joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403e28
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x416060]
jne 0x403e32
repz ret
jmp fcn.00404f17

Function at 0x40778d
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x4161f0]
je 0x4077a8
inc edi
cmp edi, 0x17
jb 0x407799
cmp edi, 0x17
jae 0x407928
push ebp
push 3
call fcn.0040cb80
cmp eax, 1
pop ecx
je 0x4078f4
push 3
call fcn.0040cb80
test eax, eax
pop ecx
jne 0x4077dc
cmp dword [0x41605c], 1
je 0x4078f4
cmp ebx, 0xfc
je 0x407927
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x4176b8
push ebp
call fcn.00403e37
add esp, 0xc
test eax, eax
je 0x407812
push esi
push esi
push esi
push esi
push esi
call fcn.00405025
add esp, 0x14
push 0x104
mov esi, 0x4176d1
push esi
push 0
mov byte [0x4177d5], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x407856
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.00403e37
add esp, 0xc
test eax, eax
je 0x407856
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00405025
add esp, 0x14
push esi
call fcn.004051d0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x40789b
push esi
call fcn.004051d0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x4179cc
push 0x412884
sub ecx, eax
push ecx
push eax
call fcn.0040cacd
add esp, 0x14
test eax, eax
je 0x40789b
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00405025
add esp, 0x14
jmp 0x40789d
xor esi, esi
push 0x412880
push ebx
push ebp
call fcn.0040ca5c
add esp, 0xc
test eax, eax
je 0x4078bd
push esi
push esi
push esi
push esi
push esi
call fcn.00405025
add esp, 0x14
push dword [edi*8 + 0x4161f4]
push ebx
push ebp
call fcn.0040ca5c
add esp, 0xc
test eax, eax
je 0x4078df
push esi
push esi
push esi
push esi
push esi
call fcn.00405025
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0040c89f
add esp, 0xc
jmp 0x407927
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x407927
cmp ebp, 0xffffffff
je 0x407927
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x4161f4]
push dword [esi]
call fcn.004051d0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x40c89f
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00407a40
xor ebx, ebx
cmp dword [0x417ccc], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x40c975
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x40ca55
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x40ca55
push eax
call fcn.004079d2
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x417ccc], eax
call esi
push eax
call fcn.004079d2
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x417cd0], eax
call esi
push eax
call fcn.004079d2
mov dword [0x417cd4], eax
lea eax, [ebp - 0xc]
push eax
call fcn.004046b2
test eax, eax
pop ecx
pop ecx
je 0x40c943
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00405025
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x40c975
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.004079d2
cmp eax, ebx
pop ecx
mov dword [0x417cdc], eax
je 0x40c975
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004079d2
pop ecx
mov dword [0x417cd8], eax
mov eax, dword [0x417cd8]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x40c9fa
cmp dword [0x417cdc], ecx
je 0x40c9fa
push eax
call fcn.00407a49
push dword [0x417cdc]
mov esi, eax
call fcn.00407a49
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x40c9fa
cmp edi, ebx
je 0x40c9fa
call esi
cmp eax, ebx
je 0x40c9c7
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40c9c7
test byte [ebp - 0x18], 1
jne 0x40c9fa
lea eax, [ebp - 0x10]
push eax
call fcn.004046e9
test eax, eax
pop ecx
je 0x40c9e2
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00405025
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x40c9f1
or dword [ebp + 0x10], 0x200000
jmp 0x40ca35
or dword [ebp + 0x10], 0x40000
jmp 0x40ca35
mov eax, dword [0x417cd0]
cmp eax, dword [ebp - 8]
je 0x40ca35
push eax
call fcn.00407a49
cmp eax, ebx
pop ecx
je 0x40ca35
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x40ca35
mov eax, dword [0x417cd4]
cmp eax, dword [ebp - 8]
je 0x40ca35
push eax
call fcn.00407a49
cmp eax, ebx
pop ecx
je 0x40ca35
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x417ccc]
call fcn.00407a49
cmp eax, ebx
pop ecx
je 0x40ca55
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40ca57
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4019a0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 4], esi
mov eax, dword [esi]
cmp eax, 0x270
jne 0x4019fd
lea edx, [esi + 8]
mov edi, eax
nop dword [eax]
mov ecx, dword [edx]
lea edx, [edx + 4]
xor ecx, dword [edx - 8]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub edi, 1
jne 0x4019c0
mov eax, dword [esi]
jmp 0x401ad7
cmp eax, 0x4e0
jb 0x401ad7
lea edi, [esi + 0x9c4]
mov esi, 0xe3
push ebx
mov ebx, dword [edi]
mov eax, ebx
lea edi, [edi + 4]
mov ebx, dword [edi]
mov ecx, ebx
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x630]
xor eax, ecx
mov dword [edi - 0x9c4], eax
sub esi, 1
jne 0x401a16
mov edi, dword [ebp - 4]
mov esi, 0x18c
add edi, 0xd50
mov ebx, dword [edi]
nop
mov eax, ebx
lea edi, [edi + 4]
mov ebx, dword [edi]
mov ecx, eax
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi - 0xd50]
xor eax, ecx
mov dword [edi - 0x9c4], eax
sub esi, 1
jne 0x401a60
mov esi, dword [ebp - 4]
pop ebx
mov eax, dword [esi + 0x1380]
mov ecx, dword [esi + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
xor eax, eax
mov dword [esi], 0
mov edx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov ecx, edx
mov eax, dword [esi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4024a1
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4024e0
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4024e0
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4024e0
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4024e0
cmp dword [ecx + 0x74], 0xe
jbe 0x4024e0
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4d0644
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
cmp word [ecx], 0x5a4d
je 0x4d0657
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], reloc.MSVCRT.dll___dllonexit
jne 0x4d0653
xor ecx, ecx
cmp word [eax + 0x18], 0x10b
sete cl
mov eax, ecx
pop ebp
ret

Function at 0x4d0684
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
test esi, esi
push edi
lea eax, [eax + ecx + 0x18]
jbe 0x4d06c3
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x4d06b9
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x4d06c5
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x4d06a9
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4e156d
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
cmp word [ecx], 0x5a4d
je 0x4e1580
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], reloc.MSVCRT.dll___dllonexit
jne 0x4e157c
xor ecx, ecx
cmp word [eax + 0x18], 0x10b
sete cl
mov eax, ecx
pop ebp
ret

Function at 0x4e15ad
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
test esi, esi
push edi
lea eax, [eax + ecx + 0x18]
jbe 0x4e15ec
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x4e15e2
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x4e15ee
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x4e15d2
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x6ed0e3
Capabilities:
Execute anti-debugging instructions

Disassembly:
not ax
mov ax, 0xdb8
sete al
xchg dword [esp], eax
call fcn.006ed0f6
insd dword es:[edi], dx

Function at 0x6ed0f6
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0x19
jmp 0x6ed124
lea esp, [esp + 1]
lea eax, reloc.MSVCRT.dll___dllonexit
call fcn.006ed10e
Function at 0x743de0
Capabilities:
Encrypt data using aes

Disassembly:
xchg byte [esp + 2], bh
xchg byte [esp + 2], bl
mov bp, 0x17ed
jmp 0x743e1c
shl edx, 8
jmp 0x743e87
movzx esi, byte [eax + 0xb]
clc
neg ebx
sub esp, 0xe
lea esp, [esp + 2]
jmp 0x743e06
lea ebp, [ebp + 8]
mov dword [ebp], edx
pop ebp
movzx edx, byte [eax + 0xc]
jmp 0x743e41
xor edx, esi
push ebp
mov ebp, ecx
jmp 0x743e57

Function at 0x74420f
Capabilities:
Encrypt data using aes

Disassembly:
mov edi, edx
and edx, esi
jmp 0x744249
movzx edi, byte [edi*4 + 0x6ffa4c]
jmp 0x744256
mov edx, dword [edx*4 + reloc.MSVCRT.dll___dllonexit]
shr edi, 0x18
pushfd
jmp 0x744233
xor ecx, edi
push si
mov byte [esp], al
rcl di, 3
lea esp, [esp + 2]
jmp 0x744393
mov dh, byte [esp]
lea edi, [esi*4]
jmp 0x7442c8
cmc
mov edi, 0x4f07bdf5
lea esp, [esp + 8]
xor ecx, dword [ebx]
lea edi, [esi*4]
jmp 0x74427f
add ebx, 4
cmc
lea edx, [edx*4]
mov edx, dword [esp]
jmp 0x744323
lea edi, [eax + 0x10]
mov edx, dword [esp]
xor ecx, dword [eax]
not edx
jmp 0x7442b2
add edi, 4
mov edx, dword [edi]
pop edi
jmp 0x7442f9
bts dx, bx
lea edx, reloc.MSVCRT.dll___dllonexit
push edi
mov edi, eax
jmp 0x7442d4
xor edx, ecx
mov ecx, dword [esp]
mov cx, ax
mov cl, ah
jmp 0x744341
pop esi
bt ecx, ecx
sub esp, 1
lea esp, [esp + 1]
jmp 0x74432b
push edx
mov edx, edi
mov dword [edx], ecx
pop edx
jmp 0x7442ea
mov ecx, dword [eax + 8]
pushal
push dword [esp + 0xa]
push sp
lea esp, [esp + 2]
jmp 0x744361
push esi
mov esi, eax
add esi, 0x14
mov dword [esi], edx
jmp 0x744305
mov dword [eax + 0x18], ecx
dec edx
call fcn.00744372
iretd
xor ecx, edx
lea edx, [ecx + esi]
mov dl, byte [esp]
sub esp, 0x1b
lea esp, [esp + 3]
jmp 0x74434b
and edx, ebp
xor ecx, edx
mov edx, eax
lea edi, reloc.MSVCRT.dll___dllonexit
jmp 0x74429d

Function at 0x7445f7
Capabilities:
Encrypt data using aes

Disassembly:
clc
shr edi, 0x18
mov edi, dword [edi*4 + reloc.MSVCRT.dll___dllonexit]
and edi, 0xff000000
xor edx, edi
mov edi, dword [ebp - 0x10]
and edi, eax
movzx eax, byte [edi*4 + 0x700e4c]
xor edx, eax
xor edx, dword [ecx + 0xc]
mov eax, edx
shr eax, 0x18
mov byte [esi + 0xc], al
mov eax, edx
shr eax, 0x10
mov byte [esi + 0xd], al
mov eax, edx
shr eax, 8
mov byte [esi + 0xe], al
mov byte [esi + 0xf], dl
jmp 0x6f5972
pop edi
pop esi
pop ebx
leave
ret 8
pushfd
call fcn.00744bf2
sbb al, 0x6f
jbe 0x6f5927
push ds
mov ecx, 0x71bb89e
test al, 0x34
pop edi
int 0x5c
scasd eax, dword es:[edi]
mov dh, byte [esp]
mov ebx, dword [esp]
jmp 0x74467e
lea esp, [esp + 4]
cmp eax, 1
pushal
jmp 0x7445f9
jmp 0x7445df
lea esp, [esp + 0x20]
jle 0x6f599a
sub esp, 0x1e
dec edx
lea esp, [esp + 2]
jmp 0x744645
mov dword [ebp - 4], ecx
xchg dl, cl
cmp bh, ch
or dx, dx
jmp 0x74462f
mov ecx, 0x5fcfe82d
jmp 0x74466a
lea esp, [esp + 0x1c]
lea ecx, [eax - 1]
push edx
mov bl, 0xa8
bsr ebx, eax
jmp 0x74460d
add ecx, 0xa03018d2
call fcn.00744654
lea esp, [esp + 4]
jmp 0x6f59e7
movzx ebx, byte [esi + 0x11]
lea edi, [eax + ecx]
mov dx, bp
jmp 0x74472c
add esi, 0x10
mov dx, word [esp]
push ebp
pushal
jmp 0x7446bb
mov ebx, dword [ebx*4 + reloc.MSVCRT.dll___dllonexit]
rol dx, cl
clc
neg dx
jmp 0x7446fb
Function at 0x744873
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
movzx ebx, byte [esi + 6]
push ebx
jmp 0x744894
lea esp, [esp + 0x24]
xor edi, dword [ebx*4 + reloc.MSVCRT.dll___dllonexit]
ror bx, cl
clc
mov bh, 0x25
jmp 0x74483a
mov edi, dword [edi*4 + reloc.MSVCRT.dll___dllonexit]
and ebx, ecx
jmp 0x744850
and ebx, ecx
jmp 0x7448fc
mov ebx, dword [ebx*4 + reloc.MSVCRT.dll___dllonexit]
push bx
lea esp, [esp + 2]
jmp 0x74487e
and edx, ecx
clc
jmp 0x7448e5
mov ecx, esi
add ecx, 9
movzx ebx, byte [ecx]
pop ecx
jmp 0x7448c4
mov edx, dword [edx*4 + reloc.MSVCRT.dll___dllonexit]
jmp 0x744910
lea esp, [esp + 4]
xor edi, dword [ebx*4 + reloc.MSVCRT.dll___dllonexit]
lea ebx, [eax - 0xbd]
push ecx
jmp 0x7448da
and edx, ecx
cmc
xor edi, dword [edx*4 + reloc.MSVCRT.dll___dllonexit]
jmp 0x7450bf
popal
lea ebx, [ebx*4]
lea ebx, reloc.MSVCRT.dll___dllonexit
mov edi, dword [ebx]
pop ebx
call fcn.00744949
shr edi, 0x18
push ebx
pushal
mov dword [esp + 0x10], edi
jmp 0x74495f
ror cl, 4
mov bp, 0x80d1
mov ebx, edx
mov dword [esp], edx
popal
jmp 0x7449c0
mov ebx, dword [ebx*4 + reloc.MSVCRT.dll___dllonexit]
bswap edi
btr edi, edi
not edi
pushal
jmp 0x744aba
mov edx, dword [esi + 8]
mov dword [esi + 4], edi
bts edi, eax
mov edi, ebx
jmp 0x744b5a

Function at 0x744a6c
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 0x1c]
xor edi, dword [edx*4 + reloc.MSVCRT.dll___dllonexit]
mov dh, bh
jmp 0x744a8f

Function at 0x744a9d
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov edi, dword [edi*4 + reloc.MSVCRT.dll___dllonexit]
jmp 0x7449a8
bsr bx, di
lea ebx, [eax + esi]
jmp 0x7449e1
and ebx, ecx
lea esp, [esp + 8]
xor edi, dword [ebx*4 + reloc.MSVCRT.dll___dllonexit]
mov bx, 0x67c0
jmp 0x744992
mov esi, ebx
jmp 0x744a2a
movzx ebx, byte [esi + 0xa]
stc
push esi
jmp 0x7449cb
and ebx, ecx
call fcn.007449e9
lea esp, [esp + 4]
xor edi, dword [ebx*4 + reloc.MSVCRT.dll___dllonexit]
mov ebx, edi
setb bh
mov bx, 0xaf01
jmp 0x744a5d
lea esi, [esi*4]
lea esi, reloc.MSVCRT.dll___dllonexit
mov ebx, dword [esi]
pop esi
jmp 0x7449ff
cmc
sub esp, 0x1b
mov dword [esp + 9], ebp
lea esp, [esp + 3]
jmp 0x744a88
movzx ebx, byte [esi + 0xd]
and edx, ecx
mov edx, dword [edx*4 + reloc.MSVCRT.dll___dllonexit]
jmp 0x744a3c
and edx, ecx
call fcn.00744a6c
pushfd
mov edx, dword [esi + 0xc]
cmc
mov dword [esi + 8], edi
call 0x744a9d
int 0xe8
jbe 0x744aa0
add byte [eax], al
dec edi
mov ebx, dword [ebx*4 + reloc.MSVCRT.dll___dllonexit]
jmp 0x744ae2
lea esp, [esp + 2]
lea esp, [esp + 0xc]
popal
call fcn.00744af1
in al, 0x62
invalid
pushal
bsf ecx, esi
mov ch, byte [esp]
mov dword [esp], edx
sub esp, 0xe
jmp 0x744acc
Function at 0x744af1
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
call fcn.00744b30
mov edi, dword [edi*4 + reloc.MSVCRT.dll___dllonexit]
and edi, ecx
mov edi, dword [edi*4 + reloc.MSVCRT.dll___dllonexit]
jmp 0x744b1a
and ebx, ecx
sub esp, 0x16
lea esp, [esp + 2]
jmp 0x744b35
lea esp, [esp + 0x28]
xor edi, dword [ebx*4 + reloc.MSVCRT.dll___dllonexit]
push edx
jmp 0x744de5
mov ebx, dword [ebx*4 + reloc.MSVCRT.dll___dllonexit]
and edx, ecx
mov edx, dword [edx*4 + reloc.MSVCRT.dll___dllonexit]
call fcn.00744c59
mov edx, esi
add edx, 0xe
movzx ebx, byte [edx]
pop edx
jmp 0x744d2c

Function at 0x744b6e
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 2]
jmp 0x744b8e
lea esp, [esp + 0x18]
xor edi, dword [ebx*4 + reloc.MSVCRT.dll___dllonexit]
push bp
add esp, 1
jmp 0x744c10
pop ecx
jmp 0x744bc7
push ecx
mov ecx, esi
lea ecx, [ecx + 0xc]
mov dword [ecx], edi
jmp 0x744ba7
jne 0x6f59e7
je 0x6f599a
les eax, [esi - 0x2c]
mov bl, 0x4e
test al, 0x76
sti
imul ecx, dword [esi], reloc.MSVCRT.dll___dllonexit
adc byte [esi - 0x57], bl
xor edi, dword [edx*4 + reloc.MSVCRT.dll___dllonexit]
pushfd
lea esp, [esp + 4]
dec dword [ebp - 4]
jmp 0x744bbd
lea esp, [esp + 1]
and edx, ecx
pushal
lea esp, [esp + 0x20]
jmp 0x744be1

Function at 0x746582
Capabilities:
Encode data using base64

Disassembly:
call fcn.007465b7
stosb byte es:[edi], al
lds esi, [edi + 0x35]
or cl, byte [ebp + ebp*4 + 0xc]
sub dword [edi + 0x1a], 0x3d
mov ds, word [ecx]
js 0x7465f3
mov dl, 0xad
cmp edx, ecx
call fcn.00746582
iretd

Function at 0x87496e
Capabilities:
Packed with generic packer
Parse pe header

Disassembly:
mov byte [esp + 0x1c], al
mov dword [esp + 0x16], ecx
call fcn.008749a0
test al, 0x2d
mov ebp, 0xbc8537c4
invalid

Function at 0x8749a0
Capabilities:
Packed with generic packer
Parse pe header

Disassembly:
mov word [esp], ax
lea esp, [esp + 1]
lea esp, [esp + 1]
push edx
push edi
jmp 0x87491b
lea esp, [esp + 6]
jmp 0x8748ff
mov dword [esp], ebp
mov dword [esp], edx
mov dword [esp], ebx
call fcn.00874965
add byte [eax], al
mov byte [ebp - 0x2b], 0xbc
dec edi
movsb byte es:[edi], byte [esi]
jo 0x874927
add edi, esi
dec edi
mov ds, word [bx + di]
js 0x874995
pop dword [esp + 2]
lea esp, [esp + 8]
mov dword [esp + 0x38], edi
lea esp, [esp + 0x38]
jmp 0x8749d8
cmp byte [ebp - 0x14c7db9c], cl
cmp al, 0x81
inc eax
add edi, dword [edx + reloc.MSVCRT.dll___dllonexit]
mov dword [esp + 0x2c], esi
pushal
pop dword [esp + 0x15]
jmp 0x87498a
mov edx, eax
jmp 0x8749e4
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
push edx
jmp 0x8749c2
lea edx, [edx + 0x1c]
mov eax, dword [edx]
pop edx
jmp 0x874a2a
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x8740dd

Function at 0x8749bc
Capabilities:
Access peb ldr_data
Packed with generic packer
Parse pe header

Disassembly:
pushal
call fcn.0087496e
mov dword [esp + 8], ebp
jmp 0x874984
Function at 0x430000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x31e050f3
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4300d2
mov ebx, 0x42e1d0
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x18010038
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x10001160
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x100011d1
mov ecx, dword [ebp - 4]
cmp dword [ecx + 8], 0
je 0x100011d1
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
test eax, eax
jne 0x100011ba
jmp 0x100011d1
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
push 0x40
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x10001680
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x1044c5f8], 0
je 0x10001699
mov eax, dword [0x1044c5f8]
jmp 0x10001836
mov dword [0x1044c5f8], 0x1044c5d0
push 0x28
push 0
push 0x1044c5d0
call fcn.1004f110
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [0x1044c5d0], eax
push str.imagehlp.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x1044c5d4], eax
cmp dword [0x1044c5d4], 0
jne 0x100016df
xor eax, eax
jmp 0x10001836
push str.ImagehlpApiVersionEx
mov eax, dword [0x1044c5d4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1044c5d8], eax
push str.SymInitialize
mov ecx, dword [0x1044c5d4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1044c5dc], eax
push str.SymSetOptions
mov edx, dword [0x1044c5d4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1044c5e0], eax
push str.SymGetOptions
mov eax, dword [0x1044c5d4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1044c5e4], eax
push str.SymLoadModule
mov ecx, dword [0x1044c5d4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1044c5e8], eax
push str.SymGetModuleInfo
mov edx, dword [0x1044c5d4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1044c5ec], eax
push str.SymGetSymFromName
mov eax, dword [0x1044c5d4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1044c5f0], eax
push str.BindImage
mov ecx, dword [0x1044c5d4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1044c5f4], eax
push 8
push 0
lea edx, [ebp - 8]
push edx
call fcn.1004f110
add esp, 0xc
mov word [ebp - 8], 9
cmp dword [0x1044c5d8], 0
je 0x100017bd
lea eax, [ebp - 8]
push eax
call dword [0x1044c5d8]
cmp dword [0x1044c5d8], 0
je 0x100017cf
movzx ecx, word [ebp - 8]
cmp ecx, 9
jge 0x100017ea
mov edx, dword [0x1044c5d4]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x1044c5d4], 0
xor eax, eax
jmp 0x10001836
cmp dword [0x1044c5dc], 0
je 0x10001803
push 0
push 0
mov eax, dword [0x1044c5d0]
push eax
call dword [0x1044c5dc]
cmp dword [0x1044c5e4], 0
je 0x10001831
cmp dword [0x1044c5e0], 0
je 0x10001831
call dword [0x1044c5e4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
and ecx, 7
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [0x1044c5e0]
mov eax, dword [0x1044c5f8]
mov esp, ebp
pop ebp
ret
Function at 0x10003b10
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10088490
push 0x1004ea20
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x1044a964]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
mov esi, dword [0x1044be68]
lea ecx, [ebp - 0x28]
push ecx
push 0x28
push eax
mov ecx, esi
call dword [0x10077410]
call esi
test eax, eax
js 0x10003b89
lea eax, [ebp - 0x24]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x10003b94
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xfffffffe
xor al, al
jmp 0x10003bc4
push 4
lea eax, [ebp - 0x24]
push eax
push 0
push dword [ebp - 0x28]
call fcn.10004f20
add esp, 0x10
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10003bbb
mov dword [ebp - 4], 0xfffffffe
mov al, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1004ce42
mov esp, ebp
pop ebp
ret