joyce8/EMBER2024-capa huggingface dataset:
Function at 0x443360
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov eax, dword [esi + 0xcb0]
mov dword [esi + 0xc24], edi
test edi, edi
je 0x443390
push 4
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [esi + 0xc24], edi
pop edi
pop esi
pop ebp
ret 8
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [esi + 0xc24], edi
pop edi
pop esi
pop ebp
ret 8

Function at 0x448f20
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
push edi
mov eax, dword [edi]
call dword [eax + 0x54]
push 2
push edi
mov esi, eax
call fcn.0041d6e0
push 1
push edi
call fcn.0041d080
cmp esi, 4
jne 0x448f6c
push 5
push 0
push 0
lea eax, [edi + 0xcb0]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
push 0
push 0x21
mov ecx, edi
call fcn.0041b920
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x448f80
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push 5
push 0
push 0
add eax, 0xcb0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop ebp
ret 4

Function at 0x450ee0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
push 1
lea eax, [edi + 0xcb0]
push eax
push edi
call fcn.0041b790
test eax, eax
je 0x450f4e
mov eax, dword [edi]
push edi
call dword [eax + 0x194]
push 0
push 0
push 1
push 0
mov dword [ebp + 8], 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 1
push 0
mov dword [edi + 0xdc0], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0xdc4], eax
lea eax, [ebp + 8]
push eax
push 0
push edi
push 0x450cd0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0xdbc], eax
pop edi
pop ebp
ret 4

Function at 0x452f70
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, ecx
push edi
mov dword [ebp - 4], eax
mov edi, dword [eax + 0xffc]
mov ecx, edi
mov eax, dword [eax + 0x1000]
cmp edi, eax
cmovge ecx, eax
cmovle edi, eax
mov dword [ebp - 8], ecx
cmp edi, ecx
je 0x453006
sub edi, ecx
push ebx
add edi, edi
push esi
lea eax, [edi + 2]
push eax
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [ebp - 4]
mov esi, eax
mov eax, dword [ebp - 8]
push edi
mov ecx, dword [ecx + 0xfcc]
lea ecx, [ecx + eax*2]
push ecx
push esi
call fcn.00478b30
add esp, 0xc
xor eax, eax
mov word [edi + esi], ax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 4]
push dword [eax + 0xc38]
call dword [sym.imp.USER32.dll_OpenClipboard]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push ebx
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x453ce0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push esi
mov esi, ecx
test dword [esi + 0xfe4], 0x800
jne 0x453d2e
push edi
push dword [esi + 0xc38]
call dword [sym.imp.USER32.dll_OpenClipboard]
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
test edi, edi
je 0x453d26
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push 1
push 1
push eax
push 1
mov ecx, esi
call fcn.004545a0
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
pop edi
pop esi
jmp dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
ret
Function at 0x45d690
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a0273
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4c8748]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.00430240
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 1
mov dword [esi + 0x28], 0
xor eax, eax
mov dword [esi], vtable.duImageStyle.0
lea ecx, [esi + 0x4c]
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
push eax
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push 0x4a2878
mov dword [ebp - 4], 0
mov word [ecx], ax
call fcn.00404110
xor eax, eax
mov dword [esi + 0x74], 0
lea ecx, [esi + 0x64]
mov byte [ebp - 4], 1
mov dword [ecx + 0x14], 7
push eax
push 0x4a2878
mov word [ecx], ax
call fcn.00404110
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x45d7a0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a0298
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4c8748]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.00430240
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 1
mov dword [esi + 0x28], 0
xor eax, eax
mov dword [esi], vtable.duLineStyle.0
lea ecx, [esi + 0x34]
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 1
push eax
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push 0x4a2878
mov dword [ebp - 4], 0
mov word [ecx], ax
call fcn.00404110
push 0
push 0
lea ecx, [esi + 0x4c]
call fcn.0042e6f0
push 0
push 0
lea ecx, [esi + 0x54]
call fcn.0042e6f0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x45d870
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a0298
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4c8748]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.00430240
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 1
mov dword [esi + 0x28], 0
xor eax, eax
mov dword [esi], vtable.duRectStyle.0
lea ecx, [esi + 0x40]
mov dword [esi + 0x2c], 0xffffff
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 1
push eax
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push 0x4a2878
mov dword [ebp - 4], 0
mov word [ecx], ax
call fcn.00404110
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x45d940
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a02de
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4c8748]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.00430240
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 1
mov dword [esi + 0x28], 0
xor eax, eax
mov dword [esi], vtable.duTextStyle.0
lea ecx, [esi + 0x34]
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 1
push eax
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push 0x4a2878
mov dword [ebp - 4], 0
mov word [ecx], ax
call fcn.00404110
xor eax, eax
mov dword [esi + 0x5c], 0
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 1
mov dword [ecx + 0x14], 7
push eax
push 0x4a2878
mov word [ecx], ax
call fcn.00404110
xor eax, eax
mov dword [esi + 0x74], 0
lea ecx, [esi + 0x64]
mov byte [ebp - 4], 2
mov dword [ecx + 0x14], 7
push eax
push 0x4a2878
mov word [ecx], ax
call fcn.00404110
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x460100
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x460235
cmp word [esi], 0
je 0x460235
mov ecx, dword [ebp + 8]
call fcn.0045fe40
push 0
push 0
push 3
push 0
push 7
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x460235
test esi, esi
je 0x460235
push ebx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
test ebx, ebx
je 0x460224
push edi
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
mov dword [ebp + 0xc], 0
lea eax, [ebp + 0xc]
push eax
push 0
push edi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
cmp dword [ebp + 0xc], 0
jne 0x46019e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push 0
lea ecx, [ebp - 4]
mov dword [ebp - 4], 0
push ecx
push ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4601fb
mov ecx, dword [ebp + 8]
push dword [ebp + 0xc]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x40]
test eax, eax
je 0x4601fb
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop ebx
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x460d20
Capabilities:
Delete file
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x4c8748]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
test ebx, ebx
je 0x460e5e
cmp dword [ebp + 0x10], 0
jle 0x460e5e
mov eax, dword [edi + 0x210]
test eax, eax
je 0x460d69
push eax
call dword [sym.imp.USER32.dll_DestroyCursor]
mov dword [edi + 0x210], 0
lea eax, [ebp - 0x414]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x460e5e
cmp eax, 0x104
ja 0x460e5e
lea eax, [ebp - 0x20c]
push eax
push 0
push 0x4ad4c8
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x460e5e
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x460e5e
test esi, esi
je 0x460e5e
push 0
lea eax, [ebp - 0x418]
mov dword [ebp - 0x418], 0
push eax
push dword [ebp + 0x10]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
test eax, eax
je 0x460e4b
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x50
push 0
push 0
push 2
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.USER32.dll_LoadImageW]
mov dword [edi + 0x210], eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [edi + 0x210]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047702f
mov esp, ebp
pop ebp
ret 0xc
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047702f
mov esp, ebp
pop ebp
ret 0xc
Function at 0x463cb0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x4c8748]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x463d09
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x463ce9
cmp dword [ebp - 8], 0x103
jne 0x463d09
push 0
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x463d09
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047702f
mov esp, ebp
pop ebp
ret
push ebx
lea eax, [esi + 8]
push eax
push 4
push esi
push 0x463d50
push 0
push 0
call fcn.0047f7b9
xor ebx, ebx
mov dword [esi + 4], eax
add esp, 0x18
test eax, eax
setne bl
test eax, eax
je 0x463d37
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop ebx
xor ecx, ebp
pop esi
call fcn.0047702f
mov esp, ebp
pop ebp
ret

Function at 0x463f50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x4c8748]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x18]
push edi
xor edi, edi
mov dword [ebp - 0x428], eax
mov eax, esi
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], edi
jb 0x463f84
mov eax, dword [esi]
xor ecx, ecx
mov word [eax], cx
mov eax, reloc.OLEAUT32.dll_SysReAllocString
mov ecx, dword [ebp + 8]
cmp ecx, 1
jne 0x463f9d
mov eax, SysReAllocString
jmp 0x463fb1
cmp ecx, 2
jne 0x463fa9
mov eax, SysReAllocString
jmp 0x463fb1
cmp ecx, 3
mov edx, eax
cmove eax, edx
mov ecx, dword [ebp + 0x14]
mov edx, 0x20019
cmp ecx, 0x40
je 0x463fc3
cmp ecx, 1
jne 0x463fc8
mov edx, 0x20119
lea ecx, [ebp - 0x424]
mov dword [ebp - 0x424], edi
push ecx
push edx
push 0
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x463ff7
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047702f
mov esp, ebp
pop ebp
ret
push 0x412
lea eax, [ebp - 0x418]
mov dword [ebp - 0x41c], 0x208
push 0
push eax
call fcn.00478960
add esp, 0xc
mov dword [ebp - 0x420], 1
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x420]
push eax
push 0
push dword [ebp - 0x428]
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x46407a
lea edx, [ebp - 0x418]
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x464057
sub edx, ecx
lea eax, [ebp - 0x418]
sar edx, 1
mov ecx, esi
push edx
push eax
call fcn.00404110
mov edi, 1
mov ecx, dword [ebp - 0x424]
test ecx, ecx
je 0x46408b
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047702f
mov esp, ebp
pop ebp
ret
Function at 0x465630
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x4c8748]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
test esi, esi
je 0x46577a
push 0x228
lea eax, [ebp - 0x240]
mov dword [ebp - 0x244], 0x22c
push ebx
push eax
call fcn.00478960
add esp, 0xc
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x46577a
lea eax, [ebp - 0x244]
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x465760
nop word [eax + eax]
lea eax, [ebp - 0x220]
push esi
push eax
call fcn.00480f49
add esp, 8
test eax, eax
je 0x4656df
lea eax, [ebp - 0x244]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4656a0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047702f
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0xc], 0
mov ebx, 1
je 0x465760
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea eax, [ebp - 0x10]
xorps xmm0, xmm0
push eax
push str.SeShutdownPrivilege
push 0
movups xmmword [ebp - 0x14], xmm0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0
push 0
push 0x10
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
push eax
push 0
push dword [ebp - 0x18]
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [ebp - 0x23c]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047702f
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047702f
mov esp, ebp
pop ebp
ret
Function at 0x4664a0
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x4664de
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4664de
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test al, 0x10
jne 0x4664de
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 1
je 0x4664d7
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop esi
pop ebp
ret

Function at 0x4665a0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x18], 0
pop ebp
ret
Function at 0x475240
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a12eb
mov eax, dword fs:[0]
push eax
mov eax, 0x293c
call fcn.00477760
mov eax, dword [0x4c8748]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x2890]
push 0x2880
push 0
push eax
mov dword [ebp - 0x2930], edi
call fcn.00478960
add esp, 0xc
mov dword [ebp - 0x2894], 0x2880
lea eax, [ebp - 0x2894]
push eax
lea eax, [ebp - 0x2890]
push eax
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x47544d
lea esi, [ebp - 0x2890]
nop dword [eax + eax]
mov eax, dword [esi + 0x1a0]
cmp eax, 6
je 0x4752db
cmp eax, 0x17
je 0x4752db
mov esi, dword [esi]
test esi, esi
jne 0x4752c0
jmp 0x47544d
push 0x98
lea eax, [ebp - 0x292c]
push 0
push eax
call fcn.00478960
add esp, 0xc
lea ecx, [ebp - 0x292c]
push 1
push 2
call fcn.004717b0
mov dword [ebp - 4], 0
xor edi, edi
nop dword [eax]
mov eax, dword [ebp - 0x292c]
lea ecx, [ebp - 0x2918]
push 0
push 2
mov eax, dword [eax + 4]
add ecx, eax
mov eax, dword [ecx]
and eax, 0xfffff9ff
or eax, 0x800
mov dword [ecx], eax
lea eax, [ebp - 0x2940]
push eax
call fcn.004762d2
mov ecx, dword [ebp - 0x292c]
lea edx, [ebp - 0x292c]
push dword [eax + 0xc]
mov ecx, dword [ecx + 4]
push dword [eax + 8]
mov eax, dword [eax]
add ecx, edx
push ecx
call eax
mov eax, dword [ebp - 0x292c]
lea ecx, [ebp - 0x292c]
add esp, 0x18
mov eax, dword [eax + 4]
mov byte [ebp + eax - 0x28ec], 0x30
movzx eax, byte [esi + edi + 0x194]
push eax
call fcn.00474bf0
inc edi
cmp edi, 6
jl 0x475310
lea eax, [ebp - 0x2948]
push eax
lea ecx, [ebp - 0x292c]
call fcn.00474580
mov edi, dword [ebp - 0x2930]
mov esi, eax
cmp edi, esi
je 0x47540c
mov ecx, dword [edi + 0x14]
cmp ecx, 0x10
jb 0x4753da
mov eax, dword [edi]
inc ecx
cmp ecx, 0x1000
jb 0x4753d0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x475470
mov eax, edx
push ecx
push eax
call fcn.00476d79
add esp, 8
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
movups xmm0, xmmword [esi]
movups xmmword [edi], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [edi + 0x10], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov edx, dword [ebp - 0x2934]
cmp edx, 0x10
jb 0x475442
mov ecx, dword [ebp - 0x2948]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x475438
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x475470
push edx
push ecx
call fcn.00476d79
add esp, 8
lea ecx, [ebp - 0x292c]
call fcn.00471e20
xor eax, eax
cmp dword [edi + 0x10], eax
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047702f
mov esp, ebp
pop ebp
ret
call fcn.0047c5ae
int3

Function at 0x492489
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00492308
Function at 0x402000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x38
push ebp
mov al, 0x32
push esi
mov esi, ecx
mov byte [esp + 0x1a], al
mov byte [esp + 0x1d], al
mov al, 0x6c
mov cl, 0x53
mov byte [esp + 0x20], al
mov byte [esp + 0x21], al
mov byte [esp + 0x13], al
mov byte [esp + 0x19], cl
mov byte [esp + 0xd], cl
lea eax, [esp + 0xc]
push edi
lea ecx, [esp + 0x1c]
mov dl, 0x57
push eax
push ecx
mov byte [esp + 0x24], dl
mov byte [esp + 0x27], 0x5f
mov byte [esp + 0x28], 0x33
mov byte [esp + 0x2a], 0x2e
mov byte [esp + 0x2b], 0x64
mov byte [esp + 0x2e], 0
mov byte [esp + 0x18], dl
mov byte [esp + 0x1a], 0x41
mov byte [esp + 0x1b], 0x49
mov byte [esp + 0x1c], 0x6f
mov byte [esp + 0x1d], 0x63
mov byte [esp + 0x1e], 0x74
mov byte [esp + 0x20], 0
call dword [sym.imp.kernel32.dll_GetStringTypeW]
push eax
call dword [sym.imp.kernel32.dll_GetConsoleNlsMode]
mov ecx, esi
mov ebp, eax
call fcn.00402020
mov edx, dword [esi + 0xac]
push edx
call dword [sym.imp.kernel32.dll_InitializeSRWLock]
push 6
push 1
push 2
mov byte [esi + 0xb5], 0
call dword [sym.imp.ws2_32.dll_socket]
mov dword [esi + 0xa8], eax
mov eax, dword [esp + 0x48]
push eax
call dword [sym.imp.ws2_32.dll_gethostbyname]
mov edi, eax
test edi, edi
jne 0x401f4d
pop edi
pop esi
xor al, al
pop ebp
add esp, 0x38
ret 8
mov ecx, dword [esp + 0x4c]
mov word [esp + 0x34], 2
push ecx
call dword [sym.imp.ws2_32.dll_htons]
mov word [esp + 0x36], ax
mov edx, dword [edi + 0xc]
push 0x10
mov eax, dword [edx]
lea edx, [esp + 0x38]
push edx
mov ecx, dword [eax]
mov eax, dword [esi + 0xa8]
push eax
mov dword [esp + 0x44], ecx
call dword [sym.imp.ws2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x401f93
pop edi
pop esi
xor al, al
pop ebp
add esp, 0x38
ret 8
mov edx, dword [esi + 0xa8]
lea ecx, [esp + 0xf]
push 1
push ecx
push 8
push 0xffff
push edx
mov byte [esp + 0x23], 1
call dword [sym.imp.ws2_32.dll_setsockopt]
test eax, eax
jne 0x401fef
push eax
mov edx, dword [esi + 0xa8]
push eax
lea eax, [esp + 0x17]
push eax
push 0
push 0
lea ecx, [esp + 0x3c]
push 0xc
push ecx
push 0x98000004
push edx
mov dword [esp + 0x4c], 1
mov dword [esp + 0x50], 0xea60
mov dword [esp + 0x54], 0x1388
call ebp
push 1
push 0
push 0
push esi
push 0x401d80
push 0
push 0
mov byte [esi + 0xb5], 1
call fcn.00408240
add esp, 0x1c
mov dword [esi + 0xa4], eax
mov al, 1
pop edi
pop esi
pop ebp
add esp, 0x38
ret 8