joyce8/EMBER2024-capa huggingface dataset:
Function at 0x456fec
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x457197
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x457178
mov dl, 1
mov eax, dword [0x418eac]
call fcn.00403724
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.004044c0
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x457167
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.004449d8
test al, al
je 0x45715a
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x4571a8
lea eax, [ebp - 0x254]
call fcn.00409848
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x45715a
xor eax, eax
push ebp
push 0x457153
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x4571e0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x45713c
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404728
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x45713c
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404728
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45715a
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x45705d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.0041d704
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45719e
lea eax, [ebp - 0x260]
call fcn.004044c0
ret

Function at 0x457acc
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x470c2c]
cmp byte [eax + 0xa5], 0
jne 0x457b3d
cmp dword [0x470c44], 0
jne 0x457afe
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x457a88
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x470c44], eax
cmp dword [0x470c40], 0
jne 0x457b19
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x470c40], eax
cmp dword [0x470c48], 0
jne 0x457b3d
push esp
push 0
push 0
push 0x457a2c
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x470c48], eax
pop edx
ret
Function at 0x457c34
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x457c4b
add esp, 0xfffffff0
call fcn.00403ab8
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004231a8
mov eax, dword [0x46f3a0]
cmp word [eax + 2], 0
jne 0x457c73
mov eax, dword [0x46f3a0]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00459310
mov eax, dword [0x46f448]
cmp word [eax + 2], 0
jne 0x457c8d
mov eax, dword [0x46f448]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00459508
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x418904]
call fcn.00403724
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x418904]
call fcn.00403724
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0x80000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x4256e0]
call fcn.0042cfc4
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x457e14
mov eax, dword [0x46f2bc]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042d394
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x459a88
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x46f2bc]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040d1a8
test eax, eax
je 0x457d82
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.004091a4
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040d1d0
test eax, eax
je 0x457d96
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404728
mov eax, dword [0x46f18c]
cmp byte [eax], 0
jne 0x457dca
mov eax, ebx
call fcn.00457f3c
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.00459c64
mov eax, ebx
call fcn.0045a614
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x457e0a
call fcn.00403b10
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4581b0
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x470c2c]
cmp dword [eax + 0x30], 0
je 0x45825a
cmp dword [ebx + 0x94], 0
jne 0x458254
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x458140
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x458254
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45821a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x458254
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041b05c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x458229
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x458d38
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x458d6d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004045b0
jmp 0x458d7a
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404514
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x459e40
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x459e81
mov eax, esi
call fcn.00440158
test al, al
je 0x459e81
mov eax, dword [ebx + 0x84]
call fcn.0043fe54
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x459e81
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043fe54
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x45bb44
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x1c
call fcn.00403030
lea eax, [ebx + 0x14]
push eax
push 0
lea eax, [ebx + 0x10]
push eax
lea eax, [ebx + 0xc]
push eax
lea eax, [ebx + 8]
push eax
push 0
lea eax, [ebx + 4]
push eax
push ebx
push 0
push 0
push 0
mov eax, dword [esi + 4]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
sete al
mov edx, dword [0x46f5b8]
cmp byte [edx + 0xc], 0
je 0x45bba8
mov edx, dword [0x46f5b0]
cmp dword [edx], 2
jne 0x45bba8
mov edx, dword [ebx + 4]
add dword [ebx + 4], edx
mov edx, dword [ebx + 0xc]
add dword [ebx + 0xc], edx
pop esi
pop ebx
ret
Function at 0x45bbac
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x45bc64
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x44]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.0045bb44
test al, al
je 0x45bc46
mov ecx, dword [ebp - 0x1c]
inc ecx
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.004045b0
mov ebx, dword [ebp - 0x20]
dec ebx
test ebx, ebx
jl 0x45bc46
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404970
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegEnumValueA
mov eax, dword [ebp - 0xc]
call fcn.00404970
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.004046b0
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
dec ebx
jne 0x45bbff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45bc6b
lea eax, [ebp - 0x2c]
call fcn.004044c0
lea eax, [ebp - 0xc]
call fcn.004044c0
ret

Function at 0x45bdd4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.0045b8a4
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00404970
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x45be32
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x46f3b8]
mov dl, 1
mov eax, dword [0x45b79c]
call fcn.0040c5a0
call fcn.00403f20
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x45be3c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00404970
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x45be94
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x46f5c4]
mov dl, 1
mov eax, dword [0x45b79c]
call fcn.0040c5a0
call fcn.00403f20
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0045b8d4
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x45c988
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45cab1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.004044c0
cmp dword [ebp - 4], 0
jne 0x45c9d0
mov eax, dword [ebp - 8]
call fcn.004044c0
jmp 0x45ca89
mov eax, dword [ebp - 4]
call fcn.00404778
test al, al
jbe 0x45ca27
mov byte [ebp - 0x12], al
mov bl, 1
lea eax, [ebp - 0x18]
mov edi, ebx
and edi, 0xff
mov edx, dword [ebp - 4]
mov dl, byte [edx + edi - 1]
movzx ecx, si
shr ecx, 8
xor dl, cl
call fcn.004046a0
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0xc]
call fcn.00404780
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax + edi - 1]
add si, ax
imul ax, si, 0xce6d
add ax, 0x58bf
mov esi, eax
inc ebx
dec byte [ebp - 0x12]
jne 0x45c9e1
lea eax, [ebp - 0x10]
call fcn.004044c0
mov eax, dword [ebp - 0xc]
call fcn.00404778
test al, al
jbe 0x45ca7e
mov byte [ebp - 0x12], al
mov bl, 1
xor eax, eax
mov al, bl
mov edx, dword [ebp - 0xc]
mov al, byte [edx + eax - 1]
mov byte [ebp - 0x11], al
lea eax, [ebp - 0x1c]
push eax
xor eax, eax
mov al, byte [ebp - 0x11]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x45cac8
call fcn.004098c8
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0x10]
call fcn.00404780
inc ebx
dec byte [ebp - 0x12]
jne 0x45ca40
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.00404514
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45cab8
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.004044e4
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004044e4
ret
Function at 0x45cad0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x45cbeb
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.004044c0
test edi, edi
jne 0x45cb12
mov eax, dword [ebp - 4]
call fcn.004044c0
jmp 0x45cbc3
mov bl, 1
lea eax, [ebp - 0x10]
push eax
xor edx, edx
mov dl, bl
mov ecx, 3
mov eax, edi
call fcn.004049d0
xor edx, edx
mov eax, dword [ebp - 0x10]
call fcn.00408c74
mov edx, eax
lea eax, [ebp - 0x18]
call fcn.004046a0
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0xc]
call fcn.00404780
add bl, 3
mov eax, edi
call fcn.00404778
xor edx, edx
mov dl, bl
cmp eax, edx
jge 0x45cb14
lea eax, [ebp - 8]
call fcn.004044c0
mov eax, dword [ebp - 0xc]
call fcn.00404778
test al, al
jbe 0x45cbb8
mov byte [ebp - 0x11], al
mov bl, 1
lea eax, [ebp - 0x1c]
xor edx, edx
mov dl, bl
mov ecx, dword [ebp - 0xc]
mov dl, byte [ecx + edx - 1]
movzx ecx, si
shr ecx, 8
xor dl, cl
call fcn.004046a0
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 8]
call fcn.00404780
xor eax, eax
mov al, bl
mov edx, dword [ebp - 0xc]
movzx eax, byte [edx + eax - 1]
add si, ax
imul ax, si, 0xce6d
add ax, 0x58bf
mov esi, eax
inc ebx
dec byte [ebp - 0x11]
jne 0x45cb72
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00404514
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45cbf2
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.004044e4
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004044e4
ret
Function at 0x462148
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe2c
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x462202
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1d4]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
xor ebx, ebx
push 0x40
lea eax, [ebp - 0x44]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x44]
push eax
call sub.wsock32.dll_gethostbyname
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov dword [edx + 0x4c], eax
test eax, eax
je 0x4621ec
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x4621b4
push dword [edi]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
lea eax, [ebp - 4]
call fcn.004046b0
inc ebx
mov edi, dword [esi + ebx*4]
test edi, edi
jne 0x4621a2
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
add eax, 0x48
mov edx, dword [ebp - 4]
call fcn.00404514
call sub.wsock32.dll_WSACleanup
cmp dword [ebp - 4], 0
je 0x4621e6
mov eax, dword [ebp - 4]
mov edx, 0x46221c
call fcn.004048bc
jne 0x4621ea
xor ebx, ebx
jmp 0x4621ec
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462209
lea eax, [ebp - 4]
call fcn.004044c0
ret

Function at 0x4628a4
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x417f88]
call fcn.00404ec8
xor eax, eax
push ebp
push 0x4629e8
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x46de98], 0
jne 0x4628f7
mov ecx, dword [0x46f19c]
mov dl, 1
mov eax, dword [0x407a04]
call fcn.0040c564
call fcn.00403f20
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00403030
mov eax, ebx
call fcn.00404d38
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x4629f8
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.0040627c
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00404d48
test eax, eax
jle 0x46298f
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x462988
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404740
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404728
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408850
test eax, eax
jne 0x462988
mov ebx, 0x15
jmp 0x462994
mov ebx, 0x10
jmp 0x462994
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x46de98]
call fcn.004627fc
mov eax, dword [ebp - 8]
call fcn.004627fc
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00406294
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4629ef
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.004044e4
lea eax, [ebp - 0x10]
mov edx, dword [0x417f88]
call fcn.00404f98
ret
Function at 0x469150
Capabilities:
Initialize winsock library

Disassembly:
add esp, 0xfffffe70
push esp
push 0x101
call sub.wsock32.dll_WSAStartup
add esp, 0x190
ret

Function at 0x46a254
Capabilities:
Encrypt data using blowfish

Disassembly:
push esi
push edi
mov dword [0x471f28], 0x10
mov esi, 0x46e0dc
mov edi, 0x470ea0
mov ecx, 0x422
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
ret

Function at 0x46a42c
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404960
mov eax, dword [ebp - 8]
call fcn.00404960
xor eax, eax
push ebp
push 0x46a4ae
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x45b7fc]
call fcn.0045b8fc
mov ebx, eax
mov edx, 0x80000002
mov eax, ebx
call fcn.0045b99c
mov cl, 1
mov edx, 0x46a4c4
mov eax, ebx
call fcn.0045ba00
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0045bcec
mov eax, ebx
call fcn.0045b96c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46a4b5
lea eax, [ebp - 8]
mov edx, 2
call fcn.004044e4
ret

Function at 0x46b59c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404960
xor eax, eax
push ebp
push 0x46b70b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0046c418
test esi, esi
je 0x46b6f0
cmp esi, 0xd2
je 0x46b6f0
cmp esi, 0xffffff34
je 0x46b6f0
cmp esi, 0xffffffed
je 0x46b65d
mov eax, esi
sub eax, 0x3ee
je 0x46b60a
sub eax, 0x5f
je 0x46b6a5
jmp 0x46b61c
lea eax, [ebp - 4]
mov edx, 0x46b720
call fcn.00404558
jmp 0x46b6a5
push 0x30
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.00408b98
push dword [ebp - 0xc]
push 0x46b770
push dword [ebp - 4]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404838
mov eax, dword [ebp - 8]
call fcn.00404970
mov edx, eax
mov ecx, 0x46b774
mov eax, dword [0x46f434]
mov eax, dword [eax]
call fcn.004593a0
jmp 0x46b6a5
cmp byte [ebx + 0x30c], 0
je 0x46b6a5
push 0x30
lea edx, [ebp - 0x14]
mov eax, esi
call fcn.00408b98
push dword [ebp - 0x14]
push 0x46b770
push dword [ebp - 4]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404838
mov eax, dword [ebp - 0x10]
call fcn.00404970
mov edx, eax
mov ecx, 0x46b774
mov eax, dword [0x46f434]
mov eax, dword [eax]
call fcn.004593a0
push 1
push dword [ebx + 0x308]
push 0x46b78c
mov eax, dword [ebx + 0x300]
push dword [eax + 0x2cc]
push 0x46b7b0
push dword [ebx + 0x304]
lea eax, [ebp - 0x18]
mov edx, 5
call fcn.00404838
mov eax, dword [ebp - 0x18]
call fcn.00404970
push eax
call sub.kernel32.dll_WinExec
mov eax, dword [0x46f434]
mov eax, dword [eax]
call fcn.004592fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46b712
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004044e4
ret
Function at 0x46c75c
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov byte [ebp - 1], cl
mov edi, edx
mov eax, dword [0x46f5b0]
cmp dword [eax], 2
jne 0x46c809
lea eax, [ebp - 8]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x46c812
lea eax, [ebp - 0x18]
push eax
push 0x46c81c
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], 2
xor eax, eax
mov dword [ebp - 0xc], eax
xor ebx, ebx
lea eax, [ebp - 0xc]
push eax
mov esi, ebx
push esi
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
cmp byte [ebp + 8], 1
cmc
sbb eax, eax
push eax
cmp byte [ebp - 1], 1
cmc
sbb eax, eax
push eax
push edi
push 0
push 0
call sub.advapi32.dll_InitiateSystemShutdownA
test eax, eax
je 0x46c812
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
push eax
push esi
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
jmp 0x46c812
push 0
push 0xd
call sub.user32.dll_ExitWindowsEx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x805370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x80538e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x82e074
push ecx
mov edi, eax
call fcn.00819198
mov esi, eax
add esp, 8
test esi, esi
jne 0x8053cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.0081902e
push esi
call fcn.00818fb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret