joyce8/EMBER2024-capa huggingface dataset:
Function at 0x60e610
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x60e627
add esp, 0xfffffff0
call fcn.00409d94
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004c5410
mov eax, dword [0x681e48]
cmp byte [eax], 0
jne 0x60e654
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x19c], al
mov eax, dword [0x682264]
cmp word [eax + 2], 0
jne 0x60e66e
mov eax, dword [0x682264]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00610ad4
mov eax, dword [0x6823d0]
cmp word [eax + 2], 0
jne 0x60e688
mov eax, dword [0x6823d0]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00610eec
mov byte [ebx + 0x41], 0
mov dl, 1
mov eax, dword [0x51b2f8]
call fcn.00521e74
mov esi, eax
mov dword [ebx + 0x54], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x611498
mov dl, 1
mov eax, dword [0x484290]
call fcn.00409770
mov dword [ebx + 0xa8], eax
mov dl, 1
mov eax, dword [0x484290]
call fcn.00409770
mov dword [ebx + 0xc8], eax
xor eax, eax
mov dword [ebx + 0x74], eax
xor eax, eax
mov dword [ebx + 0x98], eax
mov dword [ebx + 0x70], 0xff000018
mov dword [ebx + 0x8c], 0x1f4
mov byte [ebx + 0x90], 1
xor eax, eax
mov dword [ebx + 0x94], eax
mov dword [ebx + 0x88], 0x9c4
mov byte [ebx + 0xbd], 1
mov byte [ebx + 0xd4], 1
mov dl, 1
mov eax, dword [0x520468]
call fcn.0052c448
mov esi, eax
mov dword [ebx + 0xb8], esi
push 0x60e878
mov eax, dword [0x6820bc]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.0052c964
mov eax, dword [ebx + 0xb8]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x611784
mov dl, 1
mov eax, dword [0x484290]
call fcn.00409770
mov dword [ebx + 0xb0], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x6820bc]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.00429928
test eax, eax
je 0x60e79b
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.00429780
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.0042990c
test eax, eax
je 0x60e7b3
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0xa4]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.0040c1dc
push ebx
push 0x6104a8
call fcn.00602bbc
mov dword [ebx + 0x198], eax
mov byte [ebx + 0xe8], 0
mov eax, dword [0x681e48]
cmp byte [eax], 0
jne 0x60e804
mov eax, ebx
call fcn.0060ea40
mov byte [ebx + 0x6d], 1
mov byte [ebx + 0x6e], 1
mov byte [ebx + 0x6f], 1
mov byte [ebx + 0xbe], 1
mov byte [ebx + 0xe9], 0
mov byte [ebx + 0xf4], 0
xor eax, eax
mov dword [ebx + 0xec], eax
mov byte [ebx + 0xeb], 0
xor eax, eax
mov dword [ebx + 0xc0], eax
mov eax, ebx
call fcn.00611b2c
mov eax, ebx
call fcn.00612668
mov byte [ebx + 0x19e], 0
mov byte [ebx + 0xf5], 1
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x60e86f
call fcn.00409dec
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x60ed70
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x190]
test eax, eax
je 0x60ee12
cmp dword [ebx + 0xac], 0
jne 0x60ee0c
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x60ecb0
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0xa8]
cmp dword [eax + 8], 0
je 0x60ee0c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x60edd2
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0xa8]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x60ee0c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [ebx + 0xa8]
mov edx, esi
call fcn.004aefe4
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x60ede1
inc dword [ebx + 0xac]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x60f154
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x689ca8]
cmp dword [eax + 0x190], 0
je 0x60f2bd
test bl, bl
jne 0x60f210
cmp dword [esi + 0xb4], 0
jne 0x60f205
mov eax, esi
call fcn.006124b8
push eax
push 0x60f054
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x58], 0
je 0x60f1d6
mov eax, dword [0x689ca8]
cmp byte [eax + 0xeb], 0
je 0x60f1d6
mov eax, dword [esi + 0xf0]
test eax, eax
je 0x60f1b7
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x60f1d6
push 0
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x60f1bf
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x60f205
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.004aefe4
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x60f1e5
inc dword [esi + 0xb4]
jmp 0x60f2bd
cmp dword [esi + 0xb4], 0
jle 0x60f2bd
dec dword [esi + 0xb4]
cmp dword [esi + 0xb4], 0
jne 0x60f2bd
cmp dword [esi + 0x58], 0
je 0x60f272
mov eax, dword [0x689ca8]
cmp byte [eax + 0xeb], 0
je 0x60f272
mov eax, dword [esi + 0xf0]
test eax, eax
je 0x60f253
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x60f272
push 5
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x60f25b
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x60f2a1
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.004aefe4
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x60f281
mov eax, dword [esi + 0xb0]
mov edx, dword [eax]
call dword [edx + 8]
lea eax, [esi + 0xf0]
mov edx, dword [0x5ff05c]
call fcn.0040e614
pop edi
pop esi
pop ebx
ret
Function at 0x6100b4
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xc4], 0
je 0x610111
cmp byte [ebx + 0xeb], 0
jne 0x610111
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x190]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040b728
mov eax, dword [esi]
test eax, eax
je 0x6100fe
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x61011e
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040b980
jmp 0x61011e
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040b980
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x611d40
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x98]
test esi, esi
je 0x611db1
mov eax, esi
call fcn.0055b8d4
test al, al
je 0x611db1
mov eax, dword [ebx + 0x98]
call fcn.0055b46c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x611db1
mov eax, dword [ebx + 0x98]
mov edx, dword [eax]
call dword [edx + 0x160]
test al, al
je 0x611da2
push 0
mov eax, dword [ebx + 0x98]
call fcn.0055b46c
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebx + 0x98]
xor edx, edx
call fcn.00551710
jmp 0x611db1
mov edx, dword [ebx + 0x88]
mov cl, 1
mov eax, ebx
call fcn.00611b4c
pop esi
pop ebx
ret
Function at 0x61a580
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
cmp dword [ebx + 0x94], 0
jne 0x61a606
mov eax, dword [ebx + 8]
call fcn.0055b46c
mov ecx, eax
mov dl, 1
mov eax, dword [0x56fd78]
call fcn.00554fa0
mov dword [ebx + 0x94], eax
mov esi, dword [ebx + 0x94]
xor edx, edx
mov eax, esi
call fcn.00580334
mov dword [esi + 0x2dc], ebx
mov dword [esi + 0x2d8], 0x619e50
push 8
mov edx, 3
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xe0]
push eax
push 0
push 0
push 0
push 0
mov eax, dword [ebx + 0x94]
call fcn.0055b46c
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x94]
call fcn.0055b46c
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0xa4], 0
jne 0x61a688
mov eax, dword [ebx + 8]
call fcn.0055b46c
mov ecx, eax
mov dl, 1
mov eax, dword [0x56fd78]
call fcn.00554fa0
mov dword [ebx + 0xa4], eax
mov esi, dword [ebx + 0xa4]
mov dl, 1
mov eax, esi
call fcn.00580334
mov dword [esi + 0x2dc], ebx
mov dword [esi + 0x2d8], 0x619e9c
push 8
push 0
mov edx, 2
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xe0]
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0xa4]
call fcn.0055b46c
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0xa4]
call fcn.0055b46c
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x9c], 0
jne 0x61a706
mov eax, dword [ebx + 8]
call fcn.0055b46c
mov ecx, eax
mov dl, 1
mov eax, dword [0x57086c]
call fcn.00554fa0
mov dword [ebx + 0x9c], eax
mov esi, dword [ebx + 0x9c]
mov byte [esi + 0x2b0], 1
push 8
mov edx, 3
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xe0]
push eax
mov edx, 2
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xe0]
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x9c]
call fcn.0055b46c
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x9c]
call fcn.0055b46c
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x631698
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x68a160], 0
jne 0x6316af
call fcn.00631654
mov eax, edi
dec eax
test eax, eax
jl 0x6316d7
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x689d60]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x6316b9
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x634730
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x634761
dec al
je 0x63479c
dec al
je 0x6347e0
dec al
je 0x634852
jmp 0x6348ed
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x6348ed
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x634771
jmp 0x6348ed
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x6348ed
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
movzx ecx, al
mov ecx, dword [ebx + ecx*4 + 0x40]
add dl, byte [ecx + esi]
and dl, 0xff
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x6347ac
jmp 0x6348ed
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x6348ed
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, dword [ebx + 0x24]
mov ecx, esi
dec ecx
cmp edx, ecx
jbe 0x634813
xor edx, edx
mov dword [esp + 4], edx
jmp 0x634828
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov ebp, dword [ebx + edx*4 + 0x40]
movzx edx, byte [ebp + esi]
add eax, dword [esp + 4]
sar eax, 1
jns 0x634840
adc eax, 0
add dl, al
and dl, 0xff
mov byte [ebp + esi], dl
inc esi
dec edi
jne 0x6347f0
jmp 0x6348ed
xor eax, eax
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 8], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x6348ed
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, dword [ebx + 0x24]
mov ecx, esi
dec ecx
cmp edx, ecx
ja 0x6348b9
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 8], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 8]
push eax
movzx eax, byte [esp + 8]
pop edx
call fcn.006316e0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [esp]
and al, 0xff
mov byte [edx + esi], al
inc esi
dec edi
jne 0x63486e
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x638eac
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040b684
xor eax, eax
push ebp
push 0x639097
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0040b590
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.006431f0
mov eax, dword [ebp - 0x20]
mov dl, 1
call fcn.00428b58
test al, al
je 0x639072
xor ebx, ebx
lea eax, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.006431f0
mov eax, dword [ebp - 0x24]
call fcn.0040c128
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x638f8a
xor eax, eax
push ebp
push 0x638f7e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.00407004
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.006431f0
mov eax, dword [ebp - 0x28]
call fcn.0040c128
push eax
call sub.version.dll_GetFileVersionInfoW
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x638f8a
test bl, bl
je 0x639072
xor eax, eax
push ebp
push 0x63905d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x6390a8
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebx + 8]
shr eax, 0x10
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 8]
call fcn.00427ed0
mov eax, dword [ebp - 8]
push dword [eax]
push 0x6390b8
mov eax, dword [ebx + 8]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x2c]
call fcn.00427ed0
push dword [ebp - 0x2c]
mov eax, dword [ebp - 8]
mov edx, 3
call fcn.0040c414
mov eax, dword [ebp - 8]
push dword [eax]
push 0x6390b8
mov eax, dword [ebx + 0xc]
shr eax, 0x10
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x30]
call fcn.00427ed0
push dword [ebp - 0x30]
mov eax, dword [ebp - 8]
mov edx, 3
call fcn.0040c414
mov eax, dword [ebp - 8]
push dword [eax]
push 0x6390b8
mov eax, dword [ebx + 0xc]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x34]
call fcn.00427ed0
push dword [ebp - 0x34]
mov eax, dword [ebp - 8]
mov edx, 3
call fcn.0040c414
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x639067
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.00407020
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63909e
lea eax, [ebp - 0x34]
mov edx, 6
call fcn.0040b5f0
lea eax, [ebp - 4]
call fcn.0040b590
pop eax
jmp eax
Function at 0x63d1e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x63d253
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [0x6812bc]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
cmp dword [ebp - 4], 0
je 0x63d23b
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.0063d1c8
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x63c9b8]
call fcn.0063d988
mov dword [0x681320], eax
mov eax, dword [ebp - 4]
call fcn.0063d170
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63d25a
lea eax, [ebp - 8]
call fcn.0040ffd0
pop eax
jmp eax

Function at 0x63d284
Capabilities:
Get file system object information

Disassembly:
push esi
add esp, 0xfffffd4c
mov esi, 0x4008
test cl, cl
je 0x63d297
or esi, 2
test dl, dl
je 0x63d2a0
or esi, 0
jmp 0x63d2a3
or esi, 1
push esi
push 0x2b4
lea edx, [esp + 8]
push edx
push 0
push eax
call sub.shell32.dll_SHGetFileInfoW
mov eax, dword [esp + 4]
add esp, 0x2b4
pop esi
ret
Function at 0x64263c
Capabilities:
Check os version
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
mov ebx, eax
call fcn.00430e1c
cmp eax, 2
je 0x642659
mov byte [ebp - 1], 1
jmp 0x642835
mov byte [ebp - 1], 0
mov eax, 0x681bd0
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push 0x20
push 2
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_AllocateAndInitializeSid
test eax, eax
je 0x642835
xor eax, eax
push ebp
push 0x64282e
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetVersion
and eax, 0xff
cmp ax, 5
jb 0x6426c2
push 0x642840
push 0x64286c
call sub.kernel32.dll_GetModuleHandleW
push eax
call fcn.0041738c
mov ebx, eax
test ebx, ebx
je 0x6426e9
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
call ebx
test eax, eax
je 0x642815
cmp dword [ebp - 0xc], 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
jmp 0x642815
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
test eax, eax
jne 0x64273a
call sub.kernel32.dll_GetLastError
cmp eax, 0x3f0
je 0x64271b
call fcn.0040ad40
jmp 0x642835
lea eax, [ebp - 0x10]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x64273a
call fcn.0040ad40
jmp 0x642835
xor eax, eax
push ebp
push 0x64280e
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x64277d
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
je 0x64277d
call fcn.0040ad40
call fcn.0040ad40
jmp 0x642835
mov eax, dword [ebp - 0x14]
call fcn.00407004
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x6427b2
call fcn.0040ad40
call fcn.0040ad40
jmp 0x642835
mov eax, dword [ebp - 0x18]
mov esi, dword [eax]
dec esi
test esi, esi
jl 0x6427ed
inc esi
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x6427e9
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 8]
and eax, 0x14
cmp eax, 4
jne 0x6427e9
mov byte [ebp - 1], 1
jmp 0x6427ed
inc ebx
dec esi
jne 0x6427bf
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x642815
mov eax, dword [ebp - 0x18]
call fcn.00407020
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x642835
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_FreeSid
pop eax
jmp eax
movzx eax, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6428ac
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x6429dd
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.00407540
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.004294a0
mov eax, dword [ebp - 0xc]
call fcn.0040c128
push eax
call sub.wininet.dll_InternetOpenW
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x642936
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0x84000100
push 0
push 0
push 0x6429f0
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetOpenUrlW
test eax, eax
setne byte [ebp - 1]
push eax
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x642940
cmp byte [ebp - 1], 0
jne 0x6429af
lea edx, [ebp - 0x14]
mov eax, dword [0x68a1e0]
mov eax, dword [eax + 0x478]
call fcn.0055180c
mov eax, dword [ebp - 0x14]
mov edx, 0x642a28
call fcn.0040c4c4
je 0x6429af
xor edx, edx
push ebp
push 0x6429a5
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0x84000100
push 0
push 0
push 0x642a38
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetOpenUrlW
test eax, eax
setne byte [ebp - 1]
push eax
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6429af
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6429e4
lea eax, [ebp - 0x14]
call fcn.0040b590
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.0040b5f0
pop eax
jmp eax

Function at 0x642bc8
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov byte [ebp - 1], 0
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x642c27
xor eax, eax
push ebp
push 0x642c20
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x642c27
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle
pop eax
jmp eax
push 0x3e8
call sub.kernel32.dll_Sleep
movzx eax, byte [ebp - 1]
pop ecx
pop ecx
pop ebp
ret
Function at 0x6436b0
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x414], ecx
mov dword [ebp - 0x418], ecx
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
lea esi, [ebp - 0x10]
xor eax, eax
push ebp
push 0x643825
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0040b590
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x418]
mov eax, dword [0x68238c]
mov eax, dword [eax]
call fcn.00611410
mov eax, dword [ebp - 0x418]
lea edx, [ebp - 0x414]
call fcn.004294a0
mov eax, dword [ebp - 0x414]
call fcn.0040c128
push eax
call sub.wininet.dll_InternetOpenW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x6437fd
xor eax, eax
push ebp
push 0x643769
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x84000100
push 0
push 0
mov eax, edi
call fcn.0040c128
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetOpenUrlW
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x643783
cmp dword [ebp - 0xc], 0
jne 0x643794
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
jmp 0x6437fd
xor eax, eax
push ebp
push 0x6437e1
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
push 0x400
lea eax, [ebp - 0x410]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetReadFile
lea edx, [ebp - 0x410]
lea eax, [ebp - 4]
mov ecx, dword [esi]
call fcn.0040b848
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040c334
cmp dword [esi], 0
jne 0x6437a2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6437eb
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64382c
lea eax, [ebp - 0x418]
mov edx, 2
call fcn.0040b5f0
lea eax, [ebp - 4]
call fcn.0040b590
pop eax
jmp eax