joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52b4c8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor ebx, ebx
mov dword [ebp - 4], ebx
test dl, dl
je 0x52b4e0
add esp, 0xfffffff0
call fcn.00405c80
mov byte [ebp - 9], dl
mov dword [ebp - 8], eax
mov ebx, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x52b5fa
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 8]
mov dword [eax + 8], ebx
mov eax, ebx
add eax, eax
add eax, eax
add eax, eax
call fcn.0040449c
mov edx, dword [ebp - 8]
mov dword [edx + 0xc], eax
dec ebx
test ebx, ebx
jl 0x52b5e4
inc ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
call fcn.004e918c
xor eax, eax
push ebp
push 0x52b5d1
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x30]
call fcn.004e918c
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0x10]
lea ebx, [eax + edx*8]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov eax, dword [eax + 8]
mov dword [ebx], eax
lea eax, [ebx + 4]
mov edx, dword [ebp - 4]
call fcn.00407a64
jmp 0x52b5a2
lea eax, [ebx + 4]
mov ecx, 1
mov edx, 1
call fcn.0040800c
mov eax, dword [ebx + 4]
call fcn.00407b6c
dec eax
jle 0x52b5b6
mov eax, dword [ebx + 4]
cmp word [eax], 0x5f
je 0x52b590
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52b5d8
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x54]
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52b601
lea eax, [ebp - 4]
call fcn.00407218
ret

Function at 0x532f74
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x532ffa
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push edi
push esi
call sub.kernel32.dll_GetLocaleInfoW_1
mov ebx, eax
test ebx, ebx
jne 0x532fb5
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
call fcn.00407804
jmp 0x532fe4
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00407b78
push ebx
mov eax, dword [ebp - 4]
call fcn.00407890
push eax
push edi
push esi
call sub.kernel32.dll_GetLocaleInfoW_1
mov eax, dword [ebp + 8]
push eax
mov ecx, ebx
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00407f3c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x533001
lea eax, [ebp - 4]
call fcn.004077f4
ret
Function at 0x5ac010
Capabilities:
Create process on windows
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004077ec
xor eax, eax
push ebp
push 0x5ac164
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x433620]
call fcn.0043f8f8
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x5ac13a
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004142c4
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.00407858
cmp dword [ebp - 4], 0
jne 0x5ac080
call fcn.004063dc
jmp 0x5ac141
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00415670
mov eax, dword [ebp - 0x10]
call fcn.00407890
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
je 0x5ac0b4
dec eax
je 0x5ac0e3
jmp 0x5ac124
push ebx
push 0x5ac170
push 0x5ac170
lea ecx, [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x14]
call fcn.00407890
push eax
push 0x5ac174
push 0
call sub.shell32.dll_ShellExecuteW
jmp 0x5ac124
push ebx
push 0x5ac170
lea ecx, [ebp - 0x18]
mov edx, 1
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x18]
call fcn.00407890
push eax
lea ecx, [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x1c]
call fcn.00407890
push eax
push 0x5ac174
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ac141
mov eax, dword [ebp - 8]
call fcn.0040574c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ac16b
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.004077fc
lea eax, [ebp - 4]
call fcn.004077f4
ret

Function at 0x5ac180
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004077ec
mov eax, dword [ebp - 8]
call fcn.004077ec
xor eax, eax
push ebp
push 0x5ac243
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.004142c4
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 4]
call fcn.00407858
cmp dword [ebp - 4], 0
je 0x5ac228
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00415670
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.004156ac
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.00415670
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 8]
call fcn.004156ac
push ebx
mov eax, dword [ebp - 0xc]
call fcn.00407890
push eax
mov eax, dword [ebp - 8]
call fcn.00407890
push eax
mov eax, dword [ebp - 4]
call fcn.00407890
push eax
push 0x5ac254
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ac24a
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.004077fc
ret
Function at 0x5ac260
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x248], edx
mov dword [ebp - 0x24c], edx
mov dword [ebp - 0x244], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004077ec
lea eax, [ebp - 0xc]
mov edx, dword [0x5abfbc]
call fcn.004084e4
xor eax, eax
push ebp
push 0x5ac3f5
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x244]
mov eax, dword [ebp - 4]
call fcn.004142c4
mov edx, dword [ebp - 0x244]
lea eax, [ebp - 4]
call fcn.00407858
cmp dword [ebp - 4], 0
je 0x5ac3c1
xor edx, edx
mov eax, 2
call fcn.005abf5c
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x5ac3ba
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x240], 0x22c
lea edx, [ebp - 0x240]
mov eax, dword [ebp - 0x10]
call fcn.005abf7c
mov ebx, eax
jmp 0x5ac39b
lea eax, [ebp - 0xc]
lea edx, [ebp - 0x21c]
mov ecx, 0x104
call fcn.004079fc
mov edi, dword [ebp - 0x238]
mov dword [ebp - 8], edi
lea edx, [ebp - 0x248]
mov eax, dword [ebp - 4]
call fcn.00413ac8
mov eax, dword [ebp - 0x248]
push eax
lea edx, [ebp - 0x24c]
mov eax, dword [ebp - 0xc]
call fcn.00413ac8
mov eax, dword [ebp - 0x24c]
pop edx
call fcn.004082ac
dec eax
jne 0x5ac380
push edi
push 0xffffffffffffffff
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov esi, eax
lea eax, [ebp - 0x14]
push eax
push esi
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x14]
push eax
push esi
call sub.kernel32.dll_TerminateProcess
push esi
call sub.kernel32.dll_CloseHandle_1
lea edx, [ebp - 0x240]
mov eax, dword [ebp - 0x10]
call fcn.005abf9c
mov ebx, eax
test ebx, ebx
jne 0x5ac39b
call fcn.004063dc
jmp 0x5ac3c1
test ebx, ebx
jne 0x5ac309
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ac3c1
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ac3fc
lea eax, [ebp - 0x24c]
mov edx, 3
call fcn.004077fc
lea eax, [ebp - 0xc]
mov edx, dword [0x5abfbc]
call fcn.004085bc
lea eax, [ebp - 4]
call fcn.004077f4
ret
Function at 0x5ad5a0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
mov byte [ebp - 1], 0
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x5ad657
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.00407890
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
jne 0x5ad5e2
call fcn.004063dc
jmp 0x5ad65e
mov eax, ebx
call fcn.004044b4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
push ebx
push 0
mov eax, esi
call fcn.00407890
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
jne 0x5ad60b
call fcn.004063dc
jmp 0x5ad65e
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x5ad66c
mov eax, dword [ebp - 8]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
jne 0x5ad62c
call fcn.004063dc
jmp 0x5ad65e
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
mov dword [edi], eax
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ad65e
mov eax, dword [ebp - 8]
call fcn.004044d0
ret
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5b33a4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
xor edx, edx
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x58], edx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x50], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5b348c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x44
call fcn.00404e90
mov eax, ebx
xor ecx, ecx
mov edx, 0x10
call fcn.00404e90
mov dword [ebp - 0x44], 0x44
push ebx
lea eax, [ebp - 0x44]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x50]
xor eax, eax
call fcn.00404894
mov eax, dword [ebp - 0x50]
lea edx, [ebp - 0x4c]
call fcn.005b3284
push dword [ebp - 0x4c]
push 0x5b34a4
lea eax, [ebp - 0x54]
call fcn.005b31f0
push dword [ebp - 0x54]
lea eax, [ebp - 0x48]
mov edx, 3
call fcn.00407db4
mov eax, dword [ebp - 0x48]
call fcn.00407890
push eax
lea edx, [ebp - 0x58]
mov eax, dword [0x5cd154]
mov eax, dword [eax]
call fcn.004cb038
mov eax, dword [ebp - 0x58]
call fcn.00407890
push eax
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x5b3471
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b3493
lea eax, [ebp - 0x58]
mov edx, 5
call fcn.004077fc
ret
Function at 0x5b34a8
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.004077ec
mov eax, dword [ebp - 8]
call fcn.004077ec
mov eax, dword [ebp - 0xc]
call fcn.004077ec
xor eax, eax
push ebp
push 0x5b360a
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x44
call fcn.00404e90
mov eax, esi
xor ecx, ecx
mov edx, 0x10
call fcn.00404e90
mov dword [ebp - 0x50], 0x44
push esi
lea eax, [ebp - 0x50]
push eax
lea edx, [ebp - 0x58]
mov eax, dword [0x5cd154]
mov eax, dword [eax]
call fcn.004cb038
mov eax, dword [ebp - 0x58]
lea edx, [ebp - 0x54]
call fcn.00415670
mov eax, dword [ebp - 0x54]
call fcn.00407890
push eax
push 0
push 0x4000000
lea edx, [ebp - 0x64]
xor eax, eax
call fcn.00404894
mov eax, dword [ebp - 0x64]
lea edx, [ebp - 0x60]
call fcn.005b3284
push dword [ebp - 0x60]
push 0x5b3628
lea eax, [ebp - 0x68]
call fcn.005b31f0
push dword [ebp - 0x68]
push 0x5b3638
lea eax, [ebp - 0x5c]
mov edx, 4
call fcn.00407db4
mov eax, dword [ebp - 0x5c]
call fcn.00407890
push eax
lea edx, [ebp - 0x6c]
mov eax, dword [0x5cd154]
mov eax, dword [eax]
call fcn.004cb038
mov eax, dword [ebp - 0x6c]
call fcn.00407890
push eax
push 1
mov eax, dword [ebp - 0xc]
call fcn.00407890
push eax
mov eax, dword [ebp - 8]
call fcn.00407890
push eax
mov eax, dword [ebp - 4]
call fcn.00407890
push eax
call sub.advapi32.dll_CreateProcessWithLogonW
test eax, eax
je 0x5b35e2
mov eax, dword [esi + 4]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [esi]
push eax
call sub.kernel32.dll_CloseHandle_1
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b3611
lea eax, [ebp - 0x6c]
mov edx, 7
call fcn.004077fc
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004077fc
ret
Function at 0x5b3658
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff88
push ebx
xor ebx, ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004077ec
mov eax, dword [ebp - 8]
call fcn.004077ec
mov eax, dword [ebp - 0xc]
call fcn.004077ec
mov eax, dword [ebp + 8]
call fcn.004077ec
xor eax, eax
push ebp
push 0x5b37e8
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x433620]
call fcn.0043f8f8
mov dword [ebp - 0x18], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp - 0x18]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
jl 0x5b36d9
lea ecx, [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x18]
mov edx, dword [eax]
call dword [edx + 0x14]
cmp eax, 2
jl 0x5b36f6
lea ecx, [ebp - 0x14]
mov edx, 1
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dword [ebp - 0x18], edx
call fcn.0040574c
lea eax, [ebp - 0x5c]
xor ecx, ecx
mov edx, 0x44
call fcn.00404e90
lea eax, [ebp - 0x6c]
xor ecx, ecx
mov edx, 0x10
call fcn.00404e90
mov dword [ebp - 0x5c], 0x44
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x5c]
push eax
lea edx, [ebp - 0x70]
mov eax, dword [ebp - 0x10]
call fcn.00415670
mov eax, dword [ebp - 0x70]
call fcn.00407890
push eax
push 0
push 0x4000000
lea edx, [ebp - 0x78]
mov eax, dword [ebp - 0x10]
call fcn.005b3284
push dword [ebp - 0x78]
push 0x5b3804
push dword [ebp - 0x14]
lea eax, [ebp - 0x74]
mov edx, 3
call fcn.00407db4
mov eax, dword [ebp - 0x74]
call fcn.00407890
push eax
mov eax, dword [ebp - 0x10]
call fcn.00407890
push eax
push 1
mov eax, dword [ebp - 0xc]
call fcn.00407890
push eax
mov eax, dword [ebp - 8]
call fcn.00407890
push eax
mov eax, dword [ebp - 4]
call fcn.00407890
push eax
call sub.advapi32.dll_CreateProcessWithLogonW
test eax, eax
je 0x5b37b8
mov eax, dword [ebp - 0x68]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x6c]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b37ef
lea eax, [ebp - 0x78]
mov edx, 3
call fcn.004077fc
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.004077fc
lea eax, [ebp + 8]
call fcn.004077f4
ret
Function at 0x5b3830
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff88
push ebx
xor ebx, ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004077ec
mov eax, dword [ebp - 8]
call fcn.004077ec
mov eax, dword [ebp - 0xc]
call fcn.004077ec
mov eax, dword [ebp + 8]
call fcn.004077ec
xor eax, eax
push ebp
push 0x5b3976
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x6c]
call fcn.005b3808
mov edx, dword [ebp - 0x6c]
lea eax, [ebp - 0x10]
mov ecx, 0x5b3990
call fcn.00407cd0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x74], eax
mov byte [ebp - 0x70], 0x11
lea edx, [ebp - 0x74]
xor ecx, ecx
mov eax, 0x5b39b8
call fcn.00415ea0
lea eax, [ebp - 0x58]
xor ecx, ecx
mov edx, 0x44
call fcn.00404e90
lea eax, [ebp - 0x68]
xor ecx, ecx
mov edx, 0x10
call fcn.00404e90
mov dword [ebp - 0x58], 0x44
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x58]
push eax
lea edx, [ebp - 0x78]
mov eax, dword [ebp + 8]
call fcn.00415670
mov eax, dword [ebp - 0x78]
call fcn.00407890
push eax
push 0
push 0x4000000
mov eax, dword [ebp - 0x14]
call fcn.00407890
push eax
mov eax, dword [ebp - 0x10]
call fcn.00407890
push eax
push 1
mov eax, dword [ebp - 0xc]
call fcn.00407890
push eax
mov eax, dword [ebp - 8]
call fcn.00407890
push eax
mov eax, dword [ebp - 4]
call fcn.00407890
push eax
call sub.advapi32.dll_CreateProcessWithLogonW
test eax, eax
je 0x5b3943
mov eax, dword [ebp - 0x64]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x68]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b397d
lea eax, [ebp - 0x78]
call fcn.004077f4
lea eax, [ebp - 0x6c]
call fcn.004077f4
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.004077fc
lea eax, [ebp + 8]
call fcn.004077f4
ret
Function at 0x5c3838
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x5c3840
push ecx
push ebx
mov eax, 0x5b8410
call fcn.0040b3a8
xor eax, eax
push ebp
push 0x5c3a77
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x18]
mov eax, dword [0x5cd154]
mov eax, dword [eax]
call fcn.004cb038
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00415670
mov eax, dword [ebp - 0x14]
call fcn.00407890
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
push 0
mov eax, dword [0x5cd2e8]
mov eax, dword [eax]
mov ecx, 0x5c3a90
mov edx, 0x5c3ac8
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov edx, dword [0x5cca74]
mov byte [edx], al
lea eax, [ebp - 0x1c]
call fcn.005b32d0
mov edx, dword [ebp - 0x1c]
mov eax, dword [0x5cce88]
call fcn.00407804
call fcn.00404834
lea edx, [ebp - 0x20]
call fcn.00404894
mov eax, dword [ebp - 0x20]
mov edx, 0x5c3ae0
call fcn.00407ed4
je 0x5c393e
mov eax, dword [0x5cd000]
push eax
mov ecx, dword [0x5ccab8]
mov edx, dword [0x5cd0fc]
mov eax, dword [0x5cce88]
mov eax, dword [eax]
call fcn.005b30c4
test al, al
je 0x5c393e
mov eax, dword [0x5cca74]
cmp byte [eax], 0
je 0x5c393e
push 0x5d38a4
mov ecx, dword [0x5cd000]
mov ecx, dword [ecx]
mov edx, dword [0x5ccab8]
mov edx, dword [edx]
mov eax, dword [0x5cd0fc]
mov eax, dword [eax]
call fcn.005b34a8
test al, al
jne 0x5c3a5c
mov eax, 0x5d38a4
call fcn.005b33a4
jmp 0x5c3a5c
push 0x5c3afc
push 0
push 0
call fcn.0040c4fc
mov dword [0x5d38a0], eax
xor eax, eax
push ebp
push 0x5c39e4
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
je 0x5c39cb
lea edx, [ebp - 0x24]
xor eax, eax
call fcn.00404894
mov eax, dword [ebp - 0x24]
cmp word [eax], 0x5c
jne 0x5c399b
push 0
push 0x5c3b44
push 0x5c3b4c
push 0
call sub.user32.dll_MessageBoxW
call fcn.004063dc
jmp 0x5c3a5c
mov eax, dword [0x5cd154]
mov eax, dword [eax]
call fcn.004ca5e0
mov ecx, dword [0x5cced8]
mov eax, dword [0x5cd154]
mov eax, dword [eax]
mov edx, dword [0x5b3a70]
call fcn.004ca5f8
mov eax, dword [0x5cd154]
mov eax, dword [eax]
call fcn.004ca748
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c39eb
mov eax, dword [0x5d38a0]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c3a7e
lea eax, [ebp - 0x24]
mov edx, 5
call fcn.004077fc
ret
Function at 0x408f20
Capabilities:
Check for vm using instruction vpcext

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x428a68
push 0x413c30
mov eax, dword fs:[0]
push eax
add esp, 0xfffffff4
push ebx
push esi
push edi
mov eax, dword [0x42b39c]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov byte [ebp - 0x19], 0
mov dword [ebp - 4], 0
push ebx
mov ebx, 0
mov eax, 1
invalid

Function at 0x408fb0
Capabilities:
Reference the vmware io port

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x428a88
push 0x413c30
mov eax, dword fs:[0]
push eax
add esp, 0xfffffff4
push ebx
push esi
push edi
mov eax, dword [0x42b39c]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov byte [ebp - 0x19], 1
mov dword [ebp - 4], 0
push edx
push ecx
push ebx
mov eax, 0x564d5868
mov ebx, 0
mov ecx, 0xa
mov edx, 0x5658
in eax, dx
cmp ebx, 0x564d5868
sete byte [ebp - 0x19]
pop ebx
pop ecx
pop edx
mov dword [ebp - 4], 0xfffffffe
jmp 0x409030
mov al, byte [ebp - 0x19]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x409440
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov byte [ebp - 9], 0
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.00414c17
add esp, 8
cmp eax, 0xffffffff
jne 0x409475
xor al, al
jmp 0x40963c
push 0x425a94
mov ecx, dword [ebp + 8]
push ecx
call fcn.00414b77
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x409496
xor al, al
jmp 0x40963c
push 2
push 0
mov edx, dword [ebp - 8]
push edx
call fcn.00414a2e
add esp, 0xc
mov eax, dword [ebp - 8]
push eax
call fcn.00414936
add esp, 4
mov dword [ebp - 0x14], eax
push 0
push 0
mov ecx, dword [ebp - 8]
push ecx
call fcn.00414a2e
add esp, 0xc
mov edx, dword [ebp - 0x14]
push edx
call fcn.00413dbc
add esp, 4
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x14]
push ecx
push 0
mov edx, dword [ebp - 0x10]
push edx
call fcn.00413f30
add esp, 0xc
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
push 1
mov edx, dword [ebp - 0x10]
push edx
call fcn.0041477c
add esp, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
push eax
call fcn.00414460
add esp, 4
mov ecx, dword [ebp - 0x10]
movsx edx, byte [ecx]
cmp edx, 0x47
jne 0x40955b
mov eax, dword [ebp - 0x10]
movsx ecx, byte [eax + 1]
cmp ecx, 0x55
jne 0x40955b
mov edx, dword [ebp - 0x10]
movsx eax, byte [edx + 2]
cmp eax, 0x4f
jne 0x40955b
mov ecx, dword [ebp - 0x10]
movsx edx, byte [ecx + 3]
cmp edx, 0x2e
jne 0x40955b
mov eax, dword [ebp - 0x10]
mov byte [eax], 0x41
mov ecx, dword [ebp - 0x10]
mov byte [ecx + 1], 0x50
mov edx, dword [ebp - 0x10]
mov byte [edx + 2], 0x33
mov eax, dword [ebp - 0x10]
mov byte [eax + 3], 0x32
push 0
jmp 0x457965
mov esp, ebp
pop ebp
ret 4
Function at 0x411b30
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0xc]
sub ecx, 1
mov dword [ebp + 0xc], ecx
test eax, eax
je 0x411ba6
mov edx, dword [ebp + 8]
movzx eax, byte [edx]
xor eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
add ecx, 1
mov dword [ebp + 8], ecx
mov byte [ebp - 5], 0
jmp 0x411b74
mov dl, byte [ebp - 5]
add dl, 1
mov byte [ebp - 5], dl
movzx eax, byte [ebp - 5]
cmp eax, 8
jge 0x411ba4
mov ecx, dword [ebp - 4]
and ecx, 1
je 0x411b9a
mov edx, dword [ebp - 4]
shr edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
xor eax, 0xedb88320
mov dword [ebp - 4], eax
jmp 0x411ba2
mov ecx, dword [ebp - 4]
shr ecx, 1
mov dword [ebp - 4], ecx
jmp 0x411b6b
jmp 0x411b40
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8