joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b0d9
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.004077b0
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40b174
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x41318c]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x40b174
cmp eax, 1
je 0x40b195
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40b174
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x40b141
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x40b170
xor eax, eax
inc eax
jmp 0x40b1b4
cmp edi, eax
jae 0x40b178
xor eax, eax
jmp 0x40b1b4
cmp eax, esi
jae 0x40b17f
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x41318c]
jmp 0x40b198
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40b2ac
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x39c]
sub esp, 0x41c
mov ecx, dword [ebp + 0x3a4]
cmp ecx, dword [0x4136e8]
mov eax, dword [0x412690]
push ebx
push esi
mov dword [ebp + 0x398], eax
push edi
jae 0x40b472
mov eax, ecx
sar eax, 5
lea ebx, [eax*4 + 0x413700]
mov eax, dword [ebx]
mov esi, ecx
and esi, 0x1f
shl esi, 3
mov al, byte [eax + esi + 4]
test al, 1
mov dword [ebp - 0x80], ebx
je 0x40b472
xor edi, edi
cmp dword [ebp + 0x3ac], edi
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x7c], edi
jne 0x40b316
xor eax, eax
jmp 0x40b486
test al, 0x20
je 0x40b327
push 2
push edi
push edi
push ecx
call fcn.0040e2bc
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x40b3fc
cmp dword [ebp + 0x3ac], edi
mov eax, dword [ebp + 0x3a8]
mov dword [ebp - 0x70], eax
mov dword [ebp + 0x3a4], edi
jbe 0x40b443
mov ecx, dword [ebp - 0x70]
sub ecx, dword [ebp + 0x3a8]
lea eax, [ebp - 0x6c]
cmp ecx, dword [ebp + 0x3ac]
jae 0x40b389
mov edx, dword [ebp - 0x70]
inc dword [ebp - 0x70]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x40b37a
inc dword [ebp - 0x7c]
mov byte [eax], 0xd
inc eax
inc edi
mov ebx, dword [ebp - 0x80]
mov byte [eax], dl
inc eax
inc edi
cmp edi, 0x400
jl 0x40b35c
mov edi, eax
lea eax, [ebp - 0x6c]
sub edi, eax
push 0
lea eax, [ebp - 0x78]
push eax
push edi
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40b3c9
mov eax, dword [ebp - 0x78]
add dword [ebp - 0x74], eax
cmp eax, edi
jl 0x40b3d5
mov eax, dword [ebp - 0x70]
sub eax, dword [ebp + 0x3a8]
xor edi, edi
cmp eax, dword [ebp + 0x3ac]
jb 0x40b350
jmp 0x40b3d7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x3a4], eax
xor edi, edi
mov eax, dword [ebp - 0x74]
cmp eax, edi
jne 0x40b46d
cmp dword [ebp + 0x3a4], edi
je 0x40b443
push 5
pop eax
cmp dword [ebp + 0x3a4], eax
jne 0x40b435
mov dword [0x413184], eax
jmp 0x40b479
push edi
lea ecx, [ebp - 0x78]
push ecx
push dword [ebp + 0x3ac]
push dword [ebp + 0x3a8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40b427
mov eax, dword [ebp - 0x78]
mov dword [ebp + 0x3a4], edi
mov dword [ebp - 0x74], eax
jmp 0x40b3d7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x3a4], eax
jmp 0x40b3d7
push dword [ebp + 0x3a4]
call fcn.0040e1a7
pop ecx
jmp 0x40b483
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x40b45b
mov eax, dword [ebp + 0x3a8]
cmp byte [eax], 0x1a
je 0x40b30f
mov dword [0x413180], 0x1c
mov dword [0x413184], edi
jmp 0x40b483
sub eax, dword [ebp - 0x7c]
jmp 0x40b486
and dword [0x413184], 0
mov dword [0x413180], 9
or eax, 0xffffffff
mov ecx, dword [ebp + 0x398]
pop edi
pop esi
pop ebx
call fcn.0040b622
add ebp, 0x39c
leave
ret
Function at 0x40d919
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x413378], ebx
push esi
push edi
jne 0x40d999
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x40d9d4
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
mov dword [0x413378], eax
je 0x40d9d4
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x41337c], eax
call esi
cmp dword [0x41318c], 2
mov dword [0x413380], eax
jne 0x40d999
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x413388], eax
je 0x40d999
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x413384], eax
mov eax, dword [0x413384]
test eax, eax
je 0x40d9de
call eax
test eax, eax
je 0x40d9c5
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x413388]
test eax, eax
je 0x40d9c5
test byte [ebp - 8], 1
jne 0x40d9de
cmp dword [0x413198], 4
jb 0x40d9d8
or byte [ebp + 0x12], 0x20
jmp 0x40d9fd
xor eax, eax
jmp 0x40da0d
or byte [ebp + 0x12], 4
jmp 0x40d9fd
mov eax, dword [0x41337c]
test eax, eax
je 0x40d9fd
call eax
mov ebx, eax
test ebx, ebx
je 0x40d9fd
mov eax, dword [0x413380]
test eax, eax
je 0x40d9fd
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x413378]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40df7e
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x40dfac
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x40dfb3
cmp ebx, dword [eax + 4]
jae 0x40dfb3
xor eax, eax
jmp 0x40e1a3
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x40dfc4
xor eax, eax
inc eax
jmp 0x40e1a2
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x40dfda
cmp ecx, edx
jae 0x40e11f
cmp dword [eax + 4], 0
je 0x40dfe3
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x40dfcb
cmp dword [ebp + 8], 0
je 0x40e005
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x40e11f
cmp eax, esi
jae 0x40e11f
mov eax, dword [0x413390]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x40e02a
cmp dword [esi*4 + 0x413398], edi
je 0x40e123
inc esi
cmp esi, eax
jl 0x40e018
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40e19f
cmp dword [ebp - 8], 0x1000000
jne 0x40e19f
test byte [ebp - 0xc], 0xcc
je 0x40e0a8
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x40e19f
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x40e19f
cmp word [eax + 0x18], 0x10b
jne 0x40e19f
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x40e19f
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x40e0a8
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x40e0a8
test byte [ecx + 0x27], 0x80
jne 0x40e11f
push 1
push 0x4133d8
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test eax, eax
jne 0x40dfbc
mov ecx, dword [0x413390]
test ecx, ecx
mov edx, ecx
jle 0x40e0dc
lea eax, [ecx*4 + 0x413394]
cmp dword [eax], edi
je 0x40e0dc
dec edx
sub eax, 4
test edx, edx
jg 0x40e0d0
test edx, edx
jne 0x40e10d
push 0xf
pop ebx
cmp ecx, ebx
jg 0x40e0e9
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x40e101
lea eax, [edx*4 + 0x413398]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x40e0ef
cmp ecx, 0x10
jge 0x40e10d
inc ecx
mov dword [0x413390], ecx
push 0
push 0x4133d8
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x40dfbc
xor eax, eax
jmp 0x40e1a2
test esi, esi
jle 0x40dfbc
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 1
push 0x4133d8
call ebx
test eax, eax
jne 0x40dfbc
cmp dword [esi*4 + 0x413398], edi
je 0x40e179
mov eax, dword [0x413390]
lea esi, [eax - 1]
test esi, esi
jl 0x40e167
cmp dword [esi*4 + 0x413398], edi
je 0x40e163
dec esi
jns 0x40e157
test esi, esi
jge 0x40e177
cmp eax, 0x10
jge 0x40e172
inc eax
mov dword [0x413390], eax
lea esi, [eax - 1]
jmp 0x40e179
je 0x40e191
xor ecx, ecx
test esi, esi
jl 0x40e191
lea eax, [ecx*4 + 0x413398]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x40e17f
push 0
push 0x4133d8
call ebx
jmp 0x40dfbc
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40eeb4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
cmp esi, dword [0x4136e8]
push edi
jae 0x40f089
mov eax, esi
sar eax, 5
lea edi, [eax*4 + 0x413700]
mov eax, dword [edi]
and esi, 0x1f
shl esi, 3
add eax, esi
mov dl, byte [eax + 4]
test dl, 1
je 0x40f089
and dword [ebp - 0xc], 0
cmp dword [ebp + 0x10], 0
mov ebx, dword [ebp + 0xc]
mov ecx, ebx
je 0x40ef5f
test dl, 2
jne 0x40ef5f
test dl, 0x48
je 0x40ef29
cmp byte [eax + 5], 0xa
je 0x40ef29
mov eax, dword [edi]
mov al, byte [eax + esi + 5]
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea ecx, [ebx + 1]
mov dword [ebp - 0xc], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push ecx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40ef72
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop ecx
cmp eax, ecx
jne 0x40ef5a
mov dword [0x413184], ecx
jmp 0x40f090
cmp eax, 0x6d
jne 0x40ef66
xor eax, eax
jmp 0x40f09d
push eax
call fcn.0040e1a7
pop ecx
jmp 0x40f09a
mov eax, dword [ebp - 0x10]
mov ecx, dword [edi]
add dword [ebp - 0xc], eax
test byte [ecx + esi + 4], 0x80
je 0x40f084
test eax, eax
je 0x40ef99
cmp byte [ebx], 0xa
jne 0x40ef99
mov eax, ecx
lea eax, [eax + esi + 4]
or byte [eax], 4
jmp 0x40efa2
mov eax, dword [edi]
lea eax, [eax + esi + 4]
and byte [eax], 0xfb
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
add ecx, eax
cmp eax, ecx
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ecx
jae 0x40f07e
mov eax, dword [ebp - 8]
mov al, byte [eax]
cmp al, 0x1a
je 0x40f06e
cmp al, 0xd
je 0x40efd4
mov byte [ebx], al
inc ebx
inc dword [ebp - 8]
jmp 0x40f060
dec ecx
cmp dword [ebp - 8], ecx
jae 0x40efee
mov eax, dword [ebp - 8]
inc eax
cmp byte [eax], 0xa
jne 0x40efe9
add dword [ebp - 8], 2
jmp 0x40f042
mov dword [ebp - 8], eax
jmp 0x40f05c
inc dword [ebp - 8]
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40f016
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x40f05c
cmp dword [ebp - 0x10], 0
je 0x40f05c
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x40f037
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x40f042
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x40f05f
cmp ebx, dword [ebp + 0xc]
jne 0x40f047
cmp byte [ebp - 1], 0xa
jne 0x40f047
mov byte [ebx], 0xa
jmp 0x40f05f
push 1
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0040b220
add esp, 0xc
cmp byte [ebp - 1], 0xa
je 0x40f060
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 0xc]
cmp dword [ebp - 8], ecx
jb 0x40efb8
jmp 0x40f07e
mov eax, dword [edi]
test byte [eax + esi + 4], 0x40
jne 0x40f07e
lea esi, [eax + esi + 4]
or byte [esi], 2
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 0xc], ebx
mov eax, dword [ebp - 0xc]
jmp 0x40f09d
and dword [0x413184], 0
mov dword [0x413180], 9
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40279c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x40b02c], 0x8088405
inc edx
mov dword [0x40b02c], edx
mul edx
mov eax, edx
ret

Function at 0x4051c8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405201
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403278
jmp 0x40520a
mov eax, ebx
mov edx, esi
call fcn.0040322c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x405214
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405235
mov al, byte [esp]
jmp 0x405237
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40682c
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x406874
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.004067c8
mov eax, dword [ebp - 4]
call fcn.004034b8
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40687b
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x406b24
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
mov eax, esp
call fcn.00404d9c
add esp, 0x104
pop ebx
ret
Function at 0x406c6c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x406d8d
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 8]
push eax
push 0
push edi
push esi
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x406d77
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
je 0x406cc5
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x406d77
cmp dword [ebp - 0xc], 0
jne 0x406cda
mov eax, dword [ebp - 4]
call fcn.00403198
mov bl, 1
jmp 0x406d77
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
xor edx, edx
call fcn.00403278
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
call fcn.004034c4
push eax
lea eax, [ebp - 8]
push eax
push 0
push edi
push esi
call sub.advapi32.dll_RegQueryValueExA
cmp eax, 0xea
je 0x406c91
test eax, eax
jne 0x406d77
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
je 0x406d21
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x406d77
jmp 0x406d21
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0
je 0x406d34
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
cmp byte [eax + edx - 1], 0
je 0x406d1e
cmp dword [ebp - 8], 7
jne 0x406d43
cmp dword [ebp - 0xc], 0
je 0x406d43
inc dword [ebp - 0xc]
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.00403594
cmp dword [ebp - 8], 7
jne 0x406d6a
cmp dword [ebp - 0xc], 0
je 0x406d6a
lea eax, [ebp - 0x10]
call fcn.004034c4
mov edx, dword [ebp - 0xc]
mov byte [eax + edx - 1], 0
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
call fcn.004031e8
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406d94
lea eax, [ebp - 0x10]
call fcn.00403198
ret

Function at 0x407564
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x40b55c
mov eax, esi
mov edx, 8
test al, 1
je 0x407580
shr eax, 1
xor eax, 0xedb88320
jmp 0x407582
shr eax, 1
dec edx
jne 0x407573
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x40756c
pop esi
ret

Function at 0x407598
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x40b558], 0
jne 0x4075bb
call fcn.00407564
push 1
push 0x40b558
call sub.kernel32.dll_InterlockedExchange
mov eax, edi
test esi, esi
je 0x4075e6
mov edx, ebx
and dx, 0xff
xor ecx, ecx
mov cl, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x40b55c]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x4075c1
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x408a34
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, edx
mov esi, eax
cmp edi, 0x50
jle 0x408a55
mov eax, esi
mov edx, 0x40a1c8
mov ecx, 0x40
call fcn.0040270c
je 0x408a5a
call fcn.004089cc
mov eax, esi
add eax, 0x40
mov ebx, eax
mov eax, dword [ebx + 4]
mov edx, dword [ebx + 8]
not edx
cmp eax, edx
jne 0x408a79
cmp edi, eax
jne 0x408a79
cmp dword [ebx], 0xcc
je 0x408a7e
call fcn.004089cc
mov eax, ebx
add eax, 0x10
mov ebp, eax
add esi, dword [ebx + 4]
mov dword [esp], esi
mov edx, dword [esp]
sub edx, ebp
mov eax, ebp
call fcn.004075ec
cmp eax, dword [ebx + 0xc]
jne 0x408aa5
mov eax, dword [esp]
cmp byte [eax - 1], 0
je 0x408aaa
call fcn.004089cc
mov bl, 0xcc
mov esi, 0x40b95c
cmp ebp, dword [esp]
jb 0x408abb
call fcn.004089cc
mov eax, ebp
call fcn.00404cd0
mov edi, eax
mov eax, esi
mov ecx, edi
mov edx, ebp
call fcn.00403278
inc edi
add ebp, edi
add esi, 4
dec bl
jne 0x408ab1
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x408c98
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x408d84
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.00406b50
mov eax, dword [ebp - 8]
lea ecx, [ebp - 4]
mov edx, 0x408d9c
call fcn.00408b94
push 0
mov eax, dword [ebp - 4]
call fcn.004034b8
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x408d52
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 0xb7
je 0x408cb8
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x18]
mov edx, dword [ebp - 4]
mov al, 0x2f
call fcn.0040898c
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.00404c50
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.00407018
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x14]
mov ecx, 2
mov al, 0x60
call fcn.0040895c
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, 0x40461c
call fcn.0040584c
call fcn.00402eb4
jmp 0x408cb8
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.0040322c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408d8b
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.004031b8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004031b8
ret

Function at 0x408dcc
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffffec
cmp dword [0x40a07c], 2
jne 0x408e39
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x408df1
call fcn.00408dac
jmp 0x408e4b
lea eax, [esp + 8]
push eax
push 0x408e50
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [esp + 4], 1
mov dword [esp + 0x10], 2
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError_1
test eax, eax
je 0x408e39
call fcn.00408dac
jmp 0x408e4b
push 0
push 2
call sub.user32.dll_ExitWindowsEx
test eax, eax
jne 0x408e4b
call fcn.00408dac
add esp, 0x14
ret
Function at 0x408e64
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, eax
mov esi, edx
dec esi
test esi, esi
jl 0x408ec1
inc esi
xor ebx, ebx
cmp ebx, 1
jne 0x408e8a
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_Sleep
jmp 0x408e98
cmp ebx, 1
jle 0x408e98
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep
mov eax, edi
call fcn.004034b8
push eax
call sub.kernel32.dll_DeleteFileA
test eax, eax
jne 0x408ec1
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
je 0x408ec1
call sub.kernel32.dll_GetLastError_1
cmp eax, 3
je 0x408ec1
inc ebx
dec esi
jne 0x408e7a
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 4

Function at 0x409280
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff88
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
lea ebx, [ebp - 0x78]
xor eax, eax
push ebp
push 0x409370
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409388
push esi
push 0x409394
push edi
lea eax, [ebp - 8]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x4c], 0x44
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.004034b8
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409304
mov al, 0x62
call fcn.00408ecc
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x40931b
push ebx
call sub.user32.dll_TranslateMessage
push ebx
call sub.user32.dll_DispatchMessageA
push 1
push 0
push 0
push 0
push ebx
call sub.user32.dll_PeekMessageA
test eax, eax
jne 0x40930f
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x5c]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x40931b
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409377
lea eax, [ebp - 8]
call fcn.00403198
ret
Function at 0x409428
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4094dc
jmp 0x4094d1
cmp dword [esi + 0x10], 0x1000
jne 0x4094bd
test byte [esi + 0x15], 1
jne 0x4094bd
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x40947c
cmp eax, 2
je 0x40947c
cmp eax, 0x10
je 0x40947c
cmp eax, 0x20
jne 0x409491
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409491
mov bl, 1
xor ebp, ebp
jmp 0x4094a2
mov eax, dword [esi]
add eax, ebp
call fcn.00409420
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409495
test bl, bl
je 0x4094bd
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4094dc
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409454
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret