joyce8/EMBER2024-capa huggingface dataset:
Function at 0x200055e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x200055f9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x20005634
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x20005630
lea ebx, [ebx]
cmp esi, eax
jae 0x20005634
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x20005620
cmp esi, eax
jb 0x2000563a
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x20005750
Capabilities:
Link many functions at runtime

Disassembly:
cmp dword [esi], 0
je 0x20005758
xor eax, eax
ret
push edi
push str.Wininet.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.InternetOpenW
push eax
mov dword [esi], eax
call edi
mov dword [esi + 4], eax
mov eax, dword [esi]
push str.InternetConnectW
push eax
call edi
mov ecx, dword [esi]
push str.InternetCloseHandle
push ecx
mov dword [esi + 8], eax
call edi
mov edx, dword [esi]
push str.InternetReadFile
push edx
mov dword [esi + 0xc], eax
call edi
mov dword [esi + 0x10], eax
mov eax, dword [esi]
push str.InternetCrackUrlW
push eax
call edi
mov ecx, dword [esi]
push str.InternetGetLastResponseInfoW
push ecx
mov dword [esi + 0x14], eax
call edi
mov edx, dword [esi]
push str.InternetGetConnectedState
push edx
mov dword [esi + 0x18], eax
call edi
mov dword [esi + 0x1c], eax
mov eax, dword [esi]
push str.InternetSetOptionW
push eax
call edi
mov ecx, dword [esi]
push str.HttpAddRequestHeadersW
push ecx
mov dword [esi + 0x20], eax
call edi
mov edx, dword [esi]
push str.HttpOpenRequestW
push edx
mov dword [esi + 0x24], eax
call edi
mov dword [esi + 0x28], eax
mov eax, dword [esi]
push str.HttpSendRequestW
push eax
call edi
mov ecx, dword [esi]
push str.HttpQueryInfoW
push ecx
mov dword [esi + 0x2c], eax
call edi
cmp dword [esi + 4], 0
mov dword [esi + 0x30], eax
pop edi
je 0x20005851
cmp dword [esi + 8], 0
je 0x20005851
cmp dword [esi + 0xc], 0
je 0x20005851
cmp dword [esi + 0x10], 0
je 0x20005851
cmp dword [esi + 0x14], 0
je 0x20005851
cmp dword [esi + 0x18], 0
je 0x20005851
cmp dword [esi + 0x1c], 0
je 0x20005851
cmp dword [esi + 0x20], 0
je 0x20005851
cmp dword [esi + 0x24], 0
je 0x20005851
cmp dword [esi + 0x28], 0
je 0x20005851
cmp dword [esi + 0x2c], 0
je 0x20005851
test eax, eax
jne 0x20005755
mov eax, 0x7f
ret
Function at 0x20005860
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x20031ab1
mov eax, dword fs:[0]
push eax
push ebp
push esi
push edi
mov eax, dword [0x20043b94]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, dword [esp + 0x20]
xor ecx, ecx
mov eax, 0x12f
mov edx, 2
mul edx
seto cl
mov ebp, 0x12c
mov dword [esi + 0xc], ebp
neg ecx
or ecx, eax
push ecx
call fcn.2000e11b
mov dword [esi + 8], eax
add eax, 4
xor edi, edi
mov dword [esi + 4], eax
mov word [eax], di
xor ecx, ecx
mov eax, 0x12f
mov edx, 2
mul edx
seto cl
mov dword [esp + 0x1c], edi
mov dword [esi + 0x18], ebp
neg ecx
or ecx, eax
push ecx
call fcn.2000e11b
mov dword [esi + 0x14], eax
add eax, 4
mov dword [esi + 0x10], eax
mov word [eax], di
xor ecx, ecx
mov eax, 0x12f
mov edx, 2
mul edx
seto cl
mov byte [esp + 0x20], 1
mov dword [esi + 0x24], ebp
neg ecx
or ecx, eax
push ecx
call fcn.2000e11b
mov dword [esi + 0x20], eax
add eax, 4
mov dword [esi + 0x1c], eax
mov word [eax], di
xor ecx, ecx
mov eax, 0x12f
mov edx, 2
mul edx
seto cl
mov byte [esp + 0x24], 2
mov dword [esi + 0x30], ebp
neg ecx
or ecx, eax
push ecx
call fcn.2000e11b
mov dword [esi + 0x2c], eax
add esp, 0x10
add eax, 4
mov dword [esi + 0x28], eax
mov word [eax], di
mov dword [esi + 0x144c], edi
mov word [esi + 0x34], di
mov word [esi + 0x234], di
mov word [esi + 0x1234], di
mov word [esi + 0x1334], di
mov word [esi + 0x1434], di
mov dword [esi + 0x143c], 0xffffffff
mov dword [esi], edi
mov dword [esi + 0x1440], edi
mov dword [esi + 0x1444], 0x8000000
mov dword [esi + 0x1448], 0x7fffffff
mov dword [esi + 0x1460], edi
mov dword [esi + 0x1464], edi
mov dword [esi + 0x1468], edi
mov dword [esi + 0x146c], edi
mov dword [esi + 0x1450], edi
mov dword [esi + 0x1454], edi
mov dword [esi + 0x1458], edi
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0xc
ret 4
Function at 0x20006330
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, eax
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor ebp, ebp
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ebp
lea ebx, [ebx]
cmp dword [esi + 0x144c], ebp
jne 0x200063d5
mov eax, 0x10000
sub eax, dword [edi]
cmp eax, 0x4e20
jbe 0x2000636b
mov eax, 0x4e20
test byte [0x2005f338], 1
jne 0x20006381
or dword [0x2005f338], 1
mov dword [0x2005f304], ebp
mov edx, dword [esi + 0x1458]
lea ecx, [esp + 0xc]
push ecx
push eax
push ebx
push edx
call dword [0x2005f314]
test eax, eax
je 0x200063e1
mov eax, dword [esp + 0xc]
add dword [edi], eax
add ebx, eax
add dword [esi + 0x1468], eax
adc dword [esi + 0x146c], ebp
cmp eax, ebp
jbe 0x200063b9
cmp dword [edi], 0x10000
jb 0x20006350
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [esp + 0x10]
cmp eax, 1
jb 0x200063cc
call esi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
pop esi
pop ebp
mov eax, 0x4c7
pop ebx
add esp, 8
ret
cmp dword [esi + 0x144c], ebp
jne 0x200063d5
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x20008010
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov eax, dword [ebx + 0x3c]
mov ecx, dword [eax + ebx + 0x54]
mov edx, dword [esi]
push ebp
push edi
push ecx
push ebx
push edx
call fcn.2001fb50
mov eax, dword [esi]
mov ecx, dword [ebx + 0x3c]
add ecx, eax
mov dword [esi + 0xc], ecx
mov dword [ecx + 0x34], eax
mov eax, dword [esi + 0xc]
movzx edx, word [eax + 0x14]
add esp, 0xc
cmp word [eax + 6], 0
lea edi, [edx + eax + 0x18]
mov dword [esp + 8], 0
jbe 0x200080a5
add edi, 0x10
cmp dword [edi - 8], 0
je 0x2000808c
mov ecx, dword [edi + 4]
mov eax, dword [edi]
lea edx, [ecx + eax]
cmp dword [esp + 0x10], edx
jb 0x200080d3
mov edx, dword [esi + 0x1c]
mov ebp, dword [edi - 8]
lea ebp, [edx + ebp - 1]
add edx, 0xffffffff
not edx
and ebp, edx
cmp eax, ebp
ja 0x200080d3
push eax
mov eax, dword [edi - 4]
add eax, dword [esi]
add ecx, ebx
push ecx
push eax
call fcn.2001fb50
add esp, 0xc
mov ecx, dword [esi + 0xc]
mov eax, dword [esp + 8]
movzx edx, word [ecx + 6]
add eax, 1
add edi, 0x28
cmp eax, edx
mov dword [esp + 8], eax
jl 0x20008051
mov eax, dword [esi + 0xc]
mov eax, dword [eax + 0x28]
test eax, eax
je 0x200080b6
mov ecx, dword [esi]
add ecx, eax
mov dword [esi + 0x10], ecx
mov eax, dword [esi + 0xc]
add eax, 0xe8
cmp dword [eax + 4], 0
jbe 0x200080cb
mov edx, dword [eax]
add edx, dword [esi]
mov dword [esi + 0x30], edx
pop edi
xor eax, eax
pop ebp
pop ecx
ret 4
pop edi
mov eax, 0xb
pop ebp
pop ecx
ret 4
Function at 0x200086a0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x1c
push ebp
mov ebp, dword [esp + 0x24]
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 0x54]
mov ecx, dword [ebp + 0x1c]
lea eax, [edx + ecx - 1]
mov edx, dword [ebp]
add ecx, 0xffffffff
not ecx
and eax, ecx
lea ecx, [esp + 0x1c]
push ecx
push 2
push eax
push edx
call dword [0x2005cb90]
test eax, eax
jne 0x200086df
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop ebp
add esp, 0x1c
ret 4
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + 0x14]
push ebx
push edi
lea edi, [ecx + eax + 0x18]
movzx eax, word [eax + 6]
or ebx, 0xffffffff
xor ecx, ecx
test eax, eax
mov dword [esp + 0x14], ebx
jle 0x2000871e
lea edx, [edi + 0x24]
cmp dword [edx - 0x1c], 0
je 0x20008710
test dword [edx], 0x2000000
jne 0x20008710
mov ebx, ecx
add ecx, 1
add edx, 0x28
cmp ecx, eax
jl 0x20008700
mov dword [esp + 0x14], ebx
test eax, eax
push esi
mov dword [esp + 0x10], 0
jle 0x20008826
add edi, 0x24
mov dword [esp + 0x14], edi
jmp 0x20008744
mov ebx, dword [esp + 0x18]
mov eax, dword [edi - 0x1c]
test eax, eax
mov dword [esp + 0x20], eax
je 0x20008805
mov eax, dword [edi]
mov ecx, eax
shr ecx, 0x1f
mov dword [esp + 0x24], ecx
mov edx, eax
mov esi, eax
mov ecx, eax
shr edx, 0x1d
shr esi, 0x1e
shr ecx, 0x19
and edx, 1
and esi, 1
and ecx, 1
test al, 0x20
je 0x20008781
mov edx, 1
mov esi, edx
test ecx, ecx
je 0x20008793
cmp dword [esp + 0x10], ebx
mov dword [esp + 0x1c], 1
jl 0x2000879b
mov dword [esp + 0x1c], 0
mov edi, dword [edi - 0x18]
add edi, dword [ebp]
mov ebp, dword [ebp + 0x1c]
mov ebx, dword [esp + 0x20]
lea ebx, [ebx + ebp - 1]
add ebp, 0xffffffff
not ebp
and ebx, ebp
test ecx, ecx
je 0x200087cd
cmp dword [esp + 0x1c], 0
jne 0x200087cd
push 0x4000
push ebx
push edi
call dword [0x2005cb94]
jmp 0x200087f9
test eax, 0x4000000
mov ecx, dword [esp + 0x24]
lea edx, [esi + edx*2]
lea edx, [ecx + edx*2]
mov ecx, dword [edx*4 + 0x20058968]
je 0x200087eb
or ecx, 0x200
lea eax, [esp + 0x28]
push eax
push ecx
push ebx
push edi
call dword [0x2005cb90]
test eax, eax
je 0x20008832
mov edi, dword [esp + 0x14]
mov ebp, dword [esp + 0x30]
mov ecx, dword [ebp + 0xc]
mov eax, dword [esp + 0x10]
movzx edx, word [ecx + 6]
add eax, 1
add edi, 0x28
cmp eax, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edi
jl 0x20008740
pop esi
pop edi
pop ebx
xor eax, eax
pop ebp
add esp, 0x1c
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
pop edi
pop ebx
pop ebp
add esp, 0x1c
ret 4
Function at 0x2000a3b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x20032068
mov eax, dword fs:[0]
push eax
sub esp, 0x64
push ebx
push ebp
push esi
push edi
mov eax, dword [0x20043b94]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x88]
mov eax, 1
xor ebp, ebp
cmp dword [ebx + 8], eax
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], eax
jl 0x2000a591
mov edi, dword [esp + 0x1c]
xor eax, eax
lea esi, [esp + 0x50]
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], eax
call fcn.2000a8c0
cmp eax, ebp
je 0x2000a43a
mov dword [esp + 0x18], eax
jmp 0x2000a57d
mov esi, 1
cmp dword [esp + 0x5c], esi
jne 0x2000a57d
cmp dword [esp + 0x58], ebp
je 0x2000a4c6
mov edi, vtable.cHandle.0
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], ebp
lea eax, [esp + 0x50]
push eax
lea esi, [esp + 0x2c]
mov dword [esp + 0x84], ebp
call fcn.2000a5e0
add esp, 4
cmp eax, ebp
je 0x2000a4a7
mov dword [esp + 0x18], eax
mov dword [esp + 0x80], 0xffffffff
mov eax, dword [esp + 0x2c]
cmp eax, ebp
mov dword [esp + 0x28], edi
je 0x2000a57d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x2c], ebp
jmp 0x2000a57d
mov edx, dword [esp + 0x8c]
push edx
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x54]
push eax
mov dword [esp + 0x3c], ecx
call fcn.2000a3b0
add esp, 8
jmp 0x2000a47c
call fcn.2000e120
xor ecx, ecx
cmp eax, ebp
setne cl
cmp ecx, ebp
je 0x2000a5a9
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x20], eax
mov dword [esp + 0x80], esi
lea edi, [esp + 0x20]
lea esi, [esp + 0x50]
call fcn.2000a950
cmp eax, ebp
je 0x2000a508
mov dword [esp + 0x18], eax
jmp 0x2000a552
lea ecx, [esp + 0x50]
lea esi, [esp + 0x38]
mov dword [esp + 0x24], ecx
call fcn.20009b00
mov edx, esi
push edx
lea eax, [esp + 0x24]
mov byte [esp + 0x84], 2
call fcn.2000aa00
sub esp, 0x14
mov eax, esp
mov dword [esp + 0xa0], esp
push eax
mov ecx, esi
call fcn.2000a040
mov ecx, dword [esp + 0xa4]
call fcn.2000acb0
call fcn.2000a100
mov dword [esp + 0x80], 0xffffffff
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x2000a57d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x1c]
add eax, 1
cmp eax, dword [ebx + 8]
mov dword [esp + 0x1c], eax
jle 0x2000a3f6
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x70
ret
push 0x80004005
call fcn.20001720
int3
Function at 0x2000b050
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x20031eb8
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x20043b94]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, edx
test esi, esi
mov dword [esp + 0x14], 0
jge 0x2000b087
call fcn.2000f362
cmp esi, dword [edi + 8]
jl 0x2000b094
lea eax, [esi + 1]
call fcn.2000ade0
mov ecx, dword [edi + 4]
mov dx, word [esp + 0x1c]
lea eax, [esi + esi*2]
lea esi, [ecx + eax*8]
mov cx, word [esp + 0x20]
mov ax, word [esp + 0x1e]
mov word [esi], dx
lea edx, [esp + 0x24]
mov word [esi + 4], cx
push edx
lea ecx, [esi + 8]
mov word [esi + 2], ax
call fcn.20002380
lea eax, [esp + 0x28]
push eax
lea ecx, [esi + 0xc]
call fcn.20002380
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esi + 0x10]
call fcn.20002380
lea edx, [esp + 0x30]
push edx
lea ecx, [esi + 0x14]
call fcn.20002380
lea esi, [esp + 0x1c]
call fcn.2000a100
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 0x18

Function at 0x2000b420
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
push edi
xor edi, edi
push edi
push 0x100
push 2
push edi
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
je 0x2000b447
cmp esi, 0xffffffff
jne 0x2000b460
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
mov edi, eax
je 0x2000b48b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ecx
ret
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push 0
lea ecx, [esp + 0xc]
push ecx
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x2000b484
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ecx
ret

Function at 0x2000ba80
Capabilities:
Get file size
Read file on windows

Disassembly:
push ecx
push ebp
push esi
xor ebp, ebp
push ebp
push ebp
push 3
push ebp
push 1
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x2000baa9
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
pop ebp
pop ecx
ret
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
push 0xffffffffffffffff
push edi
mov ecx, ebx
call fcn.200109ad
mov eax, dword [ebx + 4]
push 0
lea ecx, [esp + 0x10]
push ecx
push edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
pop edi
jne 0x2000badf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov eax, ebp
pop ebp
pop ecx
ret
Function at 0x2000baf0
Capabilities:
Get cpu information
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push 0
push 0x20037a78
mov ecx, esi
call fcn.20002400
lea eax, [esp + 8]
push eax
push 1
push 0
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x2000bbec
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0xf]
push edx
mov dword [esp + 0x14], eax
lea eax, [esp + 0x1c]
push eax
push 0
push str.ProcessorNameString
push ecx
call ebx
mov edi, eax
cmp edi, 0xea
jne 0x2000bb96
mov eax, dword [esi]
mov ecx, dword [esp + 0xc]
sub eax, 0x10
mov edx, 1
sub edx, dword [eax + 0xc]
mov eax, dword [eax + 8]
shr ecx, 1
sub eax, ecx
or edx, eax
jge 0x2000bb79
push ecx
mov ecx, esi
call fcn.200017a0
mov eax, dword [esi]
lea ecx, [esp + 0xc]
push ecx
push eax
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x1c]
push edx
push 0
push str.ProcessorNameString
push eax
call ebx
mov edi, eax
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
mov ecx, esi
je 0x2000bbbb
push 0
push 0x20037a78
call fcn.20002400
mov eax, edi
pop edi
pop ebx
add esp, 0x10
ret
mov edi, dword [esp + 0xc]
shr edi, 1
push edi
call fcn.20004b30
test edi, edi
jle 0x2000bbe8
lea eax, [edi - 1]
test eax, eax
jl 0x2000bbf0
mov ecx, dword [esi]
cmp eax, dword [ecx - 0xc]
jg 0x2000bbf0
cmp word [ecx + eax*2], 0
jne 0x2000bbe8
push eax
mov ecx, esi
call fcn.20004b30
pop edi
xor eax, eax
pop ebx
add esp, 0x10
ret
push 0x80070057
call fcn.20001720
int3
Function at 0x20019434
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x20043b94]
jne 0x2001943e
repz ret
jmp fcn.2001cf39

Function at 0x20027619
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.2001ddab
xor ebx, ebx
cmp dword [0x2005b994], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x200276ee
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x20027659
xor eax, eax
jmp 0x200277b2
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x20027652
push eax
call fcn.2001dd48
mov dword [esp], 0x20037784
push edi
mov dword [0x2005b994], eax
call esi
push eax
call fcn.2001dd48
mov dword [esp], 0x20037770
push edi
mov dword [0x2005b998], eax
call esi
push eax
call fcn.2001dd48
mov dword [0x2005b99c], eax
lea eax, [ebp - 8]
push eax
call fcn.2001ab83
test eax, eax
pop ecx
pop ecx
je 0x200276bc
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.2001db2f
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x200276ee
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.2001dd48
cmp eax, ebx
pop ecx
mov dword [0x2005b9a4], eax
je 0x200276ee
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.2001dd48
pop ecx
mov dword [0x2005b9a0], eax
mov eax, dword [0x2005b9a0]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x20027767
cmp dword [0x2005b9a4], esi
je 0x20027767
push eax
call fcn.2001ddb4
pop ecx
call eax
cmp eax, ebx
je 0x20027734
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x2005b9a4]
call fcn.2001ddb4
pop ecx
call eax
test eax, eax
je 0x20027734
test byte [ebp - 0x18], 1
jne 0x20027767
lea eax, [ebp - 0xc]
push eax
call fcn.2001abba
test eax, eax
pop ecx
je 0x2002774f
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.2001db2f
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x2002775e
or dword [ebp + 0x10], 0x200000
jmp 0x20027798
or dword [ebp + 0x10], 0x40000
jmp 0x20027798
mov eax, dword [0x2005b998]
cmp eax, esi
je 0x20027798
push eax
call fcn.2001ddb4
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x20027798
mov eax, dword [0x2005b99c]
cmp eax, esi
je 0x20027798
push dword [ebp - 4]
push eax
call fcn.2001ddb4
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x2005b994]
call fcn.2001ddb4
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x2002fd50
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
lea eax, [esp]
push eax
push 0x40
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x2002fd83
push esi
mov esi, 0xc000000d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x2005cbd0], eax
mov eax, esi
mov dword [0x2004674c], 0x20039428
pop esi
pop ecx
ret
xor eax, eax
mov dword [0x2005cbd0], eax
mov dword [0x2004674c], 0x20037a78
pop ecx
ret
Function at 0x20030510
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [0x2005cbc4]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetProcessId
push eax
call esi
test eax, eax
mov dword [0x2005cde8], eax
jne 0x2003054b
mov ecx, dword [0x2005cbc0]
push str.NtQueryInformationProcess
push ecx
call esi
test eax, eax
mov dword [0x2005cdf0], eax
jne 0x2003054b
mov eax, 0xc000007a
pop esi
ret
mov edx, dword [0x2005cbc4]
push str.GetThreadId
push edx
call esi
test eax, eax
mov dword [0x2005cde4], eax
jne 0x20030578
mov eax, dword [0x2005cbc0]
push str.NtQueryInformationThread
push eax
call esi
test eax, eax
mov dword [0x2005cdec], eax
je 0x20030544
mov ecx, dword [0x2005cbc0]
push str.ZwQueryObject
push ecx
call esi
mov dword [0x2005cdf4], eax
neg eax
sbb eax, eax
and eax, 0x3fffff86
add eax, 0xc000007a
pop esi
ret

Function at 0x20030dc0
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
push esi
push edi
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0xc]
mov ecx, dword [0x2005cbcc]
push eax
push 0
push ecx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x20030dfb
push edi
push esi
call fcn.2002fc80
pop edi
mov eax, esi
pop esi
add esp, 0x24
ret
pop edi
xor eax, eax
pop esi
add esp, 0x24
ret

Function at 0x10c89
Capabilities:
Create device object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x10904]
test eax, eax
mov ecx, 0xbb40
je 0x10ca0
cmp eax, ecx
jne 0x10cc3
mov edx, dword [sym.imp.ntoskrnl.exe_KeTickCount]
mov eax, 0x10904
shr eax, 8
xor eax, dword [edx]
and eax, 0xffff
mov dword [0x10904], eax
jne 0x10cc3
mov eax, ecx
mov dword [0x10904], eax
not eax
mov dword [section..data], eax
pop ebp
jmp fcn.00010bc6

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Read file on windows

Disassembly:
push esi
push edi
push str.ShellExecuteW
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 1
xor edi, edi
push edi
push edi
push 0x10002054
push str.open
push edi
call eax
push 0x40
mov esi, 0x1000
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push str.desktop.ini
mov dword [0x10003228], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000322c], eax
cmp eax, 0xffffffff
je 0x100011f3
push edi
push 0x10003230
push esi
push dword [0x10003228]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x10003228]
movzx ecx, byte [eax]
xor ecx, 0x4e
xor esi, esi
cmp dword [0x10003230], edi
jbe 0x100011f1
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003230]
jb 0x100011dd
call eax
pop edi
pop esi
ret 0x10
Function at 0x406004
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor esi, esi
cmp dword [0x422a1c], esi
push edi
jne 0x40603e
mov ecx, 0x422a18
push 8
mov eax, esi
pop edi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec edi
jne 0x40601a
mov dword [ecx], eax
add ecx, 4
inc esi
cmp ecx, 0x422e18
jl 0x406015
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov edx, ecx
dec ecx
test edx, edx
not eax
jbe 0x406073
lea edx, [ecx + 1]
mov ecx, dword [esp + 0x10]
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a18]
xor eax, esi
inc ecx
dec edx
jne 0x406056
pop edi
pop esi
not eax
ret 0xc

Function at 0xf8f96a
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ecx + 0x3c]
stc
test edi, 0x21f7413a
cmp dword [eax + ecx], 0x4550
jmp 0xf63142
je 0x9338f9
je 0x9d51ca
mov eax, 0x5a4d
cmp word [ecx], ax
jmp 0x9d51c4
jne 0x9d51ca
mov edx, dword [eax + ecx + 0x78]
mov dword [ebp - 4], edx
test edx, edx
jmp 0xa566c2
push ebp
mov ebp, esp
movzx cx, bl
mov ecx, dword [ebp + 8]
sub esp, 0x114
push esi
stc
cmp ebp, 0x4517382f
test ecx, ecx
jmp 0xfae3bd
je 0x9d51ca
mov esi, dword [ebp + 0xc]
test esi, esi
jmp 0xa0aac9