joyce8/EMBER2024-capa huggingface dataset:
Function at 0x427838
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbdc
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x424], edx
mov dword [ebp - 0x420], edx
mov dword [ebp - 0x41c], edx
mov dword [ebp - 0x418], edx
mov esi, eax
xor eax, eax
push ebp
push 0x427a83
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
jmp 0x427875
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
xor eax, eax
mov al, bl
mov eax, dword [eax*4 + 0x4d3318]
call fcn.004b73fc
push eax
push 0x80000000
call sub.ADVAPI32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x427a54
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.dll_RegQueryValueExA_1
test eax, eax
jne 0x427a4b
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x411]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.dll_RegQueryValueExA_1
lea eax, [ebp - 0x418]
lea edx, [ebp - 0x411]
mov ecx, 0x401
call fcn.004b71e8
cmp dword [ebp - 0x418], 0
je 0x4279c2
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
lea eax, [ebp - 0x41c]
lea edx, [ebp - 0x411]
mov ecx, 0x401
call fcn.004b71e8
lea eax, [ebp - 0x41c]
mov edx, 0x427a98
call fcn.004b7240
mov eax, dword [ebp - 0x41c]
call fcn.004b73fc
push eax
push 0x80000000
call sub.ADVAPI32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4279c2
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4279b9
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x411]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.dll_RegQueryValueExA_1
lea eax, [ebp - 0x420]
lea edx, [ebp - 0x411]
mov ecx, 0x401
call fcn.004b71e8
cmp dword [ebp - 0x420], 0
je 0x4279b9
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.dll_RegCloseKey_1
mov edx, esi
lea eax, [ebp - 0x411]
call fcn.004af1c0
jmp 0x427a65
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.dll_RegCloseKey_1
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x427aac
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x427a4b
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.dll_RegQueryValueExA_1
test eax, eax
jne 0x427a4b
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x411]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.dll_RegQueryValueExA_1
lea eax, [ebp - 0x424]
lea edx, [ebp - 0x411]
mov ecx, 0x401
call fcn.004b71e8
cmp dword [ebp - 0x424], 0
je 0x427a4b
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.dll_RegCloseKey_1
mov edx, esi
lea eax, [ebp - 0x411]
call fcn.004af1c0
jmp 0x427a65
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.dll_RegCloseKey_1
inc ebx
cmp bl, 4
jne 0x42786f
mov eax, esi
call fcn.004b6fb8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x427a8a
lea eax, [ebp - 0x424]
mov edx, 4
call fcn.004b6fdc
ret
Function at 0x427cf8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x427dc5
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx + 0x2dc], 0
je 0x427daa
xor eax, eax
push ebp
push 0x427d9e
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call sym.Project1.exe__Icelicense_TIceLicense_BrowserPath_qqrv
cmp dword [ebp - 4], 0
je 0x427d92
mov al, byte [ebx + 0x2ec]
call fcn.00427ce0
push eax
push 0
push dword [0x4deccc]
push 0x427de0
push dword [ebx + 0x2dc]
lea eax, [ebp - 8]
mov edx, 3
call fcn.004b72f8
mov eax, dword [ebp - 8]
call fcn.004b73fc
push eax
mov eax, dword [ebp - 4]
call fcn.004b73fc
push eax
push 0
push 0
call sub.SHELL32.dll_ShellExecuteA_1
cmp eax, 0x21
jae 0x427d8d
xor esi, esi
jmp 0x427d94
or esi, 0xffffffff
jmp 0x427d94
xor esi, esi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x427daa
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x427dcc
lea eax, [ebp - 8]
mov edx, 2
call fcn.004b6fdc
ret

Function at 0x427de4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x427eb2
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx + 0x2e0], 0
je 0x427e9a
xor eax, eax
push ebp
push 0x427e8c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx + 0x2e4], 0
jne 0x427e30
lea eax, [ebx + 0x2e4]
mov edx, 0x427ecc
call fcn.004b700c
push 0x427ee4
push dword [ebx + 0x2e0]
push 0x427ef4
push dword [ebx + 0x2e4]
push 0x427f08
push dword [ebx + 0x2e8]
lea eax, [ebp - 4]
mov edx, 6
call fcn.004b72f8
push 0xa
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004b73fc
push eax
push 0
push 0
call sub.SHELL32.dll_ShellExecuteA_1
cmp eax, 0x21
jae 0x427e7f
xor ebx, ebx
jmp 0x427e82
or ebx, 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x427e9c
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x427eb9
lea eax, [ebp - 4]
call fcn.004b6fb8
ret

Function at 0x427f10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004b73ec
xor eax, eax
push ebp
push 0x427faa
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4dd998]
mov dword [eax], 0x420d91e
mov eax, dword [ebp - 4]
call fcn.004b7238
test al, al
jbe 0x427f85
mov byte [ebp - 5], al
mov bl, 1
mov eax, 0x80
call fcn.004b6024
or eax, 0x80
mov esi, ebx
and esi, 0xff
mov edx, dword [ebp - 4]
movzx edx, byte [edx + esi - 1]
xor eax, edx
push eax
lea eax, [ebp - 4]
call fcn.004b7408
pop edx
mov byte [eax + esi - 1], dl
inc ebx
dec byte [ebp - 5]
jne 0x427f50
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.004b700c
call fcn.004b5de8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x427fb1
lea eax, [ebp - 4]
call fcn.004b6fb8
ret
Function at 0x428580
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004b73ec
xor eax, eax
push ebp
push 0x42861a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4dd998]
mov dword [eax], 0x18f13e8
mov eax, dword [ebp - 4]
call fcn.004b7238
test al, al
jbe 0x4285f5
mov byte [ebp - 5], al
mov bl, 1
mov eax, 0x80
call fcn.004b6024
or eax, 0x80
mov esi, ebx
and esi, 0xff
mov edx, dword [ebp - 4]
movzx edx, byte [edx + esi - 1]
xor eax, edx
push eax
lea eax, [ebp - 4]
call fcn.004b7408
pop edx
mov byte [eax + esi - 1], dl
inc ebx
dec byte [ebp - 5]
jne 0x4285c0
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.004b700c
call fcn.004b5de8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x428621
lea eax, [ebp - 4]
call fcn.004b6fb8
ret

Function at 0x4288d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
cmp dword [0x52ee74], 0
je 0x42893a
mov ebx, dword [0x4eee74]
mov eax, dword [ebp + 8]
add eax, 0xfffffffc
push eax
push 0x40
mov eax, dword [0x52ee74]
push eax
mov esi, ebx
push esi
call sub.kernel32.dll_VirtualProtect_1
mov eax, dword [ebp + 8]
add eax, 0xfffffff8
push eax
mov eax, dword [0x52ee74]
push eax
push 0x4dee74
push esi
call sub.kernel32.dll_GetCurrentProcess_1
push eax
call sub.kernel32.dll_WriteProcessMemory_1
mov eax, dword [ebp + 8]
add eax, 0xfffffffc
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
mov eax, dword [0x52ee74]
push eax
push esi
call sub.kernel32.dll_VirtualProtect_1
xor eax, eax
mov dword [0x52ee74], eax
pop esi
pop ebx
pop ebp
ret

Function at 0x428d74
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004b73ec
xor eax, eax
push ebp
push 0x428e0e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4dd998]
mov dword [eax], 0x18f13e8
mov eax, dword [ebp - 4]
call fcn.004b7238
test al, al
jbe 0x428de9
mov byte [ebp - 5], al
mov bl, 1
mov eax, 0x80
call fcn.004b6024
or eax, 0x80
mov esi, ebx
and esi, 0xff
mov edx, dword [ebp - 4]
movzx edx, byte [edx + esi - 1]
xor eax, edx
push eax
lea eax, [ebp - 4]
call fcn.004b7408
pop edx
mov byte [eax + esi - 1], dl
inc ebx
dec byte [ebp - 5]
jne 0x428db4
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.004b700c
call fcn.004b5de8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x428e15
lea eax, [ebp - 4]
call fcn.004b6fb8
ret
Function at 0x4298f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004b73ec
xor eax, eax
push ebp
push 0x42998e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4dd998]
mov dword [eax], 0x18f13e8
mov eax, dword [ebp - 4]
call fcn.004b7238
test al, al
jbe 0x429969
mov byte [ebp - 5], al
mov bl, 1
mov eax, 0x80
call fcn.004b6024
or eax, 0x80
mov esi, ebx
and esi, 0xff
mov edx, dword [ebp - 4]
movzx edx, byte [edx + esi - 1]
xor eax, edx
push eax
lea eax, [ebp - 4]
call fcn.004b7408
pop edx
mov byte [eax + esi - 1], dl
inc ebx
dec byte [ebp - 5]
jne 0x429934
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.004b700c
call fcn.004b5de8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x429995
lea eax, [ebp - 4]
call fcn.004b6fb8
ret
Function at 0x42a4b8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004b73ec
xor eax, eax
push ebp
push 0x42a552
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4dd998]
mov dword [eax], 0x18f13e8
mov eax, dword [ebp - 4]
call fcn.004b7238
test al, al
jbe 0x42a52d
mov byte [ebp - 5], al
mov bl, 1
mov eax, 0x80
call fcn.004b6024
or eax, 0x80
mov esi, ebx
and esi, 0xff
mov edx, dword [ebp - 4]
movzx edx, byte [edx + esi - 1]
xor eax, edx
push eax
lea eax, [ebp - 4]
call fcn.004b7408
pop edx
mov byte [eax + esi - 1], dl
inc ebx
dec byte [ebp - 5]
jne 0x42a4f8
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.004b700c
call fcn.004b5de8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42a559
lea eax, [ebp - 4]
call fcn.004b6fb8
ret
Function at 0x42bcf4
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.004b73ec
xor eax, eax
push ebp
push 0x42bd9f
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x42bd1c
mov dl, 1
mov eax, dword [0x45e0d0]
call fcn.0045e1d0
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x42bd82
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000001
mov eax, dword [ebp - 8]
call fcn.0045e270
mov edx, 0x42bdb4
mov eax, dword [ebp - 8]
call fcn.0045e3fc
test al, al
je 0x42bd64
mov ecx, ebx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.0045e788
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42bd89
mov eax, dword [ebp - 8]
call fcn.0045e240
mov eax, dword [ebp - 8]
call fcn.004b635c
ret

Function at 0x42c36c
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ecx, dword [ebp + 8]
test ecx, ecx
jle 0x42c38d
cmp ecx, 0x100
jle 0x42c3a3
mov ecx, 0x42c430
mov dl, 1
mov eax, dword [0x4ada18]
call fcn.004b1ae0
call fcn.004b6ab4
xor ebx, ebx
mov esi, dword [ebp - 4]
lea edi, [ebp - 0x109]
mov byte [esi], bl
mov eax, ebx
cdq
idiv ecx
add edx, dword [ebp - 8]
mov al, byte [edx]
mov byte [edi], al
inc ebx
inc edi
inc esi
cmp ebx, 0x100
jne 0x42c3ae
xor esi, esi
mov ebx, 0x100
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x109]
xor ecx, ecx
mov cl, byte [eax]
add esi, ecx
xor ecx, ecx
mov cl, byte [edx]
add esi, ecx
and esi, 0xff
mov cl, byte [eax]
mov byte [ebp - 9], cl
mov ecx, dword [ebp - 4]
mov cl, byte [ecx + esi]
mov byte [eax], cl
mov ecx, dword [ebp - 4]
lea edi, [ecx + esi]
mov cl, byte [ebp - 9]
mov byte [edi], cl
inc edx
inc eax
dec ebx
jne 0x42c3d7
mov edx, dword [ebp - 4]
add edx, 0x100
mov eax, dword [ebp - 4]
mov ecx, 0x100
call fcn.004b5cd8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x42c464
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor eax, eax
xor ecx, ecx
mov ebx, dword [ebp + 8]
dec ebx
test ebx, ebx
jl 0x42c4f7
inc ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], 0
jmp 0x42c48d
inc eax
and al, 0xff
xor ebx, ebx
mov bl, al
add cl, byte [edx + ebx]
and cl, 0xff
xor ebx, ebx
mov bl, al
mov bl, byte [edx + ebx]
mov byte [ebp - 5], bl
mov esi, ecx
and esi, 0xff
xor ebx, ebx
mov bl, al
lea edi, [edx + ebx]
mov bl, byte [edx + esi]
mov byte [edi], bl
mov bl, byte [ebp - 5]
mov byte [edx + esi], bl
xor ebx, ebx
mov bl, al
mov bl, byte [edx + ebx]
mov esi, ecx
and esi, 0xff
add bl, byte [edx + esi]
and bl, 0xff
mov byte [ebp - 5], bl
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 0xc]
mov bl, byte [ebx + esi]
movzx esi, byte [ebp - 5]
xor bl, byte [edx + esi]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp - 0xc]
mov byte [esi + edi], bl
inc dword [ebp - 0xc]
dec dword [ebp - 0x10]
jne 0x42c487
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x42c5d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004b73ec
xor eax, eax
push ebp
push 0x42c672
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x42c5fc
mov eax, dword [0x4dd998]
mov dword [eax], 0x18f13e8
mov eax, dword [ebp - 4]
call fcn.004b7238
test al, al
jbe 0x42c64d
mov byte [ebp - 5], al
mov bl, 1
mov eax, 0x80
call fcn.004b6024
or eax, 0x80
mov esi, ebx
and esi, 0xff
mov edx, dword [ebp - 4]
movzx edx, byte [edx + esi - 1]
xor eax, edx
push eax
lea eax, [ebp - 4]
call fcn.004b7408
pop edx
mov byte [eax + esi - 1], dl
inc ebx
dec byte [ebp - 5]
jne 0x42c618
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.004b700c
call fcn.004b5de8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42c679
lea eax, [ebp - 4]
call fcn.004b6fb8
ret

Function at 0x42ce5c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004b73ec
xor eax, eax
push ebp
push 0x42cef6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4dd998]
mov dword [eax], 0x18f13e8
mov eax, dword [ebp - 4]
call fcn.004b7238
test al, al
jbe 0x42ced1
mov byte [ebp - 5], al
mov bl, 1
mov eax, 0x80
call fcn.004b6024
or eax, 0x80
mov esi, ebx
and esi, 0xff
mov edx, dword [ebp - 4]
movzx edx, byte [edx + esi - 1]
xor eax, edx
push eax
lea eax, [ebp - 4]
call fcn.004b7408
pop edx
mov byte [eax + esi - 1], dl
inc ebx
dec byte [ebp - 5]
jne 0x42ce9c
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.004b700c
call fcn.004b5de8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42cefd
lea eax, [ebp - 4]
call fcn.004b6fb8
ret
Function at 0x42ec6c
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov byte [ebp - 1], 0
lea eax, [ebp - 8]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread_1
push eax
call sub.ADVAPI32.dll_OpenThreadToken_1
mov ebx, eax
test ebx, ebx
jne 0x42ecb1
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x3f0
jne 0x42ecb1
lea eax, [ebp - 8]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess_1
push eax
call sub.ADVAPI32.dll_OpenProcessToken_1
mov ebx, eax
test ebx, ebx
je 0x42ed42
mov eax, 0x400
call fcn.004b5b4c
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 0x400
push esi
push 2
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.dll_GetTokenInformation_1
mov ebx, eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
test ebx, ebx
je 0x42ed3b
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
push 0x4d3a2c
call sub.ADVAPI32.dll_AllocateAndInitializeSid_1
mov ebx, dword [esi]
dec ebx
test ebx, ebx
jl 0x42ed32
inc ebx
xor edi, edi
mov eax, dword [esi + edi*8 + 4]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.ADVAPI32.dll_EqualSid_1
test eax, eax
je 0x42ed2e
mov byte [ebp - 1], 1
jmp 0x42ed32
inc edi
dec ebx
jne 0x42ed16
mov eax, dword [ebp - 0x10]
push eax
call sub.ADVAPI32.dll_FreeSid_1
mov eax, esi
call fcn.004b5b64
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4399d8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
mov ebx, eax
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x439a20
call sub.kernel32.dll_GetVolumeInformationA_1
push ebx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0
lea edx, [ebp - 0x14]
xor ecx, ecx
mov eax, 0x439a2c
call fcn.004af708
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x439ad4
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
xor edx, edx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x439bec
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4dd7dc]
cmp dword [eax], 2
jne 0x439b10
mov ebx, 1
jmp 0x439bc4
lea eax, [ebp - 0x3c]
call fcn.00439818
cmp dword [ebp - 0x3c], 0
je 0x439b28
mov ebx, 1
jmp 0x439bc4
push 0x2d
lea eax, [ebp - 0x35]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA_1
lea eax, [ebp - 0x40]
lea edx, [ebp - 0x35]
mov ecx, 0x2d
call fcn.004b71e8
mov edx, dword [ebp - 0x40]
lea eax, [ebp - 8]
mov ecx, 0x439c04
call fcn.004b7284
mov eax, dword [ebp - 8]
call fcn.004aec6c
test al, al
je 0x439b66
mov ebx, 1
jmp 0x439bc4
lea eax, [ebp - 0x44]
lea edx, [ebp - 0x35]
mov ecx, 0x2d
call fcn.004b71e8
mov edx, dword [ebp - 0x44]
lea eax, [ebp - 4]
mov ecx, 0x439c2c
call fcn.004b7284
mov eax, dword [ebp - 4]
call fcn.004aec6c
test al, al
jne 0x439b97
or ebx, 0xffffffff
jmp 0x439bc4
test bl, bl
je 0x439bc1
push 0
mov eax, dword [ebp - 8]
call fcn.004b73fc
push eax
mov eax, dword [ebp - 4]
call fcn.004b73fc
push eax
call sub.kernel32.dll_CopyFileA_1
test eax, eax
je 0x439bbc
xor ebx, ebx
jmp 0x439bc4
or ebx, 0xffffffff
jmp 0x439bc4
or ebx, 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x439bf3
lea eax, [ebp - 0x44]
mov edx, 3
call fcn.004b6fdc
lea eax, [ebp - 8]
mov edx, 2
call fcn.004b6fdc
ret
Function at 0x43b560
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea edx, [ebp - 0x44]
mov eax, dword [ebp - 4]
mov ecx, 0x10
call fcn.004b5cd8
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 8]
mov ecx, 8
call fcn.004b5cd8
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
lea eax, [eax + eax*2]
xor edx, edx
mov dl, byte [ebp - 9]
add edx, edx
lea edx, [edx + edx*2]
lea edx, [edx*8 + 0x4d76a4]
mov eax, dword [edx + eax*4]
mov eax, dword [ebp + eax*4 - 0x44]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
lea eax, [eax + eax*2]
xor edx, edx
mov dl, byte [ebp - 9]
add edx, edx
lea edx, [edx + edx*2]
lea edx, [edx*8 + 0x4d76a4]
mov eax, dword [edx + eax*4 + 4]
mov eax, dword [ebp + eax*4 - 0x44]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
lea eax, [eax + eax*2]
xor edx, edx
mov dl, byte [ebp - 9]
add edx, edx
lea edx, [edx + edx*2]
lea edx, [edx*8 + 0x4d76a4]
mov eax, dword [edx + eax*4 + 8]
mov eax, dword [ebp + eax*4 - 0x44]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
add dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
add dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x28]
shr eax, 7
xor dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
add dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
add dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x2c]
shl eax, 0xd
xor dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
add dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
add dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x30]
shr eax, 0x11
xor dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
add dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
add dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x34]
shl eax, 9
xor dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
add dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
add dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x28]
shr eax, 3
xor dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
add dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
shl eax, 7
xor dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
add dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x34]
shr eax, 0xf
xor dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
add dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
shl eax, 0xb
xor dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x20]
xor eax, dword [ebp - 0x34]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jne 0x43b5a0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x14]
mov ecx, 8
call fcn.004b5cd8
mov esp, ebp
pop ebp
ret
Function at 0x43b740
Capabilities:
Encrypt data using blowfish

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push esi
push edi
mov esi, eax
lea edi, [ebp - 0x2c]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], edx
mov edx, dword [ebp - 4]
mov eax, 0x4d3ba4
mov ecx, 0x48
call fcn.004b5cd8
mov edx, dword [ebp - 4]
add edx, 0x48
mov eax, 0x4d3bec
mov ecx, 0x1000
call fcn.004b5cd8
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
shl eax, 8
mov edx, dword [ebp - 0xc]
movzx edx, byte [ebp + edx - 0x2c]
or eax, edx
mov dword [ebp - 0x14], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x10
jl 0x43b7b3
xor eax, eax
mov dword [ebp - 0xc], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jne 0x43b792
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
xor dword [eax + edx*4], ecx
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x12
jne 0x43b788
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
mov cl, 1
call sym.Project1.exe__Lbxcipher_EncryptBF_qqrrx20Lbxcipher_TBFContextpio
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
mov dword [eax + edx*4], ecx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x18]
mov dword [eax + edx*4 + 4], ecx
add dword [ebp - 8], 2
cmp dword [ebp - 8], 0x11
jle 0x43b7e0
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
mov cl, 1
call sym.Project1.exe__Lbxcipher_EncryptBF_qqrrx20Lbxcipher_TBFContextpio
mov eax, dword [ebp - 0xc]
shl eax, 7
mov edx, dword [ebp - 4]
lea eax, [edx + eax*8]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
mov dword [eax + edx*4 + 0x48], ecx
mov eax, dword [ebp - 0xc]
shl eax, 7
mov edx, dword [ebp - 4]
lea eax, [edx + eax*8]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x18]
mov dword [eax + edx*4 + 0x4c], ecx
add dword [ebp - 8], 2
cmp dword [ebp - 8], 0xff
jle 0x43b81a
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jne 0x43b815
pop edi
pop esi
mov esp, ebp
pop ebp
ret