joyce8/EMBER2024-capa huggingface dataset:
Function at 0xdbb9a0
Capabilities:
Encode data using xor

Disassembly:
jmp 0xdbb9aa
pushal
call 0xdbb9b0
pop ebp
sub ebp, 0x10
sub ebp, 0x9bb9a0
jmp 0xdbb9c6
mov eax, 0x9bb9a0
add eax, ebp
add eax, 0x4c
mov ecx, 0x5a8
mov edx, 0x5b6d8600
xor byte [eax], dl
inc eax
dec ecx
jne 0xdbb9dd
jmp 0xdbb9f0
mov ecx, ebp
mov ecx, dword [ecx + 0x3c]
add ecx, 0xf8
add ecx, ebp
mov eax, 5
mov edx, 0x28
mul edx
add ecx, eax
mov eax, dword [ecx + 0xc]
add eax, ebp
lea esp, [esp - 4]
mov dword [esp], eax
lea esp, [esp - 4]
mov dword [esp], eax
push 0x217a48
push 0x7a3f58
add dword [esp], ebp
push 0x27efaf0
call fcn.00dbba40
jmp 0xdbba68
mov ecx, dword [esp + 4]
push 0x217a48
push 0x7a3f58
add dword [esp], ebp
push ecx
call fcn.00dbba87
jmp 0xdbbcce
pop edi
pop esi
jmp 0xdbbcd9
mov eax, 0x9bb9a0
add eax, ebp
add eax, 0x35f
mov ecx, 0x295
mov edx, 0xda052109
xor byte [eax], dl
inc eax
dec ecx
jne 0xdbbcf0
jmp 0xdbbd03
invalid

Function at 0xdbba40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
shr ecx, 2
xor dword [edx], eax
add edx, 4
dec ecx
jne 0xdbba58
pop ebp
ret 0xc
Function at 0xdbbb0f
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebp
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0xdbbb40
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xdbbb1e
add dl, dl
jne 0xdbbb53
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xdbbbc3
xor eax, eax
add dl, dl
jne 0xdbbb68
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xdbbc98
add dl, dl
jne 0xdbbb7b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xdbbb8a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xdbbb99
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xdbbba8
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xdbbbb6
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xdbbb33
mov eax, 1
add dl, dl
jne 0xdbbbd5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xdbbbe4
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xdbbbc8
sub eax, ebx
mov ebx, 1
jne 0xdbbc2b
mov ecx, 1
add dl, dl
jne 0xdbbc09
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xdbbc18
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xdbbbfc
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xdbbb33
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xdbbc46
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xdbbc55
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xdbbc39
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xdbbb33
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xdbbcc0
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xdbbb33
pop ebp
sub edi, dword [ebp + 8]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x1000b570
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002927b
mov eax, dword fs:[0]
push eax
sub esp, 0x168
push esi
mov eax, dword [0x10040bd0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
cmp dword [eax], 0x8b55ff8b
je 0x1000b792
cmp dword [0x1004106c], 1
jne 0x1000b630
push 1
push 0x40
push 8
push 0x1002c04c
lea ecx, [ebp - 0x174]
call fcn.10004a10
lea eax, [ebp - 0x174]
mov dword [ebp - 4], 0
push str._nSP_Scan:
push eax
call fcn.100045b0
lea eax, [ebp - 0x174]
push 0x1002c070
push eax
call fcn.100045b0
add esp, 0x10
lea ecx, [ebp - 0x170]
call fcn.100054f0
test eax, eax
jne 0x1000b61e
push eax
mov eax, dword [ebp - 0x174]
lea ecx, [ebp - 0x174]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP140D.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
lea ecx, [ebp - 0x174]
mov dword [ebp - 4], 0xffffffff
call fcn.10005000
cmp dword [0x1004107c], 1
jne 0x1000b70f
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ucrtbased.dll__time64]
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ucrtbased.dll__localtime64]
add esp, 8
lea ecx, [ebp - 0xc4]
mov esi, eax
push 1
push 0x40
push 8
push 0x1002c088
call fcn.10004a10
lea eax, [ebp - 0xc4]
mov dword [ebp - 4], 1
push 0x1002c08c
push eax
call fcn.100045b0
push esi
call dword [sym.imp.ucrtbased.dll_asctime]
push eax
lea eax, [ebp - 0xc4]
push eax
call fcn.100045b0
lea eax, [ebp - 0xc4]
push str.SP_Scan:
push eax
call fcn.100045b0
lea eax, [ebp - 0xc4]
push 0x1002c0ac
push eax
call fcn.100045b0
lea eax, [ebp - 0xc4]
push 0x1002c0c4
push eax
call fcn.100045b0
add esp, 0x2c
lea ecx, [ebp - 0xc0]
call fcn.100054f0
test eax, eax
jne 0x1000b6f7
push eax
mov eax, dword [ebp - 0xc4]
lea ecx, [ebp - 0xc4]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP140D.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
push 2
push 0x1002c0ec
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xc4]
call fcn.10005000
mov eax, dword [0x10041070]
push 0
cmp eax, 1
jne 0x1000b741
push 0
push 0
push 0x1000b4a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x1000b751
push 0
push 0
push 0x1000b420
jmp 0x1000b724
cmp eax, 3
jne 0x1000b761
push 0
push 0
push 0x1000b520
jmp 0x1000b724
cmp eax, 4
jne 0x1000b73b
push 0
push 0
push 0x10026da0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x200010
push str.SP_Scan
push 0x1002c0f8
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x1000b739
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10017110
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Get mac address on windows

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [sym.imp.ucrtbased.dll_malloc]
push ebp
push esi
push edi
push 0x14
mov dword [esp + 0x14], 4
call ebx
push 0x288
mov dword [esp + 0x20], eax
call ebx
mov esi, dword [sym.imp.ucrtbased.dll__wassert]
mov edi, eax
add esp, 8
test edi, edi
jne 0x10017157
push 0x179
push 0x10030340
push 0x100302e4
call esi
add esp, 0xc
mov ebp, dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
lea eax, [esp + 0x10]
push eax
push edi
call ebp
cmp eax, 0x6f
jne 0x1001726e
push dword [esp + 0x10]
call ebx
mov edi, eax
add esp, 4
mov dword [esp + 0x1c], edi
test edi, edi
jne 0x10017195
push 0x17d
push str.F:CODEX_ANTIHACK_V5CODEX_V5_DLLCodex_ProtectHardware_Ban.cpp
push 0x100303c4
call esi
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push edi
call ebp
test eax, eax
jne 0x10017256
mov dword [esp + 0x14], 0x1003030c
mov ebp, dword [esp + 0x14]
mov esi, dword [esp + 0x14]
add esi, 0x14
cmp byte [ebp + 0x13], al
je 0x10017204
mov eax, dword [ebp + 0xf]
inc eax
push eax
call ebx
mov ebx, eax
add esp, 4
mov eax, dword [ebp + 0xf]
xor edx, edx
mov dword [esp + 0x14], eax
test eax, eax
je 0x100171fe
sub esi, ebx
mov edi, eax
nop word [eax + eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + ebp + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
cmp edx, edi
jb 0x100171e0
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov byte [eax + ebx], 0
mov esi, ebx
movzx eax, byte [edi + 0x199]
push eax
movzx eax, byte [edi + 0x198]
push eax
movzx eax, byte [edi + 0x197]
push eax
movzx eax, byte [edi + 0x196]
push eax
movzx eax, byte [edi + 0x195]
push eax
movzx eax, byte [edi + 0x194]
push eax
push esi
mov esi, dword [esp + 0x34]
push esi
call fcn.10018540
add esp, 0x20
push edi
call dword [sym.imp.ucrtbased.dll_free]
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov esi, dword [esp + 0x18]
push edi
call dword [sym.imp.ucrtbased.dll_free]
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
call fcn.10015fe0
int3

Function at 0x10017280
Capabilities:
Create thread
Delete file

Disassembly:
push esi
mov esi, dword [sym.imp.ucrtbased.dll_remove]
push 0x10030604
call esi
push 0x10030608
call esi
push 0x1003060c
call esi
add esp, 0xc
push 0
push 0
push 0
push 0x100180d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop esi
ret
Function at 0x763a6e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], esp
call fcn.00763a70
loope 0x763ac7
cmc
pushfd
outsd dx, dword [esi]
ficom dword [ecx]
xchg esi, eax
add al, 0x63
sahf
sub dword [edi - reloc.WINMM.dll_midiStreamStop], eax
jmp 0x763a58
call 0x763aa7
jmp 0x763a58
inc ebp
jne 0x763b3a
push ebx
mov dword [esi - 0x65], ebp
or eax, 0x61342672
imul esp, dword [esi], reloc.WINMM.dll_midiStreamStop
out dx, eax
imul esp, dword [esi], reloc.WINMM.dll_midiStreamStop
lahf
insd dword es:[edi], dx
dec ebx
dec esp
insb byte es:[edi], dx
movsd dword es:[edi], dword es:[esi]
retf 0x266c
imul esp, dword [esi], reloc.WINMM.dll_midiStreamStop
pushfd
das
insb byte es:[edi], dx
jnp 0x763b5e
jo 0x763b6e
out dx, al
mov ah, 0x70
cwde
leave
push 0x26
and ebp, dword [edi + 0x26]
mul dword [edi + reloc.WINMM.dll_midiStreamStop]
imul esp, dword [esi], reloc.WINMM.dll_midiStreamStop
push ebp
insd dword es:[edi], dx
mul dword es:[edi - reloc.WINMM.dll_midiStreamStop]
push 0x26
sbb eax, 0x59266b40
add byte [esi - 0x74], ch
test dword [edi + 0x26], ebp
pop es
outsd dx, dword [esi]
insb byte es:[edi], dx
mov word es:[ebp + 0x6f07266f], es
imul esp, dword [esi], reloc.WINMM.dll_midiStreamStop
pop edi
mov byte [0x3719266b], al
outsd dx, dword [esi]
in eax, 0x6c
pop es
fsubr qword [esi + 0x44]
cmp byte [ebx + 0x26], ch
inc edx
adc al, 0x6c
mul dword es:[edi - reloc.WINMM.dll_midiStreamStop]
push 0x26
or dl, al
outsd dx, dword [esi]
pop es
imul esp, dword ds:[esi], reloc.WINMM.dll_midiStreamStop
and ebp, dword [esi - 0x22]
mov al, 0x6a
iretd

Function at 0x763aa7
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp], sp
mov word [esp + 1], bx
mov dword [esp], edx
jmp 0x763a8c
push dword [esp + 0xf]
jmp 0x764020
pushal
mov word [esp + 0x13], si
pop word [esp + 0x1b]
lea esp, [esp + 0x18]
lea esp, [esp + 2]
mov dword [esp], ebx
call fcn.00763a6e
pushal
push word [esp + 5]
jb 0x763a75
push dword [esp + 0xf]
lea esp, [esp + 2]
jmp 0x763f32
mov dword [esp + 0x28], ebp
lea esp, [esp + 2]
mov dword [esp + 0x28], ebp
pushfd
mov dword [esp], edx

Function at 0x763ec0
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.00763efe
test eax, 0x23d0b121
in al, 0xe9
invalid

Function at 0x763edf
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf074ed98
jmp 0x763f13
mov dword [esp + 0x28], esi
call fcn.00763ec0
mov byte [esp + 8], bl
mov dword [esp + 0x30], edi
lea esp, [esp + 0x30]
jmp 0x763f0d
pushfd
jmp 0x76389f
lea ebp, [eax + eax]
bsf edi, ecx
ja 0x763f73
jbe 0x763f55
adc dword [ebx], 0x76
test dword [ecx - 0x35], eax
inc esp
fidivr dword [ebp - 0xe8076b4]
popal
add bl, dh
xor esi, dword [eax + 0x73]
push 0xffffffffffffff89
insb byte es:[edi], dx
and al, 0x28
pushfd
mov dword [esp], edx
jmp 0x76402c
bswap eax
mov ebx, dword [esp]
jmp 0x763f5d
lea ecx, [ecx + edi]
neg ax
jmp 0x763f79
lea esi, [esp]
lea ecx, [ebp*4]
rdtsc
sub esp, 4
jmp 0x763f98
lea ecx, [ecx + edi]
neg ax
mov edi, dword [esp + 0x2c]
lea ebp, [esp + eax]
jmp 0x763f3f
jnp 0x763fe0
jp 0x763fe0
sub esp, 0xbc
mov ebp, esp
mov word [esp + 1], di
jmp 0x763ed6
Function at 0x763efe
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 1], sp
mov word [esp + 3], cx
call fcn.00763edf

Function at 0x83f379
Capabilities:
Execute anti-debugging instructions

Disassembly:
setbe dh
bsr dx, di
pop bx
setle al
btc ax, ax
jmp 0x83f234
xchg byte [esp + 0x15], dl
xchg word [esp + 6], dx
call fcn.0083f1fc
bsr eax, esp
sub esp, 0x14
rdtsc
bswap edx
mov dh, byte [esp + 4]
jmp 0x83f285
xchg dh, bh
xchg dh, dl
mov dx, 0x4166
pop dword [esp + 1]
jmp 0x83f34f
push word [esp + 0x2c]
xor bh, ch
xchg byte [esp + 0x34], bh
xchg byte [esp + 0x32], al
mov edx, eax
jmp 0x83f26f
lea edx, reloc.WINMM.dll_midiStreamStop
mov edx, ebx
push word [esp + 0x21]
jmp 0x83f2df
lea esp, [esp + 0x28]
xchg dword [esp + 2], ebx
xchg byte [esp + 6], dl
pop dword [esp]
pushal
bswap ebx
jmp 0x83f2b5
bsr bx, cx
mov ah, bl
mov dword [esp + 0x13], eax
call fcn.0083f328
ja 0x83f351
jbe 0x83f357
dec edi
jne 0x83f369
dec edi
jo 0x83f35d
outsb dx, byte [esi]
add byte [ebp - 0x5cf0e1af], cl
lea edx, [ecx + 0x1e]
bt edx, edx
setl al
mov word [esp + 0x1e], di
ror byte [edi], cl
pushfd
shl byte [esi - 0x77], 0x7c
and al, 0x1e
mov dword [esp + 0xe], esi
mov dx, 0x79d7
jmp 0x83f2cb
push word [esp + 0x21]
shl ebx, cl
pop eax
je 0x83f377
and ebx, edx
jecxz 0x83f3af
add ebx, esi
lea eax, reloc.WINMM.dll_midiStreamStop
bswap ebx
jmp 0x83f2fa
mov eax, dword [reloc.WINMM.dll_midiStreamStop]
xchg edi, eax
bswap ebx
inc ebx
not al
shl dl, cl
pop dword [esp + 6]
loop 0x83f2fa
inc esp
and al, 6
setbe bh
jmp 0x83f381
scasd eax, dword es:[edi]
mov dh, 0xd3
loop 0x83f2ff
les eax, [0x8ae2ebf5]
lds ecx, [edi]
mov esp, 0x9b0f5ac7
les ecx, [eax - 0x7699dbdc]
insb byte es:[edi], dx
and al, 1
mov al, ch
bsf eax, edi
pop edx
setnp ah
mov byte [esp], ah
mov word [esp + 1], bp
jmp 0x83f3cb
or ch, al
invalid
mov byte [esp], ah
neg bx
mov word [esp], sp
lea edx, reloc.WINMM.dll_midiStreamStop
jmp 0x83f411
sub esp, 1
mov bl, 0x48
lea esp, [esp + 4]
pop bx
xchg word [esp], bx
mov edx, ebx
jmp 0x83f3b5
rcl dh, cl
lea esp, [esp]
xchg ah, bl
mov bl, byte [esp]
setae ah
mov dx, si
jmp 0x83f448
pushfd
pop word [esp]
rdtsc
bsr dx, si
cld
add esp, 1
jmp 0x83f3de
mov edx, 0x9a685c0f
mov dx, bp
bsr ax, cx
lea eax, [eax*4]
xchg word [esp], bx
pop bx
jmp 0x83f3f4
bswap edx
xchg byte [esp + 0x20], al
pop bx
bswap ebx
mov edx, esp
xchg word [esp + 1], bx
jmp 0x83f475
shl ax, 6
lea edx, reloc.WINMM.dll_midiStreamStop
mov eax, esi
rdtsc
sub esp, 0x1e
push dword [esp + 0xb]
jmp 0x83f42c
xchg dword [esp + 0x11], eax
xchg word [esp + 0x11], bx
mov word [esp + 3], bp
jmp 0x840234
bsr bx, di
xchg bx, dx
bt ax, bx
neg bx
xchg dword [esp + 0xc], edx
jmp 0x83f45f
mov dx, word [esp + 0xf]
xchg dword [esp + 0x15], ebx
bsr bx, dx
xchg word [esp + 8], ax
mov word [esp + 6], di
mov edx, esp
jmp 0x83fe47
Function at 0x843bc0
Capabilities:
Access peb ldr_data

Disassembly:
call fcn.0084300e
mov dword [esp], edi
jmp 0x843c10
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x843c60
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x843009
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0x308002a5
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x3ded722a
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x444da0
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push 0xf003f
push 0x4011d8
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x444dc5
xor eax, eax
jmp 0x444e15
push 0xf01ff
push 0x4011e8
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x444dfc
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x444e15
cmp dword [ebp - 0x18], 4
jne 0x444e13
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
jmp 0x444e15
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x444e99
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
or al, al
je 0x444eb8
mov eax, 1
jmp 0x444eba
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x444ec1
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
push 1
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 4], eax
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov esp, ebp
pop ebp
ret
Function at 0x4454bf
Capabilities:
Contain obfuscated stackstrings
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov byte [ebp - 0x224], 0x12
mov byte [ebp - 0x223], 0x34
mov byte [ebp - 0x222], 0x56
mov byte [ebp - 0x221], 0x78
mov byte [ebp - 0x220], 0x87
mov byte [ebp - 0x21f], 0x65
mov byte [ebp - 0x21e], 0x34
mov byte [ebp - 0x21d], 0x21
mov byte [ebp - 0x234], 0x12
mov byte [ebp - 0x233], 0x34
mov byte [ebp - 0x232], 0x56
mov byte [ebp - 0x231], 0x79
mov byte [ebp - 0x230], 0x97
mov byte [ebp - 0x22f], 0x65
mov byte [ebp - 0x22e], 0x34
mov byte [ebp - 0x22d], 0x21
mov dword [0x4503b8], 1
push 0x208
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0
push 3
push 0
push 3
push 0x80000000
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 0xffffffff
je 0x4456ed
push 0
mov edx, dword [ebp - 0x228]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x22c], eax
push 2
push 0
push 0xfffffffffffffff8
mov eax, dword [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea ecx, [ebp - 0x218]
push ecx
push 8
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x4455ec
mov ecx, dword [ebp - 0x228]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4456ef
push 8
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x224]
push eax
call fcn.0044a220
add esp, 0xc
test eax, eax
je 0x44560c
xor eax, eax
jmp 0x4456ef
push 2
push 0
push 0xfffffffffffffff4
mov ecx, dword [ebp - 0x228]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea edx, [ebp - 0x218]
push edx
push 4
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x228]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x44565e
mov edx, dword [ebp - 0x228]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4456ef
push 4
push 0x1000
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x450b5c], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x22c]
sub eax, dword [edx]
sub eax, 0xc
mov dword [ebp - 0x21c], eax
push 0
push 0
mov ecx, dword [ebp - 0x21c]
push ecx
mov edx, dword [ebp - 0x228]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
mov eax, dword [0x450b5c]
push eax
mov ecx, dword [ebp - 0x228]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x4456e6
mov edx, dword [ebp - 0x228]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4456ef
mov eax, 1
jmp 0x4456ef
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x448405
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov cx, word [eax + 0x14]
mov edx, dword [ebp + 0xc]
lea eax, [edx + ecx + 0x18]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
jmp 0x448439
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
add edx, 0x28
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov cx, word [eax + 6]
cmp dword [ebp - 8], ecx
jae 0x44847f
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x44845f
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0xc]
jb 0x44847d
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
add eax, dword [ebp - 0xc]
cmp dword [ebp + 8], eax
jae 0x44847d
mov eax, dword [ebp - 4]
jmp 0x448481
jmp 0x448427
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x448937
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x1c], 0x9e3779b9
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 0x20], eax
mov dword [ebp - 8], 0
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x24], 0x20
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
sub ecx, 1
mov dword [ebp - 0x24], ecx
test eax, eax
jle 0x4489ef
mov edx, dword [ebp - 8]
sub edx, 0x61c88647
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x20]
shl eax, 4
add eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 8]
xor eax, ecx
mov edx, dword [ebp - 0x20]
shr edx, 5
add edx, dword [ebp - 0xc]
xor eax, edx
mov ecx, dword [ebp - 0x18]
add ecx, eax
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
shl edx, 4
add edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 8]
xor edx, eax
mov ecx, dword [ebp - 0x18]
shr ecx, 5
add ecx, dword [ebp - 0x14]
xor edx, ecx
mov eax, dword [ebp - 0x20]
add eax, edx
mov dword [ebp - 0x20], eax
jmp 0x448989
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
mov dword [ecx], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x20]
mov dword [eax + 4], ecx
mov esp, ebp
pop ebp
ret 8