joyce8/EMBER2024-capa huggingface dataset:
Function at 0x549e40
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov edi, edx
mov esi, eax
mov eax, dword [0x569f28]
mov eax, dword [eax]
mov edx, edi
call fcn.004f595c
mov ebx, eax
test ebx, ebx
je 0x549e78
mov ecx, 0x62
mov edx, 0x549f70
mov eax, 0x549fdc
call fcn.0040468c
jmp 0x549f5d
lea ecx, [esp + 4]
mov eax, dword [0x569f28]
mov eax, dword [eax]
mov edx, edi
call fcn.004f6188
mov ebx, eax
test ebx, ebx
je 0x549ea9
mov ecx, 0x69
mov edx, 0x549f70
mov eax, 0x549fdc
call fcn.0040468c
jmp 0x549f5d
movzx eax, word [esp + 0xc]
add eax, 0x10
mov dword [esp], eax
mov eax, dword [esi + 0x10]
call fcn.0041b170
cmp edx, 0
jne 0x549ec4
cmp eax, 0
je 0x549ee3
mov cx, 2
xor edx, edx
mov eax, dword [esi + 0x10]
mov ebp, dword [eax]
call dword [ebp + 0x10]
mov edx, edi
mov ecx, dword [esp]
mov eax, dword [esi + 0x10]
call fcn.0041b3a0
jmp 0x549f5d
push 0
mov eax, dword [esp + 4]
push eax
push edi
mov eax, dword [esi + 4]
push eax
call sub.wsock32.dll_send
mov ebp, eax
test ebp, ebp
jle 0x549f1f
mov edx, ebp
mov eax, dword [esi + 0x14]
call fcn.004f5630
cmp ebp, dword [esp]
je 0x549f5d
mov ecx, 0x7c
mov edx, 0x549f70
mov eax, 0x549fdc
call fcn.0040468c
jmp 0x549f5d
call sub.wsock32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x549f56
mov cx, 2
xor edx, edx
mov eax, dword [esi + 0x10]
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov edx, edi
mov ecx, dword [esp]
mov eax, dword [esi + 0x10]
call fcn.0041b3a0
mov edx, 0x23
mov eax, esi
call fcn.00549c28
mov ebx, eax
jmp 0x549f5d
call sub.wsock32.dll_WSAGetLastError
mov ebx, eax
mov eax, ebx
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x55c870
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x55c878
push ebx
push esi
push edi
mov dword [ebp - 4], edx
xor eax, eax
push ebp
push 0x55c9ac
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4164a0]
call fcn.004038b0
mov esi, eax
mov edx, 0x55c9c4
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.004ba8fc
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.004f1d60
mov edx, dword [ebp - 0xc]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x55c913
inc ebx
mov dword [ebp - 8], 0
lea ecx, [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov edx, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.004f1d60
mov edx, dword [ebp - 0x14]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc dword [ebp - 8]
dec ebx
jne 0x55c8e7
push 0x55ca00
lea ecx, [ebp - 0x28]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov edx, 0xe
mov ebx, dword [eax]
call dword [ebx + 0xc]
push dword [ebp - 0x28]
push 0x55ca28
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.0040519c
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.004f23a4
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
call fcn.004049c0
mov edx, dword [ebp - 0x1c]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x74]
mov eax, esi
call fcn.004038e0
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55c9b3
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.00404e74
lea eax, [ebp - 0x1c]
call fcn.00404730
lea eax, [ebp - 0x18]
call fcn.00404e5c
lea eax, [ebp - 0x14]
call fcn.00404730
lea eax, [ebp - 0x10]
call fcn.00404e5c
lea eax, [ebp - 0xc]
call fcn.00404730
ret

Function at 0x55ca34
Capabilities:
Access peb ldr_data
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
mov ebx, edx
xor eax, eax
push ebp
push 0x55cac2
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x55cad4
lea ecx, [ebp - 0xc]
mov eax, dword [ebx + 0x30]
mov edx, 0xe
mov ebx, dword [eax]
call dword [ebx + 0xc]
push dword [ebp - 0xc]
push 0x55cafc
lea eax, [ebp - 8]
mov edx, 3
call fcn.0040519c
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.004f23a4
mov eax, dword [ebp - 4]
call fcn.004050bc
push eax
call sub.kernel32.dll_DeleteFileW
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
test bl, bl
jne 0x55caa7
mov eax, 0x55cb10
call fcn.004451e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55cac9
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404e74
ret
Function at 0x1000b3f0
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword [esp + 8]
cmp eax, 1
jne 0x1000b4df
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp dword [0x10051670], 0
mov dword [0x10051680], eax
jne 0x1000b44f
cmp al, 3
jne 0x1000b426
test eax, 0x80000000
je 0x1000b426
push 2
call fcn.1000c420
add esp, 4
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x1000b44f
push str.IsTNT
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000b44f
push 1
call fcn.1000c420
add esp, 4
call fcn.1000b780
test eax, eax
jne 0x1000b45d
xor eax, eax
ret 0xc
xor edx, edx
mov ecx, dword [0x10051680]
mov dl, ch
mov eax, ecx
shr ecx, 0x10
and eax, 0xff
mov dword [0x1005168c], edx
mov dword [0x10051688], eax
shl eax, 8
mov dword [0x10051680], ecx
add eax, edx
mov dword [0x10051684], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x10053b34], eax
call 0x1005cf97
cmp dword [0x10053b34], 0
mov dword [0x10051660], eax
je 0x1000b4d5
test eax, eax
je 0x1000b4d5
call 0x1005cf97
call fcn.1000c050
call 0x1005cf97
call 0x1005cf97
call fcn.1000b620
inc dword [0x1005165c]
mov eax, 1
ret 0xc
call fcn.1000b7c0
xor eax, eax
ret 0xc
test eax, eax
jne 0x1000b4cd
mov eax, dword [0x1005165c]
test eax, eax
jle 0x1000b512
dec eax
cmp dword [0x100516b8], 0
mov dword [0x1005165c], eax
jne 0x1000b500
call fcn.1000b690
call fcn.1000b9e0
call fcn.1000b7c0
mov eax, 1
ret 0xc
xor eax, eax
ret 0xc

Function at 0x1000b6b0
Capabilities:
Terminate process

Disassembly:
cmp dword [0x100516bc], 1
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
jne 0x1000b6ce
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x100516b8], 1
cmp dword [esp + 0x14], 0
mov ebx, dword [esp + 0x18]
mov byte [0x100516b4], bl
jne 0x1000b728
cmp dword [0x10053b2c], 0
je 0x1000b716
mov edi, dword [0x10053b1c]
sub edi, 4
cmp edi, dword [0x10053b2c]
jb 0x1000b716
mov eax, dword [edi]
test eax, eax
je 0x1000b70b
call eax
sub edi, 4
cmp edi, dword [0x10053b2c]
jae 0x1000b703
push 0x1004f514
push 0x1004f410
call fcn.1000b760
add esp, 8
push 0x1004f71c
push 0x1004f618
call fcn.1000b760
add esp, 8
test ebx, ebx
jne 0x1000b74f
mov dword [0x100516bc], 1
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
pop esi
pop ebx
ret
Function at 0x412565
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004123e4

Function at 0x41695c
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004162ca

Function at 0x416967
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00416505

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Create process on windows
Execute shellcode via indirect call
Read file on windows

Disassembly:
push ebx
push esi
mov ebx, 0x10003028
xor esi, esi
push edi
cmp ebx, 0x10002034
jne 0x1000116a
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov word [0x1000302e], ax
movzx ecx, word [eax + 0x10002038]
mov word [eax + 0x10003028], cx
add eax, 2
cmp cx, si
jne 0x10001172
push 1
push esi
push esi
push ebx
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov word [0x1000302e], ax
movzx ecx, word [eax + 0x1000203c]
mov word [eax + 0x10003028], cx
add eax, 2
cmp cx, si
jne 0x1000119d
push 0x40
mov eax, 0x1000
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x10003018], eax
lea edi, [ebx - 2]
mov ax, word [edi + 2]
add edi, 2
cmp ax, si
jne 0x100011cb
push 5
pop ecx
mov esi, str.sktop.ini
rep movsd dword es:[edi], dword [esi]
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000301c], eax
cmp eax, 0xffffffff
je 0x10001222
push esi
push 0x10003020
push 0x1000
push dword [0x10003018]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [0x10003018]
pop edi
pop esi
pop ebx
ret 0x10
Function at 0x31b98d0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x2c80015
lea edi, [esi - 0x287f015]
push edi
jmp 0x31b98ea
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x31b98f1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x31b98e0
mov eax, 1
add ebx, ebx
jne 0x31b9903
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x31b9914
jne 0x31b9933
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x31b9933
dec eax
add ebx, ebx
jne 0x31b9920
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x31b98f8
add ebx, ebx
jne 0x31b992f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x31b9985
xor ecx, ecx
sub eax, 3
jb 0x31b994b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x31b99ba
sar eax, 1
mov ebp, eax
jmp 0x31b9956
add ebx, ebx
jne 0x31b9956
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x31b9924
inc ecx
add ebx, ebx
jne 0x31b9964
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x31b9924
add ebx, ebx
jne 0x31b9971
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x31b9966
jne 0x31b9982
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x31b9966
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x31b99a4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x31b9996
jmp 0x31b98e6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x31b99a4
add edi, ecx
jmp 0x31b98e6
pop esi
mov edi, esi
mov ecx, 0xa51a0
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x31b99c2
mov eax, dword [edi]
mov bl, byte [edi + 4]
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x31b99c7
lea edi, [esi + 0x2db6000]
mov eax, dword [edi]
or eax, eax
je 0x31b9a2f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2dbae44]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2dbaef4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x31b99ed
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2dbaefc]
or eax, eax
je 0x31b9a29
mov dword [ebx], eax
add ebx, 4
jmp 0x31b9a0a
call dword [esi + 0x2dbaef8]
mov ebp, dword [esi + 0x2dbaf00]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x31b9a63
sub esp, 0xffffff80
jmp 0x227da2a
Function at 0x10018f23
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10018f62
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10018f62
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10018f62
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10018f62
cmp dword [ecx + 0x74], 0xe
jbe 0x10018f62
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1001bbdf
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1001bc7c
push ebx
push esi
call fcn.1001bba8
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1001bb3c
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1001bc29
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001bc7b
push edi
push eax
call fcn.1001cb9a
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1001bc49
call fcn.1001a684
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001bc7a
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1001bb3c
add esp, 0x20
test eax, eax
jne 0x1001bc68
push edi
call fcn.1001a684
jmp 0x1001bc70
push ebx
call fcn.1001a684
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1001bee9
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10023cc8
push 0x10023cc0
push str.FlsAlloc
push 0x1f
call fcn.1001be05
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001bf1d
push dword [ebp + 8]
mov ecx, esi
call dword [0x10022150]
call esi
jmp 0x1001bf23
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1001bf67
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10023cd8
push 0x10023cd0
push str.FlsGetValue
push 0x21
call fcn.1001be05
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001bf9e
push dword [ebp + 8]
mov ecx, esi
call dword [0x10022150]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1001bfa6
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10023ce0
push 0x10023cd8
push str.FlsSetValue
push 0x22
call fcn.1001be05
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001bfe0
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10022150]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10021670
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1002169d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1002169d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
cmp eax, 0
nop
nop
nop
nop
nop
je 0x433072
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x5d45380a
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x433060
nop
nop
nop
nop
mov eax, section..rdata
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x7b4e5a2f
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x401160
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp byte [esi + 4], 0
jne 0x401173
xor eax, eax
pop esi
pop ebp
ret 8
push edi
push 0x410
call fcn.00404e29
push 0x410
mov edi, eax
push 0
push edi
call fcn.00406870
add esp, 0x10
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.0040a76b
mov dword [eax], 0
push dword [esi]
push 0x208
push edi
push 0
push dword [ebp + 0xc]
push str.DllInjector
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4011f8
call fcn.0040a76b
cmp dword [eax], 0
jne 0x4011f8
test esi, esi
je 0x4011f8
nop dword [eax + eax]
cmp esi, 0x207
je 0x4011f8
cmp esi, 0x206
je 0x4011f8
mov eax, edi
pop edi
pop esi
pop ebp
ret 8
push edi
call fcn.00404b95
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
ret 8
Function at 0x401940
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x421040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push 2
mov dword [ebp - 0x238], edx
mov dword [ebp - 0x23c], ecx
mov dword [ebp - 0x240], edi
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4019a1
nop dword [eax]
test edi, edi
je 0x401ac2
mov dword [edi], 1
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404b87
mov esp, ebp
pop ebp
ret
xor al, al
xor esi, esi
push 0x228
mov byte [ebp - 0x231], al
lea eax, [ebp - 0x22c]
push esi
push eax
call fcn.00406870
add esp, 0xc
mov dword [ebp - 0x230], 0x22c
lea eax, [ebp - 0x230]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x401a09
nop dword [eax]
test edi, edi
je 0x4019ea
mov dword [edi], 2
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404b87
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x238]
nop
mov edx, dword ds:[ebp - 0x23c]
lea ecx, [ebp - 0x20c]
call fcn.00401220
cmp al, 1
jne 0x401a51
test esi, esi
mov byte [ebp - 0x231], al
cmove esi, dword [ebp - 0x228]
test edi, edi
je 0x401a51
nop dword [eax]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x228], eax
je 0x401a51
mov byte [edi], 1
lea eax, [ebp - 0x230]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
nop
cmp eax, 1
je 0x401a10
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 0x231], 0
mov edi, dword [ebp - 0x240]
jne 0x401a98
test edi, edi
je 0x401ac2
mov dword [edi], 3
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404b87
mov esp, ebp
pop ebp
ret
cmp byte ds:[ebp + 0xc], 1
push esi
push 0
jne 0x401aa9
push 0x1000
jmp 0x401aae
push 0x80
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
jne 0x401ac4
test edi, edi
je 0x401ac2
mov dword [edi], 4
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404b87
mov esp, ebp
pop ebp
ret
Function at 0x402520
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x421040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0
push 0x80
push 3
push 0
push 0
mov esi, ecx
mov bl, dl
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x402576
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp bl, 1
jne 0x4025bd
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404b87
mov esp, ebp
pop ebp
ret
cmp bl, 1
je 0x4025bd
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4025bd
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 1
push 0x41d720
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00404b87
mov esp, ebp
pop ebp
ret
Function at 0x4057e3
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x405822
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x405822
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x405822
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x405822
cmp dword [ecx + 0x74], 0xe
jbe 0x405822
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x40ee6e
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40ef0b
push ebx
push esi
call fcn.0040ee37
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040edcb
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40eeb8
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40ef0a
push edi
push eax
call fcn.0040c4c4
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40eed8
call fcn.0040c48a
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40ef09
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040edcb
add esp, 0x20
test eax, eax
jne 0x40eef7
push edi
call fcn.0040c48a
jmp 0x40eeff
push ebx
call fcn.0040c48a
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x40f10b
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x418f60
push 0x418f58
push str.FlsAlloc
push 0x1f
call fcn.0040f027
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40f13f
push dword [ebp + 8]
mov ecx, esi
call dword [0x4171ac]
call esi
jmp 0x40f145
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40f189
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x418f70
push 0x418f68
push str.FlsGetValue
push 0x21
call fcn.0040f027
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40f1c0
push dword [ebp + 8]
mov ecx, esi
call dword [0x4171ac]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x40f1c8
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x418f78
push 0x418f70
push str.FlsSetValue
push 0x22
call fcn.0040f027
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40f202
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x4171ac]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x416730
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41675d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41675d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x431001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x431072
nop
mov ebx, 0x40915c
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x799b370c
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x431060
nop
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4310d2
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x65f05fde
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219