joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100062a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], 0
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x1001a944], eax
je 0x100062c4
mov eax, 0x10dd
jmp 0x1000646c
cmp dword [0x1001a948], 0
je 0x100062d7
mov eax, dword [0x1001a948]
jmp 0x1000646c
cmp dword [ebp + 0xc], 0
jne 0x100062e7
mov eax, 0x57
jmp 0x1000646c
cmp dword [ebp + 8], 0
jne 0x100062f7
mov eax, 6
jmp 0x1000646c
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x10006320
mov dword [ebp - 8], 6
mov ecx, dword [ebp - 8]
mov dword [0x1001a948], ecx
mov edx, dword [ebp + 8]
mov dword [0x1001a94c], edx
mov eax, dword [ebp - 8]
jmp 0x1000646c
push 0x18
call fcn.10007910
add esp, 4
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000637b
mov dword [ebp - 8], 8
mov ecx, dword [ebp - 8]
mov dword [0x1001a948], ecx
cmp dword [ebp - 4], 0
je 0x1000636a
mov edx, dword [ebp - 4]
mov dword [ebp - 0x20], edx
push 0x18
mov eax, dword [ebp - 0x20]
push eax
call fcn.10007940
add esp, 8
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
mov dword [0x1001a94c], ecx
mov eax, dword [ebp - 8]
jmp 0x1000646c
push 0
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call fcn.10006280
mov dword [ebp - 0x10], eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.10006280
mov dword [ebp + 0xc], eax
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + 0x36]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x40]
sub edx, dword [ebp - 0xc]
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0xc], 0
je 0x100063bb
cmp dword [ebp - 0xc], 0x1e
jbe 0x100063d7
mov dword [ebp - 8], 9
cmp dword [0x1001a93c], 0
je 0x100063d2
jmp 0x10006349
jmp 0x10006340
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x44]
cmp ecx, dword [ebp + 0xc]
je 0x100063fe
mov dword [ebp - 8], 9
cmp dword [0x1001a93c], 0
je 0x100063f9
jmp 0x10006349
jmp 0x10006340
mov dword [ebp - 0x18], 0
lea edx, [ebp - 0x18]
push edx
push 0x40
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x10006429
call sub.KERNEL32.dll_GetLastError
mov dword [ebp - 8], eax
jmp 0x10006340
mov edx, dword [ebp - 4]
mov dword [edx + 4], 1
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov dword [edx + 0x10], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
mov dword [eax + 0x14], ecx
mov edx, dword [ebp - 4]
mov eax, dword [0x1001a954]
mov dword [edx], eax
mov ecx, dword [ebp - 4]
mov dword [0x1001a954], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x10006480
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x1001a944], eax
je 0x1000649d
mov eax, 0x10dd
jmp 0x10006580
mov eax, dword [0x1001a954]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000651c
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call sub.KERNEL32.dll_VirtualProtect
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x100064f8
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x100064f8
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.10005350
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
push 0x18
mov edx, dword [ebp - 0xc]
push edx
call fcn.10007940
add esp, 8
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x100064a5
mov dword [0x1001a954], 0
call fcn.10005c30
mov ecx, dword [0x1001a950]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x1000656a
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call sub.KERNEL32.dll_ResumeThread
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
push 8
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.10007940
add esp, 8
mov edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
jmp 0x10006534
mov dword [0x1001a950], 0
mov dword [0x1001a944], 0
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10006a60
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x1001a948], 0
je 0x10006a79
mov eax, dword [0x1001a948]
jmp 0x10006b18
call sub.KERNEL32.dll_GetCurrentThread
cmp dword [ebp + 8], eax
jne 0x10006a8a
xor eax, eax
jmp 0x10006b18
push 8
call fcn.10007910
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10006ae2
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x10006acb
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
push 8
mov edx, dword [ebp - 0x10]
push edx
call fcn.10007940
add esp, 8
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x1001a948], eax
mov dword [0x1001a94c], 0
mov eax, dword [ebp - 8]
jmp 0x10006b18
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.dll_SuspendThread
cmp eax, 0xffffffff
jne 0x10006afa
call sub.KERNEL32.dll_GetLastError
mov dword [ebp - 8], eax
jmp 0x10006aaa
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x1001a950]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x1001a950], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x402a4e
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x413371
call fcn.00411bd0
sub esp, 0x824
and word [ebp - 0x830], 0
push esi
mov esi, ecx
push edi
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x82e]
mov edx, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esi + 0x68]
mov dword [ebp - 0x10], edx
mov ecx, dword [eax + 0x54]
test ecx, ecx
je 0x402a91
mov dword [ebp - 0x10], ecx
mov eax, dword [eax + 0x74]
mov edi, edx
test eax, eax
je 0x402a9c
mov edi, eax
push dword [0x41d240]
lea eax, [ebp - 0x30]
push dword [0x41d1cc]
push eax
call fcn.0040677c
and dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00405f91
mov eax, dword [eax + 4]
add esp, 0x14
test eax, eax
jne 0x402ace
mov eax, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
push dword [ebp - 0x10]
push edi
push eax
lea eax, [ebp - 0x830]
push eax
call dword [sym.imp.MSVCRT.dll_swprintf]
add esp, 0x10
lea ecx, [ebp - 0x20]
push 1
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Tidy_bool_]
or dword [ebp - 4], 0xffffffff
push 1
lea ecx, [ebp - 0x30]
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov eax, 0x41ec74
push 5
push eax
push eax
lea eax, [ebp - 0x830]
push eax
push 0x41d074
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 2
push dword [esi + 4]
call dword [sym.imp.USER32.dll_EndDialog]
mov ecx, dword [ebp - 0xc]
push 1
pop eax
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 0x10
Function at 0x405840
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
mov eax, dword [eax + 4]
test eax, eax
jne 0x405850
mov eax, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
push esi
push 0x41dce0
push eax
call dword [sym.imp.MSVCRT.dll__wfopen]
mov esi, eax
pop ecx
test esi, esi
pop ecx
je 0x4058a4
mov eax, dword [esp + 0xc]
mov eax, dword [eax + 4]
test eax, eax
jne 0x405875
mov eax, 0x4155b4
mov ecx, dword [esp + 0x10]
push esi
push 1
add eax, ecx
push dword [esp + 0x1c]
push eax
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
cmp eax, 1
push esi
je 0x40589d
call dword [sym.imp.MSVCRT.dll_fclose]
pop ecx
xor eax, eax
jmp 0x4058a7
call dword [sym.imp.MSVCRT.dll_fclose]
pop ecx
push 1
pop eax
pop esi
ret 0x10

Function at 0x406960
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
push 9
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x26]
push dword [ebp + 0x10]
mov word [ebp - 0x28], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x28]
push 0x41dd60
push eax
call dword [sym.imp.MSVCRT.dll_swprintf]
add esp, 0xc
lea eax, [ebp - 0x28]
push dword [ebp + 0xc]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, ebx
je 0x4069ed
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
je 0x4069ed
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
cmp edi, ebx
je 0x4069ed
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
cmp esi, ebx
je 0x4069ed
push dword [0x4155b0]
mov ecx, dword [ebp + 0x14]
push ebx
call fcn.004045ce
mov ecx, dword [ebp + 0x14]
push esi
push edi
call fcn.004048fb
push 1
pop ebx
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret
Function at 0x408b9e
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x413e20
call fcn.00411bd0
sub esp, 0x14
mov al, byte [ebp - 0xd]
push ebx
push esi
mov esi, ecx
push 0
lea ecx, [ebp - 0x20]
mov bl, 1
mov byte [ebp - 0x20], al
call fcn.00403595
and dword [ebp - 4], 0
lea eax, [ebp - 0x20]
push eax
push 0x3fc
mov ecx, esi
call fcn.00408966
mov ecx, esi
call fcn.00408479
mov esi, eax
test esi, esi
je 0x408c2c
mov edx, dword [ebp - 0x1c]
mov eax, 0x4155b4
test edx, edx
mov ecx, eax
je 0x408bf2
mov ecx, edx
mov ecx, dword [ecx]
cmp ecx, dword [str.0S_]
jne 0x408c22
test edx, edx
je 0x408c02
mov eax, edx
mov ecx, dword [ebp - 0x18]
push esi
add ecx, 0xfffffffc
push 1
add eax, 4
push ecx
push eax
call dword [sym.imp.MSVCRT.dll_fwrite]
mov ebx, eax
add esp, 0x10
dec ebx
neg ebx
sbb bl, bl
inc bl
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
pop ecx
jmp 0x408c2e
xor bl, bl
or dword [ebp - 4], 0xffffffff
push 1
lea ecx, [ebp - 0x20]
call fcn.00403595
mov ecx, dword [ebp - 0xc]
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x408c4c
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x413e34
call fcn.00411bd0
sub esp, 0x14
mov al, byte [ebp - 0xd]
push ebx
push esi
mov esi, ecx
xor ebx, ebx
lea ecx, [ebp - 0x20]
push ebx
mov byte [ebp - 0x20], al
call fcn.00403595
lea eax, [ebp - 0x20]
mov ecx, esi
push eax
push 0x401
mov dword [ebp - 4], ebx
call fcn.00408966
mov ecx, esi
call fcn.0040888c
mov esi, eax
cmp esi, ebx
je 0x408cba
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
jne 0x408c9a
mov eax, 0x4155b4
push esi
push 1
push dword [ebp - 0x18]
push eax
call dword [sym.imp.MSVCRT.dll_fwrite]
mov ebx, eax
push esi
dec ebx
neg ebx
sbb bl, bl
inc bl
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
or dword [ebp - 4], 0xffffffff
push 1
lea ecx, [ebp - 0x20]
call fcn.00403595
mov ecx, dword [ebp - 0xc]
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40a4f0
Capabilities:
Delete file

Disassembly:
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll__waccess]
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x40a543
mov eax, dword [esi + 0x34]
test eax, eax
jne 0x40a50d
mov eax, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
push 0
push eax
call ebx
pop ecx
test eax, eax
pop ecx
jne 0x40a543
xor edi, edi
mov eax, dword [esi + 0x34]
test eax, eax
jne 0x40a526
mov eax, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
push eax
call dword [sym.imp.MSVCRT.dll__wremove]
test eax, eax
pop ecx
je 0x40a543
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0x3e8
jl 0x40a51a
cmp dword [esi + 0x48], 0
je 0x40a58b
mov eax, dword [esi + 0x44]
test eax, eax
jne 0x40a555
mov eax, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
push 0
push eax
call ebx
pop ecx
test eax, eax
pop ecx
jne 0x40a58b
xor edi, edi
mov eax, dword [esi + 0x44]
test eax, eax
jne 0x40a56e
mov eax, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
push eax
call dword [sym.imp.MSVCRT.dll__wremove]
test eax, eax
pop ecx
je 0x40a58b
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0x3e8
jl 0x40a562
pop edi
pop esi
pop ebx
ret
Function at 0x410eec
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.00411f90
push esi
mov edx, 0x1ff
push edi
xor esi, esi
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x100e]
mov word [ebp - 0x1010], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x80e]
mov word [ebp - 0x810], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, 0x800
lea eax, [ebp - 0x1010]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x810]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xor eax, eax
lea edi, [ebp - 0xe]
mov word [ebp - 0x10], si
push 0xe
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push esi
push eax
call sub.MSVCRT.dll_memset
push esi
push esi
lea eax, [ebp - 0x10]
push esi
push eax
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.MSVCRT.dll__wsplitpath]
lea eax, [ebp - 0x10]
push 0x41d13c
push eax
call dword [sym.imp.MSVCRT.dll_wcscat]
lea eax, [ebp - 0x1010]
push esi
push eax
call fcn.00413053
add esp, 0x30
test al, al
jne 0x410fc3
lea eax, [ebp - 0x810]
push esi
push eax
call fcn.00413053
pop ecx
test al, al
pop ecx
jne 0x410fc3
lea eax, [ebp - 0x10]
push esi
push eax
call fcn.00413053
pop ecx
test al, al
pop ecx
jne 0x410fc3
inc al
jmp 0x410fc5
xor al, al
pop edi
pop esi
leave
ret
Function at 0x412be6
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.00411f90
push ebx
push edi
call fcn.00412a97
mov edx, dword [0x41ee9c]
mov ebx, eax
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x1008]
mov dword [ebp - 0x100c], edx
rep stosd dword es:[edi], eax
mov ecx, 0x1ff
lea edi, [ebp - 0x808]
mov dword [ebp - 0x80c], edx
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
rep stosd dword es:[edi], eax
mov eax, 0x400
lea ecx, [ebp - 0x80c]
push eax
push ecx
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 4]
push ecx
push eax
lea eax, [ebp - 0x100c]
push eax
push 0x41ec30
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
push dword [ebp + 8]
push ebx
push dword [ebp - 4]
call fcn.00412b76
add esp, 0xc
mov al, 1
pop edi
pop ebx
leave
ret

Function at 0x412c74
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
mov eax, 0x414780
call fcn.00411bd0
sub esp, 0x20
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x10], esp
push dword [ebp + 8]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
push esi
push 0x43a
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, esi
mov dword [ebp + 8], eax
jne 0x412cb9
lea eax, [ebp - 0x1c]
push 0x41a220
push eax
mov dword [ebp - 0x1c], esi
call sub.MSVCRT.dll__CxxThrowException
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
push 4
push 0x1000
lea edi, [eax + eax]
push edi
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ebx, eax
cmp ebx, esi
mov dword [ebp - 0x14], ebx
jne 0x412cf2
lea eax, [ebp - 0x20]
push 0x41a220
push eax
mov dword [ebp - 0x20], esi
call sub.MSVCRT.dll__CxxThrowException
push esi
push edi
push dword [ebp + 0xc]
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x412d16
lea eax, [ebp - 0x24]
push 0x41a220
push eax
mov dword [ebp - 0x24], esi
call sub.MSVCRT.dll__CxxThrowException
push str.LoadLibraryW
push str.Kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, esi
jne 0x412d42
lea eax, [ebp - 0x28]
push 0x41a220
push eax
mov dword [ebp - 0x28], esi
call sub.MSVCRT.dll__CxxThrowException
push esi
push esi
push ebx
push eax
push esi
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
cmp eax, esi
jne 0x412d93
lea eax, [ebp - 0x2c]
push 0x41a220
push eax
mov dword [ebp - 0x2c], esi
call sub.MSVCRT.dll__CxxThrowException
xor esi, esi
cmp dword [ebp - 0x14], esi
je 0x412d7f
push 0x8000
push esi
push dword [ebp - 0x14]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
cmp dword [ebp + 8], esi
je 0x412d8d
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x412da3
ret
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x18], 1
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 8
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x43b641
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x43b3c1
add eax, edx
sub edx, 0xac986c20
mov edx, 0x51decc3f
call fcn.0043b68a
mov eax, 0x96f31dc7
sub eax, eax
xor dword [ebx], edi
or edx, eax
sub eax, eax
add eax, 0x57014baf
add ebx, 1
sub edx, eax
cmp ebx, ecx
jne fcn.0043b641
mov eax, eax
sub edx, eax
sub edx, 0xf8367c26
ret
Function at 0x4050c0
Capabilities:
Delete file
Enumerate gui resources

Disassembly:
mov eax, 0x1854
call fcn.00416820
mov eax, dword [0x70c7ec]
mov ecx, dword [0x7096f4]
push ebx
push ebp
shr eax, 3
push esi
push edi
test eax, eax
jbe 0x405235
mov edi, dword [sym.imp.KERNEL32.dll_SetConsoleMode]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateActCtxW]
mov ebp, dword [sym.imp.KERNEL32.dll_DnsHostnameToComputerNameA]
mov esi, dword [sym.imp.KERNEL32.dll_GetCommState]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
cmp dword [0x70c7ec], 0x959
jne 0x40521b
push 0
push 0
call edi
lea eax, [esp + 0x40]
push eax
call ebx
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0xc64]
push edx
push 0
call ebp
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionW]
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x464]
push ecx
push 0
push 0x403724
push 0x403760
push 0x4037a0
call dword [sym.imp.KERNEL32.dll_SearchPathW]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExW]
lea edx, [esp + 0x24]
push edx
push 0
call esi
push 0
push 0
push 0
lea eax, [esp + 0x106c]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
push 0
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0
lea ecx, [esp + 0x64]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
call dword [sym.imp.KERNEL32.dll_DebugBreak]
push 0
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriorityBoost]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleA]
push 0
push 0x4037c0
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
push 0
push 0x403820
call dword [sym.imp.KERNEL32.dll_IsBadStringPtrA]
push 0
push 0x403824
push 0x403830
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
push 0x403858
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov edx, dword [esp + 0x14]
push edx
call fcn.00404ef0
add dword [esp + 0x14], 8
sub dword [esp + 0x18], 1
jne 0x405104
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1854
ret