joyce8/EMBER2024-capa huggingface dataset:
Function at 0x442450
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x4424d2
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x4424a8
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x44249c
mov byte [ebp - 1], 0
push 1
push 1
lea eax, [ebp - 1]
push eax
push 0
call fcn.0044cb56
add esp, 0x10
jmp 0x4424a6
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
jmp 0x4424cd
push 0x38fd
push 0
push 0x2eda
push 0x779c
push 1
push 0x38c5
push 0x322e
call fcn.0043c906
add esp, 0x1c
jmp 0x4425f7
lea eax, [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x2c]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x44257a
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x442555
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x442553
push 0x45d3
push 0x65e8
push 0
push 0
push 0x5dad
call fcn.00440096
add esp, 0x14
jmp 0x442578
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x442578
push 0x217d
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4425f7
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x50]
movzx eax, byte [eax]
test eax, eax
je 0x4425e3
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x4425c4
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 1
jge 0x4425e1
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x64]
call fcn.0042de28
mov dword [eax], 0x57e8b72f
jmp 0x4425b9
jmp 0x4425f7
mov byte [ebp - 2], 0
push 1
push 0
lea eax, [ebp - 2]
push eax
call fcn.00431cfb
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x4488e0
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x44891c
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x2c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 1
call fcn.00448a63
add esp, 0x10
jmp 0x448a5f
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x448a35
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x448a24
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0x16
jmp 0x4489c0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0x36
je 0x448a22
mov dword [ebp - 0x54], 0xffffffff
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x4489e5
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jg 0x448a20
lea eax, [ebp - 0x54]
push eax
push 0
push dword [ebp - 0x58]
push 0xbe
push dword [ebp - 0x5c]
push 0x204a
push 0
call fcn.0044dc37
add esp, 0x1c
push 0
push 0x7ce6
push 1
call fcn.0044bb61
add esp, 0xc
jmp 0x4489da
jmp 0x4489b5
jmp 0x448a33
push 0
push 0xf95
push 0
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
jmp 0x448a5f
push 0xd5
push 0x4c66
push 0
push 1
push 0x1bf4
push 0x301e
push 0x4d11
push 0x456c
call fcn.00434d0e
add esp, 0x20
mov esp, ebp
pop ebp
ret
Function at 0x48097c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x48e8af
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4a1484]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0047e804
mov dword [ebp - 0x14], eax
cmp dword [0xa9b6d0], esi
jne 0x48e9a2
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x48e92f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x48ea82
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x48ea82
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48ea82
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0xa9b6d0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0xa9b6d4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0xa9b6d8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0xa9b6e0], eax
test eax, eax
je 0x48e99f
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0xa9b6dc], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x48e9c7
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x48e9ba
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x48e9dc
push 4
pop eax
jmp 0x48ea84
cmp dword [ebp - 0x14], esi
je 0x48e9dc
push dword [0xa9b6d0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x48e9c1
mov eax, dword [0xa9b6dc]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x48ea3a
cmp dword [0xa9b6e0], edi
je 0x48ea3a
push eax
call ebx
push dword [0xa9b6e0]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x48ea3a
test eax, eax
je 0x48ea3a
call ecx
test eax, eax
je 0x48ea2f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x48ea2f
test byte [ebp - 8], 1
jne 0x48ea3a
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x48ea6a
mov eax, dword [0xa9b6d4]
cmp eax, edi
je 0x48ea67
push eax
call ebx
test eax, eax
je 0x48ea67
call eax
mov esi, eax
test esi, esi
je 0x48ea67
mov eax, dword [0xa9b6d8]
cmp eax, edi
je 0x48ea67
push eax
call ebx
test eax, eax
je 0x48ea67
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0xa9b6d0]
call ebx
test eax, eax
je 0x48ea82
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x48ea84
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047dcab
mov esp, ebp
pop ebp
ret
Function at 0x4267f7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push ebx
add esp, 4
add esi, 0x1768
sub esi, 0x5d68
pop esi
push esi
and esi, 0x9f4b
xor esi, 0x946f
sub esi, 0xef17
pop esi
push ebx
push edx
add esp, 4
xor ebx, 0x127f1
pop ebx
lea edx, [ebp - 0x16cc]
mov dword [ebp - 0xc28], edx
mov eax, dword [ebp - 0x4d8]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc24], ecx
xor edx, edx
mov word [ebp - 0x1fc], dx
xor eax, eax
mov word [ebp - 0x104], ax
push edi
push edx
add esp, 4
or edi, 0x17d52
xor edi, 0xb8a2
sub edi, 0x95e4
pop edi
push esi
push edx
add esp, 4
sub esi, 0x5b7f
jmp 0x426774
jmp 0x42677a
pop esi
mov ecx, dword [ebp - 0xc24]
mov dx, word [ecx]
mov word [ebp - 0xf82], dx
mov eax, dword [ebp - 0xc24]
add eax, 2
mov dword [ebp - 0xc24], eax
mov cx, word [ebp - 0xf82]
mov word [ebp - 0x1fc], cx
mov edx, dword [ebp - 0xc28]
mov ax, word [edx]
mov word [ebp - 0xf84], ax
mov ecx, dword [ebp - 0xc28]
add ecx, 2
mov dword [ebp - 0xc28], ecx
mov dx, word [ebp - 0xf84]
mov word [ebp - 0x104], dx
push ebx
sub ebx, 0x175c1
or ebx, 0x1821
pop ebx
push edi
jmp 0x4267ea
call 0x4267f7
add byte [esi], dh
xor eax, 0x3e404f3a
xor al, 0x83
les eax, [ecx + eax*4]
invalid
add esp, 4
pop ecx
push ebx
add ebx, 0x2275
add ebx, 0x14ed6
and ebx, 0xea3f
pop ebx
mov edx, dword [ebp - 0x4d8]
mov eax, dword [edx]
mov dword [ebp - 0x4d8], eax
mov ecx, dword [ebp - 0x4d8]
cmp ecx, dword [ebp - 0xc2c]
je 0x426934
mov edx, dword [ebp - 0x4d8]
cmp dword [edx + 0x30], 0
jne 0x4266ea
mov dword [ebp - 0x6ec], 0
Function at 0x426ae9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp - 0x6f4], 0
jmp 0x426b04
Function at 0x4276d6
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x4276d6
add byte [ecx + 0x35], al
xor eax, 0x83483941
les eax, [ecx + eax*4]
int1
stosd dword es:[edi], eax
sbb al, byte [eax]
add byte [ecx + 0x64], bl
mov eax, dword [0x18]
mov dword [ebp - 0x1c34], eax
mov ecx, dword [ebp - 0x1c34]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x18d4], edx
mov eax, dword [ebp - 0x18d4]
mov dword [ebp - 0x150c], eax
push edx
push ecx
add esp, 4
or edx, 0x17e66
and edx, 0xde4d
pop edx
push edx
call 0x427729
add byte [ecx + 0x3d], al
push eax
cmp byte [esi + 0x32], cl
push eax
aaa
inc ecx
add esp, 4
xor edx, 0xf59e
and edx, 0xbf82
pop edx
cmp dword [ebp - 0x150c], 0
jne 0x427751
mov dword [ebp - 0x2a8], 0
jmp 0x4279f8
mov ecx, dword [ebp - 0x150c]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xc4c], eax
push esi
push ebx
add esp, 4
or esi, 0x64b3
pop esi
push edx
push eax
add esp, 4
sub edx, 0xdbf6
and edx, 0x178cf
jmp 0x427786
jmp 0x42778c
pop edx
push edi
xor edi, 0xb695
pop edi
cmp dword [ebp - 0xc4c], 0
jne 0x4277ad
mov dword [ebp - 0x2a8], 0
jmp 0x4279f8
mov ecx, dword [ebp - 0xc4c]
mov dword [ebp - 0x4e4], ecx
push edi
and edi, 0x1181
call 0x4277cd
add byte [ebp + edi + 0x50], cl
xor dh, byte [edx]
inc eax
xor eax, 0x8104c483
invalid
push ecx
push ecx
add esp, 4
or ecx, 0x11df2
pop ecx
push ebx
call 0x427a14
add byte [ebx], dh
inc esi
dec eax
inc esp
cmp byte [ebp + 0x3f], al
xor cl, byte [edx - 0x7d]

Function at 0x427729
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x4276d6
add byte [ecx + 0x35], al
xor eax, 0x83483941
les eax, [ecx + eax*4]
int1
stosd dword es:[edi], eax
sbb al, byte [eax]
add byte [ecx + 0x64], bl
mov eax, dword [0x18]
mov dword [ebp - 0x1c34], eax
mov ecx, dword [ebp - 0x1c34]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x18d4], edx
mov eax, dword [ebp - 0x18d4]
mov dword [ebp - 0x150c], eax
push edx
push ecx
add esp, 4
or edx, 0x17e66
and edx, 0xde4d
pop edx
push edx
call 0x427729
add byte [ecx + 0x3d], al
push eax
cmp byte [esi + 0x32], cl
push eax
aaa
inc ecx
add esp, 4
xor edx, 0xf59e
and edx, 0xbf82
pop edx
cmp dword [ebp - 0x150c], 0
jne 0x427751
mov dword [ebp - 0x2a8], 0
jmp 0x4279f8
mov ecx, dword [ebp - 0x150c]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xc4c], eax
push esi
push ebx
add esp, 4
or esi, 0x64b3
pop esi
push edx
push eax
add esp, 4
sub edx, 0xdbf6
and edx, 0x178cf
jmp 0x427786
jmp 0x42778c
pop edx
push edi
xor edi, 0xb695
pop edi
cmp dword [ebp - 0xc4c], 0
jne 0x4277ad
mov dword [ebp - 0x2a8], 0
jmp 0x4279f8
mov ecx, dword [ebp - 0xc4c]
mov dword [ebp - 0x4e4], ecx
push edi
and edi, 0x1181
call 0x4277cd
add byte [ebp + edi + 0x50], cl
xor dh, byte [edx]
inc eax
xor eax, 0x8104c483
invalid
push ecx
push ecx
add esp, 4
or ecx, 0x11df2
pop ecx
push ebx
call 0x427a14
add byte [ebx], dh
inc esi
dec eax
inc esp
cmp byte [ebp + 0x3f], al
xor cl, byte [edx - 0x7d]
Function at 0x4277cd
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x4276d6
add byte [ecx + 0x35], al
xor eax, 0x83483941
les eax, [ecx + eax*4]
int1
stosd dword es:[edi], eax
sbb al, byte [eax]
add byte [ecx + 0x64], bl
mov eax, dword [0x18]
mov dword [ebp - 0x1c34], eax
mov ecx, dword [ebp - 0x1c34]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x18d4], edx
mov eax, dword [ebp - 0x18d4]
mov dword [ebp - 0x150c], eax
push edx
push ecx
add esp, 4
or edx, 0x17e66
and edx, 0xde4d
pop edx
push edx
call 0x427729
add byte [ecx + 0x3d], al
push eax
cmp byte [esi + 0x32], cl
push eax
aaa
inc ecx
add esp, 4
xor edx, 0xf59e
and edx, 0xbf82
pop edx
cmp dword [ebp - 0x150c], 0
jne 0x427751
mov dword [ebp - 0x2a8], 0
jmp 0x4279f8
mov ecx, dword [ebp - 0x150c]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xc4c], eax
push esi
push ebx
add esp, 4
or esi, 0x64b3
pop esi
push edx
push eax
add esp, 4
sub edx, 0xdbf6
and edx, 0x178cf
jmp 0x427786
jmp 0x42778c
pop edx
push edi
xor edi, 0xb695
pop edi
cmp dword [ebp - 0xc4c], 0
jne 0x4277ad
mov dword [ebp - 0x2a8], 0
jmp 0x4279f8
mov ecx, dword [ebp - 0xc4c]
mov dword [ebp - 0x4e4], ecx
push edi
and edi, 0x1181
call 0x4277cd
add byte [ebp + edi + 0x50], cl
xor dh, byte [edx]
inc eax
xor eax, 0x8104c483
invalid
push ecx
push ecx
add esp, 4
or ecx, 0x11df2
pop ecx
push ebx
call 0x427a14
add byte [ebx], dh
inc esi
dec eax
inc esp
cmp byte [ebp + 0x3f], al
xor cl, byte [edx - 0x7d]
Function at 0x4278b8
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ecx
or ecx, 0x732c
pop ecx
push ecx
push ecx
add esp, 4
xor ecx, 0xbf6e
add ecx, 0x9e62
pop ecx
push eax
push esi
add esp, 4
and eax, 0x2362
and eax, 0x17ec3
and eax, 0xd28a
pop eax
mov ecx, dword [ebp - 0xc44]
mov dx, word [ecx]
mov word [ebp - 0xf8a], dx
mov eax, dword [ebp - 0xc44]
add eax, 2
mov dword [ebp - 0xc44], eax
mov cx, word [ebp - 0xf8a]
mov word [ebp - 0x204], cx
mov edx, dword [ebp - 0xc48]
mov ax, word [edx]
mov word [ebp - 0xf8c], ax
mov ecx, dword [ebp - 0xc48]
add ecx, 2
mov dword [ebp - 0xc48], ecx
mov dx, word [ebp - 0xf8c]
mov word [ebp - 0x38], dx
push eax
push edx
add esp, 4
or eax, 0xf712
pop eax
push ecx
call fcn.004278b8
add byte [esp + eax*2 + 0x3c], al
inc ecx
dec esp
dec edx
aaa
add esp, 4
jmp 0x4278c3
xor ecx, 0xf57c
add ecx, 0x824d
pop ecx
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x4278ed
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
sub ecx, edx
mov dword [ebp - 0x1514], ecx
jmp 0x427947
movzx eax, word [ebp - 0x204]
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x427815
movzx edx, word [ebp - 0x204]
xor edx, 0x20
movzx eax, word [ebp - 0x38]
cmp edx, eax
je 0x427815
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
jge 0x427931
mov dword [ebp - 0x1510], 0xffffffff
jmp 0x42793b
mov dword [ebp - 0x1510], 1
mov eax, dword [ebp - 0x1510]
mov dword [ebp - 0x1514], eax
cmp dword [ebp - 0x1514], 0
jne 0x427990
push edi
push edi
add esp, 4
sub edi, 0x5d7e
sub edi, 0x2512
pop edi
push edi
add edi, 0xe3b0
pop edi
push edi
push edx
add esp, 4
or edi, 0x13e48
add edi, 0x6ec6
or edi, 0xd90c
pop edi
mov ecx, dword [ebp - 0x4e4]
mov dword [ebp - 0x2a8], ecx
jmp 0x4279f8
push eax
push ebx
add esp, 4
or eax, 0x8ab1
call 0x4279aa
add byte [esi + 0x3e], al
dec esi
dec esp
cmp cl, byte [edi + 0x44]
xor eax, dword ss:[ebx - 0x177efb3c]
xlatb
pop es
add dword [eax], eax
add eax, 0x14c7e
pop eax
push ebx
jmp 0x4279c1
pop ebx
mov edx, dword [ebp - 0x4e4]
mov eax, dword [edx]
mov dword [ebp - 0x4e4], eax
mov ecx, dword [ebp - 0x4e4]
cmp ecx, dword [ebp - 0xc4c]
je 0x4279ee
mov edx, dword [ebp - 0x4e4]
cmp dword [edx + 0x30], 0
jne 0x4277b9
mov dword [ebp - 0x2a8], 0
Function at 0x4279aa
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ecx
or ecx, 0x732c
pop ecx
push ecx
push ecx
add esp, 4
xor ecx, 0xbf6e
add ecx, 0x9e62
pop ecx
push eax
push esi
add esp, 4
and eax, 0x2362
and eax, 0x17ec3
and eax, 0xd28a
pop eax
mov ecx, dword [ebp - 0xc44]
mov dx, word [ecx]
mov word [ebp - 0xf8a], dx
mov eax, dword [ebp - 0xc44]
add eax, 2
mov dword [ebp - 0xc44], eax
mov cx, word [ebp - 0xf8a]
mov word [ebp - 0x204], cx
mov edx, dword [ebp - 0xc48]
mov ax, word [edx]
mov word [ebp - 0xf8c], ax
mov ecx, dword [ebp - 0xc48]
add ecx, 2
mov dword [ebp - 0xc48], ecx
mov dx, word [ebp - 0xf8c]
mov word [ebp - 0x38], dx
push eax
push edx
add esp, 4
or eax, 0xf712
pop eax
push ecx
call fcn.004278b8
add byte [esp + eax*2 + 0x3c], al
inc ecx
dec esp
dec edx
aaa
add esp, 4
jmp 0x4278c3
xor ecx, 0xf57c
add ecx, 0x824d
pop ecx
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x4278ed
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
sub ecx, edx
mov dword [ebp - 0x1514], ecx
jmp 0x427947
movzx eax, word [ebp - 0x204]
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x427815
movzx edx, word [ebp - 0x204]
xor edx, 0x20
movzx eax, word [ebp - 0x38]
cmp edx, eax
je 0x427815
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
jge 0x427931
mov dword [ebp - 0x1510], 0xffffffff
jmp 0x42793b
mov dword [ebp - 0x1510], 1
mov eax, dword [ebp - 0x1510]
mov dword [ebp - 0x1514], eax
cmp dword [ebp - 0x1514], 0
jne 0x427990
push edi
push edi
add esp, 4
sub edi, 0x5d7e
sub edi, 0x2512
pop edi
push edi
add edi, 0xe3b0
pop edi
push edi
push edx
add esp, 4
or edi, 0x13e48
add edi, 0x6ec6
or edi, 0xd90c
pop edi
mov ecx, dword [ebp - 0x4e4]
mov dword [ebp - 0x2a8], ecx
jmp 0x4279f8
push eax
push ebx
add esp, 4
or eax, 0x8ab1
call 0x4279aa
add byte [esi + 0x3e], al
dec esi
dec esp
cmp cl, byte [edi + 0x44]
xor eax, dword ss:[ebx - 0x177efb3c]
xlatb
pop es
add dword [eax], eax
add eax, 0x14c7e
pop eax
push ebx
jmp 0x4279c1
pop ebx
mov edx, dword [ebp - 0x4e4]
mov eax, dword [edx]
mov dword [ebp - 0x4e4], eax
mov ecx, dword [ebp - 0x4e4]
cmp ecx, dword [ebp - 0xc4c]
je 0x4279ee
mov edx, dword [ebp - 0x4e4]
cmp dword [edx + 0x30], 0
jne 0x4277b9
mov dword [ebp - 0x2a8], 0
Function at 0x427a14
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x4276d6
add byte [ecx + 0x35], al
xor eax, 0x83483941
les eax, [ecx + eax*4]
int1
stosd dword es:[edi], eax
sbb al, byte [eax]
add byte [ecx + 0x64], bl
mov eax, dword [0x18]
mov dword [ebp - 0x1c34], eax
mov ecx, dword [ebp - 0x1c34]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x18d4], edx
mov eax, dword [ebp - 0x18d4]
mov dword [ebp - 0x150c], eax
push edx
push ecx
add esp, 4
or edx, 0x17e66
and edx, 0xde4d
pop edx
push edx
call 0x427729
add byte [ecx + 0x3d], al
push eax
cmp byte [esi + 0x32], cl
push eax
aaa
inc ecx
add esp, 4
xor edx, 0xf59e
and edx, 0xbf82
pop edx
cmp dword [ebp - 0x150c], 0
jne 0x427751
mov dword [ebp - 0x2a8], 0
jmp 0x4279f8
mov ecx, dword [ebp - 0x150c]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xc4c], eax
push esi
push ebx
add esp, 4
or esi, 0x64b3
pop esi
push edx
push eax
add esp, 4
sub edx, 0xdbf6
and edx, 0x178cf
jmp 0x427786
jmp 0x42778c
pop edx
push edi
xor edi, 0xb695
pop edi
cmp dword [ebp - 0xc4c], 0
jne 0x4277ad
mov dword [ebp - 0x2a8], 0
jmp 0x4279f8
mov ecx, dword [ebp - 0xc4c]
mov dword [ebp - 0x4e4], ecx
push edi
and edi, 0x1181
call 0x4277cd
add byte [ebp + edi + 0x50], cl
xor dh, byte [edx]
inc eax
xor eax, 0x8104c483
invalid
push ecx
push ecx
add esp, 4
or ecx, 0x11df2
pop ecx
push ebx
call 0x427a14
add byte [ebx], dh
inc esi
dec eax
inc esp
cmp byte [ebp + 0x3f], al
xor cl, byte [edx - 0x7d]
Function at 0x446670
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetFileAttributesA]

Function at 0x446680
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetFileAttributesW]

Function at 0x4468e0
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp dword [sym.imp.WININET.dll_InternetCrackUrlA]

Function at 0x4468f0
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp dword [sym.imp.WININET.dll_InternetCrackUrlW]

Function at 0x446cd0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp dword [sym.imp.KERNEL32.dll_SetFileAttributesA]

Function at 0x446ce0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp dword [sym.imp.KERNEL32.dll_SetFileAttributesW]

Function at 0x446d30
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp dword [sym.imp.SHELL32.dll_ShellExecuteExA]

Function at 0x446d40
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp dword [sym.imp.SHELL32.dll_ShellExecuteExW]

Function at 0x447180
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x4be3b8]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
lea eax, [ebp - 0x804]
push 0x3ff
push eax
call fcn.00406bb7
xor eax, eax
add esp, 0x14
mov word [ebp - 6], ax
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044c567
leave
ret
Function at 0x4484d1
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4484eb
test al, 0x10
je 0x4484eb
xor eax, eax
inc eax
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x448935
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x448975
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
js 0x448974
cmp dword [ebp + 0x10], 0
jl 0x448974
push edi
xor edi, edi
test esi, esi
je 0x448973
push ebx
lea ebx, [eax + 8]
inc edi
cmp edi, dword [ebp + 0x10]
jb 0x44896b
cmp dword [ebx], 0
je 0x44896b
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
add ebx, 0xc
cmp edi, esi
jb 0x448958
pop ebx
pop edi
pop esi
pop ebp
ret