joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10d04fb
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf10bc550
jmp 0x10d06ed
mov byte [esp], dh
mov byte [esp], bh
lea esp, [esp + 2]
lea eax, [eax + 0x49]
pushfd
jmp 0x10d0579
pop word [esp + 5]
lea esp, [esp + 2]
xchg dword [esp + 8], eax
push bp
jmp 0x10d04e5
push dword [esp + 2]
pop dword [esp]
push dword [esp + 2]
pop dword [esp]
xchg dword [esp + 0xc], eax
pushfd
call fcn.010d0536
mov byte [esp + 1], bl
lea esp, [esp + 2]
mov dword [esp], esi
jmp 0x10d05a9
push edi
mov dword [esp], edi
lea esp, [esp + 1]
lea esp, [esp + 3]
push edi
jmp 0x10d0757
mov ebp, dword [esp + 0x2c]
mov bl, 0x17
cmp ah, 0x7f
jmp 0x10d06a9
setne dl
mov edi, 0x23a9de4b
jmp 0x10d065a
mov edx, esp
jmp 0x10d05ca
mov edi, esp
push sp
xchg byte [esp], al
cpuid
sub esp, 0xc
jmp 0x10d0629
sub esp, 0xc0
jmp 0x10d05f7
jmp 0x10d060d
jo 0x10d063f
lea esp, [esp + 2]
jmp 0x10d0643
lea esp, [esp + 2]
mov ecx, ebp
xchg dh, bl
cmc
jmp 0x10d0668
lea esi, [esp]
setb cl
rdtsc
neg ah
jle 0x10d0627
jg 0x10d060d
jae 0x10d067e
rdtsc
bsf ebx, ecx
jmp 0x10d068b
rdtsc
bsf ebx, ecx
rdtsc
jmp 0x10d06cf
rdtsc
mov eax, dword [esp]
bswap eax
jmp 0x10d06d4
jnp 0x10d05d9
setne dl
mov edi, 0x23a9de4b
jmp 0x10d065a
cmp eax, ebx
ja 0x10d0713
shr ah, cl
jmp 0x10d0715
mov eax, dword [esp]
bswap eax
lea edx, [eax*4]
lea edx, reloc.IPHLPAPI.DLL_GetInterfaceInfo
jmp 0x10d06b9
neg cx
jg 0x10d05f3
mov edx, esp
jmp 0x10d05ca
lea edx, [eax + edi]
mov bl, ch
lea eax, [esp + 0xd1]
xchg bl, bh
jmp 0x10d072f
pop ds
shr ah, cl
shr ah, cl
neg ebp
jmp 0x10d06fd
neg dh
cmp dx, ax
rcr dx, cl
mov bl, 0xbc
jmp 0x10d075d
dec ebp
xchg bl, bh
mov edx, eax
xchg ebx, eax
stc
jmp 0x10d073d
jle 0x10d0719
neg dh
cmp dx, ax
jmp 0x10d0773
pushfd
jmp 0x10cf0de
neg ebp
call 0x10d0790
outsb dx, byte [esi]
loope 0x10d07d8
adc bl, ah
push ecx
mov al, 0x22
mov al, 0xd7
and dl, byte [ebx - 0x2c998ae6]
fidiv dword [ebx - reloc.IPHLPAPI.DLL_GetInterfaceInfo]
daa
jne 0x10d0764
rcr dx, cl
mov bl, 0xbc
jmp 0x10d075d
jmp 0x10d07a3
je 0x10d0793
out dx, al
sub al, 0x85
sbb ecx, dword [ebx - 0x1257e212]
jl 0x10d079d
jne 0x10d0711
inc ebp
leave
push 0x111c8d5a
sub esp, 0x14
jnp 0x10d077a
adc dword [ebx - reloc.IPHLPAPI.DLL_GetInterfaceInfo], eax
jp 0x10d07a3
lahf
setg dl
lahf
cli
or dword [ebp + reloc.IPHLPAPI.DLL_GetInterfaceInfo], esp
and al, 0x14
lea esp, [esp + 0x14]
sub ebp, 0x520175fe
not dx
setg ah
rcl eax, cl
jmp 0x10d07c6
jno 0x10d07dc
lea ebx, [ebp*4]
jmp 0x10d07e3
hlt
lea ebx, [ebp*4]
add byte [eax], al
add byte [ecx - 0x212fa00b], al
dec eax
xor ebp, 0x48ded05f
mov dh, al
jmp 0x10d0807
mov ebx, dword [esp]
call fcn.010d0885
out dx, al
jp 0x10d07e0
invalid
dec ax
jae 0x10d07ed
mov ebx, dword [esp]
jmp 0x10d07f0
Function at 0x111ea5f
Capabilities:
Encode data using xor

Disassembly:
ret
add eax, dword [ecx + 0xc]
jmp 0x111ead8
mov ecx, dword [ecx + 0x14]
jmp 0x111eb41
lea edx, reloc.IPHLPAPI.DLL_GetInterfaceInfo
mov edx, dword [ecx]
push esi
jmp 0x111ea57
cmp edx, eax
call 0x111ea5f
cmpsb byte [esi], byte es:[edi]
lea esp, [esp + 8]
jae 0x10c0508
btr si, sp
jmp 0x111ea9e
int1
push ecx
shl dword [eax - reloc.IPHLPAPI.DLL_GetInterfaceInfo], 0x4a
push esi
jmp 0x10c0534
cmp eax, esi
jbe 0x10c04f2
ja 0x10c0508
in eax, 0x65
cmc
pushfd
outsd dx, dword [esi]
rcl byte [0x9e630496], cl
sub al, byte [edi + 0x7b18392e]
push edx
mov esi, dword [ecx + 4]
add esi, edx
stc
jmp 0x111ea7e
pop esi
jmp 0x10c04c6
cmp edi, esi
call fcn.0111f2d8
and dh, bh
jl 0x111eafb
jne 0x111ea6f
xor al, bl
dec ecx
fnstcw word [eax - 0x749706b5]
in eax, 0x62
invalid
mov esp, ebp
invalid
cmpsd dword [esi], dword es:[edi]
aaa
push edx
mov eax, dword [reloc.IPHLPAPI.DLL_GetInterfaceInfo]
add eax, dword [eax]
add byte [edx + 0x3fcca535], dh
sub dword [esi - reloc.IPHLPAPI.DLL_GetInterfaceInfo], 0xffffffd7
or dword ds:[eax - reloc.IPHLPAPI.DLL_GetInterfaceInfo], ebp
add al, ch
out 5, al
add byte [eax], al
and dword [ebp - 4], 0
call 0x111f106
push ds
or eax, 0x83701181
xor al, 0xc0
cmp dword [edx], 0x15
test byte [edi], dh
imul esp, eax, 0x76
adc eax, esp
push esi
xchg edi, eax
sbb eax, 0x9527d48d
out 0x6e, eax
cld
wait
jbe 0x111eaf3
inc esi
test ecx, ecx
jne 0x10c0534
call fcn.0111eabc
pushfd
push word [esp]
lea esp, [esp + 2]
jmp 0x111f0fa
mov ebx, dword [ebp - 0xc]
lea esp, [esp + 4]
jmp 0x111eb17
mov cl, 0xab
mov di, ax
jmp 0x111f23e
mov ecx, dword [esi + 0x1c]
mov di, dx
mov di, 0x3469
mov di, word [esp]
jmp 0x111f28f
push ecx
jmp 0x111f279
pushal
push bx
lea esp, [esp + 2]
mov dword [esp + 0x18], ebp
popal
jmp 0x111f2cd
lea esp, [esp + 4]
lea ecx, [ecx + eax*4]
pushfd
jmp 0x111f24e
mov edi, dword [eax + ecx]
jmp 0x111f2ee
add ecx, 8
mov eax, dword [ecx]
pop ecx
mov edi, dword [esp]
jmp 0x111f2b7
add edi, eax
lea esp, [esp + 4]
jmp 0x111eade

Function at 0x11ae3b9
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x24], eax
jmp 0x11ae417
jmp 0x11ae3f7
push 0
jmp 0x11ae63a
popfd
ret
call [edx + 0x77]
out 0x74, al
adc ebp, esi
pop ds
xchg edi, eax
invalid
popal
inc dword [esp + 8]
jmp 0x11ae401
cmp ebx, 0xc9c63fb0
je 0x11ae499
jne 0x11ac465
pushfd
call fcn.011ae46f
test eax, 0x45b6d343
invalid
std
or al, 0xa5
xor dword [eax], esi
xor ebp, dword [edx]
jmp 0x11ae556
pushal
mov eax, 0x10c0ab0
movzx ebx, byte [eax]
add ebx, 0xc9c63ee4
jmp 0x11ae435
inc edx
sbb al, byte [ecx + 0x6837011]
fadd qword [edx - 0x30]
mov bh, 0x42
lds eax, [ebx + 0x1f29707]
fstp xword [edx]
call 0x11ae4bd
push ebp
push ebx
inc ebp
push edx
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add bh, bh
nop
or al, 0xfc
push es
cmp bl, ch
sub eax, 0x6c059514
lahf
jnp 0x11ae452
push es
xchg esp, eax
push cs
out dx, eax
aaa
push ds
imul ebx, dword [eax + 0x2d], 0x38166154
jmp 0x11ae4ad
inc dword [esp + 8]
popfd
ret
pushfd
cmp dword [esp + 4], 0
jne 0x11ae40d
je 0x11ae486
dec ecx
rcl dword [ecx + 0x30], 0x2b
mov edx, 0x1b5e87f0
fld st(0)
lcall 0x6d0b, 0x3c6c0664
invalid
Function at 0x17b1355
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x17b1391
pop di
mov dword [esp + 0xe], esp
xchg word [esp + 0x18], bx
call 0x17b1355
mov es, ecx
iretd
stc
mov byte [esp + 0x1f], bl
btr ebp, ebx
dec bl
cpuid
lea ecx, reloc.IPHLPAPI.DLL_GetInterfaceInfo
jmp 0x17b1344

Function at 0x17b142e
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
xchg dword [esp + 3], ecx
xchg dx, ax
rdtsc
xchg ch, dl
jmp 0x17b148b
push word [esp + 1]
btr esi, edx
xchg dword [esp], ebp
lea ecx, [ebx*4]
jmp 0x17b14dc
pop word [esp + 4]
cpuid
add esp, 4
mov bh, 0xbb
xchg al, bh
mov bp, word [esp + 2]
jmp 0x17b1472
stc
mov dh, dl
neg cl
add esp, 3
xchg dword [esp], edx
sub esp, 0xc
jmp 0x17b14f3
push dword [esp + 4]
mov byte [esp + 4], ch
mov dl, cl
neg si
bsr ebp, esi
mov ax, word [esp + 5]
jmp 0x17b14a0
mov eax, 0xbd529bcb
mov esi, ecx
setno ch
xchg cl, dl
mov dx, 0x3589
push word [esp + 3]
jmp 0x17b14b6
xchg dword [esp + 0xb], eax
sbb ch, 0xd7
push sp
mov eax, 0x7c30044b
stc
inc bl
jmp 0x17b1545
pop dword [esp + 6]
xchg word [esp + 0xa], dx
pop di
xchg ecx, ebx
rcl bh, cl
jmp 0x17b1580
mov cl, 0x70
rdtsc
stc
pop word [esp + 0xd]
mov bl, cl
cpuid
jmp 0x17b152f
add esp, 0xd
call fcn.017b1654
inc eax
invalid
lea esp, [esp + 9]
mov di, bp
lea eax, [edx + esi]
add esp, 2
sub esp, 0xe
xchg dword [esp + 3], ebx
jmp 0x17b156a
Function at 0x18a6ce9
Capabilities:
Execute anti-debugging instructions

Disassembly:
btr cx, sp
stc
lea edi, [esi*4]
bt ebp, edx
jmp 0x18a6d03
rdtsc
jmp 0x18a6cd3
mov esi, 0x9afcd8d6
mov ah, bh
neg edx
rdtsc
xchg cx, bx
jmp 0x18a6daf
pop dword [esp]
add esp, 0
pop word [esp + 3]
rol ecx, cl
xchg cl, ch
cmp si, bp
jmp 0x18a6ced
pop ax
sbb di, di
xchg word [esp + 7], di
setbe cl
jmp 0x18a6d7d
mov ah, byte [esp + 0xd]
neg bx
rdtsc
cld
mov di, word [esp + 9]
pop ax
jmp 0x18a6d3e
xchg edx, ecx
lea ebp, [ebp*4]
mov al, dl
push word [esp + 4]
jmp 0x18a6d8f
mov bx, 0x66a
mov edi, edx
sub esp, 0
dec cx
mov dword [esp + 5], esp
stc
jmp 0x18a6d67
xchg word [esp + 8], di
xchg edx, eax
not al
push eax
mov dx, 0xb7f5
mov bl, 0x84
jmp 0x18a6ddf
setns al
mov bh, byte [esp + 1]
xchg dword [esp + 3], esi
xchg word [esp + 1], dx
push dword [esp + 1]
push dword [esp + 8]
jmp 0x18a6d54
mov ebp, 0xc322cc3b
xchg word [esp + 9], si
mov word [esp], ax
jmp 0x18a6fa7
mov dl, byte [esp + 0xd]
xchg word [esp], bp
dec ah
not ecx
lea ebp, [edx + edi]
cpuid
jmp 0x18a6dc9
setnp cl
push cx
push dword [esp + 0xf]
xchg dword [esp + 0xd], ebp
call fcn.018a6e2e
xchg bp, cx
sub ax, sp
bswap esi
mov word [esp], di
lea esi, reloc.IPHLPAPI.DLL_GetInterfaceInfo
lea edx, [esp + 3]
jmp 0x18a6f34
bsr cx, ax
sub esp, 0x19
lea esp, [esp + 0x10]
mov ax, bp
lea edx, [ebx*4]
pop word [esp + 3]
jmp 0x18a6f79
lea ebx, reloc.IPHLPAPI.DLL_GetInterfaceInfo
mov bh, 0x32
not ah
lea esp, [esp + 3]
jmp 0x18a6f8f
pop word [esp + 1]
neg eax
mov bp, ax
pop dx
mov eax, esp
lea edx, reloc.IPHLPAPI.DLL_GetInterfaceInfo
jmp 0x18a6f63
xchg word [esp], bp
xchg esi, ebp
add esp, 1
cpuid
lea edi, [edi + 0xb0]
jmp 0x18a6fd8
push word [esp + 0xa]
sub esp, 4
mov ecx, dword [esp + 5]
xchg bh, dh
push word [esp + 0x10]
mov cx, bx
jmp 0x18a6eef
cmp dh, 0x92
mov di, word [esp]
adc ebp, 0x6d6db500
jmp 0x18a6fe7
mov byte [esp], dh
rdtsc
bswap edi
mov ah, 0xb6
shl bl, cl
mov ebp, ecx
jmp 0x18a6fc2
bsr bp, si
mov dx, word [esp]
mov si, cx
neg ebp
mov byte [esp], cl
jmp 0x18a8778
mov si, word [esp]
xchg ebx, esi
xchg bp, bx
sub esp, 2
neg edx
cpuid
jmp 0x18a773a
Function at 0x18a7207
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp + 3], edx
mov ecx, 0x68f0b0a6
cpuid
rdtsc
jmp 0x18a70c4
pop dword [esp + 0x14]
stc
mov dx, word [esp + 0x13]
mov byte [esp + 0x16], bl
xchg esi, eax
lea ebx, [ecx + ebx]
jmp 0x18a6ffd
pop edx
mov di, word [esp]
mov cx, word [esp + 2]
mov dl, ch
mov ebx, 0x381d8829
pop ax
jmp 0x18a7077
mov edi, 0xe8498712
mov ax, word [esp + 3]
not edx
mov ch, byte [esp + 6]
mov bh, al
xchg ecx, ebx
jmp 0x18a7027
mov byte [esp], ah
mov ch, 0x47
clc
add esp, 1
mov dl, 0x93
xchg byte [esp + 1], al
jmp 0x18a709c
bsr eax, eax
inc bh
bswap esi
bsr esi, ecx
xchg bl, ah
pushfd
jmp 0x18a7061
xchg esi, ecx
bt ax, si
stc
mov word [esp + 0xa], dx
jmp 0x18a70dd
xchg di, si
xchg byte [esp + 1], bh
bsf cx, bp
lea edx, [esp + ebp]
neg edx
sub esp, 0xf
jmp 0x18a7086
lea esp, [esp + 0x15]
std
xchg dword [esp], eax
lea esp, [esp + 5]
lea edx, [eax + ebx]
pop word [esp + 2]
jmp 0x18a704b
mov ecx, 0x1b04ae08
lea esi, [ebp*4]
stc
rcr ecx, cl
call fcn.018a7181
mov byte [0x63f2cdd], al
mov cl, 0x8a
fisub dword [esi + 0x43]
mov bl, dl
inc bx
xchg dword [esp], eax
lea eax, [esi*4]
mov byte [esp], dl
pushal
jmp 0x18a7013
or ah, 0x31
xchg bx, si
bt edx, ebp
rdtsc
jmp 0x18a70f7

Function at 0x18a9194
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
not bl
lea esp, [esp + 1]
mov ebp, dword [esp + 0x3c]
mov bx, word [esp]
bswap ebx
jmp 0x18a919f
lea esp, [esp + 3]
neg ebp
bsr ebx, ebx
jmp 0x18a917e
cmc
mov ebx, dword [esp + 0x40]
lea esp, [esp + 0x48]
popfd
lea esp, [esp + 4]
jmp 0x18a91b3
call 0x18a91ef
mov cl, 0x3d
lodsd eax, dword [esi]
mov ah, 0x47
stosd dword es:[edi], eax
or dword [esi], reloc.IPHLPAPI.DLL_GetInterfaceInfo
pop ds
xchg cx, ax
adc byte [ebx + 0x242c8b66], dl

Function at 0x18a91d9
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
call fcn.018a903c
mov word [esp], bp
pushal
jmp 0x18a91ff
push word [esp + 2]
mov word [esp + 6], di
lea esp, [esp + 2]
mov dword [esp + 0x20], ecx
push sp
push word [esp]
jmp 0x18a92ae
lea esp, [esp + 0x44]
call fcn.018a9236
lea esp, [esp + 1]
mov dword [esp + 0x24], ebp
mov dword [esp + 0x20], esi
push cx
push word [esp]
mov word [esp], si
jmp 0x18a9291
mov dword [esp + 0xd], ebx
mov byte [esp + 7], ch
push edx
mov byte [esp], ch
mov byte [esp + 0xb], dh
pushal
jmp 0x18a924c
lea esp, [esp]
mov dword [esp + 0x20], edi
lea esp, [esp + 0x20]
jmp 0x18a92d4
mov dword [esp], ecx
mov dword [esp + 0x20], edx
push ecx
push esp
mov dword [esp + 0x24], ebx
pushal
jmp 0x18a927e
mov eax, dword [eax]
jmp 0x18a92e2
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x18a92be
mov eax, dword [eax + 8]
push eax
jmp 0x18a9037

Function at 0x18a9236
Capabilities:
Access peb ldr_data
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
mov dword [esp + 0x24], esp
pushal
lea esp, [esp + 3]
lea esp, [esp + 0x18]
mov dword [esp], ebp
jmp 0x18a9255
Function at 0x401ab5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42f090]
jne 0x401abf
repz ret
jmp fcn.00402d08

Function at 0x40b28e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00403feb
and dword [ebp - 4], 0
cmp dword [0x4332ec], 0
mov ebx, eax
jne 0x40b33f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40b3f0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40b3f0
push eax
call fcn.00403f79
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4332ec], eax
call esi
push eax
call fcn.00403f79
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4332f0], eax
call esi
push eax
call fcn.00403f79
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4332f4], eax
call esi
push eax
call fcn.00403f79
pop ecx
mov dword [0x4332fc], eax
test eax, eax
je 0x40b33f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00403f79
pop ecx
mov dword [0x4332f8], eax
mov eax, dword [0x4332f8]
cmp eax, ebx
je 0x40b397
cmp dword [0x4332fc], ebx
je 0x40b397
push eax
call fcn.00403ff4
push dword [0x4332fc]
mov esi, eax
call fcn.00403ff4
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40b397
test edi, edi
je 0x40b397
call esi
test eax, eax
je 0x40b38e
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40b38e
test byte [ebp - 0xc], 1
jne 0x40b397
or dword [ebp + 0x10], 0x200000
jmp 0x40b3d0
mov eax, dword [0x4332f0]
cmp eax, ebx
je 0x40b3d0
push eax
call fcn.00403ff4
pop ecx
test eax, eax
je 0x40b3d0
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40b3d0
mov eax, dword [0x4332f4]
cmp eax, ebx
je 0x40b3d0
push eax
call fcn.00403ff4
pop ecx
test eax, eax
je 0x40b3d0
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4332ec]
call fcn.00403ff4
pop ecx
test eax, eax
je 0x40b3f0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40b3f2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40ce67
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x40ce76
pop dword [ebp - 0x18]
mov eax, 0x40ce76
sub dword [ebp - 0x18], eax
push 0x40
push 0x1000
push 0x52ded
push 0
mov eax, 0xa1e26e1f
add eax, 0x5e624491
add eax, dword [ebp - 0x18]
call dword [eax]
mov ecx, 0x6a61fc53
add ecx, 0x959e562a
xor edx, edx
add edx, eax
mov ebx, 0x1fa77270
add ebx, 0xe0a11b90
add ebx, dword [ebp - 0x18]
mov edi, 0x13c8233a
sub dword [ebp - 0x10], ebx
mov esi, dword [ebx]
mov dword [ebp - 8], 0x4e43dcb1
xor esi, edi
xor dword [ebp - 8], eax
mov dword [edx], esi
add edx, 0x8566d59b
sub edx, 0x8566d597
add ebx, 0x62eb6198
sub ebx, 0x62eb6194
loop 0x40cecc
add eax, 0xfddaf314
add eax, 0x22649b3
mov ebx, eax
add eax, 0x101162c7
sub eax, 0x101162c2
mov ecx, 0x2f57d1c
sub ecx, 0x2b57d1c
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x4400c9
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46c6d0
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x44010c
push str.SystemFunction040
push dword [0x46c6d0]
call edi
push str.SystemFunction041
push dword [0x46c6d0]
mov dword [0x46c6c0], eax
call edi
mov dword [0x46c6c4], eax
jmp 0x440111
mov eax, dword [0x46c6c4]
cmp dword [0x46c6c0], 0
je 0x440122
test eax, eax
jne 0x4401c9
push 0x46c6d4
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x4401d3
push str.CryptProtectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c0], 0
mov dword [0x46c6c8], eax
jne 0x440187
test eax, eax
jne 0x440187
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x440171
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x440178
mov esi, 0x80004005
push esi
push 0x28
push str.c:_agent_work138_s_srclibsdutilcryputil.cpp
call fcn.004038f5
jmp 0x4401d3
push str.CryptUnprotectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c4], 0
mov dword [0x46c6cc], eax
jne 0x4401c9
test eax, eax
jne 0x4401c9
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4401bd
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4401c4
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x44017b
mov dword [0x46c6d8], 1
pop edi
mov eax, esi
pop esi
ret
Function at 0x40fd70
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x62c
mov eax, dword [0x4b33f0]
mov dword [ebp - 4], eax
push edi
mov dword [ebp - 0x62c], ecx
mov eax, dword [ebp - 0x62c]
cmp dword [eax + 0xc8], 0xffffffff
je 0x40fd9e
xor al, al
jmp 0x40fee9
mov cx, word [0x48d030]
mov word [ebp - 0x210], cx
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.ServiceCore.dll_public:_static_bool___cdecl_CWHService::GetWorkDirectory_wchar_t__const__unsigned_short_int_]
add esp, 8
mov ax, word [0x48d034]
mov word [ebp - 0x418], ax
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x416]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [ebp - 0x210]
push ecx
push 0x48d038
push 0x104
lea edx, [ebp - 0x418]
push edx
call dword [sym.imp.MSVCR71.dll__snwprintf]
add esp, 0x10
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x420], eax
cmp dword [ebp - 0x420], 0
jbe 0x40fe4d
mov ecx, dword [ebp - 0x420]
mov edx, dword [ebp + 8]
movzx eax, word [edx + ecx*2]
cmp eax, 0x2f
je 0x40fe4d
mov ecx, dword [ebp - 0x420]
sub ecx, 1
mov dword [ebp - 0x420], ecx
jmp 0x40fe21
mov dx, word [0x48d050]
mov word [ebp - 0x628], dx
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x626]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp - 0x420]
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 0x41c], edx
mov eax, dword [ebp - 0x41c]
push eax
lea ecx, [ebp - 0x418]
push ecx
push str._s_s.WHD
push 0x104
lea edx, [ebp - 0x628]
push edx
call dword [sym.imp.MSVCR71.dll__snwprintf]
add esp, 0x14
push 0
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push 0x1001
lea ecx, [ebp - 0x628]
push ecx
mov ecx, dword [ebp - 0x62c]
add ecx, 0xc4
mov edx, dword [ebp - 0x62c]
mov eax, dword [edx + 0xc4]
call dword [eax + 0x28]
test eax, eax
jne 0x40fee7
xor al, al
jmp 0x40fee9
mov al, 1
mov ecx, dword [ebp - 4]
call fcn.0048124d
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x414420
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4b33f0]
mov dword [ebp - 8], eax
push edi
mov dword [ebp - 0x20c], ecx
call dword [sym.imp.PlatformData.dll_public:_static_class_CGlobalWebLink____cdecl_CGlobalWebLink::GetInstance_void_]
mov dword [ebp - 4], eax
mov ax, word [0x48ded4]
mov word [ebp - 0x208], ax
mov ecx, 0x7f
xor eax, eax
lea edi, [ebp - 0x206]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, dword [ebp - 4]
call dword [sym.imp.PlatformData.dll_public:_wchar_t_const____thiscall_CGlobalWebLink::GetValidateLink_void_]
push eax
mov ecx, dword [ebp - 4]
call dword [sym.imp.PlatformData.dll_public:_wchar_t_const____thiscall_CGlobalWebLink::GetPlatformLink_void_]
push eax
push str._s__sShop_Index.aspx
push 0x100
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.MSVCR71.dll__snwprintf]
add esp, 0x14
push 1
push 0
push 0
lea edx, [ebp - 0x208]
push edx
push 0x48df04
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 8]
call fcn.0048124d
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x41ad50
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4b33f0]
mov dword [ebp - 8], eax
push edi
mov dword [ebp - 0x20c], ecx
call dword [sym.imp.PlatformData.dll_public:_static_class_CGlobalWebLink____cdecl_CGlobalWebLink::GetInstance_void_]
mov dword [ebp - 4], eax
mov ax, word [0x48f7f8]
mov word [ebp - 0x208], ax
mov ecx, 0x7f
xor eax, eax
lea edi, [ebp - 0x206]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, dword [ebp - 4]
call dword [sym.imp.PlatformData.dll_public:_wchar_t_const____thiscall_CGlobalWebLink::GetPlatformLink_void_]
push eax
push str._s_LogonLink5.aspx
push 0x100
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.MSVCR71.dll__snwprintf]
add esp, 0x10
push 1
push 0
push 0
lea edx, [ebp - 0x208]
push edx
push 0x48f824
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 8]
call fcn.0048124d
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x420450
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4b33f0]
mov dword [ebp - 8], eax
push edi
mov dword [ebp - 0x20c], ecx
call dword [sym.imp.PlatformData.dll_public:_static_class_CGlobalWebLink____cdecl_CGlobalWebLink::GetInstance_void_]
mov dword [ebp - 4], eax
mov ax, word [0x490b64]
mov word [ebp - 0x208], ax
mov ecx, 0x7f
xor eax, eax
lea edi, [ebp - 0x206]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, dword [ebp - 4]
call dword [sym.imp.PlatformData.dll_public:_wchar_t_const____thiscall_CGlobalWebLink::GetPlatformLink_void_]
push eax
push str._s_Agreement.aspx
push 0x100
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.MSVCR71.dll__snwprintf]
add esp, 0x10
push 1
push 0
push 0
lea edx, [ebp - 0x208]
push edx
push 0x490b8c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 8]
call fcn.0048124d
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4313e0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x628
mov eax, dword [0x4b33f0]
mov dword [ebp - 4], eax
push edi
mov dword [ebp - 0x628], ecx
mov eax, dword [ebp - 0x628]
cmp dword [eax + 0x27c], 0xffffffff
je 0x43140e
xor al, al
jmp 0x431557
mov cx, word [0x494508]
mov word [ebp - 0x210], cx
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.ServiceCore.dll_public:_static_bool___cdecl_CWHService::GetWorkDirectory_wchar_t__const__unsigned_short_int_]
add esp, 8
mov ax, word [0x49450c]
mov word [ebp - 0x620], ax
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x61e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, dword [ebp - 0x628]
add ecx, 0x70
push ecx
lea edx, [ebp - 0x210]
push edx
push 0x494510
push 0x104
lea eax, [ebp - 0x620]
push eax
call dword [sym.imp.MSVCR71.dll__snwprintf]
add esp, 0x14
mov cx, word [0x49451c]
mov word [ebp - 0x418], cx
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x416]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea edx, [ebp - 0x620]
push edx
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea ecx, [ebp - 0x418]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x624], eax
cmp dword [ebp - 0x624], 0
jbe 0x431503
mov edx, dword [ebp - 0x624]
movzx eax, word [ebp + edx*2 - 0x418]
cmp eax, 0x5c
je 0x431503
mov ecx, dword [ebp - 0x624]
sub ecx, 1
mov dword [ebp - 0x624], ecx
jmp 0x4314d6
mov edx, dword [ebp - 0x624]
mov word [ebp + edx*2 - 0x416], 0
push 0
lea eax, [ebp - 0x418]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push 0
push 0x1001
lea ecx, [ebp - 0x620]
push ecx
mov ecx, dword [ebp - 0x628]
add ecx, 0x278
mov edx, dword [ebp - 0x628]
mov eax, dword [edx + 0x278]
call dword [eax + 0x28]
test eax, eax
jne 0x431555
xor al, al
jmp 0x431557
mov al, 1
mov ecx, dword [ebp - 4]
call fcn.0048124d
pop edi
mov esp, ebp
pop ebp
ret 4