joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4066f0
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x40b1fb
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x411028]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
lea ecx, [esp + 0xc]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_class]
push str.settings.ini
lea esi, [esp + 0x10]
mov dword [esp + 0x2c], 0
call fcn.00403450
add esp, 4
test eax, eax
je 0x4067df
push 0
call dword [sym.imp.MSVCR90.dll__time64]
mov dword [esp + 0x1c], eax
add esp, 4
lea eax, [esp + 0x18]
push eax
lea esi, [esp + 0x18]
mov dword [esp + 0x20], edx
call fcn.00409270
lea ecx, [esp + 0x10]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_class]
mov byte [esp + 0x28], 2
mov ecx, dword [esp + 0xc]
push ecx
push 0x64
push 0x64
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90u.dll_ATL::CSimpleStringT_wchar_t_1_::GetBuffer]
push eax
push 0x40cfc8
push str.DefrageTime
push str.RegDefrag
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov edx, dword [esp + 0x14]
push edx
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::Compare]
mov esi, eax
neg esi
sbb esi, esi
lea ecx, [esp + 0x10]
inc esi
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ecx, [esp + 0xc]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret
lea ecx, [esp + 0xc]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret
Function at 0x406800
Capabilities:
Check if file exists
Copy file
Delete file
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x40b1bb
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x411028]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
lea ecx, [esp + 0xc]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_class]
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_class]
lea ecx, [esp + 8]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_class]
mov byte [esp + 0x20], 2
cmp dword [0x41174c], 0
mov dword [esp + 0x14], 0
je 0x406880
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x41174c]
cmp dword [esp + 0x14], 0
je 0x406880
push str.Nativewxp_x64RegBootDefrag.exe
jmp 0x406885
push str.Nativewxp_x86RegBootDefrag.exe
lea esi, [esp + 0x10]
call fcn.00403450
add esp, 4
push str.RegBootDefrag
lea ecx, [esp + 0x14]
push str.__SystemRoot__System32_s.exe
push ecx
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::Format]
mov esi, dword [esp + 0x1c]
add esp, 0xc
push 0x104
push 0x104
lea ecx, [esp + 0x10]
call dword [sym.imp.mfc90u.dll_ATL::CSimpleStringT_wchar_t_1_::GetBuffer]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0xffffffffffffffff
lea ecx, [esp + 0xc]
call dword [sym.imp.mfc90u.dll_ATL::CSimpleStringT_wchar_t_1_::ReleaseBuffer]
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4068ef
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
push 0
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea ecx, [esp + 8]
mov esi, eax
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ecx, [esp + 0x10]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ecx, [esp + 0xc]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x1c
ret
Function at 0x406940
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x40af99
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x411028]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
lea eax, [esp + 0x18]
push eax
push str.SYSTEMCurrentControlSetControlSession_Manager
push Ordinal_4
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
xor ebx, ebx
cmp eax, ebx
jne 0x406a53
push str.autocheck_autochk_
lea ecx, [esp + 0x18]
call dword [0x40c618]
mov dword [esp + 0x28], ebx
mov edx, dword [esp + 0x14]
mov esi, dword [edx - 0xc]
lea esi, [esi + esi + 2]
mov eax, str.RegBootDefrag
mov edi, esi
lea ebp, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4069b0
sub eax, ebp
sar eax, 1
je 0x406a16
mov eax, str.RegBootDefrag
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4069d0
sub eax, edx
sar eax, 1
lea ebp, [eax + eax + 2]
lea edi, [esi + ebp]
push edi
call sub.mfc90u.dll_new__
mov ecx, dword [esp + 0x18]
push esi
push ecx
mov ebx, eax
push edi
push ebx
call dword [sym.imp.MSVCR90.dll_memcpy_s]
push ebp
mov edx, edi
push str.RegBootDefrag
sub edx, esi
push edx
lea eax, [ebx + esi]
push eax
call dword [sym.imp.MSVCR90.dll_memcpy_s]
add esp, 0x24
jmp 0x406a24
push esi
push edx
push esi
push 0
call dword [sym.imp.MSVCR90.dll_memcpy_s]
add esp, 0x10
mov ecx, dword [esp + 0x18]
push edi
push ebx
push 7
push 0
push str.BootExecute
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [esp + 0x18]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x406a70
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 8
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
push esi
push edi
lea eax, [esp + 0xc]
push eax
push str.SYSTEMCurrentControlSetControlSession_Manager
push Ordinal_4
call ebp
mov esi, eax
test esi, esi
jne 0x406b4e
mov edx, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0x10]
push ecx
push eax
push eax
push eax
push str.BootExecute
push edx
mov dword [esp + 0x28], eax
call esi
mov eax, dword [esp + 0x10]
push eax
call sub.mfc90u.dll_new__
mov edx, dword [esp + 0x10]
add esp, 4
lea ecx, [esp + 0x10]
push ecx
mov edi, eax
push edi
push 0
push 0
push str.BootExecute
push edx
call esi
mov esi, eax
test esi, esi
je 0x406afd
push edi
call sub.mfc90u.dll_delete__
mov eax, dword [esp + 0x10]
add esp, 4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebp
add esp, 8
ret
mov ecx, dword [esp + 0xc]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call ebx
lea edx, [esp + 0x10]
push edx
push str.SOFTWAREGlarySoftRegistryDefrag
push Ordinal_4
call ebp
mov esi, eax
test esi, esi
jne 0x406b44
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push eax
push edi
push 7
push esi
push str.BootExecute
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [esp + 0x10]
push edx
mov esi, eax
call ebx
push edi
call sub.mfc90u.dll_delete__
add esp, 4
pop ebx
pop edi
mov eax, esi
pop esi
pop ebp
add esp, 8
ret
Function at 0x40a4b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411028]
jne 0x40a4ba
repz ret
jmp fcn.0040a9de
Function at 0x4287df
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
cmp dword [0x45aa24], 0
je 0x428816
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
call main
add esp, 4
jmp 0x42882f
call main
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
call main
add esp, 4
jmp 0x42882f
pop edi
pop esi
pop ebx
leave
ret

Function at 0x449b86
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x449b95
pop dword [ebp - 0xc]
mov eax, 0x70b23307
sub eax, 0x706d9772
sub dword [ebp - 0xc], eax
push 0x40
push 0x1000
push 0x4be16
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0xc]
call dword [eax]
mov ecx, 0x308deb46
sub ecx, 0x308daa8c
xor edi, edi
add edi, eax
mov ebx, 0x91815cfd
sub ebx, 0x91387cfd
add ebx, dword [ebp - 0xc]
mov edx, 0x56486419
mov esi, dword [ebx]
add dword [ebp - 8], eax
xor esi, edx
add dword [ebp - 8], 0xab7ec1bd
mov dword [edi], esi
add dword [ebp - 8], 0xe5adfdfe
add edi, 0xb6e13317
sub edi, 0xb6e13313
add ebx, 0xd2eff1cb
sub ebx, 0xd2eff1c7
loop 0x449beb
add eax, 0xe207f0b1
add eax, 0x1df9050a
mov ebx, eax
add eax, 0x47509678
add eax, 0xb8af698d
mov ecx, 0x400000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret

Function at 0x44c8c0
Capabilities:
Move file

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push eax
push ecx
call dword [sym.imp.kernel32.dll_MoveFileA]
test eax, eax
mov eax, 0
jne 0x44c8df
call dword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
je 0x44c8f2
push eax
call fcn.0044d700
add esp, 4
mov eax, 0xffffffff
ret
xor eax, eax
ret
Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x433072
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x56934096
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
mov eax, section..rsrc
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x36ad635d
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219

Function at 0x4738aa
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x4735cc
or edi, edi
call fcn.004738e5
and edi, ebx
xor dword [eax], ecx
or edi, ebx
or edi, edi
add eax, 2
add ebx, 0xef210077
add ebx, 0xef65d982
cmp eax, edx
jl fcn.004738aa
and edi, ebx
mov ebx, 0x8698ad78
sub edi, 0xa2579b49
ret
Function at 0x461f20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x455015
lea edi, [esi - 0x54015]
push edi
or ebp, 0xffffffff
jmp 0x461f42
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x461f49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x461f38
mov eax, 1
add ebx, ebx
jne 0x461f5b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x461f50
jne 0x461f6c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x461f50
xor ecx, ecx
sub eax, 3
jb 0x461f80
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x461ff2
mov ebp, eax
add ebx, ebx
jne 0x461f8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x461f98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x461fbc
inc ecx
add ebx, ebx
jne 0x461fa8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x461f9d
jne 0x461fb9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x461f9d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x461fdc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x461fcd
jmp 0x461f3e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x461fdc
add edi, ecx
jmp 0x461f3e
pop esi
mov edi, esi
mov ecx, 0x32d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x461ffa
cmp byte [edi], 0
jne 0x461ffa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x461fff
lea edi, [esi + 0x5f000]
mov eax, dword [edi]
or eax, eax
je 0x46206e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x621f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x62254]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x46202c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x62258]
or eax, eax
je 0x462068
mov dword [ebx], eax
add ebx, 4
jmp 0x462049
call dword [esi + 0x6225c]
popal
jmp 0x4095a4

Function at 0x5d8e56
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x5d8b64
mov ecx, ebx
dec ebx
sub ebx, 0xc9fd45bf
call fcn.005d8ea2
add ebx, ebx
xor dword [eax], edi
add ebx, 0x62af2f04
add eax, 2
sub ebx, 0x4ff71c68
sub ebx, ecx
sub esp, 4
mov dword [esp], 0xc8970e26
pop ecx
cmp eax, esi
jl fcn.005d8e56
inc ebx
add ebx, ebx
ret
Function at 0x100022e0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100086ed
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x100100b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov dword [ebp - 0x5c], edi
mov esi, ecx
lea eax, [ebp - 0x50]
mov dword [ebp - 4], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp + 0xc]
test esi, esi
mov edx, dword [ebp + 8]
mov eax, edi
cmove esi, dword [ebp - 0x48]
xorps xmm0, xmm0
sub ecx, edx
movq qword [ebp - 0x1c], xmm0
sar ecx, 2
sub eax, ecx
mov dword [ebp - 0x14], 0
movups xmmword [ebp - 0x2c], xmm0
cmp esi, eax
jae 0x100023f6
push 0x1c
lea eax, [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x54], edi
test eax, eax
je 0x100023e0
test dword [ebp - 0x18], 0x301
jne 0x100023d9
test dword [ebp - 0x1c], 0x1000
je 0x100023d9
mov edx, dword [ebp - 0x54]
mov edi, dword [ebp - 0x2c]
sub edx, ecx
sar edx, 2
mov eax, edi
sub eax, edx
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x58], eax
cmp edi, eax
jae 0x100023d6
xor eax, eax
test edx, edx
je 0x100023cd
nop dword [eax]
cmp edx, eax
jbe 0x10002450
mov esi, dword [ecx + eax*4]
inc eax
cmp esi, 0xffffffff
je 0x100023bd
movzx ecx, byte [eax + edi - 1]
cmp esi, ecx
jne 0x100023cd
mov ecx, dword [ebp + 8]
cmp eax, edx
je 0x100023c5
jb 0x100023a0
jmp 0x100023cd
test edi, 0x7ff
je 0x10002424
mov ecx, dword [ebp + 8]
inc edi
cmp edi, dword [ebp - 0x58]
jb 0x10002397
mov edi, dword [ebp - 0x54]
mov esi, dword [ebp - 0x2c]
dec esi
add esi, dword [ebp - 0x20]
mov edx, dword [ebp + 8]
inc esi
mov eax, dword [ebp - 0x5c]
sub edi, edx
sar edi, 2
sub eax, edi
cmp esi, eax
jb 0x10002352
xor edi, edi
test edx, edx
je 0x10002433
mov ecx, dword [ebp + 0x10]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x10002429
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10002429
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
mov edx, dword [ebp + 8]
jmp 0x100023f8
push ecx
push edx
call fcn.10007c26
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100078ce
mov esp, ebp
pop ebp
ret
call fcn.10004290
int3
Function at 0x10002580
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x434
mov eax, dword [0x100100b4]
xor eax, esp
mov dword [esp + 0x430], eax
push ebx
push esi
push edi
push 0x424
lea eax, [esp + 0x18]
mov esi, ecx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0
push 8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
mov dword [esp + 0x10], 0x428
lea eax, [esp + 0x10]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x100025fe
mov edi, dword [sym.imp.KERNEL32.dll_Module32NextW]
nop dword [eax]
mov ecx, dword [esp + 0x24]
cmp esi, ecx
jb 0x100025f2
mov eax, dword [esp + 0x28]
add eax, ecx
cmp esi, eax
jbe 0x10002618
lea eax, [esp + 0x10]
push eax
push ebx
call edi
test eax, eax
jne 0x100025e0
mov eax, 0x1000a470
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x430]
xor ecx, esp
call fcn.100078ce
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x43c]
lea eax, [esp + 0x30]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100078ce
mov esp, ebp
pop ebp
ret

Function at 0x10003f60
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, 1
movzx eax, byte [esi + 1]
mov cl, byte [esi]
mov byte [0x10017b11], al
movzx eax, byte [esi + 2]
mov byte [0x100178d2], cl
mov byte [0x100178d3], al
test cl, cl
je 0x10003fe1
push edi
add esi, 4
mov ecx, 0x41
mov edi, 0x100178d8
rep movsd dword es:[edi], dword [esi]
mov esi, dword [sym.imp.VCRUNTIME140.dll_wcsstr]
push str.everymodule
push 0x100178d8
call esi
movzx ecx, byte [0x100178d1]
test eax, eax
push str.onstartup
cmovne ecx, ebx
push 0x100178d8
mov byte [0x100178d1], cl
call esi
movzx ecx, byte [0x10017b10]
add esp, 0x10
test eax, eax
cmovne ecx, ebx
mov byte [0x10017b10], cl
pop edi
push 0
push 0
push 0
push 0x100037f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop esi
mov eax, ebx
pop ebx
pop ebp
ret
Function at 0x4013c5
Capabilities:
Encode data using xor

Disassembly:
jmp 0x4159d0
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x415b79
push ebx
mov ebx, dword [esp + 0x10]
nop word [eax + eax]
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
sub byte [esi + ebx], 0x7c
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x29
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
xor byte [esi + ebx], 0x44
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x2d
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x6b
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
add esp, 0x44
push eax
call fcn.0040616d
add byte [esi + ebx], 4
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0xf7
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x87
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
dec byte [esi + ebx]
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x64
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0xd0
add esp, 0x40
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x54
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
xor byte [esi + ebx], 0xb0
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0xe3
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x39
add esp, 0x30
inc esi
cmp esi, edi
jb 0x4159f0
pop ebx
pop edi
pop esi
ret

Function at 0x4035f3
Capabilities:
Terminate process

Disassembly:
jmp 0x453df9
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x453e0a
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405948
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x40371f
Capabilities:
Query environment variable

Disassembly:
jmp 0x49c842
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x49c853
pop esi
ret
push ebx
push edi
push esi
call fcn.0049c729
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403fe4
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x49c87b
push ebx
push esi
push edi
call fcn.0040572c
add esp, 0xc
push 0
call fcn.004062b2
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret