joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403140
Capabilities:
Compute adler32 checksum
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, dword [esp + 0x2c]
test ebp, ebp
je 0x403316
mov esi, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x40330f
mov dword [esp], ebp
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov ebx, esi
sub ebx, eax
jmp 0x4031cf
mov eax, dword [esp + 4]
add dword [esp], eax
mov esi, dword [esp + 0xc]
mov eax, edi
mov ebp, 0x80078071
mul ebp
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mul ebp
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp + 8]
mov ebx, 0x15b0
je 0x40330f
xor ebp, ebp
cmp ebx, 8
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
jb 0x40326c
mov eax, ebx
and eax, 0x1ff8
mov dword [esp + 4], eax
xor edx, edx
mov ebp, dword [esp]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, edx
movzx ebx, byte [ebp + edx]
add ebx, edi
mov edx, ebx
and edx, ecx
xor ecx, ebx
movzx esi, byte [ebp + eax + 1]
add esi, ebx
mov ebx, dword [esp + 8]
movzx edi, byte [ebp + eax + 2]
add edi, esi
add esi, ecx
lea ecx, [esi + edx*2]
movzx edx, byte [ebp + eax + 3]
add edx, edi
add ecx, edi
movzx esi, byte [ebp + eax + 4]
add esi, edx
add ecx, edx
movzx edx, byte [ebp + eax + 5]
add edx, esi
add ecx, esi
movzx esi, byte [ebp + eax + 6]
add esi, edx
add ecx, edx
movzx edi, byte [ebp + eax + 7]
add edi, esi
add ecx, esi
add ecx, edi
lea edx, [eax + 8]
add eax, 0xf
cmp eax, ebx
jb 0x403200
add ebp, edx
mov dword [esp], ebp
mov esi, dword [esp + 0xc]
mov ebp, dword [esp + 4]
mov eax, ebx
sub eax, ebp
jbe 0x40319b
mov edx, ebp
not edx
add edx, ebx
mov esi, ebx
and esi, 3
mov dword [esp + 4], eax
je 0x4032be
mov dword [esp + 0x10], edx
neg esi
xor edx, edx
mov ebx, dword [esp]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [ebx]
inc ebx
add edi, eax
add ecx, edi
dec edx
cmp esi, edx
jne 0x4032a0
sub ebp, edx
mov edx, dword [esp + 0x10]
cmp edx, 3
jb 0x403190
jmp 0x4032ca
mov ebx, dword [esp]
cmp edx, 3
jb 0x403190
mov eax, dword [esp + 8]
sub eax, ebp
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [ebx + edx]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 1]
add edi, esi
add ecx, edi
movzx esi, byte [ebx + edx + 2]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 3]
add edi, esi
add ecx, edi
add edx, 4
cmp eax, edx
jne 0x4032e0
jmp 0x403190
shl ecx, 0x10
or ecx, edi
jmp 0x40331b
mov ecx, 1
mov eax, ecx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x403330
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
push ebx
push edi
push esi
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
not ebx
cmp edx, 4
jb 0x4033ac
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ebx
xor bl, byte [ecx]
shr eax, 8
movzx esi, bl
xor eax, dword [esi*4 + 0x439928]
mov ebx, eax
shr ebx, 8
xor al, byte [ecx + 1]
movzx eax, al
xor ebx, dword [eax*4 + 0x439928]
mov eax, ebx
shr eax, 8
xor bl, byte [ecx + 2]
movzx esi, bl
xor eax, dword [esi*4 + 0x439928]
mov ebx, eax
shr ebx, 8
xor al, byte [ecx + 3]
movzx eax, al
mov eax, dword [eax*4 + 0x439928]
mov esi, ebx
and esi, eax
add ebx, eax
add esi, esi
sub ebx, esi
add ecx, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x403350
test edx, edx
je 0x4033be
test dl, 1
jne 0x4033c2
mov esi, edx
cmp edx, 1
jne 0x4033ec
jmp 0x403438
mov eax, ebx
jmp 0x403438
mov eax, ebx
shr eax, 8
movzx esi, byte [ecx]
mov edi, ebx
and edi, esi
add ebx, esi
not ebx
lea ebx, [ebx + edi*2]
not ebx
movzx esi, bl
xor eax, dword [esi*4 + 0x439928]
inc ecx
lea esi, [edx - 1]
mov ebx, eax
cmp edx, 1
je 0x403438
xor edx, edx
mov eax, ebx
mov edi, eax
shr edi, 8
movzx ebx, byte [ecx + edx]
mov ebp, eax
and ebp, ebx
add eax, ebx
not eax
lea eax, [eax + ebp*2]
not eax
movzx eax, al
xor edi, dword [eax*4 + 0x439928]
mov eax, edi
shr eax, 8
movzx ebx, byte [ecx + edx + 1]
mov ebp, edi
and ebp, ebx
add edi, ebx
not edi
lea ebx, [edi + ebp*2]
not ebx
movzx edi, bl
xor eax, dword [edi*4 + 0x439928]
add edx, 2
cmp esi, edx
jne 0x4033f0
not eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4091b0
Capabilities:
Terminate process

Disassembly:
sub esp, 0x10c
call fcn.004341a0
test al, 1
jne 0x4091c1
jmp 0x40921b
call fcn.0042f920
test al, 1
jne 0x4091cc
jmp 0x409212
mov dword [esp], 0xfffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
sub esp, 4
mov dword [esp + 8], eax
jmp 0x4091e2
lea eax, [esp + 0xc]
lea ecx, str.eleet_or_leetspeak__is_a_system_of_modified_spellings_used_primarily_on_the_internet._it_often_uses_character_replacements_in_ways_that_play_on_the_similarity_of_their_glyphs_via_reflection_or_other_resemblance
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00409230
jmp 0x4091fa
call fcn.0040a600
jmp 0x409201
test al, 1
jne 0x409207
jmp 0x409210
call fcn.004117b0
jmp 0x40920e
jmp 0x409210
jmp 0x409212
call fcn.00435d50
jmp 0x409219
jmp 0x40921b
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40a4f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x40a5ef
mov ebp, dword [esp + 0x18]
xor esi, esi
mov edi, 2
jmp 0x40a528
mov ebp, ebx
mov esi, ebp
lea eax, [edi + 4]
add edi, 2
cmp edi, ecx
mov edi, eax
mov ebp, dword [esp + 0x18]
jae 0x40a5f1
movzx eax, byte [ebp + edi - 2]
push eax
call fcn.004114e0
add esp, 4
mov bh, al
movzx eax, byte [ebp + edi - 1]
push eax
call fcn.004114e0
add esp, 4
shl bh, 2
mov ah, al
shr ah, 4
and ah, 3
or ah, bh
mov ecx, esi
and ecx, 1
mov edx, esi
xor edx, 1
lea ebx, [edx + ecx*2]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
mov byte [edx + esi], ah
cmp edi, ecx
jae 0x40a510
mov byte [esp + 3], al
mov esi, ebx
movzx eax, byte [ebp + edi]
push eax
call fcn.004114e0
add esp, 4
cmp al, 0x40
jne 0x40a590
mov ebp, esi
mov ecx, dword [esp + 0x1c]
jmp 0x40a512
mov bh, al
movzx ecx, byte [esp + 3]
shl cl, 4
shr al, 2
and al, 0xf
or al, cl
lea ebp, [esi + 1]
mov ecx, dword [esp + 0x20]
mov byte [ecx + esi], al
lea eax, [edi + 1]
mov ecx, dword [esp + 0x1c]
cmp eax, ecx
jae 0x40a512
mov eax, dword [esp + 0x18]
movzx eax, byte [eax + edi + 1]
push eax
call fcn.004114e0
mov ecx, dword [esp + 0x20]
add esp, 4
cmp al, 0x40
je 0x40a512
shl bh, 6
add al, bh
mov edx, dword [esp + 0x20]
mov byte [edx + esi + 1], al
add esi, 2
mov ebp, esi
jmp 0x40a512
xor esi, esi
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x415bb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov ebp, dword [esp + 0x4c]
mov eax, dword [esp + 0x48]
mov edi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebp + edi + 2], 0
lea edi, [edi + 2]
jne 0x415bd0
mov esi, dword [eax + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x415bf0
sar edi, 1
sar eax, 1
lea ecx, [edi + eax]
add ecx, 2
test ecx, ecx
jns 0x415c10
mov eax, 0xffffffff
jmp 0x415c17
add eax, edi
add eax, eax
add eax, 4
push eax
call fcn.00408c10
add esp, 4
movzx ecx, word [esi]
mov ebx, eax
test cx, cx
je 0x415c41
add esi, 2
mov ebx, eax
nop
mov word [ebx], cx
add ebx, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x415c30
mov word [ebx], 0x5c
add ebx, 2
movzx ecx, word [ebp]
test cx, cx
je 0x415c71
lea edx, [ebp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx], cx
add ebx, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x415c60
mov word [ebx], 0
lea ecx, [esp + 8]
push 0x20
push 1
push 3
push 0x120089
push ecx
mov dword [esp + 0x38], eax
push eax
call fcn.00437150
add esp, 0x18
not eax
shr eax, 0x1f
mov eax, dword [eax*4 + 0x43e464]
mov ecx, 0xde4ed300
xor ecx, dword [0x43e46c]
add eax, ecx
inc eax
xor ebx, ebx
jmp eax
Function at 0x41c740
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
mov eax, 0x2230
call fcn.00408be0
mov esi, esp
mov dword [esi + 0x1220], 0x63d061dc
mov dword [esi + 0x1224], 0x67216521
mov dword [esi + 0x1228], 0x6bd96921
mov dword [esi + 0x122c], 0x6fdc6dd8
mov dword [esi + 0x1230], 0x53ee51e9
mov dword [esi + 0x1234], 0x57e555e1
mov dword [esi + 0x1238], 0x5be8591d
mov dword [esi + 0x123c], 0x5d5c
mov dword [esi + 0xb0], 0
mov eax, dword [esi + 0xb0]
cmp eax, 0x1f
ja 0x41c80d
nop
nop
nop
nop
nop
nop
mov eax, dword [esi + 0xb0]
mov ecx, dword [esi + 0xb0]
movzx ecx, byte [esi + ecx + 0x1220]
mov edx, eax
and edx, 0xc7969dd0
xor eax, 0xc7969dd0
lea edx, [eax + edx*2]
lea eax, [edx + ecx]
and edx, ecx
add edx, edx
sub eax, edx
add al, 0x50
mov ecx, dword [esi + 0xb0]
mov byte [esi + ecx + 0x1220], al
inc dword [esi + 0xb0]
mov eax, dword [esi + 0xb0]
cmp eax, 0x20
jb 0x41c7c0
lea eax, [esi + 0x40]
lea edi, [esi + 0x1220]
push 0
push 0
push eax
push 0x20019
push edi
call fcn.004378a0
add esp, 0x14
shr eax, 0x1f
mov eax, dword [eax*4 + 0x43ff78]
mov ecx, 0x2b4a66a4
xor ecx, dword [0x43ff80]
add eax, ecx
inc eax
jmp eax
Function at 0x42b7d0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov esi, esp
call fcn.004117a0
push eax
mov edi, esp
push eax
mov eax, esp
push eax
mov ecx, esp
push eax
mov dword [esi + 0x1c], esp
push eax
mov dword [esi + 0x18], esp
sub esp, 0x20
mov ebx, esp
and ebx, 0xfffffff0
mov esp, ebx
jmp 0x42b800
push eax
mov dword [esi + 0x2c], esp
push eax
mov edx, dword [ebp + 8]
mov dword [edi], edx
mov byte [eax], 0
mov dword [esi + 0x10], ecx
mov dword [esi + 0x20], eax
jmp 0x42b815
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, 0
setne al
test al, 1
jne 0x42b836
jmp 0x42b98b
sub esp, 4
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ecx, dword [esi + 0x10]
mov dword [ecx], eax
cmp dword [ecx], 0
setne al
test al, 1
jne 0x42b85a
jmp 0x42b97f
mov eax, dword [ecx]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [esi + 0x1c]
mov dword [ecx], eax
mov eax, dword [ecx]
sub esp, 4
mov dword [esp], eax
call fcn.00408d20
add esp, 4
mov ecx, dword [esi + 0x18]
mov dword [ecx], eax
cmp dword [ecx], 0
setne al
test al, 1
mov eax, dword [esi + 0x10]
jne 0x42b894
jmp 0x42b969
call fcn.004117a0
mov ecx, dword [edi]
mov eax, dword [esi + 0x18]
mov edx, dword [eax]
mov eax, dword [esi + 0x1c]
mov edi, dword [eax]
mov eax, dword [esi + 0x2c]
mov al, byte [eax]
mov byte [esi + 0x14], al
mov byte [ebx], 0x9b
mov byte [ebx + 1], 0xad
mov byte [ebx + 2], 0xb3
mov byte [ebx + 3], 0xab
mov byte [ebx + 4], 0x86
mov byte [ebx + 5], 0x92
mov byte [ebx + 6], 0x87
mov byte [ebx + 7], 0x95
mov byte [ebx + 8], 0x8c
mov byte [ebx + 9], 0xd7
mov byte [ebx + 0xa], 0x9e
mov byte [ebx + 0xb], 0x9b
mov byte [ebx + 0xc], 0x90
mov byte [ebx + 0xd], 0xed
mov word [ebx + 0x12], 0
mov dword [ebx + 0xe], 0
mov dword [esi + 0xc], 0
mov eax, dword [esi + 0xc]
cmp eax, 0x14
jae 0x42b946
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edx
jmp 0x42b908
mov edx, dword [esi + 0xc]
mov edi, dword [esi + 0xc]
movzx edi, byte [ebx + edi]
mov eax, edx
add eax, 0xc519415c
lea edx, [edx + edi - 0x3ae6bea4]
and eax, edi
add eax, eax
sub edx, eax
add dl, 0x7c
mov eax, dword [esi + 0xc]
mov byte [ebx + eax], dl
mov eax, dword [esi + 0xc]
inc eax
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
cmp eax, 0x14
jb 0x42b908
mov edx, dword [esi + 0x28]
mov edi, dword [esi + 0x24]
jmp 0x42b946
jmp 0x42b948
sub esp, 0xc
mov dword [esp], ebx
mov dword [esp + 4], edi
mov dword [esp + 8], edx
call fcn.00409460
and al, 1
mov ecx, dword [esi + 0x20]
mov byte [ecx], al
mov eax, dword [esi + 0x10]
jmp 0x42b967
jmp 0x42b969
jmp 0x42b96b
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x42b97b
jmp 0x42b97d
jmp 0x42b97f
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x42b987
jmp 0x42b989
jmp 0x42b98b
mov eax, dword [esi + 0x20]
mov al, byte [eax]
and al, 1
movzx eax, al
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x431130
Capabilities:
Encode data using xor
Hash data using sha1
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x5c
mov ebp, dword [esp + 0x74]
mov eax, dword [esp + 0x70]
mov dword [esp + 0x14], 0xc3d2e1f0
mov dword [esp + 0x10], 0x10325476
mov dword [esp + 0xc], 0x98badcfe
mov dword [esp + 8], 0xefcdab89
mov dword [esp + 4], 0x67452301
cmp ebp, 0x40
jb 0x4311ed
mov edi, ebp
shr edi, 6
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebp, eax
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [ebp + esi]
mov dword [esp + esi + 0x1c], eax
movzx ecx, byte [ebp + esi + 1]
shl ecx, 8
or ecx, eax
mov dword [esp + esi + 0x1c], ecx
movzx eax, byte [ebp + esi + 2]
shl eax, 0x10
or eax, ecx
mov dword [esp + esi + 0x1c], eax
movzx ecx, byte [ebp + esi + 3]
shl ecx, 0x18
or ecx, eax
mov dword [esp + esi + 0x1c], ecx
add esi, 4
cmp esi, 0x40
jne 0x431190
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 8]
push eax
call fcn.004317f0
add esp, 8
inc ebx
lea eax, [esi + ebp]
cmp ebx, edi
jne 0x431180
add ebp, esi
mov eax, ebp
mov ebp, dword [esp + 0x74]
mov dword [esp + 0x58], 0
mov dword [esp + 0x54], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov ecx, ebp
and ecx, 0x3f
mov dword [esp], ecx
je 0x4312e4
mov ecx, ebp
and ecx, 1
xor edi, edi
cmp dword [esp], 1
je 0x4312cd
mov dword [esp + 0x18], ecx
sub dword [esp], ecx
xor ebx, ebx
xor edi, edi
nop
movzx ebp, byte [eax + edi]
mov ecx, ebx
and cl, 0x10
shl ebp, cl
mov edx, edi
and edx, 0xfffffffc
xor ebp, dword [esp + edx + 0x1c]
mov dword [esp + edx + 0x1c], ebp
movzx esi, byte [eax + edi + 1]
or cl, 8
shl esi, cl
xor esi, ebp
mov dword [esp + edx + 0x1c], esi
add edi, 2
add ebx, 0x10
cmp dword [esp], edi
jne 0x431290
add eax, edi
mov ebp, dword [esp + 0x74]
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x4312e4
movzx eax, byte [eax]
lea ecx, [edi*8]
shl eax, cl
and edi, 0xfffffffc
xor dword [esp + edi + 0x1c], eax
lea ebx, [ebp*8]
mov ecx, ebx
and cl, 0x18
or cl, 7
mov eax, 1
shl eax, cl
mov ecx, ebp
and ecx, 0x3c
xor dword [esp + ecx + 0x1c], eax
mov esi, dword [esp + 0x78]
mov eax, ebp
not eax
test al, 0x38
jne 0x431335
lea edi, [esp + 0x1c]
lea eax, [esp + 4]
push edi
push eax
call fcn.004317f0
add esp, 8
xor eax, eax
mov ecx, 0x10
rep stosd dword es:[edi], eax
lea edi, [esp + 0x5c]
xor eax, eax
xor ecx, ecx
rep stosw word es:[edi], ax
mov dword [esp + 0x54], ebx
shr ebp, 0x1d
mov dword [esp + 0x58], ebp
lea eax, [esp + 0x1c]
lea ecx, [esp + 4]
push eax
push ecx
call fcn.004317f0
add esp, 8
mov eax, dword [esp + 4]
mov dword [esi], eax
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
mov eax, dword [esp + 0xc]
mov dword [esi + 8], eax
mov eax, dword [esp + 0x10]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 0x10], eax
add esp, 0x5c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x437150
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x48
mov ebp, dword [esp + 0x5c]
mov edi, 0xfffffffe
cmp word [ebp + edi + 2], 0
lea edi, [edi + 2]
jne 0x437160
cmp edi, 0xfffffff5
jge 0x437177
mov eax, 0xffffffff
jmp 0x43717a
lea eax, [edi + 0xa]
push eax
call fcn.00408c10
add esp, 4
mov esi, eax
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
add eax, 8
movzx ecx, word [ebp]
test cx, cx
je 0x4371c2
add ebp, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [ebp]
add ebp, 2
test cx, cx
jne 0x4371b0
mov word [eax], 0
and edi, 0xfffffffe
lea eax, [edi + 8]
mov word [esp + 0x18], ax
add edi, 0xa
mov word [esp + 0x1a], di
mov dword [esp + 0x1c], esi
mov dword [esp + 0x28], 0x18
mov dword [esp + 0x2c], 0
mov dword [esp + 0x34], 0x40
lea eax, [esp + 0x18]
mov dword [esp + 0x30], eax
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov ecx, dword [0x4461ac]
mov edi, 0xffffffff
test ecx, ecx
je 0x43731d
mov eax, dword [0x4461b0]
add eax, 8
nop
nop
nop
nop
nop
nop
nop
cmp dword [eax - 8], 0xb1cf12ba
je 0x437244
add eax, 0xc
dec ecx
jne 0x437230
jmp 0x43731d
mov byte [esp + 0x14], 0
mov dword [esp + 0x10], 0x900000c2
mov dword [esp + 0xc], 0xd2ff0000
mov dword [esp + 8], 0xba00
mov dword [esp + 4], 0xb8
lea ebx, [esp + 0x14]
mov eax, dword [eax]
mov dword [esp + 5], eax
mov eax, dword [0x4461b4]
mov dword [esp + 0xa], eax
mov word [esp + 0x11], 0x2c
mov dword [esp], 0
mov dword [esp + 0x24], 0x10
lea eax, [esp + 0x24]
mov ebp, esp
push 0x40
push 0x3000
push eax
push 0
push ebp
push 0xffffffffffffffff
call dword [0x4461b8]
mov eax, dword [esp]
lea edx, [esp + 4]
mov edi, eax
mov ecx, 4
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
add eax, 0x10
xor ecx, ecx
mov edi, eax
xchg esi, ebx
rep movsw word es:[edi], word [esi]
xchg esi, ebx
lea ecx, [esp + 0x40]
lea eax, [esp + 0x28]
push 0
push 0
push dword [esp + 0x78]
push dword [esp + 0x78]
push dword [esp + 0x78]
push 0x80
push 0
push ecx
push eax
push dword [esp + 0x88]
push dword [esp + 0x88]
call dword [esp + 0x2c]
mov edi, eax
mov dword [esp + 0x20], 0
lea eax, [esp + 0x20]
push 0x8000
push eax
push ebp
push 0xffffffffffffffff
call dword [0x4461bc]
push esi
call fcn.00408c20
add esp, 4
mov eax, edi
add esp, 0x48
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x660a23a4
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
mov ecx, edx
mov dword [ebp - 4], 0x20
mov edx, dword [ecx]
test edx, edx
jne 0x660a2415
mov dword [ebp - 0x10], ebx
mov ebx, eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], edi
mov edx, 0x20
mov esi, ecx
push edx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [esi], eax
test eax, eax
je 0x660a2456
mov dword [ebp - 0xc], 0x400
lea ecx, [ebp - 4]
lea edx, [ebp - 0x818]
lea eax, [ebp - 0xc]
lea edi, [ebp - 8]
push edi
push eax
push edx
push ecx
push dword [esi]
push ebx
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x660a241b
mov edi, dword [esi]
test edi, edi
je 0x660a2434
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x18]
xor eax, eax
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x660a2439
push dword [esi]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi], 0
mov edx, dword [ebp - 4]
jmp 0x660a23ce
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x18]
push 0
push eax
call fcn.660a2840
add esp, 8
mov eax, 0x67
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push eax
call fcn.660a2840
add esp, 8
mov eax, 0x6a
mov esp, ebp
pop ebp
ret
Function at 0x660a3214
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
test ecx, ecx
je 0x660a33ae
xor edi, edi
mov esi, dword [ebp + 0x10]
mov eax, 0xaaaaaaab
mul esi
shr edx, 1
test edx, edx
je 0x660a32d2
mov dword [ebp - 4], edx
mov dword [ebp - 0x14], edi
movzx edx, byte [ebx]
movzx esi, byte [ebx + 1]
movzx edi, byte [ebx + 2]
mov eax, edx
and eax, 0xfc
shr eax, 2
movzx eax, word [eax*2 + 0x660c54c0]
mov word [ecx], ax
and edx, 3
shl edx, 4
mov eax, esi
and eax, 0xf0
shr eax, 4
or edx, eax
movzx edx, word [edx*2 + 0x660c54c0]
mov word [ecx + 2], dx
and esi, 0xf
add esi, esi
add esi, esi
mov edx, edi
and edx, 0xc0
shr edx, 6
or esi, edx
and edi, 0x3f
movzx edx, word [esi*2 + 0x660c54c0]
mov word [ecx + 4], dx
movzx edx, word [edi*2 + 0x660c54c0]
mov word [ecx + 6], dx
add ebx, 3
add ecx, 8
mov edx, dword [ebp - 4]
add edx, 0xffffffff
mov dword [ebp - 4], edx
test edx, edx
jne 0x660a324f
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp + 0x10]
mov eax, 0xaaaaaaab
mul esi
shr edx, 1
lea eax, [edx + edx]
add eax, edx
sub esi, eax
cmp esi, 2
jne 0x660a3346
movzx edx, byte [ebx]
movzx esi, byte [ebx + 1]
mov ebx, edx
and ebx, 0xfc
shr ebx, 2
and edx, 3
movzx ebx, word [ebx*2 + 0x660c54c0]
mov word [ecx], bx
shl edx, 4
mov ebx, esi
and ebx, 0xf0
shr ebx, 4
or edx, ebx
movzx edx, word [edx*2 + 0x660c54c0]
lea ebx, [ecx + 2]
mov word [ecx + 2], dx
and esi, 0xf
movzx edx, word [esi*8 + 0x660c54c0]
mov word [ecx + 4], dx
add ecx, 8
mov edx, 0x3d
mov word [ebx + 4], dx
jmp 0x660a338a
cmp esi, 1
jne 0x660a338a
movzx esi, byte [ebx]
mov edx, esi
and edx, 0xfc
shr edx, 2
and esi, 3
add esi, esi
movzx ebx, word [edx*2 + 0x660c54c0]
mov word [ecx], bx
add esi, esi
movzx edx, word [esi*8 + 0x660c54c0]
lea ebx, [ecx + 2]
mov word [ecx + 2], dx
mov edx, 0x3d
mov word [ecx + 4], dx
add ecx, 8
mov word [ebx + 4], dx
test edi, edi
je 0x660a3393
xor edx, edx
mov word [ecx], dx
mov edx, dword [ebp + 0x14]
sub ecx, dword [edx]
mov ebx, dword [ebp + 0x18]
sar ecx, 1
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov dword [ebx], ecx
mov ebx, dword [ebp - 0x10]
xor eax, eax
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0x10]
push 0
lea esi, [ecx + 2]
mov eax, 0xaaaaaaab
mul esi
shr edx, 1
mov eax, dword [ebp + 8]
add edx, edx
lea edi, [edx + edx + 1]
add edi, edi
push edi
push eax
mov eax, dword [ebp + 8]
call dword [eax + 0xc]
add esp, 0xc
mov ecx, eax
test ecx, ecx
je 0x660a33ea
mov edx, dword [ebp + 0x14]
mov dword [edx], ecx
mov edi, 1
jmp 0x660a3235
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov eax, 0x803fc002
mov esp, ebp
pop ebp
ret
Function at 0x660a869c
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call section.HTSTACK_
mov dword [ebp - 4], edi
mov dword [ebp - 8], ebx
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebx + 0x14]
push 0x660c1060
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.660a8528
add esp, 0xc
lea eax, [ebp - 0x1008]
push 0x800
push eax
push 0x660c584c
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x660a8706
lea eax, [ebp - 0x1008]
mov edx, ebx
call fcn.660a881c
movzx eax, al
test eax, eax
je 0x660a8706
mov ebx, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov eax, 1
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1008]
push 0x800
push eax
mov dword [ebx + 0x14], edi
push 0x660c5048
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x660a8747
lea eax, [ebp - 0x1008]
mov edx, ebx
call fcn.660a881c
movzx eax, al
test eax, eax
je 0x660a8747
mov ebx, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov eax, 1
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1008]
push 0x800
push eax
mov dword [ebx + 0x14], edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, eax
test eax, eax
jbe 0x660a8783
lea edi, [eax - 1]
jbe 0x660a8783
movzx eax, word [ebp + edi*2 - 0x1008]
cmp eax, 0x5c
je 0x660a8802
mov eax, edi
add edi, 0xffffffff
test eax, eax
ja 0x660a8769
lea eax, [ebp - 0x1008]
add edi, edi
lea ecx, [eax + edi]
mov eax, 0x660c5858
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov edx, dword [eax + 0xc]
mov dword [ecx + 0xc], edx
mov edx, dword [eax + 0x10]
movzx eax, word [eax + 0x14]
mov dword [ecx + 0x10], edx
mov word [ecx + 0x14], ax
lea eax, [ebp - 0x1008]
xor ecx, ecx
mov word [ebp + edi - 0xff2], cx
mov edx, ebx
call fcn.660a881c
movzx eax, al
test eax, eax
je 0x660a87f6
lea eax, [ebp - 0x1008]
push eax
push 0x660c5048
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov eax, 1
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 8]
mov edi, dword [ebp - 4]
xor eax, eax
mov esp, ebp
pop ebp
ret
add edi, 1
xor eax, eax
mov word [ebp + edi*2 - 0x1008], ax
jmp 0x660a8783