joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404600
Capabilities:
Create raw socket
Create tcp socket
Create udp socket
Receive data
Receive data on socket
Send data
Send data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x82c
mov eax, dword [0x46f20c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
push 1
push 0
push 0
push 1
push 3
push 2
mov dword [ebp - 0x82c], eax
call dword [sym.imp.WS2_32.dll_WSASocketW]
mov edi, eax
cmp edi, 0xffffffff
je 0x404769
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x828]
push 4
push eax
push 0x1006
push 0xffff
push edi
mov dword [ebp - 0x828], esi
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x404769
push 4
lea eax, [ebp - 0x828]
mov dword [ebp - 0x828], esi
push eax
push 0x1005
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x404769
mov esi, dword [ebp - 0x82c]
mov esi, dword [esi]
test esi, esi
je 0x4046af
mov eax, dword [esi + 4]
test eax, eax
jne 0x4046b1
push dword [esi]
call fcn.0040abb0
mov dword [esi + 4], eax
jmp 0x4046b1
xor eax, eax
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x810], eax
mov eax, 2
push 0x400
mov word [ebp - 0x814], ax
lea eax, [ebp - 0x404]
push 0
push eax
call fcn.0040ae60
push 0x400
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.0040ae60
lea eax, [ebp - 0x404]
push 0x2c
push eax
call fcn.004045c0
add esp, 0x20
xor eax, eax
mov word [ebp - 0x402], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x3fc], eax
mov ax, word [0x4700a8]
mov word [ebp - 0x3fe], ax
inc ax
mov word [0x4700a8], ax
lea eax, [ebp - 0x404]
push 0x2c
push eax
call fcn.00404500
add esp, 8
mov word [ebp - 0x402], ax
lea eax, [ebp - 0x814]
push 0x10
push eax
push 0
push 0x2c
lea eax, [ebp - 0x404]
push eax
push edi
call dword [sym.imp.WS2_32.dll_sendto]
cmp eax, 0xffffffff
jne 0x40477b
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409118
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x82c]
mov dword [ebp - 0x82c], 0x10
push eax
lea eax, [ebp - 0x824]
push eax
push 0
push 0x400
lea eax, [ebp - 0x804]
push eax
push edi
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp eax, 0xffffffff
jne 0x4047f4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x274c
je 0x404769
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea eax, [ebp - 0x404]
push eax
push 0
call edi
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
push eax
call esi
lea eax, [ebp - 0x804]
push eax
push 0
call edi
push eax
call esi
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409118
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x824]
push ecx
push eax
lea eax, [ebp - 0x804]
push eax
call fcn.00404580
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
pop edi
pop esi
call fcn.00409118
mov esp, ebp
pop ebp
ret
Function at 0x405710
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc90
mov eax, dword [0x46f20c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0xc8c]
push ebx
mov ebx, dword [ebp + 8]
push ecx
push eax
push 2
push 1
push 2
mov dword [ebp - 0xc8c], 0
call sub.MPR.dll_WNetOpenEnumW
test eax, eax
je 0x40575c
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409118
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0xc90]
mov dword [ebp - 0xc88], 0x64
push eax
lea eax, [ebp - 0xc84]
mov dword [ebp - 0xc90], 0xc80
push eax
lea eax, [ebp - 0xc88]
push eax
push dword [ebp - 0xc8c]
call sub.MPR.dll_WNetEnumResourceW
cmp eax, 0x103
je 0x405841
push esi
push edi
nop dword [eax]
test eax, eax
jne 0x40583f
xor edi, edi
cmp dword [ebp - 0xc88], edi
jbe 0x405800
lea esi, [ebp - 0xc70]
nop dword [eax + eax]
cmp dword [0x4700b4], 0
jne 0x405800
cmp dword [esi - 0xc], 1
jne 0x4057e1
push dword [esi]
push 0
push 0x143
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4057f4
test byte [esi - 8], 2
je 0x4057f4
lea eax, [esi - 0x14]
push eax
push ebx
call fcn.00405710
add esp, 8
inc edi
add esi, 0x20
cmp edi, dword [ebp - 0xc88]
jb 0x4057c0
lea eax, [ebp - 0xc90]
mov dword [ebp - 0xc88], 0x64
push eax
lea eax, [ebp - 0xc84]
mov dword [ebp - 0xc90], 0xc80
push eax
lea eax, [ebp - 0xc88]
push eax
push dword [ebp - 0xc8c]
call sub.MPR.dll_WNetEnumResourceW
cmp eax, 0x103
jne 0x4057a0
pop edi
pop esi
push dword [ebp - 0xc8c]
call sub.MPR.dll_WNetCloseEnum
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop ebx
call fcn.00409118
mov esp, ebp
pop ebp
ret
Function at 0x405b60
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x46f20c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x418], 0x103
call fcn.00405860
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x405bbd
push str.Everyone
push esi
call fcn.004044a0
add esp, 8
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409118
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x414]
push eax
push edi
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
test eax, eax
je 0x405c41
cmp word [ebp - 0x20c], 0
lea eax, [ebp - 0x414]
push eax
je 0x405c23
lea eax, [ebp - 0x20c]
push eax
push str._s_s
push esi
call fcn.004044a0
add esp, 0x10
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409118
mov esp, ebp
pop ebp
ret
push 0x460e78
push esi
call fcn.004044a0
add esp, 0xc
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409118
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x414]
push eax
push edi
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
test eax, eax
jne 0x405bed
push edi
call fcn.00405d50
mov edi, eax
push edi
push 0x460e78
push esi
call fcn.004044a0
push edi
mov esi, eax
call fcn.0040912f
mov ecx, dword [ebp - 4]
add esp, 0x14
mov eax, esi
xor ecx, ebp
pop edi
pop esi
call fcn.00409118
mov esp, ebp
pop ebp
ret

Function at 0x406de0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov esi, ecx
lock inc dword [0x4702c4]
mov eax, dword [0x4702c8]
test eax, eax
je 0x406e00
cmp dword [0x4702c4], eax
jge 0x406e39
lea eax, [ebp - 4]
push eax
push 4
push esi
push 0x407f20
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
je 0x406e39
mov ecx, esi
call fcn.00406ef0
push 0xfffffffffffffffe
push edi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4072e0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x459cfb
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x46f20c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x44], edi
mov ebx, dword [edi + 8]
or eax, 0xffffffff
cmp ebx, dword [edi + 0xc]
ja 0x4074c4
nop
cmp dword [0x4700b4], 0
jne 0x4074c1
movzx eax, bl
push eax
mov eax, ebx
shr eax, 8
movzx eax, al
push eax
mov eax, ebx
shr eax, 0x10
movzx eax, al
push eax
mov eax, ebx
shr eax, 0x18
push eax
lea eax, [ebp - 0x38]
push 0x4610e0
push eax
call fcn.004044a0
push 0xc
call fcn.00409134
mov esi, eax
add esp, 0x1c
mov dword [ebp - 0x48], esi
mov dword [ebp - 4], 0
test esi, esi
je 0x407395
lea eax, [ebp - 0x34]
mov dword [esi + 4], 0
push eax
mov dword [esi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esi], eax
test eax, eax
je 0x40750f
jmp 0x407397
xor esi, esi
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x40], esi
test esi, esi
je 0x40750f
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 1
push 3
push eax
call fcn.00404600
mov esi, dword [ebp - 0x40]
add esp, 8
mov byte [ebp - 0x39], al
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x40741d
or ecx, 0xffffffff
lock xadd dword [esi + 8], ecx
dec ecx
jne 0x407416
test esi, esi
je 0x407416
mov eax, dword [esi]
test eax, eax
je 0x4073f1
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x407408
push eax
call fcn.0040912f
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.00409164
mov al, byte [ebp - 0x39]
add esp, 8
mov dword [ebp - 0x40], 0
test al, al
je 0x4074b7
push 0x10
call fcn.00409134
add esp, 4
mov dword [ebp - 0x50], eax
mov dword [ebp - 4], 2
test eax, eax
je 0x407454
push 0x460e08
lea ecx, [ebp - 0x38]
push ecx
push dword [edi + 4]
mov ecx, eax
call fcn.004048d0
mov esi, eax
jmp 0x407456
xor esi, esi
mov dword [ebp - 4], 0xffffffff
lock inc dword [0x4702c4]
mov eax, dword [0x4702c8]
test eax, eax
je 0x407475
cmp dword [0x4702c4], eax
jge 0x4074b0
lea eax, [ebp - 0x54]
push eax
push 4
push esi
push 0x407f20
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
je 0x4074ad
mov ecx, esi
call fcn.00406ef0
push 0xfffffffffffffffe
push edi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edi, dword [ebp - 0x44]
jmp 0x4074b7
mov edi, dword [ebp - 0x44]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
inc ebx
cmp ebx, dword [edi + 0xc]
jbe 0x407320
or eax, 0xffffffff
lock xadd dword [0x4702c4], eax
dec eax
jne 0x4074e4
push 0
push 0
push 0x8000
push dword [0x4702cc]
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, edi
call fcn.00406ef0
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00409118
mov esp, ebp
pop ebp
ret
push 0x8007000e
call fcn.00408380
int3
Function at 0x442501
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004420f9

Function at 0x44250c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00442283

Function at 0x44639d
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00445d5b

Function at 0x446f3e
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00446e12
Function at 0x40b17f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
or al, 0x40
inc eax
mov dword [ebp + 0xc], eax
jmp 0x40b132
push ebp
mov edi, esp
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x10]
dec ecx
mov dword [ebp + 0x10], ecx
test eax, eax
jle 0x40b1d8
mov eax, dword [ebp + 8]
push cs
mov bh, 0
mov ecx, dword [ebp + 0xc]
movzx ecx, byte [ecx]
cmp eax, ecx
jge 0x40b1a5
or eax, 0xffffffff
jmp 0x40b1da
mov eax, dword [ebp + 0x48]
movsx eax, word [eax]
mov ecx, dword [ebp + 0xc]
movzx ecx, word [ecx + 0x57ec13b]
or eax, 0xffffffff
jmp 0x40b15a
xor eax, edx
pop ebp
ret 0xc

Function at 0x40b1be
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov bh, 2
test eax, eax
jne 0x40b1c6
jmp 0x40b1d8
mov eax, dword [ebp + 8]
inc eax
inc eax
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0xc]
inc eax
inc eax
mov dword [ebp + 0xc], eax
jmp 0x40b182

Function at 0x40b24c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
movzx eax, word [eax]

Function at 0x40c613
Capabilities:
Delete file

Disassembly:
inc ecx
add bh, bh
adc eax, 0x4331d0
jmp 0x40c5fc
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.0040b4d5
cmp dword [0x41c200], ebx
jne 0x40c5f0
cmp byte [0x41c208], bl
pop ebx
je 0x40c612
jmp fcn.0040c422
sar edi, cl
je 0x40c63a
push dword [esp + 4]
push esi
add al, 0x56
call fcn.0040b0a4
xor ebx, dword [ecx + 0x66]
cmp dword [esi], ecx
je 0x40c64b
mov eax, esp
movzx edx, word [eax]
cmp dx, 0x3a
je 0x40c63b
inc esi
cmp edx, 0x5c
je 0x40c63b
cmp dx, 0x2f
jne 0x40c641
push es
push 0x25
pop edx
inc esi
mov dword [eax], edx
inc ecx
lea eax, [esi + ecx*2]
cmp word [eax], 0
jne 0x40c5e6
ret 0x4004
Function at 0x40cb18
Capabilities:
Delete file
Hide graphical window
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1040
call fcn.00401200
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp word [esi], bx
je 0x40cd4f
push esi
call fcn.0040b07a
cmp eax, 0x3f6
jae 0x40cd4f
push edi
push 0x3c
pop edi
push edi
push ebx
lea eax, [ebp - 0x80]
push eax
call fcn.0040ad53
movzx ecx, word [esi]
mov ebp, edi
rol bh, 0x45
invalid
pop esi
pop ebx
leave
ret 4

Function at 0x412857
Capabilities:
Get common file path

Disassembly:
push dword [esp + 4]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
neg eax
sbb eax, eax
neg eax
ret 8
Function at 0x43edbd
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004350a7
and dword [ebp - 4], 0
cmp dword [0x457aac], 0
mov ebx, eax
jne 0x43ee6e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x43ef1f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x43ef1f
push eax
call fcn.00435035
mov dword [esp], 0x4480f0
push edi
mov dword [0x457aac], eax
call esi
push eax
call fcn.00435035
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x457ab0], eax
call esi
push eax
call fcn.00435035
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x457ab4], eax
call esi
push eax
call fcn.00435035
pop ecx
mov dword [0x457abc], eax
test eax, eax
je 0x43ee6e
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00435035
pop ecx
mov dword [0x457ab8], eax
mov eax, dword [0x457ab8]
cmp eax, ebx
je 0x43eec6
cmp dword [0x457abc], ebx
je 0x43eec6
push eax
call fcn.004350b0
push dword [0x457abc]
mov esi, eax
call fcn.004350b0
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x43eec6
test edi, edi
je 0x43eec6
call esi
test eax, eax
je 0x43eebd
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x43eebd
test byte [ebp - 0xc], 1
jne 0x43eec6
or dword [ebp + 0x10], 0x200000
jmp 0x43eeff
mov eax, dword [0x457ab0]
cmp eax, ebx
je 0x43eeff
push eax
call fcn.004350b0
pop ecx
test eax, eax
je 0x43eeff
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x43eeff
mov eax, dword [0x457ab4]
cmp eax, ebx
je 0x43eeff
push eax
call fcn.004350b0
pop ecx
test eax, eax
je 0x43eeff
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x457aac]
call fcn.004350b0
pop ecx
test eax, eax
je 0x43ef1f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x43ef21
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
mov ebx, 0x40c7d0
nop
mov ecx, 0x22f21aa7
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x432024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f314
mov ecx, 0x22132421
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x403550
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push esi
push edi
xor edi, edi
cmp eax, edi
jl 0x40357a
add eax, dword [0x472e18]
push edi
push edi
push eax
push dword [0x40b014]
mov dword [0x42f1e4], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
pop esi
push esi
call fcn.004033d2
cmp eax, edi
jl 0x403673
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp + 8]
push eax
push dword [0x40b014]
call ebx
test eax, eax
je 0x40366f
cmp dword [ebp - 4], esi
jne 0x40366f
push dword [ebp + 8]
add dword [0x42f1e4], esi
call fcn.004033d2
mov dword [ebp - 8], eax
cmp eax, edi
jl 0x403672
cmp dword [ebp + 0x10], edi
jne 0x40363e
cmp dword [ebp + 8], edi
jle 0x40366a
mov esi, 0x42f1e8
mov edi, 0x4000
cmp dword [ebp + 8], edi
jge 0x4035ee
mov edi, dword [ebp + 8]
push 0
lea eax, [ebp - 4]
push eax
push edi
push esi
push dword [0x40b014]
call ebx
test eax, eax
je 0x40366f
cmp edi, dword [ebp - 4]
jne 0x40366f
push 0
lea eax, [ebp + 0x14]
push eax
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40363a
cmp dword [ebp + 0x14], edi
jne 0x40363a
mov eax, dword [ebp - 4]
add dword [ebp - 8], eax
sub dword [ebp + 8], eax
add dword [0x42f1e4], eax
cmp dword [ebp + 8], 0
jg 0x4035e1
jmp 0x40366a
push 0xfffffffffffffffe
jmp 0x403671
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x403649
mov eax, dword [ebp + 0x14]
push edi
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40b014]
call ebx
test eax, eax
je 0x40366f
mov eax, dword [ebp - 4]
add dword [0x42f1e4], eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x403672
push 0xfffffffffffffffd
pop eax
pop ebx
pop edi
pop esi
leave
ret 0x10

Function at 0x403e18
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x403e45
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.00403b57
push edx
xchg byte [esi], bh
and cl, byte [ebp - 0x17af3fbb]
invalid
Function at 0x4073e2
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x461134], 0
jne 0x407420
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4073f6
mov dword [ecx*4 + 0x461130], eax
inc ecx
cmp ecx, 0x100
jl 0x4073f1
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x40744d
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x461130]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x40742e
not eax
pop ebp
ret 0xc

Function at 0x4014e6
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword [esp + 4]
push 0xfffffffffffffffb
pop eax
mov dl, byte [eax + ecx]
cmp dl, 0x90
je 0x4014fa
cmp dl, 0xcc
jne 0x401544
inc eax
cmp eax, 0xffffffff
jle 0x4014ed
mov al, byte [ecx]
cmp al, 0x8b
je 0x40150a
cmp al, 0x89
jne 0x401544
cmp byte [ecx + 1], 0xff
jne 0x401544
mov eax, 0x40189c
mov byte [ecx - 5], 0xe9
sub eax, ecx
mov dword [ecx - 4], eax
lea eax, [ecx + 2]
mov dword [0x436a10], eax
mov eax, 0xf9eb
push 0
push 0
mov word [ecx], ax
call dword [0x42a014]
push eax
call dword [0x42a034]
mov al, 1
ret 0xc
xor al, al
jmp 0x401541
Function at 0x401a50
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call dbg.__acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call dbg.__acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x401ab0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x40d068]
test esi, esi
jle 0x401bd0
mov eax, dword [0x40d06c]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x401ae4
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x401b67
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x401ad0
mov dword [esp], ebx
call dbg.__mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x401bf7
mov eax, dword [0x40d06c]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call dbg._GetPEImageBase
mov edx, dword [0x40d06c]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401bd7
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x401b60
lea edx, [eax - 0x40]
and edx, 0xffffffbf
jne 0x401b70
add dword [0x40d068], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x40d06c]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x401b60
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
lea esi, cs:[esi]
nop
xor esi, esi
jmp 0x401aee
mov eax, dword [0x40d06c]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, cs:[esi]
nop
Function at 0x402140
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x40d084
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x40d07c]
sub esp, 4
test ebx, ebx
je 0x402195
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
mov esi, eax
sub esp, 4
call edi
test esi, esi
je 0x40218e
test eax, eax
jne 0x40218e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402170
mov dword [esp], 0x40d084
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4024f0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x402515
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x402520
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x402515
push esi
push ebx
mov ebx, dword [esp + 0xc]
movzx eax, word [ecx + 0x400014]
movzx esi, word [ecx + 0x400006]
sub ebx, 0x400000
lea eax, [edx + eax + 0x18]
test si, si
je 0x402568
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x40255e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40256a
add ecx, 1
add eax, 0x28
cmp esi, ecx
jne 0x402550
xor eax, eax
pop ebx
pop esi
ret