joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cd748
Capabilities:
Check for time delay via gettickcount
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push esi
push edi
push 0xf01ff
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
xor edi, edi
mov dword [ebp - 8], esi
cmp esi, edi
jne 0x4cd77c
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x4cd827
push edi
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x4cd799
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push dword [ebp + 0xc]
call esi
jmp 0x4cd775
lea eax, [ebp - 0xc]
push eax
push 0x24
lea eax, [ebp - 0x30]
push eax
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
push esi
call edi
test eax, eax
je 0x4cd775
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebx
call esi
mov ebx, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
jmp 0x4cd80b
mov eax, dword [ebp - 0x18]
push 0xa
xor edx, edx
pop ecx
div ecx
mov ecx, 0x3e8
cmp eax, ecx
jb 0x4cd7de
mov ecx, 0x2710
cmp eax, ecx
jbe 0x4cd7e0
mov eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0xc]
push eax
push 0x24
lea eax, [ebp - 0x30]
push eax
push 0
push dword [ebp - 8]
call edi
test eax, eax
je 0x4cd811
cmp dword [ebp - 0x1c], ebx
ja 0x4cd7b8
call esi
sub eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x18]
ja 0x4cd811
cmp dword [ebp - 0x2c], 2
je 0x4cd7c2
push dword [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push dword [ebp + 0xc]
call esi
mov eax, 0x3e8
pop ebx
pop edi
xor edx, edx
pop esi
leave
ret

Function at 0x4d02f4
Capabilities:
Set registry value

Disassembly:
push 4
mov eax, 0x529d1f
call fcn.005054c1
lea eax, [ebp - 0x10]
push eax
call fcn.00425ed1
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax - 0xc]
add eax, eax
push eax
lea esi, [ebp - 0x10]
call fcn.004225b8
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push eax
push 1
push str.InstallDir
mov ebx, str.SoftwareAdvancedSystemRepairPro
push ebx
push SysReAllocString
call edi
mov eax, dword [ebp - 0x10]
mov eax, dword [eax - 0xc]
add eax, eax
push eax
call fcn.004225b8
push eax
push 1
push str.InstallDir
push ebx
push reloc.OLEAUT32.dll_SysReAllocString
call edi
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.004cdfac
call fcn.00505599
ret

Function at 0x4d06b3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.0040a8a5
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4d06ec
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.004448dd
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x4d09c7
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov esi, eax
xor ebx, ebx
push ebx
lea ecx, [esi + 0x90]
call fcn.004ce95f
lea edi, [esi + 0x4d8]
push 5
mov ecx, edi
call fcn.004ce95f
lea esi, [ebp - 0xc]
call fcn.004336af
push ebx
push 0x19
push 0x77
push dword [edi + 0x20]
call dword [eax + 8]
mov eax, dword [edi + 0x20]
push ebx
push ebx
push eax
push 0x428d82
push ebx
push ebx
call fcn.0050331c
add esp, 0x18
lea esi, [ebp - 0xc]
mov dword [edi + 0x74], eax
call fcn.004336af
push ebx
push 0x1388
push 0x75
push dword [edi + 0x20]
call dword [eax + 8]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4d1bc2
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push 0x74
mov eax, 0x523ba8
call fcn.0050552a
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x80], eax
call fcn.0044a215
mov esi, dword [ebp + 0xc]
xor edi, edi
mov dword [ebp - 4], edi
cmp esi, 0x13
jne 0x4d1bf0
push 0x546334
jmp 0x4d1c33
push 0x66
lea eax, [ebp - 0x78]
push edi
push eax
call fcn.00503570
add esp, 0xc
push edi
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push edi
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyExW]
shl eax, 0x10
add esi, 0xffffffdf
or eax, 1
cmp esi, 0xe
ja 0x4d1c22
or eax, 0x1000000
push 0x32
lea ecx, [ebp - 0x78]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
lea eax, [ebp - 0x78]
push eax
lea ecx, [ebp - 0x7c]
call fcn.004cf9df
lea ecx, [ebp - 0x7c]
call fcn.00403933
mov esi, dword [ebp - 0x7c]
cmp dword [esi - 0xc], edi
jle 0x4d1c84
push edi
lea ecx, [ebp - 0x7c]
call fcn.004d9512
movzx ebx, ax
push ebx
call dword [sym.imp.USER32.dll_IsCharLowerW]
test eax, eax
jne 0x4d1c6a
inc edi
cmp edi, dword [esi - 0xc]
jl 0x4d1c4b
jmp 0x4d1c84
movzx eax, bx
push eax
call fcn.0050843f
pop ecx
movzx eax, ax
push eax
push edi
lea ecx, [ebp - 0x7c]
call fcn.00481a75
mov esi, dword [ebp - 0x7c]
push dword [esi - 0xc]
mov ecx, dword [ebp - 0x80]
push esi
call fcn.004670de
cmp dword [ebp + 0x10], 0
jne 0x4d1ca0
mov ecx, dword [ebp - 0x80]
push 0x2b
call fcn.004b1748
lea ecx, [esi - 0x10]
call fcn.004daea8
call fcn.005055ad
ret 0xc

Function at 0x4d5604
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x51c510
call fcn.005054c1
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x4d5629
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x4d566f
lea ecx, [ebp - 0x10]
call fcn.0044a215
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0047e2d2
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.004daea8
mov eax, esi
call fcn.00505599
ret 8
Function at 0x4dc417
Capabilities:
Log keystrokes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi]
push edi
call dword [eax + 0x150]
mov edi, eax
movzx eax, word [ebp + 8]
push 2
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
cmp byte [ebp + 0xc], 0
movzx eax, ax
jne 0x4dc45c
test edi, edi
jl 0x4dc45c
cmp ax, 0x20
je 0x4dc451
cmp word [ebp + 8], 0x71
jne 0x4dc45c
mov eax, dword [esi]
push edi
mov ecx, esi
call dword [eax + 0x168]
pop edi
pop esi
pop ebp
ret 8

Function at 0x4ded1d
Capabilities:
Delete registry value
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x52a69a
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x57bf70]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor ebx, ebx
xor esi, esi
inc ebx
mov dword [esp + 0x10], esi
cmp dword [ebp + 0xc], esi
je 0x4ded5c
mov ecx, dword [ebp + 0xc]
jmp 0x4ded71
lea eax, [esp + 0x18]
push eax
call fcn.0044322e
pop ecx
mov dword [esp + 0x30], esi
mov ecx, dword [eax]
mov dword [esp + 0x10], ebx
lea eax, [esp + 0x14]
push eax
call fcn.00425ed1
mov dword [esp + 0x30], 2
test byte [esp + 0x10], bl
je 0x4ded97
and dword [esp + 0x10], 0xfffffffe
lea ecx, [esp + 0x18]
call fcn.004cdfac
cmp byte [ebp + 8], 0
je 0x4dee42
push dword [esp + 0x14]
push dword [ebp + 8]
call fcn.004099c1
pop ecx
pop ecx
test al, al
jne 0x4dee4d
lea eax, [esp + 0x20]
push eax
mov ecx, 0x5597b4
call fcn.00425ed1
mov byte [esp + 0x30], 3
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x20]
push ecx
mov esi, eax
call fcn.004c2fad
mov byte [esp + 0x38], 4
lea ecx, [esp + 0x20]
push str.___minimize
push ecx
mov esi, eax
call fcn.0047dc46
add esp, 0x10
mov byte [esp + 0x30], 6
lea ecx, [esp + 0x1c]
call fcn.004cdfac
mov byte [esp + 0x30], 7
lea ecx, [esp + 0x20]
call fcn.004cdfac
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx - 0xc]
add eax, eax
push eax
push ecx
push ebx
push 0x5590d4
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov byte [esp + 0x30], 2
lea ecx, [esp + 0x18]
call fcn.004cdfac
jmp 0x4dee6f
push dword [ebp + 0xc]
push esi
call fcn.004099c1
pop ecx
pop ecx
mov ebx, dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
mov edi, 0x5590d4
push edi
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push esi
push SysReAllocString
call ebx
push edi
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
or dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.004cdfac
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ede6c
Capabilities:
Get common file path

Disassembly:
push 0x224
mov eax, 0x5259a6
call fcn.0050552a
mov esi, ecx
mov dword [ebp - 0x22c], esi
call fcn.0040a7a7
push 0x15c
call fcn.0047d781
pop ecx
mov ecx, eax
mov dword [ebp - 0x228], ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp ecx, ebx
je 0x4edeb0
mov eax, dword [esi + 4]
push ebx
push eax
call fcn.004f3e06
jmp 0x4edeb2
xor eax, eax
or dword [ebp - 4], 0xffffffff
push eax
mov ecx, esi
call fcn.0049c72c
call fcn.0040a8a5
mov eax, dword [eax + 4]
mov edi, dword [eax + 0x88]
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
push 0x5c
pop eax
mov word [ebp + esi*2 - 0x218], ax
inc esi
xor eax, eax
mov dword [ebp - 0x228], esi
mov word [ebp + esi*2 - 0x218], ax
mov dword [ebp - 0x224], ebx
cmp edi, ebx
je 0x4ee052
cmp dword [edi + 4], ebx
jle 0x4ee052
lea ecx, [ebp - 0x21c]
call fcn.0044a215
mov edx, dword [edi]
xor eax, eax
inc eax
push eax
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x218]
push eax
push ebx
lea eax, [ebp - 0x21c]
push eax
mov ecx, edi
call dword [edx + 8]
test eax, eax
je 0x4ee036
lea ecx, [ebp - 0x220]
call fcn.0044a215
mov eax, dword [ebp - 0x224]
mov byte [ebp - 4], 2
cmp eax, 9
jne 0x4edf87
push dword [ebp - 0x21c]
lea eax, [ebp - 0x220]
push str.10__s
push eax
call fcn.004b7b6a
add esp, 0xc
jmp 0x4edfb9
jge 0x4edfa7
push dword [ebp - 0x21c]
inc eax
push eax
lea eax, [ebp - 0x220]
push str._d__s
push eax
call fcn.004b7b6a
add esp, 0x10
jmp 0x4edfb9
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x220]
call fcn.004f668a
push 0x15c
call fcn.0047d781
pop ecx
mov dword [ebp - 0x230], eax
mov byte [ebp - 4], 3
test eax, eax
je 0x4edfdd
mov ecx, eax
call fcn.0045d5de
mov esi, eax
jmp 0x4edfdf
xor esi, esi
push dword [ebp - 0x220]
mov eax, dword [esi]
mov ecx, esi
mov byte [ebp - 4], 2
call dword [eax + 0x10]
mov eax, dword [esi]
lea ecx, [ebx + 0xe110]
push ecx
mov ecx, esi
call dword [eax + 0xc]
push ebx
mov ecx, edi
call fcn.004826db
mov eax, dword [eax]
mov edx, dword [esi]
push eax
mov ecx, esi
call dword [edx + 0x24]
mov ecx, dword [ebp - 0x22c]
push esi
call fcn.0049c72c
mov ecx, dword [ebp - 0x220]
inc dword [ebp - 0x224]
add ecx, 0xfffffff0
call fcn.004daea8
mov esi, dword [ebp - 0x228]
mov ecx, dword [ebp - 0x21c]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.004daea8
inc ebx
cmp ebx, dword [edi + 4]
jl 0x4edf20
call fcn.005055ad
ret
Function at 0x4ffdaf
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [esi + 0x2c]
push edi
mov edi, dword [esi + 0x3c]
sub edi, dword [esi + 0x74]
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x2c]
sub edi, eax
lea ecx, [ebx + ecx - 0x106]
mov dword [ebp - 8], edi
cmp eax, ecx
jb 0x4ffe3e
mov eax, dword [esi + 0x38]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call fcn.005035f0
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x44]
sub dword [esi + 0x70], ebx
sub dword [esi + 0x6c], ebx
add esp, 0xc
sub dword [esi + 0x5c], ebx
mov dword [ebp - 4], eax
lea eax, [ecx + eax*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x4ffdfe
mov eax, dword [esi + 0x40]
mov dword [ebp - 4], ebx
lea eax, [eax + ebx*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x4ffe20
add edi, ebx
mov dword [ebp - 8], edi
mov edi, dword [esi]
cmp dword [edi + 4], 0
je 0x4ffefc
mov eax, dword [esi + 0x74]
add eax, dword [esi + 0x6c]
mov ecx, dword [edi + 4]
add eax, dword [esi + 0x38]
mov edx, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], ecx
cmp ecx, edx
jbe 0x4ffe66
mov dword [ebp - 4], edx
mov edx, dword [ebp - 4]
test edx, edx
jne 0x4ffe71
xor eax, eax
jmp 0x4ffebd
sub ecx, edx
mov dword [edi + 4], ecx
mov ecx, dword [edi + 0x1c]
mov ecx, dword [ecx + 0x18]
cmp ecx, 1
jne 0x4ffe8e
push edx
push dword [edi]
push dword [edi + 0x30]
call fcn.005006ff
jmp 0x4ffe9e
cmp ecx, 2
jne 0x4ffea7
push edx
push dword [edi]
push dword [edi + 0x30]
call fcn.00502031
mov dword [edi + 0x30], eax
mov eax, dword [ebp - 0xc]
add esp, 0xc
push dword [ebp - 4]
push dword [edi]
push eax
call fcn.005035f0
mov eax, dword [ebp - 4]
add dword [edi], eax
add esp, 0xc
add dword [edi + 8], eax
add dword [esi + 0x74], eax
mov edi, dword [esi + 0x74]
cmp edi, 3
jb 0x4ffee8
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x38]
lea edx, [eax + ecx]
movzx eax, byte [edx]
mov ecx, dword [esi + 0x58]
mov dword [esi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x54]
mov dword [esi + 0x48], eax
cmp edi, 0x106
jae 0x4ffefc
mov eax, dword [esi]
cmp dword [eax + 4], 0
jne 0x4ffdbc
pop edi
pop ebx
leave
ret
Function at 0x50255d
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x274
mov eax, dword [0x57bf70]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0x800
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x234], eax
mov esi, ecx
lea eax, [ebp - 0xc]
jne 0x5025f5
push 0x533b54
push 4
push eax
call fcn.005040e5
push eax
call fcn.00435e24
add esp, 0x10
push ebx
push edi
call fcn.0050564c
mov edi, dword [eax]
call fcn.0050564c
xor ebx, ebx
mov dword [eax], ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x234]
lea eax, [ebp - 0x230]
push esi
push 0x111
mov esi, 0x112
push esi
push eax
call fcn.005055e9
add esp, 0x18
mov dword [ebp - 0x234], eax
call fcn.0050564c
cmp dword [eax], ebx
je 0x50260c
call fcn.0050564c
push dword [eax]
call fcn.004a7ef0
pop ecx
jmp 0x502613
push 4
push eax
push 3
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x5025a0
jmp 0x50269a
call fcn.0050564c
mov dword [eax], edi
cmp dword [ebp - 0x234], 0xffffffff
je 0x502696
cmp dword [ebp - 0x234], esi
jae 0x502696
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push 0x3c
mov esi, eax
lea eax, [ebp - 0x270]
push ebx
push eax
mov dword [ebp - 0x274], 0x40
call fcn.00503570
add esp, 0xc
push 0x533778
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, ebx
je 0x502685
push str.FindActCtxSectionStringW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x502685
lea ecx, [ebp - 0x274]
push ecx
push esi
push 2
push ebx
push ebx
call eax
test eax, eax
je 0x502685
push ebx
push ebx
push esi
jmp 0x50268e
push ebx
push ebx
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x502698
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00473c5e
leave
ret
Function at 0x515898
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00509a78
and dword [ebp - 4], 0
cmp dword [0x583730], 0
mov ebx, eax
jne 0x515949
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x5159fa
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x5159fa
push eax
call fcn.00509a06
mov dword [esp], 0x5578e4
push edi
mov dword [0x583730], eax
call esi
push eax
call fcn.00509a06
mov dword [esp], 0x5578d0
push edi
mov dword [0x583734], eax
call esi
push eax
call fcn.00509a06
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x583738], eax
call esi
push eax
call fcn.00509a06
pop ecx
mov dword [0x583740], eax
test eax, eax
je 0x515949
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00509a06
pop ecx
mov dword [0x58373c], eax
mov eax, dword [0x58373c]
cmp eax, ebx
je 0x5159a1
cmp dword [0x583740], ebx
je 0x5159a1
push eax
call fcn.00509a81
push dword [0x583740]
mov esi, eax
call fcn.00509a81
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x5159a1
test edi, edi
je 0x5159a1
call esi
test eax, eax
je 0x515998
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x515998
test byte [ebp - 0xc], 1
jne 0x5159a1
or dword [ebp + 0x10], 0x200000
jmp 0x5159da
mov eax, dword [0x583734]
cmp eax, ebx
je 0x5159da
push eax
call fcn.00509a81
pop ecx
test eax, eax
je 0x5159da
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x5159da
mov eax, dword [0x583738]
cmp eax, ebx
je 0x5159da
push eax
call fcn.00509a81
pop ecx
test eax, eax
je 0x5159da
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x583730]
call fcn.00509a81
pop ecx
test eax, eax
je 0x5159fa
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x5159fc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40da3b
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x415438
call fcn.0040dfd1
push 1
call fcn.0040dabe
pop ecx
test al, al
jne 0x40d8e4
push 7
call fcn.0040e623
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.0040da89
mov byte [ebp - 0x24], al
mov eax, dword [0x4175dc]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x40d8dd
test eax, eax
jne 0x40d94e
mov dword [0x4175dc], ecx
push 0x4112c4
push 0x4112ac
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x40d931
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x40da35
push 0x4112a8
push 0x411274
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x4175dc], 2
jmp 0x40d953
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.0040dc1b
pop ecx
call fcn.0040e617
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x40d983
push esi
call fcn.0040db8e
pop ecx
test al, al
je 0x40d983
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.0040e852
call esi
call fcn.0040e61d
mov esi, eax
cmp dword [esi], edi
je 0x40d9a1
push esi
call fcn.0040db8e
pop ecx
test al, al
je 0x40d9a1
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
push edi
call sub.VCRUNTIME140.dll___telemetry_main_invoke_trigger
pop ecx
call fcn.0040e738
movzx eax, ax
push eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_wide_winmain_command_line
push eax
push edi
push 0x400000
call main
mov esi, eax
push edi
call sub.VCRUNTIME140.dll___telemetry_main_return_trigger
pop ecx
call fcn.0040e76b
test al, al
jne 0x40d9da
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
test bl, bl
jne 0x40d9e3
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push edi
push 1
call fcn.0040dc38
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x40da35
call fcn.0040e017
ret
call fcn.0040d74a
jmp 0x40d8c5
Function at 0x403492
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
xor eax, eax
push ebx
mov ebx, 0xbb40e64e
cmp dword [0x4014ac], eax
je 0x4034b4
cmp dword [0x4014ac], ebx
jne 0x40354d
push esi
push eax
push eax
push 1
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov esi, dword [ebp - 8]
xor esi, dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor esi, eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0x10]
xor eax, dword [ebp - 0x14]
xor esi, eax
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x4014ac
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [0x4014ac], esi
test esi, esi
jne 0x403523
mov dword [0x4014ac], ebx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
mov esi, 0x4014ac
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 4
push esi
call fcn.0059d000
mov eax, dword [0x4014ac]
not eax
mov dword [0x407248], eax
pop esi
pop ebx
leave
ret

Function at 0x403550
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4014ac]
jne 0x4039bf
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x4073f8], eax
mov dword [0x4073f4], ecx
mov dword [0x4073f0], edx
mov dword [0x4073ec], ebx
mov dword [0x4073e8], esi
mov dword [0x4073e4], edi
mov word [0x407410], ss
mov word [0x407404], cs
mov word [0x4073e0], ds
mov word [0x4073dc], es
mov word [0x4073d8], fs
mov word [0x4073d4], gs
pushfd
pop dword [0x407408]
mov eax, dword [ebp]
mov dword [0x4073fc], eax
mov eax, dword [ebp + 4]
mov dword [0x407400], eax
lea eax, [ebp + 8]
mov dword [0x40740c], eax
mov eax, dword [ebp - 0x320]
mov dword [0x407348], 0x10001
mov eax, dword [0x407400]
mov dword [0x4072fc], eax
mov dword [0x4072f0], 0xc0000409
mov dword [0x4072f4], 1
mov eax, dword [0x4014ac]
mov dword [ebp - 0x328], eax
mov eax, dword [0x407248]
mov dword [ebp - 0x324], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x407340], eax
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x4014b8
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x407340], 0
jne 0x403aab
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
leave
ret