joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418a12
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xcc
mov eax, 0x48cdd7
call fcn.0045a8bb
mov esi, ecx
and dword [ebp - 0xcc], 0
lea edi, [esi + 4]
mov ebx, 0x494779
push ebx
call fcn.004137d0
pop ecx
push eax
push ebx
mov ecx, edi
call fcn.0041034f
push dword [ebp + 0xc]
mov ecx, esi
call fcn.0041a32b
push 0
sub esp, 0xc
mov dword [ebp - 0xc8], 0x78516951
mov ecx, esp
mov dword [ebp - 0xc4], 0x51675164
lea eax, [ebp + 0xf]
mov dword [ebp - 0xc0], 0x48596a4d
lea edx, [ebp - 0xe]
mov dword [ebp - 0xbc], 0x4d596842
push eax
push edx
lea esi, [ebp - 0xc8]
mov dword [ebp - 0xb8], 0x2b4e4346
push esi
mov dword [ebp - 0xb4], 0x50674250
mov dword [ebp - 0xb0], 0x5541514c
mov dword [ebp - 0xac], 0x6a6b4266
mov dword [ebp - 0xa8], 0x534d675a
mov dword [ebp - 0xa4], 0x3245484f
mov dword [ebp - 0xa0], 0x46734363
mov dword [ebp - 0x9c], 0x33496848
mov dword [ebp - 0x98], 0x42386948
mov dword [ebp - 0x94], 0x656f6946
mov dword [ebp - 0x90], 0x6b6b7742
mov dword [ebp - 0x8c], 0x3639514c
mov dword [ebp - 0x88], 0x7139674b
mov dword [ebp - 0x84], 0x6e685348
mov dword [ebp - 0x80], 0x3063695a
mov dword [ebp - 0x7c], 0x4a345345
mov dword [ebp - 0x78], 0x504d684d
mov dword [ebp - 0x74], 0x7a55674a
mov dword [ebp - 0x70], 0x70387750
mov dword [ebp - 0x6c], 0x72386a4b
mov dword [ebp - 0x68], 0x3156484e
mov dword [ebp - 0x64], 0x45776a4e
mov dword [ebp - 0x60], 0x78556961
mov dword [ebp - 0x5c], 0x6d737a66
mov dword [ebp - 0x58], 0x51386862
mov dword [ebp - 0x54], 0x654d5149
mov dword [ebp - 0x50], 0x3742694a
mov dword [ebp - 0x4c], 0x6d49324f
mov dword [ebp - 0x48], 0x31516846
mov dword [ebp - 0x44], 0x42736742
mov dword [ebp - 0x40], 0x514d6944
mov dword [ebp - 0x3c], 0x30636d4c
mov dword [ebp - 0x38], 0x79456966
mov dword [ebp - 0x34], 0x51345248
mov dword [ebp - 0x30], 0x39384250
mov dword [ebp - 0x2c], 0x45734341
mov dword [ebp - 0x28], 0x346b4150
mov dword [ebp - 0x24], 0x7a4a7944
mov dword [ebp - 0x20], 0x6f734450
mov dword [ebp - 0x1c], 0x4d51774c
mov dword [ebp - 0x18], 0x6c49694c
mov dword [ebp - 0x14], 0x41414141
mov word [ebp - 0x10], 0x6768
call fcn.0040a169
lea eax, [ebp - 0xd8]
push eax
call fcn.0040b50d
add esp, 0x10
and dword [ebp - 4], 0
mov ecx, eax
call fcn.004103c8
mov esi, eax
push esi
call fcn.004137d0
pop ecx
push eax
push esi
mov ecx, edi
call fcn.0040d6bc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd8]
call fcn.00455078
mov ecx, dword [ebp + 8]
push edi
call fcn.0040a004
mov eax, dword [ebp + 8]
call fcn.0045a889
ret 8
Function at 0x418c34
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x40
mov eax, 0x48cdfd
call fcn.0045a8bb
mov esi, ecx
and dword [ebp - 0x10], 0
lea edi, [esi + 0x10]
mov ebx, 0x494779
push ebx
call fcn.004137d0
pop ecx
push eax
push ebx
mov ecx, edi
call fcn.0041034f
push ebx
mov byte [esi + 0x48], 0
call fcn.004137d0
pop ecx
push eax
push ebx
lea ecx, [esi + 0x28]
call fcn.0041034f
push dword [ebp + 0xc]
mov ecx, esi
call fcn.0041a15b
push dword [ebp + 0xc]
mov ecx, esi
call fcn.0041ba6b
push dword [ebp + 0xc]
mov ecx, esi
call fcn.00419a22
push 0
sub esp, 0xc
mov dword [ebp - 0x4c], 0x2f4e6751
mov ecx, esp
mov dword [ebp - 0x48], 0x4a45474e
lea eax, [ebp + 0xf]
mov dword [ebp - 0x44], 0x4c496a43
lea edx, [ebp - 0x1e]
mov dword [ebp - 0x40], 0x5334514b
push eax
push edx
lea esi, [ebp - 0x4c]
mov dword [ebp - 0x3c], 0x6c77794f
push esi
mov dword [ebp - 0x38], 0x39306a49
mov dword [ebp - 0x34], 0x7034444d
mov dword [ebp - 0x30], 0x375a7850
mov dword [ebp - 0x2c], 0x4b30684f
mov dword [ebp - 0x28], 0x6a4e5250
mov dword [ebp - 0x24], 0x41414141
mov word [ebp - 0x20], 0x5148
call fcn.0040a169
lea eax, [ebp - 0x1c]
push eax
call fcn.0040b50d
add esp, 0x10
and dword [ebp - 4], 0
mov ecx, eax
call fcn.004103c8
mov esi, eax
push esi
call fcn.004137d0
pop ecx
push eax
push esi
mov ecx, edi
call fcn.0040d6bc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00455078
mov ecx, dword [ebp + 8]
push edi
call fcn.0040a004
mov eax, dword [ebp + 8]
call fcn.0045a889
ret 8
Function at 0x41a15b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xa8
mov eax, 0x48cf3b
call fcn.0045a8bb
mov edi, ecx
mov ecx, dword [ebp + 8]
xor esi, esi
push esi
call fcn.00413247
test al, al
je 0x41a2e3
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0xb4]
push esi
push eax
call fcn.00413119
push eax
lea eax, [ebp - 0x9c]
mov dword [ebp - 4], esi
push eax
call fcn.004138fa
pop ecx
pop ecx
push 0xffffffffffffffff
push esi
push eax
lea ecx, [edi + 0x10]
mov byte [ebp - 4], 1
call fcn.0040d5b5
push esi
push 1
lea ecx, [ebp - 0x9c]
call fcn.0040d2aa
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb4]
push esi
push 1
call fcn.0040d2aa
push esi
sub esp, 0xc
mov dword [ebp - 0x78], 0x34706851
mov ecx, esp
mov dword [ebp - 0x74], 0x746b5247
lea eax, [ebp + 0xb]
mov dword [ebp - 0x70], 0x7230434d
lea edx, [ebp - 0xd]
mov dword [ebp - 0x6c], 0x41735846
push eax
push edx
lea esi, [ebp - 0x78]
mov dword [ebp - 0x68], 0x6941444d
push esi
mov dword [ebp - 0x64], 0x666f7a44
mov dword [ebp - 0x60], 0x77526a63
mov dword [ebp - 0x5c], 0x2f495144
mov dword [ebp - 0x58], 0x38555742
mov dword [ebp - 0x54], 0x48635143
mov dword [ebp - 0x50], 0x74384848
mov dword [ebp - 0x4c], 0x526b684b
mov dword [ebp - 0x48], 0x73385143
mov dword [ebp - 0x44], 0x2f675348
mov dword [ebp - 0x40], 0x68305344
mov dword [ebp - 0x3c], 0x3577574d
mov dword [ebp - 0x38], 0x56307948
mov dword [ebp - 0x34], 0x53455249
mov dword [ebp - 0x30], 0x2b516d5a
mov dword [ebp - 0x2c], 0x37386747
mov dword [ebp - 0x28], 0x69595466
mov dword [ebp - 0x24], 0x6d676845
mov dword [ebp - 0x20], 0x38594847
mov dword [ebp - 0x1c], 0x2f5a6943
mov dword [ebp - 0x18], 0x4f635163
mov dword [ebp - 0x14], 0x4141674a
mov word [ebp - 0x10], 0x4541
mov byte [ebp - 0xe], 0x73
call fcn.0040a169
lea eax, [ebp - 0x84]
push eax
call fcn.0040b50d
add esp, 0x10
mov ecx, eax
mov dword [ebp - 4], 2
call fcn.004103c8
mov esi, eax
push esi
call fcn.004137d0
pop ecx
push eax
push esi
lea ecx, [edi + 0x10]
call fcn.0040d6bc
lea ecx, [ebp - 0x84]
call fcn.00455078
call fcn.0045a889
ret 4
Function at 0x4205c7
Capabilities:
Set current directory

Disassembly:
push 8
mov eax, 0x48d7d6
call fcn.0045a8bb
mov edi, ecx
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x14], edi
and dword [ebp - 4], 0
push eax
push dword [ebp + 0x1c]
mov eax, dword [ebp + 0xc]
push dword [ebp + 0x18]
add eax, 0xfffffff0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ecx
mov esi, esp
push eax
call fcn.004291c0
pop ecx
push dword [ebp + 8]
add eax, 0x10
mov ecx, edi
mov dword [esi], eax
call fcn.00422dc5
mov al, byte [ebp + 0x20]
and dword [ebp - 0x10], 0
mov byte [ebp - 4], 1
mov dword [edi], 0x494e1c
mov byte [edi + 0x100], al
call fcn.0040b8e5
push eax
lea ecx, [ebp - 0x10]
call fcn.00409d6c
mov esi, 0x104
mov byte [ebp - 4], 2
push esi
lea ecx, [ebp - 0x10]
call fcn.0040bb05
push esi
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push eax
lea ecx, [ebp - 0x10]
call fcn.0040bcb0
mov ecx, edi
call fcn.00440f13
mov esi, dword [ebp - 0x10]
neg al
sbb al, al
inc al
mov byte [edi + 0x53], al
je 0x420671
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea ecx, [esi - 0x10]
call fcn.0040bc6b
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.0040bc6b
mov eax, edi
call fcn.0045a889
ret 0x20
Function at 0x42554e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xc8
mov eax, 0x48ebe0
call fcn.0045a8ee
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0xc4], ebx
call fcn.0040b8e5
push eax
lea ecx, [ebp - 0xc4]
call fcn.00409d6c
push dword [ebp + 8]
lea eax, [ebp - 0xc5]
mov dword [ebp - 4], ebx
push ebx
sub esp, 0xc
mov dword [ebp - 0xbc], 0x386c5462
mov ecx, esp
mov dword [ebp - 0xb8], 0x46517942
lea edx, [ebp - 0x10]
mov dword [ebp - 0xb4], 0x71516e4a
lea esi, [ebp - 0xbc]
mov dword [ebp - 0xb0], 0x7970544b
push eax
push edx
push esi
mov dword [ebp - 0xac], 0x6634774e
mov dword [ebp - 0xa8], 0x2b4a5766
mov dword [ebp - 0xa4], 0x31307a4c
mov dword [ebp - 0xa0], 0x76356a4a
mov dword [ebp - 0x9c], 0x78775246
mov dword [ebp - 0x98], 0x2f41584d
mov dword [ebp - 0x94], 0x79515866
mov dword [ebp - 0x90], 0x73416843
mov dword [ebp - 0x8c], 0x63594145
mov dword [ebp - 0x88], 0x61734145
mov dword [ebp - 0x84], 0x33706964
mov dword [ebp - 0x80], 0x67564164
mov dword [ebp - 0x7c], 0x52456846
mov dword [ebp - 0x78], 0x68565766
mov dword [ebp - 0x74], 0x6e355242
mov dword [ebp - 0x70], 0x364d784d
mov dword [ebp - 0x6c], 0x3956545a
mov dword [ebp - 0x68], 0x4e637849
mov dword [ebp - 0x64], 0x4c556a48
mov dword [ebp - 0x60], 0x79597a4e
mov dword [ebp - 0x5c], 0x48497a46
mov dword [ebp - 0x58], 0x55303245
mov dword [ebp - 0x54], 0x4d34434a
mov dword [ebp - 0x50], 0x37647a45
mov dword [ebp - 0x4c], 0x4563794d
mov dword [ebp - 0x48], 0x68687966
mov dword [ebp - 0x44], 0x39557747
mov dword [ebp - 0x40], 0x33356a4c
mov dword [ebp - 0x3c], 0x2b494847
mov dword [ebp - 0x38], 0x48514364
mov dword [ebp - 0x34], 0x7959414e
mov dword [ebp - 0x30], 0x37634163
mov dword [ebp - 0x2c], 0x70495149
mov dword [ebp - 0x28], 0x2f416d46
mov dword [ebp - 0x24], 0x42455247
mov dword [ebp - 0x20], 0x70515145
mov dword [ebp - 0x1c], 0x785a5242
mov dword [ebp - 0x18], 0x41677942
mov dword [ebp - 0x14], 0x37424141
call fcn.0040a169
lea eax, [ebp - 0xd4]
push eax
call fcn.0042a1df
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.004103eb
push eax
lea eax, [ebp - 0xc4]
push eax
call fcn.0042b625
add esp, 0xc
mov byte [ebp - 4], bl
lea ecx, [ebp - 0xd4]
call fcn.00455078
mov esi, dword [ebp - 0xc4]
lea ecx, [ebp - 0xc0]
push esi
call fcn.00409dd5
lea eax, [ebp - 0xc0]
mov byte [ebp - 4], 2
push eax
lea ecx, [edi + 4]
call fcn.00456bd8
mov ecx, dword [ebp - 0xc0]
lea ecx, [ecx - 0x10]
call fcn.0040bc6b
lea ecx, [esi - 0x10]
call fcn.0040bc6b
call fcn.0045a89d
ret 4
Function at 0x42a0a8
Capabilities:
Encode data using xor

Disassembly:
push 0x30
mov eax, 0x48c23e
call fcn.0045a8ee
mov ebx, dword [ebp + 8]
xor edx, edx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x3c], edx
mov edi, ebx
mov dword [ebp - 0x28], edx
xor eax, eax
xor ecx, ecx
inc ecx
mov esi, edx
mov dword [ebp - 4], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebx], edx
mov dword [ebx + 4], edx
mov dword [ebx + 8], edx
xor eax, eax
mov dword [ebp - 0x3c], ecx
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
xor eax, eax
lea edi, [ebp - 0x34]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edx
lea eax, [ebp - 0x1d]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 0x1d], dl
call fcn.0041424a
lea eax, [ebp - 0x1c]
push eax
push esi
lea ecx, [ebp + 0xc]
call fcn.004103c8
push ecx
mov ecx, esp
push eax
call fcn.00409d95
call fcn.0042b745
mov edx, dword [ebp - 0x1c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x18]
mov eax, ecx
sub eax, edx
mov dword [ebp - 0x24], eax
je 0x42a17d
push dword [ebp - 0x38]
and dword [ebp - 0x30], esi
lea eax, [ecx - 4]
push ecx
push eax
lea ecx, [ebp - 0x34]
call fcn.00409359
push dword [ebp - 0x38]
push dword [ebp - 0x30]
push dword [ebp - 0x34]
call fcn.004099ec
lea eax, [ebp - 0x34]
mov ecx, esp
push eax
call fcn.0040a125
call fcn.00426bfe
mov edx, dword [ebp - 0x1c]
add esp, 0xc
add eax, 4
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
xor edi, edi
sub eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
je 0x42a1b0
mov al, byte [edx + edi]
mov ecx, ebx
xor al, byte [esi + str.HLHMQBSBDBLJCAFDUMGDGIPVVSSKIQ]
mov byte [ebp - 0x1d], al
lea eax, [ebp - 0x1d]
push eax
call fcn.0041424a
mov edx, dword [ebp - 0x1c]
inc esi
xor eax, eax
cmp esi, 0x1e
cmovge esi, eax
inc edi
cmp edi, dword [ebp - 0x24]
jb 0x42a187
lea eax, [ebp - 0x1d]
mov byte [ebp - 0x1d], 0
push eax
mov ecx, ebx
call fcn.0041424a
lea ecx, [ebp - 0x34]
call fcn.00455078
lea ecx, [ebp - 0x1c]
call fcn.00455078
lea ecx, [ebp + 0xc]
call fcn.00455078
mov eax, ebx
call fcn.0045a89d
ret
Function at 0x42a1df
Capabilities:
Encode data using xor

Disassembly:
push 0x30
mov eax, 0x48c23e
call fcn.0045a8ee
mov ebx, dword [ebp + 8]
xor edx, edx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x3c], edx
mov edi, ebx
mov dword [ebp - 0x20], edx
xor eax, eax
xor ecx, ecx
inc ecx
mov esi, edx
mov dword [ebp - 4], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebx], edx
mov dword [ebx + 4], edx
mov dword [ebx + 8], edx
xor eax, eax
mov dword [ebp - 0x3c], ecx
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
xor eax, eax
lea edi, [ebp - 0x34]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edx
lea eax, [ebp - 0x21]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 0x21], dl
call fcn.0041424a
lea eax, [ebp - 0x1c]
push eax
push esi
lea ecx, [ebp + 0xc]
call fcn.004103c8
push ecx
mov ecx, esp
push eax
call fcn.00409d95
call fcn.0042b745
mov edx, dword [ebp - 0x1c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x18]
mov eax, ecx
sub eax, edx
mov dword [ebp - 0x28], eax
je 0x42a2b4
push dword [ebp - 0x38]
and dword [ebp - 0x30], esi
lea eax, [ecx - 4]
push ecx
push eax
lea ecx, [ebp - 0x34]
call fcn.00409359
push dword [ebp - 0x38]
push dword [ebp - 0x30]
push dword [ebp - 0x34]
call fcn.004099ec
lea eax, [ebp - 0x34]
mov ecx, esp
push eax
call fcn.0040a125
call fcn.00426bfe
mov edx, dword [ebp - 0x1c]
add esp, 0xc
add eax, 4
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x28]
xor edi, edi
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
je 0x42a2ec
mov al, byte [edx + edi]
mov ecx, ebx
xor al, byte [esi + str.HLHMQBSBDBLJCAFDUMGDGIPVVSSKIQ]
cbw
movzx eax, ax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
call fcn.00414391
mov edx, dword [ebp - 0x1c]
inc esi
xor eax, eax
cmp esi, 0x1e
cmovge esi, eax
inc edi
cmp edi, dword [ebp - 0x28]
jb 0x42a2be
and dword [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
mov ecx, ebx
call fcn.00414391
lea ecx, [ebp - 0x34]
call fcn.00455078
lea ecx, [ebp - 0x1c]
call fcn.00455078
lea ecx, [ebp + 0xc]
call fcn.00455078
mov eax, ebx
call fcn.0045a89d
ret
Function at 0x42b694
Capabilities:
Decode data using base64 via winapi

Disassembly:
push 0xc
mov eax, 0x48c26b
call fcn.0045a8ee
mov dword [ebp - 0x18], ecx
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x14]
mov esi, dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
xor edx, edx
push edx
push edx
push ecx
push edx
push 1
push dword [eax - 0xc]
mov dword [ebp - 4], edx
push eax
call esi
test eax, eax
je 0x42b6fe
push dword [ebp - 0x14]
call fcn.00457bd7
push dword [ebp - 0x14]
mov ebx, eax
push 0
push ebx
call fcn.0045d120
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x14]
add esp, 0x10
push 0
push 0
push eax
push ebx
push 1
push dword [ecx - 0xc]
push ecx
call esi
test eax, eax
jne 0x42b70f
push ebx
call fcn.0045a60a
pop ecx
mov ecx, edi
call fcn.0040b7b5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x42b730
mov ecx, dword [ebp - 0x18]
push edi
push dword [ebp - 0x14]
push ebx
call fcn.0042b7d3
mov esi, eax
test esi, esi
je 0x42b729
mov ecx, edi
call fcn.0040b7b5
push ebx
call fcn.0045a60a
pop ecx
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0040bc6b
mov eax, esi
call fcn.0045a89d
ret 8

Function at 0x42b745
Capabilities:
Decode data using base64 via winapi

Disassembly:
push 0xc
mov eax, 0x48c26b
call fcn.0045a8ee
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x18], esi
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [eax - 0xc], ebx
je 0x42b7c0
push ebx
push ebx
lea ecx, [ebp - 0x14]
push ecx
push ebx
push 1
push dword [eax - 0xc]
push eax
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
jne 0x42b782
mov eax, dword [esi]
mov dword [esi + 4], eax
jmp 0x42b7b8
push dword [ebp - 0x14]
mov ecx, esi
call fcn.00415e7f
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
push ebx
push ebx
mov esi, dword [edi - 0xc]
push eax
push ebx
call fcn.004103c8
push eax
push 1
push esi
push edi
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
jne 0x42b7c0
mov ecx, dword [ebp - 0x18]
mov eax, dword [ecx]
mov dword [ecx + 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0040bc6b
mov eax, ebx
call fcn.0045a89d
ret
Function at 0x42b7d3
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push 0x114
mov eax, 0x48f331
call fcn.0045a8ee
mov ebx, ecx
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x18], eax
lea eax, [edi + 1]
mov dword [ebp - 0x14], edi
push eax
call fcn.00457bd7
push dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
push 0
push eax
call fcn.0045d120
push edi
push esi
push dword [ebp - 0x14]
mov esi, dword [ebp - 0x1c]
push esi
call fcn.0045a224
add esp, 0x20
mov dword [ebp - 0x14], edi
lea eax, [ebp - 0x14]
push eax
push esi
push 0
push 1
push 0
push dword [ebx + 8]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x42b84d
push esi
call fcn.0045a60a
pop ecx
mov ecx, dword [ebp - 0x18]
call fcn.0040b7b5
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x42b8b3
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x120]
push 0xfde9
push esi
mov byte [esi + eax], 0
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x120], eax
call fcn.0043d8c2
push dword [ebp - 0x120]
and dword [ebp - 4], 0
call fcn.0040be23
pop ecx
mov ecx, dword [ebp - 0x18]
push eax
push dword [ebp - 0x120]
call fcn.0040bd90
lea eax, [ebp - 0x11c]
cmp dword [ebp - 0x120], eax
je 0x42b8aa
push dword [ebp - 0x120]
call fcn.0045a540
pop ecx
push esi
call fcn.0045a60a
pop ecx
xor eax, eax
call fcn.0045a89d
ret 0xc

Function at 0x42b8bb
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push 0x114
mov eax, 0x48f331
call fcn.0045a8ee
mov ebx, ecx
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x18], eax
lea eax, [edi + 1]
mov dword [ebp - 0x14], edi
push eax
call fcn.00457bd7
push dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
push 0
push eax
call fcn.0045d120
push edi
push esi
push dword [ebp - 0x14]
mov esi, dword [ebp - 0x1c]
push esi
call fcn.0045a224
add esp, 0x20
mov dword [ebp - 0x14], edi
lea eax, [ebp - 0x14]
push eax
push esi
push 0
push 1
push 0
push dword [ebx + 4]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x42b935
push esi
call fcn.0045a60a
pop ecx
mov ecx, dword [ebp - 0x18]
call fcn.0040b7b5
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x42b99b
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x120]
push 0xfde9
push esi
mov byte [esi + eax], 0
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x120], eax
call fcn.0043d8c2
push dword [ebp - 0x120]
and dword [ebp - 4], 0
call fcn.0040be23
pop ecx
mov ecx, dword [ebp - 0x18]
push eax
push dword [ebp - 0x120]
call fcn.0040bd90
lea eax, [ebp - 0x11c]
cmp dword [ebp - 0x120], eax
je 0x42b992
push dword [ebp - 0x120]
call fcn.0045a540
pop ecx
push esi
call fcn.0045a60a
pop ecx
xor eax, eax
call fcn.0045a89d
ret 0xc
Function at 0x42ba39
Capabilities:
Enumerate processes

Disassembly:
push 0x238
mov eax, 0x48f364
call fcn.0045a8ee
mov ebx, dword [ebp + 0xc]
xor esi, esi
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x244], eax
mov eax, dword [ebx]
push 2
mov dword [ebx + 4], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x42bae9
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x23c], 0x22c
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x42bae9
lea eax, [ebp - 0x218]
mov dword [ebp - 0x240], esi
push eax
lea ecx, [ebp - 0x240]
call fcn.00409dd5
push dword [ebp - 0x244]
lea ecx, [ebp - 0x240]
mov dword [ebp - 4], esi
call fcn.00429365
test eax, eax
jne 0x42bac3
lea eax, [ebp - 0x234]
mov ecx, ebx
push eax
call fcn.00456b83
mov ecx, dword [ebp - 0x240]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.0040bc6b
lea eax, [ebp - 0x23c]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x42ba85
xor esi, esi
inc esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
call fcn.0045a89d
ret
Function at 0x42fcb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x94
mov eax, 0x48f8cb
call fcn.0045a8ee
xor esi, esi
mov dword [ebp - 0x8c], 0x4e55685a
lea eax, [ebp - 0x14]
mov dword [ebp - 4], esi
push eax
push esi
sub esp, 0xc
mov dword [ebp - 0x14], esi
mov ecx, esp
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x8d]
mov dword [ebp - 0x88], 0x31305249
lea edx, [ebp - 0x19]
mov dword [ebp - 0x84], 0x544d5448
push eax
push edx
lea edi, [ebp - 0x8c]
mov dword [ebp - 0x80], 0x36355248
push edi
mov dword [ebp - 0x7c], 0x5751534c
mov dword [ebp - 0x78], 0x4f556d43
mov dword [ebp - 0x74], 0x314d7849
mov dword [ebp - 0x70], 0x6a78784c
mov dword [ebp - 0x6c], 0x51775248
mov dword [ebp - 0x68], 0x6555674c
mov dword [ebp - 0x64], 0x62455365
mov dword [ebp - 0x60], 0x494d6847
mov dword [ebp - 0x5c], 0x4f517a59
mov dword [ebp - 0x58], 0x5a55524a
mov dword [ebp - 0x54], 0x7a745146
mov dword [ebp - 0x50], 0x305a7a4d
mov dword [ebp - 0x4c], 0x58457a4d
mov dword [ebp - 0x48], 0x43494445
mov dword [ebp - 0x44], 0x6d4d4759
mov dword [ebp - 0x40], 0x63304842
mov dword [ebp - 0x3c], 0x776c4142
mov dword [ebp - 0x38], 0x4c674366
mov dword [ebp - 0x34], 0x2b4d6842
mov dword [ebp - 0x30], 0x2b34774a
mov dword [ebp - 0x2c], 0x7964544f
mov dword [ebp - 0x28], 0x64677a45
mov dword [ebp - 0x24], 0x33745242
mov dword [ebp - 0x20], 0x4141415a
mov word [ebp - 0x1c], 0x4641
mov byte [ebp - 0x1a], 0x45
call fcn.0040a169
lea eax, [ebp - 0xa0]
push eax
call fcn.0042a1df
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.004103eb
push eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp + 8]
call fcn.0045002c
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 3
call fcn.00455078
mov eax, dword [ebp - 0x18]
cmp dword [eax - 0xc], esi
je 0x42fe21
push eax
lea ecx, [ebp - 0x14]
call fcn.0041f709
push dword [eax]
call fcn.0045eebd
pop ecx
mov ecx, dword [ebp - 0x14]
mov esi, eax
add ecx, 0xfffffff0
call fcn.0040bc6b
mov eax, dword [ebp - 0x18]
lea ecx, [eax - 0x10]
call fcn.0040bc6b
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.0040bc6b
mov eax, esi
call fcn.0045a89d
ret
Function at 0x430ca0
Capabilities:
Enumerate processes

Disassembly:
push 0x23c
mov eax, 0x48f9f7
call fcn.0045a8ee
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
push 0
push 0xf
mov dword [ebp - 0x14], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [ebp - 0x240]
mov dword [ebp - 0x248], eax
push ecx
push eax
mov dword [ebp - 0x240], 0x22c
call sub.KERNEL32.dll_Process32FirstW
and dword [ebp - 0x244], 0
lea ecx, [ebp - 0x244]
push edi
mov esi, eax
call fcn.00409dd5
and dword [ebp - 4], 0
test esi, esi
mov esi, dword [ebp - 0x248]
je 0x430d4e
mov edi, dword [ebp - 0x14]
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x244]
call fcn.00429365
test eax, eax
jne 0x430d3d
push dword [ebp - 0x238]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x430d3d
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.00456b83
lea eax, [ebp - 0x240]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x430d07
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebx + 4]
xor ecx, ecx
sub eax, dword [ebx]
sar eax, 2
cmp ecx, eax
mov ecx, dword [ebp - 0x244]
sbb esi, esi
add ecx, 0xfffffff0
neg esi
call fcn.0040bc6b
mov eax, esi
call fcn.0045a89d
ret