joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6104e4
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x6104fb
add esp, 0xfffffff0
call fcn.00407ef4
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004c4790
mov eax, dword [0x67f044]
cmp byte [eax], 0
jne 0x610528
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x194], al
mov eax, dword [0x67f408]
cmp word [eax + 2], 0
jne 0x610542
mov eax, dword [0x67f408]
mov dword [eax + 4], ebx
mov dword [eax], fcn.006127b8
mov eax, dword [0x67f548]
cmp word [eax + 2], 0
jne 0x61055c
mov eax, dword [0x67f548]
mov dword [eax + 4], ebx
mov dword [eax], fcn.006129bc
mov byte [ebx + 0x41], 0
mov dl, 1
mov eax, dword [0x5133fc]
call fcn.0051954c
mov esi, eax
mov dword [ebx + 0x54], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x612f34
mov dl, 1
mov eax, dword [0x48c6a0]
call fcn.004078c0
mov dword [ebx + 0xa8], eax
mov dl, 1
mov eax, dword [0x48c6a0]
call fcn.004078c0
mov dword [ebx + 0xc8], eax
xor eax, eax
mov dword [ebx + 0x74], eax
xor eax, eax
mov dword [ebx + 0x98], eax
mov dword [ebx + 0x70], 0xff000018
mov dword [ebx + 0x8c], 0x1f4
mov byte [ebx + 0x90], 1
xor eax, eax
mov dword [ebx + 0x94], eax
mov dword [ebx + 0x88], 0x9c4
mov byte [ebx + 0x9c], 0
mov byte [ebx + 0xbd], 1
mov byte [ebx + 0xd4], 1
mov dl, 1
mov eax, dword [0x517e24]
call fcn.00522b5c
mov esi, eax
mov dword [ebx + 0xb8], esi
push 0x610744
mov eax, dword [0x67f28c]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.00522fec
mov eax, dword [ebx + 0xb8]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x61321c
mov dl, 1
mov eax, dword [0x48c6a0]
call fcn.004078c0
mov dword [ebx + 0xb0], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x67f28c]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW_1
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.00425024
test eax, eax
je 0x610676
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.00424e60
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.00425008
test eax, eax
je 0x61068e
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW_1
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0xa4]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.0040a1e0
push ebx
push 0x612194
call fcn.00605d78
mov dword [ebx + 0x190], eax
mov byte [ebx + 0xe8], 0
mov eax, dword [0x67f044]
cmp byte [eax], 0
jne 0x6106df
mov eax, ebx
call fcn.00610928
mov byte [ebx + 0x6d], 1
mov byte [ebx + 0x6e], 1
mov byte [ebx + 0x6f], 1
mov byte [ebx + 0xbe], 1
mov byte [ebx + 0xe9], 0
mov byte [ebx + 0xf4], 0
xor eax, eax
mov dword [ebx + 0xec], eax
mov byte [ebx + 0xeb], 0
xor eax, eax
mov dword [ebx + 0xc0], eax
mov eax, ebx
call fcn.00613454
mov eax, ebx
call fcn.006140c0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x61073c
call fcn.00407f4c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x610c6c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x188]
test eax, eax
je 0x610d0e
cmp dword [ebx + 0xac], 0
jne 0x610d08
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x610ba8
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0xa8]
cmp dword [eax + 8], 0
je 0x610d08
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x610cce
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0xa8]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x610d08
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0xa8]
call fcn.004aeff8
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x610cdd
inc dword [ebx + 0xac]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x610f4c
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov ebx, edx
mov esi, eax
mov eax, dword [0x6857c4]
cmp dword [eax + 0x188], 0
je 0x6110c6
test bl, bl
jne 0x611011
cmp dword [esi + 0xb4], 0
jne 0x611006
mov eax, esi
call fcn.00613f10
push eax
push 0x610e40
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x58], 0
je 0x610fd7
mov eax, dword [0x6857c4]
cmp byte [eax + 0xeb], 0
je 0x610fd7
mov eax, dword [esi + 0xf0]
mov dword [esp], eax
mov eax, dword [esp]
test eax, eax
je 0x610fb8
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x610fd7
push 0
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x610fc0
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x611006
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0xb0]
call fcn.004aeff8
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x610fe6
inc dword [esi + 0xb4]
jmp 0x6110c6
cmp dword [esi + 0xb4], 0
jle 0x6110c6
dec dword [esi + 0xb4]
cmp dword [esi + 0xb4], 0
jne 0x6110c6
cmp dword [esi + 0x58], 0
je 0x61107b
mov eax, dword [0x6857c4]
cmp byte [eax + 0xeb], 0
je 0x61107b
mov eax, dword [esi + 0xf0]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
test eax, eax
je 0x61105c
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x61107b
push 5
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x611064
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x6110aa
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0xb0]
call fcn.004aeff8
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x61108a
mov eax, dword [esi + 0xb0]
mov edx, dword [eax]
call dword [edx + 8]
lea eax, [esi + 0xf0]
mov edx, dword [0x602604]
call fcn.0040b6dc
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x611d20
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xc4], 0
je 0x611d7d
cmp byte [ebx + 0xeb], 0
jne 0x611d7d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x188]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004096f4
mov eax, dword [esi]
test eax, eax
je 0x611d6a
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x611d8a
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040994c
jmp 0x611d8a
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040994c
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x61363c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x98]
test esi, esi
je 0x6136ad
mov eax, esi
call fcn.0054aebc
test al, al
je 0x6136ad
mov eax, dword [ebx + 0x98]
call fcn.0054aaec
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x6136ad
mov eax, dword [ebx + 0x98]
mov edx, dword [eax]
call dword [edx + 0x114]
test al, al
je 0x61369e
push 0
mov eax, dword [ebx + 0x98]
call fcn.0054aaec
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x98]
call fcn.005417e4
jmp 0x6136ad
mov cl, 1
mov edx, dword [ebx + 0x88]
mov eax, ebx
call fcn.00613474
pop esi
pop ebx
ret
Function at 0x61a3d0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
cmp dword [ebx + 0x8c], 0
jne 0x61a44a
mov eax, dword [ebx + 8]
call fcn.0054aaec
mov ecx, eax
mov dl, 1
mov eax, dword [0x55cecc]
call fcn.00544eac
mov esi, eax
mov dword [ebx + 0x8c], esi
xor edx, edx
mov eax, esi
call fcn.0056968c
mov dword [esi + 0x2bc], ebx
mov dword [esi + 0x2b8], 0x619cc8
push 8
push 3
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
push 0
mov eax, dword [ebx + 0x8c]
call fcn.0054aaec
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x8c]
call fcn.0054aaec
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x9c], 0
jne 0x61a4c0
mov eax, dword [ebx + 8]
call fcn.0054aaec
mov ecx, eax
mov dl, 1
mov eax, dword [0x55cecc]
call fcn.00544eac
mov esi, eax
mov dword [ebx + 0x9c], esi
mov dl, 1
mov eax, esi
call fcn.0056968c
mov dword [esi + 0x2bc], ebx
mov dword [esi + 0x2b8], 0x619d14
push 8
push 0
push 2
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x9c]
call fcn.0054aaec
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x9c]
call fcn.0054aaec
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x94], 0
jne 0x61a52c
mov eax, dword [ebx + 8]
call fcn.0054aaec
mov ecx, eax
mov dl, 1
mov eax, dword [0x55d940]
call fcn.00544eac
mov esi, eax
mov dword [ebx + 0x94], esi
mov eax, esi
mov byte [eax + 0x290], 1
push 8
push 3
call sub.user32.dll_GetSystemMetrics
push eax
push 2
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x94]
call fcn.0054aaec
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x94]
call fcn.0054aaec
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x633c48
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00409650
xor eax, eax
push ebp
push 0x633def
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0040956c
xor ebx, ebx
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
call fcn.0040a13c
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x633ce4
xor eax, eax
push ebp
push 0x633cd8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.004067ec
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push esi
call sub.version.dll_GetFileVersionInfoW
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x633ce4
test bl, bl
je 0x633dcc
xor eax, eax
push ebp
push 0x633db7
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x633e00
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebx + 8]
shr eax, 0x10
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 8]
call fcn.004235dc
mov eax, dword [ebp - 8]
push dword [eax]
push 0x633e10
mov eax, dword [ebx + 8]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.004235dc
push dword [ebp - 0x20]
mov eax, dword [ebp - 8]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 8]
push dword [eax]
push 0x633e20
mov eax, dword [ebx + 0xc]
shr eax, 0x10
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x24]
call fcn.004235dc
push dword [ebp - 0x24]
mov eax, dword [ebp - 8]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 8]
push dword [eax]
push 0x633e30
mov eax, dword [ebx + 0xc]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x28]
call fcn.004235dc
push dword [ebp - 0x28]
mov eax, dword [ebp - 8]
mov edx, 3
call fcn.0040a418
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x633dc1
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.00406808
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x633df6
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.004095cc
lea eax, [ebp - 4]
call fcn.0040956c
ret
Function at 0x633eec
Capabilities:
Check os version
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
mov edx, dword [0x67f7d4]
cmp dword [edx], 2
je 0x633f08
mov byte [ebp - 1], 1
jmp 0x6340d6
mov byte [ebp - 1], 0
lea edx, [ebp - 8]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0x20
push 2
push 0x67e4ec
call sub.advapi32.dll_AllocateAndInitializeSid
test eax, eax
je 0x6340d6
xor eax, eax
push ebp
push 0x6340cf
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetVersion_1
and eax, 0xff
cmp ax, 5
jb 0x633f6a
push 0x6340e0
push 0x63410c
call sub.kernel32.dll_GetModuleHandleW_2
push eax
call fcn.00411f08
mov ebx, eax
test ebx, ebx
je 0x633f91
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
call ebx
test eax, eax
je 0x6340b8
cmp dword [ebp - 0xc], 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
jmp 0x6340b8
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
test eax, eax
jne 0x633fe2
call sub.kernel32.dll_GetLastError_2
cmp eax, 0x3f0
je 0x633fc3
call fcn.00408d5c
jmp 0x6340d6
lea eax, [ebp - 0x10]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x633fe2
call fcn.00408d5c
jmp 0x6340d6
xor eax, eax
push ebp
push 0x6340b1
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x634025
call sub.kernel32.dll_GetLastError_2
cmp eax, 0x7a
je 0x634025
call fcn.00408d5c
call fcn.00408d5c
jmp 0x6340d6
mov eax, dword [ebp - 0x14]
call fcn.004067ec
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x634057
call fcn.00408d5c
call fcn.00408d5c
jmp 0x6340d6
mov eax, dword [ebp - 0x18]
mov esi, dword [eax]
dec esi
test esi, esi
jl 0x634092
inc esi
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x63408e
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 8]
and eax, 0x14
cmp eax, 4
jne 0x63408e
mov byte [ebp - 1], 1
jmp 0x634092
inc ebx
dec esi
jne 0x634064
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6340b8
mov eax, dword [ebp - 0x18]
call fcn.00406808
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6340d6
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_FreeSid
ret
movzx eax, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x644c4c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00409650
xor eax, eax
push ebp
push 0x644cea
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.0040956c
mov eax, dword [ebp - 4]
test eax, eax
je 0x644c8f
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
test ebx, ebx
jle 0x644cbc
mov esi, 1
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
movzx edx, word [edx + esi*2 - 2]
xor dx, di
call fcn.0040a164
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
call fcn.0040a338
inc esi
dec ebx
jne 0x644c9a
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.0040994c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x644cf1
lea eax, [ebp - 0x10]
call fcn.0040956c
lea eax, [ebp - 8]
mov edx, 2
call fcn.004095cc
ret

Function at 0x646c2c
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.0040956c
push esp
push esi
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x646c66
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListW
mov edx, ebx
lea eax, [esp + 4]
call fcn.0042510c
add esp, 0x210
pop esi
pop ebx
ret
Function at 0x6519e4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00409650
mov eax, dword [ebp - 8]
call fcn.00409650
xor eax, eax
push ebp
push 0x651b1e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x3c
call fcn.0040720c
mov dword [ebp - 0x48], 0x3c
mov dword [ebp - 0x40], esi
test bl, bl
je 0x651a40
mov dword [ebp - 0x44], 0x540
jmp 0x651a47
mov dword [ebp - 0x44], 0x500
cmp byte [ebp + 8], 0
je 0x651a55
mov eax, 0x651b30
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 4]
call fcn.0040a13c
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 8]
call fcn.0040a13c
mov dword [ebp - 0x34], eax
movzx eax, word [ebp + 0x10]
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x48]
push eax
call sub.shell32.dll_ShellExecuteExW
test eax, eax
je 0x651af9
test bl, bl
je 0x651acc
push 0x64
call sub.kernel32.dll_Sleep_2
mov eax, dword [0x67f50c]
mov eax, dword [eax]
call fcn.00612374
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetExitCodeProcess
cmp dword [ebp - 0xc], 0x103
jne 0x651ac1
mov eax, dword [0x67f50c]
mov eax, dword [eax]
cmp byte [eax + 0xbc], 0
je 0x651a88
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x651ad9
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov bl, 1
mov eax, dword [ebp - 0xc]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x4c]
call fcn.004235dc
mov edx, dword [ebp - 0x4c]
mov eax, 0x68590c
call fcn.0040994c
jmp 0x651afb
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x651b25
lea eax, [ebp - 0x4c]
call fcn.0040956c
lea eax, [ebp - 8]
mov edx, 2
call fcn.004095cc
ret
Function at 0x652b7c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x652c67
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, ebx
call fcn.004241f0
test al, al
jne 0x652bfe
lea eax, [ebp - 4]
mov ecx, ebx
mov edx, 0x652c80
call fcn.0040a390
mov eax, dword [ebp - 4]
call fcn.00649ba0
cmp byte [0x6858e6], 0
jne 0x652bf5
push 0x10
push 0x652cbc
lea ecx, [ebp - 8]
mov edx, ebx
mov eax, 0x652cd4
call fcn.00649bf8
mov eax, dword [ebp - 8]
call fcn.0040a13c
push eax
mov eax, dword [0x67f50c]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
push eax
call sub.user32.dll_MessageBoxW
mov byte [0x6858ec], 1
jmp 0x652c4c
push 1
push 0
lea eax, [ebp - 0xc]
mov ecx, ebx
mov edx, 0x652d0c
call fcn.0040a390
mov eax, dword [ebp - 0xc]
call fcn.0040a13c
push eax
push 0x652d48
push 0x652d64
mov eax, dword [0x67f50c]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
push eax
call sub.shell32.dll_ShellExecuteW
cmp byte [0x6858e5], 0
je 0x652c4c
mov edx, ebx
mov eax, 0x652d7c
call fcn.0064b410
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x652c6e
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004095cc
ret
Function at 0x6696bc
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffffe8
push 0
push 2
call sub.user32.dll_ExitWindowsEx
test eax, eax
jne 0x669726
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x669726
lea eax, [esp + 0xc]
push eax
push 0x66972c
push 0
call sub.advapi32.dll_LookupPrivilegeValueW
mov dword [esp + 8], 1
mov dword [esp + 0x14], 2
lea eax, [esp + 4]
push eax
push 0
push 0
lea eax, [esp + 0x14]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
test eax, eax
je 0x669726
push 0
push 2
call sub.user32.dll_ExitWindowsEx
add esp, 0x18
ret
Function at 0x10011c00
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x10011c3e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x10011c36
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x10011c40
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x10011c26
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x10011d10
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x10011d26
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x10011d41
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret

Function at 0x1001c337
Capabilities:
Encode data using xor

Disassembly:
call 0x1001c2b0
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or eax, dword [ebx - 0x178f73c]
xor esi, 0xde5af04
add eax, esi
lea esp, [esp - 0xe]
mov esi, dword [esp + 0xe]
lea esp, [esp + 0x12]
xor esi, dword [esp]
push eax
sub eax, 0xf24f2b00
mov eax, esp
or dword [eax - 0x22], ebx
pop eax
jmp 0x1001c2e0
xor dword [esp], esi
xor eax, 0
mov dword [esp], esi
add esp, 4
add esi, dword [ebp + 8]
push ebp
add ebp, 0xc
mov ecx, dword [ebp]
pop ebp
ja 0x1001c2fc
xor edx, 0
jmp 0x1001c307
xor edx, edx
jmp 0x1001c31e
jmp 0x1001c32a
xor eax, eax
push 0x8427d7c0
call 0x1001c337
stc
add esp, 8
add esi, 0
cmp ecx, 0
je 0x1001c373
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
add bl, dl
xor byte [esi], bl
mov dl, byte [esi]
inc esi
add ebx, edi
rol ebx, 8
dec ecx
jne 0x1001c34c
lea esp, [esp - 4]
xchg dword [esp], ebx
mov ebx, dword [esp]
or eax, edx
xor eax, eax
add eax, dword [esp]
add esp, 4
pop esi
pop edi
pop ebx
xchg dword [esp], ecx
mov dword [esp], ecx
lea esp, [esp + 4]
pop edx
leave
je 0x1001c38a
add eax, 0
jno 0x1001c38f
add esi, 0
ret 0x10