joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ee320
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x537474]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call fcn.004c4a7c
add esp, 4
mov byte [ebp - 0x108], 0
test eax, eax
je 0x4ee384
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [ebp - 0x108], 0
je 0x4ee384
lea eax, [ebp - 0x108]
push eax
call dword [0x537e7c]
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00497ebf
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.00497ebf
mov esp, ebp
pop ebp
ret

Function at 0x4ee3a0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004ee320
Function at 0x4f1580
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi]
cmp dword [eax + 4], 2
jne 0x4f15ac
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x4f159d
pop edi
xor eax, eax
pop esi
pop ebp
ret
push dword [eax + 8]
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call ecx
jmp 0x4f15e0
cmp dword [esi + 8], 0
jne 0x4f15d0
push 0x506ff0
push dword [eax + 8]
call fcn.004a4dc7
add esp, 8
mov dword [esi + 8], eax
test eax, eax
jne 0x4f15d0
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret
push dword [esi + 8]
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call fcn.004a4ff1
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x4f1602
mov eax, dword [esi + 8]
test eax, eax
je 0x4f15fc
push eax
call fcn.004a4b42
add esp, 4
mov dword [esi + 8], edi
mov eax, dword [esi]
mov eax, dword [eax]
mov dword [esi], eax
mov eax, edi
pop edi
pop esi
pop ebp
ret

Function at 0x4f20b0
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [ebp + 0xc]
push edi
lea ecx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x4f20c0
sub esi, ecx
lea eax, [esi + esi]
push eax
mov dword [ebp - 0xc], eax
call dword [0x537e70]
mov edi, eax
add esp, 4
test edi, edi
jne 0x4f20e8
lea eax, [edi + 0x1b]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push esi
push dword [ebp + 0xc]
push edi
call fcn.004f2340
add esp, 0xc
lea eax, [ebp - 8]
push 0xf0000000
push 1
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov esi, dword [ebp + 0x10]
test eax, eax
je 0x4f2167
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x8002
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x4f215c
push 0
push dword [ebp - 0xc]
mov dword [ebp - 0x10], 0x10
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
push 0
lea eax, [ebp - 0x10]
push eax
push esi
push 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esi + 0x10], 0
push edi
mov byte [esi + 0x14], 0
call dword [0x537e74]
add esp, 4
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4f23b0
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x537474]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x1c]
push edi
mov edi, dword [ebp + 0x10]
push 0xf0000000
push 1
push 0
push 0
push eax
mov dword [ebp - 0x20], 8
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x4f2447
lea eax, [ebp - 0xc]
mov dword [ebp - 8], 0
push eax
xorps xmm0, xmm0
movups xmmword [ebp - 0x18], xmm0
push edi
mov word [ebp - 0x18], 0x208
mov dword [ebp - 0x14], 0x6601
mov dword [ebp - 0x10], 8
call fcn.004f24b0
lea eax, [ebp - 0xc]
push 8
push eax
call fcn.004f64b0
add esp, 0x10
lea eax, [ebp - 0x24]
push eax
push 0
push 0
push 0x14
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x4f2459
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00497ebf
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
push dword [ebp - 0x20]
mov eax, dword [ecx]
mov dword [esi], eax
mov eax, dword [ecx + 4]
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push eax
push esi
push 0
push 0
push 0
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push 0
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.00497ebf
mov esp, ebp
pop ebp
ret

Function at 0x4f4aa0
Capabilities:
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0xf0000000
push 1
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x4f4ad2
lea eax, [esi + 4]
push eax
push 0
push 0
push 0x8003
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
pop esi
pop ebp
ret

Function at 0x4f4c30
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push esi
push edi
mov byte [edi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
mov byte [edi + esi - 1], 0
test eax, eax
jne 0x4f4c63
push 0x2e
push edi
call fcn.0049f510
add esp, 8
test eax, eax
je 0x4f4c61
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
pop ebp
ret
Function at 0x4f6380
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [0x537e70]
mov edi, eax
add esp, 4
test edi, edi
jne 0x4f63ad
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0x4f63f4
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push dword [ebp + 0xc]
push dword [edi + 4]
call eax
mov eax, dword [edi + 8]
add eax, dword [esi + 0xc]
push dword [edi + 4]
mov dword [ebp - 4], eax
push eax
mov eax, dword [esi + 8]
call eax
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov dword [ebp + 0x10], ebx
jmp 0x4f63fa
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push dword [edi + 4]
mov eax, dword [esi]
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [ebp + 0x10]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x4f645b
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], eax
nop word [eax + eax]
movzx eax, byte [ebx]
xor al, 0x36
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
xor al, 0x5c
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub dword [ebp + 0x10], 1
jne 0x4f6420
mov ebx, dword [ebp - 8]
cmp ebx, dword [esi + 0x10]
jae 0x4f6487
mov eax, dword [esi + 4]
push 1
push str.6digit
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x5251c7
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x4f6460
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x461bb4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404aa4
xor eax, eax
push ebp
push 0x461cfc
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00409320
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.004086ac
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
call fcn.004048b4
mov ecx, eax
mov edx, 2
mov eax, dword [ebp - 0xc]
call fcn.00404b14
mov eax, dword [ebp - 0xc]
mov edx, 0x461d14
call fcn.00404a00
jne 0x461c2a
lea eax, [ebp - 0xc]
mov edx, 0x461d20
call fcn.0040468c
mov eax, dword [ebp - 0xc]
call fcn.00404ab4
mov ebx, eax
lea ecx, [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00409220
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 4]
call fcn.0040468c
push ebx
mov eax, dword [ebp - 4]
call fcn.00404ab4
push eax
mov eax, dword [0x476668]
push eax
call sub.KERNEL32.DLL_FindResourceA
mov edi, eax
push edi
mov eax, dword [0x476668]
push eax
call sub.KERNEL32.DLL_LoadResource
mov ebx, eax
test ebx, ebx
jne 0x461c99
lea eax, [ebp - 0x18]
mov ecx, dword [ebp - 4]
mov edx, 0x461d30
call fcn.00404900
mov ecx, dword [ebp - 0x18]
mov dl, 1
mov eax, dword [0x415a8c]
call fcn.0040c5cc
call fcn.00403fac
push ebx
call sub.KERNEL32.DLL_LockResource
mov dword [ebp - 8], eax
mov eax, esi
call fcn.0041b088
push edi
mov eax, dword [0x476668]
push eax
call sub.KERNEL32.DLL_SizeofResource
mov ecx, eax
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.0041ab6c
xor ecx, ecx
xor edx, edx
mov eax, esi
mov esi, dword [eax]
call dword [esi + 0x14]
mov eax, ebx
call fcn.0040741c
push ebx
call sub.KERNEL32.DLL_FreeResource
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461d03
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.00404618
lea eax, [ebp - 4]
call fcn.004045f4
ret

Function at 0x465550
Capabilities:
Query environment variable

Disassembly:
push ebx
add esp, 0xfffffc00
mov ebx, eax
mov eax, ebx
call fcn.004045f4
call fcn.00463cc4
test al, al
je 0x46558a
push 0x400
lea eax, [esp + 4]
push eax
push 0x465594
call sub.KERNEL32.DLL_GetEnvironmentVariableA
test eax, eax
je 0x46558a
mov edx, ebx
mov eax, esp
call fcn.0040964c
add esp, 0x400
pop ebx
ret
Function at 0x465640
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404aa4
xor eax, eax
push ebp
push 0x465788
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00409320
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.004086ac
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
call fcn.004048b4
mov ecx, eax
mov edx, 2
mov eax, dword [ebp - 0xc]
call fcn.00404b14
mov eax, dword [ebp - 0xc]
mov edx, 0x4657a0
call fcn.00404a00
jne 0x4656b6
lea eax, [ebp - 0xc]
mov edx, 0x4657ac
call fcn.0040468c
mov eax, dword [ebp - 0xc]
call fcn.00404ab4
mov ebx, eax
lea ecx, [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00409220
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 4]
call fcn.0040468c
push ebx
mov eax, dword [ebp - 4]
call fcn.00404ab4
push eax
mov eax, dword [0x476668]
push eax
call sub.KERNEL32.DLL_FindResourceA
mov edi, eax
push edi
mov eax, dword [0x476668]
push eax
call sub.KERNEL32.DLL_LoadResource
mov ebx, eax
test ebx, ebx
jne 0x465725
lea eax, [ebp - 0x18]
mov ecx, dword [ebp - 4]
mov edx, 0x4657bc
call fcn.00404900
mov ecx, dword [ebp - 0x18]
mov dl, 1
mov eax, dword [0x415a8c]
call fcn.0040c5cc
call fcn.00403fac
push ebx
call sub.KERNEL32.DLL_LockResource
mov dword [ebp - 8], eax
mov eax, esi
call fcn.0041b088
push edi
mov eax, dword [0x476668]
push eax
call sub.KERNEL32.DLL_SizeofResource
mov ecx, eax
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.0041ab6c
xor ecx, ecx
xor edx, edx
mov eax, esi
mov esi, dword [eax]
call dword [esi + 0x14]
mov eax, ebx
call fcn.0040741c
push ebx
call sub.KERNEL32.DLL_FreeResource
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46578f
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.00404618
lea eax, [ebp - 4]
call fcn.004045f4
ret

Function at 0x467c88
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404aa4
xor eax, eax
push ebp
push 0x467d06
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404ab4
mov dword [ebp - 8], eax
cmp dword [ebx + 8], 0
jne 0x467cd1
mov eax, dword [ebx + 4]
call fcn.00404ab4
push eax
push 0
call sub.advapi32.dll_RegisterEventSourceA
mov dword [ebx + 8], eax
push 0
lea eax, [ebp - 8]
push eax
push 0
push 1
push 0
mov eax, dword [ebp + 8]
push eax
mov ax, word [ebp + 0xc]
push eax
push esi
mov eax, dword [ebx + 8]
push eax
call sub.advapi32.dll_ReportEventA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x467d0d
lea eax, [ebp - 4]
call fcn.004045f4
ret
Function at 0x468e8c
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp word [eax + 0xb2], 0
je 0x468eb8
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0xb4]
call dword [esi + 0xb0]
push 0xf01ff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00404ab4
push eax
push ebx
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x468edd
call fcn.0040dd20
xor eax, eax
push ebp
push 0x468f14
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_DeleteService
test eax, eax
jne 0x468efd
call fcn.0040dd20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x468f1b
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret

Function at 0x46b470
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x14c], edx
mov dword [ebp - 0x150], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404aa4
xor eax, eax
push ebp
push 0x46b559
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.004086ac
mov edx, dword [ebp - 0x148]
lea eax, [ebp - 4]
call fcn.0040468c
xor ebx, ebx
lea eax, [ebp - 0x144]
push eax
push 0x46b568
call sub.KERNEL32.DLL_FindFirstFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x46b533
or eax, 0xffffffff
lea eax, [ebp - 0x150]
lea edx, [ebp - 0x118]
mov ecx, 0x104
call fcn.00404864
mov eax, dword [ebp - 0x150]
lea edx, [ebp - 0x14c]
call fcn.004086ac
mov eax, dword [ebp - 0x14c]
mov edx, dword [ebp - 4]
call fcn.00404a00
jne 0x46b51c
mov bl, 1
jmp 0x46b52d
lea eax, [ebp - 0x144]
push eax
push esi
call sub.KERNEL32.DLL_FindNextFileA
test eax, eax
jne 0x46b4e1
push esi
call sub.KERNEL32.DLL_FindClose
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46b560
lea eax, [ebp - 0x150]
mov edx, 3
call fcn.00404618
lea eax, [ebp - 4]
call fcn.004045f4
ret
Function at 0x46bc2c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404aa4
xor eax, eax
push ebp
push 0x46bd6b
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
cmp dword [0x475994], 0
je 0x46bd48
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.00409320
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.004086ac
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
call fcn.004048b4
mov ecx, eax
mov edx, 2
mov eax, dword [ebp - 0x10]
call fcn.00404b14
mov eax, dword [ebp - 0x10]
mov edx, 0x46bd84
call fcn.00404a00
jne 0x46bcb9
lea eax, [ebp - 0x10]
mov edx, 0x46bd90
call fcn.0040468c
mov eax, dword [ebp - 0x10]
call fcn.00404ab4
mov ebx, eax
lea ecx, [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00409220
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 4]
call fcn.0040468c
push ebx
mov eax, dword [ebp - 4]
call fcn.00404ab4
push eax
mov eax, dword [0x475994]
push eax
call sub.KERNEL32.DLL_FindResourceA
mov edi, eax
push edi
mov eax, dword [0x475994]
push eax
call sub.KERNEL32.DLL_LoadResource
mov ebx, eax
test ebx, ebx
je 0x46bd48
push ebx
call sub.KERNEL32.DLL_LockResource
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
call fcn.0041b088
push edi
mov eax, dword [0x475994]
push eax
call sub.KERNEL32.DLL_SizeofResource
mov ecx, eax
mov edx, dword [ebp - 0xc]
mov eax, dword [esi]
call fcn.0041ab6c
mov eax, dword [esi]
xor ecx, ecx
xor edx, edx
mov esi, dword [eax]
call dword [esi + 0x14]
mov eax, ebx
call fcn.0040741c
push ebx
call sub.KERNEL32.DLL_FreeResource
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46bd72
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00404618
lea eax, [ebp - 4]
call fcn.004045f4
ret

Function at 0x4713ac
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
xor eax, eax
push ebp
push 0x471455
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x471468
call fcn.0040468c
mov eax, dword [0x475cb8]
mov eax, dword [eax]
mov edx, 0x471478
call fcn.00404a00
jne 0x4713f0
lea eax, [ebp - 4]
mov edx, 0x471484
call fcn.0040468c
lea eax, [ebp - 8]
mov edx, 0x471490
call fcn.0040468c
push 8
push 0
push 0
push 0x4714a0
push dword [ebp - 4]
push 0x4714c0
push dword [ebp - 8]
push 0x4714e8
lea eax, [ebp - 0xc]
mov edx, 5
call fcn.00404974
mov eax, dword [ebp - 0xc]
call fcn.00404ab4
push eax
push 0x4714f0
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47145c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404618
ret
Function at 0x472238
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
mov ebx, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x472357
push dword fs:[edx]
mov dword fs:[edx], esp
call fcn.0047211c
mov dl, 1
mov eax, dword [0x4162b8]
call fcn.004037f0
mov dword [ebp - 4], eax
test bl, bl
je 0x4722ae
lea edx, [ebp - 0x14]
mov eax, esi
call fcn.00408b64
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, 0x47236c
call fcn.00404900
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0xc]
mov edx, 0x27ac40
call fcn.0046e948
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
jmp 0x4722cb
lea ecx, [ebp - 0x18]
mov edx, 0x27ac40
mov eax, 0x47236c
call fcn.0046e948
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
push 0x472380
call fcn.0040a7ac
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0x20]
mov eax, 0x4723a4
call fcn.0040b428
push dword [ebp - 0x20]
push 0x4723b8
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00404974
mov edx, dword [ebp - 0x1c]
lea ecx, [ebp - 8]
mov eax, dword [0x476e34]
call fcn.0045f810
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x74]
lea eax, [ebp - 4]
call fcn.0040e27c
push 8
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00404ab4
push eax
push 0x4723c0
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47235e
lea eax, [ebp - 0x20]
mov edx, 7
call fcn.00404618
ret

Function at 0x4723e8
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4724c3
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
mov dl, 1
mov eax, dword [0x431a74]
call fcn.00431b74
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4724a3
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000001
mov eax, dword [ebp - 8]
call fcn.00431c14
mov cl, 1
mov edx, 0x4724dc
mov eax, dword [ebp - 8]
call fcn.00431c78
test al, al
je 0x472491
xor eax, eax
push ebp
push 0x47246d
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0xc]
mov edx, 0x472514
mov eax, dword [ebp - 8]
call fcn.0043203c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47247f
cmp dword [ebp - 0xc], 0
je 0x472489
mov byte [ebp - 1], 1
mov eax, dword [ebp - 8]
call fcn.00431be4
mov eax, dword [ebp - 8]
call fcn.00403820
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4724ad
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4724ca
lea eax, [ebp - 0xc]
call fcn.004045f4
ret
Function at 0x582580
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x12b000]
push edi
jmp 0x58259a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5825a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x582590
mov eax, 1
add ebx, ebx
jne 0x5825b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5825c4
jne 0x5825e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5825e3
dec eax
add ebx, ebx
jne 0x5825d0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5825a8
add ebx, ebx
jne 0x5825df
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x582635
xor ecx, ecx
sub eax, 3
jb 0x5825fb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x58266a
sar eax, 1
mov ebp, eax
jmp 0x582606
add ebx, ebx
jne 0x582606
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5825d4
inc ecx
add ebx, ebx
jne 0x582614
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5825d4
add ebx, ebx
jne 0x582621
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x582616
jne 0x582632
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x582616
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x582654
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x582646
jmp 0x582596
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x582654
add edi, ecx
jmp 0x582596
pop esi
mov edi, esi
mov ecx, 0x3ea9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x582672
cmp byte [edi], 0x11
jne 0x582672
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x582677
lea edi, [esi + 0x17b000]
mov eax, dword [edi]
or eax, eax
je 0x5826ef
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x22b6f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x22b894]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5826a4
mov ecx, edi
jns 0x5826d3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x22b89c]
or eax, eax
je 0x5826e9
mov dword [ebx], eax
add ebx, 4
jmp 0x5826c1
call dword [esi + 0x22b898]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x582720
cmp al, 0xef
ja 0x582713
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x5826f5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x582702
mov ebp, dword [esi + 0x22b8a0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x582754
sub esp, 0xffffff80
jmp 0x42800a