joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48f3af
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4a2484]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0047f164
mov dword [ebp - 0x14], eax
cmp dword [0xa9cb90], esi
jne 0x48f4a2
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x48f42f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x48f582
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x48f582
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48f582
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0xa9cb90], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0xa9cb94], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0xa9cb98], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0xa9cba0], eax
test eax, eax
je 0x48f49f
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0xa9cb9c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x48f4c7
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x48f4ba
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x48f4dc
push 4
pop eax
jmp 0x48f584
cmp dword [ebp - 0x14], esi
je 0x48f4dc
push dword [0xa9cb90]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x48f4c1
mov eax, dword [0xa9cb9c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x48f53a
cmp dword [0xa9cba0], edi
je 0x48f53a
push eax
call ebx
push dword [0xa9cba0]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x48f53a
test eax, eax
je 0x48f53a
call ecx
test eax, eax
je 0x48f52f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x48f52f
test byte [ebp - 8], 1
jne 0x48f53a
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x48f56a
mov eax, dword [0xa9cb94]
cmp eax, edi
je 0x48f567
push eax
call ebx
test eax, eax
je 0x48f567
call eax
mov esi, eax
test esi, esi
je 0x48f567
mov eax, dword [0xa9cb98]
cmp eax, edi
je 0x48f567
push eax
call ebx
test eax, eax
je 0x48f567
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0xa9cb90]
call ebx
test eax, eax
je 0x48f582
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x48f584
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047e60b
mov esp, ebp
pop ebp
ret
Function at 0x401030
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x428a68
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4322d0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
xor ebx, ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
lea edi, [esi + 0xc]
mov dword [esp + 0x1c], ebx
push edi
mov dword [esi], vtable.CConfigTcpClient.0
call fcn.004037a0
xor eax, eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x5c], ebx
mov eax, 0xf
mov dword [esi + 0x60], eax
mov byte [esi + 0x4c], bl
mov dword [esi + 0x7c], eax
mov dword [esi + 0x78], ebx
mov byte [esi + 0x68], bl
mov dword [esi + 0x98], eax
mov dword [esi + 0x94], ebx
mov byte [esi + 0x84], bl
mov dword [esi + 0xb4], eax
mov dword [esi + 0xb0], ebx
mov byte [esi + 0xa0], bl
mov dword [esi + 0xd0], eax
mov dword [esi + 0xcc], ebx
mov byte [esi + 0xbc], bl
mov dword [esi + 0xec], eax
mov dword [esi + 0xe8], ebx
mov byte [esi + 0xd8], bl
mov eax, edi
mov dword [esi + 0xf0], ebx
mov dword [esi + 0xf4], ebx
call fcn.00403890
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4

Function at 0x401b50
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x4290e8
mov eax, dword fs:[0]
push eax
sub esp, 0x114
mov eax, dword [0x4322d0]
xor eax, esp
mov dword [esp + 0x110], eax
push ebx
push esi
mov eax, dword [0x4322d0]
xor eax, esp
push eax
lea eax, [esp + 0x120]
mov dword fs:[0], eax
lea eax, [esp + 0x24]
push eax
call fcn.00401030
lea ecx, [esp + 0xc]
xor ebx, ebx
push ecx
mov dword [esp + 0x12c], ebx
call fcn.004037a0
lea edx, [esp + 0xc]
mov dword [0x434a50], edx
lea eax, [esp + 0x2c]
push eax
push ebx
lea ecx, [esp + 0x2c]
push ecx
push 0x402790
push ebx
push ebx
mov byte [esp + 0x140], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esp + 0x28], eax
cmp eax, ebx
jne 0x401bdf
lea edx, [esp + 0xc]
push edx
jmp 0x401c2d
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [esp + 0x30]
lea esi, [esp + 0xc]
call fcn.0040ca40
test eax, eax
je 0x401c28
call fcn.004026f0
mov eax, esi
push eax
mov byte [esp + 0x12c], bl
call fcn.0040c3e0
lea ecx, [esp + 0x24]
mov dword [esp + 0x128], 0xffffffff
call fcn.00401110
mov eax, 1
jmp 0x401c4f
lea ecx, [esp + 0xc]
push ecx
mov byte [esp + 0x12c], bl
call fcn.0040c3e0
lea ecx, [esp + 0x24]
mov dword [esp + 0x128], 0xffffffff
call fcn.00401110
xor eax, eax
mov ecx, dword [esp + 0x120]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.00412dd0
add esp, 0x120
ret
Function at 0x401c80
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x110
mov eax, dword [0x4322d0]
xor eax, esp
mov dword [esp + 0x10c], eax
push esi
push edi
push str.7A23EC47_F9C9_4b1a_A812_489C7A8C8927
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x401d1d
call fcn.00405660
test eax, eax
je 0x401d1d
push 0x103
lea eax, [esp + 0xd]
push 0
push eax
mov byte [esp + 0x14], 0
call fcn.00418240
add esp, 0xc
lea edi, [esp + 8]
call fcn.0040c150
mov ecx, edi
push str.Windows_7
push ecx
call fcn.00413370
add esp, 8
test eax, eax
jne 0x401d00
call fcn.004115c0
jmp 0x401d0e
call fcn.004117c0
test eax, eax
je 0x401d0e
call fcn.00411900
call fcn.00403fb0
call fcn.00401b50
call sub.WSOCK32.dll_WSACleanup
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x114]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.00412dd0
mov esp, ebp
pop ebp
ret 0x10
Function at 0x403f50
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x5004
call fcn.0041d300
mov eax, dword [0x4322d0]
xor eax, esp
mov dword [esp + 0x5000], eax
mov ecx, dword [esp + 0x5008]
lea eax, [esp + 0x500c]
push eax
push ecx
lea edx, [esp + 8]
push 0x5000
push edx
call fcn.004137f8
add esp, 0x10
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [esp + 0x5000]
xor ecx, esp
call fcn.00412dd0
add esp, 0x5004
ret

Function at 0x404110
Capabilities:
Enumerate process modules
Print debug messages

Disassembly:
sub esp, 0x244
mov eax, dword [0x4322d0]
xor eax, esp
mov dword [esp + 0x240], eax
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.Enter_SetWindowsAPIHook_
call ebp
cmp dword [esi], 0
jne 0x40414f
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x240]
xor ecx, esp
call fcn.00412dd0
add esp, 0x244
ret
cmp dword [esi + 4], 0
je 0x404137
cmp dword [esi + 8], 0
je 0x404137
cmp dword [esi + 0x10], 0
jne 0x4041de
push ebx
push edi
push 0x220
lea eax, [esp + 0x30]
push 0
push eax
mov dword [esp + 0x34], 0x224
call fcn.00418240
add esp, 0xc
push 0x1c
lea ecx, [esp + 0x10]
push ecx
push fcn.00404080
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov edi, dword [esp + 0x10]
push 0
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea edx, [esp + 0x28]
mov ebx, eax
push edx
push ebx
call sub.KERNEL32.dll_Module32First
test eax, eax
je 0x4041d3
nop
mov eax, dword [esp + 0x44]
cmp eax, edi
je 0x4041c4
push esi
mov dword [esi + 0x10], eax
call fcn.00404080
add esp, 4
lea eax, [esp + 0x28]
push eax
push ebx
call sub.KERNEL32.dll_Module32Next
test eax, eax
jne 0x4041b0
push str.Exit_SetWindowsAPIHook_
call ebp
pop edi
pop ebx
jmp 0x4041e7
push esi
call fcn.00404080
add esp, 4
mov ecx, dword [esp + 0x244]
pop ebp
xor ecx, esp
mov eax, 1
call fcn.00412dd0
add esp, 0x244
ret

Function at 0x405660
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x1a0
mov eax, dword [0x4322d0]
xor eax, esp
mov dword [esp + 0x198], eax
mov eax, dword [0x434a4c]
push esi
test eax, eax
jne 0x4056bb
lea eax, [esp + 8]
push eax
push 0x202
call sub.WSOCK32.dll_WSAStartup
test eax, eax
je 0x4056b1
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1f4
call esi
lea ecx, [esp + 8]
push ecx
push 0x202
call sub.WSOCK32.dll_WSAStartup
test eax, eax
jne 0x405697
mov eax, 1
mov dword [0x434a4c], eax
mov ecx, dword [esp + 0x19c]
pop esi
xor ecx, esp
call fcn.00412dd0
add esp, 0x1a0
ret
Function at 0x4056e0
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
push edi
xor edi, edi
cmp ebx, edi
jne 0x4056ed
mov al, 1
pop edi
pop ecx
ret
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
push esi
xor esi, esi
mov dword [esp + 0xc], edi
jmp 0x405700
mov ecx, dword [esp + 0x18]
push 0
mov eax, ebx
sub eax, esi
push eax
mov eax, dword [esp + 0x1c]
lea edx, [esi + ecx]
push edx
push eax
call sub.WSOCK32.dll_send
test eax, eax
jle 0x40572b
add esi, eax
xor edi, edi
cmp esi, ebx
jae 0x40574b
push 2
call ebp
jmp 0x405700
jge 0x40574b
cmp edi, 5
jae 0x40574b
cmp dword [esp + 0xc], 5
jae 0x40574b
test edi, edi
jne 0x405741
inc dword [esp + 0xc]
push 0x3e8
call ebp
inc edi
jmp 0x405700
xor eax, eax
cmp esi, ebx
pop esi
pop ebp
sete al
pop edi
pop ecx
ret

Function at 0x405780
Capabilities:
Connect socket
Get socket status

Disassembly:
sub esp, 0x21c
push ebx
lea eax, [esp + 4]
push eax
push 0x8004667e
push esi
mov dword [esp + 0x10], 1
call sub.WSOCK32.dll_ioctlsocket
push 0x10
push edi
push esi
test eax, eax
jne 0x405850
xor ebx, ebx
call sub.WSOCK32.dll_connect
cmp eax, 0xffffffff
jne 0x4057be
call sub.WSOCK32.dll_WSAGetLastError
mov ebx, eax
lea ecx, [esp + 4]
push ecx
push 0x8004667e
push esi
mov dword [esp + 0x10], 0
call sub.WSOCK32.dll_ioctlsocket
cmp eax, 0xffffffff
jne 0x4057ed
cmp ebx, 0x2733
je 0x4057ed
or eax, eax
pop ebx
add esp, 0x21c
ret
mov edx, dword [esp + 0x224]
mov eax, 1
mov dword [esp + 0x10], eax
mov dword [esp + 0x118], eax
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x11c]
push ecx
mov dword [esp + 0x10], edx
lea edx, [esp + 0x18]
push edx
push 0
push 0
mov dword [esp + 0x28], esi
mov dword [esp + 0x130], esi
mov dword [esp + 0x20], 0
call sub.WSOCK32.dll_select
lea eax, [esp + 0x10]
push eax
push esi
call sub.WSOCK32.dll___WSAFDIsSet
neg eax
sbb eax, eax
neg eax
dec eax
pop ebx
add esp, 0x21c
ret
call sub.WSOCK32.dll_connect
pop ebx
add esp, 0x21c
ret
Function at 0x405860
Capabilities:
Parse url

Disassembly:
sub esp, 0x834
mov eax, dword [0x4322d0]
xor eax, esp
mov dword [esp + 0x830], eax
mov eax, dword [esp + 0x83c]
push esi
push edi
mov edi, dword [esp + 0x840]
mov esi, edx
mov dword [esp + 8], eax
mov dword [esp + 0x10], ecx
test edi, edi
je 0x4059f4
test esi, esi
je 0x4059f4
push ebx
push ebp
push 0x2000000
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x24]
push eax
push esi
mov dword [esp + 0x24], 0x824
xor ebp, ebp
call dword [sym.imp.WININET.dll_InternetCanonicalizeUrlA]
test eax, eax
jne 0x405921
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x405906
mov ecx, dword [esp + 0x14]
push ecx
call fcn.004124f2
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x405906
push 0x2000000
lea edx, [esp + 0x18]
push edx
push ebx
push esi
mov ebp, 1
call dword [sym.imp.WININET.dll_InternetCanonicalizeUrlA]
test eax, eax
jne 0x405925
push ebx
call fcn.0041361a
add esp, 4
xor eax, eax
pop ebp
pop ebx
pop edi
pop esi
mov ecx, dword [esp + 0x830]
xor ecx, esp
call fcn.00412dd0
add esp, 0x834
ret
lea ebx, [esp + 0x1c]
push edi
push 0
push 0
push ebx
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
mov esi, eax
test ebp, ebp
je 0x405940
push ebx
call fcn.0041361a
add esp, 4
test esi, esi
jne 0x405952
mov eax, dword [esp + 0x10]
mov dword [eax], 0x1000
mov eax, esi
jmp 0x405908
mov cx, word [edi + 0x18]
mov edx, dword [esp + 0x18]
mov word [edx], cx
mov edi, dword [edi + 0xc]
lea eax, [edi - 1]
cmp eax, 6
ja case.default.0x405968
jmp dword [eax*4 + 0x405a10]
mov eax, dword [esp + 0x10]
mov dword [eax], 1
mov eax, esi
jmp 0x405908
mov ecx, dword [esp + 0x10]
mov dword [ecx], 2
mov eax, esi
jmp 0x405908
mov edx, dword [esp + 0x10]
mov dword [edx], 3
mov eax, esi
jmp 0x405908
mov eax, dword [esp + 0x10]
mov dword [eax], 0x100b
mov eax, esi
jmp 0x405908
mov ecx, dword [esp + 0x10]
mov dword [ecx], 0x1001
mov eax, esi
jmp 0x405908
mov edx, dword [esp + 0x10]
mov dword [edx], 0x1006
mov eax, esi
jmp 0x405908
mov eax, dword [esp + 0x10]
mov dword [eax], 0x1002
mov eax, esi
jmp 0x405908
mov ecx, dword [esp + 0x10]
mov dword [ecx], 0x1000
mov eax, esi
jmp 0x405908
mov ecx, dword [esp + 0x838]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.00412dd0
add esp, 0x834
ret
Function at 0x405c80
Capabilities:
Print debug messages
Resolve dns
Set socket configuration

Disassembly:
push str.localhost
push esi
call fcn.00414925
add esp, 8
test eax, eax
jne 0x405c9d
push str.127.0.0.1
call sub.WSOCK32.dll_inet_addr
ret
mov eax, esi
call fcn.00405bf0
push esi
test eax, eax
jne 0x405c97
call sub.WSOCK32.dll_gethostbyname
test eax, eax
je 0x405cbd
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov eax, dword [ecx]
test eax, eax
jne 0x405d0e
call sub.WSOCK32.dll_WSAGetLastError
add eax, 0xffffd507
cmp eax, 3
ja case.default.0x405ccc
jmp dword [eax*4 + 0x405d10]
push str.The_host_was_not_found._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
or eax, 0xffffffff
ret
push str.The_name_is_valid_but_it_has_no_address._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
or eax, 0xffffffff
ret
push str.A_non_recoverable_name_server_error_occurred._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
or eax, 0xffffffff
ret
push str.The_name_server_is_temporarily_unavailable.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
or eax, 0xffffffff
ret
Function at 0x407cc0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x4281db
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4322d0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00412596
push 4
mov dword [esp + 0x20], 0
call fcn.00412e82
mov edi, eax
add esp, 4
test edi, edi
je 0x407d3e
call fcn.004128fb
mov dword [edi], eax
call fcn.00412729
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.00412557
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x407d33
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.0041257f
jmp 0x407d40
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x40b130
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 0xc]
push eax
push 4
push esi
push 0x40b100
push 0
push 0
call fcn.00414767
add esp, 0x18
mov dword [esi + 4], eax
test eax, eax
setne al
pop esi
ret

Function at 0x40b160
Capabilities:
Resume thread

Disassembly:
mov eax, dword [ecx + 4]
test eax, eax
je 0x40b16e
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov al, 1
ret

Function at 0x40b580
Capabilities:
Extract http body

Disassembly:
push 0xffffffffffffffff
push 0x428270
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4322d0]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x48]
mov esi, dword [ebp + 0x10]
mov eax, dword [esi]
mov ecx, dword [eax + 0xf0]
push 0xffffffffffffffff
push esi
call ecx
mov edx, dword [esi]
mov ecx, dword [edx + 0x48]
lea eax, [esp + 0x18]
push eax
push esi
call ecx
xor esi, esi
cmp eax, esi
jge 0x40b5dc
push 1
mov edi, ebp
call fcn.0040c0b0
jmp 0x40b733
mov eax, dword [esp + 0x18]
mov dword [esp + 0x14], esi
cmp eax, esi
je 0x40b5fd
mov edx, dword [eax]
mov edx, dword [edx]
lea ecx, [esp + 0x14]
push ecx
push 0x42a3bc
push eax
call edx
mov eax, dword [esp + 0x18]
mov dword [esp + 0x40], esi
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x14]
cmp eax, esi
je 0x40b712
lea edx, [esp + 0x48]
mov dword [esp + 0x48], esi
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x1b0]
call eax
cmp dword [esp + 0x48], esi
je 0x40b712
cmp dword [ebp + 0x70], 0x10
jb 0x40b63e
mov eax, dword [ebp + 0x5c]
jmp 0x40b641
lea eax, [ebp + 0x5c]
push eax
lea ebx, [esp + 0x20]
call fcn.0040b370
mov byte [esp + 0x40], 1
call fcn.0040b2f0
mov edi, eax
mov dword [esp + 0x24], edi
cmp edi, esi
jne 0x40b669
push 0x8007000e
call fcn.00406980
lea esi, [esp + 0x1c]
mov byte [esp + 0x40], 2
call fcn.00402db0
mov eax, dword [eax]
test eax, eax
jne 0x40b6e1
xor esi, esi
mov dword [esp + 0x20], esi
lea edx, [esp + 0x28]
push edx
mov byte [esp + 0x44], 3
mov eax, dword [esp + 0x4c]
mov ecx, dword [eax]
push edi
push esi
push eax
mov eax, dword [ecx + 0x110]
call eax
push esi
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ebx, eax
call esi
push edi
mov byte [esp + 0x44], 1
call esi
mov eax, dword [esp + 0x48]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
test ebx, ebx
jl 0x40b6fc
mov eax, dword [ebp + 4]
push 0
push 0
push 0x468
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageA]
lea edi, [esp + 0x1c]
call fcn.00402d60
xor esi, esi
jmp 0x40b71b
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [esp + 0x20], esi
test esi, esi
jne 0x40b683
push 0x8007000e
call fcn.00406980
push 1
mov edi, ebp
call fcn.0040c0b0
lea edi, [esp + 0x1c]
call fcn.00402d60
xor esi, esi
jmp 0x40b71b
push 1
mov edi, ebp
call fcn.0040c0b0
mov dword [esp + 0x40], 0xffffffff
mov eax, dword [esp + 0x14]
cmp eax, esi
je 0x40b733
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
xor eax, eax
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret 4
Function at 0x40c150
Capabilities:
Check os version
Get system information on windows

Disassembly:
push 0xffffffffffffffff
push 0x428b5b
mov eax, dword fs:[0]
push eax
sub esp, 0xe0
mov eax, dword [0x4322d0]
xor eax, esp
mov dword [esp + 0xdc], eax
push esi
mov eax, dword [0x4322d0]
xor eax, esp
push eax
lea eax, [esp + 0xe8]
mov dword fs:[0], eax
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 7
push str.unknown
lea ecx, [esp + 0x34]
mov dword [esp + 0x50], 0x9c
mov dword [esp + 0x4c], 0xf
mov dword [esp + 0x48], 0
mov byte [esp + 0x38], 0
call fcn.00402bb0
lea ecx, [esp + 0x48]
push ecx
mov dword [esp + 0xf4], 0
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x40c2ff
mov eax, dword [esp + 0x4c]
sub eax, 4
je 0x40c2bc
mov ecx, 1
sub eax, ecx
je 0x40c25d
sub eax, ecx
jne 0x40c2ff
mov eax, dword [esp + 0x50]
sub eax, 0
je 0x40c23c
sub eax, ecx
je 0x40c21b
sub eax, ecx
jne 0x40c2ff
push str.Microsoft_Windows_8
jmp 0x40c2f6
cmp byte [esp + 0xe2], cl
lea ecx, [esp + 0x2c]
jne 0x40c232
push str.Microsoft_Windows_7
jmp 0x40c2fa
push str.Microsoft_Windows_Server_2008_R2
jmp 0x40c2fa
cmp byte [esp + 0xe2], cl
lea ecx, [esp + 0x2c]
jne 0x40c253
push str.Microsoft_Windows_Vista
jmp 0x40c2fa
push str.Microsoft_Windows_Server_2008
jmp 0x40c2fa
mov eax, dword [esp + 0x50]
sub eax, 0
je 0x40c2b5
sub eax, ecx
je 0x40c2ae
sub eax, ecx
jne 0x40c2ff
cmp byte [esp + 0xe2], cl
jne 0x40c28a
cmp word [esp + 8], 9
jne 0x40c28a
push str.Microsoft_Windows_XP_Professional_x64_Edition
jmp 0x40c2f6
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x59
call esi
test eax, eax
jne 0x40c29f
push str.Microsoft_Windows_Server_2003
jmp 0x40c2f6
push 0x59
call esi
test eax, eax
je 0x40c2ff
push str.Microsoft_Windows_Server_2003_R2
jmp 0x40c2f6
push str.Microsoft_Windows_XP
jmp 0x40c2f6
push str.Microsoft_Windows_2000
jmp 0x40c2f6
mov eax, dword [esp + 0x50]
test eax, eax
je 0x40c2dc
cmp eax, 0xa
je 0x40c2d5
cmp eax, 0x5a
jne 0x40c2ff
push str.Microsoft_Windows_Me
jmp 0x40c2f6
push str.Microsoft_Windows_98
jmp 0x40c2f6
mov eax, dword [esp + 0x58]
cmp eax, 2
jne 0x40c2ec
push str.Microsoft_Windows_NT_4.0
jmp 0x40c2f6
cmp eax, 1
jne 0x40c2ff
push str.Microsoft_Windows_95
lea ecx, [esp + 0x30]
call fcn.004027a0
mov eax, dword [esp + 0x30]
mov esi, 0x10
cmp dword [esp + 0x44], esi
jae 0x40c312
lea eax, [esp + 0x30]
push 0x104
push eax
push edi
call fcn.00413bd0
add esp, 0xc
cmp dword [esp + 0x44], esi
jb 0x40c334
mov edx, dword [esp + 0x30]
push edx
call fcn.00412ddf
add esp, 4
mov ecx, dword [esp + 0xe8]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0xdc]
xor ecx, esp
call fcn.00412dd0
add esp, 0xec
ret
Function at 0x40c360
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [0x434a50]
push edi
test esi, esi
je 0x40c3d3
cmp dword [esp + 0x18], 0x46b
jne 0x40c3d3
mov edi, dword [esi + 0x10]
sub edi, dword [esi + 0xc]
xor ebp, ebp
sar edi, 2
xor ebx, ebx
test edi, edi
jle 0x40c3c7
lea ebx, [ebx]
mov eax, esi
call fcn.0040cc10
mov eax, dword [eax]
mov ecx, dword [esp + 0x1c]
cmp dword [eax + 0x4c], ecx
jne 0x40c3b2
mov eax, esi
call fcn.0040cc10
mov edx, dword [eax]
mov dword [edx + 0x50], 1
mov eax, esi
call fcn.0040cc10
mov eax, dword [eax]
cmp dword [eax + 0x50], 0
je 0x40c3c2
inc ebp
inc ebx
cmp ebx, edi
jl 0x40c390
cmp ebp, edi
jne 0x40c3d3
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret

Function at 0x40d590
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, dword [esp + 0x10]
test ebp, ebp
jne 0x40d5a0
lea eax, [ebp + 0xd]
pop ebp
ret 0xc
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
push edi
xor edi, edi
mov esi, ebp
lea ecx, [ecx]
push esi
call ebx
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x40d5b0
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
push edi
push ebp
push 7
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc