joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5ef5b4
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x5ef5cb
add esp, 0xfffffff0
call fcn.004086bc
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004c45d4
mov eax, dword [0x6f4d60]
cmp byte [eax], 0
jne 0x5ef5f8
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x194], al
mov eax, dword [0x6f5468]
cmp word [eax + 2], 0
jne 0x5ef612
mov eax, dword [0x6f5468]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005f1888
mov eax, dword [0x6f56dc]
cmp word [eax + 2], 0
jne 0x5ef62c
mov eax, dword [0x6f56dc]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005f1a8c
mov byte [ebx + 0x41], 0
mov dl, 1
mov eax, dword [0x50fc74]
call fcn.00515dc4
mov esi, eax
mov dword [ebx + 0x54], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x5f2004
mov dl, 1
mov eax, dword [0x48bd50]
call fcn.00408054
mov dword [ebx + 0xa8], eax
mov dl, 1
mov eax, dword [0x48bd50]
call fcn.00408054
mov dword [ebx + 0xc8], eax
xor eax, eax
mov dword [ebx + 0x74], eax
xor eax, eax
mov dword [ebx + 0x98], eax
mov dword [ebx + 0x70], 0xff000018
mov dword [ebx + 0x8c], 0x1f4
mov byte [ebx + 0x90], 1
xor eax, eax
mov dword [ebx + 0x94], eax
mov dword [ebx + 0x88], 0x9c4
mov byte [ebx + 0x9c], 0
mov byte [ebx + 0xbd], 1
mov byte [ebx + 0xd4], 1
mov dl, 1
mov eax, dword [0x51469c]
call fcn.0051f3d4
mov esi, eax
mov dword [ebx + 0xb8], esi
push 0x5ef814
mov eax, dword [0x6f51bc]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.0051f864
mov eax, dword [ebx + 0xb8]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x5f22ec
mov dl, 1
mov eax, dword [0x48bd50]
call fcn.00408054
mov dword [ebx + 0xb0], eax
push 0x100
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x6f51bc]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW_1
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.0042415c
test eax, eax
je 0x5ef746
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.00423f98
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.00424140
test eax, eax
je 0x5ef75e
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW_1
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0xa4]
lea edx, [ebp - 0x202]
mov ecx, 0x100
call fcn.0040a944
push ebx
push 0x5f1264
call fcn.005e4e48
mov dword [ebx + 0x190], eax
mov byte [ebx + 0xe8], 0
mov eax, dword [0x6f4d60]
cmp byte [eax], 0
jne 0x5ef7af
mov eax, ebx
call fcn.005ef9f8
mov byte [ebx + 0x6d], 1
mov byte [ebx + 0x6e], 1
mov byte [ebx + 0x6f], 1
mov byte [ebx + 0xbe], 1
mov byte [ebx + 0xe9], 0
mov byte [ebx + 0xf4], 0
xor eax, eax
mov dword [ebx + 0xec], eax
mov byte [ebx + 0xeb], 0
xor eax, eax
mov dword [ebx + 0xc0], eax
mov eax, ebx
call fcn.005f2524
mov eax, ebx
call fcn.005f3190
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x5ef80c
call fcn.00408714
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5efd3c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x188]
test eax, eax
je 0x5efdde
cmp dword [ebx + 0xac], 0
jne 0x5efdd8
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x5efc78
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0xa8]
cmp dword [eax + 8], 0
je 0x5efdd8
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x5efd9e
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0xa8]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x5efdd8
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0xa8]
call fcn.004aea4c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x5efdad
inc dword [ebx + 0xac]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x5f001c
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov ebx, edx
mov esi, eax
mov eax, dword [0x6fb740]
cmp dword [eax + 0x188], 0
je 0x5f0196
test bl, bl
jne 0x5f00e1
cmp dword [esi + 0xb4], 0
jne 0x5f00d6
mov eax, esi
call fcn.005f2fe0
push eax
push 0x5eff10
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x58], 0
je 0x5f00a7
mov eax, dword [0x6fb740]
cmp byte [eax + 0xeb], 0
je 0x5f00a7
mov eax, dword [esi + 0xf0]
mov dword [esp], eax
mov eax, dword [esp]
test eax, eax
je 0x5f0088
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5f00a7
push 0
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5f0090
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5f00d6
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0xb0]
call fcn.004aea4c
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5f00b6
inc dword [esi + 0xb4]
jmp 0x5f0196
cmp dword [esi + 0xb4], 0
jle 0x5f0196
dec dword [esi + 0xb4]
cmp dword [esi + 0xb4], 0
jne 0x5f0196
cmp dword [esi + 0x58], 0
je 0x5f014b
mov eax, dword [0x6fb740]
cmp byte [eax + 0xeb], 0
je 0x5f014b
mov eax, dword [esi + 0xf0]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
test eax, eax
je 0x5f012c
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5f014b
push 5
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5f0134
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5f017a
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0xb0]
call fcn.004aea4c
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5f015a
mov eax, dword [esi + 0xb0]
mov edx, dword [eax]
call dword [edx + 8]
lea eax, [esi + 0xf0]
mov edx, dword [0x5e1cac]
call fcn.0040c074
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x5f0df0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xc4], 0
je 0x5f0e4d
cmp byte [ebx + 0xeb], 0
jne 0x5f0e4d
push 0x100
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x188]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00409ebc
mov eax, dword [esi]
test eax, eax
je 0x5f0e3a
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x5f0e5a
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040a114
jmp 0x5f0e5a
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040a114
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x5f270c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x98]
test esi, esi
je 0x5f277d
mov eax, esi
call fcn.0053e2d0
test al, al
je 0x5f277d
mov eax, dword [ebx + 0x98]
call fcn.0053df00
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5f277d
mov eax, dword [ebx + 0x98]
mov edx, dword [eax]
call dword [edx + 0x114]
test al, al
je 0x5f276e
push 0
mov eax, dword [ebx + 0x98]
call fcn.0053df00
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x98]
call fcn.00534bf8
jmp 0x5f277d
mov cl, 1
mov edx, dword [ebx + 0x88]
mov eax, ebx
call fcn.005f2544
pop esi
pop ebx
ret
Function at 0x604cbc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd1c
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
test edi, edi
jne 0x604d21
cmp dword [ebp + 0x20], 0
jne 0x604cf5
push 1
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp + 0x20]
push eax
call fcn.00604cbc
add esp, 0x1c
jmp 0x615887
lea edx, [ebp + 0x20]
sub edx, ebx
mov dword [ebp - 0x90], edx
cmp dword [ebp - 0x90], 0
jle 0x604d16
mov eax, dword [ebp - 0x90]
neg eax
jmp 0x615887
mov eax, dword [ebp - 0x90]
jmp 0x615887
xor edx, edx
xor ecx, ecx
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x4c], ecx
Function at 0x66a6c8
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffdc
mov ebx, eax
mov eax, ebx
call fcn.00409d34
mov dword [esp], 0xf
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x66a6f9
lea edx, [esp + 4]
mov eax, ebx
mov ecx, dword [esp]
call fcn.00409ebc
add esp, 0x24
pop ebx
ret

Function at 0x681304
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x68130c
push ecx
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6814c1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0x18]
mov ecx, dword [eax + 0xc]
lea eax, [ebp - 4]
mov edx, 0x6814dc
call fcn.0040aaf4
push esi
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0x11
mov eax, dword [ebx + 0x2c]
push eax
lea eax, [ebp - 0x18]
push eax
movzx ecx, word [ebx + 0x30]
xor edx, edx
mov eax, dword [ebx + 0x1c]
call fcn.0067eec8
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0x11
lea edx, [ebp - 0x14]
mov ecx, 1
mov eax, 0x6814f0
call fcn.00626e04
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x681387
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x6813c8
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebx + 0x2c]
push eax
lea eax, [ebp - 0x28]
push eax
movzx ecx, word [ebx + 0x30]
xor edx, edx
mov eax, dword [ebx + 0xc]
call fcn.0067eec8
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x681558
call fcn.00626e04
mov edx, dword [ebp - 0x1c]
mov eax, esi
call fcn.0040aa9c
mov eax, esi
mov edx, 0x681584
call fcn.0040aa9c
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x6813e0
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x68144e
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x681598
call fcn.00626e04
mov edx, dword [ebp - 0x2c]
mov eax, esi
call fcn.0040aa9c
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x681417
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x681442
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x6815c8
call fcn.00626e04
mov edx, dword [ebp - 0x30]
mov eax, esi
call fcn.0040aa9c
mov eax, esi
mov edx, 0x6815f4
call fcn.0040aa9c
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x68145a
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x681485
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x681608
call fcn.00626e04
mov edx, dword [ebp - 0x34]
mov eax, esi
call fcn.0040aa9c
mov eax, esi
mov edx, 0x681654
call fcn.0040aa9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6814c8
lea eax, [ebp - 0x34]
mov edx, 4
call fcn.00409d94
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00409d94
lea eax, [ebp - 4]
call fcn.00409d34
ret
Function at 0x6ba948
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x6d
push 0
push 0
dec ecx
jne 0x6ba950
xor eax, eax
push ebp
push 0x6bac26
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x33c]
xor eax, eax
call fcn.00406bc0
mov eax, dword [ebp - 0x33c]
lea edx, [ebp - 0x338]
call fcn.00423d84
mov edx, dword [ebp - 0x338]
lea eax, [ebp - 4]
mov ecx, 0x6bac40
call fcn.0040aaf4
xor ecx, ecx
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x2e0]
call fcn.00407490
call fcn.004069b4
lea eax, [ebp - 0x2e0]
call fcn.00407150
call fcn.004069b4
mov edx, 0x6bac68
lea eax, [ebp - 0x2e0]
call fcn.00407b4c
call fcn.00407c4c
call fcn.004069b4
push 0x6bac80
lea edx, [ebp - 0x344]
xor eax, eax
call fcn.00406bc0
push dword [ebp - 0x344]
push 0x6bac98
lea eax, [ebp - 0x340]
mov edx, 3
call fcn.0040ab7c
mov edx, dword [ebp - 0x340]
lea eax, [ebp - 0x2e0]
call fcn.00407b4c
call fcn.00407c4c
call fcn.004069b4
push 0x6baca8
lea edx, [ebp - 0x34c]
xor eax, eax
call fcn.00406bc0
push dword [ebp - 0x34c]
push 0x6baccc
push 0x6bacdc
lea eax, [ebp - 0x348]
mov edx, 4
call fcn.0040ab7c
mov edx, dword [ebp - 0x348]
lea eax, [ebp - 0x2e0]
call fcn.00407b4c
call fcn.00407c4c
call fcn.004069b4
push 0x6bacfc
mov eax, dword [0x6f5640]
push dword [eax]
push 0x6bad14
lea edx, [ebp - 0x358]
xor eax, eax
call fcn.00406bc0
mov eax, dword [ebp - 0x358]
lea edx, [ebp - 0x354]
call fcn.00423dc4
push dword [ebp - 0x354]
push 0x6bad30
lea eax, [ebp - 0x350]
mov edx, 5
call fcn.0040ab7c
mov edx, dword [ebp - 0x350]
lea eax, [ebp - 0x2e0]
call fcn.00407b4c
call fcn.00407c4c
call fcn.004069b4
mov eax, dword [0x6f59d4]
cmp byte [eax], 0
je 0x6bab23
push 0x6bad40
lea edx, [ebp - 0x360]
xor eax, eax
call fcn.00406bc0
push dword [ebp - 0x360]
push 0x6bad50
lea eax, [ebp - 0x35c]
mov edx, 3
call fcn.0040ab7c
mov edx, dword [ebp - 0x35c]
lea eax, [ebp - 0x2e0]
call fcn.00407b4c
call fcn.00407c4c
call fcn.004069b4
jmp 0x6bab6b
push 0x6bad6c
lea edx, [ebp - 0x368]
xor eax, eax
call fcn.00406bc0
push dword [ebp - 0x368]
push 0x6bad7c
lea eax, [ebp - 0x364]
mov edx, 3
call fcn.0040ab7c
mov edx, dword [ebp - 0x364]
lea eax, [ebp - 0x2e0]
call fcn.00407b4c
call fcn.00407c4c
call fcn.004069b4
mov edx, 0x6bad8c
lea eax, [ebp - 0x2e0]
call fcn.00407b4c
call fcn.00407c4c
call fcn.004069b4
lea eax, [ebp - 0x2e0]
call fcn.00407598
call fcn.004069b4
lea eax, [ebp - 0x334]
xor ecx, ecx
mov edx, 0x44
call fcn.004075f0
mov dword [ebp - 0x308], 1
mov word [ebp - 0x304], 0
lea eax, [ebp - 0x2f0]
push eax
lea eax, [ebp - 0x334]
push eax
push 0
push 0
push 0x40
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040a888
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x6bac00
mov eax, dword [ebp - 0x2ec]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x2f0]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6bac2d
lea eax, [ebp - 0x368]
mov edx, 0xd
call fcn.00409d94
lea eax, [ebp - 4]
call fcn.00409d34
ret
Function at 0x6bb7a8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x21c], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x6bb93c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x48f50c]
call fcn.004b3260
mov ebx, eax
lea eax, [ebp - 8]
push eax
push 0
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x216]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetPathFromIDListW
lea eax, [ebp - 0x216]
mov ecx, ebx
mov edx, 0x6bb958
call fcn.006bb26c
mov eax, 0x6bb964
mov ecx, ebx
mov edx, 0x6bb9a0
call fcn.006bb26c
lea eax, [ebp - 0x21c]
lea edx, [ebp - 0x216]
mov ecx, 0x105
call fcn.0040a944
mov edx, dword [ebp - 0x21c]
mov eax, 0x6bb9b8
call fcn.00423ce0
mov esi, eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x220]
lea edx, [ebp - 0x216]
mov ecx, 0x105
call fcn.0040a944
mov eax, dword [ebp - 0x220]
mov ecx, esi
xor edx, edx
call fcn.0040ac64
lea eax, [ebp - 0x224]
mov ecx, 0x6bb9c8
mov edx, dword [ebp - 4]
call fcn.0040aaf4
mov eax, dword [ebp - 0x224]
call fcn.0040a888
mov ecx, ebx
mov edx, 0x6bba48
call fcn.006bb26c
lea eax, [ebp - 0x228]
mov ecx, 0x6bba60
mov edx, dword [ebp - 4]
call fcn.0040aaf4
mov eax, dword [ebp - 0x228]
call fcn.0040a888
mov ecx, ebx
mov edx, 0x6bbad8
call fcn.006bb26c
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x6bb90f
inc esi
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 0x22c]
mov edx, dword [ebp - 0xc]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x22c]
call fcn.006bb604
inc dword [ebp - 0xc]
dec esi
jne 0x6bb8ee
mov eax, ebx
call fcn.00408084
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6bb943
lea eax, [ebp - 0x22c]
mov edx, 5
call fcn.00409d94
lea eax, [ebp - 4]
call fcn.00409d34
ret
Function at 0x6bbcbc
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
xor eax, eax
push ebp
push 0x6bbdf6
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0xf013f
mov dl, 1
mov eax, dword [0x50a008]
call fcn.0050b198
mov ebx, eax
mov edx, 0x80000002
mov eax, ebx
call fcn.0050b23c
mov edx, 0x6bbe10
mov eax, ebx
call fcn.0050b4c8
test al, al
je 0x6bbd12
lea ecx, [ebp - 4]
mov edx, 0x6bbea0
mov eax, ebx
call fcn.0050bd70
mov eax, ebx
call fcn.0050b20c
mov dl, 1
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 4]
lea eax, [ebp - 0xc]
mov ecx, 0x6bbecc
mov edx, dword [ebp - 4]
call fcn.0040aaf4
mov eax, dword [ebp - 0xc]
mov dl, 1
call fcn.00423898
test al, al
jne 0x6bbdd3
lea eax, [ebp - 0x10]
mov ecx, 0x6bbeec
mov edx, dword [ebp - 4]
call fcn.0040aaf4
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x508744]
call fcn.00508b00
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x6bbdcc
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x6bbf0c
mov ecx, 0x6bbf24
mov edx, 0x6bbf3c
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
mov ecx, 0x6bbf98
mov edx, 0x6bbfb4
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0x6bbfe4
mov ecx, 0x6bc024
mov edx, 0x6bc038
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6bbdd3
mov eax, dword [ebp - 8]
call fcn.00408084
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6bbdfd
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00409d94
lea eax, [ebp - 4]
call fcn.00409d34
ret
Function at 0x6bdea4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00409e18
xor eax, eax
push ebp
push 0x6bdf41
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.006bdc70
cmp byte [0x6f4cf0], 0
jne 0x6bdf05
lea edx, [ebp - 8]
mov eax, 0x6bdf58
call fcn.006bd830
mov eax, dword [ebp - 8]
call fcn.006bd7c8
push 1
push 0
push 0
push 0x6bdfb8
push 0x6bdfec
push 0
call sub.shell32.dll_ShellExecuteW
jmp 0x6bdf1a
lea edx, [ebp - 0xc]
mov eax, 0x6be004
call fcn.006bd830
mov eax, dword [ebp - 0xc]
call fcn.006bdc70
call fcn.006bdd64
push 0
call sub.kernel32.dll_ExitProcess_1
Function at 0x7438d2
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
mov esi, dword [ebx + edi*4]
mov eax, esi
shr eax, 7
and eax, 0x1010101
imul edx, eax, 0x1b
mov eax, esi
and eax, 0xff7f7f7f
add eax, eax
xor edx, eax
mov eax, esi
mov ecx, edx
rol eax, 0x10
xor ecx, esi
rol esi, 8
ror ecx, 8
xor ecx, eax
xor ecx, esi
xor ecx, edx
mov dword [ebx + edi*4], ecx
inc edi
cmp edi, 4
jl 0x7438d9
pop edi
pop esi
pop ebx
ret

Function at 0x743916
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor eax, eax
mov dword [ebp - 8], ecx
push esi
mov dword [ebp - 4], eax
mov edx, 0x1010101
push edi
mov edi, dword [ecx + eax*4]
mov eax, edi
shr eax, 7
and eax, edx
imul ebx, eax, 0x1b
mov eax, edi
and eax, 0xff7f7f7f
add eax, eax
xor ebx, eax
mov eax, ebx
shr eax, 7
and eax, edx
imul ecx, eax, 0x1b
mov eax, ebx
and eax, 0xff7f7f7f
add eax, eax
xor ecx, eax
mov eax, ecx
shr eax, 7
and eax, edx
imul esi, eax, 0x1b
mov eax, ecx
and eax, 0xff7f7f7f
add eax, eax
xor esi, eax
mov edx, esi
xor esi, ecx
xor edx, edi
mov eax, esi
mov ecx, edx
xor eax, edi
xor ecx, ebx
rol eax, 0x10
ror ecx, 8
xor ecx, eax
rol edx, 8
mov eax, dword [ebp - 4]
xor ecx, edx
mov edx, dword [ebp - 8]
xor ecx, esi
xor ecx, ebx
mov dword [edx + eax*4], ecx
inc eax
mov dword [ebp - 4], eax
mov ecx, edx
mov edx, 0x1010101
cmp eax, 4
jl 0x74392b
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x743b65
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, edx
call fcn.00743820
mov edx, esi
mov ecx, 0x100030a0
call fcn.00743820
push 0xa
mov edi, 0x100030b0
pop ebx
mov ecx, esi
call fcn.00743833
call fcn.0074385f
mov ecx, esi
call fcn.007438d2
mov edx, esi
mov ecx, edi
call fcn.00743820
add edi, 0x10
dec ebx
jne 0x743b83
mov ecx, esi
call fcn.00743833
call fcn.0074385f
pop edi
mov edx, esi
mov ecx, 0x10003150
pop esi
pop ebx
jmp fcn.00743820

Function at 0x744953
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [ecx], ax
je 0x744960
xor eax, eax
ret
mov eax, dword [ecx + 0x3c]
cmp dword [eax + ecx], 0x4550
jne 0x74495d
mov eax, dword [eax + ecx + 0x80]
test eax, eax
je 0x74495d
add eax, ecx
ret
Function at 0x77d46f
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebp, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
sub eax, ebp
mov ebx, dword [0x34bdc0]
lea edi, [eax + 1]
mov eax, 1
test edi, edi
jle 0x77d4b7
xor esi, esi
lea ecx, [esi + ebp]
mov edx, ebx
sar edx, 8
inc esi
mov al, byte [ecx]
xor edx, eax
movzx eax, al
add eax, ebx
mov byte [ecx], dl
imul eax, eax, 0x5ca0
cmp esi, edi
lea ebx, [eax + 0x15ec]
jne 0x77d491
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x7be2bb
Capabilities:
Write file on windows

Disassembly:
push 0x24
mov eax, 0x4156a9
call fcn.007c35d6
xor ebx, ebx
cmp dword [edi + 0x44], ebx
je 0x7be39c
cmp byte [edi + 0x49], bl
je 0x7be39c
mov eax, dword [edi]
push 0xffffffffffffffff
mov ecx, edi
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x7be2f0
xor al, al
jmp 0x7be39e
lea esi, [ebp - 0x2c]
call fcn.007be190
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x7be33e
lea eax, [ebp - 0x2c]
mov edx, eax
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x30]
push ebx
mov ebx, dword [ebp - 0x1c]
add eax, ebx
push eax
push edx
lea eax, [edi + 0x4c]
push eax
call dword [esi + 0x18]
sub eax, 0
je 0x7be343
dec eax
je 0x7be347
dec eax
dec eax
je 0x7be398
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.007bec7c
mov al, bl
jmp 0x7be39e
mov edx, dword [ebp - 0x2c]
jmp 0x7be309
mov byte [edi + 0x49], 0
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x7be353
lea eax, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, eax
je 0x7be379
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x7be366
lea eax, [ebp - 0x2c]
push dword [edi + 0x54]
push esi
push 1
push eax
call fcn.007c1c91
add esp, 0x10
cmp esi, eax
jne 0x7be32c
cmp byte [edi + 0x49], 0
je 0x7be398
test esi, esi
jne 0x7be2fb
push esi
push 8
pop ebx
lea esi, [ebp - 0x2c]
call fcn.007be1d4
jmp 0x7be2fb
mov bl, 1
jmp 0x7be32e
mov al, 1
call fcn.007c3659
ret