joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401666
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
push edx
push esi
push edi
enter 0x84, 0
sub ebp, 0x82
mov esi, eax
mov eax, dword [0x404050]
or al, 1
imul eax, esi
mov edx, dword [0x404050]
mov ebx, esi
sub edx, eax
mov eax, 0x404054
call fcn.004015d7
xor eax, eax
mov dword [ebp + 0x7e], eax
lea eax, [ebp + 0x7e]
push eax
mov eax, esi
or al, 0x40
mov edi, 0x403111
push eax
sub edi, fcn.004028ab
push edi
push fcn.004028ab
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
cmp dword [ebp + 0x7e], 0
je 0x40172c
mov eax, fcn.004028ab
mov ebx, esi
jmp 0x401714
mov edx, edi
call fcn.004015d7
mov edx, 0x1c000
mov eax, 0x404054
mov ebx, esi
call fcn.00402644
lea edx, [ebp - 2]
mov eax, esi
mov dword [ebp - 2], 0
call fcn.00402354
lea eax, [esi + 0x1c000]
mov ebx, 0x404054
mov cl, al
mov edi, esi
or bl, 1
shl edi, cl
xor edx, edx
add edi, eax
mov eax, esi
div ebx
lea ebx, [ebp - 2]
add eax, 0x404054
mov edx, edi
call fcn.004028ab
lea esp, [ebp + 0x82]
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret

Function at 0x433000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x407d61
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
cmp dword [0x4110b0], 0xffffffff
jne 0x407d85
push 0
jmp loc.00429000
push ebx
push esi
push edi
push dword [ebp + 0xc]
call fcn.00405451
push dword [ebp + 0x10]
mov esi, eax
call fcn.00405451
mov edx, dword [ebp + 0xc]
mov ebx, eax
lea eax, [ebp - 0x68]
push eax
call fcn.00405511
add esp, 0xc
push 0xa
pop ecx
cmp esi, ecx
jae 0x407dc3
sub ecx, esi
xor eax, eax
shr ecx, 1
lea edi, [ebp + esi*2 - 0x68]
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov edx, dword [ebp + 0x10]
lea eax, [ebp - 0x54]
push eax
call fcn.00405511
pop ecx
push 0x32
lea eax, [ebx + 0xa]
pop ecx
cmp eax, ecx
jae 0x407deb
sub ecx, eax
lea edi, [ebp + eax*2 - 0x68]
xor eax, eax
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
xor esi, esi
xor eax, eax
xor byte [ebp + eax - 0x68], 0x78
inc eax
cmp eax, 0x64
jb 0x407def
mov eax, dword [ebp + 8]
imul eax, eax, 0x64
push esi
push esi
push eax
push dword [0x4110b0]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
lea eax, [ebp - 4]
push eax
push 0x64
lea eax, [ebp - 0x68]
push eax
push dword [0x4110b0]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x407e2b
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
cmp dword [0x4110b0], 0xffffffff
push esi
mov esi, eax
jne 0x407e4e
push 1
call fcn.00407cd7
cmp dword [0x4110b0], 0xffffffff
pop ecx
je 0x407eba
imul esi, esi, 0x64
push 0
push 0
push esi
push dword [0x4110b0]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 4]
push eax
push 0x64
lea eax, [ebp - 0x6c]
push eax
push dword [0x4110b0]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x407eba
cmp dword [ebp - 4], 0x64
jne 0x407eba
xor eax, eax
xor byte [ebp + eax - 0x6c], 0x78
inc eax
cmp eax, 0x64
jb 0x407e86
push dword [ebp + 8]
and word [ebp - 8], 0
lea eax, [ebp - 0x6c]
call fcn.00405493
pop ecx
lea ecx, [ebp - 0x6c]
cmp eax, ecx
jne 0x407eba
push dword [ebp + 0xc]
lea edx, [ebp - 0x58]
call fcn.00405511
xor eax, eax
pop ecx
inc eax
jmp 0x407ebc
xor eax, eax
pop esi
leave
ret
Function at 0x4024cf
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov edi, ecx
push 8
pop esi
mov ebp, dword [edi]
test ebp, ebp
je 0x402534
mov ebx, dword [edi + 4]
test ebx, ebx
je 0x402534
cmp ebx, esi
jb 0x402534
cmp ebx, 0x10
jb 0x402534
mov ecx, dword [esi + ebp]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shr edx, 8
shl eax, 8
or edx, eax
lea eax, [edx + 0xc]
add eax, esi
cmp eax, ebx
ja 0x402534
cmp dword [esi + ebp + 4], 0x54414449
je 0x40253f
mov esi, eax
lea eax, [esi + 8]
cmp eax, ebx
jbe 0x4024f1
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
lea ecx, [esi + ebp]
cmp edx, 5
jb 0x402534
mov ebp, dword [ecx + 8]
sub edx, 4
add ecx, 0xc
mov al, byte [ecx]
movzx esi, al
cmp esi, edx
ja 0x402534
test al, al
jne 0x402576
mov eax, dword [edi + 8]
test eax, eax
je 0x402534
mov esi, dword [edi + 0xc]
test esi, esi
je 0x402534
mov dword [esp + 0x10], eax
dec edx
mov dword [esp + 0x14], esi
jmp 0x402591
lea eax, [ecx + 1]
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], eax
lea eax, [esi + 1]
cmp edx, eax
jb 0x402534
or eax, 0xffffffff
sub eax, esi
add edx, eax
add ecx, esi
and dword [esp + 0x20], 0
lea eax, [ecx + 1]
lea ecx, [esp + 0x10]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
call fcn.00401aaa
test eax, eax
je 0x402534
mov esi, dword [esp + 0x1c]
xor edx, edx
mov ecx, dword [esp + 0x20]
mov ebx, 0x811c9dc5
test esi, esi
je 0x4025d2
movzx eax, byte [edx + ecx]
xor eax, ebx
imul ebx, eax, 0x1000193
inc edx
cmp edx, esi
jb 0x4025c1
cmp ebx, ebp
je 0x4025f1
test ecx, ecx
je 0x4025ea
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
jmp 0x402537
xor eax, eax
mov dword [edi + 0x14], ecx
mov dword [edi + 0x18], esi
inc eax
jmp 0x402537

Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40701c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x407028
push 0x407024
push 0x407020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x407028]
push dword [0x407024]
push dword [0x407020]
mov dword [0x407014], esp
call fcn.004014e0
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret
Function at 0x40b501
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor edx, edx
mov ecx, dword [ebp + 0xc]
and eax, 3
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, edx
sub ecx, eax
je 0x40b54b
rol edx, 5
xor edx, dword [esi + ebx]
add esi, 4
imul eax, edx, 0x9e3779b9
rol eax, 5
xor eax, 4
imul edx, eax, 0x9e3779b9
cmp esi, ecx
jb 0x40b51a
jmp 0x40b54b
movsx ecx, byte [esi + ebx]
rol edx, 5
xor edx, ecx
imul edx, edx, 0x9e3779b9
inc esi
cmp esi, dword [ebp + 0xc]
jb 0x40b53b
pop esi
mov eax, edx
pop ebx
pop ebp
ret

Function at 0x40c46f
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
lea esi, [ebx - 1]
push 0x2000
not esi
push ebx
and esi, 0xf0deafff
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
cmp edi, esi
jne 0x40c4a4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, dword [ebp - 0x18]
jb 0x40c4ce
lea eax, [esi + ebx]
cmp eax, dword [ebp - 0x18]
jb 0x40c4ce
test edi, edi
je 0x40c49b
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x40c49b
test edi, edi
je 0x40c4d6
mov eax, edi
jmp 0x40c49d
push 1
push 0x2000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x40c49d
mov esi, 0xc3
push esi
push str.c:_builds_moz2_slave_m_in_w32_d_0000000000000000000_build_src_mfbt_Poison.cpp
push str.no_usable_poison_region_identified
call fcn.00410014
add esp, 0xc
int3
Function at 0x410048
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
push eax
mov dword [sym.TestArrayUtils.exe_gMozillaPoisonSize], eax
call fcn.0040c46f
pop ecx
mov ecx, dword [sym.TestArrayUtils.exe_gMozillaPoisonSize]
mov dword [sym.TestArrayUtils.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x410080
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestArrayUtils.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
je 0x433072
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x236e6bf7
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x433060
nop
nop
mov eax, section..rsrc
nop
nop
cmp eax, 0
nop
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x421c3965
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x403a74
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x390
mov eax, dword [0x44608c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov eax, 0x101
push 0
push eax
mov ecx, esi
mov dword [ebp - 0x390], eax
call fcn.004046c1
cmp dword [esi + 0x14], 8
jb 0x403aaa
mov eax, dword [esi]
jmp 0x403aac
mov eax, esi
lea ecx, [ebp - 0x390]
push ecx
push eax
push 2
call sub.Secur32.dll_GetUserNameExW
test al, al
je 0x403adf
push 0
push dword [ebp - 0x390]
mov ecx, esi
call fcn.004046c1
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004065bb
mov esp, ebp
pop ebp
ret 4
push 0x4243c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xf
lea ecx, [ebp - 0x38c]
call fcn.004018f5
push 0x442bc0
lea eax, [ebp - 0x38c]
push eax
call fcn.004073d4
int3

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x4acc58
Capabilities:
Encode data using xor

Disassembly:
or dl, byte [ebx - 0x1b]
hlt
sti
jne 0x4acc5b
popal
xor dh, byte [edx]
mov edx, 0xd37b3b97
je 0x4acc94
mul byte [edi]
std
stosb byte es:[edi], al
imul edx, ebx, 0x2774d574
jge 0x4acc8b
wait
jbe 0x4acca3
sbb dword [ebp - 0x29], esi
cmp byte [esi + 0x65], al
fisttp word [ecx + 0x5bbdb14a]
int3
jmp 0x4acc44
pop esp
adc edi, dword [eax + 0x6178bf1f]
jge 0x4accb6
pop ebp
xchg edx, eax
xor al, 0x62
dec ebx
pop esp
cmp bl, byte [ebp - 1]
xor dword [ebp - 0x5b], esp
dec ebx
test dword [esi], ebp
sbb dh, byte [esi - 0x3747bc4]
loope 0x4acd00
rol byte [esi], 1
add al, 0xe6
push cs
retf
mov ecx, 0x109c5b28
out 0x8d, al
sub eax, 0x58cb761d
pop eax
and eax, 0x2a921c30
and eax, 0x722fb74b
xor esp, dword [esi + 0x153b79d5]
jno 0x4acd52
sub ah, byte [ebx]
mov dword [ebp + 0x61da1429], 0xbcb8fc42
push esp
jg 0x4acd0b
or dword [edi + 0x6d], ebx
sbb eax, 0x9409d8ef
in al, 0xd9
inc esi
fsub st(4)
or dword [edi + 0x7f943ac5], edi
invalid
sub bl, al
add al, 0xf6
and ecx, dword [0x2a23dbd3]
push 0x94ff2001
fist word [esp + edi*8 + 0x584e0ab1]
in al, 0xbf
stosd dword es:[edi], eax
test byte [ecx + 0x2a5b24ff], bl
inc ebp
fbld tbyte [ebp + 0xb34ee24]
sub eax, dword [eax + ecx*2]
inc esp
fucompi st(7)
and al, 0xa
cdq
mov gs, word [edi + 0x76bd085e]
dec esi
push ds
push es
sbb bh, byte [ebx - 0x497461b]
mov esi, dword [ecx - 0x47]
in al, dx
cmp eax, ebx
inc ecx
cwde
into
retf

Function at 0x4ba0e1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c1570
cmp edx, dword [eax]
je 0x4ba103
add eax, 8
inc ecx
cmp eax, 0x4c1600
jl 0x4ba0f4
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c1570]
jne 0x4ba231
mov eax, dword [0x4c5f0c]
cmp eax, 1
je 0x4ba20b
test eax, eax
jne 0x4ba134
cmp dword [0x4c149c], 1
je 0x4ba20b
cmp edx, 0xfc
je 0x4ba231
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4ba16b
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004baac0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004baf50
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4ba1ae
lea eax, [ebp - 0x1a4]
push eax
call fcn.004baf50
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bf6b4
push edi
call fcn.004bce20
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004baac0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004baad0
lea eax, [ebp - 0xa0]
push 0x4bf694
push eax
call fcn.004baad0
push dword [esi + 0x4c1574]
lea eax, [ebp - 0xa0]
push eax
call fcn.004baad0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bcd94
add esp, 0x2c
pop edi
jmp 0x4ba231
lea eax, [ebp + 8]
lea esi, [esi + 0x4c1574]
push 0
push eax
push dword [esi]
call fcn.004baf50
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x580a48
Capabilities:
Encode data using xor

Disassembly:
iretd
or al, 0x7a
sbb ebp, dword [edi + 0x3d33fe17]
jbe 0x580a61
adc dword [ebx + ebx*2], esp
imul esi, eax, 0
push cs
pop edx
add dword [eax - 0x1e], 0x8dcc33ed
loopne 0x580ac7
push esp
cmp dword [ebx], eax
pop ss
push es
mov edi, 0x6e21ea74
das
jno 0x580a02
pop eax
or edx, ebp
leave
or bl, dl
jecxz 0x580ab2
fst dword [ecx + 0x7d]
or al, 0x79
push ebx
inc ebx
imul byte [edx - 0x2240d639]
scasd eax, dword es:[edi]
push eax
pop edx
clc
add al, 0xda
sbb dword [ebx + 0x43], ebx
fisubr word [eax + edi*2]
mul dword [ebx - 0x76615ef3]
stc
and al, 0x73
clc
int 0x15
xor esi, dword [esi + edx*4 + 0x32]
mov ebx, 0xc553ab5d
invalid
pushal
adc eax, 0x38722eb5
push 0x7f7cc226
push 0xcdc81fe1
invalid
sub byte [edx + 0xe], bh
adc esp, edi
or eax, 0xfba8022
xchg edi, eax
in al, 0x87
jmp 0x580b19
nop
outsd dx, dword [esi]
nop
fldenv [edi + 0x75bf88ed]
mov ebx, 0xdfdc02d
adc dword gs:[ebx + eax*2 + 0x694f84a3], ecx
mov dword [ebp - 0x62b230c9], edi
mov byte [0x86ab9688], al
xchg ebp, eax
adc bl, byte [ecx]
mov byte [eax + 0x48], dl
imul ebp, dword [eax - 0x6c], 0x14465be1
aas
pop ebx
inc esi
adc al, 0x3f
loopne 0x580b17
inc esp
int 0xf9
ror byte [eax + 0x73af3689], cl
jecxz 0x580b43
push es
xor edi, dword [bp + 0x4a]
enter 0xffffffffffff8e26, 8
call 0x615cd9f0
jo 0x580bc5
fild dword [ebp - 0x372e60a9]
mov esi, 0xe5a315e4
add byte [edx - 0x34], 0x68
stosb byte es:[edi], al
dec ebp
test eax, 0x9b829e1c
push edi
int3
invalid
Function at 0x702f90
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x208
lea eax, [esp]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push ebp
push esi
push edi
xor edi, edi
push 0x104
push eax
push edi
push SysStringLen
call ebx
mov esi, dword [esp + 0x21c]
mov ebp, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x702ffb
mov ecx, dword [esi + 8]
push 0
push ecx
call ebp
test eax, eax
je 0x703035
lea edx, [esp + 0x10]
push esi
push edx
push SysStringLen
call fcn.00702e00
add esp, 0xc
lea eax, [esp + 0x10]
inc edi
push 0x104
push eax
push edi
push SysStringLen
call ebx
test eax, eax
je 0x702fc5
mov edi, 0x71d8b0
mov ecx, dword [esi + 8]
push 0
push ecx
call ebp
test eax, eax
je 0x703035
mov edx, dword [edi]
push esi
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00702e00
add edi, 4
add esp, 0xc
cmp edi, 0x71d8c0
jb 0x703000
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x208
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x208
ret
Function at 0x703f10
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x7189fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [esp + 0x2c]
xor ebp, ebp
mov dword [esp + 0x10], eax
xor ebx, ebx
mov eax, 1
mov ecx, ebx
shl eax, cl
mov ecx, dword [esp + 0x10]
test ecx, eax
je 0x704002
lea edx, [ebx + 0x41]
lea eax, [esp + 0x14]
push edx
push str._c:_
push eax
call fcn.00707dff
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x704002
lea edx, [esp + 0x14]
push edx
push str.Mounting__s_n
call fcn.006ff6e0
lea eax, [esp + 0x1c]
lea edi, [esi + 0x1048]
push eax
push edi
mov word [esp + 0x28], bp
call fcn.0070820b
push 0x10
call fcn.007081d3
add esp, 0x14
mov dword [esp + 0x2c], eax
cmp eax, ebp
mov dword [esp + 0x24], ebp
je 0x703fc5
mov cx, word [edi]
push ecx
mov ecx, eax
call fcn.006f41c0
jmp 0x703fc7
xor eax, eax
push esi
mov dword [esp + 0x28], 0xffffffff
mov dword [esi], eax
call fcn.00703b80
mov edi, dword [esi]
add esp, 4
cmp edi, ebp
je 0x703ff0
mov ecx, edi
call fcn.006f42c0
push edi
call fcn.007081c8
add esp, 4
mov edx, dword [esi + 0x1024]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x704021
inc ebx
cmp ebx, 0x20
jb 0x703f3e
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x7071b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00707140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00707140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00707140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00707140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x707bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x707c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x71987c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x707c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x707c52
xor eax, eax
pop esi
leave
ret 4

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43000c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403daa
nop
nop
sub eax, 0x403d50
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
jmp loc.00401219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x423b47
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x423b75
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x423b93
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00423ab1
jmp 0x423b93
mov eax, dword [esi + 0x14]
test eax, eax
je 0x423b93
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.00423ab1
test edi, edi
mov eax, edi
jne 0x423b7d
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x438c24]
test ecx, ecx
je 0x423c46
jmp 0x423b46
ret 8

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x32311e11
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x2a4a07af
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219