joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4334e0
Capabilities:
Reference http user-agent string

Disassembly:
push ebx
push esi
push 2
call fcn.004eced0
call fcn.004ecf60
push 1
mov esi, eax
push 0x29
push esi
call fcn.004ecfa0
push str.User_Agent:Mozilla_5.0__Windows_NT_6.1__WOW64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_42.0.2311.90_Safari_537.36
push 0
call fcn.004ecde0
push str.Accept:_
push eax
call fcn.004ecde0
mov ebx, eax
push ebx
push 0x2727
push esi
call fcn.004ecfa0
add esp, 0x2c
mov ecx, edi
call fcn.00402b70
push eax
push 0x2712
push esi
call fcn.004ecfa0
push 0x433450
push 0x4e2b
push esi
call fcn.004ecfa0
push edi
push 0x2711
push esi
call fcn.004ecfa0
push 0
push 0x2b
push esi
call fcn.004ecfa0
push edi
push 0x2749
push esi
call fcn.004ecfa0
push 0x433490
push 0x4e58
push esi
call fcn.004ecfa0
mov eax, dword [edi + 0x20]
add esp, 0x48
test eax, eax
je 0x433599
push eax
push 0x13
push esi
call fcn.004ecfa0
mov eax, dword [edi + 0x24]
push eax
push 0x14
push esi
call fcn.004ecfa0
add esp, 0x18
push esi
call fcn.004ed1a0
add esp, 4
test eax, eax
je 0x4335cf
push eax
call fcn.004ed200
add esp, 4
push eax
lea ecx, [edi + 0x30]
call fcn.00402b50
cmp dword [edi + 0x28], 0
je 0x4335c9
mov ecx, dword [edi + 0x28]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push edi
call eax
pop esi
or eax, 0xffffffff
pop ebx
ret
lea ecx, [edi + 0x2c]
push ecx
push 0x200002
push esi
call fcn.004ed1e0
add esp, 0xc
test eax, eax
jne 0x4335a6
push esi
call fcn.004ed1c0
push ebx
call fcn.004ece20
add esp, 8
cmp dword [edi + 0x28], 0
je 0x433604
mov ecx, dword [edi + 0x28]
mov edx, dword [ecx]
mov eax, dword [edx]
push edi
call eax
pop esi
xor eax, eax
pop ebx
ret
Function at 0x433a80
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x52b47d
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
mov eax, dword [0x580ca0]
xor eax, esp
mov dword [esp + 0xa0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x580ca0]
xor eax, esp
push eax
lea eax, [esp + 0xbc]
mov dword fs:[0], eax
mov ebp, dword [esp + 0xcc]
xor ebx, ebx
mov dword [esp + 0xc4], ebx
lea eax, [esp + 0x30]
mov dword [esp + 0x24], ebx
push eax
mov dword [esp + 0x2c], ebp
mov esi, ecx
mov dword [esp + 0x30], vtable.CHttpPageClient.0
call fcn.0040a330
lea ecx, [esp + 0x58]
call fcn.00402b90
lea ecx, [esp + 0x74]
call fcn.00402b90
lea ecx, [esp + 0x90]
call fcn.00402b90
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0xac], ebx
mov dword [esp + 0xb0], ebx
mov dword [esp + 0x54], 0x3c
mov dword [esp + 0x50], 0x1e
mov edi, 1
mov ecx, esi
mov dword [esp + 0xc4], edi
call fcn.00402b70
push eax
lea esi, [esp + 0x30]
call fcn.00434780
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [esp + 0xb0]
mov ecx, ebp
add esi, 0xc
call fcn.00402b90
mov dword [esp + 0x24], edi
mov edi, dword [esi + 0xc]
lea ecx, [esp + 0x14]
call fcn.0046bb70
cmp dword [esi + 0xc], edi
ja 0x433b7b
cmp edi, dword [esi + 0x10]
jbe 0x433b80
call fcn.004bd101
push esi
lea ecx, [esp + 0x18]
call fcn.004027c0
mov dword [esp + 0x18], edi
mov edi, edi
mov edi, dword [esi + 0x10]
lea ecx, [esp + 0x1c]
call fcn.0046bb70
cmp dword [esi + 0xc], edi
ja 0x433ba6
cmp edi, dword [esi + 0x10]
jbe 0x433bab
call fcn.004bd101
push esi
lea ecx, [esp + 0x20]
call fcn.004027c0
lea ecx, [esp + 0x14]
mov dword [esp + 0x20], edi
call fcn.004060e0
test al, al
je 0x433bd8
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x18]
call fcn.00407860
test al, al
jne 0x433bdd
call fcn.004bd101
mov edx, dword [esp + 0x18]
cmp edx, dword [esp + 0x20]
je 0x433c53
lea ecx, [esp + 0x14]
call fcn.004060e0
test al, al
jne 0x433bf9
call fcn.004bd101
lea ecx, [esp + 0x14]
call fcn.00406000
mov ecx, dword [esp + 0x18]
cmp ecx, dword [eax + 0x10]
jb 0x433c10
call fcn.004bd101
mov edx, dword [esp + 0x18]
movzx eax, byte [edx]
push eax
push 1
mov ecx, ebp
call fcn.00401a10
lea ecx, [esp + 0x14]
call fcn.004060e0
test al, al
jne 0x433c33
call fcn.004bd101
lea ecx, [esp + 0x14]
call fcn.00406000
mov ecx, dword [esp + 0x18]
cmp ecx, dword [eax + 0x10]
jb 0x433c4a
call fcn.004bd101
inc dword [esp + 0x18]
jmp 0x433b90
lea ecx, [esp + 0x2c]
mov byte [esp + 0xc4], bl
call fcn.004346c0
mov eax, ebp
mov ecx, dword [esp + 0xbc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xa0]
xor ecx, esp
call fcn.004ba1db
add esp, 0xb4
ret 4
Function at 0x434780
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x52987b
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x580ca0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
push 0x5c
call fcn.004bf084
add esp, 4
mov dword [esp + 8], eax
mov dword [esp + 0x14], 0
test eax, eax
je 0x4347c5
push eax
call fcn.00434420
jmp 0x4347c7
xor eax, eax
mov ecx, dword [esp + 0x1c]
push ecx
mov dword [esp + 0x18], 0xffffffff
lea ecx, [eax + 8]
mov dword [esi + 0x80], eax
call fcn.00402b50
mov edx, dword [esi + 0x80]
mov dword [edx + 4], 1
mov ecx, dword [esi + 0x80]
push str.GET_test1
add ecx, 0x3c
call fcn.00402b50
lea eax, [esi + 0x1c]
push eax
push 0
push esi
push 0x434850
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x20], eax
test eax, eax
je 0x43483e
cmp eax, 0xffffffff
je 0x43483e
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esi + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x20], 0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
add esp, 0x14
ret 4
Function at 0x435250
Capabilities:
Encode data using base64

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov edi, dword [esp + 0x14]
mov esi, eax
test edi, edi
je 0x4353af
lea ecx, [edi*8]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*2]
add ecx, ecx
mov edx, ecx
lea ecx, [edi*8]
sub ecx, edx
sub ecx, 2
je 0x43529a
sub ecx, 2
jne 0x43529d
add eax, 2
jmp 0x43529d
add eax, 3
inc eax
cmp dword [ebx], eax
jge 0x4352ae
pop edi
mov dword [ebx], eax
pop esi
mov eax, 0xfffffff0
pop ebx
pop ecx
ret
mov ecx, dword [esp + 0x18]
mov eax, 0x55555556
imul edi
mov eax, edx
shr eax, 0x1f
add eax, edx
lea eax, [eax + eax*2]
xor edx, edx
push ebp
test eax, eax
jle 0x43534c
lea edx, [eax - 1]
mov eax, 0xaaaaaaab
mul edx
shr edx, 1
inc edx
lea eax, [edx + edx*2]
mov dword [esp + 0x10], eax
movzx eax, byte [esi]
movzx ebp, byte [esi + 1]
mov ebx, eax
sar ebx, 2
inc esi
movzx edi, byte [esi + 1]
and ebx, 0x3f
mov bl, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], bl
inc esi
shl eax, 4
mov ebx, ebp
sar ebx, 4
add ebx, eax
and ebx, 0x3f
movzx eax, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
inc ecx
mov eax, edi
sar eax, 6
lea eax, [eax + ebp*4]
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
and edi, 0x3f
movzx eax, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
inc esi
inc ecx
sub edx, 1
jne 0x4352e2
mov ebx, dword [esp + 0x20]
mov edi, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
cmp edx, edi
jge 0x4353a3
movzx eax, byte [esi]
lea ebp, [edx + 1]
cmp ebp, edi
jge 0x435360
movzx esi, byte [esi + 1]
jmp 0x435362
xor esi, esi
mov edx, eax
sar edx, 2
and edx, 0x3f
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
mov edx, esi
sar edx, 4
shl eax, 4
add edx, eax
and edx, 0x3f
mov al, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
inc ecx
cmp ebp, edi
jge 0x43539b
and esi, 0xf
mov dl, byte [esi*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
jmp 0x43539e
mov byte [ecx], 0x3d
inc ecx
mov byte [ecx], 0x3d
inc ecx
mov eax, ecx
sub eax, dword [esp + 0x1c]
pop ebp
mov dword [ebx], eax
mov byte [ecx], 0
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x436290
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
push eax
call fcn.004b9ddb
add esp, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, 1
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004828fb
add esp, 4
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.004b9dbc
add esp, 8
mov byte [ebp - 1], 1
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
jmp 0x4362fa
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 8]
jg 0x436368
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
movzx ecx, word [eax + edx*2]
cmp ecx, 0x5c
jne 0x436366
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
mov cx, word [eax + edx*2]
mov word [ebp - 0x18], cx
xor edx, edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov word [ecx + eax*2], dx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x43634f
push 0
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x43634f
mov byte [ebp - 1], 0
jmp 0x436368
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
mov ax, word [ebp - 0x18]
mov word [edx + ecx*2], ax
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x10], ecx
jmp 0x4362f1
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
push eax
call fcn.004b9d83
add esp, 4
movzx eax, byte [ebp - 1]
mov esp, ebp
pop ebp
ret
Function at 0x437db0
Capabilities:
Check if file exists
Get common file path
Get program files directory
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x580ca0]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsIEXPLORE.EXE
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x437df5
xor eax, eax
jmp 0x437ef4
xor ecx, ecx
mov word [ebp - 0x220], cx
push 0x206
push 0
lea edx, [ebp - 0x21e]
push edx
call fcn.004ba280
add esp, 0xc
mov dword [ebp - 0xc], 0x104
mov dword [ebp - 4], 1
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x220]
push ecx
lea edx, [ebp - 4]
push edx
push 0
push 0x52daec
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [ebp - 0x220]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x437ed2
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov word [ebp - 0x428], ax
push 0x206
push 0
lea ecx, [ebp - 0x426]
push ecx
call fcn.004ba280
add esp, 0xc
push 0
push 0x26
lea edx, [ebp - 0x428]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.Internet_Exploreriexplore.exe
lea eax, [ebp - 0x428]
push eax
call fcn.004b9d8e
add esp, 8
lea ecx, [ebp - 0x428]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x437eb8
xor eax, eax
jmp 0x437ef4
lea edx, [ebp - 0x428]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004b9dbc
add esp, 8
mov eax, 1
jmp 0x437ef4
lea ecx, [ebp - 0x220]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004b9dbc
add esp, 8
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004ba1db
mov esp, ebp
pop ebp
ret
Function at 0x437f10
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x450
mov eax, dword [0x580ca0]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x23c], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x228], 0
xor eax, eax
mov word [ebp - 0x448], ax
push 0x206
push 0
lea ecx, [ebp - 0x446]
push ecx
call fcn.004ba280
add esp, 0xc
xor edx, edx
mov word [ebp - 0x220], dx
push 0x206
push 0
lea eax, [ebp - 0x21e]
push eax
call fcn.004ba280
add esp, 0xc
mov dword [ebp - 0xc], 0x104
mov dword [ebp - 0x44c], 1
lea ecx, [ebp - 0x10]
push ecx
push 0x20019
push 0
push 0x52db30
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0
je 0x437fe3
xor eax, eax
jmp 0x438140
lea edx, [ebp - 0x22c]
push edx
push 0x20019
push 0
push 0x52db3c
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0
je 0x438016
xor eax, eax
jmp 0x438140
lea ecx, [ebp - 0x234]
push ecx
push 0x20019
push 0
push 0x52db48
mov edx, dword [ebp - 0x22c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0
je 0x43804c
xor eax, eax
jmp 0x438140
mov dword [ebp - 0x228], 0x104
mov dword [ebp - 8], 1
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x448]
push ecx
lea edx, [ebp - 8]
push edx
push 0
push 0x52db64
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x22c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x234]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x448]
push eax
call fcn.004baf3a
add esp, 4
mov dword [ebp - 0x224], eax
push 0x52db68
mov ecx, dword [ebp - 0x224]
push ecx
call fcn.0043ae30
add esp, 8
mov dword [ebp - 0x450], eax
cmp dword [ebp - 0x450], 0
jne 0x4380d9
xor eax, eax
jmp 0x438140
mov edx, dword [ebp - 0x450]
add edx, 2
mov dword [ebp - 0x224], edx
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0x238], eax
push 0x52db6c
mov ecx, dword [ebp - 0x224]
push ecx
call fcn.0043ae30
add esp, 8
mov dword [ebp - 0x450], eax
cmp dword [ebp - 0x450], 0
jne 0x43811b
xor eax, eax
jmp 0x438140
xor edx, edx
mov eax, dword [ebp - 0x450]
mov word [eax], dx
mov ecx, dword [ebp - 0x238]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x43813b
xor eax, eax
jmp 0x438140
mov eax, 1
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004ba1db
mov esp, ebp
pop ebp
ret
Function at 0x438330
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x444
mov eax, dword [0x580ca0]
xor eax, ebp
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x238], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x228], 0
xor eax, eax
mov word [ebp - 0x440], ax
push 0x206
push 0
lea ecx, [ebp - 0x43e]
push ecx
call fcn.004ba280
add esp, 0xc
xor edx, edx
mov word [ebp - 0x220], dx
push 0x206
push 0
lea eax, [ebp - 0x21e]
push eax
call fcn.004ba280
add esp, 0xc
mov dword [ebp - 0x10], 0x104
mov dword [ebp - 0x444], 1
lea ecx, [ebp - 0x14]
push ecx
push 0x20019
push 0
push str.htmlfile
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0
je 0x438403
xor eax, eax
jmp 0x4384f7
lea edx, [ebp - 0x22c]
push edx
push 0x20019
push 0
push str.shell
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0
je 0x438436
xor eax, eax
jmp 0x4384f7
lea ecx, [ebp - 0x234]
push ecx
push 0x20019
push 0
push str.opencommand
mov edx, dword [ebp - 0x22c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0
je 0x43846c
xor eax, eax
jmp 0x4384f7
mov dword [ebp - 0x228], 0x104
mov dword [ebp - 0xc], 1
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x440]
push ecx
lea edx, [ebp - 0xc]
push edx
push 0
push 0x52dbf4
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x22c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x234]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x440]
push eax
call fcn.004baf3a
add esp, 4
mov dword [ebp - 0x224], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x224]
push edx
call fcn.0043ae30
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4384f2
xor eax, eax
jmp 0x4384f7
mov eax, 1
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.004ba1db
mov esp, ebp
pop ebp
ret
Function at 0x438650
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xfe0
mov eax, dword [0x580ca0]
xor eax, ebp
mov dword [ebp - 0x40], eax
push 0x7d0
lea eax, [ebp - 0xfe0]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.Program_FilesInternet_Exploreriexplore.exe
lea ecx, [ebp - 0xfd4]
push ecx
call fcn.004b9dbc
add esp, 8
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0xfe0]
push eax
call fcn.004b9d8e
add esp, 8
push 0x3c
push 0
lea ecx, [ebp - 0x3c]
push ecx
call fcn.004ba280
add esp, 0xc
mov dword [ebp - 0x30], 0x52dca0
mov dword [ebp - 0x38], 0x200
mov edx, dword [ebp + 8]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x20], 1
push 1
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0x52dcac
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x4386f2
lea ecx, [ebp - 0xfe0]
push ecx
call fcn.004387a0
add esp, 4
mov ecx, dword [ebp - 0x40]
xor ecx, ebp
call fcn.004ba1db
mov esp, ebp
pop ebp
ret

Function at 0x4387a0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x830
mov eax, dword [0x580ca0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x44
push 0
lea eax, [ebp - 0x830]
push eax
call fcn.004ba280
add esp, 0xc
mov dword [ebp - 0x830], 0x44
push 0x10
push 0
lea ecx, [ebp - 0x7e8]
push ecx
call fcn.004ba280
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
push 0x52dcd0
lea eax, [ebp - 0x7d8]
push eax
call fcn.004babbc
add esp, 0xc
lea ecx, [ebp - 0x7e8]
push ecx
lea edx, [ebp - 0x830]
push edx
push 0
push 0
push 0
push 1
push 0
push 0
lea eax, [ebp - 0x7d8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x43882a
jmp 0x438844
mov ecx, dword [ebp - 0x7e8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x7e4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ba1db
mov esp, ebp
pop ebp
ret
Function at 0x438ae0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x65c
mov eax, dword [0x580ca0]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [ebp + 8], 0
jne 0x438b00
xor eax, eax
jmp 0x438c57
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.004ba280
add esp, 0xc
xor edx, edx
mov word [ebp - 0x420], dx
push 0x206
push 0
lea eax, [ebp - 0x41e]
push eax
call fcn.004ba280
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x210]
push edx
call fcn.004b9dbc
add esp, 8
lea eax, [ebp - 0x210]
push eax
call fcn.004bb207
add esp, 4
mov dword [ebp - 0x424], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x658], 0
push 0x228
push 0
lea ecx, [ebp - 0x654]
push ecx
call fcn.004ba280
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0xffffffff
jne 0x438bb6
xor eax, eax
jmp 0x438c57
mov dword [ebp - 0x658], 0x22c
lea edx, [ebp - 0x658]
push edx
mov eax, dword [ebp - 0x214]
push eax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x438c48
lea ecx, [ebp - 0x634]
push ecx
lea edx, [ebp - 0x420]
push edx
call fcn.004b9dbc
add esp, 8
lea eax, [ebp - 0x420]
push eax
call fcn.004bb207
add esp, 4
mov dword [ebp - 0x65c], eax
mov ecx, dword [ebp - 0x424]
push ecx
mov edx, dword [ebp - 0x65c]
push edx
call fcn.004bb00b
add esp, 8
test eax, eax
jne 0x438c31
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x650]
jmp 0x438c57
lea ecx, [ebp - 0x658]
push ecx
mov edx, dword [ebp - 0x214]
push edx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x438bd7
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004ba1db
mov esp, ebp
pop ebp
ret
Function at 0x4396f0
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x580ca0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push 0x52dd5c
mov eax, dword [ebp + 8]
push eax
call fcn.0043ae30
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x439730
push 5
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x439823
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov edx, 1
test edx, edx
je 0x439815
mov dword [ebp - 0x10], 1
xor eax, eax
mov word [ebp - 0x220], ax
push 0x206
push 0
lea ecx, [ebp - 0x21e]
push ecx
call fcn.004ba280
add esp, 0xc
cmp dword [ebp - 0xc], 0
jne 0x439791
mov edx, dword [ebp + 8]
push edx
push str._s.del
lea eax, [ebp - 0x220]
push eax
call fcn.004babbc
add esp, 0xc
jmp 0x4397ad
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push str._s.del_d
lea eax, [ebp - 0x220]
push eax
call fcn.004babbc
add esp, 0x10
lea ecx, [ebp - 0x220]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4397ce
lea edx, [ebp - 0x220]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4397ea
cmp dword [ebp - 0xc], 0xa
jl 0x4397dc
jmp 0x439823
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
jmp 0x43973e
lea ecx, [ebp - 0x220]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004bb2a3
add esp, 8
push 5
push 0
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x439823
push 5
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004ba1db
mov esp, ebp
pop ebp
ret