joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43362d
Capabilities:
Hide graphical window

Disassembly:
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 8]
push esi
or ecx, 0x50000000
push edi
mov edi, dword [esp + 0xc]
test eax, 0x80000
je 0x43364d
and eax, 0xfff7ffff
mov edx, dword [0x4a842c]
push 0
push edx
mov edx, dword [esp + 0x38]
push edx
mov edx, dword [edi]
push edx
mov edx, dword [esp + 0x3c]
push edx
mov edx, dword [esp + 0x3c]
push edx
mov edx, dword [esp + 0x3c]
push edx
mov edx, dword [esp + 0x3c]
push edx
mov edx, dword [esp + 0x34]
push ecx
mov ecx, dword [esp + 0x3c]
push ecx
push edx
push eax
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, eax
test esi, esi
je 0x4336c0
cmp byte [esp + 0x34], 0
je 0x4336a5
push 0
push 0x11
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
push 0x30
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [edi + 0x180], 0
jl 0x4336c0
cmp byte [edi + 0x18c], 0
je 0x4336c0
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
mov eax, esi
pop esi
ret 0x2c

Function at 0x433fa6
Capabilities:
Create process on windows

Disassembly:
push 0x44
push 0
push 0x4a9300
call fcn.004131f0
push 0x10
push 0
push 0x4a92ec
call fcn.004131f0
mov ecx, dword [esp + 0x1c]
add esp, 0x18
push 0x4a92ec
push 0x4a9300
push 0
push 0
push 0x20
push 0
push 0
push 0
push ecx
mov eax, 1
push 0
mov dword [0x4a9300], 0x44
mov dword [0x4a932c], 1
mov word [0x4a9330], ax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x434019
mov edx, dword [0x4a92ec]
mov dword [esp + 4], edx
jmp dword [sym.imp.KERNEL32.dll_CloseHandle]
ret 4
Function at 0x4366be
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x20c
push 0x104
push eax
lea ecx, [esp + 8]
push ecx
call fcn.00436328
lea edx, [esp + 0xc]
push edx
call fcn.004112d5
add esp, 0x10
test eax, eax
je 0x4366fa
cmp word [esp + eax*2 - 2], 0x5c
lea eax, [esp + eax*2 - 2]
jne 0x4366fa
xor ecx, ecx
mov word [eax], cx
push ebp
lea edx, [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4367a3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, 2
jne 0x436737
push 0
lea eax, [esp + 8]
push eax
call ebp
test eax, eax
je 0x43673c
mov al, 1
pop ebp
add esp, 0x20c
ret
cmp eax, 3
jne 0x4367a7
push esi
push edi
lea edi, [esp + 0xc]
call fcn.0040fff0
mov esi, eax
push 0x5c
push esi
call 0x414277
add esp, 8
test eax, eax
jne 0x43676d
push esi
call fcn.004112ef
add esp, 4
pop edi
pop esi
xor al, al
pop ebp
add esp, 0x20c
ret
push ebx
xor ecx, ecx
push esi
mov word [eax], cx
call fcn.004366be
push esi
mov bl, al
call fcn.004112ef
add esp, 8
test bl, bl
je 0x436796
push 0
lea edx, [esp + 0x14]
push edx
call ebp
test eax, eax
setne bl
mov al, bl
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x20c
ret
test al, 0x10
jne 0x43672d
xor al, al
pop ebp
add esp, 0x20c
ret

Function at 0x436ac4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x436adb
test al, 0x10
je 0x436adb
mov al, 1
ret
xor al, al
ret

Function at 0x436ade
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x254
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x436b1d
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x436b12
or eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 8]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x442a81
Capabilities:
Query remote server for available data
Read data from internet
Receive data

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
push edi
push 0
push 0
lea eax, [esp + 0x1c]
push eax
push ebx
mov dword [esp + 0x20], 1
mov dword [esp + 0x24], 1
call dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
cmp dword [esp + 0x14], 0
jne 0x4428d7
mov dword [esp + 0x14], 0x400
cmp dword [esp + 0x10], 0
je 0x442930
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00434b0b
add esp, 4
mov edi, eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x10]
push edx
push eax
push edi
push ebx
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x44295e
mov eax, dword [esp + 0x10]
test eax, eax
je 0x442927
push eax
push edi
lea ecx, [esi + 0x44]
push ecx
call fcn.00434a9d
mov eax, dword [esp + 0x10]
add dword [esi + 8], eax
adc dword [esi + 0xc], 0
test eax, eax
jne 0x4428de
jmp 0x442930
push edi
call fcn.004112ef
add esp, 4
mov edx, dword [esi + 8]
or edx, dword [esi + 0xc]
jne 0x44294c
push edx
push 0xdeadbeef
push 0x21
push esi
call fcn.0044286a
pop edi
pop esi
pop ebx
ret 8
push 1
push 0
push 0
push esi
call fcn.0044286a
pop edi
pop esi
pop ebx
ret 8
push edi
call fcn.004112ef
add esp, 4
push 0
push 0xdeadbeef
push 0x20
push esi
call fcn.0044286a
pop edi
pop esi
pop ebx
ret 8
sub esp, 0x40c
push ebx
push esi
mov esi, dword [esp + 0x418]
mov eax, dword [esi + 0x34]
push edi
push 0x4876fc
push eax
mov dword [esp + 0x1c], fcn.00414e94
call fcn.00414e06
mov edi, eax
add esp, 8
mov dword [esp + 0x10], edi
test edi, edi
jne 0x4429d7
push eax
push 0xdeadbeef
push 0x1f
push esi
call fcn.0044286a
mov bl, al
lea eax, [esp + 0x10]
push eax
call fcn.004349b3
pop edi
pop esi
mov al, bl
pop ebx
add esp, 0x40c
ret 8
mov dword [esp + 0xc], 1
mov eax, dword [esp + 0x420]
lea ecx, [esp + 0xc]
push ecx
push 0x400
lea edx, [esp + 0x20]
push edx
push eax
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x442a58
mov eax, dword [esp + 0xc]
test eax, eax
je 0x442a28
push edi
push 1
push eax
lea ecx, [esp + 0x24]
push ecx
call fcn.004146ce
mov eax, dword [esp + 0x1c]
add esp, 0x10
add dword [esi + 8], eax
adc dword [esi + 0xc], 0
test eax, eax
jne 0x4429df
mov eax, dword [esi + 8]
or eax, dword [esi + 0xc]
jne 0x442a6e
push eax
push 0xdeadbeef
push 0x21
push esi
call fcn.0044286a
lea ecx, [esp + 0x10]
push ecx
mov bl, al
call fcn.004349b3
pop edi
pop esi
mov al, bl
pop ebx
add esp, 0x40c
ret 8
push 0
push 0xdeadbeef
push 0x20
push esi
call fcn.0044286a
lea edx, [esp + 0x10]
push edx
jmp 0x442a43
push 1
push 0
push 0
push esi
call fcn.0044286a
lea edx, [esp + 0x10]
push edx
jmp 0x442a43
mov eax, dword [esp + 4]
cmp byte [eax + 0x30], 0
mov ecx, dword [esp + 8]
je 0x442a9c
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
jmp 0x44289d
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
jmp 0x44297c
Function at 0x444343
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call fcn.00444326
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push 0
lea eax, [esp + 0xc]
push eax
mov eax, dword [esi]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
add dword [esi + 0x10], eax
adc dword [esi + 0x14], 0
pop esi
ret 0xc

Function at 0x44496c
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x100
push esi
mov esi, dword [esp + 0x108]
push edi
mov edi, dword [esp + 0x110]
cmp byte [edi], 0
jne 0x4449a3
cmp byte [edi + 1], 0
jne 0x4449a3
cmp byte [edi + 2], 0
jne 0x4449a3
cmp byte [edi + 3], 0
jne 0x4449a3
cmp byte [edi + 4], 0
je 0x444b5a
mov eax, dword [esi + 0x20]
push ebx
test eax, eax
je 0x444ae5
push eax
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x444ae5
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
cmp byte [edi], 0
mov al, 0x80
je 0x4449db
xor byte [esp + 0x1c], al
xor byte [esp + 0xac], al
cmp byte [edi + 1], 0
je 0x4449ec
xor byte [esp + 0x1c], al
xor byte [esp + 0xad], al
cmp byte [edi + 2], 0
je 0x4449f6
xor byte [esp + 0x1d], al
cmp byte [edi + 3], 0
je 0x444a00
xor byte [esp + 0x1e], al
cmp byte [edi + 4], 0
je 0x444a0a
xor byte [esp + 0x67], al
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.USER32.dll_SetKeyboardState]
cmp byte [edi], 0
mov ebx, dword [sym.imp.USER32.dll_PostMessageW]
jne 0x444a26
cmp byte [edi + 1], 0
je 0x444a41
movzx edx, byte [esi + 0x26]
mov eax, dword [esi + 0x20]
shl edx, 0x10
or edx, 0xc0000001
push edx
push 0x10
push 0x101
push eax
call ebx
cmp byte [edi + 2], 0
je 0x444a62
movzx ecx, byte [esi + 0x24]
mov edx, dword [esi + 0x20]
shl ecx, 0x10
or ecx, 0xc0000001
push ecx
push 0x11
push 0x101
push edx
call ebx
mov al, byte [edi + 3]
test al, al
je 0x444aae
cmp byte [edi + 2], 0
jne 0x444a8f
cmp byte [esi + 0x1c], 0
jne 0x444a8f
movzx eax, byte [esi + 0x25]
mov ecx, dword [esi + 0x20]
shl eax, 0x10
or eax, 0xe0000001
push eax
push 0x12
push 0x105
push ecx
jmp 0x444aac
test al, al
je 0x444aae
movzx edx, byte [esi + 0x25]
mov eax, dword [esi + 0x20]
shl edx, 0x10
or edx, 0xc0000001
push edx
push 0x12
push 0x101
push eax
call ebx
cmp byte [edi + 4], 0
je 0x444b53
movzx ecx, byte [esi + 0x29]
mov edx, dword [esi + 0x20]
shl ecx, 0x10
or ecx, 0xc0000001
push ecx
push 0x5b
push 0x101
push edx
call ebx
push esi
call fcn.00437953
pop ebx
pop edi
pop esi
add esp, 0x100
ret 8
cmp byte [edi], 0
je 0x444afc
movzx eax, byte [esi + 0x27]
push 2
push eax
push 0xa0
push esi
call fcn.004378b5
cmp byte [edi + 1], 0
je 0x444b14
movzx ecx, byte [esi + 0x28]
push 2
push ecx
push 0xa1
push esi
call fcn.004378b5
cmp byte [edi + 2], 0
je 0x444b29
movzx edx, byte [esi + 0x24]
push 2
push edx
push 0x11
push esi
call fcn.004378b5
cmp byte [edi + 3], 0
je 0x444b3e
movzx eax, byte [esi + 0x25]
push 2
push eax
push 0x12
push esi
call fcn.004378b5
cmp byte [edi + 4], 0
je 0x444b53
movzx ecx, byte [esi + 0x29]
push 2
push ecx
push 0x5b
push esi
call fcn.004378b5
push esi
call fcn.00437953
pop ebx
pop edi
pop esi
add esp, 0x100
ret 8
Function at 0x44b7a4
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x20]
test eax, eax
je 0x44b7b6
push eax
call fcn.0044b64f
mov eax, dword [esi + 0x24]
pop esi
test eax, eax
je 0x44b7c7
mov dword [esp + 4], eax
jmp fcn.0044b64f
ret 4

Function at 0x44c379
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x124
push ebx
push ebp
mov ebp, dword [esp + 0x130]
cmp dword [ebp + 0x20], 0
push esi
push edi
mov edi, dword [esp + 0x13c]
mov bl, byte [edi]
mov al, byte [edi + 7]
movzx esi, word [edi + 8]
mov byte [esp + 0x10], bl
mov byte [esp + 0x14], al
je 0x44c47e
cmp bl, 0x14
je 0x44c47e
cmp bl, 0x90
je 0x44c47e
cmp bl, 0x91
je 0x44c47e
push edi
call fcn.00437a22
test al, al
je 0x44c50f
lea ecx, [esp + 0x34]
push ecx
call dword [sym.imp.USER32.dll_GetKeyboardState]
movzx ebx, bl
xor byte [esp + ebx + 0x34], 0x80
lea edx, [esp + 0x34]
push edx
call dword [sym.imp.USER32.dll_SetKeyboardState]
movzx esi, byte [esp + 0x14]
shl esi, 0x10
push edi
or esi, 0xc0000001
call fcn.00444ef7
cmp al, 1
jne 0x44c411
or esi, 0x1000000
cmp byte [ebp + 0x17], 0
jne 0x44c424
cmp byte [ebp + 0x1d], 0
jne 0x44c424
cmp byte [esp + 0x10], 0x12
jne 0x44c45a
cmp byte [ebp + 0x16], 0
jne 0x44c45a
cmp byte [ebp + 0x1c], 0
jne 0x44c45a
mov eax, dword [ebp + 0x20]
or esi, 0x20000000
push esi
push ebx
push 0x105
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
push ebp
call fcn.00437953
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x124
ret 8
mov ecx, dword [ebp + 0x20]
push esi
push ebx
push 0x101
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
push ebp
call fcn.00437953
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x124
ret 8
push edi
call fcn.00437a22
test al, al
je 0x44c4dc
push edi
call fcn.00444ef7
cmp al, 1
jne 0x44c4b7
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push 3
push edx
push eax
push ebp
call fcn.004378b5
push ebp
call fcn.00437953
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x124
ret 8
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push 2
push ecx
push edx
push ebp
call fcn.004378b5
push ebp
call fcn.00437953
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x124
ret 8
push 0x1c
lea ecx, [esp + 0x1c]
xor eax, eax
push ecx
push 1
mov dword [esp + 0x24], 1
mov word [esp + 0x28], ax
mov word [esp + 0x2a], si
mov dword [esp + 0x2c], 6
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
call dword [sym.imp.USER32.dll_SendInput]
push ebp
call fcn.00437953
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x124
ret 8
Function at 0x408dd0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x408e09
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.00404dd4
jmp 0x408e12
mov eax, ebx
mov edx, esi
call fcn.00404c98
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x408e1c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x408e3e
movzx eax, word [esp]
jmp 0x408e40
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4095c8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x4096ed
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.004093dc
mov esi, eax
mov eax, dword [0x412c38]
cmp byte [eax], 0
je 0x409695
mov eax, dword [0x412b74]
call fcn.0040317c
call fcn.00402f6c
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x4095a4]
call fcn.00405ad8
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x409708
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x4096d1
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x412b54]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x415b48]
call fcn.00405b90
push eax
call sub.user32.dll_LoadStringW_1
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4096f4
lea eax, [ebp - 4]
mov edx, dword [0x4095a4]
call fcn.00405ae4
ret
Function at 0x40e058
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.0040e00c
test al, al
jne 0x40e079
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x40e0c5
xor eax, eax
push ebp
push 0x40e0b5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00404d24
push eax
call sub.kernel32.dll_DeleteFileW
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e0bc
lea eax, [ebp - 0xc]
call fcn.0040e048
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40e304
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x40e30c
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x40e3f9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.0040b8ec
mov edx, dword [ebp - 8]
mov ecx, 0x40e414
xor eax, eax
call fcn.0040e1e8
push 0
mov eax, dword [ebp - 4]
call fcn.00404d24
push eax
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x40e3c7
call sub.kernel32.dll_GetLastError
mov ebx, eax
cmp ebx, 0xb7
je 0x40e326
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x1c]
mov edx, dword [ebp - 4]
mov al, 0x36
call fcn.0040de10
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.00407e04
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x24]
mov eax, ebx
call fcn.0040be74
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x18]
mov ecx, 2
mov al, 0x68
call fcn.0040dde0
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x406c78]
call fcn.00409740
call fcn.00403f88
jmp 0x40e326
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00404c98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e400
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00404c90
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404c90
ret

Function at 0x40e428
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffffec
mov eax, dword [0x412c88]
cmp dword [eax], 2
jne 0x40e490
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x40e44b
xor eax, eax
jmp 0x40e49f
lea eax, [esp + 8]
push eax
push 0x40e4a4
push 0
call sub.advapi32.dll_LookupPrivilegeValueW
mov dword [esp + 4], 1
mov dword [esp + 0x10], 2
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError
test eax, eax
je 0x40e490
xor eax, eax
jmp 0x40e49f
push 0
push 2
call sub.user32.dll_ExitWindowsEx
cmp eax, 1
sbb eax, eax
inc eax
add esp, 0x14
ret
Function at 0x405f28
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x7a0aa4], 0
push esi
jne 0x405f5f
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f39
mov dword [ecx*4 + 0x7a0aa0], eax
inc ecx
cmp ecx, 0x100
jl 0x405f34
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f90
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x7a0aa0]
xor eax, esi
inc ecx
dec edx
jne 0x405f72
pop edi
not eax
pop esi
ret 0xc
Function at 0x100329b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x100329bf
pop dword [ebp - 8]
mov eax, 0x5b8d2ec6
add eax, 0xb475faf9
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0xdb07c4cd
add dword [ebp - 0x18], 0x734a807e
mov dword [ebp - 0x14], 0xef44d74b
sub dword [ebp - 0x14], 0xbd118b06
mov dword [ebp - 0x10], 0xa716f548
sub dword [ebp - 0x10], 0x5acab11a
mov dword [ebp - 0xc], 0x85031f79
sub dword [ebp - 0xc], 0x85031f79
lea eax, [ebp - 0x18]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xb960a440
add dword [ebp - 0x18], 0xbb11c516
mov dword [ebp - 0x14], 0x506464a5
sub dword [ebp - 0x14], 0xef80330
mov dword [ebp - 0x10], 0xf0a3d271
add dword [ebp - 0x10], 0x72cb99fb
mov dword [ebp - 0xc], 0x8851603
sub dword [ebp - 0xc], 0x8851603
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0xa775ea1b
add eax, 0x688d6749
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x3bada
push 0
call eax
mov ecx, 0x4a68
xor edi, edi
add edi, eax
mov ebx, 0x946765
add ebx, 0xf741c9b
add ebx, dword [ebp - 8]
mov esi, 0x9e3fb3fc
sub esi, 0x29333865
mov edx, dword [ebx]
sub dword [ebp - 4], esi
add edx, esi
xor dword [ebp - 4], eax
mov dword [edi], edx
add dword [ebp - 4], 0x929bb6f1
add edi, 4
add ebx, 0xf25a7128
sub ebx, 0xf25a7124
loop 0x10032ad8
add eax, 0xebfae9fc
add eax, 0x14063277
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x45123c65
sub ecx, 0x35123c65
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x1003384b
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov eax, dword [esi + 0x50]
cmp eax, dword [esi + 0x54]
jae 0x10033862
mov bl, byte [eax]
inc eax
mov dword [esi + 0x50], eax
jmp 0x100338ce
cmp dword [esi + 0x4c], 0
jl 0x100338cc
mov edi, dword [esi + 0x58]
push 0xfa0
push edi
push dword [esi + 0x4c]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
mov ebx, eax
add esp, 0xc
cmp ebx, 0xffffffff
jne 0x1003389a
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [eax], 4
je 0x1003386b
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [eax], 0xb
je 0x1003386b
cmp ebx, 1
jge 0x100338a7
or dword [esi + 0x4c], 0xffffffff
xor bl, bl
jmp 0x100338ec
lea eax, [edi + 1]
mov dword [esi + 0x50], eax
lea eax, [ebx + edi]
mov dword [esi + 0x54], eax
mov bl, byte [edi]
test bl, bl
jne 0x100338ce
push esi
call fcn.100348ff
mov eax, dword [esi + 0x50]
or dword [esi + 0x4c], 0xffffffff
pop ecx
mov dword [esi + 0x54], eax
jmp 0x100338ce
xor bl, bl
cmp bl, 0xa
jne 0x100338e2
mov eax, dword [esp + 0x18]
and dword [eax], 0
mov eax, dword [esp + 0x14]
inc dword [eax]
jmp 0x100338ec
test bl, bl
je 0x100338ec
mov ecx, dword [esp + 0x18]
inc dword [ecx]
pop edi
pop esi
mov al, bl
pop ebx
ret
Function at 0x4150df
Capabilities:
Contain obfuscated stackstrings
Decode data using base64 via vbmi lookup table
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0x84
push ebx
mov ebx, dword [esp + 0x98]
push esi
xor ecx, ecx
xor esi, esi
xor edx, edx
push edi
mov dword [esp + 0xc], 0x7f7f7f7f
mov dword [esp + 0x10], 0x7f7f7f7f
mov dword [esp + 0x14], 0x7f7f7f7f
mov dword [esp + 0x18], 0x7f7f7f7f
mov dword [esp + 0x1c], 0x7f7f7f7f
mov dword [esp + 0x20], 0x7f7f7f7f
mov dword [esp + 0x24], 0x7f7f7f7f
mov dword [esp + 0x28], 0x7f7f7f7f
mov dword [esp + 0x2c], 0x7f7f7f7f
mov dword [esp + 0x30], 0x7f7f7f7f
mov dword [esp + 0x34], 0x3e7f7f7f
mov dword [esp + 0x38], 0x3f7f7f7f
mov dword [esp + 0x3c], 0x37363534
mov dword [esp + 0x40], 0x3b3a3938
mov dword [esp + 0x44], 0x7f7f3d3c
mov dword [esp + 0x48], 0x7f7f407f
mov dword [esp + 0x4c], 0x201007f
mov dword [esp + 0x50], 0x6050403
mov dword [esp + 0x54], 0xa090807
mov dword [esp + 0x58], 0xe0d0c0b
mov dword [esp + 0x5c], 0x1211100f
mov dword [esp + 0x60], 0x16151413
mov dword [esp + 0x64], 0x7f191817
mov dword [esp + 0x68], 0x7f7f7f7f
mov dword [esp + 0x6c], 0x1c1b1a7f
mov dword [esp + 0x70], 0x201f1e1d
mov dword [esp + 0x74], 0x24232221
mov dword [esp + 0x78], 0x28272625
mov dword [esp + 0x7c], 0x2c2b2a29
mov dword [esp + 0x80], 0x302f2e2d
mov dword [esp + 0x84], 0x7f333231
mov dword [esp + 0x88], 0x7f7f7f7f
test ebx, ebx
je 0x41532c
mov edi, dword [esp + 0x9c]
mov edi, edi
mov eax, ebx
sub eax, edx
cmp eax, 2
jb 0x415229
cmp byte [edx + edi], 0xd
jne 0x415229
cmp byte [edx + edi + 1], 0xa
je 0x415262
mov al, byte [edx + edi]
cmp al, 0xa
je 0x415262
cmp al, 0x3d
jne 0x41523e
inc ecx
cmp ecx, 2
ja 0x41533a
cmp al, 0x7f
ja 0x41533a
movzx eax, al
mov al, byte [esp + eax + 0xc]
cmp al, 0x7f
je 0x41533a
cmp al, 0x40
jae 0x415261
test ecx, ecx
jne 0x41533a
inc esi
inc edx
cmp edx, ebx
jb 0x415213
test esi, esi
je 0x41532c
mov ecx, dword [esp + 0x98]
lea eax, [esi + esi*2]
mov esi, dword [esp + 0x94]
lea eax, [eax*2 + 7]
shr eax, 3
test esi, esi
je 0x41534b
cmp dword [ecx], eax
jb 0x41534b
xor eax, eax
xor ebx, ebx
push ebp
mov ebp, 3
mov dword [esp + 0x90], eax
test edx, edx
je 0x41531b
lea esp, [esp]
mov al, byte [edi]
cmp al, 0xd
je 0x415317
cmp al, 0xa
je 0x415317
movzx eax, al
mov cl, byte [esp + eax + 0x10]
xor eax, eax
cmp cl, 0x40
sete al
shl ebx, 6
sub ebp, eax
movzx eax, cl
mov ecx, dword [esp + 0x90]
and eax, 0x3f
inc ecx
or ebx, eax
mov dword [esp + 0x90], ecx
cmp ecx, 4
jne 0x415317
xor eax, eax
mov dword [esp + 0x90], eax
test ebp, ebp
je 0x415302
mov eax, ebx
shr eax, 0x10
mov byte [esi], al
inc esi
cmp ebp, 1
jbe 0x41530f
mov eax, ebx
shr eax, 8
mov byte [esi], al
inc esi
cmp ebp, 2
jbe 0x415317
mov byte [esi], bl
inc esi
inc edi
dec edx
jne 0x4152b3
sub esi, dword [esp + 0x98]
mov eax, dword [esp + 0x9c]
pop ebp
mov dword [eax], esi
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x84
ret 0x10
pop edi
pop esi
mov eax, 0xfffffffe
pop ebx
add esp, 0x84
ret 0x10
pop edi
pop esi
mov dword [ecx], eax
or eax, 0xffffffff
pop ebx
add esp, 0x84
ret 0x10