joyce8/EMBER2024-capa huggingface dataset:
Function at 0x446608
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
test dl, dl
je 0x44661c
add esp, 0xfffffff0
call fcn.00406710
mov ebx, edx
mov esi, eax
mov dl, 1
mov eax, dword [0x44058c]
call fcn.00462634
mov dword [esi + 4], eax
mov dl, 1
mov eax, dword [0x4455d8]
call fcn.00463d50
mov dword [esi + 8], eax
mov dl, 1
mov eax, dword [0x4455d8]
call fcn.00463d50
mov dword [esi + 0xc], eax
lea eax, [ebp - 0x24]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 0x20]
mov dword [esi + 0x10], eax
mov eax, esi
test bl, bl
je 0x446671
call fcn.00406768
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x495f70
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
or dl, byte [ebx + 0xd]
je 0x495fb3
cmp byte [ebx + 0x11], 0
jne 0x495fb3
cmp byte [ebx + 0x24], 0
jne 0x495fb3
mov byte [ebx + 0xf], 0
mov byte [ebx + 0xd], 0
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
je 0x495fca
mov ecx, dword [0x4b1ab8]
mov dl, 1
mov eax, dword [0x4708a8]
call fcn.004222c4
call fcn.004075bc
pop ebx
ret
mov ecx, dword [0x4b1ab8]
mov dl, 1
mov eax, dword [0x4708a8]
call fcn.004222c4
call fcn.004075bc
pop ebx
ret

Function at 0x496504
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xf]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x496552
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xf], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.00495ee8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49656b
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x496574
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.00495ee8
dec esi
jne 0x496596
mov byte [ebx + 0xf], 0
pop esi
pop ebx
ret

Function at 0x4a0a9c
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a0ae4
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.004a0a34
mov eax, dword [ebp - 4]
call fcn.00408984
push eax
call sub.kernel32.dll_GetFileAttributesW
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a0aeb
lea eax, [ebp - 4]
call fcn.00407ed4
pop eax
jmp eax
Function at 0x4a0d04
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4a0d9b
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x4a0d4f
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
lea edx, [ebp - 0x20c]
mov eax, edi
call fcn.0040806c
jmp 0x4a0d83
call sub.kernel32.dll_GetCommandLineW
mov ebx, eax
cmp word [ebx], 0
jne 0x4a0d66
lea eax, [ebp - 4]
call fcn.00407ed4
jmp 0x4a0d79
lea edx, [ebp - 4]
mov eax, ebx
call fcn.004a0bbc
mov ebx, eax
test esi, esi
je 0x4a0d79
dec esi
jmp 0x4a0d56
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.004082c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a0da2
lea eax, [ebp - 4]
call fcn.00407ed4
pop eax
jmp eax

Function at 0x4a0dac
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
mov edx, ebx
mov eax, esp
call fcn.0041c31c
add esp, 0x208
pop ebx
ret

Function at 0x4a0e0c
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov edx, ebx
mov eax, esp
call fcn.0041c31c
add esp, 0x208
pop ebx
ret
Function at 0x4a0f5c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4a1094
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x4a107c
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
je 0x4a0fb9
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jne 0x4a107c
cmp dword [ebp - 0x14], 0
jne 0x4a0fce
mov eax, dword [ebp - 0xc]
call fcn.00407ed4
mov bl, 1
jmp 0x4a107c
cmp dword [ebp - 0x14], 0x70000000
jb 0x4a0fdc
call fcn.004221f8
mov esi, dword [ebp - 0x14]
inc esi
shr esi, 1
lea eax, [ebp - 4]
mov ecx, esi
xor edx, edx
call fcn.0040806c
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
call fcn.00408464
push eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExW
cmp eax, 0xea
je 0x4a0f82
test eax, eax
jne 0x4a107c
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
je 0x4a102a
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jne 0x4a107c
mov esi, dword [ebp - 0x14]
shr esi, 1
jmp 0x4a1032
dec esi
test esi, esi
je 0x4a1041
mov eax, dword [ebp - 4]
cmp word [eax + esi*2 - 2], 0
je 0x4a1031
cmp dword [ebp - 0x10], 7
jne 0x4a104c
test esi, esi
je 0x4a104c
inc esi
lea eax, [ebp - 4]
mov edx, esi
call fcn.00408af8
cmp dword [ebp - 0x10], 7
jne 0x4a106f
test esi, esi
je 0x4a106f
lea eax, [ebp - 4]
call fcn.00408464
mov word [eax + esi*2 - 2], 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.004082c4
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a109b
lea eax, [ebp - 4]
call fcn.00407ed4
pop eax
jmp eax
Function at 0x4a11c8
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
mov byte [ebp - 1], 0
mov edx, 0x4b175c
mov dword [ebp - 0x1c], edx
lea edx, [ebp - 8]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0x20
push 2
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_AllocateAndInitializeSid
test eax, eax
je 0x4a139a
xor eax, eax
push ebp
push 0x4a1393
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4a13a4
push 0x4a13d0
call sub.kernel32.dll_GetModuleHandleW
push eax
call fcn.0040f85c
mov ebx, eax
test ebx, ebx
je 0x4a124e
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
call ebx
test eax, eax
je 0x4a137a
cmp dword [ebp - 0xc], 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
jmp 0x4a137a
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
test eax, eax
jne 0x4a129f
call sub.kernel32.dll_GetLastError
cmp eax, 0x3f0
je 0x4a1280
call fcn.004076b0
jmp 0x4a139a
lea eax, [ebp - 0x10]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x4a129f
call fcn.004076b0
jmp 0x4a139a
xor eax, eax
push ebp
push 0x4a1373
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x4a12e2
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
je 0x4a12e2
call fcn.004076b0
call fcn.004076b0
jmp 0x4a139a
mov eax, dword [ebp - 0x14]
call fcn.004053c0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x4a1317
call fcn.004076b0
call fcn.004076b0
jmp 0x4a139a
mov eax, dword [ebp - 0x18]
mov esi, dword [eax]
dec esi
test esi, esi
jl 0x4a1352
inc esi
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x4a134e
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 8]
and eax, 0x14
cmp eax, 4
jne 0x4a134e
mov byte [ebp - 1], 1
jmp 0x4a1352
inc ebx
dec esi
jne 0x4a1324
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a137a
mov eax, dword [ebp - 0x18]
call fcn.004053dc
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a139a
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_FreeSid
pop eax
jmp eax
movzx eax, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a2938
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x4b88ac
mov eax, esi
mov edx, 8
test al, 1
je 0x4a2954
shr eax, 1
xor eax, 0xedb88320
jmp 0x4a2956
shr eax, 1
dec edx
jne 0x4a2947
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4a2940
pop esi
ret

Function at 0x4a296c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ecx
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x4b88a8], 0
jne 0x4a2996
call fcn.004a2938
mov dword [esp], 0x4b88a8
mov edx, dword [esp]
mov eax, 1
lock xchg dword [edx], eax
mov eax, edi
test esi, esi
je 0x4a29c0
mov edx, 0xff
and edx, ebx
movzx ecx, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x4b88ac]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x4a299c
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4a58a8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004a585c
test al, al
jne 0x4a58c9
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4a5917
xor eax, eax
push ebp
push 0x4a5907
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00408984
push eax
call sub.kernel32.dll_DeleteFileW
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a590e
lea eax, [ebp - 0xc]
call fcn.004a5898
pop eax
jmp eax
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a6138
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffffec
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x4a6151
xor eax, eax
jmp 0x4a61a5
lea eax, [esp + 8]
push eax
push 0x4a61ac
push 0
call sub.advapi32.dll_LookupPrivilegeValueW
mov dword [esp + 4], 1
mov dword [esp + 0x10], 2
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError
test eax, eax
je 0x4a6196
xor eax, eax
jmp 0x4a61a5
push 0
push 2
call sub.user32.dll_ExitWindowsEx
cmp eax, 1
sbb eax, eax
inc eax
add esp, 0x14
ret

Function at 0x4a61d4
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x4a622e
inc esi
xor edi, edi
cmp edi, 1
jne 0x4a61fa
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_Sleep
jmp 0x4a6208
cmp edi, 1
jle 0x4a6208
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004a58a8
test eax, eax
jne 0x4a622e
call sub.kernel32.dll_GetLastError
cmp eax, 2
je 0x4a622e
call sub.kernel32.dll_GetLastError
cmp eax, 3
je 0x4a622e
inc edi
dec esi
jne 0x4a61ea
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x4a6238
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, eax
push 2
lea eax, [ebp - 4]
push eax
push 0x20001004
movzx eax, bx
push eax
call sub.kernel32.dll_GetLocaleInfoW
test eax, eax
jle 0x4a625c
mov eax, dword [ebp - 4]
jmp 0x4a625f
or eax, 0xffffffff
pop ebx
pop ecx
pop ebp
ret
Function at 0x4a6264
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov byte [ebp - 1], dl
mov edi, eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov byte [ebp - 2], 0
test esi, esi
je 0x4a62b1
xor ebx, ebx
jmp 0x4a62a6
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov eax, esi
call fcn.0041b564
test eax, eax
jne 0x4a62a5
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 2
jmp 0x4a635c
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x4a6287
movzx eax, byte [ebp - 1]
sub al, 1
jb 0x4a62bd
je 0x4a62c6
jmp 0x4a62cf
call fcn.004a13f8
mov esi, eax
jmp 0x4a62d1
call sub.kernel32.dll_GetUserDefaultLangID
mov esi, eax
jmp 0x4a62d1
xor esi, esi
test si, si
je 0x4a635c
xor ebx, ebx
jmp 0x4a62f7
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
movzx edx, si
cmp eax, edx
jne 0x4a62f6
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x4a635c
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x4a62de
xor ebx, ebx
jmp 0x4a6351
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
and eax, 0x3ff
mov dx, 0x3ff
and dx, si
movzx edx, dx
cmp eax, edx
jne 0x4a6350
mov ax, 0x3ff
and ax, si
cmp ax, 4
jne 0x4a6345
mov eax, dword [ebp - 8]
movzx eax, word [eax + 0x28]
call fcn.004a6238
push eax
mov eax, esi
call fcn.004a6238
pop edx
cmp edx, eax
jne 0x4a6350
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x4a635c
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x4a6306
movzx eax, byte [ebp - 2]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x4a6748
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a6821
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4a683c
push ebx
push 0x4a684c
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.00408c5c
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00405c10
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00408984
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x4a67ca
mov ax, 0x83
call fcn.004a636c
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle
call fcn.004a671c
push 0x1cff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x4a67d3
call fcn.004a671c
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a6828
lea eax, [ebp - 4]
call fcn.00407ed4
pop eax
jmp eax
Function at 0x4a693c
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4a6a05
jmp 0x4a69f9
cmp dword [esi + 0x10], 0x1000
jne 0x4a69e7
test byte [esi + 0x15], 1
jne 0x4a69e7
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4a6998
cmp ebp, 2
je 0x4a6998
cmp ebp, 0x10
je 0x4a6998
cmp ebp, 0x20
jne 0x4a69b4
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4a69b4
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4a69c5
mov eax, dword [esi]
add eax, ebx
call fcn.004a6934
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4a69b8
cmp byte [esp + 4], 0
je 0x4a69e7
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov edi, dword [esi]
add edi, dword [esi + 0xc]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4a6a05
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4a696d
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x401090
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, ecx
xor esi, esi
push edi
call fcn.0042a2e0
pop ecx
test eax, eax
je 0x4010b7
mov al, byte [esi + edi]
sub al, 3
xor al, 0x55
mov byte [esi + edi], al
inc esi
push edi
call fcn.0042a2e0
pop ecx
cmp esi, eax
jb 0x4010a1
pop edi
pop esi
ret

Function at 0x4010ba
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, ecx
xor esi, esi
push edi
call fcn.0042a36b
pop ecx
test eax, eax
je 0x4010e7
mov ax, word [edi + esi*2]
sub ax, 3
xor ax, 0x55
mov word [edi + esi*2], ax
inc esi
push edi
call fcn.0042a36b
pop ecx
cmp esi, eax
jb 0x4010cb
pop edi
pop esi
ret
Function at 0x401dc0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
mov ebx, dword [sym.imp.USER32.dll_LoadIconW]
push esi
push edi
xor edi, edi
mov dword [ebp - 0x2c], 0x402591
push 0x84
push edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], edi
call ebx
mov esi, dword [sym.imp.USER32.dll_LoadCursorW]
push 0x7f03
push edi
mov dword [ebp - 0x1c], eax
call esi
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
mov edi, dword [sym.imp.USER32.dll_RegisterClassW]
push eax
mov dword [ebp - 0xc], str.SHARESCREEN
call edi
xor eax, eax
mov dword [ebp - 0x30], 3
push 0x84
push eax
mov dword [ebp - 0x2c], 0x402116
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
call ebx
push 0x7f03
xor ebx, ebx
mov dword [ebp - 0x1c], eax
push ebx
call esi
push ebx
mov dword [ebp - 0x18], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], str.SHARESCREENL
call edi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x4c
call esi
push 0x4d
mov edi, eax
call esi
push 0x4e
mov ebx, eax
call esi
push 0x4f
mov dword [ebp - 8], eax
call esi
mov dword [ebp - 4], eax
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push 0x80000000
push eax
push str.SHARESCREEN
push 0x80000a8
mov dword [0x45d610], edi
mov dword [0x45d60c], ebx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, eax
test esi, esi
je 0x401f21
push 0
push dword [ebp - 4]
push dword [ebp - 8]
push ebx
push edi
push esi
call dword [sym.imp.USER32.dll_MoveWindow]
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
xor ebx, ebx
push ebx
push 0x64
pop edi
push edi
push 1
push esi
call dword [sym.imp.USER32.dll_SetTimer]
push ebx
push ebx
push ebx
push esi
mov eax, 0x12c
push eax
push eax
push edi
push edi
push 0x80000000
push ebx
push str.SHARESCREENL
push 0x8080080
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 3
push edi
push 0xff
push eax
mov dword [0x45d614], eax
call dword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401fb6
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push edi
push 5
push dword [0x45d614]
mov edi, edx
call esi
push dword [0x45d614]
call dword [sym.imp.USER32.dll_UpdateWindow]
cmp dword [ebp + 8], 0
je 0x401fe9
push 0
push dword [0x45d614]
call esi
mov esi, edi
mov edi, 0x45d5fc
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edx, dword [0x45d604]
mov edi, dword [0x45d5fc]
cmp edx, edi
jge 0x402016
mov eax, edi
mov edi, edx
mov edx, eax
mov dword [0x45d5fc], edi
mov dword [0x45d604], edx
mov ecx, dword [0x45d608]
mov esi, dword [0x45d600]
cmp ecx, esi
jge 0x402038
mov eax, esi
mov esi, ecx
mov ecx, eax
mov dword [0x45d600], esi
mov dword [0x45d608], ecx
push 1
sub ecx, esi
sub edx, edi
inc ecx
inc edx
push ecx
push edx
push esi
push edi
push dword [0x45d614]
call dword [sym.imp.USER32.dll_MoveWindow]
pop edi
pop esi
pop ebp
ret
Function at 0x402a14
Capabilities:
Create http request
Create process on windows
Download and write a file
Get common file path
Read data from internet
Receive and write data from server to client
Receive data
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x85c
mov eax, dword [0x45a064]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
mov esi, edx
push ebx
push ebx
push ebx
push ebx
push 0x451e78
call dword [sym.imp.WININET.dll_InternetOpenW]
mov edi, eax
test edi, edi
je 0x402bbc
push ebx
push ebx
push ebx
push ebx
push esi
push edi
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov esi, eax
test esi, esi
je 0x402bbc
lea eax, [ebp - 0x418]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x210]
push eax
push ebx
push ebx
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea eax, [ebp - 0x210]
push str..exe
push eax
call fcn.0042a8ae
pop ecx
pop ecx
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
lea eax, [ebp - 0x210]
mov dword [ebp - 0x81c], 1
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
test ebx, ebx
je 0x402bab
push 0x400
lea eax, [ebp - 0x818]
push 0
push eax
call fcn.00426850
add esp, 0xc
jmp 0x402b17
lea eax, [ebp - 0x81c]
push eax
push 0x400
lea eax, [ebp - 0x818]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
push 0
lea eax, [ebp - 0x820]
push eax
push dword [ebp - 0x81c]
lea eax, [ebp - 0x818]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 0x81c], 0
ja 0x402ae0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
lea ecx, [ebp - 0x210]
call fcn.00402980
test eax, eax
je 0x402bab
push 0x3c
pop ecx
lea eax, [ebp - 0x85c]
xor edx, edx
mov byte [eax], dl
inc eax
sub ecx, 1
jne 0x402b43
movaps xmm0, xmmword [0x4524d0]
lea eax, [ebp - 0x210]
mov dword [ebp - 0x84c], eax
lea eax, [ebp - 0x85c]
push eax
mov dword [ebp - 0x85c], 0x3c
mov dword [ebp - 0x858], edx
mov dword [ebp - 0x854], edx
mov dword [ebp - 0x850], edx
movups xmmword [ebp - 0x848], xmm0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x402bab
push 0x8000
push dword [ebp - 0x824]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x824]
call ebx
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push edi
call esi
xor eax, eax
inc eax
jmp 0x402bbe
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040f8f4
leave
ret
Function at 0x402bcd
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
lea eax, [ebp - 4]
push ebx
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push ecx
push 0x80000001
mov edi, edx
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
jne 0x402c0f
push 4
push dword [ebp + 8]
push 1
push ebx
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
cmp dword [ebp - 4], ebx
je 0x402c1d
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret