joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4188b0
Capabilities:
Connect to http server
Create http request
Read data from internet
Receive data
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2020
call fcn.00433ef0
mov eax, dword [0x447034]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0xfff
lea edx, [ebp - 0x200b]
push 0
push edx
mov dword [ebp - 0x201c], eax
mov dword [ebp - 0x2018], ecx
mov ebx, 0x80004005
mov dword [ebp - 0x2014], 0x7d0
mov dword [ebp - 0x2010], 0x1000
mov byte [ebp - 0x200c], 0
call fcn.0042a8d0
add esp, 0xc
push 0xfff
lea eax, [ebp - 0x100b]
push 0
push eax
mov byte [ebp - 0x100c], 0
call fcn.0042a8d0
add esp, 0xc
push 0
push 0
push 0
push 0
push str.KxeCollect_Agent
call dword [sym.imp.WININET.dll_InternetOpenW]
mov esi, eax
test esi, esi
mov dword [ebp - 0x2020], esi
jne 0x418976
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x418ac3
and eax, 0xffff
or eax, 0x80070000
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004282a0
mov esp, ebp
pop ebp
ret 4
mov edi, dword [sym.imp.WININET.dll_InternetSetOptionW]
push 4
lea ecx, [ebp - 0x2014]
push ecx
push 2
push esi
call edi
push 1
push 0
push 3
push 0
push 0
push 0x50
push str.dumpc_q.cloud.vipguanjia.net
push esi
call dword [sym.imp.WININET.dll_InternetConnectW]
mov esi, eax
test esi, esi
jne 0x4189ca
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x4189b9
mov ebx, eax
jmp 0x418aa9
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
jmp 0x418aa9
push 4
lea edx, [ebp - 0x2014]
push edx
push 2
push esi
call edi
push 4
lea eax, [ebp - 0x2014]
push eax
push 5
push esi
call edi
mov ecx, dword [ebp - 0x201c]
push 1
push 0x20000000
push 0
push 0
push str.HTTP_1.0
add ecx, 0x2c
push ecx
push 0
push esi
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov edi, eax
test edi, edi
jne 0x418a21
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x418ad6
mov ebx, eax
jmp 0x418a9e
push 0
push 0
push 0
push 0
push edi
call dword [sym.imp.WININET.dll_HttpSendRequestW]
test eax, eax
je 0x418a0f
mov eax, dword [ebp - 0x2010]
lea edx, [ebp - 0x2010]
push edx
push eax
lea ecx, [ebp - 0x200c]
push ecx
push edi
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x418a0f
lea edx, [ebp - 0x2010]
push edx
lea ecx, [ebp - 0x100c]
mov eax, 0x1000
push ecx
lea ecx, [ebp - 0x200c]
mov dword [ebp - 0x2010], eax
call fcn.00417bd0
add esp, 8
test eax, eax
je 0x418a9e
mov edx, dword [ebp - 0x2010]
mov eax, dword [ebp - 0x2018]
push edx
push eax
lea ecx, [ebp - 0x100c]
call fcn.00418c80
test eax, eax
je 0x418a9e
xor ebx, ebx
test edi, edi
je 0x418aa9
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
test esi, esi
je 0x418ab4
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, dword [ebp - 0x2020]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, ebx
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004282a0
mov esp, ebp
pop ebp
ret 4
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
jmp 0x418a9e
Function at 0x41e2d0
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x447034]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 0x206
lea eax, [ebp - 0x20a]
push 0
push eax
mov word [ebp - 0x20c], 0
call fcn.0042a8d0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx edi, ax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx ecx, di
push ecx
push 0x4413d0
mov ecx, 0x104
lea edi, [ebp - 0x20c]
movzx ebx, ax
call fcn.0040bee0
mov edx, dword [esi]
add esp, 8
push edx
mov eax, edi
push eax
push str.SystemDefaultUILanguage
push str.SystemInfo
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
movzx ecx, bx
push ecx
push 0x4413d0
mov ecx, 0x104
call fcn.0040bee0
mov edx, dword [esi]
add esp, 8
push edx
mov eax, edi
push eax
push str.UserDefaultUILanguage
push str.SystemInfo
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.004282a0
mov esp, ebp
pop ebp
ret

Function at 0x41e390
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
mov eax, dword [0x447034]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 0x3c
lea eax, [ebp - 0x24c]
push 0
push eax
call fcn.0042a8d0
push 0x206
lea ecx, [ebp - 0x20e]
push 0
push ecx
mov dword [ebp - 0x250], 0x40
mov word [ebp - 0x210], 0
call fcn.0042a8d0
add esp, 0x18
lea edx, [ebp - 0x250]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov eax, dword [ebp - 0x248]
mov ecx, dword [ebp - 0x244]
mov edx, dword [ebp - 0x240]
shrd eax, ecx, 0x14
push eax
mov eax, dword [ebp - 0x23c]
shrd edx, eax, 0x14
push edx
shr ecx, 0x14
push str._d_MB____d_MB__free_total_
mov ecx, 0x104
lea edi, [ebp - 0x210]
shr eax, 0x14
call fcn.0040bee0
mov ecx, dword [esi]
mov ebx, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
add esp, 0xc
push ecx
mov edx, edi
push edx
push str.global_physical_memory
push str.SystemInfo
call ebx
mov eax, dword [ebp - 0x238]
mov ecx, dword [ebp - 0x234]
mov edx, dword [ebp - 0x230]
shrd eax, ecx, 0x14
push eax
mov eax, dword [ebp - 0x22c]
shrd edx, eax, 0x14
push edx
shr ecx, 0x14
push str._d_MB____d_MB__free_total_
mov ecx, 0x104
shr eax, 0x14
call fcn.0040bee0
mov ecx, dword [esi]
add esp, 0xc
push ecx
mov edx, edi
push edx
push str.global_pageFile_memory
push str.SystemInfo
call ebx
mov eax, dword [ebp - 0x228]
mov ecx, dword [ebp - 0x224]
mov edx, dword [ebp - 0x220]
shrd eax, ecx, 0x14
push eax
mov eax, dword [ebp - 0x21c]
shrd edx, eax, 0x14
push edx
shr ecx, 0x14
push str._d_MB____d_MB__free_total_
mov ecx, 0x104
shr eax, 0x14
call fcn.0040bee0
mov ecx, dword [esi]
add esp, 0xc
push ecx
mov edx, edi
push edx
push str.global_virtual_memory
push str.SystemInfo
call ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.004282a0
mov esp, ebp
pop ebp
ret
Function at 0x41e640
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1420
call fcn.00433ef0
mov eax, dword [0x447034]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x41c]
push ecx
push 0x1000
lea edx, [ebp - 0x1420]
push edx
mov dword [ebp - 0x420], eax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x41e7a0
push ebx
push edi
mov edi, dword [ebp - 0x41c]
shr edi, 2
mov dword [ebp - 0x418], edi
mov ebx, 0
je 0x41e79e
push esi
lea ecx, [ecx]
mov esi, dword [ebp + ebx*4 - 0x1420]
test esi, esi
je 0x41e792
mov edx, dword [0x4415bc]
mov eax, dword [str._unknown_]
mov ecx, dword [0x4415b8]
push 0x1f4
mov dword [ebp - 0x204], edx
mov dword [ebp - 0x20c], eax
mov eax, dword [0x4415c0]
mov dword [ebp - 0x208], ecx
mov ecx, dword [0x4415c4]
lea edx, [ebp - 0x1f8]
push 0
push edx
mov dword [ebp - 0x200], eax
mov dword [ebp - 0x1fc], ecx
call fcn.0042a8d0
add esp, 0xc
push esi
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x41e792
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
push esi
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x41e78b
push 0x206
lea ecx, [ebp - 0x412]
push 0
push ecx
mov word [ebp - 0x414], 0
call fcn.0042a8d0
mov edx, dword [ebp + ebx*4 - 0x1420]
push edx
push str.running_process__d
mov ecx, 0x104
lea edi, [ebp - 0x414]
call fcn.0040bee0
mov eax, dword [ebp - 0x420]
mov ecx, dword [eax]
add esp, 0x14
push ecx
lea edx, [ebp - 0x20c]
push edx
mov eax, edi
push eax
push str.SystemInfo
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov edi, dword [ebp - 0x418]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add ebx, 1
cmp ebx, edi
jb 0x41e6a0
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004282a0
mov esp, ebp
pop ebp
ret 4
Function at 0x420ca0
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x447034]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
push 0x206
lea eax, [ebp - 0x20a]
push edi
push eax
mov esi, ecx
mov word [ebp - 0x20c], di
call fcn.0042a8d0
push 0x206
lea ecx, [ebp - 0x412]
push edi
push ecx
mov word [ebp - 0x414], di
call fcn.0042a8d0
push esi
lea edx, [ebp - 0x414]
push 0x104
push edx
call fcn.0042881e
lea eax, [ebp - 0x414]
push 0x5c
push eax
call fcn.0042a24a
mov ebx, eax
add esp, 0x2c
cmp ebx, edi
je 0x420eb5
mov eax, esi
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x420d20
sub eax, edx
sar eax, 1
jne 0x420d44
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004282a0
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x414]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea edx, [ebp - 0x414]
mov esi, ebx
sub esi, edx
sar esi, 1
push esi
mov eax, edx
push eax
lea ecx, [ebp - 0x20c]
push ecx
call fcn.0042a950
lea eax, [ebp - 0x20c]
add esp, 0xc
mov word [ebp + esi*2 - 0x20c], di
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x420d81
sub eax, edx
sar eax, 1
je 0x420eb5
jmp 0x420da0
lea edx, [ebp - 0x418]
push edx
lea ecx, [ebp - 0x20c]
call fcn.00402100
mov edx, dword [ebp - 0x418]
cmp dword [edx - 0xc], edi
jne 0x420dc1
xor esi, esi
jmp 0x420e26
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
mov edx, dword [ebp - 0x418]
je 0x420dd6
xor esi, esi
jmp 0x420e26
mov eax, dword [edx - 0xc]
cmp eax, edi
je 0x420e21
jle 0x420e1d
movzx ecx, word [edx]
cmp cx, di
mov eax, edx
je 0x420e02
movzx ecx, cx
lea esp, [esp]
cmp cx, 0x5c
je 0x420e10
movzx ecx, word [eax + 2]
add eax, 2
cmp cx, di
jne 0x420df0
xor ecx, ecx
cmp word [eax], 0x5c
setne cl
sub ecx, 1
and eax, ecx
cmp eax, edi
je 0x420e1d
sub eax, edx
sar eax, 1
cmp eax, 0xffffffff
jne 0x420e21
xor esi, esi
jmp 0x420e26
mov esi, 1
lea eax, [edx - 0x10]
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x420e42
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp esi, edi
je 0x420e5c
push edi
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x420d31
push 0x5c
add ebx, 2
push ebx
call fcn.0042a24a
mov ebx, eax
add esp, 8
cmp ebx, edi
je 0x420eb5
lea edx, [ebp - 0x414]
mov esi, ebx
sub esi, edx
push esi
mov eax, edx
push eax
lea ecx, [ebp - 0x20c]
push ecx
call fcn.0042a950
add esp, 0xc
sar esi, 1
lea eax, [ebp - 0x20c]
mov word [ebp + esi*2 - 0x20c], di
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x420ea0
sub eax, edx
sar eax, 1
jne 0x420da0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.004282a0
mov esp, ebp
pop ebp
ret
Function at 0x420f00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43b954
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x447034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [esi + 0x2c], 7
mov dword [esi + 0x28], ebx
mov word [esi + 0x18], bx
mov dword [ebp - 4], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov byte [ebp - 4], 1
call fcn.00427750
mov dword [esi + 0x5c], eax
mov byte [eax + 0x15], 1
mov eax, dword [esi + 0x5c]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x5c]
mov dword [eax], eax
mov eax, dword [esi + 0x5c]
mov dword [eax + 8], eax
mov dword [esi + 0x60], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], ebx
mov byte [ebp - 4], 4
call fcn.004249b0
mov dword [esi + 0x88], eax
mov byte [eax + 0x21], 1
mov eax, dword [esi + 0x88]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x88]
mov dword [eax], eax
mov eax, dword [esi + 0x88]
mov dword [eax + 8], eax
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x94], ebx
mov dword [esi + 0x98], ebx
mov dword [esi + 0x9c], ebx
mov dword [esi], 0xffffffff
mov word [esi + 4], bx
mov byte [esi + 7], bl
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4212c0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, eax
xor al, al
cmp dword [edi + 0xa0], 0
push esi
jne 0x421476
test ebx, ebx
je 0x421476
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4212e6
sub eax, edx
sar eax, 1
push eax
push ebx
lea esi, [edi + 0xbc]
call fcn.00407ac0
push 0
push 0
push 3
push 0
push 0
push 0x120089
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [edi + 0xd8], eax
je 0x421474
push 0
push 0
push 0
push 2
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test eax, eax
mov dword [edi + 0xdc], eax
je 0x421474
push 0
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [edi + 0xe0], eax
je 0x421474
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 4]
push edx
lea ecx, [ebp - 0xc]
push ecx
push 0xf
push eax
xor esi, esi
xor bl, bl
call sub.dbghelp.dll_MiniDumpReadDumpStream
test eax, eax
je 0x421398
mov eax, dword [ebp - 4]
test byte [eax + 4], 1
je 0x421396
mov esi, dword [eax + 8]
mov bl, 1
test esi, esi
movzx edx, bl
mov dword [edi + 0xa4], edx
je 0x4213a9
mov dword [edi], esi
jmp 0x4213b8
mov eax, dword [0x44978c]
add eax, 1
mov dword [0x44978c], eax
mov dword [edi], eax
mov eax, edi
call fcn.004217b0
movzx eax, al
mov ecx, edi
mov dword [edi + 0xa8], eax
call fcn.00421850
movzx ecx, al
push edi
mov dword [edi + 0xb0], ecx
call fcn.00421c10
movzx edx, al
push edi
mov dword [edi + 0xb8], edx
call fcn.00421b00
movzx eax, al
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [edi + 0xe0]
lea edx, [ebp - 4]
push edx
mov dword [edi + 0xb4], eax
lea eax, [ebp - 0xc]
push eax
xor esi, esi
push 6
push ecx
xor bl, bl
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
call sub.dbghelp.dll_MiniDumpReadDumpStream
test eax, eax
je 0x421459
mov eax, dword [ebp - 4]
cmp eax, esi
je 0x421459
cmp dword [ebp - 8], 0xa8
jb 0x421459
mov edx, dword [eax]
mov dword [edi + 0x40], edx
mov ecx, dword [eax + 8]
mov dword [edi + 0x30], ecx
mov edx, dword [eax + 0x18]
mov dword [edi + 0x38], edx
mov ecx, dword [eax + 0x1c]
mov dword [edi + 0x3c], ecx
mov edx, dword [eax + 0xa4]
add edx, dword [edi + 0xe0]
mov bl, 1
mov dword [edi + 0x44], edx
movzx eax, bl
mov dword [edi + 0xac], eax
mov dword [edi + 0xa0], 1
mov al, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4257c0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor esi, esi
push esi
push esi
push 3
push esi
push 1
push connect
push eax
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x425864
push edi
lea ecx, [ebp - 8]
push ecx
push ebx
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp dword [ebp - 8], esi
mov edi, eax
jne 0x425851
cmp edi, 0x200000
ja 0x425851
lea edx, [edi + 2]
push edx
call fcn.00429035
add esp, 4
push 0
mov esi, eax
lea eax, [ebp - 4]
push eax
push edi
push esi
push ebx
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x425851
mov eax, dword [ebp - 4]
cmp eax, edi
jne 0x425851
mov edx, dword [ebp + 8]
mov byte [eax + esi], 0
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov byte [ecx + esi + 1], 0
mov dword [edx], esi
mov dword [eax], edi
mov dword [ebp - 0xc], 1
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x42ea9c
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x447900]
je 0x42eab7
inc edi
cmp edi, 0x17
jb 0x42eaa8
cmp edi, 0x17
jae 0x42ec37
push ebp
push 3
call fcn.004338c9
cmp eax, 1
pop ecx
je 0x42ec03
push 3
call fcn.004338c9
test eax, eax
pop ecx
jne 0x42eaeb
cmp dword [0x447030], 1
je 0x42ec03
cmp ebx, 0xfc
je 0x42ec36
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x448e40
push ebp
call fcn.00429c13
add esp, 0xc
test eax, eax
je 0x42eb21
push esi
push esi
push esi
push esi
push esi
call fcn.0042856a
add esp, 0x14
push 0x104
mov esi, 0x448e59
push esi
push 0
mov byte [0x448f5d], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x42eb65
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.00429c13
add esp, 0xc
test eax, eax
je 0x42eb65
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0042856a
add esp, 0x14
push esi
call fcn.0042a840
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x42ebaa
push esi
call fcn.0042a840
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x449154
push 0x43db9c
sub ecx, eax
push ecx
push eax
call fcn.004332f6
add esp, 0x14
test eax, eax
je 0x42ebaa
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.0042856a
add esp, 0x14
jmp 0x42ebac
xor esi, esi
push 0x43db98
push ebx
push ebp
call fcn.00433231
add esp, 0xc
test eax, eax
je 0x42ebcc
push esi
push esi
push esi
push esi
push esi
call fcn.0042856a
add esp, 0x14
push dword [edi*8 + 0x447904]
push ebx
push ebp
call fcn.00433231
add esp, 0xc
test eax, eax
je 0x42ebee
push esi
push esi
push esi
push esi
push esi
call fcn.0042856a
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0043370c
add esp, 0xc
jmp 0x42ec36
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x42ec36
cmp ebp, 0xffffffff
je 0x42ec36
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x447904]
push dword [esi]
call fcn.0042a840
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x43370c
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0042b1fd
xor ebx, ebx
cmp dword [0x449430], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x4337e2
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x4338c2
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x4338c2
push eax
call fcn.0042b18f
mov dword [esp], 0x43ed2c
push edi
mov dword [0x449430], eax
call esi
push eax
call fcn.0042b18f
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x449434], eax
call esi
push eax
call fcn.0042b18f
mov dword [0x449438], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0042fa84
test eax, eax
pop ecx
pop ecx
je 0x4337b0
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0042856a
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x4337e2
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0042b18f
cmp eax, ebx
pop ecx
mov dword [0x449440], eax
je 0x4337e2
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0042b18f
pop ecx
mov dword [0x44943c], eax
mov eax, dword [0x44943c]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x433867
cmp dword [0x449440], ecx
je 0x433867
push eax
call fcn.0042b206
push dword [0x449440]
mov esi, eax
call fcn.0042b206
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x433867
cmp edi, ebx
je 0x433867
call esi
cmp eax, ebx
je 0x433834
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x433834
test byte [ebp - 0x18], 1
jne 0x433867
lea eax, [ebp - 0x10]
push eax
call fcn.0042fabb
test eax, eax
pop ecx
je 0x43384f
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0042856a
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x43385e
or dword [ebp + 0x10], 0x200000
jmp 0x4338a2
or dword [ebp + 0x10], 0x40000
jmp 0x4338a2
mov eax, dword [0x449434]
cmp eax, dword [ebp - 8]
je 0x4338a2
push eax
call fcn.0042b206
cmp eax, ebx
pop ecx
je 0x4338a2
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4338a2
mov eax, dword [0x449438]
cmp eax, dword [ebp - 8]
je 0x4338a2
push eax
call fcn.0042b206
cmp eax, ebx
pop ecx
je 0x4338a2
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x449430]
call fcn.0042b206
cmp eax, ebx
pop ecx
je 0x4338c2
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4338c4
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x435ab2
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x447034]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.004359f1
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.0042a8d0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x435b01
cmp dword [ebp - 0x1c], 5
jb 0x435b19
jmp 0x435b15
cmp dword [ebp - 0x10], 1
jne 0x435b19
cmp dword [ebp - 0x1c], 4
ja 0x435b15
jne 0x435b19
cmp dword [ebp - 0x18], 0
jbe 0x435b19
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x43ee38
call fcn.004119d0
test eax, eax
jge 0x435b3a
mov byte [0x449760], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004282a0
add ebp, 0x78
leave
ret

Function at 0x435cec
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x4495a0], 0
push esi
jne 0x435c5f
call fcn.00435b8a
test eax, eax
je 0x435ca2
mov eax, dword [0x4495a0]
cmp eax, 1
jne 0x435c80
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x435ca2
pop esi
ret
push eax
call dword [0x4495a8]
test eax, eax
jne 0x435cea
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x435ca6
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x4495a0]
call dword [0x4495a8]
mov edi, eax
test edi, edi
je 0x435ccd
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x435ce9
lea edi, [esi + 0xff0]
push esi
push dword [0x4495a0]
call dword [0x4495a4]
add esi, 0x10
cmp esi, edi
jb 0x435cd3
mov eax, esi
pop edi
pop esi
ret
jmp 0x435c4c