joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4044f0
Capabilities:
Check if file exists
Get disk information

Disassembly:
sub esp, 0xc
mov eax, dword [0x440750]
xor eax, esp
mov dword [esp + 8], eax
push esi
mov esi, dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 3
jl 0x404587
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x404531
mov eax, 1
pop esi
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.0042497b
add esp, 0xc
ret 4
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsUNCW]
test eax, eax
jne 0x40451a
cmp word [esi + 4], 0x5c
jne 0x404587
push esi
call dword [sym.imp.SHLWAPI.dll_PathGetDriveNumberW]
cmp eax, 0xffffffff
je 0x404587
add eax, 0x41
mov word [esp + 4], ax
mov eax, 0x3a
mov word [esp + 6], ax
lea eax, [esp + 4]
mov ecx, 0x5c
xor edx, edx
push eax
mov word [esp + 0xc], cx
mov word [esp + 0xe], dx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
je 0x404587
cmp eax, 5
jne 0x40451a
mov ecx, dword [esp + 0xc]
pop esi
xor ecx, esp
xor eax, eax
call fcn.0042497b
add esp, 0xc
ret 4

Function at 0x404c90
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x414
mov eax, dword [0x440750]
xor eax, esp
mov dword [esp + 0x410], eax
push esi
mov esi, ecx
cmp dword [esi + 0x6ac], 0
je 0x404d4f
cmp dword [esi + 0x50], 8
jb 0x404cbf
mov eax, dword [esi + 0x3c]
jmp 0x404cc2
lea eax, [esi + 0x3c]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push eax
lea eax, [esp + 0xc]
push eax
call edi
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
cmp dword [esi + 0x6b0], 8
jb 0x404ced
mov esi, dword [esi + 0x69c]
jmp 0x404cf3
add esi, 0x69c
push esi
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [esp + 8]
push 0x2d
push eax
call fcn.00424e02
mov esi, eax
add esp, 8
test esi, esi
je 0x404d36
push esi
lea ecx, [esp + 0x214]
push ecx
call edi
push 1
xor edx, edx
push edx
lea eax, [esp + 0x218]
push eax
lea ecx, [esp + 0x14]
mov word [esi], dx
push ecx
jmp 0x404d41
push 1
push 0
push 0
lea edx, [esp + 0x14]
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop edi
mov ecx, dword [esp + 0x414]
pop esi
xor ecx, esp
call fcn.0042497b
add esp, 0x414
ret
Function at 0x405aa0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4317c3
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x440750]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor edi, edi
mov dword [esi + 4], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], vtable.WTL::CMessageFilter.0
mov dword [esi + 0x24], vtable.WTL::CIdleHandler.0
mov dword [esi], vtable.CMainDlg.2.0
mov dword [esi + 0x20], vtable.CMainDlg.1.0
mov dword [esi + 0x24], vtable.CMainDlg.0
xor eax, eax
mov dword [esi + 0x50], 7
mov dword [esi + 0x4c], edi
mov dword [esp + 0x18], edi
mov word [esi + 0x3c], ax
lea ecx, [esi + 0x26c]
mov byte [esp + 0x18], 1
call fcn.0040ad40
mov dword [esi + 0x284], edi
mov dword [esi + 0x6b0], 7
mov dword [esi + 0x6ac], edi
push 0x104
xor ecx, ecx
mov word [esi + 0x69c], cx
lea edx, [esi + 0x490]
push edi
push edx
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
call fcn.00424c20
push 0x104
lea eax, [esi + 0x288]
push edi
push eax
call fcn.00424c20
add esp, 0x18
push str.Arial
push 0x20
push edi
push edi
push edi
push 0x86
push edi
push edi
push edi
push 0x190
push edi
push edi
push edi
push 0xc
call dword [sym.imp.GDI32.dll_CreateFontW]
mov dword [esi + 0x284], eax
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x408070
Capabilities:
Create thread

Disassembly:
sub esp, 0x414
mov eax, dword [0x440750]
xor eax, esp
mov dword [esp + 0x410], eax
push esi
xor eax, eax
push 0x206
mov esi, ecx
push eax
lea ecx, [esp + 0x216]
push ecx
mov word [esp + 0x218], ax
call fcn.00424c20
mov eax, dword [0x443b00]
add esp, 0xc
push 0x104
lea edx, [esp + 0x210]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0xe]
push edx
mov word [esp + 0x10], cx
call fcn.00424c20
mov ecx, dword [esi + 4]
add esp, 0xc
push 0x104
lea eax, [esp + 8]
push eax
push 0x3e9
push ecx
call dword [sym.imp.USER32.dll_GetDlgItemTextW]
lea edx, [esp + 4]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [esp + 4]
push eax
mov ecx, esi
call fcn.004044f0
test eax, eax
jne 0x408141
push 0x30
push eax
cmp dword [0x441720], eax
je 0x40812d
mov ecx, dword [esi + 4]
push 0x434f8c
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x40822a
mov edx, dword [esi + 4]
push str.path_Error
push edx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x40822a
lea eax, [esp + 4]
lea edx, [eax + 2]
jmp 0x408150
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x408150
push ebx
sub eax, edx
push edi
sar eax, 1
push eax
lea eax, [esp + 0x10]
push eax
lea ecx, [esi + 0x38]
call fcn.00406130
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 1
push 1
push 0
call edi
push 0
push 0
push 1
push 0
mov dword [esi + 0x25c], eax
call edi
lea ecx, [esi + 0x268]
push ecx
push 0
push esi
push 0x407b80
push 0
push 0
mov dword [esi + 0x260], eax
call fcn.0042572c
mov edx, dword [esi + 4]
add esp, 0x18
push 0
push 0x64
push 0x6f
push edx
mov dword [esi + 0x264], eax
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, dword [esi + 4]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 1
push eax
call edi
mov ebx, dword [sym.imp.USER32.dll_EnableWindow]
push 0
push eax
call ebx
mov ecx, dword [esi + 4]
push 0x3e9
push ecx
call edi
push 0
push eax
call ebx
mov edx, dword [esi + 4]
push 3
push edx
call edi
push 0
push eax
call ebx
mov eax, dword [esi + 4]
push 0x3f1
push eax
call edi
push 0xfffff7ff
push 3
mov esi, eax
push 0x44d
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x434728
push esi
call dword [sym.imp.USER32.dll_SetWindowTextW]
pop edi
pop ebx
mov ecx, dword [esp + 0x414]
pop esi
xor ecx, esp
xor eax, eax
call fcn.0042497b
add esp, 0x414
ret 0x10
Function at 0x408840
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x408859
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x408894
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x408890
lea ebx, [ebx]
cmp esi, eax
jae 0x408894
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x408880
cmp esi, eax
jb 0x40889a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x409700
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebx
push edi
mov edi, dword [esp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x409765
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
test bl, 1
je 0x409728
and eax, 0xfffffffe
push eax
push edi
call ebp
push 0
push 0x2000000
push 3
push 0
push 3
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40975f
lea ecx, [esp + 0x18]
push ecx
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push edi
call ebp
pop esi
pop ebp
pop edi
pop ebx
ret 0xc
Function at 0x40c640
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x431f98
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x440750]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov dword [esp + 8], 0
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
push eax
push ecx
mov ecx, dword [esp + 0x2c]
push edx
mov edx, dword [esp + 0x2c]
lea eax, [esp + 0x18]
push eax
push ecx
push edx
mov dword [esp + 0x30], 0
call fcn.0040c4c0
mov esi, eax
mov eax, dword [esp + 0x24]
add esp, 0x1c
mov dword [esp + 0x14], 0xffffffff
test eax, eax
je 0x40c6b4
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x41b450
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
mov ecx, dword [esp + 4]
test ecx, ecx
jbe 0x41b47c
push esi
jmp 0x41b460
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x444720]
dec ecx
inc edx
test ecx, ecx
ja 0x41b460
pop esi
ret 4

Function at 0x41d7b0
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
ret
Function at 0x41dd30
Capabilities:
Create thread

Disassembly:
push ecx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
lea eax, [esp]
push eax
push 0
push ecx
push edx
push 0
push 0
call fcn.0042572c
mov ecx, dword [esp + 0x20]
push eax
mov dword [ecx], eax
call fcn.0041dd00
add esp, 0x20
ret

Function at 0x41df00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43323f
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x440750]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
xor eax, eax
mov dword [esi], eax
mov dword [esp + 0x1c], eax
mov dword [esi + 4], eax
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
lea ecx, [esi + 0x10]
mov edx, 8
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], edx
mov dword [ecx], vtable.CRecordVector_unsigned_long_long_unsigned___int64__.0
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], edx
mov dword [esi + 0x24], vtable.CRecordVector_unsigned_long_long_unsigned___int64__.0
lea ebx, [esi + 0x38]
mov edx, 4
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], edx
mov dword [ebx], vtable.CRecordVector_unsigned_long_long_unsigned___int64__const__.0
lea edi, [esi + 0x4c]
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], edx
mov dword [edi], vtable.CRecordVector_unsigned_long_long_unsigned___int64__const__.0
mov eax, dword [esi + 8]
push eax
mov byte [esp + 0x20], 5
call fcn.0041fdf0
mov ecx, dword [esi + 8]
push ecx
mov ecx, ebx
call fcn.0041fdf0
mov edx, dword [esi + 0xc]
push edx
mov ecx, edi
call fcn.0041fdf0
mov eax, dword [esi + 0xc]
push eax
mov ecx, edi
call fcn.0041fdf0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 8
Function at 0x41f730
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x433540
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push ebp
push esi
push edi
mov eax, dword [0x440750]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x58]
mov eax, dword [ebp]
mov edi, dword [esp + 0x54]
xor ecx, ecx
xor edx, edx
mov dword [ebp + 4], ecx
mov word [eax], dx
movzx eax, word [edi]
xor esi, esi
cmp ax, cx
je 0x41f77d
inc esi
cmp word [edi + esi*2], cx
jne 0x41f776
cmp esi, 1
movzx ebx, ax
jl 0x41f8c9
cmp bx, 0x5c
je 0x41f8c9
cmp bx, 0x2e
jne 0x41f7b1
cmp esi, 1
je 0x41f8c9
cmp esi, 2
jne 0x41f7b1
cmp word [edi + 2], bx
je 0x41f8c9
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
push 3
lea ecx, [esp + 0x18]
call fcn.0040b530
cmp esi, 3
mov dword [esp + 0x4c], 0
jle 0x41f7f8
cmp word [edi + 2], 0x3a
jne 0x41f7f8
cmp word [edi + 4], 0x5c
jne 0x41f7f8
cmp bx, 0x61
jb 0x41f7ef
cmp bx, 0x7a
jbe 0x41f85a
add ebx, 0xffffffbf
cmp bx, 0x19
jbe 0x41f85a
cmp dword [esp + 0x1c], 0x105
jg 0x41f810
push 0x105
lea ecx, [esp + 0x18]
call fcn.0040b530
mov eax, dword [esp + 0x14]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [esp + 0x14]
mov esi, eax
call fcn.0041f1c0
test esi, esi
je 0x41f8df
cmp esi, 0x104
ja 0x41f8df
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
cmp word [edx + ecx*2 - 2], 0x5c
je 0x41f85a
push 0x5c
lea ecx, [esp + 0x18]
call fcn.004127e0
push 0x435a74
lea ecx, [esp + 0x3c]
call fcn.0040b5a0
lea ecx, [esp + 0x14]
push ecx
push eax
lea edx, [esp + 0x34]
push edx
mov byte [esp + 0x58], 1
call fcn.00418500
push edi
push eax
lea eax, [esp + 0x34]
push eax
mov byte [esp + 0x64], 2
call fcn.0041f6b0
add esp, 0x18
push eax
mov ecx, ebp
mov byte [esp + 0x50], 3
call fcn.00412790
mov ecx, dword [esp + 0x20]
push ecx
call fcn.00424c0b
mov edx, dword [esp + 0x30]
push edx
call fcn.00424c0b
mov eax, dword [esp + 0x40]
push eax
call fcn.00424c0b
mov ecx, dword [esp + 0x20]
push ecx
call fcn.00424c0b
add esp, 0x10
mov al, 1
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret
mov eax, dword [esp + 0x14]
push eax
call fcn.00424c0b
add esp, 4
xor al, al
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret

Function at 0x420b60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x433739
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x440750]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
mov esi, dword [esp + 0x30]
mov dword [esp + 0xc], 0
mov edi, dword [esp + 0x2c]
push eax
push edi
mov dword [esp + 0x2c], 0
call fcn.00420950
add esp, 8
lea ecx, [esp + 0x10]
push ecx
mov ecx, edi
mov dword [esp + 0x28], 0
mov dword [esp + 0x10], 1
call fcn.004208d0
push eax
mov ecx, edi
call fcn.00420ac0
mov edx, dword [esp + 0x10]
push edx
call fcn.00424c0b
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret
Function at 0x423c3e
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x443ac4], 0
push esi
jne 0x423bb1
call fcn.00423ad7
test eax, eax
je 0x423bf4
mov eax, dword [0x443ac4]
cmp eax, 1
jne 0x423bd2
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x423bf4
pop esi
ret
push eax
call dword [0x443acc]
test eax, eax
jne 0x423c3c
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x423bf8
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x443ac4]
call dword [0x443acc]
mov edi, eax
test edi, edi
je 0x423c1d
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x423c39
mov edi, esi
add esi, 0xff0
push edi
push dword [0x443ac4]
call dword [0x443ac8]
add edi, 0x10
cmp edi, esi
jb 0x423c25
mov eax, edi
pop edi
pop esi
ret
jmp 0x423b9e

Function at 0x42497b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x440750]
jne 0x424985
repz ret
jmp fcn.00428a1c

Function at 0x42c894
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00428361
and dword [ebp - 4], 0
cmp dword [0x44462c], 0
mov ebx, eax
jne 0x42c945
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x42c9f6
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x42c9f6
push eax
call fcn.004282ef
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x44462c], eax
call esi
push eax
call fcn.004282ef
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x444630], eax
call esi
push eax
call fcn.004282ef
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x444634], eax
call esi
push eax
call fcn.004282ef
pop ecx
mov dword [0x44463c], eax
test eax, eax
je 0x42c945
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004282ef
pop ecx
mov dword [0x444638], eax
mov eax, dword [0x444638]
cmp eax, ebx
je 0x42c99d
cmp dword [0x44463c], ebx
je 0x42c99d
push eax
call fcn.0042836a
push dword [0x44463c]
mov esi, eax
call fcn.0042836a
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x42c99d
test edi, edi
je 0x42c99d
call esi
test eax, eax
je 0x42c994
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x42c994
test byte [ebp - 0xc], 1
jne 0x42c99d
or dword [ebp + 0x10], 0x200000
jmp 0x42c9d6
mov eax, dword [0x444630]
cmp eax, ebx
je 0x42c9d6
push eax
call fcn.0042836a
pop ecx
test eax, eax
je 0x42c9d6
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x42c9d6
mov eax, dword [0x444634]
cmp eax, ebx
je 0x42c9d6
push eax
call fcn.0042836a
pop ecx
test eax, eax
je 0x42c9d6
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44462c]
call fcn.0042836a
pop ecx
test eax, eax
je 0x42c9f6
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x42c9f8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x56afb1
Capabilities:
Encode data using xor

Disassembly:
cmp edi, ebx
pushal
lea esp, [esp + 0x30]
ja 0x5904e7
mov al, bh
sub ebx, edi
shl di, cl
test dl, ch
jge 0x590731
add ebx, esp
lea edi, [edi - 0x5a8e3028]
mov edi, ebx
neg al
shrd di, cx, 0xb
add ebx, esp
push ebp
jmp 0x56c0bd

Function at 0x595e2e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test ch, bl
sub eax, eax
cmp dh, 0xd4
bt edi, 9
xchg dword [ebp + ecx*4], eax
pushfd
cmp bh, 0x95
mov dword [esp + 4], eax
pushfd
jmp 0x5979ce
cmp di, ax
cmc
bt sp, 1
pushfd
sub ecx, 1
pushfd
lea esp, [esp + 8]
jne 0x596588
pushal
mov byte [esp + 8], bl
xor eax, eax
mov word [esp + 4], 0xb914
push edx
pushfd
pushfd
xchg dword [ebp], eax
mov byte [esp], dl
mov dword [esp + 0x28], 0x596ead
mov byte [esp + 4], 0x45
mov dword [esp + 0x24], eax
mov byte [esp + 4], 0xf6
push dword [esp + 0x24]
ret 0x28
add esp, 8
je 0x597350
sub ecx, 1
push 0x2d3d104e
push 0xbd1fd183
lea esp, [esp + 8]
jne 0x596588
cmp cl, cl
bt bx, 1
xor eax, eax
push 0xf22965c5
xchg dword [ebp], eax
pushal
mov byte [esp + 8], 0x7c
mov dword [esp + 0x20], 0x5964cc
pushfd
call fcn.0059753f
Function at 0x414470
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4775db
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0046ba9a
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x4144f2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.004698ba
mov eax, dword [eax]
push 0x5581d0
push eax
call fcn.0045bc64
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0046bd25
test bl, bl
je 0x4144f2
push 0x5581d0
lea ecx, [esp + 0xc]
call fcn.0046c0b5
push 0x55bd4c
lea ecx, [esp + 0xc]
call fcn.0046c0b5
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x41452e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0046bd25
jmp 0x4145f9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x4145b2
lea edx, [esp + 0x7c]
push 0x55bd48
push edx
call fcn.0045bc64
add esp, 8
test eax, eax
je 0x4145b2
lea eax, [esp + 0x7c]
push 0x55bd44
push eax
call fcn.0045bc64
add esp, 8
test eax, eax
je 0x4145b2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x414542
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0046bd25
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x414df0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x414e52
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x414e60
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x47765b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x5624ac]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x414f98
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x414ec6
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0046bd25
xor eax, eax
jmp 0x41500f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0046be62
push esi
lea ecx, [esp + 0xc]
call fcn.0046c0f1
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x414fed
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.00414df0
test eax, eax
jne 0x414fed
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.00414df0
test eax, eax
jne 0x414fed
lea eax, [esp + 0x14]
push 0x55bd60
push eax
call fcn.0045cca0
mov esi, eax
add esp, 8
test esi, esi
jne 0x414fcc
lea ecx, [esp + 0x14]
push 0x55bd5c
push ecx
call fcn.0045cc20
mov esi, eax
add esp, 8
test esi, esi
jne 0x414fcc
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x414fcf
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0046be12
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x414ede
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0046bd25
xor eax, eax
jmp 0x41500f
mov byte [esi], 0
push 0x55bd58
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0046bd25
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4