joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10055c30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x10055c3f
pop dword [ebp - 0xc]
mov eax, 0x9e4b1bee
sub eax, 0x8e45bfaf
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x2518481b
sub dword [ebp - 0x1c], 0xd6c602d0
mov dword [ebp - 0x18], 0xc2320f6b
sub dword [ebp - 0x18], 0x8ffec326
mov dword [ebp - 0x14], 0x51d723b
sub dword [ebp - 0x14], 0xb8d12e0d
mov dword [ebp - 0x10], 0x5e0f928d
add dword [ebp - 0x10], 0xa1f06d73
lea eax, [ebp - 0x1c]
push eax
mov eax, 0xa004b87c
add eax, 0x70014794
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x53a3b0d6
sub dword [ebp - 0x1c], 0xdf314780
mov dword [ebp - 0x18], 0xab181201
add dword [ebp - 0x18], 0x96544f74
mov dword [ebp - 0x14], 0xac8e4c97
add dword [ebp - 0x14], 0xb6e11fd5
mov dword [ebp - 0x10], 0x9e52d63d
add dword [ebp - 0x10], 0x61ad29c3
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x53993
push 0
call eax
mov ecx, 0x3f16
mov ebx, eax
mov esi, 0x1008bc00
add esi, dword [ebp - 0xc]
mov edx, 0xaad8b1ff
xor dword [ebp - 8], ebx
mov edi, dword [esi]
add dword [ebp - 4], 0x7795dab
xor edi, edx
mov dword [ebp - 4], 0x635db4ac
mov dword [ebx], edi
add dword [ebp - 8], 0xc075ea4e
add ebx, 0x44ff3449
sub ebx, 0x44ff3445
add esi, 0x4beb3ade
add esi, 0xb414c526
loop 0x10055d4a
add eax, 0xe993a42b
sub eax, 0xe992b500
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x4111c00d
sub ecx, 0x3111c00d
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x404022
Capabilities:
Move file

Disassembly:
push ebp
lea ebp, [esp - 0x84]
sub esp, 0x84
push 0xffffffffffffffff
push 0x447089
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x45e014]
xor eax, ebp
mov dword [ebp + 0x80], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x50
lea eax, [ebp]
push 0
push eax
call fcn.00423ab0
add esp, 0xc
lea ecx, [ebp]
call fcn.00406c67
and dword [ebp - 4], 0
lea eax, [ebp + 0x50]
push esi
push eax
lea ecx, [ebp]
call fcn.00406c1f
push 0x456cfb
lea ecx, [ebp + 0x68]
mov byte [ebp - 4], 1
call fcn.00407a1e
push esi
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp]
call fcn.00406c1f
push 0x456eb8
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.00407990
push eax
lea ecx, [ebp - 0x40]
call fcn.004079f0
push 0x460d88
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 4
call fcn.004079af
push eax
lea ecx, [ebp - 0x28]
call fcn.004079f0
mov byte [ebp - 0x10], 0
lea eax, [ebp - 0x28]
push dword [ebp - 0x10]
lea ecx, [ebp + 0x68]
push eax
call fcn.00408665
lea ecx, [ebp - 0x28]
call fcn.00408464
lea ecx, [ebp - 0x40]
call fcn.00408464
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 2
call fcn.00408464
cmp dword [ebp + 0x64], 0x10
lea edx, [ebp + 0x50]
push dword [ebp + 0x60]
cmovae edx, dword [ebp + 0x50]
mov esi, 0x45fb48
mov ecx, esi
call fcn.00409b2c
push eax
call fcn.00408d2d
cmp dword [ebp + 0x7c], 0x10
lea edx, [ebp + 0x68]
push dword [ebp + 0x78]
cmovae edx, dword [ebp + 0x68]
mov ecx, esi
call fcn.00409b2c
push eax
call fcn.00408d2d
cmp dword [ebp + 0x7c], 0x10
lea ecx, [ebp + 0x68]
lea eax, [ebp + 0x50]
cmovae ecx, dword [ebp + 0x68]
cmp dword [ebp + 0x64], 0x10
push ecx
cmovae eax, dword [ebp + 0x50]
push eax
call fcn.004271e0
add esp, 0x18
lea ecx, [ebp + 0x68]
call fcn.00408464
lea ecx, [ebp + 0x50]
call fcn.00408464
lea ecx, [ebp]
call fcn.00406c45
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp + 0x80]
xor ecx, ebp
call fcn.00421907
add ebp, 0x84
leave
ret
Function at 0x405c2f
Capabilities:
Enumerate processes
Terminate process

Disassembly:
sub esp, 0x230
mov eax, dword [0x45e014]
xor eax, esp
mov dword [esp + 0x22c], eax
push ebp
push edi
push 0
push 0xf
mov ebp, ecx
call dword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
mov edi, eax
mov dword [esp + 8], 0x22c
lea eax, [esp + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_Process32FirstW]
test eax, eax
je 0x405cb1
push esi
lea eax, [esp + 0x30]
push ebp
push eax
call fcn.0043386c
pop ecx
pop ecx
test eax, eax
jne 0x405ca0
push dword [esp + 0x14]
push eax
push 1
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov esi, eax
test esi, esi
je 0x405ca0
push 9
push esi
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_Process32NextW]
test eax, eax
jne 0x405c6c
pop esi
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [esp + 0x234]
pop edi
pop ebp
xor ecx, esp
call fcn.00421907
add esp, 0x230
ret
Function at 0x406ef3
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x406f1a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040760b
jmp 0x406fcf
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x406f3c
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x406f3e
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x406fc3
jg 0x406f53
test esi, esi
je 0x406fc3
test ecx, ecx
jl 0x406f9c
jg 0x406f5d
test eax, eax
je 0x406f9c
cmp edi, ecx
jg 0x406f71
jl 0x406f67
cmp esi, eax
jae 0x406f71
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call fcn.00422fb0
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x406f9f
mov edx, dword [ebp + 8]
test edi, edi
jl 0x406fc3
jg 0x406fa9
test esi, esi
je 0x406fc3
cmp dword [ebx + 0x4c], 0
je 0x406fc3
push dword [ebx + 0x4c]
push esi
push 1
push edx
call fcn.0042763f
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4080e3
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x45e014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x38], ebx
je 0x40813a
cmp byte [esi + 0x3d], bl
je 0x40813a
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x408173
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, ebx
je 0x40814b
sub eax, 1
je 0x40814e
dec eax
sub eax, 1
jne 0x408173
mov byte [esi + 0x3d], bl
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00421907
leave
ret
mov byte [esi + 0x3d], bl
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x40816b
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0042763f
add esp, 0x10
cmp edi, eax
jne 0x408173
cmp byte [esi + 0x3d], bl
sete al
jmp 0x40813c
xor al, al
jmp 0x40813c
Function at 0x408e78
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x447ac9
call fcn.0042207e
mov esi, ecx
push 8
call fcn.00421b18
mov ecx, eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], ecx
mov dword [ecx], eax
mov dword [ecx + 4], fcn.0040460b
xor ebx, ebx
lea edi, [esi + 4]
push edi
push ebx
push ecx
push 0x409de6
push ebx
push ebx
mov dword [ebp - 4], ebx
call fcn.00426ca2
add esp, 0x1c
mov dword [esi], eax
test eax, eax
je 0x408ec8
mov eax, esi
call fcn.00422039
ret 8
push 6
mov dword [edi], ebx
call fcn.0040a6e8
int3

Function at 0x40e853
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x45e014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov eax, 0xffff
push edi
mov edi, ecx
cmp ax, bx
jne 0x40e878
xor eax, eax
jmp 0x40e8d4
mov eax, dword [edi + 0x20]
push esi
mov ecx, dword [eax]
test ecx, ecx
je 0x40e8a5
mov edx, dword [edi + 0x30]
mov esi, dword [edx]
lea eax, [ecx + esi*2]
cmp ecx, eax
jae 0x40e8a5
lea ecx, [esi - 1]
mov dword [edx], ecx
mov edx, dword [edi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], bx
jmp 0x40e959
cmp dword [edi + 0x4c], 0
je 0x40e8ce
mov ecx, edi
call fcn.0040e739
mov eax, dword [edi + 0x38]
mov dword [ebp - 0x2c], eax
test eax, eax
jne 0x40e8e4
push dword [edi + 0x4c]
push ebx
call fcn.0040e188
pop ecx
test al, al
movzx eax, bx
pop ecx
jne 0x40e8d3
mov eax, 0xffff
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.00421907
leave
ret 4
mov word [ebp - 0x28], bx
mov eax, dword [eax]
mov esi, dword [eax + 0x1c]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 4]
mov ecx, esi
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x26]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [edi + 0x40]
push eax
call dword [0x4491e0]
mov ecx, dword [ebp - 0x2c]
call esi
test eax, eax
js 0x40e8ce
cmp eax, 1
jle 0x40e92c
cmp eax, 3
jne 0x40e8ce
push dword [edi + 0x4c]
push dword [ebp - 0x28]
jmp 0x40e8c0
mov esi, dword [ebp - 0x30]
lea eax, [ebp - 0x24]
sub esi, eax
je 0x40e949
push dword [edi + 0x4c]
push esi
push 1
push eax
call fcn.0042763f
add esp, 0x10
cmp esi, eax
jne 0x40e8ce
lea eax, [ebp - 0x28]
mov byte [edi + 0x3e], 1
cmp dword [ebp - 0x34], eax
je 0x40e8ce
mov ax, bx
jmp 0x40e8d3

Function at 0x436b1b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004367cc

Function at 0x436b26
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00436956
Function at 0x407d9c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407e75
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x407dd4
mov eax, dword [ebp - 4]
call fcn.004071d0
jmp 0x407ddc
mov eax, dword [ebp - 4]
call fcn.00407bd4
call fcn.00404ae8
mov esi, eax
test esi, esi
jle 0x407e28
mov ebx, 1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x407e12
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.004071d0
jmp 0x407e24
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0x10]
call fcn.00407bd4
inc ebx
dec esi
jne 0x407dec
push 1
push dword [ebp - 4]
push 0x407e8c
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00406f34
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004032cc
mov eax, dword [ebp - 0x14]
call fcn.0040340c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407e7c
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret

Function at 0x4010f0
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ebp, esp
add esp, 0xfffffffc
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [0x40332c], eax
lea ecx, [ebp - 4]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
mov eax, dword [ebp + 4]
mov dword [0x40319f], eax
xor eax, eax
mov ecx, 0x16
push eax
dec ecx
jne 0x401121
push 0x7f00
push esi
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push esi
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [ebp - 0x5c]
push ecx
mov eax, 0x30
mov dword [ecx], eax
mov eax, dword [0x40319f]
mov dword [ebp - 0x48], eax
mov eax, 0x401b7b
mov dword [ebp - 0x54], eax
mov ecx, 0x4030bd
mov dword [ebp - 0x34], ecx
call dword [sym.imp.USER32.dll_RegisterClassExA]
push 0
push 0
push str.Riched32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
xor ecx, ecx
push ecx
push dword [0x40319f]
push ecx
push ecx
push 0x12e
push 0x7a
push 0x34c
push 0x2aa
push 0x40000
lea eax, str.bananas
push eax
mov eax, str.secondclass
push eax
push ecx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [0x403378], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x403378]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
xor ebx, ebx
lea edi, [ebp - 0x50]
jmp 0x4011d9
push edi
call dword [sym.imp.USER32.dll_TranslateMessage]
push edi
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
push ebx
push edi
call dword [sym.imp.USER32.dll_GetMessageA]
test al, al
jne 0x4011cb
mov esp, ebp
ret
Function at 0x43f092
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x43f0a1
pop dword [ebp - 0x48]
mov eax, 0x1f2f1c5a
sub eax, 0x1eeb2bb9
sub dword [ebp - 0x48], eax
push 0x40
push 0x1000
push 0x5099c
push 0
mov eax, 0xc5f53ead
sub eax, 0xc5b08bfd
add eax, dword [ebp - 0x48]
call dword [eax]
mov ecx, 0x9b6c0ab4
sub ecx, 0x9b6bc0c6
xor edi, edi
add edi, eax
mov ebx, 0xbf16d14e
sub ebx, 0xbece434e
add ebx, dword [ebp - 0x48]
mov edx, 0xf4112914
sub edx, 0x5201c8e4
xor dword [ebp - 0x3c], ebx
mov esi, dword [ebx]
sub dword [ebp - 0x1c], 0xc2170f7a
xor esi, edx
mov dword [edi], esi
add dword [ebp - 0x34], 0xbc191001
add edi, 0xcd1845a7
sub edi, 0xcd1845a3
add ebx, 0x5acc29be
add ebx, 0xa533d646
loop 0x43f102
add eax, 0x11a8b
mov ebx, eax
add eax, 5
mov ecx, 0xb8b9a95
sub ecx, 0xb4b9a95
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x4400c9
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46c6d0
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x44010c
push str.SystemFunction040
push dword [0x46c6d0]
call edi
push str.SystemFunction041
push dword [0x46c6d0]
mov dword [0x46c6c0], eax
call edi
mov dword [0x46c6c4], eax
jmp 0x440111
mov eax, dword [0x46c6c4]
cmp dword [0x46c6c0], 0
je 0x440122
test eax, eax
jne 0x4401c9
push 0x46c6d4
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x4401d3
push str.CryptProtectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c0], 0
mov dword [0x46c6c8], eax
jne 0x440187
test eax, eax
jne 0x440187
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x440171
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x440178
mov esi, 0x80004005
push esi
push 0x28
push str.c:_agent_work138_s_srclibsdutilcryputil.cpp
call fcn.004038f5
jmp 0x4401d3
push str.CryptUnprotectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c4], 0
mov dword [0x46c6cc], eax
jne 0x4401c9
test eax, eax
jne 0x4401c9
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4401bd
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4401c4
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x44017b
mov dword [0x46c6d8], 1
pop edi
mov eax, esi
pop esi
ret
Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d

Function at 0x40974c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x40975b
pop dword [ebp - 0x50]
mov eax, 0xce31d005
sub eax, 0xcdf138aa
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0xe4a0317f
add dword [ebp - 0x60], 0x69b213cc
mov dword [ebp - 0x5c], 0xe9f9a147
sub dword [ebp - 0x5c], 0xb7c65502
mov dword [ebp - 0x58], 0xb3f26ced
sub dword [ebp - 0x58], 0x67a628bf
mov dword [ebp - 0x54], 0x755e3646
sub dword [ebp - 0x54], 0x755e3646
lea eax, [ebp - 0x60]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x7dd4f76a
add dword [ebp - 0x60], 0xf69d71ec
mov dword [ebp - 0x5c], 0xef04b05d
add dword [ebp - 0x5c], 0x5267b118
mov dword [ebp - 0x58], 0x68fb231d
sub dword [ebp - 0x58], 0x58bb6b1
mov dword [ebp - 0x54], 0x72b7562a
sub dword [ebp - 0x54], 0x72b7562a
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0x7e9c22a1
sub eax, 0x7e5b5259
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3df26
push 0
call eax
mov ecx, 0x5984
mov ebx, eax
mov esi, 0xdf335f2c
sub esi, 0xdef1af2c
add esi, dword [ebp - 0x50]
mov edi, 0x1081134a
sub dword [ebp - 0x18], 0x4d13020c
mov edx, dword [esi]
mov dword [ebp - 0x34], 0xe10f793a
add edx, edi
xor dword [ebp - 0x30], eax
mov dword [ebx], edx
sub dword [ebp - 0x28], 0xd75be15a
add ebx, 0x56660438
add ebx, 0xa999fbcc
add esi, 0x7c8837cb
add esi, 0x8377c839
loop 0x40986c
add eax, 0x158e3
xor ebx, ebx
add ebx, eax
add eax, 0xd23d972a
add eax, 0x2dc268db
mov ecx, 0x22c78294
add ecx, 0xdd787d6c
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x401a64
Capabilities:
Create process on windows
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
push ebp
push 0x401b1a
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x46d5c4
call sub.KERNEL32.DLL_WinExec
cmp byte [0x46d045], 0
je 0x401a92
push 0x46d5c4
call sub.KERNEL32.DLL_WriteFile
mov eax, 0x46d5e4
call fcn.00401428
mov eax, 0x46d5f4
call fcn.00401428
mov eax, 0x46d620
call fcn.00401428
push 0xff8
push 0
call sub.KERNEL32.DLL_SizeofResource
mov dword [0x46d61c], eax
cmp dword [0x46d61c], 0
je 0x401af9
mov eax, 3
mov edx, dword [0x46d61c]
xor ecx, ecx
mov dword [edx + eax*4 - 0xc], ecx
inc eax
cmp eax, 0x401
jne 0x401acf
mov eax, 0x46d604
mov dword [eax + 4], eax
mov dword [eax], eax
mov dword [0x46d610], eax
mov byte [0x46d5bc], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x401b21
cmp byte [0x46d045], 0
je 0x401b19
push 0x46d5c4
call sub.KERNEL32.DLL_lstrcpyA
ret

Function at 0x401b28
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
cmp byte [0x46d5bc], 0
je 0x401c05
xor edx, edx
push ebp
push 0x401bfe
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [0x46d045], 0
je 0x401b5a
push 0x46d5c4
call sub.KERNEL32.DLL_WriteFile
mov byte [0x46d5bc], 0
mov eax, dword [0x46d61c]
push eax
call sub.KERNEL32.DLL_VirtualAlloc
xor eax, eax
mov dword [0x46d61c], eax
mov ebx, dword [0x46d5e4]
jmp 0x401b8d
push 0x8000
push 0
mov eax, dword [ebx + 8]
push eax
call sub.KERNEL32.DLL_WaitForSingleObject
mov ebx, dword [ebx]
cmp ebx, 0x46d5e4
jne 0x401b7b
mov eax, 0x46d5e4
call fcn.00401428
mov eax, 0x46d5f4
call fcn.00401428
mov eax, 0x46d620
call fcn.00401428
mov eax, dword [0x46d5dc]
test eax, eax
je 0x401bd3
mov edx, dword [eax]
mov dword [0x46d5dc], edx
push eax
call sub.KERNEL32.DLL_VirtualAlloc
mov eax, dword [0x46d5dc]
test eax, eax
jne 0x401bbc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x401c05
cmp byte [0x46d045], 0
je 0x401bf3
push 0x46d5c4
call sub.KERNEL32.DLL_lstrcpyA
push 0x46d5c4
call sub.KERNEL32.DLL_Sleep
ret
pop ebx
pop ebp
ret
Function at 0x402150
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, eax
cmp byte [0x46d5bc], 0
jne 0x40216d
call fcn.00401a64
test al, al
je 0x402175
cmp ebx, 0x7ffffff8
jle 0x40217f
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4022d3
xor ecx, ecx
push ebp
push 0x4022cc
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x46d045], 0
je 0x4021a0
push 0x46d5c4
call sub.KERNEL32.DLL_WriteFile
add ebx, 7
and ebx, 0xfffffffc
cmp ebx, 0xc
jge 0x4021b0
mov ebx, 0xc
cmp ebx, 0x1000
jg 0x40224f
mov eax, ebx
test eax, eax
jns 0x4021c5
add eax, 3
sar eax, 2
mov edx, dword [0x46d61c]
mov edx, dword [edx + eax*4 - 0xc]
test edx, edx
je 0x40224f
mov esi, edx
mov eax, esi
add eax, ebx
and dword [eax], 0xfffffffe
mov eax, dword [edx + 4]
cmp edx, eax
jne 0x402200
mov eax, ebx
test eax, eax
jns 0x4021ef
add eax, 3
sar eax, 2
mov ecx, dword [0x46d61c]
xor edi, edi
mov dword [ecx + eax*4 - 0xc], edi
jmp 0x402226
mov ecx, ebx
test ecx, ecx
jns 0x402209
add ecx, 3
sar ecx, 2
mov edi, dword [0x46d61c]
mov dword [edi + ecx*4 - 0xc], eax
mov ecx, dword [edx]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, esi
mov edx, dword [edx + 8]
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x46d5ac]
sub ebx, 4
add dword [0x46d5b0], ebx
call fcn.0040432c
jmp 0x4022d3
cmp ebx, dword [0x46d614]
jg 0x4022a1
sub dword [0x46d614], ebx
cmp dword [0x46d614], 0xc
jge 0x402273
add ebx, dword [0x46d614]
xor eax, eax
mov dword [0x46d614], eax
mov eax, dword [0x46d618]
add dword [0x46d618], ebx
mov edx, ebx
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x46d5ac]
sub ebx, 4
add dword [0x46d5b0], ebx
call fcn.0040432c
jmp 0x4022d3
mov eax, ebx
call fcn.0040205c
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4022d3
cmp byte [0x46d045], 0
je 0x4022cb
push 0x46d5c4
call sub.KERNEL32.DLL_lstrcpyA
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4022e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
mov dword [0x46d5c0], eax
cmp byte [0x46d5bc], 0
jne 0x402318
call fcn.00401a64
test al, al
jne 0x402318
mov dword [0x46d5c0], 8
mov dword [ebp - 4], 8
jmp 0x402479
xor ecx, ecx
push ebp
push 0x402472
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x46d045], 0
je 0x402339
push 0x46d5c4
call sub.KERNEL32.DLL_WriteFile
mov esi, ebx
sub esi, 4
mov ebx, dword [esi]
test bl, 2
jne 0x402354
mov dword [0x46d5c0], 9
jmp 0x402449
dec dword [0x46d5ac]
mov eax, ebx
and eax, 0x7ffffffc
sub eax, 4
sub dword [0x46d5b0], eax
test bl, 1
je 0x4023b4
mov eax, esi
sub eax, 0xc
mov edx, dword [eax + 8]
cmp edx, 0xc
jl 0x402384
test edx, 0x80000003
je 0x402393
mov dword [0x46d5c0], 0xa
jmp 0x402449
mov eax, esi
sub eax, edx
cmp edx, dword [eax + 8]
je 0x4023ab
mov dword [0x46d5c0], 0xa
jmp 0x402449
add ebx, edx
mov esi, eax
call fcn.00401c08
and ebx, 0x7ffffffc
mov eax, esi
add eax, ebx
mov edi, eax
cmp edi, dword [0x46d618]
jne 0x4023f4
sub dword [0x46d618], ebx
add dword [0x46d614], ebx
cmp dword [0x46d614], 0x3c00
jle 0x4023e5
call fcn.00401ef8
xor eax, eax
mov dword [ebp - 4], eax
call fcn.0040432c
jmp 0x402479
mov edx, dword [eax]
test dl, 2
je 0x402417
and edx, 0x7ffffffc
cmp edx, 4
jge 0x402412
mov dword [0x46d5c0], 0xb
jmp 0x402449
or dword [eax], 1
jmp 0x402440
mov eax, edi
cmp dword [eax + 4], 0
je 0x40242a
cmp dword [eax], 0
je 0x40242a
cmp dword [eax + 8], 0xc
jge 0x402436
mov dword [0x46d5c0], 0xb
jmp 0x402449
mov edx, dword [eax + 8]
add ebx, edx
call fcn.00401c08
mov edx, ebx
mov eax, esi
call fcn.00401e70
mov eax, dword [0x46d5c0]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402479
cmp byte [0x46d045], 0
je 0x402471
push 0x46d5c4
call sub.KERNEL32.DLL_lstrcpyA
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4049e8
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push edx
push eax
mov eax, dword [ebp + 8]
push eax
push ecx
push 0
mov eax, dword [0x46d5b8]
push eax
call sub.KERNEL32.DLL_ResumeThread
pop ebp
ret 4

Function at 0x404f80
Capabilities:
Hide graphical window

Disassembly:
test eax, eax
je 0x404f94
push eax
push 0
call sub.user32.dll_ShowWindow
test eax, eax
je 0x404f78
ret

Function at 0x4059f0
Capabilities:
Clear file content

Disassembly:
add esp, 0xffffffe4
push 0x1c
lea edx, [esp + 4]
push edx
push eax
call sub.KERNEL32.DLL_SetEndOfFile
cmp dword [esp + 0x10], 0x1000
jne 0x405a10
mov eax, dword [esp + 4]
jmp 0x405a12
xor eax, eax
add esp, 0x1c
ret