joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408e10
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 8
push ebx
push esi
push edi
test ecx, ecx
je 0x408fe8
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x408fe8
test bl, 3
jne 0x408fe8
lea eax, [ebx - 1]
xor edx, edx
add eax, ecx
mov dword [ebp - 8], edx
cmp byte [eax], 0x3d
jne 0x408e5a
inc edx
dec eax
mov dword [ebp - 8], edx
cmp edx, 2
ja 0x408fe8
cmp byte [eax], 0x3d
je 0x408e47
shr ebx, 2
xor edi, edi
mov dword [ebp + 8], edi
mov dword [ebp + 0x10], ebx
test ebx, ebx
je 0x408fdd
lea esi, [ecx + 2]
mov dword [ebp - 4], esi
mov al, byte [esi - 2]
lea ecx, [eax - 0x41]
cmp cl, 0x19
ja 0x408e82
sub al, 0x41
jmp 0x408eb1
lea ecx, [eax - 0x61]
cmp cl, 0x19
ja 0x408e8e
sub al, 0x47
jmp 0x408eb1
lea ecx, [eax - 0x30]
cmp cl, 9
ja 0x408e9a
add al, 4
jmp 0x408eb1
cmp al, 0x2b
jne 0x408ea2
mov al, 0x3e
jmp 0x408eb1
cmp al, 0x2f
jne 0x408eaa
mov al, 0x3f
jmp 0x408eb1
cmp al, 0x3d
sete al
sub al, 1
mov dl, byte [esi - 1]
lea ecx, [edx - 0x41]
cmp cl, 0x19
ja 0x408ec1
sub dl, 0x41
jmp 0x408ef5
lea ecx, [edx - 0x61]
cmp cl, 0x19
ja 0x408ece
sub dl, 0x47
jmp 0x408ef5
lea ecx, [edx - 0x30]
cmp cl, 9
ja 0x408edb
add dl, 4
jmp 0x408ef5
cmp dl, 0x2b
jne 0x408ee4
mov dl, 0x3e
jmp 0x408ef5
cmp dl, 0x2f
jne 0x408eed
mov dl, 0x3f
jmp 0x408ef5
cmp dl, 0x3d
sete dl
dec dl
mov bl, byte [esi]
lea ecx, [ebx - 0x41]
cmp cl, 0x19
ja 0x408f04
sub bl, 0x41
jmp 0x408f38
lea ecx, [ebx - 0x61]
cmp cl, 0x19
ja 0x408f11
sub bl, 0x47
jmp 0x408f38
lea ecx, [ebx - 0x30]
cmp cl, 9
ja 0x408f1e
add bl, 4
jmp 0x408f38
cmp bl, 0x2b
jne 0x408f27
mov bl, 0x3e
jmp 0x408f38
cmp bl, 0x2f
jne 0x408f30
mov bl, 0x3f
jmp 0x408f38
cmp bl, 0x3d
sete bl
dec bl
mov ah, byte [esi + 1]
mov cl, ah
sub cl, 0x41
cmp cl, 0x19
ja 0x408f4a
sub ah, 0x41
jmp 0x408f82
mov cl, ah
sub cl, 0x61
cmp cl, 0x19
ja 0x408f59
sub ah, 0x47
jmp 0x408f82
mov cl, ah
sub cl, 0x30
cmp cl, 9
ja 0x408f68
add ah, 4
jmp 0x408f82
cmp ah, 0x2b
jne 0x408f71
mov ah, 0x3e
jmp 0x408f82
cmp ah, 0x2f
jne 0x408f7a
mov ah, 0x3f
jmp 0x408f82
cmp ah, 0x3d
sete ah
dec ah
cmp al, 0xff
je 0x408fe8
cmp dl, 0xff
je 0x408fe8
cmp bl, 0xff
je 0x408fe8
cmp ah, 0xff
je 0x408fe8
mov esi, dword [ebp + 0xc]
mov cl, dl
shl al, 2
shr cl, 4
or cl, al
shl dl, 4
mov byte [edi + esi], cl
mov al, bl
mov ecx, esi
shr al, 2
mov esi, dword [ebp - 4]
or al, dl
shl bl, 6
add esi, 4
or bl, ah
mov dword [ebp - 4], esi
mov byte [edi + ecx + 1], al
mov eax, dword [ebp + 8]
inc eax
mov byte [edi + ecx + 2], bl
add edi, 3
mov dword [ebp + 8], eax
cmp eax, dword [ebp + 0x10]
jb 0x408e73
mov edx, dword [ebp - 8]
sub edi, edx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409530
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 8], 0
push edi
je 0x4096a3
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x4096a3
mov eax, 0xaaaaaaab
mov ecx, edi
mul edi
push ebx
mov ebx, edx
shr ebx, 1
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebx + ebx*2]
sub ecx, eax
mov eax, 0
mov dword [ebp - 4], ecx
setne al
add eax, ebx
shl eax, 2
mov dword [ebp - 8], eax
test esi, esi
je 0x40969c
xor eax, eax
test ebx, ebx
je 0x409600
mov edi, dword [ebp + 8]
add edi, 2
lea ebx, [ebx]
movzx ecx, byte [edi - 2]
lea edi, [edi + 3]
shr ecx, 2
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi], cl
movzx edx, byte [edi - 5]
movzx ecx, byte [edi - 4]
and edx, 3
shr ecx, 4
shl edx, 4
or edx, ecx
movzx ecx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi + 1], cl
movzx edx, byte [edi - 4]
movzx ecx, byte [edi - 3]
and edx, 0xf
shr ecx, 6
shl edx, 2
or edx, ecx
movzx ecx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi + 2], cl
movzx ecx, byte [edi - 3]
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi + 3], cl
add eax, 4
sub ebx, 1
jne 0x409590
mov ecx, dword [ebp - 4]
mov edi, dword [ebp + 0x10]
sub ecx, 1
je 0x409667
sub ecx, 1
jne 0x409699
mov ebx, dword [ebp + 8]
movzx ecx, byte [ebx + edi - 2]
shr ecx, 2
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi], cl
movzx edx, byte [ebx + edi - 2]
movzx ecx, byte [ebx + edi - 1]
and edx, 3
shr ecx, 4
shl edx, 4
or edx, ecx
movzx ecx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi + 1], cl
lea ecx, [eax + 2]
movzx eax, byte [ebx + edi - 1]
and eax, 0xf
mov al, byte [eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + esi], al
mov eax, dword [ebp - 8]
mov byte [ecx + esi + 1], 0x3d
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
movzx ecx, byte [edx + edi - 1]
shr ecx, 2
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi], cl
movzx ecx, byte [edx + edi - 1]
and ecx, 3
shl ecx, 4
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi + 1], cl
mov word [eax + esi + 2], 0x3d3d
mov eax, dword [ebp - 8]
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x40a540
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41c378
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x431f04]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x14], 0
je 0x40a70a
push 0x11
xor eax, eax
mov dword [ebp - 0x18], 0
push str.ciphertextversion
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 7
mov word [ebp - 0x30], ax
call fcn.00402660
lea eax, [ebp - 0x30]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.00407bf0
push eax
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 1
push eax
call fcn.004096b0
push eax
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 2
push eax
call fcn.00407b00
mov edx, dword [ebp - 0x34]
add esp, 0x18
cmp edx, 0x10
jb 0x40a60e
mov ecx, dword [ebp - 0x48]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40a604
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a725
push edx
push ecx
call fcn.0040c046
add esp, 8
mov edx, dword [ebp - 0x4c]
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0xf
mov byte [ebp - 0x48], 0
cmp edx, 0x10
jb 0x40a654
mov ecx, dword [ebp - 0x60]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40a64a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a725
push edx
push ecx
call fcn.0040c046
add esp, 8
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0xf
mov byte [ebp - 0x60], 0
cmp edx, 8
jb 0x40a6a0
mov ecx, dword [ebp - 0x30]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40a696
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a725
push edx
push ecx
call fcn.0040c046
add esp, 8
cmp dword [edi + 0x18], 8
lea esi, [edi + 4]
mov ecx, esi
jb 0x40a6ad
mov ecx, dword [esi]
cmp dword [ebp - 0x64], 8
lea eax, [ebp - 0x78]
push ecx
cmovae eax, dword [ebp - 0x78]
lea ecx, [ebp - 0x18]
push 4
push ecx
push 0
push eax
push str.Support
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x40a6d9
mov word [edi + 0x3c], 0x101
jmp 0x40a702
cmp dword [esi + 0x14], 8
jb 0x40a6e1
mov esi, dword [esi]
push esi
push 4
lea eax, [ebp - 0x18]
push eax
push 0
push str.ciphertextversion
push str.Support
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x40a702
mov byte [edi + 0x3d], 1
lea ecx, [ebp - 0x78]
call fcn.004019c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040c2b3
mov esp, ebp
pop ebp
ret
call fcn.0040fa8a
int3
Function at 0x40b360
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push 0
push 8
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x40b532
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0x3f0
jne 0x40b532
push edi
mov ecx, esi
call fcn.0040b5b0
mov edi, eax
cmp edi, 0xffffffff
je 0x40b529
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0xffffffff
push eax
push 0x20008
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40b515
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
test edi, edi
je 0x40b50b
test eax, eax
je 0x40b50b
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push 0
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x40b416
call ebx
cmp eax, 0x7a
jne 0x40b50b
push dword [ebp - 4]
call fcn.0040c054
add esp, 4
mov ebx, eax
lea eax, [ebp - 4]
mov dword [ebp - 0x18], ebx
push eax
push dword [ebp - 4]
push ebx
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x40b502
mov eax, dword [ebx]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40b502
push eax
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x40b502
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push 0
push 1
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x40b488
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x40b50b
push dword [ebp - 4]
call fcn.0040c054
add esp, 4
mov dword [ebp - 8], eax
lea ecx, [ebp - 4]
push ecx
push dword [ebp - 4]
push eax
push 1
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x40b4ef
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x40b4ef
push eax
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x40b4ef
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
push dword [ebp - 0x18]
cmp eax, 1
sete bl
call fcn.0040c05d
push dword [ebp - 8]
call fcn.0040c05d
add esp, 8
test bl, bl
jne 0x40b515
jmp 0x40b50b
push ebx
call fcn.0040c05d
push dword [ebp - 8]
call fcn.0040c05d
add esp, 8
jmp 0x40b50b
push ebx
call fcn.0040c05d
add esp, 4
push edi
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
mov byte [esi], 1
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
mov eax, dword [ebp - 0xc]
cmp eax, 0xffffffff
je 0x40b529
push eax
call edi
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40b5b0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41c53b
mov eax, dword fs:[0]
push eax
sub esp, 0x250
mov eax, dword [0x431f04]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x248]
mov dword [ebp - 0x244], 0xffffffff
push eax
mov dword [ebp - 0x248], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x40b7c0
cmp dword [ebp - 0x248], 0xffffffff
je 0x40b7c0
xor esi, esi
xor edi, edi
xor ebx, ebx
mov dword [ebp - 0x24c], esi
mov dword [ebp - 0x25c], esi
mov dword [ebp - 0x258], edi
mov dword [ebp - 0x254], ebx
push ebx
push 2
mov dword [ebp - 4], ebx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x240], eax
cmp eax, 0xffffffff
je 0x40b789
push 0x228
lea eax, [ebp - 0x238]
mov dword [ebp - 0x23c], 0x22c
push ebx
push eax
call fcn.0040e030
add esp, 0xc
lea eax, [ebp - 0x23c]
push eax
push dword [ebp - 0x240]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x40b700
jmp 0x40b690
lea eax, [ebp - 0x218]
push str.explorer.exe
push eax
call fcn.00410c6e
add esp, 8
test eax, eax
jne 0x40b6de
cmp edi, ebx
je 0x40b6bf
mov eax, dword [ebp - 0x234]
mov dword [edi], eax
add edi, 4
mov dword [ebp - 0x258], edi
jmp 0x40b6de
lea eax, [ebp - 0x234]
push eax
push edi
lea ecx, [ebp - 0x25c]
call fcn.0040b200
mov ebx, dword [ebp - 0x254]
mov edi, dword [ebp - 0x258]
lea eax, [ebp - 0x23c]
push eax
push dword [ebp - 0x240]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x40b690
mov esi, dword [ebp - 0x25c]
mov dword [ebp - 0x24c], esi
push dword [ebp - 0x240]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, edi
je 0x40b789
lea eax, [ebp - 0x240]
mov dword [ebp - 0x240], 0xffffffff
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x40b774
mov eax, dword [ebp - 0x240]
cmp eax, dword [ebp - 0x248]
jne 0x40b774
push dword [esi]
push 0
push 0x100400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x250], eax
test eax, eax
je 0x40b774
lea ecx, [ebp - 0x244]
push ecx
push 0xf
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push dword [ebp - 0x250]
test eax, eax
jne 0x40b77d
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esi, 4
cmp esi, edi
jne 0x40b710
jmp 0x40b783
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x24c]
mov edi, dword [ebp - 0x244]
test esi, esi
je 0x40b7bc
sub ebx, esi
mov eax, esi
and ebx, 0xfffffffc
cmp ebx, 0x1000
jb 0x40b7b2
mov esi, dword [esi - 4]
add ebx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40b7e2
push ebx
push esi
call fcn.0040c046
add esp, 8
mov eax, edi
jmp 0x40b7c6
mov eax, dword [ebp - 0x244]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040c2b3
mov esp, ebp
pop ebp
ret
call fcn.0040fa8a
int3

Function at 0x41391b
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041346e
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x1001baa3
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1001bae2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001bae2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001bae2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1001bae2
cmp dword [ecx + 0x74], 0xe
jbe 0x1001bae2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1001e75f
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1001e7fc
push ebx
push esi
call fcn.1001e728
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1001e6bc
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1001e7a9
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001e7fb
push edi
push eax
call fcn.1001f71a
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1001e7c9
call fcn.1001d204
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001e7fa
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1001e6bc
add esp, 0x20
test eax, eax
jne 0x1001e7e8
push edi
call fcn.1001d204
jmp 0x1001e7f0
push ebx
call fcn.1001d204
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1001ea69
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10026cc8
push 0x10026cc0
push str.FlsAlloc
push 0x1f
call fcn.1001e985
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001ea9d
push dword [ebp + 8]
mov ecx, esi
call dword [0x10025150]
call esi
jmp 0x1001eaa3
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1001eae7
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10026cd8
push 0x10026cd0
push str.FlsGetValue
push 0x21
call fcn.1001e985
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001eb1e
push dword [ebp + 8]
mov ecx, esi
call dword [0x10025150]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1001eb26
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10026ce0
push 0x10026cd8
push str.FlsSetValue
push 0x22
call fcn.1001e985
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001eb60
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10025150]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x100241e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1002420d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1002420d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x4019e0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push 2
mov ebx, ecx
mov dword [ebp - 0x130], 0x128
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x401ab6
lea eax, [ebp - 0x130]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
lea ecx, [ebp - 0x10c]
mov eax, ebx
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401a50
test dl, dl
je 0x401a4c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401a50
add eax, 2
add ecx, 2
test dl, dl
jne 0x401a30
xor eax, eax
jmp 0x401a55
sbb eax, eax
or eax, 1
test eax, eax
je 0x401ac9
mov edi, dword [sym.imp.KERNEL32.dll_Process32Next]
lea eax, [ebp - 0x130]
push eax
push esi
call edi
test eax, eax
je 0x401aaf
nop dword [eax]
lea eax, [ebp - 0x10c]
mov ecx, ebx
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x401a98
test dl, dl
je 0x401a94
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x401a98
add ecx, 2
add eax, 2
test dl, dl
jne 0x401a78
xor eax, eax
jmp 0x401a9d
sbb eax, eax
or eax, 1
test eax, eax
je 0x401ac9
lea eax, [ebp - 0x130]
push eax
push esi
call edi
test eax, eax
jne 0x401a70
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402d62
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x128]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00402d62
mov esp, ebp
pop ebp
ret
Function at 0x401af0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ecx, 4
mov dword [ebp - 0xc], edx
mov eax, esi
mul ecx
mov ecx, 0xffffffff
mov dword [ebp - 4], 0
push edi
cmovb eax, ecx
push eax
call fcn.00405d10
add esp, 4
xor ecx, ecx
mov edi, eax
test esi, esi
je 0x401bac
cmp esi, 0x10
jb 0x401b97
movaps xmm1, xmmword [0x41bae0]
lea edx, [edi + 0x20]
mov ebx, esi
and ebx, 0xfffffff0
movd xmm0, ecx
lea eax, [ecx + 4]
pshufd xmm0, xmm0, 0
lea edx, [edx + 0x40]
paddd xmm0, xmm1
movups xmmword [edx - 0x60], xmm0
movd xmm0, eax
lea eax, [ecx + 8]
pshufd xmm0, xmm0, 0
paddd xmm0, xmm1
movups xmmword [edx - 0x50], xmm0
movd xmm0, eax
lea eax, [ecx + 0xc]
pshufd xmm0, xmm0, 0
add ecx, 0x10
paddd xmm0, xmm1
movups xmmword [edx - 0x40], xmm0
movd xmm0, eax
pshufd xmm0, xmm0, 0
paddd xmm0, xmm1
movups xmmword [edx - 0x30], xmm0
cmp ecx, ebx
jb 0x401b40
cmp ecx, esi
jae 0x401bac
nop dword [eax + eax]
mov dword [edi + ecx*4], ecx
inc ecx
cmp ecx, esi
jb 0x401ba0
xor ebx, ebx
jmp 0x401bb2
xor ebx, ebx
test esi, esi
je 0x401bdf
xor edx, edx
mov ecx, dword [edi + ebx*4]
mov eax, ebx
div esi
mov eax, dword [ebp - 0xc]
movzx eax, byte [edx + eax]
xor edx, edx
add eax, ecx
add eax, dword [ebp - 4]
div esi
mov dword [ebp - 4], edx
mov eax, dword [edi + edx*4]
mov dword [edi + ebx*4], eax
inc ebx
movzx eax, cl
mov dword [edi + edx*4], eax
cmp ebx, esi
jb 0x401bb2
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp + 8], eax
je 0x401c5b
nop dword [eax]
inc eax
xor edx, edx
div esi
mov eax, edx
xor edx, edx
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, dword [edi + eax*4]
mov eax, dword [ebp - 4]
lea eax, [ecx + eax]
movzx ecx, cl
div esi
mov dword [ebp - 4], edx
mov eax, dword [edi + edx*4]
mov dword [edi + ebx*4], eax
mov eax, ebx
mov dword [edi + edx*4], ecx
xor edx, edx
mov ebx, dword [ebp + 8]
mov eax, dword [edi + eax*4]
add eax, ecx
mov ecx, dword [ebp - 0xc]
div esi
mov al, byte [edi + edx*4]
xor byte [ecx + 0x41e8f0], al
inc ecx
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], ecx
cmp ecx, ebx
jb 0x401bf0
xor ecx, ecx
mov al, byte [ecx + 0x41e8f0]
ror al, 3
not al
ror al, 6
not al
mov byte [ecx + 0x41e8f0], al
inc ecx
cmp ecx, ebx
jb 0x401c40
push edi
call fcn.00402d70
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401c70
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push ecx
push 0x18
mov dword [ebp - 0x22c], edx
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x401cf7
lea eax, [ebp - 0x228]
mov dword [ebp - 0x228], 0x224
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x401cf0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Module32Next]
push dword [ebp - 0x22c]
lea eax, [ebp - 0x208]
push eax
call fcn.004080d4
add esp, 8
test eax, eax
je 0x401ce9
lea eax, [ebp - 0x228]
push eax
push esi
call edi
test eax, eax
jne 0x401cc0
jmp 0x401cef
mov ebx, dword [ebp - 0x214]
pop edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.00402d62
mov esp, ebp
pop ebp
ret