joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419380
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x668
mov eax, dword [0x440ed0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
mov esi, ecx
push edi
mov dword [ebp - 0x25c], eax
mov dword [ebp - 0x260], ebx
cmp dword [esi], ebx
jne 0x419510
mov eax, dword [esi + 0x10]
cmp eax, ebx
je 0x4194f7
push str.EnumProcesses
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x400
lea ecx, [ebp - 0x668]
push ebx
push ecx
mov edi, eax
mov dword [ebp - 0x258], ebx
call fcn.0041b530
add esp, 0xc
cmp edi, ebx
je 0x4194f7
lea edx, [ebp - 0x258]
push edx
push 0x400
lea eax, [ebp - 0x668]
push eax
call edi
mov dword [ebp - 0x260], eax
cmp eax, ebx
je 0x4194f7
mov eax, dword [ebp - 0x258]
shr eax, 2
mov dword [ebp - 0x258], eax
test eax, eax
jbe 0x4194f7
jmp 0x419430
push 0x128
lea ecx, [ebp - 0x254]
push 0
push ecx
call fcn.0041b530
mov eax, dword [ebp + ebx*4 - 0x668]
add esp, 0xc
push eax
push 0
push 0x410
mov dword [ebp - 0x254], 0x128
mov dword [ebp - 0x24c], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x4194d9
mov edx, dword [esi + 0x10]
push str.EnumProcessModules
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ecx, ecx
mov dword [ebp - 0x264], ecx
mov dword [ebp - 0x268], ecx
cmp eax, ecx
je 0x4194d2
lea ecx, [ebp - 0x268]
push ecx
push 4
lea edx, [ebp - 0x264]
push edx
push edi
call eax
test eax, eax
je 0x4194d2
mov eax, dword [esi + 0x10]
push str.GetModuleBaseNameA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4194d2
mov edx, dword [ebp - 0x264]
push 0x103
lea ecx, [ebp - 0x230]
push ecx
push edx
push edi
call eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x254]
push eax
push esi
call dword [ebp - 0x25c]
inc ebx
add esp, 8
cmp ebx, dword [ebp - 0x258]
jb 0x419430
mov eax, dword [ebp - 0x260]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041bc6c
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x4195d2
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Process32First
push eax
call ebx
mov ecx, dword [esi + 8]
push str.Process32Next
push ecx
mov edi, eax
call ebx
mov ebx, eax
test edi, edi
je 0x4195d2
test ebx, ebx
je 0x4195d2
push 0x128
lea edx, [ebp - 0x12c]
push 0
push edx
call fcn.0041b530
mov ecx, dword [esi]
add esp, 0xc
lea eax, [ebp - 0x12c]
push eax
push ecx
mov dword [ebp - 0x12c], 0x128
call edi
mov edi, eax
test edi, edi
je 0x4195bd
lea edx, [ebp - 0x12c]
push edx
push esi
call dword [ebp - 0x25c]
add esp, 8
test edi, edi
je 0x4195bd
nop
mov ecx, dword [esi]
lea eax, [ebp - 0x12c]
push eax
push ecx
mov dword [ebp - 0x12c], 0x128
call ebx
test eax, eax
je 0x4195bd
lea edx, [ebp - 0x12c]
push edx
push esi
call dword [ebp - 0x25c]
add esp, 8
jmp 0x419590
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041bc6c
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0041bc6c
mov esp, ebp
pop ebp
ret 4
Function at 0x41a020
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcb4
mov eax, dword [0x440ed0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
call fcn.004198b0
push str._Process_Info__r_n
push esi
call fcn.004186f0
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.ProcessId:__lu_r_n
push esi
call fcn.004186f0
xor ebx, ebx
push 0x3ff
lea eax, [ebp - 0x483]
push ebx
push eax
mov byte [ebp - 0x484], bl
call fcn.0041b530
add esp, 0x18
push 0x400
lea ecx, [ebp - 0x484]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [ebp - 0x484]
push edx
push str.Name:__s_r_n
push esi
call fcn.004186f0
push 0x7ff
lea eax, [ebp - 0xc83]
push ebx
push eax
mov byte [ebp - 0xc84], bl
call fcn.0041b530
push 0x7f
lea ecx, [ebp - 0x83]
push ebx
push ecx
mov dword [ebp - 0xc88], ebx
mov byte [ebp - 0x84], bl
call fcn.0041b530
add esp, 0x24
lea edx, [ebp - 0xc84]
push edx
push 0x800
push ebx
lea eax, [ebp - 0x484]
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x41a148
lea ecx, [ebp - 0xc8c]
push ecx
lea edx, [ebp - 0xc88]
push edx
push 0x436504
lea eax, [ebp - 0xc84]
push eax
mov dword [ebp - 0xc8c], ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x41a148
mov eax, dword [ebp - 0xc88]
movzx ecx, word [eax + 0xc]
movzx edx, word [eax + 0xe]
push ecx
movzx ecx, word [eax + 8]
push edx
movzx edx, word [eax + 0xa]
push ecx
push edx
lea eax, [ebp - 0x84]
push str._lu._lu._lu._lu
push eax
call fcn.0041e496
add esp, 0x18
lea ecx, [ebp - 0x84]
push ecx
push str.Version:__s_r_n
push esi
call fcn.004186f0
mov eax, dword [esi + 0x10]
add esp, 0xc
cmp eax, ebx
je 0x41a1f7
push edi
push str.GetProcessMemoryInfo
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
cmp edi, ebx
je 0x41a1f6
xor eax, eax
push 0x28
lea edx, [ebp - 0xcb4]
push edx
mov dword [ebp - 0xcb4], eax
mov dword [ebp - 0xcb0], eax
mov dword [ebp - 0xcac], eax
mov dword [ebp - 0xca8], eax
mov dword [ebp - 0xca4], eax
mov dword [ebp - 0xca0], eax
mov dword [ebp - 0xc9c], eax
mov dword [ebp - 0xc98], eax
mov dword [ebp - 0xc94], eax
mov dword [ebp - 0xc90], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
test eax, eax
je 0x41a1f6
mov eax, dword [ebp - 0xca8]
push eax
push str.WorkingSetSize:__lu_Bytes_r_n
push esi
call fcn.004186f0
mov ecx, dword [ebp - 0xc94]
push ecx
push str.PagefileUsage:__lu_Bytes_r_n
push esi
call fcn.004186f0
add esp, 0x18
pop edi
push 0x437e84
push esi
call fcn.004186f0
mov ecx, dword [ebp - 4]
add esp, 8
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.0041bc6c
mov esp, ebp
pop ebp
ret
Function at 0x41b0e0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x440ed0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 0x4431a8
lea edx, [eax + 1]
jmp 0x41b100
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41b100
sub eax, edx
jne 0x41b199
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x108]
push 0x5c
push ecx
call fcn.0041fec0
add esp, 8
test eax, eax
jne 0x41b155
lea edx, [ebp - 0x108]
push 0x2f
push edx
call fcn.0041fec0
add esp, 8
test eax, eax
jne 0x41b155
lea eax, [ebp - 0x108]
jmp 0x41b156
inc eax
push 0x104
push 0x4431a8
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x41b199
mov eax, dword [str.RealPlayer]
mov ecx, dword [0x437c78]
mov dx, word [0x437c7c]
mov dword [0x4431a8], eax
mov al, byte [0x437c7e]
mov dword [0x4431ac], ecx
mov word [0x4431b0], dx
mov byte [0x4431b2], al
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x4431a8
call fcn.0041bc6c
mov esp, ebp
pop ebp
ret

Function at 0x41b1c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x440ed0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov ecx, 0x10
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionApp_PathsRealPlay.exe
lea edi, [ebp - 0x48]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x4c]
push eax
movsb byte es:[edi], byte [esi]
push 0x20019
xor edi, edi
push edi
lea ecx, [ebp - 0x48]
push ecx
mov esi, 0x80004005
push 0x80000002
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x4c], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41b2a2
mov ecx, dword [ebp - 0x4c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [ebp - 0x50]
push edx
push edi
lea eax, [ebp - 0x54]
push eax
push edi
push edi
push ecx
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x50], edi
call esi
mov eax, dword [ebp - 0x50]
cmp eax, edi
je 0x41b26c
lea edx, [ebp - 0x50]
push edx
push eax
mov ecx, ebx
call fcn.00411230
mov ecx, dword [ebp - 0x4c]
push eax
lea eax, [ebp - 0x54]
push eax
push edi
push edi
push ecx
call esi
push 0xffffffffffffffff
mov ecx, ebx
call fcn.004112c0
mov al, byte [ebx + 7]
cmp al, 0xff
je 0x41b28e
xor ecx, ecx
cmp al, 7
sete cl
test cl, cl
je 0x41b26f
mov edi, dword [ebp - 0x58]
mov edx, dword [ebp - 0x4c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041bc6c
mov esp, ebp
pop ebp
ret 4
cmp byte [ebx + 4], 0
jne 0x41b26f
cmp byte [ebx + 5], 0
jne 0x41b26f
cmp byte [ebx + 6], 0
je 0x41b26c
jmp 0x41b26f
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041bc6c
mov esp, ebp
pop ebp
ret 4
Function at 0x41b2c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push esi
mov esi, ecx
lea ecx, [ebp - 8]
call fcn.00410680
lea ecx, [ebp - 0x10]
call fcn.00410680
lea eax, [ebp - 8]
push eax
mov ecx, esi
call fcn.0041b1c0
mov esi, eax
test esi, esi
jl 0x41b36e
cmp byte [ebp - 1], 0xff
lea eax, [ebp - 8]
jne 0x41b2fa
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
push ecx
push eax
lea edx, [ebp - 0x10]
push str.__s___s
push edx
call fcn.00411430
push 0x44
lea eax, [ebp - 0x64]
push 0
push eax
call fcn.0041b530
add esp, 0x1c
xor eax, eax
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x64]
push edx
push eax
push eax
push eax
push eax
push eax
push eax
push eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x64], 0x44
call fcn.00411230
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, eax
neg esi
sbb esi, esi
and esi, 0x7fffbffb
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
add esi, 0x80004005
call fcn.004112c0
lea ecx, [ebp - 0x10]
call fcn.004108e0
lea ecx, [ebp - 8]
call fcn.004108e0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x41bc6c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x440ed0]
jne 0x41bc76
repz ret
jmp fcn.00422b81

Function at 0x41f455
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x41f486
call fcn.0041ea3b
mov dword [eax], esi
call fcn.0041ea28
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.0041dd5a
add esp, 0x14
or eax, 0xffffffff
jmp 0x41f4c1
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x41f4a3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0041ea4e
pop ecx
jmp 0x41f481
test byte [ebp + 0xc], 0x80
je 0x41f4ae
and eax, 0xfffffffe
jmp 0x41f4b1
or eax, 1
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x41f494
xor eax, eax
pop esi
pop ebp
ret
Function at 0x42b7e1
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0042101b
and dword [ebp - 4], 0
cmp dword [0x443d24], 0
mov ebx, eax
jne 0x42b892
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x42b943
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x42b943
push eax
call fcn.00420fa9
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x443d24], eax
call esi
push eax
call fcn.00420fa9
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x443d28], eax
call esi
push eax
call fcn.00420fa9
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x443d2c], eax
call esi
push eax
call fcn.00420fa9
pop ecx
mov dword [0x443d34], eax
test eax, eax
je 0x42b892
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00420fa9
pop ecx
mov dword [0x443d30], eax
mov eax, dword [0x443d30]
cmp eax, ebx
je 0x42b8ea
cmp dword [0x443d34], ebx
je 0x42b8ea
push eax
call fcn.00421024
push dword [0x443d34]
mov esi, eax
call fcn.00421024
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x42b8ea
test edi, edi
je 0x42b8ea
call esi
test eax, eax
je 0x42b8e1
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x42b8e1
test byte [ebp - 0xc], 1
jne 0x42b8ea
or dword [ebp + 0x10], 0x200000
jmp 0x42b923
mov eax, dword [0x443d28]
cmp eax, ebx
je 0x42b923
push eax
call fcn.00421024
pop ecx
test eax, eax
je 0x42b923
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x42b923
mov eax, dword [0x443d2c]
cmp eax, ebx
je 0x42b923
push eax
call fcn.00421024
pop ecx
test eax, eax
je 0x42b923
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x443d24]
call fcn.00421024
pop ecx
test eax, eax
je 0x42b943
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x42b945
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42fb90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x440ed0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov byte [ebp - 7], al
lea eax, [ebp - 0x14]
push eax
push str.SoftwareRealNetworks
push 0x80000000
mov byte [ebp - 0x10], 0
mov dword [ebp - 0x18], 9
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x42fc36
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x10]
push edx
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x42fc2c
cmp dword [ebp - 0x18], eax
je 0x42fc2c
mov edx, 0x4374e0
lea ecx, [ebp - 0x10]
lea ebx, [ebx]
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x42fc20
test al, al
je 0x42fc1c
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x42fc20
add ecx, 2
add edx, 2
test al, al
jne 0x42fc00
xor eax, eax
jmp 0x42fc25
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x42fc2c
lea edi, [eax + 1]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0041bc6c
mov esp, ebp
pop ebp
ret 8

Function at 0x42fd80
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret
Function at 0x406a5e
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push ebx
push esi
push edi
lea edi, [ebp - 0x11c]
push 0x47
pop ecx
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x41f01c]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 9], 0
and dword [ebp - 0x18], 0
and dword [ebp - 0x24], 0
mov dword [ebp - 0x30], 0x10
mov esi, esp
push 0xf0000040
push 1
push 0
push 0
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
cmp esi, esp
call fcn.00414070
test eax, eax
je 0x406b5c
mov esi, esp
lea eax, [ebp - 0x24]
push eax
push 0
push 0
push 0x8003
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
cmp esi, esp
call fcn.00414070
test eax, eax
je 0x406b5c
cmp dword [ebp - 0x24], 0
je 0x406b5c
mov esi, esp
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
cmp esi, esp
call fcn.00414070
test eax, eax
je 0x406b5c
mov esi, esp
push 0
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x48]
push eax
push 2
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp esi, esp
call fcn.00414070
test eax, eax
je 0x406b5c
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004064a8
add esp, 0x10
movzx eax, al
test eax, eax
je 0x406b5c
push dword [ebp + 0x10]
lea eax, [ebp - 0x58]
push eax
call fcn.004071f3
pop ecx
pop ecx
movzx eax, al
test eax, eax
je 0x406b5c
mov byte [ebp - 9], 1
cmp dword [ebp - 0x24], 0
je 0x406b74
mov esi, esp
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
cmp esi, esp
call fcn.00414070
cmp dword [ebp - 0x18], 0
je 0x406b8e
mov esi, esp
push 0
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
cmp esi, esp
call fcn.00414070
mov al, byte [ebp - 9]
push edx
mov ecx, ebp
push eax
lea edx, [0x406bc2]
call fcn.00414018
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00414093
add esp, 0x11c
cmp ebp, esp
call fcn.00414070
mov esp, ebp
pop ebp
ret
Function at 0x4071f3
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
push ebx
push esi
push edi
lea edi, [ebp - 0x190]
push 0x64
pop ecx
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x41f01c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x20
pop ecx
mov esi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
lea edi, [ebp - 0x8c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
and dword [ebp - 0x98], 0
and dword [ebp - 0xa4], 0
cmp dword [ebp - 0xa4], 8
jae 0x4073ac
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xa4]
movzx eax, byte [eax]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 8
jae 0x40728f
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xa4]
movzx eax, byte [eax]
mov dword [ebp - 0x190], eax
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
jmp 0x407296
and dword [ebp - 0x190], 0
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xa4], 8
jae 0x4072cc
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xa4]
movzx eax, byte [eax]
mov dword [ebp - 0x190], eax
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
jmp 0x4072d3
and dword [ebp - 0x190], 0
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0xb0]
shr eax, 2
mov ecx, dword [ebp - 0x98]
mov edx, dword [ebp + 0xc]
mov ax, word [ebp + eax*2 - 0x8c]
mov word [edx + ecx*2], ax
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0xbc]
shr eax, 4
mov ecx, dword [ebp - 0xb0]
and ecx, 3
shl ecx, 4
or eax, ecx
mov ecx, dword [ebp - 0x98]
mov edx, dword [ebp + 0xc]
mov ax, word [ebp + eax*2 - 0x8c]
mov word [edx + ecx*2], ax
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0xc8]
shr eax, 6
mov ecx, dword [ebp - 0xbc]
and ecx, 0xf
shl ecx, 2
or eax, ecx
mov ecx, dword [ebp - 0x98]
mov edx, dword [ebp + 0xc]
mov ax, word [ebp + eax*2 - 0x8c]
mov word [edx + ecx*2], ax
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0xc8]
and eax, 0x3f
mov ecx, dword [ebp - 0x98]
mov edx, dword [ebp + 0xc]
mov ax, word [ebp + eax*2 - 0x8c]
mov word [edx + ecx*2], ax
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
jmp 0x407239
mov eax, dword [ebp - 0x98]
dec eax
mov dword [ebp - 0x98], eax
push 0x3d
pop eax
mov ecx, dword [ebp - 0x98]
mov edx, dword [ebp + 0xc]
mov word [edx + ecx*2], ax
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
xor eax, eax
mov ecx, dword [ebp - 0x98]
mov edx, dword [ebp + 0xc]
mov word [edx + ecx*2], ax
mov al, 1
push edx
mov ecx, ebp
push eax
lea edx, [0x40740b]
call fcn.00414018
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00414093
mov esp, ebp
pop ebp
ret
Function at 0x40893c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4155aa
mov eax, dword fs:[0]
push eax
sub esp, 0xb14
push ebx
push esi
push edi
lea edi, [ebp - 0xb20]
mov ecx, 0x2c5
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x41f01c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov word [ebp - 0x21c], ax
push 0x206
push 0
lea eax, [ebp - 0x21a]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov byte [ebp - 0xa2d], 0
push 0x400
lea eax, [ebp - 0xa24]
push eax
call fcn.00408494
pop ecx
pop ecx
mov dword [ebp - 0xa3c], eax
cmp dword [ebp - 0xa3c], 0
je 0x408a0e
mov esi, esp
push str.HKEY_USERS_
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.MSVCR120.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00414070
mov esi, esp
lea eax, [ebp - 0xa24]
push eax
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.MSVCR120.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00414070
jmp 0x408a31
mov esi, esp
push str.HKEY_CURRENT_USER
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.MSVCR120.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00414070
mov esi, esp
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.MSVCR120.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00414070
lea ecx, [ebp - 0xa50]
call fcn.00413456
and dword [ebp - 4], 0
push 0x105
push 0
push dword [ebp + 8]
push str.Local_AppData
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0xa50]
call fcn.0041399f
mov esi, esp
push dword [ebp + 8]
call dword [sym.imp.MSVCR120.dll_wcslen]
pop ecx
cmp esi, esp
call fcn.00414070
test eax, eax
jne 0x408ac0
mov esi, esp
push 0
push 0x1c
push dword [ebp + 8]
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp esi, esp
call fcn.00414070
test eax, eax
je 0x408abe
mov byte [ebp - 0xa2d], 1
jmp 0x408ac7
mov byte [ebp - 0xa2d], 1
mov al, byte [ebp - 0xa2d]
mov byte [ebp - 0xb19], al
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa50]
call fcn.00413498
mov al, byte [ebp - 0xb19]
push edx
mov ecx, ebp
push eax
lea edx, [0x408b24]
call fcn.00414018
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00414093
add esp, 0xb20
cmp ebp, esp
call fcn.00414070
mov esp, ebp
pop ebp
ret
Function at 0x408f5e
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x344
push ebx
push esi
push edi
lea edi, [ebp - 0x344]
mov ecx, 0xd1
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x41f01c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
and dword [ebp - 0x21c], 0
lea eax, [ebp - 0x21c]
push eax
push 0
push 0
push 0x41c3e4
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
jne 0x409099
mov esi, esp
push dword [ebp - 0x21c]
push 0x104
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.MSVCR120.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00414070
test eax, eax
jne 0x409084
mov esi, esp
push str.control.exe__name_Microsoft.DefaultPrograms__page_pageDefaultProgram
push 0x104
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.MSVCR120.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00414070
test eax, eax
jne 0x409084
and dword [ebp - 0x268], 0
push 0x40
push 0
lea eax, [ebp - 0x264]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
and dword [ebp - 0x280], 0
xor eax, eax
lea edi, [ebp - 0x27c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x268], 0x44
mov esi, esp
lea eax, [ebp - 0x280]
push eax
lea eax, [ebp - 0x268]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp esi, esp
call fcn.00414070
mov esi, esp
push dword [ebp - 0x21c]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
cmp esi, esp
call fcn.00414070
push edx
mov ecx, ebp
push eax
lea edx, [0x4090ca]
call fcn.00414018
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00414093
add esp, 0x344
cmp ebp, esp
call fcn.00414070
mov esp, ebp
pop ebp
ret