joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4024b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x406040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x40256c
cmp byte [esi + 0x3d], 0
je 0x40256c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x40255a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x402521
sub eax, 1
je 0x402525
sub eax, 2
jne 0x40255a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402dee
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x402543
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x40255a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402dee
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402dee
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.00402dee
mov esp, ebp
pop ebp
ret

Function at 0x4030ae
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
jmp 0x4030e3
mov ecx, dword [edx + 0xc]
cmp dword [ebp + 0xc], ecx
jb 0x4030e0
mov eax, dword [edx + 8]
add eax, ecx
cmp dword [ebp + 0xc], eax
jb 0x4030ec
add edx, 0x28
cmp edx, esi
jne 0x4030ce
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 0x4030e9

Function at 0x40368b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4036ca
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4036ca
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4036ca
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4036ca
cmp dword [ecx + 0x74], 0xe
jbe 0x4036ca
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x40ef6f
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x460
mov ebp, dword [esp + 0x478]
push 0x43d700
push dword [esp + 0x478]
call sub.msvcrt.dll_fopen
mov edi, eax
test edi, edi
pop eax
pop edx
jne 0x40ef9f
mov byte [ebp], 0
jmp 0x40efff
lea eax, [esp + 0x400]
push eax
call fcn.0040e544
push 0
push 0
push edi
call sub.msvcrt.dll_fseek
add esp, 0x10
jmp 0x40efc6
push eax
push ebx
push esi
call fcn.0040e579
add esp, 0xc
push edi
push 0x400
push 1
lea ebx, [esp + 0xc]
push ebx
call sub.msvcrt.dll_fread
add esp, 0x10
test eax, eax
lea esi, [esp + 0x400]
jne 0x40efbb
push 0
push ebx
push esi
call fcn.0040e579
push edi
call sub.msvcrt.dll_fclose
push esi
push ebp
call fcn.0040ee72
add esp, 0x18
add esp, 0x460
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40f33e
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x444610], 0
push edi
push esi
push ebx
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
je 0x40f40e
mov edx, dword [0x444b20]
mov eax, 0x40
sub eax, edx
cmp esi, eax
jl 0x40f3f3
mov eax, 0x40
xor ebx, ebx
sub eax, edx
push eax
add edx, 0x444ae0
push edi
push edx
call sub.msvcrt.dll_memcpy
push 0x444ae0
mov edx, dword [0x444b20]
mov eax, edi
push 0x444acc
sub eax, edx
lea esi, [esi + edx - 0x40]
lea edi, [eax + 0x40]
call fcn.00413244
mov ecx, dword [0x444ac8]
add esp, 0x14
movzx edx, byte [ebx + 0x444ae0]
mov eax, ecx
inc ecx
xor byte [eax + 0x444618], dl
cmp ecx, 0x4b0
mov eax, 0
cmovge ecx, eax
inc ebx
cmp ebx, 0x13
jle 0x40f3ab
mov dword [0x444ac8], ecx
cmp ecx, 0x13
jg 0x40f3df
call fcn.0040f21c
mov dword [0x444b20], 0
xor edx, edx
cmp esi, 0x40
jmp 0x40f365
push esi
mov eax, dword [0x444b20]
push edi
add eax, 0x444ae0
push eax
call sub.msvcrt.dll_memcpy
add dword [0x444b20], esi
add esp, 0xc
pop ebx
pop esi
pop edi
ret
Function at 0x417dea
Capabilities:
Get file size

Disassembly:
push ebp
xlatb
push esi
adc dword [ebx + 0x748b14ec], edx
and al, 0xa8
mov edi, dword [esp + 0x30]
push 0
push 0
push 3
push 0
push 1
push 0x80000000
sti
je 0x417e2f
cmp al, 0xe8
shr dword [edi - 0x3c76fffe], cl
xor eax, eax
cmp ebx, 0xffffffff
invalid
je 0x417e3b
push esi
push ebx
call sub.KERNEL32.dll_GetFileSize
mov dword [esi + 4], eax
mov eax, dword [esp + 0x2c]
or eax, edi
je 0x417e90
lea eax, [esp + 8]
push eax
lea eax, [esp + 4]
push eax
push 0
push ebx
call sub.KERNEL32.dll_GetFileTime
test edi, edi
je 0x417e73
push 0
push 0x98d680
push dword [esp + 0xc]
push dword [esp + 0xc]
call 0x4434e10
add eax, 0x49ef6f08
add esp, 0x10
les edx, [eax]
mov dword [edi], eax
xor dword [esp + 0x2c], 4
je 0x417ea8
push 0
push 0x989680
push dword [esp + 0x14]
push dword [esp + 0x14]
call fcn.0042ce10
add dword [eax], eax
add esp, 0x10
add eax, 0x49ef6f00
mov edx, dword [eax + 0x24]
sub al, 0x89
add cl, byte [ecx + 0x10c483e8]
push ebx
pop esi
pop edi
pop ebp
ret

Function at 0x417ee8
Capabilities:
Get file size

Disassembly:
inc ebx
push 0xffffffffffffff80
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push dword [esp + 0x20]
call sub.KERNEL32.dll_CreateFileA
mov ebx, eax
cmp eax, eax
cmp ebx, 0xffffffff
je 0x417f1a
push 4
push 1
call fcn.00401771
mov dword [eax], ebx
pop edx
pop ecx
pop edi
jecxz 0x417f74
inc esi
push ebx
mov edi, dword [ebp + 0x14]
push 0
push 0
push 3
push 0
push 0x41
push 0x40000000
push dword [esp + 0x28]
call sub.KERNEL32.dll_CreateFileA
mov ebx, eax
mov cl, 0xc0
cmp ebx, 0xffffffff
je 0x417f63
push 4
push 1
call 0xfc401771
mov byte [eax], bl
invalid
pop ebx
pop esi
pop edi
ret
je 0x417f9a
sbb byte [ecx - 0xe7cbbc], cl
xor al, ch
push 0x2d
add al, byte [eax]
mov edx, eax
or eax, 0xffffffff
test edx, edx
cmovne eax, dword [esp]
pop ecx
ret
inc esp
and al, 0x24
mul ecx
mov ebx, eax
mov eax, esp
and al, 0x20
add bl, 0
cmp byte [esi], 0xd5
mov esi, edx
adc esi, 0x19db1de
mul ecx
mov dword [esp], ebx
cdq
jl 0x417fdf
add al, 0x89
ror dword [ecx + 0xc181d3], 0x80
aad 0x8d
inc esp
and al, 8
adc bl, 0xde
mov cl, 0xdd
add dword [ecx - 0x76f3db84], ecx
dec esp
and al, 8
push eax
lea eax, [esi + 0x24]
and al, 0x50
push 0
mov eax, dword [esp + 0x28]
jmp dword [eax]
add byte [ebx - 0xd7dbbc], cl
and al, ch
adc dword [esi], ebp
add al, byte [eax]
add esp, 0x10
pop ebx
pop esi
ret

Function at 0x418197
Capabilities:
Get file attributes

Disassembly:
push ebx
sub esp, 0x140
mov ebx, dword [esp + 0x148]
push ebx
call sub.KERNEL32.dll_GetFileAttributesA
inc eax
mov edx, 1
jge 0x4181ce
mov eax, esp
push eax
push ebx
call 0x30c3ad64
xor edx, edx
cmp eax, 0xffffffff
je 0x4181ce
push eax
call sub.KERNEL32.dll_FindClose
mov edx, 2
add esp, 0x140
mov eax, edx
pop ebx
ret
Function at 0x41f114
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, esp
push eax
push 0x20019
push 0
push dword [esp + 0x18]
push dword [esp + 0x18]
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x41f153
push 0
push 0
push 0
push 0
push dword [esp + 0x20]
push dword [esp + 0x14]
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
jne 0x41f153
push dword [esp]
call sub.ADVAPI32.DLL_RegCloseKey
xor eax, eax
pop edx
ret

Function at 0x41f207
Capabilities:
Set registry value

Disassembly:
push edi
push eax
mov eax, esp
push eax
push 0x20006
push 0
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x41f262
cld
mov edi, dword [esp + 0x18]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
push ecx
push dword [esp + 0x1c]
push 1
push 0
push dword [esp + 0x24]
push dword [esp + 0x14]
call sub.ADVAPI32.DLL_RegSetValueExA
test eax, eax
mov edi, eax
je 0x41f258
push dword [esp]
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, edi
jmp 0x41f262
push dword [esp]
call sub.ADVAPI32.DLL_RegCloseKey
xor eax, eax
pop edi
pop edi
ret

Function at 0x41f265
Capabilities:
Delete registry value

Disassembly:
push ecx
mov eax, esp
push eax
push 2
push 0
push dword [esp + 0x18]
push dword [esp + 0x18]
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x41f299
push dword [esp + 0x10]
push dword [esp + 4]
call sub.ADVAPI32.DLL_RegDeleteValueA
test eax, eax
jne 0x41f299
push dword [esp]
call sub.ADVAPI32.DLL_RegCloseKey
xor eax, eax
pop edx
ret

Function at 0x41f820
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push esi
push ebx
mov ebx, dword [esp + 0xc]
mov esi, dword [esp + 0x10]
lea eax, [ebx - 1]
cmp eax, 8
jbe 0x41f83d
push str.bad_pack_level
call fcn.0042162d
pop eax
push 0x10000
push 0
push 0x488528
mov dword [0x447cc0], ebx
call sub.msvcrt.dll_memset
movzx eax, word [ebx*8 + 0x43bea2]
add esp, 0xc
cmp ebx, 1
mov dword [0x447cb0], eax
movzx eax, word [ebx*8 + 0x43bea0]
mov dword [0x44b958], eax
movzx eax, word [ebx*8 + 0x43bea4]
mov dword [0x44b978], eax
movzx eax, word [ebx*8 + 0x43bea6]
mov dword [0x44b948], eax
jne 0x41f898
movzx eax, word [esi]
or eax, 4
jmp 0x41f8a3
cmp ebx, 9
jne 0x41f8a6
movzx eax, word [esi]
or eax, 2
mov word [esi], ax
push 0x10000
push 0x458268
mov dword [0x44b928], 0
mov dword [0x44b968], 0
call dword [0x44b908]
pop ebx
mov ecx, eax
test eax, eax
mov dword [0x447ca0], eax
sete al
cmp ecx, 0xffffffff
pop esi
sete dl
or eax, edx
test al, 1
je 0x41f8fa
mov dword [0x447c90], 0
cmp ecx, 0x105
ja 0x41f926
call fcn.0041f71c
cmp dword [0x447ca0], 0x105
ja 0x41f926
cmp dword [0x447c90], 0
je 0x41f90c
mov dword [0x447c80], 0
xor ecx, ecx
xor edx, edx
movzx eax, byte [ecx + 0x458268]
shl edx, 5
inc ecx
xor edx, eax
and edx, 0x7fff
cmp ecx, 1
jbe 0x41f934
mov dword [0x447c80], edx
Function at 0x421500
Capabilities:
Hash data with crc32

Disassembly:
push ebx
or edx, 0xffffffff
mov ebx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
test ebx, ebx
je 0x421530
mov edx, dword [0x43c620]
test ecx, ecx
je 0x421530
movzx eax, byte [ebx]
inc ebx
xor al, dl
movzx eax, al
shr edx, 8
xor edx, dword [eax*4 + 0x43c220]
dec ecx
jmp 0x421518
pop ebx
mov dword [0x43c620], edx
not edx
mov eax, edx
ret

Function at 0x434240
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov eax, 0x10
mov ebp, esp
push ebx
sub esp, 0x64
and esp, 0xfffffff0
call fcn.00434ad0
call fcn.004343f0
call sub.KERNEL32.dll_GetCommandLineA
mov ebx, eax
lea eax, [ebp - 0x58]
mov dword [esp], eax
call sub.KERNEL32.dll_GetStartupInfoA
sub esp, 4
test ebx, ebx
jne 0x434278
jmp 0x434314
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
or eax, edx
test al, 1
jne 0x434277
cmp cl, 0x22
je 0x4342d0
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test edx, eax
je 0x4342f0
lea esi, [esi]
lea edi, [edi]
test cl, cl
je 0x4342f0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test edx, eax
jne 0x4342b0
jmp 0x4342f0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x22
setne al
xor edx, edx
test cl, cl
setne dl
test edx, eax
jne 0x4342d0
cmp cl, 0x22
je 0x434350
lea esi, [esi]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
jmp 0x43430e
inc ebx
movzx eax, byte [ebx]
cmp al, 0x20
sete dl
cmp al, 9
sete al
or eax, edx
test al, 1
jne 0x434300
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
test byte [ebp - 0x2c], 1
mov edx, 0xa
je 0x434332
movzx edx, word [ebp - 0x28]
mov dword [esp + 0xc], edx
xor edx, edx
mov dword [esp + 8], ebx
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0041b694
sub esp, 0x10
mov ebx, dword [ebp - 4]
leave
ret
inc ebx
movzx ecx, byte [ebx]
jmp 0x4342f0

Function at 0x434410
Capabilities:
Write file on windows

Disassembly:
push ebp
mov edx, 0x17
mov ebp, esp
push ebx
sub esp, 0x14
lea ebx, [ebp + 0xc]
mov dword [esp + 8], edx
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp], str.Mingw_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
mov eax, 1
mov dword [esp + 4], eax
call sub.msvcrt.dll_fwrite
mov dword [esp + 8], ebx
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]
lea edi, [edi]
Function at 0x434470
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov dword [ebp - 4], edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], ebx
mov ebx, eax
test edi, edi
mov dword [ebp - 8], esi
mov esi, edx
jne 0x434497
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [esp], ebx
mov eax, 0x1c
mov dword [esp + 8], eax
lea eax, [ebp - 0x38]
mov dword [esp + 4], eax
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x434545
mov eax, dword [ebp - 0x24]
cmp eax, 0x40
setne dl
cmp eax, 4
setne al
movzx eax, al
test eax, edx
jne 0x43451e
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x24]
cmp eax, 0x40
setne dl
cmp eax, 4
setne al
movzx eax, al
test eax, edx
je 0x43448a
lea eax, [ebp - 0x3c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x3c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
jmp 0x43448a
lea eax, [ebp - 0x3c]
mov ecx, 0x40
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
jmp 0x4344d0
mov dword [esp + 8], ebx
mov ebx, 0x1c
mov dword [esp + 4], ebx
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00434410
nop

Function at 0x437400
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0xbc
mov eax, dword [esp + 0xd4]
and dword [esp + 0xd0], 0x3000
mov ebx, dword [esp + 0xdc]
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0xd0]
mov word [esp + 0x64], 0
mov dword [esp], str.PRINTF_EXPONENT_DIGITS
mov dword [esp + 0x54], eax
mov eax, 0xffffffff
mov dword [esp + 0x58], eax
mov eax, 0xffffffff
mov dword [esp + 0x5c], eax
mov eax, 0xfffffffd
mov dword [esp + 0x60], eax
xor eax, eax
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0xd8]
mov dword [esp + 0x6c], eax
call sub.msvcrt.dll_getenv
test eax, eax
je 0x437558
movsx eax, byte [eax]
sub eax, 0x30
cmp eax, 2
ja 0x437558
mov edx, 2
mov dword [esp + 0x70], edx
mov eax, dword [esp + 0x50]
mov dword [esp + 0xa0], edx
mov dword [esp + 0x80], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x8c], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x90], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 0x94], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 0x98], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x9c], eax
call fcn.0043ac50
test al, 1
mov edx, 3
je 0x43748d
jmp 0x437488
Function at 0x4022f0
Capabilities:
Parse pe header

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call edi
push 0
call edi
mov eax, dword [esp + 0x1c]
cmp word [eax], 0x5a4d
je 0x40231a
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
mov esi, dword [eax + 0x3c]
add esi, eax
mov dword [esp + 0x14], esi
cmp dword [esi], 0x4550
je 0x402335
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
push 0
call edi
mov eax, dword [esi + 0x50]
mov ecx, dword [esi + 0x34]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 4
push 0x2000
push eax
push ecx
call edi
mov ebp, eax
test ebp, ebp
jne 0x402372
mov edx, dword [esi + 0x50]
push 4
push 0x2000
push edx
push eax
call edi
mov ebp, eax
test ebp, ebp
jne 0x402372
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
push 0x14
push 0
call dword [0x409468]
push eax
call dword [0x409460]
mov ebx, eax
xor eax, eax
push eax
mov dword [ebx + 4], ebp
mov dword [ebx + 0xc], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0x10], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esi + 0x50]
push 4
push 0x1000
push eax
push ebp
call edi
mov ecx, dword [esi + 0x54]
push 4
push 0x1000
push ecx
push ebp
call edi
mov edi, eax
push 0
mov dword [esp + 0x14], edi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x1c]
mov edx, dword [esi + 0x54]
mov esi, eax
push ebx
mov ecx, dword [eax + 0x3c]
add ecx, edx
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, dword [esp + 0x14]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x18]
mov ecx, eax
push esi
push ecx
mov eax, dword [ecx + 0x3c]
add eax, edx
mov dword [ebx], eax
mov dword [eax + 0x34], ebp
call fcn.00402470
mov ecx, dword [esi + 0x34]
mov eax, ebp
add esp, 0xc
sub eax, ecx
je 0x402412
push eax
push ebx
call fcn.00402650
add esp, 8
push ebx
call fcn.004026e0
add esp, 4
test eax, eax
je 0x402442
push ebx
call fcn.00402550
mov eax, dword [ebx]
add esp, 4
mov eax, dword [eax + 0x28]
test eax, eax
je 0x40245c
add eax, ebp
test eax, eax
je 0x402442
push 0
push 1
push ebp
call eax
test eax, eax
jne 0x402455
push ebx
call fcn.004028d0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov dword [ebx + 0x10], 1
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 8
ret
Function at 0x402470
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call esi
mov eax, dword [esp + 0x1c]
xor ecx, ecx
mov dword [esp + 0xc], 0
mov ebp, dword [eax + 4]
mov eax, dword [eax]
mov cx, word [eax + 0x14]
cmp word [eax + 6], 0
lea ebx, [ecx + eax + 0x18]
jbe 0x402549
push edi
add ebx, 0x10
jmp 0x4024b0
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebx]
push 0
test eax, eax
jne 0x4024f2
call esi
mov edx, dword [esp + 0x1c]
mov esi, dword [edx + 0x38]
test esi, esi
jle 0x402528
mov eax, dword [ebx - 4]
push 4
push 0x1000
add eax, ebp
push esi
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, esi
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [ebx - 8], edi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
jmp 0x402528
call esi
mov ecx, dword [ebx - 4]
mov eax, dword [ebx]
push 4
push 0x1000
add ecx, ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [ebx]
mov esi, dword [ebx + 4]
mov edi, dword [esp + 0x18]
mov edx, ecx
add esi, edi
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebx - 8], eax
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
inc eax
add ebx, 0x28
mov edx, dword [ecx]
xor ecx, ecx
mov dword [esp + 0x10], eax
mov cx, word [edx + 6]
cmp eax, ecx
jl 0x4024aa
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x402550
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
xor ecx, ecx
push ebx
mov dword [esp + 4], 0
mov eax, dword [eax]
mov cx, word [eax + 0x14]
cmp word [eax + 6], 0
lea ebx, [ecx + eax + 0x18]
jbe 0x402649
push ebp
push esi
push edi
add ebx, 0x24
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebx]
push 0
mov esi, eax
mov edi, eax
shr esi, 0x1d
shr edi, 0x1e
shr eax, 0x1f
and esi, 1
and edi, 1
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
test dword [ebx], 0x2000000
je 0x4025c1
mov edx, dword [ebx - 0x14]
mov eax, dword [ebx - 0x1c]
push 0x4000
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x402626
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebx]
lea ecx, [edi + esi*2]
test eax, 0x4000000
lea edx, [ebp + ecx*2]
mov edi, dword [edx*4 + 0x408d9c]
je 0x4025e6
or edi, 0x200
mov esi, dword [ebx - 0x14]
test esi, esi
jne 0x402609
test al, 0x40
je 0x4025fc
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov esi, dword [ecx + 0x20]
jmp 0x402609
test al, 0x80
je 0x402609
mov edx, dword [esp + 0x1c]
mov eax, dword [edx]
mov esi, dword [eax + 0x24]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
jbe 0x402626
mov edx, dword [ebx - 0x1c]
lea ecx, [esp + 0x14]
push ecx
push edi
push esi
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
inc eax
add ebx, 0x28
mov edx, dword [ecx]
xor ecx, ecx
mov dword [esp + 0x10], eax
mov cx, word [edx + 6]
cmp eax, ecx
jl 0x40257d
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x40c502
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
xor ecx, ecx
cmp edi, esi
jbe 0x40c52c
mov eax, dword [ebp + 8]
add eax, 0xc
cmp dword [eax - 0xc], esi
je 0x40c587
mov dword [eax - 4], esi
mov byte [eax], 0
inc ecx
add eax, 0x10
cmp ecx, edi
jb 0x40c519
mov eax, edi
imul eax, eax, 0x24
push ebx
push 0x40
push 0x3000
push eax
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ebx, eax
cmp ebx, esi
je 0x40c593
mov dword [ebp - 4], esi
cmp edi, esi
jbe 0x40c57b
mov esi, dword [ebp + 8]
add esi, 8
mov edi, dword [esi - 8]
push ebx
push dword [esi - 4]
call fcn.00432307
test eax, eax
je 0x40c57b
mov dword [esi], ebx
add ebx, eax
inc dword [ebp - 4]
mov byte [esi + 4], al
mov eax, dword [ebp - 4]
add esi, 0x10
cmp eax, dword [ebp + 0xc]
jb 0x40c556
mov eax, dword [ebp + 0xc]
cmp dword [ebp - 4], eax
jne 0x40c58b
mov al, 1
jmp 0x40c595
xor al, al
jmp 0x40c596
mov ecx, dword [ebp + 8]
call fcn.0040c42a
xor al, al
pop ebx
pop edi
pop esi
leave
ret 8
Function at 0x40fcea
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [edi + 0x180]
sub esp, 0x2c8
push ebx
push esi
test eax, eax
je 0x40fd13
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x40fdb2
lea esi, [edi + 0x17c]
call fcn.0042ef68
push 1
lea ebx, [ebp - 0x2c8]
call fcn.004196cc
xor ebx, ebx
push ebx
lea eax, [ebp - 0xc0]
push eax
push 0x2937498d
call fcn.004191dd
push 0x44
pop edx
push edx
push ebx
lea eax, [ebp - 0x58]
push eax
call fcn.0042c138
push dword [edi + 0xc]
lea eax, [ebp - 0xc0]
mov dword [ebp - 0x58], edx
mov dword [ebp - 0x50], eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x58]
push eax
push ebx
push 0x4081d8
lea eax, [ebp - 0x2c8]
push eax
call fcn.0042ee20
test eax, eax
jne 0x40fd84
xor al, al
jmp 0x40fdb4
push 0x10
lea eax, [ebp - 0x10]
push eax
push esi
call fcn.0042c0c1
push 0x3e8
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x40fdb2
push ebx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
call fcn.0042ef68
jmp 0x40fd80
mov al, 1
pop esi
pop ebx
leave
ret