joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101b275
Capabilities:
Create udp socket
Get local ipv4 addresses
Get socket information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x1020128]
and dword [ebp - 0x38], 0
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
push 0x10078e8
mov dword [ebp - 0x40], eax
call fcn.01019fa3
pop ecx
push 0
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [ebp - 0x3c], eax
je 0x101b40f
mov esi, dword [sym.imp.WS2_32.dll_htonl]
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x7f000001
mov word [ebp - 0x14], 2
call esi
mov ebx, dword [sym.imp.WS2_32.dll_htons]
push 0x8ba
mov dword [ebp - 0x10], eax
call ebx
mov word [ebp - 0x12], ax
push 0x10
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x3c]
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
je 0x101b30a
push 0x10078c4
mov dword [ebp - 0x38], 1
call fcn.01019fa3
pop ecx
push dword [ebp - 0x3c]
call dword [sym.imp.WS2_32.dll_closesocket]
xor edi, edi
cmp dword [ebp - 0x38], edi
je 0x101b40f
push edi
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [ebp - 0x3c], eax
jne 0x101b344
push 0x10078a8
mov dword [ebp - 0x38], edi
call fcn.01019fa3
pop ecx
jmp 0x101b3f5
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor edi, edi
push edi
mov word [ebp - 0x14], 2
call esi
push edi
mov dword [ebp - 0x10], eax
call ebx
push 0x10
pop esi
mov word [ebp - 0x12], ax
push esi
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x3c]
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
je 0x101b387
push 0x100787c
call fcn.01019fa3
pop ecx
mov dword [ebp - 0x38], edi
jmp 0x101b3f5
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x3c]
mov dword [ebp - 0x48], esi
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x101b3a6
push 0x1007850
jmp 0x101b37c
push 1
lea eax, [ebp - 0x14]
push eax
call fcn.0101b099
test eax, eax
jne 0x101b3bc
push 0x1007824
jmp 0x101b37c
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x32]
push edi
call fcn.0101abca
test eax, eax
je 0x101b3e3
push 0x1005f48
mov dword [ebp - 0x38], edi
call fcn.01019fd7
jmp 0x101b33e
mov edi, dword [ebp - 0x40]
push dword [ebp - 0x44]
lea esi, [ebp - 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0101af1f
cmp dword [ebp - 0x3c], 0xffffffff
je 0x101b404
push dword [ebp - 0x3c]
call dword [sym.imp.WS2_32.dll_closesocket]
cmp dword [ebp - 0x38], 0
mov eax, 0x10077c0
jne 0x101b414
mov eax, 0x10077b8
push eax
push 0x10077c8
call fcn.01019fa3
mov eax, dword [ebp - 0x38]
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01017bb1
leave
ret 4
Function at 0x101b742
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
xor edi, edi
mov dword [ebp - 8], edi
call fcn.0101b6c2
mov esi, eax
cmp esi, edi
jne 0x101b7e9
call fcn.0101b6f2
cmp eax, edi
mov dword [ebp - 8], eax
je 0x101b787
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 8]
push 0x1007930
call fcn.010174c4
jmp 0x101b78d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.0101b6e0
cmp esi, edi
jne 0x101b7e9
lea eax, [ebp - 4]
push eax
push 0x2001b
push edi
push 0x1001c40
push 0x80000002
mov dword [ebp - 4], edi
mov dword [ebp - 0xc], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, edi
jne 0x101b7db
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push edi
push 0x10079c0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
cmp dword [ebp - 4], edi
je 0x101b7e9
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], edi
je 0x101b7f8
lea eax, [ebp - 8]
push eax
call dword [sym.imp.RPCRT4.dll_RpcStringFreeW]
pop edi
mov eax, esi
pop esi
leave
ret

Function at 0x101b803
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
call fcn.0101b6c2
mov esi, eax
xor edi, edi
cmp esi, edi
jne 0x101b87d
push edi
push edi
push 0x1007930
call fcn.010174c4
mov esi, eax
call fcn.0101b6e0
cmp esi, edi
jne 0x101b87d
lea eax, [ebp - 4]
push eax
push 0x2001b
push edi
push 0x1001c40
push 0x80000002
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, edi
jne 0x101b86f
push 4
lea eax, [ebp - 8]
push eax
push 4
push edi
push 0x10079c0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
cmp dword [ebp - 4], edi
je 0x101b87d
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
leave
ret
Function at 0x101b888
Capabilities:
Encrypt data using rc4 via winapi
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor ebx, ebx
push edi
xor edi, edi
cmp dword [ebp + 0xc], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
je 0x101b95b
cmp dword [0x1020b28], ebx
je 0x101b95b
cmp dword [ebp + 8], ebx
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
je 0x101b8f5
push dword [ebp + 8]
call esi
push dword [ebp + 0xc]
mov edi, eax
call esi
add edi, eax
lea eax, [edi + edi + 2]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
cmp edi, ebx
je 0x101b963
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push 0x8003
push dword [0x1020b28]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x101b953
cmp edi, ebx
push ebx
je 0x101b91e
push edi
call esi
shl eax, 1
push eax
push edi
jmp 0x101b929
push dword [ebp + 0xc]
call esi
shl eax, 1
push eax
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
cmp eax, ebx
je 0x101b953
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp - 4]
push 0x6801
push dword [0x1020b28]
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x101b963
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x101b963
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [ebp - 4], ebx
je 0x101b971
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
cmp edi, ebx
je 0x101b97c
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x101b98b
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
call fcn.0101b6c2
test eax, eax
mov dword [ebp - 4], eax
jne 0x101b9ea
cmp dword [0x1020b28], eax
jne 0x101b9e5
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
push edi
push eax
push 1
push 0x1007a08
mov ebx, 0x10079d8
push ebx
mov edi, 0x1020b28
push edi
call esi
test eax, eax
jne 0x101b9e2
push 8
push 1
push 0x1007a08
push ebx
push edi
call esi
test eax, eax
jne 0x101b9e2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
pop edi
pop esi
pop ebx
call fcn.0101b6e0
mov eax, dword [ebp - 4]
leave
ret
Function at 0x101bd79
Capabilities:
Compare security identifiers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
push edi
lea eax, [ebp - 4]
push eax
xor edi, edi
push edi
push edi
push 1
push ebx
mov dword [ebp - 4], edi
call esi
mov eax, dword [ebp - 4]
cmp eax, edi
jne 0x101bdad
push ebx
xor esi, esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x101bdfd
push eax
push 0x40
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
jne 0x101bdca
push ebx
xor esi, esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x101bdf2
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push edi
push 1
push ebx
call esi
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 1
jne 0x101bdf2
push dword [ebp + 0xc]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov esi, eax
test edi, edi
je 0x101bdfd
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x101be3f
Capabilities:
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
push 0xf0000000
xor ebx, ebx
push 1
push ebx
push ebx
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x101beb9
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push 0x8004
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x101beb9
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x101beb9
mov edi, dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push 4
pop eax
push ebx
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push eax
push dword [ebp - 8]
mov dword [ebp - 0x14], eax
call edi
test eax, eax
jne 0x101bec6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x101bf76
push esi
push dword [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
push 0x40
call esi
cmp eax, ebx
mov dword [ebp + 0xc], eax
je 0x101beec
push ebx
lea ecx, [ebp - 0xc]
push ecx
push eax
push 2
push dword [ebp - 8]
call edi
test eax, eax
jne 0x101bef6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x101bf67
lea eax, [ebp - 4]
push eax
push ebx
push dword [ebp - 0xc]
push dword [ebp + 0xc]
call fcn.0101c2f7
mov edi, eax
cmp edi, ebx
jne 0x101bf67
mov eax, dword [ebp - 4]
inc eax
push eax
push 0x40
call esi
mov esi, eax
cmp esi, ebx
jne 0x101bf25
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x101bf5c
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp - 0xc]
push dword [ebp + 0xc]
call fcn.0101c2f7
mov edi, eax
cmp edi, ebx
jne 0x101bf5c
mov eax, dword [ebp - 4]
add eax, esi
cmp byte [eax - 1], 0xa
jne 0x101bf53
cmp byte [eax - 2], 0xd
jne 0x101bf53
mov byte [eax - 2], bl
sub dword [ebp - 4], 2
mov ecx, dword [ebp + 0x10]
push esi
call fcn.0100b223
cmp esi, ebx
je 0x101bf67
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp + 0xc], ebx
pop esi
je 0x101bf76
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 8], ebx
je 0x101bf84
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
cmp dword [ebp - 0x10], ebx
je 0x101bf93
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, edi
pop edi
pop ebx
leave
ret 0xc
Function at 0x101c2f7
Capabilities:
Encode data using base64

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
push 3
xor edx, edx
pop ecx
lea eax, [esi + 2]
div ecx
mov ecx, dword [ebp + 0x10]
shl eax, 2
test ecx, ecx
jne 0x101c323
lea ecx, [eax + 0x3f]
shr ecx, 6
lea ecx, [eax + ecx*2]
jmp 0x101c3f4
and dword [ebp - 4], 0
test esi, esi
jle 0x101c3ec
push ebx
push edi
cmp dword [ebp - 4], 0x10
jne 0x101c343
and dword [ebp - 4], 0
mov byte [ecx], 0xd
inc ecx
mov byte [ecx], 0xa
inc ecx
inc dword [ebp - 4]
xor eax, eax
lea edi, [ebp + 0xc]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 8]
inc dword [ebp + 8]
cmp esi, 1
mov al, byte [eax]
jbe 0x101c378
mov edx, dword [ebp + 8]
mov dl, byte [edx]
inc dword [ebp + 8]
cmp esi, 2
mov byte [ebp + 0xd], dl
jbe 0x101c378
mov edx, dword [ebp + 8]
mov bl, byte [edx]
inc dword [ebp + 8]
mov byte [ebp + 0xe], bl
jmp 0x101c37b
mov bl, byte [ebp + 0xe]
movzx eax, al
mov edx, eax
shr edx, 2
mov dl, byte [edx + 0x1007cc0]
mov byte [ecx], dl
movzx edx, byte [ebp + 0xd]
shl eax, 4
mov edi, edx
shr edi, 4
or edi, eax
and edi, 0x3f
mov al, byte [edi + 0x1007cc0]
inc ecx
mov byte [ecx], al
inc ecx
cmp esi, 1
jbe 0x101c3c2
movzx eax, bl
shr eax, 6
shl edx, 2
or eax, edx
and eax, 0x3f
movzx eax, byte [eax + 0x1007cc0]
jmp 0x101c3c5
push 0x3d
pop eax
mov byte [ecx], al
inc ecx
cmp esi, 2
jbe 0x101c3d9
and ebx, 0x3f
movzx eax, byte [ebx + 0x1007cc0]
jmp 0x101c3dc
push 0x3d
pop eax
mov byte [ecx], al
sub esi, 3
inc ecx
test esi, esi
jg 0x101c331
pop edi
pop ebx
mov byte [ecx], 0xd
inc ecx
mov byte [ecx], 0xa
inc ecx
sub ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
mov dword [eax], ecx
xor eax, eax
pop esi
leave
ret 0x10
Function at 0x411600
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x569b38
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push edi
mov eax, dword [0x601328]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor edi, edi
xor eax, eax
push 0xffffffffffffffff
mov word [esp + 0x14], ax
mov eax, dword [esp + 0x3c]
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], edi
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], edi
call fcn.00406f00
mov eax, ebx
mov dword [esp + 0x30], edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x411656
sub eax, edx
sar eax, 1
push eax
mov eax, ebx
lea ecx, [esp + 0x10]
call fcn.00411890
xor ecx, ecx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push 0xffffffffffffffff
mov word [esi + 4], cx
push edi
mov ecx, esi
call fcn.00406f00
cmp dword [esp + 0x24], 8
jb 0x41169f
mov edx, dword [esp + 0x10]
push edx
call fcn.00546771
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x2c
ret
Function at 0x415d40
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [edi]
lea ecx, [esp]
push ecx
mov ecx, dword [esp + 0xc]
push esi
add eax, eax
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x18]
push 0
mov dword [edi], 0
mov edx, dword [ecx]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x415dae
mov eax, dword [esp + 0xc]
cmp eax, 1
je 0x415d7f
cmp eax, 2
jne 0x415d9a
mov eax, dword [esp]
test esi, esi
je 0x415da8
test eax, eax
je 0x415da3
test al, 1
jne 0x415d9a
mov ecx, eax
shr ecx, 1
cmp word [esi + ecx*2 - 2], 0
je 0x415da8
mov eax, 0xd
pop ecx
ret 8
xor edx, edx
mov word [esi], dx
shr eax, 1
mov dword [edi], eax
xor eax, eax
pop ecx
ret 8

Function at 0x416b70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push edi
push ebx
push ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x416b87
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x416bb8
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x416bb4
cmp esi, eax
jae 0x416bb8
sub edi, 1
movzx ecx, word [esi]
lea esi, [esi + ecx*2 + 2]
jne 0x416ba4
cmp esi, eax
jb 0x416bbe
pop esi
pop edi
xor eax, eax
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret

Function at 0x4172c0
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x56a0c8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x601328]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
mov eax, dword [0x601328]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ecx, dword [ecx + 0x20]
xor ebx, ebx
xor al, al
cmp ecx, ebx
je 0x41738d
xor eax, eax
mov dword [esp + 0x20], 7
mov dword [esp + 0x1c], ebx
mov word [esp + 0xc], ax
lea edx, [esp + 8]
push edx
mov dword [esp + 0x34], ebx
call fcn.004b1ea9
push 9
mov eax, 0x597470
lea ecx, [esp + 0xc]
call fcn.00411890
cmp dword [esp + 0x20], 8
mov eax, dword [esp + 0xc]
jae 0x41733e
lea eax, [esp + 0xc]
push ebx
push 0x80
push 1
push ebx
push ebx
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
push eax
setne bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x20], 8
mov eax, dword [esp + 0xc]
jae 0x417370
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [esp + 0x20], 8
jb 0x41738b
mov eax, dword [esp + 0xc]
push eax
call fcn.00546771
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0054677c
add esp, 0x2c
ret
Function at 0x4173b0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x574ef0
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x601328]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
push esi
mov eax, dword [0x601328]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov esi, 7
xor ebx, ebx
xor eax, eax
mov dword [esp + 0x28], vtable.CRegistry.0
mov dword [esp + 0x44], esi
mov dword [esp + 0x40], ebx
mov word [esp + 0x30], ax
mov dword [esp + 0x78], ebx
xor ecx, ecx
push 0xffffffffffffffff
mov word [esp + 0x54], cx
push ebx
mov eax, 0x603614
lea ecx, [esp + 0x54]
mov dword [esp + 0x50], SysStringLen
mov dword [esp + 0x6c], esi
mov dword [esp + 0x68], ebx
call fcn.00406f00
mov byte [esp + 0x78], 1
push 1
mov edx, 0x603614
lea ecx, [esp + 0x2c]
mov byte [esp + 0x6c], bl
call fcn.0046ed61
mov dword [esp + 0x78], 2
mov dword [esp + 0x24], esi
xor edx, edx
push 0x11
mov eax, str.DNTCurrentVersion
lea esi, [esp + 0x10]
mov dword [esp + 0x24], ebx
mov word [esp + 0x14], dx
call fcn.00406bf0
push ebx
lea eax, [esp + 0x2c]
push eax
mov ecx, esi
mov byte [esp + 0x80], 3
call fcn.004707a7
cmp dword [esp + 0x24], 8
jb 0x417493
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00546771
add esp, 4
lea ecx, [esp + 0x28]
call fcn.00415ec0
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.0054677c
add esp, 0x70
ret
Function at 0x420ad0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x30
push esi
mov esi, dword [0x6056f4]
push edi
push 0x30
lea eax, [esp + 0xc]
push 0
push eax
call fcn.0054ff70
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
add esp, 0xc
push 0
mov dword [esp + 0xc], 0x30
call edi
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], 0x420a30
mov dword [esp + 0x34], str.Hidden_Browser
call dword [sym.imp.USER32.dll_RegisterClassExA]
push 0
push 0
call edi
push eax
push 0
push esi
push 0
push SysReAllocString
push 0
push SysReAllocString
push 0xcf0000
push str.Hidden_Web_Browser
push str.Hidden_Browser
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
test esi, esi
je 0x420b6a
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4269d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x568548
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push edi
mov eax, dword [0x601328]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov dword [esp + 0xc], 0
mov dword [esp + 0x28], 0
mov edi, dword [ecx]
mov eax, 3
mov word [esp + 0x10], ax
mov ebx, dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
sub esp, 0x10
mov eax, esp
mov dword [eax], ebx
mov ebx, dword [esp + 0x28]
xor edx, edx
mov dword [eax + 4], ebx
mov dword [eax + 8], edx
mov edx, dword [esp + 0x30]
mov dword [eax + 0xc], edx
mov eax, dword [edi + 0x2c]
push ecx
call eax
mov edi, eax
test edi, edi
jne 0x426a6b
mov ebx, dword [esp + 0xc]
test ebx, ebx
je 0x426a5f
mov eax, ebx
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x426a50
sub eax, edx
sar eax, 1
push ebx
mov ebx, eax
mov eax, dword [esp + 0x34]
call fcn.00404820
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, edi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x20
ret 4
Function at 0x43ffd0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x574068
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x601328]
xor eax, esp
mov dword [esp + 0x6c], eax
push ebx
push esi
mov eax, dword [0x601328]
xor eax, esp
push eax
lea eax, [esp + 0x80]
mov dword fs:[0], eax
xor ebx, ebx
mov esi, 7
xor eax, eax
mov byte [esp + 0xe], bl
mov dword [esp + 0x2c], vtable.CRegistry.0
mov dword [esp + 0x48], esi
mov dword [esp + 0x44], ebx
mov word [esp + 0x34], ax
mov dword [esp + 0x88], ebx
xor ecx, ecx
push 0xffffffffffffffff
mov word [esp + 0x58], cx
push ebx
mov eax, 0x603614
lea ecx, [esp + 0x58]
mov dword [esp + 0x54], SysStringLen
mov dword [esp + 0x70], esi
mov dword [esp + 0x6c], ebx
call fcn.00406f00
mov byte [esp + 0x88], 1
push 1
mov edx, 0x603614
lea ecx, [esp + 0x30]
mov byte [esp + 0x70], bl
call fcn.0046ed61
mov dword [esp + 0x88], 2
xor edx, edx
mov eax, edi
mov word [esp + 0x14], dx
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x440095
sub eax, edx
sar eax, 1
push eax
mov eax, edi
lea esi, [esp + 0x14]
call fcn.00406bf0
push ebx
mov ecx, esi
lea edx, [esp + 0x30]
mov byte [esp + 0x8c], 3
call fcn.004703f8
test eax, eax
sete byte [esp + 0xf]
mov byte [esp + 0x88], 2
cmp dword [esp + 0x28], 8
jb 0x4400e7
mov eax, dword [esp + 0x14]
push eax
call fcn.00546771
add esp, 4
cmp byte [esp + 0xf], bl
je 0x44014e
xor ecx, ecx
mov eax, edi
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], ebx
mov word [esp + 0x14], cx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x440105
sub eax, edx
sar eax, 1
push eax
mov eax, edi
lea esi, [esp + 0x14]
call fcn.00406bf0
push 1
lea edx, [esp + 0x30]
push edx
mov ecx, esi
mov byte [esp + 0x90], 4
call fcn.004707a7
cmp dword [esp + 0x28], 8
jb 0x44014a
mov eax, dword [esp + 0x14]
push eax
call fcn.00546771
add esp, 4
mov bl, 1
jmp 0x440152
mov bl, byte [esp + 0xe]
lea ecx, [esp + 0x2c]
call fcn.00415ec0
mov al, bl
mov ecx, dword [esp + 0x80]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x6c]
xor ecx, esp
call fcn.0054677c
mov esp, ebp
pop ebp
ret