joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44e4a5
Capabilities:
Encode data using xor

Disassembly:
or eax, 0x64be6e1d
mov byte [edi + ebx], bl
outsb dx, byte [esi]
mov esi, 0x1f1c8864
dec eax
and ebx, edi
mov ch, 0x7d
mov ebp, 0xf7467147
pop es
and dword [ebp - 0x4c], edx
imul edi, edx, 0x421ad334
dec edi
push ebx
sub al, 0xdd
xor eax, esi
mov dh, 0x10
mov edx, 0xa669bf8d
insd dword es:[edi], dx
mov ecx, 0xd3e1460d
loope 0x44e4a7
mov bl, 0x5c
cmp dword [eax + ebx*2 + 0x30], 0xffffffc0
jno 0x44e4b2
push ecx
adc ch, byte [ebp - 0x24566368]
rcr byte [ecx], 0xef
inc edi
lea ecx, [eax + 0x54]
mov cs, word [ebx + 0x53031ab2]
push ebp
out dx, eax
sahf
stosb byte es:[edi], al
adc esp, dword [ecx]
cmc
out dx, al
pop ss
cmp al, 0x1e
pushfd
sub ch, byte [ebp + 2]
dec edi
out 0xf8, al
inc ecx
shl byte [eax], 0xa0
fimul word [ebx + 0x11c1f796]
mov byte [0x8715075f], al
dec ebx
stosb byte es:[edi], al
xlatb
nop
pop eax
les edi, [ecx]
jecxz 0x44e4d2
cwde
xchg edx, eax
imul esp, dword [esi + 0x18525622], 0xcfb6638
stc
and bh, byte [ebx - 0x67a4c92]
rcl dword [eax - 0x27ebf413]
leave
push eax
adc dword [ecx - 0x2a], ecx
ja 0x44e58d
idiv dword [edi + ecx*4 + 0x5982a26d]
in al, 0x86
dec ecx
adc eax, 0x99083554
push 0x487a41dd
mov bh, cl
stosb byte es:[edi], al
dec esi
mov word [0x7697bac6], ax
inc esi
cmp byte [edx], cl
fcomi st(2)
push ebp
test byte [edx + ecx*2], 9
sahf
in al, 0x61
fsubr st(3)
or dword [esi + 0x34c0a7a4], 0x49
clc
inc edi
sbb al, 0x93
pop ebx
rcr byte [eax], cl
fisttp word [edx + ebp*8 + 0x24]
leave
push edx
xor al, 0x24
adc al, 0x50
mov dh, 0x91
pop ecx
retf 0xfa82
retf

Function at 0x44f31d
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
dec dword [0x4a20f4]
jne 0x44f32e
call int.00446ebe
mov ecx, dword [0x4b75a4]
mov eax, dword [ecx]
add ecx, 4
mov dword [0x4b75a4], ecx
mov ecx, eax
shr ecx, 0xb
xor eax, ecx
mov edx, eax
and edx, 0xff3a58ad
shl edx, 7
xor eax, edx
mov ecx, eax
and ecx, 0xffffdf8c
shl ecx, 0xf
xor eax, ecx
mov edx, eax
shr edx, 0x12
xor edx, eax
mov dword [ebp - 4], edx
fild dword [ebp - 4]
jns 0x44f375
fadd qword [0x49c838]
fmul qword [0x49c848]
mov esp, ebp
pop ebp
ret

Function at 0x44f37f
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
dec dword [0x4a20f4]
jne 0x44f38c
call int.00446ebe
mov eax, dword [0x4b75a4]
mov ecx, dword [eax]
add eax, 4
mov dword [0x4b75a4], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov edx, ecx
and edx, 0xff3a58ad
shl edx, 7
xor ecx, edx
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
shr eax, 1
ret
Function at 0x45af82
Capabilities:
Encode data using xor

Disassembly:
or bl, byte [eax + 0x6a]
push edx
push edx
dec edi
sub eax, 0x2c22d062
bound ebx, qword [ebx + ecx*4]
pop ecx
mov eax, dword [0x191805fb]
dec edx
pop edi
mov esi, dword [ebp + 0x42]
std
sar al, 1
js 0x45af48
test byte [eax - 0x40], 0xca
sbb eax, ebp
mov dword [eax - 0x21cf1795], eax
and al, 0x46
mov dl, 0xdb
or dword [ebx - 0x4ad0de58], edi
fadd qword [edi - 0x1b]
movsb byte es:[edi], byte [esi]
shl dword [ecx - 0x1faa3b98], cl
insb byte es:[edi], dx
and byte [eax], al
pop es
and bl, byte [edx + 0x26]
pop esp
in al, dx
inc edi
xchg esi, eax
adc al, 0x9a
wait
pop ebx
sub al, 0xd7
daa
add dword [edi - 0x219b80cc], ecx
popf
mov ch, byte [edi + 0x5f]
dec edi
pop ebp
lodsb al, byte [esi]
add edx, dword [edx]
jl 0x45af23
mov eax, dword [0x8f44380f]
add eax, 0x339b5505
inc esp
pop dword [0x339b5505]
nop
aad 0xf2
xor ebx, esp
push ss
pop ss
xchg edx, eax
xor al, 0xc2
push ecx
adc byte [esi*2 + 0x1f00d250], al
xchg ecx, eax
push edx
adc al, 0xf9
xchg edi, eax
dec ebx
dec esp
in eax, 0xf8
xchg dword [edx + edx], ebx
jecxz 0x45af89
mov byte [0x83068101], al
sahf
dec ecx
cmpsb byte [esi], byte es:[edi]
xchg edi, eax
pushal
int1
push ss
jecxz 0x45b001
sbb al, 0xbc
cli
adc esp, ebx
test dword [ecx + 0xcdb0394], ecx
cmp byte [ecx], 0x82
invalid
and ebx, edx
sal dword [esi], 0x57
inc edi
invalid

Function at 0x45eafc
Capabilities:
Encode data using xor

Disassembly:
shr byte [esi], 0x6a
imul esp, dword [ebp - 0x69], 0x4b
cli
or eax, 0xda8910c
sub edi, ebp
pop ebp
fidiv dword [edi]
test eax, 0xec0b5729
sbb ch, 0x44
lahf
fcmovnb st(0), st(6)
adc esp, dword [edi + ebx*4 + 0xa]
mov byte [esi + 0xa], cl
nop
sub al, 0x2f
inc eax
sbb byte [ecx - 0x27], ah
in al, 0xc7
inc ebx
push 0xffffffffffffffd5
push edi
xchg esp, eax
xchg esi, eax
pop ss
mov al, 0x28
jnp 0x45eb4e
jo 0x45eadb
mov ecx, 0x5fcf1b30
pop ebx
rcl eax, 0xc9
pop ebp
jl 0x45eb6a
clc
stc
cmp edx, ebp
xor edi, dword [ebx]
xchg ecx, eax
jne 0x45ead1
mov esp, 0x8db54006
shr byte [ebx], 0x10
xchg byte [edi], dh
push esp
or dword [ebp + 0x60], esp
pushal
mov ch, cl
inc ecx
pop esp
cmp cl, byte [ecx]
mov byte [0xc62fb32e], al
cmpsb byte [esi], byte es:[edi]
daa
jb 0x45eb8b
sub dword [eax], edx
hlt
ret 0x1001
ret
Function at 0x1002f18
Capabilities:
Accept command line arguments
Query or enumerate registry value

Disassembly:
push ecx
cmp byte [0x40a034], 0
je 0x1002f79
cmp word [0x40a208], 0xd7b2
jne 0x1002f41
cmp dword [0x40a210], 0
jbe 0x1002f41
mov eax, 0x40a204
call dword [0x40a220]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x409060
push 0xfffffffffffffff5
call sym.imp.ADVAPI32.dll_RegQueryValueExA
push eax
call sym.imp.KERNEL32.dll_LoadLibraryA
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x402fa0
push 0xfffffffffffffff5
call sym.imp.ADVAPI32.dll_RegQueryValueExA
push eax
call sym.imp.KERNEL32.dll_LoadLibraryA
pop edx
ret
cmp byte [0x409024], 0
jne 0x1002f95
push 0
push 0x409058
push 0x409060
push 0
call sym.imp.KERNEL32.dll_GetCommandLineA
pop edx
ret

Function at 0x10035b8
Capabilities:
Set thread local storage value

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, edx
mov eax, dword [ebx]
test eax, eax
je 0x10035d0
mov dword [ebx], 0
push eax
call sym.imp.KERNEL32.dll_TlsSetValue
add ebx, 4
dec esi
jne 0x10035be
pop esi
pop ebx
ret
Function at 0x1007ed5
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x1009178]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0xc]
xor edi, edi
push eax
mov dword [ebp - 0xc], edi
call fcn.010029c8
test eax, eax
pop ecx
je 0x1007f0a
push edi
push edi
push edi
push edi
push edi
call fcn.0100461b
add esp, 0x14
push 4
pop eax
call fcn.01008140
mov dword [ebp - 0x14], esp
push 0x1c
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1008018
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x58]
dec esi
neg esi
sbb esi, esi
and esi, 0x103
inc esi
cmp dword [ebp - 0xc], 2
mov dword [ebp - 8], edi
jne 0x1007f91
push 0x10022f8
mov dword [ebp - 0x10], edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, edi
je 0x1007f91
push 0x1002234
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x1007f91
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 0x10], edi
call eax
cmp eax, 1
jne 0x1007f91
mov eax, dword [ebp - 0x10]
cmp eax, edi
jbe 0x1007f91
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
lea edi, [ebx - 1]
push edi
push dword [ebp - 8]
call 0x1003126
add esp, 0xc
test eax, eax
jl 0x1008018
not edi
and dword [ebp - 8], edi
je 0x1007fc3
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp - 8]
call 0x1003126
add esp, 0xc
test eax, eax
jl 0x1008018
lea eax, [ebx + ebx]
cmp dword [ebp - 8], eax
jae 0x1007fce
mov dword [ebp - 8], eax
lea edi, [ebx - 1]
not edi
and edi, dword [ebp - 0x14]
sub edi, dword [ebp - 8]
cmp dword [ebp - 0xc], 1
jne 0x1007fe2
push 0x11
pop ebx
mov eax, dword [ebp - 0x18]
add ebx, eax
cmp edi, ebx
jb 0x1008018
push 4
push 0x1000
push dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0x1008018
lea eax, [ebp - 0x1c]
push eax
push esi
push dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1008018
xor eax, eax
inc eax
jmp 0x100801a
xor eax, eax
lea esp, [ebp - 0x68]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01002856
leave
ret
Function at 0x402090
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4020a9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4020e4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x4020e0
lea ebx, [ebx]
cmp esi, eax
jae 0x4020e4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4020d0
cmp esi, eax
jb 0x4020ea
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x402d10
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x18
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x402d20
sub eax, edx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x20]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x402d36
push ebp
sub eax, edx
mov ebp, eax
lea eax, [esp + 0x10]
push eax
push 0
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x402e88
mov edx, dword [esp + 0x10]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
push esi
push edi
lea ecx, [esp + 0x10]
push ecx
push str..UCIP
push edx
call ebx
test eax, eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x402da3
mov eax, dword [esp + 0x10]
push 0xd
push str.YingUnInstall
push 1
push 0
push 0
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call edi
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x10]
push edx
push str.YingUnInstall
push eax
call ebx
test eax, eax
jne 0x402e7e
mov ecx, dword [esp + 0x10]
push 0xe
push str.Uninstall_File
push 1
push eax
push eax
push ecx
call esi
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push str.DefaultIcon
push eax
call ebx
test eax, eax
jne 0x402dfb
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x14]
push ebp
push ecx
push 1
push eax
push eax
push edx
call esi
mov eax, dword [esp + 0x14]
push eax
call edi
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push str.Shell
push edx
call ebx
test eax, eax
jne 0x402e77
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
push str.Open
push ecx
call ebx
test eax, eax
jne 0x402e70
mov edx, dword [esp + 0x18]
push eax
push 0x469780
push 1
push eax
push eax
push edx
call esi
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x20]
push eax
push str.Command
push ecx
call ebx
test eax, eax
jne 0x402e69
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x20]
push edx
push eax
push 2
push 0
push 0
push ecx
call esi
mov edx, dword [esp + 0x20]
push edx
call edi
mov eax, dword [esp + 0x18]
push eax
call edi
mov ecx, dword [esp + 0x14]
push ecx
call edi
mov edx, dword [esp + 0x10]
push edx
call edi
mov eax, dword [esp + 0x1c]
push eax
call edi
pop edi
pop esi
pop ebx
pop ebp
add esp, 0x18
ret
Function at 0x402e90
Capabilities:
Check os version

Disassembly:
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x402f3a
push 0x94
mov edi, 1
call fcn.00447521
mov esi, eax
add esp, 4
test esi, esi
je 0x402faf
push 0x94
push 0
push esi
call fcn.004475f0
add esp, 0xc
push esi
mov dword [esi], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esi + 4]
cmp eax, 4
jne 0x402ef7
push esi
mov edi, 5
call fcn.00447444
add esp, 4
mov eax, edi
pop edi
pop esi
ret
cmp eax, 5
jne 0x402fa6
cmp dword [esi + 8], 0
jne 0x402f19
push esi
mov edi, 6
call fcn.00447444
add esp, 4
mov eax, edi
pop edi
pop esi
ret
cmp eax, 5
jne 0x402fa6
cmp dword [esi + 8], edi
jne 0x402fa6
push esi
mov edi, 7
call fcn.00447444
add esp, 4
mov eax, edi
pop edi
pop esi
ret
cmp al, 4
jae 0x402f43
pop edi
xor eax, eax
pop esi
ret
push 0x94
mov edi, 2
call fcn.00447521
mov esi, eax
add esp, 4
test esi, esi
je 0x402faf
push 0x94
push 0
push esi
call fcn.004475f0
add esp, 0xc
push esi
mov dword [esi], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esi + 4]
cmp eax, 4
jne 0x402fa6
cmp dword [esi + 8], 0xa
jne 0x402f99
push esi
mov edi, 3
call fcn.00447444
add esp, 4
mov eax, edi
pop edi
pop esi
ret
cmp eax, 4
jne 0x402fa6
cmp dword [esi + 8], 0x5a
jne 0x402fa6
mov edi, eax
push esi
call fcn.00447444
add esp, 4
mov eax, edi
pop edi
pop esi
ret

Function at 0x402fc0
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x84
push ebx
push esi
push edi
lea eax, [esp + 0x28]
push eax
push 0x64
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
cmp byte [esp + 0x28], 0
mov edi, dword [ebp + 0x10]
mov dword [edi], 0
lea esi, [esp + 0x28]
je 0x403089
mov ebx, dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
je 0x40300f
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
jne 0x403065
movsx ecx, byte [esi]
push ecx
call fcn.0044741d
add esp, 4
cmp eax, 0x41
je 0x403065
movsx edx, byte [esi]
push edx
call fcn.0044741d
mov ecx, dword [edi]
mov edx, dword [ebp + 8]
add esp, 4
mov byte [edx + ecx], al
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x28]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov eax, dword [edi]
shrd ecx, edx, 0x14
shr edx, 0x14
mov dword [ebx + eax*8], ecx
mov dword [ebx + eax*8 + 4], edx
add dword [edi], 1
mov eax, esi
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x403070
sub eax, edx
cmp byte [esi + eax + 1], cl
lea esi, [esi + eax + 1]
jne 0x402ff7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403980
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x461078
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
push edi
lea ecx, [esp + 8]
call fcn.0042c46b
push 0
push 0
push 0
push str.DISPLAY
mov dword [esp + 0x30], 0
call dword [sym.imp.GDI32.dll_CreateICA]
push eax
lea ecx, [esp + 0xc]
call fcn.0042c96b
mov eax, dword [esp + 0x10]
mov edi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x58
push eax
call edi
mov ecx, dword [esp + 0x10]
push 0x5a
push ecx
mov esi, eax
call edi
cmp esi, 0x60
mov edi, eax
jne 0x403a0f
cmp edi, esi
jne 0x403a3c
lea ecx, [esp + 8]
mov dword [esp + 0x20], 0xffffffff
call fcn.0042c9cf
pop edi
mov eax, esi
pop esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret
cmp esi, 0x78
jne 0x403a3c
cmp edi, esi
jne 0x403a3c
lea ecx, [esp + 8]
mov dword [esp + 0x20], 0xffffffff
call fcn.0042c9cf
pop edi
mov eax, esi
pop esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret
lea ecx, [esp + 8]
mov dword [esp + 0x20], 0xffffffff
call fcn.0042c9cf
mov ecx, dword [esp + 0x18]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret

Function at 0x403a60
Capabilities:
Create process on windows
Set current directory

Disassembly:
push 0xffffffffffffffff
push 0x461098
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x258
push esi
sub esp, 0xc
lea eax, [esp + 0x278]
mov ecx, esp
mov dword [esp + 0x10], esp
push eax
mov dword [esp + 0x274], 0
call fcn.00422580
lea ecx, [esp + 0x24]
push ecx
call fcn.004035a0
mov eax, dword [eax + 4]
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea ecx, [esp + 0x18]
call fcn.00422390
mov edx, dword [esp + 0x270]
push edx
lea eax, [esp + 0x6c]
push 0x1f4
push eax
call fcn.0044722f
push 0x44
lea ecx, [esp + 0x34]
push 0
push ecx
call fcn.004475f0
mov dx, word [esp + 0x290]
add esp, 0x18
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x28]
push ecx
push 0
push 0
push 0x20
push 1
push 0
mov word [esp + 0x70], dx
push 0
lea edx, [esp + 0x88]
push edx
push 0
mov dword [esp + 0x4c], 0x44
mov dword [esp + 0x78], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x403b70
push eax
push str.Error
push str.Create_process_failed
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x26c]
mov dword [esp + 0x264], 0xffffffff
call fcn.00422390
mov eax, 0xbeb95
mov ecx, dword [esp + 0x25c]
mov dword fs:[0], ecx
pop esi
add esp, 0x264
ret
mov eax, dword [esp + 8]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 8]
lea ecx, [esp + 4]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov esi, dword [esp + 4]
lea ecx, [esp + 0x26c]
mov dword [esp + 0x264], 0xffffffff
call fcn.00422390
mov ecx, dword [esp + 0x25c]
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0x264
ret
Function at 0x403bc0
Capabilities:
Create directory

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4610b8
push eax
mov dword fs:[0], esp
sub esp, 0x708
push ebx
mov eax, dword [esp + 0x720]
push eax
lea ecx, [esp + 0x51c]
push 0x1f4
push ecx
call fcn.0044722f
lea edx, [esp + 0x524]
push edx
lea eax, [esp + 0x334]
push 0x1f4
push eax
call fcn.0044722f
lea eax, [esp + 0x33c]
add esp, 0x18
lea edx, [eax + 1]
xor ebx, ebx
nop
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x403c20
sub eax, edx
cmp eax, 4
jge 0x403c5d
lea ecx, [esp + 0x71c]
mov dword [esp + 0x714], 0xffffffff
call fcn.00422390
pop ebx
mov ecx, dword [esp + 0x708]
mov dword fs:[0], ecx
add esp, 0x714
ret
mov cx, word [esp + 0x324]
mov dl, byte [esp + 0x326]
push ebp
push esi
push 0x469780
lea eax, [esp + 0x10]
push 0x12c
push eax
mov word [esp + 0x144], cx
mov byte [esp + 0x146], dl
mov byte [esp + 0x147], bl
xor esi, esi
call fcn.0044722f
mov ebp, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
add esp, 0xc
cmp byte [esp + 0x32f], bl
je 0x403d14
push edi
lea edi, [esp + 0x333]
mov al, byte [edi]
cmp al, 0x5c
jne 0x403d05
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x140]
push 0x1f4
push edx
mov byte [esp + esi + 0x1c], bl
call fcn.00447294
add esp, 0xc
push ebx
lea eax, [esp + 0x140]
push eax
call ebp
push 0x469a68
lea ecx, [esp + 0x140]
push 0x1f4
push ecx
call fcn.00447294
add esp, 0xc
xor esi, esi
mov byte [esp + 0x10], bl
jmp 0x403d0c
mov byte [esp + esi + 0x10], al
add esi, 1
add edi, 1
cmp byte [edi], bl
jne 0x403cb4
pop edi
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x13c]
push 0x1f4
push eax
mov byte [esp + esi + 0x18], bl
call fcn.00447294
add esp, 0xc
push ebx
lea ecx, [esp + 0x13c]
push ecx
call ebp
lea ecx, [esp + 0x724]
mov dword [esp + 0x71c], 0xffffffff
call fcn.00422390
mov ecx, dword [esp + 0x714]
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x714
ret
Function at 0x403da0
Capabilities:
Set registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4610d8
push eax
mov dword fs:[0], esp
sub esp, 0x904
mov eax, dword [esp + 0x918]
push eax
lea ecx, [esp + 0x714]
push 0x1f4
push ecx
call fcn.0044722f
push 0x469cb4
lea edx, [esp + 0x720]
push edx
lea eax, [esp + 0x14]
push eax
call fcn.00447d79
add esp, 0x18
test eax, eax
jne 0x403f9f
mov ecx, dword [esp]
push ecx
lea edx, [esp + 0xc]
push 0x1e0
push edx
call fcn.00447b2e
mov eax, dword [esp + 0xc]
push eax
call fcn.00447aff
add esp, 0x10
test eax, eax
jne 0x403f93
push ebx
push ebp
push esi
lea esi, [esp + 0x14]
sub esi, 2
mov dword [esp + 0x10], esi
mov ebp, dword [esp + 0x10]
push edi
xor ebx, ebx
jmp 0x403e44
mov esi, dword [esp + 0x14]
lea eax, [esp + 0x18]
lea edx, [eax + 1]
jmp 0x403e50
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x403e50
sub eax, edx
mov byte [esi + eax], bl
mov edi, 0x469780
lea esi, [esp + 0x18]
mov ecx, 1
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x403f66
cmp byte [esp + 0x18], 0x5b
jne 0x403e91
lea eax, [esp + 0x18]
push eax
call fcn.004032f0
add esp, 4
mov ebp, eax
jmp 0x403f66
cmp byte [esp + 0x19], 0x22
mov esi, 1
je 0x403eaa
lea ecx, [ecx]
add esi, 1
cmp byte [esp + esi + 0x18], 0x22
jne 0x403ea0
lea ecx, [esi - 1]
push ecx
lea edx, [esp + 0x1d]
push edx
lea eax, [esp + 0x408]
push eax
call fcn.00447670
lea eax, [esp + 0x24]
add esp, 0xc
mov byte [esp + esi + 0x3ff], bl
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x403ed1
sub eax, edx
sub eax, esi
sub eax, 4
push eax
lea ecx, [esp + esi + 0x1f]
push ecx
lea edx, [esp + 0x214]
push edx
call fcn.00447670
lea eax, [esp + 0x24]
add esp, 0xc
lea ecx, [eax + 1]
mov edi, edi
mov dl, byte [eax]
add eax, 1
cmp dl, bl
jne 0x403f00
sub eax, ecx
sub eax, esi
mov byte [esp + eax + 0x208], bl
lea eax, [esp + 0x20c]
push eax
push 0x469cb0
lea ecx, [esp + 0x5fc]
push 0x12c
push ecx
call fcn.00447ac4
lea eax, [esp + 0x21c]
add esp, 0x10
lea ecx, [eax + 1]
mov dl, byte [eax]
add eax, 1
cmp dl, bl
jne 0x403f40
sub eax, ecx
push eax
lea edx, [esp + 0x5f8]
push edx
push 1
push ebx
lea eax, [esp + 0x410]
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push 0x1e0
push edx
call fcn.00447b2e
mov eax, dword [esp + 0x1c]
push eax
call fcn.00447aff
add esp, 0x10
test eax, eax
je 0x403e40
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp]
push ecx
call fcn.00447a48
add esp, 4
lea ecx, [esp + 0x914]
mov dword [esp + 0x90c], 0xffffffff
call fcn.00422390
mov ecx, dword [esp + 0x904]
mov dword fs:[0], ecx
add esp, 0x910
ret
Function at 0x404ae0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x461291
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
mov dword [esp + 4], 0
sub esp, 0xc
lea eax, [esp + 0x44]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
mov dword [esp + 0x3c], 1
call fcn.00422580
lea ecx, [esp + 0x18]
push ecx
call fcn.00403690
add esp, 0x10
push 0x4934e8
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 2
call fcn.00422a10
sub esp, 0xc
lea edx, [esp + 0x44]
mov ecx, esp
mov dword [esp + 0x14], esp
push edx
call fcn.00422580
lea eax, [esp + 0x24]
push eax
call fcn.00403750
add esp, 0x10
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 3
call fcn.00422a10
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c], 2
call fcn.00422390
sub esp, 0xc
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x14], esp
push edx
call fcn.00422580
mov esi, dword [esp + 0x40]
push esi
call fcn.004042f0
add esp, 0x10
lea ecx, [esp + 0xc]
mov dword [esp + 4], 1
mov byte [esp + 0x2c], 1
call fcn.00422390
lea ecx, [esp + 0x38]
mov byte [esp + 0x2c], 0
call fcn.00422390
mov ecx, dword [esp + 0x24]
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0x2c
ret
Function at 0x40bb10
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x46246b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
push edi
push 0x20
call fcn.0042a536
add esp, 4
mov dword [esp + 0x10], eax
xor edi, edi
cmp eax, edi
mov dword [esp + 0x28], edi
je 0x40bb4f
mov ecx, eax
call fcn.00422eb0
mov esi, eax
jmp 0x40bb51
xor esi, esi
push esi
push 9
push 1
sub esp, 0xc
mov eax, esp
mov dword [esp + 0x28], esp
push 0x16
push eax
mov dword [esp + 0x48], 0xffffffff
call fcn.0040d380
add esp, 8
mov ecx, 0x493500
call fcn.0041a6a0
xor ebx, ebx
cmp dword [esi + 0x1c], edi
jle 0x40bbd6
mov ebp, dword [sym.imp.KERNEL32.dll_WinExec]
lea esp, [esp]
test edi, edi
push 5
jl 0x40bbf3
cmp ebx, dword [esi + 0x10]
jge 0x40bbf3
mov eax, dword [esi + 0xc]
sub esp, 0xc
add eax, edi
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.00422580
lea ecx, [esp + 0x24]
push ecx
call fcn.004042f0
mov edx, dword [eax + 4]
add esp, 0x10
push edx
call ebp
lea ecx, [esp + 0x14]
call fcn.00422390
add ebx, 1
add edi, 0xc
cmp ebx, dword [esi + 0x1c]
jl 0x40bb90
mov eax, dword [esi]
mov edx, dword [eax]
push 1
mov ecx, esi
call edx
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x1c
ret
jmp fcn.0042bba0