joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412320
Capabilities:
Create directory
Delete file
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x4ce6a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.0040a640
add esp, 0xc
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
push esi
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00456be4
push 0x4712dc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0044dad3
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0044dad3
add esp, 0x24
lea eax, [ebp - 0x20c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x4712dc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0044dad3
push str.SBRemoteHandler.tlb
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0044dad3
add esp, 0x18
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor ecx, ecx
nop dword [eax]
movzx eax, word [ebp + ecx - 0x20c]
lea ecx, [ecx + 2]
mov word [ecx + 0x551c5e], ax
test ax, ax
jne 0x412410
push 0x47232c
push 0xa0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0
push 0x80
push 2
push 0
push 3
mov ebx, eax
lea eax, [ebp - 0x20c]
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
je 0x4124a9
push 0
lea eax, [ebp - 0x418]
push eax
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00447cbd
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x20c]
mov ecx, 0x51eff8
push eax
call fcn.0041bb40
push eax
push str._dllPath_
push str.You_do_not_have_write_and_execute_permissions_to_at_least_one_of_the_following_folders._To_use_this_application__you_must_have_write_execute_access._r_n_dllPath_.
push str.NoFolderAccess
mov ecx, 0x51eff8
call fcn.0041b7b0
push 1
mov ecx, 0x51eff8
mov dword [0x52e298], 1
mov dword [0x50e0a0], 1
call fcn.0041bbb0
mov ecx, 0x51eff8
call fcn.004139d0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00447cbd
mov esp, ebp
pop ebp
ret 4
Function at 0x412520
Capabilities:
Create directory
Delete file
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4ce6a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
push 0x104
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0040a640
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
push esi
mov esi, dword [ebp + 0xc]
push esi
push ebx
call fcn.00456be4
push 0x4712dc
push esi
push ebx
call fcn.0044dad3
lea eax, [ebp - 0x20c]
push eax
push esi
push ebx
call fcn.0044dad3
add esp, 0x24
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x4712dc
push esi
push ebx
call fcn.0044dad3
push 0x4728d0
push esi
push ebx
call fcn.0044dad3
push edi
push esi
push ebx
call fcn.0044dad3
push 0x4728ec
push esi
push ebx
call fcn.0044dad3
add esp, 0x30
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x47232c
push 0x74
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0
push 0x80
push 2
push 0
push 3
push 0xc0000000
push ebx
mov dword [ebp - 0x210], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
je 0x41265f
push 0
lea eax, [ebp - 0x214]
push eax
push dword [ebp - 0x210]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00447cbd
mov esp, ebp
pop ebp
ret 0x10
push ebx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push ebx
mov ecx, 0x51eff8
call fcn.0041bb40
push eax
push str._dllPath_
push str.You_do_not_have_write_and_execute_permissions_to_at_least_one_of_the_following_folders._To_use_this_application__you_must_have_write_execute_access._r_n_dllPath_.
push str.NoFolderAccess
mov ecx, 0x51eff8
call fcn.0041b7b0
push 1
mov ecx, 0x51eff8
mov dword [0x52e298], 1
mov dword [0x50e0a0], 1
call fcn.0041bbb0
mov ecx, 0x51eff8
call fcn.004139d0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00447cbd
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4126d0
Capabilities:
Delete file
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4ce6a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
push 0x104
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0040a640
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
push esi
mov esi, dword [ebp + 0xc]
push esi
push ebx
call fcn.00456be4
push 0x4712dc
push esi
push ebx
call fcn.0044dad3
lea eax, [ebp - 0x20c]
push eax
push esi
push ebx
call fcn.0044dad3
push 0x4712dc
push esi
push ebx
call fcn.0044dad3
push str.SBU.
push esi
push ebx
call fcn.0044dad3
push edi
push esi
push ebx
call fcn.0044dad3
add esp, 0x48
push str..exe
push esi
push ebx
call fcn.0044dad3
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x47232c
push 0x92
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0
push 0x80
push 2
push 0
push 3
push 0xc0000000
push ebx
mov dword [ebp - 0x210], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
je 0x412809
push 0
lea eax, [ebp - 0x214]
push eax
push dword [ebp - 0x210]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00447cbd
mov esp, ebp
pop ebp
ret 0x10
push ebx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push ebx
mov ecx, 0x51eff8
call fcn.0041bb40
push eax
push str._dllPath_
push str.You_do_not_have_write_and_execute_permissions_to_at_least_one_of_the_following_folders._To_use_this_application__you_must_have_write_execute_access._r_n_dllPath_.
push str.NoFolderAccess
mov ecx, 0x51eff8
call fcn.0041b7b0
push 1
mov ecx, 0x51eff8
mov dword [0x52e298], 1
mov dword [0x50e0a0], 1
call fcn.0041bbb0
mov ecx, 0x51eff8
call fcn.004139d0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00447cbd
mov esp, ebp
pop ebp
ret 0x10
Function at 0x412f80
Capabilities:
Register raw input devices

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov eax, ecx
mov dword [ebp - 0x14], 0x20001
push edi
mov dword [ebp - 8], eax
mov ebx, 1
push 0xc
mov eax, dword [eax + 0xc5ec]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push ebx
push eax
mov dword [ebp - 0x10], 0x100
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x412fcf
push 0x4754b8
push ebx
push dword [0x50c768]
call fcn.00444090
add esp, 0xc
mov edi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push 0x10
push 0x40
mov dword [ebp - 4], 0
call edi
mov esi, eax
push esi
call dword [sym.imp.OLEAUT32.dll_VariantClear]
push 0x4755b8
push 1
push dword [0x50c768]
call fcn.00444090
lea eax, [ebp - 4]
push eax
push 0x4755c8
push 0x4755d8
push esi
push dword [0x50c768]
call fcn.00443a40
push dword [ebp - 4]
push 0x475628
push 1
push dword [0x50c768]
call fcn.00444090
mov eax, dword [ebp - 4]
add esp, 0x30
test eax, eax
jle 0x413158
push 0x10
push 0x40
call edi
mov edi, eax
push edi
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 4]
push eax
push str.ConnectorType
push str.Win32_PortConnector
push edi
push dword [0x50c768]
call fcn.00443a40
mov esi, eax
push esi
push str.cCount__d
push 1
push dword [0x50c768]
call fcn.00444090
add esp, 0x24
test esi, esi
je 0x41308a
push edi
push str.N_VM____cType____d_
jmp 0x41315e
push dword [0x50c768]
mov dword [0x52df2c], ebx
mov dword [0x52df30], ebx
call fcn.00443ba0
mov esi, dword [ebp - 8]
test eax, eax
mov eax, 2
push 0x4754cc
cmovne ebx, eax
add esi, 0xc5f4
push 0x64
push esi
call fcn.00456be4
push 0x475508
push 1
push dword [0x50c768]
call fcn.00444090
add esp, 0x1c
cmp dword [0x51f47c], 0
je 0x413183
push 0
push 0
push ebx
push 2
push esi
mov ecx, 0x51eff8
mov dword [0x551410], 1
call fcn.00417510
mov ecx, 0x51eff8
call fcn.0041ba90
push str.We_have_detected_a_remote_connection_on_this_device._The_browser_has_been_shut_down_and_a_security_violation_has_been_logged.
push str.AdvVirtualMachine
mov ecx, 0x51eff8
call fcn.0041b620
push 7
mov ecx, 0x51eff8
mov dword [0x52e298], 7
mov dword [0x50e0a0], 1
call fcn.0041bbb0
mov ecx, 0x51eff8
call fcn.00413790
mov ecx, 0x51eff8
call fcn.004139d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
push 0x475680
push 1
push dword [0x50c768]
call fcn.00444090
add esp, 0x10
push 0x4755a4
push 1
push dword [0x50c768]
call fcn.00444090
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4132a0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x4ce6a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
xor esi, esi
mov dword [ebp - 0x58], edi
mov eax, dword [edi + 0x3455c]
mov byte [eax], 0
cmp byte [ebx], 0
je 0x4133ce
nop
xor edx, edx
xor eax, eax
mov cl, byte [esi + ebx]
mov byte [ebp + eax - 0x54], cl
test cl, cl
je 0x4132e3
inc edx
inc esi
jmp 0x4132f1
cmp eax, 3
jae 0x4133e1
mov byte [ebp + eax - 0x54], 0
inc eax
cmp eax, 3
jl 0x4132d4
test edx, edx
je 0x4133c4
movups xmm0, xmmword [0x472d88]
movzx eax, byte [0x472dc8]
movzx ecx, byte [ebp - 0x54]
movzx edi, byte [ebp - 0x53]
movups xmmword [ebp - 0x50], xmm0
mov byte [ebp - 0x10], al
mov eax, ecx
movups xmm0, xmmword [0x472d98]
shr eax, 2
and ecx, 3
shl ecx, 4
movups xmmword [ebp - 0x40], xmm0
movups xmm0, xmmword [0x472da8]
movups xmmword [ebp - 0x30], xmm0
movups xmm0, xmmword [0x472db8]
movups xmmword [ebp - 0x20], xmm0
movzx eax, byte [ebp + eax - 0x50]
mov byte [ebp - 0xc], al
mov eax, edi
shr eax, 4
or eax, ecx
movzx eax, byte [ebp + eax - 0x50]
mov byte [ebp - 0xb], al
cmp edx, 1
jle 0x41338d
mov cl, byte [ebp - 0x52]
and edi, 0xf
movzx eax, cl
shr eax, 6
shl edi, 2
or eax, edi
mov al, byte [ebp + eax - 0x50]
mov byte [ebp - 0xa], al
cmp edx, 2
jle 0x413391
movzx eax, cl
and eax, 0x3f
mov al, byte [ebp + eax - 0x50]
jmp 0x413393
mov byte [ebp - 0xa], 0x3d
mov al, 0x3d
mov ecx, dword [ebp - 0x58]
mov byte [ebp - 9], al
mov byte [ebp - 8], 0
mov edx, dword [ecx + 0x3455c]
mov ecx, edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4133a8
sub ecx, edi
lea eax, [ebp - 0xc]
push 5
push eax
lea eax, [ecx + 6]
push eax
push edx
call fcn.00458700
add esp, 0x10
cmp byte [esi + ebx], 0
jne 0x4132d0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00447cbd
mov esp, ebp
pop ebp
ret 4
call fcn.004480d3
int3
Function at 0x4139d0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x40c], 0
jne 0x413c27
cmp dword [esi + 0x474], 0
mov dword [esi + 0x40c], 1
je 0x413a0b
push 0
push 0
push 0
push dword [0x50c768]
call fcn.00443c80
add esp, 0x10
push 0x4746a0
push 1
push dword [0x50c768]
call fcn.00444090
mov eax, dword [0x55604c]
add esp, 0xc
test eax, eax
je 0x413abe
cmp dword [0x50c768], 0
je 0x413aba
mov ecx, 0x5092e8
call fcn.00408490
mov ecx, 0x5092e8
call fcn.004084b0
push 0x4708e0
push 1
push dword [0x50c768]
call fcn.00444090
push dword [esi + 0xc5ec]
push dword [0x50c768]
call fcn.00443cb0
push 0x4708f4
push 1
push dword [0x50c768]
call fcn.00444090
push dword [esi + 0xc5dc]
push dword [esi + 0xc5e8]
push dword [0x50c768]
call fcn.00443db0
add esp, 0x2c
push 3
push 0
push 0
push 0
push 0
push 0
push dword [esi + 0xc5ec]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [0x55604c]
test eax, eax
jne 0x413ad4
push dword [esi + 0xc5e8]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [esi + 0xc5e8], 0
push 0x4746bc
push 1
push dword [0x50c768]
call fcn.00444090
add esp, 0xc
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
push 0x473200
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esi + 0xc6bc]
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x49c1a8
call fcn.004109b0
mov ecx, 0x49c1a8
call fcn.00410a00
mov ecx, 0x49c1a8
call fcn.00410a50
push dword [0x50c768]
call fcn.00443c10
add esp, 4
test eax, eax
je 0x413b68
mov ecx, 0x49c1a8
call fcn.00410a00
mov ecx, 0x49c1a8
call fcn.00410960
cmp dword [esi + 0x400], 0
je 0x413b90
push 4
lea eax, [esi + 0xc5e0]
mov dword [eax], 0
push eax
push 0x2a
push 0
call dword [sym.imp.WININET.dll_InternetSetOptionA]
mov dword [esi + 0x4c4], eax
cmp dword [esi + 0x34468], 0
jne 0x413c05
cmp dword [0x51f47c], 0
jne 0x413c05
cmp dword [0x51f40c], 0
jne 0x413c05
cmp dword [0x52df2c], 0
je 0x413c05
push edi
lea edi, [esi + 0xc5f4]
mov ecx, 0x470a68
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x413be8
test dx, dx
je 0x413be4
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x413be8
add eax, 4
add ecx, 4
test dx, dx
jne 0x413bc2
xor eax, eax
jmp 0x413bed
sbb eax, eax
or eax, 1
test eax, eax
je 0x413c04
push 0
push 0
push 2
push 2
push edi
mov ecx, 0x51eff8
call fcn.00417510
pop edi
push dword [0x52e298]
mov ecx, 0x51eff8
call fcn.0041bbb0
push 0
push 0
push 0x10
push dword [esi + 0xc5ec]
call dword [sym.imp.USER32.dll_PostMessageA]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x413ca0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push 0
push 2
push 4
push 0
push 2
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
test esi, esi
je 0x413cda
push 0
lea eax, [ebp + 8]
push eax
push 0x64
push 0
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebp
ret 4
Function at 0x413d80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push ebx
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x413da3
test al, 0x10
je 0x413da3
mov bl, 1
jmp 0x413da5
xor bl, bl
mov edx, dword [ebp + 0x1c]
cmp edx, 8
jb 0x413ddb
mov ecx, dword [ebp + 8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x413dd1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x413de2
push edx
push ecx
call fcn.00447cee
add esp, 8
mov al, bl
pop ebx
pop ebp
ret 0x18
call fcn.00452900
int3
Function at 0x415f80
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x4ce6a8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor esi, esi
mov dword [ebp - 0x130], eax
push esi
push 0x40000002
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x41600c
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x12c], 0x128
push eax
push edi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x416005
push dword [ebp - 0x130]
lea eax, [ebp - 0x108]
push eax
call fcn.00457ac8
add esp, 8
test eax, eax
jne 0x415ff4
mov eax, dword [ebp - 0x124]
mov dword [ebx + esi*4], eax
inc esi
lea eax, [ebp - 0x12c]
push eax
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x415fd1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00447cbd
mov esp, ebp
pop ebp
ret 8

Function at 0x416030
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x4ce6a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push 0x40000002
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x41609b
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x12c], 0x128
push eax
push esi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x41609b
lea eax, [ebp - 0x108]
push edi
push eax
call fcn.00457ac8
add esp, 8
test eax, eax
je 0x4160af
lea ecx, [ebp - 0x12c]
push ecx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x416076
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00447cbd
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x124]
xor ecx, ebp
pop edi
pop esi
call fcn.00447cbd
mov esp, ebp
pop ebp
ret 4

Function at 0x4167b0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x4ce6a8]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x98]
mov dword [ebp - 0x98], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
jne 0x4167ff
cmp dword [ebp - 0x94], 5
jb 0x4167ff
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00447cbd
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.00447cbd
mov esp, ebp
pop ebp
ret
Function at 0x41a0b0
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4ce6a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 5
lea eax, [ebp - 0x1c]
mov ebx, ecx
push eax
push dword [0x5183c4]
call fcn.004580f7
push 5
lea eax, [ebp - 0xc]
push eax
push dword [0x518fc8]
call fcn.004580f7
push 5
lea eax, [ebp - 0x14]
push eax
push dword [0x518fcc]
call fcn.004580f7
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea edx, [ebp - 0xc]
add esp, 0x24
lea ecx, [ebx + 0xdf3c]
cmp dword [ebx + 0x454], 0
lea eax, [ebx + 0x4adc]
lea edi, [ebx + 0x42dc]
push edx
lea edx, [ebp - 0x14]
push edx
lea edx, [ebp - 0x1c]
push edx
push 0x553478
push 0x551414
push 0x528a04
push 0x50e068
push 0x50e090
jne 0x41a179
lea edi, [ebx + 0x1cd0]
push edi
push 0x49c094
push 0x50c770
push ecx
push 0x50dc68
push str.Mozilla_5.0___s__AppleWebKit_537.36_Chrome_84.0.4147.30_Edg__s__SecureBrowser__s__s__s_s__s__TS__s__UUID__s___s_DKM:_s._s._s
push eax
call esi
push edi
push 0x49c094
lea eax, [ebx + 0x42dc]
push 0x4715d0
push eax
call esi
add esp, 0x4c
jmp 0x41a1a1
push 0x49c094
push 0x50c770
push ecx
push 0x50dc68
push str.Mozilla_5.0___s__AppleWebKit_537.36_Chrome_84.0.4147.30_Edg__s__SecureBrowser__s__s_s__s__TS__s__UUID__s___s_DKM:_s._s._s
push eax
call esi
push 0x49c094
push 0x470908
push edi
call esi
add esp, 0x44
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0
push 0xffffffffffffffff
push 0x523ad4
push 0
push 0xfde9
call edi
mov esi, eax
lea ecx, [esi + esi]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push esi
push eax
push 0xffffffffffffffff
mov dword [ebx + 0xdf50], eax
lea eax, [ebx + 0x4adc]
push eax
push 0
push 0xfde9
call edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00447cbd
mov esp, ebp
pop ebp
ret
Function at 0x41ba90
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x4ce6a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
push 0x40000002
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x41bafb
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x12c], 0x128
push eax
push esi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x41bafb
lea eax, [ebp - 0x108]
push 0x4754a0
push eax
call fcn.00457ac8
add esp, 8
test eax, eax
je 0x41bb0c
lea ecx, [ebp - 0x12c]
push ecx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x41bad2
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00447cbd
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x124]
test eax, eax
je 0x41bafb
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00447cbd
mov esp, ebp
pop ebp
ret

Function at 0x41bbb0
Capabilities:
Delete file
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4ce6a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
mov edi, ecx
push 0x472eb8
push 5
push eax
call fcn.0040a600
add esp, 0x10
cmp dword [edi + 0xef90], 0
je 0x41bc34
add edi, 0xef94
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 2
push 4
push 0
push 2
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
test esi, esi
je 0x41bc2a
push 0
lea eax, [ebp - 0x218]
push eax
push 0x64
push 0
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0xc]
push eax
push edi
jmp 0x41bcd4
lea eax, [ebp - 0x214]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x41bce2
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x110]
push 0x104
push eax
call fcn.0044db48
push str.ITSExitCode.log
lea eax, [ebp - 0x110]
push 0x104
push eax
call fcn.0044dba2
add esp, 0x18
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 2
push 4
push 0
push 2
push 0xc0000000
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
test esi, esi
je 0x41bcc9
push 0
lea eax, [ebp - 0x218]
push eax
push 0x64
push 0
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x110]
push eax
push dword [0x50c768]
call fcn.004440c0
add esp, 0xc
cmp dword [0x551c5c], 0
pop edi
pop esi
je 0x41bcfe
push 1
push 0x55185c
push 0
push 0x14
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00447cbd
mov esp, ebp
pop ebp
ret 4