joyce8/EMBER2024-capa huggingface dataset:
Function at 0x423424
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x423549
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.0042322c
mov esi, eax
mov eax, dword [0x4e8a18]
cmp byte [eax], 0
je 0x4234f1
mov eax, dword [0x4e8860]
call fcn.00407450
call fcn.00406918
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x4233f4]
call fcn.0040b934
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x423564
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x42352d
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x4e8828]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4ebc50]
call fcn.0040bb30
push eax
call sub.user32.dll_LoadStringW_1
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x423550
lea eax, [ebp - 4]
mov edx, dword [0x4233f4]
call fcn.0040ba58
ret

Function at 0x4251fc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.0040a044
mov ebp, eax
push ebp
push 0
push 0
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040d488
mov edi, eax
cmp edi, 0x104
jbe 0x4251a7
mov eax, edi
add eax, eax
call fcn.004067c4
mov esi, eax
jmp 0x4251a9
mov esi, esp
push ebp
push esi
push edi
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040d488
push esi
call sub.user32.dll_CharUpperW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x4251e2
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x4251cc
mov eax, esp
cmp esi, eax
je 0x4251ef
mov eax, esi
call fcn.004067e0
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x425228
cmp bl, 0
je 0x425224
cmp bl, 0x41
jl 0x42521f
cmp bl, 0x5a
jg 0x42521f
or bl, 0x20
xor al, bl
inc esi
jmp 0x425203
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x425168

Function at 0x425a74
Capabilities:
Get geographical location

Disassembly:
push ebx
add esp, 0xfffff800
mov ebx, ecx
mov word [esp], 0
push 0x400
lea ecx, [esp + 4]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
mov eax, ebx
mov edx, esp
mov ecx, 0x400
call fcn.0040a744
add esp, 0x800
pop ebx
ret
Function at 0x433ea4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x433ef6
test eax, edx
je 0x433ef9
movzx ecx, byte [edx]
cmp cl, byte [eax]
je 0x433eb9
movzx eax, byte [eax]
sub eax, ecx
ret
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x433edf
add ecx, 4
js 0x433ecf
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 3
add ecx, ebx
jns 0x433edc
movzx eax, byte [ecx + eax]
movzx edx, byte [ecx + edx]
sub eax, edx
pop ebx
pop ebx
ret
xor eax, eax
ret
test eax, eax
je 0x433f05
test edx, edx
jne 0x433eac
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret
Function at 0x481868
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x481870
mov eax, edx
pop esi
pop ebx
ret

Function at 0x4b58b4
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b5952
push dword fs:[eax]
mov dword fs:[eax], esp
or dl, byte [ebx + 0xd]
je 0x4b5916
cmp byte [ebx + 0x11], 0
jne 0x4b5916
cmp byte [ebx + 0x3c], 0
jne 0x4b5916
mov byte [ebx + 0xf], 0
mov byte [ebx + 0xd], 0
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
je 0x4b5937
lea edx, [ebp - 4]
mov eax, dword [0x4e89c8]
call fcn.0040d3f4
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x48e428]
call fcn.00423574
call fcn.00409264
jmp 0x4b5937
lea edx, [ebp - 8]
mov eax, dword [0x4e89c8]
call fcn.0040d3f4
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x48e428]
call fcn.00423574
call fcn.00409264
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b5959
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409bc8
ret

Function at 0x4b62f0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xf]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x4b633e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xf], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.004b5734
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b6357
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4b6360
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.004b5734
dec esi
jne 0x4b6382
mov byte [ebx + 0xf], 0
pop esi
pop ebx
ret
Function at 0x4ddf38
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4de0f3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00409f90
mov eax, dword [ebp - 4]
call fcn.004dd868
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
jne 0x4ddf8a
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.0040aaac
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.004deb7c
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4de069
xor eax, eax
push ebp
push 0x4de062
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.004ddb08
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0xc]
call fcn.004de128
test al, al
je 0x4de040
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 8]
xor edx, edx
call fcn.00409cf0
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x4de040
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.0040a6a0
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.004dda68
test al, al
je 0x4de03a
mov eax, dword [ebp - 8]
call fcn.0040a6a0
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.0040a708
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xc]
call fcn.004ddf38
dec ebx
cmp ebx, 0xffffffff
jne 0x4ddfe9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4de069
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.004ddb08
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
cmp byte [0x4ee3fc], 0
je 0x4de0a9
push 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x18]
and eax, 0x300
push eax
mov eax, dword [ebp - 4]
call fcn.0040a6a0
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.004ddaf4
push eax
call sub.advapi32.dll_RegDeleteKeyExW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.004dda68
mov ebx, eax
jmp 0x4de0d0
mov eax, dword [ebp - 4]
call fcn.0040a6a0
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.004ddaf4
push eax
call sub.advapi32.dll_RegDeleteKeyW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.004dda68
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4de0fa
lea eax, [ebp - 0x3c]
call fcn.00409b68
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409bc8
ret
Function at 0x4dea58
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
movzx eax, byte [ebp + 8]
call fcn.004dd880
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.0040a6a0
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExW
mov edx, eax
mov eax, ebx
call fcn.004dda68
test al, al
jne 0x4deac0
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4e8938]
mov dl, 1
mov eax, dword [0x4dc64c]
call fcn.00423778
call fcn.00409264
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4deacc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.0040a6a0
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
mov edx, eax
mov eax, ebx
call fcn.004dda68
test al, al
jne 0x4deb2d
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4e8b1c]
mov dl, 1
mov eax, dword [0x4dc64c]
call fcn.00423778
call fcn.00409264
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.004dd8b0
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4df12c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4df254
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, esi
call fcn.004ddb08
xor eax, eax
push ebp
push 0x4df22f
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x2c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004de128
test al, al
je 0x4df213
mov eax, dword [ebp + 8]
push eax
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.004df00c
pop ecx
mov ecx, dword [ebp - 0x20]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.00409cf0
mov ebx, dword [ebp - 0x24]
dec ebx
test ebx, ebx
jl 0x4df213
inc ebx
xor edi, edi
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040a6a0
push eax
push edi
push esi
call sub.advapi32.dll_RegEnumValueW
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004dda68
test al, al
je 0x4df20f
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0040a6a0
mov edx, eax
lea eax, [ebp - 0x30]
call fcn.0040a708
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.004df00c
pop ecx
inc edi
dec ebx
jne 0x4df1b7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4df236
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x10]
call fcn.004ddb08
ret
Function at 0x4df264
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
xor ecx, ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4df4b2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 8]
call fcn.004ddb08
xor eax, eax
push ebp
push 0x4df488
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x44]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004de128
test al, al
je 0x4df46c
mov ecx, dword [ebp - 0x40]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.00409cf0
mov eax, dword [ebp - 0x44]
dec eax
test eax, eax
jl 0x4df46c
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.0040a6a0
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004dda68
test al, al
je 0x4df460
mov eax, dword [ebp - 4]
call fcn.0040a6a0
mov edx, eax
lea eax, [ebp - 0x48]
call fcn.0040a708
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004deb7c
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x4df460
xor eax, eax
push ebp
push 0x4df459
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0xc]
call fcn.004ddb08
xor eax, eax
push ebp
push 0x4df43b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040a6a0
mov edx, eax
lea eax, [ebp - 0x4c]
call fcn.0040a708
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004ddb0c
mov eax, dword [ebp - 4]
call fcn.0040a6a0
mov edx, eax
lea eax, [ebp - 0x50]
call fcn.0040a708
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004deb7c
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x4df418
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.004df12c
pop ecx
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.004df264
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4df41f
mov eax, dword [ebp - 0x24]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
inc dword [ebp - 0x14]
dec dword [ebp - 0x28]
jne 0x4df2ef
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4df48f
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x18]
call fcn.004ddb08
ret
Function at 0x4df73c
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00409c4c
mov eax, dword [ebp - 8]
call fcn.00409c4c
xor eax, eax
push ebp
push 0x4df7be
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4dc870]
call fcn.004dd9bc
mov ebx, eax
mov edx, 0x80000001
mov eax, ebx
call fcn.004ddaa4
xor ecx, ecx
mov edx, 0x4df7d8
mov eax, ebx
call fcn.004ddbfc
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004de570
mov eax, ebx
call fcn.00407f00
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4df7c5
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409bc8
ret

Function at 0x4df8c8
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00409c4c
xor eax, eax
push ebp
push 0x4df92f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x200
lea eax, [ebp - 0x204]
push eax
mov eax, dword [ebp - 4]
call fcn.0040a6a0
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsW
mov eax, ebx
lea edx, [ebp - 0x204]
mov ecx, pe_nt_image_headers32
call fcn.0040a744
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4df936
lea eax, [ebp - 4]
call fcn.00409b68
ret
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x41183a
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x411879
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x411879
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x411879
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x411879
cmp dword [ecx + 0x74], 0xe
jbe 0x411879
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x41563b
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.00415830
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4156d6
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x4411a8]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x4156d6
cmp eax, 1
je 0x4156f7
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4156d6
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x4156a3
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x4156d2
xor eax, eax
inc eax
jmp 0x415716
cmp edi, eax
jae 0x4156da
xor eax, eax
jmp 0x415716
cmp eax, esi
jae 0x4156e1
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x4411a8]
jmp 0x4156fa
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x415f69
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x434e30
call fcn.004171a0
mov edi, 0x94
mov eax, edi
call fcn.00415830
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x4411a8], ecx
mov eax, dword [esi + 4]
mov dword [0x4411b4], eax
mov edx, dword [esi + 8]
mov dword [0x4411b8], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x4411ac], esi
cmp ecx, 2
je 0x415fc9
or esi, 0x8000
mov dword [0x4411ac], esi
shl eax, 8
add eax, edx
mov dword [0x4411b0], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x416004
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x416004
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x41601c
cmp eax, 0x20b
je 0x416009
mov dword [ebp - 0x1c], esi
jmp 0x416030
cmp dword [ecx + 0x84], 0xe
jbe 0x416004
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x41602a
cmp dword [ecx + 0x74], 0xe
jbe 0x416004
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.00418c16
pop ecx
test eax, eax
jne 0x416044
push 0x1c
call fcn.00415f45
pop ecx
call fcn.004186bd
test eax, eax
jne 0x416055
push 0x10
call fcn.00415f45
pop ecx
call fcn.0041b774
mov dword [ebp - 4], esi
call fcn.0041b576
test eax, eax
jge 0x41606e
push 0x1b
call fcn.00415f20
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x442a70], eax
call fcn.0041b454
mov dword [0x441198], eax
call fcn.0041b3b2
test eax, eax
jge 0x416094
push 8
call fcn.00415f20
pop ecx
call fcn.0041b17f
test eax, eax
jge 0x4160a5
push 9
call fcn.00415f20
pop ecx
push 1
call fcn.00416245
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x4160bb
push eax
call fcn.00415f20
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.0041b122
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x4160dc
movzx eax, word [ebp - 0x40]
jmp 0x4160df
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.00420fd8
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x4160fd
push edi
call fcn.00416372
call fcn.00416394
jmp 0x41612f
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.004171db
ret
Function at 0x4162af
Capabilities:
Terminate process

Disassembly:
push 8
push 0x434e58
call fcn.004171a0
push 8
call fcn.00418bcb
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x4411e8], esi
jne 0x4162e3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x4411e4], esi
mov al, byte [ebp + 0x10]
mov byte [0x4411e0], al
cmp dword [ebp + 0xc], edi
jne 0x41632d
cmp dword [0x442a68], edi
je 0x41631d
mov eax, dword [0x442a64]
sub eax, 4
mov dword [0x442a64], eax
cmp eax, dword [0x442a68]
jb 0x41631d
mov eax, dword [eax]
cmp eax, edi
je 0x4162fe
call eax
jmp 0x4162fe
push 0x43d098
mov eax, 0x43d090
call fcn.0041622d
pop ecx
push 0x43d0a4
mov eax, 0x43d09c
call fcn.0041622d
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x41635e
cmp dword [ebp + 0x10], edi
jne 0x41636c
mov dword [0x4411e8], esi
push dword [ebp + 8]
call fcn.004161eb
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x41636b
push 8
call fcn.00418b16
pop ecx
ret
call fcn.004171db
ret