joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4118b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x432af8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x43e460]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x40], edx
mov edx, dword [ebp + 0x14]
mov dword [ebp - 0x3c], eax
mov eax, edx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x30], 1
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x411905
sub eax, edi
mov ecx, esi
mov edi, eax
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x411915
sub ecx, ebx
lea ecx, [ecx + edi + 1]
cmp ecx, 0x208
jb 0x411931
xor eax, eax
jmp 0x411a00
xor ebx, ebx
mov eax, edx
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x411945
sub eax, edi
push eax
push edx
lea ecx, [ebp - 0x2c]
call fcn.00401e50
push 1
push 0x435ae8
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], ebx
call fcn.00408860
mov edx, esi
lea edi, [edx + 1]
nop
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x411970
sub edx, edi
push edx
push esi
mov ecx, eax
call fcn.00408860
mov esi, 0x20019
call fcn.004078e0
test al, al
je 0x411995
mov esi, 0x20119
mov eax, dword [ebp - 0x2c]
mov edi, 0x10
cmp dword [ebp - 0x18], edi
jae 0x4119a5
lea eax, [ebp - 0x2c]
lea edx, [ebp - 0x34]
push edx
push esi
push ebx
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4119e9
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x3c]
push ecx
mov ecx, dword [ebp - 0x34]
push edx
push ebx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4119dd
mov dword [ebp - 0x30], ebx
mov edx, dword [ebp - 0x34]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4119ec
mov dword [ebp - 0x30], ebx
cmp dword [ebp - 0x18], edi
jb 0x4119fd
mov eax, dword [ebp - 0x2c]
push eax
call fcn.0041b28a
add esp, 4
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041be05
mov esp, ebp
pop ebp
ret 0x18
Function at 0x419a30
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
mov ecx, dword [ebp + 0xc]
push 4
mov dword [esi], 0x436560
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
call fcn.0041be14
push 0
push 4
push esi
push 0x419a10
push 0
push 0
mov dword [esi + 0x10], eax
call fcn.0041e138
mov edx, dword [esi + 0x10]
add esp, 0x1c
mov dword [edx], eax
mov eax, esi
pop esi
pop ebp
ret 8

Function at 0x419ab0
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x10]
cmp dword [eax], 0
jne 0x419abf
xor al, al
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x10]
mov dword [esi + 0xc], eax
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov al, 1
pop esi
ret

Function at 0x41be05
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43e460]
jne 0x41be0f
repz ret
jmp fcn.0042187c
Function at 0x42cf35
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x43e460]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00421270
and dword [ebp - 0x14], 0
cmp dword [0x440f5c], 0
mov dword [ebp - 0x18], eax
jne 0x42cfe8
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x42d090
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x42d090
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x440f5c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x440f60], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x440f64], eax
call edi
push eax
call esi
mov dword [0x440f6c], eax
test eax, eax
je 0x42cfe8
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x440f68], eax
mov eax, dword [0x440f68]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x42d041
cmp dword [0x440f6c], ecx
je 0x42d041
push eax
call esi
push dword [0x440f6c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x42d041
test ebx, ebx
je 0x42d041
call edi
test eax, eax
je 0x42d038
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x42d038
test byte [ebp - 8], 1
jne 0x42d041
or dword [ebp + 0x10], 0x200000
jmp 0x42d074
mov eax, dword [0x440f60]
cmp eax, dword [ebp - 0x18]
je 0x42d074
push eax
call esi
test eax, eax
je 0x42d074
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x42d074
mov eax, dword [0x440f64]
cmp eax, dword [ebp - 0x18]
je 0x42d074
push eax
call esi
test eax, eax
je 0x42d074
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x440f5c]
call esi
test eax, eax
je 0x42d090
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x42d092
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041be05
leave
ret

Function at 0x42e0a8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
ror byte [ecx - 0x8b7b], cl
dec dword [ebx - 0xe0807bb]
test edx, edx
je 0x42e0be
inc dword [ebp - 0x8c]
invalid
scasd eax, dword es:[edi]
invalid
invalid
Function at 0x42e679
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push dword [ebp + 0x14]
call fcn.0042dd95
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.0042dde0
pop ecx
push eax
Function at 0x42e770
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0042dd95
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], 0x80
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
push eax
call fcn.0042dde0
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0042dd95
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.0042ddd0
or dl, dl
mov bh, 0x37
and byte [ebp - 0x534], 0
and byte [ebp - 0x533], 0
mov byte [ebp - 0x532], 0x68
and byte [ebp - 0x531], 0
mov byte [ebp - 0x530], 0xd4
mov byte [ebp - 0x52f], 0xfb
mov byte [ebp - 0x52e], pe_nt_image_headers32
mov byte [ebp - 0x52d], 0xe4
mov byte [ebp - 0x52c], 0xf2
mov byte [ebp - 0x52b], 0xdf
mov byte [ebp - 0x52a], 0xf6
mov byte [ebp - 0x529], 0xf9
mov byte [ebp - 0x528], 0xf3
mov byte [ebp - 0x527], 0xfb
mov byte [ebp - 0x526], 0xf2
mov byte [ebp - 0x525], 0x97
lea eax, [ebp - 0x534]
push eax
call fcn.0042dde0
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0042dd95
add esp, 0xc
mov dword [ebp - 0x680], eax
call fcn.0042ddd0
stosb byte es:[edi], al
shr byte [eax], 0x4d
and byte [ebp - 0x664], 0
and byte [ebp - 0x663], 0
mov byte [ebp - 0x662], 7
and byte [ebp - 0x661], 0
mov byte [ebp - 0x660], 0xb0
mov byte [ebp - 0x65f], 0x9d
mov byte [ebp - 0x65e], 0x99
mov byte [ebp - 0x65d], 0x88
mov byte [ebp - 0x65c], 0xb9
mov byte [ebp - 0x65b], 0x94
mov byte [ebp - 0x65a], 0x94
mov byte [ebp - 0x659], 0x97
mov byte [ebp - 0x658], 0x9b
mov byte [ebp - 0x657], pe_nt_image_headers32
lea eax, [ebp - 0x664]
push eax
call fcn.0042dde0
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0042dd95
add esp, 0xc
mov dword [ebp - 0x67c], eax
and byte [ebp - 0x524], 0
and byte [ebp - 0x523], 0
mov byte [ebp - 0x522], 0x15
and byte [ebp - 0x521], 0
mov byte [ebp - 0x520], 0xa2
mov byte [ebp - 0x51f], 0x8f
mov byte [ebp - 0x51e], 0x8b
mov byte [ebp - 0x51d], 0x9a
mov byte [ebp - 0x51c], 0xac
mov byte [ebp - 0x51b], 0x98
mov byte [ebp - 0x51a], 0x8f
mov byte [ebp - 0x519], 0x8f
mov byte [ebp - 0x518], 0xea
lea eax, [ebp - 0x524]
push eax
call fcn.0042dde0
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0042dd95
add esp, 0xc
mov dword [ebp - 0x39c], eax
call fcn.0042ddd0
xchg byte [edx + 0x67], ah
inc eax
and byte [ebp - 0x514], 0
and byte [ebp - 0x513], 0
mov byte [ebp - 0x512], 0xe3
and byte [ebp - 0x511], 0
mov byte [ebp - 0x510], 0x5b
mov byte [ebp - 0x50f], 0x79
invalid
Function at 0x401764
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x401776
mov eax, dword [0x53f08b]
shl eax, 2
mov dword [0x53f08f], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.0050557c
pop edx
call fcn.005054e0
call fcn.005055bc
push 0
call fcn.00507ba0
pop ecx
push 0x53f034
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x53f093], eax
push 0
jmp fcn.005117ec

Function at 0x402c5c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
mov eax, 0x5400d0
call fcn.00506ee8
mov edx, dword [ebp + 8]
cmp byte [edx + 0xa], 0
je 0x402c86
mov ecx, dword [ebp - 0x28]
mov dword fs:[0], ecx
mov eax, ecx
jmp 0x402d2f
mov edx, dword [ebp + 8]
mov eax, dword [edx]
cmp dword [eax + 8], 0
jne 0x402ca2
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
mov eax, edx
jmp 0x402d2f
mov ecx, dword [ebp + 8]
mov byte [ecx + 0xa], 1
xor edx, edx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
call fcn.0046f2c4
mov dword [ebp - 0x30], eax
mov edx, dword [ebp + 8]
cmp dword [edx + 4], 0
je 0x402cd1
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
call fcn.00468c3c
mov edx, dword [ebp - 0x30]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x402d02
mov word [ebp - 0x18], 0x14
dec dword [ebp - 0xc]
mov edx, 2
mov eax, dword [ebp - 4]
call fcn.0053daf8
push dword [ebp - 4]
call fcn.00504bd8
pop ecx
mov word [ebp - 0x18], 8
xor edx, edx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
call fcn.0046f1b4
lea edx, [ebp - 0x2c]
push edx
push 0
push dword [ebp + 8]
push 0x402c30
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
mov ecx, dword [ebp - 0x28]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x402d34
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push dword [0x53f3b0]
call fcn.00506b84
pop ecx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
cmp edx, dword [ebp + 0xc]
jge 0x402d7a
mov eax, dword [ebp - 8]
cdq
idiv dword [ebp - 4]
mov ecx, dword [0x53f3b0]
mov al, byte [ecx + edx]
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 8]
xor byte [edx + ecx], al
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
jl 0x402d56
pop ecx
pop ecx
pop ebp
ret
Function at 0x402e50
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push 0
push 0
push 3
push 0
push 0
push SysReAllocStringLen
push dword [ebp + 8]
call sub.KERNEL32.DLL_CreateFileA
mov dword [ebp - 4], eax
push 0
push 0
push 3
push 0
push 0
push 0x40000000
push dword [ebp + 0xc]
call sub.KERNEL32.DLL_CreateFileA
mov dword [ebp - 8], eax
push 0
push 0
push dword [ebp + 0x18]
push dword [ebp - 4]
call sub.KERNEL32.DLL_SetFilePointer
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp - 8]
call sub.KERNEL32.DLL_SetFilePointer
push dword [ebp + 0x14]
call fcn.00504db0
pop ecx
mov dword [ebp - 0x10], eax
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x14]
push dword [ebp - 0x10]
push dword [ebp - 4]
call sub.KERNEL32.DLL_ReadFile
push 0
lea edx, [ebp - 0xc]
push edx
push dword [ebp + 0x14]
push dword [ebp - 0x10]
push dword [ebp - 8]
call sub.KERNEL32.DLL_WriteFile
push dword [ebp - 0x10]
call fcn.00504be8
pop ecx
push dword [ebp - 4]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 8]
call sub.KERNEL32.DLL_CloseHandle
mov esp, ebp
pop ebp
ret

Function at 0x403ee8
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec4
mov eax, 0x5405ec
call fcn.00506ee8
mov edx, dword [ebp + 8]
add edx, 0x4ec
push edx
call fcn.00413fb8
pop ecx
xor ecx, ecx
mov dword [ebp - 0x30], ecx
xor eax, eax
mov dword [ebp - 0x34], eax
xor edx, edx
mov dword [ebp - 0x38], edx
jmp 0x403f5d
push dword [ebp - 0x38]
mov ecx, dword [ebp + 8]
add ecx, 0x4ec
push ecx
call fcn.004141b0
add esp, 8
mov eax, dword [eax + 4]
cmp eax, dword [ebp - 0x30]
jbe 0x403f5a
push dword [ebp - 0x38]
mov edx, dword [ebp + 8]
add edx, 0x4ec
push edx
call fcn.004141b0
add esp, 8
mov ecx, dword [eax + 4]
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x38]
mov edx, dword [ebp + 8]
add edx, 0x4ec
push edx
call fcn.004038d4
pop ecx
cmp eax, dword [ebp - 0x38]
ja 0x403f1c
mov dword [ebp - 0x3c], 0xff
lea ecx, [ebp - 0x3c]
push ecx
lea eax, [ebp - 0x13c]
push eax
call sub.KERNEL32.DLL_GetComputerNameA
mov word [ebp - 0x1c], 0x14
push dword [ebp - 0x34]
mov edx, dword [ebp + 8]
add edx, 0x4ec
push edx
call fcn.004141b0
add esp, 8
push dword [eax]
lea eax, [ebp - 4]
call fcn.00402538
push eax
inc dword [ebp - 0x10]
call fcn.004140b8
add esp, 8
mov word [ebp - 0x1c], 8
mov word [ebp - 0x1c], 0x20
lea edx, [ebp - 0x13c]
lea eax, [ebp - 8]
call fcn.0053d954
inc dword [ebp - 0x10]
mov edx, dword [eax]
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x380]
call fcn.004d8aa0
dec dword [ebp - 0x10]
lea eax, [ebp - 8]
mov edx, 2
call fcn.0053daf8
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x37c]
call fcn.004d8aa0
dec dword [ebp - 0x10]
lea eax, [ebp - 4]
mov edx, 2
call fcn.0053daf8
mov ecx, dword [ebp - 0x2c]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4054d8
Capabilities:
Get file system object information
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
mov eax, 0x540d9c
call fcn.00506ee8
cmp byte [0x53f3d0], 0
jne 0x405509
mov eax, dword [ebp + 0xc]
add eax, 0x57c
call fcn.00402dd4
mov dword [0x53f3cc], eax
inc byte [0x53f3d0]
cmp byte [0x53f3d8], 0
jne 0x405560
mov word [ebp - 0x2c], 8
mov eax, 0x53f3d4
call fcn.00402538
push eax
inc dword [ebp - 0x20]
mov edx, 0x53f6c2
lea eax, [ebp - 8]
call fcn.0053d954
inc dword [ebp - 0x20]
lea edx, [ebp - 8]
mov eax, dword [ebp + 0xc]
add eax, 0x580
pop ecx
call fcn.0053db50
dec dword [ebp - 0x20]
inc byte [0x53f3d8]
dec dword [ebp - 0x20]
lea eax, [ebp - 8]
mov edx, 2
call fcn.0053daf8
mov word [ebp - 0x2c], 0x20
lea eax, [ebp - 0x10]
call fcn.00402538
push eax
inc dword [ebp - 0x20]
lea eax, [ebp - 0xc]
mov edx, dword [ebp + 0x10]
call fcn.0053d98c
inc dword [ebp - 0x20]
mov eax, dword [eax]
pop edx
call fcn.0047d084
lea ecx, [ebp - 0x10]
push ecx
lea eax, [ebp - 4]
call fcn.00402538
mov ecx, eax
inc dword [ebp - 0x20]
mov eax, 0x53f3d4
pop edx
call fcn.0053db50
dec dword [ebp - 0x20]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.0053daf8
dec dword [ebp - 0x20]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.0053daf8
mov word [ebp - 0x2c], 0x14
lea eax, [ebp - 4]
call fcn.00402dd4
mov dword [ebp - 0x40], eax
push dword [ebp - 0x40]
push dword [0x53f3cc]
call sub.KERNEL32.DLL_MoveFileA
push 0
push 1
mov word [ebp - 0x2c], 0x2c
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0x40]
call fcn.0053d954
inc dword [ebp - 0x20]
push dword [eax]
push dword [ebp + 0xc]
call fcn.0040d0a0
add esp, 0x10
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
dec dword [ebp - 0x20]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.0053daf8
push 0x400
push 0x160
push 0x55fc80
push 0
push dword [ebp - 0x40]
call sub.SHELL32.DLL_SHGetFileInfoA
push dword [0x53f3cc]
push dword [ebp - 0x40]
call sub.KERNEL32.DLL_MoveFileA
mov word [ebp - 0x2c], 0x38
mov edx, 0x55fd90
lea eax, [ebp - 0x18]
call fcn.0053d954
inc dword [ebp - 0x20]
lea edx, [ebp - 0x18]
mov eax, dword [ebp + 8]
call fcn.0053db28
mov eax, dword [ebp + 8]
mov word [ebp - 0x2c], 0x44
push eax
dec dword [ebp - 0x20]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.0053daf8
dec dword [ebp - 0x20]
lea eax, [ebp - 4]
mov edx, 2
call fcn.0053daf8
pop eax
mov word [ebp - 0x2c], 0x38
inc dword [ebp - 0x20]
mov edx, dword [ebp - 0x3c]
mov dword fs:[0], edx
mov esp, ebp
pop ebp
ret
Function at 0x40d0a0
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov eax, 0x543020
call fcn.00506ee8
mov dword [ebp - 8], 1
lea edx, [ebp + 0xc]
lea eax, [ebp + 0xc]
call fcn.0053d98c
inc dword [ebp - 8]
mov word [ebp - 0x14], 8
push 0x160
push 0
push 0x55fde0
call fcn.005069d4
add esp, 0xc
mov dword [ebp - 0x28], 0x4100
cmp byte [ebp + 0x14], 0
je 0x40d0f0
or dword [ebp - 0x28], 2
cmp byte [ebp + 0x10], 0
je 0x40d0fe
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x28], edx
jmp 0x40d102
or dword [ebp - 0x28], 1
push dword [ebp - 0x28]
push 0x160
push 0x55fde0
push 0
lea eax, [ebp + 0xc]
call fcn.00402dd4
push eax
call sub.SHELL32.DLL_SHGetFileInfoA
mov edx, dword [0x55fde4]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
push eax
dec dword [ebp - 8]
lea eax, [ebp + 0xc]
mov edx, 2
call fcn.0053daf8
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
mov esp, ebp
pop ebp
ret
Function at 0x413a6c
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
xor eax, eax
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
xor ecx, ecx
mov cl, byte [edx + str.80_]
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
and eax, 7
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0xc]
sar edx, 3
mov ecx, dword [ebp + 8]
xor eax, eax
mov al, byte [ecx + edx]
mov edx, dword [ebp - 0x10]
and ax, word [edx*2 + 0x5446ec]
je 0x413ab0
mov cl, 1
jmp 0x413ab2
xor ecx, ecx
mov eax, dword [ebp - 8]
mov byte [ebp + eax - 0x4c], cl
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x38
jl 0x413a7a
xor edx, edx
mov dword [ebp - 4], edx
cmp word [ebp + 0xc], 1
jne 0x413add
mov eax, 0xf
sub eax, dword [ebp - 4]
add eax, eax
mov dword [ebp - 0x10], eax
jmp 0x413ae5
mov edx, dword [ebp - 4]
add edx, edx
mov dword [ebp - 0x10], edx
mov ecx, dword [ebp - 0x10]
inc ecx
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
xor edx, edx
mov dword [ebp + eax*4 - 0x104], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x104], edx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 4]
xor edx, edx
mov dl, byte [eax + 0x544794]
add edx, dword [ebp - 8]
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0x1c
jge 0x413b31
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp + ecx - 0x4c]
mov edx, dword [ebp - 8]
mov byte [ebp + edx - 0x84], al
jmp 0x413b42
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp + ecx - 0x68]
mov edx, dword [ebp - 8]
mov byte [ebp + edx - 0x84], al
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x1c
jl 0x413b07
mov dword [ebp - 8], 0x1c
mov ecx, dword [ebp - 4]
xor eax, eax
mov al, byte [ecx + 0x544794]
add eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x38
jge 0x413b7c
mov edx, dword [ebp - 0xc]
mov cl, byte [ebp + edx - 0x4c]
mov eax, dword [ebp - 8]
mov byte [ebp + eax - 0x84], cl
jmp 0x413b8d
mov edx, dword [ebp - 0xc]
mov cl, byte [ebp + edx - 0x68]
mov eax, dword [ebp - 8]
mov byte [ebp + eax - 0x84], cl
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x38
jl 0x413b52
xor edx, edx
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
xor eax, eax
mov al, byte [ecx + 0x5447a4]
cmp byte [ebp + eax - 0x84], 0
je 0x413bc4
mov edx, dword [ebp - 8]
mov ecx, dword [edx*4 + 0x5446fc]
mov eax, dword [ebp - 0x10]
or dword [ebp + eax*4 - 0x104], ecx
mov edx, dword [ebp - 8]
xor ecx, ecx
mov cl, byte [edx + 0x5447bc]
cmp byte [ebp + ecx - 0x84], 0
je 0x413bed
mov eax, dword [ebp - 8]
mov edx, dword [eax*4 + 0x5446fc]
mov ecx, dword [ebp - 0x14]
or dword [ebp + ecx*4 - 0x104], edx
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x18
jl 0x413b9b
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x10
jl 0x413ac7
lea eax, [ebp - 0x104]
push eax
call fcn.00413394
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x413df4
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.USER32.DLL_FindWindowA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x413e85
push 4
push 0x2000
call sub.KERNEL32.DLL_GlobalAlloc
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
call sub.KERNEL32.DLL_GlobalLock
mov dword [ebp - 4], eax
push dword [ebp - 4]
push dword [ebp - 0x10]
call sub.USER32.DLL_GetWindowThreadProcessId
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x413e85
mov eax, dword [ebp - 4]
push dword [eax]
push 0
push 1
call sub.KERNEL32.DLL_OpenProcess
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x413e75
push 0xfffffffffffffff7
push dword [ebp - 0x14]
call sub.KERNEL32.DLL_TerminateProcess
test eax, eax
je 0x413e75
push dword [ebp - 0xc]
call sub.KERNEL32.DLL_GlobalUnlock
push dword [ebp - 0xc]
call sub.KERNEL32.DLL_GlobalFree
mov al, 1
jmp 0x413e87
push dword [ebp - 0xc]
call sub.KERNEL32.DLL_GlobalUnlock
push dword [ebp - 0xc]
call sub.KERNEL32.DLL_GlobalFree
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4145a0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
mov eax, 0x5451f8
call fcn.00506ee8
mov word [ebp - 0x14], 8
mov eax, dword [ebp + 8]
add eax, 0x20
call fcn.00402538
inc dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, 0x24
call fcn.00402538
inc dword [ebp - 8]
push 0
push dword [ebp + 8]
call fcn.00414c34
add esp, 8
mov dl, 1
mov eax, dword [0x46cac8]
call fcn.00402aec
mov edx, dword [ebp + 8]
mov dword [edx], eax
push 0x1a
push 0
mov ecx, dword [ebp + 8]
add ecx, 4
push ecx
call fcn.005069d4
add esp, 0xc
call sub.KERNEL32.DLL_GetLogicalDrives
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], 1
xor eax, eax
mov dword [ebp - 0x30], eax
xor edx, edx
mov dword [ebp - 0x34], edx
mov ecx, dword [ebp - 0x2c]
and ecx, dword [ebp - 0x28]
je 0x414637
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x30]
mov cl, byte [ebp - 0x34]
add cl, 0x61
mov byte [eax + edx + 4], cl
inc dword [ebp - 0x30]
shl dword [ebp - 0x2c], 1
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0x1a
jl 0x41461c
mov eax, dword [ebp - 0x24]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret