joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44a6c0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x482843
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00474649
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], vtable.CBrush.0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.00479db9
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.0047b311
test eax, eax
je 0x44a7dc
mov ecx, dword [esp + 0x3c]
call fcn.00479de6
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x44a7a0
push edi
mov ecx, esi
call fcn.004773a8
mov ecx, esi
call fcn.0044a940
cmp dword [esp + 0x38], 1
jne 0x44a7d5
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.00477512
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x44d210
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x44d243
push esi
call fcn.00450300
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x44d23c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x44d2c9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x44d2b2
mov eax, dword [esi + 8]
test eax, eax
je 0x44d267
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x44d2ae
cmp eax, 2
je 0x44d2b2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x44d25a
cmp eax, 3
je 0x44d28d
cmp eax, 1
jne 0x44d25a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x44d25a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x44d25a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0044d2f0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x44d2d8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0044d2f0
add esp, 4
pop esi
ret

Function at 0x47543f
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x475477
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004734f3
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004734cb
jmp 0x475483
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x476b31
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x476b73
call fcn.0047c813
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x476b73
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x476b6a
xor eax, eax
jmp 0x476b7b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00476b81
pop edi
pop esi
pop ebx
ret 4

Function at 0x47cd43
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x47cd71
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x47cd8f
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0047cca9
jmp 0x47cd8f
mov eax, dword [esi + 0x14]
test eax, eax
je 0x47cd8f
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0047cca9
test edi, edi
mov eax, edi
jne 0x47cd79
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x404620
Capabilities:
Resolve function by parsing pe exports

Disassembly:
std
dec dword [0x347929a8]
xor eax, 0x2a0a08c1
sti

Function at 0x405d20
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
jbe 0x405d7d
call 0x40c520
dec ebp
ror byte [edi], 1
test dword [esi], esi
add byte [edi + 0x34dc3d83], bl
inc ecx
xchg edx, eax
adc al, 0x7b
mov esi, gs
add byte [eax], al
add byte [edx - 0x2dbefc0f], cl
test eax, eax
jne 0x5a405e2e
mov dword [0x41bb84], 1
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
test esi, esi
je 0x405db3
mov eax, dword [0x410301]
test eax, eax
jne 0x405d89
push eax
push 0x7e63f410
mov edx, 0x4bc7e8
add byte [ebx + 0x58380cc4], al
pop eax
add eax, dword [ecx]
test eax, eax
je 0x405dfa
lea ecx, [ebp + 0x48]
push esi
inc esi
inc ecx
invalid
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov ebx, eax
push 0xffffffffffffffff
push ebx
call dword [sym.imp.MSVCRT.dll___p__environ]
push eax
call fcn.00409b50
imul edi, dword [ebp + 0x10], 0x85136183
inc ecx
sub eax, 0x485348d
cmp al, byte [eax]
add byte [eax], cl
call dword [0x9440c15c]
add esp, 4
mov dword [edi], eax
sbb al, 0x15
and al, 0xc1
inc eax
add byte [ebx + 0x2ce8b3f], cl
xor eax, 0x44c10d8b
add dh, bl
movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 0xffffffef
rep movsb byte es:[edi], byte [esi]
push ebx
arpl word [0x40d050], dx
mov esi, dword [0xcbc128]
ljmp 0x8185

Function at 0x40b890
Capabilities:
Encode data using xor

Disassembly:
push ebx
fimul word [ebx + 0xb18246a]
sal byte [ebp + 0x18], 0x73
dec esp
and al, 0x14
mov ebp, dword [esi]
and al, 0x10
xor edx, edx
div ecx
mov ebx, eax
mov eax, dword [esp + 0xc]
mul dword [edx + 0x41a1d38b]
pop ebx
enter 0x5c8b, 0x24
wait
mov edx, dword [esp + 0x10]
jb 0x40b934
and al, 0x29
aam 0xe9
xor eax, 0xd19434db
fmul dword [ebx]
leave
jne 0x40b8c0
div ebx
mov bh, 0xf0
mul dword [ebp + ebx*4 + 0x18]
adc al, cl
mov eax, dword [esp + 0x14]
invalid
add byte [ebx], al
add byte [ecx], cl
add byte [ecx], al
sbb eax, 0x9e8
stc
rcr byte [ecx - 0x3d], 1
inc eax
ret

Function at 0x40202c
Capabilities:
Encode data using xor

Disassembly:
or dword [si + 0xec3], 0xffffff9b
mov dl, 1
invalid
salc
in al, dx
cmp byte [esi], bh
je 0x401f66
aam 0x8e
jmp 0x401fd0
jbe 0x401fca
mov esp, 0xb055b026
mov al, byte [0x84b97645]
pop edx
pop eax
add al, byte ss:[ecx + esi*4]
add ebx, ebp
invalid
invalid
invalid
invalid
Function at 0x4019e4
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ecx
push esi
push edi
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x401bbd
mov dword [ebp - 0x10c], eax
push 0
push eax
call sub.kernel32.dll_GetFileSize
mov dword [ebp - 0x108], eax
cmp eax, 0xa00000
jbe 0x401afc
push 0x21
push section..data
push 0x40909d
push dword [0x4098a8]
call sub.user32.dll_MessageBoxA
cmp eax, 2
jne 0x401a64
push dword [ebp - 0x10c]
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edi
pop esi
pop ecx
leave
ret 4
push 0x4097a0
push dword [ebp + 8]
call sub.kernel32.dll_lstrcmpiA
or eax, eax
jne 0x401a7c
pop edi
pop esi
pop ecx
leave
ret 4
push 0
push 0
push 0
push 4
push 0
push dword [ebp - 0x10c]
call sub.kernel32.dll_CreateFileMappingA
test eax, eax
je 0x401bbd
mov dword [ebp - 0x118], eax
push 0
push 0
push 0
push 2
push eax
call sub.kernel32.dll_MapViewOfFile
test eax, eax
je 0x401bbd
push eax
call fcn.00406819
pop dword [0x4098b8]
push 1
push 0x3eb
push dword [0x4098ac]
call sub.user32.dll_EnableMenuItem
push 1
push 0x3ec
push dword [0x4098ac]
call sub.user32.dll_EnableMenuItem
push dword [ebp - 0x118]
call sub.kernel32.dll_CloseHandle
mov dword [0x409790], 1
jmp 0x401b66
add eax, 0x2800
push eax
push 0x40
call sub.kernel32.dll_GlobalAlloc
test eax, eax
je 0x401bbd
push eax
lea ecx, [ebp - 0x118]
push 0
push ecx
push dword [ebp - 0x108]
push eax
push dword [ebp - 0x10c]
call sub.kernel32.dll_ReadFile
push 0
push 0x3eb
push dword [0x4098ac]
call sub.user32.dll_EnableMenuItem
push 0
push 0x3ec
push dword [0x4098ac]
call sub.user32.dll_EnableMenuItem
call fcn.00406819
pop dword [0x4098b8]
mov dword [0x409790], 0
push dword [ebp + 8]
call fcn.0040177b
push dword [ebp - 0x10c]
call sub.kernel32.dll_CloseHandle
push dword [ebp - 0x108]
pop dword [0x4098c8]
push 0
call fcn.004068b1
push dword [ebp + 8]
push dword [0x4098a8]
call fcn.0040684e
push dword [ebp + 8]
push 0x4097a0
call sub.kernel32.dll_lstrcpyA
call fcn.00406b72
and dword [0x4098f4], 0xfffeffff
mov eax, 1
jmp 0x401bc2
call fcn.00406ad9
pop edi
pop esi
pop ecx
leave
ret 4

Function at 0x401bc9
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push edi
push esi
push ecx
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x401c57
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 8]
push eax
push dword [0x4098c8]
push dword [0x4098b8]
push dword [ebp - 4]
call sub.kernel32.dll_WriteFile
test eax, eax
je 0x401c57
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
cmp dword [0x409790], 0
jne 0x401c46
push dword [ebp + 8]
push dword [0x4098a8]
call fcn.0040684e
push dword [ebp + 8]
push 0x4097a0
call sub.kernel32.dll_lstrcpyA
push dword [ebp + 8]
call fcn.0040177b
and dword [0x4098f4], 0xfffeffff
mov eax, 1
jmp 0x401c5c
call fcn.00406ad9
pop ecx
pop esi
pop edi
leave
ret 4
Function at 0x403fdd
Capabilities:
Enumerate process modules
Enumerate processes
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffb30
pushal
xor eax, eax
mov dword [ebp - 0x3b0], eax
mov dword [ebp - 0x3ac], eax
mov dword [ebp - 0x3a8], 5
call sub.kernel32.dll_GetVersion
mov dword [ebp - 0x3bc], eax
lea eax, [ebp - 0x4a8]
push eax
call sub.kernel32.dll_GetSystemInfo
push 0
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x378], eax
mov dword [ebp - 0x128], 0x128
mov dword [ebp - 0x34c], 0x224
call sub.kernel32.dll_GetCurrentProcessId
mov dword [ebp - 0x4d0], eax
lea eax, [ebp - 0x128]
push eax
push dword [ebp - 0x378]
call sub.kernel32.dll_Process32First
jmp 0x4041a8
lea edi, [ebp - 0x104]
cmp dword [ebp - 0x3bc], 0
jge 0x40407b
push edi
call sub.kernel32.dll_lstrlenA
add edi, eax
mov al, 0x5c
std
repne scasb al, byte es:[edi]
add edi, 2
cld
mov dword [ebp - 0x398], edi
mov edi, dword [ebp - 0x120]
or edi, edi
je 0x404196
cmp edi, dword [ebp - 0x4d0]
je 0x404196
mov dword [ebp - 0x3b0], 0
push edi
push 0
push 0
call fcn.004041c0
mov dword [ebp - 0x384], eax
lea eax, [ebp - 0x3b0]
push eax
push 0
push 0x1100
push 0x3e8
push dword [ebp + 8]
call sub.user32.dll_SendDlgItemMessageA
mov dword [ebp - 0x3b4], eax
push edi
push 8
call sub.kernel32.dll_CreateToolhelp32Snapshot
push eax
mov dword [ebp - 0x37c], eax
lea eax, [ebp - 0x34c]
push eax
push dword [ebp - 0x37c]
call sub.kernel32.dll_Module32First
jmp 0x404183
lea edi, [ebp - 0x484]
mov eax, dword [ebp - 0x334]
shr eax, 0xa
push eax
push dword [ebp - 0x338]
lea eax, [ebp - 0x32c]
push eax
push str._s____08X__ukb
push edi
call sub.user32.dll_wsprintfA
add esp, 0x14
mov dword [ebp - 0x398], edi
push dword [ebp - 0x120]
push dword [ebp - 0x334]
push dword [ebp - 0x338]
call fcn.004041c0
mov dword [ebp - 0x384], eax
push dword [ebp - 0x3b4]
pop dword [ebp - 0x3b0]
lea eax, [ebp - 0x3b0]
push eax
push 0
push 0x1100
push 0x3e8
push dword [ebp + 8]
call sub.user32.dll_SendDlgItemMessageA
lea eax, [ebp - 0x34c]
push eax
push dword [ebp - 0x37c]
call sub.kernel32.dll_Module32Next
or eax, eax
jne 0x4040fc
call sub.kernel32.dll_CloseHandle
add esi, dword [ebp - 0x4bc]
lea eax, [ebp - 0x128]
push eax
push dword [ebp - 0x378]
call sub.kernel32.dll_Process32Next
or eax, eax
jne 0x40405b
push dword [ebp - 0x378]
call sub.kernel32.dll_CloseHandle
popal
leave
ret 4
Function at 0x40451c
Capabilities:
Open clipboard

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
pushal
push 0
push 0
push 0x14b
push 0x3e9
push dword [ebp + 8]
call sub.user32.dll_SendDlgItemMessageA
push dword [ebp + 8]
call sub.user32.dll_OpenClipboard
xor esi, esi
lea ebx, [ebp - 0xff]
push esi
call sub.user32.dll_EnumClipboardFormats
or eax, eax
je 0x4045da
mov esi, eax
cmp eax, 1
jb 0x404586
cmp eax, 0x11
jae 0x404586
push esi
lea esi, str.CF_TEXT
xor edi, edi
jmp 0x40457f
push eax
mov ebx, esi
push esi
call sub.kernel32.dll_lstrlenA
inc eax
add esi, eax
inc edi
pop eax
cmp edi, eax
jb 0x404571
pop esi
jmp 0x404592
push 0xff
push ebx
push esi
call sub.user32.dll_GetClipboardFormatNameA
push ebx
push 0xffffffffffffffff
push 0x158
push 0x3e9
push dword [ebp + 8]
call sub.user32.dll_SendDlgItemMessageA
cmp eax, 0xffffffff
jne 0x4045d5
push ebx
push 0
push 0x143
push 0x3e9
push dword [ebp + 8]
call sub.user32.dll_SendDlgItemMessageA
push esi
push eax
push 0x151
push 0x3e9
push dword [ebp + 8]
call sub.user32.dll_SendDlgItemMessageA
jmp 0x40454c
call sub.user32.dll_CloseClipboard
push 0
push 0
push 0x14e
push 0x3e9
push dword [ebp + 8]
call sub.user32.dll_SendDlgItemMessageA
popal
leave
ret 4

Function at 0x404eb5
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffcc0
push esi
push ebx
mov esi, dword [ebp + 0xc]
push dword [ebp + 0xc]
call sub.kernel32.dll_lstrlenA
add esi, eax
cmp byte [esi - 1], 0x5c
je 0x404ed8
mov word [esi], 0x5c
push dword [ebp + 0xc]
lea eax, [ebp - 0xff]
push eax
call sub.kernel32.dll_lstrcpyA
push dword [ebp + 0xc]
push 0x1388
push dword [ebp + 8]
call sub.user32.dll_SetDlgItemTextA
push 0x407443
push dword [ebp + 0xc]
call sub.kernel32.dll_lstrcatA
lea ebx, [ebp - 0x33c]
push ebx
push eax
call sub.kernel32.dll_FindFirstFileA
mov dword [ebp - 0x340], eax
mov esi, dword [0x409be5]
jmp 0x404fb7
test dword [ebp - 0x33c], 2
je 0x404f36
test byte [esi + 0xc], 4
jne 0x404f36
jmp 0x404fa5
test dword [ebp - 0x33c], 0x10
je 0x404f7c
cmp byte [ebp - 0x310], 0x2e
je 0x404fa5
test byte [esi + 0xc], 1
je 0x404f7a
lea eax, [ebp - 0xff]
push eax
lea eax, [ebp - 0x1fe]
push eax
call sub.kernel32.dll_lstrcpyA
lea ebx, [ebp - 0x310]
push ebx
push eax
call sub.kernel32.dll_lstrcatA
push eax
push dword [ebp + 8]
call fcn.00404eb5
jmp 0x404fa5
lea eax, [ebp - 0xff]
push eax
lea eax, [ebp - 0x1fe]
push eax
call sub.kernel32.dll_lstrcpyA
lea ebx, [ebp - 0x310]
push ebx
push eax
call sub.kernel32.dll_lstrcatA
push eax
push dword [ebp + 8]
call fcn.00404fd6
lea eax, [ebp - 0x33c]
push eax
push dword [ebp - 0x340]
call sub.kernel32.dll_FindNextFileA
or eax, eax
je 0x404fc5
test byte [esi + 0xc], 2
jne 0x404f22
push dword [ebp - 0x340]
call sub.kernel32.dll_FindClose
pop ebx
pop esi
leave
ret 8
Function at 0x404fd6
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push esi
push edi
push ebx
push 0
push 0
push 3
push 0
push 0
push 0x80000000
push dword [ebp + 0xc]
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x4050ab
mov dword [ebp - 0x10], eax
push 0
push eax
call sub.kernel32.dll_GetFileSize
or eax, eax
je 0x4050a3
push eax
push 0
push 0
push 0
push 2
push 0
push dword [ebp - 0x10]
call sub.kernel32.dll_CreateFileMappingA
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 4
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 4], eax
mov esi, eax
pop ebx
add eax, ebx
mov edi, dword [0x409be5]
sub eax, dword [edi + 4]
jmp 0x40508f
push eax
push dword [edi + 4]
lea eax, [edi + 0x10c]
push eax
push esi
call dword [edi + 8]
or eax, eax
je 0x40508d
push dword [ebp + 0xc]
push 0
push 0x180
push 0x3f2
push dword [ebp + 8]
call sub.user32.dll_SendDlgItemMessageA
sub esi, dword [ebp - 4]
push esi
push eax
push 0x19a
push 0x3f2
push dword [ebp + 8]
call sub.user32.dll_SendDlgItemMessageA
pop eax
jmp 0x405093
inc esi
pop eax
cmp esi, eax
jbe 0x405049
push dword [ebp - 4]
call sub.kernel32.dll_UnmapViewOfFile
push dword [ebp - 0xc]
call sub.kernel32.dll_CloseHandle
push dword [ebp - 0x10]
call sub.kernel32.dll_CloseHandle
pop ebx
pop edi
pop esi
leave
ret 8

Function at 0x4056f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffca8
push esi
lea esi, [ebp - 0x103]
push 0xff
push esi
push dword [0x4098b4]
call sub.kernel32.dll_GetModuleFileNameA
push 0xff
lea eax, [ebp - 0x32e]
push eax
push esi
call sub.kernel32.dll_GetShortPathNameA
lea esi, [ebp - 0x32e]
mov dword [ebp - 0x358], 0x28
mov dword [ebp - 0x348], 0x409000
mov dword [ebp - 0x34c], 0x409743
push dword [0x4098a4]
pop dword [ebp - 0x350]
push dword [0x4098a8]
pop dword [ebp - 0x354]
mov dword [ebp - 0x340], 0x3e8
mov dword [ebp - 0x344], 0x83
xor eax, eax
mov dword [ebp - 0x33c], eax
mov dword [ebp - 0x338], eax
mov dword [ebp - 0x334], eax
lea eax, [ebp - 0x358]
push eax
call sub.user32.dll_MessageBoxIndirectA
push esi
cmp eax, 6
jne 0x4057a0
push str.regsvr32__s
jmp 0x4057b0
cmp eax, 7
jne 0x4057ac
push str.regsvr32__u__s
jmp 0x4057b0
pop esi
pop esi
leave
ret
lea eax, [ebp - 0x22f]
push eax
call sub.user32.dll_wsprintfA
add esp, 0xc
push 5
lea eax, [ebp - 0x22f]
push eax
call sub.kernel32.dll_WinExec
push 0xff
lea eax, [ebp - 0x103]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
lea eax, [ebp - 0x103]
push eax
push str.Path
push 0x40749e
call sub.kernel32.dll_WriteProfileStringA
pop esi
leave
ret
Function at 0x4057f9
Capabilities:
Create process on windows
Extract resource via kernel32 functions
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push esi
push ebx
push edi
push 0x17
push 0x65
push dword [0x4098a4]
call sub.kernel32.dll_FindResourceA
push eax
push eax
push dword [0x4098a4]
call sub.kernel32.dll_LoadResource
push eax
call sub.kernel32.dll_LockResource
mov edi, eax
push 1
lea eax, [ebp - 0xff]
push eax
call section..text
push str.readme.htm
push eax
call sub.kernel32.dll_lstrcatA
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push eax
call sub.kernel32.dll_CreateFileA
mov esi, eax
push dword [0x4098a4]
call sub.kernel32.dll_SizeofResource
lea ebx, [ebp - 0x10c]
push 0
push ebx
push eax
push edi
push esi
call sub.kernel32.dll_WriteFile
push esi
call sub.kernel32.dll_CloseHandle
push 5
push 0
push 0
lea eax, [ebp - 0xff]
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
pop edi
pop ebx
pop esi
leave
ret

Function at 0x405896
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push 1
lea eax, [ebp - 0xff]
push eax
call section..text
push str.readme.htm
push eax
call sub.kernel32.dll_lstrcatA
push eax
call sub.kernel32.dll_DeleteFileA
leave
ret
Function at 0x4063bf
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push esi
push edi
push edx
push ebx
push edx
call sub.kernel32.dll_GetCommandLineA
mov esi, eax
mov dword [ebp - 8], eax
push eax
call sub.kernel32.dll_lstrlenA
add dword [ebp - 8], eax
push eax
push 0x40
call sub.kernel32.dll_GlobalAlloc
mov dword [0x409786], eax
push 0x3fc
push 0x40
call sub.kernel32.dll_GlobalAlloc
mov dword [0x40978a], eax
mov edi, eax
xor ebx, ebx
jmp 0x406480
cmp dword [ebp + 8], 0
je 0x406436
cmp ebx, 1
jne 0x406436
push esi
push edi
call sub.kernel32.dll_lstrcpyA
cmp byte [eax], 0x22
jne 0x40642c
inc eax
mov dword [ebx*4 + 0x40978a], eax
push eax
call sub.kernel32.dll_lstrlenA
mov byte [eax + edi], 0
jmp 0x406433
mov dword [ebx*4 + 0x40978a], eax
inc ebx
jmp 0x406496
cmp byte [esi], 0x22
je 0x406446
mov ah, 0x20
mov dword [ebp - 4], 0
jmp 0x406450
mov ah, 0x22
inc esi
mov dword [ebp - 4], 1
mov edx, esi
lodsb al, byte [esi]
or al, al
je 0x40645d
cmp al, ah
je 0x40645d
jmp 0x406452
mov eax, esi
sub eax, edx
push eax
push edx
push edi
call sub.kernel32.dll_lstrcpynA
mov dword [ebx*4 + 0x40978a], eax
inc ebx
push eax
call sub.kernel32.dll_lstrlenA
add edi, eax
mov byte [edi], 0
inc edi
add esi, dword [ebp - 4]
cmp byte [esi], 0
je 0x406496
cmp esi, dword [ebp - 8]
jae 0x406496
cmp ebx, 0xff
jb 0x406401
mov eax, ebx
pop edx
pop ebx
pop edx
pop edi
pop esi
leave
ret 4
Function at 0x4064b8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push 0x3e8
push 0
call sub.user32.dll_LoadAcceleratorsA
mov dword [ebp - 0x50], eax
push 0x30
lea eax, [ebp - 0x30]
push eax
call sub.kernel32.dll_RtlZeroMemory
mov dword [ebp - 0x30], 0x30
mov dword [ebp - 0x2c], 0x2003
push dword [ebp + 8]
pop dword [ebp - 0x1c]
mov dword [ebp - 0xc], 0x3e8
push 0x3e8
push dword [0x4098a4]
call sub.user32.dll_LoadIconA
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], 0x405f4f
mov dword [ebp - 8], str.xNotePad_ASMClass
lea eax, [ebp - 0x30]
push eax
call sub.user32.dll_RegisterClassExA
mov eax, 0x80000000
push 0
push dword [ebp + 8]
push 0
push 0
push eax
push eax
push eax
push eax
push 0xef0000
push section..data
push str.xNotePad_ASMClass
push 0x210
call sub.user32.dll_CreateWindowExA
push 1
push dword [0x4098a8]
call sub.user32.dll_ShowWindow
push dword [0x4098a8]
call sub.user32.dll_UpdateWindow
call fcn.004066dd
push 0
push 0
push 0
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_GetMessageA
test eax, eax
je 0x406617
lea eax, [ebp - 0x4c]
push eax
push dword [ebp - 0x50]
push dword [0x4098a8]
call sub.user32.dll_TranslateAcceleratorA
or eax, eax
jne 0x406612
cmp dword [0x4098f8], 0
je 0x4065c4
lea eax, [ebp - 0x4c]
push eax
push dword [0x4098f8]
call sub.user32.dll_IsDialogMessageA
test eax, eax
jne 0x40657b
cmp dword [0x4098fc], 0
je 0x4065e0
lea eax, [ebp - 0x4c]
push eax
push dword [0x4098fc]
call sub.user32.dll_IsDialogMessageA
test eax, eax
jne 0x40657b
cmp dword [0x409900], 0
je 0x406600
lea eax, [ebp - 0x4c]
push eax
push dword [0x409900]
call sub.user32.dll_IsDialogMessageA
test eax, eax
jne 0x40657b
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_TranslateMessage
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_DispatchMessageA
jmp 0x40657b
mov eax, dword [ebp - 0x44]
leave
ret 0x10

Function at 0x40661e
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
pushal
call sub.kernel32.dll_GetCurrentProcess
mov ebx, eax
xor edi, edi
lea eax, [ebp - 0x14]
push eax
push 0x28
push ebx
call sub.advapi32.dll_OpenProcessToken
lea eax, [ebp - 0xc]
push eax
push str.SeDebugPrivilege
push edi
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [ebp - 0x10], 1
mov dword [ebp - 4], 2
push edi
push edi
push edi
lea eax, [ebp - 0x10]
push eax
push edi
push dword [ebp - 0x14]
call sub.advapi32.dll_AdjustTokenPrivileges
popal
leave
ret