joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100453e0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0x10
pop eax
call fcn.1005ead0
mov eax, dword [esi + 0x14]
mov eax, dword [eax + 0xc]
or dword [ebp - 8], 0xffffffff
push ebx
push edi
shr eax, 6
xor edi, edi
inc edi
and eax, edi
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0x20]
xor ebx, ebx
push str.OPENSSL_ALLOW_PROXY_CERTS
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], eax
call dword [sym.imp.MSVCR70.dll_getenv]
test eax, eax
pop ecx
je 0x10045420
mov dword [ebp - 0x10], edi
cmp dword [esi + 0x48], ebx
jle 0x100455aa
push ebx
push dword [esi + 0x4c]
call sym.LIBEAY32.dll_sk_value
mov edi, eax
mov eax, dword [esi + 0x14]
test byte [eax + 0xc], 0x10
pop ecx
pop ecx
jne 0x10045462
test byte [edi + 0x29], 2
je 0x10045462
push esi
push 0
mov dword [esi + 0x5c], 0x22
mov dword [esi + 0x58], ebx
mov dword [esi + 0x60], edi
call dword [ebp - 4]
test eax, eax
pop ecx
pop ecx
je 0x100455ad
cmp dword [ebp - 0x10], 0
jne 0x1004548b
test byte [edi + 0x29], 4
je 0x1004548b
push esi
push 0
mov dword [esi + 0x5c], 0x28
mov dword [esi + 0x58], ebx
mov dword [esi + 0x60], edi
call dword [ebp - 4]
test eax, eax
pop ecx
pop ecx
je 0x100455ad
push edi
call sym.LIBEAY32.dll_X509_check_ca
cmp dword [ebp - 8], 0xffffffff
pop ecx
je 0x100454bd
cmp dword [ebp - 8], 0
je 0x100454b0
test eax, eax
je 0x100454cf
mov ecx, dword [esi + 0x14]
test byte [ecx + 0xc], 0x20
je 0x100454ec
cmp eax, 1
jmp 0x100454cd
test eax, eax
je 0x100454ec
mov dword [esi + 0x5c], 0x25
jmp 0x100454d6
mov ecx, dword [esi + 0x14]
test byte [ecx + 0xc], 0x20
je 0x100454ec
cmp eax, 1
je 0x100454ec
test eax, eax
je 0x100454ec
mov dword [esi + 0x5c], 0x18
push esi
push 0
mov dword [esi + 0x58], ebx
mov dword [esi + 0x60], edi
call dword [ebp - 4]
test eax, eax
pop ecx
pop ecx
je 0x100455ad
mov eax, dword [esi + 0x14]
mov eax, dword [eax + 0x10]
test eax, eax
jle 0x10045534
xor ecx, ecx
cmp dword [ebp - 8], ecx
setg cl
push ecx
push eax
push edi
call sym.LIBEAY32.dll_X509_check_purpose
add esp, 0xc
test eax, eax
je 0x1004551b
mov ecx, dword [esi + 0x14]
test byte [ecx + 0xc], 0x20
je 0x10045534
cmp eax, 1
je 0x10045534
push esi
push 0
mov dword [esi + 0x5c], 0x1a
mov dword [esi + 0x58], ebx
mov dword [esi + 0x60], edi
call dword [ebp - 4]
test eax, eax
pop ecx
pop ecx
je 0x100455ad
cmp ebx, 1
jle 0x10045565
mov eax, dword [edi + 0x20]
cmp eax, 0xffffffff
je 0x10045565
mov ecx, dword [ebp - 0xc]
lea eax, [eax + ecx + 1]
cmp ebx, eax
jle 0x10045565
push esi
push 0
mov dword [esi + 0x5c], 0x19
mov dword [esi + 0x58], ebx
mov dword [esi + 0x60], edi
call dword [ebp - 4]
test eax, eax
pop ecx
pop ecx
je 0x100455ad
test byte [edi + 0x29], 4
je 0x10045599
mov eax, dword [edi + 0x24]
cmp eax, 0xffffffff
je 0x10045590
cmp ebx, eax
jle 0x10045590
push esi
push 0
mov dword [esi + 0x5c], 0x26
mov dword [esi + 0x58], ebx
mov dword [esi + 0x60], edi
call dword [ebp - 4]
test eax, eax
pop ecx
pop ecx
je 0x100455ad
inc dword [ebp - 0xc]
and dword [ebp - 8], 0
jmp 0x100455a0
mov dword [ebp - 8], 1
inc ebx
cmp ebx, dword [esi + 0x48]
jl 0x10045429
xor eax, eax
inc eax
pop edi
pop ebx
leave
ret
Function at 0x1005223a
Capabilities:
Query environment variable

Disassembly:
push str.OPENSSL_CONF
call dword [sym.imp.MSVCR70.dll_getenv]
test eax, eax
pop ecx
je 0x10052252
push eax
call sym.LIBEAY32.dll_BUF_strdup
pop ecx
ret
push ebx
push esi
push edi
call sym.LIBEAY32.dll_X509_get_default_cert_area
push eax
call sub.MSVCR70.dll_strlen
mov esi, eax
mov ebx, str.openssl.cnf
push ebx
inc esi
call sub.MSVCR70.dll_strlen
add esi, eax
push 0x230
inc esi
push str..cryptoconfconf_mod.c
push esi
call sym.LIBEAY32.dll_CRYPTO_malloc
mov edi, eax
add esp, 0x14
test edi, edi
je 0x100522b0
push esi
call sym.LIBEAY32.dll_X509_get_default_cert_area
push eax
push edi
call sym.LIBEAY32.dll_BUF_strlcpy
push esi
push 0x10078958
push edi
call sym.LIBEAY32.dll_BUF_strlcat
push esi
push ebx
push edi
call sym.LIBEAY32.dll_BUF_strlcat
add esp, 0x24
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x10052706
Capabilities:
Terminate process

Disassembly:
cmp dword [0x100a5248], 0
jne 0x1005276c
call sym.LIBEAY32.dll_OPENSSL_load_builtin_modules
call sym.LIBEAY32.dll_ERR_clear_error
push 0x10
push 0
push 0
call sym.LIBEAY32.dll_CONF_modules_load_file
add esp, 0xc
test eax, eax
jg 0x1005276c
push esi
call sym.LIBEAY32.dll_ERR_load_crypto_strings
mov eax, dword [sym.imp.MSVCR70.dll__iob]
add eax, 0x40
push 0
push eax
call sym.LIBEAY32.dll_BIO_new_fp
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x10052763
push str.Auto_configuration_failed_n
push esi
call sym.LIBEAY32.dll_BIO_printf
push esi
call sym.LIBEAY32.dll_ERR_print_errors
push esi
call sym.LIBEAY32.dll_BIO_free
add esp, 0x10
push 1
call dword [sym.imp.MSVCR70.dll_exit]
pop esi
ret
Function at 0x10066fec
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
push ecx
mov eax, dword [esp + 0x34]
push eax
push ebx
cmp ecx, 0
je 0x100670bc
and ebp, 0xfffffff8
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
je 0x1006705a
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call sym.LIBEAY32.dll_DES_encrypt1
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x1006702c
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x10067163
call 0x1006706c
pop edx
lea ecx, [edx + 0x114]
mov ebp, dword [ecx + ebp*4]
add ebp, edx
xor ecx, ecx
xor edx, edx
jmp ebp
and ebp, 0xfffffff8
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
je 0x1006710c
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call sym.LIBEAY32.dll_DES_encrypt1
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x100670c9
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x10067163
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call sym.LIBEAY32.dll_DES_encrypt1
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x10067161
jmp 0x10067163
mov ecx, dword [esp + 0x40]
add esp, 0x1c
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x100671c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x2c]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
push ebx
cmp ecx, 0
je 0x10067299
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x10067237
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call sym.LIBEAY32.dll_DES_encrypt3
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x10067209
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x10067340
call 0x10067249
pop edx
lea ecx, [edx + 0x137]
mov ebp, dword [ecx + ebp*4]
add ebp, edx
xor ecx, ecx
xor edx, edx
jmp ebp
and ebp, 0xfffffff8
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
je 0x100672e9
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call sym.LIBEAY32.dll_DES_decrypt3
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x100672a6
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x10067340
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call sym.LIBEAY32.dll_DES_decrypt3
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x1006733e
jmp 0x10067340
mov ecx, dword [esp + 0x4c]
add esp, 0x20
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1006a836
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
push eax
push ebx
cmp ecx, 0
je 0x1006a915
and ebp, 0xfffffff8
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
je 0x1006a8ab
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call sym.LIBEAY32.dll_BF_encrypt
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x1006a875
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x1006a9cc
call 0x1006a8bd
pop edx
lea ecx, [edx + 0x143]
mov ebp, dword [ecx + ebp*4]
add ebp, edx
xor ecx, ecx
xor edx, edx
jmp ebp
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x1006a96d
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call sym.LIBEAY32.dll_BF_decrypt
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x1006a922
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x1006a9cc
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call sym.LIBEAY32.dll_BF_decrypt
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x1006a9ca
jmp 0x1006a9cc
mov ecx, dword [esp + 0x3c]
add esp, 0x18
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1006b942
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
push eax
push ebx
cmp ecx, 0
je 0x1006ba25
and ebp, 0xfffffff8
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
je 0x1006b9b7
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call sym.LIBEAY32.dll_CAST_encrypt
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x1006b981
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x1006badc
call 0x1006b9c9
pop edx
lea ecx, [edx + 0x137]
mov ebp, dword [ecx + ebp*4]
add ebp, edx
xor ecx, ecx
xor edx, edx
jmp ebp
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x1006ba7d
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call sym.LIBEAY32.dll_CAST_decrypt
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x1006ba32
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x1006badc
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call sym.LIBEAY32.dll_CAST_decrypt
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x1006bada
jmp 0x1006badc
mov ecx, dword [esp + 0x3c]
add esp, 0x18
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x403590
Capabilities:
Delete file
Enumerate gui resources

Disassembly:
mov eax, dword [0x4ac4dc]
mov ecx, dword [0x4a93e4]
sub esp, 0xc2c
push ebx
push ebp
shr eax, 3
push esi
push edi
test eax, eax
jbe 0x40367f
mov edi, dword [sym.imp.KERNEL32.dll_SetConsoleMode]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteProfileSectionW]
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetCommState]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
cmp dword [0x4ac4dc], 0x959
jne 0x403665
push 0
push 0
call edi
push 0
push 0
call ebx
push 0
call ebp
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExA]
lea eax, [esp + 0x1c]
push eax
push 0
call esi
push 0
push 0
lea ecx, [esp + 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
push 0
lea edx, [esp + 0x43c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
push 0
push 0
call esi
push 0
push 0x402cb0
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov eax, dword [esp + 0x14]
push eax
call fcn.004033e0
add dword [esp + 0x14], 8
sub dword [esp + 0x18], 1
jne 0x4035d0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc2c
ret
Function at 0x40725c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43f238]
jne 0x407266
repz ret
jmp fcn.0040c565

Function at 0x40d05f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040a778
and dword [ebp - 4], 0
cmp dword [0x442278], 0
mov ebx, eax
jne 0x40d110
push 0x4024b4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40d1c1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4024a8
push edi
call esi
test eax, eax
je 0x40d1c1
push eax
call fcn.0040a706
mov dword [esp], 0x402498
push edi
mov dword [0x442278], eax
call esi
push eax
call fcn.0040a706
mov dword [esp], 0x402484
push edi
mov dword [0x44227c], eax
call esi
push eax
call fcn.0040a706
mov dword [esp], 0x402468
push edi
mov dword [0x442280], eax
call esi
push eax
call fcn.0040a706
pop ecx
mov dword [0x442288], eax
test eax, eax
je 0x40d110
push 0x402450
push edi
call esi
push eax
call fcn.0040a706
pop ecx
mov dword [0x442284], eax
mov eax, dword [0x442284]
cmp eax, ebx
je 0x40d168
cmp dword [0x442288], ebx
je 0x40d168
push eax
call fcn.0040a781
push dword [0x442288]
mov esi, eax
call fcn.0040a781
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40d168
test edi, edi
je 0x40d168
call esi
test eax, eax
je 0x40d15f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40d15f
test byte [ebp - 0xc], 1
jne 0x40d168
or dword [ebp + 0x10], 0x200000
jmp 0x40d1a1
mov eax, dword [0x44227c]
cmp eax, ebx
je 0x40d1a1
push eax
call fcn.0040a781
pop ecx
test eax, eax
je 0x40d1a1
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40d1a1
mov eax, dword [0x442280]
cmp eax, ebx
je 0x40d1a1
push eax
call fcn.0040a781
pop ecx
test eax, eax
je 0x40d1a1
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x442278]
call fcn.0040a781
pop ecx
test eax, eax
je 0x40d1c1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40d1c3
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10001000
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
cmp dword [ebp + 0xc], 1
jne 0x1000105d
mov dword [ebp - 0x54], 0x44
push 0x40
push 0
lea eax, [ebp - 0x50]
push eax
call fcn.10001dc0
add esp, 0xc
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x54]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.C:WindowsSystem32calc.exe
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1000105d
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1000452b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1000456a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000456a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000456a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1000456a
cmp dword [ecx + 0x74], 0xe
jbe 0x1000456a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x100071be
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1000725b
push ebx
push esi
call fcn.10007187
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1000711d
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10007208
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000725a
push edi
push eax
call fcn.10008210
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10007228
call fcn.10005c50
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10007259
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1000711d
add esp, 0x20
test eax, eax
jne 0x10007247
push edi
call fcn.10005c50
jmp 0x1000724f
push ebx
call fcn.10005c50
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x1000d270
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000d29d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000d29d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x42e006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x731e066b
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e024
mov eax, section..data
nop
nop
mov ebx, 0x42cd70
mov ecx, 0x3e3749a1
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x403a85
Capabilities:
Acquire debug privileges

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
lea eax, [ebp - 0x10]
push eax
xor esi, esi
push str.SeDebugPrivilege
push esi
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
lea eax, [ebp - 4]
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push esi
push esi
push 0x10
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 4]
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov al, bl
pop ebx
leave
ret
Function at 0x406129
Capabilities:
Get common file path

Disassembly:
push 0x328
push 0x41c6d0
call fcn.00415d30
or dword [ebp - 0x2c], 0xffffffff
xor ebx, ebx
mov dword [ebp - 4], ebx
push dword [ebp + 0x10]
call fcn.00404fe6
pop ecx
mov dword [ebp - 0x2c], eax
mov byte [ebp + 0x10], bl
xor eax, eax
lea edi, [ebp + 0x11]
stosb byte es:[edi], al
mov al, byte [0x41a865]
mov byte [ebp + 0x10], al
jmp 0x40618c
or dword [ebp - 4], 0xffffffff
cmp byte [0x42053c], bl
je 0x406276
mov byte [ebp - 0x130], bl
push 0x103
push ebx
lea eax, [ebp - 0x12f]
push eax
call fcn.0040ebb0
add esp, 0xc
mov esi, 0x104
push esi
lea eax, [ebp - 0x130]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x406276
mov byte [ebp - 0x24], bl
xor eax, eax
lea edi, [ebp - 0x23]
stosb byte es:[edi], al
mov al, byte [0x41a871]
mov byte [ebp - 0x24], al
mov byte [ebp - 0x20], bl
xor eax, eax
lea edi, [ebp - 0x1f]
stosb byte es:[edi], al
mov al, byte [0x41a87d]
mov byte [ebp - 0x20], al
lea eax, [ebp - 0x234]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
cmp eax, ebx
je 0x406276
cmp eax, 0xf2
ja 0x406276
lea eax, [ebp - 0x338]
push eax
push ebx
push 0x41a888
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x406276
push 0x41a88c
lea eax, [ebp - 0x338]
push eax
call fcn.0040ec40
pop ecx
pop ecx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], 0x16c9
mov dword [ebp - 0x1c], ebx
jmp 0x406261
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x28], eax
inc dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp eax, 2
jl 0x406255
lea eax, [ebp - 0x130]
push eax
call fcn.00403f3e
pop ecx
mov eax, dword [ebp - 0x2c]
call fcn.00415d6b
ret 0x10