joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004377
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x10004386
pop dword [ebp - 0x18]
mov eax, 0x4e666c43
sub eax, 0x3e6628bd
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0xaead2475
add dword [ebp - 0x28], 0x9fa520d6
mov dword [ebp - 0x24], 0x7c800d80
sub dword [ebp - 0x24], 0x4a4cc13b
mov dword [ebp - 0x20], 0x65e2bae
sub dword [ebp - 0x20], 0xba11e780
mov dword [ebp - 0x1c], 0xe059a89d
sub dword [ebp - 0x1c], 0xe059a89d
lea eax, [ebp - 0x28]
push eax
mov eax, 0xc49d3920
add eax, 0x4b631738
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x823a5b63
add dword [ebp - 0x28], 0xf2380df3
mov dword [ebp - 0x24], 0x43d4a28e
add dword [ebp - 0x24], 0xfd97bee7
mov dword [ebp - 0x20], 0x2a80f233
add dword [ebp - 0x20], 0x38ee7a39
mov dword [ebp - 0x1c], 0x41ff6c29
add dword [ebp - 0x1c], 0xbe0093d7
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x36a80
push 0
call eax
mov ecx, 0x486e
mov edi, eax
mov edx, 0x1000a800
add edx, dword [ebp - 0x18]
mov esi, 0x139ab84d
xor dword [ebp - 0xc], 0x1a1412c9
mov ebx, dword [edx]
add dword [ebp - 0xc], ebx
add ebx, esi
mov dword [edi], ebx
sub dword [ebp - 0x10], 0x11b4ad1e
add edi, 4
add edx, 0xd61f0663
add edx, 0x29e0f9a1
loop 0x10004491
add eax, 0xac95d140
sub eax, 0xac94bcb5
mov ebx, eax
add eax, 5
mov ecx, 0xa963ca75
sub ecx, 0x9963ca75
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0xf45678
Capabilities:
Encode data using xor

Disassembly:
mov word [esp + 4], di
call fcn.019bb6ca
push ds
cmp cl, byte [ebx + 0x133d892f]
wait
mov bh, 0x98
cmc
mov byte [0xe59cd45f], al
mov dl, 1
push es
invalid
Function at 0x401aa1
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401ae0
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401ae0
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401ae0
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401ae0
cmp dword [ecx + 0x74], 0xe
jbe 0x401ae0
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x40abc0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40abed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40abed
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x401dca
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x401dd9
pop dword [ebp - 0x24]
mov eax, 0x401dd9
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x6ab04866
sub dword [ebp - 0x34], 0x1c5e031b
mov dword [ebp - 0x30], 0xf3569e69
add dword [ebp - 0x30], 0x3edcaddc
mov dword [ebp - 0x2c], 0xa296908
add dword [ebp - 0x2c], 0x4222db26
mov dword [ebp - 0x28], 0x4c115539
add dword [ebp - 0x28], 0xb3eeaac7
lea eax, [ebp - 0x34]
push eax
mov eax, 0x974799b1
add eax, 0x68fa96c3
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x649c323e
add dword [ebp - 0x34], 0xfd63718
mov dword [ebp - 0x30], 0x4089f7f3
sub dword [ebp - 0x30], 0xff1d967e
mov dword [ebp - 0x2c], 0xf4d565b2
add dword [ebp - 0x2c], 0x6e9a06ba
mov dword [ebp - 0x28], 0x33b6f487
sub dword [ebp - 0x28], 0x33b6f487
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0xff013d6a
sub eax, 0xfebf0c46
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x41260
push 0
call eax
mov ecx, 0x118c1324
add ecx, 0xee744299
xor ebx, ebx
add ebx, eax
mov esi, 0x434400
add esi, dword [ebp - 0x24]
mov edx, 0x43d7a3b8
add edx, 0x1e3d938e
sub dword [ebp - 0x20], 0x89e87a36
mov edi, dword [esi]
xor dword [ebp - 0x14], eax
sub edi, edx
sub dword [ebp - 0x10], 0x85224e8a
mov dword [ebx], edi
sub dword [ebp - 0x14], edx
add ebx, 0xf7ad4082
sub ebx, 0xf7ad407e
add esi, 0xaa668153
sub esi, 0xaa66814f
loop 0x401ef2
add eax, 0x149c7
xor ebx, ebx
add ebx, eax
add eax, 0xf9c92605
sub eax, 0xf9c92600
mov ecx, 0x400000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c
Function at 0x463828
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00405848
mov eax, dword [ebp - 8]
call fcn.00405848
xor eax, eax
push ebp
push 0x463932
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 1
call sub.kernel32.dll_Sleep_2
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x3c
call fcn.00403aec
push 1
call sub.kernel32.dll_Sleep_2
mov dword [ebp - 0x44], 0x3c
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x40], 0x540
cmp byte [0x48ec14], 0
je 0x46389e
xor eax, eax
mov dword [ebp - 0x38], eax
jmp 0x4638a6
mov eax, 0x463944
mov dword [ebp - 0x38], eax
push 1
call sub.kernel32.dll_Sleep_2
lea ecx, [ebp - 0x48]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004637a0
mov eax, dword [ebp - 0x48]
call fcn.00405d34
mov dword [ebp - 0x34], eax
push 1
call sub.kernel32.dll_Sleep_2
lea ecx, [ebp - 0x4c]
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.004637a0
mov eax, dword [ebp - 0x4c]
call fcn.00405d34
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], 1
lea eax, [ebp - 0x44]
push eax
call sub.shell32.dll_ShellExecuteExW
test eax, eax
je 0x46390a
push 1
call sub.kernel32.dll_Sleep_2
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetProcessId
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463939
lea eax, [ebp - 0x4c]
mov edx, 2
call fcn.00405bbc
lea eax, [ebp - 8]
mov edx, 2
call fcn.004053ec
ret

Function at 0x46395c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405848
xor eax, eax
push ebp
push 0x463a00
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00405460
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00405858
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x4639e5
mov eax, dword [ebp - 0xc]
call fcn.00402eb0
mov ebx, eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
push 0
push esi
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x463a10
push ebx
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4639e5
mov eax, edi
mov edx, dword [ebp - 0x14]
call fcn.004055c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463a07
lea eax, [ebp - 8]
mov edx, 2
call fcn.004053ec
ret
Function at 0x463b20
Capabilities:
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x134], eax
mov dword [ebp - 4], eax
lea edi, [ebp - 0x130]
xor eax, eax
push ebp
push 0x463cd4
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x134]
mov eax, 0x463cec
call fcn.0046395c
mov eax, dword [ebp - 0x134]
mov edx, 0x463d04
call fcn.004057f0
setne byte [ebp - 5]
push 0
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [edi], 0x128
push edi
push esi
call sub.kernel32.dll_Process32First
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x463ca0
lea edx, [ebp - 4]
mov eax, dword [edi + 8]
call fcn.00463a38
cmp dword [ebp - 4], 0
je 0x463c93
lea edx, [ebp - 0x138]
mov eax, dword [ebp - 4]
call fcn.0040e244
mov eax, dword [ebp - 0x138]
push eax
lea eax, [ebp - 0x140]
call fcn.00463950
mov eax, dword [ebp - 0x140]
lea edx, [ebp - 0x13c]
call fcn.0040e244
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.004057f0
jne 0x463c72
lea eax, [ebp - 0x14c]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00405638
mov eax, dword [ebp - 0x14c]
lea edx, [ebp - 0x148]
call fcn.004654b0
mov eax, dword [ebp - 0x148]
lea edx, [ebp - 0x144]
call fcn.004095e8
mov eax, dword [ebp - 0x144]
mov edx, 0x463d1c
call fcn.004057f0
sete al
and al, byte [ebp - 5]
je 0x463c72
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
lea eax, [ebp - 0x150]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00405638
mov edx, dword [ebp - 0x150]
lea eax, [ebp - 4]
call fcn.00405694
push edi
push esi
call sub.kernel32.dll_Process32Next
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x463bbc
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463cdb
lea eax, [ebp - 0x150]
mov edx, 8
call fcn.004053ec
lea eax, [ebp - 4]
call fcn.004053c8
ret

Function at 0x463e14
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
mov esi, eax
push esi
call sub.kernel32.dll_lstrlenA_1
mov edx, eax
dec edx
test edx, edx
jl 0x463e49
inc edx
xor ecx, ecx
movzx ebx, byte [esi + ecx]
mov edi, eax
and edi, 0xff
xor ebx, edi
mov ebx, dword [ebx*4 + 0x48edf4]
shr eax, 8
xor ebx, eax
mov eax, ebx
inc ecx
dec edx
jne 0x463e29
pop edi
pop esi
pop ebx
ret
Function at 0x463e7c
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
xor edx, edx
mov dword [ebp - 0x110], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x463f06
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0x104
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x109]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
jne 0x463ee0
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x110]
call fcn.0040cce8
mov ecx, dword [ebp - 0x110]
mov dl, 1
mov eax, dword [0x408918]
call fcn.0040d4fc
call fcn.00404d34
mov edx, ebx
lea eax, [ebp - 0x109]
call fcn.0040a5e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463f0d
lea eax, [ebp - 0x110]
call fcn.004053c8
ret

Function at 0x4640f4
Capabilities:
Delete file
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x4641fc
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4641da
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.004235b8
lea eax, [ebp - 8]
mov edx, 0x464210
call fcn.00405694
mov eax, dword [ebp - 8]
call fcn.00405858
mov edx, eax
lea eax, [ebp - 4]
call fcn.004055c0
mov eax, dword [ebp - 4]
xor edx, edx
call fcn.004644f0
push 0x20
lea eax, [ebp - 0xc]
call fcn.004235b8
lea eax, [ebp - 0xc]
mov edx, 0x464210
call fcn.00405694
mov eax, dword [ebp - 0xc]
call fcn.00405858
push eax
call sub.kernel32.dll_SetFileAttributesA
lea eax, [ebp - 0x10]
call fcn.004235b8
lea eax, [ebp - 0x10]
mov edx, 0x464210
call fcn.00405694
mov eax, dword [ebp - 0x10]
call fcn.00405858
push eax
call sub.kernel32.dll_DeleteFileA
mov eax, dword [0x63b0c8]
mov edx, 0x46422c
call fcn.00424b74
lea eax, [ebp - 0x14]
call fcn.004235b8
lea eax, [ebp - 0x14]
mov edx, 0x464210
call fcn.00405694
mov eax, dword [ebp - 0x14]
call fcn.00405858
push eax
push 0x464238
call sub.kernel32.dll_MoveFileA
test eax, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4641e1
ret
Function at 0x464240
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffecc
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x134], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x464318
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
push 0
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x130], 0x128
lea eax, [ebp - 0x130]
push eax
push esi
call sub.kernel32.dll_Process32First
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x4642ed
lea eax, [ebp - 0x134]
lea edx, [ebp - 0x10c]
mov ecx, 0x104
call fcn.00405638
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 4]
call fcn.004095e8
mov eax, dword [ebp - 4]
mov edx, 0x464334
call fcn.004057f0
je 0x4642d4
mov eax, dword [ebp - 4]
mov edx, 0x464348
call fcn.004057f0
jne 0x4642da
mov byte [ebp - 5], 1
jmp 0x4642f1
lea eax, [ebp - 0x130]
push eax
push esi
call sub.kernel32.dll_Process32Next
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x464292
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46431f
lea eax, [ebp - 0x134]
call fcn.004053c8
lea eax, [ebp - 4]
call fcn.004053c8
ret

Function at 0x464358
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405848
xor eax, eax
push ebp
push 0x4644de
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
push 0
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x12c], 0x128
lea eax, [ebp - 0x12c]
push eax
push esi
call sub.kernel32.dll_Process32First
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x4644aa
lea eax, [ebp - 0x138]
lea edx, [ebp - 0x108]
mov ecx, 0x104
call fcn.00405638
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.0040a2a4
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00409560
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.00409560
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.004057f0
je 0x46447d
lea eax, [ebp - 0x144]
lea edx, [ebp - 0x108]
mov ecx, 0x104
call fcn.00405638
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00409560
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.00409560
mov edx, dword [ebp - 0x148]
pop eax
call fcn.004057f0
jne 0x464497
push 0
mov eax, dword [ebp - 0x124]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edi, eax
lea eax, [ebp - 0x12c]
push eax
push esi
call sub.kernel32.dll_Process32Next
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x4643d8
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4644e5
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.004053ec
lea eax, [ebp - 4]
call fcn.004053c8
ret
Function at 0x4647c4
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], ebx
mov ebx, ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x464928
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4648f8
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
nop
add eax, 0
add eax, 0
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.004055c0
mov eax, dword [ebp - 0x10]
call fcn.00409f70
test al, al
je 0x46482f
nop
add eax, 0
add eax, 0
push ebx
call sub.kernel32.dll_DeleteFileA
nop
add eax, 0
add eax, 0
nop
add eax, 0
add eax, 0
push 0
push 0x80
push 1
push 0
push 2
push 0x40000000
lea eax, [ebp - 0x18]
mov edx, ebx
call fcn.004055c0
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x14]
xor edx, edx
call fcn.004637a0
mov eax, dword [ebp - 0x14]
call fcn.00405d34
push eax
call sub.kernel32.dll_CreateFileW
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4648e7
push dword fs:[eax]
mov dword fs:[eax], esp
nop
add eax, 0
add eax, 0
cmp dword [ebp - 8], 0
je 0x4648c9
nop
add eax, 0
add eax, 0
push 0
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetFilePointer_1
nop
add eax, 0
add eax, 0
push 0
lea eax, [ebp - 0xc]
push eax
push edi
push esi
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
nop
add eax, 0
add eax, 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4648ee
nop
add eax, 0
add eax, 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
ret

Function at 0x464de4
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff70
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x90], ebx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x464e7e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x90]
mov edx, ebx
call fcn.004055c0
mov eax, dword [ebp - 0x90]
call fcn.00409f70
test al, al
je 0x464e65
push 0x20
push ebx
call sub.kernel32.dll_SetFileAttributesA
push 1
lea eax, [ebp - 0x8c]
push eax
push ebx
call sub.kernel32.dll_OpenFile
mov ebx, eax
cmp ebx, 0xffffffff
je 0x464e65
xor ecx, ecx
mov edx, esi
mov eax, ebx
call fcn.004257cc
lea edx, [ebp - 4]
mov ecx, dword [ebp + 8]
mov eax, ebx
call fcn.00425858
mov eax, ebx
call fcn.00425698
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x464e85
lea eax, [ebp - 0x90]
call fcn.004053c8
ret
Function at 0x464e90
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff74
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x8c], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x464f29
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x8c]
mov edx, ebx
call fcn.004055c0
mov eax, dword [ebp - 0x8c]
call fcn.00409f70
test al, al
je 0x464f10
push 0x20
push ebx
call sub.kernel32.dll_SetFileAttributesA
push 1
lea eax, [ebp - 0x88]
push eax
push ebx
call sub.kernel32.dll_OpenFile
mov ebx, eax
cmp ebx, 0xffffffff
je 0x464f10
xor ecx, ecx
mov edx, esi
mov eax, ebx
call fcn.004257cc
mov edx, edi
mov ecx, dword [ebp + 8]
mov eax, ebx
call fcn.00425858
mov eax, ebx
call fcn.00425698
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x464f30
lea eax, [ebp - 0x8c]
call fcn.004053c8
ret
Function at 0x4654f4
Capabilities:
Create thread

Disassembly:
push ebx
push ecx
push 1
call sub.kernel32.dll_Sleep_2
push esp
push 0
push 0
push 0x4654ec
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov eax, ebx
pop edx
pop ebx
ret

Function at 0x465518
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, edx
mov esi, eax
mov eax, ebp
mov edx, esi
call fcn.0040541c
mov eax, esi
test eax, eax
je 0x465534
sub eax, 4
mov eax, dword [eax]
mov edi, eax
test edi, edi
jbe 0x465569
mov ebx, 1
mov eax, ebp
call fcn.004058b8
movzx edx, byte [esi + ebx - 1]
xor dl, 4
mov byte [eax + ebx - 1], dl
mov eax, ebp
call fcn.004058b8
movzx edx, byte [esi + ebx - 1]
xor dl, 0xc
mov byte [eax + ebx - 1], dl
inc ebx
dec edi
jne 0x46553f
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x46777c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405848
xor eax, eax
push ebp
push 0x467845
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00405460
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.00405858
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x46782a
mov eax, dword [ebp - 0x10]
call fcn.00402eb0
mov ebx, eax
push ebx
mov eax, dword [ebp - 0x10]
push eax
push 0
push esi
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x467854
push ebx
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x467809
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x18]
call fcn.004055c0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x46787c
push ebx
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x46782a
mov eax, edi
mov edx, dword [ebp - 0x18]
call fcn.004055c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46784c
lea eax, [ebp - 8]
mov edx, 2
call fcn.004053ec
ret
Function at 0x4678a0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405848
xor eax, eax
push ebp
push 0x467944
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00405460
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00405858
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x467929
mov eax, dword [ebp - 0xc]
call fcn.00402eb0
mov ebx, eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
push 0
push esi
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x467954
push ebx
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x467929
mov eax, edi
mov edx, dword [ebp - 0x14]
call fcn.004055c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46794b
lea eax, [ebp - 8]
mov edx, 2
call fcn.004053ec
ret
Function at 0x468158
Capabilities:
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x138], eax
mov dword [ebp - 4], eax
lea edi, [ebp - 0x130]
xor eax, eax
push ebp
push 0x46826a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
call fcn.00467688
test al, al
je 0x46819f
mov byte [ebp - 5], 1
jmp 0x468244
push 0
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [edi], 0x128
push edi
push esi
call sub.kernel32.dll_Process32First
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x46823a
mov eax, dword [edi + 8]
call fcn.00467c6c
test al, al
je 0x4681d1
mov byte [ebp - 5], 1
jmp 0x46823e
lea edx, [ebp - 4]
mov eax, dword [edi + 8]
call fcn.00467ac4
cmp dword [ebp - 4], 0
je 0x46822d
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00405638
mov ecx, dword [ebp - 0x138]
lea eax, [ebp - 0x134]
mov edx, dword [ebp - 4]
call fcn.004056e0
mov eax, dword [ebp - 0x134]
call fcn.00467978
test al, al
je 0x46822d
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
push edi
push esi
call sub.kernel32.dll_Process32Next
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x4681bf
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x468271
lea eax, [ebp - 0x138]
mov edx, 2
call fcn.004053ec
lea eax, [ebp - 4]
call fcn.004053c8
ret

Function at 0x468340
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
xor ecx, ecx
mov eax, dword [0x6387f8]
test eax, eax
je 0x468383
movzx edx, word [eax]
not dx
cmp dx, 0x5a4d
je 0x468383
mov esi, eax
mov edx, esi
mov ebx, dword [eax + 0x3c]
add edx, ebx
mov edx, dword [edx]
not edx
cmp edx, 0x4550
je 0x468383
mov edx, ebx
add edx, 0x18
add edx, 0x34
sub edx, 8
add edx, 0x14
add edx, esi
mov eax, edx
mov ecx, dword [eax]
mov eax, ecx
pop esi
pop ebx
ret