joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43addc
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x45313c]
cmp byte [eax + 0xc], 0
je 0x43af49
push 0x8000
call sub.KERNEL32.DLL_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x43af42
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x454b64], 0
jne 0x43ae30
push 0x43af50
call sub.KERNEL32.DLL_GetModuleHandleA
mov ebx, eax
push 0x43af58
push ebx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x454b64], eax
cmp dword [0x452b10], 0
jne 0x43af2b
push 0x43af68
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [0x452b10], eax
cmp dword [0x452b10], 0
je 0x43af2b
push 0x43af74
mov eax, dword [0x452b10]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x454b68], eax
push 0x43af84
mov eax, dword [0x452b10]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x454b6c], eax
push 0x43af98
mov eax, dword [0x452b10]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x454b70], eax
push 0x43afb0
mov eax, dword [0x452b10]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x454b74], eax
push 0x43afc8
mov eax, dword [0x452b10]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x454b78], eax
push 0x43afdc
mov eax, dword [0x452b10]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x454b7c], eax
push 0x43aff4
mov eax, dword [0x452b10]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x454b80], eax
push 0x43b00c
mov eax, dword [0x452b10]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x454b84], eax
push 0x43b028
mov eax, dword [0x452b10]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x454b88], eax
push 0x43b034
mov eax, dword [0x452b10]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x454b8c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43af49
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x43edd4
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00403e4c
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x43ee23
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.004040bc
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x446538
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x446588]
test si, 4
je 0x44654c
or bl, 1
test si, 8
je 0x446556
or bl, 4
test si, 1
je 0x446560
or bl, 8
test si, 2
je 0x44656a
or bl, 0x10
test si, 0x10
je 0x446574
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x446583
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x44658c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x4465c4]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4465a5
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4465b4
or bl, 4
test esi, 0x20000000
je 0x4465bf
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x44cc6c
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x44cc7e
add esp, 0xfffffff0
call fcn.00403420
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041910c
mov eax, dword [0x452e10]
mov dword [eax + 4], ebx
mov dword [eax], 0x44d010
mov eax, dword [0x452e1c]
mov dword [eax + 4], ebx
mov dword [eax], 0x44d01c
mov eax, ebx
call fcn.0044d028
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x411404]
call fcn.004030cc
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x411404]
call fcn.004030cc
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x411404]
call fcn.004030cc
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x411404]
call fcn.004030cc
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x411404]
call fcn.004030cc
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x449444
push eax
push 0
push 0
mov eax, dword [0x452f5c]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x41ab58]
call fcn.0041c2cc
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x41ab58]
call fcn.0041c2cc
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x41ab58]
call fcn.0041c2cc
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.0044d448
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44d324
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44d324
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44d324
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x44cdbb
call fcn.00403478
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x44d108
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44d2b3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x44d294
mov dl, 1
mov eax, dword [0x411820]
call fcn.004030cc
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00403e4c
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x44d283
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0043b13c
test al, al
je 0x44d276
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x44d2c4
lea eax, [ebp - 0x254]
call fcn.004088e0
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x44d276
xor eax, eax
push ebp
push 0x44d26f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x44d2fc
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x44d258
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004040bc
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x44d258
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004040bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44d276
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x44d179
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.004152fc
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44d2ba
lea eax, [ebp - 0x260]
call fcn.00403e4c
ret

Function at 0x44dbe8
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x454bb0]
cmp byte [eax + 0xa5], 0
jne 0x44dc59
cmp dword [0x454bc8], 0
jne 0x44dc1a
call sub.KERNEL32.DLL_GetCurrentThreadId
push eax
push 0
mov eax, 0x44dba4
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x454bc8], eax
cmp dword [0x454bc4], 0
jne 0x44dc35
push 0
push 0
push 0
push 0
call sub.KERNEL32.DLL_CreateEventA
mov dword [0x454bc4], eax
cmp dword [0x454bcc], 0
jne 0x44dc59
push esp
push 0
push 0
push 0x44db48
push 0x3e8
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [0x454bcc], eax
pop edx
ret
Function at 0x44dd98
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x44ddaf
add esp, 0xfffffff0
call fcn.00403420
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041910c
mov eax, dword [0x452f48]
cmp word [eax + 2], 0
jne 0x44ddd7
mov eax, dword [0x452f48]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0044f500
mov eax, dword [0x452ff4]
cmp word [eax + 2], 0
jne 0x44ddf1
mov eax, dword [0x452ff4]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0044f6f8
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x411404]
call fcn.004030cc
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x411404]
call fcn.004030cc
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41b638]
call fcn.004229d0
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x44df78
mov eax, dword [0x452e70]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00422da0
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x44fc98
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x452e70]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_GetModuleFileNameA
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040bfa8
test eax, eax
je 0x44dee6
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.004082d4
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040bfd0
test eax, eax
je 0x44defa
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.004040bc
mov eax, dword [0x452d68]
cmp byte [eax], 0
jne 0x44df2e
mov eax, ebx
call fcn.0044e0a0
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.0044fe74
mov eax, ebx
call fcn.00450838
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x44df6e
call fcn.00403478
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44e320
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x454bb0]
cmp dword [eax + 0x30], 0
je 0x44e3ca
cmp dword [ebx + 0x94], 0
jne 0x44e3c4
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x44e2b0
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x44e3c4
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x44e38a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x44e3c4
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041376c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x44e399
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x44ef2c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x44ef61
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403f3c
jmp 0x44ef6e
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00403ea0
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x450050
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x450091
mov eax, esi
call fcn.004367fc
test al, al
je 0x450091
mov eax, dword [ebx + 0x84]
call fcn.0043659c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x450091
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043659c
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x102c210
Capabilities:
Decompress data using aplib

Disassembly:
call 0x102c360
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x102c236
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x102c222
add dl, dl
jne 0x102c241
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x102c294
xor eax, eax
add dl, dl
jne 0x102c24e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x102c335
add dl, dl
jne 0x102c25d
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x102c268
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x102c273
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x102c27e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x102c28a
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x102c22d
mov eax, 1
add dl, dl
jne 0x102c2a2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x102c2ad
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x102c299
sub eax, ebx
mov ebx, 1
jne 0x102c2e0
mov ecx, 1
add dl, dl
jne 0x102c2c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x102c2d1
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x102c2bd
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x102c22d
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x102c2f7
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x102c302
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x102c2ee
cmp eax, 0x7d00
jae 0x102c325
cmp eax, 0x500
jb 0x102c320
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x102c22d
cmp eax, 0x7f
ja 0x102c328
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x102c22d
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x102c356
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x102c22d
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x40124f
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push ebx
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x401272
mov edi, 0x406db9
rdtsc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, 0x406595
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x404041
push 0x405050
call sub.KERNEL32.DLL_lstrcpyA
push 0x404032
push 0x405050
call sub.KERNEL32.DLL_lstrcatA
push dword [0x407521]
push 0x405050
call sub.KERNEL32.DLL_lstrcatA
mov eax, dword [ebp - 4]
cmp eax, 0xffffffff
jne 0x4012b1
mov byte [0x406550], 2
jmp 0x4012b8
mov byte [0x406550], 1
push 1
call sub.KERNEL32.DLL_SetErrorMode
call sub.KERNEL32.DLL_GetLogicalDrives
mov ecx, 0x19
mov ebx, 1
shl ebx, cl
and ebx, eax
je 0x401301
add cl, 0x41
mov byte [0x404450], cl
sub cl, 0x41
mov dword [0x404451], 0x2e2a5c3a
mov byte [0x404455], 0x2a
mov byte [0x404456], 0
push eax
push ecx
call fcn.004013a8
pop ecx
pop eax
dec ecx
jge 0x4012c9
mov eax, dword [ebp - 4]
or eax, eax
jne 0x40133e
cmp byte [0x40752d], 1
jne 0x401329
push pe_nt_image_headers32
push 0x4043f3
push 0x404077
push 0
call sub.user32.dll_MessageBoxA
jmp 0x401374
push pe_nt_image_headers32
push str.Attention_
push 0x404077
push 0
call sub.user32.dll_MessageBoxA
jmp 0x401374
cmp eax, 0xffffffff
jne 0x401374
cmp byte [0x40752d], 1
jne 0x401361
push pe_nt_image_headers32
push 0x4043f3
push 0x4041ab
push 0
call sub.user32.dll_MessageBoxA
jmp 0x401374
push pe_nt_image_headers32
push str.Attention_
push str.You_have_reached_a_limit_of_attempts___your_data_is_irrevocably_broken.
push 0
call sub.user32.dll_MessageBoxA
pop ebx
leave
ret
Function at 0x445f90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x445f9f
pop dword [ebp - 8]
mov eax, 0xb51724c6
add eax, 0x4b2d3ad9
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0xc342b4bd
sub dword [ebp - 0x18], 0x74f06f72
mov dword [ebp - 0x14], 0xc7c76bcb
add dword [ebp - 0x14], 0x6a6be07a
mov dword [ebp - 0x10], 0x9d05d12c
add dword [ebp - 0x10], 0xaf467302
mov dword [ebp - 0xc], 0x66cdb077
add dword [ebp - 0xc], 0x99324f89
lea eax, [ebp - 0x18]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x9c42364d
sub dword [ebp - 0x18], 0x27cfccf7
mov dword [ebp - 0x14], 0x8bed6fb0
add dword [ebp - 0x14], 0xb57ef1c5
mov dword [ebp - 0x10], 0x9b7b2029
add dword [ebp - 0x10], 0xc7f44c43
mov dword [ebp - 0xc], 0x5a1d2727
add dword [ebp - 0xc], 0xa5e2d8d9
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x4d5e365d
add eax, 0xb2ec3b37
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x60534
push 0
call eax
mov ecx, 0x4988
mov edi, eax
mov esi, 0x4d3800
add esi, dword [ebp - 8]
mov ebx, 0x6a033c0e
sub ebx, 0x4e839c47
mov edx, dword [esi]
xor dword [ebp - 4], 0xc52964da
add edx, ebx
xor dword [ebp - 4], 0x8095d2c6
mov dword [edi], edx
add edi, 0xdb4bdb0c
add edi, 0x24b424f8
add esi, 4
loop 0x4460b0
add eax, 0x246b6ea1
sub eax, 0x246a55ae
xor ebx, ebx
add ebx, eax
add eax, 0x9435ce9a
sub eax, 0x9435ce95
mov ecx, 0xd9c5e15a
sub ecx, 0xd985e15a
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x47046f
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push 0x2b4
mov eax, 0x4a12cd
call fcn.0049fa2f
mov ebx, ecx
push edx
mov edx, ebx
lea ecx, [ebp - 0x40]
call fcn.004707a0
pop ecx
xor edi, edi
lea ecx, [ebp - 0x2c0]
mov dword [ebp - 4], edi
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], 8
push ecx
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.kernel32.dll_FindFirstFileW]
mov esi, eax
mov dword [ebp - 0x28], edi
xor eax, eax
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 1
cmp esi, 0xffffffff
je 0x47055f
lea eax, [ebp - 0x294]
push eax
lea ecx, [ebp - 0x58]
call fcn.00445f90
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 2
push eax
mov edx, ebx
lea ecx, [ebp - 0x70]
call fcn.004707a0
mov edi, eax
lea eax, [ebp - 0x28]
pop ecx
cmp eax, edi
je 0x470507
mov ecx, eax
call fcn.0046d98d
push edi
lea ecx, [ebp - 0x28]
call fcn.00445f90
lea ecx, [ebp - 0x70]
call fcn.0046d98d
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 1
call fcn.0046d98d
test byte [ebp - 0x2c0], 4
jne 0x470542
lea ecx, [ebp - 0x28]
call fcn.0047078b
test al, al
jne 0x470542
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
lea eax, [ebp - 0x2c0]
push eax
push esi
call dword [sym.imp.kernel32.dll_FindNextFileW]
test eax, eax
jne 0x4704cc
push esi
call dword [sym.imp.kernel32.dll_FindClose]
lea ecx, [ebp - 0x28]
call fcn.0046d98d
lea ecx, [ebp - 0x40]
call fcn.0046d98d
call fcn.0049f9de
ret
Function at 0x474827
Capabilities:
Get common file path

Disassembly:
push 0x278
mov eax, 0x4a1b42
call fcn.0049fa2f
mov ebx, ecx
mov dword [ebp - 0x280], ebx
mov dword [ebp - 0x284], ebx
mov eax, dword fs:[0x2c]
xor esi, esi
mov dword [ebp - 0x284], ebx
mov edi, 0x4cb420
mov ecx, dword [eax]
mov eax, dword [0x4cb41c]
cmp eax, dword [ecx + 4]
jle 0x4748a4
push 0x4cb41c
call fcn.00445f90
cmp dword [0x4cb41c], 0xffffffff
pop ecx
jne 0x4748a4
push 0x4b9024
mov ecx, edi
mov dword [ebp - 4], esi
call fcn.00445f90
push 0x4a6680
call fcn.00445f90
or dword [ebp - 4], 0xffffffff
mov dword [esp], 0x4cb41c
call fcn.00445f90
pop ecx
cmp dword [0x4cb430], 0
jne 0x4749c5
push 0x20a
lea eax, [ebp - 0x21c]
push esi
push eax
call dword [sym.imp.VCRUNTIME140.dll_memset]
add esp, 0xc
call fcn.00445f90
test al, al
je 0x474998
push str.LogSession
lea ecx, [ebp - 0x24c]
call fcn.00445f90
lea ecx, [ebp - 0x24c]
mov dword [ebp - 4], 1
call fcn.00477e85
mov ebx, eax
lea ecx, [ebp - 0x264]
push 0x4adacc
mov eax, dword [ebx]
mov edi, dword [eax + 0x40]
call fcn.00445f90
mov esi, eax
push str.IE_is_protected_mode_
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], 2
call fcn.00445f90
push esi
lea eax, [ebp - 0x234]
mov byte [ebp - 4], 3
push eax
mov ecx, edi
call dword [0x4a75c0]
mov ecx, ebx
call edi
lea ecx, [ebp - 0x234]
call fcn.0046a23d
lea ecx, [ebp - 0x264]
call fcn.0046a23d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24c]
call fcn.0046a23d
lea ecx, [ebp - 0x27c]
call fcn.00474779
mov esi, eax
mov edi, 0x4cb420
cmp esi, edi
je 0x474985
mov ecx, edi
call fcn.0046d98d
push esi
mov ecx, edi
call fcn.00445f90
lea ecx, [ebp - 0x27c]
call fcn.0046d98d
mov ebx, dword [ebp - 0x280]
jmp 0x4749c5
lea eax, [ebp - 0x21c]
push eax
push esi
push esi
push 0x801a
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
lea ecx, [ebp - 0x21c]
mov eax, 0x4b9024
cmovne ecx, eax
push ecx
mov ecx, edi
call fcn.00445f90
push edi
mov ecx, ebx
call fcn.004723ba
mov eax, ebx
call fcn.0049f9de
ret
Function at 0x476140
Capabilities:
Read data from internet
Receive data

Disassembly:
push 0x20
mov eax, 0x4a1e1c
call fcn.0049fa65
mov dword [ebp - 0x20], ecx
xor esi, esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x18], esi
push esi
push esi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], esi
push eax
mov eax, dword [ebp - 0x20]
push dword [eax + 8]
call dword [sym.imp.wininet.dll_InternetQueryDataAvailable]
mov edi, eax
mov dword [ebp - 0x1c], edi
test edi, edi
je 0x476244
cmp dword [ebp - 0x14], 0
jbe 0x476242
mov dword [ebp - 4], esi
mov eax, dword [ebp - 0x14]
inc eax
push eax
call fcn.00445f90
pop ecx
mov ecx, dword [ebp - 0x14]
mov ebx, eax
inc ecx
mov dword [ebp - 0x18], ebx
push ecx
push esi
push ebx
call dword [sym.imp.VCRUNTIME140.dll_memset]
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
push ebx
push dword [eax + 8]
call dword [sym.imp.wininet.dll_InternetReadFile]
mov edi, eax
mov dword [ebp - 0x1c], edi
test edi, edi
jne 0x4761c8
mov dword [ebp - 0x14], esi
jmp 0x4761da
cmp dword [ebp - 0x14], 0
jbe 0x4761da
push dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
push ebx
call fcn.0046a372
or dword [ebp - 4], 0xffffffff
jmp 0x47622e
push ebx
call fcn.0048844b
cmp dword [ebp - 0x14], 0
pop ecx
mov dword [ebp - 0x18], esi
ja 0x476157
test edi, edi
setne al
call fcn.0049f9ca
ret 4