joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401190
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0xa
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x4011d0
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4011c7
push 0
lea edx, [ebp - 4]
push edx
push ebx
push esi
push edi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401220
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x410008]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x105
push 0
push esi
call fcn.004076b0
push 0x20a
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.004076b0
add esp, 0x18
push str.IsWow64Process
push str.kernel32
mov dword [ebp - 0x214], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x412c8c], eax
test eax, eax
je 0x401294
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x412c8c]
cmp byte [ebp - 0x214], 0
push edi
push 0x105
je 0x4012b7
lea edx, [ebp - 0x210]
push edx
mov edi, 0xca
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x4012c9
lea eax, [ebp - 0x210]
push eax
mov edi, 0xc9
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.DumpIt.sys
lea ecx, [ebp - 0x210]
push ecx
push str._sDrivers_s
push 0x105
push esi
call fcn.00401dc5
movzx edi, di
push esi
mov eax, edi
call fcn.00401190
add esp, 0x18
test al, al
jne 0x4013b0
push 0x20a
lea edx, [ebp - 0x210]
push 0
push edx
call fcn.004076b0
push str.DumpIt.sys
push str._TEMP__s
lea eax, [ebp - 0x210]
push 0x20a
push eax
call fcn.00401dc5
add esp, 0x1c
push 0x105
push esi
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push esi
mov eax, edi
call fcn.00401190
add esp, 4
test al, al
jne 0x4013b0
push 0x20a
lea edx, [ebp - 0x210]
push 0
push edx
call fcn.004076b0
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push str.DumpIt.sys
lea ecx, [ebp - 0x210]
push ecx
push str._s_s
push 0x105
push esi
call fcn.00401dc5
push esi
mov eax, edi
call fcn.00401190
add esp, 0x18
test al, al
jne 0x4013b0
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401db6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov al, 1
pop edi
call fcn.00401db6
mov esp, ebp
pop ebp
ret
Function at 0x401720
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x410008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push str.DumpIt
push str.RegistryMachineSystemCurrentControlSetServices_s
lea eax, [ebp - 0x218]
push 0x20a
xor esi, esi
push eax
mov dword [ebp - 0x21c], esi
call fcn.00401dc5
add esp, 0x10
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x224]
push edx
call dword [0x411b48]
lea eax, [ebp - 0x224]
push eax
call dword [0x411b4c]
test eax, eax
jne 0x4017b9
lea ecx, [ebp - 0x21c]
push ecx
push 0xf003f
push eax
push str.SYSTEMCurrentControlSetServices
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4017b9
mov edx, dword [ebp - 0x21c]
push str.DumpIt
push edx
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
test eax, eax
jne 0x4017b9
lea esi, [eax + 1]
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x4017ca
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00401db6
mov esp, ebp
pop ebp
ret

Function at 0x401870
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x670
mov eax, dword [0x410008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x660]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea ecx, [ebp - 0x664]
push ecx
lea edx, [ebp - 0x24]
push edx
mov dword [ebp - 0x664], 0x20
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0x20a
lea eax, [ebp - 0x238]
push 0
push eax
call fcn.004076b0
movzx ecx, word [ebp - 0x654]
movzx edx, word [ebp - 0x656]
movzx eax, word [ebp - 0x658]
add esp, 0xc
push ecx
movzx ecx, word [ebp - 0x65a]
push edx
movzx edx, word [ebp - 0x65e]
push eax
movzx eax, word [ebp - 0x660]
push ecx
push edx
push eax
lea ecx, [ebp - 0x24]
push ecx
push str._s__04d_02d_02d__02d_02d_02d.raw
lea edx, [ebp - 0x238]
push 0x20a
push edx
call fcn.00401dc5
push 0x20a
lea eax, [ebp - 0x448]
push 0
push eax
call fcn.004076b0
add esp, 0x34
lea ecx, [ebp - 0x670]
push ecx
lea edx, [ebp - 0x448]
push edx
push 0x105
lea eax, [ebp - 0x238]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
lea ecx, [ebp - 0x650]
push ecx
lea edx, [ebp - 0x66c]
push edx
call dword [0x411b48]
push 0
push 0
lea eax, [ebp - 0x66c]
push eax
lea ecx, [ebp - 0x448]
push ecx
call dword [0x411b44]
mov bl, al
test bl, bl
je 0x4019a1
movzx eax, word [ebp - 0x66c]
lea esi, [eax + 2]
shr esi, 1
cmp esi, 0x20a
ja 0x4019a1
mov edx, dword [ebp - 0x668]
push eax
push edx
push edi
call fcn.0040ab20
add esp, 0xc
xor eax, eax
mov word [edi + esi*2 - 2], ax
mov ecx, dword [ebp - 4]
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.00401db6
mov esp, ebp
pop ebp
ret
Function at 0x401a70
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x410008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x34]
push ecx
lea edx, [ebp - 0x3c]
push edx
lea eax, [ebp - 0x38]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
jne 0x401ab2
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401db6
mov esp, ebp
pop ebp
ret
push str.NtQuerySystemInformation
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [0x411b40], esi
test esi, esi
je 0x401a9f
push 0x2c
lea ecx, [ebp - 0x30]
push 0
push ecx
call fcn.004076b0
add esp, 0xc
push 0
push 0x2c
lea edx, [ebp - 0x30]
push edx
push 0
call esi
test eax, eax
js 0x401a9f
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x34]
inc eax
mul dword [ebp - 0x28]
mov ebx, eax
mov eax, dword [ebp - 0x38]
mov esi, edx
mul dword [ebp - 0x3c]
push 0
push ecx
push edx
push eax
call fcn.0040b2e0
mov dword [ebp - 0x48], eax
mov edi, edx
mov edx, ebx
mov eax, esi
shrd edx, eax, 0x14
shr eax, 0x14
push eax
push edx
push 7
push esi
push ebx
push 0xf
push str._n____Address_space_size:____I64d_bytes___I64d_Mb__n
call fcn.00401e01
mov eax, dword [ebp - 0x48]
mov ecx, eax
mov edx, edi
shrd ecx, edx, 0x14
shr edx, 0x14
push edx
push ecx
push 7
push edi
push eax
push 0xf
push str.____Free_space_size:_______I64d_bytes___I64d_Mb__n_n
call fcn.00401e01
add esp, 0x38
cmp edi, esi
ja 0x401b6b
jb 0x401a9f
cmp dword [ebp - 0x48], ebx
jb 0x401a9f
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.00401db6
mov esp, ebp
pop ebp
ret
Function at 0x401db6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410008]
jne 0x401dc0
repz ret
jmp fcn.004022d9

Function at 0x408f75
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x410008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00405809
and dword [ebp - 0x14], 0
cmp dword [0x411b20], 0
mov dword [ebp - 0x18], eax
jne 0x409028
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4090d0
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4090d0
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x411b20], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x411b24], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x411b28], eax
call edi
push eax
call esi
mov dword [0x411b30], eax
test eax, eax
je 0x409028
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x411b2c], eax
mov eax, dword [0x411b2c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x409081
cmp dword [0x411b30], ecx
je 0x409081
push eax
call esi
push dword [0x411b30]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x409081
test ebx, ebx
je 0x409081
call edi
test eax, eax
je 0x409078
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x409078
test byte [ebp - 8], 1
jne 0x409081
or dword [ebp + 0x10], 0x200000
jmp 0x4090b4
mov eax, dword [0x411b24]
cmp eax, dword [ebp - 0x18]
je 0x4090b4
push eax
call esi
test eax, eax
je 0x4090b4
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4090b4
mov eax, dword [0x411b28]
cmp eax, dword [ebp - 0x18]
je 0x4090b4
push eax
call esi
test eax, eax
je 0x4090b4
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x411b20]
call esi
test eax, eax
je 0x4090d0
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4090d2
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401db6
leave
ret
Function at 0x4374a7
Capabilities:
Encode data using xor

Disassembly:
wait
mov al, byte [0xa2c7d7b6]
push edi
popfd
sbb esp, dword [ebx - 0x43]
dec edx
invalid

Function at 0x4419d7
Capabilities:
Encode data using xor

Disassembly:
std
add ecx, ebp
mov gs, word [ebx - 0x78e71676]
invalid

Function at 0x46909a
Capabilities:
Encode data using xor

Disassembly:
xchg byte [edi], dh
mov byte [ebx], bl
mov es, word [eax + 0x33]
lahf
xor esi, dword [eax + 0x71029103]
adc byte [edx], 0x81
xor al, byte [eax + 0x738013]
xchg esp, eax
pop es
mov ah, 0x48
cmp byte [edi + 0x2dbb2cd8], ch
lcall 0x34a3, 0xd522ba2d
mov al, byte [0xa636a117]
in al, dx
sub edi, dword [ebx + ebp + 0x28bf2b9c]
fild qword [eax - 0x57e057c1]
aas
test eax, 0x29be29de
sahf
sub dword [esi + 0x39aede29], edi
scasb al, byte es:[edi]
sbb dword [esi + 0x2ed9ae39], ebp
mov eax, 0xb82f982f
das
fld xword [ebx + edi + 0x3aac1bac]
lodsd eax, dword [esi]
fisubr dword [0x239522b5]
mov dh, 0x26
shl byte [edx + esi + 0x3eab1d9a], 1
scasb al, byte es:[edi]
fld xword [0x249623b5]
cmp eax, 0x3fabdd2a
test eax, 0xaf38ae1e
fsubr dword [0x239522b5]
mov ah, 0x23
rcr dword [edx + 0x4a10a93c], 1
aas
test al, 0xde
mov ecx, 0x6d20952e
sub ebp, ebp
scasb al, byte es:[edi]
cmp dword [esi - 0x51c651e7], ebp
fldcw word [edx + edi*4]
and dl, byte [eax - 0x652cdb4f]
cmp eax, 0x3cab1caa
test al, 0xdf
sub byte [edi - 0x41d660d8], bh
fld xword cs:[esi + esi + 0x30a711a6]
movsb byte es:[edi], byte [esi]
shl byte [0x2a9d2a9d], cl
mov edi, 0x31a0d82e
cmpsd dword [esi], dword es:[edi]
adc byte [edi + 0x1ad2a533], ah
mov ebp, 0xb9289f2b
sub eax, 0xa731a0d5
adc ebx, dword [edx + 0x2fd8af38]
mov ebx, 0xb0269423
and eax, 0xa63caaad
sub eax, 0xd8a83fab
sub al, 0xba
sub eax, 0x23b4239a
xlatb
mov al, byte [0xa616a136]
xor byte [edi + 0x25b225d3], ah
lodsd eax, dword [esi]
sub bh, byte [ebp + 0x3fa8dc2b]
test eax, 0xaf39ae19
fsubr dword [edi]
mov ebx, 0xba2c9b2c
and dl, ah
mov dword [0xa116a037], eax
mov eax, dword ss:[0x28fd21d6]
lahf
sub byte [edi + 0x3fa8df28], bh
test al, 0x1f
test al, 0xfa
mov ebx, dword [edi + 0xb]
fisttp word [ebx]
fisttp word [ebx]
fmul dword [eax + ebx*8]
mov word [eax - 0x74], ds
pop eax
mov word [ecx - 0x73], ds
pop ecx
or eax, 0xdd90dd9
fimul dword [esi]
fimul dword [esi - 0x71a571a6]
pop ebx
invalid

Function at 0x471255
Capabilities:
Encode data using xor

Disassembly:
rcr esp, 0x90
dec edi
std
test al, 0x86
push ss
jne 0x471202
clc
pushal
ja 0x471298
test byte [bp + 0x7ecf], ah
arpl word [ecx + 0x7e], cx
xor al, 0x1e
lahf
sub ebx, edi
lea ebp, [ebx - 0x170ccb8d]
xor eax, 0x69ce6954
loopne 0x471274
int 0x54
fnstcw word [eax]
lodsb al, byte [esi]
test eax, 0xbab473ec
outsb dx, byte [esi]
arpl word [ecx - 0x25], di
retf 0xc002
push 0x37
add eax, 0xdda06035
xchg byte [ebp - 0x2630c6a1], dh
aas
cli
pop ebx
xchg byte [esi + ecx*8], bl
invalid
Function at 0x4815e9
Capabilities:
Encode data using xor

Disassembly:
push ebx
inc esi
adc dword [ebp + 0x39f34c1b], edi
inc ebx
mov dh, 0xc3
lcall 0x8c5, 0x63ab471a
mov ecx, 0x8f588e61
dec edx
jl 0x481612
je 0x481625
loope 0x48164f
popfd
jl 0x48166a
mov eax, ds
add esi, edx
and ebx, dword [esi + 0x2c]
cmpsd dword [esi], dword es:[edi]
sub al, 0xa7
mov ebp, 0xe69e1960
or dword [esi - 0x1f], eax
add dh, ch
jl 0x481651
cwde
or cl, dh
add al, 0x75
dec esp
test dh, dh
and al, 0x7c
add eax, dword [ecx + 0x2a1933e1]
fsubr qword [ecx - 0x2d3c3817]
add al, 0x9e
xchg cl, bh
and edx, dword [eax - 0x5614d55c]
push es
pop ds
cmc
push esp
imul edx, dword [esi], 0x69404bd
mov edi, 0x5e6b89b2
xchg ecx, eax
and byte [0x27751526], ah
aas
invalid
Function at 0x48a5e1
Capabilities:
Encode data using xor

Disassembly:
nop
nop
nop
nop
nop
push ebp
mov ebp, esp
push ecx
jmp 0x62a422
wait
mov eax, 0xca310950
cmc
and dword [eax + 0x1e2aaf8b], esi
je 0x48a5f1
mov bl, 0x70
jne 0x48a60b
mov ebx, dword [ebx]
pop esp
mov edi, 0xe77a3def
sbb eax, dword [ebp + ecx*8 + 0x3a]
push cs
jns 0x48a59b
invalid
mov ecx, 0x4baeccd0
ror ah, 1
scasb al, byte es:[edi]
dec ebx
rcr byte [ebp + 0x40e0ec14], cl
mov eax, dword [0x5a0782e1]
rcr byte [ebx], cl
cmp dword [ecx + ebx*2 + 0x23], ebx
fld qword [ebx - 0x4b]
cmp bh, al
xor eax, edx
stc
jp 0x48a5ec
test esi, edx
jecxz 0x48a5bf
adc byte [esi + 0x35], bh
add dword cs:[ecx + ebx*4 - 0x3d], 0xb0a21d
test al, 0x16
xor byte [eax + 0x40], bh
inc edi
dec edx
add al, byte [edx]
sub eax, 0x48934f73
clc
sub bl, byte [edi - 0x77c34102]
idiv edx
sbb ebx, esi
add edi, dword [esi - 0x1c178f2a]
scasb al, byte es:[edi]
loop 0x48a605
cdq
ret
popfd
stosd dword es:[edi], eax
out dx, eax
aaa
xchg edx, eax
inc edx
fxch st(5)
xchg esi, eax
and al, 0x8d
xchg edi, eax
xor eax, esp
pop es
aas
into
xor edi, ecx
aam 0x99
jbe 0x48a6b4
xchg esp, eax
sbb ah, byte [edx + 0x6d]
pop ecx
mov bl, 0x74
mov al, byte [0x281e5d59]
in eax, 8
lodsb al, byte [esi]
fxch st(0)
not byte [ebx - 0x431e123d]
cmp al, 0x73
popfd
cmp byte [edx + 0x3a], al
and al, 0xe4
sub dword [ebx - 0x4f], edx
push ss
das
xchg byte [edi + 0x4a5606e3], al
xor eax, 0x22a94eb
popal
xor ch, byte [ebp + 0x1c]
jae 0x48a6c4
lodsb al, byte [esi]
adc ch, byte [ecx]
pop edi
inc ebx
ror dword [ebx - 0x5acfaa19], 0xd
das
jae 0x48a6b5
pop ebx
jg 0x48a6ba
fisubr dword [edi + edx*2 + 0x53]
jnp 0x48a6d2
push 0x3a
and al, 0x9b
jbe 0x48a6c7
test dword [ebp - 0x3d], ecx
and byte [eax + 0x39], ch
or ebp, dword [ebx - 0x53b1258f]
mov bl, 0xe7
mov edi, 0x2c68f32b
xor dword [eax - 0x53759f4c], ecx
or dword [edx - 0x45425368], ecx
cmc
mov byte [eax - 0x75f65376], dh
cwde
lodsb al, byte [esi]
mov ebp, 0x3372f5ba
mov ah, 0x60
mov ch, byte [ecx + ecx - 0x42536776]
mov edx, 0x473372f5
mov bl, byte [eax - 0xa454254]
jb 0x48a6f5
inc edi
push ebx
xor byte [esi - 0x3e], bl
and dword [ebx], edi
sahf
aam 0xca
mov dword [0x99d246b3], eax
push 0x48e0216b
imul esp, dword [ecx], 0xffffffe0
dec eax
push es
lahf
pop ss
loope 0x48a747
outsb dx, byte [esi]
retf
imul ecx, dword [edx - 0x4a], 0x4f
cmpsb byte [esi], byte es:[edi]
push ds
ret 0x12c0
les esp, [edx - 0x4d]
cmp dword [ebx], esp
and byte [ecx + 0x265ba2f5], ah
js 0x48a6f1
or byte [edi - 0x46b1e30c], ah
mov dword [0x353849b0], eax
adc dword [eax + 0x5f467b09], esi
mov eax, dword cs:[0x23e5b322]
lahf
push esp
mov eax, 0x2a99824
mov bl, 0x1f
xchg esi, eax
call 0xa33593f
xchg edi, eax
vmptrld qword [0x2fc0e63f]
pop esp
int3
Function at 0x499c99
Capabilities:
Encode data using xor

Disassembly:
cmp bl, ah
dec edi
cmpsd dword [esi], dword es:[edi]
fstpnce st(1), st(0)
salc
outsd dx, dword [esi]
push edi
jg 0x499c64
sub byte [ebp + 0x6c], al
mov al, byte [0x16a82f0]
mov bl, 0x37
sub ah, bl
aas
cwde
fst dword [edi]
invalid
das
mov bh, 0x70
call 0x77d10cd0
mov ecx, 0x10230a90
pop ss
pop ecx
cmp eax, 0xe8c7bba0
sbb al, 0x28
invalid
jle 0x499c44
cmp eax, 0x68df190
mov byte [ebp + 0x52], ah
cmp byte [edi], cl
and eax, 0x4a439601
xlatb
push cs
add dword [esi + 0xed74a43], edx
xor al, 0x39
mov eax, 0xce2c0d9
inc esi
lodsb al, byte [esi]
aaa
jno 0x499ca6
sbb dh, bh
mov dh, byte [ebp + 0x5c]
jmp 0x9dbc3be3

Function at 0x4b0d79
Capabilities:
Encode data using xor

Disassembly:
push eax
mov al, 0xeb
adc al, 0x16
fxch st(2)
sub eax, 0xcef57fe9
mov dh, 0xd9
mov eax, 0xc634f827
clc
xor al, 0xc6
pop ss
pop ss
ror dword [edx + 0xdfb5c5], 1
cmp dword [ecx + 0x3e], eax
out 0xed, eax
jl 0x4b0d89
mov dl, 0xe3
shr ebp, 0xe9
pop esi
ljmp 0x42f6

Function at 0x4ba545
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c2380
cmp edx, dword [eax]
je 0x4ba567
add eax, 8
inc ecx
cmp eax, 0x4c2410
jl 0x4ba558
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c2380]
jne 0x4ba695
mov eax, dword [0x4c6d0c]
cmp eax, 1
je 0x4ba66f
test eax, eax
jne 0x4ba598
cmp dword [0x4c22a8], 1
je 0x4ba66f
cmp edx, 0xfc
je 0x4ba695
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4ba5cf
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004baf30
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bb3c0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4ba612
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bb3c0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bf9a4
push edi
call fcn.004bd290
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004baf30
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004baf40
lea eax, [ebp - 0xa0]
push 0x4bf984
push eax
call fcn.004baf40
push dword [esi + 0x4c2384]
lea eax, [ebp - 0xa0]
push eax
call fcn.004baf40
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bd204
add esp, 0x2c
pop edi
jmp 0x4ba695
lea eax, [ebp + 8]
lea esi, [esi + 0x4c2384]
push 0
push eax
push dword [esi]
call fcn.004bb3c0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x6100c98e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x6100c9e8
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x6100c9d9
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x6100c9d5
cmp esi, eax
jae 0x6100c9d9
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x6100c9c7
cmp esi, eax
jb 0x6100c9dd
xor eax, eax
jmp 0x6100c9e7
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop ebp
ret 0xc
Function at 0x61011d8f
Capabilities:
Delete file
Set file attributes

Disassembly:
push 0x14
mov eax, 0x6103d226
call fcn.6102aabe
xor ebx, ebx
mov dword [ebp - 4], ebx
push 0x610039e0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, ebx
mov dword [ebp - 0x20], eax
je 0x61011eb3
push 0x610039c8
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
cmp edi, ebx
je 0x61011e5a
lea ecx, [ebp - 0x18]
call fcn.6100d224
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.6100d224
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.6100d06a
lea ecx, [ebp - 0x10]
call fcn.6100d06a
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 8]
push eax
call fcn.61017dbb
test al, al
je 0x61011e3d
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], ebx
je 0x61011e3d
push ebx
xor esi, esi
inc esi
push esi
push eax
call edi
test eax, eax
je 0x61011e28
mov dword [ebp - 0x14], esi
jmp 0x61011e3d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe000023c
jne 0x61011e3a
mov dword [ebp - 0x14], ebx
jmp 0x61011e3d
mov dword [ebp - 0x1c], esi
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.6100d179
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.6100d179
cmp dword [ebp - 0x1c], ebx
je 0x61011eaa
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ebx, 0x80
push ebx
push dword [ebp + 8]
call esi
push dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
call edi
test eax, eax
je 0x61011eaa
lea ecx, [ebp + 8]
mov dword [ebp - 0x14], 1
call fcn.61011bba
push 0x610039bc
push 0x610039b0
lea ecx, [ebp + 8]
call fcn.61011a65
test eax, eax
je 0x61011eaa
push ebx
push dword [ebp + 8]
call esi
push dword [ebp + 8]
call edi
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.6100d179
mov eax, dword [ebp - 0x14]
call fcn.6102abaa
ret 4

Function at 0x61017013
Capabilities:
Get token membership

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x61047110]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
cmp eax, ebx
mov dword [ebp - 0x10], eax
je 0x6101707d
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x61017074
mov dword [ebp - 0x10], ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
xor ecx, ebp
pop ebx
call fcn.6102aaaa
leave
ret