joyce8/EMBER2024-capa huggingface dataset:
Function at 0x451ed0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x48260f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push 0x4a3634
lea ecx, [esp + 4]
mov dword [esp + 0x10], 0
call fcn.00471554
mov dword [esp + 0x18], 1
call fcn.00470aef
test eax, eax
je 0x451f1a
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
test eax, eax
jne 0x451f1e
xor eax, eax
jmp 0x451f21
mov eax, dword [eax + 0x1c]
mov edx, dword [esp + 0x24]
lea ecx, [esp + 4]
push ecx
push edx
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x451f79
push 0x208
lea ecx, [esp + 4]
call fcn.00471916
push eax
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
push 0xffffffffffffffff
lea ecx, [esp + 4]
call fcn.00471965
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jl 0x451f79
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push ecx
push eax
mov edx, dword [eax]
call dword [edx + 0x14]
push esi
mov esi, dword [esp + 0x24]
lea edx, [esp + 4]
mov ecx, esi
push edx
call fcn.0047125b
mov dword [esp + 0x10], 1
lea ecx, [esp + 4]
mov byte [esp + 0x1c], 0
call fcn.004714e6
mov ecx, dword [esp + 0x14]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret

Function at 0x4521e0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x48267f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x49f598]
push esi
mov dword [esp + 8], 0
mov dword [esp + 4], eax
push 0x32
lea ecx, [esp + 8]
mov dword [esp + 0x18], 1
call fcn.00471916
push eax
push 0x32
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0xffffffffffffffff
lea ecx, [esp + 8]
mov esi, eax
call fcn.00471965
test esi, esi
jne 0x452251
mov esi, dword [esp + 0x1c]
push 0x4a3634
mov ecx, esi
call fcn.00471554
mov dword [esp + 8], 1
jmp 0x452270
mov ecx, dword [esp + 4]
mov esi, dword [esp + 0x1c]
mov eax, dword [ecx - 8]
lea ecx, [esp + 4]
dec eax
push eax
push esi
call fcn.0046ef50
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x14], 0
call fcn.004714e6
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x452290
Capabilities:
Delete directory
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x4826b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x18]
call fcn.0045534f
mov edi, dword [esp + 0x44]
lea ecx, [esp + 0x14]
push edi
mov dword [esp + 0x40], 0
call fcn.00471554
mov eax, dword [0x49f598]
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x14]
push str..
lea edx, [esp + 0x48]
push ecx
push edx
mov byte [esp + 0x48], 2
call fcn.0047177b
mov eax, dword [eax]
push 0
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x44], 3
call fcn.00455412
test eax, eax
lea ecx, [esp + 0x44]
mov byte [esp + 0x3c], 2
setne bl
call fcn.004714e6
test bl, bl
je 0x452414
mov ebp, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov bl, 4
lea ecx, [esp + 0x18]
call fcn.00455632
mov esi, eax
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x1c]
call fcn.0045582a
mov ecx, dword [esp + 0x44]
lea edx, [esp + 0x10]
push ecx
push edi
push 0x499e0c
push edx
mov byte [esp + 0x4c], bl
call fcn.0046f370
add esp, 0x10
lea ecx, [esp + 0x18]
call fcn.004555f9
test eax, eax
jne 0x45239f
mov eax, dword [esp + 0x18]
push 0x10
lea ecx, [esp + 0x1c]
call dword [eax + 0x38]
test eax, eax
je 0x452390
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00452290
mov edx, dword [esp + 0x14]
add esp, 4
push edx
call ebp
test eax, eax
je 0x4523bf
jmp 0x45239f
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x4523b6
test esi, esi
mov byte [esp + 0x3c], 2
lea ecx, [esp + 0x44]
je 0x45240f
call fcn.004714e6
jmp 0x452323
lea ecx, [esp + 0x18]
call fcn.004553c8
lea ecx, [esp + 0x44]
mov byte [esp + 0x3c], 2
call fcn.004714e6
lea ecx, [esp + 0x10]
mov byte [esp + 0x3c], 1
call fcn.004714e6
lea ecx, [esp + 0x14]
mov byte [esp + 0x3c], 0
call fcn.004714e6
lea ecx, [esp + 0x18]
mov dword [esp + 0x3c], 0xffffffff
call fcn.0045538c
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret
call fcn.004714e6
lea ecx, [esp + 0x10]
mov byte [esp + 0x3c], 1
call fcn.004714e6
lea ecx, [esp + 0x14]
mov byte [esp + 0x3c], 0
call fcn.004714e6
lea ecx, [esp + 0x18]
mov dword [esp + 0x3c], 0xffffffff
call fcn.0045538c
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x30
ret

Function at 0x452720
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
push esi
push 0
push 0
push 3
push 0
push 0
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x45274c
xor eax, eax
pop esi
add esp, 8
ret
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0x14]
lea edx, [esp + 4]
push edx
push 0
push 0
push esi
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_GetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x18]
lea ecx, [esp + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov eax, 1
pop esi
add esp, 8
ret
Function at 0x452790
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4827af
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x49f598]
push esi
mov dword [esp + 8], 0
mov dword [esp + 4], eax
push 0x104
lea ecx, [esp + 8]
mov dword [esp + 0x18], 1
call fcn.00471916
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0xffffffffffffffff
lea ecx, [esp + 8]
call fcn.00471965
mov ecx, dword [esp + 0x20]
mov esi, dword [esp + 0x1c]
lea edx, [esp + 4]
push ecx
push edx
push esi
call fcn.0047177b
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x14], 0
call fcn.004714e6
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x452ae0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4828b1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x120
push ebp
push esi
push edi
push 0x4a3634
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0
call fcn.00471554
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x28]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x134], 1
push eax
push 1
push 0
push str.HTTP_shell
push SysReAllocStringLen
call esi
test eax, eax
jne 0x452b53
mov dword [esp + 0x18], 0x104
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x18]
lea edx, [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x24]
push edx
push eax
push 0
push 0x4a3634
push ecx
call ebp
push str.HTTP_shell_
lea ecx, [esp + 0x18]
mov edi, eax
call fcn.00471554
mov edx, dword [0x49f598]
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x138], 2
mov dword [esp + 0x14], edx
call fcn.0047166f
lea ecx, [esp + 0x10]
mov byte [esp + 0x134], 3
push ecx
lea ecx, [esp + 0x18]
call fcn.004718fe
lea ecx, [esp + 0x10]
mov byte [esp + 0x134], 2
call fcn.004714e6
push str.command
lea ecx, [esp + 0x18]
call fcn.004718c2
test edi, edi
jne 0x452d07
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push edx
push 1
push edi
push eax
push SysReAllocStringLen
call esi
mov edx, eax
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x28]
test edx, edx
rep stosd dword es:[edi], eax
mov dword [esp + 0x18], 0x104
jne 0x452d07
lea ecx, [esp + 0x18]
lea edx, [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x24]
push edx
push eax
push 0
push 0x4a3634
push ecx
call ebp
test eax, eax
jne 0x452d07
lea edx, [esp + 0x28]
lea ecx, [esp + 0xc]
push edx
call fcn.0047166f
lea ecx, [esp + 0xc]
call fcn.0046f3eb
push 0x22
lea ecx, [esp + 0x10]
call fcn.004719ad
push 0x49f2a0
lea ecx, [esp + 0x10]
call fcn.0046f383
push 0x22
lea ecx, [esp + 0x10]
call fcn.004719ad
cmp eax, 0xffffffff
je 0x452cad
push eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
call fcn.0046ef50
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x138], 4
call fcn.0047161f
lea ecx, [esp + 0x10]
mov byte [esp + 0x134], 2
call fcn.004714e6
lea ecx, [esp + 0xc]
call fcn.0046f3eb
lea ecx, [esp + 0xc]
call fcn.004719fa
push str..exe
lea ecx, [esp + 0x10]
call fcn.0046efea
cmp eax, 0xffffffff
je 0x452d07
add eax, 4
lea ecx, [esp + 0x10]
push eax
push ecx
lea ecx, [esp + 0x14]
call fcn.0046ef50
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x138], 5
call fcn.0047161f
lea ecx, [esp + 0x10]
mov byte [esp + 0x134], 2
call fcn.004714e6
mov esi, dword [esp + 0x13c]
lea edx, [esp + 0xc]
push edx
mov ecx, esi
call fcn.0047125b
mov dword [esp + 0x24], 1
lea ecx, [esp + 0x14]
mov byte [esp + 0x134], 1
call fcn.004714e6
lea ecx, [esp + 0xc]
mov byte [esp + 0x134], 0
call fcn.004714e6
mov ecx, dword [esp + 0x12c]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x12c
ret
Function at 0x452d60
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4828fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x11c
push ebx
push esi
push edi
push 0x4a3634
lea ecx, [esp + 0x10]
mov dword [esp + 0x18], 0
call fcn.00471554
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x24]
mov ebx, 1
rep stosd dword es:[edi], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x130], ebx
push eax
push ebx
push 0
push str.HTTP_shellopencommand
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x452de5
mov esi, dword [esp + 0x138]
push 0x4a3634
mov ecx, esi
call fcn.00471554
mov dword [esp + 0x14], ebx
jmp 0x452f14
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x24]
lea edx, [esp + 0x24]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x1c]
lea eax, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x1c]
push edx
push eax
push 0
push 0x4a3634
push ecx
mov dword [esp + 0x34], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0x24]
lea ecx, [esp + 0xc]
push edx
mov esi, eax
call fcn.0047166f
test esi, esi
jne 0x452efd
lea eax, [esp + 0x24]
lea ecx, [esp + 0xc]
push eax
call fcn.0047166f
lea ecx, [esp + 0xc]
call fcn.0046f3eb
push 0x22
lea ecx, [esp + 0x10]
call fcn.004719ad
push 0x49f2a0
lea ecx, [esp + 0x10]
call fcn.0046f383
push 0x22
lea ecx, [esp + 0x10]
call fcn.004719ad
cmp eax, 0xffffffff
je 0x452ea4
lea ecx, [esp + 0x10]
push eax
push ecx
lea ecx, [esp + 0x14]
call fcn.0046ef50
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x134], 2
call fcn.0047161f
lea ecx, [esp + 0x10]
mov byte [esp + 0x130], bl
call fcn.004714e6
lea ecx, [esp + 0xc]
call fcn.0046f3eb
lea ecx, [esp + 0xc]
call fcn.004719fa
push str..exe
lea ecx, [esp + 0x10]
call fcn.0046efea
cmp eax, 0xffffffff
je 0x452efd
add eax, 4
lea edx, [esp + 0x10]
push eax
push edx
lea ecx, [esp + 0x14]
call fcn.0046ef50
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x134], 3
call fcn.0047161f
lea ecx, [esp + 0x10]
mov byte [esp + 0x130], bl
call fcn.004714e6
mov esi, dword [esp + 0x138]
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.0047125b
mov dword [esp + 0x14], ebx
lea ecx, [esp + 0xc]
mov byte [esp + 0x130], 0
call fcn.004714e6
mov ecx, dword [esp + 0x128]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x128
ret

Function at 0x452f40
Capabilities:
Check os version

Disassembly:
sub esp, 0x9c
push esi
push edi
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 8]
xor esi, esi
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
mov dword [esp + 8], 0x9c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x452fd5
mov eax, dword [esp + 0x18]
cmp eax, 2
jne 0x452fa1
mov eax, dword [esp + 0xc]
cmp eax, 4
ja 0x452f85
mov esi, 3
cmp eax, 5
jne 0x452fd5
mov edx, dword [esp + 0x10]
xor eax, eax
test edx, edx
setne al
pop edi
add eax, 4
pop esi
add esp, 0x9c
ret
cmp eax, 1
jne 0x452fd5
mov eax, dword [esp + 0xc]
cmp eax, 4
ja 0x452fc7
jne 0x452fb9
mov eax, dword [esp + 0x10]
test eax, eax
ja 0x452fc7
pop edi
mov eax, 1
pop esi
add esp, 0x9c
ret
pop edi
mov eax, 2
pop esi
add esp, 0x9c
ret
mov eax, esi
pop edi
pop esi
add esp, 0x9c
ret
Function at 0x452fe0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x482930
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
push edi
push 0x4a3634
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0
call fcn.00471554
lea eax, [esp + 0xc]
mov byte [esp + 0x18], 1
push eax
call fcn.00452ae0
add esp, 4
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 2
call fcn.0047161f
lea ecx, [esp + 0xc]
mov byte [esp + 0x18], 1
call fcn.004714e6
mov ecx, dword [esp + 8]
push 0x4a3634
push ecx
call fcn.0045e665
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteA]
add esp, 8
test eax, eax
je 0x453079
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 8]
push 5
push 0
push edx
push eax
push str.open
push 0
call edi
mov esi, eax
cmp esi, 0x20
jge 0x4530d5
lea ecx, [esp + 0xc]
push ecx
call fcn.00452d60
add esp, 4
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 3
call fcn.0047161f
lea ecx, [esp + 0xc]
mov byte [esp + 0x18], 1
call fcn.004714e6
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 8]
push 5
push 0
push edx
push eax
push str.open
push 0
call edi
mov esi, eax
cmp esi, 0x20
jge 0x4530d5
mov ecx, dword [esp + 0x20]
push 5
push 0
push 0
push ecx
push str.open
push 0
call edi
xor edx, edx
cmp esi, 0x20
setl dl
lea ecx, [esp + 8]
mov esi, edx
mov byte [esp + 0x18], 0
call fcn.004714e6
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0xffffffff
call fcn.004714e6
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x46e730
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.0045c650
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x46e7fb
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x46e7fb
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x46e7ae
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x46e7b9
or bh, 8
and edi, 0x8000000
je 0x46e7d4
mov eax, dword [0x4a71bc]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x46e7fb
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46ebd0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x46ebfb
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x46ec1f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x46ec3a
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
Function at 0x471eec
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x482c74
call fcn.0045d0f8
sub esp, 0x18
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
mov eax, dword [esi + 0x48]
mov edi, dword [esi + 0x44]
mov dword [ebp - 0x18], eax
call fcn.0047af87
cmp dword [esi + 0x40], 0
mov ebx, dword [eax + 0xc]
je 0x471f2b
call fcn.0047af87
mov ebx, dword [eax + 0xc]
push 5
push dword [esi + 0x40]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x471f39
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x471f47
or eax, 0xffffffff
jmp 0x47202f
mov ecx, esi
call fcn.00471e62
mov dword [ebp - 0x14], eax
call fcn.00472d1d
xor edi, edi
cmp dword [ebp - 0x14], edi
mov dword [ebp - 0x20], edi
je 0x471f7e
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x471f7e
push edi
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x20], 1
push esi
mov dword [ebp - 4], edi
call fcn.00472cd1
push dword [ebp - 0x14]
call fcn.00472803
push ebx
push eax
push dword [ebp - 0x18]
mov ecx, esi
call fcn.00471bfa
cmp eax, edi
je 0x471ff1
test byte [esi + 0x24], 0x10
je 0x471fbf
push 4
mov ecx, esi
pop ebx
call fcn.00474ebb
test ah, 1
je 0x471fb7
push 5
pop ebx
push ebx
mov ecx, esi
call fcn.0047486c
cmp dword [esi + 0x1c], edi
je 0x471ff1
push 0x97
push edi
push edi
push edi
push edi
push edi
mov ecx, esi
call fcn.00474fa1
jmp 0x471ff1
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x20], edi
je 0x472005
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], edi
je 0x47201e
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x1c]
jne 0x47201e
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x58]
mov ecx, esi
call fcn.00471e9c
mov eax, dword [esi + 0x2c]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x47471a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x47475c
call fcn.0047af87
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x47475c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x474753
xor eax, eax
jmp 0x474764
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0047476a
pop edi
pop esi
pop ebx
ret 4
Function at 0x47983a
Capabilities:
Create http request

Disassembly:
mov eax, 0x482f68
call fcn.0045d0f8
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 0xc]
and dword [ebp - 4], 0
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
test eax, eax
mov dword [esi], vtable.CInternetSession.0
jne 0x479872
call fcn.0047af87
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
test eax, eax
mov dword [esi + 8], eax
jne 0x479897
push eax
push dword [esi + 4]
call fcn.0047a619
jmp 0x4798a3
push esi
push eax
mov ecx, 0x4a5638
call fcn.004798b4
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 0x18

Function at 0x479a14
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x482fa3
call fcn.0045d0f8
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.0047691c
mov eax, dword [0x49f598]
lea ebx, [esi + 0x24]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebx], eax
mov eax, dword [ebp + 0x10]
mov dword [esi], vtable.CInternetFile.0
mov ecx, 0x4a5638
mov byte [ebp - 4], 1
push dword [eax + 0xc]
push dword [ebp + 8]
call fcn.004798b4
push dword [ebp + 0xc]
lea ecx, [esi + 0xc]
call fcn.0047166f
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx + 8]
mov dword [esi + 0x1c], eax
lea eax, [ebp + 0x10]
push eax
call fcn.004542d7
push eax
mov ecx, ebx
mov byte [ebp - 4], 2
call fcn.0047161f
lea ecx, [ebp + 0x10]
mov byte [ebp - 4], 1
call fcn.004714e6
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x18], eax
mov dword [esi + 0x3c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x40], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10

Function at 0x431001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x431072
nop
nop
nop
mov ebx, 0x40915c
nop
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x25255113
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x431060
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
je 0x4310d2
nop
nop
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x774c0d3a
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4310c0
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219