joyce8/EMBER2024-capa huggingface dataset:
Function at 0x478820
Capabilities:
Encode data using xor
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ef9d0
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x52910c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], 0x7a080826
mov dword [ebp - 0x2c], 0x40484945
mov dword [ebp - 0x28], 0x4f08414f
mov word [ebp - 0x24], 0x4f48
mov byte [ebp - 0x22], 0
lea ecx, [ebp - 0x48]
mov dword [ebp - 4], 0
call fcn.004797c0
mov byte [ebp - 4], 1
xor ecx, ecx
nop
mov dl, byte [ebp + ecx - 0x2f]
xor dl, byte [ebp - 0x30]
mov byte [ebp + ecx - 0x21], dl
inc ecx
cmp ecx, 0xd
jb 0x478880
lea ecx, [ebp - 0x21]
mov byte [ebp - 0x14], 0
push ecx
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.00407900
mov eax, dword [ebp - 0x34]
add esp, 0xc
cmp eax, 0x10
jb 0x4788bb
inc eax
lea ecx, [ebp - 0x48]
push eax
push dword [ebp - 0x48]
call fcn.004099a0
cmp dword [ebp - 0x4c], 0x10
lea esi, [ebp - 0x60]
mov bh, 0xb
mov dword [ebp - 0x20], 0x54565437
cmovae esi, dword [ebp - 0x60]
mov al, 0x54
mov byte [ebp - 0x61], bh
mov dl, al
mov bh, 3
mov dword [ebp - 0x44], 0xb0a0665
mov byte [ebp - 0x62], bh
mov cl, 0x56
mov bh, 0xc
mov word [ebp - 0x1c], 0x525f
mov byte [ebp - 0x63], bh
mov ah, 6
mov bh, 2
mov byte [ebp - 0x1a], 0
mov byte [ebp - 0x64], bh
mov ch, 0x52
mov bh, byte [ebp - 0x20]
mov bl, 0x5f
xor al, bh
mov dword [ebp - 0x40], 0x20c03
mov byte [ebp - 0x19], al
xor cl, bh
mov al, byte [ebp - 0x62]
xor dl, bh
mov byte [ebp - 0x18], cl
xor ch, bh
mov cl, byte [ebp - 0x44]
xor bl, bh
mov bh, byte [ebp - 0x61]
xor al, cl
mov byte [ebp - 0x39], al
xor ah, cl
mov al, byte [ebp - 0x63]
mov dh, 0xa
xor al, cl
mov byte [ebp - 0x3c], ah
mov byte [ebp - 0x38], al
xor dh, cl
mov al, byte [ebp - 0x64]
xor bh, cl
xor al, cl
mov byte [ebp - 0x17], dl
push esi
mov byte [ebp - 0x37], al
lea eax, [ebp - 0x19]
push 1
push eax
lea eax, [ebp - 0x3c]
mov byte [ebp - 0x16], bl
push eax
mov byte [ebp - 0x15], ch
mov byte [ebp - 0x14], 0
mov byte [ebp - 0x3b], dh
mov byte [ebp - 0x3a], bh
mov byte [ebp - 0x36], 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp - 0x4c]
test eax, eax
setne bl
xor eax, eax
mov dword [ebp - 0x43], eax
mov word [ebp - 0x3f], ax
mov byte [ebp - 0x3d], al
mov dword [ebp - 0x1f], eax
mov word [ebp - 0x1b], ax
cmp ecx, 0x10
jb 0x478996
inc ecx
push ecx
push dword [ebp - 0x60]
lea ecx, [ebp - 0x60]
call fcn.004099a0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a1855
mov esp, ebp
pop ebp
ret
Function at 0x478d10
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4efa7b
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x52910c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.00478e20
lea ecx, [ebp - 0x74]
call fcn.004797c0
lea ecx, [ebp - 0x5c]
mov dword [ebp - 4], 0
call fcn.00479220
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 1
call fcn.00479400
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.004795d0
mov dword [ebp - 4], 3
lea esi, [ebp - 0x74]
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0xffffffffffffffff
push 0
push esi
lea ecx, [ebp - 0x8c]
mov dword [ebp - 0x78], 0xf
mov dword [ebp - 0x7c], 0
mov byte [ebp - 0x8c], 0
call fcn.00409690
cmp dword [ebp - 0x78], 0x10
lea eax, [ebp - 0x8c]
push 0
cmovae eax, dword [ebp - 0x8c]
push eax
call edi
mov eax, dword [ebp - 0x78]
cmp eax, 0x10
jb 0x478dd7
inc eax
lea ecx, [ebp - 0x8c]
push eax
push dword [ebp - 0x8c]
call fcn.004099a0
add esi, 0x18
lea eax, [ebp - 0x14]
cmp esi, eax
jne 0x478d81
push fcn.004095a0
push 4
push 0x18
lea eax, [ebp - 0x74]
mov dword [ebp - 4], 0xffffffff
push eax
call fcn.004a1d84
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a1855
mov esp, ebp
pop ebp
ret
Function at 0x4790b0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4efb40
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x52910c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x54], 0x1163634d
mov dword [ebp - 0x50], 0x2b23222e
mov dword [ebp - 0x4c], 0x24632a24
mov word [ebp - 0x48], 0x2423
mov byte [ebp - 0x46], 0
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 0
call fcn.004797c0
mov byte [ebp - 4], 1
xor ecx, ecx
nop
mov dl, byte [ebp + ecx - 0x53]
xor dl, byte [ebp - 0x54]
mov byte [ebp + ecx - 0x45], dl
inc ecx
cmp ecx, 0xd
jb 0x479110
lea ecx, [ebp - 0x45]
mov byte [ebp - 0x38], 0
push ecx
push eax
lea eax, [ebp - 0x6c]
push eax
call fcn.00407900
mov eax, dword [ebp - 0x20]
add esp, 0xc
cmp eax, 0x10
jb 0x47914b
inc eax
lea ecx, [ebp - 0x34]
push eax
push dword [ebp - 0x34]
call fcn.004099a0
cmp dword [ebp - 0x58], 0x10
lea esi, [ebp - 0x6c]
mov bh, 0x19
mov dword [ebp - 0x1c], 0x3d35365a
cmovae esi, dword [ebp - 0x6c]
mov al, 0x36
mov byte [ebp - 0x6d], bh
mov cl, 0x35
mov bh, 0x17
mov dword [ebp - 0x30], 0x1e1f1370
mov byte [ebp - 0x6e], bh
mov ah, 0x1f
mov bh, byte [ebp - 0x1c]
mov bl, 0x3d
xor al, bh
mov byte [ebp - 0x18], 0
xor cl, bh
mov byte [ebp - 0x17], al
mov al, byte [ebp - 0x6e]
xor bl, bh
mov bh, byte [ebp - 0x6d]
mov dl, 0x13
mov byte [ebp - 0x16], cl
mov ch, 0x1e
mov cl, byte [ebp - 0x30]
mov dh, 0x16
xor ah, cl
mov dword [ebp - 0x2c], 0x171916
xor al, cl
mov byte [ebp - 0x27], ah
push esi
mov byte [ebp - 0x23], al
xor dl, cl
push 4
lea eax, [ebp - 0x17]
mov byte [ebp - 0x15], bl
push eax
lea eax, [ebp - 0x28]
mov byte [ebp - 0x14], 0
xor ch, cl
mov byte [ebp - 0x28], dl
xor dh, cl
mov byte [ebp - 0x26], ch
xor bh, cl
mov byte [ebp - 0x25], dh
push eax
mov byte [ebp - 0x24], bh
mov byte [ebp - 0x22], 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov esi, eax
xor eax, eax
mov dword [ebp - 0x2f], eax
mov word [ebp - 0x2b], ax
mov byte [ebp - 0x29], al
mov dword [ebp - 0x1b], eax
mov eax, dword [ebp - 0x58]
cmp eax, 0x10
jb 0x4791ff
inc eax
lea ecx, [ebp - 0x6c]
push eax
push dword [ebp - 0x6c]
call fcn.004099a0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a1855
mov esp, ebp
pop ebp
ret
Function at 0x47a240
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e4aa8
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x52910c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [ebp - 0x48]
push eax
call fcn.004c31bc
xor eax, eax
mov dword [ebp - 0x2c], 7
lea edx, [esi + 0x20c]
mov dword [ebp - 0x30], 0
add esp, 4
mov word [ebp - 0x40], ax
cmp word [edx], ax
jne 0x47a29b
xor ecx, ecx
jmp 0x47a2af
mov ecx, edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x47a2a0
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x40]
call fcn.00403e20
push 0x50ce78
lea edx, [ebp - 0x40]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00414c90
mov eax, dword [ebp - 0x2c]
add esp, 4
cmp eax, 8
jb 0x47a2e8
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00403f90
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.004c87a3
add esp, 8
cmp eax, 0xffffffff
jne 0x47a317
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push dword [ebp - 0x44]
cmp dword [ebp - 0x14], 8
lea eax, [esi + 0x414]
push dword [ebp - 0x48]
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
push eax
push ecx
push str._s_s.__I64d.dmp
lea eax, [esi + 4]
push 0x104
push eax
call fcn.0047a740
mov eax, dword [ebp - 0x14]
add esp, 0x1c
cmp eax, 8
jb 0x47a35b
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00403f90
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a1855
mov esp, ebp
pop ebp
ret

Function at 0x47a380
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x52910c]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push edi
mov edi, dword [ebp + 0x10]
push eax
push str.SeDebugPrivilege
push 0
mov dword [ebp - 0x18], 1
mov dword [ebp - 0xc], 2
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x47a3fe
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x10
push eax
push edi
push 0x10
lea eax, [ebp - 0x18]
push eax
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x47a3fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x514
je 0x47a3fe
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004a1855
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 8]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.004a1855
mov esp, ebp
pop ebp
ret 0xc
Function at 0x47bac0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f0185
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x52910c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 8
mov dword [ebp - 0x10], 0x531280
mov dword [0x531280], 0x50d298
mov dword [0x531294], 0
mov dword [0x531298], 0
mov dword [0x53129c], 0
mov dword [0x5312a0], 0
mov dword [0x5312a4], 0
call fcn.004a1874
add esp, 4
mov dword [0x531294], eax
test eax, eax
je 0x47bb50
mov dword [eax], 0
mov dword [eax + 4], 0
mov eax, dword [0x531294]
mov dword [eax], 0x531294
push 0x5312a8
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
push 8
mov dword [0x531290], eax
call fcn.004a1874
mov esi, eax
add esp, 4
mov dword [ebp + 8], esi
push 0
mov byte [ebp - 4], 2
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0047c000
push 0
push 0
push 1
mov dword [esi], eax
mov byte [ebp - 4], 1
push 0
mov dword [0x53128c], esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 0
push 0xffffffffffffffff
mov dword [0x531288], eax
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
xor esi, esi
mov dword [0x531284], eax
cmp dword [0x531290], esi
jbe 0x47bc3a
nop dword [eax]
push 0
push 0
push 0x531280
push 0x47c030
push 0
push 0
call fcn.004cc930
mov edi, dword [0x53128c]
add esp, 0x18
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
mov ebx, dword [edi]
push eax
push dword [ebx + 4]
push ebx
call fcn.0047c2c0
mov edx, eax
mov ecx, 0x15555554
mov eax, dword [edi + 4]
sub ecx, eax
cmp ecx, 1
jb 0x47bc53
lea ecx, [eax + 1]
inc esi
mov dword [edi + 4], ecx
mov dword [ebx + 4], edx
mov eax, dword [edx + 4]
mov dword [eax], edx
cmp esi, dword [0x531290]
jb 0x47bbe0
mov eax, 0x531280
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.list_T__too_long
call fcn.0049e25e
int3

Function at 0x47cd60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x47cd79
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x47cdb6
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x47cdb2
nop word [eax + eax]
cmp esi, edx
jae 0x47cdb6
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x47cda0
cmp esi, edx
jb 0x47cdbd
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x480540
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 0x2c]
nop
mov eax, dword [edi + 0x2c]
mov edx, dword [edi + 0x3c]
add eax, 0xfffffefa
sub edx, dword [edi + 0x74]
add eax, esi
sub edx, dword [edi + 0x6c]
mov dword [ebp - 4], edx
cmp dword [edi + 0x6c], eax
jb 0x4805cf
mov ecx, dword [edi + 0x38]
push esi
lea eax, [ecx + esi]
push eax
push ecx
call fcn.004ba660
mov edx, dword [edi + 0x4c]
add esp, 0xc
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], esi
sub dword [edi + 0x6c], esi
sub dword [edi + 0x5c], esi
lea ecx, [eax + edx*2]
nop
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x48059f
sub eax, esi
jmp 0x4805a1
xor eax, eax
mov word [ecx], ax
sub edx, 1
jne 0x480590
mov eax, dword [edi + 0x40]
mov edx, esi
lea ecx, [eax + esi*2]
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x4805c0
sub eax, esi
jmp 0x4805c2
xor eax, eax
mov word [ecx], ax
sub edx, 1
jne 0x4805b1
mov edx, dword [ebp - 4]
add edx, esi
mov ebx, dword [edi]
cmp dword [ebx + 4], 0
je 0x480703
mov eax, dword [edi + 0x74]
add eax, dword [edi + 0x6c]
add eax, dword [edi + 0x38]
mov dword [ebp - 8], eax
mov eax, dword [ebx + 4]
cmp eax, edx
mov ecx, eax
cmova ecx, edx
mov dword [ebp - 4], ecx
test ecx, ecx
jne 0x4805fc
xor eax, eax
jmp 0x48064f
sub eax, ecx
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x480619
mov edx, dword [ebx]
push ecx
mov ecx, dword [ebx + 0x30]
call fcn.00484550
jmp 0x480631
cmp eax, 2
jne 0x480637
mov edx, dword [ebx]
test edx, edx
jne 0x480628
xor eax, eax
jmp 0x480634
push ecx
mov ecx, dword [ebx + 0x30]
call fcn.00481130
add esp, 4
mov dword [ebx + 0x30], eax
push dword [ebp - 4]
push dword [ebx]
push dword [ebp - 8]
call fcn.004ba660
mov eax, dword [ebp - 4]
add esp, 0xc
add dword [ebx], eax
add dword [ebx + 8], eax
add dword [edi + 0x74], eax
mov ebx, dword [edi + 0x74]
cmp ebx, 3
jb 0x480677
mov eax, dword [edi + 0x38]
add eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x58]
movzx edx, byte [eax]
mov dword [edi + 0x48], edx
movzx eax, byte [eax + 1]
shl edx, cl
xor edx, eax
and edx, dword [edi + 0x54]
mov dword [edi + 0x48], edx
cmp ebx, 0x106
jae 0x48068b
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x480550
mov edx, dword [edi + 0x16c0]
mov ecx, dword [edi + 0x3c]
cmp edx, ecx
jae 0x480703
mov esi, dword [edi + 0x6c]
add esi, ebx
cmp edx, esi
jae 0x4806d3
sub ecx, esi
mov eax, 0x102
cmp ecx, eax
cmova ecx, eax
mov eax, dword [edi + 0x38]
push ecx
add eax, esi
mov dword [ebp - 8], ecx
push 0
push eax
call fcn.004babe0
mov eax, dword [ebp - 8]
add esp, 0xc
add eax, esi
mov dword [edi + 0x16c0], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esi + 0x102]
cmp edx, eax
jae 0x480703
mov eax, dword [edi + 0x38]
sub esi, edx
sub ecx, edx
add esi, 0x102
cmp esi, ecx
cmova esi, ecx
add eax, edx
push esi
push 0
push eax
call fcn.004babe0
add esp, 0xc
add dword [edi + 0x16c0], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a4a13
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x4d6ead
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004d6d2c

Function at 0x4dc1c4
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004dbe84
Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x55ae48f6
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
mov ecx, 0x33805b82
nop
nop
nop
nop
test eax, eax
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x401590
Capabilities:
Access firewall rule properties via inetfwrule

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
cmp dword [esi + 4], 0
jne 0x4015a6
mov eax, 0x80004001
pop esi
pop ecx
ret 0xc
push ebx
push ebp
push edi
push str.TheHulkZ
call fcn.00401050
mov edi, eax
mov eax, dword [esp + 0x20]
push eax
call fcn.00401050
mov ecx, dword [esp + 0x28]
push ecx
mov ebp, eax
call fcn.00401050
mov dword [esp + 0x28], eax
add esp, 0xc
lea ebx, [esp + 0x20]
mov eax, esi
mov dword [esp + 0x10], 0
call fcn.00401510
mov esi, eax
test esi, esi
jge 0x401603
push esi
push str.IsAppEnabled_failed:_0x_08lx_n
call fcn.005b8d40
add esp, 8
pop edi
pop ebp
pop ebx
mov eax, esi
pop esi
pop ecx
ret 0xc
cmp dword [esp + 0x20], 0
je 0x401614
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
pop ecx
ret 0xc
lea edx, [esp + 0x10]
push edx
push 0x6b5dd0
push 1
push 0
push 0x6b5dc0
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
jge 0x40163e
push esi
push str.CoCreateInstance_NetFwRule_failed:_0x_08lx_n
jmp 0x4016cd
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x20]
push edi
push eax
call edx
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x1c]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x28]
call eax
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x30]
push ebp
push eax
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x40]
push 0x100
push eax
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x98]
push 6
push eax
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xa8]
push 1
push eax
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x88]
push 0xffffffffffffffff
push eax
call edx
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 4]
mov edx, dword [esp + 0x10]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x20]
call eax
mov esi, eax
test esi, esi
jge 0x4016d5
push esi
push str.Firewall_Rule_Add_failed:_0x_08lx_n
call fcn.005b8d40
add esp, 8
push edi
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call edi
push ebp
call edi
mov ecx, dword [esp + 0x1c]
push ecx
call edi
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4016f8
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
pop edi
pop ebp
pop ebx
mov eax, esi
pop esi
pop ecx
ret 0xc
Function at 0x401910
Capabilities:
Copy file

Disassembly:
sub esp, 0x614
mov eax, dword [0x6eff0c]
xor eax, esp
mov dword [esp + 0x610], eax
push esi
push edi
push 0x104
lea eax, [esp + 0x118]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x114]
push 0x5c
push ecx
call fcn.005deb30
mov esi, eax
inc esi
add esp, 8
cmp esi, 1
jne 0x40196b
push 0
push 0x14
push str..GenerateUpdaterXML.cpp
push str._DWORD_fname___1
call fcn.005b9050
add esp, 0x10
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x11c]
push ecx
call fcn.005b9a20
add esp, 0xc
test al, al
jne 0x40199e
lea edx, [esp + 0x114]
push edx
push str.failed_to_get_crc_for__s_n
call fcn.005b8f10
add esp, 8
push str.0.2.6
push esi
lea eax, [esp + 0x18]
push str._s__s.exe
push eax
call fcn.00401aa0
add esp, 0x10
push 0
lea ecx, [esp + 0x14]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x4019db
lea edx, [esp + 0x10]
push edx
push esi
push str.unable_to_copy__s___s_n
call fcn.005b8f10
add esp, 0xc
push 0x2f
push str.http:__bangdis_cdn_161.wz_service.com_longkubz_launcher_wzupd.xml
call fcn.005deb30
mov esi, eax
add esp, 8
test esi, esi
jne 0x401a05
push eax
push 0x21
push str..GenerateUpdaterXML.cpp
push str.updater_file
call fcn.005b9050
add esp, 0x10
lea edi, [esi + 1]
push 0x6b5e60
push edi
call fcn.005b9f30
mov esi, eax
push str._p__n
push esi
call fcn.005deb5d
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
push eax
push str.0.2.6
push ecx
lea edx, [esp + 0x2c]
push edx
push str.http:__bangdis_cdn_161.wz_service.com_longkubz_launcher_
push str.__u_url__s_s__crc__u__ver__s__size__u____n
push esi
call fcn.005deb5d
push str.__p__n
push esi
call fcn.005deb5d
push esi
call fcn.005decf0
lea eax, [esp + 0x48]
push eax
push edi
lea ecx, [esp + 0x258]
push str.XML__s_generated_nnew_exe:_s
push ecx
call fcn.00401ac0
add esp, 0x48
push 0
push str.Updater_XML
lea edx, [esp + 0x220]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x618]
pop edi
pop esi
xor ecx, esp
call fcn.005de867
add esp, 0x614
ret

Function at 0x402440
Capabilities:
Get cpu information
Query or enumerate registry value

Disassembly:
sub esp, 8
lea eax, [esp + 4]
push eax
push 0x20019
push 0
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40248c
mov edx, dword [esp + 0xc]
lea ecx, [esp]
push ecx
add edx, 0x88
push edx
push eax
push eax
mov eax, dword [esp + 0x14]
push str.MHz
push eax
mov dword [esp + 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
ret 4
Function at 0x402f30
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x134
mov eax, dword [0x6eff0c]
xor eax, esp
mov dword [esp + 0x130], eax
push ebx
push esi
push edi
push 0
push 0xf
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [esp + 0x10]
push eax
push esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x402fe8
mov edi, dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, dword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
mov ecx, str.ExEWarZ.exe
lea eax, [esp + 0x34]
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x402fb0
test dl, dl
je 0x402fac
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x402fb0
add eax, 2
add ecx, 2
test dl, dl
jne 0x402f90
xor eax, eax
jmp 0x402fb5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x402fd5
mov ecx, dword [esp + 0x18]
push ecx
push eax
push 1
call edi
mov esi, eax
test esi, esi
je 0x402fd5
push 9
push esi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x402f80
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x13c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005de867
mov esp, ebp
pop ebp
ret

Function at 0x403010
Capabilities:
Inspect load icon resource
Terminate process

Disassembly:
call fcn.00402f30
push str.ExEWarZ.exe
call fcn.005df447
mov eax, dword [0x8318cc]
add esp, 4
push 5
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
push str._generate
push 0x8310b0
mov dword [0x8318d4], eax
mov dword [0x6eebfc], 0
call fcn.005df490
add esp, 8
test eax, eax
je 0x40306a
call fcn.00401910
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
ret
call fcn.00402d50
test al, al
jne 0x40305a
call fcn.00402de0
call fcn.00402eb0
test al, al
jne 0x4030a5
push 0x40
push 0x6c0178
push 0x6c0180
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
ret
call fcn.004077e0
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0x8d6a10
push 0x6c00b0
push 0x17
push 0
push 0x693b14
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jge 0x4030d9
mov dword [0x8d6a10], 0
push str._cmdLine
push 0x8310b0
call fcn.005df490
add esp, 8
test eax, eax
je 0x4030f6
mov byte [0x8d6a0c], 1
push esi
mov esi, dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push 0
call esi
push 0x7f89
push 0
mov dword [0x8d6520], eax
call esi
push 0x209
push 0x8d6aa8
push 0x12f
push 0
mov dword [0x8d651c], eax
call dword [sym.imp.USER32.dll_LoadStringW]
pop esi
ret