joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4366b0
Capabilities:
Check os version
Create process on windows
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b4
mov eax, dword [0x46d020]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x1b0]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x12c], 0x11c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp + 0x10], 0
je 0x436798
cmp dword [ebp - 0x128], 5
jbe 0x436798
call fcn.004372c0
lea ecx, [ebp - 0x130]
push ecx
push eax
call dword [sym.imp.WTSAPI32.dll_WTSQueryUserToken]
push 0x44
lea eax, [ebp - 0x18c]
push 0
push eax
call fcn.0043be20
add esp, 0xc
mov dword [ebp - 0x18c], 0x44
lea eax, [ebp - 0x140]
mov dword [ebp - 0x184], str.winsta0default
xor esi, esi
push eax
lea eax, [ebp - 0x18c]
push eax
push esi
push esi
push 0x20
push esi
push esi
push esi
push esi
push edi
push dword [ebp - 0x130]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
test eax, eax
jne 0x43676e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ecx, dword [ebp - 0x130]
test ecx, ecx
je 0x43677f
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
test esi, esi
sete al
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00439fce
mov esp, ebp
pop ebp
ret 0xc
push ecx
lea eax, [ebp - 0x130]
push eax
call fcn.00437150
test eax, eax
jne 0x4367bb
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00439fce
mov esp, ebp
pop ebp
ret 0xc
push 0x44
lea eax, [ebp - 0x18c]
push 0
push eax
call fcn.0043be20
add esp, 0xc
mov dword [ebp - 0x18c], 0x44
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x18c]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
push 0
push edi
push dword [ebp - 0x130]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
mov ecx, dword [ebp - 0x130]
mov esi, eax
test ecx, ecx
je 0x436814
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00439fce
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4368e0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x46d020]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
push 2
mov dword [ebp - 0x234], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x436970
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x436970
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Process32NextW]
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIW]
lea esp, [esp]
push str.KMRCM.exe
lea eax, [ebp - 0x20c]
push eax
call edi
test eax, eax
jne 0x436962
lea eax, [ebp - 0x230]
push eax
push esi
call ebx
test eax, eax
jne 0x436940
jmp 0x43696e
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x234], eax
pop edi
pop ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x234]
xor ecx, ebp
pop esi
call fcn.00439fce
mov esp, ebp
pop ebp
ret
Function at 0x436aa0
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 0x1c]
sub esp, 8
xor edx, edx
push ebx
push esi
push edi
test eax, eax
jle 0x436ba2
mov ebx, dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
nop
dec eax
push ebx
mov dword [ebp - 4], eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x436ad2
push ebx
call esi
call fcn.00401100
mov esi, eax
test esi, esi
je 0x436bad
push 0x463170
push ebx
call fcn.0043b567
push dword [ebp + 0xc]
mov ebx, eax
push 0x2712
push esi
call fcn.00401140
push 0x436640
push 0x4e2b
push esi
call fcn.00401140
push ebx
push 0x2711
push esi
call fcn.00401140
push 1
push 0x63
push esi
call fcn.00401140
push 0x1d4c0
push 0x9c
push esi
call fcn.00401140
add esp, 0x44
push 0x1d4c0
push 0x9b
push esi
call fcn.00401140
push 1
push 0x4b
push esi
call fcn.00401140
push 1
push 0x34
push esi
call fcn.00401140
push 5
push 0x44
push esi
call fcn.00401140
push esi
call fcn.00401340
push esi
mov edi, eax
call fcn.00401360
push ebx
call fcn.0043ba66
xor edx, edx
add esp, 0x3c
test edi, edi
sete dl
mov dword [ebp - 8], edx
test edx, edx
jne 0x436ba2
mov ebx, dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
call esi
mov eax, dword [ebp - 4]
test eax, eax
jg 0x436ac0
mov edx, dword [ebp - 8]
pop edi
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x436f80
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x453680
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x46d020]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edx, esi
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x436fb0
sub edx, ecx
cmp edx, 1
jae 0x436fc5
xor eax, eax
jmp 0x437133
cmp byte [esi], 0
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
jne 0x436fe0
xor ecx, ecx
jmp 0x436fee
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x436fe5
sub ecx, edx
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.00438b70
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
mov eax, dword [ebp - 0x18]
push 1
dec eax
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00438610
mov ecx, eax
cmp dword [ecx + 0x14], 0x10
mov esi, dword [ecx + 0x10]
jb 0x43701f
mov ecx, dword [ecx]
mov eax, 1
cmp esi, eax
cmovb eax, esi
push eax
call fcn.00435e30
add esp, 4
test eax, eax
jne 0x43704a
cmp esi, 1
jae 0x437040
or eax, 0xffffffff
jmp 0x437048
xor eax, eax
cmp esi, 1
setne al
test eax, eax
sete al
mov byte [ebp - 4], 0
cmp dword [ebp - 0x2c], 0x10
mov byte [ebp - 0x41], al
jb 0x437068
push dword [ebp - 0x40]
call fcn.0043a7c5
mov al, byte [ebp - 0x41]
add esp, 4
test al, al
je 0x437099
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x28]
dec eax
push eax
push 0
lea eax, [ebp - 0x40]
push eax
call fcn.00438610
push eax
lea ecx, [ebp - 0x28]
call fcn.00438430
cmp dword [ebp - 0x2c], 0x10
jb 0x437099
push dword [ebp - 0x40]
call fcn.0043a7c5
add esp, 4
push ecx
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x40]
call fcn.00439350
add esp, 4
lea ecx, [ebp - 0x28]
push eax
call fcn.00438430
cmp dword [ebp - 0x2c], 0x10
jb 0x4370c2
push dword [ebp - 0x40]
call fcn.0043a7c5
add esp, 4
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
xorps xmm0, xmm0
mov dword [ebp - 0x4c], 0
cmovae eax, dword [ebp - 0x28]
movdqu xmmword [ebp - 0x64], xmm0
mov dword [ebp - 0x5c], eax
mov eax, 0x614
movq qword [ebp - 0x54], xmm0
mov word [ebp - 0x54], ax
lea eax, [ebp - 0x64]
mov word [ebp - 0x48], 0
push eax
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 3
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x4a], 0
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
mov esi, eax
neg esi
sbb esi, esi
cmp dword [ebp - 0x14], 0x10
jb 0x437130
push dword [ebp - 0x28]
call fcn.0043a7c5
add esp, 4
lea eax, [esi + 1]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00439fce
mov esp, ebp
pop ebp
ret
Function at 0x437150
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x46d020]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x228
mov dword [ebp - 0x240], eax
lea eax, [ebp - 0x234]
push 0
push eax
mov dword [ebp - 0x238], 0
call fcn.0043be20
add esp, 0xc
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4371b5
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00439fce
mov esp, ebp
pop ebp
ret 8
mov dword [ebp - 0x238], 0x22c
call fcn.004372c0
mov ebx, eax
lea eax, [ebp - 0x238]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x437298
lea esp, [esp]
push str.EXPLORER.EXE
call fcn.0043b913
add esp, 4
mov esi, eax
lea eax, [ebp - 0x214]
push eax
call fcn.0043b913
add esp, 4
mov edi, edi
mov cx, word [eax]
cmp cx, word [esi]
jne 0x437226
test cx, cx
je 0x437222
mov cx, word [eax + 2]
cmp cx, word [esi + 2]
jne 0x437226
add eax, 4
add esi, 4
test cx, cx
jne 0x437200
xor eax, eax
jmp 0x43722b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x437254
mov dword [ebp - 0x23c], eax
lea eax, [ebp - 0x23c]
push eax
push dword [ebp - 0x230]
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x437254
cmp ebx, dword [ebp - 0x23c]
je 0x43726f
lea eax, [ebp - 0x238]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x4371e0
lea esi, [eax + 1]
jmp 0x43729a
push dword [ebp - 0x230]
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push dword [ebp - 0x240]
push 0xf01ff
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov esi, eax
jmp 0x43729a
xor esi, esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00439fce
mov esp, ebp
pop ebp
ret 8
Function at 0x439810
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x46d020]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push str.KM_WATCH_SINGLE_APP
mov esi, ecx
push 0
push 0
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi], eax
test eax, eax
jne 0x439849
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x439866
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0
push 2
mov ebx, eax
mov dword [ebp - 0x234], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x4398ec
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x4398ec
jmp 0x4398b0
push str.KMWATCH.exe
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x4398ce
cmp ebx, dword [ebp - 0x228]
jne 0x4398e2
lea eax, [ebp - 0x230]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x4398b0
jmp 0x4398ec
mov dword [ebp - 0x234], 1
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
cmp dword [ebp - 0x234], 0
je 0x43990f
mov eax, dword [esi]
test eax, eax
je 0x439907
push eax
call edi
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop ebx
xor ecx, ebp
pop esi
call fcn.00439fce
mov esp, ebp
pop ebp
ret 8
Function at 0x439cb0
Capabilities:
Create service
Modify service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x46d020]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xf003f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
test edi, edi
je 0x439d06
push 1
push 0x463468
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
test eax, eax
je 0x439cfb
push eax
mov ebx, 1
call esi
push edi
call esi
test ebx, ebx
jne 0x439dc0
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
xor eax, eax
test edi, edi
je 0x439dc5
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.0043be20
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
push 0
push 0x463080
push 0
push 0
lea eax, [ebp - 0x20c]
push eax
push 1
push 2
push 0x110
push 0xf01ff
push 0x463468
push 0x463468
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov ebx, eax
test ebx, ebx
jne 0x439da0
push edi
call esi
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00439fce
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0x463478
push eax
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
push ebx
call esi
push edi
call esi
mov eax, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00439fce
mov esp, ebp
pop ebp
ret
Function at 0x439de0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14c
mov eax, dword [0x46d020]
xor eax, esp
mov dword [esp + 0x148], eax
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
test esi, esi
je 0x439e9b
mov ecx, esi
lea edx, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x439e10
sub ecx, edx
je 0x439e9b
push str.installSvr_notRun
push esi
call fcn.0043bb16
add esp, 8
test eax, eax
jne 0x439e70
call fcn.00439cb0
test eax, eax
jne 0x439e57
call fcn.00439bd0
test eax, eax
jne 0x439e57
push 0
push 0x4634ac
push 0x4634b8
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [esp + 0x154]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00439fce
mov esp, ebp
pop ebp
ret 0x10
push str.installSvr
push esi
call fcn.0043bb16
add esp, 8
test eax, eax
jne 0x439e57
call fcn.00439cb0
test eax, eax
jne 0x439e94
call fcn.00439bd0
test eax, eax
je 0x439e43
call fcn.00439c20
jmp 0x439e57
lea eax, [esp + 0x38]
mov dword [esp + 0x38], 0x463468
push eax
mov dword [esp + 0x40], 0x439990
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
test eax, eax
jne 0x439e57
sub esp, 8
lea ecx, [esp + 0x14]
call fcn.00439810
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x10], vtable.CKMWatcher.0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0xbb8
mov dword [esp + 0x24], 0x927c0
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, eax
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], 0x14
mov dword [esp + 0x30], 5
lea ebx, [ebx]
call fcn.004372c0
mov ecx, str.______________________SessionIdAlive_________________________
call fcn.004361f0
call fcn.004368e0
test eax, eax
jne 0x439f9c
push 0x103
push eax
mov byte [esp + 0x50], al
lea eax, [esp + 0x51]
push eax
call fcn.0043be20
add esp, 0xc
lea eax, [esp + 0x48]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push str...KMRCMKMRCM.exe
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
push 0
push ecx
lea eax, [esp + 0x50]
push eax
call fcn.004366b0
mov eax, dword [esp + 0x20]
lea eax, [eax + eax*2]
push eax
call ebx
mov esi, dword [esp + 0x28]
call edi
sub eax, esi
cmp eax, dword [esp + 0x24]
jb 0x439fb8
push ecx
lea ecx, [esp + 0x14]
call fcn.00437510
call edi
mov esi, eax
mov dword [esp + 0x28], esi
mov ecx, str.______________________endWork_________________________
call fcn.004361f0
push 0x3e8
call ebx
jmp 0x439f30
Function at 0x449e9f
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x46d020]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00441d29
mov dword [ebp - 0x14], eax
cmp dword [0x46f3f8], esi
jne 0x449f92
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x449f1f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x44a072
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x44a072
push 0x45d658
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x44a072
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x46f3f8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x46f3fc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x46f400], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x46f408], eax
test eax, eax
je 0x449f8f
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x46f404], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x449fb7
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x449faa
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x449fcc
push 4
pop eax
jmp 0x44a074
cmp dword [ebp - 0x14], esi
je 0x449fcc
push dword [0x46f3f8]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x449fb1
mov eax, dword [0x46f404]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x44a02a
cmp dword [0x46f408], edi
je 0x44a02a
push eax
call ebx
push dword [0x46f408]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x44a02a
test eax, eax
je 0x44a02a
call ecx
test eax, eax
je 0x44a01f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x44a01f
test byte [ebp - 8], 1
jne 0x44a02a
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x44a05a
mov eax, dword [0x46f3fc]
cmp eax, edi
je 0x44a057
push eax
call ebx
test eax, eax
je 0x44a057
call eax
mov esi, eax
test esi, esi
je 0x44a057
mov eax, dword [0x46f400]
cmp eax, edi
je 0x44a057
push eax
call ebx
test eax, eax
je 0x44a057
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x46f3f8]
call ebx
test eax, eax
je 0x44a072
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x44a074
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00439fce
mov esp, ebp
pop ebp
ret
Function at 0x92fdc0
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x92fdc6
pop ebp
sub ebp, 6
sub ebp, 0x52fdc0
jmp 0x92fe24
jmp 0x92fe2d
mov eax, 0x52fdc0
add eax, ebp
add eax, 0x93
mov ecx, 0x621
push edx
add byte [ebx], al
lds eax, [ecx + 0x93c0]
add byte [ecx + 0x621], bh
mov edx, 0xc31201cd
xor byte [eax], dl
inc eax
dec ecx
jne 0x92fe44
jmp 0x92fe57
cmpsd dword [esi], dword es:[edi]
lea esp, [ebp - 0x32322233]
movsd dword es:[edi], dword [esi]
int 1
loope 0x92fe30
dec byte [0xb558329d]
mov word [ebp + ecx*8 + 0x4600469d], es
inc esp
int1
int 0xcd
int 0x4c
or al, 0x35
int 0xcd
int 0xce
add byte [ebp - 0x35], dh
int 0xcd
int 0x77
in eax, 0xcd
int 0xcd
cmp ch, byte [edi]
into
add eax, 0xcdc14c46
int 0xcd
into
or byte [ebp - 0x3b00df5b], bl
int 0xa5
push ds
pop es
test ch, cl
int3
Function at 0x40d7a0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x497ecb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0048cb38
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40d822
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0048aa12
mov eax, dword [eax]
push 0x4b5c84
push eax
call fcn.0047cbc4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0048cdc3
test bl, bl
je 0x40d822
push 0x4b5c84
lea ecx, [esp + 0xc]
call fcn.0048d153
push 0x4b5c90
lea ecx, [esp + 0xc]
call fcn.0048d153
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40d85e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0048cdc3
jmp 0x40d929
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40d8e2
lea edx, [esp + 0x7c]
push 0x4b5c8c
push edx
call fcn.0047cbc4
add esp, 8
test eax, eax
je 0x40d8e2
lea eax, [esp + 0x7c]
push 0x4b5c88
push eax
call fcn.0047cbc4
add esp, 8
test eax, eax
je 0x40d8e2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40d872
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0048cdc3
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40e130
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40e192
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x40e1a0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x497f4b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x4c5010]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x40e2d8
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x40e206
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0048cdc3
xor eax, eax
jmp 0x40e34f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0048cf00
push esi
lea ecx, [esp + 0xc]
call fcn.0048d18f
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x40e32d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push accept
call fcn.0040e130
test eax, eax
jne 0x40e32d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push accept
mov ecx, edi
call fcn.0040e130
test eax, eax
jne 0x40e32d
lea eax, [esp + 0x14]
push 0x4b5ca0
push eax
call fcn.0047dc60
mov esi, eax
add esp, 8
test esi, esi
jne 0x40e30c
lea ecx, [esp + 0x14]
push 0x4b5c9c
push ecx
call fcn.0047dbe0
mov esi, eax
add esp, 8
test esi, esi
jne 0x40e30c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x40e30f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0048ceb0
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x40e21e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0048cdc3
xor eax, eax
jmp 0x40e34f
mov byte [esi], 0
push 0x4b5c98
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0048cdc3
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4