joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402ee7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x402ef6
pop dword [ebp - 0x2c]
mov eax, 0x402ef6
sub dword [ebp - 0x2c], eax
push 0x40
push 0x1000
push 0x50ebe
push 0
mov eax, 0x72dd93e8
sub eax, 0x7298e138
add eax, dword [ebp - 0x2c]
call dword [eax]
mov ecx, 0x4afd
xor edx, edx
add edx, eax
mov edi, 0x9722d5bb
sub edi, 0x96da47bb
add edi, dword [ebp - 0x2c]
mov esi, 0x468ecca9
sub esi, 0xa92aa7e6
xor dword [ebp - 0x28], ebx
mov ebx, dword [edi]
sub ebx, esi
mov dword [edx], ebx
xor dword [ebp - 0x20], esi
add edx, 0xf935bed9
sub edx, 0xf935bed5
add edi, 4
loop 0x402f4c
add eax, 0x62fbca37
add eax, 0x9d055490
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x5b504b66
sub ecx, 0x5b104b66
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x40419a
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push dword [ebp + 0xc]
mov edi, dword [ebp + 8]
xor esi, esi
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryW]
test eax, eax
jne 0x40426b
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4041ca
xor esi, esi
jmp 0x40426b
cmp eax, 3
je 0x4041db
push 0
push edi
call main
test eax, eax
jne 0x4041c3
movzx eax, word [edi]
mov ecx, edi
push ebx
xor ebx, ebx
test ax, ax
je 0x404258
push 0x5c
mov edx, eax
pop edi
cmp dx, di
jne 0x4041f4
mov ebx, ecx
add ecx, 2
movzx eax, word [ecx]
mov edx, eax
test ax, ax
jne 0x4041ed
mov edi, dword [ebp + 8]
test ebx, ebx
je 0x404258
push dword [ebp + 0xc]
xor eax, eax
push edi
mov word [ebx], ax
call main
mov esi, eax
push 0x5c
pop eax
mov word [ebx], ax
test esi, esi
js 0x40426a
push dword [ebp + 0xc]
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryW]
test eax, eax
jne 0x404254
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
cmp esi, 0xb7
jne 0x404245
xor esi, esi
inc esi
jmp 0x40426a
test esi, esi
jle 0x40426a
movzx esi, si
or esi, 0x80070000
jmp 0x40426a
xor esi, esi
jmp 0x40426a
mov esi, 0x80070003
push esi
push 0x72
push str.c:_agent_work138_s_srclibsdutildirutil.cpp
call fcn.004038f5
pop ebx
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x401021
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a4
push ebx
push esi
push edi
mov edi, 0x94
xor ebx, ebx
push edi
lea eax, [ebp - 0x9c]
mov esi, 0x208
push ebx
push eax
mov dword [ebp - 4], esi
call fcn.004109d0
add esp, 0xc
lea eax, [ebp - 0x9c]
mov dword [ebp - 0x9c], edi
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
push 0x41f318
push 0x10
call fcn.0040857d
push eax
lea eax, [ebp - 0x2a4]
push eax
call fcn.004108e0
add esp, 0x10
mov dword [ebp - 4], esi
push 1
pop eax
push eax
push 0x1a
push 0x42a2f8
push ebx
mov dword [ebp - 8], eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push esi
push 0x429ee8
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x2a4]
push eax
lea eax, [ebp - 8]
push eax
push 0x41f308
push 0xf
call fcn.0040857d
pop ecx
pop ecx
push eax
push 0x41f2dc
push 0x29
call fcn.0040857d
pop ecx
pop ecx
push eax
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
lea eax, [ebp - 0x2a4]
mov esi, 0x42a0f0
push eax
push esi
call fcn.004108e0
pop ecx
mov edi, 0x41f2c8
pop ecx
push ebx
push edi
push 0x10
call fcn.0040857d
pop ecx
pop ecx
push eax
call fcn.0040672e
cmp byte [eax], 0
pop ecx
pop ecx
mov ebx, 0x41f2c0
je 0x40113f
push 0
push edi
push 0x10
call fcn.0040857d
pop ecx
pop ecx
push eax
call fcn.0040672e
pop ecx
pop ecx
push eax
push esi
push ebx
push 5
call fcn.0040857d
pop ecx
mov esi, 0x429ad8
pop ecx
push eax
push esi
call fcn.0041088a
add esp, 0x10
jmp 0x40114d
push esi
mov esi, 0x429ad8
push esi
call fcn.004108e0
pop ecx
pop ecx
push 0
push 0x41f2b0
push 0xe
call fcn.0040857d
pop ecx
pop ecx
push eax
call fcn.0040672e
pop ecx
pop ecx
push eax
push esi
push ebx
push 5
call fcn.0040857d
pop ecx
mov esi, 0x429ce0
pop ecx
push eax
push esi
call fcn.0041088a
push esi
call fcn.00407f3a
add esp, 0x14
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40118b
Capabilities:
Read file via mapping

Disassembly:
push edi
push 0x41f330
push 0x10
call fcn.0040857d
pop ecx
xor edi, edi
pop ecx
push eax
push 0x1028
push edi
push 4
push edi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.DLL_CreateFileMappingA]
push edi
push edi
push edi
push 0xf001f
push eax
mov dword [0x42a500], eax
call dword [sym.imp.KERNEL32.DLL_MapViewOfFile]
mov dword [0x42a504], eax
mov dword [eax], 0x1028
mov eax, dword [0x42a504]
mov dword [eax + 4], 0x782
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
mov ecx, dword [0x42a504]
mov dword [ecx + 8], eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
mov ecx, dword [0x42a504]
push 0x41f32c
mov dword [ecx + 0xc], eax
mov eax, dword [0x42a504]
mov dword [eax + 0x10], edi
mov eax, dword [0x42a504]
add eax, 0x101c
push eax
call fcn.004108e0
mov eax, dword [0x42a504]
add eax, 0x14
push eax
call fcn.00401227
add esp, 0xc
pop edi
ret
Function at 0x4016e2
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1210
call fcn.00410a30
push ebx
push edi
mov ebx, 0x41f4cc
push 0
push ebx
push 0xd
call fcn.0040857d
pop ecx
pop ecx
push eax
call fcn.0040672e
pop ecx
mov edi, 0x42a2f8
pop ecx
push eax
push edi
push 0x41f4c0
push 9
call fcn.0040857d
pop ecx
pop ecx
push eax
lea eax, [ebp - 0x208]
push eax
call fcn.0041088a
add esp, 0x10
cmp byte [ebp + 8], 0
jne 0x40174b
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40187e
push esi
mov esi, 0x1008
push esi
lea eax, [ebp - 0x1210]
push 0
push eax
call fcn.004109d0
add esp, 0xc
mov dword [ebp - 0x1210], esi
mov dword [ebp - 0x120c], 0x3ed
push 0
push ebx
push 0xd
call fcn.0040857d
pop ecx
pop ecx
push eax
call fcn.0040672e
pop ecx
pop ecx
push eax
push 0x41f374
push 6
call fcn.0040857d
pop ecx
pop ecx
push eax
lea eax, [ebp - 0x1208]
push eax
call fcn.0041088a
lea eax, [ebp - 0x1008]
push edi
push eax
call fcn.004108e0
add esp, 0x14
push 1
pop esi
push esi
push 0x41f4b0
push 0xc
call fcn.0040857d
pop ecx
pop ecx
push eax
call fcn.0040672e
push eax
lea eax, [ebp - 0xe08]
push eax
call fcn.004108e0
add esp, 0x10
push esi
push 0x41f4a4
push 8
call fcn.0040857d
pop ecx
pop ecx
push eax
call fcn.0040672e
push eax
lea eax, [ebp - 0xc08]
push eax
call fcn.004108e0
add esp, 0x10
push esi
push 0x41f358
push 6
call fcn.0040857d
pop ecx
pop ecx
push eax
call fcn.0040672e
push eax
lea eax, [ebp - 0xa08]
push eax
call fcn.004108e0
add esp, 0x10
push esi
push 0x41f350
push 7
call fcn.0040857d
pop ecx
pop ecx
push eax
call fcn.0040672e
push eax
lea eax, [ebp - 0x808]
push eax
call fcn.004108e0
add esp, 0x10
push 0
push 0x41f2b0
push 0xe
call fcn.0040857d
pop ecx
pop ecx
push eax
call fcn.0040672e
push eax
lea eax, [ebp - 0x608]
push eax
call fcn.004108e0
lea eax, [ebp - 0x1210]
push esi
push eax
call fcn.00401882
add esp, 0x18
pop esi
pop edi
pop ebx
leave
ret
Function at 0x401b4b
Capabilities:
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
lea eax, [ebp - 0x208]
push eax
push 0x208
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
push 0x41f5bc
push 9
call fcn.0040857d
push eax
lea eax, [ebp - 0x208]
push eax
call fcn.004108f0
lea eax, [ebp - 0x208]
push 0
push eax
call fcn.004082a4
push 0x41f5b8
push 0
call fcn.0040857d
add esp, 0x20
mov edx, eax
lea ecx, [ebp - 0x208]
call fcn.00407e67
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]

Function at 0x401bb1
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
push esi
push edi
call fcn.00403404
mov ebx, 0x429ad8
push ebx
call fcn.00401d25
mov dword [esp], 0x429ce0
call fcn.00401d25
pop ecx
xor esi, esi
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
and byte [ebp - 0x20c], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push esi
push 0x41f37c
push 0x10
stosb byte es:[edi], al
call fcn.0040857d
pop ecx
pop ecx
push eax
call fcn.0040672e
pop ecx
pop ecx
push eax
push ebx
push 0x41f4c0
push 9
call fcn.0040857d
pop ecx
pop ecx
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0041088a
call fcn.00403404
mov ebx, eax
lea eax, [ebp - 0x20c]
neg ebx
sbb bl, bl
inc bl
mov byte [ebp - 4], bl
push dword [ebp - 4]
push eax
call fcn.004082a4
lea eax, [ebp - 0x20c]
push eax
call fcn.00401da3
add esp, 0x1c
lea eax, [ebp - 0x20c]
push eax
push 0x41f5f8
push 0x10
call fcn.0040857d
pop ecx
pop ecx
push eax
call fcn.004016e1
pop ecx
test bl, bl
pop ecx
je 0x401cee
call fcn.00403404
test eax, eax
je 0x401cb2
push 0x41f5f0
push 7
call fcn.0040857d
pop ecx
pop ecx
push eax
push 1
push 0x41f5e8
push 7
call fcn.0040857d
pop ecx
pop ecx
push eax
call fcn.00407c97
add esp, 0xc
jmp 0x401cee
call fcn.00411117
push dword [eax]
call fcn.00411054
pop ecx
push eax
call fcn.00411117
push dword [eax]
push 0x41f5c8
push 0x1d
call fcn.0040857d
pop ecx
pop ecx
push eax
push esi
push 0x41f5e8
push 7
call fcn.0040857d
pop ecx
pop ecx
push eax
call fcn.00407c97
add esp, 0x14
cmp dword [ebp + 8], esi
je 0x401d20
push esi
call dword [sym.imp.KERNEL32.DLL_Sleep]
call section..text
push 0x41f5b8
push esi
call fcn.0040857d
pop ecx
mov edx, eax
pop ecx
lea ecx, [ebp - 0x20c]
call fcn.00407e67
push esi
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401f82
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4408
call fcn.00410a30
push ebx
xor ebx, ebx
push edi
xor edi, edi
mov byte [ebp - 0x4408], bl
call fcn.00402351
push 1
push ebx
lea eax, [ebp - 0x4408]
push 0x4000
push eax
push 1
push 0x41f358
push 6
call fcn.0040857d
pop ecx
pop ecx
push eax
call fcn.0040672e
pop ecx
pop ecx
push eax
call fcn.00408178
add esp, 0x14
test eax, eax
jge 0x401feb
push 0x41f674
push 0x10
call fcn.0040857d
pop ecx
pop ecx
push eax
call fcn.004016e1
pop ecx
jmp 0x402018
lea eax, [ebp - 0x4408]
push eax
push 0x41f658
push 0x18
call fcn.0040857d
pop ecx
pop ecx
push eax
call fcn.004016e1
lea eax, [ebp - 0x4408]
push eax
call fcn.00402138
add esp, 0xc
push 1
pop edi
lea eax, [ebp - 4]
push eax
push 0xf003f
push ebx
push 0x41f644
push 0x12
call fcn.0040857d
pop ecx
pop ecx
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4020d9
push esi
push 0x400
lea eax, [ebp - 0x408]
push ebx
push eax
mov dword [ebp - 8], 0x3ff
call fcn.004109d0
add esp, 0xc
lea eax, [ebp - 8]
mov esi, 0x41f63c
push eax
lea eax, [ebp - 0x408]
push eax
push ebx
push ebx
push esi
push 6
call fcn.0040857d
pop ecx
pop ecx
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4020cf
lea eax, [ebp - 0x408]
push eax
push 0x41f620
push 0x1b
call fcn.0040857d
pop ecx
pop ecx
push eax
call fcn.004016e1
lea eax, [ebp - 0x408]
push eax
call fcn.00402138
push esi
push 6
call fcn.0040857d
add esp, 0x14
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
call fcn.004020df
or edi, 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov eax, edi
pop edi
pop ebx
leave
ret

Function at 0x403169
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
cmp dword [esp + 0xc], ecx
not eax
jbe 0x40319e
push esi
mov edx, dword [esp + 0xc]
mov esi, eax
and esi, 0xff
movzx edx, byte [ecx + edx]
xor edx, esi
shr eax, 8
mov edx, dword [edx*4 + 0x425080]
xor eax, edx
inc ecx
cmp ecx, dword [esp + 0x10]
jb 0x403178
pop esi
not eax
ret
Function at 0x40321a
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
push ebx
push esi
push edi
push dword [0x425480]
call fcn.00410a60
mov edi, eax
xor ebx, ebx
xor esi, esi
cmp edi, ebx
pop ecx
mov byte [ebp - 1], bl
jle 0x403273
lea eax, [ebp - 0x10]
push eax
push 0x41f7f0
push 4
call fcn.0040857d
pop ecx
pop ecx
push eax
mov eax, dword [str.0602000000240000525341310002000001000100a9959a031b5ae483402a81a758afd66183db74517df889e42099f84cfc8096e783923134ca536e2671208da3e411983dcf92d850deb6be982715ffc845e133a9]
add eax, esi
push eax
call fcn.00411abc
mov eax, esi
mov cl, byte [ebp - 0x10]
cdq
sub eax, edx
add esp, 0xc
sar eax, 1
inc esi
inc esi
mov byte [ebp + eax - 0x78], cl
cmp esi, edi
jl 0x40323c
mov eax, esi
mov edi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
cdq
sub eax, edx
push ebx
mov esi, eax
push 1
push ebx
lea eax, [ebp - 8]
push ebx
push eax
sar esi, 1
call edi
test eax, eax
jne 0x4032bd
push 8
push 1
push ebx
lea eax, [ebp - 8]
push ebx
push eax
call edi
test eax, eax
jne 0x4032bd
push 0x41f7dc
push 0x13
call fcn.0040857d
push eax
call fcn.004031a1
add esp, 0xc
xor al, al
jmp 0x40337d
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
lea eax, [ebp - 0x78]
push esi
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x4032ec
push 0x41f7cc
push 0xe
call fcn.0040857d
push eax
call fcn.004031a1
add esp, 0xc
jmp 0x40336b
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push 0x8003
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x40330d
push 0x41f7bc
push 0xf
jmp 0x4032dc
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x40332a
push 0x41f7ac
push 0xd
jmp 0x40334f
push ebx
push ebx
push dword [ebp - 0x14]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptVerifySignatureA]
test eax, eax
je 0x403348
mov byte [ebp - 1], 1
jmp 0x40335d
push 0x41f794
push 0x14
call fcn.0040857d
push eax
call fcn.004031a1
add esp, 0xc
cmp dword [ebp - 0xc], ebx
je 0x40336b
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
cmp dword [ebp - 8], ebx
je 0x40337a
push ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403382
Capabilities:
Read file via mapping

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
xor ebx, ebx
push 0x41f330
push 0x10
mov byte [ebp], bl
call fcn.0040857d
pop ecx
pop ecx
push eax
push ebx
push 4
call dword [sym.imp.KERNEL32.DLL_OpenFileMappingA]
mov edi, eax
cmp edi, ebx
je 0x4033fd
push ebx
push ebx
push ebx
push 4
push edi
call dword [sym.imp.KERNEL32.DLL_MapViewOfFile]
mov esi, eax
cmp esi, ebx
je 0x4033f6
lea eax, [esi + 0x1c]
push eax
lea eax, [esi + 0x21c]
push eax
push 0x41f2c0
push 5
call fcn.0040857d
pop ecx
pop ecx
push eax
push ebp
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.DLL_UnmapViewOfFile]
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 1
pop eax
jmp 0x4033ff
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x403404
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x200
lea eax, [ebp - 0x200]
push eax
call fcn.00403382
test eax, eax
pop ecx
je 0x403435
lea eax, [ebp - 0x200]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x403435
push 1
pop eax
leave
ret
xor eax, eax
leave
ret
Function at 0x40667b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x42a770], 0
push esi
mov esi, 0x42a770
jne 0x406729
lea eax, [ebp - 4]
mov dword [ebp - 0xc], 1
push eax
push 0x20019
push 0
push 0x4201a4
push 0x29
mov dword [ebp - 8], 0x200
call fcn.0040857d
pop ecx
pop ecx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4066e3
push 0x42019c
push 4
call fcn.0040857d
push eax
push esi
call fcn.004108e0
add esp, 0x10
jmp 0x406729
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push esi
push eax
push 0
push 0x420190
push 9
call fcn.0040857d
pop ecx
pop ecx
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x406720
push 0x42019c
push 4
call fcn.0040857d
push eax
push esi
call fcn.004108e0
add esp, 0x10
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret
Function at 0x406fae
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb90
push ebx
push esi
push edi
push 0x7f
pop esi
xor ebx, ebx
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0x38f]
mov byte [ebp - 0x390], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 8
mov byte [ebp - 0x24], bl
stosb byte es:[edi], al
pop edx
xor eax, eax
mov ecx, edx
lea edi, [ebp - 0x23]
rep stosd dword es:[edi], eax
mov ecx, esi
lea edi, [ebp - 0x98f]
mov byte [ebp - 0x990], bl
mov byte [ebp - 0x48], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x47]
mov byte [ebp - 0x590], bl
rep stosd dword es:[edi], eax
mov ecx, esi
lea edi, [ebp - 0x58f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x6b]
mov byte [ebp - 0x6c], bl
rep stosd dword es:[edi], eax
mov ecx, esi
lea edi, [ebp - 0x78f]
mov byte [ebp - 0x790], bl
mov byte [ebp - 0x90], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x8f]
push 0x3f
rep stosd dword es:[edi], eax
pop ecx
lea edi, [ebp - 0x18f]
mov byte [ebp - 0x190], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x390]
push eax
call fcn.00408eb9
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x390]
push eax
call fcn.00409edc
mov esi, dword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
add esp, 0xc
push str.Hard_Drive:_n
call esi
lea eax, [ebp - 0x390]
push eax
call esi
push 0x420404
call esi
lea eax, [ebp - 0x24]
push eax
call esi
push 0x420400
call esi
lea eax, [ebp - 0x990]
push eax
call fcn.00408ef5
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x990]
push eax
call fcn.00409edc
lea eax, [ebp - 0x590]
push eax
call fcn.00408fa0
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x590]
push eax
call fcn.00409edc
lea eax, [ebp - 0x790]
push eax
call fcn.00409070
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x790]
push eax
call fcn.00409edc
add esp, 0x24
call dword [sym.imp.KERNEL32.DLL_GetSystemDefaultLangID]
movzx eax, ax
push eax
lea eax, [ebp - 0xb90]
push 0x4203fc
push eax
call fcn.0041088a
lea eax, [ebp - 0x190]
push eax
call fcn.004090f3
mov esi, 0x1000
push esi
call fcn.004121b1
mov edi, eax
push esi
push ebx
push edi
call fcn.004109d0
lea eax, [ebp - 0x24]
push eax
push edi
call fcn.004108f0
lea eax, [ebp - 0x48]
push eax
push edi
call fcn.004108f0
lea eax, [ebp - 0x6c]
push eax
push edi
call fcn.004108f0
lea eax, [ebp - 0x90]
push eax
push edi
call fcn.004108f0
add esp, 0x40
push dword [ebp + 8]
push edi
call fcn.00409edc
pop ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x407dd1
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x200
push ebx
push esi
xor esi, esi
lea eax, [ebp - 0x200]
push esi
push esi
push 0x200
push eax
push dword [ebp + 8]
push esi
call sub.urlmon.dll_URLDownloadToCacheFileA
cmp eax, esi
jl 0x407e61
push 0x41fb74
push 2
call fcn.0040857d
push eax
lea eax, [ebp - 0x200]
push eax
call fcn.00411f82
add esp, 0x10
cmp eax, esi
mov dword [ebp + 8], eax
je 0x407e56
mov ebx, dword [ebp + 0xc]
push edi
push eax
push dword [ebp + 0x10]
push 1
push ebx
call fcn.00411e3a
mov edi, eax
add esp, 0x10
test edi, edi
jle 0x407e48
mov eax, dword [ebp + 0x10]
push dword [ebp + 8]
add esi, edi
sub eax, esi
push eax
lea eax, [esi + ebx]
push 1
push eax
jmp 0x407e27
push dword [ebp + 8]
call fcn.00411dbd
pop ecx
test edi, edi
pop edi
jge 0x407e5b
or eax, 0xffffffff
jmp 0x407e61
and byte [esi + ebx], 0
mov eax, esi
pop esi
pop ebx
leave
ret 0xc

Function at 0x407e67
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
push ebx
push esi
push edi
xor esi, esi
xor eax, eax
lea edi, [ebp - 0xc]
mov dword [ebp - 0x10], esi
mov ebx, edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edx, ecx
push 0x10
stosd dword es:[edi], eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x50]
push edx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x254]
mov dword [ebp - 0x54], 0x44
push eax
call fcn.004108e0
pop ecx
cmp ebx, esi
pop ecx
je 0x407ed1
push 0x420634
push 1
call fcn.0040857d
push eax
lea eax, [ebp - 0x254]
push eax
call fcn.004108f0
lea eax, [ebp - 0x254]
push ebx
push eax
call fcn.004108f0
add esp, 0x18
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x254]
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
test eax, eax
jne 0x407f24
lea eax, [ebp - 0x254]
push eax
push 0x42061c
push 0x17
call fcn.0040857d
pop ecx
pop ecx
push eax
push esi
push 0x41f5e8
push 7
call fcn.0040857d
pop ecx
pop ecx
push eax
call fcn.00407c97
add esp, 0x10
or eax, 0xffffffff
jmp 0x407f35
cmp dword [ebp - 0xc], esi
je 0x407f32
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x407f3a
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44c
push esi
lea eax, [ebp - 0x244]
push dword [ebp + 8]
push eax
call fcn.004108e0
push 0x42063c
push 1
call fcn.0040857d
push eax
lea eax, [ebp - 0x244]
push eax
call fcn.004108f0
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x348]
push eax
call fcn.004108e0
push 0x41f9f8
push 1
call fcn.0040857d
push eax
lea eax, [ebp - 0x348]
push eax
call fcn.004108f0
add esp, 0x30
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x348]
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40804f
lea eax, [ebp - 0x114]
push eax
push 0x41fe98
push 1
call fcn.0040857d
pop ecx
pop ecx
push eax
call fcn.00410fd0
pop ecx
test eax, eax
pop ecx
je 0x408032
lea eax, [ebp - 0x114]
push eax
push 0x420638
push 2
call fcn.0040857d
pop ecx
pop ecx
push eax
call fcn.00410fd0
pop ecx
test eax, eax
pop ecx
je 0x408032
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x44c]
push eax
call fcn.004108e0
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x44c]
push eax
call fcn.004108f0
add esp, 0x10
lea eax, [ebp - 0x44c]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
lea eax, [ebp - 0x140]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
jne 0x407fba
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
pop esi
leave
ret

Function at 0x4080a6
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
lea eax, [edi + 4]
mov dword [ebp - 0xc], ebx
push eax
mov dword [ebp + 0x10], eax
call fcn.004121b1
push edi
mov esi, eax
push dword [ebp + 0xc]
push esi
call fcn.00410c40
add esp, 0x10
push 1
push 0x41f344
push 0xb
call fcn.0040857d
pop ecx
pop ecx
push eax
call fcn.0040672e
pop ecx
pop ecx
push eax
push 0x41f530
push 0xb
call fcn.0040857d
pop ecx
pop ecx
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0041088a
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0xf003f
push ebx
push ebx
lea eax, [ebp - 0x20c]
push ebx
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x408173
push edi
push esi
push ebx
call fcn.00403169
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push 4
push eax
lea eax, [esi + edi]
push eax
call fcn.00410c40
push dword [ebp + 0x10]
push esi
call fcn.0040660b
add esp, 0x20
push dword [ebp + 0x10]
push esi
push 3
push ebx
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push esi
call fcn.004120c8
pop ecx
pop edi
pop esi
pop ebx
leave
ret