joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405bd0
Capabilities:
Check mutex on windows
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4243f0
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x43500c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor bl, bl
call fcn.004042a0
mov ecx, eax
movzx eax, cl
not eax
mov dword [ebp - 0x14], ecx
movzx eax, al
mov edx, dword [eax*4 + 0x430f40]
xor edx, 0xffffff
movzx eax, ch
xor eax, edx
lea ecx, [ebp - 0x44]
movzx eax, al
shr edx, 8
xor edx, dword [eax*4 + 0x430f40]
movzx eax, byte [ebp - 0x12]
xor eax, edx
shr edx, 8
movzx eax, al
xor edx, dword [eax*4 + 0x430f40]
movzx eax, byte [ebp - 0x11]
xor eax, edx
shr edx, 8
movzx eax, al
xor edx, dword [eax*4 + 0x430f40]
xor edx, 0xd3feab61
call fcn.004025d0
push eax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0
call fcn.00409d80
add esp, 4
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x30]
cmp eax, 0x10
jb 0x405cc2
mov ecx, dword [ebp - 0x44]
inc eax
cmp eax, 0x1000
jb 0x405cb9
test cl, 0x1f
je 0x405c95
call fcn.00411091
mov eax, dword [ecx - 4]
cmp eax, ecx
jb 0x405ca1
call fcn.00411091
sub ecx, eax
cmp ecx, 4
jae 0x405cad
call fcn.00411091
cmp ecx, 0x23
jbe 0x405cb7
call fcn.00411091
mov ecx, eax
push ecx
call fcn.0040acbc
add esp, 4
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x30], 0xf
cmovae eax, dword [ebp - 0x2c]
push eax
push 0
push 0
mov dword [ebp - 0x34], 0
mov byte [ebp - 0x44], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x405d1f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x405d1f
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
push str.mutex_exist:name_s
call fcn.00403050
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
mov eax, dword [ebp - 0x18]
cmp eax, 0x10
jb 0x405d69
mov ecx, dword [ebp - 0x2c]
inc eax
cmp eax, 0x1000
jb 0x405d60
test cl, 0x1f
je 0x405d3c
call fcn.00411091
mov eax, dword [ecx - 4]
cmp eax, ecx
jb 0x405d48
call fcn.00411091
sub ecx, eax
cmp ecx, 4
jae 0x405d54
call fcn.00411091
cmp ecx, 0x23
jbe 0x405d5e
call fcn.00411091
mov ecx, eax
push ecx
call fcn.0040acbc
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040ac78
mov esp, ebp
pop ebp
ret
Function at 0x405d90
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov eax, dword [0x43500c]
xor eax, esp
mov dword [esp + 0x38], eax
push esi
call fcn.00405bd0
test al, al
jne 0x405e48
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
test esi, esi
je 0x405e43
cmp dword [esp + 0x20], 2
jl 0x405e3c
push dword [esi + 4]
lea ecx, [esp + 0xc]
call fcn.00405f50
push ecx
lea edx, [esp + 0xc]
lea ecx, [esp + 0x28]
call fcn.004028e0
mov eax, dword [esp + 0x20]
add esp, 4
cmp eax, 8
jb 0x405e0e
inc eax
lea ecx, [esp + 8]
push eax
push dword [esp + 0xc]
call fcn.00409040
push 0x4313a5
lea ecx, [esp + 0xc]
call fcn.00406190
lea ecx, [esp + 0x24]
call fcn.00404620
call fcn.00404b40
lea ecx, [esp + 8]
call fcn.00405ff0
lea ecx, [esp + 0x24]
call fcn.00405ff0
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.00405840
mov ecx, dword [esp + 0x3c]
xor eax, eax
pop esi
xor ecx, esp
call fcn.0040ac78
mov esp, ebp
pop ebp
ret 0x10

Function at 0x409410
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x423cf6
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x43500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0040ac89
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.0040befd
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10001ef0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x10001f90
mov ecx, dword [esi]
xor eax, eax
mov byte [ecx + 0x16], al
mov ecx, dword [esi]
push ebx
mov byte [ecx + 0x17], al
mov ecx, dword [esi]
push edi
mov byte [ecx + 0x18], al
mov ecx, dword [esi]
xor edi, edi
mov byte [ecx + 0x19], al
mov ebx, dword [esi + 4]
test ebx, ebx
jle 0x10001f40
mov esi, dword [esi]
movzx edx, byte [esi + edi]
mov ecx, eax
shr ecx, 0x18
xor edx, ecx
shl eax, 8
xor eax, dword [edx*4 + 0x100b17c0]
inc edi
cmp edi, ebx
jl 0x10001f23
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 0xc]
xor edi, edi
test ebx, ebx
jle 0x10001f6d
mov esi, dword [esi + 8]
lea esp, [esp]
movzx edx, byte [esi + edi]
mov ecx, eax
shr ecx, 0x18
xor edx, ecx
shl eax, 8
xor eax, dword [edx*4 + 0x100b17c0]
inc edi
cmp edi, ebx
jl 0x10001f50
mov esi, dword [ebp + 8]
mov ecx, dword [esi]
mov edx, eax
mov byte [ecx + 0x16], al
mov ecx, dword [esi]
shr edx, 8
mov byte [ecx + 0x17], dl
mov ecx, dword [esi]
mov edx, eax
shr edx, 0x10
mov byte [ecx + 0x18], dl
mov ecx, dword [esi]
shr eax, 0x18
pop edi
mov byte [ecx + 0x19], al
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000829a
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100c1ba0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.10004df4
mov dword [ebp - 0x14], eax
cmp dword [0x100c313c], edi
jne 0x1000838b
push 0x800
push edi
push 0x1002b260
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x10008318
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1000846b
push 0x1002b260
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x1000846b
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000846b
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x100c313c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x100c3140], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x100c3144], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x100c314c], eax
test eax, eax
je 0x10008388
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x100c3148], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x100083b0
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x100083a3
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x100083c5
push 4
pop eax
jmp 0x1000846d
cmp dword [ebp - 0x14], edi
je 0x100083c5
push dword [0x100c313c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x100083aa
mov eax, dword [0x100c3148]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x10008423
cmp dword [0x100c314c], esi
je 0x10008423
push eax
call ebx
push dword [0x100c314c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10008423
test eax, eax
je 0x10008423
call ecx
test eax, eax
je 0x10008418
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10008418
test byte [ebp - 8], 1
jne 0x10008423
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x10008453
mov eax, dword [0x100c3140]
cmp eax, esi
je 0x10008450
push eax
call ebx
test eax, eax
je 0x10008450
call eax
mov edi, eax
test edi, edi
je 0x10008450
mov eax, dword [0x100c3144]
cmp eax, esi
je 0x10008450
push eax
call ebx
test eax, eax
je 0x10008450
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x100c313c]
call ebx
test eax, eax
je 0x1000846b
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x1000846d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000847c
leave
ret
Function at 0x1000a5e5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
Function at 0x41fc56
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43f480]
jne 0x41fc60
repz ret
jmp fcn.004247e8

Function at 0x431e51
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x43f480]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00425d9b
and dword [ebp - 0x14], 0
cmp dword [0x442a44], 0
mov dword [ebp - 0x18], eax
jne 0x431f04
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x431fac
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x431fac
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x442a44], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x442a48], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x442a4c], eax
call edi
push eax
call esi
mov dword [0x442a54], eax
test eax, eax
je 0x431f04
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x442a50], eax
mov eax, dword [0x442a50]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x431f5d
cmp dword [0x442a54], ecx
je 0x431f5d
push eax
call esi
push dword [0x442a54]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x431f5d
test ebx, ebx
je 0x431f5d
call edi
test eax, eax
je 0x431f54
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x431f54
test byte [ebp - 8], 1
jne 0x431f5d
or dword [ebp + 0x10], 0x200000
jmp 0x431f90
mov eax, dword [0x442a48]
cmp eax, dword [ebp - 0x18]
je 0x431f90
push eax
call esi
test eax, eax
je 0x431f90
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x431f90
mov eax, dword [0x442a4c]
cmp eax, dword [ebp - 0x18]
je 0x431f90
push eax
call esi
test eax, eax
je 0x431f90
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x442a44]
call esi
test eax, eax
je 0x431fac
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x431fae
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041fc56
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401112
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x424030]
jne 0x40111c
repz ret
jmp fcn.00401d31

Function at 0x409100
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040587e
and dword [ebp - 4], 0
cmp dword [0x426790], 0
mov ebx, eax
jne 0x4091b1
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x409262
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x409262
push eax
call fcn.0040580c
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x426790], eax
call esi
push eax
call fcn.0040580c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x426794], eax
call esi
push eax
call fcn.0040580c
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x426798], eax
call esi
push eax
call fcn.0040580c
pop ecx
mov dword [0x4267a0], eax
test eax, eax
je 0x4091b1
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040580c
pop ecx
mov dword [0x42679c], eax
mov eax, dword [0x42679c]
cmp eax, ebx
je 0x409209
cmp dword [0x4267a0], ebx
je 0x409209
push eax
call fcn.00405887
push dword [0x4267a0]
mov esi, eax
call fcn.00405887
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x409209
test edi, edi
je 0x409209
call esi
test eax, eax
je 0x409200
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x409200
test byte [ebp - 0xc], 1
jne 0x409209
or dword [ebp + 0x10], 0x200000
jmp 0x409242
mov eax, dword [0x426794]
cmp eax, ebx
je 0x409242
push eax
call fcn.00405887
pop ecx
test eax, eax
je 0x409242
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x409242
mov eax, dword [0x426798]
cmp eax, ebx
je 0x409242
push eax
call fcn.00405887
pop ecx
test eax, eax
je 0x409242
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x426790]
call fcn.00405887
pop ecx
test eax, eax
je 0x409262
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x409264
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40b130
Capabilities:
Set console window title

Disassembly:
sub esp, 0x428
mov eax, dword [0x424030]
xor eax, esp
mov dword [esp + 0x424], eax
mov eax, dword [0x2adf1cc]
push ebx
mov ebx, dword [0x2adeeec]
push esi
mov esi, dword [0x424f60]
push edi
mov edi, eax
cmp eax, 0x930
jne 0x40b171
push str.wozekajevirifegavonetucusiva
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
mov eax, dword [0x2adf1cc]
mov dword [0x2adeee8], esi
cmp eax, 0x114e
jne 0x40b199
call dword [sym.imp.KERNEL32.dll_SetFileApisToOEM]
lea eax, [esp + 0x14]
push eax
push str.gavipokucohuj
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
mov eax, dword [0x2adf1cc]
cmp eax, 0x2f
jne 0x40b1bb
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
push 0
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ReadEventLogA]
call fcn.0040b060
mov ecx, dword [esp + 0x430]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401112
add esp, 0x428
ret
Function at 0x40b15f
Capabilities:
Set console window title

Disassembly:
sub esp, 0x428
mov eax, dword [0x424030]
xor eax, esp
mov dword [esp + 0x424], eax
mov eax, dword [0x2adf1cc]
push ebx
mov ebx, dword [0x2adeeec]
push esi
mov esi, dword [0x424f60]
push edi
mov edi, eax
cmp eax, 0x930
jne 0x40b171
push str.wozekajevirifegavonetucusiva
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
mov eax, dword [0x2adf1cc]
mov dword [0x2adeee8], esi
cmp eax, 0x114e
jne 0x40b199
call dword [sym.imp.KERNEL32.dll_SetFileApisToOEM]
lea eax, [esp + 0x14]
push eax
push str.gavipokucohuj
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
mov eax, dword [0x2adf1cc]
cmp eax, 0x2f
jne 0x40b1bb
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
push 0
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ReadEventLogA]
call fcn.0040b060
mov ecx, dword [esp + 0x430]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401112
add esp, 0x428
ret
Function at 0x40ec0c
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40ece1
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x40ecfc
push ebx
push 0x40ed0c
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040513c
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00403250
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404d24
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x40ec8c
mov al, 0x6a
call fcn.0040e82c
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.0040ebe0
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x40ec95
call fcn.0040ebe0
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ece8
lea eax, [ebp - 4]
call fcn.00404c88
ret

Function at 0x40edfc
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo_1
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery_1
test eax, eax
je 0x40eec7
jmp 0x40eebb
cmp dword [esi + 0x10], 0x1000
jne 0x40eea7
test byte [esi + 0x15], 1
jne 0x40eea7
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x40ee58
cmp ebp, 2
je 0x40ee58
cmp ebp, 0x10
je 0x40ee58
cmp ebp, 0x20
jne 0x40ee74
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x40ee74
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x40ee85
mov eax, dword [esi]
add eax, ebx
call fcn.0040edf4
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x40ee78
cmp byte [esp + 4], 0
je 0x40eea7
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery_1
test eax, eax
je 0x40eec7
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x40ee2d
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x403029
Capabilities:
Create shortcut via ishelllink

Disassembly:
push 0x14
mov eax, 0x466489
call fcn.0043e5c4
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
push 0x4ca4fc
push 1
push 0
push 0x4caf48
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
test ebx, ebx
js 0x403144
mov ecx, dword [ebp - 0x10]
lea edx, [ebp - 0x18]
and dword [ebp - 0x18], 0
push edx
push 0x4caf38
mov eax, dword [ecx]
push ecx
call dword [eax]
mov ebx, eax
test ebx, ebx
js 0x40313b
push dword [ebp + 0xc]
lea ecx, [ebp - 0x14]
call fcn.0041477c
mov ecx, dword [ebp - 0x10]
xor ebx, ebx
push dword [ebp - 0x14]
mov dword [ebp - 4], ebx
push ecx
mov eax, dword [ecx]
call dword [eax + 0x50]
cmp dword [ebp + 0x14], ebx
je 0x4030c1
push dword [ebp + 0x14]
lea ecx, [ebp - 0x1c]
call fcn.0041477c
mov ecx, dword [ebp - 0x10]
push dword [ebp - 0x1c]
mov byte [ebp - 4], 1
push ecx
mov eax, dword [ecx]
call dword [eax + 0x2c]
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], bl
call fcn.004147df
mov ecx, dword [ebp - 0x10]
push ebx
push dword [ebp - 0x14]
mov eax, dword [ecx]
push ecx
call dword [eax + 0x44]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004147df
push dword [ebp + 0x10]
lea ecx, [ebp - 0x1c]
call fcn.0041477c
mov ecx, dword [ebp - 0x10]
push dword [ebp - 0x1c]
mov dword [ebp - 4], 2
push ecx
mov eax, dword [ecx]
call dword [eax + 0x24]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.004147df
push dword [ebp + 8]
lea ecx, [ebp - 0x20]
call fcn.0041477c
mov ecx, dword [ebp - 0x18]
push 1
push dword [ebp - 0x20]
mov dword [ebp - 4], 3
mov eax, dword [ecx]
push ecx
call dword [eax + 0x18]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
mov ebx, eax
call fcn.004147df
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
shr ebx, 0x1f
xor bl, 1
invalid

Function at 0x4034c4
Capabilities:
Persist via run registry key

Disassembly:
push str.Spotify_Web_Helper
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push SysReAllocString
call fcn.00414828
add esp, 0xc
ret