joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b898
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffffec
mov eax, dword [0x40e504]
cmp dword [eax], 2
jne 0x40b900
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x40b8bb
xor eax, eax
jmp 0x40b90f
lea eax, [esp + 8]
push eax
push 0x40b914
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [esp + 4], 1
mov dword [esp + 0x10], 2
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError
test eax, eax
je 0x40b900
xor eax, eax
jmp 0x40b90f
push 0
push 2
call sub.user32.dll_ExitWindowsEx
cmp eax, 1
sbb eax, eax
inc eax
add esp, 0x14
ret

Function at 0x40b928
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x40b982
inc esi
xor edi, edi
cmp edi, 1
jne 0x40b94e
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_Sleep
jmp 0x40b95c
cmp edi, 1
jle 0x40b95c
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0040b3d0
test eax, eax
jne 0x40b982
call sub.kernel32.dll_GetLastError
cmp eax, 2
je 0x40b982
call sub.kernel32.dll_GetLastError
cmp eax, 3
je 0x40b982
inc edi
dec esi
jne 0x40b93e
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
Function at 0x40b98c
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov byte [ebp - 1], dl
mov esi, eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov byte [ebp - 2], 0
test edi, edi
je 0x40b9d9
xor ebx, ebx
jmp 0x40b9ce
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov eax, edi
call fcn.00405a50
test eax, eax
jne 0x40b9cd
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 2
jmp 0x40ba89
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x40b9af
mov al, byte [ebp - 1]
sub al, 1
jb 0x40b9e4
je 0x40b9ed
jmp 0x40b9f6
call fcn.00408f64
mov edi, eax
jmp 0x40b9f8
call sub.kernel32.dll_GetUserDefaultLangID
mov edi, eax
jmp 0x40b9f8
xor edi, edi
test di, di
je 0x40ba89
xor ebx, ebx
jmp 0x40ba34
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
movzx edx, di
cmp eax, edx
jne 0x40ba33
mov eax, dword [ebp - 8]
cmp dword [eax + 0x2c], 0
je 0x40ba28
call sub.kernel32.dll_GetACP
mov edx, dword [ebp - 8]
cmp eax, dword [edx + 0x2c]
jne 0x40ba33
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x40ba89
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x40ba05
xor ebx, ebx
jmp 0x40ba7e
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
and eax, 0x3ff
mov edx, edi
and dx, 0x3ff
movzx edx, dx
cmp eax, edx
jne 0x40ba7d
mov eax, dword [ebp - 8]
cmp dword [eax + 0x2c], 0
je 0x40ba72
call sub.kernel32.dll_GetACP
mov edx, dword [ebp - 8]
cmp eax, dword [edx + 0x2c]
jne 0x40ba7d
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x40ba89
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x40ba43
mov al, byte [ebp - 2]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x40be7c
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40bf51
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x40bf68
push ebx
push 0x40bf74
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.00403c28
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00402824
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403cc4
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x40befc
mov al, 0x6a
call fcn.0040bad0
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle
call fcn.0040be50
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x40bf05
call fcn.0040be50
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40bf58
lea eax, [ebp - 4]
call fcn.004038e8
ret
Function at 0x40c014
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x40c0c8
jmp 0x40c0bd
cmp dword [esi + 0x10], 0x1000
jne 0x40c0a9
test byte [esi + 0x15], 1
jne 0x40c0a9
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x40c068
cmp eax, 2
je 0x40c068
cmp eax, 0x10
je 0x40c068
cmp eax, 0x20
jne 0x40c07d
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x40c07d
mov bl, 1
xor ebp, ebp
jmp 0x40c08e
mov eax, dword [esi]
add eax, ebp
call fcn.0040c00c
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x40c081
test bl, bl
je 0x40c0a9
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x40c0c8
mov eax, dword [esi + 4]
cmp eax, edi
je 0x40c040
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x401c66
pop dword [ebp - 0x48]
mov eax, 0x1816b9cb
add eax, 0xe829629b
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x98cd0bdd
add dword [ebp - 0x58], 0xb585396e
mov dword [ebp - 0x54], 0x97884605
sub dword [ebp - 0x54], 0x6554f9c0
mov dword [ebp - 0x50], 0x24e32be5
add dword [ebp - 0x50], 0x27691849
mov dword [ebp - 0x4c], 0x1afdcff1
sub dword [ebp - 0x4c], 0x1afdcff1
lea eax, [ebp - 0x58]
push eax
mov eax, 0x8fb26991
sub eax, 0x8f72393d
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x8568be99
sub dword [ebp - 0x58], 0x10f65543
mov dword [ebp - 0x54], 0x5eb2c76e
add dword [ebp - 0x54], 0xe2b99a07
mov dword [ebp - 0x50], 0xc8be9a5
add dword [ebp - 0x50], 0x56e382c7
mov dword [ebp - 0x4c], 0x943ca4e2
add dword [ebp - 0x4c], 0x6bc35b1e
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x37cca
push 0
call eax
mov ecx, 0x3cc55332
add ecx, 0xc33afa14
mov edi, eax
mov ebx, 0xfeaa3107
add ebx, 0x1963ef9
add ebx, dword [ebp - 0x48]
mov edx, 0x43faf4af
add edx, 0x3908ecbc
add dword [ebp - 0x40], 0x750be97b
mov esi, dword [ebx]
mov dword [ebp - 0x10], 0x11b9734f
xor esi, edx
mov dword [edi], esi
xor dword [ebp - 0x1c], 0x7aab6625
add edi, 0xfd65230
sub edi, 0xfd6522c
add ebx, 4
loop 0x401d83
add eax, 0x127eb
mov ebx, eax
add eax, 5
mov ecx, 0xe96782e3
add ecx, 0x16d87d1d
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x50540fec
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.vsansi.dll_RegSetValueExW]
test eax, eax
jle 0x50541011
and eax, 0xffff
or eax, 0x80070000
ret 8

Function at 0x5054eb3e
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x468
push ebx
push ebp
push esi
xor esi, esi
cmp dword [0x5055df98], esi
push edi
mov dword [esp + 0x10], esi
jne 0x5054ed0f
push 0x14
call sub.MSVCR70.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, esi
pop ecx
je 0x5054eb6f
mov ecx, eax
call fcn.5054e63e
jmp 0x5054eb71
xor eax, eax
mov dword [0x5055df98], eax
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov dword [esp + 0x14], esi
mov esi, 0x5055dfa0
push esi
call fcn.5053d7aa
test eax, eax
je 0x5054ed0f
mov ebx, dword [sym.imp.MSVCR70.dll_wcscat]
push 0x505342dc
push esi
call ebx
push esi
mov edi, str.file:__
push edi
call ebx
add esp, 0x10
lea eax, [esp + 0x10]
push eax
mov eax, 0x50537848
push eax
push eax
mov ecx, 0x5055df50
call fcn.50538f90
test eax, eax
mov ebp, dword [sym.imp.MSVCR70.dll_swprintf]
jl 0x5054ec07
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
lea edx, [esp + 0x1c]
push edx
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x5054ec07
push dword [esp + 0x1c]
push esi
push 0x505342c4
push esi
call ebp
push dword [esp + 0x2c]
push edi
push 0x505342b8
push edi
call ebp
add esp, 0x20
mov dword [esp + 0x14], 1
jmp 0x5054ec11
push 0x505342ac
push esi
call ebx
pop ecx
pop ecx
mov eax, dword [esp + 0x10]
test eax, eax
je 0x5054ec24
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
and dword [esp + 0x10], 0
lea eax, [esp + 0x20]
push eax
push esi
call dword [sym.imp.vsansi.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [esp + 0x18], eax
jne 0x5054ecc7
cmp dword [esp + 0x14], 0
je 0x5054ed0f
push 0x5053429c
push edi
call dword [sym.imp.MSVCR70.dll_wcscpy]
pop ecx
pop ecx
push esi
call fcn.5053d7aa
push 0x505342dc
push esi
call ebx
push esi
push edi
call ebx
push 0x505342ac
push esi
call ebx
add esp, 0x18
lea eax, [esp + 0x20]
push eax
push esi
call dword [sym.imp.vsansi.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x5054ed0f
lea eax, [esp + 0x4c]
push eax
push edi
lea eax, [esp + 0x278]
push 0x50534290
push eax
call ebp
mov eax, dword [0x5055df98]
mov ecx, dword [eax]
add esp, 0x10
lea edx, [esp + 0x270]
push edx
push eax
call dword [ecx + 0x20]
lea eax, [esp + 0x20]
push eax
push esi
call dword [sym.imp.vsansi.dll_FindNextFileW]
test eax, eax
jne 0x5054ec8a
jmp 0x5054ed0f
lea eax, [esp + 0x4c]
push eax
push edi
lea eax, [esp + 0x278]
push 0x50534290
push eax
call ebp
mov eax, dword [0x5055df98]
mov ecx, dword [eax]
add esp, 0x10
lea edx, [esp + 0x270]
push edx
push eax
call dword [ecx + 0x20]
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x1c]
call dword [sym.imp.vsansi.dll_FindNextFileW]
test eax, eax
jne 0x5054ecc7
push dword [esp + 0x18]
call dword [sym.imp.kernel32.dll_FindClose]
mov eax, dword [0x5055df98]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x468
ret
Function at 0x502578
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x50257b
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x50256c
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.00502327
and dword [ebp + 0x458d41b6], edi
test al, 0x50
call fcn.00502337
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.005022ec
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x502615
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
pop ebp
ror byte [eax + 0x45c6c15d], 0xc2
in al, dx
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.00502327
int1
sub dword [edx], esi
lea eax, ss:[ebp - 0x40]
push eax
call fcn.00502337
push eax
push esi
push dword [ebp + 8]
call fcn.005022ec
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.00502327
xchg ebp, edi
or edi, dword [esi - 0x7717ba73]
pop ebp
call 0xe9adaee8
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
invalid
Function at 0x502620
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x50257b
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x50256c
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.00502327
and dword [ebp + 0x458d41b6], edi
test al, 0x50
call fcn.00502337
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.005022ec
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x502615
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
pop ebp
ror byte [eax + 0x45c6c15d], 0xc2
in al, dx
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.00502327
int1
sub dword [edx], esi
lea eax, ss:[ebp - 0x40]
push eax
call fcn.00502337
push eax
push esi
push dword [ebp + 8]
call fcn.005022ec
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.00502327
xchg ebp, edi
or edi, dword [esi - 0x7717ba73]
pop ebp
call 0xe9adaee8
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
invalid
Function at 0x5029a1
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x5029db
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x5029d6
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
add al, dh
add byte [eax], al
add al, dh
add byte [eax], al
cmp edx, 0x3000
jne 0x5029c0
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x5029c8
cmp edx, ebx
jne 0x502b16
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x502997
add eax, dword [eax + 4]
jmp 0x502984
mov dword [ebp + 0xc], ebx
jmp 0x5029e6
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x5029fe
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x502a1c
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
add byte [ebx + 0x108c794], cl
add byte [eax], al
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x502a7a
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x502a61
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x502a6a
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x502a74
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x502a56
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x5029e0
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x502ac7
dec eax
je 0x502abe
sub eax, 3
je 0x502ab5
mov dword [ebp - 4], 0x40
jmp 0x502ae4
mov dword [ebp - 4], 4
jmp 0x502aca
mov dword [ebp - 4], 0x20
jmp 0x502aca
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
cld
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x502b16
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x502a96
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.00502327
leave
push 0x46
pop esp
push dword [ebp + 0x14]
push 1
push esi
call edi
mov eax, esi
jmp 0x502b22
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x502a0a
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x5029db
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x5029d6
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
add al, dh
add byte [eax], al
add al, dh
add byte [eax], al
cmp edx, 0x3000
jne 0x5029c0
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x5029c8
cmp edx, ebx
jne 0x502b16
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x502997
add eax, dword [eax + 4]
jmp 0x502984
mov dword [ebp + 0xc], ebx
jmp 0x5029e6
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x5029fe
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x502a1c
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
add byte [ebx + 0x108c794], cl
add byte [eax], al
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x502a7a
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x502a61
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x502a6a
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x502a74
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x502a56
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x5029e0
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x502ac7
dec eax
je 0x502abe
sub eax, 3
je 0x502ab5
mov dword [ebp - 4], 0x40
jmp 0x502ae4
mov dword [ebp - 4], 4
jmp 0x502aca
mov dword [ebp - 4], 0x20
jmp 0x502aca
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
cld
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x502b16
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x502a96
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.00502327
leave
push 0x46
pop esp
push dword [ebp + 0x14]
push 1
push esi
call edi
mov eax, esi
jmp 0x502b22
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x545ef0
Capabilities:
Reference wmi statements

Disassembly:
push ecx
push ebx
push ebp
push edi
xor ebx, ebx
push esi
mov ebp, 1
mov dword [esp + 0x10], ebx
call fcn.00549a00
mov edi, eax
add esp, 4
cmp edi, ebx
jne 0x545f30
cmp esi, ebx
je 0x546045
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x546045
push 0x8e
push str.Failed_to_create_WMI_object
jmp 0x54603b
push esi
push str.SELECT__FROM_Win32_BIOS
push edi
call fcn.00549420
add esp, 0xc
test eax, eax
jne 0x546026
push esi
push edi
call fcn.00549430
add esp, 8
test eax, eax
je 0x546009
lea esp, [esp]
lea edx, [esp + 0xc]
push edx
push str.Manufacturer
push edi
call fcn.00549400
add esp, 0xc
test eax, eax
jne 0x545f8e
mov eax, dword [esp + 0xc]
push esi
push str.innotek_GmbH
push eax
call fcn.00544440
add esp, 0xc
test eax, eax
je 0x546007
mov ecx, dword [esp + 0xc]
push ecx
call fcn.004fbea5
lea edx, [esp + 0x10]
push edx
push str.SMBIOSBIOSVersion
push edi
mov dword [esp + 0x1c], ebx
call fcn.00549400
add esp, 0x10
test eax, eax
jne 0x545fca
mov eax, dword [esp + 0xc]
push esi
push str.VirtualBox
push eax
call fcn.00544440
add esp, 0xc
test eax, eax
je 0x546007
mov ecx, dword [esp + 0xc]
push ecx
call fcn.004fbea5
push esi
push edi
mov dword [esp + 0x18], ebx
call fcn.00549430
add esp, 0xc
test eax, eax
jne 0x545f60
mov edx, dword [esp + 0xc]
push edx
call fcn.004fbea5
add esp, 4
push edi
call fcn.00549970
add esp, 4
pop edi
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret
xor ebp, ebp
mov edx, dword [esp + 0xc]
push edx
call fcn.004fbea5
add esp, 4
push edi
call fcn.00549970
add esp, 4
pop edi
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret
cmp esi, ebx
je 0x546045
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x546045
push 0xb5
push str.Error:_Cmn_Wmi_query_failed
mov ecx, dword [esi]
push 9
push ecx
call eax
add esp, 0x10
push edi
call fcn.00549970
add esp, 4
pop edi
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret
Function at 0x56af60
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 8]
test edi, edi
je 0x56afcf
mov eax, dword [esp + 0xc]
test eax, eax
je 0x56afcf
mov cl, byte [eax]
cmp cl, 0xbc
jne 0x56afa2
cmp byte [eax + 1], 0xbd
jne 0x56afa2
push 0
add eax, 2
push eax
push edi
call fcn.005441b0
mov eax, dword [esp + 0x18]
push 0
push eax
call fcn.00544630
mov byte [eax + edi - 4], 0
add esp, 0x14
mov eax, edi
pop edi
ret
xor cl, 0x23
push esi
xor esi, esi
mov byte [edi], cl
cmp byte [eax], 0
je 0x56afc6
mov ecx, edi
sub ecx, eax
mov dl, byte [eax + 1]
inc eax
dec dl
xor dl, byte [ecx + eax - 1]
inc esi
mov byte [ecx + eax], dl
cmp byte [eax], 0
jne 0x56afb3
mov byte [esi + edi], 0
pop esi
mov eax, edi
pop edi
ret
xor eax, eax
pop edi
ret

Function at 0x56dd18
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [0x63ace0], 0
jne 0x56dd2c
pop ebp
jmp fcn.00503a38
push dword [ebp + 8]
dec dword [0x63ace0]
call dword [sym.imp.KERNEL32.dll_EncodePointer]
mov ecx, dword [0x63ace0]
mov dword [ecx*4 + 0x643708], eax
pop ebp
ret

Function at 0x59b860
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push 0x60
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.004fc2f0
add esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [ecx], 0x67452301
mov edx, dword [ebp + 8]
mov dword [edx + 4], 0xefcdab89
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0x98badcfe
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xc], 0x10325476
mov edx, dword [ebp + 8]
mov dword [edx + 0x10], 0xc3d2e1f0
xor eax, eax
pop ebp
ret