joyce8/EMBER2024-capa huggingface dataset:
Function at 0x467fa0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
xor dl, dl
mov ecx, dword [esp + 0x14]
push ebx
mov ebx, dword [esp + 0x10]
mov dword [esp + 8], eax
push ebp
push esi
push edi
test bl, 3
jne 0x4680d1
test al, 3
jne 0x4680d1
mov edi, ecx
mov dword [esp + 0x10], 0
shr edi, 2
xor esi, esi
test edi, edi
je 0x46808c
cmp edi, 8
jb 0x468055
mov ebp, dword [esp + 0x20]
mov edx, edi
mov dword [esp + 0x14], ebx
and edx, 0xfffffff8
add eax, 0x10
xorps xmm3, xmm3
sub dword [esp + 0x14], ebp
xorps xmm2, xmm2
mov ebp, dword [esp + 0x14]
movups xmm0, xmmword [eax - 0x10]
lea eax, [eax + 0x20]
movups xmm1, xmmword [ebx + esi*4]
add esi, 8
pxor xmm1, xmm0
por xmm3, xmm1
movups xmm1, xmmword [eax + ebp - 0x20]
movups xmm0, xmmword [eax - 0x20]
pxor xmm1, xmm0
por xmm2, xmm1
cmp esi, edx
jb 0x468004
mov eax, dword [esp + 0x20]
por xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd dword [esp + 0x10], xmm2
cmp esi, edi
jae 0x468090
mov ebp, ebx
lea edx, [eax + esi*4]
sub ebp, eax
mov dword [esp + 0x14], ebp
mov ebp, edi
mov ebx, dword [esp + 0x14]
sub ebp, esi
mov esi, edi
mov edi, dword [esp + 0x10]
mov eax, dword [edx + ebx]
lea edx, [edx + 4]
xor eax, dword [edx - 4]
or edi, eax
sub ebp, 1
jne 0x468072
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x10], edi
jmp 0x468094
xor edi, edi
jmp 0x468094
mov edi, dword [esp + 0x10]
shl esi, 2
sub ecx, esi
jne 0x4680a8
test edi, edi
pop edi
pop esi
pop ebp
sete al
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x10]
add ebx, esi
mov ebp, dword [esp + 0x20]
mov edx, eax
shr eax, 0x10
add ebp, esi
shr edx, 0x18
or dl, al
mov dword [esp + 0x14], ebp
mov eax, dword [esp + 0x10]
shr eax, 8
or dl, al
mov eax, ebp
or dl, byte [esp + 0x10]
xor edi, edi
test ecx, ecx
je 0x468190
cmp ecx, 0x20
jb 0x46816a
mov esi, ecx
xorps xmm3, xmm3
and esi, 0xffffffe0
xorps xmm2, xmm2
mov dword [esp + 0x1c], esi
mov esi, ebx
sub esi, dword [esp + 0x14]
mov dword [esp + 0x10], esi
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x10]
movups xmm0, xmmword [eax]
lea eax, [eax + 0x20]
movups xmm1, xmmword [eax + ebp - 0x20]
pxor xmm1, xmm0
movups xmm0, xmmword [eax - 0x10]
por xmm3, xmm1
movups xmm1, xmmword [ebx + edi + 0x10]
add edi, 0x20
pxor xmm1, xmm0
por xmm2, xmm1
cmp edi, esi
jb 0x468105
por xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 2
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 1
por xmm2, xmm0
movd eax, xmm2
or dl, al
mov ebp, dword [esp + 0x14]
cmp edi, ecx
jae 0x468190
sub ebx, ebp
lea esi, [edi + ebp]
sub ecx, edi
nop dword [eax]
mov al, byte [ebx + esi]
lea esi, [esi + 1]
xor al, byte [esi - 1]
or dl, al
sub ecx, 1
jne 0x468180
pop edi
pop esi
test dl, dl
pop ebp
sete al
pop ebx
add esp, 8
ret
Function at 0x46b640
Capabilities:
Hash data using murmur3
Resolve function by parsing pe exports

Disassembly:
cmp byte [0x5283a4], 0
jne 0x46b64e
call fcn.00473860
cmp byte [0x5283ad], 0
je 0x46b66c
push 0
push 0x40
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.00474540
add esp, 0x10
ret
jmp fcn.00469980
Function at 0x48cb70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dfcd0
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x51f164]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, ebx
cmp dword [ebx + 0x14], 8
jb 0x48cbb1
mov eax, dword [ebx]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
mov dword [ebp - 0x38], esi
cmp esi, 0xffffffff
jne 0x48cbd4
push dword [ebp - 0x2c]
push ebx
push edi
call fcn.0048ca40
add esp, 0xc
jmp 0x48ccf0
push esi
push ebx
call fcn.0048c940
add esp, 8
mov ecx, eax
mov dword [ebp - 0x30], ecx
test esi, 0x400
je 0x48ccb5
cmp dword [ebx + 0x14], 8
mov edx, ebx
jb 0x48cbf9
mov edx, dword [ebx]
mov ecx, edx
mov dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x48cc12
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.00436c20
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push 0x2000000
push 3
push 0
push 7
push 0
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x34], esi
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.004049c0
cmp esi, 0xffffffff
jne 0x48cc78
push dword [ebp - 0x2c]
push ebx
push edi
call fcn.0048ca40
add esp, 0xc
jmp 0x48ccf0
push ebx
call fcn.0048c860
add esp, 4
test al, al
jne 0x48cca1
mov eax, dword [ebp - 0x30]
mov dword [edi], 9
mov dword [edi + 4], eax
push esi
mov dword [ebp - 4], 4
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x48ccf0
push esi
mov dword [ebp - 4], 5
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x48cccd
mov dword [eax], 0
mov byte [eax + 4], 0
mov dword [eax + 8], 0x5055a0
and esi, 0x10
je 0x48ccd7
mov edx, dword [ebp - 0x34]
jmp 0x48ccdc
mov edx, ecx
mov ecx, dword [ebp - 0x34]
xor eax, eax
test esi, esi
setne al
add eax, 2
test esi, esi
mov dword [edi], eax
cmove ecx, edx
mov dword [edi + 4], ecx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004905bb
mov esp, ebp
pop ebp
ret
Function at 0x490150
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub esp, 0x10
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
jne 0x490176
mov eax, dword [esp + 0x14]
mov dword [eax], 0
mov dword [eax + 4], 0
add esp, 0x10
ret
cmp dword [esp + 4], 0
jg 0x490185
jl 0x490161
cmp dword [esp], 0
jbe 0x490161
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 0x10]
push eax
xor esi, esi
call edi
test eax, eax
jne 0x4901b1
nop word [eax + eax]
inc esi
cmp esi, 3
ja 0x4901fc
lea eax, [esp + 0x10]
push eax
call edi
test eax, eax
je 0x4901a0
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
call fcn.00491530
mulsd xmm0, qword [0x4eb790]
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 8]
movsd qword [esp + 0x10], xmm0
call fcn.00491530
movsd xmm1, qword [esp + 0x10]
divsd xmm1, xmm0
movaps xmm0, xmm1
call fcn.00491457
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
mov dword [ecx], eax
mov eax, ecx
mov dword [ecx + 4], edx
add esp, 0x10
ret
mov eax, dword [esp + 0x1c]
pop edi
pop esi
mov dword [eax], 0
mov dword [eax + 4], 0
add esp, 0x10
ret
Function at 0x4902e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e0278
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x51f164]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x51f150]
cmp eax, 0xffffffff
jne 0x490314
xor ebx, ebx
jmp 0x49031d
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x49035f
mov eax, dword [ebx + 0x18]
nop
mov esi, dword [ebx + 0xc]
test eax, eax
jne 0x49039e
test esi, esi
jne 0x4903a2
push 0x48f460
push 0x5287d8
call fcn.0048f250
mov eax, dword [0x51f150]
add esp, 8
cmp eax, 0xffffffff
je 0x49035f
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [ebp - 4], 2
test ebx, ebx
je 0x49038c
or eax, 0xffffffff
lock xadd dword [ebx + 4], eax
jne 0x49038c
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax]
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x4903e4
mov eax, dword [esi + 4]
mov dword [ebx + 0xc], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x4903cd
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esi]
mov ecx, edi
push 0
mov eax, dword [edi]
call dword [eax]
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [ebx + 0xc]
test esi, esi
jne 0x4903a2
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x490330
nop
mov esi, dword [ebx + 0x14]
mov esi, dword [esi]
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x49040d
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x49040d
push eax
mov eax, dword [esi + 0x14]
push ecx
call eax
add esp, 8
push esi
lea ecx, [ebx + 0x14]
call fcn.0048eec0
push 0x20
push eax
call fcn.00490c3c
mov eax, dword [ebx + 0x18]
add esp, 8
mov byte [ebp - 4], 0
test eax, eax
jne 0x4903f0
jmp 0x490330

Function at 0x490440
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push esi
mov esi, ecx
mov edx, dword [esi]
lea eax, [edx + 0x10]
push eax
push 4
push edx
push 0x4904a0
push 0
push 0
call fcn.004bf65e
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x490469
pop esi
xor al, al
pop ebx
ret
mov eax, dword [esi]
push edi
add eax, 4
lock inc dword [eax]
mov edi, dword [esi]
mov eax, dword [edi + 8]
test eax, eax
je 0x490487
cmp eax, 0xffffffff
je 0x490487
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 8], ebx
mov eax, dword [esi]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop esi
mov al, 1
pop ebx
ret
Function at 0x492720
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x4c7633
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004c72f6

Function at 0x4c763e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004c7477

Function at 0x4cc967
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004cc627
Function at 0x404220
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4148d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x84
mov dword [ebp - 0x88], ecx
push 0
mov ecx, dword [ebp - 0x88]
call fcn.004056a0
push 0
push 0
lea ecx, [ebp - 0x44]
call fcn.00401af0
mov eax, dword [0x4164a0]
push eax
push 0
mov ecx, dword [ebp - 0x88]
add ecx, 0x1c
push ecx
lea ecx, [ebp - 0x44]
call fcn.00401ee0
mov dword [ebp - 4], 0
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.00401af0
mov edx, dword [0x4164a0]
push edx
push 0
mov eax, dword [ebp - 0x88]
add eax, 0xa8
push eax
lea ecx, [ebp - 0x28]
call fcn.00401ee0
cmp dword [ebp - 0x2c], 0x10
jb 0x4042b8
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x8c], ecx
jmp 0x4042c1
lea edx, [ebp - 0x40]
mov dword [ebp - 0x8c], edx
cmp dword [ebp - 0x10], 0x10
jb 0x4042d2
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x90], eax
jmp 0x4042db
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x90], ecx
push 0
mov edx, dword [ebp - 0x8c]
push edx
mov eax, dword [ebp - 0x90]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00401af0
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x44]
call fcn.00401af0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x404320
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414900
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x98
mov dword [ebp - 0x98], ecx
push 0
mov ecx, dword [ebp - 0x98]
call fcn.004056a0
push 0
push 0
lea ecx, [ebp - 0x44]
call fcn.00401af0
mov eax, dword [0x4164a0]
push eax
push 0
mov ecx, dword [ebp - 0x98]
add ecx, 0x38
push ecx
lea ecx, [ebp - 0x44]
call fcn.00401ee0
mov dword [ebp - 4], 0
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.00401af0
mov edx, dword [0x4164a0]
push edx
push 0
mov eax, dword [ebp - 0x98]
add eax, 0xc4
push eax
lea ecx, [ebp - 0x28]
call fcn.00401ee0
mov byte [ebp - 4], 1
cmp dword [ebp - 0x2c], 0x10
jb 0x4043bc
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x9c], ecx
jmp 0x4043c5
lea edx, [ebp - 0x40]
mov dword [ebp - 0x9c], edx
push 0x80
mov eax, dword [ebp - 0x9c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
push 0
push 0x4164c4
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push 0
push 0
push 0
push 0
push 0x4164c8
push 0
call dword [sym.imp.KERNEL32.dll_SearchPathA]
push 0
push 0
push 0x4164c4
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
cmp dword [ebp - 0x2c], 0x10
jb 0x40441b
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0xa0], ecx
jmp 0x404424
lea edx, [ebp - 0x40]
mov dword [ebp - 0xa0], edx
cmp dword [ebp - 0x10], 0x10
jb 0x404435
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xa4], eax
jmp 0x40443e
lea ecx, [ebp - 0x24]
mov dword [ebp - 0xa4], ecx
push 0
mov edx, dword [ebp - 0xa0]
push edx
mov eax, dword [ebp - 0xa4]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x40447d
mov byte [ebp - 4], 0
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00401af0
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x44]
call fcn.00401af0
jmp 0x4044b1
push 1
lea ecx, [ebp - 0x44]
push ecx
mov ecx, dword [ebp - 0x98]
call fcn.00403980
mov byte [ebp - 4], 0
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00401af0
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x44]
call fcn.00401af0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x404df0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov dword [ebp - 0x9c], ecx
mov dword [ebp - 0x98], 0x94
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 1
jne 0x404e3d
cmp dword [ebp - 0x94], 4
jne 0x404e3d
cmp dword [ebp - 0x90], 0xa
jne 0x404e3d
mov dword [ebp - 0xa0], 1
jmp 0x404e47
mov dword [ebp - 0xa0], 0
mov eax, dword [ebp - 0xa0]
mov esp, ebp
pop ebp
ret
Function at 0x405420
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414b5b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xe8
mov dword [ebp - 0xf0], ecx
push 0x416349
lea ecx, [ebp - 0x9c]
call fcn.004020c0
mov dword [ebp - 4], 0
mov dword [ebp - 0x7c], 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x7c]
push eax
push 0xc
push 0
push 0x416800
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov ecx, dword [ebp - 0x7c]
push ecx
push 0x4167fc
lea edx, [ebp - 0x74]
push edx
call fcn.0040d395
add esp, 0xc
lea eax, [ebp - 0x74]
push eax
call fcn.0040cc20
add esp, 4
test eax, eax
jne 0x4055a5
movzx ecx, byte [0x41661a]
mov dword [ebp - 0xa0], ecx
mov dword [ebp - 0xa4], 0
mov edx, dword [ebp - 0xa0]
add edx, 1
push edx
call fcn.0040b8d1
add esp, 4
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0xa4], eax
mov ecx, dword [ebp - 0xa0]
add ecx, 1
push ecx
push 0
mov edx, dword [ebp - 0xa4]
push edx
call fcn.0040cff0
add esp, 0xc
mov eax, dword [ebp - 0xa0]
push eax
push str.T_IGdfHpbcg
mov ecx, dword [ebp - 0xa4]
push ecx
call fcn.0040ccb0
add esp, 0xc
push 0x4166ac
mov edx, dword [ebp - 0xa0]
push edx
mov eax, dword [ebp - 0xa4]
push eax
call fcn.00408400
add esp, 0xc
mov ecx, dword [ebp - 0xa4]
push ecx
call fcn.0040cc20
add esp, 4
push eax
mov edx, dword [ebp - 0xa4]
push edx
lea ecx, [ebp - 0x9c]
call fcn.00401fd0
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0xac], eax
mov ecx, dword [ebp - 0xac]
push ecx
call fcn.0040ca99
add esp, 4
cmp dword [ebp - 0x84], 0x10
jb 0x405586
mov edx, dword [ebp - 0x98]
mov dword [ebp - 0xf4], edx
jmp 0x405592
lea eax, [ebp - 0x98]
mov dword [ebp - 0xf4], eax
mov ecx, dword [ebp - 0xf4]
push ecx
lea edx, [ebp - 0x74]
push edx
call fcn.0040d050
add esp, 8
lea eax, [ebp - 0x74]
push eax
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x80], 0
cmp dword [ebp - 0x78], 0
je 0x4055d7
mov dword [ebp - 0x80], 1
mov ecx, dword [ebp - 0x78]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x80]
mov dword [ebp - 0xb0], edx
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x9c]
call fcn.00401af0
mov eax, dword [ebp - 0xb0]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4084a0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov dword [edx], 0x67452301
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], 0x10325476
mov eax, dword [ebp - 4]
mov dword [eax + 0x58], 0
mov esp, ebp
pop ebp
ret

Function at 0x409580
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
push edi
cmp dword [ebp + 0xc], 0
jne 0x409597
xor eax, eax
jmp 0x4096c0
mov dword [ebp - 0x12c], 0
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x128], 0
mov ecx, 0x49
xor eax, eax
lea edi, [ebp - 0x124]
rep stosd dword es:[edi], eax
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0xffffffff
jne 0x4095e3
xor eax, eax
jmp 0x4096c0
mov dword [ebp - 0x128], 0x128
lea eax, [ebp - 0x128]
push eax
mov ecx, dword [ebp - 0x12c]
push ecx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x4096a3
mov edx, dword [ebp + 0xc]
push edx
call fcn.0040d148
add esp, 4
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.0040d148
add esp, 4
push eax
call fcn.0040d4b0
add esp, 8
test eax, eax
jne 0x40967c
mov ecx, dword [ebp - 0x120]
push ecx
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x134], eax
mov edx, dword [ebp + 8]
push edx
push 0xf01ff
mov eax, dword [ebp - 0x134]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [ebp - 0x130], eax
mov ecx, dword [ebp - 0x12c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x130]
jmp 0x4096c0
lea edx, [ebp - 0x128]
push edx
mov eax, dword [ebp - 0x12c]
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x409608
mov dword [ebp - 0x130], 1
jmp 0x4096ad
mov dword [ebp - 0x130], 0
mov ecx, dword [ebp - 0x12c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x130]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x40b240
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov dword [ebp - 0x9c], ecx
mov dword [ebp - 0x98], 0x94
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 1
jne 0x40b28d
cmp dword [ebp - 0x94], 4
jne 0x40b28d
cmp dword [ebp - 0x90], 0xa
jne 0x40b28d
mov dword [ebp - 0xa0], 1
jmp 0x40b297
mov dword [ebp - 0xa0], 0
mov al, byte [ebp - 0xa0]
mov esp, ebp
pop ebp
ret

Function at 0x40cbcf
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40cbef
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040fb43
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x40cc12
test byte [esp + 8], 2
je 0x40cc12
call fcn.0040fb31
mov dword [eax], 0xd
call fcn.0040fb3a
mov dword [eax], 5
jmp 0x40cbeb
xor eax, eax
ret

Function at 0x40dad6
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x18
push 0x416a00
call fcn.0040f848
mov edi, 0x94
mov eax, edi
call fcn.0040caa0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x41b9c0], ecx
mov eax, dword [esi + 4]
mov dword [0x41b9cc], eax
mov edx, dword [esi + 8]
mov dword [0x41b9d0], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x41b9c4], esi
cmp ecx, 2
je 0x40db36
or esi, 0x8000
mov dword [0x41b9c4], esi
shl eax, 8
add eax, edx
mov dword [0x41b9c8], eax
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x40db6f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40db6f
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x40db87
cmp eax, 0x20b
je 0x40db74
mov dword [ebp - 0x1c], edi
jmp 0x40db9b
cmp dword [ecx + 0x84], 0xe
jbe 0x40db6f
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x40db95
cmp dword [ecx + 0x74], 0xe
jbe 0x40db6f
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.00411ab3
pop ecx
test eax, eax
jne 0x40dbaf
push 0x1c
call fcn.0040dab2
pop ecx
call fcn.0040e813
test eax, eax
jne 0x40dbc0
push 0x10
call fcn.0040dab2
pop ecx
call fcn.00411a11
mov dword [ebp - 4], edi
call fcn.0040fcd8
test eax, eax
jge 0x40dbd9
push 0x1b
call fcn.0040da8d
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x41c080], eax
call fcn.004118ef
mov dword [0x41b838], eax
call fcn.0041184d
test eax, eax
jge 0x40dbff
push 8
call fcn.0040da8d
pop ecx
call fcn.0041161a
test eax, eax
jge 0x40dc10
push 9
call fcn.0040da8d
pop ecx
push 1
call fcn.004102a5
pop ecx
mov dword [ebp - 0x24], eax
cmp eax, edi
je 0x40dc26
push eax
call fcn.0040da8d
pop ecx
mov eax, dword [0x41b9e0]
mov dword [0x41b9e4], eax
push eax
push dword [0x41b9d8]
push dword [0x41b9d4]
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x1c], edi
jne 0x40dc55
push esi
call fcn.004103d2
call fcn.004103f4
jmp 0x40dc87
or dword [ebp - 4], 0xffffffff
mov eax, esi
lea esp, [ebp - 0x34]
call fcn.0040f883
ret