joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43cfb0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4c2ff8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x4fe320]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
mov dword [esp + 0x20], 7
push eax
push 0x4d38dc
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], 0
mov word [esp + 0x14], ax
call fcn.00409650
lea eax, [esp + 0xc]
mov dword [esp + 0x30], 0
mov ecx, dword [esi + 0x38]
push eax
push 0xffffffffffffffff
call fcn.0043b550
cmp dword [esp + 0x20], 8
jb 0x43d02d
push dword [esp + 0xc]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x43f970
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4c2ff8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x4fe320]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
mov dword [esp + 0x20], 7
push eax
push 0x4d38dc
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], 0
mov word [esp + 0x14], ax
call fcn.00409650
mov dword [esp + 0x30], 0
lea edx, [esp + 0xc]
mov eax, dword [esi]
push edx
push 0xfffffffffffffffe
push 0xfffffffffffffffe
mov ecx, dword [eax + 0x44]
mov eax, dword [ecx]
call dword [eax + 8]
cmp dword [esp + 0x20], 8
jb 0x43f9f1
push dword [esp + 0xc]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x447ff0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ecx
xor eax, eax
mov edx, eax
mov ecx, eax
and edx, 1
shr ecx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov dword [eax*4 + 0x5126c0], ecx
inc eax
cmp eax, 0x100
jb 0x447ff3
cmp eax, 0x800
jae 0x4480c3
nop
mov edx, dword [eax*4 + 0x5122c0]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x5126c0]
mov dword [eax*4 + 0x5126c0], edx
inc eax
cmp eax, 0x800
jb 0x4480a0
mov dword [0x5146c4], 0x449bc0
mov dword [0x5146c0], 0x449bc0
mov dword [0x5146c8], 0x449c60
call fcn.00449e70
mov ecx, dword [0x5146c0]
test eax, eax
mov edx, 0x449c60
cmove ecx, edx
mov dword [0x5146c0], ecx
pop ecx
ret
Function at 0x44ce80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
xor edi, edi
mov dword [ebp - 4], ebx
mov esi, dword [esi]
and esi, 7
cmp edx, 5
jae 0x44cea6
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
add dword [ebp + 8], 5
sub edx, 4
add edx, ebx
mov dword [ebp - 0xc], edx
lea eax, [edi + ebx]
cmp eax, edx
jae 0x44cecf
lea esp, [esp]
mov cl, byte [eax]
and cl, 0xfe
cmp cl, 0xe8
je 0x44cecf
inc eax
cmp eax, edx
jb 0x44cec0
mov ecx, eax
sub ecx, edi
mov edi, eax
sub ecx, ebx
sub edi, ebx
cmp eax, edx
jae 0x44cfb2
cmp ecx, 2
jbe 0x44cf72
xor esi, esi
movzx ebx, byte [eax + 4]
lea ecx, [ebx + 1]
test cl, 0xfe
jne 0x44cfa4
movzx ecx, byte [eax + 3]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [eax + 2]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [eax + 1]
shl ebx, 8
or ebx, ecx
mov ecx, dword [ebp + 8]
add ecx, edi
add edi, 5
sub ebx, ecx
mov dword [ebp - 8], ecx
test esi, esi
je 0x44cf4c
and esi, 6
mov edx, ebx
shl esi, 2
mov ecx, esi
shr edx, cl
inc edx
test dl, 0xfe
jne 0x44cf47
mov edx, 0x100
shl edx, cl
dec edx
xor ebx, edx
sub ebx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
xor esi, esi
mov ecx, ebx
mov byte [eax + 1], bl
shr ecx, 8
mov byte [eax + 2], cl
mov ecx, ebx
shr ebx, 0x18
and bl, 1
shr ecx, 0x10
neg bl
mov byte [eax + 3], cl
mov byte [eax + 4], bl
mov ebx, dword [ebp - 4]
jmp 0x44ceb2
shr esi, cl
test esi, esi
je 0x44ceec
cmp esi, 4
ja 0x44cf99
cmp esi, 3
je 0x44cf99
mov ecx, esi
shr ecx, 1
movzx ecx, byte [ecx + eax + 1]
inc ecx
test cl, 0xfe
jne 0x44ceec
or esi, 8
shr esi, 1
inc edi
jmp 0x44ceb2
mov ebx, dword [ebp - 4]
or esi, 8
shr esi, 1
inc edi
jmp 0x44ceb2
cmp ecx, 2
jbe 0x44cfc7
mov eax, dword [ebp + 0xc]
xor esi, esi
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
shr esi, cl
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44df30
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c3b18
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4fe320]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi + 0xc], 0
push 0x400
push ecx
lea ecx, [edi + 0x10]
mov dword [ebp - 4], 0
call fcn.0044e220
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov eax, dword [edi + 0x10]
mov dword [edi + 0x30], eax
xor eax, eax
mov dword [edi + 0x48], 7
mov dword [edi + 0x44], 0
mov word [edi + 0x34], ax
mov byte [edi + 0x4c], al
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4511e0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c3cb3
mov eax, dword fs:[0]
push eax
push ecx
push edi
mov eax, dword [0x4fe320]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 0
mov dword [edi + 4], 0
call fcn.004556b0
mov dword [edi], eax
push 0
mov dword [ebp - 4], 0
push 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
call fcn.00455670
mov dword [edi + 8], eax
push 0
mov byte [ebp - 4], 1
push 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
call fcn.00455670
mov dword [edi + 0x10], eax
lea eax, [edi + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [edi + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [edi + 0x5c], 7
xor eax, eax
mov dword [edi + 0x58], 0
mov word [edi + 0x48], ax
mov dword [edi + 0x70], eax
mov dword [edi + 0x74], 7
mov word [edi + 0x60], ax
mov dword [edi + 0x88], eax
mov dword [edi + 0x8c], 7
mov word [edi + 0x78], ax
mov dword [edi + 0xa4], eax
mov dword [edi + 0xa8], 7
mov word [edi + 0x94], ax
mov dword [edi + 0xac], eax
mov dword [edi + 0xb0], 0xffffffff
mov dword [edi + 0xb4], eax
mov eax, edi
mov dword [edi + 0xb8], 2
mov dword [edi + 0xbc], 2
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x4515f0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
mov eax, 0x4e67c6a7
push edi
movzx edi, word [esi]
test di, di
je 0x45161f
mov edx, eax
lea esi, [esi + 2]
mov ecx, eax
shl edx, 5
shr ecx, 2
add edx, ecx
movzx ecx, di
movzx edi, word [esi]
add edx, ecx
xor eax, edx
test di, di
jne 0x451601
pop edi
and eax, 0x7fff
pop esi
ret

Function at 0x4546f0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c02b8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x4fe320]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push dword [ebp + 8]
lea eax, [ebp - 0x2c]
push eax
call fcn.00451740
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 0
call fcn.00463680
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x40]
call fcn.004638b0
test al, al
jne 0x454748
xor esi, esi
jmp 0x45477b
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0xffffffff
call fcn.00460740
lea ecx, [ebp - 0x30]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
lea eax, [ebp - 0x34]
push eax
push 0x4545d0
call dword [sym.imp.USER32.dll_EnumWindows]
mov esi, dword [ebp - 0x34]
cmp dword [ebp - 0x18], 8
jb 0x45478d
push dword [ebp - 0x2c]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004bbbfc
mov esp, ebp
pop ebp
ret 4
Function at 0x457ad0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x302c
call fcn.004bc3a0
mov eax, dword [0x4fe320]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xorps xmm0, xmm0
mov dword [ebp - 0x300c], 0
lea eax, [ebp - 0x302c]
mov esi, edx
push eax
mov edi, ecx
movdqu xmmword [ebp - 0x302c], xmm0
movdqu xmmword [ebp - 0x301c], xmm0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x3018]
mov dword [edi], eax
mov dword [esi], eax
mov eax, dword [0x51243c]
test al, 1
jne 0x457b53
push str.GetLogicalProcessorInformation
or eax, 1
push str.kernel32.dll
mov dword [0x51243c], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [0x512440], esi
jmp 0x457b59
mov esi, dword [0x512440]
test esi, esi
je 0x457bc7
push 0x3000
lea eax, [ebp - 0x3004]
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [ebp - 0x3008], 0x3000
lea eax, [ebp - 0x3008]
push eax
lea eax, [ebp - 0x3004]
push eax
call esi
test eax, eax
je 0x457bc7
mov eax, 0xaaaaaaab
xor esi, esi
mul dword [ebp - 0x3008]
shr edx, 4
test edx, edx
je 0x457bc7
lea ecx, [ebp - 0x3000]
jmp 0x457bb0
mov eax, dword [ecx]
sub eax, 0
je 0x457bba
dec eax
jmp 0x457bbb
inc esi
add ecx, 0x18
dec edx
jne 0x457bb0
test esi, esi
je 0x457bc7
mov dword [edi], esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004bbbfc
mov esp, ebp
pop ebp
ret

Function at 0x459e70
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c5496
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x4fe320]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x238], 0
push 0x206
push eax
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xor eax, eax
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], 0
mov word [ebp - 0x234], ax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x234]
lea eax, [ebp - 0x21c]
push eax
call fcn.00424800
push 0x4d8978
lea edx, [ebp - 0x234]
mov dword [ebp - 4], 1
mov ecx, 0x512604
call fcn.00424a50
add esp, 4
cmp dword [ebp - 0x220], 8
jb 0x459f41
push dword [ebp - 0x234]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, 0x512604
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004bbbfc
mov esp, ebp
pop ebp
ret 4
Function at 0x45a010
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c54fb
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x4fe320]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x224], 0
push 0x206
push eax
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push eax
mov dword [ebp - 0x220], 0x512620
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push 0
push 0
push 5
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xor eax, eax
mov dword [0x512634], 7
mov dword [0x512630], 0
mov word [0x512620], ax
mov dword [ebp - 4], eax
mov ecx, 0x512620
lea eax, [ebp - 0x21c]
push eax
call fcn.00424800
mov eax, 0x512620
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004bbbfc
mov esp, ebp
pop ebp
ret 4
Function at 0x45a9e0
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c56e7
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x4fe320]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push eax
mov dword [ebp - 0x250], 0
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xor eax, eax
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], 0
mov word [ebp - 0x234], ax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x234]
lea eax, [ebp - 0x21c]
push eax
call fcn.00424800
push str.lddownloader_
lea edx, [ebp - 0x234]
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x24c]
call fcn.00424a50
add esp, 4
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.0045a5e0
cmp dword [ebp - 0x238], 8
mov esi, dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
jb 0x45aac4
push dword [ebp - 0x24c]
call esi
add esp, 4
xor eax, eax
mov dword [ebp - 0x238], 7
cmp dword [ebp - 0x220], 8
mov dword [ebp - 0x23c], 0
mov word [ebp - 0x24c], ax
jb 0x45aaf5
push dword [ebp - 0x234]
call esi
add esp, 4
xor eax, eax
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], 0
mov word [ebp - 0x234], ax
lea eax, [ebp - 0x21c]
mov dword [ebp - 4], 3
push eax
lea ecx, [ebp - 0x234]
call fcn.00424800
sub esp, 0x18
mov dword [ebp - 4], 4
mov ecx, esp
lea edx, [ebp - 0x234]
push str.lddownloaderlddownloader.log
call fcn.00424a50
add esp, 4
mov ecx, edi
call fcn.0045a680
add esp, 0x18
cmp dword [ebp - 0x220], 8
jb 0x45ab68
push dword [ebp - 0x234]
call esi
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004bbbfc
mov esp, ebp
pop ebp
ret 4

Function at 0x45bbd0
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
mov esi, ecx
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x45bc1e
cmp dword [esi + 0x14], 8
mov eax, dword [esi + 0x10]
jb 0x45bbfa
mov esi, dword [esi]
lea eax, [eax*2 + 2]
push eax
push esi
push 1
push 0
push str.leidian9
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x45d4d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x4fe320]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, edx
mov esi, ecx
cmp dword [edi + 0x14], 8
jb 0x45d4f3
mov eax, dword [edi]
jmp 0x45d4f5
mov eax, edi
cmp dword [esi + 0x14], 8
jb 0x45d4fd
mov ecx, dword [esi]
push 1
push 0
push eax
push ecx
push str.shell_filename____s___param____s___runas___d__show___d
push 0x8e
push str.common::shell
call fcn.0045ec20
push pe_nt_image_headers32
lea eax, [ebp - 0x11c]
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0x28
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x45d55f
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [edi + 0x14], 8
jb 0x45d567
mov edi, dword [edi]
cmp dword [esi + 0x14], 8
jb 0x45d56f
mov esi, dword [esi]
push 5
push 0
push edi
push esi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop edi
pop esi
cmp eax, 0x20
jg 0x45d5b7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.shellEx_failed____lastError___d
push 0x9b
push str.common::shell
call fcn.0045ec20
add esp, 0x10
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bbbfc
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
call fcn.004bbbfc
mov esp, ebp
pop ebp
ret
Function at 0x45d5d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c5d88
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
mov eax, dword [0x4fe320]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
cmp dword [esi + 0x14], 8
jb 0x45d60b
mov eax, dword [esi]
jmp 0x45d60d
mov eax, esi
cmp dword [edi + 0x14], 8
jb 0x45d615
mov ecx, dword [edi]
push eax
push ecx
push str.createProcess_filename____s___param____s_
push 0xa6
push str.common::create
call fcn.0045ec20
push edi
mov edx, 0x4d83e4
lea ecx, [ebp - 0x40]
call fcn.0041c130
push 0x4d83e4
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
call fcn.0041c220
add esp, 0x24
mov byte [ebp - 4], 2
cmp dword [ebp - 0x2c], 8
mov edi, dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
jb 0x45d66a
push dword [ebp - 0x40]
call edi
add esp, 4
xor eax, eax
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
cmp dword [esi + 0x10], eax
je 0x45d6b7
push esi
mov edx, 0x4e77f8
lea ecx, [ebp - 0x58]
call fcn.0041c130
add esp, 4
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
call fcn.004242c0
mov byte [ebp - 4], 2
cmp dword [ebp - 0x44], 8
jb 0x45d6b7
push dword [ebp - 0x58]
call edi
add esp, 4
push 0x40
lea eax, [ebp - 0xac]
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [ebp - 0xb0], 0x44
lea ecx, [ebp - 0x68]
mov dword [ebp - 0xac], 0
xor eax, eax
mov dword [ebp - 0xa8], 0
cmp dword [ebp - 0x14], 8
xorps xmm0, xmm0
push ecx
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x80], eax
push ecx
push 0
push 0
push 0x10
push 0
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push 0
push 0
push eax
push 0
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0x84], 1
movdqu xmmword [ebp - 0x68], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x45d75d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.createProcess_failed____lastError___d
push 0xb9
push str.common::create
call fcn.0045ec20
add esp, 0x10
xor esi, esi
jmp 0x45d769
push dword [ebp - 0x64]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x68]
cmp dword [ebp - 0x14], 8
jb 0x45d777
push dword [ebp - 0x28]
call edi
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004bbbfc
mov esp, ebp
pop ebp
ret
Function at 0x45d8c0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x4fe320]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
mov dword [ebp - 0x264], 0
push 0x256
push eax
mov word [ebp - 0x25c], ax
mov esi, edx
lea eax, [ebp - 0x25a]
mov edi, ecx
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
push esi
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x45d950
lea eax, [ebp - 0x268]
push eax
push 4
lea eax, [ebp - 0x260]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x45d949
push 0x104
lea eax, [ebp - 0x25c]
push eax
push dword [ebp - 0x260]
push esi
call dword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExW]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
mov word [edi], ax
cmp word [ebp - 0x25c], ax
jne 0x45d970
xor ecx, ecx
jmp 0x45d98f
lea ecx, [ebp - 0x25c]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45d980
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x25c]
mov ecx, edi
push eax
call fcn.00409650
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.004bbbfc
mov esp, ebp
pop ebp
ret
Function at 0x463c30
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax + 0xc], ecx
mov edx, dword [ebp - 4]
cmp dword [edx + 8], 0
jne 0x463c6d
mov eax, dword [ebp - 4]
add eax, 4
push eax
push 0
mov ecx, dword [ebp - 4]
push ecx
push 0x4645d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
je 0x463c7f
mov dword [ebp - 8], 1
jmp 0x463c86
mov dword [ebp - 8], 0
mov al, byte [ebp - 8]
mov esp, ebp
pop ebp
ret 4

Function at 0x469c60
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x4fe320]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x120], 0
push pe_nt_image_headers32
push 0
lea eax, [ebp - 0x11c]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [ebp - 0x120], 0x11c
lea ecx, [ebp - 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x469cc5
mov dword [ebp - 0x120], 0x114
lea edx, [ebp - 0x120]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
jb 0x469cd2
mov al, 1
jmp 0x469cd4
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bbbfc
mov esp, ebp
pop ebp
ret

Function at 0x469cf0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push 0x4d40a4
push 0x4d4090
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x469d1f
lea eax, [ebp - 0x28]
push eax
call dword [ebp - 4]
jmp 0x469d29
lea ecx, [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx edx, word [ebp - 0x28]
cmp edx, 9
je 0x469d3b
movzx eax, word [ebp - 0x28]
cmp eax, 6
jne 0x469d3f
mov al, 1
jmp 0x469d41
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x469d50
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x469d67
mov dword [ebp - 8], 1
jmp 0x469d6e
mov dword [ebp - 8], 0
mov ecx, dword [ebp + 8]
call fcn.00408e90
push eax
mov ecx, dword [ebp - 8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x469daf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x469daf
movzx edx, byte [ebp + 0x10]
test edx, edx
je 0x469daf
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x469db2
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x469e60
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov dword [ebp - 0x3c], 0
push 0x38
push 0
lea eax, [ebp - 0x38]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x440
mov dword [ebp - 0x30], 0x4d40ec
mov ecx, dword [ebp + 8]
call fcn.00408e90
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x20], 5
lea ecx, [ebp - 0x3c]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x469ed1
push 5
push 0
mov ecx, dword [ebp + 8]
call fcn.00408e90
push eax
push str.iexplore.exe
push 0x4d41ec
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esp, ebp
pop ebp
ret