joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1324c5a8
Capabilities:
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.131450b8
xor eax, eax
push ebp
push 0x1324c773
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.13144c28
push 0
push 0
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.131450c8
push eax
call sub.kernel32.dll_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x1324c74d
push 0
push 0
push 0
push ebx
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 0x24]
push eax
push 0x40
lea eax, [ebp - 0x64]
push eax
push ebx
call sub.kernel32.dll_ReadFile
cmp word [ebp - 0x64], 0x5a4d
jne 0x1324c74d
push 0
push 0
mov eax, dword [ebp - 0x28]
push eax
push ebx
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 0x24]
push eax
push 0xf8
lea eax, [ebp - 0x15c]
push eax
push ebx
call sub.kernel32.dll_ReadFile
cmp dword [ebp - 0x15c], 0x4550
jne 0x1324c74d
mov eax, dword [ebp - 0x12c]
xor edx, edx
push edx
push eax
lea edx, [ebp - 8]
mov eax, 8
call fcn.13149c40
mov eax, dword [ebp - 0x120]
xor edx, edx
push edx
push eax
lea edx, [ebp - 0xc]
mov eax, 8
call fcn.13149c40
mov eax, dword [ebp - 0x104]
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x10]
mov eax, 8
call fcn.13149c40
mov eax, dword [ebp - 0x140]
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x14]
mov eax, 8
call fcn.13149c40
mov eax, dword [ebp - 0x108]
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x18]
mov eax, 8
call fcn.13149c40
lea ecx, [ebp - 0x1c]
movzx eax, word [ebp - 0x146]
mov edx, 4
call fcn.13149c18
lea ecx, [ebp - 0x20]
movzx eax, word [ebp - 0x148]
mov edx, 4
call fcn.13149c18
push ebx
call sub.kernel32.dll_CloseHandle
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
lea eax, [ebp - 0x160]
mov edx, 7
call fcn.13144fcc
mov eax, dword [ebp - 0x160]
mov edx, esi
call fcn.1321dcf8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1324c77a
lea eax, [ebp - 0x160]
call fcn.13144c28
lea eax, [ebp - 0x20]
mov edx, 8
call fcn.13144c4c
ret
Function at 0x1324c780
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
mov byte [ebp - 1], al
xor ebx, ebx
lea eax, [ebp - 8]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x1324c7fb
mov dword [ebp - 0x1c], 1
lea eax, [ebp - 0x18]
push eax
push 0x1324c804
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
cmp byte [ebp - 1], 0
je 0x1324c7c7
mov dword [ebp - 0x10], 2
jmp 0x1324c7cc
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x10
lea eax, [ebp - 0x1c]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError
test eax, eax
sete bl
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1324c97c
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x1d
add esp, 0xfffff004
push eax
dec eax
jne 0x1324c985
mov eax, dword [ebp - 4]
add esp, 0xfffffac4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x1324cb4f
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, 1
call fcn.1324c780
test al, al
je 0x1324cb33
xor edx, edx
push ebp
push 0x1324cb29
push dword fs:[edx]
mov dword fs:[edx], esp
call fcn.1324c85c
mov esi, eax
call sub.kernel32.dll_GetCurrentProcess
mov ebx, eax
push 0
push 0x10
lea eax, [ebp - 0x1d50c]
push eax
push esi
push ebx
call sub.ntdll.dll_NtReadVirtualMemory
push 0
push 0xc
lea eax, [ebp - 0x1d518]
push eax
mov eax, dword [ebp - 0x1d50c]
push eax
push ebx
call sub.ntdll.dll_NtReadVirtualMemory
push 0
mov eax, dword [ebp - 0x1d510]
add eax, eax
add eax, eax
lea eax, [eax + eax*2]
push eax
lea eax, [ebp - 0x1d4fc]
push eax
mov eax, dword [ebp - 0x1d508]
push eax
push ebx
call sub.ntdll.dll_NtReadVirtualMemory
mov esi, 0x2711
lea ebx, [ebp - 0x1d4f4]
cmp byte [ebx], 5
jne 0x1324cafd
push 0x2b
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x1324c954]
call fcn.131462b8
add esp, 4
mov eax, dword [ebx - 8]
mov ecx, 0x2c
mov edx, dword [ebp - 4]
call fcn.1324c818
test eax, eax
jle 0x1324cafd
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x30]
mov ecx, 0x2c
call fcn.13148054
push 0x27
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x1324c954]
call fcn.131462b8
add esp, 4
mov ecx, 0x28
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x28]
call fcn.1324c818
test eax, eax
jle 0x1324cafd
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1d540]
mov ecx, 0x28
call fcn.13148054
mov eax, dword [ebp - 0x1d540]
add eax, 0x220
call fcn.1324c844
add eax, 0x84
call fcn.1324c844
cmp edi, eax
jne 0x1324cafd
mov eax, dword [ebp - 0x18]
cmp eax, 0xd
je 0x1324cae7
cmp eax, 0xe
jne 0x1324cafd
mov eax, dword [ebp - 0x30]
push eax
call sub.user32.dll_UnhookWindowsHookEx
push 2
push 0
push 0x1f
push 0xb
call sub.user32.dll_SystemParametersInfoA
add ebx, 0xc
dec esi
jne 0x1324ca34
push 0
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x1324c954]
call fcn.131462b8
add esp, 4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x1324cb33
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1324cb56
lea eax, [ebp - 4]
mov edx, dword [0x1324c954]
call fcn.131463b8
ret

Function at 0x1324d088
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffe30
mov ebp, eax
lea eax, [esp + 0x40]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, ebp
mov edx, 0x1324d0fc
call fcn.13144c7c
push 0x40
lea eax, [esp + 4]
push eax
call sub.wsock32.dll_gethostname
push esp
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x1324d0e7
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x1324d0db
push dword [edi]
call sub.wsock32.dll_inet_ntoa
mov edx, ebp
call fcn.1314a9b4
inc ebx
mov edi, dword [esi + ebx*4]
test edi, edi
jne 0x1324d0cc
call sub.wsock32.dll_WSACleanup
add esp, 0x1d0
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x1324e0ec
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.131450b8
xor eax, eax
push ebp
push 0x1324e180
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.13144c28
mov eax, dword [ebp - 4]
test eax, eax
je 0x1324e128
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
test bx, bx
jbe 0x1324e162
mov di, 1
movzx eax, di
mov edx, dword [ebp - 4]
movzx eax, byte [edx + eax - 1]
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
movzx edx, word [ebp - 6]
xor dx, 0xf
call fcn.13144e10
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.13144f04
inc edi
dec bx
jne 0x1324e133
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1324e187
lea eax, [ebp - 0xc]
call fcn.13144c28
lea eax, [ebp - 4]
call fcn.13144c28
ret

Function at 0x1324e1e8
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe48
push ebx
push esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.131450b8
xor eax, eax
push ebp
push 0x1324e2a9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x198]
push eax
push 2
call sub.wsock32.dll_WSAStartup
mov eax, dword [ebp - 4]
call fcn.131450c8
push eax
call sub.wsock32.dll_gethostbyname
mov ebx, eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebx + 0xc]
mov esi, dword [eax]
movzx eax, byte [esi]
mov dword [ebp - 0x1b8], eax
mov byte [ebp - 0x1b4], 0
movzx eax, byte [esi + 1]
mov dword [ebp - 0x1b0], eax
mov byte [ebp - 0x1ac], 0
movzx eax, byte [esi + 2]
mov dword [ebp - 0x1a8], eax
mov byte [ebp - 0x1a4], 0
movzx eax, byte [esi + 3]
mov dword [ebp - 0x1a0], eax
mov byte [ebp - 0x19c], 0
lea edx, [ebp - 0x1b8]
mov ecx, 3
mov eax, 0x1324e2c0
call fcn.1314aea4
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1324e2b0
lea eax, [ebp - 4]
call fcn.13144c28
ret

Function at 0x1324e72c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.131457a4
xor eax, eax
push ebp
push 0x1324e7a6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
call sub.ntdll.dll_RtlInitUnicodeString
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.131455bc
push eax
call sub.ntdll.dll_RtlDosPathNameToNtPathName_U
push 0
push 0
push 0
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x24]
mov ecx, 0x40
call fcn.1324e704
lea eax, [ebp - 0x24]
push eax
call sub.ntdll.dll_NtDeleteFile
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1324e7ad
lea eax, [ebp - 4]
call fcn.131453ec
ret
Function at 0x1324e980
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.131450b8
xor eax, eax
push ebp
push 0x1324ea0b
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0
push 0
push 2
push 0
push 2
push 0x40000000
mov eax, dword [ebp - 4]
call fcn.131450c8
push eax
call sub.kernel32.dll_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x1324e9f5
cmp edi, 0xffffffff
jne 0x1324e9dc
mov eax, dword [ebp - 8]
call fcn.1324ea1c
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push edi
mov eax, dword [ebp - 8]
push eax
push esi
call sub.kernel32.dll_WriteFile_1
push esi
call sub.kernel32.dll_CloseHandle
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1324ea12
lea eax, [ebp - 4]
call fcn.13144c28
ret

Function at 0x1324eafc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov edi, dword [0x132acab4]
call sub.kernel32.dll_GetTickCount
mov ebx, eax
jmp 0x1324eb29
mov eax, dword [edi]
cmp byte [eax + 0xa4], 0
jne 0x1324eb34
mov eax, dword [edi]
call fcn.131b2114
push 0xa
call sub.kernel32.dll_Sleep_2
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp esi, eax
ja 0x1324eb10
pop edi
pop esi
pop ebx
ret
Function at 0x57001da8
Capabilities:
Packed with generic packer

Disassembly:
pop es
add edx, dword [edi + 0x48]
add byte [eax], al
add byte [eax + 7], dl
add edx, dword [edi + 8]
insd dword es:[edi], dx
popal
push esp
jns 0x57001d8a
jae 0x57001d3d
sbb eax, 0xd115700
push esp
inc esp
inc ecx
push edi
imul esp, dword [ebp + 0x53], 0x6e697274
add al, 0
add byte [eax], al
push esp
pop es
add edx, dword [edi + 8]
add byte [eax], al
add byte [edi + eax + 3], dl
push edi
or byte [ebp + 0x61], ch
add edx, dword [edi + 8]
insd dword es:[edi], dx
popal
push esp
jns 0x57001db6
jae 0x57001d95
sbb eax, 0x10115700
push esp
inc esp
inc ecx
push ebp
outsb dx, byte [esi]
imul esp, dword [ebx + 0x6f], 0x74536564
jb 0x57001dc5
outsb dx, byte [esi]
add al, 0
add byte [eax], al
pop eax
pop es
add edx, dword [edi + 0x4a]
add byte [eax], al
add byte [eax + 7], bl
add edx, dword [edi + 8]
insd dword es:[edi], dx
popal
push esp
jns 0x57001de5
jae 0x57001d08
jl 0x57001d97
add byte [edi + 0x11], dl
or edx, dword [esp + eax*2 + 0x41]
dec ecx
push ebp
outsb dx, byte [esi]
imul ebp, dword [esi + 0x6f], 0x77
outsb dx, byte [esi]
add al, 0
add byte [eax], al
inc esp
pop es
add edx, dword [edi + 0xd]
add byte [eax], al
add byte [edi + eax + 3], al
push edi
or byte [ebp + 0x61], ch
add byte [eax], al
add byte [edi + eax + 3], al
push edi
or eax, 0x44000000
inc esp
pop es
add edx, dword [edi + 8]
insd dword es:[edi], dx
popal
push esp
jns 0x57001e10
jae 0x57001d2e
shr byte [eax + 0x1157001d], 8
adc dword [eax], ecx
push esp
inc esp
inc ecx
dec ecx
outsb dx, byte [esi]
je 0x57001de7
xor al, 8
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax + eax], dl
add byte [eax], al
add byte [eax], al
adc al, 0
add byte [eax], al
pushal
pop es
add edx, dword [edi + 8]
insd dword es:[edi], dx
popal
push esp
jns 0x57001e39
jae 0x57001d5c
and al, 0x1e
add byte [edi], dl
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [esi + ebx], ah
add byte [edi], dl
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [esi], dh
push ds
add byte [edi + 0x1c], dl
add byte [eax], al
add byte [edi + eax + 3], cl
push edi
mov byte [eax], dl
add byte [edi - 0x70], dl
adc byte [eax], al
push edi
test al, 0x10
add byte [edi - 0x60], dl
adc byte [eax], al
push edi
mov eax, 0xc0570010
adc byte [eax], al
push edi
enter 0x10, 0x57
mov al, 0x10
add byte [edi + 0x60], dl
adc byte [eax], al
push edi
push 0xac570010
push ds
add byte [edi + 0xe], dl
push cs
inc ebp
js 0x57001ea0
jo 0x57001eb4
imul ebp, dword [edi + 0x6e], 0x1e4890
push edi
int1
invalid
jl 0x57001e95
invalid
fimul dword [ebx + 0xc468bf0]

Function at 0x57002d81
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 0x10]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
xor esi, esi
mov ecx, dword [edi + 0x3c]
lea eax, [ecx + eax*8]
mov eax, dword [eax + edi + 0x78]
add eax, edi
mov ecx, dword [eax + 0x20]
invalid
pop eax
Function at 0x57002e2d
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
push esi
push edi
mov edi, dword [eax + 0xc]
add edi, 0xc
mov esi, dword [edi]
jmp 0x57002e53
push dword [esi + 0x30]
call fcn.57002e92
imul eax, eax, 3
pop ecx
cmp dword [esp + 0xc], eax
je 0x57002e5c
mov esi, dword [esi]
cmp esi, edi
jne 0x57002e3f
xor eax, eax
pop edi
pop esi
ret
mov eax, dword [esi + 0x18]
jmp 0x57002e59

Function at 0x57005204
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, edx
mov ebp, eax
test ebp, ebp
je 0x570052a4
test ebp, ebp
setl byte [esp]
mov eax, edi
xor ecx, ecx
mov edx, 0xb
call sub.rtl120.bpl__System__LStrSetLength_qqrv
mov esi, 0xb
mov eax, ebp
mov ecx, 0xa
cdq
idiv ecx
mov eax, edx
cdq
xor eax, edx
sub eax, edx
mov ebx, eax
mov ecx, 0xa
mov eax, ebp
cdq
idiv ecx
mov ebp, eax
mov eax, edi
call sub.rtl120.bpl__System__UniqueStringA_qqrr27System__AnsiStringT_us_i0__
add bl, 0x30
mov byte [eax + esi - 1], bl
dec esi
test ebp, ebp
jne 0x5700522e
cmp byte [esp], 0
je 0x57005273
mov eax, edi
call sub.rtl120.bpl__System__UniqueStringA_qqrr27System__AnsiStringT_us_i0__
mov byte [eax + esi - 1], 0x2d
dec esi
test esi, esi
jle 0x570052b0
mov eax, edi
call sub.rtl120.bpl__System__UniqueStringA_qqrr27System__AnsiStringT_us_i0__
push eax
mov eax, edi
call sub.rtl120.bpl__System__UniqueStringA_qqrr27System__AnsiStringT_us_i0__
add eax, esi
mov ebx, 0xb
sub ebx, esi
mov ecx, ebx
pop edx
call sub.rtl120.bpl__System_Move_qqrpxvpvi
mov edx, ebx
mov eax, edi
xor ecx, ecx
call sub.rtl120.bpl__System__LStrSetLength_qqrv
jmp 0x570052b0
mov eax, edi
mov edx, 0x570052c4
call sub.rtl120.bpl__System__LStrAsg_qqrpvpxv
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x570052c8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, edx
mov ebx, eax
test ebx, ebx
je 0x5700536b
test ebx, ebx
setl byte [esp]
mov eax, edi
mov edx, 0xb
call sub.rtl120.bpl__System__UStrSetLength_qqrr20System_UnicodeStringi
mov esi, 0xb
mov eax, ebx
mov ecx, 0xa
cdq
idiv ecx
mov eax, edx
cdq
xor eax, edx
sub eax, edx
mov ebp, eax
mov ecx, 0xa
mov eax, ebx
cdq
idiv ecx
mov ebx, eax
mov eax, edi
call sub.rtl120.bpl__System__UniqueStringU_qqrr20System_UnicodeString
add bp, 0x30
mov word [eax + esi*2 - 2], bp
dec esi
test ebx, ebx
jne 0x570052f0
cmp byte [esp], 0
je 0x57005339
mov eax, edi
call sub.rtl120.bpl__System__UniqueStringU_qqrr20System_UnicodeString
mov word [eax + esi*2 - 2], 0x2d
dec esi
test esi, esi
jle 0x57005377
mov eax, edi
call sub.rtl120.bpl__System__UniqueStringU_qqrr20System_UnicodeString
push eax
mov eax, edi
call sub.rtl120.bpl__System__UniqueStringU_qqrr20System_UnicodeString
lea eax, [eax + esi*2]
mov ebx, 0xb
sub ebx, esi
mov ecx, ebx
add ecx, ecx
pop edx
call sub.rtl120.bpl__System_Move_qqrpxvpvi
mov edx, ebx
mov eax, edi
call sub.rtl120.bpl__System__UStrSetLength_qqrr20System_UnicodeStringi
jmp 0x57005377
mov eax, edi
mov edx, 0x5700538c
call sub.rtl120.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x401110
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x41007c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xa0], 0x94
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x90], 2
jne 0x4011fb
cmp dword [ebp - 0x9c], 5
jne 0x401170
cmp dword [ebp - 0x98], 1
jne 0x401170
push 0x40e178
call fcn.00403002
add esp, 4
mov eax, 2
jmp 0x4011fd
cmp dword [ebp - 0x9c], 5
jne 0x401196
cmp dword [ebp - 0x98], 2
jne 0x401196
push str.windows_2003n
call fcn.00403002
add esp, 4
mov eax, 3
jmp 0x4011fd
cmp dword [ebp - 0x9c], 6
jne 0x4011bc
cmp dword [ebp - 0x98], 0
jne 0x4011bc
push str.vista_and_2008n
call fcn.00403002
add esp, 4
mov eax, 4
jmp 0x4011fd
cmp dword [ebp - 0x9c], 6
jne 0x4011e2
cmp dword [ebp - 0x98], 1
jne 0x4011e2
push str.2008_R2_and_Windows_7n
call fcn.00403002
add esp, 4
mov eax, 5
jmp 0x4011fd
cmp dword [ebp - 0x9c], 6
jne 0x4011fb
cmp dword [ebp - 0x98], 2
jne 0x4011fb
mov eax, 6
jmp 0x4011fd
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402b34
mov esp, ebp
pop ebp
ret
Function at 0x402b34
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41007c]
jne 0x402b3e
repz ret
jmp fcn.00403387

Function at 0x407c97
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41007c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00405d24
and dword [ebp - 0x14], 0
cmp dword [0x411b54], 0
mov dword [ebp - 0x18], eax
jne 0x407d4a
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x407df2
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x407df2
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x411b54], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x411b58], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x411b5c], eax
call edi
push eax
call esi
mov dword [0x411b64], eax
test eax, eax
je 0x407d4a
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x411b60], eax
mov eax, dword [0x411b60]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x407da3
cmp dword [0x411b64], ecx
je 0x407da3
push eax
call esi
push dword [0x411b64]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x407da3
test ebx, ebx
je 0x407da3
call edi
test eax, eax
je 0x407d9a
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x407d9a
test byte [ebp - 8], 1
jne 0x407da3
or dword [ebp + 0x10], 0x200000
jmp 0x407dd6
mov eax, dword [0x411b58]
cmp eax, dword [ebp - 0x18]
je 0x407dd6
push eax
call esi
test eax, eax
je 0x407dd6
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x407dd6
mov eax, dword [0x411b5c]
cmp eax, dword [ebp - 0x18]
je 0x407dd6
push eax
call esi
test eax, eax
je 0x407dd6
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x411b54]
call esi
test eax, eax
je 0x407df2
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x407df4
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00402b34
leave
ret
Function at 0x401750
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x40c00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
xor eax, eax
mov dl, 0x2d
nop dword [eax]
cmp byte [esi + eax], dl
jne 0x401848
mov dl, byte [eax + 0x4091a5]
inc eax
test dl, dl
jne 0x401770
add esi, eax
xor edx, edx
mov eax, dword [ebx + 4]
mov cl, byte [eax]
test cl, cl
je 0x4017a7
mov edi, esi
sub edi, eax
cmp byte [edi + eax], cl
jne 0x401848
mov cl, byte [eax + 1]
inc eax
inc edx
test cl, cl
jne 0x401795
add esi, edx
mov cl, 0x3d
xor eax, eax
nop dword [eax]
cmp byte [esi + eax], cl
jne 0x401848
mov cl, byte [eax + 0x4091a9]
inc eax
test cl, cl
jne 0x4017b0
add esi, eax
lea eax, [ebp - 8]
push 0xa
push eax
push esi
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtol]
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x401848
cmp eax, dword [ebx + 0x18]
jle 0x401806
push dword [ebx + 4]
push esi
push str.ERROR__value___s__is_too_large_for_option___s_._n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.004014d0
add esp, 0x10
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
cmp eax, dword [ebx + 0x14]
jge 0x401830
push dword [ebx + 4]
push esi
push str.ERROR__value___s__is_too_small_for_option___s_._n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.004014d0
add esp, 0x10
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
pop edi
mov dword [ebx + 0x1c], eax
mov al, 1
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407238
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407238
mov esp, ebp
pop ebp
ret 4