joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5471e8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404690
xor eax, eax
push ebp
push 0x547270
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x22], eax
mov dword [ebp - 0x1e], 3
lea eax, [ebp - 0x28]
mov ecx, 0x547288
mov edx, dword [ebp - 4]
call main
mov eax, dword [ebp - 0x28]
call fcn.004046a0
mov dword [ebp - 0x1a], eax
xor eax, eax
mov dword [ebp - 0x16], eax
mov word [ebp - 0x12], 0x450
lea eax, [ebp - 0x22]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
jne 0x547250
mov bl, 1
jmp 0x547252
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x547277
lea eax, [ebp - 0x28]
call fcn.004041e0
lea eax, [ebp - 4]
call fcn.004041e0
ret

Function at 0x54728c
Capabilities:
Create process on windows
Delete file
Move file
Self delete
Set file attributes

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x547426
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x11], 0
lea eax, [ebp - 0xc]
mov edx, 0x54743c
call fcn.00404278
push 0x34
mov eax, dword [ebp - 0xc]
call fcn.004046a0
mov edx, eax
mov ecx, 0x547488
mov eax, dword [0x55e810]
mov eax, dword [eax]
call fcn.004901ac
cmp eax, 6
jne 0x5472e1
mov byte [ebp - 0x11], 1
mov eax, esi
call fcn.0041b020
mov edi, eax
dec edi
test edi, edi
jl 0x547403
inc edi
xor ebx, ebx
cmp byte [0xbd34e0], 5
je 0x547403
mov edx, ebx
mov eax, esi
call fcn.00492abc
mov eax, dword [eax + 0x1c]
mov edx, 0x5474a0
call fcn.004045ec
jne 0x5473fb
mov dword [ebp - 0x10], 0x80
mov eax, dword [ebp - 0x10]
push eax
mov edx, ebx
mov eax, esi
call fcn.00492abc
mov eax, dword [eax + 0x28]
call fcn.004046a0
push eax
call sub.kernel32.dll_SetFileAttributesA
mov edx, ebx
mov eax, esi
call fcn.00492abc
mov eax, dword [eax + 0x28]
call fcn.004093c0
test al, al
jne 0x5473fb
mov edx, ebx
mov eax, esi
call fcn.00492abc
cmp dword [eax + 0x28], 0
je 0x5473fb
push 0x5474ac
mov edx, ebx
mov eax, esi
call fcn.00492abc
mov eax, dword [eax + 0x28]
lea edx, [ebp - 0x18]
call fcn.005457d4
push dword [ebp - 0x18]
push 0x5474c4
lea eax, [ebp - 4]
mov edx, 3
call fcn.00404560
push 4
push 0
mov edx, ebx
mov eax, esi
call fcn.00492abc
mov eax, dword [eax + 0x28]
call fcn.004046a0
push eax
call sub.kernel32.dll_MoveFileExA
push 0
mov eax, dword [ebp - 4]
call fcn.004046a0
push eax
call sub.kernel32.dll_WinExec
mov edx, ebx
mov eax, esi
call fcn.00492abc
mov edx, dword [eax + 0x28]
lea eax, [ebp - 8]
call fcn.00404278
cmp byte [ebp - 0x11], 0
je 0x5473f3
mov edx, ebx
mov eax, esi
call fcn.00492abc
mov eax, dword [eax + 0x28]
call fcn.004093c0
jmp 0x5473fb
mov eax, dword [ebp - 8]
call fcn.005471e8
inc ebx
dec edi
jne 0x5472f6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54742d
lea eax, [ebp - 0x18]
call fcn.004041e0
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404204
ret
Function at 0x5474d0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x54757f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
mov dword [ebp - 0x18], 1
lea eax, [ebp - 0x14]
push eax
push ebx
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov esi, eax
lea eax, [ebp - 0x1c]
mov edx, ebx
call fcn.004043d8
mov eax, dword [ebp - 0x1c]
mov edx, 0x547598
call fcn.004045ec
jne 0x547542
lea eax, [ebp - 0x14]
push eax
push ebx
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov esi, eax
mov dword [ebp - 0xc], 2
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0
push 0x10
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle
mov ebx, esi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x547586
lea eax, [ebp - 0x1c]
call fcn.004041e0
ret

Function at 0x5475ac
Capabilities:
Acquire debug privileges
Terminate process

Disassembly:
push ebx
push esi
mov esi, eax
xor ebx, ebx
mov eax, esi
call fcn.00542620
test al, al
je 0x5475c1
mov bl, 1
jmp 0x5475e8
push 0x5475f0
call fcn.005474d0
push esi
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov esi, eax
push 1
push esi
call sub.kernel32.dll_TerminateProcess
test eax, eax
je 0x5475e8
mov bl, 1
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x547934
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
xor edx, edx
mov dword [ebp - 0x114], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404690
xor eax, eax
push ebp
push 0x5479cc
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x10d]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea edx, [ebp - 8]
lea eax, [ebp - 0x10d]
call fcn.00409920
push dword [ebp - 8]
push 0x5479e0
push dword [ebp - 4]
lea eax, [ebp - 0x114]
mov edx, 3
call fcn.00404560
mov eax, dword [ebp - 0x114]
call fcn.004093c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5479d3
lea eax, [ebp - 0x114]
call fcn.004041e0
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404204
ret
Function at 0x5479e4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
xor edx, edx
mov dword [ebp - 0x114], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404690
xor eax, eax
push ebp
push 0x547a7c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x10d]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea edx, [ebp - 8]
lea eax, [ebp - 0x10d]
call fcn.00409920
push dword [ebp - 8]
push 0x547a90
push dword [ebp - 4]
lea eax, [ebp - 0x114]
mov edx, 3
call fcn.00404560
mov eax, dword [ebp - 0x114]
call fcn.004093c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x547a83
lea eax, [ebp - 0x114]
call fcn.004041e0
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404204
ret
Function at 0x5489d8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
mov ebx, eax
push 0x51
lea eax, [ebp - 0x51]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov eax, ebx
lea edx, [ebp - 0x51]
mov ecx, 0x51
call fcn.00404450
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x548a00
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
mov ebx, eax
push 0x104
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
lea eax, [ebp - 0x105]
call fcn.00409920
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x549d00
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffecc
push ebx
xor edx, edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x549e17
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x549df6
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x44]
call sub.kernel32.dll_GetCurrentProcess
mov cl, 1
mov edx, 0x549e2c
call fcn.00549b9c
xor edx, edx
mov eax, 2
call fcn.004917b0
mov dword [ebp - 4], eax
xor edx, edx
push ebp
push 0x549def
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x44]
mov dword [ebp - 0x130], 0x128
lea edx, [ebp - 0x130]
mov eax, dword [ebp - 4]
call fcn.004917d0
jmp 0x549dd4
lea edx, [ebp - 8]
mov eax, dword [ebp - 0x128]
call fcn.00549c58
cmp dword [ebp - 8], 0
je 0x549da3
mov edx, dword [ebp - 8]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x549dc6
lea eax, [ebp - 0x134]
lea edx, [ebp - 0x10c]
mov ecx, 0x104
call fcn.00404450
mov edx, dword [ebp - 0x134]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x130]
mov eax, dword [ebp - 4]
call fcn.004917f0
test eax, eax
jne 0x549d83
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x549df6
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x549e1e
lea eax, [ebp - 0x134]
call fcn.004041e0
lea eax, [ebp - 8]
call fcn.004041e0
ret

Function at 0x54a064
Capabilities:
Delete service
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
call fcn.0054a034
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x54a0fb
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, ebx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0054a200
test al, al
jne 0x54a0e2
mov ecx, ebx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0054a054
mov ebx, eax
test ebx, ebx
je 0x54a0d8
lea eax, [ebp - 0x28]
push eax
push 1
push ebx
call sub.advapi32.dll_ControlService
push ebx
call sub.advapi32.dll_DeleteService
test eax, eax
je 0x54a0d1
mov dword [ebp - 8], 2
jmp 0x54a0d8
mov dword [ebp - 8], 1
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0054a018
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54a102
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0054a044
ret
Function at 0x54a10c
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
call fcn.0054a034
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x54a1b7
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, ebx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0054a200
test al, al
jne 0x54a19e
mov ecx, ebx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0054a220
test al, al
jne 0x54a197
mov ecx, ebx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0054a054
mov ebx, eax
test ebx, ebx
je 0x54a18b
lea eax, [ebp - 0x28]
push eax
push 1
push ebx
call sub.advapi32.dll_ControlService
test eax, eax
je 0x54a184
mov dword [ebp - 8], 2
jmp 0x54a18b
mov dword [ebp - 8], 3
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0054a018
jmp 0x54a19e
mov dword [ebp - 8], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54a1be
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0054a044
ret

Function at 0x54a1c8
Capabilities:
Query service status

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe4
mov esi, eax
xor ebx, ebx
test edx, edx
jbe 0x54a1f7
mov eax, esi
call fcn.0054a054
mov edi, eax
push esp
push edi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x54a1ee
mov ebx, dword [esp + 4]
mov edx, edi
mov eax, esi
call fcn.0054a018
mov eax, ebx
add esp, 0x1c
pop edi
pop esi
pop ebx
ret

Function at 0x54b01c
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404690
xor eax, eax
push ebp
push 0x54b0f8
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x54b0e2
push 0xf01ff
mov eax, dword [ebp - 4]
call fcn.004046a0
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x54b0e2
xor eax, eax
push ebp
push 0x54b0bf
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x2c]
push eax
push 1
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_ControlService
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x54b0e2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54b0ff
lea eax, [ebp - 4]
call fcn.004041e0
ret
Function at 0x555370
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404690
xor eax, eax
push ebp
push 0x5553f8
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x22], eax
mov dword [ebp - 0x1e], 3
lea eax, [ebp - 0x28]
mov ecx, 0x555410
mov edx, dword [ebp - 4]
call main
mov eax, dword [ebp - 0x28]
call fcn.004046a0
mov dword [ebp - 0x1a], eax
xor eax, eax
mov dword [ebp - 0x16], eax
mov word [ebp - 0x12], 0x450
lea eax, [ebp - 0x22]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
jne 0x5553d8
mov bl, 1
jmp 0x5553da
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5553ff
lea eax, [ebp - 0x28]
call fcn.004041e0
lea eax, [ebp - 4]
call fcn.004041e0
ret

Function at 0x556a30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, edx
xor eax, eax
push ebp
push 0x556aa4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x104]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 4]
lea eax, [ebp - 0x104]
call fcn.00409920
lea eax, [ebp - 4]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404700
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00404234
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x556aab
lea eax, [ebp - 4]
call fcn.004041e0
ret
Function at 0x557fdc
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x55808b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
mov dword [ebp - 0x18], 1
lea eax, [ebp - 0x14]
push eax
push ebx
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov esi, eax
lea eax, [ebp - 0x1c]
mov edx, ebx
call fcn.004043d8
mov eax, dword [ebp - 0x1c]
mov edx, 0x5580a4
call fcn.004045ec
jne 0x55804e
lea eax, [ebp - 0x14]
push eax
push ebx
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov esi, eax
mov dword [ebp - 0xc], 2
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0
push 0x10
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle
mov ebx, esi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x558092
lea eax, [ebp - 0x1c]
call fcn.004041e0
ret

Function at 0x5580b8
Capabilities:
Acquire debug privileges
Terminate process

Disassembly:
push ebx
push esi
mov esi, eax
xor ebx, ebx
mov eax, esi
call fcn.00542620
test al, al
je 0x5580cd
mov bl, 1
jmp 0x5580f4
push 0x5580fc
call fcn.00557fdc
push esi
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov esi, eax
push 1
push esi
call sub.kernel32.dll_TerminateProcess
test eax, eax
je 0x5580f4
mov bl, 1
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x4096c0
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x450
mov eax, dword [0x40d018]
xor eax, ebp
mov dword [ebp - 0x40], eax
xor eax, eax
mov word [ebp - 0x248], ax
push 0x206
push 0
lea ecx, [ebp - 0x246]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
xor edx, edx
mov word [ebp - 0x450], dx
push 0x206
push 0
lea eax, [ebp - 0x44e]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.MSVCR90.dll_wcslen]
add esp, 4
test eax, eax
jbe 0x40974f
mov edx, dword [ebp + 0xc]
push edx
push 0x104
lea eax, [ebp - 0x450]
push eax
call fcn.004062c0
push 0x40b3b4
push 0x104
lea ecx, [ebp - 0x450]
push ecx
call fcn.00406310
jmp 0x40979e
lea edx, [ebp - 0x450]
push edx
push 0
push 0
push 0x2b
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x409780
push 0x40b3b8
push 0x104
lea eax, [ebp - 0x450]
push eax
call fcn.00406310
jmp 0x40979e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x40b3d8
push str.SHGetFolderPath_failed
call fcn.004080a0
add esp, 0xc
jmp 0x409874
lea ecx, [ebp - 0x450]
push ecx
push 0x104
lea edx, [ebp - 0x248]
push edx
call fcn.004062c0
push str.AdobeARMHelper.exe
push 0x104
lea eax, [ebp - 0x248]
push eax
call fcn.00406310
push 0xffffffffffffffff
lea ecx, [ebp - 0x248]
push ecx
call fcn.004095f0
add esp, 8
test eax, eax
jne 0x4097fc
push 0x357
lea edx, [ebp - 0x248]
push edx
push str.Service_workflow_failed__file_not_valid:
call fcn.004080a0
add esp, 0xc
jmp 0x409874
mov dword [ebp - 0x3c], 0
push 0x38
push 0
lea eax, [ebp - 0x38]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x540
mov dword [ebp - 0x20], 5
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x28], ecx
lea edx, [ebp - 0x248]
mov dword [ebp - 0x2c], edx
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x40985b
push 0
push 0x40b48c
push str.ShellExecuteEx_succeeded
call fcn.004080a0
add esp, 0xc
jmp 0x409874
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x40b4c4
push str.ShellExecuteEx_failed
call fcn.004080a0
add esp, 0xc
mov ecx, dword [ebp - 0x40]
xor ecx, ebp
call fcn.00407458
mov esp, ebp
pop ebp
ret

Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x6325d1
Capabilities:
Access pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x10]
xor ebx, ebx
push edi
xor edi, edi
inc ebx
cmp eax, edi
jne 0x632d32
mov eax, dword [esi + 0x30]
cmp eax, edi
jne 0x63303e
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push dword [eax + 8]
call dword [sym.imp.ntdll.dll_RtlImageNtHeader]
cmp eax, edi
je 0x632616
push dword [eax + 0x64]
call dword [sym.imp.RPCRT4.dll_RpcMgmtSetServerStackSize]
cmp dword [esi + 0x34], edi
jne 0x6332d7
push edi
push edi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret 4
test byte [esi + 0x38], bl
jne 0x6332c4
push ebx
lea ecx, [esi + 0x20]
push ecx
push dword [esi + 0x1c]
push dword [esi + 0x18]
push dword [esi + 0x14]
push eax
call fcn.00632d61
test eax, eax
jne 0x6325ec
jmp 0x6332bd
shl eax, 0xa
push eax
jmp 0x632610
xor eax, eax
jmp 0x63262b
push 4
push edi
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jge 0x6325ec
jmp 0x6332bd
push ebx
push edi
push ebx
call dword [sym.imp.ntdll.dll_RtlSetProcessIsCritical]
add esp, 0xc
jmp 0x63261f
Function at 0xef096c
Capabilities:
Encode data using xor

Disassembly:
jmp 0xef0976
pushal
call 0xef097c
pop ebp
sub ebp, 0x10
sub ebp, 0xaf096c
jmp 0xef0992
or dword [edi + 0x4e900], ebp
add byte [eax], al
out dx, al
retf
mov eax, 0xaf096c
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c5
mov edx, 0x8d98c65c
xor byte [eax], dl
inc eax
dec ecx
jne 0xef09a9
jmp 0xef09bc
mov edx, edi
xlatb
xchg ecx, eax
xlatb
aad 0x60
pop esp
pop esp
pop esp
fstp qword [ebp + 0x5c5c5ca4]
pop edi
xchg ecx, eax
in al, 0x5a
pop esp
pop esp
pop esp
out 0x74, al
pop esp
pop esp
pop esp
stosd dword es:[edi], eax
mov esi, 0xddd7945f
push eax
pop esp
pop esp
pop esp
pop edi
cdq
sar dword [eax], 1
js 0xef0986
aad 0x58
js 0xef09bb
cmp byte [eax - 0x60], bh
aad 0x58
js 0xef0a25
ror byte [ebp + edi*2 + 0x6492345c], 0xd1
pop esp
pop ebp
jo 0xef0a75
xor al, 0x87
add ah, ah
pop es
mov ah, 0x59
pop esp
pop esp
pop esp
mov ch, 0x6c
pop esp
pop esp
pop esp
or ecx, edx
xor byte [eax + 0x5c], bh
xlatb
fst dword [esp + ebx*2 + 0x5c]
pop esp
xlatb
leave
push eax
pop esp
pop esp
pop esp
xlatb
ror dword [esp + ebx*2 + 0x5c], 1
pop esp
popfd
mov ch, 0x5e
pop esi
insd dword es:[edi], dx
pop esi
fistp word [esi - 0x26aceaa8]
test al, 0xa3
mov dword [0x7870d7a3], eax
sar dword [eax], 1
js 0xef0a91
sahf
push eax
pop esp
xlatb
sar byte [eax + 0x58], 1
pop esp
pop esp
pop esp
xor al, 0xc0
invalid
invalid
adc bl, byte [esp + ebx*2 + 0x5c]
push ebx
aam 0x14
pop esp
pop esp
pop esp
cmp dl, bh
inc eax
fsub qword gs:[edi + 0x46d853b4]
pop esp
pop esp
pop esp
fsub qword [edi + 0x4dd853b5]
pop esp
pop esp
pop esp
cmp bl, ch
cmpsd dword [esi], dword es:[edi]
mov dword [0x49d85379], eax
pop esp
pop esp
pop esp
sbb eax, 0xa3a390b5
mov dword [0x5d651075], eax
fistp word [ebp + 0x58b4df59]
mov ch, 0xe1
mov dword [0x875a3a3], eax
pop esi
fistp word [ebp + 0x58b6df5a]
fbstp tbyte [ecx + ebx*2 - 0x5c5c084b]
mov dword [0xd17870d7], eax
cmp byte [eax + 0x58], bh
sahf
push eax
pop esp
or edi, edx
mov al, 0xa
or ecx, dword [ecx]
xlatb
sub dword [eax - 0x29], edx
and dword [eax - 0x12], edx
invalid
Function at 0x40a37e
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x40a46c
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x48], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x44], eax
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x40a439
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x40a40e
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x40a40c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
jmp 0x40a437
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
push 0
mov ecx, dword [ebp - 0x38]
call fcn.0043396d
mov ecx, dword [ebp - 0x3c]
mov eax, dword [eax]
mov dword [ecx], eax
jmp 0x40a46a
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x54], eax
push dword [ebp - 0x4c]
push 1
push 0x5b4f
push dword [ebp - 0x50]
push dword [ebp - 0x54]
push 0x26f2
push 0
call fcn.004081e3
add esp, 0x1c
jmp 0x40a491
push 0x73a3
push 0
push 1
push 0x72e3
push 0x1e2f
push 0x7fb9
push 0x7f1d
call fcn.00425fab
add esp, 0x1c
mov esp, ebp
pop ebp
ret