joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43c004]
jne 0x40100a
repz ret
jmp fcn.004019b2

Function at 0x406f48
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004046a4
and dword [ebp - 4], 0
cmp dword [0x43e0f8], 0
mov ebx, eax
jne 0x406ff9
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4070aa
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4070aa
push eax
call fcn.00404632
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x43e0f8], eax
call esi
push eax
call fcn.00404632
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43e0fc], eax
call esi
push eax
call fcn.00404632
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43e100], eax
call esi
push eax
call fcn.00404632
pop ecx
mov dword [0x43e108], eax
test eax, eax
je 0x406ff9
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404632
pop ecx
mov dword [0x43e104], eax
mov eax, dword [0x43e104]
cmp eax, ebx
je 0x407051
cmp dword [0x43e108], ebx
je 0x407051
push eax
call fcn.004046ad
push dword [0x43e108]
mov esi, eax
call fcn.004046ad
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x407051
test edi, edi
je 0x407051
call esi
test eax, eax
je 0x407048
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x407048
test byte [ebp - 0xc], 1
jne 0x407051
or dword [ebp + 0x10], 0x200000
jmp 0x40708a
mov eax, dword [0x43e0fc]
cmp eax, ebx
je 0x40708a
push eax
call fcn.004046ad
pop ecx
test eax, eax
je 0x40708a
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40708a
mov eax, dword [0x43e100]
cmp eax, ebx
je 0x40708a
push eax
call fcn.004046ad
pop ecx
test eax, eax
je 0x40708a
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43e0f8]
call fcn.004046ad
pop ecx
test eax, eax
je 0x4070aa
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4070ac
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x434d80
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
cmp edi, 0x19f
jne 0x434d99
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
xor edx, edx
test edi, edi
jle 0x434de2
nop
lea ecx, [esp + 8]
mov dword [esp], 5
mov dword [esp + 8], 0
call fcn.00434d70
mov eax, dword [esp + 8]
add eax, 0x46
mov dword [esp], eax
nop
sub dword [esp], 0x46
movsx eax, byte [edx + esi]
mov dword [esp + 4], eax
mov eax, dword [esp]
xor dword [esp + 4], eax
mov cl, byte [esp + 4]
mov byte [edx + esi], cl
inc edx
cmp edx, edi
jl 0x434da0
cmp edi, 0x2d
jne 0x434dfb
mov dword [0x2b3c318], 0xa62e7790
mov dword [0x2b3c31c], 0xffffffff
add esp, 0xc
ret
Function at 0x405c20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, 0xffff
movzx eax, bx
mov dword [ebp - 0x34], eax
mov esi, ecx
cmp di, bx
jne 0x405c5d
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409e29
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x405c97
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
lea eax, [ecx + eax*2]
cmp ecx, eax
jae 0x405c97
dec dword [edx]
mov ax, bx
mov edx, dword [esi + 0x20]
pop edi
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], bx
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409e29
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x405d67
mov ecx, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [ecx], eax
jne 0x405cc4
mov eax, dword [esi + 0xc]
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
sar edx, 1
mov dword [eax], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x405cf7
push dword [esi + 0x4c]
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputwc]
add esp, 8
movzx ecx, bx
cmp ax, di
cmove ecx, edi
pop edi
pop esi
mov ax, cx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409e29
mov esp, ebp
pop ebp
ret 4
movzx eax, bx
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x26]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_wchar_t__char__struct__Mbstatet_::out_struct__Mbstatet___wchar_t_const___wchar_t_const___wchar_t_const____char___char___char___const]
sub eax, 0
je 0x405d36
sub eax, 1
je 0x405d36
sub eax, 2
jne 0x405d67
push dword [esi + 0x4c]
push dword [ebp - 0x28]
jmp 0x405ccf
mov ebx, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub ebx, eax
je 0x405d54
push dword [esi + 0x4c]
push ebx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp ebx, eax
jne 0x405d67
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x28]
cmp dword [ebp - 0x30], ecx
movzx eax, ax
mov byte [esi + 0x3e], 1
cmovne edi, eax
mov ecx, dword [ebp - 4]
mov ax, di
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409e29
mov esp, ebp
pop ebp
ret 4
Function at 0x4062b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x406374
cmp byte [esi + 0x3e], 0
je 0x406374
mov eax, dword [esi]
push edi
push 0xffff
call dword [eax + 0xc]
mov ecx, 0xffff
cmp cx, ax
je 0x406362
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_wchar_t__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x406329
sub eax, 1
je 0x40632d
sub eax, 2
jne 0x406362
mov byte [esi + 0x3e], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409e29
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3e], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x40634b
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x406362
cmp byte [esi + 0x3e], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409e29
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409e29
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.00409e29
mov esp, ebp
pop ebp
ret

Function at 0x409d45
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x409d6c
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x409d6f
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.00409d21
pop esi
leave
ret 8

Function at 0x40a84e
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40a88d
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40a88d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40a88d
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40a88d
cmp dword [ecx + 0x74], 0xe
jbe 0x40a88d
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x42166a
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x52bc60]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.0041eeb0
mov dword [ebp - 0x14], eax
cmp dword [0x52d798], edi
jne 0x42175b
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x4216e8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x42183b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x42183b
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42183b
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x52d798], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x52d79c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x52d7a0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x52d7a8], eax
test eax, eax
je 0x421758
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x52d7a4], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x421780
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x421773
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x421795
push 4
pop eax
jmp 0x42183d
cmp dword [ebp - 0x14], edi
je 0x421795
push dword [0x52d798]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x42177a
mov eax, dword [0x52d7a4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x4217f3
cmp dword [0x52d7a8], esi
je 0x4217f3
push eax
call ebx
push dword [0x52d7a8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4217f3
test eax, eax
je 0x4217f3
call ecx
test eax, eax
je 0x4217e8
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4217e8
test byte [ebp - 8], 1
jne 0x4217f3
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x421823
mov eax, dword [0x52d79c]
cmp eax, esi
je 0x421820
push eax
call ebx
test eax, eax
je 0x421820
call eax
mov edi, eax
test edi, edi
je 0x421820
mov eax, dword [0x52d7a0]
cmp eax, esi
je 0x421820
push eax
call ebx
test eax, eax
je 0x421820
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x52d798]
call ebx
test eax, eax
je 0x42183b
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x42183d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041fe60
leave
ret
Function at 0x406fa0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov edx, dword [edi + 0x532477c1]
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
cmp ebx, dword [ecx + 0x57]
inc esi
jne 0x406fa7
test byte [ecx], dh
mov esi, str.0.0.0.0
mov al, byte [esi]
cmp al, 0x30
jl 0x11e707d
cmp al, 0x39
jg 0x40707d
jns 0x407002
sbb al, 0x40
daa
push esi
call [edi]
sbb al, 0xc1
inc eax
retf 0xd08b
mov dword [0xec4befdc], eax
mov dword [ebp - 0x10], ebx
mov dword [ebp + 0x30], ecx
mov dword [ebp + 0xc], edx
retf
push esi
call dword [sym.imp.WSOCK32.dll_gethostbyname]
cmp eax, ebx
mov dword [ebp - 0x3b], eax
jne 0x407010
mov esi, dword [sym.imp.WSOCK32.dll_WSAGetLastError]
call esi
test eax, eax
je 0x4070c6
call esi
pop edi
pop esi
add eax, 0xaefc80
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop eax
in eax, 0x5d
ret

Function at 0x4081d3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [eax + 0xf], dh
stc
or eax, dword [edi + 0x29]
dec ebx
or al, 0x5d

Function at 0x408260
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lds esp, [edi - 0x7046e37a]
bound esi, qword [edi + 0xf11d11c]
test byte [ebx - 0x14ffffff], ch
or byte [ebp - 0x34068fcd], bh
jge 0x4081c3
sbb edx, dword [eax + 0x6bfe0ceb]
cld
dec edi
mov bl, 3
inc edx
out dx, eax
cmpsd dword [esi], dword es:[edi]
mov ah, 0x17
fdiv qword [ecx]
dec dword [ecx - 0x75]
xor al, 0x8b
pop es
jl 0x4081fe
cmp al, cl
iretd
Function at 0x40b0bd
Capabilities:
Packed with generic packer
Write file on windows

Disassembly:
int3
add byte [eax], al
add byte [ebx - 0x1793a7bd], cl
or eax, 0x8bfffff3
inc ebp
or byte [edi - 0x6a], bl
lcall 0xc, 0x795de58b
mov edx, dword [esi]
invalid
mov dword [ebp + 8], eax
and byte [edi], al
mov dword [ebx + 0x28], 0xf457
mov eax, dword [ebp + 0xc]
xchg byte [ecx + 0x8458b4e], cl
pop esi
mov eax, 0xc20fe58b
or al, 0
nop
nop
jge 0x40b006
nop
nop
outsd dx, dword [esi]
nop
nop
nop
nop
nop
nop
nop
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov dword [0xc245c78a], eax
add byte [eax], al
add byte [ebx + 0x75], cl
jno 0x40b027
inc esi
or byte [eax + eax*8 + 0x568b6a74], al
add al, 0x8d
dec ebp
or byte [edx], ch
push ecx
push 0
mov dl, 0
push 0
push edx
call dword [0x40c0a9]
test eax, eax
jne 0x40b0f2
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test dword [edi - 0xa], ebx
jnp 0x40b055
dec ebp
adc al, 0x5f
xchg ebp, eax
mov dword [ecx], eax
pop ebp
ret
mov eax, dword [ebp + 8]
test dword [edx + 0x75], ecx
push cs
mov edx, dword [ebp + 0x14]
inc edi
pop esi
mov dword [edx], eax
mov eax, 0x10000b
mov dh, 0xc3
cmp ecx, eax
jbe 0x40b10d
mov edi, eax
mov eax, dword [esi + 0xc]
test eax, eax
je 0x40b137
mov cl, byte [esi + 8]
test cl, cl
jne 0x40b137
add byte [ebx + 0x8958950], 0x31
call dword [eax - 0x46]
push esi
bound edi, qword [ecx + 0x8e]
call fcn.0040b810
mov ss, word [esi + 0xc]
mov dword [edx + 0xc], eax
mov eax, dword [0x558b0c46]
inc ebp
push ebx
lea ecx, [ebp + 0x10]
sbb byte [ebx + 0x57510446], cl
push edx
push eax
fst dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40b15a
xor eax, eax
jmp 0x70fa85
mov edi, dword [sym.imp.KERNEL32.dll_GetFileType]
xor dl, bh
test eax, eax
paddd mm1, mm2
out dx, eax
add byte [eax], al
call edi
cmp al, byte [eax + 0x3d000afc]
add byte gs:[ebx], cl
popal
jne 0x7167b24f
pop es
sbb eax, sym.imp.KERNEL32.dll_WaitForSingleObject
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0x10]
pop ebx
leave
jl 0x40b1a2
jg 0x40b192
test dword [ebp + esi*2 + 0x68006a10], ebx
call 0x3c10e9d
push eax
call 0x138b583
jmp 0x40b1af
push 0
push 0x805d03e8
add edx, dword [eax - 0x18]
jecxz 0x40b1a1
clc
add bl, ch
or eax, 0xf8839323
invalid
and edx, dword [ebx + 0x7afff883]
add al, 0xb
shr bl, 2
xor eax, eax
mov ecx, dword [esi - 0x36]
push eax
mov edx, dword [ecx + 0x10]
push edx
call ebx
mov edi, eax
cmp edi, 0xc20080
je 0x40b182
test edi, edi
je 0x40b1f8
mov eax, dword [0xf410960]
arpl word [ebp - 0x33527aa1], ax
sbb byte [eax + 0x68], dl
in al, dx
and eax, dword [ecx]
push eax
cmp dword [ecx + 0x57], esp
invalid
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
lea esp, [ebx + 0x50016a10]
push ecx
mov esp, 0xc0b415ff
inc eax
add dh, dl
rcl bh, 4
inc ecx
shr bl, 0x71
pop esi
sbb eax, 0xf840c098
invalid
Function at 0x4af728
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4af7ff
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4af81c
push ebx
push 0x4af82c
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004087c4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00405884
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004084ec
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x4af7aa
mov ax, 0x83
call fcn.004af34c
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle
call fcn.004af6fc
push 0x4ff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x4af7b3
call fcn.004af6fc
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4af806
lea eax, [ebp - 4]
call fcn.00407a20
ret

Function at 0x4af91c
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4af9e7
jmp 0x4af9db
cmp dword [esi + 0x10], 0x1000
jne 0x4af9c7
test byte [esi + 0x15], 1
jne 0x4af9c7
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4af978
cmp ebp, 2
je 0x4af978
cmp ebp, 0x10
je 0x4af978
cmp ebp, 0x20
jne 0x4af994
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4af994
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4af9a5
mov eax, dword [esi]
add eax, ebx
call fcn.004af914
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4af998
cmp byte [esp + 4], 0
je 0x4af9c7
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4af9e7
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4af94d
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x438cce
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x438a14
and ebx, ebx
inc esi
dec esi
call fcn.00438cfa
and esi, esi
inc esi
xor dword [ecx], eax
sub ebx, esi
inc esi
sub esi, esi
inc ecx
add ebx, 0x42052a60
cmp ecx, edx
jne fcn.00438cce
sub ebx, ebx
ret
Function at 0x403640
Capabilities:
Enumerate gui resources
Get hostname

Disassembly:
mov eax, 0x200c
call fcn.0040d320
mov eax, dword [0x2b8262c]
mov ecx, dword [0x2b825a0]
shr eax, 3
test eax, eax
jbe 0x403772
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
jmp 0x403690
cmp dword [0x2b8262c], 0x959
jne 0x403754
push 0
lea eax, [esp + 0x420]
push eax
push 0
push 0
push 0
push 0
call edi
push 0
lea ecx, [esp + 0xc20]
push ecx
push 0
call ebx
push 0
push 0
call esi
push 0
call ebp
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExW]
push 0
push 0
lea edx, [esp + 0x24]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
push 0
push 0
call esi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriorityBoost]
push 0
lea eax, [esp + 0x1420]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x1820]
push edx
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0
push 0x402c0c
push 0x402c1c
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
mov eax, dword [esp + 0x10]
push eax
call fcn.00403490
add dword [esp + 0x10], 8
sub dword [esp + 0x14], 1
jne 0x403690
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x200c
ret
Function at 0x404f60
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x42c8db
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
lea ecx, [esi + 4]
mov dword [esi], 0x402d88
call fcn.00405142
push 4
mov dword [esp + 0x18], 0
call fcn.004060a5
mov edi, eax
add esp, 4
test edi, edi
je 0x404fd4
push ebx
call fcn.0040576f
mov dword [edi], eax
call fcn.0040520c
push 0
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.00405103
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x404fc8
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0xc]
call fcn.0040512b
pop ebx
jmp 0x404fd6
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x407611
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42ea30]
jne 0x40761b
repz ret
jmp fcn.0040b83a
Function at 0x40cd86
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004086ce
and dword [ebp - 4], 0
cmp dword [0x42ff4c], 0
mov ebx, eax
jne 0x40ce37
push 0x402b54
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40cee8
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402b48
push edi
call esi
test eax, eax
je 0x40cee8
push eax
call fcn.0040865c
mov dword [esp], 0x402b38
push edi
mov dword [0x42ff4c], eax
call esi
push eax
call fcn.0040865c
mov dword [esp], 0x402b24
push edi
mov dword [0x42ff50], eax
call esi
push eax
call fcn.0040865c
mov dword [esp], 0x402b08
push edi
mov dword [0x42ff54], eax
call esi
push eax
call fcn.0040865c
pop ecx
mov dword [0x42ff5c], eax
test eax, eax
je 0x40ce37
push 0x402af0
push edi
call esi
push eax
call fcn.0040865c
pop ecx
mov dword [0x42ff58], eax
mov eax, dword [0x42ff58]
cmp eax, ebx
je 0x40ce8f
cmp dword [0x42ff5c], ebx
je 0x40ce8f
push eax
call fcn.004086d7
push dword [0x42ff5c]
mov esi, eax
call fcn.004086d7
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40ce8f
test edi, edi
je 0x40ce8f
call esi
test eax, eax
je 0x40ce86
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40ce86
test byte [ebp - 0xc], 1
jne 0x40ce8f
or dword [ebp + 0x10], 0x200000
jmp 0x40cec8
mov eax, dword [0x42ff50]
cmp eax, ebx
je 0x40cec8
push eax
call fcn.004086d7
pop ecx
test eax, eax
je 0x40cec8
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40cec8
mov eax, dword [0x42ff54]
cmp eax, ebx
je 0x40cec8
push eax
call fcn.004086d7
pop ecx
test eax, eax
je 0x40cec8
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42ff4c]
call fcn.004086d7
pop ecx
test eax, eax
je 0x40cee8
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40ceea
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret