joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6807d0
Capabilities:
Encode data using base64
Terminate process

Disassembly:
sub esp, 0x118
mov ecx, 0x3f
mov eax, 0x80808080
push ebx
push ebp
push esi
push edi
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, 0x41
mov cl, al
sub cl, 0x41
mov byte [esp + eax + 0x28], cl
inc eax
cmp eax, 0x5a
jle 0x6807f2
mov eax, 0x61
mov dl, al
sub dl, 0x47
mov byte [esp + eax + 0x28], dl
inc eax
cmp eax, 0x7a
jle 0x680806
mov eax, 0x30
mov cl, al
add cl, 4
mov byte [esp + eax + 0x28], cl
inc eax
cmp eax, 0x39
jle 0x68081a
mov edi, dword [esp + 0x12c]
or ecx, 0xffffffff
xor eax, eax
xor ebp, ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [esp + 0x53], 0x3e
mov byte [esp + 0x57], 0x3f
mov byte [esp + 0x65], 0
mov dword [esp + 0x18], ebp
je 0x6809ad
mov ebx, dword [esp + 0x130]
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 4
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x12c]
xor eax, eax
lea esi, [edx + ecx]
movsx ecx, byte [esi + eax]
mov dl, byte [esp + ecx + 0x28]
test dl, 0x80
jne 0x68097e
mov byte [esp + eax + 0x20], cl
mov byte [esp + eax + 0x1c], dl
inc eax
cmp eax, 4
jl 0x68087c
mov esi, dword [esp + 0x138]
mov edx, dword [esp + 0x10]
cmp edx, dword [esi]
jle 0x6808e6
mov eax, dword [esp + 0x14]
push eax
call fcn.00693f27
mov ecx, dword [esi]
mov esi, ebx
mov edx, ecx
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebx
and ecx, 3
mov dword [esp + 0x2c], eax
rep movsb byte es:[edi], byte [esi]
call fcn.00693e3e
mov ecx, dword [esp + 0x140]
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x2c]
add esp, 8
mov dword [ecx], eax
mov ecx, dword [esp + 0x1c]
mov edi, dword [esp + 0x10]
mov dl, ch
mov al, cl
sar dl, 4
shl al, 2
or dl, al
mov eax, dword [esp + 0x14]
mov byte [ebx + ebp], dl
inc ebp
inc eax
mov cl, ch
mov dword [esp + 0x14], eax
mov al, byte [esp + 0x1e]
mov dl, al
inc edi
sar dl, 2
shl cl, 4
or dl, cl
mov ecx, dword [esp + 0x14]
shl al, 6
or al, byte [esp + 0x1f]
mov byte [ebx + ebp], dl
inc ebp
mov edx, edi
inc ecx
inc edx
mov byte [ebx + ebp], al
mov al, byte [esp + 0x22]
inc ebp
inc ecx
inc edx
mov dword [esp + 0x10], edi
cmp al, 0x3d
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], edx
je 0x680993
mov cl, byte [esp + 0x23]
xor eax, eax
cmp cl, 0x3d
setne al
add eax, 2
cmp eax, 3
jl 0x680993
mov edx, dword [esp + 0x18]
mov edi, dword [esp + 0x12c]
or ecx, 0xffffffff
xor eax, eax
add edx, 4
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x18], edx
cmp edx, ecx
jae 0x6809b4
jmp 0x68086c
push ecx
push str.Illegal_character__c_in_input._n
call fcn.006959b7
add esp, 8
push 1
call fcn.0069617d
mov eax, dword [esp + 0x134]
mov byte [ebx + ebp], 0
pop edi
pop esi
mov dword [eax], ebp
mov eax, ebx
pop ebp
pop ebx
add esp, 0x118
ret
mov ebx, dword [esp + 0x130]
mov ecx, dword [esp + 0x134]
mov byte [ebx + ebp], 0
pop edi
pop esi
mov dword [ecx], ebp
mov eax, ebx
pop ebp
pop ebx
add esp, 0x118
ret
Function at 0x682800
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x10
lea eax, [esp]
push esi
mov esi, dword [esp + 0x18]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [esi]
push edx
call dword [sym.imp.USER32.dll_GetWindowDC]
push eax
mov dword [esi + 4], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push 1
push eax
mov dword [esi + 8], eax
call dword [sym.imp.GDI32.dll_SetBkMode]
mov eax, dword [esi + 0x10]
test eax, eax
je 0x68284a
push eax
mov eax, dword [esi + 8]
mov dword [esi + 0x18], 0
push eax
jmp 0x682879
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
sub ecx, eax
mov eax, dword [esi + 4]
push ecx
mov ecx, dword [esp + 8]
mov dword [esi + 0x18], 1
sub edx, ecx
push edx
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ecx, dword [esi + 8]
push eax
mov dword [esi + 0x10], eax
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0xc]
cmp eax, 1
jne 0x6828bb
mov edx, dword [esi + 4]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push 0xcc0020
push 0
push 0
push edx
mov edx, dword [esp + 0x18]
sub eax, edx
mov edx, dword [esp + 0x14]
sub ecx, edx
mov edx, dword [esi + 8]
push eax
push ecx
push 0
push 0
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esi + 8]
pop esi
add esp, 0x10
ret 4
Function at 0x68ec90
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x68ecf6
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x68ecf6
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x68ecd7
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x68f080
Capabilities:
Create http request

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x68f0b8
mov edx, dword [esi + 4]
xor eax, eax
push 0
push 0
mov ecx, dword [edx - 8]
test ecx, ecx
setne al
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, edx
neg eax
sbb eax, eax
push ecx
and eax, 2
inc eax
push eax
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.0_
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi], eax
mov ecx, dword [esi]
xor eax, eax
test ecx, ecx
setne al
pop esi
ret
Function at 0x68fce0
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x68fd29
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x6901a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6ba650
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.0068fd50
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.0068fdd0
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.0068fdd0
lea ecx, [esi + 0xc]
call fcn.006a808e
lea ecx, [esi + 0x10]
call fcn.006a808e
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.00691360
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.00691360
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.00691360
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.006a8103
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.006a8103
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x6aa511
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x6aa549
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.006a855e
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.006a8536
jmp 0x6aa555
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x6abc03
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x6abc45
call fcn.006b23b9
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x6abc45
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x6abc3c
xor eax, eax
jmp 0x6abc4d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.006abc53
pop edi
pop esi
pop ebx
ret 4

Function at 0x6b28e9
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x6b2917
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x6b2935
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.006b284f
jmp 0x6b2935
mov eax, dword [esi + 0x14]
test eax, eax
je 0x6b2935
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.006b284f
test edi, edi
mov eax, edi
jne 0x6b291f
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x432008
Capabilities:
Encode data using xor

Disassembly:
test bl, dh
movsd dword es:[edi], dword [esi]
aad 0x57
fistp word [esi + 0x2b]
jecxz 0x431fc2
push 0xe6ac8144
scasb al, byte es:[edi]
int3
add byte [eax + ebx*4 - 0x5e], dh
or dword [ecx], esi
loopne 0x431fca
xor eax, esp
mov edx, 0xffd15d76
jbe 0x43206f
sar edi, 1
fucomp st(4)
dec esp
popal
mov ch, 0xeb
jo 0x43200d
popfd
stosb byte es:[edi], al
cmp dword [ebp + 0x416e639d], 0xf
push esi
hlt

Function at 0x43b487
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x487bb5
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x4d6394]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov eax, esi
call fcn.00433461
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x1c]
push eax
call dword [0x4a44e4]
mov dword [esp + 0xc], vtable.shui::CSHSignalArgs.0
and dword [esp + 0x38], 0
lea eax, [esp + 0xc]
push eax
push esi
lea ecx, [esi + 0x98]
call fcn.0040ba40
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x43bf92
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x487bb5
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x4d6394]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0xa8]
mov eax, dword [eax + 4]
cmp dword [ebp + 8], eax
jne 0x43bfda
push 0x4b7384
push dword [eax + 4]
call dword [0x4a4484]
mov dword [esp + 0xc], vtable.shui::CSHSignalArgs.0
and dword [esp + 0x38], 0
lea eax, [esp + 0xc]
push eax
push esi
lea ecx, [esi + 0x98]
mov dword [esp + 0x1c], 7
call fcn.0040ba40
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x43cebf
Capabilities:
Encode data using xor

Disassembly:
jnp 0x43cef1
fst dword [esi + 0x76]
sahf
add edi, dword [edx - 0xe]
rcl byte [eax], cl
xor byte [ecx + 0x70], bh
fidiv word [esi + 0x2b8f3db2]
lodsb al, byte [esi]
sbb dh, bl
and ecx, dword [esi + 0x99d2dbe]
insd dword es:[edi], dx
or al, 0x7a
lds ebx, [edi]
push edi
sbb byte [edi + 0x68], 0xb6
cmp ah, bl
cmpsd dword [esi], dword es:[edi]
inc edi
jbe 0x43cec1
push esi
pop ss
test al, 0xe8
sal byte [esi + 0x30d1f3a], 1
xor eax, 0x6d5beadc
add esp, 0x4513b7f7
mov edx, 0xd9771ae1
xchg ebp, eax
sbb al, 0x17
aad 0xb6
or al, 0x23
inc esi
pop ecx
add ah, dh
je 0x43cf3d
fiadd dword [edx + 0x1f52dbdc]
stc
pop eax
rol dword [ecx + 0x6acd48e3], cl
test eax, 0xf8bd6189
or al, 0xec
sub byte [eax + 0x12], cl
das
or edx, dword ss:[ebx]
int3
fbld tbyte [esi - 0x1e]
loope 0x43cfb6
invalid
test eax, 0x84583056
mov ss, word [ecx + ecx*2 - 0x18]
sar byte [ebx - 0x16d7fe80], 0xd7
test dword [edi + 0xa], esp
mov eax, 0xe9e948e6
mov dl, 0x1c
sbb byte [eax], al
invalid
Function at 0x445214
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x487bb5
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x4d6394]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
call fcn.004335d3
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
push eax
call dword [0x4a44e4]
mov dword [esp + 0xc], vtable.shui::CSHSignalArgs.0
and dword [esp + 0x38], 0
lea eax, [esp + 0xc]
push eax
push esi
lea ecx, [esi + 0x9c]
call fcn.0040ba40
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x445282
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x487bb5
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x4d6394]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x88]
mov ecx, dword [eax]
mov eax, dword [ecx]
call dword [eax + 0x1c]
push eax
call dword [0x4a44e4]
mov dword [esp + 0xc], vtable.shui::CSHSignalArgs.0
and dword [esp + 0x38], 0
lea eax, [esp + 0xc]
push eax
push esi
lea ecx, [esi + 0xa0]
call fcn.0040ba40
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x45753c
Capabilities:
Encode data using xor

Disassembly:
cdq
test byte [esi + 0x7d636012], cl
sub ebp, dword [ebp + ebx*4 + 0x25]
xchg ebp, eax
mov ch, 0x86
popfd
lodsb al, byte ds:[esi]
and al, 0x32
mov eax, dword [0xd8ad7fe1]
int3
enter 0x6a30, 0xffffffffffffff8c
push ebx
adc eax, 0x23e448f1
jle 0x4574d4
mov al, byte [0x38949a08]
sbb esi, dword [eax + 0x76]
sbb dword [edi], 0x8e88fe6a
mov byte [esi + 0x2b7f4e48], cl
mov byte [esi + 0x2b7f4e48], cl
or esi, dword [edi]
lodsd eax, dword [esi]
jecxz 0x45757a
fsub dword [ecx]
xor byte [esp + edi*8], dh
cmp dword [ecx + 8], edx
arpl word [ecx], bx
xor al, byte [edi + 3]
outsb dx, byte [esi]
stosd dword es:[edi], eax
test al, 0x53
push esi
inc edi
jbe 0x457524
salc
fucomp st(2)
lea esp, [ebx]
sbb edi, dword [esi + 0x417018ca]
sal dword [edi - 0x2728188a], cl
jb 0x4575a2
lea edi, [edi]
invalid
call 0x577b7c97
cmpsd dword [esi], dword es:[edi]
cmpsd dword [esi], dword es:[edi]
test ebx, edx
jae 0x457588
mov eax, 0xb5f364cc
in eax, dx
mov ch, 0xed
xchg esi, eax
xlatb
clc
xor dword [ebp + 0x33e9bc0c], 0xffffffa0
cmp al, 0xed
push esp
cdq
inc esi
xor eax, 0xf4752aa6
adc al, 0x1f
clc
clc
out dx, eax
loopne 0x45758c
dec eax
call 0x76b312bf
Function at 0x476394
Capabilities:
Encode data using xor

Disassembly:
or dh, byte [edi]
jns 0x47633f
push 0x73
leave
and byte [edi - 0x2c921254], dl
ret 0xdd0
test byte [ebp - 0x2af31205], 0xc8
enter 0x328b, 0x37
mov esi, dword [edx]
aaa
xchg ecx, eax
or al, 0x66
pop ds
cld
xchg dword [edx + 0x63], ecx
mov byte [edx], al
cmpsd dword [esi], dword es:[edi]
inc esi
sti
jb 0x47639c
adc byte [eax - 0x123e928c], ch
jge 0x476338
adc eax, 0x9c2df562
push esp
mov edx, 0x6f53f33b
out dx, al
jb 0x227dd4fb
xor byte [edx], 0x71
and ah, byte ss:[edx - 0x15d99066]
mov byte [0xea266f9a], al
xor ch, al
dec esi
mov dl, bl
mov edi, 0x58705c41
push edx
cdq
jg 0x4763c4
xlatb
xor bl, byte [ebx]
cmp dword [ecx - 0x35ee7cb2], edx
Function at 0x401000
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x422b66
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [esp + 4], esi
mov dword [esi + 4], 0x424664
mov dword [esi + 8], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0xc], eax
lea ecx, [esi + 0x1c]
mov dword [esp + 0x10], eax
mov dword [esi + 0x18], eax
call fcn.004221a2
lea ecx, [esi + 0x30]
mov byte [esp + 0x10], 1
call sub.MFC42.DLL_CString::CString_3
mov ecx, dword [esp + 8]
mov dword [esi], 0x424660
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x402b80
Capabilities:
Create process on windows
Resume thread
Write and execute a file
Write file on windows

Disassembly:
sub esp, 0xa54
lea eax, [esp + 0x368]
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x104
push eax
push 0
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x378]
lea edx, [esp + 0x274]
push ecx
push edx
call ebx
mov ebp, dword [sym.imp.MSVCRT.dll__mbsrchr]
lea eax, [esp + 0x274]
push 0x5c
push eax
call ebp
push 0x428104
mov byte [eax], 0
call fcn.00403b30
add esp, 0xc
push 0
push 0x8000080
push 2
push 0
push 0
push 0x40000000
push 0x4280f4
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x402d56
lea ecx, [esp + 0x6c]
push 0x104
push ecx
push 0
call edi
lea edx, [esp + 0x57c]
push 0
lea eax, [esp + 0x480]
push edx
lea ecx, [esp + 0x18]
push eax
lea edx, [esp + 0x78]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll__splitpath]
add esp, 0x14
lea eax, [esp + 0x6c]
lea ecx, [esp + 0x170]
push eax
push ecx
call ebx
lea edx, [esp + 0x170]
push 0x5c
push edx
call ebp
mov byte [eax], 0
mov eax, dword [esp + 0xa70]
add esp, 8
test eax, eax
jne 0x402c8a
lea eax, [esp + 0x170]
push 0x4280f4
lea ecx, [esp + 0x14]
push eax
push ecx
lea edx, [esp + 0x688]
push 0x428084
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [esp + 0x24]
push 0
lea ecx, [esp + 0x680]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edx, [esp + 0x684]
push eax
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
mov word [esp + 0x58], ax
lea eax, [esp + 0x14]
lea ecx, [esp + 0x28]
push eax
push ecx
push 0x428080
push 0
push 0x44
push 0
push 0
push 0
push 0x4280f4
push 0
mov dword [esp + 0x50], 0x44
mov dword [esp + 0x7c], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x402d63
mov edx, dword [esp + 0x18]
mov edi, dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 0xfffffffffffffff1
push edx
call edi
push 0xf
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call edi
push 0x80
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov eax, dword [esp + 0x14]
push eax
call esi
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, dword [esp + 0x18]
push edx
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa54
ret 4
push 0x428064
call fcn.00403b30
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa54
ret 4
Function at 0x4030b0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x208
mov eax, dword [esp + 0x20c]
push ebx
xor ebx, ebx
mov dword [esp + 4], ecx
test eax, eax
jle 0x40316c
push ebp
mov ebp, dword [esp + 0x218]
push esi
push edi
inc ebx
lea eax, [esp + 0x14]
push ebx
push 0x4281d8
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea ecx, [esp + 0x24]
lea edx, [esp + 0x14]
push ebp
push 0x1f4
push ecx
push 0x42d680
push edx
push 0x4281d0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jbe 0x40315c
push 0x1f4
call sub.MFC42.DLL_operatornew
mov edx, eax
mov ecx, 0x7d
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
lea edi, [esp + 0x28]
or ecx, 0xffffffff
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push edx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x14]
add ecx, 0x518
mov edx, dword [ecx + 8]
push edx
call sub.MFC42.DLL_CPtrArray::SetAtGrow
cmp ebx, dword [esp + 0x21c]
jl 0x4030d6
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret 8

Function at 0x403180
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x104
push ebx
push ebp
push esi
push edi
mov esi, ecx
call fcn.00402d70
mov ecx, esi
call fcn.00402db0
mov ebx, dword [sym.imp.MSVCRT.dll_sprintf]
push 0x42d478
lea eax, [esp + 0x14]
push 0x428228
push eax
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
push 0
push 0x428220
push 0x4281d0
call edi
lea edx, [esp + 0x10]
mov ebp, eax
push edx
push 0x1e
push 0x428218
push 0x428210
call edi
mov dword [esi + 0x114], eax
lea eax, [esp + 0x10]
push eax
push ebp
mov ecx, esi
call fcn.004030b0
mov ecx, dword [esi + 0x520]
push ecx
push 0x4281f0
call fcn.00403b30
push 0x42d478
lea edx, [esp + 0x1c]
push 0x4281e0
push edx
call ebx
add esp, 0x14
lea eax, [esp + 0x10]
push eax
push 0
push 0x42812c
push 0x428124
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret

Function at 0x403240
Capabilities:
Encode data using xor
Hash data using crc32b

Disassembly:
push ebx
push ebp
mov ebx, ecx
push esi
push edi
xor edi, edi
lea esi, [ebx + 0x118]
push 8
push edi
mov ecx, ebx
call fcn.004032a0
shl eax, 0x18
mov dword [esi], eax
mov edx, 8
mov ebp, eax
mov ecx, ebp
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
dec edx
mov ebp, eax
jne 0x403264
push 0x20
push eax
mov ecx, ebx
mov dword [esi], ebp
call fcn.004032a0
mov dword [esi], eax
inc edi
add esi, 4
cmp edi, 0xff
jle 0x40324e
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x4032e0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esp + 8]
or eax, 0xffffffff
mov edx, dword [ecx]
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x403318
push ebx
push edi
lea edi, [ecx]
mov ecx, eax
xor ebx, ebx
mov bl, byte [edx]
and ecx, 0xff
xor ecx, ebx
shr eax, 8
mov ecx, dword [esi + ecx*4 + 0x118]
xor eax, ecx
inc edx
dec edi
jne 0x4032f8
pop edi
pop ebx
not eax
pop esi
ret 8