joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42b4c0
Capabilities:
Read file via mapping

Disassembly:
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x1c]
push 0
push 0
push 0
push 2
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
test eax, eax
mov dword [esi + 4], eax
je 0x42b535
push edi
mov eax, dword [esp + 0x1c]
mov edx, eax
mov dword [esp + 0x10], eax
sar edx, 0x1f
mov dword [esp + 0x14], edx
mov ecx, dword [esp + 0x14]
xor edx, edx
push eax
mov eax, dword [esp + 0x14]
push ecx
push 4
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
test eax, eax
je 0x42b528
push 1
mov edx, dword [esp + 0x1c]
lea ecx, [edx + edi]
push ecx
mov ecx, esi
call fcn.0042b418
test eax, eax
jns 0x42b537
push edi
mov ecx, esi
push ebx
call fcn.0042b544
xor ebx, ebx
jmp 0x42b537
xor ebx, ebx
pop edi
mov eax, ebx
pop esi
pop ebx
add esp, 8
ret 8

Function at 0x42d4c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
mov edx, dword fs:[0]
push 0xffffffffffffffff
xor eax, eax
push 0x42d54c
push edx
mov dword fs:[0], esp
sub esp, 0x10
push ebx
mov dword [ebp - 0x18], ecx
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x1c], eax
lea ecx, [ecx + 0x20]
call fcn.004198ac
mov dword [ebp - 4], 0
mov ebx, dword [ebp - 0x18]
xor edx, edx
mov dword [ebx + 0x24], edx
lea ecx, [ebx + 0x48]
mov dword [ebx + 0x28], edx
mov dword [ebx + 0x2c], edx
mov dword [ebx + 0x30], edx
mov dword [ebx + 0x34], edx
mov dword [ebx + 0x38], edx
mov dword [ebx + 0x3c], edx
mov dword [ebx + 0x40], edx
mov dword [ebx + 0x44], edx
call fcn.004085e8
mov dword [ebp - 4], 1
mov eax, ebx
mov dword [ebx], 0x44fd4c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x436e48
Capabilities:
Get geographical location

Disassembly:
push ebx
mov ebx, 1
push esi
push edi
cmp dword [0x461998], 0
jne 0x436e9a
push 0
push 0
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov esi, eax
test eax, eax
je 0x436ea0
push esi
call fcn.00404f38
add esp, 4
mov edi, eax
test eax, eax
je 0x436ea0
push esi
push edi
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x436ea0
mov ecx, dword [esp + 0x18]
mov dword [ecx], edi
pop edi
mov eax, ebx
pop esi
pop ebx
ret
mov dword [0x461998], 1
xor ebx, ebx
jmp 0x436e9a
Function at 0x436eb0
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x20
push ebx
mov ebx, 1
push esi
push edi
cmp dword [0x461998], 0
jne 0x436f60
push 0x10
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x3c]
push dword [esp + 0x3c]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x436f69
mov dword [esp + 0x10], ebx
xor ecx, ecx
mov ebx, ecx
mov dword [esp + 0x14], ecx
mov edx, 1
cmp dword [0x43e158], edx
jle 0x436f1c
push 4
mov al, byte [esp + ebx + 0x20]
mov byte [esp + 0x1c], al
and eax, 0xff
push eax
call fcn.00406f5c
add esp, 8
test eax, eax
je 0x436f52
jmp 0x436f38
mov cl, byte [esp + ebx + 0x1c]
mov esi, dword [0x43e230]
mov byte [esp + 0x18], cl
and ecx, 0xff
test word [esi + ecx*2], 4
je 0x436f52
mov edi, dword [esp + 0x14]
movzx edx, byte [esp + 0x18]
lea eax, [edi + edi*4]
lea eax, [edx + eax*2 - 0x30]
inc ebx
cmp ebx, 0x10
mov dword [esp + 0x14], eax
jb 0x436ef1
mov esi, dword [esp + 0x38]
mov cl, byte [esp + 0x14]
mov ebx, dword [esp + 0x10]
mov byte [esi], cl
pop edi
mov eax, ebx
pop esi
pop ebx
add esp, 0x20
ret
mov dword [0x461998], 1
xor ebx, ebx
jmp 0x436f60

Function at 0x436f78
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x1c
push ebx
mov ebx, 1
push esi
cmp dword [0x461998], 0
jne 0x437014
push 0x10
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x34]
push dword [esp + 0x34]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x43701c
mov dword [esp + 0xc], ebx
xor esi, esi
xor ebx, ebx
mov ecx, 1
cmp dword [0x43e158], ecx
jle 0x436fdc
push 4
mov dl, byte [esp + ebx + 0x18]
mov byte [esp + 0x14], dl
and edx, 0xff
push edx
call fcn.00406f5c
add esp, 8
test eax, eax
je 0x43700a
jmp 0x436ff8
mov dl, byte [esp + ebx + 0x14]
mov ecx, dword [0x43e230]
mov byte [esp + 0x10], dl
and edx, 0xff
test word [ecx + edx*2], 4
je 0x43700a
movzx edx, byte [esp + 0x10]
lea esi, [esi + esi*4]
inc ebx
lea esi, [edx + esi*2 - 0x30]
cmp ebx, 0x10
jb 0x436fb0
mov ecx, dword [esp + 0x30]
mov ebx, dword [esp + 0xc]
mov dword [ecx], esi
pop esi
mov eax, ebx
pop ebx
add esp, 0x1c
ret
mov dword [0x461998], 1
xor ebx, ebx
jmp 0x437014
Function at 0x4388a0
Capabilities:
Get file size

Disassembly:
sub esp, 0x18
push ebx
mov ebx, dword [esp + 0x24]
push esi
push edi
push 0x20
push 0
push ebx
call fcn.00403aac
mov word [ebx + 6], 1
add esp, 0xc
mov eax, dword [esp + 0x28]
push dword [eax*4 + 0x45f488]
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x4388e6
mov di, word [esp + 0x28]
mov edx, 0x2180
mov word [ebx], di
mov word [ebx + 0xc], di
jmp 0x438962
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
mov edx, dword [esp + 0x34]
push dword [edx*4 + 0x45f488]
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
jne 0x438915
call fcn.00406ec0
mov eax, 0xffffffff
pop edi
pop esi
pop ebx
add esp, 0x18
ret
lea esi, [esp + 0x1c]
push esi
call fcn.0043898c
test eax, eax
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x1c], eax
mov dword [ebx + 0x18], eax
jne 0x438938
pop edi
mov eax, 0xffffffff
pop esi
pop ebx
add esp, 0x18
ret
mov dword [esp + 0x14], 0x8180
xor ecx, ecx
push ecx
mov edx, dword [esp + 0x2c]
mov word [ebx], cx
mov word [ebx + 0xc], cx
push dword [edx*4 + 0x45f488]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [esp + 0x14]
mov dword [ebx + 0x10], eax
mov esi, edx
and esi, 0x1c0
mov dword [esp + 0x10], esi
sar esi, 3
mov eax, dword [esp + 0x10]
or esi, edx
sar eax, 6
or esi, eax
mov word [ebx + 4], si
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x18
ret
Function at 0x43b860
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
cmp ebx, 0x3c
jae 0x43b8aa
mov ecx, dword [ebp + 0x10]
or ecx, ecx
je 0x43b8a6
test byte [ebx + 0x45f44c], 0x10
jne 0x43b8bb
mov edx, dword [ebp + 0xc]
push ecx
push edx
push 0
lea eax, [ebp - 8]
push eax
push ecx
push edx
push dword [ebx*4 + 0x45f488]
call sub.KERNEL32.dll_ReadFile
pop edx
pop ecx
or eax, eax
je 0x43b8aa
mov eax, dword [ebp - 8]
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
jmp 0x43b8a1
push 9
call fcn.00406e78
mov eax, 0xffffffff
jmp 0x43b8a1
push esi
push edi
mov edi, dword [ebp + 0xc]
and byte [ebx + 0x45f44c], 0xfe
cld
push ds
pop es
mov edx, edi
push ecx
push edx
push 0
lea eax, [ebp - 8]
push eax
push ecx
push edx
push dword [ebx*4 + 0x45f488]
call sub.KERNEL32.dll_ReadFile
pop edx
pop ecx
or eax, eax
je 0x43b999
mov eax, dword [ebp - 8]
add edx, eax
cmp eax, ecx
je 0x43b8fe
or byte [ebx + 0x45f44c], 1
mov ecx, eax
or ecx, ecx
je 0x43ba40
push edi
mov al, 0x1a
repne scasb al, byte es:[edi]
je 0x43b968
pop edi
mov ecx, edx
sub ecx, edi
mov al, 0xd
xor esi, esi
repne scasb al, byte es:[edi]
jne 0x43ba40
cmp edi, edx
jae 0x43b9ad
cmp byte [edi], 0xa
jne 0x43b916
mov esi, edi
mov dword [ebp - 4], edi
dec dword [ebp - 4]
mov ecx, edx
sub ecx, edi
mov al, 0xd
repne scasb al, byte es:[edi]
jne 0x43ba0a
cmp edi, edx
jae 0x43b9ad
cmp byte [edi], 0xa
jne 0x43b939
mov ecx, edi
dec ecx
sub ecx, esi
mov eax, edi
mov edi, dword [ebp - 4]
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 4], edi
mov edi, eax
inc esi
jmp 0x43b933
dec edi
test byte [ebx + 0x45f44c], 8
jne 0x43b98b
sub edx, edi
push 1
push 0
push edx
push dword [ebx*4 + 0x45f488]
call sub.KERNEL32.dll_SetFilePointer
cmp ax, 0xffff
je 0x43b999
or byte [ebx + 0x45f44c], 1
mov edx, edi
jmp 0x43b90d
push 9
call fcn.00406e78
mov eax, 0xffffffff
jmp 0x43ba45
test byte [ebx + 0x45f44c], 1
jne 0x43ba0a
dec edx
mov ecx, 1
push ecx
push edx
push 0
lea eax, [ebp - 8]
push eax
push ecx
push edx
push dword [ebx*4 + 0x45f488]
call sub.KERNEL32.dll_ReadFile
pop edx
pop ecx
or eax, eax
je 0x43b999
mov eax, dword [ebp - 8]
or eax, eax
je 0x43ba03
cmp byte [edi - 1], 0xa
je 0x43ba0a
mov byte [edi - 1], 0xd
push 1
push 0
push 0xffffffffffffffff
push dword [ebx*4 + 0x45f488]
call sub.KERNEL32.dll_SetFilePointer
cmp ax, 0xffff
je 0x43b999
jmp 0x43ba0a
or byte [ebx + 0x45f44c], 1
cmp esi, 0
je 0x43ba40
mov ecx, edi
sub ecx, esi
mov edi, dword [ebp - 4]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
test byte [ebx + 0x45f44c], 8
jne 0x43ba40
mov ecx, esi
sub ecx, edi
je 0x43ba40
test byte [ebx + 0x45f44c], 1
je 0x43b8ca
mov eax, edi
sub eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001f8d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1001fe6
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x1001fd8
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x1001fd4
cmp esi, eax
jae 0x1001fd8
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x1001fc6
cmp esi, eax
jb 0x1001fdc
xor eax, eax
jmp 0x1001fe5
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop ebp
ret 0xc
Function at 0x1002e8f
Capabilities:
Check os version
Create process on windows

Disassembly:
push 0x370
mov eax, 0x1005cbb
call fcn.010055d3
mov edi, dword [ebp + 8]
xor esi, esi
push 0x38
lea eax, [ebp - 0x378]
push esi
push eax
mov dword [ebp - 0x32c], esi
mov dword [ebp - 0x330], esi
mov dword [ebp - 0x37c], esi
call sub.msvcrt.dll_memset
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push esi
push eax
mov dword [ebp - 0x340], 0x10
mov dword [ebp - 0x33c], esi
mov dword [ebp - 0x338], 0x1000
mov dword [ebp - 0x334], esi
mov dword [ebp - 0x328], esi
call sub.msvcrt.dll_memset
add esp, 0x18
mov eax, dword [section..data]
cmp eax, section..data
je 0x1002f2d
test byte [eax + 0x1c], 0x10
je 0x1002f2d
push edi
push 0x10012d0
push 0x12
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01002266
lea eax, [ebp - 0x328]
push eax
push 0x1001504
lea ecx, [ebp - 0x324]
call fcn.01002ab0
mov dword [ebp - 4], esi
cmp edi, esi
jne 0x1002f5a
mov dword [ebp - 0x328], 0x80070057
jmp 0x1003056
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
push edi
lea eax, [ebp - 0x218]
jae 0x1002f72
push 0x1001460
jmp 0x1002f77
push 0x1001408
push 0x10013f8
push 0x104
push eax
call fcn.01002970
add esp, 0x14
lea eax, [ebp - 0x32c]
push eax
push esi
call dword [sym.imp.ole32.dll_CreateBindCtx]
cmp eax, esi
mov dword [ebp - 0x328], eax
jl 0x1003056
mov eax, dword [ebp - 0x32c]
mov ecx, dword [eax]
lea edx, [ebp - 0x340]
push edx
push eax
call dword [ecx + 0x18]
cmp eax, esi
mov dword [ebp - 0x328], eax
jl 0x100303c
push esi
push esi
lea eax, [ebp - 0x330]
push eax
push dword [ebp - 0x32c]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHELL32.dll_SHParseDisplayName]
cmp eax, esi
mov dword [ebp - 0x328], eax
jl 0x100303c
mov eax, dword [ebp - 0x330]
mov dword [ebp - 0x358], eax
lea eax, [ebp - 0x37c]
push eax
mov dword [ebp - 0x37c], 0x3c
mov dword [ebp - 0x378], 0x304
mov dword [ebp - 0x360], 5
mov dword [ebp - 0x370], 0x10013ec
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push dword [ebp - 0x330]
call dword [sym.imp.SHELL32.dll_ILFree]
mov dword [ebp - 0x330], esi
mov eax, dword [ebp - 0x32c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebp - 0x328], esi
mov dword [ebp - 0x32c], esi
jge 0x1003080
mov eax, dword [section..data]
cmp eax, section..data
je 0x1003080
test byte [eax + 0x1c], 2
je 0x1003080
push dword [ebp - 0x328]
push 0x10012d0
push 0x13
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01001d79
mov esi, dword [ebp - 0x328]
lea ecx, [ebp - 0x324]
call fcn.010021ec
mov eax, esi
call fcn.01005665
ret 4
Function at 0x1003275
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x358
mov eax, dword [0x1007024]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor esi, esi
push 0x38
lea eax, [ebp - 0x354]
push esi
push eax
mov edi, ecx
mov dword [ebp - 0x358], esi
call sub.msvcrt.dll_memset
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push esi
push eax
mov dword [ebp - 0x31c], esi
call sub.msvcrt.dll_memset
add esp, 0x18
mov eax, dword [section..data]
cmp eax, section..data
je 0x10032f2
test byte [eax + 0x1c], 0x10
je 0x10032f2
push ebx
push 0x10012d0
push 0x19
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01002266
lea eax, [ebp - 0x31c]
push eax
push 0x10015bc
lea ecx, [ebp - 0x318]
call fcn.01002ab0
cmp ebx, esi
jne 0x100331c
mov dword [ebp - 0x31c], 0x80070057
jmp 0x10033b5
lea eax, [edi + 0x218]
cmp word [eax], si
je 0x100330d
mov dword [ebp - 0x348], eax
lea eax, [edi + 0x420]
mov dword [ebp - 0x358], 0x3c
mov dword [ebp - 0x354], 0x300
mov dword [ebp - 0x33c], 5
mov dword [ebp - 0x34c], 0x10013ec
cmp word [eax], si
je 0x1003382
push ebx
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.01002970
lea eax, [ebp - 0x20c]
add esp, 0x10
mov dword [ebp - 0x344], eax
lea eax, [ebp - 0x358]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x10033ad
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x10033a7
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x31c], eax
cmp dword [ebp - 0x31c], esi
jge 0x10033df
mov eax, dword [section..data]
cmp eax, section..data
je 0x10033df
test byte [eax + 0x1c], 2
je 0x10033df
push dword [ebp - 0x31c]
push 0x10012d0
push 0x1a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01001d79
mov esi, dword [ebp - 0x31c]
lea ecx, [ebp - 0x318]
call fcn.010021ec
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100557b
leave
ret 4
Function at 0x10043a3
Capabilities:
Create process on windows

Disassembly:
push 0x37c
mov eax, 0x1005e1a
call fcn.010055d3
mov edi, dword [ebp + 8]
xor eax, eax
xor esi, esi
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
mov ebx, ecx
push esi
push eax
mov dword [ebp - 0x334], ebx
mov dword [ebp - 0x328], esi
call sub.msvcrt.dll_memset
add esp, 0xc
mov eax, dword [section..data]
cmp eax, section..data
je 0x1004408
test byte [eax + 0x1c], 0x10
je 0x1004408
push edi
push 0x10012d0
push 0x1b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01002266
lea eax, [ebp - 0x328]
push eax
push 0x100171c
lea ecx, [ebp - 0x324]
call fcn.01002ab0
mov dword [ebp - 4], esi
cmp edi, esi
jne 0x1004435
mov dword [ebp - 0x328], 0x80070057
jmp 0x1004544
add ebx, 0x218
cmp word [ebx], si
je 0x1004426
mov ecx, dword [ebp - 0x334]
push 0x103
lea eax, [ebp - 0x218]
push eax
push edi
call fcn.01003e97
cmp eax, esi
mov dword [ebp - 0x328], eax
jl 0x1004544
push ebx
lea ecx, [ebp - 0x330]
call fcn.01003e51
mov ecx, dword [ebp - 0x334]
lea eax, [ebp - 0x330]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x32c]
push eax
mov byte [ebp - 4], 1
call fcn.0100391c
mov ecx, dword [ebp - 0x330]
add ecx, 0xfffffff0
call fcn.010020ec
mov ebx, dword [ebp - 0x32c]
cmp dword [ebx - 0xc], esi
jle 0x100452e
push 0x40
lea eax, [ebp - 0x384]
push esi
push eax
call sub.msvcrt.dll_memset
xor eax, eax
mov dword [ebp - 0x344], esi
lea edi, [ebp - 0x340]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
xor eax, eax
inc eax
mov word [ebp - 0x358], ax
lea eax, [ebp - 0x344]
push eax
lea eax, [ebp - 0x388]
push eax
push esi
push esi
push 0x620
push esi
push esi
push esi
push ebx
push esi
mov dword [ebp - 0x380], 0x10016fc
mov dword [ebp - 0x388], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x100452e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x1004528
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x328], eax
mov ecx, dword [ebp - 0x32c]
add ecx, 0xfffffff0
call fcn.010020ec
cmp dword [ebp - 0x328], esi
jge 0x100456e
mov eax, dword [section..data]
cmp eax, section..data
je 0x100456e
test byte [eax + 0x1c], 2
je 0x100456e
push dword [ebp - 0x328]
push 0x10012d0
push 0x1c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01001d79
mov esi, dword [ebp - 0x328]
lea ecx, [ebp - 0x324]
call fcn.010021ec
mov eax, esi
call fcn.01005665
ret 4
Function at 0x1004e4e
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x1007024]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
call fcn.01004d8f
mov eax, 0x1000000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x98]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
jne 0x1004ec1
cmp dword [ebp - 0x94], 5
jb 0x1004ee2
jmp 0x1004ede
cmp dword [ebp - 0x88], 1
jne 0x1004ee2
cmp dword [ebp - 0x94], 4
ja 0x1004ede
jne 0x1004ee2
cmp dword [ebp - 0x90], 0
jbe 0x1004ee2
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x1001820
call fcn.01004c02
test eax, eax
jge 0x1004f03
mov byte [0x1007044], 1
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0100557b
leave
ret
Function at 0x10054fe
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x1006238
call fcn.010056c0
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x1007460
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x10052b5
cmp eax, esi
jne 0x10052a8
xor esi, esi
inc esi
mov ebx, esi
jmp 0x10052b8
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100528f
xor esi, esi
inc esi
mov eax, dword [0x100745c]
cmp eax, esi
jne 0x10052cb
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x10052fa
mov eax, dword [0x100745c]
test eax, eax
jne 0x10052f4
mov dword [0x100745c], esi
push 0x10011f8
push 0x10011ec
call fcn.010051f4
pop ecx
pop ecx
test eax, eax
je 0x10052fa
jmp 0x1005422
mov dword [0x100712c], esi
mov eax, dword [0x100745c]
cmp eax, esi
jne 0x100531e
push 0x10011e8
push 0x10011d0
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x100745c], 2
test ebx, ebx
jne 0x100532a
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x100746c], 0
je 0x100534e
push 0x100746c
call fcn.01005979
pop ecx
test eax, eax
je 0x100534e
push 0
push 2
push 0
call dword [0x100746c]
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x10053aa
test al, al
je 0x1005368
cmp dword [ebp - 0x1c], 0
jne 0x10053aa
mov al, byte [esi]
test al, al
je 0x1005378
cmp al, 0x20
ja 0x1005378
inc esi
mov dword [ebp - 0x20], esi
jmp 0x1005368
test byte [ebp - 0x3c], 1
je 0x1005384
movzx eax, word [ebp - 0x38]
jmp 0x1005387
push 0xa
pop eax
push eax
push esi
push 0
push 0x1000000
call main
mov dword [0x1007128], eax
cmp dword [0x100711c], 0
jne 0x10053fe
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp al, 0x22
jne 0x10053b9
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
je 0x10053cc
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x1005355
cmp dword [0x100712c], 0
jne 0x100540d
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1007128]
jmp 0x100542e
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.01005705
ret
call fcn.01005ac6
jmp 0x1005255
Function at 0x40d630
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x4131a0
call fcn.0040ce90
push 1
call fcn.0040cca8
pop ecx
test al, al
je 0x40d618
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.0040cc76
mov byte [ebp - 0x24], al
mov eax, dword [0x416358]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x40d618
test eax, eax
jne 0x40d53c
mov dword [0x416358], ecx
push 0x40f3a4
push 0x40f394
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x40d51f
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x40d608
push 0x40f390
push 0x40f36c
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x416358], 2
jmp 0x40d541
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.0040cdfc
pop ecx
call fcn.0040dd9a
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x40d572
push esi
call fcn.0040cd68
pop ecx
test al, al
je 0x40d572
mov esi, dword [esi]
push edi
push 2
push edi
mov ecx, esi
call dword [0x40f368]
call esi
call fcn.0040dda0
mov esi, eax
cmp dword [esi], edi
je 0x40d590
push esi
call fcn.0040cd68
pop ecx
test al, al
je 0x40d590
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
call fcn.0040da55
movzx esi, ax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_wide_winmain_command_line
push esi
push eax
push edi
push 0x400000
call main
mov esi, eax
call fcn.0040da93
test al, al
je 0x40d61f
test bl, bl
jne 0x40d5be
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push edi
push 1
call fcn.0040ce19
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x40d608
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
push 7
call fcn.0040d93b
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
push dword [ebp - 0x20]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__exit
int3
call fcn.004a7000
jmp 0x40d4b2
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x409a20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 0xc]
lea eax, [esp]
push eax
push edx
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
mov eax, dword [ecx]
push 0
push edx
push eax
mov dword [esp + 0x18], 4
call dword [0x422008]
test eax, eax
jne 0x409a58
cmp dword [esp + 0xc], 4
sete al
dec eax
and eax, 0xd
pop ecx
ret 8