joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46b310
Capabilities:
Link many functions at runtime

Disassembly:
lea esi, [0x554818]
push esi
mov eax, dword [0x554408]
push eax
call sub.KERNEL32.dll_GetProcAddress
mov dword [0x55482d], eax
mov dword [0x5540f5], 1
mov eax, 0x4000
push eax
lea eax, [0x554333]
push eax
lea eax, [0x5540e1]
push eax
lea esi, [0x5545cf]
call dword [esi]
cmp eax, 0xffffffff
jne 0x46b35c
mov dword [0x5540f5], 0
cmp dword [0x5540f5], 0
je 0x46b3d2
mov eax, 0x4000
push eax
lea eax, [0x554333]
push eax
lea eax, [0x5540ca]
push eax
lea esi, [0x5545cf]
call dword [esi]
cmp eax, 0xffffffff
je 0x46b3d2
lea eax, [0x5540ca]
push eax
call dword [0x5541f3]
mov dword [0x5540ed], eax
cmp eax, 0
je 0x46b3d2
lea edx, [0x5540f9]
push edx
push eax
call sub.KERNEL32.dll_GetProcAddress
cmp eax, 0
je 0x46b3d2
mov dword [0x55414b], eax
mov eax, dword [0x5540ed]
lea edx, [0x554130]
push edx
push eax
call sub.KERNEL32.dll_GetProcAddress
cmp eax, 0
je 0x46b3d2
mov dword [0x55414f], eax
jmp 0x46b44a
mov eax, 0x4000
push eax
lea eax, [0x554333]
push eax
lea eax, [0x5540d7]
push eax
lea esi, [0x5545cf]
call dword [esi]
cmp eax, 0xffffffff
je 0x46b43f
lea eax, [0x5540d7]
push eax
call dword [0x5541f3]
mov dword [0x5540f1], eax
cmp eax, 0
je 0x46b43f
lea edx, [0x554115]
push edx
push eax
call sub.KERNEL32.dll_GetProcAddress
cmp eax, 0
je 0x46b43f
mov dword [0x55414b], eax
mov eax, dword [0x5540f1]
lea edx, [0x55413e]
push edx
push eax
call sub.KERNEL32.dll_GetProcAddress
cmp eax, 0
je 0x46b43f
mov dword [0x55414f], eax
jmp 0x46b455
mov dword [0x554153], 0
ret
mov dword [0x554153], 1
ret
mov dword [0x554153], 2
ret

Function at 0x46b76d
Capabilities:
Packed with generic packer

Disassembly:
pushal
push eax
push ecx
push edx
test ax, 1
je 0x46b78a
push ecx
push edx
call dword [0x554763]
cmp eax, 0
je 0x46b78a
pop edx
pop ecx
pop eax
stc
jmp 0x46b7a5
pop edx
pop ecx
pop eax
test ax, 2
je 0x46b7a4
push ecx
push edx
call dword [0x554775]
cmp ax, 0
je 0x46b7a4
stc
jmp 0x46b7a5
clc
popal
ret

Function at 0x46c5d8
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
mov ecx, dword [eax]
push edi
mov edi, dword [esp + 0x14]
lea ebp, [eax + 8]
mov dword [esp + 0x14], 0xc
mov edx, dword [edi + 4]
add edx, ecx
mov ecx, dword [edi]
mov dword [edi + 4], edx
mov edx, dword [eax + 4]
add ecx, edx
mov dword [edi], ecx
mov ebx, dword [edi]
mov ecx, dword [edi + 4]
mov esi, ebx
mov edx, ebx
shr esi, 4
xor edx, ecx
and esi, 0x1f
mov ecx, 0x20
mov eax, edx
sub ecx, esi
add ebp, 8
shr eax, cl
mov ecx, esi
shl edx, cl
mov ecx, 0x20
or eax, edx
mov edx, dword [ebp - 8]
sub eax, edx
mov edx, eax
mov dword [edi + 4], eax
shr edx, 7
and edx, 0x1f
xor eax, ebx
sub ecx, edx
mov esi, eax
shr esi, cl
mov ecx, edx
mov edx, dword [ebp - 4]
shl eax, cl
or esi, eax
mov eax, dword [esp + 0x14]
add esi, edx
dec eax
mov dword [edi], esi
mov dword [esp + 0x14], eax
jne 0x46c602
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x46c661
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
lea ebp, [eax + 0x60]
mov dword [esp + 0x14], 0xc
mov ebx, dword [edi + 4]
mov edx, dword [edi]
mov ecx, dword [ebp + 4]
mov esi, ebx
shr esi, 7
sub edx, ecx
and esi, 0x1f
mov ecx, 0x20
mov eax, edx
sub ecx, esi
sub ebp, 8
shl eax, cl
mov ecx, esi
shr edx, cl
or eax, edx
xor eax, ebx
mov dword [edi], eax
mov ecx, dword [ebp + 8]
mov edx, eax
shr edx, 4
lea esi, [ebx + ecx]
and edx, 0x1f
mov ecx, 0x20
mov ebx, esi
sub ecx, edx
shl ebx, cl
mov ecx, edx
shr esi, cl
or ebx, esi
xor ebx, eax
mov eax, dword [esp + 0x14]
dec eax
mov dword [edi + 4], ebx
mov dword [esp + 0x14], eax
jne 0x46c678
mov eax, dword [esp + 0x18]
mov esi, dword [edi]
mov ecx, ebx
mov edx, dword [eax + 4]
sub esi, edx
mov dword [edi], esi
mov eax, dword [eax]
sub ecx, eax
mov dword [edi + 4], ecx
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x46c6ec
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x88
mov eax, dword [esp + 0x90]
push ebx
push esi
mov esi, dword [esp + 0x94]
lea ebx, [eax + 7]
shr ebx, 3
and eax, 7
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], eax
jne 0x46c71d
mov dword [esp + 0x10], 8
push ebp
push edi
lea eax, [ebx - 1]
xor edx, edx
xor ecx, ecx
xor edi, edi
test eax, eax
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x1c], edi
jbe 0x46c7ed
mov ebp, dword [esi]
xor ebp, ecx
mov ecx, dword [esi + 4]
xor ecx, edx
mov dword [esi], ebp
test edi, edi
mov dword [esi + 4], ecx
jne 0x46c7bf
cmp ebx, 2
push edi
jbe 0x46c7b2
lea eax, [esp + 0x2c]
push eax
push esi
call fcn.0046cb1d
mov edi, dword [esp + 0x34]
add esp, 0xc
mov dword [esp + 0x30], edi
lea eax, [esp + 0x30]
mov ebx, 0x19
mov ecx, dword [eax]
mov edx, dword [esp + 0x2c]
add ecx, edx
mov ebp, edi
mov dword [eax + 4], ecx
mov edx, dword [eax]
and edx, 0x1f
mov ecx, 0x20
sub ecx, edx
add eax, 4
shl ebp, cl
mov ecx, edx
mov edx, ebp
mov ebp, edi
shr ebp, cl
or edx, ebp
mov ebp, dword [esp + 0x34]
xor ebp, edx
dec ebx
mov dword [esp + 0x34], ebp
jne 0x46c773
mov ebx, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
jmp 0x46c7cd
push 0
push esi
call fcn.0046cb1d
add esp, 0xc
jmp 0x46c7cd
lea eax, [esp + 0x30]
push eax
push esi
call fcn.0046c5d8
add esp, 8
mov ecx, dword [esi]
mov edx, dword [esi + 4]
add esi, 8
inc edi
lea eax, [ebx - 1]
mov dword [esp + 0x10], ecx
cmp edi, eax
mov dword [esp + 0x14], edx
mov dword [esp + 0x1c], edi
jb 0x46c73c
mov eax, dword [esp + 0x18]
xor edi, edi
test eax, eax
jbe 0x46c818
mov ebp, esi
lea ecx, [esp + 0x10]
sub ebp, ecx
mov cl, byte [esp + edi + 0x10]
lea eax, [esp + edi + 0x10]
mov dl, byte [ebp + eax]
xor cl, dl
inc edi
mov byte [eax], cl
mov eax, dword [esp + 0x18]
cmp edi, eax
jb 0x46c7ff
pop edi
cmp ebx, 2
pop ebp
jbe 0x46c833
lea eax, [esp + 0x28]
lea ecx, [esp + 8]
push eax
push ecx
call fcn.0046c5d8
add esp, 8
jmp 0x46c856
cmp ebx, 1
jne 0x46c845
mov edx, dword [esi]
mov eax, dword [esi + 4]
mov dword [esp + 8], edx
mov dword [esp + 0xc], eax
push 0
lea ecx, [esp + 0xc]
push 0
push ecx
call fcn.0046cb1d
add esp, 0xc
cmp ebx, 1
jbe 0x46c88a
mov ecx, dword [esp + 0x10]
xor eax, eax
test ecx, ecx
jbe 0x46c871
mov dl, byte [esi + eax - 8]
mov byte [esi + eax], dl
inc eax
cmp eax, ecx
jb 0x46c865
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esi - 8], eax
mov dword [esi - 4], ecx
pop esi
xor eax, eax
pop ebx
add esp, 0x88
ret
mov edx, dword [esp + 8]
mov eax, dword [esp + 0xc]
mov dword [esi], edx
mov dword [esi + 4], eax
pop esi
xor eax, eax
pop ebx
add esp, 0x88
ret
Function at 0x46c8a2
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x90
mov eax, dword [esp + 0x98]
push ebx
mov ebx, dword [esp + 0x98]
push ebp
lea ebp, [eax + 7]
push esi
shr ebp, 3
and eax, 7
push edi
mov dword [esp + 0x28], ebp
mov dword [esp + 0x20], eax
jne 0x46c8d5
mov dword [esp + 0x20], 8
xor edx, edx
cmp ebp, 1
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], edx
jbe 0x46c9be
lea eax, [ebp - 2]
xor esi, esi
cmp eax, edx
mov dword [esp + 0x24], esi
jbe 0x46c9be
jmp 0x46c905
xor edx, edx
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
cmp esi, edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
jne 0x46c975
push edx
lea edx, [esp + 0x34]
push edx
push ebx
call fcn.0046cb1d
mov esi, dword [esp + 0x3c]
add esp, 0xc
mov dword [esp + 0x38], esi
lea eax, [esp + 0x38]
mov edi, 0x19
mov ecx, dword [eax]
mov edx, dword [esp + 0x34]
add ecx, edx
mov ebp, esi
mov dword [eax + 4], ecx
mov edx, dword [eax]
and edx, 0x1f
mov ecx, 0x20
sub ecx, edx
add eax, 4
shl ebp, cl
mov ecx, edx
mov edx, ebp
mov ebp, esi
shr ebp, cl
or edx, ebp
mov ebp, dword [esp + 0x3c]
xor ebp, edx
dec edi
mov dword [esp + 0x3c], ebp
jne 0x46c936
mov ebp, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
jmp 0x46c983
lea eax, [esp + 0x38]
push eax
push ebx
call fcn.0046c661
add esp, 8
mov ecx, dword [esp + 0x10]
mov edx, dword [ebx]
mov eax, dword [ebx + 4]
xor edx, ecx
mov dword [ebx], edx
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
xor eax, edx
mov dword [ebx + 4], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x10], eax
add ebx, 8
inc esi
lea eax, [ebp - 2]
cmp esi, eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x24], esi
jb 0x46c903
xor edx, edx
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x10], edx
cmp ecx, edx
mov dword [esp + 0x14], edx
jbe 0x46c9e3
mov eax, ecx
lea esi, [ebx + 8]
lea edi, [esp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp ebp, 1
jne 0x46c9f8
push edx
push edx
push ebx
call fcn.0046cb1d
add esp, 0xc
jmp 0x46ca80
cmp ebp, 2
jne 0x46ca0a
push edx
push edx
push ebx
call fcn.0046cb1d
add esp, 0xc
jmp 0x46ca1d
lea ecx, [esp + 0x38]
push ecx
push ebx
call fcn.0046c661
add esp, 8
cmp ebp, 1
jbe 0x46ca80
mov edx, dword [ebx]
mov esi, dword [esp + 0x10]
mov eax, dword [ebx + 4]
mov edi, dword [esp + 0x20]
xor esi, edx
mov edx, dword [esp + 0x14]
xor edx, eax
xor eax, eax
test edi, edi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edx
jbe 0x46ca5e
mov ecx, ebx
lea edx, [esp + 0x10]
sub ecx, edx
mov dl, byte [eax + ebx + 8]
lea esi, [esp + eax + 0x10]
inc eax
mov byte [esi + ecx], dl
mov dl, byte [esi]
mov byte [eax + ebx + 7], dl
cmp eax, edi
jb 0x46ca48
cmp ebp, 2
jne 0x46ca72
push 0
push 0
push ebx
call fcn.0046cb1d
add esp, 0xc
jmp 0x46ca80
lea eax, [esp + 0x38]
push eax
push ebx
call fcn.0046c661
add esp, 8
mov ecx, dword [esp + 0x18]
mov edx, dword [ebx]
mov eax, dword [ebx + 4]
xor edx, ecx
mov dword [ebx], edx
mov edx, dword [esp + 0x1c]
xor eax, edx
pop edi
pop esi
mov dword [ebx + 4], eax
pop ebp
xor eax, eax
pop ebx
add esp, 0x90
ret
Function at 0x401090
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create process suspended

Disassembly:
push ebx
push ecx
push edx
push esi
push ebp
sub esp, 0x4ac
mov ebx, eax
push 0
push 0
lea eax, [esp + 0x4b0]
push eax
push 0x409018
call dword [sym.imp.KERNEL32.DLL_CreatePipe]
test eax, eax
jne 0x4010d3
mov dword [0x409018], eax
mov dword [0x409000], eax
mov dword [0x409014], eax
add esp, 0x4ac
pop ebp
pop esi
pop edx
pop ecx
pop ebx
ret
push ebx
mov eax, dword [0x409008]
push eax
push 0x40104b
lea eax, [esp + 0xc]
push eax
xor edx, edx
call fcn.004016b0
add esp, 0x10
mov ebx, 0x44
lea eax, [esp + 0x450]
call fcn.004016d0
push 2
push 1
xor eax, eax
push 0
mov word [esp + 0x48c], ax
lea eax, [esp + 0x4b0]
push eax
mov dword [esp + 0x460], 0x44
mov dword [esp + 0x48c], 0x101
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
mov ebx, dword [esp + 0x4bc]
push ebx
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.DLL_DuplicateHandle]
push 2
push 1
mov eax, dword [esp + 0x4ac]
push 0
mov dword [esp + 0x49c], eax
lea eax, [esp + 0x4b0]
push eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
mov esi, dword [esp + 0x4bc]
push esi
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.DLL_DuplicateHandle]
mov eax, dword [esp + 0x4a4]
mov dword [esp + 0x48c], eax
mov eax, dword [0x409010]
mov dword [esp + 0x488], eax
lea eax, [esp + 0x494]
push eax
lea eax, [esp + 0x454]
push eax
push 0
push 0
push 0x200
push 1
push 0
push 0
lea eax, [esp + 0x20]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
test eax, eax
jne 0x4011d2
mov dword [esp + 0x49c], eax
mov ebp, dword [esp + 0x498]
push ebp
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esp + 0x490]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov edx, dword [esp + 0x48c]
push edx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [esp + 0x4a8]
push ecx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esp + 0x49c]
mov dword [0x409014], eax
mov eax, dword [esp + 0x494]
mov dword [0x409000], eax
add esp, 0x4ac
pop ebp
pop esi
pop edx
pop ecx
pop ebx
ret
Function at 0x401280
Capabilities:
Read file on windows
Read pipe
Set current directory

Disassembly:
push ebx
push ecx
push edx
push esi
push edi
push ebp
sub esp, 0x408
mov edi, 0x400
mov esi, 1
mov eax, esp
mov edx, edi
call fcn.004015e0
mov dword [esp + 0x400], eax
test eax, eax
je case.0x4012be.5
mov byte [esp + eax], 0
mov al, byte [esp]
dec al
cmp al, 8
ja case.0x4012be.7
movzx eax, al
jmp dword [eax*4 + 0x401250]
lea eax, [esp + 1]
push eax
xor ebx, ebx
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryA]
test eax, eax
je 0x4012df
mov eax, ebx
call fcn.00401230
jmp case.0x4012be.7
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov ebx, eax
mov eax, ebx
call fcn.00401230
jmp case.0x4012be.7
lea eax, [esp + 1]
call fcn.00401090
jmp case.0x4012be.7
mov ebx, dword [esp + 1]
cmp edi, ebx
jae 0x401305
mov ebx, edi
push 0
lea eax, [esp + 0x404]
push eax
push 0
push 0
lea eax, [esp + 0x10]
push eax
mov ecx, dword [0x409018]
push ecx
dec ebx
call dword [sym.imp.KERNEL32.DLL_PeekNamedPipe]
test eax, eax
je 0x401370
mov ebp, dword [esp + 0x400]
test ebp, ebp
je 0x401370
cmp ebx, ebp
jbe 0x40133b
mov ebx, ebp
push 0
lea eax, [esp + 0x404]
push eax
push ebx
lea eax, [esp + 0xd]
push eax
mov edx, dword [0x409018]
push edx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov edx, dword [esp + 0x400]
mov eax, esp
inc edx
mov byte [esp], 7
call fcn.00401650
jmp case.0x4012be.7
push 0
mov eax, dword [0x409000]
push eax
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
cmp eax, 0x102
jne 0x40139e
push esi
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov eax, esp
mov edx, esi
mov byte [esp], 0
call fcn.00401650
jmp case.0x4012be.7
lea eax, [esp + 0x404]
push eax
mov edx, dword [0x409000]
push edx
call dword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
mov ecx, dword [0x409018]
push ecx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esp + 0x404]
call fcn.00401230
mov ebp, dword [0x409000]
xor ebx, ebx
push ebp
mov dword [0x409014], ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp case.0x4012be.7
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_GenerateConsoleCtrlEvent]
jmp case.0x4012be.7
push 0
mov eax, dword [0x409000]
push eax
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
jmp case.0x4012be.7
add esp, 0x408
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret
mov edx, dword [0x40901c]
push edx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [0x409024]
push ecx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ebx, dword [0x409020]
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ebp, dword [0x40900c]
push ebp
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [0x409028]
push eax
call dword [sym.imp.KERNEL32.DLL_UnmapViewOfFile]
xor eax, eax
jmp fcn.004016e9
Function at 0x4013f4
Capabilities:
Read file on windows
Read pipe
Set current directory
Terminate process

Disassembly:
push ebx
push ecx
push edx
push esi
push edi
push ebp
sub esp, 0x408
mov edi, 0x400
mov esi, 1
mov eax, esp
mov edx, edi
call fcn.004015e0
mov dword [esp + 0x400], eax
test eax, eax
je case.0x4012be.5
mov byte [esp + eax], 0
mov al, byte [esp]
dec al
cmp al, 8
ja case.0x4012be.7
movzx eax, al
jmp dword [eax*4 + 0x401250]
lea eax, [esp + 1]
push eax
xor ebx, ebx
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryA]
test eax, eax
je 0x4012df
mov eax, ebx
call fcn.00401230
jmp case.0x4012be.7
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov ebx, eax
mov eax, ebx
call fcn.00401230
jmp case.0x4012be.7
lea eax, [esp + 1]
call fcn.00401090
jmp case.0x4012be.7
mov ebx, dword [esp + 1]
cmp edi, ebx
jae 0x401305
mov ebx, edi
push 0
lea eax, [esp + 0x404]
push eax
push 0
push 0
lea eax, [esp + 0x10]
push eax
mov ecx, dword [0x409018]
push ecx
dec ebx
call dword [sym.imp.KERNEL32.DLL_PeekNamedPipe]
test eax, eax
je 0x401370
mov ebp, dword [esp + 0x400]
test ebp, ebp
je 0x401370
cmp ebx, ebp
jbe 0x40133b
mov ebx, ebp
push 0
lea eax, [esp + 0x404]
push eax
push ebx
lea eax, [esp + 0xd]
push eax
mov edx, dword [0x409018]
push edx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov edx, dword [esp + 0x400]
mov eax, esp
inc edx
mov byte [esp], 7
call fcn.00401650
jmp case.0x4012be.7
push 0
mov eax, dword [0x409000]
push eax
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
cmp eax, 0x102
jne 0x40139e
push esi
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov eax, esp
mov edx, esi
mov byte [esp], 0
call fcn.00401650
jmp case.0x4012be.7
lea eax, [esp + 0x404]
push eax
mov edx, dword [0x409000]
push edx
call dword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
mov ecx, dword [0x409018]
push ecx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esp + 0x404]
call fcn.00401230
mov ebp, dword [0x409000]
xor ebx, ebx
push ebp
mov dword [0x409014], ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp case.0x4012be.7
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_GenerateConsoleCtrlEvent]
jmp case.0x4012be.7
push 0
mov eax, dword [0x409000]
push eax
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
jmp case.0x4012be.7
add esp, 0x408
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret
mov edx, dword [0x40901c]
push edx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [0x409024]
push ecx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ebx, dword [0x409020]
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ebp, dword [0x40900c]
push ebp
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [0x409028]
push eax
call dword [sym.imp.KERNEL32.DLL_UnmapViewOfFile]
xor eax, eax
jmp fcn.004016e9
Function at 0x4014b0
Capabilities:
Enumerate gui resources
Read file via mapping
Terminate process

Disassembly:
push ecx
sub esp, 0xc
push 0x401010
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateSemaphoreA]
push 0x401054
push 1
push 0
push 0
mov dword [0x40901c], eax
call dword [sym.imp.KERNEL32.DLL_CreateSemaphoreA]
push 0x40101e
push 1
push 0
push 0
mov dword [0x409024], eax
call dword [sym.imp.KERNEL32.DLL_CreateSemaphoreA]
push 0x40107b
push 0x400
push 0
push 4
push 0
push 0xffffffffffffffff
mov dword [0x409020], eax
call dword [sym.imp.KERNEL32.DLL_CreateFileMappingA]
push 0
push 0
push 0
push 2
push eax
mov dword [0x40900c], eax
call dword [sym.imp.KERNEL32.DLL_MapViewOfFile]
mov dword [0x409028], eax
mov eax, 0x401085
call fcn.00401750
mov dword [0x409008], eax
test eax, eax
jne 0x401556
push 0x401029
push 0x408040
call fcn.004017f0
add esp, 8
mov eax, 1
jmp fcn.004016e9
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_SetConsoleCtrlHandler]
push 1
push 0x4014a0
call dword [sym.imp.KERNEL32.DLL_SetConsoleCtrlHandler]
xor edx, edx
push edx
push edx
push 3
lea eax, [esp + 0xc]
push eax
push 3
push 0x80000000
mov dword [esp + 0x18], 0xc
push 0x40101a
mov dword [esp + 0x24], 1
mov dword [esp + 0x20], edx
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov dword [0x409010], eax
cmp eax, 0xffffffff
je 0x4015bc
push 0
push 0x401460
call dword [sym.imp.USER32.DLL_EnumWindows]
call fcn.00401280
jmp 0x4015b5
push 0x401060
push 0x408040
call fcn.004017f0
add esp, 8
mov eax, 1
jmp fcn.004016e9
Function at 0x401a10
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push esi
push edi
mov edi, eax
mov esi, ebx
mov dword [0x40904c], eax
mov dword [0x408258], edx
call fcn.004032b0
xor eax, eax
mov dword [0x409670], eax
call dword [sym.imp.KERNEL32.DLL_GetVersion]
mov edx, eax
mov byte [0x4082b5], al
shr eax, 0x10
mov word [0x4082b7], ax
xor eax, eax
mov ax, word [0x4082b7]
and edx, 0xffff
mov dword [0x4082b9], eax
xor eax, eax
sar edx, 8
mov al, byte [0x4082b5]
and edx, 0xff
mov dword [0x4082bd], eax
xor eax, eax
mov al, dl
mov byte [0x4082b6], dl
mov dword [0x4082c1], eax
mov eax, dword [0x4082bd]
mov edx, dword [0x4082c1]
shl eax, 8
or eax, edx
mov dword [0x4082c5], eax
cmp byte [0x4082b5], 4
jae 0x401b37
mov eax, 0x4019a8
push eax
xor edx, edx
push 0x4019d5
mov dword [0x4082b1], edx
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov edx, eax
test eax, eax
je 0x401aca
call edx
mov dword [0x4082b1], eax
push 0x104
push 0x409050
push 0
mov ebx, 0x208
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
mov edx, 0x409154
xor eax, eax
mov dword [0x408280], 0x409050
call fcn.004033e0
mov dword [0x40828c], 0x409154
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
call fcn.00403480
mov edx, eax
mov bl, byte [eax]
mov dword [0x409044], eax
cmp bl, 0x22
je 0x401b41
xor edx, edx
mov dl, byte [eax]
test byte [edx + 0x4034c1], 2
je 0x401b59
xor edx, edx
mov dl, byte [eax]
test byte [edx + 0x4034c1], 2
je 0x401b60
inc eax
jmp 0x401b27
mov eax, 0x4019be
jmp 0x401aa2
inc eax
cmp bl, byte [eax]
je 0x401b51
cmp byte [eax], 0
je 0x401b51
inc eax
cmp byte [eax], 0x22
jne 0x401b46
cmp byte [eax], 0
je 0x401b27
inc eax
jmp 0x401b27
test dl, dl
je 0x401b27
inc eax
jmp 0x401b1a
mov dword [0x40827c], eax
call dword [sym.imp.KERNEL32.DLL_GetCommandLineW]
test eax, eax
je 0x401bd6
call fcn.004035c1
mov edx, eax
mov bx, word [eax]
mov dword [0x409048], eax
cmp bx, 0x22
je 0x401ba9
xor eax, eax
mov ax, word [edx]
call fcn.004035e8
test eax, eax
je 0x401bcb
xor eax, eax
mov ax, word [edx]
call fcn.004035e8
test eax, eax
je 0x401bdb
add edx, 2
jmp 0x401b96
lea edx, [eax + 2]
cmp bx, word [edx]
je 0x401bc0
cmp word [edx], 0
je 0x401bc0
add edx, 2
cmp word [edx], 0x22
jne 0x401bb1
cmp word [edx], 0
je 0x401b96
add edx, 2
jmp 0x401b96
cmp word [edx], 0
je 0x401b96
add edx, 2
jmp 0x401b88
mov edx, 0x4019e2
mov dword [0x408288], edx
test edi, edi
jne 0x401bee
mov eax, 1
pop edi
pop esi
pop ecx
ret
push 0x104
push 0x40935c
push esi
mov ebx, 0x208
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
mov edx, 0x409460
mov eax, esi
mov dword [0x408284], 0x40935c
call fcn.004033e0
mov dword [0x408290], 0x409460
mov eax, 1
pop edi
pop esi
pop ecx
ret

Function at 0x404c20
Capabilities:
Terminate process

Disassembly:
push edx
push ebp
mov ebp, esp
mov eax, dword [0x40829c]
add eax, 3
and al, 0xfc
mov edx, dword [0x40829c]
sub esp, eax
mov eax, esp
add eax, edx
mov dword [0x4082a0], eax
call fcn.00405f20
mov edx, dword [0x409798]
mov eax, dword [0x409794]
call fcn.004014b0
jmp fcn.004016e9
Function at 0x405c30
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push edx
push 0x40
push 0x1000
mov edx, dword [eax]
push edx
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
pop edx
pop ecx
ret

Function at 0x405e40
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
push edi
push ebp
sub esp, 8
mov esi, eax
mov ebp, edx
mov edi, ebx
test eax, eax
jl 0x405ed4
cmp eax, dword [0x4082f4]
jae 0x405ed4
call fcn.004031e0
mov edx, eax
mov dword [esp + 4], eax
mov eax, esi
xor ebx, ebx
call fcn.00404f10
test al, 0x80
je 0x405e98
mov eax, esi
call dword [0x408218]
push 2
push 0
push 0
push edx
mov ebx, 1
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
cmp eax, 0xffffffff
je 0x405ee8
push 0
lea eax, [esp + 4]
push eax
push edi
push ebp
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
jne 0x405ef2
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
cmp ebx, 1
jne 0x405ec5
mov eax, esi
call dword [0x40821c]
mov eax, edx
call fcn.00406480
add esp, 8
pop ebp
pop edi
pop esi
pop ecx
ret
call dword [0x40825c]
mov dword [eax + 4], 4
mov eax, 0xffffffff
jmp 0x405ecc
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
jmp 0x405ebd
cmp edi, dword [esp]
je 0x405f04
call dword [0x40825c]
mov dword [eax + 4], 0xc
cmp ebx, 1
jne 0x405f11
mov eax, esi
call dword [0x40821c]
mov eax, dword [esp]
add esp, 8
pop ebp
pop edi
pop esi
pop ecx
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403e6a
nop
nop
sub eax, 0x403e10
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x431030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43101e
nop
popal
nop
nop
nop
nop
jmp loc.00401219