joyce8/EMBER2024-capa huggingface dataset:
Function at 0x454aa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, ecx
xor esi, esi
test edi, edi
je 0x454ac8
movzx ecx, byte [esi + edx]
inc esi
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4c0110]
cmp esi, edi
jb 0x454ab0
pop edi
pop esi
pop ebp
ret
Function at 0x457be0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x4cf070]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ecx + 0x10]
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x410], eax
lea eax, [ecx + 0x20]
mov dword [ebp - 0x414], eax
lea eax, [ecx + 0x30]
mov dword [ebp - 0x418], eax
lea eax, [ecx + 0x40]
mov dword [ebp - 0x41c], eax
lea eax, [ecx + 0x50]
push ebx
mov dword [ebp - 0x420], eax
xor ebx, ebx
lea eax, [ecx + 0x60]
mov dword [ebp - 0x408], ebx
push esi
mov dword [ebp - 0x424], eax
lea eax, [ecx + 0x70]
push edi
mov dword [ebp - 0x428], eax
lea edi, [edx + 0x800]
mov dword [ebp - 0x40c], 0x100
mov edx, ebx
lea edi, [edi + 4]
shr edx, 4
mov esi, ebx
and esi, 0xf
mov ah, byte [edx + ecx]
mov ecx, dword [ebp - 0x410]
shl ah, 4
xor ah, byte [esi + ecx]
mov ecx, dword [ebp - 0x414]
mov al, byte [edx + ecx]
mov ecx, dword [ebp - 0x418]
shl al, 4
xor al, byte [esi + ecx]
mov ecx, dword [ebp - 0x41c]
mov bh, byte [edx + ecx]
mov ecx, dword [ebp - 0x420]
shl bh, 4
xor bh, byte [esi + ecx]
mov ecx, dword [ebp - 0x424]
mov bl, byte [edx + ecx]
mov ecx, dword [ebp - 0x428]
movzx edx, al
movzx eax, ah
shl eax, 3
shl bl, 4
xor bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x42c]
mov dword [edi - 0x804], eax
shl edx, 0x10
mov eax, edx
shl edx, 0xb
shr eax, 0x15
xor eax, edx
mov dword [edi - 0x404], eax
movzx eax, bh
shl eax, 0x13
mov dword [edi - 4], eax
movzx eax, bl
mov ebx, dword [ebp - 0x408]
shl eax, 0xb
inc ebx
sub dword [ebp - 0x40c], 1
mov dword [edi + 0x3fc], eax
mov dword [ebp - 0x408], ebx
jne 0x457c53
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047398a
mov esp, ebp
pop ebp
ret
Function at 0x464b90
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x15c
mov eax, dword [0x4cf070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x154], 0
push edi
mov eax, edx
mov dword [ebp - 0x158], esi
lea ecx, [ebp - 0x154]
mov dword [ebp - 0x15c], eax
push ecx
push 0x40
lea ecx, [ebp - 0x48]
mov dword [eax], 0
mov eax, dword [esi]
push ecx
push 0
push 0
mov eax, dword [eax]
push esi
call eax
add esp, 0x18
test eax, eax
js 0x464e04
cmp dword [ebp - 0x154], 0x40
jne 0x464e02
mov eax, 0x5a4d
cmp word [ebp - 0x48], ax
jne 0x464e02
mov eax, dword [ebp - 0x30]
cmp ax, 0x40
jae 0x464c17
test ax, ax
jne 0x464e02
mov eax, dword [ebp - 0xc]
cmp eax, 0x40
jb 0x464e02
test al, 3
jne 0x464e02
lea ecx, [ebp - 0x154]
cdq
push ecx
push 0xf8
mov edi, eax
lea ecx, [ebp - 0x150]
mov eax, dword [esi]
mov ebx, edx
push ecx
push ebx
push edi
mov eax, dword [eax]
push esi
call eax
add esp, 0x18
test eax, eax
js 0x464e04
cmp dword [ebp - 0x154], 0xf8
jne 0x464e02
cmp dword [ebp - 0x150], 0x4550
jne 0x464e02
mov eax, dword [ebp - 0x138]
mov edx, 0x10b
cmp ax, dx
je 0x464c9e
mov ecx, 0x20b
cmp ax, cx
jne 0x464e02
cmp ax, dx
jne 0x464d22
mov eax, 4
cmp eax, dword [ebp - 0xdc]
sbb eax, eax
and eax, 0x10
add eax, 0x10
push eax
call fcn.00494a87
mov esi, eax
add esp, 4
test esi, esi
je 0x464d7f
mov edx, edi
mov ecx, ebx
add edx, 0x58
mov eax, ebx
mov dword [esi], edx
adc ecx, 0
mov dword [esi + 4], ecx
mov ecx, edi
add ecx, 0x5c
mov dword [esi + 8], ecx
mov ecx, 1
adc eax, 0
mov dword [esi + 0xc], eax
cmp dword [ebp - 0xdc], 4
jbe 0x464d18
mov ecx, edi
mov eax, ebx
add ecx, 0x98
mov dword [esi + 0x10], ecx
mov ecx, 2
adc eax, 0
add edi, 0xa0
mov dword [esi + 0x14], eax
adc ebx, 0
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], ebx
mov edx, 1
jmp 0x464dee
mov edx, dword [esi]
lea eax, [ebp - 0x154]
push eax
push 0x10
lea eax, [ebp - 0x58]
mov ecx, edi
push eax
add ecx, 0xf8
mov eax, ebx
adc eax, 0
push eax
mov eax, dword [edx]
push ecx
push esi
call eax
add esp, 0x18
test eax, eax
js 0x464e04
cmp dword [ebp - 0x154], 0x10
jne 0x464e02
mov eax, 4
cmp eax, dword [ebp - 0xcc]
sbb eax, eax
and eax, 0x10
add eax, 0x10
push eax
call fcn.00494a87
mov esi, eax
add esp, 4
test esi, esi
jne 0x464d95
mov eax, 0xfffffff9
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047398a
mov esp, ebp
pop ebp
ret
mov ecx, edi
mov eax, ebx
add ecx, 0x58
mov dword [esi], ecx
mov ecx, edi
adc eax, 0
add ecx, 0x5c
mov dword [esi + 4], eax
mov eax, ebx
adc eax, 0
mov dword [esi + 8], ecx
mov dword [esi + 0xc], eax
mov ecx, 1
cmp dword [ebp - 0xcc], 4
jbe 0x464de9
mov ecx, edi
mov eax, ebx
add ecx, 0xa8
mov dword [esi + 0x10], ecx
mov ecx, 2
adc eax, 0
add edi, 0xb0
mov dword [esi + 0x14], eax
adc ebx, 0
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], ebx
mov edx, 2
mov eax, dword [ebp - 0x158]
mov dword [eax + 4], esi
mov dword [eax + 8], ecx
mov eax, dword [ebp - 0x15c]
mov dword [eax], edx
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047398a
mov esp, ebp
pop ebp
ret
Function at 0x467680
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
test edx, edx
jne 0x46768e
xor eax, eax
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
or eax, 0xffffffff
cmp esi, 8
jb 0x46774b
push edi
mov edi, esi
shr edi, 3
movzx ecx, byte [edx]
sub esi, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4c0110]
movzx ecx, byte [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4c0110]
movzx ecx, byte [edx + 2]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4c0110]
movzx ecx, byte [edx + 3]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4c0110]
movzx ecx, byte [edx + 4]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4c0110]
movzx ecx, byte [edx + 5]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4c0110]
movzx ecx, byte [edx + 6]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4c0110]
movzx ecx, byte [edx + 7]
add edx, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4c0110]
sub edi, 1
jne 0x4676a4
pop edi
test esi, esi
je 0x46776a
nop
movzx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4c0110]
sub esi, 1
jne 0x467750
not eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x52dff0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xc9000]
push edi
jmp 0x52e00a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x52e011
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52e000
mov eax, 1
add ebx, ebx
jne 0x52e023
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x52e034
jne 0x52e053
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52e053
dec eax
add ebx, ebx
jne 0x52e040
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x52e018
add ebx, ebx
jne 0x52e04f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x52e0a5
xor ecx, ecx
sub eax, 3
jb 0x52e06b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x52e0da
sar eax, 1
mov ebp, eax
jmp 0x52e076
add ebx, ebx
jne 0x52e076
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52e044
inc ecx
add ebx, ebx
jne 0x52e084
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52e044
add ebx, ebx
jne 0x52e091
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x52e086
jne 0x52e0a2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x52e086
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x52e0c4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x52e0b6
jmp 0x52e006
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x52e0c4
add edi, ecx
jmp 0x52e006
pop esi
mov edi, esi
mov ecx, 0x3ea9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x52e0e2
cmp byte [edi], 0x11
jne 0x52e0e2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x52e0e7
lea edi, [esi + 0x126000]
mov eax, dword [edi]
or eax, eax
je 0x52e15f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x173424]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1735a0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x52e114
mov ecx, edi
jns 0x52e143
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1735a4]
or eax, eax
je 0x52e159
mov dword [ebx], eax
add ebx, 4
jmp 0x52e131
call dword [esi + 0x1735b4]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x52e190
cmp al, 0xef
ja 0x52e183
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x52e165
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x52e172
mov ebp, dword [esi + 0x1735a8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x52e1c4
sub esp, 0xffffff80
jmp 0x42800a
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x6967666
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x433060
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x2f672479
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4330c0
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x100010c8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x3c]
lea eax, [eax + ecx + 0x78]
xor edx, edx
push ebx
push edi
cmp dword [eax + 4], edx
jne 0x100010e3
xor eax, eax
jmp 0x10001108
push esi
mov esi, dword [eax]
add esi, ecx
mov eax, dword [esi + 0x18]
cmp eax, edx
je 0x10001105
cmp dword [esi + 0x14], edx
je 0x10001105
mov edi, dword [esi + 0x20]
mov ebx, dword [esi + 0x24]
add edi, ecx
add ebx, ecx
mov dword [ebp - 4], edx
cmp eax, edx
ja 0x1000110f
xor eax, eax
pop esi
pop edi
pop ebx
leave
ret
mov ecx, dword [ebp + 8]
mov eax, dword [edi]
add eax, ecx
mov ecx, dword [ebp + 0xc]
call section..text
test eax, eax
je 0x10001131
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
add edi, 4
inc ebx
inc ebx
cmp eax, dword [esi + 0x18]
jb 0x1000110c
jmp 0x10001105
movzx eax, word [ebx]
cmp eax, 0xffffffff
je 0x10001105
cmp eax, dword [esi + 0x14]
ja 0x10001105
mov ecx, dword [esi + 0x1c]
lea eax, [ecx + eax*4]
mov ecx, dword [ebp + 8]
mov eax, dword [eax + ecx]
add eax, ecx
jmp 0x10001107

Function at 0x10001266
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x508
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, 0x3ff
push esi
lea eax, [ebp - 0x507]
push 0
push eax
mov byte [ebp - 0x508], 0
call sub.msvcrt.dll_memset
mov eax, dword [0x10021dd4]
add esp, 0xc
cmp eax, 0xffffffff
jne 0x10001305
push esi
lea eax, [ebp - 0x508]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov esi, 0x104
push esi
lea eax, [ebp - 0x108]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push esi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x108]
push str._services.exe
push eax
call sub.msvcrt.dll_strcat
pop ecx
pop ecx
lea eax, [ebp - 0x108]
lea ecx, [ebp - 0x508]
call section..text
neg eax
sbb eax, eax
inc eax
mov dword [0x10021dd4], eax
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
pop esi
call fcn.100037a0
leave
ret

Function at 0x10001317
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x508
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, 0x3ff
push esi
lea eax, [ebp - 0x507]
push 0
push eax
mov byte [ebp - 0x508], 0
call sub.msvcrt.dll_memset
mov eax, dword [0x10021dd8]
add esp, 0xc
cmp eax, 0xffffffff
jne 0x100013b6
push esi
lea eax, [ebp - 0x508]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov esi, 0x104
push esi
lea eax, [ebp - 0x108]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push esi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x108]
push str._svchost.exe
push eax
call sub.msvcrt.dll_strcat
pop ecx
pop ecx
lea eax, [ebp - 0x108]
lea ecx, [ebp - 0x508]
call section..text
neg eax
sbb eax, eax
inc eax
mov dword [0x10021dd8], eax
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
pop esi
call fcn.100037a0
leave
ret
Function at 0x100013c8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x508
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push 0xf8
lea eax, [ebp - 0xfc]
push ebx
push eax
mov byte [ebp - 0x108], 0x49
mov byte [ebp - 0x107], 0x4d
mov byte [ebp - 0x106], 0x4a
mov byte [ebp - 0x105], 0x50
mov byte [ebp - 0x104], 0x4d
mov byte [ebp - 0x103], 0x49
mov byte [ebp - 0x102], 0x47
mov byte [ebp - 0x101], 0x2e
mov byte [ebp - 0x100], 0x45
mov byte [ebp - 0xff], 0x58
mov byte [ebp - 0xfe], 0x45
mov byte [ebp - 0xfd], bl
call sub.msvcrt.dll_memset
push 0x3ff
lea eax, [ebp - 0x507]
push ebx
push eax
mov byte [ebp - 0x508], bl
call sub.msvcrt.dll_memset
add esp, 0x18
push 0x104
lea eax, [ebp - 0x508]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x508]
push 0x5c
push eax
call sub.msvcrt.dll_strrchr
pop ecx
pop ecx
mov ecx, eax
inc ecx
lea eax, [ebp - 0x108]
call section..text
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
xor ecx, ebp
inc eax
pop ebx
call fcn.100037a0
leave
ret

Function at 0x100014a1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x508
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, 0x3ff
push esi
lea eax, [ebp - 0x507]
push 0
push eax
mov byte [ebp - 0x508], 0
call sub.msvcrt.dll_memset
mov eax, dword [0x10021ddc]
add esp, 0xc
cmp eax, 0xffffffff
jne 0x10001540
push esi
lea eax, [ebp - 0x508]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov esi, 0x104
push esi
lea eax, [ebp - 0x108]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push esi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x108]
push str.SearchIndexer.exe
push eax
call sub.msvcrt.dll_strcat
pop ecx
pop ecx
lea eax, [ebp - 0x108]
lea ecx, [ebp - 0x508]
call section..text
neg eax
sbb eax, eax
inc eax
mov dword [0x10021ddc], eax
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
pop esi
call fcn.100037a0
leave
ret

Function at 0x10001552
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x508
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, 0x3ff
push esi
lea eax, [ebp - 0x507]
push 0
push eax
mov byte [ebp - 0x508], 0
call sub.msvcrt.dll_memset
mov eax, dword [0x10021de0]
add esp, 0xc
cmp eax, 0xffffffff
jne 0x100015f1
push esi
lea eax, [ebp - 0x508]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov esi, 0x104
push esi
lea eax, [ebp - 0x108]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push esi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x108]
push str.lsass.exe
push eax
call sub.msvcrt.dll_strcat
pop ecx
pop ecx
lea eax, [ebp - 0x108]
lea ecx, [ebp - 0x508]
call section..text
neg eax
sbb eax, eax
inc eax
mov dword [0x10021de0], eax
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
pop esi
call fcn.100037a0
leave
ret
Function at 0x10002608
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov byte [ebp - 0x14], 0x57
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x73
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0x10], 0x70
mov byte [ebp - 0xf], 0x69
mov byte [ebp - 0xe], 0x33
mov byte [ebp - 0xd], 0x32
mov byte [ebp - 0xc], 0x2e
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0xa], 0x6c
mov byte [ebp - 9], 0x6c
mov byte [ebp - 8], bl
call dword [0x10022254]
mov dword [ebp - 0x24], eax
cmp eax, ebx
je 0x100026fe
push str.WTSQueryUserToken
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1002229c], eax
cmp eax, ebx
je 0x100026fe
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
cmp eax, 0xffffffff
je 0x1000269f
lea ecx, [ebp - 0x18]
push ecx
push eax
call dword [0x1002229c]
pop ecx
pop ecx
test eax, eax
jne 0x100026f3
lea edi, [ebp - 0x20]
call fcn.100024ff
test eax, eax
je 0x100026db
push dword [ebp - 0x20]
push ebx
push 0x400
call dword [0x10022270]
mov esi, eax
cmp esi, ebx
je 0x100026db
lea eax, [ebp - 0x18]
push eax
push 0xf00ff
push esi
call dword [0x10022288]
test eax, eax
jne 0x100026f3
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x1c]
inc dword [ebp - 0x1c]
cmp eax, 0xf0
jb 0x10002683
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x18]
xor ecx, ebp
pop ebx
call fcn.100037a0
leave
ret
Function at 0x10002dec
Capabilities:
Check os version

Disassembly:
push 0x484
push 0x10005cc0
call fcn.10004420
xor ebx, ebx
mov dword [ebp - 4], ebx
call fcn.10001603
xor eax, eax
mov word [ebp - 0x224], ax
push 0x206
push ebx
lea eax, [ebp - 0x222]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea edi, [ebp - 0x224]
call fcn.10002a93
test eax, eax
je 0x10002fa6
mov esi, 0x104
push esi
mov eax, edi
push eax
call fcn.100010a1
mov byte [ebp - 0x328], bl
push 0x103
push ebx
lea eax, [ebp - 0x327]
push eax
call sub.msvcrt.dll_memset
add esp, 0x14
push ebx
push ebx
push esi
lea eax, [ebp - 0x328]
push eax
mov eax, edi
push eax
call sub.msvcrt.dll_wcslen
pop ecx
push eax
mov eax, edi
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x43c], ebx
push 0x110
push ebx
lea eax, [ebp - 0x438]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x43c], 0x114
lea eax, [ebp - 0x43c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 0x440], ebx
cmp dword [ebp - 0x438], 6
jb 0x10002ede
call fcn.10002608
mov esi, eax
lea eax, [ebp - 0x440]
push eax
call fcn.1000258d
pop ecx
cmp esi, ebx
je 0x10002ede
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x328]
push eax
call fcn.10002c96
pop ecx
test eax, eax
je 0x10002fa6
call fcn.1000281d
push str._TestRouteadsl
lea eax, [ebp - 0x224]
push eax
call sub.msvcrt.dll_wcscat
pop ecx
pop ecx
cmp dword [ebp - 0x438], 6
jae 0x10002f6f
mov dword [ebp - 0x494], ebx
push 0x40
push ebx
lea eax, [ebp - 0x490]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x494], 0x44
mov dword [ebp - 0x450], ebx
xor eax, eax
lea edi, [ebp - 0x44c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0x494]
push eax
push ebx
push ebx
push 0x200
push ebx
push ebx
push ebx
lea eax, [ebp - 0x224]
push eax
push ebx
call dword [0x10022278]
jmp 0x10002fa6
push dword [ebp - 0x440]
lea eax, [ebp - 0x224]
push eax
call fcn.1000270e
pop ecx
pop ecx
cmp dword [ebp - 0x440], ebx
je 0x10002f97
push dword [ebp - 0x440]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x440], ebx
jmp 0x10002fa6
push 0xfffffffffffffffe
pop esi
mov dword [ebp - 4], esi
mov dword [ebp - 4], 1
call fcn.10002bc4
call fcn.10002d7b
mov dword [ebp - 4], esi
jmp 0x10002fd0
xor eax, eax
call fcn.10004468
ret
Function at 0x415a50
Capabilities:
Read file on windows
Set file attributes

Disassembly:
sub esp, 0x41c
mov eax, dword [0x426004]
xor eax, esp
mov dword [esp + 0x418], eax
mov eax, dword [0x4297cc]
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov ebp, 0x1519a5
mov ebx, 0x8e46a7b8
mov dword [0x429434], ebx
cmp eax, 0x3dc
jne 0x415aa2
push 0
push 0x423a20
call esi
push 0
call edi
mov eax, dword [0x4297cc]
dec ebp
jne 0x415a83
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, dword [sym.imp.KERNEL32.dll_CancelIo]
xor esi, esi
cmp eax, 0x997
jne 0x415aeb
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x28]
push ecx
push ebp
lea edx, [esp + 0x34]
push edx
push ebp
mov dword [esp + 0x24], ebp
call edi
push ebp
call ebx
mov eax, dword [0x4297cc]
cmp esi, 0x845f8b
jne 0x415b02
mov eax, dword [0x427940]
add eax, 0xa231
mov dword [0x4297cc], eax
cmp eax, 0x141
jne 0x415b1d
mov dword [0x429008], 0xec58acac
mov dword [0x42900c], 0xffffffff
inc esi
cmp esi, 0x12cca12
jl 0x415ab3
call fcn.00415690
mov ecx, dword [esp + 0x428]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.004010fc
add esp, 0x41c
ret 0x10