joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41d870
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x616d3d
mov eax, dword fs:[0]
push eax
sub esp, 0x4d8
mov eax, dword [0x74496c]
xor eax, esp
mov dword [esp + 0x4d4], eax
push ebx
push esi
mov eax, dword [0x74496c]
xor eax, esp
push eax
lea eax, [esp + 0x4e4]
mov dword fs:[0], eax
mov esi, ecx
call fcn.0041dcb0
mov eax, esi
call fcn.0041dd10
push esi
call fcn.0041de60
mov eax, 0x8046d0
call fcn.004111a0
mov al, 0x69
mov byte [esp + 0xd2], al
mov byte [esp + 0xd7], al
mov cl, 0x61
mov dl, 0x70
lea eax, [esp + 0xc]
push eax
lea ebx, [esp + 0xd4]
mov byte [esp + 0xd4], cl
mov byte [esp + 0xd5], dl
mov byte [esp + 0xd7], 0x5f
mov byte [esp + 0xd8], 0x4c
mov byte [esp + 0xd9], 0x6f
mov byte [esp + 0xda], 0x67
mov byte [esp + 0xdc], 0x6e
mov byte [esp + 0xdd], 0x2e
mov byte [esp + 0xde], cl
mov byte [esp + 0xdf], 0x73
mov byte [esp + 0xe0], dl
mov byte [esp + 0xe1], 0x78
mov byte [esp + 0xe2], 0
call fcn.0041cec0
mov dword [esp + 0x4ec], 0
push esi
lea ecx, [esp + 0xc8]
mov al, 0x65
push ecx
mov bl, 0x73
lea ecx, [esp + 0x5c]
mov byte [esp + 0xcc], 0x75
mov byte [esp + 0xcd], bl
mov byte [esp + 0xce], al
mov byte [esp + 0xcf], 0x72
mov byte [esp + 0xd0], 0x6e
mov byte [esp + 0xd1], 0x61
mov byte [esp + 0xd2], 0x6d
mov byte [esp + 0xd3], al
mov byte [esp + 0xd4], 0
call fcn.004244c0
lea edx, [esi + 0x80]
push edx
lea eax, [esp + 0xbc]
push eax
lea ecx, [esp + 0x5c]
mov byte [esp + 0xc0], 0x70
mov byte [esp + 0xc1], 0x61
mov byte [esp + 0xc2], bl
mov byte [esp + 0xc3], bl
mov byte [esp + 0xc4], 0x77
mov byte [esp + 0xc5], 0x6f
mov byte [esp + 0xc6], 0x72
mov byte [esp + 0xc7], 0x64
mov byte [esp + 0xc8], 0
call fcn.004244c0
mov ecx, dword [0x8046e0]
push ecx
lea edx, [esp + 0xe4]
push 0x6c5c84
push edx
call fcn.00410ac0
add esp, 0xc
lea eax, [esp + 0xe0]
push eax
push str.computerid
lea ecx, [esp + 0x5c]
call fcn.004244c0
lea ecx, [esi + 0x100]
push ecx
push str.Identifier
lea ecx, [esp + 0x5c]
call fcn.004244c0
call fcn.0041d780
push eax
push 0x6c5f60
lea ecx, [esp + 0x5c]
call fcn.004244c0
lea eax, [esp + 0xc]
call fcn.0041d2d0
test al, al
jne 0x41daa2
mov edx, dword [esp + 0x98]
push edx
push str.Login_FAILED__code:__d_n
call fcn.00581470
add esp, 8
lea eax, [esp + 0xc]
mov dword [esi + 0x170], 3
push eax
jmp 0x41dab0
lea ecx, [esp + 0xc]
call fcn.0041d670
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0x4f0], 0xffffffff
call fcn.0041d040
mov ecx, dword [esp + 0x4e4]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x4d4]
xor ecx, esp
call fcn.005ff0f4
add esp, 0x4e4
ret
Function at 0x41f8e0
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x41f903
xor eax, eax
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x10]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [ebp - 4]
push 0
push 0
push 0
lea edx, [ebp - 0x14]
push edx
push 0
push eax
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x41f8fd
push 0x80020003
push 5
call dword [sym.imp.USER32.dll_ExitWindowsEx]
neg eax
sbb eax, eax
neg eax
mov esp, ebp
pop ebp
ret

Function at 0x41f9c0
Capabilities:
Execute command
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x20
push ebx
push esi
push edi
push 0
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExA]
mov ebx, eax
test ebx, ebx
jbe 0x41fa49
mov dword [0x802d14], 1
call fcn.0041f960
call fcn.0041f8e0
mov edi, 0x5d4a24db
lea esi, [ebp - 0x1c]
call fcn.0041fd70
push eax
call sub.MSVCR90.dll_system
add esp, 4
push 0
push 0
push 0x10
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp + 8]
push ecx
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
jbe 0x41fa49
call fcn.0041f960
call fcn.0041f8e0
lea esi, [ebp - 0x1c]
call fcn.0041fd70
push eax
call sub.MSVCR90.dll_system
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4209b0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push esi
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 0x10]
push eax
call esi
cmp dword [0x80333c], 0
je 0x420a11
mov ecx, dword [esp + 0x10]
sub ecx, dword [0x800fd0]
mov edx, dword [esp + 0x14]
sbb edx, dword [0x800fd4]
mov dword [esp + 8], ecx
mov dword [esp + 0xc], edx
fild qword [esp + 8]
fdiv qword [0x800e58]
fstp dword [esp + 8]
fld dword [0x6c6454]
fld dword [esp + 8]
fcom st(1)
fnstsw ax
fstp st(1)
test ah, 0x41
jne 0x420a7d
fstp st(0)
lea eax, [esp + 8]
push eax
mov dword [0x80333c], 1
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
fild qword [esp + 8]
push 0x800fd0
fstp qword [0x800e58]
call esi
mov ecx, dword [esp + 0x10]
sub ecx, dword [0x800fd0]
mov edx, dword [esp + 0x14]
sbb edx, dword [0x800fd4]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
fild qword [esp + 0x10]
fdiv qword [0x800e58]
fstp dword [esp + 8]
fld dword [esp + 8]
fst dword [0x803340]
fst dword [0x803344]
fst dword [0x803348]
fst dword [0x80334c]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x420a90
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x134
mov eax, dword [0x74496c]
xor eax, esp
mov dword [esp + 0x130], eax
cmp byte [0x803318], 1
push ebx
push esi
push edi
push 0
jne 0x420bf0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
mov dword [esp + 0xc], edi
cmp edi, 0xffffffff
je 0x420aec
lea eax, [esp + 0x10]
push eax
push edi
mov dword [esp + 0x18], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x420b03
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x130]
xor ecx, esp
call fcn.005ff0f4
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.KERNEL32.dll_GetPriorityClass]
mov ecx, dword [esp + 0x18]
push ecx
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp esi, eax
je 0x420bbf
test esi, esi
je 0x420bbf
push esi
call ebx
push str.xxxxxxxx____xxx
push 0x6c63a8
push 0x128000
push 0x400000
push esi
call fcn.00420910
push str.x____xxxxx____xx
push 0x6c63cc
push 0x60000
push 0x900000
push esi
call fcn.00420910
push str.xxxxxxxxxxxxxxxxxx
push 0x6c63f4
push 0x10000
push fcn.00410000
push esi
call fcn.00420910
push str.xxx____xx____xx
push 0x6c6418
push 0x10000
push fcn.00410000
push esi
mov edi, eax
call fcn.00420910
add esp, 0x50
test edi, edi
jne 0x420bab
test eax, eax
je 0x420bb4
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x420b09
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x13c]
pop edi
pop esi
pop ebx
xor ecx, esp
mov al, 1
call fcn.005ff0f4
mov esp, ebp
pop ebp
ret
call sub.MSVCR90.dll_exit
int3
Function at 0x421da0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x617817
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x74496c]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebp, ecx
mov dword [esp + 0x18], ebp
xor ebx, ebx
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x2c], ebx
je 0x421df3
mov dword [ebp], 0x6c6444
mov dword [ebp + 0x58], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [esp + 0x24], ebx
mov dword [esp + 0x14], 1
mov eax, dword [ebp]
mov ecx, dword [eax + 4]
mov dword [ecx + ebp], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov edx, dword [ebp]
mov dword [ebp + 4], ebx
mov edi, dword [edx + 4]
add edi, ebp
mov ecx, edi
call fcn.00420770
lea esi, [ebp + 8]
push 0x20
mov ecx, edi
mov dword [edi + 0x28], esi
mov dword [edi + 0x2c], ebx
call fcn.00423320
mov byte [edi + 0x30], al
cmp dword [edi + 0x28], ebx
jne 0x421e3e
mov eax, dword [edi + 8]
or eax, 4
or eax, 4
push ebx
push eax
mov ecx, edi
call fcn.004205d0
mov dword [edi + 4], ebx
mov dword [esp + 0x24], 2
mov eax, dword [ebp]
mov ecx, dword [eax + 4]
mov dword [ecx + ebp], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov ecx, esi
call fcn.00422fb0
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x48], bl
mov byte [esi + 0x41], bl
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ebx
mov eax, dword [esi + 0x24]
mov dword [eax], ebx
mov ecx, dword [esi + 0x34]
mov dword [ecx], ebx
mov edx, dword [esi + 0x10]
mov dword [edx], ebx
mov eax, dword [esi + 0x20]
mov dword [eax], ebx
mov ecx, dword [esi + 0x30]
mov dword [ecx], ebx
mov dword [esi + 0x4c], ebx
mov edx, dword [0x805b00]
mov dword [esi + 0x44], edx
mov dword [esi + 0x3c], ebx
mov eax, ebp
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
Function at 0x582120
Capabilities:
Read file on windows

Disassembly:
cmp dword [esp + 8], 0
jne 0x582140
push 0
push 0x168
push str..SourceFileSystem_r3dFSCompress.cpp
push str.out_crc32
call fcn.00581780
add esp, 0x10
push ebp
mov ebp, dword [esp + 8]
push esi
push 0x6c6168
push ebp
call sub.MSVCR90.dll_fopen
mov esi, eax
add esp, 8
test esi, esi
jne 0x58215f
pop esi
xor al, al
pop ebp
ret
push ebx
push edi
push 2
push 0
push esi
call sub.MSVCR90.dll_fseek
push esi
call sub.MSVCR90.dll_ftell
push 0
push 0
push esi
mov edi, eax
call sub.MSVCR90.dll_fseek
lea eax, [edi + 1]
push 1
push eax
call fcn.005832f0
push esi
push edi
mov ebx, eax
push 1
push ebx
call sub.MSVCR90.dll_fread
add esp, 0x34
cmp eax, edi
je 0x5821bd
push esi
call sub.MSVCR90.dll_fclose
push ebx
call fcn.00583350
push edi
push ebp
push str.failed_to_read__s__d_n
call fcn.00581640
add esp, 0x14
pop edi
pop ebx
pop esi
xor al, al
pop ebp
ret
push edi
push ebx
call fcn.00581e00
push ebx
mov ebp, eax
call fcn.00583350
push esi
call sub.MSVCR90.dll_fclose
mov eax, dword [esp + 0x2c]
add esp, 0x10
test eax, eax
je 0x5821df
mov dword [eax], edi
mov ecx, dword [esp + 0x18]
pop edi
pop ebx
pop esi
mov dword [ecx], ebp
mov al, 1
pop ebp
ret

Function at 0x5822d0
Capabilities:
Read file on windows

Disassembly:
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [edi]
test eax, eax
je 0x5822e5
pop edi
mov dword [esp + 0x10], eax
jmp sub.MSVCR90.dll_fread
mov ecx, dword [edi + 8]
mov eax, dword [edi + 0x114]
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov esi, ebx
imul esi, dword [esp + 0x18]
lea edx, [ecx + esi]
cmp edx, eax
jb 0x582306
sub eax, ecx
mov esi, eax
test esi, esi
jne 0x582310
pop esi
pop ebx
xor eax, eax
pop edi
ret
mov eax, dword [edi + 4]
add eax, ecx
mov ecx, dword [esp + 0x10]
push esi
push eax
push ecx
call sub.MSVCR90.dll_memcpy
add dword [edi + 8], esi
add esp, 0xc
mov eax, esi
xor edx, edx
pop esi
div ebx
pop ebx
pop edi
ret

Function at 0x582630
Capabilities:
Set file attributes

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [esp + 0x10]
push eax
push edi
call sub.MSVCR90.dll_fopen
mov esi, eax
add esp, 8
test esi, esi
jne 0x582674
call sub.MSVCR90.dll__errno
mov ecx, dword [eax]
push ecx
call fcn.00582430
push eax
push edi
push str.__warning____cant_open__s_for_writing_nError:__s__d__n
call fcn.00581640
add esp, 0x10
mov eax, esi
pop edi
pop esi
ret

Function at 0x582680
Capabilities:
Create directory
Get common file path

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
push 0
push 0
push 0x8005
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jl 0x5826d1
mov eax, esi
dec eax
mov edi, edi
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x5826a0
mov ecx, dword [str.191Z_]
mov dword [eax], ecx
mov dx, word [0x6a29cc]
mov word [eax + 4], dx
mov cl, byte [0x6a29ce]
push esi
mov byte [eax + 6], cl
call sub.MSVCR90.dll__mkdir
add esp, 4
mov al, 1
pop esi
ret
xor al, al
pop esi
ret
Function at 0x582770
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x404c
call fcn.005ff690
push esi
mov esi, dword [esp + 0x4054]
push edi
lea eax, [esp + 0x30]
push eax
push esi
call sub.MSVCR90.dll__stat32
mov edi, dword [esp + 0x4064]
lea ecx, [esp + 0x14]
push ecx
push edi
call sub.MSVCR90.dll__stat32
mov edx, dword [esp + 0x54]
add esp, 0x10
cmp edx, dword [esp + 0x20]
je 0x5827b8
pop edi
xor eax, eax
pop esi
add esp, 0x404c
ret
push ebx
push ebp
push 0x6c6168
push esi
call sub.MSVCR90.dll_fopen
push 0x6c6168
push edi
mov ebp, eax
call sub.MSVCR90.dll_fopen
add esp, 0x10
mov ebx, eax
test ebp, ebp
je 0x5828d1
push ebp
test ebx, ebx
je 0x5828d6
mov dword [esp + 0x14], 1
call sub.MSVCR90.dll_feof
add esp, 4
test eax, eax
jne 0x5828b3
push ebp
push 0x2000
lea eax, [esp + 0x2064]
push 1
push eax
call sub.MSVCR90.dll_fread
push ebx
push 0x2000
lea ecx, [esp + 0x74]
push 1
push ecx
mov edi, eax
call sub.MSVCR90.dll_fread
add esp, 0x20
cmp edi, eax
je 0x582849
push 0
push 0x6cc
push str..Source_r3dFileMan.cpp
push str.read0__read1
call fcn.00581780
add esp, 0x10
mov eax, edi
lea ecx, [esp + 0x5c]
lea esi, [esp + 0x205c]
cmp edi, 4
jb 0x582874
jmp 0x582860
mov edx, dword [esi]
cmp edx, dword [ecx]
jne 0x5828ab
sub eax, 4
add ecx, 4
add esi, 4
cmp eax, 4
jae 0x582860
test eax, eax
je 0x582898
mov dl, byte [ecx]
cmp dl, byte [esi]
jne 0x5828ab
cmp eax, 1
jbe 0x582898
mov dl, byte [ecx + 1]
cmp dl, byte [esi + 1]
jne 0x5828ab
cmp eax, 2
jbe 0x582898
mov al, byte [ecx + 2]
cmp al, byte [esi + 2]
jne 0x5828ab
push ebp
call sub.MSVCR90.dll_feof
add esp, 4
test eax, eax
je 0x582800
jmp 0x5828b3
mov dword [esp + 0x10], 0
push ebp
call sub.MSVCR90.dll_fclose
push ebx
call sub.MSVCR90.dll_fclose
mov eax, dword [esp + 0x18]
add esp, 8
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x404c
ret
test ebx, ebx
je 0x5828de
push ebx
call sub.MSVCR90.dll_fclose
add esp, 4
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x404c
ret
Function at 0x590480
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x6121ab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x110
push esi
push edi
mov esi, ecx
push 0x7e21fc
lea ecx, [esp + 0xc]
call fcn.005841b0
mov edi, dword [esp + 0x128]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
push edi
mov ecx, esi
mov dword [esp + 0x12c], 0
call fcn.0058fc30
mov edx, dword [esp + 0x12c]
push edi
push edx
lea eax, [esp + 0x1c]
push 0x6c5ca0
push eax
call fcn.00410aa0
add esp, 0x10
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.dbghelp.dll_MakeSureDirectoryPathExists]
lea edx, [esp + 0x14]
push 0x6c3d4c
push edx
call sub.MSVCR90.dll_fopen
mov esi, eax
add esp, 8
test esi, esi
jne 0x590543
mov eax, dword [esp + 0xc]
push eax
call fcn.00583350
lea ecx, [esp + 0x18]
push ecx
push str.r3dFS:_unable_to_open__s_for_writing_n
call fcn.00581470
add esp, 0xc
lea ecx, [esp + 8]
mov dword [esp + 0x120], 0xffffffff
call fcn.00584220
xor al, al
jmp 0x59057a
mov edx, dword [esp + 0x10]
mov edi, dword [esp + 0xc]
push esi
push edx
push 1
push edi
call sub.MSVCR90.dll_fwrite
push esi
call sub.MSVCR90.dll_fclose
push edi
call fcn.00583350
add esp, 0x18
lea ecx, [esp + 8]
mov dword [esp + 0x120], 0xffffffff
call fcn.00584220
mov al, 1
mov ecx, dword [esp + 0x118]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x11c
ret 8

Function at 0x592860
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x61210b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x108
push ebx
push esi
mov ebx, ecx
push 0x7e21fc
lea ecx, [esp + 0xc]
call fcn.005841b0
push 0
lea eax, [esp + 0x10]
push eax
mov ecx, ebx
mov dword [esp + 0x120], 0
call fcn.0058f580
lea ecx, [esp + 0xc]
push 0x6c6168
push ecx
call sub.MSVCR90.dll_fopen
mov esi, eax
add esp, 8
test esi, esi
jne 0x5928fd
lea edx, [esp + 0xc]
push edx
push str.r3dFS:_there_is_no_volume_file__s_n
call fcn.00581470
add esp, 8
lea ecx, [esp + 8]
mov dword [esp + 0x118], 0xffffffff
call fcn.00584220
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x108]
mov dword fs:[0], ecx
add esp, 0x114
ret
push ebp
push edi
push 2
push 0
push esi
call sub.MSVCR90.dll_fseek
push esi
call sub.MSVCR90.dll_ftell
push 0
push 0
push esi
mov edi, eax
call sub.MSVCR90.dll_fseek
lea eax, [edi + 1]
push 1
push eax
call fcn.005832f0
push esi
push 1
mov ebp, eax
push edi
push ebp
call sub.MSVCR90.dll_fread
push esi
call sub.MSVCR90.dll_fclose
add esp, 0x38
lea ecx, [esp + 0x14]
push ecx
push edi
push ebp
lea ecx, [ebx + 0x104]
call fcn.00592560
push ebp
mov bl, al
call fcn.00583350
add esp, 4
lea ecx, [esp + 0x10]
mov dword [esp + 0x120], 0xffffffff
call fcn.00584220
mov ecx, dword [esp + 0x118]
pop edi
pop ebp
pop esi
mov al, bl
pop ebx
mov dword fs:[0], ecx
add esp, 0x114
ret
Function at 0x5d5e70
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6dc350
push 0x5ffc9e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
lea eax, [ebp - 0x1c]
push eax
push 0x28
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [0x7fe890]
mov eax, dword [edx + 0x11c]
call eax
test eax, eax
jge 0x5d5ecc
mov byte [ebp - 0x25], 0
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x25]
jmp 0x5d5f75
lea ecx, [ebp - 0x24]
push ecx
push str.SeDebugPrivilege
push 0
mov edx, dword [0x7fe890]
mov eax, dword [edx + 0x1dc]
call eax
test eax, eax
jne 0x5d5f0b
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [0x7fe890]
mov eax, dword [edx + 0xbc]
call eax
mov byte [ebp - 0x26], 0
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x26]
jmp 0x5d5f75
push 4
lea ecx, [ebp - 0x24]
push ecx
push 0
mov edx, dword [ebp - 0x1c]
push edx
call fcn.005d5ad0
add esp, 0x10
movzx eax, al
test eax, eax
je 0x5d5f48
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [0x7fe890]
mov eax, dword [edx + 0xbc]
call eax
mov byte [ebp - 0x27], 1
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x27]
jmp 0x5d5f75
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [0x7fe890]
mov eax, dword [edx + 0xbc]
call eax
mov dword [ebp - 4], 0xffffffff
jmp 0x5d5f73
mov al, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5dcc30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x72
mov dword [ebp - 8], 0
jmp 0x5dcc52
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x11
jge 0x5dcc91
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x64b5beb0]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x5dcc8c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x5dcc49
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x11], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x5ff0f4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x74496c]
jne 0x5ff0fe
repz ret
jmp fcn.005ffce0

Function at 0x602110
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x602218
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x602218
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x602218
push 2
push ebx
lea eax, [ebp + 8]
push eax
push esi
call fcn.00600e40
add esp, 0x10
cmp eax, 2
je 0x602159
pop edi
pop esi
mov eax, 0x80004005
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x5a4d
cmp word [ebp + 8], ax
jne 0x60214d
push 4
lea eax, [ebx + 0x3c]
push eax
lea eax, [ebp - 4]
push eax
push esi
call fcn.00600e40
add esp, 0x10
cmp eax, 4
jne 0x60214d
add ebx, dword [ebp - 4]
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x602188
mov dword [eax], ebx
push 2
lea eax, [ebx + 4]
push eax
lea eax, [ebp + 8]
push eax
push esi
call fcn.00600e40
add esp, 0x10
cmp eax, 2
jne 0x60214d
movzx eax, word [ebp + 8]
cmp eax, 0x14c
je 0x6021e3
cmp eax, 0x8664
jne 0x60214d
push 0x108
push ebx
push edi
push esi
call fcn.00600e40
add esp, 0x10
cmp eax, 0x108
jne 0x60214d
cmp dword [edi], 0x4550
mov eax, 0x40
pop edi
mov ecx, 0x80004005
pop esi
cmovne eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
push 0xf8
push ebx
push edi
push esi
call fcn.00600e40
add esp, 0x10
cmp eax, 0xf8
jne 0x60214d
cmp dword [edi], 0x4550
mov eax, 0x20
pop edi
mov ecx, 0x80004005
pop esi
cmovne eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0x80070057
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40413c
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x404177
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x40415e
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x40416f
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x404179
inc edi
add eax, 0x28
cmp edi, esi
jb 0x404154
xor eax, eax
pop edi
pop esi
ret