joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412ead
Capabilities:
Create process on windows
Create process suspended
Self delete

Disassembly:
push 0x78
mov eax, 0x43fac3
call fcn.0043d0b2
xor ebx, ebx
push ebx
mov dword [ebp - 0x18], ebx
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0x18]
push eax
push 0x474fd0
push 1
push ebx
push str._J7_
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, ebx
jl 0x412eec
mov ecx, dword [ebp - 0x18]
cmp ecx, ebx
je 0x412eec
call fcn.00412e79
call dword [sym.imp.ole32.dll_CoUninitialize]
push 0x44
pop esi
push esi
lea eax, [ebp - 0x84]
push ebx
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x10
lea eax, [ebp - 0x38]
push ebx
push eax
mov dword [ebp - 0x84], esi
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x22
lea edi, [ebp - 0x14]
call fcn.004064c6
lea eax, [ebp - 0x24]
push str.attrib__S__H__s
push eax
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.0041661e
mov edi, str..dat
lea ecx, [ebp - 0x20]
push edi
push ecx
mov esi, eax
mov byte [ebp - 4], 1
call fcn.0040759e
add esp, 0x10
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 3
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea eax, [ebp - 0x28]
push str.del__s
push eax
lea ecx, [ebp - 0x14]
call fcn.0041661e
lea ecx, [ebp - 0x1c]
push edi
push ecx
mov esi, eax
mov byte [ebp - 4], 4
call fcn.0040759e
add esp, 0x10
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 6
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x84]
push eax
push ebx
push ebx
mov edi, 0x8000000
push edi
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x20]
call dword [sym.imp.mfc90u.dll_ATL::CSimpleStringT_wchar_t_1_::GetBuffer]
mov esi, dword [sym.imp.KERNEL32.dll_CreateProcessW]
push eax
push ebx
call esi
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x84]
push eax
push ebx
push ebx
push edi
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x1c]
call dword [sym.imp.mfc90u.dll_ATL::CSimpleStringT_wchar_t_1_::GetBuffer]
push eax
push ebx
call esi
mov esi, dword [ebp + 8]
push ecx
lea eax, [ebp - 0x14]
mov ecx, esp
mov dword [ebp + 8], esp
push eax
mov byte [esi + 0xde4], bl
call dword [0x474b9c]
mov ecx, esi
call fcn.00415bb7
lea ecx, [ebp - 0x1c]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ecx, [ebp - 0x20]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
xor eax, eax
inc eax
call fcn.0043d18a
ret 4
Function at 0x41301b
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0x10]
and dword [ebp - 4], 0
lea edx, [ebp - 4]
push edx
push 0xf003f
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x413055
push dword [esi + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret
Function at 0x413db8
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x4e24]
mov eax, 0x4e24
call fcn.0043d080
push 0xffffffffffffffff
push 0x43dac3
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x4a3028]
xor eax, ebp
mov dword [ebp + 0x4e20], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], ebx
call dword [0x474bb4]
mov esi, 0x2710
push esi
lea eax, [ebp]
push ebx
push eax
mov byte [ebp - 4], 1
call sub.MSVCR90.dll_memset
add esp, 0xc
lea eax, [ebp + 0x4e2c]
push eax
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::operator_2]
push ebx
push 0x80
push 3
push ebx
push 3
push 0x40000000
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x10], eax
cmp eax, 0xffffffff
jne 0x413e87
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ecx, [ebp + 0x4e2c]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x4e20]
xor ecx, ebp
call fcn.0043c4b0
add ebp, 0x4e24
leave
ret 4
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push ebx
push ebx
push 0x40
push dword [ebp - 0x10]
mov edi, eax
sub edi, 0x40
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp edi, ebx
jbe 0x413ecd
lea eax, [ebp - 0x18]
push ebx
push eax
lea eax, [ebp]
cmp edi, esi
jbe 0x413ec2
push esi
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub edi, esi
jne 0x413ea5
jmp 0x413ecd
push edi
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
inc ebx
jmp 0x413e4b
Function at 0x418d59
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea eax, [ebp - 0x10]
push eax
push str.SeShutdownPrivilege
xor esi, esi
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push esi
push esi
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push SysReAllocString
push 4
call dword [sym.imp.USER32.dll_ExitWindowsEx]
pop esi
leave
ret

Function at 0x418e61
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x418e83
xor al, al
jmp 0x418edd
lea eax, [ebp - 0xc]
push eax
push str.SeShutdownPrivilege
xor esi, esi
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x418e7f
mov eax, dword [ebp - 0xc]
push esi
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
push esi
push esi
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x418e7f
push 0x10
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
setne al
pop esi
leave
ret
Function at 0x422c5c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x444415
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
mov eax, dword [0x4a3028]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
push 1
push 0x6e
push 9
push 0x10
lea ebx, [edi + 0xef8]
push 0x10
mov ecx, ebx
call sub.mfc90u.dll_CImageList::Create
xor eax, eax
mov esi, vtable.CBitmap.0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], esi
mov dword [esp + 0x38], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], esi
push 0x13e2
lea eax, [esp + 0x10]
push eax
mov byte [esp + 0x40], 3
call fcn.0040bad5
push ebx
lea eax, [esp + 0x10]
call fcn.0042447d
push dword [edi + 0xefc]
call sub.mfc90u.dll_AfxGetModuleState
mov eax, dword [eax + 0x94]
mov ecx, dword [eax]
call fcn.004242d1
push 0x13e3
lea eax, [esp + 0x28]
push eax
call fcn.0040bad5
push 0x24
push ebx
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x14]
call fcn.0042429c
push ebx
lea eax, [esp + 0x28]
call fcn.0042447d
push dword [edi + 0xefc]
call sub.mfc90u.dll_AfxGetModuleState
mov eax, dword [eax + 0x94]
mov ecx, dword [eax]
call fcn.004242d1
push 0x13e5
lea eax, [esp + 0x20]
push eax
call fcn.0040bad5
push 0xf
push ebx
lea eax, [esp + 0x24]
lea ecx, [esp + 0x14]
call fcn.0042429c
push ebx
lea eax, [esp + 0x20]
call fcn.0042447d
push dword [edi + 0xefc]
call sub.mfc90u.dll_AfxGetModuleState
mov eax, dword [eax + 0x94]
mov ecx, dword [eax]
call fcn.004242d1
push 0x13e7
lea eax, [esp + 0x18]
push eax
call fcn.0040bad5
push 0x25
push ebx
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x14]
call fcn.0042429c
push ebx
lea eax, [esp + 0x18]
call fcn.0042447d
push dword [edi + 0xefc]
call sub.mfc90u.dll_AfxGetModuleState
mov eax, dword [eax + 0x94]
mov ecx, dword [eax]
call fcn.004242d1
mov byte [esp + 0x38], 2
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], esi
call fcn.0040bb1e
mov byte [esp + 0x38], 1
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], esi
call fcn.0040bb1e
mov byte [esp + 0x38], 0
lea ecx, [esp + 0x24]
mov dword [esp + 0x24], esi
call fcn.0040bb1e
or dword [esp + 0x38], 0xffffffff
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], esi
call fcn.0040bb1e
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x431b1c
Capabilities:
Delete internet cache
Enumerate internet cache

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov eax, 0x1000
push edi
push eax
mov dword [ebp - 4], eax
call sub.mfc90u.dll_new__
mov edi, dword [sym.imp.WININET.dll_FindFirstUrlCacheEntryW]
mov esi, eax
mov eax, dword [ebp - 4]
pop ecx
mov dword [esi], eax
lea eax, [ebp - 4]
push eax
push esi
xor ebx, ebx
push ebx
call edi
mov dword [ebp - 8], eax
cmp eax, ebx
jne 0x431b89
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x431b6a
push ebx
call dword [sym.imp.WININET.dll_FindCloseUrlCache]
xor al, al
pop edi
pop esi
pop ebx
leave
ret
push dword [ebp - 4]
call sub.mfc90u.dll_new__
mov esi, eax
mov eax, dword [ebp - 4]
pop ecx
mov dword [esi], eax
lea eax, [ebp - 4]
push eax
push esi
push ebx
call edi
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x431b63
mov edi, 0x100000
test dword [esi + 0xc], edi
jne 0x431b9c
push dword [esi + 4]
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryW]
mov ebx, dword [sym.imp.WININET.dll_FindNextUrlCacheEntryW]
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp - 8]
call ebx
test eax, eax
jne 0x431bd9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x431be9
push dword [ebp - 4]
call sub.mfc90u.dll_new__
mov esi, eax
mov eax, dword [ebp - 4]
pop ecx
mov dword [esi], eax
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp - 8]
call ebx
test eax, eax
je 0x431bf4
test dword [esi + 0xc], edi
jne 0x431ba2
push dword [esi + 4]
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryW]
jmp 0x431ba2
cmp eax, 0x103
jne 0x431bf4
mov bl, 1
jmp 0x431bf6
xor bl, bl
push dword [ebp - 8]
call dword [sym.imp.WININET.dll_FindCloseUrlCache]
mov al, bl
jmp 0x431b65
Function at 0x431c06
Capabilities:
Enumerate browser history

Disassembly:
push 0x48
mov eax, 0x441e62
call fcn.0043d0b2
lea ecx, [ebp - 0x14]
call dword [0x474bb4]
lea eax, [ebp - 0x20]
push eax
push 0x474fd0
push 1
xor ebx, ebx
push ebx
push str._J7_
mov dword [ebp - 4], ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jge 0x431c4c
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
xor al, al
call fcn.0043d18a
ret
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
lea edx, [ebp - 0x18]
push edx
push eax
call dword [ecx + 0x1c]
test eax, eax
jge 0x431c6a
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov al, bl
jmp 0x431c46
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
lea edx, [ebp - 0x1c]
push edx
lea edx, [ebp - 0x54]
push edx
push 1
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x431d39
mov esi, 0x479624
cmp dword [ebp - 0x1c], ebx
je 0x431d1e
push dword [ebp - 0x50]
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::operator_1]
push str.about:Home
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CompareNoCase]
test eax, eax
je 0x431d1e
push ebx
push str..vbd
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::Find_1]
cmp eax, ebx
jge 0x431d1e
fldz
sub esp, 0xc
fstp qword [esp + 4]
mov ecx, esp
mov dword [ebp - 0x24], esp
push esi
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_class]
push ebx
push ebx
push ecx
mov byte [ebp - 4], 1
mov ecx, esp
mov dword [ebp - 0x28], esp
push esi
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_class]
push dword [ebp + 8]
lea eax, [ebp - 0x14]
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x2c], esp
push eax
mov byte [ebp - 4], 2
call dword [0x474b9c]
push 0x4a4588
mov byte [ebp - 4], bl
call fcn.0040491f
push 1
push dword [ebp - 0x14]
call dword [0x4a4870]
pop ecx
pop ecx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
lea edx, [ebp - 0x1c]
push edx
lea edx, [ebp - 0x54]
push edx
push 1
push eax
call dword [ecx + 0xc]
test eax, eax
je 0x431c8a
mov bl, 1
jmp 0x431c5d
Function at 0x435397
Capabilities:
Gather firefox profile information

Disassembly:
push 0x34
mov eax, 0x4439b8
call fcn.0043d0b2
lea ecx, [ebp - 0x20]
call dword [0x474bb4]
and dword [ebp - 4], 0
push dword [0x4a46d0]
mov esi, dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::Format]
lea eax, [ebp - 0x20]
push str._sMozillaFireFoxProfiles
push eax
call esi
add esp, 0xc
lea ecx, [ebp - 0x40]
call sub.mfc90u.dll_CFileFind::CFileFind
push 0
mov byte [ebp - 4], 1
push dword [ebp - 0x20]
lea ecx, [ebp - 0x40]
call sub.mfc90u.dll_CFileFind::FindFile
test eax, eax
je 0x43551e
lea ecx, [ebp - 0x40]
call sub.mfc90u.dll_CFileFind::FindNextFileW
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x40]
call sub.mfc90u.dll_CFileFind::GetFileName
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x40]
push 0x10
lea ecx, [ebp - 0x40]
call dword [eax + 0x40]
test eax, eax
je 0x435507
lea ecx, [ebp - 0x40]
call sub.mfc90u.dll_CFileFind::IsDots
test eax, eax
jne 0x435507
lea ecx, [ebp - 0x18]
call dword [0x474bb4]
mov byte [ebp - 4], 3
push dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
push dword [0x4a46d0]
push str._sMozillaFireFoxProfiles_scookies.txt
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x18]
mov ecx, esp
mov dword [ebp - 0x28], esp
push eax
call dword [0x474b9c]
call fcn.004065f6
cmp eax, 2
jne 0x435482
push 0x36
push ecx
lea eax, [ebp - 0x18]
mov ecx, esp
mov dword [ebp - 0x28], esp
push eax
call dword [0x474b9c]
mov edi, 0x4a4588
call fcn.00404dc8
lea ecx, [ebp - 0x14]
call dword [0x474bb4]
mov byte [ebp - 4], 4
push dword [ebp - 0x1c]
lea eax, [ebp - 0x14]
push dword [0x4a46d0]
push str._sMozillaFireFoxProfiles_scookies.sqlite
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x14]
mov ecx, esp
mov dword [ebp - 0x28], esp
push eax
call dword [0x474b9c]
call fcn.00405015
test al, al
je 0x4354f5
lea eax, [ebp - 0x14]
push eax
mov eax, dword [0x4a46ac]
mov eax, dword [eax + 0x14c4]
mov ecx, dword [eax + 0x19c]
add ecx, 0xdd0
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::operator_2]
push ecx
lea eax, [ebp - 0x14]
mov ecx, esp
mov dword [ebp - 0x28], esp
push eax
call dword [0x474b9c]
call fcn.00434f74
pop ecx
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
cmp dword [ebp - 0x24], 0
jne 0x4353eb
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0
call fcn.0043bc98
lea ecx, [ebp - 0x20]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
xor eax, eax
inc eax
call fcn.0043d18a
ret
Function at 0x43c4b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4a3028]
jne 0x43c4ba
repz ret
jmp fcn.0043ca5e
Function at 0x4013c5
Capabilities:
Encode data using xor

Disassembly:
jmp 0x4159d0
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x415b7a
push ebx
mov ebx, dword [esp + 0x10]
nop word [eax + eax]
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x52
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0xc9
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
xor byte [esi + ebx], 3
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0xe6
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0xa6
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
add esp, 0x44
push eax
call fcn.0040616d
add byte [esi + ebx], 0x9f
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 7
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0xee
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x47
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x17
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x45
add esp, 0x40
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0xb5
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
xor byte [esi + ebx], 0xf6
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x87
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x26
add esp, 0x30
inc esi
cmp esi, edi
jb 0x4159f0
pop ebx
pop edi
pop esi
ret

Function at 0x4035f3
Capabilities:
Terminate process

Disassembly:
jmp 0x453df9
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x453e0a
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405948
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x40371f
Capabilities:
Query environment variable

Disassembly:
jmp 0x49c842
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x49c853
pop esi
ret
push ebx
push edi
push esi
call fcn.0049c729
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403fe4
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x49c87b
push ebx
push esi
push edi
call fcn.0040572c
add esp, 0xc
push 0
call fcn.004062b2
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x4063b0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x42ac7b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
lea ecx, [esi + 4]
mov dword [esi], 0x404674
call fcn.00407011
push 4
mov dword [esp + 0x18], 0
call fcn.00407fa0
mov edi, eax
add esp, 4
test edi, edi
je 0x406424
push ebx
call fcn.00406ee9
mov dword [edi], eax
call fcn.00406ca8
push 0
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.00406fd2
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x406418
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0xc]
call fcn.00406ffa
pop ebx
jmp 0x406426
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x408a11
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42edd0]
jne 0x408a1b
repz ret
jmp fcn.0040de7c
Function at 0x413059
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42edd0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040ac4d
and dword [ebp - 0x14], 0
cmp dword [0x4313d4], 0
mov dword [ebp - 0x18], eax
jne 0x41310c
push 0x4040a0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4131b4
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x404094
push ebx
call edi
test eax, eax
je 0x4131b4
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x404084
push ebx
mov dword [0x4313d4], eax
call edi
push eax
call esi
push 0x404070
push ebx
mov dword [0x4313d8], eax
call edi
push eax
call esi
push 0x404054
push ebx
mov dword [0x4313dc], eax
call edi
push eax
call esi
mov dword [0x4313e4], eax
test eax, eax
je 0x41310c
push 0x40403c
push ebx
call edi
push eax
call esi
mov dword [0x4313e0], eax
mov eax, dword [0x4313e0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x413165
cmp dword [0x4313e4], ecx
je 0x413165
push eax
call esi
push dword [0x4313e4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x413165
test ebx, ebx
je 0x413165
call edi
test eax, eax
je 0x41315c
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41315c
test byte [ebp - 8], 1
jne 0x413165
or dword [ebp + 0x10], 0x200000
jmp 0x413198
mov eax, dword [0x4313d8]
cmp eax, dword [ebp - 0x18]
je 0x413198
push eax
call esi
test eax, eax
je 0x413198
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x413198
mov eax, dword [0x4313dc]
cmp eax, dword [ebp - 0x18]
je 0x413198
push eax
call esi
test eax, eax
je 0x413198
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4313d4]
call esi
test eax, eax
je 0x4131b4
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4131b6
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408a11
leave
ret