joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100107f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x100e5900]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x100b37ec
mov esi, ecx
jmp loc.104fb0ef

Function at 0x10011310
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b0f58
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
mov eax, dword [0x100e5900]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x100b3460
lea ecx, [ebp - 0x10]
call fcn.10011250
push 0
push edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0x34
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
je 0x10011401
push esi
call fcn.10020502
add esp, 4
mov ebx, eax
push ebx
push esi
push 0
push edi
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x100113f3
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x18]
push ecx
push 0x100b3888
push ebx
call fcn.100901f4
test eax, eax
je 0x100113f3
mov eax, dword [ebp - 0x18]
movzx edx, word [eax + 0xc]
movzx ecx, word [eax + 0xe]
push edx
movzx edx, word [eax + 8]
movzx eax, word [eax + 0xa]
push ecx
push edx
push eax
lea ecx, [ebp - 0x10]
push str._d._d._d._d
push ecx
call fcn.10010e50
mov edx, dword [ebp - 0x10]
mov ecx, dword [edx - 8]
mov eax, 1
sub eax, dword [edx - 4]
add esp, 0x18
or ecx, eax
jge 0x100113db
push 0
lea ecx, [ebp - 0x10]
call fcn.10010b80
mov edx, dword [ebp - 0x10]
push edx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push ebx
mov esi, eax
call fcn.10075faf
add esp, 4
jmp 0x10011406
mov esi, dword [ebp - 0x18]
push ebx
call fcn.10075faf
add esp, 4
jmp 0x10011406
mov esi, 1
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1001142c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10011440
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100e5900]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x107]
push ebx
push eax
mov byte [ebp - 0x108], bl
call fcn.10076930
lea ecx, [ebp - 0x108]
push 0x104
push ecx
call fcn.10010320
add esp, 0x14
call fcn.100103b0
mov esi, str.1.0.1.1
test eax, eax
jne 0x10011496
mov esi, str.1.0.1.3
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x100114ce
push edi
push esi
lea edi, [ebp - 0x108]
call fcn.10011310
add esp, 4
pop edi
test eax, eax
jle 0x100114e0
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10077184
mov esp, ebp
pop ebp
ret
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10077184
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.10077184
mov esp, ebp
pop ebp
ret
Function at 0x1001a680
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetWindowLongA]
mov esi, ecx
mov eax, dword [esi + 4]
push 0xfffffffffffffff0
push eax
call edi
mov ecx, dword [esi + 4]
push 0xffffffffffffffec
push ecx
mov ebx, eax
call edi
mov edx, dword [esi + 4]
push edx
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
mov ecx, dword [esi + 0x6c]
mov edx, dword [esi + 4]
mov dword [esi + 0x78], 0
mov ecx, dword [ecx + 0x1b4]
push 0
push eax
mov eax, dword [ebp - 4]
or ecx, ebx
mov ebx, dword [0x100b32fc]
and ecx, 0xff7fffff
push eax
or ecx, 0x50000080
push ecx
lea edi, [esi + 0x24]
push 0
push section..data
push edx
mov ecx, edi
mov dword [edi + 0x14], str.EDIT
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], esi
mov dword [edi + 0x20], 1
call fcn.10018a10
mov ecx, dword [esi + 0x6c]
mov eax, dword [ecx + 0x1ac]
mov edx, dword [edi]
push 0
push eax
push 0xc5
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [edi]
mov ebx, dword [0x100b32d0]
push 1
push eax
call ebx
lea ecx, [esi + 0xb8]
push ecx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea edx, [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x1001a75b
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [esi + 0xe0], eax
mov dword [esi + 0xe4], ecx
jmp 0x1001a779
push 0
push ecx
mov eax, esp
push ecx
mov dword [eax], str.Error
mov eax, esp
push 0
mov dword [eax], str.Your_hardware_DO_NOT_support_high_resolution_performance_counter.
call fcn.1000fff0
add esp, 0x10
mov ecx, dword [esi + 0xd0]
mov edx, dword [esi + 0xd4]
cmp ecx, edx
je 0x1001a7bc
mov eax, edx
cmp edx, edx
je 0x1001a7b6
nop
mov ebx, dword [eax]
mov dword [ecx], ebx
mov ebx, dword [eax + 4]
mov dword [ecx + 4], ebx
mov ebx, dword [eax + 8]
mov dword [ecx + 8], ebx
mov ebx, dword [eax + 0xc]
mov dword [ecx + 0xc], ebx
add eax, 0x10
add ecx, 0x10
cmp eax, edx
jne 0x1001a790
mov ebx, dword [0x100b32d0]
mov dword [esi + 0xd4], ecx
mov edx, dword [edi]
push edx
mov ecx, 0x100e46c8
call fcn.10011a10
cmp dword [0x100e4918], 0
jne 0x1001a7e9
mov eax, dword [edi]
push 0
push eax
call ebx
mov ecx, dword [edi]
push 0x100b3a8c
push ecx
call dword [sym.imp.USER32.dll_SetWindowTextA]
jmp 0x1001a7f0
mov edx, dword [edi]
push 1
push edx
call ebx
mov eax, dword [esi + 0x6c]
mov eax, dword [eax + 0x1b8]
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push 0
push 0
mov dword [esi + 0x98], eax
mov ecx, dword [esi + 4]
push 0x1a
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, esi
call fcn.10015330
mov edx, dword [edi]
push edx
call sub.IMM32.dll_ImmGetContext
mov esi, eax
test esi, esi
je 0x1001a83e
mov eax, dword [edi]
push 0
push eax
call sub.IMM32.dll_ImmAssociateContext
mov ecx, dword [edi]
push esi
push ecx
call sub.IMM32.dll_ImmReleaseContext
mov edx, dword [edi]
push 0
push 0x1e
push 0x3f3
push edx
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, dword [edi]
push 5
push eax
invalid
invalid
nop
mov dl, ah
Function at 0x10021275
Capabilities:
Execute shellcode via indirect call

Disassembly:
cmp dword [0x100e7c60], 0
push esi
push edi
jne 0x100211eb
call fcn.10021157
test eax, eax
je 0x10021230
mov eax, dword [0x100e7c60]
cmp eax, 1
jne 0x1002120c
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x10021230
jmp 0x10021272
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x10021272
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
adc byte [ebx + 0x75f685f0], cl
invalid
xor eax, eax
jmp 0x10021272
mov eax, dword [esi]
push dword [0x100e7c60]
call edi
mov edi, eax
test edi, edi
je 0x10021256
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x10021272
lea edi, [esi + 0xff0]
push esi
push dword [0x100e7c60]
call dword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x1002125c
mov eax, esi
pop edi
pop esi
ret
jmp 0x100211d7
Function at 0x10023420
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [esp + 4]
push ebp
push edi
mov edi, dword [esp + 0x14]
xor ebp, ebp
test edi, edi
jle 0x10023503
push esi
mov esi, dword [esp + 0x14]
lea esp, [esp]
cmp edi, 3
movzx edx, byte [esi]
jl 0x1002349e
movzx eax, byte [esi + 1]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 2]
shl edx, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
inc ecx
mov eax, edx
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
inc ecx
and edx, 0x3f
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
jmp 0x100234f0
shl edx, 0x10
cmp edi, 2
jne 0x100234af
movzx eax, byte [esi + 1]
shl eax, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
inc ecx
cmp edi, 1
jne 0x100234dd
lea edx, [edi + 0x3c]
jmp 0x100234ea
shr edx, 6
and edx, 0x3f
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
inc ecx
mov byte [ecx], 0x3d
sub edi, 3
inc ecx
add ebp, 4
add esi, 3
test edi, edi
jg 0x10023440
pop esi
pop edi
mov eax, ebp
mov byte [ecx], 0
pop ebp
ret
Function at 0x1002ea00
Capabilities:
Access the windows event log

Disassembly:
mov eax, 0x108
call fcn.10077ab0
mov eax, dword [0x100e5900]
xor eax, esp
mov dword [esp + 0x104], eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x1002ea65
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x1002ea65
mov ecx, dword [esp + 0x10c]
lea eax, [esp + 0x110]
push eax
push ecx
call fcn.1007c6f8
add eax, 0x40
push eax
call fcn.1007c6d9
add esp, 0xc
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.10077184
add esp, 0x108
ret
mov eax, dword [esp + 0x10c]
lea edx, [esp + 0x110]
push edx
push eax
lea ecx, [esp + 0xc]
push 0xff
push ecx
call fcn.1007c5b1
add esp, 0x10
mov byte [esp + 0x103], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x1002eaf4
call fcn.1002e8c0
test eax, eax
jle 0x1002eaf4
push esi
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push 0
mov esi, eax
lea eax, [esp + 8]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
lea edx, [esp + 0x28]
push esi
mov dword [esp + 0x28], edx
invalid
invalid
hlt
mov dl, ah
Function at 0x10070340
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
cmp ecx, dword [edi + 4]
jge 0x10070359
mov esi, edi
mov edi, eax
jmp 0x1007035b
mov esi, eax
mov eax, dword [esi + 4]
mov ebx, dword [esp + 0x10]
cmp eax, dword [ebx + 8]
jg 0x1007036b
mov eax, ebx
jmp 0x10070375
push eax
push ebx
call fcn.10025aa0
add esp, 8
test eax, eax
jne 0x1007037d
pop edi
pop esi
pop ebx
ret
xor eax, eax
cmp dword [edi + 4], eax
jle 0x10070399
mov edx, dword [esi]
mov ecx, dword [edi]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [edi + 4]
jl 0x10070384
cmp eax, dword [esi + 4]
jge 0x100703b0
mov edi, edi
mov edx, dword [esi]
mov edx, dword [edx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [esi + 4]
jl 0x100703a0
mov eax, dword [esi + 4]
mov dword [ebx + 4], eax
test eax, eax
jle 0x100703d1
mov ecx, dword [ebx]
lea ecx, [ecx + eax*4 - 4]
mov edx, dword [ecx]
sub ecx, 4
test edx, edx
jne 0x100703ce
dec eax
test eax, eax
jg 0x100703c0
mov dword [ebx + 4], eax
pop edi
pop esi
mov eax, 1
pop ebx
ret

Function at 0x10077184
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100e5900]
jne 0x1007718e
repz ret
jmp fcn.10081a6c

Function at 0x1008f470
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x1008f4e1
mov ecx, dword [ebp - 4]
cmp dword [ecx + 8], 0
je 0x1008f4e1
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
test eax, eax
jne 0x1008f4ca
jmp 0x1008f4e1
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
push 0x40
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x10096527
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 0xa0
call fcn.10077ab0
mov eax, dword [0x100e5900]
xor eax, esp
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0xa8]
push ebp
mov ebp, dword [esp + 0xa8]
push esi
mov esi, ecx
test eax, eax
jbe 0x10096694
push ebx
dec eax
push edi
lea edi, [ebp + 0xc]
shr eax, 3
add ebp, 0x14
inc eax
mov dword [esp + 0x18], eax
movzx ebx, byte [esi]
movzx eax, byte [esi + 1]
inc esi
movzx ecx, byte [esi + 1]
inc esi
movzx edx, byte [esi + 1]
shl eax, 8
or ebx, eax
inc esi
movzx eax, byte [esi + 1]
inc esi
shl ecx, 0x10
or ebx, ecx
movzx ecx, byte [esi + 1]
shl edx, 0x18
inc esi
or ebx, edx
movzx edx, byte [esi + 1]
inc esi
shl ecx, 8
or eax, ecx
movzx ecx, byte [esi + 1]
inc esi
shl edx, 0x10
or eax, edx
mov dl, byte [edi]
shl ecx, 0x18
or eax, ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], eax
mov al, byte [ebp]
and dl, 0xdf
and al, 0xbf
or dl, 0x40
or al, 0x20
push edi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], ebx
inc esi
mov byte [edi], dl
mov byte [ebp], al
call fcn.100904b0
lea ecx, [esp + 0x30]
push ecx
push edi
call fcn.10090580
push 1
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x38]
push eax
call fcn.100919c0
push ebp
call fcn.100904b0
lea ecx, [esp + 0x48]
push ecx
push ebp
call fcn.10090580
push 1
lea edx, [esp + 0x54]
push edx
lea eax, [esp + 0x48]
push eax
call fcn.100919c0
mov eax, dword [esp + 0x50]
xor eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x58]
xor dword [esp + 0x40], edx
xor ecx, ebx
xor ebx, dword [esp + 0x54]
mov dword [esp + 0x44], eax
mov eax, edi
mov byte [eax], bl
mov edx, ebx
inc eax
shr edx, 8
add esp, 0x30
mov byte [eax], dl
inc eax
inc eax
mov edx, ebx
shr edx, 0x10
mov byte [eax - 1], dl
mov edx, dword [esp + 0x14]
inc eax
shr ebx, 0x18
mov byte [eax - 1], bl
mov byte [eax], dl
mov ebx, edx
inc eax
inc eax
shr ebx, 8
mov byte [eax - 1], bl
mov ebx, edx
shr edx, 0x18
shr ebx, 0x10
mov byte [eax], bl
mov byte [eax + 1], dl
mov edx, ecx
shr edx, 8
mov eax, ebp
mov byte [eax], cl
mov byte [eax + 1], dl
inc eax
inc eax
mov edx, ecx
shr edx, 0x10
mov byte [eax], dl
inc eax
shr ecx, 0x18
mov byte [eax], cl
mov ecx, dword [esp + 0x10]
inc eax
mov byte [eax], cl
mov edx, ecx
shr edx, 8
inc eax
mov byte [eax], dl
mov edx, ecx
inc eax
shr edx, 0x10
shr ecx, 0x18
sub dword [esp + 0x18], 1
mov byte [eax], dl
mov byte [eax + 1], cl
jne 0x10096543
pop edi
pop ebx
mov ecx, dword [esp + 0xa4]
pop esi
pop ebp
xor ecx, esp
call fcn.10077184
add esp, 0xa0
ret
Function at 0x402b3a
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4014
call fcn.0046bd40
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x4014]
push edi
mov edi, dword [ebp + 8]
mov ecx, 0x4000
and dword [ebp + 8], 0
mov dword [ebp - 0x14], ecx
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], ecx
mov esi, dword [esi + 4]
mov dword [ebp - 4], esi
call sub.KERNEL32.dll_GetTickCount
and dword [ebp - 0xc], 0
xor ebx, ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], ebx
jmp 0x402b84
mov esi, dword [ebp - 4]
cmp ebx, esi
jge 0x402bc8
cmp dword [edi + 4], 0
ja 0x402bc8
lea eax, [ebp - 0x14]
sub esi, ebx
push eax
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push eax
call fcn.004018e2
pop ecx
pop ecx
mov ecx, dword [ebp + 0xc]
mov esi, eax
push ebx
mov dword [edi + 4], esi
call fcn.0042b887
add ebx, esi
mov dword [edi], eax
mov eax, dword [ebp + 8]
cmp ebx, dword [ebp - 4]
push 3
pop ecx
cmovge eax, ecx
mov dword [ebp - 8], ebx
mov dword [ebp + 8], eax
jmp 0x402bcb
mov eax, dword [ebp + 8]
push eax
push edi
call fcn.0046d060
mov esi, eax
pop ecx
pop ecx
cmp esi, 5
je 0x402c80
cmp esi, 7
je 0x402c80
cmp esi, 8
jle 0x402bf6
cmp esi, 0xb
jle 0x402c80
cmp dword [edi + 0x14], 0
jbe 0x402c01
cmp esi, 1
jne 0x402c39
mov ecx, dword [ebp + 0x10]
lea edx, [ebp - 0x4014]
mov ebx, 0x4000
sub ebx, dword [edi + 0x14]
push ebx
mov eax, dword [ecx]
push edx
mov eax, dword [eax]
call eax
test al, al
je 0x402c80
add dword [ebp - 0xc], ebx
lea eax, [ebp - 0x4014]
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], 0x4000
cmp esi, 1
je 0x402c8e
mov ebx, dword [ebp - 8]
cmp dword [ebp + 0x14], 0
mov esi, dword [ebp - 4]
je 0x402b84
call sub.KERNEL32.dll_GetTickCount
mov esi, eax
push esi
push dword [ebp - 0x10]
call fcn.00458ebd
pop ecx
pop ecx
cmp eax, 0xc8
jbe 0x402b81
mov eax, dword [ebp - 0xc]
shl eax, 3
push eax
mov dword [ebp - 0x10], esi
mov esi, dword [ebp - 4]
push esi
push ebx
call dword [ebp + 0x14]
add esp, 0xc
test al, al
je 0x402b84
push edi
call fcn.0046d310
xor al, al
pop ecx
pop edi
pop esi
pop ebx
leave
ret
push edi
call fcn.0046d310
mov al, 1
jmp 0x402c88

Function at 0x403081
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 8], 0
je 0x4030df
mov eax, dword [ebp + 0xc]
cmp dword [eax + 8], 0x70b
jne 0x4030df
cmp dword [eax + 0xc], 0x202
jne 0x4030df
push dword [eax + 0x1c]
push dword [eax + 0x18]
lea eax, [ebp - 0xc]
push dword [ebp + 8]
push eax
call fcn.004037e6
add esp, 0x10
mov eax, 0x49bb64
cmp dword [ebp - 0xc], 0
cmovne eax, dword [ebp - 0xc]
xor ecx, ecx
push 5
push ecx
push ecx
push eax
push 0x49bf30
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0xc]
call fcn.00426528
leave
ret
Function at 0x409aeb
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x49a5f3
call fcn.0046bcf0
sub esp, 0x7c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor edi, edi
mov dword [ebp - 4], edi
push edi
push 0x44
pop esi
push esi
lea eax, [ebp - 0x88]
push eax
call fcn.0042a415
add esp, 0xc
mov dword [ebp - 0x88], esi
mov dword [ebp - 0x5c], 1
xor eax, eax
mov word [ebp - 0x58], ax
lea ecx, [ebp - 0x1c]
call fcn.00428bf1
lea eax, [ebp - 0x34]
push eax
call fcn.004416a0
mov esi, 0x49bb64
mov ecx, esi
cmp dword [eax], edi
cmovne ecx, dword [eax]
push edi
push 0x49f16c
push ecx
push 0x49f174
lea eax, [ebp - 0x1c]
push eax
call fcn.0042fa2c
add esp, 0x18
lea ecx, [ebp - 0x34]
call fcn.00426528
lea ecx, [ebp - 0x28]
call fcn.00428bf1
push dword [ebp + 8]
lea eax, [ebp - 0x34]
push eax
call fcn.0044621c
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.00425796
lea ecx, [ebp - 0x34]
call fcn.00426528
lea eax, [ebp - 0x28]
push eax
push 0x49f178
lea ecx, [ebp - 0x1c]
call fcn.0042473a
push 0x200
lea ecx, [ebp - 0x1c]
call fcn.00423da3
cmp dword [ebp - 0x1c], edi
cmovne esi, dword [ebp - 0x1c]
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x88]
push eax
push edi
push edi
push 0x10
push edi
push edi
push edi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x409bf5
push dword [ebp - 0x40]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x44]
call esi
lea ecx, [ebp - 0x28]
call fcn.00426528
lea ecx, [ebp - 0x1c]
call fcn.00426528
mov al, 1
jmp 0x409c2d
push edi
push edi
push edi
push dword [ebp + 8]
push 0x49bf30
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
setge bl
lea ecx, [ebp - 0x28]
call fcn.00426528
lea ecx, [ebp - 0x1c]
call fcn.00426528
mov al, bl
jmp 0x409c2d
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40c19f
Capabilities:
Terminate process

Disassembly:
mov eax, 0x49a611
call fcn.0046bcf0
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor esi, esi
mov dword [ebp - 4], esi
call fcn.00409e2c
mov eax, dword [0x4ddeb4]
test eax, eax
je 0x40c1df
push 6
push eax
call fcn.004644ac
push dword [0x4ddeb4]
call fcn.00463e6b
add esp, 0xc
mov dword [0x4ddeb4], esi
call fcn.0046489b
call fcn.0040e7f8
mov ecx, dword [0x4ddf2c]
test ecx, ecx
je 0x40c217
push esi
push 1
call fcn.00469016
mov ecx, dword [0x4ddf2c]
call fcn.004693f9
mov ecx, dword [0x4ddf2c]
call fcn.004681c7
mov dword [0x4ddf2c], esi
call fcn.004125d2
call dword [sym.imp.ole32.dll_OleUninitialize]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x422fd9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
mov dword [ebp - 4], edi
push dword [esi]
call fcn.004272e3
push dword [esi + 4]
mov ebx, eax
call fcn.004272e3
pop ecx
pop ecx
mov dword [ebp + 0xc], eax
add edi, 0x44
mov dword [ebp - 8], 8
xor ebx, dword [edi]
lea edi, [edi - 8]
mov edx, dword [ebp - 4]
mov eax, ebx
shr eax, 0x10
mov ecx, ebx
movzx eax, al
mov esi, dword [edi + 4]
shr ecx, 0x18
mov edx, dword [edx + eax*4 + 0x448]
mov eax, dword [ebp - 4]
add edx, dword [eax + ecx*4 + 0x48]
mov eax, ebx
mov ecx, dword [ebp - 4]
shr eax, 8
movzx eax, al
xor edx, dword [ecx + eax*4 + 0x848]
movzx eax, bl
add edx, dword [ecx + eax*4 + 0xc48]
mov ecx, dword [ebp + 0xc]
xor edx, esi
mov esi, dword [ebp - 4]
xor ecx, edx
mov eax, ecx
mov dword [ebp + 0xc], ecx
shr eax, 0x10
movzx eax, al
shr ecx, 0x18
mov edx, dword [esi + eax*4 + 0x448]
add edx, dword [esi + ecx*4 + 0x48]
mov ecx, dword [ebp + 0xc]
mov eax, ecx
shr eax, 8
movzx eax, al
xor edx, dword [esi + eax*4 + 0x848]
movzx eax, cl
add edx, dword [esi + eax*4 + 0xc48]
xor ebx, edx
sub dword [ebp - 8], 1
jne 0x423009
mov eax, dword [edi]
xor eax, ebx
push eax
call fcn.004272e3
mov esi, dword [ebp + 8]
mov dword [esi + 4], eax
mov eax, dword [edi - 4]
xor eax, dword [ebp + 0xc]
push eax
call fcn.004272e3
pop ecx
pop ecx
pop edi
mov dword [esi], eax
pop esi
pop ebx
leave
ret 8

Function at 0x423144
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
push dword [esi]
call fcn.004272e3
push dword [esi + 4]
mov ebx, eax
call fcn.004272e3
pop ecx
lea edx, [edi + 0x48]
mov dword [ebp - 4], eax
pop ecx
mov dword [ebp + 0xc], edx
mov dword [ebp - 8], 8
xor ebx, dword [edi]
lea edi, [edi + 8]
mov esi, dword [edi - 4]
mov eax, ebx
shr eax, 0x10
mov ecx, ebx
movzx eax, al
shr ecx, 0x18
mov edx, dword [edx + eax*4 + 0x400]
mov eax, dword [ebp + 0xc]
add edx, dword [eax + ecx*4]
mov eax, ebx
mov ecx, dword [ebp + 0xc]
shr eax, 8
movzx eax, al
xor edx, dword [ecx + eax*4 + 0x800]
movzx eax, bl
add edx, dword [ecx + eax*4 + 0xc00]
mov ecx, dword [ebp - 4]
xor edx, esi
mov esi, dword [ebp + 0xc]
xor ecx, edx
mov eax, ecx
mov dword [ebp - 4], ecx
shr eax, 0x10
movzx eax, al
shr ecx, 0x18
mov edx, dword [esi + eax*4 + 0x400]
add edx, dword [esi + ecx*4]
mov ecx, dword [ebp - 4]
mov eax, ecx
shr eax, 8
movzx eax, al
xor edx, dword [esi + eax*4 + 0x800]
movzx eax, cl
add edx, dword [esi + eax*4 + 0xc00]
xor ebx, edx
sub dword [ebp - 8], 1
mov edx, esi
jne 0x423174
mov eax, dword [edi]
xor eax, ebx
push eax
call fcn.004272e3
mov esi, dword [ebp + 8]
mov dword [esi + 4], eax
mov eax, dword [edi + 4]
xor eax, dword [ebp - 4]
push eax
call fcn.004272e3
pop ecx
pop ecx
pop edi
mov dword [esi], eax
pop esi
pop ebx
leave
ret 8