joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4aeda5
Capabilities:
Encode data using xor

Disassembly:
and byte [eax + 0x612a5e24], al
push es
add dl, bh
cmpsb byte [esi], byte es:[edi]
push cs
in al, 7
sub ecx, ecx
bound esi, qword [ebx]
xor byte [edx + 0x40], ah
mov byte [ebx + 0x11d27dc0], dh
or bh, byte [ecx + 0xb]
je 0x4aee0b
and bh, byte [edx]
mov cl, 0xe6
popal
mov byte [edx], cl
inc ecx
in eax, 0xf0
and al, 0x44
inc ebp
sub ecx, dword [edi + 0x2349a257]
invalid
outsb dx, byte [esi]
jo 0x4aee41
xor edx, dword [ecx]
test dword [esi + 0x7b], esi
invalid
adc dword [ebp + 0x2cc77b76], eax
xor dword [ecx], ecx
ficomp dword [edi - 0x6619142a]
xor eax, 0xaac1b0e
xor dh, byte [esi]
pop esp
or esi, dword [edx]
mov bl, 0xcf
mul dh
stc
dec edi
mov edx, 0xf0fc5377
and ah, byte [eax + esi*2 - 0x11]
je 0x4aee0d
inc eax
push esi
xchg edi, eax
pop ss
dec esp
not ah
and ah, byte [edx + 0x27]
adc ch, 0xc7
mul byte [ebx + 0x6b]
and dh, byte [edx - 0x55ede192]
invalid

Function at 0x5f500d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x5fd3d0
cmp edx, dword [eax]
je 0x5f502f
add eax, 8
inc ecx
cmp eax, 0x5fd460
jl 0x5f5020
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x5fd3d0]
jne 0x5f515d
mov eax, dword [0x601d5c]
cmp eax, 1
je 0x5f5137
test eax, eax
jne 0x5f5060
cmp dword [0x5fd2fc], 1
je 0x5f5137
cmp edx, 0xfc
je 0x5f515d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x5f5097
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.005f59f0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.005f5e80
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x5f50da
lea eax, [ebp - 0x1a4]
push eax
call fcn.005f5e80
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x5fa794
push edi
call fcn.005f7d50
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.005f59f0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.005f5a00
lea eax, [ebp - 0xa0]
push 0x5fa774
push eax
call fcn.005f5a00
push dword [esi + 0x5fd3d4]
lea eax, [ebp - 0xa0]
push eax
call fcn.005f5a00
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.005f7cc4
add esp, 0x2c
pop edi
jmp 0x5f515d
lea eax, [ebp + 8]
lea esi, [esi + 0x5fd3d4]
push 0
push eax
push dword [esi]
call fcn.005f5e80
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x418100
Capabilities:
Get common file path

Disassembly:
sub esp, 0x218
mov eax, dword [0x425044]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push 0x206
lea eax, [esp + 0xe]
push 0
push eax
mov word [esp + 0x14], 0
call fcn.00405a30
add esp, 0xc
push 0x104
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
movzx edx, word [esp + 8]
sub edx, 0x41
lea ebx, [esp + 4]
call fcn.00414a90
mov ebx, dword [esp + 4]
call fcn.00414b90
cmp eax, 0xffffffff
jne 0x41817f
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.0040113c
add esp, 0x218
ret
push esi
call fcn.00417ed0
mov ecx, dword [esp + 0x218]
add esp, 4
pop ebx
xor ecx, esp
call fcn.0040113c
add esp, 0x218
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x44f010
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x43d015
lea edi, [esi - 0x3c015]
push edi
jmp 0x44f02a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x44f031
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x44f020
mov eax, 1
add ebx, ebx
jne 0x44f043
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x44f054
jne 0x44f073
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x44f073
dec eax
add ebx, ebx
jne 0x44f060
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x44f038
add ebx, ebx
jne 0x44f06f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x44f0c5
xor ecx, ecx
sub eax, 3
jb 0x44f08b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x44f0fa
sar eax, 1
mov ebp, eax
jmp 0x44f096
add ebx, ebx
jne 0x44f096
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x44f064
inc ecx
add ebx, ebx
jne 0x44f0a4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x44f064
add ebx, ebx
jne 0x44f0b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x44f0a6
jne 0x44f0c2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x44f0a6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x44f0e4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x44f0d6
jmp 0x44f026
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x44f0e4
add edi, ecx
jmp 0x44f026
pop esi
mov edi, esi
mov ecx, 0x1353
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x44f102
cmp byte [edi], 0xa
jne 0x44f102
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x44f107
lea edi, [esi + 0x4d000]
mov eax, dword [edi]
or eax, eax
je 0x44f176
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x557e4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x55834]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x44f134
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x55838]
or eax, eax
je 0x44f170
mov dword [ebx], eax
add ebx, 4
jmp 0x44f151
call dword [esi + 0x55848]
mov ebp, dword [esi + 0x5583c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x44f1aa
sub esp, 0xffffff80
jmp 0x401240

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x424dd2
Capabilities:
Encode data using xor

Disassembly:
add ebp, dword [ecx - 0x5d]
leave
sub ecx, 0x2b
inc ecx
sbb edi, dword [ebp - 0x258c299]
cmpsd dword [esi], dword es:[edi]
std
cmp eax, 0xfda73d67
std
daa
jge 0x424cca
out 0xbd, eax
xor eax, 0xf5aff5af
mov ebp, 0xf5af3567
scasd eax, dword es:[edi]
cmc
outsd dx, dword [esi]
xor eax, 0xf5af356f
das
jne 0x424ce2
mov ch, 0x6f
xor eax, 0x1baff5af
pcmpgtw mm5, qword [edi + 0x2fe58fc5]
inc ebp
pcmpgtw mm2, qword [edx]
inc ecx
adc ch, byte [ebp + 0x52]
sbb dword [ebx], eax
sub byte [edi + 0x27688b68], ch
test al, 0xe3
imul edx, dword [edx], 0x51391155
rcl dword [ecx + 0x19]
xlatb
push 0x33
push 0xffffffffffffffcf
stosb byte es:[edi], al
stosd dword es:[edi], eax
stosb byte es:[edi], al
or dword [ecx], esp
scasb al, byte es:[edi]
stc
salc
adc dword [esi - 0x4d773aef], esi
cwde
xchg dword [eax - 0x66e6b5e7], edx
pop ecx
sbb esp, dword [edi]
add eax, 0x1a1a251a
insd dword es:[edi], dx
wait
das
mov al, byte [0xd25ea523]
xchg edi, eax
cwde
push edi
and edi, dword [ebp + 0x5a]
test al, 0x57
fisttp dword [ebp - 0x7f1c2e26]
jecxz 0x424cdf
arpl word [ebx], sp
popal
sbb al, 0x17
and esp, dword [ecx + 0x1c]
pop ss
and al, 0x1a
mov dword [0xf79a39c], eax
lcall 0x99e3, 0x4ba93fe3
or ebx, edx
invalid
pushal
sbb dword [ecx + esi*8], ebx
cmc
aas
loopne 0x424d09
pop ds
pop ebp
and ebp, dword [ecx + 0xb]
pop ebp
or edx, dword [ecx - 0x265cb8e3]
sar byte [edi + ebx*8 + 0x2b99e3a3], 0x69
mov edi, eax
sbb eax, 0xa3996030
cmp eax, 0x9928f345
sub eax, 0x8bd9a393
mov al, 0x89
mov al, 0xc9
sbb dword [ebx], esp
pop ecx
and bl, bh
xor bl, 0x50
sub eax, 0x5abb5923
arpl word [ebx + 0x6f], sp
cdq
mov dword [0xe359605c], eax
cdq
mov edi, edx
jge 0x424e1f
xchg ecx, eax
sbb eax, 0xc0d9a347
mov esp, 0x99e3a3df
sub ebp, dword [ecx - 0x77]
invalid
and ebx, dword [ecx + 0x63]
jne 0x424d59
dec ebp
xlatb
fnsave dword [esi - 0x42]
xchg esi, eax
push edi
mov byte [0xf9fe59f9], al
push es
mov esp, 0x64db59c5
cmc
or dword [ebx + 4], edx
jecxz 0x424d7a
xchg ah, dh
or al, 0x91
mov dword [0xe04eb75a], eax
wait
dec esi
loopne 0x424d89
adc ebx, dword [ebx + eax]
sal edi, 1
js 0x424e4c
dec edx
adc dword [ebp - 0x7d], ebp
or byte [edx - 0xc], ah
add cl, byte [eax + 0x40]
dec eax
and eax, 0x798782
mov cl, 0xe5
mov dl, 0x9d
push ss
movsb byte es:[edi], byte [esi]
mov edi, 0x9a79628c
in eax, dx
xor ah, byte [esi + eax*2 - 0x50305d6c]
hlt
mov byte [0x62218203], al
add ecx, dword [ecx - 0x3f]
push 0xe25b2186
test dh, dh
dec edi
test eax, 0x7ea58a2a
and eax, 0xd3ff056c
retf
rol dword [ebp + 4], 0xb8
add dword [ebx + 0xb4e0536], 0xffffffbc
add eax, 0x5e6c1dc
inc edx
jecxz 0x424deb
shl dword [edx - 0x3487375b], 1
adc byte [edx - 0x326c9de0], dl
lds edx, [edi + 0x2ce7f046]
sti
pushal
les esp, [ebx - 0x75f504dd]
pminub mm7, mm0
mov bl, 0x98
mov eax, dword [0xee360891]
ret
Function at 0x451cd2
Capabilities:
Encode data using xor

Disassembly:
mov al, 0x3e
mov dl, 0x4c
arpl word [ebp - 0x2a28b284], cx
dec esp
mov al, byte fs:[0x3195218c]
xor eax, 0x3164c57
adc dl, byte [esi - 0x71]
xor ah, byte [eax + 0x1e]
popal
hlt
jge 0x451c6e
and byte [edi - 0xf03cdfe], bh
inc esi
in eax, dx
insb byte es:[edi], dx
sub eax, 0x11ee5aab
outsb dx, byte [esi]
dec esp
adc dword [esi + 0x4c], ebp
inc ecx
push eax
cmp byte [esp + edi*8 + 0x2d], dh
jne 0x451cdf
jge 0x451d24
sti
or cl, byte [eax]
or eax, 0xc644eb7
add al, 0x5b
mov ebp, 0x34bc648a
push esi
mov esi, 0x2d95aab4
mov ebp, 0x8f5d551a
push esp
and bh, byte [eax + 0xcab0634]
add ch, byte [ebx + edx*8 + 0x4f70f882]
jge 0x451cd0
std
and esp, dword [esi + 0x660cf1a6]
cmp al, 0x81
lodsb al, byte [esi]
invalid
into
pop edi
das
xor eax, 0x5e1bf853
not ah
xchg dword [0xbdcd5e23], ebx
jo 0x451d26
xchg ecx, eax
push edi
popal
in eax, 0xef
mov ecx, 0x87063b52
pop ebx
bound edi, qword [ebp + 0x479795e9]
out 0x88, al
cmp dword [ecx], esi
mov edx, 0x44eec942
push edx
invalid

Function at 0x45a5b2
Capabilities:
Encode data using xor

Disassembly:
xchg edx, eax
cmp al, 0x8a
rcr ah, cl
inc edi
das
add al, 0xe
stosd dword es:[edi], eax
or bh, byte [edx + eax*4 + 0x2bca3a4f]
dec ebp
lodsd eax, dword [esi]
xchg esi, eax
aad 0xfa
pop esp
jne 0x45a5e1
arpl bp, dx
lodsb al, byte [esi]
mov edi, edx
and byte [ebx - 0x6316d6f0], ch
or al, ch
retf 0xfed2
cmp bh, byte [ebx]
test eax, 0x7a0cc6b
xor eax, 0xaaecff1e
add dword [eax + 0x1c5b4e6f], esi
invalid
Function at 0x484b32
Capabilities:
Encode data using xor

Disassembly:
and al, 0x2f
xchg edx, eax
fcomp qword [ebx]
xor cl, bl
add bl, byte [ebx - 0x4f]
dec ebp
stc
adc eax, 0xa06b4c85
idiv byte [eax - 0x64]
add al, 0xed
jbe 0x484ab8
invalid
mov dword [ebp - 0x3812924f], edx
sub eax, dword [ebx - 0x1b]
imul al
sub eax, 0xcd80ce2d
or ecx, dword [edi + 0x2d]
sub al, 0xf7
mov esi, 0x2ee6fc9d
int 0xb
dec edi
sub eax, 0x9dbef72c
cld
out 0x2e, al
sub eax, 0xc7a8bf95
insd dword es:[edi], dx
sahf
insd dword es:[edi], dx
cld
out dx, al
jecxz 0x484ab5
inc edi
push eax
mov esp, 0x33ccb3d7
or eax, 0xbdbd65aa
dec esi
fisub dword [ebp - 0x21]
push eax
pop ebx
xchg esp, eax
and ch, byte [ecx + 0x61]
lea esp, [ebx + 0x52]
stc
cmp eax, 0x3c904db6
mov edx, 0xe080a422
mov edi, 0x3d948437
leave
les edi, [esi - 0x78]
mov byte [ebx], ch
aam 0x32
mov ebp, 0x3ecd69a3
mov byte [ebx], ch
aam 0x32
mov ebp, 0x3ecd69a3
mov edi, 0xc0ea628a
jle 0x484b5f
inc esp
pop ebx
in eax, 0x3a
mov ah, dl
sub ebx, dword [esp + esi + 0x60]
lds ebp, [esp - 0x67]
xchg ebp, eax
mov dh, 0x26
jb 0x484ae0
push ecx
pushal
inc edi
stosd dword es:[edi], eax
adc byte [edx - 0x51], dl
pushfd
retf 0x2dea
sub eax, 0x6f597714
xchg esi, eax
jmp 0x484aef
Function at 0x4010a0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x462658
push 0x44f870
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x49cf34]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor esi, esi
xor edi, edi
mov dword [ebp - 0x30], esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp eax, esi
je 0x40115c
cmp eax, 0xffffffff
je 0x40115c
lea ecx, [ebp - 0x30]
push ecx
push 0x28
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40115c
mov dword [ebp - 0x2c], esi
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
lea edx, [ebp - 0x28]
push edx
push 0x460fc4
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x40115c
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x20], 2
push esi
push esi
push 0x10
lea eax, [ebp - 0x2c]
push eax
push esi
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x40115c
lea edi, [esi + 1]
jmp 0x401159
mov dword [ebp - 0x34], edi
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x30]
cmp eax, esi
je 0x401176
cmp eax, 0xffffffff
je 0x401176
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0044fd61
mov esp, ebp
pop ebp
ret
Function at 0x401520
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x462638
push 0x44f870
mov eax, dword fs:[0]
push eax
sub esp, 0x43c
mov eax, dword [0x49cf34]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x448], ebx
mov dword [ebp - 0x44c], ebx
mov dword [ebp - 4], ebx
push eax
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
mov dword [ebp - 0x44c], edi
cmp edi, ebx
je 0x401611
cmp edi, 0xffffffff
je 0x401611
mov dword [ebp - 0x444], ebx
push 0x424
push ebx
lea eax, [ebp - 0x440]
push eax
call fcn.0044fd70
add esp, 0xc
mov dword [ebp - 0x444], 0x428
lea ecx, [ebp - 0x444]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
cmp eax, ebx
je 0x401611
lea edx, [ebp - 0x424]
push edx
call fcn.004513eb
add esp, 4
cmp eax, ebx
je 0x40161a
mov ecx, eax
lea esi, [ecx + 2]
lea ecx, [ecx]
mov dx, word [ecx]
add ecx, 2
cmp dx, bx
jne 0x4015e0
sub ecx, esi
sar ecx, 1
add ecx, ecx
push ecx
push eax
push ebx
call fcn.00405b20
add esp, 0xc
mov ecx, 0x6fcb9ae
cmp eax, ecx
jne 0x40161a
mov edx, dword [ebp - 0x430]
mov dword [ebp - 0x448], edx
mov dword [ebp - 4], 0xfffffffe
jmp 0x401652
mov dword [ebp - 0x444], 0x428
lea eax, [ebp - 0x444]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Module32NextW]
jmp 0x4015c1
cmp edi, ebx
je 0x401662
cmp edi, 0xffffffff
je 0x401662
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x448]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0044fd61
mov esp, ebp
pop ebp
ret 4
Function at 0x403080
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0x6a09e667
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0x3c6ef372
mov dword [eax + 0x14], 0xa54ff53a
mov dword [eax + 0x18], 0x510e527f
mov dword [eax + 0x1c], 0x9b05688c
mov dword [eax + 0x20], 0x1f83d9ab
mov dword [eax + 0x24], 0x5be0cd19
pop ebp
ret
Function at 0x405a60
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4613b0
push 0x44f870
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x49cf34]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x24], ebx
mov word [ebp - 0x20], 0x500
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea ecx, [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0x28], eax
cmp eax, ebx
je 0x405afb
lea edx, [ebp - 0x28]
push edx
mov eax, dword [ebp - 0x2c]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x405ae1
mov dword [ebp - 0x28], ebx
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x28]
jmp 0x405afb
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0044fd61
mov esp, ebp
pop ebp
ret

Function at 0x405b20
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
not eax
test ecx, ecx
je 0x405b4d
push esi
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x45e240]
inc edx
dec ecx
jne 0x405b33
pop esi
not eax
pop ebp
ret

Function at 0x405b60
Capabilities:
Get session user name
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4613d0
push 0x44f870
mov eax, dword fs:[0]
push eax
sub esp, 0x120
mov eax, dword [0x49cf34]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor eax, eax
xor esi, esi
mov dword [ebp - 4], eax
mov byte [ebp - 0x120], al
push 0x103
push eax
lea eax, [ebp - 0x11f]
push eax
call fcn.0044fd70
add esp, 0xc
mov dword [ebp - 0x12c], 0x104
lea ecx, [ebp - 0x12c]
push ecx
lea edx, [ebp - 0x120]
push edx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x405c3d
mov edx, 6
mov dword [ebp - 0x130], edx
lea ecx, [ebp - 0x120]
or eax, 0xffffffff
mov dword [ebp - 0x124], ecx
mov esi, edx
dec edx
mov dword [ebp - 0x130], edx
test esi, esi
je 0x405c1c
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x45e240]
inc ecx
jmp 0x405bf1
not eax
xor ecx, ecx
cmp eax, 0x39b5d60d
sete cl
mov esi, ecx
jmp 0x405c37
mov dword [ebp - 0x128], esi
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0044fd61
mov esp, ebp
pop ebp
ret
Function at 0x405c70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x405c8b
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x405cc2
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x405cbe
jmp 0x405cb0
cmp esi, eax
jae 0x405cc2
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x405cb0
cmp esi, eax
jb 0x405cc9
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x406110
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45ccf2
mov eax, dword fs:[0]
push eax
sub esp, 0x450
mov eax, dword [0x49cf34]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x458], ebx
mov eax, dword [0x49ceb4]
mov edx, dword [eax + 0xc]
mov ecx, 0x49ceb4
mov dword [ebp - 4], ebx
mov dword [ebp - 0x45c], esi
call edx
add eax, 0x10
mov dword [esi], eax
push 0x400
lea ecx, [ebp - 0x44a]
xor eax, eax
push ebx
push ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x458], 1
mov word [ebp - 0x44c], ax
call fcn.0044fd70
xor eax, eax
xor edx, edx
add esp, 0xc
mov word [ebp - 0x48], dx
mov dword [ebp - 0x46], eax
mov dword [ebp - 0x42], eax
mov dword [ebp - 0x3e], eax
mov dword [ebp - 0x3a], eax
mov dword [ebp - 0x36], eax
mov dword [ebp - 0x32], eax
mov dword [ebp - 0x2e], eax
mov dword [ebp - 0x2a], eax
cmp dword [ebp + 0xc], ebx
jne 0x40628c
lea eax, [ebp - 0x454]
push eax
lea ecx, [ebp - 0x44c]
push ecx
mov dword [ebp - 0x454], 0x201
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x40628c
mov eax, dword [0x45e680]
mov edx, dword [str.WemaNretupmoCteG]
mov ecx, dword [0x45e684]
mov dword [ebp - 0x20], eax
mov al, byte [0x45e68c]
mov dword [ebp - 0x24], edx
mov edx, dword [0x45e688]
mov byte [ebp - 0x14], al
lea eax, [ebp - 0x24]
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x450], 0x11
mov dword [ebp - 0x1c], ecx
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x406220
sub eax, edx
lea ecx, [ebp - 0x24]
lea eax, [ebp + eax - 0x24]
mov edx, ecx
cmp edx, eax
je 0x406248
dec eax
cmp ecx, eax
je 0x406248
mov dl, byte [ecx]
mov bl, byte [eax]
mov byte [ecx], bl
inc ecx
mov byte [eax], dl
cmp ecx, eax
jne 0x406236
lea eax, [ebp - 0x24]
push eax
push 0x45e66c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40628c
lea ecx, [ebp - 0x450]
push ecx
lea edx, [ebp - 0x48]
push edx
call eax
test eax, eax
je 0x40628c
lea eax, [ebp - 0x44c]
push eax
lea ecx, [ebp - 0x48]
push ecx
push str._s_s
push esi
call fcn.004060f0
add esp, 0x10
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044fd61
mov esp, ebp
pop ebp
ret 8
Function at 0x409740
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
pop ebp
ret