joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003c17
Capabilities:
Access pe header
Get file attributes
Map section object
Print debug messages

Disassembly:
push 0x84
push 0x10005678
call fcn.1000426c
mov edi, ecx
xor esi, esi
mov dword [ebp - 0x30], esi
push dword [edi + 8]
push str.verify__wZ_n
call sub.ntdll.dll_DbgPrint
pop ecx
pop ecx
push 0x20
push 7
lea eax, [ebp - 0x3c]
push eax
push edi
push 0x120089
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.ntdll.dll_ZwOpenFile]
test eax, eax
jl 0x10003d60
push 5
push 0x18
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.ntdll.dll_ZwQueryInformationFile]
test eax, eax
jl 0x10003d57
push dword [ebp - 0x24]
push 0x8000000
push 8
push esi
push esi
push 0xf001f
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.ntdll.dll_ZwCreateSection]
test eax, eax
jl 0x10003d57
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x28], esi
push 8
push esi
push 2
lea eax, [ebp - 0x28]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x20]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x2c]
call dword [sym.imp.ntdll.dll_ZwMapViewOfSection]
test eax, eax
jl 0x10003d4e
mov dword [ebp - 4], esi
push dword [ebp - 0x20]
call dword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov edi, eax
cmp edi, esi
je 0x10003d3f
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x20]
call fcn.10003a3c
mov ebx, eax
cmp ebx, esi
je 0x10003d3f
cmp dword [ebp - 0x34], 0x40
jne 0x10003d3f
mov dword [edi + 0x58], esi
push 0x40
push ebx
lea eax, [ebp - 0x94]
push eax
call sub.ntdll.dll_memcpy
push 0x40
push str.1234567890123456789012345678901234567890123456789012345678901234
push ebx
call sub.ntdll.dll_memcpy
add esp, 0x18
push dword [ebp + 8]
lea eax, [ebp - 0x94]
push eax
push dword [ebp - 0x28]
push dword [ebp - 0x20]
call fcn.10003b5b
mov dword [ebp - 0x30], eax
push eax
push str.found_signature___u_n
call sub.ntdll.dll_DbgPrint
pop ecx
pop ecx
jmp 0x10003d3f
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x20]
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_ZwUnmapViewOfSection]
push dword [ebp - 0x2c]
call dword [sym.imp.ntdll.dll_ZwClose]
push dword [ebp - 0x24]
call dword [sym.imp.ntdll.dll_ZwClose]
mov eax, dword [ebp - 0x30]
call fcn.100042a7
ret 4

Function at 0x10003d6b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, eax
mov byte [ebp - 1], bl
push edi
shr ebx, 8
xor edi, edi
inc byte [ebp - 1]
movzx eax, byte [ebp - 1]
add eax, esi
add bl, byte [eax]
mov dl, byte [eax]
movzx ecx, bl
add ecx, esi
mov byte [ebp - 2], dl
mov dl, byte [ecx]
mov byte [eax], dl
mov dl, byte [ebp - 2]
mov byte [ecx], dl
movzx eax, byte [eax]
movzx ecx, byte [ecx]
mov edx, dword [ebp + 8]
add eax, ecx
and eax, 0xff
mov al, byte [eax + esi]
add edx, edi
xor byte [edx], al
inc edi
cmp edi, dword [ebp + 0xc]
jl 0x10003d7b
movzx ecx, byte [ebp - 1]
movzx eax, bl
shl eax, 8
pop edi
or eax, ecx
pop ebx
leave
ret 8
Function at 0x40a9d3
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 8
call fcn.004aa3f6
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0x10
call fcn.004aa3f6
add esp, 4
mov dword [ebp - 0x10], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x14], 0
push 0x10
call fcn.004aa3f6
add esp, 4
mov dword [ebp - 0x18], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
push 0
mov ebx, 0x4ae530
call fcn.004aa408
add esp, 4
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
je 0x40aa93
mov eax, 0
jmp 0x40abff
cmp dword [ebp + 0xc], 0
jne 0x40aabf
mov dword [ebp - 0x1c], esp
mov eax, 0x1a
call fcn.004aa40e
cmp dword [ebp - 0x1c], esp
je 0x40aabc
push 6
call fcn.004aa3fc
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp + 0x14], 0
jne 0x40aae7
mov eax, str.SeDebugPrivilege
push eax
mov ebx, dword [ebp + 0x10]
mov ebx, dword [ebx]
test ebx, ebx
je 0x40aae1
push ebx
call fcn.004aa3f0
add esp, 4
pop eax
mov ebx, dword [ebp + 0x10]
mov dword [ebx], eax
mov dword [ebp - 0x1c], esp
lea eax, [ebp - 8]
push eax
push 0x28
push dword [ebp - 4]
mov eax, 0x1b
call fcn.004aa40e
cmp dword [ebp - 0x1c], esp
je 0x40ab12
push 6
call fcn.004aa3fc
add esp, 4
mov dword [ebp - 0x1c], esp
push dword [ebp - 0xc]
mov ebx, dword [ebp + 0x10]
push dword [ebx]
push 0x554e5b
mov eax, 0x1c
call fcn.004aa40e
cmp dword [ebp - 0x1c], esp
je 0x40ab3e
push 6
call fcn.004aa3fc
add esp, 4
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov dword [ebx], 1
mov ebx, dword [ebp - 0x10]
add ebx, 4
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 0x20]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x1c]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x10]
add ebx, 8
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0xc]
add ebx, 4
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 0x20]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x1c]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x10]
add ebx, 0xc
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov dword [ebx], 2
mov dword [ebp - 0x1c], esp
mov eax, 0
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x18]
push 0x1c
push dword [ebp - 0x10]
push 0
push dword [ebp - 8]
mov eax, 0x1d
call fcn.004aa40e
cmp dword [ebp - 0x1c], esp
je 0x40abd2
push 6
call fcn.004aa3fc
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], esp
push dword [ebp - 8]
mov eax, 0x1e
call fcn.004aa40e
cmp dword [ebp - 0x1c], esp
je 0x40abf7
push 6
call fcn.004aa3fc
add esp, 4
mov eax, dword [ebp - 0x14]
jmp 0x40abff
push eax
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.004aa3f0
add esp, 4
mov ebx, dword [ebp - 0x10]
push ebx
call fcn.004aa3f0
add esp, 4
mov ebx, dword [ebp - 0x18]
push ebx
call fcn.004aa3f0
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x420dac
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov eax, 0x6b
mov word [ebp - 0x24], ax
mov ecx, 0x65
mov word [ebp - 0x22], cx
mov edx, 0x72
mov word [ebp - 0x20], dx
mov eax, 0x6e
mov word [ebp - 0x1e], ax
mov ecx, 0x65
mov word [ebp - 0x1c], cx
mov edx, 0x6c
mov word [ebp - 0x1a], dx
mov eax, 0x33
mov word [ebp - 0x18], ax
mov ecx, 0x32
mov word [ebp - 0x16], cx
mov edx, 0x2e
mov word [ebp - 0x14], dx
mov eax, 0x64
mov word [ebp - 0x12], ax
mov ecx, 0x6c
mov word [ebp - 0x10], cx
mov edx, 0x6c
mov word [ebp - 0xe], dx
xor eax, eax
mov word [ebp - 0xc], ax
mov dword [ebp - 4], 0
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x420e60
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.00420d3c
add esp, 8
cmp eax, 0
mov eax, dword [ebx + 0x10]
mov ebx, dword [ebx]
jne 0x420e39
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x420e6c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebp
push edi
mov edi, ecx
mov ebp, edx
test edi, edi
je 0x420e87
test ebp, ebp
je 0x420e87
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x420e8f
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x10], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ebx
cmp ecx, ebx
ja 0x420ecf
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x420f2b
mov ecx, ebx
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x420f26
mov eax, dword [esp + 0x14]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x420f11
test dl, dl
je 0x420f0d
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x420f11
add ecx, 2
add eax, 2
test dl, dl
jne 0x420ef1
xor eax, eax
jmp 0x420f16
sbb eax, eax
or eax, 1
test eax, eax
je 0x420f35
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
inc esi
cmp esi, eax
jb 0x420ede
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [esp + 0x20]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
Function at 0x420f4c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push edi
mov edi, edx
mov ebx, ecx
call fcn.00420dac
test eax, eax
jne 0x420f64
pop edi
pop ebx
add esp, 0x10
ret
push esi
lea edx, [esp + 0xc]
mov ecx, eax
mov dword [esp + 0xc], 0x74726956
mov dword [esp + 0x10], 0x416c6175
mov dword [esp + 0x14], 0x636f6c6c
mov byte [esp + 0x18], 0
call fcn.00420e6c
mov esi, eax
test esi, esi
jne 0x420f9a
pop esi
pop edi
pop ebx
add esp, 0x10
ret
push 0x40
push 0x3000
push edi
push ebx
call esi
test eax, eax
jne 0x420fb4
push 0x40
push 0x3000
push edi
push eax
call esi
pop esi
pop edi
pop ebx
add esp, 0x10
ret
Function at 0x4210ac
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x44
push esi
push edi
mov dword [esp + 0x1c], edx
mov edi, ecx
call fcn.00420dac
mov esi, eax
test esi, esi
jne 0x4210ca
pop edi
xor eax, eax
pop esi
add esp, 0x44
ret
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x64616f4c
mov dword [esp + 0x3c], 0x7262694c
mov dword [esp + 0x40], 0x41797261
mov byte [esp + 0x44], 0
call fcn.00420e6c
mov dword [esp + 0x18], eax
test eax, eax
je 0x4210c2
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x65657246
mov dword [esp + 0x3c], 0x7262694c
mov dword [esp + 0x40], 0x797261
call fcn.00420e6c
mov dword [esp + 0x34], eax
test eax, eax
je 0x4210c2
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x50746547
mov dword [esp + 0x3c], 0x41636f72
mov dword [esp + 0x40], 0x65726464
mov word [esp + 0x44], 0x7373
mov byte [esp + 0x46], 0
call fcn.00420e6c
mov dword [esp + 0x28], eax
test eax, eax
je 0x4210c2
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x4d746547
mov dword [esp + 0x3c], 0x6c75646f
mov dword [esp + 0x40], 0x6e614865
mov dword [esp + 0x44], 0x41656c64
mov byte [esp + 0x48], 0
call fcn.00420e6c
mov dword [esp + 0x30], eax
test eax, eax
je 0x4210c2
mov eax, dword [edi + 0x3c]
push ebx
cmp dword [eax + edi + 0x84], 0
push ebp
je 0x421291
mov ecx, dword [eax + edi + 0x80]
add ecx, edi
xor esi, esi
lea ebx, [ecx + 0xc]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x10], esi
cmp dword [ebx], esi
je 0x421291
mov eax, ebx
mov ebp, ecx
mov eax, dword [eax]
add eax, edi
push eax
mov dword [esp + 0x2c], eax
call dword [esp + 0x24]
mov dword [esp + 0x2c], eax
mov eax, dword [ebp]
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x4211f4
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x1c], eax
add eax, edi
mov dword [esp + 0x14], 0
cmp dword [eax], 0
je 0x421275
mov dword [esp + 0x18], 0
nop
mov eax, dword [eax]
test eax, eax
jns 0x421217
movzx esi, ax
jmp 0x42121c
lea esi, [edi + 2]
add esi, eax
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x42123b
push dword [esp + 0x58]
and eax, 0x80000000
push eax
push esi
push dword [esp + 0x34]
call ecx
mov ecx, eax
test ecx, ecx
jne 0x42124a
push esi
push dword [esp + 0x30]
call dword [esp + 0x38]
mov ecx, eax
test ecx, ecx
je 0x42129e
mov eax, dword [ebp + 0x10]
add eax, dword [esp + 0x18]
mov dword [eax + edi], ecx
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
inc ecx
mov dword [esp + 0x14], ecx
shl ecx, 2
add eax, ecx
add eax, edi
mov dword [esp + 0x18], ecx
cmp dword [eax], 0
jne 0x42120c
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
inc esi
mov dword [esp + 0x10], esi
lea eax, [esi + esi*4]
lea ebp, [ecx + eax*4]
cmp dword [ebp + 0xc], 0
lea eax, [ebp + 0xc]
jne 0x4211d1
pop ebp
pop ebx
pop edi
mov eax, 1
pop esi
add esp, 0x44
ret
cmp dword [ebx], 0
je 0x4212c7
mov esi, dword [esp + 0x10]
xor ebp, ebp
lea ecx, [ecx]
cmp ebp, esi
ja 0x4212c7
mov eax, dword [ebx]
add eax, edi
push eax
call dword [esp + 0x3c]
push eax
call dword [esp + 0x40]
add ebx, 0x14
inc ebp
cmp dword [ebx], 0
jne 0x4212ac
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x44
ret
Function at 0x4212dc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push esi
push edi
mov edi, ecx
call fcn.00420dac
mov esi, eax
test esi, esi
je 0x421398
push ebp
lea edx, [esp + 0x10]
mov ecx, esi
mov dword [esp + 0x10], 0x65657246
mov dword [esp + 0x14], 0x7262694c
mov dword [esp + 0x18], 0x797261
call fcn.00420e6c
mov ebp, eax
test ebp, ebp
je 0x421397
lea edx, [esp + 0x10]
mov ecx, esi
mov dword [esp + 0x10], 0x4d746547
mov dword [esp + 0x14], 0x6c75646f
mov dword [esp + 0x18], 0x6e614865
mov dword [esp + 0x1c], 0x41656c64
mov byte [esp + 0x20], 0
call fcn.00420e6c
mov edx, eax
mov dword [esp + 0xc], edx
test edx, edx
je 0x421397
mov ecx, dword [edi + 0x3c]
cmp dword [ecx + edi + 0x84], 0
je 0x421397
push ebx
mov ebx, dword [ecx + edi + 0x80]
add ebx, edi
xor esi, esi
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x421396
lea ebx, [ebx]
add eax, edi
push eax
call edx
push eax
call ebp
mov edx, dword [esp + 0x10]
lea esi, [esi + 1]
lea eax, [esi + esi*4]
mov eax, dword [ebx + eax*4 + 0xc]
test eax, eax
jne 0x42137c
pop ebx
pop ebp
pop edi
pop esi
add esp, 0x18
ret

Function at 0x42662a
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 8], 0x4266dd
mov eax, dword [ebp + 8]
leave
sub esp, 0x60
pushfd
pushal
push dword [esp + 0x84]
push 0
push eax
fnsave dword [esp + 0x30]
wait
push dword fs:[0]
mov dword fs:[0], esp
mov eax, 1
jmp dword [esp + 0xc]

Function at 0x4267f2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x426815
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x426815
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x42681f
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x426861
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x4268c3
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x4268be
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4268a9
test dl, dl
je 0x4268a5
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4268a9
add ecx, 2
add eax, 2
test dl, dl
jne 0x426889
xor eax, eax
jmp 0x4268ae
sbb eax, eax
or eax, 1
test eax, eax
je 0x4268cf
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x426876
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x427869
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 8], 0
jge 0x42788b
mov eax, 0xfffffffd
jmp 0x42795d
cmp dword [0x7edacc], 0
je 0x427936
cmp dword [0x7edad0], 5
jl 0x4278b9
cmp dword [0x7edad0], 7
jg 0x4278b9
mov eax, 1
jmp 0x4278be
mov eax, 0
test eax, eax
jne 0x4278d7
cmp dword [0x7edad0], 0xfffffffb
je 0x4278d7
xor eax, eax
jmp 0x4278dc
mov eax, 1
test eax, eax
je 0x427908
mov eax, dword [ebp]
add eax, 0x80
mov ecx, 0x20
push dword [eax]
sub eax, 4
loop 0x4278f1
mov eax, dword [ebp + 8]
call dword fs:[0xc0]
nop
nop
leave
ret 4
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0xffff
shr ecx, 0x10
and ecx, 0xffff
mov edx, dword [ebp]
lea edx, [edx + 8]
call dword fs:[0xc0]
nop
nop
nop
nop
nop
leave
ret 4
cmp dword [0x7edacc], 0
jne 0x427953
mov eax, dword [ebp + 8]
mov edx, dword [ebp]
lea edx, [edx + 8]
int 0x2e
nop
leave
ret 4
mov eax, 0
jmp 0x42795d
mov esp, ebp
pop ebp
ret 4
Function at 0x433fe2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov eax, 0x692c3b
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00420cf2
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x434016
push ebx
call fcn.004aa3f0
add esp, 4
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov ebx, dword [ebp - 4]
mov ecx, dword [ebp + 8]
xor edx, edx
not ecx
cmp dword [ebp + 0x10], edx
jbe 0x434045
push esi
mov esi, dword [ebp + 0xc]
movzx eax, byte [edx + esi]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [ebx + eax*4]
inc edx
cmp edx, dword [ebp + 0x10]
jl 0x43402f
pop esi
not ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
jmp 0x434052
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4896ab
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
and eax, 1
leave
ret

Function at 0x48ac81
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov eax, 0x6b
mov word [ebp - 0x24], ax
mov ecx, 0x65
mov word [ebp - 0x22], cx
mov edx, 0x72
mov word [ebp - 0x20], dx
mov eax, 0x6e
mov word [ebp - 0x1e], ax
mov ecx, 0x65
mov word [ebp - 0x1c], cx
mov edx, 0x6c
mov word [ebp - 0x1a], dx
mov eax, 0x33
mov word [ebp - 0x18], ax
mov ecx, 0x32
mov word [ebp - 0x16], cx
mov edx, 0x2e
mov word [ebp - 0x14], dx
mov eax, 0x64
mov word [ebp - 0x12], ax
mov ecx, 0x6c
mov word [ebp - 0x10], cx
mov edx, 0x6c
mov word [ebp - 0xe], dx
xor eax, eax
mov word [ebp - 0xc], ax
mov dword [ebp - 4], 0
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x48ad35
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0048ac11
add esp, 8
cmp eax, 0
mov eax, dword [ebx + 0x10]
mov ebx, dword [ebx]
jne 0x48ad0e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48ad41
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebp
push edi
mov edi, ecx
mov ebp, edx
test edi, edi
je 0x48ad5c
test ebp, ebp
je 0x48ad5c
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x48ad64
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x10], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ebx
cmp ecx, ebx
ja 0x48ada4
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x48ae00
mov ecx, ebx
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x48adfb
mov eax, dword [esp + 0x14]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x48ade6
test dl, dl
je 0x48ade2
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x48ade6
add ecx, 2
add eax, 2
test dl, dl
jne 0x48adc6
xor eax, eax
jmp 0x48adeb
sbb eax, eax
or eax, 1
test eax, eax
je 0x48ae0a
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
inc esi
cmp esi, eax
jb 0x48adb3
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [esp + 0x20]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret

Function at 0x48ae21
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push esi
push edi
mov edi, ecx
call fcn.0048ac81
mov esi, eax
test esi, esi
je 0x48aedd
push ebp
lea edx, [esp + 0x10]
mov ecx, esi
mov dword [esp + 0x10], 0x65657246
mov dword [esp + 0x14], 0x7262694c
mov dword [esp + 0x18], 0x797261
call fcn.0048ad41
mov ebp, eax
test ebp, ebp
je 0x48aedc
lea edx, [esp + 0x10]
mov ecx, esi
mov dword [esp + 0x10], 0x4d746547
mov dword [esp + 0x14], 0x6c75646f
mov dword [esp + 0x18], 0x6e614865
mov dword [esp + 0x1c], 0x41656c64
mov byte [esp + 0x20], 0
call fcn.0048ad41
mov edx, eax
mov dword [esp + 0xc], edx
test edx, edx
je 0x48aedc
mov ecx, dword [edi + 0x3c]
cmp dword [ecx + edi + 0x84], 0
je 0x48aedc
push ebx
mov ebx, dword [ecx + edi + 0x80]
add ebx, edi
xor esi, esi
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x48aedb
lea ebx, [ebx]
add eax, edi
push eax
call edx
push eax
call ebp
mov edx, dword [esp + 0x10]
lea esi, [esi + 1]
lea eax, [esi + esi*4]
mov eax, dword [ebx + eax*4 + 0xc]
test eax, eax
jne 0x48aec1
pop ebx
pop ebp
pop edi
pop esi
add esp, 0x18
ret
Function at 0x4b8d10
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x54b38b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0053f5d6
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x4b8d92
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0053d38d
mov eax, dword [eax]
push 0x7d9d3c
push eax
call fcn.0052e484
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0053f861
test bl, bl
je 0x4b8d92
push 0x7d9d3c
lea ecx, [esp + 0xc]
call fcn.0053fbf1
push 0x7d9d48
lea ecx, [esp + 0xc]
call fcn.0053fbf1
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x4b8dce
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0053f861
jmp 0x4b8e99
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x4b8e52
lea edx, [esp + 0x7c]
push 0x7d9d44
push edx
call fcn.0052e484
add esp, 8
test eax, eax
je 0x4b8e52
lea eax, [esp + 0x7c]
push 0x7d9d40
push eax
call fcn.0052e484
add esp, 8
test eax, eax
je 0x4b8e52
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4b8de2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0053f861
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x4b96c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x4b9722
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc