joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x478008]
jne 0x40100a
repz ret
jmp fcn.00401c66

Function at 0x4080b3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00403824
and dword [ebp - 4], 0
cmp dword [0x479fe8], 0
mov ebx, eax
jne 0x408164
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x408215
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x408215
push eax
call fcn.004037b2
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x479fe8], eax
call esi
push eax
call fcn.004037b2
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x479fec], eax
call esi
push eax
call fcn.004037b2
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x479ff0], eax
call esi
push eax
call fcn.004037b2
pop ecx
mov dword [0x479ff8], eax
test eax, eax
je 0x408164
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004037b2
pop ecx
mov dword [0x479ff4], eax
mov eax, dword [0x479ff4]
cmp eax, ebx
je 0x4081bc
cmp dword [0x479ff8], ebx
je 0x4081bc
push eax
call fcn.0040382d
push dword [0x479ff8]
mov esi, eax
call fcn.0040382d
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4081bc
test edi, edi
je 0x4081bc
call esi
test eax, eax
je 0x4081b3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4081b3
test byte [ebp - 0xc], 1
jne 0x4081bc
or dword [ebp + 0x10], 0x200000
jmp 0x4081f5
mov eax, dword [0x479fec]
cmp eax, ebx
je 0x4081f5
push eax
call fcn.0040382d
pop ecx
test eax, eax
je 0x4081f5
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4081f5
mov eax, dword [0x479ff0]
cmp eax, ebx
je 0x4081f5
push eax
call fcn.0040382d
pop ecx
test eax, eax
je 0x4081f5
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x479fe8]
call fcn.0040382d
pop ecx
test eax, eax
je 0x408215
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408217
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403700
Capabilities:
Delete file
Enumerate gui resources

Disassembly:
mov eax, 0x102c
call fcn.0040f4d0
mov eax, dword [0x49e4dc]
mov ecx, dword [0x49b3e4]
push ebx
push ebp
shr eax, 3
push esi
push edi
test eax, eax
jbe 0x40381b
mov edi, dword [sym.imp.KERNEL32.dll_SetConsoleMode]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteProfileSectionW]
mov ebp, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, dword [sym.imp.KERNEL32.dll_GetCommState]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
cmp dword [0x49e4dc], 0x959
jne 0x403801
push 0
push 0
call edi
push 0
push 0
call ebx
lea eax, [esp + 0x18]
push eax
push 0x402cb0
push 0
lea ecx, [esp + 0x444]
push ecx
push 0
push 0x402cc4
push 0
push 0
call ebp
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExA]
lea edx, [esp + 0x1c]
push edx
push 0
call esi
push 0
push 0
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
push 0
lea ecx, [esp + 0x83c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
push 0
push 0
call esi
push 0
push 0x402cd0
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
push 0x402d10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov edx, dword [esp + 0x10]
push edx
call fcn.00403560
add dword [esp + 0x10], 8
sub dword [esp + 0x14], 1
jne 0x403744
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x102c
ret
Function at 0x4073ec
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x431238]
jne 0x4073f6
repz ret
jmp fcn.0040c6f5

Function at 0x40d1ef
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040a908
and dword [ebp - 4], 0
cmp dword [0x434278], 0
mov ebx, eax
jne 0x40d2a0
push 0x4024a4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40d351
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402498
push edi
call esi
test eax, eax
je 0x40d351
push eax
call fcn.0040a896
mov dword [esp], 0x402488
push edi
mov dword [0x434278], eax
call esi
push eax
call fcn.0040a896
mov dword [esp], 0x402474
push edi
mov dword [0x43427c], eax
call esi
push eax
call fcn.0040a896
mov dword [esp], 0x402458
push edi
mov dword [0x434280], eax
call esi
push eax
call fcn.0040a896
pop ecx
mov dword [0x434288], eax
test eax, eax
je 0x40d2a0
push 0x402440
push edi
call esi
push eax
call fcn.0040a896
pop ecx
mov dword [0x434284], eax
mov eax, dword [0x434284]
cmp eax, ebx
je 0x40d2f8
cmp dword [0x434288], ebx
je 0x40d2f8
push eax
call fcn.0040a911
push dword [0x434288]
mov esi, eax
call fcn.0040a911
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40d2f8
test edi, edi
je 0x40d2f8
call esi
test eax, eax
je 0x40d2ef
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40d2ef
test byte [ebp - 0xc], 1
jne 0x40d2f8
or dword [ebp + 0x10], 0x200000
jmp 0x40d331
mov eax, dword [0x43427c]
cmp eax, ebx
je 0x40d331
push eax
call fcn.0040a911
pop ecx
test eax, eax
je 0x40d331
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40d331
mov eax, dword [0x434280]
cmp eax, ebx
je 0x40d331
push eax
call fcn.0040a911
pop ecx
test eax, eax
je 0x40d331
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x434278]
call fcn.0040a911
pop ecx
test eax, eax
je 0x40d351
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40d353
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x405ef4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a34], 0
push esi
jne 0x405f2b
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f05
mov dword [ecx*4 + 0x422a30], eax
inc ecx
cmp ecx, 0x100
jl 0x405f00
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f5c
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a30]
xor eax, esi
inc ecx
dec edx
jne 0x405f3e
pop edi
not eax
pop esi
ret 0xc

Function at 0x4077c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
jmp 0x4077da
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4077e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4077d0
mov eax, 1
add ebx, ebx
jne 0x4077f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4077e8
jne 0x407804
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4077e8
xor ecx, ecx
sub eax, 3
jb 0x407818
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40788a
mov ebp, eax
add ebx, ebx
jne 0x407823
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407830
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x407854
inc ecx
add ebx, ebx
jne 0x407840
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407835
jne 0x407851
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407835
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x407874
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x407865
jmp 0x4077d6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x407874
add edi, ecx
jmp 0x4077d6
pop esi
mov edi, esi
mov ecx, 0x4a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x407892
cmp byte [edi], 0
jne 0x407892
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x407897
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x407906
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x7000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x7050]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4078c4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x7054]
or eax, eax
je 0x407900
mov dword [ebx], eax
add ebx, 4
jmp 0x4078e1
call dword [esi + 0x7064]
mov ebp, dword [esi + 0x7058]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1df]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40793a
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x1046140
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x969000]
push edi
or ebp, 0xffffffff
jmp 0x1046162
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1046169
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1046158
mov eax, 1
add ebx, ebx
jne 0x104617b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x104618c
jne 0x10461ab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10461ab
dec eax
add ebx, ebx
jne 0x1046198
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x1046170
add ebx, ebx
jne 0x10461a7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x10461fd
xor ecx, ecx
sub eax, 3
jb 0x10461c3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1046232
sar eax, 1
mov ebp, eax
jmp 0x10461ce
add ebx, ebx
jne 0x10461ce
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x104619c
inc ecx
add ebx, ebx
jne 0x10461dc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x104619c
add ebx, ebx
jne 0x10461e9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x10461de
jne 0x10461fa
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10461de
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x104621c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x104620e
jmp 0x104615e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x104621c
add edi, ecx
jmp 0x104615e
pop esi
mov edi, esi
mov ecx, 0xb600
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x104623a
cmp byte [edi], 0x3d
jne 0x104623a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x104623f
lea edi, [esi + 0xc32000]
mov eax, dword [edi]
or eax, eax
je 0x10462b7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xc48024]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xc481b4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x104626c
mov ecx, edi
jns 0x104629b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xc481bc]
or eax, eax
je 0x10462b1
mov dword [ebx], eax
add ebx, 4
jmp 0x1046289
call dword [esi + 0xc481b8]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x10462e8
cmp al, 0xef
ja 0x10462db
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x10462bd
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x10462ca
mov ebp, dword [esi + 0xc481c0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x26f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x104631c
sub esp, 0xffffff80
jmp 0x534735
Function at 0x42b224
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x438e80]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0042b1b9
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.004162c0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x42b273
cmp dword [ebp - 0x1c], 5
jb 0x42b28b
jmp 0x42b287
cmp dword [ebp - 0x10], 1
jne 0x42b28b
cmp dword [ebp - 0x1c], 4
ja 0x42b287
jne 0x42b28b
cmp dword [ebp - 0x18], 0
jbe 0x42b28b
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x4327a4
call fcn.0042b08d
test eax, eax
jge 0x42b2ac
mov byte [0x43a368], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00416063
add ebp, 0x78
leave
ret

Function at 0x411ab0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.sect_1
lea edi, [esi - 0xb000]
push edi
or ebp, 0xffffffff
jmp 0x411ad2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x411ad9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x411ac8
mov eax, 1
add ebx, ebx
jne 0x411aeb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x411ae0
jne 0x411afc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x411ae0
xor ecx, ecx
sub eax, 3
jb 0x411b10
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x411b82
mov ebp, eax
add ebx, ebx
jne 0x411b1b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x411b28
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x411b4c
inc ecx
add ebx, ebx
jne 0x411b38
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x411b2d
jne 0x411b49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x411b2d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x411b6c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x411b5d
jmp 0x411ace
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x411b6c
add edi, ecx
jmp 0x411ace
pop esi
mov edi, esi
mov ecx, 0x203
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x411b8a
cmp byte [edi], 0xa
jne 0x411b8a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x411b8f
lea edi, [esi + 0xf000]
mov eax, dword [edi]
or eax, eax
je 0x411bfe
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x113a4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x11408]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x411bbc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1140c]
or eax, eax
je 0x411bf8
mov dword [ebx], eax
add ebx, 4
jmp 0x411bd9
call dword [esi + 0x11410]
popal
jmp 0x403ae7
Function at 0x40c110
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
mov bl, cl
mov esi, edx
push 0x4b639a
lea ecx, [ebp - 0x1c]
call fcn.0040c569
cmp byte [ebp + 8], 0
je 0x40c146
mov edi, 0x4b8328
push edi
call fcn.0040bea1
pop ecx
push eax
push edi
lea ecx, [ebp - 0x1c]
call fcn.0040cf51
mov edi, 0x4b832c
push edi
call fcn.0040bea1
pop ecx
push eax
push edi
lea ecx, [ebp - 0x1c]
call fcn.0040cf51
push 0xffffffffffffffff
xor edi, edi
lea eax, [ebp + 0xc]
push edi
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040cff4
test bl, bl
jne 0x40c192
cmp dword [ebp - 8], 0x10
lea eax, [ebp - 0x1c]
push edi
cmovae eax, dword [ebp - 0x1c]
push edi
push eax
push 0x4b8330
push 0x4b8338
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x40c1fa
push 0x38
lea eax, [ebp - 0x54]
push edi
push eax
call fcn.0043dd90
add esp, 0xc
mov dword [ebp - 0x58], 0x3c
cmp dword [ebp - 8], 0x10
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x54], 0x240
cmovae eax, dword [ebp - 0x1c]
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x58]
push eax
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x4c], 0x4b8338
mov dword [ebp - 0x48], 0x4b8330
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
imul eax, esi, 0x3e8
push eax
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push 1
lea ecx, [ebp - 0x1c]
call fcn.0040c9b2
push edi
push 1
lea ecx, [ebp + 0xc]
call fcn.0040c9b2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40c217
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x1c], 8
push ebx
mov ebx, ecx
push esi
push edi
push 0x4b836c
mov eax, dword [ebx]
mov dword [ebx + 4], eax
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
call fcn.0044659a
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x40c246
xor esi, esi
jmp 0x40c289
push 2
push 0
push edi
call fcn.00449ab8
push edi
call fcn.0044628e
mov esi, eax
add esp, 0x10
test esi, esi
jle 0x40c282
push 0
push 0
push edi
call fcn.00449ab8
add esp, 0xc
mov ecx, ebx
push esi
call fcn.0040c366
push edi
push 1
push esi
push dword [ebx]
call fcn.0044c8cf
add esp, 0x10
push edi
call fcn.004467b3
pop ecx
push 0
push 1
lea ecx, [ebp + 8]
call fcn.0040c714
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret
Function at 0x40dfc6
Capabilities:
Check http status code
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x490
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], edx
push ebx
push ebx
push ebx
push ebx
push ebx
mov esi, ecx
call dword [sym.imp.WININET.dll_InternetOpenA]
mov edi, eax
test edi, edi
je 0x40e04c
push ebx
push 0x4000000
push ebx
push ebx
push esi
push edi
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov ebx, dword [sym.imp.WININET.dll_InternetCloseHandle]
mov esi, eax
test esi, esi
je 0x40e049
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x80
push eax
lea eax, [ebp - 0x90]
push eax
push 0x13
push esi
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x40e046
mov eax, dword [ebp - 4]
mov byte [ebp + eax - 0x90], 0
lea eax, [ebp - 0x90]
push eax
call fcn.0044d73d
pop ecx
cmp eax, 0xc8
je 0x40e07c
push esi
call ebx
push edi
call ebx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
test eax, eax
je 0x40e099
lea ecx, [ebp - 0x490]
mov byte [ebp - 0xc], 0
push dword [ebp - 0xc]
add eax, ecx
push eax
mov eax, ecx
push eax
mov eax, dword [ebp - 0x10]
mov ecx, eax
push dword [eax + 4]
call fcn.0040e0aa
lea eax, [ebp - 8]
push eax
push 0x400
lea eax, [ebp - 0x490]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x40e055
jmp 0x40e046
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push edi
call esi
xor eax, eax
inc eax
jmp 0x40e04e
Function at 0x40e76c
Capabilities:
Enumerate process modules
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf74
push ebx
push edi
xor eax, eax
mov ebx, ecx
push 0x228
push eax
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x270]
push eax
call fcn.0043dd90
add esp, 0xc
mov dword [ebp - 0x274], 0x22c
xor eax, eax
mov dword [ebp - 4], eax
push eax
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
xor eax, eax
mov dword [ebp - 0x44], edi
cmp edi, 0xffffffff
je 0x40e97a
push esi
push 0x20000
push ebx
push 0x4b840c
mov word [ebx], ax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea edx, [ebp - 0x374]
mov dword [ebp - 0x3c], 0x84e0829
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x38], 0x899089c
mov dword [ebp - 0x34], 0x88d0892
mov dword [ebp - 0x30], 0x84e0863
mov dword [ebp - 0x2c], 0x855088d
mov dword [ebp - 0x28], 0x88a0897
mov dword [ebp - 0x24], 0x88e0896
mov dword [ebp - 0x20], 0x84e0863
mov dword [ebp - 0x1c], 0x855089c
mov dword [ebp - 0x18], 0x88a0899
mov dword [ebp - 0x14], 0x891089d
mov dword [ebp - 0x10], 0x84e0863
mov dword [ebp - 0xc], 0x84e089c
mov dword [ebp - 8], 0x89c
call fcn.0040e716
jmp 0x40e945
lea eax, [ebp - 0x250]
push str.360Tray.exe
push eax
call fcn.004465c8
pop ecx
pop ecx
push dword [ebp - 0x26c]
xor eax, eax
push eax
push 0x410
mov word [ebp - 0x774], ax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x40e8a4
lea eax, [ebp - 0x48]
push eax
push 4
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x40e8a4
push 0x200
lea eax, [ebp - 0x774]
push eax
push dword [ebp - 4]
push esi
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
mov ecx, 0x4b8434
lea eax, [ebp - 0x774]
push ecx
push eax
lea eax, [ebp - 0x250]
push eax
push dword [ebp - 0x26c]
lea eax, [ebp - 0x374]
push ecx
push eax
lea eax, [ebp - 0xf74]
push eax
call fcn.0040bcca
mov edx, ebx
add esp, 0x1c
xor esi, esi
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, si
jne 0x40e8dc
sub edx, ecx
lea ecx, [ebp - 0xf74]
sar edx, 1
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x40]
jne 0x40e8f4
sub ecx, esi
sar ecx, 1
lea eax, [ecx + edx]
cmp eax, 0x10000
ja 0x40e95b
lea edx, [ebp - 0xf74]
xor ecx, ecx
mov esi, edx
mov ax, word [edx]
add edx, 2
cmp ax, cx
jne 0x40e918
sub edx, esi
lea edi, [ebx - 2]
mov ax, word [edi + 2]
add edi, 2
cmp ax, cx
jne 0x40e928
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 0x44]
lea eax, [ebp - 0x274]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x40e845
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebx + 2]
xor edx, edx
pop esi
mov ax, word [ebx]
add ebx, 2
cmp ax, dx
jne 0x40e968
sub ebx, ecx
sar ebx, 1
lea eax, [ebx + ebx]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40e980
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
and dword [ebp - 4], 0
lea edx, [ebp - 0x2c]
push esi
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0x8940829
mov dword [ebp - 0x14], 0x89b088e
mov dword [ebp - 0x10], 0x88e0897
mov dword [ebp - 0xc], 0x85c0895
mov dword [ebp - 8], 0x85b
mov dword [ebp - 0x4c], 0x92a08e1
mov dword [ebp - 0x48], 0x9380954
mov dword [ebp - 0x44], 0x9580950
mov dword [ebp - 0x40], 0x9150917
mov dword [ebp - 0x3c], 0x9530931
mov dword [ebp - 0x38], 0x9440950
mov dword [ebp - 0x34], 0x9540946
mov dword [ebp - 0x30], 0x954
call fcn.0040e716
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x4c]
call fcn.0040e6d3
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x40ea24
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
mov eax, dword [ebp - 4]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40ea2c
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.004462ba
pop ecx
push 0x64
lea eax, [ebp - 0xf0]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
call fcn.00446299
inc eax
push eax
lea eax, [ebp - 0x28]
push str._d.dat
push eax
call fcn.0040bc9c
lea edx, [ebp - 0x28]
add esp, 0xc
mov esi, edx
xor ecx, ecx
mov ax, word [edx]
add edx, 2
cmp ax, cx
jne 0x40ea72
lea edi, [ebp - 0xf0]
sub edx, esi
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
cmp ax, cx
jne 0x40ea88
mov ecx, edx
lea eax, [ebp - 0xf0]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
push 0x4b835c
rep movsb byte es:[edi], byte [esi]
push eax
call fcn.0044659a
pop ecx
pop ecx
pop edi
pop esi
test eax, eax
je 0x40ead2
push eax
call fcn.004467b3
pop ecx
lea eax, [ebp - 0xf0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
inc eax
mov esp, ebp
pop ebp
ret