joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001669
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14c
mov eax, dword [0x10040ac]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x148], eax
mov eax, dword [eax]
cmp eax, 0xffffffff
push esi
push edi
jne 0x10016a5
push 0x2737
push 1
call fcn.0100156c
pop ecx
pop ecx
jmp 0x100183f
push 0x30
lea edx, [ebp - 0x140]
push edx
push 2
lea edx, [ebp - 0x144]
push edx
push 0x80002010
xor ecx, ecx
push ebx
push ecx
push ecx
push ecx
push eax
mov dword [ebp - 0x144], ecx
call dword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
cmp dword [ebx], 0x8000001a
je 0x100183f
mov esi, dword [sym.imp.msvcrt.dll_sprintf]
mov edi, 0x1001184
inc dword [ebp - 0x144]
test eax, eax
jne 0x100181a
movzx eax, word [ebp - 0x140]
push eax
lea eax, [ebp - 0x14c]
push 0x1001180
push eax
call esi
movzx eax, byte [ebp - 0x137]
push eax
movzx eax, byte [ebp - 0x138]
push eax
movzx eax, byte [ebp - 0x139]
push eax
movzx eax, byte [ebp - 0x13a]
push eax
lea eax, [ebp - 0x10]
push 0x100116c
push eax
call esi
push dword [ebp - 0x128]
lea eax, [ebp - 0xf0]
push edi
push eax
call esi
push dword [ebp - 0x124]
lea eax, [ebp - 0x110]
push edi
push eax
call esi
push dword [ebp - 0x120]
lea eax, [ebp - 0x30]
push edi
push eax
call esi
add esp, 0x48
push dword [ebp - 0x11c]
lea eax, [ebp - 0x70]
push edi
push eax
call esi
push dword [ebp - 0x118]
lea eax, [ebp - 0xd0]
push edi
push eax
call esi
push dword [ebp - 0x114]
lea eax, [ebp - 0x50]
push edi
push eax
call esi
push dword [ebp - 0x12c]
lea eax, [ebp - 0xb0]
push edi
push eax
call esi
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0xf0]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14c]
push eax
push 0x2733
push 0
call fcn.0100156c
add esp, 0x5c
push 0x30
lea eax, [ebp - 0x140]
push eax
push 2
lea eax, [ebp - 0x144]
push eax
push 0x80002010
push ebx
xor eax, eax
push eax
push eax
push eax
mov eax, dword [ebp - 0x148]
push dword [eax]
call dword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
cmp dword [ebx], 0x8000001a
jne 0x10016e6
jmp 0x100183f
push eax
lea eax, [ebp - 0x90]
push 0x1001168
push eax
call esi
lea eax, [ebp - 0x90]
push eax
push 0x2732
push 1
call fcn.0100156c
add esp, 0x18
mov eax, dword [0x100410c]
cmp eax, 0xffffffff
mov esi, dword [sym.imp.ntdll.dll_NtClose]
je 0x1001852
push eax
call esi
mov eax, dword [0x1004110]
cmp eax, 0xffffffff
je 0x100185f
push eax
call esi
mov eax, dword [0x1004108]
cmp eax, 0xffffffff
je 0x100186c
push eax
call esi
push 0
call dword [sym.imp.msvcrt.dll_exit]
int3
Function at 0x100187a
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10040ac]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push esi
push edi
xor edi, edi
cmp eax, 0xffffffff
jne 0x10018ab
push 0x2737
push 1
call fcn.0100156c
pop ecx
pop ecx
jmp 0x10018e6
push edi
push edi
push edi
push edi
push 0x80002014
push ecx
push edi
push edi
push edi
push eax
call dword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
cmp eax, edi
je 0x10018e6
push eax
lea eax, [ebp - 0x24]
push 0x1001168
push eax
call dword [sym.imp.msvcrt.dll_sprintf]
lea eax, [ebp - 0x24]
push eax
push 0x2734
push 1
call fcn.0100156c
add esp, 0x18
mov eax, dword [0x100410c]
cmp eax, 0xffffffff
mov esi, dword [sym.imp.ntdll.dll_NtClose]
je 0x10018f9
push eax
call esi
mov eax, dword [0x1004110]
cmp eax, 0xffffffff
je 0x1001906
push eax
call esi
mov eax, dword [0x1004108]
cmp eax, 0xffffffff
je 0x1001913
push eax
call esi
push edi
call dword [sym.imp.msvcrt.dll_exit]
int3

Function at 0x10019fa
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1001a09
sub eax, edx
cmp eax, 0xc
jne 0x1001a4b
mov edx, dword [ebp + 0xc]
xor esi, esi
push edi
call fcn.010013fa
inc edi
push edi
mov cl, al
call fcn.010013fa
inc edi
cmp cl, 0xff
je 0x1001a4b
cmp al, 0xff
je 0x1001a4b
shl cl, 4
add cl, al
mov byte [edx], cl
inc edx
inc esi
cmp esi, 6
jl 0x1001a1c
pop edi
pop esi
xor eax, eax
pop ebp
ret 8
push 0x271c
push 1
call fcn.0100156c
pop ecx
pop ecx
push 1
call dword [sym.imp.msvcrt.dll_exit]
int3

Function at 0x1001c96
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10040ac]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 4], eax
mov eax, dword [0x10040cc]
mov dword [ebp - 0x10], eax
mov eax, dword [0x1004110]
cmp eax, 0xffffffff
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, 0x2721
mov esi, 0x494450cc
je 0x1001d09
push 0
push 0xa
lea ecx, [ebp - 0x10]
push ecx
push esi
push eax
call fcn.01001427
test eax, eax
je 0x1001d09
call dword [entry0]
push 0x100119c
push edi
push 1
mov ebx, eax
call fcn.0100156c
add esp, 0xc
push ebx
call fcn.01001461
push eax
push 1
call fcn.0100156c
pop ecx
pop ecx
mov eax, dword [0x100410c]
cmp eax, 0xffffffff
mov ebx, dword [sym.imp.ntdll.dll_NtClose]
je 0x1001d65
push 0xa
lea ecx, [ebp - 0x10]
push ecx
push esi
push eax
call fcn.0100149a
mov esi, eax
test esi, esi
je 0x1001d58
push 0x1001190
push edi
push 1
call fcn.0100156c
add esp, 0xc
cmp esi, 0x16
jne 0x1001d48
push 0x2713
jmp 0x1001d4f
push esi
call fcn.01001461
push eax
push 1
call fcn.0100156c
pop ecx
pop ecx
mov eax, dword [0x100410c]
cmp eax, 0xffffffff
je 0x1001d65
push eax
call ebx
mov eax, dword [0x1004110]
cmp eax, 0xffffffff
je 0x1001d72
push eax
call ebx
mov eax, dword [0x1004108]
cmp eax, 0xffffffff
je 0x1001d7f
push eax
call ebx
push 0
call dword [sym.imp.msvcrt.dll_exit]
int3
Function at 0x1001e65
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov ecx, dword [0x100410c]
cmp ecx, 0xffffffff
mov eax, dword [0x10040ac]
push esi
mov dword [ebp - 4], eax
push edi
je 0x1001ee0
xor eax, eax
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov edx, eax
mov esi, eax
shr esi, 0x10
and edx, 0xff0000
or edx, esi
mov esi, eax
shl eax, 0x10
and esi, 0xff00
or esi, eax
push 0x14
lea eax, [ebp - 0x18]
push eax
shr edx, 8
shl esi, 8
push 0x49445130
or edx, esi
push ecx
mov dword [ebp - 0x18], edx
call fcn.0100149a
test eax, eax
je 0x1001ed2
push 0x273d
jmp 0x1001ed7
push 0x273c
push 1
call fcn.0100156c
pop ecx
pop ecx
push 0
call dword [sym.imp.msvcrt.dll_exit]
int3

Function at 0x1001eee
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x508
mov eax, dword [0x10040ac]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x508]
push eax
push 0
call sub.MPRAPI.dll_MprConfigServerConnect
test eax, eax
jne 0x1001f83
push 0x80
lea eax, [ebp - 0x104]
push eax
push 0xffffffffffffffff
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0x400
lea eax, [ebp - 0x504]
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x508]
call sub.MPRAPI.dll_MprConfigGetFriendlyName
test eax, eax
jne 0x1001f60
lea eax, [ebp - 0x504]
push eax
push 0x273e
jmp 0x1001f66
push esi
push 0x273f
push 1
call fcn.0100156c
add esp, 0xc
push dword [ebp - 0x508]
call sub.MPRAPI.dll_MprConfigServerDisconnect
push 0
call dword [sym.imp.msvcrt.dll_exit]
mov ecx, dword [ebp - 4]
pop esi
call fcn.01003021
leave
ret 4

Function at 0x1001f95
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.010032c0
mov eax, dword [0x10040ac]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x1008]
push eax
push 0
call sub.MPRAPI.dll_MprConfigServerConnect
test eax, eax
jne 0x1002036
push 0x400
lea eax, [ebp - 0x804]
push eax
push 0xffffffffffffffff
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0x800
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x804]
push eax
push dword [ebp - 0x1008]
call sub.MPRAPI.dll_MprConfigGetGuidName
test eax, eax
jne 0x1002015
lea eax, [ebp - 0x1004]
push eax
push 0x2740
push 1
call fcn.0100156c
add esp, 0xc
jmp 0x1002023
push 0x2741
push 1
call fcn.0100156c
pop ecx
pop ecx
push dword [ebp - 0x1008]
call sub.MPRAPI.dll_MprConfigServerDisconnect
push 0
call dword [sym.imp.msvcrt.dll_exit]
mov ecx, dword [ebp - 4]
pop esi
call fcn.01003021
leave
ret 4
Function at 0x1002a88
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.msvcrt.dll_printf]
push edi
mov edi, 0x100118c
push edi
call esi
pop ecx
push dword [0x10040c0]
call fcn.010019d4
mov ebx, eax
push ebx
push 0x2717
push 0
call fcn.0100156c
add esp, 0xc
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LocalFree]
call ebx
push edi
call esi
pop ecx
push dword [0x10040c4]
call fcn.010019d4
push eax
push 0x2718
push 0
mov dword [ebp - 4], eax
call fcn.0100156c
add esp, 0xc
push dword [ebp - 4]
call ebx
push edi
call esi
pop ecx
push dword [0x10040c8]
call fcn.010019d4
push eax
push 0x2719
push 0
mov dword [ebp - 4], eax
call fcn.0100156c
add esp, 0xc
push dword [ebp - 4]
call ebx
push edi
call esi
cmp dword [ebp + 8], 0
pop ecx
je 0x1002b53
mov eax, dword [0x100410c]
cmp eax, 0xffffffff
mov esi, dword [sym.imp.ntdll.dll_NtClose]
je 0x1002b31
push eax
call esi
mov eax, dword [0x1004110]
cmp eax, 0xffffffff
je 0x1002b3e
push eax
call esi
mov eax, dword [0x1004108]
cmp eax, 0xffffffff
je 0x1002b4b
push eax
call esi
push 0
call dword [sym.imp.msvcrt.dll_exit]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4010bc
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x4010ce
mov eax, dword [0x40a08b]
shl eax, 2
mov dword [0x40a08f], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.004030ac
pop edx
call fcn.00402448
call fcn.004030b0
push 0
call fcn.004042b4
pop ecx
push 0x40a034
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x40a093], eax
push 0
jmp fcn.00407d64

Function at 0x401394
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffddc
mov eax, dword [0x40a37c]
mov edx, dword [0x40a384]
lea ecx, [ebp - 0x224]
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [0x40a380]
mov dword [ebp - 8], eax
mov dword [ebp - 0x1c], edx
mov edx, dword [0x40a388]
mov dword [0x40cf70], 1
mov dword [ebp - 0x18], edx
push 0x208
push ecx
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0
push 0
push 3
push 0
push 3
push 0x80000000
lea eax, [ebp - 0x224]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4014d8
push 0
push ebx
call sub.KERNEL32.DLL_GetFileSize
mov edi, eax
push 2
push 0
push 0xfffffffffffffff8
push ebx
call sub.KERNEL32.DLL_SetFilePointer
lea eax, [ebp - 4]
push 0
push eax
lea edx, [ebp - 0x14]
push 8
push edx
push ebx
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x401443
push ebx
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
jmp 0x4014da
push 8
lea edx, [ebp - 0x14]
push edx
lea ecx, [ebp - 0x1c]
push ecx
call fcn.0040351c
add esp, 0xc
test eax, eax
je 0x40145d
xor eax, eax
jmp 0x4014da
push 2
push 0
push 0xfffffffffffffff4
push ebx
call sub.KERNEL32.DLL_SetFilePointer
push 0
lea edx, [ebp - 4]
push edx
push 4
push esi
push ebx
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x401486
push ebx
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
jmp 0x4014da
push 4
push 0x1000
mov edx, dword [esi]
push edx
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov dword [0x40a378], eax
mov eax, edi
sub eax, dword [esi]
sub eax, 0xc
push 0
push 0
push eax
push ebx
call sub.KERNEL32.DLL_SetFilePointer
lea edx, [ebp - 4]
push 0
push edx
mov eax, dword [0x40a378]
mov ecx, dword [esi]
push ecx
push eax
push ebx
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x4014d1
push ebx
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
jmp 0x4014da
mov eax, 1
jmp 0x4014da
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4014e4
Capabilities:
Extract resource via kernel32 functions
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd04
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
push 0x2350
push 0x69
push esi
call sub.KERNEL32.DLL_FindResourceA
mov ebx, eax
test ebx, ebx
jne 0x40151b
mov eax, dword [ebp + 0x14]
push eax
call fcn.00401394
pop ecx
test eax, eax
jne 0x40155b
xor eax, eax
jmp 0x401641
push ebx
push esi
call sub.KERNEL32.DLL_LoadResource
mov edi, eax
test edi, edi
jne 0x40152f
xor eax, eax
jmp 0x401641
je 0x401534
jne 0x401534
jmp 0x40158c
push edi
call sub.KERNEL32.DLL_LockResource
mov dword [0x40a378], eax
cmp dword [0x40a378], 0
jne 0x40154f
xor eax, eax
jmp 0x401641
push ebx
push esi
call sub.KERNEL32.DLL_SizeofResource
mov edx, dword [ebp + 0x14]
mov dword [edx], eax
mov eax, 1
jmp 0x401641
cld
mov esi, dword [ebp - 4]
mov al, byte [esi]
cmp al, 0xcc
je 0x401609
mov edx, 0x409b08
mov dword [ebp - 8], edx
mov esi, dword [ebp - 8]
mov al, byte [esi]
cmp al, 0xcc
je 0x401609
mov ecx, sub.KERNEL32.DLL_CreateFileA
mov dword [ebp - 0xc], ecx
mov esi, dword [ebp - 0xc]
mov al, byte [esi]
cmp al, 0xcc
je 0x401609
mov eax, sub.KERNEL32.DLL_FindResourceA
mov dword [ebp - 0x10], eax
mov esi, dword [ebp - 0x10]
mov al, byte [esi]
cmp al, 0xcc
je 0x401609
mov edx, sub.KERNEL32.DLL_LoadResource
mov dword [ebp - 0x14], edx
mov esi, dword [ebp - 0x14]
mov al, byte [esi]
cmp al, 0xcc
je 0x401609
lea edi, [ebp - 0x1f8]
mov esi, 0x40a38c
mov ecx, 8
lea eax, [ebp - 0x1f8]
rep movsd dword es:[edi], dword [esi]
push 0x120
push eax
lea edx, [ebx + 0xa4]
push 0x64
push edx
call fcn.00401d5c
add esp, 0x10
push 0x10
lea ecx, [ebx + 0xa4]
push ecx
add ebx, 0xb8
push ebx
push 0
call sub.USER32.DLL_MessageBoxA
call sub.KERNEL32.DLL_GetCurrentProcessId
push eax
push 0
push 1
call sub.KERNEL32.DLL_OpenProcess
mov ebx, eax
push 0
push ebx
call sub.KERNEL32.DLL_TerminateProcess
push ebx
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401dac
Capabilities:
Check for software breakpoints
Decrypt data using tea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov eax, fcn.00401664
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
mov al, byte [esi]
cmp al, 0xcc
je 0x401e62
mov eax, fcn.004014e4
mov dword [ebp - 8], eax
mov esi, dword [ebp - 8]
mov al, byte [esi]
cmp al, 0xcc
je 0x401e62
mov eax, fcn.00401d5c
mov dword [ebp - 0xc], eax
mov esi, dword [ebp - 0xc]
mov al, byte [esi]
cmp al, 0xcc
je 0x401e62
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov ebx, 0xc6ef3720
mov edi, 0x20
mov ecx, dword [edx]
mov edx, dword [eax + 4]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
jmp 0x401e62
mov eax, ecx
shl eax, 4
add eax, dword [ebp - 0x18]
lea esi, [ebx + ecx]
xor eax, esi
mov esi, ecx
shr esi, 5
add esi, dword [ebp - 0x1c]
xor eax, esi
sub edx, eax
mov eax, edx
shl eax, 4
add eax, dword [ebp - 0x10]
lea esi, [ebx + edx]
xor eax, esi
mov esi, edx
shr esi, 5
add esi, dword [ebp - 0x14]
xor eax, esi
sub ecx, eax
sub ebx, 0x9e3779b9
mov eax, edi
add edi, 0xffffffff
test eax, eax
jg 0x401e2a
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401e80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov eax, dword [ebp + 8]
cmp ecx, edx
jbe 0x401e98
xor byte [eax], 0xf5
inc edx
inc eax
cmp ecx, edx
ja 0x401e8f
pop ebp
ret

Function at 0x402da0
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret

Function at 0x406de8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x406e4a
call fcn.00406d98
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.00403450
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.00403450
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x406ea8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x40bf64], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x406f82
cmp dword [0x40bf60], 0
jne 0x406f82
cmp dword [0x40c154], 0
je 0x406f3c
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.00406c98
add esp, 8
mov ebx, eax
test eax, eax
jne 0x406f22
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.00406c98
add esp, 8
mov ebx, eax
test eax, eax
jne 0x406f22
lea ebx, [ebp - 0x84]
jmp 0x406f23
inc ebx
call fcn.00406e64
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x406fbd
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x40bf68
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.00403450
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x40bf6b
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x406fbd
cmp dword [0x40bf60], 0
je 0x406f9c
cmp dword [0x40bf60], 0xffffffff
je 0x406fbd
push esi
call dword [0x40bf60]
pop ecx
mov eax, dword [0x40bf64]
test eax, eax
je 0x406fbd
cmp dword [0x40bf64], 0xffffffff
je 0x406fbd
cmp byte [eax], 0
je 0x406fbd
push esi
push eax
call fcn.00406de8
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4077a8
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x40d788], 0
jne 0x407829
cmp dword [0x40d7a8], 0
jne 0x4077d8
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x40d7a8], eax
test eax, eax
jne 0x4077d8
push str.GetEnvironmentStrings_failed
call fcn.00406fd4
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x40d7a8]
jmp 0x4077ec
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.00403450
pop ecx
mov edi, eax
test eax, eax
jne 0x4077e4
lea edi, [ebp + 1]
push edi
call fcn.00402358
pop ecx
mov ebx, eax
mov dword [0x40d78c], ebx
test ebx, ebx
jne 0x407816
xor eax, eax
jmp 0x4078ec
push edi
mov edx, dword [0x40d7a8]
push edx
push ebx
call fcn.0040333c
add esp, 0xc
jmp 0x407849
xor esi, esi
mov ebx, dword [0x40d788]
jmp 0x407843
push eax
call fcn.00403450
pop ecx
test eax, eax
jne 0x40783f
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x407833
lea ebx, [esi + 4]
push 4
mov dword [0x40d790], ebx
inc ebx
push ebx
call fcn.00401ebc
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x40786c
xor eax, eax
jmp 0x4078ec
cmp dword [0x40d788], 0
jne 0x40789d
xor esi, esi
mov ebx, dword [0x40d78c]
mov eax, dword [esp]
mov ebp, eax
jmp 0x40788e
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.00403450
pop ecx
mov edi, eax
test eax, eax
jne 0x407884
jmp 0x4078ce
xor esi, esi
mov ebx, dword [0x40d788]
mov eax, dword [esp]
mov edi, eax
jmp 0x4078c8
push eax
call fcn.00403450
pop ecx
test eax, eax
je 0x4078bd
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x4078c1
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x4078ac
mov eax, dword [0x40d788]
test eax, eax
je 0x4078de
push eax
call fcn.00402368
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x40d788], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x58d9626c
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0x78354518
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x402b9c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404904
test esi, esi
jne 0x402bd2
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004049f4
jmp 0x402bf0
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402a50
mov edi, eax
test esi, esi
je 0x402bf0
cmp dword [ebx], 0
je 0x402bf0
dec esi
jmp 0x402bd9
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x403960
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x567020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4039f8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4039d8
xor eax, eax
push ebp
push 0x4039d1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403a14
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4039d8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x567020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x567020], ax
mov esp, ebp
pop ebp
ret

Function at 0x404704
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x56e04c], 0
je 0x404765
cmp word [0x56e220], 0xd7b2
jne 0x40472d
cmp dword [0x56e228], 0
jbe 0x40472d
mov eax, 0x56e21c
call dword [0x56e238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x567090
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40478c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x567030], 0
jne 0x404781
push 0
push 0x567088
push 0x567090
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4048b8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402808
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x56e04d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x404880
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc