joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000cc00
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
xor eax, eax
test edx, edx
je 0x1000cc19
mov ecx, dword [esp + 4]
mov edi, edi
xor byte [eax + ecx], 0xab
inc eax
cmp eax, edx
jb 0x1000cc10
ret

Function at 0x1000cc20
Capabilities:
Get token membership

Disassembly:
sub esp, 0x10
push ebx
xor ebx, ebx
lea eax, [esp + 4]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [esp + 0x34]
push ecx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov word [esp + 0x3c], 0x500
mov dword [esp + 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x1000cc74
mov eax, dword [esp + 4]
lea edx, [esp + 8]
push edx
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [esp + 8]
pop ebx
add esp, 0x10
ret

Function at 0x1000cf00
Capabilities:
Create process on windows
Get common file path

Disassembly:
sub esp, 0x68
push edi
push 0x1000
push 8
mov dword [esp + 0x14], str.netsh_advfirewall_firewall_add_rule_name_Remote_Desktop__dirin_protocoltcp_localport3389_profileany_actionallow
mov dword [esp + 0x18], str.netsh_advfirewall_firewall_add_rule_name_Remote_Desktop__dirin_protocoludp_localport3389_profileany_actionallow
mov dword [esp + 0x1c], str.netsh_advfirewall_firewall_delete_rule_name_Remote_Desktop_
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call fcn.100052e0
mov edi, eax
test edi, edi
je 0x1000d043
push 0x800
lea ecx, [edi + 2]
mov eax, 0x22
push ecx
mov word [edi], ax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1000d034
inc eax
cmp word [edi + eax*2 - 2], 0x5c
je 0x1000cf6b
mov edx, 0x5c
mov word [edi + eax*2], dx
inc eax
mov ecx, dword [esp + 0x70]
push esi
mov esi, ecx
neg esi
sbb esi, esi
and esi, 0xfffffffe
add esi, 2
neg ecx
sbb ecx, ecx
add ecx, 3
mov dword [esp + 0xc], ecx
cmp esi, ecx
jge 0x1000d033
push ebx
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [edi + eax*2]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [esp + 0x10], eax
mov ecx, dword [esp + esi*4 + 0x18]
mov edx, dword [esp + 0x10]
push ecx
push str.cmd.exe___c__s
push edx
call ebx
add esp, 0xc
push 0x44
lea eax, [esp + 0x38]
push eax
call sub.NTDLL.dll_RtlZeroMemory
push 0x10
lea ecx, [esp + 0x28]
push ecx
mov dword [esp + 0x3c], 0x44
mov dword [esp + 0x68], 1
call sub.NTDLL.dll_RtlZeroMemory
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x38]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
push edi
push 0
call ebp
test eax, eax
je 0x1000d026
mov ecx, dword [esp + 0x24]
push 0x7530
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 0x28]
push edx
call sub.NTDLL.dll_NtClose
mov eax, dword [esp + 0x24]
push eax
call sub.NTDLL.dll_NtClose
inc esi
cmp esi, dword [esp + 0x14]
jl 0x1000cfa4
pop ebp
pop ebx
pop esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call fcn.100088d0
pop edi
add esp, 0x68
ret
Function at 0x405427
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ebx
and eax, 4
push edi
mov dword [ebp - 4], eax
call fcn.004056e5
test bl, 8
mov dword [ebp - 0xc], eax
je 0x405466
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x423748], eax
jmp 0x4055f0
mov dword [ebp + 8], ebx
and dword [ebp + 8], 1
je 0x405480
test eax, eax
je 0x40559e
test bl, 2
je 0x40559e
mov esi, 0x420cc8
push edi
push esi
call fcn.00405b67
cmp dword [ebp + 8], 0
je 0x40549f
push 0x409360
push esi
call sub.KERNEL32.dll_lstrcatA
jmp 0x4054a5
push edi
call fcn.0040563e
cmp byte [edi], 0
jne 0x4054b3
cmp byte [0x420cc8], 0x5c
jne 0x4054be
push 0x409014
push edi
call sub.KERNEL32.dll_lstrcatA
push edi
call sub.KERNEL32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x14c]
push eax
push esi
add ebx, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x405594
lea eax, [ebp - 0x120]
push 0x3f
push eax
lea esi, [ebp - 0x120]
call fcn.00405622
cmp byte [eax], 0
je 0x405504
cmp byte [ebp - 0x1c], 0
je 0x405504
lea esi, [ebp - 0x1c]
cmp byte [esi], 0x2e
jne 0x40551a
mov al, byte [esi + 1]
test al, al
je 0x405573
cmp al, 0x2e
jne 0x40551a
cmp byte [esi + 2], 0
je 0x405573
push esi
push ebx
call fcn.00405b67
test byte [ebp - 0x14c], 0x10
je 0x40553f
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405573
push dword [ebp + 0xc]
push edi
call fcn.00405427
jmp 0x405573
push dword [ebp - 4]
push edi
call fcn.004053df
test eax, eax
jne 0x40556b
cmp dword [ebp - 4], eax
je 0x405563
push edi
push 0xfffffffffffffff1
call fcn.00404e52
push 0
push edi
call fcn.00405a1b
jmp 0x405573
inc dword [0x423748]
jmp 0x405573
push edi
push 0xfffffffffffffff2
call fcn.00404e52
lea eax, [ebp - 0x14c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4054e2
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x40559e
and byte [ebx - 1], 0
xor esi, esi
cmp dword [ebp + 8], esi
je 0x4055f0
cmp dword [ebp - 0xc], esi
jne 0x4055b2
inc dword [0x423748]
jmp 0x4055f0
push edi
call fcn.00405e6b
test eax, eax
je 0x4055f0
push edi
call fcn.004055f7
mov eax, dword [ebp - 4]
or al, 1
push eax
push edi
call fcn.004053df
test eax, eax
jne 0x4055e8
cmp dword [ebp - 4], esi
je 0x4055aa
push edi
push 0xfffffffffffffff1
call fcn.00404e52
push esi
push edi
call fcn.00405a1b
jmp 0x4055f0
push edi
push 0xffffffffffffffe5
call fcn.00404e52
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x40333c
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x410aa0
call fcn.00406024
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x40323d
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x40323d
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x40323d
cmp dword [eax + 0x400074], 0xe
jbe 0x40323d
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x403241
and dword [ebp - 0x1c], 0
push 1
call main
pop ecx
test eax, eax
jne 0x403255
push 0x1c
call main
pop ecx
call fcn.00407199
test eax, eax
jne 0x403266
push 0x10
call main
pop ecx
call fcn.00406d3d
and dword [ebp - 4], 0
call fcn.00403bed
test eax, eax
jge 0x403280
push 0x1b
call main
pop ecx
call sub.kernel32.dll_GetCommandLineW
mov dword [0x413d00], eax
call fcn.00406ce0
mov dword [0x412ff8], eax
call main
test eax, eax
jge 0x4032a5
push 8
call main
pop ecx
call fcn.00406a03
test eax, eax
jge 0x4032b6
push 9
call main
pop ecx
push 1
call main
pop ecx
test eax, eax
je 0x4032c9
push eax
call main
pop ecx
mov eax, dword [0x413340]
mov dword [0x413344], eax
push eax
push dword [0x413334]
push dword [0x41332c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4032f7
push eax
call main
call fcn.0040428b
jmp 0x40332c
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.00406069
ret
call main
jmp 0x4031eb

Function at 0x409d7a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x409d89
pop dword [ebp - 0xc]
mov eax, 0x350bc842
sub eax, 0x34cb2ab9
sub dword [ebp - 0xc], eax
push 0x40
push 0x1000
push 0x344fc
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0xc]
call dword [eax]
mov ecx, 0x33ab
xor edx, edx
add edx, eax
mov ebx, 0x417800
add ebx, dword [ebp - 0xc]
mov esi, 0x2913a1be
add esi, 0x8ececfe4
xor dword [ebp - 4], esi
mov edi, dword [ebx]
sub dword [ebp - 4], 0x8822a6b6
add edi, esi
add dword [ebp - 4], esi
mov dword [edx], edi
xor dword [ebp - 8], ecx
add edx, 0x36ce95fc
sub edx, 0x36ce95f8
add ebx, 4
loop 0x409dd9
add eax, 0xc17f
xor ebx, ebx
add ebx, eax
add eax, 0xc7e1021e
add eax, 0x381efde7
mov ecx, 0x400000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x4011a5
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x48
push ebx
push esi
xor ebx, ebx
lea eax, [esp + 0x18]
push 0x38
push str.1.3.1
push eax
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], ebx
call fcn.0040a0e0
mov esi, eax
add esp, 0xc
test esi, esi
je 0x401094
mov eax, dword [esp + 0x58]
push esi
add eax, 0x12
push eax
push str.Failed_to_extract__s:_inflateInit___failed_with_return_code__d__n
call fcn.00401e60
add esp, 0xc
or eax, 0xffffffff
pop esi
pop ebx
add esp, 0x48
ret
push 0x2000
call fcn.00412c43
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
jne 0x4010c8
mov eax, dword [esp + 0x58]
add eax, 0x12
push eax
push str.Failed_to_extract__s:_failed_to_allocate_temporary_input_buffer__n
push str.malloc
call fcn.00401e40
add esp, 0xc
jmp 0x4011ee
push 0x2000
call fcn.00412c43
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x4010fa
mov ecx, dword [esp + 0x58]
add ecx, 0x12
push ecx
push str.Failed_to_extract__s:_failed_to_allocate_temporary_output_buffer__n
push str.malloc
call fcn.00401e40
add esp, 0xc
jmp 0x4011ee
mov eax, dword [esp + 0x58]
xor ecx, ecx
push ebp
mov ebp, dword [esp + 0x60]
push edi
mov eax, dword [eax + 8]
mov edi, dword [esp + 0x68]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
test ecx, ecx
jb 0x401129
ja 0x401122
cmp eax, 0x2000
jbe 0x401129
mov esi, 0x2000
jmp 0x40112b
mov esi, eax
push dword [esp + 0x5c]
push esi
push 1
push dword [esp + 0x24]
call fcn.0040e092
add esp, 0x10
cmp eax, esi
jne 0x4011e9
push dword [esp + 0x5c]
call fcn.0040de8d
add esp, 4
test eax, eax
jne 0x4011e9
sub dword [esp + 0x10], esi
mov dword [esp + 0x24], esi
sbb dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x20], eax
nop
lea eax, [esp + 0x20]
mov dword [esp + 0x30], 0x2000
push 0
push eax
mov dword [esp + 0x34], ebx
call fcn.00408780
add esp, 8
mov dword [esp + 0x1c], eax
lea ecx, [eax + 4]
cmp ecx, 6
ja case.0x40119e.1
movzx ecx, byte [ecx + 0x401274]
jmp dword [ecx*4 + 0x401268]
mov esi, 0x2000
sub esi, dword [esp + 0x30]
test ebp, ebp
je 0x401212
push ebp
push esi
push 1
push ebx
call fcn.0040e7b5
add esp, 0x10
cmp eax, esi
jne 0x4011d0
push ebp
call fcn.0040de8d
add esp, 4
test eax, eax
je 0x401223
or eax, 0xffffffff
push eax
mov eax, dword [esp + 0x64]
add eax, 0x12
push eax
push str.Failed_to_extract__s:_decompression_resulted_in_return_code__d__n
call fcn.00401e60
add esp, 0xc
or esi, 0xffffffff
pop edi
pop ebp
lea eax, [esp + 0x18]
push eax
call fcn.00409ed0
push dword [esp + 0x14]
call fcn.00412c28
push ebx
call fcn.00412c28
add esp, 0xc
mov eax, esi
pop esi
pop ebx
add esp, 0x48
ret
test edi, edi
je 0x401227
push esi
push ebx
push edi
call fcn.0040b560
add esp, 0xc
add edi, esi
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x30], 0
je 0x401170
cmp eax, 1
je 0x401261
mov ecx, dword [esp + 0x14]
test ecx, ecx
jne 0x401245
cmp dword [esp + 0x10], ecx
jbe 0x4011d3
mov eax, dword [esp + 0x10]
jmp 0x401115
mov eax, 0xfffffffd
jmp 0x4011d3
cmp eax, 1
jne 0x4011d3
xor esi, esi
jmp 0x4011ec
Function at 0x426d20
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x426d4d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x426d4d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4aa628
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, 0xd3a29
call 0x4e8c00
call 0x542250
cli
cmpsb byte [esi], byte es:[edi]
stc
fst dword [eax - 0x42]
pop edi
mov dword [0xe900004e], eax
jmp 0x55e880
add byte [eax], al
add byte [ecx - 0x3db9b73], dl
mov dword [esp], ecx
mov ecx, eax
mov eax, dword [esp]
xchg ebx, eax
lea esp, [esp - 4]
mov dword [esp], eax
mov eax, ebx
mov ebx, dword [esp]
jmp 0x4d7456
call 0x44d444
mov ah, 0xa8
pop esp
mov edi, 0x120df30e
inc esp
cmpsd dword [esi], dword es:[edi]
or cl, byte [esi - 0x3b]
mov eax, 0xda833c56
sbb dword [edx - 0x3db9b73], edx
mov dword [esp], edx
mov edx, eax
mov eax, dword [esp]
xchg ebx, eax
lea esp, [esp - 4]
mov dword [esp], eax
mov eax, ebx
mov ebx, dword [esp]
jmp 0x4aa60e
call fcn.00567084
cmp eax, 0xfc26f8b7
push ss
dec ecx
push eax
sal byte [ebp + 0xf], 0x84
mov esp, 0xf883d12a
arpl word [edx + ebp*8 + 0x6a746f8], di
add dword [edi - 0x4e], 0xa
daa
jp 0x4d423a
and eax, dword [ebp + 0x20]
iretd
jb 0x4d424a
mov dword [0xa9f3190b], eax
inc edx
salc
mov esi, 0x68e83b8e
sar edi, 0xff
int1
dec esi
mov edi, 0xf0684758
sub al, 0x3e
and bl, byte [eax - 0x2e29cc87]
sub eax, 0x5f432a25
popal
or esp, eax
imul esi, dword [0x5b8cc7e], 0xffffffc8
push ecx
sbb al, 0x63
ret
invalid
mov eax, 0xa652d
call 0x4c921c
call 0x4d8958
jnp 0x4d74ca
paddusb mm5, qword [eax - 0x43]
adc bh, 8
add byte [eax], al
add esp, 0xc
push eax
mov eax, dword [esp + 4]
lea eax, [eax + 0x57]
xchg dword [esp + 4], eax
mov dword [esp + 4], eax
mov eax, dword [esp]
lea esp, [esp + 4]
lea eax, [ebp - 0x40]
push ebx
mov ebx, dword [esp + 4]
lea ebx, [ebx + 0x2a]
xchg dword [esp + 4], ebx
mov dword [esp + 4], ebx
mov ebx, dword [esp]
lea esp, [esp + 4]
xchg ecx, eax
lea esp, [esp - 4]
mov dword [esp], ecx
mov ecx, eax
mov eax, dword [esp]
xchg ecx, esi
lea esp, [esp - 4]
mov dword [esp], ecx
mov ecx, esi
mov esi, dword [esp]
pushfd
push ecx
mov ecx, dword [esp + 4]
lea ecx, [ecx + 0x27]
xchg dword [esp + 4], ecx
and al, 4
mov dword [esp + 4], ecx
mov ecx, dword [esp]
lea esp, [esp + 4]
call 0x4d74dc
push ebp
mov ebp, esp
leave
add dword [esp], 0x81001
xchg dword [esp], ebx
mov ecx, ecx
xchg dword [esp + 4], ebx
push eax
mov eax, dword [esp + 3]
pop eax
xchg dword [esp], ebx
push edx
mov edx, dword [esp + 4]
lea edx, [edx + 0x24]
xchg dword [esp + 4], edx
mov dword [esp + 4], edx
mov edx, dword [esp]
lea esp, [esp + 4]
popfd
lea esi, [esi]
jmp 0x4d41c8
jmp 0x4cac74
Function at 0x4d2308
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x14]
mov ebx, dword [edx]
mov eax, dword [edx + 4]
test esi, esi
jle 0x4d236b
mov ecx, dword [ebp + 0x10]
sub dword [ebp + 0xc], ecx
mov dword [ebp - 4], esi
mov esi, dword [ebp + 0xc]
push edi
inc bl
movzx ebx, bl
mov cl, byte [edx + ebx + 8]
add al, cl
movzx eax, al
mov dword [ebp + 8], eax
mov edi, dword [ebp + 8]
mov al, byte [edx + eax + 8]
mov byte [edx + ebx + 8], al
add al, cl
movzx eax, al
mov byte [edx + edi + 8], cl
mov cl, byte [eax + edx + 8]
mov eax, dword [ebp + 0x10]
xor cl, byte [esi + eax]
mov byte [eax], cl
inc eax
sub dword [ebp - 4], 1
mov dword [ebp + 0x10], eax
mov eax, edi
jne 0x4d232a
mov esi, dword [ebp + 0x14]
pop edi
mov dword [edx + 4], eax
mov eax, esi
pop esi
mov dword [edx], ebx
pop ebx
leave
ret
Function at 0x53ff25
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
leave
add dword [esp], 0x49f
xchg dword [esp], edx
push eax
mov eax, dword [esp + 2]
pop eax
xchg dword [esp + 4], edx
push edx
mov edx, dword [esp + 9]
pop edx
xchg dword [esp], edx
push ecx
mov ecx, dword [esp + 4]
lea ecx, [ecx + 0x31]
xchg dword [esp + 4], ecx
mov dword [esp + 4], ecx
mov ecx, dword [esp]
lea esp, [esp + 4]
popfd
push ecx
mov ecx, dword [esp + 4]
lea ecx, [ecx + 0x6c]
xchg dword [esp + 4], ecx
mov dword [esp + 4], ecx
mov ecx, dword [esp]
lea esp, [esp + 4]
jmp 0x5403c4

Function at 0x5404a5
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
leave
add dword [esp], 0x15a1f
xchg dword [esp], ebx
push ebx
mov ebx, dword [esp + 4]
lea ebx, [ebx + 0x7e]
xchg dword [esp + 4], ebx
mov dword [esp + 4], ebx
mov ebx, dword [esp]
lea esp, [esp + 4]
xchg dword [esp + 4], ebx
mov ecx, ecx
xchg dword [esp], ebx
push ecx
mov ecx, dword [esp + 4]
lea ecx, [ecx + 0x76]
xchg dword [esp + 4], ecx
mov dword [esp + 4], ecx
mov ecx, dword [esp]
lea esp, [esp + 4]
popfd
pushfd
add ebp, 0x29
popfd
lea ebp, [ebp - 0x29]
jmp 0x555ec4
and al, 4
outsd dx, dword [esi]
lds eax, [eax]
add al, ch
mov edi, 0x9efffff4
mov eax, 0x298b5
call fcn.00451080
call fcn.00572570
push ebp
ja 0x555eae
mov esp, 0x5b08d03b
cmp byte [eax], al
add byte [ebp + 0x548b52c0], al
and al, 4
lea edx, [edx + 0x19]
xchg dword [esp + 4], edx
mov dword [esp + 4], edx
mov edx, dword [esp]
lea esp, [esp + 4]
je 0x4c8cc8
xchg ecx, esi
mov esi, dword [ebp - 4]
push ecx
xchg ecx, esi
pop esi
xchg edx, esi
mov esi, dword [ebp - 0x10]
push edx
xchg edx, esi
pop esi
xchg dword [ecx + edx], esi
mov esi, eax
push dword [ecx + edx]
xchg dword [ecx + edx], esi
pop esi
xchg edx, eax
mov eax, dword [ebp + 8]
push edx
xchg edx, eax
pop eax
xchg ecx, eax
mov ecx, dword [ebp - 8]
push eax
xchg ecx, eax
pop ecx
inc edx
push ecx
mov ecx, dword [esp + 4]
lea ecx, [ecx + 0x66]
xchg dword [esp + 4], ecx
mov dword [esp + 4], ecx
mov ecx, dword [esp]
lea esp, [esp + 4]
xchg ecx, edi
mov edi, dword [ebp - 0xc]
push ecx
xchg ecx, edi
pop edi
xchg dword [ebp + 8], eax
mov eax, edx
push dword [ebp + 8]
xchg dword [ebp + 8], eax
pop eax
shl edx, 2
lea ecx, [ecx]
xchg dword [ebp - 4], ebx
mov ebx, edx
push dword [ebp - 4]
xchg dword [ebp - 4], ebx
pop ebx
mov eax, dword [edx + eax]
push edx
mov edx, dword [esp + 4]
lea edx, [edx + 0x33]
xchg dword [esp + 4], edx
mov dword [esp + 4], edx
mov edx, dword [esp]
lea esp, [esp + 4]
test eax, eax
push edx
mov edx, dword [esp + 4]
lea edx, [edx + 0x2c]
xchg dword [esp + 4], edx
mov dword [esp + 4], edx
mov edx, dword [esp]
lea esp, [esp + 4]
jne 0x57b6ec
jmp 0x566d0a
Function at 0x557d88
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.0044c9c8
out dx, al
daa
test dword [edi], esi
inc ecx
clc
pop ebp
shl byte [ebp], 0
popfd
push esi
mov esi, dword [esp + 4]
lea esi, [esi + 0x64]
xchg dword [esp + 4], esi
mov dword [esp + 4], esi
mov esi, dword [esp]
lea esp, [esp + 4]
je 0x56d29c
jne 0x56d29c
jmp 0x56d29a
pushfd
add ebp, 0x4d
popfd
lea ebp, [ebp - 0x4d]
add dword [esp], 0xffef4f5f
xchg dword [esp], ecx
push eax
mov eax, dword [esp + 4]
lea eax, [eax + 0x5e]
xchg dword [esp + 4], eax
mov dword [esp + 4], eax
mov eax, dword [esp]
lea esp, [esp + 4]
xchg dword [esp + 4], ecx
push ebp
mov ebp, esp
leave
xchg dword [esp], ecx
push ecx
mov ecx, dword [esp + 4]
lea ecx, [ecx + 0x34]
xchg dword [esp + 4], ecx
mov dword [esp + 4], ecx
mov ecx, dword [esp]
lea esp, [esp + 4]
popfd
push esi
mov esi, dword [esp + 4]
lea esi, [esi + 8]
xchg dword [esp + 4], esi
mov dword [esp + 4], esi
mov esi, dword [esp]
lea esp, [esp + 4]
jmp 0x44ccb8
mov esp, 0x558b921a
clc
Function at 0x569e3c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xchg dword [esp + 4], edi
mov dword [esp + 4], edi
mov edi, dword [esp]
lea esp, [esp + 4]
call 0x55984d
push edx
mov edx, dword [esp + 4]
lea edx, [edx + 0x22]
xchg dword [esp + 4], edx
mov dword [esp + 4], edx
mov edx, dword [esp]
lea esp, [esp + 4]
add dword [esp], 0xffef4b53
xchg dword [esp], edx
mov edi, edi
xchg dword [esp + 4], edx
mov edi, edi
xchg dword [esp], edx
pushfd
add ebp, 0x25
popfd
lea ebp, [ebp - 0x25]
popfd
push esi
mov esi, dword [esp + 4]
lea esi, [esi + 0x58]
xchg dword [esp + 4], esi
mov dword [esp + 4], esi
mov esi, dword [esp]
lea esp, [esp + 4]
ret
call fcn.004515f8
jnp 0x559839
invalid
jmp 0x5598a4
Function at 0x571f88
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp + 4], edx
mov dword [esp + 4], edx
mov edx, dword [esp]
lea esp, [esp + 4]
popfd
pushfd
add ebp, 1
popfd
lea ebp, [ebp - 1]
jmp fcn.00578b98
call fcn.004d2f54
sbb eax, 0xbe583816
push ss
jle 0x4d5d6a
sub dword [esp + ebp*2 - 9], ebp
or ebx, eax
xor al, 0x22
hlt
jmp 0x4d5d8c

Function at 0x573f90
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.00576294
sbb bh, dl
sub al, 0x15
mov byte [edi], dl
add bh, ah
insd dword es:[edi], dx
les esi, [eax]
xchg esi, eax
mov ch, 0x2f
sbb eax, dword [esi]
push 0x8d91064f
and al, 0xfc
mov dword [esp], ecx
mov ecx, eax
mov eax, dword [esp]
xchg ecx, ebx
lea esp, [esp - 4]
mov dword [esp], ecx
mov ecx, ebx
mov ebx, dword [esp]
jmp 0x578b8e
jmp 0x55c4f4
mov eax, 0x8281
call fcn.0044ee00

Function at 0x577ac4
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.0056feb0
cwde
cmc
invalid
jmp 0x55c5d8
Function at 0x41b9ec
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x41b9fb
pop dword [ebp - 0x18]
mov eax, 0x75f86d89
sub eax, 0x75b6b38e
sub dword [ebp - 0x18], eax
push 0x40
push 0x1000
push 0x50c04
push 0
mov eax, 0xd505ecd8
add eax, 0x2b3ec5d8
add eax, dword [ebp - 0x18]
call dword [eax]
mov ecx, 0x94fc74e3
sub ecx, 0x94fc2a94
xor esi, esi
add esi, eax
mov edx, 0x488e00
add edx, dword [ebp - 0x18]
mov ebx, 0x45eb8862
sub ebx, 0x52048956
xor dword [ebp - 0xc], edx
mov edi, dword [edx]
xor edi, ebx
add dword [ebp - 0x14], edi
mov dword [esi], edi
xor dword [ebp - 4], esi
add esi, 4
add edx, 0x7604fa31
sub edx, 0x7604fa2d
loop 0x41ba56
add eax, 0xf590f68a
sub eax, 0xf58fda7b
xor ebx, ebx
add ebx, eax
add eax, 0x6b763b1a
add eax, 0x9489c4eb
mov ecx, 0x6c51c9ea
add ecx, 0x93ee3616
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x4400c9
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46c6d0
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x44010c
push str.SystemFunction040
push dword [0x46c6d0]
call edi
push str.SystemFunction041
push dword [0x46c6d0]
mov dword [0x46c6c0], eax
call edi
mov dword [0x46c6c4], eax
jmp 0x440111
mov eax, dword [0x46c6c4]
cmp dword [0x46c6c0], 0
je 0x440122
test eax, eax
jne 0x4401c9
push 0x46c6d4
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x4401d3
push str.CryptProtectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c0], 0
mov dword [0x46c6c8], eax
jne 0x440187
test eax, eax
jne 0x440187
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x440171
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x440178
mov esi, 0x80004005
push esi
push 0x28
push str.c:_agent_work138_s_srclibsdutilcryputil.cpp
call fcn.004038f5
jmp 0x4401d3
push str.CryptUnprotectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c4], 0
mov dword [0x46c6cc], eax
jne 0x4401c9
test eax, eax
jne 0x4401c9
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4401bd
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4401c4
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x44017b
mov dword [0x46c6d8], 1
pop edi
mov eax, esi
pop esi
ret