joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001292c
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x68]
sub esp, 0x334
mov eax, dword [0x1001e248]
push ebx
push esi
mov esi, dword [ebp + 0x78]
xor eax, ebp
push edi
mov dword [ebp + 0x64], eax
mov dword [ebp - 0x2cc], esi
call fcn.10010e1e
test eax, eax
je 0x10012b3d
lea eax, [ebp - 0x2c8]
push eax
push str.MeadCo.Zeepe.FrameApp
call dword [sym.imp.ole32.dll_CLSIDFromProgID]
test eax, eax
jl 0x10012b3d
push str.licmgr.htm
mov esi, 0x104
push esi
lea eax, [ebp - 0x2a8]
push eax
call fcn.10001a09
mov edi, eax
xor ebx, ebx
cmp edi, ebx
jl 0x10012a0f
push dword [ebp - 0x2cc]
lea eax, [ebp - 0x2a8]
push esi
push eax
call fcn.100020fb
mov edi, eax
cmp edi, ebx
jl 0x10012a0f
lea eax, [ebp - 0x2b8]
push eax
push str.MeadCo.Zeepe.SecMgr
call dword [sym.imp.ole32.dll_CLSIDFromProgID]
test eax, eax
jge 0x100129d6
mov esi, 0x1001a35c
lea edi, [ebp - 0x2b8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, 0x104
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0x2a8]
push eax
lea eax, [ebp - 0x2b8]
push eax
call fcn.1000b4e9
mov edi, eax
cmp edi, ebx
jl 0x10012a0f
lea eax, [ebp - 0x2a8]
push eax
lea eax, [ebp - 0x2c8]
push eax
call fcn.1000b355
mov edi, eax
cmp edi, ebx
jge 0x10012a35
push edi
call fcn.100023b5
push ebx
mov esi, eax
mov eax, 0x1001be90
push eax
push ebx
push ebx
push esi
push eax
call fcn.10002591
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
jmp 0x10012b43
mov edi, 0x1001a7e0
push edi
push esi
lea eax, [ebp - 0x1a4]
push eax
call fcn.10001a09
cmp eax, ebx
mov dword [ebp - 0x2cc], eax
jl 0x10012aaa
lea eax, [ebp - 0x2a8]
push eax
push esi
lea eax, [ebp - 0x1a4]
push eax
call fcn.100020fb
cmp eax, ebx
mov dword [ebp - 0x2cc], eax
jl 0x10012aaa
push str.___AppMode__
push esi
lea eax, [ebp - 0x1a4]
push eax
call fcn.100020fb
cmp eax, ebx
mov dword [ebp - 0x2cc], eax
jl 0x10012aaa
lea eax, [ebp - 0xa0]
push eax
push esi
lea eax, [ebp - 0x1a4]
push eax
call fcn.100020fb
cmp eax, ebx
mov dword [ebp - 0x2cc], eax
jge 0x10012ad1
push eax
call fcn.100023b5
push ebx
mov esi, eax
mov eax, 0x1001be90
push eax
push ebx
push ebx
push esi
push eax
call fcn.10002591
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x2cc]
jmp 0x10012b43
push edi
push esi
lea eax, [ebp - 0x1a4]
push eax
call fcn.100020fb
mov esi, eax
cmp esi, ebx
jge 0x10012b08
push esi
call fcn.100023b5
push ebx
mov edi, eax
mov eax, 0x1001be90
push eax
push ebx
push ebx
push edi
push eax
call fcn.10002591
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
jmp 0x10012b43
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x1a4]
push eax
lea ecx, [ebp - 0x20]
call fcn.10001958
push 5
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_WinExec]
lea eax, [ebp - 0x1c]
cmp dword [ebp - 0x20], eax
je 0x10012b39
push dword [ebp - 0x20]
call fcn.10017e6d
pop ecx
xor eax, eax
jmp 0x10012b43
push esi
call fcn.100124bd
mov ecx, dword [ebp + 0x64]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10018081
add ebp, 0x68
leave
ret 0x10
Function at 0x100157d4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
lea ebp, [esp - 0x39c]
sub esp, 0x41c
mov eax, dword [0x1001e248]
push ebx
mov ebx, dword [ebp + 0x3a8]
xor eax, ebp
push esi
mov esi, dword [ebp + 0x3a4]
mov dword [ebp + 0x398], eax
mov eax, dword [ebp + 0x3ac]
push edi
mov edi, ecx
mov dword [ebp - 0x74], eax
call dword [0x1001e040]
mov dword [ebp - 0x78], eax
xor eax, eax
cmp esi, eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x6c], eax
je 0x1001586b
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [eax + eax + 2]
cmp edi, 0x400
jg 0x10015853
push edi
call fcn.100011b6
test al, al
pop ecx
je 0x10015853
mov eax, edi
add eax, 3
and eax, 0xfffffffc
call fcn.10018600
mov eax, esp
jmp 0x1001585c
push edi
lea ecx, [ebp - 0x70]
call fcn.1000212c
push dword [ebp - 0x78]
push edi
push esi
push eax
call fcn.10001313
test eax, eax
jne 0x10015885
lea eax, [ebp - 0x68]
cmp dword [ebp - 0x6c], eax
je 0x1001587b
lea ecx, [ebp - 0x6c]
call fcn.10014571
mov esi, 0x8007000e
jmp 0x10015938
push 2
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov edi, eax
test edi, edi
jne 0x100158a2
call fcn.1000928b
mov esi, eax
jmp 0x10015928
push dword [ebp - 0x74]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x100158c1
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
jne 0x100158c8
call fcn.1000928b
jmp 0x1001591f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
cmp eax, 0x400
jbe 0x100158e7
push eax
lea ecx, [ebp - 0x6c]
call fcn.1001457a
jmp 0x100158ed
lea eax, [ebp - 0x68]
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
jne 0x100158fa
mov esi, 0x8007000e
jmp 0x10015921
push esi
push ebx
push dword [ebp - 0x6c]
call fcn.10018760
mov eax, dword [ebp - 0x6c]
add esp, 0xc
push dword [ebp + 0x3b0]
mov byte [esi + eax], 0
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x80]
call fcn.10015962
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x68]
cmp dword [ebp - 0x6c], eax
je 0x10015938
lea ecx, [ebp - 0x6c]
call fcn.10014571
lea ecx, [ebp - 0x70]
call fcn.10001aef
mov eax, esi
lea esp, [ebp - 0x8c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x398]
xor ecx, ebp
call fcn.10018081
add ebp, 0x39c
leave
ret 0x10
Function at 0x10016774
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov ebx, ecx
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x1001677f
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
ret 8

Function at 0x10018165
Capabilities:
Terminate process

Disassembly:
push 0x11c
push 0x1001c190
call fcn.100184a8
mov eax, dword [0x1001e248]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [0x1001e464]
test eax, eax
je 0x100181a8
and dword [ebp - 4], 0
push ecx
push dword [ebp + 8]
call eax
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
jmp 0x100182b2
mov eax, dword [ebp + 8]
dec eax
je 0x100181c4
mov ebx, str.Unknown_security_failure_detected_
mov dword [ebp - 0x12c], str.A_security_error_of_unknown_cause_has_been_detected_which_has_ncorrupted_the_programs_internal_state.__The_program_cannot_safely_ncontinue_execution_and_must_now_be_terminated._n
mov edi, 0xd4
jmp 0x100181d8
mov ebx, str.Buffer_overrun_detected_
mov dword [ebp - 0x12c], str.A_buffer_overrun_has_been_detected_which_has_corrupted_the_programs_ninternal_state.__The_program_cannot_safely_continue_execution_and_must_nnow_be_terminated._n
mov edi, 0xb9
mov byte [ebp - 0x20], 0
push 0x104
lea eax, [ebp - 0x124]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10018207
push str._program_name_unknown_
lea eax, [ebp - 0x124]
push eax
call fcn.10018de0
pop ecx
pop ecx
lea eax, [ebp - 0x124]
mov dword [ebp - 0x128], eax
push eax
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
call esi
add eax, 0xb
cmp eax, 0x3c
jbe 0x1001824e
lea eax, [ebp - 0x124]
push eax
call esi
lea ecx, [ebp - 0x124]
sub ecx, 0x31
add eax, ecx
mov dword [ebp - 0x128], eax
push 3
push 0x1001bfdc
push eax
call fcn.10018760
add esp, 0xc
push dword [ebp - 0x128]
call esi
lea eax, [eax + edi + 0xc]
add eax, 3
and eax, 0xfffffffc
call fcn.10018600
mov dword [ebp - 0x18], esp
mov edi, esp
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ebx, 0x1001bfd8
push ebx
push edi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
call esi
push str.Program:
push edi
call esi
push dword [ebp - 0x128]
push edi
call esi
push ebx
push edi
call esi
push dword [ebp - 0x12c]
push edi
call esi
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 3
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x100183c5
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.10018600
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x10018460
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x1001e43c]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x10018460
cmp eax, 1
je 0x10018481
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x10018460
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x1001842d
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x1001845c
xor eax, eax
inc eax
jmp 0x100184a0
cmp edi, eax
jae 0x10018464
xor eax, eax
jmp 0x100184a0
cmp eax, esi
jae 0x1001846b
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x1001e43c]
jmp 0x10018484
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x105de
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
movzx esi, byte [eax]
xor ecx, ecx
test esi, esi
jle 0x10602
mov dl, byte [ecx + eax + 1]
xor dl, 0x2b
add dl, 0x56
mov byte [ecx + eax], dl
inc ecx
cmp ecx, esi
jl 0x105f0
mov byte [esi + eax], 0
pop esi
pop ebp
ret 4

Function at 0x10610
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x140
mov eax, dword [0x12210]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [0x11ee0]
push edi
mov dword [ebp - 0x138], eax
lea eax, [ebp - 0x134]
push eax
xor edi, edi
push edi
push edi
push 0xb
call esi
push dword [ebp - 0x134]
push edi
call dword [0x11f38]
mov ebx, eax
lea eax, [ebp - 0x134]
push eax
push dword [ebp - 0x134]
push ebx
push 0xb
call esi
movzx eax, word [ebx + 0x1e]
lea esi, [eax + ebx + 0x20]
lea eax, [ebp - 0x30]
push eax
mov byte [ebp - 0x30], 0x29
mov byte [ebp - 0x2f], 0x2d
mov byte [ebp - 0x2e], 0xc5
mov byte [ebp - 0x2d], 0x24
mov byte [ebp - 0x2c], 0xb
mov byte [ebp - 0x2b], 0x38
mov byte [ebp - 0x2a], 0x26
mov byte [ebp - 0x29], 0x24
mov byte [ebp - 0x28], 0x2d
mov byte [ebp - 0x27], 0xd9
mov byte [ebp - 0x26], 0x20
mov byte [ebp - 0x25], 0x37
mov byte [ebp - 0x24], 0x25
mov byte [ebp - 0x23], 0x25
mov byte [ebp - 0x22], 0x38
mov byte [ebp - 0x21], 0x36
mov byte [ebp - 0x20], 0x3e
mov byte [ebp - 0x1f], 0x2b
mov byte [ebp - 0x1e], 0x32
mov byte [ebp - 0x1d], 0x3d
mov byte [ebp - 0x1c], 0x34
mov byte [ebp - 0x1b], 0x3c
mov byte [ebp - 0x1a], 0x24
mov byte [ebp - 0x19], 0xf0
mov byte [ebp - 0x18], 0x2d
mov byte [ebp - 0x17], 0x2a
mov byte [ebp - 0x16], 0x38
mov byte [ebp - 0x15], 0x33
mov byte [ebp - 0x14], 0x25
mov byte [ebp - 0x13], 0x32
mov byte [ebp - 0x12], 0xa
mov byte [ebp - 0x11], 0x36
mov byte [ebp - 0x10], 0x2d
mov byte [ebp - 0xf], 0xd6
mov byte [ebp - 0xe], 8
mov byte [ebp - 0xd], 0x36
mov byte [ebp - 0xc], 0x35
mov byte [ebp - 0xb], 0x24
mov byte [ebp - 0xa], 0x3c
mov byte [ebp - 9], 0xf6
mov byte [ebp - 8], 0xf7
mov byte [ebp - 7], 0x2d
call fcn.000105de
mov al, byte [ebp + edi - 0x30]
mov byte [ebp + edi - 0x130], al
inc edi
test al, al
jne 0x10720
mov eax, esi
mov edx, esi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10734
lea edi, [ebp - 0x130]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10744
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x140]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [0x11e94]
push 1
lea eax, [ebp - 0x140]
push eax
push dword [ebp - 0x138]
call dword [0x11e90]
push 0
push ebx
call dword [0x11e8c]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00011a3a
leave
ret 4
Function at 0x10a20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov dword [ebp - 0x44], eax
xor eax, eax
xor esi, esi
mov dword [ebp - 0x4c], 0x18
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x40], 0x40
lea edi, [ebp - 0x3c]
stosd dword es:[edi], eax
push 0x20
stosd dword es:[edi], eax
push 1
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0x100020
lea eax, [ebp - 4]
push eax
mov dword [ebp - 8], esi
mov dword [ebp - 0x14], esi
call dword [0x11ec4]
push dword [ebp - 4]
lea eax, [ebp - 0x4c]
push 0x1000000
push 0x10
push esi
push eax
push 0xf001f
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x44], esi
call dword [0x11ec0]
push 4
push 0x100000
push 1
lea eax, [ebp - 0x14]
push eax
push esi
push 0x3e8
push esi
lea eax, [ebp - 8]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x10]
call dword [0x11ebc]
push dword [ebp - 4]
call dword [0x11ea4]
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x3c]
mov esi, dword [ecx + eax + 0x78]
push dword [ebp + 8]
add esi, eax
mov edi, dword [esi + 0x1c]
mov ebx, dword [esi + 0x20]
mov ecx, dword [esi + 0x24]
add ecx, eax
mov dword [ebp - 0xc], eax
add edi, eax
add ebx, eax
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x18], ecx
call dword [0x11eb8]
and dword [ebp + 0xc], 0
cmp dword [esi + 0x14], 0
jbe 0x10b41
mov eax, dword [ebp + 0xc]
mov eax, dword [ebx + eax*4]
add eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [0x11eb8]
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x18]
movzx eax, word [eax + ecx*2]
add eax, dword [ebp - 0x1c]
push 1
mov eax, dword [edi + eax*4 - 4]
add eax, dword [ebp - 0xc]
mov dword [ebp + 8], eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [0x11eb4]
test eax, eax
je 0x10b45
inc dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
cmp eax, dword [esi + 0x14]
jb 0x10af7
xor esi, esi
jmp 0x10b48
mov esi, dword [ebp + 8]
push dword [ebp - 0x10]
call dword [0x11ea4]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x14954
Capabilities:
Authenticate hmac

Disassembly:
push 0x16463
call fcn.0001814d
Function at 0x14b10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov esi, dword [sym.imp.ntoskrnl.exe_IoAllocateMdl_1]
mov eax, dword [edx + 8]
mov edi, dword [edx + 0xc]
add edi, eax
cmp esi, eax
jb 0x144fd
cmp esi, edi
jb 0x13e9e
add ecx, 0xffffffff
je 0x13e9c
add edx, 0x11c
jmp 0x144e5
movsx ax, cl
mov byte [esp], dh
lea eax, [0x16b85]
pushfd
jmp 0x16a89
mov dword [esp + 4], 0x9e7fb674
mov dword [esp + 4], 0x14bd8
pushal
call fcn.000154fe
add byte [eax], al
dec ecx
outsd dx, dword [esi]
inc esp
insb byte es:[edi], dx
je 0x16b0e
inc esp
jbe 0x16b16
arpl word [ebp], sp
xchg edx, eax
cmp byte [0x18d10b38], al
xor byte [esi + 0xb], 0xd1
or cl, dl
sbb byte [esp + ecx*4], al
jbe 0x16b23
ror dword [eax], 1
rcr dword [eax], 1
add al, 0x8c
inc eax
add dword [eax], eax
rcl dword [ebx + 0x7b], 1
jnp 0x16b26
add byte [edx], cl
add al, 0x49
or bh, byte [esi]
add al, 0x49
mov edi, 0xd10b0805
and byte [esi], bl
outsd dx, dword [esi]
adc byte [ecx], ch
outsd dx, dword [esi]
or al, 0x76
shl dword [eax], 1
outsd dx, dword [esi]
sbb al, 0x6f
or al, 5
and byte [edi + 0x1c], ch
add eax, 0x5280530
adc al, 0x92
add byte [0x5009230], al
or al, cl
and al, 5
sbb byte [0xb23c0528], al
sub dword [ecx + 0x34926748], ebx
sub dword [edi + 0x10], ebp
add eax, 0xb81c052c
add byte [eax], al
dec ecx
outsd dx, dword [esi]
inc esp
insb byte es:[edi], dx
je 0x16bd5
push ebx
jns 0x16be0
bound ebp, qword [edi + 0x6c]
imul esp, dword [ebx + 0x4c], 0x6b6e69
push 0x642e6c61
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [ebp - 0x77], dl
in eax, 0x83
in al, dx
or byte [ebx + 0x56], dl
push edi
xor ebx, ebx
lea eax, [ebp - 8]
mov dword [eax], ebx
push eax
push ebx
lea eax, [ebp - 4]
push eax
push 0xb
lea eax, sym.imp.ntoskrnl.exe_NtQuerySystemInformation
call dword [eax]
mov eax, dword [ebp - 8]
shl eax, 1
je 0x13e9c
mov dword [ebp - 4], eax
push eax
push 0
lea eax, [sym.imp.ntoskrnl.exe_ExAllocatePool_1]
call dword [eax]
or eax, eax
je 0x13e9c
mov ebx, eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push ebx
push 0xb
lea eax, sym.imp.ntoskrnl.exe_NtQuerySystemInformation
call dword [eax]
or eax, eax
jne 0x13e9c
add bh, bh
adc byte [ecx], cl
ror byte [edi], 0x85
mov cl, 0xd2
invalid
mov ecx, dword [ebx]
or ecx, ecx
je 0x13e9c
lea edx, [ebx + 4]
mov edi, dword [ebp + 8]
lea esi, [0x13fa9]
call fcn.000146de
je 0x144df
mov edi, dword [ebp + 8]
lea esi, [0x16b7d]
call fcn.000146de
jne 0x1464f
mov esi, dword [sym.imp.HAL.dll_HalMakeBeep]
jmp 0x144e5
Function at 0x14fee
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushal
sub esp, 0xffffffe0
add ebx, esp
btc di, 8
bt sp, ax
mov edi, ebx
inc al
mov al, 0x2e
jmp 0x159d0
lea esp, [esp + 0x44]
ja 0x146d9
xor al, ah
sub al, 8
sub ebx, edi
add di, ax
dec al
jmp 0x14fd4
clc
bt bx, dx
clc
repne scasb al, byte es:[edi]
call fcn.0001564c
outsd dx, dword [esi]
and cl, al
xlatb
mov bh, 0x98
inc eax
outsd dx, dword [esi]
adc al, 0xd1
add al, 0x6f
sub cl, dl
and al, 0xd1
xor byte [edi + 0x1c], ch
outsd dx, dword [esi]
or byte [edi + 0x18], ch
sar dword [ecx + edx*8], 1
adc al, 0x6f
xor al, 0x6f
cmp cl, dl
or al, 0x92
sbb byte [eax*4 - 0x6dfffe95], al
and byte [ebx], bh
rcl dword [eax]
rol dword [eax], 1
add eax, 0xd1014500
xor cl, dl
adc byte [edx - 0x1ecffaf0], dl
and al, 5
adc al, 5
sbb byte [0x52c9228], al
cmp al, 0xe1
xor al, 5
xor byte [0xc1049208], al
sub dword [ecx + 0x6f3b6748], ebx
cmp byte [0xb8100520], al
Function at 0x402a3d
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x7a1ff0]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x402ad1
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x105
jmp 0x402a8e
cmp dword [ebp + 0x10], ebx
jne 0x402ac5
lea eax, [ebp - 0x10c]
push ebx
push eax
push dword [ebp - 4]
call fcn.00402a3d
test eax, eax
jne 0x402aa0
lea eax, [ebp - 0x10c]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402a75
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.0040601f
cmp eax, ebx
je 0x402ad8
push ebx
push dword [0x7a1ff0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402ad1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x7a1ff0], ebx
jne 0x402ace
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x402ace
jmp 0x402ad1
Function at 0x402f22
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push esi
xor esi, esi
push edi
cmp eax, esi
jl 0x402f4e
mov ecx, dword [0x7a1f98]
push esi
add eax, ecx
push esi
push eax
mov dword [0x7950e4], eax
push dword [0x40901c]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
call fcn.0040303d
cmp eax, esi
jl 0x403037
lea eax, [ebp + 8]
push 4
push eax
push dword [0x40901c]
call fcn.004059fd
test eax, eax
je 0x403023
push dword [ebp + 8]
add dword [0x7950e4], 4
call fcn.0040303d
cmp eax, esi
mov dword [ebp - 8], eax
jl 0x403037
cmp dword [ebp + 0x10], esi
jne 0x402fff
cmp dword [ebp + 8], esi
jle 0x403034
mov esi, 0x7910e0
cmp dword [ebp + 8], 0x4000
mov edi, dword [ebp + 8]
jl 0x402fb4
mov edi, 0x4000
push edi
push esi
push dword [0x40901c]
mov dword [ebp - 4], edi
call fcn.004059fd
test eax, eax
je 0x403023
lea eax, [ebp + 0x14]
push 0
push eax
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x402ffb
cmp dword [ebp + 0x14], edi
jne 0x402ffb
mov eax, dword [ebp - 4]
add dword [ebp - 8], eax
sub dword [ebp + 8], eax
add dword [0x7950e4], eax
cmp dword [ebp + 8], 0
jg 0x402fa3
jmp 0x403034
push 0xfffffffffffffffe
jmp 0x403025
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x40300a
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push esi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40901c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x403028
push 0xfffffffffffffffd
pop eax
jmp 0x403037
mov eax, dword [ebp - 4]
add dword [0x7950e4], eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
pop edi
pop esi
leave
ret 0x10
Function at 0x40303d
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [0x7950e4]
sub esi, dword [0x40a810]
push edi
add esi, dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor ebx, ebx
add eax, 0x1f4
cmp esi, ebx
mov dword [0x7a1f4c], eax
jle 0x4031a7
push dword [0x79d0f4]
call fcn.004031cf
push ebx
push ebx
push dword [0x40a810]
push dword [0x40901c]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [0x79d0f0], esi
mov dword [0x7950e0], ebx
mov ebp, 0x7890e0
mov eax, dword [0x7950e8]
mov edi, 0x4000
sub eax, dword [0x79d0f4]
cmp eax, edi
jg 0x4030b2
mov edi, eax
mov esi, 0x7910e0
push edi
push esi
call fcn.004031b9
test eax, eax
je 0x403199
add dword [0x79d0f4], edi
mov dword [0x40a818], esi
mov dword [0x40a81c], edi
cmp dword [0x7a1f50], ebx
je 0x403109
cmp dword [0x7a1fe0], ebx
jne 0x403109
mov eax, dword [0x79d0f0]
push ebx
sub eax, dword [0x7950e4]
sub eax, dword [esp + 0x1c]
add eax, dword [0x40a810]
mov dword [0x7950e0], eax
call fcn.00402bda
pop ecx
push 0x40a818
mov dword [0x40a820], ebp
mov dword [0x40a824], 0x8000
call fcn.004060ff
test eax, eax
jl 0x4031a2
mov esi, dword [0x40a820]
sub esi, ebp
je 0x403163
lea eax, [esp + 0x10]
push ebx
push eax
push esi
push ebp
push dword [0x40901c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40319e
cmp esi, dword [esp + 0x10]
jne 0x40319e
add dword [0x40a810], esi
cmp dword [0x40a81c], ebx
jne 0x4030d8
jmp 0x40316f
cmp dword [0x40a81c], ebx
jne 0x4031a2
cmp edi, ebx
je 0x4031a2
mov eax, dword [0x7950e4]
mov ecx, eax
sub ecx, dword [0x40a810]
add ecx, dword [esp + 0x18]
test ecx, ecx
jg 0x40309c
push ebx
push ebx
push eax
push dword [0x40901c]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x4031a7
or eax, 0xffffffff
jmp 0x4031b1
push 0xfffffffffffffffe
jmp 0x4031a4
push 0xfffffffffffffffd
pop eax
jmp 0x4031b1
push 1
call fcn.00402bda
pop ecx
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
Function at 0x4054a7
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [0x79fd40], 0x44
push eax
xor eax, eax
push 0x79fd40
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4054e2
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x40556c
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push esi
call fcn.00405960
mov edi, eax
cmp edi, 0xffffffff
je 0x4055ad
test byte [esp + 0x10], 1
push esi
je 0x40558f
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
jmp 0x405595
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x40559e
xor eax, eax
inc eax
jmp 0x4055af
test byte [esp + 0x10], 4
jne 0x4055ad
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
xor eax, eax
pop edi
pop esi
ret 8