joyce8/EMBER2024-capa huggingface dataset:
Function at 0x619011ad
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x61931c64]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
push 0x3ff
lea eax, [ebp - 0x403]
push 0
push eax
mov dword [ebp - 0x40c], ebx
mov byte [ebp - 0x404], 0
call sub.MSVCR100.dll_memset
push edi
lea esi, [ebp - 0x404]
call sub.MSVCR100.dll_strlen
movzx eax, ax
xor ecx, ecx
add esp, 0x10
cmp cx, ax
jge 0x61901264
mov dword [ebp - 0x408], eax
mov bl, 3
call fcn.61901175
mov cl, byte [edi]
sar cl, 6
xor cl, al
and cl, bl
xor cl, al
mov byte [esi], cl
call fcn.61901175
mov cl, byte [edi]
sar cl, 4
xor cl, al
and cl, bl
xor cl, al
mov byte [esi + 1], cl
call fcn.61901175
mov cl, byte [edi]
sar cl, 2
xor cl, al
and cl, bl
xor cl, al
mov byte [esi + 2], cl
call fcn.61901175
mov cl, byte [edi]
xor cl, al
and cl, bl
xor cl, al
mov byte [esi + 3], cl
add esi, 4
inc edi
dec dword [ebp - 0x408]
jne 0x6190120a
mov ebx, dword [ebp - 0x40c]
lea eax, [ebp - 0x404]
push eax
call sub.MSVCR100.dll_strlen
pop ecx
movzx ecx, ax
xor eax, eax
inc eax
cmp ax, cx
jg 0x61901291
movsx eax, cx
lea eax, [ebp + eax - 0x405]
mov esi, ecx
mov cl, byte [eax]
mov byte [ebx], cl
inc ebx
dec eax
dec esi
jne 0x61901288
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov byte [ebx], 0
xor ecx, ebp
pop ebx
call fcn.6191eed8
leave
ret 8
Function at 0x6190541e
Capabilities:
Create http request

Disassembly:
push 0x10
mov eax, 0x6192034c
call fcn.6191eef4
mov edi, ecx
push 0x61925af8
lea ecx, [ebp - 0x1c]
call dword [sym.imp.mfc100.dll_Ordinal_310]
and dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
call dword [0x61923a48]
lea ecx, [ebp - 0x14]
call dword [0x61923a48]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.61905358
push 0
lea ecx, [ebp - 0x14]
mov esi, eax
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
push esi
lea ecx, [ebp - 0x1c]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [edi + 0x2c], eax
test eax, eax
jne 0x619054be
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea ecx, [ebp - 0x14]
call dword [0x61923a58]
lea ecx, [ebp - 0x18]
call dword [0x61923a58]
lea ecx, [ebp - 0x1c]
call dword [0x61923a58]
mov eax, esi
call fcn.6191efcc
ret
mov esi, dword [sym.imp.WININET.dll_InternetSetOptionA]
push 4
lea ecx, [ebp - 0x10]
push ecx
push 2
push eax
mov dword [ebp - 0x10], 0x1388
call esi
push 4
lea eax, [ebp - 0x10]
push eax
push 6
push dword [edi + 0x2c]
call esi
push 4
lea eax, [ebp - 0x10]
push eax
push 5
push dword [edi + 0x2c]
call esi
push 4
lea eax, [ebp - 0x10]
push eax
push 7
push dword [edi + 0x2c]
call esi
push 4
lea eax, [ebp - 0x10]
push eax
push 8
push dword [edi + 0x2c]
call esi
xor esi, esi
jmp 0x6190549b
Function at 0x61905802
Capabilities:
Connect to http server
Read data from internet
Receive data
Send data
Send http request

Disassembly:
push esi
mov esi, ecx
call fcn.6190541e
test eax, eax
je 0x61905812
xor eax, eax
pop esi
ret
mov ecx, esi
pop esi
jmp fcn.61905596

Function at 0x61905a64
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [0x61931c64]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0xa4], 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x9c
push esi
lea eax, [ebp - 0xa0]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0xa0]
mov dword [ebp - 0xa0], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push eax
call esi
test eax, eax
jne 0x61905ad1
lea eax, [ebp - 0xa0]
push eax
mov dword [ebp - 0xa0], 0x94
call esi
test eax, eax
jne 0x61905ad1
push str.ERROR
jmp 0x61905b29
mov eax, dword [ebp - 0x90]
sub eax, 0
je 0x61905b24
dec eax
je 0x61905b02
dec eax
jne 0x61905aca
cmp dword [ebp - 0x9c], 4
ja 0x61905af2
push 0x61925b74
jmp 0x61905b29
cmp dword [ebp - 0x9c], 5
jne 0x61905aca
push str.2000
jmp 0x61905b29
cmp dword [ebp - 0x9c], 4
ja 0x61905b1d
jne 0x61905b16
cmp dword [ebp - 0x98], 0
ja 0x61905b1d
push 0x61925b68
jmp 0x61905b29
push 0x61925b64
jmp 0x61905b29
push 0x61925b60
mov ecx, edi
call dword [sym.imp.mfc100.dll_Ordinal_310]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.6191eed8
leave
ret 4
Function at 0x6190628f
Capabilities:
Link many functions at runtime

Disassembly:
push 0x36c
mov eax, 0x6192048a
call fcn.6191ef5d
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x370], ecx
mov dword [ebp - 0x36c], eax
lea ecx, [ebp + 8]
mov dword [ebp - 4], 1
call dword [sym.imp.mfc100.dll_Ordinal_7322]
test al, al
je 0x619062dd
lea ecx, [ebp + 8]
call dword [0x61923a58]
lea ecx, [ebp + 0x10]
call dword [0x61923a58]
xor eax, eax
call fcn.6191efe0
ret 0xc
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
xor ebx, ebx
cmp edi, ebx
je 0x619062c1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CreateToolhelp32Snapshot
push edi
call esi
mov dword [ebp - 0x368], eax
cmp eax, ebx
je 0x619062c1
push str.Process32First
push edi
call esi
mov dword [ebp - 0x360], eax
cmp eax, ebx
je 0x619062c1
push str.Process32Next
push edi
call esi
mov dword [ebp - 0x378], eax
cmp eax, ebx
je 0x619062c1
push str.Module32First
push edi
call esi
mov dword [ebp - 0x374], eax
cmp eax, ebx
je 0x619062c1
push str.Module32Next
push edi
call esi
lea ecx, [ebp + 8]
cmp eax, ebx
je 0x619062c4
call dword [sym.imp.mfc100.dll_Ordinal_7832]
push ebx
push 2
call dword [ebp - 0x368]
mov esi, eax
cmp esi, 0xffffffff
jne 0x61906382
xor esi, esi
lea ecx, [ebp + 8]
call dword [0x61923a58]
lea ecx, [ebp + 0x10]
call dword [0x61923a58]
mov eax, esi
jmp 0x619062d5
lea eax, [ebp - 0x35c]
push eax
push esi
mov dword [ebp - 0x35c], 0x128
mov dword [ebp - 0x234], 0x224
call dword [ebp - 0x360]
test eax, eax
je 0x619064a5
lea ecx, [ebp - 0x364]
call dword [0x61923a48]
mov ecx, dword [ebp - 0x370]
lea eax, [ebp - 0x338]
push eax
mov byte [ebp - 4], 2
call fcn.61905a13
push eax
lea ecx, [ebp - 0x364]
call dword [sym.imp.mfc100.dll_Ordinal_1316]
lea ecx, [ebp - 0x364]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
lea ecx, [ebp + 8]
call dword [sym.imp.mfc100.dll_Ordinal_2617]
test eax, eax
jne 0x6190647d
push dword [ebp - 0x354]
push 8
call dword [ebp - 0x368]
lea ecx, [ebp - 0x234]
push ecx
push eax
call dword [ebp - 0x374]
mov ecx, dword [ebp - 0x36c]
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.mfc100.dll_Ordinal_1316]
popal
lea eax, [ebp + 0x10]
push eax
lea ecx, [ebp - 0x360]
call dword [sym.imp.mfc100.dll_Ordinal_300]
lea ecx, [ebp + 0x10]
mov byte [ebp - 4], 3
call dword [sym.imp.mfc100.dll_Ordinal_5207]
test eax, eax
je 0x61906469
mov ecx, dword [ebp - 0x36c]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
lea ecx, [ebp - 0x360]
call dword [sym.imp.mfc100.dll_Ordinal_2617]
test eax, eax
je 0x619064b1
xor ebx, ebx
inc ebx
test ebx, ebx
je 0x619064b1
lea ecx, [ebp - 0x360]
mov byte [ebp - 4], 2
call dword [0x61923a58]
lea eax, [ebp - 0x35c]
push eax
push esi
call dword [ebp - 0x378]
lea ecx, [ebp - 0x364]
mov edi, eax
mov byte [ebp - 4], 1
call dword [0x61923a58]
test edi, edi
jne 0x619063ac
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x61906367
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x354]
lea ecx, [ebp - 0x360]
call dword [0x61923a58]
lea ecx, [ebp - 0x364]
call dword [0x61923a58]
jmp 0x61906369
Function at 0x619064db
Capabilities:
Read .ini file

Disassembly:
push 8
mov eax, 0x619204c4
call fcn.6191eef4
lea ecx, [ebp - 0x10]
call dword [0x61923a48]
push str._systemcommsu.ini
lea eax, [ebp - 0x14]
push 0x61931de8
xor esi, esi
push eax
mov dword [ebp - 4], esi
call fcn.61902e42
add esp, 0xc
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call dword [sym.imp.mfc100.dll_Ordinal_1313]
lea ecx, [ebp - 0x14]
call dword [0x61923a58]
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
push esi
push str.VIPHTS
push str.VIPS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x61906543
inc esi
lea ecx, [ebp - 0x10]
call dword [0x61923a58]
mov eax, esi
call fcn.6191efcc
ret
Function at 0x61908334
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x61931c64]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0xa
mov dword [ebp - 0x130], str._cert
mov dword [ebp - 0x12c], str._data
mov dword [ebp - 0x128], str._help
mov dword [ebp - 0x124], str._screen
mov dword [ebp - 0x120], 0x619262d4
mov dword [ebp - 0x11c], str._image
mov dword [ebp - 0x118], str._mst
mov dword [ebp - 0x114], str._temp
mov dword [ebp - 0x110], str._user
mov dword [ebp - 0x10c], 0x619262ac
lea esi, [ebp - 0x130]
pop edi
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call sub.MSVCR100.dll_memset
push dword [esi]
lea eax, [ebp - 0x108]
push dword [0x61931de8]
push 0x61923b0c
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0x1c
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
jne 0x6190840f
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
popal
test eax, eax
jne 0x6190840f
call dword [sym.imp.KERNEL32.dll_GetLastError]
add esi, 4
dec edi
jne 0x619083b6
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.6191eed8
leave
ret
Function at 0x61909050
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push 0x150
mov eax, 0x6192093c
call fcn.6191ef5d
mov ebx, ecx
xor esi, esi
lea ecx, [ebp - 0x154]
mov dword [ebp - 4], esi
call dword [0x61923a48]
lea ecx, [ebp - 0x158]
call dword [0x61923a48]
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x158]
mov byte [ebp - 4], 2
call dword [sym.imp.mfc100.dll_Ordinal_1313]
push 0x61926474
lea ecx, [ebp - 0x158]
call dword [sym.imp.mfc100.dll_Ordinal_1483]
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x158]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x619090ef
lea ecx, [ebp - 0x158]
call dword [0x61923a58]
lea ecx, [ebp - 0x154]
call dword [0x61923a58]
lea ecx, [ebp + 8]
call dword [0x61923a58]
mov eax, esi
call fcn.6191efe0
ret 4
mov esi, dword [sym.imp.MSVCR100.dll__mbscmp]
lea eax, [ebp - 0x124]
push 0x61924c6c
push eax
call esi
pop ecx
pop ecx
test eax, eax
je 0x619091d2
lea eax, [ebp - 0x124]
push 0x61926470
push eax
call esi
pop ecx
pop ecx
test eax, eax
je 0x619091d2
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x154]
call dword [sym.imp.mfc100.dll_Ordinal_1313]
push 0x5c
lea ecx, [ebp - 0x154]
call dword [sym.imp.mfc100.dll_Ordinal_1480]
lea eax, [ebp - 0x124]
push eax
lea ecx, [ebp - 0x154]
call dword [sym.imp.mfc100.dll_Ordinal_1483]
lea ecx, [ebp - 0x154]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 1
je 0x61909184
and eax, 0xfffffffe
push eax
lea ecx, [ebp - 0x154]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test byte [ebp - 0x150], 0x10
je 0x619091bf
push ecx
lea eax, [ebp - 0x154]
mov ecx, esp
mov dword [ebp - 0x15c], esp
push eax
call dword [sym.imp.mfc100.dll_Ordinal_300]
mov ecx, ebx
call fcn.61909050
lea ecx, [ebp - 0x154]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
jmp 0x619091d2
lea ecx, [ebp - 0x154]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x150]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x619090f5
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
popal
xor esi, esi
inc esi
jmp 0x619090c4

Function at 0x61909307
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 1
push 0
push 0
lea ecx, [ebp + 8]
invalid
invalid
inc eax
invalid
invalid
Function at 0x6190c2c7
Capabilities:
Read .ini file

Disassembly:
push 0x94
mov eax, 0x6192124e
call fcn.6191ef5d
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x94]
call dword [0x61923a48]
push str._system_Comms.ini
lea eax, [ebp - 0x9c]
push 0x61931de8
xor esi, esi
push eax
mov dword [ebp - 4], esi
call fcn.61902e42
add esp, 0xc
push eax
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 1
call dword [sym.imp.mfc100.dll_Ordinal_1313]
lea ecx, [ebp - 0x9c]
call dword [0x61923a58]
lea ecx, [ebp - 0x94]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
push esi
push str.count
mov edi, 0x6192773c
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea ecx, [ebp - 0xa0]
mov dword [ebp - 0x9c], eax
call dword [0x61923a48]
mov byte [ebp - 4], 2
mov dword [ebp - 0x98], esi
cmp dword [ebp - 0x9c], esi
jle 0x6190c3e9
mov esi, 0x80
push esi
lea eax, [ebp - 0x90]
push 0
push eax
call sub.MSVCR100.dll_memset
push dword [ebp - 0x98]
lea eax, [ebp - 0xa0]
push 0x61925cb8
push eax
call dword [0x61923a4c]
add esp, 0x18
lea ecx, [ebp - 0x94]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
push esi
lea eax, [ebp - 0x90]
push eax
push 0x61923b08
lea ecx, [ebp - 0xa0]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
push edi
call dword [0x619230d4]
lea eax, [ebp - 0x90]
push eax
push dword [ebx + 8]
mov ecx, ebx
call sub.mfc100.dll_Ordinal_12096
inc dword [ebp - 0x98]
mov eax, dword [ebp - 0x98]
cmp eax, dword [ebp - 0x9c]
jl 0x6190c36c
lea ecx, [ebp - 0xa0]
call dword [0x61923a58]
lea ecx, [ebp - 0x94]
call dword [0x61923a58]
call fcn.6191efe0
ret 4
Function at 0x6190e139
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x6192174d
call fcn.6191eef4
mov ebx, ecx
push 0x38
call sub.mfc100.dll_Ordinal_1294
pop ecx
mov ecx, eax
mov dword [ebp - 0x10], ecx
xor edi, edi
mov dword [ebp - 4], edi
cmp ecx, edi
je 0x6190e17f
cmp ebx, edi
jne 0x6190e165
xor eax, eax
jmp 0x6190e168
mov eax, dword [ebx + 0x20]
push edi
push str.http:__dr.iprovest.com_provestk_signal.txt
push 1
push 0x784
push eax
call fcn.619052fb
mov esi, eax
jmp 0x6190e181
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x14]
push eax
push edi
push esi
push 0x6190581a
push edi
push edi
call dword [sym.imp.MSVCR100.dll__beginthreadex]
add esp, 0x18
mov dword [ebx + 0xd8], eax
cmp eax, edi
jne 0x6190e1b1
cmp esi, edi
je 0x6190e1b1
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
mov dword [ebx + 0xe0], esi
xor eax, eax
call fcn.6191efcc
ret

Function at 0x6190e1bf
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x6192174d
call fcn.6191eef4
mov ebx, ecx
push 0x38
call sub.mfc100.dll_Ordinal_1294
pop ecx
mov ecx, eax
mov dword [ebp - 0x10], ecx
xor edi, edi
mov dword [ebp - 4], edi
cmp ecx, edi
je 0x6190e205
cmp ebx, edi
jne 0x6190e1eb
xor eax, eax
jmp 0x6190e1ee
mov eax, dword [ebx + 0x20]
push 1
push str.https:__www.iprovest.com_wts_sise_IntroJisuKIPS2.jsp
push edi
push 0x784
push eax
call fcn.619052fb
mov esi, eax
jmp 0x6190e207
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x14]
push eax
push edi
push esi
push 0x6190581a
push edi
push edi
call dword [sym.imp.MSVCR100.dll__beginthreadex]
add esp, 0x18
mov dword [ebx + 0xd4], eax
cmp eax, edi
jne 0x6190e237
cmp esi, edi
je 0x6190e237
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
mov dword [ebx + 0xdc], esi
xor eax, eax
call fcn.6191efcc
ret
Function at 0x6190e3c5
Capabilities:
Delete file
Read .ini file

Disassembly:
push 0x128
mov eax, 0x619217ac
call fcn.6191ef5d
mov dword [ebp - 0x120], ecx
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x118]
call dword [0x61923a48]
push dword [0x61931de8]
lea eax, [ebp - 0x118]
push str._s_temp_tempnotice.ini
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call dword [0x61923a4c]
add esp, 0xc
lea ecx, [ebp - 0x134]
call sub.mfc100.dll_Ordinal_421
push ebx
push 0x1001
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 1
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
lea ecx, [ebp - 0x134]
call sub.mfc100.dll_Ordinal_10906
lea ecx, [ebp - 0x134]
test eax, eax
je 0x6190e583
push dword [ebp + 0xc]
push esi
call sub.mfc100.dll_Ordinal_13312
lea ecx, [ebp - 0x134]
call sub.mfc100.dll_Ordinal_2524
push 4
lea ecx, [ebp - 0x118]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
call dword [sym.imp.MSVCR100.dll__access]
pop ecx
pop ecx
test eax, eax
jne 0x6190e56a
lea ecx, [ebp - 0x118]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push eax
push ebx
push str.LEVEL
mov edi, str.CONFIG
push edi
call esi
cmp eax, 1
jne 0x6190e4b8
mov ecx, dword [ebp - 0x120]
call fcn.61909fb1
mov eax, dword [0x61931e30]
mov dword [0x61931e34], eax
mov dword [0x61931e30], ebx
lea ecx, [ebp - 0x118]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
push 1
push str.CONNECT
push edi
call esi
cmp eax, ebx
jne 0x6190e56a
lea ecx, [ebp - 0x118]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
push 0x190
push 0x61927a04
mov edi, str.POPUP
push edi
call esi
lea ecx, [ebp - 0x118]
mov dword [ebp - 0x11c], eax
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
push 0x258
push 0x619279f8
push edi
call esi
lea ecx, [ebp - 0x118]
mov esi, eax
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
push 0x104
lea eax, [ebp - 0x114]
push eax
push 0x619243cc
push 0x6192472c
push edi
call dword [0x619230d4]
push esi
push dword [ebp - 0x11c]
lea eax, [ebp - 0x114]
push ecx
mov ecx, esp
mov dword [ebp - 0x11c], esp
push eax
call dword [sym.imp.mfc100.dll_Ordinal_310]
mov ecx, dword [ebp - 0x120]
call fcn.61909307
lea ecx, [ebp - 0x118]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x134]
mov byte [ebp - 4], bl
call sub.mfc100.dll_Ordinal_977
lea ecx, [ebp - 0x118]
call dword [0x61923a58]
call fcn.6191efe0
ret 8
Function at 0x61911b73
Capabilities:
Delete directory

Disassembly:
push 8
mov eax, 0x619204c4
call fcn.6191eef4
mov esi, ecx
lea ecx, [ebp - 0x10]
call dword [0x61923a48]
and dword [ebp - 4], 0
push str.__system
lea eax, [ebp - 0x14]
push 0x61931de8
push eax
call fcn.61902e42
add esp, 0xc
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call dword [sym.imp.mfc100.dll_Ordinal_1313]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call dword [0x61923a58]
push ecx
lea eax, [ebp - 0x10]
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
call dword [sym.imp.mfc100.dll_Ordinal_300]
mov ecx, esi
call fcn.61909050
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ecx, esi
call fcn.61910c81
push 0
push 0x7530
push 1
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_SetTimer]
lea ecx, [ebp - 0x10]
mov dword [esi + 0x4ae8], eax
call dword [0x61923a58]
xor eax, eax
call fcn.6191efcc
ret 4
Function at 0x61917c42
Capabilities:
Parse credit card information

Disassembly:
push ebx
push esi
mov esi, ecx
mov ecx, dword [esi + 0x40]
xor al, al
mov bl, 1
cmp ecx, 0xffffffff
je 0x61917dd7
push edi
mov edi, dword [0x619231ec]
cmp ecx, 0x7c
je 0x61917dd6
cmp ecx, 0x29
jne 0x61917c89
cmp dword [esi + 0x10], 0
jne 0x61917dd6
mov eax, 0x10000000
test dword [esi + 0x44], eax
jne 0x61917c8e
push 5
call edi
pop ecx
jmp 0x61917dbf
mov eax, 0x10000000
cmp ecx, 0x2e
jne 0x61917ca9
push 5
lea ecx, [esi + 0x18]
call fcn.6190a2ed
mov ecx, esi
call fcn.619125e7
jmp 0x61917dbf
cmp ecx, 0x5c
jne 0x61917d06
mov ecx, esi
call fcn.619125e7
mov eax, dword [esi + 0x44]
and eax, 0x80
je 0x61917cdb
cmp byte [esi + 0x3e], 0x62
jne 0x61917cdb
push 4
lea ecx, [esi + 0x18]
call fcn.6190a2ed
mov ecx, esi
call fcn.619125e7
jmp 0x61917dc6
test eax, eax
je 0x61917cfa
cmp byte [esi + 0x3e], 0x42
jne 0x61917cfa
push 4
lea ecx, [esi + 0x18]
call fcn.6190a2ed
mov eax, dword [esi + 0x1c]
add eax, 8
xor dword [eax], 1
jmp 0x61917ccf
mov ecx, esi
call fcn.61916242
jmp 0x61917dbf
cmp ecx, 0x5b
jne 0x61917d2d
mov ecx, esi
call fcn.619125e7
mov ecx, esi
call fcn.61917b0f
cmp dword [esi + 0x40], 0x5d
je 0x61917c9d
push 4
call edi
pop ecx
jmp 0x61917c9d
cmp ecx, 0x28
jne 0x61917d56
mov ecx, esi
call fcn.619125e7
mov ecx, esi
call fcn.619126c6
cmp dword [esi + 0x40], 0x29
mov bl, al
je 0x61917d4d
push 5
call edi
pop ecx
mov ecx, esi
call fcn.619125e7
jmp 0x61917dbb
cmp ecx, 0x5e
jne 0x61917d62
push 2
jmp 0x61917cc7
cmp ecx, 0x24
jne 0x61917d6e
push 3
jmp 0x61917cc7
cmp ecx, 0x2a
je 0x61917db6
cmp ecx, 0x2b
je 0x61917db6
cmp ecx, 0x3f
je 0x61917db6
cmp ecx, 0x7b
je 0x61917db6
cmp ecx, 0x7d
jne 0x61917d93
test dword [esi + 0x44], eax
jne 0x61917d93
push 6
jmp 0x61917c81
cmp ecx, 0x5d
jne 0x61917da4
test dword [esi + 0x44], eax
jne 0x61917da4
push 4
jmp 0x61917c81
movzx eax, byte [esi + 0x3e]
push eax
lea ecx, [esi + 0x18]
call fcn.61915ac9
jmp 0x61917c9d
push 0xa
call edi
pop ecx
test bl, bl
je 0x61917dc6
mov ecx, esi
call fcn.619162d7
mov ecx, dword [esi + 0x40]
mov al, 1
mov bl, al
cmp ecx, 0xffffffff
jne 0x61917c5d
pop edi
pop esi
pop ebx
ret

Function at 0x61918faa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x61931c64]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x8c], 0
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x88]
push eax
push 0xf003f
push 0
push str.CLSIDFC035099_833E_4AB1_BF48_37D08F5E553CInprocServer32
push Ordinal_1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, 0x61923b08
test eax, eax
jne 0x61919054
mov eax, 0x80
push eax
mov dword [ebp - 0x90], eax
lea eax, [ebp - 0x84]
push 0
push eax
mov dword [ebp - 0x8c], 1
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x8c]
push eax
push 0
push esi
push dword [ebp - 0x88]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x61919048
lea eax, [ebp - 0x84]
push eax
jmp 0x61919055
push dword [ebp - 0x88]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
mov ecx, edi
invalid
invalid
invalid
invalid
invalid
Function at 0x6191b7dc
Capabilities:
Log keystrokes via application hook

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0xa8], 0
jne 0x6191b803
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0
lea eax, [esi + 0x74]
push eax
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [esi + 0xa8], eax
pop esi
ret
Function at 0x6191eed8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x61931c64]
jne 0x6191eee2
repz ret
jmp fcn.6191f6c6

Function at 0x6193a4b0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x6193a5bc
test eax, eax
je 0x6193a5bc
push esi
push edi
mov ecx, 0x10
mov esi, 0x61955008
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x6193a5a3
lea edi, [eax + 4]
jmp 0x6193a507
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x6193a51c
mov dword [ebp - 4], 2
jmp 0x6193a53d
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x6193a533
mov dword [ebp - 4], 1
jmp 0x6193a53d
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x6193a5b3
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x6193a576
mov byte [ecx], 0x3d
jmp 0x6193a582
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x6193a58d
mov byte [ecx], 0x3d
jmp 0x6193a593
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x6193a504
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret