joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005e680
Capabilities:
Run powershell expression

Disassembly:
push ebx
push esi
push edi
mov edi, dword [sym.imp.libDeteven.dll_wcsistr]
mov esi, eax
push str.secure_daddy.com
push esi
xor ebx, ebx
call edi
add esp, 8
test eax, eax
je 0x1005e6a5
pop edi
pop esi
mov eax, 1
pop ebx
ret
push str.Foreach
push esi
call edi
add esp, 8
test eax, eax
je 0x1005e6e1
push 0x100c0208
push esi
call edi
add esp, 8
test eax, eax
je 0x1005e6e1
push str..DownloadFile
push esi
call edi
add esp, 8
test eax, eax
je 0x1005e6e1
push str.Saps
push esi
call edi
add esp, 8
test eax, eax
jne 0x1005e69c
push str.Copy_Item
push esi
call edi
add esp, 8
test eax, eax
je 0x1005e730
push str._Path
push esi
call edi
add esp, 8
test eax, eax
je 0x1005e730
push 0x100db328
push esi
call edi
add esp, 8
test eax, eax
je 0x1005e730
push str.Force
push esi
call edi
add esp, 8
test eax, eax
je 0x1005e730
push str.sdbinst.exe
push esi
call edi
add esp, 8
test eax, eax
jne 0x1005e69c
push str.webclient
push esi
call edi
add esp, 8
test eax, eax
je 0x1005e77f
push str.openread
push esi
call edi
add esp, 8
test eax, eax
je 0x1005e77f
push str.module
push esi
call edi
add esp, 8
test eax, eax
jne 0x1005e77f
push 0x100c44e0
push esi
call edi
add esp, 8
test eax, eax
jne 0x1005e77f
push str.canread
push esi
call edi
add esp, 8
test eax, eax
je 0x1005e69c
push str.Invoke_Expression__env:
push esi
call edi
add esp, 8
test eax, eax
jne 0x1005e79d
push str.IEX__env:
push esi
call edi
add esp, 8
test eax, eax
je 0x1005e7b0
push str._env:0
push esi
call edi
add esp, 8
test eax, eax
je 0x1005e69c
push esi
mov esi, 0x100db768
call fcn.1007b850
add esp, 4
cmp eax, 0xa
mov eax, 1
jae 0x1005e7ca
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x10065300
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push esi
push 0
push 0x10
call dword [sym.imp.pskalloc.dll_Pmalloc]
mov esi, eax
add esp, 8
test esi, esi
je 0x100653ca
mov eax, dword [0x100a2560]
push 0
push 0x80
mov dword [esi], eax
mov ecx, dword [0x100a2564]
push 3
mov dword [esi + 4], ecx
mov edx, dword [0x100a2568]
mov ecx, dword [ebp + 8]
push 0
push 0
mov dword [esi + 8], edx
mov eax, dword [0x100a256c]
push Ordinal_1
push ecx
mov dword [esi + 0xc], eax
call dword [sym.imp.psklutil.dll_Ordinal_580]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x10065397
push 0
push 0
push 0
push 2
push 0
push eax
call dword [sym.imp.psklutil.dll_Ordinal_570]
mov dword [esi + 4], eax
test eax, eax
je 0x10065397
push 0
push 0
push 0
push 4
push eax
call dword [sym.imp.psklutil.dll_Ordinal_571]
mov edx, dword [esi]
push 0
push edx
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0xc], eax
cmp dword [esi + 8], 0
jne 0x100653c8
mov eax, dword [esi + 4]
push edi
mov edi, dword [sym.imp.psklutil.dll_Ordinal_561]
test eax, eax
je 0x100653ae
push eax
call edi
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x100653b8
push eax
call edi
push esi
call dword [sym.imp.pskalloc.dll_Pfree]
add esp, 4
pop edi
xor eax, eax
pop esi
pop ebp
ret
mov eax, esi
pop esi
pop ebp
ret
Function at 0x100678d0
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
ret

Function at 0x10069ec0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push esi
mov esi, eax
mov dword [ebp - 4], 0x101
cmp esi, 5
je 0x10069ee9
cmp esi, 0x1a
je 0x10069ee9
cmp esi, 0x1c
je 0x10069ee9
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x210]
push ecx
push 2
call dword [sym.imp.Secur32.dll_GetUserNameExW]
test al, al
je 0x10069f17
lea edx, [ebp - 0x210]
push esi
push edx
call fcn.10069e00
mov esi, eax
add esp, 8
pop esi
mov esp, ebp
pop ebp
ret
xor esi, esi
mov eax, dword [0x1011ee28]
cmp eax, 0x1011ee28
je 0x10069f49
test byte [eax + 0x1c], 1
je 0x10069f49
cmp byte [eax + 0x19], 2
jb 0x10069f49
mov ecx, dword [eax + 0x14]
mov edx, dword [eax + 0x10]
push ecx
push edx
mov ecx, 0x1009e6d0
lea eax, [esi + 0xb]
call fcn.10001220
add esp, 8
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1006b510
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
or eax, 0xffffffff
xor edx, edx
test esi, esi
je 0x1006b5b3
lea ecx, [ecx]
movzx ecx, byte [edx + edi]
xor eax, ecx
mov ecx, eax
and ecx, 1
shr eax, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
and eax, 1
neg eax
and eax, 0xedb88320
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
shr eax, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
and eax, 1
neg eax
and eax, 0xedb88320
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
shr eax, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
and eax, 1
neg eax
and eax, 0xedb88320
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
shr eax, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
and eax, 1
neg eax
and eax, 0xedb88320
shr ecx, 1
inc edx
xor eax, ecx
cmp edx, esi
jb 0x1006b520
not eax
ret
Function at 0x1006f380
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov edx, ebx
push edi
mov dword [ebp - 4], 0xc0000001
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x1006f397
mov eax, 0x100993b4
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1006f3a8
sub eax, esi
lea edi, [ebx - 1]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1006f3b4
mov ecx, eax
shr ecx, 2
push 0
rep movsd dword es:[edi], dword [esi]
push 0
push 3
push 0
push 1
mov ecx, eax
push Ordinal_1
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.psklutil.dll_Ordinal_580]
mov esi, eax
cmp esi, 0xffffffff
je 0x1006f443
push 0x3f
lea eax, [ebp - 0x47]
push 0
push eax
mov byte [ebp - 0x48], 0
call sub.msvcrt.dll_memset
add esp, 0xc
push 0
lea ecx, [ebp - 4]
push ecx
push 0x40
lea edx, [ebp - 0x48]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 4]
push 0
push eax
lea ebx, [ebp - 0x48]
call fcn.1006f110
mov ecx, dword [ebp + 8]
add esp, 8
push esi
mov dword [ecx], eax
xor edi, edi
call dword [sym.imp.psklutil.dll_Ordinal_561]
mov ebx, dword [ebp + 0xc]
push ebx
call dword [sym.imp.pskalloc.dll_Pfree]
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 4]
push ebx
call dword [sym.imp.pskalloc.dll_Pfree]
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10072f20
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push 0x104
lea eax, [ebp - 0x108]
push eax
push str._SYSTEMDRIVE_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x10072f7b
lea eax, [ebp - 0x108]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10072f50
sub eax, edx
mov edx, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x108]
push ecx
push edx
call dword [sym.imp.pscr80.dll__strnicmp]
add esp, 0xc
test eax, eax
jne 0x10072f7b
mov eax, 1
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10075550
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
cmp dword [0x1011f744], 0
jne 0x100755bf
xor eax, eax
push str.GetNativeSystemInfo
push str.kernel32.dll
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1007559f
lea ecx, [ebp - 0x24]
push ecx
call eax
jmp 0x100755a9
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebp - 0x24], 9
mov eax, 1
jne 0x100755ba
mov dword [0x1011f740], eax
mov dword [0x1011f744], eax
mov eax, dword [0x1011f740]
mov esp, ebp
pop ebp
ret
Function at 0x10075ac0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push esi
push edi
mov dword [ebp - 4], 0x10
test ebx, ebx
je 0x10075bae
cmp dword [0x1011f750], 0
je 0x10075ae9
cmp dword [0x1011f754], 0
jne 0x10075b1d
push str.advapi32.dll
call dword [sym.imp.psklutil.dll_Ordinal_426]
mov esi, eax
test esi, esi
je 0x10075b1d
mov edi, dword [sym.imp.pskutil.dll_OSUtil_GetProcAddress]
push str.LookupPrivilegeValueA
push esi
call edi
push str.AdjustTokenPrivileges
push esi
mov dword [0x1011f750], eax
call edi
add esp, 0x10
mov dword [0x1011f754], eax
mov eax, dword [0x1011f750]
test eax, eax
je 0x10075bae
cmp dword [0x1011f754], 0
je 0x10075bae
lea ecx, [ebp - 0xc]
push ecx
push str.SeDebugPrivilege
push 0
call eax
test eax, eax
je 0x10075bae
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
lea ecx, [ebp - 4]
push ecx
mov dword [ebp - 0x28], edx
lea edx, [ebp - 0x1c]
push edx
push 0x10
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x2c]
push eax
push 0
mov esi, 1
push ebx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x20], 0
call dword [0x1011f754]
test eax, eax
je 0x10075bae
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
or dword [ebp - 0x10], 2
push 0
push 0
push eax
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x1c]
push ecx
push 0
push ebx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x14], edx
call dword [0x1011f754]
neg eax
sbb eax, eax
neg eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10075cb0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
cmp dword [0x1011f764], 0
push ebx
push esi
push edi
je 0x10075cd7
cmp dword [0x1011f768], 0
je 0x10075cd7
cmp dword [0x1011f76c], 0
jne 0x10075d18
push str.kernel32.dll
call dword [sym.imp.psklutil.dll_Ordinal_426]
mov esi, eax
test esi, esi
je 0x10075d18
mov ebx, dword [sym.imp.pskutil.dll_OSUtil_GetProcAddress]
push 0x100e363c
push esi
call ebx
push 0x100e364c
push esi
mov dword [0x1011f764], eax
call ebx
push str.TerminateProcess
push esi
mov dword [0x1011f768], eax
call ebx
add esp, 0x18
mov dword [0x1011f76c], eax
cmp dword [0x1011f764], 0
je 0x10075d67
cmp dword [0x1011f768], 0
je 0x10075d67
cmp dword [0x1011f76c], 0
je 0x10075d67
push 0
push 2
call dword [sym.imp.psklutil.dll_Ordinal_563]
mov esi, eax
cmp esi, 0xffffffff
je 0x10075d67
lea eax, [ebp - 0x128]
push eax
push esi
mov dword [ebp - 0x128], 0x128
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
jne 0x10075d73
push esi
call dword [sym.imp.psklutil.dll_Ordinal_561]
mov eax, 0xc0000001
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [sym.imp.KERNEL32.dll_Process32Next]
lea esp, [esp]
mov ecx, dword [ebp + 0xc]
cmp dword [ebp - 0x110], ecx
jne 0x10075d9d
mov edx, dword [ebp + 8]
mov ebx, dword [ebp - 0x120]
push edx
call fcn.10001740
add esp, 4
lea eax, [ebp - 0x128]
push eax
push esi
call edi
test eax, eax
jne 0x10075d80
push esi
call dword [sym.imp.psklutil.dll_Ordinal_561]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1007b2e0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xec]
push edi
xor edi, edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x14], edi
cmp eax, edi
jne 0x1007b309
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
push ebx
lea ecx, [ebp - 8]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, eax
mov dword [ebp - 0xc], ebx
cmp ebx, edi
jne 0x1007b326
pop ebx
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
push esi
mov esi, 1
lea esp, [esp]
cmp esi, dword [ebp - 8]
jge 0x1007b374
mov edx, dword [ebx + esi*4]
push edx
call dword [sym.imp.psklutil.dll_Ordinal_424]
cmp eax, 0xffffffff
je 0x1007b35e
mov eax, dword [ebx + esi*4]
push eax
call dword [sym.imp.psklutil.dll_Ordinal_301]
mov dword [ebp - 4], 1
mov edi, dword [ebp - 4]
add esp, 4
mov dword [ebp - 0x10], eax
inc esi
test edi, edi
je 0x1007b330
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x10]
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
test edi, edi
jne 0x1007b363
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x14]
push ecx
push 2
push edx
call dword [sym.imp.libDeteven.dll_FlagsForDetection_GetValue]
add esp, 0xc
test eax, eax
js 0x1007b495
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x1007b495
mov eax, dword [eax + 0x10]
push eax
call dword [sym.imp.psklutil.dll_Ordinal_300]
mov esi, eax
add esp, 4
mov dword [ebp - 0x18], esi
test esi, esi
je 0x1007b363
mov dword [ebp + 8], 1
jmp 0x1007b3c0
mov ecx, dword [ebp + 8]
cmp ecx, dword [ebp - 8]
jge 0x1007b47a
push 0
push 0x20000
push 1
call dword [sym.imp.pskalloc.dll_Pcalloc]
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x1007b46c
mov edx, ebx
mov eax, esi
sub edx, esi
mov edi, edi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x1007b3f0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [edx + eax*4]
mov edx, eax
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1007b410
sub eax, edx
lea edi, [ebx - 2]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x1007b420
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.psklutil.dll_Ordinal_424]
cmp eax, 0xffffffff
je 0x1007b45c
push ebx
call dword [sym.imp.psklutil.dll_Ordinal_301]
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 1
push ebx
call dword [sym.imp.pskalloc.dll_Pfree]
mov edi, dword [ebp - 4]
mov esi, dword [ebp - 0x18]
add esp, 4
inc dword [ebp + 8]
mov ebx, dword [ebp - 0xc]
test edi, edi
je 0x1007b3c0
push esi
call dword [sym.imp.pskalloc.dll_Pfree]
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x10]
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
pop esi
pop ebx
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x1007ccf0
Capabilities:
Reference wmi statements

Disassembly:
push edi
call dword [sym.imp.libDeteven.dll_LIST_Init]
mov edi, eax
push edi
call dword [sym.imp.libDeteven.dll_LIST_IsInitialized]
add esp, 4
test eax, eax
jne 0x1007cd09
pop edi
ret
push esi
push str.rootcimv2
call dword [sym.imp.psklutil.dll_Ordinal_735]
mov esi, eax
add esp, 4
test esi, esi
je 0x1007cd3e
push 0
push 0
push str.SELECT__FROM_Win32_Keyboard
push edi
push 0x1007ccb0
push esi
call dword [sym.imp.psklutil.dll_Ordinal_739]
push esi
call dword [sym.imp.psklutil.dll_Ordinal_736]
add esp, 0x1c
pop esi
mov eax, edi
pop edi
ret
Function at 0x1007d750
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x12c
cmp dword [0x1011f7e0], 0
push ebx
push esi
push edi
mov esi, eax
je 0x1007d773
cmp dword [0x1011f7e4], 0
jne 0x1007d7a7
push str.kernel32.dll
call dword [sym.imp.psklutil.dll_Ordinal_426]
mov edi, eax
test edi, edi
je 0x1007d7a7
mov ebx, dword [sym.imp.pskutil.dll_OSUtil_GetProcAddress]
push 0x100e363c
push edi
call ebx
push 0x100e364c
push edi
mov dword [0x1011f7e0], eax
call ebx
add esp, 0x10
mov dword [0x1011f7e4], eax
cmp dword [0x1011f7e0], 0
je 0x1007d7e9
cmp dword [0x1011f7e4], 0
je 0x1007d7e9
push 0
push 2
call dword [sym.imp.psklutil.dll_Ordinal_563]
mov edi, eax
cmp edi, 0xffffffff
je 0x1007d7e9
lea eax, [esp + 0x10]
push eax
push edi
mov dword [esp + 0x18], 0x128
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
jne 0x1007d7f5
push edi
call dword [sym.imp.psklutil.dll_Ordinal_561]
mov eax, 0xc0000001
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov bl, 3
lea ecx, [esp + 0x34]
push esi
push ecx
call dword [sym.imp.msvcrt.dll__stricmp]
add esp, 8
test eax, eax
jne 0x1007d897
mov eax, dword [0x1011ee28]
cmp eax, 0x1011ee28
je 0x1007d83c
test byte [eax + 0x1c], 1
je 0x1007d83c
cmp byte [eax + 0x19], bl
jb 0x1007d83c
mov edx, dword [eax + 0x14]
mov eax, dword [eax + 0x10]
push 0x100988d8
push 0x31
push edx
push eax
call fcn.10001350
add esp, 0x10
mov eax, dword [esp + 0x18]
call fcn.100022e0
test eax, eax
js 0x1007d869
mov eax, dword [0x1011ee28]
cmp eax, 0x1011ee28
je 0x1007d897
test byte [eax + 0x1c], 1
je 0x1007d897
cmp byte [eax + 0x19], bl
jb 0x1007d897
push 0x100988d8
push 0x32
jmp 0x1007d887
mov eax, dword [0x1011ee28]
cmp eax, 0x1011ee28
je 0x1007d897
test byte [eax + 0x1c], 1
je 0x1007d897
cmp byte [eax + 0x19], bl
jb 0x1007d897
push 0x100988d8
push 0x33
mov ecx, dword [eax + 0x14]
mov edx, dword [eax + 0x10]
push ecx
push edx
call fcn.10001350
add esp, 0x10
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1007d7f7
push edi
call dword [sym.imp.psklutil.dll_Ordinal_561]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10082d90
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xec]
push ebx
push esi
push edi
lea eax, [ebp - 0x14]
push eax
xor esi, esi
push edx
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x18], eax
cmp eax, esi
je 0x10082ee5
xor ecx, ecx
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x14], esi
jle 0x10082ed4
mov edi, edi
cmp dword [ebp - 0xc], 0
jne 0x10082ed4
mov eax, dword [eax + ecx*4]
push eax
call dword [sym.imp.psklutil.dll_Ordinal_301]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x10082ec1
mov edx, dword [ebp + 8]
lea ecx, [ebp - 8]
push ecx
push 2
push edx
call dword [sym.imp.libDeteven.dll_FlagsForDetection_GetValue]
add esp, 0xc
test eax, eax
js 0x10082eb5
mov eax, dword [ebp - 8]
test eax, eax
je 0x10082eb5
mov eax, dword [eax + 8]
mov esi, dword [sym.imp.libDeteven.dll_endsWith]
push 0
push eax
push ebx
call esi
add esp, 0xc
test eax, eax
jne 0x10082eb5
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0xc]
push eax
push edx
push ebx
call esi
add esp, 0xc
test eax, eax
jne 0x10082eb5
push ebx
xor esi, esi
call dword [sym.imp.psklutil.dll_Ordinal_300]
mov edi, eax
add esp, 4
test edi, edi
je 0x10082e75
mov eax, dword [ebp + 0x10]
push eax
push esi
push 1
push 1
push esi
push edi
call fcn.1007c0d0
push edi
mov edi, dword [sym.imp.pskalloc.dll_Pfree]
mov esi, eax
call edi
add esp, 0x1c
jmp 0x10082e7b
mov edi, dword [sym.imp.pskalloc.dll_Pfree]
mov dword [ebp - 4], esi
test esi, esi
je 0x10082ebb
cmp dword [ebp + 0xc], 0
je 0x10082eac
push 0
push 0x10090e58
push esi
call dword [sym.imp.libDeteven.dll_endsWith]
add esp, 0xc
test eax, eax
je 0x10082eac
push esi
call edi
add esp, 4
mov dword [ebp - 4], 0
jmp 0x10082ebb
mov dword [ebp - 0xc], 1
jmp 0x10082ebb
mov edi, dword [sym.imp.pskalloc.dll_Pfree]
push ebx
call edi
add esp, 4
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
inc ecx
mov dword [ebp - 0x10], ecx
cmp ecx, dword [ebp - 0x14]
jl 0x10082dd0
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10085170
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov dword [ebp - 4], 0
test edi, edi
jne 0x1008518b
lea eax, [edi + 1]
mov esp, ebp
pop ebp
ret
push ebx
push esi
push 0x208
lea eax, [ebp - 0x210]
push eax
push str._windir_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov ebx, dword [sym.imp.pscr80.dll__strnicmp]
mov esi, eax
test esi, esi
je 0x100851f7
lea ecx, [esi - 1]
push ecx
lea edx, [ebp - 0x210]
push edx
push edi
call ebx
add esp, 0xc
test eax, eax
jne 0x100851f7
mov eax, edi
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100851d0
sub eax, edx
lea ecx, [esi + 4]
cmp eax, ecx
jb 0x100851f7
push 4
push str.temp
add esi, edi
push esi
call ebx
add esp, 0xc
test eax, eax
jne 0x1008528d
push 0x208
lea edx, [ebp - 0x210]
push edx
push str._programFiles_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov esi, eax
test esi, esi
je 0x10085229
lea eax, [esi - 1]
push eax
lea ecx, [ebp - 0x210]
push ecx
push edi
call ebx
add esp, 0xc
test eax, eax
je 0x1008528d
lea edx, [ebp - 0x210]
push str.__x86_
push edx
call dword [sym.imp.psklutil.dll_Ordinal_312]
add esp, 8
test eax, eax
je 0x1008525f
mov byte [eax], 0
cmp esi, 6
jbe 0x1008525f
add esi, 0xfffffff9
push esi
lea eax, [ebp - 0x210]
push eax
push edi
call ebx
add esp, 0xc
test eax, eax
je 0x1008528d
push 0x208
lea ecx, [ebp - 0x210]
push ecx
push str._programFiles_x86__
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x100852b9
dec eax
push eax
lea edx, [ebp - 0x210]
push edx
push edi
call ebx
add esp, 0xc
test eax, eax
jne 0x100852b9
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push 0x4b
push 0x10096800
push edi
push eax
push esi
mov dword [ebp - 4], 1
call dword [sym.imp.DetEvenFilter.dll_Ordinal_152]
add esp, 0x14
test eax, eax
jne 0x100852b9
cmp dword [esi + 0x4c], eax
je 0x100852b9
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4033a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x45500c]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403438
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403418
xor eax, eax
push ebp
push 0x403411
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403454
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403418
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x45500c]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x45500c], ax
mov esp, ebp
pop ebp
ret

Function at 0x404100
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x457048], 0
je 0x404161
cmp word [0x45721c], 0xd7b2
jne 0x404129
cmp dword [0x457224], 0
jbe 0x404129
mov eax, 0x457218
call dword [0x457234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x455054
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404188
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x45501c], 0
jne 0x40417d
push 0
push 0x455074
push 0x455054
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret