joyce8/EMBER2024-capa huggingface dataset:
Function at 0x82f7b6
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 0xf], sp
jmp 0x82fa3d
xchg edx, eax
rcl ecx, 0x11
bsr ax, bp
and dx, 0x542
pop ax
xchg dword [esp + 3], eax
jmp 0x82f8b9
xchg edx, eax
btr eax, edx
add esp, 0x19
mov dl, dh
push edx
xchg cx, ax
jmp 0x82f80a
pop ecx
bswap eax
lea edx, [ecx - 0xab]
lea ecx, [edi*4]
mov cl, 0xca
mov al, ah
jmp 0x82f89d
bswap edx
push esp
lea eax, [edi + ebp]
mov byte [esp + 9], dh
mov dx, 0xa9b3
setbe ch
jmp 0x82f83f
setae ch
xchg dx, ax
xchg byte [esp + 2], dl
mov ch, 0x90
push word [esp + 1]
sub dx, 0x3f6e
jmp 0x82f865
mov dword [esp], ecx
setle ah
mov dword [esp], eax
rdtsc
lea edx, [esi*4]
inc eax
jmp 0x82f904
neg ecx
add esp, 1
sub dx, 0x6fa8
lea ecx, [esp + ecx]
lea ecx, [ebp*4]
pop eax
jmp 0x82f885
push edx
mov dx, 0x1269
mov cl, byte [esp]
mov dl, dh
mov ch, 0x18
mov eax, dword [esp + 0xa]
jmp 0x82f9f4
mov dword [esp], ebp
sub eax, ebp
mov cl, 0x2a
neg dh
xchg ah, ch
lea eax, [esi*4]
jmp 0x82f8d0
pop cx
mov byte [esp + 3], ah
inc dx
lea ecx, [eax + edx]
push word [esp + 2]
mov ecx, dword [esp + 5]
jmp 0x82f8e7
inc dl
seto cl
btc eax, esp
mov ah, byte [esp + 0x1b]
lea eax, [ecx + edi]
cmc
jmp 0x82f82f
lea ecx, [esi*4]
mov edx, eax
setge ch
call fcn.0082f962
btr eax, esp
neg cx
push word [esp + 0x1d]
lea edx, reloc.RASAPI32.dll_RasHangUpA
xchg dx, ax
inc dl
jmp 0x82f9ce
xchg word [esp + 0x1b], ax
push word [esp + 0x31]
bsf dx, ax
xchg cx, dx
neg cl
mov al, 0x2e
jmp 0x82fa25
push dword [esp + 7]
pushal
xchg dh, al
xchg dword [esp + 7], eax
sub esp, 0x14
lea esp, [esp + 0x43]
jmp 0x82f97d
rdtsc
sub esp, 4
push esp
sub ch, ah
mov dword [esp + 3], esi
lea esp, [esp + 0x37]
jmp 0x82fa92
pop eax
xchg dword [esp + 9], ecx
lea ecx, [esi*4]
mov cx, word [esp + 0x2c]
jmp 0x82fa0b
xchg word [esp + 0xa], ax
bswap edx
rdtsc
clc
mov cx, ax
bswap eax
jmp 0x82f922
mov cx, word [esp + 0x17]
push dword [esp + 0x1c]
xchg cl, ch
setg dh
lea edx, [ebx*4]
call fcn.0082fb7c
dec esi
fisttp dword [ebx + 0x2e]
fnsave dword [edx - 0x42]
mov ecx, 0x5df36b74
lea eax, [ebp - 0x8f]
pop dword [esp + 0xc]
mov byte [esp + 0xf], ah
push word [esp + 0x18]
jmp 0x82fa51
xchg byte [esp], ch
sub esp, 0x1a
push word [esp + 1]
xchg dx, ax
cmc
jmp 0x82fa72

Function at 0x82f962
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp], bx
mov edx, dword [esp + 1]
pop dx
setns ch
xchg cl, ch
pop dx
jmp 0x82f9b9
rdtsc
pushal
sub ch, ah
push esp
push word [esp + 0x15]
xchg dword [esp + 0x18], eax
jmp 0x82f98e
mov eax, 0x364cb282
not cx
mov dx, 0x9c0d
jmp 0x82f937
inc ecx
mov cx, 0xe8fb
dec dx
mov ecx, ebp
sub esp, 0x14
pop dword [esp + 0xa]
jmp 0x82f94a
Function at 0x82fb7c
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg cl
pop cx
bswap eax
rdtsc
and edx, ecx
sub esp, 0xe
jmp 0x82fb1e
lea edx, [esi*4]
mov ax, sp
pop eax
lea esp, [esp + 0x12]
mov word [esp + 0x10], di
mov al, 0xee
jmp 0x82fab7
xchg byte [esp + 2], ch
adc eax, ecx
xchg dh, al
neg ax
push dword [esp + 0x1c]
jmp 0x82fb55
mov byte [esp + 0x11], bh
mov cl, 0x62
mov word [esp + 0xd], dx
xchg ecx, eax
or edx, eax
mov dx, 0x1a4f
jmp 0x82fae9
mov eax, 0xdea9d4f8
mov word [esp + 7], dx
pop cx
mov eax, edx
and edx, esi
mov dx, ax
jmp 0x82fb00
lea ecx, [ebp + 0x8f]
mov dword [esp + 0xf], ebp
mov edx, eax
lea ecx, [esi + 0x65]
pop eax
inc al
jmp 0x82fbd4
pop dword [esp + 9]
pop word [esp + 0x13]
xchg cx, ax
lea esp, [esp + 8]
push word [esp + 5]
mov ax, word [esp]
jmp 0x82fb33
xchg ecx, eax
jmp 0x82fad1
push word [esp + 3]
push dword [esp + 5]
lea eax, [eax + edi]
ror ecx, 9
jmp 0x82fbee
not ch
mov cx, 0x6875
mov dx, word [esp + 2]
xchg dword [esp], edx
rcr ch, 5
jmp 0x82fb82
cmc
pop ecx
lea esp, [esp + 2]
xchg dword [esp], ecx
xchg byte [esp + 4], cl
dec cx
jmp 0x82fb9a
rdtsc
push word [esp + 0xb]
mov ax, 0x121d
mov dword [esp + 3], ebp
xor dx, 0xe4ea
pop dword [esp + 3]
jmp 0x82fbb1
mov edx, dword [esp + 4]
pop word [esp + 7]
not ax
sub esp, 0x1c
pop dword [esp + 1]
push dword [esp + 0x1e]
jmp 0x82fe9e
not eax
mov dx, word [esp + 0xd]
mov eax, edi
call fcn.0082fc9b
xchg ecx, eax
lea esp, [esp + 0x17]
mov byte [esp + 0xf], ch
mov al, ah
clc
pop ax
jmp 0x82fd78
xchg byte [esp + 7], dl
sub esp, 0x1c
xchg word [esp + 8], dx
stc
dec ax
add esp, 0x17
jmp 0x82fdb3
neg cx
mov dword [esp + 3], eax
mov ax, cx
push esp
mov word [esp + 2], bx
mov cx, di
jmp 0x82fd47
mov ch, bh
pop cx
lea esp, [esp + 9]
mov edx, dword [esp]
rdtsc
add esp, 0xd
jmp 0x82fd5f
mov edx, ecx
not cl
sub esp, 4
shr ah, 1
call fcn.0082fd8a
rcl dword [edi - 0x39], 0xa2
push ecx
clc
pop ecx
enter 0x395e, 0xffffffffffffffc8
cmp ebp, esp
adc al, 0x87
xor eax, ebp
xor eax, ebp
rdtsc
setnp cl
mov dword [esp + 0x17], ebp
mov ch, bh
mov dl, 0x9c
jmp 0x82fcd1
mov byte [esp + 0x1d], bh
add esp, 0
bsr dx, bp
pop ecx
mov byte [esp + 0x1b], ch
bsf ax, ax
jmp 0x82fdd1
Function at 0x82ff8d
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap ecx
mov dh, byte [esp + 0x27]
add esp, 0xf
mov word [esp + 0xa], bx
mov dx, bx
mov edx, dword [esp + 0x1d]
jmp 0x82ff77
not eax
setg ah
mov cl, byte [esp + 0x23]
mov dh, byte [esp + 0x17]
mov dword [esp + 0x3b], eax
mov cl, ch
jmp 0x82ff42
mov dl, 0x8c
mov cx, 0xeaa5
push dword [esp + 0x1f]
cmc
mov byte [esp + 0x27], ch
jmp 0x830034
sub esp, 0x16
xchg byte [esp + 0x1d], cl
lea edx, reloc.RASAPI32.dll_RasHangUpA
jmp 0x82ff62
add esp, 0
mov ch, 0x20
bswap ecx
mov ch, byte [esp]
mov al, 6
setne cl
jmp 0x82ffcb
cld
ror ecx, 5
xchg dx, ax
dec dx
xchg cx, ax
pop ecx
jmp 0x82ff9c
bt ecx, ebx
pushal
pop word [esp + 5]
bts edx, ebx
push dword [esp + 0x18]
mov edx, 0x927160ae
jmp 0x83001c
add esp, 0x25
mov edx, 0x47af4ecc
lea esp, [esp + 1]
mov dx, 0x19a1
lea ecx, [eax*4]
add esp, 0
jmp 0x82ffbe
mov edx, 0x6909256
mov ecx, edx
mov al, byte [esp]
rdtsc
mov cl, ch
xchg ecx, edx
jmp 0x83008d
lea eax, [esi - 0x4d]
neg dh
pushal
lea esp, [esp + 0x43]
add edx, ebp
mov dx, 0x4ed
jmp 0x830004
mov ecx, dword [esp + 0x2d]
add esp, 8
mov edx, dword [esp + 0x2b]
mov dword [esp + 2], eax
pop word [esp + 0xd]
or cx, 0x1196
jmp 0x82ffe8
push word [esp + 2]
neg edx
rdtsc
xchg byte [esp + 2], dl
mov ch, 0x38
lea ecx, [ebx*4]
jmp 0x8300c7
mov dl, 0x84
push word [esp + 2]
mov ax, 0xae5
dec ax
mov cl, ch
pop dx
jmp 0x83004f
sub esp, 4
lea esp, [esp + 1]
rdtsc
neg dx
shl cx, cl
xchg ah, ch
jmp 0x830073
lea edx, [eax*4]
mov al, ah
mov byte [esp + 0x17], ch
mov ecx, dword [esp + 0x14]
pop word [esp + 0x14]
mov ecx, dword [esp + 0xb]
jmp 0x8300d8
pushal
inc ecx
dec edx
lea ecx, [ecx*4]
xchg ecx, eax
bsf ax, ax
jmp 0x8300a0
mov ch, 0x40
lea esp, [esp + 1]
pushal
lea esp, [esp + 0x42]
xchg ecx, eax
sub esp, 0x14
jmp 0x83027d
lea eax, [esi + 0xed]
mov byte [esp + 3], bh
add esp, 9
push word [esp + 6]
call fcn.008301bb
lea eax, [eax + 0xb9]
rdtsc
setne ch
xchg dword [esp + 2], ecx
dec edx
bsr ax, bp
jmp 0x8301e9
Function at 0x8304bf
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp + 0x1f]
mov ecx, esi
clc
jmp 0x830501
mov dword [esp + 0x10], eax
mov ah, byte [esp + 0x11]
lea esp, [esp + 0x23]
lea esp, [esp + 0x11]
mov word [esp + 1], dx
jmp 0x83052e
mov byte [esp + 3], ch
add esp, 0
xchg dword [esp], ecx
mov ch, byte [esp + 3]
setae dh
jmp 0x83055a
mov dword [esp], ecx
mov ch, 0xe8
mov cx, word [esp + 2]
mov ecx, dword [esp + 4]
lea edx, [ebx + esi]
jmp 0x830a8e
lea esp, [esp + 3]
sub esp, 0x1e
xchg word [esp + 2], cx
bswap ecx
mov cl, 0x52
neg dh
jmp 0x830837
lea edx, [edi*4]
pushal
lea edx, [eax*4]
jmp 0x830598
mov ecx, edi
mov dx, bp
mov ax, word [esp + 6]
lea esp, [esp + 7]
jmp 0x8305ba
push word [esp + 7]
mov dx, si
xchg dword [esp + 4], edx
xchg edx, eax
mov eax, dword [esp + 5]
rdtsc
jmp 0x8305d2
mov word [esp + 4], sp
mov dword [esp + 9], ebp
mov dword [esp + 0x1c], eax
pushal
mov byte [esp + 0xc], ah
jmp 0x83069f
lea esp, [esp + 4]
pushal
mov word [esp + 0x1a], bx
mov dword [esp + 0xf], eax
jmp 0x830601
mov dword [esp + 1], eax
lea esp, [esp + 3]
mov dword [esp + 0x24], ecx
call fcn.0083064a
mov ebp, 0x35c6a333
xchg esp, eax
mov dh, 0xa1
loopne 0x8306c1
pop edx
mov word [esp + 4], sp
lea esp, [esp + 0x15]
mov word [esp + 6], dx
mov dword [esp + 2], eax
push edx
mov dword [esp + 8], esi
jmp 0x830683
pop esp
and al, 0x24
call fcn.00830710
cmpsb byte [esi], byte es:[edi]
xor eax, 0xcc3fcca5
mov al, 0x26
mov ah, 0xd3
wait
ret 0xcb5b
bswap eax
xchg al, ah
bswap eax
mov eax, dword [esp + 0x7d]
lea esp, [esp + 0xa8]
popfd
jmp 0x83061d
btr eax, edx
mov dl, byte [esp]
mov edx, dword [esp + 0x65]
cld
xchg ah, al
add eax, esi
jmp 0x8306dc
pop word [esp + 0xf]
neg cl
mov ecx, dword [esp + 0x49]
mov dx, word [esp]
mov al, 0x4e
setl dh
jmp 0x83073b
mov dx, bx
lea ecx, [ebp*4]
mov dword [esp + 1], ebp
rdtsc
adc cx, 0xc86c
mov dword [esp + 1], ecx
jmp 0x8305ec
lea esp, [esp + 1]
bsf ax, ax
xchg ecx, eax
mov edx, 0x4252a14c
push word [esp + 5]
xchg byte [esp + 3], cl
jmp 0x83094a

Function at 0x8306f5
Capabilities:
Parse pe header

Disassembly:
lea esp, [esp + 1]
jmp 0x8307f9
mov dword [esp + 0x38], esp
call fcn.00830787

Function at 0x830710
Capabilities:
Parse pe header

Disassembly:
call fcn.008306f3
pushal
mov byte [esp + 9], bh
pop word [esp + 0xd]
lea esp, [esp + 0x13]
push word [esp + 0x10]
call fcn.008306f5
imul esi, ecx, 0x4ef30061
imul esi, edx, 0x5bf20760
jae 0x8307a5
xor bl, al
and eax, ebx

Function at 0x830787
Capabilities:
Parse pe header

Disassembly:
push word [esp + 3]
call fcn.0083076c

Function at 0x8307a9
Capabilities:
Parse pe header

Disassembly:
call fcn.0082f225
pop dword [esp + 0x1e]
lea esp, [esp + 0x23]
mov dword [esp + 0x3c], esi
call fcn.00830791
push dword [esp + 2]
mov dword [esp + 3], eax
mov word [esp], bx
push dword [esp + 6]
pop dword [esp]
pop word [esp + 3]
jmp 0x830819
mov eax, dword fs:[0x30]
jmp 0x830883
pop word [esp + 1]
mov dword [esp + 0x3c], edi
lea esp, [esp + 0x3c]
jmp 0x830802
mov eax, dword [eax + 8]
push eax
jmp 0x82f220
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
jmp 0x83086a
Function at 0x49aca0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x62000]
push edi
jmp 0x49acba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x49acc1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x49acb0
mov eax, 1
add ebx, ebx
jne 0x49acd3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x49ace4
jne 0x49ad03
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x49ad03
dec eax
add ebx, ebx
jne 0x49acf0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x49acc8
add ebx, ebx
jne 0x49acff
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x49ad55
xor ecx, ecx
sub eax, 3
jb 0x49ad1b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x49ad8a
sar eax, 1
mov ebp, eax
jmp 0x49ad26
add ebx, ebx
jne 0x49ad26
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x49acf4
inc ecx
add ebx, ebx
jne 0x49ad34
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x49acf4
add ebx, ebx
jne 0x49ad41
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x49ad36
jne 0x49ad52
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x49ad36
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x49ad74
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x49ad66
jmp 0x49acb6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x49ad74
add edi, ecx
jmp 0x49acb6
pop esi
mov edi, esi
mov ecx, 0x2cc0
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x49ad92
cmp byte [edi], 0x1a
jne 0x49ad92
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x49ad97
lea edi, [esi + 0x97000]
mov eax, dword [edi]
or eax, eax
je 0x49ae0f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xa1f54]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xa206c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x49adc4
mov ecx, edi
jns 0x49adf3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xa2070]
or eax, eax
je 0x49ae09
mov dword [ebx], eax
add ebx, 4
jmp 0x49ade1
call dword [esi + 0xa2080]
mov ebp, dword [esi + 0xa2074]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x49ae43
sub esp, 0xffffff80
jmp 0x454d3d
Function at 0x104f0
Capabilities:
Find process by pid
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x20
xor ebx, ebx
mov esi, dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov dword [esp + 4], 0x1032c
mov dword [esp], 0x10340
mov dword [ebp - 0xc], eax
mov dword [esp + 8], eax
call fcn.000109c0
sub esp, 0xc
lea edx, [ebp - 0xc]
mov dword [esp + 4], edx
mov edx, dword [esi]
mov dword [esp], edx
call sub.ntoskrnl.exe_PsLookupProcessByProcessId
sub esp, 8
test eax, eax
jne 0x106c2
mov ebx, dword [ebp - 0xc]
mov dword [esp + 0xc], ebx
mov ecx, dword [esi]
lea ebx, [ebp - 0x10]
mov dword [esp + 4], 0x1032c
mov dword [esp], 0x10380
mov dword [esp + 8], ecx
call fcn.000109c0
mov edx, dword [ebp - 0xc]
sub esp, 0x10
mov dword [esp], edx
call sub.ntoskrnl.exe_KeAttachProcess
sub esp, 4
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov ecx, dword [esi + 4]
mov dword [esp], ecx
call dword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
sub esp, 0x18
test eax, eax
je 0x105e0
mov dword [esp + 4], 0x1032c
mov dword [esp], 0x103c0
call fcn.000109c0
sub esp, 8
call sub.ntoskrnl.exe_KeDetachProcess
mov ecx, dword [ebp - 0xc]
mov bl, 1
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
lea esp, [ebp - 8]
movzx eax, bl
pop ebx
pop esi
pop ebp
ret 4
mov dword [esp + 4], 0x1032c
mov ecx, dword [ebp - 0x10]
mov dword [esp], 0x103eb
mov dword [esp + 8], ecx
call fcn.000109c0
mov ebx, dword [ebp - 0x10]
sub esp, 0xc
movzx edx, byte [ebx - 9]
mov dword [esp + 4], 0x1032c
mov dword [esp], 0x10400
mov dword [esp + 8], edx
call fcn.000109c0
sub esp, 0xc
test byte [ebx - 9], 0x10
je 0x106a0
mov dword [esp + 4], 0x1032c
mov dword [esp], 0x10420
call fcn.000109c0
sub esp, 8
mov ecx, dword [ebp - 0x10]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov ebx, dword [esi + 4]
mov dword [esp], ebx
call dword [sym.imp.ntoskrnl.exe_ZwMakeTemporaryObject]
sub esp, 4
test eax, eax
je 0x10670
mov dword [esp + 4], 0x1032c
mov dword [esp], 0x10440
jmp 0x105b8
mov edx, dword [esi + 4]
mov dword [esp], edx
call dword [sym.imp.ntoskrnl.exe_ZwClose]
sub esp, 4
test eax, eax
je 0x105c0
mov dword [esp + 4], 0x1032c
mov dword [esp], 0x10466
jmp 0x105b8
mov dword [esp + 4], 0x1032c
mov dword [esp], 0x104a0
call fcn.000109c0
sub esp, 8
mov ecx, dword [ebp - 0x10]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x10670
mov dword [esp + 4], 0x1032c
mov dword [esp], 0x104c3
call fcn.000109c0
sub esp, 8
jmp 0x105d0
Function at 0x10b60
Capabilities:
Create device object
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, 0xc0000182
push ebx
sub esp, 0x20
mov ebx, dword [ebp + 8]
mov dword [esp], section..text
call fcn.000109c0
sub esp, 4
mov dword [esp + 4], 0x102c0
mov dword [esp], 0x10b50
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
sub esp, 8
mov dword [esp + 4], 0x102e0
mov dword [esp], 0x10b40
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea edx, [ebp - 0xc]
sub esp, 8
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x22
mov dword [esp + 8], 0x10b50
mov dword [esp + 4], 0
mov dword [esp], ebx
call dword [sym.imp.ntoskrnl.exe_IoCreateDevice]
sub esp, 0x1c
test eax, eax
jne 0x10c51
mov dword [esp + 4], 0x10b50
mov dword [esp], 0x10b40
call dword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
sub esp, 8
test eax, eax
jne 0x10c42
mov dword [ebx + 0x34], 0x10730
xor esi, esi
mov dword [ebx + 0x38], 0x10810
mov dword [ebx + 0x40], 0x10810
mov dword [ebx + 0x70], 0x10900
mov dword [esp], 0x102fe
call fcn.000109c0
sub esp, 4
lea esp, [ebp - 8]
mov eax, esi
pop ebx
pop esi
pop ebp
ret 8
mov edx, dword [ebp - 0xc]
mov dword [esp], edx
call dword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
sub esp, 4
mov dword [esp], 0x10314
jmp 0x10c2f
Function at 0x40fbd0
Capabilities:
Get common file path

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x47bb5d
push eax
mov dword fs:[0], esp
sub esp, 0x13c
push ebx
push ebp
mov ebx, ecx
push esi
push edi
xor edi, edi
cmp dword [ebx + 0x78], edi
jne 0x40fc3e
push 8
call fcn.0046fe8c
add esp, 4
mov dword [esp + 0x10], eax
cmp eax, edi
mov dword [esp + 0x154], edi
je 0x40fc1a
mov ecx, eax
call fcn.0046ea43
jmp 0x40fc1c
xor eax, eax
push 0xff00ff
push edi
push 0x10
push 0x407
mov ecx, eax
mov dword [esp + 0x164], 0xffffffff
mov dword [ebx + 0x78], eax
call fcn.0046eb08
mov eax, dword [ebx + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0xffff0000
push edi
push 0x1101
push eax
mov dword [esp + 0x20], edi
call ebp
mov eax, dword [ebx + 0x40]
lea esi, [ebx + 0x40]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x40fc8c
lea ecx, [esp + 0x48]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x40fd9e
lea edx, [esp + 0x48]
mov ecx, esi
push edx
call fcn.00470288
jmp 0x40fcb3
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x48]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x10]
mov eax, dword [ebx + 0x78]
test eax, eax
je 0x40fcbd
mov eax, dword [eax + 4]
mov ecx, dword [ebx + 0x1c]
push eax
push 0
push 0x1109
push ecx
call ebp
push eax
call fcn.0046ead5
lea edx, [esp + 0x48]
push 0x585200
push edx
mov esi, 0xffff0000
call fcn.0046111b
add esp, 8
test eax, eax
je 0x40fd40
mov ecx, dword [ebx + 0x1c]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x14]
mov dword [esp + 0x14], esi
push eax
push 0
push 0x1100
push ecx
mov dword [esp + 0x28], 0xffff0002
mov dword [esp + 0x44], 2
mov dword [esp + 0x48], 3
mov dword [esp + 0x2c], 0x23
call ebp
push 0x585200
push 0
mov esi, eax
inc edi
call fcn.0046111b
add esp, 8
test eax, eax
jne 0x40fcec
mov dword [esp + 0x10], edi
mov edx, dword [ebx + 0x1c]
xor edi, edi
push edi
push edi
push 0x110a
push edx
call ebp
mov esi, eax
mov eax, dword [esp + 0x10]
test eax, eax
jle 0x40fd88
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 0x1c]
push esi
push 2
push 0x1102
push eax
mov edi, esi
call ebp
mov ecx, dword [ebx + 0x1c]
push esi
push 4
push 0x110a
push ecx
call ebp
mov esi, eax
mov eax, dword [esp + 0x10]
dec eax
mov dword [esp + 0x10], eax
jne 0x40fd5d
mov edx, dword [ebx + 0x1c]
push edi
push 9
push 0x110b
push edx
call ebp
push edi
mov ecx, ebx
call fcn.0040fdc0
mov ecx, dword [esp + 0x14c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x148
ret
Function at 0x40fdc0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x47bb7b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0046fec0
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40fe42
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0046d7b0
mov eax, dword [eax]
push 0x585200
push eax
call fcn.00460124
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0047014b
test bl, bl
je 0x40fe42
push 0x585200
lea ecx, [esp + 0xc]
call fcn.004704db
push 0x588dd0
lea ecx, [esp + 0xc]
call fcn.004704db
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40fe7e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0047014b
jmp 0x40ff49
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40ff02
lea edx, [esp + 0x7c]
push 0x588dcc
push edx
call fcn.00460124
add esp, 8
test eax, eax
je 0x40ff02
lea eax, [esp + 0x7c]
push 0x588dc8
push eax
call fcn.00460124
add esp, 8
test eax, eax
je 0x40ff02
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40fe92
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0047014b
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4
Function at 0x411960
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x4119c2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc

Function at 0x4119d0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x47bd2b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x5902dc]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x411b08
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x411a36
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0047014b
xor eax, eax
jmp 0x411b7f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.00470288
push esi
lea ecx, [esp + 0xc]
call fcn.00470517
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push 0x588e08
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x411b5d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.00411960
test eax, eax
jne 0x411b5d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.00411960
test eax, eax
jne 0x411b5d
lea eax, [esp + 0x14]
push 0x588de4
push eax
call fcn.00461250
mov esi, eax
add esp, 8
test esi, esi
jne 0x411b3c
lea ecx, [esp + 0x14]
push 0x588de0
push ecx
call fcn.004611d0
mov esi, eax
add esp, 8
test esi, esi
jne 0x411b3c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x411b3f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.00470238
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x411a4e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0047014b
xor eax, eax
jmp 0x411b7f
mov byte [esi], 0
push 0x588ddc
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0047014b
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4