joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401f80
Capabilities:
Inspect section memory permissions

Disassembly:
sub esp, 0x50
push ebx
push ebp
push esi
push edi
lea esi, [esp + 0x3c]
call fcn.0040e680
mov eax, dword [esp + 0x64]
xor ebp, ebp
push eax
mov ecx, esi
mov dword [esp + 0x18], ebp
call fcn.00402940
push 0x104
push 0x4a7d14
push ebp
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, 0x4a7d14
call fcn.0040ff90
lea esi, [esp + 0x40]
lea edi, [esp + 0x28]
mov bl, al
mov dword [0x4a7cf8], 0x4a7d14
call fcn.004107b0
mov edi, str.CMDLINERAW
lea esi, [esp + 0x18]
call fcn.00401b70
xor eax, eax
lea ecx, [ebp + 1]
lea edx, [esp + 0x28]
call fcn.004019e0
mov ecx, esi
call fcn.00402620
lea esi, [esp + 0x28]
call fcn.004092c0
mov edi, str.CMDLINE
lea esi, [esp + 0x18]
mov dword [esp + 0x30], 1
mov dword [esp + 0x28], ebp
call fcn.00401b70
xor eax, eax
mov ecx, 0x100
lea edx, [esp + 0x28]
call fcn.004019e0
mov ecx, esi
call fcn.00402620
lea esi, [esp + 0x18]
call fcn.00401b70
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x68]
push edx
xor ecx, ecx
call fcn.0040c3e0
mov ecx, esi
call fcn.00402620
mov ebp, dword [esp + 0x58]
lea ecx, [esp + 0x18]
call fcn.0040c060
lea ecx, [esp + 0x18]
lea eax, [esp + 0x3c]
call fcn.00401a70
mov esi, dword [esp + 0x18]
push esi
push str._ErrorStdOut
call fcn.004115d0
add esp, 8
test eax, eax
je 0x42c174
push esi
push str._AutoIt3OutputDebug
call fcn.004115d0
add esp, 8
test eax, eax
je 0x42c192
push esi
push str._AutoIt3ExecuteLine
call fcn.004115d0
add esp, 8
test eax, eax
je 0x42c1b0
push esi
push str._AutoIt3ExecuteScript
call fcn.004115d0
add esp, 8
test eax, eax
jne 0x40210b
test bl, bl
jne 0x42c20a
mov dword [0x4a7cfc], 3
lea ecx, [esp + 0x18]
lea eax, [esp + 0x3c]
call fcn.00401a70
mov edx, dword [esp + 0x18]
push edx
push 0x4a7d14
call fcn.00411691
add esp, 8
lea ecx, [esp + 0x18]
lea eax, [esp + 0x3c]
sub ebp, 2
call fcn.00401a70
mov esi, dword [esp + 0x18]
cmp word [0x4a7d14], 0
je 0x42c219
test ebp, ebp
jl 0x42c243
mov edi, dword [esp + 0x64]
lea eax, [ebp + 1]
push eax
push 1
mov eax, edi
call fcn.0040e7e0
push 0
push 1
push 0
push edi
call fcn.0040d030
add esp, 0x18
mov esi, eax
call fcn.004092c0
mov dword [esi + 8], 1
mov dword [esi], ebp
test ebp, ebp
jle 0x402184
xor ebx, ebx
inc ebx
push ebx
push 1
push 0
push edi
call fcn.0040d030
add esp, 0x10
lea edi, [esp + 0x18]
mov esi, eax
call fcn.0040e640
mov ecx, edi
lea eax, [esp + 0x3c]
call fcn.00401a70
cmp ebx, ebp
jl 0x42c23a
lea ecx, [esp + 0x18]
call fcn.00402620
lea esi, [esp + 0x28]
call fcn.004092c0
lea edi, [esp + 0x50]
call fcn.00401a30
mov dword [esp + 0x3c], 0
mov dword [esp + 0x50], 0x4848ec
call fcn.00401a30
mov ecx, dword [esp + 0x54]
push ecx
call fcn.004112ef
add esp, 4
lea ecx, [esp + 0x40]
call fcn.00402620
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret 4
add byte [eax], al
js 0x42c23f
xlatb
or byte gs:[eax], al
add byte [eax], al
inc eax
add byte [eax - 0x77], al
jge 0x42c258
Function at 0x403d40
Capabilities:
Read file on windows

Disassembly:
cmp dword [esi + 8], 0
push ebp
mov ebp, dword [esp + 8]
push edi
je 0x403da9
xor edi, edi
test ebx, ebx
jbe 0x403d6e
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 8]
je 0x403d7c
mov edx, dword [esi + 0xc]
mov ecx, dword [esi + 4]
mov al, byte [ecx + edx]
mov byte [edi + ebp], al
inc dword [esi + 0xc]
inc edi
cmp edi, ebx
jb 0x403d52
add dword [esi + 0x10], edi
mov eax, edi
pop edi
adc dword [esi + 0x14], 0
pop ebp
ret 4
mov edx, dword [esi + 4]
mov eax, dword [esi]
push 0
lea ecx, [esp + 0x10]
push ecx
push 0x10000
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x403d6e
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0
jmp 0x403d5a
push esi
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
call fcn.0040e190
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
jmp 0x403d4c

Function at 0x409110
Capabilities:
Inspect section memory permissions

Disassembly:
inc dword [eax]
mov ecx, dword [eax]
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x24]
mov edx, dword [ebp + 4]
lea edx, [edx + ecx*4]
push esi
mov esi, dword [edx]
cmp word [esi + 8], 0x47
jne 0x42c051
mov edx, dword [esp + 0x24]
mov dword [esp + 0x28], ecx
mov dword [esp + 0xc], ecx
lea ecx, [esp + 0xc]
push ecx
push edx
lea edx, [esp + 0x30]
mov esi, ebp
call fcn.0040c2a0
test eax, eax
jne 0x42c065
mov ebx, dword [esp + 0xc]
mov ecx, dword [esp + 0x2c]
mov dword [ecx], eax
cmp dword [esp + 0x28], ebx
jae 0x409204
jmp 0x409172
xor eax, eax
lea edx, [esp + 0x10]
push edx
mov esi, edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0x20], eax
call fcn.0040be00
mov ecx, dword [edi + 4]
mov eax, dword [edi + 8]
mov eax, dword [ecx + eax*4 - 4]
mov esi, dword [esp + 0x24]
push ebx
push eax
lea edx, [esp + 0x30]
push edx
push ebp
mov ecx, esi
call fcn.0040ab50
test eax, eax
jne 0x42c082
mov eax, dword [esp + 0x2c]
inc dword [eax]
mov eax, dword [esp + 0x28]
cmp eax, ebx
je 0x4091fb
mov ecx, dword [ebp + 4]
mov edx, dword [ecx + eax*4]
cmp word [edx + 8], 0x40
jne 0x42c06f
lea ecx, [eax + 1]
cmp ecx, ebx
je 0x42c06f
lea esi, [esp + 0x10]
mov dword [esp + 0x28], ecx
call fcn.004092c0
cmp dword [esp + 0x28], ebx
jb 0x409170
xor eax, eax
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0xc
lea esi, [esp + 0x10]
call fcn.004092c0
xor eax, eax
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0xc
adc byte [eax], al
add bh, bh
jne 0x42c043
test bh, dl
add al, byte [eax]
add bh, bh
mov ch, 0x4c
inc ebp
or al, 0x8b
dec ebp
mov esp, 0xff80048d
je 0x42c031
rcl dword [eax], 0x8d
add al, 0xc1
adc byte [ebp + 0x488bc104], cl
adc al, 0x8b
inc eax
or al, 3
dec ebp
adc byte [ebx], al
invalid
adc edx, edi
invalid
Function at 0x40c620
Capabilities:
Inspect section memory permissions

Disassembly:
sub esp, 0x118
push ebx
push ebp
mov ebp, dword [esp + 0x128]
push esi
push edi
mov esi, eax
mov eax, dword [esi]
mov edi, ecx
mov ecx, dword [edi + 4]
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], ebx
mov edx, dword [ecx + eax*4 - 4]
lea eax, [ecx + eax*4]
movsx ecx, word [edx + 0xa]
mov edx, dword [eax]
cmp word [edx + 8], 0x4e
mov dword [esp + 0x24], ecx
jne 0x40c6d7
inc dword [esi]
mov eax, dword [esi]
mov ecx, dword [edi + 4]
mov edx, dword [ecx + eax*4]
movsx eax, word [edx + 0xa]
push 0xffffffffffffffff
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x134]
push esi
push edi
mov dword [esp + 0x30], eax
call fcn.0040ab50
test eax, eax
jne 0x42c290
lea ecx, [esp + 0x10]
call fcn.0040c760
test eax, eax
jl 0x42c267
mov eax, dword [esi]
mov edx, dword [edi + 4]
mov ecx, dword [edx + eax*4]
cmp word [ecx + 8], 0x4f
jne 0x42c278
inc eax
lea ecx, [esp + 0x10]
mov dword [esi], eax
call fcn.0040c760
mov edx, dword [esi]
mov dword [esp + ebx*4 + 0x28], eax
mov eax, dword [edi + 4]
mov ecx, dword [eax + edx*4]
inc ebx
cmp word [ecx + 8], 0x4e
je 0x40c664
mov esi, dword [ebp]
cmp dword [esi + 8], 5
jne 0x42c24a
mov eax, dword [esi]
xor edi, edi
cmp ebx, edi
mov dword [eax + 0x210], edi
jle 0x40c703
mov esi, dword [esp + edi*4 + 0x28]
mov edx, dword [ebp]
call fcn.0040d0f0
inc edi
cmp edi, ebx
jl 0x40c6f2
mov ecx, dword [esp + 0x134]
mov edx, dword [ebp]
push 0
push ecx
push edx
call fcn.0040d030
add esp, 0xc
mov dword [ebp], eax
test eax, eax
je 0x42c256
lea esi, [esp + 0x10]
call fcn.004092c0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x118
ret 0xc
add byte [eax], al
add byte [eax], ah
dec ebp
sbb byte [ebx], bh
sal dword [esp + eax - 0x80], cl
or al, 8
add dword [ecx], edi
pop ebp
or byte [esp + eax - 0x80], dh
or al, 8
add bh, byte [ecx]
pop ebp
adc byte [ebp + eax + 3], dh
enter 0x980, 4
or byte [edx], al
fdiv st(7), st(0)
inc ebp
or al, 0x8b
test dword [eax - 1], edi
invalid
Function at 0x40f110
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [esp + 0x14]
lea ecx, [eax + eax]
lea eax, [esp]
push eax
xor edx, edx
push 1
push edx
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x18]
mov word [esi], dx
mov edx, dword [esp + 0x14]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40f15f
mov ecx, dword [esp + 0x10]
mov edx, dword [esp]
lea eax, [esp + 0x14]
push eax
push esi
push 0
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ecx
ret

Function at 0x40f400
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x58
push ebx
push ebp
mov ebp, dword [esp + 0x64]
push esi
push edi
mov esi, eax
push esi
lea edi, [esp + 0x30]
call fcn.0040f5e0
test eax, eax
je 0x42ca37
mov ebx, dword [esp + 0x74]
cmp dword [ebx], 4
je 0x42ca1f
mov edx, dword [esp + 0x70]
push 0
push 0x4848e8
push esi
push edx
push esi
push ebp
mov dword [ebx], 2
call fcn.004037e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret 0xc
mov ebp, 0xfffff9ad
std
cli
invalid
Function at 0x444d52
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x100
push esi
mov esi, dword [esp + 0x10c]
push edi
mov edi, dword [esp + 0x10c]
cmp dword [edi + 0x20], 0
mov byte [esi], 0
mov byte [esi + 1], 0
mov byte [esi + 2], 0
mov byte [esi + 3], 0
mov byte [esi + 4], 0
mov byte [esi + 5], 0
je 0x444e02
lea eax, [esp + 8]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov al, 0x80
cmp byte [esp + 0xa8], al
je 0x444da1
cmp byte [esp + 0x18], al
jne 0x444daa
cmp byte [edi + 0x1a], 0
jne 0x444daa
mov byte [esi], 1
cmp byte [esp + 0xa9], al
jne 0x444dbd
cmp byte [edi + 0x1b], 0
jne 0x444dbd
mov byte [esi + 1], 1
cmp byte [esp + 0x19], al
jne 0x444dcd
cmp byte [edi + 0x1c], 0
jne 0x444dcd
mov byte [esi + 2], 1
cmp byte [esp + 0x1a], al
jne 0x444ddd
cmp byte [edi + 0x1d], 0
jne 0x444ddd
mov byte [esi + 3], 1
cmp byte [esp + 0x63], al
mov eax, esi
jne 0x444eec
cmp byte [edi + 0x1e], 0
jne 0x444eec
pop edi
mov byte [esi + 4], 1
pop esi
add esp, 0x100
ret 8
push ebx
push ebp
mov ebp, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0xa0
call ebp
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x444e32
push 0xa0
call ebx
mov edx, 0x8000
test dx, ax
je 0x444e3b
cmp byte [edi + 0x1a], 0
jne 0x444e3b
mov byte [esi], 1
push 0xa1
call ebp
mov ecx, 0x8000
test cx, ax
jne 0x444e5d
push 0xa1
call ebx
mov edx, 0x8000
test dx, ax
je 0x444e67
cmp byte [edi + 0x1b], 0
jne 0x444e67
mov byte [esi + 1], 1
push 0x11
call ebp
mov ecx, 0x8000
test cx, ax
jne 0x444e83
push 0x11
call ebx
mov edx, 0x8000
test dx, ax
je 0x444e8d
cmp byte [edi + 0x1c], 0
jne 0x444e8d
mov byte [esi + 2], 1
push 0x12
call ebp
mov ecx, 0x8000
test cx, ax
jne 0x444ea9
push 0x12
call ebx
mov edx, 0x8000
test dx, ax
je 0x444eb3
cmp byte [edi + 0x1d], 0
jne 0x444eb3
mov byte [esi + 3], 1
push 0x5b
call ebp
mov ecx, 0x8000
test cx, ax
jne 0x444ecf
push 0x5b
call ebx
mov edx, 0x8000
test dx, ax
je 0x444ee8
cmp byte [edi + 0x1e], 0
mov eax, esi
jne 0x444eea
pop ebp
pop ebx
pop edi
mov byte [esi + 4], 1
pop esi
add esp, 0x100
ret 8
mov eax, esi
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x100
ret 8
Function at 0x4034d0
Capabilities:
Enumerate gui resources
Get hostname

Disassembly:
mov eax, 0x1c0c
call fcn.0040c4d0
mov eax, dword [0x2c2fbdc]
mov ecx, dword [0x2c2fb50]
shr eax, 3
test eax, eax
jbe 0x40360b
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextVolumeA]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
jmp 0x403520
cmp dword [0x2c2fbdc], 0x959
jne 0x4035ed
push 0
lea eax, [esp + 0x20]
push eax
push 0
push 0x402d2c
push 0
push 0
call edi
push 0
lea ecx, [esp + 0x1020]
push ecx
push 0
call ebx
push 0
push 0
call esi
push 0x402d58
call ebp
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExW]
push 0
push 0
lea edx, [esp + 0x824]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
push 0
push 0
call esi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriorityBoost]
push 0
lea eax, [esp + 0x1420]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleW]
push 0
push 0x402d8c
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceA]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x420]
push edx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push 0
push 0x402d98
push 0x402da8
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
mov eax, dword [esp + 0x10]
push eax
call fcn.00403300
add dword [esp + 0x10], 8
sub dword [esp + 0x14], 1
jne 0x403520
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c0c
ret
Function at 0x408e8b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4d7a10]
jne 0x408e95
repz ret
jmp fcn.0040b15c

Function at 0x40a8ac
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00405d7d
and dword [ebp - 4], 0
cmp dword [0x4d8dac], 0
mov ebx, eax
jne 0x40a95d
push 0x402c0c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40aa0e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402c00
push edi
call esi
test eax, eax
je 0x40aa0e
push eax
call fcn.00405d0b
mov dword [esp], 0x402bf0
push edi
mov dword [0x4d8dac], eax
call esi
push eax
call fcn.00405d0b
mov dword [esp], 0x402bdc
push edi
mov dword [0x4d8db0], eax
call esi
push eax
call fcn.00405d0b
mov dword [esp], 0x402bc0
push edi
mov dword [0x4d8db4], eax
call esi
push eax
call fcn.00405d0b
pop ecx
mov dword [0x4d8dbc], eax
test eax, eax
je 0x40a95d
push 0x402ba8
push edi
call esi
push eax
call fcn.00405d0b
pop ecx
mov dword [0x4d8db8], eax
mov eax, dword [0x4d8db8]
cmp eax, ebx
je 0x40a9b5
cmp dword [0x4d8dbc], ebx
je 0x40a9b5
push eax
call fcn.00405d86
push dword [0x4d8dbc]
mov esi, eax
call fcn.00405d86
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40a9b5
test edi, edi
je 0x40a9b5
call esi
test eax, eax
je 0x40a9ac
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40a9ac
test byte [ebp - 0xc], 1
jne 0x40a9b5
or dword [ebp + 0x10], 0x200000
jmp 0x40a9ee
mov eax, dword [0x4d8db0]
cmp eax, ebx
je 0x40a9ee
push eax
call fcn.00405d86
pop ecx
test eax, eax
je 0x40a9ee
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40a9ee
mov eax, dword [0x4d8db4]
cmp eax, ebx
je 0x40a9ee
push eax
call fcn.00405d86
pop ecx
test eax, eax
je 0x40a9ee
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4d8dac]
call fcn.00405d86
pop ecx
test eax, eax
je 0x40aa0e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40aa10
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x407180
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x4071be
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x4071b6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x4071c0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x4071a6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4072a0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x4072b6
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x4072d1
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x61435aed
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..rdata
mov ebx, 0x4304d8
nop
mov ecx, 0x1dbb2ff3
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x40812b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x417400]
jne 0x408135
repz ret
jmp fcn.0040deca

Function at 0x40af51
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x417400]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00406450
and dword [ebp - 0x14], 0
cmp dword [0x437414], 0
mov dword [ebp - 0x18], eax
jne 0x40b004
push 0x402218
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40b0ac
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40220c
push ebx
call edi
test eax, eax
je 0x40b0ac
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x4021fc
push ebx
mov dword [0x437414], eax
call edi
push eax
call esi
push 0x4021e8
push ebx
mov dword [0x437418], eax
call edi
push eax
call esi
push 0x4021cc
push ebx
mov dword [0x43741c], eax
call edi
push eax
call esi
mov dword [0x437424], eax
test eax, eax
je 0x40b004
push 0x4021b4
push ebx
call edi
push eax
call esi
mov dword [0x437420], eax
mov eax, dword [0x437420]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40b05d
cmp dword [0x437424], ecx
je 0x40b05d
push eax
call esi
push dword [0x437424]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40b05d
test ebx, ebx
je 0x40b05d
call edi
test eax, eax
je 0x40b054
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40b054
test byte [ebp - 8], 1
jne 0x40b05d
or dword [ebp + 0x10], 0x200000
jmp 0x40b090
mov eax, dword [0x437418]
cmp eax, dword [ebp - 0x18]
je 0x40b090
push eax
call esi
test eax, eax
je 0x40b090
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40b090
mov eax, dword [0x43741c]
cmp eax, dword [ebp - 0x18]
je 0x40b090
push eax
call esi
test eax, eax
je 0x40b090
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x437414]
call esi
test eax, eax
je 0x40b0ac
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40b0ae
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040812b
leave
ret
Function at 0x414a10
Capabilities:
Connect pipe
Delete file
Get common file path
Get uefi variable
Read pipe
Write pipe

Disassembly:
mov eax, 0x1404
call fcn.0040eda0
cmp dword [0x2b60f74], 0x37
jne 0x414ae6
push 0x40352c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetLocaleInfoA]
push 0
lea eax, [esp + 0xc08]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push 0
lea ecx, [esp + 4]
push ecx
push 0
lea edx, [esp + 0x810]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CallNamedPipeW]
push 0x403538
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x403560
push 0x4035d8
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionW]
push 0
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
push 0
lea eax, [esp + 8]
push eax
push 0x403544
push 0x4035bc
call dword [sym.imp.KERNEL32.dll_GetFirmwareEnvironmentVariableA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
push 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetKernelObjectSecurity]
push 0
lea ecx, [esp + 0x408]
push ecx
push 0x403668
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointA]
mov edx, dword [0x2b61388]
mov ecx, dword [0x2b60a58]
mov al, byte [edx + esi + 0x38d6]
mov byte [ecx + esi], al
add esp, 0x1404
ret
Function at 0x46743c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x467444
mov eax, edx
pop esi
pop ebx
ret

Function at 0x497954
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xf]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x4979a2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xf], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.00497418
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4979bb
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4aefe8
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x4aeff0
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4af0e1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.00422d70
mov edx, dword [ebp - 8]
mov ecx, 0x4af0fc
xor eax, eax
call fcn.004aeec8
push 0
mov eax, dword [ebp - 4]
call fcn.004084ec
push eax
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x4af0af
call sub.kernel32.dll_GetLastError
mov ebx, eax
cmp ebx, 0xb7
je 0x4af00a
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x1c]
mov edx, dword [ebp - 4]
mov ax, 0x3d
call fcn.00426f08
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.00419e18
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x24]
mov eax, ebx
call fcn.004232ec
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x18]
mov ecx, 2
mov ax, 0x81
call fcn.00426ed8
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x414db8]
call fcn.0041f264
call fcn.0040711c
jmp 0x4af00a
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00407e00
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4af0e8
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00407a80
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00407a80
ret

Function at 0x4af1b4
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x4af20e
inc esi
xor edi, edi
cmp edi, 1
jne 0x4af1da
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_Sleep
jmp 0x4af1e8
cmp edi, 1
jle 0x4af1e8
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00427154
test eax, eax
jne 0x4af20e
call sub.kernel32.dll_GetLastError
cmp eax, 2
je 0x4af20e
call sub.kernel32.dll_GetLastError
cmp eax, 3
je 0x4af20e
inc edi
dec esi
jne 0x4af1ca
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8