joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44aabd
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor dl, 0x6a
lea eax, [esp + ebx]
mov eax, dword [esp]
mov eax, dword [esp]
call fcn.0044aa44
mov ah, byte [esp + 1]
lea esp, [esp + 2]
jmp 0x44aa96
lea esp, [esp + 4]
not dl
push eax
xchg dword [esp], eax
mov al, byte [esp + 1]
jmp 0x44ab05
add bl, dl
or dx, 0x3624
jne 0x44aadb
xchg al, ah
rcl ax, cl
stc
jmp 0x44aadf
bswap eax
lea esp, [esp + 4]
jmp 0x44aa63
rcl ax, cl
stc
jmp 0x44aadf
xchg al, ah
jmp 0x44aac5
inc esi
not ah
dec dx
js 0x44ab18
jns 0x44abbe
push dx
mov dl, byte [esp]
jmp 0x44ab24
pop ax
xchg word [esp], ax
mov ah, 0x86
lea esp, [esp]
not eax
lea esp, [esp + 2]
jmp 0x44aaa6
mov ax, dx
rdtsc
bswap eax
push dx
mov dl, byte [esp]
pushfd
push word [esp + 3]
je 0x44ab54
lea edx, [ebx*4]
jmp 0x44abca
call 0x44ab84
popal
cli
push 0x414ffa0f
fisttp word [edi + 0x2a]
fst dword [ebp - 0x4e]
lodsd eax, dword [esi]
mov esp, 0x1c87168f
and al, 0xf6
aam 0xf
xor dword [edi - reloc.mscoree.dll__CorExeMain], eax
shr ebx, 1
sbb al, 0x9a
add dword [ecx + reloc.mscoree.dll__CorExeMain], edx
add edi, dword [edx + reloc.mscoree.dll__CorExeMain]
mov edx, 0x69284ae3
setl al
mov dh, byte [esp]
mov eax, edx
jmp 0x44ab6a
xchg dword [esp], ebx
not ah
rdtsc
xchg edx, eax
dec eax
mov dx, cx
jmp 0x44ab95
lea ebx, [ebx - 0x1b]
mov ax, word [esp]
btc edx, eax
mov dh, byte [esp]
not dx
sub edx, esp
jmp 0x44ac38
mov ax, dx
rdtsc
bswap eax
jmp 0x44aaec
rcl dh, 6
lea edx, [eax + edx]
jmp 0x44ac04
call fcn.0044abee
shl dword [ebx - 0xd], 0x96
movsd dword es:[edi], dword gs:[esi]
cmp dword [edx + edi + reloc.mscoree.dll__CorExeMain], esp
rcl byte [ebx - 0x36]
push dword gs:[esp]
push dword [esp]
ret 4
lea esp, [esp + 8]
dec cl
sub esp, 3
jge 0x44abd2
jl 0x44abd2
rcr ah, 5
ja 0x44ac62
rdtsc
lea eax, [ebp*4]
pop word [esp + 2]
lea esp, [esp + 1]
call fcn.0044ad34
fstp qword [esi - 0x34]
stosd dword es:[edi], eax
xlatb
das
and dword ss:[eax - 0x5d], esp
xchg dword [esp], ebx
dec dh
inc edx
mov ah, byte [esp]
neg ax
lea eax, [edi + ebp]
jmp 0x44abe8
pop word [esp + 2]
lea esp, [esp + 1]
call fcn.0044accc
fcomp dword [eax - 0x32]
test eax, 0x24359d58
push edi
mov esi, 0x8d310f89
add al, 0xad
add byte [eax], al
add byte [eax], al
rdtsc
lea eax, [ebp*4]
jmp 0x44ac49

Function at 0x4cadfa
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub ax, cx
mov dl, cl
bswap ebx
bts dx, bp
jno 0x4cae14
jo 0x4cae47
jmp 0x4cae4c
lea esp, [esp + 4]
not dx
push eax
jmp 0x4cae52
jmp 0x4cadeb
shr bx, cl
neg ebx
je 0x4cadfc
jne 0x4cadfc
sub esp, 0x1d
jb 0x4cae86
lea ebx, reloc.mscoree.dll__CorExeMain
clc
sub esp, 0xe
pop ebx
jmp 0x4caea5
lea ebx, reloc.mscoree.dll__CorExeMain
clc
jmp 0x4cae70
mov bx, 0x6f9f
jmp 0x4cae78

Function at 0x4cae12
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub ax, cx
mov dl, cl
bswap ebx
bts dx, bp
jno 0x4cae14
jo 0x4cae47
jmp 0x4cae4c
lea esp, [esp + 4]
not dx
push eax
jmp 0x4cae52
jmp 0x4cadeb
shr bx, cl
neg ebx
je 0x4cadfc
jne 0x4cadfc
sub esp, 0x1d
jb 0x4cae86
lea ebx, reloc.mscoree.dll__CorExeMain
clc
sub esp, 0xe
pop ebx
jmp 0x4caea5
lea ebx, reloc.mscoree.dll__CorExeMain
clc
jmp 0x4cae70
mov bx, 0x6f9f
jmp 0x4cae78
Function at 0x4caf0d
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bh, byte [esp]
push ecx
adc bx, 0xd5ca
sub esp, 6
mov bl, byte [esp]
jmp 0x4caf4d
lea esp, [esp + 2]
xchg dword [esp + 8], esi
bsr bx, bx
bswap ebx
lea ebx, reloc.mscoree.dll__CorExeMain
neg bx
jmp 0x4cb22e
xchg bh, bl
lea esi, [esi + 0x30]
stc
lea ebx, [eax + ebp]
mov bx, word [esp]
sub esp, 0x10
call fcn.004cafde

Function at 0x4f54cf
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ebp, reloc.mscoree.dll__CorExeMain
mov dh, byte [esp + 9]
lea ebx, [eax + ebp]
bswap ecx
sub esp, 0x17
mov ebp, ecx
jmp 0x4f52f5
inc ecx
mov dword [esp + 9], edi
mov dword [esp + 3], ebx
neg esi
xchg ebp, edi
xchg edi, edx
jmp 0x4f530c
mov eax, dword [esp + 0xc]
xchg ebx, edi
lea ecx, [ebp*4]
not cl
mov byte [esp + 0xb], dl
jmp 0x4f5341
Function at 0x4f5aa9
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 2
mov bh, dl
stc
setp dl
cmc
mov ch, 0x1c
jmp 0x4f5ad0
shr cl, 2
cpuid
cmc
mov bp, 0x8da0
bsf bp, dx
pop esi
jmp 0x4f5a6d
rdtsc
mov cl, byte [esp + 1]
mov eax, ebx
lea edi, [eax + edi]
mov dword [esp + 2], ecx
jmp 0x4f5a83
mov bh, dl
setnp al
mov byte [esp], cl
lea ebp, [esi + 0xac]
xchg si, ax
jmp 0x4f5aea
add esp, 1
mov esi, 0xf1f47b1e
mov ax, si
lea ebx, reloc.mscoree.dll__CorExeMain
bswap edi
mov ebx, 0x1c021584
jmp 0x4f5aba
lea esp, [esp]
mov al, 0x98
setno dl
xchg byte [esp], bl
cpuid
xchg ebp, eax
jmp 0x4f5b8b
xor esi, 0x6d3fd4fb
inc ecx
xchg cl, al
not edi
xchg word [esp], bp
jmp 0x4f5b43
rdtsc
mov dl, bl
neg ebp
push word [esp + 4]
lea edi, [esi + ebp]
lea esp, [esp + 5]
jmp 0x4f5b19
mov ebx, 0x77be2b31
add esp, 0
clc
sub esp, 8
mov dword [esp + 2], ecx
jmp 0x4f5b6a
mov ah, dh
add esp, 0xa
bt ebp, edx
neg ebp
pushfd
bsr cx, sp
jmp 0x4f5b2f
xchg ebp, eax
lea eax, [edi*4]
mov bp, 0x569f
pop word [esp + 1]
bts ebp, ebp
mov ax, si
jmp 0x4f5bd4
mov eax, dword [esp]
shl al, 7
lea esp, [esp]
lea esp, [esp]
sub esp, 0xa
mov ebp, 0x1f645bb2
jmp 0x4f5b59
mov edx, 0x7838bda7
mov word [esp], di
push dword [esp + 3]
dec ch
jmp 0x4f5c2f
rol esi, cl
pop ebp
mov cx, 0x12bd
btc esi, ecx
push word [esp + 1]
mov ch, 0x19
jmp 0x4f5ba1
mov byte [esp + 2], cl
mov si, ax
lea edx, [eax*4]
pop si
or ebx, 0x154d5158
xchg byte [esp + 4], bh
jmp 0x4f5bb7
mov bh, 0xd
mov dword [esp + 2], ebx
add esp, 1
xchg edx, ecx
xchg word [esp + 3], si
jmp 0x4f5c60
xchg word [esp + 2], bx
lea eax, [edx*4]
mov dword [esp + 1], ebx
bsf eax, edx
mov dword [esp], edi
lea eax, [edi + 0xa]
jmp 0x4f5c19
mov ecx, dword [esp]
bswap eax
neg cx
pop word [esp]
neg dl
xchg edx, ecx
call fcn.004f5c4a
xchg word [esp + 0x14], si
xchg word [esp + 0x18], di
sub esp, 0x17
xchg al, bl
jmp 0x4f5c9b
xchg ebp, esi
cpuid
popal
push cx
push word [esp + 0x16]
mov dh, 0xcb
jmp 0x4f5f39
xchg al, ah
lea edx, [edi*4]
push esi
mov byte [esp + 2], dl
jmp 0x4f5d3b
lea ebx, reloc.mscoree.dll__CorExeMain
sub esp, 0x16
bts edi, edx
xchg dword [esp + 0x15], ebp
mov dword [esp + 4], edx
mov eax, 0xaf02e89c
jmp 0x4f5cd4
mov bp, word [esp + 1]
neg eax
dec eax
xchg dh, bl
mov esi, dword [esp + 3]
mov ah, 0xa1
jmp 0x4f5cea
popal
mov bl, 0x5f
mov bh, byte [esp]
xor dh, 0x5a
rdtsc
mov ax, si
jmp 0x4f5cae

Function at 0x4f5c4a
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x4f5c8b
mov esi, 0xe17d4cd6
pop dword [esp]
xchg ch, ah
cpuid
pushal
clc
jmp 0x4f5c75

Function at 0x4f5ef7
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, 0x25aa9bcf
bswap edi
push word [esp + 3]
rdtsc
jmp 0x4f5f18
Function at 0x4f63e1
Capabilities:
Access peb ldr_data

Disassembly:
call fcn.004f6054
push word [esp]
jmp 0x4f63bc
mov byte [esp + 5], dl
pop word [esp + 4]
mov byte [esp + 5], bl
pop dword [esp]
pushfd
push dword [esp + 5]
call fcn.004f63a1
mov dword [esp + 0xe], ebx
pushfd
call 0x4f63e1
in eax, dx
push dword [esp + 7]
mov dword [esp + 0x58], edi
lea esp, [esp + 0x58]
jmp 0x4f6414
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x4f651c
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x4f604f
Function at 0x10015217
Capabilities:
Enumerate processes

Disassembly:
push 0x238
mov eax, 0x1002d711
call fcn.10017005
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x10015234
xor eax, eax
jmp 0x10015311
xor edi, edi
push edi
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
test esi, esi
je 0x1001530f
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x23c], 0x22c
push eax
push esi
call sub.kernel32.dll_Process32FirstW
jmp 0x100152e5
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x244]
call fcn.1000128b
push ebx
lea ecx, [ebp - 0x240]
mov dword [ebp - 4], edi
call fcn.1000128b
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 1
call fcn.10001cc6
lea ecx, [ebp - 0x240]
call fcn.10001cc6
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x240]
push eax
call fcn.1001af27
pop ecx
pop ecx
mov ecx, dword [ebp - 0x240]
lea ecx, [ecx - 0x10]
test al, al
jne 0x100152ef
call fcn.10001eb4
mov ecx, dword [ebp - 0x244]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.10001eb4
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.kernel32.dll_Process32NextW
test eax, eax
jne 0x10015264
jmp 0x10015308
mov edi, dword [ebp - 0x234]
call fcn.10001eb4
mov ecx, dword [ebp - 0x244]
add ecx, 0xfffffff0
call fcn.10001eb4
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, edi
call fcn.10016faf
ret

Function at 0x1001af27
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x1001af36
pop dword [ebp - 0x30]
mov eax, 0x1001af36
sub dword [ebp - 0x30], eax
push 0x40
push 0x1000
push reloc.kernel32.dll_CreateFileW
push 0
mov eax, 0x6a44720c
sub eax, 0x5a4180b0
add eax, dword [ebp - 0x30]
call dword [eax]
mov ecx, 0x63ac4ca8
add ecx, 0x9c53f58d
mov edx, eax
mov esi, 0x1004ac00
add esi, dword [ebp - 0x30]
mov ebx, 0xa65f38cb
sub ebx, 0xc523c2f0
mov dword [ebp - 0x24], 0xe83de6af
mov edi, dword [esi]
mov dword [ebp - 4], 0x395577df
sub edi, ebx
xor dword [ebp - 0x1c], 0xc51f33d8
mov dword [edx], edi
add dword [ebp - 0x20], 0x80d2c5fb
add edx, 0x35e26312
add edx, 0xca1d9cf2
add esi, 0x45501cac
add esi, 0xbaafe358
loop 0x1001af8a
add eax, 0x589d586e
sub eax, 0x589c5cc7
mov ebx, eax
add eax, 5
mov ecx, 0x83e762c6
sub ecx, 0x73e762c6
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x4062c0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x415f3b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
lea ecx, [esi + 4]
mov dword [esi], 0x4041fc
call fcn.004074ab
push 4
mov dword [esp + 0x18], 0
call fcn.00408784
mov edi, eax
add esp, 4
test edi, edi
je 0x406334
push ebx
call fcn.004072a6
mov dword [edi], eax
call fcn.00407065
push 0
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.0040746c
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x406328
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0xc]
call fcn.00407494
pop ebx
jmp 0x406336
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x40935b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x419354]
jne 0x409365
repz ret
jmp fcn.0040e04c
Function at 0x4128de
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419354]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040b3ff
and dword [ebp - 0x14], 0
cmp dword [0x4302c4], 0
mov dword [ebp - 0x18], eax
jne 0x412991
push 0x403e40
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x412a39
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403e34
push ebx
call edi
test eax, eax
je 0x412a39
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403e24
push ebx
mov dword [0x4302c4], eax
call edi
push eax
call esi
push 0x403e10
push ebx
mov dword [0x4302c8], eax
call edi
push eax
call esi
push 0x403df4
push ebx
mov dword [0x4302cc], eax
call edi
push eax
call esi
mov dword [0x4302d4], eax
test eax, eax
je 0x412991
push 0x403ddc
push ebx
call edi
push eax
call esi
mov dword [0x4302d0], eax
mov eax, dword [0x4302d0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4129ea
cmp dword [0x4302d4], ecx
je 0x4129ea
push eax
call esi
push dword [0x4302d4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4129ea
test ebx, ebx
je 0x4129ea
call edi
test eax, eax
je 0x4129e1
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4129e1
test byte [ebp - 8], 1
jne 0x4129ea
or dword [ebp + 0x10], 0x200000
jmp 0x412a1d
mov eax, dword [0x4302c8]
cmp eax, dword [ebp - 0x18]
je 0x412a1d
push eax
call esi
test eax, eax
je 0x412a1d
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x412a1d
mov eax, dword [0x4302cc]
cmp eax, dword [ebp - 0x18]
je 0x412a1d
push eax
call esi
test eax, eax
je 0x412a1d
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4302c4]
call esi
test eax, eax
je 0x412a39
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x412a3b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040935b
leave
ret
Function at 0x401020
Capabilities:
Check mutex on windows

Disassembly:
push 0xffffffffffffffff
push 0x429690
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x43b14c]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov eax, dword [0x44130c]
mov edx, dword [eax + 0xc]
mov ecx, 0x44130c
xor esi, esi
call edx
add eax, 0x10
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
push eax
push ecx
push edx
push str.c__s__s__s
lea edi, [esp + 0x1c]
mov dword [esp + 0x2c], esi
call fcn.004016f0
mov edx, dword [esp + 0x1c]
push esi
lea ecx, [esp + 0x24]
call fcn.00416c70
add esp, 0x14
mov byte [esp + 0x1c], 1
call fcn.00401380
mov byte [esp + 0x1c], 0
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4010be
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [esp + 0xc]
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x441f4c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4010e8
cmp dword [0x441f4c], 0
jne 0x4010ed
mov esi, 1
lea eax, [edi - 0x10]
mov dword [esp + 0x1c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401111
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret
Function at 0x401130
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x429cb0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x43b14c]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov eax, dword [0x44130c]
mov edx, dword [eax + 0xc]
mov ecx, 0x44130c
xor ebx, ebx
call edx
add eax, 0x10
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x34]
push eax
push ecx
push edx
push 0x42ce20
lea edi, [esp + 0x24]
mov dword [esp + 0x34], ebx
call fcn.004016f0
mov edx, dword [esp + 0x24]
push ebx
lea ecx, [esp + 0x2c]
call fcn.00416c70
add esp, 0x14
mov byte [esp + 0x24], 1
call fcn.00401380
mov byte [esp + 0x24], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4011ce
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x18]
push 0x42ce34
push ecx
lea ecx, [esp + 0x1c]
call fcn.00401270
mov eax, dword [eax]
add esp, 8
push eax
push ebx
push 0x20000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov esi, eax
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x401215
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp esi, ebx
je 0x401225
push esi
mov ebx, 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x24], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40124d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret

Function at 0x4017b0
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x24
lea eax, [esp + 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4017ec
lea ecx, [esp + 8]
push ecx
push 0x42cf14
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x4017f2
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add esp, 0x24
ret
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push 0
push 0
push 0x10
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x14]
push 0
push eax
mov dword [esp + 0x28], 1
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x40183f
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add esp, 0x24
ret
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add esp, 0x24
ret
Function at 0x4019e0
Capabilities:
Access peb ldr_data
Resolve dns

Disassembly:
push 0xffffffffffffffff
push 0x429c78
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x43b14c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x44130c]
mov edx, dword [eax + 0xc]
mov ecx, 0x44130c
xor ebp, ebp
call edx
add eax, 0x10
mov dword [esp + 0x18], eax
mov dword [esp + 0x30], ebp
cmp esi, ebp
jne 0x401a2d
xor eax, eax
jmp 0x401a41
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x401a32
sub eax, edx
sar eax, 1
mov ebx, eax
push esi
lea eax, [esp + 0x1c]
call fcn.00401470
mov eax, dword [0x44130c]
mov edx, dword [eax + 0xc]
mov ecx, 0x44130c
call edx
add eax, 0x10
mov dword [esp + 0x14], eax
lea eax, [esp + 0x24]
push eax
lea ebx, [esp + 0x1c]
mov byte [esp + 0x34], 1
call fcn.004034f0
add esp, 4
mov bl, 2
mov byte [esp + 0x30], bl
mov eax, dword [eax]
push 0
mov edx, eax
lea ecx, [esp + 0x24]
call fcn.00416c70
add esp, 4
lea edi, [esp + 0x14]
mov byte [esp + 0x30], 3
call fcn.00401380
mov byte [esp + 0x30], bl
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401ac3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebx, 1
mov byte [esp + 0x30], bl
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401aec
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ebx
push 0x42cf90
lea ecx, [esp + 0x1c]
push ecx
call fcn.00403ef0
mov edx, str.780e3ce5bfc17823bc43168597d38b61
lea ecx, [esp + 0x24]
call fcn.00416e50
mov byte [esp + 0x30], 4
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea edx, [esp + 0x1c]
push edx
call fcn.00403ef0
mov byte [esp + 0x30], bl
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401b44
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x20]
push ecx
push 0
push 0x68
push ebx
push esi
mov dword [esp + 0x34], 0
call sub.DNSAPI.dll_DnsQuery_W
test eax, eax
jne 0x401b80
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x401b80
cmp dword [eax + 0x18], 0x2c21160b
jne 0x401b79
mov ebp, ebx
push ebx
push eax
call sub.DNSAPI.dll_DnsFree
lea eax, [esi - 0x10]
mov byte [esp + 0x30], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x401ba1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x30], 0xffffffff
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401bc9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, ebp
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x402c70
Capabilities:
Create process on windows
Self delete
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x429690
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x43b14c]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov eax, dword [0x44130c]
mov edx, dword [eax + 0xc]
mov ecx, 0x44130c
call edx
lea esi, [eax + 0x10]
mov dword [esp + 0xc], esi
mov dword [esp + 0x1c], 0
mov eax, dword [0x44130c]
mov edx, dword [eax + 0xc]
mov ecx, 0x44130c
call edx
add eax, 0x10
mov dword [esp + 0x10], eax
push 0x100
mov byte [esp + 0x20], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 0xf
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ecx, dword [esi - 8]
mov eax, 1
sub eax, dword [esi - 4]
sub ecx, 0x104
or eax, ecx
jge 0x402d16
mov ecx, 0x104
lea eax, [esp + 0xc]
call fcn.004015f0
mov esi, dword [esp + 0xc]
push 0x104
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [esi - 8]
push eax
push esi
call fcn.00419e5c
add esp, 8
test eax, eax
jl 0x402d78
cmp eax, dword [esi - 8]
jg 0x402d78
xor edx, edx
push esi
mov dword [esi - 0xc], eax
push str._c_timeout__t_1__del__Q__F___s_
lea edi, [esp + 0x18]
mov word [esi + eax*2], dx
call fcn.004016f0
mov eax, dword [esp + 0x18]
add esp, 8
push 0
push 0
push eax
push str.cmd.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x80070057
call fcn.00401790
int3

Function at 0x402ff0
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x402f80
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0xc]
push eax
call fcn.00401fd0
add esp, 4
call fcn.00402c70
int3

Function at 0x404e10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push edi
push ebx
push ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x404e27
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x404e58
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x404e54
cmp esi, eax
jae 0x404e58
sub edi, 1
movzx ecx, word [esi]
lea esi, [esi + ecx*2 + 2]
jne 0x404e44
cmp esi, eax
jb 0x404e5e
pop esi
pop edi
xor eax, eax
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret