joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403bd8
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffac
mov edi, ecx
mov esi, edx
mov ebx, eax
push 0x44
push 0
lea eax, [esp + 8]
push eax
call fcn.00406550
add esp, 0xc
mov dword [esp], 0x44
lea edx, [esp + 0x44]
push edx
lea ecx, [esp + 4]
push ecx
push esi
push 0
push 0
push 0
push 0
push 0
push ebx
push 0
call sub.KERNEL32.DLL_CreateProcessA
test eax, eax
je 0x403c41
test edi, edi
je 0x403c2b
push edi
push dword [esp + 0x48]
call sub.KERNEL32.DLL_WaitForSingleObject
push dword [esp + 0x48]
call sub.KERNEL32.DLL_CloseHandle
push dword [esp + 0x44]
call sub.KERNEL32.DLL_CloseHandle
mov al, 1
jmp 0x403c43
xor eax, eax
add esp, 0x54
pop edi
pop esi
pop ebx
ret

Function at 0x4040c4
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov ebx, eax
push edi
mov dword [ebp - 4], edx
xor edx, edx
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0xc18], edx
cmp byte [ebx + 0x14], 0
mov edi, ecx
je 0x4040e7
mov al, 1
cmp byte [ebp + 8], 0
mov esi, 0x80000000
je 0x4040f8
or esi, 0x40000000
mov dword [ebp - 8], 1
test al, al
je 0x404107
or dword [ebp - 8], 2
call fcn.0040490c
test eax, eax
je 0x404133
test edi, edi
je 0x404133
cmp word [edi], 0
je 0x404133
push 0
push 0x8000000
push 3
push 0
push dword [ebp - 8]
push esi
push edi
call sub.KERNEL32.DLL_CreateFileW
mov esi, eax
jmp 0x40414c
push 0
push 0x8000000
push 3
push 0
push dword [ebp - 8]
push esi
push dword [ebp - 4]
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
jne 0x404165
call sub.KERNEL32.DLL_GetLastError
cmp eax, 2
jne 0x404165
mov dword [ebx + 0xc18], 1
xor eax, eax
cmp esi, 0xffffffff
mov byte [ebx + 0x12], 0
setne dl
mov dword [ebx + 0xc], eax
and edx, 1
mov byte [ebx + 0x10], 0
mov byte [ebp - 9], dl
cmp byte [ebp - 9], 0
je 0x4041b2
mov dword [ebx + 4], esi
test edi, edi
je 0x40419a
lea eax, [ebx + 0x416]
mov edx, edi
call fcn.00403d98
jmp 0x4041a3
mov word [ebx + 0x416], 0
push dword [ebp - 4]
add ebx, 0x15
push ebx
call fcn.004066d0
add esp, 8
mov al, byte [ebp - 9]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x404240
Capabilities:
Delete file

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0xc], 0
jne 0x40424f
cmp byte [ebx + 0x13], 0
jne 0x404253
xor eax, eax
pop ebx
ret
cmp dword [ebx + 4], 0xffffffff
je 0x404260
mov eax, ebx
call fcn.004041c0
call fcn.0040490c
test eax, eax
je 0x404289
cmp word [ebx + 0x416], 0
je 0x404289
add ebx, 0x416
push ebx
call sub.KERNEL32.DLL_DeleteFileW
test eax, eax
setne al
and eax, 1
jmp 0x40429a
add ebx, 0x15
push ebx
call sub.KERNEL32.DLL_DeleteFileA
test eax, eax
setne al
and eax, 1
pop ebx
ret
Function at 0x40436c
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, eax
push esi
push edi
push ecx
mov edi, edx
cmp dword [ebx + 0xc], 1
mov esi, ecx
jne 0x404393
cmp esi, 0x4e20
jle 0x404389
mov esi, 0x4e20
push 0xfffffffffffffff6
call sub.KERNEL32.DLL_GetStdHandle
mov dword [ebx + 4], eax
push 0
lea eax, [esp + 4]
push eax
push esi
push edi
push dword [ebx + 4]
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x4043e4
mov eax, ebx
call fcn.004044bc
test al, al
je 0x4043cb
cmp esi, 0x4e20
jle 0x4043cb
mov ecx, 0x4e20
mov edx, edi
mov eax, ebx
call fcn.0040436c
jmp 0x4043e7
cmp dword [ebx + 0xc], 1
jne 0x4043df
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x6d
jne 0x4043df
xor eax, eax
jmp 0x4043e7
or eax, 0xffffffff
jmp 0x4043e7
mov eax, dword [esp]
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40498c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, 0x41438c
push edi
push ebp
mov ebp, edx
cmp dword [esi + 4], 0
mov edi, ecx
mov ebx, eax
jne 0x4049a6
call fcn.00404954
mov eax, ebp
cmp edi, 8
jb 0x404a31
xor ebx, dword [eax]
xor edx, edx
mov dl, bl
sub edi, 8
shr ebx, 8
mov ecx, dword [esi + edx*4]
xor ecx, ebx
xor edx, edx
mov ebx, ecx
mov dl, bl
shr ebx, 8
mov ecx, dword [esi + edx*4]
xor ecx, ebx
xor edx, edx
mov ebx, ecx
mov dl, bl
shr ebx, 8
mov ecx, dword [esi + edx*4]
xor ecx, ebx
xor edx, edx
mov ebx, ecx
mov dl, bl
shr ebx, 8
mov ecx, dword [esi + edx*4]
xor ecx, ebx
xor edx, edx
mov ebx, ecx
xor ebx, dword [eax + 4]
add eax, 8
mov dl, bl
shr ebx, 8
mov ecx, dword [esi + edx*4]
xor ecx, ebx
xor edx, edx
mov ebx, ecx
mov dl, bl
shr ebx, 8
mov ecx, dword [esi + edx*4]
xor ecx, ebx
xor edx, edx
mov ebx, ecx
mov dl, bl
shr ebx, 8
mov ecx, dword [esi + edx*4]
xor ecx, ebx
xor edx, edx
mov ebx, ecx
mov dl, bl
shr ebx, 8
mov ecx, dword [esi + edx*4]
xor ecx, ebx
cmp edi, 8
mov ebx, ecx
jae 0x4049b1
xor edx, edx
jmp 0x404a4b
mov ecx, ebx
xor cl, byte [eax + edx]
and ecx, 0xff
shr ebx, 8
mov ecx, dword [esi + ecx*4]
xor ecx, ebx
mov ebx, ecx
inc edx
cmp edi, edx
ja 0x404a35
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4061ac
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret

Function at 0x4073c8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x4073e4
call fcn.0040860c
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x4073ff
test bl, 1
je 0x4073ff
mov dword [0x411514], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x4075ac
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
test byte [ebp + 0xd], 0xc0
jne 0x4075cb
mov eax, dword [0x410668]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x4075d8
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x407605
je 0x407617
sub ecx, 0x100
je 0x407625
sub ecx, 0x100
je 0x40762c
sub ecx, 0x100
je 0x40761e
jmp 0x407633
sub ecx, 0x600
je 0x40762c
sub ecx, 0x100
je 0x407617
jmp 0x407633
mov edi, 1
jmp 0x407638
mov edi, 2
jmp 0x407638
mov edi, 4
jmp 0x407638
mov edi, 5
jmp 0x407638
mov edi, 3
test byte [ebp + 0xd], 1
je 0x40765f
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x4100e0]
test al, 0x80
je 0x407658
mov ebx, 0x80
jmp 0x407671
mov ebx, 1
jmp 0x407671
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x407671
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x407683
je 0x40768c
dec eax
je 0x407695
jmp 0x40769e
mov dword [ebp - 4], 0x80000000
jmp 0x4076ad
mov dword [ebp - 4], 0x40000000
jmp 0x4076ad
mov dword [ebp - 4], 0xc0000000
jmp 0x4076ad
push 1
call fcn.004085a8
pop ecx
mov ebx, eax
jmp 0x40779d
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x4076c9
sub eax, 0x10
je 0x4076d0
sub eax, 0x10
je 0x4076d9
sub eax, 0x10
je 0x4076e2
jmp 0x4076e2
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x4076e9
mov dword [ebp - 8], 1
jmp 0x4076e9
mov dword [ebp - 8], 2
jmp 0x4076e9
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x407756
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x40774b
test byte [ebp + 0xd], 1
je 0x407746
mov ebx, 0x50
jmp 0x40774b
mov ebx, 2
push ebx
call fcn.004085a8
pop ecx
mov ebx, eax
jmp 0x40779d
mov edi, esi
push edi
call fcn.0040751c
pop ecx
test eax, eax
je 0x40776a
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x407776
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.004082ec
add esp, 8
mov ebx, eax
inc eax
jne 0x40779d
push 4
call fcn.004085a8
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40be28
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x40be8a
call fcn.0040bdd8
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.00406700
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.00406700
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x40bee8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x41151c], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x40bfc2
cmp dword [0x411518], 0
jne 0x40bfc2
cmp dword [0x41170c], 0
je 0x40bf7c
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.0040bd80
add esp, 8
mov ebx, eax
test eax, eax
jne 0x40bf62
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.0040bd80
add esp, 8
mov ebx, eax
test eax, eax
jne 0x40bf62
lea ebx, [ebp - 0x84]
jmp 0x40bf63
inc ebx
call fcn.0040bea4
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x40bffd
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x411520
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.00406700
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x411523
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x40bffd
cmp dword [0x411518], 0
je 0x40bfdc
cmp dword [0x411518], 0xffffffff
je 0x40bffd
push esi
call dword [0x411518]
pop ecx
mov eax, dword [0x41151c]
test eax, eax
je 0x40bffd
cmp dword [0x41151c], 0xffffffff
je 0x40bffd
cmp byte [eax], 0
je 0x40bffd
push esi
push eax
call fcn.0040be28
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401005
Capabilities:
Hide graphical window

Disassembly:
jmp 0x401d70
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi + 0x1c]
push edi
push eax
call dword [sym.imp.USER32.dll_GetParent]
push eax
call fcn.0043138c
mov ebx, dword [esi + 0x78]
mov edx, dword [esi + 0x80]
mov ecx, dword [esi + 0x94]
sub ebx, edx
sub ebx, 0x14
xor edi, edi
dec ecx
mov ebp, eax
js 0x401dd6
test edi, edi
jl 0x401ef3
cmp edi, dword [esi + 0x94]
jge 0x401ef3
mov edx, dword [esi + 0x90]
mov eax, dword [edx + edi*4]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0x94]
inc edi
dec ecx
cmp edi, ecx
jle 0x401da4
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0x1c]
lea edx, [esp + 0x10]
push edx
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
lea edx, [esp + 0x10]
push edx
mov ecx, ebp
call fcn.0043e1ef
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
sub eax, ebx
push 1
mov dword [esp + 0x20], eax
sub eax, ecx
push eax
mov eax, dword [esp + 0x18]
sub edx, eax
push edx
push ecx
mov ecx, dword [esi + 0x54]
push eax
call fcn.00433ed0
mov eax, dword [esi + 0xa8]
xor edi, edi
dec eax
js 0x401eb5
jmp 0x401e30
test edi, edi
jl 0x401ef3
cmp edi, dword [esi + 0xa8]
jge 0x401ef3
mov edx, dword [esi + 0xa4]
mov eax, dword [edx + edi*4]
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [esp + 0x10]
push ecx
mov ecx, ebp
call fcn.0043e1ef
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov edx, dword [esi + 0xa8]
sub ecx, ebx
sub eax, ebx
cmp edi, edx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x1c], eax
jge 0x401ef3
mov edx, dword [esp + 0x18]
push 1
sub eax, ecx
push eax
mov eax, dword [esp + 0x18]
sub edx, eax
push edx
push ecx
push eax
mov eax, dword [esi + 0xa4]
mov ecx, dword [eax + edi*4]
push ecx
call dword [sym.imp.USER32.dll_MoveWindow]
mov edx, dword [esi + 0xa8]
inc edi
dec edx
cmp edi, edx
jle 0x401e30
mov ecx, dword [ebp + 0x1c]
lea eax, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
sub eax, ebx
push 1
mov dword [esp + 0x20], eax
sub eax, ecx
push eax
mov eax, dword [esp + 0x18]
sub edx, eax
push edx
push ecx
push eax
mov ecx, ebp
call fcn.00433ed0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
jmp fcn.00424cfc
Function at 0x40114a
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
jmp 0x402820
mov eax, 0x24f3c
call fcn.0040b430
push ebx
mov ebx, dword [esp + 0x24f4c]
push esi
push edi
mov edi, dword [esp + 0x24f58]
xor esi, esi
xor ecx, ecx
nop
mov eax, ecx
cdq
idiv edi
mov byte [esp + ecx + 0x10], cl
inc ecx
cmp ecx, 0x12799
mov al, byte [edx + ebx]
mov byte [esp + ecx + 0x127ab], al
jl 0x402840
xor ecx, ecx
mov edi, edi
mov bl, byte [esp + ecx + 0x10]
movzx edx, byte [esp + ecx + 0x127ac]
add edx, esi
movzx eax, bl
add eax, edx
cdq
mov esi, 0x12799
idiv esi
inc ecx
cmp ecx, 0x12799
mov esi, edx
mov al, byte [esp + esi + 0x10]
mov byte [esp + esi + 0x10], bl
mov byte [esp + ecx + 0xf], al
jl 0x402860
mov eax, dword [esp + 0x24f50]
xor edi, edi
test eax, eax
jle 0x40290c
mov esi, dword [esp + 0x24f5c]
push ebp
mov ebp, dword [esp + 0x24f50]
sub ebp, esi
mov dword [esp + 0x10], eax
lea eax, [ecx + 1]
cdq
mov ecx, 0x12799
idiv ecx
mov ebx, 0x12799
mov ecx, edx
movzx eax, byte [esp + ecx + 0x14]
add eax, edi
cdq
mov edi, 0x12799
idiv edi
mov edi, edx
mov dl, byte [esp + ecx + 0x14]
mov al, byte [esp + edi + 0x14]
mov byte [esp + edi + 0x14], dl
mov byte [esp + ecx + 0x14], al
movzx edx, byte [esp + edi + 0x14]
movzx eax, al
add eax, edx
cdq
idiv ebx
mov bl, byte [esi + ebp]
mov al, byte [esp + edx + 0x14]
xor al, bl
mov byte [esi], al
mov eax, dword [esp + 0x10]
inc esi
dec eax
mov dword [esp + 0x10], eax
jne 0x4028b4
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x24f3c
ret

Function at 0x4064ed
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x406502
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x406514
xor eax, eax
jmp 0x406546
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x406538
cmp esi, eax
jae 0x406510
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x40652a
cmp esi, eax
jae 0x406510
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop ebp
ret
Function at 0x40b597
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.0040b430
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40b632
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x482754]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x40b632
cmp eax, 1
je 0x40b653
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40b632
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x40b5ff
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x40b62e
xor eax, eax
inc eax
jmp 0x40b672
cmp edi, eax
jae 0x40b636
xor eax, eax
jmp 0x40b672
cmp eax, esi
jae 0x40b63d
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x482754]
jmp 0x40b656
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40b86a
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x46eef0
call fcn.0040c518
mov edi, 0x94
mov eax, edi
call fcn.0040b430
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x482754], ecx
mov eax, dword [esi + 4]
mov dword [0x482760], eax
mov edx, dword [esi + 8]
mov dword [0x482764], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x482758], esi
cmp ecx, 2
je 0x40b8ca
or esi, 0x8000
mov dword [0x482758], esi
shl eax, 8
add eax, edx
mov dword [0x48275c], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x40b905
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40b905
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x40b91d
cmp eax, 0x20b
je 0x40b90a
mov dword [ebp - 0x1c], esi
jmp 0x40b931
cmp dword [ecx + 0x84], 0xe
jbe 0x40b905
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x40b92b
cmp dword [ecx + 0x74], 0xe
jbe 0x40b905
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.0040ffbf
pop ecx
test eax, eax
jne 0x40b945
push 0x1c
call fcn.0040b7f0
pop ecx
call fcn.0040eec9
test eax, eax
jne 0x40b956
push 0x10
call fcn.0040b7f0
pop ecx
call fcn.00411ca3
mov dword [ebp - 4], esi
call fcn.00411a59
test eax, eax
jge 0x40b96f
push 0x1b
call fcn.0040b7cb
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x484460], eax
call fcn.00411937
mov dword [0x482740], eax
call fcn.00411895
test eax, eax
jge 0x40b995
push 8
call fcn.0040b7cb
pop ecx
call fcn.00411662
test eax, eax
jge 0x40b9a6
push 9
call fcn.0040b7cb
pop ecx
push 1
call fcn.0040c742
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x40b9bc
push eax
call fcn.0040b7cb
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00411605
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x40b9dd
movzx eax, word [ebp - 0x40]
jmp 0x40b9e0
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.0041d718
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x40b9fe
push edi
call fcn.0040c86f
call fcn.0040c891
jmp 0x40ba30
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.0040c553
ret
Function at 0x40c7ac
Capabilities:
Terminate process

Disassembly:
push 8
push 0x46ef80
call fcn.0040c518
push 8
call fcn.0040ff74
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x482794], esi
jne 0x40c7e0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x482790], esi
mov al, byte [ebp + 0x10]
mov byte [0x48278c], al
cmp dword [ebp + 0xc], edi
jne 0x40c82a
cmp dword [0x484458], edi
je 0x40c81a
mov eax, dword [0x484454]
sub eax, 4
mov dword [0x484454], eax
cmp eax, dword [0x484458]
jb 0x40c81a
mov eax, dword [eax]
cmp eax, edi
je 0x40c7fb
call eax
jmp 0x40c7fb
push 0x47dcb0
mov eax, 0x47daa8
call fcn.0040c70c
pop ecx
push 0x47dfbc
mov eax, 0x47ddb4
call fcn.0040c70c
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x40c85b
cmp dword [ebp + 0x10], edi
jne 0x40c869
mov dword [0x482794], esi
push dword [ebp + 8]
call fcn.0040c6ca
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x40c868
push 8
call fcn.0040fea7
pop ecx
ret
call fcn.0040c553
ret

Function at 0x40c9a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
test edi, edi
jne 0x40c9bd
call fcn.0040d9ca
mov dword [eax], 0x16
xor eax, eax
jmp 0x40ca27
push esi
push 0x8c
push 1
call fcn.0040dec7
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40ca12
push esi
call fcn.0040ecc3
mov eax, dword [ebp + 0x14]
or dword [esi + 4], 0xffffffff
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
pop ecx
mov dword [esi + 0x4c], edi
jne 0x40c9f0
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x18]
push esi
push 0x40c90b
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x40ca26
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call fcn.0040b526
test ebx, ebx
pop ecx
je 0x40ca24
push ebx
call fcn.0040d9dc
pop ecx
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x411057
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x411085
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x41108c
cmp ebx, dword [eax + 4]
jae 0x41108c
xor eax, eax
jmp 0x41127c
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x41109d
xor eax, eax
inc eax
jmp 0x41127b
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x4110b3
cmp ecx, edx
jae 0x4111f8
cmp dword [eax + 4], 0
je 0x4110bc
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x4110a4
cmp dword [ebp + 8], 0
je 0x4110de
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x4111f8
cmp eax, esi
jae 0x4111f8
mov eax, dword [0x482920]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x411103
cmp dword [esi*4 + 0x482928], edi
je 0x4111fc
inc esi
cmp esi, eax
jl 0x4110f1
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x411278
cmp dword [ebp - 8], 0x1000000
jne 0x411278
test byte [ebp - 0xc], 0xcc
je 0x411181
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x411278
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x411278
cmp word [eax + 0x18], 0x10b
jne 0x411278
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x411278
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x411181
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x411181
test byte [ecx + 0x27], 0x80
jne 0x4111f8
push 1
push 0x482968
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test eax, eax
jne 0x411095
mov ecx, dword [0x482920]
test ecx, ecx
mov edx, ecx
jle 0x4111b5
lea eax, [ecx*4 + 0x482924]
cmp dword [eax], edi
je 0x4111b5
dec edx
sub eax, 4
test edx, edx
jg 0x4111a9
test edx, edx
jne 0x4111e6
push 0xf
pop ebx
cmp ecx, ebx
jg 0x4111c2
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x4111da
lea eax, [edx*4 + 0x482928]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x4111c8
cmp ecx, 0x10
jge 0x4111e6
inc ecx
mov dword [0x482920], ecx
push 0
push 0x482968
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x411095
xor eax, eax
jmp 0x41127b
test esi, esi
jle 0x411095
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 1
push 0x482968
call ebx
test eax, eax
jne 0x411095
cmp dword [esi*4 + 0x482928], edi
je 0x411252
mov eax, dword [0x482920]
lea esi, [eax - 1]
test esi, esi
jl 0x411240
cmp dword [esi*4 + 0x482928], edi
je 0x41123c
dec esi
jns 0x411230
test esi, esi
jge 0x411250
cmp eax, 0x10
jge 0x41124b
inc eax
mov dword [0x482920], eax
lea esi, [eax - 1]
jmp 0x411252
je 0x41126a
xor ecx, ecx
test esi, esi
jl 0x41126a
lea eax, [ecx*4 + 0x482928]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x411258
push 0
push 0x482968
call ebx
jmp 0x411095
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret