joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40fca0
Capabilities:
Check for time delay via gettickcount
Create process on windows

Disassembly:
sub esp, 0x160
push ebx
push ebp
push esi
push edi
push str.ejeccallusr
push 1
xor edi, edi
call fcn.0040c720
add esp, 8
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
mov ebp, eax
push str.127.0.0.1
call fcn.0040fa40
add esp, 4
mov esi, eax
call ebx
inc edi
test esi, esi
je 0x40fcf9
cmp esi, 1
je 0x40fd33
cmp edi, 4
jge 0x40fcf9
sub eax, ebp
cmp eax, 0x7530
jb 0x40fcd0
cmp esi, 1
jge 0x40fd33
push 0x429438
lea eax, [esp + 0x14]
push str.__sDiscover.exe___NOREINTNONE
push eax
call fcn.00416129
lea ecx, [esp + 0x1c]
push ecx
push str.ejecutara___disc_de__s
push 1
call fcn.0040c720
add esp, 0x18
lea edx, [esp + 0x10]
push 5
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
push esi
push str.res_d
push 1
call fcn.0040c720
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x160
ret

Function at 0x40fd50
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push str.ejeccallsyst
push 1
xor edi, edi
call fcn.0040c720
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
add esp, 8
call ebx
mov ebp, dword [esp + 0x18]
mov dword [esp + 0x10], eax
push ebp
push str.127.0.0.1
call fcn.0040fb50
add esp, 8
mov esi, eax
call ebx
inc edi
cmp esi, 1
je 0x40fd9e
cmp edi, 4
jge 0x40fd9e
sub eax, dword [esp + 0x10]
cmp eax, 0x7530
jb 0x40fd76
push esi
push str.res_d
push 1
call fcn.0040c720
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x4103a0
Capabilities:
Create directory
Set file attributes

Disassembly:
sub esp, 0x12c
push ebx
mov ebx, dword [esp + 0x134]
push ebp
push esi
push edi
push ebx
push str.cree_dir__s
push 1
call fcn.0040c720
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x10]
mov eax, ecx
mov esi, edi
mov edi, edx
mov ebp, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov al, byte [esp + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test al, al
lea esi, [esp + 0x10]
je 0x410425
cmp byte [esi], 0x5c
jne 0x41041d
lea ecx, [esp + 0x10]
push 0
push ecx
mov byte [esi], 0
call edi
test eax, eax
je 0x41041a
lea edx, [esp + 0x10]
push 2
push edx
call ebp
mov byte [esi], 0x5c
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x4103fc
push 0
push ebx
call edi
push 2
push ebx
call ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x12c
ret
Function at 0x410600
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x244
push ebp
mov ebp, dword [esp + 0x250]
push esi
mov esi, dword [esp + 0x250]
push edi
push ebp
push esi
push str.vacie__s__s
push 1
call fcn.0040c720
push ebp
push esi
lea eax, [esp + 0x24]
push 0x4287f4
push eax
call fcn.00416129
add esp, 0x20
lea ecx, [esp + 0x110]
lea edx, [esp + 0xc]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4106d9
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea eax, [esp + 0x140]
lea ecx, [esp + 0x10]
push eax
push esi
push 0x4287f4
push ecx
call fcn.00416129
mov al, byte [esp + 0x124]
add esp, 0x10
test al, 0x10
je 0x4106a5
cmp byte [esp + 0x140], 0x2e
je 0x4106a5
lea edx, [esp + 0x10]
push ebp
push edx
call fcn.00410600
add esp, 8
lea eax, [esp + 0x10]
push eax
call ebx
jmp 0x4106b2
lea ecx, [esp + 0x10]
push ecx
call fcn.004105c0
add esp, 4
lea edx, [esp + 0x114]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41065e
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x244
ret
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x244
ret

Function at 0x4106f0
Capabilities:
Set file attributes

Disassembly:
sub esp, 0x30c
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x118]
push ebx
push ebp
mov ebp, dword [esp + 0x318]
push esi
push edi
mov edi, ebp
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x128]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.bas.bas
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x12c]
xor esi, esi
push ecx
call fcn.00417385
mov edi, eax
add esp, 8
cmp edi, 0xffffffff
jne 0x41077b
mov esi, 1
lea edx, [esp + 0x128]
push edx
push str.BuscaraB__s
push 2
call fcn.0040c720
add esp, 0xc
test esi, esi
jne 0x410827
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov bl, 0x18
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x24]
push eax
push ecx
push str.dect_s_atrib_d
push 2
call fcn.0040c720
mov al, byte [esp + 0x20]
add esp, 0x10
test bl, al
jne 0x410811
lea edx, [esp + 0x24]
lea eax, [esp + 0x128]
push edx
push ebp
push 0x4287f4
push eax
call fcn.00416129
lea ecx, [esp + 0x138]
push ecx
push str.borrara_s
push 2
call fcn.0040c720
add esp, 0x1c
lea edx, [esp + 0x128]
push 0x80
push edx
call esi
lea eax, [esp + 0x128]
push eax
call fcn.0041737a
add esp, 4
lea ecx, [esp + 0x10]
push ecx
push edi
call fcn.0041744f
add esp, 8
test eax, eax
je 0x4107a2
push edi
call fcn.00417514
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30c
ret
Function at 0x410920
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
push esi
push edi
push str.copiar_file__s__s
push 1
xor ebx, ebx
call fcn.0040c720
push 0x430068
push edi
call fcn.0041f970
add esp, 0x18
test eax, eax
jne 0x410956
pop edi
pop esi
mov eax, 1
pop ebx
ret
push edi
call fcn.00410570
add esp, 4
test eax, eax
jne 0x41096d
pop edi
mov dword [0x42fde8], ebx
pop esi
pop ebx
ret
mov eax, dword [0x430794]
push ebp
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0x430794]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
call fcn.004105c0
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
add esp, 4
push ebx
push esi
push edi
call ebp
test eax, eax
jne 0x4109c7
push esi
call fcn.00410840
add esp, 4
push 0
push esi
push edi
call ebp
test eax, eax
jne 0x4109c7
mov dword [0x42fde8], eax
jmp 0x4109cc
mov ebx, 1
push 1
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov edi, dword [0x430ab4]
push ebx
inc edi
push str.res__d
push 1
mov dword [0x430ab4], edi
call fcn.0040c720
add esp, 0xc
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4110f0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push ebx
mov ebx, dword [esp + 0x28]
push ebp
push esi
push edi
push 2
push 0
push ebx
call fcn.00416651
push ebx
call fcn.004164f9
push 0
mov edi, eax
push 0
push ebx
mov dword [esp + 0x34], edi
call fcn.00416651
lea eax, [edi + 0xfa0]
push eax
call fcn.0041691b
push ebx
mov esi, eax
push edi
push 1
push esi
call fcn.004162d4
push ebx
call fcn.0041627e
add esp, 0x34
mov edi, str.FDACT001AA
mov eax, esi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [edi]
jne 0x411167
test cl, cl
je 0x411163
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [edi + 1]
jne 0x411167
add eax, 2
add edi, 2
test cl, cl
jne 0x411143
xor eax, eax
jmp 0x41116c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4112bd
mov al, byte [esi + 0x64]
mov cl, byte [esi + 0x65]
mov dl, byte [esi + 0x66]
mov byte [esp + 0x12], al
mov eax, dword [esi + 0x68]
mov byte [esp + 0x13], cl
cmp eax, 1
mov byte [esp + 0x11], dl
mov ebp, 0x6e
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], 1
jl 0x411269
mov eax, dword [esp + 0x18]
add eax, 0x3e8
mov dword [esp + 0x18], eax
mov edi, dword [esi + ebp]
mov eax, dword [esp + 0x18]
add ebp, 4
mov dword [esp + 0x1c], edi
lea ecx, [edi + ebp + 4]
cmp ecx, eax
jg 0x411269
mov al, byte [esp + 0x14]
mov bl, byte [esp + 0x12]
imul byte [esp + 0x11]
add al, bl
xor ecx, ecx
test edi, edi
jl 0x4111f7
lea edx, [esi + ebp]
mov bl, byte [edx + ecx]
xor bl, al
mov byte [edx + ecx], bl
mov bl, byte [esp + 0x13]
add al, bl
inc ecx
cmp ecx, edi
jle 0x4111e4
add ecx, ebp
lea ebx, [esi + ebp]
push 0x428ccc
push ebx
mov byte [ecx + esi], 0
call fcn.00417180
add esp, 8
test eax, eax
je 0x411215
mov byte [eax], 0
mov edx, dword [esp + 0x28]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push ebx
call fcn.0041ae30
add esp, 0xc
test eax, eax
jne 0x411248
mov edx, dword [esp + 0x28]
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [ecx + ebx], 0x3d
je 0x411282
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov ebx, dword [esp + 0x34]
inc eax
lea ebp, [edx + ebp + 0xa]
cmp eax, ecx
mov dword [esp + 0x14], eax
jle 0x4111b3
push ebx
call fcn.0041627e
push esi
call fcn.0041698f
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx + ebx + 1]
mov ecx, dword [esp + 0x2c]
push eax
push ecx
call fcn.00411080
mov edx, dword [esp + 0x3c]
push edx
call fcn.0041627e
push esi
call fcn.0041698f
add esp, 0x10
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
push ebx
call fcn.0041627e
push esi
call fcn.0041698f
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x411580
Capabilities:
Copy file

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x3e8
lea ecx, [esp + 0x1f4]
push esi
mov esi, dword [esp + 0x3f8]
push esi
push eax
push 0x4287f4
push ecx
call fcn.00416129
mov edx, dword [esp + 0x404]
push esi
push edx
lea eax, [esp + 0x1c]
push 0x4287f4
push eax
call fcn.00416129
add esp, 0x20
lea ecx, [esp + 4]
lea edx, [esp + 0x1f8]
push 0
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
pop esi
add esp, 0x3e8
ret

Function at 0x411720
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
push edi
mov ecx, 0x25
xor eax, eax
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
mov dword [esp + 4], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 8]
pop edi
cmp eax, 5
ja 0x411763
jne 0x41175a
cmp dword [esp + 8], 1
jae 0x411763
xor eax, eax
add esp, 0x94
ret
mov eax, 1
add esp, 0x94
ret
Function at 0x412600
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
push ebx
push ebp
push eax
push str.traiga_archivos__s__s__s
push 1
xor esi, esi
call fcn.0040c720
add esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x1c], eax
mov ecx, esi
push 0
and ecx, 0x80000001
push 1
jns 0x412641
dec ecx
or ecx, 0xfffffffe
inc ecx
mov edx, dword [esp + 0x1c]
push ecx
push ebx
push ebp
push edx
call fcn.00412370
add esp, 0x18
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
inc esi
cmp edi, 1
je 0x412674
cmp esi, 4
jge 0x412674
sub eax, dword [esp + 0x1c]
cmp eax, 0xea60
jb 0x41262e
cmp esi, 1
je 0x41262e
push edi
push str.res_d
push 1
call fcn.0040c720
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x412690
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
push ebx
push ebp
push eax
push str.traiga_archivos__s__s__s
push 1
xor esi, esi
call fcn.0040c720
add esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x1c], eax
lea ecx, [esp + 0x18]
mov edx, esi
push ecx
and edx, 0x80000001
push 2
jns 0x4126d4
dec edx
or edx, 0xfffffffe
inc edx
mov eax, dword [esp + 0x1c]
push edx
push ebx
push ebp
push eax
call fcn.00412370
add esp, 0x18
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
inc esi
cmp edi, 1
je 0x41270a
cmp esi, 4
jge 0x41270a
sub eax, dword [esp + 0x1c]
cmp eax, 0xc350
jae 0x41270a
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4126be
push edi
push str.res_d
push 1
call fcn.0040c720
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x412730
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
sub esp, 0x194
push esi
push edi
push str.instale_install
push 1
call fcn.0040c720
push 0x429438
lea eax, [esp + 0x18]
push str._sSoloDisc.exe
push eax
call fcn.00416129
lea ecx, [esp + 0x20]
push ecx
call fcn.00410570
add esp, 0x18
test eax, eax
jne 0x41284d
push 0x42f470
call fcn.00410fa0
mov edi, str.Instok
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
push ecx
push 0x42f470
push 0x4287f4
push 0x430068
call fcn.00416129
push 0x430068
call fcn.004105c0
mov edi, 0x42ab80
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x24]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x42f8d8
mov eax, ecx
mov esi, edi
mov edi, edx
push str._sSoloDisc.exe
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0x42fe34
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00416129
push 0x430068
call fcn.004103a0
lea ecx, [esp + 0x34]
push ecx
push 0x42f470
push 0x4287f4
push 0x430068
call fcn.00416129
push 0x430068
push 0x42fe34
call fcn.00410920
add esp, 0x40
lea edx, [esp + 0xc]
push edx
push 0x42f470
push str.__s_s_
push 0x430068
call fcn.00416129
add esp, 0x10
jmp 0x412864
lea eax, [esp + 0xc]
push eax
push str.__s_
push 0x430068
call fcn.00416129
add esp, 0xc
lea ecx, [esp + 8]
push ecx
push 0x2001f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4128ee
mov edi, str.__normal
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x430068
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x430068
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
push ecx
push 0x430068
push 1
push eax
mov eax, dword [esp + 0x18]
push str.BossD
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x4128ee
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
add esp, 0x194
ret
Function at 0x412ed0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push str.pida_ser_red
push 1
mov dword [esp + 0x18], ebx
call fcn.0040c720
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebp, dword [esp + 0x30]
mov dword [esp + 0x14], eax
mov edi, dword [esp + 0x1c]
or ecx, 0xffffffff
xor eax, eax
push 0x4304d8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebp
mov eax, ecx
mov esi, edi
shr ecx, 2
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x28]
or ecx, 0xffffffff
mov byte [ebp + 0x3c], bl
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
lea edi, [ebp + 0x46]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x2c]
or ecx, 0xffffffff
mov byte [ebp + 0x82], bl
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
lea edi, [ebp + 0x8c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x30]
or ecx, 0xffffffff
mov byte [ebp + 0xdc], bl
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
lea edi, [ebp + 0xe6]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + 0x15e], bl
call fcn.00412d20
add esp, 8
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [esp + 0x10]
inc edx
cmp esi, 1
mov dword [esp + 0x10], edx
je 0x412fd4
mov ecx, edx
cmp ecx, 4
jge 0x412fd4
sub eax, dword [esp + 0x14]
cmp eax, 0x1fbd0
jb 0x412efa
push esi
push str.ret_d
push 1
call fcn.0040c720
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x413180
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x1f4
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x208]
xor ebx, ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.pida_miniver
mov eax, ecx
mov esi, edi
mov edi, edx
push 1
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0040c720
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
add esp, 8
call edi
mov ebp, eax
lea ecx, [esp + 0x10]
push 0x4304d8
push ecx
call fcn.00412ff0
add esp, 8
mov esi, eax
call edi
inc ebx
cmp esi, 1
je 0x4131f7
cmp ebx, 4
jge 0x4131f7
sub eax, ebp
cmp eax, 0x7530
jb 0x4131cd
push esi
push str.ret_d
push 1
call fcn.0040c720
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1f4
ret
Function at 0x413220
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x12c
push str.ejecutara_discover
push 1
call fcn.0040c720
push 0x429438
lea eax, [esp + 0xc]
push str._sDiscover.exe
push eax
call fcn.00416129
lea ecx, [esp + 0x14]
push ecx
push str.ejecutara_disc_de__s
push 1
call fcn.0040c720
add esp, 0x20
lea edx, [esp]
push 5
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
add esp, 0x12c
ret

Function at 0x413350
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
push str.ponga_id_s
push 1
call fcn.0040c720
push esi
call fcn.0040c680
push esi
push str.cambia_por___s
push 2
call fcn.0040c720
add esp, 0x1c
lea eax, [esp + 8]
push eax
push 0x2001f
push 0
push str.SoftwareLeverITAgent
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4133b5
lea ecx, [esp + 8]
push ecx
push str.SoftwareLeverITAgent
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x4133b5
xor eax, eax
pop esi
ret
push edi
push esi
call fcn.0040d390
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0xc]
not ecx
push ecx
push esi
push 1
push eax
push 0x428b20
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
test esi, esi
sete al
pop esi
ret
Function at 0x413540
Capabilities:
Get common file path
Get hostname

Disassembly:
sub esp, 0x130
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x14]
push 0x12c
push eax
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, str.pcnfswin.ini
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x428954
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x18]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.004163dc
mov esi, eax
add esp, 8
test esi, esi
mov dword [esp + 0x10], esi
je 0x41368d
push esi
lea ecx, [esp + 0x18]
push 0x12c
push ecx
call fcn.00416798
add esp, 0xc
test eax, eax
je 0x413673
mov edi, str.Hostname
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebx, ecx
push ebx
push str.Hostname
push edx
call fcn.0041ae30
add esp, 0xc
test eax, eax
jne 0x413652
mov al, byte [esp + 0x14]
xor edi, edi
test al, al
lea esi, [esp + 0x14]
je 0x413623
mov al, byte [esi + 1]
inc edi
inc esi
test al, al
jne 0x4135fb
test edi, edi
jle 0x413623
movsx eax, byte [esi]
push eax
call fcn.00416770
add esp, 4
test eax, eax
jne 0x413620
dec edi
dec esi
test edi, edi
jg 0x413608
jmp 0x413623
mov byte [esi], 0
lea edi, [esp + ebx + 0x14]
or ecx, 0xffffffff
xor eax, eax
mov ebp, 1
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, dword [esp + 0x144]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x10]
test byte [esi + 0xc], 0x10
jne 0x413673
push esi
lea eax, [esp + 0x18]
push 0x12c
push eax
call fcn.00416798
add esp, 0xc
test eax, eax
jne 0x4135c5
push esi
call fcn.0041627e
add esp, 4
test ebp, ebp
je 0x41368d
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x130
ret
mov edx, dword [esp + 0x144]
lea ecx, [esp + 0x148]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x130
ret