joyce8/EMBER2024-capa huggingface dataset:
Function at 0x455d10
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4c2010]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0xc], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
mov word [ebp - 8], 0x500
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x455d79
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [ebp - 0x14]
neg eax
sbb eax, eax
and dword [ebp - 0x10], eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00458fdd
mov esp, ebp
pop ebp
ret

Function at 0x455d90
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48dfc8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x4c2010]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push edx
mov dword [ebp - 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x455e02
push 0x4ace58
mov ecx, esi
call fcn.00401c80
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0
push eax
push edi
mov dword [ebp - 0x1c], 0
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
call fcn.00487130
lea ecx, [ebp - 0x10]
movsd qword [ebp - 0x28], xmm0
call fcn.00401d20
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
test ecx, ecx
jg 0x455eaf
jl 0x455e54
cmp eax, 0x400
jae 0x455e5d
push ecx
push eax
push str._I64dB
jmp 0x455ec9
test ecx, ecx
jg 0x455eaf
jl 0x455e6a
cmp eax, 0x100000
jae 0x455e86
movsd xmm0, qword [ebp - 0x28]
sub esp, 8
mulsd xmm0, qword [0x4ae090]
movsd qword [esp], xmm0
push str._.2fKB
jmp 0x455ec9
test ecx, ecx
jg 0x455eaf
jl 0x455e93
cmp eax, 0x40000000
jae 0x455eaf
movsd xmm0, qword [ebp - 0x28]
sub esp, 8
mulsd xmm0, qword [0x4ae088]
movsd qword [esp], xmm0
push str._.2fMB
jmp 0x455ec9
movsd xmm0, qword [ebp - 0x28]
sub esp, 8
mulsd xmm0, qword [0x4ae080]
movsd qword [esp], xmm0
push str._.2fGB
lea eax, [ebp - 0x10]
push eax
call fcn.0042bf00
add esp, 0x10
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
call fcn.00401d00
lea ecx, [ebp - 0x10]
call fcn.00401c60
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x456120
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov ebx, edx
mov dword [ebp - 8], ecx
push edi
mov edx, ecx
xor edi, edi
xor ecx, ecx
xor esi, esi
test ebx, ebx
jle 0x456219
nop
mov al, byte [esi + edx]
cmp al, 0x3d
jne 0x45614d
inc edi
cmp edi, 2
jg 0x456196
cmp al, 0x7f
ja 0x456196
movzx eax, al
mov al, byte [eax + 0x4a9c58]
cmp al, 0x7f
je 0x456196
cmp al, 0x40
jae 0x456166
test edi, edi
jne 0x456196
inc esi
inc ecx
cmp esi, ebx
jl 0x456140
test ecx, ecx
je 0x456219
lea eax, [ecx + ecx*2]
mov ecx, dword [ebp + 0xc]
lea eax, [eax*2 + 7]
sar eax, 3
cmp dword [ecx], eax
jge 0x4561a2
pop edi
pop esi
mov dword [ecx], eax
mov eax, 0xfffffff0
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0xffffffee
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
xor ecx, ecx
xor ebx, ebx
mov dword [ebp - 4], ecx
mov edi, 3
test esi, esi
jle 0x456211
movzx ecx, byte [edx]
mov dl, byte [ecx + 0x4a9c58]
xor ecx, ecx
cmp dl, 0x40
sete cl
shl ebx, 6
sub edi, ecx
movzx ecx, dl
and ecx, 0x3f
or ebx, ecx
mov ecx, dword [ebp - 4]
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 4
jne 0x456205
xor ecx, ecx
mov dword [ebp - 4], ecx
test edi, edi
jle 0x4561f0
mov ecx, ebx
shr ecx, 0x10
mov byte [eax], cl
inc eax
cmp edi, 1
jle 0x4561fd
mov ecx, ebx
shr ecx, 8
mov byte [eax], cl
inc eax
cmp edi, 2
jle 0x456205
mov byte [eax], bl
inc eax
mov edx, dword [ebp - 8]
dec esi
inc edx
mov dword [ebp - 8], edx
test esi, esi
jg 0x4561b5
mov ecx, dword [ebp + 0xc]
sub eax, dword [ebp + 8]
mov dword [ecx], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4568e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48e0dc
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x4c2010]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
mov dword [ebp - 4], 1
test esi, esi
je 0x456a42
cmp byte [esi], 0
mov dword [ebp - 0x2c], 0xf
mov dword [ebp - 0x30], 0
mov byte [ebp - 0x40], 0
jne 0x45694e
xor ecx, ecx
jmp 0x45695c
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x456953
sub ecx, edx
push ecx
push esi
lea ecx, [ebp - 0x40]
call fcn.00454cb0
push 0x4ae054
lea edx, [ebp - 0x40]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x70]
call fcn.00454ad0
push edi
mov edx, eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x58]
call fcn.00454ad0
add esp, 8
mov edi, eax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 4
cmp eax, edi
je 0x4569cb
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4569b0
inc eax
push 1
push eax
push dword [ebp - 0x28]
call fcn.00406d20
add esp, 0xc
push edi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.00454fe0
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x44]
cmp eax, 0x10
jb 0x4569e6
inc eax
push 1
push eax
push dword [ebp - 0x58]
call fcn.00406d20
add esp, 0xc
mov dword [ebp - 0x44], 0xf
mov dword [ebp - 0x48], 0
mov byte [ebp - 0x58], 0
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x5c]
cmp eax, 0x10
jb 0x456a13
inc eax
push 1
push eax
push dword [ebp - 0x70]
call fcn.00406d20
add esp, 0xc
mov dword [ebp - 0x5c], 0xf
mov dword [ebp - 0x60], 0
mov byte [ebp - 0x70], 0
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x2c]
cmp eax, 0x10
jb 0x456a63
inc eax
push 1
push eax
push dword [ebp - 0x40]
call fcn.00406d20
add esp, 0xc
jmp 0x456a63
cmp byte [edi], 0
jne 0x456a4b
xor ecx, ecx
jmp 0x456a59
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x456a50
sub ecx, edx
push ecx
push edi
lea ecx, [ebp - 0x28]
call fcn.00454cb0
push dword [ebp + 0xc]
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, dword [ebp - 0x28]
push ebx
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [ebp - 4], 8
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x456a9f
push 1
inc eax
push eax
push dword [ebp - 0x28]
call fcn.00406d20
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00458fdd
mov esp, ebp
pop ebp
ret
Function at 0x456c50
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48e124
mov eax, dword fs:[0]
push eax
sub esp, 0x144
mov eax, dword [0x4c2010]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x28]
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x138], eax
call fcn.00456620
push 0xffffffffffffffff
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push 0
push eax
lea ecx, [ebp - 0x150]
mov dword [ebp - 0x13c], 0xf
mov dword [ebp - 0x140], 0
mov byte [ebp - 0x150], 0
call fcn.00454eb0
mov eax, dword [ebp - 0x140]
lea ecx, [ebp - 0x12c]
cmp dword [ebp - 0x13c], 0x10
mov edx, 0x100
mov dword [ebp - 0x134], eax
lea eax, [ebp - 0x150]
cmovae eax, dword [ebp - 0x150]
mov dword [ebp - 0x130], eax
xor eax, eax
nop word [eax + eax]
mov byte [ecx], al
lea ecx, [ecx + 1]
inc eax
cmp ax, dx
jl 0x456d00
xor dl, dl
mov word [ebp - 0x2c], 0
xor ebx, ebx
lea esi, [ebp - 0x12c]
mov edi, 0x100
mov eax, dword [ebp - 0x130]
lea esi, [esi + 1]
mov cl, byte [esi - 1]
movzx edx, dl
mov al, byte [edx + eax]
add al, bl
add al, cl
movzx ebx, al
movzx eax, byte [ebp + ebx - 0x12c]
mov byte [esi - 1], al
lea eax, [edx + 1]
cdq
idiv dword [ebp - 0x134]
mov byte [ebp + ebx - 0x12c], cl
sub edi, 1
jne 0x456d20
xor esi, esi
cmp dword [ebp + 0xc], esi
jle 0x456dbb
movzx edx, byte [ebp - 0x2c]
movzx ebx, byte [ebp - 0x2b]
nop dword [eax]
inc dl
inc esi
movzx edx, dl
mov cl, byte [ebp + edx - 0x12c]
add bl, cl
movzx ebx, bl
movzx eax, byte [ebp + ebx - 0x12c]
mov byte [ebp + edx - 0x12c], al
mov byte [ebp + ebx - 0x12c], cl
add cl, byte [ebp + edx - 0x12c]
movzx eax, cl
mov ecx, dword [ebp - 0x138]
movzx eax, byte [ebp + eax - 0x12c]
xor byte [edi + ecx], al
movsx edi, si
cmp edi, dword [ebp + 0xc]
jl 0x456d70
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x13c]
cmp eax, 0x10
jb 0x456ddc
inc eax
push 1
push eax
push dword [ebp - 0x150]
call fcn.00406d20
add esp, 0xc
mov dword [ebp - 4], 2
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x456dfa
push 1
inc eax
push eax
push dword [ebp - 0x28]
call fcn.00406d20
add esp, 0xc
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00458fdd
mov esp, ebp
pop ebp
ret 8
Function at 0x457490
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48e1e8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x4c2010]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x38], 0
call fcn.004575c0
test al, al
jne 0x4574d8
jmp 0x457588
cmp dword [edi + 0x14], 0x10
jb 0x4574e2
mov eax, dword [edi]
jmp 0x4574e4
mov eax, edi
lea ecx, [ebp - 0x2c]
push ecx
push 0
lea ecx, [ebp - 0x30]
push ecx
push 0
push eax
push dword [ebx + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x457588
mov eax, dword [ebp - 0x30]
cmp eax, 1
je 0x457514
cmp eax, 2
je 0x457514
cmp eax, 6
jne 0x457588
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x457586
inc eax
push eax
call fcn.0045960a
inc dword [ebp - 0x2c]
add esp, 4
cmp dword [edi + 0x14], 0x10
mov dword [ebp - 0x34], eax
jb 0x457533
mov edi, dword [edi]
lea ecx, [ebp - 0x2c]
push ecx
push eax
push 0
push 0
push edi
push dword [ebx + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x2c]
push ecx
mov byte [ecx + eax], 0
lea ecx, [ebp - 0x28]
call fcn.00454db0
mov dword [ebp - 4], 2
lea eax, [ebp - 0x28]
mov dword [esi + 0x14], 0xf
mov ecx, esi
mov dword [esi + 0x10], 0
push eax
mov byte [esi], 0
call fcn.00454fe0
lea ecx, [ebp - 0x28]
call fcn.00455490
jmp 0x457599
jmp 0x457588
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00458fdd
mov esp, ebp
pop ebp
ret 8

Function at 0x45bc5e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
mov ebx, 0x40c7d0
nop
mov ecx, 0x48273a75
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
mov eax, section..text_1
nop
mov ebx, 0x42f314
mov ecx, 0x60416a9f
nop
nop
nop
nop
nop
test eax, eax
je 0x432084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00431219
Function at 0x401530
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401545
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401586
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x401582
nop word [eax + eax]
cmp esi, edx
jae 0x401586
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x401570
cmp esi, edx
jb 0x40158b
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret

Function at 0x401b00
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x52d474]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x108]
push 0x104
push 0
push eax
mov dword [ebp - 0x10c], 0
call fcn.00493270
add esp, 0xc
lea eax, [ebp - 0x108]
push 0
push dword [ebp + 0xc]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
cmp byte [ebp - 0x108], 0
jne 0x401b69
xor ecx, ecx
jmp 0x401b7b
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401b72
sub ecx, edx
push ecx
lea eax, [ebp - 0x108]
mov ecx, esi
push eax
call fcn.00405370
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00491511
mov esp, ebp
pop ebp
ret
Function at 0x401ba0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f1a38
mov eax, dword fs:[0]
push eax
sub esp, 0x250
mov eax, dword [0x52d474]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
push 0x22c
mov dword [ebp - 0x258], eax
lea eax, [ebp - 0x254]
push 0
push eax
call fcn.00493270
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x401c07
xor al, al
jmp 0x401d00
lea eax, [ebp - 0x254]
mov dword [ebp - 0x254], 0x22c
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x401cf7
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00401e50
add esp, 8
mov ecx, dword [ebp - 0x258]
lea esi, [ebp - 0x28]
mov dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x10
cmovae esi, dword [ebp - 0x28]
call fcn.00402fb0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x401ca5
mov eax, dword [ebp - 0x24c]
mov ecx, ebx
mov esi, dword [ebx]
mov dword [ebp - 0x25c], eax
lea eax, [ebp - 0x25c]
push eax
push dword [esi + 4]
push esi
call fcn.00403d00
mov edx, eax
mov ecx, 0x15555554
mov eax, dword [ebx + 4]
sub ecx, eax
cmp ecx, 1
jb 0x401d1c
lea ecx, [eax + 1]
mov dword [ebx + 4], ecx
mov dword [esi + 4], edx
mov eax, dword [edx + 4]
mov dword [eax], edx
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x401ce2
mov eax, dword [ebp - 0x28]
inc ecx
cmp ecx, 0x1000
jb 0x401cd9
test al, 0x1f
jne 0x401d26
mov ecx, dword [eax - 4]
cmp ecx, eax
jae 0x401d26
sub eax, ecx
cmp eax, 4
jb 0x401d26
cmp eax, 0x23
ja 0x401d26
mov eax, ecx
push eax
call fcn.0046df4e
add esp, 4
lea eax, [ebp - 0x254]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x401c26
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00491511
mov esp, ebp
pop ebp
ret
push str.list_T__too_long
call fcn.00443aea
call fcn.0049beb9
int3
Function at 0x4021a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea eax, [ebp - 8]
push eax
push str.SOFTWAREHintsoft
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], 0
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
je 0x4021e6
mov eax, dword [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x4021e0
push eax
call esi
mov byte [ebp - 1], 0
jmp 0x402207
push 0
push 0
push 0
push dword [ebp - 8]
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
mov eax, dword [ebp - 8]
sete byte [ebp - 1]
test eax, eax
je 0x402207
push eax
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push str.SOFTWARESicent
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
je 0x402232
mov eax, dword [ebp - 8]
test eax, eax
je 0x40222c
push eax
call esi
mov byte [ebp - 2], 0
jmp 0x40224d
push 0
push 0
push 0
push dword [ebp - 8]
call ebx
test eax, eax
mov eax, dword [ebp - 8]
sete byte [ebp - 2]
test eax, eax
je 0x40224d
push eax
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push str.SOFTWAREGoyoo
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
je 0x402278
mov eax, dword [ebp - 8]
test eax, eax
je 0x402272
push eax
call esi
mov byte [ebp - 3], 0
jmp 0x402293
push 0
push 0
push 0
push dword [ebp - 8]
call ebx
test eax, eax
mov eax, dword [ebp - 8]
sete byte [ebp - 3]
test eax, eax
je 0x402293
push eax
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push str.SOFTWARE_
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
je 0x4022bc
mov eax, dword [ebp - 8]
test eax, eax
je 0x4022b8
push eax
call esi
xor bl, bl
jmp 0x4022d6
push 0
push 0
push 0
push dword [ebp - 8]
call ebx
test eax, eax
mov eax, dword [ebp - 8]
sete bl
test eax, eax
je 0x4022d6
push eax
call esi
cmp byte [ebp - 1], 0
jne 0x4022f5
cmp byte [ebp - 2], 0
jne 0x4022f5
cmp byte [ebp - 3], 0
jne 0x4022f5
test bl, bl
jne 0x4022f5
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402340
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov ax, word [ebp - 0x24]
cmp ax, 9
je 0x402366
cmp ax, 6
je 0x402366
xor al, al
mov esp, ebp
pop ebp
ret
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x402370
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f1ae8
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x52d474]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
mov dword [ebp - 4], 0
test esi, esi
je 0x40243f
cmp byte [esi], 0
mov dword [ebp - 0x2c], 0xf
mov dword [ebp - 0x30], 0
mov byte [ebp - 0x40], 0
jne 0x4023dc
xor ecx, ecx
jmp 0x4023ea
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4023e1
sub ecx, edx
push ecx
push esi
lea ecx, [ebp - 0x40]
call fcn.00405370
push 0x51e670
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.00403900
push edi
push eax
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 2
push eax
call fcn.00403900
add esp, 0x18
lea ecx, [ebp - 0x28]
push eax
call fcn.004030f0
lea ecx, [ebp - 0x58]
call fcn.00404c10
lea ecx, [ebp - 0x70]
call fcn.00404c10
lea ecx, [ebp - 0x40]
call fcn.00404c10
jmp 0x402463
cmp byte [edi], 0
jne 0x402448
xor ecx, ecx
jmp 0x402459
mov ecx, edi
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402450
sub ecx, edx
push ecx
push edi
lea ecx, [ebp - 0x28]
call fcn.00405370
push dword [ebp + 0x14]
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, dword [ebp - 0x28]
push ebx
push eax
push 0x51e674
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [ebp - 0x28]
call fcn.00404c10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00491511
mov esp, ebp
pop ebp
ret
Function at 0x4024b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f1b18
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x52d474]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
cmp byte [ebx], 0
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
jne 0x40250b
xor ecx, ecx
jmp 0x402519
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402510
sub ecx, edx
push ecx
push ebx
lea ecx, [ebp - 0x28]
call fcn.00405370
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
mov edi, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x18]
cmovae eax, edi
cmp byte [ecx + eax - 1], 0x5c
je 0x4025a3
or eax, 0xffffffff
sub eax, ecx
cmp eax, 1
ja 0x402557
push str.string_too_long
call fcn.00443aea
lea esi, [ecx + 1]
cmp esi, 0xfffffffe
jbe 0x402569
push str.string_too_long
call fcn.00443aea
cmp edx, esi
jae 0x4025af
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.00404fc0
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x28]
test esi, esi
je 0x4025a3
cmp edx, 0x10
lea eax, [ebp - 0x28]
cmovae eax, edi
mov byte [eax + ecx], 0x5c
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
mov dword [ebp - 0x18], esi
cmovae eax, dword [ebp - 0x28]
mov byte [eax + esi], 0
mov edx, dword [ebp - 0x2c]
cmp byte [edx], 0
jne 0x4025c4
xor ecx, ecx
jmp 0x4025d9
test esi, esi
jne 0x402584
cmp edx, 0x10
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x28]
cmovae eax, edi
mov byte [eax], 0
jmp 0x4025a3
mov ecx, edx
lea esi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4025d0
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.00404ab0
push 0x38
lea eax, [ebp - 0x6c]
push 0
push eax
call fcn.00493270
mov eax, dword [ebp - 0x30]
add esp, 0xc
cmp dword [ebp - 0x14], 0x10
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x70]
push eax
mov dword [ebp - 0x70], 0x3c
mov dword [ebp - 0x6c], 0x440
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
cmp byte [ebp + 0x18], 0
je 0x40264e
push 0xffffffffffffffff
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [ebp - 0x28]
call fcn.00404c10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00491511
mov esp, ebp
pop ebp
ret