joyce8/EMBER2024-capa huggingface dataset:
Function at 0x455138
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x475be8]
cmp dword [eax + 0x30], 0
je 0x4551e2
cmp dword [ebx + 0x94], 0
jne 0x4551dc
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4550c8
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4551dc
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x4551a2
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4551dc
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.004153f8
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4551b1
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x455d40
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x455d75
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404a5c
jmp 0x455d82
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004049c0
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x456eac
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x456eed
mov eax, esi
call fcn.0043d568
test al, al
je 0x456eed
mov eax, dword [ebx + 0x84]
call fcn.0043d264
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x456eed
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043d264
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x464f50
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x464f58
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x46514a
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x465160
mov eax, esi
call fcn.00462ddc
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.004049c0
lea ecx, [ebp - 0x10]
mov edx, 0x465174
mov eax, esi
call fcn.00462ddc
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.004049c0
lea ecx, [ebp - 0x14]
mov edx, 0x46518c
mov eax, esi
call fcn.00462ddc
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.004049c0
lea ecx, [ebp - 0x18]
mov edx, 0x4651a8
mov eax, esi
call fcn.00462ddc
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.004049c0
lea ecx, [ebp - 0x1c]
mov edx, 0x4651c4
mov eax, esi
call fcn.00462ddc
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.004049c0
lea ecx, [ebp - 0x24]
mov edx, 0x4651dc
mov eax, esi
call fcn.00462ddc
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00408a1c
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.00408e10
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x4651f4
mov eax, esi
call fcn.00462ddc
mov eax, dword [ebp - 0x28]
call fcn.0045cd54
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x465204
mov eax, esi
call fcn.00462ddc
mov eax, dword [ebp - 0x2c]
call fcn.0045cd54
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x46521c
mov eax, esi
call fcn.00462ddc
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.00408e10
inc eax
je 0x4650ed
lea ecx, [ebp - 0x34]
mov edx, 0x46521c
mov eax, esi
call fcn.00462ddc
mov eax, dword [ebp - 0x34]
call fcn.00408dd4
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040a6e4
fstp qword [ebp - 0x3c]
wait
call fcn.0040aa54
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x465108
lea ecx, [ebp - 0x40]
mov edx, 0x46521c
mov eax, esi
call fcn.00462ddc
mov eax, dword [ebp - 0x40]
call fcn.0045cd54
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x46522c
mov eax, esi
call fcn.00462ddc
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.004049c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x465151
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.00404990
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.00404990
ret
Function at 0x46c37c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x46c3d6
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.0046c36c
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.0045b9c0
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.0045b5c0
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46c3dd
lea eax, [ebp - 4]
call fcn.0040496c
ret

Function at 0x4706ac
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe20
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x1e0], eax
mov dword [ebp - 0x1dc], eax
mov dword [ebp - 0x1d4], eax
mov dword [ebp - 0x1d8], eax
mov dword [ebp - 0x1d0], eax
xor eax, eax
push ebp
push 0x47081c
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x47079e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1d0]
mov ecx, 0x470834
mov edx, dword [0x4745d8]
call fcn.00404c78
mov edx, dword [ebp - 0x1d0]
lea eax, [ebp - 0x1cc]
call fcn.004031d0
lea eax, [ebp - 0x1cc]
call fcn.00402f6c
mov edx, 0x470844
lea eax, [ebp - 0x1cc]
call fcn.00405048
call fcn.00403608
push 0x470868
lea edx, [ebp - 0x1d8]
xor eax, eax
call fcn.00402e4c
push dword [ebp - 0x1d8]
push 0x470878
lea eax, [ebp - 0x1d4]
mov edx, 3
call fcn.00404cec
mov edx, dword [ebp - 0x1d4]
lea eax, [ebp - 0x1cc]
call fcn.00405048
call fcn.00403608
lea eax, [ebp - 0x1cc]
call fcn.00403280
lea eax, [ebp - 0x1cc]
call fcn.00403298
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4707a8
lea eax, [ebp - 0x1dc]
mov ecx, 0x470834
mov edx, dword [0x4745d8]
call fcn.00404c78
mov eax, dword [ebp - 0x1dc]
call fcn.00409180
test al, al
je 0x4707fe
push 0
push 0
push 0
lea eax, [ebp - 0x1e0]
mov ecx, 0x470834
mov edx, dword [0x4745d8]
call fcn.00404c78
mov eax, dword [ebp - 0x1e0]
call fcn.00404e2c
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x470823
lea eax, [ebp - 0x1e0]
mov edx, 5
call fcn.00404990
ret
Function at 0x4710d8
Capabilities:
Create process on windows
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x4710e0
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x47128d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
mov ecx, dword [0x4745e0]
mov edx, dword [0x4745d8]
call fcn.00404c78
mov eax, dword [ebp - 0xc]
call fcn.00409190
mov eax, 0x64
call fcn.0047087c
xor edx, edx
push ebp
push 0x471264
push dword fs:[edx]
mov dword fs:[edx], esp
push 0xffff
lea eax, [ebp - 0x10]
mov ecx, dword [0x4745e0]
mov edx, dword [0x4745d8]
call fcn.00404c78
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x4135c8]
call fcn.00418030
mov esi, eax
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x18]
mov eax, dword [0x4745e0]
call fcn.0040929c
mov eax, dword [ebp - 0x18]
mov ecx, 0x2710
mov edx, 2
call fcn.00404e8c
mov eax, dword [ebp - 0x14]
call fcn.00404e2c
push eax
lea eax, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x20]
mov eax, dword [0x4745e0]
call fcn.0040929c
mov eax, dword [ebp - 0x20]
call fcn.00404c2c
push eax
mov eax, dword [0x4745e0]
call fcn.00404c2c
mov ecx, eax
pop eax
sub ecx, eax
mov edx, 1
mov eax, dword [0x4745e0]
call fcn.00404e8c
mov eax, dword [ebp - 0x1c]
call fcn.00404e2c
push eax
mov eax, dword [0x475664]
push eax
call sub.KERNEL32.DLL_FindResourceA
push eax
mov eax, dword [0x475664]
push eax
call sub.KERNEL32.DLL_LoadResource
mov ebx, eax
test ebx, ebx
jne 0x4711ee
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x471272
push ebx
call sub.KERNEL32.DLL_LockResource
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
mov ecx, dword [0x4745e4]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x10]
mov eax, esi
call fcn.00403b5c
mov eax, ebx
call fcn.00407540
push ebx
call sub.KERNEL32.DLL_FreeResource
mov eax, 0x3e8
call fcn.0047087c
push 5
push 0
mov eax, dword [0x4745e8]
call fcn.00404e2c
push eax
lea eax, [ebp - 0x24]
mov ecx, dword [0x4745e0]
mov edx, dword [0x4745d8]
call fcn.00404c78
mov eax, dword [ebp - 0x24]
call fcn.00404e2c
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47126e
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x471294
lea eax, [ebp - 0x24]
mov edx, 7
call fcn.00404990
ret
Function at 0x401460
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push esi
mov esi, dword [ebp + 0xc]
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push esi
push dword [ebp + 8]
call sub.KERNEL32.DLL_WriteFile
and eax, eax
je 0x401486
cmp dword [ebp - 4], 0
jne 0x40148d
sub eax, eax
pop esi
leave
ret 0xc
mov eax, dword [ebp - 4]
add esi, eax
sub dword [ebp + 0x10], eax
jne 0x40146a
mov eax, 1
pop esi
leave
ret 0xc

Function at 0x4019e8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
push dword [ebp + 8]
pop ebx
mov al, byte [ebx]
mov byte [ebp - 3], al
mov al, byte [ebx + 1]
mov byte [ebp - 4], al
mov edi, ebx
inc edi
inc edi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], 0
mov ecx, dword [ebp + 0x10]
jecxz 0x401a53
inc byte [ebp - 3]
movzx eax, byte [ebp - 3]
movzx edx, byte [eax + edi]
mov byte [ebp - 1], dl
add byte [ebp - 4], dl
movzx eax, byte [ebp - 4]
mov dl, byte [eax + edi]
mov byte [ebp - 2], dl
movzx eax, byte [ebp - 3]
mov byte [eax + edi], dl
movzx eax, byte [ebp - 4]
mov dl, byte [ebp - 1]
mov byte [eax + edi], dl
mov dl, byte [ebp - 1]
add dl, byte [ebp - 2]
mov dl, byte [edx + edi]
mov eax, dword [ebp - 8]
xor byte [eax + esi], dl
inc dword [ebp - 8]
loop 0x401a13
mov al, byte [ebp - 3]
mov byte [ebx], al
mov al, byte [ebp - 4]
mov byte [ebx + 1], al
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x401ccb
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push edi
mov eax, dword [ebp + 0x14]
and eax, eax
je 0x401cdf
mov dword [eax], 0
sub edi, edi
cmp dword [ebp + 0x18], 1
jne 0x401cee
mov edx, 0x200
jmp 0x401cfd
cmp dword [ebp + 0x18], 2
jne 0x401cfb
mov edx, 0x100
jmp 0x401cfd
sub edx, edx
or edx, 0x20019
lea eax, [ebp - 4]
push eax
push edx
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegOpenKeyExA
or eax, eax
jne 0x401d88
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA
and eax, eax
jne 0x401d80
cmp dword [ebp - 8], 0
je 0x401d80
cmp dword [ebp - 0xc], 1
jne 0x401d46
cmp dword [ebp - 8], 1
je 0x401d80
mov eax, dword [ebp - 8]
inc eax
push eax
call fcn.0040190d
mov edi, eax
lea eax, [ebp - 8]
push eax
push edi
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA
and eax, eax
je 0x401d74
push edi
call fcn.004018f6
sub edi, edi
jmp 0x401d80
mov eax, dword [ebp + 0x14]
and eax, eax
je 0x401d80
push dword [ebp - 8]
pop dword [eax]
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
mov eax, edi
and eax, eax
jne 0x401daa
cmp dword [ebp + 0x18], 2
jae 0x401daa
mov eax, dword [ebp + 0x18]
inc eax
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401ccb
pop edi
leave
ret 0x14
Function at 0x401e04
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov eax, dword [ebp + 8]
not eax
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
or ecx, ecx
je 0x401e2f
mov edx, eax
shr edx, 8
xor al, byte [edi]
and eax, 0xff
mov eax, dword [eax*4 + 0x41ae90]
xor eax, edx
inc edi
loop 0x401e17
not eax
pop edi
leave
ret 0xc

Function at 0x401fbd
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and eax, eax
je 0x401fcc
cmp byte [eax], 0
jne 0x401fd5
mov eax, 0
leave
ret 4
push dword [ebp + 8]
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
je 0x401fef
test eax, 0x10
setne al
movzx eax, al
jmp 0x401ff4
mov eax, 0
leave
ret 4

Function at 0x401ff8
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push 0
push 0
push dword [ebp + 8]
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
and eax, eax
je 0x402038
push eax
push eax
call fcn.0040190d
mov dword [ebp - 4], eax
pop eax
push eax
push dword [ebp - 4]
push dword [ebp + 8]
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
and eax, eax
jne 0x402035
push dword [ebp - 4]
call fcn.004018f6
sub eax, eax
jmp 0x402038
mov eax, dword [ebp - 4]
leave
ret 4

Function at 0x40203c
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push 0x10
push ebx
call fcn.00401924
push 0
push 0
push 3
push 0
push 3
push 0x80000000
push dword [ebp + 8]
call sub.KERNEL32.DLL_CreateFileA
mov dword [ebx], eax
inc eax
je 0x4020c4
dec eax
push 0
push eax
call sub.KERNEL32.DLL_GetFileSize
mov dword [ebx + 0xc], eax
push 0
push 0
push 0
push 2
push 0
push dword [ebx]
call sub.KERNEL32.DLL_CreateFileMappingA
and eax, eax
je 0x4020b7
mov dword [ebx + 4], eax
push 0
push 0
push 0
push 4
push eax
call sub.KERNEL32.DLL_MapViewOfFile
mov dword [ebx + 8], eax
and eax, eax
jne 0x4020b5
push dword [ebx + 4]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebx]
call sub.KERNEL32.DLL_CloseHandle
mov dword [ebx], 0xffffffff
jmp 0x4020c4
push dword [ebx]
call sub.KERNEL32.DLL_CloseHandle
mov dword [ebx], 0xffffffff
sub eax, eax
cmp dword [ebx + 8], eax
setne al
pop ebx
leave
ret 8
Function at 0x40272c
Capabilities:
Create directory
Delete file
Get common file path
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
sub ebx, ebx
lea eax, [ebp - 4]
push eax
push str.SoftwareWinRAR
push dword [0x416169]
call sub.advapi32.dll_RegCreateKeyA
or eax, eax
jne 0x402772
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 3
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegSetValueExA
or eax, eax
jne 0x40276a
inc ebx
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
and ebx, ebx
jne 0x40283f
lea eax, [ebp - 0x10d]
push eax
push 0x104
call sub.KERNEL32.DLL_GetTempPathA
and eax, eax
je 0x40283f
cmp eax, 0x104
ja 0x40283f
push 0
lea eax, [ebp - 0x10d]
push eax
call sub.KERNEL32.DLL_CreateDirectoryA
lea eax, [ebp - 0x10d]
push eax
call fcn.004025f8
and eax, eax
jne 0x4027d8
push 0x416141
lea eax, [ebp - 0x10d]
push eax
call fcn.00401e36
push dword [ebp + 8]
push eax
call fcn.00401e8a
jmp 0x4027e7
push dword [ebp + 8]
lea eax, [ebp - 0x10d]
push eax
call fcn.00401e36
mov dword [ebp - 0x114], eax
push 0
push 0
push 2
push 0
push 3
push 0xc0000000
push dword [ebp - 0x114]
call sub.KERNEL32.DLL_CreateFileA
mov dword [ebp - 8], eax
inc eax
je 0x402825
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 8]
call fcn.00401460
mov ebx, eax
push dword [ebp - 8]
call sub.KERNEL32.DLL_CloseHandle
and ebx, ebx
jne 0x402834
push dword [ebp - 0x114]
call sub.KERNEL32.DLL_DeleteFileA
push dword [ebp - 0x114]
call fcn.004018f6
mov eax, ebx
pop ebx
leave
ret 0xc

Function at 0x402846
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.SoftwareWinRAR
push dword [0x416169]
call fcn.00401daf
and eax, eax
jne 0x402948
sub ebx, ebx
lea eax, [ebp - 0x111]
push eax
push 0x104
call sub.KERNEL32.DLL_GetTempPathA
and eax, eax
je 0x402946
cmp eax, 0x104
ja 0x402946
lea eax, [ebp - 4]
push eax
call fcn.00401000
lea eax, [ebp - 0x111]
push eax
call fcn.004025f8
and eax, eax
jne 0x4028c9
push 0x416141
lea eax, [ebp - 0x111]
push eax
call fcn.00401e36
push dword [ebp + 8]
push eax
call fcn.00401e8a
jmp 0x4028d8
push dword [ebp + 8]
lea eax, [ebp - 0x111]
push eax
call fcn.00401e36
push eax
push dword [ebp - 4]
push eax
call fcn.00401230
and eax, eax
je 0x402939
push dword [ebp - 4]
call fcn.00401091
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x402939
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call sub.ole32.dll_GetHGlobalFromStream
test eax, eax
js 0x402939
push dword [ebp - 0xc]
call sub.KERNEL32.DLL_GlobalLock
and eax, eax
je 0x402939
push eax
push dword [ebp - 8]
call fcn.0040190d
mov ebx, eax
pop eax
push dword [ebp - 8]
push ebx
push eax
call fcn.00401944
push dword [ebp - 0xc]
call sub.KERNEL32.DLL_GlobalUnlock
mov eax, dword [ebp + 0xc]
push dword [ebp - 8]
pop dword [eax]
call fcn.004018f6
push dword [ebp - 4]
call fcn.00401026
mov eax, ebx
pop ebx
leave
ret 8
Function at 0x402d40
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec0
push ebx
xor edx, eax
xor eax, edx
xor edx, eax
push 0x402d5d
nop
clc
nop
jb 0x402d5c
nop
ret
inc byte [ebx + 0x41643c3d]
add byte [eax], al
je 0x402d81
cmp dword [0x416440], 0
je 0x402d81
cmp dword [0x416478], 0
je 0x402d81
cmp dword [0x41647c], 0
jne 0x402d88
sub eax, eax
pop ebx
leave
ret 4
sub ebx, ebx
call dword [0x41643c]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x134], 0x128
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
cmp eax, 0xffffffff
je 0x402edd
mov dword [ebp - 0x138], eax
lea eax, [ebp - 0x134]
push eax
push dword [ebp - 0x138]
call sub.KERNEL32.DLL_Process32First
and eax, eax
je 0x402ed2
push str.explorer.exe
lea eax, [ebp - 0x110]
push eax
call sub.shlwapi.dll_StrStrIA
and eax, eax
je 0x402ebb
mov dword [ebp - 0x13c], 0
lea eax, [ebp - 0x13c]
push eax
push dword [ebp - 0x12c]
call dword [0x416440]
mov edx, dword [ebp - 0x13c]
and eax, eax
je 0x402ebb
cmp edx, dword [ebp - 0xc]
jne 0x402ebb
push dword [ebp - 0x12c]
push 0
push 0x2000000
call sub.KERNEL32.DLL_OpenProcess
and eax, eax
je 0x402ebb
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 0x201eb
push dword [ebp - 8]
call dword [0x416478]
and eax, eax
je 0x402eb3
push dword [ebp - 4]
call dword [0x41647c]
and eax, eax
je 0x402ea1
inc ebx
mov dword [ebp - 0x140], 0
lea eax, [ebp - 0x140]
push eax
push 0xf003f
call sub.advapi32.dll_RegOpenCurrentUser
or eax, eax
jne 0x402e91
cmp dword [ebp - 0x140], 0
je 0x402e91
push dword [ebp - 0x140]
pop dword [0x416169]
mov eax, dword [ebp + 8]
and eax, eax
je 0x402e9d
push dword [ebp - 4]
pop dword [eax]
jmp 0x402ed2
push dword [ebp - 4]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 8]
call sub.KERNEL32.DLL_CloseHandle
jmp 0x402ebb
push dword [ebp - 8]
call sub.KERNEL32.DLL_CloseHandle
lea eax, [ebp - 0x134]
push eax
push dword [ebp - 0x138]
call sub.KERNEL32.DLL_Process32Next
jmp 0x402dc7
push dword [ebp - 0x138]
call sub.KERNEL32.DLL_CloseHandle
mov eax, ebx
pop ebx
leave
ret 4

Function at 0x402ee4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
cmp dword [ebp + 8], 0
jne 0x402ef6
sub eax, eax
leave
ret 8
cmp dword [ebp + 0xc], 0
je 0x402f93
cmp dword [0x4164b4], 0
je 0x402f93
cmp dword [0x416494], 0
je 0x402f93
cmp dword [0x4164b8], 0
je 0x402f93
push 0x44
lea eax, [ebp - 0x44]
push eax
call fcn.00401924
push 0x10
lea eax, [ebp - 0x54]
push eax
call fcn.00401924
mov dword [ebp - 0x44], 0x44
mov dword [ebp - 0x58], 0
push 0
push dword [ebp + 0xc]
lea eax, [ebp - 0x58]
push eax
call dword [0x4164b4]
and eax, eax
je 0x402f8f
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x44]
push eax
push 0
push dword [ebp - 0x58]
push 0x400
push 0
push 0
push 0
push 0
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [0x416494]
push eax
push dword [ebp - 0x58]
call dword [0x4164b8]
pop eax
and eax, eax
jne 0x402f8d
jmp 0x402f93
jmp 0x402f91
jmp 0x402f93
jmp 0x402fa8
push 0xa
push 0
push 0
push dword [ebp + 8]
push str.open
push 0
call sub.shell32.dll_ShellExecuteA
leave
ret 8
Function at 0x403195
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push eax
push ebx
push ecx
push edx
push edi
push esi
mov eax, dword [ebp + 0xc]
lea ecx, [eax + 0x80]
lea edx, [eax*8]
mov ebx, eax
mov ecx, eax
shr eax, 6
mov dword [ebp - 0x14], eax
mov edi, dword [ebp + 8]
add edi, ecx
mov byte [edi], pe_nt_image_headers32
and ebx, 0x3f
sub edi, ebx
cmp ebx, 0x38
jb 0x4031db
add edi, ebx
mov eax, 0x40
sub eax, ebx
add edi, eax
inc dword [ebp - 0x14]
mov dword [edi + 0x38], edx
lea esi, [ebp - 0x10]
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
push dword [ebp - 0x14]
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.00403220
cld
mov ecx, 4
mov edi, dword [ebp + 0x10]
rep movsd dword es:[edi], dword [esi]
pop esi
pop edi
pop edx
pop ecx
pop ebx
pop eax
leave
ret 0xc

Function at 0x403833
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push edi
push esi
push ebx
mov dword [ebp - 4], 0
push dword [ebp + 0xc]
pop dword [ebp - 8]
mov dword [0x41b290], 0x67452301
mov dword [0x41b294], 0xefcdab89
mov dword [0x41b298], 0x98badcfe
mov dword [0x41b29c], 0x10325476
mov dword [0x41b2a0], 0xc3d2e1f0
jmp 0x403899
mov eax, dword [ebp + 8]
add eax, dword [ebp - 4]
push 0x40
push 0x41b2a4
push eax
call fcn.00401944
add dword [ebp - 4], 0x40
call fcn.00403965
sub dword [ebp - 8], 0x40
jae 0x40387d
mov ebx, dword [ebp - 8]
add ebx, 0x40
mov eax, dword [ebp + 8]
add eax, dword [ebp - 4]
push ebx
push 0x41b2a4
push eax
call fcn.00401944
add dword [ebp - 4], ebx
mov byte [ebx + 0x41b2a4], 0x80
sub ebx, 0x37
jbe 0x4038e1
sub ebx, 8
je 0x4038d5
and byte [ebx + 0x41b2e4], 0
inc ebx
js 0x4038cb
call fcn.00403965
mov ebx, 0xffffffc8
jmp 0x4038e3
je 0x4038ed
and byte [ebx + 0x41b2dc], 0
inc ebx
js 0x4038e3
mov eax, dword [ebp + 0xc]
mov ecx, 8
xor edx, edx
mul ecx
bswap eax
bswap edx
mov dword [0x41b2e0], eax
mov dword [0x41b2dc], edx
call fcn.00403965
mov eax, dword [0x41b290]
mov edx, dword [0x41b294]
mov ecx, dword [0x41b298]
bswap eax
bswap edx
bswap ecx
mov dword [0x41b290], eax
mov dword [0x41b294], edx
mov dword [0x41b298], ecx
mov eax, dword [0x41b29c]
mov edx, dword [0x41b2a0]
bswap eax
bswap edx
mov dword [0x41b29c], eax
mov dword [0x41b2a0], edx
push 0x14
push dword [ebp + 0x10]
push 0x41b290
call fcn.00401944
pop ebx
pop esi
pop edi
leave
ret 0xc