joyce8/EMBER2024-capa huggingface dataset:
Function at 0x63b170
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x63b178
push ecx
push ebx
xor eax, eax
push ebp
push 0x63b2c2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.005f0e90
mov edx, dword [ebp - 0x10]
mov eax, 0x660224
call fcn.00408aec
lea eax, [ebp - 0x14]
mov ecx, dword [0x660224]
mov edx, 0x63b2dc
call fcn.00409a14
mov eax, dword [ebp - 0x14]
call fcn.005f958c
mov eax, dword [0x658998]
cmp byte [eax], 0
je 0x63b1d3
mov eax, dword [0x660224]
call fcn.005f8d00
lea edx, [ebp - 0x18]
mov eax, dword [0x660224]
call fcn.005a2878
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 4]
mov ecx, 0x63b2fc
call fcn.00409a14
push 0
mov eax, dword [ebp - 4]
call fcn.004097c0
push eax
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x63b269
call sub.kernel32.dll_GetLastError
mov ebx, eax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x2c]
mov edx, dword [ebp - 4]
mov al, 0x3b
call fcn.005ab338
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x30]
call fcn.004207e0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x24], eax
lea edx, [ebp - 0x34]
mov eax, ebx
call fcn.005a4e4c
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x20], eax
lea edx, [ebp - 0x28]
mov ecx, 2
mov al, 0x70
call fcn.005ab308
mov ecx, dword [ebp - 0x1c]
mov dl, 1
mov eax, dword [0x41994c]
call fcn.0042660c
call fcn.00407e08
lea eax, [ebp - 8]
call fcn.006129b8
cmp dword [ebp - 8], 0
je 0x63b29a
lea eax, [ebp - 0xc]
mov ecx, 0x63b318
mov edx, dword [ebp - 4]
call fcn.00409a14
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.0063b118
mov eax, dword [ebp - 0xc]
call fcn.00612a10
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63b2c9
lea eax, [ebp - 0x34]
mov edx, 3
call fcn.0040876c
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.0040876c
ret

Function at 0x63da40
Capabilities:
Hide graphical window

Disassembly:
mov byte [0x66051d], 1
call fcn.005f2d6c
test al, al
jne 0x63da92
push 5
mov eax, dword [0x658894]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x658894]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
push eax
call sub.user32.dll_SetForegroundWindow
push 0
push 1
push 1
mov eax, dword [0x6588a8]
mov eax, dword [eax + 0x138]
mov cl, 2
xor edx, edx
call fcn.0063d808
ret

Function at 0x640fa4
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 4], eax
mov ecx, 3
lea ebx, [ebp - 8]
lea esi, [ebp - 0xc]
lea edi, [ebp - 4]
movzx eax, byte [esi]
movzx edx, byte [ebx]
sub eax, edx
imul dword [ebp - 0x10]
push ecx
mov ecx, 0xff
cdq
idiv ecx
pop ecx
movzx edx, byte [ebx]
add eax, edx
mov byte [edi], al
inc edi
inc esi
inc ebx
dec ecx
jne 0x640fc9
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x642c9c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
call sub.kernel32.dll_GetTickCount
mov ebx, eax
jmp 0x642cc8
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, 0x3e8
jae 0x642cd1
call fcn.00641b5c
mov eax, 0xa
call fcn.005a5260
call fcn.00641b5c
call fcn.00642c68
test al, al
jne 0x642ca6
pop ebx
ret

Function at 0x6431d4
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [0x658348]
cmp dword [eax], 0
je 0x64327f
mov eax, dword [0x658348]
mov eax, dword [eax]
call fcn.004f9784
test al, al
je 0x64327f
mov eax, dword [0x658348]
mov eax, dword [eax]
cmp byte [eax + 0x215], 0
je 0x643229
cmp byte [ebx + 0x3e1], 0
jne 0x643229
mov eax, dword [0x658894]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
push eax
call sub.user32.dll_IsIconic
test eax, eax
je 0x64322d
xor eax, eax
jmp 0x64322f
mov al, 1
mov ebx, eax
mov eax, dword [0x658348]
mov eax, dword [eax]
call fcn.004f93b0
push 0xfffffffffffffff0
push eax
call sub.user32.dll_GetWindowLongW
test eax, 0x10000000
setne al
cmp bl, al
je 0x64327f
test bl, bl
je 0x64326b
push 5
mov eax, dword [0x658348]
mov eax, dword [eax]
call fcn.004f93b0
push eax
call sub.user32.dll_ShowWindow
jmp 0x64327f
push 0
mov eax, dword [0x658348]
mov eax, dword [eax]
call fcn.004f93b0
push eax
call sub.user32.dll_ShowWindow
pop ebx
ret
Function at 0x643330
Capabilities:
Get system information on windows

Disassembly:
push ebx
push esi
add esp, 0xffffffd4
mov byte [0x6604d5], 0
push 0x6434bc
call sub.kernel32.dll_GetModuleHandleW
mov ebx, eax
push 0x6434d8
push ebx
call fcn.0041218c
mov esi, eax
test esi, esi
je 0x6433d8
lea eax, [esp + 2]
push eax
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call esi
test eax, eax
je 0x6433d8
cmp word [esp], 0
je 0x6433d8
mov byte [0x6604d5], 1
movzx eax, word [esp + 2]
sub ax, 0x14c
je 0x64339c
sub ax, 0xb4
je 0x6433a8
sub ax, 0x8464
je 0x6433b4
sub ax, 0x2400
je 0x6433c0
jmp 0x6433cc
mov byte [0x658179], 1
jmp 0x643474
mov byte [0x658179], 3
jmp 0x643474
mov byte [0x658179], 2
jmp 0x643474
mov byte [0x658179], 4
jmp 0x643474
mov byte [0x658179], 0
jmp 0x643474
push 0x6434f8
push ebx
call fcn.0041218c
test eax, eax
je 0x643420
lea edx, [esp + 8]
push edx
call eax
push 0x643520
push ebx
call fcn.0041218c
mov esi, eax
test esi, esi
je 0x64342a
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call esi
test eax, eax
je 0x64342a
cmp dword [esp + 4], 0
je 0x64342a
mov byte [0x6604d5], 1
jmp 0x64342a
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetSystemInfo
movzx eax, word [esp + 8]
sub ax, 1
jb 0x643449
sub ax, 5
je 0x643452
sub ax, 3
je 0x64345b
sub ax, 3
je 0x643464
jmp 0x64346d
mov byte [0x658179], 1
jmp 0x643474
mov byte [0x658179], 3
jmp 0x643474
mov byte [0x658179], 2
jmp 0x643474
mov byte [0x658179], 4
jmp 0x643474
mov byte [0x658179], 0
cmp byte [0x6604d5], 0
je 0x6434b5
call fcn.005ee134
test al, al
je 0x6434ae
push 0x643540
push ebx
call fcn.0041218c
test eax, eax
je 0x6434ae
push 0x643574
push 0x643594
call sub.kernel32.dll_GetModuleHandleW
push eax
call fcn.0041218c
test eax, eax
jne 0x6434b5
mov byte [0x6604d5], 0
add esp, 0x2c
pop esi
pop ebx
ret

Function at 0x6435b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push 0
push 1
lea eax, [ebp - 4]
push eax
mov ecx, 0x643620
mov edx, 0x80000002
xor eax, eax
call fcn.005a4308
test eax, eax
jne 0x643619
mov dword [ebp - 8], 4
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x643674
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x643610
cmp dword [ebp - 0xc], 4
jne 0x643610
cmp dword [ebp - 8], 4
jne 0x643610
movzx eax, word [ebp - 0x10]
mov word [0x6604ec], ax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
mov esp, ebp
pop ebp
ret
Function at 0x64381c
Capabilities:
Check os version

Disassembly:
add esp, 0xfffffdd0
mov dword [esp], 0x114
push esp
call sub.kernel32.dll_GetVersionExW
test eax, eax
je 0x6438cb
movzx eax, byte [esp + 4]
shl eax, 0x18
movzx edx, byte [esp + 8]
shl edx, 0x10
or eax, edx
movzx edx, word [esp + 0xc]
or eax, edx
mov dword [0x6604e8], eax
cmp byte [0x6604d4], 0
je 0x6438cb
mov eax, dword [esp + 4]
cmp eax, 5
jb 0x6438bc
mov dword [esp + 0x114], 0x11c
lea eax, [esp + 0x114]
push eax
call sub.kernel32.dll_GetVersionExW
test eax, eax
je 0x6438cb
movzx eax, byte [esp + 0x228]
shl eax, 8
movzx edx, byte [esp + 0x22a]
or ax, dx
mov word [0x6604ec], ax
movzx eax, byte [esp + 0x22e]
mov byte [0x6604ee], al
movzx eax, word [esp + 0x22c]
mov word [0x6604f0], ax
jmp 0x6438cb
cmp eax, 4
jne 0x6438cb
call fcn.006435b0
call fcn.0064368c
add esp, 0x230
ret

Function at 0x644800
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6448a8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x6448c4
push ebx
push 0x6448d4
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.00409a9c
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00405ce4
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004097c0
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x644886
mov eax, dword [0x6588a8]
mov eax, dword [eax + 0x1c8]
call fcn.00644758
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle
mov ebx, dword [ebp - 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6448af
lea eax, [ebp - 4]
call fcn.0040870c
ret
Function at 0x6451b0
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x64539e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.005a3ed8
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.005f0d14
test al, al
jne 0x64521d
xor eax, eax
push ebp
push 0x645213
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
xor eax, eax
call fcn.005f120c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64521d
push 0
mov eax, dword [ebp - 4]
call fcn.004097c0
push eax
mov eax, dword [0x6605cc]
call fcn.004097c0
push eax
call sub.kernel32.dll_CopyFileW
test eax, eax
jne 0x64524c
mov eax, dword [0x6588a8]
mov eax, dword [eax + 0x1c4]
call fcn.00644758
push 0x80
mov eax, dword [ebp - 4]
call fcn.004097c0
push eax
call sub.kernel32.dll_SetFileAttributesW
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [0x65c634]
push eax
push 0
mov ecx, 0x6453ac
mov edx, 0x6453b0
xor eax, eax
call fcn.00412eac
mov dword [ebp - 8], eax
push 0x644918
push 0xfffffffffffffffc
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_SetWindowLongW
mov dword [0x6605f8], eax
xor eax, eax
push ebp
push 0x645367
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x97
push 0
push 0
push 0
push 0
push 0
mov eax, dword [0x658894]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
push eax
call sub.user32.dll_SetWindowPos
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x28]
xor eax, eax
call fcn.005a38a4
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x24]
mov ecx, 1
mov eax, 0x6453cc
call fcn.00421bec
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x2c]
call fcn.005a3784
mov edx, dword [ebp - 0x2c]
pop eax
call fcn.004099bc
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.00644800
mov dword [ebp - 0xc], eax
call fcn.006448dc
test al, al
jne 0x645347
push 0x4ff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0xc]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x645325
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64536e
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_DestroyWindow
ret
Function at 0x646458
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x64670c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x658894]
mov eax, dword [eax]
mov edx, 0x646728
call fcn.00596160
push 5
mov eax, dword [0x658894]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
push ebp
push 0x6466d3
push dword fs:[edx]
mov dword fs:[edx], esp
call fcn.0063dccc
lea eax, [ebp - 0x10]
call fcn.005a3d50
mov eax, dword [ebp - 0x10]
call fcn.00421714
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.005a38a4
mov edx, dword [ebp - 0x14]
mov eax, 0x6605cc
call fcn.00408aec
call fcn.00644ac0
lea ecx, [ebp - 0x18]
mov edx, 0x64673c
mov eax, dword [0x6605cc]
call fcn.005a2964
mov edx, dword [ebp - 0x18]
mov eax, 0x6605d0
call fcn.00408aec
lea ecx, [ebp - 0x1c]
mov edx, 0x646754
mov eax, dword [0x6605cc]
call fcn.005a2964
mov edx, dword [ebp - 0x1c]
mov eax, 0x6605d4
call fcn.00408aec
push 2
push 0
push 1
mov ecx, dword [0x6605cc]
mov dl, 1
mov eax, dword [0x5a94d4]
call fcn.005a9e28
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x6465b0
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 4]
mov edx, dword [ebp - 0x24]
sub edx, 8
mov eax, dword [ebp - 4]
call fcn.005a9de8
lea edx, [ebp - 0xc]
mov ecx, 8
mov eax, dword [ebp - 4]
call fcn.005a9dc0
cmp dword [ebp - 0xc], 0x67734d49
je 0x64658b
mov cl, 1
xor edx, edx
mov eax, dword [0x6605d4]
call fcn.005ab47c
jmp 0x64659a
mov cl, 1
mov edx, dword [ebp - 8]
mov eax, dword [0x6605cc]
call fcn.005ab47c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6465b7
mov eax, dword [ebp - 4]
call fcn.004069c8
ret
Function at 0x646858
Capabilities:
Enumerate files on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 0x25c], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x646995
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x25c]
mov ecx, 0x6469b0
mov edx, ebx
call fcn.00409a14
mov eax, dword [ebp - 0x25c]
call fcn.004097c0
push eax
call sub.kernel32.dll_FindFirstFileW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x64696f
xor eax, eax
push ebp
push 0x646968
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x6469cc
lea eax, [ebp - 0x22c]
mov ecx, 5
call fcn.00421894
test eax, eax
jne 0x646939
test byte [ebp - 0x258], 0x10
jne 0x646939
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x22c]
mov ecx, 0x104
call fcn.00409864
mov ecx, dword [ebp - 0x260]
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00409a14
mov esi, dword [ebp - 0x258]
test esi, 1
je 0x646931
and esi, 0xfffffffe
push esi
mov eax, dword [ebp - 4]
call fcn.004097c0
push eax
call sub.kernel32.dll_SetFileAttributesW
mov eax, dword [ebp - 4]
call fcn.00421114
lea eax, [ebp - 0x258]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x6468c9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64696f
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindClose
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64699c
lea eax, [ebp - 0x260]
mov edx, 2
call fcn.0040876c
lea eax, [ebp - 4]
call fcn.0040870c
ret
Function at 0x6469d8
Capabilities:
Check if file exists
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x646ad6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
call fcn.0040870c
lea edx, [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.005a2dfc
xor edi, edi
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x1c]
xor ecx, ecx
mov eax, 0x646af0
call fcn.00421bec
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00409a14
mov eax, dword [ebp - 8]
call fcn.004097c0
push eax
call sub.kernel32.dll_GetFileAttributesW
mov esi, eax
cmp esi, 0xffffffff
je 0x646a76
test esi, 0x10
jne 0x646aa6
test esi, 1
je 0x646a76
and esi, 0xfffffffe
push esi
mov eax, dword [ebp - 8]
call fcn.004097c0
push eax
call sub.kernel32.dll_SetFileAttributesW
push 1
mov eax, dword [ebp - 8]
call fcn.004097c0
push eax
mov eax, dword [ebp - 0xc]
call fcn.004097c0
push eax
call sub.kernel32.dll_MoveFileExW
test eax, eax
je 0x646aa0
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.00408aec
jmp 0x646ab3
inc edi
cmp edi, 0xa
je 0x646ab3
inc ebx
cmp ebx, 0x3e8
jne 0x646a17
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x646add
lea eax, [ebp - 0x14]
call fcn.0040870c
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040876c
ret
Function at 0x401000
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
push edx
enter 0x84, 0
sub ebp, 0x82
mov dword [ebp - 2], 0
call fcn.00401554
mov ebx, eax
xor eax, eax
mov dword [ebp + 0x7e], eax
lea eax, [ebp + 0x7e]
push eax
mov eax, ebx
or al, 0x40
push eax
mov eax, 0x401e00
sub eax, fcn.004015cb
push eax
push fcn.004015cb
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
cmp dword [ebp + 0x7e], 0
je 0x40107d
mov eax, ebx
lea edx, [ebp - 2]
call fcn.00401478
mov eax, ebx
call fcn.004014c9
lea eax, [ebx + 0x1b600]
lea edx, [ebx - 1]
lea ecx, [ebp - 2]
and edx, eax
test ebx, ebx
je 0x401071
mov eax, 0x402054
add eax, eax
jmp 0x401076
mov eax, 0x402054
mov ebx, ecx
call fcn.004015cb
xor eax, eax
lea esp, [ebp + 0x82]
pop ebp
pop edx
pop ecx
pop ebx
ret

Function at 0x401554
Capabilities:
Delete file
Encode data using base64 via winapi

Disassembly:
push ebx
push ecx
push edx
enter 0x11c, 0
lea ebx, [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
push ebx
call dword [sym.imp.USER32.DLL_GetCursorPos]
push 0
push 0
lea ebx, [ebp - 4]
call dword [sym.imp.USER32.DLL_GetWindow]
push ebx
lea ebx, [ebp - 0x18]
push ebx
push 1
push 1
lea eax, [ebp - 0x11c]
push eax
mov dword [ebp - 4], 0xa
mov byte [ebp - 0x11c], 0
call dword [sym.imp.CRYPT32.DLL_CryptBinaryToStringA]
lea eax, [ebp - 0x18]
movzx ebx, byte [ebp - 0x18]
push eax
sub ebx, 0x41
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
mov eax, ebx
leave
pop edx
pop ecx
pop ebx
ret
Function at 0x42c470
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4a743b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0049974b
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x42c4f2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00496cad
mov eax, dword [eax]
push 0x4ec264
push eax
call fcn.004882b4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004999d6
test bl, bl
je 0x42c4f2
push 0x4ec264
lea ecx, [esp + 0xc]
call fcn.00499db2
push 0x4efddc
lea ecx, [esp + 0xc]
call fcn.00499db2
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x42c52e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004999d6
jmp 0x42c5f9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x42c5b2
lea edx, [esp + 0x7c]
push 0x4efdd8
push edx
call fcn.004882b4
add esp, 8
test eax, eax
je 0x42c5b2
lea eax, [esp + 0x7c]
push 0x4efdd4
push eax
call fcn.004882b4
add esp, 8
test eax, eax
je 0x42c5b2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x42c542
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004999d6
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x42cdf0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x42ce52
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x42ce60
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4a74bb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x4f8218]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x42cf98
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x42cec6
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004999d6
xor eax, eax
jmp 0x42d00f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.00499b5f
push esi
lea ecx, [esp + 0xc]
call fcn.00499dee
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push 0x4efe14
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x42cfed
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.0042cdf0
test eax, eax
jne 0x42cfed
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.0042cdf0
test eax, eax
jne 0x42cfed
lea eax, [esp + 0x14]
push 0x4efdf0
push eax
call fcn.00489490
mov esi, eax
add esp, 8
test esi, esi
jne 0x42cfcc
lea ecx, [esp + 0x14]
push 0x4efdec
push ecx
call fcn.00489410
mov esi, eax
add esp, 8
test esi, esi
jne 0x42cfcc
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x42cfcf
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.00499b0f
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x42cede
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004999d6
xor eax, eax
jmp 0x42d00f
mov byte [esi], 0
push 0x4efde8
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.004999d6
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4