joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
mov edi, ecx
xor ebx, ebx
call fcn.00404053
mov ecx, eax
call fcn.004040b4
test eax, eax
je 0x40106c
push esi
lea ecx, [ebp - 0x14]
mov word [ebp - 0xd], 0x4374
push ecx
push eax
mov dword [ebp - 0xa], 0x4865736f
mov dword [ebp - 5], 0x656c646e
mov byte [ebp - 0xb], 0x6c
mov word [ebp - 0x14], 0x6e49
mov dword [ebp - 0x11], 0x656e7265
mov byte [ebp - 1], bl
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 6], 0x61
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x40106b
push edi
mov ecx, esi
call dword [0x4172b8]
call esi
mov ebx, eax
pop esi
pop edi
mov eax, ebx
pop ebx
leave
ret

Function at 0x401072
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push edi
mov edi, edx
xor ebx, ebx
call fcn.00404053
mov ecx, eax
call fcn.0040411c
test eax, eax
je 0x4010dd
push esi
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x14], 0x72507075
push ecx
push eax
mov dword [ebp - 0xa], 0x6c615665
mov dword [ebp - 0x18], 0x6b6f6f4c
mov dword [ebp - 0xf], 0x656c6976
mov dword [ebp - 6], 0x576575
mov byte [ebp - 0x10], 0x69
mov byte [ebp - 0xb], 0x67
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x4010dc
push dword [ebp + 8]
mov ecx, esi
push edi
push ebx
call dword [0x4172b8]
call esi
mov ebx, eax
pop esi
pop edi
mov eax, ebx
pop ebx
leave
ret

Function at 0x4010e3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
xor esi, esi
mov ebx, edx
mov ebp, ecx
inc esi
call fcn.00404053
mov ecx, eax
call fcn.0040411c
test eax, eax
je 0x401154
push edi
lea ecx, [esp + 0x10]
mov word [esp + 0x18], 0x7965
push ecx
push eax
mov dword [esp + 0x22], 0x577845
mov dword [esp + 0x1b], 0x6e65704f
mov byte [esp + 0x1f], 0x4b
mov word [esp + 0x19], 0x6765
mov byte [esp + 0x18], 0x52
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x401153
push dword [esp + 0x2c]
mov ecx, edi
push dword [esp + 0x2c]
push 0
push ebx
push ebp
call dword [0x4172b8]
call edi
mov esi, eax
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x40115d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor esi, esi
mov ebx, ecx
inc esi
call fcn.00404053
mov ecx, eax
call fcn.0040411c
test eax, eax
je 0x4011bb
push edi
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], 0x43676552
push ecx
push eax
mov word [ebp - 5], 0x4b65
mov word [ebp - 8], 0x6f6c
mov word [ebp - 2], 0x79
mov byte [ebp - 6], 0x73
mov byte [ebp - 3], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x4011ba
push ebx
mov ecx, edi
call dword [0x4172b8]
call edi
mov esi, eax
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4011c1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebx
push ebp
push edi
mov edi, edx
mov ebp, ecx
xor ebx, ebx
call fcn.00404053
mov ecx, eax
call fcn.004040b4
test eax, eax
je 0x401236
push esi
lea ecx, [esp + 0x10]
mov dword [esp + 0x15], 0x4374656e
push ecx
push eax
mov dword [esp + 0x21], 0x656e6e6f
mov dword [esp + 0x18], 0x65746e49
mov word [esp + 0x26], 0x5774
mov byte [esp + 0x1c], 0x72
mov byte [esp + 0x28], bl
mov byte [esp + 0x25], 0x63
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x401235
push ebx
push ebx
push 3
push ebx
push ebx
push dword [esp + 0x3c]
mov ecx, esi
push edi
push ebp
call dword [0x4172b8]
call esi
mov ebx, eax
pop esi
pop edi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x14
ret

Function at 0x401b2b
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
lea eax, [ebp - 0x208]
push esi
push edi
push 0x208
push 0
push eax
mov esi, edx
mov edi, ecx
call fcn.00406530
push dword [ebp + 8]
lea eax, [ebp - 0x208]
push esi
push edi
push str._s_s_s
push 0xffffffffffffffff
push 0x104
push eax
call fcn.004041d1
add esp, 0x28
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop edi
pop esi
test eax, eax
je 0x401b98
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.GDI32.dll_RemoveFontResourceW]
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
leave
ret

Function at 0x401bde
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x218
push ebx
push ebp
push esi
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x401c22
lea eax, [esp + 0x14]
mov edx, edi
push eax
push 0x20019
push ecx
mov ecx, ebx
call fcn.004010e3
add esp, 0xc
test eax, eax
je 0x401c2d
cmp eax, 2
jne 0x401cbe
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x5c
lea esi, [edi + eax*2]
pop eax
cmp word [esi - 2], ax
je 0x401c4b
mov word [esi], ax
add esi, 2
xor eax, eax
mov word [esi], ax
xor ebp, ebp
jmp 0x401c76
xor eax, eax
mov word [esi], ax
lea eax, [esp + 0x20]
push 0xffffffffffffffff
push eax
push 0x208
push edi
call fcn.0040a056
add esp, 0x10
mov edx, edi
mov ecx, ebx
call fcn.00401bde
test eax, eax
je 0x401c9f
lea eax, [esp + 0x18]
mov dword [esp + 0x10], 0x104
push eax
push ebp
push ebp
push ebp
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x34]
push eax
push ebp
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x401c4f
xor eax, eax
mov word [esi - 2], ax
mov ecx, dword [esp + 0x14]
call fcn.0040115d
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x401c22
xor eax, eax
jmp 0x401c25
Function at 0x401cc5
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 2
push ecx
call fcn.004010e3
add esp, 0xc
test eax, eax
jne 0x401cf0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [ebp - 4]
call fcn.0040115d
leave
ret

Function at 0x402130
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebx
push ebp
push edi
mov edi, edx
mov ebp, ecx
xor ebx, ebx
call fcn.00404053
mov ecx, eax
call fcn.004040b4
test eax, eax
je 0x4021b1
push esi
lea ecx, [esp + 0x10]
mov word [esp + 0x19], 0x6165
push ecx
push eax
mov word [esp + 0x1b], 0x7265
mov word [esp + 0x1e], 0x7465
mov dword [esp + 0x25], 0x656c69
mov word [esp + 0x19], 0x746e
mov byte [esp + 0x18], 0x49
mov word [esp + 0x23], 0x4664
mov byte [esp + 0x1d], 0x6e
mov byte [esp + 0x20], 0x52
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x4021b0
push dword [esp + 0x2c]
mov ecx, esi
push 0x400
push edi
push ebp
call dword [0x4172b8]
call esi
mov ebx, eax
pop esi
pop edi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x14
ret

Function at 0x4021ba
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
mov edi, ecx
xor ebx, ebx
call fcn.00404053
mov ecx, eax
call fcn.0040411c
test eax, eax
je 0x402221
push esi
lea ecx, [ebp - 0x14]
mov dword [ebp - 0xb], 0x6f547373
push ecx
push eax
mov word [ebp - 6], 0x6e65
mov byte [ebp - 4], bl
mov dword [ebp - 0xf], 0x65636f72
mov dword [ebp - 0x14], 0x6e65704f
mov byte [ebp - 7], 0x6b
mov byte [ebp - 0x10], 0x50
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x402220
push dword [ebp + 8]
mov ecx, esi
push 0x20
push edi
call dword [0x4172b8]
call esi
mov ebx, eax
pop esi
pop edi
mov eax, ebx
pop ebx
leave
ret

Function at 0x402227
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push ebp
push edi
mov edi, edx
mov ebp, ecx
xor ebx, ebx
call fcn.00404053
mov ecx, eax
call fcn.004040b4
test eax, eax
je 0x40228f
push esi
lea ecx, [esp + 0x10]
mov word [esp + 0x10], 0x6e49
push ecx
push eax
mov dword [esp + 0x1b], 0x656e7265
mov dword [esp + 0x21], 0x576e6570
mov byte [esp + 0x1a], 0x74
mov byte [esp + 0x25], bl
mov word [esp + 0x1f], 0x4f74
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x40228e
push ebx
push ebx
push ebx
push edi
push ebp
mov ecx, esi
call dword [0x4172b8]
call esi
mov ebx, eax
pop esi
pop edi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x10
ret
Function at 0x40232b
Capabilities:
Copy file
Create process on windows
Delete file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x890
push esi
push edi
push dword [ebp + 0x10]
push 0x41cda8
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x402443
mov edi, 0x208
lea eax, [ebp - 0x688]
push edi
xor esi, esi
push esi
push eax
call fcn.00406530
push edi
lea eax, [ebp - 0x480]
push esi
push eax
call fcn.00406530
push edi
lea eax, [ebp - 0x278]
push esi
push eax
call fcn.00406530
add esp, 0x24
lea eax, [ebp - 0x688]
mov edi, 0x104
push edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x480]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x278]
push eax
push esi
push 0x41cdb0
lea eax, [ebp - 0x480]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea eax, [ebp - 0x278]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x278]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
mov edx, str..exe
lea ecx, [ebp - 0x278]
call fcn.00404190
push esi
lea eax, [ebp - 0x278]
push eax
lea eax, [ebp - 0x688]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0x44
pop edi
push edi
lea eax, [ebp - 0x70]
push esi
push eax
call fcn.00406530
add esp, 0xc
mov dword [ebp - 0x70], edi
mov edx, 0x41cdc4
lea ecx, [ebp - 0x278]
call fcn.00404190
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x70]
push eax
push esi
push esi
push 0x50
push esi
push esi
push esi
lea eax, [ebp - 0x278]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
xor eax, eax
jmp 0x4024fc
mov esi, dword [ebp + 8]
push 0x64
push 0x421580
push 0x68
push esi
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x64
push 0x4214b8
push 0x6e
push esi
call dword [sym.imp.USER32.dll_LoadStringW]
mov ecx, esi
call fcn.00416487
mov edx, dword [ebp + 0x14]
mov ecx, esi
call fcn.0040123f
test eax, eax
je 0x40243c
push 0x6e
push esi
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov edi, eax
xor esi, esi
jmp 0x4024b0
lea eax, [ebp - 0x1c]
push eax
push edi
push dword [ebp - 0x1c]
call dword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
jne 0x4024b0
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push esi
push esi
push esi
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x40248a
push 0x208
lea eax, [ebp - 0x890]
push esi
push eax
call fcn.00406530
add esp, 0xc
lea eax, [ebp - 0x890]
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 4
push esi
lea eax, [ebp - 0x890]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov eax, dword [ebp - 0x14]
pop edi
pop esi
leave
ret 0x10
Function at 0x40254d
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
push 0x69
pop eax
push 0x75
mov word [ebp - 0x16], ax
pop eax
push 0x61
mov word [ebp - 0xc], ax
xor eax, eax
mov word [ebp - 4], ax
pop eax
push 0x72
mov word [ebp - 0x1a], ax
pop eax
push 0x43
mov word [ebp - 6], ax
pop eax
push 0x70
mov word [ebp - 0x10], ax
pop eax
push 0x52
mov word [ebp - 0x18], ax
pop eax
push 0x65
mov word [ebp - 0x1c], ax
pop eax
push 0x6e
mov word [ebp - 8], ax
pop eax
push 0x54
mov word [ebp - 0xa], ax
pop eax
push 0x64
mov word [ebp - 0xe], ax
pop eax
push 0x50
mov word [ebp - 0x14], ax
pop eax
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x1c]
push 0x41cfa4
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x402659
push esi
push 0x208
xor esi, esi
lea eax, [ebp - 0x224]
push esi
push eax
call fcn.00406530
add esp, 0xc
lea eax, [ebp - 0x224]
push esi
push 0x2a
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edx, [ebp - 0x1c]
lea ecx, [ebp - 0x224]
call fcn.00401b9a
lea edx, [ebp - 0x1c]
lea ecx, [ebp - 0x224]
call fcn.00401acc
push esi
push 0x23
lea eax, [ebp - 0x224]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edx, [ebp - 0x1c]
lea ecx, [ebp - 0x224]
call fcn.00401acc
push esi
push 0x1c
lea eax, [ebp - 0x224]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edx, [ebp - 0x1c]
lea ecx, [ebp - 0x224]
call fcn.00401b9a
lea edx, [ebp - 0x1c]
lea ecx, [ebp - 0x224]
call fcn.00401acc
pop esi
leave
ret

Function at 0x4160ec
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebx
push ebp
push edi
mov edi, edx
mov ebp, ecx
xor ebx, ebx
call fcn.00404053
mov ecx, eax
call fcn.004040b4
test eax, eax
je 0x416167
push esi
lea ecx, [esp + 0x10]
mov dword [esp + 0x17], 0x71655264
push ecx
push eax
mov dword [esp + 0x25], 0x577473
mov word [esp + 0x1a], 0x7074
mov word [esp + 0x1d], 0x6e65
mov word [esp + 0x18], 0x7448
mov word [esp + 0x23], 0x6575
mov byte [esp + 0x1c], 0x53
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x416166
push dword [esp + 0x30]
mov ecx, esi
push dword [esp + 0x30]
push dword [esp + 0x30]
push edi
push ebp
call dword [0x4172b8]
call esi
mov ebx, eax
pop esi
pop edi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x14
ret
Function at 0x416170
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push edi
mov edi, ecx
xor ebx, ebx
call fcn.00404053
mov ecx, eax
call fcn.0040411c
test eax, eax
je 0x4161eb
push esi
lea ecx, [ebp - 0x18]
mov word [ebp - 8], 0x656c
push ecx
push eax
mov dword [ebp - 0xd], 0x76697250
mov word [ebp - 0x17], 0x6a64
mov dword [ebp - 6], 0x736567
mov dword [ebp - 0x12], 0x656b6f54
mov byte [ebp - 0x18], 0x41
mov word [ebp - 0x14], 0x7473
mov byte [ebp - 9], 0x69
mov byte [ebp - 0x15], 0x75
mov byte [ebp - 0xe], 0x6e
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x4161ea
push ebx
push ebx
push 0x10
push dword [ebp + 8]
mov ecx, esi
push ebx
push edi
call dword [0x4172b8]
call esi
mov ebx, eax
pop esi
pop edi
mov eax, ebx
pop ebx
leave
ret

Function at 0x4161f1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
xor esi, esi
mov ebx, edx
mov ebp, ecx
inc esi
call fcn.00404053
mov ecx, eax
call fcn.0040411c
test eax, eax
je 0x416267
push edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x12], 0x65755167
push ecx
push eax
mov dword [esp + 0x23], 0x78456575
mov word [esp + 0x18], 0x6552
mov dword [esp + 0x1e], 0x61567972
mov word [esp + 0x27], 0x57
mov byte [esp + 0x22], 0x6c
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x416266
push dword [esp + 0x34]
mov ecx, edi
push dword [esp + 0x34]
push 0
push 0
push ebx
push ebp
call dword [0x4172b8]
call edi
mov esi, eax
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret

Function at 0x416270
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push edi
mov edi, ecx
xor ebx, ebx
call fcn.00404053
mov ecx, eax
call fcn.004040b4
test eax, eax
je 0x4162e1
push esi
lea ecx, [ebp - 0x18]
mov word [ebp - 0x14], 0x6e72
push ecx
push eax
mov dword [ebp - 0x11], 0x65755174
mov dword [ebp - 8], 0x576e6f69
mov dword [ebp - 0xd], 0x704f7972
mov dword [ebp - 0x18], 0x65746e49
mov byte [ebp - 9], 0x74
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 4], bl
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x4162e0
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
push 0x1f
push edi
call dword [0x4172b8]
call esi
mov ebx, eax
pop esi
pop edi
mov eax, ebx
pop ebx
leave
ret
Function at 0x4162e7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
mov edi, ecx
xor ebx, ebx
call fcn.00404053
mov ecx, eax
call fcn.004040b4
test eax, eax
je 0x416361
push esi
lea ecx, [ebp - 0x14]
mov word [ebp - 0xc], 0x6553
push ecx
push eax
mov word [ebp - 0x11], 0x7265
mov dword [ebp - 7], 0x6e6f6974
mov word [ebp - 9], 0x704f
mov word [ebp - 0x14], 0x6e49
mov word [ebp - 0xe], 0x7465
mov word [ebp - 3], 0x57
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 0xf], 0x6e
mov byte [ebp - 0x12], 0x74
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x416360
push 4
push dword [ebp + 8]
mov ecx, esi
push 0x1f
push edi
call dword [0x4172b8]
call esi
mov ebx, eax
pop esi
pop edi
mov eax, ebx
pop ebx
leave
ret

Function at 0x416367
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebx
push ebp
push edi
mov edi, edx
mov ebp, ecx
xor ebx, ebx
call fcn.00404053
mov ecx, eax
call fcn.004040b4
test eax, eax
je 0x4163e9
push esi
lea ecx, [esp + 0x10]
mov dword [esp + 0x11], 0x4f707474
push ecx
push eax
mov word [esp + 0x21], 0x7165
mov dword [esp + 0x25], 0x577473
mov word [esp + 0x1e], 0x6e65
mov word [esp + 0x23], 0x6575
mov byte [esp + 0x20], 0x52
mov byte [esp + 0x1d], 0x70
mov byte [esp + 0x18], 0x48
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x4163e8
push ebx
push dword [esp + 0x3c]
mov ecx, esi
push ebx
push ebx
push str.HTTP_1.0
push dword [esp + 0x3c]
push edi
push ebp
call dword [0x4172b8]
call esi
mov ebx, eax
pop esi
pop edi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x14
ret

Function at 0x41667e
Capabilities:
Enumerate processes
Terminate process

Disassembly:
sub esp, 0x22c
push ebp
push esi
push edi
xor esi, esi
mov ebp, ecx
push esi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x416705
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x22c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
cmp eax, 1
jne 0x4166fe
push ebx
push ebp
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4166d8
push dword [esp + 0x18]
push esi
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
jne 0x4166eb
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
je 0x4166b5
jmp 0x4166fd
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
inc esi
pop ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebp
add esp, 0x22c
ret
Function at 0x416711
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x45c
lea eax, [esp + 4]
push ebx
push esi
push edi
mov esi, ecx
mov ebx, 0x208
push esi
push ebx
push eax
call fcn.00409e82
push 0x41cfec
lea eax, [esp + 0x20]
push ebx
push eax
call fcn.00409e0d
add esp, 0x18
lea eax, [esp + 0x218]
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
push 4
mov edi, eax
pop ebx
mov edx, 0x41cff4
lea ecx, [esp + 0x244]
mov ax, word [ecx]
cmp ax, word [edx]
jne 0x41678e
test ax, ax
je 0x41678a
mov ax, word [ecx + 2]
cmp ax, word [edx + 2]
jne 0x41678e
add ecx, ebx
add edx, ebx
test ax, ax
jne 0x41676a
xor eax, eax
jmp 0x416793
sbb eax, eax
or eax, 1
test eax, eax
je 0x41687c
mov ecx, 0x41cff8
lea eax, [esp + 0x244]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4167cb
test dx, dx
je 0x4167c7
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4167cb
add eax, ebx
add ecx, ebx
test dx, dx
jne 0x4167a7
xor eax, eax
jmp 0x4167d0
sbb eax, eax
or eax, 1
test eax, eax
je 0x41687c
push esi
lea eax, [esp + 0x14]
push 0x208
push eax
call fcn.00409e82
push 0x41d000
lea eax, [esp + 0x20]
push 0x208
push eax
call fcn.00409e0d
lea eax, [esp + 0x25c]
push eax
lea eax, [esp + 0x2c]
push 0x208
push eax
call fcn.00409e0d
add esp, 0x24
test byte [esp + 0x218], 0x10
je 0x416845
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryEmptyW]
test eax, eax
jne 0x416838
lea ecx, [esp + 0x10]
call fcn.00416711
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x41686b
test byte [esp + 0x218], 1
je 0x416860
lea eax, [esp + 0x10]
push 0x80
push eax
call fcn.00409ee6
pop ecx
pop ecx
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x41687c
push ebx
push eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea eax, [esp + 0x218]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x41675e
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x4168ae
push ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4168e8
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x402b80
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x42149c], eax
ret
Function at 0x416a5c
Capabilities:
Check http status code

Disassembly:
mov eax, 0x416cdd
call fcn.004160cc
sub esp, 0x4c
push ebx
push esi
push edi
push 0x6f
pop esi
push 0x77
mov edi, ecx
mov word [ebp - 0x4e], si
pop ecx
push 0x6c
pop eax
push 0x67
pop edx
push 0x2e
mov word [ebp - 0x58], cx
xor ebx, ebx
mov word [ebp - 0x54], cx
mov word [ebp - 0x56], cx
pop ecx
push 0x6d
mov word [ebp - 0x48], ax
pop eax
mov word [ebp - 0x3e], ax
push 0x65
pop eax
mov word [ebp - 0x46], ax
push 0x63
pop eax
mov word [ebp - 0x42], ax
xor eax, eax
mov word [ebp - 0x3c], ax
inc eax
mov word [ebp - 0x44], cx
mov word [ebp - 0x52], cx
mov ecx, eax
push eax
mov word [ebp - 0x50], dx
mov word [ebp - 0x4c], si
mov word [ebp - 0x4a], dx
mov word [ebp - 0x40], si
call fcn.00401dec
push eax
sub esp, 0x18
lea eax, [ebp - 0x58]
mov ecx, esp
push eax
call fcn.00404238
mov ecx, edi
call fcn.00401cf2
cmp byte [edi + 0x18], bl
je 0x416b9d
lea ecx, [ebp - 0x38]
call fcn.00401e03
push ecx
push 0x4883000
sub esp, 0xc
mov dword [ebp - 4], ebx
mov ecx, eax
push 0x41d0fc
call fcn.00403a50
mov ecx, dword [edi + 0x20]
mov edx, eax
call fcn.00416367
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
add esp, 0x18
mov esi, eax
call fcn.00403a5c
test esi, esi
je 0x416b96
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 4
push eax
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
call fcn.00416270
or dword [ebp - 0x10], 0x180
lea eax, [ebp - 0x10]
add esp, 4
mov ecx, esi
push eax
call fcn.004162e7
push ebx
push ebx
push ebx
xor edx, edx
mov ecx, esi
call fcn.004160ec
add esp, 0x14
mov dword [ebp - 0x14], ebx
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 4
push ebx
push eax
lea eax, [ebp - 0x14]
push eax
push 0x20000013
push esi
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
cmp dword [ebp - 0x14], 0xc8
push 1
movzx ebx, bl
pop ecx
cmove ebx, ecx
mov ecx, esi
call fcn.00401000
mov ecx, edi
call fcn.00401d5e
mov ecx, dword [ebp - 0xc]
mov al, bl
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219