joyce8/EMBER2024-capa huggingface dataset:
Function at 0x12cfe77
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x20
mov dword [ebp - 4], edx
mov esi, ecx
call fcn.012d79f2
mov edi, eax
xor ebx, ebx
pop ecx
test edi, edi
je 0x12cfeb1
mov dword [edi + 0x10], ebx
mov dword [edi], ebx
mov dword [edi + 0x1c], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [edi + 0x18], eax
jmp 0x12cfeb3
mov edi, ebx
test edi, edi
jne 0x12cfec1
mov esi, 0x8007000e
jmp 0x12cff45
push ebx
push ebx
push ebx
push ebx
mov dword [edi + 8], esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [edi + 0x1c], eax
test eax, eax
jne 0x12cfeec
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x12cff39
movzx esi, si
or esi, 0x80070000
jmp 0x12cff39
lea eax, [edi + 0x14]
push eax
push ebx
push edi
push 0x12cff50
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x10], eax
test eax, eax
je 0x12cfed5
push ecx
push ecx
mov ecx, dword [edi + 0x1c]
call fcn.012cfadc
push dword [edi + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [edi + 0xc]
mov dword [edi + 0x1c], ebx
test esi, esi
jle 0x12cff2e
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x12cff39
mov eax, dword [ebp - 4]
mov esi, ebx
mov dword [eax], edi
mov edi, ebx
test edi, edi
je 0x12cff45
push ecx
mov ecx, edi
call fcn.012ca3f7
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x12d2494
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x39c
mov eax, dword [0x12d8140]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x12d8489], 0
push ebx
push esi
push edi
mov esi, ecx
je 0x12d24e6
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x12d2566
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x12d256a
lea eax, [ebp - 0x398]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
jmp 0x12d2552
xor eax, eax
push eax
push eax
push eax
push eax
push 0xffffffffffffffff
push esi
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, eax
test ebx, ebx
jne 0x12d2511
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x12d256f
movzx eax, ax
or eax, 0x80070000
jmp 0x12d256f
call fcn.012d7df0
mov edi, esp
xor eax, eax
push eax
push eax
push ebx
push edi
push 0xffffffffffffffff
push esi
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x12d24fd
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x12d2566
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x12d256a
lea eax, [ebp - 0x148]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
test eax, eax
je 0x12d256a
cmp eax, 0xffffffff
je 0x12d256a
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x12d256f
test al, 0x10
je 0x12d2562
mov eax, 0x80070002
lea esp, [ebp - 0x3a8]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.012d7a50
mov esp, ebp
pop ebp
ret

Function at 0x12d5482
Capabilities:
Check os version

Disassembly:
push 0xa0
push 0x12d7ec0
call fcn.012d7d64
mov dword [0x12d8484], 0x9c4
mov dword [0x12d848c], ecx
and dword [ebp - 4], 0
push 0x12d84a0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 0xb0], 0x94
lea eax, [ebp - 0xb0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x12d5539
cmp dword [ebp - 0xac], 6
sbb al, al
inc al
mov byte [0x12d848a], al
call fcn.012d5571
mov dword [0x12d8498], eax
cmp dword [ebp - 0xa0], 2
jne 0x12d551e
mov byte [0x12d8489], 1
cmp dword [ebp - 0xac], 5
jne 0x12d550e
cmp dword [ebp - 0xa8], 1
jae 0x12d5517
cmp dword [ebp - 0xac], 6
jb 0x12d551e
mov byte [0x12d8494], 1
xor eax, eax
cmp dword [0x12d848c], eax
setne al
jmp 0x12d553b
xor eax, eax
call fcn.012d7dac
ret
Function at 0x12d5ae4
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x12d8140]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x12d8489], 0
push ebx
push esi
push edi
mov ebx, ecx
je 0x12d5b79
mov eax, dword [ebp + 0xc]
xor esi, esi
push 2
pop ecx
mul ecx
cmp edx, esi
ja 0x12d5bb7
jb 0x12d5b21
cmp eax, 0xffffffff
ja 0x12d5bb7
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push edi
lea eax, [ebp - 8]
push eax
push esi
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x12d5b49
jle 0x12d5b63
movzx eax, ax
or eax, 0x80070000
jmp 0x12d5b63
cmp dword [ebp - 8], 1
je 0x12d5b55
cmp dword [ebp - 8], 2
jne 0x12d5bb7
mov eax, dword [ebp - 0xc]
shr eax, 1
cmp word [edi + eax*2 - 2], si
jne 0x12d5bb7
xor eax, eax
lea esp, [ebp - 0x18]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.012d7a50
mov esp, ebp
pop ebp
ret 8
mov esi, dword [ebp + 0xc]
inc esi
mov eax, esi
call fcn.012d7df0
mov edi, esp
mov dword [ebp - 0xc], esi
lea eax, [ebp - 0xc]
xor esi, esi
push eax
push edi
lea eax, [ebp - 8]
push eax
push esi
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x12d5b3d
cmp dword [ebp - 8], 1
je 0x12d5bad
cmp dword [ebp - 8], 2
jne 0x12d5bb7
mov eax, dword [ebp - 0xc]
cmp byte [edi + eax - 1], 0
je 0x12d5bbe
mov eax, 0x80040153
jmp 0x12d5b63
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0xffffffffffffffff
push edi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x12d5b61
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jmp 0x12d5b3d
Function at 0x12d5be0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x12d8140]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x12d8489], 0
mov eax, ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], 4
je 0x12d5c23
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 8]
lea ecx, [ebp - 0xc]
push ecx
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x12d5c86
xor esi, esi
test edi, edi
je 0x12d5c98
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push edi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x12d5c53
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x12d5ca1
movzx eax, ax
or eax, 0x80070000
jmp 0x12d5ca1
call fcn.012d7df0
mov ebx, esp
push esi
push esi
push dword [ebp - 0x10]
push ebx
push 0xffffffffffffffff
push edi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x12d5c3f
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 8]
lea ecx, [ebp - 0xc]
push ecx
push esi
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x12d5c47
cmp dword [ebp - 0xc], 4
jne 0x12d5c9c
cmp dword [ebp - 8], 4
jne 0x12d5c9c
jmp 0x12d5ca1
mov ebx, esi
jmp 0x12d5c72
mov eax, 0x80040153
lea esp, [ebp - 0x20]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.012d7a50
mov esp, ebp
pop ebp
ret 4

Function at 0x12d5cb7
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x12d8140]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x12d8489], 0
mov eax, ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0xc], eax
je 0x12d5cf0
push 4
lea ecx, [ebp + 8]
push ecx
push 4
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x12d5d44
xor esi, esi
test edi, edi
je 0x12d5d66
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push edi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 8], eax
test eax, eax
jne 0x12d5d14
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x12d5d44
call fcn.012d7df0
mov ebx, esp
push esi
push esi
push dword [ebp - 8]
push ebx
push 0xffffffffffffffff
push edi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x12d5d0c
mov eax, dword [ebp - 0xc]
push 4
lea ecx, [ebp + 8]
push ecx
push 4
push esi
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jle 0x12d5d50
movzx eax, ax
or eax, 0x80070000
lea esp, [ebp - 0x18]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.012d7a50
mov esp, ebp
pop ebp
ret 4
mov ebx, esi
jmp 0x12d5d33
Function at 0x12d5d6a
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc1c
mov eax, dword [0x12d8140]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
mov esi, edx
xor edx, edx
mov eax, ecx
push edi
mov edi, dword [ebp + 8]
inc ebx
mov dword [ebp - 0xc18], eax
mov dword [ebp - 0xc14], edi
mov dword [ebp - 0xc1c], edx
cmp byte [0x12d8489], dl
je 0x12d5e02
lea ecx, [ebp - 0xc08]
mov dword [ebp - 0xc08], 0x400
push ecx
lea ecx, [ebp - 0xc04]
push ecx
lea ecx, [ebp - 0xc0c]
push ecx
push edx
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x12d5df7
jle 0x12d5dde
movzx eax, ax
or eax, 0x80070000
lea esp, [ebp - 0xc28]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.012d7a50
mov esp, ebp
pop ebp
ret 4
lea edx, [ebp - 0xc04]
jmp 0x12d5ef9
test esi, esi
je 0x12d5ea3
push edx
push edx
push edx
push edx
push 0xffffffffffffffff
push esi
push edx
push edx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
jne 0x12d5e29
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jmp 0x12d5dd4
call fcn.012d7df0
mov eax, esp
xor ecx, ecx
push ecx
push ecx
push edi
push eax
push 0xffffffffffffffff
push esi
push ecx
push ecx
mov dword [ebp - 0xc10], eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x12d5e1f
mov eax, dword [ebp - 0xc10]
xor edx, edx
mov edi, dword [ebp - 0xc14]
lea ecx, [ebp - 0xc08]
mov esi, 0x400
push ecx
lea ecx, [ebp - 0x404]
mov dword [ebp - 0xc08], esi
push ecx
lea ecx, [ebp - 0xc0c]
push ecx
push edx
push eax
push dword [ebp - 0xc18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x12d5dd4
mov ecx, dword [ebp - 0xc08]
test ecx, ecx
jne 0x12d5ea7
mov eax, 0x80004005
jmp 0x12d5dde
mov eax, edx
jmp 0x12d5e59
lea eax, [ecx - 1]
cmp eax, esi
jae 0x12d5f78
xor edx, edx
mov byte [ebp + eax - 0x404], dl
mov eax, dword [ebp - 0xc0c]
cmp eax, ebx
je 0x12d5ed2
cmp eax, 2
je 0x12d5ed2
lea edx, [ebp - 0x404]
jmp 0x12d5f05
push esi
lea eax, [ebp - 0xc04]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x404]
push eax
push edx
push edx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x12d5e1f
mov edx, dword [ebp - 0xc1c]
mov eax, dword [ebp - 0xc0c]
mov ecx, dword [ebp - 0xc08]
test eax, eax
je 0x12d5f6e
cmp eax, 2
jbe 0x12d5f1f
cmp eax, 4
jne 0x12d5f6e
cmp ecx, eax
jne 0x12d5f6e
cmp dword [edx], 0
setne bl
jmp 0x12d5f65
push 0xffffffffffffffff
mov edx, 0x12c4240
mov byte [edi], bl
lea ecx, [ebp - 0xc04]
call fcn.012d4ff6
test eax, eax
je 0x12d5f63
push 0xffffffffffffffff
mov edx, 0x12c4244
lea ecx, [ebp - 0xc04]
call fcn.012d4ff6
test eax, eax
je 0x12d5f63
push 0xffffffffffffffff
mov edx, 0x12c424c
lea ecx, [ebp - 0xc04]
call fcn.012d4ff6
test eax, eax
jne 0x12d5f65
xor bl, bl
mov byte [edi], bl
xor eax, eax
jmp 0x12d5dde
mov eax, 0x80040153
jmp 0x12d5dde
call fcn.012d7c34
int3
Function at 0x12d5f7e
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x12d8140]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x12d8489], 0
push ebx
push esi
push edi
mov esi, ecx
je 0x12d5fc1
push esi
push 0x104
push dword [ebp + 0xc]
push 0x12c3ae4
push 0x12c417c
push 0x12c412c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x12d60f8
xor eax, eax
push eax
push eax
push eax
push eax
push 0xffffffffffffffff
push esi
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
jne 0x12d5ff3
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x12d6101
movzx eax, ax
or eax, 0x80070000
jmp 0x12d6101
call fcn.012d7df0
mov ebx, esp
test ebx, ebx
je 0x12d60fc
xor eax, eax
push eax
push eax
push edi
push ebx
or edi, 0xffffffff
push edi
push esi
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x12d5fd8
xor eax, eax
push eax
push eax
push eax
push eax
push edi
push 0x12c412c
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
test esi, esi
je 0x12d5fd8
call fcn.012d7df0
mov eax, esp
mov dword [ebp - 0xc], eax
test eax, eax
je 0x12d60fc
xor ecx, ecx
push ecx
push ecx
push esi
push eax
push edi
push 0x12c412c
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x12d5fd8
xor eax, eax
push eax
push eax
push eax
push eax
push edi
push 0x12c417c
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
test esi, esi
je 0x12d5fd8
call fcn.012d7df0
mov eax, esp
mov dword [ebp - 8], eax
test eax, eax
je 0x12d60fc
xor ecx, ecx
push ecx
push ecx
push esi
push eax
push edi
push 0x12c417c
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x12d5fd8
push 4
pop eax
call fcn.012d7dc0
mov esi, esp
test esi, esi
je 0x12d60fc
mov eax, 0x108
mov byte [esi], 0
call fcn.012d7df0
mov edi, esp
test edi, edi
je 0x12d60fc
push ebx
mov ebx, 0x104
push ebx
push edi
push esi
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push ebx
push dword [ebp + 0xc]
push 0xffffffffffffffff
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x12d5fd8
xor eax, eax
jmp 0x12d6101
mov eax, 0x8007000e
lea esp, [ebp - 0x18]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.012d7a50
mov esp, ebp
pop ebp
ret 0x10
Function at 0x12d632a
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
cmp eax, 0xffffffff
jne 0x12d6341
mov eax, 0x8000ffff
jmp 0x12d6399
push edi
xor edi, edi
mov dword [esi], eax
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0xc], eax
cmp eax, 0xffffffff
je 0x12d6382
test eax, eax
je 0x12d6396
push edi
push eax
push edi
push 2
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [esi + 4], eax
test eax, eax
je 0x12d6382
push edi
push edi
push edi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 8], eax
test eax, eax
jne 0x12d6396
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x12d6398
movzx eax, ax
or eax, 0x80070000
jmp 0x12d6398
xor eax, eax
pop edi
pop esi
pop ebp
ret 8

Function at 0x12d71c6
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x12d8140]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x20
lea eax, [ebp - 0x44]
mov esi, 0xc04
push eax
push 8
push 0x404
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x12d7214
push 3
lea eax, [ebp - 0x44]
push 0x12c4530
push eax
call dword [sym.imp.msvcrt.dll_wcsncmp]
add esp, 0xc
neg eax
sbb eax, eax
and eax, 0xfffff800
add esi, eax
mov ecx, dword [ebp - 4]
mov ax, si
xor ecx, ebp
pop esi
call fcn.012d7a50
mov esp, ebp
pop ebp
ret

Function at 0x12d7226
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x12d8140]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
cmp ax, word [0x12d84bc]
jne 0x12d72c2
push edi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 6
push eax
push 1
xor edi, edi
push edi
push 0x12c4548
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x12d72c1
push esi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push edi
push 0x12c4600
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x12d72c1
push 3
push dword [edi*8 + 0x12c1620]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
je 0x12d72b3
inc edi
cmp edi, 0x1c
jb 0x12d7291
jmp 0x12d72c1
mov ax, word [edi*8 + 0x12c1624]
mov word [0x12d84bc], ax
pop edi
mov ecx, dword [ebp - 4]
mov ax, word [0x12d84bc]
xor ecx, ebp
call fcn.012d7a50
mov esp, ebp
pop ebp
ret
Function at 0x405a3d
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push eax
and dword [eax + 0x24], 0
mov dword [eax], 0x3c
call dword [sym.imp.shell32.dll_ShellExecuteExW]
ret 4

Function at 0x405b23
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x405b32
pop dword [ebp - 0x40]
mov eax, 0x6fc99a1f
add eax, 0x9076c113
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x87038dd3
sub dword [ebp - 0x50], 0x38b14888
mov dword [ebp - 0x4c], 0xbd142c72
add dword [ebp - 0x4c], 0x751f1fd3
mov dword [ebp - 0x48], 0x1b0a5b7d
sub dword [ebp - 0x48], 0xcebe174f
mov dword [ebp - 0x44], 0x466b263f
add dword [ebp - 0x44], 0xb994d9c1
lea eax, [ebp - 0x50]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xa726f166
add dword [ebp - 0x50], 0xcd4b77f0
mov dword [ebp - 0x4c], 0x43734a46
sub dword [ebp - 0x4c], 0x206e8d1
mov dword [ebp - 0x48], 0xabc97741
add dword [ebp - 0x48], 0xb7a5f52b
mov dword [ebp - 0x44], 0xd677e13b
sub dword [ebp - 0x44], 0xd677e13b
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0xaee22248
sub eax, 0xaea1a1cc
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x3b460
push 0
call eax
mov ecx, 0xccc2445a
sub ecx, 0xccc1eb4c
xor ebx, ebx
add ebx, eax
mov edi, 0x66b28dea
add edi, 0x99930416
add edi, dword [ebp - 0x40]
mov edx, 0x9c399b4e
mov dword [ebp - 8], 0x89429c1d
mov esi, dword [edi]
xor esi, edx
add dword [ebp - 0x38], 0x13567e6c
mov dword [ebx], esi
add dword [ebp - 0x24], 0x933e0be
add ebx, 4
add edi, 4
loop 0x405c4b
add eax, 0x7660efdc
sub eax, 0x765f98d1
xor ebx, ebx
add ebx, eax
add eax, 0xb258e181
add eax, 0x4da71e84
mov ecx, 0x400000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x405dee
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x42fa70
push esi
call fcn.00406411
push esi
call fcn.00405d91
mov edi, eax
test edi, edi
jne 0x405e0f
xor eax, eax
jmp 0x405e67
push edi
call fcn.004066c0
test byte [0x434f1c], 0x80
je 0x405e2c
mov ax, word [edi]
test ax, ax
je 0x405e0b
cmp ax, 0x5c
je 0x405e0b
sub edi, esi
sar edi, 1
jmp 0x405e46
call fcn.0040676f
test eax, eax
je 0x405e40
test byte [eax], 0x10
je 0x405e0b
push esi
call fcn.00405d32
push esi
call sub.kernel32.dll_lstrlenW
cmp eax, edi
push esi
jg 0x405e32
call fcn.00405ce6
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405ee2
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405f01
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4
Function at 0x4068f3
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43190c], 0
push esi
jne 0x40692a
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406904
mov dword [ecx*4 + 0x431908], eax
inc ecx
cmp ecx, 0x100
jl 0x4068ff
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x40695b
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x431908]
xor eax, esi
inc ecx
dec edx
jne 0x40693d
pop edi
not eax
pop esi
ret 0xc

Function at 0x40102a
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
push ebx
push esi
push edi
push str._JAVA_LAUNCHER_DEBUG
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xor ebx, ebx
pop ecx
test eax, eax
je 0x401078
push str.Windows_original_main_args:_n
call fcn.004010f9
mov edi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argc]
mov esi, ebx
pop ecx
call edi
cmp dword [eax], ebx
jle 0x401078
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argv]
mov eax, dword [eax]
push dword [eax + esi*4]
push esi
push str.wwwd_args__d____s_n
call fcn.004010f9
add esp, 0xc
inc esi
call edi
cmp esi, dword [eax]
jl 0x401058
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
call sub.jli.dll_JLI_CmdToArgs
call sub.jli.dll_JLI_GetStdArgc
mov edi, eax
lea ecx, [edi*4 + 4]
push ecx
call sub.jli.dll_JLI_MemAlloc
pop ecx
pop ecx
mov esi, eax
call sub.jli.dll_JLI_GetStdArgs
mov edx, ebx
test edi, edi
jle 0x4010b2
mov ecx, dword [eax + edx*8]
mov dword [esi + edx*4], ecx
inc edx
cmp edx, edi
jl 0x4010a7
mov ecx, dword [str.java]
mov dword [esi + edx*4], ebx
test ecx, ecx
jne 0x4010c1
mov ecx, dword [esi]
mov eax, dword [section..data]
test eax, eax
jne 0x4010cc
mov eax, dword [esi]
push ebx
push ebx
push ebx
push 1
push ecx
push eax
push 0x4021bc
push 0x4021c0
push 0x40300c
push 2
push 0x403004
push 2
push esi
push edi
call sub.jli.dll_JLI_Launch
add esp, 0x38
pop edi
pop esi
pop ebx
ret
Function at 0x4010d0
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Inject thread
Print debug messages
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x430050]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, ecx
call fcn.00407bf0
push esi
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x40110d
push 0x42c74c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x4011ee
push 0x40
push 0x1000
push 0x104
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, eax
test edi, edi
jne 0x40113a
push 0x42c760
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor esi, esi
jmp 0x4011ee
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 8]
push ecx
push 0x104
lea eax, [ebp + 8]
mov dword [ebp - 8], 0
cmovae eax, dword [ebp + 8]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x401171
push 0x42c780
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor esi, esi
jmp 0x4011ee
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x40118f
push 0x42c79c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor esi, esi
jmp 0x4011ee
push str.LoadLibraryA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x4011ae
push 0x42c7c4
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor esi, esi
jmp 0x4011ee
push 0
push 0
push edi
push eax
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov edi, eax
test edi, edi
jne 0x4011d4
push 0x42c7dc
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor esi, esi
jmp 0x4011ee
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call esi
mov esi, 1
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x40121e
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x401214
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401230
push edx
push ecx
call fcn.00409072
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00409064
mov esp, ebp
pop ebp
ret
call fcn.0040d4ef
int3