joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3006ad1f
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x468
mov eax, dword [0x3002226c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x40
xor esi, esi
lea eax, [ebp - 0x464]
push esi
push eax
mov dword [ebp - 0x468], 0x44
call sub.MSVCR80.dll_memset
mov dword [ebp - 0x424], esi
xor eax, eax
lea edi, [ebp - 0x420]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
push ebx
stosd dword es:[edi], eax
call fcn.30059e93
cmp eax, 0x104
jg 0x3006add6
push dword [ebp + 0xc]
lea eax, [ebp - 0x414]
push 0x6b
push ebx
push 0x300226fc
push 0x208
push eax
call dword [sym.imp.MSVCR80.dll_swprintf_s]
add esp, 0x18
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x468]
push eax
push esi
push esi
push 0x4000020
push esi
push esi
push esi
lea eax, [ebp - 0x414]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x3006add6
push dword [ebp - 0x424]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x420]
call esi
jmp 0x3006ade1
push esi
push 0x30303030
call fcn.30043574
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.300696c7
leave
ret 8

Function at 0x3006b598
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call fcn.3006b3fb
test eax, eax
je 0x3006b609
lea eax, [ebp + 8]
push eax
push 0x20019
push 0
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x3006b609
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
add eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 0x10]
push eax
push 0
push 0x300227fc
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x3006b5ff
cmp dword [ebp - 0x10], 1
je 0x3006b5ff
and word [esi], ax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
leave
ret 0xc
Function at 0x30070741
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x3002226c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xa0], 0x94
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x300707a5
cmp dword [ebp - 0x90], 2
jne 0x300707a5
cmp dword [ebp - 0x9c], 6
ja 0x3007078c
cmp dword [ebp - 0x9c], 6
jne 0x300707a5
cmp dword [ebp - 0x94], 0x155e
jb 0x300707a5
push 0x3002303c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x300707a7
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.300696c7
mov esp, ebp
pop ebp
ret

Function at 0x30077f72
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x68], 1
jne 0x30078074
push 0x30023e9c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x6c], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x6c], 0
jne 0x30077fd4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x30077fbf
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.3006d214
mov dword [ebp - 8], eax
jmp 0x30077fc6
mov dword [ebp - 8], 0x80004005
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [eax + 0x68], ecx
jmp 0x30078074
push 0x30009664
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x70], eax
push 0x30009628
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x74], eax
push 0x3000967c
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x78], eax
push 0x30009640
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x7c], eax
push 0x30009654
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x80], eax
push 0x30009618
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x84], eax
mov edx, dword [ebp - 4]
mov dword [edx + 0x68], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
mov esp, ebp
pop ebp
ret
Function at 0x3007892d
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x30088940
push 0x30069fe0
mov eax, dword fs:[0]
push eax
add esp, 0xfffffff4
push ebx
push esi
push edi
mov eax, dword [0x3002226c]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x1c], 0
cmp dword [ebp + 8], 0
je 0x30078a20
cmp dword [ebp + 8], 0xffffffff
je 0x30078a20
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
cmp ecx, 0x5a4d
jne 0x30078a00
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
cmp dword [ecx], 0x4550
jne 0x300789c6
mov edx, dword [ebp - 0x1c]
movzx eax, word [edx + 0x18]
cmp eax, 0x10b
je 0x300789cf
mov ecx, dword [ebp - 0x1c]
movzx edx, word [ecx + 0x18]
cmp edx, 0x20b
je 0x300789cf
mov dword [ebp - 0x1c], 0
jmp 0x30078a00
cmp dword [ebp + 0xc], 0
je 0x30078a00
mov eax, dword [ebp - 0x1c]
movzx ecx, word [eax + 0x18]
cmp ecx, 0x10b
jne 0x300789f3
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call fcn.30078725
jmp 0x30078a00
mov ecx, 0x42
mov esi, dword [ebp - 0x1c]
mov edi, dword [ebp + 0xc]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], 0xfffffffe
jmp 0x30078a20
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x30078a37
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
movzx ecx, word [eax + 0x14]
mov edx, dword [ebp + 8]
lea eax, [edx + ecx + 0x18]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
jmp 0x30078a62
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 8]
movzx eax, word [edx + 6]
cmp dword [ebp - 8], eax
jae 0x30078a9a
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0x10]
cmp edx, dword [ecx + 0xc]
jb 0x30078a8f
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 0x10]
cmp dword [ebp + 0x10], ecx
jae 0x30078a8f
mov eax, dword [ebp - 4]
jmp 0x30078a9c
mov eax, dword [ebp - 4]
add eax, 0x28
mov dword [ebp - 4], eax
jmp 0x30078a59
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x3007915a
Capabilities:
Create thread
Suspend thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x30088980
push 0x30069fe0
mov eax, dword fs:[0]
push eax
add esp, 0xfffffa40
mov eax, dword [0x3002226c]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x28], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x2fc], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
lea eax, [ebp - 0x24]
push eax
push 0
push 0
push 0x30079153
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x300791d4
xor eax, eax
jmp 0x30079311
mov ecx, dword [ebp - 0x24]
push ecx
push 0
push 0x1f03ff
mov edx, dword [ebp + 8]
push edx
call fcn.3007909e
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x30079200
mov dword [ebp - 0x300], 0
jmp 0x300792c9
mov dword [ebp - 0x300], 1
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov dword [ebp - 0x2fc], eax
cmp dword [ebp - 0x2fc], 0xffffffff
jne 0x30079236
mov dword [ebp - 0x300], 0
jmp 0x300792a6
mov dword [ebp - 0x5d0], 0x10007
lea ecx, [ebp - 0x5d0]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov dword [ebp - 0x300], eax
cmp dword [ebp - 0x300], 0
jne 0x30079262
jmp 0x300792a6
mov dword [ebp - 0x2f8], 0x10007
lea eax, [ebp - 0x2f8]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov dword [ebp - 0x300], eax
cmp dword [ebp - 0x300], 0
jne 0x3007928e
jmp 0x300792a6
mov edx, dword [ebp - 0x518]
cmp edx, dword [ebp - 0x240]
je 0x300792a6
mov dword [ebp - 0x300], 0
mov dword [ebp - 4], 0xfffffffe
jmp 0x300792c9
cmp dword [ebp - 0x2fc], 0
jle 0x300792dc
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0xdead
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
cmp dword [ebp - 0x20], 0
je 0x300792fb
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x1c], 0
je 0x3007930b
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x300]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x28]
xor ecx, ebp
call fcn.300696c7
mov esp, ebp
pop ebp
ret 4
Function at 0x3007dd91
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
push ebx
push edi
mov edi, dword [ebp + 0xc]
mov eax, edi
shr eax, 2
test eax, eax
jle 0x3007ddd0
push esi
movzx esi, byte [ecx]
xor ebx, ebx
dec eax
inc ecx
mov bh, byte [ecx]
or esi, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x10
or esi, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x18
or esi, ebx
inc ecx
xor edx, esi
test eax, eax
jg 0x3007ddab
pop esi
and edi, 3
xor eax, eax
dec edi
je 0x3007ddec
dec edi
je 0x3007dde5
dec edi
jne 0x3007ddf1
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
xor ebx, ebx
mov bh, byte [ecx]
or eax, ebx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
pop edi
xor eax, edx
pop ebx
pop ebp
ret 0xc

Function at 0x3007f208
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebx + 0x18], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebx + 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebx + 4], eax
mov eax, dword [ebp + 0x18]
push esi
push edi
xor edi, edi
cmp byte [ebp + 0x24], 0
mov dword [ebx + 0x10], eax
mov eax, dword [ebp + 0xc]
mov word [ebx + 0xc], di
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x24], ecx
mov dword [ebx + 0x28], edi
mov esi, 0x8000
jne 0x3007f258
push esi
push eax
add eax, esi
push eax
call sub.MSVCR80.dll_memcpy
add esp, 0xc
mov word [ebx + 0x2c], di
mov dword [ebx + 0x30], edi
call fcn.3007ec62
mov eax, dword [ebx + 0x14]
and dword [ebx + 0x20], edi
push 2
mov word [ebx + 0x3c], si
mov dword [ebx + 0x34], esi
add eax, esi
pop ecx
movzx edi, byte [eax]
mov edx, dword [ebx + 0x20]
shl edx, 5
xor edx, edi
and edx, 0x7fff
inc eax
dec ecx
mov dword [ebx + 0x20], edx
jne 0x3007f276
cmp byte [ebp + 0x24], cl
je 0x3007f29c
mov edi, ebx
call fcn.3007eabf
jmp 0x3007f2ad
xor eax, eax
mov ecx, esi
mov edx, dword [ebx + 0x18]
and word [eax + edx], 0
inc eax
inc eax
dec ecx
jne 0x3007f2a0
push 8
pop edi
push 0x43
pop edx
mov eax, ebx
call fcn.3007df05
push 0x4b
pop edx
call fcn.3007df05
call fcn.3007ef8e
mov ecx, dword [ebp + 0x28]
inc eax
inc eax
cmp byte [ebp + 0x24], 0
movzx eax, ax
mov dword [ecx], eax
je 0x3007f2eb
mov eax, dword [ebx + 0x14]
push esi
lea ecx, [eax + 0x8000]
push ecx
push eax
call sub.MSVCR80.dll_memcpy
add esp, 0xc
mov eax, dword [ebx + 0x28]
neg eax
pop edi
sbb eax, eax
pop esi
and eax, 3
pop ebx
pop ebp
ret 0x24
Function at 0x300816ae
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc9c
mov eax, dword [0x3002226c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc88], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
mov dword [ebp - 0xc8c], eax
mov eax, dword [esi + 0x870]
add eax, 0x20
mov ecx, eax
shl ecx, 3
cmp ecx, 0x320
mov dword [ebp - 0xc9c], ecx
jb 0x300816fb
xor eax, eax
jmp 0x300818d7
push edi
mov edi, eax
shl edi, 4
push edi
lea eax, [ebp - 0xc84]
push 0
push eax
call sub.MSVCR80.dll_memset
push edi
lea eax, [ebp - 0x644]
push 0
push eax
call sub.MSVCR80.dll_memset
mov ecx, dword [ebp + 0x18]
add esp, 0x18
test ecx, ecx
jbe 0x3008185b
mov eax, dword [ebp + 0x14]
mov edi, dword [esi + 0x30]
shl eax, 2
mov dword [ebp - 0xc90], eax
mov eax, dword [ebp + 0x10]
shl eax, 2
push ebx
mov ebx, dword [esi + 0x34]
mov dword [ebp - 0xc94], eax
mov dword [ebp - 0xc98], ecx
jmp 0x3008175a
mov eax, dword [ebp - 0xc94]
mov ecx, dword [ebp - 0xc88]
and ecx, 7
xor edx, edx
inc edx
shl edx, cl
mov ecx, dword [ebp - 0xc88]
shr ecx, 3
mov cl, byte [ecx + ebx]
test cl, dl
jne 0x30081784
mov eax, dword [ebp - 0xc88]
movzx eax, byte [edi + eax]
jmp 0x300817c8
mov ecx, dword [ebp - 0xc88]
cmp byte [edi + ecx], 7
mov ecx, dword [esi + 0x2c]
push dword [eax + ecx]
push esi
jae 0x300817b2
call fcn.3007fa0b
mov ecx, dword [ebp - 0xc88]
movzx ecx, byte [edi + ecx]
movzx eax, al
lea eax, [ecx + eax*8 + 0x100]
jmp 0x300817c1
call fcn.3007fa0b
movzx eax, al
lea eax, [eax*8 + 0x107]
add dword [ebp - 0xc94], 4
inc dword [ebp - 0xc88]
lea eax, [ebp + eax*2 - 0xc84]
inc word [eax]
mov eax, dword [ebp - 0xc8c]
xor edx, edx
mov ecx, eax
and ecx, 7
inc edx
shl edx, cl
mov ecx, eax
shr ecx, 3
mov cl, byte [ecx + ebx]
test cl, dl
jne 0x300817fa
movzx eax, byte [edi + eax]
jmp 0x3008183e
cmp byte [edi + eax], 7
mov ecx, dword [ebp - 0xc90]
mov eax, dword [esi + 0x2c]
push dword [eax + ecx]
push esi
jae 0x30081828
call fcn.3007fa0b
mov ecx, dword [ebp - 0xc8c]
movzx ecx, byte [edi + ecx]
movzx eax, al
lea eax, [ecx + eax*8 + 0x100]
jmp 0x30081837
call fcn.3007fa0b
movzx eax, al
lea eax, [eax*8 + 0x107]
add dword [ebp - 0xc90], 4
inc dword [ebp - 0xc8c]
lea eax, [ebp + eax*2 - 0x644]
inc word [eax]
dec dword [ebp - 0xc98]
jne 0x30081754
pop ebx
xor esi, esi
xor edi, edi
cmp dword [ebp - 0xc9c], esi
jbe 0x300818d4
movzx eax, word [ebp + esi*2 - 0xc84]
cmp ax, 0x100
movzx eax, ax
jae 0x30081881
movzx eax, byte [eax + 0x30024720]
jmp 0x3008188e
shr eax, 8
movzx eax, byte [eax + 0x30024720]
add eax, 8
movzx ecx, word [ebp + esi*2 - 0x644]
cmp cx, 0x100
movzx ecx, cx
jae 0x300818a9
movzx ecx, byte [ecx + 0x30024720]
jmp 0x300818b6
shr ecx, 8
movzx ecx, byte [ecx + 0x30024720]
add ecx, 8
mov eax, dword [eax*4 + 0x300246d8]
sub eax, dword [ecx*4 + 0x300246d8]
cdq
xor eax, edx
sub eax, edx
add edi, eax
inc esi
cmp esi, dword [ebp - 0xc9c]
jb 0x30081867
mov eax, edi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.300696c7
leave
ret 0x14
Function at 0x407ab3
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x407ad3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040b8ea
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x407af4
test byte [esp + 8], 2
je 0x407af4
mov dword [0x413548], 0xd
mov dword [0x41354c], 5
jmp 0x407acf
xor eax, eax
ret

Function at 0x407b1c
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x40f578
call fcn.0040aa38
mov edi, 0x94
mov eax, edi
call fcn.00406850
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x413554], ecx
mov eax, dword [esi + 4]
mov dword [0x413560], eax
mov edx, dword [esi + 8]
mov dword [0x413564], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x413558], esi
cmp ecx, 2
je 0x407b7c
or esi, 0x8000
mov dword [0x413558], esi
shl eax, 8
add eax, edx
mov dword [0x41355c], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x407bb7
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x407bb7
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x407bcf
cmp eax, 0x20b
je 0x407bbc
mov dword [ebp - 0x1c], esi
jmp 0x407be3
cmp dword [ecx + 0x84], 0xe
jbe 0x407bb7
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x407bdd
cmp dword [ecx + 0x74], 0xe
jbe 0x407bb7
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push esi
call fcn.00408912
pop ecx
test eax, eax
jne 0x407c0f
cmp dword [0x41351c], 1
jne 0x407bfc
call fcn.0040bac0
push 0x1c
call fcn.0040b949
push 0xff
call fcn.00408669
pop ecx
pop ecx
call fcn.0040c275
mov dword [ebp - 4], esi
call fcn.0040c0ca
test eax, eax
jge 0x407c28
push 0x1b
call fcn.00407af7
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x414ab8], eax
call fcn.0040bfa8
mov dword [0x413514], eax
call fcn.0040bf06
test eax, eax
jge 0x407c4e
push 8
call fcn.00407af7
pop ecx
call fcn.0040bcd3
test eax, eax
jge 0x407c5f
push 9
call fcn.00407af7
pop ecx
call fcn.00408699
mov dword [ebp - 0x20], eax
cmp eax, esi
je 0x407c72
push eax
call fcn.00407af7
pop ecx
mov dword [ebp - 0x38], esi
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.0040bc6a
mov dword [ebp - 0x68], eax
test byte [ebp - 0x38], 1
je 0x407c93
movzx eax, word [ebp - 0x34]
jmp 0x407c96
push 0xa
pop eax
push eax
push dword [ebp - 0x68]
push esi
push esi
call edi
push eax
call fcn.00404fc0
mov edi, eax
mov dword [ebp - 0x6c], edi
cmp dword [ebp - 0x1c], esi
jne 0x407cb4
push edi
call fcn.004087c0
call fcn.004087e2
jmp 0x407ce6
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.0040aa73
ret
Function at 0x4086fe
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
inc esi
cmp dword [0x413594], esi
push edi
jne 0x40871e
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [ebp + 0xc], 0
mov al, byte [ebp + 0x10]
mov dword [0x413590], esi
mov byte [0x41358c], al
jne 0x408784
mov ecx, dword [0x414aac]
test ecx, ecx
je 0x408765
mov eax, dword [0x414aa8]
sub eax, 4
cmp eax, ecx
jmp 0x40875e
mov eax, dword [eax]
test eax, eax
je 0x408750
call eax
mov eax, dword [0x414aa8]
sub eax, 4
cmp eax, dword [0x414aac]
mov dword [0x414aa8], eax
jae 0x408748
mov eax, 0x412024
mov esi, 0x41202c
cmp eax, esi
mov edi, eax
jae 0x408784
mov eax, dword [edi]
test eax, eax
je 0x40877d
call eax
add edi, 4
cmp edi, esi
jb 0x408775
mov eax, 0x412030
mov esi, 0x412038
cmp eax, esi
mov edi, eax
jae 0x4087a3
mov eax, dword [edi]
test eax, eax
je 0x40879c
call eax
add edi, 4
cmp edi, esi
jb 0x408794
cmp dword [ebp + 0x10], 0
pop edi
pop esi
jne 0x4087be
push dword [ebp + 8]
mov dword [0x413594], 1
call fcn.00408669
pop ecx
pop ebp
ret

Function at 0x40a70b
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
push 4
pop eax
call fcn.00406850
mov ebx, esp
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40a7a0
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x44]
lea esi, [eax - 1]
not esi
and esi, ebx
sub esi, eax
mov dword [ebp - 4], eax
mov eax, dword [0x413554]
mov ecx, eax
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0xffff1000
add ecx, reloc.KERNEL32.dll_GetModuleHandleA
add ecx, edi
cmp esi, ecx
jb 0x40a7a0
cmp eax, 1
je 0x40a7b8
mov ebx, edi
mov edi, 0x1000
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40a7a0
add ebx, dword [ebp - 0x18]
test dword [ebp - 0x14], edi
je 0x40a775
test byte [ebp - 0xf], 1
mov ebx, dword [ebp - 0x24]
je 0x40a79c
xor eax, eax
inc eax
jmp 0x40a7d4
cmp esi, ebx
jae 0x40a7a4
xor eax, eax
jmp 0x40a7d4
push 4
push edi
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x413554]
jmp 0x40a7ba
mov ebx, esi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 8]
push ecx
inc eax
push eax
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x54]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42d470
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4b51db
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.004a7079
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x42d4f2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.004a4084
mov eax, dword [eax]
push 0x7f7244
push eax
call fcn.00496784
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004a7304
test bl, bl
je 0x42d4f2
push 0x7f7244
lea ecx, [esp + 0xc]
call fcn.004a76e0
push 0x7fadd8
lea ecx, [esp + 0xc]
call fcn.004a76e0
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x42d52e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004a7304
jmp 0x42d5f9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x42d5b2
lea edx, [esp + 0x7c]
push 0x7fadd4
push edx
call fcn.00496784
add esp, 8
test eax, eax
je 0x42d5b2
lea eax, [esp + 0x7c]
push 0x7fadd0
push eax
call fcn.00496784
add esp, 8
test eax, eax
je 0x42d5b2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x42d542
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004a7304
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x42e850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x42e8b2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc