joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406c4e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x67ccf0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
sub eax, 0x80
je 0x406c90
sub eax, 0x40
je 0x406c88
sub eax, 0x40
jne 0x406d64
mov dword [edi], 0xe
jmp 0x406c96
mov dword [edi], 0xc
jmp 0x406c96
mov dword [edi], 0xa
push esi
push dword [ebp + 0x10]
lea eax, [ebp - 0x11c]
push ecx
lea esi, [edi + 8]
push eax
mov dword [edi + 4], esi
call fcn.00406d73
mov edx, dword [ebp - 0x11c]
add esp, 0xc
shl edx, 4
add edx, dword [ebp - 0x118]
push 4
pop ecx
mov eax, dword [edx]
add edx, ecx
mov dword [esi], eax
add esi, ecx
mov eax, dword [edx]
add edx, ecx
mov dword [esi], eax
add esi, ecx
mov eax, dword [edx]
add edx, ecx
mov dword [esi], eax
add esi, ecx
mov eax, dword [edx]
sub edx, 0x1c
mov dword [esi], eax
add esi, ecx
mov edi, dword [edi]
dec edi
test edi, edi
jle 0x406d49
push ebx
mov ebx, ecx
movzx eax, byte [edx + 3]
push 4
movzx ecx, byte [eax + 0x6823e8]
movzx eax, byte [edx + 2]
mov ecx, dword [ecx*4 + 0x6841e8]
movzx eax, byte [eax + 0x6823e8]
xor ecx, dword [eax*4 + 0x683de8]
movzx eax, byte [edx + 1]
movzx eax, byte [eax + 0x6823e8]
xor ecx, dword [eax*4 + 0x6839e8]
movzx eax, byte [edx]
movzx eax, byte [eax + 0x6823e8]
xor ecx, dword [eax*4 + 0x6835e8]
mov dword [esi], ecx
pop ecx
add esi, ecx
add edx, ecx
dec ebx
jne 0x406ced
dec edi
sub edx, 0x20
test edi, edi
jg 0x406ceb
pop ebx
mov eax, dword [edx]
mov dword [esi], eax
add esi, ecx
add edx, ecx
mov eax, dword [edx]
mov dword [esi], eax
mov eax, dword [edx + ecx]
mov dword [esi + ecx], eax
mov eax, dword [edx + ecx + 4]
mov dword [esi + ecx + 4], eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.005500ac
mov esp, ebp
pop ebp
ret
Function at 0x40734a
Capabilities:
Write file on windows

Disassembly:
push 0x30
mov eax, 0x5514a9
call fcn.00550118
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x40], ebx
je 0x407470
cmp byte [edi + 0x45], bl
je 0x407470
call fcn.00405f50
mov esi, eax
mov ecx, edi
mov eax, dword [edi]
push esi
call dword [eax + 0xc]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], esi
push eax
call fcn.004076ce
pop ecx
pop ecx
test al, al
je 0x40739b
xor al, al
jmp 0x407472
push ebx
push 8
lea ecx, [ebp - 0x28]
call fcn.0040718e
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x28]
call fcn.00407657
mov ecx, eax
call fcn.004072ae
lea ecx, [ebp - 0x28]
mov esi, eax
call fcn.0041bb9b
add esi, eax
lea ecx, [ebp - 0x28]
push esi
lea eax, [ebp - 0x30]
push eax
call fcn.00407657
mov ecx, eax
call fcn.004072ae
mov ecx, dword [edi + 0x40]
push eax
lea eax, [edi + 0x48]
push eax
call dword [sym.imp.MSVCP120.dll_public:_int___thiscall_std::codecvt_char__char__int_::unshift_int___char___char___char___const]
sub eax, ebx
je 0x4073fc
dec eax
je 0x4073ff
dec eax
dec eax
jne 0x407464
inc eax
jmp 0x407462
mov byte [edi + 0x45], bl
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x28]
call fcn.00407657
mov ecx, eax
call fcn.004072ae
mov esi, dword [ebp - 0x34]
sub esi, eax
je 0x407440
push dword [edi + 0x50]
lea eax, [ebp - 0x38]
push esi
push 1
push eax
lea ecx, [ebp - 0x28]
call fcn.00407657
mov ecx, eax
call fcn.004072ae
push eax
call dword [sym.imp.MSVCR120.dll_fwrite]
add esp, 0x10
cmp esi, eax
jne 0x407460
cmp byte [edi + 0x45], 0
je 0x40745e
test esi, esi
jne 0x4073a9
push ebx
push 8
lea ecx, [ebp - 0x28]
call fcn.004075aa
jmp 0x4073a9
mov bl, 1
mov al, bl
mov bl, al
lea ecx, [ebp - 0x28]
call fcn.0040575c
mov al, bl
jmp 0x407472
mov al, 1
call fcn.005500d6
ret
Function at 0x408906
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x68d680]
push 0x200030
push dword [0x68d5fc]
cmp eax, 1
jne 0x408937
push 0x55c6d8
call fcn.00408fb9
pop ecx
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x40891b
push 0x55c758
jmp 0x408920

Function at 0x408943
Capabilities:
Create thread

Disassembly:
push edi
xor edi, edi
cmp dword [0x68462c], edi
jne 0x40895e
push edi
push edi
push edi
push 0x409014
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [0x684628], edi
jne 0x408976
push edi
push edi
push edi
push 0x40897a
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
pop edi
ret

Function at 0x408ab4
Capabilities:
Terminate process

Disassembly:
call fcn.00408dc1
mov eax, dword [0x68d680]
push 0x200030
push dword [0x68d5fc]
cmp eax, 1
jne 0x408aea
push 0x55c5a0
call fcn.00408fb9
pop ecx
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x408ace
push 0x55c638
jmp 0x408ad3

Function at 0x408b5a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 8]
push esi
push eax
push 0x20019
xor esi, esi
push esi
push 0x55c880
call fcn.00408fb9
pop ecx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x408bb3
lea eax, [ebp - 0xc]
mov dword [ebp - 4], esi
push eax
lea eax, [ebp - 4]
push eax
push esi
push esi
push str.MoveImages
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x408bae
call fcn.00408d03
jmp 0x408bb3
call fcn.00408c51
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x408c69
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x67ccf0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
mov word [ebp - 8], 0x500
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], ebx
push eax
mov esi, ebx
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x408cc1
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x408cc9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp dword [ebp - 0x10], ebx
je 0x408cda
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov dword [ebp - 0x10], ebx
test esi, esi
jne 0x408cf1
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
xor ecx, ebp
pop esi
pop ebx
call fcn.005500ac
mov esp, ebp
pop ebp
ret
push 0x583238
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], esi
push eax
call sub.MSVCR120.dll__CxxThrowException
int3

Function at 0x408d10
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x408d23
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x408dc1
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x67ccf0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x118]
push eax
push 0x55c4f0
call fcn.00408fb9
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
pop ecx
push eax
push 0x80000001
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x408e24
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x118]
call edi
push dword [ebp - 0x118]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
lea eax, [ebp - 0x11c]
push eax
push 0x55c548
call fcn.00408fb9
pop ecx
push eax
push 0x80000002
call ebx
test eax, eax
jne 0x408e5f
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x11c]
call edi
push dword [ebp - 0x11c]
call esi
lea eax, [ebp - 0x10c]
push eax
push 1
push 0
push 0x55c548
call fcn.00408fb9
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
pop ecx
push eax
push 0x80000002
call ebx
test eax, eax
jne 0x408e9e
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x10c]
call edi
push dword [ebp - 0x10c]
call esi
lea eax, [ebp - 0x110]
push eax
push 1
push 0
push 0x55c4f0
call fcn.00408fb9
pop ecx
push eax
push 0x80000001
call ebx
test eax, eax
jne 0x408ed7
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x110]
call edi
push dword [ebp - 0x110]
call esi
lea eax, [ebp - 0x114]
push eax
push 0xf013f
push 0
push 0x55c548
call fcn.00408fb9
pop ecx
push eax
push 0x80000002
call ebx
test eax, eax
jne 0x408f13
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x114]
call edi
push dword [ebp - 0x114]
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005500ac
mov esp, ebp
pop ebp
ret

Function at 0x408f8f
Capabilities:
Create thread
Terminate process

Disassembly:
push esi
xor esi, esi
push esi
push esi
push esi
push 0x408f52
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x684620]
inc eax
mov dword [0x684620], eax
cmp eax, 1
je 0x408f2c
xor eax, eax
ret

Function at 0x408fb9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 8]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x40900e
push esi
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
mov edx, eax
xor eax, eax
pop ecx
test esi, esi
mov dword [ebp + 8], eax
pop esi
je 0x409005
sub edi, edx
lea ecx, [eax + edx]
and eax, 7
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp + 8], eax
cmp eax, dword [ebx + 0xf]
jb 0x408fea
mov eax, dword [ebx + 0xf]
mov edi, edx
mov byte [edx + eax], 0
mov eax, edi
pop edi
pop ebx
pop ebp
ret
Function at 0x409182
Capabilities:
Create thread
Terminate process

Disassembly:
mov eax, dword [0x68d680]
push esi
cmp eax, 1
je 0x4091d0
cmp eax, 4
je 0x4091d0
cmp eax, 2
jne 0x4091bb
xor esi, esi
push esi
push esi
push esi
push 0x409533
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 3
jne 0x4091cc
xor esi, esi
push esi
push esi
push esi
push 0x4108b8
jmp 0x4091a1
push 0
jmp 0x4091b5
xor esi, esi
push esi
push esi
push esi
push 0x40955b
jmp 0x4091a1
Function at 0x409520
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x4091dc
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x4098de
Capabilities:
Create thread
Terminate process

Disassembly:
mov eax, dword [0x68d680]
push esi
cmp eax, 1
je 0x40992c
cmp eax, 4
je 0x40992c
cmp eax, 2
jne 0x409917
xor esi, esi
push esi
push esi
push esi
push 0x409ab4
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 3
jne 0x409928
xor esi, esi
push esi
push esi
push esi
push 0x4108b8
jmp 0x4098fd
push 0
jmp 0x409911
xor esi, esi
push esi
push esi
push esi
push 0x409adc
jmp 0x4098fd

Function at 0x409938
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x4098aa
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x409b04
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x67ccf0]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
or dword [ebp - 0x408], 0xffffffff
push ebx
push edi
push 0x55cf54
push edx
mov ebx, ecx
call dword [sym.imp.MSVCR120.dll_fopen]
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x409b3e
or eax, 0xffffffff
jmp 0x409b88
push esi
push edi
push 0x400
lea eax, [ebp - 0x404]
push 1
push eax
call dword [sym.imp.MSVCR120.dll_fread]
add esp, 0x10
mov esi, eax
lea eax, [ebp - 0x404]
mov ecx, ebx
push esi
push eax
lea eax, [ebp - 0x408]
push eax
call fcn.00409bf9
cmp esi, 0x400
je 0x409b3f
push edi
call dword [sym.imp.MSVCR120.dll_fclose]
mov eax, dword [ebp - 0x408]
pop ecx
not eax
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.005500ac
mov esp, ebp
pop ebp
ret 4

Function at 0x409b9a
Capabilities:
Encode data using xor
Hash data using crc32b

Disassembly:
push ebx
push esi
push edi
push 0x400
xor esi, esi
mov ebx, ecx
push esi
push ebx
call sub.MSVCR120.dll_memset
add esp, 0xc
mov edi, ebx
push 8
push esi
mov ecx, ebx
call fcn.00409c32
shl eax, 0x18
push 8
mov dword [edi], eax
pop edx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
add eax, eax
and ecx, 0x4c11db7
xor eax, ecx
dec edx
jne 0x409bc4
push 0x20
push eax
mov ecx, ebx
call fcn.00409c32
mov dword [edi], eax
inc esi
add edi, 4
cmp esi, 0xff
jle 0x409bb2
pop edi
pop esi
pop ebx
ret

Function at 0x409bf9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 4], ecx
test esi, esi
je 0x409c2b
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov edx, dword [ebx]
movzx eax, byte [edi]
movzx ecx, dl
xor ecx, eax
shr edx, 8
mov eax, dword [ebp - 4]
xor edx, dword [eax + ecx*4]
inc edi
mov dword [ebx], edx
dec esi
jne 0x409c10
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40ac71
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x684ab0]
add eax, dword [0x684aac]
add eax, dword [0x684aa8]
add eax, dword [0x684aa4]
add eax, dword [0x684aa0]
add eax, dword [0x684a9c]
add eax, dword [0x684a98]
add eax, dword [0x684a94]
add eax, dword [0x684a90]
add eax, dword [0x684a8c]
add eax, dword [0x684a88]
add eax, dword [0x684a84]
add eax, dword [0x684a80]
add eax, dword [0x684a7c]
add eax, dword [0x684a78]
add eax, dword [0x684a74]
add eax, dword [0x684a70]
add eax, dword [0x684a6c]
add eax, dword [0x684a68]
add eax, dword [0x684a64]
add eax, dword [0x684a60]
add eax, dword [0x684a5c]
mov edx, dword [0x684ab4]
add eax, dword [0x684a58]
inc edx
mov dword [0x684ab4], edx
cmp eax, dword [0x684a4c]
je 0x40ad18
cmp edx, 5
jg 0x40ae1b
jmp 0x40b0fd
push 0xa8
mov eax, 0x551839
call fcn.005500e5
xor esi, esi
cmp dword [0x68d67c], 1
jne 0x40ae9c
push 1
push 0x40
push 8
push 0x55c9cc
call fcn.00408fb9
pop ecx
push eax
lea ecx, [ebp - 0xb4]
call fcn.00409075
push 0x55dad0
mov dword [ebp - 4], esi
call fcn.00408fb9
push eax
lea eax, [ebp - 0xb4]
push eax
call fcn.004081fc
push 0x55daf4
call fcn.00408fb9
push eax
lea eax, [ebp - 0xb4]
push eax
call fcn.004081fc
add esp, 0x18
lea ecx, [ebp - 0xb4]
call fcn.00409583
lea ecx, [ebp - 0xb4]
call fcn.00409144
mov eax, dword [0x68d680]
cmp eax, 1
je 0x40aee2
cmp eax, 4
je 0x40aee2
push esi
cmp eax, 2
jne 0x40aed2
push esi
push esi
push 0x40b06d
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 3
jne 0x40aee0
push esi
push esi
push 0x4108b8
jmp 0x40aeb8
jmp 0x40aecc
push esi
push esi
push esi
push 0x40b0b1
jmp 0x40aeb8
xor eax, eax
mov dword [0x684a58], eax
mov dword [0x684a5c], eax
mov dword [0x684a60], eax
mov dword [0x684a64], eax
mov dword [0x684a68], eax
mov dword [0x684a6c], eax
mov dword [0x684a70], eax
mov dword [0x684a74], eax
mov dword [0x684a78], eax
mov dword [0x684a7c], eax
mov dword [0x684a80], eax
mov dword [0x684a84], eax
mov dword [0x684a88], eax
mov dword [0x684a8c], eax
mov dword [0x684a90], eax
mov dword [0x684a94], eax
mov dword [0x684a98], eax
mov dword [0x684a9c], eax
mov dword [0x684aa0], eax
mov dword [0x684aa4], eax
mov dword [0x684aa8], eax
mov dword [0x684aac], eax
mov dword [0x684ab0], eax
ret

Function at 0x40adbe
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x40ad1d
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x40add1
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x40ad5e
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x40b17e
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x40b191
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x40b2cc
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push 0x158
mov eax, 0x551927
call fcn.005500e5
xor ebx, ebx
push ebx
push dword [ebp + 8]
push ebx
push ebx
call dword [sym.imp.USER32.dll_FindWindowExA]
test eax, eax
je 0x40b4be
push ebx
push ebx
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [0x68d67c], 1
jne 0x40b368
push 1
push 0x40
push 8
push 0x55c9cc
call fcn.00408fb9
pop ecx
push eax
lea ecx, [ebp - 0x164]
call fcn.00409075
push str.__nAh
mov dword [ebp - 4], ebx
call fcn.00408fb9
push eax
lea eax, [ebp - 0x164]
push eax
call fcn.004081fc
push dword [ebp + 8]
lea eax, [ebp - 0x164]
push eax
call fcn.004081fc
add esp, 0x14
lea ecx, [ebp - 0x164]
call fcn.00409583
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x164]
call fcn.00409144
cmp dword [0x68d68c], 1
jne 0x40b443
lea eax, [ebp - 0x14]
push eax
call fcn.0041310f
lea eax, [ebp - 0x14]
push eax
call fcn.0040ee71
pop ecx
pop ecx
push 1
push 0x40
push 8
mov ebx, 0x55ca18
mov esi, eax
push ebx
call fcn.00408fb9
pop ecx
push eax
lea ecx, [ebp - 0xbc]
call fcn.00409075
push 0x55ca30
mov dword [ebp - 4], 1
call fcn.00408fb9
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.004081fc
push esi
call dword [sym.imp.MSVCR120.dll_asctime]
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.004081fc
push 0x55dbc0
call fcn.00408fb9
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.004081fc
push dword [ebp + 8]
lea eax, [ebp - 0xbc]
push eax
call fcn.004081fc
push 0x55ca78
call fcn.00408fb9
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.004081fc
add esp, 0x38
lea ecx, [ebp - 0xbc]
call fcn.00409583
push 2
push ebx
call fcn.00408fb9
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xbc]
call fcn.00409144
xor ebx, ebx
mov eax, dword [0x68d680]
push ebx
cmp eax, 1
jne 0x40b46f
push ebx
push ebx
push 0x40b4ec
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x40b47d
push ebx
push ebx
push 0x40b4c4
jmp 0x40b455
cmp eax, 3
jne 0x40b48b
push ebx
push ebx
push 0x4108b8
jmp 0x40b455
cmp eax, 4
jne 0x40b4bc
push ebx
push ebx
push 0x40b022
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x200010
push 0x55dbe4
call fcn.00408fb9
pop ecx
push eax
push dword [ebp + 8]
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40b468
jmp 0x40b469
call fcn.005500c2
ret
Function at 0x40b8a2
Capabilities:
Acquire debug privileges
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x67ccf0]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40b935
push esi
lea eax, [ebp - 0x20]
xor esi, esi
push eax
push str.SeDebugPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x40b91d
mov eax, dword [ebp - 0x20]
push esi
push esi
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x1c]
push 0x10
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp - 0x18]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x40b91d
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x40b921
xor eax, eax
jmp 0x40b934
push esi
push esi
push esi
push 0x40b514
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
inc eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005500ac
mov esp, ebp
pop ebp
ret

Function at 0x40b943
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x40b956
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x40d22a
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x40d505
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x40d55f
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x40daff
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x40db2e
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x40db9f
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x40ee7c
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push 0x158
mov eax, 0x551927
call fcn.005500e5
xor ebx, ebx
xor edi, edi
inc ebx
cmp dword [0x68d67c], ebx
jne 0x40ef02
push ebx
push 0x40
push 2
push 0x56052c
call fcn.00408fb9
pop ecx
push eax
lea ecx, [ebp - 0x164]
call fcn.00409075
push 0x560554
mov dword [ebp - 4], edi
call fcn.00408fb9
push eax
lea eax, [ebp - 0x164]
push eax
call fcn.004081fc
push 0x560578
call fcn.00408fb9
push eax
lea eax, [ebp - 0x164]
push eax
call fcn.004081fc
add esp, 0x18
lea ecx, [ebp - 0x164]
call fcn.00409583
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x164]
call fcn.00409144
cmp dword [0x68d68c], ebx
jne 0x40efd9
lea eax, [ebp - 0x14]
push eax
call fcn.0041310f
lea eax, [ebp - 0x14]
push eax
call fcn.0040ee71
pop ecx
pop ecx
push ebx
push 0x40
push 8
push 0x55ded4
lea ecx, [ebp - 0xbc]
mov esi, eax
call fcn.00409075
push 0x55ca30
mov dword [ebp - 4], ebx
call fcn.00408fb9
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.004081fc
push esi
call dword [sym.imp.MSVCR120.dll_asctime]
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.004081fc
push 0x5605a4
call fcn.00408fb9
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.004081fc
push 0x560578
call fcn.00408fb9
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.004081fc
push 0x55ca78
call fcn.00408fb9
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.004081fc
add esp, 0x3c
lea ecx, [ebp - 0xbc]
call fcn.00409583
push 2
push 0x55ca18
call fcn.00408fb9
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xbc]
call fcn.00409144
mov eax, dword [0x68d680]
push edi
cmp eax, ebx
jne 0x40f004
push edi
push edi
push 0x40f1e0
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x40f012
push edi
push edi
push 0x40f1b8
jmp 0x40efea
cmp eax, 3
jne 0x40f020
push edi
push edi
push 0x4108b8
jmp 0x40efea
cmp eax, 4
jne 0x40f05a
push edi
push edi
push 0x40b022
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x200010
push 0x55f24c
call fcn.00408fb9
pop ecx
push eax
push 0x5605c8
call fcn.00408fb9
pop ecx
push eax
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40effd
jmp 0x40effe

Function at 0x40f05c
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x40f184
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret