joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412de0
Capabilities:
Get local ipv4 addresses

Disassembly:
sub esp, 0x514
mov eax, dword [0x436090]
push ebx
push ebp
push esi
xor esi, esi
xor ebx, ebx
push edi
xor edi, edi
mov dword [esp + 0x520], eax
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
xor ebp, ebp
lea eax, [esp + 0x18]
push eax
push ebp
call sub.iphlpapi.dll_GetAdaptersInfo
cmp eax, 0x6f
jne 0x412e39
mov ecx, dword [esp + 0x18]
push ecx
push ebp
call fcn.00423d4d
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x412fa9
inc esi
cmp esi, 0x64
jl 0x412e06
jmp 0x412f8f
test eax, eax
jne 0x412f8f
call fcn.00411d50
test ebp, ebp
mov ecx, ebp
je 0x412fa9
lea edx, [ecx + 0x1b0]
test edx, edx
je 0x412e7a
cmp byte [edx], 0
je 0x412e7a
lea edx, [ecx + 0x1d8]
test edx, edx
je 0x412e7a
cmp byte [edx], 0
je 0x412e7a
test eax, eax
je 0x412e85
cmp dword [ecx + 0x19c], eax
je 0x412e85
mov ecx, dword [ecx]
test ecx, ecx
jne 0x412e50
jmp 0x412f8f
add ecx, 8
push ecx
push str.SYSTEMCurrentControlSetServicesTcpipParametersInterfaces_
push str._s_s
lea edx, [esp + 0x12c]
push 0x400
push edx
call fcn.00423faf
add esp, 0x14
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x124]
push ecx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x412f8f
mov ebx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x14]
push edx
push str.Domain
lea esi, [esp + 0x28]
call fcn.00411f10
mov ebx, dword [esp + 0x1c]
add esp, 0xc
test ebx, ebx
je 0x412f01
cmp byte [ebx], 0
jne 0x412f21
push ebx
call fcn.00423699
add esp, 4
mov dword [esp + 0x10], 0
mov ebx, dword [esp + 0x14]
push 0
lea eax, [esp + 0x14]
push eax
push str.DhcpDomain
lea esi, [esp + 0x28]
call fcn.00411f10
mov ebx, dword [esp + 0x1c]
add esp, 0xc
test ebx, ebx
je 0x412f8f
cmp byte [ebx], 0
je 0x412f8f
lea ecx, [esp + 0x20]
push ebx
push ecx
call fcn.00402750
add esp, 8
test eax, eax
jne 0x412f44
mov al, byte [esp + 0x20]
test al, al
jne 0x412f8f
push 0x104
call fcn.00423687
add esp, 4
test eax, eax
mov dword [esp + 0x10], eax
je 0x412f8b
lea edx, [esp + 0x20]
push edx
call fcn.00402430
movzx ecx, ax
mov eax, dword [esp + 0x14]
mov edx, ecx
shr ecx, 2
lea esi, [esp + 0x24]
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
add esp, 4
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [eax + 0x100], 0
mov edi, dword [esp + 0x10]
test ebp, ebp
je 0x412f9c
push ebp
call fcn.00423699
add esp, 4
test ebx, ebx
je 0x412fa9
push ebx
call fcn.00423699
add esp, 4
mov eax, dword [esp + 0x14]
test eax, eax
je 0x412fb8
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x520]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
call fcn.0042373b
add esp, 0x514
ret
Function at 0x412fe0
Capabilities:
Get local ipv4 addresses

Disassembly:
sub esp, 0xc
push ebx
push ebp
xor ebp, ebp
push esi
mov dword [esp + 0x10], ebp
xor esi, esi
mov edi, edi
lea eax, [esp + 0x10]
push eax
push ebp
call sub.iphlpapi.dll_GetAdaptersInfo
mov ebx, eax
cmp ebx, 0x6f
mov dword [esp + 0xc], ebx
jne 0x413030
mov ecx, dword [esp + 0x10]
push ecx
push ebp
call fcn.00423d4d
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x413022
inc esi
cmp esi, 0x64
jl 0x412ff0
jmp 0x41309f
mov dword [esp + 0xc], 0xffffe5b8
mov ebx, dword [esp + 0xc]
jmp 0x41309f
test ebx, ebx
jne 0x41309f
call fcn.00411d50
test ebp, ebp
mov dword [esp + 0x14], eax
mov esi, ebp
je 0x4130ac
push edi
lea ecx, [esi + 0x1b0]
test ecx, ecx
je 0x413092
cmp byte [ecx], 0
je 0x413092
lea edi, [esi + 0x1d8]
test edi, edi
je 0x413092
cmp byte [edi], 0
je 0x413092
mov ebx, dword [esp + 0x24]
call fcn.00411fc0
test eax, eax
jne 0x41308e
mov ebx, dword [esp + 0x28]
mov ecx, edi
call fcn.00411fc0
test eax, eax
jne 0x41308e
mov eax, dword [esp + 0x18]
test eax, eax
je 0x41309a
cmp dword [esi + 0x19c], eax
je 0x41309a
mov ebx, dword [esp + 0x10]
mov esi, dword [esi]
test esi, esi
jne 0x413044
jmp 0x41309e
mov ebx, dword [esp + 0x10]
pop edi
test ebp, ebp
je 0x4130ac
push ebp
call fcn.00423699
add esp, 4
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0xc
ret
Function at 0x415ab0
Capabilities:
Get routing table

Disassembly:
push ecx
push esi
push edi
xor esi, esi
mov edi, eax
push esi
lea eax, [esp + 0xc]
push eax
push esi
mov dword [esp + 0x14], esi
call sub.iphlpapi.dll_GetIpForwardTable
cmp eax, 0x7a
jne 0x415b43
mov ecx, dword [esp + 8]
push ebx
push ecx
call fcn.00423687
mov ebx, eax
add esp, 4
cmp ebx, esi
je 0x415b3c
push esi
lea edx, [esp + 0x10]
push edx
push ebx
call sub.iphlpapi.dll_GetIpForwardTable
test eax, eax
jne 0x415b33
mov edx, dword [ebx]
cmp edx, esi
jbe 0x415b33
lea ecx, [ebx + 4]
lea esp, [esp]
cmp dword [ecx], edi
je 0x415b1c
inc eax
add ecx, 0x38
cmp eax, edx
jb 0x415b00
push ebx
call fcn.00423699
add esp, 4
pop ebx
pop edi
mov eax, esi
pop esi
pop ecx
ret
mov edi, dword [esp + 0x14]
imul eax, eax, 0x38
lea esi, [eax + ebx + 4]
mov ecx, 0xe
rep movsd dword es:[edi], dword [esi]
mov esi, 1
push ebx
call fcn.00423699
add esp, 4
pop ebx
pop edi
mov eax, esi
pop esi
pop ecx
ret
pop edi
mov eax, esi
pop esi
pop ecx
ret
Function at 0x415b50
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
sub esp, 0xc
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [sym.imp.WS2_32.dll_inet_addr]
push str.169.254.0.0
call edi
push ebp
push eax
call sub.iphlpapi.dll_GetBestInterface
test eax, eax
je 0x415b78
mov dword [ebp], 0
lea eax, [esp + 0x10]
push eax
push 0
call sub.iphlpapi.dll_GetAdaptersInfo
cmp eax, 0x6f
je 0x415b94
pop edi
mov eax, 0xffffe5d4
pop ebp
add esp, 0xc
ret
mov ecx, dword [esp + 0x10]
push ebx
push esi
push ecx
call fcn.00423687
mov ebx, eax
add esp, 4
test ebx, ebx
mov dword [esp + 0x14], ebx
jne 0x415bb7
mov esi, 0xffffe5b8
jmp 0x415cc3
lea edx, [esp + 0x18]
push edx
push ebx
call sub.iphlpapi.dll_GetAdaptersInfo
test eax, eax
mov dword [esp + 0x10], eax
jne 0x415cbf
mov esi, ebx
mov dword [esp + 0x10], 0xffffe5d4
mov bl, 0x42
lea ebx, [ebx]
mov eax, dword [esi + 0x1a0]
mov edx, 6
cmp eax, edx
jne 0x415c43
cmp dword [esi + 0x190], edx
jne 0x415c43
cmp byte [esi + 0x194], 0x44
jne 0x415c43
cmp byte [esi + 0x195], 0x45
jne 0x415c43
cmp byte [esi + 0x196], 0x53
jne 0x415c43
cmp byte [esi + 0x197], 0x54
jne 0x415c43
cmp byte [esi + 0x198], bl
jne 0x415c43
mov al, byte [esi + 0x199]
test al, al
jne 0x415c43
lea eax, [esi + 0x1b0]
push eax
call edi
test eax, eax
jne 0x415cbb
mov edx, 6
mov esi, dword [esi]
test esi, esi
jne 0x415be0
mov dword [esp + 0x10], 0xffffe5d4
mov ebx, dword [esp + 0x14]
cmp dword [ebx + 0x1a0], edx
jne 0x415c86
lea esi, [ebx + 0x1b0]
test esi, esi
je 0x415c86
mov edi, str.0.0.0.0
mov ecx, 8
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x415c86
mov eax, dword [ebp]
test eax, eax
je 0x415c97
cmp dword [ebx + 0x19c], eax
je 0x415c97
mov ebx, dword [ebx]
test ebx, ebx
jne 0x415c55
cmp dword [ebp], 0
je 0x415cbb
mov dword [ebp], ebx
jmp 0x415c51
lea ecx, [ebx + 0x1b0]
push ecx
call dword [sym.imp.WS2_32.dll_inet_addr]
mov edx, dword [esp + 0x24]
mov dword [edx], eax
mov eax, dword [ebx + 0x19c]
mov dword [ebp], eax
mov dword [esp + 0x10], 0
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
test ebx, ebx
je 0x415cd0
push ebx
call fcn.00423699
add esp, 4
mov eax, esi
pop esi
pop ebx
pop edi
pop ebp
add esp, 0xc
ret
Function at 0x420b20
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 8
mov edx, dword [esp + 0xc]
push esi
lea ecx, [esp + 4]
push ecx
lea eax, [esp + 0xc]
push edx
mov dword [esp + 0xc], eax
call fcn.00406100
mov edx, dword [edi]
mov eax, dword [esp + 0x10]
add esp, 8
push 0
push 4
lea ecx, [esp + 0x18]
push ecx
push edx
mov dword [esp + 0x20], eax
call dword [sym.imp.WS2_32.dll_send]
mov esi, eax
cmp esi, 4
jge 0x420bd3
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call ebx
cmp eax, 0x2714
je 0x420b78
call ebx
cmp eax, 0x2733
jne 0x420b92
xor esi, esi
push 0xc
call fcn.00423687
add esp, 4
test eax, eax
jne 0x420bba
push str.ERROR:_malloc
call fcn.0041fca0
test esi, esi
jge 0x420b7a
call ebx
push eax
call fcn.0041fb20
push eax
push str.ERROR:_send___unable_to_deliver_error_to_client
push str._s:__s
call fcn.00410bc0
add esp, 0x10
pop ebx
or eax, 0xffffffff
pop esi
add esp, 8
ret
mov ecx, dword [esp + 0x14]
mov dword [eax + 4], esi
mov dword [eax], ecx
mov edx, dword [edi]
mov dword [eax + 8], edx
pop ebx
mov dword [edi + 0x48], eax
xor eax, eax
pop esi
add esp, 8
ret
xor eax, eax
pop esi
add esp, 8
ret
Function at 0x423420
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
sub esp, 0x18
mov eax, dword [0x436090]
push esi
push 0
push 1
push 2
mov dword [esp + 0x24], eax
mov dword [esp + 0x10], 1
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [0x43608c], eax
jne 0x423471
call esi
push eax
call fcn.0041fb20
push eax
push str.ERROR:_socket_AF_DNSSD__SOCK_STREAM__0___failed
push str._s:__s
call fcn.00410bc0
add esp, 0x10
jmp 0x423556
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
push 0x14ea
mov dword [esp + 0x18], eax
mov word [esp + 0xc], 2
call dword [sym.imp.WS2_32.dll_htons]
push str.127.0.0.1
mov word [esp + 0xe], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov edx, dword [0x43608c]
push 0x10
lea ecx, [esp + 0xc]
push ecx
push edx
mov dword [esp + 0x18], eax
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
jge 0x4234de
call esi
push eax
call fcn.0041fb20
push eax
push str.ERROR:_bind_listenfd___struct_sockaddr___laddr__sizeof_laddr____failed
push str._s:__s
call fcn.00410bc0
add esp, 0x10
jmp 0x423556
mov ecx, dword [0x43608c]
lea eax, [esp + 4]
push eax
push 0x8004667e
push ecx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x423516
call esi
push eax
call fcn.0041fb20
push eax
push str.ERROR:_could_not_set_listen_socket_to_non_blocking_mode
push str._s:__s
call fcn.00410bc0
add esp, 0x10
jmp 0x423556
mov edx, dword [0x43608c]
push 5
push edx
call dword [sym.imp.WS2_32.dll_listen]
test eax, eax
je 0x423530
push str.ERROR:_could_not_listen_on_listen_socket
jmp 0x42354e
mov eax, dword [0x43608c]
push 0
push 0x4232f0
push eax
call fcn.00416520
add esp, 0xc
test eax, eax
je 0x423582
push str.ERROR:_could_not_add_listen_socket_to_event_loop
call fcn.00420010
add esp, 4
call esi
push eax
call fcn.0041fb20
push eax
push str.ERROR:_udsserver_init
push str._s:__s
call fcn.00410bc0
add esp, 0x10
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x14]
call fcn.0042373b
add esp, 0x18
ret
mov ecx, dword [esp + 0x18]
xor eax, eax
pop esi
call fcn.0042373b
add esp, 0x18
ret

Function at 0x4241df
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
test edi, edi
jne 0x4241fc
call fcn.00427b84
mov dword [eax], 0x16
xor eax, eax
jmp 0x424266
push esi
push 0x8c
push 1
call fcn.00424006
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x424251
push esi
call fcn.0042726d
mov eax, dword [ebp + 0x14]
or dword [esi + 4], 0xffffffff
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
pop ecx
mov dword [esi + 0x4c], edi
jne 0x42422f
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x18]
push esi
push 0x42414a
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x424265
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call fcn.00423699
test ebx, ebx
pop ecx
je 0x424263
push ebx
call fcn.00427b96
pop ecx
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x401a24
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43b0d0]
jne 0x401a2e
repz ret
jmp fcn.00402816

Function at 0x40dbab
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00405f51
and dword [ebp - 4], 0
cmp dword [0x4440c0], 0
mov ebx, eax
jne 0x40dc5c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40dd0d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40dd0d
push eax
call fcn.00405edf
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4440c0], eax
call esi
push eax
call fcn.00405edf
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4440c4], eax
call esi
push eax
call fcn.00405edf
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4440c8], eax
call esi
push eax
call fcn.00405edf
pop ecx
mov dword [0x4440d0], eax
test eax, eax
je 0x40dc5c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00405edf
pop ecx
mov dword [0x4440cc], eax
mov eax, dword [0x4440cc]
cmp eax, ebx
je 0x40dcb4
cmp dword [0x4440d0], ebx
je 0x40dcb4
push eax
call fcn.00405f5a
push dword [0x4440d0]
mov esi, eax
call fcn.00405f5a
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40dcb4
test edi, edi
je 0x40dcb4
call esi
test eax, eax
je 0x40dcab
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40dcab
test byte [ebp - 0xc], 1
jne 0x40dcb4
or dword [ebp + 0x10], 0x200000
jmp 0x40dced
mov eax, dword [0x4440c4]
cmp eax, ebx
je 0x40dced
push eax
call fcn.00405f5a
pop ecx
test eax, eax
je 0x40dced
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40dced
mov eax, dword [0x4440c8]
cmp eax, ebx
je 0x40dced
push eax
call fcn.00405f5a
pop ecx
test eax, eax
je 0x40dced
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4440c0]
call fcn.00405f5a
pop ecx
test eax, eax
je 0x40dd0d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40dd0f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x434ba2
Capabilities:
Compare security identifiers
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x43b0d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [0x4445ac]
push edi
push dword [eax]
mov edi, dword [0x4444f4]
call fcn.00434acf
cmp dword [0x4445ac], 0x2f
pop ecx
jne 0x434c33
push esi
xor esi, esi
push esi
call dword [sym.imp.ADVAPI32.dll_AbortSystemShutdownA]
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_EqualSid]
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x408]
push eax
push esi
lea eax, [ebp - 0x404]
push eax
push esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_ReadEventLogW]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
pop esi
push edi
call fcn.00434b19
pop ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.00401a24
leave
ret
Function at 0x434f85
Capabilities:
Manipulate console buffer
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, 0x13ba1f
xor esi, esi
cmp dword [0x4445ac], 0xbf9
jne 0x434fa8
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
cmp dword [0x4445ac], 0x3dc
mov dword [0x4445a0], 0x8e55ceaa
jne 0x434fd7
push esi
push 0x438988
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push str.canofepusofijinufuj_vil_jacuvopagaruvahobidorojofutove
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerA]
dec edi
jne 0x434f95
xor ebx, ebx
cmp ebx, 0x8465cd
jne 0x434ff3
mov eax, dword [0x443574]
add eax, 0xa231
mov dword [0x4445ac], eax
cmp dword [0x4445ac], 0x141
jne 0x435039
xor eax, eax
mov word [ebp - 8], ax
lea edi, [ebp - 6]
stosw word es:[edi], ax
mov word [ebp - 4], ax
lea edi, [ebp - 2]
stosw word es:[edi], ax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0xc]
push dword [ebp - 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputA]
or dword [0x444274], 0xffffffff
mov dword [0x444270], 0xec58acac
inc ebx
cmp ebx, 0x125483c
jl 0x434fdc
call fcn.00434c48
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10
Function at 0x401a9e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4b00d0]
jne 0x401aa8
repz ret
jmp fcn.00402bd6

Function at 0x40f8a5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00403626
and dword [ebp - 4], 0
cmp dword [0x4b22fc], 0
mov ebx, eax
jne 0x40f956
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40fa07
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40fa07
push eax
call fcn.004035b4
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4b22fc], eax
call esi
push eax
call fcn.004035b4
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4b2300], eax
call esi
push eax
call fcn.004035b4
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4b2304], eax
call esi
push eax
call fcn.004035b4
pop ecx
mov dword [0x4b230c], eax
test eax, eax
je 0x40f956
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004035b4
pop ecx
mov dword [0x4b2308], eax
mov eax, dword [0x4b2308]
cmp eax, ebx
je 0x40f9ae
cmp dword [0x4b230c], ebx
je 0x40f9ae
push eax
call fcn.0040362f
push dword [0x4b230c]
mov esi, eax
call fcn.0040362f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40f9ae
test edi, edi
je 0x40f9ae
call esi
test eax, eax
je 0x40f9a5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40f9a5
test byte [ebp - 0xc], 1
jne 0x40f9ae
or dword [ebp + 0x10], 0x200000
jmp 0x40f9e7
mov eax, dword [0x4b2300]
cmp eax, ebx
je 0x40f9e7
push eax
call fcn.0040362f
pop ecx
test eax, eax
je 0x40f9e7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40f9e7
mov eax, dword [0x4b2304]
cmp eax, ebx
je 0x40f9e7
push eax
call fcn.0040362f
pop ecx
test eax, eax
je 0x40f9e7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4b22fc]
call fcn.0040362f
pop ecx
test eax, eax
je 0x40fa07
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40fa09
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4aa55b
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
xor esi, esi
cmp esi, 0x5026c
jne 0x4aa5f8
mov dword [ebp - 4], 0x20
add dword [ebp - 4], 0x20
push 0x4b23e0
mov byte [0x4b23e0], 0x6b
mov byte [0x4b23e1], 0x65
mov byte [0x4b23e2], 0x72
mov byte [0x4b23e3], 0x6e
mov byte [0x4b23e4], 0x65
mov byte [0x4b23e5], 0x6c
mov byte [0x4b23e6], 0x33
mov byte [0x4b23e7], 0x32
mov byte [0x4b23e8], 0x2e
mov byte [0x4b23e9], 0x64
mov byte [0x4b23ea], 0x6c
mov byte [0x4b23eb], 0x6c
mov byte [0x4b23ec], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea eax, [ebp - 8]
push eax
push 0x40
push dword [0x4b27a4]
push dword [0x4b26ec]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
inc esi
cmp esi, 0x36edcb
jl 0x4aa563
pop esi
leave
ret
Function at 0x4aa7d2
Capabilities:
Clear file content
Create pipe
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4b27a4]
push ebx
mov ebx, dword [0x4b26ec]
push esi
xor esi, esi
mov dword [ebp - 0x10], eax
cmp eax, 0x5dd
jne 0x4aa7f8
push esi
call dword [sym.imp.KERNEL32.dll_LocalUnlock]
mov eax, dword [ebp + 8]
push dword [eax]
call fcn.004aa6fc
cmp dword [0x4b27a4], 0x2f
pop ecx
jne 0x4aa85d
push edi
xor eax, eax
mov word [ebp - 0xc], ax
lea edi, [ebp - 0xa]
stosw word es:[edi], ax
mov word [ebp - 4], ax
lea edi, [ebp - 2]
stosw word es:[edi], ax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0xc]
push dword [ebp - 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputA]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
pop edi
push ebx
mov ebx, dword [ebp - 0x10]
call fcn.004aa746
cmp dword [0x4b27a4], 0x568
pop ecx
jne 0x4aa87a
push esi
call dword [sym.imp.KERNEL32.dll_DeleteAtom]
pop esi
pop ebx
leave
ret
Function at 0x4aac4d
Capabilities:
Set file attributes

Disassembly:
sub esp, 0x804
mov eax, dword [0x4b00d0]
xor eax, esp
mov dword [esp + 0x800], eax
push esi
push edi
mov edi, 0x13ba1f
xor esi, esi
cmp dword [0x4b27a4], 0xbf9
jne 0x4aac7d
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleDisplayMode]
cmp dword [0x4b27a4], 0x3dc
mov dword [0x4b2798], 0x8e55ceaa
jne 0x4aaca8
push esi
push 0x4ada84
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
dec edi
jne 0x4aac6a
cmp esi, 0x8465cd
jne 0x4aacc2
mov eax, dword [0x4b1780]
add eax, 0xa231
mov dword [0x4b27a4], eax
cmp dword [0x4b27a4], 0x141
jne 0x4aacef
push str.Debiluluyi_domuni_catuca_goherajoxaneh_tobo
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
or dword [0x4b246c], 0xffffffff
mov dword [0x4b2468], 0xec58acac
inc esi
cmp esi, 0x125483c
jl 0x4aacab
call fcn.004aa87e
mov ecx, dword [esp + 0x808]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.00401a9e
add esp, 0x804
ret 0x10

Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x225f7766
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x432024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f314
mov ecx, 0x34654674
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x432084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x10001000
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp + 0xc], eax
mov ecx, dword [esi]
mov edi, dword [esi + 4]
mov dword [ebp + 8], 0x10
mov edx, dword [ebp + 0xc]
add dword [ebp + 0xc], 4
xor ecx, dword [edx]
xor edx, edx
mov dword [ebp - 4], ecx
mov ebx, ecx
mov dl, byte [ebp - 2]
mov dword [ebp - 8], ecx
shr ebx, 0x18
mov edx, dword [eax + edx*4 + 0x448]
add edx, dword [eax + ebx*4 + 0x48]
xor ebx, ebx
mov bl, ch
and ecx, 0xff
xor edx, dword [eax + ebx*4 + 0x848]
add edx, dword [eax + ecx*4 + 0xc48]
xor edx, edi
dec dword [ebp + 8]
mov edi, dword [ebp - 8]
mov ecx, edx
jne 0x1000101d
mov edx, dword [eax + 0x40]
mov eax, dword [eax + 0x44]
xor edx, ecx
xor eax, edi
mov dword [esi], eax
mov dword [esi + 4], edx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10001079
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp + 8], 0x10
lea edi, [eax + 0x44]
xor ecx, dword [edi]
xor edx, edx
sub edi, 4
mov dword [ebp - 4], ecx
mov ebx, ecx
mov dl, byte [ebp - 2]
mov dword [ebp - 8], ecx
shr ebx, 0x18
mov edx, dword [eax + edx*4 + 0x448]
add edx, dword [eax + ebx*4 + 0x48]
xor ebx, ebx
mov bl, ch
and ecx, 0xff
xor edx, dword [eax + ebx*4 + 0x848]
add edx, dword [eax + ecx*4 + 0xc48]
xor edx, dword [ebp + 0xc]
dec dword [ebp + 8]
mov ecx, edx
mov edx, dword [ebp - 8]
mov dword [ebp + 0xc], edx
jne 0x10001099
mov edi, edx
mov edx, dword [eax + 4]
mov eax, dword [eax]
xor edx, ecx
xor eax, edi
mov dword [esi + 4], edx
mov dword [esi], eax
pop edi
pop esi
pop ebx
leave
ret