joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44e07c
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Get file size
Read file on windows
Set file attributes

Disassembly:
sub esp, 8
mov byte [esp + 3], 1
xor eax, eax
lea ebx, [ebx]
mov cl, byte [eax + 0x45c2e4]
mov byte [eax + 0x45bddc], cl
inc eax
test cl, cl
jne 0x44e08c
mov eax, 0x45bddc
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x44e0a3
mov ecx, dword [0x45840c]
mov dl, byte [0x458410]
push ebp
mov dword [eax], ecx
push 0x45bddc
mov byte [eax + 4], dl
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebp, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov dword [0x45bee0], eax
cmp eax, 0xffffffff
je 0x44e0f3
test al, 0x10
jne 0x44e10b
push 0x80
push 0x45bddc
call ebp
push 0x45bddc
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0x45bddc
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x44e10b
xor al, al
pop ebp
add esp, 8
ret
mov eax, 0x45bddc
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x44e111
mov ecx, dword [0x4583fc]
mov edx, dword [0x458400]
mov dword [eax], ecx
mov ecx, dword [0x458404]
push esi
mov dword [eax + 4], edx
mov dl, byte [0x458408]
push edi
mov dword [eax + 8], ecx
push 0x24
mov byte [eax + 0xc], dl
call fcn.00450b01
push 0x24
mov dword [0x45c4f0], eax
call fcn.00450b01
mov edi, dword [esp + 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileA]
add esp, 8
push 0
push 0x80000087
push 3
push 0
push 1
push closesocket
push edi
mov dword [0x45c4f4], eax
call esi
mov ecx, dword [0x45c4f0]
mov dword [ecx + 4], eax
mov edx, dword [0x45c4f0]
cmp dword [edx + 4], 0xffffffff
je 0x44e1d3
push 0x80
push 0x45bddc
call ebp
push 0
push 0x80000087
push 2
push 0
push 3
push 0xc0000000
push 0x45bddc
call esi
mov ecx, dword [0x45c4f4]
mov dword [ecx + 4], eax
mov edx, dword [0x45c4f4]
cmp dword [edx + 4], 0xffffffff
jne 0x44e1dc
push 0x87
push 0x45bddc
call ebp
pop edi
pop esi
xor al, al
pop ebp
add esp, 8
ret
mov eax, dword [0x45c4f0]
mov ecx, dword [eax + 4]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [0x45c4f0]
mov dword [edx], eax
mov eax, dword [0x45c4f0]
mov ecx, dword [eax]
push ecx
call fcn.0044d50c
mov edx, dword [0x45c4f0]
mov dword [edx + 0xc], eax
mov ecx, dword [0x45c4f0]
mov eax, dword [ecx + 0xc]
add esp, 4
test eax, eax
je 0x44e261
push 0
lea edx, [esp + 0x14]
push edx
mov edx, dword [ecx]
push edx
push eax
mov eax, dword [ecx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
call fcn.0044de3c
test al, al
jne 0x44e255
call fcn.0044e03c
test al, al
je 0x44e25c
push edi
push 0x4583f4
push 0x4583b4
call fcn.0044ec8c
add esp, 0xc
mov byte [esp + 0xf], 1
jmp 0x44e261
mov byte [esp + 0xf], 0
mov ecx, dword [0x45c4f0]
mov edx, dword [ecx + 0xc]
push edx
call fcn.0044d53c
mov ecx, dword [0x45c4f0]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ecx + 0xc], eax
mov edx, dword [0x45c4f0]
mov eax, dword [edx + 4]
add esp, 4
push eax
call esi
mov ecx, dword [0x45c4f4]
mov edx, dword [ecx + 4]
push edx
call esi
push 0x87
push 0x45bddc
call ebp
mov al, byte [esp + 0xf]
pop edi
pop esi
pop ebp
add esp, 8
ret
Function at 0x44e2bc
Capabilities:
Set registry value

Disassembly:
push ecx
mov ecx, dword [esp + 8]
push 0
lea eax, [esp + 4]
push eax
push 0
push 0xf003f
push 1
push 0
push 0
push ecx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x44e30d
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
push edx
mov edx, dword [esp + 4]
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ecx
ret
Function at 0x44e94c
Capabilities:
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
sub esp, 0x548
mov eax, dword [0x45b0fc]
xor eax, esp
mov dword [esp + 0x544], eax
push ebx
push esi
push edi
push 0x3ff
lea eax, [esp + 0x155]
push 0
push eax
mov byte [esp + 0x15c], 0
call fcn.0045086c
mov ebx, dword [esp + 0x564]
lea edx, [esp + 0x15c]
add esp, 0xc
mov esi, 1
mov eax, ebx
sub edx, ebx
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x44e99c
lea edi, [esp + 0x150]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x44e9ae
mov ecx, dword [0x458418]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x154]
push eax
mov dword [edi], ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [esp + 0xc], eax
cmp eax, 0xffffffff
je 0x44eb48
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea esp, [esp]
test esi, esi
je 0x44eb47
mov edx, 0x45bee4
mov eax, ebx
sub edx, ebx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x44e9fd
lea eax, [esp + 0x40]
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x44ea0d
mov edi, 0x45bee4
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x44ea1e
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 0x14]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [0x45bee0], eax
test al, 0x10
je 0x44ead7
cmp byte [esp + 0x40], 0x2e
mov al, byte [esp + 0x41]
jne 0x44ea58
test al, al
je 0x44eb30
cmp al, 0x2e
jne 0x44ea67
cmp byte [esp + 0x42], 0
je 0x44eb30
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
jmp 0x44ea7c
mov cl, byte [eax + 0x45bee4]
mov byte [esp + eax + 0x154], cl
inc eax
test cl, cl
jne 0x44ea7c
lea ecx, [esp + 0x154]
push 0x45c3ec
push ecx
call fcn.00450818
add esp, 8
test eax, eax
je 0x44eb30
lea edi, [esp + 0x154]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x44eab3
mov dx, word [0x458414]
lea eax, [esp + 0x154]
push eax
mov word [edi], dx
call fcn.0044e94c
add esp, 4
jmp 0x44eb30
call fcn.0044e8dc
mov ecx, dword [0x45c4f0]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [0x45c4f0]
mov ecx, dword [eax + 8]
push ecx
call ebp
mov edx, dword [0x45c4f0]
mov eax, dword [edx + 4]
push eax
call ebp
mov ecx, dword [0x45c4f4]
mov edx, dword [ecx + 0xc]
push edx
call fcn.0044d53c
mov ecx, dword [0x45c4f4]
add esp, 4
mov dword [ecx + 0xc], eax
mov edx, dword [0x45bee0]
push edx
push 0x45bee4
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov esi, eax
jmp 0x44e9ec
pop ebp
mov ecx, dword [esp + 0x550]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00450674
add esp, 0x548
ret
Function at 0x44ec0c
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0xc
push edi
lea eax, [esp + 4]
push eax
push ecx
push closesocket
mov edi, 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x44ec35
xor eax, eax
pop edi
add esp, 0xc
ret
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], edi
mov dword [esp + 8], eax
test eax, eax
je 0x44ec78
push esi
mov esi, dword [esp + 0x20]
push eax
push 0
push esi
call fcn.0045086c
mov ecx, dword [esp + 0x28]
add esp, 0xc
lea edx, [esp + 0xc]
push edx
mov edx, dword [esp + 0xc]
push esi
lea eax, [esp + 0x18]
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
pop esi
test eax, eax
je 0x44ec7a
xor edi, edi
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
add esp, 0xc
ret

Function at 0x44ec8c
Capabilities:
Set registry value

Disassembly:
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp]
push eax
push ecx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x44eca9
xor eax, eax
pop ecx
ret
mov edx, dword [esp + 0x10]
mov eax, edx
push esi
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x44ecb3
sub eax, esi
push eax
mov eax, dword [esp + 8]
push edx
mov edx, dword [esp + 0x18]
push 1
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop esi
pop ecx
ret

Function at 0x44efec
Capabilities:
Resolve dns

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push esi
call fcn.0044ed1c
add esp, 4
test eax, eax
jne 0x44f022
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x44f02e
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
push edx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
pop esi
pop ecx
ret
mov eax, esi
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
pop esi
pop ecx
ret
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
pop esi
pop ecx
ret
Function at 0x44f03c
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get socket status
Set socket configuration

Disassembly:
sub esp, 0x124
mov eax, dword [0x45b0fc]
xor eax, esp
mov dword [esp + 0x120], eax
push esi
mov esi, dword [esp + 0x12c]
push 0x45844c
push esi
call fcn.00450fbc
add esp, 8
mov ecx, 0x50
test eax, eax
je 0x44f07f
mov byte [eax], 0
inc eax
push eax
call fcn.0044ed1c
add esp, 4
movzx ecx, ax
mov eax, 2
push ecx
mov word [esp + 0x118], ax
call dword [sym.imp.WS2_32.dll_htons]
push esi
mov word [esp + 0x11a], ax
call fcn.0044efec
add esp, 4
mov dword [esp + 0x118], eax
cmp eax, 0xffffffff
jne 0x44f0c8
or eax, eax
pop esi
mov ecx, dword [esp + 0x120]
xor ecx, esp
call fcn.00450674
add esp, 0x124
ret
push ebp
push 0
mov ebp, 1
push ebp
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
je 0x44f15d
push edi
mov edi, dword [sym.imp.WS2_32.dll_ioctlsocket]
lea ecx, [esp + 0xc]
push ecx
push 0x8004667e
push esi
mov dword [esp + 0x18], ebp
call edi
push 0x10
lea edx, [esp + 0x120]
push edx
push esi
call dword [sym.imp.WS2_32.dll_connect]
mov eax, dword [esp + 0x138]
lea ecx, [esp + 0x10]
push ecx
push 0
lea edx, [esp + 0x20]
push edx
push 0
push 0
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], 0
call dword [sym.imp.WS2_32.dll_select]
mov ebp, eax
lea eax, [esp + 0xc]
push eax
push 0x8004667e
push esi
mov dword [esp + 0x18], 0
call edi
pop edi
test ebp, ebp
jg 0x44f177
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
pop ebp
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x120]
xor ecx, esp
call fcn.00450674
add esp, 0x124
ret
mov ecx, dword [esp + 0x128]
pop ebp
mov eax, esi
pop esi
xor ecx, esp
call fcn.00450674
add esp, 0x124
ret
Function at 0x44f58c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x457fa2
mov eax, dword fs:[0]
push eax
sub esp, 0xb20
mov eax, dword [0x45b0fc]
xor eax, esp
mov dword [esp + 0xb1c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x45b0fc]
xor eax, esp
push eax
lea eax, [esp + 0xb34]
mov dword fs:[0], eax
mov esi, dword [esp + 0xb44]
lea ecx, [esp + 0x14]
call fcn.0044fa4c
mov eax, dword [esp + 0xb48]
push eax
xor edi, edi
push esi
lea ecx, [esp + 0x1c]
mov dword [esp + 0xb44], edi
call fcn.0044fabc
test al, al
jne 0x44f611
lea ecx, [esp + 0x14]
mov dword [esp + 0xb3c], 0xffffffff
call fcn.0044ff9c
xor eax, eax
jmp 0x44f741
movsx eax, byte [esp + 0x14]
sub eax, 1
je 0x44f63c
sub eax, 1
jne 0x44f728
mov ecx, dword [0x45c644]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [0x45c644], edi
jmp 0x44f728
push edi
lea ecx, [esp + 0x18]
call fcn.0044fe4c
push 1
lea ecx, [esp + 0x18]
mov esi, eax
call fcn.0044fe4c
push 2
lea ecx, [esp + 0x18]
mov ebp, eax
call fcn.0044fe4c
push 3
lea ecx, [esp + 0x18]
mov ebx, eax
call fcn.0044fe4c
push 0x45859c
push esi
mov edi, eax
call fcn.00450818
add esp, 8
test eax, eax
jne 0x44f6b8
push 0x104
lea edx, [esp + 0xa30]
push edx
push ebp
push 0x45b0a0
call fcn.0044ec0c
add esp, 0x10
test eax, eax
je 0x44f6b3
lea eax, [esp + 0xa2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x44f6d1
mov ecx, dword [ebx]
push ecx
jmp 0x44f6c8
push ebp
call fcn.0045017c
add esp, 4
test al, al
jne 0x44f6d1
mov edx, dword [ebx]
push edx
push edi
call fcn.0044f51c
add esp, 8
push ebp
call fcn.0044d53c
push esi
call fcn.0044d53c
push edi
call fcn.0044d53c
add esp, 0xc
lea ecx, [esp + 0x520]
call fcn.0044fa4c
mov eax, dword [0x45c644]
push eax
lea ecx, [esp + 0x524]
mov byte [esp + 0xb40], 1
mov byte [esp + 0x524], 1
call fcn.0044fdec
lea ecx, [esp + 0x520]
mov byte [esp + 0xb3c], 0
call fcn.0044ff9c
lea ecx, [esp + 0x14]
mov dword [esp + 0xb3c], 0xffffffff
call fcn.0044ff9c
mov eax, 1
mov ecx, dword [esp + 0xb34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xb1c]
xor ecx, esp
call fcn.00450674
add esp, 0xb2c
ret

Function at 0x44fdec
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, ecx
test ebx, ebx
jne 0x44fdff
pop edi
xor al, al
pop ebx
ret 4
push esi
call fcn.0044fc7c
mov esi, eax
test esi, esi
je 0x44fe27
mov edi, dword [edi + 4]
push 0
push edi
push esi
push ebx
call dword [sym.imp.WS2_32.dll_send]
push esi
cmp eax, 0xffffffff
jne 0x44fe2f
call fcn.0044d53c
add esp, 4
pop esi
pop edi
xor al, al
pop ebx
ret 4
call fcn.0044d53c
add esp, 4
pop esi
pop edi
mov al, 1
pop ebx
ret 4
Function at 0x45000c
Capabilities:
Query service status

Disassembly:
mov eax, dword [0x45c648]
sub esp, 0x1c
push ebx
xor bl, bl
test eax, eax
je 0x450079
mov ecx, dword [esp + 0x24]
push esi
push 0xf01ff
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x450071
xor eax, eax
lea edx, [esp + 8]
push edx
push esi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x45006a
cmp dword [esp + 0xc], 4
jne 0x45006a
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov al, bl
pop ebx
add esp, 0x1c
ret
mov al, bl
pop ebx
add esp, 0x1c
ret

Function at 0x45008c
Capabilities:
Create service
Persist via windows service

Disassembly:
mov eax, dword [0x45c648]
push ebx
xor bl, bl
test eax, eax
je 0x4500d0
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 8]
push 0
push 0
push 0
push 0
push 0
push ecx
mov ecx, dword [esp + 0x24]
push 1
push 2
push 0x10
push 0xf01ff
push edx
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
test eax, eax
je 0x4500d0
push eax
mov bl, 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
pop ebx
ret

Function at 0x4500dc
Capabilities:
Modify service
Query service configuration
Start service

Disassembly:
mov eax, dword [0x45c648]
sub esp, 0x28
push ebx
xor bl, bl
push esi
test eax, eax
je 0x450168
push 0xf01ff
push 0x45b0e8
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x450168
lea eax, [esp + 8]
push eax
push 0x24
lea ecx, [esp + 0x14]
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
cmp dword [esp + 0x10], 2
je 0x450150
push 0x45b0d4
push 0
push 0
push 0
push 0
push 0
push 0x45bddc
push 1
push 2
push 0x10
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
test eax, eax
jne 0x450150
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
xor al, al
pop ebx
add esp, 0x28
ret
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
je 0x450161
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov al, bl
pop ebx
add esp, 0x28
ret

Function at 0x4503cc
Capabilities:
Create thread

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x44eb6c
push 0
push 0
call esi
push 0
push 0
push 0
push 0x44f76c
push 0
push 0
call esi
push 0
push 0
push 0
push 0x4501ac
push 0
push 0
call esi
pop esi
ret

Function at 0x450674
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x45b0fc]
jne 0x45067e
repz ret
jmp fcn.00451428
Function at 0x4560d8
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00451fa8
and dword [ebp - 4], 0
cmp dword [0x45cff4], 0
mov ebx, eax
jne 0x456189
push 0x459724
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x45623a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x459718
push edi
call esi
test eax, eax
je 0x45623a
push eax
call fcn.00451f36
mov dword [esp], 0x459708
push edi
mov dword [0x45cff4], eax
call esi
push eax
call fcn.00451f36
mov dword [esp], 0x4596f4
push edi
mov dword [0x45cff8], eax
call esi
push eax
call fcn.00451f36
mov dword [esp], 0x4596d8
push edi
mov dword [0x45cffc], eax
call esi
push eax
call fcn.00451f36
pop ecx
mov dword [0x45d004], eax
test eax, eax
je 0x456189
push 0x4596c0
push edi
call esi
push eax
call fcn.00451f36
pop ecx
mov dword [0x45d000], eax
mov eax, dword [0x45d000]
cmp eax, ebx
je 0x4561e1
cmp dword [0x45d004], ebx
je 0x4561e1
push eax
call fcn.00451fb1
push dword [0x45d004]
mov esi, eax
call fcn.00451fb1
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4561e1
test edi, edi
je 0x4561e1
call esi
test eax, eax
je 0x4561d8
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4561d8
test byte [ebp - 0xc], 1
jne 0x4561e1
or dword [ebp + 0x10], 0x200000
jmp 0x45621a
mov eax, dword [0x45cff8]
cmp eax, ebx
je 0x45621a
push eax
call fcn.00451fb1
pop ecx
test eax, eax
je 0x45621a
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x45621a
mov eax, dword [0x45cffc]
cmp eax, ebx
je 0x45621a
push eax
call fcn.00451fb1
pop ecx
test eax, eax
je 0x45621a
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x45cff4]
call fcn.00451fb1
pop ecx
test eax, eax
je 0x45623a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x45623c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
mov ecx, 0x6202030d
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x432024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f314
nop
mov ecx, 0x15af59c9
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x432084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x401007
Capabilities:
Delete file
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1040
call fcn.00408c40
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 4]
mov ebx, dword [edi]
xor esi, esi
cmp dword [0x2b0295c], 0x594
mov dword [ebp - 0xc], eax
jne 0x40103f
push esi
lea eax, [ebp - 0x840]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [0x429ee8]
mov dword [ebp - 0x34], eax
mov eax, dword [0x429eec]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
mov dword [ebp - 0x2c], 0x9e3779b9
call fcn.00401000
mov eax, dword [0x429ef0]
add dword [ebp - 8], 0x23f
mov dword [ebp - 0x30], eax
mov eax, dword [0x429ef4]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x20], 0x20
mov dword [ebp - 0x10], 2
add dword [ebp - 0x10], 3
mov eax, ebx
shl eax, 4
cmp dword [0x2b0295c], 0xc
mov dword [ebp - 4], eax
jne 0x4010dc
push esi
lea eax, [ebp - 0x840]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
push esi
lea eax, [ebp - 0x3c]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
xor eax, eax
mov word [ebp - 0x24], ax
lea edi, [ebp - 0x22]
stosw word es:[edi], ax
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x24]
lea eax, [ebp - 0x1040]
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterW]
mov edi, dword [ebp + 8]
mov eax, dword [ebp - 0x30]
add dword [ebp - 4], eax
mov eax, dword [0x2b0295c]
cmp eax, 0xfa9
jne 0x4010f8
mov dword [0x2b02958], 0xedeb2e40
cmp eax, 0x3eb
jne 0x401113
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov dword [0x2b0230c], esi
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
mov edx, ebx
add eax, ebx
shr edx, cl
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov dword [0x2b02954], 0xf4ea3dee
add edx, dword [ebp - 0x38]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x14]
add dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
xor dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
xor edx, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
add dword [ebp - 0xc], 0x64
sub dword [ebp - 0xc], eax
sub dword [ebp - 0xc], 0x64
mov eax, dword [ebp - 0xc]
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x34]
add dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
add ecx, eax
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x10]
shr eax, cl
add eax, dword [ebp - 0x28]
mov ecx, eax
mov eax, dword [ebp - 0x14]
xor dword [ebp - 4], eax
xor dword [ebp - 4], ecx
sub ebx, dword [ebp - 4]
mov eax, dword [ebp - 0x2c]
sub dword [ebp - 8], eax
dec dword [ebp - 0x20]
jne 0x40107f
mov eax, dword [ebp - 0xc]
mov dword [edi], ebx
mov dword [edi + 4], eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x404be3
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x429640]
jne 0x404bed
repz ret
jmp fcn.00406ba5

Function at 0x4063d0
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00403668
and dword [ebp - 4], 0
cmp dword [0x42e208], 0
mov ebx, eax
jne 0x406481
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406532
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x406532
push eax
call fcn.004035f6
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x42e208], eax
call esi
push eax
call fcn.004035f6
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x42e20c], eax
call esi
push eax
call fcn.004035f6
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42e210], eax
call esi
push eax
call fcn.004035f6
pop ecx
mov dword [0x42e218], eax
test eax, eax
je 0x406481
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004035f6
pop ecx
mov dword [0x42e214], eax
mov eax, dword [0x42e214]
cmp eax, ebx
je 0x4064d9
cmp dword [0x42e218], ebx
je 0x4064d9
push eax
call fcn.00403671
push dword [0x42e218]
mov esi, eax
call fcn.00403671
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4064d9
test edi, edi
je 0x4064d9
call esi
test eax, eax
je 0x4064d0
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4064d0
test byte [ebp - 0xc], 1
jne 0x4064d9
or dword [ebp + 0x10], 0x200000
jmp 0x406512
mov eax, dword [0x42e20c]
cmp eax, ebx
je 0x406512
push eax
call fcn.00403671
pop ecx
test eax, eax
je 0x406512
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x406512
mov eax, dword [0x42e210]
cmp eax, ebx
je 0x406512
push eax
call fcn.00403671
pop ecx
test eax, eax
je 0x406512
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42e208]
call fcn.00403671
pop ecx
test eax, eax
je 0x406532
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x406534
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret