joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6028e0
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x190]
test eax, eax
je 0x602982
cmp dword [ebx + 0xac], 0
jne 0x60297c
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x602820
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0xa8]
cmp dword [eax + 8], 0
je 0x60297c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x602942
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0xa8]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x60297c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [ebx + 0xa8]
mov edx, esi
call fcn.004bd30c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x602951
inc dword [ebx + 0xac]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x602cb8
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x73fc30]
cmp dword [eax + 0x190], 0
je 0x602e1d
test bl, bl
jne 0x602d72
cmp dword [esi + 0xb4], 0
jne 0x602d67
mov eax, esi
call fcn.00606020
push eax
push 0x602bc0
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x58], 0
je 0x602d38
mov eax, dword [0x73fc30]
cmp byte [eax + 0xeb], 0
je 0x602d38
mov eax, dword [esi + 0xf0]
test eax, eax
je 0x602d19
mov eax, dword [eax - 4]
mov edi, eax
dec edi
cmp edi, 0
jl 0x602d38
push 0
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x602d21
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x602d67
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.004bd30c
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x602d47
inc dword [esi + 0xb4]
jmp 0x602e1d
cmp dword [esi + 0xb4], 0
jle 0x602e1d
dec dword [esi + 0xb4]
cmp dword [esi + 0xb4], 0
jne 0x602e1d
cmp dword [esi + 0x58], 0
je 0x602dd2
mov eax, dword [0x73fc30]
cmp byte [eax + 0xeb], 0
je 0x602dd2
mov eax, dword [esi + 0xf0]
test eax, eax
je 0x602db3
mov eax, dword [eax - 4]
mov edi, eax
dec edi
cmp edi, 0
jl 0x602dd2
push 5
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x602dbb
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x602e01
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.004bd30c
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x602de1
mov eax, dword [esi + 0xb0]
mov edx, dword [eax]
call dword [edx + 8]
lea eax, [esi + 0xf0]
mov edx, dword [0x5ee350]
call fcn.0040ebf4
pop edi
pop esi
pop ebx
ret
Function at 0x603c24
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xc4], 0
je 0x603c7f
cmp byte [ebx + 0xeb], 0
jne 0x603c7f
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x190]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040ba9c
mov eax, dword [esi]
test eax, eax
je 0x603c6c
mov eax, dword [eax - 4]
test eax, eax
jne 0x603c8c
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040bcf4
jmp 0x603c8c
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040bcf4
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x6058ac
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x98]
test esi, esi
je 0x60591d
mov eax, esi
call fcn.0055d064
test al, al
je 0x60591d
mov eax, dword [ebx + 0x98]
call fcn.0055cbfc
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x60591d
mov eax, dword [ebx + 0x98]
mov edx, dword [eax]
call dword [edx + 0x17c]
test al, al
je 0x60590e
push 0
mov eax, dword [ebx + 0x98]
call fcn.0055cbfc
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebx + 0x98]
xor edx, edx
call fcn.00552890
jmp 0x60591d
mov edx, dword [ebx + 0x88]
mov cl, 1
mov eax, ebx
call fcn.006056b8
pop esi
pop ebx
ret
Function at 0x61f03c
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.0040b9f8
xor eax, eax
push ebp
push 0x61f17b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x61f14c
xor edx, edx
push ebp
push 0x61f145
push dword fs:[edx]
mov dword fs:[edx], esp
mov ebx, dword [ebp - 4]
mov eax, ebx
test eax, eax
je 0x61f087
mov eax, dword [eax - 4]
add eax, eax
add eax, 2
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x61f118
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov esi, eax
xor eax, eax
push ebp
push 0x61f107
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x61f0c8
mov ebx, dword [ebx - 4]
mov eax, dword [ebp - 4]
call fcn.0040c408
mov ecx, ebx
add ecx, ecx
add ecx, 2
mov edx, esi
call fcn.00407410
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 0xd
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61f10e
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
pop eax
jmp eax
mov ecx, dword [0x737ad8]
mov dl, 1
mov eax, dword [0x4209c4]
call fcn.004312a0
call fcn.0040afb0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61f182
lea eax, [ebp - 4]
call fcn.0040b904
pop eax
jmp eax
Function at 0x625ca8
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x625cd6
mov eax, ebx
call fcn.00626764
cmp dword [ebx + 0x40], 0
je 0x625ccf
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x625d47
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x625d39
cmp dword [ebx + 8], 0
je 0x625cf8
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x625d0a
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x625d39
cmp dword [ebx + 8], 0
je 0x625ceb
cmp eax, 3
je 0x625d1d
dec eax
jne 0x625ceb
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x625ceb
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x625ceb
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x625d65
cmp dword [ebx + 0x14], 0xcc
je 0x625d65
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00625d70
pop ebx
ret

Function at 0x63a55c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x7400dc], 0
jne 0x63a573
call fcn.0063a518
mov eax, edi
dec eax
test eax, eax
jl 0x63a59b
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x73fcdc]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x63a57d
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x63d668
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x63d699
dec al
je 0x63d6d4
dec al
je 0x63d718
dec al
je 0x63d78a
jmp 0x63d825
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x63d825
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x63d6a9
jmp 0x63d825
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x63d825
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
movzx ecx, al
mov ecx, dword [ebx + ecx*4 + 0x40]
add dl, byte [ecx + esi]
and dl, 0xff
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x63d6e4
jmp 0x63d825
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x63d825
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, dword [ebx + 0x24]
mov ecx, esi
dec ecx
cmp edx, ecx
jbe 0x63d74b
xor edx, edx
mov dword [esp + 4], edx
jmp 0x63d760
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov ebp, dword [ebx + edx*4 + 0x40]
movzx edx, byte [ebp + esi]
add eax, dword [esp + 4]
sar eax, 1
jns 0x63d778
adc eax, 0
add dl, al
and dl, 0xff
mov byte [ebp + esi], dl
inc esi
dec edi
jne 0x63d728
jmp 0x63d825
xor eax, eax
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 8], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x63d825
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, dword [ebx + 0x24]
mov ecx, esi
dec ecx
cmp edx, ecx
ja 0x63d7f1
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 8], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 8]
push eax
movzx eax, byte [esp + 8]
pop edx
call fcn.0063a5a4
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [esp]
and al, 0xff
mov byte [edx + esi], al
inc esi
dec edi
jne 0x63d7a6
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x6472c4
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040b9f8
mov eax, dword [ebp - 8]
call fcn.0040b9f8
xor eax, eax
push ebp
push 0x64744c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.00429948
test al, al
je 0x64740f
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
call fcn.0040c408
mov ebx, eax
push ebx
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jle 0x64741c
mov eax, dword [ebp - 0x18]
call fcn.00406eb0
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x647408
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x1c]
push eax
push ebx
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x6473ed
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
push 0x647458
mov eax, dword [ebp - 0x14]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x6473c4
mov eax, dword [ebp - 0x20]
mov ebx, dword [eax]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x20]
movzx eax, word [eax]
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0
shr ebx, 0x10
movzx eax, bx
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0
mov eax, dword [ebp - 8]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0x11
lea edx, [ebp - 0x44]
mov ecx, 2
mov eax, 0x647498
call fcn.0042a9a4
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 8]
call fcn.0040bd3c
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 8]
call fcn.0040c408
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x6473ed
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 0x24]
call fcn.0042a7bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64741c
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
call fcn.00406ecc
pop eax
jmp eax
lea eax, [ebp - 0xc]
mov edx, 0x6474e4
call fcn.0040bd3c
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.0040bcf4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x647453
lea eax, [ebp - 0x2c]
call fcn.0040b904
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040b964
pop eax
jmp eax

Function at 0x6475e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jbe 0x647635
xor eax, eax
push ebp
push 0x64762e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_TerminateProcess
call fcn.00433fd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x647635
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle
pop eax
jmp eax
pop ecx
pop ebp
ret
Function at 0x648ac8
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffdc
mov ebx, eax
mov eax, ebx
call fcn.0040b904
xor eax, eax
mov dword [esp], eax
mov dword [esp], 0x10
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameW
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x10
call fcn.0040c4bc
add esp, 0x24
pop ebx
ret

Function at 0x654354
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x6543a5
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x65438c
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x65437c
jmp 0x6543a5
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x65438d
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x699cc0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x699d5a
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0
push 0
lea edx, [ebp - 0x14]
mov eax, dword [0x738138]
mov eax, dword [eax]
call fcn.00604f78
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.0042a0a0
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.0042a0a0
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.0042a0a0
push dword [ebp - 8]
push 0x699d74
push 0x699d98
lea eax, [ebp - 4]
mov edx, 3
call fcn.0040c6f8
mov eax, dword [ebp - 4]
call fcn.0040c408
push eax
push 0x699d9c
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x699d61
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.0040b964
pop eax
jmp eax

Function at 0x699da8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
xor eax, eax
push ebp
push 0x699e2b
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0
push 0
lea edx, [ebp - 0xc]
mov eax, dword [0x738138]
mov eax, dword [eax]
call fcn.00604f78
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.0042a190
push dword [ebp - 8]
push 0x699e44
push 0x699e54
lea eax, [ebp - 4]
mov edx, 3
call fcn.0040c6f8
mov eax, dword [ebp - 4]
call fcn.0040c408
push eax
push 0x699e58
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x699e32
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040b964
pop eax
jmp eax
Function at 0x69a0c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x69a15a
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0
push 0
lea edx, [ebp - 0x14]
mov eax, dword [0x738138]
mov eax, dword [eax]
call fcn.00604f78
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.0042a0a0
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.0042a0a0
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.0042a0a0
push dword [ebp - 8]
push 0x69a174
push 0x69a1a4
lea eax, [ebp - 4]
mov edx, 3
call fcn.0040c6f8
mov eax, dword [ebp - 4]
call fcn.0040c408
push eax
push 0x69a1a8
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x69a161
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.0040b964
pop eax
jmp eax
Function at 0x69a614
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x69a6ae
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0
push 0
lea edx, [ebp - 0x14]
mov eax, dword [0x738138]
mov eax, dword [eax]
call fcn.00604f78
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.0042a0a0
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.0042a0a0
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.0042a0a0
push dword [ebp - 8]
push 0x69a6c8
push 0x69a700
lea eax, [ebp - 4]
mov edx, 3
call fcn.0040c6f8
mov eax, dword [ebp - 4]
call fcn.0040c408
push eax
push 0x69a704
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x69a6b5
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.0040b964
pop eax
jmp eax

Function at 0x69a880
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x69a91a
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0
push 0
lea edx, [ebp - 0x14]
mov eax, dword [0x738138]
mov eax, dword [eax]
call fcn.00604f78
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.0042a0a0
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.0042a0a0
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.0042a0a0
push dword [ebp - 8]
push 0x69a934
push 0x69a968
lea eax, [ebp - 4]
mov edx, 3
call fcn.0040c6f8
mov eax, dword [ebp - 4]
call fcn.0040c408
push eax
push 0x69a96c
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x69a921
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.0040b964
pop eax
jmp eax
Function at 0x6aa15c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
xor eax, eax
push ebp
push 0x6aa33c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x6aa354
call fcn.0040bd3c
mov eax, dword [0x737a0c]
cmp byte [eax], 0
je 0x6aa199
lea eax, [ebp - 4]
mov edx, 0x6aa398
call fcn.0040c618
jmp 0x6aa1a6
lea eax, [ebp - 4]
mov edx, 0x6aa3d4
call fcn.0040c618
mov eax, dword [0x737d2c]
cmp byte [eax], 0
je 0x6aa1bf
lea eax, [ebp - 4]
mov edx, 0x6aa414
call fcn.0040c618
jmp 0x6aa1cc
lea eax, [ebp - 4]
mov edx, 0x6aa448
call fcn.0040c618
mov eax, dword [0x737dd8]
cmp byte [eax], 0
je 0x6aa1e5
lea eax, [ebp - 4]
mov edx, 0x6aa480
call fcn.0040c618
jmp 0x6aa1f2
lea eax, [ebp - 4]
mov edx, 0x6aa4a4
call fcn.0040c618
mov eax, dword [0x738560]
mov eax, dword [eax]
mov edx, 0x6aa4cc
call fcn.0040c808
jne 0x6aa212
lea eax, [ebp - 4]
mov edx, 0x6aa4ec
call fcn.0040c618
mov eax, dword [0x738560]
mov eax, dword [eax]
mov edx, 0x6aa528
call fcn.0040c808
jne 0x6aa232
lea eax, [ebp - 4]
mov edx, 0x6aa544
call fcn.0040c618
mov eax, dword [0x738560]
mov eax, dword [eax]
mov edx, 0x6aa578
call fcn.0040c808
jne 0x6aa28a
lea eax, [ebp - 4]
mov edx, 0x6aa590
call fcn.0040c618
push dword [ebp - 4]
push 0x6aa5c4
mov eax, dword [0x738174]
push dword [eax]
lea eax, [ebp - 4]
mov edx, 3
call fcn.0040c6f8
push dword [ebp - 4]
push 0x6aa5e8
mov eax, dword [0x737e3c]
push dword [eax]
lea eax, [ebp - 4]
mov edx, 3
call fcn.0040c6f8
mov eax, dword [0x737a50]
mov eax, dword [eax]
mov edx, 0x6aa610
call fcn.0040c808
je 0x6aa2ba
mov eax, dword [0x7381ec]
cmp byte [eax], 0
jne 0x6aa2c9
mov eax, dword [0x737a50]
mov eax, dword [eax]
mov edx, 0x6aa4cc
call fcn.0040c808
jne 0x6aa2c9
lea eax, [ebp - 4]
mov edx, 0x6aa62c
call fcn.0040c618
jmp 0x6aa2d6
lea eax, [ebp - 4]
mov edx, 0x6aa674
call fcn.0040c618
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.0040c408
push eax
lea edx, [ebp - 0xc]
mov eax, dword [0x738138]
mov eax, dword [eax]
call fcn.00604f78
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.0042a0a0
lea eax, [ebp - 8]
mov edx, 0x6aa6bc
call fcn.0040c618
mov eax, dword [ebp - 8]
call fcn.0040c408
push eax
push 0x6aa6f0
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6aa343
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040b964
pop eax
jmp eax
Function at 0x401b1c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor eax, eax
mov dword [ebp - 4], eax
lea edx, [ebp - 4]
push edx
push 0
push dword [ebp + 8]
push 0x401784
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [ebp - 8], eax
push 0xffffffffffffffff
push dword [ebp - 8]
call sub.KERNEL32.DLL_WaitForSingleObject
xor ecx, ecx
mov dword [ebp - 0xc], ecx
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
call sub.KERNEL32.DLL_GetExitCodeThread
push dword [ebp - 8]
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x403f64
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
mov esi, 0x48e314
push 0xa
push 0x403ff8
mov eax, dword [0x48e2f4]
push eax
call sub.KERNEL32.DLL_FindResourceW
mov ebx, eax
test ebx, ebx
jne 0x403f88
call fcn.0041e350
push ebx
mov eax, dword [0x48e2f4]
push eax
call sub.KERNEL32.DLL_LoadResource
mov ebx, eax
test ebx, ebx
jne 0x403f9f
call fcn.0041e350
push ebx
call sub.KERNEL32.DLL_LockResource
mov dword [esi], eax
cmp dword [esi], 0
jne 0x403fb1
call fcn.0041e350
mov eax, dword [esi]
mov edx, dword [esi]
mov ecx, edx
add ecx, dword [eax]
mov dword [0x48e318], ecx
mov ecx, edx
add ecx, dword [eax + 4]
mov dword [0x48e31c], ecx
mov ecx, edx
add ecx, dword [eax + 8]
mov dword [0x48e320], ecx
mov ecx, edx
add ecx, dword [eax + 0xc]
mov dword [0x48e324], ecx
mov ecx, edx
add ecx, dword [eax + 0x10]
mov dword [0x48e328], ecx
add edx, dword [eax + 0x14]
mov dword [0x48e32c], edx
pop esi
pop ebx
ret

Function at 0x411a60
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.00411764
dec esi
jne 0x411a82
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret

Function at 0x412c2c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x48e614
cmp dword [edi], 0
jne 0x412ca8
push 0x40
push 0x1000
push 0x1000
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov esi, eax
mov eax, dword [0x48e610]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x486394
mov ecx, 2
call fcn.00429638
mov edx, 0x412c04
lea eax, [esi + 5]
call fcn.00412c24
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.00412c24
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x412c7d
mov dword [0x48e610], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8