joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407240
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push esi
push edi
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push str.NtProtectVirtualMemory
push esi
call edi
mov ebx, dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [0x43809c], eax
test eax, eax
jne 0x407281
mov eax, dword [0x438094]
push 0
push str.kawaks_loader
push 0x40d800
push eax
call ebx
push str.NtWriteVirtualMemory
push esi
call edi
mov dword [0x4380a0], eax
test eax, eax
jne 0x4072a6
mov ecx, dword [0x438094]
push eax
push str.kawaks_loader
push 0x40d800
push ecx
call ebx
push str.NtFlushInstructionCache
push esi
call edi
mov dword [0x4380a4], eax
test eax, eax
jne 0x4072cb
mov edx, dword [0x438094]
push eax
push str.kawaks_loader
push 0x40d800
push edx
call ebx
push str.RtlNtStatusToDosError
push esi
call edi
mov dword [0x4380a8], eax
test eax, eax
jne 0x4072ef
push eax
mov eax, dword [0x438094]
push str.kawaks_loader
push 0x40d800
push eax
call ebx
push str.NtReadVirtualMemory
push esi
call edi
mov dword [0x4380ac], eax
test eax, eax
jne 0x407314
mov ecx, dword [0x438094]
push eax
push str.kawaks_loader
push 0x40d800
push ecx
call ebx
pop edi
pop esi
pop ebx
ret

Function at 0x407340
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Inject apc

Disassembly:
sub esp, 0x18
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x14], eax
mov eax, dword [str..plugins.dll]
push ebx
push ebp
mov dword [esp + 0xc], eax
mov ax, word [0x40d490]
push esi
mov esi, edx
mov edx, dword [0x40d48c]
mov ebx, ecx
mov ecx, dword [0x40d488]
mov word [esp + 0x1c], ax
lea eax, [esp + 0x10]
mov dword [esp + 0x18], edx
push edi
mov dword [esp + 0x18], ecx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407385
push 0x40
sub eax, edx
push 0x101000
mov edi, eax
push edi
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ebp, eax
test ebp, ebp
je 0x407403
lea ecx, [esp + 0x10]
push ecx
push edi
lea edx, [esp + 0x1c]
push edx
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x407403
test esi, esi
je 0x407403
mov edi, dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, dword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov edi, edi
mov eax, dword [esi]
push eax
push 0
push 0x1fffff
call edi
test eax, eax
je 0x4073eb
mov ecx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push ebp
push eax
push ecx
call ebx
mov edx, dword [esi]
push edx
push str.TID:_d_n
call dword [sym.imp.MSVCR90.dll_printf]
mov esi, dword [esi + 4]
add esp, 8
test esi, esi
jne 0x4073d0
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.004098be
add esp, 0x18
ret
Function at 0x407420
Capabilities:
Enumerate threads

Disassembly:
sub esp, 0x20
xor eax, eax
push ebp
mov ebp, dword [esp + 0x2c]
push esi
push edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x30]
push eax
push 4
mov dword [esp + 0x18], 0x1c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [esp + 0xc], esi
cmp esi, 0xffffffff
je 0x4074e7
lea ecx, [esp + 0x10]
push ecx
push esi
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x4074e7
mov edx, dword [esp + 0x30]
cmp dword [esp + 0x1c], edx
jne 0x4074d8
cmp dword [ebp], 0
jne 0x40748f
mov eax, dword [esp + 0x18]
mov dword [ebp], eax
jmp 0x4074d8
mov edi, dword [esp + 0x18]
mov esi, ebp
mov eax, dword [esi + 4]
test eax, eax
je 0x4074b9
mov esi, eax
test esi, esi
jne 0x407495
push 0x40d894
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x20
ret
push 8
call dword [sym.imp.MSVCR90.dll_malloc]
add esp, 4
test eax, eax
je 0x4074a2
mov dword [eax], edi
mov dword [eax + 4], 0
mov dword [esi + 4], eax
mov esi, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ecx
push esi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x407476
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x20
ret
Function at 0x407590
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Resume thread
Spawn thread to rwx shellcode
Terminate process

Disassembly:
mov eax, dword [0x438028]
sub esp, 8
push esi
push 0x40
push 0x1000
push 0xe
push 0
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, eax
test esi, esi
jne 0x4075d0
mov ecx, dword [0x438094]
push eax
push str.kawaks_loader
push 0x40d8a0
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
xor al, al
pop esi
add esp, 8
ret
mov eax, dword [0x438028]
lea edx, [esp + 4]
push edx
push 0xe
push str..plugins.dll
push esi
push eax
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x407618
cmp dword [esp + 4], 0xe
je 0x407618
mov ecx, dword [0x438028]
push 0x4000
push 0xe
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor al, al
pop esi
add esp, 8
ret
push edi
push 0x40d494
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
jne 0x407656
mov edx, dword [0x438094]
push eax
push str.kawaks_loader
push str.GetLoadLibraryAddress__NULL.
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
xor al, al
pop esi
add esp, 8
ret
mov eax, dword [0x43802c]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [0x438028]
push 0
push 0
push esi
push edi
push 0
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov edi, eax
test edi, edi
je 0x4076d7
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea edx, [esp + 0xc]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [esp + 0xc], 0
jne 0x4076b3
mov eax, dword [0x438094]
push 0
push str.kawaks_loader
push str.Remote_LoadLibrary_Return__NULL.
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [0x438028]
push 0x4000
push 0xe
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov al, 1
pop esi
add esp, 8
ret
mov edx, dword [0x438094]
push 0
push str.kawaks_loader
push 0x40d900
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [0x438028]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.MSVCR90.dll_exit]
int3
Function at 0x408870
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
push 0
push 0x80
push 4
push 0
push 2
push 0x40000000
push str..kawaks_loader.ini
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
mov esi, eax
lea eax, [esp + 8]
push eax
push 0x51f
push str.__Configuration_file_for_WinKawaks_Loader_r_n__Cracker_By_sjx_r_n_r_n_r_n________________________________________r_n_r_n_Process__r_n_r_n_
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ecx
ret
Function at 0x408950
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xa0
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x9c], eax
push ebp
push esi
push edi
push 0x63
lea eax, [esp + 0x49]
push 0
push eax
mov edi, ecx
mov byte [esp + 0x50], 0
call sub.MSVCR90.dll_memset
mov esi, dword [edi]
xor eax, eax
add esp, 0xc
xor ebp, ebp
push ebp
push 1
lea edx, [esp + 0x17]
push edx
mov dword [esp + 0x45], eax
mov dword [esp + 0x49], eax
mov word [esp + 0x4d], ax
mov byte [esp + 0x4f], al
mov byte [esp + 0x20], al
mov dword [esp + 0x21], eax
mov dword [esp + 0x25], eax
mov word [esp + 0x29], ax
mov byte [esp + 0x2b], al
mov byte [esp + 0x2c], al
mov dword [esp + 0x2d], eax
mov dword [esp + 0x31], eax
mov word [esp + 0x35], ax
mov byte [esp + 0x37], al
mov byte [esp + 0x38], al
mov dword [esp + 0x39], eax
mov dword [esp + 0x3d], eax
mov word [esp + 0x41], ax
mov byte [esp + 0x43], al
mov byte [esp + 0x1b], al
mov eax, dword [0x438028]
push esi
mov ecx, 0xa
push eax
mov byte [esp + 0x4c], 0
mov word [esp + 0x24], cx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov al, byte [esp + 0xf]
test al, al
je 0x408a2a
mov edx, dword [0x438028]
push 0
push 1
lea ecx, [esp + 0x17]
push ecx
inc esi
push esi
mov byte [esp + ebp + 0x54], al
push edx
inc ebp
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov al, byte [esp + 0xf]
test al, al
jne 0x408a05
mov eax, dword [edi + 4]
mov esi, dword [sym.imp.MSVCR90.dll_sprintf]
push eax
lea ecx, [esp + 0x3c]
push 0x40d974
push ecx
mov byte [esp + ebp + 0x50], 0x2c
call esi
mov edx, dword [edi + 8]
push edx
lea eax, [esp + 0x24]
push 0x40d974
push eax
call esi
mov ecx, dword [edi + 0xc]
push ecx
lea edx, [esp + 0x3c]
push 0x40d974
push edx
call esi
mov eax, dword [edi + 0x10]
push eax
lea ecx, [esp + 0x54]
push 0x40d978
push ecx
call esi
lea eax, [esp + 0x74]
add esp, 0x30
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408a80
mov esi, dword [sym.imp.MSVCR90.dll_fwrite]
sub eax, edx
push ebx
push eax
lea edx, [esp + 0x4c]
push 1
push edx
call esi
lea eax, [esp + 0x48]
add esp, 0x10
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408aa4
sub eax, edi
push ebx
push eax
lea eax, [esp + 0x40]
push 1
push eax
call esi
lea eax, [esp + 0x24]
add esp, 0x10
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408ac2
push ebx
sub eax, edi
push eax
lea ecx, [esp + 0x1c]
push 1
push ecx
call esi
lea eax, [esp + 0x30]
add esp, 0x10
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408ae0
push ebx
sub eax, edi
push eax
lea edx, [esp + 0x28]
push 1
push edx
call esi
lea eax, [esp + 0x3c]
add esp, 0x10
lea edi, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408b00
sub eax, edi
push ebx
push eax
lea eax, [esp + 0x34]
push 1
push eax
call esi
lea eax, [esp + 0x20]
add esp, 0x10
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408b20
push ebx
sub eax, edx
push eax
lea ecx, [esp + 0x18]
push 1
push ecx
call esi
mov ecx, dword [esp + 0xb8]
add esp, 0x10
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.004098be
add esp, 0xa0
ret
Function at 0x409750
Capabilities:
Set registry value

Disassembly:
sub esp, 8
lea eax, [esp]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000002
mov dword [esp + 0x10], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov edx, dword [esp]
push 4
lea ecx, [esp + 8]
push ecx
push 4
push 0
push str.ConsentPromptBehaviorAdmin
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push eax
push str.res_:__X
call dword [sym.imp.MSVCR90.dll_printf]
mov eax, dword [esp + 8]
add esp, 8
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 8
ret

Function at 0x409830
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x18
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x14], eax
mov eax, dword [str.SeDebugPrivilege]
mov ecx, dword [0x416af4]
mov edx, dword [0x416af8]
mov dword [esp], eax
mov eax, dword [0x416afc]
mov dword [esp + 4], ecx
mov cl, byte [0x416b00]
mov dword [esp + 8], edx
mov dword [esp + 0xc], eax
mov byte [esp + 0x10], cl
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edx, [esp]
push edx
mov ecx, eax
call fcn.004097b0
add esp, 4
test al, al
jne 0x40989d
mov eax, dword [0x438094]
push 0
push str.kawaks_loader
push 0x416b04
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.004098be
add esp, 0x18
ret

Function at 0x4098be
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x4098c8
repz ret
jmp fcn.00409be2
Function at 0xf1f360
Capabilities:
Encode data using xor

Disassembly:
jmp 0xf1f36a
pushal
call 0xf1f370
pop ebp
sub ebp, 0x10
sub ebp, 0xb1f360
jmp 0xf1f386
mov eax, 0xb1f360
add eax, ebp
add eax, 0x4c
mov ecx, 0x5bf
mov edx, 0xd3503112
xor byte [eax], dl
inc eax
dec ecx
jne 0xf1f39d
jmp 0xf1f3b0
cdq
fistp word [ecx + 0x12122e9b]
adc dl, byte [ebx + 0x1212ead3]
adc dl, byte [ecx]
fild qword [edx + 0x12121214]
test al, 0x3a
adc dl, byte [edx]
adc ah, ch
invalid
Function at 0x40b740
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x94
mov eax, dword [0x4a1014]
xor eax, esp
mov dword [esp + 0x90], eax
push ebx
push esi
mov esi, dword [0x4861c4]
mov ebx, ecx
push edi
push 0
push 0
push 0
push ebx
call esi
push 0
lea eax, [esp + 0x24]
push eax
push 0x40
lea eax, [esp + 0x3c]
push eax
push ebx
call dword [0x4861d0]
test eax, eax
jne 0x40b7a5
call dword [0x4861cc]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x90]
xor ecx, esp
call fcn.00462fbd
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x20]
cmp eax, 0xffffffff
je 0x40b78d
cmp eax, 0x40
jne 0x40b78d
mov eax, 0x5a4d
cmp ax, word [esp + 0x30]
jne 0x40b78d
push 0
push 0
push dword [esp + 0x74]
push ebx
call esi
push 1
xorps xmm0, xmm0
lea eax, [esp + 0x14]
push eax
movlpd qword [esp + 0x28], xmm0
push dword [esp + 0x2c]
movlpd qword [esp + 0x1c], xmm0
push dword [esp + 0x2c]
push ebx
call dword [0x4861c0]
test eax, eax
jne 0x40b7fc
xorps xmm0, xmm0
movlpd qword [esp + 0x10], xmm0
mov eax, dword [esp + 0x6c]
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
cdq
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], ecx
cmp esi, eax
jne 0x40b78d
cmp ecx, edx
jne 0x40b78d
push 0xf8
call fcn.00462fce
add esp, 4
mov esi, eax
mov edx, esi
mov dword [esp + 0x20], esi
mov ecx, ebx
push 0xf8
call fcn.0040b660
add esp, 4
test eax, eax
je 0x40b86f
push 0xf8
push esi
call fcn.00462ffe
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x90]
xor ecx, esp
call fcn.00462fbd
mov esp, ebp
pop ebp
ret
movzx eax, word [esi + 6]
mov ecx, ebx
mov edi, dword [esi + 0x54]
mov dword [esp + 0x2c], eax
movzx eax, word [esi + 0x14]
cdq
add eax, dword [esp + 0x18]
adc edx, dword [esp + 0x1c]
add eax, 0x18
adc edx, 0
push edx
push eax
call fcn.0040b700
add esp, 8
mov ecx, ebx
call fcn.0040b6c0
mov ecx, eax
mov dword [esp + 0x10], edx
movzx eax, word [esi + 0x14]
cdq
add eax, dword [esp + 0x18]
adc edx, dword [esp + 0x1c]
add eax, 0x18
adc edx, 0
cmp ecx, eax
jne 0x40b91a
cmp dword [esp + 0x10], edx
jne 0x40b91a
xor esi, esi
cmp dword [esp + 0x2c], esi
jbe 0x40b8f2
nop dword [eax + eax]
push 0x28
lea edx, [esp + 0x78]
mov ecx, ebx
call fcn.0040b660
add esp, 4
test eax, eax
jne 0x40b8f2
add edi, dword [esp + 0x84]
inc esi
cmp esi, dword [esp + 0x2c]
jb 0x40b8d0
push 0xf8
push dword [esp + 0x24]
call fcn.00462ffe
add esp, 8
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x90]
xor ecx, esp
call fcn.00462fbd
mov esp, ebp
pop ebp
ret
push 0xf8
push esi
call fcn.00462ffe
mov ecx, dword [esp + 0xa4]
add esp, 8
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00462fbd
mov esp, ebp
pop ebp
ret
Function at 0x44acf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 0x4c]
mov eax, dword [esi + 0x60]
mov edx, dword [esi + 0x54]
mov dword [esi + 0x104], ecx
sub ecx, dword [esi + 0x58]
add eax, ecx
mov dword [esi + 0x108], edx
sub edx, dword [esi + 0x5c]
mov dword [esi + 0x120], eax
mov eax, dword [esi + 0x64]
add eax, edx
mov dword [esi + 0x118], ecx
mov dword [esi + 0x124], eax
mov ecx, esi
mov eax, dword [esi + 0xdc]
mov dword [esi + 0x10c], eax
mov eax, dword [esi + 0xe8]
mov dword [esi + 0x11c], edx
mov edx, 1
mov dword [esi + 0x110], eax
pop esi
pop ebp
jmp fcn.0044ad60
Function at 0x40830e
Capabilities:
Encode data using xor

Disassembly:
les ebx, [edx + edi]
hlt
loope 0x4081d5
pop esp
cmp byte [eax + 0x245a672c], bh
xor eax, 0x667146d1
mov dl, 0x58
mov ebx, 0xa438193c
test eax, 0xb374e458
push ebp
in al, dx
jecxz 0x408240
jecxz 0x408237
sub byte [ebp + 0x60784d0c], al
mov al, 0x70
test al, 0x3b
clc
mov dword [0xd168bcca], eax
int3
push 0xdb4c7c6d
mov ecx, 0x594b9691
mov ecx, 0x202dba1d
pushfd
jmp 0xb58c7a54
dec ebx
mov ch, 0xc5
sti
jecxz 0x4082d6
cld
jne 0x408332
les edi, [edx]
dec ebp
jge 0x4082da
jg 0x408270
xchg edx, eax
loop 0x408363
or al, byte [eax]
push ebp
mov esi, 0xbbd944b3
pop ecx
inc edi
cmp eax, 0x4d9ecc78
js 0x4082c3
sahf
dec ebp
sal ch, 0xa9
sbb dword [eax - 0x4d], ebp
adc edx, edx
enter 0xffffffffffffcf74, 0xffffffffffffffa1
cld
push edi
or al, 0x4d
xchg ebx, eax
aas
xchg dword [ecx - 0x57], eax
std
push ebx
xchg ecx, eax
push esi
jecxz 0x4082dc
aam 0xf7
jl 0x4082f5
cmp al, 0x79
mov edi, 0x32a4b112
mov ebp, 0x6bbc309d
or byte [ecx + 9], bl
pop ecx
lcall 0x4a0b, 0xc64bb919
sbb eax, 0x27d840f
jge 0x4083b0
aad 0xb9
mov edx, 0xcaddaabb
mov eax, dword [0x46e00234]
jmp 0x4083bf
call 0x3789940d
cmp eax, 0x31a80c35
adc ch, dh
jns 0x408334
rol edi, cl
ret
mov edx, 0x5d980169
aam 0x1f
stosd dword es:[edi], eax

Function at 0x44a210
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x14
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
lea eax, [esp + 8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 1
push 0x859c40
mov dword [esp + 0x34], 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
lea ecx, [esp + 0xc]
push ecx
push esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push 0x14
push 0x40
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test edi, edi
je 0x44a280
mov edx, dword [0x659a70]
push 0x659788
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
push 0
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push str.GlobalDDiskDoctor
push 0
lea eax, [esp + 0x18]
push 1
push eax
mov dword [esp + 0x20], 0xc
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
pop edi
mov dword [0x659a6c], eax
pop esi
add esp, 0x14
ret
Function at 0x47798e
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push esp
sbb edx, dword [edi + 0x37]
adc edx, dword [esi]
and dword [eax - 0x30], edx
mov eax, 0xafa2f351
mov dl, byte [edx + 0x2f]
push 0xffffffffffffffb7
sub dword [ecx - 0x6d4418db], ecx
rcr dword [edi], 0xbc
lahf
les ebx, [eax - 0x593be9ef]
lock sub edi, dword [ebx - 0x313823e8]
les esp, [esi + 0x18bb2bf0]
fadd st(7), st(0)
into
push ds
push edx
insd dword es:[edi], dx
add dword [edi + 0x74], 0x3f98f5b1
xchg edi, eax
xchg dh, bl
dec ebx
clc
test dword [edx], esi
xor eax, 0x5bf65212
xor dword [ecx - 0x79262e25], esi
pop es
shl dword [esi], 1
out dx, eax
xor al, 0x97
dec ebp
fld qword [edi + ebp*8 + 0x6829ee46]
cmpsd dword [esi], dword es:[edi]
inc ecx
push esi
inc ecx
cmp al, 0x51
leave
xor dh, byte [ebp + 0x471fc67b]
xor al, byte [edi]
lcall 0x29f1, 0x746e1e03
jno 0x4779ab
imul edi, dword [ecx + 0x71165b67], 0x9b51f8cc
test eax, 0x2aa338a2
salc
mov eax, 0x7613b05f
or dl, byte [eax]
int1
and eax, 0x6015ab0
dec ebx
cdq
fsub qword [edi - 0x4e]
pop ecx
inc ebp
dec edi
push ebx
js 0x4779b0
lea ebp, [0x31995967]
xchg edi, eax
out 0x77, al
invalid
Function at 0x52d43e
Capabilities:
Encode data using xor

Disassembly:
jg 0x52d48a
mov cl, 0xc1
pop esp
pop esi
pushal
mov bh, byte [esi + 0x5d]
xor eax, 0xd24205e9
nop
jne 0x52d492
test eax, 0xb343f5c1
int3
js 0x52d49a
and dword [ecx], esi
invalid
jb 0x52d48c
aam 0x5b
invalid
or cl, byte [ebx - 0x20]
imul eax, dword [eax + ebp*2 + 0x68], 0xffffff90
inc ecx
mov ah, 0x60
push esi
js 0x52d413
pop edx
loop 0x52d4c7
adc al, 0x34
loop 0x52d432
adc dword [edx - 0x6b], ebp
in eax, 0xf4
aad 0x40
adc byte [eax + 0x8099131], ah
int1
xchg edx, eax
test al, 0x51
retf 0xea67
pop esp
jo 0x52d45e
jo 0x52d45e
jne 0x52d444
pop dword [esi + 0xf]
fistp dword [ebp + 0x55]
pand mm3, qword [ebp + 0x55]
movsb byte es:[edi], byte [esi]
inc edx
lds esp, [eax + 0x14713378]
js 0x52d4cf
jno 0x52d4b2
mov ebp, 0x31eb1e30
lodsd eax, dword [esi]
mov ecx, 0x5e5a6282
and byte [esi], ah
lahf
pushal
mov dword [0xc293add4], eax
xor byte [esi], bl
jmp 0x52d4d4
enter 0xffffffffffffe70c, 0xffffffffffffffd0
leave
stosb byte es:[edi], al
ficomp dword [0xbdd44e44]
pop ebp
mov al, byte [ecx - 0x47779bbf]
lea edi, [0x4a2e1ca0]
mov byte [eax + 0x1ca03d8d], bh
dec edx
mov al, byte [0x614a2e1c]
popal
fsubr st(2)
mov al, byte [0x44c365c4]
les esp, [ebp - 0x3d]
inc esp
js 0x52d49f
retf 0x3d71
jno 0x52d514
cwde
test byte [ebp + 0x2d], ch
enter 0x7845, 0xfffffffffffffff0
pop ecx
adc al, 0x1a
cwde
xchg ebp, eax
jns 0x52d466
xchg edx, eax
insb byte es:[edi], dx
cmp bl, ah
mov esp, 0x957e2593
mov es, word [ebx - 0x43]
mov ebp, 0xb976b752
daa
pushfd
jg 0x52d54b
dec ecx
jno 0x52d56f
push esp
arpl word [edx + ebp*4 + 0x53], ax
mov esi, 0xc04dc124
pop edx
cdq
pop esi
dec eax
aaa
adc eax, 0x428339a4
fstp st(5)
pop eax
adc byte [ebx + edx*8 - 0x470efdbc], 0x1b
jbe 0x52d4c3
xor dword [ecx + 0x11], ecx
mov ecx, 0xdbeef7c2
jb 0x52d52a
sub cl, bh
stc
adc byte [esi - 0x52ff8209], al
mov byte [0x677693a0], al
mov ecx, ebp
stosd dword es:[edi], eax
and al, 0xec
mov byte [0xb56c88a1], al
in eax, 0x4d
dec esp
ret
sal byte [edi + 0x1c13e3a9], 1
sal byte [eax - 0x29ba7b64], cl
mov gs, word [edi + 0x25]
out dx, al
Function at 0x54bb9e
Capabilities:
Encode data using xor

Disassembly:
shl dword [esi + 0x77f68de7], 0xad
mov edx, 0x70fa5e32
inc esp
in eax, 0xba
test dword [ebp + 0x5c], 0x8d64bcb6
cdq
invalid
pop esp
mov dh, 0xbc
lea ebx, fs:[ecx + 0x4060958f]
invalid
jecxz 0x54bb18
mov al, byte [ebp + 0x73fbc293]
or eax, dword [ebx + 0x53]
adc byte ds:[ebp - 0x436d6f34], 0xc6
out dx, al
cmpsb byte [esi], byte es:[edi]
mov al, 0xf1
sbb al, 7
fadd st(1), st(0)
js 0x54bb29
mov ah, 0x6c
scasb al, byte es:[edi]
salc
aam 0x67
into
je 0x54bbd3
invalid
xor al, 0x86
push es
xchg byte [esi], al
or byte [esp + ebx*8], dl
and edi, esi
inc ebp
test dword [eax - 0x7e], ecx
push edi
in eax, 0x3c
stosb byte es:[edi], al
mov ah, 0x28
mov byte [eax + 0xd38e1ac], dl
cli
cli
mov esp, ss
mov al, 0x59
xchg dword [ebp + 0x10], edi
test eax, 0x379d5294
in eax, dx
pop ecx
jp 0x54bc3b
lcall 0xb196, 0xa6d68d84
mov edx, 0xa37f77b1
cmpsb byte [esi], byte es:[edi]
xchg esi, eax
mov cl, 0xba
mov cl, 0x77
jg 0x54bb78
cmp al, byte [ebp - 0x75dd3922]
imul ebp, dword [edi + 0x11], 0xfffffff3
xor ah, byte [edx + esi*4]
stosb byte es:[edi], al
or esi, eax
std
sti
mov ebx, 0xa6b15515
mov bh, 0xbe
imul esi, dword [ebp + 0x7a22a7b0], 0xffffffa8
loope 0x54bbcd
dec edx
pop es
push esp
adc dword [edi], 0x580f4a33
adc eax, 0x81dd40ed
adc dword [0xd15eab5e], edi
sub edi, 0xdda4cb0
test byte [ecx + 0x3eb37264], cl
xor ebx, dword [ebx + 0x18]
rol dword [0x302988e1], cl
cmp bh, byte [ecx + 0x51]
xchg ebx, eax
and eax, 0xa41166e1
xchg ecx, eax
mov dh, 0xc3
mov al, byte [0x8c07e4a0]
xchg ebx, eax
movsb byte es:[edi], byte [esi]
mov ah, 0x84
xchg ecx, eax
inc esi
retf 0x5e55
adc dword [eax + 0x76e0146b], esi
fimul word [esi]
push edx
mov bh, 0x30
test dword [ebp - 0x565a5b9c], esp
pop ebp
pop esi
mov es, word [ebx]
cmp ebp, eax
cdq
pop ebp
jbe 0x54bc76
mov cl, dh
jmp 0x54bc6d
int 0x63
xor dword [ecx + edx*2 + 0x5eac46ed], edx
push ecx
jb 0x54bcd6
xchg esi, eax
mov esp, 0x21d995e2
rcl byte [eax], 0xca
add eax, 0x208ac9f0
mov bl, 0x58
push ebp
dec esp
popfd
invalid
push ebx
xor bl, al
jmp 0xdf2c62c5

Function at 0x59d6be
Capabilities:
Encode data using xor

Disassembly:
dec edx
fsubr dword [edi + esi]
cmp eax, 0x7b913be5
bound ebp, qword [ecx + ebp + 0x3e8e2e15]
mov ecx, 0x3121218c
xchg ebp, eax
add esp, ecx
xor edx, dword [ecx + 0x6a016751]
aas
mov gs, word [ebx]
and dword [eax], ecx
jnp 0x59d6ef
dec eax
mov eax, 0x3038fc12
pop ss
invalid
invalid