joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48ed94
Capabilities:
Create process on windows
Create process suspended
Self delete

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc4
xor eax, eax
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x22c], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x48ef8d
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x22c]
xor eax, eax
call fcn.00402ae4
mov eax, dword [ebp - 0x22c]
lea edx, [ebp - 0x228]
call fcn.00408e80
mov edx, dword [ebp - 0x228]
lea eax, [ebp - 4]
mov ecx, 0x48efa0
call fcn.00404854
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1d0]
call fcn.00402e78
lea eax, [ebp - 0x1d0]
call fcn.00402c14
call fcn.004028c4
mov edx, 0x48efb8
lea eax, [ebp - 0x1d0]
call fcn.00404c1c
call fcn.004032a8
call fcn.004028c4
push 0x48efc8
lea edx, [ebp - 0x234]
xor eax, eax
call fcn.00402ae4
push dword [ebp - 0x234]
push 0x48efd8
lea eax, [ebp - 0x230]
mov edx, 3
call fcn.004048c8
mov edx, dword [ebp - 0x230]
lea eax, [ebp - 0x1d0]
call fcn.00404c1c
call fcn.004032a8
call fcn.004028c4
push 0x48efe4
lea edx, [ebp - 0x23c]
xor eax, eax
call fcn.00402ae4
push dword [ebp - 0x23c]
push 0x48efd8
push 0x48eff8
lea eax, [ebp - 0x238]
mov edx, 4
call fcn.004048c8
mov edx, dword [ebp - 0x238]
lea eax, [ebp - 0x1d0]
call fcn.00404c1c
call fcn.004032a8
call fcn.004028c4
mov edx, 0x48f00c
lea eax, [ebp - 0x1d0]
call fcn.00404c1c
call fcn.004032a8
call fcn.004028c4
lea eax, [ebp - 0x1d0]
call fcn.00402f40
call fcn.004028c4
lea eax, [ebp - 0x224]
xor ecx, ecx
mov edx, 0x44
call fcn.004030a8
mov dword [ebp - 0x1f8], 1
mov word [ebp - 0x1f4], 0
lea eax, [ebp - 0x1e0]
push eax
lea eax, [ebp - 0x224]
push eax
push 0
push 0
push 0x40
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404a00
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x48ef67
mov eax, dword [ebp - 0x1dc]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x1e0]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48ef94
lea eax, [ebp - 0x23c]
mov edx, 6
call fcn.00404574
lea eax, [ebp - 4]
call fcn.00404550
ret

Function at 0x48f0a8
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebx
add esp, 0xfffffe30
lea eax, [esp + 0x40]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
push 0x40
lea eax, [esp + 4]
push eax
call sub.wsock32.dll_gethostname
push esp
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x48f0e9
mov edx, dword [eax + 0xc]
xor eax, eax
jmp 0x48f0dc
inc eax
cmp dword [edx + eax*4], 0
jne 0x48f0db
mov ebx, eax
call sub.wsock32.dll_WSACleanup
mov eax, ebx
add esp, 0x1d0
pop ebx
ret
Function at 0x48f1d4
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov byte [ebp - 2], cl
mov byte [ebp - 1], dl
mov ebx, eax
mov eax, 0x40
call fcn.0040275c
mov dword [ebp - 8], eax
mov edx, 0x40
mov eax, dword [ebp - 8]
call fcn.0040748c
xor eax, eax
push ebp
push 0x48f259
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebp - 8]
mov byte [esi + 0x30], bl
mov al, byte [ebp + 8]
mov byte [esi + 2], al
mov al, byte [ebp - 1]
mov byte [esi + 0xa], al
mov byte [esi + 0xb], 0
mov al, byte [ebp - 2]
mov byte [esi + 0xc], al
mov byte [esi + 0xd], 0
mov byte [esi], 0x32
mov eax, dword [ebp - 8]
push eax
call sub.netapi32.dll_Netbios
mov al, byte [esi + 0x31]
mov byte [ebp - 3], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48f260
mov edx, 0x40
mov eax, dword [ebp - 8]
call fcn.0040277c
ret

Function at 0x4909fc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.004049f0
xor eax, eax
push ebp
push 0x490ae0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov edx, 0x490af8
call fcn.004045e8
mov eax, dword [ebp - 4]
call fcn.00404808
mov edx, eax
xor dl, 0xa5
mov byte [ebp - 0x11], dl
mov esi, eax
test esi, esi
jle 0x490aa5
mov edi, 1
mov eax, dword [ebp - 4]
mov bl, byte [eax + edi - 1]
xor bl, byte [ebp - 0x11]
mov byte [ebp - 0x11], bl
lea eax, [ebp - 0x18]
xor edx, edx
mov dl, bl
shr edx, 4
mov ecx, dword [ebp - 0x10]
mov dl, byte [ecx + edx]
call fcn.00404730
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0xc]
call fcn.00404810
lea eax, [ebp - 0x1c]
xor edx, edx
mov dl, bl
and edx, 0xf
mov ecx, dword [ebp - 0x10]
mov dl, byte [ecx + edx]
call fcn.00404730
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.00404810
inc edi
dec esi
jne 0x490a54
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.004045a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x490ae7
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00404574
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00404574
lea eax, [ebp - 4]
call fcn.00404550
ret
Function at 0x492930
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd68
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x298], ecx
mov dword [ebp - 0x294], ecx
mov esi, edx
xor eax, eax
push ebp
push 0x492a97
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00404550
lea eax, [ebp - 0x190]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
test eax, eax
jne 0x492a79
xor edx, edx
push ebp
push 0x492a72
push dword fs:[edx]
mov dword fs:[edx], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x290]
push eax
call sub.wsock32.dll_gethostname
test eax, eax
je 0x4929a6
call fcn.0040405c
jmp 0x492a79
lea eax, [ebp - 0x290]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
jne 0x4929c0
call fcn.0040405c
jmp 0x492a79
mov ebx, dword [eax + 0xc]
test ebx, ebx
je 0x4929cc
cmp dword [ebx], 0
jne 0x4929d6
call fcn.0040405c
jmp 0x492a79
mov eax, dword [ebx]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, esi
call fcn.004091a0
add ebx, 4
jmp 0x492a5a
mov eax, dword [esi]
call fcn.00404808
test eax, eax
jle 0x492a2a
push dword [esi]
push 0x492aac
push 0x492ab8
mov eax, dword [ebx]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
lea edx, [ebp - 0x294]
call fcn.004091a0
push dword [ebp - 0x294]
mov eax, esi
mov edx, 4
call fcn.004048c8
jmp 0x492a57
push dword [esi]
push 0x492ab8
mov eax, dword [ebx]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
lea edx, [ebp - 0x298]
call fcn.004091a0
push dword [ebp - 0x298]
mov eax, esi
mov edx, 3
call fcn.004048c8
add ebx, 4
cmp dword [ebx], 0
jne 0x4929eb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x492a79
call sub.wsock32.dll_WSACleanup
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x492a9e
lea eax, [ebp - 0x298]
mov edx, 2
call fcn.00404574
ret
Function at 0x403390
Capabilities:
Create service
Persist via windows service

Disassembly:
sub esp, 0xf8
mov eax, dword [0x452728]
xor eax, esp
mov dword [esp + 0xf4], eax
push ebx
push esi
mov esi, dword [esp + 0x108]
push edi
mov edi, dword [esp + 0x108]
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
jne 0x403407
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x10]
push 0x449a60
push eax
call fcn.00402d70
lea ecx, [esp + 0x18]
push ecx
push 0x453a88
call fcn.00403010
add esp, 0x14
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xf4]
xor ecx, esp
call fcn.0041ae81
add esp, 0xf8
ret
push ebp
push 0
push 0
push 0
push 0
push 0
push edi
push 1
push 2
push 0x110
push 0xf01ff
push esi
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov ebp, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
test edi, edi
jne 0x403461
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
lea edx, [esp + 0x18]
push 0x449a00
push edx
call fcn.00402d70
lea eax, [esp + 0x20]
push eax
push 0x453a88
call fcn.00403010
add esp, 0x18
jmp 0x403486
push esi
lea ecx, [esp + 0x14]
push 0x4499d0
push ecx
call fcn.00402d70
lea edx, [esp + 0x1c]
push edx
push 0x453a88
call fcn.00403010
add esp, 0x14
push edi
call ebp
push ebx
call ebp
mov ecx, dword [esp + 0x104]
pop ebp
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041ae81
add esp, 0xf8
ret

Function at 0x4034b0
Capabilities:
Delete service

Disassembly:
sub esp, 0xf8
mov eax, dword [0x452728]
xor eax, esp
mov dword [esp + 0xf4], eax
push ebx
push esi
mov esi, dword [esp + 0x104]
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
jne 0x40350f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0xc]
push 0x449a60
push eax
call fcn.00402d70
lea ecx, [esp + 0x14]
push ecx
push 0x453a88
call fcn.00403010
add esp, 0x14
jmp 0x40359f
push ebp
push edi
push 0xf01ff
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebp, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
test edi, edi
jne 0x403554
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [esp + 0x14]
push 0x449b18
push edx
call fcn.00402d70
lea eax, [esp + 0x1c]
push eax
push 0x453a88
call fcn.00403010
add esp, 0x14
jmp 0x40359a
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
test eax, eax
jne 0x403576
lea ecx, [esp + 0x14]
push 0x449ad8
push ecx
call fcn.00402d70
lea edx, [esp + 0x1c]
push edx
jmp 0x40358a
lea eax, [esp + 0x14]
push 0x449ab0
push eax
call fcn.00402d70
lea ecx, [esp + 0x1c]
push ecx
push 0x453a88
call fcn.00403010
add esp, 0x14
push edi
call ebp
push ebx
call ebp
pop edi
pop ebp
push 0x453a88
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0xfc]
pop esi
pop ebx
xor ecx, esp
call fcn.0041ae81
add esp, 0xf8
ret
Function at 0x4035d0
Capabilities:
Stop service

Disassembly:
sub esp, 0x114
mov eax, dword [0x452728]
xor eax, esp
mov dword [esp + 0x110], eax
push ebx
push esi
mov esi, dword [esp + 0x120]
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x403630
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x2c]
push 0x449a60
push eax
call fcn.00402d70
lea ecx, [esp + 0x34]
push ecx
push 0x453a88
call fcn.00403010
add esp, 0x14
jmp 0x4036dc
push 0xf01ff
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
test esi, esi
jne 0x403673
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [esp + 0x2c]
push 0x449b18
push edx
call fcn.00402d70
lea eax, [esp + 0x34]
push eax
push 0x453a88
call fcn.00403010
add esp, 0x14
jmp 0x4036d9
lea ecx, [esp + 0xc]
push ecx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x4036ae
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0041ae81
add esp, 0x114
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [esp + 0x2c]
push 0x449b68
push edx
call fcn.00402d70
lea eax, [esp + 0x34]
push eax
push 0x453a88
call fcn.00403010
add esp, 0x14
push esi
call ebx
push edi
call ebx
mov ecx, dword [esp + 0x11c]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0041ae81
add esp, 0x114
ret
Function at 0x404340
Capabilities:
Create http request
Get http content length

Disassembly:
sub esp, 0x42c
mov eax, dword [0x452728]
xor eax, esp
mov dword [esp + 0x428], eax
mov eax, dword [esp + 0x434]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x43c]
push edi
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
or edi, 0xffffffff
push 0x449d74
mov dword [esp + 0x24], eax
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x34], 4
mov dword [esp + 0x30], edi
call dword [sym.imp.WININET.dll_InternetOpenA]
mov ebp, eax
mov dword [esp + 0x18], ebp
cmp ebp, ebx
je 0x404521
push ebx
push 0x80000000
push ebx
push ebx
push esi
push ebp
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov esi, eax
cmp esi, ebx
je 0x40451a
mov edi, dword [sym.imp.WININET.dll_HttpQueryInfoA]
push ebx
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x30]
push edx
push 0x20000005
push esi
call edi
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x38]
push edx
push 0x13
push esi
mov byte [esp + 0x44], bl
mov dword [esp + 0x45], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x38], 4
call edi
test eax, eax
je 0x40450f
cmp byte [esp + 0x30], 0x32
jne 0x40450f
mov al, 0x30
cmp byte [esp + 0x31], al
jne 0x40450f
cmp byte [esp + 0x32], al
jne 0x40450f
mov eax, dword [esp + 0x10]
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, ebx
je 0x40450b
cmp ebp, 0xffffffff
je 0x40450b
mov ecx, dword [esp + 0x448]
push ebx
push ebx
push ebx
push ecx
push esi
call dword [sym.imp.WININET.dll_InternetSetFilePointer]
push 0x3ff
lea edx, [esp + 0x3d]
push ebx
push edx
mov byte [esp + 0x44], bl
call fcn.0041ae90
mov edi, dword [sym.imp.WININET.dll_InternetReadFile]
add esp, 0xc
lea eax, [esp + 0x14]
push eax
push 0x400
lea ecx, [esp + 0x40]
push ecx
push esi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], ebx
call edi
test eax, eax
je 0x404504
lea ebx, [ebx]
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x404500
push ebx
lea edx, [esp + 0x14]
push edx
push eax
lea eax, [esp + 0x44]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x404504
mov ecx, dword [esp + 0x14]
cmp ecx, dword [esp + 0x10]
jne 0x404504
push 0x3ff
lea edx, [esp + 0x3d]
push ebx
push edx
mov byte [esp + 0x44], bl
call fcn.0041ae90
add esp, 0xc
lea eax, [esp + 0x14]
push eax
push 0x400
lea ecx, [esp + 0x40]
push ecx
push esi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], ebx
call edi
test eax, eax
jne 0x4044a0
jmp 0x404504
mov dword [esp + 0x1c], ebx
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebp, dword [esp + 0x18]
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov edi, dword [esp + 0x1c]
push ebp
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, dword [esp + 0x438]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041ae81
add esp, 0x42c
ret
Function at 0x41d239
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x3039a37c
and ecx, dword [edi - 0x4828bd48]
inc ecx
test byte [edi + 0x27fb78e3], dh
in eax, dx
aaa
add ecx, edx
invalid

Function at 0x436690
Capabilities:
Encode data using xor

Disassembly:
xchg ebx, eax
fsubr st(6), st(0)
mov ebp, 0xc3bccf36
rol byte [ebp - 0x2d3bd7e8], 1
mov es, word [esi]
or edi, dword [edi]
retf 0xa783
aad 0x79
std
sub byte [edx], al
sbb byte [ecx + 0x4427cd52], 0xe
add al, byte [eax + 0x27cd5299]
inc esp
push cs
dec edx
loopne 0x4366b5
mov byte [eax - 0x17], 0x8f
into
mov ecx, 0x3fb27c37
cmp al, 0x97
mov ebx, 0x184f18f1
adc bh, byte [ebx]
push ds
ja 0x4366c7
dec eax
sbb al, 0x57
inc edi
sub byte ds:[edx - 0x25c6f355], 0x41
stc
jno 0x436694
mul dword [esi + 0x2ba2fd98]
inc eax
fistp dword [edi + 0x73]
xchg ebx, eax
std
mov byte [0x5fdb402b], al
jae 0x436662
mov ah, 0x1c
nop
cmp dl, byte [ecx]
push esi
rcr dword [edx - 0x33b92370], 0x55
inc edi
push ebx
rcr byte [eax], 0
invalid

Function at 0x436a71
Capabilities:
Encode data using xor

Disassembly:
mov al, dh
cmpsb byte [esi], byte es:[edi]
fsubp st(1)
invalid
adc byte [0xe3de4e79], al
mov eax, dword [0x324e533f]
dec ecx
in al, dx
arpl word [ecx + 0x81bf698], sp
sub al, 0xc7
add byte [esi - 0x16659c86], cl
push ebx
das
dec edi
mov dl, 0x6a
shl byte [ebx], 0x86
adc eax, 0xe780f230
or eax, 0xefceb58e
daa
out dx, eax
adc al, dh
movsb byte es:[edi], byte [esi]
jno 0x4369e7
cmp ebp, dword [edx + 0x1ca82785]
or dh, byte [esi - 0x36d93d21]
salc
inc ebx
in eax, 0xed
sbb al, 3
fisub word [ecx + 0x4a1151c7]
mov ebp, dword [eax]
rcr dword [edi - 0x6c], 0x70
dec edi
sub cl, al
pop edi
xchg esp, eax
jo 0x436aaa
xor eax, 0x52a6414b
inc ebp
invalid
ret
add eax, 0x5dadf1be
in eax, dx
int 0x23
inc esi
cmp bl, cl
add dword [ebx - 0x2682cf27], edi
loopne 0x436a08
pop edx
push edx
jp 0x436af8
mov dword [0x42d186be], eax
push esp
adc dh, byte [eax + 0x40]
invalid
test al, 0x51
jae 0x436a64
dec eax
and al, 0xfa
salc
aam 0x5f
xor ebp, dword [edx]
psubw mm1, qword [esi + 0x4c9df68]
test dword [edx + 0x68], ebx
rcl byte [ecx]
sub cl, byte [edi]
stc
mov gs, word [eax - 0x21]
leave
add al, 0x85
pop edx
push 0x27c911d0
leave
daa
and al, 0xf
cmpsd dword [esi], dword es:[edi]
jp 0x436a9d
jo 0x436b05
mov dl, byte ss:[ebx - 8]
dec eax
invalid
pop ss
xlatb

Function at 0x43f172
Capabilities:
Encode data using xor

Disassembly:
push edx
jge 0x43f1be
mov ah, bh
shl dword [edx], cl
fbld tbyte [ecx]
outsd dx, dword [esi]
push cs
xchg ecx, eax
or ebx, dword [eax + 0x3b]
out dx, eax
mov byte [0x6d75ef7f], al
js 0x43f18e
invalid
div dword [edx - 0x6a]
test eax, 0x468b4ba
adc al, 0x3a
and byte [esp + ebp + 0x7b106492], 0xfa
fld st(0)
Function at 0x40101a
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
nop
mov eax, 0xfffffff5
push eax
call sub.kernel32.dll_GetStdHandle
mov ecx, dword [ebp + 8]
sub ecx, 1
mov word [ebp - 4], cx
mov ecx, dword [ebp + 0xc]
sub ecx, 1
mov word [ebp - 2], cx
sub esp, 4
mov ecx, esp
mov edx, 4
push edx
lea edx, [ebp - 4]
push edx
push ecx
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ecx
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetConsoleCursorPosition
leave
ret

Function at 0x401287
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
nop
mov eax, str.title_Clock
push eax
call sub.msvcrt.dll_system
add esp, 4
mov eax, str.color_1f
push eax
call sub.msvcrt.dll_system
add esp, 4
mov eax, str.mode_35_6
push eax
call sub.msvcrt.dll_system
add esp, 4
call sub.msvcrt.dll__kbhit
test eax, eax
je 0x4012cd
jmp 0x401342
mov eax, 0
push eax
call sub.msvcrt.dll_time
add esp, 4
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
call sub.msvcrt.dll_ctime
add esp, 4
push eax
lea eax, [ebp - 0x104]
push eax
call sub.msvcrt.dll_strcpy
add esp, 8
mov eax, 3
push eax
mov eax, 6
push eax
call fcn.0040101a
add esp, 8
lea eax, [ebp - 0x104]
push eax
mov eax, 0x402023
push eax
call sub.msvcrt.dll_printf
add esp, 8
mov eax, dword [sym.imp.msvcrt.dll__iob]
push eax
call sub.msvcrt.dll_fflush
add esp, 4
mov eax, 0x3e8
push eax
call sub.kernel32.dll_Sleep
jmp 0x4012bb
mov eax, 0
jmp 0x40134c
leave
ret
Function at 0x40badb
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push 0x100
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.USER32.dll_GetDlgItemTextA
sub esp, 8
push 0
push 0
push 0
lea eax, [ebp - 0x108]
push eax
push 0x40bad6
push 0
call sub.SHELL32.DLL_ShellExecuteA
add esp, 8
leave
ret

Function at 0x40df9b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0x10]
and eax, 0xffff
push eax
mov eax, dword [ebp + 0xc]
shr eax, 4
inc eax
and eax, 0xffff
push eax
push 6
push dword [ebp + 8]
call sub.KERNEL32.dll_FindResourceExA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40dfd6
mov dword [ebp - 0x14], 0
jmp 0x40e063
sub esp, 8
push dword [ebp - 4]
push dword [ebp + 8]
call sub.KERNEL32.dll_LoadResource
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40dff9
mov dword [ebp - 0x14], 0
jmp 0x40e063
sub esp, 0xc
push dword [ebp - 8]
call sub.KERNEL32.dll_LockResource
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x40e019
mov dword [ebp - 0x14], 0
jmp 0x40e063
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 0xc]
and eax, 0xf
cmp dword [ebp - 0x10], eax
jb 0x40e02d
jmp 0x40e04a
mov eax, dword [ebp - 0xc]
mov ax, word [eax]
and eax, 0xffff
add eax, eax
add eax, dword [ebp - 0xc]
add eax, 2
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
inc dword [eax]
jmp 0x40e020
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp - 0xc]
mov ax, word [eax]
and eax, 0xffff
mov dword [edx], eax
mov eax, dword [ebp - 0xc]
add eax, 2
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
leave
ret
Function at 0x4104d0
Capabilities:
Hash data with md5

Disassembly:
mov edx, dword [esp + 4]
mov dword [edx], 0x67452301
mov dword [edx + 4], 0xefcdab89
mov dword [edx + 8], 0x98badcfe
mov dword [edx + 0xc], 0x10325476
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0
mov dword [edx + 0x58], 0
mov eax, 1
ret

Function at 0x418a60
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x158
push 0xfffffffffffffff4
mov ebx, dword [ebp + 8]
call sub.KERNEL32.dll_GetStdHandle
add esp, 0xc
test eax, eax
je 0x418a91
sub esp, 0xc
push eax
call sub.KERNEL32.dll_GetFileType
add esp, 0xc
test eax, eax
jne 0x418c60
lea edx, [ebp + 0xc]
push edx
push ebx
push 0xff
lea esi, [ebp - 0x118]
push esi
call sub.msvcrt.dll__vsnprintf
mov byte [ebp - 0x19], 0
call sub.KERNEL32.dll_GetVersion
add esp, 0x10
cmp eax, 0x7fffffff
ja 0x418afd
call sub.USER32.dll_GetDesktopWindow
call sub.USER32.dll_GetProcessWindowStation
test eax, eax
mov ebx, eax
mov edx, 0xffffffff
je 0x418af5
sub esp, 0xc
lea edi, [ebp - 0x14c]
push edi
push 0
push 0
push 2
push eax
call sub.USER32.dll_GetUserObjectInformationW
add esp, 0xc
test eax, eax
je 0x418bbb
mov edx, 0xffffffff
test edx, edx
jne 0x418b80
sub esp, 0xc
lea edx, [ebp - 0x148]
push edx
mov dword [ebp - 0x148], 0x28
mov dword [ebp - 0x144], 0
mov dword [ebp - 0x138], 0x418a27
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x140], 0
mov dword [ebp - 0x130], 0x7f01
mov dword [ebp - 0x12c], 0
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x124], 0x409
mov dword [ebp - 0x13c], esi
call sub.USER32.dll_MessageBoxIndirectA
add esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
sub esp, 8
push 0x418a36
push 0
call sub.ADVAPI32.DLL_RegisterEventSourceA
push ecx
push 0
mov dword [ebp - 0x150], esi
lea esi, [ebp - 0x150]
push esi
push 0
push 1
push 0
push 0
push 0
push 1
push eax
mov edi, eax
call sub.ADVAPI32.DLL_ReportEventA
push edi
call sub.ADVAPI32.DLL_DeregisterEventSource
jmp 0x418b6c
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x418af0
mov eax, dword [ebp - 0x14c]
cmp eax, 0x200
mov edx, 0xffffffff
ja 0x418af5
lea ecx, [eax + 1]
and ecx, 0xfffffffe
lea edx, [ecx + 0x11]
and edx, 0xfffffff0
mov eax, edx
call fcn.0041c850
mov dword [ebp - 0x154], esp
sub esp, 0xc
push edi
push ecx
mov eax, dword [ebp - 0x154]
push eax
push 2
push ebx
mov dword [ebp - 0x14c], ecx
call sub.USER32.dll_GetUserObjectInformationW
add esp, 0xc
test eax, eax
mov edx, 0xffffffff
je 0x418af5
mov ecx, dword [ebp - 0x14c]
inc ecx
sub esp, 8
and ecx, 0xfffffffe
mov edi, dword [ebp - 0x154]
mov word [edi + ecx], 0
push 0x418a3e
push edi
mov dword [ebp - 0x14c], ecx
call sub.msvcrt.dll_wcsstr
add esp, 0x10
test eax, eax
setne bl
xor edx, edx
mov dl, bl
jmp 0x418af5
push edx
lea ecx, [ebp + 0xc]
push ecx
mov edx, dword [sym.imp.msvcrt.dll__iob]
push ebx
add edx, 0x40
push edx
call sub.msvcrt.dll_vfprintf
add esp, 0x10
jmp 0x418b6f