joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100f368
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov esi, ecx
xor edi, edi
jmp 0x100f3f0
mov eax, dword [esi]
lea ecx, [esi + 0x18]
push ecx
lea ecx, [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 8]
push ebx
add ecx, edi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x100f3ea
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x100f3ea
cmp eax, 6
je 0x100f42d
cmp eax, 0x6d
je 0x100f42d
cmp eax, 0x3e5
jne 0x100f40f
push 0
push dword [0x10141c4]
push dword [esi + 0x28]
push 0xffffffffffffffff
call fcn.0100e160
add esp, 0x10
dec eax
jne 0x100f3fb
mov eax, dword [esi]
push 1
lea ecx, [ebp + 0xc]
push ecx
lea ecx, [esi + 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x100f398
xor eax, eax
jmp 0x100f39e
sub ebx, dword [ebp + 0xc]
add edi, dword [ebp + 0xc]
test ebx, ebx
ja 0x100f37c
pop edi
pop esi
pop ebx
leave
ret 8
dec eax
je 0x100f41c
mov dword [ebp - 8], 0x80100001
push 0x10101d0
lea eax, [ebp - 8]
jmp 0x100f43c
mov dword [ebp - 4], eax
push 0x10101d0
lea eax, [ebp - 4]
jmp 0x100f43c
mov dword [ebp - 0xc], 0x80100018
push 0x10101d0
lea eax, [ebp - 0xc]
jmp 0x100f43c
mov dword [ebp - 0x10], 0x6d
push 0x10101d0
lea eax, [ebp - 0x10]
push eax
call sub.msvcrt.dll__CxxThrowException
int3

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x5003972
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov eax, esi
shr eax, 2
push edi
mov edi, eax
dec eax
test edi, edi
jle 0x50039b2
lea edi, [eax + 1]
movzx eax, byte [ecx]
inc ecx
xor ebx, ebx
mov bh, byte [ecx]
or eax, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x10
or eax, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x18
or eax, ebx
inc ecx
xor edx, eax
dec edi
jne 0x5003990
and esi, 3
xor eax, eax
dec esi
je 0x50039ce
dec esi
je 0x50039c7
dec esi
jne 0x50039d3
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
xor ebx, ebx
mov bh, byte [ecx]
or eax, ebx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
pop edi
pop esi
xor eax, edx
pop ebx
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x405d9f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [ebx]
mov byte [ebp - 0x787], 0x3b
mov byte [ebp - 0x786], 0x33
mov byte [ebp - 0x785], 0x3c
mov byte [ebp - 0x784], 0x30
mov byte [ebp - 0x783], 0x3a
mov byte [ebp - 0x782], 0x2d
mov byte [ebp - 0x781], 0x71
mov byte [ebp - 0x780], 0x3b
mov byte [ebp - 0x77f], 0x33
push dword [ebx]
mov byte [ebp - 0x77e], 0x33
mov byte [ebp - 0x77d], 0x5f
push 0xc
lea eax, [ebp - 0x78c]
push eax
call fcn.00404206
pop ecx
push eax
mov eax, dword [ebp - 0x28]
fmul dword [ebp - 0x12bfa7c]
invalid
call dword [eax - 0x18]
pop ecx
jecxz 0x405e0c
inc dword [ebx - 0x7a72f33c]
aam 0xfe
invalid
dec dword [ecx - 0x39f7b]
invalid
jmp 0x40616e
Function at 0x11374
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x424], 0
push edi
mov edi, dword [esi]
mov dword [ebp - 4], edi
je 0x11411
mov eax, dword [esi + 0x14]
add eax, 0x34
push eax
call sub.SCSIPORT.SYS_ScsiPortReadRegisterUlong
mov ebx, eax
or eax, 0x1f
push eax
mov eax, dword [esi + 0x14]
add eax, 0x34
push eax
call sub.SCSIPORT.SYS_ScsiPortWriteRegisterUlong
push esi
call fcn.00011278
push esi
call fcn.00011152
cmp al, 1
je 0x113c9
push 0x11322
call sub.ntoskrnl.exe_DbgPrint
pop ecx
mov dword [ebp + 8], 0x100
mov eax, dword [esi + 0x14]
add eax, 0x44
push eax
call sub.SCSIPORT.SYS_ScsiPortReadRegisterUlong
dec dword [ebp + 8]
jne 0x113d0
test edi, edi
mov eax, dword [esi + 0x1c]
jle 0x11401
add eax, 0x20a
cmp word [eax], 0x55aa
jne 0x113f9
mov word [eax], 0xaa55
add eax, 0x220
dec edi
jne 0x113ed
mov eax, dword [esi + 0x14]
and ebx, 0xfffffff2
push ebx
add eax, 0x34
push eax
call sub.SCSIPORT.SYS_ScsiPortWriteRegisterUlong
and dword [ebp + 8], 0
jmp 0x11490
mov eax, dword [ebp + 8]
lea eax, [esi + eax*4 + 0x20]
mov edi, dword [eax]
test edi, edi
je 0x11481
and dword [eax], 0
lea ebx, [esi + 0x2940]
push ebx
call fcn.000110d0
mov eax, dword [edi + 0x200]
mov byte [eax + 3], 2
and word [edi + 0x20a], 0
and word [edi + 0x208], 0
lea ecx, [esi + 0x928]
mov eax, dword [ecx]
mov dword [esi + eax*4 + 0x428], edi
mov eax, dword [ecx]
inc eax
cdq
idiv dword [ebp - 4]
and dword [ebx], 0
mov dword [ecx], edx
push dword [edi + 0x200]
push esi
call fcn.000110e2
or ecx, 0xffffffff
lea eax, [esi + 0x420]
lock xadd dword [eax], ecx
mov eax, dword [ebp + 8]
inc eax
cdq
mov ecx, 0x100
idiv ecx
mov dword [ebp + 8], edx
cmp dword [esi + 0x420], 0
jg 0x11417
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x11af8
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [eax + 0x20]
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x424], 0
push edi
mov edi, dword [esi]
mov dword [ebp - 4], ebx
mov dword [ebp + 0xc], edi
je 0x11b3d
mov eax, dword [esi + 0x1c]
xor ecx, ecx
test edi, edi
jle 0x11b3d
add eax, 0x200
cmp word [eax + 0xa], 0x55aa
jne 0x11b33
cmp dword [eax], ebx
je 0x11b76
inc ecx
add eax, 0x220
cmp ecx, edi
jl 0x11b27
lea eax, [esi + 0x420]
cmp dword [eax], 0
mov dword [ebp + 8], eax
je 0x11c48
xor eax, eax
lea ecx, [esi + 0x20]
mov edx, dword [ecx]
test edx, edx
je 0x11b66
cmp dword [edx + 0x200], ebx
je 0x11bf5
inc eax
add ecx, 4
cmp eax, 0x100
jl 0x11b54
jmp 0x11c48
mov eax, dword [esi + 0x14]
add eax, 0x34
push eax
call sub.SCSIPORT.SYS_ScsiPortReadRegisterUlong
mov ebx, eax
or eax, 0x1f
push eax
mov eax, dword [esi + 0x14]
add eax, 0x34
push eax
call sub.SCSIPORT.SYS_ScsiPortWriteRegisterUlong
push esi
call fcn.00011278
push esi
call fcn.00011152
cmp al, 1
je 0x11baf
push 0x11aa0
call sub.ntoskrnl.exe_DbgPrint
pop ecx
mov dword [ebp + 0xc], 0x100
mov eax, dword [esi + 0x14]
add eax, 0x44
push eax
call sub.SCSIPORT.SYS_ScsiPortReadRegisterUlong
dec dword [ebp + 0xc]
jne 0x11bb6
mov eax, dword [esi + 0x1c]
add eax, 0x20a
cmp word [eax], 0x55aa
jne 0x11bdb
mov word [eax], 0xaa55
add eax, 0x220
dec edi
jne 0x11bcf
mov eax, dword [esi + 0x14]
and ebx, 0xfffffff2
push ebx
add eax, 0x34
push eax
call sub.SCSIPORT.SYS_ScsiPortWriteRegisterUlong
jmp 0x11c48
and dword [esi + eax*4 + 0x20], 0
lea edi, [esi + 0x2940]
push edi
call fcn.000110d0
mov byte [ebx + 3], 2
and word [edx + 0x20a], 0
and word [edx + 0x208], 0
lea ecx, [esi + 0x928]
mov eax, dword [ecx]
mov dword [esi + eax*4 + 0x428], edx
mov eax, dword [ecx]
inc eax
cdq
idiv dword [ebp + 0xc]
push dword [ebp - 4]
and dword [edi], 0
push esi
mov dword [ecx], edx
call fcn.000110e2
mov ecx, dword [ebp + 8]
or eax, 0xffffffff
lock xadd dword [ecx], eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x1240a
Capabilities:
Print debug messages

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov eax, dword [esi + 0x14]
add eax, 0x1c
push eax
call sub.SCSIPORT.SYS_ScsiPortReadRegisterUlong
test eax, eax
jns 0x12410
mov eax, dword [esi + 0x14]
add eax, 0x34
push eax
call sub.SCSIPORT.SYS_ScsiPortReadRegisterUlong
mov edi, eax
or eax, 0x1f
push eax
mov eax, dword [esi + 0x14]
add eax, 0x34
push eax
call sub.SCSIPORT.SYS_ScsiPortWriteRegisterUlong
push esi
call fcn.0001238e
push esi
call fcn.00011152
cmp al, 1
je 0x12459
push 0x123b4
call sub.ntoskrnl.exe_DbgPrint
pop ecx
mov eax, dword [esi + 0x14]
add eax, 0x2c
push eax
call sub.SCSIPORT.SYS_ScsiPortReadRegisterUlong
test al, 1
je 0x12484
push eax
mov eax, dword [esi + 0x14]
add eax, 0x2c
push eax
call sub.SCSIPORT.SYS_ScsiPortWriteRegisterUlong
mov eax, dword [esi + 0x14]
push 2
add eax, 0x20
push eax
call sub.SCSIPORT.SYS_ScsiPortWriteRegisterUlong
mov eax, dword [esi + 0x14]
and edi, 0xfffffff2
push edi
add eax, 0x34
push eax
call sub.SCSIPORT.SYS_ScsiPortWriteRegisterUlong
or byte [esi + 0x1a], 0x40
not edi
and edi, 0xff
mov dword [esi + 0xc], edi
pop edi
pop esi
ret 4
Function at 0x401491
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
mov eax, dword [0x43d9b0]
or eax, 8
push eax
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x401526
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x105
jmp 0x4014e3
cmp dword [ebp + 0x10], ebx
jne 0x40151a
push ebx
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 4]
call fcn.00401491
test eax, eax
jne 0x4014f5
push edi
lea eax, [ebp - 0x10c]
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x4014ca
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 2
call fcn.00405789
cmp eax, ebx
je 0x40152d
push ebx
push dword [0x43d9b0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x401526
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x43d9b0], ebx
jne 0x401523
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x401523
jmp 0x401526
Function at 0x405374
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
push 0x435538
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
mov dword [0x435538], 0x44
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4053af
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x4054f6
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x405513
and eax, 0xfffffffe
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret 4

Function at 0x405516
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
inc ecx
push 0
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x405545
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
pop ecx
xor edx, edx
div ecx
push esi
push 0
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x405589
test edi, edi
jne 0x405550
mov byte [esi], 0
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x405583

Function at 0x40558d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x14]
lea eax, [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x18]
xor ebx, ebx
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push ebx
push dword [ebp + 0xc]
mov byte [esi], bl
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4055fe
lea eax, [ebp + 0xc]
push eax
push esi
lea eax, [ebp + 0x14]
push eax
push ebx
push dword [ebp + 0x10]
mov dword [ebp + 0xc], 0x1000
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4055ed
cmp dword [ebp + 0x14], 1
je 0x4055ef
cmp dword [ebp + 0x14], 2
je 0x4055ef
mov byte [esi], bl
push dword [ebp + 0x18]
mov byte [esi + 0xfff], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x405847
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x435580
push esi
call fcn.004056a6
push esi
call fcn.0040547f
mov edi, eax
test edi, edi
jne 0x405868
xor eax, eax
jmp 0x4058c0
push edi
call fcn.004056c8
test byte [0x43d928], 0x80
je 0x405881
mov al, byte [edi]
test al, al
je 0x405864
cmp al, 0x5c
je 0x405864
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
sub edi, esi
jmp 0x4058a1
push esi
call fcn.00405762
test eax, eax
je 0x40589b
test byte [eax], 0x10
je 0x4058c5
push esi
call fcn.00405820
push esi
call ebx
cmp eax, edi
jg 0x40588c
push esi
call fcn.004057f3
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop ebx
pop edi
pop esi
ret 4
xor eax, eax
jmp 0x4058bf
Function at 0x405b79
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push 1
call fcn.00405789
mov esi, dword [esp + 0x18]
test eax, eax
je 0x405b9d
push 5
push esi
push dword [esp + 0x1c]
call eax
test eax, eax
jne 0x405cd6
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [0x436580], 0x4c554e
mov edi, 0x400
mov ebp, 0x436580
test esi, esi
je 0x405be1
push 1
push 0
push esi
call fcn.00405516
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x405cdc
cmp eax, edi
jg 0x405cdc
push edi
mov esi, 0x436ec0
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x405cdc
cmp eax, edi
jg 0x405cdc
push esi
push ebp
push str._s_s_r_n
push 0x436980
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ebx, eax
mov eax, dword [0x43d8cc]
push dword [eax + 0x128]
push esi
call fcn.0040591f
push 4
push 0xc0000000
push esi
call fcn.00405516
mov ebp, eax
mov dword [esp + 0x14], ebp
cmp ebp, 0xffffffff
je 0x405cd6
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x405ccf
push 0
lea eax, [esp + 0x1c]
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x405ccf
cmp edi, dword [esp + 0x18]
jne 0x405ccf
push str._Rename__r_n
push esi
call fcn.004058c9
test eax, eax
jne 0x405ce3
push str._Rename__r_n
lea eax, [esi + edi]
push eax
call fcn.004056a6
add edi, 0xa
mov eax, edi
push ebx
push 0x436980
add eax, esi
push eax
call fcn.004054d2
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [esp + 0x1c]
push eax
add edi, ebx
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [0x43d990]
pop edi
pop esi
pop ebp
pop ebx
ret 8
push 0x407614
add eax, 0xa
push eax
call fcn.004058c9
test eax, eax
je 0x405c9a
inc eax
lea ecx, [esi + edi]
mov ebp, eax
cmp eax, ecx
jae 0x405d0a
mov dl, byte [ebp]
mov byte [ebx + ebp], dl
inc ebp
cmp ebp, ecx
jb 0x405cff
mov ebp, dword [esp + 0x14]
sub eax, esi
jmp 0x405c9c
Function at 0x405d12
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push ebx
mov ebx, dword [ebp + 8]
push ebx
call fcn.00405847
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], eax
test cl, 8
je 0x405d47
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x43d988], eax
jmp 0x405ed9
mov dword [ebp + 8], ecx
and dword [ebp + 8], 1
push esi
je 0x405d62
test eax, eax
je 0x405e84
test cl, 2
je 0x405e84
push edi
push ebx
mov esi, 0x4372c0
push esi
call fcn.004056a6
cmp dword [ebp + 8], 0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
je 0x405d85
push str..
push esi
call edi
jmp 0x405d8b
push ebx
call fcn.00405820
cmp byte [ebx], 0
jne 0x405d99
cmp byte [0x4372c0], 0x5c
jne 0x405da1
push 0x407290
push ebx
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
lea eax, [ebp - 0x148]
push eax
push esi
add edi, ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x405e79
lea esi, [ebp - 0x11c]
push 0x3f
mov eax, esi
push eax
call fcn.0040543b
cmp byte [eax], 0
je 0x405de4
cmp byte [ebp - 0x18], 0
je 0x405de4
lea esi, [ebp - 0x18]
cmp byte [esi], 0x2e
jne 0x405dfa
mov al, byte [esi + 1]
test al, al
je 0x405e58
cmp al, 0x2e
jne 0x405dfa
cmp byte [esi + 2], 0
je 0x405e58
push esi
push edi
call fcn.004056a6
test byte [ebp - 0x148], 0x10
je 0x405e1f
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405e58
push dword [ebp + 0xc]
push ebx
call fcn.00405d12
jmp 0x405e58
push ebx
call fcn.004054f6
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x405e50
test byte [ebp + 0xc], 4
je 0x405e48
push ebx
push 0xfffffffffffffff1
call fcn.00404755
push 0
push ebx
call fcn.00405b79
jmp 0x405e58
inc dword [0x43d988]
jmp 0x405e58
push ebx
push 0xfffffffffffffff2
call fcn.00404755
lea eax, [ebp - 0x148]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x405dc6
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x405e83
mov byte [edi - 1], 0
pop edi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x405ed8
cmp dword [ebp - 8], esi
je 0x405ec8
push ebx
call fcn.00405762
test eax, eax
je 0x405ed8
push ebx
call fcn.004057f3
push ebx
call fcn.004054f6
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x405ed0
test byte [ebp + 0xc], 4
je 0x405ec8
push ebx
push 0xfffffffffffffff1
call fcn.00404755
push esi
push ebx
call fcn.00405b79
jmp 0x405ed8
inc dword [0x43d988]
jmp 0x405ed8
push ebx
push 0xffffffffffffffe5
call fcn.00404755
pop esi
pop ebx
leave
ret 8
Function at 0x405ede
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x4382c4], 0
jne 0x405f1c
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405ef2
mov dword [ecx*4 + 0x4382c0], eax
inc ecx
cmp ecx, 0x100
jl 0x405eed
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x405f49
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x4382c0]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x405f2a
not eax
pop ebp
ret 0xc
Function at 0x40c370
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x46871b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0045d009
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40c3f2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0045af20
mov eax, dword [eax]
push 0x6651f0
push eax
call fcn.0044db54
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0045d294
test bl, bl
je 0x40c3f2
push 0x6651f0
lea ecx, [esp + 0xc]
call fcn.0045d624
push 0x668d80
lea ecx, [esp + 0xc]
call fcn.0045d624
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40c42e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0045d294
jmp 0x40c4f9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40c4b2
lea edx, [esp + 0x7c]
push 0x668d7c
push edx
call fcn.0044db54
add esp, 8
test eax, eax
je 0x40c4b2
lea eax, [esp + 0x7c]
push 0x668d78
push eax
call fcn.0044db54
add esp, 8
test eax, eax
je 0x40c4b2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40c442
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0045d294
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40ccf0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40cd52
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x40cd60
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x46879b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x66f2fc]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x40ce98
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x40cdc6
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0045d294
xor eax, eax
jmp 0x40cf0f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0045d3d1
push esi
lea ecx, [esp + 0xc]
call fcn.0045d660
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push 0x668db8
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x40ceed
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.0040ccf0
test eax, eax
jne 0x40ceed
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.0040ccf0
test eax, eax
jne 0x40ceed
lea eax, [esp + 0x14]
push 0x668d94
push eax
call fcn.0044eb90
mov esi, eax
add esp, 8
test esi, esi
jne 0x40cecc
lea ecx, [esp + 0x14]
push 0x668d90
push ecx
call fcn.0044eb10
mov esi, eax
add esp, 8
test esi, esi
jne 0x40cecc
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x40cecf
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0045d381
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x40cdde
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0045d294
xor eax, eax
jmp 0x40cf0f
mov byte [esi], 0
push 0x668d8c
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0045d294
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4