joyce8/EMBER2024-capa huggingface dataset:
Function at 0x61eec4
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x61eedb
add esp, 0xfffffff0
call fcn.00408ec0
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0047d424
mov eax, dword [0x70353c]
cmp byte [eax], 0
jne 0x61ef08
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x194], al
mov eax, dword [0x703ca4]
cmp word [eax + 2], 0
jne 0x61ef22
mov eax, dword [0x703ca4]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0062135c
mov eax, dword [0x703f54]
cmp word [eax + 2], 0
jne 0x61ef3c
mov eax, dword [0x703f54]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00621560
mov byte [ebx + 0x41], 0
mov dl, 1
mov eax, dword [0x517f4c]
call fcn.0051e474
mov esi, eax
mov dword [ebx + 0x54], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x621ad8
mov dl, 1
mov eax, dword [0x43fd54]
call fcn.004087d4
mov dword [ebx + 0xa8], eax
mov dl, 1
mov eax, dword [0x43fd54]
call fcn.004087d4
mov dword [ebx + 0xc8], eax
xor eax, eax
mov dword [ebx + 0x74], eax
xor eax, eax
mov dword [ebx + 0x98], eax
mov dword [ebx + 0x70], 0xff000018
mov dword [ebx + 0x8c], 0x1f4
mov byte [ebx + 0x90], 1
xor eax, eax
mov dword [ebx + 0x94], eax
mov dword [ebx + 0x88], 0x9c4
mov byte [ebx + 0x9c], 0
mov byte [ebx + 0xbd], 1
mov byte [ebx + 0xd4], 1
mov dl, 1
mov eax, dword [0x51cce8]
call fcn.00528730
mov esi, eax
mov dword [ebx + 0xb8], esi
push 0x61f12c
mov eax, dword [0x7039b8]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.00528c4c
mov eax, dword [ebx + 0xb8]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x621dc0
mov dl, 1
mov eax, dword [0x43fd54]
call fcn.004087d4
mov dword [ebx + 0xb0], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x7039b8]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_GetModuleFileNameW
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.00426384
test eax, eax
je 0x61f056
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.004261b0
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.00426368
test eax, eax
je 0x61f06e
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0xa4]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.0040b238
push ebx
push 0x620d3c
call fcn.00614074
mov dword [ebx + 0x190], eax
mov byte [ebx + 0xe8], 0
mov eax, dword [0x70353c]
cmp byte [eax], 0
jne 0x61f0bf
mov eax, ebx
call fcn.0061f2f4
mov byte [ebx + 0x6d], 1
mov byte [ebx + 0x6e], 1
mov byte [ebx + 0x6f], 1
mov byte [ebx + 0xbe], 1
mov byte [ebx + 0xe9], 0
mov byte [ebx + 0xf4], 0
xor eax, eax
mov dword [ebx + 0xec], eax
mov byte [ebx + 0xeb], 0
xor eax, eax
mov dword [ebx + 0xc0], eax
mov eax, ebx
call fcn.00621ff8
mov eax, ebx
call fcn.00622c80
mov byte [ebx + 0x196], 0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x61f123
call fcn.00408f18
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x61f620
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x188]
test eax, eax
je 0x61f6c2
cmp dword [ebx + 0xac], 0
jne 0x61f6bc
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x61f560
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0xa8]
cmp dword [eax + 8], 0
je 0x61f6bc
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x61f682
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0xa8]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x61f6bc
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [ebx + 0xa8]
mov edx, esi
call fcn.0046825c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x61f691
inc dword [ebx + 0xac]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x61f968
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x70b7cc]
cmp dword [eax + 0x188], 0
je 0x61fad1
test bl, bl
jne 0x61fa24
cmp dword [esi + 0xb4], 0
jne 0x61fa19
mov eax, esi
call fcn.00622ad0
push eax
push 0x61f868
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x58], 0
je 0x61f9ea
mov eax, dword [0x70b7cc]
cmp byte [eax + 0xeb], 0
je 0x61f9ea
mov eax, dword [esi + 0xf0]
test eax, eax
je 0x61f9cb
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x61f9ea
push 0
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x61f9d3
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x61fa19
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.0046825c
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x61f9f9
inc dword [esi + 0xb4]
jmp 0x61fad1
cmp dword [esi + 0xb4], 0
jle 0x61fad1
dec dword [esi + 0xb4]
cmp dword [esi + 0xb4], 0
jne 0x61fad1
cmp dword [esi + 0x58], 0
je 0x61fa86
mov eax, dword [0x70b7cc]
cmp byte [eax + 0xeb], 0
je 0x61fa86
mov eax, dword [esi + 0xf0]
test eax, eax
je 0x61fa67
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x61fa86
push 5
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x61fa6f
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x61fab5
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.0046825c
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x61fa95
mov eax, dword [esi + 0xb0]
mov edx, dword [eax]
call dword [edx + 8]
lea eax, [esi + 0xf0]
mov edx, dword [0x6106e4]
call fcn.0040cb74
pop edi
pop esi
pop ebx
ret
Function at 0x620858
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xc4], 0
je 0x6208b5
cmp byte [ebx + 0xeb], 0
jne 0x6208b5
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x188]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040a7f4
mov eax, dword [esi]
test eax, eax
je 0x6208a2
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x6208c2
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040aa4c
jmp 0x6208c2
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040aa4c
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x62220c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x98]
test esi, esi
je 0x62227d
mov eax, esi
call fcn.00554f04
test al, al
je 0x62227d
mov eax, dword [ebx + 0x98]
call fcn.00554b30
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x62227d
mov eax, dword [ebx + 0x98]
mov edx, dword [eax]
call dword [edx + 0x140]
test al, al
je 0x62226e
push 0
mov eax, dword [ebx + 0x98]
call fcn.00554b30
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebx + 0x98]
xor edx, edx
call fcn.0054b6f0
jmp 0x62227d
mov edx, dword [ebx + 0x88]
mov cl, 1
mov eax, ebx
call fcn.00622018
pop esi
pop ebx
ret
Function at 0x63324c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x70bc0c], 0
jne 0x633263
call fcn.00633208
mov eax, edi
dec eax
test eax, eax
jl 0x63328b
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x70b80c]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x63326d
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x63e15c
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x63e18a
mov eax, ebx
call fcn.0063ec18
cmp dword [ebx + 0x40], 0
je 0x63e183
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x63e1fb
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x63e1ed
cmp dword [ebx + 8], 0
je 0x63e1ac
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x63e1be
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x63e1ed
cmp dword [ebx + 8], 0
je 0x63e19f
cmp eax, 3
je 0x63e1d1
dec eax
jne 0x63e19f
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x63e19f
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x63e19f
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x63e219
cmp dword [ebx + 0x14], 0xcc
je 0x63e219
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0063e224
pop ebx
ret

Function at 0x652008
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040a750
xor eax, eax
push ebp
push 0x652086
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040b180
mov dword [ebp - 8], eax
cmp dword [ebx + 8], 0
jne 0x652051
mov eax, dword [ebx + 4]
call fcn.0040b180
push eax
push 0
call sub.advapi32.dll_RegisterEventSourceW
mov dword [ebx + 8], eax
push 0
lea eax, [ebp - 8]
push eax
push 0
push 1
push 0
mov eax, dword [ebp + 8]
push eax
movzx eax, word [ebp + 0xc]
push eax
push esi
mov eax, dword [ebx + 8]
push eax
call sub.advapi32.dll_ReportEventW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x65208d
lea eax, [ebp - 4]
call fcn.0040a66c
ret
Function at 0x653138
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x653313
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
xor eax, eax
call fcn.004072c0
mov ecx, 1
mov edx, dword [ebp - 4]
mov eax, 0x653330
call fcn.0040b768
test eax, eax
jle 0x653199
push 0x653340
push dword [ebp - 4]
push 0x653340
lea eax, [ebp - 4]
mov edx, 3
call fcn.0040b470
cmp word [ebx + 0xb2], 0
je 0x6531b1
mov edx, ebx
mov eax, dword [ebx + 0xb4]
call dword [ebx + 0xb0]
mov eax, dword [ebx + 0xa0]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x6531c5
lea esi, [ebp - 0xc]
jmp 0x6531c7
xor esi, esi
cmp dword [ebx + 0x90], 0
jne 0x6531d4
xor edi, edi
jmp 0x6531e1
mov eax, dword [ebx + 0x90]
call fcn.0040b180
mov edi, eax
mov eax, dword [ebx + 0x8c]
call fcn.0040b180
push eax
push edi
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.00652864
mov eax, dword [ebp - 0x14]
call fcn.0040b180
push eax
push esi
mov eax, dword [ebx + 0x84]
call fcn.0040b180
push eax
mov eax, dword [ebp - 4]
call fcn.0040b180
push eax
mov eax, ebx
call fcn.006529a4
push eax
mov eax, ebx
call fcn.00652978
push eax
mov eax, ebx
call fcn.0065292c
push eax
push 0xf01ff
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.006526ec
mov eax, dword [ebp - 0x18]
call fcn.0040b180
push eax
mov eax, dword [ebx + 8]
call fcn.0040b180
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CreateServiceW
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0xa0], eax
cmp dword [ebp - 0x10], 0
jne 0x653270
call fcn.0042daac
xor edx, edx
push ebp
push 0x6532e9
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x6532ae
push dword fs:[edx]
mov dword fs:[edx], esp
cmp word [ebx + 0xba], 0
je 0x6532a4
mov edx, ebx
mov eax, dword [ebx + 0xbc]
call dword [ebx + 0xb8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6532d2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6532f0
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret

Function at 0x653344
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp word [eax + 0xc2], 0
je 0x653370
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0xc4]
call dword [esi + 0xc0]
push 0xf01ff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.0040b180
push eax
push ebx
call sub.advapi32.dll_OpenServiceW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x653395
call fcn.0042daac
xor eax, eax
push ebp
push 0x6533cc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_DeleteService
test eax, eax
jne 0x6533b5
call fcn.0042daac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6533d3
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
Function at 0x6545c0
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x654611
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x114], 0x114
lea eax, [ebp - 0x114]
push eax
call sub.KERNEL32.DLL_GetVersionExW
mov al, 1
call fcn.00654500
push 0
push 6
call sub.user32.dll_ExitWindowsEx
xor eax, eax
call fcn.00654500
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x65461b
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x654624
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x6546e0
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0
lea eax, [ebp - 0x18]
call fcn.006546ec
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00425e24
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.0042cb28
mov eax, dword [ebp - 0x10]
call fcn.0040b180
push eax
call sub.KERNEL32.DLL_GetVolumeInformationW
test eax, eax
je 0x6546be
lea ecx, [ebp - 0x1c]
movzx eax, word [ebp - 4]
mov edx, 4
call fcn.00425510
mov eax, dword [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x20]
mov eax, dword [ebp - 4]
shr eax, 0x10
movzx eax, ax
mov edx, 4
call fcn.00425510
mov edx, dword [ebp - 0x20]
mov eax, ebx
pop ecx
call fcn.0040b3e8
jmp 0x6546c5
mov eax, ebx
call fcn.0040a66c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6546e7
lea eax, [ebp - 0x20]
mov edx, 5
call fcn.0040a6cc
ret

Function at 0x6546ec
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x214], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x654789
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x65475e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x20e]
push eax
call sub.KERNEL32.DLL_GetWindowsDirectoryW
lea eax, [ebp - 0x214]
lea edx, [ebp - 0x20e]
mov ecx, 0x105
call fcn.0040b238
mov eax, dword [ebp - 0x214]
mov edx, dword [ebp - 4]
call fcn.0042cb28
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x654770
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x654790
lea eax, [ebp - 0x214]
call fcn.0040a66c
ret
Function at 0x654798
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd0
push ebx
push esi
push edi
xor edx, edx
push ebp
push 0x654933
push dword fs:[edx]
mov dword fs:[edx], esp
mov bl, 1
lea eax, [ebp - 0x11c]
xor ecx, ecx
mov edx, 0x11c
call fcn.00407ce4
mov dword [ebp - 0x11c], 0x11c
lea esi, [ebp - 0x11c]
push esi
call sub.KERNEL32.DLL_GetVersionExW
cmp eax, 1
sbb eax, eax
inc eax
cmp bl, al
je 0x65480e
lea eax, [ebp - 0x11c]
xor ecx, ecx
mov edx, 0x114
call fcn.00407ce4
mov dword [ebp - 0x11c], 0x114
lea eax, [ebp - 0x230]
push eax
call sub.KERNEL32.DLL_GetVersionExW
mov eax, dword [ebp - 0x118]
cmp eax, 5
jne 0x65486e
mov eax, dword [ebp - 0x114]
test eax, eax
jne 0x65482a
xor ebx, ebx
jmp 0x654929
cmp eax, 1
jne 0x654839
mov ebx, 1
jmp 0x654929
cmp eax, 2
jne 0x654866
movzx eax, byte [ebp - 2]
cmp al, 1
jne 0x654850
mov ebx, 1
jmp 0x654929
cmp al, 2
jb 0x65485e
mov ebx, 2
jmp 0x654929
or ebx, 0xffffffff
jmp 0x654929
or ebx, 0xffffffff
jmp 0x654929
cmp eax, 6
jne 0x65491a
mov eax, dword [ebp - 0x114]
test eax, eax
jne 0x6548a9
movzx eax, byte [ebp - 2]
cmp al, 1
jne 0x654893
mov ebx, 3
jmp 0x654929
cmp al, 2
jb 0x6548a1
mov ebx, 4
jmp 0x654929
or ebx, 0xffffffff
jmp 0x654929
cmp eax, 1
jne 0x6548cd
movzx eax, byte [ebp - 2]
cmp al, 1
jne 0x6548bd
mov ebx, 5
jmp 0x654929
cmp al, 2
jb 0x6548c8
mov ebx, 4
jmp 0x654929
or ebx, 0xffffffff
jmp 0x654929
cmp eax, 2
jne 0x6548f1
movzx eax, byte [ebp - 2]
cmp al, 1
jne 0x6548e1
mov ebx, 6
jmp 0x654929
cmp al, 2
jb 0x6548ec
mov ebx, 7
jmp 0x654929
or ebx, 0xffffffff
jmp 0x654929
cmp eax, 3
jne 0x654915
movzx eax, byte [ebp - 2]
cmp al, 1
jne 0x654905
mov ebx, 6
jmp 0x654929
cmp al, 2
jb 0x654910
mov ebx, 7
jmp 0x654929
or ebx, 0xffffffff
jmp 0x654929
or ebx, 0xffffffff
jmp 0x654929
cmp eax, 0xa
jne 0x654926
mov ebx, 8
jmp 0x654929
or ebx, 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x654940
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x655f44
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor edx, edx
push ebp
push 0x655faa
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push ebx
call sub.KERNEL32.DLL_VirtualProtect
cmp eax, 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x655fa0
mov eax, ebx
mov byte [eax], 0xe9
sub esi, ebx
sub esi, 5
mov dword [eax + 1], esi
push 5
push ebx
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.KERNEL32.DLL_FlushInstructionCache
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
push eax
push 5
push ebx
call sub.KERNEL32.DLL_VirtualProtect
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x655fb4
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x655ffc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a750
mov eax, dword [ebp - 8]
call fcn.0040a750
xor eax, eax
push ebp
push 0x656094
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x65606f
push dword fs:[eax]
mov dword fs:[eax], esp
push 5
push 0
mov eax, dword [ebp - 8]
call fcn.0040b180
push eax
mov eax, dword [ebp - 4]
call fcn.0040b180
push eax
push 0x6560a4
mov eax, dword [0x703eb8]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
push eax
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x656079
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x65609b
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040a6cc
ret

Function at 0x6560b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a750
mov eax, dword [ebp - 8]
call fcn.0040a750
xor eax, eax
push ebp
push 0x65613c
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x656117
push dword fs:[eax]
mov dword fs:[eax], esp
push 5
push 0
mov eax, dword [ebp - 8]
call fcn.0040b180
push eax
mov eax, dword [ebp - 4]
call fcn.0040b180
push eax
push 0x65614c
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x656121
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x656143
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040a6cc
ret

Function at 0x65625c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a750
xor eax, eax
push ebp
push 0x6562db
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x6562bb
push dword fs:[eax]
mov dword fs:[eax], esp
push 5
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040b180
push eax
push 0x6562e8
mov eax, dword [0x703eb8]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
push eax
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6562c5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6562e2
lea eax, [ebp - 4]
call fcn.0040a66c
ret

Function at 0x69e5d0
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffdc
mov ebx, eax
mov eax, ebx
call fcn.0040a66c
mov dword [esp], 0xf
push esp
lea eax, [esp + 8]
push eax
call sub.KERNEL32.DLL_GetComputerNameW
test eax, eax
je 0x69e601
lea edx, [esp + 4]
mov eax, ebx
mov ecx, dword [esp]
call fcn.0040a7f4
add esp, 0x24
pop ebx
ret
Function at 0x6b52b8
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x6b52c0
push ecx
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6b5475
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0x18]
mov ecx, dword [eax + 0xc]
lea eax, [ebp - 4]
mov edx, 0x6b5490
call fcn.0040b3e8
push esi
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0x11
mov eax, dword [ebx + 0x2c]
push eax
lea eax, [ebp - 0x18]
push eax
movzx ecx, word [ebx + 0x30]
mov eax, dword [ebx + 0x1c]
xor edx, edx
call fcn.006b2e6c
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0x11
lea edx, [ebp - 0x14]
mov ecx, 1
mov eax, 0x6b54a4
call fcn.0065cb14
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x6b533b
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x6b537c
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebx + 0x2c]
push eax
lea eax, [ebp - 0x28]
push eax
movzx ecx, word [ebx + 0x30]
mov eax, dword [ebx + 0xc]
xor edx, edx
call fcn.006b2e6c
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x6b550c
call fcn.0065cb14
mov edx, dword [ebp - 0x1c]
mov eax, esi
call fcn.0040b390
mov eax, esi
mov edx, 0x6b5538
call fcn.0040b390
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x6b5394
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x6b5402
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x6b554c
call fcn.0065cb14
mov edx, dword [ebp - 0x2c]
mov eax, esi
call fcn.0040b390
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x6b53cb
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x6b53f6
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x6b557c
call fcn.0065cb14
mov edx, dword [ebp - 0x30]
mov eax, esi
call fcn.0040b390
mov eax, esi
mov edx, 0x6b5538
call fcn.0040b390
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x6b540e
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x6b5439
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x6b55a8
call fcn.0065cb14
mov edx, dword [ebp - 0x34]
mov eax, esi
call fcn.0040b390
mov eax, esi
mov edx, 0x6b5538
call fcn.0040b390
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6b547c
lea eax, [ebp - 0x34]
mov edx, 4
call fcn.0040a6cc
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.0040a6cc
lea eax, [ebp - 4]
call fcn.0040a66c
ret