joyce8/EMBER2024-capa huggingface dataset:
Function at 0x54ec8c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffdc
mov ebp, edx
mov ebx, eax
cmp dword [ebx + 0x6c], 0
jne 0x54eca4
mov eax, ebx
call fcn.0054e524
cmp dword [ebx + 0x68], 0
jne 0x54ecb1
mov eax, ebx
call fcn.0054e480
mov esi, dword [ebx + 0x6c]
test esi, esi
je 0x54ee64
cmp dword [ebx + 0x68], 0
je 0x54ee64
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
mov dword [esp], eax
mov eax, dword [ebx + 0x6c]
mov edx, dword [eax]
call dword [edx + 0x20]
mov dword [esp + 4], eax
lea edx, [esp + 0x14]
mov eax, ebx
call fcn.0054e2f0
lea eax, [esp + 0x14]
xor edx, edx
call fcn.00550a3c
cmp eax, dword [esp]
je 0x54ed33
lea eax, [esp + 0x14]
xor edx, edx
call fcn.00550a50
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x54ed0f
adc edx, 0
push edx
lea eax, [esp + 0x18]
xor edx, edx
call fcn.00550a3c
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x54ed28
adc edx, 0
push edx
lea eax, [esp + 0x1c]
push eax
call sub.user32.dll_InflateRect
mov eax, dword [ebx + 0x48]
test eax, eax
je 0x54ed46
mov eax, dword [eax + 0x10]
call fcn.0046bbe4
mov esi, eax
jmp 0x54ed49
mov esi, dword [ebx + 0x50]
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
and eax, 8
cmp eax, 8
jne 0x54ed5e
or esi, 0xffffffff
jmp 0x54ed68
push 3
push esi
call sub.user32.dll_GetWindow
mov esi, eax
mov edi, 0x610
mov edx, dword [esp + 0x14]
mov eax, dword [ebx + 0x68]
call fcn.00464b1c
mov edx, dword [esp + 0x18]
mov eax, dword [ebx + 0x68]
call fcn.00464b40
mov edx, dword [esp]
mov eax, dword [ebx + 0x68]
call fcn.00464b68
mov edx, dword [esp + 4]
mov eax, dword [ebx + 0x68]
call fcn.00464b8c
lea ecx, [esp + 8]
xor edx, edx
xor eax, eax
call fcn.00406a98
mov eax, ebp
mov byte [esp + 0x12], al
mov byte [esp + 0x10], 0
mov byte [esp + 0x11], 0
mov byte [esp + 0x13], 1
or edi, 2
or edi, 1
push edi
push 0
push 0
push 0
push 0
push esi
mov eax, dword [ebx + 0x68]
call fcn.0046bbe4
push eax
call sub.user32.dll_SetWindowPos
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x68]
call fcn.0046bbe4
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80000
or eax, 0x8000000
or eax, 0x20
push eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x68]
call fcn.0046bbe4
push eax
call sub.user32.dll_SetWindowLongA
push 2
lea eax, [esp + 0x14]
push eax
push 0x1fffffff
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebx + 0x6c]
call fcn.0042f804
call fcn.0042ad10
push eax
lea eax, [esp + 0x14]
push eax
push 0
push esi
mov eax, dword [ebx + 0x68]
call fcn.0046bbe4
push eax
mov eax, dword [0x6637e8]
mov eax, dword [eax]
call eax
push 4
mov eax, dword [ebx + 0x68]
call fcn.0046bbe4
push eax
call sub.user32.dll_ShowWindow
push esi
push 0
call sub.user32.dll_ReleaseDC
add esp, 0x24
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x54f0a4
Capabilities:
Allocate or change rwx memory
Find taskbar
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffa4
mov dword [esp], eax
mov eax, dword [esp]
xor ecx, ecx
mov edx, 0x10
call fcn.00403178
lea eax, [esp + 0x38]
push eax
call sub.kernel32.dll_GetSystemInfo
call sub.user32.dll_GetDesktopWindow
test eax, eax
je 0x54f290
push 0
push 0x54f298
push 0
push eax
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x54f290
push 0
push 0x54f2a8
push 0
push eax
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x54f290
push 0
push 0x54f2b8
push 0
push eax
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x54f290
push 0
push 0x54f2c8
push 0
push eax
call sub.user32.dll_FindWindowExA
mov ebp, eax
test ebp, ebp
je 0x54f290
push 0
push 0
push 0x418
push ebp
call sub.user32.dll_SendMessageA
mov dword [esp + 4], eax
cmp dword [esp + 4], 1
jl 0x54f290
xor eax, eax
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push ebp
call sub.user32.dll_GetWindowThreadProcessId
cmp dword [esp + 8], 0
je 0x54f290
mov eax, dword [esp + 8]
push eax
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov edi, eax
test edi, edi
je 0x54f290
push 0x40
push 0x1000
push 0x1000
push 0
push edi
call sub.kernel32.dll_VirtualAllocEx
mov esi, eax
test esi, esi
je 0x54f290
or ebx, 0xffffffff
cmp ebx, dword [esp + 4]
jge 0x54f27c
inc ebx
push esi
push ebx
push 0x417
push ebp
call sub.user32.dll_SendMessageA
test eax, eax
je 0x54f272
lea eax, [esp + 0xc]
push eax
push 0x18
lea eax, [esp + 0x1c]
push eax
push esi
push edi
call sub.kernel32.dll_ReadProcessMemory
test eax, eax
je 0x54f272
test byte [esp + 0x1d], 0xd
jne 0x54f272
mov al, byte [esp + 0x1c]
and al, 8
cmp al, 8
je 0x54f272
lea eax, [esp + 0xc]
push eax
push 4
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x2c]
push eax
push edi
call sub.kernel32.dll_ReadProcessMemory
test eax, eax
je 0x54f272
cmp dword [esp + 0xc], 0
je 0x54f272
mov eax, dword [0x663c88]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
cmp eax, dword [esp + 0x10]
jne 0x54f272
push esi
push ebx
push 0x41d
push ebp
call sub.user32.dll_SendMessageA
test eax, eax
je 0x54f24e
lea eax, [esp + 0xc]
push eax
push 0x10
mov eax, dword [esp + 8]
push eax
push esi
push edi
call sub.kernel32.dll_ReadProcessMemory
cmp dword [esp + 0xc], 0
je 0x54f27c
lea eax, [esp + 0x28]
push eax
push ebp
call sub.user32.dll_GetWindowRect
mov eax, dword [esp]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
call fcn.00406adc
jmp 0x54f27c
cmp ebx, dword [esp + 4]
jl 0x54f1b2
push 0x8000
push 0
push esi
push edi
call sub.kernel32.dll_VirtualFreeEx
push edi
call sub.kernel32.dll_CloseHandle
add esp, 0x5c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x550e3c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, eax
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
mov eax, dword [0x663c88]
mov eax, dword [eax]
call fcn.0048564c
call sub.kernel32.dll_GetTickCount_1
sub eax, ebx
cmp eax, esi
jb 0x550e47
pop esi
pop ebx
ret
Function at 0x5513bc
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffe9c
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [esp], eax
mov eax, ebx
call fcn.00409728
test al, al
je 0x551443
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 0x160
call fcn.00403178
or esi, 0x100
test esi, esi
jns 0x5513f7
call fcn.004036e4
push esi
push 0x160
lea eax, [esp + 0xc]
push eax
push 0
mov eax, ebx
call fcn.00404a98
push eax
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x551443
mov dl, 1
mov eax, dword [0x428ad4]
call fcn.00430f08
mov dword [esp], eax
mov edx, dword [esp + 4]
mov eax, dword [esp]
call fcn.00431314
mov eax, dword [esp]
mov edx, dword [eax]
call dword [edx + 0x1c]
test al, al
je 0x551443
mov eax, esp
call fcn.0040ef38
mov eax, dword [esp]
add esp, 0x164
pop esi
pop ebx
ret
Function at 0x57b960
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ecx, 0xcb201
mov eax, 0x59835c
mov edx, 0x665c98
mov bl, byte [eax]
xor bl, 0x2c
mov byte [edx], bl
inc edx
inc eax
dec ecx
jne 0x57b970
pop ebx
ret

Function at 0x57b980
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push ecx
mov esi, eax
call fcn.0057b960
xor ebx, ebx
push 0
push 0
push 2
push 0
push 1
push 0xc0000000
push esi
call sub.kernel32.dll_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x57b9cb
push 0
lea eax, [esp + 4]
push eax
push 0xcb200
push 0x665c98
push esi
call sub.kernel32.dll_WriteFile_1
test eax, eax
je 0x57b9c5
mov bl, 1
push esi
call sub.kernel32.dll_CloseHandle
mov eax, ebx
pop edx
pop esi
pop ebx
ret
Function at 0x57ef20
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x10
add esp, 0xfffff004
push eax
dec eax
jne 0x57ef29
mov eax, dword [ebp - 4]
add esp, 0xffffffec
push ebx
push esi
mov ebx, ecx
mov esi, edx
lea eax, [ebp - 0x10018]
xor ecx, ecx
mov edx, 0xffff
call fcn.00403178
mov byte [ebx], 0
push 0
push 0
push 0
push 0
push 0x57f0f4
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x57f0ea
xor eax, eax
push ebp
push 0x57f0e3
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
push 0x663564
push 2
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetSetOptionA
push 4
push 0x663564
push 5
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetSetOptionA
push 4
push 0x663564
push 6
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetSetOptionA
push 0
push 0x80c0800
push 0
push 0
mov eax, esi
call fcn.00404a98
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetOpenUrlA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x57f0c6
xor eax, eax
push ebp
push 0x57f0bf
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov dl, 1
mov eax, dword [0x41b294]
call fcn.00420650
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0x10000
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x10018]
push eax
push 0x16
mov eax, dword [ebp - 4]
push eax
call sub.wininet.dll_HttpQueryInfoA
xor eax, eax
push ebp
push 0x57f09b
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x57f046
lea edx, [ebp - 0x10018]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
mov esi, dword [eax]
call dword [esi + 0x10]
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x10018]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.wininet.dll_InternetReadFile
test eax, eax
je 0x57f068
cmp dword [ebp - 0xc], 0
ja 0x57f035
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x14]
mov edx, dword [edx + 4]
call fcn.0040462c
mov byte [ebx], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57f0a2
push 0
push 0
mov eax, dword [ebp - 0x14]
call fcn.0041fd10
mov eax, dword [ebp - 0x14]
call fcn.004037a4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57f0ea
cmp dword [ebp - 8], 0
je 0x57f0e2
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x581970
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, eax
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
mov eax, dword [0x663c88]
mov eax, dword [eax]
call fcn.0048564c
call sub.kernel32.dll_GetTickCount_1
mov edx, eax
sub edx, ebx
cmp esi, edx
jle 0x581998
cmp ebx, eax
jle 0x58197b
pop esi
pop ebx
ret
Function at 0x5858a4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
xor ebx, ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404a88
mov eax, dword [ebp - 8]
call fcn.00404a88
xor eax, eax
push ebp
push 0x585955
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x44], 0x3c
mov eax, dword [0x730ef8]
call fcn.0046bbe4
mov dword [ebp - 0x3c], eax
mov eax, 0x585964
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 4]
call fcn.00404a98
mov dword [ebp - 0x34], eax
lea edx, [ebp - 0x48]
mov eax, dword [ebp - 8]
call fcn.00408f3c
mov eax, dword [ebp - 0x48]
call fcn.00404a98
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 5
mov dword [ebp - 0x40], 0x40
xor eax, eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x44]
push eax
call sub.shell32.dll_ShellExecuteExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58595c
lea eax, [ebp - 0x48]
call fcn.004045d8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004045fc
ret

Function at 0x585c6c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x140], ecx
mov dword [ebp - 0x148], ecx
mov dword [ebp - 0x144], ecx
mov dword [ebp - 0x130], ecx
mov dword [ebp - 0x13c], ecx
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x138], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404a88
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x585de6
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
xor edx, edx
mov eax, 2
call fcn.0057010c
mov ebx, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, ebx
call fcn.0057012c
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x585db2
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00404848
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.004099b0
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00408d28
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.00408d28
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.004049e4
je 0x585d8c
lea eax, [ebp - 0x144]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00404848
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00408d28
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.00408d28
mov edx, dword [ebp - 0x148]
pop eax
call fcn.004049e4
jne 0x585da3
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov esi, eax
mov edx, edi
mov eax, ebx
call fcn.0057014c
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x585ced
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x585ded
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.004045fc
lea eax, [ebp - 4]
call fcn.004045d8
ret
Function at 0x586220
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
xor ecx, ecx
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x64], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a88
mov eax, dword [ebp - 8]
call fcn.00404a88
xor eax, eax
push ebp
push 0x586304
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x5c]
xor ecx, ecx
mov edx, 0x10
call fcn.00403178
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x44
call fcn.00403178
mov dword [ebp - 0x4c], 0x44
mov dword [ebp - 0x20], 1
mov word [ebp - 0x1c], 5
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00404a98
push eax
mov eax, dword [ebp - 4]
call fcn.00404a98
push eax
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x5862dc
call sub.kernel32.dll_GetLastError_1
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x64]
call fcn.00409228
mov ecx, dword [ebp - 0x64]
lea eax, [ebp - 0x60]
mov edx, 0x586318
call fcn.004048e4
mov eax, dword [ebp - 0x60]
call fcn.00437860
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58630b
lea eax, [ebp - 0x64]
mov edx, 2
call fcn.004045fc
lea eax, [ebp - 8]
mov edx, 2
call fcn.004045fc
ret

Function at 0x5870b4
Capabilities:
Delete internet cache
Enumerate internet cache

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a88
lea edi, [ebp - 8]
xor eax, eax
push ebp
push 0x5871ad
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [edi], eax
push edi
push 0
push 0
call sub.wininet.dll_FindFirstUrlCacheEntryA
mov eax, dword [edi]
call fcn.004027f8
mov ebx, eax
cmp dword [edi], 0
jbe 0x5870fe
mov eax, dword [edi]
mov dword [ebx], eax
push edi
push ebx
push 0
call sub.wininet.dll_FindFirstUrlCacheEntryA
mov esi, eax
test esi, esi
je 0x587180
mov eax, dword [0x663c88]
mov eax, dword [eax]
call fcn.0048564c
mov eax, dword [ebx + 0xc]
and eax, 1
cmp eax, 1
jne 0x58712f
lea eax, [ebp - 0xc]
mov edx, dword [ebx + 4]
call fcn.004047d0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00404bdc
test eax, eax
jle 0x58714c
mov eax, dword [ebp - 0xc]
call fcn.00404a98
push eax
call sub.wininet.dll_DeleteUrlCacheEntry
mov edx, dword [edi]
mov eax, ebx
call fcn.00402818
xor eax, eax
mov dword [edi], eax
push edi
push 0
push esi
call sub.wininet.dll_FindNextUrlCacheEntryA
mov eax, dword [edi]
call fcn.004027f8
mov ebx, eax
cmp dword [edi], 0
jbe 0x587174
mov eax, dword [edi]
mov dword [ebx], eax
push edi
push ebx
push esi
call sub.wininet.dll_FindNextUrlCacheEntryA
test eax, eax
jne 0x58710d
mov edx, dword [edi]
mov eax, ebx
call fcn.00402818
push esi
call sub.wininet.dll_FindCloseUrlCache
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5871b4
lea eax, [ebp - 0xc]
call fcn.004045d8
lea eax, [ebp - 4]
call fcn.004045d8
ret
Function at 0x5871bc
Capabilities:
Copy file
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00404a88
mov eax, dword [ebp - 8]
call fcn.00404a88
mov eax, dword [ebp - 0xc]
call fcn.00404a88
xor eax, eax
push ebp
push 0x58726f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.00404a98
mov esi, eax
push esi
mov eax, dword [ebp - 4]
call fcn.00404a98
push eax
push 0
call sub.URLMON.DLL_URLDownloadToFileA
test eax, eax
jne 0x58724a
mov eax, dword [ebp - 8]
call fcn.00409728
test al, al
je 0x58722d
mov eax, dword [ebp - 8]
call fcn.00409850
push 0xffffffffffffffff
mov eax, dword [ebp - 8]
call fcn.00404a98
push eax
push esi
call sub.kernel32.dll_CopyFileA
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.0040462c
jmp 0x587254
mov eax, ebx
mov edx, dword [ebp - 0xc]
call fcn.0040462c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x587276
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004045fc
ret
Function at 0x58cd4c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404a88
xor eax, eax
push ebp
push 0x58cf15
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x41af04]
call fcn.00403774
mov ebx, eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x44]
xor eax, eax
push ebp
push 0x58cee8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
push eax
push 0x141f
push 0x58cf2c
call sub.LibSSS.dll_SendUDP
mov ebx, eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x58ceb3
lea ecx, [ebp - 0x44]
xor edx, edx
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x44]
mov edx, 0x58cf48
call fcn.004049e4
jne 0x58ce86
lea ecx, [ebp - 0x48]
mov edx, 1
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x48]
call fcn.00409278
cmp eax, dword [0x6636a4]
je 0x58cede
mov dword [ebp - 0x40], 0x3c
xor eax, eax
mov dword [ebp - 0x38], eax
mov eax, 0x58cf50
mov dword [ebp - 0x34], eax
lea edx, [ebp - 0x50]
xor eax, eax
call fcn.00402ca0
mov eax, dword [ebp - 0x50]
lea edx, [ebp - 0x4c]
call fcn.004098e8
lea eax, [ebp - 0x4c]
mov edx, 0x58cf60
call fcn.004048a0
mov eax, dword [ebp - 0x4c]
call fcn.00404a98
mov dword [ebp - 0x30], eax
mov eax, 0x58cf74
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], 5
mov dword [ebp - 0x3c], 0x40
xor eax, eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x40]
push eax
call sub.shell32.dll_ShellExecuteExA
push 0
push 0
push 0x12
mov eax, esi
call fcn.0046bbe4
push eax
call sub.user32.dll_PostMessageA
jmp 0x58cede
push 0x10
mov ecx, 0x58cf78
mov edx, 0x58cf80
mov eax, dword [0x663c88]
mov eax, dword [eax]
call fcn.00485988
push 0
push 0
push 0x12
mov eax, esi
call fcn.0046bbe4
push eax
call sub.user32.dll_PostMessageA
jmp 0x58cede
push 0x10
mov ecx, 0x58cf78
mov edx, 0x58cf80
mov eax, dword [0x663c88]
mov eax, dword [eax]
call fcn.00485988
push 0
push 0
push 0x12
mov eax, esi
call fcn.0046bbe4
push eax
call sub.user32.dll_PostMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x58cef2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58cf1c
lea eax, [ebp - 0x50]
mov edx, 4
call fcn.004045fc
lea eax, [ebp - 4]
call fcn.004045d8
ret

Function at 0x58d37c
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x663e84]
mov eax, dword [eax]
call fcn.00482070
mov eax, dword [0x731144]
call fcn.00482068
push 0
mov eax, dword [0x663c88]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
ret
Function at 0x40ca36
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
xor eax, eax
push ebx
push esi
mov esi, dword [esp + 0x10]
xor ebx, ebx
inc eax
mov cl, bl
cmp esi, eax
jbe 0x40ca53
xor cl, byte [eax + edx]
inc eax
cmp eax, esi
jb 0x40ca4b
cmp cl, byte [edx]
jne 0x40ca8e
push esi
push edx
push 0xffffffffffffffff
call fcn.00405dce
not eax
mov ecx, ebx
cmp dword [ecx + 0x43e044], eax
jne 0x40ca74
cmp dword [ecx + 0x43e040], esi
je 0x40ca7f
add ecx, 0xc
inc ebx
cmp ecx, 0x48
jb 0x40ca64
jmp 0x40ca8e
imul eax, ebx, 0xc
mov ecx, dword [eax + 0x43e048]
mov eax, dword [esp + 0x14]
mov dword [eax], ecx
pop esi
pop ebx
ret 0xc

Function at 0x40e6b5
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ecx
push ecx
push ebx
push ebp
xor ebp, ebp
push edi
mov ecx, ebp
movzx eax, byte [ecx + 0x43e098]
mov byte [eax + 0x4450c8], cl
inc ecx
cmp ecx, 0x100
jl 0x40e6be
mov al, byte [ebp + 0x43e098]
mov byte [esp + 0x10], al
push 2
push dword [esp + 0x14]
mov byte [ebp*4 + 0x445dc9], al
mov byte [ebp*4 + 0x445dc8], al
mov byte [ebp*4 + 0x4459cb], al
mov byte [ebp*4 + 0x4459c8], al
mov byte [ebp*4 + 0x4455cb], al
mov byte [ebp*4 + 0x4455ca], al
mov byte [ebp*4 + 0x4451ca], al
mov byte [ebp*4 + 0x4451c9], al
call fcn.0040ef04
push 3
push dword [esp + 0x14]
mov byte [ebp*4 + 0x445dcb], al
mov byte [ebp*4 + 0x4459ca], al
mov byte [ebp*4 + 0x4455c9], al
mov byte [ebp*4 + 0x4451c8], al
call fcn.0040ef04
mov bl, byte [ebp + 0x4450c8]
push 0xb
mov byte [esp + 0x10], bl
push dword [esp + 0x10]
mov byte [ebp*4 + 0x445dca], al
mov byte [ebp*4 + 0x4459c9], al
mov byte [ebp*4 + 0x4455c8], al
mov byte [ebp*4 + 0x4451cb], al
call fcn.0040ef04
movzx edi, bl
push 9
push dword [esp + 0x10]
mov byte [ebp*4 + 0x446dca], al
mov byte [ebp*4 + 0x4469c9], al
mov byte [ebp*4 + 0x4465c8], al
mov byte [ebp*4 + 0x4461cb], al
mov byte [edi*4 + 0x447dca], al
mov byte [edi*4 + 0x4479c9], al
mov byte [edi*4 + 0x4475c8], al
mov byte [edi*4 + 0x4471cb], al
call fcn.0040ef04
push 0xd
push dword [esp + 0x10]
mov byte [ebp*4 + 0x446dc8], al
mov byte [ebp*4 + 0x4469cb], al
mov byte [ebp*4 + 0x4465ca], al
mov byte [ebp*4 + 0x4461c9], al
mov byte [edi*4 + 0x447dc8], al
mov byte [edi*4 + 0x4479cb], al
mov byte [edi*4 + 0x4475ca], al
mov byte [edi*4 + 0x4471c9], al
call fcn.0040ef04
push 0xe
push dword [esp + 0x10]
mov byte [ebp*4 + 0x446dc9], al
mov byte [ebp*4 + 0x4469c8], al
mov byte [ebp*4 + 0x4465cb], al
mov byte [ebp*4 + 0x4461ca], al
mov byte [edi*4 + 0x447dc9], al
mov byte [edi*4 + 0x4479c8], al
mov byte [edi*4 + 0x4475cb], al
mov byte [edi*4 + 0x4471ca], al
call fcn.0040ef04
mov byte [ebp*4 + 0x446dcb], al
mov byte [ebp*4 + 0x4469ca], al
mov byte [ebp*4 + 0x4465c9], al
mov byte [ebp*4 + 0x4461c8], al
inc ebp
mov byte [edi*4 + 0x447dcb], al
mov byte [edi*4 + 0x4479ca], al
mov byte [edi*4 + 0x4475c9], al
mov byte [edi*4 + 0x4471c8], al
cmp ebp, 0x100
jl 0x40e6d4
pop edi
pop ebp
pop ebx
pop ecx
pop ecx
ret