joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4077c4
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405764
xor eax, eax
push ebp
push 0x407884
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
lea eax, [ebp - 0xc]
push eax
push 3
call sub.kernel32.dll_GetUserDefaultUILanguage
movzx eax, ax
push eax
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.00405d0c
mov ecx, dword [ebp - 0x10]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00405e3c
mov eax, dword [ebx]
call fcn.0040768c
test al, al
jne 0x407861
mov word [ebp - 8], 0
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.00405d0c
mov ecx, dword [ebp - 0x14]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00405e3c
mov eax, dword [ebx]
call fcn.0040768c
test al, al
jne 0x407861
mov eax, ebx
call fcn.00405680
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40788b
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004056e0
lea eax, [ebp - 4]
call fcn.00405680
ret

Function at 0x407f08
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret

Function at 0x4149a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x4149f9
test eax, edx
je 0x4149fc
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x4149b7
movzx eax, word [eax]
sub eax, ecx
jmp 0x4149de
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x4149df
add ecx, 4
js 0x4149cf
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x4149dc
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x4149de
xor eax, eax
ret
test eax, eax
je 0x414a08
test edx, edx
jne 0x4149a8
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x416968
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x4169a1
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.004057d8
jmp 0x4169aa
mov eax, ebx
mov edx, esi
call fcn.00405954
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4169b4
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x4169d6
movzx eax, word [esp]
jmp 0x4169d8
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4176ac
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
dec ebp
cld

Function at 0x418e48
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.00405a44
mov ebp, eax
push ebp
push 0
push 0
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.00407ee8
mov edi, eax
cmp edi, 0x104
jbe 0x418def
mov eax, edi
add eax, eax
call fcn.00403bdc
mov esi, eax
jmp 0x418df1
mov esi, esp
push ebp
push esi
push edi
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.00407ee8
mov eax, esi
push eax
call sub.user32.dll_CharUpperW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x418e2c
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x418e16
mov eax, esp
cmp esi, eax
je 0x418e39
mov eax, esi
call fcn.00403bf8
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x418e74
cmp bl, 0
je 0x418e70
cmp bl, 0x41
jl 0x418e6b
cmp bl, 0x5a
jg 0x418e6b
or bl, 0x20
xor al, bl
inc esi
jmp 0x418e4f
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x418db0

Function at 0x419068
Capabilities:
Get geographical location

Disassembly:
push ebx
add esp, 0xfffff800
mov ebx, ecx
mov word [esp], 0
push 0x400
lea ecx, [esp + 4]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
mov eax, ebx
mov edx, esp
mov ecx, 0x400
call fcn.00405d0c
add esp, 0x800
pop ebx
ret

Function at 0x41a380
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push eax
push 0xffffffffffffffff
push 1
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41a3ce
xor eax, eax
push ebp
push 0x41a3c7
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_TerminateProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41a3ce
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
pop ecx
pop ebp
ret
Function at 0x4041f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x474cd0], 0
jne 0x40420f
cmp dword [0x474cd4], 0
jne 0x40420f
mov eax, 1
jmp 0x4042a0
push 0
push 0
push 1
push 0
call dword [0x47cd4c]
mov dword [0x47b2a8], eax
cmp dword [0x47b2a8], 0
je 0x40429e
push 0
push 0
push 1
push 0
call dword [0x47cd4c]
mov dword [0x47b2ac], eax
cmp dword [0x47b2ac], 0
je 0x404287
push 0
push 0
push 0
push 0x404320
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x47b2a4], eax
cmp dword [0x47b2a4], 0
je 0x404271
mov eax, 1
jmp 0x4042a0
mov eax, dword [0x47b2ac]
push eax
call dword [0x47cd34]
mov dword [0x47b2ac], 0
mov ecx, dword [0x47b2a8]
push ecx
call dword [0x47cd34]
mov dword [0x47b2a8], 0
xor eax, eax
pop ebp
ret
Function at 0x405750
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push edi
cmp dword [0x47cb2c], 0
jne 0x405769
xor eax, eax
xor edx, edx
jmp 0x40594f
lea eax, [ebp + 0x14]
mov dword [ebp - 0x1c], eax
cmp dword [ebp + 0x10], 0
jle 0x405798
mov ecx, dword [ebp + 0x10]
sub ecx, 1
mov dword [ebp + 0x10], ecx
mov edx, dword [ebp - 0x1c]
add edx, 8
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax - 8]
mov dword [ebp - 0x50], ecx
mov edx, dword [eax - 4]
mov dword [ebp - 0x4c], edx
jmp 0x4057a6
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x34], ecx
cmp dword [ebp + 0x10], 0
jle 0x4057db
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
mov eax, dword [ebp - 0x1c]
add eax, 8
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx - 8]
mov dword [ebp - 0x58], edx
mov eax, dword [ecx - 4]
mov dword [ebp - 0x54], eax
jmp 0x4057e9
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0
mov ecx, dword [ebp - 0x58]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x54]
mov dword [ebp - 0xc], edx
cmp dword [ebp + 0x10], 0
jle 0x40581e
mov eax, dword [ebp + 0x10]
sub eax, 1
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 8
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx - 8]
mov dword [ebp - 0x60], eax
mov ecx, dword [edx - 4]
mov dword [ebp - 0x5c], ecx
jmp 0x40582c
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0
mov edx, dword [ebp - 0x60]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x24], eax
cmp dword [ebp + 0x10], 0
jle 0x405861
mov ecx, dword [ebp + 0x10]
sub ecx, 1
mov dword [ebp + 0x10], ecx
mov edx, dword [ebp - 0x1c]
add edx, 8
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax - 8]
mov dword [ebp - 0x68], ecx
mov edx, dword [eax - 4]
mov dword [ebp - 0x64], edx
jmp 0x40586f
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 0
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x64]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x1c]
add edx, 8
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
sub eax, 8
xor ecx, ecx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp + 0x10]
cdq
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x48], 0
xor edx, edx
mov word [ebp - 0x44], dx
mov word [ebp - 0x44], fs
mov eax, 0x2b
mov fs, ax
mov dword [ebp - 0x48], esp
and esp, 0xfffffff0
push 0x33
call 0x4058d0
add dword [esp], 5
retf
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x405960
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
cmp dword [ebp + 8], 0
je 0x405980
cmp dword [ebp + 0xc], 0
jne 0x40597a
cmp dword [ebp + 0x10], 0
je 0x405980
cmp dword [ebp + 0x14], 0
jne 0x405982
jmp 0x4059d5
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 4], ecx
push 0x33
call fcn.00405995
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4059e0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
cmp dword [ebp + 8], 0
je 0x405a00
cmp dword [ebp + 0xc], 0
jne 0x4059fa
cmp dword [ebp + 0x10], 0
je 0x405a00
cmp dword [ebp + 0x14], 0
jne 0x405a04
xor al, al
jmp 0x405a68
mov byte [ebp - 9], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 4], ecx
push 0x33
call fcn.00405a1b
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x405a70
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 0x33
call fcn.00405a8b
Function at 0x40b860
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc30
xor eax, eax
mov word [ebp - 0x208], ax
push 0x206
push 0
lea ecx, [ebp - 0x206]
push ecx
call fcn.00423520
add esp, 0xc
push 0x104
lea edx, [ebp - 0x208]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x40ba22
xor eax, eax
mov word [ebp - 0x410], ax
push 0x206
push 0
lea ecx, [ebp - 0x40e]
push ecx
call fcn.00423520
add esp, 0xc
push 0x104
lea edx, [ebp - 0x410]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jbe 0x40ba22
xor eax, eax
mov word [ebp - 0x618], ax
push 0x206
push 0
lea ecx, [ebp - 0x616]
push ecx
call fcn.00423520
add esp, 0xc
push 0x104
lea edx, [ebp - 0x618]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jbe 0x40ba22
xor eax, eax
mov word [ebp - 0x820], ax
push 0x206
push 0
lea ecx, [ebp - 0x81e]
push ecx
call fcn.00423520
add esp, 0xc
lea edx, [ebp - 0x410]
push edx
push 0x43345c
push 0x104
lea eax, [ebp - 0x820]
push eax
call fcn.0042359a
add esp, 0x10
xor ecx, ecx
mov word [ebp - 0xc30], cx
push 0x206
push 0
lea edx, [ebp - 0xc2e]
push edx
call fcn.00423520
add esp, 0xc
lea eax, [ebp - 0x618]
push eax
push 0x43347c
push 0x104
lea ecx, [ebp - 0xc30]
push ecx
call fcn.0042359a
add esp, 0x10
xor edx, edx
mov word [ebp - 0xa28], dx
push 0x206
push 0
lea eax, [ebp - 0xa26]
push eax
call fcn.00423520
add esp, 0xc
lea ecx, [ebp - 0x618]
push ecx
push 0x43349c
push 0x104
lea edx, [ebp - 0xa28]
push edx
call fcn.0042359a
add esp, 0x10
lea eax, [ebp - 0x820]
push eax
lea ecx, [ebp - 0x208]
push ecx
call dword [0x47d0e0]
test eax, eax
je 0x40ba1b
lea edx, [ebp - 0xc30]
push edx
lea eax, [ebp - 0x208]
push eax
call dword [0x47d0e0]
test eax, eax
je 0x40ba1b
lea ecx, [ebp - 0xa28]
push ecx
lea edx, [ebp - 0x208]
push edx
call dword [0x47d0e0]
test eax, eax
jne 0x40ba22
mov eax, 1
jmp 0x40ba24
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x40bb80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0xfffe
push 0x40
call dword [0x47cd3c]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40bc6b
push 0xfffe
push 0x40
call dword [0x47cd3c]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40bc61
push 0xfffe
push 0x40
call dword [0x47cd3c]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40bc57
push 0x7fff
mov eax, dword [ebp - 4]
push eax
push 0
call dword [0x47cd54]
test eax, eax
je 0x40bc4d
push 0x7fff
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x40bc4d
mov edx, dword [ebp - 8]
push edx
push str._sexplorer.exe
push 0x7fff
mov eax, dword [ebp - 0xc]
push eax
call fcn.0042359a
add esp, 0x10
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40bc4d
mov eax, dword [ebp - 4]
push eax
call dword [0x47cd48]
mov ecx, dword [ebp - 8]
push ecx
call dword [0x47cd48]
mov edx, dword [ebp - 0xc]
push edx
call dword [0x47cd48]
mov eax, 1
jmp 0x40bc6d
mov eax, dword [ebp - 0xc]
push eax
call dword [0x47cd48]
mov ecx, dword [ebp - 8]
push ecx
call dword [0x47cd48]
mov edx, dword [ebp - 4]
push edx
call dword [0x47cd48]
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x40bc80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0xfffe
push 0x40
call dword [0x47cd3c]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40bd6b
push 0xfffe
push 0x40
call dword [0x47cd3c]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40bd61
push 0xfffe
push 0x40
call dword [0x47cd3c]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40bd57
push 0x7fff
mov eax, dword [ebp - 4]
push eax
push 0
call dword [0x47cd54]
test eax, eax
je 0x40bd4d
push 0x7fff
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x40bd4d
mov edx, dword [ebp - 8]
push edx
push str._s_svchost.exe
push 0x7fff
mov eax, dword [ebp - 0xc]
push eax
call fcn.0042359a
add esp, 0x10
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40bd4d
mov eax, dword [ebp - 4]
push eax
call dword [0x47cd48]
mov ecx, dword [ebp - 8]
push ecx
call dword [0x47cd48]
mov edx, dword [ebp - 0xc]
push edx
call dword [0x47cd48]
mov eax, 1
jmp 0x40bd6d
mov eax, dword [ebp - 0xc]
push eax
call dword [0x47cd48]
mov ecx, dword [ebp - 8]
push ecx
call dword [0x47cd48]
mov edx, dword [ebp - 4]
push edx
call dword [0x47cd48]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x40bd80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0xfffe
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40be6b
push 0xfffe
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40be61
push 0xfffe
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40be57
push 0x7fff
mov eax, dword [ebp - 4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x40be4d
push 0x7fff
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x40be4d
mov edx, dword [ebp - 8]
push edx
push str._scmd.exe
push 0x7fff
mov eax, dword [ebp - 0xc]
push eax
call fcn.0042359a
add esp, 0x10
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40be4d
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, 1
jmp 0x40be6d
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x40fad0
Capabilities:
Create directory
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov dword [ebp - 0x10], 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040fe20
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40fce9
push 0
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, 1
je 0x40fb1f
call dword [0x47cd9c]
cmp eax, 0xb7
jne 0x40fcd9
push 0xfffe
push 0x40
call dword [0x47cd3c]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x40fcd9
mov eax, dword [ebp + 8]
add eax, 0x270
push eax
mov ecx, dword [ebp - 0xc]
push ecx
push 0x433d44
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x224], 0
push 0x104
lea eax, [ebp - 0x220]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x40fcc9
lea ecx, [ebp - 0x224]
push ecx
lea edx, [ebp - 0x220]
push edx
call fcn.0041c570
add esp, 8
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 0
je 0x40fcc9
mov dword [ebp - 0x22c], 0xffffffff
push 0
push 0x80
push 1
push 0
push 0
push 0xc0000000
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x22c], eax
call dword [0x47cd9c]
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x22c], 0xffffffff
jne 0x40fbff
cmp dword [ebp - 0x230], 0x50
jne 0x40fcb3
cmp dword [ebp - 0x230], 0x50
jne 0x40fc0c
jmp 0x40fc6b
push 0
lea ecx, [ebp - 0x234]
push ecx
mov edx, dword [ebp - 0x224]
push edx
mov eax, dword [ebp - 0x228]
push eax
mov ecx, dword [ebp - 0x22c]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0x234]
cmp edx, dword [ebp - 0x224]
jne 0x40fc93
mov eax, dword [ebp - 0x22c]
push eax
call dword [0x47cd34]
mov dword [ebp - 0x22c], 0xffffffff
cmp dword [ebp - 0x22c], 0xffffffff
je 0x40fc6b
mov ecx, dword [ebp - 0x22c]
push ecx
call dword [0x47cd34]
mov edx, dword [ebp - 0x228]
push edx
call dword [0x47cd48]
mov eax, dword [ebp - 0x14]
push eax
call dword [0x47cd48]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [0x47cd48]
mov eax, 1
jmp 0x40fceb
cmp dword [ebp - 0x22c], 0xffffffff
je 0x40fca9
mov edx, dword [ebp - 0x22c]
push edx
call dword [0x47cd34]
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x228], 0
je 0x40fcc9
mov ecx, dword [ebp - 0x228]
push ecx
call dword [0x47cd48]
cmp dword [ebp - 0x14], 0
je 0x40fcd9
mov edx, dword [ebp - 0x14]
push edx
call dword [0x47cd48]
cmp dword [ebp - 0xc], 0
je 0x40fce9
mov eax, dword [ebp - 0xc]
push eax
call dword [0x47cd48]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x40ff10
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x437c00
call dword [0x47d0fc]
test eax, eax
jne 0x40ffff
push 0xfffe
push 0x40
call dword [0x47cd3c]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40fff5
mov ecx, dword [ebp + 8]
add ecx, 0x6072
push ecx
mov edx, dword [ebp - 4]
push edx
push 0x433d60
push 0x7fff
mov eax, dword [ebp - 8]
push eax
call dword [0x47d0e8]
add esp, 0x14
test eax, eax
jle 0x40ffeb
call fcn.00410400
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40ffeb
mov dword [ebp - 0x18], 0xc
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], 0
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, 1
je 0x40ffb6
call dword [0x47cd9c]
cmp eax, 0xb7
jne 0x40ffdb
mov ecx, dword [ebp - 0xc]
push ecx
call dword [0x47cd48]
mov edx, dword [ebp - 8]
push edx
call dword [0x47cd48]
mov eax, dword [ebp - 4]
push eax
call dword [0x47d118]
mov eax, 1
jmp 0x410001
cmp dword [ebp - 0xc], 0
je 0x40ffeb
mov ecx, dword [ebp - 0xc]
push ecx
call dword [0x47cd48]
mov edx, dword [ebp - 8]
push edx
call dword [0x47cd48]
mov eax, dword [ebp - 4]
push eax
call dword [0x47d118]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x412560
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 4]
push eax
push 0x471178
call fcn.0040fe20
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x41266e
push 0xfffe
push 0x40
call dword [0x47cd3c]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x412664
push str.DD61E7CE_22B3_45B0_BF2C_62B2AE0B679B
push str.nov.exe
mov ecx, dword [ebp - 8]
push ecx
push str._s_s__s
push 0x7fff
mov edx, dword [ebp - 0xc]
push edx
call dword [0x47d0e8]
add esp, 0x18
mov dword [ebp - 0x14], eax
cmp dword [0x472e2c], 1
jne 0x412610
lea eax, [ebp - 0x10]
push eax
push 0x433fa0
push SysReAllocString
call dword [0x47d014]
test eax, eax
jne 0x412610
mov ecx, dword [ebp - 0x14]
lea edx, [ecx + ecx + 2]
push edx
mov eax, dword [ebp - 0xc]
push eax
push 1
push 0
push 0x476fc8
mov ecx, dword [ebp - 0x10]
push ecx
call dword [0x47d010]
mov edx, dword [ebp - 0x10]
push edx
call dword [0x47d018]
cmp dword [0x472e28], 1
jne 0x41265a
lea eax, [ebp - 0x10]
push eax
push 0x434008
push reloc.OLEAUT32.dll_SysReAllocString
call dword [0x47d014]
test eax, eax
jne 0x41265a
mov ecx, dword [ebp - 0x14]
lea edx, [ecx + ecx + 2]
push edx
mov eax, dword [ebp - 0xc]
push eax
push 1
push 0
push 0x477016
mov ecx, dword [ebp - 0x10]
push ecx
call dword [0x47d010]
mov edx, dword [ebp - 0x10]
push edx
call dword [0x47d018]
mov eax, dword [ebp - 0xc]
push eax
call dword [0x47cd48]
mov ecx, dword [ebp - 8]
push ecx
call dword [0x47cd48]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x413160
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [0x472e34], 1
jne 0x41329d
push 0xfffe
push 0x40
call dword [0x47cd3c]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4131dd
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0x437bf0
call dword [0x47d0fc]
test eax, eax
jne 0x4131d3
push str.EB17DC72_465F_48EE_8243_8049BA9843AD
mov ecx, dword [ebp - 0xc]
push ecx
push str._s_s.lnk
push 0x7fff
mov edx, dword [ebp - 4]
push edx
call fcn.0042359a
add esp, 0x14
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [0x47d118]
mov edx, dword [ebp - 4]
push edx
call dword [0x47cd48]
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x437c00
call dword [0x47d0fc]
test eax, eax
jne 0x41329d
push 0xfffe
push 0x40
call dword [0x47cd3c]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x413293
push str.AADB095A_67FB_49F0_83A8_26FF77FF389A
mov ecx, dword [ebp - 8]
push ecx
push 0x434184
push 0x7fff
mov edx, dword [ebp - 0x10]
push edx
call fcn.0042359a
add esp, 0x14
push 0xfffe
push 0x40
call dword [0x47cd3c]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x413289
push str.FCEC8604_2912_4B73_AC18_9F3C65152ADD
push str.AADB095A_67FB_49F0_83A8_26FF77FF389A
mov eax, dword [ebp - 8]
push eax
push str._s_s_s.BAT
push 0x7fff
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.0042359a
add esp, 0x18
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [0x47cd48]
mov edx, dword [ebp - 0x10]
push edx
call dword [0x47cd48]
mov eax, dword [ebp - 8]
push eax
call dword [0x47d118]
mov eax, 1
mov esp, ebp
pop ebp
ret