joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10cb30b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push 0x1012fbc
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10cb363
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x1009aca
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10cb356
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x10cb365
xor eax, eax
pop esi
leave
ret 4

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x43d60b
Capabilities:
Terminate process

Disassembly:
call fcn.0043d618
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4040d0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x418f5c]
xor eax, ebp
mov dword [ebp - 0xc], eax
push 0
lea eax, [ebp - 0x228]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.LZ32.dll_LZOpenFileA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x40414d
push 0x100
push str._____Cannot_open_file
lea edx, [ebp - 0x1a0]
push edx
call fcn.00404a50
add esp, 0xc
push 0x100
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x1a0]
push ecx
call fcn.004049d0
add esp, 0xc
push 0x418e10
lea edx, [ebp - 0x1a0]
push edx
call fcn.00404bb0
add esp, 8
mov eax, 1
jmp 0x4041e1
push 0x1000
lea eax, [ebp - 0x98]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call sub.LZ32.dll_LZOpenFileA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4041c0
push 0x100
push str._____Cannot_create_file
lea edx, [ebp - 0x1a0]
push edx
call fcn.00404a50
add esp, 0xc
push 0x100
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x1a0]
push ecx
call fcn.004049d0
add esp, 0xc
push str.Setup
lea edx, [ebp - 0x1a0]
push edx
call fcn.00404bb0
add esp, 8
mov eax, dword [ebp - 8]
push eax
call sub.LZ32.dll_LZClose
mov eax, 1
jmp 0x4041e1
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
push edx
call sub.LZ32.dll_LZCopy
mov eax, dword [ebp - 8]
push eax
call sub.LZ32.dll_LZClose
mov ecx, dword [ebp - 4]
push ecx
call sub.LZ32.dll_LZClose
xor eax, eax
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00404c6e
mov esp, ebp
pop ebp
ret

Function at 0x404ae0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], 0
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
mov edx, dword [str.SOFTWAREDislin]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x404ba1
mov eax, dword [ebp + 8]
push eax
call fcn.00404f10
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
push 1
push 0
push str.Path
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x404b5b
mov dword [ebp - 8], 1
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00404f10
add esp, 4
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 1
push 0
push str.Version
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x404b95
mov dword [ebp - 8], 1
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x404ba8
mov dword [ebp - 8], 1
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x404c6e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x418f5c]
jne 0x404c78
repz ret
jmp fcn.00405689
Function at 0x408b2c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x418f5c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040578f
and dword [ebp - 0x14], 0
cmp dword [0x41b5b8], 0
mov dword [ebp - 0x18], eax
jne 0x408bdf
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x408c87
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x408c87
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x41b5b8], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x41b5bc], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x41b5c0], eax
call edi
push eax
call esi
mov dword [0x41b5c8], eax
test eax, eax
je 0x408bdf
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x41b5c4], eax
mov eax, dword [0x41b5c4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x408c38
cmp dword [0x41b5c8], ecx
je 0x408c38
push eax
call esi
push dword [0x41b5c8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x408c38
test ebx, ebx
je 0x408c38
call edi
test eax, eax
je 0x408c2f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x408c2f
test byte [ebp - 8], 1
jne 0x408c38
or dword [ebp + 0x10], 0x200000
jmp 0x408c6b
mov eax, dword [0x41b5bc]
cmp eax, dword [ebp - 0x18]
je 0x408c6b
push eax
call esi
test eax, eax
je 0x408c6b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x408c6b
mov eax, dword [0x41b5c0]
cmp eax, dword [ebp - 0x18]
je 0x408c6b
push eax
call esi
test eax, eax
je 0x408c6b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x41b5b8]
call esi
test eax, eax
je 0x408c87
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x408c89
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404c6e
leave
ret
Function at 0x407220
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x473198
mov eax, dword fs:[0]
push eax
sub esp, 0x410
mov eax, dword [0x492bec]
xor eax, esp
mov dword [esp + 0x40c], eax
push edi
mov eax, dword [0x492bec]
xor eax, esp
push eax
lea eax, [esp + 0x418]
mov dword fs:[0], eax
lea eax, [esp + 0x10]
push eax
call sub.HZDKernel.dll_public:_static_class_ATL::CStringT_char__class_StrTraitMFC_DLL_char__class_ATL::ChTraitsCRT_char______cdecl_HZD::Kernel::Helper::CBaseHelper::BinPath_void_
push eax
lea ecx, [esp + 0x14]
push ecx
mov edi, str.Config.ini
mov dword [esp + 0x42c], 0
call fcn.00407810
mov eax, dword [eax]
add esp, 0xc
push eax
push 0x400
lea edx, [esp + 0x1c]
push edx
push 0x47ee18
push str.Flag
push str.ShutDown
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [esp + 0xc]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [esp + 0x10]
mov dword [esp + 0x420], 0xffffffff
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0xc]
call dword [sym.imp.mfc90.dll_Ordinal_310]
push 0x4812a4
lea ecx, [esp + 0xc]
mov dword [esp + 0x424], 1
call dword [sym.imp.mfc90.dll_Ordinal_1603]
test eax, eax
jne 0x407316
mov eax, dword [esi + 0x458]
cmp dword [eax + 0x1c], 0
jg 0x4072fe
xor eax, eax
jmp 0x407303
mov ecx, dword [eax + 0x18]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
push 0
push 0
push 0x822
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [esp + 8]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [esp + 0x418]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [esp + 0x40c]
xor ecx, esp
call fcn.0046d6fc
add esp, 0x41c
ret

Function at 0x4094e0
Capabilities:
Hide graphical window

Disassembly:
cmp dword [esi + 8], 0x80000000
mov eax, dword [eax + 0xc]
mov dword [esi + 0x20], eax
jae 0x40957e
mov ecx, dword [esi + 4]
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetWindowLongA]
push edi
push 0xffffffffffffffec
push ecx
call ebx
mov edx, dword [esi + 4]
xor eax, 0x80000
push eax
push 0xffffffffffffffec
push edx
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov eax, dword [esi + 4]
push 4
push eax
mov dword [esi + 0xc], 1
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [esi + 0xc], 0
mov edi, dword [esi + 4]
jne 0x409553
push 0
push 0xffffffffffffffec
push edi
call ebx
xor eax, 0x80000
push eax
push 0
push edi
call sub.mfc90.dll_Ordinal_4517
mov dword [esi + 0xc], 1
cmp dword [esi + 0xc], 0
je 0x409563
movzx ecx, byte [esi + 0x10]
push 2
push ecx
push 0
push edi
call dword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
mov edx, dword [esi + 4]
push 0
push 0x32
push 2
push edx
call dword [sym.imp.USER32.dll_SetTimer]
pop edi
mov eax, 1
pop ebx
mov dword [esi + 0x1c], eax
ret
push 0
push eax
mov eax, dword [esi + 4]
push 1
push eax
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, 1
mov dword [esi + 0x1c], eax
ret
Function at 0x4098e0
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
cmp eax, 0xa
jne 0x409959
add dword [esi + 8], 0xfffffffb
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 8]
sub ecx, dword [esi + 0xc]
cmp eax, dword [esi + 4]
push 0x51
jg 0x40993a
mov eax, dword [esi + 0x18]
sub eax, dword [esi + 0x10]
mov edx, dword [esi + 0x10]
push eax
mov eax, dword [esi + 0xc]
push ecx
mov ecx, dword [esi]
push edx
push eax
push 0xffffffffffffffff
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov edx, dword [esi]
push 0xa
push edx
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi]
push 0
push eax
push 0xc
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, 1
pop esi
ret
mov edx, dword [esi + 0x18]
sub edx, dword [esi + 0x10]
push edx
mov edx, dword [esi + 0xc]
push ecx
push eax
mov eax, dword [esi]
push edx
push 0xffffffffffffffff
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, 1
pop esi
ret
cmp eax, 0xc
jne 0x409972
call fcn.004099d0
mov ecx, dword [esi]
push 0xc
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
xor eax, eax
pop esi
ret
cmp eax, 0xb
jne 0x4099cc
add dword [esi + 8], 5
mov eax, dword [esi + 8]
cmp eax, dword [esi + 4]
jl 0x4099ac
mov edx, dword [esi]
push 0xb
push edx
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi]
push 0
push 0
push 0x10
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
xor eax, eax
pop esi
ret
mov edx, dword [esi + 0x18]
sub edx, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
sub ecx, dword [esi + 0xc]
push 0x51
push edx
mov edx, dword [esi + 0xc]
push ecx
push eax
mov eax, dword [esi]
push edx
push 0xffffffffffffffff
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
xor eax, eax
pop esi
ret

Function at 0x40a560
Capabilities:
Hide graphical window

Disassembly:
push ebp
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x30]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [edi + 0x60]
mov ebp, dword [sym.imp.USER32.dll_IsWindow]
mov esi, dword [sym.imp.USER32.dll_KillTimer]
test eax, eax
je 0x40a5aa
push eax
call ebp
test eax, eax
je 0x40a5aa
mov ecx, dword [edi + 0x60]
push 0xb
push ecx
call esi
mov edx, dword [edi + 0x60]
push 0xa
push edx
call esi
mov eax, dword [edi + 0x60]
push 0xc
push eax
call esi
mov dword [edi + 0x60], 0
mov eax, dword [edi + 0x40]
test eax, eax
je 0x40a5de
push eax
call ebp
test eax, eax
je 0x40a5de
mov ecx, dword [edi + 0x40]
push 2
push ecx
mov dword [edi + 0x58], 0
call esi
mov edx, dword [edi + 0x40]
push 1
push edx
call esi
mov eax, dword [edi + 0x40]
push 3
push eax
call esi
mov dword [edi + 0x40], 0
mov esi, dword [edi + 0x34]
test esi, esi
je 0x40a5ee
mov ecx, dword [edi + 0x30]
push ecx
call fcn.0040a1e0
pop edi
pop esi
mov eax, 1
pop ebp
ret
Function at 0x40ac40
Capabilities:
Read file via mapping

Disassembly:
sub esp, 0x128
mov eax, dword [0x492bec]
xor eax, esp
mov dword [esp + 0x124], eax
push ebp
push esi
push edi
push 0x104
lea eax, [esp + 0x10]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp byte [esp + 0xc], 0
lea esi, [esp + 0xc]
je 0x40ac82
cmp byte [esi], 0x5c
jne 0x40ac7c
mov byte [esi], 0x2f
inc esi
cmp byte [esi], 0
jne 0x40ac74
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str._04d
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
push 4
xor ebp, ebp
push ebp
push 4
push ebp
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edi, eax
test edi, edi
je 0x40ad40
push ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 4
push ebp
push ebp
xor ebx, ebx
push 0xf001f
cmp eax, 0xb7
push edi
sete bl
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
jne 0x40ad00
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebp
pop ebx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x124]
xor ecx, esp
call fcn.0046d6fc
add esp, 0x128
ret
test ebx, ebx
je 0x40ad18
mov ebx, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x40ace7
push 8
call sub.mfc90.dll_Ordinal_798
add esp, 4
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [edi], eax
mov dword [edi + 4], 0xfffffffc
push esi
mov dword [esi], edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, edi
jmp 0x40ace7
mov ecx, dword [esp + 0x130]
pop edi
pop esi
mov eax, ebp
pop ebp
xor ecx, esp
call fcn.0046d6fc
add esp, 0x128
ret
Function at 0x40ce00
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0xd4]
sub esp, 0x10
push ebx
push esi
push ecx
lea ecx, [esp + 0xc]
call sub.mfc90.dll_Ordinal_321
mov esi, dword [ebp + 0xc]
cmp dword [esi + 4], 0x100
mov ebx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
jne 0x40ce65
push 0x74
call ebx
test ax, ax
jge 0x40ce65
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40ce48
mov edx, dword [esp + 8]
mov dword [eax + 4], edx
cmp dword [esp + 0x14], 0
je 0x40ce5b
mov eax, dword [esp + 0x10]
push eax
push 0
call sub.mfc90.dll_Ordinal_1087
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x40ced7
cmp dword [esi + 4], 0x100
jne 0x40ced7
push 0x4f
call ebx
test ax, ax
jge 0x40ce92
mov byte [0x494014], 1
jmp 0x40ce39
cmp dword [esi + 4], 0x100
jne 0x40ced7
push 0x53
call ebx
test ax, ax
jge 0x40ced7
mov eax, dword [esp + 0xc]
mov byte [0x494014], 0
test eax, eax
je 0x40ceba
mov ecx, dword [esp + 8]
mov dword [eax + 4], ecx
cmp dword [esp + 0x14], 0
je 0x40ce5b
mov edx, dword [esp + 0x10]
push edx
push 0
call sub.mfc90.dll_Ordinal_1087
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40cee6
mov ecx, dword [esp + 8]
mov dword [eax + 4], ecx
cmp dword [esp + 0x14], 0
je 0x40cef9
mov edx, dword [esp + 0x10]
push edx
push 0
call sub.mfc90.dll_Ordinal_1087
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40f5d0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [ecx + 4]
test eax, eax
jne 0x40f5da
ret 0xc
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
mov eax, dword [esp + 0x10]
push eax
push ecx
push edx
call dword [sym.imp.MSVCR90.dll_fread]
add esp, 0x10
ret 0xc

Function at 0x40f600
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [ecx + 4]
test eax, eax
jne 0x40f60a
ret 0xc
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
mov eax, dword [esp + 0x10]
push eax
push ecx
push edx
call dword [sym.imp.MSVCR90.dll_fwrite]
add esp, 0x10
ret 0xc

Function at 0x4112a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4896f8
push 0x46df11
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x492bec]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, edx
push 0x1c
lea eax, [ebp - 0x34]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov dword [ebp - 4], 0
mov edx, 0x5a4d
mov ecx, dword [ebp - 0x30]
cmp word [ecx], dx
jne 0x411342
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x411342
mov edx, dword [eax + 0xd8]
lea edi, [edx + ecx]
cmp esi, edi
jb 0x411342
mov eax, dword [eax + 0xdc]
add eax, edx
add eax, ecx
cmp esi, eax
jae 0x411342
mov dword [ebp - 4], 0xfffffffe
mov al, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xfffffffe
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4113e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [0x49401c]
test esi, esi
je 0x41140a
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 8]
push eax
push 0x40
push 0x10000
push esi
call edi
mov esi, dword [esi + 4]
test esi, esi
jne 0x4113f3
pop edi
pop esi
pop ecx
ret
Function at 0x4117f0
Capabilities:
Resume thread

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x494028], eax
je 0x411806
mov eax, 0x10dd
pop ecx
ret
push ebx
push ebp
push esi
mov esi, dword [0x494038]
xor ebp, ebp
push edi
cmp esi, ebp
je 0x411881
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [esp]
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
lea eax, [esp + 0x10]
push eax
movzx eax, byte [edx + 0x17]
push ecx
mov ecx, dword [esi + 0xc]
push eax
push ecx
call ebx
cmp dword [esi + 4], ebp
jne 0x411870
mov eax, dword [esi + 0x10]
cmp eax, ebp
je 0x411870
mov edx, eax
and edx, 0xffff0000
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 0x18], ecx
mov dword [edx + 8], eax
mov dword [esi + 0x10], ebp
mov edi, dword [esi]
push esi
call sub.mfc90.dll_Ordinal_800
add esp, 4
mov esi, edi
cmp edi, ebp
jne 0x411820
mov dword [0x494038], ebp
call fcn.00411410
mov esi, dword [0x494034]
cmp esi, ebp
je 0x4118b7
mov ebx, dword [sym.imp.KERNEL32.dll_ResumeThread]
lea esp, [esp]
mov edx, dword [esi + 4]
push edx
call ebx
mov edi, dword [esi]
push esi
call sub.mfc90.dll_Ordinal_800
add esp, 4
mov esi, edi
cmp edi, ebp
jne 0x4118a0
pop edi
pop esi
mov dword [0x494034], ebp
mov dword [0x494028], ebp
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x411bb0
Capabilities:
Suspend thread

Disassembly:
mov eax, dword [0x49402c]
test eax, eax
jne 0x411c2c
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edi, dword [esp + 8]
cmp edi, eax
jne 0x411bce
xor eax, eax
pop edi
ret 4
push esi
push 8
call sub.mfc90.dll_Ordinal_798
mov esi, eax
add esp, 4
test esi, esi
jne 0x411be4
lea edi, [eax + 8]
jmp 0x411c01
push edi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x411c18
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call sub.mfc90.dll_Ordinal_800
add esp, 4
pop esi
mov dword [0x49402c], edi
mov eax, edi
mov dword [0x494030], 0
pop edi
ret 4
mov eax, dword [0x494034]
mov dword [esi + 4], edi
mov dword [esi], eax
mov dword [0x494034], esi
pop esi
xor eax, eax
pop edi
ret 4
Function at 0x411c30
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
jmp 0x411c40
sub esp, 0x10
push ebx
push edi
xor edi, edi
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x494028], eax
je 0x411c64
pop edi
mov eax, 0x10dd
pop ebx
add esp, 0x10
ret 8
mov eax, dword [0x49402c]
cmp eax, edi
jne 0x411e82
mov eax, dword [esp + 0x1c]
cmp eax, edi
jne 0x411c86
pop edi
mov eax, 6
pop ebx
add esp, 0x10
ret 8
push esi
mov esi, dword [eax]
cmp esi, edi
jne 0x411caa
pop esi
pop edi
mov dword [0x494030], eax
mov dword [0x49402c], 6
mov eax, 6
pop ebx
add esp, 0x10
ret 8
push ebp
mov dword [esp + 0x10], edi
call fcn.00411750
mov esi, dword [esp + 0x28]
mov ebp, eax
call fcn.00411750
mov dword [esp + 0x28], eax
cmp eax, ebp
jne 0x411cd8
cmp dword [0x494024], ebx
jne 0x411e18
jmp 0x411df6
push 0x18
call sub.mfc90.dll_Ordinal_798
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
jne 0x411cf2
lea ebx, [eax + 8]
jmp 0x411df6
mov eax, ebp
call fcn.00411440
mov edi, eax
test edi, edi
jne 0x411d07
lea ebx, [eax + 8]
jmp 0x411df6
mov esi, ebp
xor ebx, ebx
jmp 0x411d10
lea eax, [ebx + edi]
push eax
lea edx, [esp + 0x18]
mov ecx, esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x18], 0
call fcn.00411fc0
cmp dword [esp + 0x14], 0
mov esi, eax
jne 0x411d59
mov ecx, dword [esp + 0x1c]
mov ebx, esi
sub ebx, ebp
call fcn.00411390
test eax, eax
jne 0x411d59
cmp ebx, 5
jl 0x411d10
cmp ebx, 0x12
jbe 0x411d75
mov ebx, 6
jmp 0x411df6
cmp ebx, 5
jge 0x411d4a
cmp dword [0x494024], 0
mov ebx, 9
jne 0x411dfc
jmp 0x411df6
mov ecx, dword [esp + 0x28]
mov dword [edi + 0x1c], ecx
lea ecx, [ebx + edi]
lea edx, [ebx + ebp]
mov dword [edi + 0x18], edx
lea eax, [edi + 0x17]
lea esi, [ecx + 5]
mov byte [eax], bl
mov byte [ecx], 0xe9
inc ecx
sub edx, esi
mov dword [ecx], edx
add ecx, 4
call fcn.00411360
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea edx, [esp + 0x18]
push edx
push 0x40
push ebx
push ebp
mov dword [esp + 0x28], 0
call esi
test eax, eax
je 0x411dee
mov ecx, ebp
call fcn.004116a0
mov ebx, eax
test ebx, ebx
je 0x411e52
mov eax, 0x6544
cmp word [ebx + 0x1c], ax
je 0x411e52
lea ecx, [esp + 0x28]
push ecx
push 0x40
push 0x40
push ebx
mov dword [esp + 0x38], 0
call esi
test eax, eax
jne 0x411e2e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [0x49402c], ebx
test edi, edi
je 0x411e07
mov eax, edi
call fcn.00411670
mov eax, dword [esp + 0x10]
test eax, eax
je 0x411e18
push eax
call sub.mfc90.dll_Ordinal_800
add esp, 4
mov edx, dword [esp + 0x24]
pop ebp
pop esi
pop edi
mov eax, ebx
mov dword [0x494030], edx
pop ebx
add esp, 0x10
ret 8
mov eax, 0x6544
mov word [ebx + 0x1c], ax
mov ecx, 0x6f74
mov edx, 0x7275
mov eax, 0x2173
mov word [ebx + 0x1e], cx
mov word [ebx + 0x20], dx
mov word [ebx + 0x22], ax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x24]
mov dword [eax + 8], ecx
mov ecx, dword [0x494038]
mov dword [eax + 0xc], ebp
mov dword [eax + 4], 0
mov dword [eax + 0x10], edi
mov edx, dword [esp + 0x18]
pop ebp
mov dword [eax + 0x14], edx
mov dword [eax], ecx
mov dword [0x494038], eax
xor eax, eax
pop esi
pop edi
pop ebx
add esp, 0x10
ret 8