joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005d425
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x1005d434
pop dword [ebp - 8]
mov eax, 0xcc7a53b2
sub eax, 0xbc747f7e
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x6a7000f7
sub dword [ebp - 0x18], 0x1c1dbbac
mov dword [ebp - 0x14], 0x1c202e75
sub dword [ebp - 0x14], 0xe9ece230
mov dword [ebp - 0x10], 0x980fdce9
sub dword [ebp - 0x10], 0x4bc398bb
mov dword [ebp - 0xc], 0xa434103d
add dword [ebp - 0xc], 0x5bcbefc3
lea eax, [ebp - 0x18]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x4bb9c5c5
add dword [ebp - 0x18], 0x28b8a391
mov dword [ebp - 0x14], 0x3dd341d5
add dword [ebp - 0x14], 0x3991fa0
mov dword [ebp - 0x10], 0xaeccb653
sub dword [ebp - 0x10], 0x4b5d49e7
mov dword [ebp - 0xc], 0xebd788ea
add dword [ebp - 0xc], 0x14287716
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0xb525997a
sub eax, 0xa51d2956
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x3b6f8
push 0
call eax
mov ecx, 0x5a3668e8
add ecx, 0xa5c9d738
mov edx, eax
mov ebx, 0x100b9000
add ebx, dword [ebp - 8]
mov esi, 0xba60f7c0
add esi, 0xfc405f33
sub dword [ebp - 4], ebx
mov edi, dword [ebx]
sub dword [ebp - 4], 0x3f856ec0
sub edi, esi
xor dword [ebp - 4], 0x7fe81f05
mov dword [edx], edi
sub dword [ebp - 4], edx
add edx, 0xcd6058d7
add edx, 0x329fa72d
add ebx, 0x7a51f1f6
add ebx, 0x85ae0e0e
loop 0x1005d54b
add eax, 0x394d2457
add eax, 0xc6b3cefc
mov ebx, eax
add eax, 0x98e79fec
add eax, 0x67186019
mov ecx, 0x1abfb0a1
add ecx, 0xf5404f5f
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x42285a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x422869
pop dword [ebp - 0x50]
mov eax, 0x46e29d62
add eax, 0xb95f8b07
sub dword [ebp - 0x50], eax
push 0x40
push 0x1000
push 0x4ff9f
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x50]
call dword [eax]
mov ecx, 0xf05bb648
sub ecx, 0xf05b6ece
mov esi, eax
mov edx, 0xa789ff74
add edx, 0x58bd5e8c
add edx, dword [ebp - 0x50]
mov edi, 0xbe591d0e
sub edi, 0x9b96e32e
sub dword [ebp - 0x3c], edx
mov ebx, dword [edx]
xor dword [ebp - 0x10], edi
add ebx, edi
add dword [ebp - 0x10], esi
mov dword [esi], ebx
mov dword [ebp - 0x4c], 0xec3b7fd4
add esi, 4
add edx, 4
loop 0x4228c3
add eax, 0xc4070ac2
add eax, 0x3bfa05f9
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xefe6b9e5
sub ecx, 0xefa6b9e5
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x4400c9
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46c6d0
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x44010c
push str.SystemFunction040
push dword [0x46c6d0]
call edi
push str.SystemFunction041
push dword [0x46c6d0]
mov dword [0x46c6c0], eax
call edi
mov dword [0x46c6c4], eax
jmp 0x440111
mov eax, dword [0x46c6c4]
cmp dword [0x46c6c0], 0
je 0x440122
test eax, eax
jne 0x4401c9
push 0x46c6d4
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x4401d3
push str.CryptProtectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c0], 0
mov dword [0x46c6c8], eax
jne 0x440187
test eax, eax
jne 0x440187
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x440171
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x440178
mov esi, 0x80004005
push esi
push 0x28
push str.c:_agent_work138_s_srclibsdutilcryputil.cpp
call fcn.004038f5
jmp 0x4401d3
push str.CryptUnprotectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c4], 0
mov dword [0x46c6cc], eax
jne 0x4401c9
test eax, eax
jne 0x4401c9
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4401bd
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4401c4
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x44017b
mov dword [0x46c6d8], 1
pop edi
mov eax, esi
pop esi
ret
Function at 0x42ebb0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
push ebx
mov eax, ecx
mov ebx, dword [esp + 0x10]
cdq
and edx, 7
push ebp
add eax, edx
and ecx, 7
sar eax, 3
push esi
mov esi, dword [esp + 0x10]
test eax, eax
mov ebp, ecx
jle 0x42ebfb
push edi
mov edi, eax
push 8
mov ecx, esi
call fcn.0042e820
xor ecx, ecx
and eax, 0xff
mov cl, bh
xor edx, edx
xor eax, ecx
mov dh, bl
mov ebx, dword [eax*4 + 0x435750]
xor ebx, edx
dec edi
jne 0x42ebd6
pop edi
test ebp, ebp
jle 0x42ec27
push 1
mov ecx, esi
call fcn.0042e820
mov ecx, ebx
and ebx, 0x7fff
shr ecx, 0xf
and ecx, 1
xor eax, ecx
shl ebx, 1
test eax, eax
je 0x42ec24
xor ebx, 0x8005
dec ebp
jne 0x42ebff
pop esi
mov eax, ebx
pop ebp
pop ebx
ret

Function at 0x418180
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x12000]
push edi
or ebp, 0xffffffff
jmp 0x4181a2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4181a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x418198
mov eax, 1
add ebx, ebx
jne 0x4181bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4181b0
jne 0x4181cc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4181b0
xor ecx, ecx
sub eax, 3
jb 0x4181e0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x418252
mov ebp, eax
add ebx, ebx
jne 0x4181eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4181f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41821c
inc ecx
add ebx, ebx
jne 0x418208
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4181fd
jne 0x418219
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4181fd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41823c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41822d
jmp 0x41819e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41823c
add edi, ecx
jmp 0x41819e
pop esi
mov edi, esi
mov ecx, 0x3b2
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41825a
cmp byte [edi], 0
jne 0x41825a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x41825f
lea edi, [esi + 0x16000]
mov eax, dword [edi]
or eax, eax
je 0x4182ce
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x180b0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x18114]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41828c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x18118]
or eax, eax
je 0x4182c8
mov dword [ebx], eax
add ebx, 4
jmp 0x4182a9
call dword [esi + 0x1811c]
popal
jmp 0x40a630
Function at 0x404eb0
Capabilities:
Enumerate processes

Disassembly:
push 0xffffffffffffffff
push 0x46ba87
mov eax, dword fs:[0]
push eax
sub esp, 0x64c
mov eax, dword [0x48c74c]
xor eax, esp
mov dword [esp + 0x648], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x48c74c]
xor eax, esp
push eax
lea eax, [esp + 0x660]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
mov dword [esp + 0x14], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0
push 2
mov ebp, eax
mov dword [esp + 0x28], 0x22c
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x404f1b
xor al, al
jmp 0x40508d
lea eax, [esp + 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x40507c
nop
cmp dword [esp + 0x28], ebp
je 0x405068
xor eax, eax
push 0x206
push eax
mov word [esp + 0x45c], ax
lea eax, [esp + 0x45e]
push eax
call fcn.00451b50
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x464]
push 0x104
push eax
call fcn.0044c453
xor eax, eax
push 0x206
push eax
mov word [esp + 0x26c], ax
lea eax, [esp + 0x26e]
push eax
call fcn.00451b50
push esi
lea eax, [esp + 0x274]
push 0x104
push eax
call fcn.0044c453
lea eax, [esp + 0x27c]
push eax
call fcn.00467c9c
mov esi, eax
lea eax, [esp + 0x488]
push eax
call fcn.00467c9c
add esp, 0x38
lea ecx, [ecx]
mov cx, word [eax]
cmp cx, word [esi]
jne 0x404fe6
test cx, cx
je 0x404fe2
mov cx, word [eax + 2]
cmp cx, word [esi + 2]
jne 0x404fe6
add eax, 4
add esi, 4
test cx, cx
jne 0x404fc0
xor eax, eax
jmp 0x404feb
sbb eax, eax
or eax, 1
test eax, eax
jne 0x405064
mov eax, dword [edi + 4]
lea ecx, [esp + 0x28]
cmp ecx, eax
jae 0x405046
mov ecx, dword [edi]
lea edx, [esp + 0x28]
cmp ecx, edx
ja 0x405046
mov esi, edx
sub esi, ecx
sar esi, 2
cmp eax, dword [edi + 8]
jne 0x405018
push ecx
mov ecx, edi
call fcn.00405280
mov ecx, dword [edi + 4]
mov eax, dword [edi]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x668], 0
test ecx, ecx
je 0x405039
mov eax, dword [eax + esi*4]
mov dword [ecx], eax
mov dword [esp + 0x668], 0xffffffff
jmp 0x405060
cmp eax, dword [edi + 8]
jne 0x405053
push ecx
mov ecx, edi
call fcn.00405280
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x405060
mov eax, dword [esp + 0x28]
mov dword [ecx], eax
add dword [edi + 4], 4
mov esi, dword [esp + 0x14]
lea eax, [esp + 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x404f30
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [edi]
xor eax, eax
cmp ecx, dword [edi + 4]
setne al
mov ecx, dword [esp + 0x660]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x648]
xor ecx, esp
call fcn.0044b642
add esp, 0x658
ret
Function at 0x4050c0
Capabilities:
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x46bad0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x48c74c]
xor eax, esp
mov dword [esp + 0xc], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x48c74c]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov dword [esp + 0x2c], 0
xorps xmm0, xmm0
movq qword [esp + 0x14], xmm0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov byte [esp + 0x2c], 1
lea ecx, [esp + 0x34]
cmp dword [esp + 0x48], 8
lea edx, [esp + 0x14]
cmovae ecx, dword [esp + 0x34]
call fcn.00404eb0
mov ebp, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
cmp ebp, eax
jne 0x40514f
xor bl, bl
jmp 0x40518b
mov ebx, eax
xor ecx, ecx
sub ebx, ebp
xor edi, edi
add ebx, 3
mov esi, ebp
shr ebx, 2
cmp ebp, eax
cmova ebx, ecx
test ebx, ebx
je 0x405189
push dword [esi]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x405181
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
inc edi
add esi, 4
cmp edi, ebx
jne 0x405168
mov bl, 1
mov byte [esp + 0x2c], 0
test ebp, ebp
je 0x4051b5
push ebp
call fcn.0044b63d
add esp, 4
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x2c], 0xffffffff
cmp dword [esp + 0x48], 8
jb 0x4051d0
push dword [esp + 0x34]
call fcn.0044b63d
add esp, 4
xor eax, eax
mov dword [esp + 0x48], 7
mov word [esp + 0x34], ax
mov al, bl
mov dword [esp + 0x44], 0
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.0044b642
add esp, 0x1c
ret

Function at 0x405480
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46bbd2
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x48c74c]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
push edi
mov eax, dword [0x48c74c]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esp + 0x34]
push 0
mov dword [esp + 0x10], esi
call fcn.004477fd
mov dword [esp + 0x2c], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov byte [esp + 0x2c], 1
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
mov byte [esp + 0x2c], 2
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov byte [esp + 0x2c], 3
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov byte [esp + 0x2c], 4
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov byte [esp + 0x2c], 5
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [esp + 0x2c], 6
test edi, edi
jne 0x405558
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], str.bad_locale_name
push eax
lea ecx, [esp + 0x14]
call fcn.0044c4e6
mov byte [esp + 0x2c], 7
mov dword [esp + 0x10], vtable.std::runtime_error.0
mov byte [esp + 0x2c], 6
lea eax, [esp + 0x10]
push 0x48a0f8
push eax
call fcn.0044f1cb
push edi
push esi
call fcn.00447a93
add esp, 8
mov dword [esp + 0x2c], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0044b642
add esp, 0x24
ret 4
Function at 0x405dd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46be19
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x48c74c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0
mov dword [esp + 0x30], 1
cmp dword [esp + 0x50], 0
je 0x405e21
push 2
push 0x47c384
lea ecx, [esp + 0x48]
call fcn.00403070
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x3c]
call fcn.00405d60
mov byte [esp + 0x30], 2
lea ecx, [esp + 0x40]
push 0xffffffffffffffff
push 0
push eax
call fcn.00402fc0
mov byte [esp + 0x30], 1
cmp dword [esp + 0x24], 0x10
jb 0x405e5a
push dword [esp + 0x10]
call fcn.0044b63d
add esp, 4
lea eax, [esp + 0x40]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov ecx, esi
push eax
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], 0
mov byte [esp + 0x14], 0
mov byte [esi], 0
call fcn.00402f20
mov dword [esp + 8], 1
mov byte [esp + 0x30], 0
cmp dword [esp + 0x54], 0x10
jb 0x405eac
push dword [esp + 0x40]
call fcn.0044b63d
add esp, 4
mov dword [esp + 0x54], 0xf
mov dword [esp + 0x50], 0
mov byte [esp + 0x40], 0
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret

Function at 0x405ee0
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x46be60
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
mov eax, dword [0x48c74c]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x24], esp
push 0xffffffffffffffff
push 0
push dword [esp + 0x5c]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
mov byte [ecx], 0
call fcn.00403150
mov dword [esp + 0x4c], 0
push dword [esp + 0x5c]
push dword [esp + 0x5c]
mov dword [esp + 0x54], 0xffffffff
lea ecx, [esp + 0x30]
call fcn.00405dd0
add esp, 0x20
mov dword [esp + 0x34], 1
cmp dword [eax + 0x14], 0x10
jb 0x405f65
mov eax, dword [eax]
mov dword [esp + 0x3c], eax
mov ecx, esi
lea eax, [esp + 0x3c]
push eax
call fcn.0044c4e6
mov byte [esp + 0x34], 2
mov dword [esi], vtable.std::runtime_error.0
mov byte [esp + 0x34], 4
cmp dword [esp + 0x24], 0x10
jb 0x405f98
push dword [esp + 0x10]
call fcn.0044b63d
add esp, 4
mov eax, dword [esp + 0x40]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
mov dword [esi], vtable.std::_System_error.0
mov dword [esi + 0x10], eax
mov dword [esp + 0x34], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x30
ret 0xc
Function at 0x406310
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46bfe9
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x48c74c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov dword [esp + 8], 0
mov eax, dword [ecx + 0x30]
mov esi, dword [esp + 0x1c]
mov ecx, dword [eax]
mov dword [esi], ecx
mov edx, dword [ecx]
call dword [edx + 4]
mov dword [esp + 0x14], 0
mov dword [esp + 8], 1
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4

Function at 0x4066a0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x418
mov eax, dword [0x48c74c]
xor eax, esp
mov dword [esp + 0x414], eax
push esi
xor eax, eax
mov esi, edx
push 0x40e
push eax
mov word [esp + 0x10], ax
lea eax, [esp + 0x12]
push eax
call fcn.00451b50
add esp, 0xc
mov dword [esp + 4], 0
lea eax, [esp + 4]
push eax
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x40670e
lea eax, [esp + 8]
push eax
push dword [esp + 8]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
jne 0x406726
mov eax, dword [esp + 4]
test eax, eax
je 0x40670e
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor al, al
pop esi
mov ecx, dword [esp + 0x414]
xor ecx, esp
call fcn.0044b642
add esp, 0x418
ret
cmp word [esp + 8], 0
jne 0x406732
xor ecx, ecx
jmp 0x40674f
lea ecx, [esp + 8]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x406740
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [esp + 0xc]
mov ecx, esi
push eax
call fcn.00403be0
mov eax, dword [esp + 4]
test eax, eax
je 0x40676b
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov ecx, dword [esp + 0x418]
mov al, 1
pop esi
xor ecx, esp
call fcn.0044b642
add esp, 0x418
ret
Function at 0x406790
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x46c14b
mov eax, dword fs:[0]
push eax
sub esp, 0xb0
mov eax, dword [0x48c74c]
xor eax, esp
mov dword [esp + 0xac], eax
push ebx
push esi
push edi
mov eax, dword [0x48c74c]
xor eax, esp
push eax
lea eax, [esp + 0xc0]
mov dword fs:[0], eax
mov esi, edx
push 0x47c3d0
push 0xc8
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x406886
push edi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x406886
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x406873
push 0xa8
lea eax, [esp + 0x18]
push 0
push eax
call fcn.00451b50
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x40682f
mov eax, dword [esi]
jmp 0x406831
mov eax, esi
sub esp, 0xc
lea ecx, [esp + 0x20]
push eax
call fcn.004094d0
mov dword [esp + 0xc8], 0
lea ecx, [esp + 0x14]
push 0
push edi
push ebx
call fcn.00409350
lea ecx, [esp + 0x14]
call fcn.00409670
mov dword [esp + 0xc8], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.004068b0
mov ecx, esi
call fcn.004110e0
cmp eax, edi
jne 0x406886
test edx, edx
jne 0x406886
mov al, 1
jmp 0x406888
xor al, al
mov ecx, dword [esp + 0xc0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xac]
xor ecx, esp
call fcn.0044b642
add esp, 0xbc
ret
Function at 0x407040
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
sub esp, 8
mov eax, dword [0x48c74c]
xor eax, esp
mov dword [esp + 4], eax
push ebx
push ebp
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0xc]
push edi
push eax
push 0x20006
push 0
push str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x24], 0
xor bl, bl
call esi
mov ebp, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edi, 0x48d674
test eax, eax
jne 0x4070b7
cmp dword [0x48d688], 8
mov eax, edi
cmovae eax, dword [0x48d674]
push eax
push dword [esp + 0x14]
call ebp
push dword [esp + 0x10]
test eax, eax
movzx ebx, bl
mov eax, 1
cmove ebx, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x10]
push eax
push 0x20006
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x407101
cmp dword [0x48d688], 8
mov eax, edi
cmovae eax, dword [0x48d674]
push eax
push dword [esp + 0x14]
call ebp
push dword [esp + 0x10]
test eax, eax
movzx ebx, bl
mov eax, 1
cmove ebx, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x10]
push eax
push 0x20006
push 0
push str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRun
push SysReAllocString
call esi
test eax, eax
jne 0x40714b
cmp dword [0x48d688], 8
mov eax, edi
cmovae eax, dword [0x48d674]
push eax
push dword [esp + 0x14]
call ebp
push dword [esp + 0x10]
test eax, eax
movzx ebx, bl
mov eax, 1
cmove ebx, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x10]
push eax
push 0x20006
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push SysReAllocString
call esi
test eax, eax
jne 0x407193
cmp dword [0x48d688], 8
cmovae edi, dword [0x48d674]
push edi
push dword [esp + 0x14]
call ebp
push dword [esp + 0x10]
test eax, eax
movzx ebx, bl
mov eax, 1
cmove ebx, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x14]
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0044b642
add esp, 8
ret
Function at 0x4094d0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x46c7f2
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x48c74c]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], 0
lea eax, [edi + 0x60]
mov dword [edi], 0x47e124
mov dword [esp + 0x14], eax
mov dword [eax], vtable.std::ios_base.0
mov dword [esp + 0x20], 0
mov dword [eax], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [esp + 0x20], 1
lea esi, [edi + 4]
mov eax, dword [edi]
mov dword [esp + 0xc], 1
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
push ecx
push esi
lea eax, [ecx - 8]
mov dword [ecx + edi - 4], eax
mov eax, dword [edi]
mov ecx, dword [eax + 4]
add ecx, edi
call fcn.0040a260
mov dword [esp + 0x20], 4
mov eax, dword [edi]
mov dword [esp + 0x14], esi
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x60]
mov dword [ecx + edi - 4], eax
mov ecx, esi
call fcn.0040ab20
mov byte [esp + 0x20], 5
lea eax, [esi + 4]
mov dword [esi + 0xc], eax
lea ecx, [esi + 8]
lea eax, [esi + 0x14]
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x18]
mov dword [esi + 0x20], eax
lea eax, [esi + 0x24]
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x28]
mov dword [esi + 0x30], eax
mov byte [esi + 0x4c], 0
mov byte [esi + 0x45], 0
mov dword [esi + 0x10], ecx
mov dword [ecx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [0x48f434]
mov dword [esi + 0x50], 0
mov dword [esi + 0x48], eax
mov dword [esi + 0x40], 0
mov byte [esp + 0x20], 6
sub esp, 8
mov ecx, esi
push dword [esp + 0x30]
call fcn.0040a360
test eax, eax
jne 0x409648
mov eax, dword [edi]
mov ecx, dword [eax + 4]
mov eax, dword [ecx + edi + 0xc]
add ecx, edi
or eax, 2
cmp dword [ecx + 0x38], 0
jne 0x409636
or eax, 4
and eax, 0x17
mov dword [ecx + 0xc], eax
test dword [ecx + 0x10], eax
je 0x409648
push 0
call fcn.00406230
mov dword [esp + 0x20], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret 0x10