joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4011d0
Capabilities:
Create http request
Download and write a file
Get common file path
Print debug messages
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc20
push ebx
push esi
push edi
lea eax, [ebp - 0x420]
push eax
push 0x104
mov dword [ebp - 4], 0x64
mov ebx, 1
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [ebp - 0x218]
push ecx
push 0
push 0x40b2b0
lea edx, [ebp - 0x420]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str._ndownloading
call esi
mov edi, dword [ebp + 8]
push edi
call esi
push str._nDownloading_File_To
call esi
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x40b284
call esi
push edi
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
mov eax, dword [0x40ef00]
test eax, eax
jne 0x401274
push eax
push eax
push eax
push eax
push str.install
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [0x40ef00], eax
test eax, eax
jne 0x401274
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0x84000000
push 0
push 0
push edi
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov esi, eax
mov dword [ebp - 0xc], esi
test esi, esi
je 0x40126b
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 8], edi
cmp edi, 0xffffffff
je 0x40126b
lea esp, [esp]
cmp dword [ebp - 4], 0
je 0x4012fb
lea edx, [ebp - 4]
push edx
push 0x800
lea eax, [ebp - 0xc20]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
mov edx, dword [ebp - 4]
push 0
lea ecx, [ebp - 0x10]
push ecx
mov ebx, eax
push edx
lea eax, [ebp - 0xc20]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test ebx, ebx
jne 0x4012c0
mov edi, dword [ebp + 0xc]
mov ecx, 0x82
lea esi, [ebp - 0x218]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401460
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
push 0
push 0
push 0x40fcb0
push 0x4013e0
push 0
push 0
mov dword [0x40fcb0], eax
mov dword [0x40fcb4], ecx
mov dword [0x40fcb8], edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x401e50
Capabilities:
Parse pe header
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x104]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x401f23
push 0
push 0
push 0
push 2
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edi, eax
test edi, edi
je 0x401f1c
push 0
push 0
push 0
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
je 0x401f15
mov edx, 0x5a4d
cmp word [esi], dx
jne 0x401f0e
mov eax, dword [esi + 0x3c]
cmp dword [eax + esi], 0x4550
jne 0x401f0e
mov ecx, dword [eax + esi + 0x98]
test ecx, ecx
je 0x401f0e
mov eax, dword [eax + esi + 0x9c]
add ecx, esi
push eax
push ecx
mov ecx, dword [ebp + 8]
push ecx
call fcn.00401df0
add esp, 0xc
test eax, eax
je 0x401f0e
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4059ce
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40ea70]
jne 0x4059d8
repz ret
jmp fcn.00409a6c
Function at 0x40946c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x40ea70]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004034f4
and dword [ebp - 0x14], 0
cmp dword [0x40f840], 0
mov dword [ebp - 0x18], eax
jne 0x40951f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4095c7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4095c7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x40f840], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x40f844], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x40f848], eax
call edi
push eax
call esi
mov dword [0x40f850], eax
test eax, eax
je 0x40951f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x40f84c], eax
mov eax, dword [0x40f84c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x409578
cmp dword [0x40f850], ecx
je 0x409578
push eax
call esi
push dword [0x40f850]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x409578
test ebx, ebx
je 0x409578
call edi
test eax, eax
je 0x40956f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40956f
test byte [ebp - 8], 1
jne 0x409578
or dword [ebp + 0x10], 0x200000
jmp 0x4095ab
mov eax, dword [0x40f844]
cmp eax, dword [ebp - 0x18]
je 0x4095ab
push eax
call esi
test eax, eax
je 0x4095ab
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4095ab
mov eax, dword [0x40f848]
cmp eax, dword [ebp - 0x18]
je 0x4095ab
push eax
call esi
test eax, eax
je 0x4095ab
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x40f840]
call esi
test eax, eax
je 0x4095c7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4095c9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004059ce
leave
ret
Function at 0x401070
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x11c
push edi
xor eax, eax
mov dword [esp + 0x18], 0x5c3a43
mov ecx, 0x41
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
push 0x108
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov cl, byte [esp + 0x18]
xor eax, eax
push eax
push eax
mov dword [esp + 0x10], 0x5c3a78
lea edx, [esp + 0x18]
push edx
mov byte [esp + 0x14], cl
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x1c]
push edx
push eax
push eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov eax, dword [esp + 0xc]
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x4010f0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x40c
push ebx
lea eax, [esp + 0xc]
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.HARDWAREDESCRIPTIONSystem
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40118f
lea ecx, [esp + 4]
push ecx
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x10]
push eax
push ebx
push str.SystemBiosDate
push ecx
mov dword [esp + 0x1c], 0x3ff
mov dword [esp + 0x20], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401184
cmp dword [esp + 8], 1
jne 0x401184
mov eax, dword [esp + 4]
push edi
xor edi, edi
cmp eax, ebx
jle 0x401183
push ebp
mov ebp, dword [sym.imp.MSVCRT.dll_isdigit]
push esi
movsx esi, byte [esp + edi + 0x1c]
push esi
call ebp
add esp, 4
test eax, eax
je 0x401178
lea edx, [ebx + ebx*4]
lea ebx, [esi + edx*2 - 0x30]
mov eax, dword [esp + 0x10]
inc edi
cmp edi, eax
jl 0x401162
pop esi
pop ebp
pop edi
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
pop ebx
add esp, 0x40c
ret
Function at 0x4012a0
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
sub esp, 0xc
push edi
push 0xf0000000
push 1
xor edi, edi
push edi
push edi
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x401358
mov edx, dword [esp + 0xc]
lea ecx, [esp + 4]
push ecx
push edi
push edi
push 0x8003
push edx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x40134b
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 4]
push edi
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x401340
mov ecx, dword [esp + 4]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push edi
lea eax, [esp + 0x10]
push eax
push edi
push 2
push ecx
mov dword [esp + 0x20], edi
call esi
test eax, eax
je 0x40133f
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 8]
push edi
lea edx, [esp + 0x10]
push edx
push eax
push 2
push ecx
call esi
test eax, eax
je 0x40133f
mov eax, dword [esp + 0xc]
cmp eax, 0x10
jne 0x40133b
mov edi, eax
jmp 0x40133f
neg eax
mov edi, eax
pop esi
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [esp + 0xc]
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, edi
pop edi
add esp, 0xc
ret
Function at 0x401360
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
sub esp, 0x24
mov edx, dword [0x406018]
mov eax, dword [0x406010]
mov ecx, dword [0x406014]
push esi
push 0xf0000000
push 1
push 0
mov dword [esp + 0x28], edx
mov dword [esp + 0x20], eax
mov eax, dword [str.XWP_soft]
mov dword [esp + 0x24], ecx
mov ecx, dword [0x406020]
push 0
lea edx, [esp + 0x20]
or esi, 0xffffffff
push edx
mov dword [esp + 0x20], esi
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x40148d
mov edx, dword [esp + 0x10]
lea eax, [esp + 8]
push eax
push 1
push 0
push 0x14
lea ecx, [esp + 0x24]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x401480
mov ecx, dword [esp + 8]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
push 0
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 1
push 0
push ecx
mov dword [esp + 0x24], edi
call ebp
test eax, eax
je 0x401474
mov eax, dword [esp + 8]
push ebx
push eax
mov ebx, eax
call dword [sym.imp.MSVCRT.dll_malloc]
mov edx, dword [esp + 0x38]
push edi
mov esi, eax
push edx
push esi
mov dword [esp + 0x1c], edi
call sub.MSVCRT.dll_memcpy
mov ecx, dword [esp + 0x20]
add esp, 0x10
push ebx
lea eax, [esp + 0x10]
push eax
push esi
push 0
push 1
push 0
push ecx
call ebp
test eax, eax
pop ebx
je 0x401466
mov edx, dword [esp + 0x34]
test edx, edx
mov eax, dword [esp + 8]
mov dword [esp + 0x10], eax
je 0x401466
mov ecx, dword [esp + 0x38]
test ecx, ecx
jle 0x401466
cmp ecx, eax
jge 0x40145b
mov eax, ecx
push eax
push esi
push edx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push esi
call dword [sym.imp.MSVCRT.dll_free]
mov esi, dword [esp + 0x14]
add esp, 4
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
pop ebp
mov eax, dword [esp + 0x10]
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, esi
pop esi
add esp, 0x24
ret
Function at 0x4014a0
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
sub esp, 0x20
mov edx, dword [0x406018]
mov eax, dword [0x406010]
mov ecx, dword [0x406014]
push ebx
push ebp
mov ebp, dword [esp + 0x2c]
push 0xf0000000
push 1
push 0
mov dword [esp + 0x28], edx
mov dword [esp + 0x20], eax
mov eax, dword [str.XWP_soft]
mov dword [esp + 0x24], ecx
mov ecx, dword [0x406020]
push 0
lea edx, [esp + 0x20]
push edx
or ebx, 0xffffffff
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x40158e
mov edx, dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push 1
push 0
push 0x14
lea ecx, [esp + 0x24]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x401581
push edi
push esi
mov dword [esp + 0x10], esi
call dword [sym.imp.MSVCRT.dll_malloc]
push esi
mov edi, eax
push ebp
push edi
mov dword [esp + 0x1c], esi
call sub.MSVCRT.dll_memcpy
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x20]
add esp, 0x10
lea eax, [esp + 0xc]
push eax
push edi
push 0
push ecx
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x40156b
mov eax, dword [esp + 0xc]
cmp esi, eax
mov ebx, eax
jge 0x401560
mov eax, esi
push eax
push edi
push ebp
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push edi
call dword [sym.imp.MSVCRT.dll_free]
mov eax, dword [esp + 0x14]
add esp, 4
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
pop edi
mov ecx, dword [esp + 0x10]
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop ebp
mov eax, ebx
pop ebx
add esp, 0x20
ret
Function at 0x401760
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x118
push ebp
push esi
push edi
mov esi, eax
push 0x404ad8
xor ebp, ebp
push esi
mov dword [esp + 0x20], ebp
call dword [sym.imp.MSVCRT.dll_fopen]
mov edi, eax
add esp, 8
cmp edi, ebp
jne 0x4017a6
push esi
lea eax, [esp + 0x28]
push str.Cant_open_file__s_n
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x118
ret
push ebx
push edi
call dword [sym.imp.MSVCRT.dll__fileno]
push eax
call dword [sym.imp.MSVCRT.dll__filelength]
mov ebx, eax
cdq
and edx, 0x3ff
add eax, edx
mov ecx, eax
sar ecx, 0xa
mov eax, ecx
cdq
idiv dword [0x406518]
mov esi, dword [0x40651c]
add esp, 8
mov dword [esp + 0x20], ebx
cmp eax, esi
mov edx, eax
jg 0x4017e3
mov edx, esi
cmp ecx, edx
jl 0x40180e
cmp eax, esi
jg 0x4017ed
mov eax, esi
cmp eax, ecx
jge 0x40180e
shl eax, 0xa
mov ecx, ebx
push ebp
sub ecx, eax
push ecx
push edi
mov dword [esp + 0x20], 2
call dword [sym.imp.MSVCRT.dll_fseek]
add esp, 0xc
jmp 0x401816
mov dword [esp + 0x14], 1
mov eax, 0x51eb851f
imul ebx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x14]
xor esi, esi
cmp eax, ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x10], esi
jle 0x401914
jmp 0x401847
mov esi, dword [esp + 0x10]
test esi, esi
jne 0x4018ea
cmp dword [esp + 0x18], 1
jne 0x401862
push esi
push esi
push edi
call dword [sym.imp.MSVCRT.dll_fseek]
add esp, 0xc
push edi
xor esi, esi
call dword [sym.imp.MSVCRT.dll_ftell]
add esp, 4
xor ebp, ebp
test ebx, ebx
jle 0x4018cb
lea ebx, [eax - 8]
push edi
call dword [sym.imp.MSVCRT.dll_fgetc]
add esp, 4
cmp eax, 0xffffffff
je 0x4018c7
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x24]
inc ecx
inc ebx
cmp ecx, edx
mov dword [esp + 0x1c], ecx
jle 0x4018a0
mov dword [esp + 0x1c], 0
cmp byte [esi + str.MklLABTam], al
jne 0x4018bc
inc esi
cmp esi, 8
jne 0x4018be
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x40192b
mov dword [esp + 0x10], ebx
jmp 0x4018be
xor esi, esi
mov eax, dword [esp + 0x20]
inc ebp
cmp ebp, eax
jl 0x401877
mov ebx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
inc eax
cmp eax, ecx
mov dword [esp + 0x18], eax
jl 0x401843
mov eax, dword [esp + 0x10]
test eax, eax
mov esi, eax
je 0x401914
mov ebx, dword [esp + 0x12c]
test ebx, ebx
je 0x401911
push 0
push esi
push edi
call dword [sym.imp.MSVCRT.dll_fseek]
push edi
push 1
push 0x800
push ebx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x1c
add esi, 0xa
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
pop ebx
pop edi
mov eax, esi
pop esi
pop ebp
add esp, 0x118
ret
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x118
ret
Function at 0x402870
Capabilities:
Get memory capacity
Get system information on windows

Disassembly:
sub esp, 0xc8
xor al, al
mov byte [esp + 3], al
mov byte [esp + 2], al
push esi
lea eax, [esp + 6]
push eax
lea ecx, [esp + 0xb]
push ecx
call fcn.00403520
movzx esi, al
add esp, 8
cmp esi, 3
ja case.default.0x40289b
jmp dword [esi*4 + 0x402a58]
push str.HT_not_capable
lea edx, [esp + 0x50]
push edx
jmp 0x4028d7
push str.HT_disabled
jmp 0x4028d2
push str.HT_enabled
lea ecx, [esp + 0x50]
push ecx
jmp 0x4028d7
push str.HT_capable_but_not_enabled
lea edx, [esp + 0x50]
push edx
jmp 0x4028d7
push str.HT_cannot_be_detected
lea eax, [esp + 0x50]
push eax
call sub.MSVCRT.dll_strcpy
movzx eax, byte [esp + 0xe]
movzx edx, byte [esp + 0xf]
imul edx, eax
add esp, 8
lea ecx, [esp + 0x4c]
push ecx
push esi
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
push edx
push eax
push str.CPU:Physical_d__Logical_d__HT_Flag_d___s__
push 0x406648
call esi
push 0x406648
push 0x406a40
call sub.MSVCRT.dll_strcpy
add esp, 0x20
call fcn.00401730
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x28]
push edx
push eax
push ecx
push str.OEM_ID:__u__Number_of_Processors:__u__Processor_Type:__u_
push 0x406648
call esi
push 0x406648
push 0x406a40
call sub.MSVCRT.dll_strcpy
call fcn.00401730
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
shr edx, 0xa
push edx
shr eax, 0xa
push eax
push str.Memory:_Phisical_memory:_Total__lu_Kb___Free__lu_Kb.
push 0x406648
call esi
push 0x406648
push 0x406a40
call sub.MSVCRT.dll_strcpy
call fcn.00401730
mov ecx, dword [esp + 0x58]
mov edx, dword [esp + 0x54]
shr ecx, 0xa
push ecx
shr edx, 0xa
push edx
push str.________Virtual_memory:__Total__lu_Kb___Free_lu__Kb.
push 0x406648
call esi
add esp, 0x44
push 0x406648
push 0x406a40
call sub.MSVCRT.dll_strcpy
call fcn.00401730
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
shr eax, 0xa
push eax
shr ecx, 0xa
push ecx
push str.________Paging_file:_____Total__lu_Kb___Free_lu__Kb.
push 0x406648
call esi
push 0x406648
push 0x406a40
call sub.MSVCRT.dll_strcpy
call fcn.00401730
mov edx, dword [esp + 0x2c]
push edx
push str._________ld_percent_of_memory_is_in_use.
push 0x406648
call esi
push 0x406648
push 0x406a40
call sub.MSVCRT.dll_strcpy
call fcn.00401730
mov eax, dword [esp + 0x68]
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x60]
push eax
push ecx
push edx
push str.________Page_size:__u__App_address:__Ix____Ix_
push 0x406648
call esi
add esp, 0x48
push 0x406648
push 0x406a40
call sub.MSVCRT.dll_strcpy
add esp, 8
call fcn.00401730
pop esi
add esp, 0xc8
ret
Function at 0x403520
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x30
push ebx
push ebp
mov ebp, dword [esp + 0x40]
push esi
mov esi, dword [esp + 0x40]
push edi
lea eax, [esp + 0x1c]
mov byte [ebp], 0
xor edi, edi
push eax
mov byte [esp + 0x16], 0
mov byte [esi], 0
mov dword [esp + 0x34], edi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov cl, byte [esp + 0x30]
mov byte [ebp], cl
call fcn.004033f0
test eax, eax
je 0x4036f3
mov byte [esp + 0x13], 0
mov dword [esp + 0x14], edi
call fcn.004033f0
test eax, eax
jne 0x403576
mov cl, 1
jmp 0x403588
mov eax, 1
cpuid
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0x14]
shr ecx, 0x10
cmp cl, 1
mov byte [esi], cl
jb 0x4036fb
mov al, 1
or bl, 0xff
cmp cl, al
jbe 0x4035a8
lea esp, [esp]
shl al, 1
shl bl, 1
cmp al, cl
jb 0x4035a0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edi, eax
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
push str.KERNEL32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, 0x20
mov dword [0x406930], eax
jae 0x4035e0
xor ecx, ecx
mov dword [0x406930], ecx
jmp 0x4035f7
push str.SetProcessAffinityMask
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x406930]
mov dword [0x406a20], eax
mov eax, dword [0x406a20]
xor esi, esi
cmp eax, esi
je 0x4036ce
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x18]
jne 0x4036ce
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, 1
nop
cmp esi, eax
ja 0x403654
test eax, esi
je 0x40364e
push esi
push edi
call dword [0x406a20]
test eax, eax
je 0x40364a
push 0
call ebp
call fcn.004034f0
mov cl, bl
not cl
test cl, al
je 0x40364a
mov byte [esp + 0x13], 1
mov eax, dword [esp + 0x14]
shl esi, 1
test esi, esi
jne 0x403620
push eax
push edi
call dword [0x406a20]
mov eax, dword [0x406930]
xor esi, esi
cmp eax, esi
je 0x40366e
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edx, dword [esp + 0x44]
mov dword [0x406a20], esi
mov al, byte [edx]
cmp al, 1
mov dword [0x406930], esi
jne 0x403695
pop edi
pop esi
mov byte [esp + 0xa], 2
mov al, byte [esp + 0xa]
pop ebp
pop ebx
add esp, 0x30
ret
mov cl, byte [esp + 0x13]
test cl, cl
je 0x4036bd
mov ecx, dword [esp + 0x48]
movzx esi, al
movzx eax, byte [ecx]
cdq
idiv esi
pop edi
pop esi
mov byte [esp + 0xa], 1
pop ebp
pop ebx
mov byte [ecx], al
mov al, byte [esp + 2]
add esp, 0x30
ret
pop edi
pop esi
mov byte [esp + 0xa], 3
mov al, byte [esp + 0xa]
pop ebp
pop ebx
add esp, 0x30
ret
cmp ecx, esi
je 0x4036d9
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov dword [0x406a20], esi
mov dword [0x406930], esi
pop esi
mov byte [ebp], 0xff
pop ebp
mov al, 4
pop ebx
add esp, 0x30
ret
mov byte [esp + 0x12], 0
mov byte [esi], 1
mov al, byte [esp + 0x12]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
Function at 0x401b43
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], esp
push 2
push str.ServicesActive
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x401b88
push 6
call fcn.00405738
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x401cac
push 0x4172d9
mov ebx, dword [ebp + 0x18]
push dword [ebx]
mov ecx, 2
call fcn.00401149
add esp, 8
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push 0x417240
push 0
push 0x417240
push 0
push 0x417240
push dword [ebp - 0xc]
push 1
push dword [ebp + 0x14]
push 0x120
push 0xf003f
mov ebx, dword [ebp + 0xc]
push dword [ebx]
mov ebx, dword [ebp + 8]
push dword [ebx]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x401c09
push 6
call fcn.00405738
add esp, 4
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x401c1c
push ebx
call fcn.00405744
add esp, 4
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x401c80
mov dword [ebp - 0xc], esp
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x401c4e
push 6
call fcn.00405738
add esp, 4
mov dword [ebp - 0xc], esp
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x401c70
push 6
call fcn.00405738
add esp, 4
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.00401cbc
jmp 0x401cb6
mov dword [ebp - 0xc], esp
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x401ca2
push 6
call fcn.00405738
add esp, 4
mov eax, 0
jmp 0x401cb6
mov eax, 0
jmp 0x401cb6
mov esp, ebp
pop ebp
ret 0x14