joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bac34
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x4bacce.0
jmp dword [ecx*4 + 0x4bac67]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x4bac99
sub dl, 8
je 0x4baca8
jmp case.0x4bacce.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x4ba8dc
jmp case.0x4bacce.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x4ba934
jmp case.0x4bacce.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x4bacce.0
movzx ecx, byte [ecx + 0x4bacd5]
jmp dword [ecx*4 + 0x4bace6]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x4ba9e0
jmp case.0x4bacce.0
cmp dl, 3
jne 0x4bad13
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x4baa38
jmp case.0x4bacce.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x4ba9f4
jmp case.0x4bacce.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x4baa7c
jmp case.0x4bacce.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x4bad3e
sub dl, 8
je 0x4bad4a
jmp case.0x4bacce.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x4baaa8
jmp case.0x4bacce.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x4bab14
jmp case.0x4bacce.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x4bad69
sub dl, 8
je 0x4bad75
jmp case.0x4bacce.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x4babd0
jmp case.0x4bacce.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x4babf8
mov edx, dword [eax + 0x468]
mov ecx, dword [ebx + 0x1c]
dec ecx
imul edx, ecx
mov esi, edx
add esi, dword [eax + 0x450]
mov dword [ebp - 0x10], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 0xc], esi
add edx, dword [eax + 0x44c]
mov dword [ebp - 0x14], edx
mov esi, ecx
test esi, esi
jb 0x4bae17
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004b9de0
test eax, eax
je 0x4bae17
mov eax, ebx
call fcn.004bae20
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
call dword [ebp - 0x20]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0x10], eax
sub dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 0xc], eax
dec esi
jne 0x4badb0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4bae20
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x4bae51
dec al
je 0x4bae8c
dec al
je 0x4baed1
dec al
je 0x4baf3a
jmp 0x4bafc4
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x4bafc4
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4bae61
jmp 0x4bafc4
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4bafc4
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4bae9c
jmp 0x4bafc4
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4bafc4
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x4baf00
xor ebp, ebp
jmp 0x4baf10
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x4baf19
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4baee1
jmp 0x4bafc4
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4bafc4
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x4baf93
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.004b7ef0
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4baf4e
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x503d78
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406944
mov eax, dword [ebp - 8]
call fcn.00406944
xor eax, eax
push ebp
push 0x503e00
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00411ce4
test al, al
je 0x503de5
push 0
push 0
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov edx, 0x503e18
call fcn.00406e30
mov eax, dword [ebp - 0xc]
call fcn.004069e8
push eax
mov eax, dword [ebp - 4]
call fcn.004069e8
push eax
push 0x503e30
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x503e07
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00406954
ret

Function at 0x503ebc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x214], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x503f73
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x503f4e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
push 0x1c
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x20e]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListW
lea eax, [ebp - 0x214]
lea edx, [ebp - 0x20e]
mov ecx, 0x105
call fcn.00406b5c
push dword [ebp - 0x214]
push 0x503f90
push 0x503fa0
push 0x503f90
mov eax, ebx
mov edx, 4
call fcn.00406f14
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x503f5a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x503f7a
lea eax, [ebp - 0x214]
call fcn.0040694c
ret

Function at 0x503fbc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x214], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x504064
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x50403f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
push 0x1c
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x20e]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListW
lea eax, [ebp - 0x214]
lea edx, [ebp - 0x20e]
mov ecx, 0x105
call fcn.00406b5c
mov edx, dword [ebp - 0x214]
mov eax, ebx
mov ecx, 0x504080
call fcn.00406e30
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x50404b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50406b
lea eax, [ebp - 0x214]
call fcn.0040694c
ret
Function at 0x504124
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406944
xor eax, eax
push ebp
push 0x50424a
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004069b0
push 0xa
mov eax, dword [ebp - 8]
call fcn.004069e8
push eax
mov eax, dword [0x52bc40]
push eax
call sub.kernel32.dll_FindResourceW
mov ebx, eax
test ebx, ebx
je 0x504227
push ebx
mov eax, dword [0x52bc40]
push eax
call sub.kernel32.dll_SizeofResource
mov edi, eax
push ebx
mov eax, dword [0x52bc40]
push eax
call sub.kernel32.dll_LoadResource
mov ebx, eax
xor edx, edx
push ebp
push 0x50420a
push dword fs:[edx]
mov dword fs:[edx], esp
test ebx, ebx
je 0x504200
push edi
push 0
call sub.kernel32.dll_GlobalAlloc
mov esi, eax
push esi
call sub.kernel32.dll_GlobalLock
mov edx, eax
mov eax, ebx
mov ecx, edi
call fcn.004043ac
lea eax, [ebp - 0xc]
call fcn.0040964c
push eax
push 0
push esi
call sub.ole32.dll_CreateStreamOnHGlobal
push 0
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x4b3854]
call fcn.004b3e70
mov dword [ebp - 0x10], eax
push esi
call sub.kernel32.dll_GlobalUnlock
lea eax, [ebp - 0xc]
call fcn.0040964c
push ebx
call sub.kernel32.dll_FreeResource
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x504227
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x504251
lea eax, [ebp - 0xc]
call fcn.0040964c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406954
ret

Function at 0x507328
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406944
xor eax, eax
push ebp
push 0x5073cf
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
call fcn.00411ce4
test al, al
je 0x5073ab
mov edx, 0x40
mov eax, dword [ebp - 4]
call fcn.00411b60
mov ebx, eax
lea eax, [ebp - 0x14]
push eax
push ebx
call sub.kernel32.dll_GetFileSize
mov esi, eax
cmp esi, 0xffffffff
jne 0x507393
call sub.kernel32.dll_GetLastError_1
test eax, eax
je 0x507393
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
jmp 0x5073a3
mov eax, dword [ebp - 0x14]
shl eax, 0x20
add eax, esi
xor edx, edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
push ebx
call sub.kernel32.dll_CloseHandle_1
jmp 0x5073b9
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5073d6
lea eax, [ebp - 4]
call fcn.0040694c
ret
Function at 0x5073e4
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x507513
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, 0x50752c
call fcn.0040695c
lea edx, [ebp - 4]
mov eax, dword [0x528c90]
mov eax, dword [eax]
call fcn.004b1e60
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.004069e8
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x5074fd
mov eax, dword [ebp - 8]
call fcn.004041f4
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x5074f6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
push esi
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x5074dd
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x50753c
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
cmp dword [ebp - 0x14], 0
je 0x5074dd
push ebx
mov eax, dword [ebp - 0x14]
mov esi, dword [eax + 8]
mov eax, esi
shr eax, 0x10
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0
and esi, 0xffff
mov dword [ebp - 0x2c], esi
mov byte [ebp - 0x28], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xc]
shr eax, 0x10
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
mov eax, dword [ebp - 0x14]
movzx eax, word [eax + 0x14]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x34]
mov ecx, 3
mov eax, 0x50754c
call fcn.004127fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5074fd
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.00404210
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50751a
lea eax, [ebp - 4]
call fcn.0040694c
ret
Function at 0x507b94
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x248], edx
mov dword [ebp - 0x250], edx
mov dword [ebp - 0x24c], edx
mov dword [ebp - 0x238], edx
mov dword [ebp - 0x244], edx
mov dword [ebp - 0x23c], edx
mov dword [ebp - 0x240], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406944
lea edi, [ebp - 0x234]
xor eax, eax
push ebp
push 0x507d11
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
xor edx, edx
mov eax, 2
call fcn.00505d44
mov esi, eax
mov dword [edi], 0x22c
mov edx, edi
mov eax, esi
call fcn.00505d64
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x507cdd
lea eax, [ebp - 0x240]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00406b5c
mov eax, dword [ebp - 0x240]
lea edx, [ebp - 0x23c]
call fcn.00412018
mov eax, dword [ebp - 0x23c]
lea edx, [ebp - 0x238]
call fcn.004108b0
mov eax, dword [ebp - 0x238]
push eax
lea edx, [ebp - 0x244]
mov eax, dword [ebp - 4]
call fcn.004108b0
mov edx, dword [ebp - 0x244]
pop eax
call fcn.00407034
je 0x507cb6
lea eax, [ebp - 0x24c]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00406b5c
mov eax, dword [ebp - 0x24c]
lea edx, [ebp - 0x248]
call fcn.004108b0
mov eax, dword [ebp - 0x248]
push eax
lea edx, [ebp - 0x250]
mov eax, dword [ebp - 4]
call fcn.004108b0
mov edx, dword [ebp - 0x250]
pop eax
call fcn.00407034
jne 0x507cce
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov byte [ebp - 5], al
mov edx, edi
mov eax, esi
call fcn.00505d84
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x507c17
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x507d18
lea eax, [ebp - 0x250]
mov edx, 7
call fcn.00406954
lea eax, [ebp - 4]
call fcn.0040694c
ret

Function at 0x508f28
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 4], 6
setae al
add esp, 0x94
ret
Function at 0x50948c
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406944
mov eax, dword [ebp - 8]
call fcn.00406944
xor eax, eax
push ebp
push 0x50954a
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4434bc]
call fcn.004445c8
mov dword [ebp - 0xc], eax
mov edx, 0x80000001
mov eax, dword [ebp - 0xc]
call fcn.00443bfc
xor eax, eax
push ebp
push 0x50951b
push dword fs:[eax]
mov dword fs:[eax], esp
test bl, bl
je 0x509501
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x509564
mov eax, dword [ebp - 0xc]
call fcn.00444730
jmp 0x509511
mov ecx, dword [ebp - 4]
mov edx, 0x509564
mov eax, dword [ebp - 0xc]
call fcn.00444800
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x509525
mov dl, 1
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx - 4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x509551
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406954
ret

Function at 0x509854
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406944
xor eax, eax
push ebp
push 0x50997a
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004069b0
push 0xa
mov eax, dword [ebp - 8]
call fcn.004069e8
push eax
mov eax, dword [0x52bc40]
push eax
call sub.kernel32.dll_FindResourceW
mov ebx, eax
test ebx, ebx
je 0x509957
push ebx
mov eax, dword [0x52bc40]
push eax
call sub.kernel32.dll_SizeofResource
mov edi, eax
push ebx
mov eax, dword [0x52bc40]
push eax
call sub.kernel32.dll_LoadResource
mov ebx, eax
xor edx, edx
push ebp
push 0x50993a
push dword fs:[edx]
mov dword fs:[edx], esp
test ebx, ebx
je 0x509930
push edi
push 0
call sub.kernel32.dll_GlobalAlloc
mov esi, eax
push esi
call sub.kernel32.dll_GlobalLock
mov edx, eax
mov eax, ebx
mov ecx, edi
call fcn.004043ac
lea eax, [ebp - 0xc]
call fcn.0040964c
push eax
push 0
push esi
call sub.ole32.dll_CreateStreamOnHGlobal
push 0
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x4b3854]
call fcn.004b3e70
mov dword [ebp - 0x10], eax
push esi
call sub.kernel32.dll_GlobalUnlock
lea eax, [ebp - 0xc]
call fcn.0040964c
push ebx
call sub.kernel32.dll_FreeResource
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x509957
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x509981
lea eax, [ebp - 0xc]
call fcn.0040964c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406954
ret
Function at 0x509b70
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff998
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x668], ebx
mov dword [ebp - 0xc], ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406944
mov eax, dword [ebp - 8]
call fcn.00406944
xor eax, eax
push ebp
push 0x509cae
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x509c7e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x410]
mov edx, dword [ebp - 4]
call fcn.004123d8
lea edx, [ebp - 0xc]
xor eax, eax
call fcn.00407400
lea eax, [ebp - 0x610]
mov edx, dword [ebp - 0xc]
call fcn.004123d8
lea eax, [ebp - 0x654]
xor ecx, ecx
mov edx, 0x44
call fcn.004047ec
mov dword [ebp - 0x654], 0x44
mov dword [ebp - 0x628], 1
mov word [ebp - 0x624], bx
lea eax, [ebp - 0x664]
push eax
lea eax, [ebp - 0x654]
push eax
push 0
push 0
push 0x30
push 0
push 0
push 0
push dword [ebp - 4]
push 0x509cd0
push dword [ebp - 8]
lea eax, [ebp - 0x668]
mov edx, 3
call fcn.00406f14
mov eax, dword [ebp - 0x668]
call fcn.004069e8
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x509c70
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0x664]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov byte [ebp - 0xd], 1
jmp 0x509c74
mov byte [ebp - 0xd], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x509c88
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x509cb5
lea eax, [ebp - 0x668]
call fcn.0040694c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00406954
ret
Function at 0x51076c
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov byte [ebp - 1], 0
xor eax, eax
push ebp
push 0x5107ab
push dword fs:[eax]
mov dword fs:[eax], esp
rdtsc
xchg ecx, eax
rdtsc
sub eax, ecx
cmp eax, 0xff
jae 0x51079b
sub edx, edx
mov byte [ebp - 1], 0
jmp 0x5107a1
sub eax, ecx
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5107b5
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x5107c0
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406944
xor eax, eax
push ebp
push 0x510875
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x442500]
call fcn.00443b14
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x510848
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000001
mov eax, dword [ebp - 0x14]
call fcn.00443bfc
xor ecx, ecx
mov edx, 0x51088c
mov eax, dword [ebp - 0x14]
call fcn.00443d44
test al, al
je 0x510832
lea ecx, [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
call fcn.00444338
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51084f
mov eax, dword [ebp - 0x14]
call fcn.00404e28
ret
Function at 0x4d6ad0
Capabilities:
Hash data using crc32b

Disassembly:
mov ecx, dword [esp + 8]
xor eax, eax
push edi
mov edi, dword [esp + 8]
test ecx, ecx
jbe 0x4d6b19
push ebx
push ebp
push esi
mov ebp, ecx
xor ecx, ecx
mov edx, 0x80
mov cl, byte [edi]
mov esi, ecx
mov ebx, esi
mov ecx, eax
and ebx, edx
and ecx, 0x80000000
neg ebx
sbb ebx, ebx
add eax, eax
neg ebx
or eax, ebx
test ecx, ecx
je 0x4d6b0e
xor eax, 0x4c11db7
sar edx, 1
jne 0x4d6aef
inc edi
dec ebp
jne 0x4d6ae4
pop esi
pop ebp
pop ebx
pop edi
ret
Function at 0x4de25c
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4ffde7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov al, byte [esp + 3]
push esi
mov esi, ecx
mov dword [esp + 8], esi
mov byte [esi + 8], al
xor eax, eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov cl, byte [esp + 7]
mov dword [esp + 0x14], eax
mov byte [esi + 0x18], cl
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dl, byte [esp + 7]
mov dword [esi + 0x2c], eax
mov byte [esi + 0x28], dl
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov cl, byte [esp + 7]
mov dword [esi + 0x3c], eax
mov byte [esi + 0x38], cl
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dl, byte [esp + 7]
mov dword [esi + 0x4c], eax
mov byte [esi + 0x48], dl
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
mov ecx, esi
mov byte [esp + 0x14], 4
mov dword [esi], 0x50bc20
call fcn.004de6a0
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x42a905
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x42a93d
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x42a92b
mov al, 1
jmp 0x42a987
cmp dword [ebx + 0x54], ecx
jne 0x42a934
mov al, 2
jmp 0x42a987
cmp dword [ebx + 0x7c], ecx
jne 0x42a987
mov al, 3
jmp 0x42a987
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x42a952
mov al, 4
jmp 0x42a987
cmp ecx, 5
jne 0x42a972
cmp ebx, 0
jne 0x42a960
mov al, 5
jmp 0x42a987
cmp ebx, 1
jne 0x42a969
mov al, 6
jmp 0x42a987
cmp ebx, 2
jne 0x42a972
mov al, 7
jmp 0x42a987
cmp ecx, 6
jne 0x42a97e
cmp ebx, 0
jne 0x42a980
mov al, 8
jmp 0x42a987
cmp ebx, 1
jne 0x42a987
mov al, 9
pop ebx
mov esp, ebp
pop ebp
ret