joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b759
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x41b7f6
push ebx
push esi
call fcn.0041b722
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0041a3a7
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x41b7a3
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41b7f5
push edi
push eax
call fcn.00415126
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x41b7c3
call fcn.00414efc
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41b7f4
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0041a3a7
add esp, 0x20
test eax, eax
jne 0x41b7e2
push edi
call fcn.00414efc
jmp 0x41b7ea
push ebx
call fcn.00414efc
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x4232f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42331d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42331d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x424000
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
push str.Success_created.
push 0x492e38
mov ebx, ecx
call fcn.00401160
push eax
call fcn.00401e70
push 8
call fcn.004073e8
mov esi, eax
add esp, 0x10
test esi, esi
je 0x424062
push 4
call fcn.004073e8
add esp, 4
test eax, eax
je 0x424040
mov dword [eax], 0x424bc0
jmp 0x424042
xor eax, eax
lea edi, [esi + 4]
push edi
push 0
push eax
push 0x401e50
push 0
push 0
call fcn.0040e506
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x42409d
jmp 0x424064
xor esi, esi
cmp dword [esi + 4], 0
je 0x4240aa
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [esi + 4], eax
je 0x4240b1
push 0
push dword [esi + 4]
push dword [esi]
call fcn.004050d5
add esp, 0xc
test eax, eax
jne 0x4240b8
push 8
push esi
mov dword [esi], eax
mov dword [esi + 4], eax
call fcn.00407418
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebx
ret
push 6
mov dword [edi], 0
call fcn.0040528b
push 1
call fcn.0040528b
push 5
call fcn.0040528b
push 2
call fcn.0040528b
int3
Function at 0x1cdb262
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushal
lea edi, [edi + 1]
push 0x4cefe8d6
cwde
call fcn.01cde114
cmp bh, 0x21
jmp 0x1cdc092
rol al, 1
mov byte [esp], 0x26
pushfd
push esp
call fcn.01ff9f7f
pushal
mov word [esp + 0x10], 0x7363
inc al
mov word [esp + 4], 0x850a
cmp cl, dl
clc
cmp al, byte [edi]
cwde
jmp 0x117c267
push ebx
clc
push esi
not al
lea eax, [edi + 0x1206c1bb]
stc
push edi
cmp ch, 0xab
seta al
sub ah, 0x9b
setnp ah
sub ebx, ebx
bswap eax
pushfd
lea eax, [ebp - 8]
call fcn.02001ce6
push 0x9c90949e
mov dword [esp], 0xd40b1902
pushfd
mov dword [esp], 0xe155bab4
pushal
push edx
lea esp, [esp + 0x24]
jmp 0x20083b9
cmp byte [edi], 0x23
call fcn.01191548
add byte [eax], al
add byte [eax], al
not ah
movsx eax, dl
movsx eax, dl
rcr ax, 6
push ebp
neg ebp
mov ebp, esp
stc
aas
cwde
sal ah, 3
sub esp, 8
jmp 0x1cdb23c
mov dword [esp], eax
pushal
pushfd
lodsb al, byte [esi]
mov dword [esp + 4], eax
cmc
cmc
pushfd
neg al
pushfd
dec al
clc
jmp 0x1190e33
jmp 0x2004b46

Function at 0x1cdb267
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushal
lea edi, [edi + 1]
push 0x4cefe8d6
cwde
call fcn.01cde114
cmp bh, 0x21
jmp 0x1cdc092
rol al, 1
mov byte [esp], 0x26
pushfd
push esp
call fcn.01ff9f7f
pushal
mov word [esp + 0x10], 0x7363
inc al
mov word [esp + 4], 0x850a
cmp cl, dl
clc
cmp al, byte [edi]
cwde
jmp 0x117c267
push ebx
clc
push esi
not al
lea eax, [edi + 0x1206c1bb]
stc
push edi
cmp ch, 0xab
seta al
sub ah, 0x9b
setnp ah
sub ebx, ebx
bswap eax
pushfd
lea eax, [ebp - 8]
call fcn.02001ce6
push 0x9c90949e
mov dword [esp], 0xd40b1902
pushfd
mov dword [esp], 0xe155bab4
pushal
push edx
lea esp, [esp + 0x24]
jmp 0x20083b9
cmp byte [edi], 0x23
call fcn.01191548
add byte [eax], al
add byte [eax], al
not ah
movsx eax, dl
movsx eax, dl
rcr ax, 6
push ebp
neg ebp
mov ebp, esp
stc
aas
cwde
sal ah, 3
sub esp, 8
jmp 0x1cdb23c
mov dword [esp], eax
pushal
pushfd
lodsb al, byte [esi]
mov dword [esp + 4], eax
cmc
cmc
pushfd
neg al
pushfd
dec al
clc
jmp 0x1190e33
jmp 0x2004b46

Function at 0x1cdcd73
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test eax, eax
pushal
lea esp, [esp + 0x20]
je fcn.0117a3a0
pushal
mov esi, dword [eax + 0x3c]
bts dx, cx
cmp bl, 0x86
rcl dl, 1
add esi, eax
shr dx, cl
mov edx, dword [esi + 0x78]
pushal
mov byte [esp], bh
mov word [esp], 0xcfdf
test edx, edx
push 0x87ace6b8
pushfd
push esi
jmp 0x1cdb346
movsx ax, al
and ax, 0x3aeb
sub esp, 0x18
and ax, 0x6e74
or al, ah
lahf
jge 0x2004ff4
push esi
aas
lea eax, [edx - 0x42d41ddb]
push 0xd1943cea
mov dword [esp], edi
pushfd
inc al
mov dword [esp], ebx
aaa
push edx
pushfd
not ah
shr ah, 5
mov eax, dword [ebp + 8]
cmp si, 0x334e
pushal
test eax, eax
call fcn.01cddeff
cmc
call fcn.020045e2
call fcn.01cde29d
lea esp, [esp + 0x4c]
je fcn.0117a3a0
bt sp, 0xc
stc
movsx cx, al
add edx, eax
bt dx, 0xc
mov ecx, dword [esi + 0x7c]
jmp 0x118ea44
btc eax, 0x1b
adc ah, dl
xor ah, dh
pushfd
mov dword [esp], ebp
bswap bp
daa
ror bp, cl
mov ebp, esp
jmp 0x117934d
not al
push esi
dec al
push edi
daa
bsf ax, bp
shrd ax, sp, 5
lea eax, [ecx - 0x23a8e49]
push ebx
test dl, dl
push edx
adc ax, 0x6126
mov eax, dword [ebp + 8]
jmp 0x11789cd
Function at 0x1cddeff
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xa9d05c6f
mov dword [ebp - 0x10], ecx
cmp dl, 0x66
mov ecx, dword [ebp + 0xc]
push dword [esp]
call fcn.01cde11d
push edx
lea esp, [esp + 0x2c]
je fcn.0117a3a0
shl esi, cl
neg esi
sub dl, 0x46
mov esi, dword [eax + 0x3c]
dec edx
shl dl, cl
movsx dx, al
add esi, eax
mov dl, 0xa6
and edx, 0x1221613b
mov edx, dword [esi + 0x78]
pushfd
stc
test edx, edx
pushal
jmp 0x1ffa84c
lea esp, [esp + 0x24]
je fcn.0117a3a0
or cx, 0xf113
add edx, eax
sar ecx, cl
movzx cx, al
mov ecx, dword [esi + 0x7c]
cmp ebp, 0x6dc97b38
add ecx, edx
jle 0x1cd97ce
test si, 0xc22f
clc
mov dword [ebp - 0x10], ecx
xor ch, dh
movzx cx, cl
xor cx, si
mov ecx, dword [ebp + 0xc]
cmc
cmp dl, 0x41
pushfd
stc
cmp ecx, 0xffff
call fcn.01178695
inc esp
jne 0x1ffa8d1
inc eax
fild dword [eax + ebx*4 - 0x668c6ff8]
mov edi, 0xc7a10e37
scasb al, byte es:[edi]
cli
add eax, 0x6bdfb490
cmp dl, byte ss:[ebp - 0x1d]
shr byte [edx + 0x5c1e79db], 1
leave
int3
invalid
Function at 0x1ffe53f
Capabilities:
Encode data using xor

Disassembly:
stc
bt edx, esp
ror dl, 3
clc
push word [esp + 0x3e]
popf
mov byte [esp + 8], al
inc esi
pushfd
call fcn.01cdb458
imul eax, edx, 0x59
sbb byte [edi - 0x21], ch
invalid
Function at 0x10012933
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10012959
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10012957
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x1001297e
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push dword [eax]
mov ecx, dword [ebp - 0x14]
call fcn.10016d5b
mov esp, ebp
pop ebp
ret
Function at 0x1001bcc2
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x1001bcdf
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x1001bdd7
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
xor edx, edx
sub edx, dword [ecx]
add eax, edx
mov ecx, dword [ebp - 4]
cmp eax, dword [ecx]
jg 0x1001bd4d
mov dword [ebp - 0x10], 1
jmp 0x1001bd51
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x10]
je 0x1001bd64
mov dword [ebp - 0x14], 1
jmp 0x1001bd68
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x30]
mov dword [eax], 0xfffffff6
cmp dword [ebp - 0x14], 0xfffffff6
jge 0x1001bd80
mov dword [ebp - 8], 1
jmp 0x1001bd84
and dword [ebp - 8], 0
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
push 0
mov ecx, dword [ebp - 0xc]
call fcn.10016e0a
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax]
jg 0x1001bda6
mov dword [ebp - 0x38], 1
jmp 0x1001bdaa
and dword [ebp - 0x38], 0
push 0
mov ecx, dword [ebp - 0xc]
call fcn.10016e0a
push 0
mov ecx, dword [ebp - 0xc]
call fcn.10016e0a
mov eax, dword [ebp - 0x3c]
mov dword [eax], 0x3860a421
push 0
mov ecx, dword [ebp - 0x40]
call fcn.10016e0a
mov dword [eax], 0x3860a421
mov esp, ebp
pop ebp
ret
Function at 0x1001cd13
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008575b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001ce09
mov dword [ebp - 0x18], 0xfffffff6
mov dword [ebp - 0x24], 0xf6d4a0d4
mov dword [ebp - 0x20], 0xfffe
mov dword [ebp - 0x14], 0
jmp 0x1001cd5f
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x1001cd72
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x50], 0
jmp 0x1001cd58
mov dword [ebp - 0x18], 0
jmp 0x1001cd82
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x19
jle 0x1001ce07
mov dword [ebp - 0x28], 0xfffffff9
mov dword [ebp - 0x2c], 0xe2167fa5
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x34], 0x924c0001
push 4
lea ecx, [ebp - 0x40]
call fcn.10016d92
and dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0
jmp 0x1001cdc2
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x1001cddb
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x40]
call fcn.10016e0a
mov dword [eax], 0x39ba095a
jmp 0x1001cdbb
mov byte [ebp - 0xd], 0
movzx eax, byte [ebp - 0xd]
test eax, eax
je 0x1001cdef
push 0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.10016dee
jmp 0x1001cd7b
jmp 0x1001ce21
push 0
push 0x19eb
push 0
push 0
push 0x10d9
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x100263b1
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002640c
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x100263ed
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x1002640a
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.10016e0a
mov dword [eax], 1
jmp 0x100263e2
jmp 0x10026424
push 0
push 0x19eb
push 0
push 0
push 0x10d9
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esp, ebp
pop ebp
ret

Function at 0x1002bd49
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1002bda4
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1002bd85
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x1002bda2
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.10016e0a
mov dword [eax], 0x571177e8
jmp 0x1002bd7a
jmp 0x1002bdae
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov esp, ebp
pop ebp
ret

Function at 0x1002c80f
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002c848
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx]
mov ecx, dword [ecx]
mov eax, dword [eax]
mov dword [ecx + 4], eax
jmp 0x1002c868
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1002c868
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov esp, ebp
pop ebp
ret
Function at 0x1002ce6f
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1002ce93
xor eax, eax
jmp 0x1002cfe9
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x1002ceb1
xor eax, eax
jmp 0x1002cfe9
push 0x74e7
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 1
push 0x769d
push 0x7d0e
push 0x7aee
call fcn.1002cb01
add esp, 0x1c
cmp dword [ebp - 0xc], 0
jne 0x1002cee4
xor eax, eax
jmp 0x1002cfe9
lea eax, [ebp - 0x24]
push eax
push 1
push 0x9ce
push dword [ebp - 8]
push dword [ebp - 0x10]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0x2cb8
call fcn.1002c96f
add esp, 0x20
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 4]
push eax
push 1
lea eax, [ebp - 8]
push eax
push 0x4097
call fcn.1002cc31
add esp, 0x14
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [eax + 0x34]
mov dword [ebp - 0x14], ecx
je 0x1002cf4a
lea eax, [ebp - 4]
push eax
push 0x2b59
lea eax, [ebp - 0x14]
push eax
push 1
call fcn.1002ccc2
add esp, 0x10
push dword [ebp - 4]
call fcn.1002c66f
pop ecx
test eax, eax
jne 0x1002cf5e
xor eax, eax
jmp 0x1002cfe9
lea eax, [ebp - 4]
push eax
push 0x5297
push 1
push 0x424
push 0x7c16
push 0x937
push 0x2d1c
push 0x7b19
push 0x52ca
call fcn.1002cd26
add esp, 0x24
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x1002cfd1
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x18], ecx
jne 0x1002cfae
xor eax, eax
jmp 0x1002cfe9
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x1002cfc7
xor eax, eax
jmp 0x1002cfe9
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x1002cfe2
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
jmp 0x1002cfe6
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x1003fd01
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1003fd46
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
call fcn.1006bd77
mov esi, eax
mov ecx, dword [ebp - 0xc]
call fcn.10017224
mov ecx, eax
mov eax, esi
xor edx, edx
div ecx
mov eax, dword [ebp - 0x10]
mov dword [eax], edx
jmp 0x1003fd5e
push 0
push 0x19eb
push 0
push 0
push 0x10d9
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10041bf4
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10041c0c
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x10041c3d
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10041c3d
push 0x1d2
push 0
push 0xd51
push 0x1afd
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_TextOutA]
mov esp, ebp
pop ebp
ret
Function at 0x10081107
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1008d330]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.10071bf4
mov dword [ebp - 0x14], eax
cmp dword [0x1067a4c8], esi
jne 0x100811fa
push 0x800
push esi
push 0x10007dcc
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10081187
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x100812da
push esi
push esi
push 0x10007dcc
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x100812da
push 0x10007de4
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100812da
push eax
call ebx
push 0x10007df0
push edi
mov dword [0x1067a4c8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007e00
push edi
mov dword [0x1067a4cc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007e14
push edi
mov dword [0x1067a4d0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1067a4d8], eax
test eax, eax
je 0x100811f7
push 0x10007e30
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1067a4d4], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1008121f
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10081212
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x10081234
push 4
pop eax
jmp 0x100812dc
cmp dword [ebp - 0x14], esi
je 0x10081234
push dword [0x1067a4c8]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10081219
mov eax, dword [0x1067a4d4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x10081292
cmp dword [0x1067a4d8], edi
je 0x10081292
push eax
call ebx
push dword [0x1067a4d8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10081292
test eax, eax
je 0x10081292
call ecx
test eax, eax
je 0x10081287
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10081287
test byte [ebp - 8], 1
jne 0x10081292
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x100812c2
mov eax, dword [0x1067a4cc]
cmp eax, edi
je 0x100812bf
push eax
call ebx
test eax, eax
je 0x100812bf
call eax
mov esi, eax
test esi, esi
je 0x100812bf
mov eax, dword [0x1067a4d0]
cmp eax, edi
je 0x100812bf
push eax
call ebx
test eax, eax
je 0x100812bf
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x1067a4c8]
call ebx
test eax, eax
je 0x100812da
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x100812dc
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1006bf5d
mov esp, ebp
pop ebp
ret
Function at 0x459327
Capabilities:
Encode data using xor

Disassembly:
cdq
shr dword [esi + 0x6b], 0x55
adc eax, 0x3f6ab3f5
cmp byte [edi], dh
xor al, 0x2a
mov al, byte [edi + 0x1f]
and al, 0xef
mov byte [eax], cl
or al, 0xc7
jns 0x4593b4
mov bh, 0x95
lodsb al, byte [esi]
push es
mov byte [edx], bh
leave
adc eax, 0xa6570f9b
sub ecx, esp
dec ebp
adc al, 0x29
ljmp 0x65e1
inc esp
jo 0x2aa79bb8
adc dword [esi + edx], eax
mov ebp, 0xd702fd48
add dl, bh
test eax, 0xb905292b
inc esp
mov eax, 0xa99d002c
xchg edx, eax
inc edi
cmp dword [ebp - 0x451e5209], edx
mov ecx, 0x948589d4
xchg ebp, eax
mov al, 0x58
insb byte es:[edi], dx
out 0xc3, eax
adc eax, 0xac46cda8
or eax, 0x250df8f0
add bl, 0x71
dec ebp
bound ebx, qword [esi + 0x22]
not ah
cmc
mov esi, dword [edx - 0x2971914]
lea esi, [edi + 0x42ea4ee4]
push 0xffffffffffffffa8
daa
xor al, 0x53
mov esi, 0x264ab6e2
inc ebx
loop 0x45936c
dec edx
inc ebx
cwde
and eax, 0x69571215
dec esi
mov dword [esi - 0x19], ecx
jne 0x45935f
xchg ecx, eax
maxps xmm3, xmm6
daa
adc byte [edx + 0x3d531dc7], dl
lcall 0x1068, 0x5815b131
xlatb
stc
les edx, [eax - 0x21106c7]
inc eax
dec ebx
test byte [ecx - 0x538ddd41], bh
xchg edx, eax
invalid
and dh, byte [edx - 0x54]
and al, 0x85
test eax, 0x86e78280
jp 0x4593f9
ja 0x4593cb
loope 0x4593e4
dec eax
movups xmm2, xmm2
enter 0xffffffffffff951d, 0xffffffffffffff9e
fisub word gs:[ecx]
wait
cld
out dx, eax
fucomp st(7)
sbb eax, 0xde659e95
and dword [ebx - 0x10221004], ebx
sbb byte [edi], al
loop 0x4593c6
pushfd
loope 0x4593e4
xchg ebp, eax
cmpsd dword [esi], dword es:[edi]
sbb esp, dword [esi]
push ebp
xchg ebx, eax
xchg bl, al
jle 0x45942d
jl 0x459457
push 0x37
mov dword [0x4d2c0b98], eax
cmp eax, 0xc29846d6
and al, 0xb2
sub eax, 0xb5928ed7
std
inc ebp
sub dword [ecx + ebp*2], esp
and al, 0x69
adc ecx, dword [edi + edi*8]
ficomp dword [edx + 0x61]
outsb dx, byte [esi]
les ebp, [edi]
mov ebx, esi
jnp 0x4593c5
js 0x459467
cmp al, 0xc7
dec ecx
mov ebp, 0xd24dc25e
and byte [ebp + 0x2446afba], 0xbb
mov al, byte [0x1b451b71]
mov eax, dword [0xab8c7680]
jmp 0x87eb0a47
mov word [ebx - 0x5a8a1617], gs
xchg dword [ecx + esi*8 - 0x6601a61b], edx
or ch, 0xcf
fnstsw word [ecx + 0x27]
push ebp
push 0xdf69a570
mov eax, 0xe2a54d6d
or eax, 0xd2530157
pop ebp
jnp 0x4594c7
add byte [eax*4 - 0x1fd68ef8], dh
mov edi, 0xe50ef8b6
rcl dword [ebx - 0x43be40c], 0xdc
inc esi
aaa
cmp eax, 0xffee2bd2
adc dword [esi + 0x77], esi
push ecx
or ebp, dword [ebp - 0x62476429]
or al, 0xe8
push edx
ret
rcr byte [ecx - 0x350d4f11], 0x90
ljmp 0x6053
Function at 0x6234ab
Capabilities:
Encode data using xor

Disassembly:
xchg edx, eax
and eax, 0x280d6a5f
and eax, dword [edi]
jle 0x6234da
cmp eax, 0xc6a85796
test al, 0x3c
mov al, 0x13
mov bl, 0x8d
push eax
stosb byte es:[edi], al
imul ebp, dword [ebp - 0xc4998b7], 0x6766032f
aam 3
or dword [edx + 0x4222f840], ebp
xor ebx, eax
mov cl, 9
rcr byte [ebx + 0x157de788], 1
mov bh, ah
jge 0x6234f3
and eax, dword [ecx]
dec esi
add al, 0x44
push ebx
sub al, 0xdb
fld qword [ebx - 0x6dfbc48e]
cld
adc edx, dword [edx - 0x158da830]
xor dword [ebp + ebp*4 - 0x2fc6946c], 0x34
insb byte es:[edi], dx
mov ecx, 0x5c727209
pushfd
or eax, edx
sub bl, ch
pushfd
cmp eax, 0x922a51ee
xor al, 0xbc
push esp
jae 0x6234d6
aad 0xc4
lahf
invalid