joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100358e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10035983
lea eax, [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1003595e
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10035942
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x1003595c
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x20]
call fcn.1000bcff
or dword [eax], 0xffffffff
jmp 0x10035937
jmp 0x10035981
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x10035981
push 0x7c6
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x100359f1
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x100359e9
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x100359cd
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 2
jge 0x100359e7
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x44]
call fcn.1000bcff
and dword [eax], 0
jmp 0x100359c2
jmp 0x100359f1
push 0
call dword [sym.imp.USER32.dll_SetKeyboardState]
mov esp, ebp
pop ebp
ret

Function at 0x100362e3
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10036301
push 0
push 0x2786
call fcn.1003d22f
pop ecx
pop ecx
jmp 0x10036344
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x10036337
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x10036335
push 0
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
jmp 0x10036344
push 0xa0f
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esp, ebp
pop ebp
ret
Function at 0x10036348
Capabilities:
Clear file content
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10036394
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 0x704c
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push 1
call fcn.100363ec
add esp, 0x1c
jmp 0x100363e8
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x100363c0
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x100363be
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
jmp 0x100363e8
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x100363e8
push 0x599
push 0
push 0x713
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov esp, ebp
pop ebp
ret
Function at 0x100378df
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006c8e4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1003797d
lea eax, [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x1003791c
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
jmp 0x10037978
push 2
lea ecx, [ebp - 0x44]
call fcn.1000bc61
and dword [ebp - 4], 0
mov dword [ebp - 0x18], 0xfffffff6
mov dword [ebp - 0x34], 0xa4f402e3
push 1
push 0x2f1e
push 1
push 0x1a5c
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.1002d911
add esp, 0x18
push 1
lea eax, [ebp - 0x18]
push eax
push 1
lea eax, [ebp - 0x44]
push eax
push 0
call fcn.100378df
add esp, 0x14
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.1000bce3
jmp 0x100379fe
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x100379e7
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x10]
mov dword [eax], 1
jmp 0x100379c7
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0
jl 0x100379e5
mov eax, dword [ebp - 0x10]
push dword [eax]
mov ecx, dword [ebp - 0x30]
call fcn.1000bcff
cmp dword [eax], 0
je 0x100379e3
jmp 0x100379e5
jmp 0x100379bc
jmp 0x100379fe
push 0
push 0x607
push 0x2439
push 0x129a
call dword [sym.imp.GDI32.dll_MoveToEx]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1003d523
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1003d5a7
lea eax, [ebp + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1003d59f
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1003d59d
push 0x5055
push 1
push 0x2965
push 0x1801
push 0x17ee
push 0x6883
push 1
push 0x6d23
push 0x63cf
push 0x4a09
push 1
push 0x3ec8
push 0x7122
call fcn.10038151
add esp, 0x34
jmp 0x1003d5a5
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
jmp 0x1003d5c8
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x14]
push 0x47b9
push dword [ebp - 0x18]
push 0
call fcn.100377f8
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x10047702
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1004775c
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10047746
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x10047744
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
jmp 0x1004775a
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1004775a
push 1
call fcn.10042568
pop ecx
jmp 0x10047778
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x18]
push 1
push dword [ebp - 0x1c]
call fcn.10046032
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x100477e1
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10047887
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10047862
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10047843
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x10047860
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.1000bcff
mov dword [eax], 0x77f17245
jmp 0x10047838
jmp 0x10047885
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x10047885
push 0x7c6
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x100478d0
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
push 0x1326
push dword [ebp - 0x2c]
push 0x7819
push 0x4084
push 0x63aa
push 0x5e47
push dword [ebp - 0x30]
push 0x6479
push 0x1bbb
push 0x76e0
push 0x76ef
push 0
call fcn.10045fd7
add esp, 0x30
mov esp, ebp
pop ebp
ret
Function at 0x1004cbb3
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1004cd0d
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x58], eax
lea eax, [ebp + 0x2c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1004ccc0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0xfffffffe
jmp 0x1004cc55
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0xc
jle 0x1004ccbe
mov dword [ebp - 0x50], 0xfffffffa
mov dword [ebp - 0x48], 6
mov dword [ebp - 0x4c], 0x7675daaf
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1004cc8b
push 0xa0f
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
push dword [ebp - 0x3c]
push dword [ebp - 8]
push dword [ebp - 0x40]
push dword [ebp - 0x44]
push 1
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x50]
push eax
push 1
push 0x2066
push dword [ebp - 0x54]
push 0x9a4
call fcn.1004a9fb
add esp, 0x30
jmp 0x1004cc4a
jmp 0x1004cd0b
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0xc]
mov dword [eax], 0
jmp 0x1004ccee
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 4
jge 0x1004cd0b
mov eax, dword [ebp - 0xc]
push dword [eax]
mov ecx, dword [ebp - 0x68]
call fcn.1000bcff
mov dword [eax], 0xfffffff9
jmp 0x1004cce3
jmp 0x1004cd2a
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x6c], eax
push 0x7313
push 0x260d
push 0
push dword [ebp - 0x6c]
call fcn.100447d9
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x1004cf93
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1004d00f
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1004d000
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x1004cffe
push 0x6166
push 0
push 0x5900
push 0x30af
push 1
push 0x4bdd
push 0x5f3e
push 1
push 0x6cb6
push 0x1bd
call fcn.1004c605
add esp, 0x28
jmp 0x1004d00d
push 0xa0f
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x1004d04b
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1004d03e
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x1004d04b
push 0
push 0x639
call dword [sym.imp.USER32.dll_GetWindowRect]
mov esp, ebp
pop ebp
ret
Function at 0x10067cd0
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10071740]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.10058bb8
mov dword [ebp - 0x14], eax
cmp dword [0x10614b6c], esi
jne 0x10067dc3
push 0x800
push esi
push 0x100075b0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10067d50
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10067ea3
push esi
push esi
push 0x100075b0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10067ea3
push 0x100075c8
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10067ea3
push eax
call ebx
push 0x100075d4
push edi
mov dword [0x10614b6c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x100075e4
push edi
mov dword [0x10614b70], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x100075f8
push edi
mov dword [0x10614b74], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10614b7c], eax
test eax, eax
je 0x10067dc0
push 0x10007614
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10614b78], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x10067de8
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10067ddb
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x10067dfd
push 4
pop eax
jmp 0x10067ea5
cmp dword [ebp - 0x14], esi
je 0x10067dfd
push dword [0x10614b6c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10067de2
mov eax, dword [0x10614b78]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x10067e5b
cmp dword [0x10614b7c], edi
je 0x10067e5b
push eax
call ebx
push dword [0x10614b7c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10067e5b
test eax, eax
je 0x10067e5b
call ecx
test eax, eax
je 0x10067e50
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10067e50
test byte [ebp - 8], 1
jne 0x10067e5b
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x10067e8b
mov eax, dword [0x10614b70]
cmp eax, edi
je 0x10067e88
push eax
call ebx
test eax, eax
je 0x10067e88
call eax
mov esi, eax
test esi, esi
je 0x10067e88
mov eax, dword [0x10614b74]
cmp eax, edi
je 0x10067e88
push eax
call ebx
test eax, eax
je 0x10067e88
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x10614b6c]
call ebx
test eax, eax
je 0x10067ea3
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x10067ea5
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005569e
mov esp, ebp
pop ebp
ret
Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0x54201dde
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
mov eax, str.H5T
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x35f52848
nop
nop
nop
nop
test eax, eax
je 0x433084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x401d30
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x410645
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x419010]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 4
call fcn.00403abb
mov dword [ebp - 0x1c], eax
mov dword [eax], 0x401470
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0
push ecx
push 0
push eax
push 0x402880
push 0
push 0
call fcn.00406b01
add esp, 0x1c
mov dword [ebp - 0x18], eax
test eax, eax
je 0x401ded
mov dword [ebp - 4], 1
cmp dword [ebp - 0x14], 0
je 0x401dfb
call sub.KERNEL32.dll_GetCurrentThreadId
mov ecx, dword [ebp - 0x14]
cmp ecx, eax
je 0x401e02
push 0
push ecx
push dword [ebp - 0x18]
call fcn.0040368c
add esp, 0xc
test eax, eax
jne 0x401e09
xorps xmm0, xmm0
push 0x7530
movlpd qword [ebp - 0x18], xmm0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x14], 0
jne 0x401e10
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00403aad
mov esp, ebp
pop ebp
ret
push 6
mov dword [ebp - 0x14], 0
call fcn.0040342e
push 1
call fcn.0040342e
push 5
call fcn.0040342e
push 2
call fcn.0040342e
call fcn.00406b94
int3

Function at 0x4028e0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x419010]
xor eax, esp
mov dword [esp + 0x1c], eax
lea eax, [esp]
push eax
push 0xf01ff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x402973
lea eax, [esp + 4]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x402973
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
push 0
push 0
push 0x10
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
push eax
push 0
push dword [esp + 0x14]
mov dword [esp + 0x24], 1
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x402973
mov eax, 1
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00403aad
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x1c]
xor eax, eax
xor ecx, esp
call fcn.00403aad
mov esp, ebp
pop ebp
ret
Function at 0x402df0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x410730
mov eax, dword fs:[0]
push eax
sub esp, 0x448
mov eax, dword [0x419010]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x438], 0
push eax
push 0x416fe8
lea ecx, [ebp - 0x438]
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 7
mov word [ebp - 0x438], ax
call fcn.00402000
push 0x410
lea eax, [ebp - 0x420]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.00405300
add esp, 0xc
lea eax, [ebp - 0x420]
push 0x208
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x403007
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x403007
lea ecx, [ebp - 0x420]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x402eb0
sub ecx, edx
lea eax, [ebp - 0x420]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x438]
call fcn.00402000
cmp dword [ebp - 0x424], 8
lea edx, [ebp - 0x438]
mov edi, dword [ebp - 0x428]
cmovae edx, dword [ebp - 0x438]
test edi, edi
je 0x402f18
or ecx, 0xffffffff
lea eax, [edi - 1]
cmp eax, ecx
cmovb ecx, eax
cmp word [edx + ecx*2], 0x5c
lea ecx, [edx + ecx*2]
je 0x402f12
cmp ecx, edx
je 0x402f18
sub ecx, 2
cmp word [ecx], 0x5c
jne 0x402f05
sub ecx, edx
sar ecx, 1
jmp 0x402f1b
or ecx, 0xffffffff
inc ecx
mov dword [ebp - 0x454], 0
cmp edi, ecx
mov dword [ebp - 0x444], 0
lea eax, [ebp - 0x438]
mov dword [ebp - 0x440], 7
cmovb ecx, edi
cmp dword [ebp - 0x424], 8
push ecx
cmovae eax, dword [ebp - 0x438]
lea ecx, [ebp - 0x454]
push eax
call fcn.00402000
mov edx, dword [ebp - 0x424]
cmp edx, 8
jb 0x402fa0
mov ecx, dword [ebp - 0x438]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x402f96
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40307a
push edx
push ecx
call fcn.00403aeb
add esp, 8
movups xmm1, xmmword [ebp - 0x454]
cmp dword [ebp - 0x440], 8
lea ecx, [ebp - 0x438]
movq xmm0, qword [ebp - 0x444]
movd eax, xmm1
movups xmmword [ebp - 0x438], xmm1
cmovae ecx, eax
movq qword [ebp - 0x428], xmm0
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x403015
lea eax, [ebp - 0x438]
cmp esi, eax
je 0x403003
cmp dword [ebp - 0x424], 8
mov ecx, esi
push dword [ebp - 0x428]
cmovae eax, dword [ebp - 0x438]
push eax
call fcn.00402000
mov al, 1
jmp 0x403017
push 0
push 0x416fe8
mov ecx, esi
call fcn.00402000
xor al, al
mov edx, dword [ebp - 0x424]
mov byte [ebp - 0x439], al
cmp edx, 8
jb 0x40305f
mov ecx, dword [ebp - 0x438]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40304f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40307a
push edx
push ecx
call fcn.00403aeb
mov al, byte [ebp - 0x439]
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00403aad
mov esp, ebp
pop ebp
ret
call fcn.00406d8e
int3