joyce8/EMBER2024-capa huggingface dataset:
Function at 0x450d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x450d58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0x450d60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x450d94
mov eax, dword [esp + 0x14]
test eax, eax
je 0x450d94
push eax
push esi
call fcn.0045320b
add esp, 8
pop esi
ret 0x10

Function at 0x450da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x450e22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0x450e15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0x469320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00452dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0x450dda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0x450e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x450ec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0x450eb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0x469320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00452dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x450eab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0x450e6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0x451000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x451131
push esi
call fcn.00454145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00443080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x451131
push 0
push ebp
call fcn.004433a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00443260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x45108b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.004432f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x451121
push 0x469918
push edi
call fcn.004523f0
push eax
push ebx
push esi
call fcn.00450f60
push 0x4698f8
push edi
call fcn.004523f0
push eax
push ebx
push esi
call fcn.00450f60
push 0x4698d8
push edi
call fcn.004523f0
push eax
push ebx
push esi
call fcn.00450f60
push 0x4698c0
push edi
call fcn.004523f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00450f60
push 0x4698a0
push edi
call fcn.004523f0
push eax
push ebx
push esi
call fcn.00450f60
push 0x469888
push edi
call fcn.004523f0
push eax
push ebx
push esi
call fcn.00450f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x4521b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00452140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00452140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00452140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00452140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x452bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x452c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x46487c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x452c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x452c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x4bea50
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6b000]
push edi
or ebp, 0xffffffff
jmp 0x4bea72
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4bea79
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4bea68
mov eax, 1
add ebx, ebx
jne 0x4bea8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4bea9c
jne 0x4beaac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4beaac
dec eax
add ebx, ebx
jne 0x4beaa8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4bea80
xor ecx, ecx
sub eax, 3
jb 0x4beac4
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4beb36
sar eax, 1
mov ebp, eax
jmp 0x4beacf
add ebx, ebx
jne 0x4beacf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4beadc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4beb00
inc ecx
add ebx, ebx
jne 0x4beaec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4beae1
jne 0x4beafd
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4beae1
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4beb20
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4beb11
jmp 0x4bea6e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4beb20
add edi, ecx
jmp 0x4bea6e
pop esi
mov edi, esi
mov ecx, 0x325e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4beb3e
cmp byte [edi], 0x19
jne 0x4beb3e
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x4beb43
lea edi, [esi + 0xbb000]
mov eax, dword [edi]
or eax, eax
je 0x4bebb2
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xbf128]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xbf1c8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4beb70
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xbf1cc]
or eax, eax
je 0x4bebac
mov dword [ebx], eax
add ebx, 4
jmp 0x4beb8d
call dword [esi + 0xbf1d0]
popal
jmp 0x465818
Function at 0x405ef4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a34], 0
push esi
jne 0x405f2b
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f05
mov dword [ecx*4 + 0x422a30], eax
inc ecx
cmp ecx, 0x100
jl 0x405f00
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f5c
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a30]
xor eax, esi
inc ecx
dec edx
jne 0x405f3e
pop edi
not eax
pop esi
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x55bc4a
Capabilities:
Encode data using xor

Disassembly:
jmp 0x543d27
xor ecx, ecx
cmp dword [esp + 8], ecx
jbe 0x543d43
mov edx, dword [esp + 4]
movzx edx, byte [ecx + edx]
rol eax, 7
xor eax, edx
inc ecx
cmp ecx, dword [esp + 8]
jb 0x543d2f
jmp 0x543d4e
ret
jmp 0x543d1c

Function at 0x570a2c
Capabilities:
Encrypt data using aes

Disassembly:
shr edi, 0x18
mov bp, 0xc1b7
mov bp, word [esp]
movzx edi, byte [edi*4 + 0x54bd8c]
jmp 0x570a59
pop ebp
sub esp, 2
lea esp, [esp + 2]
jmp 0x570a08
and edi, esi
adc bp, di
cmc
neg ebp
shr bp, cl
jmp 0x570ab9
and edi, ebp
clc
sub esp, 1
lea esp, [esp + 1]
jmp 0x570a9f
xor eax, edi
mov edi, edx
xor ebp, 0x49ce
not bp
jmp 0x570a36
xor eax, edi
pushfd
mov edi, dword [esp + 3]
jmp 0x570afa
mov edi, dword [edi*4 + reloc.KERNEL32.dll_GetProcAddress]
mov ebp, 0xff00
clc
jmp 0x570a43
push edi
lea esp, [esp + 4]
lea edi, [ecx + 0x10]
sub esp, 0x17
lea esp, [esp + 4]
xor eax, dword [ecx]
neg di
dec edi
neg edi
jmp 0x570ae2

Function at 0x59534e
Capabilities:
Encode data using xor

Disassembly:
add dword [edi - reloc.KERNEL32.dll_GetProcAddress], edi
rcl byte [edi - 1]
xor al, 0x24
push edi
push dword [esp]
lea esp, [esp + 8]
test dl, dl
call fcn.0059530c
out dx, eax
jge 0x595333
je 0x5952cf
inc edi
mov edi, 0xb8e4210b
lea esp, [esp + 8]
inc ecx
jmp 0x595334
Function at 0x611e2b
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
mov dword [esp + 0x25], esi
mov word [esp + 0x25], dx
jmp 0x611e0c
Function at 0x1002337
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push esi
lea eax, [ebp - 0xd8]
push edi
push eax
mov dword [ebp - 0xd8], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
xor eax, eax
cmp dword [ebp - 0xc8], 2
sete al
mov dword [0x100c210], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x100238c
mov al, byte [esi + 1]
inc esi
test al, al
je 0x1002384
cmp al, 0x22
jne 0x1002378
cmp byte [esi], 0x22
jne 0x1002396
inc esi
jmp 0x1002396
cmp al, 0x20
je 0x1002396
inc esi
cmp byte [esi], 0x20
jne 0x1002390
mov al, byte [esi]
test al, al
je 0x10023a3
cmp al, 0x20
jg 0x10023a3
inc esi
jmp 0x1002396
and dword [ebp - 0x44], 0
push 0x10
pop ecx
xor eax, eax
lea edi, [ebp - 0x40]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x18], 1
je 0x10023c7
movzx eax, word [ebp - 0x14]
jmp 0x10023ca
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x10025cf
Capabilities:
Check mutex on windows

Disassembly:
push esi
push edi
push 0x1001310
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x10025f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x10025f8
push 1
pop edi
jmp 0x10025fa
xor edi, edi
test esi, esi
je 0x1002605
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
ret

Function at 0x1004614
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
and dword [ebp - 4], 0
push 2
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x1004683
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
mov edi, eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x1004683
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x100467c
push edi
call fcn.0100338b
test eax, eax
pop ecx
mov dword [ebp - 4], eax
je 0x100467c
mov ecx, edi
mov edi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x1006f39
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
cmp dword [0x100c210], 0
push esi
push edi
jne 0x1006f8d
mov edi, dword [sym.imp.USER32.dll_GetWindow]
push 0
push dword [ecx + 8]
call edi
mov esi, eax
test esi, esi
je 0x1006f92
push esi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
test eax, eax
jle 0x1006f88
lea eax, [ebp - 0x28]
push 0x28
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 0x28]
push 0x1001b7c
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1006f8d
push 2
push esi
jmp 0x1006f55
push 1
pop eax
jmp 0x1006f94
xor eax, eax
pop edi
pop esi
leave
ret

Function at 0x10073a4
Capabilities:
Log keystrokes via application hook

Disassembly:
mov eax, dword [0x100c208]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push edi
mov edi, dword [eax]
call esi
push eax
push edi
mov edi, dword [sym.imp.USER32.dll_SetWindowsHookExA]
push 0x10073e9
push 2
call edi
mov dword [0x100c240], eax
mov eax, dword [0x100c208]
mov ebx, dword [eax]
call esi
push eax
push ebx
push 0x1007499
push 7
call edi
pop edi
pop esi
mov dword [0x100c244], eax
pop ebx
ret
Function at 0x100858b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push ebx
push esi
push edi
push ecx
lea ecx, [ebp - 0x14]
call fcn.0100806c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
lea ecx, [ebp - 0x94]
push esi
call fcn.01002f3f
xor edi, edi
push edi
push edi
push esi
push dword [ebp - 0x94]
push 0xffffffffffffffff
push dword [ebp + 8]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 2
push edi
push dword [ebp - 0x94]
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
cmp eax, edi
mov dword [ebp + 8], eax
je 0x100860a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebx, eax
cmp ebx, edi
je 0x100860a
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
cmp esi, edi
jne 0x100862c
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
je 0x1008628
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x1008689
xor esi, esi
jmp 0x1008689
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
cmp byte [ebx + esi], 0
je 0x1008669
lea edi, [ebx + 1]
push edi
call fcn.01003322
pop ecx
mov ecx, edi
mov edi, eax
mov edx, ecx
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
and byte [ebx + eax], 0
mov esi, eax
call fcn.01003371
pop ecx
xor edi, edi
push dword [ebp + 0x18]
lea ecx, [ebp - 0x14]
push esi
call fcn.01008306
mov esi, eax
cmp esi, edi
jge 0x1008689
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov ecx, dword [ebp - 4]
mov dword [eax + 4], ecx
cmp dword [ebp + 8], edi
je 0x1008697
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0x94], edi
je 0x10086b1
test byte [ebp - 0x18], 1
je 0x10086b1
push dword [ebp - 0x94]
call fcn.01003371
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x40117c
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
and byte [ebp - 0x208], 0
push esi
mov edx, 0x81
push edi
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x207]
and byte [ebp - 0x410], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x40f]
cmp dword [ebp + 0x18], 0xa
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
je 0x401272
mov esi, dword [ebp + 8]
push dword [ebp + 0x14]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push dword [esi + 0xc]
call edi
push dword [esi + 0xc]
call fcn.00406708
test eax, eax
pop ecx
jne 0x401296
lea eax, [ebp - 0x208]
push 0x208
push eax
push 0xfffffffffffffffa
call fcn.00409219
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x208]
push 0x5c
push eax
call fcn.00406a88
and byte [eax + 1], 0
pop ecx
pop ecx
lea eax, [ebp - 0x410]
push eax
push dword [esi + 0xc]
call fcn.0040a004
pop ecx
lea eax, [ebp - 0x410]
pop ecx
push eax
lea eax, [ebp - 0x208]
push eax
call edi
mov eax, dword [esi + 0x20]
inc eax
push eax
lea eax, [ebp - 0x208]
push eax
push dword [ebp + 0x14]
push dword [esi + 0x24]
call fcn.00401792
add esp, 0x10
test eax, eax
jne 0x401276
push 1
mov word [esi + 0x38], 3
call fcn.00410ff0
pop ecx
xor eax, eax
jmp 0x401299
push 0
lea eax, [ebp - 0x208]
push dword [esi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0x80
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 1
pop eax
pop edi
pop esi
leave
ret
Function at 0x40373c
Capabilities:
Create directory
Set file attributes

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
push edi
call fcn.004036d5
test eax, eax
pop ecx
je 0x40377b
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov esi, eax
test esi, esi
jne 0x40376d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40377b
test esi, esi
je 0x403776
push 2
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 1
pop eax
jmp 0x40377d
xor eax, eax
pop edi
pop esi
ret

Function at 0x403780
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
push edi
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x4037df
movsx eax, byte [0x424aa0]
mov esi, dword [sym.imp.USER32.dll_CharUpperA]
push eax
call esi
mov ebx, eax
movsx eax, byte [edi]
push eax
call esi
cmp ebx, eax
je 0x4037e3
call fcn.00409c5e
test eax, eax
je 0x4037e3
push edi
call fcn.0040373c
test eax, eax
pop ecx
jne 0x4037e3
push dword [0x4238a0]
push 0x41c1cc
push 1
push 0x40
push 1
call fcn.00405290
add esp, 0x14
xor eax, eax
jmp 0x4037e6
push 1
pop eax
pop edi
pop esi
pop ebx
ret

Function at 0x4037ea
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
push esi
xor esi, esi
cmp dword [0x4210a8], esi
jne 0x4038c4
cmp dword [ebp + 8], esi
mov eax, dword [0x4243f8]
jne 0x40380e
mov eax, dword [0x42389c]
push eax
push 0x41c25c
push 6
push 0x34
push 2
call fcn.00405290
add esp, 0x14
cmp eax, 6
jne 0x4038c4
call fcn.00409c47
test eax, eax
je 0x40389a
lea eax, [ebp + 8]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x403859
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenProcessToken_Error__d_in_fDoReboot__.
jmp 0x4038b3
lea eax, [ebp - 0xc]
push eax
push str.SeShutdownPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push esi
push esi
lea eax, [ebp - 0x10]
push esi
push eax
push esi
push dword [ebp + 8]
mov dword [ebp - 0x10], 1
mov dword [ebp - 4], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x40389a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.AdjustTokenPrivileges_Error__d_in_fDoReboot
jmp 0x4038b3
push esi
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x4038c4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error_ExitWindows_Error__d
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
xor eax, eax
jmp 0x4038c7
push 1
pop eax
pop esi
leave
ret
Function at 0x403a8d
Capabilities:
Persist via run registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
push edi
push 0xc
pop ecx
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
lea edi, [ebp - 0x3c]
xor ebx, ebx
rep movsd dword es:[edi], dword [esi]
cmp dword [0x4210c0], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
movsw word es:[edi], word [esi]
jne 0x403abd
cmp dword [0x4210c4], ebx
je 0x403b03
lea eax, [ebp - 4]
push eax
push 1
lea eax, [ebp - 0x3c]
push ebx
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x403b03
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x403afa
cmp dword [ebp - 8], ebx
jbe 0x403afa
push 1
pop ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret

Function at 0x405bec
Capabilities:
Create directory

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
push 1
pop edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x405c12
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x405c6a
xor edi, edi
push esi
call fcn.00403c4f
pop ecx
push eax
push str.CreateDir
call fcn.00404f71
pop ecx
pop ecx
push 0xfffffffffffffffe
pop ebx
cmp eax, ebx
je 0x405c5b
test edi, edi
je 0x405c3c
call fcn.00404eea
cmp eax, ebx
jne 0x405c6a
jmp 0x405c5b
push esi
push 0x41c058
push dword [0x423658]
call fcn.00403c7b
add esp, 0xc
push eax
call fcn.00404f1f
cmp eax, ebx
pop ecx
jne 0x405c5f
mov eax, ebx
jmp 0x405c6c
call fcn.00404ec5
cmp eax, ebx
mov eax, ebx
je 0x405c6c
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x405d54
Capabilities:
Get file size

Disassembly:
push ebx
push esi
push edi
xor edi, edi
push edi
push edi
push 3
push edi
push edi
push SysReAllocStringLen
push dword [esp + 0x28]
or ebx, 0xffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x405d89
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, 0xffffffff
jne 0x405dab
push dword [esp + 0x10]
push dword [0x424418]
push str._s_n_s
push 1
push 0x10
push 1
call fcn.00405290
add esp, 0x18
pop edi
mov eax, ebx
pop esi
pop ebx
ret