joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b270
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
push 4
mov esi, dword [edi]
movzx eax, byte [esi + 0x286]
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push 1
push 6
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x41b2bb
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
call fcn.0041deb0
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.0041a550
add esp, 0x14
pop edi
pop esi
pop ebp
ret
push str.TCP_NODELAY_set_n
push esi
call fcn.0041a550
add esp, 8
pop edi
pop esi
pop ebp
ret

Function at 0x41d120
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov cl, byte [ebp + 8]
movsx eax, cl
add eax, 0xffffff9f
cmp eax, 0x19
ja case.default.0x41d131
jmp dword [eax*4 + 0x41d1a4]
mov al, 0x41
pop ebp
ret
mov al, 0x42
pop ebp
ret
mov al, 0x43
pop ebp
ret
mov al, 0x44
pop ebp
ret
mov al, 0x45
pop ebp
ret
mov al, 0x46
pop ebp
ret
mov al, 0x47
pop ebp
ret
mov al, 0x48
pop ebp
ret
mov al, 0x49
pop ebp
ret
mov al, 0x4a
pop ebp
ret
mov al, 0x4b
pop ebp
ret
mov al, 0x4c
pop ebp
ret
mov al, 0x4d
pop ebp
ret
mov al, 0x4e
pop ebp
ret
mov al, 0x4f
pop ebp
ret
mov al, 0x50
pop ebp
ret
mov al, 0x51
pop ebp
ret
mov al, 0x52
pop ebp
ret
mov al, 0x53
pop ebp
ret
mov al, 0x54
pop ebp
ret
mov al, 0x55
pop ebp
ret
mov al, 0x56
pop ebp
ret
mov al, 0x57
pop ebp
ret
mov al, 0x58
pop ebp
ret
mov al, 0x59
pop ebp
ret
mov al, 0x5a
pop ebp
ret
mov al, cl
pop ebp
ret

Function at 0x41d700
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
lea eax, [ebp - 4]
push eax
push esi
push 2
call fcn.00425220
add esp, 0xc
test eax, eax
jle 0x41d745
push dword [ebp + 0x10]
lea eax, [ebp - 4]
push esi
push eax
push 2
call fcn.0041d560
add esp, 0x10
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [ebp + 0x10]
push 0
push ebx
push esi
push edi
call fcn.0041db90
add esp, 0x10
test al, al
je 0x41d76c
mov eax, dword [ebp + 0x14]
pop ebx
pop edi
pop esi
mov dword [eax], 1
xor eax, eax
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
call fcn.0041deb0
push eax
push esi
push str.init_resolve_thread___failed_for__s___s_n
push dword [ebp + 8]
call fcn.0041a550
add esp, 0x18
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x41d7bf
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
call fcn.0041deb0
push eax
push ebx
push esi
push str.gethostbyname_2__failed_for__s:_d___s_n
push dword [ebp + 8]
call fcn.0041a550
add esp, 0x1c
xor eax, eax
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push eax
call fcn.0041d430
add esp, 8
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41d870
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
mov eax, dword [ebx]
mov esi, dword [ebx + 0x2d0]
mov dword [ebp - 4], esi
mov dword [ebp + 8], eax
mov ecx, dword [eax + 0x174]
test ecx, ecx
jne 0x41d8a1
mov eax, dword [eax + 0x170]
mov ecx, 0x493e0
test eax, eax
cmovne ecx, eax
push edi
push ecx
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi + 0x10]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [esi + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov eax, dword [ebp - 4]
push dword [eax + 0x14]
mov dword [eax + 0x10], 0
call esi
mov esi, dword [ebp - 4]
mov dword [esi + 0x14], 0
test edi, edi
jne 0x41d8fc
push 0x1388
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x41d94e
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
lea edi, [esi + 8]
mov byte [ebx + 0x2c8], 1
mov dword [edi], 0xffffffff
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x41d91b
mov eax, dword [ebx + 0x2c4]
mov dword [ecx], eax
xor esi, esi
cmp dword [ebx + 0x2c4], esi
jne 0x41d9f3
mov eax, dword [edi]
cmp eax, 0x1b
jne 0x41d968
push eax
mov esi, eax
call fcn.0041df90
push eax
push str.Could_not_resolve_host:__s
push dword [ebp + 8]
call fcn.0041a4b0
add esp, 0x10
jmp 0x41d9f3
push dword [ebx + 0x2cc]
call dword [sym.imp.WS2_32.dll_WSASetLastError]
lea edi, [esi + 8]
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
jmp 0x41d90c
cmp byte [ebx + 0x2c8], 0
je 0x41d9c7
cmp byte [ebx + 0x12b], 0
push dword [ebx + 0x2cc]
push ebx
je 0x41d9a4
call fcn.0041deb0
push eax
push dword [ebx + 0xa0]
push str.Could_not_resolve_proxy:__s___s
push dword [ebp + 8]
call fcn.0041a4b0
add esp, 0x18
mov esi, 5
jmp 0x41d9f3
call fcn.0041deb0
push eax
push dword [ebx + 0x8c]
push str.Could_not_resolve_host:__s___s
push dword [ebp + 8]
call fcn.0041a4b0
add esp, 0x18
mov esi, 6
jmp 0x41d9f3
cmp eax, 0xffffffff
je 0x41d9d8
cmp dword [ebx + 0x2cc], 0x2afc
jne 0x41d9ee
push dword [ebx + 0x8c]
push str.Resolving_host_timed_out:__s
push dword [ebp + 8]
call fcn.0041a4b0
add esp, 0xc
mov esi, 0x1c
lea ecx, [ebx + 0x2bc]
push ecx
call fcn.0041d630
add esp, 4
mov eax, esi
cmp dword [ebx + 0x2c4], 0
pop edi
jne 0x41da15
mov byte [ebx + 0x128], 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41db90
Capabilities:
Create tcp socket
Create thread
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push 1
push 0x24
call dword [0x49a010]
mov esi, eax
mov dword [ebp - 8], 0
add esp, 8
mov dword [ebp - 4], 0
test esi, esi
jne 0x41dbc7
push 0xc
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [ebp + 8]
push edi
push dword [ebx + 0x2bc]
lea edi, [ebx + 0x2bc]
call fcn.004165e0
push dword [ebp + 0xc]
call dword [0x49a00c]
add esp, 8
mov dword [edi], eax
test eax, eax
jne 0x41dc0a
push esi
call dword [0x49a004]
add esp, 4
push 0xc
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop ebx
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x10]
push 0
push 1
mov dword [ebx + 0x2c0], eax
mov byte [ebx + 0x2c8], 0
mov dword [ebx + 0x2cc], 0
mov dword [ebx + 0x2c4], 0
mov dword [ebx + 0x2d0], esi
push 0
mov dword [esi + 0xc], 0xffffffff
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 0x10], eax
test eax, eax
je 0x41dca0
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x14], eax
test eax, eax
je 0x41dca0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 0x1c], eax
test eax, eax
je 0x41dca0
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x20], eax
test eax, eax
je 0x41dca0
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x18], eax
test eax, eax
jne 0x41dcba
push edi
call fcn.0041d630
add esp, 4
push 0xb
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop ebx
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [esi + 4]
push eax
push 0
push ebx
push 0x41dac0
push 0
push 0
call fcn.0042ec2b
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x41dcf7
call fcn.004394e1
push dword [eax]
call dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
call fcn.0041d630
add esp, 4
xor al, al
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
mov dword [ebp - 8], eax
mov eax, dword [esi + 0x18]
push 0xffffffffffffffff
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push 0
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push 0
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
pop edi
mov dword [esi + 0xc], eax
mov al, 1
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x422930
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x49a02c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call fcn.0043c94b
add esp, 4
mov byte [ebp - 0x108], 0
test eax, eax
je 0x422994
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp byte [ebp - 0x108], 0
je 0x422994
lea eax, [ebp - 0x108]
push eax
call dword [0x49a00c]
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004261a3
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.004261a3
mov esp, ebp
pop ebp
ret

Function at 0x4229b0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00422930

Function at 0x425de0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret
Function at 0x443a79
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004438f8

Function at 0x447ba9
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00447869

Function at 0x44fbf8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, edx
mov dword [ebp - 4], ecx
mov esi, dword [edi]
test esi, esi
jne 0x44fc11
xor eax, eax
jmp 0x44fc59
and dword [edi], 0
mov edx, 0x400000
and dword [ebp + 8], 0
lea eax, [ebp + 8]
push 0
push eax
cmp esi, edx
mov eax, esi
cmova eax, edx
push eax
push ebx
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp + 8]
add ebx, ecx
add dword [edi], ecx
sub esi, ecx
test eax, eax
je 0x44fc53
test ecx, ecx
je 0x44fc0d
mov ecx, dword [ebp - 4]
mov edx, 0x400000
test esi, esi
jne 0x44fc19
jmp 0x44fc0d
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44fc60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, edx
mov dword [ebp - 4], ecx
mov esi, dword [edi]
test esi, esi
jne 0x44fc79
xor eax, eax
jmp 0x44fcc1
and dword [edi], 0
mov edx, 0x400000
and dword [ebp + 8], 0
lea eax, [ebp + 8]
push 0
push eax
cmp esi, edx
mov eax, esi
cmova eax, edx
push eax
push ebx
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp + 8]
add ebx, ecx
add dword [edi], ecx
sub esi, ecx
test eax, eax
je 0x44fcbb
test ecx, ecx
je 0x44fc75
mov ecx, dword [ebp - 4]
mov edx, 0x400000
test esi, esi
jne 0x44fc81
jmp 0x44fc75
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x452f9d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
and dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
jne 0x452fb6
mov eax, dword [ebp - 4]
jmp 0x453090
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
shr ecx, 3
xor eax, 0xffffffff
test ecx, ecx
je 0x45306b
push ebp
mov ebp, ecx
xor edx, edx
xor ecx, ecx
nop
mov ebx, dword [esi]
add esi, 4
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x485500]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x485500]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x485500]
mov cl, bh
xor eax, edi
mov ebx, dword [esi]
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x485500]
add esi, 4
xor eax, edi
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x485500]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x485500]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x485500]
mov cl, bh
xor eax, edi
xor cl, al
shr eax, 8
xor eax, dword [ecx*4 + 0x485500]
dec ebp
jne 0x452fd5
pop ebp
mov ecx, dword [ebp + 0x10]
xor edx, edx
and ecx, 7
je 0x453087
mov dl, byte [esi]
inc esi
xor dl, al
shr eax, 8
xor eax, dword [edx*4 + 0x485500]
dec ecx
jne 0x453075
xor eax, 0xffffffff
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x453910
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret

Function at 0x4570d0
Capabilities:
Create thread

Disassembly:
push 0x10
mov eax, 0x471004
call fcn.0044f632
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x4570ed
mov eax, 0x80070057
jmp 0x45719f
mov esi, dword [ebp + 8]
lea eax, [esi + 0x40]
push eax
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 0x18], 1
and dword [ebp - 4], 0
lea eax, [ebp + 0xc]
lea ebx, [esi + 0x58]
push eax
mov ecx, ebx
call fcn.00403da7
test eax, eax
jne 0x457139
mov byte [ebp - 0x10], al
mov ecx, ebx
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], edi
push eax
call fcn.004058ef
push eax
add eax, 0x10
push eax
push ecx
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.0040591d
lea ebx, [esi + 4]
push ebx
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 0x10], 1
mov byte [ebp - 4], 1
cmp dword [esi + 0x1c], 0
jne 0x457185
push 0
push 0
push esi
push 0x457037
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x1c], eax
test eax, eax
jne 0x457185
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
jmp 0x457187
xor edi, edi
mov byte [ebp - 4], 0
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push ebx
call esi
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x1c]
call esi
mov eax, edi
call fcn.0044f60c
ret 8
Function at 0x457416
Capabilities:
Acquire debug privileges

Disassembly:
push 0x2c
push 0x494120
call fcn.0044f8d0
xor esi, esi
mov ebx, esi
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x2c], esi
xor eax, eax
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 4], esi
lea eax, [ebp - 0x30]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x45749d
lea eax, [ebp - 0x3c]
push eax
push str.SeDebugPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x45749d
xor edi, edi
inc edi
mov dword [ebp - 0x2c], edi
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 2
push esi
push esi
push esi
lea eax, [ebp - 0x2c]
push eax
push esi
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
cmovne ebx, edi
mov dword [ebp - 0x34], ebx
mov dword [ebp - 4], 0xfffffffe
call fcn.004574b6
mov eax, ebx
call fcn.0044f919
ret

Function at 0x457763
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x14], ebx
jne 0x4577e1
push 0x487b80
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edi + 0x18], eax
test eax, eax
je 0x4577e1
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.EnumProcessModules
push eax
call esi
push str.EnumProcesses
push dword [edi + 0x18]
mov dword [edi + 8], eax
call esi
push str.GetModuleBaseNameW
push dword [edi + 0x18]
mov dword [edi], eax
call esi
push 0x487bcc
push dword [edi + 0x18]
mov dword [edi + 4], eax
call esi
push str.GetProcessImageFileNameW
push dword [edi + 0x18]
mov dword [edi + 0xc], eax
call esi
mov dword [edi + 0x10], eax
pop esi
cmp dword [edi], ebx
je 0x4577de
cmp dword [edi + 4], ebx
je 0x4577de
cmp dword [edi + 8], ebx
je 0x4577de
cmp dword [edi + 0xc], ebx
je 0x4577de
test eax, eax
je 0x4577de
inc ebx
mov dword [edi + 0x14], ebx
mov eax, dword [edi + 0x14]
pop edi
pop ebx
ret
Function at 0x457d4b
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x49a02c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, edx
push edi
test esi, esi
je 0x457e2c
and dword [ebp - 0x210], 0
lea eax, [ebp - 0x20c]
mov edi, 0x208
push edi
push 0
push eax
call fcn.0042ac90
add esp, 0xc
mov dword [ebp - 0x214], edi
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x210]
push eax
push str.ProgramPath
push str.SOFTWAREMiniLiebao
push reloc.WS2_32.dll_bind
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x457e2c
cmp dword [ebp - 0x210], 1
jne 0x457e2c
mov eax, dword [ebp - 0x214]
cmp eax, 2
jb 0x457e2c
and eax, 0xfffffffe
cmp eax, edi
jae 0x457e3e
xor ecx, ecx
mov word [ebp + eax - 0x20c], cx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x457e2c
lea eax, [ebp - 0x20c]
push eax
call fcn.004394f4
inc eax
mov edx, 0x104
pop ecx
cmp eax, edx
ja 0x457e2c
lea ecx, [ebp - 0x20c]
push ecx
push edx
push esi
call fcn.00439e3c
xor eax, eax
add esp, 0xc
inc eax
jmp 0x457e2e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004261a3
mov esp, ebp
pop ebp
ret
call fcn.004265c5
int3
Function at 0x457eaf
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x49a02c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esi], edi
mov dword [esi + 0x18], 3
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
call fcn.00457e6d
push 0x118
mov byte [esi + 0x20], al
lea eax, [ebp - 0x11c]
push edi
push eax
mov dword [ebp - 0x120], 0x11c
call fcn.0042ac90
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp - 0x114]
mov edx, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x118]
push 6
pop ebx
push 5
mov dword [esi + 0xc], eax
pop eax
mov dword [esi + 4], edx
mov dword [esi + 8], ecx
cmp edx, eax
jne 0x457f44
test ecx, ecx
jle 0x457f65
xor eax, eax
cmp ecx, 1
setne al
inc eax
mov dword [esi], eax
jmp 0x457f65
cmp edx, ebx
jne 0x457f61
sub ecx, edi
je 0x457f59
sub ecx, 1
jne 0x457f40
mov dword [esi], 4
jmp 0x457f65
mov dword [esi], 3
jmp 0x457f65
jle 0x457f65
mov dword [esi], ebx
movzx eax, word [ebp - 0xc]
lea edi, [ebp - 0x144]
push 9
mov dword [esi + 0x10], eax
movzx eax, word [ebp - 0xa]
pop ecx
mov dword [esi + 0x14], eax
xor eax, eax
push str.GetNativeSystemInfo
rep stosd dword es:[edi], eax
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x457faa
lea eax, [ebp - 0x144]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
jmp 0x457fb3
lea ecx, [ebp - 0x144]
push ecx
call eax
movzx eax, word [ebp - 0x144]
test eax, eax
je 0x457fd9
cmp eax, ebx
je 0x457fd0
cmp eax, 9
jne 0x457fdd
mov dword [esi + 0x18], 1
jmp 0x457fdd
mov dword [esi + 0x18], 2
jmp 0x457fdd
and dword [esi + 0x18], 0
mov ecx, dword [ebp - 0x130]
mov eax, esi
mov dword [esi + 0x1c], ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004261a3
mov esp, ebp
pop ebp
ret
Function at 0x4585ee
Capabilities:
Create process on windows

Disassembly:
push 0x58
mov eax, 0x4712e7
call fcn.0044f632
mov esi, edx
mov edi, ecx
push 0x40
xor ebx, ebx
lea eax, [ebp - 0x60]
push ebx
push eax
call fcn.0042ac90
add esp, 0xc
mov dword [ebp - 0x64], 0x44
xorps xmm0, xmm0
mov dword [ebp - 0x38], 1
lea ecx, [ebp - 0x10]
movups xmmword [ebp - 0x20], xmm0
push 0x49ccf0
call fcn.00406102
and dword [ebp - 4], ebx
lea eax, [ebp - 0x10]
push esi
push edi
push str.__s___s
push eax
call fcn.00406873
add esp, 0x10
mov esi, dword [ebp - 0x10]
xor eax, eax
mov word [ebp - 0x34], ax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x64]
push eax
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x458680
cmp dword [ebp + 8], ebx
je 0x45867d
push dword [ebp + 8]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor ebx, ebx
inc ebx
cmp dword [ebp - 0x20], 0
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x458695
push dword [ebp - 0x20]
call edi
and dword [ebp - 0x20], 0
cmp dword [ebp - 0x1c], 0
je 0x4586a4
push dword [ebp - 0x1c]
call edi
and dword [ebp - 0x1c], 0
lea ecx, [esi - 0x10]
call fcn.0040630c
mov eax, ebx
call fcn.0044f60c
ret

Function at 0x4586b4
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x49a02c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
lea eax, [ebp - 0x11c]
xor ebx, ebx
push eax
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], ebx
push eax
push 1
push ebx
push ebx
mov edi, ecx
mov dword [ebp - 0x11c], ebx
call dword [sym.imp.WTSAPI32.dll_WTSEnumerateSessionsW]
test eax, eax
jne 0x45873c
push 0x110
lea eax, [ebp - 0x114]
push ebx
push eax
call fcn.0042ac90
add esp, 0xc
mov dword [ebp - 0x118], 0x114
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x458736
cmp dword [ebp - 0x114], 6
jne 0x458736
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x45877b
mov dword [edi], ebx
xor eax, eax
jmp 0x45877b
mov ecx, dword [ebp - 0x120]
mov eax, ebx
push esi
mov esi, 0x490
cmp dword [ebp - 0x11c], eax
jbe 0x458771
lea edx, [ecx + 8]
cmp dword [edx], ebx
je 0x458767
inc eax
add edx, 0xc
cmp eax, dword [ebp - 0x11c]
jb 0x458755
jmp 0x458771
imul eax, eax, 0xc
mov esi, ebx
mov eax, dword [eax + ecx]
mov dword [edi], eax
push ecx
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.004261a3
mov esp, ebp
pop ebp
ret
Function at 0x4587d6
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x49a02c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
xor ebx, ebx
mov dword [ebp - 0x238], ecx
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
jne 0x45880e
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4588d8
push esi
push 0x228
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x234], ebx
push ebx
push eax
mov esi, 0x490
call fcn.0042ac90
add esp, 0xc
mov dword [ebp - 0x230], 0x22c
lea eax, [ebp - 0x230]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x45888c
lea eax, [ebp - 0x20c]
push str.explorer.exe
push eax
call fcn.004399d2
pop ecx
pop ecx
test eax, eax
je 0x45887c
lea eax, [ebp - 0x230]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x458851
jmp 0x458890
mov eax, dword [ebp - 0x228]
xor esi, esi
mov dword [ebp - 0x234], eax
jmp 0x458890
call ebx
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x234]
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x4588b4
call ebx
jmp 0x4588d7
push dword [ebp - 0x238]
push 0xf01ff
push edi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x4588ce
call ebx
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.004261a3
mov esp, ebp
pop ebp
ret

Function at 0x45894b
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x49a02c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
test esi, esi
jne 0x45896a
or eax, 0xffffffff
jmp 0x4589c3
push 0x110
lea eax, [ebp - 0x114]
push 0
push eax
call fcn.0042ac90
add esp, 0xc
mov dword [ebp - 0x118], 0x114
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4589ad
cmp dword [ebp - 0x114], 5
jne 0x4589ad
cmp dword [ebp - 0x110], 0
je 0x4589b8
mov ecx, esi
call fcn.0045878b
test eax, eax
je 0x4589c1
mov ecx, esi
call fcn.004587d6
jmp 0x4589c3
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004261a3
mov esp, ebp
pop ebp
ret