joyce8/EMBER2024-capa huggingface dataset:
Function at 0x27eb8
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [0xb3be0], 0
push ebx
push edi
mov edi, 0xc000009a
mov ebx, edi
je 0x27ed6
xor eax, eax
jmp 0x27f82
call fcn.00028c45
mov dword [0xb3be0], eax
test eax, eax
jne 0x27eeb
mov eax, edi
jmp 0x27f82
push esi
mov esi, dword [ebp + 8]
imul esi, esi, 0x86
add esi, 0x486
mov eax, esi
neg eax
and eax, 0xfff
push 0x484f4f4b
add esi, eax
push esi
push 0
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
push esi
push eax
push str.g_lpCodeBuffer_p_MemLen_d_n
mov dword [0xb3bd0], eax
call sub.ntoskrnl.exe_DbgPrint
mov eax, dword [0xb3bd0]
add esp, 0xc
test eax, eax
je 0x27f7f
push 0xb3bd4
push 0xb3bd8
push esi
push eax
call fcn.00027da6
mov ebx, eax
test ebx, ebx
jl 0x27f7f
push esi
push 0xcc
push dword [0xb3bd4]
call sub.ntoskrnl.exe_memset
add esp, 0xc
push dword [0xb3bd4]
add esi, 0xffffffd0
push 0x30
push esi
call fcn.00028668
mov dword [0xb3bdc], eax
neg eax
sbb eax, eax
and eax, 0x3fffff66
add eax, edi
mov ebx, eax
mov eax, ebx
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x282fe
Capabilities:
Check for software breakpoints

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 0xc], esi
jbe 0x28324
mov eax, dword [ebp + 8]
lea ecx, [esi + eax]
cmp byte [ecx], 0xcc
je 0x28324
xor edx, edx
call fcn.00029061
add esi, eax
cmp esi, dword [ebp + 0xc]
jb 0x2830b
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x45d5f0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0
push 0x4581a0
call fcn.0047b880
add esp, 0xc
mov byte [0x4581a0], 0x80
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret

Function at 0x45da70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
push 0xf
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.00464ea0
add esp, 0xc
push eax
pop eax
xchg edi, edi
jbe 0x45da9e
lea edx, [edx + 0x36a0]
lea edx, [edx - 0x36a0]
ja 0x45da9e
lcall 0xc672, 0xb173b085
inc ebp
inc byte [eax]
mov al, 0x73
mov cl, 0x72
mov byte [ebp - 2], 0
mov byte [ebp - 0x10], 0x50
mov byte [ebp - 0xb], al
mov byte [ebp - 6], 0x69
mov byte [ebp - 0xf], cl
mov byte [ebp - 0xa], al
mov byte [ebp - 5], cl
mov byte [ebp - 0xe], 0x6f
mov byte [ebp - 9], 0x33
mov byte [ebp - 4], al
mov byte [ebp - 0xd], 0x63
mov byte [ebp - 8], 0x32
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 7], 0x46
mov byte [ebp - 3], 0x74
call fcn.0046b250
test eax, eax
jne 0x45daea
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebp - 0x10]
push ecx
push eax
call fcn.0047c6d0
push 0xf
lea edx, [ebp - 0x10]
push 0
push edx
mov esi, eax
call fcn.00464ea0
add esp, 0xc
test esi, esi
jne 0x45db14
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
std
cld
jl 0x45db23
xchg ecx, eax
xchg ecx, eax
mov esp, esp
jbe 0x45db1e
je 0x45db20
jge 0x45db23
mov ebp, 0xcc07e856
add dword [eax], eax
push esi
call fcn.0047a730
add esp, 4
ror edx, 0
or esp, 0
add edi, dword [esp]
sub edi, dword [esp]
js 0x45db4e
pushf
shr esp, 0
jnp 0x45db41
jbe 0x45db43
popf
je 0x45db47
jno 0x45db49
xchg ecx, ecx
jns 0x45db4e
mov ecx, 0x8b0c458b
dec ebp
or byte [eax + 0x51], dl
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push ecx
call esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x462c30
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x459f50]
push esi
push edi
push eax
push 0x459e75
mov byte [0x459e74], 0x45
call fcn.004671e0
mov edx, dword [0x459f50]
mov al, 0x2d
mov byte [0x459e7a], al
mov byte [0x459e7b], al
lea eax, [edx + 0x4ed1567b]
mov cl, 0x20
lea edx, [edx + edx*4]
add esp, 8
mov byte [0x459e79], cl
mov byte [0x459e7c], cl
mov esi, 0x459e7d
xor ecx, ecx
lea edi, [edx + edx*4]
mov edx, eax
imul eax, eax, 0x1003411d
shr edx, 9
add edx, 0x79d11093
xor eax, edx
mov dl, byte [ecx + edi*8 + 0x449a69]
xor dl, al
mov byte [esi], dl
inc esi
inc ecx
cmp ecx, 0xc8
jl 0x462c7f
mov byte [esi], 0
pop edi
mov eax, 0x459e74
pop esi
ret

Function at 0x462cc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x13
lea eax, [ebp - 0x18]
push 0
push eax
call fcn.00464ea0
add esp, 0xc
lea esi, [esi + 0x1ee5]
lea esi, [esi - 0x1ee5]
dec ebx
inc ebx
ja 0x462ce9
call fcn.00462cee
Function at 0x462f90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xe
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00464ea0
add esp, 0xc
and edx, 0xffffffff
jge 0x462fc3
lea esp, [esp]
lea edi, [edi + 0x6a1b]
lea edi, [edi - 0x6a1b]
nop
jl 0x462fc3
mov esi, 0x66b16145
mov cl, 0x66
mov al, 0x75
mov byte [ebp - 0x10], 0x7a
mov byte [ebp - 0x14], 0x48
mov byte [ebp - 0x13], cl
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xb], 0x4a
mov byte [ebp - 0xc], 0x6e
mov byte [ebp - 9], 0x67
mov byte [ebp - 0xe], al
mov byte [ebp - 7], 0
mov byte [ebp - 0x12], al
mov byte [ebp - 8], 0x70
mov byte [ebp - 0x11], 0x54
mov byte [ebp - 0xd], cl
mov byte [ebp - 0xa], 0x6f
test dword [esp], ebx
shr edx, 0
jge 0x463013
pushf
or esp, 0
jo 0x46300a
jg 0x46300c
popf
jge 0x463010
jl 0x463013
call 0x8b3e85a1
dec ebp
int1
mov dl, byte [ebp - 8]
mov cl, byte [ebp - 0xf]
mov al, byte [ebp - 0x13]
mov bl, byte [ebp - 0x11]
dec dl
dec cl
mov byte [ebp - 8], dl
mov dl, byte [ebp - 0xd]
dec al
mov byte [ebp - 0xf], cl
mov cl, byte [ebp - 0x10]
dec bl
mov byte [ebp - 0x13], al
mov al, byte [ebp - 0xe]
dec dl
mov byte [ebp - 0x11], bl
mov bl, byte [ebp - 0xa]
mov byte [ebp - 0xd], dl
mov dl, byte [ebp - 0xc]
dec cl
dec al
mov byte [ebp - 0x10], cl
mov cl, byte [ebp - 0x14]
dec bl
mov byte [ebp - 0xe], al
mov al, byte [ebp - 0xb]
dec dl
mov byte [ebp - 0xa], bl
mov bl, byte [ebp - 9]
mov byte [ebp - 0xc], dl
mov dl, byte [ebp - 0x12]
dec cl
dec al
dec bl
dec dl
mov byte [ebp - 0x14], cl
mov byte [ebp - 0xb], al
mov byte [ebp - 9], bl
mov byte [ebp - 0x12], dl
rol esi, 0
xchg edi, edi
jb 0x463082
ja 0x463089
xchg esp, esp
jbe 0x463089
mov esp, 0x81c2e8
add byte [ebp - 0x5e7bf040], al
add byte [eax], al
add cl, al
out 0, al
call fcn.0046b250
test eax, eax
je 0x463137
shl esi, 0
jp 0x4630a8
pushf
inc ebx
dec ebx
popf
jb 0x4630a3
js 0x4630a5
jnp 0x4630a8
mov esi, 0x51ec4d8d
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.0047c6d0
push 0xe
lea edx, [ebp - 0x14]
mov esi, eax
push 0
push edx
mov dword [ebp - 4], esi
call fcn.00464ea0
add esp, 0xc
test esp, 0xa03
je 0x4630cf
nop
or edx, edx
jns 0x4630e0
jae 0x4630d6
jnp 0x4630d8
jb 0x4630da
mov ebx, ebx
js 0x4630e0
mov ebx, 0x74f68557
push ebx
test esi, esi
je 0x463137
xor esi, dword [esp]
xor esi, dword [esp]
jo 0x4630fd
lea edi, [edi + 0x6542]
lea edi, [edi - 0x6542]
ja 0x4630fa
jno 0x4630fd
or dword [ebx - 0x17a9038b], 0x1762a
mov esi, dword [ebp - 4]
push esi
call fcn.0047a730
add esp, 4
xor ecx, 0x2321
xor ecx, 0x2321
add ebx, dword [esp]
sub ebx, dword [esp]
lea eax, [eax]
ror edi, 5
ror edi, 0x1b
ja 0x463131
xchg edi, ebx
xchg edi, ebx
xchg edi, edi
jl 0x46312d
jbe 0x463131
mov ebx, 0x8458bb0
mov eax, dword [ebp + 8]
push eax
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x463be0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
lea eax, [ebp - 0x18]
push 0
push eax
call fcn.00464ea0
add esp, 0xc
or edx, 0
jo 0x463c06
lea ebx, [ebx]
lea esp, [esp]
jno 0x463c06
mov ebx, 0x45c666b0
call 0xed8bc45f
mov al, 0x66
mov byte [ebp - 0x18], 0x50
mov byte [ebp - 0x13], al
mov byte [ebp - 0xe], al
mov byte [ebp - 0x17], 0x71
mov byte [ebp - 0x12], 0x73
mov byte [ebp - 0xd], 0x42
mov byte [ebp - 0x16], al
mov byte [ebp - 0x11], 0x77
mov byte [ebp - 0xc], 0
mov byte [ebp - 0x15], 0x6f
mov byte [ebp - 0x10], 0x6a
mov byte [ebp - 0x14], 0x54
mov byte [ebp - 0xf], 0x64
ror esp, 0
jae 0x463c4c
pushf
nop
mov ecx, ecx
jnp 0x463c45
popf
jge 0x463c49
jb 0x463c4c
xor eax, 0x8ae8458a
pop ebp
in eax, dx
mov al, byte [ebp - 0x18]
mov bl, byte [ebp - 0x13]
mov dl, byte [ebp - 0xe]
mov cl, byte [ebp - 0x17]
dec al
dec bl
mov byte [ebp - 0x18], al
mov al, byte [ebp - 0x12]
dec dl
mov byte [ebp - 0x13], bl
mov bl, byte [ebp - 0xd]
dec cl
mov byte [ebp - 0xe], dl
mov dl, byte [ebp - 0x16]
mov byte [ebp - 0x17], cl
mov cl, byte [ebp - 0x11]
dec al
dec bl
mov byte [ebp - 0x12], al
mov al, byte [ebp - 0x15]
dec dl
mov byte [ebp - 0xd], bl
mov bl, byte [ebp - 0x10]
dec cl
mov byte [ebp - 0x16], dl
mov dl, byte [ebp - 0x14]
mov byte [ebp - 0x11], cl
mov cl, byte [ebp - 0xf]
dec al
dec bl
dec dl
dec cl
mov byte [ebp - 0x15], al
mov byte [ebp - 0x10], bl
mov byte [ebp - 0x14], dl
mov byte [ebp - 0xf], cl
test esi, 0x70ec
lea ebx, [ebx + 0x796a]
lea ebx, [ebx - 0x796a]
jl 0x463ccc
xchg ebx, edx
xchg ebx, edx
jnp 0x463cc6
mov ebx, ebx
jge 0x463ccc
jmp 0x2cb6252a
call 0x466940
mov ecx, eax
test ecx, ecx
mov dword [ebp - 4], ecx
jne 0x463ce3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
xor edi, 0
jne 0x463d0c
pushf
shr ebx, 0
xor edi, dword [esp + 0x10]
xor edi, dword [esp + 0x10]
lea eax, [eax + 0x2736]
lea eax, [eax - 0x2736]
or edi, edi
popf
je 0x463d07
jp 0x463d09
je 0x463d0c
lcall 0xe851, 0x52e8558d
mov edx, 0x8b000189
invalid
lea edx, [ebp - 0x18]
push edx
push ecx
call fcn.0047c6d0
mov esi, eax
push 0xd
lea eax, [ebp - 0x18]
push 0
push eax
mov dword [ebp - 8], esi
call fcn.00464ea0
add esp, 0xc
test esi, esi
jne 0x463d3a
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
xor ebx, 0x791
xor ebx, 0x791
rol ecx, 0x1a
rol ecx, 6
stc
xchg esp, esp
ja 0x463d5d
jae 0x463d53
jp 0x463d55
js 0x463d57
je 0x463d59
jbe 0x463d5d
add eax, 0xcde85693
imul eax, dword [ecx], 0x8d0d6a00
dec ebp
call 0xe8973dd6
xor byte [ecx], dl
add byte [eax], al
push esi
call fcn.0047a730
push 0xd
lea ecx, [ebp - 0x18]
push 0
push ecx
call fcn.00464ea0
add esp, 0x10
xchg esi, ebx
xchg esi, ebx
call fcn.00463d7c

Function at 0x464f50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x13
lea eax, [ebp - 0x1c]
push 0
push eax
call fcn.00464ea0
add esp, 0xc
jo 0x464f6b
jp 0x464f6d
call fcn.00464f72
Function at 0x470140
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push 0xc
lea eax, [ebp - 0xc]
push 0
push eax
call fcn.00464ea0
add esp, 0xc
push edi
pop edi
stc
test ecx, 0x3c26
shl eax, 0
jp 0x470174
jnp 0x470169
jns 0x47016b
mov esi, esi
xchg esi, esi
jnp 0x470174
mov edx, 0x74b09cca
mov al, 0x74
mov byte [ebp - 0xc], 0x46
mov byte [ebp - 7], 0x73
mov byte [ebp - 2], al
mov byte [ebp - 0xb], 0x79
mov byte [ebp - 6], 0x70
mov byte [ebp - 1], 0
mov byte [ebp - 0xa], 0x6a
mov byte [ebp - 5], 0x64
mov byte [ebp - 9], 0x75
mov byte [ebp - 4], 0x66
mov byte [ebp - 8], 0x51
mov byte [ebp - 3], al
ror edi, 3
rol edi, 3
lea eax, [eax]
jg 0x4701b9
jp 0x4701b0
ja 0x4701b2
lea ebx, [ebx]
jle 0x4701b9
add eax, 0x458a851f
hlt
mov al, byte [ebp - 0xc]
mov bl, byte [ebp - 7]
mov dl, byte [ebp - 2]
mov cl, byte [ebp - 0xb]
dec al
dec bl
mov byte [ebp - 0xc], al
mov al, byte [ebp - 6]
dec dl
mov byte [ebp - 7], bl
mov bl, byte [ebp - 0xa]
mov byte [ebp - 2], dl
mov dl, byte [ebp - 5]
dec cl
dec al
mov byte [ebp - 0xb], cl
mov cl, byte [ebp - 9]
dec bl
mov byte [ebp - 6], al
mov al, byte [ebp - 4]
dec dl
mov byte [ebp - 0xa], bl
mov bl, byte [ebp - 8]
mov byte [ebp - 5], dl
mov dl, byte [ebp - 3]
dec cl
dec al
dec bl
dec dl
mov byte [ebp - 9], cl
mov byte [ebp - 4], al
mov byte [ebp - 8], bl
mov byte [ebp - 3], dl
and esp, 0xffffffff
test dword [esp + 0x10], edx
std
cld
jbe 0x47021c
jge 0x470243
pushf
neg edx
neg edx
cmp esi, 0x6866
test edx, ecx
lea edx, [edx]
popf
lea edi, [edi + 0x175e]
lea edi, [edi - 0x175e]
jnp 0x47023e
jno 0x470240
jl 0x470243
mov esp, 0xffb008e8
inc dword [ebp + 0x5f0775c0]
call fcn.0046b250
test eax, eax
jne 0x470253
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
rol esi, 0
add esi, 0x2b36
sub esi, 0x2b36
je 0x470273
pushf
xchg edx, edx
jno 0x47026a
popf
jns 0x47026e
xchg ebx, ebx
jne 0x470273
mov esp, 0x51f44d8d
lea ecx, [ebp - 0xc]
push ecx
push eax
call fcn.0047c6d0
push 0xc
lea edx, [ebp - 0xc]
push 0
push edx
mov esi, eax
call fcn.00464ea0
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x471ab0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0xe
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.00464ea0
add esp, 0xc
xor esp, 0
jae 0x471ace
test esp, 0x705c
jnp 0x471ae3
pushf
xchg esi, eax
xchg esi, eax
test edx, ecx
popf
lea edi, [edi]
jp 0x471ae3
mov esi, 0x65b073b1
mov cl, 0x73
mov al, 0x65
mov byte [ebp - 3], 0
mov byte [ebp - 0x10], 0x50
mov byte [ebp - 0xb], cl
mov byte [ebp - 6], al
mov byte [ebp - 0xf], 0x72
mov byte [ebp - 0xa], cl
mov byte [ebp - 5], 0x78
mov byte [ebp - 0xe], 0x6f
mov byte [ebp - 9], 0x33
mov byte [ebp - 4], 0x74
mov byte [ebp - 0xd], 0x63
mov byte [ebp - 8], 0x32
mov byte [ebp - 0xc], al
mov byte [ebp - 7], 0x4e
lea esp, [esp]
cmc
rol edx, 0x1a
ror edx, 0x1a
jne 0x471b2c
jl 0x471b29
je 0x471b2c
mov edx, 0xff971fe8
inc dword [ebp + 0x5f0975c0]
call fcn.0046b250
test eax, eax
jne 0x471b3e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
std
cld
neg ebx
neg ebx
jp 0x471b46
clc
jg 0x471b59
pushf
xor edi, 0
popf
ja 0x471b52
mov edx, edx
mov edx, edx
jle 0x471b59
jmp 0x523768ea
lea ecx, [ebp - 0x10]
push ecx
push eax
call fcn.0047c6d0
push 0xe
lea edx, [ebp - 0x10]
push 0
push edx
mov ebx, eax
call fcn.00464ea0
add esp, 0xc
test ebx, ebx
jne 0x471b84
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
and esi, 0xffffffff
jp 0x471b89
xchg esp, esp
jg 0x471b99
mov eax, eax
mov edx, edx
jl 0x471b93
xchg edx, eax
xchg edx, eax
jle 0x471b99
mov edi, 0x91e853d8
mov eax, dword [eax]
add byte [ebx + 0x7904c4], al
push ebx
call fcn.0047a730
add esp, 4
jns 0x471ba4
je 0x471bb5
pushf
xchg edi, eax
xchg edi, eax
dec edx
inc edx
popf
jae 0x471bb0
jmp 0x471bb2
jne 0x471bb5
ljmp 0x84d:0x8b0c458b
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push ecx
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x47a730
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
lea eax, [eax]
js 0x47a73a
inc esi
dec esi
jbe 0x47a756
pushf
add ecx, 0x6261
sub ecx, 0x6261
popf
jl 0x47a750
js 0x47a752
nop
ja 0x47a756
xor eax, 0x5008458b
mov eax, dword [ebp + 8]
push eax
call fcn.00479340
add esp, 4
cmp eax, 2
jne 0x47a7a1
cmc
jbe 0x47a774
mov esp, esp
mov edx, edx
jns 0x47a770
ja 0x47a774
lcall 0x45, 0x98c8680b
push 0x4598c8
mov dword [0x457c7c], eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor esi, dword [esp + 4]
xor esi, dword [esp + 4]
dec ecx
inc ecx
jg 0x47a797
nop
lea ebx, [ebx]
jle 0x47a797
mov esp, 0x1b8cd
add byte [eax], al
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret
shr esp, 0
nop
mov eax, eax
jno 0x47a7c4
pushf
shr esp, 0
call 0x47a7b3
lea esp, [esp + 4]
lea edi, [edi]
test dword [esp + 0xc], edx
popf
jae 0x47a7c1
jo 0x47a7c4
call 0xc07b0627
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x47c600
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor eax, eax
push esi
push edi
mov dword [ebp - 0xb], eax
push 0x45993c
mov byte [ebp - 0xc], 0
mov byte [ebp - 7], al
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
sidt [ebp - 0xc]
mov eax, dword [ebp - 0xa]
add eax, 8
mov ebx, dword [eax]
add eax, 0x10
mov eax, dword [eax]
and eax, 0xffff
and ebx, 0xffff
sub eax, ebx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x1e
jne 0x47c66c
nop
add edi, 0x2da7
sub edi, 0x2da7
js 0x47c656
lea esp, [esp]
jne 0x47c665
lea eax, [eax]
jge 0x47c65f
jne 0x47c661
je 0x47c665
mov eax, 0x2be24
add byte [eax], al
mov esi, 2
jmp 0x47c698
jne 0x47c66e
test esp, 0x78dd
xchg ebx, esi
xchg ebx, esi
jno 0x47c693
pushf
xchg esp, esp
shl esp, 0
add esp, 0
je 0x47c686
popf
jnp 0x47c68a
jle 0x47c68c
xchg ebx, esi
xchg ebx, esi
jo 0x47c693
lcall 0x6800, 0x4be
sub al, 0x99
inc ebp
add bh, bh
adc eax, sym.imp.KERNEL32.dll_OutputDebugStringA
mov esi, 4
push 0x45992c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea ecx, [ecx + 0x21c8]
lea ecx, [ecx - 0x21c8]
test edi, eax
shr ebx, 0
jno 0x47c6bd
jb 0x47c6b8
jb 0x47c6ba
jo 0x47c6bd
mov esi, 0x5e5fc68b
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47c6d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
test eax, eax
je 0x47c76e
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x47c76e
neg ecx
neg ecx
jae 0x47c6f8
jne 0x47c6f4
jb 0x47c6f8
sub eax, 0xfa81a2
add byte [ecx], al
add byte [ebx + 0x25], dh
cmp edx, 0x10000
jae 0x47c725
jle 0x47c702
mov ecx, ecx
not edi
not edi
jne 0x47c71c
pushf
ror edi, 0xb
rol edi, 0xb
shr esp, 0
popf
mov esi, esi
je 0x47c71c
adc dword [edx + 0x50], 0xfed74de8
invalid
push edx
push eax
call 0x469e70
jmp 0x47c754
neg ebx
neg ebx
jg 0x47c72b
std
cld
jns 0x47c74a
pushf
ror eax, 0x1b
rol eax, 0x1b
popf
lea ecx, [ecx + 0x2672]
lea ecx, [ecx - 0x2672]
je 0x47c747
js 0x47c74a
mov edi, 0x5208458b
mov eax, dword [ebp + 8]
push edx
push eax
call fcn.004666a0
add esp, 8
test eax, eax
je 0x47c779
xor ebx, 0
jle 0x47c767
jge 0x47c762
jg 0x47c767
mov ecx, 0x5e5f14da
pop edi
pop esi
pop ebx
pop ebp
ret 8
push 0x45994c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8
Function at 0x68a02430
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa1960b21
mov ecx, 0x18b71962
rorx edx, eax, 0xb
sarx ecx, ecx, ecx
mulx eax, edx, ecx
xor eax, edx
mov ecx, 0xf5f7ffbe
pext eax, eax, ecx
cmp eax, 0x22f270c
sete al
ret

Function at 0x68a083e0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x68aaf040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x120]
mov dword [ebp - 0x124], 0
push eax
mov esi, ecx
mov dword [ebp - 0x120], 0x114
xor ebx, ebx
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x110], 2
jne 0x68a08483
cmp dword [ebp - 0x11c], 6
jae 0x68a08436
mov eax, str.D:_A__GA___WD__A__GA___AN_
jmp 0x68a0844b
jne 0x68a08446
cmp dword [ebp - 0x118], 2
mov eax, str.D:_A__GA___WD__A__GA___AN_S:_ML__NW___LW_
jb 0x68a0844b
mov eax, str.D:_A__GA___WD__A__GA___AN__A__GA___S_1_15_2_1_S:_ML__NW___LW_
push 0
lea ecx, [ebp - 0x124]
push ecx
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
mov eax, dword [ebp - 0x124]
test eax, eax
je 0x68a08483
mov dword [ebp - 0x128], ebx
lea ebx, [ebp - 0x130]
mov dword [ebp - 0x130], 0xc
mov dword [ebp - 0x12c], eax
sub esp, 0x18
mov edx, ebx
call fcn.68a07d20
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x68a084a3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x68a08540
push 0
push 0
push 0
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 8], eax
test eax, eax
jne 0x68a084cb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [esi]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x68a08540
push ecx
push 0
sub esp, 8
mov ecx, ebx
call fcn.68a07bf0
add esp, 0x10
mov dword [esi + 4], eax
test eax, eax
jne 0x68a084fd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [esi + 8]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x68a08540
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
push ecx
cmp dword [eax], 0x12345678
je 0x68a08533
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 2
jmp 0x68a08540
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov dword [esi + 0xc], 1
mov eax, dword [ebp - 0x124]
test eax, eax
je 0x68a08551
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.68a3943b
mov esp, ebp
pop ebp
ret
Function at 0x68a08cf0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x68aab1c0
push 0x68a3aba0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x68aaf040]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x30], edx
mov ebx, ecx
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 0
test ebx, ebx
je 0x68a08e66
test edx, edx
je 0x68a08e66
push 0x14
push ebx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x68a08e66
xor esi, esi
mov dword [ebp - 0x2c], esi
nop
lea edi, [ebx + esi]
mov ecx, edi
call fcn.68a08be0
test eax, eax
jne 0x68a08e66
mov ecx, edi
call fcn.68a08930
add esi, eax
mov dword [ebp - 0x2c], esi
cmp esi, 5
jl 0x68a08d60
push 0x40
push 0x1000
push 0x1c
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
mov dword [ebp - 0x28], edi
test edi, edi
je 0x68a08e66
mov dword [edi + 0x14], esi
mov dword [edi + 0x18], ebx
push esi
push ebx
mov edx, 0x14
mov ecx, edi
call fcn.68a09e20
add esp, 8
lea eax, [esi + edi]
mov word [eax], 0x25ff
lea ecx, [eax + 6]
mov dword [eax + 2], ecx
lea eax, [ebx + esi]
mov dword [ecx], eax
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
push 0x40
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x68a08ded
push 0x8000
push eax
push edi
jmp 0x68a08e60
mov eax, dword [ebp - 0x20]
cmp eax, 4
je 0x68a08e13
cmp eax, 0x40
je 0x68a08e13
cmp eax, 0x80
je 0x68a08e13
lea eax, [ebp - 0x24]
push eax
push 0x20
push 0x1c
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 0x20]
mov byte [ebx], 0xe9
mov ecx, dword [ebp - 0x30]
sub ecx, ebx
sub ecx, 5
mov dword [ebx + 1], ecx
lea ecx, [ebp - 0x20]
push ecx
push eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov dword [ebp - 4], 0xfffffffe
mov eax, edi
jmp 0x68a08e6f
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.68a3943b
mov esp, ebp
pop ebp
ret