joyce8/EMBER2024-capa huggingface dataset:
Function at 0x54d438
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x54d514
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebx + 0xc], eax
mov byte [ebx + 0x10], 0
mov eax, dword [ebp - 4]
mov dword [ebx], eax
mov eax, dword [0x5baf18]
mov eax, dword [eax + 0x34]
mov dword [ebx + 0x24], eax
mov eax, dword [0x5baf18]
mov eax, dword [eax + 0x38]
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x50], pe_nt_image_headers32
mov dword [ebx + 0x14], esi
mov dword [ebx + 0x18], edi
mov ecx, dword [ebx + 0x50]
mov eax, esi
cdq
idiv ecx
imul ecx
add eax, ecx
mov dword [ebx + 0x1c], eax
mov dword [ebx + 0x20], edi
xor eax, eax
mov dword [ebx + 0x30], eax
mov eax, dword [ebx + 0x38]
dec eax
mov dword [ebx + 0x34], eax
xor eax, eax
mov dword [ebx + 0x40], eax
xor eax, eax
mov dword [ebx + 0x44], eax
xor eax, eax
mov dword [ebx + 0x48], eax
xor eax, eax
mov dword [ebx + 0x4c], eax
mov eax, dword [ebx + 0x1c]
mov ecx, dword [ebx + 0x50]
cdq
idiv ecx
imul ecx
add eax, ecx
mov dword [ebx + 0x3c], eax
xor eax, eax
mov dword [ebx + 0x58], eax
xor eax, eax
mov dword [ebx + 0x54], eax
mov byte [ebx + 0x5c], 1
mov edx, ebx
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.0053ea64
xor eax, eax
mov dword [ebx + 0x48], eax
mov eax, dword [ebx + 0x38]
dec eax
imul dword [ebx + 0x50]
dec eax
mov dword [ebx + 0x4c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54d51b
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dl, 1
call fcn.0042398c
ret

Function at 0x54fef4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
xor ebx, ebx
push ebp
push 0x550065
push dword fs:[ebx]
mov dword fs:[ebx], esp
push ecx
push 0
push 0
push edx
push 0
push eax
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
ja case.0x54ff25.0
mov al, byte [eax + 0x54ff2c]
jmp dword [eax*4 + 0x54ff4d]
lea eax, [ebp - 4]
mov edx, 0x550078
call fcn.00403aa8
jmp 0x55003c
lea eax, [ebp - 4]
mov edx, 0x5500a4
call fcn.00403aa8
jmp 0x55003c
lea eax, [ebp - 4]
mov edx, 0x5500d0
call fcn.00403aa8
jmp 0x55003c
lea eax, [ebp - 4]
mov edx, 0x55011c
call fcn.00403aa8
jmp 0x55003c
lea eax, [ebp - 4]
mov edx, 0x550160
call fcn.00403aa8
jmp 0x55003c
lea eax, [ebp - 4]
mov edx, 0x55019c
call fcn.00403aa8
jmp 0x55003c
lea eax, [ebp - 4]
mov edx, 0x550208
call fcn.00403aa8
jmp 0x55003c
lea eax, [ebp - 4]
mov edx, 0x55022c
call fcn.00403aa8
jmp 0x55003c
lea eax, [ebp - 4]
mov edx, 0x550280
call fcn.00403aa8
jmp 0x55003c
lea eax, [ebp - 4]
mov edx, 0x5502bc
call fcn.00403aa8
jmp 0x55003c
lea eax, [ebp - 4]
mov edx, 0x55030c
call fcn.00403aa8
jmp 0x55003c
lea eax, [ebp - 4]
mov edx, 0x55034c
call fcn.00403aa8
push 0
mov cx, word [0x55036c]
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.00440b28
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55006c
lea eax, [ebp - 4]
call fcn.00403a10
ret
Function at 0x5537f8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
pushal
mov ecx, edx
dec ecx
test ecx, ecx
jl 0x553858
inc ecx
mov dword [ebp - 4], 0x136c9856
mov dword [ebp - 8], 0x9abfb3b6
mov dword [ebp - 0xc], 0x7f6a0dbb
mov esi, eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
rol eax, 7
rol edx, 0x1b
xor eax, edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp - 0xc]
xor eax, ebx
push ecx
mov ecx, eax
rol ebx, cl
pop ecx
ror eax, 0xf
xor edx, eax
xor edx, ebx
push ecx
mov ecx, edx
ror ebx, cl
pop ecx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], edx
mov ebx, dword [ebp - 4]
xor bl, byte [esi]
mov byte [esi], bl
inc esi
dec ecx
jne 0x55381e
popal
mov esp, ebp
pop ebp
ret
Function at 0x5ad320
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [0x5bb528]
cmp dword [eax], 0
je 0x5ad38e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x5dc]
cmp byte [eax + 0xc0], 0
je 0x5ad35e
push 0
mov eax, dword [0x5bb528]
mov eax, dword [eax]
call fcn.004276fc
push eax
call sub.user32.dll_ShowWindow
jmp 0x5ad38e
mov eax, dword [0x5bb528]
mov eax, dword [eax]
call fcn.004319d0
push 4
mov eax, dword [0x5bb528]
mov eax, dword [eax]
call fcn.004276fc
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x5c19f0]
call fcn.004276fc
push eax
call sub.user32.dll_SetForegroundWindow
pop ecx
pop ecx
pop ebp
ret
Function at 0x401e40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401e59
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401e94
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x401e90
lea ebx, [ebx]
cmp esi, eax
jae 0x401e94
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401e80
cmp esi, eax
jb 0x401e9a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x406960
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x10
test ebx, ebx
jne 0x40696d
xor eax, eax
add esp, 0x10
ret
mov cl, byte [esi + 0xe]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GlobalSize]
push edi
mov eax, 0x4d42
mov edi, 1
push esi
shl edi, cl
mov word [esp + 0xc], ax
call ebp
add eax, 0xe
push ebx
xor edx, edx
xor ecx, ecx
mov dword [esp + 0xe], eax
mov eax, dword [esi]
push 0xe
mov word [esp + 0x18], dx
mov word [esp + 0x16], cx
lea edx, [esp + 0x10]
lea ecx, [eax + edi*4 + 0xe]
push 1
push edx
mov dword [esp + 0x22], ecx
call fcn.004ee64a
add esp, 0x10
push ebx
push esi
call ebp
push eax
push 1
push esi
call fcn.004ee64a
add esp, 0x10
pop edi
mov eax, 1
pop ebp
add esp, 0x10
ret
Function at 0x40b1b0
Capabilities:
Get file version info

Disassembly:
sub esp, 0x98
mov eax, dword [0x5706b0]
xor eax, esp
mov dword [esp + 0x94], eax
push ebx
push ebp
mov ebp, dword [esp + 0xa4]
push esi
call fcn.0040bb40
mov ebx, eax
lea eax, [esp + 0x1c]
push eax
push ebx
mov dword [esp + 0x20], 0
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x40b313
push edi
push esi
call fcn.004dcd28
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x40b309
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x20]
push edx
push 0x5359a4
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x40b309
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0x5359a8
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x40b2e9
mov eax, dword [esp + 0x18]
movzx edx, word [eax + 2]
movzx eax, word [eax]
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
push edx
push eax
lea ecx, [esp + 0x2c]
push str.StringFileInfo_04x_04xFileVersion
push ecx
call esi
add esp, 0x10
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x2c]
push ecx
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x40b29b
mov edx, dword [esp + 0x14]
push edx
lea eax, [ebp + 0x10]
push 0x100
push eax
call fcn.00450b87
add esp, 0xc
mov eax, dword [esp + 0x18]
movzx ecx, word [eax + 2]
movzx edx, word [eax]
push ecx
push edx
lea eax, [esp + 0x2c]
push str.StringFileInfo_04x_04xCompanyName
push eax
call esi
add esp, 0x10
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x2c]
push eax
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x40b2e9
mov ecx, dword [esp + 0x14]
push ecx
lea edx, [ebp + 0x110]
push 0x100
push edx
call fcn.00450b87
add esp, 0xc
mov eax, dword [esp + 0x1c]
movzx ecx, word [eax + 0xa]
mov dword [ebp], ecx
movzx edx, word [eax + 8]
mov dword [ebp + 4], edx
movzx ecx, word [eax + 0xe]
mov dword [ebp + 8], ecx
movzx edx, word [eax + 0xc]
mov dword [ebp + 0xc], edx
push edi
call fcn.004dcd33
add esp, 4
pop edi
mov ecx, dword [esp + 0xa0]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004edcb6
add esp, 0x98
ret 4
Function at 0x40c2a0
Capabilities:
Create thread
Resume thread

Disassembly:
push ecx
cmp dword [esi + 0xa8], 0
je 0x40c2ae
xor eax, eax
pop ecx
ret
lea eax, [esp]
push eax
push 4
push esi
push 0x40c380
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0xa8], eax
test eax, eax
je 0x40c2aa
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ecx, dword [esi + 0xa8]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
pop ecx
ret

Function at 0x40c3e0
Capabilities:
Create thread
Resume thread

Disassembly:
push 0xffffffffffffffff
push 0x51230b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
mov eax, dword [0x5706b0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x24]
mov eax, dword [esi + 0x8c4]
cmp dword [eax + 0xa64], 1
je 0x40c5b9
mov ecx, dword [eax + 0xa68]
xor ebx, ebx
cmp ecx, ebx
je 0x40c5b9
push eax
call fcn.00426c90
cmp dword [esi + 0xd5c], ebx
jne 0x40c503
mov ecx, dword [esi + 0xd70]
cmp ecx, ebx
je 0x40c47c
mov eax, dword [ecx]
mov edx, dword [eax + 0x14]
call edx
test eax, eax
je 0x40c46d
mov eax, dword [esi + 0xd70]
mov dword [eax + 0xc], 7
mov ecx, dword [esi + 0xd70]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
mov ecx, dword [esi + 0xd70]
mov dword [ecx + 0x10], 3
jmp 0x40c4bd
push 0x54
call fcn.004dccf9
add esp, 4
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], ebx
cmp eax, ebx
je 0x40c499
call fcn.00402920
jmp 0x40c49b
xor eax, eax
mov dword [esp + 0x1c], 0xffffffff
mov dword [esi + 0xd70], eax
mov dword [eax + 0x10], 3
mov ecx, dword [esi + 0xd70]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esi + 0xd70]
mov dword [ecx + 0x1c], ebx
mov edx, dword [esi + 0xd70]
mov dword [edx + 0x20], ebx
mov eax, dword [esi + 0xd70]
mov dword [eax + 0x24], ebx
mov ecx, dword [esi + 0xd70]
mov dword [ecx + 0xc], 1
mov ecx, dword [esi + 0xd70]
jmp 0x40c4f0
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
mov ecx, dword [esi + 0xd70]
cmp dword [ecx + 0xc], 6
jne 0x40c4f0
mov ecx, dword [esi + 0x8c4]
xor edx, edx
mov word [ecx + 0x404], dx
cmp ebp, ebx
je 0x40c530
mov eax, dword [esi + 0x8c4]
push ebp
add eax, 0x404
push 0x100
push eax
call fcn.00450bd1
add esp, 0xc
mov edx, dword [esi + 0x8c4]
lea ecx, [esp + 0x10]
push ecx
push 4
push edx
push 0x40c7f0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0xac], eax
cmp eax, ebx
je 0x40c57f
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [esi + 0xac]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop ebp
pop ebx
add esp, 0x14
ret 4
mov eax, dword [0x57c8d8]
cmp eax, ebx
je 0x40c58f
xor edx, edx
call fcn.00413ee0
mov ecx, dword [esi + 0x8c4]
mov dword [ecx + 0xa68], 1
mov eax, dword [0x57c848]
cmp eax, ebx
je 0x40c5b9
mov edx, dword [eax + 0x20]
push ebx
push ebx
push 0x42a
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop ebp
pop ebx
add esp, 0x14
ret 4
Function at 0x40c5d0
Capabilities:
Create thread
Resume thread

Disassembly:
push 0xffffffffffffffff
push 0x51306b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push edi
mov eax, dword [0x5706b0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, dword [esi + 0x8c4]
mov eax, dword [edi + 0xa68]
xor ebx, ebx
cmp eax, ebx
je 0x40c7cd
mov eax, dword [0x57c8d8]
cmp eax, ebx
je 0x40c61d
lea edx, [ebx + 1]
call fcn.00413ee0
mov ebp, dword [sym.imp.USER32.dll_SendMessageW]
mov dword [edi + 0xa68], ebx
mov eax, dword [0x57c848]
cmp eax, ebx
je 0x40c63f
mov eax, dword [eax + 0x20]
push ebx
push ebx
push 0x429
push eax
call ebp
cmp dword [esi + 0xd5c], ebx
jne 0x40c712
mov ecx, dword [esi + 0xd70]
cmp ecx, ebx
je 0x40c689
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
call eax
test eax, eax
je 0x40c67a
mov ecx, dword [esi + 0xd70]
mov dword [ecx + 0xc], 7
mov ecx, dword [esi + 0xd70]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
mov ecx, dword [esi + 0xd70]
mov dword [ecx + 0x10], 3
jmp 0x40c6ca
push 0x54
call fcn.004dccf9
add esp, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], ebx
cmp eax, ebx
je 0x40c6a6
call fcn.00402920
jmp 0x40c6a8
xor eax, eax
mov dword [esp + 0x20], 0xffffffff
mov dword [esi + 0xd70], eax
mov dword [eax + 0x10], 3
mov ecx, dword [esi + 0xd70]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esi + 0xd70]
mov dword [ecx + 0x1c], ebx
mov edx, dword [esi + 0xd70]
mov dword [edx + 0x20], ebx
mov eax, dword [esi + 0xd70]
mov dword [eax + 0x24], ebx
mov ecx, dword [esi + 0xd70]
mov dword [ecx + 0xc], 1
mov ecx, dword [esi + 0xd70]
mov edi, 6
lea ecx, [ecx]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
mov ecx, dword [esi + 0xd70]
cmp dword [ecx + 0xc], edi
jne 0x40c700
mov ecx, dword [esp + 0x28]
mov edx, dword [esi + 0x8c4]
push ecx
add edx, 0x604
push 0x200
push edx
call fcn.00450bd1
mov eax, dword [esp + 0x38]
mov ecx, dword [esi + 0x8c4]
push eax
add ecx, 4
push 0x200
push ecx
call fcn.00450bd1
mov edx, dword [esi + 0x8c4]
mov eax, dword [esp + 0x48]
add esp, 0x18
lea ecx, [esp + 0x14]
push ecx
push 4
mov dword [edx + 0xa5c], eax
mov edx, dword [esi + 0x8c4]
push edx
push 0x40c850
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0xac], eax
cmp eax, ebx
je 0x40c797
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [esi + 0xac]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x40c7cd
mov eax, dword [0x57c8d8]
cmp eax, ebx
je 0x40c7a7
xor edx, edx
call fcn.00413ee0
mov ecx, dword [esi + 0x8c4]
mov dword [ecx + 0xa68], 1
mov eax, dword [0x57c848]
cmp eax, ebx
je 0x40c7cd
mov edx, dword [eax + 0x20]
push ebx
push ebx
push 0x42a
push edx
call ebp
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
add esp, 0x14
ret 0xc
Function at 0x4126c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x210
mov eax, dword [0x5706b0]
xor eax, esp
mov dword [esp + 0x20c], eax
mov eax, dword [esp + 0x214]
push esi
mov esi, dword [eax]
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0xc]
push ecx
push 0
push esi
mov dword [esp + 0x14], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 8]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x210]
pop esi
xor ecx, esp
xor eax, eax
call fcn.004edcb6
add esp, 0x210
ret 4

Function at 0x412730
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3a0]
sub esp, 0x420
mov eax, dword [0x5706b0]
xor eax, ebp
mov dword [ebp + 0x39c], eax
mov eax, dword [ebp + 0x3a8]
push ebx
push esi
push edi
push 5
push 0
push 0
push eax
push 0x535d88
push 0
mov dword [ebp - 0x7c], eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ebx, eax
mov dword [ebp - 0x80], ebx
cmp ebx, 0x20
ja 0x41288a
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x78]
push eax
push 1
push 0
push str..htm
push SysReAllocString
call esi
test eax, eax
jne 0x412888
lea ecx, [ebp - 0x78]
push ecx
lea edi, [ebp - 0x74]
call fcn.004126c0
test eax, eax
jne 0x412888
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x541460
mov edx, edi
push edx
call ebx
lea eax, [ebp - 0x78]
push eax
push 1
push 0
mov ecx, edi
push ecx
push SysReAllocString
call esi
test eax, eax
jne 0x412883
lea edx, [ebp - 0x78]
push edx
call fcn.004126c0
test eax, eax
jne 0x412883
mov eax, edi
push 0x541488
push eax
call fcn.004ee6cc
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
add esp, 8
test esi, esi
jne 0x412830
lea ecx, [ebp - 0x74]
push 0x541494
push ecx
call fcn.004ee6cc
mov esi, eax
add esp, 8
test esi, esi
jne 0x412829
lea edx, [ebp - 0x74]
push edx
call edi
lea esi, [ebp + eax*2 - 0x76]
jmp 0x412835
xor eax, eax
mov word [esi], ax
jmp 0x412835
xor ecx, ecx
mov word [esi], cx
push 0x534a20
push esi
call ebx
mov edx, dword [ebp - 0x7c]
push edx
push esi
call ebx
lea eax, [ebp - 0x74]
push eax
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x41285f
xor eax, eax
push 5
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x41288a
lea esi, [eax + eax]
mov eax, esi
call fcn.004ef5d0
mov eax, esp
push 3
push esi
lea ecx, [ebp - 0x74]
push ecx
push eax
call fcn.00412c30
push 5
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x41288a
mov eax, dword [ebp - 0x80]
jmp 0x41288a
mov eax, ebx
lea esp, [ebp - 0x8c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x39c]
xor ecx, ebp
call fcn.004edcb6
add ebp, 0x3a0
mov esp, ebp
pop ebp
ret 4
Function at 0x413120
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x554c40
push 0x4ef3c0
mov eax, dword fs:[0]
push eax
sub esp, 0x70
push ebx
push esi
push edi
mov eax, dword [0x5706b0]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
push str.GlobalMemoryStatusEx
push 0x535ca4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push 0x40
push 0
lea eax, [ebp - 0x80]
push eax
call fcn.004ef550
add esp, 0xc
mov dword [ebp - 0x80], 0x40
wait
mov dword [ebp - 4], 0
test esi, esi
je 0x4131c3
lea ecx, [ebp - 0x80]
push ecx
call esi
test eax, eax
je 0x4131c3
mov edx, dword [ebp - 0x74]
fild dword [ebp - 0x74]
test edx, edx
jge 0x4131a9
fadd qword [0x544c18]
fmul qword [0x544c18]
mov eax, dword [ebp - 0x78]
fild dword [ebp - 0x78]
test eax, eax
jge 0x4131bf
fadd qword [0x544c18]
faddp st(1)
jmp 0x4131dd
lea ecx, [ebp - 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov edx, dword [ebp - 0x38]
fild dword [ebp - 0x38]
test edx, edx
jge 0x4131dd
fadd qword [0x544c18]
fmul qword [0x544c10]
fadd qword [str.ffffff]
call fcn.004efaf0
mov dword [ebp - 0x1c], eax
test al, 1
je 0x4131f9
inc eax
mov dword [ebp - 0x1c], eax
wait
jmp 0x41320b
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x413f30
Capabilities:
Get memory capacity

Disassembly:
mov ecx, dword [esi + 0x810]
test ecx, ecx
je 0x413f3f
call fcn.00456b6d
mov ecx, dword [esi + 0x818]
test ecx, ecx
je 0x413f4e
call fcn.004399c4
cmp dword [0x57d568], 0
je 0x413f6f
cmp dword [0x57d584], 0
jne 0x413f6f
mov ecx, dword [esi + 0x834]
test ecx, ecx
je 0x413f6f
call fcn.0045aee2
cmp dword [0x57d564], 0
je 0x413f90
cmp dword [0x57d584], 0
jne 0x413f90
mov ecx, dword [esi + 0x82c]
test ecx, ecx
je 0x413f90
jmp 0x45ba7c
ret
push 0x30
mov eax, 0x50df6b
call fcn.004ef9e2
mov dword [ebp - 0x14], ecx
call fcn.0047809e
call fcn.00451ca2
mov esi, dword [eax + 0x60]
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
fild dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
test eax, eax
jge 0x45bab2
fadd dword [0x544c00]
xor ebx, ebx
fstp dword [ebp - 0x10]
cmp dword [esi + 0x118], ebx
jne 0x45bb21
push 0x164
call fcn.004dccf9
pop ecx
mov ecx, eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], ebx
cmp ecx, ebx
je 0x45bade
push ebx
call fcn.00469e1c
jmp 0x45bae0
xor eax, eax
or dword [ebp - 4], 0xffffffff
push str.System_Memory
mov dword [esi + 0x118], eax
add eax, 4
push 0x100
push eax
call fcn.00450b87
mov eax, dword [esi]
add esp, 0xc
push dword [esi + 0x118]
mov ecx, esi
call dword [eax + 0x14]
mov edi, dword [esi + 0x118]
call fcn.00451ca2
mov ecx, dword [eax + 0x30]
push edi
call fcn.004562f8
fld dword [ebp - 0x10]
push 1
push ecx
mov ecx, dword [esi + 0x118]
fstp dword [esp]
call fcn.004681bd
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], ebx
call fcn.004560b8
jmp 0x45bb5b
push ebx
mov ecx, eax
call fcn.00479530
lea ecx, [ebp - 0x1c]
call fcn.00450c7d
cmp eax, ebx
jne 0x45bb4b
call fcn.004efaba
ret
Function at 0x426cd0
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x51211b
mov eax, dword fs:[0]
push eax
sub esp, 0x898
mov eax, dword [0x5706b0]
xor eax, esp
mov dword [esp + 0x894], eax
push ebp
push esi
push edi
mov eax, dword [0x5706b0]
xor eax, esp
push eax
lea eax, [esp + 0x8a8]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x8b8]
mov dword [esp + 0x10], vtable.CRJK.0
mov byte [esp + 0x14], 0
mov dword [esp + 0x8b0], 0
mov eax, dword [0x57d0f0]
movzx edx, byte [eax]
add dl, 0x30
mov byte [esp + 0x484], dl
movzx edx, byte [eax + 4]
add dl, 0x30
push ecx
mov ecx, dword [esp + 0x8c0]
mov byte [esp + 0x489], dl
movzx edx, byte [eax + 8]
mov al, byte [eax + 0xc]
push ecx
add dl, 0x30
push 0x543fbc
mov byte [esp + 0x492], dl
lea edx, [esp + 0x6b0]
add al, 0x30
push 0x100
push edx
mov byte [esp + 0x49b], al
mov byte [esp + 0x49c], 0x35
mov byte [esp + 0x49d], 0x30
mov byte [esp + 0x49e], 0x65
mov byte [esp + 0x49f], 0x36
mov byte [esp + 0x4a0], 0x67
mov byte [esp + 0x4a1], 0x6b
mov byte [esp + 0x4a2], 0x69
mov byte [esp + 0x4a3], 0x75
mov byte [esp + 0x4a4], 0x39
mov byte [esp + 0x4a5], 0x37
mov byte [esp + 0x4a6], 0x31
mov byte [esp + 0x4a7], 0x61
call fcn.00450bd1
add esp, 0x14
push 0
push 0
push 0x200
lea eax, [esp + 0x4b0]
push eax
push 0xffffffffffffffff
lea ecx, [esp + 0x6b8]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [esp + 0x4a4]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x426e15
sub eax, edx
mov edx, dword [ebp + 0xa58]
lea edi, [eax + 0x10]
and edi, 0xfffffff0
add edx, edi
cmp edx, 0x10000
ja 0x426e95
cmp eax, edi
jge 0x426e4f
mov edx, edi
sub edx, eax
push edx
lea ecx, [esp + eax + 0x4a8]
push 0
push ecx
call fcn.004ef550
add esp, 0xc
lea eax, [esp + 0x484]
push eax
lea esi, [esp + 0x14]
call fcn.004220f0
lea edx, [esp + 0x4a4]
push edi
mov ecx, edx
mov eax, esi
call fcn.00422b90
mov edx, dword [ebp + 0xa48]
add edx, dword [ebp + 0xa58]
push edi
lea ecx, [esp + 0x4a8]
push ecx
push edx
call fcn.004efcc0
add esp, 0xc
add dword [ebp + 0xa58], edi
mov ecx, dword [esp + 0x8a8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x894]
xor ecx, esp
call fcn.004edcb6
add esp, 0x8a4
ret 8