joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46d9e3
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x487d01
call fcn.0046cde8
push ecx
push ebx
push esi
push edi
push dword [ebp + 0xc]
mov edi, dword [ebp + 8]
lea eax, [edi + 0xc]
mov esi, ecx
push eax
mov dword [ebp - 0x10], esi
call fcn.0046ffbc
xor ebx, ebx
lea ecx, [esi + 0x3c]
mov dword [ebp - 4], ebx
mov dword [esi], 0x407cbc
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], edi
call fcn.0043be96
mov al, byte [ebp + 0x10]
mov byte [esi + 0x4c], al
mov dword [esi + 0x48], ebx
mov eax, dword [edi + 8]
sub eax, 0x18
push eax
mov byte [ebp - 4], 1
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x48], eax
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc

Function at 0x46da5d
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x487d01
call fcn.0046cde8
push ecx
push ebx
push esi
push edi
push dword [ebp + 0xc]
mov edi, dword [ebp + 8]
lea eax, [edi + 0xc]
mov esi, ecx
push eax
mov dword [ebp - 0x10], esi
call fcn.0046ffbc
xor ebx, ebx
lea ecx, [esi + 0x3c]
mov dword [ebp - 4], ebx
mov dword [esi], 0x407cbc
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], edi
call fcn.0043be96
mov dword [esi + 0x48], ebx
mov byte [esi + 0x4c], 1
mov eax, dword [edi + 8]
sub eax, 0x18
push eax
mov byte [ebp - 4], 1
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x48], eax
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x4715c3
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x487ef5
call fcn.0046cde8
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
push edi
lea ecx, [esi + 0x44]
mov dword [esi], fcn.0046fc8d
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
call fcn.00470495
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x74], edi
mov dword [esi + 0x78], edi
mov dword [esi + 0x7c], edi
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x475d02
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x475d1c
push dword [esp + 0xc]
push dword [esp + 0xc]
push ecx
call eax
add esp, 0xc
ret
push 0x408428
push ecx
call fcn.00476c05
push esi
mov esi, dword [esp + 8]
push dword [esi + 0x54]
push dword [esp + 0x14]
push 1
push dword [esp + 0x18]
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
cmp eax, dword [esp + 0x10]
je 0x475d53
push 0x408444
push esi
call fcn.00476c05
pop esi
ret

Function at 0x476a86
Capabilities:
Read file on windows

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [ecx + 0x50]
test eax, eax
je 0x476aa0
push dword [esp + 0xc]
push dword [esp + 0xc]
push ecx
call eax
add esp, 0xc
ret
push 0x408620
push ecx
call fcn.00476c05
push esi
mov esi, dword [esp + 8]
push dword [esi + 0x54]
push dword [esp + 0x14]
push 1
push dword [esp + 0x18]
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, dword [esp + 0x10]
je 0x476ad7
push 0x40863c
push esi
call fcn.00476c05
pop esi
ret

Function at 0x476d66
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
je 0x476d8c
cmp dword [ebp + 0x10], 0
jbe 0x476d8c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0047495f
add esp, 0xc
pop ebp
jmp fcn.00475d02
pop ebp
ret

Function at 0x481e4f
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 8]
test edx, edx
jne 0x481e5e
xor eax, eax
jmp 0x481f2f
mov eax, dword [esp + 0xc]
cmp eax, 8
push ebx
push esi
mov esi, dword [esp + 0xc]
not esi
mov ecx, 0xff
jb 0x481f11
push edi
mov edi, eax
shr edi, 3
mov bl, byte [edx]
sub eax, 8
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x409a70]
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x409a70]
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x409a70]
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x409a70]
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x409a70]
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x409a70]
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x409a70]
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x409a70]
inc edx
dec edi
jne 0x481e7e
pop edi
test eax, eax
je 0x481f29
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x409a70]
inc edx
dec eax
jne 0x481f15
mov eax, esi
pop esi
not eax
pop ebx
ret 0xc
Function at 0x482427
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebx + 0x24]
push esi
mov dword [ebp - 8], edx
push edi
mov ecx, dword [ebx + 0x64]
mov eax, dword [ebx + 0x34]
mov esi, dword [ebx + 0x6c]
sub eax, ecx
sub eax, esi
mov dword [ebp - 4], eax
jne 0x482453
test ecx, ecx
jne 0x48245d
test esi, esi
jne 0x48245d
mov eax, edx
jmp 0x4824ce
cmp eax, 0xffffffff
jne 0x48245d
push 0xfffffffffffffffe
pop eax
jmp 0x4824ce
mov esi, dword [ebx + 0x24]
lea esi, [edx + esi - 0x106]
cmp ecx, esi
jb 0x4824ce
mov edi, dword [ebx + 0x30]
mov ecx, edx
mov eax, ecx
shr ecx, 2
lea esi, [edi + edx]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0x44]
mov eax, dword [ebx + 0x3c]
sub dword [ebx + 0x68], edx
sub dword [ebx + 0x64], edx
sub dword [ebx + 0x54], edx
lea eax, [eax + ecx*2]
dec eax
dec eax
movzx esi, word [eax]
mov edi, esi
sub edi, edx
cmp esi, edx
sbb esi, esi
not esi
and esi, edi
dec ecx
mov word [eax], si
jne 0x482493
mov eax, dword [ebx + 0x38]
mov esi, edx
lea eax, [eax + edx*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edi, ecx
sub edi, edx
cmp ecx, edx
sbb ecx, ecx
not ecx
and ecx, edi
dec esi
mov word [eax], cx
jne 0x4824b2
mov eax, dword [ebp - 4]
add eax, edx
mov esi, dword [ebx]
cmp dword [esi + 4], 0
mov dword [ebp - 0xc], esi
je 0x48257b
mov edi, dword [ebx + 0x6c]
add edi, dword [ebx + 0x64]
mov ecx, dword [esi + 4]
add edi, dword [ebx + 0x30]
cmp ecx, eax
mov dword [ebp - 4], ecx
jbe 0x4824f3
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4824fd
xor ecx, ecx
jmp 0x48253c
sub ecx, dword [ebp - 4]
mov eax, dword [esi + 0x1c]
mov dword [esi + 4], ecx
cmp dword [eax + 0x18], 0
jne 0x48251f
push dword [ebp - 4]
push dword [esi]
push dword [esi + 0x30]
call fcn.00473889
mov edx, dword [ebp - 8]
mov dword [esi + 0x30], eax
mov ecx, dword [ebp - 4]
mov esi, dword [esi]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, eax
mov eax, dword [ebp - 0xc]
add dword [eax], ecx
add dword [eax + 8], ecx
add dword [ebx + 0x6c], ecx
mov edi, dword [ebx + 0x6c]
cmp edi, 3
jb 0x482567
mov eax, dword [ebx + 0x64]
mov ecx, dword [ebx + 0x30]
lea esi, [eax + ecx]
movzx eax, byte [esi]
mov ecx, dword [ebx + 0x50]
mov dword [ebx + 0x40], eax
shl eax, cl
movzx ecx, byte [esi + 1]
xor eax, ecx
and eax, dword [ebx + 0x4c]
mov dword [ebx + 0x40], eax
cmp edi, 0x106
jae 0x48257b
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x482435
pop edi
pop esi
leave
ret
Function at 0x401080
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x13c
mov eax, dword [0x404008]
xor eax, esp
mov dword [esp + 0x138], eax
push esi
lea eax, [esp + 8]
mov dword [esp + 4], 0
push eax
push 1
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionOpenWith
xorps xmm0, xmm0
mov dword [esp + 0x18], 0
push reloc.OLEAUT32.dll_SysReAllocString
movaps xmmword [esp + 0x34], xmm0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401191
mov esi, dword [esp + 8]
test esi, esi
je 0x401191
push pe_nt_image_headers32
push eax
lea eax, [esp + 0x40]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0x1c], pe_nt_image_headers32
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 0x403224
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 8]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x401191
lea ecx, [esp + 0x38]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401130
sub ecx, edx
sar ecx, 1
cmp ecx, 0x26
jne 0x401191
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
test eax, eax
js 0x401191
lea eax, [esp + 4]
mov dword [esp + 0xc], 0x6a283fe2
push eax
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 0x4599ecfa
push eax
push 4
push 0
lea eax, [esp + 0x30]
mov dword [esp + 0x24], 0x9e8c491
push eax
mov dword [esp + 0x2c], 0x267b1357
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov ecx, dword [esp + 0x13c]
mov eax, dword [esp + 4]
pop esi
xor ecx, esp
call fcn.004012f0
mov esp, ebp
pop ebp
ret

Function at 0x4011b0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push 2
push 0
mov dword [ebp - 4], eax
call dword [sym.imp.ole32.dll_CoInitializeEx]
call fcn.00401080
mov ebx, eax
push 0
push ebx
call dword [sym.imp.ole32.dll_CoAllowSetForegroundWindow]
push str..pdf
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
test esi, esi
je 0x401232
mov edi, dword [ebx]
push 4
push esi
push dword [ebp - 4]
mov edi, dword [edi + 0xc]
mov ecx, edi
push ebx
call dword [0x403110]
call edi
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebx]
push ebx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x403110]
call esi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x8007000e
call fcn.00401030
int3

Function at 0x426450
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, 0x401000
call 0x426450
lcall 0x5de5, 0x8b10c483
jmp loc.008223dc
Function at 0x401070
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
mov edx, ebx
push esi
lea ecx, [edx + 1]
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x401080
sub edx, ecx
mov esi, ebx
lea ecx, [edx + ebx]
mov dword [ebp - 8], ecx
cmp ebx, ecx
ja 0x401186
push edi
nop word [eax + eax]
mov al, byte [esi]
cmp al, 0x7c
je 0x4010ae
test al, al
jne 0x40117c
mov edi, esi
sub edi, ebx
test edi, edi
jle 0x401179
lea eax, [edi + 1]
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [ebp - 0xc], eax
test eax, eax
je 0x4011ad
push edi
push ebx
push eax
call sub.VCRUNTIME140.dll_memcpy
mov edi, dword [ebp - 0xc]
lea eax, [ebp - 4]
mov ecx, edi
sub ecx, ebx
push 0xa
push eax
push edi
mov byte [ecx + esi], 0
mov dword [ebp - 4], 0
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtol]
mov ecx, dword [ebp - 4]
add esp, 0x18
mov ebx, eax
test ecx, ecx
je 0x401141
cmp byte [ecx], 0
je 0x401141
mov eax, dword [0x4063bc]
lea eax, [eax*4 + 4]
push eax
push dword [0x4063b0]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
add esp, 8
test eax, eax
je 0x40118c
mov ecx, dword [0x4063bc]
mov dword [0x4063b0], eax
mov dword [eax + ecx*4], edi
inc ecx
mov dword [0x4063bc], ecx
jmp 0x401176
mov eax, dword [0x4063a0]
lea eax, [eax*4 + 4]
push eax
push dword [0x4063d4]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
add esp, 8
test eax, eax
je 0x40118c
mov ecx, dword [0x4063a0]
mov dword [0x4063d4], eax
mov dword [eax + ecx*4], ebx
inc ecx
mov dword [0x4063a0], ecx
mov ecx, dword [ebp - 8]
lea ebx, [esi + 1]
inc esi
cmp esi, ecx
jbe 0x4010a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.ERROR:_realloc___failed_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.00401010
add esp, 8
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
push str.ERROR:_malloc___failed_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.00401010
add esp, 8
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x402445
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
nop
nop
nop
nop
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jne 0x4024d8
push reloc.WS2_32.dll_connect
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x402486
mov eax, 0x4732d5
push eax
push 1
mov ebx, 0x25c
call fcn.0044f3c0
add esp, 0x10
mov dword [ebp - 4], eax
push 0x80000301
push 0
push 0x20
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc4
call fcn.0044f3d0
add esp, 0x1c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
mov eax, 0
setne al
jmp 0x4024e2
mov eax, 0
jmp 0x4024e2
mov esp, ebp
pop ebp
ret 4

Function at 0x40251a
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
push reloc.WS2_32.dll_getsockname
push 0
push dword [ebp + 8]
push 1
mov ebx, 0x9dc
call fcn.0044f3f0
add esp, 0x10
mov dword [ebp - 8], eax
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp - 8]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
nop
nop
nop
nop
mov dword [ebp - 4], eax
cmp dword [ebp + 0x18], 0
jne 0x402596
cmp dword [ebp - 4], 0
je 0x402591
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
jmp 0x40259e
mov eax, dword [ebp - 4]
mov ebx, dword [ebp + 0x14]
mov dword [ebx], eax
cmp dword [ebp - 4], 0
mov eax, 0
setne al
jmp 0x4025af
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4025b5
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 4
push 0x80000301
push 0
push 3
push reloc.WS2_32.dll_connect
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x4025f2
mov eax, 0x4732d5
push eax
push 3
mov ebx, 0x270
call fcn.0044f4d0
add esp, 0x28
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x402735
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x278
call fcn.0044f5b0
add esp, 0x10
push reloc.WS2_32.dll_connect
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x402643
mov eax, 0x4732d5
push eax
push 1
mov ebx, 0x244
call fcn.0044f1c0
add esp, 0x10
call fcn.00401762
mov dword [ebp - 8], eax
push reloc.WS2_32.dll_connect
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x402673
mov eax, 0x4732d5
push eax
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x402687
mov eax, 0x4732d5
push eax
push 2
mov ebx, 0x23c
call fcn.0044f1d0
add esp, 0x1c
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4026aa
push ebx
call fcn.0044a4de
add esp, 4
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.0044ecb0
add esp, 0x10
mov dword [ebp - 8], eax
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.0044ecb0
add esp, 0x10
mov dword [ebp - 0xc], eax
push 5
push dword [ebp - 0xc]
push dword [ebp - 8]
mov ebx, dword [ebp + 8]
push dword [ebx]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
nop
nop
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x402720
push ebx
call fcn.0044a4de
add esp, 4
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x402730
push ebx
call fcn.0044a4de
add esp, 4
jmp 0x402825
push dword [ebp + 8]
call fcn.00402445
and eax, 1
xor eax, 1
test eax, eax
je 0x40279f
call fcn.00401762
mov dword [ebp - 8], eax
push reloc.WS2_32.dll_connect
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x402768
mov eax, 0x4732d5
push eax
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x40277c
mov eax, 0x4732d5
push eax
push 2
mov ebx, 0x23c
call fcn.0044f1d0
add esp, 0x1c
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x40279f
push ebx
call fcn.0044a4de
add esp, 4
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.0044ecb0
add esp, 0x10
mov dword [ebp - 8], eax
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.0044ecb0
add esp, 0x10
mov dword [ebp - 0xc], eax
push 5
push dword [ebp - 0xc]
push dword [ebp - 8]
mov ebx, dword [ebp + 8]
push dword [ebx]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
nop
nop
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x402815
push ebx
call fcn.0044a4de
add esp, 4
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x402825
push ebx
call fcn.0044a4de
add esp, 4
push 0x786d1d
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x90]
mov esp, ebp
pop ebp
ret 4
Function at 0x406d9e
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
push 8
call fcn.0044a4d8
add esp, 4
mov dword [ebp - 8], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0x10
call fcn.0044a4d8
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x10], 0
push 0x10
call fcn.0044a4d8
add esp, 4
mov dword [ebp - 0x14], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
nop
nop
nop
nop
mov dword [ebp - 0x18], eax
push 0x80000301
push 0
push 8
push 0x80000301
push 0
push 0x20
push 2
mov ebx, 0xc8
call fcn.0044ec50
add esp, 0x1c
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
nop
nop
nop
nop
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.0044ecb0
add esp, 0x10
mov dword [ebp - 0x18], eax
push dword [ebp - 8]
push str.SeDebugPrivilege
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
nop
nop
nop
nop
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x406ec2
push ebx
call fcn.0044a4de
add esp, 4
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 1
mov ebx, dword [ebp - 0xc]
add ebx, 4
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 8]
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0xc]
add ebx, 8
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 8]
add ebx, 4
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0xc]
add ebx, 0xc
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 2
mov eax, 0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x14]
push 0x1c
push dword [ebp - 0xc]
push 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
nop
nop
nop
nop
mov dword [ebp - 0x10], eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
mov eax, dword [ebp - 0x10]
jmp 0x406f59
push eax
mov ebx, dword [ebp - 8]
push ebx
call fcn.0044a4de
add esp, 4
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.0044a4de
add esp, 4
mov ebx, dword [ebp - 0x14]
push ebx
call fcn.0044a4de
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x40c855
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0
push 0
mov ebx, dword [ebp + 0xc]
push dword [ebx]
mov ebx, dword [ebp + 8]
push dword [ebx]
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
nop
nop
nop
nop
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
mov eax, 0
sete al
jmp 0x40c895
mov esp, ebp
pop ebp
ret 8
Function at 0x40ffe4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
push dword [ebp + 8]
push dword [0x786d39]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
nop
nop
nop
nop
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x410033
mov eax, 0x47338d
jmp 0x4100f2
push dword [ebp + 8]
push dword [0x786d39]
call dword [sym.imp.KERNEL32.dll_LoadResource]
nop
nop
nop
nop
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x41005d
mov eax, 0x47338d
jmp 0x4100f2
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LockResource]
nop
nop
nop
nop
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x410081
mov eax, 0x47338d
jmp 0x4100f2
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x1bc
call fcn.0044f5e0
add esp, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x4100b4
push ebx
call fcn.0044a4de
add esp, 4
pop eax
mov dword [ebp - 0x10], eax
push dword [ebp - 4]
push dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4100c8
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_RtlMoveMemory]
nop
nop
nop
nop
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4100ed
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.0044a4d8
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x4100f2
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x410103
push ebx
call fcn.0044a4de
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x4134c3
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ebx, dword [0x786d21]
mov dword [ebp - 4], ebx
push 0x4732d5
mov ebx, dword [ebp - 4]
push dword [ebx]
call fcn.00401c03
add esp, 8
cmp eax, 0
je 0x41357f
mov ebx, dword [0x786d21]
mov dword [ebp - 4], ebx
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.0044ecb0
add esp, 0x10
mov dword [ebp - 8], eax
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.0044ecb0
add esp, 0x10
mov dword [ebp - 0xc], eax
push 1
push dword [ebp - 0xc]
push dword [ebp - 8]
mov ebx, dword [ebp - 4]
push dword [ebx]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
nop
nop
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x41356f
push ebx
call fcn.0044a4de
add esp, 4
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x41357f
push ebx
call fcn.0044a4de
add esp, 4
mov esp, ebp
pop ebp
ret