joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10009195
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
je 0x10009297
cmp dword [esi], 0x4f4a
jne 0x10009297
cmp dword [ebp + 0xc], ebx
je 0x100091ce
cmp dword [ebp + 0x10], ebx
jbe 0x100091ce
push dword [ebp + 0x10]
push ebx
push dword [ebp + 0xc]
call sub.msvcrt.dll_memset
add esp, 0xc
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [esi + 0x220]
call dword [esi + 0x280]
mov dword [ebp + 0xc], eax
cmp eax, ebx
je 0x10009223
lea eax, [esi + 0x258]
cmp dword [eax], ebx
jne 0x10009292
push dword [esi + 8]
mov dword [eax], 1
push 0x10001e30
call fcn.1000e09d
test byte [esi + 0x218], 0x40
pop ecx
pop ecx
je 0x10009292
push 0x10001b4c
push esi
call fcn.10008679
jmp 0x10009292
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x10009292
push edi
lea edi, [esi + 0x258]
cmp dword [edi], ebx
je 0x10009291
push dword [esi + 8]
push 0x10001de0
call fcn.1000e09d
pop ecx
pop ecx
mov dword [edi], ebx
cmp dword [esi + 0x250], ebx
je 0x10009291
cmp byte [0x10015fcc], bl
je 0x10009291
mov edi, 0x10015758
push 0x10001bb8
mov ecx, edi
call fcn.1000e815
mov ecx, eax
mov dword [ebp + 0x10], ecx
cmp ecx, ebx
je 0x10009291
push 0x10001dd8
push 0x10001dd0
add esi, 0xc
push esi
call fcn.1000fcdf
push dword [ebp + 0x10]
mov ecx, edi
call fcn.1000e52b
pop edi
mov eax, dword [ebp + 0xc]
jmp 0x100092a1
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x1000d3e4
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x100035e0
call fcn.1000e09d
mov esi, dword [ebp + 8]
push dword [esi + 8]
push 0x10003588
call fcn.1000e09d
mov edi, dword [sym.imp.KERNEL32.dll_SetEvent]
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add esp, 0xc
cmp dword [esi + 0x230], 0
je 0x1000d44b
push dword [esi + 0x224]
and dword [esi + 0x218], 0xfffffffd
call edi
push 0xffffffffffffffff
push dword [esi + 0x230]
call ebx
push dword [esi + 0x230]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [esi + 0x230], 0
or dword [esi + 0x218], 2
push 0xffffffffffffffff
push dword [esi + 0x22c]
call ebx
push dword [esi + 0x224]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push dword [esi + 0x228]
call edi
lea eax, [ebp - 4]
push eax
push 0
push esi
push 0x1000d1c5
push 0x4000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
test ebx, ebx
je 0x1000d4a3
push 0xfffffffffffffffe
push ebx
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor eax, eax
mov dword [esi + 0x230], ebx
inc eax
jmp 0x1000d4b4
push dword [esi + 0x22c]
and dword [esi + 0x218], 0xfffffffd
call edi
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x1000dfad
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x3014
call fcn.10012b80
mov eax, dword [0x10015408]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10015400], 0
jne 0x1000dfdc
cmp byte [0x100160dc], 0
je 0x1000e08c
push dword [ebp + 8]
lea eax, [ebp - 0x2004]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x2004]
push eax
lea eax, [ebp - 0x3004]
push eax
call dword [sym.imp.USER32.dll_wvsprintfA]
lea eax, [ebp - 0x3014]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x3006]
push eax
movzx eax, word [ebp - 0x3008]
push eax
movzx eax, word [ebp - 0x300a]
push eax
movzx eax, word [ebp - 0x300c]
push eax
movzx eax, word [ebp - 0x3014]
push eax
movzx eax, word [ebp - 0x300e]
push eax
movzx eax, word [ebp - 0x3012]
push eax
lea eax, [ebp - 0x1004]
push 0x10003a44
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x3004]
push eax
lea eax, [ebp - 0x1004]
push 0x1000
push eax
call fcn.10012d25
add esp, 0x30
cmp byte [0x10015400], 0
je 0x1000e08c
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10012b45
leave
ret

Function at 0x1000e09d
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x4014
call fcn.10012b80
mov eax, dword [0x10015408]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10015400], 0
jne 0x1000e0cc
cmp byte [0x100160dc], 0
je 0x1000e15f
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x2004]
push 0x400
push eax
call dword [sym.imp.msvcrt.dll__vsnwprintf]
add esp, 0x10
lea eax, [ebp - 0x4014]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea eax, [ebp - 0x2004]
push eax
movzx eax, word [ebp - 0x4006]
push eax
movzx eax, word [ebp - 0x4008]
push eax
movzx eax, word [ebp - 0x400a]
push eax
movzx eax, word [ebp - 0x400c]
push eax
movzx eax, word [ebp - 0x4014]
push eax
movzx eax, word [ebp - 0x400e]
push eax
movzx eax, word [ebp - 0x4012]
push eax
lea eax, [ebp - 0x4004]
push 0x10003a68
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x28
cmp byte [0x10015400], 0
je 0x1000e15f
lea eax, [ebp - 0x4004]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10012b45
leave
ret
Function at 0x1000e1b0
Capabilities:
Start service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x1000e2c0
cmp word [ebx], 0
je 0x1000e2c0
mov esi, dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push ebx
call esi
mov edi, eax
test edi, edi
je 0x1000e2c6
push edi
push ebx
push 0x10003bc0
call fcn.1000e09d
and dword [ebp - 4], 0
add esp, 0xc
cmp edi, 0x35
jne 0x1000e2c6
push 0x10003b50
call fcn.1000e09d
mov dword [esp], 0xf003f
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 8], eax
test eax, eax
je 0x1000e283
push 0xf01ff
push 0x10003ba0
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp + 8], eax
test eax, eax
je 0x1000e269
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x1000e262
push 0x10003b28
call fcn.1000dfad
pop ecx
push dword [ebp + 8]
call edi
jmp 0x1000e27c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10003b00
call fcn.1000dfad
pop ecx
pop ecx
push dword [ebp - 8]
call edi
jmp 0x1000e296
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10003ad4
call fcn.1000dfad
pop ecx
pop ecx
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push ebx
call esi
test eax, eax
je 0x1000e2c6
push eax
push ebx
push 0x10003bc0
call fcn.1000e09d
add esp, 0xc
jmp 0x1000e2c6
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x1000e2d5
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1000e1b0
mov esi, eax
mov eax, dword [ebp + 0x18]
test esi, esi
je 0x1000e370
mov dword [ebp + 8], eax
call fcn.1000e170
test eax, eax
je 0x1000e304
or dword [ebp + 0x1c], 0x100
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0x1c]
push 0
push dword [ebp + 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000e35c
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0x14]
mov dword [ebp - 4], 4
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1000e351
push dword [ebp + 0x14]
push eax
push 0x10003c78
call fcn.1000e09d
add esp, 0xc
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1000e36d
push dword [ebp + 0x10]
push eax
push 0x10003c10
call fcn.1000e09d
add esp, 0xc
mov eax, dword [ebp + 8]
pop esi
leave
ret 0x18
Function at 0x1000e692
Capabilities:
Connect pipe
Create pipe
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
push esi
mov esi, ecx
lea eax, [esi + 0x10]
push eax
push 0x10003db0
call fcn.1000e09d
test byte [esi + 4], 1
pop ecx
pop ecx
mov byte [esi + 8], 1
mov dword [ebp - 4], 0x40000001
je 0x1000e6c9
mov dword [ebp - 4], 0x40000003
push dword [ebp - 4]
push 0x10003d80
call fcn.1000e09d
cmp byte [esi + 8], 0
pop ecx
pop ecx
je 0x1000e7f5
push ebx
push edi
mov ebx, 0x400
xor edi, edi
push edi
push 0x3e8
push ebx
push ebx
push 0xff
push 6
push dword [ebp - 4]
lea eax, [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov dword [esi + 0x21c], eax
cmp eax, 0xffffffff
je 0x1000e7da
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x1000e738
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0x217
neg eax
sbb eax, eax
inc eax
je 0x1000e7cc
push 0x21c
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
cmp eax, edi
je 0x1000e750
mov ecx, eax
call fcn.1000ea05
mov edi, eax
test edi, edi
je 0x1000e7e9
push edi
push 0x10003d48
call fcn.1000e09d
test byte [esi + 4], 2
pop ecx
pop ecx
je 0x1000e78a
lea eax, [esi + 0x220]
push eax
lea eax, [edi + 4]
push 0x104
push eax
mov byte [edi + 0x219], 1
call fcn.10012e0b
add esp, 0xc
mov eax, dword [esi + 0x21c]
push 8
mov dword [edi], eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
lea ecx, [ebp - 8]
push ecx
xor ecx, ecx
push ecx
push eax
push 0x1000e504
push ecx
push ecx
mov dword [eax], esi
mov dword [eax + 4], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x1000e7e9
push edi
lea ecx, [esi + 0x428]
call sym.KXPLM32.dll_public:_int___thiscall_TARRAY_class_NamedPipeHandler___1_::Add_class_NamedPipeHandler__
push dword [ebp - 0xc]
jmp 0x1000e7d2
push dword [esi + 0x21c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000e7e9
push 0x10003d20
call fcn.1000e09d
pop ecx
mov byte [esi + 8], 0
cmp byte [esi + 8], 0
jne 0x1000e6e9
pop edi
pop ebx
lea ecx, [esi + 0x428]
call sym.KXPLM32.dll_public:_bool___thiscall_TARRAY_class_NamedPipeHandler___1_::RemoveAll_void_
push 0x10003ce0
call fcn.1000e09d
pop ecx
xor eax, eax
pop esi
leave
ret
Function at 0x1000e815
Capabilities:
Check if file exists
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push dword [ebp + 8]
mov edi, ecx
push 0x10003e80
call fcn.1000e09d
or dword [ebp - 8], 0xffffffff
xor ebx, ebx
test byte [edi + 4], 1
pop ecx
mov esi, 0x40000000
pop ecx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], esi
je 0x1000e852
mov dword [ebp - 0xc], 0xc0000000
mov dword [ebp - 4], ebx
cmp dword [ebp - 4], 0x14
jge 0x1000e89a
push ebx
push esi
push 3
push ebx
push ebx
push dword [ebp - 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x1000e891
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x1000e889
mov dword [ebp - 4], 0x14
jmp 0x1000e891
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp - 4]
cmp dword [ebp - 8], 0xffffffff
je 0x1000e855
cmp dword [ebp - 8], 0xffffffff
je 0x1000e907
push 0x21c
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
cmp eax, ebx
je 0x1000e8ba
mov ecx, eax
call fcn.1000ea05
mov esi, eax
jmp 0x1000e8bc
xor esi, esi
cmp esi, ebx
je 0x1000e91a
mov eax, dword [ebp - 8]
mov dword [esi], eax
test byte [edi + 4], 1
je 0x1000e902
push 8
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
lea ecx, [ebp - 0x14]
push ecx
push ebx
push eax
push 0x1000e504
push ebx
push ebx
mov dword [eax], edi
mov dword [eax + 4], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
je 0x1000e8f6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
lea ecx, [edi + 0x428]
call sym.KXPLM32.dll_public:_int___thiscall_TARRAY_class_NamedPipeHandler___1_::Add_class_NamedPipeHandler__
mov dword [ebp - 0x10], esi
jmp 0x1000e91a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10003e00
call fcn.1000e09d
pop ecx
pop ecx
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x1000e941
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
mov esi, ecx
lea eax, [esi + 0x10]
push eax
call fcn.1000e3f1
mov eax, dword [ebp + 0xc]
pop ecx
pop ecx
mov dword [esi + 4], eax
lea eax, [ebp + 8]
push eax
xor eax, eax
push eax
push esi
push 0x1000e929
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0xc], eax
xor eax, eax
pop esi
pop ebp
ret 8
Function at 0x1000edfb
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
xor edi, edi
push edi
push edi
push edi
push edi
mov esi, ecx
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp dword [esi], 0xffffffff
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], eax
jne 0x1000ee33
push 0x10004030
call fcn.1000e09d
pop ecx
push dword [ebp + 0xc]
push esi
push dword [esi]
push 0x10003fb8
call fcn.1000e09d
mov ebx, dword [ebp + 0x10]
add esp, 0x10
push edi
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1000ee72
push dword [ebx]
push 0x10003f94
call fcn.1000dfad
mov dword [ebp - 4], 1
jmp 0x1000eeea
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push ebx
push 0x10003f78
call fcn.1000dfad
pop ecx
pop ecx
cmp ebx, 0x26
jne 0x1000ee93
mov dword [ebp - 4], 1
cmp ebx, 0x3e5
jne 0x1000eeec
push 0x10003f5c
call fcn.1000dfad
pop ecx
push 0xffffffffffffffff
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x10003f48
mov ebx, eax
call fcn.1000dfad
pop ecx
cmp ebx, edi
jne 0x1000eeec
push edi
push dword [ebp + 0x10]
lea eax, [ebp - 0x1c]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x1000eedd
mov dword [ebp - 4], 1
push dword [ebp - 4]
push 0x10003f2c
call fcn.1000dfad
pop ecx
pop ecx
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x1000ef04
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
mov esi, ecx
mov byte [ebp - 1], 1
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edi, eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0x10]
mov dword [ebp - 0x10], ebx
push dword [ebp + 0xc]
mov dword [ebp - 0xc], ebx
push dword [ebp + 8]
mov dword [ebp - 8], edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1000ef4b
mov byte [ebp - 1], 1
jmp 0x1000efc0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10004088
mov dword [ebp + 0xc], eax
call fcn.1000dfad
cmp dword [ebp + 0xc], 0x6d
pop ecx
pop ecx
jne 0x1000ef77
push esi
push 0x10004070
call fcn.1000dfad
pop ecx
pop ecx
mov byte [ebp - 1], bl
cmp dword [ebp + 0xc], 0x26
jne 0x1000ef81
mov byte [ebp - 1], 1
cmp dword [ebp + 0xc], 0x3e5
jne 0x1000efc0
push 0xffffffffffffffff
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1000efc0
push ebx
mov ebx, dword [ebp + 0x10]
push ebx
lea eax, [ebp - 0x18]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x1000efc0
push dword [ebx]
mov byte [ebp - 1], 1
push 0x1000405c
call fcn.1000dfad
pop ecx
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x4400c9
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46c6d0
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x44010c
push str.SystemFunction040
push dword [0x46c6d0]
call edi
push str.SystemFunction041
push dword [0x46c6d0]
mov dword [0x46c6c0], eax
call edi
mov dword [0x46c6c4], eax
jmp 0x440111
mov eax, dword [0x46c6c4]
cmp dword [0x46c6c0], 0
je 0x440122
test eax, eax
jne 0x4401c9
push 0x46c6d4
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x4401d3
push str.CryptProtectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c0], 0
mov dword [0x46c6c8], eax
jne 0x440187
test eax, eax
jne 0x440187
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x440171
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x440178
mov esi, 0x80004005
push esi
push 0x28
push str.c:_agent_work138_s_srclibsdutilcryputil.cpp
call fcn.004038f5
jmp 0x4401d3
push str.CryptUnprotectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c4], 0
mov dword [0x46c6cc], eax
jne 0x4401c9
test eax, eax
jne 0x4401c9
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4401bd
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4401c4
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x44017b
mov dword [0x46c6d8], 1
pop edi
mov eax, esi
pop esi
ret

Function at 0x448f6f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x448f7e
pop dword [ebp - 0x38]
mov eax, 0x448f7e
sub dword [ebp - 0x38], eax
push 0x40
push 0x1000
push 0x51ded
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x38]
call dword [eax]
mov ecx, 0x11a27c0
sub ecx, 0x119d8c9
mov ebx, eax
mov esi, 0xbc7d3133
add esi, 0x43cb5ccd
add esi, dword [ebp - 0x38]
mov edi, 0xb229b4b
xor dword [ebp - 0x10], 0xe588eaef
mov edx, dword [esi]
sub dword [ebp - 8], edi
xor edx, edi
xor dword [ebp - 4], eax
mov dword [ebx], edx
add dword [ebp - 8], 0xd287a32f
add ebx, 4
add esi, 0x3ebb271b
sub esi, 0x3ebb2717
loop 0x448fcd
add eax, 0x6cb96f05
add eax, 0x9347bfaa
xor ebx, ebx
add ebx, eax
add eax, 0x4a3a51bd
sub eax, 0x4a3a51b8
mov ecx, 0x400000
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0xefd1f8
Capabilities:
Encode data using xor

Disassembly:
jmp 0xefd202
pushal
call 0xefd208
pop ebp
sub ebp, 0x10
sub ebp, 0xafd1f8
jmp 0xefd21e
mov eax, 0xafd1f8
add eax, ebp
add eax, 0x4c
mov ecx, 0x5bf
mov edx, 0x1d9e8725
xor byte [eax], dl
inc eax
dec ecx
jne 0xefd235
jmp 0xefd248
scasb al, byte es:[edi]
call 0x26097efc
and eax, 0xdde4a425
and eax, 0xe8262525
popfd
and esp, dword [0xd9f2525]
and eax, 0xc7d22525
in eax, dx
scasb al, byte es:[edi]
movsb byte es:[edi], byte [esi]
sub dword [0xe0262525], esp
test al, 0x41
add ecx, ebx
lodsb al, byte [esi]
and dword [ecx], eax
jne 0xefd2c4
leave
pop es
and eax, 0xa8e32e4d
and eax, 0x4d010924
invalid
and edi, esp
sub dword [0x2101a9ae], esp
and eax, 0xc94d2525
pop es
and eax, 0xa8e32e4d
and eax, 0x74010924
int 0x20
and eax, 0x1acc2525
daa
and eax, 0xc9ae7025
ficom dword [eax + 0x29]
ficom dword [eax + 0x2d]
int 0x57
and eax, 0x98ae2525
sub eax, 0x16252525
in al, dx
movsb byte es:[edi], byte [esi]
xlatb
push ecx
mov edx, 0xd7a410e7
push ecx
mov edx, 0xf71610e7
cmpsb byte [esi], byte es:[edi]
int 0x20
insd dword es:[edi], dx
sub ah, byte [ecx + 0x2525256b]
sub ch, byte [ebp + 0x2525256d]
inc ebx
scasb al, byte es:[edi]
cmp dword [0xa12acdde], ebx
aas
and eax, 0xdea52525
int3

Function at 0x401960
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0x4d
mov eax, dword [ebp - 8]
push eax
call dword [0x40b1e8]
mov dword [0x40af50], 0x44
push 0x12
push 0x3b
call fcn.00401030
add esp, 8
mov dword [0x40ac30], 0x1003f
push 0x25
push 0x64
call fcn.00401090
add esp, 8
mov ecx, dword [ebp + 8]
push ecx
call fcn.004017e0
add esp, 4
push 0x6d
push 0x5a
call fcn.00401060
add esp, 8
mov dword [ebp - 4], 0
jmp 0x4019cd
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [0x40ac0c]
xor ecx, ecx
mov cx, word [eax + 6]
cmp dword [ebp - 4], ecx
jge 0x401a4e
push 0x4d
push 0x30
call dword [0x40af40]
mov edx, dword [0x40b1d8]
mov eax, dword [edx + 0x3c]
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x28
add ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0xf8]
mov dword [0x40ac08], edx
push 0x46
push 0x2c
push 0
call dword [0x40ac1c]
push 0
mov eax, dword [0x40ac08]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [0x40ac08]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x14]
push eax
mov ecx, dword [0x40ac0c]
mov edx, dword [ecx + 0x34]
mov eax, dword [0x40ac08]
add edx, dword [eax + 0xc]
push edx
mov ecx, dword [0x40abf8]
push ecx
call dword [0x40afac]
jmp 0x4019c4
push 2
push 0x56
call dword [0x40af40]
call fcn.004018e0
push 0x54
push 0xf
push 0
call dword [0x40ac1c]
mov esp, ebp
pop ebp
ret
Function at 0x258071b7
Capabilities:
Print debug messages

Disassembly:
push 0x1c
mov eax, 0x2581bbcc
call fcn.2581aa61
mov eax, dword fs:[0x2c]
xor ebx, ebx
mov ecx, dword [0x2582448c]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x25823cb8]
cmp eax, dword [ecx + 4]
jg 0x25807284
cmp byte [0x25823cb4], 0
je 0x2580727e
lea eax, [ebp + 0xc]
push eax
push ebx
push dword [ebp + 8]
call fcn.25817901
push 1
lea esi, [eax + 6]
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov edi, eax
add esp, 0x14
test edi, edi
je 0x2580727e
lea eax, [ebp + 0xc]
push eax
push ebx
push dword [ebp + 8]
push esi
push edi
call fcn.25817901
add esp, 0x14
mov dword [ebp - 0x18], ebx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
push str._nEFS:TMS:
call fcn.2580cc41
push edi
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 1
call fcn.2580cbab
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, dword [ebp - 0x14]
pop ecx
cmp eax, 0x10
jb 0x2580727e
inc eax
push eax
push dword [ebp - 0x28]
call fcn.25817901
pop ecx
pop ecx
call fcn.2581aa50
ret
mov edi, 0x25823cb8
push edi
call fcn.25817901
cmp dword [0x25823cb8], 0xffffffff
pop ecx
jne 0x258071e5
mov eax, dword [0x25823de8]
mov dword [ebp - 4], ebx
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x2581d220]
call esi
test al, al
je 0x258072e2
mov eax, dword [0x258240c4]
push ebx
push str.enableTMSLogging
push 0x2581db70
mov esi, dword [eax + 0x5a8]
mov ecx, esi
call dword [0x2581d220]
call esi
add esp, 0xc
test ax, ax
mov al, 1
jne 0x258072e6
jmp 0x258072e2
mov al, bl
jmp 0x258072e6
or dword [ebp - 4], 0xffffffff
push edi
mov byte [0x25823cb4], al
call fcn.25817901
pop ecx
jmp 0x258071e5