joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4031f5
Capabilities:
Persist via run registry key
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x409044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov edi, ebx
movzx eax, word [esi]
test ax, ax
je 0x4032e7
mov ecx, eax
test cx, cx
je 0x4032e7
movzx ecx, cx
movzx edx, cx
cmp cx, 0x2d
je 0x40324b
movzx edx, cx
cmp cx, 0x2f
je 0x40324b
add esi, 2
movzx eax, word [esi]
mov ecx, eax
mov edx, eax
test ax, ax
jne 0x40322a
test dx, dx
je 0x4032e7
push 0x401728
add esi, 2
push esi
call dword [sym.imp.SHLWAPI.dll_StrCmpICW]
test eax, eax
je 0x4033b4
push 0x4017a4
push esi
call dword [sym.imp.SHLWAPI.dll_StrCmpICW]
test eax, eax
je 0x4033a1
push 0x4017c0
push esi
call dword [sym.imp.SHLWAPI.dll_StrCmpICW]
test eax, eax
je 0x40338e
push 0x4017d0
push esi
call dword [sym.imp.SHLWAPI.dll_StrCmpICW]
test eax, eax
je 0x403331
push 0x4017fc
push esi
call dword [sym.imp.SHLWAPI.dll_StrCmpICW]
test eax, eax
je 0x4032f8
movzx eax, word [esi]
sub eax, 0x62
je 0x4032d3
sub eax, 0x10
je 0x4032ce
sub eax, 1
jne 0x4032d6
or edi, 4
jmp 0x4032d6
or edi, 1
jmp 0x4032d6
or edi, 2
add esi, 2
movzx eax, word [esi]
mov ecx, eax
test ax, ax
jne 0x40321e
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408730
leave
ret
test byte [0x4095c1], 0x40
je 0x403312
lea eax, [ebp - 0x18]
mov edx, 0x401468
push eax
push 1
push ecx
call fcn.00403669
call fcn.004061b3
call fcn.004062b2
test byte [0x4095c1], 0x40
je 0x403387
mov edx, 0x401408
call fcn.004036b9
jmp 0x403387
call fcn.004072ef
test eax, eax
jne 0x403344
call fcn.004061b3
call fcn.004062b2
push 0x43
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
jne 0x403363
push 0x43
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
jne 0x403363
push ebx
call dword [sym.imp.SHELL32.dll_Ordinal_885]
call fcn.004072ef
test eax, eax
jne 0x403382
push 0x43
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
jne 0x403382
call fcn.004064a3
call fcn.00406c85
call fcn.00406ca1
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x1e
call dword [sym.imp.SHLWAPI.dll_IsOS]
test eax, eax
je 0x403387
call fcn.0040683c
jmp 0x403387
push 0x1e
call dword [sym.imp.SHLWAPI.dll_IsOS]
test eax, eax
je 0x403387
call fcn.004031ba
jmp 0x403387
push 0x1e
call dword [sym.imp.SHLWAPI.dll_IsOS]
test eax, eax
je 0x403387
push ebx
push fcn.00405580
push ebx
push 3
mov edx, 0x401740
mov ecx, 0x80000002
call fcn.00404fba
jmp 0x403387
Function at 0x4033da
Capabilities:
Persist via run registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x494
mov eax, dword [0x409044]
xor eax, esp
mov dword [esp + 0x490], eax
push ebx
mov ebx, dword [ebp + 0x10]
xor eax, eax
push esi
mov esi, dword [ebp + 8]
push edi
push eax
push eax
push 1
push eax
mov edi, eax
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
mov eax, section..data
push eax
push eax
call fcn.0040363e
movzx eax, word [0x401848]
push eax
push 0x401848
push 2
push dword [0x409004]
push dword [section..data]
call dword [sym.imp.ADVAPI32.dll_EventSetInformation]
call fcn.004073c6
push edi
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
js 0x403492
mov ecx, ebx
call fcn.004031f5
mov dword [0x4094e0], eax
mov dword [0x409610], esi
push edi
test al, 1
je 0x40347c
push fcn.00405580
push edi
push 3
mov edx, 0x401740
mov ecx, 0x80000002
call fcn.00404fba
inc edi
jmp 0x40348c
push 0x402f90
push 0
push 0x65
push esi
call dword [sym.imp.USER32.dll_DialogBoxParamW]
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoUninitialize]
mov esi, 0x488
lea eax, [esp + 0x10]
push esi
xor ebx, ebx
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [esp + 0x10], esi
lea eax, [esp + 0x10]
mov dword [esp + 0x3c], 0x20000
mov dword [esp + 0x50], 0x20801
mov dword [esp + 0x7c], 0x78
push eax
push 0x401810
push ebx
push ebx
mov dword [esp + 0x90], 0x280
call dword [sym.imp.api_ms_win_eventing_controller_l1_1_0.dll_StopTraceW]
mov ecx, section..data
call fcn.00403504
mov ecx, dword [esp + 0x49c]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00408730
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4044ef
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x21c
mov eax, dword [0x409044]
xor eax, esp
mov dword [esp + 0x218], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
mov dword [esp + 0x14], eax
push ecx
mov esi, 0x104
mov dword [eax], edi
mov edx, esi
mov dword [eax + 4], edi
lea ecx, [esp + 0x1c]
call fcn.0040374f
push 0x401a50
mov edx, esi
lea ecx, [esp + 0x1c]
call fcn.00403784
lea eax, [esp + 0x18]
push eax
push edi
push 0x1f0003
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenSemaphoreW]
mov esi, eax
test esi, esi
jne 0x404571
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 2
je 0x4045ab
push ecx
mov ecx, dword [ebp + 4]
mov edx, 0xc9
call fcn.004041c8
mov edi, eax
jmp 0x4045ab
lea edx, [esp + 0x10]
mov dword [esp + 0x10], edi
mov ecx, esi
call fcn.004043d6
mov ebx, eax
test ebx, ebx
jns 0x40459d
mov ecx, dword [ebp + 4]
mov edx, 0xcf
push ebx
push 0x4019c4
call fcn.004041ab
mov edi, ebx
jmp 0x4045ab
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
cdq
mov dword [ecx], eax
mov dword [ecx + 4], edx
test esi, esi
je 0x4045b5
push esi
call fcn.00404220
mov ecx, dword [esp + 0x224]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00408730
mov esp, ebp
pop ebp
ret 8
Function at 0x4061b3
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x409044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ecx
xor esi, esi
call fcn.00407370
test eax, eax
je 0x4062a1
push 0x208
lea eax, [ebp - 0x210]
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
xor ebx, ebx
call fcn.00405d45
test eax, eax
je 0x406205
push 1
call dword [sym.imp.KERNEL32.dll_SetTermsrvAppInstallMode]
mov ebx, eax
mov edi, 0x104
lea eax, [ebp - 0x210]
push edi
push eax
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemDirectoryW]
test eax, eax
je 0x406295
push 0x401ca0
push edi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathCchAppend]
test eax, eax
js 0x406295
xor eax, eax
lea edi, [ebp - 0x224]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x224]
push eax
push ecx
push ecx
lea ecx, [ebp - 0x210]
call fcn.00408268
test eax, eax
js 0x406295
mov ecx, dword [ebp - 0x224]
lea edx, [ebp - 0x214]
push ecx
xor eax, eax
mov dword [ebp - 0x214], ecx
push ecx
test ecx, ecx
push 0xffffffffffffffff
setne al
push eax
call fcn.00405b89
push dword [ebp - 0x224]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x220]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
inc esi
test ebx, ebx
je 0x4062a1
push 0
call dword [sym.imp.KERNEL32.dll_SetTermsrvAppInstallMode]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408730
leave
ret
Function at 0x4062e4
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x409044]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x220], eax
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x228], edx
push edi
mov ebx, eax
lea eax, [ebp - 0x214]
push 0x104
push eax
mov dword [ebp - 0x224], ebx
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetWindowsDirectoryW]
test eax, eax
je 0x40643f
push 0x43
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov edi, eax
mov dword [ebp - 0x21c], edi
test edi, edi
jne 0x40643f
movzx eax, word [esi]
mov ebx, esi
mov edx, eax
test ax, ax
je 0x406378
mov ecx, eax
movzx edx, cx
cmp cx, 0x20
je 0x406378
movzx edx, cx
cmp cx, 0x2c
je 0x406378
add ebx, 2
movzx eax, word [ebx]
mov ecx, eax
mov edx, eax
test ax, ax
jne 0x406357
test dx, dx
jne 0x406388
xor edi, edi
inc edi
mov dword [ebp - 0x21c], edi
jmp 0x40638d
xor eax, eax
mov word [ebx], ax
xor eax, eax
cmp word [esi], ax
je 0x40642e
test byte [0x4095c1], 0x40
je 0x4063b3
mov ecx, esi
call fcn.00405490
push eax
mov edx, 0x401488
call fcn.0040541c
lea eax, [ebp - 0x218]
xor edx, edx
push eax
push dword [ebp - 0x220]
lea eax, [ebp - 0x214]
push ecx
push ecx
push dword [ebp - 0x228]
mov ecx, esi
push eax
call fcn.004078c2
test eax, eax
jns 0x406452
push 0x401cfc
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleA]
test byte [0x4095c1], 0x40
mov edi, eax
je 0x406407
mov ecx, esi
call fcn.00405490
push eax
xor eax, eax
mov edx, 0x4014a8
push eax
call fcn.00405ac4
test edi, edi
je 0x406428
push esi
push 0x1030
push 0x20c
push 0x203
xor eax, eax
push eax
push edi
call dword [sym.imp.SHLWAPI.dll_ShellMessageBoxW]
add esp, 0x18
mov edi, dword [ebp - 0x21c]
lea esi, [ebx + 2]
test edi, edi
je 0x406349
mov ebx, dword [ebp - 0x224]
mov ecx, dword [ebp - 8]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408730
leave
ret 4
mov edx, dword [ebp - 0x218]
mov ecx, dword [ebp - 0x220]
call fcn.00405a73
test byte [0x4095c1], 0x40
je 0x40648b
mov ecx, esi
call fcn.00405490
push eax
push dword [ebp - 0x218]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetProcessId]
push eax
mov edx, 0x4014a8
call fcn.00405ac4
push dword [ebp - 0x218]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x224], 1
jmp 0x40642e
Function at 0x4064a3
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x409044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x40000047
mov esi, ebx
call dword [sym.imp.SHELL32.dll_SHRestricted]
test eax, eax
jne 0x406633
push 0x43
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
jne 0x406633
lea eax, [ebp - 0x214]
xor edi, edi
push eax
inc edi
push edi
push ebx
push 0x401d10
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x406633
push ecx
lea ecx, [ebp - 0x218]
call fcn.0040615f
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x20c], 0x1fe
push eax
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x210]
push eax
push 0x401d7c
push ebx
push dword [ebp - 0x214]
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x406599
cmp dword [ebp - 0x210], edi
jne 0x406599
test byte [0x4095c1], 0x40
je 0x406567
push 0x401d88
mov edx, 0x401478
call fcn.0040541c
push dword [ebp - 0x218]
lea ecx, [ebp - 0x208]
push 7
pop edx
call fcn.004062e4
test eax, eax
je 0x406581
mov esi, edi
test byte [0x4095c1], 0x40
je 0x406599
push 0x401d88
mov edx, 0x4013f8
call fcn.0040541c
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x20c], 0x1fe
push eax
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x210]
push eax
push 0x401dfc
push ebx
push dword [ebp - 0x214]
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x40661c
cmp dword [ebp - 0x210], edi
jne 0x40661c
test byte [0x4095c1], 0x40
mov ebx, 0x401e08
je 0x4065ef
push ebx
mov edx, 0x401478
call fcn.0040541c
push dword [ebp - 0x218]
mov edx, edi
lea ecx, [ebp - 0x208]
call fcn.004062e4
test eax, eax
je 0x406608
mov esi, edi
test byte [0x4095c1], 0x40
je 0x40661c
push ebx
mov edx, 0x4013f8
call fcn.0040541c
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x218]
call fcn.00406cd7
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408730
leave
ret

Function at 0x407370
Capabilities:
Persist via run registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push 9
push ebx
push 0x401c38
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4073bf
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x4073b6
cmp dword [ebp - 8], ebx
setne bl
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
pop ebx
leave
ret 4
Function at 0x4073c6
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x49c
mov eax, dword [0x409044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x488
lea eax, [ebp - 0x490]
push esi
xor ebx, ebx
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x490], esi
mov edi, 0x104
mov dword [ebp - 0x464], 0x20000
lea eax, [ebp - 0x418]
mov dword [ebp - 0x460], 8
mov dword [ebp - 0x450], 0x20801
mov esi, 0x80004005
push edi
push eax
push dword [0x401194]
mov dword [ebp - 0x424], 0x78
mov dword [ebp - 0x420], 0x280
call dword [sym.imp.SHLWAPI.dll_Ordinal_460]
test eax, eax
je 0x40758b
lea eax, [ebp - 0x418]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push 0x401810
push edi
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathCchAppend]
mov esi, eax
test esi, esi
js 0x40758b
push 0x402124
push edi
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathCchAddExtension]
mov esi, eax
test esi, esi
js 0x40758b
lea eax, [ebp - 0x490]
mov dword [ebp - 0x498], ebx
push eax
mov edi, 0x401810
mov dword [ebp - 0x494], ebx
push edi
lea eax, [ebp - 0x498]
push eax
call dword [sym.imp.api_ms_win_eventing_controller_l1_1_0.dll_StartTraceW]
mov esi, eax
test esi, esi
jle 0x4074d1
movzx esi, si
or esi, 0x80070000
cmp esi, 0x80070057
jne 0x407517
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
test eax, eax
je 0x407510
lea eax, [ebp - 0x490]
push eax
push edi
lea eax, [ebp - 0x498]
push eax
call dword [sym.imp.api_ms_win_eventing_controller_l1_1_0.dll_StartTraceW]
mov esi, eax
test esi, esi
jle 0x407519
movzx esi, si
or esi, 0x80070000
jmp 0x407517
call fcn.00405d29
mov esi, eax
test esi, esi
js 0x40758b
mov edi, ebx
test esi, esi
js 0x407564
mov eax, dword [0x4011a0]
push ebx
push ebx
push ebx
push ebx
add eax, edi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 4
push 1
push eax
push dword [ebp - 0x494]
push dword [ebp - 0x498]
call dword [sym.imp.api_ms_win_eventing_controller_l1_1_0.dll_EnableTraceEx2]
mov esi, eax
test esi, esi
jle 0x407558
movzx esi, si
or esi, 0x80070000
add edi, 0x18
cmp edi, 0x18
jb 0x40751d
test esi, esi
jns 0x40758b
lea eax, [ebp - 0x490]
push eax
push ebx
push dword [ebp - 0x494]
push dword [ebp - 0x498]
call dword [sym.imp.api_ms_win_eventing_controller_l1_1_0.dll_StopTraceW]
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408730
leave
ret
Function at 0x407c24
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor eax, eax
push edi
mov edi, esi
mov dword [ebp - 8], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
cmp dword [ecx], 0
jne 0x407c49
push 0x15
pop ebx
jmp 0x407cff
cmp dword [ecx], 1
jne 0x407c63
cmp dword [ecx + 4], 1
jne 0x407c5b
xor ebx, ebx
jmp 0x407cff
push 2
pop ebx
jmp 0x407d05
cmp dword [ecx], 2
jne 0x407c75
mov dword [esi], 3
xor ebx, ebx
jmp 0x407d05
lea eax, [ebp - 4]
mov dword [ebp - 4], 0xc
push eax
push esi
xor edi, edi
push edi
push 0x20000008
push dword [ebp + 8]
push edi
push dword [ecx]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
mov ebx, eax
cmp ebx, 0xea
jne 0x407cee
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
mov dword [ebp - 0xc], edi
test edi, edi
je 0x407ceb
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push edi
push 0
push 0x20000008
push dword [ebp + 8]
push 0
push dword [eax]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
mov ebx, eax
test ebx, ebx
jne 0x407ce2
mov esi, edi
mov edi, dword [ebp + 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x407cee
push 0xe
pop ebx
test ebx, ebx
je 0x407d05
cmp ebx, 2
je 0x407d05
cmp ebx, 0x65e
je 0x407d05
mov dword [esi], 2
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 8
Function at 0x408268
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x470
mov eax, dword [0x409044]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
push 0x44
pop edi
push edi
mov dword [ebp - 0x41c], eax
mov ebx, eax
lea eax, [ebp - 0x470]
mov esi, ecx
push 0
push eax
mov dword [ebp - 0x418], esi
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x470], edi
test ebx, ebx
jne 0x4082b8
lea ebx, [ebp - 0x42c]
xor eax, eax
lea ecx, [ebp - 0x414]
mov edi, ebx
mov edx, 0x102
push esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.0040374f
mov esi, eax
test esi, esi
js 0x408371
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathQuoteSpacesW]
mov edi, 0x208
lea ecx, [ebp - 0x414]
push 0x4023c0
mov edx, edi
call fcn.00403784
mov esi, eax
test esi, esi
js 0x408371
push 0x401cc0
mov edx, edi
lea ecx, [ebp - 0x414]
call fcn.00403784
mov esi, eax
test esi, esi
js 0x408371
push ebx
lea eax, [ebp - 0x470]
push eax
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x418]
call sub.KERNEL32.dll_CreateProcessW
test eax, eax
jne 0x408359
call sub.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError
mov esi, eax
test esi, esi
jle 0x408371
movzx esi, si
or esi, 0x80070000
jmp 0x408371
cmp dword [ebp - 0x41c], 0
jne 0x408371
push dword [ebx + 4]
call sub.KERNEL32.dll_CloseHandle
push dword [ebx]
call sub.KERNEL32.dll_CloseHandle
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408730
leave
ret 0xc
Function at 0x408720
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x408f08
call fcn.00408ba8
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, ebx
mov edx, 0x409604
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x4084f5
cmp eax, esi
jne 0x4084e8
xor esi, esi
inc esi
mov edi, esi
jmp 0x4084f8
push 0x3e8
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x4084cc
xor esi, esi
inc esi
cmp dword [0x409608], esi
jne 0x40850a
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x408544
cmp dword [0x409608], ebx
jne 0x40853e
mov dword [0x409608], esi
push 0x4012bc
push 0x4012b0
call fcn.0040867e
pop ecx
pop ecx
test eax, eax
je 0x408544
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x40866e
mov dword [0x409184], esi
cmp dword [0x409608], esi
jne 0x408567
push 0x4012ac
push 0x401294
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x409608], 2
test edi, edi
jne 0x408574
xor eax, eax
mov ecx, 0x409604
xchg dword [ecx], eax
cmp dword [0x40960c], 0
je 0x4085a0
push 0x40960c
call fcn.00408a00
pop ecx
test eax, eax
je 0x4085a0
push ebx
push 2
push ebx
mov esi, dword [0x40960c]
mov ecx, esi
call dword [0x40a37c]
call esi
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
mov ecx, dword [eax]
test ecx, ecx
je 0x40852d
mov dword [ebp - 0x20], ecx
push 0x20
pop esi
mov edx, dword [ebp - 0x1c]
movzx eax, word [ecx]
cmp ax, si
ja 0x40860b
test ax, ax
je 0x4085da
test edx, edx
jne 0x40860b
test ax, ax
je 0x4085da
cmp ax, si
ja 0x4085da
add ecx, 2
mov dword [ebp - 0x20], ecx
movzx eax, word [ecx]
jmp 0x4085c5
test byte [ebp - 0x3c], 1
je 0x4085e6
movzx eax, word [ebp - 0x38]
jmp 0x4085e9
push 0xa
pop eax
push eax
push ecx
push ebx
push 0x400000
call main
mov dword [0x409180], eax
cmp dword [0x409198], 0
jne 0x408653
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp eax, 0x22
jne 0x40861c
xor eax, eax
test edx, edx
sete al
mov edx, eax
mov dword [ebp - 0x1c], edx
add ecx, 2
mov dword [ebp - 0x20], ecx
jmp 0x4085b4
cmp dword [0x409184], 0
jne 0x408667
call dword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x409180]
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
call fcn.00408af5
jmp 0x4084a3

Function at 0x4088e4
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x408f28
call fcn.00408ba8
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x408944
cmp eax, 0xffffffff
je 0x408944
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x40893d
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x40893d
cmp edx, 0x10000000
jae 0x40893d
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x40893a
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4089b0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x4089ee
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x4089e6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x4089f0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x4089d6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x408ac0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x408af1
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x408af1
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x408af1
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x10b65d8
Capabilities:
Encode data using xor

Disassembly:
jmp 0x10b65e2
pushal
call 0x10b65e8
pop ebp
sub ebp, 0x10
sub ebp, 0xcb65d8
jmp 0x10b65fe
mov eax, 0xcb65d8
add eax, ebp
add eax, 0x4c
mov ecx, 0x5b7
mov edx, 0xfcf191ea
xor byte [eax], dl
inc eax
dec ecx
jne 0x10b6615
jmp 0x10b6628
popal
daa
popal
arpl si, dx
ljmp 0xea12