joyce8/EMBER2024-capa huggingface dataset:
Function at 0xf02e10
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x9f000]
push edi
jmp 0xf02e2a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xf02e31
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xf02e20
mov eax, 1
add ebx, ebx
jne 0xf02e43
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xf02e54
jne 0xf02e73
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xf02e73
dec eax
add ebx, ebx
jne 0xf02e60
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xf02e38
add ebx, ebx
jne 0xf02e6f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xf02ec5
xor ecx, ecx
sub eax, 3
jb 0xf02e8b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xf02efa
sar eax, 1
mov ebp, eax
jmp 0xf02e96
add ebx, ebx
jne 0xf02e96
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xf02e64
inc ecx
add ebx, ebx
jne 0xf02ea4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xf02e64
add ebx, ebx
jne 0xf02eb1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xf02ea6
jne 0xf02ec2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xf02ea6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xf02ee4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xf02ed6
jmp 0xf02e26
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xf02ee4
add edi, ecx
jmp 0xf02e26
pop esi
mov edi, esi
mov ecx, 0x3f93
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xf02f02
cmp byte [edi], 0x28
jne 0xf02f02
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xf02f07
lea edi, [esi + 0xaea000]
mov eax, dword [edi]
or eax, eax
je 0xf02f7f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xb0554c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xb056b4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xf02f34
mov ecx, edi
jns 0xf02f63
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xb056b8]
or eax, eax
je 0xf02f79
mov dword [ebx], eax
add ebx, 4
jmp 0xf02f51
call dword [esi + 0xb056c8]
mov ebp, dword [esi + 0xb056bc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xf02fb3
sub esp, 0xffffff80
jmp 0x487014
Function at 0x401112
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
lea eax, [ebp - 4]
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SoftwareMicrosoftNET_Framework_SetupNDP_v4Full
push 0x80000002
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40113f
xor al, al
jmp 0x401168
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40115d
mov bl, 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
leave
ret
Function at 0x405d78
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41f288]
jne 0x405d82
repz ret
jmp fcn.00409064

Function at 0x4134dc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040d2f5
and dword [ebp - 4], 0
cmp dword [0x4211f4], 0
mov ebx, eax
jne 0x41358d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41363e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x418954
push edi
call esi
test eax, eax
je 0x41363e
push eax
call fcn.0040d283
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4211f4], eax
call esi
push eax
call fcn.0040d283
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4211f8], eax
call esi
push eax
call fcn.0040d283
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4211fc], eax
call esi
push eax
call fcn.0040d283
pop ecx
mov dword [0x421204], eax
test eax, eax
je 0x41358d
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040d283
pop ecx
mov dword [0x421200], eax
mov eax, dword [0x421200]
cmp eax, ebx
je 0x4135e5
cmp dword [0x421204], ebx
je 0x4135e5
push eax
call fcn.0040d2fe
push dword [0x421204]
mov esi, eax
call fcn.0040d2fe
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4135e5
test edi, edi
je 0x4135e5
call esi
test eax, eax
je 0x4135dc
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4135dc
test byte [ebp - 0xc], 1
jne 0x4135e5
or dword [ebp + 0x10], 0x200000
jmp 0x41361e
mov eax, dword [0x4211f8]
cmp eax, ebx
je 0x41361e
push eax
call fcn.0040d2fe
pop ecx
test eax, eax
je 0x41361e
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41361e
mov eax, dword [0x4211fc]
cmp eax, ebx
je 0x41361e
push eax
call fcn.0040d2fe
pop ecx
test eax, eax
je 0x41361e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4211f4]
call fcn.0040d2fe
pop ecx
test eax, eax
je 0x41363e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x413640
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x431000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x431072
nop
mov ebx, 0x40915c
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x9467b7f
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
loop 0x431060
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
je 0x4310d2
nop
nop
nop
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x2821150a
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4310c0
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x40569c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push edi
mov edi, eax
test edx, edx
jne 0x4056a7
xor eax, eax
pop edi
ret
or eax, 0xffffffff
push esi
mov ecx, 0xff
cmp edi, 8
jb 0x40575a
mov esi, edi
shr esi, 3
push ebx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4152e8]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4152e8]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4152e8]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4152e8]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4152e8]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4152e8]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4152e8]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4152e8]
inc edx
sub edi, 8
dec esi
jne 0x4056bf
pop ebx
test edi, edi
je 0x405773
movzx esi, byte [edx]
xor esi, eax
and esi, ecx
shr eax, 8
xor eax, dword [esi*4 + 0x4152e8]
inc edx
dec edi
jne 0x40575e
pop esi
not eax
pop edi
ret

Function at 0x41dbef
Capabilities:
Hash data using murmur3

Disassembly:
cld
push dword [esp + 8]
rep movsb byte es:[edi], byte [esi]
bsr edi, ebx
rol di, 0xd
bsr si, sp
mov edi, dword [esp + 0x44]
not si
add si, 0x1a23
mov esi, dword [esp + 0x48]
jmp 0x41f707
cld
test cx, 0x466f
push dword [esp + 0x4c]
popfd
mov byte [esp], 0xe7
mov word [esp + 4], 0x7d7
mov word [esp], 0x752e
lea esp, [esp + 0x50]
jmp 0x4223ef

Function at 0x44b401
Capabilities:
Execute anti-debugging instructions

Disassembly:
jns 0x4b3ce7
nop
pushfd
xchg dword [esp], ebp
push 0x61817e18
pushfd
pushal
mov ebp, 0x40786f
push 0x44b0323a
mov byte [esp], 0x9f
jmp 0x46798b
pushfd
mov ebp, dword [ebp + 0x860ce]
push esp
mov word [esp + 0xc], 0x8b7f
mov byte [esp + 0x18], ch
pushfd
lea ebp, [ebp + 0xd1800e2]
pushfd
mov word [esp], dx
pushfd
call fcn.004b41bb
push ebp
jmp 0x46e01e

Function at 0x4679b0
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x58]
jb 0x4695e8
inc dl
lea eax, [eax - 0x62e684b6]
push 0x62f1d193
dec dword [esi + 0x28]
rdtsc
cwde
pushfd
not bh
mov byte [ebp - 1], 1
lea ebx, [edx*8 + 0x19b50521]
jmp 0x45107d
mov edx, dword [esi]
lahf
bswap ax
bswap ax
mov eax, dword [edx + 8]
jmp 0x458475
mov ecx, esi
pushal
pushfd
call fcn.0044cfb2
rdtsc
mov ebx, dword [esp + 8]
jmp 0x448f2f
jmp 0x44c2a4
cmc
stc
cmp edx, eax
jmp 0x43dfeb
Function at 0x47eb7d
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x40]
jb 0x4695e8
lahf
not cl
movzx ax, cl
rdtsc
dec dword [esi + 0x28]
rdtsc
mov byte [ebp - 1], 1
bswap ax
mov bx, 0x84dc
movsx bx, al
movzx edx, al
pop ebx
not al
mov edx, dword [esi]
pushal
push ecx
movzx ax, dl
bswap eax
mov eax, dword [edx + 8]
bswap cx
pushal
movsx ecx, cl
mov ecx, esi
jmp 0x49fa58
cmp al, 9
cmp bx, bx
add ecx, 0xc
cmc
test ax, si
cmc
cmc
cmp edx, eax
push dword [esp + 8]
mov byte [esp + 8], ch
jmp 0x46014f
lea esp, [esp + 0x3c]
jno 0x4c401b
pushal
pushfd
xchg dword [esp + 0x24], edx
push dword [esp]
pushfd
push esp
push dword [esp + 0x30]
ret 0x34
pushfd
pushfd
pushfd
mov dword [esp + 0x4c], 0x4629f7
pushfd
call fcn.004a676d
pushfd
lea edx, [edx + 0x3865a8c9]
jmp 0x48ebb3

Function at 0x499a31
Capabilities:
Encode data using xor

Disassembly:
add byte [edi], cl
adc ebx, 0x14
add byte [eax], al
pushal
push esp
pushfd
mov dword [esp + 0x24], 0x7e8ce2e3
pushal
push dword [esp + 4]
call fcn.004c16d1
not ebp
mov ebp, 0x410a88
call fcn.004793d7
add ebp, dword [ecx]
loop 0x4999e1
loop 0x499a99
adc dword [ebx], 0x9bd6f76f
wait
push 0x7f
push ss
clc
push ds
mov dword [ebx + 0x12], esp
or al, dl
scasb al, byte es:[edi]
jae 0x4999e8
sbb byte [ebx - 0x1a], ch
or byte [ebx - 0x38], 0xb0
push eax
cmpsb byte [esi], byte es:[edi]
cmp byte [edx + 0x7b449ba2], bh
dec ebp
jecxz 0x499a3f
test al, 0x2a
inc eax
jecxz 0x499a7b
mov ebp, dword [edx + 0xe187fd1]
mov dword [esi], ebx
arpl bp, bp
push es
push ds
aaa
or dword [ebp - 0x5541c0a6], edi
dec edi
xor ch, byte [ebp + 0x12253643]
xchg ecx, eax
stosb byte es:[edi], al
fsub st(0), st(0)
loope 0x499a81
sal dword [esi - 0x150bfa56], 0x52
imul edi, dword [ebp + 0x18], 0xfffffff4
salc
test al, 0xec
out 0xa7, eax
ror dword [esi + 0x7d], 0xf5
out 0x68, al
add eax, 0xf7252ca6
fldenv [eax]
mov esp, 0x284bb989
lodsb al, byte [esi]
movsd dword es:[edi], dword [esi]
ja 0x499a48
push eax
or eax, 0x3f89ee05
inc edi
jb 0x499b03
cld
aad 0x67
push 0xffffffffffffff89
mov al, 0x42
mov byte [0xd0255935], al
rcl byte [edx - 0x466d32e7]
lcall 0x9385, 0x9ea3add5
add byte [esi - 0x78], 0x5a
invalid
xor ch, dl
mov ebp, 0x80ca2d39
test ecx, ecx
enter 0xffffffffffffbb7e, 0x55
add dword [ebx], edi
insd dword es:[edi], dx
jns 0x499b27
enter 0xffffffffffffc139, 0xffffffffffffffbb
pop edx
adc byte [0x1bde2875], dl
xlatb
ror byte [ebx], 1
xor byte [ebx - 0x4c], ch
adc dl, ch
inc dword [ecx - 0x50178ce0]
lodsb al, byte [esi]
aad 0xff
and dword [eax], 0xacafe873
push edi
out 0x2a, al
test dword [ebx - 0x3f], ecx
test dword [ecx], eax
mov dh, 0xb7
shl byte [edx - 0x15], 0x5d
fst dword [ecx - 0x4fa25f96]
dec esp
inc edx
pop esi
mov al, byte [0x34d98c65]
int3
Function at 0x4beecd
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [ebp - 8], esi
test bl, ch
bt dx, cx
mov dword [ebp - 4], ebx
pushal
test dh, ch
test edx, edx
call fcn.0048ce43
lea esp, [esp + 0x2c]
jne 0x486ce3
and ax, 0x3e7f
xadd ah, dh
dec eax
cwde
push ebx
sub dx, 0xfa5f
setl dl
aaa
or dx, dx
push esi
shrd dx, bx, cl
mov esi, dword [ecx + 0x2c]
bsr eax, eax
das
movzx edx, word [esi]
bsr ax, dx
daa
not al
movzx eax, word [esi + 2]
test al, bh
clc
pushfd
pushfd
xor ebx, ebx
pushfd
test cx, sp
add edx, eax
pushfd
jmp 0x445d3d

Function at 0x4c3a51
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x30]
js 0x440f75
mov edx, 0xb61c807d
rdtsc
dec dx
mov edx, dword [ecx + 0x2c]
bt ecx, 0x10
mov dword [ebp - 4], edx
push eax
rdtsc
rcr ch, 5
add cl, ah
lea ebx, [ebx]
sbb cl, 0xb2
aaa
mov ecx, dword [ebp + 8]
bt sp, 0xb
clc
cdq
bsf dx, di
lea eax, [edi + ebx]
or edx, esp
cdq
pushal
mov word [esp + 8], 0xe4c7
pushfd
or bh, al
in al, 0x9c
sub eax, edx
not dh
mov edx, dword [ebp + 0xc]
call fcn.0043d00e
jo 0x4c3a9a
push cs
mov esp, 0xe9600137
mov byte [ecx + edi*2 + 0x35], bh
lds eax, [edx + 0x314fadfc]
invalid

Function at 0x4dae7f
Capabilities:
Hash data using murmur3

Disassembly:
cld
test cx, 0x466f
push dword [esp + 0x4c]
popfd
mov byte [esp], 0xe7
mov word [esp + 4], 0x7d7
mov word [esp], 0x752e
lea esp, [esp + 0x50]
jmp 0x4db05a
cld
push dword [esp + 8]
rep movsb byte es:[edi], byte [esi]
bsr edi, ebx
rol di, 0xd
bsr si, sp
mov edi, dword [esp + 0x44]
not si
add si, 0x1a23
mov esi, dword [esp + 0x48]
jmp 0x4d93ec
Function at 0x402433
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
nop
nop
nop
nop
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jne 0x4024c6
push reloc.WS2_32.dll_connect
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x402474
mov eax, 0x4732d5
push eax
push 1
mov ebx, 0x25c
call fcn.0044ed30
add esp, 0x10
mov dword [ebp - 4], eax
push 0x80000301
push 0
push 0x20
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc4
call fcn.0044ed40
add esp, 0x1c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
mov eax, 0
setne al
jmp 0x4024d0
mov eax, 0
jmp 0x4024d0
mov esp, ebp
pop ebp
ret 4

Function at 0x402508
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
push reloc.WS2_32.dll_getsockname
push 0
push dword [ebp + 8]
push 1
mov ebx, 0x9dc
call fcn.0044ed60
add esp, 0x10
mov dword [ebp - 8], eax
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp - 8]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
nop
nop
nop
nop
mov dword [ebp - 4], eax
cmp dword [ebp + 0x18], 0
jne 0x402584
cmp dword [ebp - 4], 0
je 0x40257f
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
jmp 0x40258c
mov eax, dword [ebp - 4]
mov ebx, dword [ebp + 0x14]
mov dword [ebx], eax
cmp dword [ebp - 4], 0
mov eax, 0
setne al
jmp 0x40259d
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4025a3
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 4
push 0x80000301
push 0
push 3
push reloc.WS2_32.dll_connect
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x4025e0
mov eax, 0x4732d5
push eax
push 3
mov ebx, 0x270
call fcn.0044ee40
add esp, 0x28
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x402723
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x278
call fcn.0044ef20
add esp, 0x10
push reloc.WS2_32.dll_connect
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x402631
mov eax, 0x4732d5
push eax
push 1
mov ebx, 0x244
call fcn.0044eb30
add esp, 0x10
call fcn.00401750
mov dword [ebp - 8], eax
push reloc.WS2_32.dll_connect
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x402661
mov eax, 0x4732d5
push eax
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x402675
mov eax, 0x4732d5
push eax
push 2
mov ebx, 0x23c
call fcn.0044eb40
add esp, 0x1c
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x402698
push ebx
call fcn.00449e4f
add esp, 4
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.0044e620
add esp, 0x10
mov dword [ebp - 8], eax
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.0044e620
add esp, 0x10
mov dword [ebp - 0xc], eax
push 5
push dword [ebp - 0xc]
push dword [ebp - 8]
mov ebx, dword [ebp + 8]
push dword [ebx]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
nop
nop
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x40270e
push ebx
call fcn.00449e4f
add esp, 4
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x40271e
push ebx
call fcn.00449e4f
add esp, 4
jmp 0x402813
push dword [ebp + 8]
call fcn.00402433
and eax, 1
xor eax, 1
test eax, eax
je 0x40278d
call fcn.00401750
mov dword [ebp - 8], eax
push reloc.WS2_32.dll_connect
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x402756
mov eax, 0x4732d5
push eax
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x40276a
mov eax, 0x4732d5
push eax
push 2
mov ebx, 0x23c
call fcn.0044eb40
add esp, 0x1c
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x40278d
push ebx
call fcn.00449e4f
add esp, 4
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.0044e620
add esp, 0x10
mov dword [ebp - 8], eax
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.0044e620
add esp, 0x10
mov dword [ebp - 0xc], eax
push 5
push dword [ebp - 0xc]
push dword [ebp - 8]
mov ebx, dword [ebp + 8]
push dword [ebx]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
nop
nop
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x402803
push ebx
call fcn.00449e4f
add esp, 4
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x402813
push ebx
call fcn.00449e4f
add esp, 4
push 0x54ae40
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x90]
mov esp, ebp
pop ebp
ret 4
Function at 0x406d38
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
push 8
call fcn.00449e49
add esp, 4
mov dword [ebp - 8], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0x10
call fcn.00449e49
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x10], 0
push 0x10
call fcn.00449e49
add esp, 4
mov dword [ebp - 0x14], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
nop
nop
nop
nop
mov dword [ebp - 0x18], eax
push 0x80000301
push 0
push 8
push 0x80000301
push 0
push 0x20
push 2
mov ebx, 0xc8
call fcn.0044e5c0
add esp, 0x1c
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
nop
nop
nop
nop
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.0044e620
add esp, 0x10
mov dword [ebp - 0x18], eax
push dword [ebp - 8]
push str.SeDebugPrivilege
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
nop
nop
nop
nop
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x406e5c
push ebx
call fcn.00449e4f
add esp, 4
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 1
mov ebx, dword [ebp - 0xc]
add ebx, 4
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 8]
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0xc]
add ebx, 8
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 8]
add ebx, 4
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0xc]
add ebx, 0xc
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 2
mov eax, 0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x14]
push 0x1c
push dword [ebp - 0xc]
push 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
nop
nop
nop
nop
mov dword [ebp - 0x10], eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
mov eax, dword [ebp - 0x10]
jmp 0x406ef3
push eax
mov ebx, dword [ebp - 8]
push ebx
call fcn.00449e4f
add esp, 4
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.00449e4f
add esp, 4
mov ebx, dword [ebp - 0x14]
push ebx
call fcn.00449e4f
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x40fa2c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
push dword [ebp + 8]
push dword [0x54ae5c]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
nop
nop
nop
nop
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40fa7b
mov eax, 0x47338d
jmp 0x40fb3a
push dword [ebp + 8]
push dword [0x54ae5c]
call dword [sym.imp.KERNEL32.dll_LoadResource]
nop
nop
nop
nop
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40faa5
mov eax, 0x47338d
jmp 0x40fb3a
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LockResource]
nop
nop
nop
nop
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x40fac9
mov eax, 0x47338d
jmp 0x40fb3a
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x1bc
call fcn.0044ef50
add esp, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x40fafc
push ebx
call fcn.00449e4f
add esp, 4
pop eax
mov dword [ebp - 0x10], eax
push dword [ebp - 4]
push dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x40fb10
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_RtlMoveMemory]
nop
nop
nop
nop
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x40fb35
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.00449e49
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x40fb3a
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x40fb4b
push ebx
call fcn.00449e4f
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x412f01
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ebx, dword [0x54ae44]
mov dword [ebp - 4], ebx
push 0x4732d5
mov ebx, dword [ebp - 4]
push dword [ebx]
call fcn.00401bf1
add esp, 8
cmp eax, 0
je 0x412fbd
mov ebx, dword [0x54ae44]
mov dword [ebp - 4], ebx
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.0044e620
add esp, 0x10
mov dword [ebp - 8], eax
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.0044e620
add esp, 0x10
mov dword [ebp - 0xc], eax
push 1
push dword [ebp - 0xc]
push dword [ebp - 8]
mov ebx, dword [ebp - 4]
push dword [ebx]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
nop
nop
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x412fad
push ebx
call fcn.00449e4f
add esp, 4
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x412fbd
push ebx
call fcn.00449e4f
add esp, 4
mov esp, ebp
pop ebp
ret