joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40216b
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
call main
jmp 0x402175
push 0x14
push 0x411788
call fcn.00405300
call main
movzx esi, ax
push 2
call main
pop ecx
mov eax, 0x5a4d
cmp word [0x400000], ax
je 0x4021a3
xor ebx, ebx
jmp 0x4021d6
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x40219f
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x40219f
xor ebx, ebx
cmp dword [eax + 0x400074], 0xe
jbe 0x4021d6
cmp dword [eax + 0x4000e8], ebx
setne bl
mov dword [ebp - 0x1c], ebx
call fcn.004048ef
test eax, eax
jne 0x4021ea
push 0x1c
call main
pop ecx
call fcn.00403b58
test eax, eax
jne 0x4021fb
push 0x10
call main
pop ecx
call fcn.004051cc
and dword [ebp - 4], 0
call fcn.00404904
test eax, eax
jns 0x402215
push 0x1b
call main
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x4162e8], eax
call main
mov dword [0x414430], eax
call main
test eax, eax
jns 0x40223b
push 8
call main
pop ecx
call fcn.00404de7
test eax, eax
jns 0x40224c
push 9
call main
pop ecx
push 1
call main
pop ecx
test eax, eax
je 0x40225f
push eax
call main
pop ecx
call fcn.00405299
push esi
push eax
push 0
push 0x400000
call main
mov esi, eax
mov dword [ebp - 0x24], esi
test ebx, ebx
jne 0x402281
push esi
call main
call fcn.00404663
jmp 0x4022b6
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
call fcn.00405345
ret

Function at 0x407282
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x407291
pop dword [ebp - 8]
mov eax, 0x585acf98
add eax, 0xa7e5a2f9
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x374e0e12
sub dword [ebp - 0x18], 0xe8fbc8c7
mov dword [ebp - 0x14], 0xfa1f2b4d
add dword [ebp - 0x14], 0x381420f8
mov dword [ebp - 0x10], 0xbf056f39
add dword [ebp - 0x10], 0x8d46d4f5
mov dword [ebp - 0xc], 0x75e4d471
add dword [ebp - 0xc], 0x8a1b2b8f
lea eax, [ebp - 0x18]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x205a325c
sub dword [ebp - 0x18], 0xabe7c906
mov dword [ebp - 0x14], 0xbe2be895
add dword [ebp - 0x14], 0x834078e0
mov dword [ebp - 0x10], 0x7116bbad
sub dword [ebp - 0x10], 0xda74f41
mov dword [ebp - 0xc], 0xaad95bdb
sub dword [ebp - 0xc], 0xaad95bdb
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0xce25e54b
add eax, 0x321aeae5
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x3956d
push 0
call eax
mov ecx, 0x1b2409ac
add ecx, 0xe4dc404f
xor edx, edx
add edx, eax
mov esi, 0x209f233b
add esi, 0xdfa2ecc5
add esi, dword [ebp - 8]
mov ebx, 0xfa13e765
add ebx, 0x70046b0c
mov dword [ebp - 4], 0xcb5e055f
mov edi, dword [esi]
add dword [ebp - 4], 0x82a172b7
xor edi, ebx
mov dword [edx], edi
sub dword [ebp - 4], eax
add edx, 4
add esi, 4
loop 0x4073b0
add eax, 0x11abf
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x9d16d7ef
sub ecx, 0x9cd6d7ef
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x10013a24
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x10013a33
pop dword [ebp - 0x24]
mov eax, 0x8174928
add eax, 0x7e9f10b
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x3dde1f01
add dword [ebp - 0x34], 0x1074264a
mov dword [ebp - 0x30], 0x981c97c9
sub dword [ebp - 0x30], 0x65e94b84
mov dword [ebp - 0x2c], 0x56535d5d
add dword [ebp - 0x2c], 0xf5f8e6d1
mov dword [ebp - 0x28], 0xb01a07f1
add dword [ebp - 0x28], 0x4fe5f80f
lea eax, [ebp - 0x34]
push eax
mov eax, 0xd46634ec
add eax, 0x3b9b8b94
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x725bea5c
add dword [ebp - 0x34], 0x2167efa
mov dword [ebp - 0x30], 0xcb873d2a
sub dword [ebp - 0x30], 0x8a1adbb5
mov dword [ebp - 0x2c], 0xf1b2c5d5
sub dword [ebp - 0x2c], 0x8e435969
mov dword [ebp - 0x28], 0xee3323af
sub dword [ebp - 0x28], 0xee3323af
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0xf42bbdc3
sub eax, 0xe429fdc3
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x340e5
push 0
call eax
mov ecx, 0xba904b82
add ecx, 0x456fef12
mov esi, eax
mov edi, 0x2ccdc54d
add edi, 0xe334a2b3
add edi, dword [ebp - 0x24]
mov ebx, 0xcd399251
add ebx, 0x8ee20e8
xor dword [ebp - 0x14], esi
mov edx, dword [edi]
add dword [ebp - 4], edi
xor edx, ebx
xor dword [ebp - 0x20], eax
mov dword [esi], edx
add dword [ebp - 0x18], 0x72c1551e
add esi, 4
add edi, 4
loop 0x10013b55
add eax, 0xdd23
xor ebx, ebx
add ebx, eax
add eax, 0x47b16f84
add eax, 0xb84e9081
mov ecx, 0x8314f8e0
sub ecx, 0x7314f8e0
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x41f150
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x14000]
push edi
or ebp, 0xffffffff
jmp 0x41f172
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41f179
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41f168
mov eax, 1
add ebx, ebx
jne 0x41f18b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41f180
jne 0x41f19c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41f180
xor ecx, ecx
sub eax, 3
jb 0x41f1b0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41f222
mov ebp, eax
add ebx, ebx
jne 0x41f1bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41f1c8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41f1ec
inc ecx
add ebx, ebx
jne 0x41f1d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41f1cd
jne 0x41f1e9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41f1cd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41f20c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41f1fd
jmp 0x41f16e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41f20c
add edi, ecx
jmp 0x41f16e
pop esi
mov edi, esi
mov ecx, 0x7b7
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41f22a
cmp byte [edi], 5
jne 0x41f22a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x41f22f
lea edi, [esi + 0x1d000]
mov eax, dword [edi]
or eax, eax
je 0x41f2a7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x208f8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x20998]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41f25c
mov ecx, edi
jns 0x41f28b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2099c]
or eax, eax
je 0x41f2a1
mov dword [ebx], eax
add ebx, 4
jmp 0x41f279
call dword [esi + 0x209a0]
popal
jmp section.UPX0

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x405060
Capabilities:
Hash data using fnv

Disassembly:
movsx eax, dl
xor eax, ecx
imul eax, eax, 0x1000193
ret

Function at 0x405070
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
mov esi, dword [0x4844a4]
lea eax, [ecx - 0x345]
push edi
mov edi, dword [0x4844a0]
cmp eax, 0x16
ja 0x4050ad
lea eax, [edx - 0xc]
cmp eax, 0x14
ja 0x4050ad
lea eax, [edi - 0x345]
cmp eax, 0x16
ja 0x4050ad
lea eax, [esi - 0xc]
cmp eax, 0x14
ja 0x4050ad
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
lea eax, [ecx - 0x32c]
cmp eax, 0x12
ja 0x4050e7
lea eax, [edx - 0xc]
cmp eax, 0x14
ja 0x4050e7
lea eax, [edi - 0x32c]
cmp eax, 0x12
ja 0x4050e7
lea eax, [esi - 0xc]
cmp eax, 0x14
ja 0x4050e7
call fcn.00405480
push 6
push dword [0x484498]
call eax
jmp 0x40534b
cmp ecx, 0xe
jl 0x40534b
cmp ecx, 0x64
jg 0x40534b
lea eax, [edx - 0xce]
cmp eax, 0x42
ja 0x4051e0
lea eax, [edi - 0xe]
cmp eax, 0x56
ja 0x4051e0
lea eax, [esi - 0xce]
cmp eax, 0x42
ja 0x4051e0
mov eax, dword [0x484020]
mov dword [0x484020], 1
cmp eax, 1
je 0x40534b
cmp eax, 2
jne 0x405190
lea esi, [eax + 2]
nop dword [eax]
nop word [eax + eax]
movsd xmm0, qword [0x484018]
subsd xmm0, qword [0x481418]
movsd qword [0x484018], xmm0
call fcn.00405500
push 0
push 0
push dword [0x484498]
call eax
call fcn.00405580
push dword [0x484498]
call eax
sub esi, 1
jne 0x405150
jmp 0x40534b
mov esi, 8
nop word [eax + eax]
movsd xmm0, qword [0x484018]
subsd xmm0, qword [0x481418]
movsd qword [0x484018], xmm0
call fcn.00405600
push 0
push 0
push dword [0x484498]
call eax
call fcn.00405680
push dword [0x484498]
call eax
sub esi, 1
jne 0x4051a0
jmp 0x40534b
lea eax, [edx - 0x124]
cmp eax, 0x42
ja 0x405269
lea eax, [edi - 0xe]
cmp eax, 0x56
ja 0x405269
lea eax, [esi - 0x124]
cmp eax, 0x42
ja 0x405269
mov edi, dword [0x484020]
mov ecx, 2
mov dword [0x484020], ecx
lea esi, [ecx + 2]
movsd xmm0, qword [0x484018]
mov eax, edi
sub eax, ecx
movd xmm1, eax
cvtdq2pd xmm1, xmm1
mulsd xmm1, qword [0x481418]
subsd xmm0, xmm1
movsd qword [0x484018], xmm0
call fcn.00405700
push 0
push 0
push dword [0x484498]
call eax
call fcn.00405780
push dword [0x484498]
call eax
sub esi, 1
je 0x40534b
mov ecx, dword [0x484020]
jmp 0x405212
lea eax, [edx - 0x17a]
cmp eax, 0x42
ja 0x40534b
lea eax, [edi - 0xe]
cmp eax, 0x56
ja 0x40534b
lea eax, [esi - 0x17a]
cmp eax, 0x42
ja 0x40534b
mov eax, dword [0x484020]
mov dword [0x484020], 3
cmp eax, 3
je 0x40534b
cmp eax, 2
jne 0x4052fd
lea esi, [eax + 2]
nop dword [eax]
nop word [eax + eax]
movsd xmm0, qword [0x484018]
addsd xmm0, qword [0x481418]
movsd qword [0x484018], xmm0
call fcn.00405800
push 0
push 0
push dword [0x484498]
call eax
call fcn.00405880
push dword [0x484498]
call eax
sub esi, 1
jne 0x4052c0
jmp 0x40534b
mov esi, 8
nop dword [eax]
nop word [eax + eax]
movsd xmm0, qword [0x484018]
addsd xmm0, qword [0x481418]
movsd qword [0x484018], xmm0
call fcn.00405900
push 0
push 0
push dword [0x484498]
call eax
call fcn.00405980
push dword [0x484498]
call eax
sub esi, 1
jne 0x405310
call fcn.00405a00
push 0
push 0
push dword [0x484498]
call eax
call fcn.00405a80
push dword [0x484498]
call eax
pop edi
pop esi
pop ecx
ret 8
Function at 0x480476
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4804b5
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4804b5
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4804b5
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4804b5
cmp dword [ecx + 0x74], 0xe
jbe 0x4804b5
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x10007c1f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x10007c2e
pop dword [ebp - 0x48]
mov eax, 0xe9a8dca7
add eax, 0x26579f87
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x9ceaa8c1
add dword [ebp - 0x58], 0xb1679c8a
mov dword [ebp - 0x54], 0x127b08e6
add dword [ebp - 0x54], 0x1fb8435f
mov dword [ebp - 0x50], 0xf0c7dac9
sub dword [ebp - 0x50], 0xa47b969b
mov dword [ebp - 0x4c], 0xf6d56244
sub dword [ebp - 0x4c], 0xf6d56244
lea eax, [ebp - 0x58]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xb68542fc
add dword [ebp - 0x58], 0xbded265a
mov dword [ebp - 0x54], 0x1f79e0d3
sub dword [ebp - 0x54], 0xde0d7f5e
mov dword [ebp - 0x50], 0x37b5668d
add dword [ebp - 0x50], 0x2bba05df
mov dword [ebp - 0x4c], 0xb3c735b8
sub dword [ebp - 0x4c], 0xb3c735b8
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0x7b47f120
sub eax, 0x6b4770d0
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x35b0a
push 0
call eax
mov ecx, 0x4417
xor esi, esi
add esi, eax
mov edx, 0x1000fa00
add edx, dword [ebp - 0x48]
mov ebx, 0x4b909d73
add ebx, 0xfe548ef9
xor dword [ebp - 4], ebx
mov edi, dword [edx]
add dword [ebp - 0x2c], 0x5b708517
add edi, ebx
add dword [ebp - 0xc], edx
mov dword [esi], edi
sub dword [ebp - 0x28], 0x4b3b81dd
add esi, 0x4ed3b08
add esi, 0xfb12c4fc
add edx, 4
loop 0x10007d41
add eax, 0x1032f
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x74bd9e63
sub ecx, 0x64bd9e63
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x1000d5e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x1000d5ef
pop dword [ebp - 0x4c]
mov eax, 0x1000d5ef
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0xe915d4b7
add dword [ebp - 0x5c], 0x653c7094
mov dword [ebp - 0x58], 0xc16e55f5
sub dword [ebp - 0x58], 0x8f3b09b0
mov dword [ebp - 0x54], 0xd6b3c680
sub dword [ebp - 0x54], 0x8a678252
mov dword [ebp - 0x50], 0x1644d582
add dword [ebp - 0x50], 0xe9bb2a7e
lea eax, [ebp - 0x5c]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0xc2ddb9fe
add dword [ebp - 0x5c], 0xb194af58
mov dword [ebp - 0x58], 0x21fbfca7
sub dword [ebp - 0x58], 0xe08f9b32
mov dword [ebp - 0x54], 0x385326a0
add dword [ebp - 0x54], 0x2b1c45cc
mov dword [ebp - 0x50], 0x3b68ec36
add dword [ebp - 0x50], 0xc49713ca
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0x628605a9
add eax, 0xad7bbab7
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x3c52e
push 0
call eax
mov ecx, 0x4a63
mov ebx, eax
mov esi, 0x10028800
add esi, dword [ebp - 0x4c]
mov edi, 0xd8840d53
xor dword [ebp - 0xc], 0xc4c3a7b1
mov edx, dword [esi]
xor dword [ebp - 0x24], edx
xor edx, edi
xor dword [ebp - 0xc], eax
mov dword [ebx], edx
sub dword [ebp - 0x34], ecx
add ebx, 0x56449fe3
add ebx, 0xa9bb6021
add esi, 4
loop 0x1000d6f5
add eax, 0x11c5f
mov ebx, eax
add eax, 0x257f250d
add eax, 0xda80daf8
mov ecx, 0x1c10fe4d
sub ecx, 0xc10fe4d
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x4b4e70
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x72000]
push edi
jmp 0x4b4e8a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4b4e91
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b4e80
mov eax, 1
add ebx, ebx
jne 0x4b4ea3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4b4eb4
jne 0x4b4ed3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b4ed3
dec eax
add ebx, ebx
jne 0x4b4ec0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4b4e98
add ebx, ebx
jne 0x4b4ecf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4b4f25
xor ecx, ecx
sub eax, 3
jb 0x4b4eeb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4b4f5a
sar eax, 1
mov ebp, eax
jmp 0x4b4ef6
add ebx, ebx
jne 0x4b4ef6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b4ec4
inc ecx
add ebx, ebx
jne 0x4b4f04
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b4ec4
add ebx, ebx
jne 0x4b4f11
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4b4f06
jne 0x4b4f22
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4b4f06
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4b4f44
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4b4f36
jmp 0x4b4e86
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4b4f44
add edi, ecx
jmp 0x4b4e86
pop esi
mov edi, esi
mov ecx, 0x379b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4b4f62
cmp byte [edi], 0x13
jne 0x4b4f62
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4b4f67
lea edi, [esi + 0xb0000]
mov eax, dword [edi]
or eax, eax
je 0x4b4fdf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xb8280]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xb83d4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4b4f94
mov ecx, edi
jns 0x4b4fc3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xb83d8]
or eax, eax
je 0x4b4fd9
mov dword [ebx], eax
add ebx, 4
jmp 0x4b4fb1
call dword [esi + 0xb83e8]
mov ebp, dword [esi + 0xb83dc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4b5013
sub esp, 0xffffff80
jmp 0x4165c1
Function at 0x76bf10
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x7809fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [esp + 0x2c]
xor ebp, ebp
mov dword [esp + 0x10], eax
xor ebx, ebx
mov eax, 1
mov ecx, ebx
shl eax, cl
mov ecx, dword [esp + 0x10]
test ecx, eax
je 0x76c002
lea edx, [ebx + 0x41]
lea eax, [esp + 0x14]
push edx
push str._c:_
push eax
call fcn.0076fdff
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x76c002
lea edx, [esp + 0x14]
push edx
push str.Mounting__s_n
call fcn.007676e0
lea eax, [esp + 0x1c]
lea edi, [esi + 0x1048]
push eax
push edi
mov word [esp + 0x28], bp
call fcn.0077020b
push 0x10
call fcn.007701d3
add esp, 0x14
mov dword [esp + 0x2c], eax
cmp eax, ebp
mov dword [esp + 0x24], ebp
je 0x76bfc5
mov cx, word [edi]
push ecx
mov ecx, eax
call fcn.0075c1c0
jmp 0x76bfc7
xor eax, eax
push esi
mov dword [esp + 0x28], 0xffffffff
mov dword [esi], eax
call fcn.0076bb80
mov edi, dword [esi]
add esp, 4
cmp edi, ebp
je 0x76bff0
mov ecx, edi
call fcn.0075c2c0
push edi
call fcn.007701c8
add esp, 4
mov edx, dword [esi + 0x1024]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x76c021
inc ebx
cmp ebx, 0x20
jb 0x76bf3e
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x76f1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.0076f140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.0076f140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.0076f140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.0076f140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x76fbfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x76fc50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x78187c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x76fc43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x76fc52
xor eax, eax
pop esi
leave
ret 4
Function at 0x10013600
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 0x40
push esi
push edi
push ebx
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
jne 0x10013633
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0xc]
lea ecx, [ebp - 0xc]
push ecx
push esi
push edx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x1001364b
mov dword [ebp - 4], eax
cmp dword [ebp - 0xc], esi
je 0x10013657
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 8]
lea eax, [ebp - 8]
push eax
push ecx
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
jne 0x1001366f
mov dword [ebp - 4], eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
test eax, eax
je 0x1001362c
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100244d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x101e10ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 0x10]
push ecx
push 0x40
sub eax, esi
push 5
sub eax, 5
push esi
mov byte [ebp - 0xc], 0xe9
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xb], eax
call edi
test eax, eax
jne 0x10024517
push str.Failed_to_unprotect_memory_n
jmp 0x10024538
mov edx, dword [ebp - 0xc]
mov al, byte [ebp - 8]
mov dword [esi], edx
mov edx, dword [ebp - 0x10]
lea ecx, [ebp - 0x14]
push ecx
push edx
push 5
push esi
mov byte [esi + 4], al
call edi
test eax, eax
jne 0x10024540
push str.Failed_to_restore_protection_on_memory
call fcn.101166c9
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.101140e8
mov esp, ebp
pop ebp
ret 8

Function at 0x1002e660
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x101e10ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 0x10]
push ecx
push 0x40
sub eax, esi
push 5
sub eax, 5
push esi
mov byte [ebp - 0xc], 0xe9
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xb], eax
call edi
test eax, eax
jne 0x1002e6a7
push str.Failed_to_unprotect_memory_n
jmp 0x1002e6c8
mov edx, dword [ebp - 0xc]
mov al, byte [ebp - 8]
mov dword [esi], edx
mov edx, dword [ebp - 0x10]
lea ecx, [ebp - 0x14]
push ecx
push edx
push 5
push esi
mov byte [esi + 4], al
call edi
test eax, eax
jne 0x1002e6d0
push str.Failed_to_restore_protection_on_memory
call fcn.101166c9
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.101140e8
mov esp, ebp
pop ebp
ret