joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000fb30
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
mov ebx, ecx
push ebp
push esi
mov eax, dword [ebx + 0x14]
push edi
cmp eax, 3
jge 0x1000fb4a
pop edi
pop esi
pop ebp
mov eax, 0xfffffffe
pop ebx
ret 0xc
mov ebp, dword [esp + 0x18]
test ebp, ebp
jne 0x1000fb5e
pop edi
pop esi
pop ebp
mov eax, 0xfffffffc
pop ebx
ret 0xc
mov edi, dword [esp + 0x14]
test edi, edi
jg 0x1000fb74
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ecx
mov eax, dword [esp + 0x1c]
test eax, eax
jl 0x1000fbf6
mov ebp, dword [sym.imp.MSVCRT.dll_time]
push 0
call ebp
add esp, 4
mov ecx, ebx
mov dword [esp + 0x14], eax
push 1
push 0x30d40
call fcn.1000f110
mov esi, eax
test esi, esi
jne 0x1000fbca
push 0
call ebp
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
sub eax, edx
add esp, 4
cmp eax, ecx
jg 0x1000fbca
push 1
push 0x30d40
mov ecx, ebx
call fcn.1000f110
mov esi, eax
test esi, esi
je 0x1000fba1
cmp esi, 0xffffffff
jne 0x1000fbe1
call sub.WS2_32.dll_WSAGetLastError
pop edi
pop esi
mov dword [ebx + 8], eax
pop ebp
or eax, 0xffffffff
pop ebx
ret 0xc
cmp esi, 1
je 0x1000fbf2
pop edi
pop esi
pop ebp
mov eax, 0xfffffff3
pop ebx
ret 0xc
mov ebp, dword [esp + 0x18]
cmp dword [ebx + 0x10], 1
jne 0x1000fc2d
mov eax, dword [ebx + 0xc]
push 0
push edi
push ebp
push eax
call sub.WS2_32.dll_send
mov esi, eax
test esi, esi
jle 0x1000fc4b
cmp esi, edi
jge 0x1000fc49
mov edx, dword [ebx + 0xc]
sub edi, esi
push 0
lea ecx, [esi + ebp]
push edi
push ecx
push edx
call sub.WS2_32.dll_send
test eax, eax
jl 0x1000fc49
add esi, eax
jmp 0x1000fc49
cmp word [ebx + 0x2e], 0
jbe 0x1000fc83
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x2c]
push 0x10
push eax
push 0
push edi
push ebp
push ecx
call sub.WS2_32.dll_sendto
mov esi, eax
test esi, esi
jl 0x1000fc5e
mov eax, dword [ebx + 0x40]
pop edi
add eax, esi
mov dword [ebx + 0x40], eax
mov eax, esi
pop esi
pop ebp
pop ebx
ret 0xc
cmp esi, 0xffffffff
jne 0x1000fbcf
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x271d
jne 0x1000fbcf
pop edi
pop esi
pop ebp
mov eax, 0xfffffff2
pop ebx
ret 0xc
pop edi
pop esi
pop ebp
mov eax, 0xfffffff6
pop ebx
ret 0xc
Function at 0x100166c0
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
test eax, eax
mov dword [esi + 4], eax
jne 0x100166d4
xor al, al
pop esi
ret 8
mov eax, dword [esp + 0xc]
lea ecx, [esp + 8]
push ecx
push 0
push esi
push 0x10016750
push 0
push 0
mov dword [esi + 8], eax
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
mov dword [esi], eax
test eax, eax
setne al
pop esi
ret 8

Function at 0x10016700
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov edx, dword [esi]
test edx, edx
je 0x10016749
mov ecx, dword [esp + 8]
or eax, 0xffffffff
test ecx, ecx
jl 0x10016720
lea eax, [ecx + ecx*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
push eax
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1001673a
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
pop esi
ret 4

Function at 0x10016780
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1002a54f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
xor ebx, ebx
mov dword [esp + 0x14], esi
lea eax, [esi + 0xc]
mov dword [esi + 8], ebx
push eax
mov dword [esi + 4], 0x1002c208
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov cl, byte [esp + 0xf]
mov dword [esp + 0x20], ebx
mov byte [esi + 0x24], cl
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dl, byte [esp + 0xf]
mov al, byte [esp + 0xf]
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 1
mov byte [esi + 0x54], dl
mov byte [esi + 0x55], al
mov byte [esi + 0x5c], bl
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::_Lockit::constructor_void_]
mov eax, dword [0x10033194]
mov byte [esp + 0x20], 2
cmp eax, ebx
jne 0x10016835
push 0x20
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov dword [eax + 4], ebx
mov dword [eax + 0x1c], 1
mov dword [0x10033194], eax
mov dword [eax], ebx
mov ecx, dword [0x10033194]
add esp, 4
mov dword [ecx + 8], ebx
mov edi, dword [0x10033190]
push 0x20
inc edi
mov dword [0x10033190], edi
mov edi, dword [0x10033194]
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov dword [eax + 4], edi
mov dword [eax + 0x1c], ebx
mov dword [esi + 0x58], eax
mov dword [esi + 0x60], ebx
mov dword [eax], eax
mov eax, dword [esi + 0x58]
add esp, 4
lea ecx, [esp + 0x10]
mov dword [eax + 8], eax
mov byte [esp + 0x20], 1
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::_Lockit::destructor_void_]
mov ecx, dword [esp + 0x18]
mov dword [esi], ebx
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x10017180
Capabilities:
Create thread

Disassembly:
sub esp, 0x28
push ebx
push esi
push edi
xor ebx, ebx
mov edi, ecx
push 0x14
mov dword [esp + 0x10], ebx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x100171bc
push ebx
push ebx
push ebx
push ebx
mov dword [esi + 4], ebx
mov dword [esi], 0x1002c218
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 8], eax
jmp 0x100171be
xor esi, esi
cmp esi, ebx
jne 0x100171cd
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x28
ret 4
mov eax, dword [edi + 4]
push ebp
lea ebp, [edi + 4]
mov ecx, ebp
call dword [eax + 4]
lea ecx, [esp + 0x10]
push ecx
push ebx
push edi
push 0x100172a0
push ebx
push ebx
call dword [sym.imp.MSVCRT.dll__beginthreadex]
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x100171fc
mov dword [esp + 0x10], eax
jmp 0x10017250
mov eax, dword [esp + 0x10]
test eax, eax
je 0x10017250
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], eax
lea edx, [esp + 0x28]
lea eax, [esp + 0x14]
mov dword [esp + 0x34], ecx
push edx
push eax
lea ecx, [edi + 0x54]
call fcn.10018010
mov ecx, eax
mov eax, dword [ecx]
add eax, 0x10
mov edx, dword [ecx + 4]
mov ecx, eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x20], edx
mov dword [ecx], ebx
mov dword [ecx + 4], eax
mov dword [ecx + 8], esi
xor esi, esi
mov edx, dword [ebp]
mov ecx, ebp
call dword [edx + 8]
test esi, esi
pop ebp
je 0x10017287
mov eax, dword [esi + 0xc]
test eax, eax
je 0x1001726e
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [esi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
mov dword [esi], 0x1002c218
call fcn.10009e1d
add esp, 4
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
add esp, 0x28
ret 4
Function at 0x1001a8b0
Capabilities:
Resolve dns

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
je 0x1001a8d2
mov ecx, dword [esi + 0xc]
sub ecx, eax
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
jne 0x1001a8d8
mov al, byte [esi]
pop esi
ret 0xc
push ebx
mov ebx, dword [esp + 0xc]
push edi
push ebx
call sub.WS2_32.dll_inet_addr
mov edi, eax
cmp edi, 0xffffffff
jne 0x1001a8fc
push ebx
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x1001a8fc
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov edi, dword [edx]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
push ecx
push edi
mov ecx, esi
call fcn.1001a840
pop edi
pop ebx
pop esi
ret 0xc
Function at 0x1001f350
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x60]
cmp eax, ebx
je 0x1001f383
lea ecx, [esp + 0xc]
push ebx
push ecx
push 0xd
push str._r_nquit_cmd__r_n
push eax
mov dword [esp + 0x20], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [esi + 0x60]
push edx
call edi
mov eax, dword [esi + 0x5c]
cmp eax, ebx
je 0x1001f38d
push eax
call edi
mov eax, dword [esi + 0x54]
cmp eax, ebx
je 0x1001f397
push eax
call edi
mov eax, dword [esi + 0x58]
cmp eax, ebx
je 0x1001f3a1
push eax
call edi
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x1001f3ab
push eax
call edi
mov eax, dword [esi]
cmp eax, ebx
je 0x1001f3be
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [esi]
push eax
call edi
mov edx, esi
xor ecx, ecx
xor eax, eax
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
lea edx, [esi + 0x10]
mov ecx, 0x11
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [esi + 0x58], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x5c], ebx
pop edi
pop esi
mov dword [edx], 0x44
pop ebx
pop ecx
ret
Function at 0x1001f400
Capabilities:
Create pipe
Create process on windows
Create two anonymous pipes

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
xor ebp, ebp
mov esi, ecx
push 0xfffffffffffffff5
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], ebp
mov dword [esp + 0x28], 0xc
mov dword [esp + 0x30], 1
mov dword [esp + 0x2c], ebp
call edi
mov dword [esp + 0x20], eax
lea eax, [esp + 0x24]
lea ebx, [esi + 0x60]
push ebp
push eax
lea ecx, [esi + 0x5c]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x1001f535
mov edx, dword [ebx]
mov ebp, dword [sym.imp.KERNEL32.dll_SetStdHandle]
push edx
push 0xfffffffffffffff5
call ebp
test eax, eax
je 0x1001f535
push 0xfffffffffffffff4
call edi
mov dword [esp + 0x10], eax
mov eax, dword [ebx]
push eax
push 0xfffffffffffffff4
call ebp
test eax, eax
je 0x1001f535
push 0xfffffffffffffff6
call edi
lea ecx, [esp + 0x24]
lea edi, [esi + 0x58]
push 0
lea ebp, [esi + 0x54]
push ecx
push edi
push ebp
mov dword [esp + 0x2c], eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x1001f524
mov edx, dword [ebp]
push edx
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
test eax, eax
je 0x1001f524
push 2
push 0
lea eax, [esp + 0x20]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, dword [edi]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x1001f524
mov edx, dword [edi]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esi + 0x10]
mov eax, dword [esp + 0x18]
mov ecx, dword [ebp]
mov ebx, dword [ebx]
push esi
push edx
push 0
push 0
push 0
push 1
push 0
push 0
push str.cmd.exe
push 0
mov dword [edi], eax
mov dword [esi + 0x3c], 0x101
mov dword [esi + 0x48], ecx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov word [esi + 0x40], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x1001f535
push eax
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
mov eax, dword [esp + 0x20]
test eax, eax
je 0x1001f546
push eax
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1001f557
push eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x1001f569
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x20
ret
mov ecx, esi
call fcn.1001f350
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x20
ret
Function at 0x10028890
Capabilities:
Encode data using base64

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x100289df
mov ecx, dword [esp + 0xc]
test ecx, ecx
jbe 0x100289df
mov eax, 0xaaaaaaab
push ebp
mul ecx
shr edx, 1
mov eax, dword [esp + 0x14]
lea edx, [edx + edx*2]
lea ebp, [edx + esi]
cmp esi, ebp
je 0x1002895f
mov ecx, dword [0x10032f84]
push ebx
push edi
xor edi, edi
test ecx, ecx
jbe 0x10028943
cmp esi, ebp
je 0x1002893f
xor ecx, ecx
xor ebx, ebx
mov cl, byte [esi]
mov bl, byte [esi + 1]
inc esi
add edi, 4
shl ecx, 8
or ecx, ebx
inc esi
xor ebx, ebx
add eax, 4
mov bl, byte [esi]
shl ecx, 8
or ecx, ebx
inc esi
mov ebx, ecx
and ebx, 0x3f
shr ecx, 6
mov bl, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax - 1], bl
mov ebx, ecx
and ebx, 0x3f
shr ecx, 6
mov bl, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax - 2], bl
mov ebx, ecx
and ebx, 0x3f
shr ecx, 6
mov bl, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax - 3], bl
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax - 4], cl
mov ecx, dword [0x10032f84]
cmp edi, ecx
jb 0x100288d3
jmp 0x10028943
cmp edi, ecx
jb 0x10028951
mov byte [eax], 0xd
inc eax
mov byte [eax], 0xa
mov ecx, dword [0x10032f84]
inc eax
cmp esi, ebp
jne 0x100288cd
mov ecx, dword [esp + 0x18]
pop edi
pop ebx
sub ecx, edx
pop ebp
dec ecx
je 0x100289ac
dec ecx
jne 0x100289d7
xor ecx, ecx
add eax, 4
mov ch, byte [esi]
mov cl, byte [esi + 1]
pop esi
shl ecx, 2
mov edx, ecx
and edx, 0x3f
shr ecx, 6
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax - 2], dl
mov edx, ecx
and edx, 0x3f
shr ecx, 6
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax - 3], dl
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax - 4], cl
mov ecx, dword [esp + 0xc]
mov byte [eax - 1], 0x3d
sub eax, ecx
ret
xor ecx, ecx
mov cl, byte [esi]
shl ecx, 4
mov edx, ecx
and edx, 0x3f
shr ecx, 6
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 1], dl
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax], cl
mov cl, 0x3d
mov byte [eax + 2], cl
mov byte [eax + 3], cl
add eax, 4
mov ecx, dword [esp + 0x10]
pop esi
sub eax, ecx
ret
xor eax, eax
pop esi
ret
Function at 0x409961
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x417344]
jne 0x40996b
repz ret
jmp fcn.0040e40c

Function at 0x41263c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x417344]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040c202
and dword [ebp - 0x14], 0
cmp dword [0x46830c], 0
mov dword [ebp - 0x18], eax
jne 0x4126ef
push 0x403754
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x412797
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403748
push ebx
call edi
test eax, eax
je 0x412797
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403738
push ebx
mov dword [0x46830c], eax
call edi
push eax
call esi
push 0x403724
push ebx
mov dword [0x468310], eax
call edi
push eax
call esi
push 0x403708
push ebx
mov dword [0x468314], eax
call edi
push eax
call esi
mov dword [0x46831c], eax
test eax, eax
je 0x4126ef
push 0x4036f0
push ebx
call edi
push eax
call esi
mov dword [0x468318], eax
mov eax, dword [0x468318]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x412748
cmp dword [0x46831c], ecx
je 0x412748
push eax
call esi
push dword [0x46831c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x412748
test ebx, ebx
je 0x412748
call edi
test eax, eax
je 0x41273f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41273f
test byte [ebp - 8], 1
jne 0x412748
or dword [ebp + 0x10], 0x200000
jmp 0x41277b
mov eax, dword [0x468310]
cmp eax, dword [ebp - 0x18]
je 0x41277b
push eax
call esi
test eax, eax
je 0x41277b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41277b
mov eax, dword [0x468314]
cmp eax, dword [ebp - 0x18]
je 0x41277b
push eax
call esi
test eax, eax
je 0x41277b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x46830c]
call esi
test eax, eax
je 0x412797
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x412799
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409961
leave
ret
Function at 0x4145d0
Capabilities:
Delete directory
Delete file
Get disk information
Read .ini file

Disassembly:
mov eax, 0x1400
call fcn.00413c10
cmp dword [0x808464], 0x37
jne 0x414653
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x403f58
call edi
push 0
lea eax, [esp + 0x808]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x40401c
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [esp + 4]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetTapePosition]
push 0x404048
call edi
push 0
lea edx, [esp + 0xc08]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
pop edi
mov eax, dword [0x809048]
mov edx, dword [0x8054c4]
mov cl, byte [eax + esi + 0x38d6]
mov byte [edx + esi], cl
add esp, 0x1400
ret
Function at 0x401087
Capabilities:
Create process on windows

Disassembly:
jmp 0x4022d0
sub esp, 0x54
push esi
push edi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x18]
mov esi, dword [esp + 0x60]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
lea ecx, [esp + 0x18]
push eax
push ecx
push 0
push 0
push 0x20
push 0
push 0
push 0
push 0
push esi
mov dword [esp + 0x40], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, dword [esp + 0x64]
test eax, eax
jne 0x40232c
mov edx, dword [esp + 8]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.MSVCRT.dll__unlink]
add esp, 4
pop edi
pop esi
add esp, 0x54
ret
Function at 0x404670
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x40482c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4046d1
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x404848
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x404743
xor eax, eax
push ebp
push 0x40473c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
call fcn.004044c8
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x404725
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x404868
mov eax, dword [ebp - 8]
push eax
jmp 0x45f45f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404743
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
jmp 0x462009

Function at 0x405900
Capabilities:
Get thread local storage value

Disassembly:
mov cl, byte [0x4104c8]
mov eax, dword [0x4104cc]
test cl, cl
jne 0x405938
mov edx, dword fs:[0x2c]
mov eax, dword [edx + eax*4]
ret
jmp fcn.0045d94f
push eax
call sub.kernel32.dll_TlsGetValue
test eax, eax
je 0x40591b
ret

Function at 0x406c58
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 0
lea eax, [esp + 4]
push eax
push edi
push esi
push ebx
call sub.kernel32.dll_ReadFile_1
test eax, eax
jne 0x406c7c
jmp fcn.0045d668
mov eax, dword [esp]
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40771c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x407755
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
jmp fcn.00459917
mov eax, ebx
mov edx, esi
call fcn.004033e4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x403050
Capabilities:
Delete file
Enumerate gui resources

Disassembly:
mov eax, dword [0x498f3c]
mov ecx, dword [0x495e48]
sub esp, 0xc2c
push ebx
push ebp
shr eax, 3
push esi
push edi
test eax, eax
jbe 0x403143
mov esi, dword [sym.imp.KERNEL32.dll_SetConsoleMode]
mov edi, dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
cmp dword [0x498f3c], 0x959
jne 0x403129
push 0
push 0
call esi
push 0
lea eax, [esp + 0x43c]
push eax
push 0
call edi
push 0
push 0
call ebx
push 0
call ebp
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExW]
lea ecx, [esp + 0x1c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
push 0
push 0
lea edx, [esp + 0x40]
push edx
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommState]
push 0
push 0x402b70
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov eax, dword [esp + 0x14]
push eax
call fcn.00402e90
add dword [esp + 0x14], 8
sub dword [esp + 0x18], 1
jne 0x403090
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc2c
ret
Function at 0x4039c0
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x42a368
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
xor ebx, ebx
cmp dword [0x498f3c], 0x84
jne 0x403a4c
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push ebx
call dword [sym.imp.KERNEL32.dll_InterlockedFlushSList]
push ebx
call dword [sym.imp.KERNEL32.dll_AddAtomW]
mov dword [esp + 0x1c], 0xf
mov dword [esp + 0x18], ebx
mov byte [esp + 8], bl
push ebx
mov dword [esp + 0x2c], ebx
call fcn.00403d13
push ebx
push ebx
call fcn.00403da1
add esp, 0xc
mov dword [esp + 0x28], 0xffffffff
cmp dword [esp + 0x1c], 0x10
jb 0x403a3c
mov eax, dword [esp + 8]
push eax
call fcn.00403f88
add esp, 4
mov dword [esp + 0x1c], 0xf
mov dword [esp + 0x18], ebx
mov byte [esp + 8], bl
cmp byte [0x42edf0], bl
jle 0x403a5c
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ecx, dword [0x42e0d4]
mov edx, dword [0x42e0a8]
mov dword [0x498f3c], ecx
mov dword [0x4998dc], edx
call fcn.00403190
mov ecx, dword [esp + 0x20]
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret 0x10

Function at 0x405610
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42c118]
jne 0x40561a
repz ret
jmp fcn.00409be2