joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4090cf
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x24
mov eax, 0x434f9a
call fcn.00422c8e
mov esi, ecx
mov dword [ebp - 0x20], esi
mov eax, dword [esi + 0x60]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x5c]
mov dword [ebp - 0x18], eax
call fcn.00410e84
mov edi, dword [eax + 0xc]
xor ebx, ebx
cmp dword [esi + 0x58], ebx
je 0x40911a
call fcn.00410e84
mov edi, dword [eax + 0xc]
push 5
push dword [esi + 0x58]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
je 0x40912b
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jne 0x409138
or eax, 0xffffffff
jmp 0x409294
mov ecx, esi
call fcn.00408c21
mov dword [ebp - 0x14], eax
call fcn.0040c6f8
and dword [ebp - 0x28], ebx
cmp dword [ebp - 0x14], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], ebx
je 0x4091b6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp dword [ebp - 0x14], eax
je 0x4091b6
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x4091b6
push 0
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x2c], 1
call fcn.004055fd
mov ebx, eax
test ebx, ebx
mov dword [ebp - 0x24], ebx
je 0x4091b6
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x120]
test eax, eax
je 0x4091b6
mov ecx, ebx
call fcn.004098ec
test eax, eax
je 0x4091b6
push 0
mov ecx, ebx
call fcn.00409907
mov dword [ebp - 0x28], 1
and dword [ebp - 4], 0
push esi
call fcn.0040e069
push dword [ebp - 0x14]
call fcn.0040c650
push edi
push eax
push dword [ebp - 0x1c]
mov ecx, esi
call fcn.00408ed7
xor edi, edi
cmp eax, edi
je 0x409213
test byte [esi + 0x3c], 0x10
je 0x4091fd
push 4
pop edi
mov ecx, esi
call fcn.004097d3
test ax, 0x100
je 0x4091f3
push 5
pop edi
push edi
mov ecx, esi
call fcn.0040c1e6
xor edi, edi
cmp dword [esi + 0x20], edi
je 0x409213
push 0x97
push edi
push edi
push edi
push edi
push edi
mov ecx, esi
call fcn.00409ab1
or dword [ebp - 4], 0xffffffff
jmp 0x40923e
cmp dword [ebp - 0x28], edi
je 0x40924c
push 1
mov ecx, ebx
call fcn.00409907
cmp dword [ebp - 0x2c], edi
je 0x40925c
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], edi
je 0x409275
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x20]
jne 0x409275
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x60]
mov ecx, esi
call fcn.00408c5b
cmp dword [esi + 0x58], edi
je 0x409291
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [esi + 0x44]
call fcn.00422d33
ret
Function at 0x40f186
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x40f1c9
call fcn.00410e84
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x40f1c9
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x40f1e4
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.0040ed3d
test ebx, ebx
mov esi, eax
je 0x40f1e2
test edi, edi
je 0x40f1e2
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x420cad
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x446650]
jne 0x420cb7
repz ret
jmp fcn.00426428

Function at 0x42a087
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x446dd8]
je 0x42a0a2
inc edi
cmp edi, 0x17
jb 0x42a093
cmp edi, 0x17
jae 0x42a222
push ebp
push 3
call fcn.00430be0
cmp eax, 1
pop ecx
je 0x42a1ee
push 3
call fcn.00430be0
test eax, eax
pop ecx
jne 0x42a0d6
cmp dword [0x4464c0], 1
je 0x42a1ee
cmp ebx, 0xfc
je 0x42a221
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x449e00
push ebp
call fcn.004232a6
add esp, 0xc
test eax, eax
je 0x42a10c
push esi
push esi
push esi
push esi
push esi
call fcn.004220bc
add esp, 0x14
push 0x104
mov esi, 0x449e19
push esi
push 0
mov byte [0x449f1d], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x42a150
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.004232a6
add esp, 0xc
test eax, eax
je 0x42a150
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.004220bc
add esp, 0x14
push esi
call fcn.00423310
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x42a195
push esi
call fcn.00423310
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x44a114
push 0x43aaec
sub ecx, eax
push ecx
push eax
call fcn.00425140
add esp, 0x14
test eax, eax
je 0x42a195
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.004220bc
add esp, 0x14
jmp 0x42a197
xor esi, esi
push 0x43aae8
push ebx
push ebp
call fcn.004234dc
add esp, 0xc
test eax, eax
je 0x42a1b7
push esi
push esi
push esi
push esi
push esi
call fcn.004220bc
add esp, 0x14
push dword [edi*8 + 0x446ddc]
push ebx
push ebp
call fcn.004234dc
add esp, 0xc
test eax, eax
je 0x42a1d9
push esi
push esi
push esi
push esi
push esi
call fcn.004220bc
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.00430a23
add esp, 0xc
jmp 0x42a221
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x42a221
cmp ebp, 0xffffffff
je 0x42a221
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x446ddc]
push dword [esi]
call fcn.00423310
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x430a23
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00426606
xor ebx, ebx
cmp dword [0x44a364], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x430af9
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x430bd9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x43bc8c
push edi
call esi
cmp eax, ebx
je 0x430bd9
push eax
call fcn.00426598
mov dword [esp], 0x43bc7c
push edi
mov dword [0x44a364], eax
call esi
push eax
call fcn.00426598
mov dword [esp], 0x43bc68
push edi
mov dword [0x44a368], eax
call esi
push eax
call fcn.00426598
mov dword [0x44a36c], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00423033
test eax, eax
pop ecx
pop ecx
je 0x430ac7
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004220bc
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x430af9
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00426598
cmp eax, ebx
pop ecx
mov dword [0x44a374], eax
je 0x430af9
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00426598
pop ecx
mov dword [0x44a370], eax
mov eax, dword [0x44a370]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x430b7e
cmp dword [0x44a374], ecx
je 0x430b7e
push eax
call fcn.0042660f
push dword [0x44a374]
mov esi, eax
call fcn.0042660f
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x430b7e
cmp edi, ebx
je 0x430b7e
call esi
cmp eax, ebx
je 0x430b4b
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x430b4b
test byte [ebp - 0x18], 1
jne 0x430b7e
lea eax, [ebp - 0x10]
push eax
call fcn.0042306a
test eax, eax
pop ecx
je 0x430b66
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004220bc
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x430b75
or dword [ebp + 0x10], 0x200000
jmp 0x430bb9
or dword [ebp + 0x10], 0x40000
jmp 0x430bb9
mov eax, dword [0x44a368]
cmp eax, dword [ebp - 8]
je 0x430bb9
push eax
call fcn.0042660f
cmp eax, ebx
pop ecx
je 0x430bb9
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x430bb9
mov eax, dword [0x44a36c]
cmp eax, dword [ebp - 8]
je 0x430bb9
push eax
call fcn.0042660f
cmp eax, ebx
pop ecx
je 0x430bb9
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44a364]
call fcn.0042660f
cmp eax, ebx
pop ecx
je 0x430bd9
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x430bdb
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43491f
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x446650]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.004348b4
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.00422f10
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x43496e
cmp dword [ebp - 0x1c], 5
jb 0x434986
jmp 0x434982
cmp dword [ebp - 0x10], 1
jne 0x434986
cmp dword [ebp - 0x1c], 4
ja 0x434982
jne 0x434986
cmp dword [ebp - 0x18], 0
jbe 0x434986
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x43c568
call fcn.00434788
test eax, eax
jge 0x4349a7
mov byte [0x44a4ac], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00420cad
add ebp, 0x78
leave
ret
Function at 0x1045230
Capabilities:
Encode data using xor

Disassembly:
invalid
xor dword [edx + 0x60335197], eax
bound edx, qword [ebx + 0x7f]
inc ebp
mov cl, 0x64
ja 0x1045214
mov ebx, 0xfe84ae6b
and dword [eax + 0x2b08f91c], 0x68487094
pop eax
pop dword [ebp - 3]
sbb dword [esi + ebx*8 + 0x7b52876c], edx
clc
mov bh, 0xab
jae 0x1045226
and esi, dword [edx + 0x4b]
add ah, dl
jecxz 0x1045279
invalid
add ebp, dword [edx - 0x46]
in eax, dx
push ss
sbb byte [edx + ecx*4 - 0x31], 0x1c
sub esp, dword [edi - 0xc6d4b87]
pop es
invalid
Function at 0x1058f60
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x1058f72
xor eax, eax
jmp 0x105910f
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
mov dword [ebp + 8], eax
cmp dword [ebp + 0x10], 8
jb 0x10590d0
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x2d3df0]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x2d3df0]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x2d3df0]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x2d3df0]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x2d3df0]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x2d3df0]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x2d3df0]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x2d3df0]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0x10]
sub eax, 8
mov dword [ebp + 0x10], eax
jmp 0x1058f7b
cmp dword [ebp + 0x10], 0
je 0x1059109
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x2d3df0]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
jne 0x10590d6
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
pop ebp
ret
Function at 0x101d2d10
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x101d2efd
pushal
mov esi, section.UPX1
lea edi, [esi - 0x129000]
push edi
or ebp, 0xffffffff
jmp 0x101d2d3a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x101d2d41
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x101d2d30
mov eax, 1
add ebx, ebx
jne 0x101d2d53
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x101d2d64
jne 0x101d2d83
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x101d2d83
dec eax
add ebx, ebx
jne 0x101d2d70
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x101d2d48
add ebx, ebx
jne 0x101d2d7f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x101d2dd5
xor ecx, ecx
sub eax, 3
jb 0x101d2d9b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x101d2e0a
sar eax, 1
mov ebp, eax
jmp 0x101d2da6
add ebx, ebx
jne 0x101d2da6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x101d2d74
inc ecx
add ebx, ebx
jne 0x101d2db4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x101d2d74
add ebx, ebx
jne 0x101d2dc1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x101d2db6
jne 0x101d2dd2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x101d2db6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x101d2df4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x101d2de6
jmp 0x101d2d36
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x101d2df4
add edi, ecx
jmp 0x101d2d36
pop esi
mov edi, esi
mov ecx, 0x53a4
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x101d2e12
cmp byte [edi], 0x1e
jne 0x101d2e12
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x101d2e17
lea edi, [esi + 0x1c8000]
mov eax, dword [edi]
or eax, eax
je 0x101d2e8f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1d3f14]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1d4018]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x101d2e44
mov ecx, edi
jns 0x101d2e73
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1d401c]
or eax, eax
je 0x101d2e89
mov dword [ebx], eax
add ebx, 4
jmp 0x101d2e61
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x101d2ec0
cmp al, 0xef
ja 0x101d2eb3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x101d2e95
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x101d2ea2
mov ebp, dword [esi + 0x1d4020]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x101d2ef4
sub esp, 0xffffff80
jmp 0x100b12e1
Function at 0x4c8340
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x86000]
push edi
jmp 0x4c835a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4c8361
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4c8350
mov eax, 1
add ebx, ebx
jne 0x4c8373
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4c8384
jne 0x4c83a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4c83a3
dec eax
add ebx, ebx
jne 0x4c8390
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4c8368
add ebx, ebx
jne 0x4c839f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4c83f5
xor ecx, ecx
sub eax, 3
jb 0x4c83bb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4c842a
sar eax, 1
mov ebp, eax
jmp 0x4c83c6
add ebx, ebx
jne 0x4c83c6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4c8394
inc ecx
add ebx, ebx
jne 0x4c83d4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4c8394
add ebx, ebx
jne 0x4c83e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4c83d6
jne 0x4c83f2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4c83d6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4c8414
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4c8406
jmp 0x4c8356
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4c8414
add edi, ecx
jmp 0x4c8356
pop esi
mov edi, esi
mov ecx, 0x3726
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4c8432
cmp byte [edi], 0x22
jne 0x4c8432
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4c8437
lea edi, [esi + 0xc4000]
mov eax, dword [edi]
or eax, eax
je 0x4c84af
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xe0b7c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xe0cd0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4c8464
mov ecx, edi
jns 0x4c8493
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xe0cd4]
or eax, eax
je 0x4c84a9
mov dword [ebx], eax
add ebx, 4
jmp 0x4c8481
call dword [esi + 0xe0ce4]
mov ebp, dword [esi + 0xe0cd8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4c84e3
sub esp, 0xffffff80
jmp 0x416781

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10952
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0xed8
call fcn.00010a1f
mov dword [0x1a050], eax
mov dword [ebp - 4], esp
push 0xc
mov eax, 0x193ce
test eax, eax
je 0x1097e
add eax, 8
push eax
push dword [0x1a050]
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
cmp dword [ebp - 4], esp
je 0x1099f
push 6
call fcn.00015358
add esp, 4
push 0x80000301
push 0
push dword [0x1a050]
push 1
mov ebx, 0x15be0
call fcn.0001536a
add esp, 0x10
mov dword [ebp - 4], eax
push dword [ebp - 4]
push 0x193e2
mov ecx, 2
call fcn.000108f6
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x109e9
push ebx
call fcn.0001535e
add esp, 4
mov dword [ebp - 0xc], esp
push 0
push dword [ebp - 8]
call sub.ntoskrnl.exe_DbgPrint
cmp dword [ebp - 0xc], esp
je 0x10a0b
push 6
call fcn.00015358
add esp, 4
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x10a1b
push ebx
call fcn.0001535e
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x13206
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x13275
push 0x80d
call fcn.000129e1
cmp dword [ebp + 8], eax
jne 0x13260
mov dword [ebp - 8], esp
push dword [ebp + 0xc]
call sub.ntoskrnl.exe_DbgPrint
add esp, 4
cmp dword [ebp - 8], esp
je 0x13253
push 6
call fcn.00015358
add esp, 4
mov dword [ebp - 4], eax
jmp 0x13275
mov ebx, dword [ebp + 0x1c]
mov dword [ebx], 0
mov eax, 0xc0000003
jmp 0x132b8
mov eax, dword [ebp + 0x18]
mov ebx, dword [ebp + 0x1c]
mov dword [ebx], eax
cmp dword [ebp + 0x18], 0
jle 0x132ae
mov dword [ebp - 8], esp
push dword [ebp + 0x18]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x14]
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
cmp dword [ebp - 8], esp
je 0x132ae
push 6
call fcn.00015358
add esp, 4
mov eax, 0
jmp 0x132b8
mov esp, ebp
pop ebp
ret 0x18
Function at 0x13d34
Capabilities:
Find process by pid

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], esp
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call sub.ntoskrnl.exe_PsLookupProcessByProcessId
cmp dword [ebp - 0x18], esp
je 0x13d81
push 6
call fcn.00015358
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x13d98
mov eax, 0xc0000003
jmp 0x13f16
mov dword [ebp - 0x18], esp
push dword [ebp - 8]
call sub.ntoskrnl.exe_ObDereferenceObject
cmp dword [ebp - 0x18], esp
je 0x13db5
push 6
call fcn.00015358
add esp, 4
call fcn.00013f1c
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jne 0x13dd3
mov dword [ebp - 0xc], 0x88
jmp 0x13dec
call fcn.00013f1c
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jne 0x13dec
mov dword [ebp - 0xc], 0xb8
fild dword [ebp - 8]
fstp qword [ebp - 0x1c]
fld qword [ebp - 0x1c]
fild dword [ebp - 0xc]
fstp qword [ebp - 0x24]
fadd qword [ebp - 0x24]
fstp qword [ebp - 0x2c]
mov dword [ebp - 0x30], esp
push 4
fld qword [ebp - 0x2c]
call fcn.00010ac7
push eax
lea eax, [ebp - 0x10]
push eax
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
cmp dword [ebp - 0x30], esp
je 0x13e30
push 6
call fcn.00015358
add esp, 4
cmp dword [ebp - 0x10], 0
jne 0x13e44
mov eax, 0xc0000003
jmp 0x13f16
fild dword [ebp - 8]
fstp qword [ebp - 0x1c]
fld qword [ebp - 0x1c]
fild dword [ebp - 0xc]
fstp qword [ebp - 0x24]
fadd qword [ebp - 0x24]
fadd qword [0x193ec]
fstp qword [ebp - 0x2c]
mov dword [ebp - 0x30], esp
push 4
fld qword [ebp - 0x2c]
call fcn.00010ac7
push eax
lea eax, [ebp - 0x14]
push eax
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
cmp dword [ebp - 0x30], esp
je 0x13e8e
push 6
call fcn.00015358
add esp, 4
cmp dword [ebp - 0x14], 0
jne 0x13ea2
mov eax, 0xc0000003
jmp 0x13f16
fild dword [ebp - 0x10]
fstp qword [ebp - 0x1c]
fld qword [ebp - 0x1c]
fadd qword [0x193ec]
fstp qword [ebp - 0x24]
mov dword [ebp - 0x28], esp
push 4
lea eax, [ebp - 0x14]
push eax
fld qword [ebp - 0x24]
call fcn.00010ac7
push eax
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
cmp dword [ebp - 0x28], esp
je 0x13ee3
push 6
call fcn.00015358
add esp, 4
mov dword [ebp - 0x18], esp
push 4
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
cmp dword [ebp - 0x18], esp
je 0x13f0c
push 6
call fcn.00015358
add esp, 4
mov eax, 0
jmp 0x13f16
mov esp, ebp
pop ebp
ret 4