joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407433
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
mov ecx, esi
call fcn.0040c612
push 0x4405c4
push dword [ebp + 8]
lea eax, [ebp - 4]
push eax
call fcn.0041bf37
add esp, 0xc
test eax, eax
je 0x40747b
cmp dword [ebp - 4], 0
je 0x407469
push dword [ebp - 4]
call fcn.0041ba96
pop ecx
push str._n_BIN_file_not_found._n
call fcn.00401036
pop ecx
xor al, al
jmp 0x407515
imul eax, dword [esi + 0xa0018], 0x4c
push ebx
xor ebx, ebx
push edi
mov edi, ebx
movzx eax, byte [eax + esi + 0x298]
mov dword [ebp + 8], eax
mov byte [ebp + 0xf], bl
jmp 0x4074ea
imul eax, dword [esi + 0xa0014], 0x120
cmp ebx, dword [eax + esi + 0xc00]
jge 0x407502
movzx ecx, byte [ebp + 0xf]
or ecx, 0xffffff00
test edi, edi
jle 0x4074c9
mov eax, edi
shl ecx, 8
or ecx, 0xff
sub eax, 1
jne 0x4074bb
mov eax, dword [esi + 0x8fb5c]
mov eax, dword [eax]
and dword [eax + ebx*4], ecx
lea ecx, [edi + 1]
cmp ecx, dword [ebp + 8]
lea eax, [ebx + 1]
cmovl eax, ebx
xor edi, edi
cmp ecx, dword [ebp + 8]
mov ebx, eax
cmovl edi, ecx
push dword [ebp - 4]
lea eax, [ebp + 0xf]
push 1
push 1
push eax
call fcn.0041c317
add esp, 0x10
cmp eax, 1
je 0x407498
cmp dword [ebp - 4], 0
pop edi
pop ebx
je 0x407513
push dword [ebp - 4]
call fcn.0041ba96
pop ecx
mov al, 1
pop esi
leave
ret 8

Function at 0x40813d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push 0x440684
push dword [ebp + 8]
lea eax, [ebp + 8]
mov byte [ebp - 1], 0
push eax
call fcn.0041bf37
add esp, 0xc
test eax, eax
je 0x40817f
cmp dword [ebp + 8], 0
je 0x40816d
push dword [ebp + 8]
call fcn.0041ba96
pop ecx
push str._nError_Opening_save_file._n
call fcn.00401036
pop ecx
xor al, al
jmp 0x408219
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
imul eax, dword [esi + 0xa0018], 0x4c
movzx ecx, byte [eax + esi + 0x298]
imul eax, dword [esi + 0xa0014], 0x120
mov dword [ebp - 8], ecx
cmp dword [eax + esi + 0xc00], edi
jle 0x408205
xor ebx, ebx
test ecx, ecx
je 0x4081f1
xor ecx, ecx
mov dword [ebp + 0xc], ecx
mov eax, dword [esi + 0x8fb5c]
push dword [ebp + 8]
push 1
mov eax, dword [eax]
push 1
mov eax, dword [eax + edi*4]
shr eax, cl
mov byte [ebp - 1], al
lea eax, [ebp - 1]
push eax
call fcn.0041be1e
add esp, 0x10
cmp eax, 1
jne 0x40821d
mov ecx, dword [ebp + 0xc]
inc ebx
add ecx, 8
mov dword [ebp + 0xc], ecx
cmp ebx, dword [ebp - 8]
jl 0x4081b7
mov ecx, dword [ebp - 8]
imul eax, dword [esi + 0xa0014], 0x120
inc edi
cmp edi, dword [eax + esi + 0xc00]
jl 0x4081ac
cmp dword [ebp + 8], 0
je 0x408214
push dword [ebp + 8]
call fcn.0041ba96
pop ecx
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 8
push str._nError_writing_to_save_file._n
call fcn.00401036
cmp dword [ebp + 8], 0
pop ecx
je 0x408237
push dword [ebp + 8]
call fcn.0041ba96
pop ecx
xor al, al
jmp 0x408216
Function at 0x40a100
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
push 1
imul eax, dword [edi + 0xa0014], 0x120
movzx esi, word [eax + edi + 0xcf0]
mov eax, dword [eax + edi + 0xc00]
cdq
idiv esi
xor esi, esi
push esi
mov ebx, eax
call fcn.0040c325
imul ecx, dword [edi + 0xa0014], 0x120
cmp word [ecx + edi + 0xc96], si
je 0x40a154
push esi
mov ecx, edi
call fcn.0040c262
push 1
push 6
mov ecx, edi
call fcn.0040c325
mov eax, ebx
mov ecx, edi
cdq
and edx, 0xff
add eax, edx
sar eax, 8
push eax
push str.Row_Erase
call fcn.0040c0a4
xor eax, eax
lea esi, [ebx - 0x100]
cmp ebx, 0x100
mov ecx, edi
cmovl esi, eax
cmp ebx, 0x100
cmovl eax, ebx
push eax
push 0x1a
call fcn.0040c325
mov ecx, edi
call fcn.0040c12f
mov ebx, esi
test esi, esi
jg 0x40a16f
xor esi, esi
mov ecx, edi
inc esi
push esi
push esi
call fcn.0040c325
imul eax, dword [edi + 0xa0014], 0x120
xor ebx, ebx
cmp word [eax + edi + 0xcd6], bx
jbe 0x40a25c
movzx ecx, word [eax + edi + 0xcd8]
xor edx, edx
movzx eax, word [eax + edi + 0xc04]
div ecx
push esi
push 0
mov ecx, edi
mov ebx, eax
call fcn.0040c325
imul edx, dword [edi + 0xa0014], 0x120
xor eax, eax
cmp word [edx + edi + 0xc88], ax
je 0x40a227
imul eax, dword [edi + 0xa0018], 0x4c
movzx ecx, byte [eax + edi + 0x294]
mov eax, dword [edx + edi + 0xc08]
cdq
idiv ecx
mov ecx, edi
push eax
call fcn.0040c262
push esi
push 8
mov ecx, edi
call fcn.0040c325
xor eax, eax
lea esi, [ebx - 0x100]
mov ecx, 0x100
cmp ebx, ecx
cmovl esi, eax
cmp ebx, ecx
mov ecx, edi
cmovl eax, ebx
push eax
push 0x1c
call fcn.0040c325
mov ebx, esi
test esi, esi
jg 0x40a227
xor esi, esi
mov ecx, edi
inc esi
push esi
push esi
call fcn.0040c325
xor ebx, ebx
imul eax, dword [edi + 0xa0014], 0x120
cmp word [eax + edi + 0xccc], bx
jbe 0x40a2cc
push esi
push ebx
mov ecx, edi
call fcn.0040c325
mov eax, dword [edi + 0xa0014]
imul ecx, eax, 0x120
cmp word [ecx + edi + 0xc96], bx
je 0x40a2ad
push dword [ecx + edi + 0xc18]
mov ecx, edi
call fcn.0040c262
push esi
push 6
mov ecx, edi
call fcn.0040c325
mov eax, dword [edi + 0xa0014]
imul eax, eax, 0x120
mov ecx, edi
movzx eax, word [eax + edi + 0xccc]
push eax
call fcn.0040a778
push esi
push esi
mov ecx, edi
call fcn.0040c325
mov ecx, edi
pop edi
pop esi
pop ebx
jmp fcn.0040c215
Function at 0x40d385
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
xor ebx, ebx
lea eax, [ebp - 1]
inc ebx
push ebx
push ebx
push eax
call fcn.0041c317
movzx esi, byte [ebp - 1]
add esp, 0x10
and esi, 0x7f
cmp byte [ebp - 1], 0x7f
jbe 0x40d3c7
push dword [ebp + 8]
lea eax, [ebp - 1]
push ebx
push ebx
push eax
call fcn.0041c317
movzx eax, byte [ebp - 1]
add esp, 0x10
shl eax, 7
add esi, eax
mov ebx, dword [ebp + 0xc]
xor edi, edi
test esi, esi
je 0x40d3ee
push dword [ebp + 8]
lea eax, [ebp - 1]
push 1
push 1
push eax
call fcn.0041c317
mov al, byte [ebp - 1]
add esp, 0x10
mov byte [edi + ebx], al
inc edi
cmp edi, esi
jl 0x40d3d0
mov byte [edi + ebx], 0
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x40fe02
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
imul eax, dword [ecx + 0xa0018], 0x4c
mov edx, dword [ebp + 0xc]
push esi
mov esi, 0xffff
movzx ecx, byte [eax + ecx + 0x28c]
mov eax, dword [ebp + 0x10]
add eax, edx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
cmp edx, eax
jae 0x40fe81
push ebx
push edi
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx + edx*4]
test ecx, ecx
je 0x40fe77
mov dword [ebp + 0x10], ecx
movzx edi, bl
push 8
shl edi, 8
shr ebx, 8
pop edx
mov ecx, edi
lea eax, [esi + esi]
xor ecx, esi
add edi, edi
mov esi, eax
xor esi, 0x11021
and ecx, 0x8000
cmove esi, eax
sub edx, 1
jne 0x40fe49
sub dword [ebp + 0x10], 1
jne 0x40fe3d
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 8]
inc edx
mov dword [ebp + 0xc], edx
cmp edx, eax
jb 0x40fe30
pop edi
pop ebx
movzx eax, si
pop esi
leave
ret 0xc

Function at 0x41276d
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x443481], 0
je 0x412824
push ebx
push esi
push edi
push 0x4434cc
push 0x4434b4
push 0x41
pop ebx
push ebx
push 0x443440
push dword [0x4434c8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0x3e8
push dword [0x4434c4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4127e0
push dword [0x4434c8]
call dword [sym.imp.KERNEL32.dll_CancelIo]
push dword [0x4434c8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [0x4434bc]
call esi
mov byte [0x443481], 0
push dword [0x4434c4]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov edi, dword [ebp + 8]
lea eax, [edi + 0x40]
cmp edi, 0x443481
ja 0x412812
mov ecx, 0x443441
cmp eax, ecx
jb 0x412812
sub ecx, edi
mov al, byte [ecx + edi]
mov byte [edi], al
inc edi
sub ebx, 1
jne 0x412805
jmp 0x41281d
push 0x10
pop ecx
mov esi, 0x443441
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov al, 1
pop ebx
jmp 0x412826
xor al, al
pop ebp
ret 4
Function at 0x41282a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x442008]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x4c], 0
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov byte [ebp - 0x48], 0
push edi
mov edi, ecx
test esi, esi
je 0x41285e
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x47]
push eax
call fcn.00414050
add esp, 0xc
inc esi
cmp esi, 0x41
jae 0x41287a
push 0x41
pop eax
sub eax, esi
push eax
lea eax, [ebp - 0x48]
add eax, esi
push 0x5a
push eax
call fcn.004137f0
add esp, 0xc
cmp byte [0x443481], 0
je 0x41292c
push 0x44348c
lea eax, [ebp - 0x4c]
push eax
push 0x41
lea eax, [ebp - 0x48]
push eax
push dword [0x4434bc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x3e8
push dword [0x4434c0]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, eax
test ebx, ebx
je 0x4128f5
cmp ebx, 0x102
jne 0x4128fb
push dword [0x4434bc]
call dword [sym.imp.KERNEL32.dll_CancelIo]
push dword [0x4434c8]
mov ebx, eax
call esi
push dword [0x4434bc]
call esi
mov byte [0x443481], 0
mov dword [edi + 0x24], 2
jmp 0x4128fb
xor ebx, ebx
inc ebx
mov dword [edi + 0x24], ebx
push dword [0x4434c0]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
test ebx, ebx
jne 0x41292e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [0x4434bc]
mov ebx, eax
call esi
push dword [0x4434c8]
call esi
mov byte [0x443481], 0
jmp 0x41292e
xor ebx, ebx
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00412976
leave
ret 8

Function at 0x423d85
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00423c04

Function at 0x424e34
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00424af4
Function at 0x402463
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
nop
nop
nop
nop
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jne 0x4024f6
push reloc.WS2_32.dll_connect
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x4024a4
mov eax, 0x4732d5
push eax
push 1
mov ebx, 0x25c
call fcn.0044f3d0
add esp, 0x10
mov dword [ebp - 4], eax
push 0x80000301
push 0
push 0x20
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc4
call fcn.0044f3e0
add esp, 0x1c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
mov eax, 0
setne al
jmp 0x402500
mov eax, 0
jmp 0x402500
mov esp, ebp
pop ebp
ret 4

Function at 0x402538
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
push reloc.WS2_32.dll_getsockname
push 0
push dword [ebp + 8]
push 1
mov ebx, 0x9dc
call fcn.0044f400
add esp, 0x10
mov dword [ebp - 8], eax
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp - 8]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
nop
nop
nop
nop
mov dword [ebp - 4], eax
cmp dword [ebp + 0x18], 0
jne 0x4025b4
cmp dword [ebp - 4], 0
je 0x4025af
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
jmp 0x4025bc
mov eax, dword [ebp - 4]
mov ebx, dword [ebp + 0x14]
mov dword [ebx], eax
cmp dword [ebp - 4], 0
mov eax, 0
setne al
jmp 0x4025cd
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4025d3
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 4
push 0x80000301
push 0
push 3
push reloc.WS2_32.dll_connect
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x402610
mov eax, 0x4732d5
push eax
push 3
mov ebx, 0x270
call fcn.0044f4e0
add esp, 0x28
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x402753
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x278
call fcn.0044f5c0
add esp, 0x10
push reloc.WS2_32.dll_connect
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x402661
mov eax, 0x4732d5
push eax
push 1
mov ebx, 0x244
call fcn.0044f1d0
add esp, 0x10
call fcn.00401780
mov dword [ebp - 8], eax
push reloc.WS2_32.dll_connect
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x402691
mov eax, 0x4732d5
push eax
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x4026a5
mov eax, 0x4732d5
push eax
push 2
mov ebx, 0x23c
call fcn.0044f1e0
add esp, 0x1c
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4026c8
push ebx
call fcn.0044a4ea
add esp, 4
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.0044ecc0
add esp, 0x10
mov dword [ebp - 8], eax
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.0044ecc0
add esp, 0x10
mov dword [ebp - 0xc], eax
push 5
push dword [ebp - 0xc]
push dword [ebp - 8]
mov ebx, dword [ebp + 8]
push dword [ebx]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
nop
nop
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x40273e
push ebx
call fcn.0044a4ea
add esp, 4
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x40274e
push ebx
call fcn.0044a4ea
add esp, 4
jmp 0x402843
push dword [ebp + 8]
call fcn.00402463
and eax, 1
xor eax, 1
test eax, eax
je 0x4027bd
call fcn.00401780
mov dword [ebp - 8], eax
push reloc.WS2_32.dll_connect
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x402786
mov eax, 0x4732d5
push eax
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x40279a
mov eax, 0x4732d5
push eax
push 2
mov ebx, 0x23c
call fcn.0044f1e0
add esp, 0x1c
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4027bd
push ebx
call fcn.0044a4ea
add esp, 4
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.0044ecc0
add esp, 0x10
mov dword [ebp - 8], eax
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.0044ecc0
add esp, 0x10
mov dword [ebp - 0xc], eax
push 5
push dword [ebp - 0xc]
push dword [ebp - 8]
mov ebx, dword [ebp + 8]
push dword [ebx]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
nop
nop
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x402833
push ebx
call fcn.0044a4ea
add esp, 4
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x402843
push ebx
call fcn.0044a4ea
add esp, 4
push 0x681182
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x90]
mov esp, ebp
pop ebp
ret 4
Function at 0x4070ba
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
push 8
call fcn.0044a4e4
add esp, 4
mov dword [ebp - 8], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0x10
call fcn.0044a4e4
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x10], 0
push 0x10
call fcn.0044a4e4
add esp, 4
mov dword [ebp - 0x14], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
nop
nop
nop
nop
mov dword [ebp - 0x18], eax
push 0x80000301
push 0
push 8
push 0x80000301
push 0
push 0x20
push 2
mov ebx, 0xc8
call fcn.0044ec60
add esp, 0x1c
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
nop
nop
nop
nop
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.0044ecc0
add esp, 0x10
mov dword [ebp - 0x18], eax
push dword [ebp - 8]
push str.SeDebugPrivilege
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
nop
nop
nop
nop
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x4071de
push ebx
call fcn.0044a4ea
add esp, 4
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 1
mov ebx, dword [ebp - 0xc]
add ebx, 4
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 8]
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0xc]
add ebx, 8
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 8]
add ebx, 4
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0xc]
add ebx, 0xc
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 2
mov eax, 0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x14]
push 0x1c
push dword [ebp - 0xc]
push 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
nop
nop
nop
nop
mov dword [ebp - 0x10], eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
mov eax, dword [ebp - 0x10]
jmp 0x407275
push eax
mov ebx, dword [ebp - 8]
push ebx
call fcn.0044a4ea
add esp, 4
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.0044a4ea
add esp, 4
mov ebx, dword [ebp - 0x14]
push ebx
call fcn.0044a4ea
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x408843
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0
push 0
mov ebx, dword [ebp + 0xc]
push dword [ebx]
mov ebx, dword [ebp + 8]
push dword [ebx]
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
nop
nop
nop
nop
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
mov eax, 0
sete al
jmp 0x408883
mov esp, ebp
pop ebp
ret 8
Function at 0x408ce9
Capabilities:
Create http request
Download and write a file
Inspect section memory permissions
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push 0x24
call fcn.0044a4e4
add esp, 4
mov dword [ebp - 4], eax
mov ebx, eax
mov edi, eax
xor eax, eax
mov ecx, 9
rep stosd dword es:[edi], eax
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov ebx, dword [ebp - 4]
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x14]
mov dword [ebx], 0
mov ebx, dword [ebp - 4]
add ebx, 4
mov dword [ebp - 0x14], ebx
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.0044ecc0
add esp, 0x10
mov dword [ebp - 0x18], eax
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.0044ecc0
add esp, 0x10
mov dword [ebp - 0x1c], eax
push 0
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
push 0
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.WININET.dll_InternetOpenA]
nop
nop
nop
nop
mov dword [ebp - 0x20], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x408db0
push ebx
call fcn.0044a4ea
add esp, 4
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x408dc0
push ebx
call fcn.0044a4ea
add esp, 4
mov eax, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x14]
mov dword [ebx], eax
mov ebx, dword [ebp - 4]
add ebx, 4
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x14]
cmp dword [ebx], 0
jne 0x408e11
push 0x6811d6
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 8]
push dword [ebp + 0x14]
push 0
push 0
push 0xffffffffffffffff
call dword [ebp + 0x10]
push 0x6811d6
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xc]
mov eax, 0xffffffff
jmp 0x4093fc
push dword [ebp + 8]
call fcn.00409440
mov dword [ebp - 0x14], eax
push str._r_nAccept_Language:_zh_cn_r_n
push dword [ebp - 0x14]
push str.Accept:_image_gif__image_x_xbitmap__image_jpeg__image_pjpeg__application_x_shockwave_flash__application_vnd.ms_excel__application_vnd.ms_powerpoint__application_msword____r_nReferer:
mov ecx, 3
call fcn.004010d5
add esp, 0xc
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x408e49
push ebx
call fcn.0044a4ea
add esp, 4
mov eax, dword [ebp - 0x18]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x408e5d
push ebx
call fcn.0044a4ea
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
Function at 0x41002c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
push dword [ebp + 8]
push dword [0x68119e]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
nop
nop
nop
nop
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x41007b
mov eax, 0x47338d
jmp 0x41013a
push dword [ebp + 8]
push dword [0x68119e]
call dword [sym.imp.KERNEL32.dll_LoadResource]
nop
nop
nop
nop
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4100a5
mov eax, 0x47338d
jmp 0x41013a
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LockResource]
nop
nop
nop
nop
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4100c9
mov eax, 0x47338d
jmp 0x41013a
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x1bc
call fcn.0044f5f0
add esp, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x4100fc
push ebx
call fcn.0044a4ea
add esp, 4
pop eax
mov dword [ebp - 0x10], eax
push dword [ebp - 4]
push dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x410110
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_RtlMoveMemory]
nop
nop
nop
nop
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x410135
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.0044a4e4
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x41013a
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x41014b
push ebx
call fcn.0044a4ea
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x41353d
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ebx, dword [0x681186]
mov dword [ebp - 4], ebx
push 0x4732d5
mov ebx, dword [ebp - 4]
push dword [ebx]
call fcn.00401c21
add esp, 8
cmp eax, 0
je 0x4135f9
mov ebx, dword [0x681186]
mov dword [ebp - 4], ebx
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.0044ecc0
add esp, 0x10
mov dword [ebp - 8], eax
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.0044ecc0
add esp, 0x10
mov dword [ebp - 0xc], eax
push 1
push dword [ebp - 0xc]
push dword [ebp - 8]
mov ebx, dword [ebp - 4]
push dword [ebx]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
nop
nop
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4135e9
push ebx
call fcn.0044a4ea
add esp, 4
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x4135f9
push ebx
call fcn.0044a4ea
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x41ad02
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ebx, dword [0x681186]
add ebx, 0x70
mov dword [ebp - 4], ebx
push 0x4732d5
mov ebx, dword [ebp - 4]
push dword [ebx]
call fcn.00401c21
add esp, 8
cmp eax, 0
je 0x41adc4
mov ebx, dword [0x681186]
add ebx, 0x70
mov dword [ebp - 4], ebx
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.0044ecc0
add esp, 0x10
mov dword [ebp - 8], eax
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.0044ecc0
add esp, 0x10
mov dword [ebp - 0xc], eax
push 1
push dword [ebp - 0xc]
push dword [ebp - 8]
mov ebx, dword [ebp - 4]
push dword [ebx]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
nop
nop
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x41adb4
push ebx
call fcn.0044a4ea
add esp, 4
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x41adc4
push ebx
call fcn.0044a4ea
add esp, 4
mov esp, ebp
pop ebp
ret