joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10145a73
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x30
mov dword [ebp - 8], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 0x10]
mov ecx, dword [ecx + 0x3c]
mov edx, dword [0x102c4138]
mov esi, edx
add esi, 0xffffde83
mov dword [0x102c4134], esi
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], esi
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10145b38
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x14], 0x64
sete dl
mov byte [ebp - 0x21], dl
mov al, byte [ebp - 0x21]
test al, 1
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x28], ecx
jne 0x10145b07
jmp 0x10145bd3
mov eax, dword [ebp - 0x14]
add eax, 0xffffdce0
mov dword [0x102c4134], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x20]
cmp word [ecx + edx*2 - 0x10], 0x6c
mov dword [ebp - 0x28], eax
je 0x10145baa
jmp 0x10145bd3
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x12], 0x64
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x28], edx
je 0x10145adf
jmp 0x10145bd3
mov eax, dword [ebp - 0x2c]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x30], eax
jge 0x10145b4e
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], edx
jne 0x10145b21
mov eax, dword [ebp - 0x30]
mov dword [0x102c4138], 0x9f
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x28], edx
jne 0x10145bd3
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x18], 0x6f
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x28], edx
jne 0x10145bd3
mov dword [0x102c4138], 0x1815
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x16], 0x61
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x28], edx
je 0x10145aba
jmp 0x10145bd3
mov eax, 1
mov ecx, 0xadf
mov dword [0x102c4134], 0xadf
mov edx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x20]
cmp word [edx + esi*2 - 0xe], 0x6c
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x34], eax
je 0x10145be5
mov eax, dword [ebp - 0x28]
xor ecx, ecx
add eax, 0xfffff184
mov dword [0x102c4138], eax
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x34]
add esp, 0x30
pop esi
pop ebp
ret
Function at 0x10145e0d
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x50
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
lea edx, [0x10292075]
mov esi, 0xe
lea edi, [ebp - 0x28]
mov dword [esp], edi
mov dword [esp + 4], edx
mov dword [esp + 8], 0xe
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], esi
call fcn.101456ab
mov eax, dword [0x102c4134]
add eax, 0xffffe70f
mov dword [0x102c4134], eax
call fcn.101459d2
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
call fcn.1014533e
cmp eax, 0
mov dword [ebp - 0x3c], eax
je 0x10145f24
mov eax, dword [ebp - 0x3c]
mov ecx, dword [0x102c4134]
add ecx, 0x1acf
mov dword [0x102c4134], ecx
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [esp], eax
mov ecx, dword [ebp - 0x2c]
mov dword [esp + 4], ecx
mov dword [ebp - 0x40], eax
call fcn.10145c10
mov eax, dword [ebp - 0x40]
mov word [eax], 0x5a4d
mov dword [eax + 0x3c], 0xc0
mov dword [eax + 0xc0], 0x4550
xor eax, eax
mov ecx, dword [ebp - 0x40]
add ecx, 0x1022
mov edx, dword [ebp - 0x40]
add edx, 0xffc00000
mov esi, dword [ebp - 0x30]
mov dword [esi + 0x30], edx
mov dword [0x102c4134], 0x112
mov edx, dword [ebp - 0x40]
mov dword [esi + 0xc], edx
cmp edx, 0
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x48], eax
je 0x10145f1a
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
add esp, 0x50
pop esi
pop edi
pop ebp
ret
xor eax, eax
add esp, 0x50
pop esi
pop edi
pop ebp
ret
Function at 0x101460c7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x40
mov eax, dword [ebp + 8]
mov ecx, dword [0x102c4134]
add ecx, 0x4b29
mov dword [0x102c4134], ecx
mov dword [ebp - 0x10], eax
call fcn.101457ba
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov esi, dword [eax + esi + 0x78]
mov dword [0x102c4138], 0x47e5
mov edi, edx
add edi, dword [eax + esi + 0x20]
mov dword [0x102c4134], 0x660
mov eax, dword [eax + esi + 0x18]
cmp eax, 0
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ecx
jne 0x10146192
mov eax, dword [ebp - 0x24]
add esp, 0x40
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x28]
mov ecx, eax
mov edx, dword [ebp - 0x2c]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x31], bh
mov byte [ebp - 0x32], cl
je 0x10146209
jmp 0x101461dd
xor eax, eax
mov ecx, dword [ebp - 0x38]
add ecx, 1
mov edx, dword [ebp - 0x3c]
add edx, 2
mov esi, dword [ebp - 0x18]
cmp ecx, esi
mov edi, dword [ebp - 0x40]
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x4c], ecx
jb 0x101461ac
jmp 0x1014612c
mov eax, 0x660
xor ecx, ecx
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
add edx, dword [edx + esi + 0x24]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 0x48]
xor esi, esi
mov edi, dword [ebp - 0x14]
mov ebx, dword [edi + eax*4]
add edx, 0x24f8
mov dword [0x102c4134], edx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x28], esi
jmp 0x10146137
mov eax, dword [ebp - 0x30]
add eax, 1
mov cl, byte [ebp - 0x31]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x32]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dword [ebp - 0x28], eax
jne 0x10146137
mov al, byte [ebp - 0x32]
test al, 1
jne 0x10146215
jmp 0x10146166
mov eax, dword [ebp - 0x3c]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
add edx, dword [edx + esi + 0x1c]
mov dword [0x102c4134], 0xc39
mov edi, dword [ebp - 0x1c]
add edi, dword [edx + ecx*4]
mov dword [ebp - 0x24], edi
jmp 0x1014612c
Function at 0x1014623d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x102c413c], 0
mov dword [0x102c4140], 0
mov dword [0x102c414c], 0
mov dword [0x102c4138], 0x14e0
cmp eax, 0
mov ebx, edi
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], edi
je 0x10146385
jmp 0x101462b9
mov eax, dword [0x102c413c]
mov ecx, dword [0x102c4140]
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
mov dword [0x102c4134], 0xb69
add ecx, 1
mov dword [ebp - 0x30], eax
mov eax, ecx
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x102c413c], edx
mov ecx, dword [ebp - 0x20]
movzx edi, byte [ecx + edx]
mov ebx, dword [ebp - 0x34]
add edi, ebx
mov eax, edi
mov dword [ebp - 0x38], edx
cdq
idiv esi
mov dword [0x102c4140], edx
mov esi, dword [ebp - 0x38]
mov cl, byte [ecx + esi]
mov byte [0x102c4144], cl
mov edi, dword [ebp - 0x20]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov dword [0x102c4134], 0x226c
mov cl, byte [0x102c4144]
mov edx, dword [0x102c4140]
mov byte [edi + edx], cl
mov edx, dword [0x102c413c]
movzx edx, byte [edi + edx]
mov ebx, dword [0x102c4140]
movzx ebx, byte [edi + ebx]
add ebx, edx
and ebx, 0xff
mov dword [0x102c414c], ebx
mov dword [0x102c4134], 0x11c5
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x30]
mov cl, byte [edx + ecx]
xor cl, byte [edi + ebx]
mov ebx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x30]
mov byte [ebx + edx], cl
add edx, 1
mov ecx, dword [ebp - 0x10]
cmp edx, ecx
mov dword [ebp - 0x2c], edx
jne 0x101462a2
mov dword [0x102c4138], 0xe7d
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x401554
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x80000000
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.KERNEL32.dll_CreateFileA
sub esp, 0x1c
mov dword [ebp - 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 8]
mov dword [esp], eax
call sub.KERNEL32.dll_GetFileSize
sub esp, 8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov eax, dword [ebp - 4]
leave
ret

Function at 0x40163e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.KERNEL32.dll_GetFileAttributesA
sub esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x401664
mov dword [ebp - 8], 0
jmp 0x40166b
mov dword [ebp - 8], 1
mov eax, dword [ebp - 8]
leave
ret

Function at 0x40183c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp], 0x40a4c0
call fcn.00401318
mov dword [ebp - 4], 0xc8
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], 0x40a4c0
call sub.msvcrt.dll_strcat
mov dword [esp], 0x405380
call fcn.00401290
mov dword [esp + 4], eax
mov dword [esp], 0x40a4c0
call sub.msvcrt.dll_strcat
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x10000080
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40000000
mov dword [esp], 0x40a4c0
call sub.KERNEL32.dll_CreateFileA
sub esp, 0x1c
mov dword [ebp - 8], eax
mov dword [esp + 0x10], 0
lea eax, [ebp - 4]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0x407000
mov eax, dword [ebp - 8]
mov dword [esp], eax
call sub.KERNEL32.dll_WriteFile
sub esp, 0x14
mov eax, dword [ebp - 8]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
leave
ret

Function at 0x401904
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], 0xc8
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x10000080
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40000000
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.KERNEL32.dll_CreateFileA
sub esp, 0x1c
mov dword [ebp - 8], eax
mov dword [esp + 0x10], 0
lea eax, [ebp - 4]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0x407000
mov eax, dword [ebp - 8]
mov dword [esp], eax
call sub.KERNEL32.dll_WriteFile
sub esp, 0x14
mov eax, dword [ebp - 8]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
leave
ret
Function at 0x4019e8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x448
call fcn.00401774
mov edx, eax
mov dword [esp + 0x1c], 0x200
lea eax, [ebp - 0x408]
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x41c]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x418]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x414]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x200
lea eax, [ebp - 0x208]
mov dword [esp + 4], eax
mov dword [esp], edx
call sub.KERNEL32.dll_GetVolumeInformationA
sub esp, 0x20
mov dword [esp], 0x40a8c0
call fcn.00401318
mov edx, dword [ebp - 0x414]
mov eax, edx
shl eax, 3
sub eax, edx
mov dword [ebp - 0x40c], eax
mov eax, dword [ebp - 0x414]
shl eax, 2
mov dword [ebp - 0x410], eax
mov eax, dword [ebp - 0x40c]
mov dword [esp], eax
call fcn.00401990
mov dword [esp + 8], 5
mov dword [esp + 4], 2
mov dword [esp], eax
call fcn.004013e2
mov dword [esp + 4], eax
mov dword [esp], 0x40a8c0
call sub.msvcrt.dll_strcat
mov eax, dword [ebp - 0x410]
mov dword [esp], eax
call fcn.00401990
mov dword [esp + 8], 5
mov dword [esp + 4], 2
mov dword [esp], eax
call fcn.004013e2
mov dword [esp + 4], eax
mov dword [esp], 0x40a8c0
call sub.msvcrt.dll_strcat
mov eax, 0x40a8c0
leave
ret

Function at 0x401bf8
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf8
mov dword [esp], 0x40aec0
call fcn.00401318
mov dword [esp], 0x40b2c0
call fcn.00401318
mov dword [esp], 0x40b6c0
call fcn.00401318
mov dword [esp + 8], 0x24
mov dword [esp + 4], 0
lea eax, [ebp - 0xd8]
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov dword [esp + 8], 0x9c
mov dword [esp + 4], 0
lea eax, [ebp - 0xa8]
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov dword [esp], 0x4067a0
call fcn.00401290
mov dword [esp + 4], eax
mov dword [esp], 0x40b2c0
call sub.msvcrt.dll_strcat
mov dword [esp], 0x406820
call fcn.00401290
mov dword [esp + 4], eax
mov dword [esp], 0x40b6c0
call sub.msvcrt.dll_strcat
mov dword [ebp - 0xa8], 0x9c
lea eax, [ebp - 0xa8]
mov dword [esp], eax
call sub.KERNEL32.dll_GetVersionExA
sub esp, 4
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0
jne 0x401cd2
mov dword [ebp - 0xe4], section..rdata
jmp 0x401d79
mov dword [esp], 0x40b2c0
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
mov dword [esp + 4], 0x40b6c0
mov dword [esp], eax
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0
je 0x401d19
lea eax, [ebp - 0xd8]
mov dword [esp], eax
mov eax, dword [ebp - 0xdc]
call eax
sub esp, 4
jmp 0x401d2a
lea eax, [ebp - 0xd8]
mov dword [esp], eax
call sub.KERNEL32.dll_GetSystemInfo
sub esp, 4
cmp dword [ebp - 0xa4], 5
jbe 0x401d6f
cmp word [ebp - 0xd8], 9
jne 0x401d51
mov dword [esp + 4], 0x407007
mov dword [esp], 0x40aec0
call sub.msvcrt.dll_strcat
cmp word [ebp - 0xd8], 0
jne 0x401d6f
mov dword [esp + 4], 0x407009
mov dword [esp], 0x40aec0
call sub.msvcrt.dll_strcat
mov dword [ebp - 0xe4], 0x40aec0
mov eax, dword [ebp - 0xe4]
leave
ret
Function at 0x401d82
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov dword [esp], 0x40bad0
call fcn.00401318
mov dword [esp], 0x40bed0
call fcn.00401318
mov dword [esp + 8], 0x24
mov dword [esp + 4], 0
lea eax, [ebp - 0xd8]
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov dword [esp + 8], 0x9c
mov dword [esp + 4], 0
lea eax, [ebp - 0xa8]
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov dword [esp], 0x4067a0
call fcn.00401290
mov dword [esp + 4], eax
mov dword [esp], 0x40bad0
call sub.msvcrt.dll_strcat
mov dword [esp], 0x406820
call fcn.00401290
mov dword [esp + 4], eax
mov dword [esp], 0x40bed0
call sub.msvcrt.dll_strcat
mov dword [ebp - 0xa8], 0x9c
lea eax, [ebp - 0xa8]
mov dword [esp], eax
call sub.KERNEL32.dll_GetVersionExA
sub esp, 4
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0
jne 0x401e50
mov dword [ebp - 0xec], 0
jmp 0x402028
mov dword [esp], 0x40bad0
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
mov dword [esp + 4], 0x40bed0
mov dword [esp], eax
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0
je 0x401e97
lea eax, [ebp - 0xd8]
mov dword [esp], eax
mov eax, dword [ebp - 0xdc]
call eax
sub esp, 4
jmp 0x401ea8
lea eax, [ebp - 0xd8]
mov dword [esp], eax
call sub.KERNEL32.dll_GetSystemInfo
sub esp, 4
cmp dword [ebp - 0xa4], 0xa
jne 0x401ed6
cmp dword [ebp - 0xa0], 0
jne 0x401ed6
cmp byte [ebp - 0xe], 1
jne 0x401ecc
mov dword [0x40bac0], 1
jmp 0x401ed6
mov dword [0x40bac0], 2
cmp dword [ebp - 0xa4], 6
jne 0x401f04
cmp dword [ebp - 0xa0], 3
jne 0x401f04
cmp byte [ebp - 0xe], 1
jne 0x401efa
mov dword [0x40bac0], 3
jmp 0x401f04
mov dword [0x40bac0], 4
cmp dword [ebp - 0xa4], 6
jne 0x401f32
cmp dword [ebp - 0xa0], 2
jne 0x401f32
cmp byte [ebp - 0xe], 1
jne 0x401f28
mov dword [0x40bac0], 1
jmp 0x401f32
mov dword [0x40bac0], 2
cmp dword [ebp - 0xa4], 6
jne 0x401f60
cmp dword [ebp - 0xa0], 0
jne 0x401f60
cmp byte [ebp - 0xe], 1
jne 0x401f56
mov dword [0x40bac0], 7
jmp 0x401f60
mov dword [0x40bac0], 8
cmp dword [ebp - 0xa4], 6
jne 0x401f8e
cmp dword [ebp - 0xa0], 1
jne 0x401f8e
cmp byte [ebp - 0xe], 1
jne 0x401f84
mov dword [0x40bac0], 9
jmp 0x401f8e
mov dword [0x40bac0], 0xa
cmp dword [ebp - 0xa4], 5
jne 0x401fe5
cmp dword [ebp - 0xa0], 2
jne 0x401fe5
mov dword [esp], 0x59
call sub.USER32.dll_GetSystemMetrics
sub esp, 4
test eax, eax
je 0x401fbf
mov dword [0x40bac0], 0xb
jmp 0x401fe5
cmp byte [ebp - 0xe], 1
jne 0x401fdb
cmp word [ebp - 0xd8], 9
jne 0x401fdb
mov dword [0x40bac0], 0xc
jmp 0x401fe5
mov dword [0x40bac0], 0xd
cmp dword [ebp - 0xa4], 5
jne 0x402001
cmp dword [ebp - 0xa0], 1
jne 0x402001
mov dword [0x40bac0], 0xe
cmp dword [ebp - 0xa4], 5
jne 0x40201d
cmp dword [ebp - 0xa0], 0
jne 0x40201d
mov dword [0x40bac0], 0xf
mov eax, dword [0x40bac0]
mov dword [ebp - 0xec], eax
mov eax, dword [ebp - 0xec]
leave
ret
Function at 0x402254
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c8
lea eax, [ebp - 0x1b8]
mov dword [esp + 4], eax
mov dword [esp], 2
call sub.WSOCK32.DLL_WSAStartup
sub esp, 8
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.WSOCK32.DLL_gethostbyname
sub esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4022e1
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.WSOCK32.DLL_gethostbyname
sub esp, 4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movsx eax, word [eax + 0xa]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov dword [esp + 4], eax
lea eax, [ebp - 0x28]
add eax, 4
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sub.WSOCK32.DLL_inet_ntoa
sub esp, 4
mov dword [esp + 4], eax
mov dword [esp], 0x40c2d0
call sub.msvcrt.dll_strcpy
mov eax, 0x40c2d0
leave
ret
Function at 0x4028b8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
lea ecx, [ebp - 0x58]
mov edx, 0x406924
mov eax, 0x44
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp], ecx
call sub.msvcrt.dll_memcpy
lea eax, [ebp - 0x68]
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x58]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], 0
call sub.KERNEL32.dll_CreateProcessA
sub esp, 0x28
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
setne al
movzx eax, al
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x6c]
leave
ret

Function at 0x402948
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov dword [esp + 8], 0x3c
mov dword [esp + 4], 0
lea eax, [ebp - 0x48]
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov dword [ebp - 0x48], 0x3c
mov dword [ebp - 0x40], 0
mov dword [esp], 0x405700
call fcn.00401290
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x44], 0x40
lea eax, [ebp - 0x48]
mov dword [esp], eax
call sub.SHELL32.DLL_ShellExecuteExA
sub esp, 4
test eax, eax
je 0x4029cb
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.KERNEL32.dll_WaitForSingleObject
sub esp, 8
mov dword [ebp - 0x4c], 1
jmp 0x4029cb
mov eax, dword [ebp - 0x4c]
leave
ret

Function at 0x4036de
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2028
call fcn.00403fb0
cmp dword [ebp + 8], 0x407000
je 0x4037b6
cmp dword [ebp + 0xc], section..rdata
je 0x4037b6
mov dword [esp + 4], 0x407030
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov dword [ebp - 0x2010], eax
mov dword [esp + 4], 0x407033
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov dword [ebp - 0x2014], eax
mov eax, dword [ebp - 0x2010]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x200
mov dword [esp + 4], 1
lea eax, [ebp - 0x2008]
mov dword [esp], eax
call sub.msvcrt.dll_fread
mov dword [ebp - 0x200c], eax
cmp dword [ebp - 0x200c], 0
je 0x40379a
mov eax, dword [ebp - 0x2014]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x200c]
mov dword [esp + 8], eax
mov dword [esp + 4], 1
lea eax, [ebp - 0x2008]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
jmp 0x403737
mov eax, dword [ebp - 0x2010]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov eax, dword [ebp - 0x2014]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
leave
ret
Function at 0x20011d3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x200122b
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x200121c
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x2001218
cmp esi, eax
jae 0x200121c
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x200120a
cmp esi, eax
jb 0x2001220
xor eax, eax
jmp 0x200122a
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop ebp
ret 0xc

Function at 0x2001fd9
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x200202c
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
test esi, esi
mov ebx, ecx
jne 0x2002042
push 0x80004005
call fcn.02001105
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x2002045
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
ret 8

Function at 0x20025e1
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [0x2019688]
xor eax, ebp
mov dword [ebp + 0x94], eax
mov eax, dword [ebp + 0xa0]
push ebx
push esi
push edi
push 0x2001f
mov ebx, ecx
push eax
push dword [ebx]
xor esi, esi
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x70], esi
call fcn.02001411
mov edi, eax
cmp edi, esi
je 0x2002649
lea ecx, [ebp - 0x70]
call fcn.020013fa
mov eax, edi
mov ecx, dword [ebp + 0x94]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0201016a
add ebp, 0x98
leave
ret 4
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x2002661
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x70]
call fcn.020025e1
cmp eax, esi
jne 0x2002694
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x6c]
push eax
push esi
push dword [ebp - 0x70]
mov dword [ebp - 0x74], 0x100
call edi
test eax, eax
je 0x2002651
lea ecx, [ebp - 0x70]
call fcn.020013fa
push dword [ebp - 0x78]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea ecx, [ebp - 0x70]
mov esi, eax
call fcn.020013fa
mov eax, esi
jmp 0x200262f

Function at 0x2002d37
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
call fcn.0200c03c
mov eax, dword [eax]
push 1
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
mov esi, eax
call fcn.0200151a
mov eax, esi
pop esi
leave
ret 8