joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4182c4
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4284e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0040bc4b
mov dword [ebp - 0x14], eax
cmp dword [0x42b064], esi
jne 0x4183b7
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x418344
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x418497
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x418497
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x418497
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x42b064], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x42b068], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x42b06c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x42b074], eax
test eax, eax
je 0x4183b4
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x42b070], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4183dc
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4183cf
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x4183f1
push 4
pop eax
jmp 0x418499
cmp dword [ebp - 0x14], esi
je 0x4183f1
push dword [0x42b064]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4183d6
mov eax, dword [0x42b070]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x41844f
cmp dword [0x42b074], edi
je 0x41844f
push eax
call ebx
push dword [0x42b074]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x41844f
test eax, eax
je 0x41844f
call ecx
test eax, eax
je 0x418444
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x418444
test byte [ebp - 8], 1
jne 0x41844f
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x41847f
mov eax, dword [0x42b068]
cmp eax, edi
je 0x41847c
push eax
call ebx
test eax, eax
je 0x41847c
call eax
mov esi, eax
test esi, esi
je 0x41847c
mov eax, dword [0x42b06c]
cmp eax, edi
je 0x41847c
push eax
call ebx
test eax, eax
je 0x41847c
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x42b064]
call ebx
test eax, eax
je 0x418497
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x418499
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409e2f
mov esp, ebp
pop ebp
ret
Function at 0x44b610
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
mov cl, byte [0x65f042]
mov al, byte [0x65f041]
or cl, 0x10
push ebx
shr cl, 3
and ecx, 0xff
mov bl, byte [0x65f04b]
mov dword [esp + 4], ecx
xor bl, al
fild dword [esp + 4]
mov byte [0x65f04b], bl
mov ebx, dword [esp + 0x10]
test ebx, ebx
fdivr qword [0x6629a0]
push esi
fadd qword [0x65f058]
fstp qword [0x662a10]
je 0x44b6ce
push 0x65f0a4
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edx, dword [0x65f030]
mov ecx, dword [0x65f034]
mov esi, eax
mov dword [esp + 0xc], 0
lea eax, [edx + edx]
or eax, ecx
mov dword [esp + 8], eax
fild qword [esp + 8]
test esi, esi
fadd qword [0x65f058]
fstp qword [0x65f058]
je 0x44b6ce
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x65f07c
push esi
call edi
push 0x65f064
push esi
call edi
xor eax, eax
pop edi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x44b6ce
lea ecx, [esp + 0x14]
inc eax
add ecx, 4
cmp eax, 0x36
jae 0x44b6d8
cmp dword [ecx], 0
jne 0x44b6c0
pop esi
xor al, al
pop ebx
add esp, 8
ret 4
mov dword [ebx], esi
pop esi
mov al, 1
pop ebx
add esp, 8
ret 4

Function at 0x4df849
Capabilities:
Encode data using xor

Disassembly:
sub eax, 0x868165a2
pop esi
sub dword [eax + 0x127ed1d0], esi
push es
arpl di, si
je 0x4df876
push cs
aaa
pop ecx
div dword [esi]
sub ch, byte ss:[eax + 0x12]
cmp al, 0x71
lahf
pop ebp
lea ebx, [edi]
inc edi
jl 0x4df8b4
dec edi
leave
and dl, byte [esi + 0x6cb5b237]
push edi
loop 0x4df7f5
push esp
scasb al, byte es:[edi]
adc eax, edx
mov bl, cl
frstor dword [ebx]
mov al, cl
inc eax
sar byte [eax - 0x47f9ed47], cl
wait
cld
xor dword [edx + 0x22487b1], edx
mov dl, 0xd3
mov byte [0xa74d580d], al
jnp 0x4df8e7
adc al, 0xf3
inc eax
xchg edx, eax
cmp eax, esi
inc edx
hlt
adc bh, dl
push ss
loop 0x4df840
push 0xffffffffffffffd7
retf 0xf6
invalid

Function at 0x51e591
Capabilities:
Check for vm using instruction vpcext

Disassembly:
ficomp dword [ebp + 0x4a714fec]
pop edx
ret 0x2b25
js 0x51e548
mov dh, byte [edi - 0x72]
pop ss
cwde
nop
add bl, ch
invalid

Function at 0x51e712
Capabilities:
Encode data using xor

Disassembly:
mov bh, byte [edi - 0x47]
popfd
wait
lcall 0xa33e, 0xaa709051
and dh, byte [ecx]
jb 0x51e72d
push ecx
sti
mov ebx, 0x988a27a7
inc esi
mov edx, 0x6f59ba3a
pop ecx
outsd dx, dword [esi]
call 0x9bdb77c5
daa
or al, 0x62
bound eax, qword [edx + 0x404a4c71]
xor byte [ecx + 0x4c], 0x4a
inc eax
cdq
out 0xc4, al
xor ch, byte [edi + 0x35]
stosb byte es:[edi], al
insb byte es:[edi], dx
cli
mov edi, 0x1a86278a
aam 9
fmul st(5)
mov ebp, 0x174e4efc
cld
dec esp
stosb byte es:[edi], al
fdivrp st(4)
js 0x51e738
cwde
push 0x67
fnstcw word [edx - 0x3dd5fbac]
mov esi, 0x86e6f77e
push ds
lodsd eax, dword [esi]
xor cl, byte [ecx - 0x16]
dec ecx
mov al, byte [0x71e85dbc]
popfd
cmp byte [ecx - 0x10f475af], ch
retf 0x6e59
Function at 0x536a69
Capabilities:
Encode data using xor

Disassembly:
adc dword [eax], ecx
or bh, byte ds:[edi + 0x39]
enter 0x71fb, 0xfffffffffffffff9
loope 0x536ab5
hlt
mov cl, 0xcf
ja 0x536b31
cmpsd dword [esi], dword es:[edi]
xchg ecx, eax
aad 0x4c
mov ss, word [eax + 0x68f5f874]
pop esp
xchg esi, eax
ljmp 0x1de7
xchg ecx, eax
add eax, 0x13b2fafd
cmc
xchg dword [esi + 0x32], edx
invalid
push ebp
sub dl, byte [esi + 0x1a]
retf
pop eax
cwde
push 0xe7acb784
dec ecx
enter 0x22a4, 0xffffffffffffffd3
in al, dx
and cl, dl
jg 0x536b29
popfd
adc byte [edi + 0x46], bl
aas
and ch, byte [edx + 0x19b72b32]
aas
inc esi
jns 0x536b46
xchg edi, eax
cmp dword [0xbaacbb6c], ecx
out dx, al
xlatb
ja 0x536bd8
push esi
pop ss
salc
clc
cwde
or dl, byte [ebp + 0x596aba17]
salc
jp 0x536b1c
dec edx
enter 0x996, 0xffffffffffffffa6
cmc
cmpsb byte [esi], byte es:[edi]
pop ds
popfd
stc
mov eax, dword [0x7bf45a10]
xchg edi, eax
jnp 0x536b61
popal
scasd eax, dword es:[edi]
mov dword [0x151905a4], eax
sbb eax, 0x39c9fccd
popal
sub edx, dword [edi + 0x748a4786]
not dword [0x817493c6]
pop ecx
test dword [ecx], ebp
lds edi, [ecx + 0x6c0680b0]
imul byte [esi + 0x1b]
cmp bh, byte [esi + 0x448b2f74]
stosb byte es:[edi], al
mov bh, 0x84
inc ebp
lea edi, [esi - 0x32]
sal dh, 0x8f
popfd
push 0xffffffffffffff88
jecxz 0x536c1c
xchg ah, al
retf
test eax, 0x39d7a1d5
inc edx
lodsb al, byte [esi]
push ds
xchg dword [ecx], esp
loop 0x536c00
pop ebx
mov bh, 0x45
sub eax, 0x1810cc33
and al, 6
scasd eax, dword es:[edi]
test byte [eax], 0x99
out 0x97, al
fisub word [eax + esi*8 - 0x28]
test al, 0xd9
adc ah, 0x89
leave
jp 0x536c6a
insd dword es:[edi], dx
adc ah, byte [esi - 0x3d]
dec eax
sub byte [esi + 0x44], al
mov ecx, 0x6648b648
xor dword fs:[edi], 0x11
or eax, 0x5c421679
in al, dx
xchg edx, eax
inc ebx
shr byte [ecx - 0x918607a], 0x55
lahf
out 0xf6, eax
push ebp
in al, 4
popfd
jb 0x536c04
xlatb
pop ecx
push ebp
sbb byte [ebx - 0x12], bh
or byte [bx + di - 0xaf7], bl
mov esp, 0x238b67a8
pushfd
leave
fnstcw word [edi + 0x41e39827]
ror esp, cl
call 0x13fb190e
push 0x27
mov al, byte [ebx + 0x7c]
dec ebx
sub dword [ecx + 0x53113216], edi
fcom dword [esi - 0xc26c8d9]
out dx, eax
mov esp, 0x68681d33
or al, bh
fcom qword [esi - 0x77230c85]
push 0x3c
mov dword [edi], esi
jle 0x536cd0
mov byte [0x6dc03119], al
jbe 0x536c49
hlt
fcmovnu st(0), st(3)
retf
movsd dword es:[edi], dword [esi]
cmpsb byte [esi], byte es:[edi]
loopne 0x536c78
cmp ebp, dword [edi - 0x19813c59]
mov dh, 0x8a
mov eax, es
sbb edx, dword [ebx - 0x48672ec7]
inc esi
wait
cmp dword [eax + 0xf435664], 0xfffffff9
jmp 0xa4ea74ec
Function at 0x6578fd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x65f3e8
cmp edx, dword [eax]
je 0x65791f
add eax, 8
inc ecx
cmp eax, 0x65f478
jl 0x657910
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x65f3e8]
jne 0x657a4d
mov eax, dword [0xa5bdc4]
cmp eax, 1
je 0x657a27
test eax, eax
jne 0x657950
cmp dword [0x65f314], 1
je 0x657a27
cmp edx, 0xfc
je 0x657a4d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x657987
lea eax, [ebp - 0x1a4]
push 0x65ca20
push eax
call fcn.006582e0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00658770
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x6579ca
lea eax, [ebp - 0x1a4]
push eax
call fcn.00658770
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x65ca1c
push edi
call fcn.0065a640
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x65ca00
push eax
call fcn.006582e0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.006582f0
lea eax, [ebp - 0xa0]
push 0x65c9fc
push eax
call fcn.006582f0
push dword [esi + 0x65f3ec]
lea eax, [ebp - 0xa0]
push eax
call fcn.006582f0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x65c9d4
push eax
call fcn.0065a5b4
add esp, 0x2c
pop edi
jmp 0x657a4d
lea eax, [ebp + 8]
lea esi, [esi + 0x65f3ec]
push 0
push eax
push dword [esi]
call fcn.00658770
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x100011c0
Capabilities:
Inspect section memory permissions

Disassembly:
mov ecx, dword [ecx + 4]
jmp 0x100028a0
cmp dword [eax], ebx
je 0x100028c6
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x100028c1
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x100028ab
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x100028b3
cmp edx, ebx
jne 0x10002a01
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x10002882
add eax, dword [eax + 4]
jmp 0x1000286f
mov dword [ebp + 0xc], ebx
jmp 0x100028d1
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x100028e9
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x10002907
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x10002965
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x1000294c
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x10002955
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x1000295f
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x10002941
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x100028cb
mov dword [ebp + 8], esi
xor edi, edi
invalid
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x100029b2
dec eax
je 0x100029a9
sub eax, 3
je 0x100029a0
mov dword [ebp - 4], 0x40
jmp 0x100029cf
mov dword [ebp - 4], 4
jmp 0x100029b5
mov dword [ebp - 4], 0x20
jmp 0x100029b5
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x10002a01
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x10002981
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.10002212
mov esi, 0xff65a10c
jne 0x10002a0c
push 1
push esi
call edi
mov eax, esi
jmp 0x10002a0d
push 0x8000
push ebx
push esi
call dword [ebp - 8]
rcr byte [edi + 0x5e], 0x5b
Function at 0x10003110
Capabilities:
Contain obfuscated stackstrings

Disassembly:
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.100021f0
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte es:[ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.10002222
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.100021d7
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.10002212
enter 0x5b54, 0xffffffffffffffbf
push 0x104
lea eax, [ebp - 0x12c]
push eax
call dword [ebp - 0x3d4]

Function at 0x10003180
Capabilities:
Contain obfuscated stackstrings

Disassembly:
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.100021f0
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte es:[ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.10002222
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.100021d7
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.10002212
enter 0x5b54, 0xffffffffffffffbf
push 0x104
lea eax, [ebp - 0x12c]
push eax
call dword [ebp - 0x3d4]
Function at 0x1000d5a0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100182e0]
jne 0x1000d5aa
repz ret
jmp fcn.1000da08
Function at 0x401732
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0x80000000
mov dword [esp], 0x4473f0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
lea edx, [ebp - 0x1c]
mov esi, eax
sub esp, 0x1c
xor eax, eax
cmp esi, 0xffffffff
jne 0x4017c7
jmp 0x4017da
mov dword [esp + 0xc], edx
mov dword [ebp - 0x2c], edx
mov dword [esp + 0x10], 0
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [ebp - 0x2c]
sub esp, 0x14
test eax, eax
je 0x4017cb
mov eax, dword [ebp - 0x1c]
add edi, eax
sub ebx, eax
test ebx, ebx
jg 0x401796
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
push ecx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x401840
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x26aa
xor edx, edx
mov dword [esp + 0x28], 0x5c
mov dword [esp + 0x24], 0x65
mov dword [esp + 0x20], 0x70
mov dword [esp + 0x1c], 0x69
mov dword [esp + 0x18], 0x70
div ecx
mov dword [esp + 0x14], 0x5c
mov dword [esp + 0x10], 0x2e
mov dword [esp + 0xc], 0x5c
mov dword [esp + 8], 0x5c
mov dword [esp + 4], 0x446044
mov dword [esp], 0x4473f0
mov dword [esp + 0x2c], edx
call sub.msvcrt.dll_sprintf
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x401713
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp + 8], 0
sub esp, 0x18
leave
jmp fcn.004017e2

Function at 0x401e50
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
lea ebx, [esp + 0x24]
mov dword [esp + 4], 1
mov dword [esp], 0x4461dc
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.00401eb0
Function at 0x401eb0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, ecx
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x6c
mov ecx, dword [0x447058]
mov dword [esp + 0x1c], edx
test ecx, ecx
jle 0x402092
mov eax, dword [0x447054]
xor esi, esi
mov edx, dword [eax + 4]
cmp ebx, edx
jb 0x401ee9
mov edi, dword [eax + 8]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x401fc0
add esi, 1
add eax, 0xc
cmp esi, ecx
jne 0x401ed4
mov dword [esp], ebx
call fcn.004024b0
test eax, eax
mov edi, eax
je 0x4020b9
lea edx, [esi + esi*2]
mov esi, dword [0x447054]
shl edx, 2
add esi, edx
mov dword [esi + 8], eax
mov dword [esi], 0
mov dword [esp + 0x18], edx
call fcn.00402590
mov edx, dword [esp + 0x18]
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x40]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov dword [esp + 4], eax
mov eax, dword [0x447054]
mov dword [esp + 8], 0x1c
mov eax, dword [eax + edx + 4]
mov dword [esp], eax
call esi
sub esp, 0xc
test eax, eax
mov edx, dword [esp + 0x18]
je 0x402099
mov eax, dword [esp + 0x54]
cmp eax, 4
jne 0x402041
add dword [0x447058], 1
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call esi
sub esp, 0xc
test eax, eax
je 0x4020c9
mov eax, dword [esp + 0x38]
cmp eax, 4
jne 0x401fc8
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], ebp
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_memcpy
add esp, 0x6c
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_VirtualQuery]
jmp 0x401f76
cmp eax, 0x40
je 0x401f9f
mov eax, dword [esp + 0x30]
lea edi, [esp + 0x5c]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call esi
sub esp, 0x10
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], ebp
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_memcpy
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x401fb3
cmp eax, 4
je 0x401fb3
mov eax, dword [esp + 0x5c]
mov dword [esp + 0xc], edi
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call esi
sub esp, 0x10
add esp, 0x6c
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 0x40
je 0x401f6f
mov eax, dword [esp + 0x4c]
add edx, dword [0x447054]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0xc], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x401f6f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], 0x44624c
mov dword [esp + 4], eax
call fcn.00401e50
xor esi, esi
jmp 0x401ef3
mov eax, dword [0x447054]
mov eax, dword [eax + edx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], 0x446218
mov dword [esp + 4], eax
call fcn.00401e50
mov dword [esp + 4], ebx
mov dword [esp], 0x4461f8
call fcn.00401e50
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], 0x446218
call fcn.00401e50
jmp fcn.004020f0
Function at 0x4023a0
Capabilities:
Parse pe header

Disassembly:
mov edx, dword [esp + 4]
xor eax, eax
cmp word [edx], 0x5a4d
je 0x4023b0
repz ret
add edx, dword [edx + 0x3c]
cmp dword [edx], 0x4550
jne 0x4023ad
xor eax, eax
cmp word [edx + 0x18], 0x10b
sete al
ret
Function at 0x401340
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [0x481340]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, 0xc142a2cd
mov esi, 0xc707d862
mov edi, 0x5b8901de
jmp 0x401390
mov eax, dword [ebp - 0x18]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
xor al, 0xfe
test al, bl
setne byte [ebp - 0x12]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, 0x63b7d940
nop word [eax + eax]
cmp eax, 0x2cfec9da
jg 0x4013d0
cmp eax, 0xc707d861
jle 0x401410
cmp eax, 0xe9e6633f
jg 0x4014a3
cmp eax, 0xc707d862
je 0x401509
cmp eax, 0xd22e0f7f
jne 0x401390
mov eax, 0x832088a3
mov bl, 1
jmp 0x401390
cmp eax, 0x55537913
jle 0x401470
cmp eax, 0x5b8901dd
jg 0x4014e2
cmp eax, 0x55537914
je 0x401513
cmp eax, 0x5aa52e11
jne 0x401390
cmp byte [ebp - 0x11], 0
mov eax, 0x2faf0ca1
cmovne eax, edi
jmp 0x401390
cmp eax, 0x832088a3
je 0x401536
cmp eax, 0xa1fbbd15
je 0x401540
cmp eax, 0xc142a2cd
jne 0x401390
push eax
mov eax, esp
mov dword [ebp - 0x18], eax
sub esp, 0x10
mov eax, esp
mov dword [ebp - 0x1c], eax
sub esp, 8
mov eax, esp
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov dword [eax], 0
mov eax, dword [ebp - 0x1c]
mov eax, 0x1b66514e
xor ebx, ebx
jmp 0x401390
cmp eax, 0x2cfec9db
je 0x401364
cmp eax, 0x2faf0ca1
je 0x40156a
cmp eax, 0x41ffdf71
jne 0x401390
cmp dword [ebp - 0x24], 0
setne byte [ebp - 0x11]
mov eax, 0x5aa52e11
jmp 0x401390
cmp eax, 0xe9e66340
je 0x401574
cmp eax, 0x1b66514e
jne 0x401390
mov eax, dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push dword [ebp - 0x18]
push 0x20
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
mov eax, 0xe9e66340
mov ecx, 0x2cfec9db
cmove eax, ecx
jmp 0x401390
cmp eax, 0x5b8901de
jne 0x401591
mov eax, dword [ebp - 0x1c]
mov dword [eax], 1
mov eax, dword [ebp - 0x1c]
add eax, 4
mov dword [ebp - 0x28], eax
mov eax, 0xa1fbbd15
jmp 0x401390
mov eax, 0x2faf0ca1
jmp 0x401390
push 0
push 0
push 0
push dword [ebp - 0x1c]
push 0
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
mov eax, 0xd22e0f7f
cmove eax, esi
jmp 0x401390
mov eax, 0xc707d862
jmp 0x401390
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x20]
movsd xmm0, qword [ecx]
movsd qword [eax], xmm0
mov eax, dword [ebp - 0x1c]
mov dword [eax + 0xc], 2
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov eax, 0x55537914
jmp 0x401390
mov eax, 0x2cfec9db
jmp 0x401390
push dword [ebp - 0x20]
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov dword [ebp - 0x24], eax
mov eax, 0x41ffdf71
jmp 0x401390
cmp eax, 0x63b7d940
jne 0x401390
movzx ebx, byte [ebp - 0x12]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00446e61
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret