joyce8/EMBER2024-capa huggingface dataset:
Function at 0x476394
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x415f50]
call fcn.00405084
xor eax, eax
push ebp
push 0x4764d8
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4adb78], 0
jne 0x4763e7
mov ecx, dword [0x4ae6dc]
mov dl, 1
mov eax, dword [0x407ba8]
call fcn.0040c960
call fcn.00403fd4
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00403158
mov eax, ebx
call fcn.00404ec8
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x4764e8
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.004061d8
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00404ed8
test eax, eax
jle 0x47647f
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x476478
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.004048e8
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.004048d0
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408a18
test eax, eax
jne 0x476478
mov ebx, 0x15
jmp 0x476484
mov ebx, 0x10
jmp 0x476484
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x4adb78]
call fcn.004762ec
mov eax, dword [ebp - 8]
call fcn.004762ec
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.004061f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4764df
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00404684
lea eax, [ebp - 0x10]
mov edx, dword [0x415f50]
call fcn.00405154
ret

Function at 0x47d028
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x58
call fcn.00403158
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret

Function at 0x483308
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
test dl, dl
je 0x48331b
add esp, 0xfffffff0
call fcn.00403aa8
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x483394
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, esi
call fcn.00403740
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [esi + 0x14], 0
lea edx, [ebp - 4]
mov eax, esi
call fcn.00483774
mov edx, dword [ebp - 4]
lea eax, [esi + 8]
call fcn.004046b4
mov ecx, dword [esi + 8]
lea eax, [esi + 0xc]
mov edx, 0x4833c0
call fcn.0040496c
mov ecx, esi
mov dl, 1
mov eax, dword [0x48313c]
call fcn.00483bd4
mov dword [esi + 0x30], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48339b
lea eax, [ebp - 4]
call fcn.00404660
ret
Function at 0x48bf80
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x48bf88
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x48c17a
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x48c190
mov eax, esi
call fcn.00489e0c
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.004046b4
lea ecx, [ebp - 0x10]
mov edx, 0x48c1a4
mov eax, esi
call fcn.00489e0c
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.004046b4
lea ecx, [ebp - 0x14]
mov edx, 0x48c1bc
mov eax, esi
call fcn.00489e0c
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.004046b4
lea ecx, [ebp - 0x18]
mov edx, 0x48c1d8
mov eax, esi
call fcn.00489e0c
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.004046b4
lea ecx, [ebp - 0x1c]
mov edx, 0x48c1f4
mov eax, esi
call fcn.00489e0c
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.004046b4
lea ecx, [ebp - 0x24]
mov edx, 0x48c20c
mov eax, esi
call fcn.00489e0c
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00408a88
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.00409074
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x48c224
mov eax, esi
call fcn.00489e0c
mov eax, dword [ebp - 0x28]
call fcn.00482910
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x48c234
mov eax, esi
call fcn.00489e0c
mov eax, dword [ebp - 0x2c]
call fcn.00482910
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x48c24c
mov eax, esi
call fcn.00489e0c
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.00409074
inc eax
je 0x48c11d
lea ecx, [ebp - 0x34]
mov edx, 0x48c24c
mov eax, esi
call fcn.00489e0c
mov eax, dword [ebp - 0x34]
call fcn.00409038
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040a76c
fstp qword [ebp - 0x3c]
wait
call fcn.0040ab08
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x48c138
lea ecx, [ebp - 0x40]
mov edx, 0x48c24c
mov eax, esi
call fcn.00489e0c
mov eax, dword [ebp - 0x40]
call fcn.00482910
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x48c25c
mov eax, esi
call fcn.00489e0c
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.004046b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c181
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.00404684
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.00404684
ret
Function at 0x492f0c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x492f66
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.00492efc
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.0048157c
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.0048117c
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x492f6d
lea eax, [ebp - 4]
call fcn.00404660
ret

Function at 0x496ca0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x496d8a
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 4]
mov edx, esi
call fcn.004046f8
lea ecx, [ebp - 0x28]
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004304ec
mov eax, dword [ebp - 0x28]
mov edx, 0x496da4
call fcn.00404a6c
jne 0x496d05
mov eax, dword [ebp - 4]
call fcn.00404920
mov edx, eax
lea eax, [ebp - 4]
mov ecx, 1
call fcn.00404bc0
lea ecx, [ebp - 0x2c]
mov edx, 3
mov eax, dword [ebp - 4]
call fcn.004304ec
mov eax, dword [ebp - 0x2c]
mov edx, 0x496db0
call fcn.00404a6c
jne 0x496d67
xor eax, eax
mov dword [ebp - 0x22], eax
mov dword [ebp - 0x1e], 3
mov eax, dword [ebp - 4]
call fcn.00404b20
mov dword [ebp - 0x1a], eax
xor eax, eax
mov dword [ebp - 0x16], eax
mov word [ebp - 0x12], 0x414
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, 0x496db4
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x22]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
jne 0x496d67
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x496d91
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.00404684
lea eax, [ebp - 4]
call fcn.00404660
ret

Function at 0x4a7044
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffac
mov edi, edx
mov esi, eax
mov dl, 1
mov eax, dword [0x41703c]
call fcn.00403740
mov ebx, eax
mov edx, edi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x74]
mov eax, ebx
call fcn.00403770
lea eax, [esp + 0x10]
xor ecx, ecx
mov edx, 0x44
call fcn.00403158
mov dword [esp + 0x3c], 1
mov word [esp + 0x40], 0
push esp
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 0x40
push 0
push 0
push 0
mov eax, esi
call fcn.00404b20
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x4a70cc
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [esp]
push eax
call sub.kernel32.dll_CloseHandle
add esp, 0x54
pop edi
pop esi
pop ebx
ret
Function at 0x4aaa44
Capabilities:
Query environment variable

Disassembly:
push ebx
add esp, 0xffffff00
mov ebx, edx
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
push 0x4aaa78
call sub.kernel32.dll_GetEnvironmentVariableA
mov eax, ebx
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.004048d0
add esp, 0x100
pop ebx
ret
Function at 0xeb575e
Capabilities:
Check for software breakpoints

Disassembly:
add esi, 2
pushfd
mov word [esp + 4], 0x1125
dec ecx
push 0xe21f8d56
mov byte [esp + 4], 0x1a
lea esp, [esp + 0xc]
jne 0xecba81
pushfd
push 0x426905ff
lea esp, [esp + 8]
jmp 0xec6f1c
pushal
rol dh, cl
mov edx, eax
pushal
xor ebx, ebx
pushfd
test cl, 0x9e
shr eax, 0x10
sub esp, 0xffffffbc
bt bx, 0xa
clc
cmc
cmp dword [esi], 0
pushal
pushfd
call fcn.0152ea7e
xchg edi, eax
push ecx
pop es
ja 0xec6fa4
movsb byte es:[edi], byte [esi]
fcom qword [edi - 0x1146be36]
jns 0xec6fa9
test dword [esi], esp
mov ebp, 0xebf637c3
dec eax
mov esp, 0x35d7aef7
stosb byte es:[edi], al
stosd dword es:[edi], eax
mov eax, 0x3906f12d
push ds
xchg dword [edi - 0x2a], ecx
insd dword es:[edi], dx
loop 0xec6f5e
jge 0xec6f0a
and dl, dl
xchg ch, bh
imul dword [0xa52f4f5f]
pop edi
dec edi
das
movsd dword es:[edi], dword [esi]
wait
dec edi
retf 0xb03f
out 0xda, al
dec esi
iretd
inc ebp
or byte [eax + 2], 0xa5
ljmp 0xfbcf
je 0xeb5ff2
bt edi, 0x17
cmp ebx, 3
pushfd
lea esp, [esp + 4]
je 0xecd093
pushal
mov byte [esp], ch
pushal
lea esp, [esp + 0x40]
jmp fcn.00ec92bf
stc
add dword [edi + ebx], edx
setb bh
xor bh, bl
sub bl, 0x53
mov bx, word [esi]
pushfd
cmp edi, 0x347adfa9
cmc
shr ebx, 0xc
cmp edi, 0x911f5119
pushal
stc
pushal
cmp ebx, 1
pushfd
mov byte [esp], 0xe2
lea esp, [esp + 0x48]
je 0xecc282
cmp dx, ax
cmp ebx, 2
jmp 0xec7f1a
sbb bl, 0xfa
rcr bl, cl
not bx
mov bx, word [esi]
jmp 0x152f144
and ebx, 0xfff
test ah, dl
jmp 0xec92bb
Function at 0x41303d
Capabilities:
Authenticate hmac

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
xor eax, eax
cmp dword [ebp + 8], eax
je 0x41304f
pop ebp
jmp fcn.004f640e
pop ebp
ret

Function at 0x4dc8df
Capabilities:
Check for vm using instruction vpcext

Disassembly:
dec edx
mov ch, 0x1d
xor eax, 0x3f319947
frstor dword [edx - 0x7963de43]
adc ch, byte [edx - 0x5f]
pop edx
mov ah, dh
pop es
pop ebx
invalid

Function at 0x4e488e
Capabilities:
Encode data using xor

Disassembly:
invalid
push ds
push esp
mov byte [edx], ah
in eax, 0xfd
push 0xe1acd02a
mov fs, word [ebx + esi*2 - 0x7b3aae89]
aaa
mov al, 0xb3
pushal
stosd dword es:[edi], eax
loope 0x4e4831
or al, 0xb4
insd dword es:[edi], dx
mov ah, 5
je 0x4e4914
cmpsb byte [esi], byte es:[edi]
cld
sbb eax, 0x7e51d773
mov word [ebp - 0x37], ss
mov al, byte [0xe6428bda]
fcom qword [ebx + 4]
mov esi, 0xcd6dc7d4
jge 0x4e490e
out 0xd8, al
mov bl, 0
stosd dword es:[edi], eax
mov byte [ecx + 0x2d], dh
arpl word [ebx + 0x22], sp
sbb dl, byte [0xc55e1640]
mov ah, byte [edi + 0x3f]
xchg byte [edx + 0x202c002a], ch
sub dl, byte [edi - 0x7f3b97fc]
salc
mov edi, fs
cmp dword [edx - 0x28464874], ecx
mov byte [esi], al
add eax, 0xd496d5de
jmp 0x6d2eae3a
push ss
test ebp, ecx
and esi, 0x1f84eb0d
jo 0x4e48b6
jmp 0x4e489a
loop 0x4e490e
aas
or eax, 0xaf857c22
int1
or eax, 0x3108e4ff
jmp esp
or byte [ecx], dh
mov cl, 0x8d
mov cl, 0x28
imul edx, esi, 0xbc937f71
sub al, 0x85
imul ebx, dword [ecx + eax*8], 0xb5694326
cmp ebp, edx
and al, 0x8d
cmp ebx, dword [eax - 0x7c9aa982]
and al, 0x7f
retf

Function at 0x4f53d9
Capabilities:
Authenticate hmac

Disassembly:
jge 0x4f5433
leave
xchg ebp, eax
adc eax, 0x386cf12d
fcmovne st(0), st(2)
test dh, al
test dword [ebx], 0xe784ec56
iretd

Function at 0x4f5b94
Capabilities:
Authenticate hmac

Disassembly:
push esp
cld
push es
test byte [ecx], bl
pop ds
or al, 0xc2
sbb byte [edi - 0x77], 0x54
or ebp, dword [esi]
movsd dword es:[edi], dword [esi]
movaps xmmword [ecx], xmm1
sub byte [edi], dh
stc
mov ah, 0x71
jmp 0x4f5bb9
xchg ebp, eax
Function at 0x4f5bba
Capabilities:
Authenticate hmac

Disassembly:
invalid
pop esi
rcl dword [ebp - 0x6e26ea8c], 0x8e
je 0x4f5bd1
fst dword [ecx - 0x46abde72]
invalid
invalid
je 0x4f5bd1
fst dword [ecx - 0x46abde72]
fimul word [edi + 0x19f21559]
arpl word [ebp + esi*4 - 0x66a215ef], bp
salc
push 0x70f8dff8
nop
add eax, 0x587d3aa8
leave
clc
invalid
push ebx
in eax, dx
mov ecx, 0x1de28f7e
nop
pushal
jo 0x4f5bfd
xchg ebp, eax
mov dl, 0x85
lea edi, [esi - 0x41]
bound ebp, qword [ecx]
insb byte es:[edi], dx
invalid
and cl, 0x73
xchg byte [esi], dl
jne 0x4f5bb7
jo 0x4f5bdc
frstor dword [ebx + 0x12a6777a]
mov dl, 0x1e
test dword [ebx], edi
outsb dx, byte [esi]
xchg ecx, eax
and dword [ecx + 0x21], ecx
and ecx, 0xf9a13b5a
cmp eax, 0x8d833f89
js 0x4f5c52
in al, 0x36
push ds
sbb eax, 0x6b4fe87b
aaa
mov ah, 0xac
jae 0x4f5bb1
mov esi, 0x1595a8b2
sub eax, 0xdb386cf1
retf 0xc684
arpl dx, ax
in eax, 0xf7
daa
mov dh, 0xcf
cmp dword [ebx - 0x35], ebx
and byte [edi], ah
jo 0x4f5cbf
insd dword es:[edi], dx
mov ah, 0xfa
arpl word [edx - 0x5b], bx
jno 0x4f5c61
cld
mov cl, 0xac
jbe 0x4f5cc6
sti
mov byte [0x28c50e63], al
call 0x86351789
xlatb
dec esi
imul eax, dword [esi + 0xe], 0xb34d58e7
jne 0x4f5c8f
push cs
out 0x58, eax
dec ebp
mov bl, 0x75
or al, 0xa0
mov ah, 0x7b
pop ebx
mov al, byte [0x5b7bb4f2]
xchg dword [eax], eax
pop ds
jp 0x4f5c60
jle 0x4f5c7c
in al, dx
stosb byte es:[edi], al
mov bh, 0x67
clc
shr dword [eax + 0x29cfa5ff], 1
fcmovnu st(0), st(0)
je 0x4f5cf5
test eax, 0x6aced45d
xchg edx, eax
insd dword es:[edi], dx
push 0x2a
sub eax, 0x7875ccb
int3
mov ecx, 0xee15474d
mov ecx, 0x1221c77d
sub dword [esi], edx
shr dl, 0x9d
cdq
add al, 0x98
mov ebx, 0xaf5ce571
invalid
invalid
imul esi, dword [edx], 0x40e1996e
or edi, dword [ecx]
invalid

Function at 0x4f640e
Capabilities:
Authenticate hmac

Disassembly:
invalid
push ds
test dword [ebx], edi
outsb dx, byte [esi]
xchg ecx, eax
and dword [ecx + 0x21], ecx
and ecx, 0xf9a13b5a
cmp eax, 0x8d833f89
js 0x4f6452
in al, 0x36
push ds
sbb eax, 0x6b4fe87b
aaa
mov ah, 0xac
jae 0x4f63b1
mov esi, 0x1595a8b2
sub eax, 0xdb386cf1
retf 0xc684
arpl dx, ax
in eax, 0xf7
daa
mov dh, 0xcf
cmp dword [ebx - 0x35], ebx
and byte [edi], ah
jo 0x4f64bf
mov ecx, 0xee15474d
mov ecx, 0x1221c77d
sub dword [esi], edx
shr dl, 0x9d
cdq
add al, 0x98
mov ebx, 0xaf5ce571
invalid
Function at 0x4081e0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
push edi
mov edi, edx
call fcn.004082c0
mov ebx, eax
test ebx, ebx
jne 0x408200
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 4], eax
test edi, edi
je 0x408234
mov eax, dword [ebp + 0xc]
sub eax, esi
mov dword [ebp + 0xc], eax
add eax, esi
mov cl, byte [esi]
xor edx, edx
rol cl, 4
div dword [ebp - 4]
mov eax, dword [ebp + 0xc]
xor cl, byte [edx + ebx]
not cl
mov byte [esi], cl
inc esi
sub edi, 1
jne 0x408218
push ebx
call fcn.004a14cb
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x408250
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
xor edi, edi
mov dword [ebp - 4], edx
mov esi, ecx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
push edi
push edi
push 4
push edi
push esi
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
test esi, esi
je 0x4082b2
push ebx
push edi
push edi
push edi
push 2
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
test ebx, ebx
je 0x4082aa
mov edx, dword [ebp - 8]
mov ecx, ebx
push edi
push dword [ebp - 4]
call fcn.004081e0
add esp, 8
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4082c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], 0x7863513
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
push ebx
call fcn.004a14d0
mov esi, eax
add esp, 4
test esi, esi
je 0x408308
xor edx, edx
test ebx, ebx
je 0x408308
sub edi, esi
mov eax, edx
lea ecx, [edx + esi]
and eax, 3
inc edx
mov al, byte [ebp + eax - 4]
xor al, byte [edi + ecx]
mov byte [ecx], al
cmp edx, ebx
jb 0x4082f0
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408410
Capabilities:
Check if file exists
Create process on windows
Create process suspended
Self delete

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b7dd0
mov eax, dword fs:[0]
push eax
sub esp, 0x158
mov eax, dword [0x52a0b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
sub esp, 8
lea ecx, [ebp - 0x40]
call fcn.00404910
mov dword [ebp - 4], 0
lea eax, [ebp - 0x120]
push 0x400
push eax
lea ecx, [ebp - 0x40]
call fcn.004035c0
mov byte [ebp - 4], 1
mov ecx, dword [eax]
mov byte [eax + 4], 1
call fcn.00403420
push 0x400
push dword [eax]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
sete bl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x120]
call fcn.00403cd0
test bl, bl
jne 0x40862a
cmp dword [ebp - 0x28], 8
lea eax, [ebp - 0x3c]
cmovae eax, dword [ebp - 0x3c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40862a
push ecx
push 0
lea eax, [ebp - 0x100]
push eax
lea ecx, [ebp - 0x40]
call fcn.00408730
mov byte [ebp - 4], 4
sub esp, 8
lea ecx, [ebp - 0xd0]
call fcn.00404910
mov byte [ebp - 4], 5
xor eax, eax
push 0x44
push eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x108], eax
lea eax, [ebp - 0x164]
push eax
mov dword [ebp - 0x114], 0
call fcn.004a34a0
xor eax, eax
mov dword [ebp - 0x164], 0x44
push eax
mov word [ebp - 0x134], ax
lea eax, [ebp - 0x70]
push eax
mov dword [ebp - 0x138], 1
call fcn.0040a070
add esp, 0x14
mov byte [ebp - 4], 6
lea eax, [ebp - 0x101]
push 0
push eax
push str.cmd.exe
lea ecx, [ebp - 0xa0]
mov dword [ebp - 0xa0], 0x4e81b4
mov dword [ebp - 0x78], 0x4e8f38
call fcn.00404190
mov byte [ebp - 4], 8
lea eax, [ebp - 0xa0]
push eax
lea ecx, [ebp - 0x70]
call fcn.00408950
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xa0]
call fcn.00404c20
cmp dword [ebp - 0x28], 8
lea ecx, [ebp - 0x3c]
lea eax, [ebp - 0x6c]
cmovae ecx, dword [ebp - 0x3c]
cmp dword [ebp - 0x58], 8
push ecx
cmovae eax, dword [ebp - 0x6c]
push eax
lea eax, [ebp - 0xd0]
push str.__s___c_del___s_
push eax
call fcn.004086a0
add esp, 0x10
lea ecx, [ebp - 0xd0]
call fcn.00403420
lea ecx, [ebp - 0x114]
push ecx
lea ecx, [ebp - 0x164]
push ecx
push 0
push 0
push 0x40
push 0
push 0
push 0
push dword [eax]
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4085fe
push dword [ebp - 0x110]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x114]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x70]
call fcn.00404c20
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xd0]
call fcn.00404850
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x100]
call fcn.00404850
jmp 0x40862c
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00404850
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a14ba
mov esp, ebp
pop ebp
ret
Function at 0x40a070
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b8561
mov eax, dword fs:[0]
push eax
sub esp, 0x84
mov eax, dword [0x52a0b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x70]
sub esp, 8
mov dword [ebp - 0x88], esi
mov dword [ebp - 0x78], 0
call fcn.004091f0
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x70]
mov eax, dword [ebp + 0xc]
push 0x104
cmp eax, 1
jne 0x40a1f0
lea eax, [ebp - 0x84]
push eax
call fcn.00409470
mov byte [ebp - 4], 2
mov ecx, dword [eax]
mov byte [eax + 4], 1
call fcn.00403f10
push 0x104
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
sete bl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x84]
call fcn.00409a90
test bl, bl
je 0x40a129
lea ecx, [ebp - 0x2c]
call fcn.00409b70
push 0x527a94
lea eax, [ebp - 0x2c]
push eax
call fcn.004a35fa
push 0
lea eax, [ebp - 0x71]
mov dword [ebp - 0x40], 0x4e81b4
push eax
push str.sysnative
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x18], 0x4e8f38
call fcn.00404190
mov byte [ebp - 4], 4
lea eax, [ebp - 0x40]
push 0x5c
sub esp, 0x30
mov ecx, esp
mov dword [ebp - 0x8c], esp
mov dword [ebp - 0x90], ecx
push 0
push eax
mov dword [ecx], 0x4e81b4
mov dword [ecx + 0x28], 0x4e8f38
call fcn.00406fd0
mov byte [ebp - 4], 6
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x70]
call fcn.004092d0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x40]
call fcn.00404c20
push 0x4e82a8
lea ecx, [ebp - 0x70]
call fcn.00409f30
push 0
push eax
mov ecx, esi
mov dword [esi], 0x4e81b4
mov dword [esi + 0x28], 0x4e8f38
call fcn.00406fd0
mov byte [ebp - 4], 1
mov dword [ebp - 0x78], 1
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x70]
call fcn.00404c20
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a14ba
mov esp, ebp
pop ebp
ret
cmp eax, 2
lea eax, [ebp - 0x84]
push eax
jne 0x40a26f
call fcn.00409470
mov byte [ebp - 4], 8
mov ecx, dword [eax]
mov byte [eax + 4], 1
call fcn.00403f10
push 0x104
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
sete bl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x84]
call fcn.00409a90
test bl, bl
jne 0x40a113
push 0
lea eax, [ebp - 0x71]
mov dword [ebp - 0x40], 0x4e81b4
push eax
push str.syswow64
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x18], 0x4e8f38
call fcn.00404190
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x70]
call fcn.004093f0
jmp 0x40a189
call fcn.00409470
mov byte [ebp - 4], 0xc
mov ecx, dword [eax]
mov byte [eax + 4], 1
call fcn.00403f10
push 0x104
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
sete bl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x84]
call fcn.00409a90
test bl, bl
je 0x40a195
jmp 0x40a113