joyce8/EMBER2024-capa huggingface dataset:
Function at 0x21cef8
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe90
xor edx, edx
mov dword [ebp - 0x16c], edx
mov dword [ebp - 0x170], edx
mov dword [ebp - 0x168], edx
mov dword [ebp - 0x164], edx
mov dword [ebp - 0x160], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00104f6c
lea eax, [ebp - 0x15c]
mov edx, dword [0x108328]
call fcn.001054d4
xor eax, eax
push ebp
push 0x21d099
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x160]
mov ecx, 0x21d0ac
mov edx, dword [ebp - 4]
call fcn.00104dc8
mov eax, dword [ebp - 0x160]
lea ecx, [ebp - 0x15c]
mov edx, 0x3f
call fcn.00109d08
test eax, eax
jne 0x21d062
mov eax, dword [ebp - 0x150]
mov edx, 0x21d0b8
call fcn.00104ec8
je 0x21d04f
mov eax, dword [ebp - 0x150]
mov edx, 0x21d0c4
call fcn.00104ec8
je 0x21d04f
lea eax, [ebp - 0x164]
mov ecx, dword [ebp - 0x150]
mov edx, dword [ebp - 4]
call fcn.00104dc8
mov eax, dword [ebp - 0x164]
call fcn.00109b70
test al, al
je 0x21cffb
mov eax, dword [ebp + 8]
push eax
push dword [ebp - 4]
push dword [ebp - 0x150]
push 0x21d0d0
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.00104e3c
mov eax, dword [ebp - 0x168]
call fcn.0021cef8
pop ecx
jmp 0x21d04f
push 0
mov eax, dword [ebp + 8]
push dword [eax - 4]
push 0x21d0dc
push dword [ebp - 0x150]
lea eax, [ebp - 0x16c]
mov edx, 3
call fcn.00104e3c
mov eax, dword [ebp - 0x16c]
call fcn.00104f7c
push eax
lea eax, [ebp - 0x170]
mov ecx, dword [ebp - 0x150]
mov edx, dword [ebp - 4]
call fcn.00104dc8
mov eax, dword [ebp - 0x170]
call fcn.00104f7c
push eax
call sub.kernel32.dll_CopyFileA
lea eax, [ebp - 0x15c]
call fcn.00109d58
test eax, eax
je 0x21cf7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x21d0a0
lea eax, [ebp - 0x170]
mov edx, 5
call fcn.00104ac4
lea eax, [ebp - 0x15c]
mov edx, dword [0x108328]
call fcn.001055a4
lea eax, [ebp - 4]
call fcn.00104aa0
ret

Function at 0x220420
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00104f6c
xor eax, eax
push ebp
push 0x220480
push dword fs:[eax]
mov dword fs:[eax], esp
push pe_nt_image_headers32
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00104f7c
push eax
call sub.shell32.dll_SHGetFileInfoA
mov ebx, dword [ebp - 0x164]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x220487
lea eax, [ebp - 4]
call fcn.00104aa0
ret
Function at 0x223f40
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, eax
cmp byte [ebx + 0x22b], 2
jne 0x223f6a
push 9
mov eax, ebx
call fcn.0016d3b8
push eax
call sub.user32.dll_ShowWindow
mov byte [ebx + 0x640], 0
jmp 0x223fbd
mov byte [ebx + 0x640], 1
push 3
mov eax, ebx
call fcn.0016d3b8
push eax
call sub.user32.dll_ShowWindow
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push 0x30
call sub.user32.dll_SystemParametersInfoA
mov edx, dword [ebp - 0x10]
mov eax, ebx
call fcn.00166250
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.00166274
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.001662c0
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0x10]
mov eax, ebx
call fcn.0016629c
mov eax, ebx
call fcn.00224000
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x228c90
Capabilities:
Copy file
Create process on windows
Persist via lnk shortcut

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x228c98
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x228ee5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x1198dc]
call fcn.00103b78
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
call fcn.00217694
mov eax, dword [ebp + 8]
mov byte [eax - 9], 0
mov eax, dword [0x257274]
call fcn.0010a17c
xor eax, eax
push ebp
push 0x228ec3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [0x257274]
call fcn.00104fdc
mov eax, dword [ebp - 0x14]
mov edx, 0x228f00
call fcn.00104ec8
jne 0x228d29
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00239ab4
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x10]
mov ecx, 0x228f0c
call fcn.00104dc8
jmp 0x228d3c
lea eax, [ebp - 0x10]
mov ecx, 0x228f0c
mov edx, dword [0x257274]
call fcn.00104dc8
mov eax, dword [ebp - 0x10]
call fcn.00109b60
test al, al
je 0x228d52
xor edx, edx
mov eax, dword [ebp - 0x10]
call fcn.00109c7c
push 0
mov eax, dword [ebp - 0x10]
call fcn.00104f7c
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x10]
call fcn.00104f7c
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
je 0x228e95
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
call fcn.00109fe0
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x228f1c
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
xor eax, eax
push ebp
push 0x228e01
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x20]
mov ecx, 0x228f2c
mov edx, dword [0x257274]
call fcn.00104dc8
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x74]
push 0
lea eax, [ebp - 0x24]
mov ecx, 0x228f2c
mov edx, dword [0x257274]
call fcn.00104dc8
mov eax, dword [ebp - 0x24]
call fcn.00104f7c
push eax
call sub.kernel32.dll_WinExec
cmp eax, 0x1f
jbe 0x228df4
mov eax, dword [ebp + 8]
mov byte [eax - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x228e9c
mov eax, dword [ebp + 8]
mov byte [eax - 9], 0
mov eax, dword [ebp + 8]
mov al, byte [eax - 9]
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x228eca
mov eax, dword [ebp - 0xc]
call fcn.0010a17c
mov eax, dword [ebp - 8]
call fcn.00103ba8
ret
Function at 0x231d00
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00104f6c
xor eax, eax
push ebp
push 0x231d9a
push dword fs:[eax]
mov dword fs:[eax], esp
test bl, bl
je 0x231d55
push 1
push 0x231db0
push dword [ebp - 4]
push 0x231dcc
lea eax, [ebp - 8]
mov edx, 3
call fcn.00104e3c
mov eax, dword [ebp - 8]
call fcn.00104f7c
push eax
call sub.kernel32.dll_WinExec
jmp 0x231d7f
push 1
push 0x231dd8
push dword [ebp - 4]
push 0x231dcc
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00104e3c
mov eax, dword [ebp - 0xc]
call fcn.00104f7c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x231da1
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00104ac4
ret

Function at 0x235544
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x128], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x2356ab
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x11c]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
mov ebx, eax
mov dl, 1
mov eax, dword [0x13eccc]
call fcn.0013edcc
mov dword [ebp - 0x14], eax
mov edx, 0x80000002
mov eax, dword [ebp - 0x14]
call fcn.0013ee6c
dec ebx
test ebx, ebx
jl 0x23567b
inc ebx
mov dword [ebp - 0x18], ebx
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
call fcn.00172118
test al, al
je 0x23566e
xor eax, eax
push ebp
push 0x235664
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
mov dword [ebp - 0x124], eax
mov byte [ebp - 0x120], 0
lea edx, [ebp - 0x124]
xor ecx, ecx
mov eax, 0x2356c4
call fcn.0010a8a8
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
call fcn.0013eed0
test al, al
je 0x235652
lea ecx, [ebp - 0xc]
mov edx, 0x235704
mov eax, dword [ebp - 0x14]
call fcn.0013f250
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
lea ecx, [ebp - 0x128]
mov edx, 0x235718
mov eax, dword [ebp - 0x14]
call fcn.0013f250
mov edx, dword [ebp - 0x128]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 0x14]
call fcn.0013ee3c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x23566e
add dword [ebp - 0x1c], 4
dec dword [ebp - 0x18]
jne 0x2355b4
mov bl, 1
mov eax, dword [ebp - 0x14]
call fcn.00103ba8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x2356b2
lea eax, [ebp - 0x128]
call fcn.00104aa0
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00104ac4
ret
Function at 0x237ec8
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
push ebx
xor ebx, ebx
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x237f66
mov edx, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x84]
dec ecx
je 0x237f31
dec ecx
jne 0x237f66
cmp eax, 4
jg 0x237f0f
mov bl, 4
jmp 0x237f66
cmp eax, 5
jne 0x237f1c
test edx, edx
jne 0x237f1c
mov bl, 6
jmp 0x237f66
cmp eax, 5
jne 0x237f28
dec edx
jne 0x237f28
mov bl, 7
jmp 0x237f66
cmp eax, 6
jl 0x237f66
mov bl, 8
jmp 0x237f66
cmp eax, 4
jne 0x237f3e
test edx, edx
jne 0x237f3e
mov bl, 1
jmp 0x237f66
cmp eax, 4
jne 0x237f56
cmp edx, 0xa
jne 0x237f56
cmp byte [ebp - 0x7f], 0x41
jne 0x237f52
mov bl, 3
jmp 0x237f66
mov bl, 2
jmp 0x237f66
cmp eax, 4
jne 0x237f64
cmp edx, 0x5a
jne 0x237f64
mov bl, 5
jmp 0x237f66
xor ebx, ebx
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x238144
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
mov ebx, eax
call fcn.00102be8
lea eax, [ebp - 0x105]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathA
lea eax, [ebp - 0x105]
push eax
mov eax, 0xffff
call fcn.001033cc
push eax
push 0x2381a0
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetTempFileNameA
mov eax, ebx
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.00104d10
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x238614
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor edx, edx
push ebp
push 0x23867d
push dword fs:[edx]
mov dword fs:[edx], esp
mov dword [ebp - 8], 0x1400
mov eax, dword [ebp - 8]
call fcn.001027b4
mov ebx, eax
lea eax, [ebp - 8]
push eax
push ebx
call sub.iphlpapi.dll_GetAdaptersInfo
test eax, eax
je 0x23865f
mov eax, dword [ebp - 4]
call fcn.00104aa0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x238694
mov ecx, dword [ebp - 4]
mov edx, dword [ebx + 0x190]
lea eax, [ebx + 0x194]
call fcn.00238580
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x238694
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x23956c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
push 0xffffffffffffffff
push ebx
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb eax, eax
inc eax
pop ebx
pop ebp
ret
Function at 0x239bc8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
push ebx
xor ebx, ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00104f6c
mov eax, dword [ebp - 8]
call fcn.00104f6c
mov eax, dword [ebp - 0xc]
call fcn.00104f6c
xor eax, eax
push ebp
push 0x239cbd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x54]
xor ecx, ecx
mov edx, 0x44
call fcn.001033ac
mov dword [ebp - 0x54], 0x44
mov dword [ebp - 0x28], 1
cmp byte [ebp + 8], 0
je 0x239c2e
mov word [ebp - 0x24], 1
jmp 0x239c34
mov word [ebp - 0x24], 0
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x54]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00104f7c
push eax
push 0
push 0x30
push 0xffffffffffffffff
push 0
push 0
push dword [ebp - 4]
push 0x239cd8
push dword [ebp - 8]
lea eax, [ebp - 0x68]
mov edx, 3
call fcn.00104e3c
mov eax, dword [ebp - 0x68]
call fcn.00104f7c
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x239c9a
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x64]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x64]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x60]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x239cc4
lea eax, [ebp - 0x68]
call fcn.00104aa0
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00104ac4
ret

Function at 0x239cdc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00104f6c
mov eax, dword [ebp - 8]
call fcn.00104f6c
mov eax, dword [ebp + 0x10]
call fcn.00104f6c
lea ebx, [ebp - 0x44]
xor eax, eax
push ebp
push 0x239dc1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebx], 0x3c
mov dword [ebx + 4], 0x4008340
mov dword [ebx + 8], esi
mov eax, 0x239dd4
mov dword [ebx + 0xc], eax
mov eax, dword [ebp - 4]
call fcn.00104f7c
mov dword [ebx + 0x10], eax
mov eax, dword [ebp - 8]
call fcn.00104f7c
mov dword [ebx + 0x14], eax
mov eax, dword [ebp + 0x10]
call fcn.00104f7c
mov dword [ebx + 0x18], eax
cmp byte [ebp + 0xc], 0
je 0x239d5d
mov dword [ebx + 0x1c], 1
jmp 0x239d62
xor eax, eax
mov dword [ebx + 0x1c], eax
xor eax, eax
mov dword [ebx + 0x20], eax
xor eax, eax
mov dword [ebx + 0x24], eax
xor eax, eax
mov dword [ebx + 0x28], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
xor eax, eax
mov dword [ebx + 0x30], eax
xor eax, eax
mov dword [ebx + 0x34], eax
xor eax, eax
mov dword [ebx + 0x38], eax
push ebx
call sub.shell32.dll_ShellExecuteExA
cmp byte [ebp + 8], 0
je 0x239d9c
push 0xffffffffffffffff
mov eax, dword [ebx + 0x38]
push eax
call sub.kernel32.dll_WaitForSingleObject
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x239dc8
lea eax, [ebp - 8]
mov edx, 2
call fcn.00104ac4
lea eax, [ebp + 0x10]
call fcn.00104aa0
ret
Function at 0x239ddc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
push ebx
xor ebx, ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00104f6c
mov eax, dword [ebp - 8]
call fcn.00104f6c
mov eax, dword [ebp - 0xc]
call fcn.00104f6c
xor eax, eax
push ebp
push 0x239edc
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x54]
xor ecx, ecx
mov edx, 0x44
call fcn.001033ac
mov dword [ebp - 0x54], 0x44
mov dword [ebp - 0x28], 1
cmp byte [ebp + 8], 0
je 0x239e42
mov word [ebp - 0x24], 1
jmp 0x239e48
mov word [ebp - 0x24], 0
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x54]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00104f7c
push eax
push 0
push 0x30
push 0xffffffffffffffff
push 0
push 0
push dword [ebp - 4]
push 0x239ef8
push dword [ebp - 8]
lea eax, [ebp - 0x68]
mov edx, 3
call fcn.00104e3c
mov eax, dword [ebp - 0x68]
call fcn.00104f7c
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x239eb9
push 0xffffffffffffffff
mov eax, dword [ebp - 0x64]
push eax
call sub.kernel32.dll_WaitForSingleObject
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x64]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x64]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x60]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x239ee3
lea eax, [ebp - 0x68]
call fcn.00104aa0
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00104ac4
ret

Function at 0x23a264
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00104f6c
mov eax, dword [ebp - 8]
call fcn.00104f6c
mov eax, dword [ebp + 8]
call fcn.00104f6c
xor eax, eax
push ebp
push 0x23a33b
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0010a018
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.00109074
mov eax, dword [ebp - 0xc]
mov edx, 0x23a354
call fcn.00104ec8
jne 0x23a2ed
push 6
mov eax, dword [ebp + 8]
call fcn.00104f7c
push eax
mov eax, dword [ebp - 8]
call fcn.00104f7c
push eax
mov eax, dword [ebp - 4]
call fcn.00104f7c
push eax
push 0
push ebx
call sub.shell32.dll_ShellExecuteA
jmp 0x23a312
push 0xa
mov eax, dword [ebp + 8]
call fcn.00104f7c
push eax
mov eax, dword [ebp - 8]
call fcn.00104f7c
push eax
mov eax, dword [ebp - 4]
call fcn.00104f7c
push eax
push 0
push ebx
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
setg bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x23a342
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00104ac4
lea eax, [ebp + 8]
call fcn.00104aa0
ret
Function at 0x23c830
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, eax
cmp byte [ebx + 0x22b], 2
jne 0x23c853
push 9
mov eax, ebx
call fcn.0016d3b8
push eax
call sub.user32.dll_ShowWindow
jmp 0x23c89f
push 3
mov eax, ebx
call fcn.0016d3b8
push eax
call sub.user32.dll_ShowWindow
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push 0x30
call sub.user32.dll_SystemParametersInfoA
mov edx, dword [ebp - 0x10]
mov eax, ebx
call fcn.00166250
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.00166274
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.001662c0
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0x10]
mov eax, ebx
call fcn.0016629c
mov eax, ebx
call fcn.0023c234
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406cbe
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x428094], 0
jne 0x406cfc
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406cd2
mov dword [ecx*4 + 0x428090], eax
inc ecx
cmp ecx, 0x100
jl 0x406ccd
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x406d29
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x428090]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x406d0a
not eax
pop ebp
ret 0xc
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ed0
nop
mov ecx, 0x4c16315d
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
mov ecx, 0x50e81842
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
popal
nop
nop
nop
nop
jmp 0x401219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x423c90
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4a01cb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.004943d6
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x423d12
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0049196d
mov eax, dword [eax]
push 0x65d234
push eax
call fcn.004836c4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00494661
test bl, bl
je 0x423d12
push 0x65d234
lea ecx, [esp + 0xc]
call fcn.004949f1
push 0x660da4
lea ecx, [esp + 0xc]
call fcn.004949f1
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x423d4e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.00494661
jmp 0x423e19
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x423dd2
lea edx, [esp + 0x7c]
push 0x660da0
push edx
call fcn.004836c4
add esp, 8
test eax, eax
je 0x423dd2
lea eax, [esp + 0x7c]
push 0x660d9c
push eax
call fcn.004836c4
add esp, 8
test eax, eax
je 0x423dd2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x423d62
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.00494661
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x424630
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x424692
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc