joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401240
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push esi
cmovae eax, dword [ebp + 8]
mov esi, ecx
push edi
push eax
push 0x200
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test eax, eax
je 0x4012b6
push 0x200
push 0
push 0
push 0xf001f
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
je 0x4012b6
mov ecx, edi
sub ecx, esi
nop dword [eax]
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x401290
push 0x42c7ec
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, 1
jmp 0x4012b8
xor esi, esi
mov edx, dword [ebp + 0x1c]
cmp edx, 8
jb 0x4012ee
mov ecx, dword [ebp + 8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4012e4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4012f4
push edx
push ecx
call fcn.00409072
add esp, 8
pop edi
mov eax, esi
pop esi
pop ebp
ret
call fcn.0040d4ef
int3

Function at 0x4013b0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x434
mov eax, dword [0x430050]
xor eax, esp
mov dword [esp + 0x430], eax
push ebx
push esi
push edi
push ecx
push 0x18
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x401428
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x428
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x401428
mov edi, dword [sym.imp.KERNEL32.dll_Module32NextW]
nop dword [eax]
lea eax, [esp + 0x30]
push str.WeChatWin.dll
push eax
call fcn.0040d64f
add esp, 8
test eax, eax
je 0x401424
lea eax, [esp + 0x10]
push eax
push esi
call edi
test eax, eax
jne 0x401400
jmp 0x401428
mov ebx, dword [esp + 0x24]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x43c]
mov eax, ebx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00409064
mov esp, ebp
pop ebp
ret
Function at 0x4041a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x404286
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x404275
jg 0x4041e0
test edx, edx
je 0x404275
nop dword [eax]
call fcn.00405910
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x404234
jg 0x4041f7
test esi, esi
je 0x404234
cmp ebx, eax
jg 0x404207
jl 0x404201
cmp edi, esi
jae 0x404207
mov esi, edi
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
push esi
push eax
mov eax, dword [ecx + 0x20]
push dword [eax]
call fcn.0040a710
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x404259
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov edx, dword [ecx]
movzx eax, byte [eax]
push eax
call dword [edx + 0xc]
cmp eax, 0xffffffff
je 0x40426f
mov ecx, dword [esp + 0xc]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [esp + 0x10], esi
test ebx, ebx
jg 0x4041e0
jl 0x40426f
test edi, edi
jne 0x4041e0
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x4042a8
mov eax, dword [ecx + 0x30]
mov eax, dword [eax]
jmp 0x4042aa
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x14], eax
test edi, edi
jl 0x404328
jg 0x4042bd
test esi, esi
je 0x404328
test eax, eax
jl 0x40430c
jg 0x4042c7
test ebx, ebx
je 0x40430c
cmp edi, eax
jg 0x4042d7
jl 0x4042d1
cmp esi, ebx
jae 0x4042d7
mov ebx, esi
mov dword [esp + 0x14], edi
push ebx
push dword [ebp + 8]
push dword [esp + 0x18]
call fcn.0040a710
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
sub esi, ebx
sbb edi, dword [esp + 0x14]
add edx, ebx
mov eax, dword [ecx + 0x30]
sub dword [eax], ebx
mov eax, dword [ecx + 0x20]
add dword [eax], ebx
test edi, edi
jl 0x404328
jg 0x40430f
test esi, esi
je 0x404328
jmp 0x40430f
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x404328
push eax
push esi
push 1
push edx
call fcn.0040e1fe
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x404340
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x404372
jl 0x404365
test ecx, ecx
jne 0x404372
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x404432
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov ecx, ebx
call fcn.00405930
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x4043de
jg 0x40439d
test esi, esi
je 0x4043de
mov ecx, dword [esp + 0xc]
cmp ecx, eax
jg 0x4043b5
mov eax, dword [esp + 0x10]
jl 0x4043af
cmp eax, esi
jae 0x4043b5
mov esi, eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.0040a710
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
sub ecx, esi
sbb edx, dword [esp + 0x14]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x4043ff
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x40441b
mov ecx, dword [esp + 0x10]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
test edx, edx
jg 0x404384
jl 0x40441b
test ecx, ecx
jne 0x404384
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0x10]
mov ecx, dword [ebp + 0x10]
sbb ecx, edx
mov edx, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x404471
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
test eax, eax
je 0x404471
mov edi, dword [esp + 0xc]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push edi
call fcn.0040a710
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [esp + 0x18], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
cmp dword [ebx + 0x4c], 0
mov ecx, edi
je 0x4044e0
mov esi, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [esi], eax
jne 0x404497
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [esi], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
mov ecx, edi
cmp edi, 0xfff
jbe 0x4044c9
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.0040e867
sub edi, eax
add esp, 0x10
add esi, eax
mov ecx, edi
cmp eax, 0xfff
jne 0x4044f4
cmp edi, eax
ja 0x4044a5
test ecx, ecx
je 0x4044e0
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.0040e867
mov ecx, edi
add esp, 0x10
sub ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, ecx
sbb edx, 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x404860
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x430050]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x404890
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409064
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x4048cc
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x4048cc
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409064
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x4049b4
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x4048f4
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x404927
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.0040d7bc
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409064
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
sub eax, 0
je 0x404987
sub eax, 1
je 0x404987
sub eax, 2
jne 0x4049b4
push dword [esi + 0x4c]
movsx eax, byte [ebp - 0x25]
push eax
call fcn.0040d7bc
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409064
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x4049a4
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0040e1fe
add esp, 0x10
cmp edi, eax
jne 0x4049b4
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x4048b7
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409064
mov esp, ebp
pop ebp
ret 4
Function at 0x405730
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x430050]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x4057ea
cmp byte [esi + 0x3d], 0
je 0x4057ea
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x4057d8
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x4057a0
sub eax, 1
je 0x4057a4
sub eax, 2
jne 0x4057d8
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409064
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x4057c1
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0040e1fe
add esp, 0x10
cmp edi, eax
jne 0x4057d8
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409064
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409064
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.00409064
mov esp, ebp
pop ebp
ret

Function at 0x405af0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x421120
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x430050]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00409085
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.004086d9
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406ed0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, ecx
mov eax, 0x1fffffff
bsr ecx, eax
push esi
mov esi, 1
mov dword [ebp - 0x18], ebx
mov eax, esi
shl eax, cl
mov ecx, dword [ebp + 8]
push edi
cmp ecx, eax
ja 0x407060
lea eax, [ecx - 1]
or eax, esi
bsr ecx, eax
mov eax, dword [ebx + 4]
push eax
mov dword [ebp - 0xc], eax
lea ecx, [ecx + 1]
shl esi, cl
lea ecx, [ebx + 0xc]
lea eax, [esi + esi]
push eax
call fcn.00405bc0
mov edi, dword [ebx + 4]
lea eax, [esi - 1]
mov ecx, dword [ebp - 0xc]
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], esi
mov edi, dword [edi]
mov eax, edi
cmp edi, ecx
je 0x407038
cmp dword [edi + 0x1c], 0x10
lea ebx, [edi + 8]
mov eax, dword [eax]
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], ebx
jb 0x406f4b
mov edx, dword [ebx]
mov dword [ebp - 0x10], edx
mov esi, dword [ebx + 0x10]
xor edx, edx
mov dword [ebp - 4], 0x811c9dc5
mov dword [ebp - 0x14], esi
test esi, esi
je 0x406f83
mov ecx, dword [ebp - 4]
mov eax, esi
mov ebx, dword [ebp - 0x10]
movzx esi, byte [edx + ebx]
inc edx
xor esi, ecx
imul ecx, esi, 0x1000193
cmp edx, eax
jb 0x406f66
mov eax, dword [ebp - 8]
lea ebx, [edi + 8]
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x18]
mov esi, dword [edx + 0x18]
and esi, dword [ebp - 4]
mov edx, dword [edx + 0xc]
lea edx, [edx + esi*8]
mov esi, dword [edx]
mov dword [ebp - 4], edx
mov dword [ebp - 0x10], esi
cmp esi, ecx
jne 0x406fa8
mov dword [edx], edi
mov dword [edx + 4], edi
jmp 0x40702e
mov esi, dword [edx + 4]
lea eax, [esi + 8]
push eax
push ebx
call fcn.00407390
test al, al
jne 0x406fe2
mov ebx, dword [esi]
mov eax, dword [ebp - 8]
cmp ebx, edi
je 0x406fda
mov esi, dword [edi + 4]
mov dword [esi], eax
mov edx, dword [eax + 4]
mov dword [edx], ebx
mov ecx, dword [ebx + 4]
mov dword [ecx], edi
mov dword [ebx + 4], edx
mov dword [eax + 4], esi
mov dword [edi + 4], ecx
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], edi
jmp 0x40702b
mov ebx, esi
cmp dword [ebp - 0x10], esi
je 0x40700b
nop dword [eax]
mov esi, dword [esi + 4]
mov ebx, esi
lea eax, [ebx + 8]
push eax
lea eax, [edi + 8]
push eax
call fcn.00407390
test al, al
je 0x407041
cmp dword [ebp - 0x10], esi
jne 0x406ff0
mov esi, dword [edi + 4]
mov eax, dword [ebp - 8]
mov dword [esi], eax
mov edx, dword [eax + 4]
mov dword [edx], ebx
mov ecx, dword [ebx + 4]
mov dword [ecx], edi
mov dword [ebx + 4], edx
mov dword [eax + 4], esi
mov dword [edi + 4], ecx
mov ecx, dword [ebp - 4]
mov dword [ecx], edi
mov ecx, dword [ebp - 0xc]
mov edi, eax
cmp eax, ecx
jne 0x406f35
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [esi]
mov esi, dword [edi + 4]
mov eax, dword [ebp - 8]
mov dword [esi], eax
mov edx, dword [eax + 4]
mov dword [edx], ebx
mov ecx, dword [ebx + 4]
mov dword [ecx], edi
mov dword [ebx + 4], edx
mov dword [eax + 4], esi
mov dword [edi + 4], ecx
jmp 0x40702b
push str.invalid_hash_bucket_count
call fcn.004083b2
int3
Function at 0x407bf0
Capabilities:
Acquire debug privileges
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x430050]
xor eax, esp
mov dword [esp + 0x1c], eax
lea eax, [esp]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x407c35
push 0x42cb98
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00409064
mov esp, ebp
pop ebp
ret
lea eax, [esp + 4]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x407c52
push str.LookupPrivilegeValue
jmp 0x407c92
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
push 0
push 0
push 0x10
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
push eax
push 0
push dword [esp + 0x14]
mov dword [esp + 0x24], 1
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x407ca1
push 0x42cbe8
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push dword [esp]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00409064
mov esp, ebp
pop ebp
ret

Function at 0x414a7c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004148f2

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4039c1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x4039d0
pop dword [ebp - 0x50]
mov eax, 0x4039d0
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0xb41aebd7
sub dword [ebp - 0x60], 0x65c8a68c
mov dword [ebp - 0x5c], 0x8826855
sub dword [ebp - 0x5c], 0xd64f1c10
mov dword [ebp - 0x58], 0x776abcd
sub dword [ebp - 0x58], 0xbb2a679f
mov dword [ebp - 0x54], 0xb8c352e3
sub dword [ebp - 0x54], 0xb8c352e3
lea eax, [ebp - 0x60]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xb3f83e97
add dword [ebp - 0x60], 0xc07a2abf
mov dword [ebp - 0x5c], 0x8805bf65
add dword [ebp - 0x5c], 0xb966a210
mov dword [ebp - 0x58], 0x69d0dbe9
add dword [ebp - 0x58], 0xf99e9083
mov dword [ebp - 0x54], 0xa117d98a
add dword [ebp - 0x54], 0x5ee82676
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0x3b69abee
sub eax, 0x3b296b66
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x39db4
push 0
call eax
mov ecx, 0x4bd45bc4
add ecx, 0xb42bf8d0
mov esi, eax
mov edi, 0xa5e39b90
add edi, 0x5a5cec70
add edi, dword [ebp - 0x50]
mov ebx, 0xbdfbb7a0
add ebx, 0xa0ab4068
add dword [ebp - 0x38], 0xabcbf67d
mov edx, dword [edi]
xor dword [ebp - 0x18], edx
add edx, ebx
add dword [ebp - 0x3c], ecx
mov dword [esi], edx
sub dword [ebp - 0x34], ebx
add esi, 0xddce95c2
add esi, 0x22316a42
add edi, 0xcce934cb
add edi, 0x3316cb39
loop 0x403ae8
add eax, 0x14523
mov ebx, eax
add eax, 0xd5734599
add eax, 0x2a8cba6c
mov ecx, 0x4f333887
sub ecx, 0x4ef33887
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4012e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4235f9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x1c]
push edi
xor edi, edi
mov ecx, esi
mov dword [esp + 8], edi
call dword [0x42522c]
push eax
lea ecx, [esp + 0xc]
call dword [0x425228]
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x24]
push edi
call dword [0x425224]
add esp, 4
push eax
push edi
mov ecx, esi
call dword [0x425220]
push eax
mov ecx, esi
call dword [0x42521c]
push eax
lea eax, [esp + 0x18]
push eax
call dword [0x425218]
mov esi, dword [esp + 0x30]
add esp, 0x14
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call dword [0x425214]
lea ecx, [esp + 8]
call dword [0x425210]
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x404550
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x274
push ebx
push esi
push edi
mov esi, ecx
xor eax, eax
xor ebx, ebx
mov byte [esp + 0x10], bl
mov ecx, 0x40
lea edi, [esp + 0x11]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [esp + 0x14]
push eax
push ebx
call dword [0x4251c4]
test eax, eax
je 0x4045c5
push str._service
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x120]
push str.__s___s
push edx
call dword [0x4253f4]
add esp, 0x10
lea eax, [esp + 0xc]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionRunServices
push reloc.OLEAUT32.dll_SysReAllocString
call dword [0x425068]
test eax, eax
je 0x4045ce
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x118]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4045d8
sub eax, edx
mov edx, dword [esi + 4]
push eax
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x11c]
push ecx
push 1
push ebx
push edx
push eax
call dword [0x42506c]
test eax, eax
jne 0x404605
mov ebx, 1
mov ecx, dword [esp + 0xc]
push ecx
call dword [0x42503c]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret