joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45c66c
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x4167e8]
call fcn.00404eec
xor eax, eax
push ebp
push 0x45c7b0
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x495d58], 0
jne 0x45c6bf
mov ecx, dword [0x496ef8]
mov dl, 1
mov eax, dword [0x407aac]
call fcn.0040b0c8
call fcn.00403f50
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00403084
mov eax, ebx
call fcn.00404d3c
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x45c7c0
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.0040638c
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00404d4c
test eax, eax
jle 0x45c757
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x45c750
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404770
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404758
mov eax, dword [ebp - 0x48]
pop edx
call fcn.004088a8
test eax, eax
jne 0x45c750
mov ebx, 0x15
jmp 0x45c75c
mov ebx, 0x10
jmp 0x45c75c
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x495d58]
call fcn.0045c5c4
mov eax, dword [ebp - 8]
call fcn.0045c5c4
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.004063a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45c7b7
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00404514
lea eax, [ebp - 0x10]
mov edx, dword [0x4167e8]
call fcn.00404fbc
ret

Function at 0x4695b4
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
mov edx, 0x40
call fcn.0040754c
ret
Function at 0x46c9a0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x46c9ce
mov eax, ebx
call fcn.0046d458
cmp dword [ebx + 0x3c], 0
je 0x46c9c7
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x46ca3f
mov edx, dword [ebx + 0x1ac]
cmp dword [edx + 0x10], 0
je 0x46ca31
cmp dword [ebx + 8], 0
je 0x46c9f0
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1ac]
call dword [edx]
test eax, eax
jne 0x46ca02
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x46ca31
cmp dword [ebx + 8], 0
je 0x46c9e3
cmp eax, 3
je 0x46ca15
dec eax
jne 0x46c9e3
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x46c9e3
mov edx, dword [ebx + 0x138]
add dword [eax + 8], edx
jmp 0x46c9e3
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x46ca5d
cmp dword [ebx + 0x10], 0xcc
je 0x46ca5d
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0046ca68
pop ebx
ret

Function at 0x47e588
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
xor eax, eax
push ebp
push 0x47e5dc
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea edx, [ebp - 4]
mov eax, dword [0x4972b8]
mov eax, dword [eax]
call fcn.0045b328
mov eax, dword [ebp - 4]
call fcn.004049a0
push eax
call sub.kernel32.dll_WinExec
mov eax, dword [0x4972b8]
mov eax, dword [eax]
call fcn.0045ae3c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47e5e3
lea eax, [ebp - 4]
call fcn.004044f0
ret
Function at 0x493578
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
xor ecx, ecx
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404990
mov eax, dword [ebp - 8]
call fcn.00404990
xor eax, eax
push ebp
push 0x493685
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
cmp byte [eax], 0x22
jne 0x4935c2
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.00404588
jmp 0x4935dc
push 0x493698
push dword [ebp - 8]
push 0x493698
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404868
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00408df8
lea eax, [ebp - 0x54]
xor ecx, ecx
mov edx, 0x44
call fcn.00403084
mov dword [ebp - 0x54], 0x44
mov dword [ebp - 0x28], 1
mov word [ebp - 0x24], 1
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x54]
push eax
mov eax, dword [ebp - 0xc]
call fcn.004049a0
push eax
push 0
push 0x30
push 0xffffffffffffffff
push 0
push 0
push dword [ebp - 4]
push 0x4936a4
push dword [ebp - 8]
lea eax, [ebp - 0x68]
mov edx, 3
call fcn.00404868
mov eax, dword [ebp - 0x68]
call fcn.004049a0
push eax
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x493662
push 0xffffffffffffffff
mov eax, dword [ebp - 0x64]
push eax
call sub.kernel32.dll_WaitForSingleObject
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49368c
lea eax, [ebp - 0x68]
call fcn.004044f0
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404514
ret
Function at 0x494154
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov esi, edx
lea edi, [ebp - 0x2c]
mov ecx, 7
rep movsd dword es:[edi], dword [esi]
mov ebx, eax
lea eax, [ebp - 0x2c]
mov edx, dword [0x492834]
call fcn.004050e8
xor eax, eax
push ebp
push 0x4943a0
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
mov eax, dword [ebp - 0x20]
mov edx, 0x4943bc
call fcn.004048ec
jne 0x4941c0
lea eax, [ebp - 0xc]
mov edx, 0x4943c8
call fcn.00404588
jmp 0x4941d0
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0x2c]
mov edx, 0x4943e8
call fcn.004047f4
xor eax, eax
push ebp
push 0x494217
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x4943c8
call fcn.00408d2c
test al, al
je 0x4941f6
mov eax, 0x4943c8
call fcn.00408d60
push 0xffff
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x41791c]
call fcn.0041c258
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49422b
xor eax, eax
push ebp
push 0x494254
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x304]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x28]
call fcn.0048c394
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x494270
mov eax, dword [ebp - 8]
call fcn.00403784
mov eax, dword [ebp - 0x20]
mov edx, 0x4943bc
call fcn.004048ec
jne 0x4942bf
lea eax, [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
mov edx, 0x4943e8
call fcn.004047f4
mov edx, dword [ebp - 0x30]
lea ecx, [ebp - 0x10]
mov eax, 0x4943c8
call fcn.004936a8
test eax, eax
jne 0x49436a
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0x2c]
mov edx, 0x4943e8
call fcn.004047f4
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
sub eax, 0x30
jne 0x49432f
lea eax, [ebp - 0x38]
call fcn.00493518
push dword [ebp - 0x38]
push 0x4943fc
push dword [ebp - 0x2c]
lea eax, [ebp - 0x34]
mov edx, 3
call fcn.00404868
mov eax, dword [ebp - 0x34]
call fcn.00408d2c
test al, al
jne 0x49432f
push 0
lea eax, [ebp - 0x40]
call fcn.00493518
push dword [ebp - 0x40]
push 0x4943fc
push dword [ebp - 0x2c]
lea eax, [ebp - 0x3c]
mov edx, 3
call fcn.00404868
mov eax, dword [ebp - 0x3c]
call fcn.004049a0
push eax
mov eax, dword [ebp - 0xc]
call fcn.004049a0
push eax
call sub.kernel32.dll_CopyFileA
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
sub eax, 0x30
dec eax
je 0x494342
sub eax, 2
je 0x49435c
jmp 0x494366
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.00493964
xor ecx, ecx
mov dl, 1
mov eax, dword [ebp - 0xc]
call fcn.00493964
jmp 0x494366
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.00493578
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4943a7
lea eax, [ebp - 0x40]
mov edx, 5
call fcn.00404514
lea eax, [ebp - 0x2c]
mov edx, dword [0x492834]
call fcn.00404fbc
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00404514
ret
Function at 0x4947d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov eax, 0x494460
call fcn.00406a6c
xor eax, eax
push ebp
push 0x494930
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov dl, 1
mov eax, dword [0x493aa0]
call fcn.00453624
mov ebx, eax
mov eax, ebx
call fcn.00493d80
test al, al
jne 0x494817
mov eax, ebx
call fcn.00403784
jmp 0x494922
mov edx, 0x499e9c
mov eax, ebx
call fcn.00493c6c
mov esi, eax
mov eax, ebx
call fcn.00403784
test esi, esi
jne 0x494922
mov eax, 0x494948
cmp byte [eax + 0x31], 0x31
jne 0x494871
push 1
push 0x49497c
mov eax, dword [0x499e9c]
call fcn.004049a0
push eax
push 0x494980
push 0x49498c
push 0
call sub.shell32.dll_ShellExecuteA
push 0x3e8
call sub.kernel32.dll_Sleep_1
jmp 0x494922
mov eax, dword [0x4972b8]
mov eax, dword [eax]
call fcn.0045acb8
mov eax, dword [0x4972b8]
mov eax, dword [eax]
mov edx, 0x49499c
call fcn.0045a8dc
mov ecx, dword [0x49740c]
mov eax, dword [0x4972b8]
mov eax, dword [eax]
mov edx, dword [0x47d8dc]
call fcn.0045acd0
mov eax, dword [0x4970e8]
add eax, 0x10
mov edx, dword [0x499e9c]
call fcn.00404544
mov ecx, dword [0x497054]
mov eax, dword [0x4972b8]
mov eax, dword [eax]
mov edx, dword [0x47cc64]
call fcn.0045acd0
mov eax, dword [0x49740c]
mov eax, dword [eax]
mov edx, dword [eax + 0x320]
mov eax, dword [0x49740c]
mov eax, dword [eax]
call fcn.0047e72c
push 0x2c
push 0
push 1
push 0
call sub.user32.dll_RegisterHotKey
push 0x2c
push 1
push 2
push 0
call sub.user32.dll_RegisterHotKey
mov eax, dword [0x4972b8]
mov eax, dword [eax]
call fcn.0045ad50
push 1
push 0
call sub.user32.dll_UnregisterHotKey
push 2
push 0
call sub.user32.dll_UnregisterHotKey
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x494937
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x40b252
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x40b261
pop dword [ebp - 0x28]
mov eax, 0xf597b458
add eax, 0xaa8fe09
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x3b0a7
push 0
mov eax, 0x560993cf
add eax, 0xaa374d09
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0x5c0954f5
sub ecx, 0x5c090615
xor edx, edx
add edx, eax
mov edi, 0x32d1f10f
sub edi, 0x3290b54b
add edi, dword [ebp - 0x28]
mov esi, 0xc4ce9e42
sub dword [ebp - 0x10], ecx
mov ebx, dword [edi]
sub dword [ebp - 0xc], eax
xor ebx, esi
add dword [ebp - 4], 0x63269d1f
mov dword [edx], ebx
xor dword [ebp - 0x24], 0x23efb1b
add edx, 4
add edi, 0xdfdc1d04
sub edi, 0xdfdc1d00
loop 0x40b2bc
add eax, 0x4abf864b
sub eax, 0x4abe57f8
mov ebx, eax
add eax, 0x65ec3991
add eax, 0x9a13c674
mov ecx, 0x400000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x4013d0
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x429be1
push eax
mov eax, 0x188c
mov dword fs:[0], esp
call fcn.0040d420
mov eax, dword [0x436748]
push ebx
push ebp
xor ebx, ebx
push esi
push edi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov ecx, 0x5db
xor eax, eax
lea edi, [esp + 0x12d]
mov byte [esp + 0x12c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x29]
mov byte [esp + 0x28], bl
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x18b8]
lea edx, [esp + 0x12c]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x18b4]
push ecx
push 0x1770
push edx
push eax
mov dword [esp + 0x18b4], ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
xor eax, eax
cmp byte [esp + eax + 0x12c], bl
jne 0x40146e
cmp byte [esp + eax + 0x12d], bl
je 0x401476
inc eax
cmp eax, 0x1770
jl 0x40145c
mov esi, dword [esp + 0x18ac]
lea edi, [eax + 1]
push 0xffffffffffffffff
push ebx
mov ecx, esi
mov dword [esp + 0x28], edi
call fcn.0041c7df
mov ebp, dword [esp + 0x18b0]
push 0xffffffffffffffff
push ebx
mov ecx, ebp
call fcn.0041c7df
xor eax, eax
cmp edi, ebx
mov dword [esp + 0x18], eax
jle 0x40158f
mov ecx, dword [esp + 0x14]
mov al, byte [esp + eax + 0x12c]
mov byte [esp + ecx + 0x28], al
inc ecx
cmp al, bl
mov dword [esp + 0x14], ecx
jne 0x40157a
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x14]
call fcn.0041e79d
mov edx, dword [esp + 0x10]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
mov eax, dword [edx - 8]
mov dword [esp + 0x14], ebx
cmp eax, ebx
je 0x40157a
push 0x4360c0
lea ecx, [esp + 0x14]
call fcn.0041c055
push eax
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x18]
call fcn.0041bfbb
mov ecx, dword [esi + 8]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x18ac], 1
call fcn.0041c928
lea ecx, [esp + 0x1c]
mov byte [esp + 0x18a4], bl
call fcn.0041e614
push 0x4360c0
lea ecx, [esp + 0x14]
call fcn.0041c055
inc eax
lea ecx, [esp + 0x24]
push eax
push ecx
lea ecx, [esp + 0x18]
call fcn.0041bf02
mov ecx, dword [ebp + 8]
push eax
push ecx
mov ecx, ebp
mov byte [esp + 0x18ac], 2
call fcn.0041c928
lea ecx, [esp + 0x24]
mov byte [esp + 0x18a4], bl
call fcn.0041e614
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
inc eax
cmp eax, ecx
mov dword [esp + 0x18], eax
jl 0x4014ad
mov esi, dword [esi + 8]
lea ecx, [esp + 0x10]
mov dword [esp + 0x18a4], 0xffffffff
call fcn.0041e614
mov ecx, dword [esp + 0x189c]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1898
ret
Function at 0x4015d0
Capabilities:
Access peb ldr_data
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x429c00
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebp
push esi
push edi
mov dword [esp + 0x24], 0
call fcn.00426a66
mov esi, dword [eax + 0xc]
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
and ecx, 0xffff
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x40163d
lea ecx, [esp + 0x34]
mov dword [esp + 0x24], 0xffffffff
call fcn.0041e614
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x40167a
lea ecx, [esp + 0x34]
mov dword [esp + 0x24], 0xffffffff
call fcn.0041e614
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret
lea ecx, [esp + 0xc]
call fcn.0041eafc
mov edx, dword [esp + 0x34]
push 0
push 0x1001
push edx
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 1
call fcn.0041ec0e
push ebp
push esi
lea ecx, [esp + 0x14]
call fcn.0041ed65
lea ecx, [esp + 0xc]
call fcn.0041ee29
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 0
call fcn.0041eb51
lea ecx, [esp + 0x34]
mov dword [esp + 0x24], 0xffffffff
call fcn.0041e614
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
mov eax, 1
pop ebp
mov dword fs:[0], ecx
add esp, 0x1c
ret

Function at 0x4016f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
push ebp
push esi
push edi
call fcn.00426a66
mov esi, dword [eax + 0xc]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
and ecx, 0xffff
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x40171e
pop edi
pop esi
pop ebp
pop ecx
ret
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x40173b
pop edi
pop esi
pop ebp
pop ecx
ret
push ebx
push ebp
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, ebp
mov edi, eax
mov edx, ecx
lea eax, [esp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push eax
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
push ebx
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov ecx, dword [esp + 0x10]
push 0
push ecx
call fcn.00404cb0
mov edx, dword [esp + 0x28]
add esp, 8
push ebx
mov dword [edx], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [esp + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
pop ecx
ret
Function at 0x401930
Capabilities:
Access peb ldr_data
Create process on windows
Get common file path
Self delete
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x429d10
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
mov esi, dword [esp + 0x28]
push pe_nt_image_headers32
push pe_nt_image_headers32
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], 0
call fcn.0041ea1d
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push 0xffffffffffffffff
lea ecx, [esp + 0x2c]
call fcn.0041ea6c
mov eax, dword [0x436748]
mov dword [esp + 4], eax
push pe_nt_image_headers32
lea ecx, [esp + 8]
mov byte [esp + 0x24], 1
call fcn.0041ea1d
push eax
push pe_nt_image_headers32
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0xffffffffffffffff
lea ecx, [esp + 8]
call fcn.0041ea6c
lea ecx, [esp + 4]
push str.newyx.bat
lea edx, [esp + 0xc]
push ecx
push edx
call fcn.0041e8a9
mov eax, dword [eax]
push 0x436130
push eax
call fcn.0040d5cd
add esp, 8
lea ecx, [esp + 8]
mov esi, eax
call fcn.0041e614
test esi, esi
je 0x401b20
push esi
push str._echo_off_n
call fcn.0040d54e
push esi
push str.ping__n_2_127.0.0.1_nul_n
call fcn.0040d54e
add esp, 0x10
lea eax, [esp + 0x28]
lea ecx, [esp + 0xc]
push eax
push str.del__f__q
push ecx
call fcn.0041e91d
push str.newyxmodule.exe_n
lea edx, [esp + 0xc]
push eax
push edx
mov byte [esp + 0x2c], 2
call fcn.0041e8a9
mov eax, dword [eax]
push esi
push eax
call fcn.0040d54e
add esp, 8
lea ecx, [esp + 8]
call fcn.0041e614
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 1
call fcn.0041e614
lea eax, [esp + 0x28]
lea ecx, [esp + 0x14]
push eax
push str.move
push ecx
call fcn.0041e91d
push str.newyxupdate.exe
lea edx, [esp + 0x14]
push eax
push edx
mov byte [esp + 0x2c], 3
call fcn.0041e8a9
lea ecx, [esp + 0x28]
lea edx, [esp + 8]
push ecx
push eax
push edx
mov byte [esp + 0x2c], 4
call fcn.0041e843
push str.newyxmodule.exe_n
push eax
lea eax, [esp + 0x14]
mov byte [esp + 0x28], 5
push eax
call fcn.0041e8a9
mov eax, dword [eax]
push esi
push eax
call fcn.0040d54e
add esp, 8
lea ecx, [esp + 0xc]
call fcn.0041e614
lea ecx, [esp + 8]
mov byte [esp + 0x20], 4
call fcn.0041e614
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 3
call fcn.0041e614
lea ecx, [esp + 0x14]
mov byte [esp + 0x20], 1
call fcn.0041e614
push esi
push str.del__0
call fcn.0040d54e
push esi
call fcn.0040d4d1
add esp, 0xc
push str.newyx.bat
lea ecx, [esp + 8]
lea edx, [esp + 0x18]
push ecx
push edx
call fcn.0041e8a9
mov eax, dword [eax]
push 0
push 0
push 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp + 0x14]
call fcn.0041e614
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4032d0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x429e50
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push esi
test eax, eax
mov esi, ecx
je 0x4033e5
mov dword [esi + 0x84], 0xffffffff
mov eax, dword [0x436748]
push edi
mov dword [esp + 0x1c], eax
push pe_nt_image_headers32
push pe_nt_image_headers32
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 0
call fcn.0041ea1d
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0xffffffffffffffff
lea ecx, [esp + 0x20]
call fcn.0041ea6c
push 0x5c
lea ecx, [esp + 0x20]
call fcn.0041c033
inc eax
lea ecx, [esp + 8]
push eax
push ecx
lea ecx, [esp + 0x24]
call fcn.0041bfbb
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x18], 1
call fcn.0041e74d
lea ecx, [esp + 8]
mov byte [esp + 0x14], 0
call fcn.0041e614
mov eax, dword [esi + 0x98]
lea edi, [esi + 0x98]
push eax
mov ecx, esi
call fcn.004039f0
test eax, eax
je 0x4033a0
push 0x24
push 0x436468
push 0x436448
mov ecx, esi
call fcn.00420b97
cmp eax, 6
jne 0x4033d3
push ebp
mov ebp, dword [esi + 0x5c]
lea edx, [esp + 0x20]
push edi
lea eax, [esp + 0x10]
push edx
push eax
call fcn.0041e843
mov ecx, dword [esp + 0x20]
mov eax, dword [eax]
push 5
push ecx
push ebp
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp + 0xc]
call fcn.0041e614
pop ebp
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call fcn.0041e614
pop edi
push 0
mov ecx, esi
call fcn.00421db1
push esi
call fcn.00401d40
mov ecx, dword [esp + 8]
mov dword [esi + 0x88], 1
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x4039f0
Capabilities:
Enumerate processes

Disassembly:
push 0xffffffffffffffff
push 0x429ec6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x130
mov eax, dword [esp + 0x140]
push ebx
push esi
push edi
push eax
lea ecx, [esp + 0x14]
call fcn.0041e682
xor ebx, ebx
lea ecx, [esp + 0x10]
mov dword [esp + 0x144], ebx
call fcn.0041eab4
mov ecx, 0x49
xor eax, eax
lea edi, [esp + 0x18]
mov dword [esp + 0x14], 0x128
push ebx
push 2
rep stosd dword es:[edi], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
or edi, 0xffffffff
cmp esi, edi
je 0x403b1d
lea ecx, [esp + 0x14]
push ecx
push esi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x403b16
lea edx, [esp + 0x38]
lea ecx, [esp + 0xc]
push edx
call fcn.0041e682
lea ecx, [esp + 0xc]
mov byte [esp + 0x144], 1
call fcn.0041eab4
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0xc]
push eax
call fcn.0041c055
cmp eax, edi
jne 0x403aef
lea ecx, [esp + 0xc]
mov byte [esp + 0x144], bl
call fcn.0041e614
lea ecx, [esp + 0x14]
push ecx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x403b16
lea edx, [esp + 0x38]
lea ecx, [esp + 0xc]
push edx
call fcn.0041e682
lea ecx, [esp + 0xc]
mov byte [esp + 0x144], 1
call fcn.0041eab4
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0xc]
push eax
call fcn.0041c055
cmp eax, edi
je 0x403a9f
lea ecx, [esp + 0xc]
mov byte [esp + 0x144], bl
call fcn.0041e614
lea ecx, [esp + 0x10]
mov dword [esp + 0x144], edi
call fcn.0041e614
mov eax, 1
jmp 0x403b2f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x10]
mov dword [esp + 0x144], edi
call fcn.0041e614
xor eax, eax
mov ecx, dword [esp + 0x13c]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x13c
ret 4