joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4014a0
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Terminate process

Disassembly:
mov eax, dword [esp + 4]
push esi
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateMutexA]
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
jne 0x4014ce
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
mov eax, esi
pop esi
ret

Function at 0x401810
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
sub esp, 0x410
push ebp
push esi
push edi
xor esi, esi
mov edi, ecx
push esi
push esi
push esi
mov eax, dword [edi]
push esi
push eax
call dword [sym.imp.WININET.DLL_InternetOpenA]
mov ebp, eax
cmp ebp, esi
mov dword [esp + 0x14], ebp
je 0x40196e
push esi
lea ecx, [esp + 0x1c]
push 4
push ecx
push 0x3c
push ebp
mov dword [esp + 0x2c], esi
call dword [sym.imp.WININET.DLL_InternetSetOptionExA]
test eax, eax
je 0x401967
mov edx, dword [edi + 4]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push esi
dec ecx
push 0x84000100
push ecx
push edx
mov edx, dword [esp + 0x430]
push edx
push ebp
call dword [sym.imp.WININET.DLL_InternetOpenUrlA]
cmp eax, esi
mov dword [esp + 0x10], eax
je 0x401967
lea ecx, [esp + 0xc]
push ebx
push ecx
lea edx, [esp + 0x24]
push 0x400
push edx
push eax
call dword [sym.imp.WININET.DLL_InternetReadFile]
test eax, eax
je 0x40195b
mov ebx, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40195b
test esi, esi
jne 0x4018cf
push 0xc
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
mov eax, dword [esp + 0x10]
mov edi, dword [esi + 4]
mov ecx, dword [esi]
mov ebp, eax
add eax, edi
cmp eax, ecx
mov dword [esi + 4], eax
jbe 0x401921
mov ecx, eax
and ecx, 0x3ff
neg ecx
sbb ecx, ecx
neg ecx
shr eax, 0xa
add ecx, eax
mov eax, dword [esi + 8]
shl ecx, 0xa
test eax, eax
mov dword [esi], ecx
mov eax, ecx
jne 0x40190e
push eax
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
jmp 0x40191e
mov ecx, dword [esi + 8]
push eax
push ecx
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapReAlloc]
mov dword [esi + 8], eax
mov eax, dword [esi + 8]
lea edx, [esp + 0x20]
push ebp
add eax, edi
push edx
push eax
call fcn.00401c60
mov eax, dword [esp + 0x20]
add esp, 0xc
lea ecx, [esp + 0x10]
lea edx, [esp + 0x20]
push ecx
push 0x400
push edx
push eax
call dword [sym.imp.WININET.DLL_InternetReadFile]
mov ebp, dword [esp + 0x18]
test eax, eax
jne 0x4018ac
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.WININET.DLL_InternetCloseHandle]
pop ebx
push ebp
call dword [sym.imp.WININET.DLL_InternetCloseHandle]
mov eax, esi
pop edi
pop esi
pop ebp
add esp, 0x410
ret 4
Function at 0x401ac0
Capabilities:
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x214
lea eax, [esp]
mov dword [esp], 0
push eax
push 0xf003f
push 0
push 0x4061a4
push 0x80000001
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExA]
test eax, eax
jne 0x401bb2
mov ecx, dword [0x406194]
mov eax, dword [0x40619c]
mov edx, dword [0x406198]
mov dword [esp + 0xc], ecx
mov cx, word [0x4061a0]
push edi
mov dword [esp + 0x18], eax
mov word [esp + 0x1c], cx
mov ecx, 0x3d
xor eax, eax
lea edi, [esp + 0x1e]
mov dword [esp + 0x14], edx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x115]
mov byte [esp + 0x114], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edx, [esp + 0xc]
lea eax, [esp + 0x114]
push edx
lea ecx, [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push ecx
lea edx, [esp + 0x1c]
push 0
push edx
push eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0x104
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExA]
test eax, eax
je 0x401ba6
mov edx, dword [esp + 0x21c]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
mov edx, dword [esp + 0xc]
push 1
lea ecx, [esp + 0x1c]
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.DLL_RegSetValueExA]
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
pop edi
add esp, 0x214
ret

Function at 0x401d10
Capabilities:
Get mac address on windows

Disassembly:
push ecx
push ebx
push esi
lea eax, [esp + 8]
push edi
xor ebx, ebx
push eax
push ebx
mov dword [esp + 0x14], ebx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
jne 0x401d79
mov ecx, dword [esp + 0xc]
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push ecx
push 8
call edi
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
cmp esi, ebx
je 0x401d79
lea edx, [esp + 0xc]
push edx
push esi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x401d6d
mov ecx, dword [esp + 0x14]
lea eax, [esi + 0x194]
push 6
push eax
push ecx
call fcn.00401c60
add esp, 0xc
mov bl, 1
push esi
push 8
call edi
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop edi
mov al, bl
pop esi
pop ebx
pop ecx
ret

Function at 0x401d80
Capabilities:
Terminate process

Disassembly:
sub esp, 0x3c
push edi
push 0x406218
push 0x40620c
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov edx, eax
mov ecx, 0xe
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x44]
lea ecx, [esp + 4]
push ecx
mov dword [esp + 8], 0x3c
mov dword [esp + 0xc], 0x40
mov dword [esp + 0x18], 0x4061fc
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 0x4061d8
mov dword [esp + 0x24], 0
call edx
mov edx, dword [esp + 0x3c]
push 0xea60
push edx
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov eax, dword [esp + 0x3c]
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
pop edi
add esp, 0x3c
ret
Function at 0x401e50
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push edi
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
lea ecx, [esp + 0x14]
mov edx, dword [esp + 0x5c]
push eax
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push edx
mov dword [esp + 0x3c], 0x44
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
pop edi
add esp, 0x54
ret

Function at 0x402000
Capabilities:
Read file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx]
lea eax, [esp + 8]
push 0
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov eax, dword [esp + 8]
ret 8

Function at 0x402030
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx]
lea eax, [esp + 8]
push 0
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
ret 8

Function at 0x40a561
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.0040a5e0
jae 0x40a56d
xor ecx, ecx
call fcn.0040a5e0
jae 0x40a597
xor eax, eax
call fcn.0040a5e0
jae 0x40a5a8
mov al, 0x10
call fcn.0040a5e0
adc al, al
jae 0x40a589
jne 0x40a5d5
stosb byte es:[edi], al
jmp 0x40a56e
call fcn.0040a5ec
dec ecx
loop 0x40a5b4
mov eax, ebp
call fcn.0040a5ea
jmp 0x40a5d6
lodsb al, byte [esi]
shr eax, 1
je 0x40a5fc
adc ecx, 2
mov ebp, eax
jmp 0x40a5d6
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.0040a5ea
cmp eax, 0x7d00
jae 0x40a5d4
cmp eax, 0x500
jae 0x40a5d5
cmp eax, 0x7f
ja 0x40a5d6
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x40a56e
pop ebp
ret 8

Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0x55695c55
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x6b566a38
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x454660
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov esi, ecx
sub esp, 0x2c
mov edx, dword [ecx + 0x80]
mov ebx, dword [ebp + 8]
mov eax, dword [edx + 0x5c8]
mov edi, dword [eax + 0x14]
movzx eax, word [edi + 6]
and eax, 1
cmp bl, al
je 0x4546c8
mov edx, dword [ecx + 0x14]
mov eax, dword [edi + 0x1c]
sub eax, dword [edi + 0x14]
mov ecx, dword [edx + 0x1c]
sub ecx, dword [edx + 0x14]
mov edi, eax
add eax, 1
test bl, bl
not edi
cmovne eax, edi
lea eax, [eax + ecx + 1]
mov ecx, esi
mov dword [esp + 4], eax
mov eax, dword [edx + 0x18]
sub eax, dword [edx + 0x10]
add eax, 1
mov dword [esp], eax
call dword [0x544ebc]
mov edx, dword [esi + 0x80]
sub esp, 8
mov edi, dword [edx + 0x30]
test bl, bl
mov edx, 0x4d5e26
mov eax, 0x4d592e
mov dword [esp + 4], 0xc
cmovne eax, edx
mov dword [esp], eax
call dword [0x54459c]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
mov dword [esp], 7
mov ecx, edi
mov dword [esp + 4], eax
call dword [0x544bec]
mov eax, dword [ebp - 0x1c]
sub esp, 8
mov edx, dword [eax]
test edx, edx
je 0x454743
cmp edx, 0xffffffff
je 0x45471e
lock sub dword [eax], 1
mov eax, dword [ebp - 0x1c]
je 0x454743
mov eax, dword [esi + 0x80]
movzx ebx, bl
mov ecx, dword [eax + 0x5c8]
mov dword [esp], ebx
call dword [0x544f64]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 4
mov dword [esp + 8], 4
mov dword [esp + 4], 2
mov dword [esp], eax
call dword [0x5442ec]
jmp 0x45471e
Function at 0x401037
Capabilities:
Delete file
Extract resource via kernel32 functions
Get common file path

Disassembly:
call 0x401037
push 0
call sub.kernel32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffbf4
push esi
push edi
push ebx
push 0
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x403030], eax
mov dword [ebp - 8], 0
push 0xa
push section..data
push 0
call sub.kernel32.dll_FindResourceA
or eax, eax
je 0x401089
mov dword [ebp - 4], eax
push dword [ebp - 4]
push 0
call sub.kernel32.dll_SizeofResource
mov dword [ebp - 0xc], eax
push dword [ebp - 4]
push 0
call sub.kernel32.dll_LoadResource
or eax, eax
je 0x401089
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4010c1
push 4
push 0x1000
push dword [ebp - 0xc]
push 0
call sub.kernel32.dll_VirtualAlloc
mov edi, eax
push dword [ebp - 0xc]
push dword [ebp - 8]
push edi
call sub.kernel32.dll_RtlMoveMemory
mov dword [ebp - 8], edi
push 0xdeadbeef
push dword [ebp - 0xc]
push dword [ebp - 8]
call section..text
cmp dword [ebp - 8], 0
je 0x4010fb
lea eax, [ebp - 0x40c]
push eax
push 0x400
call sub.kernel32.dll_GetTempPathA
push str.dup2patcher.dll
lea eax, [ebp - 0x40c]
push eax
call sub.kernel32.dll_lstrcatA
push dword [ebp - 0xc]
push dword [ebp - 8]
lea eax, [ebp - 0x40c]
push eax
call fcn.00401184
lea eax, [ebp - 0x40c]
push eax
call sub.kernel32.dll_LoadLibraryA
or eax, eax
je 0x401130
mov ebx, eax
push str.load_patcher
push ebx
call sub.kernel32.dll_GetProcAddress
or eax, eax
je 0x40111e
call eax
push ebx
call sub.kernel32.dll_FreeLibrary
lea eax, [ebp - 0x40c]
push eax
call sub.kernel32.dll_DeleteFileA
pop ebx
pop edi
pop esi
leave
ret

Function at 0x401184
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x4011af
xor eax, eax
leave
ret 0xc
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call sub.kernel32.dll_WriteFile
push dword [ebp - 4]
call sub.kernel32.dll_FlushFileBuffers
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 8]
leave
ret 0xc
Function at 0x4636b5
Capabilities:
Copy file
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x20030
call fcn.00431ac0
push ebx
push esi
lea eax, [esp + 0x10038]
mov esi, edx
push eax
mov edx, 0x7fff
call fcn.004646af
lea eax, [esp + 0x3c]
mov edx, 0x7fff
push eax
mov ecx, esi
call fcn.004646af
pop ecx
pop ecx
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x1003c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x463743
cmp byte [ebp + 8], al
je 0x46373c
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x1003c]
push eax
call fcn.004236cc
pop ecx
pop ecx
test eax, eax
je 0x463735
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x1003c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov al, 1
jmp 0x4637ef
xor al, al
jmp 0x4637ef
lea ecx, [esp + 0x10038]
call fcn.00464ad8
test al, al
je 0x46373c
lea ecx, [esp + 0x38]
call fcn.00464ad8
test al, al
je 0x4637f5
cmp byte [ebp + 8], 0
je 0x46373c
lea eax, [esp + 0x10038]
push 0x4b86b8
push eax
call fcn.00422f0d
lea eax, [esp + 0x10040]
push eax
call fcn.00422d7c
xor ecx, ecx
mov word [esp + eax*2 + 0x10046], cx
lea eax, [esp + 0x44]
push eax
call fcn.00422d7c
xor ecx, ecx
mov dword [esp + 0x1c], 2
add esp, 0x10
mov word [esp + eax*2 + 0x3a], cx
lea eax, [esp + 0x10038]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x38]
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 0x1e], eax
mov dword [esp + 0x22], eax
mov dword [esp + 0x1a], eax
mov dword [esp + 8], eax
mov eax, 0x614
mov word [esp + 0x18], ax
lea eax, [esp + 8]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
neg eax
sbb al, al
inc al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x2c]
call fcn.00407f41
lea ecx, [esp + 0x28]
call fcn.00463a6e
mov bl, al
lea ecx, [esp + 0x28]
neg bl
sbb bl, bl
call fcn.00405a64
inc bl
jne 0x46373c
lea ecx, [esp + 0x38]
call fcn.00464ad8
test al, al
jmp 0x463768
Function at 0x463833
Capabilities:
Delete file
Enumerate files on windows
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2cc
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea ecx, [ebp - 0x34]
mov byte [ebp - 1], bl
mov edi, edx
call fcn.004077c7
lea ecx, [ebp - 0x44]
call fcn.004077c7
lea ecx, [ebp - 0x24]
call fcn.004077c7
lea ecx, [ebp - 0x14]
call fcn.004077c7
lea edx, [ebp - 0x34]
mov ecx, esi
call fcn.004048ae
lea edx, [ebp - 0x44]
mov ecx, edi
call fcn.004048ae
lea edx, [ebp - 0x44]
lea ecx, [ebp - 0x34]
call fcn.00464a6e
mov ecx, dword [ebp - 0x34]
mov byte [ebp - 3], al
call fcn.00464ad8
mov esi, 0x4b86b8
test al, al
je 0x4638a4
push esi
lea ecx, [ebp - 0x34]
call fcn.00407e0b
mov ecx, dword [ebp - 0x44]
call fcn.00464ad8
test al, al
je 0x4638b9
push esi
lea ecx, [ebp - 0x44]
call fcn.00407e0b
lea ecx, [ebp - 0x54]
call fcn.004077c7
lea ecx, [ebp - 0x64]
call fcn.004077c7
push ebx
lea eax, [ebp - 0x64]
push ebx
push eax
lea edx, [ebp - 0x54]
lea ecx, [ebp - 0x34]
call fcn.004046f9
add esp, 0xc
lea eax, [ebp - 0x2c8]
push eax
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov al, 1
mov byte [ebp - 2], al
cmp esi, 0xffffffff
je 0x463a05
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp al, 1
jne 0x463a05
test byte [ebp - 0x2c8], 0x10
jne 0x4639d9
lea eax, [ebp - 0x29c]
push eax
lea ecx, [ebp - 0x74]
call fcn.00407f41
lea eax, [ebp - 0x24]
push eax
lea edx, [ebp - 0x44]
lea ecx, [ebp - 0x74]
call fcn.004640b2
pop ecx
lea ecx, [ebp - 0x74]
call fcn.00405a64
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x14]
call fcn.004081a7
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x14]
call fcn.00407c8e
lea eax, [ebp - 0x29c]
push eax
lea ecx, [ebp - 0x14]
call fcn.00407e0b
lea ecx, [ebp - 0x24]
call fcn.00463c7b
test al, al
je 0x463991
cmp byte [ebp + 8], bl
je 0x4639fc
push ebx
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x14]
call fcn.00407a68
push dword [ebp - 0x24]
test eax, eax
je 0x46399f
call edi
cmp byte [ebp + 0xc], 1
jne 0x4639c3
cmp byte [ebp - 3], bl
jne 0x4639aa
push dword [ebp - 0x24]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x4639d1
lea edx, [ebp - 0x24]
lea ecx, [ebp - 0x14]
call fcn.00463a48
movzx eax, al
test eax, eax
je 0x4639fc
push dword [ebp - 0x14]
call edi
jmp 0x4639d1
lea edx, [ebp - 0x24]
lea ecx, [ebp - 0x14]
call fcn.00463a48
movzx eax, al
test eax, eax
je 0x4639fc
mov byte [ebp - 1], 1
lea eax, [ebp - 0x2c8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
mov al, byte [ebp - 2]
jne 0x463903
mov al, bl
mov byte [ebp - 2], al
jmp 0x463903
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x463a0f
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov bl, byte [ebp - 1]
lea ecx, [ebp - 0x64]
call fcn.00405a64
lea ecx, [ebp - 0x54]
call fcn.00405a64
lea ecx, [ebp - 0x14]
call fcn.00405a64
lea ecx, [ebp - 0x24]
call fcn.00405a64
lea ecx, [ebp - 0x44]
call fcn.00405a64
lea ecx, [ebp - 0x34]
call fcn.00405a64
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x463b56
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x288
push ebx
push esi
mov esi, ecx
xor ebx, ebx
lea ecx, [esp + 0x10]
mov byte [esp + 0xf], bl
call fcn.004077c7
lea ecx, [esp + 0x20]
call fcn.004077c7
lea ecx, [esp + 0x30]
call fcn.004077c7
lea edx, [esp + 0x10]
mov ecx, esi
call fcn.004048ae
mov ecx, dword [esp + 0x10]
call fcn.00464ad8
test al, al
je 0x463bad
push 0x4b86b8
lea ecx, [esp + 0x14]
call fcn.00407e0b
push ebx
lea eax, [esp + 0x34]
push ebx
push eax
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x1c]
call fcn.004046f9
add esp, 0xc
lea eax, [esp + 0x40]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov al, 1
mov byte [esp + 0xe], al
cmp esi, 0xffffffff
je 0x463c4d
cmp al, 1
jne 0x463c4d
test byte [esp + 0x40], 0x10
jne 0x463c28
mov byte [esp + 0xf], al
lea ecx, [esp + 0x10]
lea eax, [esp + 0x20]
push eax
call fcn.004081a7
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x14]
call fcn.00407c8e
lea eax, [esp + 0x6c]
push eax
lea ecx, [esp + 0x14]
call fcn.00407e0b
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, 1
jne 0x463c44
lea eax, [esp + 0x40]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
mov al, byte [esp + 0xe]
jne 0x463be0
mov al, bl
mov byte [esp + 0xe], al
jmp 0x463be0
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x463c58
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov bl, byte [esp + 0xf]
lea ecx, [esp + 0x30]
call fcn.00405a64
lea ecx, [esp + 0x20]
call fcn.00405a64
lea ecx, [esp + 0x10]
call fcn.00405a64
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402e0f
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x14
push 0x4127f0
call fcn.00404cf0
call fcn.004049c6
movzx esi, ax
push 2
call fcn.004047c6
pop ecx
mov eax, 0x5a4d
cmp word [sym.imp.crypt32.dll_CertDeleteCRLFromStore], ax
je 0x402cc6
xor ebx, ebx
jmp 0x402cf9
mov eax, dword [0x40003c]
cmp dword [eax + sym.imp.crypt32.dll_CertDeleteCRLFromStore], 0x4550
jne 0x402cc2
mov ecx, 0x10b
cmp word [eax + sym.imp.shlwapi.dll_StrStrNIW], cx
jne 0x402cc2
sub ebx, ebx
cmp dword [eax + 0x400074], 0xe
jbe 0x402cf9
cmp dword [eax + 0x4000e8], ebx
setne bl
mov dword [ebp - 0x1c], ebx
call fcn.004041e8
test eax, eax
jne 0x402d0d
push 0x1c
call fcn.00402de8
pop ecx
call fcn.00403c4b
or eax, eax
jne 0x402d1e
push 0x10
call fcn.00402de8
pop ecx
call fcn.004048ad
and dword [ebp - 4], 0
call fcn.004041fd
test eax, eax
jns 0x402d38
push 0x1b
call fcn.00402de8
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [0x484150], eax
call fcn.004048ed
mov dword [0x482144], eax
call fcn.004044ab
test eax, eax
jns 0x402d5e
push 8
call fcn.00403d26
pop ecx
call fcn.004046e4
or eax, eax
jns 0x402d6f
push 9
call fcn.00403d26
pop ecx
push 1
call fcn.00403d60
pop ecx
or eax, eax
je 0x402d82
push eax
call fcn.00403d26
pop ecx
call fcn.00404c9d
push esi
push eax
push 0
push sym.imp.crypt32.dll_CertDeleteCRLFromStore
call main
mov esi, eax
mov dword [ebp - 0x24], esi
or ebx, ebx
jne 0x402da4
push esi
call fcn.00403fbc
call fcn.00403d51
jmp 0x402dd9
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
call fcn.00404d35
ret
call fcn.00404813
jmp 0x402c98
Function at 0x40402d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1fc
mov eax, dword [0x4140a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.00404009
push eax
pop edi
pop ecx
test edi, edi
je 0x4041cf
push ebx
push 3
call fcn.004047d3
pop ecx
cmp eax, 1
je 0x404177
push 3
call fcn.004047d3
pop ecx
test eax, eax
jne 0x404081
cmp dword [0x482180], 1
je 0x404177
cmp esi, 0xfc
je 0x4041ce
push 0x40dc3c
push 0x314
push 0x482188
call fcn.00403479
add esp, 0xc
xor ebx, ebx
or eax, eax
jne 0x4041dd
push 0x104
push 0x4821ba
push ebx
mov word [0x4823c2], ax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, 0x2fb
test eax, eax
jne 0x4040e9
push 0x40dc70
push esi
push 0x4821ba
call fcn.00403479
add esp, 0xc
test eax, eax
jne 0x4041dd
push 0x4821ba
call fcn.004075f7
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40412f
push 0x4821ba
call fcn.004075f7
lea ecx, [eax*2 + 0x482144]
mov eax, ecx
sub eax, 0x4821ba
push 3
sar eax, 1
push 0x40dca0
sub esi, eax
push esi
push ecx
call fcn.00407610
add esp, 0x14
or eax, eax
jne 0x4041dd
push 0x40dca8
push 0x314
mov esi, 0x482188
push esi
call fcn.0040758b
add esp, 0xc
test eax, eax
jne 0x4041dd
push edi
push 0x314
push esi
call fcn.0040758b
add esp, 0xc
test eax, eax
jne 0x4041dd
push 0x12010
push 0x40dcb0
push esi
call fcn.004076ce
add esp, 0xc
jmp 0x4041ce
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
test esi, esi
je 0x4041ce
cmp esi, 0xffffffff
je 0x4041ce
sub ebx, ebx
mov ecx, ebx
mov al, byte [edi + ecx*2]
mov byte [ebp + ecx - 0x1f8], al
cmp word [edi + ecx*2], bx
je 0x4041a7
inc ecx
cmp ecx, 0x1f4
jb 0x40418e
push ebx
lea eax, [ebp - 0x1fc]
push eax
lea eax, [ebp - 0x1f8]
push eax
mov byte [ebp - 5], bl
call fcn.00407500
pop ecx
push eax
lea eax, [ebp - 0x1f8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00402e19
leave
ret
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004052bf
int3

Function at 0x4048ed
Capabilities:
Query environment variable

Disassembly:
push ebp
push esp
pop ebp
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push eax
pop edi
or edi, edi
je 0x404945
push ebx
sub ebx, ebx
push esi
mov esi, edi
cmp word [edi], bx
je 0x404919
add esi, 2
cmp word [esi], bx
jne 0x404909
add esi, 2
cmp word [esi], bx
jne 0x404909
sub esi, edi
add esi, 2
push esi
call fcn.00406544
pop ecx
mov dword [ebp - 4], eax
or eax, eax
je 0x40493a
push esi
push edi
push eax
call fcn.00405a60
mov ebx, dword [ebp - 4]
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
pop esi
push ebx
pop eax
pop ebx
pop edi
leave
ret