joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43fbfd
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x50
mov dword [esp + 8], edx
mov edi, dword [esp + 0x6c]
mov eax, dword [0x4b507c]
xor eax, esp
test edi, edi
mov dword [esp + 0x4c], eax
jle 0x43fcac
mov esi, dword [esp + 0x68]
mov ebx, ecx
mov dword [esp], 0
mov dword [esp + 4], ecx
mov eax, dword [ebx + 0x10]
mov ebp, edi
cmp edi, eax
cmovg ebp, eax
cmp eax, 0x41
jl 0x43fc56
push 0x348
push str..._sshrsa.c
push str.h__hlen___MAX_HASH_LEN
call fcn.0047b3ef
add esp, 0xc
push ebx
call dword [ebx]
add esp, 4
mov ebx, eax
push dword [esp + 0x64]
push dword [esp + 0xc]
push dword [eax + 4]
call fcn.00410634
add esp, 0xc
push dword [esp]
push dword [ebx + 4]
call fcn.0041073e
add esp, 8
mov eax, dword [ebx]
lea ecx, [esp + 0xc]
push ecx
push ebx
call dword [eax + 8]
add esp, 8
test ebp, ebp
jle 0x43fc9f
xor eax, eax
mov cl, byte [esp + eax + 0xc]
xor byte [esi + eax], cl
inc eax
cmp eax, ebp
jl 0x43fc93
mov ebx, dword [esp + 4]
inc dword [esp]
add esi, ebp
sub edi, ebp
jg 0x43fc30
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.0046f0c8
add esp, 0x50
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4470d4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, dword [esp + 0x2c]
mov dword [esp + 8], ecx
xor ecx, ecx
xor edi, edi
mov esi, edx
mov eax, 8
inc edi
push ecx
push eax
push edi
call fcn.00410b50
add esp, 0xc
mov ebp, eax
xor eax, eax
mov ecx, ebx
dec eax
shl eax, cl
mov ecx, dword [esp + 0x30]
shl edi, cl
mov dword [esp + 4], eax
xor eax, eax
push eax
mov eax, 8
push eax
push edi
call fcn.00410b50
add esp, 0xc
lea edx, [edi - 1]
test edi, edi
mov dword [ebp + 4], eax
mov dword [ebp], edx
jle 0x447170
mov word [eax + 2], 0xffff
mov eax, dword [ebp + 4]
mov byte [eax], 0
mov eax, dword [ebp + 4]
mov dword [eax + 4], 0
mov edx, dword [ebp]
test edx, edx
jle 0x447170
xor eax, eax
mov ecx, dword [ebp + 4]
mov word [ecx + eax*8 + 0xa], 0xffff
mov ecx, dword [ebp + 4]
mov byte [ecx + eax*8 + 8], 0
mov ecx, dword [ebp + 4]
mov dword [ecx + eax*8 + 0xc], 0
inc eax
mov edx, dword [ebp]
cmp eax, edx
jl 0x44714b
cmp dword [esp + 0x24], 0
jle 0x4471fb
xor eax, eax
mov ebx, dword [esp + 0x2c]
mov dword [esp], esi
mov dword [esp + 0xc], ebp
dec eax
xor dword [esp + 4], eax
xor eax, eax
movzx ecx, byte [esi + eax]
cmp ecx, ebx
jle 0x4471f2
mov ecx, dword [esp + 8]
mov edi, dword [ecx + eax*4]
mov ecx, edi
and ecx, dword [esp + 4]
cmp ecx, dword [esp + 0x28]
jne 0x4471f2
mov ecx, ebx
sar edi, cl
and edi, edx
cmp edi, edx
jg 0x4471f2
mov ecx, dword [ebp + 4]
mov word [ecx + edi*8 + 2], ax
movzx ecx, byte [esi + eax]
mov edx, dword [ebp + 4]
mov ebp, esi
mov esi, ebx
sub ecx, ebx
movzx ebx, byte [edx + edi*8]
cmp ecx, ebx
jle 0x4471db
mov byte [edx + edi*8], cl
movzx ecx, byte [ebp + eax]
sub ecx, esi
mov ebp, dword [esp + 0xc]
xor edx, edx
mov ebx, esi
mov esi, dword [esp]
inc edx
shl edx, cl
add edi, edx
mov edx, dword [ebp]
cmp edi, edx
jle 0x4471b4
inc eax
cmp eax, dword [esp + 0x24]
jne 0x44718f
jmp 0x4471ff
mov ebx, dword [esp + 0x2c]
test edx, edx
js 0x447272
mov eax, dword [esp + 0x30]
xor edi, edi
add eax, ebx
mov dword [esp], eax
mov eax, dword [ebp + 4]
movzx ecx, byte [eax + edi*8]
cmp ecx, dword [esp + 0x30]
jle 0x44726b
mov word [eax + edi*8 + 2], 0xffff
mov ecx, dword [esp + 0x30]
mov edx, 7
mov eax, dword [ebp + 4]
movzx ebx, byte [eax + edi*8]
mov byte [eax + edi*8], cl
mov eax, edi
sub ebx, ecx
mov ecx, dword [esp + 0x2c]
cmp ebx, 8
cmovge ebx, edx
shl eax, cl
mov ecx, dword [esp + 8]
mov edx, esi
or eax, dword [esp + 0x28]
push ebx
push dword [esp + 4]
push eax
push dword [esp + 0x30]
call fcn.004470d4
add esp, 0x10
mov ecx, dword [ebp + 4]
mov dword [ecx + edi*8 + 4], eax
mov edx, dword [ebp]
cmp edi, edx
lea edi, [edi + 1]
jl 0x44720e
mov eax, ebp
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x45108c
Capabilities:
Encode data using base64
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x111c], 2
jl 0x4510d8
mov eax, dword [esp + 0xc]
cmp dword [esi + 0x1114], eax
jne 0x4510d8
xor eax, eax
mov dword [esi + 0xe1c], eax
mov dword [esi + 0xe2c], eax
mov dword [esi + 0xe28], eax
mov dword [esi + 0xe34], eax
mov dword [esi + 0xe30], eax
push esi
call fcn.0044892c
add esp, 4
cmp dword [esi + 0xe1c], 2
jne 0x4510da
pop esi
ret
mov ecx, esi
pop esi
jmp fcn.0044d79a

Function at 0x455ea2
Capabilities:
Encode data using base64

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [0x4b507c]
mov edi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov edx, 0xfffffffc
xor eax, esp
xor esi, esi
dec esi
mov dword [esp + 0x10], eax
movsx ebx, byte [ecx + edx + 4]
mov eax, ebx
add al, 0xbf
cmp al, 0x19
ja 0x455ed6
add ebx, 0xffffffbf
jmp 0x455f13
mov eax, ebx
add al, 0x9f
cmp al, 0x19
ja 0x455ee3
add ebx, 0xffffffb9
jmp 0x455f13
mov eax, ebx
add al, 0xd0
cmp al, 9
ja 0x455ef0
add ebx, 4
jmp 0x455f13
cmp bl, 0x2b
je 0x455f0a
cmp bl, 0x3d
je 0x455f11
cmp bl, 0x2f
jne 0x455f95
mov ebx, 0x3f
jmp 0x455f13
mov ebx, 0x3e
jmp 0x455f13
mov ebx, esi
mov dword [esp + edx*4 + 0x10], ebx
inc edx
jne 0x455ec4
mov eax, dword [esp]
xor esi, esi
cmp eax, 0xffffffff
je 0x455f97
mov edx, dword [esp + 4]
cmp edx, 0xffffffff
je 0x455f97
mov ecx, dword [esp + 8]
mov ebx, dword [esp + 0xc]
cmp ecx, 0xffffffff
je 0x455f4b
mov ebp, 3
cmp ebx, 0xffffffff
jne 0x455f56
mov ebp, 2
jmp 0x455f53
cmp ebx, 0xffffffff
jne 0x455f97
xor ebp, ebp
inc ebp
xor ebx, ebx
dec ebx
shl eax, 0x12
shl edx, 0xc
or eax, edx
shr eax, 0x10
cmp ebp, 2
mov byte [edi], al
jb 0x455f90
shl ecx, 6
mov esi, 2
mov eax, ecx
and eax, 0xf00
or eax, edx
cmp ebp, 3
mov byte [edi + 1], ah
jne 0x455f97
and ebx, 0x3f
mov esi, 3
or ebx, ecx
mov byte [edi + 2], bl
jmp 0x455f97
xor esi, esi
inc esi
jmp 0x455f97
xor esi, esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.0046f0c8
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x456241
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov eax, dword [esp + 0x18]
test eax, eax
je 0x456279
mov ecx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
xor edi, edi
xor edx, edx
mov bl, byte [ecx + edi]
xor bl, byte [esi + edi]
inc edi
movzx ebx, bl
or edx, ebx
cmp eax, edi
jne 0x456258
mov eax, 0x100
sub eax, edx
cmp eax, 0xff
seta al
jmp 0x45627b
mov al, 1
pop esi
pop edi
pop ebx
ret
Function at 0x45b89d
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x4b7694]
test eax, eax
jne 0x45b8d2
push 0
push 0x45b8da
push dword [esp + 0xc]
push 0x6e
push dword [0x4b7664]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov dword [0x4b7694], eax
push 1
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x4b7694]
push eax
call dword [sym.imp.USER32.dll_SetActiveWindow]
ret

Function at 0x45c1c0
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push esi
sub esp, 0x98
mov eax, dword [0x4b507c]
xor eax, esp
mov dword [esp + 0x94], eax
cmp dword [0x4b614c], 0
je 0x45c1f0
xor ebx, ebx
cmp dword [0x4b6140], 0
setne bl
jmp 0x45c313
lea esi, [esp + 4]
push 0x90
push 0
push esi
call fcn.004721e0
add esp, 0xc
mov dword [esi - 4], 0x94
mov esi, esp
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
xor eax, eax
cmp dword [esi + 0x10], 2
sete al
mov dword [0x4b6150], eax
push str.USER32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x45c2dd
mov esi, eax
push 0x49f641
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x4b6130], eax
je 0x45c2dd
push str.MonitorFromWindow
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x4b6134], eax
je 0x45c2dd
push str.MonitorFromRect
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x4b6138], eax
je 0x45c2dd
push str.MonitorFromPoint
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x4b613c], eax
je 0x45c2dd
push str.EnumDisplayMonitors
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x4b6144], eax
je 0x45c2dd
push str.GetMonitorInfoA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x4b6140], eax
je 0x45c2dd
push str.EnumDisplayDevicesA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x4b6148], eax
je 0x45c2dd
xor ebx, ebx
mov dword [0x4b614c], 1
inc ebx
jmp 0x45c313
xor ebx, ebx
mov dword [0x4b614c], 1
mov dword [0x4b6130], ebx
mov dword [0x4b6134], ebx
mov dword [0x4b6138], ebx
mov dword [0x4b613c], ebx
mov dword [0x4b6140], ebx
mov dword [0x4b6144], ebx
mov dword [0x4b6148], ebx
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.0046f0c8
mov eax, ebx
add esp, 0x98
pop esi
pop ebx
ret
Function at 0x45d033
Capabilities:
Terminate process

Disassembly:
push esi
call fcn.00460d31
push dword [0x4b6cac]
call fcn.00410bcd
add esp, 4
mov eax, dword [0x4b6ca8]
test eax, eax
je 0x45d057
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov esi, dword [esp + 8]
call fcn.00467a90
push 2
push dword [0x4b7678]
call fcn.00403081
add esp, 8
cmp eax, 3
jne 0x45d07a
call fcn.0043ea58
call fcn.00465cf5
call dword [sym.imp.ole32.dll_CoUninitialize]
push esi
call fcn.00479f0b
Function at 0x4609df
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x4b507c]
xor eax, esp
mov dword [esp + 0xc], eax
push 2
push dword [0x4b7678]
call fcn.00403081
add esp, 8
push eax
call fcn.0041aa0f
add esp, 4
test eax, eax
je 0x460b93
mov esi, eax
mov eax, dword [0x4b5060]
xor ebx, ebx
mov ecx, 0x4b5060
inc ebx
push ebx
push ecx
call dword [eax + 0x44]
add esp, 8
push 8
push dword [0x4b7678]
call fcn.00402fe1
add esp, 8
mov byte [esp + 4], al
push 7
push dword [0x4b7678]
call fcn.00402fe1
add esp, 8
mov byte [esp + 3], al
push ebx
push dword [0x4b7678]
call fcn.00403081
add esp, 8
mov edi, eax
push 0
push dword [0x4b7678]
call fcn.004031c6
add esp, 8
movzx ecx, byte [esp + 4]
movzx edx, byte [esp + 3]
lea ebp, [esp + 8]
push ecx
push edx
push ebp
push edi
push eax
push dword [0x4b7678]
push dword [0x4b7690]
push 0x4b6cc4
mov eax, 0x4b5060
push eax
call dword [esi]
add esp, 0x24
test eax, eax
jne 0x460bc8
xor edi, edi
mov dword [0x4b75cc], edi
mov dword [0x4b75c8], edi
push 0x62
push dword [0x4b7678]
call fcn.004031c6
add esp, 8
cmp byte [eax], 0
mov esi, eax
mov eax, 0
jne 0x460aec
push dword [0x48e058]
push dword [esp + 0xc]
push str._s____s
call fcn.004558cb
add esp, 0xc
mov esi, eax
mov dword [esp + 4], eax
push dword [esp + 8]
call fcn.00410bcd
add esp, 4
mov eax, dword [0x4b6154]
mov ebp, 0x4b6154
push esi
push ebp
call dword [eax + 0x38]
add esp, 8
mov eax, dword [0x4b6154]
push esi
push ebp
call dword [eax + 0x3c]
add esp, 8
push dword [0x4b6cc4]
push dword [0x4b7660]
call fcn.0044b4ac
add esp, 8
push 0x4b5060
push dword [0x4b6cc4]
push dword [0x4b7660]
push dword [0x4b7678]
call fcn.0040e5c4
add esp, 0x10
mov esi, dword [sym.imp.USER32.dll_DeleteMenu]
xor ebp, ebp
mov dword [0x4b6cc8], eax
push edi
push 0x40
push dword [ebp*4 + 0x4b6c90]
call esi
test ebp, ebp
mov ebp, ebx
je 0x460b5b
mov byte [0x4b6cc0], 0
push dword [esp + 4]
call fcn.00410bcd
add esp, 4
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.0046f0c8
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
push dword [0x48e058]
push str._s_Internal_Error
call fcn.004558cb
add esp, 8
mov esi, eax
push 0x30
push eax
push str.Unsupported_protocol_number_found
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call fcn.00410bcd
add esp, 4
push 1
call fcn.0045d033
mov esi, eax
push dword [0x48e058]
push str._s_Error
call fcn.004558cb
add esp, 8
mov edi, eax
push dword [0x4b7678]
call fcn.00412cd8
add esp, 4
push esi
push eax
push str.Unable_to_open_connection_to_n_s_n_s
call fcn.004558cb
add esp, 0xc
mov esi, eax
xor ebx, ebx
push 0x10
push edi
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push edi
call fcn.00410bcd
add esp, 4
push esi
call fcn.00410bcd
add esp, 4
push ebx
call fcn.00479f0b
Function at 0x460e1e
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
push ebx
push edi
push esi
cmp dword [esp + 0x14], 2
jne 0x460ed9
mov ebp, dword [esp + 0x1c]
lea eax, [ebp + 1]
push eax
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
je 0x460ed9
mov esi, eax
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x460ed9
mov bl, byte [esp + 0x20]
mov edi, eax
push ebp
push dword [esp + 0x1c]
push eax
call fcn.004716e0
add esp, 0xc
xor eax, eax
mov byte [edi + ebp], al
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
test bl, bl
jne 0x460e92
push 0
push 1
push 0x8002
push dword [0x4b7668]
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [0x4b7668]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x460eb9
call dword [sym.imp.USER32.dll_EmptyClipboard]
push esi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x460ec0
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
test bl, bl
jne 0x460ed9
xor eax, eax
push eax
push eax
push 0x8002
push dword [0x4b7668]
call dword [sym.imp.USER32.dll_SendMessageA]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x46539c
Capabilities:
Create thread

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x4b507c]
mov ebp, dword [esp + 0x1c]
xor edi, edi
xor eax, esp
mov dword [esp + 4], eax
push edi
push 0x1028
push 1
call fcn.00410b50
add esp, 0xc
mov dword [eax], edi
mov dword [eax + 4], ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
lea ebx, [eax + 4]
push edi
push edi
push edi
push edi
call ebp
mov dword [esi + 8], eax
push edi
push edi
push edi
push edi
call ebp
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x20]
mov dword [esi + 0x1024], eax
mov eax, dword [esp + 0x24]
mov byte [esi + 0x12], 0
mov word [esi + 0x10], 0
mov dword [esi + 0x14], eax
mov eax, dword [esp + 0x28]
mov dword [esi + 0x18], eax
mov eax, dword [0x4b8328]
test eax, eax
jne 0x465423
push 0x4207d6
call fcn.004544f4
add esp, 4
mov dword [0x4b8328], eax
push esi
push eax
call fcn.0045458e
add esp, 8
mov eax, esp
push eax
push edi
push ebx
push 0x465458
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov byte [esi + 0x13], 1
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.0046f0c8
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x465596
Capabilities:
Create thread

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x4b507c]
mov ebp, dword [esp + 0x1c]
xor edi, edi
xor eax, esp
xor ebx, ebx
inc ebx
mov dword [esp + 4], eax
push edi
push 0x1028
push ebx
call fcn.00410b50
add esp, 0xc
mov dword [eax], ebx
mov dword [eax + 4], ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
lea ebx, [eax + 4]
push edi
push edi
push edi
push edi
call ebp
mov dword [esi + 8], eax
push edi
push edi
push edi
push edi
call ebp
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x24]
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], eax
lea eax, [esi + 0x2c]
push eax
call fcn.00455fac
add esp, 4
mov eax, dword [esp + 0x20]
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], eax
mov eax, dword [esp + 0x28]
mov dword [esi + 0x18], eax
mov eax, dword [0x4b8328]
test eax, eax
jne 0x465624
push 0x4207d6
call fcn.004544f4
add esp, 4
mov dword [0x4b8328], eax
push esi
push eax
call fcn.0045458e
add esp, 8
mov eax, esp
push eax
push edi
push ebx
push 0x465655
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.0046f0c8
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x465c15
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push edi
push esi
cmp byte [0x4b8334], 0
jne 0x465cf2
mov byte [0x4b8334], 1
push str.hhctrl.ocx
call fcn.00466d24
add esp, 4
mov esi, eax
test eax, eax
je 0x465ca3
push str.HtmlHelpA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x4b8338], eax
je 0x465cad
cmp byte [0x4b8349], 0
jne 0x465cb6
mov byte [0x4b8349], 1
call fcn.00465be0
test eax, eax
je 0x465cb6
push dword [0x4b8330]
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
mov dword [0x4b834c], eax
je 0x465cb6
push dword [0x4b8330]
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x465cb6
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [0x4b8344], eax
jmp 0x465cbb
mov dword [0x4b8338], 0
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x465cf2
mov eax, dword [0x4b8344]
test eax, eax
jne 0x465cf2
xor edi, edi
xor esi, esi
inc esi
push 0
push dword [edi*4 + 0x497ae0]
push 0x80000002
call fcn.0046727d
add esp, 0xc
test eax, eax
jne 0x465ce6
test edi, edi
mov edi, esi
je 0x465cc4
jmp 0x465cf2
mov dword [0x4b833c], eax
mov byte [0x4b8340], 0
pop esi
pop edi
ret

Function at 0x465cf5
Capabilities:
Delete file

Disassembly:
mov eax, dword [0x4b833c]
test eax, eax
je 0x465d27
cmp byte [0x4b8340], 1
jne 0x465d29
xor eax, eax
push eax
push 0x12
push eax
push eax
call dword [0x4b8338]
push dword [0x4b833c]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [0x4b833c]
jmp 0x465d29
xor eax, eax
push eax
call fcn.00410bcd
add esp, 4
mov dword [0x4b833c], 0
mov byte [0x4b8340], 0
ret
Function at 0x465d53
Capabilities:
Delete file
Get common file path
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x114
mov eax, dword [0x4b507c]
xor eax, esp
mov dword [esp + 0x110], eax
mov eax, dword [0x4b833c]
test eax, eax
jne 0x465eb3
cmp dword [0x4b8344], 0
je 0x465eb3
xor esi, esi
cmp byte [0x4b8350], 0
jne 0x465ea5
lea edi, [esp + 0xa]
mov byte [0x4b8350], 1
push edi
push 0x106
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x465ea5
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebp, eax
xor eax, eax
push eax
push eax
push ebp
push edi
xor edi, edi
push str._sputty__lu__llu.chm
call fcn.004558cb
add esp, 0x14
mov esi, eax
xor eax, eax
inc eax
push edi
push 0x80
push eax
push edi
push eax
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x465e4e
mov dword [esp], ebp
xor ebp, ebp
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x465ea5
push esi
call fcn.00410bcd
add esp, 4
xor esi, esi
mov ebx, 0
inc esi
add ebp, esi
adc edi, ebx
push edi
push ebp
push dword [esp + 8]
lea eax, [esp + 0x16]
push eax
push str._sputty__lu__llu.chm
call fcn.004558cb
add esp, 0x14
push ebx
push 0x80
push esi
push ebx
push esi
mov esi, eax
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x465df6
mov ebx, eax
mov eax, dword [0x4b834c]
test eax, eax
je 0x465e94
mov edi, dword [0x4b8344]
xor ebp, ebp
xor edx, edx
sub eax, ebp
lea ecx, [edi + ebp]
mov dword [esp + 4], edx
push edx
lea edx, [esp + 8]
push edx
push eax
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x465f1d
mov eax, dword [esp + 4]
lea ebp, [ebp + eax + 1]
mov eax, dword [0x4b834c]
cmp eax, ebp
ja 0x465e61
mov dword [0x4b833c], esi
mov byte [0x4b8340], 1
xor esi, esi
jmp 0x465f24
push esi
call fcn.00410bcd
add esp, 4
mov eax, dword [0x4b833c]
test eax, eax
je 0x465f04
mov ecx, dword [esp + 0x12c]
mov edi, dword [esp + 0x128]
test ecx, ecx
je 0x465ef1
push ecx
push eax
push str._s::__s.html_main
call fcn.004558cb
add esp, 0xc
mov esi, eax
xor eax, eax
push eax
push eax
push esi
push edi
call dword [0x4b8338]
push esi
call fcn.00410bcd
add esp, 4
jmp 0x465efd
xor ecx, ecx
push ecx
push ecx
push eax
push edi
call dword [0x4b8338]
mov byte [0x4b8348], 1
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0046f0c8
add esp, 0x114
pop esi
pop edi
pop ebx
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call fcn.00410bcd
add esp, 4
cmp ebx, 0xffffffff
je 0x465eae
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x465eae
Function at 0x466c19
Capabilities:
Get session user name

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x4b507c]
xor eax, esp
mov dword [esp + 4], eax
cmp byte [0x4b8b6c], 0
je 0x466c3b
mov ecx, dword [0x4b8b68]
jmp 0x466c7a
push str.secur32.dll
call fcn.00466d24
add esp, 4
mov esi, eax
push str.sspicli.dll
call fcn.00466d24
add esp, 4
test esi, esi
je 0x466c6b
push str.GetUserNameExA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
jmp 0x466c6d
xor ecx, ecx
mov dword [0x4b8b68], ecx
mov byte [0x4b8b6c], 1
test ecx, ecx
je 0x466cc7
xor esi, esi
mov edi, esp
mov ebx, 8
mov dword [edi], esi
push edi
push esi
push ebx
call ecx
push esi
push 1
push dword [edi]
call fcn.00410b50
add esp, 0xc
mov esi, eax
push edi
push eax
push ebx
call dword [0x4b8b68]
test al, al
je 0x466cbe
push 0x40
push esi
call fcn.00472340
add esp, 8
test eax, eax
je 0x466d10
mov byte [eax], 0
jmp 0x466d10
push esi
call fcn.00410bcd
add esp, 4
mov edi, esp
xor eax, eax
mov dword [edi], eax
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x466cde
mov eax, dword [esp]
jmp 0x466cea
mov eax, 0x100
mov dword [esp], 0x100
push 0
push 1
push eax
call fcn.00410b50
add esp, 0xc
mov esi, eax
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x466d10
push esi
call fcn.00410bcd
add esp, 4
xor esi, esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.0046f0c8
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
ret

Function at 0x466d24
Capabilities:
Get common file path

Disassembly:
push ebx
push edi
push esi
mov esi, dword [esp + 0x10]
cmp dword [0x4b8b80], 0
jne 0x466d81
push dword [0x4b8b84]
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, dword [0x4b8b84]
jb 0x466d81
mov ebx, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
xor edi, edi
inc edi
push 0
push edi
push eax
push edi
push 0x4b8b84
push dword [0x4b8b80]
call fcn.00410bd9
add esp, 0x18
mov dword [0x4b8b80], eax
push dword [0x4b8b84]
push eax
call ebx
cmp eax, dword [0x4b8b84]
jae 0x466d53
push 0
push esi
push 0x4a5961
push dword [0x4b8b80]
call fcn.0045594b
add esp, 0x10
mov esi, eax
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
push esi
call fcn.00410bcd
add esp, 4
mov eax, edi
pop esi
pop edi
pop ebx
ret
Function at 0x46727d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov edx, dword [0x4b507c]
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
xor edi, edi
xor edx, esp
test ecx, ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
je 0x4672c7
lea edx, [esp + 0x10]
push edx
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
mov esi, 0
jne 0x467353
mov al, 1
mov dword [esp], eax
mov eax, dword [esp + 0x10]
jmp 0x4672ce
mov dword [esp], 0
mov ebp, dword [esp + 0x34]
lea ecx, [esp + 8]
xor esi, esi
lea ebx, [esp + 0xc]
push ecx
push esi
push ebx
push esi
push ebp
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x467341
cmp dword [esp + 0xc], 1
mov edi, 0
jne 0x467343
mov eax, dword [esp + 8]
xor esi, esi
inc eax
push esi
push 1
push eax
call fcn.00410b50
add esp, 0xc
mov edi, eax
mov eax, dword [esp + 8]
lea ecx, [esp + 4]
mov dword [ecx], eax
push ecx
push edi
push ebx
push esi
push ebp
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x467343
cmp dword [esp + 0xc], 1
jne 0x467343
mov eax, dword [esp + 4]
cmp eax, dword [esp + 8]
ja 0x467343
mov esi, edi
mov byte [edi + eax], 0
xor edi, edi
cmp byte [esp], 0
je 0x467353
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call fcn.00410bcd
add esp, 4
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0046f0c8
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret