joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4126d8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x412711
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.004067b8
jmp 0x41271a
mov eax, ebx
mov edx, esi
call fcn.0040667c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x412724
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x412746
movzx eax, word [esp]
jmp 0x412748
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x412ed8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x412ffd
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.00412ce8
mov esi, eax
mov eax, dword [0x43e258]
cmp byte [eax], 0
je 0x412fa5
mov eax, dword [0x43e110]
call fcn.004045cc
call fcn.004042c8
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x412eb0]
call fcn.00407bd8
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x413018
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x412fe1
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x43e0dc]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x441c38]
call fcn.00407c9c
push eax
call sub.user32.dll_LoadStringW_1
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x413004
lea eax, [ebp - 4]
mov edx, dword [0x412eb0]
call fcn.00407be4
ret
Function at 0x415184
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.00406194
mov ebp, eax
push 0
push 0
push ebp
push ebx
push 0
push 0xfde9
call sub.kernel32.dll_MultiByteToWideChar_1
mov edi, eax
cmp edi, 0x104
jbe 0x41512e
mov eax, edi
add eax, eax
call fcn.00404180
mov esi, eax
jmp 0x415130
mov esi, esp
push edi
push esi
push ebp
push ebx
push 0
push 0xfde9
call sub.kernel32.dll_MultiByteToWideChar_1
push edi
push esi
call sub.user32.dll_CharUpperBuffW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x415169
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x415153
mov eax, esp
cmp esi, eax
je 0x415176
mov eax, esi
call fcn.0040419c
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x4151b0
cmp bl, 0
je 0x4151ac
cmp bl, 0x41
jl 0x4151a7
cmp bl, 0x5a
jg 0x4151a7
or bl, 0x20
xor al, bl
inc esi
jmp 0x41518b
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x4150f0

Function at 0x4393fc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 4], ebx
mov ebx, ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4394ed
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x439504
push esi
push 0x43950c
push edi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004064f0
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.004046a0
mov dword [ebp - 0x48], 0x3c
mov dword [ebp - 0x1c], 1
test bl, bl
je 0x439464
mov word [ebp - 0x18], 5
test bl, bl
jne 0x43946e
mov word [ebp - 0x18], 0
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x60]
mov edx, esi
call fcn.004068cc
mov eax, dword [ebp - 0x60]
lea edx, [ebp - 0x5c]
call fcn.0040f3a8
mov eax, dword [ebp - 0x5c]
call fcn.00406708
push eax
push 0
push 0x30
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004064e0
push eax
push 0
call sub.kernel32.dll_CreateProcessW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x4394ca
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4394f4
lea eax, [ebp - 0x60]
mov edx, 2
call fcn.00406674
lea eax, [ebp - 4]
call fcn.00406314
ret
Function at 0x45c7e0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], 0
jmp 0x45c805
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 0xc]
jae 0x45c878
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 8]
xor ecx, edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 8]
shr eax, 8
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
jmp 0x45c83a
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 8
jge 0x45c86d
mov edx, dword [ebp - 0x10]
and edx, 1
neg edx
sbb edx, edx
neg edx
mov byte [ebp - 0x15], dl
mov eax, dword [ebp - 0x10]
shr eax, 1
mov dword [ebp - 0x10], eax
movzx ecx, byte [ebp - 0x15]
test ecx, ecx
je 0x45c86b
mov edx, dword [ebp - 0x10]
xor edx, 0xedb88320
mov dword [ebp - 0x10], edx
jmp 0x45c831
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x45c7fc
mov eax, dword [ebp - 8]
not eax
mov esp, ebp
pop ebp
ret
Function at 0x1002f720
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x1002f72f
pop dword [ebp - 0x2c]
mov eax, 0x90a80552
add eax, 0x7f5af1dd
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xf991c584
add dword [ebp - 0x3c], 0x54c07fc7
mov dword [ebp - 0x38], 0xcadc8f2c
add dword [ebp - 0x38], 0x6756bd19
mov dword [ebp - 0x34], 0xcfa9313f
sub dword [ebp - 0x34], 0x835ced11
mov dword [ebp - 0x30], 0x1523c810
sub dword [ebp - 0x30], 0x1523c810
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0xcc54c827
add dword [ebp - 0x3c], 0xa81da12f
mov dword [ebp - 0x38], 0x160a3263
add dword [ebp - 0x38], 0x2b622f12
mov dword [ebp - 0x34], 0xa63811de
sub dword [ebp - 0x34], 0x42c8a572
mov dword [ebp - 0x30], 0x8cd88b39
sub dword [ebp - 0x30], 0x8cd88b39
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0x4a147cba
add eax, 0xc5efa392
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x46d73
push 0
call eax
mov ecx, 0x46d8
xor edi, edi
add edi, eax
mov edx, 0x10057e00
add edx, dword [ebp - 0x2c]
mov esi, 0xce13b240
add esi, 0x7d9f35f4
mov dword [ebp - 0x1c], 0xa1c7b254
mov ebx, dword [edx]
sub dword [ebp - 0x20], 0xd6fb52cf
xor ebx, esi
mov dword [ebp - 0x24], 0x73f2ecd7
mov dword [edi], ebx
xor dword [ebp - 0x10], edx
add edi, 0xd0eaf9c9
add edi, 0x2f15063b
add edx, 4
loop 0x1002f842
add eax, 0xba2aa290
sub eax, 0xba29945d
mov ebx, eax
add eax, 5
mov ecx, 0x7f9fcb52
add ecx, 0x906034ae
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x100346a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100512d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x100346d0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x10034700
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x10034700
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x100347fa
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x10034729
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1003475d
push dword [esi + 0x4c]
movsx eax, bl
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x100347fa
cmp eax, 1
jle 0x100347bb
cmp eax, 3
jne 0x100347fa
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.1002f720
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100347d9
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x100347fa
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x100347fa
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
Function at 0x100396b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100412f8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x100512d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x1005128c]
cmp eax, 0xffffffff
jne 0x100396e6
xor ebx, ebx
jmp 0x100396ef
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x1003972f
mov eax, dword [ebx + 0x18]
mov esi, dword [ebx + 0xc]
test eax, eax
jne 0x1003976e
test esi, esi
jne 0x10039772
push 0x10038230
push 0x10052ad8
call fcn.1002f720
mov eax, dword [0x1005128c]
add esp, 8
cmp eax, 0xffffffff
je 0x1003972f
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [ebp - 4], 1
test ebx, ebx
je 0x1003975c
or eax, 0xffffffff
lock xadd dword [ebx + 4], eax
jne 0x1003975c
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax]
push ebx
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x100397b4
mov eax, dword [esi + 4]
mov dword [ebx + 0xc], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x1003979d
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esi]
mov ecx, edi
push 0
mov eax, dword [edi]
call dword [eax]
push edi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
push esi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov esi, dword [ebx + 0xc]
test esi, esi
jne 0x10039772
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x10039700
nop
mov esi, dword [ebx + 0x14]
mov esi, dword [esi]
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x100397d9
mov edx, dword [esi + 0x1c]
test edx, edx
je 0x100397d9
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push esi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebx + 0x14]
call fcn.1002f720
mov eax, dword [ebx + 0x18]
test eax, eax
jne 0x100397c0
jmp 0x10039700
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x408b8e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x408b9d
pop dword [ebp - 0x24]
mov eax, 0x408b9d
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x3c18c
push 0
mov eax, 0x6db8f8e7
sub eax, 0x6d78180f
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0x3efdd730
sub ecx, 0x3efd83a0
mov edx, eax
mov edi, 0x1896f563
add edi, 0xe7aa4661
add edi, dword [ebp - 0x24]
mov esi, 0xf3559061
add dword [ebp - 0x14], 0x57ab05c4
mov ebx, dword [edi]
add ebx, esi
xor dword [ebp - 0x20], 0x69b17dc4
mov dword [edx], ebx
mov dword [ebp - 0x20], 0x4c6d1c1c
add edx, 4
add edi, 0x2573e355
add edi, 0xda8c1caf
loop 0x408bf1
add eax, 0x96dfc805
add eax, 0x6921790e
xor ebx, ebx
add ebx, eax
add eax, 0x9ef5aa54
sub eax, 0x9ef5aa4f
mov ecx, 0x1262fdad
sub ecx, 0x1222fdad
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x401540
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0
call fcn.004209f8
push eax
call fcn.004208c4
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
xor esi, esi
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push connect
call edi
mov eax, dword [ebp - 4]
test eax, eax
je 0x4015a4
mov ecx, dword [esi*4 + 0x443a90]
push 0
push 0
push 0
push 0
push ecx
push eax
call ebx
test eax, eax
je 0x4015c9
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc esi
cmp esi, 8
jl 0x401565
call fcn.004208d6
and eax, 0x80000007
jns 0x4015bb
dec eax
or eax, 0xfffffff8
inc eax
mov eax, dword [eax*4 + 0x443a90]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esi*4 + 0x443a90]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401f80
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push 0x43b2d4
push eax
xor bl, bl
call fcn.004218f3
mov esi, eax
add esp, 8
test esi, esi
je 0x401fff
mov ecx, dword [ebp + 8]
push edi
push 0x43b2dc
push ecx
call fcn.004218f3
mov edi, eax
add esp, 8
test edi, edi
je 0x401ff5
push esi
call fcn.00420b45
add esp, 4
test eax, eax
jne 0x401fea
push esi
push 1
lea edx, [ebp - 1]
push 1
push edx
call fcn.00421c4a
push edi
push 1
lea eax, [ebp - 1]
push 1
push eax
call fcn.00421e3e
push esi
call fcn.00420b45
add esp, 0x24
test eax, eax
je 0x401fc1
push edi
mov bl, 1
call fcn.00422275
add esp, 4
push esi
call fcn.00422275
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402010
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x440480]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push str.SYSTEMROOT
mov dword [ebp - 0x98], eax
call fcn.0042097e
add esp, 4
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402040
sub eax, edx
add eax, 0x20
push eax
call fcn.0041fbf7
push str.SYSTEMROOT
mov edi, eax
call fcn.0042097e
push eax
push str._s_notepad.exe
push edi
call fcn.00420835
mov ebx, dword [sym.imp.KERNEL32.DLL_OpenFile]
add esp, 0x14
push 0
lea ecx, [ebp - 0x94]
push ecx
push edi
call ebx
mov esi, eax
cmp esi, 0xffffffff
je 0x4020d1
push 0
push 0
lea edx, [ebp - 0xa0]
push edx
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileTime]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [ebp - 0x98]
push 2
lea eax, [ebp - 0x94]
push eax
push ecx
call ebx
mov esi, eax
cmp esi, 0xffffffff
je 0x4020d1
push 0
push 0
lea edx, [ebp - 0xa0]
push edx
push esi
call dword [sym.imp.KERNEL32.DLL_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push edi
call fcn.004208b9
mov ecx, dword [ebp - 8]
add esp, 4
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00420826
mov esp, ebp
pop ebp
ret
Function at 0x404910
Capabilities:
Check if file exists
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, edx
push esi
mov edi, ecx
mov dword [esp + 0x18], eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x40493b
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
lea ebx, [esp + 0x10]
mov dword [esp + 0x10], 0
call fcn.00401de0
mov esi, eax
add esp, 4
test esi, esi
je 0x404932
push 0
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x18], 0
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
jne 0x404983
push esi
xor edi, edi
call fcn.004208b9
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x18]
push eax
push esi
mov ecx, edi
call fcn.004046c0
add esp, 0xc
push esi
mov edi, eax
call fcn.004208b9
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x404ba0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push 0x22
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryExA]
mov esi, eax
mov dword [ebp - 0xc], esi
test esi, esi
jne 0x404bc0
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push 3
push 1
push esi
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
mov ebx, eax
mov dword [ebp - 8], ebx
test ebx, ebx
je 0x404bef
push ebx
push esi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
je 0x404bef
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov dword [ebp - 4], eax
test eax, eax
jne 0x404bfe
push esi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov esi, dword [ebx + 4]
push edi
push esi
call fcn.0041fbf7
add esp, 4
mov edi, eax
test esi, esi
je 0x404c24
mov ecx, dword [ebp - 4]
sub ecx, edi
mov edx, esi
mov bl, byte [ecx + eax]
mov byte [eax], bl
inc eax
dec edx
jne 0x404c18
mov ebx, dword [ebp - 8]
push ebx
call dword [sym.imp.KERNEL32.DLL_FreeResource]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
mov edx, dword [ebp + 8]
mov eax, edi
pop edi
pop ebx
mov dword [edx], esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x405490
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x440480]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
push edi
lea eax, [ebp - 0x134]
push eax
push ebx
mov dword [ebp - 0x134], 0x128
call dword [sym.imp.KERNEL32.DLL_Process32First]
test eax, eax
je 0x4055a1
mov edi, dword [sym.imp.KERNEL32.DLL_OpenProcess]
jmp 0x4054d0
lea eax, [ebp - 0x110]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4054e0
sub eax, edx
inc eax
push eax
call fcn.0041fbf7
mov esi, eax
lea eax, [ebp - 0x110]
mov edx, esi
mov ecx, eax
add esp, 4
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x405501
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x405510
sub eax, edx
mov edx, eax
xor ecx, ecx
test edx, edx
jle 0x405536
mov al, byte [ecx + esi]
cmp al, 0x41
jl 0x405531
cmp al, 0x5a
jg 0x405531
add al, 0x20
mov byte [ecx + esi], al
inc ecx
cmp ecx, edx
jl 0x405521
mov ecx, dword [ebp + 8]
mov eax, esi
jmp 0x405540
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x405560
test dl, dl
je 0x40555c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x405560
add eax, 2
add ecx, 2
test dl, dl
jne 0x405540
xor eax, eax
jmp 0x405565
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x405582
mov edx, dword [ebp - 0x12c]
push edx
push eax
push 1
call edi
test eax, eax
je 0x405582
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
push esi
call fcn.004208b9
add esp, 4
lea eax, [ebp - 0x134]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_Process32Next]
test eax, eax
jne 0x4054d0
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [ebp - 8]
pop edi
xor ecx, ebp
pop esi
call fcn.00420826
mov esp, ebp
pop ebp
ret

Function at 0x4055c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push 0x184
push 0
push esi
xor bl, bl
call fcn.00428e90
add esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SoftwareClasses.exe_shellopencommand
push connect
mov dword [ebp - 8], 0x184
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, dword [ebp - 4]
test eax, eax
je 0x405624
lea ecx, [ebp - 8]
push ecx
push esi
push 0
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40561a
mov bl, 1
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405f30
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x443a58], 0
jne 0x405fdc
push ebx
call fcn.004053c0
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x405f5d
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x405f54
sub eax, edx
add eax, 0x104
push eax
call fcn.0041fbf7
add esp, 4
lea ecx, [ebp - 4]
push ecx
push eax
mov dword [0x443a30], eax
mov dword [ebp - 4], 0x100
call dword [sym.imp.KERNEL32.DLL_GetComputerNameA]
test ebx, ebx
je 0x405fd4
mov ecx, dword [0x443a30]
push esi
push edi
lea edi, [ecx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x405f91
mov dx, word [0x43b788]
mov eax, ebx
mov word [edi], dx
mov esi, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x405fa7
sub eax, esi
lea edi, [ecx - 1]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x405fb3
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call fcn.004208b9
add esp, 4
pop edi
pop esi
mov byte [0x443a58], 1
pop ebx
mov eax, dword [0x443a30]
mov esp, ebp
pop ebp
ret

Function at 0x405ff0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0x43b2d4
push eax
call fcn.004218f3
mov esi, eax
add esp, 8
test esi, esi
je 0x4060d1
push ebx
push edi
push 2
push 0
push esi
call fcn.0042213b
push esi
call fcn.0042204c
mov edi, eax
push edi
call fcn.0041fbf7
push 0
push 0
push esi
mov dword [ebp - 4], eax
call fcn.0042213b
add esp, 0x20
xor ebx, ebx
test edi, edi
jle 0x406066
lea ecx, [ecx]
push esi
call fcn.00420b45
add esp, 4
test eax, eax
jne 0x406066
mov ecx, dword [ebp - 4]
push esi
push 1
lea edx, [ebx + ecx]
push 1
push edx
call fcn.00421c4a
inc ebx
add esp, 0x10
cmp ebx, edi
jl 0x406040
push esi
call fcn.00422275
add esp, 4
xor eax, eax
xor ecx, ecx
test edi, edi
jle 0x406092
cmp ecx, dword [ebp + 0x10]
jl 0x40607e
xor ecx, ecx
mov edx, dword [ebp + 0xc]
mov dl, byte [ecx + edx]
mov esi, dword [ebp - 4]
neg dl
xor byte [eax + esi], dl
inc eax
inc ecx
cmp eax, edi
jl 0x406077
mov eax, dword [ebp + 8]
push 0x43b2dc
push eax
call fcn.004218f3
mov esi, eax
add esp, 8
test esi, esi
je 0x4060c8
mov ecx, dword [ebp - 4]
push esi
push edi
push 1
push ecx
call fcn.00421e3e
push esi
call fcn.00422275
add esp, 0x14
pop edi
pop ebx
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
pop edi
pop ebx
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
xor al, al
pop esi
mov esp, ebp
pop ebp
ret