joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41aac4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x41aca5
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x427ca0], 0
jne 0x41ac73
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x38
call fcn.00402d2c
mov bl, 0x43
lea esi, [ebp - 0x50]
lea eax, [ebp - 0x54]
mov edx, ebx
call fcn.00404354
mov edx, dword [ebp - 0x54]
lea eax, [ebp - 0x18]
mov ecx, 0x41acbc
call fcn.00404478
mov eax, dword [ebp - 0x18]
call fcn.0040462c
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x41abdc
lea eax, [ebp - 0x10]
mov ecx, 0x41acc8
mov edx, dword [ebp - 0x18]
call fcn.00404478
mov eax, dword [ebp - 0x10]
call fcn.00406f14
test al, al
je 0x41ab90
push dword [ebp - 0x10]
push 0x41acd8
push 0
push 0x2710
push 0
push 0x186a0
lea eax, [ebp - 0x58]
call fcn.0040b640
push dword [ebp - 0x58]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004044ec
mov eax, dword [ebp - 0x10]
call fcn.00406f38
lea eax, [ebp - 0x14]
mov ecx, 0x41ace8
mov edx, dword [ebp - 0x10]
call fcn.00404478
push 0
push 0
xor ecx, ecx
mov edx, 0x41acfc
mov eax, dword [ebp - 0x14]
call fcn.004130a0
mov eax, dword [ebp - 0x14]
call fcn.00406f04
test al, al
je 0x41abd2
mov eax, dword [ebp - 0x10]
call fcn.00413448
fstp qword [esi]
wait
xor edx, edx
mov eax, dword [ebp - 0x10]
call fcn.00413cb8
inc ebx
add esi, 8
cmp bl, 0x46
jne 0x41ab15
lea edx, [ebp - 0x60]
mov al, 1
call fcn.0040d148
mov eax, dword [ebp - 0x60]
lea edx, [ebp - 0x5c]
call fcn.00406b70
mov eax, dword [ebp - 0x5c]
mov dl, byte [eax]
mov byte [ebp - 9], dl
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov bl, 0x43
lea ecx, [ebp - 0x50]
fld qword [ecx]
fcomp qword [ebp - 8]
fnstsw ax
sahf
jbe 0x41ac2b
mov eax, dword [ecx]
mov dword [ebp - 8], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 4], eax
mov byte [ebp - 9], bl
inc ebx
add ecx, 8
cmp bl, 0x46
jne 0x41ac13
cmp dl, byte [ebp - 9]
je 0x41ac73
lea eax, [ebp - 0x64]
mov dl, byte [ebp - 9]
call fcn.00404354
mov edx, dword [ebp - 0x64]
mov eax, 0x427ca0
mov ecx, 0x41ad08
call fcn.00404478
mov eax, dword [0x427ca0]
call fcn.00406f14
test al, al
je 0x41ac73
mov eax, 0x427ca0
mov edx, 0x41acd8
call fcn.00404434
cmp dword [0x427ca0], 0
setne bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41acac
lea eax, [ebp - 0x64]
mov edx, 5
call fcn.004041ac
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.004041ac
ret
Function at 0x41ef84
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040461c
xor eax, eax
push ebp
push 0x41f005
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call fcn.0040cee8
test al, al
je 0x41efc0
mov dl, byte [ebp - 5]
mov eax, dword [ebp - 4]
call fcn.0041e5f8
jmp 0x41efcb
mov dl, byte [ebp - 5]
mov eax, dword [ebp - 4]
call fcn.0041e314
test eax, eax
je 0x41efef
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov esi, eax
push 0
push esi
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb ebx, ebx
inc ebx
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41f00c
lea eax, [ebp - 4]
call fcn.00404188
ret

Function at 0x41f608
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040461c
xor eax, eax
push ebp
push 0x41f695
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00402d2c
mov dword [ebp - 0x48], 0x44
mov dword [ebp - 0x1c], 1
mov word [ebp - 0x18], si
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040462c
push eax
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x41f67f
mov ebx, dword [ebp - 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41f69c
lea eax, [ebp - 4]
call fcn.00404188
ret
Function at 0x422f28
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x423022
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x423038
call fcn.00414508
mov eax, dword [0x427e50]
cmp dword [eax], 0
jg 0x422ffd
lea eax, [ebp - 0xc]
call fcn.0041bc78
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 0x423064
call fcn.00404478
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.00402820
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.0040728c
push dword [ebp - 0x10]
lea edx, [ebp - 0x18]
mov eax, dword [0x427df4]
mov eax, dword [eax]
call fcn.00415a2c
push dword [ebp - 0x18]
push dword [ebp - 4]
lea eax, [ebp - 8]
mov edx, 3
call fcn.004044ec
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 8]
mov edx, 0x42308c
call fcn.00404478
mov eax, dword [ebp - 0x1c]
call fcn.00414508
push 0
mov eax, dword [ebp - 8]
call fcn.0040462c
push eax
call sub.kernel32.dll_WinExec
xor edx, edx
mov eax, 0x3e8
call fcn.0040c12c
mov eax, 0x4230a4
call fcn.00414508
push 0
push 0
push 2
mov eax, dword [0x427d8c]
mov eax, dword [eax]
push eax
call sub.user32.dll_PostMessageA
mov eax, 0x4230c8
call fcn.00414508
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x423029
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.004041ac
ret
Function at 0x423f50
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4240e9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.0040cfc4
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x414ea4]
call fcn.00415688
call fcn.00415dfc
mov dword [ebp - 0xc], eax
mov ebx, 0x46
mov eax, dword [ebp - 0xc]
add eax, 0xffffff4f
sub eax, 2
jae 0x423fa3
add ebx, 0x34
mov esi, 0x14
mov edi, 0x154
mov dword [ebp - 8], 0x12
push ebx
push esi
push edi
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push 0
mov eax, dword [0x428660]
push eax
push 0
mov edx, 0x4240f8
mov eax, 0x4240fc
mov ecx, 0x50000000
call fcn.00405d74
mov edx, dword [0x427ecc]
mov dword [edx], eax
mov ebx, 0x46
mov esi, 0x26
mov edi, 0x188
mov dword [ebp - 8], 0xd
push 0x50000000
push ebx
push esi
push edi
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push 0
mov eax, dword [0x428660]
push eax
push 0
mov edx, 0x424104
xor ecx, ecx
xor eax, eax
call fcn.00405d1c
mov edx, dword [0x427e0c]
mov dword [edx], eax
mov ebx, 0x1a0
mov eax, dword [ebp - 0xc]
add eax, 0xffffff4f
sub eax, 2
jae 0x424042
mov ebx, 0x46
mov esi, 0x14
mov edi, 0x2e
mov dword [ebp - 8], 0xd
push 0x40000000
push ebx
push esi
push edi
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push 0
mov eax, dword [0x428660]
push eax
push 0
mov edx, 0x424104
xor ecx, ecx
xor eax, eax
call fcn.00405d1c
mov edx, dword [0x427dac]
mov dword [edx], eax
push 0
push 0x3e8
push 1
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SetTimer
mov edx, dword [0x427ddc]
mov dword [edx], eax
push 0x424118
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xfffffffffffffff5
call sub.gdi32.dll_CreateFontA
push 0
push eax
push 0x30
mov eax, dword [0x427ecc]
mov eax, dword [eax]
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4240f0
lea eax, [ebp - 0x10]
call fcn.00404188
ret
Function at 0x424380
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x424567
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xffffffffffffffff
push 0xffffffffffffffff
mov eax, 0x424580
call fcn.0040d724
test eax, eax
jl 0x4243be
neg eax
mov edx, dword [0x427e6c]
mov dword [edx], eax
call sub.comctl32.dll_InitCommonControls
lea eax, [ebp - 0x54]
xor ecx, ecx
mov edx, 0x28
call fcn.00402d2c
mov dword [ebp - 0x50], 0x424258
mov eax, dword [0x428660]
mov dword [ebp - 0x44], eax
mov eax, dword [0x427d28]
call fcn.0040462c
mov dword [ebp - 0x30], eax
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [ebp - 0x3c], eax
push 0x42458c
mov eax, dword [0x428660]
push eax
call sub.user32.dll_LoadIconA
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x54], 8
lea eax, [ebp - 0x54]
push eax
call sub.user32.dll_RegisterClassA
mov esi, 0x1ec
mov edi, 0x6e
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
mov edx, edi
mov eax, esi
call fcn.0040e764
mov dword [ebp - 0xc], 0x2c80000
lea eax, [ebp - 0x58]
call fcn.0040cfc4
mov ecx, dword [ebp - 0x58]
mov dl, 1
mov eax, dword [0x414ea4]
call fcn.00415688
mov ebx, eax
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x4245a0
mov edx, 0x4245c4
mov eax, ebx
call fcn.00415cf8
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
push esi
push edi
push 0
push 0
mov eax, dword [0x428660]
push eax
push 0
mov eax, dword [ebp - 0x10]
call fcn.0040462c
push eax
mov eax, dword [0x427d28]
call fcn.0040462c
mov edx, eax
xor eax, eax
pop ecx
call fcn.00405d1c
mov edx, dword [0x427d8c]
mov dword [edx], eax
lea edx, [ebp - 0x5c]
mov eax, ebx
call fcn.00415ef4
mov eax, dword [ebp - 0x5c]
push eax
mov eax, ebx
call fcn.00415dfc
push eax
mov eax, ebx
call fcn.00415e74
mov edx, eax
pop ecx
pop eax
call fcn.0040e874
mov eax, dword [0x427d8c]
cmp dword [eax], 0
je 0x42451d
push 0
mov eax, dword [0x427d8c]
mov eax, dword [eax]
push eax
call sub.user32.dll_ShowWindow
jmp 0x42450a
lea eax, [ebp - 0x2c]
push eax
call sub.user32.dll_TranslateMessage
lea eax, [ebp - 0x2c]
push eax
call sub.user32.dll_DispatchMessageA
cmp byte [0x427d30], 0
jne 0x42451d
push 0
push 0
push 0
lea eax, [ebp - 0x2c]
push eax
call sub.user32.dll_GetMessageA
test eax, eax
jne 0x4244ef
push 1
mov eax, dword [0x427d8c]
mov eax, dword [eax]
push eax
call sub.user32.dll_KillTimer
mov al, 1
call fcn.0041d1fc
call fcn.0041d1cc
xor edx, edx
mov eax, 0x2b
call fcn.004145e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42456e
lea eax, [ebp - 0x5c]
mov edx, 2
call fcn.004041ac
lea eax, [ebp - 0x10]
call fcn.00404188
ret
Function at 0x4247fc
Capabilities:
Copy file
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x424804
xor eax, eax
push ebp
push 0x424910
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
xor eax, eax
call fcn.00402820
lea eax, [ebp - 0x10]
call fcn.0041a93c
push dword [ebp - 0x10]
push 0x424924
push 0x424930
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.00407314
push dword [ebp - 0x14]
lea eax, [ebp - 8]
mov edx, 4
call fcn.004044ec
push 0
mov eax, dword [ebp - 8]
call fcn.0040462c
push eax
mov eax, dword [ebp - 4]
call fcn.0040462c
push eax
call sub.kernel32.dll_CopyFileA
lea eax, [ebp - 0x18]
call fcn.0040d464
push dword [ebp - 0x18]
push 0x42493c
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.00402820
push dword [ebp - 0x1c]
push 0x424964
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.004044ec
push dword [ebp - 0xc]
push 0x424974
lea edx, [ebp - 0x20]
xor eax, eax
call fcn.00402820
push dword [ebp - 0x20]
push 0x42498c
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.004044ec
push 0
push dword [ebp - 8]
push 0x424998
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.00406bac
push dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.004044ec
mov eax, dword [ebp - 0x24]
call fcn.0040462c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x424917
lea eax, [ebp - 0x28]
mov edx, 0xa
call fcn.004041ac
ret
Function at 0x3440475d
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 0xc], 0
je 0x344047e6
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jl 0x3440478e
cmp dword [ebp - 0x10], 5
jle 0x3440477d
jmp 0x3440478e
mov eax, dword [ebp + 8]
mov ax, word [eax*2 + str..___Ee]
mov word [ebp - 4], ax
jmp 0x3440480d
cmp dword [ebp + 8], 0
jl 0x344047da
cmp dword [ebp + 8], 6
jae 0x344047da
push 2
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push dword [eax*4 + 0x34416f28]
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
cmp eax, 2
jne 0x344047da
push 2
lea eax, [ebp - 0xc]
push eax
push 2
lea eax, [ebp - 8]
push eax
push 4
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ax, word [ebp - 0xc]
mov word [ebp - 4], ax
jmp 0x3440480d
mov ax, word [str..___Ee]
mov word [ebp - 4], ax
jmp 0x3440480d
cmp dword [ebp + 8], 0
jl 0x34404803
cmp dword [ebp + 8], 7
jae 0x34404803
mov eax, dword [ebp + 8]
mov ax, word [eax*2 + str..___Ee]
mov word [ebp - 4], ax
jmp 0x3440480d
mov ax, word [str..___Ee]
mov word [ebp - 4], ax
mov ax, word [ebp - 4]
leave
ret 8

Function at 0x344049f4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0xf
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x34404a2f
push 4
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
call fcn.34412eca
test eax, eax
jl 0x34404a2f
mov eax, dword [ebp + 0xc]
mov cx, word [ebp - 8]
mov word [eax], cx
push 2
lea eax, [ebp - 4]
push eax
push 0xe
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x34404a65
push 4
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
call fcn.34412eca
test eax, eax
jl 0x34404a65
mov eax, dword [ebp + 8]
mov cx, word [ebp - 8]
mov word [eax], cx
leave
ret 8
Function at 0x3440670d
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x343f2b10]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x24c], ecx
and dword [ebp - 4], 0
push 0x343f1274
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 8], eax
cmp dword [ebp + 8], 0
je 0x34406744
mov eax, dword [ebp + 8]
and dword [eax], 0
cmp dword [ebp - 8], 0
je 0x344068f9
and dword [ebp - 0xc], 0
mov ecx, dword [ebp - 0x24c]
call fcn.3440690a
test eax, eax
je 0x34406768
mov dword [ebp - 4], 1
call fcn.34404dc5
test eax, eax
jne 0x344068f9
push 0x104
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x344068f9
and dword [ebp - 0x230], 0
and dword [ebp - 0x224], 0
and dword [ebp - 0x22c], 0
and dword [ebp - 0x228], 0
and dword [ebp - 0x21c], 0
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x218]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 0
ja 0x344067e1
jmp 0x344068f9
push dword [ebp - 0x228]
call fcn.344132c3
pop ecx
mov dword [ebp - 0x23c], eax
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
jne 0x3440680d
jmp 0x344068f9
push dword [ebp - 0x21c]
push dword [ebp - 0x228]
push 0
lea eax, [ebp - 0x218]
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x34406848
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 0x240], eax
push dword [ebp - 0x240]
call fcn.344132cf
pop ecx
jmp 0x344068f9
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x224]
push eax
push 0x343f145c
push dword [ebp - 0x21c]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x34406884
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 0x244], eax
push dword [ebp - 0x244]
call fcn.344132cf
pop ecx
jmp 0x344068f9
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 0
je 0x344068e1
and dword [ebp - 0x234], 0
and dword [ebp - 0x238], 0
mov eax, dword [ebp - 0x230]
mov eax, dword [eax + 8]
mov dword [ebp - 0x234], eax
mov eax, dword [ebp - 0x230]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x238], eax
cmp dword [ebp + 8], 0
je 0x344068e1
mov eax, dword [ebp - 0x234]
shr eax, 0x10
and eax, 0xffff
movzx eax, ax
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 0x248], eax
push dword [ebp - 0x248]
call fcn.344132cf
pop ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.34413b37
leave
ret 4
Function at 0x34413a83
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0x343f2b30
push 0x343f2b14
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x34413ab8
push 0
push 0
push 1
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call esi
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov esi, dword [ebp - 8]
xor esi, dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor esi, eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0x10]
xor eax, dword [ebp - 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor esi, eax
lea eax, [ebp - 4]
push eax
push 0x40
push 4
mov ebx, 0x343f2b10
push ebx
call edi
test esi, esi
mov dword [0x343f2b10], esi
jne 0x34413b1c
mov dword [0x343f2b10], 0xbb40e64e
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 4
push ebx
call edi
pop edi
pop esi
mov dword [0x3441855c], 0x44bf19b1
pop ebx
leave
ret

Function at 0x34413b37
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x343f2b10]
jne 0x34413fa1
ret
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x34418c70], eax
mov dword [0x34418c6c], ecx
mov dword [0x34418c68], edx
mov dword [0x34418c64], ebx
mov dword [0x34418c60], esi
mov dword [0x34418c5c], edi
mov word [0x34418c88], ss
mov word [0x34418c7c], cs
mov word [0x34418c58], ds
mov word [0x34418c54], es
mov word [0x34418c50], fs
mov word [0x34418c4c], gs
pushfd
pop dword [0x34418c80]
mov eax, dword [ebp]
mov dword [0x34418c74], eax
mov eax, dword [ebp + 4]
mov dword [0x34418c78], eax
lea eax, [ebp + 8]
mov dword [0x34418c84], eax
mov eax, dword [ebp - 0x320]
mov dword [0x34418bc0], 0x10001
mov eax, dword [0x34418c78]
mov dword [0x34418b74], eax
mov dword [0x34418b68], 0xc0000409
mov dword [0x34418b6c], 1
mov eax, dword [0x343f2b10]
mov dword [ebp - 0x328], eax
mov eax, dword [0x3441855c]
mov dword [ebp - 0x324], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x34418bb8], eax
push 1
call sub.MSVCR80.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x343f2b50
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x34418bb8], 0
jne 0x34414091
push 1
call sub.MSVCR80.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
leave
ret
Function at 0x344143db
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x478
mov eax, dword [0x343f2b10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x474], eax
push 0x105
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor esi, esi
cmp eax, esi
jne 0x34414417
xor eax, eax
jmp 0x3441453d
add eax, eax
lea ecx, [ebp + eax - 0x260]
cmp word [ecx], 0x5c
je 0x34414433
mov word [ecx], 0x5c
mov word [ebp + eax - 0x25e], si
push ebx
push edi
push 0x106
lea eax, [ebp - 0x260]
push eax
mov edi, 0x343f2c58
push edi
call fcn.344143b0
push 8
push esi
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, eax
cmp ebx, esi
jne 0x34414473
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
cmp ebx, esi
je 0x34414525
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x343f2c44
push ebx
call edi
push 0x343f2c24
push ebx
mov dword [ebp - 0x478], eax
call edi
cmp eax, esi
mov dword [ebp - 0x470], eax
je 0x34414525
cmp dword [ebp - 0x474], esi
mov ebx, 0x343f2c10
mov edi, 0x343f2bc0
je 0x344144fd
cmp dword [ebp - 0x478], esi
je 0x34414525
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x474]
call dword [ebp - 0x478]
cmp eax, esi
jne 0x344144f6
lea eax, [ebp - 0x46c]
push eax
lea eax, [ebp - 0x468]
push eax
push esi
push esi
lea eax, [ebp - 0x54]
push eax
push esi
push ebx
push edi
mov dword [ebp - 0x46c], 0x104
call dword [ebp - 0x470]
cmp eax, esi
je 0x34414529
cmp eax, 0x642
je 0x34414529
lea eax, [ebp - 0x46c]
push eax
lea eax, [ebp - 0x468]
push eax
push esi
push esi
push esi
push esi
push ebx
push edi
mov dword [ebp - 0x46c], 0x104
call dword [ebp - 0x470]
test eax, eax
je 0x34414529
xor eax, eax
jmp 0x3441453b
lea eax, [ebp - 0x468]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x34418e98], eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.34413b37
leave
ret 4
Function at 0x344145da
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x343f2b10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x214]
push eax
push 0x20019
xor ebx, ebx
push ebx
push 0x343f2b58
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x214], ebx
xor esi, esi
mov dword [ebp - 0x218], 0x208
mov word [ebp - 0x210], bx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x210]
push eax
push ebx
push ebx
push 0x343f2cdc
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 0x214], ebx
je 0x34414665
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x218]
cmp eax, ebx
je 0x34414690
cmp eax, 0x208
ja 0x34414690
shr eax, 1
mov esi, eax
je 0x34414690
lea eax, [ebp + esi*2 - 0x212]
cmp word [eax], 0x5c
je 0x34414690
dec esi
dec eax
dec eax
cmp esi, ebx
jne 0x34414683
push dword [ebp - 0x21c]
lea eax, [ebp - 0x210]
push eax
mov word [ebp + esi*2 - 0x210], bx
call fcn.3441454c
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.34413b37
leave
ret 4

Function at 0x344146ba
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x343f2b10]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x214]
push eax
push 0x20019
xor esi, esi
push esi
push 0x343f2c88
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x218], 0x208
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x210]
push eax
push esi
push esi
push 0x343f2c68
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [ebp - 0x218]
shr eax, 1
cmp dword [ebp - 0x214], esi
mov word [ebp + eax*2 - 0x210], si
je 0x34414742
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x105
lea eax, [ebp - 0x210]
push eax
push 0x343f2cf0
call fcn.344143b0
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, esi
pop esi
jne 0x34414774
push 0x343f277c
call fcn.344145da
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.34413b37
leave
ret