joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46d3a9
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x288
push ebx
push esi
mov esi, ecx
xor ebx, ebx
lea ecx, [esp + 0x10]
mov byte [esp + 0xf], bl
call fcn.0040a961
lea ecx, [esp + 0x30]
call fcn.0040a961
lea ecx, [esp + 0x20]
call fcn.0040a961
lea edx, [esp + 0x10]
mov ecx, esi
call fcn.00403aa2
mov ecx, dword [esp + 0x10]
call fcn.0046e199
test al, al
je 0x46d400
push 0x4c68d8
lea ecx, [esp + 0x14]
call fcn.004033c6
push ebx
lea eax, [esp + 0x24]
push ebx
push eax
lea edx, [esp + 0x3c]
lea ecx, [esp + 0x1c]
call fcn.0040525f
add esp, 0xc
lea eax, [esp + 0x40]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov al, 1
mov byte [esp + 0xe], al
cmp esi, 0xffffffff
je 0x46d4a0
cmp al, 1
jne 0x46d4a0
test byte [esp + 0x40], 0x10
jne 0x46d47b
mov byte [esp + 0xf], al
lea ecx, [esp + 0x10]
lea eax, [esp + 0x30]
push eax
call fcn.0040a8c7
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x14]
call fcn.00406350
lea eax, [esp + 0x6c]
push eax
lea ecx, [esp + 0x14]
call fcn.004033c6
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, 1
jne 0x46d497
lea eax, [esp + 0x40]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
ret
dec ecx
add byte [ebp + 0x24448ac0], al
push cs
jne 0x46d433
mov al, bl
mov byte [esp + 0xe], al
jmp 0x46d433
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x46d4ab
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov bl, byte [esp + 0xf]
lea ecx, [esp + 0x20]
call fcn.0040988f
lea ecx, [esp + 0x30]
call fcn.0040988f
lea ecx, [esp + 0x10]
call fcn.0040988f
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x472046
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x4d2ff0], 0
push esi
push edi
mov esi, 0x4d2630
jne 0x472069
push 0
call fcn.0042e4e8
pop ecx
mov ecx, eax
call fcn.00472006
mov dword [0x4d06e0], 0x270
mov edx, 0xe3
mov dword [0x4d2ff4], esi
mov eax, dword [esi + 4]
mov ecx, dword [esi]
xor ecx, eax
and al, 1
and ecx, 0x7ffffffe
movzx eax, al
xor ecx, dword [esi]
shr ecx, 1
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
xor ecx, dword [esi + 0x634]
mov dword [esi], ecx
add esi, 4
sub edx, 1
jne 0x47207e
mov eax, dword [esi]
mov dword [ebp - 4], 0x18c
mov edi, dword [esi + 4]
mov ecx, eax
xor ecx, edi
and ecx, 0x7ffffffe
xor ecx, eax
mov eax, edi
and al, 1
shr ecx, 1
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
mov eax, edi
xor ecx, dword [esi - 0x38c]
sub dword [ebp - 4], 1
mov dword [esi], ecx
lea esi, [esi + 4]
jne 0x4720b8
mov eax, dword [0x4d2630]
mov ecx, edi
xor ecx, eax
and al, 1
and ecx, 0x7ffffffe
movzx eax, al
xor ecx, edi
shr ecx, 1
neg eax
pop edi
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
xor ecx, dword [esi - 0x38c]
mov dword [esi], ecx
pop esi
leave
ret

Function at 0x472557
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x14], 1
jne 0x47257c
mov eax, dword [esi + 0xc]
add eax, dword [esi + 4]
push 8
push eax
lea eax, [ebp - 8]
push eax
call fcn.00420e20
add esp, 0xc
jmp 0x47258f
push dword [esi + 0x1c]
lea eax, [ebp - 8]
push 8
push 1
push eax
call fcn.0042e8c4
add esp, 0x10
movzx ecx, byte [ebp - 4]
movzx eax, byte [ebp - 3]
add dword [esi + 0xc], 8
shl ecx, 8
or ecx, eax
mov byte [ebp - 4], 0
movzx eax, byte [ebp - 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp - 1]
shl ecx, 8
or ecx, eax
mov eax, dword [ebp + 8]
push str.EA06
mov dword [eax], ecx
lea eax, [ebp - 8]
push eax
call fcn.0042e980
neg eax
pop ecx
pop ecx
sbb eax, eax
neg eax
pop esi
leave
ret 4

Function at 0x472693
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ecx
mov eax, 0x10000
mov ecx, dword [esi + 0x464]
test ecx, ecx
je 0x4726a9
cmp ecx, eax
jne 0x4726c5
push dword [esi + 0x1c]
push eax
push 1
push dword [esi + 0x45c]
call fcn.0042e8c4
add esp, 0x10
xor ecx, ecx
mov dword [esi + 0x464], ecx
mov eax, dword [esi + 0x45c]
mov al, byte [ecx + eax]
inc ecx
mov dword [esi + 0x464], ecx
pop esi
ret

Function at 0x4728fe
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe0
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
lea ecx, [ebp - 0xdc]
call fcn.0047274e
push dword [ebp + 8]
lea ecx, [ebp - 0xdc]
call fcn.00472792
xor esi, esi
test ebx, ebx
je 0x472942
push ecx
push ecx
lea ecx, [ebp - 0xdc]
call fcn.004728d2
xor byte [esi + edi], al
inc esi
cmp esi, ebx
jb 0x47292d
pop edi
pop esi
pop ebx
leave
ret
Function at 0x47cd1e
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
inc ebx
push edi
mov edi, ecx
cmp eax, ebx
jne 0x47cd3b
movzx ecx, word [edi + 0x8c]
jmp 0x47cd3f
movzx ecx, word [edi + 0x58]
movzx edx, cx
mov ecx, dword [edi + 0xc0]
cmp dx, bx
jne 0x47cd55
xor esi, esi
push esi
push esi
push esi
push ebx
jmp 0x47cd7c
cmp dx, 2
jne 0x47cd76
dec eax
neg eax
sbb eax, eax
and eax, 0xffffffcc
xor esi, esi
push esi
push str._local_
push dword [eax + edi + 0xb0]
push 3
jmp 0x47cd7c
xor esi, esi
push esi
push esi
push esi
push esi
push ecx
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [edi + 4], eax
test eax, eax
jne 0x47cd8e
xor al, al
jmp 0x47cdae
cmp byte [edi + 0xdc], 0
je 0x47cdac
push 8
lea ecx, [ebp - 8]
mov dword [ebp - 8], ebx
push ecx
push 0x32
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.WININET.dll_InternetSetOptionW]
mov al, bl
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x47ce44
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
push ebx
push esi
mov esi, ecx
push edi
push 0x4c6a94
push dword [esi + 0x34]
call fcn.0042e5eb
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x47ce70
mov dword [esi + 0x18], 0x1f
jmp 0x47ceea
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 4]
push eax
push 0x400
lea eax, [ebp - 0x404]
push eax
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x47cee3
cmp dword [ebp - 4], 0
je 0x47cebb
push edi
push ebx
push dword [ebp - 4]
lea eax, [ebp - 0x404]
push eax
call fcn.0042dbb3
mov eax, dword [ebp - 4]
add esp, 0x10
add dword [esi + 8], eax
adc dword [esi + 0xc], 0
test eax, eax
jne 0x47ce76
mov eax, dword [esi + 8]
or eax, dword [esi + 0xc]
jne 0x47cecc
mov dword [esi + 0x18], 0x21
jmp 0x47ceea
and dword [esi + 0x18], 0
mov eax, dword [esi + 0xd4]
test eax, eax
je 0x47cf06
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x47cf06
mov dword [esi + 0x18], 0x20
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0xd4]
test eax, eax
je 0x47cf04
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor bl, bl
test edi, edi
je 0x47cf11
push edi
call fcn.0042e678
pop ecx
pop edi
pop esi
mov al, bl
pop ebx
leave
ret 4
Function at 0x405ef0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a34], 0
push esi
jne 0x405f27
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f01
mov dword [ecx*4 + 0x422a30], eax
inc ecx
cmp ecx, 0x100
jl 0x405efc
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f58
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a30]
xor eax, esi
inc ecx
dec edx
jne 0x405f3a
pop edi
not eax
pop esi
ret 0xc

Function at 0xedd660
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x5d2000]
push edi
or ebp, 0xffffffff
jmp 0xedd682
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xedd689
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xedd678
mov eax, 1
add ebx, ebx
jne 0xedd69b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xedd6ac
jne 0xedd6bc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xedd6bc
dec eax
add ebx, ebx
jne 0xedd6b8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xedd690
xor ecx, ecx
sub eax, 3
jb 0xedd6d4
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xedd746
sar eax, 1
mov ebp, eax
jmp 0xedd6df
add ebx, ebx
jne 0xedd6df
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0xedd6ec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0xedd710
inc ecx
add ebx, ebx
jne 0xedd6fc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xedd6f1
jne 0xedd70d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xedd6f1
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xedd730
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xedd721
jmp 0xedd67e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xedd730
add edi, ecx
jmp 0xedd67e
pop esi
mov edi, esi
mov ecx, 0xd05
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xedd74e
cmp byte [edi], 9
jne 0xedd74e
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0xedd753
lea edi, [esi + 0xadb000]
mov eax, dword [edi]
or eax, eax
je 0xedd7cb
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xafed58]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xafedd0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xedd780
mov ecx, edi
jns 0xedd7af
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xafedd4]
or eax, eax
je 0xedd7c5
mov dword [ebx], eax
add ebx, 4
jmp 0xedd79d
call dword [esi + 0xafedd8]
popal
jmp 0x42344b

Function at 0x406080
Capabilities:
Encode data using xor

Disassembly:
mul dl
or dword [ecx], 0xb40ef49
invalid
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x44602f
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
pop ebx
ret 0x4fbe
or ecx, 0xf
scasd eax, dword es:[edi]
fld xword [edx - 0x5c]
xchg esi, eax
jl 0x445f46
in al, dx
test byte [ecx], 0xaa
sbb al, 0x84
pop ss
pushfd
loop 0x446008
cmp esi, dword [eax + 0x53]
add al, 0x5c
inc edx
popfd
shr esi, 0x53
mov esp, dword [eax + 0x58]
out 0x99, eax
pop esi
and ch, byte [ebp + ecx*8 - 0x61d25363]
or dword [ebx], edi
xor eax, eax
dec esp
fst dword [ebx + ecx*4 - 0x611333f1]
jl 0x445ff0
invalid
adc eax, 0xad58c3be
mov ebp, edx
jne 0x446047
ja 0x445f87
mov edx, 0x7ec99fae
movsd dword es:[edi], dword [esi]
jle 0x445f8a
pop ebp
pop ss
inc ecx
adc esp, dword [ebx]
sub al, 0x9c
push edx
xchg ecx, eax
and eax, 0xc8306e6c
outsb dx, byte [esi]
xor al, cl
xor dword [0xb0f75ca3], 0x70c005b5
scasd eax, dword es:[edi]
stosd dword es:[edi], eax
push ds
je 0x445fe5
add eax, 0x175193d6
or dword [esi + 0x4a], esp
jnp 0x446021
dec edx
push esp
inc eax
jecxz 0x446052
mov esp, 0x3192380a
push ecx
dec ebx
cmp esp, edx
ficomp word [esi - 1]
imul si, word [eax], 0xcc3b
cmp ecx, esp
invalid
jns 0x445fd4
fstp qword [esi + 0x4d]
stc
enter 0xffffffffffffe6ef, 5
into
adc byte [ecx - 0x5999a7e6], dh
mov eax, dword [0xc8b02a39]
cmpsb byte [esi], byte es:[edi]
sub eax, 0x484b3741
inc ecx
aaa
dec ebx
dec eax
cmp ebp, edx
pop ds
cmp esi, dword [ecx - 0x21dcb507]
and ebx, esi
jp 0x445fe3
mov edi, 0xb334883
hlt
Function at 0x402d4a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
je 0x402d90
call fcn.0040d5e5
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x402d90
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 4], eax
je 0x402dd3
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
je 0x402dbc
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x402dbc
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x402dd0
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x4096b1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x4096f4
call fcn.0040d5e5
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4096f4
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x40970f
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.00409268
test ebx, ebx
mov esi, eax
je 0x40970d
test edi, edi
je 0x40970d
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x40ee64
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x40ee92
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x40eeb0
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0040edce
jmp 0x40eeb0
mov eax, dword [esi + 0x14]
test eax, eax
je 0x40eeb0
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.0040edce
test edi, edi
mov eax, edi
jne 0x40ee9a
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x4433f0]
test ecx, ecx
je 0x40ef73
jmp 0x40ee63
ret 8

Function at 0x41cbab
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x440590]
jne 0x41cbb5
repz ret
jmp fcn.004213f2
Function at 0x429c7a
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00421559
xor ebx, ebx
cmp dword [0x44419c], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x429d4f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x429cba
xor eax, eax
jmp 0x429e13
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x436118
push edi
call esi
cmp eax, ebx
je 0x429cb3
push eax
call fcn.004214f6
mov dword [esp], 0x436108
push edi
mov dword [0x44419c], eax
call esi
push eax
call fcn.004214f6
mov dword [esp], 0x4360f4
push edi
mov dword [0x4441a0], eax
call esi
push eax
call fcn.004214f6
mov dword [0x4441a4], eax
lea eax, [ebp - 8]
push eax
call fcn.0041cdd2
test eax, eax
pop ecx
pop ecx
je 0x429d1d
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00421fd2
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x429d4f
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.004214f6
cmp eax, ebx
pop ecx
mov dword [0x4441ac], eax
je 0x429d4f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004214f6
pop ecx
mov dword [0x4441a8], eax
mov eax, dword [0x4441a8]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x429dc8
cmp dword [0x4441ac], esi
je 0x429dc8
push eax
call fcn.00421562
pop ecx
call eax
cmp eax, ebx
je 0x429d95
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x4441ac]
call fcn.00421562
pop ecx
call eax
test eax, eax
je 0x429d95
test byte [ebp - 0x18], 1
jne 0x429dc8
lea eax, [ebp - 0xc]
push eax
call fcn.0041ce09
test eax, eax
pop ecx
je 0x429db0
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00421fd2
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x429dbf
or dword [ebp + 0x10], 0x200000
jmp 0x429df9
or dword [ebp + 0x10], 0x40000
jmp 0x429df9
mov eax, dword [0x4441a0]
cmp eax, esi
je 0x429df9
push eax
call fcn.00421562
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x429df9
mov eax, dword [0x4441a4]
cmp eax, esi
je 0x429df9
push dword [ebp - 4]
push eax
call fcn.00421562
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x44419c]
call fcn.00421562
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42ff84
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x440590]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0042ff19
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.0041e0d0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x42ffd3
cmp dword [ebp - 0x1c], 5
jb 0x42ffeb
jmp 0x42ffe7
cmp dword [ebp - 0x10], 1
jne 0x42ffeb
cmp dword [ebp - 0x1c], 4
ja 0x42ffe7
jne 0x42ffeb
cmp dword [ebp - 0x18], 0
jbe 0x42ffeb
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x4372f0
call fcn.0042fded
test eax, eax
jge 0x43000c
mov byte [0x4442fc], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0041cbab
add ebp, 0x78
leave
ret
Function at 0x1001205
Capabilities:
Create process on windows
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
xor esi, esi
push eax
mov dword [ebp - 0x218], esi
mov dword [ebp - 0x21c], esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0xa
mov eax, 0x80000000
mov dword [ebp - 0x250], eax
mov dword [ebp - 0x24c], eax
mov dword [ebp - 0x248], eax
mov dword [ebp - 0x244], eax
pop eax
mov word [ebp - 0x230], ax
xor eax, eax
mov word [ebp - 0x22e], ax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x260]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x20c]
push eax
push esi
mov dword [ebp - 0x260], 0x44
mov dword [ebp - 0x25c], esi
mov dword [ebp - 0x258], esi
mov dword [ebp - 0x254], esi
mov dword [ebp - 0x234], esi
mov dword [ebp - 0x22c], esi
mov dword [ebp - 0x228], esi
mov dword [ebp - 0x224], esi
mov dword [ebp - 0x220], esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp dword [ebp - 0x218], esi
pop esi
je 0x10012e0
push dword [ebp - 0x218]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x21c]
xor ecx, ebp
call fcn.01001c13
leave
ret 4
Function at 0x1001751
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x458
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov dword [0x100343c], eax
mov eax, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
mov dword [0x1003440], eax
mov eax, dword [ebp + 0x14]
mov dword [0x1003aac], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
push 9
push edi
mov dword [0x1003aa8], edi
call dword [sym.imp.USER32.dll_LoadStringW]
push esi
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x10018e5
push ebx
lea eax, [ebp - 0x414]
push eax
push esi
push 0x1003680
call sub.msvcrt.dll_wcscpy_s
add esp, 0xc
mov ebx, 0x7f00
xor esi, esi
push ebx
lea eax, [ebp - 0x20c]
push esi
mov dword [ebp - 0x42c], edi
mov dword [ebp - 0x418], eax
mov dword [ebp - 0x438], 0x10014ed
mov dword [ebp - 0x43c], esi
call dword [sym.imp.USER32.dll_LoadIconW]
push ebx
push esi
mov dword [ebp - 0x428], eax
call dword [sym.imp.USER32.dll_LoadCursorW]
push esi
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x41c], esi
mov dword [ebp - 0x434], esi
mov dword [ebp - 0x430], esi
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [ebp - 0x420], eax
lea eax, [ebp - 0x43c]
push eax
call dword [sym.imp.USER32.dll_RegisterClassW]
test ax, ax
je 0x100188f
push esi
push edi
push esi
push esi
push 0xa
push 0xa
mov eax, 0x80000000
push eax
push eax
push 0x48000000
push esi
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.USER32.dll_CreateWindowExW]
push dword [ebp + 0x14]
mov ebx, eax
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
push 0x1f4
push 1
push ebx
call dword [sym.imp.USER32.dll_SetTimer]
push ebx
call dword [sym.imp.USER32.dll_UpdateWindow]
call fcn.0100152a
test eax, eax
jne 0x1001893
xor eax, eax
jmp 0x10018e4
call fcn.010012f9
test eax, eax
je 0x10018a3
push esi
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov edi, dword [sym.imp.USER32.dll_GetMessageW]
jmp 0x10018c5
lea eax, [ebp - 0x458]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x458]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push esi
push esi
push esi
lea eax, [ebp - 0x458]
push eax
call edi
test eax, eax
jne 0x10018ab
push 1
push ebx
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [ebp - 0x450]
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.01001c13
leave
ret 0x10