joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402f00
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push esi
push edi
xor edi, edi
cmp eax, edi
jl 0x402f2c
mov ecx, dword [0x423c18]
push edi
add eax, ecx
push edi
push eax
push dword [0x409014]
mov dword [0x41ed88], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
pop esi
push esi
call fcn.00402d82
cmp eax, edi
jl 0x403025
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp + 8]
push eax
push dword [0x409014]
call ebx
test eax, eax
je 0x403021
cmp dword [ebp - 4], esi
jne 0x403021
push dword [ebp + 8]
add dword [0x41ed88], esi
call fcn.00402d82
cmp eax, edi
mov dword [ebp - 8], eax
jl 0x403024
cmp dword [ebp + 0x10], edi
jne 0x402ff0
cmp dword [ebp + 8], edi
jle 0x40301c
mov esi, 0x41ad88
mov edi, 0x4000
cmp dword [ebp + 8], edi
jge 0x402fa0
mov edi, dword [ebp + 8]
push 0
lea eax, [ebp - 4]
push eax
push edi
push esi
push dword [0x409014]
call ebx
test eax, eax
je 0x403021
cmp edi, dword [ebp - 4]
jne 0x403021
push 0
lea eax, [ebp + 0x14]
push eax
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x402fec
cmp dword [ebp + 0x14], edi
jne 0x402fec
mov eax, dword [ebp - 4]
add dword [ebp - 8], eax
sub dword [ebp + 8], eax
add dword [0x41ed88], eax
cmp dword [ebp + 8], 0
jg 0x402f93
jmp 0x40301c
push 0xfffffffffffffffe
jmp 0x403023
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x402ffb
mov eax, dword [ebp + 0x14]
push edi
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x409014]
call ebx
test eax, eax
je 0x403021
mov eax, dword [ebp - 4]
add dword [0x41ed88], eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x403024
push 0xfffffffffffffffd
pop eax
pop ebx
pop edi
pop esi
leave
ret 0x10
Function at 0x40547e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
push 0x4211d8
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
mov dword [0x4211d8], 0x44
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4054b9
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x4055f3
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x405610
and eax, 0xfffffffe
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret 4

Function at 0x405613
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
inc ecx
push 0
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x405642
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
pop ecx
xor edx, edx
div ecx
push esi
push 0
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x405686
test edi, edi
jne 0x40564d
mov byte [esi], 0
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x405680

Function at 0x40568a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x14]
lea eax, [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x18]
xor ebx, ebx
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push ebx
push dword [ebp + 0xc]
mov byte [esi], bl
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4056fb
lea eax, [ebp + 0xc]
push eax
push esi
lea eax, [ebp + 0x14]
push eax
push ebx
push dword [ebp + 0x10]
mov dword [ebp + 0xc], 0x400
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4056ea
cmp dword [ebp + 0x14], 1
je 0x4056ec
cmp dword [ebp + 0x14], 2
je 0x4056ec
mov byte [esi], bl
push dword [ebp + 0x18]
mov byte [esi + 0x3ff], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x405945
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x421220
push esi
call fcn.004057a3
push esi
call fcn.00405586
mov edi, eax
test edi, edi
jne 0x405966
xor eax, eax
jmp 0x4059be
push edi
call fcn.004057c5
test byte [0x423c28], 0x80
je 0x40597f
mov al, byte [edi]
test al, al
je 0x405962
cmp al, 0x5c
je 0x405962
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
sub edi, esi
jmp 0x40599f
push esi
call fcn.00405860
test eax, eax
je 0x405999
test byte [eax], 0x10
je 0x4059c3
push esi
call fcn.0040591e
push esi
call ebx
cmp eax, edi
jg 0x40598a
push esi
call fcn.004058f1
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop ebx
pop edi
pop esi
ret 4
xor eax, eax
jmp 0x4059bd
Function at 0x405c73
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push 1
call fcn.00405887
test eax, eax
mov esi, dword [esp + 0x18]
je 0x405c97
push 5
push esi
push dword [esp + 0x1c]
call eax
test eax, eax
jne 0x405dd0
test esi, esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [0x421620], 0x4c554e
mov edi, 0x400
mov ebp, 0x421620
je 0x405cdb
push 1
push 0
push esi
call fcn.00405613
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x405dd6
cmp eax, edi
jg 0x405dd6
push edi
mov esi, 0x421f60
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x405dd6
cmp eax, edi
jg 0x405dd6
push esi
push ebp
push str._s_s_r_n
push 0x421a20
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ebx, eax
mov eax, dword [0x423bcc]
push dword [eax + 0x128]
push esi
call fcn.00405a1d
push 4
push 0xc0000000
push esi
call fcn.00405613
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x14], ebp
je 0x405dd0
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x405dc9
push 0
lea eax, [esp + 0x1c]
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x405dc9
cmp edi, dword [esp + 0x18]
jne 0x405dc9
push str._Rename__r_n
push esi
call fcn.004059c7
test eax, eax
jne 0x405ddd
push str._Rename__r_n
lea eax, [esi + edi]
push eax
call fcn.004057a3
add edi, 0xa
mov eax, edi
push ebx
push 0x421a20
add eax, esi
push eax
call fcn.004055d3
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [esp + 0x1c]
push eax
add edi, ebx
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [0x423c90]
pop edi
pop esi
pop ebp
pop ebx
ret 8
push 0x40762c
add eax, 0xa
push eax
call fcn.004059c7
test eax, eax
je 0x405d94
inc eax
lea ecx, [esi + edi]
cmp eax, ecx
mov ebp, eax
jae 0x405e04
mov dl, byte [ebp]
mov byte [ebx + ebp], dl
inc ebp
cmp ebp, ecx
jb 0x405df9
mov ebp, dword [esp + 0x14]
sub eax, esi
jmp 0x405d96
Function at 0x405e0c
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push ebx
mov ebx, dword [ebp + 8]
push ebx
call fcn.00405945
mov ecx, dword [ebp + 0xc]
test cl, 8
mov dword [ebp - 8], eax
je 0x405e41
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x423c88], eax
jmp 0x405fd3
mov dword [ebp + 8], ecx
and dword [ebp + 8], 1
push esi
je 0x405e5c
test eax, eax
je 0x405f7e
test cl, 2
je 0x405f7e
push edi
push ebx
mov esi, 0x422360
push esi
call fcn.004057a3
cmp dword [ebp + 8], 0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
je 0x405e7f
push str..
push esi
call edi
jmp 0x405e85
push ebx
call fcn.0040591e
cmp byte [ebx], 0
jne 0x405e93
cmp byte [0x422360], 0x5c
jne 0x405e9b
push 0x407290
push ebx
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
lea eax, [ebp - 0x148]
push eax
push esi
add edi, ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x405f73
lea esi, [ebp - 0x11c]
push 0x3f
mov eax, esi
push eax
call fcn.00405543
cmp byte [eax], 0
je 0x405ede
cmp byte [ebp - 0x18], 0
je 0x405ede
lea esi, [ebp - 0x18]
cmp byte [esi], 0x2e
jne 0x405ef4
mov al, byte [esi + 1]
test al, al
je 0x405f52
cmp al, 0x2e
jne 0x405ef4
cmp byte [esi + 2], 0
je 0x405f52
push esi
push edi
call fcn.004057a3
test byte [ebp - 0x148], 0x10
je 0x405f19
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405f52
push dword [ebp + 0xc]
push ebx
call fcn.00405e0c
jmp 0x405f52
push ebx
call fcn.004055f3
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x405f4a
test byte [ebp + 0xc], 4
je 0x405f42
push ebx
push 0xfffffffffffffff1
call fcn.00404845
push 0
push ebx
call fcn.00405c73
jmp 0x405f52
inc dword [0x423c88]
jmp 0x405f52
push ebx
push 0xfffffffffffffff2
call fcn.00404845
lea eax, [ebp - 0x148]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x405ec0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x405f7d
mov byte [edi - 1], 0
pop edi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x405fd2
cmp dword [ebp - 8], esi
jne 0x405f92
inc dword [0x423c88]
jmp 0x405fd2
push ebx
call fcn.00405860
test eax, eax
je 0x405fd2
push ebx
call fcn.004058f1
push ebx
call fcn.004055f3
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x405fca
test byte [ebp + 0xc], 4
je 0x405f8a
push ebx
push 0xfffffffffffffff1
call fcn.00404845
push esi
push ebx
call fcn.00405c73
jmp 0x405fd2
push ebx
push 0xffffffffffffffe5
call fcn.00404845
pop esi
pop ebx
leave
ret 8
Function at 0x405fd8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422764], 0
push esi
jne 0x40600f
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405fe9
mov dword [ecx*4 + 0x422760], eax
inc ecx
cmp ecx, 0x100
jl 0x405fe4
mov esi, dword [esp + 0x10]
test esi, esi
mov eax, dword [esp + 8]
not eax
jbe 0x40603b
mov ecx, dword [esp + 0xc]
xor edx, edx
mov dl, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x422760]
inc ecx
dec esi
jne 0x406021
not eax
pop esi
ret 0xc
Function at 0x5a999b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x1095f3c4
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1095f3ce
pushal
call 0x1095f3d4
pop ebp
sub ebp, 0x10
sub ebp, 0x95f3c4
mov al, byte [esp + 0x28]
cmp al, 1
je 0x1095f3f8
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x1095f401
mov eax, 0x95f3c4
add eax, ebp
add eax, 0x63
mov ecx, 0x5a4
mov edx, 0x75169e74
xor byte [eax], dl
inc eax
dec ecx
jne 0x1095f418
jmp 0x1095f42b
invalid
Function at 0x4093a4
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
mov eax, 0x445ffc
call fcn.004398fc
push str.ConfigTDP::Startup__
call sub.KERNEL32.DLL_OutputDebugStringA
cmp dword [0x445d28], 0
jne 0x409508
call fcn.0040a188
test al, al
jne 0x409413
call fcn.0040a1d0
test al, al
jne 0x409413
call fcn.0040a020
test al, al
jne 0x409413
call fcn.0040a05c
test al, al
jne 0x409413
call fcn.0040a098
test al, al
jne 0x409413
call fcn.0040a0d4
test al, al
jne 0x409413
call fcn.0040a110
test al, al
jne 0x409413
call fcn.0040a14c
test al, al
je 0x40944a
push 0x10
call fcn.00434bec
pop ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x40943c
mov word [ebp - 0x24], 0x24
push dword [ebp - 4]
call fcn.0040a89c
pop ecx
mov word [ebp - 0x24], 0xc
mov edx, dword [ebp - 4]
jmp 0x40943f
mov edx, dword [ebp - 4]
mov dword [0x445d28], edx
jmp 0x409508
call fcn.00408ebc
test al, al
jne 0x40945c
call fcn.00409fe4
test al, al
je 0x409490
push 0x10
call fcn.00434bec
pop ecx
mov dword [ebp - 8], eax
test eax, eax
je 0x409485
mov word [ebp - 0x24], 0x48
push dword [ebp - 8]
call fcn.0040ae7c
pop ecx
mov word [ebp - 0x24], 0x30
mov ecx, dword [ebp - 8]
jmp 0x409488
mov ecx, dword [ebp - 8]
mov dword [0x445d28], ecx
jmp 0x409508
call fcn.00409f30
test al, al
je 0x4094cd
push 0x10
call fcn.00434bec
pop ecx
mov dword [ebp - 0xc], eax
test eax, eax
je 0x4094c2
mov word [ebp - 0x24], 0x6c
push dword [ebp - 0xc]
call fcn.0040ab84
pop ecx
mov word [ebp - 0x24], 0x54
mov edx, dword [ebp - 0xc]
jmp 0x4094c5
mov edx, dword [ebp - 0xc]
mov dword [0x445d28], edx
jmp 0x409508
call fcn.00409240
test al, al
je 0x409508
push 0x10
call fcn.00434bec
pop ecx
mov dword [ebp - 0x10], eax
test eax, eax
je 0x4094ff
mov word [ebp - 0x24], 0x90
push dword [ebp - 0x10]
call fcn.0040b1a0
pop ecx
mov word [ebp - 0x24], 0x78
mov ecx, dword [ebp - 0x10]
jmp 0x409502
mov ecx, dword [ebp - 0x10]
mov dword [0x445d28], ecx
cmp dword [0x445d28], 0
je 0x409522
push dword [ebp + 8]
push dword [0x445d28]
call fcn.0040a420
add esp, 8
mov eax, dword [ebp - 0x34]
mov dword fs:[0], eax
mov esp, ebp
pop ebp
ret 4

Function at 0x4095a0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push str.ConfigTDP::EnterNormalMode__
call sub.KERNEL32.DLL_OutputDebugStringA
cmp dword [0x445d28], 0
je 0x4095c7
push dword [ebp + 8]
mov eax, dword [0x445d28]
push eax
mov edx, dword [eax]
call dword [edx + 4]
add esp, 8
pop ebp
ret 4

Function at 0x4095e0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push str.ConfigTDP::EnterPowerSavingMode__
call sub.KERNEL32.DLL_OutputDebugStringA
cmp dword [0x445d28], 0
je 0x409607
push dword [ebp + 8]
mov eax, dword [0x445d28]
push eax
mov edx, dword [eax]
call dword [edx + 0xc]
add esp, 8
pop ebp
ret 4

Function at 0x40960c
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push str.ConfigTDP::LeavePowerSavingMode__
call sub.KERNEL32.DLL_OutputDebugStringA
cmp dword [0x445d28], 0
je 0x409633
push dword [ebp + 8]
mov eax, dword [0x445d28]
push eax
mov edx, dword [eax]
call dword [edx + 0x10]
add esp, 8
pop ebp
ret 4
Function at 0x409638
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push str.ConfigTDP::EnterAwayMode__
call sub.KERNEL32.DLL_OutputDebugStringA
cmp dword [0x445d28], 0
je 0x40965f
push dword [ebp + 8]
mov eax, dword [0x445d28]
push eax
mov edx, dword [eax]
call dword [edx + 0x14]
add esp, 8
pop ebp
ret 4

Function at 0x409664
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push str.ConfigTDP::LeaveAwayMode__
call sub.KERNEL32.DLL_OutputDebugStringA
cmp dword [0x445d28], 0
je 0x40968b
push dword [ebp + 8]
mov eax, dword [0x445d28]
push eax
mov edx, dword [eax]
call dword [edx + 0x18]
add esp, 8
pop ebp
ret 4

Function at 0x409690
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push str.ConfigTDP::EnterSuspendMode__
call sub.KERNEL32.DLL_OutputDebugStringA
cmp dword [0x445d28], 0
je 0x4096b7
push dword [ebp + 8]
mov eax, dword [0x445d28]
push eax
mov edx, dword [eax]
call dword [edx + 0x1c]
add esp, 8
pop ebp
ret 4

Function at 0x4096bc
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push str.ConfigTDP::LeaveSuspendMode__
call sub.KERNEL32.DLL_OutputDebugStringA
cmp dword [0x445d28], 0
je 0x4096e3
push dword [ebp + 8]
mov eax, dword [0x445d28]
push eax
mov edx, dword [eax]
call dword [edx + 0x20]
add esp, 8
pop ebp
ret 4
Function at 0x409b38
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdac
push esi
push edi
mov eax, 0x4464c4
call fcn.004398fc
cmp dword [0x446118], 0
je 0x409b67
mov al, 1
mov edx, dword [ebp - 0x4c]
mov dword fs:[0], edx
jmp 0x409d22
mov esi, 0x44611c
lea edi, [ebp - 0x254]
mov ecx, 0x82
rep movsd dword es:[edi], dword [esi]
mov word [ebp - 0x3c], 0xc
mov word [ebp - 0x3c], 0x18
lea eax, [ebp - 0x28]
push eax
call fcn.00409a80
pop ecx
inc dword [ebp - 0x30]
mov word [ebp - 0x3c], 0xc
push 0x104
lea edx, [ebp - 0x254]
push edx
call sub.KERNEL32.DLL_GetSystemDirectoryW
lea ecx, [ebp - 0x254]
push ecx
lea eax, [ebp - 0x28]
push eax
call fcn.00409d28
add esp, 8
push 0x4463f6
lea edx, [ebp - 0x28]
push edx
call fcn.004015c0
add esp, 8
lea ecx, [ebp - 0x28]
push ecx
call fcn.004015d4
pop ecx
push eax
call sub.KERNEL32.DLL_LoadLibraryW
mov dword [0x446118], eax
cmp dword [0x446118], 0
je 0x409d03
push str.ASIO_Open
push dword [0x446118]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4560a8], eax
push str.ASIO_ReadMSR
push dword [0x446118]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4560ac], eax
push str.ASIO_WriteMSR
push dword [0x446118]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4560b0], eax
push str.ASIO_InPortB
push dword [0x446118]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4560b4], eax
push str.ASIO_OutPortB
push dword [0x446118]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4560b8], eax
push str.ASIO_InPortD
push dword [0x446118]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4560bc], eax
push str.ASIO_OutPortD
push dword [0x446118]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4560c0], eax
push str.MapPhysToLin
push dword [0x446118]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4560c4], eax
push str.UnmapPhysicalMemory
push dword [0x446118]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4560c8], eax
push str.ASIO_MapMem
push dword [0x446118]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4560cc], eax
push str.ASIO_UnmapMem
push dword [0x446118]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4560d0], eax
push 0
call dword [0x4560a8]
test eax, eax
je 0x409d03
mov al, 1
push eax
dec dword [ebp - 0x30]
push 2
lea edx, [ebp - 0x28]
push edx
call fcn.00401594
add esp, 8
pop eax
mov edx, dword [ebp - 0x4c]
mov dword fs:[0], edx
jmp 0x409d22
xor eax, eax
push eax
dec dword [ebp - 0x30]
push 2
lea edx, [ebp - 0x28]
push edx
call fcn.00401594
add esp, 8
pop eax
mov edx, dword [ebp - 0x4c]
mov dword fs:[0], edx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x412114
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov eax, 0x449650
call fcn.004398fc
mov word [ebp - 0x14], 0xc
push dword [ebp + 8]
call fcn.0041215c
pop ecx
add dword [ebp - 8], 2
mov edx, dword [ebp + 8]
add edx, 0x30
push edx
call fcn.004121b0
pop ecx
add dword [ebp - 8], 2
mov ecx, dword [ebp - 0x24]
mov dword fs:[0], ecx
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret
Function at 0x415570
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
call fcn.00415530
test eax, eax
jne 0x41558a
lea eax, [ebp - 0x24]
push eax
call sub.KERNEL32.DLL_GetSystemInfo
jmp 0x415593
lea edx, [ebp - 0x24]
push edx
call sub.KERNEL32.DLL_GetNativeSystemInfo
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x42a410
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
lea eax, [ebp - 0x24]
push eax
call sub.KERNEL32.DLL_GetSystemInfo
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x42ce10
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda8
push esi
push edi
mov eax, 0x44ed44
call fcn.004398fc
xor edx, edx
mov dword [ebp - 0x28], edx
mov esi, 0x44d120
lea edi, [ebp - 0x258]
mov ecx, 0x8b
rep movsd dword es:[edi], dword [esi]
mov word [ebp - 0x14], 0xc
push 0
push 0xf
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xffffffff
je 0x42cea2
lea eax, [ebp - 0x258]
push eax
push dword [ebp - 0x2c]
call sub.KERNEL32.DLL_Process32FirstW
test eax, eax
je 0x42ce9a
jmp 0x42ce87
lea edx, [ebp - 0x234]
push edx
push dword [ebp + 8]
call sub.KERNEL32.DLL_lstrcmpiW
test eax, eax
jne 0x42ce87
mov ecx, dword [ebp - 0x250]
mov dword [ebp - 0x28], ecx
jmp 0x42ce9a
lea eax, [ebp - 0x258]
push eax
push dword [ebp - 0x2c]
call sub.KERNEL32.DLL_Process32NextW
test eax, eax
jne 0x42ce69
push dword [ebp - 0x2c]
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42cf30
Capabilities:
Create process on windows
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff900
push esi
push edi
mov eax, 0x44edbc
call fcn.004398fc
mov dword [ebp - 0x58], 2
mov word [ebp - 0x64], 0xc
mov word [ebp - 0x64], 0x18
lea edx, [ebp + 0x30]
push edx
lea ecx, [ebp + 8]
push ecx
lea eax, [ebp - 0x28]
push eax
call fcn.00414e60
add esp, 0xc
inc dword [ebp - 0x58]
mov word [ebp - 0x64], 0xc
mov word [ebp - 0x64], 0x24
lea edx, [ebp + 8]
push edx
lea ecx, [ebp - 0x50]
push ecx
call fcn.0042d150
add esp, 8
lea eax, [ebp - 0x50]
push eax
inc dword [ebp - 0x58]
call fcn.004015d4
pop ecx
push eax
call sub.KERNEL32.DLL_SetCurrentDirectoryW
dec dword [ebp - 0x58]
push 2
lea edx, [ebp - 0x50]
push edx
call fcn.00401594
add esp, 8
push 0x44
push 0
lea ecx, [ebp - 0xe8]
push ecx
call fcn.004394b8
add esp, 0xc
mov dword [ebp - 0xe8], 0x44
mov dword [ebp - 0xbc], 1
cmp byte [ebp + 0x5c], 0
je 0x42cfe7
mov word [ebp - 0xb8], 1
jmp 0x42cff0
mov word [ebp - 0xb8], 0
mov esi, 0x44d7ba
lea edi, [ebp - 0x2f0]
mov ecx, 0x82
rep movsd dword es:[edi], dword [esi]
mov word [ebp - 0x64], 0x30
lea eax, [ebp - 0x28]
push eax
call fcn.004015d4
pop ecx
push eax
lea edx, [ebp - 0x2f0]
push edx
call fcn.004398bc
add esp, 8
lea ecx, [ebp - 0x300]
push ecx
lea eax, [ebp - 0xe8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x2f0]
push edx
push 0
call sub.KERNEL32.DLL_CreateProcessW
test eax, eax
jne 0x42d0c3
call sub.KERNEL32.DLL_GetLastError
push eax
push str.CreateProcess_failed___d_._n
lea ecx, [ebp - 0x700]
push ecx
call fcn.0043c3d8
add esp, 0xc
push 0
push str.Error
lea eax, [ebp - 0x700]
push eax
push 0
call sub.USER32.DLL_MessageBoxA
xor eax, eax
push eax
dec dword [ebp - 0x58]
push 2
lea edx, [ebp - 0x28]
push edx
call fcn.00401594
add esp, 8
dec dword [ebp - 0x58]
push 2
lea ecx, [ebp + 8]
push ecx
call fcn.00401594
add esp, 8
dec dword [ebp - 0x58]
push 2
lea eax, [ebp + 0x30]
push eax
call fcn.00401594
add esp, 8
pop eax
mov edx, dword [ebp - 0x74]
mov dword fs:[0], edx
jmp 0x42d147
push 1
call sub.KERNEL32.DLL_Sleep
mov ecx, dword [ebp - 0x300]
mov dword [ebp - 0x78], ecx
cmp byte [ebp + 0x58], 0
je 0x42d0fd
push dword [ebp + 0x60]
push dword [ebp - 0x78]
call sub.KERNEL32.DLL_WaitForSingleObject
xor eax, eax
mov dword [ebp - 0x7c], eax
lea edx, [ebp - 0x7c]
push edx
push dword [ebp - 0x78]
call sub.KERNEL32.DLL_GetExitCodeProcess
push dword [ebp - 0x78]
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebp - 0x78]
push eax
dec dword [ebp - 0x58]
push 2
lea edx, [ebp - 0x28]
push edx
call fcn.00401594
add esp, 8
dec dword [ebp - 0x58]
push 2
lea ecx, [ebp + 8]
push ecx
call fcn.00401594
add esp, 8
dec dword [ebp - 0x58]
push 2
lea eax, [ebp + 0x30]
push eax
call fcn.00401594
add esp, 8
pop eax
mov edx, dword [ebp - 0x74]
mov dword fs:[0], edx
jmp 0x42d147
pop edi
pop esi
mov esp, ebp
pop ebp
ret