joyce8/EMBER2024-capa huggingface dataset:
Function at 0x477188
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x1c
call fcn.00402f18
lea eax, [ebx + 0x14]
push eax
push 0
lea eax, [ebx + 0x10]
push eax
lea eax, [ebx + 0xc]
push eax
lea eax, [ebx + 8]
push eax
push 0
lea eax, [ebx + 4]
push eax
push ebx
push 0
push 0
push 0
mov eax, dword [esi + 4]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
sete al
mov edx, dword [0x497f04]
cmp byte [edx + 0xc], 0
je 0x4771ec
mov edx, dword [0x497ef8]
cmp dword [edx], 2
jne 0x4771ec
mov edx, dword [ebx + 4]
add dword [ebx + 4], edx
mov edx, dword [ebx + 0xc]
add dword [ebx + 0xc], edx
pop esi
pop ebx
ret

Function at 0x4771f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4772a8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x44]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.00477188
test al, al
je 0x47728a
mov ecx, dword [ebp - 0x1c]
inc ecx
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.00404408
mov ebx, dword [ebp - 0x20]
dec ebx
test ebx, ebx
jl 0x47728a
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.004047d8
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegEnumValueA
mov eax, dword [ebp - 0xc]
call fcn.004047d8
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.00404510
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
dec ebx
jne 0x477243
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4772af
lea eax, [ebp - 0x2c]
call fcn.00404318
lea eax, [ebp - 0xc]
call fcn.00404318
ret

Function at 0x4773a8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.004047d8
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x477400
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x497f10]
mov dl, 1
mov eax, dword [0x476d9c]
call fcn.0040c060
call fcn.00403ca8
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00476ea4
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x47e128
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov edi, dword [ebp + 8]
mov byte [ebp - 5], 0
push 0
mov eax, dword [ebx + 0x44]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
jne 0x47e197
mov eax, dword [ebp - 4]
push eax
push edi
mov eax, dword [ebp + 0xc]
push eax
push esi
mov eax, dword [ebx + 0x40]
push eax
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x47e179
mov ecx, dword [edi]
mov edx, esi
mov eax, ebx
call fcn.0047e1a4
test al, al
je 0x47e197
jmp 0x47e13f
call sub.kernel32.dll_GetLastError
cmp eax, 0x3e5
jne 0x47e18b
mov byte [ebp - 5], 1
jmp 0x47e197
cmp eax, 6
je 0x47e197
mov eax, ebx
call fcn.0047e420
mov al, byte [ebp - 5]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x47e574
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov ebx, dword [ebp + 8]
mov byte [ebp - 9], 0
xor eax, eax
mov dword [ebp - 0x10], eax
xor esi, esi
mov eax, dword [edi + 0x44]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 8]
add eax, esi
push eax
mov eax, dword [edi + 0x40]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
jne 0x47e630
call sub.kernel32.dll_GetLastError
cmp eax, 6
je 0x47e642
cmp eax, 0x3e5
je 0x47e5d8
mov eax, edi
call fcn.0047e650
jmp 0x47e642
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x18]
push eax
push 2
call sub.kernel32.dll_WaitForMultipleObjects
sub eax, 0xffffffff
je 0x47e61e
dec eax
je 0x47e642
dec eax
je 0x47e5f4
jmp 0x47e627
push 0xffffffffffffffff
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [edi + 0x40]
push eax
call sub.kernel32.dll_GetOverlappedResult
test eax, eax
jne 0x47e630
call sub.kernel32.dll_GetLastError
cmp eax, 6
je 0x47e642
mov eax, edi
call fcn.0047e650
jmp 0x47e642
mov eax, edi
call fcn.0047e650
jmp 0x47e642
mov eax, edi
call fcn.0047e650
jmp 0x47e642
sub ebx, dword [ebp - 0x10]
add esi, dword [ebp - 0x10]
test ebx, ebx
ja 0x47e5a2
mov byte [ebp - 9], 1
mov al, byte [ebp - 9]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x47faf0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47fd50
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x47fb53
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.0047f5b8
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040c92c
cmp al, 1
jne 0x47fb53
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.0047f8d0
test al, al
je 0x47fcdf
cmp dword [ebp - 8], 0
jge 0x47fb71
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.0047f5b8
mov eax, dword [ebp - 0x210]
call fcn.004045d8
cmp ebx, eax
jge 0x47fbbb
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.0047f5b8
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x497eec]
and eax, 0xff
bt dword [edx], eax
jae 0x47fbbb
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x47fbcf
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0047facc
cmp ebx, dword [ebp - 8]
je 0x47fcd1
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x47fbfb
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403710
and eax, 0x7f
movzx eax, word [eax*2 + 0x49789c]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x47fcbe
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403710
and eax, 0x7f
movzx eax, word [eax*2 + 0x49789c]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.004464e0
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403710
and eax, 0x7f
movzx eax, word [eax*2 + 0x49789c]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.004464e0
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47fcc5
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x47fd32
cmp dword [ebp - 8], 0
jge 0x47fcea
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.0047f5b8
mov eax, dword [ebp - 0x218]
call fcn.004045d8
cmp eax, dword [ebp - 8]
jg 0x47fd24
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.0047f5b8
mov eax, dword [ebp - 0x21c]
call fcn.004045d8
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0047facc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47fd57
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.0040433c
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x42e030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x407d9c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407e75
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x407dd4
mov eax, dword [ebp - 4]
call fcn.004071d0
jmp 0x407ddc
mov eax, dword [ebp - 4]
call fcn.00407bd4
call fcn.00404ae8
mov esi, eax
test esi, esi
jle 0x407e28
mov ebx, 1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x407e12
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.004071d0
jmp 0x407e24
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0x10]
call fcn.00407bd4
inc ebx
dec esi
jne 0x407dec
push 1
push dword [ebp - 4]
push 0x407e8c
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00406f34
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004032cc
mov eax, dword [ebp - 0x14]
call fcn.0040340c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407e7c
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x1fff0d3e
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
mov eax, str.IyKy
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x790959c4
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x100123c3
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x100123f6
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x100123f4
push 0x1a2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetROP2]
jmp 0x1001241f
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x1001241f
push 0
push 0
push 0
push 0
push 0x207
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esp, ebp
pop ebp
ret

Function at 0x10013e27
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10013e51
push 0
push 0
push 0
push 0
push 0x207
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x10013e62
push 0xbbb
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CombineRgn]
pop ebp
ret
Function at 0x1001e389
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001e3a7
push 0xbbb
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CombineRgn]
jmp 0x1001e3c4
push 0
push 0
push 0
push 0
push 0x207
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop ebp
ret

Function at 0x1001e857
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1001e883
push 0
push 0
push 0
push 0
push 0x207
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x1001e8ad
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1001e8ad
push 0x1a97
push 0
push 0x157
push 0
call dword [sym.imp.USER32.dll_LoadStringA]
mov esp, ebp
pop ebp
ret

Function at 0x1001e8b1
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001e8c4
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
jmp 0x1001e8e1
push 0
push 0
push 0
push 0
push 0x207
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop ebp
ret
Function at 0x1002980e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1002983b
push 0
push 0
push 0
push 0
push 0x207
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x10029864
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx]
mov eax, dword [eax + 0x24]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret

Function at 0x1002aef3
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002af2a
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1002af28
push 0
push 0
push 0
push 0
push 0x207
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x1002af47
push 0
push 0
push 0
push 0
push 0x207
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esp, ebp
pop ebp
ret
Function at 0x1002f5c9
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1002f5ed
xor eax, eax
jmp 0x1002f769
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 8]
push eax
push 1
lea eax, [ebp - 0x10]
push eax
call fcn.1002ec57
add esp, 0x10
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x1002f615
xor eax, eax
jmp 0x1002f769
push 0x271
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
call fcn.1002ed36
add esp, 0x10
cmp dword [ebp - 0xc], 0
jne 0x1002f639
xor eax, eax
jmp 0x1002f769
push 0x1f14
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
push 1
push dword [ebp - 0x10]
lea eax, [ebp - 0xc]
push eax
push 0xc57
lea eax, [ebp - 0x24]
push eax
call fcn.1002de15
add esp, 0x20
push 1
push dword [ebp - 4]
push dword [ebp + 8]
push dword [ebp - 8]
call fcn.100284e9
add esp, 0x10
push 1
lea eax, [ebp - 0x14]
push eax
push 0x4aec
push 0x724c
lea eax, [ebp - 0xc]
push eax
push 0x48c5
lea eax, [ebp - 8]
push eax
call fcn.1002ecb0
add esp, 0x1c
cmp dword [ebp - 0x14], 0
je 0x1002f6c6
push dword [ebp - 0x14]
push 0x6205
push 0x105
push 0
push 0x501a
push 0x5ac4
push dword [ebp - 4]
push 0x6341
call fcn.1002de15
add esp, 0x20
push dword [ebp - 4]
call fcn.1002dbdc
pop ecx
test eax, eax
jne 0x1002f6da
xor eax, eax
jmp 0x1002f769
lea eax, [ebp - 4]
push eax
push 0x7acd
push 0x398
push 1
call fcn.1002ed36
add esp, 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x1002f751
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x18], ecx
jne 0x1002f711
xor eax, eax
jmp 0x1002f769
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x1002f72a
xor eax, eax
jmp 0x1002f769
push 0x5909
push 0x3733
push 0x297c
lea eax, [ebp - 4]
push eax
push 1
push 0x289a
push 0x7dc
call fcn.1002ed8e
add esp, 0x1c
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x1002f762
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
jmp 0x1002f766
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x10043209
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1004334c
mov dword [ebp - 8], 0x20f89b54
mov dword [ebp - 0x10], 0xc8748afa
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x50], 0xf8c7b5c6
mov dword [ebp - 0x4c], 0xf8c7b5c6
mov dword [ebp - 0x48], 0xf8c7b5c6
mov dword [ebp - 0x44], 0xf8c7b5c6
mov dword [ebp - 0xc], 0
jmp 0x1004325c
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 3
jge 0x1004326f
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x40], 0x85f70ad6
jmp 0x10043255
mov dword [ebp - 8], 2
jmp 0x1004327f
mov eax, dword [ebp - 8]
dec eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jl 0x1004334a
mov dword [ebp - 0x14], 0xfffffff9
mov dword [ebp - 0x2c], 0xfffffffb
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x50]
dec eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x50], eax
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x40]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x2c]
jne 0x1004331f
cmp dword [ebp - 0x28], 0
je 0x10043319
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x14], 3
jb 0x100432d9
mov dword [ebp - 0x18], 1
jmp 0x100432dd
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x40]
cmp dword [ebp - 0x10], eax
jl 0x10043302
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x40], 0
jne 0x10043302
and dword [ebp - 0x1c], 0
jmp 0x10043309
mov dword [ebp - 0x1c], 1
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 8]
cmp eax, 0x1191
jl 0x1004331f
and dword [ebp - 0x20], 0
jmp 0x10043326
mov dword [ebp - 0x20], 1
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x20], eax
jl 0x10043337
mov dword [ebp - 0x24], 1
jmp 0x1004333b
and dword [ebp - 0x24], 0
imul eax, dword [ebp - 0x24], 0xf154
mov dword [ebp - 0x28], eax
jmp 0x10043278
jmp 0x10043375
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10043375
push 0
push 0
push 0
push 0
push 0x207
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esp, ebp
pop ebp
ret

Function at 0x10043486
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x100434a2
push 0x1e48
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
jmp 0x100434bf
push 0
push 0
push 0
push 0
push 0x207
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop ebp
ret
Function at 0x1004417b
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x10044220
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
and dword [ebp - 4], 0
jmp 0x100441d7
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 4]
cmp ecx, dword [eax]
jge 0x1004421e
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx]
add ecx, dword [eax + 0x24]
mov eax, dword [ebp - 4]
lea eax, [ecx + eax*2]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
mov esi, dword [ebp - 8]
add edx, dword [esi]
mov esi, dword [ebp - 0x10]
mov esi, dword [esi]
mov ax, word [ecx + eax]
mov word [esi + edx], ax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x100441d0
jmp 0x1004423d
push 0
push 0
push 0
push 0
push 0x207
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop esi
mov esp, ebp
pop ebp
ret