joyce8/EMBER2024-capa huggingface dataset:
Function at 0x636ec5
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x636f23
pop word [esp + 1]
pop ebp
rdtsc
mov ebp, dword [esp]
lea eax, [ebx*4]
pushal
jmp 0x636f09
lea ebp, [ebp - 0x67]
mov ebp, edx
mov ebp, edi
add esp, 0x1f
xchg bp, ax
xor eax, esi
jmp 0x636f51
lea esp, [esp + 0x11]
and bp, 0xec8a
rcr bp, cl
push word [esp + 3]
jmp 0x636ec7
clc
xchg ebp, eax
mov al, ah
xchg ebp, edx
mov dh, byte [esp]
mov eax, 0x53af84f0
jmp 0x636f90
pushal
mov word [esp + 0xf], bx
mov eax, dword [esp + 0x22]
mov word [esp + 0x12], di
pushal
jmp 0x63701c
bswap ebp
not dh
sub eax, ebp
rcl eax, 0x11
push edx
mov eax, esi
jmp 0x636f61
bsf ax, ax
bswap ebp
mov edx, dword [esp]
mov dh, 0x5a
cld
not bp
jmp 0x637080
lea esp, [esp + 0x45]
rdtsc
push edx
xchg word [esp + 1], bp
lea esp, [esp + 1]
mov byte [esp + 1], ch
jmp 0x636ffb
add esp, 2
xchg dh, dl
lea eax, [edx*4]
mov dx, word [esp]
mov dh, 0x7a
call fcn.00637056
xchg ebp, eax
mov word [esp + 1], dx
mov dh, ch
ror ah, 1
adc eax, esi
bsr bp, cx
jmp 0x6371e1
mov eax, dword [esp + 5]
clc
push edx
not dx
push dword [esp + 2]
mov byte [esp + 3], ah
jmp 0x6371a8
pop word [esp + 3]
setns ah
lea ebp, reloc.RASAPI32.dll_RasHangUpA
setge dh
not dx
rcr ebp, 7
jmp 0x6370fc
xchg byte [esp], dh
xchg word [esp + 4], ax
sub esp, 0xc
lea ebp, [ebx + ebp]
add esp, 9
pop word [esp + 1]
jmp 0x63711c
sub esp, 6
pop bp
mov dl, 0x1c
neg ah
clc
lea ebp, [esp + edx]
jmp 0x6371b9
xchg dword [esp + 0x14], edx
add esp, 0x25
xchg dword [esp], eax
lea ebp, [esp + ebx]
shl dh, 3
lea eax, [ebx + ebx]
jmp 0x637151
stc
mov edx, eax
bsr bp, bp
pushal
inc eax
xchg ah, dh
jmp 0x63716f
mov dh, byte [esp + 1]
stc
pop bp
push dword [esp + 8]
stc
lea ebp, [esp + edi]
jmp 0x63718c
mov dh, 0x68
call 0x63722e
cmp ebp, ecx
mov dx, 0x54e5
inc bp
sub esp, 0x16
mov edx, 0x525720e0
xor ebp, esi
jmp 0x637216
lea eax, [eax + 1]
mov eax, ebp
lea ebp, [eax - 0xd1]
btc edx, ebx
neg dh
setl dh
jmp 0x637139
pop dword [esp + 0xe]
call fcn.006371f9
xchg ecx, eax
adc al, byte [eax + 0x11f412e7]
xchg edi, eax
pop es
bound edx, qword [ecx + 0x54258a7e]
pop bp
inc bp
sub esp, 0
pop dword [esp + 6]
mov byte [esp + 7], ch
jmp 0x6371c0
Function at 0x6371f9
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp + 8], ebp
neg ebp
xchg dx, bp
add esp, 0x1a
xchg bp, ax
jmp 0x6372d5
btr eax, edx
mov dh, ch
push edx
mov ebp, esi
bts ebp, ebx
cmc
jmp 0x6372bd
mov dl, 4
xchg word [esp], bp
mov edx, 0xd6504094
rcl dh, 3
add esp, 7
pop ebp
jmp 0x637260
sub esp, 4
setle dh
mov eax, 0x1bab5574
not eax
btc ebp, edi
lea ebp, [edx + ebp]
jmp 0x637277
add esp, 7
add ax, 0xa00e
bsr dx, bp
lea ebp, reloc.RASAPI32.dll_RasHangUpA
jmp 0x637346
lea ebp, [eax - 0x91]
mov byte [esp + 1], ah
cmc
dec bp
xchg byte [esp + 2], dh
push esp
jmp 0x6372a4
mov ax, word [esp + 5]
lea edx, [ebp*4]
mov ah, byte [esp]
inc dh
xchg word [esp], bp
xchg byte [esp + 2], dh
jmp 0x63728f
add bp, 0x9df6
sub esp, 0x1e
not dh
mov dx, di
mov ax, 0x2367
mov dx, cx
jmp 0x6373b9
mov ebp, dword [esp]
mov ebp, 0xd6c5b7e6
mov dh, byte [esp]
rdtsc
lea esp, [esp]
mov ebp, dword [esp]
jmp 0x6372f0
mov ebp, esp
btc ebp, esp
mov byte [esp], bh
mov dl, 0x7c
sub esp, 0
mov bp, di
jmp 0x63730e
mov bp, 0x8ffd
bt edx, edx
xchg word [esp], bp
xchg dh, al
lea esp, [esp + 2]
jmp 0x63732e
mov ebp, ebx
clc
mov edx, dword [esp + 0xa]
bswap ebp
push edx
pop word [esp]
jmp 0x637629
xchg dword [esp + 3], eax
xchg word [esp + 7], bp
setge ah
bsf ax, si
mov al, ah
mov edx, 0x8fb160e2
jmp 0x637379
mov bp, sp
xchg byte [esp + 2], dh
push dword [esp + 7]
mov dx, si
rdtsc
add esp, 0x16
jmp 0x637398
add esp, 1
pop bp
mov bp, di
lea esp, [esp]
mov bp, 0x7709
setnp dh
jmp 0x637543
pop bp
mov dl, 0x3c
pop ebp
bswap ebp
mov dh, 0x42
xchg edx, ebp
jmp 0x6373e8
lea esp, [esp + 0x10]
xor ebp, esi
mov ebp, eax
mov byte [esp + 1], bh
mov dx, word [esp + 5]
mov dh, ch
jmp 0x6374f6
mov al, 0x7e
mov bp, word [esp + 1]
lea ebp, [eax - 0x19]
bsf ax, si
bt ebp, edx
lea eax, [eax + ebx]
jmp 0x63740d
lea ebp, [esp + ecx]
pushal
mov dh, byte [esp + 0x1d]
sub esp, 0x16
setnp ah
sub esp, 4
jmp 0x637430
mov bp, bx
call fcn.0063747f
mov ebp, 0x74d83b7a
pop ebp
mov dword [esp + 8], eax
bt eax, esp
inc dh
shl eax, 1
jmp 0x637521
pushal
lea esp, [esp + 0x4b]
mov dh, 0xb8
mov dh, byte [esp]
bsr ax, bp
mov ebp, dword [esp]
jmp 0x6374c8
not dh
lea ebp, [edx + edi]
stc
not ah
mov dh, 0xda
mov bp, 0xb157
jmp 0x63759d
shr ebp, 0x17
lea esp, [esp + 0x14]
btc ebp, ebx
cld
mov ebp, dword [esp]
mov ebp, 0x4e3dcfba
jmp 0x637509
setae dh
mov ebp, esi
stc
bsf bp, ax
mov edx, esp
sub dh, ah
jmp 0x63744c
and bp, 0x9f22
mov ebp, 0x80bd652a
stc
rcr dh, 7
and ebp, ecx
sub esp, 0x1e
jmp 0x637608
mov byte [esp], ah
mov ebp, edx
lea edx, [esi - 0x8d]
rdtsc
mov dh, byte [esp]
setg dh
jmp 0x637556
lea ebp, reloc.RASAPI32.dll_RasHangUpA
neg bp
mov ebp, 0xded2aace
clc
mov dx, 0x30cf
xor ebp, esi
jmp 0x63757d
push word [esp + 5]
inc bp
xchg word [esp + 5], ax
mov dl, dh
lea ebp, [eax + edx]
mov ax, word [esp + 2]
jmp 0x637400
mov dh, ch
mov dh, 0x50
push word [esp + 0x1a]
call fcn.006375ef
stosb byte es:[edi], al
cmp eax, 0xec47b4ad
xchg esp, eax
push cs
pushfd
sti
push ss
test al, 6
mov dword [reloc.RASAPI32.dll_RasHangUpA], eax
mov bp, word [esp + 6]
mov ebp, dword [esp + 6]
mov dword [esp + 3], ecx
push edx
xchg byte [esp], dh
mov al, 0xee
add esp, 0xb
jmp 0x6375bd
Function at 0x63747f
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg word [esp], bp
mov bp, dx
not bp
setbe dh
mov word [esp], bx
push word [esp + 1]
jmp 0x6374b0
pop word [esp]
mov bp, 0xfe6f
lea eax, [esi*4]
mov dh, byte [esp + 1]
shl ebp, 0xb
jmp 0x63745f
mov eax, dword [esp + 3]
mov ebp, 0x9037fbec
pop ebp
sub esp, 0x18
shr dh, 5
jmp 0x6374d0
push word [esp + 3]
btr ebp, esp
rdtsc
xchg dx, bp
lea esp, [esp + 1]
jmp 0x637497

Function at 0x6378ee
Capabilities:
Parse pe header

Disassembly:
push word [esp + 3]
pop word [esp + 1]
jmp 0x6378be
mov dword [esp + 0xc], ecx
pop dword [esp + 6]
lea esp, [esp + 1]
mov dword [esp + 0x98], esi
call fcn.00637879
test al, 0xcb
mov byte [esp + 1], dh
pop word [esp]
mov byte [esp], ch
lea esp, [esp + 1]
and al, 1
pushal
jmp 0x637892
mov byte [esp + 2], ch
pop word [esp]
mov word [esp], sp
mov byte [esp], ah
lea esp, [esp + 1]
push esp
call fcn.006378ee
jne 0x6378b9
jbe 0x6378ec
loopne 0x637926
popfd
in al, dx
inc esi
jno 0x63786c
lodsb al, byte [esi]
and al, 0x80
add byte [eax], al
add al, ch
mov esi, 0xebffffff
jmp 0x637949
invalid

Function at 0x40100b
Capabilities:
Query or enumerate registry value

Disassembly:
call 0x40100b
push eax
call sub.KERNEL32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffef0
jmp 0x40109c
lea eax, [ebp - 0x104]
push eax
call fcn.004011ec
push 0x401019
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
jne 0x401165
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push 0x401038
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x4011a5
mov dword [ebp - 0x110], 0x103
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x401052
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x4011a5
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x40114a
mov word [ebx], 0x5c
push 0x401023
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
je 0x4011a5
mov dword [ebp - 0x108], eax
push 0x40102d
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x40119a
push 0x3e8
call eax
test eax, eax
je 0x40119a
call 0x40118a
add dword [esp], 0x1e76
call eax
push 0
call sub.KERNEL32.dll_ExitProcess
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
push 0x10
push 0x401096
push 0x401057
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0xffffffff
leave
ret
Function at 0x4013f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4288e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov eax, dword [0x4352dc]
push esi
mov esi, ecx
mov dword [esp + 8], eax
push str.update.vcs
mov dword [esp + 0x34], 0
call fcn.00401890
push ecx
add eax, 0xc0
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0041eccc
lea ecx, [esp + 0x18]
push ecx
call fcn.00401d00
add esp, 8
lea edx, [esp + 0x10]
push eax
push edx
mov byte [esp + 0x3c], 1
call fcn.0041f1ec
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x34], 2
call fcn.0041f090
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 1
call fcn.0041ef57
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 0
call fcn.0041ef57
mov eax, dword [esp + 8]
push 0x1001
push eax
lea ecx, [esp + 0x20]
call fcn.0041fe99
mov byte [esp + 0x30], 3
call fcn.00401890
mov ecx, dword [0x4352dc]
fld dword [eax + 0xdc]
mov dword [esp + 4], ecx
sub esp, 8
lea edx, [esp + 0xc]
mov byte [esp + 0x38], 4
fstp qword [esp]
push 0x4350f0
push edx
call fcn.0041a602
mov eax, dword [esp + 0x14]
add esp, 0x10
mov ecx, dword [eax - 8]
push ecx
push eax
lea ecx, [esp + 0x20]
call fcn.0042014d
lea ecx, [esp + 0x18]
call fcn.00420211
mov ecx, esi
call fcn.00401750
lea eax, [esi + 0x98]
push 0x70
push eax
call fcn.0041a615
add esp, 8
mov ecx, esi
push 5
push 1
call fcn.0041e9af
mov ecx, eax
call fcn.0041eb6f
push 0
mov ecx, esi
call fcn.0041db80
mov byte [esp + 0x30], 3
lea ecx, [esp + 4]
call fcn.0041ef57
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 0
call fcn.0041ff39
lea ecx, [esp + 8]
mov dword [esp + 0x30], 0xffffffff
call fcn.0041ef57
mov ecx, dword [esp + 0x28]
pop esi
mov dword fs:[0], ecx
add esp, 0x30
ret

Function at 0x401710
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [ecx + 0xac]
test eax, eax
je 0x401727
mov eax, dword [eax + 0x28]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
ret
mov eax, 1
ret

Function at 0x401750
Capabilities:
Delete directory

Disassembly:
push 0xffffffffffffffff
push 0x428948
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
call fcn.00401890
mov eax, dword [0x4352dc]
mov dword [esp], eax
push 0x435110
mov dword [esp + 0x1c], 0
call fcn.00401890
push ecx
add eax, 0xc0
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.0041eccc
lea ecx, [esp + 0x10]
push ecx
call fcn.00401d00
add esp, 8
lea edx, [esp + 8]
push eax
push edx
mov byte [esp + 0x24], 1
call fcn.0041f1ec
push eax
lea ecx, [esp + 4]
mov byte [esp + 0x1c], 2
call fcn.0041f090
lea ecx, [esp + 4]
mov byte [esp + 0x18], 1
call fcn.0041ef57
lea ecx, [esp + 8]
mov byte [esp + 0x18], 0
call fcn.0041ef57
push 0
push ecx
lea eax, [esp + 8]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.0041eccc
call fcn.00402160
mov ecx, dword [esp + 8]
add esp, 8
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea ecx, [esp]
mov dword [esp + 0x18], 0xffffffff
call fcn.0041ef57
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x411395
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4367e0
cmp edx, dword [eax]
je 0x4113b7
add eax, 8
inc ecx
cmp eax, 0x436870
jl 0x4113a8
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4367e0]
jne 0x4114e5
mov eax, dword [0x43b424]
cmp eax, 1
je 0x4114bf
test eax, eax
jne 0x4113e8
cmp dword [0x4360ec], 1
je 0x4114bf
cmp edx, 0xfc
je 0x4114e5
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x41141f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00413720
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0040d490
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x411462
lea eax, [ebp - 0x1a4]
push eax
call fcn.0040d490
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x42d4cc
push edi
call fcn.00415750
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00413720
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00413730
lea eax, [ebp - 0xa0]
push 0x42d4ac
push eax
call fcn.00413730
push dword [esi + 0x4367e4]
lea eax, [ebp - 0xa0]
push eax
call fcn.00413730
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004156bd
add esp, 0x2c
pop edi
jmp 0x4114e5
lea eax, [ebp + 8]
lea esi, [esi + 0x4367e4]
push 0
push eax
push dword [esi]
call fcn.0040d490
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x419ac0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.0040d6e0
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x419b8b
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x419b8b
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x419b3e
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x419b49
or bh, 8
and edi, 0x8000000
je 0x419b64
mov eax, dword [0x43cbdc]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x419b8b
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x419f60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x419f8b
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x419faf
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x419fca
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
Function at 0x41ddf1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x41de33
call fcn.004250ef
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x41de33
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x41de2a
xor eax, eax
jmp 0x41de3b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0041de41
pop edi
pop esi
pop ebx
ret 4

Function at 0x423bab
Capabilities:
Create http request

Disassembly:
mov eax, 0x4292ec
call fcn.0040c5d8
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 0xc]
and dword [ebp - 4], 0
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
test eax, eax
mov dword [esi], vtable.CInternetSession.0
jne 0x423be3
call fcn.004250ef
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
test eax, eax
mov dword [esi + 8], eax
jne 0x423c08
push eax
push dword [esi + 4]
call fcn.004247eb
jmp 0x423c14
push esi
push eax
mov ecx, 0x43aee0
call fcn.00423c25
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 0x18

Function at 0x423ed6
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
mov eax, 0x42934b
call fcn.0040c5d8
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.00421620
mov eax, dword [ebp + 0x18]
lea ebx, [esi + 0x24]
mov dword [esi + 0x1c], eax
mov eax, dword [0x4352dc]
xor edi, edi
mov dword [ebx], eax
mov dword [ebp - 4], edi
push dword [ebp + 0x10]
lea ecx, [esi + 0xc]
mov byte [ebp - 4], 1
mov dword [esi], vtable.CInternetFile.0
call fcn.0041f0e0
push dword [ebp + 0x14]
mov ecx, ebx
call fcn.0041f0e0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [esi + 0x18], eax
mov dword [esi + 0x3c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x40], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x18
Function at 0x40b960
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4761eb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0046ab5c
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40b9e2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0046884d
mov eax, dword [eax]
push 0x4d1200
push eax
call fcn.0045b394
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0046ade7
test bl, bl
je 0x40b9e2
push 0x4d1200
lea ecx, [esp + 0xc]
call fcn.0046b177
push 0x4d4d6c
lea ecx, [esp + 0xc]
call fcn.0046b177
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40ba1e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0046ade7
jmp 0x40bae9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40baa2
lea edx, [esp + 0x7c]
push 0x4d4d68
push edx
call fcn.0045b394
add esp, 8
test eax, eax
je 0x40baa2
lea eax, [esp + 0x7c]
push 0x4d4d64
push eax
call fcn.0045b394
add esp, 8
test eax, eax
je 0x40baa2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40ba32
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0046ade7
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40c2e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40c342
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x40c350
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x47626b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x4e0d58]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x40c488
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x40c3b6
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0046ade7
xor eax, eax
jmp 0x40c4ff
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0046af24
push esi
lea ecx, [esp + 0xc]
call fcn.0046b1b3
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push 0x4d4da4
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x40c4dd
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push accept
call fcn.0040c2e0
test eax, eax
jne 0x40c4dd
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push accept
mov ecx, edi
call fcn.0040c2e0
test eax, eax
jne 0x40c4dd
lea eax, [esp + 0x14]
push 0x4d4d80
push eax
call fcn.0045c3d0
mov esi, eax
add esp, 8
test esi, esi
jne 0x40c4bc
lea ecx, [esp + 0x14]
push 0x4d4d7c
push ecx
call fcn.0045c350
mov esi, eax
add esp, 8
test esi, esi
jne 0x40c4bc
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x40c4bf
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0046aed4
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x40c3ce
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0046ade7
xor eax, eax
jmp 0x40c4ff
mov byte [esi], 0
push 0x4d4d78
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0046ade7
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4