joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fd810
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x533048]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.004f2dbb
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.004f2dbb
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x4fd887
cmp word [ecx], dx
je 0x4fd887
mov eax, dword [0x51140c]
push edi
dec eax
push eax
push 0x5112f8
call fcn.004fd7af
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x4fd8fa
cmp word [eax], dx
je 0x4fd8fa
mov eax, dword [edi]
test eax, eax
je 0x4fd8ab
cmp word [eax], dx
je 0x4fd8ab
lea eax, [ebp - 0x10]
push eax
call fcn.004fd192
jmp 0x4fd8b4
lea eax, [ebp - 0x10]
push eax
call fcn.004fd22d
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x4fd924
mov eax, dword [0x5112f4]
push dword [ebp - 0x14]
dec eax
push eax
push 0x510fe8
call fcn.004fd7af
add esp, 0xc
test al, al
je 0x4fd924
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x4fd8ef
cmp word [eax], di
je 0x4fd8ef
lea eax, [ebp - 0x10]
push eax
call fcn.004fd192
pop ecx
jmp 0x4fd926
lea eax, [ebp - 0x10]
push eax
call fcn.004fd22d
jmp 0x4fd8ec
mov eax, dword [edi]
test eax, eax
je 0x4fd911
cmp word [eax], dx
je 0x4fd911
lea eax, [ebp - 0x10]
push eax
call fcn.004fd147
pop ecx
jmp 0x4fd924
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x4fd9ef
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.004fd634
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x4fd9ef
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x4fd9ef
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x4fd9ef
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x4fd97c
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.004f47f0
test ebx, ebx
je 0x4fd9ea
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.004f47f0
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4fd9ef
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4fd9ef
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.00501159
add esp, 0x10
xor eax, eax
inc eax
jmp 0x4fd9f1
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004dca95
leave
ret
Function at 0x501bb0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x501bdd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x501bdd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x703c1cd9
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call fcn.703e2d70
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp + 0x10]
lea edx, [ebp - 0x10]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call eax
sub esp, 0x10
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x10]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call eax
sub esp, 0x10
cmp dword [ebp - 0xc], 0
je 0x703c1d7b
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.703e2d40
nop
leave
ret

Function at 0x703c1d7e
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.703e2d70
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
cmp dword [ebp - 0xc], 0
je 0x703c1e2a
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0x14]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call eax
sub esp, 0x10
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x14]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call eax
sub esp, 0x10
cmp dword [ebp - 0x10], 0
je 0x703c1e3b
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.703e2d40
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x703c1e40
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xd], 0xe8
mov byte [ebp - 9], 0
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
sub edx, eax
lea eax, [edx - 5]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0xd]
add eax, 1
mov edx, dword [ebp - 0x14]
mov dword [eax], edx
lea eax, [ebp - 0x18]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x40
mov dword [esp + 4], 5
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call eax
sub esp, 0x10
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xd]
mov dword [eax], edx
movzx edx, byte [ebp - 9]
mov byte [eax + 4], dl
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x18]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 5
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call eax
sub esp, 0x10
nop
leave
ret

Function at 0x703cb6d4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [esp], 2
call fcn.703d5ae0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], 0x70627b1c
call sub.msvcrt.dll_fwrite
mov ebx, dword [ebp - 0xc]
mov dword [esp], 2
call fcn.703d5ae0
mov dword [esp + 8], ebx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort

Function at 0x703cc04c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x703cc06b
mov eax, 0
jmp 0x703cc0af
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x703cc08e
mov eax, 0
jmp 0x703cc0af
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
cmp ax, 0x10b
je 0x703cc0aa
mov eax, 0
jmp 0x703cc0af
mov eax, 1
leave
ret

Function at 0x703cc0b1
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [ebp - 0xc]
add eax, edx
add eax, 0x18
mov dword [ebp - 4], eax
jmp 0x703cc110
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
cmp dword [ebp + 0xc], eax
jb 0x703cc108
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
add eax, edx
cmp dword [ebp + 0xc], eax
jae 0x703cc108
mov eax, dword [ebp - 4]
jmp 0x703cc124
add dword [ebp - 8], 1
add dword [ebp - 4], 0x28
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 6]
movzx eax, ax
cmp dword [ebp - 8], eax
jb 0x703cc0e5
mov eax, 0
leave
ret
Function at 0x703d70f7
Capabilities:
Contain obfuscated stackstrings
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
push ebx
add esp, 0xffffff80
cmp dword [ebp + 8], 0
je 0x703d7210
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.703dae44
cmp eax, 1
jne 0x703d7206
mov dword [ebp - 0x77], 0x6f727245
mov dword [ebp - 0x73], 0x6c632072
mov dword [ebp - 0x6f], 0x696e6165
mov dword [ebp - 0x6b], 0x7520676e
mov dword [ebp - 0x67], 0x70732070
mov dword [ebp - 0x63], 0x6b5f6e69
mov dword [ebp - 0x5f], 0x20737965
mov dword [ebp - 0x5b], 0x20726f66
mov dword [ebp - 0x57], 0x65726874
mov dword [ebp - 0x53], 0x206461
lea eax, [ebp - 0x4f]
mov ecx, 0x43
mov ebx, 0
mov dword [eax], ebx
mov dword [eax + ecx - 4], ebx
lea edx, [eax + 4]
and edx, 0xfffffffc
sub eax, edx
add ecx, eax
and ecx, 0xfffffffc
shr ecx, 2
mov edi, edx
mov eax, ebx
rep stosd dword es:[edi], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call eax
mov dword [esp + 8], 0xa
lea edx, [ebp - 0x77]
add edx, 0x27
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll__ultoa]
call eax
mov dword [ebp - 0xc], 0x27
jmp 0x703d71bc
add dword [ebp - 0xc], 1
lea edx, [ebp - 0x77]
mov eax, dword [ebp - 0xc]
add eax, edx
movzx eax, byte [eax]
test al, al
je 0x703d71d3
mov eax, dword [ebp - 0xc]
cmp eax, 0x69
jbe 0x703d71b8
mov eax, dword [ebp - 0xc]
cmp eax, 0x69
ja 0x703d71f1
lea edx, [ebp - 0x77]
mov eax, dword [ebp - 0xc]
add eax, edx
mov byte [eax], 0xa
mov eax, dword [ebp - 0xc]
add eax, 1
mov byte [ebp + eax - 0x77], 0
lea eax, [ebp - 0x77]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call eax
sub esp, 4
call sub.msvcrt.dll_abort
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov dword [eax], edx
jmp 0x703d7211
nop
lea esp, [ebp - 8]
pop ebx
pop edi
pop ebp
ret
Function at 0x703d8197
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov dword [ebp - 0x1c], 0xffffffff
mov dword [esp + 4], 0x703d8006
mov dword [esp], 0x70631a9c
call fcn.703d776c
mov eax, dword [0x70625730]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
sub esp, 4
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x703d81de
mov eax, dword [ebp - 0x20]
jmp 0x703d8329
call fcn.703d7000
mov dword [ebp - 0x20], eax
mov eax, dword [entry3]
test eax, eax
je 0x703d81f5
cmp dword [ebp - 0x20], 0
jne 0x703d81ff
mov eax, 0
jmp 0x703d8329
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x24], 1
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call eax
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x3c], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateEventA]
call eax
sub esp, 0x10
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x1c], 0xffffffff
mov eax, dword [ebp - 0x20]
lea edx, [eax + 0x38]
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.703d70f7
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x64], 0
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0x20]
lea edi, [eax + 0x14]
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov esi, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call eax
mov ebx, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
call eax
sub esp, 0x1c
test eax, eax
jne 0x703d82d1
call sub.msvcrt.dll_abort
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetThreadPriority]
call eax
sub esp, 4
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x6c], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x68], 0
mov eax, dword [ebp - 0x20]
movzx edx, byte [eax + 0x20]
and edx, 0xffffffcf
or edx, 0x10
mov byte [eax + 0x20], dl
mov eax, dword [0x70625730]
mov edx, dword [ebp - 0x20]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
test eax, eax
jne 0x703d8326
call sub.msvcrt.dll_abort
mov eax, dword [ebp - 0x20]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x703d83ed
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
call fcn.703d8197
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xb4]
mov dword [esp], eax
call fcn.703d802a
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax + 0x20]
and eax, 0x30
test al, al
jne 0x703d8448
mov eax, dword [ebp - 0x14]
add eax, 0x70
mov dword [esp + 4], 1
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll_longjmp]
call eax
mov eax, dword [0x70625730]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
sub esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x703d8572
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
test eax, eax
jne 0x703d84da
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xdeadbeef
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x703d8497
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.703d6f0e
mov dword [ebp - 0x10], 0
mov eax, dword [0x70625730]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
jmp 0x703d8572
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x68], 1
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x703d850a
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x24]
and eax, 4
test eax, eax
je 0x703d8572
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xdeadbeef
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.703d6f0e
mov dword [ebp - 0x10], 0
mov eax, dword [0x70625730]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll__endthreadex]
call eax
Function at 0x703e03b4
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov dword [esp + 0x14], 0x44
mov dword [esp + 0x10], 0x79
mov dword [esp + 0xc], 0x21
mov dword [esp + 8], 8
lea eax, [ebp - 0x42]
mov dword [esp + 4], eax
mov dword [esp], 0x70628684
call fcn.703e1084
lea eax, [ebp - 0x42]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
call eax
sub esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x703e041f
mov dword [esp + 4], 0
mov dword [esp], 0x7b
call fcn.703e060c
jmp 0x703e0531
mov dword [esp + 0x14], 0x91
mov dword [esp + 0x10], 0xbb
mov dword [esp + 0xc], 9
mov dword [esp + 8], 0xe
lea eax, [ebp - 0x2f]
mov dword [esp + 4], eax
mov dword [esp], 0x70628658
call fcn.703e0250
lea eax, [ebp - 0x2f]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x703e048b
mov dword [esp + 4], 0
mov dword [esp], 0x7e
call fcn.703e060c
jmp 0x703e0531
mov dword [ebp - 0xc], 0
jmp 0x703e0524
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
add eax, edx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
cmp eax, 0x49534d41
jne 0x703e051f
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 4
lea eax, [ebp - 0x20]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x40
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call eax
sub esp, 0x10
test eax, eax
setne al
test al, al
je 0x703e0520
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
lea edx, [eax + 1]
mov eax, dword [ebp - 0x18]
mov dword [eax], edx
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x20]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call eax
sub esp, 0x10
jmp 0x703e0520
nop
add dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 0xfff
jle 0x703e0497
leave
ret
Function at 0x703e06f0
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call eax
mov dword [ebp - 0xc], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0xffffffff
mov dword [esp + 4], 0
mov dword [esp], 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
sub esp, 8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x703e073b
mov eax, 0
jmp 0x703e0826
mov dword [ebp - 0x38], 0x1c
lea eax, [ebp - 0x38]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.KERNEL32.dll_Thread32First
sub esp, 8
test eax, eax
sete al
test al, al
je 0x703e077a
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, 0
jmp 0x703e0826
mov eax, dword [ebp - 0x38]
cmp eax, 0xf
jbe 0x703e07ef
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0xc], eax
jne 0x703e07ef
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x10], eax
je 0x703e07ef
mov eax, dword [ebp - 0x30]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x1fffff
mov eax, dword [sym.imp.KERNEL32.dll_OpenThread]
call eax
sub esp, 0xc
mov dword [ebp - 0x18], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x18], 0
je 0x703e07ef
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_SuspendThread]
call eax
sub esp, 4
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
lea eax, [ebp - 0x38]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.KERNEL32.dll_Thread32Next
sub esp, 8
test eax, eax
setne al
test al, al
jne 0x703e077a
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, 1
leave
ret
Function at 0x703e0c00
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x703e0d04
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x703e0ca2
mov dword [esp + 0x14], 0xd8
mov dword [esp + 0x10], 0x17
mov dword [esp + 0xc], 9
mov dword [esp + 8], 0xb
lea eax, [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp], 0x70628618
call fcn.703e0250
lea eax, [ebp - 0x1c]
mov dword [esp], eax
call fcn.703e1124
mov dword [esp + 4], 0
mov dword [esp], 0x2af
call fcn.703e060c
jmp 0x703e0cc0
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
call fcn.703c1f29
nop
leave
ret

Function at 0x703e1084
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x10
mov dword [ebp - 8], 0
jmp 0x703e10a8
mov eax, dword [ebp - 8]
lea edx, [eax + eax]
mov eax, dword [ebp + 0xc]
add eax, edx
mov word [eax], 0
add dword [ebp - 8], 1
mov eax, dword [ebp - 8]
cmp dword [ebp + 0x10], eax
jae 0x703e1094
mov dword [ebp - 0xc], 0
jmp 0x703e1112
mov eax, dword [ebp + 0x1c]
imul eax, dword [ebp + 0x14]
mov edx, eax
mov eax, dword [ebp + 0x18]
add eax, edx
mov dword [ebp + 0x1c], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
add eax, edx
movzx eax, byte [eax]
movzx ecx, al
mov eax, dword [ebp + 0x1c]
mov ebx, eax
mov eax, dword [ebp - 0xc]
lea edx, [eax + eax]
mov eax, dword [ebp + 0xc]
add eax, edx
xor ecx, ebx
mov edx, ecx
mov word [eax], dx
mov eax, dword [ebp - 0xc]
lea edx, [eax + eax]
mov eax, dword [ebp + 0xc]
add eax, edx
movzx eax, word [eax]
mov edx, dword [ebp - 0xc]
lea ecx, [edx + edx]
mov edx, dword [ebp + 0xc]
add edx, ecx
movzx eax, al
mov word [edx], ax
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0x10]
jb 0x703e10b9
nop
nop
mov ebx, dword [ebp - 4]
leave
ret