joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002e540
Capabilities:
Check http status code
Get http content length

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 8
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x20]
push edx
push 0x20000013
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x1002e5b0
cmp dword [ebp - 0x20], 0xc8
jne 0x1002e5a1
cmp dword [ebp - 0x1c], 0
je 0x1002e5b8
cmp dword [ebp - 0x20], 0x12e
jne 0x1002e5b0
cmp dword [ebp - 0x1c], 0
je 0x1002e5b8
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
jmp 0x1002e60d
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 8
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x20]
push eax
push 0x20000005
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
jne 0x1002e5fb
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
jmp 0x1002e60d
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x1002e860
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10035599
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x10044710]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x48]
call fcn.10003160
mov dword [ebp - 4], 0
mov ecx, dword [0x1003dfb8]
push ecx
push 0x1003a4cc
lea ecx, [ebp - 0x48]
call fcn.10019400
mov dword [ebp - 0x54], eax
push 0x1003a4d0
lea ecx, [ebp - 0x4c]
call fcn.10019430
mov byte [ebp - 4], 1
mov dword [ebp - 0x50], 0xffffffff
mov edx, dword [ebp - 0x54]
cmp edx, dword [0x1003dfb8]
je 0x1002e993
mov eax, dword [ebp - 0x54]
push eax
push 0
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x48]
call fcn.10017b00
mov dword [ebp - 0x64], eax
mov edx, dword [ebp - 0x64]
mov dword [ebp - 0x68], edx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x68]
call fcn.10003230
push eax
lea ecx, [ebp - 0x4c]
call fcn.10017f30
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.10003210
lea ecx, [ebp - 0x4c]
call fcn.10013280
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1002e977
push 0x1003a4d4
lea ecx, [ebp - 0x58]
call fcn.100194b0
mov byte [ebp - 4], 3
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x4c]
push ecx
lea edx, [ebp - 0x5c]
push edx
call fcn.10019530
add esp, 0xc
mov dword [ebp - 0x6c], eax
push 0
mov ecx, dword [ebp - 0x6c]
call fcn.10013280
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
lea ecx, [ebp - 0x5c]
call fcn.10017f10
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x58]
call fcn.10017f10
push 0
push 0x80
push 2
push 0
push 5
push 2
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x50]
mov dword [ebp - 0x60], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call fcn.10017f10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.10003210
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001cc35
mov esp, ebp
pop ebp
ret
Function at 0x1002e9d0
Capabilities:
Delete file
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x212c
call fcn.1002d420
mov eax, dword [0x10044710]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x212c], ecx
mov byte [ebp - 0x108], 0
push 0xff
push 0
lea eax, [ebp - 0x107]
push eax
call fcn.1001d9c0
add esp, 0xc
mov ecx, dword [ebp - 0x212c]
add ecx, 0x1c
call fcn.10003230
push eax
call fcn.1002e860
add esp, 4
mov dword [ebp - 0x10c], eax
mov byte [ebp - 0x115], 1
cmp dword [ebp - 0x10c], 0xffffffff
jne 0x1002ea3e
xor al, al
jmp 0x1002ebf1
mov ecx, dword [ebp - 0x212c]
cmp dword [ecx + 0x50], 0
je 0x1002ea6d
mov edx, dword [ebp - 0x212c]
mov eax, dword [edx + 0x3c]
push eax
mov ecx, dword [ebp - 0x212c]
call fcn.1002e540
mov ecx, dword [ebp - 0x212c]
mov ecx, dword [ecx + 0x50]
mov dword [ecx], eax
mov dword [ecx + 4], edx
lea edx, [ebp - 0x10c]
push edx
lea ecx, [ebp - 0x114]
call fcn.100179e0
mov dword [ebp - 0x2124], 0x2000
mov byte [ebp - 0x2120], 0
push 0x1fff
push 0
lea eax, [ebp - 0x211f]
push eax
call fcn.1001d9c0
add esp, 0xc
lea ecx, [ebp - 0x120]
push ecx
push 0x2000
lea edx, [ebp - 0x2120]
push edx
mov eax, dword [ebp - 0x212c]
mov ecx, dword [eax + 0x3c]
push ecx
call dword [sym.imp.WININET.dll_InternetReadFile]
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
je 0x1002eb44
cmp dword [ebp - 0x120], 0
je 0x1002eb44
mov edx, dword [ebp - 0x212c]
cmp dword [edx + 0x54], 0
je 0x1002eb11
mov eax, dword [ebp - 0x212c]
mov ecx, dword [eax + 0x54]
mov edx, dword [ebp - 0x120]
xor eax, eax
add edx, dword [ecx]
adc eax, dword [ecx + 4]
mov ecx, dword [ebp - 0x212c]
mov ecx, dword [ecx + 0x54]
mov dword [ecx], edx
mov dword [ecx + 4], eax
push 0
lea edx, [ebp - 0x120]
push edx
mov eax, dword [ebp - 0x120]
push eax
lea ecx, [ebp - 0x2120]
push ecx
mov edx, dword [ebp - 0x10c]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1002eb42
mov byte [ebp - 0x115], 0
jmp 0x1002eb72
jmp 0x1002eb65
cmp dword [ebp - 0x11c], 0
jne 0x1002eb63
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x212c]
mov dword [ecx + 0x4c], eax
mov byte [ebp - 0x115], 0
jmp 0x1002eb72
mov edx, 1
test edx, edx
jne 0x1002ea7f
movzx eax, byte [ebp - 0x115]
test eax, eax
je 0x1002eb8c
mov ecx, dword [ebp - 0x212c]
call fcn.1002e730
test eax, eax
jne 0x1002ebd9
mov ecx, dword [ebp - 0x212c]
cmp dword [ecx + 0x4c], 0xffffffff
jne 0x1002ebaa
mov edx, dword [ebp - 0x212c]
mov eax, dword [ebp - 0x212c]
mov ecx, dword [eax + 0x48]
mov dword [edx + 0x4c], ecx
mov ecx, dword [ebp - 0x212c]
add ecx, 0x1c
call fcn.10003230
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 0x2125], 0
lea ecx, [ebp - 0x114]
call fcn.10017a00
mov al, byte [ebp - 0x2125]
jmp 0x1002ebf1
mov byte [ebp - 0x2126], 1
lea ecx, [ebp - 0x114]
call fcn.10017a00
mov al, byte [ebp - 0x2126]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001cc35
mov esp, ebp
pop ebp
ret
Function at 0x1002ec00
Capabilities:
Check internet connectivity via wininet
Create http request

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003573d
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x10044710]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x34], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x2c]
call fcn.10003160
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x2c]
push edx
call fcn.10030770
add esp, 8
movzx eax, al
neg eax
sbb eax, eax
add eax, 1
mov byte [ebp - 0x35], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.10003210
movzx ecx, byte [ebp - 0x35]
test ecx, ecx
je 0x1002ec7d
xor al, al
jmp 0x1002ece3
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp + 0xc]
mov dword [edx + 0x40], eax
push 0
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
mov edx, dword [ebp - 0x34]
and edx, 4
sub edx, 4
neg edx
sbb edx, edx
and edx, 4
mov dword [ebp - 0x30], edx
push 0
push 0
push 0
mov eax, dword [ebp - 0x30]
push eax
push str.Mozilla_4.0__compatible__MSIE_7.0__Windows_NT_5.2__.NET_CLR_1.1.4322__.NET_CLR_2.0.50727_
call dword [sym.imp.WININET.dll_InternetOpenA]
mov ecx, dword [ebp - 0x3c]
mov dword [ecx + 0x38], eax
mov edx, dword [ebp - 0x3c]
cmp dword [edx + 0x38], 0
jne 0x1002ecd9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x3c]
mov dword [ecx + 0x4c], eax
xor al, al
jmp 0x1002ece3
mov ecx, dword [ebp - 0x3c]
call fcn.1002e620
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001cc35
mov esp, ebp
pop ebp
ret 8

Function at 0x1002f9a0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov byte [eax + 0x10], 1
push 0x2710
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1002f9dc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x1002f9eb
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1002fdd0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x10044710]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 4], str.common
mov dword [ebp - 0x30], str.revision
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x38]
call fcn.1002fd30
lea ecx, [ebp - 0x28]
call fcn.10003230
push eax
push 0
mov ecx, dword [ebp - 0x30]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 0x2c], eax
push 1
mov eax, dword [ebp - 0x30]
push eax
call fcn.10031cc0
add esp, 8
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x2c]
cmp ecx, dword [ebp - 8]
jg 0x1002fe43
mov byte [ebp - 0x31], 0
lea ecx, [ebp - 0x28]
call fcn.10003210
mov al, byte [ebp - 0x31]
jmp 0x1002fe52
mov byte [ebp - 0x32], 1
lea ecx, [ebp - 0x28]
call fcn.10003210
mov al, byte [ebp - 0x32]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1001cc35
mov esp, ebp
pop ebp
ret

Function at 0x1002fe60
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10035a7e
mov eax, dword fs:[0]
push eax
mov eax, 0x1004c
call fcn.1002d420
mov eax, dword [0x10044710]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10058], ecx
mov eax, dword [ebp + 0xc]
push eax
push 0x8000
lea ecx, [ebp - 0x1004c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.10003230
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jne 0x1002fec4
xor eax, eax
jmp 0x1002ffb3
cmp dword [ebp - 0x4c], 0x7ffe
jb 0x1002fed5
or eax, 0xffffffff
jmp 0x1002ffb3
lea ecx, [ebp - 0x2c]
call fcn.10003130
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x48]
call fcn.10003130
mov byte [ebp - 4], 1
mov dword [ebp - 0x10050], 0
jmp 0x1002ff0b
mov edx, dword [ebp - 0x10050]
add edx, 1
mov dword [ebp - 0x10050], edx
mov eax, dword [ebp - 0x10050]
cmp eax, dword [ebp - 0x4c]
jae 0x1002ff88
lea ecx, [ebp - 0x2c]
call fcn.10009df0
lea ecx, [ebp - 0x48]
call fcn.10009df0
lea ecx, [ebp - 0x48]
push ecx
lea edx, [ebp - 0x2c]
push edx
mov eax, dword [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x10050]
push ecx
lea edx, [ebp - 0x1004c]
push edx
mov ecx, dword [ebp - 0x10058]
call fcn.1002fc40
lea ecx, [ebp - 0x2c]
call fcn.10009e10
movzx eax, al
test eax, eax
jne 0x1002ff83
lea ecx, [ebp - 0x48]
call fcn.10009e10
movzx ecx, al
test ecx, ecx
jne 0x1002ff83
lea ecx, [ebp - 0x48]
call fcn.10003230
push eax
lea ecx, [ebp - 0x2c]
call fcn.10003230
push eax
call fcn.10031c40
add esp, 8
jmp 0x1002fefc
mov dword [ebp - 0x10054], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x48]
call fcn.10003210
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.10003210
mov eax, dword [ebp - 0x10054]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001cc35
mov esp, ebp
pop ebp
ret 8
Function at 0x10030540
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0
push 0
mov eax, dword [ebp - 4]
push eax
push 0x100304b0
push 0
push 0
call fcn.1001ec86
add esp, 0x18
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x14], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x14], 0
jne 0x10030574
or eax, 0xffffffff
jmp 0x10030576
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10030c70
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4018
call fcn.1002d420
mov eax, dword [0x10044710]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x4018], ecx
mov dword [ebp - 0x4014], 0
xor eax, eax
mov word [ebp - 4], ax
push 0x4000
push 0
lea ecx, [ebp - 0x4010]
push ecx
call fcn.1001d9c0
add esp, 0xc
mov ecx, dword [ebp - 0x4018]
call fcn.10003230
push eax
push 0x2000
lea edx, [ebp - 0x4010]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [str.participation]
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [ebp - 8], eax
xor eax, eax
mov ecx, dword [ebp - 8]
mov word [ebp + ecx*2 - 0x4010], ax
lea edx, [ebp - 0x4010]
push edx
mov ecx, dword [ebp + 8]
call fcn.10003160
mov eax, dword [ebp - 0x4014]
or eax, 1
mov dword [ebp - 0x4014], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1001cc35
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10031030
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100356a6
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x10044710]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x68], ecx
lea eax, [ebp - 0x2c]
push eax
call fcn.10030870
add esp, 4
mov dword [ebp - 0x6c], eax
mov ecx, dword [ebp - 0x6c]
mov dword [ebp - 0x70], ecx
mov dword [ebp - 4], 0
push 0x5c
mov edx, dword [ebp - 0x70]
push edx
lea eax, [ebp - 0x48]
push eax
call fcn.10007af0
add esp, 0xc
mov dword [ebp - 0x74], eax
mov ecx, dword [ebp - 0x74]
mov dword [ebp - 0x78], ecx
mov byte [ebp - 4], 1
push str.crashreport.exe
mov edx, dword [ebp - 0x78]
push edx
lea eax, [ebp - 0x64]
push eax
call fcn.10007b30
add esp, 0xc
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x48]
call fcn.10003210
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.10003210
lea ecx, [ebp - 0x64]
push ecx
call fcn.10030590
add esp, 4
movzx edx, al
test edx, edx
jne 0x100310e3
lea ecx, [ebp - 0x64]
call fcn.10003210
jmp 0x10031107
push 1
push 0
push str.removeLog
lea ecx, [ebp - 0x64]
call fcn.10003230
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x64]
call fcn.10003210
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001cc35
mov esp, ebp
pop ebp
ret
Function at 0x10031120
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100356db
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x10044710]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x68], ecx
mov eax, dword [ebp - 0x68]
cmp dword [eax + 0x1c], 3
jl 0x10031160
mov ecx, dword [ebp - 0x68]
cmp dword [ecx + 0x1c], 0x16e360
jle 0x10031165
jmp 0x10031211
lea edx, [ebp - 0x2c]
push edx
call fcn.10030870
add esp, 4
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x70], eax
mov dword [ebp - 4], 0
push 0x5c
mov ecx, dword [ebp - 0x70]
push ecx
lea edx, [ebp - 0x48]
push edx
call fcn.10007af0
add esp, 0xc
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x78], eax
mov byte [ebp - 4], 1
push 0x1003ddd0
mov ecx, dword [ebp - 0x78]
push ecx
lea edx, [ebp - 0x64]
push edx
call fcn.10007b30
add esp, 0xc
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x48]
call fcn.10003210
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.10003210
lea eax, [ebp - 0x64]
push eax
call fcn.10030590
add esp, 4
movzx ecx, al
test ecx, ecx
jne 0x100311ed
lea ecx, [ebp - 0x64]
call fcn.10003210
jmp 0x10031211
push 1
push 0
push str.reportLog
lea ecx, [ebp - 0x64]
call fcn.10003230
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x64]
call fcn.10003210
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001cc35
mov esp, ebp
pop ebp
ret
Function at 0x423300
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lahf
adc esi, eax
inc ebp
mov al, byte [0xa145c633]
mov byte cs:[ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.00422f27
push eax
push esi
push dword [ebp + 8]
call fcn.00422edc
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00422f27
push eax
push esi
push dword [ebp + 8]
jne 0x42338a
Function at 0x10007830
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1000ba65
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x10011008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x1050
call fcn.1000a08d
mov esi, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
push 0x1050
push 0
push esi
call sub.VCRUNTIME140.dll_memset
lea ecx, [esi + 0x44]
mov dword [esi], 0
mov eax, ecx
mov dword [esi + 4], 0
neg eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
lea edx, [esi + 0x1044]
mov dword [esi + 0x10], 0
and eax, 3
mov dword [esi + 0x14], 0
add esp, 0x10
mov dword [esi + 0x18], 0
add eax, ecx
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [ebp - 0x14], esi
mov dword [edx], 0
mov dword [esi + 0x1048], 0
mov dword [esi + 0x38], ecx
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edx
mov byte [ebp - 4], 2
mov dword [esi + 0x104c], 0
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov dword [edi], esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0x30ce4f2a
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x61ac009d
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x1000876e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x1000877d
pop dword [ebp - 0x40]
mov eax, 0xddc8dd3b
add eax, 0x3237aa42
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xd34fe9fb
add dword [ebp - 0x50], 0x7b025b50
mov dword [ebp - 0x4c], 0x34e4e621
add dword [ebp - 0x4c], 0xfd4e6624
mov dword [ebp - 0x48], 0x7bed578d
sub dword [ebp - 0x48], 0x2fa1135f
mov dword [ebp - 0x44], 0x72bbe440
add dword [ebp - 0x44], 0x8d441bc0
lea eax, [ebp - 0x50]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xf653528e
sub dword [ebp - 0x50], 0x81e0e938
mov dword [ebp - 0x4c], 0x80fed1dd
add dword [ebp - 0x4c], 0xc06d8f98
mov dword [ebp - 0x48], 0xe4548154
sub dword [ebp - 0x48], 0x80e514e8
mov dword [ebp - 0x44], 0x6018ea67
sub dword [ebp - 0x44], 0x6018ea67
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0x32edec87
add eax, 0xdd1224f1
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x3d99b
push 0
call eax
mov ecx, 0x48b6
xor esi, esi
add esi, eax
mov edx, 0xcdb647e0
sub edx, 0xbdb479e0
add edx, dword [ebp - 0x40]
mov edi, 0xd674bbee
add edi, 0x6fa14f1
xor dword [ebp - 0x24], 0x2f7808c2
mov ebx, dword [edx]
xor dword [ebp - 8], edx
add ebx, edi
mov dword [ebp - 0x1c], 0xec9e5951
mov dword [esi], ebx
add esi, 4
add edx, 0xccd2cdd0
add edx, 0x332d3234
loop 0x10008896
add eax, 0x115ab
xor ebx, ebx
add ebx, eax
add eax, 0x7fe1793c
add eax, 0x801e86c9
mov ecx, 0x10000000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x41ac70
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x496f1b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00489483
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x41acf2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00486eaa
mov eax, dword [eax]
push 0x8f9270
push eax
call fcn.004787c4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0048970e
test bl, bl
je 0x41acf2
push 0x8f9270
lea ecx, [esp + 0xc]
call fcn.00489aea
push 0x8fcdd8
lea ecx, [esp + 0xc]
call fcn.00489aea
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x41ad2e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0048970e
jmp 0x41adf9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x41adb2
lea edx, [esp + 0x7c]
push 0x8fcdd4
push edx
call fcn.004787c4
add esp, 8
test eax, eax
je 0x41adb2
lea eax, [esp + 0x7c]
push 0x8fcdd0
push eax
call fcn.004787c4
add esp, 8
test eax, eax
je 0x41adb2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41ad42
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0048970e
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x41b610
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x41b672
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc