joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422b70
Capabilities:
Write file on windows

Disassembly:
push 0x20
mov eax, 0x583292
call fcn.00560e5c
mov ebx, ecx
cmp dword [ebx + 0x40], 0
je 0x422c67
cmp byte [ebx + 0x45], 0
je 0x422c67
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x422ba5
xor al, al
jmp 0x422c69
xor eax, eax
mov dword [ebp - 0x14], 0xf
push eax
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.0042331c
and dword [ebp - 4], 0
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
lea eax, [ebp - 0x2c]
mov ecx, dword [ebx + 0x40]
lea edi, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x18]
lea esi, [ebp - 0x28]
cmovae edi, edx
cmovae esi, edx
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x48]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x422bff
dec eax
je 0x422c03
dec eax
dec eax
je 0x422c55
xor bl, bl
jmp 0x422c57
mov byte [ebx + 0x45], 0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
cmp ecx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae eax, edx
sub esi, eax
je 0x422c3b
push dword [ebx + 0x50]
cmp ecx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, edx
push 1
push eax
call fcn.00562aae
add esp, 0x10
cmp esi, eax
jne 0x422bfb
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x28]
cmp byte [ebx + 0x45], 0
je 0x422c55
test esi, esi
jne 0x422bc9
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.00423219
jmp 0x422bc3
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.004066d3
mov al, bl
jmp 0x422c69
mov al, 1
call fcn.00560e1a
ret
Function at 0x423bea
Capabilities:
Create thread
Terminate process

Disassembly:
push esi
xor esi, esi
push esi
push esi
push esi
push 0x423a98
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x68f7a8]
inc eax
mov dword [0x68f7a8], eax
cmp eax, 1
je 0x423a72
xor eax, eax
ret

Function at 0x423c88
Capabilities:
Write file on windows

Disassembly:
push 0x34
mov eax, 0x583378
call fcn.00560e5c
mov esi, ecx
mov dword [ebp - 0x30], esi
mov edi, dword [ebp + 8]
or ebx, 0xffffffff
cmp edi, ebx
jne 0x423caa
xor eax, eax
jmp 0x423e04
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x423cd4
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
add eax, ecx
cmp ecx, eax
jae 0x423cd4
dec dword [edx]
mov edx, dword [esi + 0x20]
mov eax, dword [ebp + 8]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], al
jmp 0x423e04
cmp dword [esi + 0x50], 0
je 0x423e02
mov ecx, esi
call fcn.004230e0
xor ecx, ecx
cmp dword [esi + 0x40], ecx
jne 0x423d01
push dword [esi + 0x50]
push edi
call fcn.00421897
test al, al
pop ecx
pop ecx
cmovne ebx, edi
jmp 0x423e02
mov eax, dword [ebp + 8]
push ecx
mov dword [ebp - 0x18], ecx
mov byte [ebp - 0x28], cl
lea ecx, [ebp - 0x28]
push 8
mov byte [ebp - 0x2c], al
mov dword [ebp - 0x14], 0xf
call fcn.0042331c
and dword [ebp - 4], 0
lea eax, [esi + 0x48]
mov dword [ebp - 0x40], eax
mov edi, dword [ebp - 0x14]
mov esi, dword [esi + 0x40]
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x28]
cmp edi, 0x10
lea edx, [ebp - 0x28]
mov edi, dword [esi]
cmovae ecx, dword [ebp - 0x28]
cmovae edx, dword [ebp - 0x28]
add eax, ecx
push eax
push edx
lea eax, [ebp - 0x38]
mov ecx, esi
push eax
lea eax, [ebp - 0x2b]
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x40]
call dword [edi + 0x1c]
test eax, eax
js 0x423df6
cmp eax, 1
jg 0x423ddb
mov edi, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
cmp edi, 0x10
mov edx, dword [ebp - 0x34]
mov esi, dword [ebp - 0x30]
cmovae eax, ecx
sub edx, eax
mov dword [ebp - 0x3c], edx
je 0x423dac
push dword [esi + 0x50]
cmp edi, 0x10
lea eax, [ebp - 0x28]
push edx
cmovae eax, ecx
push 1
push eax
call fcn.00562aae
mov edx, dword [ebp - 0x3c]
add esp, 0x10
cmp edx, eax
jne 0x423df6
mov edi, dword [ebp - 0x14]
lea eax, [ebp - 0x2c]
mov byte [esi + 0x45], 1
cmp dword [ebp - 0x38], eax
jne 0x423dd6
test edx, edx
jne 0x423d2c
cmp dword [ebp - 0x18], 0x20
jae 0x423df6
push edx
push 8
lea ecx, [ebp - 0x28]
call fcn.00423219
jmp 0x423d29
mov ebx, dword [ebp + 8]
jmp 0x423df6
cmp eax, 3
jne 0x423df6
mov eax, dword [ebp - 0x30]
push dword [eax + 0x50]
push dword [ebp - 0x2c]
call fcn.00421897
test al, al
pop ecx
cmovne ebx, dword [ebp + 8]
pop ecx
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.004066d3
mov eax, ebx
call fcn.00560e1a
ret 4
Function at 0x42480f
Capabilities:
Create thread
Terminate process

Disassembly:
mov eax, dword [0x698830]
push esi
cmp eax, 1
je 0x42485d
cmp eax, 4
je 0x42485d
cmp eax, 2
jne 0x424848
xor esi, esi
push esi
push esi
push esi
push 0x4250ec
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 3
jne 0x424859
xor esi, esi
push esi
push esi
push esi
push 0x431a24
jmp 0x42482e
push 0
jmp 0x424842
xor esi, esi
push esi
push esi
push esi
push 0x425164
jmp 0x42482e
Function at 0x425070
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0x58fb98
push ebx
mov ebx, dword [ebp - 4]
push edi
mov edi, dword [ebp - 4]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x4250cc
push esi
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00565205
mov edx, eax
xor eax, eax
pop ecx
test esi, esi
mov dword [ebp - 4], eax
pop esi
je 0x4250c3
sub edi, edx
lea ecx, [eax + edx]
and eax, 7
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp eax, dword [ebx + 0xf]
jb 0x4250a8
mov eax, dword [ebx + 0xf]
mov edi, edx
mov byte [edx + eax], 0
push edi
call fcn.0042489d
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4250d9
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x424869
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x425a12
Capabilities:
Create thread
Terminate process

Disassembly:
mov eax, dword [0x698830]
push esi
cmp eax, 1
je 0x425a60
cmp eax, 4
je 0x425a60
cmp eax, 2
jne 0x425a4b
xor esi, esi
push esi
push esi
push esi
push 0x42697b
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 3
jne 0x425a5c
xor esi, esi
push esi
push esi
push esi
push 0x431a24
jmp 0x425a31
push 0
jmp 0x425a45
xor esi, esi
push esi
push esi
push esi
push 0x4269f3
jmp 0x425a31

Function at 0x425a6c
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x4259de
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x426a6b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x66e240]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
or dword [ebp - 0x408], 0xffffffff
push ebx
push edi
push 0x58c990
push edx
mov ebx, ecx
call fcn.005621eb
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x426aa4
or eax, 0xffffffff
jmp 0x426aec
push esi
push edi
push 0x400
lea eax, [ebp - 0x404]
push 1
push eax
call fcn.00562797
add esp, 0x10
mov esi, eax
lea eax, [ebp - 0x404]
mov ecx, ebx
push esi
push eax
lea eax, [ebp - 0x408]
push eax
call fcn.00426b5d
cmp esi, 0x400
je 0x426aa5
push edi
call fcn.005620b0
mov eax, dword [ebp - 0x408]
pop ecx
not eax
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.00560d94
mov esp, ebp
pop ebp
ret 4

Function at 0x426afe
Capabilities:
Encode data using xor
Hash data using crc32b

Disassembly:
push ebx
push esi
push edi
push 0x400
xor esi, esi
mov ebx, ecx
push esi
push ebx
call fcn.00561d60
add esp, 0xc
mov edi, ebx
push 8
push esi
mov ecx, ebx
call fcn.00426b96
shl eax, 0x18
push 8
mov dword [edi], eax
pop edx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
add eax, eax
and ecx, 0x4c11db7
xor eax, ecx
dec edx
jne 0x426b28
push 0x20
push eax
mov ecx, ebx
call fcn.00426b96
mov dword [edi], eax
inc esi
add edi, 4
cmp esi, 0xff
jle 0x426b16
pop edi
pop esi
pop ebx
ret

Function at 0x426b5d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 4], ecx
test esi, esi
je 0x426b8f
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov edx, dword [ebx]
movzx eax, byte [edi]
movzx ecx, dl
xor ecx, eax
shr edx, 8
mov eax, dword [ebp - 4]
xor edx, dword [eax + ecx*4]
inc edi
mov dword [ebx], edx
dec esi
jne 0x426b74
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x42952d
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x68fc50]
add eax, dword [0x68fc4c]
add eax, dword [0x68fc48]
add eax, dword [0x68fc44]
add eax, dword [0x68fc40]
add eax, dword [0x68fc3c]
add eax, dword [0x68fc38]
add eax, dword [0x68fc34]
add eax, dword [0x68fc30]
add eax, dword [0x68fc2c]
add eax, dword [0x68fc28]
add eax, dword [0x68fc24]
add eax, dword [0x68fc20]
add eax, dword [0x68fc1c]
add eax, dword [0x68fc18]
add eax, dword [0x68fc14]
add eax, dword [0x68fc10]
add eax, dword [0x68fc0c]
add eax, dword [0x68fc08]
add eax, dword [0x68fc04]
add eax, dword [0x68fc00]
add eax, dword [0x68fbfc]
mov edx, dword [0x68fc54]
add eax, dword [0x68fbf8]
inc edx
mov dword [0x68fc54], edx
cmp eax, dword [0x68fbe8]
je 0x4295d4
cmp edx, 5
jg fcn.004296cf
jmp 0x429b3e
xor eax, eax
mov dword [0x68fbf8], eax
mov dword [0x68fbfc], eax
mov dword [0x68fc00], eax
mov dword [0x68fc04], eax
mov dword [0x68fc08], eax
mov dword [0x68fc0c], eax
mov dword [0x68fc10], eax
mov dword [0x68fc14], eax
mov dword [0x68fc18], eax
mov dword [0x68fc1c], eax
mov dword [0x68fc20], eax
mov dword [0x68fc24], eax
mov dword [0x68fc28], eax
mov dword [0x68fc2c], eax
mov dword [0x68fc30], eax
mov dword [0x68fc34], eax
mov dword [0x68fc38], eax
mov dword [0x68fc3c], eax
mov dword [0x68fc40], eax
mov dword [0x68fc44], eax
mov dword [0x68fc48], eax
mov dword [0x68fc4c], eax
mov dword [0x68fc50], eax
ret

Function at 0x429693
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x4295d9
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x4296a6
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x429629
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x4296cf
Capabilities:
Create thread
Encode data using xor
Terminate process

Disassembly:
push 0xac
mov eax, 0x58357e
call fcn.00560e29
xor ebx, ebx
cmp dword [0x69882c], 1
jne 0x429838
mov dword [ebp - 0x10], 0x58fa7c
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x429741
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00565205
mov edx, eax
xor eax, eax
mov dword [ebp - 0x10], eax
pop ecx
test esi, esi
je 0x429738
sub edi, edx
lea ecx, [eax + edx]
and eax, 7
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, dword [ebx + 0xf]
jb 0x42971d
mov eax, dword [ebx + 0xf]
mov edi, edx
mov byte [edx + eax], 0
push 1
push 0x40
push 8
push edi
lea ecx, [ebp - 0xb8]
call fcn.00424676
and dword [ebp - 4], 0
mov dword [ebp - 0x10], 0x590ec0
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x4297ab
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00565205
mov edx, eax
xor eax, eax
mov dword [ebp - 0x10], eax
pop ecx
test esi, esi
je 0x4297a2
sub edi, edx
lea ecx, [eax + edx]
and eax, 7
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, dword [ebx + 0xf]
jb 0x429787
mov eax, dword [ebx + 0xf]
mov edi, edx
mov byte [edx + eax], 0
lea eax, [ebp - 0xb8]
push edi
push eax
call fcn.0042163d
mov dword [ebp - 0x10], 0x590ee4
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
pop ecx
add edi, 0x14
cmp byte [ebx + 0x13], 0
pop ecx
je 0x429811
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00565205
mov edx, eax
xor eax, eax
mov dword [ebp - 0x10], eax
pop ecx
test esi, esi
je 0x429805
sub edi, edx
lea ecx, [eax + edx]
and eax, 7
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, dword [ebx + 0xf]
jb 0x4297ea
mov eax, dword [ebx + 0xf]
mov edi, edx
xor ebx, ebx
mov byte [edx + eax], bl
jmp 0x429813
xor ebx, ebx
lea eax, [ebp - 0xb8]
push edi
push eax
call fcn.0042163d
pop ecx
pop ecx
lea ecx, [ebp - 0xb8]
call fcn.004251dc
lea ecx, [ebp - 0xb8]
call fcn.004247cb
mov eax, dword [0x698830]
cmp eax, 1
je 0x42987e
cmp eax, 4
je 0x42987e
push ebx
cmp eax, 2
jne 0x42986e
push ebx
push ebx
push 0x429a16
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 3
jne 0x42987c
push ebx
push ebx
push 0x431a24
jmp 0x429854
jmp 0x429868
push ebx
push ebx
push ebx
push 0x429aaa
jmp 0x429854

Function at 0x429bb4
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x429bc7
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x42ade6
Capabilities:
Acquire debug privileges
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x66e240]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x42ae79
push esi
lea eax, [ebp - 0x20]
xor esi, esi
push eax
push str.SeDebugPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x42ae61
mov eax, dword [ebp - 0x20]
push esi
push esi
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x1c]
push 0x10
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp - 0x18]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x42ae61
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x42ae65
xor eax, eax
jmp 0x42ae78
push esi
push esi
push esi
push 0x42a709
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
inc eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00560d94
mov esp, ebp
pop ebp
ret

Function at 0x42ae87
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x42ae9a
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x4305ee
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x430d57
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x430da7
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x4318f2
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x431921
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x431ab4
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x4362d2
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x4363fa
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x4362e5
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20804
call fcn.00562360
mov eax, dword [0x66e240]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
xor ebx, ebx
push edi
push edi
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
test esi, esi
je 0x4363db
lea eax, [ebp - 0x207f8]
mov dword [ebp - 0x20800], eax
push esi
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
jne 0x4363bf
lea eax, [ebp - 0x20804]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp - 0x20804]
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
jne 0x4363bf
mov ecx, dword [ebp - 0x20800]
mov eax, dword [ebp - 0x20804]
push 0xff
mov dword [ecx], eax
lea eax, [ecx + 4]
push eax
push esi
mov dword [ecx - 4], esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov eax, dword [ebp - 0x20800]
push 0xff
add eax, 0x103
push eax
push esi
call dword [sym.imp.USER32.dll_GetClassNameA]
add dword [ebp - 0x20800], 0x206
inc ebx
mov ecx, dword [ebp - 0x20804]
xor eax, eax
test edi, edi
jle 0x4363b3
cmp ecx, dword [ebp + eax*4 - 0x400]
je 0x4363b3
inc eax
cmp eax, edi
jl 0x4363a5
cmp eax, edi
jne 0x4363bf
mov dword [ebp + edi*4 - 0x400], ecx
inc edi
push 2
push esi
call dword [sym.imp.USER32.dll_GetWindow]
mov esi, eax
test esi, esi
jne 0x436321
test ebx, ebx
je 0x4363db
cmp edi, 1
jg 0x4363f4
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00560d94
mov esp, ebp
pop ebp
ret
call fcn.00435dd6
int3

Function at 0x43651e
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x436531
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x438c9c
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x4388a1
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x43aa56
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x43b0cd
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x43b1f1
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x43b767
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x43b79b
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x43b89e
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x43c1c3
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x66e240]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x698840], 1
push ebx
push esi
push edi
jne 0x43c267
movzx eax, word [0x449081]
push eax
lea eax, [ebp - 0x10]
push 0x58d2c0
push eax
call fcn.005623bc
mov dword [ebp - 0x14], 0x595010
add esp, 0xc
mov ebx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x14]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x43c250
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00565205
mov edx, eax
xor eax, eax
mov dword [ebp - 0x14], eax
pop ecx
test esi, esi
je 0x43c247
sub edi, edx
lea ecx, [eax + edx]
and eax, 7
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp eax, dword [ebx + 0xf]
jb 0x43c22c
mov eax, dword [ebx + 0xf]
mov edi, edx
mov byte [edx + eax], 0
push 0x30
push edi
lea eax, [ebp - 0x10]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, 0x7361
cmp word [0x449081], ax
jne 0x43c288
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00560d94
mov esp, ebp
pop ebp
ret
call fcn.0043be30
int3

Function at 0x43c2c2
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x43c28e
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x43c2d5
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x441fb8
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x4421fc
Capabilities:
Acquire debug privileges
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x66e240]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor edi, edi
inc edi
cmp dword [0x698854], edi
jne 0x442220
call fcn.0044268f
jmp 0x44229a
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x44223b
xor eax, eax
jmp 0x44229c
lea eax, [ebp - 0x20]
xor esi, esi
push eax
push str.SeDebugPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x442237
mov eax, dword [ebp - 0x20]
push esi
push esi
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x1c]
push 0x10
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp - 0x18]
mov dword [ebp - 0x14], edi
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x442237
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x442237
push esi
push esi
push esi
push 0x442184
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00560d94
mov esp, ebp
pop ebp
ret
Function at 0x4422ac
Capabilities:
Create thread
Encode data using xor
Terminate process

Disassembly:
push 0xac
mov eax, 0x58357e
call fcn.00560e29
xor ebx, ebx
cmp dword [0x69882c], 1
jne 0x4423c5
mov dword [ebp - 0x10], 0x58fa7c
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x44231e
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00565205
mov edx, eax
xor eax, eax
mov dword [ebp - 0x10], eax
pop ecx
test esi, esi
je 0x442315
sub edi, edx
lea ecx, [eax + edx]
and eax, 7
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, dword [ebx + 0xf]
jb 0x4422fa
mov eax, dword [ebx + 0xf]
mov edi, edx
mov byte [edx + eax], 0
push 1
push 0x40
push 8
push edi
lea ecx, [ebp - 0xb8]
call fcn.00424676
and dword [ebp - 4], 0
mov dword [ebp - 0x10], 0x5945f0
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x44238b
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00565205
mov edx, eax
xor eax, eax
mov dword [ebp - 0x10], eax
pop ecx
test esi, esi
je 0x44237f
sub edi, edx
lea ecx, [eax + edx]
and eax, 7
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, dword [ebx + 0xf]
jb 0x442364
mov eax, dword [ebx + 0xf]
mov edi, edx
xor ebx, ebx
mov byte [edx + eax], bl
jmp 0x44238d
xor ebx, ebx
lea eax, [ebp - 0xb8]
push edi
push eax
call fcn.0042163d
push dword [0x69877c]
lea eax, [ebp - 0xb8]
push eax
call fcn.0042163d
add esp, 0x10
lea ecx, [ebp - 0xb8]
call fcn.004251dc
lea ecx, [ebp - 0xb8]
call fcn.004247cb
mov eax, dword [0x698830]
cmp eax, 1
je 0x442402
cmp eax, 3
je 0x442402
cmp eax, 4
je 0x442402
push ebx
cmp eax, 2
jne 0x442400
push ebx
push ebx
push 0x4424de
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x4423fa
push ebx
push ebx
push ebx
push 0x442556
jmp 0x4423e6

Function at 0x4425e0
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push 0x596cf0
push 0x596d00
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp + 0xc]
mov ebx, eax
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x442604
push 4
push 0x3000
sub ecx, edx
push ecx
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edx, dword [ebp + 0xc]
mov edi, eax
lea eax, [edx + 1]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x442628
push 0
sub edx, eax
push edx
push dword [ebp + 0xc]
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor eax, eax
push eax
push eax
push edi
push ebx
push eax
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov al, 1
pop ebx
pop ebp
ret
Function at 0x44268f
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x4425ce
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret