joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47e730
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0xa4]
test eax, eax
je 0x47e777
mov edi, dword [esp + 0x10]
push edi
call fcn.00494ee3
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
mov dword [esi + 0xa8], eax
mov eax, dword [esi + 0xa4]
mov ecx, dword [ecx]
push eax
push edi
push 1
push ecx
call fcn.004ac3d0
sub eax, edi
add esp, 0x14
neg eax
sbb eax, eax
pop edi
and eax, 0x21
pop esi
ret 0xc
mov ecx, dword [esi + 0x2c]
test ecx, ecx
je 0x47e7ab
mov eax, dword [esi + 0x18]
test eax, eax
je 0x47e7ab
mov edx, dword [ecx]
call dword [edx + 0x40]
test al, al
je 0x47e795
mov eax, dword [esi + 0x7c]
test eax, eax
jg 0x47e7ab
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push eax
push ecx
mov ecx, esi
call fcn.0047e870
pop edi
pop esi
ret 0xc
mov ecx, dword [esi + 0x18]
push ebx
mov edx, dword [ecx]
call dword [edx + 0x18]
mov ecx, dword [esi + 0x14]
mov edi, eax
mov eax, dword [ecx]
call dword [eax + 0x18]
mov ebx, eax
cmp ebx, 0x5a
jle 0x47e7de
cmp edi, 0x5a
jle 0x47e7de
mov ecx, dword [esi + 0x2c]
mov edx, dword [ecx]
call dword [edx + 0x44]
test al, al
je 0x47e7de
mov ecx, dword [esi + 0x18]
mov eax, dword [ecx]
call dword [eax + 0x14]
mov eax, dword [esi + 0x7c]
imul eax, dword [esi + 0x3c]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
and edx, 0x1fff
add eax, edx
mov edi, eax
mov eax, dword [esi + 0x40]
sar edi, 0xd
cmp edi, eax
jbe 0x47e80d
cdq
sub eax, edx
mov edi, eax
sar edi, 1
mov al, byte [esp + 0x18]
test al, al
je 0x47e853
cmp ebx, 1
jge 0x47e853
mov ecx, dword [esi + 0x18]
mov edx, edi
shr edx, 1
cmp dword [ecx + 0xc], edx
jae 0x47e853
mov al, byte [esi + 0x1d]
test al, al
jne 0x47e853
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call ebx
mov ecx, dword [esi + 0x18]
cmp dword [ecx + 0xc], edi
jae 0x47e853
mov eax, dword [ecx]
call dword [eax + 0x18]
cmp eax, 0x5a
jg 0x47e853
mov al, byte [esi + 0x1d]
test al, al
je 0x47e833
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push ecx
push edx
mov ecx, esi
call fcn.0047e870
pop ebx
pop edi
pop esi
ret 0xc

Function at 0x47fa30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, ecx
mov al, byte [ebp + 0x24]
test al, al
jne 0x47fa57
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push eax
push ecx
push 1
push edx
call fcn.004ac3d0
add esp, 0x10
pop ebp
ret 0xc
push ebx
push esi
mov esi, dword [esp + 0x18]
push edi
push esi
call fcn.004ae7fa
mov ebx, dword [esp + 0x18]
mov edi, eax
mov eax, dword [esp + 0x1c]
push esi
push eax
push 1
push ebx
call fcn.004ac3d0
mov esi, eax
add esp, 0x14
test esi, esi
jbe 0x47fa8b
push esi
push ebx
push edi
mov ecx, ebp
call fcn.0047fb60
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x47faa0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x50e6b8]
xor edx, edx
cmp eax, edx
jne 0x47fac6
xor eax, eax
mov byte [eax + 0x50e5b8], al
inc eax
cmp eax, 0x100
jl 0x47faae
mov dword [0x50e6b8], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x50e5b8
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x47fb57
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x47fb2a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x47faf8
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x486510
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c2bee
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.00486e30
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x4d0b34
call fcn.00494ee3
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x4865a3
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00494ee3
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x48659c
push 0
mov ecx, eax
call fcn.0047d6d0
mov dword [esi + 0xc], eax
jmp 0x4865a5
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x4865a5
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x49752b
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x497563
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004955fd
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004955d5
jmp 0x49756f
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4
Function at 0x498c1d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x498c5f
call fcn.0049e566
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x498c5f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x498c56
xor eax, eax
jmp 0x498c67
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00498c6d
pop edi
pop esi
pop ebx
ret 4
Function at 0x4a0020
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x4fdab8]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x10c]
push 0
push eax
call fcn.004a36e0
mov ecx, dword [ebp + 8]
add esp, 0xc
lea eax, [ecx - 1]
cmp eax, 7
ja 0x4a0141
cmp ecx, 1
jne 0x4a0079
push 0
mov eax, 5
push eax
lea eax, [ebp - 0x10c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
jmp 0x4a01a2
cmp ecx, 2
jne 0x4a009a
push 0
mov eax, 6
push eax
lea eax, [ebp - 0x10c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
jmp 0x4a01a2
cmp ecx, 3
jne 0x4a00bb
push 0
mov eax, 0x10
push eax
lea eax, [ebp - 0x10c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
jmp 0x4a01a2
cmp ecx, 4
jne 0x4a00dc
push 0
mov eax, 0x14
push eax
lea eax, [ebp - 0x10c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
jmp 0x4a01a2
cmp ecx, 5
jne 0x4a00fd
push 0
mov eax, 0xb
push eax
lea eax, [ebp - 0x10c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
jmp 0x4a01a2
cmp ecx, 6
jne 0x4a011e
push 0
mov eax, 2
push eax
lea eax, [ebp - 0x10c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
jmp 0x4a01a2
mov edx, 7
mov eax, 0x1a
cmp ecx, edx
push 0
cmove eax, edx
push eax
lea eax, [ebp - 0x10c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
jmp 0x4a01a2
cmp ecx, 9
jne 0x4a015a
push 0x104
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x4a019a
cmp ecx, 0xa
jne 0x4a0173
push 0x104
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x4a019a
cmp ecx, 0xb
je 0x4a0188
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a151e
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x10c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
xor ecx, ecx
cmp ecx, eax
sbb eax, eax
neg eax
push ebx
xor ebx, ebx
test eax, eax
je 0x4a0244
lea ecx, [ebp - 0x10c]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a01b6
sub ecx, edx
je 0x4a01e3
cmp byte [ebp + ecx - 0x10d], 0x5c
je 0x4a01e3
mov byte [ebp + ecx - 0x10c], 0x5c
inc ecx
cmp ecx, 0x105
jae 0x4a0255
mov byte [ebp + ecx - 0x10c], bl
cmp byte [ebp - 0x10c], bl
je 0x4a0242
push esi
push edi
lea edi, [ebp - 0x10c]
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x4a01f6
sub edi, ecx
push 0
lea esi, [edi + 1]
push esi
push 0x7e8
call fcn.004a0380
push esi
mov ebx, eax
push 0
push ebx
call fcn.004a36e0
push edi
lea eax, [ebp - 0x10c]
push eax
push ebx
call fcn.004a2a30
add esp, 0x18
mov byte [edi + ebx], 0
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a151e
mov esp, ebp
pop ebp
ret
xor ebx, ebx
mov ecx, dword [ebp - 4]
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.004a151e
mov esp, ebp
pop ebp
ret
call fcn.004a165e
int3
Function at 0x4a0260
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov ecx, dword [ebp + 0x18]
movaps xmm0, xmmword [0x4cf440]
push esi
push edi
lea eax, [ecx - 1]
mov dword [ebp - 8], 8
mov dword [ebp - 4], 6
mov esi, 1
movups xmmword [ebp - 0x18], xmm0
cmp eax, 5
ja 0x4a0295
mov esi, dword [ebp + ecx*4 - 0x1c]
mov edi, dword [ebp + 8]
lea eax, [edi - 1]
cmp eax, 3
ja case.default.0x4a02a4
jmp dword [eax*4 + 0x4a036c]
mov eax, dword [ebp + 0x14]
push esi
mov edx, dword [eax]
mov eax, dword [ebp + 0x10]
push edx
mov ecx, dword [eax]
mov eax, dword [ebp + 0xc]
push ecx
push dword [eax]
push str.edit
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
push esi
mov edx, dword [eax]
mov eax, dword [ebp + 0x10]
push edx
mov ecx, dword [eax]
mov eax, dword [ebp + 0xc]
push ecx
push dword [eax]
push str.explore
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
push esi
mov edx, dword [eax]
mov eax, dword [ebp + 0x10]
push edx
mov ecx, dword [eax]
mov eax, dword [ebp + 0xc]
push ecx
push dword [eax]
push str.find
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
push esi
mov edx, dword [eax]
mov eax, dword [ebp + 0x10]
push edx
mov ecx, dword [eax]
mov eax, dword [ebp + 0xc]
push ecx
push dword [eax]
push 0x4cf428
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
push esi
mov edx, dword [eax]
mov eax, dword [ebp + 0x10]
push edx
mov ecx, dword [eax]
mov eax, dword [ebp + 0xc]
push ecx
xor ecx, ecx
cmp edi, 5
push dword [eax]
mov eax, str.print
cmovne eax, ecx
push eax
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4a02ab
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov ecx, dword [ebp + 0x18]
movaps xmm0, xmmword [0x4cf440]
push esi
push edi
lea eax, [ecx - 1]
mov dword [ebp - 8], 8
mov dword [ebp - 4], 6
mov esi, 1
movups xmmword [ebp - 0x18], xmm0
cmp eax, 5
ja 0x4a0295
mov esi, dword [ebp + ecx*4 - 0x1c]
mov edi, dword [ebp + 8]
lea eax, [edi - 1]
cmp eax, 3
ja case.default.0x4a02a4
jmp dword [eax*4 + 0x4a036c]
mov eax, dword [ebp + 0x14]
push esi
mov edx, dword [eax]
mov eax, dword [ebp + 0x10]
push edx
mov ecx, dword [eax]
mov eax, dword [ebp + 0xc]
push ecx
push dword [eax]
push str.edit
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
push esi
mov edx, dword [eax]
mov eax, dword [ebp + 0x10]
push edx
mov ecx, dword [eax]
mov eax, dword [ebp + 0xc]
push ecx
push dword [eax]
push str.explore
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
push esi
mov edx, dword [eax]
mov eax, dword [ebp + 0x10]
push edx
mov ecx, dword [eax]
mov eax, dword [ebp + 0xc]
push ecx
push dword [eax]
push str.find
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
push esi
mov edx, dword [eax]
mov eax, dword [ebp + 0x10]
push edx
mov ecx, dword [eax]
mov eax, dword [ebp + 0xc]
push ecx
push dword [eax]
push 0x4cf428
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
push esi
mov edx, dword [eax]
mov eax, dword [ebp + 0x10]
push edx
mov ecx, dword [eax]
mov eax, dword [ebp + 0xc]
push ecx
xor ecx, ecx
cmp edi, 5
push dword [eax]
mov eax, str.print
cmovne eax, ecx
push eax
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4a02d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov ecx, dword [ebp + 0x18]
movaps xmm0, xmmword [0x4cf440]
push esi
push edi
lea eax, [ecx - 1]
mov dword [ebp - 8], 8
mov dword [ebp - 4], 6
mov esi, 1
movups xmmword [ebp - 0x18], xmm0
cmp eax, 5
ja 0x4a0295
mov esi, dword [ebp + ecx*4 - 0x1c]
mov edi, dword [ebp + 8]
lea eax, [edi - 1]
cmp eax, 3
ja case.default.0x4a02a4
jmp dword [eax*4 + 0x4a036c]
mov eax, dword [ebp + 0x14]
push esi
mov edx, dword [eax]
mov eax, dword [ebp + 0x10]
push edx
mov ecx, dword [eax]
mov eax, dword [ebp + 0xc]
push ecx
push dword [eax]
push str.edit
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
push esi
mov edx, dword [eax]
mov eax, dword [ebp + 0x10]
push edx
mov ecx, dword [eax]
mov eax, dword [ebp + 0xc]
push ecx
push dword [eax]
push str.explore
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
push esi
mov edx, dword [eax]
mov eax, dword [ebp + 0x10]
push edx
mov ecx, dword [eax]
mov eax, dword [ebp + 0xc]
push ecx
push dword [eax]
push str.find
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
push esi
mov edx, dword [eax]
mov eax, dword [ebp + 0x10]
push edx
mov ecx, dword [eax]
mov eax, dword [ebp + 0xc]
push ecx
push dword [eax]
push 0x4cf428
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
push esi
mov edx, dword [eax]
mov eax, dword [ebp + 0x10]
push edx
mov ecx, dword [eax]
mov eax, dword [ebp + 0xc]
push ecx
xor ecx, ecx
cmp edi, 5
push dword [eax]
mov eax, str.print
cmovne eax, ecx
push eax
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4a02f5
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov ecx, dword [ebp + 0x18]
movaps xmm0, xmmword [0x4cf440]
push esi
push edi
lea eax, [ecx - 1]
mov dword [ebp - 8], 8
mov dword [ebp - 4], 6
mov esi, 1
movups xmmword [ebp - 0x18], xmm0
cmp eax, 5
ja 0x4a0295
mov esi, dword [ebp + ecx*4 - 0x1c]
mov edi, dword [ebp + 8]
lea eax, [edi - 1]
cmp eax, 3
ja case.default.0x4a02a4
jmp dword [eax*4 + 0x4a036c]
mov eax, dword [ebp + 0x14]
push esi
mov edx, dword [eax]
mov eax, dword [ebp + 0x10]
push edx
mov ecx, dword [eax]
mov eax, dword [ebp + 0xc]
push ecx
push dword [eax]
push str.edit
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
push esi
mov edx, dword [eax]
mov eax, dword [ebp + 0x10]
push edx
mov ecx, dword [eax]
mov eax, dword [ebp + 0xc]
push ecx
push dword [eax]
push str.explore
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
push esi
mov edx, dword [eax]
mov eax, dword [ebp + 0x10]
push edx
mov ecx, dword [eax]
mov eax, dword [ebp + 0xc]
push ecx
push dword [eax]
push str.find
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
push esi
mov edx, dword [eax]
mov eax, dword [ebp + 0x10]
push edx
mov ecx, dword [eax]
mov eax, dword [ebp + 0xc]
push ecx
push dword [eax]
push 0x4cf428
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
push esi
mov edx, dword [eax]
mov eax, dword [ebp + 0x10]
push edx
mov ecx, dword [eax]
mov eax, dword [ebp + 0xc]
push ecx
xor ecx, ecx
cmp edi, 5
push dword [eax]
mov eax, str.print
cmovne eax, ecx
push eax
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4a031a
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov ecx, dword [ebp + 0x18]
movaps xmm0, xmmword [0x4cf440]
push esi
push edi
lea eax, [ecx - 1]
mov dword [ebp - 8], 8
mov dword [ebp - 4], 6
mov esi, 1
movups xmmword [ebp - 0x18], xmm0
cmp eax, 5
ja 0x4a0295
mov esi, dword [ebp + ecx*4 - 0x1c]
mov edi, dword [ebp + 8]
lea eax, [edi - 1]
cmp eax, 3
ja case.default.0x4a02a4
jmp dword [eax*4 + 0x4a036c]
mov eax, dword [ebp + 0x14]
push esi
mov edx, dword [eax]
mov eax, dword [ebp + 0x10]
push edx
mov ecx, dword [eax]
mov eax, dword [ebp + 0xc]
push ecx
push dword [eax]
push str.edit
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
push esi
mov edx, dword [eax]
mov eax, dword [ebp + 0x10]
push edx
mov ecx, dword [eax]
mov eax, dword [ebp + 0xc]
push ecx
push dword [eax]
push str.explore
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
push esi
mov edx, dword [eax]
mov eax, dword [ebp + 0x10]
push edx
mov ecx, dword [eax]
mov eax, dword [ebp + 0xc]
push ecx
push dword [eax]
push str.find
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
push esi
mov edx, dword [eax]
mov eax, dword [ebp + 0x10]
push edx
mov ecx, dword [eax]
mov eax, dword [ebp + 0xc]
push ecx
push dword [eax]
push 0x4cf428
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
push esi
mov edx, dword [eax]
mov eax, dword [ebp + 0x10]
push edx
mov ecx, dword [eax]
mov eax, dword [ebp + 0xc]
push ecx
xor ecx, ecx
cmp edi, 5
push dword [eax]
mov eax, str.print
cmovne eax, ecx
push eax
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4a0a20
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c2a16
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x4fdab8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov al, 0x41
mov dword [ebp - 0x3c], esi
mov edi, 0x1a
mov dword [ebp - 0x34], 0
mov byte [ebp - 0x29], al
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], 0
mov dword [ebp - 0x34], 1
mov edx, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov byte [ebp - 0x30], al
lea eax, [ebp - 0x30]
mov dword [ebp - 0x38], edi
mov word [ebp - 0x2f], 0x3a
push eax
test ecx, ecx
je 0x4a0b15
call edx
mov ecx, dword [ebp + 0xc]
cmp eax, ecx
jne 0x4a0b69
lea eax, [ebp - 0x30]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
lea edx, [eax + 1]
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
nop dword [eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4a0ad0
sub eax, edx
lea ecx, [ebp - 0x28]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.0049ff20
mov eax, dword [esi + 4]
mov dword [ebp - 4], 1
cmp eax, dword [esi + 8]
je 0x4a0b26
movups xmm0, xmmword [ebp - 0x28]
mov edx, 0xf
mov byte [ebp - 0x28], 0
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x18]
movq qword [eax + 0x10], xmm0
add dword [esi + 4], 0x18
jmp 0x4a0b35
call edx
add eax, 0xfffffffe
cmp eax, 3
ja case.default.0x4a0b1f
jmp dword [eax*4 + 0x4a0ba0]
lea ecx, [ebp - 0x28]
push ecx
push eax
mov ecx, esi
call fcn.004a0780
mov edx, dword [ebp - 0x14]
mov byte [ebp - 4], 0
cmp edx, 0x10
jb case.default.0x4a0b1f
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4a0b5c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a0b99
push edx
push ecx
call fcn.004a152f
add esp, 8
mov ecx, dword [ebp + 0xc]
mov al, byte [ebp - 0x29]
dec edi
inc al
cmp dword [ebp - 0x38], 1
mov byte [ebp - 0x29], al
jne 0x4a0a86
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a151e
mov esp, ebp
pop ebp
ret
call fcn.004ac65c
nop
lodsd eax, dword [esi]
or cl, byte [edx]
lodsd eax, dword [esi]
or cl, byte [edx]
lodsd eax, dword [esi]
or cl, byte [edx]
lodsd eax, dword [esi]
or cl, byte [edx]

Function at 0x4b9071
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004b8ee7
Function at 0x89d1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.0089d140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.0089d140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.0089d140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.0089d140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x89dbfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x89dc50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x8af87c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x89dc43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x89dc52
xor eax, eax
pop esi
leave
ret 4

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx