joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003a83f
Capabilities:
Reference cloudflare dns server

Disassembly:
mov eax, dword [esp + 4]
push ebx
xor ebx, ebx
push esi
push edi
cmp eax, ebx
je 0x1003a8f9
mov ecx, dword [eax + 4]
cmp ecx, 0x100007f
jne 0x1003a862
mov al, 1
jmp 0x1003aa0b
cmp ecx, ebx
je 0x1003a85b
cmp ecx, 0x1010101
je 0x1003a85b
cmp ecx, 0xffffffff
je 0x1003a85b
push ecx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov edi, eax
cmp edi, ebx
je 0x1003aa09
cmp byte [0x10145710], bl
je 0x1003a89d
push 0x10145710
push edi
call fcn.100073d3
pop ecx
pop ecx
test eax, eax
je 0x1003a85b
cmp byte [0x1014b960], bl
je 0x1003a8a9
cmp byte [edi], bl
jne 0x1003a8c4
push 0x10149320
push 0x101494b0
push edi
call fcn.10010200
add esp, 0xc
test al, al
je 0x1003a9f6
push edi
mov esi, 0x1014b960
push esi
call fcn.10007480
pop ecx
pop ecx
test eax, eax
je 0x1003aa09
mov eax, dword [0x101434ac]
cmp eax, 0x68
je 0x1003a8ed
cmp eax, 2
jne 0x1003a85b
push edi
push esi
push str.CSendMonitorDDX::isMyIP_g_tc_ExceptIP_:__s__strAddr_:__s
jmp 0x1003a9e8
mov edi, dword [esp + 0x14]
cmp edi, ebx
je 0x1003aa09
cmp byte [0x10145710], bl
je 0x1003a922
push 0x10145710
push edi
call fcn.100073d3
pop ecx
pop ecx
test eax, eax
je 0x1003a85b
push 8
push str.169.254.
push edi
call fcn.10007429
add esp, 0xc
test eax, eax
jne 0x1003a945
mov dword [0x100724a8], 0x1f2e3d4c
jmp 0x1003a85b
push str.127.0.0.1
push edi
call fcn.100073d3
pop ecx
pop ecx
test eax, eax
je 0x1003a85b
push str.0.0.0.0
push edi
call fcn.100073d3
pop ecx
pop ecx
test eax, eax
je 0x1003a85b
push str.1.1.1.1
push edi
call fcn.100073d3
pop ecx
pop ecx
test eax, eax
je 0x1003a85b
push str.255.255.255.255
push edi
call fcn.100073d3
pop ecx
pop ecx
test eax, eax
je 0x1003a85b
cmp byte [0x1014b960], bl
je 0x1003a9f6
cmp byte [edi], bl
je 0x1003aa09
push edi
mov esi, 0x1014b960
push esi
call fcn.10007480
pop ecx
pop ecx
test eax, eax
jne 0x1003a9ce
push 0x10149320
push 0x101494b0
push edi
call fcn.10010200
add esp, 0xc
test al, al
je 0x1003a9f6
mov eax, dword [0x101434ac]
cmp eax, 0x68
je 0x1003a9e1
cmp eax, 2
jne 0x1003a85b
push edi
push esi
push str.CSendMonitorDDX::isMyIP2_g_tc_ExceptIP_:__s__addr_:__s
push ebx
call fcn.1003dfed
add esp, 0x10
jmp 0x1003a85b
cmp byte [edi], bl
je 0x1003aa09
push edi
call fcn.10010a2d
pop ecx
test al, al
jne 0x1003a85b
xor al, al
pop edi
pop esi
pop ebx
ret 8
Function at 0x1003aa69
Capabilities:
Get mac address on windows

Disassembly:
push ebp
lea ebp, [esp - 0x280c]
mov eax, 0x288c
call fcn.10040c40
mov eax, dword [0x10074bac]
xor eax, ebp
mov dword [ebp + 0x2808], eax
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
mov dword [ebp - 0x80], 0x2880
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
je 0x1003aaa4
xor al, al
jmp 0x1003ab1f
and dword [ebp - 0x7c], 0
push ebx
push esi
lea eax, [ebp - 0x78]
push edi
mov dl, byte [eax + 0x195]
lea esi, [eax + 0x194]
mov cl, byte [esi]
mov bl, cl
and bl, dl
and bl, byte [eax + 0x196]
mov dl, byte [eax + 0x199]
and bl, byte [eax + 0x197]
and bl, byte [eax + 0x198]
and bl, dl
cmp bl, 0xff
je 0x1003ab0b
or cl, byte [eax + 0x195]
or cl, byte [eax + 0x196]
or cl, byte [eax + 0x197]
or cl, byte [eax + 0x198]
or cl, dl
je 0x1003ab0b
mov edi, dword [ebp + 0x2814]
push 3
pop ecx
xor edx, edx
repe cmpsw word [esi], word es:[edi]
je 0x1003ab34
cmp dword [ebp - 0x7c], 0x10
mov eax, dword [eax]
jg 0x1003ab1a
inc dword [ebp - 0x7c]
test eax, eax
jne 0x1003aaae
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x2808]
xor ecx, ebp
call fcn.1004083f
add ebp, 0x280c
leave
ret
mov al, 1
jmp 0x1003ab1c
Function at 0x1003c5ad
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
push edi
push 0xdc
mov byte [0x102bc548], 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [sym.imp.ole32.dll_CoUninitialize]
xor ebx, ebx
cmp dword [0x10141c00], ebx
je 0x1003c640
cmp dword [0x101434ac], ebx
je 0x1003c5e7
push str.End_Real_AccessibleObjectFromEvent
push ebx
call fcn.1003dfed
pop ecx
pop ecx
mov eax, dword [0x101400f0]
cmp eax, ebx
je 0x1003c5f7
push eax
call dword [sym.imp.USER32.dll_UnhookWinEvent]
call edi
mov eax, dword [0x1013f2c8]
cmp eax, ebx
je 0x1003c61d
test dword [0x10144688], 0x40000000
push eax
je 0x1003c617
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x1003c61d
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x64
push dword [0x1013f2cc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [0x101434ac], ebx
je 0x1003c640
push str.End_WaitForSingleObject
push ebx
call fcn.1003dfed
pop ecx
pop ecx
mov eax, dword [0x10141c1c]
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp eax, ebx
je 0x1003c652
push eax
call esi
mov eax, dword [0x102c6564]
cmp eax, ebx
je 0x1003c65e
push eax
call esi
mov eax, dword [0x1016e8e8]
cmp eax, ebx
je 0x1003c66a
push eax
call esi
mov eax, dword [0x1016e8e4]
cmp eax, ebx
je 0x1003c676
push eax
call esi
test byte [0x102bc54c], 1
je 0x1003c69d
mov eax, dword [0x10072ce4]
cmp eax, ebx
mov esi, dword [sym.imp.KERNEL32.dll_TlsFree]
jl 0x1003c691
push eax
call esi
mov eax, dword [0x10072ce8]
cmp eax, ebx
jl 0x1003c69d
push eax
call esi
cmp byte [0x101400f4], bl
je 0x1003c6a7
call edi
mov eax, dword [0x10092cc0]
mov esi, dword [sym.imp.KERNEL32.dll_TerminateThread]
cmp eax, ebx
je 0x1003c6ba
push ebx
push eax
call esi
mov eax, dword [0x1013eea0]
cmp eax, ebx
je 0x1003c6c7
push ebx
push eax
call esi
mov eax, dword [0x1013eeac]
cmp eax, ebx
je 0x1003c6d4
push ebx
push eax
call esi
mov eax, dword [0x1013eea8]
cmp eax, ebx
je 0x1003c6e1
push ebx
push eax
call esi
mov eax, dword [0x10092cc4]
cmp eax, ebx
je 0x1003c6ee
push ebx
push eax
call esi
mov eax, dword [0x10092cc8]
cmp eax, ebx
je 0x1003c6fb
push ebx
push eax
call esi
mov eax, dword [0x10092ccc]
cmp eax, ebx
je 0x1003c708
push ebx
push eax
call esi
mov eax, dword [0x10092cd0]
cmp eax, ebx
je 0x1003c715
push ebx
push eax
call esi
mov eax, dword [0x10092cd4]
cmp eax, ebx
je 0x1003c722
push ebx
push eax
call esi
pop edi
pop esi
pop ebx
ret
Function at 0x1003c726
Capabilities:
Create directory

Disassembly:
push ebp
sub esp, 0x400
lea ebp, [esp - 4]
mov eax, dword [0x10074bac]
xor eax, ebp
mov dword [ebp + 0x400], eax
push 0x114
mov eax, 0x1005ab36
call fcn.10042ae2
mov ebx, dword [ebp + 0x40c]
mov esi, 0x1ff
push esi
xor edi, edi
lea eax, [ebp + 0x201]
push edi
push eax
mov byte [ebp + 0x200], 0
call fcn.10040850
push esi
lea eax, [ebp + 1]
push edi
push eax
mov byte [ebp], 0
call fcn.10040850
push 0x10142048
lea eax, [ebp + 0x200]
push str._sLogDump
push eax
call fcn.10040b98
lea eax, [ebp + 0x200]
push edi
push eax
call fcn.10043bc5
add esp, 0x2c
test eax, eax
je 0x1003c7b6
push edi
lea eax, [ebp + 0x200]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0x10142848
lea eax, [ebp]
push str._s.dmp
push eax
call fcn.10040b98
lea eax, [ebp]
add esp, 0xc
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1003c7d1
lea edi, [ebp + 0x200]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1003c7e1
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push str.DBGHELP.DLL
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.MiniDumpWriteDump
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
xor esi, esi
cmp edi, esi
jne 0x1003c81d
xor eax, eax
jmp 0x1003c8b8
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x120], eax
push 3
lea eax, [ebp + 0x200]
push eax
lea ecx, [ebp - 0x120]
call fcn.1000c23e
push esi
push 0x80
push 2
push esi
push 3
push 0x40000000
push dword [ebp - 0x120]
mov dword [ebp - 4], esi
call dword [0x101a7f1c]
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x11c]
cmp dword [ebp - 0x120], eax
je 0x1003c87d
push dword [ebp - 0x120]
call fcn.100425b3
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x18], ebx
push esi
neg ebx
mov dword [ebp - 0x1c], eax
push esi
sbb ebx, ebx
lea eax, [ebp - 0x1c]
and ebx, eax
push ebx
push esi
push dword [ebp - 0x10]
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x400]
xor ecx, ebp
call fcn.1004083f
add ebp, 0x404
leave
ret
Function at 0x1003d5c8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
mov eax, ebx
push esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1003d5d8
sub eax, edx
xor esi, esi
cmp eax, esi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], esi
jle 0x1003d650
push edi
xor eax, eax
lea edi, [ebp - 7]
stosw word es:[edi], ax
mov al, byte [esi + ebx]
mov byte [ebp - 8], al
inc esi
mov al, byte [esi + ebx]
mov byte [ebp - 7], al
lea eax, [ebp - 1]
push eax
lea eax, [ebp - 8]
push eax
inc esi
mov byte [ebp - 6], 0
call fcn.1003d51b
mov eax, dword [ebp - 0xc]
push 0xa
cdq
pop ecx
idiv ecx
mov al, byte [ebp - 1]
mov byte [ebp - 7], 0
xor al, byte [edx + str._8N8Oe]
inc dword [ebp - 0xc]
mov byte [ebp - 1], al
mov byte [ebp - 8], al
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
push 0x1005eaf4
push dword [ebp + 0xc]
call fcn.10040b98
add esp, 0x18
cmp esi, dword [ebp - 0x10]
jl 0x1003d5ee
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1003d897
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
push 4
pop eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [ebp + 0x14]
push eax
push ebx
push dword [ebp + 8]
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x1003d8ca
mov eax, esi
jmp 0x1003d99a
push edi
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push edi
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp + 0x14]
test eax, eax
je 0x1003d8fa
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x1003d999
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.tc_ssl
push edi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
je 0x1003d996
cmp byte [0x10144f0d], 0
je 0x1003d996
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push str.tc_Env_tc_CLIENT
push ebx
call esi
test eax, eax
jne 0x1003d948
push str.tc_Env_tc_COMMUNICATION
push ebx
call esi
test eax, eax
jne 0x1003d948
push str.TC_INSTALL
push ebx
call esi
test eax, eax
je 0x1003d996
mov eax, edi
xor bl, bl
xor esi, esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1003d951
sub eax, ecx
je 0x1003d97c
movsx eax, byte [esi + edi]
push eax
call fcn.10043cf3
add bl, al
mov eax, edi
pop ecx
inc esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1003d96f
sub eax, ecx
cmp esi, eax
jb 0x1003d95c
movsx ecx, bl
and ecx, 0x8000001f
jns 0x1003d98c
dec ecx
or ecx, 0xffffffe0
inc ecx
mov eax, dword [ebp - 4]
and ecx, 0x1f
rol eax, cl
jmp 0x1003d999
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1003eab9
Capabilities:
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x31ac
call fcn.10040c40
mov eax, dword [0x10074bac]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x31a8], edi
cmp dword [0x101434ac], ebx
je 0x1003eaf9
push esi
push edi
push str.in_Send8Str__s___s_
push ebx
call fcn.1003dfed
add esp, 0x10
cmp byte [0x10144ec3], bl
jne 0x1003eb09
cmp byte [0x102bc549], bl
je 0x1003eb10
push esi
call fcn.1003e87f
pop ecx
lea eax, [ebp - 0x31a4]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x1003eb35
push esi
push str.WSAStartup_err___s_
push ebx
call fcn.1003dfed
add esp, 0xc
push edi
call fcn.1000737c
mov dword [esp], 0x2dff
lea eax, [ebp - 0x3003]
push ebx
push eax
mov byte [ebp - 0x3004], bl
call fcn.10040850
push esi
lea eax, [ebp - 0x3004]
push 0x1005d458
push eax
call fcn.10040b98
add esp, 0x18
push 0x11
push 2
push 2
mov byte [ebp - 0x205], bl
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 0x31ac], eax
cmp eax, 0xffffffff
jne 0x1003eb9b
push esi
push str.socket_err___s_
push ebx
call fcn.1003dfed
add esp, 0xc
jmp 0x1003ec47
push 0x10
lea eax, [ebp - 0x3014]
push ebx
push eax
call fcn.10007496
add esp, 0xc
push 2
pop eax
push 0x1f99
mov word [ebp - 0x3014], ax
call dword [sym.imp.WS2_32.dll_htons]
push str.127.0.0.1
mov word [ebp - 0x3012], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x3010], eax
mov eax, esi
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1003ebdf
push 0x10
lea ecx, [ebp - 0x3014]
push ecx
sub eax, edi
push ebx
inc eax
push eax
push esi
push dword [ebp - 0x31ac]
call dword [0x1019fd74]
cmp eax, 0xffffffff
jne 0x1003ec2a
lea eax, [ebp - 0x204]
push eax
call fcn.1003d46b
push esi
lea eax, [ebp - 0x204]
push eax
push str.sendto_err_:__s___s_
push ebx
call fcn.1003dfed
add esp, 0x14
jmp 0x1003ec47
cmp dword [0x101434ac], ebx
je 0x1003ec47
push esi
push dword [ebp - 0x31a8]
push str.in_Send8Str_OK_send__s___s_
push ebx
call fcn.1003dfed
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004083f
leave
ret
Function at 0x1004083f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10074bac]
jne 0x10040849
repz ret
jmp fcn.100440a8

Function at 0x10043b3c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x10043b6d
call fcn.1004595c
mov dword [eax], esi
call fcn.10045949
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.100458e1
add esp, 0x14
push 0x16
pop eax
jmp 0x10043bc2
test dword [ebp + 0xc], 0xfffffff9
jne 0x10043b49
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x10043b9a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.1004596f
pop ecx
call fcn.10045949
mov eax, dword [eax]
jmp 0x10043bc2
test al, 0x10
jne 0x10043bc0
test al, 1
je 0x10043bc0
test byte [ebp + 0xc], 2
je 0x10043bc0
call fcn.1004595c
mov dword [eax], 5
call fcn.10045949
mov dword [eax], 0xd
jmp 0x10043b91
xor eax, eax
pop esi
pop ebp
ret

Function at 0x1005097f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10044dcd
and dword [ebp - 4], 0
cmp dword [0x102c7090], 0
mov ebx, eax
jne 0x10050a30
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10050ae1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1006ed64
push edi
call esi
test eax, eax
je 0x10050ae1
push eax
call fcn.10044d5b
mov dword [esp], 0x1006ed54
push edi
mov dword [0x102c7090], eax
call esi
push eax
call fcn.10044d5b
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x102c7094], eax
call esi
push eax
call fcn.10044d5b
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x102c7098], eax
call esi
push eax
call fcn.10044d5b
pop ecx
mov dword [0x102c70a0], eax
test eax, eax
je 0x10050a30
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10044d5b
pop ecx
mov dword [0x102c709c], eax
mov eax, dword [0x102c709c]
cmp eax, ebx
je 0x10050a88
cmp dword [0x102c70a0], ebx
je 0x10050a88
push eax
call fcn.10044dd6
push dword [0x102c70a0]
mov esi, eax
call fcn.10044dd6
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10050a88
test edi, edi
je 0x10050a88
call esi
test eax, eax
je 0x10050a7f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x10050a7f
test byte [ebp - 0xc], 1
jne 0x10050a88
or dword [ebp + 0x10], 0x200000
jmp 0x10050ac1
mov eax, dword [0x102c7094]
cmp eax, ebx
je 0x10050ac1
push eax
call fcn.10044dd6
pop ecx
test eax, eax
je 0x10050ac1
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x10050ac1
mov eax, dword [0x102c7098]
cmp eax, ebx
je 0x10050ac1
push eax
call fcn.10044dd6
pop ecx
test eax, eax
je 0x10050ac1
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x102c7090]
call fcn.10044dd6
pop ecx
test eax, eax
je 0x10050ae1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10050ae3
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10054340
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x10074bac]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1005436a
push 0x57
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x1005441e
push 0x1c
push 0
lea ecx, [ebp - 0x64]
push ecx
call fcn.10040850
add esp, 0xc
push 0x1c
lea edx, [ebp - 0x64]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.dll_VirtualQueryEx
test eax, eax
jne 0x10054398
xor eax, eax
jmp 0x1005441e
push 0
push 0x40
lea edx, [ebp - 0x48]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.dll_ReadProcessMemory
test eax, eax
jne 0x100543b5
xor eax, eax
jmp 0x1005441e
movzx edx, word [ebp - 0x48]
cmp edx, 0x5a4d
jne 0x100543cf
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x58]
ja 0x100543cf
cmp dword [ebp - 0xc], 0x40
jae 0x100543dd
push 0xc1
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x1005441e
push 0
push 0xf8
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_ReadProcessMemory
test eax, eax
jne 0x10054400
xor eax, eax
jmp 0x1005441e
mov ecx, dword [ebp + 0x10]
cmp dword [ecx], 0x4550
je 0x10054419
push 0xc1
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x1005441e
mov eax, 1
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1004083f
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100556d0
Capabilities:
Query environment variable
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x284
mov eax, dword [0x10074bac]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x234], 0
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0x1006edf4
call sub.KERNEL32.dll_GetEnvironmentVariableA
mov dword [ebp - 0x21c], eax
cmp dword [ebp + 0xc], 1
jb 0x10055722
cmp dword [ebp + 0xc], 0x1000
jbe 0x10055733
push 0x57
call sub.KERNEL32.dll_SetLastError
jmp 0x100558fb
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x234]
push ecx
call fcn.10055a70
test eax, eax
jne 0x10055759
jmp 0x100558fb
cmp dword [ebp - 0x21c], 0
je 0x1005576e
cmp dword [ebp - 0x21c], 0x104
jb 0x10055778
jmp 0x100558fb
push 0x1006edfc
push 0x104
lea edx, [ebp - 0x218]
push edx
call fcn.10055920
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0
jge 0x100557a7
jmp 0x100558fb
mov eax, dword [ebp - 0x234]
add eax, 0xc
push eax
push 0x1006ee14
push 0x104
lea ecx, [ebp - 0x110]
push ecx
call fcn.10055970
add esp, 0x10
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0
jge 0x100557e3
jmp 0x100558fb
push 0x10
push 0
lea edx, [ebp - 0x230]
push edx
call fcn.10040850
add esp, 0xc
push 0x44
push 0
lea eax, [ebp - 0x280]
push eax
call fcn.10040850
add esp, 0xc
mov dword [ebp - 0x280], 0x44
lea ecx, [ebp - 0x230]
push ecx
lea edx, [ebp - 0x280]
push edx
push 0
push 0
push 4
push 0
push 0
push 0
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x218]
push ecx
call dword [ebp + 0x14]
test eax, eax
je 0x100558fb
mov edx, dword [ebp - 0x234]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 0x234]
push ecx
push 0x1006edac
mov edx, dword [ebp - 0x230]
push edx
call fcn.10055270
test eax, eax
jne 0x10055895
push 0xffffffffffffffff
mov eax, dword [ebp - 0x230]
push eax
call sub.KERNEL32.dll_TerminateProcess
mov ecx, dword [ebp - 0x230]
push ecx
call sub.KERNEL32.dll_CloseHandle
mov edx, dword [ebp - 0x22c]
push edx
call sub.KERNEL32.dll_CloseHandle
jmp 0x100558fb
mov eax, dword [ebp - 0x22c]
push eax
call sub.KERNEL32.dll_ResumeThread
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x230]
push ecx
call sub.KERNEL32.dll_WaitForSingleObject
mov dword [ebp - 0x284], 0x1f4
lea edx, [ebp - 0x284]
push edx
mov eax, dword [ebp - 0x230]
push eax
call sub.KERNEL32.dll_GetExitCodeProcess
mov ecx, dword [ebp - 0x230]
push ecx
call sub.KERNEL32.dll_CloseHandle
mov edx, dword [ebp - 0x22c]
push edx
call sub.KERNEL32.dll_CloseHandle
cmp dword [ebp - 0x284], 0
je 0x100558f1
jmp 0x100558fb
mov dword [ebp - 0x220], 1
lea eax, [ebp - 0x234]
push eax
call fcn.10055cf0
mov eax, dword [ebp - 0x220]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004083f
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10055d40
Capabilities:
Query environment variable
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68c
mov eax, dword [0x10074bac]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x420], 0
mov dword [ebp - 0x63c], 0
push 0x104
lea eax, [ebp - 0x418]
push eax
push str.WINDIR
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov dword [ebp - 0x41c], eax
cmp dword [ebp + 0xc], 1
jb 0x10055d92
cmp dword [ebp + 0xc], 0x1000
jbe 0x10055da3
push 0x57
call sub.KERNEL32.dll_SetLastError
jmp 0x10055fa5
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x63c]
push ecx
call fcn.10055a70
test eax, eax
jne 0x10055dc9
jmp 0x10055fa5
cmp dword [ebp - 0x41c], 0
je 0x10055dde
cmp dword [ebp - 0x41c], 0x104
jb 0x10055de8
jmp 0x10055fa5
push str._sysnative_rundll32.exe
push 0x104
lea edx, [ebp - 0x418]
push edx
call fcn.10055fd0
mov dword [ebp - 0x640], eax
cmp dword [ebp - 0x640], 0
jge 0x10055e17
jmp 0x10055fa5
push 0x104
lea eax, [ebp - 0x628]
push eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x63c]
add ecx, 0xc
push ecx
push 0
push 0
call sub.KERNEL32.dll_MultiByteToWideChar
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x104
jae 0x10055e4a
cmp dword [ebp - 4], 0
jg 0x10055e54
jmp 0x10055fa5
lea edx, [ebp - 0x628]
push edx
push str.rundll32.exe___s__1
push 0x104
lea eax, [ebp - 0x210]
push eax
call fcn.10056030
add esp, 0x10
mov dword [ebp - 0x640], eax
cmp dword [ebp - 0x640], 0
jge 0x10055e8d
jmp 0x10055fa5
push 0x10
push 0
lea ecx, [ebp - 0x638]
push ecx
call fcn.10040850
add esp, 0xc
push 0x44
push 0
lea edx, [ebp - 0x688]
push edx
call fcn.10040850
add esp, 0xc
mov dword [ebp - 0x688], 0x44
lea eax, [ebp - 0x638]
push eax
lea ecx, [ebp - 0x688]
push ecx
push 0
push 0
push 4
push 0
push 0
push 0
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x418]
push eax
call dword [ebp + 0x14]
test eax, eax
je 0x10055fa5
mov ecx, dword [ebp - 0x63c]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp - 0x63c]
push eax
push 0x1006edac
mov ecx, dword [ebp - 0x638]
push ecx
call fcn.10055270
test eax, eax
jne 0x10055f3f
push 0xffffffffffffffff
mov edx, dword [ebp - 0x638]
push edx
call sub.KERNEL32.dll_TerminateProcess
mov eax, dword [ebp - 0x638]
push eax
call sub.KERNEL32.dll_CloseHandle
mov ecx, dword [ebp - 0x634]
push ecx
call sub.KERNEL32.dll_CloseHandle
jmp 0x10055fa5
mov edx, dword [ebp - 0x634]
push edx
call sub.KERNEL32.dll_ResumeThread
push 0xffffffffffffffff
mov eax, dword [ebp - 0x638]
push eax
call sub.KERNEL32.dll_WaitForSingleObject
mov dword [ebp - 0x68c], 0x1f4
lea ecx, [ebp - 0x68c]
push ecx
mov edx, dword [ebp - 0x638]
push edx
call sub.KERNEL32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x638]
push eax
call sub.KERNEL32.dll_CloseHandle
mov ecx, dword [ebp - 0x634]
push ecx
call sub.KERNEL32.dll_CloseHandle
cmp dword [ebp - 0x68c], 0
je 0x10055f9b
jmp 0x10055fa5
mov dword [ebp - 0x420], 1
lea edx, [ebp - 0x63c]
push edx
call fcn.10055cf0
mov eax, dword [ebp - 0x420]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1004083f
mov esp, ebp
pop ebp
ret 0x10