joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1025250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1039808
push 0x1029288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x1025329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1025329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.010281d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0x1025329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0x1025329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0x102532c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.01025351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1025d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1025d58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0x1025d60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1025d94
mov eax, dword [esp + 0x14]
test eax, eax
je 0x1025d94
push eax
push esi
call fcn.0102820b
add esp, 8
pop esi
ret 0x10

Function at 0x1025da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1025e22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0x1025e15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0x103e320
push ecx
mov dword [esp + 0x1c], 4
call fcn.01027dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0x1025dda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0x1025e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1025ec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0x1025eb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0x103e320
push ecx
mov dword [esp + 0x1c], 4
call fcn.01027dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x1025eab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0x1025e6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0x1026000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x1026131
push esi
call fcn.01029145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.01018080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x1026131
push 0
push ebp
call fcn.010183a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.01018260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x102608b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.010182f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x1026121
push 0x103e918
push edi
call fcn.010273f0
push eax
push ebx
push esi
call fcn.01025f60
push 0x103e8f8
push edi
call fcn.010273f0
push eax
push ebx
push esi
call fcn.01025f60
push 0x103e8d8
push edi
call fcn.010273f0
push eax
push ebx
push esi
call fcn.01025f60
push 0x103e8c0
push edi
call fcn.010273f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.01025f60
push 0x103e8a0
push edi
call fcn.010273f0
push eax
push ebx
push esi
call fcn.01025f60
push 0x103e888
push edi
call fcn.010273f0
push eax
push ebx
push esi
call fcn.01025f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x10271b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.01027140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.01027140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.01027140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.01027140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x1027bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1027c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x103987c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1027c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x1027c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x200d058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x200d1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x200d07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x200d06a
add dl, dl
jne 0x200d089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x200d0dc
xor eax, eax
add dl, dl
jne 0x200d096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x200d17d
add dl, dl
jne 0x200d0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x200d0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x200d0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x200d0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x200d0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x200d075
mov eax, 1
add dl, dl
jne 0x200d0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x200d0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x200d0e1
sub eax, ebx
mov ebx, 1
jne 0x200d128
mov ecx, 1
add dl, dl
jne 0x200d10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x200d119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x200d105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x200d075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x200d13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x200d14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x200d136
cmp eax, 0x7d00
jae 0x200d16d
cmp eax, 0x500
jb 0x200d168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x200d075
cmp eax, 0x7f
ja 0x200d170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x200d075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x200d19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x200d075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x431072
nop
nop
mov ebx, 0x40915c
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x76fa3dd1
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x431060
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
je 0x4310d2
nop
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x4181734
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4310c0
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x401380
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x64
mov eax, dword [0x4e97d0]
xor eax, esp
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x68]
xor ecx, ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x6c]
push ecx
push eax
lea edx, [esp + 8]
push edx
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.00402ea0
lea eax, [esp + 0xc]
push eax
push esi
call fcn.00402f40
mov ecx, dword [esp + 0x70]
add esp, 0x14
xor ecx, esp
call fcn.00484647
add esp, 0x64
ret

Function at 0x4013f0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x64
mov eax, dword [0x4e97d0]
xor eax, esp
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x68]
xor ecx, ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x6c]
push ecx
push eax
lea edx, [esp + 8]
push edx
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.00402ea0
lea eax, [esp + 0xc]
push eax
push esi
call fcn.00402f40
mov ecx, dword [esp + 0x70]
add esp, 0x14
xor ecx, esp
call fcn.00484647
add esp, 0x64
ret

Function at 0x401c80
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x68
mov eax, dword [0x4e97d0]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0xc]
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x10], 0x67452301
mov dword [esp + 0x14], 0xefcdab89
mov dword [esp + 0x18], 0x98badcfe
mov dword [esp + 0x1c], 0x10325476
call fcn.00405d00
add esp, 8
test eax, eax
jne 0x401ce6
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00484647
add esp, 0x68
ret
mov eax, dword [esp + 0x6c]
test eax, eax
jbe 0x401cfd
push eax
lea eax, [esp + 0xc]
push edi
push eax
call fcn.00402ea0
add esp, 0xc
lea ecx, [esp + 8]
push ecx
push ebx
call fcn.00402f40
add esp, 8
test esi, esi
je 0x401d1d
mov eax, dword [esp + 4]
xor edx, edx
cmp eax, dword [esp]
sete dl
mov dword [esi], edx
mov ecx, dword [esp + 0x64]
xor ecx, esp
mov eax, 1
call fcn.00484647
add esp, 0x68
ret

Function at 0x401d80
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x68
mov eax, dword [0x4e97d0]
xor eax, esp
mov dword [esp + 0x60], eax
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
push edi
lea eax, [esp + 8]
mov edi, ecx
push eax
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.00405f00
add esp, 4
test eax, eax
jne 0x401ddc
pop edi
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.00484647
add esp, 0x68
ret
lea ecx, [esp + 8]
push ecx
push esi
call fcn.00402f40
mov ecx, dword [esp + 0x6c]
add esp, 8
pop edi
xor ecx, esp
mov eax, 1
call fcn.00484647
add esp, 0x68
ret
Function at 0x401e00
Capabilities:
Hash data using sha256

Disassembly:
sub esp, 0x74
mov eax, dword [0x4e97d0]
xor eax, esp
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x78]
xor ecx, ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
push edi
lea ecx, [esp + 8]
push ecx
push eax
mov dword [esp + 0x10], 0x6a09e667
mov dword [esp + 0x14], 0xbb67ae85
mov dword [esp + 0x18], 0x3c6ef372
mov dword [esp + 0x1c], 0xa54ff53a
mov dword [esp + 0x20], 0x510e527f
mov dword [esp + 0x24], 0x9b05688c
mov dword [esp + 0x28], 0x1f83d9ab
mov dword [esp + 0x2c], 0x5be0cd19
call fcn.00405fe0
add esp, 8
test eax, eax
jne 0x401e7f
pop edi
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00484647
add esp, 0x74
ret
mov eax, esi
lea edi, [esp + 8]
call fcn.004074f0
mov ecx, dword [esp + 0x74]
pop edi
xor ecx, esp
mov eax, 1
call fcn.00484647
add esp, 0x74
ret

Function at 0x402e70
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x40a900
Capabilities:
Check http status code

Disassembly:
sub esp, 0x14
push edi
xor edi, edi
mov dword [esp + 0xc], 3
mov dword [esp + 8], edi
mov dword [esp + 0x10], 4
cmp esi, edi
je 0x40a9f9
push ebx
mov ebx, dword [0x4be6cc]
push ebp
mov ebp, dword [0x4be6b8]
mov eax, dword [esp + 0x14]
mov ecx, eax
dec eax
mov dword [esp + 0x14], eax
test ecx, ecx
jle 0x40a9f7
push 0
push 0
push 0
push 0
push esi
call ebx
mov edi, eax
test edi, edi
jne 0x40a9b8
call dword [0x4be374]
cmp eax, 0x2f0d
je 0x40a968
cmp eax, 0x2f19
jne 0x40a9a4
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x10]
push eax
push 0x1f
push esi
mov dword [esp + 0x2c], 4
call ebp
or dword [esp + 0xc], 0x3180
push 4
lea ecx, [esp + 0x10]
push ecx
push 0x1f
push esi
call dword [0x4be6b0]
push 0
push 0
push 0
push 0
push esi
call ebx
mov edi, eax
test edi, edi
jne 0x40a930
push 0x3e8
call dword [0x4be34c]
jmp 0x40a930
push 0
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x18]
push eax
push 0x20000013
push esi
mov dword [esp + 0x24], 0
mov dword [esp + 0x2c], 4
call dword [0x4be6ac]
mov edi, eax
test edi, edi
je 0x40a9a8
cmp dword [esp + 0x10], 0xc8
je 0x40a9f7
xor edi, edi
jmp 0x40a930
pop ebp
pop ebx
mov eax, edi
pop edi
add esp, 0x14
ret
Function at 0x40e100
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x144
mov eax, dword [0x4e97d0]
xor eax, esp
mov dword [esp + 0x140], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 1
push 0x80000000
push eax
call dword [0x4be33c]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40e153
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x140]
xor ecx, esp
call fcn.00484647
mov esp, ebp
pop ebp
ret
mov edi, dword [0x4be334]
push 0
lea eax, [esp + 0x10]
push eax
push 0x40
lea ecx, [esp + 0x114]
push ecx
push esi
call edi
test eax, eax
je 0x40e1db
cmp dword [esp + 0xc], 0x40
jne 0x40e1db
mov edx, 0x5a4d
cmp word [esp + 0x108], dx
jne 0x40e1db
mov eax, dword [esp + 0x144]
push 0
push 0
push eax
push esi
call dword [0x4be338]
cmp eax, dword [esp + 0x144]
jne 0x40e1db
push 0
lea ecx, [esp + 0x10]
push ecx
push 0xf8
lea edx, [esp + 0x1c]
push edx
push esi
call edi
test eax, eax
je 0x40e1db
cmp dword [esp + 0xc], 0xf8
jne 0x40e1db
cmp dword [esp + 0x10], 0x4550
jne 0x40e1db
cmp word [esp + 0x16], bx
je 0x40e1db
mov ebx, 1
push esi
call dword [0x4be344]
mov ecx, dword [esp + 0x14c]
pop edi
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.00484647
mov esp, ebp
pop ebp
ret
Function at 0x42390e
Capabilities:
Check http status code

Disassembly:
push 0xc
mov eax, 0x4b469b
call fcn.00485421
mov esi, ecx
mov ebx, dword [ebp + 0x18]
xor edi, edi
mov dword [ebx], edi
call fcn.0041e07e
cmp dword [esi + 0x1440], edi
jne 0x42393b
push 6
pop eax
call fcn.004854f9
ret 0x14
cmp dword [esi + 0x142c], 3
je 0x423948
push 0x57
jmp 0x423932
lea ecx, [ebp - 0x18]
call fcn.00421e07
push dword [ebp + 0x14]
lea eax, [esi + 0x224]
push eax
lea eax, [ebp - 0x18]
push str._s_s
push eax
mov dword [ebp - 4], edi
call fcn.0041dd06
or dword [esi + 0x1430], 0x400000
mov eax, dword [esi + 0x1430]
add esp, 0x10
cmp dword [esi + 0x1428], 4
jne 0x423992
or eax, 0x800000
mov dword [esi + 0x1430], eax
call fcn.0041e002
push edi
push dword [esi + 0x1430]
push edi
push edi
push 0x4cd6f8
push dword [ebp - 0x18]
push dword [ebp + 8]
push dword [esi + 0x1440]
call dword [eax + 0x28]
mov dword [esi + 0x1444], eax
cmp eax, edi
jne 0x4239d7
mov ecx, esi
call fcn.0041e31f
mov edi, eax
push dword [ebp - 0x18]
call fcn.00485811
pop ecx
mov eax, edi
jmp 0x423933
mov eax, dword [esi + 0x1c]
lea ecx, [ebp + 0x18]
push ecx
push eax
mov ecx, esi
call fcn.0041e334
test eax, eax
je 0x4239be
call fcn.0041e002
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
push edi
push dword [esi + 0x1444]
call dword [eax + 0x2c]
test eax, eax
je 0x4239be
push ebx
push 0x13
mov ecx, esi
call fcn.004223b3
cmp eax, edi
jne 0x4239c5
cmp dword [ebp + 0x18], edi
je 0x423a26
cmp dword [ebx], 0xce
je 0x423a2e
mov edi, 0x2f78
jmp 0x4239c7
cmp dword [ebx], 0xc8
jmp 0x423a1d
lea eax, [ebp - 0x10]
push eax
push 5
mov ecx, esi
call fcn.004223b3
mov eax, dword [ebp - 0x10]
mov dword [esi + 0x1450], eax
mov dword [esi + 0x1454], edi
jmp 0x4239c7

Function at 0x431a9b
Capabilities:
Persist via run registry key

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x4e97d0]
xor eax, ebp
mov dword [ebp + 0x190], eax
push 0x208
lea eax, [ebp - 0x78]
push 0
push eax
call fcn.00484550
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x7c]
push eax
push str.360Safetray
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000002
mov dword [ebp - 0x7c], 1
mov dword [ebp - 0x80], 0x208
call dword [0x4be4d4]
mov ecx, dword [ebp + 0x190]
neg eax
sbb eax, eax
xor ecx, ebp
inc eax
call fcn.00484647
add ebp, 0x194
leave
ret
Function at 0x4395c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x45c
mov eax, dword [0x4e97d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push edi
push 0x4c292c
push eax
call fcn.0048ad5e
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x4395f3
or eax, 0xffffffff
jmp 0x43965e
lea eax, [ebp - 0x45c]
push esi
push eax
call fcn.00402e70
push edi
mov esi, 0x400
push esi
lea eax, [ebp - 0x404]
push 1
push eax
call fcn.0048b2fc
add esp, 0x14
jmp 0x439641
push eax
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x45c]
push eax
call fcn.00402ea0
push edi
push esi
lea eax, [ebp - 0x404]
push 1
push eax
call fcn.0048b2fc
add esp, 0x1c
test eax, eax
jne 0x43961a
lea eax, [ebp - 0x45c]
push eax
push ebx
call fcn.00402f40
push edi
call fcn.0048ac1c
add esp, 0xc
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.00484647
leave
ret

Function at 0x4466a8
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 4], 0
je 0x4466b5
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x18]
test eax, eax
je 0x4466b1
lea ecx, [esi + 8]
push ecx
push 0
push dword [esi + 0x1c]
push eax
push 0
push 0
call fcn.0048ea8c
xor ecx, ecx
add esp, 0x18
test eax, eax
setne cl
mov dword [esi + 4], eax
pop esi
mov eax, ecx
ret

Function at 0x45ca27
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
xor esi, esi
push 4
pop edi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0x10], edi
cmp dword [ebp + 8], esi
je 0x45cb06
push ebx
mov ebx, dword [0x4be6cc]
mov eax, dword [ebp + 0xc]
dec dword [ebp + 0xc]
test eax, eax
jle 0x45cb05
push esi
push esi
push esi
push esi
push dword [ebp + 8]
call ebx
mov dword [ebp - 4], eax
cmp eax, esi
jne 0x45cac7
call dword [0x4be374]
cmp eax, 0x2f0d
je 0x45ca7f
cmp eax, 0x2f19
jne 0x45cab8
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x1f
push dword [ebp + 8]
mov dword [ebp - 4], edi
call dword [0x4be6b8]
or dword [ebp - 0xc], 0x3180
push edi
lea eax, [ebp - 0xc]
push eax
push 0x1f
push dword [ebp + 8]
call dword [0x4be6b0]
push esi
push esi
push esi
push esi
push dword [ebp + 8]
call ebx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], esi
jne 0x45ca4d
push 0xa
call dword [0x4be34c]
jmp 0x45ca4d
push esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0x20000013
push dword [ebp + 8]
mov dword [ebp - 8], esi
mov dword [ebp - 0x10], edi
call dword [0x4be6ac]
mov dword [ebp - 4], eax
cmp eax, esi
je 0x45cabd
cmp dword [ebp - 8], 0xc8
je 0x45cb05
cmp dword [ebp - 8], 0xce
je 0x45cb05
mov dword [ebp - 4], esi
jmp 0x45ca4d
pop ebx
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 8