joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405616
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
call fcn.0052dc74
movzx ebx, word [esp + 0x14]
mov esi, dword [eax + 0xc]
mov ebp, dword [sym.imp.KERNEL32.dll_FindResourceA]
push 2
push ebx
push esi
call ebp
mov edi, eax
test edi, edi
jne 0x405647
xor esi, esi
push 2
push ebx
push esi
call ebp
mov edi, eax
test edi, edi
je 0x40566b
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40566b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x40566b
push eax
call fcn.004055e3
cmp ax, 0x10
pop ecx
je 0x40566f
xor eax, eax
jmp 0x405678
push 0
push edi
push esi
call fcn.0051f455
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x405774
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
push esi
xor esi, esi
cmp dword [0x5a4c38], esi
je 0x405792
mov eax, dword [0x5a4c34]
jmp 0x405845
push ebx
push 1
pop ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push esi
push str.SoftwareMicrosoftPlus_ThemesCurrent
push reloc.WSOCK32.dll_accept
mov dword [0x5a4c38], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40583f
lea eax, [ebp - 0xc]
push edi
push eax
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 8]
push eax
push esi
push esi
mov dword [ebp - 0xc], 0x104
push dword [ebp - 4]
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x405835
push 5
mov esi, str.Windows_Classic.theme
pop ecx
lea edi, [ebp - 0x24]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp - 0x134]
push eax
call esi
mov edi, eax
lea eax, [ebp - 0x24]
push eax
call esi
cmp edi, eax
jl 0x405835
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x24]
push eax
call esi
sub edi, eax
lea eax, [ebp + edi - 0x134]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x405835
mov dword [0x5a4c34], ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, dword [0x5a4c34]
pop ebx
pop esi
leave
ret

Function at 0x405f83
Capabilities:
Encrypt data using blowfish

Disassembly:
push esi
mov esi, ecx
push edi
mov ecx, 0x54db40
push 0x12
mov eax, esi
sub ecx, esi
pop edx
mov edi, dword [ecx + eax]
mov dword [eax], edi
add eax, 4
dec edx
jne 0x405f93
mov eax, 0x54db88
lea ecx, [esi + 0x48]
mov edx, 0x100
mov edi, dword [eax]
add eax, 4
mov dword [ecx], edi
add ecx, 4
dec edx
jne 0x405fab
cmp eax, 0x54eb88
jl 0x405fa6
push dword [esp + 0x10]
mov ecx, esi
push dword [esp + 0x10]
call fcn.00405fd5
mov eax, esi
pop edi
pop esi
ret 8
Function at 0x405fd5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
movsx ebx, word [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 8], ecx
xor edx, edx
mov dword [ebp + 0xc], ecx
mov dword [ebp - 4], 0x12
movsx esi, dx
xor ecx, ecx
lea eax, [esi + 1]
cdq
idiv ebx
lea eax, [esi + 2]
mov cl, byte [edx + edi]
cdq
idiv ebx
mov ch, byte [esi + edi]
shl ecx, 8
movzx eax, byte [edx + edi]
or ecx, eax
lea eax, [esi + 3]
cdq
idiv ebx
shl ecx, 8
movzx eax, byte [edx + edi]
or ecx, eax
mov eax, ecx
mov ecx, dword [ebp + 0xc]
xor dword [ecx], eax
lea eax, [esi + 4]
cdq
idiv ebx
add ecx, 4
dec dword [ebp - 4]
mov dword [ebp + 0xc], ecx
jne 0x405ff3
mov edi, dword [ebp - 8]
and dword [ebp + 0xc], 0
and dword [ebp + 8], 0
push 9
mov esi, edi
pop ebx
lea eax, [ebp + 8]
mov ecx, edi
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.004060e7
mov eax, dword [ebp + 0xc]
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov dword [esi + 4], eax
add esi, 8
dec ebx
jne 0x40604a
lea esi, [edi + 0x4c]
mov dword [ebp - 4], 4
mov ebx, 0x80
lea eax, [ebp + 8]
mov ecx, edi
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.004060e7
mov eax, dword [ebp + 0xc]
mov dword [esi - 4], eax
mov eax, dword [ebp + 8]
mov dword [esi], eax
add esi, 8
dec ebx
jne 0x406079
dec dword [ebp - 4]
jne 0x406074
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x40a992
Capabilities:
Get geographical location

Disassembly:
mov eax, 0x5367dc
call fcn.004f8378
sub esp, 0x1c
push esi
mov esi, ecx
xor eax, eax
cmp dword [esi + 0x44], eax
jne 0x40aaf3
mov ecx, dword [0x59fe84]
push ebx
push edi
mov dword [ebp - 0x10], ecx
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push eax
push eax
push 0x146
push dword [esi + 0x1c]
mov dword [ebp - 4], eax
call ebx
and byte [ebp - 0x28], 0
mov dword [ebp - 0x1c], eax
xor eax, eax
lea edi, [ebp - 0x27]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp - 0x28]
push 0xa
push eax
push 0xc
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x14]
push eax
call fcn.0051379e
mov eax, dword [ebp - 0x14]
xor edi, edi
mov byte [ebp - 4], 1
cmp dword [eax - 8], edi
jne 0x40aa13
push 0x2c
lea ecx, [ebp - 0x14]
call fcn.0050ed5d
lea ecx, [ebp - 0x14]
call fcn.0050f77a
mov ecx, esi
call fcn.0040b351
test eax, eax
je 0x40aa52
push edi
push edi
push 0x147
push dword [esi + 0x1c]
call ebx
cmp eax, edi
jl 0x40aa44
lea ecx, [ebp - 0x10]
push ecx
push eax
mov ecx, esi
call fcn.0040b062
jmp 0x40aabb
lea eax, [esi + 0x40]
lea ecx, [ebp - 0x10]
push eax
call fcn.00513869
jmp 0x40aabb
xor ebx, ebx
cmp dword [ebp - 0x1c], edi
jle 0x40aabb
push ebx
mov ecx, esi
call fcn.0040ab30
test eax, eax
je 0x40aab5
mov eax, dword [0x59fe84]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
mov ecx, esi
push eax
push ebx
mov byte [ebp - 4], 2
call fcn.00527f5b
lea eax, [ebp - 0x18]
mov ecx, esi
push eax
push ebx
call fcn.0040b062
mov eax, dword [ebp - 0x10]
cmp dword [eax - 8], edi
je 0x40aa9d
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x10]
push eax
call fcn.00513b48
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x10]
push eax
call fcn.00513b48
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.00513730
inc ebx
cmp ebx, dword [ebp - 0x1c]
jl 0x40aa59
push dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
call fcn.0050f6e5
lea eax, [ebp - 0x10]
lea ecx, [esi + 0x40]
push eax
call fcn.00513869
and byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
mov dword [esi + 0x44], 1
call fcn.00513730
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00513730
pop edi
pop ebx
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x414aaa
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
push esi
push edi
push 0xc
push 0x5502c0
call fcn.00414c02
pop ecx
mov esi, eax
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push esi
mov edi, eax
call fcn.0051349a
xor ebp, ebp
pop ecx
cmp edi, ebp
je 0x414bbf
push ebx
push 0x18
push 0x5502cc
call fcn.00414c02
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
pop ecx
pop ecx
mov ebx, eax
push ebx
push edi
call esi
push ebx
mov dword [0x5a4d8c], eax
call fcn.0051349a
push 0xe
push 0x5502e4
call fcn.00414c02
add esp, 0xc
mov ebx, eax
push ebx
push edi
call esi
push ebx
mov dword [0x5a4d90], eax
call fcn.0051349a
push 0xd
push 0x5502f4
call fcn.00414c02
add esp, 0xc
mov ebx, eax
push ebx
push edi
call esi
push ebx
mov dword [0x5a4d94], eax
call fcn.0051349a
push 0xd
push 0x550304
call fcn.00414c02
add esp, 0xc
mov ebx, eax
push ebx
push edi
call esi
push ebx
mov dword [0x5a4d98], eax
call fcn.0051349a
push 0xc
push 0x550314
call fcn.00414c02
add esp, 0xc
mov ebx, eax
push ebx
push edi
call esi
push ebx
mov dword [0x5a4d9c], eax
call fcn.0051349a
push 0xd
push 0x550320
call fcn.00414c02
add esp, 0xc
mov ebx, eax
push ebx
push edi
call esi
push ebx
mov dword [0x5a4da0], eax
call fcn.0051349a
push 0xc
push 0x550330
call fcn.00414c02
add esp, 0xc
mov ebx, eax
push ebx
push edi
call esi
push ebx
mov dword [0x5a4da4], eax
call fcn.0051349a
pop ecx
pop ebx
cmp dword [0x5a4d8c], ebp
je 0x414bfc
cmp dword [0x5a4d90], ebp
je 0x414bfc
cmp dword [0x5a4d94], ebp
je 0x414bfc
cmp dword [0x5a4d98], ebp
je 0x414bfc
cmp dword [0x5a4d9c], ebp
je 0x414bfc
cmp dword [0x5a4da0], ebp
je 0x414bfc
cmp dword [0x5a4da4], ebp
je 0x414bfc
push 1
pop eax
jmp 0x414bfe
xor eax, eax
pop edi
pop esi
pop ebp
ret
Function at 0x41ed4c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
mov ebx, ecx
push esi
push str.ntdll.dll
and dword [ebx], 0
and dword [ebx + 4], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [ebx], eax
je 0x41edb3
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.ZwOpenSection
push eax
call esi
test eax, eax
mov dword [ebx + 0x14], eax
je 0x41edb3
push str.ZwMapViewOfSection
push dword [ebx]
call esi
test eax, eax
mov dword [ebx + 0x18], eax
je 0x41edb3
push str.ZwUnmapViewOfSection
push dword [ebx]
call esi
test eax, eax
mov dword [ebx + 0x1c], eax
je 0x41edb3
push str.RtlInitUnicodeString
push dword [ebx]
call esi
test eax, eax
mov dword [ebx + 0x20], eax
jne 0x41edb7
xor eax, eax
jmp 0x41ee0e
lea eax, [ebx + 0x24]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, str.DevicePhysicalMemory
lea edi, [ebp - 0x50]
push 0xb
lea eax, [ebp - 0x50]
pop ecx
rep movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 8]
push eax
movsw word es:[edi], word [esi]
call dword [ebx + 0x20]
xor eax, eax
lea ecx, [ebp - 8]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x18
push eax
lea eax, [ebx + 4]
push 4
push eax
mov dword [ebp - 0x18], ecx
call dword [ebx + 0x14]
xor ecx, ecx
test eax, eax
setge cl
mov eax, ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41ef39
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, ecx
lea eax, [edi + 0x12]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [edi + 4], 0x100000
jae 0x41ef9b
sgdt [ebp - 8]
sldt word [ebp - 2]
movzx eax, word [ebp - 2]
add eax, dword [ebp - 6]
push 7
pop ebx
movzx esi, byte [eax + 7]
movzx ecx, byte [eax + 4]
movzx eax, word [eax + 2]
shl esi, 8
add esi, ecx
shl esi, 0x10
add esi, eax
xor eax, eax
mov word [edi + 0xc], ax
mov dword [edi + 0xe], eax
add esi, 0x38
add esi, 8
inc ebx
test byte [esi + 5], 0x80
je 0x41efa2
cmp bx, 0x7ff
jbe 0x41ef8a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
push 8
push eax
push esi
call fcn.004f8540
mov ax, word [edi + 4]
or word [esi], 0xffff
mov word [esi + 2], ax
mov eax, dword [edi + 4]
shr eax, 0x10
mov byte [esi + 4], al
mov eax, dword [edi + 4]
shr eax, 0x18
add esp, 0xc
or byte [esi + 6], 0x1f
mov byte [esi + 7], al
lea eax, [ebx*8 + 7]
mov byte [esi + 5], 0xf2
push 1
mov word [edi + 0xc], ax
mov dword [edi + 0xe], esi
pop eax
jmp 0x41ef9d
Function at 0x4215a2
Capabilities:
Enumerate processes
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
mov eax, dword [ebp + 8]
mov eax, dword [eax]
test eax, eax
je 0x4215cd
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp + 0xc]
jne 0x4215c4
mov ecx, dword [ebp + 0x10]
cmp dword [eax + 0xc], ecx
je 0x4215c9
mov eax, dword [eax + 0x10]
jmp 0x4215b0
xor eax, eax
leave
ret
and dword [ebp - 4], 0
push edi
push 0
push 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
mov dword [ebp - 8], edi
je 0x421695
push ebx
push esi
push 0x1c
lea eax, [ebp - 0x24]
pop esi
push eax
push edi
mov dword [ebp - 0x24], esi
call sub.KERNEL32.dll_Thread32First
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x42168e
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp + 0xc]
je 0x421624
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], esi
push eax
push edi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x421609
jmp 0x42168e
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x42168e
lea eax, [ebp - 0x14c]
mov esi, 0x128
push eax
push edi
mov dword [ebp - 0x14c], esi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x42168b
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x144]
je 0x421670
lea eax, [ebp - 0x14c]
mov dword [ebp - 0x14c], esi
push eax
push edi
call sub.KERNEL32.dll_Process32Next
jmp 0x42164c
push dword [ebp + 0x10]
lea eax, [ebp - 0x128]
push dword [ebp + 0xc]
push eax
push dword [ebp + 8]
call fcn.00421339
add esp, 0x10
mov dword [ebp - 4], eax
push edi
call ebx
push dword [ebp - 8]
call ebx
pop esi
pop ebx
mov eax, dword [ebp - 4]
pop edi
leave
ret

Function at 0x423031
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
lea eax, [ebp + 0xc]
push esi
push eax
push 1
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x42308a
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x104
push eax
lea eax, [ebp - 0x104]
push eax
push esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret
Function at 0x4231a6
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
push esi
push edi
xor ebx, ebx
push dword [ebp + 0xc]
push ebx
push ebx
push dword [ebp + 8]
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
mov dword [ebp - 4], eax
ja 0x423290
lea eax, [ebp - 0x20c]
mov edi, SysReAllocStringLen
push eax
push str..htm
push edi
call fcn.00423031
add esp, 0xc
test eax, eax
jne 0x423290
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x20c]
push str._shellopencommand
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.00423031
add esp, 0xc
test eax, eax
jne 0x423290
lea eax, [ebp - 0x20c]
push str.__1_
push eax
call fcn.004fa868
mov edi, eax
pop ecx
cmp edi, ebx
pop ecx
jne 0x42326d
lea eax, [ebp - 0x20c]
push 0x591fa8
push eax
call fcn.004f9040
mov edi, eax
pop ecx
cmp edi, ebx
pop ecx
jne 0x42326d
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edi, [ebp + eax - 0x20d]
jmp 0x42326f
mov byte [edi], bl
push 0x590724
push edi
call esi
push dword [ebp + 8]
push edi
call esi
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42e378
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 8]
cmp dword [ebp + 8], 0x10
push esi
mov esi, ecx
mov dword [esi + 0x3c], eax
jb 0x42e3a8
cmp dword [ebp + 8], 0x12
ja 0x42e3a8
push 0x5a4c3c
push dword [ebp + 0x10]
call fcn.004f95e0
pop ecx
pop ecx
jmp 0x42e4ac
push edi
lea eax, [ebp - 0x20]
push 0x20
push eax
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
mov edi, 0x5a4c3c
push edi
push dword [ebp + 0x10]
call fcn.004f95e0
test byte [ebp + 0xf], 0x20
pop ecx
pop ecx
je 0x42e401
lea eax, [ebp - 0x20]
push 0x592384
push eax
call fcn.004fa868
pop ecx
test eax, eax
pop ecx
je 0x42e3ee
lea eax, [ebp - 0x20]
push edi
push eax
call fcn.004f95e0
pop ecx
pop ecx
push str._Alt
push dword [ebp + 0x10]
call fcn.004f95f0
or byte [esi + 0x3d], 1
pop ecx
pop ecx
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call ebx
test ax, ax
jge 0x42e444
lea eax, [ebp - 0x20]
push str.Shift
push eax
call fcn.004fa868
pop ecx
test eax, eax
pop ecx
je 0x42e431
lea eax, [ebp - 0x20]
push edi
push eax
call fcn.004f95e0
pop ecx
pop ecx
push str._Shift
push dword [ebp + 0x10]
call fcn.004f95f0
or byte [esi + 0x3d], 4
pop ecx
pop ecx
push 0x11
call ebx
test ax, ax
pop ebx
jge 0x42e481
lea eax, [ebp - 0x20]
push str.Ctrl
push eax
call fcn.004fa868
pop ecx
test eax, eax
pop ecx
je 0x42e46e
lea eax, [ebp - 0x20]
push edi
push eax
call fcn.004f95e0
pop ecx
pop ecx
push str._Ctrl
push dword [ebp + 0x10]
call fcn.004f95f0
or byte [esi + 0x3d], 2
pop ecx
pop ecx
lea eax, [ebp - 0x20]
push eax
call fcn.004f8bc0
pop ecx
pop edi
test eax, eax
jbe 0x42e4ac
push 0x592354
push dword [ebp + 0x10]
call fcn.004f95f0
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0x10]
call fcn.004f95f0
add esp, 0x10
mov eax, dword [ebp + 0x10]
pop esi
leave
ret 0xc

Function at 0x42f124
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 0xc]
push esi
push edi
push str.BIN_DATA
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x42f180
push esi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x42f180
push esi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp dword [ebp + 8], 0
mov esi, eax
je 0x42f17c
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x42f180
push esi
push eax
push dword [ebp + 8]
call fcn.004f87d0
add esp, 0xc
mov eax, esi
jmp 0x42f183
or eax, 0xffffffff
pop edi
pop esi
pop ebp
ret
Function at 0x42f65c
Capabilities:
Get common file path

Disassembly:
mov eax, 0x53a380
call fcn.004f8378
sub esp, 0x224
mov eax, dword [0x59fe84]
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], eax
and dword [ebp - 4], 0
lea eax, [ebp - 0x118]
push 0xff
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x118]
lea ecx, [ebp - 0x14]
push eax
call fcn.005138b9
lea eax, [ebp - 0x18]
push 1
push eax
lea ecx, [ebp - 0x14]
call fcn.0050f1ed
mov eax, dword [eax]
mov esi, 0x591374
push esi
push eax
call fcn.004f8b05
pop ecx
pop ecx
test eax, eax
lea ecx, [ebp - 0x18]
setne bl
call fcn.00513730
test bl, bl
je 0x42f6d7
push esi
lea ecx, [ebp - 0x14]
call fcn.00513b0c
lea eax, [ebp - 0x14]
push str.EXPLORER.EXE
push eax
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 1
call fcn.005139c5
mov eax, dword [eax]
lea ecx, [ebp - 0x230]
push ecx
push eax
mov byte [ebp - 4], 2
call fcn.0051a0f9
lea ecx, [ebp - 0x18]
mov esi, eax
mov byte [ebp - 4], 1
call fcn.00513730
test esi, esi
je 0x42f755
mov eax, dword [ebp - 0x22c]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
call fcn.004faa17
test eax, eax
pop ecx
je 0x42f755
mov ecx, dword [eax + 0x14]
mov edx, dword [eax + 0x10]
imul ecx, ecx, 0x64
or dword [ebp - 4], 0xffffffff
lea esi, [ecx + edx + 0x2e631]
lea ecx, [ebp - 0x14]
imul esi, esi, 0x64
add esi, dword [eax + 0xc]
call fcn.00513730
mov eax, esi
jmp 0x42f763
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00513730
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x42f772
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x53a3b3
call fcn.004f8378
sub esp, 0x118
mov eax, dword [0x59fe84]
and dword [ebp - 0x1c], 0
push ebx
push edi
mov dword [ebp - 0x14], eax
and byte [ebp - 0x124], 0
push 1
pop ebx
xor eax, eax
push 0x40
lea edi, [ebp - 0x123]
pop ecx
mov dword [ebp - 4], ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x124]
push 0x104
push eax
push str._PROGRAMFILES_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
jle 0x42f839
lea eax, [ebp - 0x124]
lea ecx, [ebp - 0x14]
push eax
call fcn.005138b9
push ebx
push 0x5c
lea ecx, [ebp - 0x18]
call fcn.0050ecf7
lea eax, [ebp - 0x20]
push ebx
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.0050f1ed
push dword [ebp - 0x18]
mov eax, dword [eax]
push eax
call fcn.004f8b05
pop ecx
pop ecx
test eax, eax
lea ecx, [ebp - 0x20]
setne byte [ebp - 0xd]
call fcn.00513730
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], bl
call fcn.00513730
cmp byte [ebp - 0xd], 0
je 0x42f82c
push 0x591374
lea ecx, [ebp - 0x14]
call fcn.00513b0c
push str.Common_Filesjyverify.dat
lea ecx, [ebp - 0x14]
call fcn.00513b0c
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
call fcn.005134a5
mov dword [ebp - 0x1c], ebx
and byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00513730
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x44023d
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x53c071
call fcn.004f8378
sub esp, 0x4c
push ebx
push esi
mov esi, ecx
push edi
lea eax, [esi + 0x87f]
push eax
call fcn.004d6080
pop ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.0051379e
mov edi, dword [ebp + 8]
xor ebx, ebx
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.00513c64
mov eax, dword [0x59fe84]
mov dword [ebp - 0x10], eax
lea eax, [esi + 0x7df]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp + 8]
push eax
call fcn.004316a9
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.00513869
lea ecx, [ebp + 8]
mov byte [ebp - 4], 1
call fcn.00513730
push dword [ebp - 0x10]
mov ecx, edi
push str.__account__
call fcn.0050ef80
push dword [ebp - 0x14]
mov ecx, edi
push str.__password__
call fcn.0050ef80
push dword [esi + 0xa35]
mov ecx, edi
push str.__commpwd__
call fcn.0050ef80
mov al, byte [esi + 0x8dd]
lea ecx, [ebp - 0x14]
push eax
call fcn.0050ed5d
push dword [ebp - 0x14]
mov ecx, edi
push str.__setcode__
call fcn.0050ef80
push dword [ebp - 0x10]
lea eax, [ebp - 0x58]
push eax
call fcn.004f95e0
lea eax, [ebp - 0x18]
push eax
call fcn.0042fd04
mov eax, dword [eax]
mov ecx, dword [esi + 0xcf5]
add esp, 0xc
lea edx, [ebp - 0x58]
push 0x40
push edx
push eax
push 7
push ecx
call fcn.004bf672
lea ecx, [ebp - 0x18]
call fcn.00513730
lea eax, [ebp - 0x58]
mov ecx, edi
push eax
push str.__port__
call fcn.0050ef80
cmp dword [esi + 0xc97], ebx
je 0x4403ae
push 0x11c
call fcn.00513471
pop ecx
mov ecx, eax
mov dword [ebp + 8], ecx
cmp ecx, ebx
mov byte [ebp - 4], 3
je 0x44036b
push esi
call fcn.00481621
mov dword [ebp + 8], eax
jmp 0x44036e
mov dword [ebp + 8], ebx
mov ecx, dword [ebp + 8]
mov byte [ebp - 4], 1
cmp ecx, ebx
je 0x4403bd
push dword [edi]
call fcn.0048177d
mov ecx, dword [ebp + 8]
push 5
call fcn.00517bf5
push 1
mov ecx, dword [ebp + 8]
push dword [esi + 0xca7]
push dword [esi + 0xca3]
push dword [esi + 0xc9f]
push dword [esi + 0xc9b]
call fcn.00517b65
jmp 0x4403bd
mov edi, dword [edi]
push 1
push ebx
push ebx
push edi
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.00513730
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00513730
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4