joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405590
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
sub esp, 0x10
push esi
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4055ae
or eax, eax
pop esi
add esp, 0x10
ret
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push ecx
mov dword [esp + 0xc], eax
mov word [esp + 8], 2
call dword [sym.imp.WS2_32.dll_htons]
lea edx, [esp + 4]
push 0x10
push edx
push esi
mov word [esp + 0x12], ax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x4055ef
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
pop esi
add esp, 0x10
ret
mov eax, esi
pop esi
add esp, 0x10
ret

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43300c
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x10029b10
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x10034060]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10037104]
test dword [ebp + 8], eax
je 0x10029bba
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x808]
push eax
call fcn.1002aa5b
xor eax, eax
add esp, 0xc
mov word [ebp - 8], ax
mov eax, dword [0x10037100]
test eax, eax
je 0x10029bad
lea ecx, [ebp - 0x808]
push ecx
push eax
call fcn.1002aa5b
mov eax, dword [0x10034058]
pop ecx
pop ecx
test eax, eax
jle 0x10029bba
push esi
mov esi, dword [0x10037108]
push edi
mov edi, dword [0x1003710c]
cdq
push edx
push eax
push edi
push esi
call fcn.1002a520
add esi, 1
mov dword [0x10037108], esi
adc edi, 0
or eax, edx
mov dword [0x1003710c], edi
pop edi
pop esi
jne 0x10029bba
push dword [0x10037100]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
pop ecx
jmp 0x10029bba
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10029e60
leave
ret
Function at 0x10033b30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x10033b3f
pop dword [ebp - 0x30]
mov eax, 0x96f94399
add eax, 0x7909f7a6
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x2cc3282
sub dword [ebp - 0x40], 0xb479ed37
mov dword [ebp - 0x3c], 0x436ee206
sub dword [ebp - 0x3c], 0x113b95c1
mov dword [ebp - 0x38], 0xba4d5d2b
add dword [ebp - 0x38], 0x91fee703
mov dword [ebp - 0x34], 0xdc4b8f50
sub dword [ebp - 0x34], 0xdc4b8f50
lea eax, [ebp - 0x40]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x8a91709f
add dword [ebp - 0x40], 0xe9e0f8b7
mov dword [ebp - 0x3c], 0xb853e43d
add dword [ebp - 0x3c], 0x89187d38
mov dword [ebp - 0x38], 0x551c0847
add dword [ebp - 0x38], 0xe536425
mov dword [ebp - 0x34], 0x490fdb01
sub dword [ebp - 0x34], 0x490fdb01
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x3d2a3
push 0
call eax
mov ecx, 0xadb0b2e0
sub ecx, 0xadb06cb4
mov edx, eax
mov ebx, 0x21ea3799
add ebx, 0xee1cda67
add ebx, dword [ebp - 0x30]
mov edi, 0xd80a50e4
xor dword [ebp - 0x10], 0x729574e2
mov esi, dword [ebx]
xor dword [ebp - 0x1c], 0xbd5324ef
add esi, edi
sub dword [ebp - 0x28], 0x73dcd1f9
mov dword [edx], esi
mov dword [ebp - 0x20], 0x2c25a932
add edx, 4
add ebx, 0xc2a4ca44
sub ebx, 0xc2a4ca40
loop 0x10033c51
add eax, 0xf3a7868
sub eax, 0xf396ce5
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x101b2db0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4
push ebx
push esi
push edi
lea edi, [ebp - 4]
mov ecx, 1
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x103b01ed
call fcn.100e3268
mov esi, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cmp esi, esp
call fcn.100e1e59
movsx ecx, ax
and ecx, 0x8000
je 0x101b2dff
mov dword [ebp - 0xc4], 1
jmp 0x101b2e09
mov dword [ebp - 0xc4], 0
movzx eax, byte [ebp - 0xc4]
pop edi
pop esi
pop ebx
add esp, 0xc4
cmp ebp, esp
call fcn.100e1e59
mov esp, ebp
pop ebp
ret

Function at 0x10216300
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
push edi
lea edi, [ebp - 0x18]
mov ecx, 6
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x103b030a
call fcn.100e3268
mov eax, dword [0x103ab168]
mov dword [ebp - 8], eax
jmp 0x10216337
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x10216350
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0
je 0x1021634e
mov eax, dword [ebp - 8]
jmp 0x102163d3
jmp 0x1021632f
mov esi, esp
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp esi, esp
call fcn.100e1e59
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x102163d0
mov eax, dword [ebp - 8]
add eax, 0x20
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
mov dword [eax + 4], 0
mov eax, dword [ebp - 8]
mov dword [eax + 8], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
mov dword [eax], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 0x14]
add eax, 0x20
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 8]
cmp eax, 0xfe0
jbe 0x10216393
mov eax, dword [ebp - 8]
mov ecx, dword [0x103ab168]
mov dword [eax], ecx
mov eax, dword [ebp - 8]
mov dword [0x103ab168], eax
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
add esp, 0xd8
cmp ebp, esp
call fcn.100e1e59
mov esp, ebp
pop ebp
ret
Function at 0x10217ec0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
lea edi, [ebp - 0x4c]
mov ecx, 0x13
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x10307340]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0x103b0492
call fcn.100e3268
imul eax, dword [ebp + 8], 0x2c
add eax, dword [0x103ab150]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x24], 5
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0xc]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x10217f2d
mov eax, dword [ebp - 0x30]
sub eax, 5
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
add eax, 2
mov dword [ebp - 0x24], eax
mov esi, esp
lea eax, [ebp - 0x18]
push eax
push 0x40
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.100e1e59
test eax, eax
jne 0x10217f58
mov eax, 0xa
jmp 0x1021805a
cmp dword [ebp + 0xc], 0
je 0x10217fa5
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov byte [eax], 0xe9
mov eax, dword [ebp - 0x30]
add eax, 5
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 4]
sub edx, eax
mov eax, dword [ebp - 0x3c]
mov dword [eax + 1], edx
mov eax, dword [ebp - 0xc]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x10217fa3
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x48]
mov byte [eax], 0xeb
mov eax, dword [ebp - 0x48]
mov byte [eax + 1], 0xf9
jmp 0x10217fe1
mov eax, dword [ebp - 0xc]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x10217fcc
push 7
mov eax, dword [ebp - 0xc]
add eax, 0xc
push eax
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.100e2efd
add esp, 0xc
jmp 0x10217fe1
push 5
mov eax, dword [ebp - 0xc]
add eax, 0xc
push eax
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.100e2efd
add esp, 0xc
mov esi, esp
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.100e1e59
mov esi, esp
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x30]
push ecx
mov edi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp edi, esp
call fcn.100e1e59
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
cmp esi, esp
call fcn.100e1e59
mov al, byte [ebp + 0xc]
and al, 1
shl al, 1
mov ecx, dword [ebp - 0xc]
mov dl, byte [ecx + 0x14]
and dl, 0xfd
or dl, al
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x14], dl
mov al, byte [ebp + 0xc]
and al, 1
shl al, 2
mov ecx, dword [ebp - 0xc]
mov dl, byte [ecx + 0x14]
and dl, 0xfb
or dl, al
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x14], dl
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x1021808c]
call fcn.100e16ca
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e0c61
add esp, 0x10c
cmp ebp, esp
call fcn.100e1e59
mov esp, ebp
pop ebp
ret
Function at 0x102186d0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe4
push ebx
push esi
push edi
lea edi, [ebp - 0x24]
mov ecx, 9
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x103b0492
call fcn.100e3268
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0
mov eax, dword [ebp + 8]
push eax
call fcn.102181e0
add esp, 4
test eax, eax
jne 0x10218735
mov dword [ebp - 8], 9
jmp 0x102187c2
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x102187c2
mov dword [ebp - 0x14], 0
jmp 0x10218753
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [eax + 8]
jae 0x102187c2
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov esi, esp
mov edx, dword [ebp - 0x14]
mov eax, dword [ecx + edx*4]
push eax
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp esi, esp
call fcn.100e1e59
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x102187c0
mov esi, esp
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp esi, esp
call fcn.100e1e59
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x20]
push edx
call fcn.102194e0
add esp, 0xc
mov esi, esp
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.100e1e59
jmp 0x1021874a
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
add esp, 0xe4
cmp ebp, esp
call fcn.100e1e59
mov esp, ebp
pop ebp
ret

Function at 0x10219890
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
push edi
lea edi, [ebp - 0x18]
mov ecx, 6
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x103b0492
call fcn.100e3268
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x1021994c
mov dword [ebp - 8], 0
jmp 0x102198d3
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + 8]
jae 0x1021992e
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov esi, esp
mov edx, dword [ebp - 8]
mov eax, dword [ecx + edx*4]
push eax
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp esi, esp
call fcn.100e1e59
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x1021992c
mov esi, esp
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp esi, esp
call fcn.100e1e59
mov esi, esp
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.100e1e59
jmp 0x102198ca
mov esi, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push 0
mov edx, dword [0x1030fe8c]
push edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp esi, esp
call fcn.100e1e59
pop edi
pop esi
pop ebx
add esp, 0xd8
cmp ebp, esp
call fcn.100e1e59
mov esp, ebp
pop ebp
ret
Function at 0x1021a080
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
lea edi, [ebp - 0xc]
mov ecx, 3
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x103b0566
call fcn.100e3268
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
test eax, eax
je 0x1021a0e8
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
cmp eax, 0x90
je 0x1021a0e8
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
cmp eax, 0xcc
je 0x1021a0e8
xor eax, eax
jmp 0x1021a129
mov dword [ebp - 8], 1
jmp 0x1021a0fa
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
jae 0x1021a124
mov eax, dword [ebp + 8]
add eax, dword [ebp - 8]
movzx ecx, byte [eax]
mov edx, 1
imul eax, edx, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + eax]
cmp ecx, eax
je 0x1021a122
xor eax, eax
jmp 0x1021a129
jmp 0x1021a0f1
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0xcc
cmp ebp, esp
call fcn.100e1e59
mov esp, ebp
pop ebp
ret
Function at 0x4215e0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x20000]
push edi
jmp 0x4215fa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x421601
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4215f0
mov eax, 1
add ebx, ebx
jne 0x421613
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x421608
jne 0x421624
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x421608
xor ecx, ecx
sub eax, 3
jb 0x421638
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4216aa
mov ebp, eax
add ebx, ebx
jne 0x421643
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x421650
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x421674
inc ecx
add ebx, ebx
jne 0x421660
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x421655
jne 0x421671
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x421655
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x421694
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x421685
jmp 0x4215f6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x421694
add edi, ecx
jmp 0x4215f6
pop esi
mov edi, esi
mov ecx, 3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4216b2
cmp byte [edi], 0
jne 0x4216b2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4216b7
lea edi, [esi + 0x1f000]
mov eax, dword [edi]
or eax, eax
je 0x42172f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x3d07c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x3d0b8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4216e4
mov ecx, edi
jns 0x421713
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x3d0c0]
or eax, eax
je 0x421729
mov dword [ebx], eax
add ebx, 4
jmp 0x421701
call dword [esi + 0x3d0bc]
mov ebp, dword [esi + 0x3d0c4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x421763
sub esp, 0xffffff80
jmp 0x4011b0
Function at 0x42e726
Capabilities:
Query environment variable

Disassembly:
push ecx
push ecx
mov eax, dword [0x4477c4]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push esi
push edi
xor ebx, ebx
xor esi, esi
xor edi, edi
cmp eax, ebx
jne 0x42e76f
call ebp
mov esi, eax
cmp esi, ebx
je 0x42e755
mov dword [0x4477c4], 1
jmp 0x42e774
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x42e76a
push 2
pop eax
mov dword [0x4477c4], eax
jmp 0x42e76f
mov eax, dword [0x4477c4]
cmp eax, 1
jne 0x42e7cc
cmp esi, ebx
jne 0x42e787
call ebp
mov esi, eax
cmp esi, ebx
jne 0x42e787
xor eax, eax
jmp 0x42e873
cmp word [esi], bx
mov eax, esi
je 0x42e79c
inc eax
inc eax
cmp word [eax], bx
jne 0x42e78e
inc eax
inc eax
cmp word [eax], bx
jne 0x42e78e
sub eax, esi
inc eax
inc eax
mov ebp, eax
push ebp
call fcn.004282c7
mov edi, eax
cmp edi, ebx
pop ecx
jne 0x42e7bf
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
jmp 0x42e873
push ebp
push esi
push edi
call fcn.00428390
add esp, 0xc
jmp 0x42e7b1
cmp eax, 2
je 0x42e7d5
cmp eax, ebx
jne 0x42e780
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebp, eax
cmp ebp, ebx
je 0x42e780
cmp byte [ebp], bl
mov esi, ebp
je 0x42e80b
push ebx
push ebx
push 0xffffffffffffffff
push esi
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, ebx
je 0x42e780
push esi
add edi, eax
call fcn.00428300
lea esi, [esi + eax + 1]
cmp byte [esi], bl
pop ecx
jne 0x42e7e8
inc edi
lea eax, [edi + edi]
push eax
mov dword [esp + 0x18], edi
call fcn.004282c7
cmp eax, ebx
pop ecx
mov dword [esp + 0x10], eax
je 0x42e884
cmp byte [ebp], bl
mov edi, ebp
mov esi, eax
je 0x42e865
mov ecx, dword [esp + 0x14]
mov eax, esi
sub eax, dword [esp + 0x10]
sar eax, 1
sub ecx, eax
push ecx
push esi
push 0xffffffffffffffff
push edi
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x42e87a
push edi
call fcn.00428300
push esi
lea edi, [edi + eax + 1]
call fcn.00426a3d
cmp byte [edi], bl
pop ecx
pop ecx
lea esi, [esi + eax*2 + 2]
jne 0x42e82b
push ebp
mov word [esi], bx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
push dword [esp + 0x10]
call fcn.004273b8
pop ecx
push ebp
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
jmp 0x42e780
Function at 0x42e890
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword [0x4477c8]
push ebp
xor ebp, ebp
cmp eax, ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
jne 0x42e8d0
call esi
test eax, eax
je 0x42e8b5
mov dword [0x4477c8], 1
jmp 0x42e8d5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x42e8cc
mov dword [0x4477c8], 2
jmp 0x42e8de
xor eax, eax
jmp 0x42e92c
cmp eax, 1
jne 0x42e8d9
call esi
jmp 0x42e92c
cmp eax, 2
jne 0x42e8cc
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push ebp
push ebp
push 0xffffffffffffffff
mov ebx, eax
push ebx
push 1
push ebp
call edi
mov esi, eax
cmp esi, ebp
je 0x42e924
lea eax, [esi + esi]
push eax
call fcn.004282c7
mov ebp, eax
test ebp, ebp
pop ecx
je 0x42e924
push esi
push ebp
push 0xffffffffffffffff
push ebx
push 1
push 0
call edi
test eax, eax
jne 0x42e928
push ebp
call fcn.004273b8
pop ecx
xor eax, eax
jmp 0x42e92a
mov eax, ebp
pop edi
pop ebx
pop esi
pop ebp
ret

Function at 0x42ec09
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.0042e9c0
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x42eca4
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x447484]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x42eca4
cmp eax, 1
je 0x42ecc5
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x42eca4
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x42ec71
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x42eca0
xor eax, eax
inc eax
jmp 0x42ece4
cmp edi, eax
jae 0x42eca8
xor eax, eax
jmp 0x42ece4
cmp eax, esi
jae 0x42ecaf
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x447484]
jmp 0x42ecc8
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40110c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4a8030]
jne 0x401116
repz ret
jmp fcn.00401b11

Function at 0x408edc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004047d5
and dword [ebp - 4], 0
cmp dword [0x4aa78c], 0
mov ebx, eax
jne 0x408f8d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40903e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40903e
push eax
call fcn.00404763
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4aa78c], eax
call esi
push eax
call fcn.00404763
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4aa790], eax
call esi
push eax
call fcn.00404763
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4aa794], eax
call esi
push eax
call fcn.00404763
pop ecx
mov dword [0x4aa79c], eax
test eax, eax
je 0x408f8d
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404763
pop ecx
mov dword [0x4aa798], eax
mov eax, dword [0x4aa798]
cmp eax, ebx
je 0x408fe5
cmp dword [0x4aa79c], ebx
je 0x408fe5
push eax
call fcn.004047de
push dword [0x4aa79c]
mov esi, eax
call fcn.004047de
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x408fe5
test edi, edi
je 0x408fe5
call esi
test eax, eax
je 0x408fdc
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x408fdc
test byte [ebp - 0xc], 1
jne 0x408fe5
or dword [ebp + 0x10], 0x200000
jmp 0x40901e
mov eax, dword [0x4aa790]
cmp eax, ebx
je 0x40901e
push eax
call fcn.004047de
pop ecx
test eax, eax
je 0x40901e
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40901e
mov eax, dword [0x4aa794]
cmp eax, ebx
je 0x40901e
push eax
call fcn.004047de
pop ecx
test eax, eax
je 0x40901e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4aa78c]
call fcn.004047de
pop ecx
test eax, eax
je 0x40903e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x409040
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40b0e0
Capabilities:
Set console window title

Disassembly:
sub esp, 0x428
mov eax, dword [0x4a8030]
xor eax, esp
mov dword [esp + 0x424], eax
mov eax, dword [0x2b631cc]
push ebx
mov ebx, dword [0x2b62eec]
push esi
mov esi, dword [0x4a8f60]
push edi
mov edi, eax
cmp eax, 0x930
jne 0x40b121
push str.lefovuweceh
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
mov eax, dword [0x2b631cc]
mov dword [0x2b62ee8], esi
cmp eax, 0x114e
jne 0x40b14b
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
lea eax, [esp + 0x14]
push eax
push str.durinarusunavabaxomoyowev
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
mov eax, dword [0x2b631cc]
cmp eax, 0x2f
jne 0x40b16d
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
push 0
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ReadEventLogA]
call fcn.0040b050
mov ecx, dword [esp + 0x430]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040110c
add esp, 0x428
ret