joyce8/EMBER2024-capa huggingface dataset:
Function at 0x454d5a
Capabilities:
Encode data using base64

Disassembly:
mov eax, 0x49e86b
call fcn.00487e80
sub esp, 0x20
mov al, byte [ebp + 0xf]
push ebx
push esi
xor esi, esi
push edi
push esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1c], esi
mov byte [ebp - 0x2c], al
call fcn.004226ca
mov eax, dword [ebp + 0x10]
push 1
mov ecx, eax
pop edi
dec eax
mov dword [ebp - 4], edi
test ecx, ecx
je 0x454ecb
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
inc esi
inc dword [ebp + 0xc]
cmp esi, 3
mov al, byte [eax]
mov byte [ebp + esi + 0xf], al
mov bl, byte [ebp + 0x11]
jne 0x454e13
mov al, byte [ebp + 0x10]
mov cl, bl
shr al, 2
mov byte [ebp - 0x10], al
mov al, byte [ebp + 0x10]
and al, 3
shl al, 4
shr cl, 4
add al, cl
mov cl, byte [ebp + 0x12]
mov byte [ebp - 0xf], al
mov al, bl
and al, 0xf
shl al, 2
shr cl, 6
add al, cl
mov byte [ebp - 0xe], al
mov al, byte [ebp + 0x12]
and al, 0x3f
xor esi, esi
mov byte [ebp - 0xd], al
mov ecx, dword [0x4ccc84]
test ecx, ecx
jne 0x454df3
mov eax, 0x4a3cb4
jmp 0x454dfa
movzx eax, byte [ebp + esi - 0x10]
add eax, ecx
mov al, byte [eax]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 0x18], al
push dword [ebp - 0x18]
push edi
call fcn.004543c5
inc esi
cmp esi, 4
jl 0x454de2
xor esi, esi
dec dword [ebp - 0x14]
jne 0x454d96
test esi, esi
je 0x454ecb
cmp esi, 3
jge 0x454e45
push 3
lea edi, [ebp + esi + 0x10]
pop ecx
xor eax, eax
sub ecx, esi
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov bl, byte [ebp + 0x11]
mov al, byte [ebp + 0x10]
xor edi, edi
mov cl, al
and al, 3
shr cl, 2
mov byte [ebp - 0x10], cl
mov cl, bl
shl al, 4
shr cl, 4
add al, cl
and bl, 0xf
mov byte [ebp - 0xf], al
mov al, byte [ebp + 0x12]
mov cl, al
and al, 0x3f
shl bl, 2
shr cl, 6
add bl, cl
mov byte [ebp - 0xd], al
mov byte [ebp - 0xe], bl
lea ebx, [esi + 1]
test ebx, ebx
jle 0x454eaf
mov ecx, dword [0x4ccc84]
test ecx, ecx
jne 0x454e91
mov eax, 0x4a3cb4
jmp 0x454e98
movzx eax, byte [ebp + edi - 0x10]
add eax, ecx
mov al, byte [eax]
lea ecx, [ebp - 0x2c]
mov byte [ebp + 0xc], al
push dword [ebp + 0xc]
push 1
call fcn.004543c5
inc edi
cmp edi, ebx
jl 0x454e80
cmp esi, 3
jge 0x454ec8
push 4
pop esi
sub esi, ebx
push 0x3d
push 1
lea ecx, [ebp - 0x2c]
call fcn.004543c5
dec esi
jne 0x454eb9
push 1
pop edi
mov esi, dword [ebp + 8]
mov al, byte [ebp - 0x2c]
push 0
mov ecx, esi
mov byte [esi], al
call fcn.004226ca
push dword [0x4a40b0]
lea eax, [ebp - 0x2c]
mov ecx, esi
push 0
push eax
call fcn.0045441e
mov dword [ebp - 0x1c], edi
and byte [ebp - 4], 0
push edi
lea ecx, [ebp - 0x2c]
call fcn.004226ca
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x45d595
Capabilities:
Terminate process

Disassembly:
mov eax, 0x49f19c
call fcn.00487e80
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0045d696
mov esi, eax
push esi
call fcn.0045c98b
pop ecx
call fcn.0045d47c
call fcn.0046eaa5
mov ecx, eax
call fcn.0046ef40
push eax
lea ecx, [ebp - 0x20]
call fcn.00401973
xor ebx, ebx
mov edi, 0x9c72
mov dword [ebp - 4], ebx
push ebx
push edi
push dword [ebp + 8]
call dword [0x4a36fc]
inc edi
cmp eax, ebx
jne 0x45d5d7
mov edi, dword [esi + 8]
mov esi, dword [esi + 4]
cmp esi, edi
mov byte [ebp - 0xd], 1
mov dword [ebp - 0x18], ebx
je 0x45d65d
push dword [esi]
lea eax, [ebp - 0x14]
push eax
call fcn.00415bb1
pop ecx
pop ecx
mov eax, dword [ebp - 0x20]
mov byte [ebp - 4], 1
cmp dword [eax - 8], ebx
jne 0x45d616
mov byte [ebp - 0x1c], bl
jmp 0x45d62f
push dword [ebp - 0x14]
push eax
call fcn.00488395
neg eax
sbb al, al
pop ecx
inc al
pop ecx
mov byte [ebp - 0x1c], al
je 0x45d62f
mov byte [ebp - 0xd], bl
push dword [ebp - 0x1c]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp + 8]
call fcn.0045d234
add esp, 0x10
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call fcn.00401600
add esi, 4
inc dword [ebp - 0x18]
cmp esi, edi
jne 0x45d5f8
cmp byte [ebp - 0xd], bl
je 0x45d67b
push dword [ebp + 8]
mov esi, 0x9c4b
push esi
push 1
call fcn.004683c0
add esp, 0xc
push ebx
push esi
push dword [ebp + 8]
call dword [0x4a351c]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00401600
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x47c196
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x47c1a4
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
cmp dword [ebp + 0x10], 8
push esi
push edi
not eax
mov ecx, 0xff
jb 0x47c285
mov edi, dword [ebp + 0x10]
push ebx
shr edi, 3
movzx ebx, byte [edx]
mov esi, eax
sub dword [ebp + 0x10], 8
and esi, ecx
xor esi, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [esi*4 + 0x4a5c74]
xor eax, ebx
inc edx
mov esi, eax
movzx ebx, byte [edx]
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x4a5c74]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x4a5c74]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x4a5c74]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x4a5c74]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x4a5c74]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x4a5c74]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
shr eax, 8
mov esi, dword [esi*4 + 0x4a5c74]
xor eax, esi
inc edx
dec edi
jne 0x47c1c1
pop ebx
cmp dword [ebp + 0x10], 0
je 0x47c2a6
movzx edi, byte [edx]
mov esi, eax
and esi, ecx
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4a5c74]
xor eax, esi
inc edx
dec dword [ebp + 0x10]
jne 0x47c28b
pop edi
pop esi
not eax
pop ebp
ret

Function at 0x47c2ac
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 4]
push esi
push edi
mov edx, 0xff
mov esi, dword [ecx]
movzx edi, byte [esp + 0x10]
mov eax, esi
and eax, edx
xor eax, edi
shr esi, 8
mov eax, dword [eax*4 + 0x4a5c74]
xor eax, esi
mov esi, dword [ecx + 8]
mov dword [ecx], eax
and eax, edx
add eax, dword [ecx + 4]
mov edi, esi
and edi, edx
imul eax, eax, 0x8088405
inc eax
mov dword [ecx + 4], eax
shr eax, 0x18
xor eax, edi
pop edi
shr esi, 8
mov eax, dword [eax*4 + 0x4a5c74]
xor eax, esi
pop esi
mov dword [ecx + 8], eax
ret
Function at 0x47fcd8
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, 0x4a2531
call fcn.00487e80
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x40]
mov dword [ebp - 4], 0xf
call fcn.00401600
lea ecx, [esi + 0x3c]
mov byte [ebp - 4], 0xe
call fcn.00401600
lea ecx, [esi + 0x38]
mov byte [ebp - 4], 0xd
call fcn.00401600
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 0xc
call fcn.00401600
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 0xb
call fcn.00401600
lea ecx, [esi + 0x2c]
mov byte [ebp - 4], 0xa
call fcn.00401600
lea ecx, [esi + 0x28]
mov byte [ebp - 4], 9
call fcn.00401600
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 8
call fcn.00401600
lea ecx, [esi + 0x20]
mov byte [ebp - 4], 7
call fcn.00401600
lea ecx, [esi + 0x1c]
mov byte [ebp - 4], 6
call fcn.00401600
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 5
call fcn.00401600
lea ecx, [esi + 0x14]
mov byte [ebp - 4], 4
call fcn.00401600
lea ecx, [esi + 0x10]
mov byte [ebp - 4], 3
call fcn.00401600
lea ecx, [esi + 0xc]
mov byte [ebp - 4], 2
call fcn.00401600
lea ecx, [esi + 8]
mov byte [ebp - 4], 1
call fcn.00401600
and byte [ebp - 4], 0
lea ecx, [esi + 4]
call fcn.00401600
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.00401600
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x4806ac
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
push dword [ebp + 8]
call fcn.0048069b
mov edi, eax
pop ecx
test edi, edi
je 0x4806e5
and byte [ebp - 1], 0
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 1]
push eax
push edi
mov ecx, esi
call fcn.004806f6
mov esi, dword [esi + 4]
push edi
push esi
push dword [ebp + 8]
call fcn.0048062f
add esp, 0xc
pop esi
pop edi
leave
ret
Function at 0x48462b
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 4]
push esi
push edi
mov edx, 0xff
mov esi, dword [ecx]
movzx edi, byte [esp + 0x10]
mov eax, esi
and eax, edx
xor eax, edi
shr esi, 8
mov eax, dword [eax*4 + 0x4a6260]
xor eax, esi
mov esi, dword [ecx + 8]
mov dword [ecx], eax
and eax, edx
add eax, dword [ecx + 4]
mov edi, esi
and edi, edx
imul eax, eax, 0x8088405
inc eax
mov dword [ecx + 4], eax
shr eax, 0x18
xor eax, edi
pop edi
shr esi, 8
mov eax, dword [eax*4 + 0x4a6260]
xor eax, esi
pop esi
mov dword [ecx + 8], eax
ret
Function at 0xf6ea38
Capabilities:
Encode data using xor

Disassembly:
jmp 0xf6ea42
pushal
call 0xf6ea48
pop ebp
sub ebp, 0x10
sub ebp, 0xb6ea38
jmp 0xf6ea5e
mov eax, 0xb6ea38
add eax, ebp
add eax, 0x4c
mov ecx, 0x5ce
mov edx, 0x7f0f848c
xor byte [eax], dl
inc eax
dec ecx
jne 0xf6ea75
jmp 0xf6ea88
pop es
inc ecx
pop es
add eax, 0x8c8c8cb0
or eax, 0x8c8c744d
mov word [edi - 0x7376cbbf], cs
mov word [esi + esi - 0x7373735c], cs
jnp 0xf6eb12
pop dword [edi + eax + 0xd]
or byte [esp + ecx*4 - 0x23b67074], 1
call 0x88fc5b5d
test al, 0xe4
mov eax, 0xe48ca8d0
mov byte [edx], al
push ds
mov word [ebp - 0x21b5760], cs
sub al, 0xc2
out 0x64, eax
mov dword [esp + ecx*4 - 0x73439a74], ecx
mov word [ecx + eax + 0x570a8e8], cs
mov al, byte [0xa8e001a8]
mov word [edi], es
or dword [esp + ecx*4 + 0x19078c8c], eax
or byte [esp + ecx*4 - 0x63fef874], 0x8c
mov word [ebp + ecx*2 - 0x7142719b], cs
cmovle ecx, dword [eax + 0x780983c5]
jae 0xf6eb70
jae 0xf6ead0
dec esi
or byte [edi + eax - 0x73775800], 0x8c
mov esp, fs
mov eax, 0xe48ca8d0
mov byte [edx], al
push ds
mov word [ebp - 0x17fe5760], cs
test al, 0x70
add eax, 0x8964a880
mov word [esp + ecx*4 - 0x73714a9b], cs
mov word [ecx], es
call 0xa0fc5bd5
test al, 7
pushal
mov ch, 0x8e
mov word [ecx + eax + 0x570a8e8], cs
mov al, byte [0x736007a8]
add eax, 0x6007a8a0
jae 0xf6eb2b
stc
xor byte [ebx - 7], 0x84
ljmp 0x8431
test eax, 0x8c990883
mov word [ebp + ecx*8 + 0x73734065], cs
jae 0xf6eb22
or dword [eax], 0xffffff99
mov word [esp + ecx*4 + 0x734065cd], cs
jae 0xf6ebef
movsd dword es:[edi], dword [esi]
sal byte [ebp - 0x76b2f073], 0xf
mov byte fs:[ebp + 0x31], ah
jae 0xf6ebfd
jae 0xf6eb31
fdiv dword [ebp - 0x75b2f072]
pcmpgtd mm1, qword [eax + 0x6589640f]
daa
jae 0xf6ec0f
jae 0xf6eb6f
dec esi
or byte [ecx + ebx*8 - 0x24259ff9], 0xd9
pop es
stc
add byte [edi], 0xf1
test byte [eax + 0x3e], dh
or al, 6
mov cl, byte [0x8c8c8d4a]
mov word [ebx + ecx*4], es
or eax, 0x8c8c8d4b
invalid
or dword [ecx], 0xffffff89
mov word [esp + ecx*4 - 0x613565fa], cs
pop esi
or dword [edi], 0xffffffa6
lea ecx, [esp + ecx*4 + 0x9835e8e]
mov dword [esp + ecx*4 - 0x3565f974], ecx
sahf
pop esi
lahf
dec esp
mov ds, word [esi - 0x7d]
or dword [ecx + 0x68c8c8c], ecx
lcall 0x8e4c, 0x9f5e9eca
pop esi
or dword [ecx], 0xffffff89
mov word [esp + ecx*4 - 0x613565fa], cs
pop esi
lahf
dec esp
mov ds, word [esi - 0x7d]
or dword [ecx + 0x68c8c8c], ecx
lcall 0x834c, 0x9f5e9eca
or byte [edx + 0x78c8c8c], cl
push ebx
cmpsd dword [esi], dword es:[edi]
push esp
push es
pop dword [ebx + ecx*4]
retf
Function at 0x80010f76
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0x6c
push 0x80010370
call fcn.80011d8c
mov ebx, dword [ebp + 8]
mov edi, dword [ebx]
cmp dword [ebx + 4], 0
je 0x80010fca
push 1
push dword [edi + 8]
call fcn.80011d10
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x80011005
cmp dword [esi + 0x20], 0
jne 0x80011005
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 4]
add eax, ecx
mov edx, dword [edi + 0xc]
mov dword [ebx + 8], edx
mov dword [ebx + 0xc], eax
cmp edx, eax
ja 0x80011005
cmp edx, ecx
jb 0x80011005
mov eax, dword [edi + 0x10]
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x28], esi
jmp 0x80010fd1
and dword [ebx + 0x28], 0
mov esi, dword [ebp - 0x1c]
mov eax, dword [edi + 4]
test eax, eax
je 0x8001102f
push 0
push eax
call fcn.80011d10
test eax, eax
je 0x80011005
mov esi, dword [eax + 4]
mov dword [ebp - 0x20], esi
mov dword [ebx + 0x1c], esi
cmp dword [esi + 0x14], 0
je 0x80011005
mov eax, dword [ebx + 0x20]
test eax, eax
jne 0x8001100f
mov eax, dword [ebx + 8]
cmp dword [eax], 0x10012
je 0x80011017
xor eax, eax
call fcn.80011dc5
ret 4
mov ecx, dword [esi + 0x1c]
cmp ecx, dword [eax + 0x30]
jne 0x80010ffa
mov eax, dword [ebx + 0x34]
test eax, eax
je 0x80011024
push eax
call fcn.80011cb0
mov eax, dword [esi + 0x48]
or dword [ebx + 0x48], eax
mov esi, dword [ebp - 0x1c]
jmp 0x80011033
and dword [ebx + 0x1c], 0
mov eax, dword [ebx + 0x20]
test eax, eax
je 0x80011042
mov eax, dword [eax + 0x3c]
mov dword [ebx + 0x24], eax
jmp 0x8001105d
mov eax, dword [ebx + 0x1c]
test eax, eax
je 0x8001104e
mov eax, dword [eax + 0x4c]
jmp 0x8001103d
push dword [ebx + 0x30]
call fcn.80010994
mov dword [ebx + 0x24], eax
test eax, eax
je 0x80011005
mov eax, dword [edi]
test al, 0x20
je 0x800110af
mov edx, dword [ebx + 0x1c]
test edx, edx
je 0x80011005
cmp dword [ebx + 0x28], 0
je 0x80011005
mov eax, dword [ebx + 0x20]
call fcn.80010632
mov eax, dword [ebx + 0x24]
mov ecx, dword [eax + 0x58]
test ecx, ecx
jne 0x8001109d
mov eax, dword [eax + 0x80]
test eax, eax
je 0x80011095
push dword [ebx + 0x1c]
lea ecx, [ebx + 0x2c]
push ecx
call eax
mov eax, dword [ebx + 8]
jmp 0x80011007
push dword [ebx + 0xc]
push dword [ebx + 8]
add esi, 4
push esi
push dword [ebx + 0x1c]
jmp 0x8001187f
test al, 1
je 0x80011131
mov eax, dword [ebx + 8]
mov dword [ebp - 0x24], eax
mov esi, dword [eax + 0x14]
mov ecx, dword [ebx + 0xc]
sub ecx, eax
cmp ecx, 0x18
jb 0x80011005
cmp dword [ebx + 0x14], 0x68
jb 0x80011005
cmp dword [ebx + 0x10], 0
je 0x80011005
and dword [ebp - 4], 0
push 4
push 0x68
push esi
call fcn.80011d86
push 0x1a
pop ecx
mov edi, dword [ebx + 0x10]
rep movsd dword es:[edi], dword [esi]
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebx + 0x10]
and dword [ecx], 0
mov eax, dword [ebp - 0x24]
push dword [eax + 0x10]
push dword [eax]
push dword [eax + 4]
push dword [eax + 0xc]
push dword [eax + 8]
push dword [ebx + 0x24]
push ecx
add ebx, 0x2c
push ebx
call fcn.80010e58
jmp 0x80011007
mov esi, dword [ebx + 8]
mov dword [ebp - 0x24], esi
mov eax, dword [esi]
add eax, 0xfffeffff
cmp eax, 0x24
ja 0x80011005
jmp dword [eax*4 - 0x7ffee4b2]
add ebx, 0x2c
push ebx
call ecx
jmp 0x80011007
Function at 0x41181a
Capabilities:
Create thread

Disassembly:
push ecx
push ebp
push esi
mov esi, ecx
xor ebp, ebp
cmp dword [esi], ebp
jbe 0x411895
push ebx
push edi
lea edi, [esi + 4]
lea eax, [esp + 0x10]
push eax
push 0
push esi
push 0x4117a3
push 0x10000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
test ebx, ebx
jne 0x411871
push str.CreateThread_failed
push 0x43474c
call fcn.00406447
pop ecx
pop ecx
mov ecx, 0x43474c
call fcn.00401000
push 2
mov ecx, 0x43474c
call fcn.004063ed
mov dword [edi], ebx
inc dword [esi + 0x84]
mov eax, dword [0x45072c]
test eax, eax
je 0x41188b
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
inc ebp
add edi, 4
cmp ebp, dword [esi]
jb 0x41182a
pop edi
pop ebx
pop esi
pop ebp
pop ecx
ret

Function at 0x415bb8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov esp, 0x44fffffc
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.00415343
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004152f8
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.00415343
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004152f8
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
invalid
test dword [edi], ebx
cld
invalid
invalid
Function at 0x1131e
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x14098]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x204]
push eax
xor esi, esi
call fcn.00011006
cmp word [ebp - 0x204], si
jne 0x11352
xor eax, eax
jmp 0x11419
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x238]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push esi
push esi
push 0x820
push 3
push 3
push 0x80
lea eax, [ebp - 0x238]
mov dword [ebp - 0x228], eax
push esi
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x230]
push eax
push 0x120116
lea eax, [ebp - 0x208]
push eax
mov dword [ebp - 0x230], 0x18
mov dword [ebp - 0x22c], esi
mov dword [ebp - 0x224], 0x40
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x21c], esi
call dword [sym.imp.ntoskrnl.exe_ZwCreateFile]
test eax, eax
jl 0x11417
mov eax, dword [ebp + 8]
push esi
push esi
push 8
mov dword [ebp - 0x214], eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x210]
push eax
push esi
push esi
push esi
push dword [ebp - 0x208]
mov dword [ebp - 0x218], 0x58
call dword [sym.imp.ntoskrnl.exe_ZwWriteFile]
test eax, eax
jl 0x1140b
mov esi, dword [ebp - 0x20c]
push dword [ebp - 0x208]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00012164
leave
ret 4

Function at 0x119a6
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [ecx + 0x3c]
add eax, ecx
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
cmp edx, dword [ecx + 0xc]
jae 0x119bb
mov eax, edx
ret
push ebx
push esi
movzx esi, word [eax + 6]
push edi
xor edi, edi
test esi, esi
jbe 0x119e0
mov eax, dword [ecx + 0xc]
cmp edx, eax
jb 0x119d8
mov ebx, dword [ecx + 8]
add ebx, eax
cmp edx, ebx
jb 0x119e7
add ecx, 0x28
inc edi
cmp edi, esi
jb 0x119c8
or eax, 0xffffffff
pop edi
pop esi
pop ebx
ret
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
add eax, edx
jmp 0x119e3

Function at 0x1208a
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
xor esi, esi
push esi
push esi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntoskrnl.exe_PsGetVersion]
cmp dword [ebp - 8], 5
jne 0x120de
cmp dword [ebp - 4], 2
jne 0x120bf
mov dword [0x14428], 0x77
jmp 0x12147
cmp dword [ebp - 4], 1
jne 0x120d1
mov dword [0x14428], 0x71
jmp 0x12147
cmp dword [ebp - 4], esi
jne 0x1213f
mov dword [0x14428], esi
jmp 0x1215a
cmp dword [ebp - 8], 6
jne 0x1212a
mov eax, dword [ebp - 4]
cmp eax, esi
jne 0x120f7
mov dword [0x14428], 0xb7
jmp 0x12147
cmp eax, 1
jne 0x12108
mov dword [0x14428], 0xaf
jmp 0x12147
cmp eax, 2
jne 0x12119
mov dword [0x14428], 0xec
jmp 0x12147
cmp eax, 3
jne 0x1213f
mov dword [0x14428], 0xef
jmp 0x12147
cmp dword [ebp - 8], 0xa
jne 0x1213f
cmp dword [ebp - 4], esi
jne 0x1213f
mov dword [0x14428], 0xf2
cmp dword [0x14428], esi
je 0x1215a
push 0x14424
push dword [0x14428]
push dword [ebp + 8]
call fcn.00011a5a
pop esi
leave
ret 8
Function at 0x15006
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [0x143ac]
xor edx, edx
mov dword [ebp - 4], edx
cmp ecx, edx
je 0x15096
mov eax, dword [sym.imp.ntoskrnl.exe_PsProcessType]
mov eax, dword [eax]
add eax, dword [0x143b0]
add eax, ecx
mov dword [0x143b8], eax
mov ecx, dword [eax]
cmp dword [0x143b4], edx
je 0x15049
mov dword [0x143c0], ecx
mov dword [eax], 0x117bc
jmp 0x15055
mov dword [0x143bc], ecx
mov dword [eax], 0x11770
push edx
push 0x1183c
lea eax, [ebp - 0xc]
push eax
push edx
push edx
push edx
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
test eax, eax
jl 0x15096
push 0x143c4
push dword [ebp - 8]
call sub.ntoskrnl.exe_PsLookupThreadByThreadId
test eax, eax
jl 0x1508d
mov ecx, dword [0x143c4]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
leave
ret

Function at 0x15156
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x14098]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x11c
lea eax, [ebp - 0x120]
push 0
push eax
call sub.ntoskrnl.exe_memset
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.ntoskrnl.exe_RtlGetVersion]
mov eax, dword [ebp - 0x118]
xor ecx, ecx
inc ecx
cmp dword [ebp - 0x11c], 5
jne 0x151f0
cmp eax, 2
jne 0x151c5
mov dword [0x143ac], 0x60
mov dword [0x143b0], 0x40
jmp 0x1522c
cmp eax, ecx
jne 0x151ec
cmp word [ebp - 0xc], 2
mov dword [0x143ac], 0x60
mov dword [0x143b0], 0x40
ja 0x1522c
mov dword [0x143b4], ecx
jmp 0x1522c
test eax, eax
je 0x1522c
cmp dword [ebp - 0x11c], 6
jne 0x1520b
test eax, eax
je 0x15218
cmp eax, ecx
je 0x15218
cmp eax, 2
je 0x15218
cmp eax, 3
jmp 0x15216
cmp dword [ebp - 0x11c], 0xa
jne 0x1522c
test eax, eax
jne 0x1522c
mov dword [0x143ac], 0x28
mov dword [0x143b0], 0x44
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00012164
leave
ret