joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5786b7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
push edi
push dword [esi + 0x144]
lea ebx, [esi + 0x78]
push dword [esi + 0x20]
lea eax, [esi + 0x1f0]
push ebx
push eax
mov dword [ebp - 8], 1
call fcn.0058838f
mov edi, eax
test edi, edi
jns 0x5786f4
push 0x43bb08
jmp 0x578874
lea eax, [esi + 0xe8]
push ebx
push eax
call fcn.0058d489
mov edi, eax
test edi, edi
jns 0x578711
push 0x43bad4
jmp 0x578874
cmp dword [esi + 0x268], 1
jne 0x578765
lea eax, [ebp - 4]
push eax
push 1
lea ebx, [esi + 0x274]
push ebx
call fcn.00579755
mov edi, eax
test edi, edi
jns 0x57873c
push 0x43ba96
jmp 0x578874
push ebx
call fcn.00579971
mov edi, eax
test edi, edi
jns 0x578752
push 0x43ba68
jmp 0x578874
cmp dword [ebp - 4], 0
je 0x578765
push dword [ebp - 4]
call dword [0x401270]
and dword [ebp - 4], 0
lea eax, [ebp - 8]
push eax
lea eax, [esi + 0xe4]
push eax
push dword [esi + 0x144]
lea eax, [esi + 0x9c]
push dword [esi + 0x20]
lea ebx, [esi + 0x78]
push eax
push ebx
call fcn.0058c759
mov edi, eax
xor eax, eax
cmp edi, eax
jge 0x57879b
push 0x43ba46
jmp 0x578874
cmp dword [ebp - 8], eax
jne 0x5787b3
push 0xe0000035
push 1
call fcn.0057835f
xor edi, edi
jmp 0x57887a
cmp dword [esi + 0xa8], eax
je 0x5787ce
cmp dword [esi + 0x20], 2
jle 0x5787ce
lea ecx, [esi + 0x34]
push ecx
push eax
push dword [ebp + 8]
call fcn.0058b741
push esi
push dword [ebp + 8]
call fcn.00587a9f
mov edi, eax
test edi, edi
jns 0x5787e7
push 0x43b7c4
jmp 0x578874
push esi
call fcn.005830f7
mov edi, eax
test edi, edi
jns 0x5787fa
push 0x43ba28
jmp 0x578874
push ebx
push dword [esi + 0x1c]
call fcn.005895e5
mov edi, eax
test edi, edi
jns 0x578810
push 0x43ba08
jmp 0x578874
push ebx
lea eax, [esi + 0xe8]
push eax
call fcn.0057dda9
mov edi, eax
test edi, edi
jns 0x57882a
push 0x43b9e2
jmp 0x578874
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x578852
cmp word [eax], 0
je 0x578852
push 0
push eax
push 0x402658
push ebx
call fcn.00581a33
mov edi, eax
test edi, edi
jns 0x578852
push 0x43b994
jmp 0x578874
and dword [ebp + 8], 0
lea eax, [ebp + 8]
push eax
mov eax, esi
call fcn.00578561
mov edi, eax
test edi, edi
js 0x57886f
cmp dword [ebp + 8], 0
jne 0x578852
jmp 0x57887c
push 0x43b97e
push edi
call 0x59d4df
pop ecx
pop ecx
push esi
call fcn.005877c7
lea eax, [esi + 0x78]
push eax
call fcn.0058283b
cmp dword [esi + 0x284], 0xffffffff
je 0x5788b7
cmp dword [esi + 0x268], 1
jne 0x5788a2
mov eax, dword [esi + 0x18]
jmp 0x5788a4
xor eax, eax
push eax
push dword [esi + 0xe4]
lea eax, [esi + 0x274]
push eax
call fcn.00579c5f
push dword [esi + 0x34]
call dword [fcn.00401358]
test eax, eax
je 0x5788d3
push 0
push 0
push 0x10
push dword [esi + 0x34]
call dword [fcn.0040135c]
cmp dword [ebp - 4], 0
je 0x5788e2
push dword [ebp - 4]
call dword [0x401270]
mov eax, edi
pop edi
pop ebx
leave
ret 4
Function at 0x592bab
Capabilities:
Encode data using xor

Disassembly:
add eax, 0x3893019d
mov ecx, ds
inc esi
inc edi
dec ecx
ljmp 0x95f7
add byte [eax], al
add byte [eax], al
int 0x2e
cmpsb byte [esi], byte es:[edi]
inc ebx
pop ds
push ebp
scasb al, byte es:[edi]
sti
shl esi, 1
jmp 0x592b2b
out 0xeb, al
cmpsb byte [esi], byte es:[edi]
mov dword [edi + 0x60ce671], edi
pop edx
xchg esi, eax
pop esp
ja 0x592b75
test al, 1
add al, 0xd0
in al, dx
stosd dword es:[edi], eax
out dx, al
and eax, 0
outsb dx, byte [esi]
push edi
mov al, byte [edx]
clc
adc dword [esi], eax
jl 0x592b95
invalid
xchg ebx, eax
in eax, dx
bound edi, qword [ecx - 0xb]
xchg esi, eax
jae 0x592c09
dec ebx
aam 0xa6
mov ch, 0xfd
js 0x592bf8
jge 0x592b82
xchg edx, eax
pop es
add byte [eax], al
add byte [edi - 0x7f], dl
sbb ecx, dword [esi + 0x53]
or al, 0x19
lodsb al, byte [esi]
fcom qword [di + 0x1cc7]
push 0xffffffffffffffb7
mov esi, 0x17caeded
and ch, byte [eax - 0x1a]
jnp 0xa8864d8b
cmp al, byte [eax]
dec eax
cli
add byte [eax + 0x195b309f], bh
pop esi
xor byte [eax + 0x1c], dh
nop
add dl, byte [eax + eax - 0x1d3bc000]
outsd dx, dword [esi]
mov ebp, 0x1b51bdbd
jae 0x592bd5
push ecx
sbb esi, dword [ebx - 0x27]
push ss
mov ah, 0xa1
xor dl, byte [eax - 0x48]
xchg esi, eax
movsd dword es:[edi], dword [esi]
add eax, 0xaac5b9ab
stosb byte es:[edi], al
push ecx
pop es
add bl, al
lodsb al, byte [esi]
push ebx
and cl, byte [ecx]
insd dword es:[edi], dx
push eax
mov word [ebp + 0x1a4e8be7], fs
mov es, word [eax]
add byte [esp + edi*8], dh
mov al, byte [0x9e242d7d]
lahf
push ebp
mov dword [eax], ebx
mov bl, byte [ebx + 0x3c]
out 0x19, al
cmp cl, byte [ebp - 0x1f]
scasd eax, dword es:[edi]
dec ebp
loope 0x592be0
add byte [eax], al
add byte [eax], al
cmpsb byte [esi], byte es:[edi]
inc edx
shr byte [ebx], 0xae
jg 0x592c3e
in eax, 0x93
pop ss
call 0x20dc7599
mov ah, 0x68
enter 0xffffffffffffa07c, 0x28
xor eax, 0xb008712a
lcall 0x4b, 0x32041f71
add byte [eax], al
add byte [ebx + 0xc], bh
lodsb al, byte [esi]
adc esp, dword [edi + 0x2e2e4b3f]
jl 0x592c2e
test ebp, 0xb0825adf
mov al, 0xcb
wait
xor eax, 0x24d303dc
cmp edx, eax
mov byte [ebx], 0xb8
je 0x592c7a
inc eax
add al, 0
mov ah, 0xfa
out dx, eax
push edi
dec esi
cmp dword [edx], esi
inc esi
mov esp, 0x9cbd2012
mov cl, 0xa8
dec ebx
enter 0xffffffffffffb3ed, 0x76
aas
wait
pop edx
mov esp, 0x2f197e60
add byte [eax], al
out dx, eax
add edx, esp
sbb eax, 0x182f659a
push 0
dec edi
invalid
Function at 0x100024a7
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
mov dword [ebp - 4], eax
call fcn.100039a4
movsx ecx, al
call fcn.100039a1
movsx eax, al
imul ecx, eax
call fcn.100039ad
movsx eax, al
xor edx, edx
lea eax, [eax + ecx*2]
movsx ecx, byte [0x1000c004]
add eax, ecx
movsx ecx, byte [0x1000c003]
div ecx
movsx ecx, byte [section..data]
sub eax, ecx
push ecx
push ecx
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10008ba0]
movsd qword [esp], xmm0
call fcn.10004e73
test eax, eax
pop ecx
cmovg eax, dword [ebp - 4]
pop ecx
leave
ret
Function at 0x1000279b
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, eax
push esi
call fcn.1000252a
pop ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push eax
push esi
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x10]
cdq
push edx
push eax
push str.Base_Address:_0x_llu_n
call fcn.10006b19
push dword [ebp - 0xc]
push str.Image_Size:____u_n
call fcn.10006b19
mov eax, dword [ebp - 8]
cdq
push edx
push eax
push str.Entry_Point:__0x_llu_n
call fcn.10006b19
push 0x10008328
call fcn.10006b19
mov ecx, dword [ebp + 8]
add esp, 0x24
mov eax, dword [ebp - 0x10]
cdq
mov dword [ecx], eax
mov eax, dword [ebp + 0xc]
mov dword [ecx + 4], edx
mov ecx, dword [ebp - 0xc]
and dword [eax + 4], 0
mov dword [eax], ecx
lea eax, [ebp - 4]
push eax
push 0x40
push ecx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
call fcn.100039a4
movsx ecx, al
call fcn.100039a1
movsx eax, al
imul ecx, eax
imul edx, ecx, 6
call fcn.100039ad
movsx ecx, byte [0x1000c004]
movsx eax, al
add eax, edx
xor edx, edx
add eax, ecx
movsx ecx, byte [0x1000c003]
div ecx
movsx ecx, byte [section..data]
sub eax, ecx
push ecx
push ecx
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10008ba0]
movsd qword [esp], xmm0
call fcn.10004e73
pop ecx
pop ecx
pop esi
test eax, eax
jle 0x10002886
xor eax, eax
leave
ret
Function at 0x100037d3
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 4], esi
lea edi, [esi + 0x9c4]
mov esi, 0xe3
mov ebx, dword [edi]
mov eax, ebx
lea edx, [edi]
mov ecx, eax
lea edi, [edx + 4]
mov ebx, dword [edi]
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x634]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub esi, 1
jne 0x100037ec
mov edi, dword [ebp - 4]
mov esi, 0x18c
add edi, 0xd50
mov ebx, dword [edi]
mov eax, ebx
lea edx, [edi]
mov ecx, eax
lea edi, [edx + 4]
mov ebx, dword [edi]
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx - 0xd4c]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub esi, 1
jne 0x10003836
mov esi, dword [ebp - 4]
pop edi
mov eax, dword [esi + 0x1380]
mov ecx, dword [esi + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
and dword [esi], 0
mov dword [esi + 0x9c0], eax
pop esi
pop ebx
leave
ret

Function at 0x100038ae
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
lea edx, [ecx + 8]
mov esi, 0x270
mov ecx, dword [edx]
lea edx, [edx + 4]
xor ecx, dword [edx - 8]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub esi, 1
jne 0x100038b7
pop esi
ret
Function at 0x10005bde
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor edx, eax
imul edx, dword [ebp + 0xc]
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jb 0x10005bf5
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8
Function at 0x401000
Capabilities:
Read file on windows

Disassembly:
push esi
push edi
push 0x40ca24
push eax
mov edi, ecx
call fcn.00402235
mov esi, eax
add esp, 8
test esi, esi
je 0x401088
push ebx
push 2
push 0
push esi
call fcn.00402736
push esi
call fcn.00402647
push 0
push 0
push esi
mov ebx, eax
call fcn.00402736
add esp, 0x1c
test edi, edi
je 0x40103e
mov dword [edi], ebx
test ebx, ebx
je 0x40106a
push ebx
call fcn.00402a0d
mov edi, eax
add esp, 4
test edi, edi
je 0x401042
push esi
push ebx
push 1
push edi
call fcn.00402496
push esi
call fcn.0040281f
add esp, 0x14
pop ebx
mov eax, edi
pop edi
pop esi
ret
push esi
call fcn.0040281f
add esp, 4
push 8
call fcn.00402a0d
add esp, 4
test eax, eax
je 0x401073
pop ebx
pop edi
mov byte [eax], 0
pop esi
ret
pop edi
xor eax, eax
pop esi
ret

Function at 0x4013f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
sub esp, 8
cmp word [eax], cx
je 0x401409
xor eax, eax
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [eax + 0x3c]
add ebx, eax
cmp dword [ebx], 0x4550
mov dword [ebp - 8], ebx
je 0x401421
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebx + 0x50]
mov eax, dword [ebx + 0x34]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 4
push 0x3000
push edx
push eax
call edi
mov esi, eax
test esi, esi
jne 0x401458
mov ecx, dword [ebx + 0x50]
push 4
push 0x3000
push ecx
push eax
call edi
mov esi, eax
test esi, esi
je 0x40151c
push 0x14
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
xor eax, eax
cmp edi, eax
jne 0x401487
push 0x8000
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push 4
mov dword [edi + 4], esi
mov dword [edi + 0xc], eax
mov dword [edi + 8], eax
mov byte [edi + 0x10], al
mov edx, dword [ebx + 0x54]
push 0x1000
push edx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 4], eax
test eax, eax
je 0x401515
mov ecx, dword [ebx + 0x54]
mov edx, dword [ebp + 8]
push ecx
push edx
push eax
call fcn.004061d0
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x3c]
add eax, dword [ebp - 4]
push ebx
mov dword [edi], eax
push ecx
mov ebx, edi
mov dword [eax + 0x34], esi
call fcn.00401090
mov ecx, dword [ebp - 8]
mov eax, esi
add esp, 0x14
sub eax, dword [ecx + 0x34]
je 0x4014e8
push eax
push edi
call fcn.00401200
add esp, 8
call fcn.00401280
test al, al
je 0x401515
push edi
call fcn.00401130
add esp, 4
call fcn.004013b0
mov edx, dword [edi]
mov eax, dword [edx + 0x28]
test eax, eax
je 0x401529
push 0
push 1
add eax, esi
push esi
call eax
test eax, eax
jne 0x401525
mov esi, edi
call fcn.00401600
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [edi + 0x10], 1
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401fce
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411004]
jne 0x401fd8
repz ret
jmp fcn.004031b4
Function at 0x409ed4
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x411004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00403cd7
and dword [ebp - 0x14], 0
cmp dword [0x412d10], 0
mov dword [ebp - 0x18], eax
jne 0x409f87
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40a02f
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40a02f
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x412d10], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x412d14], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x412d18], eax
call edi
push eax
call esi
mov dword [0x412d20], eax
test eax, eax
je 0x409f87
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x412d1c], eax
mov eax, dword [0x412d1c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x409fe0
cmp dword [0x412d20], ecx
je 0x409fe0
push eax
call esi
push dword [0x412d20]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x409fe0
test ebx, ebx
je 0x409fe0
call edi
test eax, eax
je 0x409fd7
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x409fd7
test byte [ebp - 8], 1
jne 0x409fe0
or dword [ebp + 0x10], 0x200000
jmp 0x40a013
mov eax, dword [0x412d14]
cmp eax, dword [ebp - 0x18]
je 0x40a013
push eax
call esi
test eax, eax
je 0x40a013
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40a013
mov eax, dword [0x412d18]
cmp eax, dword [ebp - 0x18]
je 0x40a013
push eax
call esi
test eax, eax
je 0x40a013
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x412d10]
call esi
test eax, eax
je 0x40a02f
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40a031
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401fce
leave
ret
Function at 0x401e80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x50b618]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x513218], 0
jne 0x401f44
cmp byte [0x513219], 0
mov al, 1
mov byte [0x513218], al
jne 0x401ebd
push 0x512e70
mov byte [0x513219], al
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call fcn.00401540
call fcn.00401f60
mov dword [0x513214], eax
mov al, 0x73
mov cl, 0x65
mov byte [ebp - 0x1f], al
mov byte [ebp - 0x14], al
mov byte [ebp - 0x13], al
lea eax, [ebp - 0x20]
mov byte [ebp - 0xf], cl
mov byte [ebp - 0xc], cl
mov byte [ebp - 0x15], cl
mov dl, 0x6f
push eax
lea ecx, [ebp - 0x10]
push ecx
mov byte [ebp - 0x10], 0x6b
mov byte [ebp - 0xe], 0x72
mov byte [ebp - 0xd], 0x6e
mov byte [ebp - 0xb], 0x6c
mov byte [ebp - 0xa], 0x33
mov byte [ebp - 9], 0x32
mov byte [ebp - 8], 0
mov byte [ebp - 0x20], 0x49
mov byte [ebp - 0x1e], 0x57
mov byte [ebp - 0x1d], dl
mov byte [ebp - 0x1c], 0x77
mov byte [ebp - 0x1b], 0x36
mov byte [ebp - 0x1a], 0x34
mov byte [ebp - 0x19], 0x50
mov byte [ebp - 0x18], 0x72
mov byte [ebp - 0x17], dl
mov byte [ebp - 0x16], 0x63
mov byte [ebp - 0x12], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x513210], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045d99c
mov esp, ebp
pop ebp
ret

Function at 0x401f60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x50b618]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, 0x65
mov cl, 0x74
mov byte [ebp - 0xf], al
mov byte [ebp - 0xc], al
mov byte [ebp - 0x23], al
mov byte [ebp - 0x1c], al
mov byte [ebp - 0x17], al
lea eax, [ebp - 0x24]
mov byte [ebp - 0x22], cl
mov byte [ebp - 0x1f], cl
mov byte [ebp - 0x18], cl
mov dl, 0x6e
push eax
lea ecx, [ebp - 0x10]
push ecx
mov byte [ebp - 0x10], 0x6b
mov byte [ebp - 0xe], 0x72
mov byte [ebp - 0xd], dl
mov byte [ebp - 0xb], 0x6c
mov byte [ebp - 0xa], 0x33
mov byte [ebp - 9], 0x32
mov byte [ebp - 8], 0
mov byte [ebp - 0x24], 0x47
mov byte [ebp - 0x21], 0x4e
mov byte [ebp - 0x20], 0x61
mov byte [ebp - 0x1e], 0x69
mov byte [ebp - 0x1d], 0x76
mov byte [ebp - 0x1b], 0x53
mov byte [ebp - 0x1a], 0x79
mov byte [ebp - 0x19], 0x73
mov byte [ebp - 0x16], 0x6d
mov byte [ebp - 0x15], 0x49
mov byte [ebp - 0x14], dl
mov byte [ebp - 0x13], 0x66
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0x11], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x402042
xor ecx, ecx
lea edx, [ebp - 0x48]
push edx
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
call eax
mov eax, dword [ebp - 0x48]
cmp ax, 6
je 0x40202f
cmp ax, 9
jne 0x402042
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045d99c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.0045d99c
mov esp, ebp
pop ebp
ret
Function at 0x402cf0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x50b618]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
xor ecx, ecx
push 0x7e
xor eax, eax
push ecx
lea edx, [ebp - 0x8a]
push edx
mov dword [ebp - 0x90], esi
mov word [ebp - 0xc], ax
mov dword [ebp - 0xa], eax
mov word [ebp - 6], ax
mov word [ebp - 0x8c], cx
call fcn.004634b0
add esp, 0xc
test ebx, ebx
je 0x402dfa
test esi, esi
je 0x402dfa
push edi
mov edi, 0x41
mov edi, edi
push 0x40
lea ecx, [ebp - 0x8c]
push ecx
lea edx, [ebp - 0xc]
mov eax, 0x3a
push edx
mov word [ebp - 0xc], di
mov word [ebp - 0xa], ax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x402da6
lea eax, [ebp - 0x8c]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402d80
sub eax, edx
sar eax, 1
mov esi, eax
push esi
lea eax, [ebp - 0x8c]
push ebx
push eax
call fcn.0045e330
add esp, 0xc
test eax, eax
je 0x402dc0
inc edi
cmp di, 0x5b
jl 0x402d50
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045d99c
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x90]
lea ecx, [ebp - 0xc]
push ecx
push 0x104
push edi
call fcn.0045e3d6
lea edx, [ebx + esi*2]
push edx
push 0x104
push edi
call fcn.0045e445
add esp, 0x18
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045d99c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
xor al, al
pop ebx
call fcn.0045d99c
mov esp, ebp
pop ebp
ret
Function at 0x4036c0
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x50b618]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.00401e80
push pe_nt_image_headers32
lea eax, [ebp - 0x11c]
push 0
push eax
call fcn.004634b0
add esp, 0xc
lea ecx, [ebp - 0x120]
push ecx
mov dword [ebp - 0x120], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x403717
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045d99c
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x110], 2
jne 0x403725
call fcn.00403550
push 0
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045d99c
mov esp, ebp
pop ebp
ret

Function at 0x403740
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x50b618]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
call fcn.00401e80
mov al, 0x6c
mov byte [ebp - 0xd], al
mov byte [ebp - 0xc], al
mov byte [ebp - 9], al
mov byte [ebp - 8], al
mov al, 0x6f
mov byte [ebp - 0x20], al
mov byte [ebp - 0x1a], al
mov byte [ebp - 0x16], al
mov cl, 0x74
mov al, 0x73
mov byte [ebp - 0x13], al
mov byte [ebp - 0x12], al
lea eax, [ebp - 0x28]
mov dl, 0x6e
mov byte [ebp - 0xf], cl
mov byte [ebp - 0x27], cl
mov byte [ebp - 0x24], cl
mov byte [ebp - 0x1c], cl
push eax
lea ecx, [ebp - 0x10]
push ecx
mov byte [ebp - 0x10], dl
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0xb], 0x2e
mov byte [ebp - 0xa], 0x64
mov byte [ebp - 7], 0
mov byte [ebp - 0x28], 0x4e
mov byte [ebp - 0x26], 0x53
mov byte [ebp - 0x25], 0x65
mov byte [ebp - 0x23], 0x49
mov byte [ebp - 0x22], dl
mov byte [ebp - 0x21], 0x66
mov byte [ebp - 0x1f], 0x72
mov byte [ebp - 0x1e], 0x6d
mov byte [ebp - 0x1d], 0x61
mov byte [ebp - 0x1b], 0x69
mov byte [ebp - 0x19], dl
mov byte [ebp - 0x18], 0x50
mov byte [ebp - 0x17], 0x72
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x14], 0x65
mov byte [ebp - 0x11], 0
call fcn.00476470
mov esi, eax
test esi, esi
jne 0x4037fc
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045d99c
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x29]
push edx
push 0
push 1
push 0x14
call sub.ntdll.dll_RtlAdjustPrivilege
test eax, eax
jne 0x4037eb
push 4
lea eax, [ebp + 8]
push eax
push 0x1d
push edi
call esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
pop esi
call fcn.0045d99c
mov esp, ebp
pop ebp
ret

Function at 0x404680
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x404696
test al, 0x10
je 0x404696
mov eax, 1
ret
xor eax, eax
ret
Function at 0x4046a0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x4046b3
xor eax, eax
mov word [ebx], ax
push esi
mov byte [ebp - 1], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4046cb
test al, 0x10
jne 0x404781
mov eax, esi
push edi
xor edi, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4046d3
sub eax, edx
sar eax, 1
je 0x40475a
movzx eax, word [esi + edi*2]
cmp ax, 0x5c
je 0x4046f4
cmp ax, 0x2f
jne 0x404741
xor ecx, ecx
push esi
movzx ebx, ax
mov word [esi + edi*2], cx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40470d
test al, 0x10
jne 0x40473a
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x40473a
mov eax, dword [ebp + 8]
test eax, eax
je 0x40473a
cmp byte [ebp - 1], 0
jne 0x40473a
push esi
push 0x104
push eax
call fcn.0045e3d6
add esp, 0xc
mov byte [ebp - 1], 1
mov word [esi + edi*2], bx
mov ebx, dword [ebp + 8]
mov eax, esi
inc edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x404747
sub eax, edx
sar eax, 1
cmp edi, eax
jb 0x4046e4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop edi
test eax, eax
je 0x404781
test ebx, ebx
je 0x404781
cmp byte [ebp - 1], 0
jne 0x404781
push esi
push 0x104
push ebx
call fcn.0045e3d6
add esp, 0xc
pop ebx
mov esp, ebp
pop ebp
ret