joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403f54
Capabilities:
Encode data using xor

Disassembly:
lea eax, [ebp + ecx - 0x40]
mov dl, byte [edi + eax]
xor dl, 0x5c
inc ecx
mov byte [eax], dl
cmp ecx, esi
jb fcn.00403f54
pop edi
cmp esi, ebx
jae 0x403f7e
mov ecx, ebx
sub ecx, esi
push ecx
lea eax, [ebp + esi - 0x40]
push 0x5c
push eax
call fcn.00418a70
add esp, 0xc
push ebx
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x160]
push eax
call fcn.0040ec45
push 0x20
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x160]
push eax
call fcn.0040ec45
push dword [ebp + 0x18]
lea eax, [ebp - 0x160]
push eax
call fcn.0040ecbe
pop esi
pop ebx
leave
ret 0x14

Function at 0x4043cd
Capabilities:
Encode data using xor

Disassembly:
add al, 0x89
inc ebp
or byte [ebp + 0x6a50e045], cl
add al, 0x8d
inc ebp
or byte [eax + 0x6a], dl
and bh, bh
jne 0x4043cb
call fcn.00403e79
xor edx, edx
mov dword [esi + 4], edx
xor eax, eax
push ebx
movzx ebx, byte [ebp + eax - 0x20]
mov ecx, eax
and ecx, 3
shl ecx, 3
shl ebx, cl
xor edx, ebx
inc eax
cmp eax, 0x20
jb 0x4043cc
mov dword [esi + 4], edx
pop ebx
cmp dword [esi], 3
jne 0x40440f
lea eax, [ebp - 0x20]
push eax
push 0x20
add esi, 4
push esi
push 0x20
push dword [ebp + 0xc]
call fcn.00403e79
push 0x20
lea eax, [ebp - 0x20]
push eax
push esi
call fcn.0041a4e0
add esp, 0xc
pop esi
leave
ret 8

Function at 0x40a33f
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
push ecx
cmp dword [ebp + 0xc], 0
mov eax, dword [ebp + 0x10]
push ebx
push esi
lea ebx, [ecx + 8]
movdqu xmm1, xmmword [ebx]
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], eax
lea esi, [ecx + 0x18]
jbe 0x40a3c4
mov eax, edi
movdqu xmm2, xmmword [eax]
mov eax, dword [ecx + 4]
mov edx, eax
shl edx, 4
add edx, esi
movdqu xmm0, xmmword [edx]
add edi, 0x10
dec eax
pxor xmm0, xmm2
test eax, eax
jle 0x40a39b
mov edx, eax
shl edx, 4
add edx, esi
movdqu xmm3, xmmword [edx]
dec eax
sub edx, 0x10
aesdec xmm0, xmm3
test eax, eax
jg 0x40a38a
cmp byte [ecx + 1], 0
movdqu xmm3, xmmword [esi]
aesdeclast xmm0, xmm3
je 0x40a3ae
pxor xmm0, xmm1
mov eax, dword [esp + 0xc]
add dword [esp + 0xc], 0x10
dec dword [ebp + 0xc]
movdqa xmm1, xmm2
movdqu xmmword [eax], xmm0
jne 0x40a363
pop edi
pop esi
movdqu xmmword [ebx], xmm1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40a4ee
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
mov al, byte [ebp - 0x38]
xor al, byte [ecx + 0x437700]
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 0x38], al
movzx ecx, byte [ecx]
mov cl, byte [ecx + 0x437700]
xor byte [ebp - 0x37], cl
mov ecx, dword [ebp - 0x14]
movzx ecx, byte [ecx]
mov cl, byte [ecx + 0x437700]
xor byte [ebp - 0x36], cl
mov ecx, dword [ebp - 0x18]
movzx ecx, byte [ecx]
mov cl, byte [ecx + 0x437700]
xor byte [ebp - 0x35], cl
mov ecx, dword [ebp - 8]
xor al, byte [ecx]
inc dword [ebp - 8]
mov byte [ebp - 0x38], al
cmp ebx, 8
je 0x40a4e3
cmp ebx, 1
jle 0x40a544
lea ecx, [ebp - 0x34]
lea edi, [ebx - 1]
xor esi, esi
mov al, byte [ecx + esi - 4]
xor byte [ecx + esi], al
inc esi
cmp esi, 4
jl 0x40a4ce
add ecx, 4
dec edi
jne 0x40a4cc
jmp 0x40a541
push 3
lea ecx, [ebp - 0x34]
pop edi
push 4
pop esi
mov al, byte [ecx - 4]
cld
xor byte [ecx], al
inc ecx
dec esi
jne 0x40a4ec
dec edi
jne 0x40a4e9
movzx eax, byte [ebp - 0x2c]
mov al, byte [eax + 0x437700]
xor byte [ebp - 0x28], al
movzx eax, byte [ebp - 0x2b]
mov al, byte [eax + 0x437700]
xor byte [ebp - 0x27], al
movzx eax, byte [ebp - 0x2a]
mov al, byte [eax + 0x437700]
xor byte [ebp - 0x26], al
movzx eax, byte [ebp - 0x29]
mov al, byte [eax + 0x437700]
xor byte [ebp - 0x25], al
push 3
lea ecx, [ebp - 0x24]
pop edi
push 4
pop esi
mov al, byte [ecx - 4]
xor byte [ecx], al
inc ecx
dec esi
jne 0x40a535
dec edi
jne 0x40a532
mov edi, dword [ebp - 4]
xor ecx, ecx
test ebx, ebx
jle 0x40a586
cmp edx, dword [edi + 4]
jg 0x40a58f
cmp ecx, ebx
jge 0x40a577
lea eax, [ebp + ecx*4 - 0x38]
mov esi, dword [ebp + 8]
cmp esi, 4
jge 0x40a577
lea esi, [esi + edx*4]
lea edi, [edi + esi*4 + 0x18]
mov esi, eax
inc ecx
add eax, 4
inc dword [ebp + 8]
cmp ecx, ebx
movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 4]
jl 0x40a557
cmp dword [ebp + 8], 4
jne 0x40a582
inc edx
and dword [ebp + 8], 0
cmp ecx, ebx
jl 0x40a54a
cmp edx, dword [edi + 4]
jle 0x40a472
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x40a596
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
xor eax, eax
push edi
inc eax
mov edi, ecx
cmp dword [edi + 4], eax
mov dword [ebp - 8], eax
jle 0x40a625
lea eax, [edi + 0x28]
push ebx
mov dword [ebp - 4], eax
push esi
xor eax, eax
mov ecx, dword [ebp - 4]
lea esi, [ebp + eax - 0x1c]
add ecx, 2
mov dword [ebp - 0xc], 4
movzx edx, byte [ecx + 1]
movzx ebx, byte [ecx - 1]
mov dl, byte [eax + edx*4 + 0x4345e0]
xor dl, byte [eax + ebx*4 + 0x434de0]
movzx ebx, byte [ecx - 2]
xor dl, byte [eax + ebx*4 + 0x4351e0]
movzx ebx, byte [ecx]
xor dl, byte [eax + ebx*4 + 0x4349e0]
add ecx, 4
mov byte [esi], dl
add esi, 4
dec dword [ebp - 0xc]
jne 0x40a5c5
inc eax
cmp eax, 4
jl 0x40a5b4
push 0x10
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 4]
call fcn.0041a020
add dword [ebp - 4], 0x10
add esp, 0xc
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp eax, dword [edi + 4]
jl 0x40a5b2
pop esi
pop ebx
pop edi
leave
ret
Function at 0x40a628
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x304
push ebx
push esi
xor eax, eax
xor ecx, ecx
inc eax
mov esi, 0x11b
push edi
mov edx, eax
and dl, 0x80
movsx edx, dl
mov byte [ebp + ecx - 0x304], al
mov byte [ebp + ecx - 0x205], al
mov byte [ebp + eax - 0x104], cl
inc ecx
neg edx
sbb edx, edx
and edx, esi
lea edi, [eax + eax]
xor edx, edi
xor eax, edx
cmp eax, 1
jne 0x40a63e
xor ecx, ecx
pop edi
mov edx, eax
and dl, 0x80
movsx edx, dl
neg edx
sbb edx, edx
mov byte [ecx + 0x4375e0], al
and edx, esi
add eax, eax
xor eax, edx
inc ecx
cmp ecx, 0x1e
jb 0x40a671
xor ebx, ebx
mov dword [ebp - 4], ebx
jmp 0x40a699
Function at 0x403f70
Capabilities:
Set current directory

Disassembly:
push 0xffffffffffffffff
push 0x41a05b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x114
mov ecx, dword [0x422abc]
push esi
lea eax, [esp + 4]
push edi
push eax
call fcn.00405760
mov esi, eax
mov eax, dword [esi + 8]
mov edx, dword [esi]
xor edi, edi
push eax
mov ecx, esi
mov dword [esp + 0x128], edi
call dword [edx + 4]
mov edx, dword [esp + 0x12c]
mov esi, dword [esi + 4]
lea ecx, [esp + 0x18]
push 0x104
push ecx
push edx
push esi
call fcn.00403e50
mov esi, eax
mov eax, dword [esp + 0x1c]
add esp, 0x10
cmp eax, edi
mov dword [esp + 8], 0x41b238
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
je 0x403ff8
push eax
call fcn.0040c2f0
add esp, 4
cmp esi, edi
jbe 0x40400f
cmp esi, 0x104
jae 0x40400f
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [esp + 0x11c]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x120
ret
Function at 0x406070
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x41a46d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x13c
push ebx
push ebp
push esi
lea eax, [esp + 0x44]
push edi
push eax
mov esi, ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov edx, dword [esi + 0x34]
add esi, 0x34
xor ebp, ebp
mov ecx, esi
push ebp
call dword [edx + 4]
lea eax, [esp + 0x48]
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x18]
call fcn.00402630
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push ecx
push edx
mov ecx, esi
mov dword [esp + 0x15c], ebp
call fcn.00402460
lea eax, [esp + 0x28]
push 1
push eax
mov ecx, esi
mov dword [esp + 0x15c], 0xffffffff
call fcn.00409610
mov edi, eax
push 0xffffffffffffffff
push 0x41f33c
lea ecx, [esp + 0x18]
mov dword [esp + 0x15c], 1
call fcn.00402630
lea ecx, [esp + 0x10]
mov byte [esp + 0x154], 2
push ecx
mov ecx, edi
call fcn.00405970
cmp eax, ebp
mov byte [esp + 0x154], 1
je 0x4061a4
lea edx, [esp + 0x38]
push 1
push edx
mov ecx, esi
call fcn.00409610
mov edi, eax
push 0xffffffffffffffff
push 0x41f338
lea ecx, [esp + 0x18]
mov byte [esp + 0x15c], 3
call fcn.00402630
lea eax, [esp + 0x10]
mov ecx, edi
push eax
mov byte [esp + 0x158], 4
call fcn.00405970
cmp eax, ebp
mov dword [esp + 0x38], 0x41b238
setne bl
lea ecx, [esp + 0x38]
mov byte [esp + 0x154], 5
call fcn.00405b10
cmp eax, ebp
je 0x406194
push eax
call fcn.0040c2f0
add esp, 4
test bl, bl
mov dword [esp + 0x38], 0x41b27c
je 0x4061a4
mov bl, 1
jmp 0x4061a6
xor bl, bl
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x154], 0xffffffff
cmp eax, ebp
mov dword [esp + 0x28], 0x41b238
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebp
je 0x4061d6
push eax
call fcn.0040c2f0
add esp, 4
test bl, bl
je 0x40622d
push 0xffffffffffffffff
push 0x41f338
lea ecx, [esp + 0x24]
call fcn.00402730
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
cmp eax, 0xffffffff
mov dword [esp + 0x1c], 0x41b290
jne 0x406219
xor eax, eax
cmp ecx, ebp
mov dword [esp + 0x24], eax
je 0x406219
cmp byte [ecx], 0
je 0x406219
inc eax
mov dword [esp + 0x24], eax
cmp byte [ecx + eax], 0
jne 0x40620e
push eax
push ecx
mov ecx, esi
mov dword [esp + 0x15c], 6
call fcn.00402460
mov ecx, dword [esp + 0x14c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x148
ret
Function at 0x409740
Capabilities:
Get file size
Read file via mapping

Disassembly:
push 0xffffffffffffffff
push 0x41ac71
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x11c
push ebx
push ebp
push esi
push edi
mov edi, dword [ecx + 0x54]
lea eax, [esp + 0x28]
push 0x104
push eax
push 0
mov dword [esp + 0x30], ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0x80
push 3
push 0
push 3
lea ecx, [esp + 0x3c]
push 0x80000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push 0
push 0
push 2
push 0
push ebp
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push esi
push 0
push 0
push 4
push eax
mov dword [esp + 0x34], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
add edi, 0xfffffffc
push 0
push 0
mov esi, dword [edi + ebx]
lea ecx, [esp + 0x18]
call fcn.00402730
xor eax, eax
lea ecx, [esp + 0x10]
push eax
push eax
mov dword [esp + 0x13c], eax
mov dword [esp + 0x18], 0x41b238
mov dword [esp + 0x24], eax
call fcn.00402460
push 0
push 0
lea ecx, [esp + 0x18]
mov dword [esp + 0x13c], 1
mov dword [esp + 0x18], 0x41b264
call fcn.00402460
mov dword [esp + 0x10], 0x41b248
mov eax, dword [esp + 0x1c]
lea ecx, [esi + 1]
cmp ecx, eax
mov dword [esp + 0x134], 2
jle 0x409874
cmp eax, 8
jge 0x409846
mov eax, 8
mov dword [esp + 0x1c], eax
cmp ecx, eax
jle 0x409862
add eax, eax
cmp ecx, eax
mov dword [esp + 0x1c], eax
jle 0x409862
lea eax, [ecx + 0xb]
mov edx, eax
and edx, 7
sub eax, edx
mov dword [esp + 0x1c], eax
push eax
mov eax, dword [esp + 0x18]
push eax
call fcn.0040c6c0
add esp, 8
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
push esi
mov byte [ecx + esi], 0
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x14]
mov dword [esp + 0x1c], esi
call dword [edx + 4]
mov eax, dword [esp + 0x14]
sub edi, esi
add edi, ebx
push esi
push edi
push eax
call fcn.0040e190
mov edx, dword [esp + 0x30]
lea ecx, [esp + 0x1c]
push ecx
push edx
call fcn.00409f00
add esp, 0x14
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [esp + 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
push ebp
call esi
mov eax, dword [esp + 0x14]
xor ecx, ecx
pop edi
pop esi
pop ebp
cmp eax, ecx
mov dword [esp + 4], 0x41b238
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], ecx
pop ebx
je 0x4098f0
push eax
call fcn.0040c2f0
add esp, 4
mov ecx, dword [esp + 0x11c]
mov dword fs:[0], ecx
add esp, 0x128
ret
Function at 0x409e50
Capabilities:
Get file size

Disassembly:
sub esp, 0x114
push ebx
push ebp
push esi
push edi
push 8
mov ebx, ecx
push 0x41f4c8
call fcn.00404160
mov ebp, dword [eax]
add esp, 8
lea eax, [esp + 0x20]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0x80
push 3
push 0
push 3
lea ecx, [esp + 0x34]
push 0x80000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x10]
call fcn.0040a700
mov ecx, dword [eax + 8]
mov eax, dword [esp + 0x14]
sub esi, ecx
xor ecx, ecx
sub esi, ebp
pop edi
sub esi, 0x10
cmp eax, ecx
mov dword [ebx + 0x54], esi
pop esi
pop ebp
mov dword [esp + 4], 0x41b238
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], ecx
pop ebx
je 0x409ef1
push eax
call fcn.0040c2f0
add esp, 4
add esp, 0x114
ret

Function at 0x40a560
Capabilities:
Access peb ldr_data
Get file size
Read file via mapping

Disassembly:
push 0xffffffffffffffff
push 0x41addb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x190
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x10]
call fcn.0040a700
mov eax, dword [eax + 8]
mov edx, dword [esp + 0x1b0]
add edx, eax
mov eax, dword [esp + 0x14]
xor ebx, ebx
mov dword [esp + 0x1b0], edx
cmp eax, ebx
mov dword [esp + 0x10], 0x41b238
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
je 0x40a5c2
push eax
call fcn.0040c2f0
add esp, 4
lea eax, [esp + 0x9c]
push 0x104
push eax
push ebx
mov dword [esp + 0x1c], 0x41b27c
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push ebx
push 0x80
push 3
push ebx
push 3
lea ecx, [esp + 0xb0]
push 0x80000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push ebx
push ebx
push ebx
push 2
push ebx
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push esi
push ebx
mov ebp, eax
push ebx
push 4
push ebp
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [esp + 0x1b0]
mov ebx, eax
sub esi, ecx
lea ecx, [esp + 0x40]
sub esi, 0x10
call fcn.00418ea0
push esi
push ebx
lea ecx, [esp + 0x48]
mov dword [esp + 0x1b0], 0
call fcn.00418fa0
mov edx, dword [esp + 0x1b0]
add esi, ebx
push edx
lea ecx, [esp + 0x44]
lea eax, [esi + 0x10]
push eax
call fcn.00418fa0
lea ecx, [esp + 0x30]
push ecx
lea ecx, [esp + 0x44]
call fcn.00418f30
mov edx, dword [esi]
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
mov dword [esp + 0x20], edx
mov edx, dword [esi + 0xc]
push ebx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
mov ecx, 4
lea edi, [esp + 0x30]
lea esi, [esp + 0x20]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
pop edi
pop esi
sete al
pop ebp
mov ecx, dword [esp + 0x194]
pop ebx
mov dword fs:[0], ecx
add esp, 0x19c
ret
Function at 0x40a700
Capabilities:
Get file size
Read file via mapping

Disassembly:
push 0xffffffffffffffff
push 0x41ae06
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x124
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov ebp, ecx
push ebx
push ebx
mov dword [esp + 0x20], ebp
call fcn.00402730
push ebx
push ebx
mov ecx, ebp
mov dword [esp + 0x144], ebx
mov dword [ebp], 0x41b238
mov dword [ebp + 0xc], ebx
call fcn.00402460
push ebx
push ebx
mov ecx, ebp
mov dword [esp + 0x144], 1
mov dword [ebp], 0x41b264
call fcn.00402460
mov edi, 0x41f4e4
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp], 0x41b2c4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x12]
mov eax, ecx
mov esi, edi
mov edi, edx
mov byte [esp + 0x10], 0x50
shr ecx, 2
mov byte [esp + 0x11], 0x4b
mov byte [esp + 0x12], bl
mov byte [esp + 0x13], bl
mov byte [esp + 0x14], bl
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0x104
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x34]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push ebx
push 0x80
push 3
push ebx
push 3
lea edx, [esp + 0x44]
push 0x80000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
push ebx
push edi
mov dword [esp + 0x20], edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push ebx
push ebx
push ebx
push 2
push ebx
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push esi
push ebx
push ebx
push 4
push eax
mov dword [esp + 0x30], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
lea eax, [esi - 0xc816]
mov dword [esp + 0x20], ecx
cmp eax, ebx
jge 0x40a811
xor eax, eax
sub esi, eax
add ecx, eax
mov dword [esp + 0x28], ecx
lea edi, [esi - 0x16]
cmp edi, ebx
jl 0x40a8a9
lea eax, [ecx + edi]
mov edx, dword [eax]
lea ecx, [esp + 0x10]
cmp edx, dword [ecx]
je 0x40a839
dec edi
dec eax
cmp edi, ebx
jge 0x40a827
jmp 0x40a8a9
mov ecx, dword [ebp + 0xc]
sub esi, edi
sub esi, 0x16
lea eax, [esi + 1]
cmp eax, ecx
jle 0x40a885
cmp ecx, 8
jge 0x40a854
mov dword [ebp + 0xc], 8
mov ecx, dword [ebp + 0xc]
cmp eax, ecx
jle 0x40a860
add ecx, ecx
mov dword [ebp + 0xc], ecx
cmp eax, dword [ebp + 0xc]
jle 0x40a872
add eax, 0xb
mov edx, eax
and edx, 7
sub eax, edx
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 4]
push eax
push ecx
call fcn.0040c6c0
add esp, 8
mov dword [ebp + 4], eax
mov edx, dword [ebp + 4]
mov eax, dword [esp + 0x28]
mov ecx, esi
mov byte [edx + esi], bl
mov dword [ebp + 8], esi
mov edx, ecx
lea esi, [eax + edi + 0x16]
mov edi, dword [ebp + 4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0x18]
push edx
call esi
mov ecx, dword [esp + 0x134]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x130
ret
Function at 0x40ad20
Capabilities:
Create thread

Disassembly:
sub esp, 0xc
push esi
push edi
push 0x18
call fcn.0040c3d9
mov esi, eax
xor edi, edi
add esp, 4
cmp esi, edi
je 0x40ad67
push edi
push edi
lea eax, [esp + 0x10]
push 1
push eax
mov dword [esi], 0x41b2cc
mov dword [esi + 8], edi
mov dword [esi + 0x14], edi
mov dword [esp + 0x18], 0xc
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 4], eax
jmp 0x40ad69
xor esi, esi
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
push esi
push edi
push 0x40a940
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], edx
call fcn.0040e28e
mov eax, dword [esi + 4]
add esp, 0xc
push 0x7530
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, esi
pop edi
pop esi
add esp, 0xc
ret

Function at 0x40b450
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push eax
mov eax, dword [esp + 0x10]
and eax, 0xff
push ecx
mov edx, eax
shl edx, 5
sub edx, eax
push edx
call fcn.0040b400
mov dword [esp + 0x14], eax
add esp, 0xc
xor al, al
xor ecx, ecx
mov dl, byte [esp + ecx + 8]
xor al, dl
inc ecx
cmp ecx, 4
jb 0x40b47b
ret

Function at 0x417dda
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x417dfa
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004127b5
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x417e1d
test byte [esp + 8], 2
je 0x417e1d
call fcn.00412828
mov dword [eax], 0xd
call fcn.00412831
mov dword [eax], 5
jmp 0x417df6
xor eax, eax
ret
Function at 0x7a8584
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
call fcn.007a8530
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x7a85fc
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [0x80c8a4], eax
mov dword [ebp - 4], 0x7a84bc
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_VirtualProtect
test eax, eax
je 0x7a85fc
xor eax, eax
push ebp
push 0x7a85f5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov dword [eax], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7a85fc
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 4
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_VirtualProtect
ret
mov esp, ebp
pop ebp
ret

Function at 0x7a8600
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
call fcn.007a8530
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x7a866f
mov eax, dword [0x80c8a4]
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_VirtualProtect
test eax, eax
je 0x7a866f
xor eax, eax
push ebp
push 0x7a8668
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov dword [eax], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7a866f
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 4
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_VirtualProtect
ret
mov esp, ebp
pop ebp
ret
Function at 0x7b8d90
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x54], ecx
mov esi, edx
lea edi, [ebp - 0x50]
mov ecx, 0x10
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x50]
mov edx, dword [0x7b7e60]
call fcn.00405938
xor eax, eax
push ebp
push 0x7b8f33
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
xor ecx, ecx
mov dl, 1
mov eax, dword [0x665708]
call fcn.00666a1c
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0xc]
call fcn.00696b74
xor ecx, ecx
mov dl, 1
mov eax, dword [0x653edc]
call fcn.006546a0
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.00676808
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x38]
xor eax, eax
push ebp
push 0x7b8f03
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
call fcn.00656d98
mov edx, 0x7b8f4c
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea eax, [ebp - 0x54]
push eax
mov ecx, 0x50
mov edx, 1
mov eax, dword [ebp - 0x40]
call fcn.00405180
mov eax, dword [ebp - 0x54]
push eax
mov edx, 0x7b906c
mov eax, dword [ebp - 0x10]
call fcn.00656e64
pop edx
call fcn.006870e8
lea eax, [ebp - 0x58]
push eax
mov ecx, 0x50
mov edx, 1
mov eax, dword [ebp - 0x3c]
call fcn.00405180
mov eax, dword [ebp - 0x58]
push eax
mov edx, 0x7b9084
mov eax, dword [ebp - 0x10]
call fcn.00656e64
pop edx
call fcn.006870e8
lea eax, [ebp - 0x5c]
push eax
mov ecx, 0x400
mov edx, 1
mov eax, dword [ebp - 0x28]
call fcn.00405180
mov eax, dword [ebp - 0x5c]
push eax
mov edx, 0x7b909c
mov eax, dword [ebp - 0x10]
call fcn.00656e64
pop edx
call fcn.006870e8
mov eax, dword [ebp - 0x10]
call fcn.004ecb98
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x14c]
test eax, eax
setg byte [ebp - 5]
mov eax, dword [ebp - 0x10]
call fcn.004ecba4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7b8f0a
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, dword [ebp - 0x10]
call fcn.00403d10
mov eax, dword [ebp - 0xc]
call fcn.00403d10
ret