joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4018f0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x40d004]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, str.Default_Monitor
mov eax, str.NCP004D
lea ecx, [ecx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401930
test dl, dl
je 0x40192c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401930
add eax, 2
add ecx, 2
test dl, dl
jne 0x401910
xor eax, eax
jmp 0x401935
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4019fe
lea eax, [ebp - 0x108]
push eax
push 8
push 0
push str.SYSTEMCurrentControlSetControlClass4d36e968_e325_11ce_bfc1_08002be10318
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x401982
add eax, 0xfffffffe
cmp eax, 1
jbe 0x4019fe
or dword [0x40ea38], 0xfffffffe
mov eax, dword [0x40ea38]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004020bf
mov esp, ebp
pop ebp
ret
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
xor esi, esi
lea esp, [esp]
mov eax, dword [ebp - 0x108]
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x10c]
push ecx
lea edx, [ebp - 0x104]
push edx
push esi
push eax
mov dword [ebp - 0x10c], 0x100
call edi
test eax, eax
jne 0x4019d3
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x104]
call fcn.004014f0
add esp, 4
inc esi
jmp 0x401990
mov esi, 0xfffffffe
cmp eax, 0x103
je 0x4019e5
or dword [0x40ea38], esi
mov edx, dword [ebp - 0x108]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x4019fc
or dword [0x40ea38], esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
mov eax, dword [0x40ea38]
xor ecx, ebp
call fcn.004020bf
mov esp, ebp
pop ebp
ret
Function at 0x401a40
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx]
lea eax, [esp + 8]
push 0
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
je 0x433072
nop
nop
nop
nop
mov ebx, 0x40de38
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x5b0f256d
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
je 0x4330d2
nop
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x61045477
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4330c0
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x40891d
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x4085d8
call fcn.0040893d
add edx, esi
xor dword [eax], edi
mov edx, 0x86101951
add eax, 1
cmp eax, ebx
jne fcn.0040891d
mov esi, edx
ret

Function at 0x40226a
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push edi
mov byte [ebp - 0x104], 0
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 4], 0
mov eax, 0x4021d6
sub eax, 0x401cf5
mov dword [ebp - 4], eax
push 8
push 0x408008
lea ecx, [ebp - 0x104]
push ecx
call fcn.00406350
add esp, 0xc
mov edx, dword [ebp - 4]
push edx
push 0x401cf5
lea eax, [ebp - 0x104]
push eax
call fcn.00406464
add esp, 0xc
push 0x100
push 0
lea ecx, [ebp - 0x104]
push ecx
call fcn.00406890
add esp, 0xc
call fcn.00401d3d
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x406464
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
jmp 0x40648a
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp + 0x10]
jge 0x40654c
mov edx, dword [ebp - 0xc]
add edx, 1
and edx, 0x800000ff
jns 0x4064ac
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
xor ecx, ecx
mov cl, byte [eax]
mov edx, dword [ebp - 0x10]
add edx, ecx
and edx, 0x800000ff
jns 0x4064ce
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
mov cl, byte [eax]
mov byte [ebp - 4], cl
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x10]
mov cl, byte [eax]
mov byte [edx], cl
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x10]
mov al, byte [ebp - 4]
mov byte [edx], al
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x10]
xor ecx, ecx
mov cl, byte [eax]
add edx, ecx
and edx, 0x800000ff
jns 0x40651d
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
mov edx, dword [ebp + 8]
add edx, dword [ebp - 8]
mov al, byte [edx]
mov byte [ebp - 4], al
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0x14]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp - 4]
and eax, 0xff
xor edx, eax
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0x14]
mov byte [ecx], dl
jmp 0x406481
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Allocate thread local storage

Disassembly:
push 0x11c
push 0
push 0x498d94
call fcn.00406010
add esp, 0xc
push 0
call fcn.00406016
add byte [ebx + 0x498d98], ah
push 0
push 0x1000

Function at 0x401018
Capabilities:
Allocate thread local storage

Disassembly:
push 0x11c
push 0
push 0x498d94
call fcn.00406010
add esp, 0xc
push 0
call fcn.00406016
add byte [ebx + 0x498d98], ah
push 0
push 0x1000

Function at 0x401028
Capabilities:
Allocate thread local storage

Disassembly:
push 0x11c
push 0
push 0x498d94
call fcn.00406010
add esp, 0xc
push 0
call fcn.00406016
add byte [ebx + 0x498d98], ah
push 0
push 0x1000

Function at 0x401038
Capabilities:
Allocate thread local storage

Disassembly:
push 0
call fcn.0040601c
add byte [eax], al
mov dword [0x498d94], eax
call fcn.00415360
sbb al, 0x43
add dword [eax], eax
call fcn.004149c5
call fcn.00414950
call fcn.00413b00
call fcn.00411c34

Function at 0x401048
Capabilities:
Allocate thread local storage

Disassembly:
push 0
call fcn.0040601c
add byte [eax], al
mov dword [0x498d94], eax
call fcn.00415360
sbb al, 0x43
add dword [eax], eax
call fcn.004149c5
call fcn.00414950
call fcn.00413b00
call fcn.00411c34

Function at 0x402680
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x409008], 0x8088405
inc edx
mov dword [ebx + 0x409008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x407080
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, dword [0x409214]
mov dword [eax], ecx
mov ebx, edx
test ebx, ebx
jle 0x4070a1
mov eax, 0xff
call fcn.00402680
xor byte [esi], al
inc esi
dec ebx
jne 0x407091
pop esi
pop ebx
ret
Function at 0x40baf0
Capabilities:
Check os version

Disassembly:
sub esp, 0x114
push ebx
push ebp
push esi
push edi
push dword [0x49978c]
call fcn.00414b3f
xor ebp, ebp
mov esi, eax
cmp dword [0x499558], ebp
jne 0x40bbcc
xor ebx, ebx
inc ebx
mov dword [0x499558], ebx
call fcn.0040c02f
mov edi, 0xa4
push edi
push ebp
push 0x499560
call fcn.00406010
add esp, 0xc
mov dword [0x499560], 0x13
lea eax, [esp + 0x10]
mov dword [0x499564], edi
mov dword [0x499570], 0x40ba3b
mov dword [0x499574], 0x40bd86
push eax
mov dword [0x4995c8], 0x40ba16
mov dword [0x4995cc], 0x40bcd1
mov dword [0x49956c], 0x40b9f1
mov dword [0x4995f0], 0x40ba56
mov dword [0x499604], ebx
mov dword [esp + 0x14], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40bbcc
cmp dword [esp + 0x20], ebx
je 0x40bbb4
cmp dword [esp + 0x20], 2
jne 0x40bbcc
cmp dword [esp + 0x14], 5
jae 0x40bbbc
mov dword [0x499604], ebp
jmp 0x40bbcc
jne 0x40bbcc
mov eax, dword [esp + 0x18]
neg eax
sbb eax, eax
and dword [0x499604], eax
lea eax, [esp + 0x138]
push eax
lea eax, [esp + 0x138]
push eax
lea eax, [esp + 0x138]
push eax
lea eax, [esp + 0x138]
push eax
call fcn.0040d6bf
mov eax, dword [esp + 0x140]
push ebp
push dword [0x498d98]
or eax, 0x50010000
push 0xffffffffffffffff
push dword [esi]
push dword [esp + 0x148]
push dword [esp + 0x148]
push dword [esp + 0x148]
push dword [esp + 0x148]
push eax
push ebp
push str.BUTTON
push ebp
call dword [sym.imp.USER32.DLL_CreateWindowExW]
mov ebx, eax
test ebx, ebx
je 0x40bca2
push dword [esp + 0x128]
push dword [0x4997a8]
call fcn.00414bd0
mov edi, dword [esp + 0x13c]
mov esi, eax
mov dword [esi + 0x10], edi
test edi, edi
je 0x40bc71
push edi
call fcn.004108ad
test eax, eax
je 0x40bc71
push ebp
push ebp
push edi
call fcn.004104f7
mov dword [esi + 0x18], eax
jmp 0x40bc74
mov dword [esi + 0x18], ebp
push 0x40b731
push 0xfffffffffffffffc
push ebx
mov dword [esi + 0x14], ebp
mov dword [esi + 0x1c], ebp
call dword [sym.imp.USER32.DLL_SetWindowLongW]
push 0x499560
push ebx
push esi
push dword [esp + 0x134]
mov dword [0x49955c], eax
call fcn.0040bf75
mov ebx, eax
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x114
ret 0x1c
Function at 0x40d371
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
call dword [sym.imp.USER32.DLL_GetFocus]
mov esi, dword [sym.imp.USER32.DLL_GetKeyState]
mov ebx, eax
test ebx, ebx
je 0x40d3eb
push 9
call esi
test al, al
jns 0x40d3eb
push 0x11
call esi
test al, al
js 0x40d3eb
push 0x10
call esi
test al, al
js 0x40d3eb
push 0x12
call esi
test al, al
js 0x40d3eb
push 5
lea eax, [ebp - 0x10]
push eax
push ebx
call dword [sym.imp.USER32.DLL_GetClassNameW]
push 4
lea eax, [ebp - 0x10]
push str.Rich
push eax
call fcn.0040625d
add esp, 0xc
test eax, eax
jne 0x40d3eb
push eax
push eax
push 0x44e
push ebx
call dword [sym.imp.USER32.DLL_SendMessageW]
test eax, 0x800
jne 0x40d3eb
xor eax, eax
jmp 0x40d46c
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x40d413
push 0x11
call esi
test al, al
js 0x40d40b
push 0x10
call esi
test al, al
js 0x40d40b
push 0x12
call esi
test al, al
jns 0x40d413
push 1
push edi
call fcn.0040d474
mov esi, dword [sym.imp.USER32.DLL_GetPropW]
test ebx, ebx
je 0x40d429
push str.PB_Hotkey
push ebx
call esi
test eax, eax
jne 0x40d469
push str.PB_WindowID
push edi
call esi
mov esi, eax
test esi, esi
je 0x40d469
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.USER32.DLL_GetWindowThreadProcessId]
test eax, eax
je 0x40d469
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 4], eax
jne 0x40d469
lea eax, [esi - 1]
push eax
push dword [0x4997b4]
call fcn.00414ba8
test eax, eax
je 0x40d469
mov eax, dword [eax + 8]
jmp 0x40d46b
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40dc00
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [esi + 0x14], 0
jne 0x40dc3c
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi + 0xc]
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 8]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 4
xor eax, eax
pop esi
pop ecx
ret 4

Function at 0x41099e
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push str.msimg32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x49964c], eax
test eax, eax
je 0x4109cc
push str.AlphaBlend
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x499648], eax
lea eax, [ebp - 0x114]
mov dword [0x499650], 1
push eax
mov dword [ebp - 0x114], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x410a2e
cmp dword [ebp - 0x104], 1
jne 0x410a03
and dword [0x499650], 0
jmp 0x410a46
cmp dword [ebp - 0x104], 2
jne 0x410a2e
cmp dword [ebp - 0x110], 5
jb 0x4109fa
jne 0x410a2e
mov eax, dword [ebp - 0x10c]
neg eax
sbb eax, eax
and eax, dword [0x499650]
mov dword [0x499650], eax
jmp 0x410a33
mov eax, dword [0x499650]
test eax, eax
je 0x410a46
call fcn.0041044e
neg eax
sbb eax, eax
and dword [0x499650], eax
mov esp, ebp
pop ebp
ret
Function at 0x411ab0
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x411ae2
push 0
lea ecx, [esp + 0x10]
push ecx
push esi
push dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x411add
cmp dword [esp + 0xc], esi
je 0x411af9
pop edi
xor eax, eax
pop esi
ret
mov eax, dword [edi + 4]
add eax, dword [edi + 8]
push esi
push dword [esp + 0x14]
push eax
call fcn.0040624b
add esp, 0xc
add dword [edi + 8], esi
pop edi
mov eax, 1
pop esi
ret

Function at 0x41d250
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x41d270
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x41d270
mov eax, dword [eax + 0x44]
test eax, eax
je 0x41d270
push dword [esp + 8]
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x402ad0
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [esp]
push ecx
push 0x28
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x402b34
lea edx, [esp + 4]
push edx
push 0x4073f0
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
push 0
push 0
push 0x10
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x10]
push 0
push eax
mov dword [esp + 0x24], 1
mov dword [esp + 0x30], 2
mov dword [esp + 0x2c], ecx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 0x1c
ret
Function at 0x402f80
Capabilities:
Enumerate disk volumes
Get disk information

Disassembly:
push ecx
mov eax, dword [0x4086b4]
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0x190
push 8
push eax
call edi
mov ecx, dword [0x4086b4]
push 0x190
push 8
push ecx
mov esi, eax
call edi
push 0xc6
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x403029
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
jmp 0x402fd0
lea edx, [esp + 0x10]
push edx
push 0xc6
push edi
push esi
call ebp
push edi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
jne 0x402ff3
push edi
call fcn.00401c20
add esp, 4
push 0xc6
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
test eax, eax
jne 0x402fd0
push ebx
call dword [sym.imp.KERNEL32.dll_FindVolumeClose]
mov eax, dword [0x4086b4]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
push 0
push eax
call esi
mov ecx, dword [0x4086b4]
push edi
push 0
push ecx
call esi
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x403060
Capabilities:
Check mutex on windows
Copy file
Create thread
Resume thread

Disassembly:
sub esp, 0x28
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x40
call esi
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
call fcn.004046c0
push 0
call fcn.00402b40
mov eax, dword [0x4086a0]
push eax
call fcn.00405090
add esp, 8
push 0x8007
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
call fcn.00404d30
call fcn.00403af0
call fcn.00404e40
call fcn.00402ad0
test eax, eax
jne 0x4030bd
mov dword [0x4086b0], 1
call esi
push 0
lea ecx, [esp + 0x10]
push ecx
push 1
push str.D:P_D_OICI_RPWPCCDCLCSWRCWDWOGA___LA__D_OICI_RPWPCCDCLCSWRCWDWOGA___BA__D_OICI_RPWPCCDCLCSWRCWDWOGA___SY__D_OICI_RPWPCCDCLCSWRCWDWOGA___LS__D_OICI_RPWPCCDCLCSWRCWDWOGA___SU_
mov esi, eax
mov dword [esp + 0x18], 0xc
mov dword [esp + 0x20], 0
call dword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
test eax, eax
je 0x4030f7
mov edx, dword [esp + 0xc]
push edx
push 4
push esi
call dword [sym.imp.ADVAPI32.dll_SetKernelObjectSecurity]
mov eax, dword [0x4086bc]
push eax
xor eax, eax
call fcn.00404080
mov ecx, dword [0x4086bc]
mov ebp, dword [sym.imp.KERNEL32.dll_CreateMutexW]
add esp, 4
push ecx
push 0
push 0
call ebp
push 0x14
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x403134
pop esi
xor eax, eax
pop ebp
add esp, 0x28
ret 0x10
mov edx, dword [0x4086b0]
push edx
call fcn.00402b40
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
add esp, 4
lea eax, [esp + 0x14]
push eax
push 4
push 0
push 0x4045c0
push 0
push 0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_ResumeThread]
push eax
call edi
mov ecx, dword [0x4086b4]
push 0x54
push 8
push ecx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
push ebx
call fcn.00403330
add esp, 4
push ebx
push 0
push 0
call ebp
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x40319d
cmp eax, 0x80
jne 0x4031a2
call fcn.00403d60
call fcn.00404910
lea edx, [esp + 0x1c]
push edx
push 4
push 0
push 0x403ad0
push 0
push 0
call esi
push eax
call edi
lea eax, [esp + 0x20]
push eax
push 4
push 0
push 0x403d40
push 0
push 0
call esi
push eax
call edi
lea ecx, [esp + 0x24]
push ecx
push 4
push 0
push 0x402640
push 0
push 0
call esi
push eax
call edi
lea edx, [esp + 0x28]
push edx
push 4
push 0
push 0x403030
push 0
push 0
call esi
push eax
call edi
lea eax, [esp + 0x2c]
push eax
push 4
push 0
push 0x404d10
push 0
push 0
call esi
push eax
call edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, dword [sym.imp.KERNEL32.dll_CopyFileW]
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
lea esp, [esp]
cmp dword [0x4085bc], 0
je 0x403270
mov ecx, dword [0x4086a4]
mov edx, dword [0x4086a0]
push 0
push ecx
push edx
call ebx
cmp dword [0x4085c0], 0
jne 0x403270
mov eax, dword [0x4086a4]
push 0
push 2
push 4
push 0
push 1
push 0x80000000
push eax
call esi
mov dword [0x4085c0], eax
push 0x1388
call edi
jmp 0x403230
Function at 0x403280
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebp
push esi
push edi
push 0x208
mov esi, eax
mov eax, dword [0x4086b4]
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, eax
xor eax, eax
push eax
push eax
push eax
mov ecx, 0x82
mov edi, ebp
push esi
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea ecx, [esp + 0x10]
push ecx
push 0x1f6
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
lea edx, [ebp + 4]
mov esi, 0xfc
mov eax, 0x65
cmp word [edx - 4], 0x2e
jne 0x403307
cmp word [edx - 2], ax
jne 0x403307
cmp word [edx], 0x78
jne 0x403307
cmp word [edx + 2], ax
jne 0x403307
xor eax, eax
lea ecx, [edx - 0x12]
nop
mov di, word [ecx]
mov word [ebx + eax*2], di
add eax, 1
add ecx, 2
cmp eax, 0xa
jle 0x4032f0
mov eax, 0x65
add edx, 2
sub esi, 1
jne 0x4032d1
mov edx, dword [0x4086b4]
push ebp
push 0
push edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebp
pop ecx
ret
Function at 0x403af0
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov eax, dword [0x4086b4]
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push edi
push 0x1e0
push 8
push eax
call esi
push 0xef
mov ebx, eax
push ebx
xor ebp, ebp
push ebp
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, dword [0x4086b4]
push 0x1e0
push 8
push ecx
call esi
mov esi, eax
push 0xef
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov word [esi + 6], bp
mov word [esi + 8], bp
mov edx, dword [0x408684]
push edx
push 0xef
push esi
call dword [sym.imp.MSVCR80.dll_wcscat_s]
mov edi, dword [sym.imp.MSVCR80.dll__wcsicmp]
push ebx
push esi
call edi
add esp, 0x14
test eax, eax
je 0x403c3e
mov eax, dword [0x408698]
push eax
push ebx
call edi
add esp, 8
test eax, eax
je 0x403c3e
xor edi, edi
mov eax, 2
lea ecx, [ebx + 4]
mov edx, 0x5c
jmp 0x403b90
cmp word [ecx - 4], dx
jne 0x403b99
lea edi, [eax - 2]
cmp word [ecx - 2], dx
jne 0x403ba2
lea edi, [eax - 1]
cmp word [ecx], dx
jne 0x403ba9
mov edi, eax
cmp word [ecx + 2], dx
jne 0x403bb2
lea edi, [eax + 1]
cmp word [ecx + 4], dx
jne 0x403bbb
lea edi, [eax + 2]
cmp word [ecx + 6], dx
jne 0x403bc4
lea edi, [eax + 3]
add eax, 6
lea ebp, [eax - 2]
add ecx, 0xc
cmp ebp, 0xef
jle 0x403b90
lea edx, [edi - 1]
test edx, edx
jl 0x403bf4
mov ecx, ebx
sub ecx, esi
mov eax, esi
add edx, 1
mov bp, word [ecx + eax]
mov word [eax], bp
add eax, 2
sub edx, 1
jne 0x403be5
xor ebp, ebp
mov word [esi + edi*2], bp
mov word [esi], 0x43
mov ecx, dword [0x4085ec]
push ecx
push esi
call dword [sym.imp.MSVCR80.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x403c3e
push ebp
mov word [esi + 6], bp
call fcn.00402b40
mov edx, dword [0x4086a0]
push edx
call fcn.00405090
add esp, 8
push 1
push ebp
push ebp
push esi
push str.open
push ebp
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [0x4086b4]
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
push ebx
push ebp
push eax
call edi
mov ecx, dword [0x4086b4]
push esi
push ebp
push ecx
call edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x403c60
Capabilities:
Enumerate processes
Terminate process

Disassembly:
sub esp, 0x238
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x234], eax
mov eax, dword [0x4086b0]
push esi
push 0
push 2
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0x22c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [esp + 0xc]
mov esi, eax
push ecx
push esi
mov dword [esp + 0xc], esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x403d21
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_OpenProcess]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea esp, [esp]
lea edx, [esp + 0x3c]
push edx
call fcn.004045e0
add esp, 4
test eax, eax
jne 0x403d0c
cmp dword [esp + 0x14], eax
jne 0x403cef
mov eax, dword [0x40868c]
push eax
lea ecx, [esp + 0x40]
push ecx
call dword [sym.imp.MSVCR80.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x403d0c
mov edx, dword [esp + 0x20]
push edx
push 0
push 1
call ebx
mov esi, eax
test esi, esi
je 0x403d1e
push 0
push esi
call ebp
push esi
call edi
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x403cc0
push esi
call edi
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x238]
pop esi
xor ecx, esp
call fcn.00405260
add esp, 0x238
ret