joyce8/EMBER2024-capa huggingface dataset:
Function at 0x72bfcc
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff30
xor eax, eax
lea edx, [ebp - 4]
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov dword [ebp - 8], eax
push edx
push 0
push 0
push 3
push esi
call sub.advapi32.dll_GetTokenInformation
test eax, eax
je 0x72c00b
push 0x2f3
push 0x799b5f
push str._Result
call fcn.00724ad4
add esp, 0xc
call sub.kernel32.dll_GetLastError_2
cmp eax, 0x7a
je 0x72c01c
xor eax, eax
jmp 0x72c0cc
mov edx, dword [ebp - 4]
push edx
call fcn.00724b84
pop ecx
mov ebx, eax
test ebx, ebx
jne 0x72c033
xor eax, eax
jmp 0x72c0cc
lea edx, [ebp - 4]
push edx
mov ecx, dword [ebp - 4]
push ecx
push ebx
push 3
push esi
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x72c060
call sub.kernel32.dll_GetLastError_2
mov esi, eax
push ebx
call fcn.00724ba4
pop ecx
push esi
call sub.kernel32.dll_SetLastError
xor eax, eax
jmp 0x72c0cc
xor esi, esi
lea edi, [ebx + 0xc]
jmp 0x72c0b7
mov ecx, esi
lea eax, [ebp - 4]
shl ecx, 2
lea edx, [ebp - 0xd0]
mov dword [ebp - 4], 0x64
lea ecx, [ecx + ecx*2]
push eax
add ecx, ebx
push edx
add ecx, 4
push ecx
push 0
call sub.advapi32.dll_LookupPrivilegeNameW
test eax, eax
je 0x72c0b3
mov eax, dword [ebp + 0xc]
push eax
lea edx, [ebp - 0xd0]
push edx
call fcn.00724f10
add esp, 8
test eax, eax
jne 0x72c0b3
mov ecx, dword [edi]
and ecx, 2
mov dword [ebp - 8], ecx
jmp 0x72c0bb
inc esi
add edi, 0xc
cmp esi, dword [ebx]
jb 0x72c067
push ebx
call fcn.00724ba4
pop ecx
push 0
call sub.kernel32.dll_SetLastError
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x72c310
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor edi, edi
xor esi, esi
cmp dword [ebp + 0xc], 0
je 0x72c32b
call fcn.0072b668
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call fcn.007251dc
pop ecx
mov ebx, eax
test ebx, ebx
je 0x72c3a1
lea eax, [ebp - 0x14]
push eax
push ebx
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x72c3a1
mov edx, dword [ebp - 0x18]
push edx
call fcn.00724b84
pop ecx
mov esi, eax
test esi, esi
je 0x72c3a1
push esi
mov eax, dword [ebp - 0x18]
push eax
push 0
push ebx
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x72c3a1
lea edx, [ebp - 0xc]
push edx
lea ecx, [ebp - 8]
push ecx
push 0x799c2e
push esi
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x72c3a1
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0x10]
mov edi, 1
mov edx, dword [eax + 8]
mov dword [ecx], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0x14]
mov edx, dword [eax + 0xc]
mov dword [ecx], edx
call sub.kernel32.dll_GetLastError_2
mov dword [ebp - 0x10], eax
cmp dword [ebp + 0xc], 0
je 0x72c3b8
mov eax, dword [ebp - 4]
push eax
call fcn.0072b6d8
test ebx, ebx
je 0x72c3c3
push ebx
call fcn.00724ba4
pop ecx
test esi, esi
je 0x72c3ce
push esi
call fcn.00724ba4
pop ecx
mov edx, dword [ebp - 0x10]
push edx
call sub.kernel32.dll_SetLastError
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x72c3e4
Capabilities:
Check if file exists
Copy file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
xor ebx, ebx
test edi, edi
je 0x72c3ff
call fcn.0072b668
mov dword [ebp - 4], eax
test esi, esi
jne 0x72c41e
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x72c41e
and eax, 0xfffffffe
push eax
mov edx, dword [ebp + 0xc]
push edx
call sub.kernel32.dll_SetFileAttributesW
push esi
mov ecx, dword [ebp + 0xc]
push ecx
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_CopyFileW
test eax, eax
je 0x72c435
mov ebx, 1
call sub.kernel32.dll_GetLastError_2
mov esi, eax
test edi, edi
je 0x72c449
mov eax, dword [ebp - 4]
push eax
call fcn.0072b6d8
push esi
call sub.kernel32.dll_SetLastError
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x10

Function at 0x72c4b4
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
xor esi, esi
test edi, edi
je 0x72c4cf
call fcn.0072b668
mov dword [ebp - 4], eax
push ebx
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x72c4e4
and eax, 0xfffffffe
push eax
push ebx
call sub.kernel32.dll_SetFileAttributesW
push ebx
call sub.kernel32.dll_DeleteFileW
test eax, eax
jne 0x72c513
push 0
push 0x4000000
push 3
push 0
push 4
push 0x80000100
push ebx
call sub.kernel32.dll_CreateFileW_1
cmp eax, 0xffffffff
je 0x72c518
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x72c518
mov esi, 1
call sub.kernel32.dll_GetLastError_2
mov ebx, eax
test edi, edi
je 0x72c52c
mov eax, dword [ebp - 4]
push eax
call fcn.0072b6d8
push ebx
call sub.kernel32.dll_SetLastError
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x72c53c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
test esi, esi
je 0x72c554
call fcn.0072b668
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x72c572
test al, 0x10
jne 0x72c572
mov ebx, 1
push 0
call sub.kernel32.dll_SetLastError
call sub.kernel32.dll_GetLastError_2
mov edi, eax
test esi, esi
je 0x72c586
mov eax, dword [ebp - 4]
push eax
call fcn.0072b6d8
push edi
call sub.kernel32.dll_SetLastError
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
Function at 0x72c7a4
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor esi, esi
xor eax, eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 3
push 0
push 1
push 0x80000000
mov edx, dword [ebp + 8]
push edx
call sub.kernel32.dll_CreateFileW_1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x72c7dc
xor eax, eax
jmp 0x72c89e
push 0
mov edx, dword [ebp - 4]
push edx
call sub.kernel32.dll_GetFileSize_1
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 2
push 0
mov ecx, dword [ebp - 4]
push ecx
call sub.kernel32.dll_CreateFileMappingW
mov edi, eax
test edi, edi
je 0x72c871
push 0
push 0
push 0
push 4
push edi
call sub.kernel32.dll_MapViewOfFile
mov esi, eax
test esi, esi
je 0x72c871
mov eax, dword [ebp + 0xc]
push eax
call fcn.00724d20
pop ecx
mov dword [ebp - 8], eax
mov ebx, esi
jmp 0x72c847
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp + 0xc]
push edx
push ebx
call fcn.00724c1c
add esp, 0xc
test eax, eax
jne 0x72c846
mov dword [ebp - 0x10], 1
jmp 0x72c871
inc ebx
mov ecx, ebx
sub ecx, esi
mov eax, dword [ebp - 0xc]
sub eax, ecx
push eax
mov edx, dword [ebp + 0xc]
movsx ecx, byte [edx]
push ecx
push ebx
call fcn.00724d38
add esp, 0xc
mov ebx, eax
test eax, eax
jne 0x72c828
push 0x490
call sub.kernel32.dll_SetLastError
call sub.kernel32.dll_GetLastError_2
mov ebx, eax
test esi, esi
je 0x72c882
push esi
call sub.kernel32.dll_UnmapViewOfFile
test edi, edi
je 0x72c88c
push edi
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle_1
push ebx
call sub.kernel32.dll_SetLastError
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x72d5d8
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
xor eax, eax
push ebx
push esi
push edi
xor esi, esi
mov edi, str.Application
mov dword [ebp - 4], eax
cmp dword [0x7977e4], 0
mov ebx, edi
jne 0x72d60d
push 0x16
lea eax, [edi + 0x31]
push eax
lea edx, [edi + 0x18]
push edx
call fcn.00724ad4
add esp, 0xc
lea ecx, [edi + 0x60]
push ecx
lea eax, [ebp - 0x210]
push eax
call fcn.00724fcc
add esp, 8
push ebx
lea edx, [ebp - 0x210]
push edx
call fcn.00725138
add esp, 8
lea ecx, [edi + 0xb8]
push ecx
lea eax, [ebp - 0x210]
push eax
call fcn.00725138
add esp, 8
mov edx, dword [0x7977e4]
push edx
lea ecx, [ebp - 0x210]
push ecx
call fcn.00725138
add esp, 8
lea eax, [ebp - 4]
lea edx, [ebp - 0x210]
push 0
push eax
push 0
push 0x20006
push 0
push 0
push 0
push edx
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExW
mov ebx, eax
test ebx, ebx
je 0x72d696
xor eax, eax
mov dword [ebp - 4], eax
push ebx
call sub.kernel32.dll_SetLastError
jmp 0x72d72f
lea edx, [edi + 0xbc]
push edx
lea ecx, [ebp - 0x210]
push ecx
call fcn.00724fcc
add esp, 8
mov eax, dword [ebp + 8]
push eax
lea edx, [ebp - 0x210]
push edx
call fcn.00725138
add esp, 8
lea ecx, [ebp - 0x210]
push ecx
call fcn.00724c48
add eax, eax
pop ecx
add eax, 2
lea edx, [edi + 0xea]
push eax
lea eax, [ebp - 0x210]
push eax
push 2
push 0
push edx
mov ecx, dword [ebp - 4]
push ecx
call sub.advapi32.dll_RegSetValueExW
mov ebx, eax
test ebx, ebx
je 0x72d6fb
push ebx
call sub.kernel32.dll_SetLastError
jmp 0x72d72f
mov dword [ebp - 8], 7
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
lea edx, [edi + 0x10c]
push edx
mov ecx, dword [ebp - 4]
push ecx
call sub.advapi32.dll_RegSetValueExW
mov ebx, eax
test ebx, ebx
je 0x72d72a
push ebx
call sub.kernel32.dll_SetLastError
jmp 0x72d72f
mov esi, 1
call sub.kernel32.dll_GetLastError_2
cmp dword [ebp - 4], 0
mov ebx, eax
je 0x72d745
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
push ebx
call sub.kernel32.dll_SetLastError
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x72d754
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor esi, esi
call sub.kernel32.dll_GetLastError_2
mov dword [ebp - 0xc], eax
cmp dword [0x7977e4], 0
jne 0x72d787
push 0xa3
push str.....DriverLibrariesEventLogumodeevtlog.c
push str.EvtLogSourceName___NULL
call fcn.00724ad4
add esp, 0xc
mov eax, dword [ebp + 0xc]
push eax
call fcn.00724d20
pop ecx
mov edi, eax
inc edi
mov eax, dword [ebp + 0x10]
push eax
call fcn.00724d20
pop ecx
inc eax
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
add edx, edi
add edx, 4
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
push ecx
call fcn.00724b84
pop ecx
mov ebx, eax
test ebx, ebx
je 0x72d82c
mov eax, dword [ebp + 0x14]
mov dword [ebx], eax
push edi
mov edx, dword [ebp + 0xc]
push edx
lea ecx, [ebx + 4]
push ecx
call fcn.00724bdc
add esp, 0xc
mov eax, dword [ebp - 4]
add edi, ebx
add edi, 4
push eax
mov edx, dword [ebp + 0x10]
push edx
push edi
call fcn.00724bdc
add esp, 0xc
cmp dword [ebp + 0x18], 0
jne 0x72d7fb
mov dword [ebp + 0x18], 0x799f82
xor ecx, ecx
mov dword [ebp + 0x1c], ecx
mov eax, dword [0x7977e4]
push eax
push 0
call sub.advapi32.dll_RegisterEventSourceW
mov esi, eax
test esi, esi
je 0x72d82c
lea eax, [ebp + 0x18]
push ebx
push eax
mov edx, dword [ebp - 8]
push edx
push 1
push 0
push 1
push 0
mov cx, word [ebp + 8]
push ecx
push esi
call sub.advapi32.dll_ReportEventW
test eax, eax
test esi, esi
je 0x72d836
push esi
call sub.advapi32.dll_DeregisterEventSource
push ebx
call fcn.00724ba4
cmp dword [ebp + 0x1c], 0
pop ecx
je 0x72d84d
mov eax, dword [ebp + 0x18]
push eax
call fcn.00724ba4
pop ecx
mov edx, dword [ebp - 0xc]
push edx
call sub.kernel32.dll_SetLastError
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x72e4ec
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a074
xor eax, eax
push ebp
push 0x72e55b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
movzx edx, word [edx]
call fcn.0040aef0
lea eax, [ebp - 8]
mov edx, 0x72e578
call fcn.0040b0dc
mov eax, dword [ebp - 8]
call fcn.0040aec8
push eax
call sub.kernel32.dll_GetDriveTypeW
cmp eax, 5
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x72e562
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409ff0
ret
Function at 0x734a98
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a074
xor eax, eax
push ebp
push 0x734b3d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00409f90
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004279f8
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.0042e27c
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.0040a3b8
push 0x20
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.0040aec8
push eax
call sub.kernel32.dll_GetVolumeInformationW
test eax, eax
je 0x734b22
mov eax, ebx
lea edx, [ebp - 0x38]
mov ecx, 0x10
call fcn.0040af84
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x734b44
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00409ff0
ret

Function at 0x735c18
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, esi
call fcn.004b4124
mov edi, eax
mov ebx, dword [esi + 4]
add ebx, edi
mov eax, esi
mov edx, dword [eax]
call dword [edx]
sub eax, edi
dec eax
test eax, eax
jl 0x735c47
inc eax
xor edx, edx
mov ecx, edx
add cl, 0xa
xor byte [ebx], cl
inc ebx
inc edx
dec eax
jne 0x735c3b
pop edi
pop esi
pop ebx
ret

Function at 0x736b7c
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
test dl, dl
je 0x736b9c
add esp, 0xfffffff0
call fcn.00408808
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x736c27
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x736c58
call fcn.0040a3b8
lea edx, [ebp - 8]
mov eax, dword [0x79fc50]
call fcn.0042eb6c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0x11
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0x11
lea edx, [ebp - 0x1c]
mov ecx, 1
mov eax, 0x736c98
call fcn.004286c4
mov esi, dword [ebp - 0xc]
mov dword [ebp - 0x20], esi
mov eax, dword [ebp - 0x20]
call fcn.0040aec8
push eax
call sub.kernel32.dll_OutputDebugStringW
mov eax, edi
mov edx, dword [eax]
call dword [edx]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x736c2e
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00409ff0
ret
Function at 0x7371dc
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
call fcn.0040dc6c
push dword [ebp + 8]
xor eax, eax
push ebp
push 0x7372b5
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x1388
mov eax, dword [0x7a3e54]
push eax
call sub.kernel32.dll_WaitForSingleObject
xor eax, eax
push ebp
push 0x7372a1
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x7a3e58], 1
lea edx, [ebp - 8]
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov eax, dword [ebp - 4]
call fcn.00734618
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7372a8
mov eax, dword [0x7a3e54]
push eax
call sub.kernel32.dll_ReleaseMutex
mov eax, 0x7372ec
call fcn.0040aec8
push eax
call sub.kernel32.dll_OutputDebugStringW
mov eax, dword [0x79b5a8]
mov eax, dword [eax]
call fcn.005f3538
mov eax, dword [0x79b5a8]
mov eax, dword [eax]
call fcn.005f357c
mov eax, 0x73732c
call fcn.0040aec8
push eax
call sub.kernel32.dll_OutputDebugStringW
push 0x14
call sub.kernel32.dll_Sleep_2
mov byte [0x7a3e58], 0
ret

Function at 0x73b114
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x73b1fc
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0073a640
mov eax, dword [0x79c180]
movzx eax, byte [eax]
mov edx, dword [0x79ba14]
cmp al, 0x1f
ja 0x73b154
and eax, 0x7f
bt dword [edx], eax
jb 0x73b15f
cmp dword [ebp - 4], 0
setne al
jmp 0x73b161
xor eax, eax
test al, al
je 0x73b171
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.004271e8
jmp 0x73b173
xor eax, eax
test al, al
je 0x73b1c7
push 5
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00427994
mov eax, dword [ebp - 8]
call fcn.0040aec8
push eax
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0x14], esi
mov byte [ebp - 0x10], 0x11
lea edx, [ebp - 0x14]
xor ecx, ecx
mov eax, 0x73b218
call fcn.004286c4
mov eax, dword [ebp - 0xc]
call fcn.0040aec8
push eax
mov eax, dword [ebp - 4]
call fcn.0040aec8
push eax
push 0x73b224
push 0
call sub.shell32.dll_ShellExecuteW
jmp 0x73b1e1
push 5
push 0
push 0
mov eax, esi
call fcn.0040aec8
push eax
push 0x73b224
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x73b203
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00409ff0
ret

Function at 0x73c04c
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
xor ecx, ecx
mov edx, 0x40
call fcn.00407764
ret
Function at 0x73c404
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebp, edx
mov edi, 0x79a898
test ebp, ebp
je 0x73c4f6
mov ebx, eax
mov eax, ebp
mov esi, 3
cdq
idiv esi
lea eax, [eax + eax*2]
mov dword [esp], eax
mov esi, ebx
add esi, dword [esp]
jmp 0x73c485
movzx eax, byte [ebx]
shl eax, 8
movzx edx, byte [ebx + 1]
or eax, edx
shl eax, 8
movzx edx, byte [ebx + 2]
or eax, edx
add ebx, 3
mov edx, 0x3f
and edx, eax
movzx edx, byte [edi + edx]
mov byte [ecx + 3], dl
shr eax, 6
mov edx, 0x3f
and edx, eax
movzx edx, byte [edi + edx]
mov byte [ecx + 2], dl
shr eax, 6
mov edx, 0x3f
and edx, eax
movzx edx, byte [edi + edx]
mov byte [ecx + 1], dl
shr eax, 6
movzx eax, byte [edi + eax]
mov byte [ecx], al
add ecx, 4
cmp ebx, esi
jb 0x73c431
sub ebp, dword [esp]
dec ebp
je 0x73c494
dec ebp
je 0x73c4bb
jmp 0x73c4f6
movzx eax, byte [ebx]
shl eax, 4
mov edx, 0x3f
and edx, eax
movzx edx, byte [edi + edx]
mov byte [ecx + 1], dl
shr eax, 6
movzx eax, byte [edi + eax]
mov byte [ecx], al
mov byte [ecx + 2], 0x3d
mov byte [ecx + 3], 0x3d
jmp 0x73c4f6
movzx eax, byte [ebx]
shl eax, 8
movzx edx, byte [ebx + 1]
or eax, edx
shl eax, 2
mov edx, 0x3f
and edx, eax
movzx edx, byte [edi + edx]
mov byte [ecx + 2], dl
shr eax, 6
mov edx, 0x3f
and edx, eax
movzx edx, byte [edi + edx]
mov byte [ecx + 1], dl
shr eax, 6
movzx eax, byte [edi + eax]
mov byte [ecx], al
mov byte [ecx + 3], 0x3d
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x73cb9c
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 6
push 0
push 0
dec ecx
jne 0x73cba5
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp - 4]
call fcn.0040a074
xor eax, eax
push ebp
push 0x73cd79
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x14]
or ecx, 0xffffffff
mov eax, 0x73cd98
call fcn.004286c4
mov eax, dword [ebp - 0x14]
call fcn.0040aec8
push eax
call sub.kernel32.dll_OutputDebugStringW
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x20], ebx
mov byte [ebp - 0x1c], 0
lea edx, [ebp - 0x20]
xor ecx, ecx
mov eax, 0x73cdfc
call fcn.004286c4
mov eax, dword [ebp - 0x18]
call fcn.0040aec8
push eax
call sub.kernel32.dll_OutputDebugStringW
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0xc]
call fcn.0073d280
mov ecx, dword [ebp - 0x24]
lea edx, [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.0073d89c
lea edx, [ebp - 4]
mov ecx, ebx
mov eax, dword [ebp - 0xc]
call fcn.0073d8d4
lea ecx, [ebp - 0x28]
mov edx, esi
mov eax, dword [ebp - 0xc]
call fcn.0073d0a4
mov ecx, dword [ebp - 0x28]
lea edx, [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.0073d944
lea ecx, [ebp - 0x2c]
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp - 0xc]
call fcn.0073d0a4
mov ecx, dword [ebp - 0x2c]
lea edx, [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.0073d9e4
cmp byte [ebp + 8], 0
je 0x73cd13
lea eax, [ebp - 8]
call fcn.00409f90
xor eax, eax
push ebp
push 0x73ccfb
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x30]
xor eax, eax
call fcn.00406b1c
mov ecx, dword [ebp - 0x30]
mov dl, 1
mov eax, dword [0x5dd3d0]
call fcn.005dea20
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x73ccea
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 8]
mov edx, 4
mov eax, dword [ebp - 0x10]
call fcn.005dfe70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x73ccf1
mov eax, dword [ebp - 0x10]
call fcn.004081f0
ret
movzx ecx, byte [ebp + 0xc]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.0073dac0
lea eax, [ebp - 0x34]
push eax
lea edx, [ebp - 0x14]
or ecx, 0xffffffff
mov eax, 0x73ce30
call fcn.004286c4
mov eax, dword [ebp - 0x34]
call fcn.0040aec8
push eax
call sub.kernel32.dll_OutputDebugStringW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x73cd80
lea eax, [ebp - 0x34]
mov edx, 5
call fcn.00409ff0
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00409ff0
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409ff0
ret
Function at 0x741518
Capabilities:
Create process on windows

Disassembly:
push 0
push 0
push 0x741548
push 0x7415a8
push 0
push 0
call sub.shell32.dll_ShellExecuteW
push 0
push 0
push 0x7415b8
push 0x7415a8
push 0
push 0
call sub.shell32.dll_ShellExecuteW
ret

Function at 0x741618
Capabilities:
Create process on windows

Disassembly:
push 0
push 0
push 0x741660
push 0x7416c4
push 0
push 0
call sub.shell32.dll_ShellExecuteW
push 0
push 0
push 0x7416d4
push 0x7416c4
push 0
push 0
call sub.shell32.dll_ShellExecuteW
push 0
push 0
push 0x74173c
push 0x7416c4
push 0
push 0
call sub.shell32.dll_ShellExecuteW
ret

Function at 0x741764
Capabilities:
Create process on windows

Disassembly:
push 0
push 0
push 0x7417ac
push 0x741808
push 0
push 0
call sub.shell32.dll_ShellExecuteW
push 0
push 0
push 0x741818
push 0x741808
push 0
push 0
call sub.shell32.dll_ShellExecuteW
push 0
push 0
push 0x74187c
push 0x741808
push 0
push 0
call sub.shell32.dll_ShellExecuteW
ret

Function at 0x7418a4
Capabilities:
Create process on windows

Disassembly:
push 0
push 0
push 0x7418ec
push 0x74195c
push 0
push 0
call sub.shell32.dll_ShellExecuteW
push 0
push 0
push 0x74196c
push 0x74195c
push 0
push 0
call sub.shell32.dll_ShellExecuteW
push 0
push 0
push 0x7419e4
push 0x74195c
push 0
push 0
call sub.shell32.dll_ShellExecuteW
ret