joyce8/EMBER2024-capa huggingface dataset:
Function at 0x56e7e4
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
test dl, dl
je 0x56e7f9
add esp, 0xfffffff0
call fcn.004044a0
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov esi, dword [ebp + 8]
xor edx, edx
mov eax, ebx
call fcn.004040f8
lea eax, [ebx + 0xc]
mov edx, esi
call fcn.00405008
mov eax, esi
call fcn.00405474
push eax
xor eax, eax
mov al, byte [ebp + 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_CreateMutexA
mov edi, eax
mov dword [ebx + 8], edi
test edi, edi
jne 0x56e84e
mov ecx, dword [0x58fe48]
mov dl, 1
mov eax, dword [0x56e5bc]
call fcn.00569b6c
call fcn.00404908
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0xb7
sete al
mov byte [ebx + 4], al
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x56e875
call fcn.004044f8
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x56f634
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x56f6ea
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.00405474
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
jbe 0x56f6d4
lea eax, [ebp - 0x10]
mov edx, edi
call fcn.00405600
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
push eax
push edi
mov eax, dword [ebp - 0xc]
push eax
mov eax, esi
call fcn.00405474
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x56f6d4
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x56f6fc
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x56f6d4
cmp dword [ebp - 8], 0x34
jne 0x56f6d4
mov bl, 1
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
mov esi, eax
mov edi, edx
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56f6f1
lea eax, [ebp - 0x10]
call fcn.00404fb4
ret
Function at 0x57162c
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x154], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405464
xor eax, eax
push ebp
push 0x571764
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
cmp dword [ebp - 8], 0
setne bl
mov eax, dword [ebp - 4]
call fcn.00405274
mov edx, dword [ebp - 4]
cmp byte [edx + eax - 1], 0x5c
je 0x57168a
lea eax, [ebp - 4]
mov edx, 0x57177c
call fcn.0040527c
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.0040504c
lea eax, [ebp - 4]
mov edx, 0x571788
call fcn.0040527c
lea eax, [ebp - 0x150]
push eax
mov eax, dword [ebp - 4]
call fcn.00405474
push eax
call sub.KERNEL32.DLL_FindFirstFileA
mov edi, eax
cmp edi, 0xffffffff
je 0x571730
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x124]
call fcn.0040b2e0
mov eax, dword [ebp - 0xc]
mov edx, 0x571794
call fcn.004053c0
je 0x571717
mov eax, dword [ebp - 0xc]
mov edx, 0x5717a0
call fcn.004053c0
je 0x571717
test byte [ebp - 0x150], 0x10
je 0x571717
inc esi
test bl, bl
je 0x571717
lea eax, [ebp - 0x154]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
call fcn.004052c0
mov edx, dword [ebp - 0x154]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x150]
push eax
push edi
call sub.KERNEL32.DLL_FindNextFileA
test eax, eax
jne 0x57172b
or edi, 0xffffffff
cmp edi, 0xffffffff
jne 0x5716be
push edi
call sub.KERNEL32.DLL_FindClose
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57176b
lea eax, [ebp - 0x154]
call fcn.00404fb4
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00404fd8
lea eax, [ebp - 4]
call fcn.00404fb4
ret
Function at 0x571978
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffff684
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x197c], eax
mov dword [ebp - 0x1974], eax
mov dword [ebp - 0x1978], eax
mov dword [ebp - 0x1970], eax
mov dword [ebp - 0x196c], eax
mov dword [ebp - 0x1964], eax
mov dword [ebp - 0x1968], eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x571b59
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1964]
call fcn.0054be88
mov eax, dword [ebp - 0x1964]
push eax
lea eax, [ebp - 0x1968]
call fcn.0054c1c0
mov edx, dword [ebp - 0x1968]
lea eax, [ebp - 4]
pop ecx
call fcn.004052c0
mov dl, 1
mov eax, dword [0x41c8c4]
call fcn.004040f8
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
call fcn.00405274
mov ebx, eax
test ebx, ebx
jle 0x571a56
mov esi, 1
lea eax, [ebp - 0x196c]
push eax
mov ecx, 1
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.004054d4
lea eax, [ebp - 0x196c]
mov edx, 0x571b70
call fcn.0040527c
mov eax, dword [ebp - 0x196c]
mov ecx, dword [ebp - 0xc]
mov edx, 0x571b7c
call fcn.00572140
inc esi
dec ebx
jne 0x571a19
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x571b2e
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x571b2e
inc ebx
xor esi, esi
lea eax, [ebp - 0x1960]
xor ecx, ecx
mov edx, 0x1954
call fcn.0040379c
lea ecx, [ebp - 0x1970]
mov edx, esi
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x1970]
call fcn.00405474
push eax
lea eax, [ebp - 0x1960]
push eax
call sub.KERNEL32.DLL_lstrcpyA
lea eax, [ebp - 0x1960]
call fcn.00568cc4
lea eax, [ebp - 8]
lea edx, [ebp - 0x155f]
mov ecx, 0x401
call fcn.00405224
lea edx, [ebp - 0x1978]
mov eax, dword [ebp - 8]
call fcn.0040ade8
mov eax, dword [ebp - 0x1978]
lea edx, [ebp - 0x1974]
call fcn.00409af4
mov eax, dword [ebp - 0x1974]
mov edx, 0x571b8c
call fcn.004053c0
jne 0x571b26
lea ecx, [ebp - 0x197c]
mov edx, esi
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x197c]
call fcn.00405474
push eax
call sub.KERNEL32.DLL_DeleteFileA
inc esi
dec ebx
jne 0x571a7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x571b60
lea eax, [ebp - 0x197c]
mov edx, 7
call fcn.00404fd8
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404fd8
ret
Function at 0x572aa8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00405464
xor eax, eax
push ebp
push 0x572ba6
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov dl, 1
mov eax, dword [0x5632e4]
call fcn.00563b8c
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x572b3b
inc esi
xor ebx, ebx
lea ecx, [ebp - 0x10]
mov edx, ebx
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x10]
call fcn.0040a898
test al, al
je 0x572b37
lea ecx, [ebp - 0x14]
mov edx, ebx
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x3c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc ebx
dec esi
jne 0x572b03
mov dl, 1
mov eax, dword [ebp - 0xc]
call fcn.00568c18
mov dl, 1
mov eax, dword [ebp - 0xc]
call fcn.00568c38
mov eax, dword [ebp - 8]
call fcn.0040a898
test al, al
je 0x572b73
mov eax, dword [ebp - 8]
call fcn.00405474
push eax
call sub.KERNEL32.DLL_DeleteFileA
push 0xc8
call sub.KERNEL32.DLL_Sleep_1
mov eax, dword [ebp - 0xc]
call fcn.00564044
mov eax, dword [ebp - 0xc]
call fcn.00404128
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x572bad
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00404fd8
lea eax, [ebp - 8]
call fcn.00404fb4
ret
Function at 0x57344c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x154], edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x14c], edx
mov dword [ebp - 0x150], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x573603
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x41c8c4]
call fcn.004040f8
mov dword [ebp - 0x10], eax
xor edx, edx
mov eax, 2
call fcn.004d6408
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x13c], 0x128
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 0xc]
call fcn.004d6428
mov dword [ebp - 8], eax
jmp 0x5735b9
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x5735a8
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x134]
call fcn.0054a148
test al, al
jne 0x5735a8
lea ecx, [ebp - 0x144]
mov edx, esi
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00409aa4
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x150]
mov eax, dword [ebp - 0x134]
call fcn.004d64a8
mov edx, dword [ebp - 0x150]
lea eax, [ebp - 0x14c]
call fcn.0040523c
mov eax, dword [ebp - 0x14c]
lea edx, [ebp - 0x148]
call fcn.00409aa4
mov edx, dword [ebp - 0x148]
pop eax
call fcn.004055b8
test eax, eax
je 0x5735a0
push 0
mov eax, dword [ebp - 0x134]
push eax
push 0
push 1
call sub.KERNEL32.DLL_OpenProcess
push eax
call sub.KERNEL32.DLL_TerminateProcess
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x5735a0
lea ecx, [ebp - 0x154]
mov edx, esi
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x154]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
dec ebx
jne 0x5734e3
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 0xc]
call fcn.004d6448
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x5734cd
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_CloseHandle
mov ebx, dword [ebp - 0x10]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57360a
lea eax, [ebp - 0x154]
call fcn.00404fb4
lea eax, [ebp - 0x150]
call fcn.004056fc
lea eax, [ebp - 0x14c]
mov edx, 4
call fcn.00404fd8
ret
Function at 0x5739fc
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405464
lea eax, [ebp - 0x168]
mov edx, dword [0x408da8]
call fcn.00405ac4
xor eax, eax
push ebp
push 0x573b26
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0xc]
call fcn.0040b090
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0040ac94
mov eax, dword [ebp - 0x10]
call fcn.0040a8a8
test al, al
je 0x573afa
mov eax, dword [ebp - 0x10]
call fcn.00402d80
call fcn.00402d44
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040adb0
lea ecx, [ebp - 0x168]
mov edx, 0x3f
mov eax, dword [ebp - 8]
call fcn.0040aaac
mov eax, dword [ebp - 0x15c]
call fcn.0040a898
test al, al
je 0x573ad3
mov bl, 1
xor edx, edx
mov eax, dword [ebp - 0x15c]
call fcn.0040aa18
mov eax, dword [ebp - 0x15c]
call fcn.0040ab3c
test al, al
jne 0x573ad3
push 4
push 0
mov eax, dword [ebp - 0x15c]
call fcn.00405474
push eax
call sub.KERNEL32.DLL_MoveFileExA
cmp eax, 1
sbb ebx, ebx
inc ebx
lea eax, [ebp - 0x168]
call fcn.0040aafc
test eax, eax
je 0x573a8b
lea eax, [ebp - 0x168]
call fcn.0040ab20
mov eax, dword [ebp - 0xc]
call fcn.00402d80
call fcn.00402d44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x573b2d
lea eax, [ebp - 0x168]
mov edx, dword [0x408da8]
call fcn.00405b94
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404fd8
ret
Function at 0x57480c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405464
xor eax, eax
push ebp
push 0x574984
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x41c8c4]
call fcn.004040f8
mov dword [ebp - 8], eax
mov dl, 1
mov eax, dword [0x41c8c4]
call fcn.004040f8
mov dl, 1
mov eax, dword [0x41c8c4]
call fcn.004040f8
mov dl, 1
mov eax, dword [0x41c8c4]
call fcn.004040f8
mov dword [ebp - 0xc], eax
mov dl, 1
mov eax, dword [0x41c8c4]
call fcn.004040f8
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, dword [ebp - 4]
call fcn.00405474
push eax
call sub.KERNEL32.DLL_GetDriveTypeA
cmp eax, 2
jne 0x5748a8
mov eax, dword [0x58f748]
mov eax, dword [eax]
call fcn.00478a4c
push eax
lea edx, [ebp - 0xc]
mov cl, 1
mov eax, dword [ebp - 4]
call fcn.0054e634
mov esi, eax
jmp 0x5748c4
mov eax, dword [0x58f748]
mov eax, dword [eax]
call fcn.00478a4c
push eax
lea edx, [ebp - 0xc]
xor ecx, ecx
mov eax, dword [ebp - 4]
call fcn.0054e634
mov esi, eax
xor edx, edx
push ebp
push 0x574967
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.005726d4
test al, al
jne 0x5748ea
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
je 0x574956
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, dword [ebp - 4]
call fcn.00549a8c
mov ebx, eax
mov eax, dword [0x58f748]
mov eax, dword [eax]
cmp byte [eax + 0x674], 0
je 0x574942
mov eax, ebx
call fcn.005742ac
mov edx, eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, ebx
call fcn.00574508
mov edx, eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0xc]
call fcn.00573b34
mov edx, eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x40]
jmp 0x574956
mov edx, ebx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov edx, esi
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x40]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57496e
mov ebx, dword [ebp - 8]
ret
Function at 0x575684
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
xor edx, edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405464
lea eax, [ebp - 0x28]
mov edx, dword [0x571208]
call fcn.00405ac4
xor eax, eax
push ebp
push 0x57576b
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea ecx, [ebp - 0x28]
mov dx, word [0x57577c]
mov eax, dword [ebp - 4]
call fcn.005714c0
test al, al
je 0x575732
cmp byte [ebp - 0x18], 4
jne 0x575726
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x14]
call fcn.0040523c
lea eax, [ebp - 8]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x575788
call fcn.00575608
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.004054d4
lea eax, [ebp - 0x2c]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004052c0
mov eax, dword [ebp - 0x2c]
call fcn.00405474
push eax
call sub.KERNEL32.DLL_DeleteFileA
test eax, eax
je 0x575726
mov bl, 1
lea eax, [ebp - 0x28]
call fcn.00571540
test al, al
jne 0x5756d2
lea eax, [ebp - 0x28]
call fcn.0057155c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x575772
lea eax, [ebp - 0x2c]
call fcn.00404fb4
lea eax, [ebp - 0x28]
mov edx, dword [0x571208]
call fcn.00405b94
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404fd8
ret

Function at 0x575df0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
xor eax, eax
push ebp
push 0x575f04
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x41c8c4]
call fcn.004040f8
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
call fcn.0054c1c0
mov eax, dword [ebp - 4]
call fcn.00405274
mov ebx, eax
test ebx, ebx
jle 0x575e65
mov esi, 1
lea eax, [ebp - 0x10]
push eax
mov ecx, 1
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.004054d4
lea eax, [ebp - 0x10]
mov edx, 0x575f1c
call fcn.0040527c
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
dec ebx
jne 0x575e36
lea edx, [ebp - 0x18]
mov eax, dword [0x58fc34]
mov eax, dword [eax]
call fcn.00493c90
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.0040ac94
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 8]
mov ecx, 0x575f28
call fcn.004052c0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
mov ecx, 1
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004054d4
lea eax, [ebp - 0x1c]
mov edx, 0x575f3c
call fcn.0040527c
mov eax, dword [ebp - 0x1c]
call fcn.00405474
push eax
mov eax, dword [ebp - 8]
call fcn.00405474
push eax
push 0x575f40
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, dword [ebp - 0xc]
call fcn.0057344c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x575f0b
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.00404fd8
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404fd8
ret
Function at 0x57b134
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x57b24c
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, dword [0x58fc34]
mov eax, dword [eax]
call fcn.00493c90
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.0040ac94
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, 0x57b260
call fcn.004052c0
cmp byte [ebx + 0x674], 0
je 0x57b1cb
push 1
lea edx, [ebp - 0x14]
mov eax, dword [0x58fc34]
mov eax, dword [eax]
call fcn.00493c90
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.0040ac94
mov eax, dword [ebp - 0x10]
call fcn.00405474
push eax
push 0x57b26c
mov eax, dword [ebp - 4]
call fcn.00405474
push eax
push 0x57b278
mov eax, ebx
call fcn.00478a4c
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x57b231
push 0x40
lea edx, [ebp - 0x18]
mov eax, 0x57b288
call fcn.0050f520
mov eax, dword [ebp - 0x18]
call fcn.00405474
push eax
lea edx, [ebp - 0x1c]
mov eax, 0x57b294
call fcn.0050f520
mov eax, dword [ebp - 0x1c]
call fcn.00405474
push eax
mov eax, ebx
call fcn.00478a4c
push eax
call sub.user32.dll_MessageBoxA
push 1
push 0x57b298
push 0x57b298
mov eax, dword [0x58f470]
mov eax, dword [eax]
call fcn.00405474
push eax
push 0x57b278
mov eax, ebx
call fcn.00478a4c
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57b253
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.00404fd8
ret

Function at 0x57bf4c
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ecx
mov dword [esp], 7
push 0
lea eax, [esp + 4]
push eax
call sub.wininet.dll_InternetGetConnectedState
cmp eax, 1
sbb eax, eax
inc eax
pop edx
ret
Function at 0x580e78
Capabilities:
Create process on windows
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x580e80
push ebx
push esi
mov eax, 0x580700
call fcn.0040771c
xor eax, eax
push ebp
push 0x581019
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x58fc34]
mov eax, dword [eax]
call fcn.00493538
mov eax, dword [0x58fc34]
mov eax, dword [eax]
mov edx, 0x581030
call fcn.00493120
push 0x581040
push 0
push 0
call fcn.004079f4
mov ebx, eax
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0xb7
je 0x580f8f
mov ecx, dword [0x58f748]
mov eax, dword [0x58fc34]
mov eax, dword [eax]
mov edx, dword [0x5764ec]
call fcn.00493550
mov ecx, dword [0x58fdf4]
mov eax, dword [0x58fc34]
mov eax, dword [eax]
mov edx, dword [0x542ee4]
call fcn.00493550
lea edx, [ebp - 0x14]
mov eax, 1
call fcn.0040309c
mov eax, dword [ebp - 0x14]
mov edx, 0x581054
call fcn.004053c0
jne 0x580f81
mov eax, dword [0x58fc34]
mov eax, dword [eax]
mov byte [eax + 0x5b], 0
push 1
push 0xa
lea edx, [ebp - 0x18]
mov eax, 0x581064
call fcn.0050f520
mov eax, dword [ebp - 0x18]
push eax
lea edx, [ebp - 0x1c]
mov eax, 0x581070
call fcn.0050f520
mov edx, dword [ebp - 0x1c]
mov eax, dword [0x58f748]
mov eax, dword [eax]
mov eax, dword [eax + 0x3b4]
pop ecx
call fcn.00496884
mov eax, dword [0x58f748]
mov eax, dword [eax]
mov eax, dword [eax + 0x3b0]
mov dl, 1
call fcn.0043d590
mov eax, dword [0x58fc34]
mov eax, dword [eax]
call fcn.004935d0
jmp 0x580ffe
lea edx, [ebp - 0x24]
xor eax, eax
call fcn.0040309c
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.0040ad1c
mov edx, dword [ebp - 0x20]
mov eax, 0x5951f4
call fcn.00405008
mov eax, dword [0x5951f4]
call fcn.00405474
mov esi, eax
push esi
call sub.KERNEL32.DLL_GetDriveTypeA
cmp eax, 2
jne 0x580fe3
push 1
push 0x581074
push 0x581074
push esi
push 0x581078
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x580ff8
lea edx, [ebp - 0x28]
mov eax, 0x581088
call fcn.0050f520
mov eax, dword [ebp - 0x28]
call fcn.004391d8
push ebx
call sub.KERNEL32.DLL_ReleaseMutex
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x581020
lea eax, [ebp - 0x28]
mov edx, 6
call fcn.00404fd8
ret
Function at 0x401b30
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
sub esp, 0x108
mov eax, dword [0x40e00c]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
mov esi, dword [esp + 0x110]
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 4]
push ecx
push 0xf003f
push 0
lea edx, [esp + 0x14]
push edx
push 0x80000002
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, dword [esp + 4]
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x108]
pop esi
xor ecx, esp
call fcn.004024d9
add esp, 0x108
ret