joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c090
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.0041bdf0
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.0041bdf0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x40c0f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x50306c]
test esi, esi
jle 0x40c210
mov eax, dword [0x503070]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x40c124
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x40c1a7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x40c110
mov dword [esp], ebx
call fcn.0040caf0
mov edi, eax
test eax, eax
je 0x40c237
mov eax, dword [0x503070]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.0040cc30
mov edx, dword [0x503070]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x40c217
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x40c1a0
lea edx, [eax - 0x40]
and edx, 0xffffffbf
jne 0x40c1b0
add dword [0x50306c], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x503070]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x40c1a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.0040c090
lea esi, cs:[esi]
nop
xor esi, esi
jmp 0x40c12e
mov eax, dword [0x503070]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.0040c090
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.0040c090
lea esi, cs:[esi]
nop
Function at 0x40c760
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x503088
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x503080]
sub esp, 4
test ebx, ebx
je 0x40c7b5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
mov esi, eax
sub esp, 4
call edi
test esi, esi
je 0x40c7ae
test eax, eax
jne 0x40c7ae
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x40c790
mov dword [esp], 0x503088
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40caf0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x40cb15
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x40cb20
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x40cb15
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x40cb68
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x40cb5e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40cb6a
add ecx, 1
add eax, 0x28
cmp esi, ecx
jne 0x40cb50
xor eax, eax
pop ebx
pop esi
ret
Function at 0x4121b0
Capabilities:
Allocate thread local storage
Create thread
Resume thread

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [0x4b6018]
mov ebp, dword [esp + 0x40]
mov edi, dword [esp + 0x44]
mov esi, dword [esp + 0x48]
test ebx, ebx
je 0x4121db
mov ecx, dword [0x4b602c]
test ecx, ecx
je 0x412260
mov dword [esp], 0xc
call sub.msvcrt.dll_malloc
mov dword [eax], edi
mov ebx, eax
mov dword [eax + 4], esi
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x412170
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
sub esp, 0x18
mov dword [ebx + 8], eax
test eax, eax
je 0x412248
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [ebx + 8]
sub esp, 4
mov dword [ebp], eax
add esp, 0x2c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], ebx
call fcn.0041c468
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
lock add dword [0x4b6030], 1
jne 0x4122a8
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x4122e0
mov dword [esp + 4], fcn.0041c468
mov dword [esp], eax
mov dword [0x4b6034], eax
call fcn.0041c5d0
test eax, eax
jne 0x4af72c
mov dword [0x4b602c], 1
jmp 0x4121db
mov edx, dword [0x4b602c]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
test edx, edx
jne 0x4121db
lea esi, [esi]
mov dword [esp], 0
call ebx
mov eax, dword [0x4b602c]
sub esp, 4
test eax, eax
je 0x4122c0
jmp 0x4121db
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x41228a
Function at 0x41f660
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ecx, 0x1a
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x80]
mov esi, 0x4b9485
push ebx
sub esp, 0x9c
mov eax, dword [0x4b9484]
mov dword [ebp - 0x81], eax
mov eax, dword [0x4b94e9]
mov dword [ebp - 0x1c], eax
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp + 8]
lea eax, [edx + 0x84]
and eax, 0xfffffff0
call fcn.0040cdc0
mov ecx, 0x1a
sub esp, eax
lea esi, [ebp - 0x81]
mov dword [ebp - 0x8c], edx
lea ebx, [esp + 0x1b]
and ebx, 0xfffffff0
mov edi, ebx
lea eax, [ebx + 0x68]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 8]
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 4], ecx
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0x8c]
mov byte [ebx + edx + 0x68], 0
mov dword [esp], ebx
call fcn.004ae070
nop
nop
nop
nop
nop
nop
nop
push edi
push esi
push ebx
sub esp, 0x20
cmp byte [0x4b7dc4], 0
jne 0x41f786
mov byte [0x4b7dc4], 1
call fcn.004ac200
test eax, eax
je 0x41f754
mov ebx, dword [eax + 4]
xor eax, eax
cmp byte [ebx], 0x2a
mov dword [esp + 8], 0
sete al
mov dword [esp + 4], 0
add ebx, eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call fcn.0040bca0
mov dword [esp], 2
mov esi, dword [fcn.0041bdf0]
mov edi, eax
call esi
mov dword [esp + 8], 0x30
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_after_throwing_an_instance_of_
call sub.msvcrt.dll_fwrite
mov edx, dword [esp + 0x1c]
mov dword [esp], 2
test edx, edx
je 0x41f744
call esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
mov dword [esp], 2
call esi
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x4b81b9
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x4ad26c
jmp 0x4ad264
call esi
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
jmp 0x41f70a
mov dword [esp], 2
call dword [0x4b6218]
mov dword [esp + 8], 0x2d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_without_an_active_exception_n
call sub.msvcrt.dll_fwrite
jmp 0x4ad25f
mov dword [esp], 2
call dword [0x4b6218]
mov dword [esp + 8], 0x1d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_recursively_n
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
push ebx
mov ebx, ecx
sub esp, 0x18
mov dword [ecx], 0x4c1164
call fcn.004a6090
mov dword [esp], ebx
mov dword [esp + 4], 4
call fcn.004abfb0
add esp, 0x18
pop ebx
ret
Function at 0x474d20
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x1c
mov edi, dword [esp + 0x30]
mov esi, dword [esp + 0x34]
mov eax, dword [ebx]
mov dword [esp], eax
call sub.msvcrt.dll__fileno_1
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.msvcrt.dll__read
mov ebp, eax
cmp eax, 0xffffffff
je 0x474d60
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 8
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 4
je 0x474d31
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x44d960
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x44d98d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x44d98d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x2095058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.020951a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x209507e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x209506a
add dl, dl
jne 0x2095089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x20950dc
xor eax, eax
add dl, dl
jne 0x2095096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x209517d
add dl, dl
jne 0x20950a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x20950b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x20950bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x20950c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x20950d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x2095075
mov eax, 1
add dl, dl
jne 0x20950ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x20950f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x20950e1
sub eax, ebx
mov ebx, 1
jne 0x2095128
mov ecx, 1
add dl, dl
jne 0x209510e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x2095119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x2095105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x2095075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x209513f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x209514a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x2095136
cmp eax, 0x7d00
jae 0x209516d
cmp eax, 0x500
jb 0x2095168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x2095075
cmp eax, 0x7f
ja 0x2095170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x2095075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x209519e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x2095075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x17705d9
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x1713748
je 0x1741687
pop esi
add esi, 4
add dword [ebp - 4], 1
jmp 0x17532e2
add eax, dword [ebp + 0xc]
movsx edx, di
pop ecx
pop edx
pop edi
cmovs bx, di
xchg esi, esi
pop ebx
movzx esi, ax
pop esi
mov dword [ebp - 4], eax
nop
mov ax, 0x429c
mov eax, dword [ebp - 4]
jmp 0x171c9de
pop esi
cmove ebx, eax
cwd
mov eax, dword [ebp - 4]
neg bh
adc ebx, ecx
shld ecx, esp, 0x1d
shl eax, 1
cmp dx, di
shr edx, 0xf1
clc
add eax, dword [ebp - 0x10]
sub esi, esi
sbb di, bp
sar di, 0x7a
or di, dx
xchg esi, eax
and dh, 0xa4
mov ax, word [esi]
adc dx, si
shl ax, 2
cmovno dx, dx
ror di, 0xcf
btr ebx, ebx
add eax, dword [ebp - 8]
and ecx, esp
neg edx
xchg esi, eax
rcr cx, 0xf9
mov eax, dword [esi]
jmp 0x172d1b8
jae 0x17894ee
xor ax, 0x8320
clc
xor bx, 0xedb8
jmp 0x17894ee
jne 0x174a0a7
pop esi
test ah, dl
cmp dx, dx
sub edi, ebx
jmp 0x176a1e2
stosd dword es:[edi], eax
ror bx, cl
mov dword [ebp - 0xc], eax
rcl al, cl
mov eax, dword [esi]
shl si, 0xb0
test si, si
add eax, dword [ebp + 0xc]
rol bx, 0xd0
cmc
mov dword [ebp - 0x10], eax
xor ax, cx
shl bx, cl
pop esi
sar ax, 0x44
mov dword [ebp - 4], 0
xor ebx, esp
push esi
add ah, 0xb1
mov ebx, ebp
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
xchg edi, eax
sal bh, cl
sub ebx, esi
ror ebx, cl
mov ebx, edi
test cl, 0xc5
push edi
test bp, bx
stc
sub al, al
test si, 0x4899
clc
cmp esp, 0x2baf1648
scasb al, byte es:[edi]
jmp 0x17487e7
jmp 0x174a07d
dec edi
jmp 0x17895d1
push edx
bswap edx
cld
movzx edx, si
sub ecx, ecx
bswap dx
mov edx, edi
movsx dx, dl
dec ecx
mov edx, ecx
xor eax, eax
inc al
rol al, cl
xor ebx, ebx
xchg al, al
lodsb al, byte [esi]
test di, bx
xor al, cl
test cl, bh
cmp ebp, 0x4e550b99
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
cmc
clc
stc
shr bx, 1
rcr ax, 1
jmp 0x174878b
push ebp
mov ebp, esp
cmp dh, 0x5d
shld ax, bx, 0x74
lea esp, [esp - 4]
shl eax, 0xdd
mov dword [ebp - 4], 0
test dl, ch
add ah, 0xd4
add esp, 0xffffffec
bswap ax
bt ax, cx
cmovns ax, sp
push esi
sar ax, 0x90
cmc
xor eax, 0x76b13bf3
push ebx
push edi
add bl, 0x5c
sub di, 0x18e0
push edx
push ecx
add bl, 0x60
mov eax, dword [ebp + 0x10]
bsr si, ax
movzx esi, cx
sub edx, edx
sar esi, 0x8a
xchg edx, eax
adc eax, ebx
rcl al, cl
shld si, bp, 0xd0
mov esi, 0x3c
xor edi, 0x75a924ec
add esi, dword [ebp + 0xc]
cmp di, 0x43c7
mov eax, dword [esi]
btc di, si
add eax, dword [ebp + 0xc]
stc
or esi, ebx
add edi, 0x1ab2e1d
mov esi, dword [eax + 0x78]
dec di
rcl ah, cl
add esi, 0x18
add esi, dword [ebp + 0xc]
sal di, 0x3f
and al, bl
sub ah, al
mov eax, dword [esi]
dec ebx
btc bx, 0xe8
rcr di, 0xa8
mov dword [ebp - 0x14], eax
shl bx, cl
add esi, 4
not al
lea edi, [ebp - 8]
lodsd eax, dword [esi]
rcl bl, 0xb5
add eax, dword [ebp + 0xc]
mov bh, dl
stosd dword es:[edi], eax
movzx ebx, di
cmovp ebx, edx
mov dword [ebp - 8], eax
cwde
lodsd eax, dword [esi]
add eax, dword [ebp + 0xc]
push eax
jmp 0x174a04c
dec dh
jne 0x176a21a
xor ecx, eax
xor edx, ebx
jmp 0x175a0c8
jne 0x176a1f7
not edx
xchg al, al
rcr ax, 0xf5
not ecx
rcl ax, cl
btr ax, 0x62
rcr al, 0xca
mov eax, edx
rol eax, 0x10
mov ax, cx
cmp esp, 0x435f3ebc
bt dx, bp
sar dx, 0x2a
pop edx
cmp edx, eax
jmp 0x17213dd
Function at 0x401a90
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x408044
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [0x40803c]
sub esp, 4
test ebx, ebx
je 0x401adb
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
mov esi, eax
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x401ad4
test esi, esi
je 0x401ad4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401ab0
mov dword [esp], 0x408044
call sub.KERNEL32.dll_LeaveCriticalSection
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x401cc0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
lea esi, [esp + 0x24]
lea ebx, [eax + 0x40]
mov dword [esp + 4], 1
mov dword [esp + 0xc], ebx
mov dword [esp], str.Mingw_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x401d10
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, edx
push esi
mov esi, ecx
push ebx
mov ebx, eax
sub esp, 0x3c
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x401de4
mov eax, dword [esp + 0x28]
cmp eax, 0x40
je 0x401d4e
cmp eax, 4
jne 0x401d70
test esi, esi
je 0x401d62
xor eax, eax
movzx ecx, byte [edi + eax]
mov byte [ebx + eax], cl
add eax, 1
cmp eax, esi
jb 0x401d54
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x20]
lea ebp, [esp + 0x10]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
mov ecx, dword [esp + 0x28]
test esi, esi
je 0x401daf
xor edx, edx
movzx eax, byte [edi + edx]
mov byte [ebx + edx], al
add edx, 1
cmp edx, esi
jb 0x401da1
cmp ecx, 0x40
je 0x401d62
cmp ecx, 4
je 0x401d62
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00401cc0
lea esi, [esi]
Function at 0x403ee0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x52c]
mov esi, 0x40607c
push ebx
push ecx
sub esp, 0x558
call fcn.00401960
mov ecx, 0x145
rep movsd dword es:[edi], dword [esi]
mov dword [esp], str.kernel32.dll
lea esi, [ebp - 0x52c]
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
mov dword [esp + 4], str.VirtualProtect
mov dword [esp], eax
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [ebp - 0x540], eax
mov dword [esp], str.kernel32.dll
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
mov dword [esp + 4], str.CreateThread
mov dword [esp], eax
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [ebp - 0x53c], eax
mov dword [esp], str.kernel32.dll
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
mov dword [esp + 4], str.VirtualAlloc
mov dword [esp], eax
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0x1000
mov dword [esp + 4], 0x514
mov dword [esp], 0
call eax
mov ebx, eax
mov eax, dword [ebp - 0x52c]
sub esp, 0x10
lea edi, [ebx + 4]
mov ecx, ebx
and edi, 0xfffffffc
mov dword [ebx], eax
mov eax, dword [ebp - 0x1c]
sub ecx, edi
sub esi, ecx
add ecx, 0x514
mov dword [ebx + 0x510], eax
lea eax, [ebp - 0x530]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov dword [esp], ebx
mov dword [esp + 0xc], eax
mov edx, dword [ebp - 0x540]
mov dword [esp + 8], 0x40
mov dword [esp + 4], 0x514
call edx
lea eax, [ebp - 0x534]
sub esp, 0x10
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x53c]
mov dword [esp + 8], ebx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call eax
sub esp, 0x18
mov esi, eax
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call sub.KERNEL32.dll_WaitForSingleObject
sub esp, 8
mov dword [esp], esi
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov dword [esp], ebx
mov dword [esp + 8], 0x8000
mov dword [esp + 4], 0
call sub.KERNEL32.dll_VirtualFree
sub esp, 0xc
xor eax, eax
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
Function at 0xe360b0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00e36200
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xe360d6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xe360c2
add dl, dl
jne 0xe360e1
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xe36134
xor eax, eax
add dl, dl
jne 0xe360ee
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xe361d5
add dl, dl
jne 0xe360fd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xe36108
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xe36113
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xe3611e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xe3612a
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xe360cd
mov eax, 1
add dl, dl
jne 0xe36142
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xe3614d
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xe36139
sub eax, ebx
mov ebx, 1
jne 0xe36180
mov ecx, 1
add dl, dl
jne 0xe36166
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xe36171
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xe3615d
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xe360cd
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xe36197
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xe361a2
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xe3618e
cmp eax, 0x7d00
jae 0xe361c5
cmp eax, 0x500
jb 0xe361c0
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xe360cd
cmp eax, 0x7f
ja 0xe361c8
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xe360cd
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xe361f6
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xe360cd
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x10009f10
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x10013064]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x114]
mov byte [ebp - 0x114], 0
push eax
push 0
push 2
push edx
push 0
push ecx
mov dword [esi], 0
mov dword [ebp - 0x228], 0x10e
call dword [sym.imp.ADVAPI32.dll_RegGetValueA]
test eax, eax
je 0x10009f71
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10011be0
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x224]
call fcn.10009a60
test eax, eax
je 0x10009f9e
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.msvcrt.dll__stricmp]
add esp, 8
neg eax
sbb eax, eax
inc eax
mov dword [esi], eax
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop esi
call fcn.10011be0
mov esp, ebp
pop ebp
ret

Function at 0x1000a2f0
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x10013064]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x100133e4], 0
mov dword [ebp - 0x118], 0
jne 0x1000a411
lea eax, [ebp - 0x118]
push eax
push ecx
lea ecx, [ebp - 0x114]
call fcn.10009b70
add esp, 8
test eax, eax
jne 0x1000a38b
push 1
call fcn.10009700
push 0x100133c4
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x100133f0
push 0
push 0
push 0
push 0
push 0x100013d8
push 0
mov dword [0x10013400], 1
push 0x1000a020
mov dword [0x100133e0], 1
call dword [sym.imp.ADVAPI32.dll_RegisterTraceGuidsW]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10011be0
mov esp, ebp
pop ebp
ret
cmp dword [0x100133e8], 0
lea eax, [ebp - 0x114]
mov dword [0x10013058], eax
mov byte [ebp - 7], 0
jne 0x1000a3ad
mov dword [0x100133e8], 0xfff
cmp dword [0x100133e4], 0
jne 0x1000a3d0
mov ecx, 0x23fa
call fcn.10009810
cmp dword [0x10013070], 0xffffffff
jne 0x1000a3d0
push 1
call fcn.10009700
cmp dword [0x10013008], 0x10009500
jne 0x1000a407
cmp dword [ebp - 0x118], 0
je 0x1000a407
push 0x100022e4
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push dword [0x10013058]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x100022ec
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [0x10013058], 0x10002304
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.10011be0
mov esp, ebp
pop ebp
ret