joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4049bc
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x404b74
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x404a1d
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x404b90
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x404a8a
xor eax, eax
push ebp
push 0x404a83
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x404a6c
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x404bb0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404a8a
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x404b6b
cmp byte [ebp - 0xd], 0
jne 0x404acc
cmp byte [ebp - 0x12], 0
je 0x404b6b
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x404ae5
dec ebx
cmp byte [ebx], 0x2e
je 0x404af4
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x404ae4
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x404b6b
inc ebx
cmp byte [ebp - 0x12], 0
je 0x404b21
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404b6b
cmp byte [ebp - 0xd], 0
je 0x404b6b
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404b6b
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407d98
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x110], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x407ea2
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x407deb
push 0x105
lea eax, [ebp - 0x109]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA_2
mov ecx, eax
lea edx, [ebp - 0x109]
mov eax, dword [ebp - 4]
call fcn.004036ac
jmp 0x407e89
call sub.kernel32.dll_GetCommandLineA_1
mov ebx, eax
mov eax, ebx
call fcn.00407d4c
mov ebx, eax
mov edi, ebx
mov eax, ebx
call fcn.00407d6c
mov ebx, eax
test esi, esi
je 0x407e13
dec esi
test esi, esi
jl 0x407e13
cmp edi, ebx
jne 0x407df2
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x110]
mov edx, edi
call fcn.0040377c
mov eax, dword [ebp - 0x110]
mov ecx, ebx
sub ecx, edi
mov edx, 1
call fcn.00403a10
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040380c
cmp eax, 2
jl 0x407e89
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp byte [eax], 0x22
jne 0x407e89
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040380c
mov edx, dword [ebp - 4]
mov edx, dword [edx]
cmp byte [edx + eax - 1], 0x22
jne 0x407e89
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040380c
mov ecx, eax
sub ecx, 2
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, 2
call fcn.00403a10
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407ea9
lea eax, [ebp - 0x110]
call fcn.004035c8
ret

Function at 0x407f1c
Capabilities:
Get file attributes

Disassembly:
call fcn.0040649c
push eax
call sub.kernel32.dll_GetFileAttributesA
inc eax
je 0x407f30
dec eax
and al, 0x10
sete al
ret

Function at 0x408088
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4080f2
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x105
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
call fcn.0040377c
mov eax, dword [ebp - 0x10c]
mov edx, ebx
call fcn.00407fe8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4080f9
lea eax, [ebp - 0x10c]
call fcn.004035c8
ret

Function at 0x408100
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40816a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x105
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
call fcn.0040377c
mov eax, dword [ebp - 0x10c]
mov edx, ebx
call fcn.00407fe8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408171
lea eax, [ebp - 0x10c]
call fcn.004035c8
ret
Function at 0x408178
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4081e2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x105]
push eax
push 0x105
call sub.kernel32.dll_GetTempPathA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
call fcn.0040377c
mov eax, dword [ebp - 0x10c]
mov edx, ebx
call fcn.00407fe8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4081e9
lea eax, [ebp - 0x10c]
call fcn.004035c8
ret

Function at 0x408288
Capabilities:
Create thread

Disassembly:
push ebx
mov eax, dword [0x4874c0]
mov byte [eax], 1
mov edx, dword [0x4062d4]
xor eax, eax
call fcn.00406640
mov ebx, eax
mov byte [ebx + 0x18], 1
lea eax, [ebx + 0x1e]
push eax
push 4
push ebx
push 0x408278
push 0
push 0
call sub.kernel32.dll_CreateThread
mov dword [ebx + 0x1a], eax
mov eax, ebx
pop ebx
ret

Function at 0x408318
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
mov byte [ebx + 0x18], 0
mov eax, dword [ebx + 0x1a]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
jbe 0x408333
mov byte [ebx + 0x18], 1
pop ebx
ret
cmp word [ebx + 0x2c], 0
je 0x408342
mov edx, ebx
mov eax, dword [ebx + 0x2e]
call dword [ebx + 0x2a]
pop ebx
ret

Function at 0x408448
Capabilities:
Terminate thread

Disassembly:
push ebx
mov ebx, eax
push 0
mov eax, dword [ebx + 0x1a]
push eax
call sub.kernel32.dll_TerminateThread
mov byte [ebx + 0x19], 1
pop ebx
ret

Function at 0x4086f8
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x408790
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x18], 0
jne 0x408745
mov eax, dword [ebx + 0x19]
call fcn.004039d0
push eax
push esi
mov eax, edi
call fcn.004039d0
push eax
mov eax, dword [ebx + 0x1d]
call fcn.004039d0
push eax
call sub.kernel32.dll_GetPrivateProfileIntA
mov dword [ebp - 4], eax
jmp 0x40877a
mov dword [ebp - 4], esi
mov eax, dword [ebx + 0x19]
call fcn.004039d0
push eax
lea edx, [ebp - 8]
mov eax, esi
call fcn.00407b04
mov eax, dword [ebp - 8]
call fcn.004039d0
push eax
mov eax, edi
call fcn.004039d0
push eax
mov eax, dword [ebx + 0x1d]
call fcn.004039d0
push eax
call sub.kernel32.dll_WritePrivateProfileStringA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408797
lea eax, [ebp - 8]
call fcn.004035c8
ret
Function at 0x4087a4
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff800
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp byte [ebx + 0x18], 0
jne 0x40880b
mov byte [ebp - 0x800], 0
mov eax, dword [ebx + 0x19]
call fcn.004039d0
push eax
push 0x800
lea eax, [ebp - 0x800]
push eax
mov eax, esi
call fcn.004039d0
push eax
mov eax, edi
call fcn.004039d0
push eax
mov eax, dword [ebx + 0x1d]
call fcn.004039d0
push eax
call sub.kernel32.dll_GetPrivateProfileStringA
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x800]
mov ecx, 0x800
call fcn.004037f4
jmp 0x40883c
mov eax, dword [ebp + 8]
mov edx, esi
call fcn.00403660
mov eax, dword [ebx + 0x19]
call fcn.004039d0
push eax
mov eax, esi
call fcn.004039d0
push eax
mov eax, edi
call fcn.004039d0
push eax
mov eax, dword [ebx + 0x1d]
call fcn.004039d0
push eax
call sub.kernel32.dll_WritePrivateProfileStringA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40afa0
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
call fcn.0040cc6c
test eax, eax
je 0x40afbc
cmp dword [eax + 0x155], ebx
jne 0x40afbc
xor edx, edx
mov dword [eax + 0x155], edx
mov ecx, dword [ebx + 0x18]
jecxz 0x40afc9
push 0
push ecx
call sub.user32.dll_ShowWindow
mov eax, ebx
call fcn.004066a4
mov eax, ebx
call fcn.0040c814
xor ecx, ecx
cmp byte [ebx + 0x8a], cl
jne 0x40b137
xchg byte [ebx + 0xfb], cl
jecxz 0x40aff8
mov eax, dword [ebx + 0xf6]
call fcn.00402620
inc byte [ebx + 0x8a]
mov eax, dword [ebx + 0x10a]
call fcn.00406688
mov eax, dword [ebx + 0x112]
call fcn.00406688
mov eax, dword [ebx + 0x40]
call fcn.00406688
xor ecx, ecx
mov dword [ebx + 0x10a], ecx
mov dword [ebx + 0x112], ecx
mov dword [ebx + 0x40], ecx
xchg dword [ebx + 0x52b], ecx
jecxz 0x40b03b
xchg ecx, eax
call fcn.00402620
mov eax, dword [ebx + 0x52f]
call fcn.00406688
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x40b0b8
xor ecx, ecx
xchg dword [ebx + 0x93], ecx
jecxz 0x40b05d
push ecx
call sub.user32.dll_DestroyAcceleratorTable
mov eax, dword [ebx + 0x8f]
call fcn.00406688
mov eax, dword [ebx + 0x97]
test eax, eax
je 0x40b079
call fcn.00406688
jmp 0x40b068
push dword [ebx + 0x18]
call sub.user32.dll_IsWindow
test eax, eax
je 0x40b0b3
push eax
push 1
push 0x80
push dword [ebx + 0x18]
call sub.user32.dll_SendMessageA
test eax, eax
je 0x40b0a5
cmp byte [ebx + 0x35], 0
jne 0x40b0a5
push eax
call sub.user32.dll_DestroyIcon
cmp byte [ebx + 0x48], 0
jne 0x40b0b3
push dword [ebx + 0x18]
call sub.user32.dll_DestroyWindow
xor eax, eax
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 0x36]
test eax, eax
je 0x40b0c4
call fcn.00402620
mov eax, dword [ebx + 0x26d]
test eax, eax
je 0x40b0d3
call fcn.00402620
mov ecx, dword [ebx + 0x49]
jecxz 0x40b0f2
cmp dword [ecx + 0x155], ebx
jne 0x40b0e8
xor eax, eax
mov dword [ecx + 0x155], eax
mov eax, dword [ecx + 0x60]
mov edx, ebx
call fcn.00406820
mov ecx, dword [ebx + 0x79]
jecxz 0x40b0fd
push ecx
call sub.gdi32.dll_DeleteObject
push ebx
push dword [ebx + 0x60]
push dword [ebx + 0x568]
push dword [ebx + 0x56c]
push dword [ebx + 0x2f5]
push dword [ebx + 0xcb]
mov bl, 5
pop eax
call fcn.00406688
dec bl
jne 0x40b11b
pop ebx
lea eax, [ebx + 0x4fb]
call fcn.004035c8
xchg ebx, eax
call fcn.00406694
pop ebx
ret
Function at 0x40c188
Capabilities:
Get graphical window text

Disassembly:
xchg edx, eax
movzx ecx, byte [edx + 0x3a]
jecxz 0x40c197
mov edx, dword [edx + 0x36]
jmp fcn.0040377c
mov ecx, dword [edx + 0x18]
jecxz 0x40c18f
push ebx
push esi
xchg ebx, eax
mov esi, ecx
push esi
call sub.user32.dll_GetWindowTextLengthA
mov edx, eax
inc eax
push eax
mov eax, ebx
call fcn.00403b3c
pop edx
mov ecx, dword [ebx]
jecxz 0x40c1bf
push edx
push ecx
push esi
call sub.user32.dll_GetWindowTextA
pop esi
pop ebx
ret

Function at 0x40f6b0
Capabilities:
Capture screenshot

Disassembly:
push ebx
mov ebx, eax
call fcn.0040e944
je 0x40f6f5
mov eax, ebx
push edx
call fcn.0040fb00
pop edx
cmp eax, edx
je 0x40f6f5
test edx, edx
mov eax, ebx
jne 0x40f6d4
pop ebx
inc edx
jmp fcn.0040faf0
mov byte [ebx + 0x49], dl
cmp dl, 5
jne 0x40f6dd
dec edx
push edx
xor edx, edx
call fcn.0040faf0
mov eax, dword [ebx + 0x3d]
movzx eax, word [eax + 0xe]
call fcn.0040e418
pop edx
cmp al, dl
xchg ebx, eax
pop ebx
jne fcn.0040f790
ret
Function at 0x40ff9c
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov ebx, eax
mov byte [ebp - 1], 0
cmp dword [0x488504], 0
je 0x4100a0
mov eax, dword [0x488504]
call fcn.0040b16c
push eax
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x4100a0
xor eax, eax
push ebp
push 0x410099
push dword fs:[eax]
mov dword fs:[eax], esp
push 8
call sub.user32.dll_IsClipboardFormatAvailable
test eax, eax
je 0x410086
push 8
call sub.user32.dll_GetClipboardData
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x410086
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalSize
mov edi, eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x41007f
push dword fs:[eax]
mov dword fs:[eax], esp
test edi, edi
jle 0x410068
cmp dword [ebp - 0xc], 0
je 0x410068
call fcn.004086b4
mov esi, eax
mov edx, dword [ebp - 0xc]
mov eax, esi
mov ecx, edi
call fcn.004084b8
mov eax, esi
xor edx, edx
call fcn.004084a0
mov eax, ebx
mov edx, esi
call fcn.0040f508
mov eax, esi
call fcn.00406688
mov eax, ebx
call fcn.0040e944
xor al, 1
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x410086
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4100a0
call sub.user32.dll_CloseClipboard
ret
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41182c
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push esi
push edi
mov edi, eax
xor ebx, ebx
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x4118a7
call sub.user32.dll_EmptyClipboard
mov eax, edi
xor edx, edx
call fcn.00403ca0
je 0x4118a0
mov eax, edi
call fcn.00403c94
inc eax
add eax, eax
push eax
push 0x2000
call sub.kernel32.dll_GlobalAlloc
mov esi, eax
test esi, esi
je 0x4118a2
push esi
call sub.kernel32.dll_GlobalLock
mov ebx, eax
mov eax, edi
call fcn.00403c94
inc eax
add eax, eax
push eax
mov eax, edi
call fcn.00403c84
mov edx, ebx
pop ecx
call fcn.00402714
push esi
call sub.kernel32.dll_GlobalUnlock
push esi
push 0xd
call sub.user32.dll_SetClipboardData
test eax, eax
setne bl
jmp 0x4118a2
mov bl, 1
call sub.user32.dll_CloseClipboard
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x411a48
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
cmp byte [0x48563c], 0xff
je 0x411a5e
mov al, byte [0x48563c]
jmp 0x411abe
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
mov eax, dword [esp + 0x10]
cmp eax, 2
jne 0x411a97
mov al, 3
mov edx, dword [esp + 4]
cmp edx, 6
jb 0x411a83
mov al, 6
jmp 0x411ab9
cmp edx, 5
jb 0x411ab9
cmp dword [esp + 8], 1
jb 0x411a93
mov al, 5
jmp 0x411ab9
mov al, 4
jmp 0x411ab9
cmp eax, 1
jne 0x411ab7
mov al, 1
cmp dword [esp + 4], 4
ja 0x411ab3
cmp dword [esp + 4], 4
jne 0x411ab9
cmp dword [esp + 8], 0xa
jb 0x411ab9
mov al, 2
jmp 0x411ab9
xor eax, eax
mov byte [0x48563c], al
add esp, 0x94
ret
Function at 0x413454
Capabilities:
Initialize winsock library

Disassembly:
add esp, 0xfffffe70
cmp dword [0x485678], 0
jne 0x413475
push esp
push 0x101
call sub.wsock32.dll_WSAStartup
test eax, eax
sete al
jmp 0x413477
mov al, 1
inc dword [0x485678]
add esp, 0x190
ret
Function at 0x4165fc
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
test dl, dl
je 0x416631
push 0
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0x18]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0x49]
test eax, eax
je 0x416626
push 0
mov eax, dword [eax + 0x18]
push eax
call sub.user32.dll_ShowWindow
lea eax, [ebx + 0xb8]
call fcn.00413178
cmp byte [ebx + 0x60], 0
jne 0x41668d
mov dword [ebx + 8], 0x58
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0x18]
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], 1
mov dword [ebx + 0x14], 7
mov dword [ebx + 0x18], 0x401
mov eax, dword [ebx + 4]
call fcn.0040c484
mov dword [ebx + 0x1c], eax
mov eax, dword [ebx + 0x6c]
call fcn.004039d0
mov edx, eax
lea eax, [ebx + 0x20]
mov ecx, 0x3f
call fcn.00407cb8
lea eax, [ebx + 8]
push eax
push 0
call sub.shell32.dll_Shell_NotifyIconA
mov byte [ebx + 0x60], 1
pop ebx
ret

Function at 0x41b740
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x41b80e
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
xor eax, eax
mov dword [ebx + 0x2c], eax
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00402884
mov dword [ebp - 0x48], 0x44
mov dword [ebp - 0x1c], 1
xor eax, eax
mov al, byte [ebx + 0x38]
mov word [ebp - 0x18], ax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
push 0
push 0x4000000
push 0
push 0
push 0
push edi
push 0x41b828
push dword [ebp - 4]
lea eax, [ebp - 0x60]
mov edx, 3
call fcn.004038cc
mov eax, dword [ebp - 0x60]
lea edx, [ebp - 0x5c]
call fcn.00407c20
mov eax, dword [ebp - 0x5c]
call fcn.004039d0
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x41b7f3
mov eax, dword [ebp - 0x50]
mov dword [ebx + 0x2c], eax
mov esi, dword [ebp - 0x58]
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41b815
lea eax, [ebp - 0x60]
mov edx, 2
call fcn.004035ec
ret
Function at 0x41ba0c
Capabilities:
Create pipe

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov esi, eax
cmp dword [esi + 8], 0
je 0x41ba21
mov bl, 1
jmp 0x41bacb
mov dword [esp], 0xc
mov dword [esp + 8], 0xffffffff
xor eax, eax
mov dword [esp + 4], eax
push 0
lea eax, [esp + 4]
push eax
lea eax, [esi + 0xc]
push eax
lea eax, [esi + 8]
push eax
call sub.kernel32.dll_CreatePipe
test eax, eax
je 0x41ba84
push 0x2000
lea eax, [esp + 4]
push eax
lea eax, [esi + 0x14]
push eax
lea eax, [esi + 0x10]
push eax
call sub.kernel32.dll_CreatePipe
test eax, eax
je 0x41ba84
push 0x2000
lea eax, [esp + 4]
push eax
lea eax, [esi + 0x1c]
push eax
lea eax, [esi + 0x18]
push eax
call sub.kernel32.dll_CreatePipe
test eax, eax
jne 0x41ba88
xor ebx, ebx
jmp 0x41ba8a
mov bl, 1
test bl, bl
je 0x41bab7
push 0
push 1
mov eax, dword [esi + 0x10]
push eax
call sub.kernel32.dll_SetHandleInformation
push 0
push 1
mov eax, dword [esi + 0x18]
push eax
call sub.kernel32.dll_SetHandleInformation
push 0
push 1
mov eax, dword [esi + 0xc]
push eax
call sub.kernel32.dll_SetHandleInformation
jmp 0x41bacb
call sub.kernel32.dll_GetLastError_1
mov edi, eax
mov eax, esi
call fcn.0041bad4
push edi
call sub.kernel32.dll_SetLastError
mov eax, ebx
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x41bdc4
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x5c], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x41bf36
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx + 4], 0
jne 0x41bf1b
xor eax, eax
mov dword [ebx + 0x2c], eax
xor eax, eax
mov dword [ebx + 0x28], eax
mov eax, ebx
call fcn.0041ba0c
test al, al
jne 0x41be1f
call sub.kernel32.dll_GetLastError_1
mov edx, eax
lea eax, [ebx + 0x80]
call fcn.00412f70
jmp 0x41bf1b
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x44
call fcn.00402884
mov dword [ebp - 0x44], 0x44
mov dword [ebp - 0x18], 0x101
xor eax, eax
mov al, byte [ebx + 0x38]
mov word [ebp - 0x14], ax
mov eax, dword [ebx + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebx + 0x1c]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x44]
push eax
mov eax, dword [ebp + 8]
push eax
push 0
push 0x10
push 0xffffffffffffffff
push 0
push 0
push esi
push 0x41bf50
push edi
lea eax, [ebp - 0x5c]
mov edx, 3
call fcn.004038cc
mov eax, dword [ebp - 0x5c]
lea edx, [ebp - 0x58]
call fcn.00407c20
mov eax, dword [ebp - 0x58]
call fcn.004039d0
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x41befe
mov eax, dword [ebp - 0x4c]
mov dword [ebx + 0x2c], eax
mov eax, dword [ebp - 0x54]
mov dword [ebx + 4], eax
mov eax, dword [ebp - 0x50]
push eax
call sub.kernel32.dll_CloseHandle_1
cmp byte [ebx + 0x39], 1
jne 0x41beed
cmp dword [ebx + 0x20], 0
jne 0x41bed1
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [ebx + 0x20], eax
lea eax, [ebx + 0x74]
call fcn.00413178
mov eax, ebx
call fcn.0041bb30
push 0xffffffffffffffff
mov eax, dword [ebx + 0x20]
push eax
call sub.kernel32.dll_WaitForSingleObject
jmp 0x41bf1b
lea eax, [ebx + 0x74]
call fcn.00413178
mov eax, ebx
call fcn.0041bb30
jmp 0x41bf1b
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x44], eax
mov eax, ebx
call fcn.0041bad4
lea eax, [ebx + 0x80]
mov edx, dword [ebp - 0x44]
call fcn.00412f70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41bf3d
lea eax, [ebp - 0x5c]
mov edx, 2
call fcn.004035ec
ret
Function at 0x42ef34
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov dword [esp], ecx
mov esi, edx
mov edi, eax
xor ebx, ebx
xor ecx, ecx
mov eax, dword [esp]
mov ebp, 3
cdq
idiv ebp
lea eax, [eax + eax*2]
mov dword [esp + 4], eax
cmp ecx, dword [esp + 4]
jge 0x42efc7
xor eax, eax
mov al, byte [edi]
shl eax, 0x10
xor edx, edx
mov dl, byte [edi + 1]
shl edx, 8
or eax, edx
xor edx, edx
mov dl, byte [edi + 2]
or eax, edx
mov edx, eax
shr edx, 0x12
and edx, 0x3f
mov dl, byte [edx + 0x486068]
mov byte [esi + ebx], dl
mov edx, eax
shr edx, 0xc
and edx, 0x3f
mov dl, byte [edx + 0x486068]
mov byte [esi + ebx + 1], dl
mov edx, eax
shr edx, 6
and edx, 0x3f
mov dl, byte [edx + 0x486068]
mov byte [esi + ebx + 2], dl
and eax, 0x3f
mov al, byte [eax + 0x486068]
mov byte [esi + ebx + 3], al
add ebx, 4
add edi, 3
add ecx, 3
cmp ecx, dword [esp + 4]
jl 0x42ef5e
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
mov ecx, edx
test ecx, ecx
je 0x42f035
xor eax, eax
mov al, byte [edi]
shl eax, 0x10
cmp ecx, 2
jne 0x42efee
xor edx, edx
mov dl, byte [edi + 1]
shl edx, 8
or eax, edx
mov edx, eax
shr edx, 0x12
and edx, 0x3f
mov dl, byte [edx + 0x486068]
mov byte [esi + ebx], dl
mov edx, eax
shr edx, 0xc
and edx, 0x3f
mov dl, byte [edx + 0x486068]
mov byte [esi + ebx + 1], dl
cmp ecx, 2
jne 0x42f028
shr eax, 6
and eax, 0x3f
mov al, byte [eax + 0x486068]
mov byte [esi + ebx + 2], al
jmp 0x42f02d
mov byte [esi + ebx + 2], 0x3d
mov byte [esi + ebx + 3], 0x3d
add ebx, 4
mov eax, ebx
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x45f2a0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 8
push 0
push 0
dec ecx
jne 0x45f2a9
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
test dl, dl
je 0x45f2c2
add esp, 0xfffffff0
call fcn.00402c98
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x45fbd0
push dword fs:[eax]

Function at 0x45fd98
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x4889f0
cmp dword [edi], 0
jne 0x45fe14
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x4889ec]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x48742c
mov ecx, 2
call fcn.00402714
mov edx, 0x45fd70
lea eax, [esi + 5]
call fcn.0045fd90
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0045fd90
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0x52b
jl 0x45fde9
mov dword [0x4889ec], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8