joyce8/EMBER2024-capa huggingface dataset:
Function at 0x455050
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dfd79
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x538a60]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x60], 0
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], 0
mov dword [ebp - 0x64], edi
mov byte [edi], 0
lea eax, [ebp - 0x5c]
mov dword [ebp - 4], 0
push eax
push 0x20119
push 0
push str.SOFTWAREMicrosoftCryptography
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x60], 1
mov dword [ebp - 0x54], 0x40
mov dword [ebp - 0x58], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x58]
push eax
push 0
push str.MachineGuid
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test esi, esi
jne 0x455115
test eax, eax
jne 0x455115
cmp byte [ebp - 0x50], al
je 0x455109
lea eax, [ebp - 0x50]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x455100
sub eax, edx
push eax
lea eax, [ebp - 0x50]
mov ecx, edi
push eax
call fcn.004704b0
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004bae74
mov esp, ebp
pop ebp
ret
Function at 0x455630
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, ecx
push esi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x45565d
test esi, esi
je 0x455659
lea ecx, [ecx]
mov byte [eax], 0
lea eax, [eax + 1]
dec esi
jne 0x455650
mov eax, ecx
pop esi
ret
push str.Failed_to_allocate_memory_on_process_heap_n
call fcn.004bc829
add esp, 4
push 1
call fcn.004bcc8d
int3

Function at 0x455680
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x538a60]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
test esi, esi
jne 0x4556a9
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004bae74
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x104]
push eax
push 0x100
push esi
call dword [sym.imp.PGPsdk.dll_PGPGetErrorString]
lea eax, [ebp - 0x104]
push eax
push esi
push str.PGP_Error:_Failed_with__d___s_n
call fcn.004bc829
add esp, 0x18
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
call fcn.004bcc8d
int3
Function at 0x457880
Capabilities:
Check for time delay via gettickcount
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x538a60]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, edx
mov ebx, ecx
mov edx, dword [0x560d68]
push edi
mov edi, dword [0x53ed5c]
mov dword [ebp - 0xc], esi
cmp edx, edi
jne 0x457952
inc dword [0x53ec54]
mov eax, dword [0x560e00]
cmp eax, 0xffffffff
je 0x4578e2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x4578d8
push str.Failed_to_close_dump_for_new_part_n
call fcn.004bc829
add esp, 4
jmp 0x4578e2
mov dword [0x560e00], 0xffffffff
push dword [0x560dfc]
push dword [0x53ec54]
push 0x561208
push 0x561418
push 0x55ed60
push str._s_s__S__d._s
push 0x1000
push 0x552d60
call fcn.004bb50e
add esp, 0x20
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push 0x552d60
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, eax
mov dword [0x560e00], ecx
cmp ecx, 0xffffffff
je 0x457a79
mov edi, dword [0x53ed5c]
xor edx, edx
mov dword [0x560d68], edx
jmp 0x457958
mov ecx, dword [0x560e00]
imul esi, dword [ebp + 8]
mov dword [ebp - 8], 0
lea eax, [esi + edx]
cmp eax, edi
jbe 0x4579b0
push 0
lea eax, [ebp - 8]
sub edi, edx
push eax
push edi
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x457a92
mov eax, dword [ebp - 8]
sub esi, edi
add dword [0x560d68], eax
mov edx, 1
push esi
lea ecx, [ebx + eax]
call fcn.00457880
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bae74
mov esp, ebp
pop ebp
ret
cmp ecx, 0xffffffff
je 0x457aa6
push 0
lea eax, [ebp - 8]
push eax
push esi
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x457aba
mov eax, dword [0x560d68]
mov ecx, dword [ebp - 8]
add eax, ecx
mov dword [0x560d68], eax
cmp ecx, esi
jne 0x457ace
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov ecx, eax
sub ecx, dword [0x560e04]
cmp ecx, 0xbb8
jbe 0x457a68
push 0
mov eax, 0x10624dd3
mul ecx
push 0x400
push dword [0x560d64]
mov esi, edx
push dword [0x560d60]
shr esi, 6
call fcn.004c1450
push 0
push esi
push edx
push eax
call fcn.004c1450
mov ecx, dword [0x53ec54]
imul ecx, dword [0x53ed5c]
push eax
mov eax, dword [0x560d68]
shr eax, 0xa
shr ecx, 0xa
add ecx, eax
push ecx
push str._rAcquired__dKB____dKB_sec___________________________r
call fcn.004bc829
add esp, 0xc
call edi
xorps xmm0, xmm0
mov dword [0x560e04], eax
movlpd qword [0x560d60], xmm0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004bae74
mov esp, ebp
pop ebp
ret
push 0x552d60
push str.Failed_to_open__S_n
call fcn.004bc829
add esp, 8
push 1
call fcn.004bcc8d
push str.WriteFile_failed_n
call fcn.004bc829
add esp, 4
push 1
call fcn.004bcc8d
push str.dump_is_invalid__exiting_n
call fcn.004bc829
add esp, 4
push 1
call fcn.004bcc8d
push str.WriteFile_failed_n
call fcn.004bc829
add esp, 4
push 1
call fcn.004bcc8d
push eax
push dword [ebp - 0xc]
push dword [ebp + 8]
push ecx
push str.ERROR___wrote__d_of__d_size__d_bytes__write_count___d_n
call fcn.004bc829
add esp, 0x14
push 1
call fcn.004bcc8d
int3
Function at 0x457af0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x538a60]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
mov dword [ebp - 0x114], edx
push esi
lea esi, [eax + eax]
test ebx, ebx
jne 0x457b1f
mov dword [ebp - 0x10c], ecx
jmp 0x457b33
push 0x1000
push ebx
call fcn.004bbd22
add esp, 8
mov dword [ebp - 0x10c], eax
push edi
lea eax, [ebp - 0x108]
mov dword [ebp - 0x108], 0
push eax
push 2
lea eax, [ebp - 0x10c]
push eax
push dword [0x53ebb8]
call dword [sym.imp.PGPsdk.dll_PGPCFBEncrypt]
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x457cd2
push 1
lea edx, [eax + 2]
lea ecx, [ebp - 0x108]
call fcn.00457880
push 0x548d60
push dword [ebp - 0x10c]
push ebx
push dword [0x53ebb8]
call dword [sym.imp.PGPsdk.dll_PGPCFBEncrypt]
mov edi, eax
add esp, 0x14
test edi, edi
jne 0x457d0c
push dword [ebp - 0x10c]
lea edx, [eax + 1]
mov ecx, 0x548d60
call fcn.00457880
mov edi, dword [sym.imp.PGPsdk.dll_PGPCFBEncrypt]
mov ecx, 0x1000
cmp esi, ecx
mov eax, esi
cmova eax, ecx
mov dword [ebp - 0x110], eax
lea eax, [ebp - 0x108]
push eax
push 2
lea eax, [ebp - 0x110]
push eax
push dword [0x53ebb8]
call edi
add esp, 0x14
mov dword [ebp - 0x118], eax
test eax, eax
je 0x457c11
lea ecx, [ebp - 0x104]
push ecx
push 0x100
push eax
call dword [sym.imp.PGPsdk.dll_PGPGetErrorString]
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x118]
jmp 0x457ced
push 1
mov edx, 2
lea ecx, [ebp - 0x108]
call fcn.00457880
mov eax, dword [ebp - 0x110]
add esp, 4
test eax, eax
je 0x457c63
push 0x548d60
push eax
push dword [ebp - 0x114]
push dword [0x53ebb8]
call edi
mov ecx, eax
call fcn.00455680
push dword [ebp - 0x110]
mov edx, 1
mov ecx, 0x548d60
call fcn.00457880
add esp, 0x14
lea eax, [ebp - 0x108]
mov dword [ebp - 0x10c], 0xffffffff
push eax
push 2
lea eax, [ebp - 0x10c]
push eax
push dword [0x53ebb8]
call edi
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x457cd2
push 1
lea edx, [eax + 2]
lea ecx, [ebp - 0x108]
call fcn.00457880
mov eax, dword [ebp - 0x110]
add esp, 4
pop edi
cmp eax, esi
je 0x457cc2
mov edx, dword [ebp - 0x114]
sub esi, eax
push esi
mov ecx, ebx
lea edx, [edx + eax*2]
call fcn.00457af0
add esp, 4
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004bae74
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x104]
push eax
push 0x100
push edi
call dword [sym.imp.PGPsdk.dll_PGPGetErrorString]
lea eax, [ebp - 0x104]
push eax
push edi
push str.PGP_Error:_Failed_with__d___s_n
call fcn.004bc829
add esp, 0x18
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
call fcn.004bcc8d
lea eax, [ebp - 0x104]
push eax
push 0x100
push edi
call dword [sym.imp.PGPsdk.dll_PGPGetErrorString]
lea eax, [ebp - 0x104]
push eax
push edi
push str.PGP_Error:_Failed_with__d___s_n
call fcn.004bc829
add esp, 0x18
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
call fcn.004bcc8d
int3
Function at 0x45d890
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa08
mov eax, dword [0x538a60]
xor eax, ebp
mov dword [ebp - 4], eax
movdqu xmm0, xmmword [str.NetBIOS]
push esi
push edi
push 0x30
lea eax, [ebp - 0x9f8]
push 0
push eax
movdqu xmmword [ebp - 0xa08], xmm0
call fcn.004c13c0
movdqu xmm0, xmmword [str.DNS_HOSTNAME]
movzx eax, word [0x521f5c]
mov word [ebp - 0x9b0], ax
mov eax, dword [0x521f70]
movdqu xmmword [ebp - 0x9c8], xmm0
mov dword [ebp - 0x978], eax
movq xmm0, qword [0x521f54]
movzx eax, word [0x521f74]
movq qword [ebp - 0x9b8], xmm0
xorps xmm0, xmm0
movdqu xmmword [ebp - 0x9ae], xmm0
push 0x2a
movdqu xmmword [ebp - 0x99e], xmm0
mov word [ebp - 0x974], ax
lea eax, [ebp - 0x972]
movdqu xmm0, xmmword [str.DNS_DOMAIN]
push 0
push eax
mov dword [ebp - 0x98e], 0
mov word [ebp - 0x98a], 0
movdqu xmmword [ebp - 0x988], xmm0
call fcn.004c13c0
movzx eax, word [0x521f88]
movdqu xmm0, xmmword [str.DNS_FQDN]
push 0x2e
mov word [ebp - 0x938], ax
lea eax, [ebp - 0x936]
push 0
push eax
movdqu xmmword [ebp - 0x948], xmm0
call fcn.004c13c0
movdqu xmm0, xmmword [str.NETBIOS]
push 0x30
lea eax, [ebp - 0x8f8]
push 0
push eax
movdqu xmmword [ebp - 0x908], xmm0
call fcn.004c13c0
movdqu xmm3, xmmword [str.PHYSICAL_DNS_HOSTNAME]
mov eax, dword [0x521fc4]
add esp, 0x30
movdqu xmm2, xmmword [0x521fac]
mov edi, dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
xor esi, esi
movq xmm1, qword [0x521fbc]
xorps xmm0, xmm0
movdqu xmmword [ebp - 0x89c], xmm0
mov dword [ebp - 0x8a0], eax
movdqu xmmword [ebp - 0x85c], xmm0
mov dword [ebp - 0x860], eax
movdqu xmm0, xmmword [str.PHYSICAL_DNS_FQDN]
mov eax, dword [0x521fe8]
movdqu xmmword [ebp - 0x8c8], xmm3
mov dword [ebp - 0x88c], 0
movdqu xmmword [ebp - 0x848], xmm0
mov dword [ebp - 0x84c], 0
movdqu xmm0, xmmword [0x521fd8]
mov dword [ebp - 0x828], eax
movdqu xmmword [ebp - 0x8b8], xmm2
mov dword [ebp - 0x80c], 0
movdqu xmmword [ebp - 0x838], xmm0
mov dword [ebp - 0x808], 0x400
xorps xmm0, xmm0
movq qword [ebp - 0x8a8], xmm1
movdqu xmmword [ebp - 0x888], xmm3
movdqu xmmword [ebp - 0x878], xmm2
movq qword [ebp - 0x868], xmm1
movdqu xmmword [ebp - 0x824], xmm0
movq qword [ebp - 0x814], xmm0
lea ecx, [ecx]
lea eax, [ebp - 0x808]
push eax
lea eax, [ebp - 0x804]
push eax
push esi
call edi
test eax, eax
je 0x45db11
cmp byte [0x53eb9e], 0
jne 0x45dad4
cmp esi, 1
jne 0x45dab6
lea eax, [ebp - 0x804]
push eax
push 0x100
push 0x561418
jmp 0x45dacc
cmp esi, 2
jne 0x45dad4
lea eax, [ebp - 0x804]
push eax
push 0x100
push 0x561218
call fcn.004bb73b
add esp, 0xc
mov dword [ebp - 0x808], 0x400
lea eax, [ebp - 0x804]
mov ecx, 0x400
lea esp, [esp]
mov byte [eax], 0
lea eax, [eax + 1]
dec ecx
jne 0x45daf0
inc esi
cmp esi, 8
jl 0x45da80
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bae74
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetComputerNameEx_failed___d__n
call fcn.004bc829
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
mov eax, 1
pop edi
pop esi
call fcn.004bae74
mov esp, ebp
pop ebp
ret
Function at 0x460d00
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x538a60]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x53eb85], 0
je 0x460e21
cmp byte [0x53eb9e], 1
je 0x460e21
mov ecx, 0x44
lea eax, [ebp - 0x50]
mov byte [eax], 0
lea eax, [eax + 1]
dec ecx
jne 0x460d32
mov dword [ebp - 0x50], 0x44
lea eax, [ebp - 0x60]
mov ecx, 0x10
lea ebx, [ebx]
mov byte [eax], 0
lea eax, [eax + 1]
dec ecx
jne 0x460d50
or dword [ebp - 0x24], 0x100
mov ecx, str.AMD64
mov eax, 0x560e08
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x460d96
test dx, dx
je 0x460d92
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x460d96
add eax, 4
add ecx, 4
test dx, dx
jne 0x460d70
xor eax, eax
jmp 0x460d9b
sbb eax, eax
or eax, 1
push 0x55ed60
test eax, eax
jne 0x460dab
push str.c:WindowsSysnative_netsh.exe_trace_start_captureyes_tracefile__s_network.etl_
jmp 0x460db0
push str.c:WindowsSystem32_netsh.exe_trace_start_captureyes_tracefile__s_network.etl_
push 0x1000
push 0x552d60
call fcn.004bb50e
add esp, 0x10
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x50]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x552d60
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x460e04
mov ecx, str.startNetworkEtl:_CreateProcess_failed_n
call fcn.00458190
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bae74
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
push dword [ebp - 0x60]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x60]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x5c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.004bae74
mov esp, ebp
pop ebp
ret
Function at 0x460e40
Capabilities:
Create process on windows
Schedule task via schtasks

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2074
call fcn.004c2ee0
mov eax, dword [0x538a60]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x1000
push 0x54ed60
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [eax*2 - 0x12]
cmp eax, 0x2000
jae 0x461033
xor ecx, ecx
mov word [eax + 0x54ed60], cx
mov ecx, 0x44
lea eax, [ebp - 0x2060]
mov byte [eax], 0
lea eax, [eax + 1]
dec ecx
jne 0x460e90
mov dword [ebp - 0x2060], 0x44
lea eax, [ebp - 0x2070]
mov ecx, 0x10
mov edi, edi
mov byte [eax], 0
lea eax, [eax + 1]
dec ecx
jne 0x460eb0
or dword [ebp - 0x2034], 0x100
push 0x10
call fcn.004bb090
add esp, 4
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [esi + 0xa]
lea eax, [ebp - 0x18]
push ecx
movzx ecx, word [esi + 8]
push ecx
push str._02d:_02d:00
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
push esi
call fcn.004bae6f
add esp, 0x14
lea eax, [ebp - 0x2018]
cmp byte [0x53eb66], 0
push 0x54cd60
push dword [0x53eb60]
push 0x54ed60
je 0x460f1e
push str.__sreact.exe__nochecks__poll__d__remote__s
jmp 0x460f23
push str.__sreact.exe___poll__d__remote__s
push 0xffffffffffffffff
push 0x800
push eax
call fcn.004bb4ef
add esp, 0x1c
mov ecx, str.AMD64
mov eax, 0x560e08
lea ecx, [ecx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x460f66
test dx, dx
je 0x460f62
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x460f66
add eax, 4
add ecx, 4
test dx, dx
jne 0x460f40
xor eax, eax
jmp 0x460f6b
sbb eax, eax
or eax, 1
test eax, eax
lea eax, [ebp - 0x18]
push eax
push 0x54ed60
lea eax, [ebp - 0x2018]
push eax
jne 0x460f86
push str.c:WindowsSysnativecmd.exe__c_echo__s___react.bat__schtasks__Create__TN_REACT__TR____sreact.bat____SC_MINUTE__MO_2__ST__s__RU_SYSTEM
jmp 0x460f8b
push str.c:WindowsSystem32cmd.exe__c_echo__s___react.bat__schtasks__Create__TN_REACT__TR____sreact.bat____SC_MINUTE__MO_2__ST__s__RU_SYSTEM
push 0x1000
push 0x552d60
call fcn.004bb50e
add esp, 0x18
lea eax, [ebp - 0x2070]
push eax
lea eax, [ebp - 0x2060]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x552d60
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x460fe6
mov ecx, str.Persist_failed_n
call fcn.00458190
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bae74
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
push dword [ebp - 0x2070]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x2070]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x206c]
call esi
lea eax, [ebp - 0x2018]
push eax
call fcn.004bb0e1
lea eax, [ebp - 0x18]
push eax
call fcn.004bb0e1
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
xor eax, eax
pop esi
call fcn.004bae74
mov esp, ebp
pop ebp
ret
call fcn.004bbfd4
int3
Function at 0x461770
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2008
call fcn.004c2ee0
mov eax, dword [0x538a60]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push eax
push 0x54ed60
push str._s_s
lea eax, [ebp - 0x2004]
mov edi, edx
push 0x1000
push eax
mov ebx, ecx
call fcn.004bb50e
add esp, 0x14
lea eax, [ebp - 0x2004]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x461815
lea eax, [ebp - 0x2004]
push eax
push str.dropFile:_Failed_to_open__s_n
push esi
push 0x800
push 0x545d60
call fcn.004bb4ef
add esp, 0x14
mov ecx, 0x545d60
call fcn.00458190
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bae74
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 0x2008]
mov dword [ebp - 0x2008], 0
push eax
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x46187c
lea eax, [ebp - 0x2004]
push eax
push str.dropFile:_Failed_to_write__s_n
push 0xffffffffffffffff
push 0x800
push 0x545d60
call fcn.004bb4ef
add esp, 0x14
mov ecx, 0x545d60
call fcn.00458190
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bae74
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004bae74
mov esp, ebp
pop ebp
ret

Function at 0x4618a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov esi, edx
movzx eax, cx
push esi
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x4618e5
push esi
push str.extractResource:_Critical_error__failed_to_find_resource__s_n
push 0xffffffffffffffff
push 0x800
push 0x545d60
call fcn.004bb4ef
add esp, 0x14
mov ecx, 0x545d60
call fcn.00458190
lea eax, [edi + 1]
pop edi
pop esi
pop ebp
ret
push ebx
push edi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
jne 0x461921
push esi
push str.extractResource:_Critical_error__failed_to_load_resource__s_n
push 0xffffffffffffffff
push 0x800
push 0x545d60
call fcn.004bb4ef
add esp, 0x14
mov ecx, 0x545d60
call fcn.00458190
lea eax, [ebx + 1]
pop ebx
pop edi
pop esi
pop ebp
ret
mov esi, dword [ebp + 8]
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, eax
mov ecx, ebx
call fcn.00461770
add esp, 4
test eax, eax
je 0x46196c
push esi
push str.extractResource:_Critical_error__failed_to_drop_file__s_n
push 0xffffffffffffffff
push 0x800
push 0x545d60
call fcn.004bb4ef
add esp, 0x14
mov ecx, 0x545d60
call fcn.00458190
pop ebx
pop edi
mov eax, 1
pop esi
pop ebp
ret
pop ebx
pop edi
xor eax, eax
pop esi
pop ebp
ret
Function at 0x4620f0
Capabilities:
Delete file

Disassembly:
push esi
push str.osquery.exe
mov edx, str.osquery
mov ecx, 0x98
call fcn.004618a0
add esp, 4
test eax, eax
je 0x46211d
mov ecx, str.acquireOSQuery:_Critical_error__failed_to_extract_resource_osquery_n
call fcn.00458190
mov eax, 1
pop esi
ret
push str.osquery.exe
push 0x54ed60
push str._s_s
push 0x1000
push 0x552d60
call fcn.004bb50e
add esp, 0x14
mov edx, 0x528ba0
mov ecx, 0x552d60
call fcn.0045d5f0
push 0x6000
push 0x53fd60
call fcn.004bbd22
add esp, 8
test eax, eax
je 0x4621f0
push 0x53fd60
push 0x54ed60
push str.__sosquery.exe____S____json
push 0x6000
push 0x552d60
call fcn.004bb50e
add esp, 0x10
call fcn.00461980
add esp, 4
test eax, eax
je 0x4622bc
push 0x53fd60
push str.acquireOSQuery:_query___S__failed._n
push 0xffffffffffffffff
push 0x1000
push 0x545d60
call fcn.004bb4ef
add esp, 0x14
mov ecx, 0x545d60
call fcn.00458190
push 0x54ed60
push str._sosquery.exe
push 0xffffffffffffffff
push 0x1000
push 0x552d60
call fcn.004bb4ef
add esp, 0x14
push 0x552d60
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, 1
pop esi
ret
mov esi, 0x528950
jmp 0x462200
push dword [esi]
push 0x54ed60
push str.__sosquery.exe____S____json
push 0x6000
push 0x552d60
call fcn.004bb50e
add esp, 0x10
call fcn.00461980
add esp, 4
test eax, eax
je 0x46224f
push dword [esi]
push str.acquireOSQuery:_query___S__failed._n
push 0xffffffffffffffff
push 0x1000
push 0x545d60
call fcn.004bb4ef
add esp, 0x14
mov ecx, 0x545d60
call fcn.00458190
add esi, 4
cmp esi, 0x528b00
jl 0x462200
push ecx
call fcn.00476440
add esp, 4
test eax, eax
jne 0x4622bc
push str.select__ec2_instance_metadata_as_data_type_from_ec2_instance_metadata_
push 0x54ed60
push str.__sosquery.exe____S____json
push 0x6000
push 0x552d60
call fcn.004bb50e
add esp, 0x10
call fcn.00461980
add esp, 4
test eax, eax
je 0x4622bc
push str.select__ec2_instance_metadata_as_data_type_from_ec2_instance_metadata_
push str.acquireOSQuery:_query___S__failed._n
push 0xffffffffffffffff
push 0x1000
push 0x545d60
call fcn.004bb4ef
add esp, 0x14
mov ecx, 0x545d60
call fcn.00458190
mov ecx, str.OSQUERY_acquired__delete_temp_OSQuery_binary_n
call fcn.00458190
push 0x54ed60
push str._sosquery.exe
push 0xffffffffffffffff
push 0x1000
push 0x552d60
call fcn.004bb4ef
add esp, 0x14
push 0x552d60
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
pop esi
ret
Function at 0x46a710
Capabilities:
Terminate process

Disassembly:
mov edx, dword [0x53ec3c]
push ebx
push esi
push edi
mov edi, edx
lea ecx, [edi + 1]
mov edi, edi
mov al, byte [edi]
inc edi
test al, al
jne 0x46a720
sub edi, ecx
mov ecx, 0
mov eax, ecx
je 0x46a73e
cmp byte [edx + eax], 0x2c
jne 0x46a739
inc ecx
inc eax
cmp eax, edi
jb 0x46a732
movsx esi, cx
shl esi, 2
push esi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x46a7c9
test esi, esi
je 0x46a769
mov edi, edi
mov byte [eax], 0
lea eax, [eax + 1]
dec esi
jne 0x46a760
xor esi, esi
xor ecx, ecx
test edi, edi
je 0x46a796
mov edx, dword [0x53ec3c]
test ecx, ecx
jne 0x46a77f
mov dword [ebx + esi*4], edx
inc esi
cmp byte [edx + ecx], 0x2c
jne 0x46a791
mov byte [edx + ecx], 0
inc ecx
lea eax, [edx + ecx]
mov dword [ebx + esi*4], eax
inc esi
inc ecx
cmp ecx, edi
jb 0x46a777
xor edi, edi
test esi, esi
je 0x46a7c3
lea esp, [esp]
mov ecx, dword [ebx + edi*4]
xor dl, dl
push 0
call fcn.0046a120
mov ecx, dword [ebx + edi*4]
add esp, 4
mov dl, 1
push 0
call fcn.0046a120
inc edi
add esp, 4
cmp edi, esi
jb 0x46a7a0
pop edi
pop esi
xor eax, eax
pop ebx
ret
push str.Failed_to_allocate_memory_on_process_heap_n
call fcn.004bc829
add esp, 4
push 1
call fcn.004bcc8d
int3