joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401820
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.004025a0
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.004025a0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x401880
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x406070]
test esi, esi
jle 0x4019a0
mov eax, dword [0x406074]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x4018b4
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x401937
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x4018a0
mov dword [esp], ebx
call fcn.00402270
mov edi, eax
test eax, eax
je 0x4019c7
mov eax, dword [0x406074]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.004023b0
mov edx, dword [0x406074]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x4019a7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x401930
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x401940
add dword [0x406070], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x406074]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x401930
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00401820
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x4018be
mov eax, dword [0x406074]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00401820
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00401820
lea esi, [esi]
nop
Function at 0x401ee0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x40608c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x406084]
sub esp, 4
test ebx, ebx
je 0x401f35
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x401f2e
test esi, esi
je 0x401f2e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401f10
mov dword [esp], 0x40608c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x402270
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x402295
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x4022a0
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x402295
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x4022e8
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x4022de
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x4022ea
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x4022d0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x54671c
Capabilities:
Encode data using xor

Disassembly:
inc dword [ecx + 0x2d6]
add dh, dh
sal esi, 1
rol al, 1
dec esp
and al, 1
mov dword [0x246407e8], eax
add byte [esi*4 - 0x641727ce], al
add al, 0xb5
xor bl, al
call fcn.005898c0
add al, 0xb5
xor bl, al
call fcn.005898c0
mov edi, 0x876aba0e
push ss
pop ds
push cs
and dl, byte [eax]
xlatb
test dword [edx + 0x71e25104], edi
jg 0x546707
sub bh, byte [eax - 0x1300de8e]
push edx
cmp dword [edx], 0xb534472a
invalid

Function at 0x54b790
Capabilities:
Encode data using base64

Disassembly:
mov bp, word [ebp]
jmp 0x766c04
lea esp, [esp + 4]
jmp fcn.005679ca

Function at 0x54cd24
Capabilities:
Encode data using base64

Disassembly:
mov ebp, dword [ebp]
lea esp, [esp + 4]
jmp fcn.005679ca

Function at 0x567196
Capabilities:
Encode data using base64

Disassembly:
lea edx, [edx*2 + 0x45adb786]
mov dword [esp + edx - 0x4fc49950], 0x859bd0a4
dec cl
xor bl, cl
lea ecx, [esp + ecx + 4]
and dword [esp + edx - 0x4fc49950], 0xeb031202
shl word [esp + edx - 0x4fc4994e], 0x25
adc edx, edx
mov edx, dword [ecx]
sbb ebp, 4
mov dword [ebp], edx
lea esp, [esp + 4]
jmp fcn.005679ca

Function at 0x571e7a
Capabilities:
Encode data using base64

Disassembly:
sbb ebp, 8
mov dword [ebp + 4], eax
mov dword [ebp], edx
mov dword [esp], 0x32134c3d
not dword [esp]
jmp 0x586651
lea esp, [esp + 4]
jmp fcn.005679ca

Function at 0x573590
Capabilities:
Encode data using xor

Disassembly:
add esi, 4
xor edx, ebx
not edx
rol edx, 2
neg dword [esp + 4]
not edx
jb 0x5a9944
out dx, eax
sbb al, 0x60
clc
mov cl, 0xfb
sbb dword [eax + ebx*8 - 0x252bdee], 0x25
cwde
cmp ah, byte [0xdb9b6e3d]
fdiv dword [edi + 0x46]
and byte [esi + 1], dl
dec esp
jge 0x573614
adc eax, 0x13aaf2ae
fcom qword [ebx]
fucomi st(3)
pop edx
insd dword es:[edi], dx
and al, 0xbb
mov bh, 0xdc
cmp byte [esi + 0x7027d631], cl
mov eax, dword [0x5d91deea]
xlatb
rcr bl, 0x9a
fcomi st(6)
pop edi
and eax, 0x690c88c4
sal dword [ebp + 0x78], 1
xor eax, 0xa1b90017
inc edi
lodsd eax, dword [esi]
setns cl
aam 0x3d
cwde
inc edx
aad 0x34
jecxz 0x5735cf
ljmp 0xb221:0x697f0fff
ljmp 0xae63:0xbad626b0
bswap edx
neg edx
rol dword [esp + 4], 0xe1
xor ebx, edx
sub ebp, 4
jmp 0x6fc99c
push 0xae99df9c
mov dword [ebp], edx
lea esp, [esp + 0xc]
jmp fcn.005d6241

Function at 0x57e16a
Capabilities:
Encode data using base64

Disassembly:
add esi, 1
xor al, bl
mov dword [esp], 0x288ded99
sub al, 0x97
rol al, 1
dec al
neg dword [esp]
xor al, 0x89
xor bl, al
jmp 0x58d209
sub ebp, 2
push 0x7d9ca508
jmp 0x7452b6
mov word [ebp], ax
lea esp, [esp + 8]
jmp fcn.005679ca

Function at 0x58ddac
Capabilities:
Encode data using base64

Disassembly:
mov bp, word [ebp]
lea esp, [esp + 4]
jmp fcn.005679ca

Function at 0x598fa6
Capabilities:
Encode data using base64

Disassembly:
rdtsc
sub ebp, 8
mov dword [ebp + 4], eax
push 0xd3141d96
mov dword [ebp], edx
jmp 0x7748cd
lea esp, [esp + 0xc]
jmp fcn.005679ca

Function at 0x5b07ac
Capabilities:
Encode data using base64

Disassembly:
mov word [ebp], dx
lea esp, [esp + 0x14]
jmp fcn.005679ca
Function at 0x5b1983
Capabilities:
Encode data using base64

Disassembly:
add esi, 2
mov word [esi], dx
call fcn.005ac0eb
mov eax, 0xbbe6c82
shr eax, 0x90
movzx eax, byte [esi + eax*2 - 0x177c]
mov ecx, 0xfebcd520
adc esi, 1
and ecx, ecx
xor cl, ch
shl ecx, 0x8d
xor al, bl
lea ecx, [ecx*8 + 0x369af41d]
or ecx, 0x4d31e18f
xor al, 0x1d
jmp 0x73395c
add al, 0x9b
rol al, 1
dec ecx
sar ecx, 0xef
dec al
not al
neg cl
xor bl, al
add eax, esp
lea ecx, [ecx + ecx + 0x1507a6aa]
ror ecx, cl
mov cx, word [eax]
push 0x4f36c285
sub ebp, 2
mov word [ebp], cx
lea esp, [esp + 4]
jmp fcn.005679ca

Function at 0x5b4192
Capabilities:
Encode data using base64

Disassembly:
inc cx
not ebp
inc cx
sub ebp, 0x4166a015
rol ebp, 1
inc cx
xor ebp, 0xa0687bbc
invalid

Function at 0x5b4cb4
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + 4], 0x813ec818
mov dword [ebp], edx
push 0xf72f26b0
mov ebx, dword [esp + 0x14]
lea esp, [esp + 0x18]
jmp fcn.005679ca

Function at 0x5c3a4a
Capabilities:
Encode data using base64

Disassembly:
dec cl
not cl
ror cl, 1
sub cl, 0x87
xor bl, cl
lea ecx, [esp + ecx + 8]
mov dword [ecx], ebp
push 0xa035c3aa
call fcn.00752efa

Function at 0x5ca03f
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
ret
push ebp
mov ebp, esp
inc dx
bts dx, ax
mov edx, dword [ebp + 8]
test bx, di
cmp si, dx
stc
sub esp, 0x114
test sp, 0xa90
clc
test edx, esi
push esi
test sp, 0x9e90
test edx, edx
je 0x727654
mov esi, dword [ebp + 0xc]
stc
clc
test esi, esi
jmp 0x6ebdfe
mov eax, dword [edx + 0x3c]
add eax, edx
test bx, 0xf3ab
cmc
cmp dword [eax], 0x4550
jne 0x727654
mov ecx, dword [eax + 0x78]
test bx, sp
stc
mov dword [ebp - 4], ecx
test ecx, ecx
jmp 0x796469
je 0x727654
mov eax, 0x5a4d
cmp word [edx], ax
jmp 0x72764e
je 0x6da8c1
xor eax, eax
movzx esi, di
movsx esi, sp
pop esi
jmp 0x73943a
mov esp, ebp
pop ebp
jmp 0x555516
ja 0x76dbbb
mov eax, esi
cmp dh, 7
sub eax, dword [ecx + edx + 0x10]
jmp 0x59be93
mov edi, dword [ecx + edx + 0x18]
test edi, edi
je 0x5c63e1
mov eax, dword [ecx + edx + 0x20]
jmp 0x77cb8d
je 0x727654
mov eax, dword [eax + 0x7c]
test bp, bx
test si, 0x65bb
push ebx
cmp ax, ax
push edi
mov dword [ebp - 0x10], eax
clc
cmp esp, 0xd9a5348e
mov dword [ebp - 8], 0xffffffff
clc
test esp, ebx
cmp ebp, ebp
cmp esi, 0xffff
jmp 0x7452cc

Function at 0x5cf65c
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0x5a3edcab
sub ebp, 4
mov dword [ebp], edi
lea esp, [esp + 4]
jmp fcn.005679ca
Function at 0x5d07f2
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0xc69d9da1
add esi, 1
xor dl, bl
mov edi, 0xe69a3e3f
xor dl, 0x23
ror dl, 1
neg dl
inc edi
dec dl
ror edi, 0x6f
xor bl, dl
inc di
add edi, dword [esp + edi - 0x7c81cd35]
push edi
lea edx, [esp + edx + 8]
lea edi, [edi*8 - 0x6b5d2a80]
mov edi, dword [edx]
jne 0x7797b1
mov word [esi], ax
push 0xcf0c652f
call fcn.005924eb
mov edx, 0xd39d138e
mov ecx, dword [ebp]
or edx, edx
mov dx, word [ebp + 4]
js 0x765de9
inc edx
add edi, esp
pop esi
neg dword [esi + 0x6f]
dec esi
lds ecx, [edi + 0x1210ebde]
sti
sub bh, byte [ecx]
cmpsd dword [esi], dword es:[edi]
mov dx, word [eax]
mov esp, esp
xor dword [edi + eax + 0x1f], ebp
arpl word [ebx], di
xor edi, eax
or eax, 0x8763aff3
inc eax
popal
sub cl, al
xchg ebx, eax
pop eax
not dword [ebp + ebx*8 + 0x33]
retf 0x89f7
mov word [ecx], dx
jmp fcn.005651e4
adc ebp, 6
jmp 0x6e1415
sub ebp, 4
mov dword [ebp], edi
jmp 0x7799b3
lea esp, [esp + 8]
jmp fcn.005679ca

Function at 0x5d0c51
Capabilities:
Encode data using base64

Disassembly:
mov dword [ebp], edx
lea esp, [esp + 8]
jmp fcn.005679ca

Function at 0x6d4ff7
Capabilities:
Encode data using base64

Disassembly:
lea ebx, [eax*2 - 0x2d61aa43]
pop esi
sar ebx, 0x71
pop ebx
sar al, 0xa1
movsx edx, al
dec al
pop eax
dec edx
pop edx
call fcn.006d5048
mov bp, word [esi]
mov dword [esp], 0x6fb4799b
lea edx, [edx*2 - 0x257cd0da]
mov dx, word [esi + 2]
mov ecx, dword [esp]
dec dword [esp + ecx - 0x6fb4799b]
mov cl, byte [esi + ecx - 0x6fb47997]
push 0x8e003b0d
add esi, 4
sar word [esp + 5], 0xe1
jnp 0x71ca40
shr dword [esp], 0xc2
shld bp, dx, cl
mov word [esi], bp
lea esp, [esp + 8]
jmp fcn.00564153
pop ecx
shr ax, 0x88
jb 0x58d1ed

Function at 0x6da8ab
Capabilities:
Encode data using base64

Disassembly:
ror edi, 2
not dword [esp + 8]
sub edi, 0xcd80daa8
xor ebx, edi
ror dword [esp + 5], 0xa7
sub ebp, 4
mov dword [ebp], edi
lea esp, [esp + 0xc]
jmp fcn.005679ca
sub edi, 0x4fbd2e9d
jmp 0x551c6e

Function at 0x6dae6d
Capabilities:
Encode data using base64

Disassembly:
dec eax
mov dword [esp + 8], 0x41e26a42
dec eax
lea esp, [esp + 8]
call fcn.006fc0b5
movsx ecx, bx

Function at 0x6dffa0
Capabilities:
Encode data using base64

Disassembly:
lea ecx, [esp + ecx + 8]
rol di, 0xe2
adc edi, edi
movzx di, byte [edi + ecx - 0x3eed3a00]
jle 0x71ca0f
xor al, 0x10
sal dword [esp], 0x45
xor bl, al
lea eax, [esp + eax + 4]
jmp 0x75291b
sub ebp, 2
mov word [ebp], di
lea esp, [esp + 8]
jmp fcn.005679ca
call fcn.005c6c12

Function at 0x6e1de2
Capabilities:
Encode data using xor

Disassembly:
jmp 0x76222b
add esi, 8
call fcn.006ec58b
lodsb al, byte [esi]
popfd
mov dword [eax - 0x74], edi
pop esi
movsb byte es:[edi], byte [esi]
xchg esp, eax
rcl dword [eax], 0xbc
or eax, 0x9e144afe
invalid
Function at 0x6ec506
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 8]
je 0x58d083
mov ecx, 0x94269eaf
movzx ecx, byte [edx]
push 0x29327724
neg word [esp + 2]
xor ecx, ebp
and ecx, 0xff
sal word [esp + 2], 0xe9
mov ecx, dword [ecx*4 + 0x78a628]
shr ebp, 8
xor ebp, ecx
xor word [esp], 0x4d99
inc edx
xor ebp, 0x8981d916
sar dword [esp], 0xe4
dec eax
lea esp, [esp + 4]
jne 0x58d03b
call fcn.005b1848
mov ecx, dword [ebp]
sal di, 0x88
mov di, word ss:[ecx]
push 0x36b0b33f
add ebp, 2
push 0x29389908
push 0x7e831c29
mov word [ebp], di
lea esp, [esp + 0xc]
jmp fcn.006d1717
adc esi, 4
xor ebp, ebp
test eax, eax
jmp 0x58d031

Function at 0x6eeb37
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 8]
jmp fcn.005679ca
jmp 0x54d529
mov dword [ebp + 4], eax
push 0xeb361384
mov dword [ebp], edx
jmp 0x58de81

Function at 0x6f32e6
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
dec dl
inc ax
xor bl, dl
inc al
add edx, esp
mov eax, dword [edx + eax*4 - 0x3fc08]
sub ebp, 4
mov dword [ebp], eax
push 0x430766a8
lea esp, [esp + 4]
jmp fcn.005679ca
dec eax
sub ebx, 4
dec eax
mov dword [esp], 0x239cc237
mov dword [ebx], eax
call fcn.0054b22d
movzx edx, byte [eax + esi - 0x31b85e05]
lea esi, [esi + eax*2 - 0x6370bc09]
ror eax, 0xac
xor dl, bl
xor eax, eax
xor dl, 0x23
dec ax
ror dl, 1
dec eax
inc eax
neg dl
jmp 0x72666f
xor al, ah
jp 0x5b7167
pop esp
in eax, dx
imul byte [edx]
stc
mov ebp, 0x4ea74cfb
or eax, 0xc4f397dc
xor byte [esi + 0x4dbda19], bl
dec ebp
mov ch, ah
test dword [edi], edx
pop ss
pop es
inc ebx
xor dword [esi], esi
sal byte [ebx], 0x5f
outsb dx, byte [esi]
xchg ecx, ecx
add byte [eax + edx*8 + 0x3ccad282], ah
rol dword [ecx], cl
div byte [eax + 0x6651f62f]
xchg esp, eax
add eax, 0xafe6c0e6
cli
pop esi
call 0xa4a7f7
pop esi
sub byte [edx - 0x5c], dl
mov al, byte [0xbed5bb78]
lea edi, [edi - 5]
dec esi
mov al, 0x1c
inc ecx
add eax, 0xa1ff24b4
js 0x726690
xchg ebx, eax
js 0x726690
int 0xef
invalid

Function at 0x6f955e
Capabilities:
Encode data using base64

Disassembly:
push 0x6903080a
mov dword [ebp], edx
lea esp, [esp + 0x10]
jmp fcn.005679ca

Function at 0x7014b4
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 8]
jmp fcn.005679ca

Function at 0x7156af
Capabilities:
Encode data using base64

Disassembly:
mov dword [ebp], edi
push 0x62bef786
lea esp, [esp + 0xc]
jmp fcn.005679ca
xor edi, ebx
not edi
bswap edi
sub edi, 0x4fbd2e9d
ror edi, 2
sub edi, 0xcd80daa8
xor ebx, edi
sub ebp, 4
jmp 0x5c39ae
Function at 0x71f582
Capabilities:
Encode data using base64

Disassembly:
adc esi, 6
call fcn.007a052e
sub esi, 1
mov edx, 0x528cef94
sub edx, 0xbd043809
movzx ecx, byte [esi]
xor cl, bl
jmp 0x5ac1aa
inc ecx
shl ecx, cl
not dl
ror cx, 0xcd
and cl, 0x14
seta cl
inc dl
push ecx
bswap ecx
and ecx, dword [esp + ecx*4 - 0x1a0]
xor dl, 0xac
sal ecx, 0xc4
sub cx, 0xf9b1
sar cx, cl
dec dl
xor dword [esp + ecx], 0xf094103d
sbb cl, ch
rol dl, 1
call fcn.00763fb5
neg cl
or dl, dl
and dl, dl
jge 0x59f089
xor cl, 0xab
sar edx, 0x41
add cl, 0x2e
rol edx, 0xc
xor cl, 0x2a
dec edx
rol cl, 1
xor bl, cl
shl edx, 0xb7
sal edx, 0xac
call fcn.005d67dc
jg 0x54b1e4
mov eax, dword [esp + edx*2 - 0x126]
mov edx, dword [esp + edx*2 - 0x122]
push 0xaf2f3325
push dword [esp + 0x1c]
popfd
lea esp, [esp + 0x20]
ret

Function at 0x721781
Capabilities:
Encode data using base64

Disassembly:
mov dword [ebp], eax
jmp 0x79dfa9

Function at 0x721d07
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0x10]
jmp fcn.005679ca

Function at 0x7234c2
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 4]
jmp fcn.005679ca
mov ebp, dword [ebp]
jmp 0x58d1e4

Function at 0x72fdc9
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 4]
jmp fcn.005679ca

Function at 0x735424
Capabilities:
Encode data using base64

Disassembly:
mov word [ebp], di
push 0x1a24c720
push 0xb1376715
push 0xdd01f688
lea esp, [esp + 0x1c]
jmp fcn.005679ca

Function at 0x754d7b
Capabilities:
Encode data using base64

Disassembly:
mov word [ebp], dx
lea esp, [esp + 8]
jmp fcn.005679ca

Function at 0x75be2a
Capabilities:
Encode data using base64

Disassembly:
sbb ebp, 2
push 0x630af6ae
mov word [ebp], cx
lea esp, [esp + 0x18]
jmp fcn.005679ca

Function at 0x75d980
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
adc esi, 6
mov byte es:[edx], cl
push 0x42bfcd25
call fcn.005ab811
pop ds
push ds
mov byte [0xfa733551], al
shl bh, 0xd3
aaa
push ecx
xor eax, 0xe7c0fa73
sal dword [edi], cl
rcr ah, 0x52
sub eax, edx
add cl, byte [esi]
test byte [eax - 0x714a4fe6], cl
jp 0x75d996
sahf
pop edx
xor eax, 0x56
invalid
Function at 0x76c560
Capabilities:
Encode data using base64

Disassembly:
mov dword [ecx], ebx
bsr cx, bx
rcr cl, 0x3c
mov ecx, dword [eax + 4]
bt ax, 0x33
add ecx, esi
cmp esi, ebx
sar al, cl
not ax
mov eax, 0x300
shl eax, cl
jmp 0x546fab
mov dword [ebp - 0x3c], esi
cmc
mov dword [ebp - 0x14], ebx
clc
test ch, 0xc
mov dword [ebp - 0x10], edi
add eax, 0x736
jmp 0x7885c7
rep stosd dword es:[edi], eax
jmp 0x723509
je 0x72e210
mov ecx, eax
test esi, 0x94bbff3e
adc ah, 0x22
mov eax, 0x400
bts di, si
mov edi, edx
add edx, 0x1804dfae
bt edx, 0x9d
adc dh, 0x3d
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
shr ecx, 1
jmp 0x742d40
add ebp, 1
xor al, bl
rol al, 1
call fcn.0059fad3
mov dword [ebp - 0x44], esi
not esi
bts si, si
clc
mov esi, edi
stc
cmc
test cx, bp
shl esi, cl
adc cx, di
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x18], ebx
mov byte [ebp - 1], bl
test ah, 0xb4
sub esi, edi
cmp esp, ebx
test esi, 0x19b46bae
mov dword [ebp - 0x48], esi
btc si, 0x81
mov esi, dword [eax]
mov dword [ecx], ebx
sub ecx, esp
mov ecx, dword [ebp + 0x14]
cmc
jmp 0x545b02
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
jmp 0x79789e
mov dword [ebp - 0x2c], edi
jmp 0x76254b

Function at 0x76e6ed
Capabilities:
Encode data using base64

Disassembly:
jmp 0x771fa2
mov word [ebp], cx
lea esp, [esp + 8]
jmp fcn.005679ca

Function at 0x7754e8
Capabilities:
Encode data using base64

Disassembly:
sbb ebp, 2
mov word [ebp], di
lea esp, [esp + 4]
jmp fcn.005679ca
not al
mov dword [esp], edi
shr byte [esp + 1], 0xc5
shr dword [esp], 0xd1
add al, 0xb5
add dword [esp], edi
xor bl, al
or dword [esp], edi
lea eax, [esp + eax + 4]
movzx di, byte [eax]
js 0x774591
test al, 0xf9
salc
or ah, al
add eax, 0x9c553f6b
add esi, dword [0xdf8614e0]
hlt

Function at 0x77c8d0
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0x10]
jmp fcn.005679ca
push 0x5f34c123
jmp 0x5808b2

Function at 0x780088
Capabilities:
Encode data using base64

Disassembly:
xor esi, edi
push 0x4a19e7b4
and esi, 0xff
mov esi, dword [esi*4 + 0x58f810]
shr edi, 8
xor edi, esi
inc eax
sar byte [esp + 3], 0xc2
sbb word [esp + 2], 0x3615
xor edi, 0x85a94199
rol dword [esp], 0x71
dec edx
call fcn.0075e1e2

Function at 0x781a69
Capabilities:
Encode data using base64

Disassembly:
ror di, 1
mov dword [esp], 0x92e4a02
xor bx, di
sub ebp, 2
mov word [ebp], di
push 0xc497ac00
jmp 0x79308e
lea esp, [esp + 0xc]
jmp fcn.005679ca

Function at 0x78dc97
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [ebp + ebx*4]
mov dword [esp], eax
dec ebx
jne 0x77bad8

Function at 0x7921bb
Capabilities:
Encode data using xor

Disassembly:
mov ebp, dword [esi]
mov eax, dword [esi + 4]
add esi, 4
xor ecx, ecx
test eax, eax
lea esp, [esp + 4]
je 0x792211
movzx edx, byte [ebp]
push 0x3327c737
xor edx, ecx
and edx, 0xff
mov edx, dword [edx*4 + 0x783cac]
inc dword [esp]
sar byte [esp + 1], 0xc1
shr ecx, 8
xor ecx, edx
inc ebp
xor ecx, 0x150df10f
dec eax
push 0xc7bf26a1
lea esp, [esp + 8]
jne 0x7921d4
not ecx
push 0xba46814
mov dword [esi], ecx
lea esp, [esp + 4]
jmp fcn.00564153
Function at 0x79be39
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0xf96a5a9
mov word [ebp], di
push 0xa528c880
lea esp, [esp + 0xc]
jmp fcn.005679ca
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x61df6382
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x42e024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x16c32a7a
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x4021f0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42b6d0]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push esi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x402245
lea ecx, [ebp - 0x20]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x402256
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040b2e2
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
push 0
push 0
push 0x10
lea edx, [ebp - 0x14]
push edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x18]
push 0
push eax
mov dword [ebp - 0x14], 1
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ecx, dword [ebp - 0x18]
push ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0040b2e2
mov esp, ebp
pop ebp
ret

Function at 0x402460
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1118
call fcn.0041c820
mov eax, dword [0x42b6d0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 0x1110]
push eax
push 0x1000
lea ecx, [ebp - 0x1108]
xor edi, edi
push ecx
mov dword [ebp - 0x110c], edi
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
jne 0x4024ac
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040b2e2
mov esp, ebp
pop ebp
ret
test dword [ebp - 0x1110], 0xfffffffc
jbe 0x402581
push ebx
mov ebx, dword [sym.imp.PSAPI.DLL_GetModuleBaseNameA]
push esi
jmp 0x4024d0
mov eax, dword [ebp + edi*4 - 0x1108]
test eax, eax
je 0x40256d
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x40256d
lea edx, [ebp - 0x1118]
push edx
push 4
lea eax, [ebp - 0x1114]
push eax
push esi
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x40256d
mov edx, dword [ebp - 0x1114]
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push edx
push esi
call ebx
mov ecx, 0x42772c
lea eax, [ebp - 0x108]
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x402550
test dl, dl
je 0x40254c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x402550
add eax, 2
add ecx, 2
test dl, dl
jne 0x402530
xor eax, eax
jmp 0x402555
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x402566
mov eax, dword [ebp + edi*4 - 0x1108]
mov dword [ebp - 0x110c], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x1110]
inc edi
shr ecx, 2
cmp edi, ecx
jb 0x4024d0
pop esi
pop ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x110c]
xor ecx, ebp
pop edi
call fcn.0040b2e2
mov esp, ebp
pop ebp
ret