joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411080
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
mov eax, ecx
push ebx
push esi
lea ecx, [ebp - 4]
mov dword [ebp - 8], eax
push ecx
push 0x2001f
push 0
mov ebx, edx
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 2
jne 0x4110af
xor esi, esi
inc esi
jmp 0x4110f4
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x4110f4
mov ecx, dword [ebp - 4]
call fcn.00410ec8
mov esi, eax
test esi, esi
js 0x4110f4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 4], 0
push ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
cmp dword [ebp - 4], 0
je 0x411103
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x414026
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push esi
push str.FlsAlloc
push 0x4263f0
push str.FlsAlloc
push 0
call fcn.00413f9f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x414058
push dword [ebp + 8]
mov ecx, esi
call fcn.00411dc4
call esi
pop esi
pop ebp
ret
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x41409a
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push str.FlsGetValue
push 0x426414
push str.FlsGetValue
push 2
call fcn.00413f9f
add esp, 0x10
mov esi, eax
push dword [ebp + 8]
test esi, esi
je 0x4140cb
mov ecx, esi
call fcn.00411dc4
call esi
jmp 0x4140d1
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
pop esi
pop ebp
ret

Function at 0x4140d4
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push str.FlsSetValue
push 0x426428
push str.FlsSetValue
push 3
call fcn.00413f9f
add esp, 0x10
mov esi, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
test esi, esi
je 0x414108
mov ecx, esi
call fcn.00411dc4
call esi
jmp 0x41410e
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
pop ebp
ret
Function at 0x641c1730
Capabilities:
Create thread
Inject thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x1f0fff
call sym._OpenProcess_12
sub esp, 0xc
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0x1000
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._VirtualAllocEx_20
sub esp, 0x14
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._WriteProcessMemory_20
sub esp, 0x14
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], sym._LoadLibraryA_4
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CreateRemoteThread_28
sub esp, 0x1c
mov dword [ebp - 0x14], eax
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
nop
leave
ret

Function at 0x641c1969
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0xc]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov eax, dword [ebp + 8]
call eax
nop
leave
ret

Function at 0x641c1d50
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x641c603c
call sym._EnterCriticalSection_4
mov ebx, dword [0x641c6034]
sub esp, 4
test ebx, ebx
je 0x641c1d9b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x641c1d94
test esi, esi
je 0x641c1d94
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x641c1d70
mov dword [esp], 0x641c603c
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x641c1f80
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], 0x641c4174
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]
Function at 0x641c1fd0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x641c20a8
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x641c200e
cmp eax, 4
jne 0x641c2030
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x641c201e
cmp edx, 4
je 0x641c201e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.641c1f80

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43300c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x43a9b6
Capabilities:
Encode data using xor

Disassembly:
imul eax, dword [edx + 0x680b6fc5], 0xffffffa3
pop ebp
invalid
jle 0x43a96a
jmp 0x43aa03
movsb byte es:[edi], byte [esi]
pop eax
or byte [ebp + 0x1e2a2b3c], ah
xchg ecx, eax
cmc
sub ebp, dword [ebp - 0x4737fec4]
stosb byte es:[edi], al
inc edx
int1
mov eax, dword [0x580292af]
mov cl, byte [edx - 0x24]
movsd dword es:[edi], dword [esi]
call 0xf65c7dfb
add al, 0xfb
or dword [ebp + esi*8 - 0x1b], eax
out dx, eax
jle 0x43aa66
imul edx, dword [edx + 0x2c732a6a], 3
in eax, dx
test al, 0xf
sbb byte [eax + 0x36], cl
xchg byte [esi + 0x2db5ab28], ch
stosd dword es:[edi], eax
mov ch, 0x2d
push 0xa1896dbe
push 0x28
mov dl, 0xaf
dec edx
dec edi
jo 0x43aa3d
lodsb al, byte [esi]
and ebx, dword [edi + eax*4]
lea ecx, [eax - 0x4e]
sub cl, ch
std
stosb byte es:[edi], al
or dword [eax - 0x11d29cde], ebp
lodsb al, byte [esi]
push es
sahf
mov ecx, 0x215c18a6
iretd
and edi, ecx
hlt
Function at 0x468656
Capabilities:
Encode data using xor

Disassembly:
xor cl, ch
sbb al, 0xae
xchg edi, eax
adc byte [ecx - 0x4ef2fe12], dh
scasb al, byte es:[edi]
sahf
shr dword [ebp - 0x59], 0x1c
out dx, al
mov al, 0x6a
out dx, al
xchg esi, eax
mov bh, byte [esi + 3]
push cs
mov bh, 0xa6
popal
or ch, byte [esi - 0x41]
adc dword [esi], ebx
mov ecx, 0x69deda6b
invalid
Function at 0x496686
Capabilities:
Encode data using xor

Disassembly:
arpl word [esi], cx
aas
inc ebp
push ecx
push ecx
cmp esp, esp
das
cmp byte [ebp - 1], 0x3e
xchg esi, eax
push eax
mov esp, 0xa2968fe2
nop
in al, 1
lodsb al, byte [esi]
pop ebp
push edx
xor al, 0x55
insb byte es:[edi], dx
xor byte [edx + edx*4], al
push ss
mov ebx, 0xa7842959
pop eax
scasb al, byte es:[edi]
push 0x26bd5b16
jg 0x49672d
and ah, bl
push 0xffffffffffffffc5
pushal
xchg dword [edi - 0x230cd9e7], esi
shl dword [0x46c7dd19], 0x63
inc edx
xchg esp, eax
xchg edi, eax
ja 0x4966ee
and esi, dword [eax + 0x56]
push esp
xchg esp, eax
imul esp, dword [eax - 0x9ec5c0b], 0xfffffff7
sub byte [edx - 0x5c], 0x75
insb byte es:[edi], dx
mov dh, 0x44
movd mm4, dword [esi]
movsb byte es:[edi], byte [esi]
daa
jp 0x4966e5
clc
pushal
invalid
sub eax, 0x662e49a4
mov ah, 0xba
movsd dword es:[edi], dword [esi]
cmp al, 0x40
xor eax, 0xfa437748
movsb byte es:[edi], byte [esi]
ljmp 0xa5f4
test byte [0xae140a06], dl
stosd dword es:[edi], eax
fcom qword [edi - 0x61b657e0]
add dword [esi - 0x1222a9f], ecx
xchg esi, eax
in eax, 0xc9
sbb eax, 0x3a2c2fec
or eax, 0x83d8f5f3
imul ebp, edx, 0x95d65308
push edi
push 0xcb29710f
sbb eax, esp
xchg edi, eax
pop ds
add al, dl
xchg edi, eax
imul edi, dword [ebx], 0x2d617973
stosb byte es:[edi], al
cmp byte [esi - 0x69], cl
jb 0x4967e5
jmp 0x496778
push edi
scasb al, byte es:[edi]
mov ch, 0x95
or dword [ecx + 0x624c4738], ebx
ja 0x496776
ljmp 0x74c3:0xe7aa1971
imul esi, dword [edx + 0x3352686b], 0x28
or ah, byte [ecx + 0x3b]
mov ebp, 0x63bcad1
push ebx
out dx, eax
imul edx, dword [ebx + 0x28], 0x6b68293b
pop edi
mov bl, 0x6a
sub dword [edi - 0x2f], edi
or al, 0x38
arpl word [ebx + 0x19], bx
jl 0x49680f
xor eax, 0x6a0a3d12
cli
mov ebp, 0x24fb49e7
loop 0x49684a
or dword [0xb95bfb7b], ebx
xchg edx, eax
jl 0x496856
mov gs, edx
and dword [ecx + 0x1b3839b7], eax
cmp byte [ebx], bl
movntq qword [0x792fa2], mm7
inc edx
salc
cmp byte [edx + 0x4ee9ffe9], dh
cld
pop ecx
pop ss
test al, 0xbd
mov dl, 0xe
add byte [ecx], al
jmp 0x4968be
leave
hlt
and dword [ebx + 0x12314a2d], ebp
xor dword [edx], edx
loope 0x496878
aam 0x66
ja 0x49685a
test bh, cl
ljmp 0xc7c3
adc al, dl
lds edx, [eax]
scasb al, byte es:[edi]
dec esp
call 0xd1177b4
ret 0xb4e6
arpl si, cx
sub byte [eax + edx*8], dl
dec edx
invalid
add dl, byte [ebx + ebp*2 - 0x44]
inc edi
adc al, 0x88
and byte cs:[eax - 0x529c5e83], cl
lodsd eax, dword [esi]
lahf
jne 0x496888
arpl ax, di
arpl si, cx
push esi
dec esp
mov bh, 0xc0
push esi
aad 0xd5
dec esp
loope 0x4968b1
and dword [eax - 0xe340358], edx
aam 0xe7
clc
cld
lock add dword [eax - 0x2a827c9f], esi
ret
Function at 0x4a9ea6
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
mov ebx, ecx
mov dword [ebp - 0xc], ebx
push esi
push edi
test ebx, ebx
jne 0x4a9ec2
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebx + 0xc984], 0xffffffff
jle 0x4a9ed7
mov eax, 0xfffffff6
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edx, edx
lea edi, [ebx + 0x11fb0]
mov eax, 0x4a2d20
mov ecx, 0x62
cmovne eax, edx
lea edx, [ebx + 0x12838]
mov esi, eax
mov dword [ebp - 0x2c], eax
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebx + 0x12138]
mov edi, 0x40
lea esi, [ebx + 0x9a0]
nop dword [eax]
nop dword [eax + eax]
lea eax, [esi - 0x80]
mov dword [ecx - 0x11e14], esi
mov dword [ecx - 0x11e18], eax
lea ecx, [ecx + 0x18]
mov dword [ecx - 0x14], edx
lea eax, [edx - 0x100]
mov dword [ecx - 0x18], eax
lea eax, [esi + 0x80]
mov dword [ecx - 0x11e28], eax
lea eax, [edx + 0x100]
mov dword [ecx - 0x10], eax
lea eax, [esi + 0x100]
mov dword [ecx - 0x11e24], eax
lea eax, [edx + 0x200]
mov dword [ecx - 0xc], eax
lea eax, [esi + 0x180]
mov dword [ecx - 0x11e20], eax
lea eax, [edx + 0x300]
mov dword [ecx - 8], eax
lea eax, [esi + 0x200]
mov dword [ecx - 0x11e1c], eax
add esi, 0x300
lea eax, [edx + 0x400]
add edx, 0x600
mov dword [ecx - 4], eax
sub edi, 1
jne 0x4a9f16
push dword [ebp - 0x2c]
add ebx, 0x320
xor edx, edx
mov ecx, ebx
mov dword [ebp - 8], ebx
call fcn.004af196
mov eax, ebx
mov dword [ebp - 0x20], edi
add esp, 4
mov dword [ebp - 4], edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x30], 3
Function at 0x4bb10e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c3370
cmp edx, dword [eax]
je 0x4bb130
add eax, 8
inc ecx
cmp eax, 0x4c3400
jl 0x4bb121
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c3370]
jne 0x4bb25e
mov eax, dword [0x4c7a24]
cmp eax, 1
je 0x4bb238
test eax, eax
jne 0x4bb161
cmp dword [0x4c32b0], 1
je 0x4bb238
cmp edx, 0xfc
je 0x4bb25e
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bb198
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004bb820
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bba50
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bb1db
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bba50
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bfa08
push edi
call fcn.004bd220
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004bb820
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bb830
lea eax, [ebp - 0xa0]
push 0x4bf9e8
push eax
call fcn.004bb830
push dword [esi + 0x4c3374]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bb830
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bd194
add esp, 0x2c
pop edi
jmp 0x4bb25e
lea eax, [ebp + 8]
lea esi, [esi + 0x4c3374]
push 0
push eax
push dword [esi]
call fcn.004bba50
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401e87
Capabilities:
Check os version

Disassembly:
mov eax, dword fs:[0x18]
sub esp, 0x74
mov eax, dword [eax + 0x30]
cmp dword [eax + 0xa4], 6
jae 0x40205e
cmp dword [0x43d228], 0
jne 0x402057
push ebx
push ebp
push edi
call fcn.004026cc
mov ebx, eax
test ebx, ebx
jne 0x401eca
push eax
push eax
push 1
push 0xc0000264
call dword [sym.imp.KERNEL32.dll_RaiseException]
push 0x5c
pop edx
push 0x4b
pop eax
push 0x65
pop ecx
push 0x72
mov word [esp + 0x36], ax
pop eax
push 0x6e
mov word [esp + 0x3a], ax
pop eax
push 0x6c
mov word [esp + 0x3c], ax
pop eax
push 0x4f
pop edi
push 0x62
mov word [esp + 0x40], ax
pop eax
push 0x6a
mov word [esp + 0x44], ax
pop eax
push 0x63
mov word [esp + 0x46], ax
mov word [esp + 0x38], cx
mov word [esp + 0x3e], cx
mov word [esp + 0x48], cx
pop ecx
push 0x74
pop ebp
push 0x73
pop eax
push 0x43
mov word [esp + 0x4e], ax
pop eax
push 0x72
mov word [esp + 0x52], ax
mov word [esp + 0x34], dx
mov word [esp + 0x50], dx
pop edx
push 0x69
pop eax
push 0x53
mov word [esp + 0x56], ax
pop eax
push 0x65
mov word [esp + 0x5a], ax
pop eax
push 0x75
mov word [esp + 0x5c], ax
pop eax
push 0x66
mov word [esp + 0x62], ax
pop eax
push 0x4d
mov word [esp + 0x68], ax
pop eax
push 0x65
mov word [esp + 0x4a], cx
mov word [esp + 0x5e], cx
pop ecx
push 0x6d
mov word [esp + 0x6a], ax
pop eax
push 0x6f
mov word [esp + 0x6e], ax
pop eax
push 0x79
mov word [esp + 0x70], ax
pop eax
mov word [esp + 0x3e], di
mov word [esp + 0x48], bp
mov word [esp + 0x50], dx
mov word [esp + 0x54], bp
mov word [esp + 0x5c], di
mov word [esp + 0x60], bp
mov word [esp + 0x62], di
mov word [esp + 0x68], cx
mov word [esp + 0x6e], dx
mov word [esp + 0x70], ax
push 0x45
pop eax
mov word [esp + 0x72], ax
lea edi, [esp + 0x24]
push 0x76
pop eax
mov word [esp + 0x74], ax
push 0x6e
pop eax
mov word [esp + 0x78], ax
xor eax, eax
mov word [esp + 0x7c], ax
push 0x4c
pop eax
mov word [esp + 0x10], ax
mov word [esp + 0x12], ax
lea eax, [esp + 0x30]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x20], eax
xor eax, eax
mov word [esp + 0x7a], bp
xor ebp, ebp
mov dword [esp + 0x18], 0x18
mov dword [esp + 0x1c], ebp
stosd dword es:[edi], eax
mov word [esp + 0x76], cx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x18]
push eax
push 0x2000000
lea eax, [esp + 0x14]
push eax
call ebx
test eax, eax
jns 0x402038
push ebp
push ebp
push 1
push 0xc0000264
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov ecx, dword [esp + 0xc]
mov edx, 0x43d228
xor eax, eax
lock cmpxchg dword [edx], ecx
pop edi
pop ebp
pop ebx
test eax, eax
je 0x402057
push dword [esp]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x43d228]
jmp 0x402060
xor eax, eax
add esp, 0x74
ret
Function at 0x40aec0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
sub edx, edi
sar edx, 1
add edx, edx
je 0x40aef1
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x40aee0
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x40cec0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42edb3
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x43c100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
lea ecx, [edi + 0x40]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
mov edx, dword [ebp + 0x20]
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x54], eax
mov eax, dword [ebp + 0x1c]
mov dword [edi + 0x5c], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x58], esi
mov dword [edi + 0x60], edx
mov byte [edi + 0x64], 0
mov dword [edi + 0x68], eax
test byte [esi + 8], 8
mov byte [ebp - 4], 2
je 0x40cfba
test dl, 0x10
jne 0x40cfba
mov al, 1
jmp 0x40cfbc
xor al, al
mov byte [edi + 0x6c], al
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x70], eax
mov ebx, dword [ecx + 4]
mov edx, ebx
mov esi, dword [esi + 0x18]
sar edx, 3
cmp esi, edx
jae 0x40cfe0
lea eax, [esi*8]
mov dword [ecx + 4], eax
jmp 0x40d013
jbe 0x40d013
mov eax, dword [ecx + 8]
sar eax, 3
cmp esi, eax
jbe 0x40cff8
lea eax, [ebp + 0x17]
push eax
push esi
call fcn.004044e0
jmp 0x40d013
sub esi, edx
je 0x40d010
shl esi, 3
push esi
push 0
push ebx
call sub.msvcrt.dll_memset
add esp, 0xc
lea ecx, [edi + 0x40]
add ebx, esi
mov dword [ecx + 4], ebx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x411590
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42f19d
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x43c100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
push 4
push 0x3000
mov dword [ebp - 0x3c], 1
mov ecx, dword [eax]
mov eax, dword [eax + 4]
sub eax, ecx
mov dword [ebp - 0x1c], ecx
mov ecx, dword [esi]
and eax, 0xfffffffc
push eax
push 0
push 0
push ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x2c], eax
call fcn.00417590
mov edi, eax
mov ebx, edx
mov ecx, edi
mov dword [ebp - 0x34], edi
or ecx, ebx
mov dword [ebp - 0x30], ebx
je 0x411646
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x1c]
push ebx
push edi
push dword [ebp - 0x14]
call fcn.004178a0
test eax, eax
mov eax, dword [ebp - 0x10]
je 0x411628
cmp dword [ebp + 8], eax
je 0x411646
push 0x4000
push eax
push ebx
push edi
push dword [ebp - 0x14]
call fcn.00417720
xorps xmm0, xmm0
movlpd qword [ebp - 0x34], xmm0
mov ebx, dword [ebp - 0x30]
mov edi, dword [ebp - 0x34]
mov eax, edi
mov dword [ebp - 4], 0
or eax, ebx
je 0x4116ac
cmp dword [esi + 0x18], 0
mov eax, dword [esi + 4]
push 0
push 0
je 0x411675
push ebx
push edi
push dword [eax + 0xc]
push dword [eax + 8]
push 0
push 0
push dword [esi]
call fcn.004148b0
jmp 0x411685
push edi
push dword [eax + 8]
push 0
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp + 8], eax
test eax, eax
je 0x4116ac
push dword [esi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4116d9
mov eax, dword [esi + 4]
push dword [ebp + 8]
mov dword [eax], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or esi, 0xffffffff
or ecx, 0xffffffff
mov dword [ebp + 8], ecx
mov eax, edi
mov dword [ebp - 4], 5
or eax, ebx
je 0x411732
push 0x4000
push dword [ebp - 0x10]
push ebx
push edi
push dword [ebp - 0x14]
call fcn.00417720
mov edx, dword [ebp + 8]
jmp 0x411734
cmp dword [esi + 0x18], 0
je 0x41170f
cmp dword [esi + 0x10], 0
je 0x41170f
push dword [ebp + 8]
xorps xmm0, xmm0
movlpd qword [ebp - 0x24], xmm0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 8
lea eax, [ebp - 0x24]
push eax
push ebx
push edi
push dword [esi]
call fcn.00416780
mov esi, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
jmp 0x4116b2
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x18]
push eax
push esi
mov dword [ebp - 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x18]
xor ecx, ecx
jmp 0x4116b2
mov edx, ecx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4