joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10033746
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x10033949
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [esi], eax
xor edx, edx
mov eax, dword [0x1004cce0]
call fcn.10029a8a
mov dword [0x1004e724], eax
xor edx, edx
mov eax, dword [0x1004cce4]
call fcn.10029a8a
mov dword [0x1004e728], eax
lea eax, [ebp - 8]
mov edx, 5
call fcn.10022976
lea eax, [ebp - 8]
call fcn.100228e2
mov byte [eax], 0x72
lea eax, [ebp - 8]
call fcn.100228e2
mov byte [eax + 1], 0x64
lea eax, [ebp - 8]
call fcn.100228e2
mov byte [eax + 2], 0x65
lea eax, [ebp - 8]
call fcn.100228e2
mov byte [eax + 3], 0x63
lea eax, [ebp - 8]
call fcn.100228e2
mov byte [eax + 4], 0x20
lea edx, [ebp - 0x10]
mov eax, dword [0x1004cd54]
call fcn.10025b16
push dword [ebp - 0x10]
push 0x10033962
push dword [ebp - 8]
lea eax, [ebp - 0x14]
push eax
call sub.KERNEL32.dll_GetCurrentProcessId
mov cl, 0x30
mov edx, 1
call fcn.100256c2
push dword [ebp - 0x14]
lea eax, [ebp - 8]
mov edx, 4
call fcn.1002274a
mov eax, dword [ebp - 8]
call fcn.1002288a
push eax
push 0
push 0
call fcn.10023bb6
mov edx, dword [ebp + 8]
mov dword [edx - 4], eax
mov eax, dword [ebp + 8]
cmp dword [eax - 4], 0
je 0x10033926
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.KERNEL32.dll_WaitForSingleObject
mov dword [0x1004e718], edi
mov eax, dword [ebp - 4]
mov dword [0x1004e71c], eax
cmp dword [0x1004e724], 0
je 0x1003386f
cmp dword [0x1004e728], 0
jne 0x100338f5
mov dl, 1
mov eax, dword [0x1004cc7c]
call fcn.10029b96
mov esi, eax
cmp dword [esi], 0x4244c8b
jne 0x1003390a
lea eax, [esi + 4]
mov eax, dword [eax]
and eax, 0xffffff
cmp eax, 0x241c8b
jne 0x1003390a
lea eax, [esi + 7]
cmp byte [eax], 0x51
jne 0x1003390a
lea eax, [esi + 8]
cmp byte [eax], 0x53
jne 0x1003390a
lea eax, [esi + 9]
cmp byte [eax], 0xe8
jne 0x1003390a
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
lea eax, [esi + 0xa]
push eax
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
je 0x1003390a
lea edx, [esi + 0xe]
lea eax, [esi + 0xa]
add edx, dword [eax]
mov dword [0x1004e720], edx
mov edx, 0x100336f6
sub edx, esi
sub edx, 0xe
mov dword [eax], edx
lea edx, [ebp - 0xc]
push edx
mov edx, dword [ebp - 0xc]
push edx
push 4
push eax
call sub.KERNEL32.dll_VirtualProtect
mov bl, 1
jmp 0x1003390a
push 0x100336a2
push 0xffffffffffffffff
call dword [0x1004e724]
mov dword [esi], eax
cmp dword [esi], 0
setne bl
test bl, bl
jne 0x10033926
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.KERNEL32.dll_ReleaseMutex
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.KERNEL32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x10033950
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.1002245a
lea eax, [ebp - 8]
call fcn.10022436
ret
Function at 0x10033966
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
cmp dword [0x1004e724], 0
je 0x1003397e
cmp dword [0x1004e728], 0
jne 0x100339bf
mov dl, 1
mov eax, dword [0x1004cc7c]
call fcn.10029b96
mov ebx, eax
lea eax, [ebp - 4]
push eax
push 0x40
push 4
lea esi, [ebx + 0xa]
push esi
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
je 0x100339c6
mov eax, dword [0x1004e720]
sub eax, ebx
sub eax, 0xe
mov dword [esi], eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
push eax
push 4
push esi
call sub.KERNEL32.dll_VirtualProtect
jmp 0x100339c6
push eax
call dword [0x1004e728]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.KERNEL32.dll_ReleaseMutex
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.KERNEL32.dll_CloseHandle
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x10036546
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor eax, eax
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x10036631
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
call fcn.10031b9a
xor eax, eax
push ebp
push 0x10036614
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x14]
lea edx, [ebp - 8]
mov eax, ebx
call fcn.10025d5e
test al, al
je 0x10036601
lea ecx, [ebp - 0x10]
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.10031f9a
test al, al
je 0x10036601
cmp dword [ebp - 0xc], 0
jne 0x100365a7
cmp dword [ebp - 0x10], 0
je 0x10036601
call fcn.1002b192
lea eax, [ebp - 0x18]
push eax
push 0x40
push 8
push ebx
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
je 0x10036601
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x10]
mov ecx, 8
mov edx, ebx
call fcn.10030386
test al, al
jne 0x100365e5
mov eax, dword [ebp - 0x10]
mov dword [ebx], eax
mov eax, dword [ebp - 0xc]
mov dword [ebx + 4], eax
mov edx, 8
mov eax, ebx
call fcn.10033666
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 8
push ebx
call sub.KERNEL32.dll_VirtualProtect
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1003661b
call fcn.10031d2a
ret
Function at 0x10037d96
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x10037f00
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
lea eax, [ebp - 0x14]
mov ecx, esi
mov edx, 0x10037f16
call fcn.10022c2e
mov eax, dword [ebp - 0x14]
call fcn.10022bb2
push eax
call sub.KERNEL32.dll_CreateFileW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x10037ee8
mov eax, dword [ebx]
push eax
push 0x40
call sub.KERNEL32.dll_LocalAlloc
mov dword [ebp - 0x10], eax
mov ecx, dword [ebx]
mov edx, dword [ebp - 0x10]
mov eax, ebx
call fcn.100215f6
call sub.KERNEL32.dll_GetCurrentThreadId
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
sub edi, 0x18
dec edi
test edi, edi
jl 0x10037e3c
inc edi
xor esi, esi
mov al, byte [ebp - 0xc]
xor al, byte [ecx]
mov edx, esi
and dl, 0xff
xor al, dl
mov byte [ecx], al
inc ecx
inc esi
dec edi
jne 0x10037e29
lea ecx, [ebp - 0x28]
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
sub edx, 0x18
mov ebx, dword [ebp - 0x10]
add ebx, 0x18
mov eax, ebx
call fcn.1002f152
mov eax, dword [ebp - 0x10]
lea esi, [ebp - 0x28]
lea edi, [eax + 4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
sub edi, 0x18
dec edi
test edi, edi
jl 0x10037e9c
inc edi
xor esi, esi
mov eax, esi
mov ebx, 0x14
cdq
idiv ebx
mov eax, dword [ebp - 0x10]
mov al, byte [eax + edx + 4]
xor edx, edx
mov dl, al
shr edx, 4
xor dl, byte [ecx]
and al, 0xf
shl eax, 4
xor dl, al
mov byte [ecx], dl
inc ecx
inc esi
dec edi
jne 0x10037e74
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.dll_DeviceIoControl
cmp eax, 1
sbb ebx, ebx
inc ebx
call sub.KERNEL32.dll_GetLastError
mov esi, eax
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.dll_LocalFree
push esi
call sub.KERNEL32.dll_SetLastError
jmp 0x10037eea
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x10037f07
lea eax, [ebp - 0x14]
call fcn.10022a0a
ret
Function at 0x10037f22
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebp, edx
mov edi, eax
push esp
push 0xf003f
push 0
push ebp
push edi
call sub.ADVAPI32.dll_RegOpenKeyExW
test eax, eax
jne 0x10037f7f
xor esi, esi
push 0x208
push 0x40
call sub.KERNEL32.dll_LocalAlloc
mov ebx, eax
jmp 0x10037f5b
mov edx, ebx
mov eax, dword [esp]
call fcn.10037f22
inc esi
push 0x104
push ebx
push esi
mov eax, dword [esp + 0xc]
push eax
call sub.ADVAPI32.dll_RegEnumKeyW
test eax, eax
je 0x10037f50
push ebx
call sub.KERNEL32.dll_LocalFree
mov eax, dword [esp]
push eax
call sub.ADVAPI32.dll_RegCloseKey
push ebp
push edi
call sub.ADVAPI32.dll_RegDeleteKeyW
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x10038c76
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
xor ebx, ebx
push 0
push 0
push 3
push 0
push 1
push SysReAllocStringLen
push eax
call sub.KERNEL32.dll_CreateFileW
mov edi, eax
cmp edi, 0xffffffff
je 0x10038d1d
push 0
push 0
push 0
push 2
push 0
push edi
call sub.KERNEL32.dll_CreateFileMappingA
mov esi, eax
test esi, esi
je 0x10038d17
push 0
push 0
push 0
push 4
push esi
call sub.KERNEL32.dll_MapViewOfFile
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x10038d11
push 0
push edi
call sub.KERNEL32.dll_GetFileSize
mov ebx, eax
cmp dword [ebp - 8], 0
je 0x10038ce8
cmp ebx, dword [ebp - 8]
jbe 0x10038ce8
mov ebx, dword [ebp - 8]
lea ecx, [ebp - 0x20]
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.1002f152
mov eax, dword [ebp - 4]
push esi
push edi
lea esi, [ebp - 0x20]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov bl, 1
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.dll_UnmapViewOfFile
push esi
call sub.KERNEL32.dll_CloseHandle
push edi
call sub.KERNEL32.dll_CloseHandle
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10039d4e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov byte [ebp - 1], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x10039eb1
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
call sub.KERNEL32.dll_lstrlenW
mov edx, eax
cmp byte [ebp - 1], 0
je 0x10039d9b
mov eax, edx
sub eax, 2
cmp eax, 1
jl 0x10039d9b
cmp word [ebx + eax*2], 0x5c
jne 0x10039d96
mov word [ebx + eax*2], 0
mov edx, eax
jmp 0x10039d9b
dec eax
test eax, eax
jne 0x10039d85
test edx, edx
jle 0x10039db4
cmp word [ebx + edx*2 - 2], 0x5c
je 0x10039db4
mov word [ebx + edx*2], 0x5c
mov word [ebx + edx*2 + 2], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
cmp dword [eax], 0
jne 0x10039df2
lea ecx, [ebp - 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax]
mov dl, 1
call fcn.1002ff86
mov eax, dword [ebp - 8]
push eax
lea ecx, [ebp - 0xc]
xor edx, edx
mov eax, ebx
call fcn.1002ff86
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
pop ecx
call fcn.100226d6
jmp 0x10039e2e
lea eax, [ebp - 0x14]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx]
call fcn.1002262e
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
mov dl, 1
call fcn.1002ffda
mov eax, dword [ebp - 0x10]
push eax
lea ecx, [ebp - 0x18]
xor edx, edx
mov eax, ebx
call fcn.1002ff86
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
pop ecx
call fcn.100226d6
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax]
call fcn.1002268a
cmp eax, 6
jle 0x10039e7c
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax]
cmp byte [eax + 2], 0x3a
je 0x10039e69
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax]
cmp byte [eax], 0x5c
jne 0x10039e7c
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax]
cmp byte [eax + 2], 0x5c
jne 0x10039e7c
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax]
push eax
call sub.KERNEL32.dll_GetFileAttributesW
cmp eax, 0xffffffff
jne 0x10039e80
xor ebx, ebx
jmp 0x10039e82
mov bl, 1
test bl, bl
je 0x10039e96
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 8]
mov dword [edx], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x10039eb8
lea eax, [ebp - 0x18]
mov edx, 5
call fcn.1002245a
ret
Function at 0x10039ec2
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov bl, 1
push ebp
xor edx, edx
xor eax, eax
call fcn.10039d4e
pop ecx
test al, al
jne 0x10039f7d
push 0x104
lea eax, [ebp - 0x212]
push eax
push 0
call sub.KERNEL32.dll_GetModuleFileNameW
push ebp
lea eax, [ebp - 0x212]
mov dl, 1
call fcn.10039d4e
pop ecx
test al, al
jne 0x10039f7d
push 0x104
lea eax, [ebp - 0x212]
push eax
mov eax, dword [0x1004e658]
push eax
call sub.KERNEL32.dll_GetModuleFileNameW
push ebp
lea eax, [ebp - 0x212]
mov dl, 1
call fcn.10039d4e
pop ecx
test al, al
jne 0x10039f7d
lea eax, [ebp - 0x212]
push eax
push 0x104
call sub.KERNEL32.dll_GetCurrentDirectoryW
push ebp
lea eax, [ebp - 0x212]
xor edx, edx
call fcn.10039d4e
pop ecx
test al, al
jne 0x10039f7d
push 0x104
lea eax, [ebp - 0x212]
push eax
call sub.KERNEL32.dll_GetSystemDirectoryW
push ebp
lea eax, [ebp - 0x212]
xor edx, edx
call fcn.10039d4e
pop ecx
mov ebx, eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1003aa56
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
cmp dword [eax], 0
je 0x1003aaed
push 2
lea ecx, [ebp - 2]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
mov edx, dword [edx]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.1003a9a2
test al, al
je 0x1003aaed
cmp word [ebp - 2], 0x5a4d
jne 0x1003aaed
push 4
lea ecx, [ebp - 8]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
mov edx, dword [edx]
add edx, 0x3c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.1003a9a2
test al, al
je 0x1003aaed
push 0xf8
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0xc]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
mov edx, dword [edx]
add edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.1003a9a2
test al, al
je 0x1003aaed
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
cmp dword [eax], 0x4550
jne 0x1003aaed
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
test byte [eax + 0x17], 0x20
je 0x1003aaf1
xor eax, eax
jmp 0x1003aaf3
mov al, 1
test al, al
je 0x1003ab10
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx]
movzx ecx, word [ebp - 2]
add edx, ecx
add edx, 0x78
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 8]
mov dword [ecx], edx
pop ecx
pop ecx
pop ebp
ret
Function at 0x1003b1ba
Capabilities:
Get number of processors

Disassembly:
mov eax, dword gs:[0x60]
mov edx, dword gs:[0x64]
ret
Function at 0x1003cd8a
Capabilities:
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, ecx
push 0
mov edx, dword [ebp - 0x10]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 1
push 0
push 1
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
call fcn.1003b9de
mov ebx, eax
test bl, bl
je 0x1003cde4
test esi, 4
jne 0x1003cdef
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.dll_ResumeThread
jmp 0x1003cdef
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.dll_TerminateProcess
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1003f62a
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
push ebx
xor eax, eax
mov dword [ebp - 0x154], eax
xor eax, eax
push ebp
push 0x1003f6d6
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
lea eax, [ebp - 0x154]
mov edx, dword [ebp + 8]
mov edx, dword [edx + 8]
call fcn.1002262e
mov eax, dword [ebp - 0x154]
lea edx, [ebp - 0x150]
xor ecx, ecx
call fcn.1003d8ae
mov ebx, eax
test bl, bl
je 0x1003f6bd
mov eax, dword [ebp - 0x144]
push eax
call sub.KERNEL32.dll_CloseHandle
push 0x64
mov eax, dword [ebp - 0x12c]
push eax
call sub.KERNEL32.dll_WaitForSingleObject
cmp eax, 0x102
jne 0x1003f6a5
push 0
mov eax, dword [ebp - 0x12c]
push eax
call sub.KERNEL32.dll_TerminateThread
mov eax, dword [ebp - 0x148]
push eax
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebp - 0x12c]
push eax
call sub.KERNEL32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1003f6dd
lea eax, [ebp - 0x154]
call fcn.10022436
ret
Function at 0x1003f962
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x1003fb4c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x1004dd0c], 0
jne 0x1003fb31
lea eax, [ebp - 4]
push eax
push 0x28
call sub.KERNEL32.dll_GetCurrentProcess
push eax
call sub.ADVAPI32.dll_OpenProcessToken
test eax, eax
je 0x1003fb2a
xor eax, eax
push ebp
push 0x1003fb23
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 3
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.dll_GetTokenInformation
cmp dword [ebp - 8], 0
je 0x1003fb0c
mov eax, dword [ebp - 8]
add eax, eax
push eax
push 0x40
call sub.KERNEL32.dll_LocalAlloc
mov ebx, eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
add eax, eax
push eax
push ebx
push 3
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.dll_GetTokenInformation
test eax, eax
je 0x1003fb06
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x24]
mov eax, dword [0x1004cd40]
call fcn.10025b16
mov eax, dword [ebp - 0x24]
call fcn.1002288a
push eax
push 0
call sub.ADVAPI32.dll_LookupPrivilegeValueA
test eax, eax
jne 0x1003fa3a
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x28]
mov eax, dword [0x1004cd44]
call fcn.10025b16
mov eax, dword [ebp - 0x28]
call fcn.1002288a
push eax
push 0
call sub.ADVAPI32.dll_LookupPrivilegeValueA
test eax, eax
jne 0x1003fa6d
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x20]
push eax
lea edx, [ebp - 0x2c]
mov eax, dword [0x1004cd48]
call fcn.10025b16
mov eax, dword [ebp - 0x2c]
call fcn.1002288a
push eax
push 0
call sub.ADVAPI32.dll_LookupPrivilegeValueA
test eax, eax
jne 0x1003faa0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov esi, dword [ebx]
dec esi
test esi, esi
jl 0x1003faf2
inc esi
xor ecx, ecx
lea edi, [ecx + ecx*2]
mov eax, dword [ebx + edi*4 + 4]
mov edx, dword [ebx + edi*4 + 8]
cmp edx, dword [ebp - 0xc]
jne 0x1003fabd
cmp eax, dword [ebp - 0x10]
je 0x1003faee
lea eax, [ecx + ecx*2]
mov edx, dword [ebx + eax*4 + 8]
mov eax, dword [ebx + eax*4 + 4]
cmp edx, dword [ebp - 0x14]
jne 0x1003fad2
cmp eax, dword [ebp - 0x18]
je 0x1003faee
lea eax, [ecx + ecx*2]
mov edx, dword [ebx + eax*4 + 8]
mov eax, dword [ebx + eax*4 + 4]
cmp edx, dword [ebp - 0x1c]
jne 0x1003fae7
cmp eax, dword [ebp - 0x20]
je 0x1003faee
or dword [ebx + edi*4 + 0xc], 2
inc ecx
dec esi
jne 0x1003faaa
push 0
push 0
mov eax, dword [ebp - 8]
push eax
push ebx
push 0
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.dll_AdjustTokenPrivileges
push ebx
call sub.KERNEL32.dll_LocalFree
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1003fb2a
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.dll_CloseHandle
ret
mov byte [0x1004dd0c], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1003fb53
lea eax, [ebp - 0x2c]
mov edx, 3
call fcn.1002245a
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x904058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.009041a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x90407e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x90406a
add dl, dl
jne 0x904089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9040dc
xor eax, eax
add dl, dl
jne 0x904096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x90417d
add dl, dl
jne 0x9040a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9040b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9040bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9040c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x9040d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x904075
mov eax, 1
add dl, dl
jne 0x9040ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9040f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9040e1
sub eax, ebx
mov ebx, 1
jne 0x904128
mov ecx, 1
add dl, dl
jne 0x90410e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x904119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x904105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x904075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x90413f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x90414a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x904136
cmp eax, 0x7d00
jae 0x90416d
cmp eax, 0x500
jb 0x904168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x904075
cmp eax, 0x7f
ja 0x904170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x904075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x90419e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x904075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10