joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b340
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x400
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x41c]
test edi, edi
mov esi, edi
jle 0x41b381
mov ebx, dword [esp + 0x418]
mov ebp, dword [esp + 0x414]
push 0
mov eax, ebx
sub eax, esi
push esi
add eax, edi
push eax
push ebp
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x41b38e
sub esi, eax
test esi, esi
jg 0x41b365
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x400
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
lea ecx, [esp + 0x14]
push str.SSLTray:_Socket_send_failed__d.
push ecx
call fcn.0044dd9b
lea edx, [esp + 0x1c]
push edx
call fcn.00402a90
add esp, 0x10
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x400
ret

Function at 0x41b3c0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4802f0
push 0x44e7f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x410
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x1c], esi
or ebx, 0xffffffff
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x20], esi
cmp esi, edi
jge 0x41b4a3
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], ebx
push 0
mov eax, edi
sub eax, esi
push eax
mov ecx, dword [ebp + 0xc]
lea edx, [esi + ecx]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
call fcn.0041b459
test eax, eax
jne 0x41b45a
push str.SSLTray:_Socket_closed.
call fcn.00402a90
add esp, 4
mov eax, ebx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, ebx
jne 0x41b49c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str.SSLTray:_Socket__d_recv_failed__d.
lea edx, [ebp - 0x420]
push edx
call fcn.0044dd9b
lea eax, [ebp - 0x420]
push eax
call fcn.00402a90
add esp, 0x14
mov eax, ebx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
add esi, eax
jmp 0x41b3f1
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41bd10
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc4
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov dword [esp], ecx
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ecx
push ebx
mov ebx, dword [ebp + 8]
mov dword [esp + 0x1c], ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dword [esp + 0x24], ecx
push edi
mov dword [ebx], 4
mov dword [esp + 0x2c], ecx
mov dword [eax], 0
xor eax, eax
lea edx, [esp + 0x30]
mov ecx, 0x27
lea edi, [esp + 0x30]
rep stosd dword es:[edi], eax
push edx
mov dword [esp + 0x34], 0x9c
call esi
mov edi, eax
test edi, edi
jne 0x41bd98
lea eax, [esp + 0x30]
push eax
mov dword [esp + 0x34], 0x94
call esi
test eax, eax
jne 0x41bd98
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.GetNativeSystemInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41bdbc
lea ecx, [esp + 0xc]
push ecx
call eax
jmp 0x41bdc7
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x40]
dec eax
je 0x41be7e
dec eax
jne 0x41be84
mov ecx, dword [esp + 0x34]
cmp ecx, 6
mov edx, dword [esp + 0x38]
jne 0x41bdf2
test edx, edx
jne 0x41be28
mov dword [ebx], 5
jmp 0x41be28
cmp ecx, 5
jne 0x41be1d
cmp edx, 2
jne 0x41be04
mov dword [ebx], 4
jmp 0x41be28
cmp edx, 1
jne 0x41be11
mov dword [ebx], 4
jmp 0x41be28
test edx, edx
jne 0x41be28
mov dword [ebx], 3
jmp 0x41be28
cmp ecx, 4
ja 0x41be28
mov dword [ebx], 2
test edi, edi
je 0x41be84
mov al, byte [esp + 0xca]
cmp al, 1
je 0x41be84
cmp al, 3
je 0x41be3f
cmp al, 2
jne 0x41be84
cmp ecx, 5
jne 0x41be84
cmp edx, 2
jne 0x41be84
mov eax, dword [esp + 0xc]
cmp ax, 6
jne 0x41be64
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0xc]
xor ecx, ecx
cmp ax, 9
sete cl
mov eax, 1
mov dword [edx], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebx], 1
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41be90
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x204
push ebx
push esi
push edi
xor eax, eax
mov byte [esp + 0x10], 0
mov ecx, 0x7f
lea edi, [esp + 0x11]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0
stosb byte es:[edi], al
push 0x26
lea eax, [esp + 0x18]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea edi, [esp + 0x10]
dec edi
lea ebx, [ebx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x41bed0
mov ecx, dword [0x47a868]
mov dx, word [0x47a86c]
mov dword [edi], ecx
mov word [edi + 4], dx
lea edi, [esp + 0x10]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x41bef0
mov eax, dword [str.hosts.dll]
mov ecx, dword [0x480a98]
mov dx, word [0x480a9c]
mov dword [edi], eax
lea eax, [esp + 0x10]
mov dword [edi + 4], ecx
push 0x480a90
push eax
mov word [edi + 8], dx
call fcn.0044dd88
mov ebx, dword [ebp + 8]
mov esi, eax
add esp, 8
test esi, esi
je 0x41bf4d
push esi
push 0x18
push 1
push ebx
call fcn.004501d5
push esi
mov edi, eax
call fcn.0044dc7d
add esp, 0x14
cmp edi, 0x18
je 0x41bfed
lea ecx, [esp + 0x10]
push 0x47bb78
push ecx
call fcn.0044dd88
add esp, 8
test eax, eax
mov dword [esp + 0xc], eax
push 0
jne 0x41bf84
mov byte [ebx], al
call fcn.0044dc7d
push str.Error_create_HOST_SERIAL_FILE
call fcn.00402a90
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00450440
push eax
call fcn.00450411
add esp, 8
mov esi, ebx
mov edi, 6
lea esp, [esp]
call fcn.0045041e
mov ecx, eax
imul ecx, ecx, 0x270f
mov eax, 0x80010003
imul ecx
add edx, ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
push str._.4d
push esi
call fcn.0044dd9b
add esp, 0xc
add esi, 4
dec edi
jne 0x41bfa0
mov esi, dword [esp + 0xc]
push esi
push 0x18
push 1
push ebx
call fcn.0044ea05
push esi
call fcn.0044dc7d
add esp, 0x14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41c750
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x104
push ebx
push esi
push edi
xor eax, eax
mov byte [esp + 0x10], 0
mov ecx, 0x3f
lea edi, [esp + 0x11]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp + 0x10]
test ecx, ecx
stosw word es:[edi], ax
stosb byte es:[edi], al
jle 0x41c7b7
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
lea ebx, [esp + 0x10]
sub edi, edx
sub ebx, edx
lea esp, [esp]
xor eax, eax
cmp byte [edi + edx], 0x31
sete al
mov esi, eax
xor eax, eax
cmp byte [edx], 0x31
sete al
xor eax, esi
dec eax
neg eax
sbb al, al
add eax, 0x31
mov byte [ebx + edx], al
inc edx
dec ecx
jne 0x41c790
mov ecx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
mov edx, ecx
shr ecx, 2
lea esi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x41c910
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0x20
mov edx, dword [esp + 0x3c]
xor eax, eax
xor ecx, ecx
mov dword [esp + 1], ecx
mov dword [esp + 5], ecx
mov dword [esp + 9], ecx
mov dword [esp + 0xd], ecx
mov dword [esp + 0x11], ecx
mov dword [esp + 0x15], ecx
push ebp
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x1d], ecx
mov word [esp + 0x21], cx
push esi
mov byte [esp + 8], al
mov byte [esp + 0x27], cl
push edi
jmp 0x41c950
cmp edx, 0x10
mov ecx, ebp
jae 0x41c95b
lea ecx, [esp + 0x34]
movsx esi, byte [eax + 0x481710]
mov cl, byte [esi + ecx - 1]
mov byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0x20
jl 0x41c950
cmp edx, 0x10
mov edi, dword [esp + 0x4c]
mov ecx, 8
lea esi, [esp + 0xc]
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
jb 0x41c98f
push ebp
call fcn.0044e8f9
add esp, 4
pop ebp
add esp, 0x20
ret 0x20
Function at 0x41d800
Capabilities:
Encrypt data using des

Disassembly:
push 0xffffffffffffffff
push 0x4794e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x104
push ebx
push ebp
push esi
push edi
mov ebp, ecx
xor eax, eax
xor ebx, ebx
mov byte [esp + 0x54], bl
mov ecx, 0xf
lea edi, [esp + 0x55]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov ecx, 0xf
lea edi, [esp + 0x95]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0xd4], bl
mov ecx, 0xf
lea edi, [esp + 0xd5]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 1
stosb byte es:[edi], al
lea eax, [esp + 0x58]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x150]
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push edx
mov dword [esp + 0x14c], ebx
mov byte [ecx + 4], bl
call fcn.0040af70
mov ecx, ebp
call fcn.0041d0d0
mov ecx, 8
lea esi, [esp + 0x54]
lea edi, [esp + 0x34]
rep movsd dword es:[edi], dword [esi]
mov ecx, 8
lea esi, [esp + 0x74]
lea edi, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
xor esi, esi
nop
push esi
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x3c]
push ecx
mov ecx, ebp
call fcn.0041d650
inc esi
cmp esi, 0x10
jl 0x41d8c0
mov ecx, 8
lea esi, [esp + 0x14]
lea edi, [esp + 0x94]
rep movsd dword es:[edi], dword [esi]
mov ecx, 8
lea esi, [esp + 0x34]
lea edi, [esp + 0xb4]
rep movsd dword es:[edi], dword [esi]
xor eax, eax
mov edi, edi
movsx edx, byte [eax + 0x481730]
mov cl, byte [esp + edx + 0x93]
mov byte [esp + eax + 0xd4], cl
inc eax
cmp eax, 0x40
jl 0x41d900
push 1
push 0x40
lea edx, [esp + 0xdc]
push edx
lea eax, [esp + 0x20]
push eax
mov ecx, ebp
call fcn.0041ceb0
mov ecx, dword [eax + 0x18]
mov esi, 0x10
cmp ecx, esi
jb 0x41d944
mov eax, dword [eax + 4]
jmp 0x41d947
add eax, 4
mov ecx, dword [eax]
add ebp, 0x300
mov dword [ebp], ecx
mov edx, dword [eax + 4]
mov dword [ebp + 4], edx
mov ecx, dword [eax + 8]
mov dword [ebp + 8], ecx
mov edx, dword [eax + 0xc]
cmp dword [esp + 0x2c], esi
mov dword [ebp + 0xc], edx
jb 0x41d977
mov eax, dword [esp + 0x18]
push eax
call fcn.0044e8f9
add esp, 4
cmp dword [esp + 0x13c], esi
jb 0x41d990
mov ecx, dword [esp + 0x128]
push ecx
call fcn.0044e8f9
add esp, 4
mov ecx, dword [esp + 0x114]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x110
ret 0x1c
Function at 0x41d9b0
Capabilities:
Encrypt data using des

Disassembly:
push 0xffffffffffffffff
push 0x4794e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x104
push ebx
push ebp
push esi
push edi
mov ebp, ecx
xor eax, eax
xor ebx, ebx
mov byte [esp + 0x54], bl
mov ecx, 0xf
lea edi, [esp + 0x55]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov ecx, 0xf
lea edi, [esp + 0x95]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0xd4], bl
mov ecx, 0xf
lea edi, [esp + 0xd5]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
stosb byte es:[edi], al
lea eax, [esp + 0x58]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x150]
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push edx
mov dword [esp + 0x14c], ebx
mov byte [ecx + 4], bl
call fcn.0040af70
mov ecx, ebp
call fcn.0041d0d0
mov ecx, 8
lea esi, [esp + 0x54]
lea edi, [esp + 0x34]
rep movsd dword es:[edi], dword [esi]
mov ecx, 8
lea esi, [esp + 0x74]
lea edi, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
mov esi, 0xf
push esi
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x3c]
push ecx
mov ecx, ebp
call fcn.0041d650
dec esi
cmp esi, 0xffffffff
jg 0x41da71
mov ecx, 8
lea esi, [esp + 0x14]
lea edi, [esp + 0x94]
rep movsd dword es:[edi], dword [esi]
mov ecx, 8
lea esi, [esp + 0x34]
lea edi, [esp + 0xb4]
rep movsd dword es:[edi], dword [esi]
xor eax, eax
nop
movsx edx, byte [eax + 0x481730]
mov cl, byte [esp + edx + 0x93]
mov byte [esp + eax + 0xd4], cl
inc eax
cmp eax, 0x40
jl 0x41dab0
push ebx
push 0x40
lea edx, [esp + 0xdc]
push edx
lea eax, [esp + 0x20]
push eax
mov ecx, ebp
call fcn.0041ceb0
mov ecx, dword [eax + 0x18]
mov esi, 0x10
cmp ecx, esi
jb 0x41daf3
mov eax, dword [eax + 4]
jmp 0x41daf6
add eax, 4
mov ecx, dword [eax]
mov dword [ebp + 0x310], ecx
mov edx, dword [eax + 4]
cmp dword [esp + 0x2c], esi
mov dword [ebp + 0x314], edx
jb 0x41db1a
mov eax, dword [esp + 0x18]
push eax
call fcn.0044e8f9
add esp, 4
cmp dword [esp + 0x13c], esi
jb 0x41db33
mov ecx, dword [esp + 0x128]
push ecx
call fcn.0044e8f9
add esp, 4
mov ecx, dword [esp + 0x114]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x110
ret 0x1c
Function at 0x425af0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
xor esi, esi
test edi, edi
je 0x425b53
mov al, byte [edi]
test al, al
je 0x425b53
push ebx
push ebp
mov ebx, 0x100
lea esp, [esp]
movsx eax, al
or eax, ebx
mov edx, eax
shr edx, 2
xor edx, eax
and edx, 0xf
mov ecx, 0x20
sub ecx, edx
mov ebp, esi
shr ebp, cl
mov ecx, edx
shl esi, cl
mov ecx, eax
imul ecx, eax
mov al, byte [edi + 1]
or ebp, esi
xor ebp, ecx
add ebx, 0x100
inc edi
test al, al
mov esi, ebp
jne 0x425b10
pop ebp
mov eax, esi
pop ebx
shr eax, 0x10
pop edi
xor eax, esi
pop esi
ret
pop edi
xor eax, eax
pop esi
ret
Function at 0x44e605
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
test edi, edi
jne 0x44e622
call fcn.0045074d
mov dword [eax], 0x16
xor eax, eax
jmp 0x44e68c
push esi
push 0x8c
push 1
call fcn.0044fe5b
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x44e677
push esi
call fcn.00453574
mov eax, dword [ebp + 0x14]
or dword [esi + 4], 0xffffffff
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
pop ecx
mov dword [esi + 0x4c], edi
jne 0x44e655
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x18]
push esi
push 0x44e570
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x44e68b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call fcn.0044dee5
test ebx, ebx
pop ecx
je 0x44e689
push ebx
call fcn.0045075f
pop ecx
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x44ed26
Capabilities:
Terminate process

Disassembly:
push 8
push 0x48d660
call fcn.004517b0
push 8
call fcn.0045270d
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x50b6b4], esi
jne 0x44ed5a
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x50b6b0], esi
mov al, byte [ebp + 0x10]
mov byte [0x50b6ac], al
cmp dword [ebp + 0xc], edi
jne 0x44eda4
cmp dword [0x50d16c], edi
je 0x44ed94
mov eax, dword [0x50d168]
sub eax, 4
mov dword [0x50d168], eax
cmp eax, dword [0x50d16c]
jb 0x44ed94
mov eax, dword [eax]
cmp eax, edi
je 0x44ed75
call eax
jmp 0x44ed75
push 0x49f044
mov eax, 0x49f038
call fcn.0044eca4
pop ecx
push 0x49f050
mov eax, 0x49f048
call fcn.0044eca4
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x44edd5
cmp dword [ebp + 0x10], edi
jne 0x44ede3
mov dword [0x50b6b4], esi
push dword [ebp + 8]
call fcn.0044ec62
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x44ede2
push 8
call fcn.00452658
pop ecx
ret
call fcn.004517eb
ret
Function at 0x44eea5
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.0044e0a0
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x44ef40
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x50b674]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x44ef40
cmp eax, 1
je 0x44ef61
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x44ef40
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x44ef0d
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x44ef3c
xor eax, eax
inc eax
jmp 0x44ef80
cmp edi, eax
jae 0x44ef44
xor eax, eax
jmp 0x44ef80
cmp eax, esi
jae 0x44ef4b
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x50b674]
jmp 0x44ef64
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x450a7a
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x48d780
call fcn.004517b0
mov edi, 0x94
mov eax, edi
call fcn.0044e0a0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x50b674], ecx
mov eax, dword [esi + 4]
mov dword [0x50b680], eax
mov edx, dword [esi + 8]
mov dword [0x50b684], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x50b678], esi
cmp ecx, 2
je 0x450ada
or esi, 0x8000
mov dword [0x50b678], esi
shl eax, 8
add eax, edx
mov dword [0x50b67c], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x450b15
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x450b15
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x450b2d
cmp eax, 0x20b
je 0x450b1a
mov dword [ebp - 0x1c], esi
jmp 0x450b41
cmp dword [ecx + 0x84], 0xe
jbe 0x450b15
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x450b3b
cmp dword [ecx + 0x74], 0xe
jbe 0x450b15
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.00452569
pop ecx
test eax, eax
jne 0x450b55
push 0x1c
call fcn.00450a56
pop ecx
call fcn.0045376e
test eax, eax
jne 0x450b66
push 0x10
call fcn.00450a56
pop ecx
call fcn.0045611d
mov dword [ebp - 4], esi
call fcn.0045462e
test eax, eax
jge 0x450b7f
push 0x1b
call fcn.00450a31
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x50c144], eax
call fcn.004587d5
mov dword [0x50b750], eax
call fcn.00458733
test eax, eax
jge 0x450ba5
push 8
call fcn.00450a31
pop ecx
call fcn.00458500
test eax, eax
jge 0x450bb6
push 9
call fcn.00450a31
pop ecx
push 1
call fcn.0044ecbc
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x450bcc
push eax
call fcn.00450a31
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.004584a3
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x450bed
movzx eax, word [ebp - 0x40]
jmp 0x450bf0
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.00415430
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x450c0e
push edi
call fcn.0044ede9
call fcn.0044ee0b
jmp 0x450c40
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.004517eb
ret
Function at 0x455366
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x455394
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x45539b
cmp ebx, dword [eax + 4]
jae 0x45539b
xor eax, eax
jmp 0x45558b
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x4553ac
xor eax, eax
inc eax
jmp 0x45558a
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x4553c2
cmp ecx, edx
jae 0x455507
cmp dword [eax + 4], 0
je 0x4553cb
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x4553b3
cmp dword [ebp + 8], 0
je 0x4553ed
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x455507
cmp eax, esi
jae 0x455507
mov eax, dword [0x50b8e0]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x455412
cmp dword [esi*4 + 0x50b8e8], edi
je 0x45550b
inc esi
cmp esi, eax
jl 0x455400
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x455587
cmp dword [ebp - 8], 0x1000000
jne 0x455587
test byte [ebp - 0xc], 0xcc
je 0x455490
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x455587
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x455587
cmp word [eax + 0x18], 0x10b
jne 0x455587
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x455587
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x455490
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x455490
test byte [ecx + 0x27], 0x80
jne 0x455507
push 1
push 0x50b928
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test eax, eax
jne 0x4553a4
mov ecx, dword [0x50b8e0]
test ecx, ecx
mov edx, ecx
jle 0x4554c4
lea eax, [ecx*4 + 0x50b8e4]
cmp dword [eax], edi
je 0x4554c4
dec edx
sub eax, 4
test edx, edx
jg 0x4554b8
test edx, edx
jne 0x4554f5
push 0xf
pop ebx
cmp ecx, ebx
jg 0x4554d1
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x4554e9
lea eax, [edx*4 + 0x50b8e8]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x4554d7
cmp ecx, 0x10
jge 0x4554f5
inc ecx
mov dword [0x50b8e0], ecx
push 0
push 0x50b928
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x4553a4
xor eax, eax
jmp 0x45558a
test esi, esi
jle 0x4553a4
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 1
push 0x50b928
call ebx
test eax, eax
jne 0x4553a4
cmp dword [esi*4 + 0x50b8e8], edi
je 0x455561
mov eax, dword [0x50b8e0]
lea esi, [eax - 1]
test esi, esi
jl 0x45554f
cmp dword [esi*4 + 0x50b8e8], edi
je 0x45554b
dec esi
jns 0x45553f
test esi, esi
jge 0x45555f
cmp eax, 0x10
jge 0x45555a
inc eax
mov dword [0x50b8e0], eax
lea esi, [eax - 1]
jmp 0x455561
je 0x455579
xor ecx, ecx
test esi, esi
jl 0x455579
lea eax, [ecx*4 + 0x50b8e8]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x455567
push 0
push 0x50b928
call ebx
jmp 0x4553a4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret