joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1010ff62
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x101ba0ec]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x11c
lea eax, [ebp - 0x120]
push esi
push 0
push eax
call fcn.1012bd00
add esp, 0xc
mov dword [ebp - 0x120], esi
call fcn.100ebd90
test al, al
je 0x1010ffb5
push edi
pop ebx
push edi
push edx
push ecx
pop ebx
pop edx
push ebx
pop eax
push eax
pop ebp
pop edi
pop ebp
pop esp
pop ecx
push ecx
push edx
push esp
push ecx
push edi
pop ebp
pop ecx
pop ebx
call fcn.100eba80
test al, al
je 0x1010ffd6
pop eax
pop ebx
pop edi
pop edi
pop ebp
pop edi
pop ecx
pop esp
push esp
pop edi
push eax
push ebp
pop esp
pop edi
pop edx
push ebx
pop esi
push edx
push esp
push ecx
pop ebp
pop ebp
pop edi
push edi
call fcn.100eb460
test al, al
je 0x1010fff7
push esi
push esi
push edx
pop esi
pop ecx
push ecx
pop edi
pop eax
pop ebp
pop eax
push esp
push ecx
pop edx
pop eax
pop ebx
push esi
pop esp
pop ecx
push ecx
pop ebp
pop edi
pop esi
push esi
push ebp
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
jne 0x10110027
xor eax, eax
inc eax
cmp dword [ebp - 0x118], 0
je 0x10110021
cmp dword [ebp - 0x118], eax
jne 0x10110027
cmp byte [ebp - 6], 1
je 0x10110086
call fcn.100ebe70
test al, al
je 0x1011004b
push eax
push ecx
push ebp
pop edi
pop edi
pop esi
pop esi
pop edi
pop esi
push eax
push esp
push edi
pop esp
push eax
push eax
push eax
push esp
push esi
push edi
pop esi
pop esp
push ebp
pop ecx
pop esp
pop edx
pop ecx
pop ebp
call fcn.100ebc40
test al, al
je 0x10110069
push ecx
pop edi
push ecx
pop edi
push eax
push ebx
pop ecx
push eax
push ebp
pop edx
push ebp
pop esp
push ebx
push esi
pop esp
pop esi
push esp
pop esp
push eax
pop esi
push ecx
call fcn.100ebe00
test al, al
je 0x10110084
push ebx
pop eax
push esi
pop esi
push ebp
pop esp
pop eax
push esp
pop eax
push edi
push edi
pop eax
pop esp
push ebp
push edx
push esi
push ebx
push eax
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1010a832
mov esp, ebp
pop ebp
ret
Function at 0x10110097
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.10143e05
mov dword [ebp - 8], eax
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10050ec0
push dword [ebp + 8]
mov edi, eax
push edi
mov dword [ebp - 4], edi
call fcn.10143de3
add esp, 0x10
call fcn.100eb690
test al, al
je 0x101100ea
push edx
push ebp
pop esp
pop edx
push esi
pop esi
pop edx
push eax
pop edx
pop ebx
pop ebx
pop esp
pop edx
push edi
push esp
push edi
mov eax, dword [ebp - 8]
xor esi, esi
xor ebx, ebx
inc esi
mov dword [ebp - 0xc], ebx
test eax, eax
js 0x101101b4
cmp word [edi + ebx*2], 0x5c
jne 0x101101a5
call fcn.100ebd20
test al, al
je 0x10110125
push ebp
pop ebp
push eax
push esp
pop ebp
push ebx
pop ebp
push esi
pop ebx
push edi
pop eax
pop esp
push esi
push eax
push ebp
pop eax
pop esi
push ecx
push ebx
push edx
call fcn.100eba80
test al, al
je 0x1011014f
push ebp
push ecx
push edi
push edx
push ebx
push ecx
pop esp
pop ebx
pop ebp
pop edx
pop ecx
pop edi
pop ebx
push esp
push eax
push edi
pop ebx
push edi
pop ebx
push eax
pop edx
push ebp
pop ecx
pop eax
pop eax
pop ebx
push ebx
pop ebx
push esp
push ebp
mov edi, dword [ebp - 4]
call fcn.100ebb60
test al, al
je 0x1011017a
push esi
push esp
push esp
push eax
pop ebx
pop esi
push ebp
push ecx
push eax
push esp
push esp
push edi
pop ebp
pop ebx
push edi
pop ecx
pop esi
push edi
push ecx
push esp
pop ebp
pop ecx
pop ebp
push eax
pop ebp
pop edi
push ecx
pop ebp
pop eax
pop ecx
push ecx
mov edi, dword [ebp - 4]
mov ebx, dword [ebp - 0xc]
xor eax, eax
push edi
movzx esi, word [edi + ebx*2]
mov word [edi + ebx*2], ax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1011019e
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x101101c4
mov eax, dword [ebp - 8]
mov word [edi + ebx*2], si
inc ebx
mov dword [ebp - 0xc], ebx
cmp ebx, eax
jle 0x101100fd
xor esi, esi
inc esi
push edi
call fcn.10050eb0
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor esi, esi
jmp 0x101101b4
Function at 0x10110fe7
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov byte [ecx + 0x89], al
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], eax
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret
Function at 0x10111ca9
Capabilities:
Enumerate processes

Disassembly:
push 0x280
mov eax, 0x1016584b
call fcn.1010b4ff
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x28c], ebx
test eax, eax
je 0x10111e96
push eax
lea ecx, [ebp - 0x40]
call fcn.10041a70
and dword [ebp - 4], 0
lea eax, [ebp - 0x40]
push eax
call fcn.10110ad3
mov edi, 0x22c
lea eax, [ebp - 0x284]
push edi
push 0
push eax
call fcn.1012bd00
add esp, 0x10
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x28c], esi
cmp esi, 0xffffffff
je 0x10111e86
call fcn.100ebe70
test al, al
je 0x10111d2b
pop eax
pop ecx
push ebp
push edi
pop ecx
push esp
pop edx
pop ebp
pop edx
pop esp
push eax
push ebx
push ebx
push edx
push esp
push edx
lea eax, [ebp - 0x284]
mov dword [ebp - 0x284], edi
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x10111e03
and dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp word [ebp - 0x260], ax
je 0x10111d6a
lea eax, [ebp - 0x260]
push eax
call fcn.10143e05
pop ecx
push eax
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x28]
call fcn.10041f80
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
call fcn.10110ad3
pop ecx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.1004b160
test eax, eax
je 0x10111dbe
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.101108aa
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x40]
or ebx, 1
call fcn.1004b160
mov byte [ebp - 0x285], 0
test eax, eax
jne 0x10111dc5
mov byte [ebp - 0x285], 1
test bl, 1
je 0x10111dd9
push 0
push 1
lea ecx, [ebp - 0x58]
and ebx, 0xfffffffe
call fcn.100421b0
cmp byte [ebp - 0x285], 0
jne 0x10111e9c
push 0
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.100421b0
lea eax, [ebp - 0x284]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x10111d43
call fcn.100eb5b0
test al, al
je 0x10111e33
push esp
push edi
pop ebx
pop ecx
pop esp
pop ebx
pop ebx
push ecx
pop ebp
pop eax
pop ebp
push ebx
pop ebx
pop edx
push ebp
push ebx
pop edi
pop eax
push ebx
push edx
pop edx
pop eax
pop edi
push ebp
pop edx
push ebp
push ebx
pop ebp
push ebx
pop edx
pop esi
call fcn.100eb850
test al, al
je 0x10111e55
pop edx
push ecx
push ebp
pop edx
push esp
push esp
push edx
push esi
pop eax
push esi
pop ebx
pop ecx
pop esi
pop ebx
push edi
pop edi
push ecx
push esi
pop edi
pop edi
push ecx
push esp
pop ebp
push ebp
push edi
call fcn.100ebc40
test al, al
je 0x10111e7a
pop edx
push ecx
pop ebp
pop ebx
pop ebp
pop eax
pop ebx
push edi
push edx
push esi
pop edi
push eax
push edx
push edi
push esi
push esp
pop ebp
push ecx
push edx
pop eax
pop ebp
pop esi
push ecx
pop ecx
push ebx
pop edi
push edi
pop ebp
push dword [ebp - 0x28c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.100421b0
mov eax, esi
call fcn.1010b4ba
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x27c]
lea ecx, [ebp - 0x28]
push 0
push 1
call fcn.100421b0
jmp 0x10111e88
Function at 0x101134fa
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x101ba0ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
mov esi, 0x101bd460
cmp dword [esi], eax
je 0x10113533
add esi, 0x50
cmp esi, 0x101bdcd0
jl 0x1011351d
xor al, al
jmp 0x101135fd
push 0x190
lea eax, [ebp - 0x194]
push 0
push eax
call fcn.1012bd00
add edi, 4
add esp, 0xc
cmp dword [edi + 0x14], 8
jb 0x10113554
mov edi, dword [edi]
lea eax, [esi + 0x38]
cmp dword [eax + 0x14], 8
jb 0x1011355f
mov eax, dword [eax]
lea ecx, [esi + 0x20]
cmp dword [ecx + 0x14], 8
jb 0x1011356a
mov ecx, dword [ecx]
lea edx, [esi + 8]
cmp dword [edx + 0x14], 8
jb 0x10113575
mov edx, dword [edx]
push edi
push 0xc8
lea edi, [ebp - 0x194]
push edi
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x194], 0
jne 0x10113599
xor eax, eax
jmp 0x101135a6
lea eax, [ebp - 0x194]
push eax
call fcn.10143e05
pop ecx
push eax
lea eax, [ebp - 0x194]
lea edi, [ebx + 8]
push eax
mov ecx, edi
call fcn.10041f80
mov eax, dword [esi + 4]
mov dword [ebx], eax
cmp dword [esi + 4], 1
jne 0x101135d9
cmp dword [edi + 0x14], 8
jb 0x101135cd
mov eax, dword [edi]
jmp 0x101135cf
mov eax, edi
push eax
call fcn.1013359d
pop ecx
mov dword [ebx + 4], eax
cmp dword [esi + 4], 3
jne 0x101135fb
cmp dword [edi + 0x14], 8
jb 0x101135e7
mov edi, dword [edi]
push edi
call fcn.1013359d
pop ecx
xor ecx, ecx
mov dword [ebx + 4], eax
test eax, eax
setg cl
mov dword [ebx + 0x20], ecx
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1010a832
mov esp, ebp
pop ebp
ret 8

Function at 0x101146ef
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x1014ec40
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1014eabf

Function at 0x10151501
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.101511c1
Function at 0x40cb74
Capabilities:
Encode data using xor

Disassembly:
fcmovnbe st(0), st(0)
mov cl, 0x36
pushal
cld
clc
sal byte [ecx - 0x7039fca], 1
jae 0x40cacf
int1
inc ebp
xor dl, ch
sub eax, 0xce1689b5
jno 0x40cafc
push esi
shr dword [eax - 0x6e928229], 1
mov dword [0x3a15729d], eax
invalid
test eax, 0xb954974a
int1
mov bl, 0x1b
xchg esp, eax
xor esp, 0x5d2333d5
aaa
xor dword [ebx - 0x68], 0xce2f1eeb
in eax, 0xa5
in al, 0x3f
push ds
ret
mov ch, 0xf9
push ebx
fdivr dword [eax - 0x4f1c6d8b]
mov eax, 0xb0e39275
or eax, 0xeaeef89b
or cl, dl
fdiv qword [esi + 0x5c]
xlatb
dec edx
pop ebp
sub edx, edi
rol dh, cl
jnp 0x40cb21
jge 0x40cace
fcomp qword [edi + 0xc471b49]
not byte [esi + 0x479df3b7]
jge 0x40cb1d
wait
xor al, 0xe
salc
movzx esi, dl
dec edx
invalid
je 0x40cb38
invalid

Function at 0x41767c
Capabilities:
Encode data using xor

Disassembly:
jle 0x417653
push esi
cdq
pop edi
aad 0xf6
xchg dword [edi], esp
xchg edi, eax
jb 0x417670
cld
stosd dword es:[edi], eax
push cs
invalid
add bh, ah
push ebx
or eax, 0x4f393d76
xor al, 0x66
xchg edi, eax
or dword [ebp + 0x25a71408], eax
sub dl, al
cli
push ss
idiv dl
daa
fadd dword [esi + 0x2c4855ed]
and eax, 0x71b773e6
push 0xff58504
bound esi, qword [edi]
mov edi, eax
arpl word [edx], bx
mov edx, ecx
mov dl, 0x77
pop ss
loop 0x417672
pop ds
cmpsd dword [esi], dword es:[edi]
ljmp 0x7fe

Function at 0x47dcc4
Capabilities:
Encode data using xor

Disassembly:
inc eax
bswap ecx
neg dword es:[ebp + 0x1d]
mov al, 0xbf
outsd dx, dword es:[esi]
lodsb al, byte [esi]
mov al, byte [0xa02ef2d3]
pop esi
dec ebx
invalid

Function at 0x47f5e4
Capabilities:
Encode data using xor

Disassembly:
jle 0x47f59c
adc eax, 0xadecea8c
or al, 0xea
dec esp
pop edi
lodsb al, byte [esi]
push 0xffffffffffffffac
cmp byte ss:[edi], 0x80
xchg edx, eax
mov esi, 0x5c9f8c77
mov edi, 0xa14a1931
mov word [esi + 0x4f], ds
wait
loopne 0x47f5cf
popal
jno 0x47f508
xchg ebp, eax
jl 0x47f54d
aas
arpl word [esi + 0x7c], bx
and al, 0x4c
jl 0x47f59e
dec esp
adc ecx, dword [eax - 0x4d]
cmp dword [esi + 0xa1cbf1c], esi
or al, 0xa6
invalid
arpl word [esi - 0x69], di
xchg edi, eax
fcom qword [ebx]
push ds
fdivr qword [ebp + 0x1ac5a3c6]
insb byte es:[edi], dx
dec edi
nop
push ds
sar ecx, 1
nop
xchg ebp, eax
fdivr dword [esi - 0x537313]
or eax, 0x90039043
add edx, ebx
ror dword [edi + 0x34], cl
call [ebx]
and ebx, dword [edx + 0xd6c8fde]
sub cl, ch
inc edx
lodsb al, byte [esi]
mov bl, 0xb4
jp 0x47f5c8
xchg edi, eax
int1
and eax, dword [ebx - 0xdedf2e5]
mov es, esp
jns 0x47f572
push esi
or eax, 0x9c49c2a0
jle 0x47f578
jbe 0x47f571
push esi
jmp [edx + edi]
Function at 0x4971c4
Capabilities:
Encode data using xor

Disassembly:
in eax, 0x74
mov byte [0xa1b8a830], al
push ss
test al, 0x86
daa
push edx
xor eax, 0x654da53b
jb 0x4971ba
movsd dword es:[edi], dword [esi]
dec ebp
jb 0x4971ba
cwde
mov eax, dword [0x657e0030]
je 0x49713e
adc al, 0xf5
insd dword es:[edi], dx
in eax, 0x78
in eax, 0x76
cwde
bound edi, qword [ebp - 0x2d8661e7]
jmp 0xe5b25677
div byte [esi + 0x6478a444]
movsb byte es:[edi], byte [esi]
js 0x4971f9
sbb byte [esp - 7], ah
invalid
cmc
sbb dword [ebp + 0x71cc6c79], esi
test al, 3
jno 0x49714c
add ebx, dword [esp + ebx*2 - 8]
pop esp
pop esp
clc
xor eax, 0xe6c82528
mov byte [esi + ebx*8 - 0x1f], ah
fsubrp st(1)
pop eax
inc ebx
imul ebp, dword [ebx - 0x19824ebc], 0xebe978c8
or al, 0x2e
bts dword [edx - 0x668a5b4e], esp
jne 0x49715f
js 0x4971a5
jmp 0x4971ca
jl 0x497241
js 0x497192
in al, 0x45
sub ebx, dword [edx]
xor ebx, edx
cdq
jne 0x49718f
dec esi
inc eax
add eax, 0x4b38dcc5
xor byte [ecx + edx*4 + 0xd], 0x73
std
or bh, byte [edi + 0x1b6cf1a2]
std
jle 0x4971ae
push esi
cli
dec edx
add al, 0x2f
inc esp
mov eax, 0xb899cd07
or al, 0xfd
stc
jnp 0x4971f0
sbb dword [0xa3d5d214], ebx
add byte [ecx + esi*8], 0x64
mov dh, dl
xor al, 0x31
jno 0x4971a2
sbb dword [edx + 0x426b3e9e], esp
dec ebp
das
dec esi
nop
in al, dx
or bh, byte [eax + 0x10868db3]
sbb al, 0x39
in al, 0x78
or ch, ch
test al, 0x5f
mov ch, dl
cmp dword [edx], edi
in eax, 0x91
adc ch, dh
in eax, 0xdf
inc ebp
sbb eax, 0x1f4e6262
push cs

Function at 0x4ba8f1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c33d8
cmp edx, dword [eax]
je 0x4ba913
add eax, 8
inc ecx
cmp eax, 0x4c3468
jl 0x4ba904
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c33d8]
jne 0x4baa41
mov eax, dword [0x4c7d84]
cmp eax, 1
je 0x4baa1b
test eax, eax
jne 0x4ba944
cmp dword [0x4c3300], 1
je 0x4baa1b
cmp edx, 0xfc
je 0x4baa41
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4ba97b
lea eax, [ebp - 0x1a4]
push 0x4bfb50
push eax
call fcn.004bb2d0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bb760
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4ba9be
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bb760
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bfb4c
push edi
call fcn.004bd630
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4bfb30
push eax
call fcn.004bb2d0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bb2e0
lea eax, [ebp - 0xa0]
push 0x4bfb2c
push eax
call fcn.004bb2e0
push dword [esi + 0x4c33dc]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bb2e0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4bfb04
push eax
call fcn.004bd5a4
add esp, 0x2c
pop edi
jmp 0x4baa41
lea eax, [ebp + 8]
lea esi, [esi + 0x4c33dc]
push 0
push eax
push dword [esi]
call fcn.004bb760
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x414590
Capabilities:
Accept command line arguments

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x6c
call fcn.0040c810
call sub.KERNEL32.dll_GetCommandLineA
mov ebx, eax
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call sub.KERNEL32.dll_GetStartupInfoA
sub esp, 4
test ebx, ebx
jne 0x4145c6
jmp 0x414605
add ebx, 1
movzx eax, byte [ebx]
cmp al, 9
je 0x4145c3
cmp al, 0x20
je 0x4145c3
cmp al, 0x22
jne 0x4145e9
jmp 0x414654
cmp al, 0x20
lea esi, [esi]
je 0x4145f0
test al, al
je 0x414605
add ebx, 1
movzx eax, byte [ebx]
cmp al, 9
jne 0x4145d7
movzx eax, byte [ebx]
cmp al, 0x20
jne 0x41466a
add ebx, 1
movzx eax, byte [ebx]
cmp al, 9
je 0x4145f7
cmp al, 0x20
je 0x4145f7
test byte [ebp - 0x30], 1
mov esi, 0xa
je 0x414614
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00401e40
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
cmp al, 0x22
je 0x41465e
add ebx, 1
movzx eax, byte [ebx]
test al, al
jne 0x414650
cmp al, 0x22
sete al
movzx eax, al
add ebx, eax
jmp 0x4145f0
cmp al, 9
je 0x4145f7
jmp 0x414605

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0xcf1f10
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0xd069fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [esp + 0x2c]
xor ebp, ebp
mov dword [esp + 0x10], eax
xor ebx, ebx
mov eax, 1
mov ecx, ebx
shl eax, cl
mov ecx, dword [esp + 0x10]
test ecx, eax
je 0xcf2002
lea edx, [ebx + 0x41]
lea eax, [esp + 0x14]
push edx
push str._c:_
push eax
call fcn.00cf5dff
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0xcf2002
lea edx, [esp + 0x14]
push edx
push 0xd0c140
call fcn.00ced6e0
lea eax, [esp + 0x1c]
lea edi, [esi + 0x1048]
push eax
push edi
mov word [esp + 0x28], bp
call fcn.00cf620b
push 0x10
call fcn.00cf61d3
add esp, 0x14
mov dword [esp + 0x2c], eax
cmp eax, ebp
mov dword [esp + 0x24], ebp
je 0xcf1fc5
mov cx, word [edi]
push ecx
mov ecx, eax
call fcn.00ce21c0
jmp 0xcf1fc7
xor eax, eax
push esi
mov dword [esp + 0x28], 0xffffffff
mov dword [esi], eax
call fcn.00cf1b80
mov edi, dword [esi]
add esp, 4
cmp edi, ebp
je 0xcf1ff0
mov ecx, edi
call fcn.00ce22c0
push edi
call fcn.00cf61c8
add esp, 4
mov edx, dword [esi + 0x1024]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0xcf2021
inc ebx
cmp ebx, 0x20
jb 0xcf1f3e
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0xcf51b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00cf5140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00cf5140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00cf5140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00cf5140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xcf5230
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x20c
lea eax, [esp]
push ebx
mov ebx, dword [esp + 0x218]
push ebp
mov ebp, dword [esp + 0x218]
push esi
push eax
push 0xf003f
push 0
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xcf52d6
mov edx, dword [esp + 0xc]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
lea ecx, [esp + 0x14]
push 0x104
push ecx
push eax
push edx
call edi
mov esi, eax
test esi, esi
jne 0xcf52ae
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push ecx
call fcn.00cf5230
mov esi, eax
add esp, 8
test esi, esi
jne 0xcf52ae
lea edx, [esp + 0x14]
push 0x104
push edx
push eax
mov eax, dword [esp + 0x1c]
push eax
call edi
mov esi, eax
test esi, esi
je 0xcf527e
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 0x103
pop edi
je 0xcf52ce
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x20c
ret
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop esi
pop ebp
pop ebx
add esp, 0x20c
ret

Function at 0xcf5bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xcf5c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xd0787c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xcf5c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xcf5c52
xor eax, eax
pop esi
leave
ret 4