joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002540
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 8
call fcn.10002460
test eax, eax
je 0x10002737
call fcn.100024d0
test eax, eax
jne 0x1000256f
push eax
push 0x1002f5a4
push 0x1002f5ac
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
add esp, 8
ret
push ebx
push esi
push 0x1002f5bc
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x1002f5d0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push 0x418635
mov eax, 0x100023b0
call fcn.10001ce0
push 0x418708
mov eax, 0x100023d0
call fcn.10001ce0
mov dword [0x1003a3d4], esi
add esi, 0x280c
push esi
mov eax, 0x10001e60
call fcn.10001ce0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 0xc
lea eax, [esp + 8]
push eax
push 0x40
push 5
push 0x42d6f3
call esi
mov eax, 0x42d6f3
mov ecx, dword [eax]
mov dword [0x1003a0a0], ecx
movzx edx, byte [eax + 4]
mov eax, 0x10002040
sub eax, 0x42d6f8
mov byte [0x1003a0a4], dl
mov dword [esp + 0xc], eax
mov ebx, 0x42d6f3
mov dl, 0xe9
mov byte [ebx], dl
add ebx, 1
mov edx, dword [esp + 0xc]
mov dword [ebx], edx
mov edx, dword [esp + 8]
lea ecx, [esp + 8]
push ecx
push edx
push 5
push 0x42d6f3
call esi
lea eax, [esp + 8]
push eax
push 0x40
push 5
push 0x40b47d
call esi
mov eax, 0x40b47d
mov ecx, dword [eax]
mov dword [0x1003a0a0], ecx
movzx edx, byte [eax + 4]
mov eax, 0x10002250
sub eax, 0x40b482
mov byte [0x1003a0a4], dl
mov dword [esp + 0xc], eax
mov ebx, 0x40b47d
mov dl, 0xe9
mov byte [ebx], dl
add ebx, 1
mov edx, dword [esp + 0xc]
mov dword [ebx], edx
mov edx, dword [esp + 8]
lea ecx, [esp + 8]
push ecx
push edx
push 5
push 0x40b47d
call esi
lea eax, [esp + 8]
push eax
push 0x40
push 5
push 0x415bc7
call esi
mov eax, 0x415bc7
mov ecx, dword [eax]
mov dword [0x1003a0a0], ecx
movzx edx, byte [eax + 4]
mov eax, 0x10001d50
sub eax, 0x415bcc
mov byte [0x1003a0a4], dl
mov dword [esp + 0xc], eax
mov ebx, 0x415bc7
mov dl, 0xe9
mov byte [ebx], dl
add ebx, 1
mov edx, dword [esp + 0xc]
mov dword [ebx], edx
lea ecx, [esp + 8]
mov edx, dword [esp + 8]
push ecx
push edx
push 5
push 0x415bc7
call esi
call fcn.10001c50
lea eax, [esp + 8]
push eax
push 0x40
push 5
push 0x4378b9
call esi
mov eax, 0x4378b9
mov ecx, dword [eax]
mov dword [0x1003a0a0], ecx
movzx edx, byte [eax + 4]
mov eax, 0x10001fc0
sub eax, 0x4378be
mov byte [0x1003a0a4], dl
mov dword [esp + 0xc], eax
mov ebx, 0x4378b9
mov dl, 0xe9
mov byte [ebx], dl
add ebx, 1
mov edx, dword [esp + 0xc]
mov dword [ebx], edx
mov edx, dword [esp + 8]
lea ecx, [esp + 8]
push ecx
push edx
push 5
push 0x4378b9
call esi
pop esi
pop ebx
add esp, 8
ret
Function at 0x10002820
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x110
mov eax, dword [0x10035b10]
xor eax, esp
mov dword [esp + 0x10c], eax
push ebx
push ebp
push esi
push edi
push 0x32
xor esi, esi
push esi
push 0x1003a2ec
call fcn.10012780
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
xor eax, eax
add esp, 0xc
mov dword [0x1003a320], eax
mov dword [0x1003a324], eax
mov dword [0x1003a328], eax
mov dword [0x1003a32c], eax
mov dword [0x1003a330], eax
mov dword [0x1003a334], eax
mov dword [0x1003a338], eax
mov word [0x1003a33c], ax
lea eax, [esp + 0x18]
push eax
push 0x1002f318
push closesocket
mov dword [esp + 0x1c], esi
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x100028cb
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
push esi
push esi
push 0x1002f340
push eax
mov dword [esp + 0x2c], 4
call ebx
mov ecx, dword [esp + 0x18]
push ecx
call ebp
mov esi, dword [esp + 0x10]
push 0xff
lea edx, [esp + 0x20]
push 0
push edx
call fcn.10012780
push esi
lea eax, [esp + 0x2c]
push 0x1002f34c
push eax
call fcn.10011672
add esp, 0x18
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x20]
push edx
push closesocket
call edi
test eax, eax
jne 0x1000292d
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push 0x1003a2ec
push 0
push 0
push 0x1002f608
push ecx
mov dword [esp + 0x2c], 0xff
call ebx
mov edx, dword [esp + 0x10]
push edx
call ebp
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x20]
push ecx
push closesocket
mov dword [esp + 0x24], 0
call edi
test eax, eax
je 0x1000294e
xor eax, eax
jmp 0x1000297b
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push 0x1002f614
push ecx
mov dword [esp + 0x2c], 4
call ebx
mov edx, dword [esp + 0x10]
push edx
call ebp
mov eax, dword [esp + 0x18]
push 0xa
push 0x1003a320
push eax
call fcn.10028f98
mov ecx, dword [esp + 0x128]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1001116a
add esp, 0x110
ret
Function at 0x100039f0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov eax, 0x1003a278
push edi
lea edx, [eax + 1]
jmp 0x10003a00
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10003a00
sub eax, edx
je 0x10003a47
push 0x1002f50c
push 0x1002f76c
call fcn.10011568
mov esi, eax
mov eax, 0x1003a278
add esp, 8
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10003a27
push esi
sub eax, edx
push eax
push 1
push 0x1003a278
call fcn.10011e0b
push esi
call fcn.100115f6
add esp, 0x14
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xbb8
call edi
mov esi, 0x1002f838
call fcn.10001600
test eax, eax
je 0x10003a67
jmp 0x10003b41
mov esi, 0x1002f854
call fcn.10001600
test eax, eax
je 0x10003a7a
jmp 0x10003b41
mov esi, 0x1002f86c
call fcn.10001600
test eax, eax
je 0x10003a8d
jmp 0x10003b41
mov esi, 0x1002f880
call fcn.10001600
test eax, eax
je 0x10003aa0
jmp 0x10003b41
mov esi, 0x1002f898
call fcn.10001600
test eax, eax
je 0x10003ab3
jmp 0x10003b41
mov esi, 0x1002f8ac
call fcn.10001600
test eax, eax
je 0x10003ac3
jmp 0x10003b41
mov esi, 0x1002f8c4
call fcn.10001600
test eax, eax
je 0x10003ad3
jmp 0x10003b41
mov esi, 0x1002f8dc
call fcn.10001600
test eax, eax
je 0x10003ae3
jmp 0x10003b41
mov esi, 0x1002f8f4
call fcn.10001600
test eax, eax
je 0x10003af3
jmp 0x10003b41
mov esi, 0x1002f90c
call fcn.10001600
test eax, eax
je 0x10003b03
jmp 0x10003b41
mov esi, 0x1002f920
call fcn.10001600
test eax, eax
je 0x10003b13
jmp 0x10003b41
mov esi, 0x1002f934
call fcn.10001600
test eax, eax
je 0x10003b23
jmp 0x10003b41
mov esi, 0x1002f950
call fcn.10001600
test eax, eax
je 0x10003b33
jmp 0x10003b41
mov esi, 0x1002f968
call fcn.10001600
test eax, eax
je 0x10003b4d
call fcn.10001740
push 0x1770
call edi
mov eax, 0
mov eax, ebx
mov esi, str.MFC71CHS.exe
call fcn.10001600
test eax, eax
je 0x10003b67
call fcn.10001740
pop edi
pop esi
pop ecx
ret
Function at 0x1001116a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10035b10]
jne 0x10011174
repz ret
jmp fcn.1001581f

Function at 0x10023406
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10019eee
and dword [ebp - 4], 0
cmp dword [0x10039cc0], 0
mov ebx, eax
jne 0x100234b7
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10023568
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1002f094
push edi
call esi
test eax, eax
je 0x10023568
push eax
call fcn.10019e7c
mov dword [esp], 0x1002f084
push edi
mov dword [0x10039cc0], eax
call esi
push eax
call fcn.10019e7c
mov dword [esp], 0x1002f070
push edi
mov dword [0x10039cc4], eax
call esi
push eax
call fcn.10019e7c
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x10039cc8], eax
call esi
push eax
call fcn.10019e7c
pop ecx
mov dword [0x10039cd0], eax
test eax, eax
je 0x100234b7
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10019e7c
pop ecx
mov dword [0x10039ccc], eax
mov eax, dword [0x10039ccc]
cmp eax, ebx
je 0x1002350f
cmp dword [0x10039cd0], ebx
je 0x1002350f
push eax
call fcn.10019ef7
push dword [0x10039cd0]
mov esi, eax
call fcn.10019ef7
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1002350f
test edi, edi
je 0x1002350f
call esi
test eax, eax
je 0x10023506
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x10023506
test byte [ebp - 0xc], 1
jne 0x1002350f
or dword [ebp + 0x10], 0x200000
jmp 0x10023548
mov eax, dword [0x10039cc4]
cmp eax, ebx
je 0x10023548
push eax
call fcn.10019ef7
pop ecx
test eax, eax
je 0x10023548
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x10023548
mov eax, dword [0x10039cc8]
cmp eax, ebx
je 0x10023548
push eax
call fcn.10019ef7
pop ecx
test eax, eax
je 0x10023548
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10039cc0]
call fcn.10019ef7
pop ecx
test eax, eax
je 0x10023568
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1002356a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4010f2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx eax, word [esp + 4]
push esi
push 0x63
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x40110b
pop esi
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0xc]
push esi
push 0
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
pop esi
ret

Function at 0x40112c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
push edi
push esi
push 0x80
push 2
push esi
push esi
push 0x40000000
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x40117c
mov dword [ebp + 0x10], esi
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp + 0x10]
push eax
push esi
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40117c
cmp esi, dword [ebp + 0x10]
jne 0x40117c
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x40117e
xor al, al
pop edi
pop esi
pop ebp
ret

Function at 0x4011b6
Capabilities:
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18c
push esi
lea eax, [ebp - 0x104]
push edi
push eax
push dword [ebp + 0x10]
call fcn.00401182
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040112c
add esp, 0x14
test al, al
je 0x401229
lea eax, [ebp - 0x18c]
push 0
push eax
lea eax, [ebp - 0x104]
push eax
call sub.LZ32.dll_LZOpenFileA
mov edi, eax
test edi, edi
jl 0x401229
lea eax, [ebp - 0x18c]
push 0x1002
push eax
push dword [ebp + 0x14]
call sub.LZ32.dll_LZOpenFileA
mov esi, eax
test esi, esi
jl 0x401229
push esi
push edi
call sub.LZ32.dll_LZCopy
test eax, eax
jge 0x40122d
xor eax, eax
jmp 0x401249
push edi
call sub.LZ32.dll_LZClose
push esi
call sub.LZ32.dll_LZClose
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 1
pop eax
pop edi
pop esi
leave
ret
Function at 0x40124d
Capabilities:
Accept command line arguments
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x364
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
push 1
xor esi, esi
mov ebx, fcn.004011b6
call fcn.004010f2
mov edi, eax
pop ecx
test edi, edi
pop ecx
je 0x4012c9
lea eax, [ebp - 0x260]
push eax
push dword [ebp + 8]
call fcn.00401182
lea eax, [ebp - 0x260]
push eax
push dword [ebp + 8]
push dword [ebp - 4]
push edi
call fcn.004011b6
add esp, 0x18
test eax, eax
je 0x4013d9
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x4013d9
push 0x401084
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
je 0x401302
lea eax, [ebp - 4]
push eax
push 2
call fcn.004010f2
mov edi, eax
pop ecx
test edi, edi
pop ecx
je 0x401302
lea eax, [ebp - 0x364]
push eax
push dword [ebp + 8]
call fcn.00401182
lea eax, [ebp - 0x364]
push eax
push dword [ebp + 8]
push dword [ebp - 4]
push edi
call ebx
add esp, 0x18
test eax, eax
jne 0x401323
test esi, esi
je 0x4013d9
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x4013d9
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
test esi, esi
je 0x40133d
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x260]
push eax
call ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, eax
xor cl, cl
cmp byte [edi], 0x22
jne 0x40134f
inc cl
inc edi
mov al, byte [edi]
test al, al
je 0x401362
cmp al, 0x20
jne 0x40135d
test cl, cl
je 0x401362
cmp al, 0x22
jne 0x40134e
inc edi
lea eax, [ebp - 0x15c]
push 0x401080
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x364]
push eax
lea eax, [ebp - 0x15c]
push eax
call esi
lea eax, [ebp - 0x15c]
push 0x40107c
push eax
call esi
lea eax, [ebp - 0x15c]
push edi
push eax
call esi
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
lea eax, [ebp - 0x14]
xor edi, edi
push eax
lea eax, [ebp - 0x58]
push eax
push edi
push edi
push 0x20
push 1
push edi
lea eax, [ebp - 0x15c]
push edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4013dd
lea eax, [ebp - 0x364]
push eax
call ebx
xor al, al
jmp 0x401421
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push 0xffffffffffffffff
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp + 0xc]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x14]
call esi
lea eax, [ebp - 0x364]
push eax
call ebx
test eax, eax
jne 0x40141f
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0x64
jl 0x401404
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x405df0
Capabilities:
Delete file
Execute command

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x54c
mov eax, dword [ebp + 8]
xor ecx, ecx
lea edx, [ebp - 0x10c]
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0x104
mov dword [ebp - 0x514], eax
mov dword [ebp - 0x518], ecx
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
cmp dword [0x43c144], 0
je 0x405e66
lea eax, [ebp - 0x10c]
mov ecx, dword [0x43c140]
mov dword [esp], eax
mov dword [esp + 4], 0x104
lea eax, str._s.dot
mov dword [esp + 8], eax
mov dword [esp + 0xc], ecx
call fcn.0040afa0
jmp 0x405ebf
xor eax, eax
lea ecx, [ebp - 0x10c]
mov dword [esp], 0
mov dword [ebp - 0x51c], eax
mov dword [ebp - 0x520], ecx
call fcn.00406010
mov dword [ebp - 0x524], eax
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
mov ecx, dword [ebp - 0x520]
mov dword [esp], ecx
mov dword [esp + 4], 0x104
lea edx, str.dot__d__d.dot
mov dword [esp + 8], edx
mov edx, dword [ebp - 0x524]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], eax
call fcn.0040afa0
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x110], 0
mov dword [esp], eax
lea eax, [0x432f0c]
mov dword [esp + 4], eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fopen
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0x110]
mov dword [esp], eax
lea eax, str.digraph_g__nnode__shape__record_height.1___n
mov dword [esp + 4], eax
call fcn.0040aea0
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp + 8]
mov edx, dword [edx + 0x1c]
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [ebp - 0x528], eax
call fcn.00405ba0
mov eax, dword [ebp - 0x110]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x1c]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00405d10
mov eax, dword [ebp - 0x110]
mov dword [esp], eax
lea eax, [0x432f3d]
mov dword [esp + 4], eax
call fcn.0040aea0
mov ecx, dword [ebp - 0x110]
mov dword [esp], ecx
mov dword [ebp - 0x52c], eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
lea ecx, [ebp - 0x10c]
lea edx, [ebp - 0x510]
xor esi, esi
mov edi, edx
mov dword [esp], edi
mov dword [esp + 4], 0
mov dword [esp + 8], 0x400
mov dword [ebp - 0x530], eax
mov dword [ebp - 0x534], ecx
mov dword [ebp - 0x538], edx
mov dword [ebp - 0x53c], esi
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov eax, dword [0x43c140]
mov ecx, dword [ebp - 0x538]
mov dword [esp], ecx
mov dword [esp + 4], 0x400
lea edx, str.dot__Tpng__o___s____s_
mov dword [esp + 8], edx
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x534]
mov dword [esp + 0x10], eax
call fcn.0040afa0
lea ecx, [ebp - 0x510]
mov dword [esp], ecx
mov dword [ebp - 0x540], eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll_system
cmp dword [0x43c144], 0
jne 0x406003
lea eax, [ebp - 0x10c]
mov dword [esp], eax
call sub.api_ms_win_crt_filesystem_l1_1_0.dll_remove
add esp, 0x54c
pop esi
pop edi
pop ebp
ret
Function at 0x40b940
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
mov dword [esp + 0xc], eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov dword [esp], 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00410a60
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
lea esi, [esi]

Function at 0x40b9a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x3c
mov eax, dword [0x43c4e0]
test eax, eax
jle 0x40bab0
mov edx, dword [0x43c4e4]
xor ebx, ebx
mov ecx, dword [edx + 0xc]
cmp ecx, esi
ja 0x40b9d1
mov edi, dword [edx + 0x10]
add ecx, dword [edi + 8]
cmp esi, ecx
jb 0x40ba4a
add ebx, 1
add edx, 0x14
cmp ebx, eax
jne 0x40b9c0
mov dword [esp], esi
call fcn.00410bc0
test eax, eax
mov edi, eax
je 0x40bad7
lea esi, [ebx + ebx*4]
mov ebx, dword [0x43c4e4]
shl esi, 2
add ebx, esi
mov dword [ebx + 0x10], eax
mov dword [ebx], 0
call fcn.00410cb0
add eax, dword [edi + 0xc]
mov dword [ebx + 0xc], eax
lea eax, [ebp - 0x34]
mov dword [esp + 4], eax
mov eax, dword [0x43c4e4]
mov dword [esp + 8], 0x1c
mov eax, dword [eax + esi + 0xc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x40bab7
mov eax, dword [ebp - 0x20]
cmp eax, 0x40
jne 0x40ba52
add dword [0x43c4e0], 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 4
je 0x40ba43
cmp eax, 0x80
je 0x40ba43
cmp eax, 8
je 0x40ba43
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x28]
add esi, dword [0x43c4e4]
mov dword [esi + 4], eax
mov dword [esi + 8], edx
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x40ba43
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.0040b940
nop
lea esi, [esi]
xor ebx, ebx
jmp 0x40b9db
mov eax, dword [0x43c4e4]
mov eax, dword [eax + esi + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.0040b940
mov dword [esp + 4], esi
mov dword [esp], str.Address__p_has_no_image_section
call fcn.0040b940
mov esi, esi
lea edi, [edi]

Function at 0x40ca50
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0
jmp fcn.0040c450
Function at 0x410ae0
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x410b18
xor edx, edx
nop
mov ecx, dword [eax + 0xc]
cmp ecx, ebx
ja 0x410b0e
add ecx, dword [eax + 8]
cmp ebx, ecx
jb 0x410b1a
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x410b00
xor eax, eax
pop ebx
pop esi
ret
Function at 0x413f43
Capabilities:
Contain obfuscated stackstrings
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
push ebx
add esp, 0xffffff80
cmp dword [ebp + 8], 0
jne 0x413f56
jmp 0x41408a
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0042ae88
cmp eax, 1
jne 0x414082
mov dword [ebp - 0x77], 0x6f727245
mov dword [ebp - 0x73], 0x6c632072
mov dword [ebp - 0x6f], 0x696e6165
mov dword [ebp - 0x6b], 0x7520676e
mov dword [ebp - 0x67], 0x70732070
mov dword [ebp - 0x63], 0x6b5f6e69
mov dword [ebp - 0x5f], 0x20737965
mov dword [ebp - 0x5b], 0x20726f66
mov dword [ebp - 0x57], 0x65726874
mov dword [ebp - 0x53], 0x206461
lea edx, [ebp - 0x4f]
mov ebx, 0x43
mov eax, 0
mov ecx, edx
and ecx, 1
test ecx, ecx
je 0x413fce
mov byte [edx], al
add edx, 1
sub ebx, 1
mov ecx, edx
and ecx, 2
test ecx, ecx
je 0x413fe0
mov word [edx], ax
add edx, 2
sub ebx, 2
mov ecx, ebx
shr ecx, 2
mov edi, edx
rep stosd dword es:[edi], eax
mov edx, edi
mov ecx, ebx
and ecx, 2
test ecx, ecx
je 0x413ffa
mov word [edx], ax
add edx, 2
and ebx, 1
mov ecx, ebx
test ecx, ecx
je 0x414008
mov byte [edx], al
add edx, 1
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call eax
mov dword [esp + 8], 0xa
lea edx, [ebp - 0x77]
add edx, 0x27
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ultoa]
call eax
mov dword [ebp - 0xc], 0x27
jmp 0x414038
add dword [ebp - 0xc], 1
lea edx, [ebp - 0x77]
mov eax, dword [ebp - 0xc]
add eax, edx
movzx eax, byte [eax]
test al, al
je 0x41404f
mov eax, dword [ebp - 0xc]
cmp eax, 0x69
jbe 0x414034
mov eax, dword [ebp - 0xc]
cmp eax, 0x69
ja 0x41406d
lea edx, [ebp - 0x77]
mov eax, dword [ebp - 0xc]
add eax, edx
mov byte [eax], 0xa
mov eax, dword [ebp - 0xc]
add eax, 1
mov byte [ebp + eax - 0x77], 0
lea eax, [ebp - 0x77]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call eax
sub esp, 4
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov dword [eax], edx
lea esp, [ebp - 8]
pop ebx
pop edi
pop ebp
ret