joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42b903
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x52e030]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char______cdecl_std::endl_class_std::basic_ostream_char__struct_std::char_traits_char____]
lea esi, [ebx + 8]
mov ecx, esi
mov dword [ebp - 0x40], esi
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
lea eax, [ebp - 0x20]
push eax
mov ecx, esi
call fcn.004140f8
mov eax, dword [0x536238]
test eax, eax
je 0x42b962
lea ecx, [ebp - 0x20]
push ecx
push dword [ebx + 0xa0]
push dword [ebx + 0xa8]
push dword [ebx + 0xa4]
push dword [ebx]
call eax
add esp, 0x14
test al, al
jne 0x42ba87
mov eax, dword [0x530d0c]
push 2
pop edi
cmp eax, edi
je 0x42b979
cmp eax, 3
je 0x42b979
cmp dword [ebx], edi
jl 0x42b9bf
jmp 0x42b98c
cmp dword [ebp - 0xc], 0x10
mov eax, dword [ebp - 0x20]
jae 0x42b985
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [ebp - 0xc], 0x10
mov eax, dword [ebp - 0x20]
jae 0x42b998
lea eax, [ebp - 0x20]
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push eax
push 0x508454
call esi
add eax, 0x40
push eax
call dword [sym.imp.MSVCR100.dll_fprintf]
call esi
add eax, 0x40
push eax
call dword [sym.imp.MSVCR100.dll_fflush]
add esp, 0x10
xor esi, esi
push esi
xor ecx, ecx
call fcn.0042b0b9
mov eax, dword [0x530d0c]
pop ecx
cmp eax, esi
je 0x42ba1a
cmp eax, edi
je 0x42ba1a
call fcn.0042b205
call fcn.0042b24d
test al, al
je 0x42ba15
push edi
push esi
push esi
push dword [0x536228]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [ebp - 0xc], 0x10
mov eax, dword [ebp - 0x20]
jae 0x42ba00
lea eax, [ebp - 0x20]
push esi
lea ecx, [ebp - 0x44]
push ecx
push dword [ebp - 0x10]
push eax
push dword [0x536228]
call dword [sym.imp.KERNEL32.dll_WriteFile]
call fcn.0042b22a
mov eax, dword [ebx]
cmp eax, 4
jne 0x42ba4d
call fcn.00440467
test al, al
je 0x42ba2f
call fcn.00440474
cmp dword [0x536230], esi
je 0x42ba2a
mov ecx, dword [ebp - 0x40]
lea eax, [ebp - 0x3c]
push eax
call fcn.004140f8
push eax
call dword [0x536230]
pop ecx
jmp 0x42ba7b
cmp eax, 3
jne 0x42ba87
mov ecx, dword [ebp - 0x40]
lea eax, [ebp - 0x3c]
push eax
cmp dword [0x536234], esi
je 0x42ba6f
call fcn.004140f8
push eax
call dword [0x536234]
jmp 0x42ba4a
call fcn.004140f8
mov ecx, eax
call fcn.0042b61a
push 1
xor edi, edi
lea esi, [ebp - 0x3c]
call fcn.00402dc7
push 1
xor edi, edi
lea esi, [ebp - 0x20]
call fcn.00402dc7
push dword [ebx + 0xac]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x40]
call fcn.00412800
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00475360
leave
ret
Function at 0x437af4
Capabilities:
Create process on windows
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
push 0x44
pop edi
xor ebx, ebx
push edi
mov esi, eax
lea eax, [ebp - 0x5c]
push ebx
push eax
mov dword [ebp - 8], ebx
call sub.MSVCR100.dll_memset
add esp, 0xc
mov dword [ebp - 0x5c], edi
cmp byte [esi + 8], bl
je 0x437b27
mov dword [ebp - 0x54], 0x506f40
xor eax, eax
cmp byte [esi + 1], bl
mov dword [ebp - 0x30], 1
setne al
xor edi, edi
dec eax
and eax, 5
mov word [ebp - 0x2c], ax
cmp dword [esi + 0xc], ebx
je 0x437b4a
mov edi, 0x1000004
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x437c24
push ebx
push eax
lea eax, [ebp - 4]
push eax
or edi, 0x400
mov dword [ebp - 4], ebx
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
jne 0x437b75
xor al, al
jmp 0x437c88
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x437b80
mov eax, dword [eax]
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x5c]
push ecx
movzx ecx, byte [esi + 2]
push ebx
push dword [ebp - 4]
push edi
push ecx
push ebx
push ebx
push eax
push ebx
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
cmp edi, ebx
je 0x437b6e
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x437c59
push dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
test eax, eax
jne 0x437c50
push 2
pop eax
cmp dword [0x536220], eax
jg 0x437c02
mov edi, 0x117
mov ebx, str.process_util_win.cc
lea esi, [ebp - 0x10c]
mov dword [ebp - 8], 1
call fcn.0042b7c4
add eax, 8
push str.Could_not_AssignProcessToObject.
push eax
call fcn.00403bcc
pop ecx
pop ecx
test byte [ebp - 8], 1
je 0x437c13
lea ebx, [ebp - 0x10c]
call fcn.0042b903
push 1
push dword [ebp - 0x18]
call fcn.00438033
pop ecx
pop ecx
jmp 0x437b6e
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x437c2f
mov eax, dword [eax]
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x5c]
push ecx
movzx ecx, byte [esi + 2]
push ebx
push ebx
push edi
push ecx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jmp 0x437bac
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push dword [ebp - 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
cmp byte [esi], bl
je 0x437c73
push 0xffffffffffffffff
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x437c81
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
jmp 0x437c86
push dword [ebp - 0x18]
call edi
mov al, 1
pop edi
pop esi
pop ebx
leave
ret

Function at 0x438033
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
setne bl
test bl, bl
je 0x43805f
push 0xea60
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov al, bl
pop ebx
leave
ret
Function at 0x438297
Capabilities:
Enumerate processes

Disassembly:
push edi
lea edi, [esi + 0xc]
call fcn.004382c4
cmp byte [esi + 8], 0
push edi
push dword [esi + 4]
jne 0x4382b6
mov byte [esi + 8], 1
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x4382bc
call dword [sym.imp.KERNEL32.dll_Process32NextW]
neg eax
sbb eax, eax
neg eax
pop edi
ret

Function at 0x4391c3
Capabilities:
Delete registry value

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0xb4
and dword [ebp + 0x6c], 0
xor eax, eax
push ebx
inc eax
push esi
push edi
cmp dword [0x536218], eax
jne 0x439219
cmp dword [0x536220], 3
jg 0x439219
mov ecx, dword [ebp + 0x78]
cmp dword [ecx], 0
jne 0x439219
push 3
mov dword [ebp + 0x6c], eax
pop eax
mov edi, 0x84
mov ebx, str.win_registry.cc
lea esi, [ebp - 0x44]
call fcn.0042b7c4
add eax, 8
push str.Check_failed:_key_.
push eax
call fcn.00403bcc
pop ecx
pop ecx
test byte [ebp + 0x6c], 1
je 0x43922b
and dword [ebp + 0x6c], 0xfffffffe
lea ebx, [ebp - 0x44]
call fcn.0042b903
cmp dword [0x536218], 1
jne 0x43926b
push 3
pop eax
cmp dword [0x536220], eax
jg 0x43926b
cmp dword [ebp + 0x7c], 0
jne 0x43926b
or dword [ebp + 0x6c], 2
mov edi, 0x85
mov ebx, str.win_registry.cc
lea esi, [ebp - 0x44]
call fcn.0042b7c4
add eax, 8
push str.Check_failed:_value_name.
push eax
call fcn.00403bcc
pop ecx
pop ecx
test byte [ebp + 0x6c], 2
je 0x439279
lea ebx, [ebp - 0x44]
call fcn.0042b903
push dword [ebp + 0x7c]
mov eax, dword [ebp + 0x78]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
pop edi
pop esi
pop ebx
add ebp, 0x70
leave
ret 8
Function at 0x4392cc
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x104c]
mov eax, 0x10cc
call fcn.00476090
mov eax, dword [0x52e030]
xor eax, ebp
mov dword [ebp + 0x1048], eax
mov eax, dword [ebp + 0x1054]
and dword [ebp + 0x3c], 0
xor edx, edx
push ebx
mov dword [ebp + 0x30], eax
mov eax, dword [ebp + 0x1058]
inc edx
push esi
push edi
mov dword [ebp + 0x34], eax
mov dword [ebp + 0x38], ecx
cmp dword [0x536218], edx
jne 0x439346
push 3
pop eax
cmp dword [0x536220], eax
jg 0x439346
test ecx, ecx
jne 0x439346
mov edi, 0x9a
mov ebx, str.win_registry.cc
lea esi, [ebp - 0x80]
mov dword [ebp + 0x3c], edx
call fcn.0042b7c4
add eax, 8
push str.Check_failed:_value.
push eax
call fcn.00403bcc
pop ecx
pop ecx
test byte [ebp + 0x3c], 1
je 0x439354
lea ebx, [ebp - 0x80]
call fcn.0042b903
lea eax, [ebp + 0x40]
push eax
lea eax, [ebp + 0x848]
push eax
lea eax, [ebp + 0x44]
push eax
mov eax, dword [ebp + 0x30]
push 0
push dword [ebp + 0x34]
xor esi, esi
push dword [eax]
inc esi
mov dword [ebp + 0x44], esi
mov dword [ebp + 0x40], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test edi, edi
jne 0x4393d5
cmp dword [ebp + 0x44], esi
jne 0x43939c
lea eax, [ebp + 0x848]
push eax
push dword [ebp + 0x38]
call fcn.00402ed5
jmp 0x4393d5
cmp dword [ebp + 0x44], 2
jne 0x4393d0
mov esi, 0x400
push esi
lea eax, [ebp + 0x48]
push eax
lea eax, [ebp + 0x848]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp + 0x40], eax
test eax, eax
je 0x4393c9
cmp eax, esi
ja 0x4393c9
lea eax, [ebp + 0x48]
jmp 0x439391
mov edi, 0xea
jmp 0x4393d5
mov edi, 0x3f4
mov ecx, dword [ebp + 0x1048]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00475360
add ebp, 0x104c
leave
ret 8

Function at 0x4393f1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8
and dword [ebp - 0x14], 0
xor eax, eax
push ebx
inc eax
push esi
push edi
cmp dword [0x536218], eax
jne 0x439446
cmp dword [0x536220], 3
jg 0x439446
cmp dword [ebp + 0x10], 0
jne 0x439446
push 3
mov dword [ebp - 0x14], eax
pop eax
mov edi, 0xb8
mov ebx, str.win_registry.cc
lea esi, [ebp - 0xc4]
call fcn.0042b7c4
add eax, 8
push str.Check_failed:_value.
push eax
call fcn.00403bcc
pop ecx
pop ecx
test byte [ebp - 0x14], 1
je 0x439457
lea ebx, [ebp - 0xc4]
call fcn.0042b903
and dword [ebp - 0x10], 0
push 4
pop esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
mov dword [ebp - 8], esi
push dword [eax]
mov dword [ebp - 0xc], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4394a3
cmp dword [ebp - 8], esi
je 0x43948f
cmp dword [ebp - 8], 3
jne 0x43949e
cmp dword [ebp - 0xc], esi
jne 0x43949e
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 0x10]
mov dword [edx], ecx
jmp 0x4394a3
mov eax, 0x3f4
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x43956f
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
xor ecx, ecx
push ebx
xor edx, edx
inc ecx
push esi
push edi
mov dword [ebp - 8], edx
cmp dword [0x536218], ecx
jne 0x4395c8
push 3
pop eax
cmp dword [0x536220], eax
jg 0x4395c8
cmp dword [ebp + 0x10], edx
jne 0x4395c8
cmp dword [ebp + 0x14], edx
je 0x4395c8
mov edi, 0xdd
mov ebx, str.win_registry.cc
lea esi, [ebp - 0xbc]
mov dword [ebp - 8], ecx
call fcn.0042b7c4
add eax, 8
push str.Check_failed:_data___dsize.
push eax
call fcn.00403bcc
pop ecx
pop ecx
test byte [ebp - 8], 1
je 0x4395d9
lea ebx, [ebp - 0xbc]
call fcn.0042b903
push dword [ebp + 0x14]
mov eax, dword [ebp + 8]
push dword [ebp + 0x10]
push dword [ebp + 0x18]
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
leave
ret 0x14

Function at 0x43aa83
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf8
mov eax, dword [0x52e030]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x38], eax
push edi
xor esi, esi
xor eax, eax
push 0x504b50
lea edx, [ebp - 0x24]
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x14], esi
mov word [ebp - 0x24], ax
call fcn.00441fb3
pop ecx
cmp dword [ebp - 0x14], esi
je 0x43ab78
cmp dword [ebp - 0x10], 8
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], esi
jae 0x43aadd
lea eax, [ebp - 0x24]
lea ecx, [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [0x536220], 4
mov dword [ebp - 0x2c], eax
jg 0x43ab50
cmp eax, esi
jne 0x43ab50
mov dword [ebp - 0x30], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 4
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0xf0], esi
pop eax
mov edi, 0x18d
mov ebx, str.command_line.cc
lea esi, [ebp - 0xec]
call fcn.0042b7c4
lea eax, [ebp - 0xe4]
push str.CommandLineToArgvW_failed_on_command_line:
push eax
call fcn.00403bcc
mov edx, dword [ebp - 0x34]
cmp dword [edx + 0x14], 8
pop ecx
pop ecx
jb 0x43ab47
mov edx, dword [edx]
push edx
mov ecx, eax
call fcn.0042bf60
pop ecx
test byte [ebp - 0x30], 1
je 0x43ab61
lea esi, [ebp - 0xf4]
call fcn.0042bdd6
push dword [ebp - 0x2c]
push dword [ebp - 0x28]
push dword [ebp - 0x38]
call fcn.0043a081
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 1
xor edi, edi
lea esi, [ebp - 0x24]
call fcn.00402efe
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00475360
leave
ret 4

Function at 0x43ca4f
Capabilities:
Hash data with md5

Disassembly:
and dword [eax + 0x10], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x43d752
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xb4
push ebx
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
or dword [esp + 4], 0xffffffff
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x43d79f
push str.slot_____DWORD_0xFFFFFFFF_
lea eax, [esp + 8]
push eax
push esi
call fcn.00428842
add esp, 0xc
test eax, eax
je 0x43d79f
push eax
push str.threading_thread_local_win.cc
push 0x12
pop eax
lea ebx, [esp + 0x10]
call fcn.0042b7f4
call fcn.0042b903
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43d82d
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xb4
and dword [esp], 0
push ebx
push esi
push edi
push dword [ebp + 8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x43d893
push 4
pop eax
cmp dword [0x536220], eax
jg 0x43d883
push 0x24
pop edi
mov ebx, str.threading_thread_local_win.cc
lea esi, [esp + 0x10]
mov dword [esp + 0xc], 1
call fcn.0042b7c4
add eax, 8
push str.Failed_to_TlsSetValue__.
push eax
call fcn.00403bcc
pop ecx
pop ecx
test byte [esp + 0xc], 1
je 0x43d893
lea ebx, [esp + 0x10]
call fcn.0042b903
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43d923
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x204
mov eax, dword [0x52e030]
xor eax, esp
mov dword [esp + 0x200], eax
push ebx
push esi
push edi
mov esi, ecx
push 3
xor ebx, ebx
pop edi
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], ebx
mov dword [esi], ebx
mov dword [esi + 0x18], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call fcn.0043dad1
mov dword [esi + 0x24], eax
mov dword [esp], 0x118
lea eax, [esp + 0xf0]
push ebx
push eax
mov dword [esp + 0xf4], 0x11c
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [esp + 0xe8]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov edx, dword [esp + 0xf4]
mov eax, dword [esp + 0xec]
mov ecx, dword [esp + 0xf0]
push 5
mov dword [esi + 0xc], edx
pop edx
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
cmp eax, edx
jne 0x43d9d1
cmp ecx, ebx
jle 0x43da53
xor eax, eax
cmp ecx, 1
setne al
inc eax
mov dword [esi], eax
jmp 0x43da53
cmp eax, 6
jne 0x43d9fb
cmp byte [esp + 0x202], 1
jne 0x43d9f3
sub ecx, ebx
je 0x43d9ef
dec ecx
je 0x43d9eb
mov dword [esi], eax
jmp 0x43da53
mov dword [esi], edx
jmp 0x43da53
mov dword [esi], edi
jmp 0x43da53
mov dword [esi], 4
jmp 0x43da53
jle 0x43da53
xor eax, eax
inc eax
cmp dword [0x536218], eax
jne 0x43da3b
cmp dword [0x536220], edi
jg 0x43da3b
mov dword [esp + 0xc], eax
push 0x39
mov eax, edi
pop edi
mov ebx, str.winwindows_version.cc
lea esi, [esp + 0x38]
call fcn.0042b7c4
add eax, 8
push str.Check_failed:_false.
push eax
call fcn.00403bcc
mov esi, dword [esp + 0x18]
pop ecx
pop ecx
test byte [esp + 0xc], 1
je 0x43da4b
lea ebx, [esp + 0x38]
call fcn.0042b903
mov dword [esi], 7
xor ebx, ebx
movzx eax, word [esp + 0x1fc]
mov dword [esi + 0x10], eax
movzx eax, word [esp + 0x1fe]
push 8
mov dword [esi + 0x14], eax
pop ecx
xor eax, eax
mov dword [esp + 0x14], ebx
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [esp + 0x14]
cmp eax, ebx
je 0x43daa8
cmp eax, 6
je 0x43da9f
cmp eax, 9
jne 0x43daab
mov dword [esi + 0x18], 1
jmp 0x43daab
mov dword [esi + 0x18], 2
jmp 0x43daab
mov dword [esi + 0x18], ebx
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x20c]
mov dword [esi + 0x1c], eax
mov eax, dword [esp + 0x30]
mov dword [esi + 0x20], eax
pop edi
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.00475360
mov esp, ebp
pop ebp
ret
Function at 0x440260
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebx]
sub esp, 0xc
test eax, eax
jne 0x440270
xor al, al
leave
ret
mov ecx, dword [esi]
and dword [ebp - 0xc], 0
add ecx, ecx
mov dword [ebp - 8], ecx
lea ecx, [ebp - 8]
push ecx
push edi
lea ecx, [ebp - 0xc]
push ecx
push 0
push str.Debugger
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4402c4
cmp dword [ebp - 8], eax
je 0x4402c4
cmp dword [ebp - 0xc], 1
jne 0x4402c4
mov eax, dword [esi]
xor ecx, ecx
push edi
mov word [edi + eax*2 - 2], cx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [esi], eax
mov byte [ebp - 1], 1
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 1]
leave
ret
mov byte [ebp - 1], 0
jmp 0x4402b7

Function at 0x449066
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push esi
movzx edx, byte [ebp + ecx - 4]
mov esi, eax
and esi, 0xff
xor edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x504710]
inc ecx
cmp ecx, 4
jb 0x449070
pop esi
leave
ret
Function at 0x457e6f
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x52e030]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x31
pop eax
push 0x62
mov word [ebp - 0x68], ax
lea eax, [ebp - 0x66]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x64
lea eax, [ebp - 0x68]
push eax
push str.RUNNING_ON_VALGRIND
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jle 0x457ece
push esi
push edi
push 2
pop ecx
mov edi, str.0____
lea esi, [ebp - 0x68]
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
pop edi
pop esi
je 0x457ec5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x457ece
xor eax, eax
inc eax
jmp 0x457ed0
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00475360
leave
ret

Function at 0x458ba1
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push 0x244
mov eax, 0x4dbcc9
call fcn.00475ad5
mov eax, dword [ebp + 8]
xor ebx, ebx
push ebx
push 2
mov dword [ebp - 0x24c], eax
mov dword [ebp - 0x248], ebx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x458cbb
mov esi, 0x22c
push esi
lea eax, [ebp - 0x240]
push ebx
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x240]
push eax
push edi
mov dword [ebp - 0x240], esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x458cac
mov eax, dword [ebp - 0x238]
cmp eax, dword [ebp + 0xc]
je 0x458c49
lea esi, [ebp - 0x250]
call fcn.004585dc
mov dword [ebp - 4], ebx
or dword [ebp - 0x248], 1
lea ecx, [ebp - 0x21c]
push ecx
mov ecx, dword [ebp - 0x24c]
add ecx, 0x14
push ecx
mov ecx, eax
call fcn.00458d68
pop ecx
pop ecx
mov byte [ebp - 0x241], 1
test al, al
jne 0x458c4f
mov byte [ebp - 0x241], bl
or dword [ebp - 4], 0xffffffff
test byte [ebp - 0x248], 1
je 0x458c6e
and dword [ebp - 0x248], 0xfffffffe
lea eax, [ebp - 0x250]
call fcn.004585f5
cmp byte [ebp - 0x241], bl
je 0x458c9e
push dword [ebp - 0x238]
push ebx
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, ebx
je 0x458c9e
push 0xdead
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x240]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x458c04
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00475b58
ret 8

Function at 0x458fff
Capabilities:
Allocate or change rwx memory

Disassembly:
push esi
xor esi, esi
push 0x78
push esi
push 0x53629c
mov dword [0x536290], esi
mov dword [0x536294], esi
mov dword [0x536298], esi
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x40
push 0x1000
push 0x12c
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x536294], eax
mov eax, 0x536290
pop esi
ret
Function at 0x45926e
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 0xa
push esi
call edi
mov eax, dword [ebp + 8]
lea ecx, [esi + 6]
mov word [esi], 0x25ff
push 0xa
mov dword [esi + 2], ecx
push esi
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 0xa
push esi
call edi
pop edi
leave
ret 4

Function at 0x459e8d
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp byte [ebp + 8], bl
je 0x459eb1
push 5
push ebx
push dword [ebp + 0xc]
push 0x504354
push 0x504370
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x459ee0
push esi
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 5
push ebx
push ebx
push dword [ebp + 0xc]
push 0x50437c
push ebx
call esi
cmp eax, 0x20
jge 0x459edf
push 5
push ebx
push dword [ebp + 0xc]
push str.iexplore.exe
push str.open
push ebx
call esi
pop esi
pop ebx
pop ebp
ret

Function at 0x45c06f
Capabilities:
Get file version info

Disassembly:
push 0x22c
mov eax, 0x4eb030
call fcn.00475ad5
push fcn.0045be46
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 2
xor esi, esi
push esi
call dword [sym.imp.MSVCR100.dll__set_abort_behavior]
mov edi, dword [sym.imp.MSVCR100.dll_signal]
mov ebx, 0x45bf3a
push ebx
push 0x16
call edi
push ebx
push 0xf
call edi
push 0x45bfc4
call dword [sym.imp.MSVCR100.dll__set_invalid_parameter_handler]
add esp, 0x1c
push 0x45c023
call dword [sym.imp.MSVCR100.dll__set_purecall_handler]
mov dword [esp], 0x45c005
call dword [sym.imp.MSVCR100.dll_int____cdecl___unsigned_int____cdecl__set_new_handler_int____cdecl___unsigned_int__]
xor eax, eax
mov word [ebp - 0x21c], ax
mov dword [esp], 0x206
lea eax, [ebp - 0x21a]
push esi
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x104
lea eax, [ebp - 0x21c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x45c1a5
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x21c]
push eax
mov dword [ebp - 0x224], esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
cmp edi, esi
je 0x45c1a5
mov dword [ebp - 0x234], esi
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x22c], esi
mov dword [ebp - 4], esi
lea ecx, [ebp - 0x234]
call fcn.00445209
push dword [ebp - 0x234]
lea eax, [ebp - 0x21c]
push edi
push esi
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x45c196
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x220]
push eax
push 0x50410c
push dword [ebp - 0x234]
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x45c196
mov eax, dword [ebp - 0x220]
mov ax, word [eax + 0xc]
mov word [0x536288], ax
or dword [ebp - 4], 0xffffffff
lea esi, [ebp - 0x234]
call fcn.0044525e
call fcn.00475b58
ret