joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402119
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x406110
cmp edx, dword [eax]
je 0x40213b
add eax, 8
inc ecx
cmp eax, 0x4061a0
jl 0x40212c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x406110]
jne 0x402269
mov eax, dword [0x4084e0]
cmp eax, 1
je 0x402243
test eax, eax
jne 0x40216c
cmp dword [0x406064], 1
je 0x402243
cmp edx, 0xfc
je 0x402269
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4021a3
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00403590
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00403680
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4021e6
lea eax, [ebp - 0x1a4]
push eax
call fcn.00403680
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4053b8
push edi
call fcn.00401180
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00403590
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004035a0
lea eax, [ebp - 0xa0]
push 0x405398
push eax
call fcn.004035a0
push dword [esi + 0x406114]
lea eax, [ebp - 0xa0]
push eax
call fcn.004035a0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00403e1f
add esp, 0x2c
pop edi
jmp 0x402269
lea eax, [ebp + 8]
lea esi, [esi + 0x406114]
push 0
push eax
push dword [esi]
call fcn.00403680
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x419610
Capabilities:
Get disk information

Disassembly:
sub esp, 8
mov eax, dword [0x4d2030]
mov edx, dword [0x4d2034]
mov dword [esp + 4], 0
push 0x4d2064
lea ecx, [eax + eax]
or ecx, edx
mov dword [esp + 4], ecx
fild qword [esp + 4]
fadd qword [0x4d2058]
fstp qword [0x4d2058]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [0x4d5acc], eax
add esp, 8
ret

Function at 0x43187e
Capabilities:
Encode data using xor

Disassembly:
inc ebx
invalid
lahf
mov esi, 0xa98af794
cmovl esp, dword [esi]
wait
clc
jbe 0x43185b
sar dword [ecx - 0x37ee3268], cl
jb 0x4318d8
push edx
enter 0x318f, 0x12
lahf
sti
sub eax, 0xff779093
mov dh, 0xe6
retf
leave
add eax, 0xf6128658
fisub dword [eax]
adc eax, 0x61756ce1
jne 0x43193b
sbb cl, byte [esi]
pushal
mov al, 0x32
sbb edx, dword [0x3d228387]
xchg edx, eax
loop 0x4318cd
push es
mov ch, byte [edi + 0x36f32185]
int 0xe5
test dword [ecx], esp
int 0xe5
pop ds
sub byte [ebp - 0x38528d51], 0x13
sti
cli
pop ebx
xchg ecx, eax
add esp, ecx
add ebp, eax
adc dl, bl
adc edi, dword [ebx - 0x18edb203]
outsb dx, byte [esi]
ja 0x431925
cmp eax, dword [edi + 0x5e88e636]
push es
xchg edx, eax
mov esp, 0x6c11d38a
xchg byte [edx - 0x53], ch
aas
jl 0x43199b
adc byte [edx - 0x36ad97d8], dl
push ebx
pushfd
outsb dx, byte [esi]
xchg ebx, eax
aad 0x2c
pop esi
test dword [eax], ebp
jp 0x431962
inc esi
invalid
or eax, 0x1c1b9c89
dec ebp
xchg edx, eax
call [0x72acdb96]
imul ecx, esp, 0xffffff8a
nop
pushfd
sbb ebx, dword [ecx*2 - 0x69e2006e]
fld xword [edx + esi*2 - 0x6f753395]
fistp qword [0x8ec8c3db]
adc ebp, ebp
jecxz 0x4318fd
dec esp
jno 0x4318eb
jp 0x43196e
sti
xchg edx, eax
or eax, 0x493c51a
ljmp 0x870f
fdivr qword [edx + ebp*2]
ja 0x24d56050
or eax, 0x22c625f9
fidiv word [ebx + 0x33]
call 0x7f3ba79d
invalid
and eax, 0x137f3281
ror ah, 1
jnp 0x431939
pop eax
inc edx
sbb al, 0x13
stosb byte es:[edi], al
adc dl, byte [ecx - 0x16]
push ecx
mov esi, 0x5c0d5371
mov ecx, 0x1239b34d
mov edx, 0x142373ab
call 0x1985a050
fdivp st(3)
mov cl, 0x86
inc edx
sbb esi, ebx
sti
and eax, dword [edx + eax]
sbb al, 0xb7
jb 0x431978
invalid

Function at 0x4623e2
Capabilities:
Encode data using xor

Disassembly:
cmp eax, 0x3b0214f5
jae 0x4623d4
imul esp, dword [ebx], 0xffffffd1
xor dword [ecx - 0x6e], 0x39
or al, 0xe4
out 0x29, eax
push bp
invalid
Function at 0x4c7ebd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4d2380
cmp edx, dword [eax]
je 0x4c7edf
add eax, 8
inc ecx
cmp eax, 0x4d2410
jl 0x4c7ed0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4d2380]
jne 0x4c800d
mov eax, dword [0x4d7db0]
cmp eax, 1
je 0x4c7fe7
test eax, eax
jne 0x4c7f10
cmp dword [0x4d22a8], 1
je 0x4c7fe7
cmp edx, 0xfc
je 0x4c800d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4c7f47
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004c88a0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004c8d30
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4c7f8a
lea eax, [ebp - 0x1a4]
push eax
call fcn.004c8d30
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4cde1c
push edi
call fcn.004cac00
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004c88a0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004c88b0
lea eax, [ebp - 0xa0]
push 0x4cddfc
push eax
call fcn.004c88b0
push dword [esi + 0x4d2384]
lea eax, [ebp - 0xa0]
push eax
call fcn.004c88b0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004cab74
add esp, 0x2c
pop edi
jmp 0x4c800d
lea eax, [ebp + 8]
lea esi, [esi + 0x4d2384]
push 0
push eax
push dword [esi]
call fcn.004c8d30
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4043e6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x4043ff
cmp dword [esi], 2
jae 0x4043ff
push 0x7a
pop eax
jmp 0x40445d
mov eax, dword [esi]
and dword [esi], 0
add eax, eax
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40445d
cmp dword [ebp + 0x10], 7
je 0x40442d
push 0xd
jmp 0x4043fc
mov ecx, dword [ebp + 0xc]
test edi, edi
je 0x404457
test cl, 1
jne 0x404429
mov eax, ecx
shr eax, 1
cmp eax, 1
jb 0x404429
cmp word [edi + eax*2 - 2], 0
jne 0x404429
cmp eax, 1
jbe 0x404457
cmp word [edi + eax*2 - 4], 0
jne 0x404429
shr ecx, 1
mov dword [esi], ecx
xor eax, eax
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x4089a1
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
ret 8

Function at 0x4089f2
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov ebx, ecx
test esi, esi
jne 0x408a03
push 0xd
pop eax
jmp 0x408a30
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x408a06
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
ret 8

Function at 0x409395
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
sub esp, 0x200
lea ebp, [esp - 4]
mov eax, dword [0x477930]
xor eax, ebp
mov dword [ebp + 0x200], eax
push 0x18
mov eax, 0x45302e
call fcn.0043e1bc
mov eax, dword [ebp + 0x20c]
xor esi, esi
mov edi, ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], esi
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
lea ecx, [ebp - 0x14]
call fcn.004043a5
mov ebx, eax
cmp ebx, esi
je 0x40941d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0040438a
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x200]
xor ecx, ebp
call fcn.0043e1ad
add ebp, 0x204
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x409435
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x14]
call fcn.00409395
cmp eax, esi
jne 0x409467
lea eax, [ebp - 0x24]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp]
push eax
push esi
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 0x100
call ebx
test eax, eax
je 0x409425
lea ecx, [ebp - 0x14]
call fcn.0040438a
push dword [ebp - 0x1c]
mov ecx, edi
call fcn.004088ec
mov esi, eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0040438a
mov eax, esi
jmp 0x4093f8
Function at 0x40c3a9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
sub esp, 0x404
lea ebp, [esp - 4]
mov eax, dword [0x477930]
xor eax, ebp
mov dword [ebp + 0x404], eax
push 0x20
mov eax, 0x4535eb
call fcn.0043e1ef
mov eax, dword [ebp + 0x410]
mov esi, dword [ebp + 0x414]
mov edi, dword [ebp + 0x418]
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], ebx
mov dword [ebp], ebx
mov byte [ebp - 4], 1
push 2
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 0x14], eax
cmp eax, ebx
jne 0x40c411
call fcn.00407ed8
mov esi, eax
jmp 0x40c516
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, ebx
jne 0x40c42a
call fcn.00407ed8
jmp 0x40c50b
push esi
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x18], eax
cmp eax, ebx
je 0x40c420
push esi
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x20], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x40c49c
mov byte [ebp - 4], bl
lea eax, [ebp + 4]
cmp dword [ebp], eax
je 0x40c464
lea ecx, [ebp]
call fcn.00409049
mov esi, 0x8007000e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00405945
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x404]
xor ecx, ebp
call fcn.0043e1ad
add ebp, 0x408
leave
ret 0x10
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp]
call fcn.0040a6ca
mov dword [ebp - 4], 1
jmp 0x40c4cc
cmp dword [ebp], ebx
jne 0x40c4d8
mov esi, 0x8007000e
jmp 0x40c50d
push esi
push dword [ebp]
push esi
push dword [ebp - 0x18]
push ebx
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, ebx
je 0x40c420
xor ecx, ecx
mov edx, dword [ebp]
mov word [edx + eax*2], cx
push dword [ebp + 0x41c]
push dword [ebp]
lea ecx, [ebp - 0x28]
call fcn.0040bdf2
mov esi, eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov byte [ebp - 4], bl
lea eax, [ebp + 4]
cmp dword [ebp], eax
je 0x40c469
lea ecx, [ebp]
call fcn.00409049
jmp 0x40c469
Function at 0x40cba0
Capabilities:
Create process on windows

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x477930]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0x5c
mov eax, 0x45371f
call fcn.0043e1bc
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
push 0x38
lea eax, [ebp - 0x5c]
push ebx
push eax
mov dword [ebp - 0x68], 0x44
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], 0x459144
call fcn.0043e640
xor eax, eax
mov dword [ebp - 0x24], ebx
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
push 0x206
mov word [ebp], ax
lea eax, [ebp + 2]
push ebx
push eax
mov dword [ebp - 0x10], ebx
call fcn.0043e640
add esp, 0x18
call fcn.00417ae0
mov eax, dword [eax + 4]
push 0x104
lea ecx, [ebp]
push ecx
push dword [eax + 0x44]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp + 0x214]
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0040c0b2
add esp, 0xc
mov byte [ebp - 4], 1
push 0xb
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call fcn.0040835f
test eax, eax
jne 0x40cc61
push 0xb
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call fcn.0040c9a8
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x68]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x14]
call fcn.004016d0
push eax
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x40cc9b
push dword [ebp - 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x24]
call esi
push dword [ebp - 0x10]
call esi
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
call fcn.004018ed
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x14]
call fcn.004024c0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x214]
call fcn.004024c0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.0043e1ad
add ebp, 0x20c
leave
ret 4

Function at 0x40e203
Capabilities:
Create process on windows

Disassembly:
push 1
xor eax, eax
push eax
push eax
push dword [0x479118]
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
ret
Function at 0x4131d4
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [ecx]
xor ecx, ecx
cmp dword [eax - 0xc], ecx
jne 0x4131e0
xor eax, eax
ret
push 1
push ecx
push ecx
push eax
push str.open
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
cmp eax, 0x20
setg cl
mov eax, ecx
ret

Function at 0x413666
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x477930]
xor eax, ebp
mov dword [ebp + 0x9c], eax
push esi
push edi
mov esi, 0x11c
push esi
xor edi, edi
lea eax, [ebp - 0x80]
push edi
push eax
call fcn.0043e640
add esp, 0xc
lea eax, [ebp - 0x80]
mov dword [ebp - 0x80], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
test eax, eax
jne 0x4136d3
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x114
call esi
test eax, eax
jne 0x4136d3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error__CSUComUtil::IsWindowsVistaOrLater__GetVersionEx_failed_with_error__d._n
call fcn.0043e3d0
pop ecx
pop ecx
xor eax, eax
jmp 0x4136de
cmp dword [ebp - 0x7c], 6
jb 0x4136dc
xor edi, edi
inc edi
mov eax, edi
mov ecx, dword [ebp + 0x9c]
pop edi
xor ecx, ebp
pop esi
call fcn.0043e1ad
add ebp, 0xa0
leave
ret

Function at 0x413838
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x10]
mov eax, dword [esi]
and dword [esi], 0
push edi
mov edi, dword [ebp + 0xc]
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4138a1
cmp dword [ebp + 0x10], 1
je 0x413879
cmp dword [ebp + 0x10], 2
je 0x413879
push 0xd
pop eax
jmp 0x4138a1
mov eax, dword [ebp - 4]
test edi, edi
je 0x41389b
test eax, eax
je 0x413896
test al, 1
jne 0x413874
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x41389b
jmp 0x413874
xor ecx, ecx
mov word [edi], cx
shr eax, 1
mov dword [esi], eax
xor eax, eax
pop edi
pop esi
leave
ret 0xc

Function at 0x4141ec
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x477930]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.00414189
test eax, eax
je 0x41420a
xor eax, eax
inc eax
jmp 0x41426c
push ebx
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x414251
push 0x45cd78
call fcn.0043e3d0
pop ecx
jmp 0x414268
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x10]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043e1ad
leave
ret
Function at 0x4155ea
Capabilities:
Get system information on windows

Disassembly:
push 4
mov eax, 0x4547e0
call fcn.0043e1bc
mov esi, ecx
push 0x24
lea eax, [esi + 4]
push 0
push eax
call fcn.0043e640
mov ebx, 0x11c
push ebx
lea edi, [esi + 0x28]
push 0
push edi
call fcn.0043e640
add esp, 0x18
lea eax, [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov dword [edi], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push edi
call ebx
mov dword [esi + 0x144], eax
test eax, eax
jne 0x415658
push edi
mov dword [edi], 0x114
call ebx
test eax, eax
jne 0x415658
push 0x45ae2a
lea ecx, [ebp - 0x10]
call fcn.00407202
and dword [ebp - 4], 0
jmp 0x41566a
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call fcn.00414f71
mov dword [ebp - 4], 1
push eax
lea ecx, [esi + 0x148]
call fcn.00402eec
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004024c0
xor eax, eax
call fcn.0043e294
ret
Function at 0x416427
Capabilities:
Enumerate process modules

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x477930]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0x10
mov eax, 0x454968
call fcn.0043e1bc
xor ebx, ebx
mov dword [ebp - 4], ebx
push 5
pop ecx
push 0x1f4
lea eax, [ebp + 0x14]
push ebx
mov esi, 0x45e790
lea edi, [ebp]
push eax
mov byte [ebp - 0xd], bl
rep movsd dword es:[edi], dword [esi]
call fcn.0043e640
add esp, 0xc
push dword [ebp + 0x214]
push ebx
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, ebx
je 0x4164b0
lea eax, [ebp - 0x1c]
push eax
push 4
lea eax, [ebp - 0x18]
push eax
push esi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x4164b0
push 0x104
lea eax, [ebp]
push eax
push dword [ebp - 0x18]
push esi
call sub.PSAPI.DLL_GetModuleBaseNameW
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x14]
call fcn.004034a4
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.0040b97a
push dword [ebp - 0x14]
lea ecx, [ebp + 0x218]
call fcn.0040674d
test eax, eax
jne 0x4164de
mov byte [ebp - 0xd], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x14]
call fcn.004024c0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x218]
call fcn.004024c0
mov al, byte [ebp - 0xd]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.0043e1ad
add ebp, 0x20c
leave
ret 8

Function at 0x416527
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4549a0
mov eax, dword fs:[0]
push eax
mov eax, 0x1008
call fcn.004410c0
push ebx
push esi
push edi
mov eax, dword [0x477930]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
xor esi, esi
mov dword [ebp - 4], esi
lea eax, [ebp - 0x10]
push eax
push 0x1000
lea eax, [ebp - 0x1014]
push eax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x416599
or esi, 0xffffffff
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004024c0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4
mov edi, dword [ebp - 0x10]
shr edi, 2
test edi, edi
jbe 0x416576
push ecx
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
call fcn.00402606
mov byte [ebp - 4], 1
push dword [ebp + esi*4 - 0x1014]
mov byte [ebp - 4], 0
mov ecx, ebx
call fcn.00416427
test al, al
jne 0x4165d3
inc esi
cmp esi, edi
jb 0x4165a3
jmp 0x416576
mov esi, dword [ebp + esi*4 - 0x1014]
jmp 0x416579
Function at 0x4165dc
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
xor eax, eax
xor esi, esi
mov dword [ebp - 0x14], esi
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 4]
push eax
push 0x28
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x416677
lea eax, [ebp - 0x10]
push eax
push str.SeShutdownPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push esi
push esi
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp - 4]
xor edi, edi
inc edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x416677
mov eax, dword [ebp + 8]
cmp eax, esi
jne 0x416649
push esi
push 0xd
jmp 0x41665a
cmp eax, edi
jne 0x416652
push esi
push 6
jmp 0x41665a
cmp eax, 2
jne 0x416662
push esi
push 4
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x416677
cmp eax, 3
jne 0x41666b
push edi
push edi
jmp 0x416672
cmp eax, 4
jne 0x416677
push esi
push esi
call sub.KERNEL32.dll_SetSystemPowerState
pop edi
pop esi
leave
ret 4

Function at 0x4166aa
Capabilities:
Send data
Send data on socket

Disassembly:
push 0
push dword [esp + 0xc]
call fcn.004410f0
pop ecx
push eax
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.WS2_32.dll_send]
ret 8

Function at 0x4166c8
Capabilities:
Resolve dns

Disassembly:
push dword [esp + 4]
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x4166dd
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
ret 4
Function at 0x418ab3
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x454abb
call fcn.0043e1bc
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x418ad8
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x418b1e
lea ecx, [ebp - 0x10]
call fcn.00402496
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00407e48
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.0040121c
mov eax, esi
call fcn.0043e294
ret 8

Function at 0x41983e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.00417ae0
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x419877
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.0041948a
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x4198d5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x4198f9
cmp dword [edi + 0x54], 0
jne 0x4198f9
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.00417ae0
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.00419896
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41f911
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x41f958
call fcn.00417ae0
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x41f958
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x41f974
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0041f489
mov esi, eax
test edi, edi
je 0x41f972
test ebx, ebx
je 0x41f972
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4