joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e20b4
Capabilities:
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x4e20bc
push ecx
push ebx
push esi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.0040569c
xor eax, eax
push ebp
push 0x4e22cd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.0040521c
call fcn.004034d0
mov ebx, eax
test ebx, ebx
jle 0x4e211d
mov esi, 1
push dword [ebp - 8]
push 0x4e22e4
lea edx, [ebp - 0x24]
mov eax, esi
call fcn.00403530
push dword [ebp - 0x24]
lea eax, [ebp - 8]
mov edx, 3
call fcn.004055b0
inc esi
dec ebx
jne 0x4e20f7
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x4e22f0
call fcn.004057f8
mov ebx, eax
mov edx, dword [ebp - 8]
mov eax, 0x4e22fc
call fcn.004057f8
sub ebx, eax
sub ebx, 2
push ebx
mov edx, dword [ebp - 8]
mov eax, 0x4e22fc
call fcn.004057f8
mov edx, eax
add edx, 2
mov eax, dword [ebp - 8]
pop ecx
call fcn.00405714
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.00409be0
cmp dword [ebp - 0x28], 0
je 0x4e22a5
mov eax, 0x4f4154
mov edx, dword [ebp - 0xc]
call fcn.00405270
mov dl, 1
mov eax, dword [0x419b68]
call fcn.004042cc
mov dword [ebp - 0x20], eax
mov edx, 0x4e2308
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x2c]
mov ecx, dword [ebp - 0xc]
mov edx, 0x4e2318
call fcn.00405534
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x18]
mov ecx, 0x4e2328
mov edx, dword [0x4f4158]
call fcn.00405534
mov eax, dword [ebp - 0x18]
call fcn.0040a730
test al, al
je 0x4e21e4
mov eax, dword [ebp - 0x18]
call fcn.004056ac
push eax
call sub.kernel32.dll_DeleteFileA_1
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
call dword [ecx + 0x74]
lea eax, [ebp - 0x20]
call fcn.00410730
lea eax, [ebp - 0x14]
mov ecx, 0x4e233c
mov edx, dword [0x4f4158]
call fcn.00405534
mov eax, dword [ebp - 0x14]
call fcn.0040a754
test al, al
jne 0x4e221e
mov eax, dword [ebp - 0x14]
call fcn.0040a778
lea eax, [ebp - 0x10]
mov ecx, 0x4e234c
mov edx, dword [ebp - 4]
call fcn.00405534
mov eax, dword [ebp - 0x10]
call fcn.0040a730
test al, al
je 0x4e2248
mov eax, dword [ebp - 0x10]
call fcn.004056ac
push eax
call sub.kernel32.dll_DeleteFileA_1
lea eax, [ebp - 0x1c]
mov ecx, 0x4e2328
mov edx, dword [ebp - 0x14]
call fcn.00405534
push 0
mov eax, dword [ebp - 0x1c]
call fcn.004056ac
push eax
mov eax, dword [ebp - 0x18]
call fcn.004056ac
push eax
call sub.kernel32.dll_CopyFileA
mov eax, dword [ebp - 0x18]
call fcn.004056ac
push eax
call sub.kernel32.dll_DeleteFileA_1
mov ecx, 0x4e2360
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
call fcn.004e0730
mov eax, dword [ebp - 0x1c]
call fcn.004056ac
push eax
call sub.kernel32.dll_DeleteFileA_1
mov eax, dword [ebp - 0x14]
call fcn.0040af70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e22d4
lea eax, [ebp - 0x2c]
mov edx, 3
call fcn.00405240
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.00405240
ret
Function at 0x4e23dc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
call fcn.0040569c
mov eax, dword [ebp - 8]
call fcn.0040569c
mov eax, dword [ebp + 8]
call fcn.0040569c
xor eax, eax
push ebp
push 0x4e2588
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x398]
xor edx, edx
call fcn.00442c24
xor eax, eax
push ebp
push 0x4e253e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
mov ecx, 0x4e25a0
mov edx, dword [0x4f4158]
call fcn.00405534
mov eax, dword [ebp - 0xc]
call fcn.0040a754
test al, al
jne 0x4e2466
mov eax, dword [ebp - 0xc]
call fcn.0040a778
mov eax, dword [ebp - 4]
mov edx, 0x4e25b0
call fcn.00405644
jne 0x4e24cb
lea eax, [ebp - 0x18]
mov ecx, 0x4e25c0
mov edx, dword [ebp + 8]
call fcn.00405534
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov edx, dword [0x4f4158]
call fcn.004e0730
push dword [0x4f4158]
push 0x4e25d8
push dword [ebp - 8]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004055b0
push 0xa
push 0
push 0
mov eax, dword [ebp - 0x10]
call fcn.004056ac
push eax
push 0x4e25dc
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
call fcn.004e10f8
push dword [ebp - 0xc]
push 0x4e25d8
push dword [ebp - 8]
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.004055b0
mov eax, dword [ebp - 0x1c]
call fcn.0040a730
test al, al
je 0x4e2534
push 0xa
push 0
push 0
push dword [ebp - 0xc]
push 0x4e25d8
push dword [ebp - 8]
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.004055b0
mov eax, dword [ebp - 0x20]
call fcn.004056ac
push eax
push 0x4e25dc
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4e2548
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x398]
mov dl, 1
call fcn.00442c24
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e258f
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00405240
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00405240
lea eax, [ebp + 8]
call fcn.0040521c
ret

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
mov ebx, 0x40de38
nop
nop
mov ecx, 0x205f5faa
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x4304d8
mov ecx, 0x59634870
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x1730058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x17301a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x173007e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x173006a
add dl, dl
jne 0x1730089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x17300dc
xor eax, eax
add dl, dl
jne 0x1730096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x173017d
add dl, dl
jne 0x17300a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x17300b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x17300bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x17300c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x17300d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1730075
mov eax, 1
add dl, dl
jne 0x17300ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x17300f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x17300e1
sub eax, ebx
mov ebx, 1
jne 0x1730128
mov ecx, 1
add dl, dl
jne 0x173010e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1730119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1730105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1730075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x173013f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x173014a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1730136
cmp eax, 0x7d00
jae 0x173016d
cmp eax, 0x500
jb 0x1730168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1730075
cmp eax, 0x7f
ja 0x1730170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1730075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x173019e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1730075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x3001ccbc
Capabilities:
Set thread local storage value

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [eax + 4]
mov edx, dword [eax]
cmp ecx, edx
jb 0x3001ccdd
mov eax, dword [eax + 8]
cmp ecx, eax
jb 0x3001ccdd
cmp edx, eax
jb 0x3001ccdd
add eax, 0x10000
cmp eax, ecx
jae 0x3001cd08
mov eax, dword [0x30036574]
push 0
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push 0
push 0x35636561
call fcn.300217b4
push 0
push 0
push 1
push 0xe0000001
call dword [sym.imp.kernel32.dll_RaiseException]
ret

Function at 0x300217b4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x300217c3
pop dword [ebp - 0x40]
mov eax, 0xd9e40815
sub eax, 0xa9e1f052
sub dword [ebp - 0x40], eax
push 0x40
push 0x1000
push 0x3928c
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x40]
call dword [eax]
mov ecx, 0xc61941b1
sub ecx, 0xc619034e
xor edx, edx
add edx, eax
mov edi, 0xb3395da6
add edi, 0x7ccd925a
add edi, dword [ebp - 0x40]
mov esi, 0xc28d0dab
mov ebx, dword [edi]
xor ebx, esi
mov dword [ebp - 0xc], 0x73405c1c
mov dword [edx], ebx
mov dword [ebp - 0x3c], 0x46fa9bcb
add edx, 4
add edi, 0x22c7ef35
add edi, 0xdd3810cf
loop 0x30021819
add eax, 0xafef44df
sub eax, 0xafee5880
xor ebx, ebx
add ebx, eax
add eax, 0x22ef661c
sub eax, 0x22ef6617
mov ecx, 0x30000000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x300305d2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x3001b290]
jne 0x30031279
ret
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x3006bce0], eax
mov dword [0x3006bcdc], ecx
mov dword [0x3006bcd8], edx
mov dword [0x3006bcd4], ebx
mov dword [0x3006bcd0], esi
mov dword [0x3006bccc], edi
mov word [0x3006bcf8], ss
mov word [0x3006bcec], cs
mov word [0x3006bcc8], ds
mov word [0x3006bcc4], es
mov word [0x3006bcc0], fs
mov word [0x3006bcbc], gs
pushfd
pop dword [0x3006bcf0]
mov eax, dword [ebp]
mov dword [0x3006bce4], eax
mov eax, dword [ebp + 4]
mov dword [0x3006bce8], eax
lea eax, [ebp + 8]
mov dword [0x3006bcf4], eax
mov eax, dword [ebp - 0x320]
mov dword [0x3006bc30], 0x10001
mov eax, dword [0x3006bce8]
mov dword [0x3006bbe4], eax
mov dword [0x3006bbd8], 0xc0000409
mov dword [0x3006bbdc], 1
mov eax, dword [0x3001b290]
mov dword [ebp - 0x328], eax
mov eax, dword [0x300671ac]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x3006bc28], eax
push 1
call sub.msvcr80.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x3001b568
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x3006bc28], 0
jne 0x30031369
push 1
call sub.msvcr80.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
Function at 0x30030e08
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x30034158
call fcn.3003107e
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x3006bf28
push ebx
push esi
push edi
call dword [sym.imp.kernel32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x30030bf8
cmp eax, esi
jne 0x30030beb
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x30030bfb
push 0x3e8
call dword [sym.imp.kernel32.dll_Sleep]
jmp 0x30030bd2
xor esi, esi
inc esi
mov eax, dword [0x3006bf24]
cmp eax, esi
jne 0x30030c0e
push 0x1f
call sub.msvcr80.dll__amsg_exit
pop ecx
jmp 0x30030c49
mov eax, dword [0x3006bf24]
test eax, eax
jne 0x30030c43
mov dword [0x3006bf24], esi
push 0x30001378
push 0x3000136c
call sub.msvcr80.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x30030c49
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x30030d20
mov dword [0x3006bbd0], esi
mov eax, dword [0x3006bf24]
cmp eax, esi
jne 0x30030c6d
push 0x30001368
push 0x30001350
call sub.msvcr80.dll__initterm
pop ecx
pop ecx
mov dword [0x3006bf24], 2
cmp dword [ebp - 0x1c], ebx
jne 0x30030c7a
push ebx
push edi
call dword [sym.imp.kernel32.dll_InterlockedExchange]
cmp dword [0x3006bf34], ebx
je 0x30030c9b
push 0x3006bf34
call fcn.3003143c
pop ecx
test eax, eax
je 0x30030c9b
push ebx
push 2
push ebx
call dword [0x3006bf34]
mov eax, dword [0x3006bbb8]
mov ecx, dword [sym.imp.msvcr80.dll___winitenv]
mov dword [ecx], eax
push dword [0x3006bbb8]
push dword [0x3006bbbc]
push dword [0x3006bbb4]
call fcn.300217b4
add esp, 0xc
mov dword [0x3006bbcc], eax
cmp dword [0x3006bbc0], ebx
jne 0x30030d06
push eax
call dword [sym.imp.msvcr80.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcr80.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x3006bbd0], ebx
jne 0x30030d14
call dword [sym.imp.msvcr80.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x3006bbcc]
call fcn.300310c3
ret
call fcn.300217b4
jmp 0x30030bb0

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x40262e
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x402662
push 6
call fcn.0045183e
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jne 0x4026d6
push reloc.WS2_32.dll_connect
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x402684
mov eax, 0x47a2d5
push eax
push 1
mov ebx, 0x25c
call fcn.00456720
add esp, 0x10
mov dword [ebp - 4], eax
push 0x80000301
push 0
push 0x20
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc4
call fcn.00456730
add esp, 0x1c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
mov eax, 0
setne al
jmp 0x4026e0
mov eax, 0
jmp 0x4026e0
mov esp, ebp
pop ebp
ret 4

Function at 0x40272d
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
push reloc.WS2_32.dll_getsockname
push 0
push dword [ebp + 8]
push 1
mov ebx, 0x9dc
call fcn.00456750
add esp, 0x10
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp - 8]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x402795
push 6
call fcn.0045183e
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp + 0x18], 0
jne 0x4027d3
cmp dword [ebp - 4], 0
je 0x4027ce
mov dword [ebp - 8], esp
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x4027ce
push 6
call fcn.0045183e
add esp, 4
jmp 0x4027db
mov eax, dword [ebp - 4]
mov ebx, dword [ebp + 0x14]
mov dword [ebx], eax
cmp dword [ebp - 4], 0
mov eax, 0
setne al
jmp 0x4027ec
mov esp, ebp
pop ebp
ret 0x14
Function at 0x406ccd
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
push 8
call fcn.00451832
add esp, 4
mov dword [ebp - 8], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0x10
call fcn.00451832
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x10], 0
push 0x10
call fcn.00451832
add esp, 4
mov dword [ebp - 0x14], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
nop
nop
nop
nop
cmp dword [ebp - 0x18], esp
je 0x406d7c
push 6
call fcn.0045183e
add esp, 4
mov dword [ebp - 0x1c], eax
push 0x80000301
push 0
push 8
push 0x80000301
push 0
push 0x20
push 2
mov ebx, 0xc8
call fcn.00455fb0
add esp, 0x1c
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], esp
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
nop
nop
nop
nop
cmp dword [ebp - 0x24], esp
je 0x406dd5
push 6
call fcn.0045183e
add esp, 4
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00456010
add esp, 0x10
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], esp
push dword [ebp - 8]
push str.SeDebugPrivilege
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
nop
nop
nop
nop
cmp dword [ebp - 0x1c], esp
je 0x406e20
push 6
call fcn.0045183e
add esp, 4
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x406e30
push ebx
call fcn.00451838
add esp, 4
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 1
mov ebx, dword [ebp - 0xc]
add ebx, 4
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 8]
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0xc]
add ebx, 8
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 8]
add ebx, 4
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0xc]
add ebx, 0xc
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 2
mov dword [ebp - 0x18], esp
mov eax, 0
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x14]
push 0x1c
push dword [ebp - 0xc]
push 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
nop
nop
nop
nop
cmp dword [ebp - 0x18], esp
je 0x406ec4
push 6
call fcn.0045183e
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], esp
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
cmp dword [ebp - 0x18], esp
je 0x406ee9
push 6
call fcn.0045183e
add esp, 4
mov eax, dword [ebp - 0x10]
jmp 0x406ef1
push eax
mov ebx, dword [ebp - 8]
push ebx
call fcn.00451838
add esp, 4
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.00451838
add esp, 4
mov ebx, dword [ebp - 0x14]
push ebx
call fcn.00451838
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x40d675
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], esp
push 0
push 0
mov ebx, dword [ebp + 0xc]
push dword [ebx]
mov ebx, dword [ebp + 8]
push dword [ebx]
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x40d6b6
push 6
call fcn.0045183e
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
mov eax, 0
sete al
jmp 0x40d6ca
mov esp, ebp
pop ebp
ret 8
Function at 0x410a72
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], esp
push dword [ebp + 8]
push dword [0x63753f]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x410abf
push 6
call fcn.0045183e
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x410ad6
mov eax, 0x47a38d
jmp 0x410bd4
mov dword [ebp - 0x14], esp
push dword [ebp + 8]
push dword [0x63753f]
call dword [sym.imp.KERNEL32.dll_LoadResource]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x410afe
push 6
call fcn.0045183e
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x410b15
mov eax, 0x47a38d
jmp 0x410bd4
mov dword [ebp - 0x14], esp
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LockResource]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x410b37
push 6
call fcn.0045183e
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x410b4e
mov eax, 0x47a38d
jmp 0x410bd4
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x1bc
call fcn.00456940
add esp, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x410b81
push ebx
call fcn.00451838
add esp, 4
pop eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esp
push dword [ebp - 4]
push dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x410b98
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_RtlMoveMemory]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x410bb5
push 6
call fcn.0045183e
add esp, 4
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x410bcf
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.00451832
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x410bd4
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x410be5
push ebx
call fcn.00451838
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x4118ea
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ebx, dword [0x63754f]
mov dword [ebp - 4], ebx
push 0x47a2d5
mov ebx, dword [ebp - 4]
push dword [ebx]
call fcn.00401dec
add esp, 8
cmp eax, 0
je 0x4119bb
mov ebx, dword [0x63754f]
mov dword [ebp - 4], ebx
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00456010
add esp, 0x10
mov dword [ebp - 8], eax
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00456010
add esp, 0x10
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push 1
push dword [ebp - 0xc]
push dword [ebp - 8]
mov ebx, dword [ebp - 4]
push dword [ebx]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x41199b
push 6
call fcn.0045183e
add esp, 4
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4119ab
push ebx
call fcn.00451838
add esp, 4
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x4119bb
push ebx
call fcn.00451838
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x41d99f
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], esp
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x41d9cf
push 6
call fcn.0045183e
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
mov eax, 0
setne al
jmp 0x41d9e3
mov esp, ebp
pop ebp
ret 4

Function at 0x41da33
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
cmp dword [0x637623], 0
jle 0x41da6b
cmp dword [0x63760f], 0
jle 0x41da6b
mov eax, 1
jmp 0x41da6d
xor eax, eax
test eax, eax
je 0x41db45
push 1
push dword [0x637623]
call fcn.0041db4b
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
jne 0x41db2c
push 0x63761f
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 8]
lea eax, [ebp - 8]
push eax
call fcn.00407521
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push dword [ebp - 0xc]
push dword [0x63760f]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x41dad2
push 6
call fcn.0045183e
add esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x41db18
mov dword [ebp - 0xc], esp
push dword [0x63760f]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x41db04
push 6
call fcn.0045183e
add esp, 4
mov dword [0x63760f], 0
mov dword [0x637623], 0
push 0x63761f
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xc]
jmp 0x41db45
cmp dword [ebp - 4], 0
jne 0x41db45
push 0x6376b7
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xc]
mov esp, ebp
pop ebp
ret 0x10