joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100619b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
xor al, al
push edi
xor edi, edi
test esi, esi
je 0x10061a77
push ebx
mov ecx, dword [ebp + 8]
mov dl, byte [edi + ecx]
xor dl, al
mov cl, dl
shr cl, 1
mov al, cl
xor al, 0x8c
and dl, 1
movzx ebx, al
movzx eax, cl
cmove ebx, eax
mov cl, bl
shr cl, 1
mov al, cl
xor al, 0x8c
and bl, 1
movzx edx, al
movzx eax, cl
cmove edx, eax
mov cl, dl
shr cl, 1
mov al, cl
xor al, 0x8c
and dl, 1
movzx ebx, al
movzx eax, cl
cmove ebx, eax
mov cl, bl
shr cl, 1
mov al, cl
xor al, 0x8c
and bl, 1
movzx edx, al
movzx eax, cl
cmove edx, eax
mov cl, dl
shr cl, 1
mov al, cl
xor al, 0x8c
and dl, 1
movzx ebx, al
movzx eax, cl
cmove ebx, eax
mov cl, bl
shr cl, 1
mov al, cl
xor al, 0x8c
and bl, 1
movzx edx, al
movzx eax, cl
cmove edx, eax
mov cl, dl
shr cl, 1
mov al, cl
xor al, 0x8c
and dl, 1
movzx ebx, al
movzx eax, cl
cmove ebx, eax
mov cl, bl
shr cl, 1
mov al, cl
movzx ecx, cl
xor al, 0x8c
and bl, 1
movzx eax, al
cmove eax, ecx
inc edi
cmp edi, esi
jb 0x100619c5
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x10062610
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x100dc0d8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x23c]
push 0x208
push 0
push eax
mov esi, ecx
call fcn.1007cdb0
add esp, 0xc
lea eax, [ebp - 0x23c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
dec eax
cmp eax, 0x102
ja 0x1006274e
mov ecx, esi
call fcn.10062a30
mov dword [ebp - 0x34], 0x790053
test eax, eax
jne 0x100626dc
lea eax, [ebp - 0x34]
mov dword [ebp - 0x30], 0x740073
push eax
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x2c], 0x6d0065
push eax
push edi
mov dword [ebp - 0x28], 0x320033
mov dword [ebp - 0x24], 0x6e005c
mov dword [ebp - 0x20], 0x6f0074
mov dword [ebp - 0x1c], 0x6b0073
mov dword [ebp - 0x18], 0x6e0072
mov dword [ebp - 0x14], 0x2e006c
mov dword [ebp - 0x10], 0x780065
mov dword [ebp - 0xc], 0x65
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004ce3a
mov esp, ebp
pop ebp
ret 4
xor eax, eax
mov dword [ebp - 0x30], 0x4e0073
mov word [ebp - 8], ax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x2c], 0x740061
push eax
push edi
mov dword [ebp - 0x28], 0x760069
mov dword [ebp - 0x24], 0x5c0065
mov dword [ebp - 0x20], 0x74006e
mov dword [ebp - 0x1c], 0x73006f
mov dword [ebp - 0x18], 0x72006b
mov dword [ebp - 0x14], 0x6c006e
mov dword [ebp - 0x10], 0x65002e
mov dword [ebp - 0xc], 0x650078
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004ce3a
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
mov eax, 0x80004005
pop edi
xor ecx, ebp
pop esi
call fcn.1004ce3a
mov esp, ebp
pop ebp
ret 4
Function at 0x100632e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ace93
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x100dc0d8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x8c], 0
mov dword [ebx], 0
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x84], 0
push 0x201
push dword [0x100dc188]
lea ecx, [ebp - 0x8c]
mov dword [ebp - 4], 0
push 0x80000002
call fcn.10052030
mov edi, dword [ebp - 0x8c]
test eax, eax
jne 0x100634c1
push 0x64
lea eax, [ebp - 0x74]
push 0
push eax
call fcn.1007cdb0
add esp, 0xc
mov dword [ebp - 0x78], 0x64
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0
push 0x100c1298
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100634c1
mov eax, dword [ebp - 0x7c]
cmp eax, 1
je 0x100633b5
cmp eax, 2
jne 0x100634c1
mov ecx, dword [ebp - 0x78]
test ecx, ecx
je 0x100633d6
test cl, 1
jne 0x100634c1
mov eax, ecx
shr eax, 1
cmp word [ebp + eax*2 - 0x76], 0
je 0x100633dc
jmp 0x100634c1
xor eax, eax
mov word [ebp - 0x74], ax
shr ecx, 1
cmp ecx, 0x2d
jne 0x100634c1
call fcn.10004ec0
mov ecx, eax
test ecx, ecx
je 0x100634ec
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x78]
call fcn.100614d0
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x7c], 0
push eax
lea eax, [ebp - 0x20]
push 0x100c12a0
push eax
call fcn.10063930
mov esi, dword [ebp - 0x78]
push 0x2a
push esi
call fcn.100619b0
movzx eax, al
add esp, 0x14
cmp dword [ebp - 0x7c], eax
jne 0x100634a5
lea edx, [ebp - 0x74]
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10063446
sub edx, ecx
lea eax, [ebp - 0x74]
mov ecx, dword [ebp - 0x80]
sar edx, 1
push edx
push eax
call fcn.10063540
push dword [0x100dc190]
lea eax, [ebp - 0x74]
push dword [0x100dc18c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x10063482
mov dword [ebx], 1
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x1006349e
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, 1
jmp 0x100634c3
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x100634c1
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
xor esi, esi
test edi, edi
je 0x100634ce
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004ce3a
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10004a30
int3
Function at 0x10063630
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100acec8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x100dc0d8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
push 0x202
push dword [0x100dc188]
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0
push 0x80000002
call fcn.10052030
test eax, eax
je 0x10063758
mov esi, dword [ebp - 0x18]
mov edi, dword [0x100dc188]
mov dword [ebp - 0x10], 0
test esi, esi
je 0x10063703
cmp dword [esi], 0
je 0x100636f6
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x100636c3
mov eax, 1
jmp 0x10063724
push str.RegCreateKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100636fc
push 0
push dword [esi]
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0x20206
push 0
push 0
push 0
push edi
push 0x80000002
call eax
jmp 0x10063724
cmp dword [esi + 4], 0
jne 0x10063703
mov eax, 1
jmp 0x10063724
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x20206
push 0
push 0
push 0
push edi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1006374e
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x10063736
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], 0x200
test eax, eax
je 0x1006375b
xor ebx, ebx
jmp 0x100637ff
mov esi, dword [ebp - 0x20]
xor ebx, ebx
jmp 0x100637ff
mov esi, dword [ebp - 0x20]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
je 0x100637b8
mov ecx, dword [ebx]
test ecx, ecx
je 0x1006381e
push ecx
push eax
call fcn.10084f2c
add esp, 8
test eax, eax
je 0x100637b8
mov edx, dword [edi]
test edx, edx
je 0x100637b8
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10063790
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push str.m2_old
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebx]
test edx, edx
jne 0x100637c3
lea eax, [edx + 0xd]
jmp 0x100637f8
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100637d0
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push 0x100c1298
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor ebx, ebx
test eax, eax
sete bl
test esi, esi
je 0x1006380a
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10004a30
int3
Function at 0x10064fb0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], 0
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10065021
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x10064fef
cmp eax, 2
jne 0x1006500b
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x1006501b
test ecx, ecx
je 0x10065016
test cl, 1
jne 0x1006500b
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], 0
je 0x1006501b
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x1006674b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x1009e4a1
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1009e423
Function at 0x4013f0
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
push 0x417370
push dword [0x417380]
call dword [sym.imp.USER32.dll_GetWindowRect]
push 0
call fcn.00404363
push eax
call fcn.00404351
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
add esp, 8
push 0
push 0
push 0
push 0x401030
push 0
push 0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x7530
call edi
push 0
push 0
push 0
push 0x401050
push 0
push 0
call esi
push 0x2710
call edi
push 0
push 0
push 0
push 0x4010d0
push 0
push 0
call esi
call fcn.00404330
cdq
mov ebx, 0x2710
idiv ebx
inc edx
push edx
call edi
push 0
push 0
push 0
push 0x401140
push 0
push 0
call esi
push 0x1388
call edi
push 0
push 0
push 0
push 0x401250
push 0
push 0
call esi
call fcn.00404330
cdq
idiv ebx
inc edx
push edx
call edi
push 0
push 0
push 0
push 0x401360
push 0
push 0
call esi
call fcn.00404330
cdq
mov ecx, 0x4e20
idiv ecx
inc edx
push edx
call edi
nop dword [eax]
call fcn.00404330
push eax
call fcn.004043e6
push eax
call fcn.004043cb
add esp, 8
jmp 0x4014d0

Function at 0x401bbb
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401bfa
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401bfa
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401bfa
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401bfa
cmp dword [ecx + 0x74], 0xe
jbe 0x401bfa
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4064b8
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x410540
push 0x410538
push str.FlsAlloc
push 0x1f
call fcn.00406377
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4064ec
push dword [ebp + 8]
mov ecx, esi
call dword [0x40f16c]
call esi
jmp 0x4064f2
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x406536
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x410550
push 0x410548
push str.FlsGetValue
push 0x21
call fcn.00406377
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40656d
push dword [ebp + 8]
mov ecx, esi
call dword [0x40f16c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x406575
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x410558
push 0x410550
push str.FlsSetValue
push 0x22
call fcn.00406377
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4065af
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x40f16c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x407cc7
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x407d64
push ebx
push esi
call fcn.00407c90
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00407c24
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x407d11
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x407d63
push edi
push eax
call fcn.00406714
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x407d31
call fcn.004066da
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x407d62
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00407c24
add esp, 0x20
test eax, eax
jne 0x407d50
push edi
call fcn.004066da
jmp 0x407d58
push ebx
call fcn.004066da
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x40e0d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40e0fd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40e0fd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x1000e9b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x1000e9bf
pop dword [ebp - 0x20]
mov eax, 0x686d08a0
sub eax, 0x586c1ee1
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0xfb72bf2e
add dword [ebp - 0x30], 0x52df861d
mov dword [ebp - 0x2c], 0x76f216a
add dword [ebp - 0x2c], 0x2ac42adb
mov dword [ebp - 0x28], 0x8aa19d4d
add dword [ebp - 0x28], 0xc1aaa6e1
mov dword [ebp - 0x24], 0x4843dcf5
add dword [ebp - 0x24], 0xb7bc230b
lea eax, [ebp - 0x30]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x21d5cf84
sub dword [ebp - 0x30], 0xad63662e
mov dword [ebp - 0x2c], 0x633b6b9a
sub dword [ebp - 0x2c], 0x21cf0a25
mov dword [ebp - 0x28], 0xc70693df
add dword [ebp - 0x28], 0x9c68d88d
mov dword [ebp - 0x24], 0x1d220a23
add dword [ebp - 0x24], 0xe2ddf5dd
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0xe43d1cee
add eax, 0x2bc4734a
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x389c5
push 0
call eax
mov ecx, 0x5034
mov esi, eax
mov edx, 0x10022800
add edx, dword [ebp - 0x20]
mov ebx, 0xfabd12cc
sub ebx, 0xf22aa9f7
add dword [ebp - 0x1c], edx
mov edi, dword [edx]
add dword [ebp - 0x1c], 0x3a3b2070
xor edi, ebx
sub dword [ebp - 8], eax
mov dword [esi], edi
sub dword [ebp - 0x1c], edi
add esi, 0x5e3207d1
add esi, 0xa1cdf833
add edx, 0x5ad0b740
add edx, 0xa52f48c4
loop 0x1000ead0
add eax, 0x133a3
xor ebx, ebx
add ebx, eax
add eax, 0x6cf0a760
sub eax, 0x6cf0a75b
mov ecx, 0x1e0c6a9e
add ecx, 0xf1f39562
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x10014d90
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x1001f83c]
push dword [esp + 4]
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x234]
call eax
test eax, eax
je 0x10014dd2
push 0x51b
push str.hprof_util.c
push str.Unable_to_get_necessary_JVMTI_capabilities.
push 0
push 0
call fcn.10005090
add esp, 0x14
mov dword [esp + 4], 1
jmp fcn.10005080
ret

Function at 0x10016400
Capabilities:
Terminate process

Disassembly:
mov edx, dword [esp + 4]
xorps xmm0, xmm0
push edx
movups xmmword [edx], xmm0
mov eax, dword [0x1001f83c]
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x22c]
call eax
test eax, eax
je 0x10016449
push 0x50e
push str.hprof_util.c
push str.Unable_to_get_potential_JVMTI_capabilities.
push 0
push 0
call fcn.10005090
add esp, 0x14
mov dword [esp + 4], 1
jmp fcn.10005080
ret
Function at 0x402d89
Capabilities:
Compare security identifiers

Disassembly:
push ebx
push esi
lea ebx, [ecx + 4]
push edi
mov edi, edx
test ebx, ebx
je 0x402dbf
lea esi, [edi + 4]
test esi, esi
je 0x402dbf
call fcn.00402ceb
test al, al
je 0x402dbf
mov ecx, edi
call fcn.00402ceb
test al, al
je 0x402dbf
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
setne al
jmp 0x402dc1
xor al, al
pop edi
pop esi
pop ebx
ret

Function at 0x4052f2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x405301
pop dword [ebp - 8]
mov eax, 0x7d76716e
add eax, 0x82c9e193
sub dword [ebp - 8], eax
push 0x40
push 0x1000
push 0x3e215
push 0
mov eax, 0x4773bd0f
add eax, 0xb8ce1505
add eax, dword [ebp - 8]
call dword [eax]
mov ecx, 0x4b04
xor edx, edx
add edx, eax
mov ebx, 0x436000
add ebx, dword [ebp - 8]
mov esi, 0xd147b57d
add esi, 0x44c36f2d
mov edi, dword [ebx]
sub dword [ebp - 4], 0x477993d2
add edi, esi
xor dword [ebp - 4], edi
mov dword [edx], edi
mov dword [ebp - 4], 0x2cb0d5eb
add edx, 0x217ee26c
sub edx, 0x217ee268
add ebx, 0x1432a687
sub ebx, 0x1432a683
loop 0x405356
add eax, 0xebe8a525
add eax, 0x141879be
xor ebx, ebx
add ebx, eax
add eax, 0x40a60213
add eax, 0xbf59fdf2
mov ecx, 0xf5f5bfd7
add ecx, 0xa4a4029
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x40612f
Capabilities:
Print debug messages

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 8], 0
jne 0x4061b0
mov byte [esi + 8], 1
call main
cmp dword [esi + 0x10], 0
je 0x4061b0
test al, al
je 0x40614f
mov byte [esi + 0xa], 1
mov ecx, esi
call fcn.00406749
test al, al
jne 0x406176
push dword [esi + 0xc]
push dword [esi + 0x1c]
push str.LOG_SYSTEM:___s_:_Could_not_acquire_logging_mutex__s_n
call fcn.00406e12
add esp, 0xc
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
pop esi
ret
mov ecx, esi
call main
cmp dword [esi + 0x18], 0
jne 0x40619d
push dword [esi + 0x14]
push dword [esi + 0x1c]
push str.LOG_SYSTEM:___s_:_Could_not_create_logging_file__s_n
call fcn.00406e12
add esp, 0xc
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
cmp dword [esi + 0x10], 0
mov byte [esi + 9], 1
je 0x4061b0
push dword [esi + 0x10]
call dword [sym.imp.kernel32.dll_ReleaseMutex]
pop esi
ret

Function at 0x406749
Capabilities:
Print debug messages

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x10], 0
jne 0x406756
xor al, al
pop esi
ret
push 0x1f4
push dword [esi + 0x10]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
test eax, eax
je 0x40678f
cmp eax, 0x80
je 0x40678f
push dword [esi + 0xc]
push dword [esi + 0x1c]
push str.LOG_SYSTEM:___s_:_Could_not_acquire_logging_mutex__s_n
call fcn.00406e12
add esp, 0xc
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
mov byte [esi + 9], 0
jmp 0x406752
mov al, 1
pop esi
ret
Function at 0x191609
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x191a90
call fcn.001917b4
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x20], ebx
mov edi, 0x192370
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x1913c4
cmp eax, esi
jne 0x1913b7
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0x1913c7
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x19139e
xor esi, esi
inc esi
mov eax, dword [0x19236c]
cmp eax, esi
jne 0x1913da
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x191409
mov eax, dword [0x19236c]
test eax, eax
jne 0x191403
mov dword [0x19236c], esi
push 0x1910b8
push 0x1910ac
call fcn.00191300
pop ecx
pop ecx
test eax, eax
je 0x191409
jmp 0x19152d
mov dword [0x192034], esi
mov eax, dword [0x19236c]
cmp eax, esi
jne 0x19142d
push 0x1910a8
push 0x1910a0
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x19236c], 2
cmp dword [ebp - 0x20], ebx
jne 0x19143a
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x192374], ebx
je 0x19145b
push 0x192374
call fcn.00191729
pop ecx
test eax, eax
je 0x19145b
push ebx
push 2
push ebx
call dword [0x192374]
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
cmp dword [eax], ebx
je 0x19152d
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
movzx ecx, word [eax]
cmp cx, 0x20
ja 0x1914c5
cmp cx, bx
je 0x191480
cmp dword [ebp - 0x1c], ebx
jne 0x1914c5
movzx ecx, word [eax]
cmp cx, bx
je 0x191495
cmp cx, 0x20
ja 0x191495
inc eax
inc eax
mov dword [ebp - 0x24], eax
jmp 0x191480
test byte [ebp - 0x40], 1
je 0x1914a1
movzx ecx, word [ebp - 0x3c]
jmp 0x1914a4
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x190000
call main
mov dword [0x192030], eax
cmp dword [0x192024], ebx
jne 0x19150a
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp cx, 0x22
jne 0x1914d6
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
inc eax
inc eax
jmp 0x19146a
cmp dword [0x192034], ebx
jne 0x191518
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x192030]
jmp 0x191539
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.001917f9
ret
call fcn.00191901
jmp 0x191361