joyce8/EMBER2024-capa huggingface dataset:
Function at 0x907e5ad
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90ac387
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x13f0
call fcn.090a6f20
mov eax, dword [0x90e6610]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x13e8], edi
mov esi, dword [ebx + 8]
push 0
mov dword [ebp - 0x13e4], esi
mov eax, dword [esi + 4]
add eax, 0x94
push eax
call fcn.09053fcd
cmp dword [edi], 0
pop ecx
pop ecx
jne 0x907e632
push 0
push 0x9c4
push 0xf424
push dword [esi + 4]
call fcn.09053fcd
add esp, 0x10
mov dword [edi], eax
mov ecx, esi
mov dword [ebp - 0x13ec], esi
call fcn.090168fd
and dword [ebp - 4], 0
lea edi, [ebp - 0x48]
push 0xc
pop ecx
mov eax, ecx
mov dword [ebp - 0x13dc], 0x18
xor edx, edx
add ecx, 0x8000
div dword [ebp - 0x13dc]
mov word [edi], ax
lea edi, [edi + 2]
cmp ecx, 0xc800c
jb 0x907e649
and dword [ebp - 0x13e0], 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x13dc], eax
movzx eax, word [eax]
lea ecx, [ebp - 0x13cc]
xor edx, edx
mov dword [ebp - 0x13d8], eax
mov dword [ebp - 0x13d4], edx
movzx esi, word [ebp + edx*2 - 0x48]
xor edi, edi
mov edx, dword [ebp - 0x13d8]
mov ax, word [ebp + edi*2 - 0x48]
inc edi
mov word [ecx - 2], dx
mov word [ecx], si
mov word [ecx + 2], ax
add ecx, 8
cmp edi, 0x19
jb 0x907e6a5
mov edx, dword [ebp - 0x13d4]
inc edx
mov dword [ebp - 0x13d4], edx
cmp edx, 0x19
jb 0x907e698
mov ecx, dword [ebp - 0x13e4]
lea eax, [ebp - 0x13d0]
push 0
push 0x434d594b
push 0x50524742
push 0x271
push eax
push eax
call fcn.09053fcd
mov eax, dword [ebp - 0x13e8]
lea ecx, [ebp - 0x1400]
mov edi, dword [ebp - 0x13e0]
push 1
push 0x9c4
push edi
push dword [eax]
call fcn.09053fcd
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 1
call fcn.09005d4d
lea esi, [ebp - 0x13d0]
mov dword [ebp - 0x13d8], 0x19
lea edi, [eax + 2]
mov dword [ebp - 0x13d4], 0x19
mov ecx, dword [esi]
mov edx, dword [esi + 4]
add esi, 8
movzx eax, cx
imul eax, eax, 0xff
shr ecx, 0x10
add eax, 0x4000
shr eax, 0xf
mov byte [edi - 2], al
imul eax, ecx, 0xff
mov ecx, 0x4000
add eax, ecx
shr eax, 0xf
mov byte [edi - 1], al
movzx eax, dx
imul eax, eax, 0xff
shr edx, 0x10
add eax, ecx
shr eax, 0xf
mov byte [edi], al
imul eax, edx, 0xff
add eax, ecx
shr eax, 0xf
mov byte [edi + 1], al
add edi, 4
sub dword [ebp - 0x13d4], 1
jne 0x907e741
sub dword [ebp - 0x13d8], 1
jne 0x907e737
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 0
call fcn.09005e1d
mov edi, dword [ebp - 0x13e0]
mov eax, dword [ebp - 0x13dc]
add edi, 0x9c4
mov esi, dword [ebp - 0x13e4]
add eax, 2
mov dword [ebp - 0x13dc], eax
mov dword [ebp - 0x13e0], edi
cmp edi, 0xf424
jb 0x907e681
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.09016a6b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.09001f80
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x909f010
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90ace1d
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xb20
mov eax, dword [0x90e6610]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebx + 8]
mov esi, dword [ebx + 0x18]
push eax
mov dword [ebp - 0xb2c], eax
call fcn.09053fcd
add esp, 4
lea ecx, [ebp - 0xb24]
push eax
call fcn.09053fcd
push 0
push 0
push 0
push 1
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 1
push dword [ebp - 0xb24]
mov dword [ebp - 4], 0
push esi
call fcn.09008247
add esp, 0x3c
lea ecx, [ebp - 0xb20]
push eax
call fcn.09053fcd
mov byte [ebp - 4], 1
xor eax, eax
nop dword [eax]
nop dword [eax + eax]
mov byte [ebp + eax - 0x118], al
inc eax
cmp eax, 0x100
jb 0x909f0c0
mov ecx, dword [ebp - 0xb20]
lea eax, [ebp - 0x918]
push 0
push 0x5058595a
push 0x67386b30
push 0x100
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.09053fcd
movzx ecx, word [ebp - 0x11c]
movzx edi, word [ebp - 0x914]
mov dword [ebp - 0xb28], ecx
cmp ecx, edi
jbe 0x909f23a
mov edx, ecx
sub edx, edi
xor esi, esi
mov dword [ebp - 0xb1c], edx
movzx eax, word [ebp + esi*8 - 0x914]
cmp eax, edi
ja 0x909f131
xor eax, eax
jmp 0x909f15e
cmp eax, ecx
jb 0x909f13c
mov eax, 0x8000
jmp 0x909f15e
sub eax, edi
mov ecx, edx
shl eax, 0xf
xor edx, edx
shr ecx, 1
add eax, ecx
mov ecx, dword [ebp - 0xb28]
div dword [ebp - 0xb1c]
mov edx, dword [ebp - 0xb1c]
movzx eax, ax
mov word [ebp + esi*2 - 0xb18], ax
inc esi
cmp esi, 0x100
jb 0x909f121
lea ecx, [ebp - 0xb20]
mov byte [ebp - 4], 0
call fcn.09017177
lea ecx, [ebp - 0xb24]
mov dword [ebp - 4], 0xffffffff
call fcn.0901b295
mov esi, dword [ebp - 0xb2c]
lea eax, [esi + 8]
push eax
push 0x278
mov dword [ebp - 0xb2c], eax
call fcn.09053fcd
add esp, 8
mov dword [ebp - 0xb28], eax
mov dword [ebp - 4], 2
test eax, eax
je 0x909f1ca
push esi
mov ecx, eax
call fcn.09053fcd
mov edx, eax
jmp 0x909f1cc
xor edx, edx
mov ecx, dword [ebx + 0xc]
xorps xmm0, xmm0
movsd xmm1, qword [ebx + 0x10]
mulsd xmm1, qword [0x90bee38]
mov eax, dword [ecx]
mov dword [edx + 0x68], eax
mov eax, dword [ecx + 4]
comisd xmm0, xmm1
mov dword [edx + 0x6c], eax
jbe 0x909f1fa
subsd xmm1, qword [0x90b4780]
jmp 0x909f202
addsd xmm1, qword [0x90b4780]
cvttsd2si eax, xmm1
lea edi, [edx + 0x72]
mov ecx, 0x80
lea esi, [ebp - 0xb18]
rep movsd dword es:[edi], dword [esi]
mov word [edx + 0x70], ax
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.09001f80
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push 0x6250726f
call fcn.09053fcd
int3
Function at 0x2e01416e
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x2e0306d8
call fcn.2e001511
mov edi, ecx
mov dword [ebp - 0x18], edi
xor ebx, ebx
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ebx
mov byte [edi], bl
mov dword [ebp - 4], ebx
call fcn.2e014eb5
test ax, ax
je 0x2e014216
lea eax, [ebp - 0x10]
push eax
push str.softwaremicrosoftwindows_shell_associationsurlassociationshttpuserchoice
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e014216
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push str.progid
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e01420d
mov eax, dword [ebp - 0x14]
inc eax
push eax
call fcn.2e0289f3
mov esi, eax
pop ecx
mov dword [ebp - 0x1c], esi
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
push esi
push ebx
push ebx
push str.progid
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e014200
push esi
mov ecx, edi
call fcn.2e010e6c
push 1
push esi
mov byte [ebp - 4], bl
call fcn.2e0289f3
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
call fcn.2e00155b
ret

Function at 0x2e014ca3
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x2e030759
call fcn.2e02e6de
mov esi, dword [ebp + 8]
xor eax, eax
mov bl, al
mov edi, dword [ebp + 0xc]
cmp dword [ecx + 0x10], eax
jbe 0x2e014da7
push ecx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
call fcn.2e014b8d
and dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
push esi
call fcn.2e010d8f
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x30]
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e014d65
lea eax, [ebp - 0x2c]
push eax
push 0
push 0x2e033941
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x2e014d5c
mov eax, dword [ebp - 0x2c]
inc eax
push eax
call fcn.2e0289f3
mov esi, eax
pop ecx
mov dword [ebp - 0x34], esi
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
push eax
push esi
push 0
push 0
push 0x2e033941
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e014d4e
push esi
mov ecx, edi
call fcn.2e010e6c
mov bl, 1
push 1
push esi
mov byte [ebp - 4], 0
call fcn.2e0289f3
pop ecx
pop ecx
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x2e014da7
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 4], 2
cmp eax, 0x1000
jb 0x2e014d9e
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.2e0289f3
mov eax, dword [ebp - 0x2c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x34]
push eax
push ecx
call fcn.2e0289f3
pop ecx
pop ecx
mov al, bl
call fcn.2e02e6bc
ret 8
Function at 0x2e014de1
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc
mov eax, 0x2e03078d
call fcn.2e001511
lea eax, [ebp - 0x10]
xor ebx, ebx
push eax
push dword [ebp + 8]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x2e014e1b
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e014e81
lea eax, [ebp - 0x14]
mov edi, 0x2e033941
push eax
push ebx
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x2e014e78
mov eax, dword [ebp - 0x14]
test eax, eax
js 0x2e014e78
inc eax
push eax
call fcn.2e0289f3
mov esi, eax
pop ecx
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x14]
mov dword [ebp - 4], ebx
push eax
push esi
push ebx
push ebx
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e014e6a
mov ecx, dword [ebp + 0xc]
push esi
call fcn.2e010e6c
mov bl, 1
or dword [ebp - 4], 0xffffffff
push 1
push esi
call fcn.2e0289f3
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
call fcn.2e00155b
ret 8
Function at 0x2e01e565
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x2e030a97
call fcn.2e02e6de
lea eax, [ebp - 0x2c]
xor ebx, ebx
push eax
push str.softwaremicrosoftwindows_shell_associationsurlassociationshttpuserchoice
push 0x80000001
mov edi, ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e01e683
lea eax, [ebp - 0x30]
push eax
push ebx
push ebx
push ebx
push str.progid
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e01e67a
mov eax, dword [ebp - 0x30]
inc eax
push eax
call fcn.2e0289f3
mov esi, eax
pop ecx
mov dword [ebp - 0x3c], esi
lea eax, [ebp - 0x30]
mov dword [ebp - 4], ebx
push eax
push esi
push ebx
push ebx
push str.progid
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor ecx, ecx
inc ecx
test eax, eax
jne 0x2e01e66d
push esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.2e010e6c
push str.IE.HTTP
lea ecx, [ebp - 0x28]
call fcn.2e0289f3
test al, al
jne 0x2e01e620
push ebx
push str.AppX
lea ecx, [ebp - 0x28]
call fcn.2e0289f3
push 1
test eax, eax
pop edx
cmove edi, edx
jmp 0x2e01e623
xor edx, edx
inc edx
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x2e01e65d
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], ecx
mov byte [ebp - 4], dl
cmp eax, 0x1000
jb 0x2e01e654
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.2e0289f3
mov eax, dword [ebp - 0x34]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x38]
push eax
push ecx
call fcn.2e0289f3
pop ecx
pop ecx
xor ecx, ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
inc ecx
mov byte [ebp - 0x28], bl
or dword [ebp - 4], 0xffffffff
push ecx
push esi
call fcn.2e0289f3
pop ecx
pop ecx
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ax, di
call fcn.2e02e6bc
ret
Function at 0x2e0289f3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x2e028a02
pop dword [ebp - 0xc]
mov eax, 0x4da48855
sub eax, 0x1fa1fe53
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x74c960e8
add dword [ebp - 0x1c], 0xd988e463
mov dword [ebp - 0x18], 0x9a4d756a
sub dword [ebp - 0x18], 0x681a2925
mov dword [ebp - 0x14], 0x5bf0b106
sub dword [ebp - 0x14], 0xfa46cd8
mov dword [ebp - 0x10], 0xdddc0cf0
add dword [ebp - 0x10], 0x2223f310
lea eax, [ebp - 0x1c]
push eax
mov eax, 0xc458fd80
add eax, 0x69aa3348
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0xa591f4c1
add dword [ebp - 0x1c], 0xcee07495
mov dword [ebp - 0x18], 0x51e0572e
sub dword [ebp - 0x18], 0x1073f5b9
mov dword [ebp - 0x14], 0xddb91561
sub dword [ebp - 0x14], 0x7a49a8f5
mov dword [ebp - 0x10], 0xca190f84
sub dword [ebp - 0x10], 0xca190f84
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x3fc2a
push 0
call eax
mov ecx, 0x66c792ed
sub ecx, 0x66c75027
xor esi, esi
add esi, eax
mov edi, 0xfed50cb2
add edi, 0x2f30714e
add edi, dword [ebp - 0xc]
mov ebx, 0x86aa63bc
sub ebx, 0x42f7de5b
add dword [ebp - 8], 0x8950a70c
mov edx, dword [edi]
add dword [ebp - 4], edx
xor edx, ebx
xor dword [ebp - 8], esi
mov dword [esi], edx
xor dword [ebp - 8], edx
add esi, 0x5338848c
sub esi, 0x53388488
add edi, 4
loop 0x2e028b21
add eax, 0x3882b629
add eax, 0xc77e47c2
xor ebx, ebx
add ebx, eax
add eax, 0x381803b0
add eax, 0xc7e7fc55
mov ecx, 0xf9775dea
sub ecx, 0xcb775dea
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x4020f0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x4080b4
call sym._EnterCriticalSection_4
mov ebx, dword [0x4080ac]
sub esp, 4
test ebx, ebx
je 0x40213b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x402134
test esi, esi
je 0x402134
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402110
mov dword [esp], 0x4080b4
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x402320
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
lea esi, [esp + 0x24]
lea ebx, [eax + 0x40]
mov dword [esp + 4], 1
mov dword [esp + 0xc], ebx
mov dword [esp], str.Mingw_runtime_failure:_n
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x402370
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, edx
push esi
mov esi, ecx
push ebx
mov ebx, eax
sub esp, 0x3c
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x402444
mov eax, dword [esp + 0x28]
cmp eax, 0x40
je 0x4023ae
cmp eax, 4
jne 0x4023d0
test esi, esi
je 0x4023c2
xor eax, eax
movzx ecx, byte [edi + eax]
mov byte [ebx + eax], cl
add eax, 1
cmp eax, esi
jb 0x4023b4
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x20]
lea ebp, [esp + 0x10]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov ecx, dword [esp + 0x28]
test esi, esi
je 0x40240f
xor edx, edx
movzx eax, byte [edi + edx]
mov byte [ebx + edx], al
add edx, 1
cmp edx, esi
jb 0x402401
cmp ecx, 0x40
je 0x4023c2
cmp ecx, 4
je 0x4023c2
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00402320
lea esi, [esi]
Function at 0x4013fc
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov esi, 0x49f450
cmp dword [esi], 0
jne 0x401442
push 0x644
push 0
call sub.KERNEL32.DLL_TerminateProcess
mov ecx, eax
test ecx, ecx
jne 0x40141f
xor eax, eax
pop esi
pop ebx
ret
mov eax, dword [0x49f44c]
mov dword [ecx], eax
mov dword [0x49f44c], ecx
xor edx, edx
mov eax, edx
add eax, eax
lea eax, [ecx + eax*8 + 4]
mov ebx, dword [esi]
mov dword [eax], ebx
mov dword [esi], eax
inc edx
cmp edx, 0x64
jne 0x40142e
mov eax, dword [esi]
mov edx, dword [eax]
mov dword [esi], edx
pop esi
pop ebx
ret

Function at 0x401a88
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
push ebp
push 0x401b3e
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x49f434
call sub.KERNEL32.DLL_VirtualQuery
cmp byte [0x49f045], 0
je 0x401ab6
push 0x49f434
call sub.KERNEL32.DLL_WaitForSingleObject
mov eax, 0x49f454
call fcn.0040144c
mov eax, 0x49f464
call fcn.0040144c
mov eax, 0x49f490
call fcn.0040144c
push 0xff8
push 0
call sub.KERNEL32.DLL_TerminateProcess
mov dword [0x49f48c], eax
cmp dword [0x49f48c], 0
je 0x401b1d
mov eax, 3
mov edx, dword [0x49f48c]
xor ecx, ecx
mov dword [edx + eax*4 - 0xc], ecx
inc eax
cmp eax, 0x401
jne 0x401af3
mov eax, 0x49f474
mov dword [eax + 4], eax
mov dword [eax], eax
mov dword [0x49f480], eax
mov byte [0x49f42c], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x401b45
cmp byte [0x49f045], 0
je 0x401b3d
push 0x49f434
call sub.KERNEL32.DLL_WinExec
ret

Function at 0x401b4c
Capabilities:
Create process on windows
Terminate thread
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
cmp byte [0x49f42c], 0
je 0x401c29
xor edx, edx
push ebp
push 0x401c22
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [0x49f045], 0
je 0x401b7e
push 0x49f434
call sub.KERNEL32.DLL_WaitForSingleObject
mov byte [0x49f42c], 0
mov eax, dword [0x49f48c]
push eax
call sub.KERNEL32.DLL_TerminateThread
xor eax, eax
mov dword [0x49f48c], eax
mov ebx, dword [0x49f454]
jmp 0x401bb1
push 0x8000
push 0
mov eax, dword [ebx + 8]
push eax
call sub.KERNEL32.DLL_VirtualAlloc
mov ebx, dword [ebx]
cmp ebx, 0x49f454
jne 0x401b9f
mov eax, 0x49f454
call fcn.0040144c
mov eax, 0x49f464
call fcn.0040144c
mov eax, 0x49f490
call fcn.0040144c
mov eax, dword [0x49f44c]
test eax, eax
je 0x401bf7
mov edx, dword [eax]
mov dword [0x49f44c], edx
push eax
call sub.KERNEL32.DLL_TerminateThread
mov eax, dword [0x49f44c]
test eax, eax
jne 0x401be0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x401c29
cmp byte [0x49f045], 0
je 0x401c17
push 0x49f434
call sub.KERNEL32.DLL_WinExec
push 0x49f434
call sub.KERNEL32.DLL_WriteFile
ret
pop ebx
pop ebp
ret
Function at 0x40215c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, eax
cmp byte [0x49f42c], 0
jne 0x402183
call fcn.00401a88
test al, al
jne 0x402183
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4022d7
xor ecx, ecx
push ebp
push 0x4022d0
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x49f045], 0
je 0x4021a4
push 0x49f434
call sub.KERNEL32.DLL_WaitForSingleObject
add ebx, 7
and ebx, 0xfffffffc
cmp ebx, 0xc
jge 0x4021b4
mov ebx, 0xc
cmp ebx, 0x1000
jg 0x402253
mov eax, ebx
test eax, eax
jns 0x4021c9
add eax, 3
sar eax, 2
mov edx, dword [0x49f48c]
mov edx, dword [edx + eax*4 - 0xc]
test edx, edx
je 0x402253
mov esi, edx
mov eax, esi
add eax, ebx
and dword [eax], 0xfffffffe
mov eax, dword [edx + 4]
cmp edx, eax
jne 0x402204
mov eax, ebx
test eax, eax
jns 0x4021f3
add eax, 3
sar eax, 2
mov ecx, dword [0x49f48c]
xor edi, edi
mov dword [ecx + eax*4 - 0xc], edi
jmp 0x40222a
mov ecx, ebx
test ecx, ecx
jns 0x40220d
add ecx, 3
sar ecx, 2
mov edi, dword [0x49f48c]
mov dword [edi + ecx*4 - 0xc], eax
mov ecx, dword [edx]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, esi
mov edx, dword [edx + 8]
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x49f420]
sub ebx, 4
add dword [0x49f424], ebx
call fcn.00403768
jmp 0x4022d7
cmp ebx, dword [0x49f484]
jg 0x4022a5
sub dword [0x49f484], ebx
cmp dword [0x49f484], 0xc
jge 0x402277
add ebx, dword [0x49f484]
xor eax, eax
mov dword [0x49f484], eax
mov eax, dword [0x49f488]
add dword [0x49f488], ebx
mov edx, ebx
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x49f420]
sub ebx, 4
add dword [0x49f424], ebx
call fcn.00403768
jmp 0x4022d7
mov eax, ebx
call fcn.00402068
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4022d7
cmp byte [0x49f045], 0
je 0x4022cf
push 0x49f434
call sub.KERNEL32.DLL_WinExec
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4022e4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
mov dword [0x49f430], eax
cmp byte [0x49f42c], 0
jne 0x40231c
call fcn.00401a88
test al, al
jne 0x40231c
mov dword [0x49f430], 8
mov dword [ebp - 4], 8
jmp 0x40247d
xor ecx, ecx
push ebp
push 0x402476
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x49f045], 0
je 0x40233d
push 0x49f434
call sub.KERNEL32.DLL_WaitForSingleObject
mov esi, ebx
sub esi, 4
mov ebx, dword [esi]
test bl, 2
jne 0x402358
mov dword [0x49f430], 9
jmp 0x40244d
dec dword [0x49f420]
mov eax, ebx
and eax, 0x7ffffffc
sub eax, 4
sub dword [0x49f424], eax
test bl, 1
je 0x4023b8
mov eax, esi
sub eax, 0xc
mov edx, dword [eax + 8]
cmp edx, 0xc
jl 0x402388
test edx, 0x80000003
je 0x402397
mov dword [0x49f430], 0xa
jmp 0x40244d
mov eax, esi
sub eax, edx
cmp edx, dword [eax + 8]
je 0x4023af
mov dword [0x49f430], 0xa
jmp 0x40244d
add ebx, edx
mov esi, eax
call fcn.00401c2c
and ebx, 0x7ffffffc
mov eax, esi
add eax, ebx
mov edi, eax
cmp edi, dword [0x49f488]
jne 0x4023f8
sub dword [0x49f488], ebx
add dword [0x49f484], ebx
cmp dword [0x49f484], 0x3c00
jle 0x4023e9
call fcn.00401f04
xor eax, eax
mov dword [ebp - 4], eax
call fcn.00403768
jmp 0x40247d
mov edx, dword [eax]
test dl, 2
je 0x40241b
and edx, 0x7ffffffc
cmp edx, 4
jge 0x402416
mov dword [0x49f430], 0xb
jmp 0x40244d
or dword [eax], 1
jmp 0x402444
mov eax, edi
cmp dword [eax + 4], 0
je 0x40242e
cmp dword [eax], 0
je 0x40242e
cmp dword [eax + 8], 0xc
jge 0x40243a
mov dword [0x49f430], 0xb
jmp 0x40244d
mov edx, dword [eax + 8]
add ebx, edx
call fcn.00401c2c
mov edx, ebx
mov eax, esi
call fcn.00401e7c
mov eax, dword [0x49f430]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40247d
cmp byte [0x49f045], 0
je 0x402475
push 0x49f434
call sub.KERNEL32.DLL_WinExec
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4029b4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
lea eax, [ebp - 0x18]
push eax
call sub.KERNEL32.DLL_GetTempFileNameA
movzx eax, word [ebp - 0x10]
imul eax, eax, 0x3c
add ax, word [ebp - 0xe]
imul eax, eax, 0x3c
xor edx, edx
mov dx, word [ebp - 0xc]
add eax, edx
imul eax, eax, 0x3e8
mov dx, word [ebp - 0xa]
add eax, edx
mov dword [0x49f040], eax
mov esp, ebp
pop ebp
ret

Function at 0x402c24
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x49f040], 0x8088405
inc edx
mov dword [0x49f040], edx
mul edx
mov eax, edx
ret

Function at 0x404374
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, edx
mov eax, dword [ebx]
test eax, eax
je 0x40438c
mov dword [ebx], 0
push eax
call sub.user32.dll_ShowWindow
add ebx, 4
dec esi
jne 0x40437a
pop esi
pop ebx
ret

Function at 0x404440
Capabilities:
Hide graphical window

Disassembly:
mov al, 1
jmp fcn.004027a8
test ecx, ecx
je fcn.0040435c
push eax
push ecx
push edx
call sub.user32.dll_ShowOwnedPopups
test eax, eax
je 0x404344
pop edx
push dword [edx]
mov dword [edx], eax
call sub.user32.dll_ShowWindow
ret