joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408b1f
Capabilities:
Enumerate files on windows
Get common file path
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x364
mov eax, dword [0x40f014]
xor eax, esp
mov dword [esp + 0x360], eax
push ebx
push esi
push edi
lea eax, [esp + 0x260]
mov ebx, 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x408b74
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x408cdc
movzx esi, si
or esi, 0x80070000
jmp 0x408cdc
push ecx
lea eax, [esp + 0x264]
mov edx, ebx
push eax
push 0
lea ecx, [esp + 0x164]
call fcn.00407318
mov esi, eax
test esi, esi
js 0x408cdc
push 0x402a18
mov edx, ebx
lea ecx, [esp + 0x15c]
call fcn.00407227
mov esi, eax
test esi, esi
js 0x408cdc
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x408b56
push 0x4029b4
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x408ca1
push 0x4029b8
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x408ca1
lea eax, [esp + 0x158]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x158]
push 0
lea eax, [esp + 0x14]
mov edx, ebx
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x26c]
push eax
call fcn.0040702c
mov esi, eax
test esi, esi
js 0x408cd5
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x10]
mov ecx, dword [esp + 0x14]
push 0
push eax
lea eax, [esp + 0x1c]
push eax
push 0x402a20
call fcn.0040702c
mov esi, eax
test esi, esi
js 0x408cd5
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x44]
mov ecx, dword [esp + 0x14]
push eax
call fcn.00406ff8
mov esi, eax
test esi, esi
js 0x408cd5
test byte [esp + 0x18], 0x10
je 0x408ca1
push 0x90
lea eax, [esp + 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [esp + 0x158]
call fcn.00407e5f
mov esi, eax
test esi, esi
js 0x408cd5
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x408bce
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x408cd5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x408cd5
movzx esi, si
or esi, 0x80070000
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x36c]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040de60
mov esp, ebp
pop ebp
ret
Function at 0x4093bd
Capabilities:
Compare security identifiers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor esi, esi
mov ebx, ecx
push esi
push 0x2000000
push 3
push esi
push esi
push 0x20000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x409458
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push eax
push 0x402b40
call dword [sym.imp.ADVAPI32.dll_ConvertStringSidToSidW]
test eax, eax
je 0x409451
lea edx, [ebp - 4]
mov dword [ebp - 4], esi
mov ecx, edi
call fcn.00408fbf
test eax, eax
js 0x409424
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov esi, eax
neg esi
sbb esi, esi
inc esi
jmp 0x409439
cmp eax, 0x8007053c
jne 0x409439
mov ecx, ebx
call fcn.0040d178
test eax, eax
je 0x409439
xor esi, esi
inc esi
cmp dword [ebp - 4], 0
je 0x409448
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x409aff
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push esi
xor esi, esi
mov dword [ebp - 8], eax
push esi
push esi
lea eax, [ebp - 0x10]
mov dword [ebp - 4], esi
push eax
push 0x409a30
push esi
push esi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x409b6b
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
jne 0x409b5f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x409b5c
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 4], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
jmp 0x409b7d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x409b7d
movzx eax, ax
or eax, 0x80070000
pop esi
leave
ret 4
Function at 0x40a4b9
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [0x40f014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea esi, [ebp + 8]
lea edi, [ebp - 0x64]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x78]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp + 0x18]
lea edi, [ebp - 0x74]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, 0xf003f
xor esi, esi
push edi
push esi
push 0x402670
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test ebx, ebx
jne 0x40a52d
push 0x27
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 0x78]
mov ebx, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x7c]
push eax
push edi
push esi
push 0x402c64
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
jne 0x40a584
push 0x27
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 0x7c]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x40a584
test ebx, ebx
je 0x40a593
jg 0x40a57f
mov esi, ebx
jmp 0x40a593
movzx esi, bx
jmp 0x40a58d
jg 0x40a58a
mov esi, edi
jmp 0x40a593
movzx esi, di
or esi, 0x80070000
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040de60
leave
ret 0x20

Function at 0x40aafc
Capabilities:
Parse pe header

Disassembly:
push 0x24
push 0x40e538
call fcn.0040e3b8
mov edi, edx
push 0x1c
lea eax, [ebp - 0x34]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
and dword [ebp - 4], 0
mov eax, 0x5a4d
mov ecx, dword [ebp - 0x30]
cmp word [ecx], ax
jne 0x40ab72
mov edx, dword [ecx + 0x3c]
cmp dword [edx + ecx], 0x4550
jne 0x40ab72
mov esi, dword [edx + ecx + 0xd8]
lea eax, [esi + ecx]
cmp edi, eax
jb 0x40ab72
mov eax, dword [edx + ecx + 0xdc]
add eax, esi
add eax, ecx
cmp edi, eax
jae 0x40ab72
mov dword [ebp - 4], 0xfffffffe
mov al, 1
jmp 0x40ab7b
mov dword [ebp - 4], 0xfffffffe
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40ac1d
Capabilities:
Allocate or change rwx memory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
mov ebx, edx
movzx eax, si
push edi
mov edi, 0x10000
test eax, eax
je 0x40aca5
sub esi, eax
add esi, edi
jmp 0x40aca5
lea eax, [esi - 0x50000000]
cmp eax, 0x30000000
ja 0x40ac52
mov esi, 0x80010000
jmp 0x40aca5
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
push 0x1c
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40aca9
mov ecx, dword [ebp - 0x10]
mov edi, 0x10000
cmp dword [ebp - 0xc], edi
jne 0x40ac93
cmp ecx, edi
jb 0x40ac93
push 0x40
push 0x3000
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x40acab
jmp 0x40ac3a
mov esi, dword [ebp - 0x1c]
add esi, ecx
movzx ecx, si
test ecx, ecx
je 0x40aca5
mov eax, edi
sub eax, ecx
add esi, eax
cmp esi, ebx
jb 0x40ac3e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40acb0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov ebx, ecx
lea esi, [edx - 0x10000]
jmp 0x40ad23
lea eax, [esi - 0x50000000]
cmp eax, 0x30000000
ja 0x40acd9
mov esi, 0x4fff0000
jmp 0x40ad2c
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
push 0x1c
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40ad30
mov edi, 0x10000
cmp dword [ebp - 0xc], edi
jne 0x40ad1a
cmp dword [ebp - 0x10], edi
jb 0x40ad1a
push 0x40
push 0x3000
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x40ad32
sub esi, edi
jmp 0x40ad2c
mov esi, dword [ebp - 0x18]
add esi, 0xffff0000
movzx eax, si
test eax, eax
je 0x40ad2c
sub esi, eax
cmp esi, ebx
ja 0x40acc5
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40af3c
Capabilities:
Allocate or change rwx memory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
cmp dword [0x40f4b8], 0
jne 0x40afa2
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
mov edx, 0x40f4b8
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x40afa2
push esi
mov esi, dword [0x40f4a8]
mov dword [0x40f498], eax
mov dword [0x40f4a0], eax
mov dword [0x40f4b4], eax
mov dword [0x40f4bc], eax
mov dword [0x40f4ac], eax
jmp 0x40af99
lea eax, [ebp - 4]
push eax
push 0x40
push 0x10000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, dword [esi + 4]
test esi, esi
jne 0x40af84
xor eax, eax
pop esi
leave
ret
mov eax, 0x10dd
leave
ret
Function at 0x40afa9
Capabilities:
Resume thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x40f4b8], eax
je 0x40afc4
mov eax, 0x10dd
leave
ret
push ebx
push esi
mov esi, dword [0x40f4b4]
push edi
jmp 0x40afda
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esi, dword [esi]
test esi, esi
jne 0x40afcf
mov edi, dword [0x40f4a0]
test edi, edi
je 0x40b010
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edi, dword [edi]
test edi, edi
jne 0x40afe8
mov edi, dword [0x40f4a0]
test edi, edi
je 0x40b010
mov esi, dword [edi]
push edi
call fcn.004035ce
mov edi, esi
pop ecx
test esi, esi
jne 0x40b001
mov edi, dword [0x40f498]
xor ebx, ebx
mov dword [0x40f4a0], ebx
mov dword [0x40f4b4], ebx
test edi, edi
je 0x40b063
lea eax, [ebp - 4]
push eax
mov eax, dword [edi + 0x10]
push dword [edi + 0x14]
movzx eax, byte [eax + 0x36]
push eax
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [edi + 4], ebx
jne 0x40b054
mov ecx, dword [edi + 0x10]
test ecx, ecx
je 0x40b054
call fcn.0040aeb1
mov dword [edi + 0x10], ebx
mov esi, dword [edi]
push edi
call fcn.004035ce
mov edi, esi
pop ecx
test esi, esi
jne 0x40b028
mov dword [0x40f498], ebx
call fcn.0040abda
pop edi
pop esi
mov dword [0x40f4b8], ebx
xor eax, eax
pop ebx
leave
ret
Function at 0x40b17b
Capabilities:
Resume thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x40f4b8], eax
je 0x40b197
mov eax, 0x10dd
leave
ret
cmp dword [0x40f4bc], 0
je 0x40b1aa
call fcn.0040afa9
jmp fcn.0040b3a3
push ebx
push esi
mov esi, dword [0x40f498]
xor ebx, ebx
mov dword [ebp - 8], ebx
push edi
test esi, esi
je 0x40b22b
cmp dword [esi + 4], 0
mov ecx, dword [esi + 0x10]
je 0x40b1e3
movzx eax, byte [ecx + 0x36]
push eax
lea eax, [ecx + 0x20]
push eax
push dword [esi + 0xc]
call sub.msvcrt.dll_memcpy
mov ecx, dword [esi + 8]
add esp, 0xc
mov eax, dword [esi + 0xc]
mov dword [ecx], eax
jmp 0x40b222
mov edx, dword [esi + 0xc]
mov ecx, dword [ecx + 0x44]
lea eax, [edx + 5]
mov byte [edx], 0xe9
sub ecx, eax
mov dword [edx + 1], ecx
add edx, 5
mov edi, dword [esi + 0x10]
xor ecx, ecx
mov eax, dword [edi + 0x40]
sub eax, edx
cmp dword [edi + 0x40], edx
sbb ebx, ebx
not ebx
and ebx, eax
mov dword [ebp - 4], ebx
jbe 0x40b21d
mov eax, ebx
mov byte [edx], 0xcc
inc edx
inc ecx
cmp ecx, eax
jb 0x40b211
mov edi, dword [esi + 0x10]
mov eax, dword [esi + 8]
mov dword [eax], edi
mov esi, dword [esi]
test esi, esi
jne 0x40b1bc
mov ebx, dword [ebp - 8]
mov esi, dword [0x40f4b4]
jmp 0x40b23d
mov ecx, dword [esi + 4]
call fcn.0040b07b
mov esi, dword [esi]
test esi, esi
jne 0x40b233
mov esi, dword [0x40f4a0]
jmp 0x40b253
mov ecx, dword [esi + 4]
call fcn.0040b07b
mov esi, dword [esi]
test esi, esi
jne 0x40b249
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, dword [0x40f498]
mov edi, eax
jmp 0x40b27b
mov ecx, dword [esi + 0x10]
movzx ecx, byte [ecx + 0x36]
push ecx
push dword [esi + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov esi, dword [esi]
test esi, esi
jne 0x40b267
mov esi, dword [0x40f4b4]
jmp 0x40b292
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esi, dword [esi]
test esi, esi
jne 0x40b287
mov edi, dword [0x40f4a0]
test edi, edi
je 0x40b2c8
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edi, dword [edi]
test edi, edi
jne 0x40b2a0
mov edi, dword [0x40f4a0]
test edi, edi
je 0x40b2c8
mov esi, dword [edi]
push edi
call fcn.004035ce
mov edi, esi
pop ecx
test esi, esi
jne 0x40b2b9
and dword [0x40f4a0], 0
and dword [0x40f4b4], 0
mov edi, dword [0x40f498]
test edi, edi
je 0x40b320
lea eax, [ebp - 8]
push eax
mov eax, dword [edi + 0x10]
push dword [edi + 0x14]
movzx eax, byte [eax + 0x36]
push eax
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [edi + 4], 0
je 0x40b311
mov ecx, dword [edi + 0x10]
test ecx, ecx
je 0x40b311
call fcn.0040aeb1
and dword [edi + 0x10], 0
xor ebx, ebx
inc ebx
mov esi, dword [edi]
push edi
call fcn.004035ce
mov edi, esi
pop ecx
test esi, esi
jne 0x40b2e0
and dword [0x40f498], 0
test ebx, ebx
je 0x40b394
invalid
invalid
movsb byte es:[edi], byte [esi]
Function at 0x40bc5e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
idiv edi
call [ecx + 0x50]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040b382
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.0040b3cd
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040b382
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
invalid
test dword [ecx], esp
cld
invalid

Function at 0x40c2b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.0040b39b
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.0040b3cd
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040b382
out dx, eax
invalid
inc dword [ebx - 0x7a76f33c]
sub al, 0xfc
invalid
invalid
call fcn.0040b3bd
lcall 0x104, 0x6873832c
add byte [eax], al
lea eax, [ebp - 0x12c]
push eax
invalid
xchg ebp, eax
Function at 0x40e0f4
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x40e598
call fcn.0040e3b8
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x40e154
cmp eax, 0xffffffff
je 0x40e154
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x40e14d
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x40e14d
cmp edx, 0x10000000
jae 0x40e14d
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x40e14a
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x40e1c0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40e1fe
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x40e1f6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x40e200
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x40e1e6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x40e2d0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x40e301
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x40e301
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x40e301
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x7a74ec
Capabilities:
Encode data using xor

Disassembly:
jmp 0x7a74f6
pushal
call 0x7a74fc
pop ebp
sub ebp, 0x10
sub ebp, 0x3a74ec
mov al, byte [esp + 0x28]
cmp al, 1
je 0x7a7520
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x7a7529
mov eax, 0x3a74ec
add eax, ebp
add eax, 0x63
mov ecx, 0x616
push ss
push es
add byte [eax], al
mov edx, 0x435e3ede
xor byte [eax], dl
inc eax
dec ecx
jne 0x7a7540
jmp 0x7a7553
push ebp
adc edx, dword [ebp + 0x57]
loop 0x7a7537
invalid
Function at 0x401060
Capabilities:
Check os version

Disassembly:
sub esp, 0x98
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x94], eax
push 0x94
lea eax, [esp + 4]
push 0
push eax
call fcn.004011b0
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x10], 2
jne 0x4010c2
cmp dword [esp + 4], 6
jb 0x4010c2
mov eax, 1
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.00401198
add esp, 0x98
ret
mov ecx, dword [esp + 0x94]
xor ecx, esp
xor eax, eax
call fcn.00401198
add esp, 0x98
ret

Function at 0x4010e0
Capabilities:
Check mutex on windows
Create process on windows

Disassembly:
call fcn.00401060
test eax, eax
je 0x4010ef
or eax, 0xffffffff
ret 0x10
push esi
push str.TopDomain_Screen_Capture_Mutex
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x401119
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x401120
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
pop esi
ret 0x10
call fcn.00401000
test eax, eax
je 0x401155
push 0
push 0x4000000
push 1
push 0
push 0
push 0
push str..TDHost.vxd
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x401119
push 0
push str.TDHelp.exe
call dword [sym.imp.KERNEL32.dll_WinExec]
call dword [sym.imp.TDGL32.dll_GL32Initialize]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x64
call esi
jmp 0x401161

Function at 0x401198
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x4011a2
repz ret
jmp fcn.004014ab
Function at 0x401b68
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x415018]
je 0x401b83
inc edi
cmp edi, 0x17
jb 0x401b74
cmp edi, 0x17
jae 0x401d03
push ebp
push 3
call fcn.004045c0
cmp eax, 1
pop ecx
je 0x401ccf
push 3
call fcn.004045c0
test eax, eax
pop ecx
jne 0x401bb7
cmp dword [0x415010], 1
je 0x401ccf
cmp ebx, 0xfc
je 0x401d02
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x416040
push ebp
call fcn.0040455b
add esp, 0xc
test eax, eax
je 0x401bed
push esi
push esi
push esi
push esi
push esi
call fcn.0040341c
add esp, 0x14
push 0x104
mov esi, 0x416059
push esi
push 0
mov byte [0x41615d], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x401c31
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.0040455b
add esp, 0xc
test eax, eax
je 0x401c31
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0040341c
add esp, 0x14
push esi
call fcn.004044d0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x401c76
push esi
call fcn.004044d0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x416354
push 0x41279c
sub ecx, eax
push ecx
push eax
call fcn.00404411
add esp, 0x14
test eax, eax
je 0x401c76
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.0040341c
add esp, 0x14
jmp 0x401c78
xor esi, esi
push 0x412798
push ebx
push ebp
call fcn.004043a0
add esp, 0xc
test eax, eax
je 0x401c98
push esi
push esi
push esi
push esi
push esi
call fcn.0040341c
add esp, 0x14
push dword [edi*8 + 0x41501c]
push ebx
push ebp
call fcn.004043a0
add esp, 0xc
test eax, eax
je 0x401cba
push esi
push esi
push esi
push esi
push esi
call fcn.0040341c
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.004041e3
add esp, 0xc
jmp 0x401d02
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x401d02
cmp ebp, 0xffffffff
je 0x401d02
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x41501c]
push dword [esi]
call fcn.004044d0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret