joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45b030
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x47fc8c]
cmp dword [eax + 0x30], 0
je 0x45b0da
cmp dword [ebx + 0x94], 0
jne 0x45b0d4
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45afc0
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45b0d4
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45b09a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45b0d4
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041bcd0
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45b0a9
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45bbb8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x45bbed
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004045c0
jmp 0x45bbfa
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404524
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45ccc0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45cd01
mov eax, esi
call fcn.0044309c
test al, al
je 0x45cd01
mov eax, dword [ebx + 0x84]
call fcn.00442d98
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45cd01
push 0
mov eax, dword [ebx + 0x84]
call fcn.00442d98
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x462b40
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x462b6e
mov eax, ebx
call fcn.004635f8
cmp dword [ebx + 0x3c], 0
je 0x462b67
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x462bdf
mov edx, dword [ebx + 0x1ac]
cmp dword [edx + 0x10], 0
je 0x462bd1
cmp dword [ebx + 8], 0
je 0x462b90
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1ac]
call dword [edx]
test eax, eax
jne 0x462ba2
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x462bd1
cmp dword [ebx + 8], 0
je 0x462b83
cmp eax, 3
je 0x462bb5
dec eax
jne 0x462b83
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x462b83
mov edx, dword [ebx + 0x138]
add dword [eax + 8], edx
jmp 0x462b83
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x462bfd
cmp dword [ebx + 0x10], 0xcc
je 0x462bfd
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00462c08
pop ebx
ret
Function at 0x472d78
Capabilities:
Encrypt data using des

Disassembly:
push ebx
mov ecx, edx
and cl, 0x20
mov ebx, edx
and bl, 0x1e
and ebx, 0xff
shr ebx, 1
or cl, bl
and dl, 1
shl edx, 4
or cl, dl
mov edx, ecx
and edx, 0xff
and eax, 0xff
shl eax, 3
lea eax, [eax*8 + 0x47d8b0]
mov al, byte [eax + edx]
and al, 0xf
pop ebx
ret

Function at 0x472db4
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
test ebx, ebx
js 0x472dcc
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x472dc5
mov eax, esp
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, 7
call fcn.00402fcc
xor edx, edx
mov eax, 0x47dab0
mov bl, byte [eax]
mov ecx, ebx
and cl, 7
and ecx, 0xff
push ecx
mov ecx, 7
pop esi
sub ecx, esi
mov esi, 1
shl esi, cl
xor ecx, ecx
mov cl, bl
shr ecx, 3
mov ebx, dword [ebp - 4]
movzx ecx, byte [ebx + ecx]
and esi, ecx
je 0x472e36
mov ecx, edx
and ecx, 7
push ecx
mov ecx, 7
pop ebx
sub ecx, ebx
mov bl, 1
shl bl, cl
mov ecx, edx
shr ecx, 3
mov esi, dword [ebp - 8]
or byte [esi + ecx], bl
inc edx
inc eax
cmp edx, 0x38
jne 0x472dea
mov esi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x473074
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov ebx, dword [ebp + 0x10]
test ebx, ebx
js 0x47308d
shr ebx, 2
mov esi, dword [ecx + ebx*4]
dec ebx
push esi
jns 0x473086
mov ecx, esp
mov ebx, edx
test ebx, ebx
js 0x47309f
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x473098
mov eax, esp
mov dword [ebp - 4], ecx
push 5
lea ecx, [ebp - 0xa]
call fcn.00472c68
mov ebx, 6
mov eax, dword [ebp - 4]
lea edx, [ebp - 0xa]
mov cl, byte [eax]
xor byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x4730b9
mov al, byte [ebp - 0xa]
xor edx, edx
mov dl, al
shr edx, 2
mov byte [ebp - 0x12], dl
and al, 3
shl eax, 4
mov dl, byte [ebp - 9]
xor ecx, ecx
mov cl, dl
shr ecx, 4
or al, cl
mov byte [ebp - 0x11], al
and dl, 0xf
shl edx, 2
mov al, byte [ebp - 8]
xor ecx, ecx
mov cl, al
shr ecx, 6
or dl, cl
mov byte [ebp - 0x10], dl
and al, 0x3f
mov byte [ebp - 0xf], al
mov al, byte [ebp - 7]
xor edx, edx
mov dl, al
shr edx, 2
mov byte [ebp - 0xe], dl
and al, 3
shl eax, 4
xor edx, edx
mov dl, byte [ebp - 6]
shr edx, 4
or al, dl
mov byte [ebp - 0xd], al
mov al, byte [ebp - 6]
and al, 0xf
shl eax, 2
xor edx, edx
mov dl, byte [ebp - 5]
shr edx, 6
or al, dl
mov byte [ebp - 0xc], al
mov al, byte [ebp - 5]
and al, 0x3f
mov byte [ebp - 0xb], al
xor ebx, ebx
lea esi, [ebp - 0x12]
mov eax, ebx
mov dl, byte [esi]
call fcn.00472d78
mov byte [esi], al
inc ebx
inc esi
cmp ebx, 8
jne 0x47313e
mov ebx, 4
lea eax, [ebp - 0x12]
lea edx, [ebp - 0xa]
mov cl, byte [eax]
shl ecx, 4
or cl, byte [eax + 1]
mov byte [edx], cl
inc edx
add eax, 2
dec ebx
jne 0x47315b
lea eax, [ebp - 0xa]
mov edx, 5
call fcn.00472cf8
mov ebx, 4
lea eax, [ebp - 0xa]
mov edx, dword [ebp + 0xc]
mov cl, byte [eax]
mov byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x473184
mov esi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x47319c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov ebx, ecx
test ebx, ebx
js 0x4731b5
shr ebx, 2
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x4731ae
mov edx, esp
mov dword [ebp - 4], edx
mov ebx, eax
mov dword [ebp - 8], 8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov dl, byte [eax]
mov byte [ecx], dl
inc ecx
inc eax
dec dword [ebp - 8]
jne 0x4731c9
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.00472b60
test bl, bl
jne 0x47329c
mov dword [ebp - 8], 0x10
mov dword [ebp - 0x14], 0x47fd78
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
mov cl, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x473200
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
mov cl, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x473214
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.00473074
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov bl, byte [edx]
xor bl, byte [esi]
mov byte [ecx], bl
inc ecx
inc esi
inc edx
dec eax
jne 0x473246
add dword [ebp - 0x14], 6
dec dword [ebp - 8]
jne 0x4731f5
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ecx, [ebp - 0xc]
mov bl, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x473269
mov eax, 4
mov edx, dword [ebp + 0xc]
mov cl, byte [edx]
mov byte [edx + 4], cl
inc edx
dec eax
jne 0x47327a
mov eax, 4
lea edx, [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
mov bl, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x47328e
jmp 0x473357
cmp bl, 1
jne 0x473357
mov dword [ebp - 8], 0xfffffff0
mov ebx, 0x47fdd2
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
mov cl, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x4732bc
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
mov cl, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x4732d0
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov ecx, ebx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.00473074
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov dword [ebp - 0x18], ecx
mov cl, byte [edx]
xor cl, byte [esi]
mov edi, dword [ebp - 0x18]
mov byte [edi], cl
inc dword [ebp - 0x18]
inc esi
inc edx
dec eax
jne 0x473302
sub ebx, 6
inc dword [ebp - 8]
jne 0x4732b1
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ebx, [ebp - 0xc]
mov cl, byte [edx]
mov byte [ebx], cl
inc ebx
inc edx
dec eax
jne 0x473329
mov eax, 4
mov ebx, dword [ebp + 0xc]
mov dl, byte [ebx]
mov byte [ebx + 4], dl
inc ebx
dec eax
jne 0x47333a
mov eax, 4
lea ebx, [ebp - 0xc]
mov edx, dword [ebp + 0xc]
mov cl, byte [ebx]
mov byte [edx], cl
inc edx
inc ebx
dec eax
jne 0x47334e
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.00472be4
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret 8
Function at 0x4745d8
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_GetPriorityClass
mov ebx, eax
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.kernel32.dll_GetThreadPriority
mov esi, eax
push pe_nt_image_headers32
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_SetPriorityClass
push 0xf
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.kernel32.dll_SetThreadPriority
push 0xa
call sub.kernel32.dll_Sleep_1
rdtsc
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
push 0x1f4
call sub.kernel32.dll_Sleep_1
rdtsc
sub eax, dword [ebp - 4]
sbb edx, dword [ebp - 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
push esi
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.kernel32.dll_SetThreadPriority
push ebx
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_SetPriorityClass
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x14], eax
fild qword [ebp - 0x18]
fdiv dword [0x474678]
fstp qword [ebp - 0x10]
wait
fld qword [ebp - 0x10]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x478f50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec4
xor edx, edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404970
xor eax, eax
push ebp
push 0x47908e
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 0xf
call fcn.0045fc04
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x479066
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0xc], 0
jae 0x478fa7
call fcn.00403f38
jmp 0x47906d
mov dword [ebp - 0x138], 0x128
lea edx, [ebp - 0x138]
mov eax, dword [ebp - 0xc]
call fcn.0045fc24
test eax, eax
je 0x47904f
lea eax, [ebp - 0x13c]
lea edx, [ebp - 0x114]
mov ecx, 0x104
call fcn.00404738
mov eax, dword [ebp - 0x13c]
mov edx, dword [ebp - 4]
call fcn.004086b8
test al, al
je 0x479039
mov eax, dword [ebp - 0x130]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x479032
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_TerminateProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x479039
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
lea edx, [ebp - 0x138]
mov eax, dword [ebp - 0xc]
call fcn.0045fc44
test eax, eax
jne 0x478fc7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47906d
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x479095
lea eax, [ebp - 0x13c]
call fcn.004044d0
lea eax, [ebp - 4]
call fcn.004044d0
ret
Function at 0x47955c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x47963f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004044d0
xor eax, eax
push ebp
push 0x47961a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.004046b0
lea eax, [ebp - 0x10]
mov edx, 0x479658
call fcn.00404790
mov eax, dword [ebp - 0x10]
call fcn.00404980
push eax
call sub.kernel32.dll_GetVolumeInformationA
mov eax, dword [ebp - 4]
call fcn.004073c4
movzx eax, ax
lea ecx, [ebp - 0x14]
mov edx, 4
call fcn.00408904
push dword [ebp - 0x14]
push 0x479664
lea ecx, [ebp - 0x18]
movzx eax, word [ebp - 4]
mov edx, 4
call fcn.00408904
push dword [ebp - 0x18]
mov eax, esi
mov edx, 3
call fcn.00404848
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x479624
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x479646
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.004044f4
ret

Function at 0x479668
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x479771
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.004044d0
call sub.kernel32.dll_GetLogicalDrives
mov esi, eax
mov eax, esi
and eax, 1
xor edx, edx
mov dword [ebp - 0x10], edx
xor edi, edi
dec eax
jne 0x479732
mov ebx, edi
add bl, 0x41
lea eax, [ebp - 0x14]
mov edx, ebx
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x18]
call fcn.00402eb0
mov edx, 0x479780
lea eax, [ebp - 0x18]
mov cl, 2
call fcn.00402e80
lea edx, [ebp - 0x18]
lea eax, [ebp - 8]
call fcn.0040472c
test bl, bl
je 0x479732
mov eax, dword [ebp - 8]
call fcn.00404980
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x479732
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jg 0x479743
mov eax, dword [ebp - 0xc]
call fcn.00404788
test eax, eax
jle 0x47971d
lea eax, [ebp - 0xc]
mov edx, 0x47978c
call fcn.00404790
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.0047955c
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.00404790
shr esi, 1
mov eax, esi
and eax, 1
inc edi
cmp edi, 0x1b
jne 0x4796a8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
call fcn.00404524
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x479778
lea eax, [ebp - 0x1c]
call fcn.004044d0
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004044f4
ret
Function at 0x404baf
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40db60]
jne 0x404bb9
repz ret
jmp fcn.004087fb

Function at 0x4060b3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00402986
and dword [ebp - 4], 0
cmp dword [0x40e54c], 0
mov ebx, eax
jne 0x406164
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406215
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40aa14
push edi
call esi
test eax, eax
je 0x406215
push eax
call fcn.00402914
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40e54c], eax
call esi
push eax
call fcn.00402914
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40e550], eax
call esi
push eax
call fcn.00402914
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x40e554], eax
call esi
push eax
call fcn.00402914
pop ecx
mov dword [0x40e55c], eax
test eax, eax
je 0x406164
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402914
pop ecx
mov dword [0x40e558], eax
mov eax, dword [0x40e558]
cmp eax, ebx
je 0x4061bc
cmp dword [0x40e55c], ebx
je 0x4061bc
push eax
call fcn.0040298f
push dword [0x40e55c]
mov esi, eax
call fcn.0040298f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4061bc
test edi, edi
je 0x4061bc
call esi
test eax, eax
je 0x4061b3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4061b3
test byte [ebp - 0xc], 1
jne 0x4061bc
or dword [ebp + 0x10], 0x200000
jmp 0x4061f5
mov eax, dword [0x40e550]
cmp eax, ebx
je 0x4061f5
push eax
call fcn.0040298f
pop ecx
test eax, eax
je 0x4061f5
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4061f5
mov eax, dword [0x40e554]
cmp eax, ebx
je 0x4061f5
push eax
call fcn.0040298f
pop ecx
test eax, eax
je 0x4061f5
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40e54c]
call fcn.0040298f
pop ecx
test eax, eax
je 0x406215
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x406217
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401f9a
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
push 8
call fcn.00402c6c
add esp, 4
mov dword [ebp - 8], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0x10
call fcn.00402c6c
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x10], esp
lea eax, [ebp - 4]
push eax
push 0xf01ff
push dword [ebp + 8]
mov eax, 7
call fcn.00402c84
cmp dword [ebp - 0x10], esp
je 0x402021
push 6
call fcn.00402c7e
add esp, 4
mov dword [ebp - 0x10], esp
push dword [ebp + 8]
mov eax, 8
call fcn.00402c84
cmp dword [ebp - 0x10], esp
je 0x402043
push 6
call fcn.00402c7e
add esp, 4
mov dword [ebp - 0x10], esp
push dword [ebp - 8]
push str.SeDebugPrivilege
push 0
mov eax, 9
call fcn.00402c84
cmp dword [ebp - 0x10], esp
je 0x40206f
push 6
call fcn.00402c7e
add esp, 4
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx], 1
mov ebx, dword [ebp - 0xc]
add ebx, 0xc
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx], 2
mov ebx, dword [ebp - 0xc]
add ebx, 4
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 8]
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x14]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x10]
mov dword [ebx], eax
mov ebx, dword [ebp - 0xc]
add ebx, 8
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 8]
add ebx, 4
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x14]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x10]
mov dword [ebx], eax
mov dword [ebp - 0x10], esp
push 0
push 0
push 0
push dword [ebp - 0xc]
push 0
push dword [ebp - 4]
mov eax, 0xa
call fcn.00402c84
cmp dword [ebp - 0x10], esp
je 0x4020fe
push 6
call fcn.00402c7e
add esp, 4
jmp 0x402103
push eax
mov ebx, dword [ebp - 8]
push ebx
call fcn.00402c66
add esp, 4
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.00402c66
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x40aa60
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x47581b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0046a23c
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40aae2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00467f2d
mov eax, dword [eax]
push 0x4a4200
push eax
call fcn.0045ab34
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0046a4c7
test bl, bl
je 0x40aae2
push 0x4a4200
lea ecx, [esp + 0xc]
call fcn.0046a857
push 0x4a7d74
lea ecx, [esp + 0xc]
call fcn.0046a857
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40ab1e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0046a4c7
jmp 0x40abe9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40aba2
lea edx, [esp + 0x7c]
push 0x4a7d70
push edx
call fcn.0045ab34
add esp, 8
test eax, eax
je 0x40aba2
lea eax, [esp + 0x7c]
push 0x4a7d6c
push eax
call fcn.0045ab34
add esp, 8
test eax, eax
je 0x40aba2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40ab32
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0046a4c7
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40b3e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40b442
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc