joyce8/EMBER2024-capa huggingface dataset:
Function at 0x11cb13a
Capabilities:
Authenticate hmac
Packed with generic packer
Parse pe header

Disassembly:
push edx
movzx dx, bl
cdq
not dl
mov edx, 1
jmp 0x125cc4f
nop
jmp 0x137b7b8
nop
jmp 0x167740a
nop
jmp 0x11fe888
nop
jmp 0x16ac929
nop
jmp 0x181ea4d
nop
nop
jmp 0x12f3818
nop
jmp 0x104c94c
nop
nop
jmp 0x185040a
nop
jmp 0x112ec59
nop
jmp 0x13e01bd
nop
jmp 0x178cc17
nop
jmp 0x134dfab
nop
jmp 0x15f72de
nop
jmp 0x15cf20d
nop
jmp 0x10bba0e
push ebp
sbb ebp, 0x1e722c44
clc
bswap ebp
mov ebp, esp
clc
stc
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
jmp 0x1666acf
nop
nop
jmp 0x170b580
nop
jmp 0xfeb630
mov edx, 2
bswap dx
mov edx, 4
seta dl
movzx edx, sp
mov edx, 2
mov edx, 5
mov edx, 4
movsx edx, sp
mov dx, bx
mov edx, 2
setp dl
cdq
mov dx, bp
mov edx, 5
cmovs dx, dx
jmp 0x143278c
nop
jmp 0x14289ab
nop
jmp 0x116ae55
nop
jmp 0x187bf49
nop
jmp 0x10b3ad9
nop
jmp 0x1503341
jmp 0x14fad4a
nop
nop
jmp 0x137110e
nop
jmp 0x187040a
nop
jmp 0x1788b11
nop
jmp 0x158ef0e
nop
nop
jmp 0x10268ed
nop
jmp 0x15ef862
nop
jmp 0x177d507
nop
jmp 0x12cabc2
stosd dword es:[edi], eax
xchg ah, ah
lodsd eax, dword [esi]
stosd dword es:[edi], eax
jmp 0x12def82
nop
nop
jmp 0x150d9ac
nop
jmp 0x1872a0a
nop
jmp 0x161db18
mov edx, 5
cdq
pop edx
nop
jmp 0x14840fb
nop
jmp 0x10fc1be
nop
jmp 0x16be55f
nop
jmp 0x14d8461
nop
jmp 0x11716db
nop
jmp 0x16fe183
nop
jmp 0x1523094
pushal
mov di, dx
cdq
mov eax, 1
bswap edx
mov eax, 2
mov eax, 4
cwd
mov eax, 2
mov eax, 5
lahf
movzx ebp, bx
mov eax, 4
bswap esi
cbw
movsx ebp, bp
mov eax, 2
mov eax, 5
mov eax, 6
movzx edx, sp
lahf
popal
jmp 0xf4958b
nop
jmp 0x1710e29
nop
jmp 0x13573ff
nop
jmp 0x14c068a
nop
jmp 0x176ccde
nop
jmp 0x11b017a
nop
jmp 0x1532f12
nop
nop
jmp 0x1697bbb
nop
jmp 0x17e051f
nop
nop
nop
nop
jmp 0x18830d9
nop
jmp 0x16b77fc
nop
jmp 0x12963c5
push 8
call fcn.0051ff12
add esp, 4
xchg si, di
cmovs edi, ebp
mov dword [ebp - 0x10], eax
mov di, ax
movzx edi, bx
mov edi, eax
not ah
cwde
mov esi, 0x5c1211
lodsd eax, dword [esi]
jmp 0x13cd4e1
nop
jmp 0x11cf51a
nop
nop
jmp 0x139ee16
nop
jmp 0x161d771
nop
jmp 0xf8d44a
nop
jmp 0x41f45b
nop
jmp 0x1612e7e
nop
nop
jmp 0x126f754
nop
jmp 0x17d1631
nop
jmp 0x17670e2
nop
jmp 0x16c2ba3
nop
nop
jmp 0x16c985a
nop
jmp 0x1287b25
nop
jmp 0x14804f4
nop
nop
jmp 0x11805fd
nop
nop
nop
jmp 0x14a83c6
nop
nop
nop
jmp 0x104767d
nop
jmp 0x14289b1
nop
jmp 0x139a672
nop
jmp 0x128182b
nop
jmp 0x143f1dd
nop
nop
jmp 0x10eb3ce
nop
nop
jmp 0x1398fc9
nop
jmp 0x1726f61
nop
nop
nop
jmp 0x10cc23a

Function at 0x125d67e
Capabilities:
Encode data using base64
Packed with generic packer

Disassembly:
push 8
call fcn.0051ff12
add esp, 4
mov dword [ebp - 0x18], eax
cmovbe esi, eax
mov edi, eax
bswap eax
mov esi, 0x5c1211
not al
mov eax, esi
lahf
lodsd eax, dword [esi]
jmp loc.0041f484
push ebp
mov ebp, esp
sub esp, 0x30
jmp 0x1576945
mov dword [ebp - 0xc], 0
jmp 0x163aae2
mov dword [ebp - 0x14], 0
jmp 0xff30aa
mov dword [ebp - 4], 0
jmp 0x161a335
mov dword [ebp - 8], 0
jmp 0x13e38aa
mov dword [ebp - 0x10], 0
jmp 0x13fd631
Function at 0x17c1a81
Capabilities:
Packed with generic packer

Disassembly:
nop
jmp 0x11760dc
nop
jmp 0x141caad
jmp 0x13335b9
nop
jmp 0x16b4ecd
nop
jmp 0x1034615
nop
nop
jmp 0x13ee2c1
push 0x60
jmp 0x10dfe38
nop
jmp 0x15473e1
call fcn.0051ff12
lea esp, [esp + 4]
rcl cl, 0x3c
mov dword [ebp - 4], eax
xor cx, 0x887
and cx, si
mov edi, edi
mov ebx, eax
jmp 0x1518895
nop
jmp 0x15d7026
rep stosd dword es:[edi], eax
test eax, 0x3fa25e7d
stc
add ebx, 0x1c
jmp 0x1655d35
popal
jmp 0x169db92
push 0x24
call fcn.0051ff12
add esp, 4
add cx, sp
rol cl, cl
pop ebx
and ch, 0x5e
add ch, 0x75
push ebx
mov dword [ebx], eax
sub cx, cx
adc ebx, 0x96b75cd
sub cx, 0x2eae
mov ebx, eax
dec edi
sete ch
inc ecx
mov edi, eax
sub eax, eax
xchg ch, ch
cmovb ecx, edx
mov ecx, 9
jmp 0x15291a5
mov dword [ebp - 0xc], 0
jmp 0xfd6969
mov dword [ebp - 8], 0
jmp 0x13f39d7
pushal
mov bp, di
cwde
mov eax, 1
jmp 0x15bef0f
nop
nop
jmp 0x151e61b
mov dword [ebp - 0x10], 0
jmp 0x12b886a
nop
jmp 0x15e6fcf
nop
jmp 0x15a5518
stosd dword es:[edi], eax
sbb bx, cx
shl cx, 0x73
sub eax, eax
mov ecx, 0x14
jmp 0x15229be
mov edi, eax
movzx cx, al
xadd ecx, ecx
xor ecx, esp
sub eax, eax
setge ch
not ecx
bswap cx
mov ecx, 0x18
jmp 0x11de49f
nop
jmp 0x14d4c95
rep stosd dword es:[edi], eax
pop ebx
jmp 0x1318783
rep stosd dword es:[edi], eax
cmc
test ax, 0x1840
add ebx, 0x1c
jmp 0x183af93
nop
jmp 0x1604df0
nop
jmp 0x46d6c8
nop
jmp 0xfd9dbf
mov eax, 2
mov dx, di
mov eax, 4
movzx ecx, di
mov eax, 2
bswap edi
xchg ebp, ecx
mov eax, 5
cwde
cmovo di, si
mov eax, 4
setb bl
cwd
mov eax, 2
cwd
mov eax, 5
movsx ebp, si
cwd
mov eax, 6
jmp 0x1244907
nop
nop
jmp 0xfcb5e0
nop
jmp 0x166db79
nop
jmp 0xf78479
nop
jmp 0x10ac67c
push ebx
jmp 0x127dee0
nop
jmp 0x1619a87
push edx
mov edx, 1
not dh
movzx edx, di
mov edx, 2
not dh
mov dx, 0x5460
bswap dx
mov edx, 4
mov edx, 2
mov edx, 5
movzx dx, dl
mov edx, 4
mov edx, 2
mov edx, 5
mov edx, 5
cmovs dx, bp
pop edx
jmp 0x177bd22
nop
nop
nop
jmp 0x153e74b
nop
jmp 0x102f13b
push ebp
not ebp
mov ebp, esp
sub esp, 0x1c
jmp 0x109de98
push 0x58
call fcn.0051ff12
add esp, 4
movsx cx, cl
mov ecx, 0x5f085ef1
pop ebx
not edi
bswap esi
mov dword [ebx], eax
mov edi, eax
movsx eax, di
mov esi, 0x5efbd7
lodsd eax, dword [esi]
mov ch, 0x16
movsx ecx, ax
stosd dword es:[edi], eax
lahf
mov eax, edi
cwde
lodsd eax, dword [esi]
jmp 0x14e3278
push ebx
jmp 0x17cbf1d

Function at 0x17fe923
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
pushal
mov si, 0x6b1b
movsx edi, ax
mov eax, 1
mov bp, 0x6e94
mov eax, 2
not ebx
rdtsc
movzx edx, sp
mov eax, 4
movsx edi, bx
mov eax, 2
movzx ebp, sp
jmp loc.00432aa5
jmp 0xfbf7a4
mov dword [ebp - 0xc], 0
jmp 0x12aab4d
mov dword [ebp - 8], 0
jmp 0x11d9054
mov dword [ebp - 0x18], 0
jmp 0x11ca544
mov dword [ebp - 0x10], 0
jmp 0x158c97e
mov dword [ebp - 0x14], 0
jmp 0x1256983
push ebp
neg ebp
mov ebp, esp
stc
sub esp, 0x30
mov dword [ebp - 4], 0
jmp 0x11f8acd
Function at 0x430172
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
pushal
mov edx, dword [ebp + 8]
mov ax, word [edx]
cmp ax, 0x5a4d
jne 0x4301a1
mov eax, dword [edx + 0x3c]
add edx, eax
mov eax, dword [edx]
cmp eax, 0x4550
jne 0x4301a1
add edx, 4
mov dword [ebp - 4], edx
popal
mov eax, dword [ebp - 4]
leave
ret 8
popal
sub eax, eax
leave
ret 8

Function at 0x430dff
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov ecx, 3
mov edx, 1
push ecx
push dword [ebp + 8]
call fcn.00430f02
rol eax, 8
push dword [ebp + 0xc]
push eax
call fcn.00430f1c
push edx
push dword [ebp + 0x10]
push eax
call fcn.00430eea
inc edx
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.00430f02
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.00430ecb
push ecx
push dword [ebp + 8]
call fcn.00430f02
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.00430f02
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.00430ecb
push ecx
push dword [ebp + 8]
call fcn.00430f02
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.00430f02
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.00430ecb
push ecx
push dword [ebp + 8]
call fcn.00430f02
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.00430f02
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.00430ecb
cmp ecx, 0x2b
jne 0x430e0f
leave
ret 0xc

Function at 0x432495
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
pushal
mov byte [ebp - 0x118], 0x42
mov byte [ebp - 0x117], 0x72
mov byte [ebp - 0x116], 0x75
mov byte [ebp - 0x115], 0x74
mov byte [ebp - 0x114], 0x65
mov byte [ebp - 0x113], 0x66
mov byte [ebp - 0x112], 0x6f
mov byte [ebp - 0x111], 0x72
mov byte [ebp - 0x110], 0x63
mov byte [ebp - 0x10f], 0x69
mov byte [ebp - 0x10e], 0x6e
mov byte [ebp - 0x10d], 0x67
mov byte [ebp - 0x10c], 0x20
mov byte [ebp - 0x10b], 0x4b
mov byte [ebp - 0x10a], 0x65
mov byte [ebp - 0x109], 0x79
mov byte [ebp - 0x108], 0
mov eax, 1
lea edi, [ebp - 0x14]
mov ecx, 0x10
mov al, 0
mov byte [edi], al
inc edi
dec ecx
jne 0x432525
mov eax, dword [ebp + 8]
push 4
push 0x3000
push 0xde00
push 0
call dword [eax + 0x20]
test eax, eax
je 0x4325b7
mov dword [ebp - 4], eax
mov edi, eax
mov esi, dword [ebp + 0xc]
mov ecx, 0xde00
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
push dword [ebp + 0xc]
push 0xde00
call fcn.004323d4
push 0xde00
push dword [ebp + 0xc]
call fcn.004301a8
test eax, eax
jne 0x432599
mov esi, dword [ebp - 4]
mov edi, dword [ebp + 0xc]
mov ecx, 0xde00
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14]
push eax
call fcn.004325be
test eax, eax
je 0x4325b7
jmp 0x432555
mov eax, dword [ebp + 8]
push 0x8000
push 0
push dword [ebp - 4]
call dword [eax + 0x28]
test eax, eax
je 0x4325b7
popal
mov eax, 1
leave
ret 8
popal
sub eax, eax
leave
ret 8
Function at 0x4325ec
Capabilities:
Terminate process

Disassembly:
call fcn.004325f9
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
Function at 0x403619
Capabilities:
Query environment variable

Disassembly:
push 0x210
mov eax, 0x42476c
call fcn.0040db21
mov ebx, ecx
mov edi, dword [ebp + 8]
xor eax, eax
mov esi, eax
test edi, edi
je 0x4036f7
cmp word [edi], ax
je 0x4036f7
mov esi, 0x104
lea eax, [ebp - 0x218]
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x40366b
push edi
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.0040c809
add esp, 0xc
lea ecx, [ebp - 0x218]
call fcn.00407f34
lea eax, [ebp - 0x218]
mov ecx, ebx
push eax
call fcn.004035c3
mov esi, eax
test esi, esi
jne 0x4036f7
push 0x38
call fcn.0040b9f6
mov esi, eax
pop ecx
mov dword [ebp - 0x21c], esi
and dword [ebp - 4], 0
test esi, esi
je 0x4036d2
lea eax, [ebp - 0x218]
mov byte [esi], 1
push eax
lea ecx, [esi + 4]
call fcn.00401d68
mov byte [ebp - 4], 1
xor ecx, ecx
mov dword [esi + 0x1c], ecx
xor eax, eax
mov dword [esi + 0x34], 7
mov dword [esi + 0x30], ecx
mov word [esi + 0x20], ax
mov byte [ebp - 4], cl
jmp 0x4036d4
xor esi, esi
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x21c], esi
test esi, esi
je 0x4036f7
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebx + 0x40]
call fcn.00406017
mov esi, dword [ebp - 0x21c]
mov eax, esi
call fcn.0040dad0
ret 4
Function at 0x404544
Capabilities:
Write file on windows

Disassembly:
push 0x24
mov eax, 0x4249f1
call fcn.0040db21
mov ebx, ecx
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x30], eax
cmp dword [ebx + 0x2e4], edi
jle 0x404616
cmp eax, 0xffffffff
je 0x404616
push str.____Queued_Lines_End_____r_n
lea ecx, [ebp - 0x28]
call fcn.00401d68
mov dword [ebp - 4], 1
lea esi, [ebx + 0x2d4]
push eax
mov ecx, esi
call fcn.004060dc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
push edi
push 1
call fcn.00401bf8
jmp 0x40460d
lea eax, [ebp - 0x1c]
mov ecx, esi
push eax
call fcn.00406858
mov edx, eax
mov eax, dword [edx]
test eax, eax
je 0x4045b7
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 4]
dec ecx
and ecx, dword [edx + 8]
mov ecx, dword [eax + ecx*4]
cmp dword [ecx + 0x14], 8
mov eax, dword [ecx + 0x10]
jb 0x4045cf
mov ecx, dword [ecx]
push 0
lea edx, [ebp - 0x2c]
add eax, eax
push edx
push eax
push ecx
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4045e9
add edi, dword [ebp - 0x2c]
mov ecx, dword [esi + 8]
mov eax, dword [esi + 4]
dec ecx
and ecx, dword [esi + 0xc]
push 0
push 1
mov ecx, dword [eax + ecx*4]
call fcn.00401bf8
dec dword [esi + 0x10]
jne 0x40460a
and dword [esi + 0xc], 0
jmp 0x40460d
inc dword [esi + 0xc]
cmp dword [ebx + 0x2e4], 0
ja 0x4045a2
mov eax, edi
call fcn.0040dad0
ret 8
Function at 0x40515b
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x4334c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push eax
xor esi, esi
mov ebx, ecx
push esi
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x4051e3
lea eax, [ebp - 0x408]
push eax
push 0x400
lea eax, [ebp - 0x404]
push eax
push edi
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x4051dc
test dword [ebp - 0x408], 0xfffffffc
jbe 0x4051dc
add ebx, 0xbc
push 0x104
push ebx
push dword [ebp + esi*4 - 0x404]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [ebp - 0x408]
inc esi
shr eax, 2
cmp esi, eax
jb 0x4051bb
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b1e5
mov esp, ebp
pop ebp
ret 4
Function at 0x406e1e
Capabilities:
Check mutex on windows

Disassembly:
push 0x54
mov eax, 0x424e4b
call fcn.0040db21
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x5c], esi
push 7
pop ecx
xor eax, eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], ebx
mov word [ebp - 0x40], ax
mov dword [ebp - 4], ebx
cmp dword [esi + 8], ebx
jne 0x406ec1
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 1
lea edx, [ebp - 0x40]
mov ecx, str.RegValues
call fcn.00408118
push str.Lock
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x58]
call fcn.00407243
pop ecx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
push eax
call fcn.004026d1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x58]
push ebx
push 1
call fcn.00401bf8
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 8], eax
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x28]
push ebx
push 1
call fcn.00401bf8
push 0x32
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x406f6c
push str.MappedFile
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.00407243
pop ecx
mov byte [ebp - 4], 3
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
mov edi, 0x88
cmovae eax, dword [ebp - 0x28]
push eax
push edi
push ebx
push 4
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 4], eax
test eax, eax
je 0x406f55
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
push 0
push 0
xor ebx, ebx
cmp eax, 0xb7
push 0xf001f
push dword [esi + 4]
setne bl
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0xc], eax
test eax, eax
je 0x406f53
test ebx, ebx
je 0x406f4e
mov dword [ebp - 0x60], eax
mov byte [ebp - 4], 4
mov ecx, eax
call fcn.0040339b
mov byte [ebp - 4], 3
mov eax, dword [esi + 0xc]
inc dword [eax]
xor ebx, ebx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x28]
push ebx
push 1
call fcn.00401bf8
mov esi, dword [esi + 0xc]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
push ebx
push 1
call fcn.00401bf8
mov eax, esi
call fcn.0040dad0
ret 4
Function at 0x406fc5
Capabilities:
Check mutex on windows

Disassembly:
push 0x54
mov eax, 0x424eb7
call fcn.0040db21
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x5c], esi
push 7
pop edi
xor eax, eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x30], ebx
mov word [ebp - 0x40], ax
mov dword [ebp - 4], ebx
cmp dword [esi + 8], ebx
jne 0x407068
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 1
lea edx, [ebp - 0x40]
mov ecx, str.ExtMonitor
call fcn.00408118
push str.Lock
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x58]
call fcn.00407243
pop ecx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
push eax
call fcn.004026d1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x58]
push ebx
push 1
call fcn.00401bf8
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 8], eax
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x28]
push ebx
push 1
call fcn.00401bf8
push 0x32
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x407153
push str.MappedFile
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.00407243
pop ecx
mov byte [ebp - 4], 3
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
cmovae eax, dword [ebp - 0x28]
push eax
push 0x48
push ebx
push 4
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 4], eax
test eax, eax
je 0x40713c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x48
push 0
push 0
xor ebx, ebx
cmp eax, 0xb7
push 0xf001f
push dword [esi + 4]
setne bl
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0xc], eax
test eax, eax
je 0x40713a
test ebx, ebx
je 0x407126
mov dword [ebp - 0x60], eax
mov byte [ebp - 4], 4
xor ebx, ebx
mov dword [eax + 4], ebx
xor ecx, ecx
mov dword [eax], vtable.NGLogging::CExtMonitorSettings.0
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov byte [eax + 0x10], bl
mov dword [eax + 0x28], edi
mov dword [eax + 0x24], ebx
mov word [eax + 0x14], cx
mov byte [ebp - 4], 5
mov dword [eax + 0x40], edi
mov dword [eax + 0x3c], ebx
mov word [eax + 0x2c], cx
mov byte [ebp - 4], 6
mov dword [eax + 0x44], ebx
mov byte [ebp - 4], 3
jmp 0x407128
xor ebx, ebx
mov eax, dword [esi + 0xc]
test eax, eax
je 0x407134
add eax, 4
jmp 0x407136
mov eax, ebx
inc dword [eax]
jmp 0x40713c
xor ebx, ebx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x28]
push ebx
push 1
call fcn.00401bf8
mov esi, dword [esi + 0xc]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
push ebx
push 1
call fcn.00401bf8
mov eax, esi
call fcn.0040dad0
ret 4
Function at 0x407fd9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
mov edi, ecx
mov ebx, edx
test edi, edi
je 0x40805b
xor ecx, ecx
lea eax, [ebp - 4]
push eax
push ecx
lea eax, [ebp - 8]
mov dword [ebp - 4], ecx
push eax
push ecx
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40805b
cmp dword [ebp - 8], 1
jne 0x40805b
mov eax, dword [ebp - 4]
xor ecx, ecx
push esi
shr eax, 1
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004095eb
mov esi, eax
pop ecx
test esi, esi
je 0x40805a
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x408053
push esi
call fcn.00401d41
pop ecx
mov ecx, dword [ebp + 8]
push eax
push esi
call fcn.00401cc8
push esi
call fcn.0040ba47
pop ecx
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x408460
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp dword [sym.imp.SHELL32.dll_ShellExecuteExW]

Function at 0x408470
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp dword [sym.imp.SHELL32.dll_ShellExecuteW]

Function at 0x408837
Capabilities:
Get file version info

Disassembly:
push 0x10
mov eax, 0x425223
call fcn.0040db57
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [esi], vtable.NGUtils::AFileVersionInfo.0
xor edi, edi
mov dword [ebp - 4], edi
mov dword [esi], vtable.NGUtils::CFileVersionInfo.0
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 4], edi
mov eax, dword [ebp + 8]
test eax, eax
je 0x40890d
mov dword [ebp - 0x18], edi
lea ecx, [ebp - 0x18]
push ecx
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ebx, eax
mov dword [ebp - 0x1c], ebx
test ebx, ebx
je 0x40890d
mov byte [ebp - 4], 1
push ebx
call fcn.004095eb
pop ecx
mov dword [esi + 0xc], eax
mov dword [ebp - 4], edi
jmp 0x4088b6
cmp dword [esi + 0xc], 0
je 0x40890d
push dword [esi + 0xc]
push ebx
push dword [ebp - 0x18]
push dword [ebp + 8]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x40890d
mov dword [ebp + 8], edi
mov dword [ebp - 0x1c], edi
lea eax, [ebp + 8]
push eax
lea eax, [esi + 0x10]
push eax
push 0x42dd84
push dword [esi + 0xc]
mov edi, dword [sym.imp.VERSION.dll_VerQueryValueW]
call edi
test eax, eax
je 0x4088fb
mov eax, dword [ebp + 8]
shr eax, 2
mov dword [esi + 8], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [esi + 4]
push eax
push 0x42d62c
push dword [esi + 0xc]
call edi
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0040dabc
ret 4

Function at 0x408ba0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp dword [sym.imp.KERNEL32.dll_CreateProcessW]

Function at 0x408bf0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp dword [sym.imp.KERNEL32.dll_CreateThread]
Function at 0x408c00
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00423eae
add esp, 0x18
pop ebp
ret

Function at 0x408c60
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TerminateThread]

Function at 0x408d40
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetFileAttributesW]

Function at 0x409270
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp dword [sym.imp.KERNEL32.dll_SetFileAttributesW]

Function at 0x40a118
Capabilities:
Write file on windows

Disassembly:
push 0x20
mov eax, 0x42534a
call fcn.0040db21
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x40], ebx
je 0x40a210
cmp byte [esi + 0x46], bl
je 0x40a210
mov eax, dword [esi]
mov edi, 0xffff
push edi
call dword [eax + 0xc]
movzx eax, ax
cmp di, ax
jne 0x40a154
xor al, al
jmp 0x40a212
push ebx
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.0040a425
mov dword [ebp - 4], ebx
mov edi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov ebx, edi
cmp eax, 0x10
jae 0x40a181
lea ebx, [ebp - 0x28]
mov edi, ebx
mov ecx, dword [esi + 0x40]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
add eax, ebx
mov edx, dword [ecx]
push eax
push edi
lea eax, [esi + 0x48]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x40a1a8
dec eax
je 0x40a1ac
dec eax
dec eax
je 0x40a1fe
xor bl, bl
jmp 0x40a200
mov byte [esi + 0x46], 0
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x28]
mov ecx, edi
cmp eax, 0x10
jae 0x40a1bc
lea ecx, [ebp - 0x28]
mov ebx, dword [ebp - 0x2c]
sub ebx, ecx
je 0x40a1e4
cmp eax, 0x10
jae 0x40a1cb
lea edi, [ebp - 0x28]
push dword [esi + 0x50]
push ebx
push 1
push edi
call fcn.0040f61b
add esp, 0x10
cmp ebx, eax
jne 0x40a1a4
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x28]
cmp byte [esi + 0x46], 0
je 0x40a1fe
test ebx, ebx
jne 0x40a175
push ebx
push 8
lea ecx, [ebp - 0x28]
call fcn.0040a3c4
jmp 0x40a16f
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00401573
mov al, bl
jmp 0x40a212
mov al, 1
call fcn.0040dad0
ret

Function at 0x41548f
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x4154ca
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x4154b1
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x4154c2
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x4154cc
inc edi
add eax, 0x28
cmp edi, esi
jb 0x4154a7
xor eax, eax
pop edi
pop esi
ret