joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49a7b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50e878
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x551758]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
cmp byte [esi + 0x20], 0
jne 0x49a7f7
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x18], 1
jbe 0x49a833
lea eax, [ebp - 0x14]
push eax
push 0
push esi
push 0x49af00
push 0
push 0
call fcn.004e8801
xor ecx, ecx
mov dword [esi + 0x10], eax
add esp, 0x18
test eax, eax
setne cl
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ebx, [esi + 0x60]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push dword [esi + 0x44]
call sub.gdiplus.dll_GdipCreateFromHDC
mov edi, dword [ebp - 0x10]
mov esi, eax
mov dword [ebp - 0x1c], edi
push 0xffffffffffffffff
push edi
mov dword [ebp - 4], 0
call sub.gdiplus.dll_GdipGraphicsClear
test eax, eax
cmovne esi, eax
mov eax, dword [ebp - 0x14]
push dword [eax + 0x2c]
push dword [eax + 0x28]
push 0
push 0
push dword [eax + 4]
push edi
call sub.gdiplus.dll_GdipDrawImageRectI
test eax, eax
push ebx
cmovne esi, eax
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [ebp - 0x14]
mov ecx, dword [esi + 0x4c]
call fcn.00437030
mov ecx, esi
call fcn.0049abc0
push edi
call sub.gdiplus.dll_GdipDeleteGraphics
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a0ed0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004a0aa0
Function at 0x4a21b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50ebe3
mov eax, dword fs:[0]
push eax
sub esp, 0x84
mov eax, dword [0x551758]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x80], 0
mov dword [edi], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x7c], 0
lea eax, [ebp - 0x7c]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.004289d0
mov eax, dword [ebp - 0x80]
add esp, 8
test eax, eax
je 0x4a23c3
mov esi, dword [sym.imp.OLEAUT32.dll_VariantInit]
push eax
call esi
test eax, eax
je 0x4a23c3
mov eax, dword [ebp - 0x7c]
test eax, eax
je 0x4a23c3
push eax
call esi
test eax, eax
je 0x4a23c3
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x88], 0
push 0x201
push dword [ebp - 0x80]
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 2
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004a2100
mov esi, dword [ebp - 0x90]
test eax, eax
jne 0x4a23b4
push 0x64
lea eax, [ebp - 0x74]
push 0
push eax
call fcn.004dfe60
add esp, 0xc
mov dword [ebp - 0x78], 0x64
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x84]
push eax
push 0
push dword [ebp - 0x7c]
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4a23b4
mov eax, dword [ebp - 0x84]
cmp eax, 1
je 0x4a22db
cmp eax, 2
jne 0x4a23b4
mov ecx, dword [ebp - 0x78]
test ecx, ecx
je 0x4a22fc
test cl, 1
jne 0x4a23b4
mov eax, ecx
shr eax, 1
cmp word [ebp + eax*2 - 0x76], 0
je 0x4a2302
jmp 0x4a23b4
xor eax, eax
mov word [ebp - 0x74], ax
shr ecx, 1
cmp ecx, 0x2d
jne 0x4a23b4
lea ecx, [ebp - 0x78]
call fcn.0040eaf0
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x78]
call fcn.004a05e0
lea eax, [ebp - 0x84]
mov dword [ebp - 0x84], 0
push eax
lea eax, [ebp - 0x20]
push 0x5297a8
push eax
call fcn.004a27c0
push 0x2a
push dword [ebp - 0x78]
call fcn.004a0aa0
movzx eax, al
add esp, 0x14
cmp dword [ebp - 0x84], eax
jne 0x4a23ac
lea edx, [ebp - 0x74]
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4a2362
sub edx, ecx
lea eax, [ebp - 0x74]
sar edx, 1
mov ecx, ebx
push edx
push eax
call fcn.004a03a0
push dword [0x55177c]
lea eax, [ebp - 0x74]
push dword [0x551778]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x4a239d
mov dword [edi], 1
lea ecx, [ebp - 0x78]
call fcn.00404890
mov edi, 1
jmp 0x4a23b6
lea ecx, [ebp - 0x78]
call fcn.00404890
xor edi, edi
test esi, esi
je 0x4a23c5
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4a23c5
xor edi, edi
push dword [ebp - 0x7c]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call esi
push dword [ebp - 0x80]
call esi
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049e374
mov esp, ebp
pop ebp
ret
Function at 0x4a2400
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, ecx
test edx, edx
jne 0x4a2415
lea eax, [edx + 0xd]
pop esi
pop ebp
ret 0xc
mov eax, edx
push edi
lea edi, [eax + 2]
nop dword [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4a2420
sub eax, edi
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push dword [ebp + 0x10]
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x4a5640
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], 0
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4a56b1
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x4a567f
cmp eax, 2
jne 0x4a569b
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x4a56ab
test ecx, ecx
je 0x4a56a6
test cl, 1
jne 0x4a569b
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], 0
je 0x4a56ab
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x4a91dc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x4fb7cf
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
and eax, 0x3f
mov edx, dword [ebp + 0xc]
push ebx
sar ecx, 6
push esi
push edi
imul edi, eax, 0x30
mov eax, dword [ecx*4 + 0x55dcc0]
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4fb810
cmp byte [edx], 0xa
jne 0x4fb810
or byte [eax + edi + 0x28], 4
jmp 0x4fb815
and byte [eax + edi + 0x28], 0xfb
lea eax, [edx + ecx]
mov ebx, edx
mov dword [ebp - 8], eax
mov esi, edx
cmp edx, eax
jae 0x4fb906
mov al, byte [ebx]
cmp al, 0x1a
je 0x4fb8e7
cmp al, 0xd
je 0x4fb83e
mov byte [esi], al
inc esi
inc ebx
jmp 0x4fb8dc
lea eax, [ebx + 1]
cmp eax, dword [ebp - 8]
jae 0x4fb85e
cmp byte [eax], 0xa
jne 0x4fb853
push 2
mov byte [esi], 0xa
pop eax
jmp 0x4fb859
xor eax, eax
mov byte [esi], 0xd
inc eax
add ebx, eax
inc esi
jmp 0x4fb8dc
push 0
mov ebx, eax
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4fb8d5
cmp dword [ebp - 0x14], 0
je 0x4fb8d5
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x55dcc0]
test byte [eax + edi + 0x28], 0x48
je 0x4fb8ac
mov dl, byte [ebp - 1]
cmp dl, 0xa
jne 0x4fb89c
mov byte [esi], dl
jmp 0x4fb8d8
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x55dcc0]
mov byte [eax + edi + 0x2a], dl
jmp 0x4fb8d8
cmp byte [ebp - 1], 0xa
jne 0x4fb8be
mov edx, dword [ebp + 0xc]
cmp esi, edx
jne 0x4fb8be
mov byte [esi], 0xa
jmp 0x4fb85b
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.004e7c17
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x4fb8d9
mov byte [esi], 0xd
inc esi
mov edx, dword [ebp + 0xc]
cmp ebx, dword [ebp - 8]
jb 0x4fb827
jmp 0x4fb906
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x55dcc0]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4fb901
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4fb906
mov cl, byte [ebx]
mov byte [esi], cl
inc esi
sub esi, edx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4fb911
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
and eax, 0x3f
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
sar ecx, 6
imul edi, eax, 0x30
mov dword [ebp - 8], ecx
push 0xa
mov eax, dword [ecx*4 + 0x55dcc0]
pop ebx
mov edx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], edx
mov edx, dword [ebp + 0xc]
test esi, esi
je 0x4fb955
cmp word [edx], bx
jne 0x4fb955
or byte [edi + eax + 0x28], 4
jmp 0x4fb95a
and byte [edi + eax + 0x28], 0xfb
lea eax, [edx + esi*2]
mov ebx, edx
mov dword [ebp - 0xc], eax
mov esi, edx
cmp edx, eax
jae 0x4fbaae
mov dword [ebp - 0x10], 0xd
movzx eax, word [ebx]
cmp eax, 0x1a
je 0x4fba8e
cmp ax, word [ebp - 0x10]
je 0x4fb993
mov word [esi], ax
add esi, 2
add ebx, 2
jmp 0x4fba83
lea eax, [ebx + 2]
cmp eax, dword [ebp - 0xc]
jae 0x4fb9b9
push 0xa
pop ecx
cmp word [eax], cx
jne 0x4fb9a9
push ecx
pop eax
push 4
jmp 0x4fb9ae
push 0xd
pop eax
push 2
mov word [esi], ax
pop eax
add ebx, eax
jmp 0x4fba7d
push 0
mov ebx, eax
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4fba74
cmp dword [ebp - 0x18], 0
je 0x4fba74
mov ecx, dword [ebp - 8]
push 0xa
mov eax, dword [ecx*4 + 0x55dcc0]
test byte [edi + eax + 0x28], 0x48
pop eax
je 0x4fba40
mov dx, word [ebp - 4]
cmp dx, ax
jne 0x4fba04
mov word [esi], ax
jmp 0x4fba38
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ecx*4 + 0x55dcc0]
mov word [ebp - 0x20], dx
push 0xa
mov byte [edi + eax + 0x2a], dl
mov ecx, dword [ecx*4 + 0x55dcc0]
mov al, byte [ebp - 0x1f]
pop edx
mov byte [edi + ecx + 0x2b], al
mov ecx, dword [ebp - 8]
mov eax, dword [ecx*4 + 0x55dcc0]
mov byte [edi + eax + 0x2c], dl
mov edx, dword [ebp + 0xc]
add esi, 2
jmp 0x4fba83
cmp word [ebp - 4], ax
jne 0x4fba55
mov edx, dword [ebp + 0xc]
cmp esi, edx
jne 0x4fba55
mov word [esi], ax
add esi, 2
jmp 0x4fba83
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.004e7c17
mov edx, dword [ebp + 0xc]
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x4fba80
jmp 0x4fba77
mov edx, dword [ebp + 0xc]
push 0xd
pop eax
mov word [esi], ax
add esi, 2
mov ecx, dword [ebp - 8]
cmp ebx, dword [ebp - 0xc]
jb 0x4fb973
jmp 0x4fbaae
mov ecx, dword [ecx*4 + 0x55dcc0]
mov al, byte [edi + ecx + 0x28]
test al, 0x40
jne 0x4fbaa5
or al, 2
mov byte [edi + ecx + 0x28], al
jmp 0x4fbaae
mov cx, word [ebx]
mov word [esi], cx
add esi, 2
sub esi, edx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x501b22
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005017c4
Function at 0x100031c7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x100031d6
pop dword [ebp - 0x50]
mov eax, 0x7b0a0d59
sub eax, 0x6b09db83
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0xd5e980aa
add dword [ebp - 0x60], 0x7868c4a1
mov dword [ebp - 0x5c], 0x31d2d1a1
sub dword [ebp - 0x5c], 0xff9f855c
mov dword [ebp - 0x58], 0xc73cc83c
add dword [ebp - 0x58], 0x850f7bf2
mov dword [ebp - 0x54], 0xb05f067
sub dword [ebp - 0x54], 0xb05f067
lea eax, [ebp - 0x60]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xac149513
add dword [ebp - 0x60], 0xc85dd443
mov dword [ebp - 0x5c], 0xa45db7ec
sub dword [ebp - 0x5c], 0x62f15677
mov dword [ebp - 0x58], 0x5e9f778c
add dword [ebp - 0x58], 0x4cff4e0
mov dword [ebp - 0x54], 0xb5722ea5
add dword [ebp - 0x54], 0x4a8dd15b
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0x1cf05925
sub eax, 0xceed8c5
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3c538
push 0
call eax
mov ecx, 0x7d90f9ab
add ecx, 0x826f51c7
mov edx, eax
mov ebx, 0x3e12013d
sub ebx, 0x2e0f8f3d
add ebx, dword [ebp - 0x50]
mov edi, 0x59d09c93
sub edi, 0x2d0c9850
mov dword [ebp - 0x30], 0x9c11347a
mov esi, dword [ebx]
sub dword [ebp - 0x20], ebx
xor esi, edi
mov dword [edx], esi
add dword [ebp - 0x44], ebx
add edx, 0xf88c4da7
add edx, 0x773b25d
add ebx, 4
loop 0x100032f3
add eax, 0x5c6630cd
add eax, 0xa39aefce
mov ebx, eax
add eax, 0x6dcb10c9
add eax, 0x9234ef3c
mov ecx, 0x11f71818
sub ecx, 0x1f71818
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x401e50
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push edi
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
lea ecx, [esp + 0x14]
mov edx, dword [esp + 0x5c]
push eax
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push edx
mov dword [esp + 0x3c], 0x44
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
pop edi
add esp, 0x54
ret

Function at 0x402000
Capabilities:
Read file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx]
lea eax, [esp + 8]
push 0
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov eax, dword [esp + 8]
ret 8

Function at 0x402030
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx]
lea eax, [esp + 8]
push 0
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
ret 8

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..rsrc
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
nop
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x75a07880
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x433060
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
je 0x4330d2
nop
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x696b3547
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x401280
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4012d9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4012d9
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x4012c8
cmp esi, edx
jae 0x4012d9
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x4012b6
cmp esi, edx
jae 0x4012d9
cmp word [esi], 0
je 0x4012d9
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x403030
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
mov eax, dword [0x437070]
xor eax, esp
mov dword [esp + 0x14], eax
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x40306f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, str.Error_in_OpenProcessToken:
jmp 0x4030dd
lea eax, [esp + 8]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0
push 0
push 0
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 1
push eax
push 0
push dword [esp + 0x14]
mov dword [esp + 0x28], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4030b9
mov edx, str.Error_calling_AdjustTokenPrivileges:
jmp 0x4030dd
push 0x40002
push 1
push 1
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownExW]
test eax, eax
jne 0x4030f7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, str.Error_calling_InitiateSystemShutdownEx:
push eax
push ecx
call fcn.00405bc0
add esp, 4
mov ecx, eax
call fcn.004035c0
push eax
call fcn.00405e80
add esp, 4
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.004092eb
mov esp, ebp
pop ebp
ret
Function at 0x40809f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x437070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov eax, 0xffff
push edi
mov edi, ecx
cmp ax, bx
jne 0x4080c4
xor eax, eax
jmp 0x408120
mov eax, dword [edi + 0x20]
push esi
mov ecx, dword [eax]
test ecx, ecx
je 0x4080f1
mov edx, dword [edi + 0x30]
mov esi, dword [edx]
lea eax, [ecx + esi*2]
cmp ecx, eax
jae 0x4080f1
lea ecx, [esi - 1]
mov dword [edx], ecx
mov edx, dword [edi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], bx
jmp 0x4081a5
cmp dword [edi + 0x4c], 0
je 0x40811a
mov ecx, edi
call fcn.00407ca1
mov eax, dword [edi + 0x38]
mov dword [ebp - 0x2c], eax
test eax, eax
jne 0x408130
push dword [edi + 0x4c]
push ebx
call fcn.00407520
pop ecx
test al, al
movzx eax, bx
pop ecx
jne 0x40811f
mov eax, 0xffff
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.004092eb
leave
ret 4
mov word [ebp - 0x28], bx
mov eax, dword [eax]
mov esi, dword [eax + 0x1c]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 4]
mov ecx, esi
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x26]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [edi + 0x40]
push eax
call dword [0x4261b0]
mov ecx, dword [ebp - 0x2c]
call esi
test eax, eax
js 0x40811a
cmp eax, 1
jle 0x408178
cmp eax, 3
jne 0x40811a
push dword [edi + 0x4c]
push dword [ebp - 0x28]
jmp 0x40810c
mov esi, dword [ebp - 0x30]
lea eax, [ebp - 0x24]
sub esi, eax
je 0x408195
push dword [edi + 0x4c]
push esi
push 1
push eax
call fcn.0041289e
add esp, 0x10
cmp esi, eax
jne 0x40811a
lea eax, [ebp - 0x28]
mov byte [edi + 0x3e], 1
cmp dword [ebp - 0x34], eax
je 0x40811a
mov ax, bx
jmp 0x40811f

Function at 0x4199b7
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041965e

Function at 0x4199c2
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004197e8
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x432030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x406650
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x41e91b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
lea ecx, [esi + 4]
mov dword [esi], 0x4043d4
call fcn.004091c4
push 4
mov dword [esp + 0x18], 0
call fcn.0040a8a3
mov edi, eax
add esp, 4
test edi, edi
je 0x4066c4
push ebx
call fcn.00408fbf
mov dword [edi], eax
call fcn.00408d7e
push 0
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.00409185
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x4066b8
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0xc]
call fcn.004091ad
pop ebx
jmp 0x4066c6
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x40b39b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4223ec]
jne 0x40b3a5
repz ret
jmp fcn.004125ac