joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44c661
Capabilities:
Copy file
Move file

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x438
push ebx
mov bl, byte [esp + 0x448]
lea eax, [esp + 0x230]
call fcn.0040ff50
mov ecx, dword [esp + 0x444]
lea eax, [esp + 0x24]
call fcn.0040ff50
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x234]
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrcmpiW]
test eax, eax
jne 0x44c6e0
test bl, bl
je 0x44c709
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x234]
push eax
call fcn.0041455e
add esp, 8
test eax, eax
je 0x44c6d6
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x234]
push edx
call dword [sym.imp.KERNEL32.DLL_MoveFileW]
mov al, 1
pop ebx
add esp, 0x438
ret
lea eax, [esp + 0x230]
push eax
call fcn.00438396
add esp, 4
test al, al
je 0x44c709
lea ecx, [esp + 0x24]
push ecx
call fcn.00438396
add esp, 4
test al, al
je 0x44c713
test bl, bl
jne 0x44c735
xor al, al
pop ebx
add esp, 0x438
ret
lea edx, [esp + 0x24]
push edx
call fcn.00438037
add esp, 4
test al, al
je 0x44c709
lea eax, [esp + 0x24]
push eax
call fcn.00438396
add esp, 4
test al, al
je 0x44c709
lea ecx, [esp + 0x230]
push str..
push ecx
call fcn.00412518
lea edx, [esp + 0x238]
push edx
call fcn.004143ca
lea edx, [esp + 0x30]
xor ecx, ecx
push edx
mov word [esp + eax*2 + 0x242], cx
call fcn.004143ca
xor ecx, ecx
mov word [esp + eax*2 + 0x36], cx
lea edx, [esp + 0x240]
lea eax, [esp + 0x34]
mov dword [esp + 0x1c], edx
add esp, 0x10
mov dword [esp + 0x10], eax
xor eax, eax
lea edx, [esp + 4]
mov ecx, 0x614
push edx
mov dword [esp + 0x1e], eax
mov dword [esp + 0x22], eax
mov dword [esp + 0x1a], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], 2
mov word [esp + 0x18], cx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
sete al
pop ebx
add esp, 0x438
ret
Function at 0x44c7c1
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xca8
mov ecx, dword [ebp + 8]
push ebx
push esi
lea eax, [esp + 0x10]
mov byte [esp + 0xf], 0
call fcn.0040ff50
lea eax, [esp + 0x10]
push eax
call fcn.00438396
add esp, 4
test al, al
je 0x44c803
lea ecx, [esp + 0x10]
push str..
push ecx
call fcn.00412518
add esp, 8
lea edx, [esp + 0xaa0]
push edx
lea eax, [esp + 0x894]
push eax
lea ecx, [esp + 0x478]
push ecx
lea edx, [esp + 0x68c]
push edx
lea eax, [esp + 0x20]
push eax
call fcn.00415060
add esp, 0x14
lea ecx, [esp + 0x220]
push ecx
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov esi, eax
mov bl, 1
cmp esi, 0xffffffff
je 0x44c8d7
nop
cmp bl, 1
jne 0x44c8d7
test byte [esp + 0x220], 0x10
jne 0x44c8b1
lea eax, [esp + 0x680]
push eax
lea ecx, [esp + 0x14]
push ecx
mov byte [esp + 0x17], bl
call fcn.00412546
lea edx, [esp + 0x478]
push edx
lea eax, [esp + 0x1c]
push eax
call fcn.00412518
lea ecx, [esp + 0x25c]
push ecx
lea edx, [esp + 0x24]
push edx
call fcn.00412518
add esp, 0x18
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
cmp eax, 1
jne 0x44c8c8
lea ecx, [esp + 0x220]
push ecx
push esi
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x44c851
xor bl, bl
jmp 0x44c851
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
xor al, al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov al, byte [esp + 0xf]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x451bb0
Capabilities:
Connect network resource
Query or enumerate registry value

Disassembly:
sub esp, 0x264
push ebp
mov ebp, dword [esp + 0x278]
push esi
mov esi, dword [esp + 0x274]
push edi
lea ecx, [esp + 0x28]
mov dword [esp + 0x14], 0
mov dword [esp + 0xc], 0
call fcn.00407c40
lea ecx, [esp + 0x18]
call fcn.00407c40
lea ecx, [esp + 0x38]
call fcn.00407c40
push str.SOFTWAREClasses_
lea eax, [esp + 0x2c]
call fcn.00401b10
mov edi, dword [esp + 0x274]
lea eax, [esp + 0x28]
call fcn.0040df00
mov edi, str.CLSID
lea eax, [esp + 0x28]
call fcn.0040df00
push 0x47f878
lea eax, [esp + 0x1c]
call fcn.00401b10
test esi, esi
je 0x451c56
cmp word [esi], 0x5c
je 0x451c56
cmp word [esi + 2], 0x5c
je 0x451c56
push 0x4855c4
lea eax, [esp + 0x1c]
call fcn.00401b10
mov edi, esi
lea eax, [esp + 0x18]
call fcn.0040df00
test ebp, ebp
je 0x451cb4
push 0x20
lea eax, [esp + 0x4c]
push 0
push eax
call fcn.00414350
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
lea esi, [esp + 0x3c]
mov dword [esp + 0x50], 0
call fcn.0040ee20
mov edi, str.IPC_
mov eax, esi
call fcn.0040df00
mov eax, dword [esp + 0x284]
mov edx, dword [esp + 0x38]
push 0
push ebp
push eax
lea ecx, [esp + 0x54]
push ecx
mov dword [esp + 0x6c], edx
call sub.MPR.dll_WNetAddConnection2W
mov esi, eax
test esi, esi
jne 0x451d67
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x14]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
push eax
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
mov esi, eax
test esi, esi
jne 0x451d67
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0xc]
push ecx
push 0x20019
push eax
mov eax, dword [esp + 0x20]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
test esi, esi
jne 0x451d60
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x6c]
push edx
push 0
push 0
push 0
push eax
mov dword [esp + 0x28], 0x1fe
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x451d59
mov eax, dword [esp + 0x10]
shr eax, 1
xor ecx, ecx
lea edi, [esp + 0x68]
mov dword [esp + 0x10], eax
mov word [esp + eax*2 + 0x68], cx
call fcn.0040ff90
mov edx, dword [esp + 0x27c]
mov edi, eax
push edx
push edi
call dword [sym.imp.ole32.dll_CLSIDFromString]
push edi
mov esi, eax
call fcn.00412949
add esp, 4
mov eax, dword [esp + 0xc]
push eax
call ebp
mov ecx, dword [esp + 0x14]
push ecx
call ebp
lea ecx, [esp + 0x38]
call fcn.0040c430
lea ecx, [esp + 0x18]
call fcn.0040c430
lea ecx, [esp + 0x28]
call fcn.0040c430
pop edi
mov eax, esi
pop esi
pop ebp
add esp, 0x264
ret
Function at 0x451d8e
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x24c
push ebx
push ebp
mov ebp, dword [esp + 0x258]
push esi
push edi
lea ecx, [esp + 0x30]
call fcn.00407c40
fld1
lea eax, [esp + 0x24]
fstp qword [esp + 0x28]
push eax
push ebp
call dword [sym.imp.ole32.dll_StringFromIID]
mov esi, eax
test esi, esi
jl 0x451f8f
mov edi, dword [esp + 0x24]
call fcn.0040ff90
mov esi, eax
push str.interface_
lea eax, [esp + 0x34]
call fcn.00401b10
mov edi, esi
lea eax, [esp + 0x30]
call fcn.0040df00
mov edi, str.TypeLib
lea eax, [esp + 0x30]
call fcn.0040df00
push esi
call fcn.00412949
mov ecx, dword [esp + 0x28]
add esp, 4
push ecx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, dword [esp + 0x30]
lea edx, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x451f8f
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x54]
push edx
push eax
push eax
push eax
mov eax, dword [esp + 0x30]
push eax
mov dword [esp + 0x2c], 0x1fe
call ebx
mov esi, eax
test esi, esi
jne 0x451f84
mov eax, dword [esp + 0x14]
shr eax, 1
xor ecx, ecx
lea edi, [esp + 0x50]
mov dword [esp + 0x14], eax
mov word [esp + eax*2 + 0x50], cx
call fcn.0040ff90
lea edx, [esp + 0x40]
mov edi, eax
push edx
push edi
call dword [sym.imp.ole32.dll_CLSIDFromString]
push edi
mov esi, eax
call fcn.00412949
add esp, 4
test esi, esi
jl 0x451f84
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x54]
push ecx
push 0
push 0
push str.Version
push edx
mov dword [esp + 0x2c], 0x1fe
call ebx
test eax, eax
jne 0x451edf
mov eax, dword [esp + 0x14]
shr eax, 1
lea edx, [esp + 0x50]
xor ecx, ecx
push edx
mov dword [esp + 0x18], eax
mov word [esp + eax*2 + 0x54], cx
call fcn.00415247
fstp qword [esp + 0x2c]
add esp, 4
fld1
lea eax, [esp + 0x20]
push eax
push 0
sub esp, 0x10
fstp qword [esp + 8]
fld qword [esp + 0x40]
fstp qword [esp]
call fcn.004171f0
fnstcw word [esp + 0x2a]
add esp, 0x10
movzx eax, word [esp + 0x1a]
or eax, 0xc00
mov dword [esp + 0x20], eax
fldcw word [esp + 0x20]
fistp dword [esp + 0x20]
mov cx, word [esp + 0x20]
movzx edx, cx
push edx
fldcw word [esp + 0x1e]
lea edx, [esp + 0x4c]
fld qword [esp + 0x34]
fnstcw word [esp + 0x1e]
movzx eax, word [esp + 0x1e]
or eax, 0xc00
mov dword [esp + 0x24], eax
fldcw word [esp + 0x24]
fistp dword [esp + 0x24]
mov ax, word [esp + 0x24]
movzx ecx, ax
push ecx
fldcw word [esp + 0x22]
push edx
call dword [sym.imp.OLEAUT32.dll_RegisterTypeLib]
mov esi, eax
test esi, esi
jl 0x451f84
mov edx, dword [esp + 0x264]
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
push edx
push ebp
push eax
mov eax, dword [ecx + 0x18]
call eax
mov esi, eax
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x30]
call fcn.0040c430
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x24c
ret
Function at 0x451fa5
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x284
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x20]
mov esi, 0x80004002
xor ebx, ebx
mov dword [esp + 0x14], 0x28
call fcn.00407c40
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x1c]
push eax
push 0x20019
push ebx
push str.interface
push bind
call ebp
test eax, eax
jne 0x4520ea
lea ecx, [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x20]
push 0
push 0
push 0
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x4c]
push eax
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x4520df
mov eax, dword [esp + 0x14]
xor edx, edx
mov word [esp + eax*2 + 0x38], dx
push str.interface_
lea eax, [esp + 0x24]
mov dword [esp + 0x18], 0x1fe
call fcn.00401b10
lea edi, [esp + 0x38]
lea eax, [esp + 0x20]
call fcn.0040df00
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x18]
push ecx
push 0x20019
push 0
push edx
push bind
call ebp
test eax, eax
jne 0x4520cd
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x8c]
push ecx
push 0
push 0
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4520c2
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x29c]
shr eax, 1
xor ecx, ecx
mov dword [esp + 0x14], eax
mov word [esp + eax*2 + 0x88], cx
push edx
lea eax, [esp + 0x8c]
push eax
call fcn.00412485
add esp, 8
test eax, eax
jne 0x4520c2
mov ecx, dword [esp + 0x298]
push ecx
push edi
call dword [sym.imp.ole32.dll_IIDFromString]
mov esi, eax
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x4520df
inc ebx
mov dword [esp + 0x14], 0x28
jmp 0x451fec
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x20]
call fcn.0040c430
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x284
ret
Function at 0x454826
Capabilities:
Copy file
Delete file
Enumerate files on windows
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x12d4
call fcn.00426210
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
lea eax, [esp + 0x430]
xor bl, bl
call fcn.0040ff50
mov ecx, dword [ebp + 0xc]
lea eax, [esp + 0x640]
call fcn.0040ff50
lea eax, [esp + 0x640]
push eax
lea ecx, [esp + 0x434]
push ecx
call fcn.0044c8e8
lea edx, [esp + 0x438]
push edx
mov byte [esp + 0x1b], al
call fcn.00438396
add esp, 0xc
test al, al
je 0x45489b
lea eax, [esp + 0x430]
push str..
push eax
call fcn.00412518
add esp, 8
lea ecx, [esp + 0x640]
push ecx
call fcn.00438396
add esp, 4
test al, al
je 0x4548c4
lea edx, [esp + 0x640]
push str..
push edx
call fcn.00412518
add esp, 8
lea eax, [esp + 0xec0]
push eax
lea ecx, [esp + 0x10d4]
push ecx
lea edx, [esp + 0xcb8]
push edx
lea eax, [esp + 0xaac]
push eax
lea ecx, [esp + 0x440]
push ecx
call fcn.00415060
add esp, 0x14
lea edx, [esp + 0x850]
push edx
lea eax, [esp + 0x434]
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov esi, eax
mov byte [esp + 0xe], 1
cmp esi, 0xffffffff
je 0x454a80
mov edi, dword [sym.imp.KERNEL32.DLL_CopyFileW]
cmp byte [esp + 0xe], 1
jne 0x454a80
test byte [esp + 0x850], 0x10
jne 0x454a60
lea ecx, [esp + 0x220]
push ecx
lea edx, [esp + 0x644]
push edx
lea eax, [esp + 0xec8]
push eax
lea ecx, [esp + 0x10dc]
push ecx
lea edx, [esp + 0x88c]
push edx
call fcn.004381f2
add esp, 0x14
lea eax, [esp + 0xaa0]
push eax
lea ecx, [esp + 0x14]
push ecx
call fcn.00412546
lea edx, [esp + 0xcb8]
push edx
lea eax, [esp + 0x1c]
push eax
call fcn.00412518
lea ecx, [esp + 0x88c]
push ecx
lea edx, [esp + 0x24]
push edx
call fcn.00412518
lea eax, [esp + 0x238]
push eax
call fcn.004383f4
add esp, 0x1c
test al, al
je 0x4549de
cmp byte [ebp + 0x10], 0
je 0x454a37
lea ecx, [esp + 0x220]
push ecx
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcmpiW]
test eax, eax
je 0x454a47
lea eax, [esp + 0x220]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
cmp byte [ebp + 0x14], 1
jne 0x454a22
cmp byte [esp + 0xf], 0
jne 0x454a00
lea ecx, [esp + 0x220]
push ecx
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.DLL_MoveFileW]
jmp 0x454a33
push 0
lea eax, [esp + 0x224]
push eax
lea ecx, [esp + 0x18]
push ecx
call edi
test eax, eax
je 0x454a37
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
jmp 0x454a33
push 0
lea eax, [esp + 0x224]
push eax
lea ecx, [esp + 0x18]
push ecx
call edi
test eax, eax
jne 0x454a5e
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [esp + 0x220]
push edx
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileW]
test eax, eax
je 0x454a37
mov bl, 1
lea ecx, [esp + 0x850]
push ecx
push esi
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x454920
mov byte [esp + 0xe], al
jmp 0x454920
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45d156
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x2020
call fcn.00426210
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x10]
call fcn.00407c40
lea ecx, [esp + 0x20]
call fcn.00407c40
mov eax, dword [esp + 0x2034]
push eax
xor ebp, ebp
call fcn.0044bbd8
mov esi, eax
movzx eax, word [esi]
xor bl, bl
test ax, ax
je 0x45d284
nop
inc ebp
cmp ax, 0x25
jne 0x45d258
cmp word [esi + ebp*2], ax
jne 0x45d1bb
push 0x25
lea ecx, [esp + 0x14]
push ecx
mov bl, 1
call fcn.0044c25b
inc ebp
jmp 0x45d263
push 0x47f878
lea eax, [esp + 0x24]
call fcn.00401b10
movzx eax, word [esi + ebp*2]
cmp ax, 0x25
je 0x45d1f5
lea ecx, [ecx]
test ax, ax
je 0x45d1f5
movzx eax, ax
push eax
lea edx, [esp + 0x24]
push edx
call fcn.0044c25b
movzx eax, word [esi + ebp*2 + 2]
inc ebp
cmp ax, 0x25
jne 0x45d1d6
cmp word [esi + ebp*2], 0
je 0x45d2a3
mov edx, dword [esp + 0x20]
push 0xfff
lea ecx, [esp + 0x34]
push ecx
xor eax, eax
push edx
inc ebp
mov word [esp + 0x3c], ax
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
test eax, eax
lea eax, [esp + 0x10]
je 0x45d232
lea edi, [esp + 0x30]
call fcn.0040df00
mov bl, 1
jmp 0x45d263
mov edi, 0x4863c4
mov bl, 1
call fcn.0040df00
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x14]
push ecx
call fcn.00454426
lea eax, [esp + 0x10]
call fcn.0040df00
jmp 0x45d263
push eax
lea edx, [esp + 0x14]
push edx
call fcn.0044c25b
movzx eax, word [esi + ebp*2]
test ax, ax
jne 0x45d196
test bl, bl
je 0x45d284
mov esi, dword [esp + 0x2034]
lea edi, [esp + 0x10]
call fcn.0040f790
lea ecx, [esp + 0x20]
call fcn.0040c430
lea ecx, [esp + 0x10]
call fcn.0040c430
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2020
ret 4
mov edi, 0x4863c4
lea eax, [esp + 0x10]
call fcn.0040df00
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x14]
push ecx
call fcn.00454426
jmp 0x45d274
Function at 0x409580
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x14
lea eax, [esp]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea ecx, [esp + 8]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [esp]
push 0
push 0
lea edx, [esp + 0xc]
push 0
push edx
push 0
push eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov eax, dword [esp + 0x18]
push 0
test eax, eax
je 0x4095e9
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
add esp, 0x14
ret 4
push 0xc
call dword [sym.imp.USER32.dll_ExitWindowsEx]
add esp, 0x14
ret 4

Function at 0x432002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x432072
nop
mov ebx, 0x40c7d0
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x43ac7db3
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x432060
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4320d2
nop
nop
nop
mov ebx, 0x42f314
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0xd8b1b15
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4320c0
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x564664
Capabilities:
Check if file exists
Set global application hook

Disassembly:
sub esp, 0x11c
mov eax, dword [0x5cce64]
xor eax, esp
mov dword [esp + 0x118], eax
push esi
mov esi, ecx
mov eax, dword [esi + 0xd0]
test eax, eax
je 0x564682
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [esi + 0xd0], 0
push 0x104
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.00547890
add esp, 0xc
lea eax, [esp + 0x18]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea eax, [esp + 0xc]
mov word [esp + 0xf], 0x642e
push eax
lea eax, [esp + 0x1c]
mov word [esp + 0x10], 0x6464
push eax
mov word [esp + 0x19], 0x6c6c
mov byte [esp + 0x1b], 0
mov byte [esp + 0x16], 0x72
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x56473b
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [esi + 0xd0], eax
test eax, eax
je 0x56473b
lea ecx, [esp + 4]
mov dword [esp + 4], 0x6e6f4d
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0xd4], eax
test eax, eax
je 0x56473b
push 0
push dword [esi + 0xd0]
push eax
push 3
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [esi + 0xd8], eax
mov ecx, dword [esp + 0x11c]
pop esi
xor ecx, esp
call fcn.00544a44
add esp, 0x11c
ret

Function at 0x8003b3f
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov dword [0x80043b4], 0x30
mov dword [0x80043bc], 0x8003351
mov dword [0x80043b8], 2
mov dword [0x80043c0], 0
mov dword [0x80043c4], 0
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
jmp 0x8003b82
mov dword [0x80043c8], eax
mov dword [0x80043dc], 0x80041e0
mov dword [0x80043d4], 0xf
mov dword [0x8004102], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x80043cc], eax
mov dword [0x80043e0], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x800410a], ebp
mov dword [0x80043d0], eax
push 0x80043b4
call dword [sym.imp.user32.dll_RegisterClassExA]
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x8004434], eax
push 0
push dword [0x8004102]
push 0
push 0
push 0x1ef
push 0x21c
push 0xffffe688
push 0xfffff524
push 0xcf0000
push str.uno_momento
push str.verba
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x800442c], eax
push 1
push dword [0x800442c]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x800442c]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x8003c40
xor edi, edi
lea ebx, [0x80043e4]
jmp 0x8003c58
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x8003c4a
jmp 0x8003c6c
mov eax, dword [0x80043ec]
call fcn.08002ae4
ret
Function at 0x491304
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x491332
push dword [esi]
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
test eax, eax
je 0x491350
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0049126a
jmp 0x491350
mov eax, dword [esi + 0x14]
test eax, eax
je 0x491350
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0049126a
test edi, edi
mov eax, edi
jne 0x49133a
pop edi
push ebx
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x401260
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx], al
sub edx, eax
mov dh, 8
mov byte [edx + eax], cl
inc eax
cmp cl, bl
sub dh, dh
mov fs, word [edx - 0x74fffffe]
push ebp
cld
fmul dword [eax + eax*2 + 0x41]
add byte [ebx + 0x68], dl
pushfd
sar dword [ecx], 1
push edx
push 0x430ed190
push eax
call fcn.004032ae
adc dword [ebp + 0x14], 0xffffffa3
inc esp
inc eax
inc ecx
add cl, ch
jnp 0x40129b
movsd dword es:[edi], dword [esi]
xor byte [esi], ch
jge 0x40129a
jge 0x40129a
mov ebp, eax
je 0x401263
inc eax
add byte [ebp + 0x39], bh
add dword [esi + 0x11], edi
xor edx, edx
push 8
loope 0x4012c6
push edx
call esi
mov edi, dword [ebp + 0x46]
add esp, 8
jmp 0x40132c
nop
add al, 0x42
ja 0x4012b8
or byte [esi + 0x470674c3], bh
mov dword [ebp - 4], edi
jmp 0x40129e
add byte [ebx + 0x108b27c4], al
cld
cmp eax, 0x748bff00
xor eax, eax
repne scasb al, byte es:[edi]
ret
movsb byte es:[edi], byte [esi]
add byte [ebx + 0xd92fc7d], cl
je 0x4012f6
xchg edx, eax
or eax, sym.imp.MSVCRT.dll___mb_cur_max
cmp dword [ecx], 0xffffffdc
jle 0x40134d
inc eax
add byte [ebx + 0x117edc39], al
push ds
add al, 0x2d
les ecx, [edx - 0x295badd9]
salc
sti
jge 0x401344
add esp, 0x29
jmp 0x40135f
mov ecx, ebp
ja 0x40135e
inc eax
xor al, 0x33
ror byte [edx - 0x27ee0ab3], 4
inc edx
and eax, 8
or byte [ebx], bh
ret
cmp eax, ebx
je 0x401369
inc edi
dec ecx
jge 0x401363
jmp 0x401331
cmpsb byte [esi], byte es:[edi]
leave
call ebp
sal dl, 0xae
neg dword [ecx + ecx*2 - 0x5fc817af]
add byte [eax], al
xor dword [eax], eax
add al, 0
add byte [esi + 0xd], dh
push str.Proxy_credentials_too_long_n
and eax, esi
add eax, dword [eax]
add byte [ebx + 0x5503049a], bl
cld
or ecx, 2
mov ecx, dword [edx + 0x33]
sal dl, 0xae
not ecx
dec ecx
mov al, byte [ebp - 0x5e000446]
push ecx
push edx
push eax
enter 0xffffffffffffa036, 0xffffffffffffffef
add byte [edi - 0x30b7273], cl
invalid

Function at 0x4026f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
clc
ror dword [ebp + 2], 1
xchg dword [ebx - 0x72a2a40a], esp
cmp esi, dword [esi - 0xe]
in eax, dx