joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4029b0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x90]
sub esp, 0x110
mov eax, dword [0x42f180]
xor eax, ebp
mov dword [ebp + 0x8c], eax
mov eax, dword [ebp + 0x98]
push ebx
lea ecx, [ebp - 0x68]
push ecx
push 0x20019
xor ebx, ebx
push ebx
mov dword [ebp - 0x74], eax
mov eax, dword [ebp + 0x9c]
push str.SoftwarePythonPythonCore
push eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x6c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x402a04
xor eax, eax
jmp 0x402b41
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp + 0x3c]
push eax
push ebx
push dword [ebp - 0x68]
mov dword [ebp - 0x70], 0x50
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x402b35
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov esi, dword [ebp + 0xa0]
inc dword [ebp - 0x6c]
mov dword [ebp - 0x70], 0x50
cmp esi, ebx
je 0x402a77
cmp byte [esi], bl
je 0x402a77
lea eax, [ebp + 0x3c]
mov cl, byte [esi]
cmp cl, byte [eax]
jne 0x402a6a
cmp cl, bl
je 0x402a66
mov cl, byte [esi + 1]
cmp cl, byte [eax + 1]
jne 0x402a6a
inc esi
inc esi
inc eax
inc eax
cmp cl, bl
jne 0x402a4c
xor eax, eax
jmp 0x402a6f
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x402b13
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp + 0x3c]
push eax
lea eax, [ebp - 0x14]
push str.Python_Version__s__found_in_registry_
push eax
call esi
lea eax, [ebp + 0x3c]
push eax
lea eax, [ebp - 0x64]
push str.SoftwarePythonPythonCore_sInstallPath
push eax
call esi
add esp, 0x18
lea eax, [ebp - 0x78]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402b13
push 0x10c
call fcn.0041b8a8
mov esi, eax
pop ecx
mov dword [ebp - 0x80], 0x105
cmp esi, ebx
je 0x402b0a
lea eax, [ebp - 0x80]
push eax
push esi
push ebx
push ebx
push ebx
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402b0a
lea eax, [ebp - 0x14]
push eax
push ebx
push 0x180
push dword [ebp - 0x74]
call edi
mov ecx, dword [ebp - 0x7c]
push esi
push eax
push 0x19a
push dword [ebp - 0x74]
mov dword [esi + 0x108], ecx
call edi
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp + 0x3c]
push eax
push dword [ebp - 0x6c]
push dword [ebp - 0x68]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x402a31
pop edi
pop esi
push dword [ebp - 0x68]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x8c]
xor ecx, ebp
pop ebx
call fcn.00407875
add ebp, 0x90
leave
ret
Function at 0x4036c6
Capabilities:
Create process on windows
Resume thread
Self delete

Disassembly:
push ebp
lea ebp, [esp - 0x1e0]
sub esp, 0x260
mov eax, dword [0x42f180]
xor eax, ebp
mov dword [ebp + 0x1dc], eax
push ebx
push esi
push edi
push 0x104
lea eax, [ebp + 0xd8]
push eax
xor edi, edi
push edi
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
lea eax, [ebp + 0xd8]
push eax
lea eax, [ebp - 0x2c]
push str._s.bat
push eax
call fcn.0041b8a8
lea eax, [ebp - 0x2c]
push 0x425fc0
push eax
call fcn.0041b8a8
mov ebx, eax
push str.:Repeat_n
push ebx
call fcn.00408778
lea eax, [ebp + 0xd8]
push eax
mov esi, str.del___s__n
push esi
push ebx
call fcn.00408778
lea eax, [ebp + 0xd8]
push eax
push str.if_exist___s__goto_Repeat_n
push ebx
call fcn.00408778
lea eax, [ebp - 0x2c]
push eax
push esi
push ebx
call fcn.00408778
add esp, 0x40
push ebx
call fcn.00408fa6
push 0x44
pop esi
push esi
lea eax, [ebp - 0x80]
push edi
push eax
call fcn.004076c0
add esp, 0x10
xor eax, eax
mov word [ebp - 0x50], ax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x80]
push eax
push 0x4253ac
push edi
push esi
push edi
push edi
push edi
lea eax, [ebp - 0x2c]
push eax
push edi
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x54], 1
call dword [sym.imp.kernel32.dll_CreateProcessA]
test eax, eax
je 0x4037e7
mov esi, dword [sym.imp.kernel32.dll_SetThreadPriority]
push 0xfffffffffffffff1
push dword [ebp - 0x38]
call esi
push 0xf
call dword [sym.imp.kernel32.dll_GetCurrentThread]
push eax
call esi
push 0x80
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_SetPriorityClass]
push dword [ebp - 0x3c]
mov esi, dword [sym.imp.kernel32.dll_CloseHandle]
call esi
push dword [ebp - 0x38]
call dword [sym.imp.kernel32.dll_ResumeThread]
push dword [ebp - 0x38]
call esi
mov ecx, dword [ebp + 0x1dc]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407875
add ebp, 0x1e0
leave
ret

Function at 0x403989
Capabilities:
Delete file

Disassembly:
push esi
push 0x3a
push dword [esp + 0xc]
call fcn.00407290
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x40399f
pop esi
ret
inc esi
movsx eax, byte [esi]
push eax
call fcn.0041b8a8
pop ecx
test eax, eax
jne 0x40399f
push esi
call dword [sym.imp.kernel32.dll_DeleteFileA]
pop esi
ret

Function at 0x4039b7
Capabilities:
Delete directory

Disassembly:
push esi
push 0x3a
push dword [esp + 0xc]
call fcn.00407290
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x4039cd
pop esi
ret
inc esi
movsx eax, byte [esi]
push eax
call fcn.0041b8a8
pop ecx
test eax, eax
jne 0x4039cd
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryA]
pop esi
ret
Function at 0x4044dd
Capabilities:
Delete file
Read .ini file

Disassembly:
mov eax, 0x1004
call fcn.00408e10
mov eax, dword [0x42f180]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
push ebp
push esi
push edi
push dword [0x43292c]
mov edi, dword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
mov ebp, 0x1000
push ebp
lea eax, [esp + 0x18]
push eax
mov ebx, 0x425524
push ebx
push str.title
mov esi, 0x425f40
push esi
call edi
push 0x50
pop ecx
lea eax, [esp + 0x10]
mov edx, 0x431140
call fcn.0041b8a8
push dword [0x43292c]
lea eax, [esp + 0x14]
push ebp
push eax
push ebx
push str.info
push esi
call edi
mov ecx, ebp
lea eax, [esp + 0x10]
mov edx, 0x431580
call fcn.0041b8a8
push dword [0x43292c]
push 0x50
push 0x4327c0
push ebx
push str.build_info
push esi
call edi
push dword [0x43292c]
mov ebp, dword [sym.imp.kernel32.dll_GetPrivateProfileIntA]
push 1
push str.target_compile
push esi
call ebp
push dword [0x43292c]
mov dword [0x431194], eax
push 1
push str.target_optimize
push esi
call ebp
push dword [0x43292c]
mov dword [0x431190], eax
push 0xa
push 0x432590
push ebx
push str.target_version
push esi
call edi
push dword [0x43292c]
push 0x50
push 0x4312c0
push ebx
push str.name
push str.metadata
call edi
push dword [0x43292c]
push 0x104
push 0x4311a0
push ebx
push str.install_script
push esi
call edi
push dword [0x43292c]
mov ebp, 0x431550
push 0xa
push ebp
push ebx
push str.user_access_control
push esi
call edi
push 6
mov edi, str.force
mov esi, ebp
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x40462b
call fcn.0041b8a8
test eax, eax
je 0x404688
call fcn.00403547
test eax, eax
jne 0x404688
call fcn.0041b8a8
jmp 0x4046cb
push 5
mov edi, str.auto
mov esi, ebp
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x404658
call fcn.0041b8a8
test eax, eax
je 0x404688
call fcn.00403547
test eax, eax
jne 0x404688
call fcn.0041b8a8
test eax, eax
je 0x404688
jmp 0x404621
cmp byte [0x431550], al
je 0x404688
push 5
mov edi, str.none
mov esi, ebp
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x404688
push eax
push str.oops
push str.Bad_user_access_control_value
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x431140
call fcn.00402766
push eax
mov dword [0x432580], eax
call fcn.0041b8a8
pop ecx
pop ecx
push dword [0x432814]
call dword [sym.imp.kernel32.dll_UnmapViewOfFile]
mov eax, dword [0x43292c]
test eax, eax
je 0x4046bb
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov eax, dword [0x432930]
test eax, eax
je 0x4046cb
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [esp + 0x1010]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00407875
add esp, 0x1004
ret

Function at 0x407875
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42f180]
jne 0x40787f
repz ret
jmp fcn.0040bbd7
Function at 0x41b8a8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x41b8b7
pop dword [ebp - 0x38]
mov eax, 0x3be1a772
add eax, 0xc4601145
sub dword [ebp - 0x38], eax
push 0x40
push 0x1000
push 0x3d51b
push 0
mov eax, 0x1f9ef67f
add eax, 0xe0a35b99
add eax, dword [ebp - 0x38]
call dword [eax]
mov ecx, 0xcb928bcf
sub ecx, 0xcb924aaa
mov edi, eax
mov ebx, 0x435400
add ebx, dword [ebp - 0x38]
mov esi, 0x93f5ba0
sub esi, 0x9c9e14c4
xor dword [ebp - 0x30], edx
mov edx, dword [ebx]
xor dword [ebp - 4], 0x5da02a52
xor edx, esi
xor dword [ebp - 8], 0x7a8f126e
mov dword [edi], edx
sub dword [ebp - 0x20], ecx
add edi, 4
add ebx, 0x43f401a9
sub ebx, 0x43f401a5
loop 0x41b910
add eax, 0xf767
xor ebx, ebx
add ebx, eax
add eax, 0xb917d5b8
add eax, 0x46e82a4d
mov ecx, 0xed98b318
sub ecx, 0xed58b318
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408f6c
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x42384df0
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e3d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x46d37695
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x40c6e3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0x80000301
push 0
push 0xff
push 1
mov ebx, 0x184
call fcn.00443710
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x40c72f
push ebx
call fcn.0044222b
add esp, 4
pop eax
mov dword [ebp - 4], eax
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x40c746
mov eax, 0x483260
push eax
push 1
mov ebx, 0x130
call fcn.00442ed0
add esp, 0x10
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push dword [ebp - 0xc]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x40c781
push 6
call fcn.00442237
add esp, 4
mov dword [ebp - 8], eax
push 0x80000301
push 0
push dword [ebp - 8]
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x40c7a1
mov eax, 0x483260
push eax
push 2
mov ebx, 0x134
call fcn.004430a0
add esp, 0x1c
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x40c7cb
push ebx
call fcn.0044222b
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x40c7eb
push eax
mov ebx, eax
call fcn.004010ac
inc eax
push eax
call fcn.00442225
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x40c7f0
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x40c801
push ebx
call fcn.0044222b
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x41b4c0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
jmp 0x41b4f7
push 0x80000301
push 0
push 0xff
push 1
mov ebx, 0x184
call fcn.00443710
add esp, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x41b52c
push ebx
call fcn.0044222b
add esp, 4
pop eax
mov dword [ebp - 4], eax
push 0x80000301
push 0
push 0xff
push 1
mov ebx, 0x184
call fcn.00443710
add esp, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x41b565
push ebx
call fcn.0044222b
add esp, 4
pop eax
mov dword [ebp - 8], eax
call fcn.0040c6e3
mov dword [ebp - 0x14], eax
push 0x80000301
push 0
push 3
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x41b590
mov eax, 0x483260
push eax
push 2
mov ebx, 0x134
call fcn.004430a0
add esp, 0x1c
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x41b5b6
push ebx
call fcn.0044222b
add esp, 4
mov dword [ebp - 0x1c], esp
push 0xff
push dword [ebp - 8]
mov eax, 0
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
mov eax, 0xff
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x10]
push eax
push 0xff
push dword [ebp - 4]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
nop
nop
nop
nop
cmp dword [ebp - 0x1c], esp
je 0x41b604
push 6
call fcn.00442237
add esp, 4
mov dword [ebp - 0x28], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x41b617
push ebx
call fcn.0044222b
add esp, 4
cmp dword [ebp - 0x28], 0
je 0x41b649
push 0x80000401
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 1
mov ebx, 0x168
call fcn.004428b0
add esp, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
jmp 0x41b682
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00442b80
add esp, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
jmp 0x41b682
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x41b693
push ebx
call fcn.0044222b
add esp, 4
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x41b6a3
push ebx
call fcn.0044222b
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret

Function at 0x41f6c1
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x41f70a
push 6
call fcn.00442237
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp + 0x18], 0
jne 0x41f73e
mov dword [ebp - 8], esp
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x41f739
push 6
call fcn.00442237
add esp, 4
jmp 0x41f746
mov eax, dword [ebp - 4]
mov ebx, dword [ebp + 0x14]
mov dword [ebx], eax
cmp dword [ebp - 4], 0
mov eax, 0
setne al
jmp 0x41f757
mov esp, ebp
pop ebp
ret 0x14
Function at 0x424af8
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
jmp 0x424b1a
push 0x80000301
push 0
push 0x32
push 1
mov ebx, 0x184
call fcn.00443710
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x424b4f
push ebx
call fcn.0044222b
add esp, 4
pop eax
mov dword [ebp - 4], eax
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x424b66
mov eax, 0x483260
push eax
push 1
mov ebx, 0x130
call fcn.00442ed0
add esp, 0x10
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x424ba2
push 6
call fcn.00442237
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x424bd0
mov eax, dword [ebp - 4]
test eax, eax
je 0x424bcb
push eax
mov ebx, eax
call fcn.004010ac
inc eax
push eax
call fcn.00442225
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x424c09
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00442b80
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x424c09
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x424c1a
push ebx
call fcn.0044222b
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret

Function at 0x42d0b3
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], esp
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x42d0e3
push 6
call fcn.00442237
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
mov eax, 0
setne al
jmp 0x42d0f7
mov esp, ebp
pop ebp
ret 4
Function at 0x4435d0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
push edi
push 0
push 0x20
push 3
push 0
push 3
push closesocket
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x443639
push ebx
lea ecx, [esp + 0x10]
push esi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea edx, [ebx + 8]
push edx
call fcn.004423f0
add esp, 4
mov esi, eax
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esi + 8]
push ebx
push ecx
push edi
mov dword [esi], 1
mov dword [esi + 4], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
pop edi
ret

Function at 0x4436e0
Capabilities:
Create directory

Disassembly:
sub esp, 0xc
mov ecx, dword [esp + 0x14]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
lea eax, [esp]
mov dword [esp], 0xc
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
add esp, 0xc
ret
Function at 0x444090
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x4440ae
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x4440a3
pop esi
ret

Function at 0x4440b0
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x444142
mov eax, dword [esp + 0x10]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push esi
mov dword [esp + 0x10], ebx
jle 0x444134
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x44412c
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x4440f5
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret

Function at 0x4502b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
test ecx, ecx
je 0x4502d8
push esi
mov esi, 1
mov edx, 0x10
sub esi, ecx
xor byte [ecx], 0x54
lea eax, [esi + ecx]
lea ecx, [ecx + 1]
sub edx, 1
jne 0x4502c5
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x450430
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x483014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x186a0
push 8
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x450471
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047724d
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
push eax
push 0x40
push 0x186a0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0047724d
mov esp, ebp
pop ebp
ret
Function at 0x450570
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call fcn.00450540
nop
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
call fcn.00450540
mov dword [ebp - 0x20], eax
mov dword [ebp - 8], 0
jmp 0x4505a6
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 4
jge 0x4505c5
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + edx*4]
push ecx
call fcn.00450540
nop
mov edx, dword [ebp - 8]
mov dword [ebp + edx*4 - 0x18], eax
jmp 0x45059d
mov dword [ebp - 0x1c], 0
mov dword [ebp - 8], 0
jmp 0x4505de
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x10
jge 0x450636
mov ecx, dword [ebp - 0x1c]
sub ecx, 0x61c88647
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x20]
shl edx, 4
add edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x1c]
xor edx, eax
mov ecx, dword [ebp - 0x20]
shr ecx, 5
add ecx, dword [ebp - 0x14]
xor edx, ecx
add edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov edx, dword [ebp - 4]
shl edx, 4
add edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x1c]
xor edx, eax
mov ecx, dword [ebp - 4]
shr ecx, 5
add ecx, dword [ebp - 0xc]
xor edx, ecx
add edx, dword [ebp - 0x20]
mov dword [ebp - 0x20], edx
jmp 0x4505d5
mov edx, dword [ebp - 4]
push edx
call fcn.00450540
nop
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov edx, dword [ebp - 0x20]
push edx
call fcn.00450540
nop
mov ecx, dword [ebp + 0x10]
mov dword [ecx + 4], eax
mov esp, ebp
pop ebp
ret