joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405d6d
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
mov byte [ebp - 0x250], 1
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x248]
push ecx
call fcn.00409730
add esp, 8
push 0
lea edx, [ebp - 0x248]
push edx
call fcn.00409830
add esp, 8
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00409730
add esp, 8
lea edx, [ebp - 0x144]
push edx
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0xffffffff
jne 0x405ddf
mov al, byte [ebp - 0x250]
jmp 0x405e42
mov ecx, 1
test ecx, ecx
je 0x405e2f
lea edx, [ebp - 0x118]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.00409730
add esp, 8
lea ecx, [ebp - 0x248]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x405e13
mov byte [ebp - 0x250], 0
lea edx, [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x24c]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x405e2d
jmp 0x405e2f
jmp 0x405ddf
mov ecx, dword [ebp - 0x24c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, byte [ebp - 0x250]
mov esp, ebp
pop ebp
ret

Function at 0x405e46
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
and eax, 0xff
test eax, eax
je 0x405e67
push 0xffffffffffffffff
mov ecx, dword [0x412140]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea edx, [ebp - 8]
push edx
mov eax, dword [0x412140]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ecx, dword [0x412144]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x412140]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.004053b7
call dword [0x412264]
mov eax, dword [0x412378]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [0x412480]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x412258]
mov eax, dword [edx]
sub eax, 1
mov ecx, dword [0x412258]
mov dword [ecx], eax
mov edx, dword [0x412258]
xor eax, eax
cmp dword [edx], 0
sete al
mov byte [ebp - 4], al
mov ecx, dword [ebp - 4]
and ecx, 0xff
test ecx, ecx
je 0x405f10
xor edx, edx
mov dl, byte [0x41225c]
test edx, edx
jne 0x405f10
push 0x412150
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x405f10
push 0
push 0x412150
call fcn.00405a7c
add esp, 8
xor eax, eax
mov al, byte [0x41225c]
neg eax
sbb al, al
not al
and eax, dword [ebp - 4]
push eax
call fcn.00405bb5
add esp, 4
mov ecx, dword [0x412258]
push ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edx, dword [0x412138]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x405f4a
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push str.ArmAccess
mov eax, dword [0x412378]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0
jne 0x405f7d
mov eax, 1
jmp 0x406019
push 0x100
lea ecx, [ebp - 0x200]
push ecx
push 0x4113dc
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push str..mailslotclient_
lea edx, [ebp - 0x100]
push edx
call fcn.00409730
add esp, 8
lea eax, [ebp - 0x200]
push eax
lea ecx, [ebp - 0x100]
push ecx
call fcn.00409740
add esp, 8
push 0
push 0x80
push 3
push 0
push 1
push 0x40000000
lea edx, [ebp - 0x100]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x412484], eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [0x412484]
push edx
mov eax, dword [0x412480]
push eax
call dword [ebp - 0x208]
add esp, 0x10
mov dword [ebp - 0x204], eax
mov ecx, dword [0x412484]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x204]
mov esp, ebp
pop ebp
ret
Function at 0x406f36
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov byte [ebp - 0xc], 0
push 0
lea eax, [ebp - 4]
push eax
push 4
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x406f6b
mov dword [0x41248c], 1
xor al, al
jmp 0x407028
mov eax, dword [ebp - 8]
and eax, 0x80000000
test eax, eax
je 0x406f87
mov ecx, dword [ebp - 8]
and ecx, 0x7fffffff
mov dword [ebp - 8], ecx
mov byte [ebp - 0xc], 1
cmp dword [ebp - 8], 0
je 0x40701e
cmp dword [ebp + 0xc], 0
je 0x40700c
push 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x406fc1
mov dword [0x41248c], 1
xor al, al
jmp 0x407028
cmp dword [ebp + 0x14], 0
je 0x406fdb
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0x14]
push edx
call fcn.0040438b
add esp, 0xc
mov eax, dword [ebp - 0xc]
and eax, 0xff
test eax, eax
jne 0x40700a
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
push edx
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00404549
add esp, 0xc
and eax, 0xff
test eax, eax
jne 0x40700a
xor al, al
jmp 0x407028
jmp 0x40701e
push 1
push 0
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 8]
mov dword [ecx], edx
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x40722c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov byte [0x41236c], 1
lea eax, [ebp - 4]
push eax
push 0
push 0x412140
push 0x405413
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x412374], eax
xor ecx, ecx
mov cl, byte [0x41236c]
cmp ecx, 1
jne 0x40726f
push 0
push 0x7d
call dword [sym.imp.KERNEL32.dll_SleepEx]
jmp 0x407256
mov esp, ebp
pop ebp
ret

Function at 0x40793c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push reloc.KERNEL32.dll_HeapReAlloc
call fcn.00408f35
add esp, 4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 1
mov ecx, dword [ebp - 8]
and ecx, 0xff
test ecx, ecx
je 0x4079d5
mov dword [ebp - 4], reloc.KERNEL32.dll_HeapReAlloc
mov edx, dword [ebp + 0x10]
push edx
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.00406f36
add esp, 0x10
and eax, 0xff
test eax, eax
je 0x4079c5
cmp dword [ebp - 4], 0
jne 0x407999
jmp 0x4079d5
push 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4079c3
mov dword [0x41248c], 2
mov byte [ebp - 8], 0
jmp 0x4079d3
mov dword [0x41248c], 0
mov byte [ebp - 8], 0
jmp 0x40795c
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
push edx
call fcn.00408f2a
add esp, 4
mov al, byte [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x4079ee
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
lea eax, [ebp - 0x244]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x4115e4
lea ecx, [ebp - 0x244]
push ecx
call fcn.00409740
add esp, 8
lea edx, [ebp - 0x140]
push edx
lea eax, [ebp - 0x244]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0xffffffff
jne 0x407a44
xor al, al
jmp 0x407a53
mov ecx, dword [ebp - 0x248]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x407a57
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [ebp + 0xc]
and eax, 0xff
test eax, eax
jne 0x407aa0
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
lea edx, [ebp - 0x108]
push edx
call fcn.004098f0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x407aa0
mov eax, dword [ebp - 4]
mov byte [eax], 0
mov ecx, dword [ebp + 0xc]
and ecx, 0xff
test ecx, ecx
je 0x407abf
lea edx, [ebp - 0x108]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov eax, dword [ebp + 8]
push eax
push 0
push 0x4115e8
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x407af6
mov edx, dword [ebp + 0xc]
and edx, 0xff
test edx, edx
jne 0x407af6
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.00407a57
add esp, 8
mov esp, ebp
pop ebp
ret
Function at 0x407f0f
Capabilities:
Create mailslot
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x200
mov eax, dword [0x412368]
push eax
push str._08X
lea ecx, [ebp - 0x200]
push ecx
call fcn.00409917
add esp, 0xc
lea edx, [ebp - 0x200]
push edx
push str.ArmServerInfo
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str..mailslot_server_
lea eax, [ebp - 0x100]
push eax
call fcn.00409730
add esp, 8
lea ecx, [ebp - 0x200]
push ecx
lea edx, [ebp - 0x100]
push edx
call fcn.00409740
add esp, 8
push 0
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.KERNEL32.dll_CreateMailslotA]
mov dword [0x412480], eax
mov esp, ebp
pop ebp
ret

Function at 0x407f8a
Capabilities:
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x288
push 1
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.00407afa
add esp, 0xc
lea ecx, [ebp - 0x140]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0xffffffff
jne 0x407fca
xor eax, eax
jmp 0x408117
mov eax, dword [ebp - 0x144]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [0x4111cc]
xor ecx, dword [0x4111d0]
xor ecx, dword [0x4111c8]
xor ecx, dword [0x4111bc]
test ecx, ecx
je 0x40810e
push 0
push 0x8000080
push 3
push 0
push 1
push 0x80000000
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 0xffffffff
jne 0x408029
xor eax, eax
jmp 0x408117
mov dword [ebp - 0x148], 0
mov dword [ebp - 0x14c], 0
push 0
lea eax, [ebp - 0x148]
push eax
push 0x40
lea ecx, [ebp - 0x284]
push ecx
mov edx, dword [ebp - 0x288]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0x148], 0x40
jne 0x4080db
mov eax, dword [ebp - 0x284]
and eax, 0xffff
cmp eax, 0x5a4d
jne 0x4080db
push 0
push 0
mov ecx, dword [ebp - 0x248]
push ecx
mov edx, dword [ebp - 0x288]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x148]
push eax
push 0xf8
lea ecx, [ebp - 0x244]
push ecx
mov edx, dword [ebp - 0x288]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0x148], 0xf8
jne 0x4080db
cmp dword [ebp - 0x244], 0x4550
jne 0x4080db
mov eax, dword [ebp - 0x21c]
add eax, dword [ebp - 0x210]
mov dword [ebp - 0x14c], eax
mov ecx, dword [ebp - 0x288]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x4111cc]
xor edx, dword [0x4111d0]
xor edx, dword [0x4111c8]
xor edx, dword [0x4111bc]
cmp dword [ebp - 0x14c], edx
je 0x40810c
xor eax, eax
jmp 0x408117
jmp 0x408112
xor eax, eax
jmp 0x408117
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x40811b
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
push edi
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov cl, byte [0x4125ac]
mov byte [ebp - 0x250], cl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x24f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edx, dword [ebp + 0xc]
and edx, 0xff
test edx, edx
je 0x408181
cmp dword [ebp - 0x3c], 0
jne 0x408181
lea eax, [ebp - 0x250]
push eax
call fcn.00408245
add esp, 4
and eax, 0xff
test eax, eax
je 0x408181
lea ecx, [ebp - 0x250]
mov dword [ebp - 0x3c], ecx
push 0x104
lea edx, [ebp - 0x14c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x14c]
push eax
push str.PROTECTEDFILE
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x5c
lea ecx, [ebp - 0x14c]
push ecx
call fcn.004098f0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4081d2
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov byte [eax], 0
jmp 0x4081db
lea ecx, [ebp - 0x14c]
mov dword [ebp - 4], ecx
lea edx, [ebp - 0x14c]
push edx
push str.PROTECTEDFILEPATH
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x412140
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40823e
mov dword [0x41248c], 9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._Error_code__u_
push 0x412490
call fcn.00409917
add esp, 0xc
xor al, al
jmp 0x408240
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x408bdd
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 4], str.Bitmap_Window
mov al, byte [ebp + 0x14]
mov byte [0x4125d4], al
mov ecx, dword [ebp + 8]
mov dword [0x4125c4], ecx
mov edx, dword [ebp + 0xc]
mov dword [0x4125c0], edx
xor eax, eax
mov al, byte [0x4125d5]
test eax, eax
jne 0x408c83
mov dword [ebp - 0x34], 3
mov dword [ebp - 0x30], 0x408d29
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0
xor ecx, ecx
mov cl, byte [0x4125d4]
neg ecx
sbb ecx, ecx
and ecx, 0xfffffffe
add ecx, 0x7f02
push ecx
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov edx, dword [ebp - 4]
mov dword [ebp - 0x10], edx
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.USER32.dll_RegisterClassA]
mov byte [0x4125d5], 1
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
sub eax, dword [0x4125c4]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0xc], eax
push 1
call dword [sym.imp.USER32.dll_GetSystemMetrics]
sub eax, dword [0x4125c0]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 8], eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
push 0
push 0
mov ecx, dword [0x4125c0]
push ecx
mov edx, dword [0x4125c4]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
push 0x80000000
push str.Loading...
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0x10]
and eax, 0xff
neg eax
sbb eax, eax
and eax, 8
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x4125c8], eax
push 5
mov ecx, dword [0x4125c8]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [0x4125c8]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
cmp dword [0x4125c8], 0
setne al
mov esp, ebp
pop ebp
ret
Function at 0x40b40a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x411a18
cmp edx, dword [eax]
je 0x40b42c
add eax, 8
inc ecx
cmp eax, 0x411aa8
jl 0x40b41d
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x411a18]
jne 0x40b55a
mov eax, dword [0x4125f8]
cmp eax, 1
je 0x40b534
test eax, eax
jne 0x40b45d
cmp dword [0x411754], 1
je 0x40b534
cmp edx, 0xfc
je 0x40b55a
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40b494
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00409730
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00409ce0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40b4d7
lea eax, [ebp - 0x1a4]
push eax
call fcn.00409ce0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40f564
push edi
call fcn.00409d60
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00409730
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00409740
lea eax, [ebp - 0xa0]
push 0x40f544
push eax
call fcn.00409740
push dword [esi + 0x411a1c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00409740
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0040d03f
add esp, 0x2c
pop edi
jmp 0x40b55a
lea eax, [ebp + 8]
lea esi, [esi + 0x411a1c]
push 0
push eax
push dword [esi]
call fcn.00409ce0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x40507c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x40508b
pop dword [ebp - 0x10]
mov eax, 0x95716021
sub eax, 0x95310f96
sub dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x389eb
push 0
mov eax, 0x9bbcbbf2
add eax, 0x64859626
add eax, dword [ebp - 0x10]
call dword [eax]
mov ecx, 0x32e2
mov edi, eax
mov ebx, 0x4bcc74cc
add ebx, 0xb476df34
add ebx, dword [ebp - 0x10]
mov esi, 0xb14632d6
add dword [ebp - 0xc], 0xe3a1437e
mov edx, dword [ebx]
xor dword [ebp - 0xc], edi
xor edx, esi
mov dword [ebp - 0xc], 0xe7543440
mov dword [edi], edx
add edi, 0xa2c761b5
add edi, 0x5d389e4f
add ebx, 4
loop 0x4050de
add eax, 0x21e7770b
sub eax, 0x21e6b8b0
xor ebx, ebx
add ebx, eax
add eax, 0xd2fec63
add eax, 0xf2d013a2
mov ecx, 0x400000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x407875
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42f180]
jne 0x40787f
repz ret
jmp fcn.0040bbd7
Function at 0x4014d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x44c3d4]
imul eax, eax, 0x149f5ead
mov dword [0x44c3d4], eax
mov ecx, dword [0x44c0ec]
mov edx, 0xa0bbe220
sub edx, ecx
cmp edx, 0xeb433cc3
mov dword [ebp - 4], 0
jg 0x401537
mov eax, dword [0x44c374]
mov dword [ebp - 8], eax
fild dword [ebp - 8]
fstp dword [ebp - 8]
fld dword [0x44c120]
fadd dword [ebp - 8]
fistp qword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov dword [0x44c374], ecx
fld dword [0x44c120]
fadd qword [0x445ca0]
fstp dword [0x44c120]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edi
imul esi, dword [ebp + 0x10]
test esi, esi
jne 0x401562
movzx edx, word [0x44c2f0]
sub edx, 0x602c5ecb
pop edi
mov word [0x44c2f0], dx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
inc word [0x44c324]
mov ax, word [0x44c324]
movsx ecx, ax
sub ecx, 0x716c071b
mov dword [0x44c100], ecx
mov ecx, dword [ebp + 0x14]
call fcn.0040fac0
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, 0x2949
mov word [0x44c358], dx
mov edx, dword [ebp + 8]
push esi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
fld dword [0x44c27c]
mov eax, dword [0x44c224]
mov dword [ebp + 0xc], eax
fisub dword [ebp + 0xc]
xor edx, edx
fstp dword [0x44c27c]
inc dword [0x44c224]
mov eax, dword [ebp - 4]
div edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x420590
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ax, word [0x44c104]
inc word [0x44c104]
movsx ecx, ax
mov edx, 0xc4262896
sub edx, ecx
sub esp, 8
cmp edx, 0x3a6785c1
jge 0x4205fb
fld qword [0x44c420]
fsub qword [0x445ca0]
fstp qword [0x44c420]
fld qword [0x44c420]
fld dword [0x44c408]
mov eax, dword [0x44c028]
dec dword [0x44c028]
mov dword [ebp - 4], eax
fisub dword [ebp - 4]
fucompp
fnstsw ax
test ah, 0x44
jnp 0x4205fb
mov ecx, dword [0x44c3fc]
fld dword [0x44c204]
fstp st(0)
call fcn.004211d0
mov edx, dword [0x44c094]
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], edx
fild dword [ebp - 4]
push ecx
fmul qword [0x44c1a0]
fistp qword [ebp - 8]
mov eax, dword [ebp - 8]
mov dword [0x44c094], eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x42f460
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, word [0x44c304]
mov edx, dword [0x44c054]
cwde
sub eax, edx
mov word [0x44c304], ax
mov dword [ecx], 0
fld qword [0x44c288]
fadd qword [0x446cf0]
fadd dword [0x44c1d4]
fstp dword [0x44c1d4]
fld qword [0x44c288]
fld1
fsub st(1), st(0)
fxch st(1)
fstp qword [0x44c288]
mov dword [ecx + 4], 0
fld qword [0x44c3c0]
fsub qword [0x446ce8]
fstp qword [0x44c3c0]
mov dword [ecx + 8], 0x67452301
movzx eax, word [0x44c3a8]
movsx edx, ax
mov dword [ebp - 4], edx
or edx, 0xffffffff
fild dword [ebp - 4]
fsub qword [0x44c280]
mov eax, dword [0x44c370]
mov dword [ebp - 4], eax
fild dword [ebp - 4]
fsub qword [0x44c380]
fsub dword [0x44c188]
fcompp
fnstsw ax
fld qword [0x44c380]
fadd st(1)
fstp qword [0x44c380]
add dword [0x44c370], edx
inc word [0x44c3a8]
test ah, 0x41
jne 0x42f533
movzx eax, word [0x44c138]
imul eax, eax, 0x382f13b9
mov word [0x44c138], ax
jmp 0x42f555
mov ax, word [0x44c3a0]
push edi
mov edi, dword [0x44c434]
cwde
lea eax, [edi + eax + 0x741f776f]
mov dword [0x44c434], eax
add word [0x44c3a0], dx
pop edi
mov dword [ecx + 0xc], 0xefcdab89
fld dword [0x44c088]
fld dword [0x44c33c]
mov eax, dword [0x44c100]
mov dword [ebp - 4], eax
fisub dword [ebp - 4]
fsubp st(1)
fstp dword [0x44c088]
add dword [0x44c100], edx
mov dword [ecx + 0x10], 0x98badcfe
add dword [0x44c2b0], 0x994d9258
mov dword [ecx + 0x14], 0x10325476
fld dword [0x44c120]
fsub qword [0x446ce0]
fsub qword [0x44c318]
fcomp qword [0x446cd8]
fnstsw ax
fadd dword [0x44c120]
fstp dword [0x44c120]
test ah, 0x44
jnp 0x42f5f3
mov cx, word [0x44c078]
mov dx, word [0x44c3a8]
movsx eax, cx
movsx ecx, dx
sub eax, ecx
mov dword [ebp - 4], eax
fild dword [ebp - 4]
fmul qword [0x44c380]
fstp qword [0x44c380]
inc word [0x44c078]
mov esp, ebp
pop ebp
ret
Function at 0xee21b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00ee2140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00ee2140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00ee2140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00ee2140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xee2bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xee2c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xef487c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xee2c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xee2c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x43a550
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
push edx
mov edx, dword [esp + 0x10]
push eax
push ecx
push 0xca62c1d6
push 0x8f1bbcdc
push 0x6ed9eba1
push 0x5a827999
push edx
call fcn.0043a590
ret 0x18