joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4165c0
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x4165fb
mov ecx, dword [ebp - 8]
call fcn.00416690
mov ecx, dword [ebp - 8]
call fcn.004166d0
or eax, 0xffffffff
jmp 0x4165fe
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8

Function at 0x4168a0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x435fe8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x441400]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x10]
call fcn.00403620
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x30]
call fcn.00416a10
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x10]
call fcn.0040c3b0
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jbe 0x4169dc
mov edx, dword [ebp - 0x14]
push edx
call fcn.00423be6
add esp, 4
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x24]
mov dword [eax], ecx
mov edx, dword [ebp - 0x30]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x18]
push edx
lea ecx, [ebp - 0x10]
call fcn.0040c3b0
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x4169dc
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x20]
push ecx
push 0x4384f0
mov edx, dword [ebp - 0x30]
mov eax, dword [edx]
push eax
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x41697e
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x20]
mov dword [ecx + 4], edx
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x20]
push ecx
push str.VarFileInfoTranslation
mov edx, dword [ebp - 0x30]
mov eax, dword [edx]
push eax
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4169af
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x20]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 0x1c]
shr eax, 2
mov ecx, dword [ebp - 0x30]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x30]
cmp dword [edx + 4], 0
je 0x4169dc
mov eax, dword [ebp - 0x30]
cmp dword [eax + 8], 0
je 0x4169dc
mov dword [ebp - 0x28], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0040de10
mov eax, dword [ebp - 0x28]
jmp 0x4169f5
mov dword [ebp - 0x2c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0040de10
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x416e60
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [eax], 0
lea ecx, [ebp - 8]
push ecx
push 0x43852c
push 1
push 0
push 0x43851c
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jge 0x416ea9
jmp 0x416edd
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ecx + 0x1c]
call eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jge 0x416ec8
jmp 0x416edd
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [eax + 0x1c]
call edx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0
je 0x416ef1
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ecx + 8]
call eax
cmp dword [ebp - 8], 0
je 0x416f05
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [edx + 8]
call ecx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x4174f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
sub edx, dword [ecx]
push edx
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
call fcn.0043457d
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jg 0x417529
jmp 0x417540
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
add edx, dword [ebp - 4]
mov eax, dword [ebp + 0x14]
mov dword [eax], edx
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
cmp edx, dword [ebp + 0x10]
jb 0x4174fd
cmp dword [ebp - 4], 0
jge 0x41756a
call fcn.00427417
mov eax, dword [eax]
push eax
call fcn.004279bc
add esp, 4
push eax
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
push ecx
call fcn.004188c0
add esp, 0xc
or eax, 0xffffffff
jmp 0x41757c
cmp dword [ebp - 4], 0
jne 0x41757a
mov edx, dword [ebp + 8]
mov dword [edx + 0x28], 1
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4232c8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x24
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov eax, dword [edx + 0x78]
mov ebx, dword [edx + 0x8c]
cmp eax, ebx
mov eax, dword [edx + 0x34]
mov ebx, dword [edx + 0x7c]
jl 0x4232ed
shr ebx, 2
dec ebx
shl ebx, 0x10
or ebx, eax
mov dword [esp], ebx
mov eax, dword [edx + 0x90]
mov ebx, dword [edx + 0x74]
cmp ebx, eax
jl 0x423305
mov ebx, eax
mov dword [esp + 0x18], ebx
mov esi, dword [edx + 0x38]
mov dword [esp + 4], esi
mov ebp, dword [edx + 0x6c]
lea edi, [ebp + esi]
mov dword [esp + 0x20], edi
mov eax, edi
neg eax
and eax, 3
mov dword [esp + 0x14], eax
mov eax, dword [edx + 0x2c]
sub eax, 0x106
sub ebp, eax
jg 0x423334
xor ebp, ebp
mov eax, dword [edx + 0x78]
mov dword [esp + 0x1c], eax
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [edi]
mov dword [esp + 0x10], ebx
movzx ebx, word [eax + edi - 1]
mov dword [esp + 0xc], ebx
mov edi, dword [edx + 0x40]
mov edx, dword [esp]
jmp 0x423376
and ecx, edx
movzx ecx, word [edi + ecx*2]
cmp ecx, ebp
jbe 0x42344a
sub edx, 0x10000
js 0x42344a
movzx eax, word [ecx + esi - 1]
cmp eax, ebx
jne 0x42335c
mov eax, dword [esp + 4]
movzx eax, word [ecx + eax]
cmp eax, dword [esp + 0x10]
jne 0x42335c
mov dword [esp], edx
mov esi, dword [esp + 4]
mov edi, dword [esp + 0x20]
add esi, ecx
mov eax, dword [esp + 0x14]
mov edx, 0xfffffef8
lea edi, [eax + edi + 0x108]
lea esi, [eax + esi + 0x108]
mov eax, dword [edx + esi]
xor eax, dword [edx + edi]
jne 0x4233cd
mov eax, dword [edx + esi + 4]
xor eax, dword [edx + edi + 4]
jne 0x4233ca
add edx, 8
jne 0x4233b1
jmp 0x42343b
add edx, 4
test eax, 0xffff
jne 0x4233da
add edx, 2
shr eax, 0x10
sub al, 1
adc edx, 0
lea eax, [edx + edi]
mov edi, dword [esp + 0x20]
sub eax, edi
cmp eax, 0x102
jge 0x42343b
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
cmp eax, ebx
jg 0x42340e
mov esi, dword [esp + 8]
mov edi, dword [edx + 0x40]
mov ebx, dword [esp + 0xc]
mov edx, dword [esp]
jmp 0x42335c
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
mov dword [edx + 0x70], ecx
cmp eax, ebx
jge 0x42344a
mov esi, dword [esp + 4]
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [eax + edi - 1]
mov edi, dword [edx + 0x40]
mov dword [esp + 0xc], ebx
mov edx, dword [esp]
jmp 0x42335c
mov edx, dword [esp + 0x38]
mov dword [esp + 0x1c], 0x102
mov dword [edx + 0x70], ecx
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
mov eax, dword [edx + 0x74]
cmp ebx, eax
jg 0x42345b
mov eax, ebx
add esp, 0x24
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x423ff6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x441400]
jne 0x424000
repz ret
jmp fcn.004289eb
Function at 0x431354
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004299f8
and dword [ebp - 4], 0
cmp dword [0x4434e4], 0
mov ebx, eax
jne 0x431405
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4314b6
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x43db8c
push edi
call esi
test eax, eax
je 0x4314b6
push eax
call fcn.00429986
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4434e4], eax
call esi
push eax
call fcn.00429986
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4434e8], eax
call esi
push eax
call fcn.00429986
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4434ec], eax
call esi
push eax
call fcn.00429986
pop ecx
mov dword [0x4434f4], eax
test eax, eax
je 0x431405
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00429986
pop ecx
mov dword [0x4434f0], eax
mov eax, dword [0x4434f0]
cmp eax, ebx
je 0x43145d
cmp dword [0x4434f4], ebx
je 0x43145d
push eax
call fcn.00429a01
push dword [0x4434f4]
mov esi, eax
call fcn.00429a01
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x43145d
test edi, edi
je 0x43145d
call esi
test eax, eax
je 0x431454
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x431454
test byte [ebp - 0xc], 1
jne 0x43145d
or dword [ebp + 0x10], 0x200000
jmp 0x431496
mov eax, dword [0x4434e8]
cmp eax, ebx
je 0x431496
push eax
call fcn.00429a01
pop ecx
test eax, eax
je 0x431496
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x431496
mov eax, dword [0x4434ec]
cmp eax, ebx
je 0x431496
push eax
call fcn.00429a01
pop ecx
test eax, eax
je 0x431496
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4434e4]
call fcn.00429a01
pop ecx
test eax, eax
je 0x4314b6
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4314b8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401760
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401779
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4017b4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x4017b0
lea ebx, [ebx]
cmp esi, eax
jae 0x4017b4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4017a0
cmp esi, eax
jb 0x4017ba
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x40bba0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x138
mov eax, dword [0x4a1620]
xor eax, esp
mov dword [esp + 0x130], eax
push ebp
push esi
push edi
push 0xffffffffffffffff
mov esi, ecx
push 0
mov ecx, ebx
call fcn.0045147c
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebp, eax
lea eax, [esp + 0x10]
push eax
push ebp
mov dword [esp + 0x18], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40bbf9
push 0x40
push str.Notice
push str.The_frist_entry_of_the_process_list_has_not_been_copyied_to_the_buffer
mov ecx, esi
call fcn.00447772
lea ecx, [esp + 0x10]
push ecx
push ebp
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x40bc57
jmp 0x40bc10
lea edi, [esp + 0x34]
mov esi, str.ElementClient.exe
mov ecx, 0x12
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x40bc38
lea edi, [esp + 0x34]
mov esi, str.elementclient.exe
mov ecx, 0x12
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x40bc48
mov ecx, dword [esp + 0x18]
mov edx, dword [ebx + 8]
push ecx
push edx
mov ecx, ebx
call fcn.004515a0
lea eax, [esp + 0x10]
push eax
push ebp
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40bc10
mov ecx, dword [esp + 0x13c]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.00465b73
add esp, 0x138
ret
Function at 0x4111f0
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push 0xffffffffffffffff
push 0x47e788
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x4a1620]
xor eax, esp
mov dword [esp + 0x3c], eax
push ebx
push ebp
push edi
mov eax, dword [0x4a1620]
xor eax, esp
push eax
lea eax, [esp + 0x54]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x5c], ebx
xor edi, edi
cmp dword [esi + 0x38c], ebx
jle 0x411278
cmp edi, ebx
jl 0x4113bf
cmp edi, dword [esi + 0x378]
jge 0x4113bf
mov eax, dword [esi + 0x374]
lea eax, [eax + edi*4]
mov eax, dword [eax]
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
je 0x4112c0
mov ecx, dword [esp + 0x64]
push eax
push ecx
call fcn.00466452
add esp, 8
cmp eax, ebx
je 0x4112ca
add edi, 1
cmp edi, dword [esi + 0x38c]
jl 0x411231
mov dword [esp + 0x5c], 0xffffffff
mov eax, dword [esp + 0x64]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4112a0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.00465b73
add esp, 0x50
ret 4
push 0x80004005
call fcn.004012e0
push 0x38
lea edx, [esp + 0x18]
push ebx
push edx
call fcn.00467720
add esp, 0xc
cmp edi, dword [esi + 0x38c]
jge 0x4113bf
cmp byte [esi + 0x301], 1
mov eax, dword [esi + 0x388]
mov ecx, dword [eax + edi*4]
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
lea eax, [eax + edi*4]
mov dword [esp + 0x14], ecx
jne 0x411319
mov byte [esi + 0x301], bl
mov dword [0x4a5c64], ebx
mov dword [0x4a5c60], ebx
jmp 0x411322
mov eax, dword [0x4a5c64]
cmp eax, ebx
jne 0x41133a
mov edx, dword [esi + 0xbc]
push 4
push 0x1000
push 0x38
push ebx
push edx
call ebp
mov dword [0x4a5c64], eax
mov edx, dword [esi + 0xbc]
mov edi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push ebx
push 0x38
lea ecx, [esp + 0x1c]
push ecx
push eax
push edx
call edi
mov eax, dword [0x4a5c60]
cmp eax, ebx
jne 0x411378
mov eax, dword [esi + 0xb4]
mov ecx, dword [esi + 0xbc]
push 0x40
push 0x3000
push eax
push ebx
push ecx
call ebp
mov dword [0x4a5c60], eax
mov edx, dword [esi + 0xb4]
push ebx
push edx
push 0x442a40
push eax
mov eax, dword [esi + 0xbc]
push eax
call edi
mov edx, dword [0x4a5c64]
mov eax, dword [0x4a5c60]
lea ecx, [esi + 0xc0]
push ecx
mov ecx, dword [esi + 0xbc]
push ebx
push edx
push eax
push ebx
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x411278
call fcn.0044c4a2
int3
Function at 0x412a30
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 8
cmp byte [0x4a5c84], 0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
jne case.default.0x412a67
call edi
mov dword [0x4a5c80], eax
mov eax, dword [0x4a5c7c]
cmp eax, 3
mov ecx, 1
mov byte [0x4a5c84], cl
ja case.default.0x412a67
jmp dword [eax*4 + 0x412b1c]
mov dword [0x4a5c7c], ecx
mov dword [0x4a5c78], 0x927c0
jmp case.default.0x412a67
push ecx
mov ecx, esp
mov dword [esp + 0xc], esp
push 0x48e9ec
call fcn.004014f0
mov ecx, esi
call fcn.004110b0
mov dword [0x4a5c7c], 2
jmp 0x412aea
push ecx
mov ecx, esp
mov dword [esp + 0xc], esp
push 0x48e9f8
call fcn.004014f0
mov ecx, esi
call fcn.004110b0
mov dword [0x4a5c7c], 3
jmp 0x412aea
push ecx
mov ecx, esp
mov dword [esp + 0xc], esp
push 0x48ea04
call fcn.004014f0
mov ecx, esi
call fcn.004110b0
mov dword [0x4a5c7c], 0
mov dword [0x4a5c78], 0xbb8
call edi
sub eax, dword [0x4a5c80]
cmp eax, dword [0x4a5c78]
jl 0x412b15
mov dword [0x4a5c78], 0
mov byte [0x4a5c84], 0
pop edi
add esp, 8
ret
Function at 0x414c70
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0xffffffffffffffff
push 0x482a40
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4a1620]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
cmp byte [0x4a5df8], 0
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
jne case.default.0x414ccd
call ebp
mov dword [0x4a5df4], eax
mov eax, dword [edi + 0x318]
cmp eax, 5
mov ebx, 1
mov byte [0x4a5df8], bl
ja case.default.0x414ccd
jmp dword [eax*4 + 0x414f14]
mov eax, dword [edi + 0x4624]
xor ecx, ecx
cmp dword [eax + 0x80], ecx
jle 0x414cff
mov edx, dword [eax + 0x7c]
cmp edx, dword [edi + 0x324]
jge 0x414cff
cmp dword [edi + 0x320], ecx
je 0x414cff
add dword [edi + 0x31c], ebx
jmp 0x414d05
mov dword [edi + 0x31c], ecx
mov ecx, dword [edi + 0x31c]
cmp ecx, dword [eax + 0x80]
jle case.default.0x414ccd
mov dword [edi + 0x318], ebx
jmp case.default.0x414ccd
mov edx, dword [edi + 0x4624]
xor eax, eax
mov dword [edi + 0x330], eax
mov dword [edi + 0x320], eax
mov eax, dword [edx + 0x84]
mov dword [edi + 0x48b0], eax
mov byte [edi + 0x48c0], bl
mov dword [edi + 0x318], 2
jmp case.default.0x414ccd
lea ecx, [esp + 0x14]
call fcn.00402440
mov dword [esp + 0x28], 0
mov eax, dword [edi + 0x4624]
lea ecx, [esp + 0x14]
push ecx
add eax, 0xe8
call fcn.004445a0
push 0x48e6f0
lea ecx, [esp + 0x18]
call fcn.00405570
test eax, eax
jne 0x414eba
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x48e6f0
call fcn.004014f0
mov ecx, edi
call fcn.0041a3a0
cmp al, bl
jne 0x414ec0
add dword [edi + 0x318], 3
lea ecx, [esp + 0x14]
mov dword [0x4a5df0], 0x3a98
call fcn.004010b0
jmp case.default.0x414ccd
lea ecx, [esp + 0x14]
call fcn.00402440
mov dword [esp + 0x28], ebx
mov eax, dword [edi + 0x4624]
lea edx, [esp + 0x14]
push edx
add eax, 0xe8
call fcn.004445a0
push 0x48c9fc
lea ecx, [esp + 0x18]
call fcn.00405570
test eax, eax
jne 0x414eba
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x48c9fc
call fcn.004014f0
mov ecx, edi
call fcn.0041a3a0
cmp al, bl
jne 0x414ec0
add dword [edi + 0x318], 2
lea ecx, [esp + 0x14]
mov dword [0x4a5df0], 0x3a98
call fcn.004010b0
jmp case.default.0x414ccd
lea ecx, [esp + 0x14]
call fcn.00402440
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x2c], 2
mov eax, dword [edi + 0x4624]
add eax, 0xe8
call fcn.004445a0
xor ecx, ecx
mov edx, 0x48e018
lea esi, [esp + 0x14]
call fcn.004055a0
test eax, eax
jl 0x414ec0
push 6
lea ecx, [esp + 0x1c]
push ecx
mov ecx, esi
call fcn.00436a00
mov byte [esp + 0x28], 3
mov eax, dword [eax]
push eax
call fcn.004669bd
add esp, 4
push eax
call fcn.00418f30
lea ecx, [esp + 0x18]
call fcn.004010b0
mov dword [edi + 0x48bc], 0x3a98
add dword [edi + 0x318], ebx
lea ecx, [esp + 0x14]
call fcn.004010b0
jmp case.default.0x414ccd
xor eax, eax
mov dword [edi + 0x330], ebx
mov dword [edi + 0x318], eax
mov dword [edi + 0x31c], eax
call ebp
sub eax, dword [0x4a5df4]
cmp eax, dword [0x4a5df0]
jl 0x414f00
mov dword [0x4a5df0], 0
mov byte [0x4a5df8], 0
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x4157d0
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x40
mov eax, dword [0x4a1620]
xor eax, esp
mov dword [esp + 0x3c], eax
push ebx
push edi
push 0x38
xor edi, edi
lea eax, [esp + 0x10]
push edi
push eax
call fcn.00467720
lea eax, [esp + 0x40]
add esp, 0xc
add eax, 0xffffffff
nop
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x415800
cmp byte [esi + 0x304], 1
mov ecx, dword [str.IDCANCEL]
mov edx, dword [0x48eba8]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [eax], ecx
mov cl, byte [0x48ebac]
mov dword [eax + 4], edx
mov byte [eax + 8], cl
jne 0x415848
mov byte [esi + 0x304], 0
mov dword [0x4a5bd0], edi
mov dword [0x4a5bcc], edi
jmp 0x415851
mov eax, dword [0x4a5bd0]
cmp eax, edi
jne 0x415869
mov edx, dword [esi + 0xbc]
push 4
push 0x1000
push 0x38
push edi
push edx
call ebx
mov dword [0x4a5bd0], eax
mov edx, dword [esi + 0xbc]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0x38
lea ecx, [esp + 0x14]
push ecx
push eax
push edx
mov dword [esp + 0x20], eax
call edi
mov eax, dword [0x4a5bcc]
test eax, eax
jne 0x4158ac
mov eax, dword [esi + 0xb4]
mov ecx, dword [esi + 0xbc]
push 0x40
push 0x3000
push eax
push 0
push ecx
call ebx
mov dword [0x4a5bcc], eax
mov edx, dword [esi + 0xb4]
push 0
push edx
push 0x442ac0
push eax
mov eax, dword [esi + 0xbc]
push eax
call edi
mov edx, dword [0x4a5bd0]
mov eax, dword [0x4a5bcc]
lea ecx, [esi + 0xc0]
push ecx
mov ecx, dword [esi + 0xbc]
push 0
push edx
push eax
push 0
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x44]
pop edi
pop ebx
xor ecx, esp
call fcn.00465b73
mov esp, ebp
pop ebp
ret
Function at 0x415a20
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x50
push ebx
push edi
push 0x50
xor ebx, ebx
lea eax, [esp + 0xc]
push ebx
push eax
call fcn.00467720
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x14], ecx
mov ecx, dword [ebp + 0x18]
mov dword [esp + 0x18], edx
mov edx, dword [ebp + 0x1c]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0x20]
mov dword [esp + 0x20], ecx
mov ecx, dword [ebp + 0x24]
mov dword [esp + 0x24], edx
mov edx, dword [ebp + 0x28]
mov dword [esp + 0x28], eax
mov eax, dword [ebp + 0x2c]
mov dword [esp + 0x2c], ecx
mov ecx, dword [ebp + 0x30]
mov dword [esp + 0x30], edx
mov edx, dword [ebp + 0x34]
mov dword [esp + 0x34], eax
mov eax, dword [ebp + 0x38]
mov dword [esp + 0x38], ecx
mov ecx, dword [esi + 0x2dc]
mov dword [esp + 0x3c], edx
mov edx, dword [ebp + 8]
add esp, 0xc
cmp byte [esi + 0x305], 1
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x54], edx
jne 0x415ad7
mov byte [esi + 0x305], bl
mov dword [0x4a5bc8], ebx
mov dword [0x4a5bc4], ebx
jmp 0x415ae0
mov eax, dword [0x4a5bc8]
cmp eax, ebx
jne 0x415afc
mov eax, dword [esi + 0xbc]
push 4
push 0x1000
push 0x50
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [0x4a5bc8], eax
mov edx, dword [esi + 0xbc]
mov edi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push ebx
push 0x50
lea ecx, [esp + 0x10]
push ecx
push eax
push edx
call edi
mov eax, dword [0x4a5bc4]
cmp eax, ebx
jne 0x415b3e
mov eax, dword [esi + 0xb4]
mov ecx, dword [esi + 0xbc]
push 0x40
push 0x3000
push eax
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [0x4a5bc4], eax
mov edx, dword [esi + 0xb4]
push ebx
push edx
push 0x442b60
push eax
mov eax, dword [esi + 0xbc]
push eax
call edi
mov edx, dword [0x4a5bc8]
mov eax, dword [0x4a5bc4]
lea ecx, [esi + 0xc0]
push ecx
mov ecx, dword [esi + 0xbc]
push ebx
push edx
push eax
push ebx
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0x34
Function at 0x4185b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp byte [0x4a5bc0], 0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
jne 0x4185ce
call edi
mov dword [0x4a5bbc], eax
mov byte [0x4a5bc0], 1
call edi
sub eax, dword [0x4a5bbc]
pop edi
cmp eax, dword [esi + 0x48bc]
jl 0x4185f7
mov byte [0x4a5bc0], 0
mov byte [esi + 0x48b8], 1
mov dword [esi + 0x48bc], 0
ret