joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4010b7
Capabilities:
Check if file exists
Get common file path
Read .ini file

Disassembly:
push ebp
lea ebp, [esp - 0x4a4]
sub esp, 0x524
mov eax, dword [0x410040]
xor eax, ebp
mov dword [ebp + 0x4a0], eax
mov eax, dword [ebp + 0x4ac]
push esi
push edi
mov esi, 0x103
push esi
mov dword [ebp - 0x80], eax
xor edi, edi
lea eax, [ebp + 0x299]
push edi
push eax
mov byte [ebp + 0x298], 0
call fcn.004067c0
push esi
lea eax, [ebp + 0x39d]
push edi
push eax
mov byte [ebp + 0x39c], 0
call fcn.004067c0
push esi
lea eax, [ebp + 0x195]
push edi
push eax
mov byte [ebp + 0x194], 0
call fcn.004067c0
push esi
lea eax, [ebp + 0x91]
push edi
push eax
mov byte [ebp + 0x90], 0
call fcn.004067c0
push esi
lea eax, [ebp - 0x73]
push edi
push eax
mov byte [ebp - 0x74], 0
call fcn.004067c0
add esp, 0x3c
lea eax, [ebp + 0x298]
push eax
push edi
push edi
push 0x801a
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
cmp eax, 1
jne 0x40116b
xor al, al
jmp 0x40128b
push ebx
push str.MozillaFirefox_
mov ebx, 0x104
lea eax, [ebp + 0x298]
push ebx
push eax
call fcn.0040293c
lea eax, [ebp + 0x298]
push eax
lea eax, [ebp + 0x39c]
push ebx
push eax
call fcn.0040287f
push str.profiles.ini
lea eax, [ebp + 0x39c]
push ebx
push eax
call fcn.0040293c
add esp, 0x24
lea eax, [ebp + 0x39c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x4011c4
xor al, al
jmp 0x40128a
mov dword [ebp - 0x7c], edi
mov byte [ebp - 0x75], 0
push edi
jmp 0x401208
lea eax, [ebp + 0x39c]
push eax
push ebx
lea eax, [ebp - 0x74]
push eax
push 0x40dcc6
push str.Name
lea eax, [ebp + 0x194]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 8
mov edi, str.default
lea esi, [ebp - 0x74]
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x40124a
inc dword [ebp - 0x7c]
push dword [ebp - 0x7c]
push str.Profile_d
lea eax, [ebp + 0x194]
push 0x14
push eax
call fcn.00402861
add esp, 0x10
lea eax, [ebp + 0x39c]
push eax
push ebx
lea eax, [ebp + 0x90]
push eax
push 0x40dcc6
push str.Path
lea eax, [ebp + 0x194]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x4011ce
jmp 0x401287
lea eax, [ebp + 0x90]
push eax
lea eax, [ebp + 0x298]
push ebx
push eax
mov byte [ebp - 0x75], 1
call fcn.0040293c
push 0x40dd10
lea eax, [ebp + 0x298]
push ebx
push eax
call fcn.0040293c
lea eax, [ebp + 0x298]
push eax
push ebx
push dword [ebp - 0x80]
call fcn.0040287f
add esp, 0x24
mov al, byte [ebp - 0x75]
pop ebx
mov ecx, dword [ebp + 0x4a0]
pop edi
xor ecx, ebp
pop esi
call fcn.00402852
add ebp, 0x4a4
leave
ret
Function at 0x401a3e
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
lea eax, [ebp - 4]
push eax
push 0x20006
xor ebx, ebx
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x401a67
xor al, al
jmp 0x401a94
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push dword [ebp + 0xc]
push 1
push ebx
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x401a89
mov bl, 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
leave
ret

Function at 0x401a97
Capabilities:
Get common file path
Move file
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x410040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x103
push esi
xor ebx, ebx
lea eax, [ebp - 0x323]
push ebx
push eax
mov byte [ebp - 0x324], 0
call fcn.004067c0
push esi
lea eax, [ebp - 0x21f]
push ebx
push eax
mov byte [ebp - 0x220], bl
call fcn.004067c0
xor eax, eax
mov byte [ebp - 0x18], bl
lea edi, [ebp - 0x17]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
push esi
stosb byte es:[edi], al
lea eax, [ebp - 0x11b]
push ebx
push eax
mov byte [ebp - 0x11c], bl
call fcn.004067c0
add esp, 0x24
lea eax, [ebp - 0x428]
push eax
push ebx
push ebx
push 0x1a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jne 0x401c33
lea eax, [ebp - 0x428]
push eax
push str._sMozillaFirefoxprofiles.ini
inc esi
lea eax, [ebp - 0x324]
push esi
push eax
call fcn.00402861
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push ebx
push str.Profile_d
lea eax, [ebp - 0x18]
push 0x14
push eax
mov dword [ebp - 0x42c], ebx
call fcn.00402861
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
add esp, 0x10
lea eax, [ebp - 0x324]
push eax
push esi
lea eax, [ebp - 0x220]
push eax
push 0x40dcc6
push str.Path
lea eax, [ebp - 0x18]
push eax
call ebx
test eax, eax
je 0x401c33
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x428]
push eax
push str._sMozillaFirefox_sExtensions.ini
lea eax, [ebp - 0x11c]
push esi
push eax
call fcn.00402861
add esp, 0x14
push 5
push 0
lea eax, [ebp - 0x11c]
push eax
call edi
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x428]
push eax
push str._sMozillaFirefox_sExtensions.rdf
lea eax, [ebp - 0x11c]
push esi
push eax
call fcn.00402861
add esp, 0x14
push 5
push 0
lea eax, [ebp - 0x11c]
push eax
call edi
inc dword [ebp - 0x42c]
push dword [ebp - 0x42c]
lea eax, [ebp - 0x18]
push str.Profile_d
push 0x14
push eax
call fcn.00402861
add esp, 0x10
lea eax, [ebp - 0x324]
push eax
push esi
lea eax, [ebp - 0x220]
push eax
push 0x40dcc6
push str.Path
lea eax, [ebp - 0x18]
push eax
call ebx
test eax, eax
jne 0x401b8d
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00402852
leave
ret
Function at 0x401c42
Capabilities:
Delete directory
Delete file
Delete registry value
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x2e8]
sub esp, 0x368
mov eax, dword [0x410040]
xor eax, ebp
mov dword [ebp + 0x2e4], eax
push ebx
push esi
push edi
mov esi, 0x103
xor ebx, ebx
push esi
lea eax, [ebp + 0x1e1]
push ebx
push eax
mov byte [ebp + 0x1e0], bl
call fcn.004067c0
push esi
lea eax, [ebp - 0x5b]
push ebx
push eax
mov byte [ebp - 0x5c], bl
call fcn.004067c0
add esp, 0x18
lea eax, [ebp + 0x1e0]
push eax
push ebx
push ebx
push 0x801a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
push str.MozillaExtensionsec8030f7_c20a_464f_9b0e_13a3a9e97384_
inc esi
lea eax, [ebp + 0x1e0]
push esi
push eax
call fcn.0040293c
mov edi, str.textlinks_playsushi.com
push edi
lea eax, [ebp + 0x1e0]
push esi
push eax
call fcn.0040293c
lea eax, [ebp + 0x1e0]
push eax
push str._s.
lea eax, [ebp - 0x5c]
push esi
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x78], eax
mov eax, 0x614
mov word [ebp - 0x70], ax
add esp, 0x28
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x7c], 3
mov dword [ebp - 0x74], ebx
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
lea eax, [ebp + 0x1e0]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0x135
lea eax, [ebp + 0xa9]
push ebx
push eax
mov byte [ebp + 0xa8], bl
call fcn.004067c0
lea eax, [ebp + 0x1e0]
push eax
push str.cmd.exe__c_rd___s___Q_S
lea eax, [ebp + 0xa8]
push 0x136
push eax
call fcn.00402861
lea eax, [ebp + 0xa8]
push eax
push str.PS_Firefox_removal
call fcn.00401a3e
add esp, 0x24
lea eax, [ebp - 0x60]
push eax
push 0x2001f
push ebx
push str.SoftwareMozillaFirefoxExtensions
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401d8e
push edi
push dword [ebp - 0x60]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 0x60]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp + 0x1e0]
push eax
call fcn.004010b7
pop ecx
test al, al
je 0x401e00
push str.extensions_
lea eax, [ebp + 0x1e0]
push esi
push eax
call fcn.0040293c
push edi
lea eax, [ebp + 0x1e0]
push esi
push eax
call fcn.0040293c
add esp, 0x18
lea eax, [ebp + 0x1e0]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea eax, [ebp + 0x1e0]
push eax
push str.cmd.exe__c_rd___s___Q_S
lea eax, [ebp + 0xa8]
push 0x136
push eax
call fcn.00402861
lea eax, [ebp + 0xa8]
push eax
push str.PS_Firefox_removal_proc
call fcn.00401a3e
add esp, 0x18
call fcn.00401a97
mov ecx, dword [ebp + 0x2e4]
pop edi
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.00402852
add ebp, 0x2e8
leave
ret
Function at 0x402231
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x410040]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x24]
push eax
push 0x20006
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x402265
or eax, 0xffffffff
jmp 0x40229b
push esi
push edi
push 6
pop ecx
mov esi, str.Playsushi_Welcome_Message
lea edi, [ebp - 0x20]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x24]
movsw word es:[edi], word [esi]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 0x24]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop edi
pop esi
lea eax, [eax + eax - 1]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402852
leave
ret

Function at 0x4022a7
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0xb8]
sub esp, 0x138
mov eax, dword [0x410040]
xor eax, ebp
mov dword [ebp + 0xb4], eax
lea eax, [ebp - 0x80]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x4022e2
or eax, 0xffffffff
jmp 0x402390
push esi
push edi
push 5
pop ecx
push 5
mov esi, str.PS_registry_removal
lea edi, [ebp + 0xa0]
rep movsd dword es:[edi], dword [esi]
pop ecx
mov esi, str.PS_registry_removal_2
lea edi, [ebp + 0x88]
rep movsd dword es:[edi], dword [esi]
push 0x103
lea eax, [ebp - 0x7b]
push 0
push eax
movsw word es:[edi], word [esi]
mov byte [ebp - 0x7c], 0
call fcn.004067c0
call section..text
push str.cmd.exe__c_reg_delete_HKCUSOFTWAREPlaySushi__f
mov esi, 0x104
lea eax, [ebp - 0x7c]
push esi
push eax
call fcn.00402861
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
add esp, 0x18
push esi
lea eax, [ebp - 0x7c]
push eax
push 1
push 0
lea eax, [ebp + 0xa0]
push eax
push dword [ebp - 0x80]
call edi
push str.cmd.exe__c_reg_delete_HKCUSOFTWAREAppDataLowPlaySushi__f
lea eax, [ebp - 0x7c]
push esi
push eax
call fcn.00402861
add esp, 0xc
push esi
lea eax, [ebp - 0x7c]
push eax
push 1
push 0
lea eax, [ebp + 0x88]
push eax
push dword [ebp - 0x80]
call edi
push dword [ebp - 0x80]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop edi
pop esi
lea eax, [eax + eax - 1]
mov ecx, dword [ebp + 0xb4]
xor ecx, ebp
call fcn.00402852
add ebp, 0xb8
leave
ret
Function at 0x4023a5
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
call fcn.004024c2
xor ebx, ebx
test al, al
je 0x402436
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
push str.OpenProcessToken
push edi
call esi
push str.LookupPrivilegeValueA
push edi
mov dword [ebp - 4], eax
call esi
push str.AdjustTokenPrivileges
push edi
mov dword [ebp - 8], eax
call esi
mov esi, eax
cmp dword [ebp - 4], ebx
je 0x402436
cmp dword [ebp - 8], ebx
je 0x402436
cmp esi, ebx
je 0x402436
lea eax, [ebp - 0xc]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [ebp - 4]
test eax, eax
je 0x402436
lea eax, [ebp - 0x18]
push eax
push str.SeShutdownPrivilege
push ebx
call dword [ebp - 8]
push ebx
push ebx
push ebx
lea eax, [ebp - 0x1c]
push eax
push ebx
push dword [ebp - 0xc]
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], 2
call esi
call fcn.004024c2
push ebx
test al, al
je 0x402444
push 6
jmp 0x402446
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x402451
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersion
mov esi, 0x104
push 0x80000002
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], 1
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
push 0
push str.ProgramFilesDir
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [sym.imp.SHLWAPI.dll_StrNCatA]
push esi
push 0x40dd10
push dword [ebp + 8]
call edi
push esi
push str.Playsushi
push dword [ebp + 8]
call edi
pop edi
xor eax, eax
pop esi
leave
ret
Function at 0x4026ca
Capabilities:
Delete directory
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x63c
mov eax, dword [0x410040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x110]
push edi
push eax
call fcn.00402451
pop ecx
lea eax, [ebp - 0x218]
push eax
call fcn.00402451
pop ecx
lea eax, [ebp - 0x428]
push eax
call fcn.00402451
mov dword [esp], str.PSText.dll
mov esi, 0x104
lea eax, [ebp - 0x110]
push esi
push eax
call fcn.0040293c
add esp, 0xc
push str.icon.ico
lea eax, [ebp - 0x428]
push esi
push eax
call fcn.0040293c
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExA]
add esp, 0xc
push 5
xor ebx, ebx
push ebx
lea eax, [ebp - 0x428]
push eax
call edi
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.DllUnregisterServer
push eax
mov dword [ebp - 0x63c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x402770
call eax
push dword [ebp - 0x63c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 5
push ebx
lea eax, [ebp - 0x110]
push eax
call edi
push esi
lea eax, [ebp - 0x110]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 5
push ebx
lea eax, [ebp - 0x110]
push eax
call edi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x320]
push esi
push eax
call fcn.0040287f
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x530]
push esi
push eax
call fcn.0040287f
add esp, 0xc
push 0x40eb24
lea eax, [ebp - 0x320]
push esi
push eax
call fcn.0040293c
add esp, 0xc
push str.PSText.dll.tmp
lea eax, [ebp - 0x530]
push esi
push eax
call fcn.0040293c
add esp, 0xc
push 5
push ebx
lea eax, [ebp - 0x320]
push eax
call edi
push 5
push ebx
lea eax, [ebp - 0x530]
push eax
call edi
lea eax, [ebp - 0x638]
push eax
call fcn.00402451
pop ecx
lea eax, [ebp - 0x638]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 5
push ebx
lea eax, [ebp - 0x638]
push eax
call edi
call fcn.00401e1f
call fcn.00401c42
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00402852
leave
ret

Function at 0x402852
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410040]
jne 0x40285c
repz ret
jmp fcn.00402c3b
Function at 0x40870c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404601
and dword [ebp - 4], 0
cmp dword [0x411934], 0
mov ebx, eax
jne 0x4087bd
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40886e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40886e
push eax
call fcn.0040458f
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x411934], eax
call esi
push eax
call fcn.0040458f
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x411938], eax
call esi
push eax
call fcn.0040458f
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x41193c], eax
call esi
push eax
call fcn.0040458f
pop ecx
mov dword [0x411944], eax
test eax, eax
je 0x4087bd
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040458f
pop ecx
mov dword [0x411940], eax
mov eax, dword [0x411940]
cmp eax, ebx
je 0x408815
cmp dword [0x411944], ebx
je 0x408815
push eax
call fcn.0040460a
push dword [0x411944]
mov esi, eax
call fcn.0040460a
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x408815
test edi, edi
je 0x408815
call esi
test eax, eax
je 0x40880c
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40880c
test byte [ebp - 0xc], 1
jne 0x408815
or dword [ebp + 0x10], 0x200000
jmp 0x40884e
mov eax, dword [0x411938]
cmp eax, ebx
je 0x40884e
push eax
call fcn.0040460a
pop ecx
test eax, eax
je 0x40884e
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40884e
mov eax, dword [0x41193c]
cmp eax, ebx
je 0x40884e
push eax
call fcn.0040460a
pop ecx
test eax, eax
je 0x40884e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x411934]
call fcn.0040460a
pop ecx
test eax, eax
je 0x40886e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408870
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x405e10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x5c
mov eax, dword [0x410340]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
cmp dword [eax + 0x38], 0
je 0x405e42
mov eax, dword [ebp - 0x44]
test byte [eax + 0x3d], 1
jne 0x405e4b
mov byte [ebp - 0x31], 1
jmp 0x405f77
call fcn.004060b0
mov ecx, dword [ebp - 0x44]
mov edx, eax
mov eax, dword [ecx]
mov dword [esp], edx
call dword [eax + 0xc]
sub esp, 4
mov dword [ebp - 0x48], eax
call fcn.004060b0
mov ecx, eax
mov eax, dword [ebp - 0x48]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00406090
test al, 1
jne 0x405e86
jmp 0x405e8f
mov byte [ebp - 0x31], 0
jmp 0x405f77
mov edx, dword [ebp - 0x44]
mov dword [ebp - 0x3c], 0x20
mov ecx, dword [edx + 0x38]
lea esi, [ebp - 0xc]
add edx, 0x40
mov eax, esp
lea edi, [ebp - 0x30]
mov dword [eax + 0xc], edi
mov dword [eax + 8], esi
lea esi, [ebp - 0x2c]
mov dword [eax + 4], esi
mov dword [eax], edx
mov eax, dword [sym.imp.MSVCP140D.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
call eax
sub esp, 0x10
mov ecx, eax
mov dword [ebp - 0x4c], ecx
test eax, eax
je 0x405ef3
jmp 0x405ed1
mov eax, dword [ebp - 0x4c]
sub eax, 1
je 0x405efa
jmp 0x405ee2
mov eax, dword [ebp - 0x4c]
sub eax, 3
je 0x405f63
jmp 0x405f73
mov eax, dword [ebp - 0x44]
mov byte [eax + 0x3d], 0
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x2c]
sub eax, ecx
mov dword [ebp - 0x40], eax
xor eax, eax
cmp eax, dword [ebp - 0x40]
jae 0x405f51
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x50], ecx
mov eax, dword [eax + 0x4c]
mov ecx, dword [ebp - 0x40]
lea edx, [ebp - 0x2c]
mov dword [esp], edx
mov dword [esp + 4], 1
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.ucrtbased.dll_fwrite]
mov ecx, eax
mov eax, dword [ebp - 0x50]
cmp eax, ecx
je 0x405f51
mov byte [ebp - 0x31], 0
jmp 0x405f77
mov eax, dword [ebp - 0x44]
mov al, byte [eax + 0x3d]
xor al, 0xff
and al, 1
mov byte [ebp - 0x31], al
jmp 0x405f77
mov eax, dword [ebp - 0x44]
mov byte [eax + 0x3d], 0
mov byte [ebp - 0x31], 1
jmp 0x405f77
mov byte [ebp - 0x31], 0
mov al, byte [ebp - 0x31]
and al, 1
movzx eax, al
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00409640
mov eax, dword [ebp - 0x54]
add esp, 0x5c
pop esi
pop edi
pop ebp
ret
Function at 0x407e50
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
lea eax, [ebp + 8]
mov dword [ebp - 0x13c], eax
mov eax, dword [0x410340]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [esp], 2
mov dword [esp + 4], 0
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
sub esp, 8
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0
je 0x407ea9
mov eax, 0xffffffff
cmp dword [ebp - 0x134], eax
jne 0x407ed4
mov eax, dword [ebp - 0x134]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x138], 1
jmp 0x407fc6
mov dword [ebp - 0x12c], 0x128
mov ecx, dword [ebp - 0x134]
lea eax, [ebp - 0x12c]
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.KERNEL32.dll_Process32First
sub esp, 8
cmp eax, 0
jne 0x407f2d
mov eax, dword [ebp - 0x134]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x138], 1
jmp 0x407fc6
jmp 0x407f32
mov ecx, dword [ebp - 0x134]
lea eax, [ebp - 0x12c]
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.KERNEL32.dll_Process32Next
sub esp, 8
cmp eax, 0
je 0x407fb2
mov ecx, dword [ebp - 0x13c]
call fcn.004044c0
lea ecx, [ebp - 0x12c]
add ecx, 0x24
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.ucrtbased.dll__stricmp]
cmp eax, 0
jne 0x407fad
mov eax, dword [ebp - 0x134]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x138], 1
jmp 0x407fc6
jmp 0x407f32
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x138], 1
mov ecx, dword [ebp - 0x13c]
call fcn.00401a00
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x140], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409640
mov eax, dword [ebp - 0x140]
add esp, 0x148
pop ebp
ret
Function at 0x408000
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x3c
lea ecx, [ebp + 8]
mov dword [ebp - 0x30], ecx
mov eax, esp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x408900
mov edx, dword fs:[0]
mov dword [ebp - 0x18], edx
mov dword fs:[0], eax
add ecx, 0x1c
mov dword [ebp - 0x2c], ecx
call fcn.004044c0
mov ecx, eax
mov eax, esp
mov dword [eax], ecx
mov eax, dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
call eax
sub esp, 4
mov dword [ebp - 0x10], 1
mov ecx, dword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], str.starting_download..._n
call fcn.004023e0
jmp 0x408072
mov ecx, dword [ebp - 0x30]
call fcn.004044c0
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
call fcn.004044c0
mov ecx, eax
mov eax, dword [ebp - 0x34]
xor edx, edx
mov dword [esp], 0
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call sub.urlmon.dll_URLDownloadToFileA
sub esp, 0x14
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x4080eb
mov ecx, dword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], str.Succesfully_downloaded__n
call fcn.004023e0
jmp 0x4080db
mov byte [ebp - 0x1d], 1
mov dword [ebp - 0x28], 1
jmp 0x4080f6
mov byte [ebp - 0x1d], 0
mov dword [ebp - 0x28], 1
mov ecx, dword [ebp - 0x30]
call fcn.00401a00
mov ecx, dword [ebp - 0x2c]
call fcn.00401a00
mov al, byte [ebp - 0x1d]
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
and al, 1
movzx eax, al
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x408160
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea ecx, [ebp + 8]
mov dword [ebp - 0xc], ecx
call fcn.004044c0
mov dword [esp], eax
call dword [sym.imp.ucrtbased.dll__mkdir]
cmp eax, 0
jne 0x408193
mov byte [ebp - 1], 0
mov dword [ebp - 8], 1
jmp 0x40819e
mov byte [ebp - 1], 1
mov dword [ebp - 8], 1
mov ecx, dword [ebp - 0xc]
call fcn.00401a00
mov al, byte [ebp - 1]
and al, 1
movzx eax, al
add esp, 0x10
pop ebp
ret
Function at 0x408980
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x110], eax
mov eax, dword [0x410340]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x10c], 0x105
lea ecx, [ebp - 0x108]
lea eax, [ebp - 0x10c]
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
sub esp, 8
mov ecx, dword [ebp - 0x114]
lea eax, [ebp - 0x108]
mov dword [esp], eax
call fcn.00401db0
sub esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409640
mov eax, dword [ebp - 0x110]
add esp, 0x11c
pop ebp
ret