joyce8/EMBER2024-capa huggingface dataset:
Function at 0x54c07c
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404d24
xor eax, eax
push ebp
push 0x54c1bb
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp + 0x10], 0
jne 0x54c1a0
mov eax, dword [ebp - 4]
call fcn.00409cc8
test al, al
jne 0x54c1a0
lea eax, [ebp - 0xc]
mov ecx, 0x54c1d4
mov edx, dword [ebp - 4]
call fcn.00404b88
mov edx, dword [ebp - 0xc]
lea ecx, [ebp - 8]
mov eax, ebx
call fcn.00549c94
cmp dword [ebp - 8], 0
je 0x54c123
push 0x54c1e0
push dword [ebp - 8]
push 0x54c1f0
push 0x54c1fc
lea edx, [ebp - 0x14]
mov eax, esi
call fcn.00409790
push dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, 5
call fcn.00404bfc
mov edx, dword [ebp - 0x10]
mov eax, dword [ebx + 0x84]
call fcn.00420704
mov eax, dword [ebp - 4]
call fcn.00409cec
mov eax, dword [ebp - 4]
call fcn.00409cc8
test al, al
jne 0x54c17a
mov al, byte [0x54c210]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
mov ecx, 0x54c21c
mov edx, 0x54c240
mov eax, ebx
call fcn.0054fa3c
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
mov edx, 0x54c25c
call fcn.0040edd0
mov ecx, dword [ebp - 0x18]
mov dl, 1
mov eax, dword [0x408530]
call fcn.0040d954
call fcn.00404204
mov ebx, 0x10
cmp byte [ebp + 0xc], 0
je 0x54c188
or ebx, 1
cmp byte [ebp + 8], 0
je 0x54c191
or ebx, 2
push ebx
mov eax, dword [ebp - 4]
call fcn.00404d34
push eax
call sub.kernel32.dll_SetFileAttributesA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54c1c2
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.0040488c
ret

Function at 0x54e6d8
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x54e769
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
push 0xf01ff
push 0x54e774
push eax
call sub.advapi32.dll_OpenServiceA
xor edx, edx
mov dword [ebp - 4], edx
test eax, eax
je 0x54e726
lea edx, [ebp - 4]
push edx
push 0
push eax
call sub.advapi32.dll_StartServiceA
jmp 0x54e753
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, 0x54e788
mov edx, 0x54e7a8
call fcn.0054fa3c
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x408530]
call fcn.0040d954
call fcn.00404204
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54e770
lea eax, [ebp - 8]
call fcn.00404868
ret
Function at 0x5524ec
Capabilities:
Copy file
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
xor eax, eax
push ebp
push 0x5525b5
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [0x57a244]
push 0x5525cc
lea eax, [ebp - 0xc]
call fcn.0054a240
push dword [ebp - 0xc]
push 0x5525d8
lea eax, [ebp - 4]
mov edx, 4
call fcn.00404bfc
push 0
mov eax, dword [ebp - 4]
call fcn.00404d34
mov ebx, eax
push ebx
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.00402c28
mov eax, dword [ebp - 0x10]
call fcn.00404d34
push eax
call sub.kernel32.dll_CopyFileA
mov edx, 0x5525e8
mov eax, dword [ebp - 4]
call fcn.00555018
call sub.kernel32.dll_GetCurrentProcessId
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x14]
call fcn.004097c0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 8]
mov edx, 0x5525f4
call fcn.00404b88
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00404d34
push eax
push ebx
push 0x5525f8
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5525bc
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.0040488c
ret

Function at 0x552670
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404d24
mov eax, dword [ebp + 0xc]
call fcn.00404d24
xor eax, eax
push ebp
push 0x55278c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 0x10]
mov eax, dword [eax - 4]
cmp word [eax + 0x42], 0
je 0x5526e9
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax - 4]
mov ecx, 0x5527a4
mov edx, 0x5527b8
call fcn.005549c8
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404b44
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 0x10]
mov ebx, dword [eax - 4]
mov eax, dword [ebp + 0x10]
mov eax, dword [eax - 4]
mov ecx, dword [eax + 0x38]
mov eax, dword [ebx + 0x44]
call dword [ebx + 0x40]
cmp byte [ebp + 8], 0
je 0x5526f3
xor ebx, ebx
jmp 0x5526f8
mov ebx, 1
sub esi, 1
jb 0x552704
je 0x552739
dec esi
je 0x552761
jmp 0x552769
push ebx
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040a014
mov eax, dword [ebp - 0xc]
call fcn.00404d34
push eax
mov eax, dword [ebp + 0xc]
call fcn.00404d34
push eax
mov eax, dword [ebp - 4]
call fcn.00404d34
push eax
push 0x5527c4
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x552769
push 0
push dword [ebp - 4]
push 0x5527d4
push dword [ebp + 0xc]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404bfc
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov edx, ebx
call fcn.0054af28
jmp 0x552769
mov eax, dword [ebp - 4]
call fcn.00409f7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x552793
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.0040488c
lea eax, [ebp + 0xc]
call fcn.00404868
ret
Function at 0x553b48
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe6c
push ebx
xor ebx, ebx
mov dword [ebp - 0x194], ebx
mov dword [ebp - 0x190], ebx
mov dword [ebp - 0x18c], ebx
mov dword [ebp - 0x188], ebx
mov dword [ebp - 0x15c], ebx
mov ebx, ecx
mov dword [ebp - 0x164], edx
mov dword [ebp - 0x160], eax
lea eax, [ebp - 0x158]
mov edx, dword [0x408510]
call fcn.00405374
xor eax, eax
push ebp
push 0x553de6
push dword fs:[eax]
mov dword fs:[eax], esp
test bl, bl
je 0x553c62
mov eax, dword [ebp - 0x160]
cmp word [eax + 0x42], 0
je 0x553bfc
lea eax, [ebp - 0x188]
push eax
mov ecx, 0x553dfc
mov edx, 0x553e14
mov eax, dword [ebp - 0x160]
call fcn.005549c8
lea eax, [ebp - 0x188]
mov edx, dword [ebp - 0x164]
call fcn.00404b44
mov edx, dword [ebp - 0x188]
mov eax, dword [ebp - 0x160]
mov ecx, dword [eax + 0x38]
mov ebx, dword [ebp - 0x160]
mov eax, dword [ebx + 0x44]
call dword [ebx + 0x40]
xor eax, eax
mov dword [ebp - 0x182], eax
xor eax, eax
mov dword [ebp - 0x182], eax
mov dword [ebp - 0x17e], 3
lea eax, [ebp - 0x18c]
mov ecx, 0x553e2c
mov edx, dword [ebp - 0x164]
call fcn.00404b88
mov eax, dword [ebp - 0x18c]
call fcn.00404d34
mov dword [ebp - 0x17a], eax
mov eax, 0x553e30
mov dword [ebp - 0x176], eax
mov word [ebp - 0x172], 0x414
lea eax, [ebp - 0x182]
push eax
call sub.shell32.dll_SHFileOperationA
jmp 0x553d9c
lea eax, [ebp - 0x15c]
mov edx, dword [ebp - 0x164]
call fcn.00404900
mov eax, dword [ebp - 0x160]
cmp word [eax + 0x42], 0
je 0x553cc8
lea eax, [ebp - 0x190]
push eax
mov ecx, 0x553dfc
mov edx, 0x553e14
mov eax, dword [ebp - 0x160]
call fcn.005549c8
lea eax, [ebp - 0x190]
mov edx, dword [ebp - 0x15c]
call fcn.00404b44
mov edx, dword [ebp - 0x190]
mov eax, dword [ebp - 0x160]
mov ecx, dword [eax + 0x38]
mov ebx, dword [ebp - 0x160]
mov eax, dword [ebx + 0x44]
call dword [ebx + 0x40]
mov eax, dword [ebp - 0x15c]
call fcn.00404b3c
mov edx, dword [ebp - 0x15c]
cmp byte [edx + eax - 1], 0x5c
jne 0x553cfd
mov eax, dword [ebp - 0x15c]
call fcn.00404b3c
mov edx, eax
lea eax, [ebp - 0x15c]
mov ecx, 1
call fcn.00404dd4
lea eax, [ebp - 0x194]
mov ecx, 0x553e3c
mov edx, dword [ebp - 0x15c]
call fcn.00404b88
mov eax, dword [ebp - 0x194]
lea ecx, [ebp - 0x158]
mov edx, 0x3f
call fcn.00409eec
test eax, eax
jne 0x553d7a
xor eax, eax
push ebp
push 0x553d73
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
call fcn.00553a40
pop ecx
jmp 0x553d4b
push ebp
call fcn.00553a40
pop ecx
lea eax, [ebp - 0x158]
call fcn.00409f3c
test eax, eax
je 0x553d44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x553d7a
lea eax, [ebp - 0x158]
call fcn.00409f60
ret
mov eax, dword [ebp - 0x164]
call fcn.00553908
test al, al
je 0x553d9c
mov cl, 1
mov edx, dword [ebp - 0x164]
mov eax, dword [ebp - 0x160]
call fcn.00553b48
mov eax, dword [ebp - 0x164]
call fcn.00409cc8
mov ebx, eax
xor bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x553ded
lea eax, [ebp - 0x194]
mov edx, 4
call fcn.0040488c
lea eax, [ebp - 0x15c]
call fcn.00404868
lea eax, [ebp - 0x158]
mov edx, dword [0x408510]
call fcn.00405444
ret
Function at 0x554a0c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x554ae3
push dword fs:[eax]
mov dword fs:[eax], esp
cmp word [esi + 0x42], 0
je 0x554a60
lea eax, [ebp - 0x24]
push eax
mov ecx, 0x554afc
mov edx, 0x554b14
mov eax, esi
call fcn.005549c8
lea eax, [ebp - 0x24]
mov edx, ebx
call fcn.00404b44
mov edx, dword [ebp - 0x24]
mov ecx, dword [esi + 0x38]
mov eax, dword [esi + 0x44]
call dword [esi + 0x40]
xor edx, edx
mov eax, ebx
call fcn.00409e60
xor eax, eax
mov dword [ebp - 0x1f], eax
xor eax, eax
mov dword [ebp - 0x1f], eax
mov dword [ebp - 0x1b], 3
lea eax, [ebp - 0x28]
mov ecx, 0x554b2c
mov edx, ebx
call fcn.00404b88
mov eax, dword [ebp - 0x28]
call fcn.00404d34
mov dword [ebp - 0x17], eax
mov eax, 0x554b30
mov dword [ebp - 0x13], eax
mov word [ebp - 0xf], 0x14
lea eax, [ebp - 0x1f]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
sete byte [ebp - 1]
mov eax, ebx
call fcn.00409cb8
test al, al
je 0x554ac8
mov edx, 0x554b3c
mov eax, ebx
call fcn.00555018
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x554aea
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.0040488c
ret

Function at 0x554b84
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef4
mov ebx, edx
push esp
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.00404ad0
add esp, 0x10c
pop ebx
ret

Function at 0x554bc0
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xffffff00
mov ebx, eax
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov eax, ebx
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.00404ad0
mov eax, dword [ebx]
call fcn.00404b3c
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
jne 0x554c0b
mov eax, dword [ebx]
call fcn.00404b3c
mov edx, eax
mov eax, ebx
mov ecx, 1
call fcn.00404dd4
add esp, 0x100
pop ebx
ret

Function at 0x554c14
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
test eax, eax
je 0x554c65
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.00404ad0
mov eax, dword [ebx]
call fcn.00404b3c
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
jne 0x554c7b
mov eax, dword [ebx]
call fcn.00404b3c
mov edx, eax
mov eax, ebx
mov ecx, 1
call fcn.00404dd4
jmp 0x554c7b
mov ecx, 0x554c8c
mov dl, 1
mov eax, dword [0x408530]
call fcn.0040d954
call fcn.00404204
add esp, 0x108
pop ebx
ret
Function at 0x554d30
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xffffff00
mov ebx, eax
push esp
push pe_nt_image_headers32
call sub.kernel32.dll_GetTempPathA
mov eax, ebx
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.00404ad0
mov eax, dword [ebx]
call fcn.00404b3c
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
jne 0x554d77
mov eax, dword [ebx]
call fcn.00404b3c
mov edx, eax
mov eax, ebx
mov ecx, 1
call fcn.00404dd4
add esp, 0x100
pop ebx
ret

Function at 0x554e34
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffffe8
call fcn.00554d80
cmp al, 3
je 0x554e55
push esp
push 0xf00ff
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x554ea8
call fcn.00554d80
cmp al, 3
je 0x554e9f
lea eax, [esp + 0xc]
push eax
push 0x554eac
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [esp + 8], 1
mov dword [esp + 0x14], 2
xor eax, eax
mov dword [esp + 4], eax
lea eax, [esp + 4]
push eax
push 0
push 0
lea eax, [esp + 0x14]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
push 0
push 2
call sub.user32.dll_ExitWindowsEx
add esp, 0x18
ret
Function at 0x555018
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404d24
mov eax, dword [ebp - 8]
call fcn.00404d24
xor eax, eax
push ebp
push 0x55519f
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetVersion
mov ebx, eax
mov eax, ebx
xor edx, edx
push edx
push eax
lea edx, [ebp - 0xc]
mov eax, 8
call fcn.00409830
mov eax, dword [ebp - 0xc]
cmp byte [eax], 0x30
jne 0x5550b0
mov eax, dword [ebp - 8]
mov edx, 0x5551b4
call fcn.00404c80
jne 0x555092
push 4
push 0
mov eax, dword [ebp - 4]
call fcn.00404d34
push eax
call sub.kernel32.dll_MoveFileExA
jmp 0x555177
push 5
mov eax, dword [ebp - 8]
call fcn.00404d34
push eax
mov eax, dword [ebp - 4]
call fcn.00404d34
push eax
call sub.kernel32.dll_MoveFileExA
jmp 0x555177
mov dl, 1
mov eax, dword [0x41cecc]
call fcn.00403944
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x555170
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
mov ecx, 0x5551c0
mov edx, dword [0x57a294]
call fcn.00404b88
mov eax, dword [ebp - 0x14]
call fcn.00409cb8
test al, al
jne 0x5550fb
mov edx, 0x5551d8
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
jmp 0x555119
lea eax, [ebp - 0x18]
mov ecx, 0x5551c0
mov edx, dword [0x57a294]
call fcn.00404b88
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x68]
push dword [ebp - 8]
push 0x5551f0
push dword [ebp - 4]
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00404bfc
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
call fcn.00420704
lea eax, [ebp - 0x20]
mov ecx, 0x5551c0
mov edx, dword [0x57a294]
call fcn.00404b88
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x74]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x555177
mov eax, dword [ebp - 0x10]
call fcn.00403974
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5551a6
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.0040488c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040488c
ret
Function at 0x557718
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb8
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x244], edx
mov dword [ebp - 0x248], edx
mov dword [ebp - 0x240], edx
mov dword [ebp - 0x128], edx
mov dword [ebp - 0x12c], edx
mov dword [ebp - 0x230], edx
mov dword [ebp - 0x234], edx
mov dword [ebp - 0x238], edx
mov dword [ebp - 0x23c], edx
mov dword [ebp - 0x124], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x55797c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
mov dl, 1
call fcn.0045bb30
lea eax, [ebp - 0x120]
push eax
push pe_nt_image_headers32
call sub.kernel32.dll_GetLogicalDriveStringsA
lea ebx, [ebp - 0x120]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x35c]
mov eax, dword [eax + 0x218]
mov edx, dword [eax]
call dword [edx + 0x44]
jmp 0x557923
push ebx
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x557908
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
mov eax, dword [0x577148]
mov eax, dword [eax]
call eax
push ebp
lea eax, [ebp - 0x124]
mov edx, ebx
call fcn.00404a58
mov eax, dword [ebp - 0x124]
call fcn.0055747c
pop ecx
mov esi, eax
lea eax, [ebp - 0x22c]
mov edx, ebx
call fcn.00403454
lea edx, [ebp - 0x22c]
lea eax, [ebp - 0x12c]
call fcn.00404ac4
push dword [ebp - 0x12c]
push 0x557994
push dword [ebp - 0x14]
push dword [ebp - 0x18]
lea eax, [ebp - 0x230]
call fcn.00557590
push dword [ebp - 0x230]
push 0x557994
push dword [ebp - 0xc]
push dword [ebp - 0x10]
lea eax, [ebp - 0x234]
call fcn.00557590
push dword [ebp - 0x234]
push 0x557994
mov eax, esi
cdq
push edx
push eax
lea eax, [ebp - 0x238]
call fcn.00557590
push dword [ebp - 0x238]
push 0x557994
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
push edx
push eax
mov eax, esi
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
push edx
push eax
lea eax, [ebp - 0x23c]
call fcn.00557590
push dword [ebp - 0x23c]
lea eax, [ebp - 0x128]
mov edx, 9
call fcn.00404bfc
mov edx, dword [ebp - 0x128]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x35c]
mov eax, dword [eax + 0x218]
call fcn.00420704
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
push edx
push eax
mov eax, esi
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
cmp edx, 0
jne 0x5578e0
cmp eax, 0
jae 0x557908
jmp 0x5578e2
jge 0x557908
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
xor edx, edx
call fcn.0045bb30
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x35c]
mov eax, dword [eax + 0x68]
mov edx, 0xff
call fcn.0042b044
lea eax, [ebp - 0x240]
mov edx, ebx
call fcn.00404a58
mov eax, dword [ebp - 0x240]
call fcn.00404b3c
add ebx, eax
inc ebx
lea eax, [ebp - 0x248]
mov edx, ebx
call fcn.00404a58
mov eax, dword [ebp - 0x248]
lea edx, [ebp - 0x244]
call fcn.0040940c
cmp dword [ebp - 0x244], 0
jne 0x5577b2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x557983
lea eax, [ebp - 0x248]
mov edx, 7
call fcn.0040488c
lea eax, [ebp - 0x12c]
mov edx, 3
call fcn.0040488c
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
jmp 0x45ac82
push 0x14
push 0x47b4b0
call fcn.0045b020
push 1
call fcn.0045a868
pop ecx
test al, al
jne 0x45ab39
push 7
call fcn.0045b30e
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.0045a833
mov byte [ebp - 0x24], al
mov eax, dword [0x480f84]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x45ab32
test eax, eax
jne 0x45aba3
mov dword [0x480f84], ecx
push 0x46c420
push 0x46c408
call fcn.0046099b
pop ecx
pop ecx
test eax, eax
je 0x45ab86
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x45ac7c
push 0x46c404
push 0x46c3b0
call fcn.0046093f
pop ecx
pop ecx
mov dword [0x480f84], 2
jmp 0x45aba8
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.0045a9c2
pop ecx
call fcn.0045b606
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x45abd8
push esi
call fcn.0045a938
pop ecx
test al, al
je 0x45abd8
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.0045b017
call esi
call fcn.0045b60c
mov esi, eax
cmp dword [esi], edi
je 0x45abf6
push esi
call fcn.0045a938
pop ecx
test al, al
je 0x45abf6
push dword [esi]
call fcn.0045fdda
pop ecx
call fcn.0045b429
movzx eax, ax
push eax
call fcn.004608ec
push eax
push edi
push 0x400000
call main
mov esi, eax
call fcn.0045b45c
test al, al
jne 0x45ac21
push esi
call fcn.0045fe12
test bl, bl
jne 0x45ac2a
call fcn.0045fdb5
push edi
push 1
call fcn.0045a9df
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x45ac7c
call fcn.0045b066
ret
call fcn.0045b4f5
jmp 0x45ab1a
Function at 0x4044d0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
jb 0x404503
call fcn.004042d0
test eax, eax
je 0x404503
mov edx, 1
lea ecx, [ebp - 0x10]
call fcn.004042b0
mov eax, dword [ebp - 8]
shr eax, 9
and eax, 1
mov esp, ebp
pop ebp
ret
xor eax, eax
shr eax, 9
and eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x404550
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
jae 0x404566
xor eax, eax
mov esp, ebp
pop ebp
ret
call fcn.004042d0
cmp eax, 7
jb 0x404560
mov edx, 7
lea ecx, [ebp - 0x10]
call fcn.004042b0
mov eax, dword [ebp - 0xc]
shr eax, 0x1d
and eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x4047f0
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d4
mov eax, dword [0x47d044]
xor eax, ebp
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp ax, 6
je 0x404839
push str.SetDefaultDllDirectories
push 0x46c5d0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x404839
push 0xc00
call eax
test eax, eax
jne 0x4048d7
push 0x106
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x4048d7
cmp eax, 0x104
ja 0x4048d7
cmp word [ebp + eax*2 - 0x2d6], 0x5c
je 0x404877
mov ecx, 0x5c
mov word [ebp + eax*2 - 0x2d4], cx
inc eax
cmp byte [str.userenv], 0
push esi
mov esi, str.userenv
je 0x4048d6
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push edi
lea edi, [ebp - 0x2d4]
lea edi, [edi + eax*2]
mov al, byte [esi]
mov ecx, edi
inc esi
test al, al
je 0x4048b0
movzx eax, al
mov word [ecx], ax
add ecx, 2
mov al, byte [esi]
inc esi
test al, al
jne 0x4048a0
xor eax, eax
mov dword [ecx], 0x64002e
push 8
push eax
mov word [ecx + 8], ax
lea eax, [ebp - 0x2d4]
push eax
mov dword [ecx + 4], 0x6c006c
call ebx
cmp byte [esi], 0
jne 0x404897
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045a230
mov esp, ebp
pop ebp
ret
Function at 0x40a870
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x98
push 0
lea eax, [edi + 0x110]
push eax
call fcn.0045bcd0
mov eax, dword [edi + 0x30]
add esp, 0xc
add eax, dword [edi + 0x34]
mov ecx, dword [edi + 0x28]
mov dword [edi + 0x40], eax
mov dword [edi + 0x2c], 0
mov dword [edi + 0x14], 0
lea esi, [ecx + eax]
shr ecx, 3
mov eax, 0xaaaaaaab
mul ecx
mov ecx, 0xc
shr edx, 3
imul eax, edx, 0x54
mov edx, esi
sub edx, eax
mov eax, dword [edi + 0x18]
cmp eax, ecx
mov dword [edi + 0xc], eax
mov dword [edi + 0x44], edx
cmovb ecx, eax
mov dword [edi + 8], edx
not ecx
lea eax, [edx + 0x600]
mov dword [edi + 0x24], ecx
mov dword [edi + 0x20], ecx
lea ecx, [esi - 0xc]
mov dword [edi + 0x38], eax
xor eax, eax
mov dword [edi + 0x3c], ecx
mov dword [edi], ecx
mov dword [edi + 4], ecx
mov dword [ecx + 4], edx
add edx, 2
mov dword [ecx], 0x1010100
mov dword [ecx + 8], 0
mov byte [edx - 2], al
lea edx, [edx + 6]
xor ecx, ecx
mov byte [edx - 7], 1
inc eax
mov dword [edx - 6], ecx
cmp eax, 0x100
jb 0x40a907
lea eax, [edi + 0x9fc]
push ebx
xor ebx, ebx
mov dword [ebp - 4], eax
nop word [eax + eax]
mov esi, eax
xor edi, edi
movzx eax, word [edi + 0x46c5f0]
lea ecx, [ebx + 2]
xor edx, edx
div ecx
mov ecx, 0x4000
sub ecx, eax
xor eax, eax
movzx ecx, cx
nop
mov word [esi + eax*2], cx
add eax, 8
cmp eax, 0x40
jb 0x40a950
add edi, 2
add esi, 2
cmp edi, 0x10
jb 0x40a934
mov eax, dword [ebp - 4]
inc ebx
sub eax, 0xffffff80
mov dword [ebp - 4], eax
cmp ebx, 0x80
jb 0x40a930
mov edi, dword [ebp + 8]
mov edx, 0x50
pop ebx
lea esi, [edi + 0x3bc]
nop dword [eax + eax]
mov eax, esi
mov ecx, 0x10
nop word [eax + eax]
mov word [eax], dx
lea eax, [eax + 4]
mov word [eax - 2], 0x403
sub ecx, 1
jne 0x40a9a0
add edx, 0x28
add esi, 0x40
cmp edx, 0x438
jb 0x40a990
mov dword [edi + 0x3b8], 0x40070000
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x40b140
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, dword [0x47d020]
mov dword [ecx], eax
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x20], 0x6a09e667
mov dword [ecx + 0x24], 0xbb67ae85
mov dword [ecx + 0x28], 0x3c6ef372
mov dword [ecx + 0x2c], 0xa54ff53a
mov dword [ecx + 0x30], 0x510e527f
mov dword [ecx + 0x34], 0x9b05688c
mov dword [ecx + 0x38], 0x1f83d9ab
mov dword [ecx + 0x3c], 0x5be0cd19
pop ebp
ret 4