joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7d732bd6
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
lea eax, [eax + 0xc]
mov edx, eax
cmp edx, eax
je 0x7d732c30
push eax
push 0x7d73173a
call fcn.7d732c6e
push 7
push 0x7d8670bc
push dword [eax + 0x30]
call fcn.7d732fc7
cmp eax, 0
jne 0x7d732c0a
inc eax
jmp 0x7d732c32
push 0x7d731752
call fcn.7d732c6e
push 7
push 0x7d8670bc
push dword [eax + 0x30]
call fcn.7d732fc7
cmp eax, 0
jne 0x7d732c2b
inc eax
jmp 0x7d732c32
pop eax
mov eax, dword [eax]
jmp 0x7d732be4
xor eax, eax
ret

Function at 0x7d732c48
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
mov eax, dword fs:[0x30]
mov al, byte [eax + 0x68]
and al, 0x70
cmp al, 0x70
sete al
movzx eax, al
ret

Function at 0x7d732c5c
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, dword fs:[0x30]
mov al, byte [eax + 2]
test al, al
setne al
movzx eax, al
ret

Function at 0x7d732c6e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
lea edi, [0x7d8670bc]
mov esi, dword [ebp + 8]
lodsw ax, word [esi]
xor ax, 0xe9
stosw word es:[edi], ax
cmp ax, 0
jne 0x7d732c7c
pop edi
pop esi
leave
ret 4

Function at 0x7d732c90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
lea edi, [0x7d8670bc]
mov esi, dword [ebp + 8]
lodsb al, byte [esi]
xor al, 0xe9
stosb byte es:[edi], al
cmp al, 0
jne 0x7d732c9e
pop edi
pop esi
leave
ret 4

Function at 0x7d732ed2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x3c]
mov eax, dword [eax + ebx + 0x78]
add eax, ebx
mov ecx, dword [eax + 0x18]
mov edx, dword [eax + 0x20]
mov edi, dword [edx + ebx]
test edi, edi
je 0x7d732f23
add edi, ebx
xchg esi, eax
push ecx
xor eax, eax
lea ecx, [eax - 1]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg esi, eax
mov esi, dword [ebp + 0xc]
repe cmpsb byte [esi], byte es:[edi]
pop ecx
jne 0x7d732f23
sub ecx, dword [eax + 0x18]
neg ecx
mov edx, dword [eax + 0x24]
add edx, ebx
movzx edx, word [edx + ecx*2]
mov eax, dword [eax + 0x1c]
add eax, ebx
mov eax, dword [eax + edx*4]
add eax, ebx
jmp 0x7d732f2a
add edx, 4
loop 0x7d732eea
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret 8

Function at 0x7d732f31
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
push esi
push edi
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
lea ebp, [eax + 0xc]
mov eax, dword [ebp]
mov esi, dword [eax + 0x30]
movzx ecx, word [eax + 0x2e]
mov edi, dword [esp + 0x10]
mov dx, word [esi]
cmp dx, word [edi]
je 0x7d732f7d
cmp dx, 0x41
jb 0x7d732f62
cmp dx, 0x5a
jbe 0x7d732f68
cmp dx, 0x61
jb 0x7d732f74
cmp dx, 0x7a
ja 0x7d732f74
xor dx, 0x20
jmp 0x7d732f76
jmp 0x7d732f90
cmp dx, word [edi]
je 0x7d732f7d
jmp 0x7d732f90
add edi, 2
add esi, 2
sub ecx, 2
cmp ecx, 0
jne 0x7d732f4e
mov eax, dword [eax + 0x18]
jmp 0x7d732f98
mov eax, dword [eax]
cmp ebp, eax
jne 0x7d732f43
xor eax, eax
pop edi
pop esi
pop ebp
ret 4
Function at 0x40e490
Capabilities:
Create process on windows
Get common file path
Set current directory

Disassembly:
sub esp, 0x438
push ebx
push esi
push edi
mov edi, eax
lea eax, [esp + 0x20]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push edi
call fcn.00406890
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x4339ce
mov eax, dword [0x4a56fc]
test eax, eax
je 0x4339e7
mov byte [esp + 0xf], 0
mov esi, 0x4a6888
cmp eax, 1
je 0x4339fb
push 0x4a56fc
lea ecx, [esp + 0x13]
mov eax, 0x4a5714
call fcn.0040fd70
test al, al
je 0x433a1c
mov dl, byte [0x4a6888]
mov bl, byte [0x4a6889]
push 0x4a56f8
lea eax, [esp + 0x234]
push eax
push 0x104
push 0x4a5714
mov byte [0x4a5700], dl
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov ecx, dword [0x4a56fc]
push ecx
push 0x4a5714
call fcn.0040dc60
test eax, eax
jne 0x433a30
cmp bl, 1
je 0x433a54
call fcn.00411490
call fcn.00411680
cmp byte [0x4a5700], 0
jne 0x40e568
mov esi, 0x4a5ec0
call fcn.0040ed40
push 1
mov ecx, 0x4a5920
call fcn.004043c0
cmp byte [0x4a5700], 0
jne 0x40e587
mov ecx, 0x4a5ec0
call fcn.0040ee40
mov ebx, 0x4a6888
call fcn.0040f550
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
pop edi
pop esi
pop ebx
add esp, 0x438
ret
push 0x10
push 0x4856d6
push str.This_is_a_compiled_AutoIt_script._AV_researchers_please_email_avsupport_autoitscript.com_for_support.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40e59c
lea ecx, [esp + 0x20]
mov dword [0x494c9c], 0xffffffff
push ecx
jmp 0x40e596
mov edx, dword [0x4a5704]
push 0xffffffffffffffff
push edx
push 1
xor bl, bl
call fcn.00411240
mov al, byte [0x494c90]
mov byte [0x4a688b], al
jmp 0x40e529
lea ecx, [esp + 0x20]
mov dword [0x494c9c], 1
push ecx
jmp 0x40e596
mov ebx, 0x4a6888
call fcn.0040f550
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov dword [0x494c9c], 1
jmp 0x40e59c
call fcn.00438130
test al, al
jne 0x40e54b
push 0x104
lea eax, [esp + 0x234]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp byte [esp + 0xf], 0
je 0x433ad5
mov edi, 0x485740
lea esi, [esp + 0x10]
call fcn.00405a50
mov edi, 0x4a5714
mov eax, esi
call fcn.0040d6c0
mov edi, 0x485740
mov eax, esi
call fcn.0040d6c0
mov edx, dword [esp + 0x10]
push 1
lea ecx, [esp + 0x24]
push ecx
push edx
lea eax, [esp + 0x23c]
push eax
push 0x485744
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, esi
call fcn.004059c0
jmp 0x40e587
push 1
lea ecx, [esp + 0x24]
push ecx
push edi
lea edx, [esp + 0x23c]
push edx
push 0x485744
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x40e587
Function at 0x4113b0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esi]
sub esp, 8
test al, 3
jne 0x42af7b
add esp, 8
ret
test al, 1
je 0x42af9d
mov ecx, dword [esi + 4]
lea eax, [esp]
push eax
push ecx
call fcn.00415712
mov edx, dword [esp + 8]
add esp, 8
or edx, dword [esp + 4]
jne 0x4113bd
mov eax, dword [esi]
test al, 0x20
je 0x42afc3
mov eax, dword [esi + 4]
push eax
push 2
push 1
push 0x487d9c
call fcn.004158e2
mov dword [esi + 0xc], 1
add esp, 0x10
add esp, 8
ret
test al, 0x40
je 0x42afe7
mov ecx, dword [esi + 4]
push ecx
push 2
push 1
push 0x487eb0
call fcn.004158e2
mov dword [esi + 0xc], 2
add esp, 0x10
add esp, 8
ret
test al, al
jns 0x4113bd
mov edx, dword [esi + 4]
push edx
push 3
push 1
push str.rb
call fcn.004158e2
mov dword [esi + 0xc], 4
add esp, 0x10
add esp, 8
ret

Function at 0x411400
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, dword [esp + 8]
mov eax, dword [ebp]
mov dword [ebp + 0xc], 0
mov byte [ebp + 8], 0
test al, 0x14
jne 0x411486
test al, al
js 0x42aee7
test al, 0x20
jne 0x42aef3
test al, 0x40
jne 0x42aeff
mov eax, dword [esp + 0xc]
push 0x487eb8
push eax
call fcn.004155ec
add esp, 8
test eax, eax
je 0x411486
push esi
push edi
mov esi, eax
push esi
push 3
lea ecx, [esp + 0x18]
push 1
push ecx
call fcn.00415cf7
push esi
mov edi, eax
call fcn.004159db
mov al, byte [esp + 0x24]
add esp, 0x14
cmp edi, 2
jb 0x41147c
cmp al, 0xff
je 0x42af0b
cmp al, 0xfe
je 0x42af26
cmp al, 0xef
je 0x42af41
pop edi
pop esi
pop ebp
ret 8
mov dword [ebp + 0xc], 4
jmp 0x41142f
mov dword [ebp + 0xc], 1
jmp 0x41142f
mov dword [ebp + 0xc], 2
jmp 0x41142f
cmp byte [esp + 0x11], 0xfe
jne 0x41147c
mov dword [ebp + 0xc], 1
mov byte [ebp + 8], 1
jmp 0x411484
cmp byte [esp + 0x11], 0xff
jne 0x41147c
mov dword [ebp + 0xc], 2
mov byte [ebp + 8], 1
jmp 0x411484
cmp edi, 3
jb 0x411484
cmp byte [esp + 0x11], 0xbb
jne 0x411484
cmp byte [esp + 0x12], 0xbf
jne 0x411484
mov dword [ebp + 0xc], 4
mov byte [ebp + 8], 1
jmp 0x411484

Function at 0x411680
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x494cc8]
push esi
push 0
mov esi, dword [sym.imp.USER32.dll_CreateWindowExW]
push eax
push 0
push 0
push 0x64
push 0x12c
push accept
push accept
push 0xcf0000
push str.AutoIt_v3
push str.AutoIt_v3
push 0
call esi
mov ecx, dword [0x494cc8]
push 0
push ecx
push 1
push eax
push 0
push 0
push 0
push 0
push 0x50b008c4
push 0
push str.edit
push 0
mov dword [0x494cc0], eax
call esi
mov edx, dword [0x494cc0]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push edx
mov dword [0x494cbc], eax
call esi
mov eax, dword [0x494cc0]
push 0
push eax
call esi
pop esi
ret
Function at 0x424ef8
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004183f5
and dword [ebp - 4], 0
cmp dword [0x4948fc], 0
mov ebx, eax
jne 0x424fa9
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x42505a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x484de0
push edi
call esi
test eax, eax
je 0x42505a
push eax
call fcn.00418383
mov dword [esp], 0x484dd0
push edi
mov dword [0x4948fc], eax
call esi
push eax
call fcn.00418383
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x494900], eax
call esi
push eax
call fcn.00418383
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x494904], eax
call esi
push eax
call fcn.00418383
pop ecx
mov dword [0x49490c], eax
test eax, eax
je 0x424fa9
push 0x484d88
push edi
call esi
push eax
call fcn.00418383
pop ecx
mov dword [0x494908], eax
mov eax, dword [0x494908]
cmp eax, ebx
je 0x425001
cmp dword [0x49490c], ebx
je 0x425001
push eax
call fcn.004183fe
push dword [0x49490c]
mov esi, eax
call fcn.004183fe
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x425001
test edi, edi
je 0x425001
call esi
test eax, eax
je 0x424ff8
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x424ff8
test byte [ebp - 0xc], 1
jne 0x425001
or dword [ebp + 0x10], 0x200000
jmp 0x42503a
mov eax, dword [0x494900]
cmp eax, ebx
je 0x42503a
push eax
call fcn.004183fe
pop ecx
test eax, eax
je 0x42503a
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x42503a
mov eax, dword [0x494904]
cmp eax, ebx
je 0x42503a
push eax
call fcn.004183fe
pop ecx
test eax, eax
je 0x42503a
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4948fc]
call fcn.004183fe
pop ecx
test eax, eax
je 0x42505a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x42505c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x435421
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x24
mov eax, dword [esp + 0x2c]
push ebx
push ebp
mov ebp, dword [esp + 0x38]
push esi
xor esi, esi
push edi
mov dword [esp + 0x3c], esi
cmp word [eax], si
je 0x43554a
push esi
push esi
push 3
push esi
push esi
push accept
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x435464
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 0x10
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push 0
lea ecx, [esp + 0x18]
push ecx
push ebx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x10]
push edx
push 1
push esi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x3c]
push eax
push 0x483a20
push 0
push 0
push ecx
call dword [sym.imp.OLEAUT32.dll_OleCreatePictureIndirect]
mov eax, dword [esp + 0x10]
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x435458
mov ecx, dword [eax]
lea edx, [esp + 0x40]
push edx
push eax
mov eax, dword [ecx + 0xc]
call eax
mov edx, dword [esp + 0x40]
lea ecx, [esp + 0x18]
push ecx
push 0x18
push edx
call dword [sym.imp.GDI32.dll_GetObjectW]
cmp dword [ebp], 0
mov eax, dword [esp + 0x44]
jne 0x43551f
cmp dword [eax], 0
jne 0x43551f
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
mov dword [ebp], ecx
mov dword [eax], edx
mov eax, dword [eax]
mov ecx, dword [ebp]
mov edx, dword [esp + 0x40]
push 0x2000
push eax
push ecx
push 0
push edx
call dword [sym.imp.USER32.dll_CopyImage]
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
jmp 0x43554e
mov dword [esp + 0x40], esi
mov esi, dword [esp + 0x38]
mov eax, dword [esi + 0x60]
test eax, eax
je 0x435560
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [esp + 0x40]
push eax
push 0
mov dword [esi + 0x60], eax
mov esi, dword [esi]
push 0x172
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 0x10
Function at 0x435efb
Capabilities:
Create process on windows

Disassembly:
push 0x44
push 0
push 0x4a6d00
call fcn.00414580
push 0x10
push 0
push 0x4a6cec
call fcn.00414580
mov ecx, dword [esp + 0x1c]
add esp, 0x18
push 0x4a6cec
push 0x4a6d00
push 0
push 0
push 0x20
push 0
push 0
push 0
push ecx
mov eax, 1
push 0
mov dword [0x4a6d00], 0x44
mov dword [0x4a6d2c], 1
mov word [0x4a6d30], ax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x435f70
mov edx, dword [0x4a6cec]
mov dword [esp + 4], edx
jmp dword [sym.imp.KERNEL32.dll_CloseHandle]
ret 4
Function at 0x436aee
Capabilities:
Enumerate files on windows
Enumerate files recursively
Get file attributes
Set current directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x254
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
lea eax, [esp + 0x10]
mov dword [esp + 0xc], ecx
mov ecx, dword [ebp + 8]
push eax
push ecx
xor bl, bl
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x436b81
lea ecx, [ecx]
lea edx, [esp + 0x3c]
push 0x487fa4
push edx
call fcn.00414774
add esp, 8
test eax, eax
je 0x436b71
lea eax, [esp + 0x3c]
push 0x48ae74
push eax
call fcn.00414774
add esp, 8
test eax, eax
je 0x436b71
lea ecx, [esp + 0x3c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
not edx
and eax, edx
push eax
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x436b9b
mov bl, 1
lea ecx, [esp + 0x10]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x436b1e
push esi
mov esi, dword [sym.imp.KERNEL32.dll_FindClose]
call esi
cmp byte [ebp + 0x14], 0
jne 0x436bad
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea edx, [esp + 0x10]
push edx
push 0x48ae6c
call edi
mov edi, eax
cmp edi, 0xffffffff
je 0x436c34
mov ebx, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test byte [esp + 0x10], 0x10
je 0x436c24
lea eax, [esp + 0x3c]
push 0x487fa4
push eax
call fcn.00414774
add esp, 8
test eax, eax
je 0x436c24
lea ecx, [esp + 0x3c]
push 0x48ae74
push ecx
call fcn.00414774
add esp, 8
test eax, eax
je 0x436c24
lea edx, [esp + 0x3c]
push edx
call ebx
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push ecx
mov ecx, dword [esp + 0x14]
push edx
push eax
call fcn.00436aee
test al, al
je 0x436c42
push 0x48ae74
call ebx
lea ecx, [esp + 0x10]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x436bc6
push edi
call esi
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push edi
call esi
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x436e8d
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov ecx, dword [esp + 0x210]
push ecx
push 0
push 0x48846c
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
add esp, 0x20c
ret 4

Function at 0x437036
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x464]
test eax, eax
je 0x43704c
cmp eax, 0x10000
jne 0x437070
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x45c]
push eax
push 0x10000
push 1
push ecx
call fcn.00415cf7
add esp, 0x10
mov dword [esi + 0x464], 0
mov ecx, dword [esi + 0x464]
mov edx, dword [esi + 0x45c]
mov al, byte [ecx + edx]
inc ecx
mov dword [esi + 0x464], ecx
pop esi
ret 4
Function at 0x438357
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub esp, 0x28
push esi
mov esi, dword [esp + 0x30]
push edi
test esi, esi
jl 0x438407
jne 0x438378
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
pop esi
add esp, 0x28
ret
cmp esi, 0xf
jae 0x438400
mov edi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 0x18]
push eax
call edi
test eax, eax
je 0x438400
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [esp + 0x10]
push edx
call edi
fnstcw word [esp + 0x34]
mov eax, dword [esp + 0x10]
sub eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
sbb ecx, dword [esp + 0x1c]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
fild qword [esp + 0x20]
movzx eax, word [esp + 0x34]
fild qword [esp + 0x28]
or eax, 0xc00
mov dword [esp + 8], eax
fdivp st(1)
fmul qword [0x48d318]
fldcw word [esp + 8]
fistp qword [esp + 8]
mov edx, dword [esp + 8]
fldcw word [esp + 0x34]
cmp edx, esi
jb 0x43839d
pop edi
pop esi
add esp, 0x28
ret
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
pop esi
add esp, 0x28
ret

Function at 0x438667
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
sub esp, 0x29c
push esi
mov esi, dword [esp + 0x2a4]
push edi
mov edi, dword [esp + 0x2ac]
lea eax, [esp + 0x110]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
test eax, eax
jne 0x438746
push 0x100
lea ecx, [esp + 0x14]
push ecx
call sub.WSOCK32.dll_gethostname
lea edx, [esp + 0x10]
push edx
call sub.WSOCK32.dll_gethostbyname
test eax, eax
je 0x438746
mov eax, dword [eax + 0xc]
xor edx, edx
cmp dword [eax], edx
je 0x4386d0
mov ecx, eax
lea esp, [esp]
add ecx, 4
inc edx
cmp dword [ecx], 0
jne 0x4386c7
cmp esi, edx
jle 0x4386f0
push str.0.0.0.0
push edi
call fcn.00412a21
add esp, 8
call sub.WSOCK32.dll_WSACleanup
pop edi
pop esi
add esp, 0x29c
ret
mov eax, dword [eax + esi*4 - 4]
push 4
push eax
lea ecx, [esp + 0x14]
push ecx
call fcn.00412300
mov edx, dword [esp + 0x18]
add esp, 0xc
push edx
call sub.WSOCK32.dll_inet_ntoa
push eax
lea eax, [esp + 0x14]
push eax
call fcn.00414d20
lea ecx, [esp + 0x18]
push ecx
or eax, 0xffffffff
call fcn.00410c00
mov esi, eax
push esi
push edi
call fcn.00412a21
push esi
call fcn.004127bd
add esp, 0x18
call sub.WSOCK32.dll_WSACleanup
pop edi
pop esi
add esp, 0x29c
ret
push 0x4858e8
push edi
call fcn.00412a21
add esp, 8
pop edi
pop esi
add esp, 0x29c
ret
Function at 0x4387a4
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x20c
push 0x104
push eax
lea ecx, [esp + 8]
push ecx
call fcn.0043840d
lea edx, [esp + 0xc]
push edx
call fcn.00412665
add esp, 0x10
test eax, eax
je 0x4387e0
cmp word [esp + eax*2 - 2], 0x5c
lea eax, [esp + eax*2 - 2]
jne 0x4387e0
xor ecx, ecx
mov word [eax], cx
push ebp
lea edx, [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x438889
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, 2
jne 0x43881d
push 0
lea eax, [esp + 8]
push eax
call ebp
test eax, eax
je 0x438822
mov al, 1
pop ebp
add esp, 0x20c
ret
cmp eax, 3
jne 0x43888d
push esi
push edi
lea edi, [esp + 0xc]
call fcn.0040fe00
mov esi, eax
push 0x5c
push esi
call fcn.00416b26
add esp, 8
test eax, eax
jne 0x438853
push esi
call fcn.004127bd
add esp, 4
pop edi
pop esi
xor al, al
pop ebp
add esp, 0x20c
ret
push ebx
xor ecx, ecx
push esi
mov word [eax], cx
call fcn.004387a4
push esi
mov bl, al
call fcn.004127bd
add esp, 8
test bl, bl
je 0x43887c
push 0
lea edx, [esp + 0x14]
push edx
call ebp
test eax, eax
setne bl
mov al, bl
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x20c
ret
test al, 0x10
jne 0x438813
xor al, al
pop ebp
add esp, 0x20c
ret

Function at 0x438baa
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x438bc1
test al, 0x10
je 0x438bc1
mov al, 1
ret
xor al, al
ret

Function at 0x438bc4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x254
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x438c03
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x438bf8
or eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 8]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x438fae
Capabilities:
Enumerate process modules

Disassembly:
mov eax, 0x102c
call fcn.0041fe20
push ebp
mov ebp, dword [esp + 0x103c]
lea eax, [esp + 4]
push eax
push 0x800
lea ecx, [esp + 0x838]
push ecx
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x438fe5
xor al, al
pop ebp
add esp, 0x102c
ret
mov edx, dword [esp + 0x1034]
push ebx
push esi
mov esi, dword [esp + 0xc]
push edx
shr esi, 2
mov byte [ebp], 0
call fcn.00438f72
add esp, 4
xor ebx, ebx
mov dword [esp + 0x14], eax
test esi, esi
jbe 0x4390f9
push edi
cmp byte [ebp], 0
jne 0x4390f8
mov eax, dword [esp + ebx*4 + 0x83c]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
lea ecx, [esp + 0x10]
push ecx
push 4
lea edx, [esp + 0x1c]
mov edi, eax
push edx
push edi
call sub.PSAPI.DLL_EnumProcessModules
mov ecx, dword [esp + 0x14]
push 0x104
lea eax, [esp + 0x22c]
push eax
push ecx
push edi
call sub.PSAPI.DLL_GetModuleBaseNameW
test eax, eax
je 0x4390e8
lea edx, [esp + 0x434]
push edx
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x640]
push ecx
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x238]
push eax
call fcn.00415140
lea ecx, [esp + 0x448]
push ecx
lea edx, [esp + 0x3c]
push edx
call fcn.004129f3
mov eax, dword [esp + 0x105c]
push eax
lea ecx, [esp + 0x44]
push ecx
call fcn.00412960
add esp, 0x24
test eax, eax
jne 0x4390c8
mov edx, dword [esp + ebx*4 + 0x83c]
mov eax, dword [esp + 0x1044]
mov dword [eax], edx
jmp 0x4390e4
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x4390e8
mov eax, dword [esp + ebx*4 + 0x83c]
cmp ecx, eax
jne 0x4390e8
mov ecx, dword [esp + 0x1044]
mov dword [ecx], eax
mov byte [ebp], 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, esi
jb 0x439011
pop edi
pop esi
pop ebx
mov al, 1
pop ebp
add esp, 0x102c
ret

Function at 0x439105
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x840
push ebx
push ebp
mov ebp, dword [esp + 0x84c]
push esi
mov esi, dword [esp + 0x858]
push edi
push 0
push 2
mov dword [esp + 0x20], 0x22c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
lea eax, [esp + 0x18]
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
push ebp
mov byte [esi], 0
call fcn.00438f72
add esp, 4
cmp byte [esi], 0
mov ebx, eax
jne 0x4391ea
lea ecx, [ecx]
lea ecx, [esp + 0x18]
push ecx
push edi
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
jne 0x4391ea
lea edx, [esp + 0x448]
push edx
lea eax, [esp + 0x248]
push eax
lea ecx, [esp + 0x654]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x4c]
push eax
call fcn.00415140
lea ecx, [esp + 0x45c]
push ecx
lea edx, [esp + 0x25c]
push edx
call fcn.004129f3
lea eax, [esp + 0x260]
push ebp
push eax
call fcn.00412960
add esp, 0x24
test eax, eax
jne 0x4391c9
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x858]
mov dword [edx], ecx
jmp 0x4391de
test ebx, ebx
je 0x4391e1
mov eax, dword [esp + 0x20]
cmp ebx, eax
jne 0x4391e1
mov ecx, dword [esp + 0x858]
mov dword [ecx], eax
mov byte [esi], 1
cmp byte [esi], 0
je 0x439155
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x840
ret