joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4918d3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x5b42a0
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x40
cmp dword [0x607948], 1
jge 0x5b430f
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
je 0x5b42e5
mov edx, dword [ebx + 8]
movzx eax, word [edx]
movzx ecx, word [ebx + 0xc]
cmp eax, ecx
je 0x5b42e5
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x5b42c2
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x5b42fb
mov eax, dword [ebx + 8]
mov dword [ebp - 4], eax
jmp 0x5b4302
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
jmp 0x5b43ff
movzx ecx, word [ebx + 0xc]
movd xmm0, ecx
movaps xmmword [ebp - 0x30], xmm0
pshuflw xmm0, xmmword [ebp - 0x30], 0
movaps xmmword [ebp - 0x30], xmm0
pshufd xmm0, xmmword [ebp - 0x30], 0
movaps xmmword [ebp - 0x30], xmm0
mov edx, dword [ebx + 8]
and edx, 0xfff
cmp edx, 0xff0
ja 0x5b43d0
mov eax, dword [ebx + 8]
movups xmm0, xmmword [eax]
movaps xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pxor xmm0, xmmword [ebp - 0x20]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pcmpeqw xmm0, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x40]
pcmpeqw xmm0, xmmword [ebp - 0x30]
movaps xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [ebp - 0x20]
por xmm0, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pmovmskb ecx, xmm0
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x5b43c5
bsf edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebx + 8]
mov dword [ebx + 8], eax
mov ecx, dword [ebx + 8]
movzx edx, word [ecx]
movzx eax, word [ebx + 0xc]
cmp edx, eax
jne 0x5b43b9
mov ecx, dword [ebx + 8]
mov dword [ebp - 0xc], ecx
jmp 0x5b43c0
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
jmp 0x5b43ff
mov edx, dword [ebx + 8]
add edx, 0x10
mov dword [ebx + 8], edx
jmp 0x5b43fa
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x5b43e3
mov eax, dword [ebx + 8]
jmp 0x5b43ff
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
jne 0x5b43f1
xor eax, eax
jmp 0x5b43ff
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x5b432f
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret

Function at 0x4940ba
Capabilities:
Query environment variable

Disassembly:
jmp 0x5990c0
mov edi, edi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x5990d4
xor edi, edi
jmp 0x599118
push ebx
push esi
call fcn.00598fb6
push 0x40
mov ebx, eax
push str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
sub ebx, esi
and ebx, 0xfffffffe
push 2
push ebx
call fcn.004949e3
mov edi, eax
add esp, 0x14
test edi, edi
je 0x599105
push ebx
push esi
push edi
call fcn.00494245
add esp, 0xc
push 2
push 0
call fcn.00495299
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
pop ebx
mov eax, edi
pop edi
pop esi
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x40121a
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x401243
mov al, byte [esi + 1]
inc esi
test al, al
je 0x40123b
cmp al, 0x22
jne 0x40122f
cmp byte [esi], 0x22
jne 0x40124d
inc esi
jmp 0x40124d
cmp al, 0x20
jle 0x40124d
inc esi
cmp byte [esi], 0x20
jg 0x401247
mov al, byte [esi]
test al, al
je 0x401257
cmp al, 0x20
jle 0x401240
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00401bda
push 0x403004
push section..data
call fcn.00401bc0
test byte [ebp - 0x18], 1
pop ecx
pop ecx
je 0x401287
movzx eax, word [ebp - 0x14]
jmp 0x40128a
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov esi, eax
call fcn.00401bf2
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x4013d0
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ebp, esp
add esp, 0xfffffffc
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [0x40334c], eax
lea ecx, [ebp - 4]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
mov eax, dword [ebp + 4]
mov dword [0x40319d], eax
xor eax, eax
mov ecx, 0x16
push eax
dec ecx
jne 0x401401
push 0x7f00
push esi
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push esi
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [ebp - 0x5c]
push ecx
mov eax, 0x30
mov dword [ecx], eax
mov eax, dword [0x40319d]
mov dword [ebp - 0x48], eax
mov eax, 0x4018d6
mov dword [ebp - 0x54], eax
mov ecx, str.secondclass
mov dword [ebp - 0x34], ecx
call dword [sym.imp.USER32.dll_RegisterClassExA]
push str.Riched32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor ecx, ecx
push ecx
push dword [0x40319d]
push ecx
push ecx
push 0x12e
push 0x7a
push 0x34c
push 0x2aa
push 0x40000
lea eax, str.bytesma
push eax
mov eax, 0x4030f5
push eax
push ecx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [0x403398], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x403398]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
xor ebx, ebx
lea edi, [ebp - 0x50]
jmp 0x4014b5
push edi
call dword [sym.imp.USER32.dll_TranslateMessage]
push edi
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
push ebx
push edi
call dword [sym.imp.USER32.dll_GetMessageA]
test al, al
jne 0x4014a7
mov esp, ebp
ret
Function at 0x40184f
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40188e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40188e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40188e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40188e
cmp dword [ecx + 0x74], 0xe
jbe 0x40188e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x416bd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, edx
mov edx, dword [esp + 0x14]
mov ebp, dword [esp + 0x20]
xor esi, esi
lea edx, [eax + edx*2]
movzx ebx, byte [eax + 1]
cmp byte [eax], ch
lea eax, [eax + 2]
lea edi, [esi + ebx]
jne 0x416c20
cmp esi, edi
ja 0x416c88
cmp edi, dword [esp + 0x1c]
ja 0x416c9b
add esi, dword [esp + 0x18]
nop word [eax + eax]
test ebx, ebx
je 0x416c22
dec ebx
cmp byte [esi], cl
lea esi, [esi + 1]
jne 0x416c10
jmp 0x416c7f
ja 0x416c28
cmp eax, edx
mov esi, edi
jne 0x416be3
mov edi, dword [esp + 0x24]
movzx ecx, cx
mov al, 1
add edi, ebp
nop word cs:[eax + eax]
nop dword [eax]
movzx edx, byte [ebp]
lea esi, [ebp + 1]
test dl, dl
js 0x416c60
mov ebp, esi
sub ecx, edx
jns 0x416c77
jmp 0x416c81
cmp esi, edi
je 0x416cb0
movzx esi, byte [ebp + 1]
and edx, 0x7f
add ebp, 2
shl edx, 8
or edx, esi
sub ecx, edx
js 0x416c81
xor al, 1
cmp ebp, edi
jne 0x416c40
jmp 0x416c81
xor eax, eax
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
mov edx, edi
push 0xc08bf4
call fcn.0044abd0
add esp, 4
ud2
mov edx, dword [esp + 0x1c]
mov ecx, edi
push 0xc08bf4
call fcn.0044a9c0
add esp, 4
ud2
mov ecx, 0xc0cf5c
mov edx, 0x2b
push 0xc08be4
call fcn.0044aa30
add esp, 4
ud2
Function at 0x441131
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [0x44c094]
test eax, eax
je 0x441170
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x441170
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x441170
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x441170
cmp dword [ecx + 0x74], 0xe
jbe 0x441170
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x118a9e0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov ebx, dword [eax + edi + 0x18]
test edx, 0x478e668b
cmc
test edi, esp
test ebx, ebx
jmp 0x1151669
cmp ecx, dword [eax + edi + 0x14]
jae 0x22581d6
mov edx, dword [eax + edi + 0x1c]
cmc
cmp bx, si
lea ecx, [edx + ecx*4]
mov ecx, dword [ecx + edi]
cmp sp, cx
test ecx, ecx
jmp 0x1120591
jne 0x114945b
mov eax, dword [edx + 0x78]
mov dword [ebp - 4], eax
test eax, eax
jmp 0x1136993
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + edi + 0x24]
movzx ax, ah
movsx ecx, sp
mov ah, bh
lea eax, [edx + esi*2]
cwd
not dh
movzx ecx, word [eax + edi]
movsx edx, di
jmp 0x116414c
je 0x114945b
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x114945b
mov eax, 0x5a4d
cmp edi, 0x75fc2545
jmp 0x1101ef4
jle 0x112a2dc
je 0x10895cb
cmp eax, 1
jmp 0x1111ad0
cmp dword [ebp + 8], ebx
jmp 0x1090baf
ret
lea ebx, [esi - 1]
jmp 0x1099cc2
mov dword [ebp + 8], 0
mov dword [ebp - 0xc], edx
test ebx, ebp
jmp 0x117fc4a
je 0x10da8dd
test eax, eax
jmp 0x1093583
mov dword [ebp - 8], ecx
jmp 0x110f645
cmp word [edi], ax
jmp 0x1149455
jmp 0x1099cc2
mov dword [ebp + 8], edx
jmp 0x1101f7c
jne 0x1099cc2
inc esi
jmp 0x13fce8a
mov esp, ebp
pop ebp
jmp 0x1124957
jne 0x21de680
pop esi
xor edi, eax
sal ebx, 0xe
pop ebx
shld di, di, 0x65
rcl di, 0xb2
rol di, 0x61
xor eax, eax
mov edi, 0x5a263135
pop edi
jmp 0x111cae0
ret
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
or esi, 0x6ce37281
cmp si, 0x75c9
lea esi, [ebx + eax]
movsx eax, sp
adc eax, esp
mov eax, dword [ebp + 0x10]
stc
test cx, si
push eax
shl ax, 0xa8
xadd ax, ax
rcl ax, 0xb5
sar esi, 1
rol eax, cl
mov eax, dword [edx + esi*4]
test ch, dl
cmc
cmp ah, 0xbc
add eax, edi
jmp 0x21d57d3
je 0x114945b
mov edx, dword [edx + 0x7c]
clc
cmp esp, 0x5da26251
push ebx
jmp 0x116d4bd
je 0x2256861
sub eax, eax
xchg di, di
not di
pop edi
jmp 0x1192c3b
je 0x1090bbf
mov edx, dword [eax + edi + 0x20]
dec ebx
test ax, sp
add edx, edi
jmp 0x10e1202
lea edx, [ebx + 1]
jmp 0x10ea5a0
ja 0x106d527
sub ecx, dword [eax + edi + 0x10]
jmp 0x1078ff4
push esi
or esi, 0xffffffff
clc
test bx, 0xcd2
stc
mov dword [ebp - 0x10], edx
mov dword [ebp - 8], esi
stc
cmp bp, 0x6fe
cmp ecx, 0xffff
jmp 0x116be1a
test ebx, ebx
jmp 0x13cd875
push ebp
mov ebp, esp
stc
cmp al, dh
sub esp, 0x114
stc
test di, 0x20ce
push edi
bts edi, edi
mov edi, dword [ebp + 8]
cmp dx, si
test edi, edi
jmp 0x108c9d0
mov esp, ebp
pop ebp
jmp 0x10c2ad3
add edx, edi
clc
cmp dword [edx], 0x4550
jmp 0x1085d67
jl 0x1090bbf
jmp 0x112a2e2
mov dword [ebp + 8], esi
jmp 0x2259c8a
call fcn.0114df17
add esp, 4
cmp eax, 0xffffffff
jmp 0x10ea22b
mov edx, dword [edi + 0x3c]
jmp 0x13bd8e3
jmp 0x1099cc2
Function at 0x1006277
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push 0x1001318
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10062cf
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
push dword [ebp + 8]
push esi
push esi
push 0x1001354
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10062c2
push 1
pop esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x10062d1
xor eax, eax
pop esi
leave
ret 4

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x11001d10
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 8], 0
jne 0x11001d33
push 0x135
push 0x11195124
push 0x1119511c
call fcn.11029a70
add esp, 0xc
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [esi + 8]
push eax
push ecx
push edx
call dword [sym.imp.uSEr32.dll_GetWindowTextA]
pop esi
pop ebp
ret 8
Function at 0x11009500
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1117e178
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x111ec774]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov esi, dword [ebp + 0x10]
push 8
push 0x11195ce4
push esi
mov edi, 0x11195cdc
call fcn.11163dec
add esp, 0xc
test eax, eax
je 0x11009556
push 7
push edi
push esi
call fcn.11163dec
add esp, 0xc
test eax, eax
jne 0x1100955b
mov edi, 0x11195264
lea ecx, [ebp - 0x20]
call fcn.110d1930
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push esi
push esi
push edi
push eax
push ecx
lea edx, [ebp - 0x20]
push 0x11195b50
push edx
mov dword [ebp - 4], 0
call fcn.110d1540
mov eax, dword [ebp - 0x20]
mov edx, dword [eax]
add esp, 0x1c
lea ecx, [ebp - 0x20]
mov dword [ebp + 0x10], 0
call edx
test al, al
jne 0x110095b2
push 0x253
push 0x11195b24
push 0x11195b1c
call fcn.11029a70
add esp, 0xc
mov eax, dword [ebp - 0x20]
mov edx, dword [eax]
mov esi, dword [ebp - 0x18]
lea ecx, [ebp - 0x20]
call edx
test al, al
jne 0x110095da
push 0x255
push 0x11195b24
push 0x11195b1c
call fcn.11029a70
add esp, 0xc
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
push 0
lea eax, [ebp + 0x10]
push eax
mov eax, dword [edx]
push esi
push ecx
push eax
call dword [sym.imp.KeRneL32.DLl_WriteFile]
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0xffffffff
call fcn.110d0a10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x11009620
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1117e178
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x111ec774]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [ebp - 0x20]
call fcn.110d1930
push 0x11195264
lea eax, [ebp - 0x20]
push 0x11195db0
push eax
mov dword [ebp - 4], 0
call fcn.110d1540
mov edx, dword [ebp - 0x20]
mov eax, dword [edx]
add esp, 0xc
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x10], 0
call eax
test al, al
jne 0x1100969a
push 0x253
push 0x11195b24
push 0x11195b1c
call fcn.11029a70
add esp, 0xc
mov edx, dword [ebp - 0x20]
mov eax, dword [edx]
mov edi, dword [ebp - 0x18]
lea ecx, [ebp - 0x20]
call eax
test al, al
jne 0x110096c2
push 0x255
push 0x11195b24
push 0x11195b1c
call fcn.11029a70
add esp, 0xc
mov edx, dword [ebp - 0x14]
mov eax, dword [esi]
push 0
lea ecx, [ebp - 0x10]
push ecx
push edi
mov edi, dword [sym.imp.KeRneL32.DLl_WriteFile]
push edx
push eax
call edi
mov edx, dword [esi]
push 0
lea ecx, [ebp - 0x10]
push ecx
push 0xb9
push 0x11195cf0
push edx
call edi
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0xffffffff
call fcn.110d0a10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x11009740
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x111ec774]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x228], ecx
mov dword [ecx + 4], eax
mov byte [ebp - 0x18], 0
call fcn.110b7df0
mov esi, dword [sym.imp.uSEr32.dll_wsprintfA]
test eax, eax
je 0x11009784
push eax
lea ecx, [ebp - 0x18]
push 0x11195fc0
push ecx
call esi
add esp, 0xc
lea edx, [ebp - 0x18]
push edx
push 0x11195fb0
lea eax, [ebp - 0x220]
push 0x11195fa4
push eax
call esi
mov ebx, dword [sym.imp.KeRneL32.DLl_CreateFileA]
add esp, 0x10
xor eax, eax
mov dword [ebp - 0x224], eax
jmp 0x110097b6
mov eax, dword [ebp - 0x224]
test eax, eax
jne 0x110097dc
push eax
call fcn.111457a0
lea edx, [ebp - 0x11c]
add esp, 4
sub edx, eax
jmp 0x110097d0
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x110097d0
jmp 0x1100983c
cmp eax, 1
jne 0x110097f5
lea ecx, [ebp - 0x11c]
push ecx
push 0x104
call dword [sym.imp.KeRneL32.DLl_GetTempPathA]
jmp 0x1100983c
push 0
call fcn.111457a0
lea edx, [ebp - 0x11c]
add esp, 4
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x11009807
lea eax, [ebp - 0x11c]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x11009818
mov edx, dword [0x11195f9c]
mov cx, word [0x11195fa0]
mov dword [eax], edx
mov dl, byte [0x11195fa2]
mov word [eax + 4], cx
mov byte [eax + 6], dl
lea eax, [ebp - 0x220]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x11009844
lea edi, [ebp - 0x11c]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x11009854
mov ecx, eax
shr ecx, 2
push 0
rep movsd dword es:[edi], dword [esi]
push 0x80
push 2
push 0
push 0
mov ecx, eax
push 0x40000000
lea eax, [ebp - 0x11c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call ebx
cmp eax, 0xffffffff
jne 0x110098b5
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
cmp eax, 3
jl 0x110097b0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.11162bb7
mov esp, ebp
pop ebp
ret 4
mov esi, dword [ebp - 0x228]
mov dword [esi], eax
lea eax, [ebp - 0x11c]
lea edx, [esi + 8]
mov ecx, eax
sub edx, ecx
lea ebx, [ebx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x110098d0
mov ecx, esi
call fcn.11009620
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.11162bb7
mov esp, ebp
pop ebp
ret 4
Function at 0x1100d5e0
Capabilities:
Check os version

Disassembly:
cmp dword [0x111ede6c], 0
jne 0x1100d616
call dword [sym.imp.KeRneL32.DLl_GetVersion]
cmp al, 5
jbe 0x1100d619
push 0x11196970
call dword [sym.imp.KeRneL32.DLl_LoadLibraryA]
mov dword [0x111ede6c], eax
test eax, eax
jne 0x1100d60d
mov eax, 2
ret
call fcn.1100d4c0
test eax, eax
jne 0x1100d618
xor eax, eax
ret
mov eax, 1
ret

Function at 0x1100d690
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2ec
mov eax, dword [0x111ec774]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2a8]
push eax
call fcn.110ee230
add esp, 4
test eax, eax
je 0x1100d78d
push 0
push 0
push 0
lea ecx, [ebp - 0x2a8]
push ecx
call dword [sym.imp.KeRneL32.DLl_CreateEventA]
push 0x104
lea edx, [ebp - 0x108]
push edx
push 0
mov dword [0x111ede44], eax
call dword [sym.imp.KeRneL32.DLl_GetModuleFileNameA]
lea eax, [ebp - 0x108]
push 0x5c
push eax
call fcn.111640b0
add esp, 8
test eax, eax
je 0x1100d6ff
mov byte [eax + 1], 0
call dword [sym.imp.KeRneL32.DLl_GetCurrentProcessId]
mov ecx, dword [0x111ede44]
push eax
push ecx
lea edx, [ebp - 0x108]
push edx
lea eax, [ebp - 0x28c]
push 0x11196a40
push eax
call dword [sym.imp.uSEr32.dll_wsprintfA]
push 0x44
lea ecx, [ebp - 0x2ec]
push 0
push ecx
call fcn.11162be0
add esp, 0x20
lea edx, [ebp - 0x29c]
push edx
lea eax, [ebp - 0x2ec]
push eax
push 0
push 0
push 0x4000000
push 1
push 0
push 0
lea ecx, [ebp - 0x28c]
push ecx
push 0
mov dword [ebp - 0x2ec], 0x44
call dword [sym.imp.KeRneL32.DLl_CreateProcessA]
test eax, eax
je 0x1100d78d
mov edx, dword [ebp - 0x29c]
push esi
mov esi, dword [sym.imp.KeRneL32.DLl_CloseHandle]
push edx
call esi
mov eax, dword [ebp - 0x298]
push eax
call esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.11162bb7
mov esp, ebp
pop ebp
ret
Function at 0x1100e980
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1117e3ab
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x111ec774]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], 0x11196b7c
call fcn.11161bd4
push 4
mov dword [ebp - 4], 0
call fcn.111101b0
mov edi, eax
add esp, 4
test edi, edi
je 0x1100ea00
call fcn.1116183d
mov dword [edi], eax
call fcn.111615fc
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.11161531
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x1100e9f6
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.11161559
jmp 0x1100ea02
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x110155c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1117eca6
mov eax, dword fs:[0]
push eax
sub esp, 0x93c
mov eax, dword [0x111ec774]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 0x940], ebx
mov ecx, 0x16
mov esi, 0x11197620
lea edi, [ebp - 0x134]
rep movsd dword es:[edi], dword [esi]
cmp dword [ebp - 0x940], ebx
jle 0x11015632
lea eax, [ebp - 0x134]
dec eax
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x11015617
mov cx, word [0x1119761c]
mov dl, byte [0x1119761e]
mov word [eax], cx
mov byte [eax + 2], dl
lea ecx, [ebp - 0x93c]
call fcn.110ed130
push 0x20019
lea eax, [ebp - 0x134]
push eax
push reloc.wsOcK32.dll_bind
lea ecx, [ebp - 0x93c]
mov dword [ebp - 4], ebx
call fcn.110ed520
test eax, eax
jne 0x11015735
mov esi, 1
lea esp, [esp]
push esi
lea ecx, [ebp - 0x30]
push 0x11197614
push ecx
call dword [sym.imp.uSEr32.dll_wsprintfA]
add esp, 0xc
lea ecx, [ebp - 0x938]
call fcn.110ed130
mov eax, dword [ebp - 0x93c]
push 0x20019
lea edx, [ebp - 0x30]
push edx
push eax
lea ecx, [ebp - 0x938]
mov byte [ebp - 4], 1
call fcn.110ed520
test eax, eax
jne 0x1101571a
push 0x800
lea ecx, [ebp - 0x934]
push ebx
push ecx
call fcn.11162be0
add esp, 0xc
lea edx, [ebp - 0x944]
push edx
mov edx, dword [ebp - 0x938]
lea eax, [ebp - 0x934]
push eax
lea ecx, [ebp - 0x948]
push ecx
push ebx
push 0x11197600
push edx
mov dword [ebp - 0x944], 0x800
mov dword [ebp - 0x948], ebx
call dword [sym.imp.aDvapi32.DLL_RegQueryValueExA]
test eax, eax
jne 0x1101571a
lea eax, [ebp - 0x934]
push 0x111975f8
push eax
call fcn.11129e00
add esp, 8
test eax, eax
jne 0x1101577b
lea ecx, [ebp - 0x938]
mov byte [ebp - 4], bl
call fcn.110edb10
inc esi
cmp esi, 0x3e7
jl 0x11015670
lea ecx, [ebp - 0x93c]
mov dword [ebp - 4], 0xffffffff
call fcn.110edb10
mov eax, dword [ebp - 0x940]
inc eax
mov dword [ebp - 0x940], eax
cmp eax, 2
jl 0x110155f6
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.11162bb7
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x938]
mov byte [ebp - 4], bl
call fcn.110edb10
lea ecx, [ebp - 0x93c]
mov dword [ebp - 4], 0xffffffff
call fcn.110edb10
mov eax, 1
jmp 0x1101575f