joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417430
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48e0d3
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4b03e8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0x4b6280
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
lea ecx, [esi + 0x34]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [ebp - 4], 0
mov dword [ecx], 0x4b6280
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
push 0
push 0x491514
mov byte [ebp - 4], 1
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], 0
mov byte [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.0041afe0
mov dword [esi + 0x40], 0
mov eax, esi
mov dword [esi + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41b831
Capabilities:
Write file on windows

Disassembly:
push 0x20
mov eax, 0x48e579
call fcn.0045b4ca
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x41b931
cmp byte [ebx + 0x3d], 0
je 0x41b931
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
sete al
test al, al
je 0x41b86b
xor al, al
jmp 0x41b933
xor eax, eax
mov dword [ebp - 0x14], 0xf
push eax
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.0041bd57
and dword [ebp - 4], 0
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
lea eax, [ebp - 0x2c]
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x18]
lea esi, [ebp - 0x28]
cmovae edi, edx
cmovae esi, edx
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x41b8c9
sub eax, 1
je 0x41b8cd
dec eax
sub eax, 1
je 0x41b91f
xor bl, bl
jmp 0x41b921
mov byte [ebx + 0x3d], 0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
cmp ecx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae eax, edx
sub esi, eax
je 0x41b905
push dword [ebx + 0x4c]
cmp ecx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, edx
push 1
push eax
call fcn.00448383
add esp, 0x10
cmp esi, eax
jne 0x41b8c5
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x28]
cmp byte [ebx + 0x3d], 0
je 0x41b91f
test esi, esi
jne 0x41b88f
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.00415bd0
jmp 0x41b889
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.0041bcd8
mov al, bl
jmp 0x41b933
mov al, 1
call fcn.0045b485
ret

Function at 0x41c472
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov byte [ecx + 0x68], al
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], eax
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret
Function at 0x41cd0f
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
mov esi, ecx
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0xb7
neg eax
sbb eax, eax
inc eax
mov dword [esi + 4], eax
pop esi
pop ebp
ret 4

Function at 0x41e7db
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push esi
xor ecx, ecx
xor edx, edx
xor esi, esi
push edi
cmp dword [ebp + 0xc], ecx
jle 0x41e8bc
mov edi, dword [ebp + 8]
mov al, byte [esi + edi]
cmp al, 0x3d
jne 0x41e7ff
inc edx
cmp edx, 2
jg 0x41e83d
cmp al, 0x7f
ja 0x41e83d
movzx eax, al
mov al, byte [eax + 0x493f58]
cmp al, 0x7f
je 0x41e83d
cmp al, 0x40
jae 0x41e818
test edx, edx
jne 0x41e83d
inc ecx
inc esi
cmp esi, dword [ebp + 0xc]
jl 0x41e7f2
test ecx, ecx
je 0x41e8bc
mov edi, dword [ebp + 0x14]
imul eax, ecx, 6
add eax, 7
sar eax, 3
cmp dword [edi], eax
jge 0x41e842
mov dword [edi], eax
push 0xfffffffffffffff0
jmp 0x41e83f
push 0xffffffffffffffee
pop eax
jmp 0x41e8be
mov edx, dword [ebp + 0x10]
xor eax, eax
push ebx
xor ebx, ebx
mov dword [ebp + 0xc], eax
test esi, esi
jle 0x41e8b6
mov eax, dword [ebp + 8]
push 3
pop edi
movzx eax, byte [eax]
mov cl, byte [eax + 0x493f58]
xor eax, eax
cmp cl, 0x40
sete al
shl ebx, 6
sub edi, eax
movzx eax, cl
mov ecx, dword [ebp + 0xc]
and eax, 0x3f
or ebx, eax
inc ecx
mov dword [ebp + 0xc], ecx
cmp ecx, 4
jne 0x41e8a7
xor eax, eax
mov dword [ebp + 0xc], eax
test edi, edi
jle 0x41e892
mov eax, ebx
shr eax, 0x10
mov byte [edx], al
inc edx
cmp edi, 1
jle 0x41e89f
mov eax, ebx
shr eax, 8
mov byte [edx], al
inc edx
cmp edi, 2
jle 0x41e8a7
mov byte [edx], bl
inc edx
mov eax, dword [ebp + 8]
dec esi
inc eax
mov dword [ebp + 8], eax
test esi, esi
jg 0x41e857
mov edi, dword [ebp + 0x14]
sub edx, dword [ebp + 0x10]
mov dword [edi], edx
pop ebx
xor eax, eax
pop edi
pop esi
pop ebp
ret
Function at 0x41e8c2
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
jne 0x41e8d6
xor eax, eax
jmp 0x41ea14
mov eax, ebx
shl eax, 3
push 6
pop ecx
cdq
idiv ecx
mov edx, ebx
imul ecx, eax, 6
shl edx, 3
push 3
sub edx, ecx
dec edx
pop ecx
sub edx, 1
je 0x41e8ff
dec edx
sub edx, 1
jne 0x41e901
add eax, 2
jmp 0x41e901
add eax, ecx
push esi
mov esi, dword [ebp + 0x14]
inc eax
cmp dword [esi], eax
jge 0x41e914
push 0xfffffffffffffff0
mov dword [esi], eax
pop eax
jmp 0x41ea13
mov eax, ebx
cdq
idiv ecx
xor ecx, ecx
imul eax, eax, 3
push edi
mov edi, dword [ebp + 0x10]
test eax, eax
jle 0x41e9aa
dec eax
mov ebx, dword [ebp + 8]
xor edx, edx
push 3
pop ecx
div ecx
inc eax
imul ecx, eax, 3
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
movzx ecx, byte [ebx]
movzx edx, byte [ebx + 1]
mov eax, ecx
movzx esi, byte [ebx + 2]
add ebx, 3
shr eax, 2
shl ecx, 4
mov al, byte [eax + 0x493f18]
mov byte [edi], al
mov eax, edx
shr eax, 4
add eax, ecx
and eax, 0x3f
mov al, byte [eax + 0x493f18]
mov byte [edi + 1], al
mov eax, esi
shr eax, 6
and esi, 0x3f
lea eax, [eax + edx*4]
and eax, 0x3f
mov al, byte [eax + 0x493f18]
mov byte [edi + 2], al
mov al, byte [esi + 0x493f18]
mov byte [edi + 3], al
add edi, 4
sub dword [ebp - 4], 1
jne 0x41e93f
mov esi, dword [ebp + 0x14]
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ebx
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
jmp 0x41e9ad
mov eax, dword [ebp + 8]
cmp ecx, ebx
jge 0x41ea06
movzx edx, byte [eax]
inc ecx
mov dword [ebp + 0xc], ecx
cmp ecx, ebx
jge 0x41e9c2
movzx ecx, byte [eax + 1]
jmp 0x41e9c4
xor ecx, ecx
mov eax, edx
shl edx, 4
shr eax, 2
mov al, byte [eax + 0x493f18]
mov byte [edi], al
mov eax, ecx
shr eax, 4
add eax, edx
and eax, 0x3f
mov al, byte [eax + 0x493f18]
mov byte [edi + 1], al
cmp dword [ebp + 0xc], ebx
jge 0x41e9fb
and ecx, 0xf
mov al, byte [ecx*4 + 0x493f18]
mov byte [edi + 2], al
jmp 0x41e9ff
mov byte [edi + 2], 0x3d
mov byte [edi + 3], 0x3d
add edi, 4
mov eax, edi
sub eax, dword [ebp + 0x10]
mov dword [esi], eax
xor eax, eax
mov byte [edi], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x423070
Capabilities:
Get mac address on windows

Disassembly:
push 0x58
mov eax, 0x48f085
call fcn.0045b4ca
mov esi, dword [ebp + 8]
and dword [ebp - 0x64], 0
push 0x288
mov dword [ebp - 0x54], 4
call fcn.004446b6
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x4230ac
push 0x491514
mov ecx, esi
call fcn.00412690
jmp 0x423214
lea eax, [ebp - 0x54]
push eax
push ebx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
jne 0x4230d1
push ebx
call fcn.004446c1
push dword [ebp - 0x54]
call fcn.004446b6
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x42309b
xor eax, eax
mov dword [ebp - 0x24], 0xf
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x38], al
mov dword [ebp - 4], eax
lea eax, [ebp - 0x54]
push eax
push ebx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x4231e9
mov byte [ebp - 0x20], al
lea edi, [ebp - 0x1f]
stosd dword es:[edi], eax
xor ecx, ecx
mov dword [ebp - 0x60], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
and dword [ebp - 0x58], eax
mov dword [ebp - 0x5c], eax
mov byte [ebp - 4], 1
mov edi, ebx
test ebx, ebx
je 0x4231c2
movzx eax, byte [edi + 0x199]
push eax
movzx eax, byte [edi + 0x198]
push eax
movzx eax, byte [edi + 0x197]
push eax
movzx eax, byte [edi + 0x196]
push eax
movzx eax, byte [edi + 0x195]
push eax
movzx eax, byte [edi + 0x194]
push eax
lea eax, [ebp - 0x20]
push str._02X_02X_02X_02X_02X_02X
push eax
call fcn.0040c1c0
lea eax, [edi + 0x10c]
push eax
call fcn.0048a3f5
push 0x4945c0
push eax
call fcn.004376b0
add esp, 0x2c
test eax, eax
jne 0x42321e
cmp dword [edi + 0x1a0], 0x47
je 0x42321e
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x50]
call fcn.00412690
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x60]
call fcn.0041e25a
push 0
push 1
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 1
call fcn.0041bcd8
mov edi, dword [edi]
test edi, edi
jne 0x423119
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x60]
sub eax, ecx
push 0x18
cdq
pop edi
idiv edi
test eax, eax
je 0x4231e1
lea eax, [ebp - 0x38]
cmp eax, ecx
je 0x4231e1
push 0xffffffffffffffff
push 0
push ecx
mov ecx, eax
call fcn.00409480
lea ecx, [ebp - 0x60]
call fcn.0041f761
push ebx
call fcn.004446c1
pop ecx
xor ebx, ebx
mov dword [esi + 0x14], 0xf
lea eax, [ebp - 0x38]
mov dword [esi + 0x10], ebx
push eax
mov ecx, esi
mov byte [esi], bl
call fcn.0040b890
push ebx
push 1
lea ecx, [ebp - 0x38]
call fcn.0041bcd8
mov eax, esi
call fcn.0045b485
ret 4
cmp byte [ebp - 0x20], 0
jne 0x423228
xor eax, eax
jmp 0x423232
lea eax, [ebp - 0x20]
push eax
call fcn.004480c0
pop ecx
push eax
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x38]
call fcn.0040bf30
jmp 0x4231e1
Function at 0x4232a7
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6a8
mov eax, dword [0x4b03e8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov eax, ecx
push esi
xor esi, esi
mov dword [ebp - 0x6a4], eax
mov dword [ebp - 0x6a8], esi
cmp dword [eax + 0x58], esi
je 0x4232e4
lea ecx, [eax + 0x48]
push ecx
mov ecx, ebx
call fcn.0041b27a
jmp 0x4233f4
push edi
xor eax, eax
lea edi, [ebp - 0x16]
mov word [ebp - 0x18], ax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x284]
mov edi, 0x208
push edi
push esi
push eax
call fcn.004357e0
add esp, 0xc
lea eax, [ebp - 0x284]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x4a80d8
call fcn.004485b1
push eax
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00448fbc
push edi
lea eax, [ebp - 0x694]
push esi
push eax
call fcn.004357e0
push edi
lea eax, [ebp - 0x48c]
push esi
push eax
call fcn.004357e0
push 0x64
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x698], esi
push esi
push eax
mov dword [ebp - 0x6a0], esi
mov dword [ebp - 0x69c], esi
call fcn.004357e0
add esp, 0x34
lea eax, [ebp - 0x48c]
mov ecx, 0x104
push ecx
push eax
lea eax, [ebp - 0x69c]
push eax
lea eax, [ebp - 0x6a0]
push eax
lea eax, [ebp - 0x698]
push eax
push ecx
lea eax, [ebp - 0x694]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
pop edi
test eax, eax
je 0x4233c4
push dword [ebp - 0x698]
lea eax, [ebp - 0x7c]
push str._08X
push eax
call fcn.0040c1c0
add esp, 0xc
cmp byte [ebp - 0x7c], 0
je 0x4233d6
lea eax, [ebp - 0x7c]
push eax
call fcn.004480c0
pop ecx
mov esi, eax
mov ecx, dword [ebp - 0x6a4]
lea eax, [ebp - 0x7c]
push esi
push eax
add ecx, 0x48
call fcn.0040bf30
lea eax, [ebp - 0x7c]
mov ecx, ebx
push eax
call fcn.00412690
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.004168b6
mov esp, ebp
pop ebp
ret 4
Function at 0x423b2e
Capabilities:
Check os version

Disassembly:
push 0x34c
mov eax, 0x48f158
call fcn.0045b4ca
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x330]
xor ebx, ebx
mov dword [ebp - 0x358], esi
push 0x118
push ebx
mov dword [ebp - 0x350], ebx
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x334], 0x11c
call fcn.004357e0
add esp, 0xc
lea eax, [ebp - 0x334]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0x4a80e8
mov ecx, esi
call fcn.004056b0
mov eax, dword [ebp - 0x330]
mov dword [ebp - 0x34c], eax
movzx eax, byte [ebp - 0x21a]
mov dword [ebp - 0x354], eax
mov eax, dword [ebp - 0x328]
mov dword [ebp - 0x338], eax
mov eax, dword [ebp - 0x32c]
push str.ntdll.dll
mov dword [ebp - 4], ebx
mov dword [ebp - 0x350], 1
mov dword [ebp - 0x340], ebx
mov dword [ebp - 0x344], ebx
mov dword [ebp - 0x33c], ebx
mov dword [ebp - 0x348], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x423c25
push str.RtlGetNtVersionNumbers
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x423c1e
lea ecx, [ebp - 0x33c]
push ecx
lea ecx, [ebp - 0x344]
push ecx
lea ecx, [ebp - 0x340]
push ecx
call eax
movzx eax, word [ebp - 0x33c]
mov dword [ebp - 0x33c], eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x34c]
cmp eax, 5
jne 0x423c57
mov eax, dword [ebp - 0x348]
test eax, eax
je 0x423d23
cmp eax, 1
jne 0x423c4d
mov edi, str.WindowsXP
jmp 0x423d13
mov edi, str.WindowsServer2003
jmp 0x423d13
cmp eax, 6
jne 0x423d23
mov eax, dword [ebp - 0x348]
sub eax, ebx
je 0x423d00
sub eax, 1
je 0x423cf9
mov edi, dword [ebp - 0x338]
sub eax, 1
jne 0x423d29
cmp edi, 0x1ebb
jne 0x423c95
mov edi, str.Windows8
jmp 0x423d13
lea eax, [edi - 0x1ee6]
cmp eax, 0x25
jbe 0x423c8e
cmp edi, 0x1f13
je 0x423c8e
cmp dword [ebp - 0x340], 0xa
jne 0x423ccd
cmp dword [ebp - 0x344], 0
jne 0x423d29
push str.Windows10
call fcn.004485b1
pop ecx
push eax
push str.Windows10
jmp 0x423cf0
cmp dword [ebp - 0x340], 6
jne 0x423d29
cmp dword [ebp - 0x344], 3
jne 0x423d29
push str.Windows8.1
call fcn.004485b1
pop ecx
push eax
push str.Windows8.1
mov ecx, esi
call fcn.00405810
jmp 0x423d29
mov edi, str.Windows7
jmp 0x423d13
cmp dword [ebp - 0x354], 1
mov edi, str.WindowsVista
je 0x423d13
mov edi, str.WindowsServer2008
push edi
call fcn.004485b1
pop ecx
push eax
push edi
mov ecx, esi
call fcn.00405810
mov edi, dword [ebp - 0x338]
push 0x4a80e8
mov ecx, esi
call fcn.0041e40c
test eax, eax
jne 0x423d97
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.004357e0
mov eax, dword [ebp - 0x34c]
push edi
push dword [ebp - 0x348]
push eax
lea eax, [ebp - 0x218]
push str.Windows_d._d._d
push eax
call fcn.0040cbc0
add esp, 0x20
cmp word [ebp - 0x218], 0
jne 0x423d7b
mov eax, ebx
jmp 0x423d88
lea eax, [ebp - 0x218]
push eax
call fcn.004485b1
pop ecx
push eax
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.00405810
cmp dword [ebp + 0xc], 0
je 0x423dc5
cmp word [ebp - 0x320], 0
je 0x423db6
lea eax, [ebp - 0x320]
push eax
call fcn.004485b1
pop ecx
mov ebx, eax
push ebx
lea eax, [ebp - 0x320]
mov ecx, esi
push eax
call fcn.00407450
mov eax, esi
call fcn.0045b485
ret
Function at 0x424abc
Capabilities:
Create process on windows

Disassembly:
push 0x88
mov eax, 0x48f27c
call fcn.0045b4ca
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x94]
mov edi, dword [ebp + 0xc]
push 0x44
pop ebx
push ebx
push 0
push eax
call fcn.004357e0
push 0x10
lea eax, [ebp - 0x50]
mov dword [ebp - 0x94], ebx
push 0
push eax
call fcn.004357e0
add esp, 0x18
xor edx, edx
xor eax, eax
mov dword [ebp - 0x18], edx
mov word [ebp - 0x28], ax
push 7
pop ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
mov word [ebp - 0x40], ax
or ebx, 0xffffffff
mov byte [ebp - 4], 1
test edi, edi
je 0x424b9a
cmp word [edi], dx
jne 0x424b2b
mov eax, edx
jmp 0x424b32
push edi
call fcn.004485b1
pop ecx
push eax
push edi
lea ecx, [ebp - 0x40]
call fcn.00405810
cmp dword [ebp - 0x30], 0
je 0x424b9a
mov edi, 0x491b38
push edi
call fcn.004485b1
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.00405810
xor edi, edi
cmp word [esi], di
jne 0x424b63
mov eax, edi
jmp 0x424b6a
push esi
call fcn.004485b1
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00407450
mov esi, 0x491b3c
push esi
call fcn.004485b1
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00407450
push ebx
push edi
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.00407580
jmp 0x424bb6
xor edi, edi
cmp word [esi], di
jne 0x424ba5
mov eax, edi
jmp 0x424bac
push esi
call fcn.004485b1
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00405810
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push str.CreateRunProcess__s_
call fcn.00413ec0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
pop ecx
cmovae eax, dword [ebp - 0x28]
pop ecx
lea ecx, [ebp - 0x50]
push ecx
lea ecx, [ebp - 0x94]
push ecx
push edi
push edi
push edi
push 1
push edi
push edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x424bfb
mov esi, edi
jmp 0x424c26
cmp byte [ebp + 0x10], 0
je 0x424c13
cmp dword [ebp + 0x14], 0
cmovg ebx, dword [ebp + 0x14]
push ebx
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x50]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x4c]
call esi
xor esi, esi
inc esi
push edi
push 1
lea ecx, [ebp - 0x40]
call fcn.00405750
push edi
push 1
lea ecx, [ebp - 0x28]
call fcn.00405750
mov eax, esi
call fcn.0045b485
ret
Function at 0x424c68
Capabilities:
Enumerate processes

Disassembly:
push 0x260
mov eax, 0x48f2b4
call fcn.0045b4ca
mov eax, dword [ebp + 8]
test eax, eax
je 0x424d64
push eax
lea ecx, [ebp - 0x40]
call fcn.004056b0
lea eax, [ebp - 0x40]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.0041dcc0
mov edi, 0x22c
lea eax, [ebp - 0x26c]
push edi
push ebx
push eax
call fcn.004357e0
add esp, 0x10
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x424d55
lea eax, [ebp - 0x26c]
mov dword [ebp - 0x26c], edi
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x424d4a
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x28], ax
cmp word [ebp - 0x248], ax
jne 0x424cf4
mov eax, ebx
jmp 0x424d01
lea eax, [ebp - 0x248]
push eax
call fcn.004485b1
pop ecx
push eax
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x28]
call fcn.00405810
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
call fcn.0041dcc0
pop ecx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.0041e175
test eax, eax
je 0x424d6a
push ebx
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.00405750
lea eax, [ebp - 0x26c]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x424cd7
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, ebx
push ebx
push 1
lea ecx, [ebp - 0x40]
call fcn.00405750
mov eax, esi
call fcn.0045b485
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x264]
lea ecx, [ebp - 0x28]
push ebx
push 1
call fcn.00405750
jmp 0x424d57
Function at 0x4255c1
Capabilities:
Encode data using xor

Disassembly:
push 0x74
mov eax, 0x48f414
call fcn.0045b4ca
mov edi, ecx
mov dword [ebp - 0x4c], edi
mov eax, dword [edi]
or eax, dword [edi + 4]
jne 0x4255ff
xor ebx, ebx
push ebx
call fcn.0043cf62
mov dword [edi], eax
imul eax, dword [edi + 8], 0x3c
pop ecx
mov dword [edi + 4], edx
test eax, eax
jle 0x42560d
push eax
push ebx
call fcn.004298df
cdq
add dword [edi], eax
pop ecx
adc dword [edi + 4], edx
jmp 0x42560c
xor ebx, ebx
push ebx
call fcn.0043cf62
mov dword [edi], eax
mov dword [edi + 4], edx
pop ecx
push 0x1869f
push 0x2710
call fcn.004298df
pop ecx
pop ecx
lea ecx, [edi + 0xa8]
mov esi, eax
push ecx
lea ecx, [ebp - 0x28]
call fcn.0041b27a
xor eax, eax
mov dword [ebp - 4], ebx
inc eax
cmp dword [ebp - 0x18], 0
je 0x42574f
push str._rand
call fcn.004480c0
pop ecx
push eax
push str._rand
lea ecx, [ebp - 0x28]
call fcn.0040be00
mov eax, esi
cdq
push edx
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00423f6c
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0040bd00
xor eax, eax
mov byte [ebp - 4], bl
push ebx
inc eax
lea ecx, [ebp - 0x40]
push eax
call fcn.0041bcd8
lea ecx, [ebp - 0x80]
call fcn.0041f49e
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 2
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.0041f54d
lea ecx, [ebp - 0x80]
call fcn.0041f7f6
push 1
mov dword [ebp - 0x44], eax
mov esi, dword [eax + 4]
sub esi, dword [eax]
pop eax
cmove esi, eax
inc esi
push esi
call fcn.004168ea
push esi
mov esi, eax
mov dword [ebp - 0x48], eax
push ebx
push esi
call fcn.004357e0
push str.e5f11964f060af81f9225589564307ea
call fcn.004480c0
mov dword [ebp - 0x48], eax
add esp, 0x14
mov eax, dword [ebp - 0x44]
mov edx, ebx
mov ecx, dword [eax + 4]
sub ecx, dword [eax]
je 0x42571a
mov edi, ebx
mov ecx, dword [eax]
mov al, byte [ecx + edx]
xor al, byte [edi + str.e5f11964f060af81f9225589564307ea]
inc edi
mov ecx, dword [ebp - 0x44]
mov byte [edx + esi], al
xor eax, eax
cmp edi, dword [ebp - 0x48]
cmovge edi, eax
mov eax, dword [ecx + 4]
sub eax, dword [ecx]
inc edx
cmp edx, eax
mov eax, ecx
jb 0x4256f1
mov edi, dword [ebp - 0x4c]
push esi
mov ecx, edi
call fcn.004252d7
test al, al
jne 0x425733
test esi, esi
je 0x425744
push esi
call fcn.004168f3
pop ecx
jmp 0x425744
test esi, esi
je 0x42573e
push esi
call fcn.004168f3
pop ecx
xor eax, eax
inc eax
mov byte [edi + 0xc], al
lea ecx, [ebp - 0x80]
call fcn.0041f4df
xor eax, eax
inc eax
push ebx
push eax
lea ecx, [ebp - 0x28]
call fcn.0041bcd8
call fcn.0045b485
ret
Function at 0x427627
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x48f6de
call fcn.0045b496
xor esi, esi
mov dword [ebp - 0x18], 0x104
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
call fcn.00430d66
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], esi
call fcn.00430d9a
test eax, eax
mov edi, 0xf013f
lea eax, [ebp - 0x10]
push eax
jne 0x427667
mov edi, 0xf003f
push edi
push esi
push 0x4952b4
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4276c7
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push edi
push esi
push esi
push esi
push dword [ebp + 8]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x4276a2
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4276c7
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0x10]
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x10]
call esi
lea ecx, [ebp - 0x3c]
call fcn.00430d79
call fcn.0045b470
ret 0xc