joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1011f123
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov edi, 0x1769
mov dword [0x1012d3d0], 0
mov byte [0x1012d3d4], 0
mov dword [0x1012d3c4], 0x1769
mov dword [0x1012d3cc], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], edi
jmp 0x1011f184
mov dword [0x1012d3c4], 0x27cb
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
add eax, 0xffffe280
mov dword [0x1012d3c4], eax
mov eax, ecx
mov dl, al
mov eax, dword [ebp - 0x18]
mov byte [eax + ecx], dl
mov ecx, dword [0x1012d3c4]
mov esi, ecx
add esi, 0xfffff237
mov dword [0x1012d3c8], esi
mov esi, dword [0x1012d3cc]
add esi, 1
mov dword [0x1012d3cc], esi
cmp esi, 0x100
mov edi, ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], edi
jl 0x1011f184
xor eax, eax
mov ecx, dword [ebp - 0x24]
add ecx, 0xffffe7c2
mov dword [0x1012d3c4], ecx
mov dword [0x1012d3cc], 0
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov ecx, 0x100
mov dword [0x1012d3d8], 0
mov dword [0x1012d3c8], 0x2161
mov edx, dword [0x1012d3d0]
mov esi, dword [ebp - 0x18]
movzx edi, byte [esi + eax]
add edi, edx
mov dword [ebp - 0x2c], eax
xor edx, edx
mov ebx, dword [ebp - 0x10]
div ebx
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
add edi, edx
mov dword [0x1012d3d8], edi
mov eax, edi
cdq
idiv ecx
mov dword [0x1012d3d0], edx
mov dword [0x1012d3c4], 0x2438
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x2c]
mov cl, byte [ecx + edi]
mov byte [0x1012d3d4], cl
mov dword [0x1012d3c4], 0x1cf5
mov ecx, dword [ebp - 0x18]
mov cl, byte [ecx + edx]
mov edx, dword [ebp - 0x18]
mov byte [edx + edi], cl
mov cl, byte [0x1012d3d4]
mov edx, dword [0x1012d3d0]
mov esi, dword [ebp - 0x18]
mov byte [esi + edx], cl
mov dword [0x1012d3c4], 0x1799
mov edx, dword [0x1012d3cc]
add edx, 1
mov dword [0x1012d3cc], edx
cmp edx, 0x100
mov dword [ebp - 0x28], edx
jl 0x1011f1f5
jmp 0x1011f172
Function at 0x1011f437
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [0x1012d3c4], 0x13
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
mov cl, byte [eax + 0x10122312]
mov dl, byte [eax + 0x101222e3]
sub dl, cl
mov byte [ebp + eax - 0x20], dl
add eax, 1
cmp eax, 0xe
mov dword [ebp - 0x2c], eax
jne 0x1011f458
lea eax, [ebp - 0x20]
mov dword [0x1012d3c8], 0x1499
mov dword [0x1012d3c4], 0x11f8
mov dword [ebp - 0x30], eax
call fcn.1011f5b7
mov dword [esp], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 4], eax
call fcn.1011f6c4
xor ecx, ecx
mov dword [0x1012d3c4], 0x23c5
cmp eax, 0
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], ecx
je 0x1011f587
mov eax, dword [ebp - 0x34]
mov dword [0x1012d3c8], 0x185a
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov ecx, dword [0x1012d3c4]
add ecx, 0xfffff955
mov dword [0x1012d3c4], ecx
mov dword [esp], eax
mov ecx, dword [ebp - 0x24]
mov dword [esp + 4], ecx
mov dword [ebp - 0x3c], eax
call fcn.1011eff1
xor eax, eax
mov ecx, dword [ebp - 0x3c]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x28]
mov dword [edx + 0xc], ecx
mov ecx, dword [ebp - 0x3c]
mov dword [edx + 0x1c], ecx
mov dword [0x1012d3c4], 0xfffff3db
mov dword [0x1012d3c8], 0x9c
cmp ecx, 0
mov dword [ebp - 0x38], eax
je 0x1011f587
mov eax, dword [ebp - 0x3c]
add eax, 0x2579
mov dword [0x1012d3c8], 0x1744
mov dword [0x1012d3c4], 0x1b4
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
add esp, 0x4c
pop ebp
ret
Function at 0x1011ff61
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, dword [0x1012d3c8]
mov dword [0x1012d3cc], 0
mov dword [0x1012d3d0], 0
mov dword [0x1012d3dc], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], edi
xor eax, eax
mov dword [0x1012d3c4], 0xa9f
mov ecx, dword [ebp - 0x10]
cmp ecx, 0
mov edx, eax
mov esi, eax
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], edi
je 0x101200f7
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
mov esi, 0x100
mov dword [0x1012d3c4], 0x1b0a
add ecx, 1
mov dword [ebp - 0x34], eax
mov eax, ecx
mov dword [ebp - 0x38], edx
cdq
idiv esi
mov dword [0x1012d3cc], edx
mov ecx, dword [ebp - 0x1c]
movzx edi, byte [ecx + edx]
mov ebx, dword [ebp - 0x38]
add edi, ebx
mov eax, edi
mov dword [ebp - 0x3c], edx
cdq
idiv esi
mov dword [0x1012d3d0], edx
mov esi, dword [ebp - 0x3c]
mov cl, byte [ecx + esi]
mov byte [0x1012d3d4], cl
mov dword [0x1012d3c4], 0x1ba7
mov edi, dword [ebp - 0x1c]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov cl, byte [0x1012d3d4]
mov edx, dword [0x1012d3d0]
mov byte [edi + edx], cl
mov dword [0x1012d3c4], 0x25da
mov edx, dword [0x1012d3cc]
movzx edx, byte [edi + edx]
mov ebx, dword [0x1012d3d0]
movzx ebx, byte [edi + ebx]
add ebx, edx
and ebx, 0xff
mov dword [0x1012d3dc], ebx
mov dword [0x1012d3c4], 0x4df
mov cl, byte [edi + ebx]
mov edx, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x34]
mov ch, byte [edx + ebx]
mov byte [0x1012d3e1], ch
mov byte [0x1012d3e2], cl
xor ch, cl
mov byte [0x1012d3e0], ch
mov dword [0x1012d3c8], 0xd0
mov edx, dword [ebp - 0x18]
mov byte [edx + ebx], ch
mov edx, dword [0x1012d3c8]
mov esi, edx
add esi, 0xffffe557
mov dword [0x1012d3c4], esi
add ebx, 1
mov esi, dword [ebp - 0x10]
cmp ebx, esi
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x30], edx
je 0x101200f7
mov eax, dword [0x1012d3cc]
mov ecx, dword [0x1012d3d0]
mov edx, dword [ebp - 0x40]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x2c], edx
jmp 0x1011ffd7
mov eax, dword [ebp - 0x30]
add eax, 0xffffe56e
mov dword [0x1012d3c4], eax
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1012010c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x98
mov eax, dword [0x1012d3c8]
add eax, 0x1601
mov dword [0x1012d3c8], eax
call fcn.10001092
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x24], ecx
je 0x10120189
jmp 0x1012029b
lea eax, [esp + 0x38]
mov dword [0x1012d3c8], 0x17ac
mov ecx, dword [esp + 0x30]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.1011f437
mov ecx, esp
lea edx, [esp + 0x38]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov ecx, dword [0x1012d3c4]
add ecx, 0x122d
mov dword [0x1012d3c4], ecx
mov dword [esp + 0x20], eax
jmp 0x10120293
lea eax, [esp + 0x28]
lea ecx, [esp + 0x38]
mov dword [0x1012d3c4], 0x3bb
mov dword [esp], eax
mov dword [esp + 0x1c], ecx
call fcn.1011f8d7
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x68], ecx
mov dword [esp + 0x80], 0x12b800
mov ecx, dword [0x1012d3b0]
mov dword [esp + 0x5c], ecx
mov ecx, dword [0x1012d3b4]
mov dword [esp + 0x70], ecx
mov ecx, dword [0x1012d3b8]
mov dword [esp + 0x74], ecx
mov ecx, dword [0x1012d3bc]
mov dword [esp + 0x8c], ecx
mov ecx, dword [0x1012d3c0]
mov dword [esp + 0x88], ecx
mov dword [0x1012d3c8], 0xc9d
mov dword [0x1012d3c4], 0xc7
mov dword [esp + 0x18], eax
lea eax, [0x1011f3c9]
mov dword [esp + 0x14], eax
jmp 0x10120216
mov eax, dword [esp + 0x14]
cmp word [eax], 0x5a4d
mov dword [esp + 0x10], eax
jne 0x10120239
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0xc], ecx
je 0x10120255
mov eax, dword [esp + 0x10]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
mov dword [esp + 0x14], eax
jmp 0x10120216
mov eax, dword [esp + 0x10]
mov dword [esp + 0x64], eax
mov dword [0x1012d3c8], 0x83d
mov ecx, dword [esp + 0xc]
mov edx, dword [eax + ecx + 0x50]
mov dword [esp + 0x60], edx
mov dword [0x1012d3c4], 0x5f1
call fcn.1011e9f5
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x20], ecx
je 0x1012013e
mov eax, dword [esp + 0x20]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov esp, ebp
pop ebp
ret
Function at 0x402430
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
xor eax, eax
jne 0x402439
xor ecx, ecx
jne 0x402439
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40247e
mov eax, dword [ebp - 0xc]
jmp 0x4024d4
cmp dword [ebp - 4], 1
je 0x402491
cmp dword [ebp - 4], 2
je 0x402491
mov eax, 0xd
jmp 0x4024d4
cmp dword [ebp + 0xc], 0
je 0x4024ca
cmp dword [ebp - 8], 0
je 0x4024c4
mov eax, dword [ebp - 8]
xor edx, edx
mov ecx, 1
div ecx
test edx, edx
jne 0x4024bb
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 8]
movsx eax, byte [edx - 1]
test eax, eax
je 0x4024c2
mov eax, 0xd
jmp 0x4024d4
jmp 0x4024ca
mov ecx, dword [ebp + 0xc]
mov byte [ecx], 0
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 8]
mov dword [edx], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc

Function at 0x402510
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
xor eax, eax
jne 0x402519
xor ecx, ecx
jne 0x402519
xor edx, edx
cmp dword [ebp + 0xc], 0
setne dl
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
jne 0x40253a
mov eax, 0xd
jmp 0x402566
xor eax, eax
jne 0x402521
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 0x10]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x402570
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
xor eax, eax
jne 0x402579
xor ecx, ecx
jne 0x402579
xor edx, edx
cmp dword [ebp + 0xc], 0
setne dl
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0
jne 0x40259a
mov eax, 0xd
jmp 0x4025ef
xor eax, eax
jne 0x402581
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
cmp dword [ebp - 0xc], 1
jne 0x4025ab
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 7
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esp, ebp
pop ebp
ret 8
Function at 0x402600
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x425060]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x130], ecx
lea ecx, [ebp - 0x14]
call fcn.00402200
mov eax, dword [ebp - 0x130]
mov ecx, dword [eax + 4]
or ecx, 0x2001f
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x130]
mov ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x14]
call fcn.004023d0
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x40266b
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x124], edx
lea ecx, [ebp - 0x14]
call fcn.00402230
mov eax, dword [ebp - 0x124]
jmp 0x4026fc
mov dword [ebp - 4], 0x100
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x120]
push edx
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x4026d1
lea ecx, [ebp - 0x120]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00402600
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4026c8
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x128], edx
lea ecx, [ebp - 0x14]
call fcn.00402230
mov eax, dword [ebp - 0x128]
jmp 0x4026fc
mov dword [ebp - 4], 0x100
jmp 0x402672
lea ecx, [ebp - 0x14]
call fcn.00402310
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x130]
call fcn.004022b0
mov dword [ebp - 0x12c], eax
lea ecx, [ebp - 0x14]
call fcn.00402230
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0040f346
mov esp, ebp
pop ebp
ret 4
Function at 0x408ba0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x425060]
xor eax, ebp
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
shl ecx, 1
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
call fcn.00419860
mov dword [ebp - 0x2c], esp
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x10], edx
call fcn.004018d0
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x408beb
mov dword [ebp - 0x30], 0
jmp 0x408c38
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x3fffffff
jle 0x408c0d
mov dword [ebp - 0x34], 0
jmp 0x408c32
mov eax, dword [ebp - 4]
shl eax, 1
call fcn.00419860
mov dword [ebp - 0x38], esp
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x38]
push edx
call fcn.004018e0
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [ebp - 0x30]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00406b90
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x408c6a
mov eax, dword [ebp - 0x18]
jmp 0x408d19
cmp dword [ebp - 8], 3
jne 0x408cba
mov edx, dword [ebp + 0x14]
cmp dword [edx], 0
je 0x408ca6
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax - 1]
test ecx, ecx
je 0x408c90
mov eax, 0xd
jmp 0x408d19
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.0040f360
add esp, 0xc
jmp 0x408cae
xor edx, edx
mov eax, dword [ebp - 0x10]
mov word [eax], dx
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0xc]
mov dword [ecx], edx
xor eax, eax
jmp 0x408d19
cmp dword [ebp - 8], 1
je 0x408cc6
cmp dword [ebp - 8], 2
jne 0x408d14
mov eax, dword [ebp + 0x14]
cmp dword [eax], 0
je 0x408d06
push 0
push 0
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp + 0x10]
push eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x10]
push ecx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edx, dword [ebp + 0x14]
mov dword [edx], eax
mov eax, dword [ebp + 0x14]
cmp dword [eax], 0
jne 0x408d04
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x408d19
jmp 0x408d0e
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov word [edx], cx
xor eax, eax
jmp 0x408d19
mov eax, 0xd
lea esp, [ebp - 0x38]
mov ecx, dword [ebp - 0x24]
xor ecx, ebp
call fcn.0040f346
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40e230
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ecx
mov byte [ebp - 1], 1
mov ecx, dword [ebp - 0x20]
call fcn.0040e790
movzx eax, al
test eax, eax
je 0x40e29e
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x10], edx
mov ecx, dword [ebp - 0x20]
add ecx, 4
call fcn.00406e40
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0xfffffffe
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x20]
add ecx, 4
call fcn.00406e40
push eax
push 0x4e
lea ecx, [ebp - 0x18]
push ecx
mov ecx, dword [ebp - 0x20]
add ecx, 4
call fcn.00406e10
mov ecx, eax
call fcn.00406b90
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x40e33c
mov ecx, dword [ebp - 0x20]
call fcn.0040e5e0
movzx edx, al
test edx, edx
je 0x40e2ec
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 4]
push ecx
mov ecx, dword [ebp - 0x20]
add ecx, 4
call fcn.00406e40
and eax, 0xffff
movzx edx, ax
push edx
push 0x111
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x20]
add ecx, 4
call fcn.00406e10
mov ecx, eax
call fcn.00406b90
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x40e33c
push 1
push 0
push 0
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 0x28]
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [ebp - 0x14], eax
mov eax, 0x20
cmp eax, dword [ebp - 0x14]
sbb ecx, ecx
neg ecx
mov byte [ebp - 1], cl
movzx edx, byte [ebp - 1]
test edx, edx
je 0x40e33c
mov eax, dword [ebp - 0x20]
mov cl, byte [eax + 0x58]
or cl, 2
mov edx, dword [ebp - 0x20]
mov byte [edx + 0x58], cl
push 1
mov ecx, dword [ebp - 0x20]
add ecx, 4
call fcn.00406d40
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret

Function at 0x40f195
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x428238], 0
push esi
jne 0x40f108
call fcn.0040f02e
test eax, eax
je 0x40f14b
mov eax, dword [0x428238]
cmp eax, 1
jne 0x40f129
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x40f14b
pop esi
ret
push eax
call dword [0x428240]
test eax, eax
jne 0x40f193
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x40f14f
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x428238]
call dword [0x428240]
mov edi, eax
test edi, edi
je 0x40f174
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x40f190
mov edi, esi
add esi, 0xff0
push edi
push dword [0x428238]
call dword [0x42823c]
add edi, 0x10
cmp edi, esi
jb 0x40f17c
mov eax, edi
pop edi
pop esi
ret
jmp 0x40f0f5

Function at 0x40f346
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x425060]
jne 0x40f350
repz ret
jmp fcn.0041078c
Function at 0x4172e4
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00410b2d
and dword [ebp - 4], 0
cmp dword [0x428c60], 0
mov ebx, eax
jne 0x417395
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x417446
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x417446
push eax
call fcn.00410abb
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x428c60], eax
call esi
push eax
call fcn.00410abb
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x428c64], eax
call esi
push eax
call fcn.00410abb
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x428c68], eax
call esi
push eax
call fcn.00410abb
pop ecx
mov dword [0x428c70], eax
test eax, eax
je 0x417395
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00410abb
pop ecx
mov dword [0x428c6c], eax
mov eax, dword [0x428c6c]
cmp eax, ebx
je 0x4173ed
cmp dword [0x428c70], ebx
je 0x4173ed
push eax
call fcn.00410b36
push dword [0x428c70]
mov esi, eax
call fcn.00410b36
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4173ed
test edi, edi
je 0x4173ed
call esi
test eax, eax
je 0x4173e4
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4173e4
test byte [ebp - 0xc], 1
jne 0x4173ed
or dword [ebp + 0x10], 0x200000
jmp 0x417426
mov eax, dword [0x428c64]
cmp eax, ebx
je 0x417426
push eax
call fcn.00410b36
pop ecx
test eax, eax
je 0x417426
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x417426
mov eax, dword [0x428c68]
cmp eax, ebx
je 0x417426
push eax
call fcn.00410b36
pop ecx
test eax, eax
je 0x417426
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x428c60]
call fcn.00410b36
pop ecx
test eax, eax
je 0x417446
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x417448
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41ab50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x41abc0
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x41abb9
mov ecx, 0x428dc4
call fcn.00401000
cmp dword [ebp + 0x10], eax
je 0x41abb9
mov ecx, 0x428dc4
call fcn.00401000
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x41abb7
xor eax, eax
jmp 0x41acaf
jmp 0x41abc0
xor eax, eax
jmp 0x41acaf
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x41abde
xor eax, eax
jmp 0x41acaf
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x41abfc
xor eax, eax
jmp 0x41acaf
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x41ac16
xor eax, eax
jmp 0x41acaf
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x41acac
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x41aca2
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.0040f360
add esp, 0xc
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea ecx, [ebp - 0x20]
call fcn.004015d0
lea ecx, [ebp - 0x20]
call fcn.00406920
push eax
push 0
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x41ac9a
push 0
lea ecx, [ebp - 0x20]
call fcn.00406b90
push eax
call fcn.00401530
add esp, 8
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x20]
call fcn.00401010
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret
Function at 0x448860
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b0ef0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x634bc0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esi], vtable.CryptoPP::FilterWithBufferedInput.0
mov dword [esi + 4], vtable.CryptoPP::FilterWithBufferedInput.1.0
mov dword [ebp - 4], 0
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x30]
cmp eax, ecx
mov edx, dword [esi + 0x34]
mov edi, edx
cmovb ecx, eax
xor al, al
rep stosb byte es:[edi], al
push edx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov ecx, dword [esi + 0xc]
add esp, 4
test ecx, ecx
je 0x4488c4
mov eax, dword [ecx]
push 1
call dword [eax]
test byte [ebp + 8], 1
je 0x4488d5
push 0x48
push esi
call fcn.005adbc8
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4