joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4359c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0x80004005
push str.HTML
mov eax, dword [ebp + 0x10]
push eax
call fcn.0041d4aa
add esp, 8
test eax, eax
je 0x4359ea
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x1c], ecx
jmp 0x4359f1
mov dword [ebp - 0x1c], 0x17
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x435ab8
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x435ab8
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x435ab8
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x435aae
mov ecx, dword [ebp - 0xc]
add ecx, 1
push ecx
call fcn.0041bb9e
add esp, 4
mov dword [ebp - 0x18], eax
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp - 0x18]
mov dword [edx], eax
mov ecx, dword [ebp + 0x14]
cmp dword [ecx], 0
je 0x435aae
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
push edx
call fcn.0041d810
add esp, 0xc
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
mov edx, dword [ebp - 0xc]
mov byte [ecx + edx], 0
cmp dword [ebp + 0x18], 0
je 0x435aa7
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x435b50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov eax, dword [ebp + 0x10]
mov cl, byte [eax + 0x100]
mov byte [ebp - 2], cl
mov edx, dword [ebp + 0x10]
mov al, byte [edx + 0x101]
mov byte [ebp - 1], al
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x10], ecx
xor edx, edx
mov word [ebp - 8], dx
jmp 0x435b89
mov ax, word [ebp - 8]
add ax, 1
mov word [ebp - 8], ax
movsx ecx, word [ebp - 8]
cmp ecx, dword [ebp + 0xc]
jge 0x435c54
movzx edx, byte [ebp - 2]
add edx, 1
and edx, 0x800000ff
jns 0x435bad
dec edx
or edx, 0xffffff00
inc edx
mov byte [ebp - 2], dl
movzx eax, byte [ebp - 2]
mov ecx, dword [ebp - 0x10]
movzx edx, byte [ecx + eax]
movzx eax, byte [ebp - 1]
add edx, eax
and edx, 0x800000ff
jns 0x435bd1
dec edx
or edx, 0xffffff00
inc edx
mov byte [ebp - 1], dl
movzx ecx, byte [ebp - 2]
mov edx, dword [ebp - 0x10]
mov al, byte [edx + ecx]
mov byte [ebp - 9], al
movzx ecx, byte [ebp - 1]
movzx edx, byte [ebp - 2]
mov eax, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
mov cl, byte [esi + ecx]
mov byte [eax + edx], cl
movzx edx, byte [ebp - 1]
mov eax, dword [ebp - 0x10]
mov cl, byte [ebp - 9]
mov byte [eax + edx], cl
movzx edx, byte [ebp - 2]
mov eax, dword [ebp - 0x10]
movzx ecx, byte [eax + edx]
movzx edx, byte [ebp - 1]
mov eax, dword [ebp - 0x10]
movzx edx, byte [eax + edx]
add ecx, edx
and ecx, 0x800000ff
jns 0x435c2a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [ebp - 0xa], cl
movsx eax, word [ebp - 8]
movzx ecx, byte [ebp - 0xa]
mov edx, dword [ebp - 0x10]
movzx ecx, byte [edx + ecx]
mov edx, dword [ebp + 8]
movzx eax, byte [edx + eax]
xor eax, ecx
movsx ecx, word [ebp - 8]
mov edx, dword [ebp + 8]
mov byte [edx + ecx], al
jmp 0x435b7d
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 2]
mov byte [eax + 0x100], cl
mov edx, dword [ebp + 0x10]
mov al, byte [ebp - 1]
mov byte [edx + 0x101], al
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x435da0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x14]
shl eax, 1
mov dword [ebp - 8], eax
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 0x10]
push edx
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x435dd9
cmp dword [ebp - 4], 1
je 0x435ddd
xor eax, eax
jmp 0x435de2
mov eax, dword [ebp - 8]
shr eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x435df0
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x334
mov eax, dword [0x44f1a4]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x214], 0
lea eax, [ebp - 0x210]
push eax
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xor ecx, ecx
mov word [ebp - 0x20a], cx
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x214]
push edx
push 0
push 0
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov ecx, dword [ebp - 0x214]
push ecx
push str._.8x
lea edx, [ebp - 0x330]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov dword [ebp - 0x218], eax
lea eax, [ebp - 0x320]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.00435c80
add esp, 0xc
lea eax, [ebp - 0x320]
push eax
mov ecx, dword [ebp - 0x218]
push ecx
lea edx, [ebp - 0x330]
push edx
call fcn.00435b50
add esp, 0xc
mov dword [ebp - 4], 0x4526a0
mov dword [ebp - 0x334], 0
jmp 0x435eca
mov eax, dword [ebp - 0x334]
add eax, 1
mov dword [ebp - 0x334], eax
mov ecx, dword [ebp - 0x334]
cmp ecx, dword [ebp - 0x218]
jge 0x435f04
mov edx, dword [ebp - 0x334]
movzx eax, byte [ebp + edx - 0x330]
push eax
push 0x445b80
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov edx, dword [ebp - 4]
lea eax, [edx + eax*2]
mov dword [ebp - 4], eax
jmp 0x435ebb
mov eax, 0x4526a0
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0041bbb4
mov esp, ebp
pop ebp
ret

Function at 0x435f20
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push 0x44
lea eax, [ebp - 0x58]
push eax
call fcn.00435d70
add esp, 8
push 0x10
lea ecx, [ebp - 0x10]
push ecx
call fcn.00435d70
add esp, 8
mov dword [ebp - 0x58], 0x44
lea edx, [ebp - 0x58]
push edx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x58]
push ecx
push 0
push 0
push 0xc000000
push 0
push 0
push 0
mov edx, dword [ebp + 8]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x435fb2
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x5c], eax
lea edx, [ebp - 0x5c]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x5c]
jmp 0x435fb4
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x436040
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x44f1a4]
xor eax, ebp
mov dword [ebp - 8], eax
xor eax, eax
mov ecx, dword [ebp + 8]
mov word [ecx], ax
call fcn.00435fc0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x43616c
push 0x104
lea edx, [ebp - 0x210]
push edx
push str.INSTALL_FOLDER_NAME
mov eax, dword [ebp - 4]
push eax
call fcn.00435da0
add esp, 0x10
test eax, eax
je 0x436162
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrCatW]
push 0x445a80
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_StrCatW]
push 0x104
lea eax, [ebp - 0x210]
push eax
push 0x445a84
mov ecx, dword [ebp - 4]
push ecx
call fcn.00435da0
add esp, 0x10
lea edx, [ebp - 0x210]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
push 0x445a94
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrCatW]
push 0x104
lea edx, [ebp - 0x210]
push edx
push 0x445a98
mov eax, dword [ebp - 4]
push eax
call fcn.00435da0
add esp, 0x10
test eax, eax
je 0x436162
lea ecx, [ebp - 0x210]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_StrCatW]
push 0x445aa4
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x436162
xor edx, edx
mov eax, dword [ebp + 8]
mov word [eax], dx
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0041bbb4
mov esp, ebp
pop ebp
ret

Function at 0x436190
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x44f1a4]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x210]
push eax
call fcn.00436040
add esp, 4
test eax, eax
jne 0x4361bd
mov eax, 0x62
jmp 0x436225
push 0x445aa8
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrCatW]
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4361e7
mov eax, 0x63
jmp 0x436225
push str.VTM3C6kW4BzLIpq0hKVkVaLMSLNpdvbwZ1ujeYpnFeY3Qs6E
call fcn.00435df0
add esp, 4
push eax
lea eax, [ebp - 0x210]
push eax
push str.__s___Uninstall__su_s
lea ecx, [ebp - 0x418]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0xea60
lea edx, [ebp - 0x418]
push edx
call fcn.00435f20
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041bbb4
mov esp, ebp
pop ebp
ret
Function at 0x4362b0
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [ebp + 8], 0
jne 0x4362c3
xor al, al
jmp 0x4363d3
mov byte [ebp - 9], 1
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
mov ecx, dword [ebp - 8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x436302
xor al, al
jmp 0x4363d3
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
push 0
push 0
push 0
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
test eax, eax
jne 0x4363b5
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
jmp 0x43632e
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 8]
mov dword [ebp - 0x10], eax
movzx ecx, byte [ebp - 9]
test ecx, ecx
je 0x4363b5
cmp dword [ebp - 0x10], 0
je 0x4363b5
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0x34], 6
jae 0x436350
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x34]
mov dword [ebp - 0x18], ecx
jmp 0x436357
mov dword [ebp - 0x18], 6
mov edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
mov dword [ebp - 0x14], 0
jmp 0x43636f
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 8]
jae 0x4363b0
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 0x14]
movzx eax, byte [edx + 0x2c]
test eax, eax
je 0x436389
mov byte [ebp - 9], 0
mov ecx, dword [ebp - 0x10]
add ecx, dword [ebp - 0x14]
movzx edx, byte [ecx + 0x2c]
push edx
push str._02X
mov eax, dword [ebp - 0x14]
shl eax, 1
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax*2]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x436366
jmp 0x436325
mov eax, dword [ebp - 4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
movzx eax, byte [ebp - 9]
neg eax
sbb eax, eax
add eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x4363e0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x44f1a4]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0xf
xor eax, eax
mov word [ebp - 0x28], ax
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x436416
mov eax, 0xabcdef
jmp 0x43642a
mov eax, dword [ebp - 4]
shl eax, 1
push eax
lea ecx, [ebp - 0x28]
push ecx
push 0
call fcn.004364e0
add esp, 0xc
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0041bbb4
mov esp, ebp
pop ebp
ret
Function at 0x4364e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x4364f0
xor eax, eax
jmp 0x43668d
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
mov dword [ebp + 8], eax
cmp dword [ebp + 0x10], 8
jb 0x43664e
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x445bc8]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x445bc8]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x445bc8]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x445bc8]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x445bc8]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x445bc8]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x445bc8]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x445bc8]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0x10]
sub eax, 8
mov dword [ebp + 0x10], eax
jmp 0x4364f9
cmp dword [ebp + 0x10], 0
je 0x436687
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x445bc8]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
jne 0x436654
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
pop ebp
ret
Function at 0x436710
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x436737
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0
mov ecx, dword [ebp - 4]
cmp dword [ecx], 0
je 0x436763
movzx edx, byte [ebp + 0xc]
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 8]
cmp edx, ecx
je 0x436763
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, dword [ebp - 4]
mov dword [ecx], 0
mov edx, dword [ebp - 4]
mov al, byte [ebp + 0xc]
mov byte [edx + 8], al
mov ecx, dword [ebp - 4]
cmp dword [ecx], 0
jne 0x43679f
movzx edx, byte [ebp + 0xc]
neg edx
sbb edx, edx
and edx, 0xf0000000
add edx, 0x10000000
push edx
push 0
push 0
push 0
push str.Babylon
call dword [sym.imp.WININET.dll_InternetOpenW]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov edx, dword [ebp - 4]
cmp dword [edx], 0
je 0x4367dc
push 4
lea eax, [ebp + 0x10]
push eax
push 6
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.WININET.dll_InternetSetOptionW]
push 0
push 0x80080000
push 0
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 4]
xor eax, eax
cmp dword [edx + 4], 0
setne al
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4367f0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x44f1a4]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x4368bb
mov dword [ebp - 0x240], 0x22c
cmp dword [ebp + 8], 0
jne 0x436839
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp + 8], eax
lea eax, [ebp - 0x240]
push eax
mov ecx, dword [ebp - 8]
push ecx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
setne dl
mov byte [ebp - 0x241], dl
movzx eax, byte [ebp - 0x241]
test eax, eax
je 0x4368b1
mov ecx, dword [ebp - 0x238]
cmp ecx, dword [ebp + 8]
jne 0x436873
mov edx, dword [ebp - 0x228]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
jne 0x436899
lea eax, [ebp - 0x240]
push eax
mov ecx, dword [ebp - 8]
push ecx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x436899
mov dword [ebp - 0x248], 1
jmp 0x4368a3
mov dword [ebp - 0x248], 0
mov dl, byte [ebp - 0x248]
mov byte [ebp - 0x241], dl
jmp 0x436854
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0041bbb4
mov esp, ebp
pop ebp
ret
Function at 0x436b40
Capabilities:
Check if file exists
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x436b63
push 0x80
mov ecx, dword [ebp + 8]
add ecx, 4
call fcn.00403120
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, dword [ebp + 8]
add ecx, 4
call fcn.00403120
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x436b96
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
je 0x436b8e
cmp dword [ebp - 4], 3
jne 0x436b92
mov al, 1
jmp 0x436b98
xor al, al
jmp 0x436b98
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x436ba0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
mov ecx, dword [ebp + 8]
add ecx, 4
call fcn.00403120
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x436bd2
cmp dword [ebp + 0xc], 0
je 0x436bd2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
xor eax, eax
cmp dword [ebp - 4], 0
setne al
mov esp, ebp
pop ebp
ret

Function at 0x4372e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0
jne 0x4372f6
xor eax, eax
jmp 0x437317
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0041d0a8
add esp, 0x10
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4383e0
Capabilities:
Copy file
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x44f1a4]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x418], ax
push 0x206
push 0
lea ecx, [ebp - 0x416]
push ecx
call fcn.0041c5e0
add esp, 0xc
xor edx, edx
mov word [ebp - 0x210], dx
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.0041c5e0
add esp, 0xc
lea ecx, [ebp - 0x418]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea edx, [ebp - 0x418]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push str.uninst1.exe
lea eax, [ebp - 0x418]
push eax
call fcn.0041d793
add esp, 8
push 0x104
lea ecx, [ebp - 0x210]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x4384ea
push 0
lea edx, [ebp - 0x418]
push edx
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x4384ea
movzx ecx, byte [ebp + 0xc]
test ecx, ecx
je 0x4384b6
call fcn.00435170
movzx edx, al
test edx, edx
jne 0x4384b6
mov dword [ebp - 0x420], str.runas
jmp 0x4384c0
mov dword [ebp - 0x420], 0x4447fc
mov eax, dword [ebp - 0x420]
mov dword [ebp - 0x41c], eax
push 5
push 0
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x418]
push edx
mov eax, dword [ebp - 0x41c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041bbb4
mov esp, ebp
pop ebp
ret
Function at 0x43a840
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 0x54]
test ecx, ecx
jne 0x43a867
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp + 8]
add ecx, 0x50
call fcn.00406d80
movzx eax, al
test eax, eax
jne 0x43a875
mov ecx, dword [ebp + 8]
mov byte [ecx + 0x54], 0
xor eax, eax
jmp 0x43a94e
cmp dword [ebp + 0x24], 0
je 0x43a884
or edx, 0xffffffff
mov eax, dword [ebp + 0x24]
mov word [eax], dx
mov dword [ebp - 8], str.uninst:__btn
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 0x10]
mov eax, dword [edx + 8]
push eax
call fcn.00413420
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x43a900
mov dword [ebp - 8], str.close_me
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 0x10]
mov eax, dword [edx + 8]
push eax
call fcn.00413420
add esp, 8
mov dword [ebp - 4], eax
push 0
push 0x10000
push 0x402
lea ecx, [ebp - 0x10]
push ecx
mov ecx, dword [ebp + 8]
add ecx, 4
call fcn.00413790
mov ecx, eax
call fcn.004066d0
push 3
push 0
push 0
mov edx, dword [ebp + 0x10]
mov eax, dword [edx + 8]
push eax
push 0x4452ec
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp dword [ebp - 4], 0
je 0x43a94c
mov ecx, dword [ebp - 8]
push ecx
call fcn.0041bf1b
add esp, 4
mov edx, dword [ebp - 4]
lea eax, [edx + eax*2]
mov dword [ebp - 4], eax
push 0xa
push 0
mov ecx, dword [ebp - 4]
push ecx
call fcn.0041fd61
add esp, 0xc
mov dword [ebp - 0xc], eax
push 0
mov edx, dword [ebp - 0xc]
push edx
push 0x10
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
add ecx, 4
call fcn.00413790
mov ecx, eax
call fcn.004137c0
xor eax, eax
mov esp, ebp
pop ebp
ret 0x20

Function at 0x43c040
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0xc]
add ecx, 4
call fcn.00413d60
mov ecx, 0x452400
call fcn.00406700
mov dword [ebp - 8], eax
push 0x17
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x43c0d5
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x43c0d5
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x43c0d5
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x43c0cb
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.00403440
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov ecx, dword [ebp + 0xc]
add ecx, 4
call fcn.00401e80
movzx eax, al
neg eax
sbb eax, eax
add eax, 1
mov esp, ebp
pop ebp
ret 8