joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409888
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40995b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409974
push ebx
push 0x409980
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409908
mov al, 0x62
call fcn.00409460
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.0040985c
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409911
call fcn.0040985c
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409962
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409a14
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409ac8
jmp 0x409abd
cmp dword [esi + 0x10], 0x1000
jne 0x409aa9
test byte [esi + 0x15], 1
jne 0x409aa9
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409a68
cmp eax, 2
je 0x409a68
cmp eax, 0x10
je 0x409a68
cmp eax, 0x20
jne 0x409a7d
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409a7d
mov bl, 1
xor ebp, ebp
jmp 0x409a8e
mov eax, dword [esi]
add eax, ebp
call fcn.00409a0c
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409a81
test bl, bl
je 0x409aa9
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409ac8
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409a40
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x414ac0
Capabilities:
Encode data using xor

Disassembly:
retf 0xdc25
popal
jnp 0x414ae6
pushal
xor dword [edx], esp
xchg edi, eax
out 0x34, eax
repe scasb al, byte es:[edi]
jbe 0x414ac3
mov al, 0xc6
int3
jle 0x414a7e
push esp
mov bl, 0xc6
dec esi
or eax, 0xa9dc5939
cmp dword [ecx - 0x35], ebx
dec edx
salc
invalid
Function at 0xdd0dec
Capabilities:
Encode data using xor

Disassembly:
jmp 0xdd0df6
pushal
call 0xdd0dfc
pop ebp
sub ebp, 0x10
sub ebp, 0x9d0dec
jmp 0xdd0e12
mov eax, 0x9d0dec
add eax, ebp
add eax, 0x4c
mov ecx, 0x5cd
mov edx, 0x119a0b9e
xor byte [eax], dl
inc eax
dec ecx
jne 0xdd0e29
jmp 0xdd0e3c
adc eax, 0xa2171553
sahf
sahf
sahf
pop ds
pop ss
mov byte [0x1f9e9e9e], al
pop edi
sahf
sahf
sahf
popfd
push ebx
lcall 0x9eb6, 0x249e9e9e
sahf
sahf
imul edi, dword [ebp + ebx*4 + 0x56], 0x9e921f15
sahf
sahf
popfd
pop ebx
adc edi, edx
mov edx, 0xba9a1762
adc edi, edx
mov edx, 0xba9a1762
mul byte [esi + 4]
mov edi, 0xec6af69e
in eax, 0x9e
lahf
mov dl, 0xba
not byte [eax + 0x763aed89]
wait
sahf
sahf
sahf
ja 0xdd0e3f
sahf
sahf
sahf
retf
Function at 0x437a1444
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0x437a14f4
push 0x437a1efc
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x437a1479
push 0
push 0
push 1
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call esi
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov esi, dword [ebp - 8]
xor esi, dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor esi, eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0x10]
xor eax, dword [ebp - 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor esi, eax
lea eax, [ebp - 4]
push eax
push 0x40
push 4
mov ebx, 0x437bca70
push ebx
call edi
mov dword [0x437bca70], esi
test esi, esi
je 0x437c152a
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 4
push ebx
call edi
pop edi
pop esi
mov dword [0x4391772c], 0x44bf19b1
pop ebx
leave
ret
mov dword [0x437bca70], 0xbb40e64e
jmp 0x437a14d7
Function at 0x437a27f7
Capabilities:
Link many functions at runtime
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x437bca70]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
xor esi, esi
lea eax, [ebp - 0x20a]
push esi
push eax
mov dword [ebp - 0x214], 1
call sub.MSVCR90.dll_memset
mov eax, 0x43917a10
add esp, 0xc
mov dword [ebp - 0x210], 0x208
mov ecx, eax
cmp dword [ecx], 0
jne 0x437c1260
imul esi, esi, 0x14
add esi, eax
je 0x437a28a0
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x437c1275
xor ebx, ebx
cmp esi, ebx
je 0x437a28a0
mov eax, dword [esi]
cmp eax, ebx
jne 0x437c138b
mov dword [esi], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.437b9d88
leave
ret 0xc
add ecx, 0x14
inc esi
cmp ecx, 0x43917a38
jge 0x437a28a0
jmp 0x437a284e
cmp dword [ebp - 0x214], 1
jne 0x437a2885
xor ebx, ebx
cmp word [ebp - 0x20c], bx
je 0x437a2887
cmp dword [ebp - 0x210], ebx
je 0x437a2887
shr dword [ebp - 0x210], 1
cmp dword [ebp - 0x210], 0x104
jae 0x437c12bf
mov ecx, dword [ebp - 0x210]
mov word [ebp + ecx*2 - 0x20c], ax
jmp 0x437c12c3
mov word [ebp - 6], ax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi], eax
cmp eax, ebx
je 0x437a2887
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x437c1418
push eax
call edi
cmp eax, ebx
jne 0x437c12f1
mov eax, dword [ebp + 0x10]
jmp 0x437c12f3
call eax
mov dword [esi + 4], eax
cmp eax, 1
jne 0x437c1317
push 0x437c140c
push dword [esi]
call edi
push 0x437c13f8
push dword [esi]
mov dword [esi + 8], eax
call edi
push 0x437c13e8
jmp 0x437c134b
cmp eax, 2
jne 0x437c132c
push 0x437c140c
push dword [esi]
call edi
push 0x437c13d4
jmp 0x437c1309
cmp eax, 3
jne 0x437c1355
push 0x437c13c4
push dword [esi]
call edi
push 0x437c13ac
push dword [esi]
mov dword [esi + 8], eax
call edi
push 0x437c1398
push dword [esi]
mov dword [esi + 0x10], eax
call edi
mov dword [esi + 0xc], eax
cmp dword [esi + 8], ebx
je 0x437a2887
cmp dword [esi + 0x10], ebx
je 0x437a2887
cmp dword [esi + 0xc], ebx
je 0x437a2887
push dword [0x43917a38]
push esi
call fcn.438cbba2
test eax, eax
jl 0x437a2887
xor esi, esi
jmp 0x437a2887
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x437a2895
Function at 0x437b6857
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 0x10]
test ebx, ebx
je 0x437b68ad
mov esi, dword [edi]
shr esi, 1
and dword [ebp + 0xc], 0
push edi
push ebx
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x437b68a6
cmp dword [ebp + 0xc], 7
jne 0x437bcd14
test ebx, ebx
je 0x437b68a6
mov ecx, dword [edi]
shr ecx, 1
cmp ecx, esi
jae 0x437bcd30
xor edx, edx
mov word [ebx + ecx*2], dx
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
xor esi, esi
jmp 0x437b686b
cmp dword [ebp + 0xc], 2
je 0x437b6890
cmp dword [ebp + 0xc], 1
je 0x437b6890
push 0xd
pop eax
jmp 0x437b68a6
test esi, esi
je 0x437bcd41
xor ecx, ecx
cmp cx, word [ebx + esi*2 - 2]
je 0x437b68a6
mov eax, 0xea
jmp 0x437b68a6

Function at 0x437b8529
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 0x30]
push edi
xor edi, edi
cmp eax, edi
jne 0x437bd097
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventW]
push edi
push edi
push 1
push edi
mov dword [esi + 0x5c], eax
call ebx
push eax
lea ecx, [esi + 0x28]
call fcn.437b85b0
mov eax, dword [esi + 0x28]
cmp eax, edi
je 0x437b85a9
cmp eax, 0xffffffff
je 0x437b85a9
push edi
push edi
push edi
push edi
call ebx
lea ebx, [esi + 0x2c]
push eax
mov ecx, ebx
call fcn.437b85b0
mov ebx, dword [ebx]
cmp ebx, edi
je 0x437b85a9
cmp ebx, 0xffffffff
je 0x437b85a9
push edi
push edi
push esi
push 0x437b88ee
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x30], eax
mov esi, eax
cmp esi, edi
je 0x437b85a9
cmp esi, 0xffffffff
je 0x437b85a9
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret 4
mov eax, 0x8000ffff
jmp 0x437b85a2
cmp eax, 0xffffffff
je 0x437b853d
xor eax, eax
jmp 0x437b85a3
Function at 0x437b9d88
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x437bca70]
jne 0x438cbe32
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x439208b8], eax
mov dword [0x439208b4], ecx
mov dword [0x439208b0], edx
mov dword [0x439208ac], ebx
mov dword [0x439208a8], esi
mov dword [0x439208a4], edi
mov word [0x439208d0], ss
mov word [0x439208c4], cs
mov word [0x439208a0], ds
mov word [0x4392089c], es
mov word [0x43920898], fs
mov word [0x43920894], gs
pushfd
pop dword [0x439208c8]
mov eax, dword [ebp]
mov dword [0x439208bc], eax
mov eax, dword [ebp + 4]
mov dword [0x439208c0], eax
lea eax, [ebp + 8]
mov dword [0x439208cc], eax
mov eax, dword [ebp - 0x320]
mov dword [0x43920808], 0x10001
mov eax, dword [0x439208c0]
mov dword [0x439207bc], eax
mov dword [0x439207b0], 0xc0000409
mov dword [0x439207b4], 1
mov eax, dword [0x437bca70]
mov dword [ebp - 0x328], eax
mov eax, dword [0x4391772c]
mov dword [ebp - 0x324], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x43920800], eax
push 1
call sub.MSVCR90.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x438cbf34
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x43920800], 0
jne 0x438cbf1e
push 1
call sub.MSVCR90.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
leave
ret
Function at 0x438333dc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 4
mov eax, 0x438fc6a2
call fcn.437bbfdf
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebx + 4], 0
mov esi, dword [ebp + 8]
and dword [ebp - 4], 0
mov dword [ebx], 0x43833500
mov eax, dword [esi]
mov ecx, esi
lea edi, [ebx + 8]
call dword [eax + 4]
push eax
mov ecx, edi
call fcn.43833048
mov eax, dword [esi]
mov ecx, esi
mov byte [ebp - 4], 1
call dword [eax + 4]
fldz
mov dword [ebx + 0xc], eax
fst dword [ebx + 0x10]
and dword [ebx + 0x28], 0
fst dword [ebx + 0x14]
fst dword [ebx + 0x18]
fst dword [ebx + 0x1c]
fst dword [ebx + 0x20]
fstp dword [ebx + 0x24]
mov eax, dword [esi]
mov ecx, esi
mov byte [ebp - 4], 2
call dword [eax + 0x10]
fldz
mov esi, eax
lea edi, [ebx + 0x2c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
fst dword [ebx + 0x3c]
fst dword [ebx + 0x40]
fst dword [ebx + 0x44]
lea eax, [ebx + 0x7c]
fst dword [ebx + 0x48]
xor esi, esi
fst dword [ebx + 0x4c]
fst dword [ebx + 0x50]
fst dword [ebx + 0x54]
fst dword [ebx + 0x58]
fst dword [ebx + 0x5c]
fst dword [ebx + 0x60]
fst dword [ebx + 0x64]
fst dword [ebx + 0x68]
fst dword [ebx + 0x6c]
fst dword [ebx + 0x70]
fst dword [ebx + 0x74]
fst dword [ebx + 0x78]
fst dword [eax]
fst dword [eax + 4]
fst dword [eax + 8]
fst dword [eax + 0xc]
cmp dword [ebx + 0xc], esi
fld1
mov byte [ebx + 0x98], 0
fstp dword [ebx + 0x8c]
mov byte [ebx + 0x99], 0
mov byte [ebx + 0x9a], 0
mov byte [ebx + 0x9b], 0
fst dword [ebx + 0x90]
fstp dword [ebx + 0x94]
jle 0x438334f5
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
mov edi, dword [ebx + 8]
push esi
call dword [eax + 0xc]
push eax
lea ecx, [edi + esi*4]
call fcn.437bc7b5
mov eax, dword [ebx + 8]
mov ecx, dword [eax + esi*4]
mov eax, dword [ecx]
call dword [eax + 0x14]
test al, al
je 0x438334ef
mov byte [ebx + 0x9b], 1
inc esi
cmp esi, dword [ebx + 0xc]
jl 0x438334c4
mov eax, ebx
call fcn.437bca5a
ret 4
Function at 0x43869e6f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
push 1
xor edi, edi
push edi
push 0x43869f00
push 0x80000001
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x43869ef6
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 0x14]
lea eax, [ebp + 0x14]
push eax
push ebx
lea eax, [ebp + 0x10]
push eax
push edi
push dword [ebp + 0xc]
mov dword [ebp + 0x14], esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x43869ef6
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp + 8]
jne 0x43869ef6
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x43869ee1
cmp eax, 7
je 0x43869ee1
cmp eax, 2
je 0x43869ee1
mov eax, ecx
jmp 0x43869ef8
mov eax, dword [ebp + 0x14]
inc eax
cmp eax, esi
jb 0x43869eeb
mov eax, esi
cmp eax, ecx
jb 0x43869ef6
mov byte [eax + ebx - 1], 0
jmp 0x43869edd
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x43869f41
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x437bca70]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x3ff
lea eax, [ebp - 0x403]
push 0
push eax
mov byte [ebp - 0x404], 0
call sub.MSVCR90.dll_memset
push 0x4386a00c
lea eax, [ebp - 0x404]
push 0xffffffffffffffff
push eax
call fcn.43869f21
lea eax, [ebp - 0x404]
add esp, 0x18
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x43869f8d
sub eax, ecx
push esi
mov esi, eax
lea eax, [ebp - 0x404]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x43869fa2
sub eax, ecx
lea ecx, [ebp + 0xc]
push ecx
push dword [ebp + 8]
mov ecx, 0x400
push 0xffffffffffffffff
sub ecx, esi
push ecx
lea eax, [ebp + eax - 0x404]
push eax
call dword [sym.imp.MSVCR90.dll__vsnprintf_s]
lea eax, [ebp - 0x404]
push eax
push 0x4381263c
push 0xffffffffffffffff
push eax
call fcn.43869f21
add esp, 0x24
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.MSVCR90.dll_printf]
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.437b9d88
leave
ret
Function at 0x4386a01f
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x437bca70]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x3ff
lea eax, [ebp - 0x403]
push 0
push eax
mov byte [ebp - 0x404], 0
call sub.MSVCR90.dll_memset
push 0x43812640
lea eax, [ebp - 0x404]
push 0xffffffffffffffff
push eax
call fcn.43869f21
lea eax, [ebp - 0x404]
add esp, 0x18
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4386a06b
sub eax, ecx
push esi
mov esi, eax
lea eax, [ebp - 0x404]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4386a080
sub eax, ecx
lea ecx, [ebp + 0xc]
push ecx
push dword [ebp + 8]
mov ecx, 0x400
push 0xffffffffffffffff
sub ecx, esi
push ecx
lea eax, [ebp + eax - 0x404]
push eax
call dword [sym.imp.MSVCR90.dll__vsnprintf_s]
lea eax, [ebp - 0x404]
push eax
push 0x4381263c
push 0xffffffffffffffff
push eax
call fcn.43869f21
add esp, 0x24
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.MSVCR90.dll_printf]
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.437b9d88
leave
ret

Function at 0x4386a0e7
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x437bca70]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp eax, dword [0x4391c388]
jg 0x4386a198
push 0x43812640
lea eax, [ebp - 0x404]
push 0xffffffffffffffff
push eax
call fcn.43869f21
lea eax, [ebp - 0x404]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4386a128
sub eax, edx
push esi
mov esi, eax
lea eax, [ebp - 0x404]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4386a13d
sub eax, ecx
lea ecx, [ebp + 0x10]
push ecx
push dword [ebp + 0xc]
mov ecx, 0x400
push 0xffffffffffffffff
sub ecx, esi
push ecx
lea eax, [ebp + eax - 0x404]
push eax
call dword [sym.imp.MSVCR90.dll__vsnprintf_s]
lea eax, [ebp - 0x404]
push eax
push 0x4381263c
push 0xffffffffffffffff
push eax
call fcn.43869f21
add esp, 0x24
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.MSVCR90.dll_printf]
pop ecx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.437b9d88
leave
ret
Function at 0x4387970d
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x437bca70]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x43812640
lea eax, [ebp - 0x404]
push 0xffffffffffffffff
push eax
call fcn.43869f21
lea eax, [ebp - 0x404]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4387973f
sub eax, edx
push esi
mov esi, eax
lea eax, [ebp - 0x404]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x43879754
sub eax, ecx
lea ecx, [ebp + 0xc]
push ecx
push dword [ebp + 8]
mov ecx, 0x400
push 0xffffffffffffffff
sub ecx, esi
push ecx
lea eax, [ebp + eax - 0x404]
push eax
call dword [sym.imp.MSVCR90.dll__vsnprintf_s]
lea eax, [ebp - 0x404]
push eax
push 0x4381263c
push 0xffffffffffffffff
push eax
call fcn.43869f21
add esp, 0x24
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.MSVCR90.dll_printf]
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.437b9d88
leave
ret
Function at 0x4389057c
Capabilities:
Create thread
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
mov esi, ecx
je 0x438905a1
push 0x131
push 0x43812be8
push 0x4389073c
call fcn.438c6b7a
mov eax, dword [ebp + 0x10]
and dword [ebp + 8], 0
mov dword [esi + 0x4c], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 0x18]
push 0x20
mov dword [esi + 0x54], eax
mov eax, dword [ebp + 0x1c]
pop edi
push 4
mov dword [esi + 0x58], eax
lea eax, [ebp + 8]
push eax
push 0x43890730
push 4
mov ebx, 0x100
call fcn.43869e6f
test eax, eax
je 0x438905de
mov ebx, dword [ebp + 8]
push 4
lea eax, [ebp + 8]
push eax
push 0x43890724
push 4
call fcn.43869e6f
test eax, eax
je 0x438905f7
mov edi, dword [ebp + 8]
push edi
push ebx
push 0x8000
lea eax, [esi + 0x2c0]
push eax
push esi
call fcn.438bf252
mov dword [esi + 0x48], eax
test eax, eax
jne 0x4389061c
mov eax, 0x8007000e
jmp 0x4389070e
and dword [ebp - 4], 0
push 4
lea eax, [ebp - 4]
push eax
push 0x43890718
push 4
call fcn.43869e6f
test eax, eax
je 0x4389063b
mov edi, dword [ebp - 4]
jmp 0x43890656
and dword [ebp - 0x28], 0
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [ebp - 0x14]
call dword [sym.imp.MSO.dll_Ordinal_4428]
cmp eax, 5
jne 0x43890664
xor edi, edi
inc edi
cmp edi, 1
ja 0x4389066c
xor edi, edi
inc edi
push edi
call fcn.438679c7
test al, al
jne 0x4389067e
push edi
call fcn.438903c0
mov edi, eax
cmp edi, 0x10
jb 0x43890686
push 0x10
pop edi
lea ebx, [esi + 0x6c]
push edi
mov ecx, ebx
call fcn.4388fd81
test eax, eax
jl 0x4389070e
mov ecx, ebx
call fcn.4388fe9c
and dword [ebp + 0x10], 0
mov dword [esi + 0x60], edi
test edi, edi
jbe 0x438906da
lea ebx, [esi + 0x1b0]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
push edi
push dword [ebp + 0x10]
lea eax, [esi + 0x1f0]
push 0x8000
push eax
call dword [edx + 0x14]
mov dword [ebx], eax
test eax, eax
je 0x43890612
inc dword [ebp + 0x10]
add ebx, 4
cmp dword [ebp + 0x10], edi
jb 0x438906ad
and dword [ebp + 0x10], 0
test edi, edi
jbe 0x4389070c
lea ebx, [esi + 8]
xor eax, eax
push eax
push eax
push esi
push 0x43890413
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebx], eax
test eax, eax
je 0x43890612
inc dword [ebp + 0x10]
add ebx, 4
cmp dword [ebp + 0x10], edi
jb 0x438906e5
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x18
Function at 0x438c6dcd
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
ja 0x438c6def
push 0x19e
push 0x43816788
push 0x43816810
mov ecx, 0x439206f4
call fcn.438c7324
push 0x40
push 0x2000
push dword [ebp + 8]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
pop ebp
ret 4

Function at 0x438c6e05
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
ja 0x438c6e27
push 0x1a5
push 0x43816788
push 0x43816810
mov ecx, 0x439206f4
call fcn.438c7324
push 0x40
push 0x1000
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
pop ebp
ret 8

Function at 0x438c6f51
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 4
pop esi
xor edi, edi
mov dword [ebx], edi
or dword [eax], 0xffffffff
lea eax, [ebp - 0xc]
push eax
push 0x20019
push edi
push 0x438c7014
push 0x80000001
mov dword [ebp + 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x438c6feb
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0x438c7004
push dword [ebp - 0xc]
call edi
test eax, eax
jne 0x438c6fb6
cmp dword [ebp - 4], esi
jne 0x438c6fb6
mov eax, dword [ebp - 8]
mov dword [ebx], eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x438c6ff4
push dword [ebp - 0xc]
mov dword [ebp + 8], esi
call edi
test eax, eax
jne 0x438c6fe2
cmp dword [ebp - 4], esi
jne 0x438c6fe2
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x438cb90c
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x438cb990
call fcn.437b9e39
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
movzx edx, word [eax]
mov ecx, 0x5a4d
cmp dx, cx
jne 0x438cb94a
mov ecx, dword [eax + 0x3c]
add ecx, eax
mov esi, 0xe0
cmp word [ecx + 0x14], si
jne 0x438cb94a
add esi, 0x2b
cmp word [ecx + 0x18], si
jne 0x438cb94a
mov eax, dword [ecx + 0x50]
jmp 0x438cb96b
mov ecx, 0x4550
cmp dx, cx
jne 0x438cb977
mov ecx, 0xe0
cmp word [eax + 0x14], cx
jne 0x438cb977
add ecx, 0x2b
cmp word [eax + 0x18], cx
jne 0x438cb977
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x1c], eax
jmp 0x438cb97b
and dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x1c]
call fcn.437b9e7e
ret 4