joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c3d5
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x42d018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.00412ea9
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.00412ea9
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x41c44c
cmp word [ecx], dx
je 0x41c44c
mov eax, dword [0x426c84]
push edi
dec eax
push eax
push 0x426b70
call fcn.0041c374
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x41c4bf
cmp word [eax], dx
je 0x41c4bf
mov eax, dword [edi]
test eax, eax
je 0x41c470
cmp word [eax], dx
je 0x41c470
lea eax, [ebp - 0x10]
push eax
call fcn.0041bd42
jmp 0x41c479
lea eax, [ebp - 0x10]
push eax
call fcn.0041bddd
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x41c4e9
mov eax, dword [0x426b6c]
push dword [ebp - 0x14]
dec eax
push eax
push 0x426860
call fcn.0041c374
add esp, 0xc
test al, al
je 0x41c4e9
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x41c4b4
cmp word [eax], di
je 0x41c4b4
lea eax, [ebp - 0x10]
push eax
call fcn.0041bd42
pop ecx
jmp 0x41c4eb
lea eax, [ebp - 0x10]
push eax
call fcn.0041bddd
jmp 0x41c4b1
mov eax, dword [edi]
test eax, eax
je 0x41c4d6
cmp word [eax], dx
je 0x41c4d6
lea eax, [ebp - 0x10]
push eax
call fcn.0041bcf7
pop ecx
jmp 0x41c4e9
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x41c5b4
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.0041c1f9
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x41c5b4
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x41c5b4
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x41c5b4
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x41c541
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.004157e8
test ebx, ebx
je 0x41c5af
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.004157e8
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x41c5b4
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x41c5b4
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.0041f70a
add esp, 0x10
xor eax, eax
inc eax
jmp 0x41c5b6
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406175
leave
ret
Function at 0x420f90
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x420fbd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x420fbd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10001150
Capabilities:
Create udp socket
Initialize winsock library

Disassembly:
mov eax, dword [0x10003020]
test eax, eax
jne 0x10001170
xor eax, eax
mov dword [0x10003020], eax
mov eax, 1
ret
push ebp
mov ebp, esp
sub esp, 0x1ac
call sym._close_server_socket
lea eax, [ebp - 0x190]
mov dword [esp + 4], eax
mov dword [esp], 0x202
call dword [sym.imp.wsock32.dll_WSAStartup]
xor edx, edx
sub esp, 8
test eax, eax
sete dl
mov dword [0x10007004], edx
je 0x100011b0
leave
xor eax, eax
ret
mov dword [esp], str.127.0.0.1
mov eax, 2
mov word [ebp - 0x1a0], ax
call dword [sym.imp.wsock32.dll_inet_addr]
mov dword [ebp - 0x19c], eax
sub esp, 4
mov dword [esp], 0x1f0d
call dword [sym.imp.wsock32.dll_htons]
mov word [ebp - 0x19e], ax
sub esp, 4
mov eax, 0x11
mov dword [esp + 8], eax
mov eax, 2
mov dword [esp + 4], eax
mov dword [esp], 2
call dword [sym.imp.wsock32.dll_socket]
mov dword [0x1000301c], eax
sub esp, 0xc
cmp eax, 0xffffffff
je 0x100011a7
mov dword [esp], eax
lea edx, [ebp - 0x1a0]
mov ecx, 0x10
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
call dword [sym.imp.wsock32.dll_bind]
sub esp, 0xc
inc eax
je 0x100011a7
xor edx, edx
mov eax, 1
mov dword [0x10003020], edx
leave
ret
Function at 0x100019c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov eax, 0x1000512c
mov ebp, esp
push edi
push esi
push ebx
lea edi, [ebp - 0x14]
sub esp, 0x24
mov dword [esp + 4], eax
mov dword [esp], 0xfffffffe
call dword [sym.imp.kernel32.dll_SetThreadDescription]
mov eax, dword [0x10007014]
sub esp, 8
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_SetEvent]
mov dword [ebp - 0x1c], eax
call eax
mov esi, dword [sym.imp.kernel32.dll_GetTickCount]
sub esp, 4
call esi
mov edx, 0x102
mov ebx, eax
jmp 0x10001a1e
and eax, 0xfffffeff
cmp eax, 2
jne 0x10001b28
mov dword [ebp - 0x18], edx
call esi
mov edx, dword [ebp - 0x18]
cmp edx, 0x102
je 0x10001b10
mov edx, ebx
mov ebx, eax
mov eax, ebx
sub eax, edx
cmp eax, 0x7cf
ja 0x10001aaa
mov eax, dword [0x10007048]
mov ebx, edx
test eax, eax
jne 0x10001ae0
mov dword [esp + 4], edi
mov eax, dword [0x10007008]
mov dword [esp], 2
mov dword [ebp - 0x14], eax
mov eax, dword [0x10007010]
mov dword [ebp - 0x10], eax
mov eax, 2
mov dword [esp + 0x10], eax
mov eax, 0x1cff
mov dword [esp + 0xc], eax
mov eax, 0x7d0
mov dword [esp + 8], eax
call dword [sym.imp.user32.dll_MsgWaitForMultipleObjectsEx]
sub esp, 0x14
test eax, eax
mov edx, eax
jne 0x10001a10
call esi
mov edx, ebx
mov ebx, eax
mov eax, ebx
sub eax, edx
cmp eax, 0x7cf
jbe 0x10001a41
xor eax, eax
cmp dword [0x1000301c], 0xffffffff
mov dword [0x1000704c], eax
je 0x10001b18
mov ecx, dword [0x10003020]
mov eax, dword [0x10007048]
test ecx, ecx
je 0x10001a48
mov edx, 3
test eax, eax
mov dword [0x1000704c], edx
je 0x10001b60
mov eax, dword [0x10007044]
test eax, eax
je 0x10001a50
mov dword [esp], 0x1f4
mov eax, 1
mov dword [0x10003020], eax
call dword [sym.imp.kernel32.dll_Sleep]
sub esp, 4
jmp 0x10001a50
mov ebx, eax
jmp 0x10001aaa
call sym._create_server_socket
lea esi, [esi]
jmp 0x10001aba
cmp edx, 1
je 0x10001b3a
test byte [0x10003024], 2
jne 0x10001be8
mov dword [ebp - 0x18], edx
mov eax, dword [0x1000700c]
mov dword [esp], eax
mov eax, dword [ebp - 0x1c]
call eax
mov edx, dword [ebp - 0x18]
mov eax, edx
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 4
xor eax, eax
xor edx, edx
mov dword [0x1000703c], eax
xor eax, eax
xor ecx, ecx
mov dword [0x10007040], eax
mov eax, 1
mov dword [0x10007048], eax
xor eax, eax
mov dword [0x10007020], eax
xor eax, eax
mov dword [0x10007030], eax
mov eax, 0x70007
mov dword [0x1000702c], eax
mov eax, 0x101
mov word [0x10007020], ax
mov eax, 1
mov dword [0x10007044], eax
mov eax, dword [0x10007008]
mov dword [0x10007034], edx
mov edx, 0x303ffff
mov dword [0x10007038], ecx
mov ecx, 0x70007
mov dword [0x10007024], edx
mov dword [esp], eax
mov eax, dword [ebp - 0x1c]
mov dword [0x10007028], ecx
call eax
mov eax, dword [0x10007048]
sub esp, 4
jmp 0x10001a48
mov dword [esp + 0x10], edx
mov eax, str.update_thread_exited_unexpectedly__ret__lu_n
mov ecx, 0x10003024
mov dword [ebp - 0x18], edx
mov edx, str.controller_update_thread_proc
mov dword [esp + 8], edx
mov dword [esp + 0xc], eax
mov dword [esp + 4], ecx
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
mov edx, dword [ebp - 0x18]
jmp 0x10001b3a
Function at 0x10002310
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
test eax, eax
je 0x10002378
cmp byte [esi + eax - 1], 0xa
mov ebx, eax
je 0x10002370
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x100070e4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp], esi
mov dword [esp + 0xc], eax
mov eax, 1
mov dword [esp + 4], eax
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
xor eax, eax
jmp 0x1000233a
add esp, 0x10
xor eax, eax
pop ebx
pop esi
pop ebp
ret
Function at 0x100029f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov ebx, dword [ebp + 0xc]
mov dword [esp], ebx
call sym.___wine_dbg_get_channel_flags
movzx ecx, byte [ebp + 8]
movzx eax, al
sar eax, cl
test al, 1
je 0x10002bd8
mov edx, dword [0x100070e4]
mov eax, dword fs:[0x18]
cmp dword [eax + 0x24], edx
je 0x10002bc8
test byte [0x1000303c], 8
jne 0x10002b70
lea edi, [ebp - 0xd4]
mov esi, edi
test byte [0x1000304c], 8
jne 0x10002b30
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov ecx, str._04x:
mov dword [esp + 4], ecx
mov dword [esp], esi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x10002a7a
cmp dword [ebp + 8], 3
jbe 0x10002ae8
mov dword [esp], 2
mov ebx, edi
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov esi, dword [ebx]
add ebx, 4
lea ecx, [esi - 0x1010101]
not esi
and ecx, esi
and ecx, 0x80808080
je 0x10002a89
mov dword [esp + 0xc], eax
mov esi, ecx
mov eax, 1
mov dword [esp + 4], eax
shr esi, 0x10
test ecx, 0x8080
mov dword [esp], edi
cmove ecx, esi
lea esi, [ebx + 2]
mov dl, cl
cmove ebx, esi
add dl, cl
sbb ebx, 3
sub ebx, edi
mov dword [esp + 8], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [ebp + 0x10]
add eax, esi
inc ebx
mov dword [esp + 0x10], ebx
mov dword [esp], eax
mov dword [esp + 0x14], edx
mov edx, dword [ebp + 8]
mov ecx, dword [edx*4 + 0x100059a4]
mov edx, str._s:_s:_s
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
mov ecx, edi
sub ecx, eax
add ecx, 0xc8
mov dword [esp + 4], ecx
call sym._snprintf.constprop.0
jmp 0x10002a7a
mov dword [esp], 0x1000304c
call sym.___wine_dbg_get_channel_flags
and al, 8
je 0x10002a4f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov ecx, str._04x:
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call sym._sprintf
add esi, eax
jmp 0x10002a4f
mov dword [esp], 0x1000303c
call sym.___wine_dbg_get_channel_flags
and al, 8
je 0x10002a3a
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
mov esi, str._3u._03u:
mov dword [esp + 4], esi
lea edi, [ebp - 0xd4]
mov dword [esp], edi
mov ecx, eax
mul edx
shr edx, 6
mov dword [esp + 8], edx
imul eax, edx, 0x3e8
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea esi, [edi + eax]
jmp 0x10002a42
add esp, 0xe0
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 0xffffffff
jmp 0x10002ad7
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, 0xd0d72a3
nop
nop
nop
nop
test eax, eax
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..rdata
nop
mov ebx, 0x42e1d0
mov ecx, 0x1815744a
nop
nop
nop
nop
test eax, eax
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x402142
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
xor esi, esi
push esi
push pe_nt_image_headers32
push 3
push esi
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40216f
xor eax, eax
jmp 0x4021bd
push ebx
lea eax, [ebp - 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
push esi
push esi
push 2
push esi
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], eax
call edi
cmp dword [ebp - 4], 0xffffffff
jne 0x4021a0
xor eax, eax
jmp 0x4021bc
push esi
push esi
push esi
push 4
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push dword [ebp - 4]
mov esi, eax
call edi
mov eax, dword [ebp + 0xc]
mov dword [eax], ebx
mov eax, esi
pop ebx
pop edi
pop esi
leave
ret

Function at 0x40220d
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x94]
sub esp, 0x114
mov eax, dword [0x40c17c]
xor eax, ebp
mov dword [ebp + 0x90], eax
mov eax, dword [ebp + 0x9c]
mov dword [ebp - 0x78], ecx
lea ecx, [edx + eax - 0x16]
sub eax, dword [ecx + 0x10]
push esi
sub eax, dword [ecx + 0xc]
push edi
mov edi, dword [ebp + 0xa0]
sub eax, 0x22
lea esi, [edx + eax]
xor edx, edx
mov dword [edi], edx
mov dword [ebx], edx
cmp dword [ecx], 0x6054b50
mov dword [ebp - 0x80], edi
jne 0x40234d
cmp dword [esi], 0x1234567b
je 0x402277
push edx
mov edi, str.Invalid_cfgdata_magic_number__see_bdist_wininst.py_
call fcn.00401f4e
pop ecx
jmp 0x40234f
cmp eax, edx
jl 0x40234d
mov ecx, dword [esi + 8]
cmp ecx, edx
je 0x402293
mov edx, esi
sub edx, dword [esi + 4]
sub edx, ecx
mov dword [0x40ca30], edx
sub eax, dword [esi + 4]
mov ecx, dword [ebp - 0x78]
sub eax, dword [esi + 8]
mov edi, esi
mov dword [ecx], eax
sub edi, dword [esi + 4]
push 0x104
call dword [sym.imp.MSVCR80.dll_malloc]
test eax, eax
pop ecx
mov dword [ebp - 0x7c], eax
je 0x40234d
lea eax, [ebp - 0x74]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x40233b
push dword [ebp - 0x7c]
lea eax, [ebp - 0x74]
push 0
push 0x407940
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x40233b
xor eax, eax
push eax
push eax
push eax
push dword [esi + 4]
push eax
push dword [ebp - 0x7c]
push 2
call fcn.004010ab
add esp, 0x1c
test eax, eax
mov dword [ebp - 0x78], eax
je 0x40234d
push dword [esi + 4]
push edi
push eax
call dword [sym.imp.MSVCR80.dll_strncpy]
push dword [ebp - 0x78]
call sub.MSVCR80.dll_strlen
lea edi, [edi + eax + 1]
push edi
call dword [sym.imp.MSVCR80.dll__strdup]
mov ecx, dword [ebp - 0x80]
add esp, 0x14
push dword [ebp - 0x78]
mov dword [ecx], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebx], eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
xor eax, eax
inc eax
jmp 0x40234f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov edi, str.Could_not_create_temporary_file
call fcn.00401f4e
pop ecx
xor eax, eax
mov ecx, dword [ebp + 0x90]
pop edi
xor ecx, ebp
pop esi
call fcn.004065b0
add ebp, 0x94
leave
ret
Function at 0x403370
Capabilities:
Create process on windows
Resume thread
Self delete

Disassembly:
push ebp
lea ebp, [esp - 0x1e4]
sub esp, 0x264
mov eax, dword [0x40c17c]
xor eax, ebp
mov dword [ebp + 0x1e0], eax
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x28]
push eax
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp + 0xdc]
push str._s.bat
push eax
call dword [sym.imp.MSVCR80.dll_sprintf]
lea eax, [ebp + 0xdc]
push 0x407f3c
push eax
call dword [sym.imp.MSVCR80.dll_fopen]
mov esi, dword [sym.imp.MSVCR80.dll_fprintf]
push str.:Repeat_n
push eax
mov dword [ebp - 0x2c], eax
call esi
lea eax, [ebp - 0x28]
push eax
mov edi, str.del___s__n
push edi
push dword [ebp - 0x2c]
call esi
lea eax, [ebp - 0x28]
push eax
push str.if_exist___s__goto_Repeat_n
push dword [ebp - 0x2c]
call esi
lea eax, [ebp + 0xdc]
push eax
push edi
push dword [ebp - 0x2c]
call esi
add esp, 0x40
push dword [ebp - 0x2c]
call dword [sym.imp.MSVCR80.dll_fclose]
push 0x44
pop esi
push esi
lea eax, [ebp - 0x80]
push ebx
push eax
call sub.MSVCR80.dll_memset
add esp, 0x10
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x80]
push eax
push 0x407370
push ebx
push esi
push ebx
push ebx
push ebx
lea eax, [ebp + 0xdc]
push eax
push ebx
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x54], 1
mov word [ebp - 0x50], bx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x403495
mov esi, dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 0xfffffffffffffff1
push dword [ebp - 0x38]
call esi
push 0xf
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push pe_nt_image_headers32
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push dword [ebp - 0x3c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push dword [ebp - 0x38]
call esi
mov ecx, dword [ebp + 0x1e0]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004065b0
add ebp, 0x1e4
leave
ret
Function at 0x402c4f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea edx, [0x4054e8]
mov ecx, edx
mov eax, dword [edx]
inc ecx
inc ecx
inc ecx
inc ecx
mov edi, dword [ecx]
mov ecx, eax
mov eax, dword [edi]
add edi, 4
mov esi, edi
mov ebx, esi
add edi, eax
mov edx, edi
dec edx
sub ecx, eax
dec ecx
dec ecx
dec ecx
dec ecx
lea eax, [0x4054e8]
mov dword [eax], ecx
inc eax
inc eax
inc eax
inc eax
mov dword [eax], edi
push ecx
mov ch, byte [edi]
mov al, byte [0x4053c3]
jmp 0x402c90
add al, byte [esi]
xor al, ch
mov byte [edi], al
mov eax, edx
cmp esi, eax
jne 0x402c9f
mov esi, ebx
dec esi
inc esi
pop ecx
inc edi
dec ecx
jne 0x402c83
jmp 0x402cab
mov edi, esi
push 0x39
push 0x4054e8
push 0x111
push dword [0x4054c4]
call dword [sym.imp.user32.dll_SendMessageA]
mov ecx, dword [0x4054e8]
mov edi, dword [0x4054ec]
mov esi, dword [0x4054dc]
mov al, byte [esi]
mov byte [edi], al
inc esi
inc edi
dec ecx
jne 0x402cd7
mov esi, dword [0x4053be]
mov ecx, dword [0x4053ba]
push ecx
add ecx, esi
mov dword [0x4054a8], ecx
pop ecx
mov eax, dword [esi]
inc esi
inc esi
nop
inc esi
inc esi
mov edi, dword [0x4054dc]
mov ebx, esi
add ebx, eax
mov dword [0x4054a4], ebx
mov edx, esi
add esi, eax
mov ecx, 0
movzx eax, byte [edx]
inc eax
cmp edx, ebx
jae 0x402d7e
cmp eax, ecx
jae 0x402d23
ret
sub eax, ecx
mov ecx, eax
test ecx, ecx
je 0x402d34
mov al, byte [esi]
mov byte [edi], al
inc esi
inc edi
dec ecx
jne 0x402d2b
inc edx
mov al, byte [edx]
inc edx
movzx ecx, byte [edx]
test ecx, ecx
je 0x402d47
push ecx
mov byte [edi], al
inc edi
dec ecx
jne 0x402d40
pop ecx
inc edx
movzx eax, byte [edx]
inc cl
cmp cl, 0
jne 0x402d68
inc al
cmp al, 0
jne 0x402d60
inc edx
movzx eax, word [edx]
inc edx
inc edx
jmp 0x402d64
mov al, 0
dec al
dec cl
jmp 0x402d7a
dec cl
inc al
cmp al, 0
jne 0x402d78
inc edx
movzx eax, word [edx]
inc edx
inc edx
jmp 0x402d7a
dec al
jmp 0x402d1a
mov ecx, dword [0x4054a8]
sub ecx, esi
test ecx, ecx
je 0x402d93
mov al, byte [esi]
mov byte [edi], al
inc esi
inc edi
dec ecx
jne 0x402d8a
mov edi, dword [0x4054dc]
mov dword [0x4054dc], edi
ret

Function at 0x4015a0
Capabilities:
Terminate process

Disassembly:
call fcn.00401940
jmp fcn.004012d0

Function at 0x4015b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x403008]
jne 0x4015ba
repz ret
jmp fcn.004019f0
Function at 0x10015217
Capabilities:
Enumerate processes

Disassembly:
push 0x238
mov eax, 0x1002d711
call fcn.10017005
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x10015234
xor eax, eax
jmp 0x10015311
xor edi, edi
push edi
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
test esi, esi
je 0x1001530f
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x23c], 0x22c
push eax
push esi
call sub.kernel32.dll_Process32FirstW
jmp 0x100152e5
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x244]
call fcn.1000128b
push ebx
lea ecx, [ebp - 0x240]
mov dword [ebp - 4], edi
call fcn.1000128b
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 1
call fcn.10001cc6
lea ecx, [ebp - 0x240]
call fcn.10001cc6
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x240]
push eax
call fcn.100226a8
pop ecx
pop ecx
mov ecx, dword [ebp - 0x240]
lea ecx, [ecx - 0x10]
test al, al
jne 0x100152ef
call fcn.10001eb4
mov ecx, dword [ebp - 0x244]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.10001eb4
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.kernel32.dll_Process32NextW
test eax, eax
jne 0x10015264
jmp 0x10015308
mov edi, dword [ebp - 0x234]
call fcn.10001eb4
mov ecx, dword [ebp - 0x244]
add ecx, 0xfffffff0
call fcn.10001eb4
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, edi
call fcn.10016faf
ret

Function at 0x100226a8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x100226b7
pop dword [ebp - 0x40]
mov eax, 0x100226b7
sub dword [ebp - 0x40], eax
push 0x40
push 0x1000
push 0x3f3b0
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x40]
call dword [eax]
mov ecx, 0xe5515673
add ecx, 0x1aaeed39
xor edx, edx
add edx, eax
mov ebx, 0x1004ac00
add ebx, dword [ebp - 0x40]
mov edi, 0x58d291b6
sub edi, 0x3c83421e
add dword [ebp - 0x10], 0xe9ba0733
mov esi, dword [ebx]
sub dword [ebp - 0x38], eax
sub esi, edi
add dword [ebp - 0x24], 0x55c4744a
mov dword [edx], esi
xor dword [ebp - 8], eax
add edx, 0xc831c553
sub edx, 0xc831c54f
add ebx, 0xafa9b6a
sub ebx, 0xafa9b66
loop 0x10022708
add eax, 0x10183
xor ebx, ebx
add ebx, eax
add eax, 0x61c1f9ca
add eax, 0x9e3e063b
mov ecx, 0xd3b74a57
sub ecx, 0xc3b74a57
add ecx, dword [ebp - 0x40]
call ebx
leave
ret