joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43124d
Capabilities:
Clear file content

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0
push dword [esp + 0x14]
push dword [esp + 0x14]
push dword [esi]
call fcn.0042572e
add esp, 0x10
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
pop esi
ret
Function at 0x431d97
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
xor esi, esi
push esi
push 0x48b164
push str.OLEPRO32.DLL
push str.OleLoadPicture
call fcn.0042584c
add esp, 0x10
cmp dword [0x48b160], esi
je 0x431e8d
cmp dword [0x48b164], esi
je 0x431e8d
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push dword [ebp + 8]
lea ecx, [ebp - 4]
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], esi
call fcn.00403993
cmp dword [ebp - 4], esi
je 0x431e81
push ebx
push edi
push esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
cmp edi, esi
je 0x431e6f
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
lea ecx, [ebp - 0x10]
push ecx
push ebx
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea ecx, [ebp - 4]
call fcn.00402905
lea eax, [ebp - 8]
push eax
push esi
push edi
call dword [0x48b160]
cmp dword [ebp - 8], esi
je 0x431e68
lea eax, [ebp - 0xc]
push eax
push 0x47d95c
push esi
push esi
push dword [ebp - 8]
call dword [0x48b164]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 8]
cmp eax, esi
pop edi
pop ebx
je 0x431e7e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov esi, dword [ebp - 0xc]
lea ecx, [ebp - 4]
call fcn.00402905
mov eax, esi
jmp 0x431e8f
xor eax, eax
pop esi
leave
ret
Function at 0x4322f1
Capabilities:
Delete file
Query environment variable
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2e4
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
cmp dword [edi + 4], esi
mov dword [ebp - 4], esi
jg 0x432310
xor eax, eax
jmp 0x4324d4
push 0x48b5d4
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call fcn.00431d2a
lea ecx, [ebp - 0xc]
call fcn.00409538
push dword [edi + 4]
push dword [edi]
call fcn.00428952
mov edi, eax
cmp edi, esi
pop ecx
pop ecx
je 0x43234f
mov eax, dword [edi]
lea ecx, [ebp - 4]
push ecx
push edi
call dword [eax + 0xc]
cmp dword [ebp - 4], esi
jne 0x432354
mov eax, dword [edi]
push edi
call dword [eax + 8]
cmp dword [ebp - 4], esi
je 0x43236e
mov eax, dword [0x48b158]
cmp eax, esi
mov edi, dword [ebp - 4]
je 0x432367
cmp dword [ebp - 0xc], esi
jne 0x432367
call eax
mov esi, edi
jmp 0x4324c7
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push ebx
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x2e4]
push eax
push 0x475d10
mov word [ebp - 0x2e4], si
call edi
cmp eax, esi
jg 0x4323c4
push ebx
lea eax, [ebp - 0x2e4]
push eax
push str.TEMP
call edi
cmp eax, esi
jg 0x4323c4
mov eax, dword [0x48b158]
cmp eax, esi
je 0x4324c6
cmp dword [ebp - 0xc], esi
jne 0x4324c6
call eax
jmp 0x4324c6
mov dword [ebp - 8], esi
mov dword [ebp - 0x10], 0x63
lea edi, [ebp + eax*2 - 0x2e4]
call fcn.004264c1
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.pecmd_bmp._lu._lu.tmp
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push esi
push 0x80
push 1
push esi
push 5
push 0x40000000
lea eax, [ebp - 0x2e4]
push eax
lea ecx, [ebp - 8]
call fcn.00403993
cmp dword [ebp - 8], esi
jne 0x432439
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
dec dword [ebp - 0x10]
jns 0x4323d5
lea ecx, [ebp - 8]
call fcn.00402905
jmp 0x4323a7
push esi
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp + 8]
push dword [eax + 4]
mov dword [ebp - 0x14], esi
push dword [eax]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea ecx, [ebp - 8]
call fcn.00402905
push 0x10
push esi
push esi
push esi
lea eax, [ebp - 0x2e4]
push eax
push esi
call dword [sym.imp.USER32.dll_LoadImageW]
cmp eax, esi
mov dword [ebp - 4], eax
jne 0x43249c
lea eax, [ebp - 0x2e4]
push eax
call fcn.00431d97
mov edi, eax
cmp edi, esi
pop ecx
je 0x43249c
mov eax, dword [edi]
lea ecx, [ebp - 4]
push ecx
push edi
call dword [eax + 0xc]
cmp dword [ebp - 4], esi
jne 0x43249c
mov eax, dword [edi]
push edi
call dword [eax + 8]
lea eax, [ebp - 0x2e4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, dword [ebp - 4]
lea ecx, [ebp - 8]
call fcn.00402905
mov eax, dword [0x48b158]
cmp eax, esi
je 0x4324c4
cmp dword [ebp - 0xc], esi
jne 0x4324c4
call eax
mov esi, edi
pop ebx
push 0x48b5d4
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
pop edi
pop esi
leave
ret
Function at 0x432988
Capabilities:
Get disk information
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
cmp ax, 0x61
jb 0x4329a2
cmp ax, 0x7a
ja 0x4329a2
and eax, 0xffdf
push ebx
push esi
push 0x5c
pop ecx
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 3
mov word [ebp - 0x1c], ax
mov word [ebp - 0x24], ax
push ebx
lea eax, [ebp - 0x2c]
push eax
mov word [ebp - 0x1a], 0x3a
mov word [ebp - 0x18], cx
mov word [ebp - 0x16], bx
mov word [ebp - 0x2c], cx
mov word [ebp - 0x2a], cx
mov word [ebp - 0x28], 0x2e
mov word [ebp - 0x26], cx
mov word [ebp - 0x22], 0x3a
mov word [ebp - 0x20], bx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x432a41
push edi
push ebx
lea eax, [ebp - 0x30]
push eax
push 0xc
lea eax, [ebp - 0x40]
push eax
push ebx
push ebx
push 0x2d1080
push esi
mov dword [ebp - 0x30], ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, ebx
pop edi
je 0x432a41
mov esi, dword [ebp - 0x3c]
cmp esi, 0xffffffff
je 0x432a41
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
push eax
push esi
mov dword [ebp - 8], ebx
call fcn.00428bfb
cmp eax, ebx
pop ecx
pop ecx
jne 0x432a49
xor eax, eax
inc eax
jmp 0x432ae6
push ebx
push eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x10], ebx
call dword [sym.imp.SETUPAPI.dll_CM_Get_Parent]
push ebx
push dword [ebp - 8]
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.SETUPAPI.dll_CM_Get_DevNode_Status]
mov eax, dword [ebp - 0x14]
shr eax, 0xe
and al, 1
mov byte [ebp - 1], al
mov dword [ebp - 0xc], 1
mov esi, 0x208
push ebx
push esi
cmp al, bl
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
mov word [ebp - 0x248], bx
je 0x432aad
call dword [sym.imp.SETUPAPI.dll_CM_Request_Device_EjectW]
jmp 0x432ab3
call dword [sym.imp.SETUPAPI.dll_CM_Query_And_Remove_SubTreeW]
cmp eax, ebx
jne 0x432abc
cmp dword [ebp - 0x10], ebx
je 0x432ad9
push 0xc8
mov ecx, 0x48aec0
call fcn.0040ac88
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jg 0x432adb
mov al, byte [ebp - 1]
jmp 0x432a8a
mov bl, 1
neg bl
sbb ebx, ebx
and ebx, 0xfffffffe
inc ebx
inc ebx
mov eax, ebx
pop esi
pop ebx
leave
ret

Function at 0x432aea
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov eax, esi
call fcn.00432988
and word [ebp - 0xc], 0
and word [ebp - 2], 0
mov ebx, eax
lea eax, [ebp - 8]
push eax
mov word [ebp - 0x18], 0x20
mov word [ebp - 0x16], 0x2a
mov word [ebp - 0x14], 0x20
mov word [ebp - 0x12], si
mov word [ebp - 0x10], 0x3a
mov word [ebp - 0xe], 0x2c
mov word [ebp - 8], si
mov word [ebp - 6], 0x3a
mov word [ebp - 4], 0x5c
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
je 0x432b4a
cmp ebx, 2
je 0x432b5a
push 0
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x48aec0
call fcn.0042ee15
pop ebx
leave
ret
Function at 0x439b34
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
xor esi, esi
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
push esi
push esi
push dword [ebp + 8]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov ebx, eax
cmp ebx, esi
jne 0x439c5d
mov eax, dword [ebp - 0x10]
lea eax, [eax*4 + 8]
push eax
lea ecx, [ebp - 0x18]
call fcn.0042465d
cmp dword [ebp - 0x14], esi
mov dword [ebp - 0xc], esi
jle 0x439c55
push edi
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
push esi
push esi
push esi
shl eax, 2
push esi
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
push edi
push dword [ebp - 0xc]
mov dword [ebp - 8], esi
push dword [ebp + 8]
mov word [edi], si
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov ebx, eax
cmp ebx, esi
jne 0x439c45
cmp word [edi], si
je 0x439c45
mov eax, dword [ebp + 0x10]
push dword [eax]
lea ecx, [ebp - 4]
call fcn.0042a183
push 0x475ba4
lea ecx, [ebp - 4]
call fcn.004246c0
push edi
lea ecx, [ebp - 4]
call fcn.004246c0
push esi
push dword [ebp + 0xc]
push esi
push esi
push 4
push 4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
lea eax, [ebp - 8]
push eax
movzx eax, word [0x48ab68]
or eax, 0xf003f
push eax
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp dword [ebp - 8], esi
mov ebx, eax
je 0x439c3d
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp - 8]
call fcn.00439b34
add esp, 0xc
cmp dword [ebp - 8], esi
mov ebx, eax
je 0x439c3d
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 4]
call fcn.00424686
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jl 0x439b8b
pop edi
lea ecx, [ebp - 0x18]
call fcn.00424686
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x43d213
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
mov esi, ecx
push 0x48b5d4
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov bl, byte [esi + 9]
xor edi, edi
cmp dword [ebp + 0x10], edi
setl byte [ebp - 1]
and bl, 0x11
cmp byte [ebp - 1], 0
jne 0x43d247
test byte [ebp + 0x10], 0x40
je 0x43d249
xor bl, bl
mov esi, dword [ebp + 8]
push str.RANDOM
push esi
mov dword [ebp + 8], esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x43d29d
mov word [ebp - 0x4c], di
call fcn.004264c1
and edx, 0x7fffffff
push edx
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.0043417d
mov esi, dword [ebp + 0xc]
add esp, 0xc
push 3
mov ecx, esi
mov word [ebp - 0xe], di
call fcn.00424699
mov esi, dword [esi]
mov ax, word [ebp - 0x4c]
mov word [esi], ax
lea eax, [esi + 2]
jmp 0x43d3d0
push esi
call fcn.0046176a
cmp byte [ebp - 1], 0
mov edi, dword [ebp + 0xc]
movsx eax, bl
pop ecx
mov byte [ebp + 0x13], 0
mov dword [ebp - 8], eax
jne 0x43d2c9
cmp word [esi], 0x26
je 0x43d37b
test bl, bl
jne 0x43d354
push 0x52
mov ecx, edi
call fcn.00424699
mov esi, dword [edi]
and word [esi], 0
push 0
mov dword [ebp + 0xc], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [edi]
push 0x50
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebx, eax
test ebx, ebx
jle 0x43d333
cmp word [esi], 0
jne 0x43d32b
lea eax, [ebx + 0xc]
push eax
mov ecx, edi
call fcn.00424699
mov esi, dword [edi]
and word [esi], 0
push 0
mov dword [ebp + 0xc], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [edi]
add ebx, 0xa
push ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebx, eax
test ebx, ebx
jg 0x43d3cd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
jne 0x43d3c9
cmp byte [ebp + 0x13], 0
jne 0x43d3c7
cmp byte [ebp - 1], 0
mov byte [ebp + 0x13], 1
jne 0x43d3c7
mov ecx, dword [ebp - 0xc]
push 0xffffffffffffffff
xor ebx, ebx
push ebx
push dword [ebp + 8]
call fcn.0040e8be
cmp eax, ebx
jne 0x43d38a
cmp dword [ebp - 8], ebx
jne 0x43d398
cmp byte [ebp + 0x13], bl
jne 0x43d398
mov byte [ebp + 0x13], 1
jmp 0x43d2c9
add esi, 2
mov dword [ebp + 8], esi
mov dword [ebp - 8], 1
jmp 0x43d354
mov eax, dword [eax]
push eax
mov dword [ebp + 8], eax
call fcn.0046176a
pop ecx
mov ebx, eax
lea eax, [ebx + 2]
push eax
mov ecx, edi
call fcn.00424699
dec ebx
mov esi, dword [edi]
mov dword [ebp + 0xc], esi
js 0x43d3d3
lea eax, [ebx + 1]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov cx, word [ecx]
add dword [ebp + 0xc], 2
add dword [ebp + 8], 2
dec eax
mov word [edx], cx
jne 0x43d3ae
jmp 0x43d3d3
xor ebx, ebx
test ebx, ebx
jle 0x43d3d3
lea eax, [esi + ebx*2]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
and word [eax], 0
mov eax, 0x48b5d4
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc
Function at 0x43dcfa
Capabilities:
Parse credit card information
Query environment variable

Disassembly:
push ebp
mov ebp, esp
cmp byte [ecx + 0x4d], 0
jne 0x43dd0f
test byte [ecx + 9], 0xf
jne 0x43dd0f
pop ebp
jmp fcn.0043dc02
pop ebp
jmp fcn.0043cace

Function at 0x43dff9
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
mov ax, word [esi]
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
mov ecx, esi
xor edi, edi
cmp ax, bx
mov dword [ebp + 8], ecx
je 0x43e03e
mov edx, eax
mov eax, edx
call fcn.004213da
test al, al
jne 0x43e03e
cmp dx, 0x24
jne 0x43e031
xor edi, edi
inc edi
inc ecx
inc ecx
mov dx, word [ecx]
cmp dx, bx
mov dword [ebp + 8], ecx
jne 0x43e01d
mov ax, word [ecx]
call fcn.004213da
test al, al
je 0x43e05a
lea ecx, [ebp + 8]
call fcn.00429ef2
mov eax, dword [ebp + 8]
cmp word [eax], bx
jne 0x43e064
mov eax, 0x80070057
jmp 0x43e1b1
cmp edi, ebx
mov dword [ebp - 8], ebx
je 0x43e0ab
mov ecx, dword [ebp - 4]
push 1
push ebx
lea eax, [ebp - 8]
push eax
push esi
call fcn.0043cace
mov eax, dword [ebp - 8]
lea ecx, [ebp + 8]
mov dword [ebp + 8], eax
call fcn.00429ef2
mov esi, dword [ebp + 8]
lea eax, [ebp + 8]
push eax
mov dword [ebp + 8], esi
call fcn.00403977
mov eax, dword [ebp + 8]
cmp word [eax], bx
pop ecx
jne 0x43e0ab
mov esi, 0x80070057
jmp 0x43e1a7
push 5
push dword [ebp + 8]
mov edi, 0x100000
push str.st:
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], ebx
call fcn.004257a3
add esp, 0xc
test al, al
je 0x43e0f6
add dword [ebp + 8], 0xa
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 8]
push eax
call fcn.0042f308
mov edi, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
add edi, 0x1fff
adc eax, ebx
pop ecx
pop ecx
and edi, 0xffffe000
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], 4
mov dword [ebp - 0x1c], ebx
mov esi, 0x48b1a4
mov dword [ebp - 0x18], eax
push esi
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp - 0x1c]
push eax
push 0x10000
lea eax, [ebp - 0x2c]
push eax
push 0x43dd15
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
mov dword [ebp + 0xc], eax
je 0x43e147
mov dword [ebp - 0xc], ebx
jmp 0x43e157
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jne 0x43e154
xor eax, eax
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp + 0xc], ebx
je 0x43e18a
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp + 8], 0x270f
cmp dword [ebp - 0x20], ebx
je 0x43e181
push ebx
call edi
dec dword [ebp + 8]
jns 0x43e169
jmp 0x43e17c
push 1
call edi
cmp dword [ebp - 0x20], ebx
jne 0x43e178
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.__LastTID
push dword [ebp - 0x1c]
push dword [ebp - 4]
call fcn.0042d501
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [ebp - 0xc]
lea ecx, [ebp - 8]
call fcn.00424686
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x43e9ce
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x298
push ebx
push esi
push edi
push dword [ebp + 0xc]
call fcn.0046176a
mov esi, eax
mov eax, 0xb4
cmp esi, eax
pop ecx
jle 0x43e9f0
mov esi, eax
and dword [ebp - 0x298], 0
xor eax, eax
mov ecx, 0xa5
lea edi, [ebp - 0x294]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0x1c]
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xb0], eax
lea eax, [esi + esi]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x248]
push eax
mov byte [ebp - 0x250], 0x40
mov dword [ebp - 0x24c], edi
call fcn.00461a50
and word [ebp + esi*2 - 0x248], 0
add esp, 0xc
mov ebx, 0x48b1a4
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x48ab6c
push 0x10000
lea eax, [ebp - 0x298]
push eax
push 0x43e1b8
push 0x20000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [ebp + 0x18], eax
je 0x43eab8
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp + 0x1c], 0x270f
cmp dword [ebp - 0x24c], edi
jne 0x43eaaf
push 0
call esi
dec dword [ebp + 0x1c]
jns 0x43ea90
jmp 0x43eaa7
push 1
call esi
cmp dword [ebp - 0x24c], edi
je 0x43eaa3
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret
Function at 0x441a2a
Capabilities:
Hide graphical window

Disassembly:
push ebp
lea ebp, [esp - 0x68]
sub esp, 0x84
push ebx
push esi
xor ebx, ebx
cmp byte [ebp + 0x78], bl
push edi
mov edi, ecx
mov esi, dword [edi + 0x1c]
mov dword [ebp + 0x64], edi
mov word [ebp - 0x1c], bx
jne 0x441a98
push dword [ebp + 0x70]
lea ebx, [esi + 0x40]
mov ecx, ebx
call fcn.00409673
and dword [ebp + 0x4c], 0
xor eax, eax
mov dword [ebp + 0x48], 1
lea edi, [ebp + 0x50]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 0x74]
mov edi, dword [esi + 0x4c]
mov dword [ebp + 0x54], eax
lea eax, [ebp + 0x48]
push eax
push dword [ebp + 0x70]
push 0x133d
push dword [esi + 0x18]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebx]
mov eax, dword [eax + edi*4]
mov eax, dword [eax]
mov ebx, dword [eax + 0x18]
mov edi, dword [ebp + 0x64]
mov eax, dword [ebp + 0x70]
inc eax
push eax
lea eax, [ebp - 0x1c]
push 0x47ba30
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x47a470
lea ecx, [ebp + 0x78]
call fcn.0042a183
push dword [edi + 8]
lea ecx, [ebp + 0x78]
call fcn.004246c0
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp + 0x78]
call fcn.004246c0
push dword [ebp + 0x74]
mov ecx, dword [edi + 0x30]
push dword [ebp + 0x78]
call fcn.00428e1b
mov eax, dword [ebp + 0x7c]
test eax, eax
je 0x441af8
mov ecx, dword [eax]
test ecx, ecx
je 0x441af8
and dword [eax], 0
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebx, ebx
je 0x441b0c
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push ebx
call esi
push 5
push ebx
call esi
lea ecx, [ebp + 0x78]
call fcn.00424686
pop edi
pop esi
pop ebx
add ebp, 0x68
leave
ret 0x10
Function at 0x45a189
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmp dword [ebp - 0x6fc], 2
jne 0x45a246
and byte [ebp - 0x79c], 0
and byte [ebp - 0x79b], 0
mov byte [ebp - 0x79a], 0x10
and byte [ebp - 0x799], 0
inc dword [eax]
cmp dword [ebp - 0x6fc], 3
jne 0x45a2e7
and byte [ebp - 0x7ac], 0
and byte [ebp - 0x7ab], 0
mov byte [ebp - 0x7aa], 0xed
and byte [ebp - 0x7a9], 0
mov byte [ebp - 0x7a8], 0x4e
mov byte [ebp - 0x7a7], 0x55
push ebp
cmp dword [ebp - 0x6fc], 4
jne 0x45a391
and byte [ebp - 0x7bc], 0
and byte [ebp - 0x7bb], 0
mov byte [ebp - 0x7ba], 2
and byte [ebp - 0x7b9], 0
mov byte [ebp - 0x7b8], 0xa1
jmp dword [ecx - 0x7b67a3a]
invalid
push dword [edx - 0x7b57a3a]
invalid
push dword [ecx - 0x7b47a3a]
invalid
invalid
mov eax, 0xf84c85c6
invalid
dec edi
mov byte [ebp - 0x7b3], 0xce
mov byte [ebp - 0x7b2], 0xd3
mov byte [ebp - 0x7b1], 0x99
mov byte [ebp - 0x7b0], 0x91
mov byte [ebp - 0x7af], 0x91
xchg ecx, eax
cmp dword [ebp - 0x6fc], 5
jne 0x45a432
and byte [ebp - 0x7cc], 0
and byte [ebp - 0x7cb], 0
movsd dword es:[edi], dword [esi]
xor eax, 0xfffff8
cmp dword [ebp - 0x6fc], 6
jne 0x45a4d0
and byte [ebp - 0x7dc], 0
and byte [ebp - 0x7db], 0
mov byte [ebp - 0x7da], 0x11
and byte [ebp - 0x7d9], 0
mov byte [ebp - 0x7d8], 0xb2
mov byte [ebp - 0x7d7], 0x8b
mov byte [ebp - 0x7d6], 0x9c
mov byte [ebp - 0x7d5], 0x9c
mov byte [ebp - 0x7d4], 0x81
mov byte [ebp - 0x7d3], 0x9c
mov byte [ebp - 0x7d2], 0xc0
mov byte [ebp - 0x7d1], 0x82
mov byte [ebp - 0x7d0], 0x81
mov byte [ebp - 0x7cf], 0x89
mov byte [ebp - 0x7ce], 0xee
push 0xb
lea eax, [ebp - 0x7dc]
push eax
call fcn.0045856d
pop ecx
push eax
mov eax, dword [ebp - 0x338]
lea eax, [ebp + eax - 0x230]
push eax
call fcn.004584ce
add esp, 0xc
jmp 0x45a4d5
jmp 0x45a603
cmp dword [ebp - 0x37c], 0
jne 0x45a6ad
mov eax, dword [ebp - 0x748]
mov dword [ebp - 0x7ec], eax
mov eax, dword [ebp - 0x38c]
mov dword [ebp - 0x7e8], eax
and dword [ebp - 0x7e0], 0
push 0x1000
push 8
push dword [ebp - 0x674]
call dword [ebp - 0x67c]
mov dword [ebp - 0x7e4], eax
push dword [ebp - 0x7e4]
lea eax, [ebp - 0x7ec]
push eax
push dword [ebp - 0x748]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00458739
add esp, 0x14
mov dword [ebp - 0x7e0], eax
cmp dword [ebp - 0x7e0], 0
je 0x45a699
lea eax, [ebp - 0x714]
push eax
call fcn.0045856d
pop ecx
push eax
push dword [ebp - 0x7e0]
call fcn.00458602
pop ecx
pop ecx
mov dword [ebp - 0x37c], eax
push dword [ebp - 0x7e4]
push 1
push dword [ebp - 0x674]
call dword [ebp - 0x39c]
push dword [ebp + 0x1c]
push dword [ebp - 0xc]
push dword [ebp - 0x540]
push dword [ebp - 0x684]
push dword [ebp - 0x688]
push dword [ebp - 0x3ac]
push dword [ebp - 0x400]
push dword [ebp - 0x54c]
push dword [ebp - 0x678]
lea eax, [ebp - 0x334]
push eax
push dword [ebp - 4]
push dword [ebp + 8]
call dword [ebp - 0x37c]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4612e9
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
and eax, 0xffdf
cmp ax, 0x41
je 0x461307
cmp ax, 0x42
je 0x461307
push 0xfffffffffffffffe
pop eax
leave
ret
and word [ebp - 4], 0
mov word [ebp - 8], ax
lea eax, [ebp - 8]
push eax
mov word [ebp - 6], 0x3a
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
xor ecx, ecx
cmp eax, 2
setne cl
mov eax, ecx
leave
ret

Function at 0x46148c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
pop ebp
ret

Function at 0x464ebf
Capabilities:
Terminate process

Disassembly:
push 8
push 0x47da88
call fcn.00464048
push 8
call fcn.00466952
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x48bb04], esi
jne 0x464ef3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x48bb00], esi
mov al, byte [ebp + 0x10]
mov byte [0x48bafc], al
cmp dword [ebp + 0xc], edi
jne 0x464f3d
cmp dword [0x48c468], edi
je 0x464f2d
mov eax, dword [0x48c464]
sub eax, 4
mov dword [0x48c464], eax
cmp eax, dword [0x48c468]
jb 0x464f2d
mov eax, dword [eax]
cmp eax, edi
je 0x464f0e
call eax
jmp 0x464f0e
push 0x4890dc
mov eax, 0x4890d4
call fcn.00464e3d
pop ecx
push 0x4890e8
mov eax, 0x4890e0
call fcn.00464e3d
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x464f6e
cmp dword [ebp + 0x10], edi
jne 0x464f7c
mov dword [0x48bb04], esi
push dword [ebp + 8]
call fcn.00464dfb
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x464f7b
push 8
call fcn.0046689d
pop ecx
ret
call fcn.00464083
ret