joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5def90
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x208
lea eax, [esp]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push ebp
push esi
push edi
xor edi, edi
push 0x104
push eax
push edi
push SysStringLen
call ebx
mov esi, dword [esp + 0x21c]
mov ebp, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x5deffb
mov ecx, dword [esi + 8]
push 0
push ecx
call ebp
test eax, eax
je 0x5df035
lea edx, [esp + 0x10]
push esi
push edx
push SysStringLen
call fcn.005dee00
add esp, 0xc
lea eax, [esp + 0x10]
inc edi
push 0x104
push eax
push edi
push SysStringLen
call ebx
test eax, eax
je 0x5defc5
mov edi, 0x5f98b0
mov ecx, dword [esi + 8]
push 0
push ecx
call ebp
test eax, eax
je 0x5df035
mov edx, dword [edi]
push esi
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.005dee00
add edi, 4
add esp, 0xc
cmp edi, 0x5f98c0
jb 0x5df000
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x208
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x208
ret

Function at 0x5df070
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x250
push esi
push edi
mov edi, dword [esp + 0x25c]
push 0x5c
push edi
call fcn.005e5082
mov esi, eax
add esp, 8
test esi, esi
je 0x5df107
lea eax, [esp + 8]
mov word [esi], 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x5df102
push ebx
lea ebx, [esi + 2]
push ebp
lea ecx, [esp + 0x3c]
push ebx
push ecx
call fcn.005e4946
add esp, 8
test eax, eax
je 0x5df0e3
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea edx, [esp + 0x10]
push edx
push edi
call ebp
test eax, eax
je 0x5df0e8
lea eax, [esp + 0x3c]
push ebx
push eax
call fcn.005e4946
add esp, 8
test eax, eax
jne 0x5df0c5
mov word [esi], 0x5c
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp word [esi], 0
pop ebp
pop ebx
je 0x5df102
pop edi
mov al, 1
pop esi
add esp, 0x250
ret
mov word [esi], 0x5c
pop edi
xor al, al
pop esi
add esp, 0x250
ret
Function at 0x5dff10
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x5f49fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [esp + 0x2c]
xor ebp, ebp
mov dword [esp + 0x10], eax
xor ebx, ebx
mov eax, 1
mov ecx, ebx
shl eax, cl
mov ecx, dword [esp + 0x10]
test ecx, eax
je 0x5e0002
lea edx, [ebx + 0x41]
lea eax, [esp + 0x14]
push edx
push str._c:_
push eax
call fcn.005e3dff
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x5e0002
lea edx, [esp + 0x14]
push edx
push str.Mounting__s_n
call fcn.005db6e0
lea eax, [esp + 0x1c]
lea edi, [esi + 0x1048]
push eax
push edi
mov word [esp + 0x28], bp
call fcn.005e420b
push 0x10
call fcn.005e41d3
add esp, 0x14
mov dword [esp + 0x2c], eax
cmp eax, ebp
mov dword [esp + 0x24], ebp
je 0x5dffc5
mov cx, word [edi]
push ecx
mov ecx, eax
call fcn.005d01c0
jmp 0x5dffc7
xor eax, eax
push esi
mov dword [esp + 0x28], 0xffffffff
mov dword [esi], eax
call fcn.005dfb80
mov edi, dword [esi]
add esp, 4
cmp edi, ebp
je 0x5dfff0
mov ecx, edi
call fcn.005d02c0
push edi
call fcn.005e41c8
add esp, 4
mov edx, dword [esi + 0x1024]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x5e0021
inc ebx
cmp ebx, 0x20
jb 0x5dff3e
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x5e1250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f5808
push 0x5e5288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x5e1329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x5e1329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.005e41d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0x5e1329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0x5e1329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0x5e132c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.005e1351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5e1d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x5e1d58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0x5e1d60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x5e1d94
mov eax, dword [esp + 0x14]
test eax, eax
je 0x5e1d94
push eax
push esi
call fcn.005e420b
add esp, 8
pop esi
ret 0x10

Function at 0x5e1da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x5e1e22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0x5e1e15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0x5fa320
push ecx
mov dword [esp + 0x1c], 4
call fcn.005e3dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0x5e1dda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0x5e1e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x5e1ec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0x5e1eb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0x5fa320
push ecx
mov dword [esp + 0x1c], 4
call fcn.005e3dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x5e1eab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0x5e1e6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0x5e2000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x5e2131
push esi
call fcn.005e5145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.005d4080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x5e2131
push 0
push ebp
call fcn.005d43a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.005d4260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x5e208b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.005d42f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x5e2121
push 0x5fa918
push edi
call fcn.005e33f0
push eax
push ebx
push esi
call fcn.005e1f60
push 0x5fa8f8
push edi
call fcn.005e33f0
push eax
push ebx
push esi
call fcn.005e1f60
push 0x5fa8d8
push edi
call fcn.005e33f0
push eax
push ebx
push esi
call fcn.005e1f60
push 0x5fa8c0
push edi
call fcn.005e33f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.005e1f60
push 0x5fa8a0
push edi
call fcn.005e33f0
push eax
push ebx
push esi
call fcn.005e1f60
push 0x5fa888
push edi
call fcn.005e33f0
push eax
push ebx
push esi
call fcn.005e1f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x5e31b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.005e3140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.005e3140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.005e3140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.005e3140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x5e3bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x5e3c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x5f587c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x5e3c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x5e3c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x42e006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x42e072
nop
nop
nop
mov ebx, 0x407ef8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x2ff320a8
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x42e060
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x42e0d2
nop
nop
mov ebx, 0x42cd70
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x11f87401
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x407180
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x4071be
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x4071b6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x4071c0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x4071a6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4072a0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x4072b6
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x4072d1
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408f6c
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x321e4363
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e3d0
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x32b401ab
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x4af728
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4af7ff
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4af81c
push ebx
push 0x4af82c
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004087c4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00405884
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004084ec
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x4af7aa
mov ax, 0x83
call fcn.004af34c
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle
call fcn.004af6fc
push 0x4ff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x4af7b3
call fcn.004af6fc
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4af806
lea eax, [ebp - 4]
call fcn.00407a20
ret

Function at 0x4af91c
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4af9e7
jmp 0x4af9db
cmp dword [esi + 0x10], 0x1000
jne 0x4af9c7
test byte [esi + 0x15], 1
jne 0x4af9c7
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4af978
cmp ebp, 2
je 0x4af978
cmp ebp, 0x10
je 0x4af978
cmp ebp, 0x20
jne 0x4af994
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4af994
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4af9a5
mov eax, dword [esi]
add eax, ebx
call fcn.004af914
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4af998
cmp byte [esp + 4], 0
je 0x4af9c7
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4af9e7
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4af94d
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x43b64f
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov dword [esp], 0x43b3c1
pop esi
sub edx, ebx
inc edx
call fcn.0043b682
add edx, 0x1ef69240
or edx, ebx
xor dword [edi], esi
sub ebx, 0x86a0e51e
inc edi
sub edx, edx
cmp edi, ecx
jne fcn.0043b64f
sub edx, edx
ret
Function at 0x69a5da43
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x4c
mov eax, dword [ebp + 8]
cdq
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
jmp 0x69a5db07
jmp 0x69a5dbba
jmp 0x69a5dc6d
jmp 0x69a5dd20
jmp 0x69a5ddd3
jmp 0x69a5de86
jmp 0x69a5df39
jmp 0x69a5dfec
jmp 0x69a5e09f
jmp 0x69a5e152
jmp 0x69a5e205
jmp 0x69a5e2b8
jmp 0x69a5e36b
jmp 0x69a5e41e
jmp 0x69a5e4d1
jmp 0x69a5e584
jmp 0x69a5e637
jmp 0x69a5e6ea
jmp 0x69a5e79d
jmp 0x69a5e850
jmp 0x69a5e903
jmp 0x69a5e9b6
jmp 0x69a5ea69
jmp 0x69a5eb1c
jmp 0x69a5ebcf
jmp 0x69a5ec82
jmp 0x69a5ed35
jmp 0x69a5ede8
jmp 0x69a5ee9b
jmp 0x69a5ef4e
jmp 0x69a5f001
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
jmp 0x69a5f0ba
jmp 0x69a5f16d
jmp 0x69a5f220
jmp 0x69a5f2d3
jmp 0x69a5f386
jmp 0x69a5f439
jmp 0x69a5f4ec
jmp 0x69a5f59f
jmp 0x69a5f652
jmp 0x69a5f705
jmp 0x69a5f7b8
jmp 0x69a5f86b
jmp 0x69a5f91e
jmp 0x69a5f9d1
jmp 0x69a5fa84
jmp 0x69a5fb37
jmp 0x69a5fbea
jmp 0x69a5fc9d
jmp 0x69a5fd50
jmp 0x69a5fe03
jmp 0x69a5feb6
jmp 0x69a5ff69
jmp 0x69a6001c
jmp 0x69a600cf
jmp 0x69a60182
jmp 0x69a60235
jmp 0x69a602e8
jmp 0x69a6039b
jmp 0x69a6044e
jmp 0x69a60501
jmp 0x69a605b4
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x3c]
mov ecx, eax
mov ebx, eax
sar ebx, 0x1f
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
add eax, ecx
adc edx, ebx
mov dword [ebp - 0x20], eax
jmp 0x69a60681
jmp 0x69a60734
jmp 0x69a607e7
jmp 0x69a6089a
jmp 0x69a6094d
jmp 0x69a60a00
jmp 0x69a60ab3
jmp 0x69a60b66
jmp 0x69a60c19
jmp 0x69a60ccc
jmp 0x69a60d7f
jmp 0x69a60e32
jmp 0x69a60ee5
jmp 0x69a60f98
jmp 0x69a6104b
jmp 0x69a610fe
jmp 0x69a611b1
jmp 0x69a61264
jmp 0x69a61317
jmp 0x69a613ca
jmp 0x69a6147d
jmp 0x69a61530
jmp 0x69a615e3
jmp 0x69a61696
jmp 0x69a61749
jmp 0x69a617fc
jmp 0x69a618af
jmp 0x69a61962
jmp 0x69a61a15
jmp 0x69a61ac8
jmp 0x69a61b7b
mov eax, dword [ebp - 0x20]
add eax, 0x78
mov dword [ebp - 0x24], eax
jmp 0x69a61c37
jmp 0x69a61cea
jmp 0x69a61d9d
jmp 0x69a61e50
jmp 0x69a61f03
jmp 0x69a61fb6
jmp 0x69a62069
jmp 0x69a6211c
jmp 0x69a621cf
jmp 0x69a62282
jmp 0x69a62335
jmp 0x69a623e8
jmp 0x69a6249b
jmp 0x69a6254e
jmp 0x69a62601
jmp 0x69a626b4
jmp 0x69a62767
jmp 0x69a6281a
jmp 0x69a628cd
jmp 0x69a62980
jmp 0x69a62a33
jmp 0x69a62ae6
jmp 0x69a62b99
jmp 0x69a62c4c
jmp 0x69a62cff
jmp 0x69a62db2
jmp 0x69a62e65
jmp 0x69a62f18
jmp 0x69a62fcb
jmp 0x69a6307e
jmp 0x69a63131
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
mov ecx, eax
mov ebx, 0
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
add eax, ecx
adc edx, ebx
mov dword [ebp - 0x28], eax
jmp 0x69a631fd
jmp 0x69a632b0
jmp 0x69a63363
jmp 0x69a63416
jmp 0x69a634c9
Function at 0x69a9c48c
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x6a2a0018]
movzx eax, word [eax + 0x14]
movzx eax, ax
mov edx, dword [0x6a2a0018]
add eax, edx
add eax, 0x18
mov dword [ebp - 0xc], eax
jmp 0x69a9c55f
jmp 0x69a9c612
jmp 0x69a9c6c5
jmp 0x69a9c778
jmp 0x69a9c82b
jmp 0x69a9c8de
jmp 0x69a9c991
jmp 0x69a9ca44
jmp 0x69a9caf7
jmp 0x69a9cbaa
jmp 0x69a9cc5d
jmp 0x69a9cd10
jmp 0x69a9cdc3
jmp 0x69a9ce76
jmp 0x69a9cf29
jmp 0x69a9cfdc
jmp 0x69a9d08f
jmp 0x69a9d142
jmp 0x69a9d1f5
jmp 0x69a9d2a8
jmp 0x69a9d35b
jmp 0x69a9d40e
jmp 0x69a9d4c1
jmp 0x69a9d574
jmp 0x69a9d627
jmp 0x69a9d6da
jmp 0x69a9d78d
jmp 0x69a9d840
jmp 0x69a9d8f3
jmp 0x69a9d9a6
jmp 0x69a9da59
mov dword [ebp - 0x14], 0
jmp 0x69a9db13
jmp 0x69a9dbc6
jmp 0x69a9dc79
jmp 0x69a9dd2c
jmp 0x69a9dddf
jmp 0x69a9de92
jmp 0x69a9df45
jmp 0x69a9dff8
jmp 0x69a9e0ab
jmp 0x69a9e15e
jmp 0x69a9e211
jmp 0x69a9e2c4
jmp 0x69a9e377
jmp 0x69a9e42a
jmp 0x69a9e4dd
jmp 0x69a9e590
jmp 0x69a9e643
jmp 0x69a9e6f6
jmp 0x69a9e7a9
jmp 0x69a9e85c
jmp 0x69a9e90f
jmp 0x69a9e9c2
jmp 0x69a9ea75
jmp 0x69a9eb28
jmp 0x69a9ebdb
jmp 0x69a9ec8e
jmp 0x69a9ed41
jmp 0x69a9edf4
jmp 0x69a9eea7
jmp 0x69a9ef5a
jmp 0x69a9f00d
mov dword [ebp - 0x18], 0
jmp 0x69a9f0c7
jmp 0x69a9f17a
jmp 0x69a9f22d
jmp 0x69a9f2e0
jmp 0x69a9f393
jmp 0x69a9f446
jmp 0x69a9f4f9
jmp 0x69a9f5ac
jmp 0x69a9f65f
jmp 0x69a9f712
jmp 0x69a9f7c5
jmp 0x69a9f878
jmp 0x69a9f92b
jmp 0x69a9f9de
jmp 0x69a9fa91
jmp 0x69a9fb44
jmp 0x69a9fbf7
jmp 0x69a9fcaa
jmp 0x69a9fd5d
jmp 0x69a9fe10
jmp 0x69a9fec3
jmp 0x69a9ff76
jmp 0x69aa0029
jmp 0x69aa00dc
jmp 0x69aa018f
jmp 0x69aa0242
jmp 0x69aa02f5
jmp 0x69aa03a8
jmp 0x69aa045b
jmp 0x69aa050e
jmp 0x69aa05c1
mov dword [ebp - 0x10], 0
jmp 0x69aa067b
jmp 0x69aa072e
jmp 0x69aa07e1
jmp 0x69aa0894
jmp 0x69aa0947
jmp 0x69aa09fa
jmp 0x69aa0aad
jmp 0x69aa0b60
jmp 0x69aa0c13
jmp 0x69aa0cc6
jmp 0x69aa0d79
jmp 0x69aa0e2c
jmp 0x69aa0edf
jmp 0x69aa0f92
jmp 0x69aa1045
jmp 0x69aa10f8
jmp 0x69aa11ab
jmp 0x69aa125e
jmp 0x69aa1311
jmp 0x69aa13c4
jmp 0x69aa1477
jmp 0x69aa152a
jmp 0x69aa15dd
jmp 0x69aa1690
jmp 0x69aa1743
jmp 0x69aa17f6
jmp 0x69aa18a9
jmp 0x69aa195c
jmp 0x69aa1a0f
jmp 0x69aa1ac2
jmp 0x69aa1b75
mov dword [ebp - 0x10], 0
jmp 0x69aa882a
jmp 0x69aa1c34
jmp 0x69aa1ce7
jmp fcn.69aa1d9a
mov eax, dword [0x6a2a0018]
movzx eax, word [eax + 6]
movzx eax, ax
cmp eax, dword [ebp - 0x10]
ja 0x69aa1b81
nop
leave
ret
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x42e006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x66526ae4
nop
nop
test eax, eax
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x101d642d
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219