joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e309
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a8
push edi
mov dword [ebp - 0x1a8], ecx
mov al, byte [0x52dc2c]
mov byte [ebp - 0x1a4], al
mov ecx, 0x18
xor eax, eax
lea edi, [ebp - 0x1a3]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov cl, byte [0x52dc30]
mov byte [ebp - 0x14], cl
xor edx, edx
mov dword [ebp - 0x13], edx
mov dword [ebp - 0xf], edx
mov dword [ebp - 0xb], edx
mov dword [ebp - 7], edx
mov word [ebp - 3], dx
mov byte [ebp - 1], dl
mov al, byte [0x52dc34]
mov byte [ebp - 0x140], al
mov ecx, 0x4a
xor eax, eax
lea edi, [ebp - 0x13f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, dword [ebp + 8]
push ecx
push 0x104
lea edx, [ebp - 0x1a4]
push edx
push str.127.0.0.1
push str.ServerName
push 0x456610
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [ebp + 8]
push eax
push 0x14
lea ecx, [ebp - 0x14]
push ecx
push 0x456620
push str.PORT
push 0x456630
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov edx, dword [ebp + 8]
push edx
push 0x12c
lea eax, [ebp - 0x140]
push eax
push str.3001
push str.mMsg
push 0x456650
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [ebp - 0x14]
push ecx
call sub.MSVCRT.dll_atol
add esp, 4
push eax
lea edx, [ebp - 0x140]
push edx
lea eax, [ebp - 0x1a4]
push eax
call dword [0x52dbec]
pop edi
mov esp, ebp
pop ebp
ret 4

Function at 0x40fad0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 4], eax
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
Function at 0x40fd95
Capabilities:
Contain obfuscated stackstrings
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov byte [ebp - 0x224], 0x12
mov byte [ebp - 0x223], 0x34
mov byte [ebp - 0x222], 0x56
mov byte [ebp - 0x221], 0x78
mov byte [ebp - 0x220], 0x87
mov byte [ebp - 0x21f], 0x65
mov byte [ebp - 0x21e], 0x34
mov byte [ebp - 0x21d], 0x21
mov byte [ebp - 0x234], 0x12
mov byte [ebp - 0x233], 0x34
mov byte [ebp - 0x232], 0x56
mov byte [ebp - 0x231], 0x79
mov byte [ebp - 0x230], 0x97
mov byte [ebp - 0x22f], 0x65
mov byte [ebp - 0x22e], 0x34
mov byte [ebp - 0x22d], 0x21
mov dword [0x52b018], 1
push 0x208
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0
push 3
push 0
push 3
push 0x80000000
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 0xffffffff
je 0x40ffc3
push 0
mov edx, dword [ebp - 0x228]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x22c], eax
push 2
push 0
push 0xfffffffffffffff8
mov eax, dword [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea ecx, [ebp - 0x218]
push ecx
push 8
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x40fec2
mov ecx, dword [ebp - 0x228]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x40ffc5
push 8
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x224]
push eax
call sub.MSVCRT.dll_memcmp
add esp, 0xc
test eax, eax
je 0x40fee2
xor eax, eax
jmp 0x40ffc5
push 2
push 0
push 0xfffffffffffffff4
mov ecx, dword [ebp - 0x228]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea edx, [ebp - 0x218]
push edx
push 4
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x228]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x40ff34
mov edx, dword [ebp - 0x228]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x40ffc5
push 4
push 0x1000
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x52d994], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x22c]
sub eax, dword [edx]
sub eax, 0xc
mov dword [ebp - 0x21c], eax
push 0
push 0
mov ecx, dword [ebp - 0x21c]
push ecx
mov edx, dword [ebp - 0x228]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
mov eax, dword [0x52d994]
push eax
mov ecx, dword [ebp - 0x228]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x40ffbc
mov edx, dword [ebp - 0x228]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x40ffc5
mov eax, 1
jmp 0x40ffc5
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x410edc
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov cx, word [eax + 0x14]
mov edx, dword [ebp + 0xc]
lea eax, [edx + ecx + 0x18]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
jmp 0x410f10
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
add edx, 0x28
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov cx, word [eax + 6]
cmp dword [ebp - 8], ecx
jae 0x410f56
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x410f36
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0xc]
jb 0x410f54
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
add eax, dword [ebp - 0xc]
cmp dword [ebp + 8], eax
jae 0x410f54
mov eax, dword [ebp - 4]
jmp 0x410f58
jmp 0x410efe
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x411540
Capabilities:
Create process on windows
Get common file path
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x468
cmp dword [ebp + 0xc], 0
je 0x411566
lea eax, [ebp - 0x45c]
push eax
call fcn.004118c7
add esp, 4
test eax, eax
jne 0x411663
push 0x400
push 0
lea ecx, [ebp - 0x45c]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
lea edx, [ebp - 0x45c]
push edx
push 0x1ff
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push str.YShowWU.exe
lea eax, [ebp - 0x45c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 0x464], 0
mov dword [ebp - 0x460], 0
push 4
push 0x4f83b8
lea ecx, [ebp - 0x460]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 4
push 0x1000
mov edx, dword [ebp - 0x460]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4115f0
xor eax, eax
jmp 0x4116fb
push 0x293a8
push 0x4f83bc
lea eax, [ebp - 0x460]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.00417800
add esp, 0x10
push 0
push 0
push 2
push 0
push 3
push 0xc0000000
lea edx, [ebp - 0x45c]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x468], eax
cmp dword [ebp - 0x468], 0xffffffff
je 0x411663
push 0
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x460]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x468]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 0x468]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x45c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x44
push 0
lea ecx, [ebp - 0x5c]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x5c], 0x44
mov dword [ebp - 0x30], 1
mov word [ebp - 0x2c], 1
push 0x10
push 0
lea edx, [ebp - 0x10]
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x5c]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x45c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4116d3
xor eax, eax
jmp 0x4116fb
mov eax, dword [ebp + 0x10]
cmp dword [eax], 1
jne 0x4116ea
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 8]
mov dword [ecx], edx
mov eax, 1
jmp 0x4116fb
push 0xffffffffffffffff
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x411bd8
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x1c], 0x9e3779b9
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 0x20], eax
mov dword [ebp - 8], 0
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x24], 0x20
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
sub ecx, 1
mov dword [ebp - 0x24], ecx
test eax, eax
jle 0x411c90
mov edx, dword [ebp - 8]
sub edx, 0x61c88647
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x20]
shl eax, 4
add eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 8]
xor eax, ecx
mov edx, dword [ebp - 0x20]
shr edx, 5
add edx, dword [ebp - 0xc]
xor eax, edx
mov ecx, dword [ebp - 0x18]
add ecx, eax
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
shl edx, 4
add edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 8]
xor edx, eax
mov ecx, dword [ebp - 0x18]
shr ecx, 5
add ecx, dword [ebp - 0x14]
xor edx, ecx
mov eax, dword [ebp - 0x20]
add eax, edx
mov dword [ebp - 0x20], eax
jmp 0x411c2a
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
mov dword [ecx], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x20]
mov dword [eax + 4], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x411ca7
Capabilities:
Decrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x1c], 0x9e3779b9
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 0x20], eax
mov dword [ebp - 8], 0xc6ef3720
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x24], 0x20
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
sub ecx, 1
mov dword [ebp - 0x24], ecx
test eax, eax
jle 0x411d5e
mov edx, dword [ebp - 0x18]
shl edx, 4
add edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 8]
xor edx, eax
mov ecx, dword [ebp - 0x18]
shr ecx, 5
add ecx, dword [ebp - 0x14]
xor edx, ecx
mov eax, dword [ebp - 0x20]
sub eax, edx
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
shl ecx, 4
add ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x20]
add edx, dword [ebp - 8]
xor ecx, edx
mov eax, dword [ebp - 0x20]
shr eax, 5
add eax, dword [ebp - 0xc]
xor ecx, eax
mov edx, dword [ebp - 0x18]
sub edx, ecx
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
add eax, 0x61c88647
mov dword [ebp - 8], eax
jmp 0x411cf9
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
mov dword [ecx], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x20]
mov dword [eax + 4], ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x417a70
Capabilities:
Compress data via zlib inflate or deflate

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x40
test eax, eax
push ebx
push ebp
push esi
push edi
je 0x418fea
mov ebx, dword [eax + 0x1c]
test ebx, ebx
je 0x418fea
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x418fea
cmp dword [eax], 0
jne 0x417aa9
mov ecx, dword [eax + 4]
test ecx, ecx
jne 0x418fea
cmp dword [ebx], 0xb
jne 0x417ab4
mov dword [ebx], 0xc
mov ecx, dword [eax + 0xc]
mov esi, dword [eax]
mov edi, dword [eax + 4]
mov ebp, dword [ebx + 0x3c]
mov dword [esp + 0x28], ecx
mov ecx, dword [eax + 0x10]
mov eax, dword [ebx + 0x38]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x30], ecx
mov ecx, dword [ebx]
cmp ecx, 0x1e
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], 0
ja 0x418fea
jmp 0x417afa
jmp dword [ecx*4 + 0x419184]
mov eax, 0xfffffffe
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret
Function at 0x426f50
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x104
call fcn.00443ba0
push ebx
push esi
push edi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x426f9f
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x426f9f
mov edx, dword [sym.imp.MSVCRT.dll__iob]
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
add edx, 0x40
push eax
push ecx
push edx
call dword [sym.imp.MSVCRT.dll_vfprintf]
add esp, 0xc
lea esp, [ebp - 0x110]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push ecx
lea edx, [ebp - 0x104]
push 0xff
push edx
call dword [sym.imp.MSVCRT.dll__vsnprintf]
add esp, 0x10
mov byte [ebp - 5], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x4270a3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
call dword [sym.imp.USER32.dll_GetProcessWindowStation]
mov ebx, eax
test ebx, ebx
je 0x42705e
lea eax, [ebp - 4]
push eax
push 0
push 0
push 2
push ebx
call dword [sym.imp.USER32.dll_GetUserObjectInformationW]
test eax, eax
jne 0x42705e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x42705e
mov eax, dword [ebp - 4]
cmp eax, 0x200
ja 0x42705e
lea esi, [eax + 1]
and esi, 0xfffffffe
mov dword [ebp - 4], esi
lea eax, [esi + 2]
add eax, 3
and al, 0xfc
call fcn.00443ba0
lea ecx, [ebp - 4]
mov edi, esp
push ecx
push esi
push edi
push 2
push ebx
call dword [sym.imp.USER32.dll_GetUserObjectInformationW]
test eax, eax
je 0x42705e
mov edx, dword [ebp - 4]
push str.Service_0x
push edi
lea eax, [edx + 1]
and al, 0xfe
mov dword [ebp - 4], eax
shr eax, 1
mov word [edi + eax*2], 0
call dword [sym.imp.MSVCRT.dll_wcsstr]
add esp, 8
test eax, eax
je 0x4270a3
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
lea ecx, [ebp - 4]
push 0
push ecx
push 0
push 1
push 0
push 0
mov esi, eax
push 0
lea eax, [ebp - 0x104]
push 1
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
lea esp, [ebp - 0x110]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x10
lea edx, [ebp - 0x104]
push str.OpenSSL:_FATAL
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea esp, [ebp - 0x110]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x443c56
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x453f30
jmp 0x443c73
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
and dword [ebp - 4], 0
push 1
call dword [sym.imp.MSVCRT.dll___set_app_type]
pop ecx
or dword [0x52fb7c], 0xffffffff
or dword [0x52fb80], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x52fb78]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov ecx, dword [0x52fb74]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x52fb84], eax
call fcn.00444091
cmp dword [0x52b010], 0
jne 0x443cd9
push 0x44408e
call dword [sym.imp.MSVCRT.dll___setusermatherr]
pop ecx
call fcn.0044407c
push 0x455010
push 0x45500c
call sub.MSVCRT.dll__initterm
mov eax, dword [0x52fb70]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x52fb6c]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.MSVCRT.dll___getmainargs]
push 0x455008
push section..data
call sub.MSVCRT.dll__initterm
call dword [sym.imp.MSVCRT.dll___p___initenv]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
push dword [ebp - 0x20]
push dword [ebp - 0x2c]
push dword [ebp - 0x1c]
call fcn.00401458
add esp, 0x30
mov dword [ebp - 0x24], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x30], ecx
push eax
push ecx
call sub.MSVCRT.dll__XcptFilter
pop ecx
pop ecx
ret
Function at 0x401cf0
Capabilities:
Copy file
Delete file
Delete registry key
Set file attributes

Disassembly:
sub esp, 0x100
push esi
mov esi, dword [esp + 0x108]
test esi, esi
push 0x80
je 0x401d3b
mov eax, dword [0x411178]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [esp + 4]
push 0xff
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, dword [0x411178]
push 0
lea eax, [esp + 8]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
jmp 0x401d66
mov ecx, dword [0x411178]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov edx, dword [0x411178]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [0x4111f4]
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ecx, dword [0x4111e0]
mov edx, dword [0x4111dc]
mov eax, dword [0x4111cc]
push ecx
mov ecx, dword [0x4111d8]
push edx
mov edx, dword [0x411178]
push eax
push 0xc
push ecx
push edx
push esi
call fcn.00401ff0
mov eax, dword [0x4111d4]
mov ecx, dword [0x4111c8]
mov edx, dword [0x4111e4]
add esp, 0x1c
push eax
mov eax, dword [0x4111bc]
push ecx
mov ecx, dword [0x411178]
push edx
push 0x1c
push eax
push ecx
push esi
call fcn.00401ff0
mov edx, dword [0x411198]
mov eax, dword [0x411190]
mov ecx, dword [0x411188]
add esp, 0x1c
push edx
mov edx, dword [0x411178]
push eax
push 3
push ecx
push edx
push esi
call fcn.00401f60
mov eax, dword [0x41117c]
mov ecx, dword [0x4111a8]
mov edx, dword [0x4111a0]
add esp, 0x18
push eax
mov eax, dword [0x411178]
push ecx
push 9
push edx
push eax
push esi
call fcn.00401f60
mov ecx, dword [0x4111d0]
mov edx, dword [0x4111c4]
mov eax, dword [0x4111b8]
add esp, 0x18
push ecx
mov ecx, dword [0x411178]
push edx
push 1
push eax
push ecx
push esi
call fcn.00401f60
mov edx, dword [0x4111c0]
mov eax, dword [0x4111b4]
mov ecx, dword [0x4111ac]
add esp, 0x18
push edx
mov edx, dword [0x411178]
push eax
push 6
push ecx
push edx
push esi
call fcn.00401f60
add esp, 0x18
pop esi
add esp, 0x100
ret
Function at 0x401e60
Capabilities:
Create process on windows
Create process suspended

Disassembly:
sub esp, 0x54
push esi
push edi
push 0x40b5b4
call fcn.00401ae0
add esp, 4
test eax, eax
je 0x401e94
mov eax, dword [0x4111dc]
mov ecx, dword [0x4111cc]
push eax
push ecx
push connect
call fcn.00402fd0
add esp, 0xc
mov esi, eax
jmp 0x401e98
mov esi, dword [esp + 0x60]
push 0x40b5b0
call fcn.00401ae0
add esp, 4
test eax, eax
je 0x401ec5
mov edx, dword [0x4111c8]
mov eax, dword [0x4111e4]
push edx
push eax
push connect
call fcn.00402fd0
add esp, 0xc
mov esi, eax
test esi, esi
je 0x401f55
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, esi
mov byte [ecx + esi - 2], al
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x411200
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x60]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x411200
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 8]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
push 0x20
push 0
push 0
push 0
push 0x411200
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop edi
pop esi
add esp, 0x54
ret

Function at 0x401f60
Capabilities:
Copy file
Delete file
Set file attributes

Disassembly:
mov eax, dword [esp + 4]
push esi
test eax, eax
je 0x401fc0
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x80
push esi
call edi
mov eax, dword [esp + 0x10]
push 0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0x80
push esi
call edi
mov ecx, dword [esp + 0x18]
push ecx
push esi
call fcn.00403300
add esp, 8
push 1
push esi
call edi
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
push esi
push edx
push eax
push connect
call fcn.00403090
add esp, 0x10
pop edi
pop esi
ret
mov esi, dword [esp + 0x10]
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push ecx
push edx
push connect
call fcn.004030e0
add esp, 0xc
pop esi
ret
Function at 0x401ff0
Capabilities:
Copy file
Delete file
Set file attributes

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
push esi
test eax, eax
push edi
je 0x4020c2
mov esi, dword [esp + 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x80
push esi
call edi
mov eax, dword [esp + 0x18]
push 0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0x80
push esi
call edi
mov ecx, dword [esp + 0x20]
push ecx
push esi
call fcn.00403300
add esp, 8
push 1
push esi
call edi
mov ebp, dword [esp + 0x24]
push 0x411644
push ebp
push connect
call fcn.00402fd0
mov edi, eax
add esp, 0xc
test edi, edi
je 0x402119
mov ebx, dword [esp + 0x2c]
mov ecx, edi
mov esi, ebx
mov al, byte [ecx]
mov dl, al
cmp al, byte [esi]
jne 0x402088
test dl, dl
je 0x402084
mov al, byte [ecx + 1]
mov dl, al
cmp al, byte [esi + 1]
jne 0x402088
add ecx, 2
add esi, 2
test dl, dl
jne 0x402064
xor ecx, ecx
jmp 0x40208d
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
je 0x402119
mov ecx, dword [esp + 0x28]
push edi
push ecx
push ebp
push connect
call fcn.00403090
add esp, 0x10
push ebx
push 0x411644
push ebp
push connect
call fcn.00403090
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
ret
mov ebp, dword [esp + 0x28]
mov edi, dword [esp + 0x24]
push ebp
push edi
push connect
call fcn.00402fd0
mov ebx, dword [esp + 0x28]
add esp, 0xc
mov esi, eax
push 0x80
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test esi, esi
je 0x40210a
push esi
push 0x411644
push edi
push connect
call fcn.00403090
add esp, 0x10
push ebp
push edi
push connect
call fcn.004030e0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x402e10
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x100
push ebx
push ebp
push esi
push edi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetTopWindow]
mov ebp, eax
test ebp, ebp
je 0x402e97
mov ebx, dword [esp + 0x114]
lea eax, [esp + 0x10]
push 0xff
push eax
push ebp
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
mov esi, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [esp + ecx + 0x10], al
lea eax, [esp + 0x10]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x402e7f
test cl, cl
je 0x402e7b
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x402e7f
add eax, 2
add esi, 2
test cl, cl
jne 0x402e5b
xor eax, eax
jmp 0x402e84
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x402e97
push 2
push ebp
call dword [sym.imp.USER32.dll_GetWindow]
mov ebp, eax
test ebp, ebp
jne 0x402e34
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x100
ret