joyce8/EMBER2024-capa huggingface dataset:
Function at 0x683cd3
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esi, reloc.mscoree.dll__CorExeMain
jmp 0x683dbf
mov dword [esp + 0x1f], esi
pop si
pop dword [esp + 0xc]
pop dword [esp + 0x11]
xchg bl, ch
rdtsc
jmp 0x683cf4
push dword [esp + 0xc]
mov byte [esp + 0x19], ch
rdtsc
mov ebx, esi
lea edx, [esp + 0xdc]
mov bh, byte [esp + 3]
jmp 0x683d0a
xchg word [esp], dx
xchg dh, ch
lea edx, reloc.mscoree.dll__CorExeMain
xchg ebx, ecx
xchg ah, dh
xchg ah, cl
jmp 0x683d76

Function at 0x68432f
Capabilities:
Execute anti-debugging instructions

Disassembly:
stc
xchg dword [esp + 6], ecx
mov edx, dword [esp + 2]
not edx
bswap eax
jmp 0x6843aa
mov ax, dx
mov ah, byte [esp + 1]
xchg word [esp + 0x13], dx
pop ecx
mov ecx, esp
lea eax, [eax + ebx]
jmp 0x684381
mov ah, cl
lea ecx, [ebx + edi]
inc dl
bswap ecx
bsr ax, si
mov dx, bp
jmp 0x684356
rdtsc
rcr dh, cl
xchg dword [esp + 1], eax
mov dx, 0x6352
xchg dword [esp + 1], eax
mov dh, 0x5b
jmp 0x6843bd
not cl
mov al, 0xe
xchg dx, ax
adc dh, 0x8d
pop dword [esp]
xchg word [esp + 0x13], ax
jmp 0x68436f
cld
not ecx
rdtsc
push ecx
mov ecx, 0x33ea19e9
pop word [esp + 6]
jmp 0x68440e
cld
mov eax, 0xce5f38e9
mov al, byte [esp]
mov ecx, ebx
mov byte [esp], dh
xchg edx, eax
jmp 0x68443a
xchg edx, ecx
xchg cl, dl
clc
xchg dword [esp + 0xb], eax
lea edx, [edi*4]
lea esp, [esp + 0x15]
jmp 0x6843f8
mov dx, 0x82a3
not ah
add esp, 0
xchg ah, dl
rcr eax, cl
xchg edx, ecx
jmp 0x68457f
mov word [esp], cx
neg ah
mov ch, 0x2b
xchg dx, ax
mov cx, 0x37d3
jmp 0x684424
push word [esp + 1]
push dword [esp + 3]
lea edx, [esi*4]
clc
not ecx
mov edx, dword [esp + 3]
jmp 0x68454e
xchg ah, ch
lea edx, reloc.mscoree.dll__CorExeMain
xor ax, 0xf7f5
mov word [esp], cx
mov cx, word [esp]
mov al, byte [esp + 1]
jmp 0x6844d6
neg dx
xchg dl, ch
clc
lea ecx, [edx*4]
btr eax, esi
jmp 0x684560
sub esp, 5
pop ecx
xchg dx, cx
sub esp, 0x1e
shl dx, 4
pop edx
jmp 0x684512
mov cx, word [esp + 3]
cmp al, dh
push dword [esp + 3]
not eax
std
neg eax
jmp 0x684528
xchg word [esp + 0xb], dx
mov ecx, eax
std
pop word [esp + 0x18]
mov ch, byte [esp + 0xf]
lea edx, reloc.mscoree.dll__CorExeMain
jmp 0x68464c
mov ecx, edi
or ah, dl
btr edx, esi
cld
mov ax, 0xef93
neg ecx
jmp 0x6844f8
mov word [esp + 0x1c], cx
lea edx, [ecx + ebp]
mov ch, 0x56
pushal
lea esp, [esp + 0x45]
rcr cl, cl
call fcn.0068460f
mov ax, 0x8fed
mov eax, dword [esp + 2]
mov cx, word [esp + 3]
add esp, 1
jmp 0x684693
mov cl, 0x77
mov ch, byte [esp + 2]
neg eax
pop word [esp]
lea esp, [esp + 1]
lea edx, [esp + edx]
jmp 0x6846fd
mov edx, 0xb0375725
bt ecx, ebx
or dx, si
lea edx, [esi*4]
shl edx, cl
add esp, 0
jmp 0x684732
not ch
add esp, 1
not cx
cmc
rdtsc
mov al, ch
jmp 0x6846d2
inc ax
mov ax, word [esp]
add esp, 0
mov eax, 0x423bd15e
and ax, di
mov cl, 0xc5
jmp 0x68474b
mov edx, 0x90aadc1f
mov ah, 0xa3
mov edx, 0xf0ecb77c
xchg edx, eax
mov ah, byte [esp]
lea ecx, reloc.mscoree.dll__CorExeMain
jmp 0x68470c
pushfd
clc
bsf eax, ecx
push dword [esp + 1]
mov eax, 0x53a64ec5
lea esp, [esp + 4]
jmp 0x685cdc
mov ax, 0xc6f7
neg ecx
call fcn.00684f30
cmpsd dword [esi], dword es:[edi]
aaa
cmpsd dword [esi], dword es:[edi]
ret 0x8a31
Function at 0x68460f
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dx, 0x3d9a
mov edx, eax
mov dh, 0x25
mov dword [esp + 4], edi
not ecx
jmp 0x6845ee
rdtsc
xchg dx, ax
push word [esp + 2]
bts eax, edx
push dword [esp + 5]
std
jmp 0x684592
push dword [esp + 2]
sub esp, 0
mov ch, 0x97
sbb ax, cx
neg cx
lea eax, [ebx*4]
jmp 0x6845a8
shr ecx, cl
lea ecx, [esp + 0x50]
bts ax, bp
jmp 0x684627
mov dword [esp + 6], eax
not al
stc
mov ecx, dword [esp + 0xd]
pop dx
cld
jmp 0x6845d8
jmp 0x6845c0
mov ax, dx
mov dx, 0xcc21
xchg edx, ecx
mov dx, bx
setns al
jmp 0x6846b8
lea ecx, [esp + 0x8b]
mov ah, cl
mov dl, 0x15
rol dl, 2
add esp, 4
sets dl
jmp 0x684611
mov cx, 0xbfc9
mov byte [esp + 1], dh
lea edx, [esi*4]
xchg byte [esp + 3], dh
mov cx, dx
mov dx, si
jmp 0x684662
sete ch
add esp, 0
pop word [esp + 1]
mov cx, word [esp + 1]
bsr dx, bx
mov byte [esp + 2], bl
jmp 0x684678

Function at 0x6849c7
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, esp
bsr dx, sp
mov ax, 0x16a
lea ecx, [edx + esi]
jmp 0x684a2e
inc ax
rdtsc
pop word [esp + 5]
mov word [esp + 7], sp
jmp 0x684a41
push dword [esp + 7]
push di
mov edx, ecx
xchg cx, ax
xchg dword [esp + 4], ecx
mov word [esp + 6], bp
jmp 0x6849fe
mov dword [esp + 2], eax
bswap ecx
xchg dword [esp + 3], ecx
cld
and dh, bl
mov ecx, dword [esp + 4]
jmp 0x684a14
lea edx, [ecx - 0x59]
stc
mov word [esp + 2], cx
lea ecx, [eax + ecx]
xchg word [esp + 6], dx
mov cx, word [esp + 6]
jmp 0x684abf
lea esp, [esp + 4]
inc cl
adc cl, 0xbd
lea edx, [esi*4]
bswap edx
rdtsc
jmp 0x684a7b
pop ax
mov byte [esp + 1], ch
mov dh, byte [esp + 5]
pop dword [esp]
bt edx, esp
mov dword [esp], edi
jmp 0x684a91
Function at 0x684c86
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x684ce0
bswap edx
mov ah, cl
xchg byte [esp + 5], ch
rol eax, cl
mov ax, bp
mov cl, 0x82
jmp 0x684cca
mov dh, bh
shl ah, 7
xchg word [esp + 0xa], ax
bswap eax
jmp 0x684d43
mov edx, 0x4b3457fa
sub esp, 5
lea ecx, [ecx + edx]
setbe al
pop dword [esp + 5]
mov ecx, 0xe4afe689
jmp 0x684c88
bsf ax, di
sub esp, 3
mov dl, byte [esp + 8]
mov cl, ch
rdtsc
neg dl
jmp 0x684d9d
pop word [esp + 8]
xchg word [esp + 2], ax
inc ecx
pushfd
mov ax, word [esp + 0x13]
xchg word [esp + 0x13], ax
jmp 0x684d21
mov byte [esp + 9], cl
rdtsc
pop dword [esp + 2]
xchg byte [esp + 0xb], al
rdtsc
jmp 0x684dc9
mov ax, bp
mov dword [esp + 5], esi
pop dword [esp + 9]
xchg dword [esp + 2], edx
btr cx, ax
xchg edx, ecx
jmp 0x684d5b
xchg word [esp + 8], cx
mov dword [esp + 8], edx
xchg dword [esp + 4], eax
pop cx
bt eax, ebx
neg cl
jmp 0x684d71
neg ax
mov dx, si
lea eax, [esp + edx]
xchg cl, dl
jmp 0x684e1c
xchg word [esp + 5], ax
add esp, 0xe
not dx
mov al, 0xab
lea esp, [esp]
mov cx, word [esp + 1]
jmp 0x684db3
mov ch, byte [esp]
xchg dx, ax
cmc
not cl
mov dx, 0xd0af
setne dh
jmp 0x684e71
mov ecx, 0x88357bb1
pop dx
mov dh, byte [esp]
cmp ecx, ebp
cmc
rdtsc
jmp 0x684dfa
mov dl, 0x82
lea edx, [edx*4]
mov ecx, esp
cld
push ebx
jmp 0x684e52
stc
mov edx, ecx
bts ecx, esi
bswap edx
setb dh
neg ah
jmp 0x684e2d
lea ecx, [esp - 0xf8]
dec dh
pushal
xchg ecx, eax
call fcn.00684e9a
fstp dword [eax - 0x32]
test eax, 0xb531ba58
and eax, 0x2454bf4c
push edi
or ax, ax
rdtsc
lea ecx, [ebp + ebp]
std
mov ax, si
mov dx, 0xfddc
jmp 0x684e43

Function at 0x684f30
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov cx, word [esp + 0xc]
push dword [esp + 3]
mov dx, 0x37c3
rdtsc
add esp, 0xd
call fcn.00684990
rcr cx, 0xe
not ecx
add esp, 0
setnp dl
lea eax, [esp + ebp]
jmp 0x684aa7
not edx
mov word [esp], ax
inc dx
lea ecx, [eax + 0x30]
bswap eax
add esp, 2
jmp 0x684b1c
mov edx, dword [esp]
call fcn.00684aea
pop word [esp + 7]
xchg dword [esp + 2], edx
xchg dword [esp + 5], ecx
xchg ecx, eax
jmp 0x684c13
rdtsc
rdtsc
mov ax, 0xe610
mov byte [esp + 0xc], bh
pop word [esp + 9]
mov dx, 0x26c
jmp 0x684a64
bswap edx
mov ch, byte [esp + 8]
xchg word [esp + 5], cx
mov byte [esp + 6], dl
not dx
push esp
jmp 0x684bc5
xchg word [esp + 5], dx
pop ecx
lea ecx, [ecx*4]
lea edx, [edx*4]
bsf ax, si
pushfd
jmp 0x684b76
pushfd
mov edx, 0x9cfab5af
pop eax
pop word [esp + 4]
std
call fcn.00684baf
lea ecx, [edi*4]
bsf dx, dx
pop eax
pop ax
jmp 0x684bf2
lea eax, reloc.mscoree.dll__CorExeMain
lea esp, [esp + 3]
mov ch, 0x41
cld
lea eax, [ecx*4]
xchg ecx, eax
jmp 0x684de5
mov al, byte [esp + 4]
sbb dx, di
lea esp, [esp + 2]
xchg ecx, eax
mov eax, ebp
mov ax, word [esp]
jmp 0x684b94
xchg dword [esp], ecx
rdtsc
and ecx, 0x98dfd032
lea eax, [esp + edx]
push dword [esp]
pop dword [esp]
call fcn.00684c40
mov edx, dword [esp + 5]
xchg ecx, eax
xchg dword [esp], ecx
setp al
xchg cx, ax
xchg ah, dh
jmp 0x684c6d
rdtsc
pop eax
pop word [esp + 1]
push bx
mov al, ah
mov ax, 0xea60
jmp 0x684d0c
sets dl
push dword [esp + 4]
push word [esp + 2]
xchg byte [esp + 2], dl
jmp 0x684b5c
Function at 0x1006c040
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x1006c22d
pushal
mov esi, section.UPX1
lea edi, [esi - 0x47000]
push edi
or ebp, 0xffffffff
jmp 0x1006c06a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1006c071
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1006c060
mov eax, 1
add ebx, ebx
jne 0x1006c083
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x1006c094
jne 0x1006c0b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1006c0b3
dec eax
add ebx, ebx
jne 0x1006c0a0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x1006c078
add ebx, ebx
jne 0x1006c0af
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x1006c105
xor ecx, ecx
sub eax, 3
jb 0x1006c0cb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1006c13a
sar eax, 1
mov ebp, eax
jmp 0x1006c0d6
add ebx, ebx
jne 0x1006c0d6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1006c0a4
inc ecx
add ebx, ebx
jne 0x1006c0e4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1006c0a4
add ebx, ebx
jne 0x1006c0f1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x1006c0e6
jne 0x1006c102
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1006c0e6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x1006c124
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x1006c116
jmp 0x1006c066
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x1006c124
add edi, ecx
jmp 0x1006c066
pop esi
mov edi, esi
mov ecx, 0x1b7a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x1006c142
cmp byte [edi], 0xe
jne 0x1006c142
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x1006c147
lea edi, [esi + 0x68000]
mov eax, dword [edi]
or eax, eax
je 0x1006c1bf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x6c29c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x6c3a4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x1006c174
mov ecx, edi
jns 0x1006c1a3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x6c3a8]
or eax, eax
je 0x1006c1b9
mov dword [ebx], eax
add ebx, 4
jmp 0x1006c191
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x1006c1f0
cmp al, 0xef
ja 0x1006c1e3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x1006c1c5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x1006c1d2
mov ebp, dword [esi + 0x6c3ac]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1006c224
sub esp, 0xffffff80
jmp 0x1002bda2
Function at 0x4011c0
Capabilities:
Contain obfuscated stackstrings
Decode data using base64 via vbmi lookup table

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4eb822
mov eax, dword fs:[0]
push eax
sub esp, 0x94
mov eax, dword [0x5441b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 0xc]
mov esi, edx
mov dword [ebp - 0x94], eax
xor eax, eax
mov dword [ebp - 0x9c], eax
lea ecx, [eax + 0xf]
mov dword [esi + 0x14], ecx
mov dword [esi + 0x10], eax
mov dword [ebp - 0xa0], esi
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], 0x3e000000
mov dword [ebp - 0x60], 0x3f000000
mov dword [ebp - 0x5c], 0x37363534
mov dword [ebp - 0x58], 0x3b3a3938
mov dword [ebp - 0x54], 0x3d3c
mov dword [ebp - 0x50], eax
lea edx, [eax + 1]
mov dword [ebp - 0x4c], 0x2010000
mov dword [ebp - 0x48], 0x6050403
mov dword [ebp - 0x44], 0xa090807
mov dword [ebp - 0x40], 0xe0d0c0b
mov dword [ebp - 0x3c], 0x1211100f
mov dword [ebp - 0x38], 0x16151413
mov dword [ebp - 0x34], 0x191817
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 0x1c1b1a00
mov dword [ebp - 0x28], 0x201f1e1d
mov dword [ebp - 0x24], 0x24232221
mov dword [ebp - 0x20], 0x28272625
mov dword [ebp - 0x1c], 0x2c2b2a29
mov dword [ebp - 0x18], 0x302f2e2d
mov word [ebp - 0x14], 0x3231
mov byte [ebp - 0x12], 0x33
mov byte [esi], al
mov dword [ebp - 4], eax
mov dword [ebp - 0x9c], edx
mov dword [ebp - 0x90], eax
cmp dword [ebp + 8], eax
jle 0x4013be
mov al, byte [edi]
cmp al, 0xd
je 0x4013a7
cmp al, 0xa
je 0x4013a7
cmp al, 0x20
je 0x4013a7
cmp al, 9
je 0x4013a7
movsx ecx, al
movsx eax, byte [edi + edx]
movsx ebx, byte [ebp + ecx - 0x8c]
movsx ecx, byte [ebp + eax - 0x8c]
add edi, edx
shl ebx, 0x12
shl ecx, 0xc
add ebx, ecx
mov dword [ebp - 0x98], ebx
sar ebx, 0x10
add edi, edx
call fcn.00401e10
mov eax, dword [ebp - 0x94]
inc dword [eax]
mov al, byte [edi]
cmp al, 0x3d
je 0x401399
mov ebx, dword [ebp - 0x98]
movsx edx, al
movsx eax, byte [ebp + edx - 0x8c]
shl eax, 6
add ebx, eax
mov dword [ebp - 0x98], ebx
sar ebx, 8
inc edi
call fcn.00401e10
mov eax, dword [ebp - 0x94]
inc dword [eax]
mov al, byte [edi]
cmp al, 0x3d
je 0x401399
mov ebx, dword [ebp - 0x98]
movsx ecx, al
movsx edx, byte [ebp + ecx - 0x8c]
add ebx, edx
inc edi
call fcn.00401e10
mov eax, dword [ebp - 0x94]
inc dword [eax]
add dword [ebp - 0x90], 4
mov edx, 1
jmp 0x4013af
add edi, edx
add dword [ebp - 0x90], edx
mov eax, dword [ebp - 0x90]
cmp eax, dword [ebp + 8]
jl 0x4012e4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b6111
mov esp, ebp
pop ebp
ret 8
Function at 0x401ff0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ed006
mov eax, dword fs:[0]
push eax
sub esp, 0x14c
mov eax, dword [0x5441b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
mov edi, edx
cmp dword [esi + 0x10], ebx
je 0x402172
cmp dword [esi + 0x14], 8
jb 0x402037
mov eax, dword [esi]
jmp 0x402039
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x402172
push 0x18
push str.UmVnc3ZyMzIgL3MgIiVzIg
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.00406bf0
mov dword [ebp - 4], ebx
mov ecx, dword [ebp - 0x2c]
mov ebx, 0x10
cmp dword [ebp - 0x18], ebx
jae 0x402077
lea ecx, [ebp - 0x2c]
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0x154]
push eax
push edx
lea edx, [ebp - 0x48]
call fcn.004011c0
mov byte [ebp - 4], 1
mov eax, dword [0x543f28]
mov edx, dword [eax + 0xc]
mov ecx, 0x543f28
call edx
add eax, 0x10
mov dword [ebp - 0x154], eax
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x34], ebx
jae 0x4020b5
lea eax, [ebp - 0x48]
push 3
push eax
lea edx, [ebp - 0x150]
lea ecx, [ebp - 0x14c]
push edx
mov dword [ebp - 0x150], ecx
call fcn.00404240
mov byte [ebp - 4], 3
cmp dword [esi + 0x14], 8
jb 0x4020dc
mov esi, dword [esi]
mov eax, dword [ebp - 0x150]
push esi
push eax
lea edi, [ebp - 0x154]
call fcn.00406b50
mov eax, dword [ebp - 0x150]
lea ecx, [ebp - 0x14c]
add esp, 8
cmp eax, ecx
je 0x40210b
push eax
call fcn.004b7789
add esp, 4
mov esi, dword [ebp - 0x154]
push esi
call fcn.00402350
lea eax, [esi - 0x10]
add esp, 4
mov byte [ebp - 4], 1
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40213a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [ebp - 0x34], ebx
jb 0x40214b
mov ecx, dword [ebp - 0x48]
push ecx
call fcn.004b6106
add esp, 4
mov dword [ebp - 0x34], 0xf
mov dword [ebp - 0x38], 0
mov byte [ebp - 0x48], 0
cmp dword [ebp - 0x18], ebx
jb 0x40216e
mov edx, dword [ebp - 0x2c]
push edx
call fcn.004b6106
add esp, 4
mov al, 1
jmp 0x402182
push 7
push 0x50b1b0
mov ecx, edi
call fcn.004073c0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b6111
mov esp, ebp
pop ebp
ret
Function at 0x4021a0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ecfb6
mov eax, dword fs:[0]
push eax
sub esp, 0x14c
mov eax, dword [0x5441b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
mov edi, edx
cmp dword [esi + 0x10], ebx
je 0x402322
cmp dword [esi + 0x14], 8
jb 0x4021e7
mov eax, dword [esi]
jmp 0x4021e9
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x402322
push 0x1c
push str.UmVnc3ZyMzIgL3UgL3MgIiVzIg
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.00406bf0
mov dword [ebp - 4], ebx
mov ecx, dword [ebp - 0x2c]
mov ebx, 0x10
cmp dword [ebp - 0x18], ebx
jae 0x402227
lea ecx, [ebp - 0x2c]
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0x154]
push eax
push edx
lea edx, [ebp - 0x48]
call fcn.004011c0
mov byte [ebp - 4], 1
mov eax, dword [0x543f28]
mov edx, dword [eax + 0xc]
mov ecx, 0x543f28
call edx
add eax, 0x10
mov dword [ebp - 0x154], eax
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x34], ebx
jae 0x402265
lea eax, [ebp - 0x48]
push 3
push eax
lea edx, [ebp - 0x150]
lea ecx, [ebp - 0x14c]
push edx
mov dword [ebp - 0x150], ecx
call fcn.00404240
mov byte [ebp - 4], 3
cmp dword [esi + 0x14], 8
jb 0x40228c
mov esi, dword [esi]
mov eax, dword [ebp - 0x150]
push esi
push eax
lea edi, [ebp - 0x154]
call fcn.00406b50
mov eax, dword [ebp - 0x150]
lea ecx, [ebp - 0x14c]
add esp, 8
cmp eax, ecx
je 0x4022bb
push eax
call fcn.004b7789
add esp, 4
mov esi, dword [ebp - 0x154]
push esi
call fcn.00402350
lea eax, [esi - 0x10]
add esp, 4
mov byte [ebp - 4], 1
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4022ea
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [ebp - 0x34], ebx
jb 0x4022fb
mov ecx, dword [ebp - 0x48]
push ecx
call fcn.004b6106
add esp, 4
mov dword [ebp - 0x34], 0xf
mov dword [ebp - 0x38], 0
mov byte [ebp - 0x48], 0
cmp dword [ebp - 0x18], ebx
jb 0x40231e
mov edx, dword [ebp - 0x2c]
push edx
call fcn.004b6106
add esp, 4
mov al, 1
jmp 0x402332
push 7
push 0x50b1b0
mov ecx, edi
call fcn.004073c0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b6111
mov esp, ebp
pop ebp
ret
Function at 0x402350
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push esi
push edi
lea eax, [ebp - 0x5c]
push eax
mov dword [ebp - 0x5c], 0x44
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xor ecx, ecx
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x5c]
push eax
push ecx
push ecx
push ecx
push 1
push ecx
push ecx
mov word [ebp - 0x2c], cx
mov ecx, dword [ebp + 8]
push ecx
push 0
mov dword [ebp - 0x30], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40239d
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x7530
push edx
xor esi, esi
call edi
test eax, eax
je 0x4023c9
inc esi
cmp esi, 5
je 0x4023c9
mov eax, dword [ebp - 0x14]
push 0x7530
push eax
call edi
test eax, eax
jne 0x4023b4
mov ecx, dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [ebp - 0x14]
push edx
call esi
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4023f0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x5441b4]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov dword [ebp - 0x210], 0
mov word [ebp - 0x20c], ax
call fcn.004be120
add esp, 0xc
cmp byte [ebp + 8], 0
push 0x104
je 0x402444
lea edx, [ebp - 0x20c]
push edx
push str._ProgramW6432_
jmp 0x402450
lea eax, [ebp - 0x20c]
push eax
push str._ProgramFiles_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor ecx, ecx
lea eax, [ebp - 0x20c]
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], cx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402472
sub eax, edx
sar eax, 1
push eax
lea edx, [ebp - 0x20c]
push edx
mov ecx, esi
call fcn.004073c0
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, esi
call fcn.004b6111
mov esp, ebp
pop ebp
ret

Function at 0x4024a0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x5441b4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4024d6
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b6111
mov esp, ebp
pop ebp
ret
push edi
push 0x228
lea eax, [ebp - 0x22c]
push 0
push eax
mov dword [ebp - 0x230], 0x22c
call fcn.004be120
add esp, 0xc
lea ecx, [ebp - 0x230]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x402532
mov edi, dword [sym.imp.KERNEL32.dll_Process32NextW]
nop
lea edx, [ebp - 0x20c]
push edx
push ebx
call fcn.004b6f86
add esp, 8
test eax, eax
je 0x40254b
lea eax, [ebp - 0x230]
push eax
push esi
call edi
test eax, eax
jne 0x402510
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b6111
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x228]
pop edi
xor ecx, ebp
pop esi
call fcn.004b6111
mov esp, ebp
pop ebp
ret