joyce8/EMBER2024-capa huggingface dataset:
Function at 0x759f3400
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x75a96e38
push 0x75a00cf0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x75aa7214]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov ebx, edx
mov dword [ebp - 0x28], ebx
mov esi, ecx
test esi, esi
je 0x759f3536
movzx eax, word [esi]
cmp eax, 0x2d
je 0x75a11ffd
mov dword [ebp - 0x24], 0
mov ecx, eax
cmp eax, 0x2b
je 0x75a12004
cmp cx, 0x30
je 0x759f3510
mov dword [ebp - 0x20], 0xa
movzx ecx, cx
xor eax, eax
mov dword [ebp - 0x1c], eax
movzx edx, cx
test cx, cx
je 0x759f34be
movzx edi, cx
movzx ebx, di
lea ecx, [ebx - 0x30]
cmp ecx, 9
ja 0x759f3552
imul eax, dword [ebp - 0x20]
add eax, ecx
movzx edx, di
cmp dword [ebp - 0x20], 0x10
je 0x759f3502
cmp eax, dword [ebp - 0x1c]
jl 0x759f34bb
mov dword [ebp - 0x1c], eax
add esi, 2
movzx ecx, word [esi]
mov edi, ecx
mov edx, ecx
test cx, cx
jne 0x759f3486
mov ebx, dword [ebp - 0x28]
test dx, dx
jne 0x759f3564
cmp dword [ebp - 0x24], 0
jne 0x75a1203f
mov esi, 1
mov dword [ebp - 4], 0
mov dword [ebx], eax
mov dword [ebp - 4], 0xfffffffe
test esi, esi
je 0x75a12056
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 0x1c]
inc ebx
mov dword [ebp - 0x1c], ebx
cmp ebx, 8
jbe 0x759f34ac
jmp 0x759f34bb
movzx eax, word [esi + 2]
cmp eax, 0x78
jne 0x759f352b
mov dword [ebp - 0x20], 0x10
add esi, 4
movzx ecx, word [esi]
jmp 0x759f3476
cmp eax, 0x58
jne 0x759f346c
jmp 0x759f3519
push 0x57
call dword [0x75aa9118]
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx edx, di
cmp dword [ebp - 0x20], 0x10
jne 0x759f34bb
jmp 0x75a1200f
push 0xd
call dword [0x75aa9118]
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x24], 1
add esi, 2
movzx ecx, word [esi]
jmp 0x759f3462
lea ecx, [ebx - 0x61]
cmp ecx, 5
ja 0x75a1201f
lea ecx, [ebx - 0x57]
jmp 0x759f3495
movzx edx, di
cmp ebx, 0x41
jb 0x759f34bb
movzx edx, di
cmp ebx, 0x46
ja 0x759f34bb
lea ecx, [ebx - 0x37]
jmp 0x759f3495
neg eax
jmp 0x759f34d1
push 0x57
call dword [0x75aa9118]
jmp 0x759f34ee
Function at 0x75a01b60
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x75a01b9e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x75a01b96
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x75a01ba0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x75a01b86
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x75a01c70
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x75a01ca1
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x75a01ca1
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x75a01ca1
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x75a03c42
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
mov dword [ebp - 8], edx
push edi
xor ebx, ebx
mov dword [ebp - 4], esi
push 0xc
mov ecx, dword [esi + 0x14]
mov edi, ebx
mov eax, dword [esi + 0x18]
mov edx, ebx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], ecx
movzx eax, word [ecx + 4]
mov dword [ebp - 0x10], eax
pop ecx
test eax, eax
je 0x75a03cb9
mov eax, dword [esi + 0x18]
mov esi, dword [ebp + 8]
cmp dword [eax], esi
mov esi, dword [ebp - 4]
jne 0x75a03cb1
cmp dword [ebp + 0xc], ebx
je 0x75a03ca0
cmp dword [esi + 0x20], ebx
je 0x75a03ca0
test byte [eax + 4], 1
jne 0x75a03cb1
imul esi, edx, 0xc
lea edi, [ebp - 0x20]
add esi, dword [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp 0x75a03cc3
mov esi, eax
lea edi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor edi, edi
inc edi
test byte [eax + 4], 1
jne 0x75a03cb9
inc edx
add eax, ecx
cmp edx, dword [ebp - 0x10]
jb 0x75a03c78
mov esi, ebx
test edi, edi
je 0x75a03d71
cmp dword [ebp + 0xc], ebx
je 0x75a03cd0
mov eax, dword [ebp - 4]
cmp dword [eax + 0x20], ebx
jne 0x75a03cd3
push 8
pop ecx
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ecx + eax]
test al, 4
je 0x75a03ce9
and edx, 0xffffcfff
mov dword [ebp - 0x1c], edx
test al, 2
je 0x75a03cf6
and edx, 0xfffff3ff
mov dword [ebp - 0x1c], edx
test al, 1
je 0x75a03d03
and edx, 0xfffffcff
mov dword [ebp - 0x1c], edx
test al, 8
je 0x75a03d17
and edx, 0xc0ffffff
mov edi, ebx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edi
jmp 0x75a03d1a
mov edi, dword [ebp - 0x18]
lea ecx, [ebp - 0x20]
mov esi, ebx
call fcn.75a039a9
mov ecx, dword [ebp - 8]
test eax, eax
je 0x75a03d74
mov eax, edx
mov dword [ecx + 0xc], edi
shr eax, 0x1e
mov dword [ecx + 8], eax
mov eax, edx
shr eax, 0x18
and al, 0x3f
mov byte [ecx + 4], al
mov eax, edx
shr eax, 1
and eax, 1
mov dword [ecx + 0x14], eax
mov eax, edx
shr eax, 0xc
and eax, 3
jne 0x75a03d5e
mov eax, edx
shr eax, 0xa
and eax, 3
je 0x75a03d62
mov dword [ecx], eax
jmp 0x75a03d6c
shr edx, 8
and edx, 3
je 0x75a03d6c
mov dword [ecx], edx
xor esi, esi
inc esi
jmp 0x75a03d74
mov ecx, dword [ebp - 8]
mov edi, dword [ebp - 0xc]
mov edx, ebx
mov eax, dword [ebp - 4]
movzx edi, word [edi + 6]
mov eax, dword [eax + 0x1c]
test edi, edi
je 0x75a03d9e
mov ecx, dword [ebp + 8]
cmp dword [eax], ecx
mov ecx, dword [ebp - 8]
je 0x75a03d9b
inc edx
add eax, 0x10
cmp edx, edi
jb 0x75a03d87
jmp 0x75a03d9e
xor ebx, ebx
inc ebx
pop edi
mov eax, esi
mov dword [ecx + 0x10], ebx
pop esi
pop ebx
leave
ret 8
Function at 0x75a84ac9
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
xor edx, edx
movzx eax, byte [edx + edi]
xor eax, esi
imul esi, eax, 0x1000193
inc edx
cmp edx, 4
jb 0x75a84ada
mov edx, dword [ecx + 0x14]
mov eax, edx
and eax, esi
pop edi
pop esi
cmp dword [ecx + 0x18], eax
ja 0x75a84b03
shr edx, 1
or ecx, 0xffffffff
sub ecx, edx
add eax, ecx
pop ebp
ret 4
Function at 0x40d340
Capabilities:
Create thread
Terminate process

Disassembly:
push 0x24
mov eax, 0x484788
call fcn.0046af73
mov esi, ecx
call fcn.00438f88
mov edi, eax
mov ecx, esi
lea eax, [ebp - 0x30]
push eax
call fcn.004391c7
xor ebx, ebx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], ebx
push dword [eax]
call fcn.0040d781
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x30]
lea ecx, [ecx - 0x10]
call fcn.0040c9bc
mov eax, edi
dec eax
je 0x40d3af
dec eax
je 0x40d392
call fcn.0042b044
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push ebx
push ebx
push esi
push 0x40d2e7
push ebx
push ebx
call fcn.00466f1c
add esp, 0x18
mov ecx, esi
call fcn.0040d340
mov edi, eax
jmp 0x40d3fe
cmp dword [ebp - 0x1c], 0
je 0x40d3fe
mov eax, dword [esi + 0x354]
mov byte [eax + 0x711], bl
lea eax, [ebp - 0x2c]
mov ecx, dword [esi + 0x354]
add ecx, 0x6c8
cmp ecx, eax
je 0x40d3dd
push 0xffffffffffffffff
push ebx
push eax
call fcn.0040de35
mov ecx, dword [esi + 0x354]
call fcn.00413a97
mov ecx, dword [esi + 0x358]
test al, al
je 0x40d3f9
call fcn.00431799
jmp 0x40d3fe
call fcn.00431802
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.0040d9e7
mov eax, edi
call fcn.0046af22
ret
Function at 0x410b0c
Capabilities:
Create process on windows

Disassembly:
push 0x264
mov eax, 0x484e57
call fcn.0046afdf
mov edi, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x26c], eax
mov dword [ebp - 0x264], eax
lea eax, [ebp - 0x260]
push eax
mov dword [ebp - 0x268], edi
call fcn.00428615
xor esi, esi
xor eax, eax
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], esi
mov word [ebp - 0x2c], ax
xor ebx, ebx
lea ecx, [ebp - 0x1dc]
inc ebx
mov byte [ebp - 4], bl
mov edx, dword [0x4c325c]
call fcn.00415092
test al, al
je 0x410bbd
cmp dword [edi + 0x6c4], esi
je 0x410b94
sub esp, 0x18
lea eax, [edi + 0x77c]
mov ecx, esp
push eax
call fcn.00413b07
mov ecx, dword [edi + 0x6c4]
push esi
push esi
call fcn.00435c7e
lea edx, [ebp - 0x194]
mov byte [edi + 0x711], bl
lea ecx, [ebp - 0x44]
call fcn.0042cf8c
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040d7d7
push esi
push ebx
lea ecx, [ebp - 0x44]
call fcn.0040d9e7
jmp 0x410bfd
push ebx
push esi
push esi
lea eax, [edi + 0x6c8]
mov byte [ebp - 4], 2
push eax
lea eax, [edi + 0x6e0]
mov ecx, edi
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.00412c37
push esi
push ebx
lea ecx, [ebp - 0x44]
call fcn.0040d9e7
lea ecx, [ebp - 0x2c]
lea eax, [edi + 0x6c8]
cmp ecx, eax
je 0x410bfd
push 0xffffffffffffffff
push esi
push eax
call fcn.0040de35
cmp byte [edi + 0x711], 0
je 0x410c21
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
push ebx
cmovae eax, dword [ebp - 0x2c]
push esi
push esi
push eax
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push esi
push 2
push 0x111
push dword [ebp - 0x26c]
call dword [sym.imp.USER32.dll_SendMessageW]
push esi
push ebx
jmp 0x410d69
lea ecx, [ebp - 0x2c]
call fcn.0040d9e7
lea ecx, [ebp - 0x260]
call fcn.0040cef3
call fcn.0046af31
ret 4
Function at 0x413172
Capabilities:
Write file on windows

Disassembly:
push 0x3c
mov eax, 0x48552d
call fcn.0046af73
xor ebx, ebx
lea eax, [ebp + 8]
inc ebx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0x1c], 8
cmovae eax, dword [ebp + 8]
xor edi, edi
push edi
push 0x80
push 2
push edi
push edi
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push str._InternetShortcut__nURL_
lea ecx, [ebp - 0x2c]
mov esi, eax
call fcn.0040d748
push edi
lea edx, [ebp + 0x20]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x44]
call fcn.0042ceff
pop ecx
push 0xffffffffffffffff
push edi
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call fcn.00414539
push edi
push ebx
lea ecx, [ebp - 0x44]
call fcn.0040d955
mov dword [ebp - 0x48], edi
test esi, esi
je 0x413203
cmp dword [ebp - 0x18], 0x10
lea ecx, [ebp - 0x48]
push edi
push ecx
push dword [ebp - 0x1c]
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
push ebx
lea ecx, [ebp - 0x2c]
call fcn.0040d955
push edi
push ebx
lea ecx, [ebp + 8]
call fcn.0040d9e7
push edi
push ebx
lea ecx, [ebp + 0x20]
call fcn.0040d9e7
call fcn.0046af22
ret

Function at 0x413227
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4bc760]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, edx
mov ebx, ecx
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x413251
xor al, al
jmp 0x4132c1
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x41324d
mov edx, ebx
lea ecx, [ebp - 0x1c]
call fcn.0042e9fa
cmp dword [eax + 0x14], 8
jb 0x41327c
mov eax, dword [eax]
xor ebx, ebx
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push ebx
push 1
lea ecx, [ebp - 0x1c]
mov esi, eax
call fcn.0040d9e7
test esi, esi
je 0x41324d
push ebx
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], ebx
push ecx
push dword [ebp - 0x20]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00466746
mov esp, ebp
pop ebp
ret
Function at 0x413837
Capabilities:
Create process on windows
Create shortcut via ishelllink

Disassembly:
push 8
mov eax, 0x4856d3
call fcn.0046af40
xor ebx, ebx
mov dword [ebp - 4], 3
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
mov esi, eax
test esi, esi
js 0x41394a
lea eax, [ebp - 0x10]
push eax
push 0x49efdc
push 1
push ebx
push 0x49f2cc
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
js 0x41394a
mov eax, dword [ebp - 0x10]
lea edx, [ebp + 8]
push 8
pop edi
cmp dword [ebp + 0x1c], edi
mov ecx, dword [eax]
cmovae edx, dword [ebp + 8]
push edx
push eax
call dword [ecx + 0x50]
mov eax, dword [ebp - 0x10]
lea edx, [ebp + 0x38]
cmp dword [ebp + 0x4c], edi
cmovae edx, dword [ebp + 0x38]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x10]
lea edx, [ebp + 0x38]
cmp dword [ebp + 0x4c], edi
cmovae edx, dword [ebp + 0x38]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x2c]
mov eax, dword [ebp - 0x10]
lea edx, [ebp + 0x50]
cmp dword [ebp + 0x64], edi
push ebx
cmovae edx, dword [ebp + 0x50]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x14]
push edx
push 0x49f31c
push eax
mov ecx, dword [eax]
call dword [ecx]
mov esi, eax
test esi, esi
js 0x413941
mov eax, dword [ebp - 0x14]
lea edx, [ebp + 0x20]
cmp dword [ebp + 0x34], edi
push 1
cmovae edx, dword [ebp + 0x20]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x18]
mov edi, str.Quick_Launch
mov esi, eax
push edi
call fcn.0040ca1c
pop ecx
push eax
push ebx
push edi
lea ecx, [ebp + 0x20]
call fcn.0041462f
cmp eax, 0xffffffff
je 0x413938
cmp dword [ebp + 0x34], 8
lea eax, [ebp + 0x20]
push ebx
cmovae eax, dword [ebp + 0x20]
push ebx
push ebx
push eax
push str.taskbarpin
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
push ebx
push 1
lea ecx, [ebp + 8]
call fcn.0040d9e7
push ebx
push 1
lea ecx, [ebp + 0x20]
call fcn.0040d9e7
push ebx
push 1
lea ecx, [ebp + 0x38]
call fcn.0040d9e7
push ebx
push 1
lea ecx, [ebp + 0x50]
call fcn.0040d9e7
mov eax, esi
call fcn.0046af0e
ret
Function at 0x4166be
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x485d8a
mov eax, dword fs:[0]
push eax
sub esp, 0x7e8
mov eax, dword [0x4bc760]
xor eax, esp
mov dword [esp + 0x7e0], eax
push ebx
push esi
push edi
mov eax, dword [0x4bc760]
xor eax, esp
push eax
lea eax, [esp + 0x7f8]
mov dword fs:[0], eax
mov edi, ecx
call fcn.0044aec2
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edx, dword [esp + 0x18]
mov esi, eax
lea eax, [esp + 0x14]
xor ebx, ebx
push eax
mov ecx, esi
mov word [esp + 0x18], bx
mov byte [esp + 0x1a], bl
call fcn.0041684a
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp byte [esp + 0x14], bl
je 0x416747
call fcn.0041693f
cmp byte [esp + 0x15], bl
jne 0x416785
call fcn.00416a9f
test al, al
jne 0x416785
push dword [esp + 0x18]
mov edx, esi
lea ecx, [esp + 0x28]
call fcn.00416b15
pop ecx
lea edx, [esp + 0x24]
call fcn.004169fa
push ebx
test al, al
je 0x41677a
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 1
lea ecx, [esp + 0x2c]
call fcn.0040d9e7
push ebx
push ebx
push ebx
push 4
push 6
push ebx
push ebx
push 0xffffffffffffffff
push ebx
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 8
push eax
mov dword [esp + 0x24], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, edi
call fcn.00447dfd
push ebx
call fcn.004499f1
movzx eax, byte [esp + 0x1a]
xorps xmm0, xmm0
test eax, eax
mov dword [esp + 0x50], ebx
pop ecx
setne al
mov dword [esp + 0x50], ebx
movzx eax, al
push eax
movdqu xmmword [esp + 0x40], xmm0
call fcn.0044c71b
lea ecx, [esp + 0x58]
push dword [eax + 8]
call fcn.0040f363
mov dword [esp + 0x7e8], 1
lea ecx, [esp + 0x3c]
mov dword [esp + 0x800], ebx
call fcn.00431401
lea ecx, [esp + 0x54]
call fcn.0040f67a
xor eax, eax
mov ecx, dword [esp + 0x7f8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x7e0]
xor ecx, esp
call fcn.00466746
mov esp, ebp
pop ebp
ret

Function at 0x41693f
Capabilities:
Terminate process

Disassembly:
push 0x254
mov eax, 0x485dce
call fcn.0046af73
push 0x104
lea eax, [ebp - 0x218]
xor esi, esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x248]
call fcn.0040d781
lea edx, [ebp - 0x248]
mov dword [ebp - 4], esi
lea ecx, [ebp - 0x260]
call fcn.0042adac
push str._test
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x230]
call fcn.0040e342
pop ecx
push esi
push 1
lea ecx, [ebp - 0x260]
call fcn.0040d9e7
push esi
push 1
lea ecx, [ebp - 0x248]
call fcn.0040d9e7
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push esi
cmovae eax, dword [ebp - 0x230]
push 0x80
push 2
push esi
push esi
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
test eax, eax
je 0x4169f1
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xfffffffffffffffb
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4169fa
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x4bc760]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x104
lea eax, [ebp - 0x20c]
mov esi, edx
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x416a8e
push 0x3c
lea eax, [ebp - 0x248]
push 0
push eax
call fcn.00469150
and dword [ebp - 0x240], 0
lea eax, [ebp - 0x20c]
add esp, 0xc
mov dword [ebp - 0x248], 0x3c
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x23c], str.runas
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x22c], 1
jb 0x416a74
mov esi, dword [esi]
lea eax, [ebp - 0x248]
mov dword [ebp - 0x234], esi
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
setne al
jmp 0x416a90
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00466746
mov esp, ebp
pop ebp
ret

Function at 0x416a9f
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4bc760]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
mov word [ebp - 8], 0x500
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], ebx
push eax
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x416af0
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
cmp dword [ebp - 0x10], 0
pop ebx
je 0x416b00
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [ebp - 0x14], 0
mov ecx, dword [ebp - 4]
setne al
xor ecx, ebp
call fcn.00466746
mov esp, ebp
pop ebp
ret
Function at 0x4241bf
Capabilities:
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x487d45
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
mov eax, dword [0x4bc760]
xor eax, esp
mov dword [esp + 0xa0], eax
push ebx
push esi
push edi
mov eax, dword [0x4bc760]
xor eax, esp
push eax
lea eax, [esp + 0xb8]
mov dword fs:[0], eax
mov esi, ecx
mov edx, esi
lea ecx, [esp + 0x38]
call fcn.0042579d
and dword [esp + 0xc0], 0
lea ecx, [esp + 0x50]
mov edx, esi
call fcn.004258a2
mov byte [esp + 0xc0], 1
cmp dword [esp + 0x48], 0
je 0x4243cb
cmp dword [esp + 0x60], 0
je 0x4243cb
xor ecx, ecx
mov dword [esp + 0x34], 0xf
xorps xmm0, xmm0
mov dword [esp + 0x30], ecx
movlpd qword [esp + 0x14], xmm0
mov bl, cl
mov byte [esp + 0x20], cl
push ecx
push ecx
mov byte [esp + 0xc8], 3
mov eax, 0x4c3c4c
cmp dword [0x4c3c60], 8
push ecx
cmovae eax, dword [0x4c3c4c]
push ecx
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [esp + 0x1c], eax
test eax, eax
je 0x42433e
cmp dword [esp + 0x4c], 8
lea ecx, [esp + 0x38]
cmovae ecx, dword [esp + 0x38]
xor edx, edx
push edx
push edx
push 3
push edx
push edx
push 0x50
push ecx
push eax
call dword [sym.imp.WININET.dll_InternetConnectW]
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
mov edi, eax
test edi, edi
je 0x42431d
cmp dword [esp + 0x64], 8
lea ecx, [esp + 0x50]
cmovae ecx, dword [esp + 0x50]
xor eax, eax
push eax
push 0x400000
push eax
push eax
push eax
push ecx
push 0x4a4cb4
push edi
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov dword [esp + 0x10], eax
test eax, eax
je 0x4242ff
lea ecx, [esp + 0x10]
call fcn.00424d00
push dword [esp + 0x10]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
call esi
jmp 0x424318
mov ebx, str.Request_cannot_be_completed_on_current_url.
push ebx
call fcn.0040ca87
pop ecx
push eax
push ebx
lea ecx, [esp + 0x28]
call fcn.0040db24
mov bl, 1
push edi
call esi
jmp 0x424336
mov edi, str.Cannot_connect_to_server.
push edi
call fcn.0040ca87
pop ecx
push eax
push edi
lea ecx, [esp + 0x28]
call fcn.0040db24
mov bl, 1
push dword [esp + 0x1c]
call esi
jmp 0x424357
mov esi, str.Cannot_initialize_library.
push esi
call fcn.0040ca87
pop ecx
push eax
push esi
lea ecx, [esp + 0x28]
call fcn.0040db24
mov bl, 1
test bl, bl
je 0x424378
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x6c]
call fcn.00423e90
push 0x4b92a8
lea eax, [esp + 0x6c]
push eax
call fcn.0046b53e
push 0
push 1
lea ecx, [esp + 0x28]
call fcn.0040d955
push 0
push 1
lea ecx, [esp + 0x58]
call fcn.0040d9e7
push 0
push 1
lea ecx, [esp + 0x40]
call fcn.0040d9e7
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0xb8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xa0]
xor ecx, esp
call fcn.00466746
mov esp, ebp
pop ebp
ret
push str.Cannot_get_file_size__bad_URL.
lea ecx, [esp + 0x6c]
call fcn.0040d748
lea eax, [esp + 0x68]
mov byte [esp + 0xc0], 2
push eax
lea ecx, [esp + 0x90]
call fcn.00423e90
push 0x4b92a8
lea eax, [esp + 0x90]
jmp 0x424372
Function at 0x424d00
Capabilities:
Get http content length

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
xor edi, edi
mov dword [ebp - 4], 8
push edi
push edi
mov esi, ecx
xorps xmm0, xmm0
push edi
push edi
movlpd qword [ebp - 0xc], xmm0
push dword [esi]
call dword [sym.imp.WININET.dll_HttpSendRequestW]
push edi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x20000005
push dword [esi]
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret