joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100050a5
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x28
push ebx
mov ebx, dword [esp + 0x38]
xor eax, eax
push ebp
mov dword [esp + 8], eax
push 4
lea eax, [ebx + 0x130]
mov dword [esp + 0x20], edx
push eax
lea eax, [esp + 0x30]
mov dword [esp + 0x14], ecx
push eax
call fcn.10004a35
push 4
lea eax, [ebx + 0x138]
push eax
lea eax, [esp + 0x40]
push eax
call fcn.10004a35
mov edx, dword [esp + 0x24]
add esp, 0x18
xor ebx, ebx
mov ebp, edx
xor eax, eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
push esi
mov dword [esp + 0x1c], eax
push edi
nop dword [eax + eax]
mov eax, edx
lea ecx, [ebp + 1]
mov edx, dword [esp + 0x24]
sub eax, ebp
add edx, 0xfffffff0
mov dword [esp + 0x2c], ecx
xor edi, edi
add eax, edx
mov dword [esp + 0x28], eax
je 0x10005225
lea esi, [esp + 0x30]
sub esi, ecx
lea ebp, [edi + ecx]
xor edx, edx
mov eax, ebp
nop dword [eax]
mov cl, byte [esi + eax]
cmp byte [eax], cl
je 0x10005145
cmp cl, 0x3f
jne 0x100051c6
inc edx
inc eax
cmp edx, 8
jb 0x10005135
test ebp, ebp
je 0x10005225
mov ecx, dword [ebp]
lea edi, [ebp + 8]
mov eax, ecx
shr eax, 8
movzx esi, al
movzx eax, cl
shl eax, 8
add esi, eax
mov eax, ecx
shr eax, 0x10
shl esi, 8
movzx eax, al
add esi, eax
shr ecx, 0x18
mov eax, dword [edi]
shl esi, 8
add esi, ecx
mov ecx, dword [esp + 0x44]
cmp eax, dword [ecx + 0x10]
jne 0x100051d7
test ebx, ebx
jne 0x100051e3
mov eax, dword [edi + 8]
add eax, 0x10
mov dword [esp + 0x20], edi
push eax
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x44]
push 0x40
mov eax, dword [eax + 0x54]
call eax
push esi
mov ebx, eax
push edi
push ebx
mov dword [esp + 0x24], ebx
call fcn.10004a35
mov edx, dword [esp + 0x20]
add esp, 0xc
add dword [esp + 0x10], esi
jmp 0x10005105
inc edi
dec esi
cmp edi, dword [esp + 0x28]
jae 0x10005225
mov ecx, dword [esp + 0x2c]
jmp 0x1000512b
mov edx, dword [esp + 0x14]
test ebx, ebx
je 0x10005105
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
add eax, edx
lea ebx, [esi + edx]
cmp ebx, ecx
ja 0x10005214
push esi
push edi
push eax
call fcn.10004a35
mov edx, dword [esp + 0x20]
add esp, 0xc
mov dword [esp + 0x10], ebx
mov ebx, dword [esp + 0x18]
jmp 0x10005105
sub ecx, edx
push ecx
push edi
push eax
call fcn.10004a35
mov ebx, dword [esp + 0x24]
add esp, 0xc
pop edi
pop esi
test ebx, ebx
jne 0x10005235
pop ebp
xor al, al
pop ebx
add esp, 0x28
ret 0xc
mov eax, dword [esp + 0x18]
mov edx, dword [eax + 4]
mov eax, dword [eax + 8]
test al, 3
je 0x1000524a
nop
dec eax
test al, 3
jne 0x10005245
xor ecx, ecx
test eax, eax
je 0x10005260
nop dword [eax + eax]
xor dword [ebx + ecx + 0x10], edx
add ecx, 4
cmp ecx, eax
jb 0x10005255
mov eax, dword [esp + 0x34]
cmp dword [esp + 8], 0
pop ebp
mov dword [eax], ebx
setne al
pop ebx
add esp, 0x28
ret 0xc
Function at 0x100063e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 8
push ebx
mov dword [eax], 0
cmp dword [0x100d33d0], 0
push esi
je 0x1000643d
mov eax, dword [0x100d8cc0]
test eax, eax
je 0x1000640d
push eax
call dword [0x100d3428]
add esp, 4
lea ebx, [ebp - 4]
mov eax, 0x14
call fcn.10003ca0
mov eax, dword [0x100d8cc0]
test eax, eax
je 0x1000642d
push eax
call dword [0x100d3430]
add esp, 4
mov esi, dword [ebp - 4]
test esi, esi
jne 0x1000644c
lea eax, [esi + 7]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x14
call dword [0x100d33f8]
add esp, 4
mov esi, eax
jmp 0x10006430
cmp dword [0x100d33d4], 0
je 0x10006493
mov eax, dword [0x100d34d8]
test eax, eax
je 0x1000646c
push 0xc8
call eax
add esp, 4
test eax, eax
jne 0x10006493
mov ecx, dword [ebp + 0xc]
lea edx, [esi + 4]
push edx
push 0
push esi
push 0x100063b0
push 0
push 0
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edi
call fcn.100a48ec
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x100064a3
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
cmp dword [esi + 8], 0
jne 0x100064bc
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push edi
mov dword [esi + 4], eax
call dword [ebp + 0xc]
add esp, 4
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 8]
mov dword [eax], esi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10008530
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, eax
mov esi, dword [edi + 0xc]
test esi, esi
je 0x10008579
mov edx, dword [ebp + 8]
mov cl, byte [edx]
xor eax, eax
test cl, cl
je 0x1000856c
jmp 0x10008550
movzx ecx, cl
movzx ecx, byte [ecx + 0x100b8af0]
lea ebx, [eax*8]
xor ecx, ebx
inc edx
xor eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x10008550
xor edx, edx
div dword [edi]
mov eax, dword [esi + edx*8 + 4]
mov esi, dword [esi + edx*8]
jmp 0x10008581
mov eax, dword [edi + 8]
mov esi, dword [edi + 4]
xor edx, edx
mov ecx, dword [ebp + 0xc]
mov dword [ecx], edx
test esi, esi
je 0x100085f1
mov edx, dword [ebp + 8]
movzx ecx, byte [edx]
movzx edx, byte [ecx + 0x100b8af0]
mov dword [ebp + 0xc], edx
lea ebx, [ebx]
mov edx, dword [eax + 0xc]
mov bl, byte [edx]
movzx ecx, bl
movzx ecx, byte [ecx + 0x100b8af0]
dec esi
sub ecx, dword [ebp + 0xc]
mov dword [ebp - 4], esi
jne 0x100085e8
mov esi, dword [ebp + 8]
sub esi, edx
lea ecx, [ecx]
test bl, bl
je 0x100085e4
movzx ecx, byte [esi + edx + 1]
movzx edi, byte [ecx + 0x100b8af0]
mov bl, byte [edx + 1]
inc edx
movzx ecx, bl
movzx ecx, byte [ecx + 0x100b8af0]
sub ecx, edi
je 0x100085c0
jmp 0x100085e8
test ecx, ecx
je 0x100085f3
mov esi, dword [ebp - 4]
mov eax, dword [eax]
test esi, esi
jne 0x100085a0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10008640
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
push esi
push edi
push ebx
sub esp, 0x494
mov eax, dword fs:[0x30]
mov eax, dword [0x30]
mov esi, dword [eax + 0xc]
add esi, 0xc
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x4e39b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6a000]
push edi
or ebp, 0xffffffff
jmp 0x4e39d2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4e39d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e39c8
mov eax, 1
add ebx, ebx
jne 0x4e39eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4e39fc
jne 0x4e3a0c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e3a0c
dec eax
add ebx, ebx
jne 0x4e3a08
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4e39e0
xor ecx, ecx
sub eax, 3
jb 0x4e3a24
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4e3a96
sar eax, 1
mov ebp, eax
jmp 0x4e3a2f
add ebx, ebx
jne 0x4e3a2f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4e3a3c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4e3a60
inc ecx
add ebx, ebx
jne 0x4e3a4c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4e3a41
jne 0x4e3a5d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4e3a41
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4e3a80
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4e3a71
jmp 0x4e39ce
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4e3a80
add edi, ecx
jmp 0x4e39ce
pop esi
mov edi, esi
mov ecx, 0x1b7
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4e3a9e
cmp byte [edi], 6
jne 0x4e3a9e
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x4e3aa3
lea edi, [esi + 0xe1000]
mov eax, dword [edi]
or eax, eax
je 0x4e3b12
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xe4f84]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xe4fe8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4e3ad0
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xe4fec]
or eax, eax
je 0x4e3b0c
mov dword [ebx], eax
add ebx, 4
jmp 0x4e3aed
call dword [esi + 0xe4ff0]
popal
jmp 0x401f20
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x41ff02
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x41ff11
pop dword [ebp - 0x18]
mov eax, 0x41ff11
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x315f4e57
sub dword [ebp - 0x28], 0xe30d090c
mov dword [ebp - 0x24], 0x5a57cfec
add dword [ebp - 0x24], 0xd7db7c59
mov dword [ebp - 0x20], 0xc54de38c
add dword [ebp - 0x20], 0x86fe60a2
mov dword [ebp - 0x1c], 0x680352f2
sub dword [ebp - 0x1c], 0x680352f2
lea eax, [ebp - 0x28]
push eax
mov eax, 0xbfa2b77d
add eax, 0x409f78f7
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x4d839fd2
sub dword [ebp - 0x28], 0xd911367c
mov dword [ebp - 0x24], 0x6c4ef5ad
add dword [ebp - 0x24], 0xd51d6bc8
mov dword [ebp - 0x20], 0x59669fea
sub dword [ebp - 0x20], 0xf5f7337e
mov dword [ebp - 0x1c], 0xe84dad05
add dword [ebp - 0x1c], 0x17b252fb
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0x38aa7d86
sub eax, 0x38684c62
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x4327b
push 0
call eax
mov ecx, 0x33c102fb
sub ecx, 0x33c0a534
xor esi, esi
add esi, eax
mov edi, 0x856127b3
sub edi, 0x851de3b3
add edi, dword [ebp - 0x18]
mov ebx, 0x521a0c89
add ebx, 0x891367be
xor dword [ebp - 0xc], 0xfe0781a1
mov edx, dword [edi]
xor dword [ebp - 0xc], 0x6c98cdee
xor edx, ebx
mov dword [esi], edx
add esi, 4
add edi, 0x5f0f8a97
add edi, 0xa0f0756d
loop 0x420030
add eax, 0x169ef
mov ebx, eax
add eax, 0xca87993b
sub eax, 0xca879936
mov ecx, 0x400000
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x4672c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x417015
lea edi, [esi - 0x16015]
push edi
jmp 0x4672da
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4672e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4672d0
mov eax, 1
add ebx, ebx
jne 0x4672f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x467304
jne 0x467323
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x467323
dec eax
add ebx, ebx
jne 0x467310
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4672e8
add ebx, ebx
jne 0x46731f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x467375
xor ecx, ecx
sub eax, 3
jb 0x46733b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4673aa
sar eax, 1
mov ebp, eax
jmp 0x467346
add ebx, ebx
jne 0x467346
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x467314
inc ecx
add ebx, ebx
jne 0x467354
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x467314
add ebx, ebx
jne 0x467361
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x467356
jne 0x467372
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x467356
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x467394
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x467386
jmp 0x4672d6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x467394
add edi, ecx
jmp 0x4672d6
pop esi
mov edi, esi
mov ecx, 4
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4673b2
cmp byte [edi], 1
jne 0x4673b2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4673b7
mov ebp, dword [esi + 0x676d4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x467412
sub esp, 0xffffff80
jmp 0x407c28
Function at 0x412d80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UzBUtnck
lea edi, [esi - 0xe000]
push edi
or ebp, 0xffffffff
jmp 0x412da2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x412da9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x412d98
mov eax, 1
add ebx, ebx
jne 0x412dbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x412db0
jne 0x412dcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x412db0
xor ecx, ecx
sub eax, 3
jb 0x412de0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x412e52
mov ebp, eax
add ebx, ebx
jne 0x412deb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x412df8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x412e1c
inc ecx
add ebx, ebx
jne 0x412e08
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x412dfd
jne 0x412e19
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x412dfd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x412e3c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x412e2d
jmp 0x412d9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x412e3c
add edi, ecx
jmp 0x412d9e
pop esi
mov edi, esi
mov ecx, 0x2ad
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x412e5a
cmp byte [edi], 0
jne 0x412e5a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x412e5f
lea edi, [esi + 0x10000]
mov eax, dword [edi]
or eax, eax
je 0x412ece
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x120b0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1211c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x412e8c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x12124]
or eax, eax
je 0x412ec8
mov dword [ebx], eax
add ebx, 4
jmp 0x412ea9
call dword [esi + 0x12120]
mov ebp, dword [esi + 0x12128]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x412f02
sub esp, 0xffffff80
jmp 0x406f9c

Function at 0x438caa
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x438a14
or edx, esi
dec esi
push esi
mov esi, dword [esp]
add esp, 4
call fcn.00438cf7
sub esi, edx
xor dword [ebx], eax
sub edx, 1
sub edx, esi
add ebx, 1
sub edx, esi
sub esi, 0x88714514
add edx, 0x869248a1
cmp ebx, edi
jne fcn.00438caa
sub esi, 1
sub esi, esi
and edx, esi
ret
Function at 0x403a6d
Capabilities:
Encode data using xor

Disassembly:
pop esi
push esi
xor dword [esi], ebx
lodsd eax, dword [esi]
add ebx, eax
test eax, eax
jne 0x403a6f
ret

Function at 0x406fe9
Capabilities:
Set socket configuration

Disassembly:
scasd eax, dword es:[edi]
dec edi
jne 0x5340707d
push esi
call dword [sym.imp.WSOCK32.dll_inet_addr]
mov dword [ebp - 8], eax
pop edi
inc ebp
clc
lea ecx, [ebp - 0x5c]
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x438cab
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x438a14
and eax, edi
push 0x9d6ccc82
mov eax, dword [esp]
add esp, 4
or edi, edi
call fcn.00438ceb
and eax, edi
xor dword [ebx], ecx
add edi, 1
mov eax, 0xfcd5eca3
mov edi, edi
inc ebx
and edi, edi
sub edi, eax
dec eax
cmp ebx, edx
jne fcn.00438cab
push eax
mov eax, dword [esp]
add esp, 4
ret
Function at 0x7dbf10
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x7f09fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [esp + 0x2c]
xor ebp, ebp
mov dword [esp + 0x10], eax
xor ebx, ebx
mov eax, 1
mov ecx, ebx
shl eax, cl
mov ecx, dword [esp + 0x10]
test ecx, eax
je 0x7dc002
lea edx, [ebx + 0x41]
lea eax, [esp + 0x14]
push edx
push str._c:_
push eax
call fcn.007dfdff
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x7dc002
lea edx, [esp + 0x14]
push edx
push 0x7f6140
call fcn.007d76e0
lea eax, [esp + 0x1c]
lea edi, [esi + 0x1048]
push eax
push edi
mov word [esp + 0x28], bp
call fcn.007e020b
push 0x10
call fcn.007e01d3
add esp, 0x14
mov dword [esp + 0x2c], eax
cmp eax, ebp
mov dword [esp + 0x24], ebp
je 0x7dbfc5
mov cx, word [edi]
push ecx
mov ecx, eax
call fcn.007cc1c0
jmp 0x7dbfc7
xor eax, eax
push esi
mov dword [esp + 0x28], 0xffffffff
mov dword [esi], eax
call fcn.007dbb80
mov edi, dword [esi]
add esp, 4
cmp edi, ebp
je 0x7dbff0
mov ecx, edi
call fcn.007cc2c0
push edi
call fcn.007e01c8
add esp, 4
mov edx, dword [esi + 0x1024]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x7dc021
inc ebx
cmp ebx, 0x20
jb 0x7dbf3e
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x7df1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.007df140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.007df140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.007df140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.007df140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x7df230
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x20c
lea eax, [esp]
push ebx
mov ebx, dword [esp + 0x218]
push ebp
mov ebp, dword [esp + 0x218]
push esi
push eax
push 0xf003f
push 0
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x7df2d6
mov edx, dword [esp + 0xc]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
lea ecx, [esp + 0x14]
push 0x104
push ecx
push eax
push edx
call edi
mov esi, eax
test esi, esi
jne 0x7df2ae
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push ecx
call fcn.007df230
mov esi, eax
add esp, 8
test esi, esi
jne 0x7df2ae
lea edx, [esp + 0x14]
push 0x104
push edx
push eax
mov eax, dword [esp + 0x1c]
push eax
call edi
mov esi, eax
test esi, esi
je 0x7df27e
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 0x103
pop edi
je 0x7df2ce
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x20c
ret
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop esi
pop ebp
pop ebx
add esp, 0x20c
ret

Function at 0x7dfbfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x7dfc50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x7f187c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x7dfc43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x7dfc52
xor eax, eax
pop esi
leave
ret 4