joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4dc7f0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4fb1f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov al, byte [esp + 0x3c]
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov byte [esp + 0x10], al
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x44]
push ebx
mov dword [esp + 0x40], ebx
mov byte [esp + 0x28], al
mov edx, dword [ecx]
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], edx
call fcn.004d1506
mov eax, dword [0x6cc350]
lea ecx, [esp + 0x10]
push eax
push ebx
push ecx
lea ecx, [esp + 0x30]
call fcn.004d1438
lea edx, [esp + 0x20]
lea eax, [esp + 8]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x44], 1
call fcn.004dd2d0
mov esi, dword [eax]
mov ecx, dword [eax + 4]
mov eax, dword [esp + 0x28]
cmp eax, ebx
mov dword [esp + 0xc], ecx
je 0x4dc897
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x4dc88e
cmp al, 0xff
je 0x4dc88e
dec al
mov byte [ecx], al
jmp 0x4dc897
push ecx
call fcn.004e635c
add esp, 4
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], ebx
cmp eax, ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
je 0x4dc8c8
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x4dc8bf
cmp al, 0xff
je 0x4dc8bf
dec al
mov byte [ecx], al
jmp 0x4dc8c8
push ecx
call fcn.004e635c
add esp, 4
mov ecx, dword [esp + 0x34]
lea eax, [esi + 0x10]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret 4
Function at 0x4e7438
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
call fcn.004f16f4
mov esi, dword [eax + 0xc]
push 5
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4e7469
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push esi
mov ecx, ebx
push dword [esp + 0x18]
push edi
call fcn.004e747c
pop edi
pop esi
pop ebx
ret 8

Function at 0x4e8a50
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4e8a88
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004e6a99
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004e6a71
jmp 0x4e8a94
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4ea348
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4ea38a
call fcn.004f16f4
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4ea38a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4ea381
xor eax, eax
jmp 0x4ea392
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004ea398
pop edi
pop esi
pop ebx
ret 4

Function at 0x4f1c24
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4f1c52
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4f1c70
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004f1b8a
jmp 0x4f1c70
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4f1c70
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004f1b8a
test edi, edi
mov eax, edi
jne 0x4f1c5a
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x401630
Capabilities:
Read .ini file

Disassembly:
push ebp
mov eax, 0x10
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x22c
and esp, 0xfffffff0
call fcn.00401c30
call fcn.00401810
mov dword [esp], str.Tera_Term
mov eax, dword [section..data]
mov esi, 1
lea ebx, [ebp - 0x218]
mov dword [esp + 0x14], eax
mov eax, 0x100
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x118]
mov dword [esp + 0xc], eax
mov eax, str.c:cygwin
mov dword [esp + 8], eax
mov eax, str.CygwinDirectory
mov dword [esp + 4], eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
mov byte [ebp - 0x218], 0
sub esp, 0x18
cmp esi, dword [ebp + 8]
jge 0x40175f
mov edi, 0xff
nop
lea esi, [esi]
mov ecx, ebx
lea esi, [esi]
lea edi, [edi]
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
not eax
and edx, eax
and edx, 0x80808080
je 0x4016c0
test edx, 0x8080
jne 0x4016e5
shr edx, 0x10
add ecx, 2
add dl, dl
mov eax, edi
mov edx, dword [ebp + 0xc]
sbb ecx, 3
sub ecx, ebx
sub eax, ecx
mov dword [esp + 8], eax
mov eax, dword [edx + esi*4]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_strncat
mov ecx, ebx
nop
lea esi, [esi]
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
not eax
and edx, eax
and edx, 0x80808080
je 0x401710
test edx, 0x8080
jne 0x401735
shr edx, 0x10
add ecx, 2
mov dword [esp], ebx
add dl, dl
mov eax, edi
sbb ecx, 3
sub ecx, ebx
inc esi
sub eax, ecx
mov dword [esp + 8], eax
mov eax, 0x4030ba
mov dword [esp + 4], eax
call sub.msvcrt.dll_strncat
cmp esi, dword [ebp + 8]
jl 0x4016b0
mov dword [esp + 4], ebx
lea eax, [ebp - 0x118]
mov dword [esp], eax
call fcn.004012e0
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x401830
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov dword [ebp - 4], edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], ebx
mov ebx, eax
test edi, edi
mov dword [ebp - 8], esi
mov esi, edx
jne 0x401857
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [esp], ebx
mov eax, 0x1c
mov dword [esp + 8], eax
lea eax, [ebp - 0x38]
mov dword [esp + 4], eax
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x401905
mov eax, dword [ebp - 0x24]
cmp eax, 0x40
setne dl
cmp eax, 4
setne al
movzx eax, al
test eax, edx
jne 0x4018de
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x24]
cmp eax, 0x40
setne dl
cmp eax, 4
setne al
movzx eax, al
test eax, edx
je 0x40184a
lea eax, [ebp - 0x3c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x3c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
jmp 0x40184a
lea eax, [ebp - 0x3c]
mov dword [esp + 0xc], eax
mov eax, 0x40
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
jmp 0x401890
mov dword [esp], str.VirtualQuery__addr__b__sizeof_b__
mov ecx, 0x34
mov edx, str..._.._runtime_pseudo_reloc.c
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
call sub.msvcrt.dll__assert
lea esi, [esi]
lea edi, [edi]
Function at 0x429440
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x58ebc0]
xor edx, edx
cmp eax, edx
jne 0x429466
xor eax, eax
mov byte [eax + 0x58eac0], al
inc eax
cmp eax, 0x100
jl 0x42944e
mov dword [0x58ebc0], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x58eac0
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x4294f7
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x4294ca
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x429498
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x429570
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x4295c3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x4295aa
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43dea0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x480258
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push esi
mov ebx, ecx
push edi
mov esi, dword [ebp]
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
dec ecx
cmp eax, ecx
jge 0x43ded9
inc eax
mov dword [esi + 0x10], eax
jmp 0x43dfec
mov eax, dword [ebx + 0x3c]
mov ecx, dword [esi + 8]
cmp ecx, eax
jne 0x43deed
mov eax, 0xffffffc7
jmp 0x43dfee
mov esi, dword [esi]
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp edx, ecx
jl 0x43defe
cmp dword [esi + 8], eax
jne 0x43deed
cmp dword [esi + 8], eax
jne 0x43df17
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp eax, ecx
jl 0x43df17
mov eax, 0xffffffc7
jmp 0x43dfee
mov eax, dword [esi + 4]
xor edi, edi
cmp eax, edi
je 0x43df2b
push eax
mov ecx, ebx
call fcn.0043d6d0
mov dword [esi + 4], edi
mov dword [ebp], esi
mov ecx, dword [esi + 0x10]
inc ecx
mov dword [esi + 0x10], ecx
lea ecx, [esp + 0x10]
call fcn.0040ad30
mov dword [esp + 0x2c], edi
mov edi, dword [esp + 0x3c]
test edi, edi
jne 0x43df5c
mov ecx, dword [ebx + 4]
mov edx, dword [ecx + 8]
lea ecx, [esp + 0x10]
push edx
call fcn.0040ad50
mov edi, eax
mov eax, dword [esi + 8]
push edi
push eax
mov ecx, ebx
call fcn.0043ce40
test eax, eax
mov dword [esp + 0x38], eax
je 0x43df8f
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x55f2f8
call fcn.0040af30
mov eax, dword [esp + 0x38]
jmp 0x43dfee
mov ecx, dword [esi + 0x10]
push ecx
push edi
mov ecx, ebx
call fcn.0043dd00
mov dl, byte [edi]
and dl, 1
cmp dl, 1
jne 0x43dfd3
mov ecx, dword [esp + 0x34]
push ebp
push ecx
push edi
push eax
mov ecx, ebx
call fcn.0043dd20
mov esi, eax
test esi, esi
jne 0x43e003
mov edx, dword [ebp]
push eax
push edi
mov ecx, ebx
mov dword [edx + 0x10], eax
call fcn.0043dd00
mov cl, byte [edi]
and cl, 1
cmp cl, 1
je 0x43dfa5
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x55f2f8
call fcn.0040af30
xor eax, eax
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x55f2f8
call fcn.0040af30
mov eax, esi
jmp 0x43dfee
Function at 0x612bf8
Capabilities:
Encode data using xor

Disassembly:
push es
mov eax, dword [0xd2b727a9]
and esp, esp
sbb edx, dword [edx + 0x7c926700]
adc dword [ebx], 0xffffff83
out 0x15, al
mul dword [ecx + ebp*8 + 0x79]
sbb bl, ch
or ecx, eax
inc esp
fidivr dword [ebp - 0x5fd25ab4]
push ecx
mov al, byte [0x34a63454]
push ebx
mov al, byte [0x54a05136]
xor al, 0xa6
xor al, 0x53
scasb al, byte es:[edi]
inc esi
lcall 0xeee2, 0x9fa9f0f
or edx, esp
out dx, al
jle 0x612c19
mov eax, dword [esi - 0x19706df]
cdq
push 0xc24cdaab
movsd dword es:[edi], dword [esi]
push esp
mov dh, 0xd1
inc esi
aam 0xb3
dec esi
movsb byte es:[edi], byte [esi]
stc
jae 0x612c28
xchg byte [ebp - 0x65], dh
outsd dx, dword [esi]
cli
push 0x2a5dfa0f
mov al, 0x26
inc ecx
mov al, 0x41
lodsd eax, dword [esi]
movsb byte es:[edi], byte ss:[esi]
ret

Function at 0x620626
Capabilities:
Parse pe header

Disassembly:
jmp 0x650467
lea esp, [esp + 4]
jmp fcn.006513b9

Function at 0x62064d
Capabilities:
Enumerate pe sections

Disassembly:
jmp 0x650473
lea esp, [esp + 4]
jmp fcn.00650508
Function at 0x6284e0
Capabilities:
Encode data using xor

Disassembly:
sbb ah, byte [edx + eax]
add byte [eax], al
push esp
fmul dword [esi + 0x29]
fdiv dword [ecx]
xlatb
pop edx
enter 0x5aaf, 0xffffffffffffffae
pop edx
enter 0x395e, 0xffffffffffffffc8
and byte [ebx - 0x20], dh
jbe 0x62850c
sub esp, 0x224
jmp 0x628517
sti
push 0xfffffffffffffff8
lahf
push 0xffffffffffffffa9
xor al, 0xa2
xor byte [edi - 0x5e], dl
inc eax
push edi
mov byte [0x3931a40], al
xchg bp, ax
jns 0x62850f
sbb dl, byte [ebx + 0x79956603]
stc
jae 0x628503
jmp 0x628533
sbb dh, byte [ebp - 0x65]
jmp 0x62859b
push ebx
jmp 0x62854f
jmp 0x62856b
push 0x208
jmp 0x628587
jmp 0x6285a3
mov dl, 0xd5
and al, 0xef
in al, dx
bound eax, qword [0x18ebdb33]
fdiv st(5), st(0)
invalid
xor ebx, ebx
jmp 0x6285bf
jmp 0x6285db
lea eax, [ebp - 0x224]
jmp 0x6285f7
jmp 0x628613
push ebx
jmp 0x62862f
jmp fcn.0062864b

Function at 0x62c184
Capabilities:
Encode data using xor

Disassembly:
dec esp
push 0x36
insb byte es:[edi], dx
pop edx
aas
aas
jle 0x62c1d1
div edi
cmc
add cl, ah
int3
add al, 8
or al, 0xc7
invalid
add eax, 0x9a9a0f0a
das
mov ch, 7
pop es
push cs
or dword [edx], edx
adc ah, byte [esi + esi]
add byte [eax - 0x1d1d64e5], 0xdf
cmp eax, 0x26cdebeb
daa
daa
dec esi
imul esi, dword [edx + 0x75cd7fb2], 0x99fea75
or dword [edx], edx
sbb eax, dword [ebx + 0x2c9e1d83]
sub al, 0x58
je 0x62c21f
ljmp 0x831b:0x1209099f
sbb dh, byte [esi + ebp]
sbb ebx, dword [ebx]
sub eax, 0xb2dc6e6e
outsb dx, byte [esi]
outsb dx, byte [esi]
fdiv qword [edx - 0x114ba5a6]
pop edx
pop edx
mov ah, 0xee
mov al, byte [0x52fb5ba0]
push edx
movsb byte es:[edi], byte [esi]
idiv byte [ebx]
cmp esi, dword [esi + 0x4d]
cmp edi, dword [ebx]
jbe 0x62c26d
dec ebp
salc
salc
mov bh, 0x61
mov bl, 0xb3
jge 0x62c1f6
sub dword [ecx], ebp
push edx
jnp 0x62c210
jecxz 0x62c20c
das
das
pop esi
jno 0x62c1b9
test byte [ebx], dl
xchg edi, eax
push ebx
push ebx
cmpsb byte [esi], byte es:[edi]
cmc
rcl ecx, 1
mov ecx, 0x68
add ch, ch
in eax, dx
shr dword [eax], 0x20
inc eax
pushal
cld
cld
jecxz 0x62c26f
mov cl, 0xb1
jns 0x62c21c
pop ebx
pop ebx
mov dh, 0xed
push 0x6a
aam 0xbe
retf
dec esp
cwde
aam 0x58
pop eax
mov al, 0xe8
iretd
Function at 0x641020
Capabilities:
Encode data using xor

Disassembly:
test eax, 0x5e32ef58
scasd eax, dword es:[edi]
sub esp, dword [ebx - 0x3127426]
dec esi
movsb byte es:[edi], byte [esi]
mov bh, 0xed
in eax, dx
push edi
add dword [esi], esi
stc
stc
fsubr dword [eax + ecx*4]
sbb byte [eax + eax + 0x4d], 5
dec esp
in al, 0xd
in eax, dx
test byte [esi], dh
sub al, 0xe2
call [eax + eax - 0x74]
sub eax, dword [0xc66b6fb]
jle 0x641002
or al, 0x7e
pop esi
dec edx
fsub dword [ebx - 0x56]
mov esp, ecx
outsb dx, byte [esi]
cld
wait
jbe 0x640fa0
int3
xchg esp, eax
mov al, 0x8f
invalid
sub al, 0xe2
call [eax + eax - 0x74]
fild word [0xf07eb66d]
fsub dword [ebx + 0x66]
stosb byte es:[edi], al
salc
pop esi
mov dword [eax], ebp
mov dword [ecx], ebx
js 0x640f72
sbb dword [eax - 0x75], edi
push cs
inc ebp
lds edx, [ebp + 0x3c]
iretd
dec ebp
adc al, 0x9b
or ebp, dword [esi - 0x63]
jns 0x640fe4
imul edi, ebx, 0xffffff9e
sti
sahf
insd dword es:[edi], dx
add ch, 0x42
inc edx
sal byte [edi + 0x49cfa242], 1
fnstcw word [eax + 0x2ba0a74b]
mov ebx, 0x1ac22dde
nop
push es
popal
nop
jb 0x641018
sbb dl, byte [eax + 0x72906106]
stc
jb 0x641001
loopne 0x640fa9
xchg dword [edx - 0x2b], esi
jb 0x640ff9
pushal
call 0x244c29a8
arpl word fs:[esi], ax
cmc
sbb eax, 0x8dea74fa
jl 0x640fce
lea edi, [eax + ebx*4 - 0x24]
push ecx
shl dword [eax - 0x1e904cad], 0x71
adc bl, ah
or ch, dh
fcom qword [ecx - 0x3f]
mov al, byte [0xe16fb353]
jno 0x641050
jecxz 0x64104a
cmc
js 0x641033
mov dword [eax - 0x74], edi
push ecx
rcl dword [ecx + 0x30], 0xc3
push ecx
xor bl, al
sub dword [eax - 0x17], edi
jns 0x64106a
jmp 0x641070
jg 0x641043
jge 0x64105c
not dword [edx - 0x73]
sbb al, 0xb2
aad 0x24
out 0x57, eax
mov dl, 0xd5
and al, 0xe7
push edi
invalid
pop eax
mov dl, 0xe3
jne 0x641054
invalid
jg 0x641007
mov eax, 0x35c6a333
xchg esp, eax
push edi
xor esp, dword [ebx + 0x579435c6]
rol dword [ebx + 0x26], cl
aad 0x22
mov ebx, 0xdbd4e2b
mov ss, word [esi]
test bl, ah
push ds
mov bh, 0xe9
jo 0x641073
xor dword [eax - 0x31], 0x1c75e579
out dx, eax
inc esp
mov edx, dword [edx + ecx*4]
in eax, dx
sbb al, 0xab
retf
Function at 0x402644
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 8
call fcn.00424845
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0x10
call fcn.00424845
add esp, 4
mov dword [ebp - 0x10], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x14], 0
cmp dword [ebp + 8], 0
jne 0x4026c0
mov eax, dword [0x5b559c]
mov dword [ebp + 8], eax
mov dword [ebp - 0x18], esp
push dword [ebp + 8]
push 0
push 0x1f0fff
mov eax, 3
call fcn.0042485d
cmp dword [ebp - 0x18], esp
je 0x4026ec
push 6
call fcn.00424857
add esp, 4
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], esp
lea eax, [ebp - 8]
push eax
push 0xf01ff
push dword [ebp - 4]
mov eax, 8
call fcn.0042485d
cmp dword [ebp - 0x18], esp
je 0x40271a
push 6
call fcn.00424857
add esp, 4
mov dword [ebp - 0x18], esp
push dword [ebp - 0xc]
push str.SeDebugPrivilege
push 0
mov eax, 9
call fcn.0042485d
cmp dword [ebp - 0x18], esp
je 0x402746
push 6
call fcn.00424857
add esp, 4
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 1
mov ebx, dword [ebp - 0x10]
add ebx, 0xc
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 2
mov ebx, dword [ebp - 0x10]
add ebx, 4
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x10]
add ebx, 8
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xc]
add ebx, 4
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov dword [ebp - 0x18], esp
push 0
push 0
push 0
push dword [ebp - 0x10]
push 0
push dword [ebp - 8]
mov eax, 0xa
call fcn.0042485d
cmp dword [ebp - 0x18], esp
je 0x4027d5
push 6
call fcn.00424857
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], esp
push dword [ebp - 4]
mov eax, 0xb
call fcn.0042485d
cmp dword [ebp - 0x18], esp
je 0x4027fa
push 6
call fcn.00424857
add esp, 4
mov eax, dword [ebp - 0x14]
jmp 0x402802
push eax
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.0042484b
add esp, 4
mov ebx, dword [ebp - 0x10]
push ebx
call fcn.0042484b
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 8
Function at 0x412750
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.00412900
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x41284e
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x4127f1
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x412834
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x412808
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x412823
test al, 0x40
je 0x41281a
mov ecx, dword [edi + 0x20]
jmp 0x412821
test al, 0x80
je 0x412834
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x412834
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x4127c0
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x433ac0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4a525b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00499490
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x433b42
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00497210
mov eax, dword [eax]
push 0x5a4244
push eax
call fcn.004893e4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0049971b
test bl, bl
je 0x433b42
push 0x5a4244
lea ecx, [esp + 0xc]
call fcn.00499aab
push 0x5a7dc4
lea ecx, [esp + 0xc]
call fcn.00499aab
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x433b7e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0049971b
jmp 0x433c49
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x433c02
lea edx, [esp + 0x7c]
push 0x5a7dc0
push edx
call fcn.004893e4
add esp, 8
test eax, eax
je 0x433c02
lea eax, [esp + 0x7c]
push 0x5a7dbc
push eax
call fcn.004893e4
add esp, 8
test eax, eax
je 0x433c02
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x433b92
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0049971b
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x434440
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x4344a2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc