joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4036b0
Capabilities:
Inspect section memory permissions

Disassembly:
jmp 0x4036b8
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x4036d0
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x4036ee
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edi, es
add al, 1
add byte [eax], al
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x40374c
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x403733
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x40373c
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x403746
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x403728
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x4036b2
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx

Function at 0x4036d7
Capabilities:
Inspect section memory permissions

Disassembly:
jmp 0x4036b8
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x4036d0
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x4036ee
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edi, es
add al, 1
add byte [eax], al
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x40374c
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x403733
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x40373c
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x403746
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x403728
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x4036b2
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
Function at 0x40dabd
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x43e373
call fcn.0043d180
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.004027c7
and dword [ebp - 4], 0
lea ecx, [esi + 0xc]
call fcn.004027c7
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.004027c7
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 2
call fcn.004027c7
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 3
call fcn.004027c7
and byte [esi + 0x3c], 0
lea ecx, [esi + 0x40]
mov byte [ebp - 4], 4
call fcn.004027c7
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 5
call fcn.004027c7
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x413ca1
Capabilities:
Encode data using xor

Disassembly:
push esi
or eax, 0xffffffff
xor esi, esi
test edx, edx
jbe 0x413cce
push ebx
push edi
movzx edi, byte [esi + ecx]
mov ebx, eax
and ebx, 0xff
xor edi, ebx
shr eax, 8
mov edi, dword [edi*4 + 0x451720]
xor eax, edi
inc esi
cmp esi, edx
jb 0x413cad
pop edi
pop ebx
not eax
pop esi
ret
Function at 0x4181fb
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x43efde
call fcn.0043d180
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov byte [esi + 0x30], bl
mov byte [esi + 0x31], bl
mov dword [esi + 0x38], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x60], ebx
lea ecx, [esi + 0x68]
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x64], ebx
call fcn.00418295
lea eax, [esi + 0x8c]
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov byte [ebp - 4], 5
mov byte [esi + 0x95], bl
mov dword [esi + 0x98], ebx
call fcn.0040e33b
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x94], al
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x41a78b
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x43f346
call fcn.0043d180
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [ebp - 4], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 1
mov dword [esi + 0x1c], eax
mov byte [esi + 0x20], al
mov byte [esi + 0x21], al
call fcn.004027c7
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.0041a7e5
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x41a796
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x43f346
call fcn.0043d180
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [ebp - 4], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 1
mov dword [esi + 0x1c], eax
mov byte [esi + 0x20], al
mov byte [esi + 0x21], al
call fcn.004027c7
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.0041a7e5
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x41a837
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x43f391
call fcn.0043d180
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 3
call fcn.00422edf
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.0041a88d
push dword [esi + 0x24]
call fcn.00402fca
and byte [ebp - 4], 0
pop ecx
lea ecx, [esi + 0xc]
call fcn.00419bb8
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.0041adca
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x41bebb
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x43f592
call fcn.0043d180
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esi], 0x4449b0
mov dword [ebp - 0x10], esi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
lea ecx, [esi + 0x48]
mov dword [ebp - 4], edi
call fcn.004027c7
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 1
call fcn.004027c7
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x38], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x14], edi
mov dword [esi], fcn.0041b739
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x41bec6
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x43f592
call fcn.0043d180
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esi], 0x4449b0
mov dword [ebp - 0x10], esi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
lea ecx, [esi + 0x48]
mov dword [ebp - 4], edi
call fcn.004027c7
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 1
call fcn.004027c7
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x38], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x14], edi
mov dword [esi], fcn.0041b739
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x428878
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors

Disassembly:
mov eax, 0x4405e3
call fcn.0043d180
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x4459f0
mov dword [esi + 4], 0x4459dc
mov dword [esi + 8], 0x443fa0
mov dword [esi + 0xc], 0x4459c0
mov dword [esi + 0x10], 0x4459ac
mov dword [esi + 0x14], 0x44599c
mov dword [esi + 0x18], 0x443f90
mov dword [esi + 0x1c], 0x443f80
mov dword [esi + 0x20], 0x445994
mov dword [esi + 0x24], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
or dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
lea ecx, [esi + 0x64]
mov byte [ebp - 4], 4
call fcn.004027c7
lea ecx, [esi + 0x70]
mov byte [ebp - 4], 5
call fcn.004027c7
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], ebx
or dword [esi + 0x9c], 0xffffffff
mov byte [ebp - 4], 7
mov dword [esi + 0x90], ebx
mov dword [esi + 0x94], ebx
mov dword [esi + 0x98], ebx
mov dword [esi + 0xa0], ebx
mov byte [esi + 0xa4], bl
mov byte [esi + 0xa5], bl
mov byte [esi + 0xa6], bl
mov byte [esi + 0xa7], bl
mov byte [esi + 0xa8], bl
mov byte [esi + 0xa9], bl
mov byte [esi + 0xaa], bl
mov dword [esi + 0xac], ebx
mov dword [esi], 0x445968
mov dword [esi + 4], 0x445954
mov dword [esi + 8], 0x44593c
mov dword [esi + 0xc], 0x445920
mov dword [esi + 0x10], 0x44590c
mov dword [esi + 0x14], 0x4458fc
mov dword [esi + 0x18], 0x4458ec
mov dword [esi + 0x1c], 0x4458dc
mov dword [esi + 0x20], 0x4458d4
call fcn.0040e33b
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x28], al
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x42daa9
Capabilities:
Identify system language via api

Disassembly:
mov eax, 0x440dd0
call fcn.0043d180
sub esp, 0x28
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
cmp si, ax
jne 0x42db87
mov ecx, eax
xor edi, edi
shr ax, 0xa
and ecx, 0x3ff
mov esi, eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
movzx ecx, cx
lea edx, [ebp - 0x1c]
mov dword [ebp - 4], edi
call fcn.0042dbb5
lea ecx, [ebp - 0x34]
call fcn.0042d761
mov byte [ebp - 4], 1
mov dword [ebp - 0x10], edi
movzx ebx, si
mov eax, dword [ebp - 0x10]
neg eax
sbb eax, eax
not eax
and eax, ebx
cmp eax, dword [ebp - 0x18]
jae 0x42db69
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ecx + eax*4]
cmp dword [esi + 4], edi
je 0x42db69
lea eax, [ebp - 0x34]
lea ecx, [ebp - 0x28]
push eax
call fcn.0040289a
push dword [esi]
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.00402b8b
lea ecx, [ebp - 0x28]
push str..txt
call fcn.00402b8b
mov edx, dword [ebp - 0x28]
mov ecx, 0x4516b0
call fcn.0042d755
test al, al
jne 0x42db96
push dword [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00402fca
pop ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jb 0x42db09
push dword [ebp - 0x34]
call fcn.00402fca
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x1c]
call fcn.00419bb8
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
push dword [esi]
mov ecx, 0x4516d0
call fcn.00402a68
push dword [ebp - 0x28]
call fcn.00402fca
push dword [ebp - 0x34]
call fcn.00402fca
pop ecx
jmp 0x42db7a

Function at 0x42ebbd
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get ntdll base address

Disassembly:
mov eax, 0x440f44
call fcn.0043d180
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
or eax, 0xffffffff
mov dword [ebp - 0x10], esi
mov dword [esi + 8], eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0x18], eax
mov dword [esi + 0x20], ebx
mov dword [esi + 0x28], eax
mov dword [esi + 0x30], eax
lea ecx, [esi + 0x38]
mov byte [esi], bl
mov byte [esi + 1], bl
mov byte [esi + 2], 1
mov dword [esi + 0xc], eax
mov dword [esi + 0x14], ebx
mov dword [esi + 0x1c], eax
mov dword [esi + 0x24], ebx
mov dword [esi + 0x2c], eax
mov dword [esi + 0x34], eax
call fcn.004027c7
lea ecx, [esi + 0x44]
mov dword [ebp - 4], ebx
call fcn.004027c7
lea ecx, [esi + 0x50]
mov byte [ebp - 4], 1
call fcn.004027c7
mov byte [esi + 0x5c], bl
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
lea ecx, [esi + 0x6c]
mov byte [ebp - 4], 3
call fcn.0042ec53
lea ecx, [esi + 0x9c]
call fcn.0043ce80
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x42ebc9
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get ntdll base address

Disassembly:
mov eax, 0x440f44
call fcn.0043d180
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
or eax, 0xffffffff
mov dword [ebp - 0x10], esi
mov dword [esi + 8], eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0x18], eax
mov dword [esi + 0x20], ebx
mov dword [esi + 0x28], eax
mov dword [esi + 0x30], eax
lea ecx, [esi + 0x38]
mov byte [esi], bl
mov byte [esi + 1], bl
mov byte [esi + 2], 1
mov dword [esi + 0xc], eax
mov dword [esi + 0x14], ebx
mov dword [esi + 0x1c], eax
mov dword [esi + 0x24], ebx
mov dword [esi + 0x2c], eax
mov dword [esi + 0x34], eax
call fcn.004027c7
lea ecx, [esi + 0x44]
mov dword [ebp - 4], ebx
call fcn.004027c7
lea ecx, [esi + 0x50]
mov byte [ebp - 4], 1
call fcn.004027c7
mov byte [esi + 0x5c], bl
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
lea ecx, [esi + 0x6c]
mov byte [ebp - 4], 3
call fcn.0042ec53
lea ecx, [esi + 0x9c]
call fcn.0043ce80
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x434bdd
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x44184c
call fcn.0043d180
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], ebx
mov dword [esi], 0x445f68
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x1c], ebx
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
call fcn.00434c45
lea eax, [esi + 0x164]
mov byte [esi + 0x160], bl
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
lea ecx, [esi + 0x170]
mov byte [ebp - 4], 3
call fcn.004027c7
mov ecx, dword [ebp - 0xc]
mov dword [esi], 0x446900
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x435257
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x4418e0
call fcn.0043d180
sub esp, 0x10
push ebx
push esi
push edi
mov esi, ecx
push 0xedb
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
cmp eax, 1
push 0
sete bl
mov al, bl
neg al
sbb eax, eax
and al, 0xd6
add eax, 0x2a
movzx eax, ax
push eax
push 0xcc
push dword [esi + 0x3c]
mov dword [ebp - 0x10], eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
lea edi, [esi + 0x40]
push dword [ebp - 0x10]
push 0xcc
push dword [edi]
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [ebp - 0x1c]
call fcn.004027c7
and dword [ebp - 4], 0
lea eax, [ebp - 0x1c]
push eax
lea ecx, [esi + 0x3c]
call fcn.00408f77
push dword [ebp - 0x1c]
push dword [esi + 0x3c]
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.00408f77
push dword [ebp - 0x1c]
push dword [edi]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 0xeda
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
neg bl
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
sbb ebx, ebx
and ebx, 0xfffffffb
add ebx, 5
push ebx
push eax
call esi
push ebx
push dword [edi]
call esi
push dword [ebp - 0x1c]
call fcn.00402fca
pop ecx
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4397a7
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x441d92
call fcn.0043d180
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x447194
mov dword [esi + 4], 0x44717c
mov dword [esi + 8], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.004027c7
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x24], 1
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov byte [esi + 0x4c], bl
mov byte [esi + 0x4d], bl
mov dword [esi], 0x447160
mov dword [esi + 4], 0x447148
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x439d6f
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x44200e
call fcn.0043d180
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x447214
mov dword [esi + 4], 0x447200
mov dword [esi + 8], 0x4471f0
mov dword [esi + 0xc], 0x4471cc
mov dword [esi + 0x10], 0x4471b0
mov dword [esi + 0x14], 0x443f80
mov dword [esi + 0x18], 0x443f90
mov dword [esi + 0x1c], ebx
lea ecx, [esi + 0x20]
mov dword [ebp - 4], ebx
call fcn.004027c7
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
call fcn.004027c7
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 2
call fcn.004027c7
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x6c], ebx
lea ecx, [esi + 0x9c]
mov byte [ebp - 4], 5
mov byte [esi + 0x70], 1
mov byte [esi + 0x71], bl
mov dword [esi + 0x94], ebx
mov byte [esi + 0x98], bl
mov byte [esi + 0x99], bl
call fcn.004027c7
lea ecx, [esi + 0xa8]
mov byte [ebp - 4], 6
call fcn.004027c7
lea ecx, [esi + 0xb4]
mov byte [ebp - 4], 7
call fcn.004027c7
lea ecx, [esi + 0xc0]
mov byte [ebp - 4], 8
call fcn.004027c7
lea ecx, [esi + 0xcc]
mov byte [ebp - 4], 9
call fcn.004027c7
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0xd8], bl
mov byte [esi + 0xd9], bl
mov byte [esi + 0xda], bl
mov dword [esi], 0x445efc
mov dword [esi + 4], 0x445ee8
mov dword [esi + 8], 0x445ed8
mov dword [esi + 0xc], 0x445eb4
mov dword [esi + 0x10], 0x445e98
mov dword [esi + 0x14], 0x445e88
mov dword [esi + 0x18], 0x445e78
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x439ed8
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
mov eax, 0x442036
call fcn.0043d180
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
lea ecx, [esi + 0xc]
mov dword [ebp - 4], ebx
call fcn.004027c7
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.004027c7
mov dword [esi + 0x28], ebx
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
mov byte [esi + 0x24], bl
mov byte [esi + 0x25], bl
mov dword [esi + 0x2c], ebx
call fcn.004027c7
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x43ac4a
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x442274
call fcn.0043d180
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], ebx
mov dword [esi], 0x445f68
lea ecx, [esi + 0xc]
mov dword [ebp - 4], ebx
mov dword [esi + 8], ebx
call fcn.004027c7
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x18], bl
mov byte [esi + 0x19], bl
mov byte [esi + 0x1a], bl
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
or dword [esi + 0x34], 0xffffffff
mov dword [esi + 0x38], 1
mov dword [esi], 0x4473e8
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x43bc3a
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4424ab
call fcn.0043d180
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], ebx
mov dword [esi], 0x445f68
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
lea ecx, [esi + 0x48]
mov dword [ebp - 4], ebx
mov dword [esi + 0x44], ebx
call fcn.0043bdc4
lea ecx, [esi + 0x80]
mov byte [ebp - 4], 1
call fcn.004027c7
lea ecx, [esi + 0x8c]
mov byte [ebp - 4], 2
call fcn.004027c7
lea eax, [esi + 0x9c]
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
lea ecx, [esi + 0xa8]
mov byte [ebp - 4], 4
call fcn.0043bce9
lea ecx, [esi + 0x138]
mov byte [ebp - 4], 5
call fcn.004027c7
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x144], bl
mov dword [esi], 0x447508
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x43cd40
Capabilities:
Check os version

Disassembly:
sub esp, 0x114
lea eax, [esp]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
mov dword [esp + 8], 0x114
call esi
lea ecx, [esp + 4]
push ecx
call esi
test eax, eax
pop esi
je 0x43cd77
cmp dword [esp + 4], 6
jne 0x43cd77
mov eax, dword [esp + 8]
test eax, eax
je 0x43cd99
push str.SetDefaultDllDirectories
push 0x4433f4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x43cd99
push 0xc00
call eax
add esp, 0x114
ret

Function at 0x43cde0
Capabilities:
Create thread

Disassembly:
push esi
lea eax, [esp + 8]
push eax
push 0
mov esi, ecx
mov ecx, dword [esp + 0x10]
push ecx
push edx
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
mov dword [esi], eax
pop esi
test eax, eax
je 0x43ce09
xor eax, eax
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x43ce18
mov eax, 1
ret 4
Function at 0x10008fff
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x1000900e
pop dword [ebp - 0x34]
mov eax, 0x2005137f
sub eax, 0x10048371
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x61110b0d
sub dword [ebp - 0x44], 0x12bec5c2
mov dword [ebp - 0x40], 0xe49d1ff
add dword [ebp - 0x40], 0x23e97a46
mov dword [ebp - 0x3c], 0xb1886fd2
add dword [ebp - 0x3c], 0x9ac3d45c
mov dword [ebp - 0x38], 0x16d1b6ae
add dword [ebp - 0x38], 0xe92e4952
lea eax, [ebp - 0x44]
push eax
mov eax, 0x16e0ac30
sub eax, 0x6e00c2c
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x6cf36812
sub dword [ebp - 0x44], 0xf880febc
mov dword [ebp - 0x40], 0x5d3d2f9
add dword [ebp - 0x40], 0x3b988e7c
mov dword [ebp - 0x3c], 0xb10d035d
sub dword [ebp - 0x3c], 0x4d9d96f1
mov dword [ebp - 0x38], 0x27340bfc
sub dword [ebp - 0x38], 0x27340bfc
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0xa2a4cf92
sub eax, 0x92a42f8a
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x34f92
push 0
call eax
mov ecx, 0x99899586
add ecx, 0x6676ac3a
mov esi, eax
mov edi, 0x52918233
add edi, 0xbd6f75cd
add edi, dword [ebp - 0x34]
mov ebx, 0x3038692e
add ebx, 0x58d4c147
xor dword [ebp - 0x30], 0x3b1c9ec7
mov edx, dword [edi]
mov dword [ebp - 0x20], 0xa3a9f1e3
xor edx, ebx
xor dword [ebp - 0x28], esi
mov dword [esi], edx
xor dword [ebp - 0x14], edx
add esi, 0x40231fa6
sub esi, 0x40231fa2
add edi, 0xe8741d55
add edi, 0x178be2af
loop 0x10009130
add eax, 0x86f18454
sub eax, 0x86f08a81
mov ebx, eax
add eax, 0x62cdc2ec
add eax, 0x9d323d19
mov ecx, 0xba2383ef
add ecx, 0x55dc7c11
invalid
invalid
int3
invalid
invalid