joyce8/EMBER2024-capa huggingface dataset:
Function at 0x76ef10
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x7839fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [esp + 0x2c]
xor ebp, ebp
mov dword [esp + 0x10], eax
xor ebx, ebx
mov eax, 1
mov ecx, ebx
shl eax, cl
mov ecx, dword [esp + 0x10]
test ecx, eax
je 0x76f002
lea edx, [ebx + 0x41]
lea eax, [esp + 0x14]
push edx
push str._c:_
push eax
call fcn.00772dff
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x76f002
lea edx, [esp + 0x14]
push edx
push str.Mounting__s_n
call fcn.0076a6e0
lea eax, [esp + 0x1c]
lea edi, [esi + 0x1048]
push eax
push edi
mov word [esp + 0x28], bp
call fcn.0077320b
push 0x10
call fcn.007731d3
add esp, 0x14
mov dword [esp + 0x2c], eax
cmp eax, ebp
mov dword [esp + 0x24], ebp
je 0x76efc5
mov cx, word [edi]
push ecx
mov ecx, eax
call fcn.0075f1c0
jmp 0x76efc7
xor eax, eax
push esi
mov dword [esp + 0x28], 0xffffffff
mov dword [esi], eax
call fcn.0076eb80
mov edi, dword [esi]
add esp, 4
cmp edi, ebp
je 0x76eff0
mov ecx, edi
call fcn.0075f2c0
push edi
call fcn.007731c8
add esp, 4
mov edx, dword [esi + 0x1024]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x76f021
inc ebx
cmp ebx, 0x20
jb 0x76ef3e
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x770250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x784808
push 0x774288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x770329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x770329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.007731d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0x770329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0x770329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0x77032c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.00770351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x771000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x771131
push esi
call fcn.00774145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00763080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x771131
push 0
push ebp
call fcn.007633a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00763260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x77108b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.007632f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x771121
push 0x789918
push edi
call fcn.007723f0
push eax
push ebx
push esi
call fcn.00770f60
push 0x7898f8
push edi
call fcn.007723f0
push eax
push ebx
push esi
call fcn.00770f60
push 0x7898d8
push edi
call fcn.007723f0
push eax
push ebx
push esi
call fcn.00770f60
push 0x7898c0
push edi
call fcn.007723f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00770f60
push 0x7898a0
push edi
call fcn.007723f0
push eax
push ebx
push esi
call fcn.00770f60
push 0x789888
push edi
call fcn.007723f0
push eax
push ebx
push esi
call fcn.00770f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x7721b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00772140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00772140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00772140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00772140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x772bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x772c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x78487c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x772c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x772c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x10001940
Capabilities:
Check for debugger via api
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x10048018]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
call fcn.100018a0
test eax, eax
jne 0x10001a3f
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [ebp - 8], 0
jne 0x10001a3f
movaps xmm0, xmmword [0x100421b0]
xor eax, eax
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x28], 0x3e000107
mov dword [ebp - 0x24], 0xb0d011c
mov word [ebp - 0x20], 0x1d1d
mov byte [ebp - 0x1e], 0
mov cl, byte [ebp - 0x38]
xor byte [ebp + eax - 0x37], cl
inc eax
cmp eax, 0x19
jb 0x100019a7
push ebx
mov byte [ebp - 0x1c], 0x67
mov al, 9
xor al, byte [ebp - 0x1c]
mov bl, 0xb
mov ah, bl
mov byte [ebp - 0x1b], al
mov al, byte [ebp - 0x1c]
mov dl, 3
mov bh, ah
mov byte [ebp - 0xd], ah
xor bl, al
mov byte [ebp - 0x12], 0
xor ah, al
mov byte [ebp - 0x1e], 0
xor bh, al
mov byte [ebp - 0x17], ah
mov dh, dl
mov byte [ebp - 0x18], bl
xor dl, al
mov byte [ebp - 0x14], bh
xor dh, al
mov byte [ebp - 0x19], dl
mov cl, 0x13
mov byte [ebp - 0x15], dh
xor cl, al
mov byte [ebp - 0x12], 0
mov ch, 0x49
mov byte [ebp - 0x1a], cl
xor ch, al
mov al, byte [ebp - 0xd]
xor al, byte [ebp - 0x1c]
mov byte [ebp - 0x13], al
lea eax, [ebp - 0x37]
push eax
lea eax, [ebp - 0x1b]
mov byte [ebp - 0x16], ch
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
pop ebx
test eax, eax
je 0x10001a47
push 0
push 4
lea ecx, [ebp - 0xc]
push ecx
push 7
push 0xffffffffffffffff
call eax
test eax, eax
je 0x10001a47
cmp dword [ebp - 0xc], 0
je 0x10001a47
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003c800
mov esp, ebp
pop ebp
ret

Function at 0x10001a60
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movaps xmm0, xmmword [0x100426d0]
xor ecx, ecx
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x1c], 0x415b7751
mov dword [ebp - 0x18], 0x4651405a
mov byte [ebp - 0x14], 0
mov al, byte [ebp - 0x2c]
xor byte [ebp + ecx - 0x2b], al
inc ecx
cmp ecx, 0x17
jb 0x10001a85
mov byte [ebp - 0x14], 0
mov cl, 0x55
mov dword [ebp - 0x10], 0x27303e55
xor eax, eax
mov dword [ebp - 0xc], 0x6639303b
mov dword [ebp - 8], 0x39317b67
mov word [ebp - 4], 0x39
xor byte [ebp + eax - 0xf], cl
inc eax
cmp eax, 0xc
jae 0x10001ac4
mov cl, byte [ebp - 0x10]
jmp 0x10001ab5
lea eax, [ebp - 0x2b]
mov byte [ebp - 3], 0
push eax
lea eax, [ebp - 0xf]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
call fcn.1000e320
cmp al, 0xe9
jne 0x10001af0
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esp, ebp
pop ebp
ret
Function at 0x10001b00
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov cl, 0x59
mov dword [ebp - 0x10], 0x34302d59
mov dword [ebp - 0xc], 0x2d3c1e3c
xor eax, eax
mov dword [ebp - 8], 0x3c34300d
mov byte [ebp - 4], 0
xor byte [ebp + eax - 0xf], cl
inc eax
cmp eax, 0xb
jae 0x10001b32
mov cl, byte [ebp - 0x10]
jmp 0x10001b23
mov byte [ebp - 4], 0
mov cl, 5
mov dword [ebp - 0x20], 0x77606e05
xor eax, eax
mov dword [ebp - 0x1c], 0x3669606b
mov dword [ebp - 0x18], 0x69612b37
mov word [ebp - 0x14], 0x69
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 0xc
jae 0x10001b64
mov cl, byte [ebp - 0x20]
jmp 0x10001b55
lea eax, [ebp - 0xf]
mov byte [ebp - 0x13], 0
push eax
lea eax, [ebp - 0x1f]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
call fcn.1000e320
cmp al, 0xe9
jne 0x10001b90
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esp, ebp
pop ebp
ret

Function at 0x10001ba0
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov cl, 0x39
mov dword [ebp - 0x10], 0x4d5c7e39
mov dword [ebp - 0xc], 0x525a506d
xor eax, eax
mov dword [ebp - 8], 0x574c567a
mov word [ebp - 4], 0x4d
xor byte [ebp + eax - 0xf], cl
inc eax
cmp eax, 0xc
jae 0x10001bd4
mov cl, byte [ebp - 0x10]
jmp 0x10001bc5
mov byte [ebp - 3], 0
mov cl, 0x4b
mov dword [ebp - 0x20], 0x392e204b
xor eax, eax
mov dword [ebp - 0x1c], 0x78272e25
mov dword [ebp - 0x18], 0x272f6579
mov word [ebp - 0x14], 0x27
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 0xc
jae 0x10001c06
mov cl, byte [ebp - 0x20]
jmp 0x10001bf7
lea eax, [ebp - 0xf]
mov byte [ebp - 0x13], 0
push eax
lea eax, [ebp - 0x1f]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
call fcn.1000e320
cmp al, 0xe9
jne 0x10001c32
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esp, ebp
pop ebp
ret

Function at 0x10001c40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10048018]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [str._l_JN_J]
xor eax, eax
movups xmmword [ebp - 0x28], xmm0
nop dword [eax]
mov cl, byte [ebp - 0x28]
xor byte [ebp + eax - 0x27], cl
inc eax
cmp eax, 0xe
jb 0x10001c60
mov byte [ebp - 0x19], 0
mov cl, 0x21
mov dword [ebp - 0x18], 0x73646a21
xor eax, eax
mov dword [ebp - 0x14], 0x126d646f
mov dword [ebp - 0x10], 0x4d450f13
mov word [ebp - 0xc], 0x4d
xor byte [ebp + eax - 0x17], cl
inc eax
cmp eax, 0xc
jae 0x10001c9f
mov cl, byte [ebp - 0x18]
jmp 0x10001c90
lea eax, [ebp - 0x27]
mov byte [ebp - 0xb], 0
push eax
lea eax, [ebp - 0x17]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 1
lea ecx, [ebp - 5]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp byte [ebp - 5], 0xe9
mov ecx, dword [ebp - 4]
sete al
xor ecx, ebp
call fcn.1003c800
mov esp, ebp
pop ebp
ret
Function at 0x10001cf0
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10043d20
push 0x1003d6c7
mov eax, dword fs:[0]
push eax
add esp, 0xffffffc0
mov eax, dword [0x10048018]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x48], 0
xor eax, eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 0x48]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x40
push 0x3000
mov edx, dword [ebp - 0x44]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x10001d89
xor al, al
jmp 0x10001e12
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x50]
mov byte [ecx], 0xc3
lea edx, [ebp - 0x20]
push edx
push 0x140
mov eax, dword [ebp - 0x44]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10001db4
xor al, al
jmp 0x10001e12
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x24]
push 0x10001dff
jmp eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1003c800
mov esp, ebp
pop ebp
ret
Function at 0x100023b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movaps xmm0, xmmword [0x10042250]
xor ecx, ecx
movups xmmword [ebp - 0x14], xmm0
mov word [ebp - 4], 0x3a34
mov byte [ebp - 2], 0
nop dword [eax]
mov al, byte [ebp - 0x14]
xor byte [ebp + ecx - 0x13], al
inc ecx
cmp ecx, 0x11
jb 0x100023d0
lea eax, [ebp - 0x13]
mov byte [ebp - 2], 0
push eax
call fcn.100027f0
cmp eax, 0xba2d38a3
je 0x100023f7
xor al, al
mov esp, ebp
pop ebp
ret
movaps xmm0, xmmword [0x10041fa0]
xor ecx, ecx
movups xmmword [ebp - 0x14], xmm0
mov al, byte [ebp - 0x14]
xor byte [ebp + ecx - 0x13], al
inc ecx
cmp ecx, 0xe
jb 0x10002404
lea eax, [ebp - 0x13]
mov byte [ebp - 5], 0
push eax
call fcn.100027f0
cmp eax, 0x27b35bb1
sete al
mov esp, ebp
pop ebp
ret
Function at 0x100026b0
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x400
push 0
push 0x10049eb8
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 4], ecx
push ebx
nop
xor eax, eax
test cl, 1
je 0x100026db
bts eax, 7
shr ecx, 1
test cl, 1
je 0x100026e6
bts eax, 6
shr ecx, 1
test cl, 1
je 0x100026f1
bts eax, 5
shr ecx, 1
test cl, 1
je 0x100026fc
bts eax, 4
shr ecx, 1
test cl, 1
je 0x10002707
bts eax, 3
shr ecx, 1
test cl, 1
je 0x10002712
bts eax, 2
shr ecx, 1
test cl, 1
je 0x1000271d
bts eax, 1
test cl, 2
je 0x10002726
bts eax, 0
shl eax, 0x18
mov ecx, eax
add eax, eax
sar ecx, 0x1f
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov ebx, ecx
sar ebx, 0x1f
and ebx, 0x4c11db7
lea eax, [ecx + ecx]
xor ebx, eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax*4 + 0x10049eb8], ebx
lea ecx, [edx + 1]
test bl, 1
je 0x100027c6
mov eax, 0x20
sub eax, ecx
bts edx, eax
inc ecx
shr ebx, 1
cmp ecx, 0x21
jl 0x100027b7
mov ecx, dword [ebp - 4]
mov dword [ecx*4 + 0x10049eb8], edx
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0xff
jle 0x100026d0
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100027f0
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x10048018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push 0x100417c8
push eax
lea eax, [ebp - 0x408]
mov dword [ebp - 0x408], 0
push eax
or ebx, 0xffffffff
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
add esp, 0xc
test eax, eax
jne 0x100028cf
mov eax, dword [ebp - 0x408]
test eax, eax
je 0x100028cf
push edi
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
push eax
push 0x400
lea eax, [ebp - 0x404]
push 1
push eax
call edi
mov edx, eax
add esp, 0x10
test edx, edx
je 0x100028aa
push esi
lea esi, [ebp - 0x404]
test edx, edx
je 0x1000288a
nop dword [eax]
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x10049eb8]
sub edx, 1
jne 0x10002870
push dword [ebp - 0x408]
lea eax, [ebp - 0x404]
push 0x400
push 1
push eax
call edi
mov edx, eax
add esp, 0x10
test edx, edx
jne 0x10002862
pop esi
push dword [ebp - 0x408]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
not ebx
mov eax, ebx
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003c800
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
xor ecx, ebp
pop ebx
call fcn.1003c800
mov esp, ebp
pop ebp
ret 4
Function at 0x100042a0
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
call fcn.100026b0
call fcn.10001f20
test al, al
je 0x100042d2
call fcn.100023b0
test al, al
je 0x100042d2
call fcn.10002430
test al, al
je 0x100042d2
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
call fcn.10007e50
call fcn.10007f30
call fcn.1000f940
mov dword [0x1004a334], eax
test eax, eax
je 0x100042f9
mov ecx, eax
call fcn.1000fb30
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x10003e60
push 0
push 0
mov dword [0x1004a2c0], eax
mov dword [0x1004a2c4], edx
mov dword [0x1004a2d0], eax
mov dword [0x1004a2d4], edx
call esi
mov ebx, eax
test ebx, ebx
jne 0x1000433a
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
push 0
push 0
push 0
push 0x10004160
push 0
push 0
call esi
mov edi, eax
test edi, edi
jne 0x10004359
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x64
push ebx
call esi
push 0x64
push edi
call esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call esi
push edi
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10007e50
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10048018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
push esi
push edi
test eax, eax
jne 0x10007e6e
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 1
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
cmp edi, 0xffffffff
je 0x10007f11
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push eax
push 0x28
push edi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x10007f11
mov esi, dword [ebp - 0x18]
lea eax, [ebp - 0x10]
push eax
push str.SeSecurityPrivilege
push 0
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x10007f11
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x10007f11
push ecx
mov ecx, dword [ebp - 0x18]
mov edx, str.SeDebugPrivilege
call fcn.10007de0
add esp, 4
test al, al
je 0x10007f11
push dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call esi
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003c800
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
xor ecx, ebp
pop esi
call fcn.1003c800
mov esp, ebp
pop ebp
ret
Function at 0x10007f30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x10048018]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20]
push eax
push 0xf01ff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x10007f9e
movaps xmm0, xmmword [0x10041d80]
xor ecx, ecx
movups xmmword [ebp - 0x34], xmm0
mov word [ebp - 0x24], 2
nop dword [eax]
mov al, byte [ebp - 0x34]
xor byte [ebp + ecx - 0x33], al
inc ecx
cmp ecx, 0x10
jb 0x10007f70
lea eax, [ebp - 0xc]
mov byte [ebp - 0x23], 0
push eax
lea eax, [ebp - 0x33]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x10007fae
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003c800
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
push 0
push 0
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
push 0x10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push eax
push 0
push dword [ebp - 0x20]
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [ebp - 0x20]
test eax, eax
je 0x10007f98
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
call fcn.1003c800
mov esp, ebp
pop ebp
ret