joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406160
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
sub esp, 0x10c
lea eax, [esp]
lea ecx, [esp + 8]
push eax
lea edx, [esp + 8]
push ecx
push edx
push str.ProgramFilesDir
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push 0x80000002
mov dword [esp + 0x1c], 1
mov dword [esp + 0x18], 0x104
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
je 0x4061be
mov eax, dword [esp]
lea ecx, [esp + 8]
push eax
push ecx
push str.ProgramFiles
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x4061be
add esp, 0x10c
ret
mov ecx, dword [esp + 0x114]
push esi
cmp ecx, 0x7fffffff
ja 0x406207
mov eax, dword [esp + 0x114]
mov esi, ecx
test ecx, ecx
je 0x406207
lea edx, [esp + 0xc]
sub edx, eax
mov cl, byte [edx + eax]
test cl, cl
je 0x4061ff
mov byte [eax], cl
inc eax
dec esi
jne 0x4061e1
dec eax
pop esi
mov byte [eax], 0
mov eax, 1
add esp, 0x10c
ret
test esi, esi
jne 0x406204
dec eax
mov byte [eax], 0
mov eax, 1
pop esi
add esp, 0x10c
ret

Function at 0x406260
Capabilities:
Check if file exists
Delete file
Get common file path
Move file
Set file attributes

Disassembly:
sub esp, 0x208
push esi
mov esi, dword [esp + 0x210]
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
push esi
call edi
test eax, eax
jne 0x406285
pop edi
pop esi
add esp, 0x208
ret
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call edi
test eax, eax
je 0x406330
call fcn.00406110
test eax, eax
je 0x406317
lea eax, [esp + 0x10c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [esp + 8]
lea edx, [esp + 0x10c]
push ecx
push 0
push str._del_
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea eax, [esp + 8]
push 1
push eax
push esi
call edi
test eax, eax
push 4
push 0
je 0x406306
lea ecx, [esp + 0x10]
push ecx
call edi
pop edi
mov eax, 2
pop esi
add esp, 0x208
ret
push esi
call edi
pop edi
mov eax, 2
pop esi
add esp, 0x208
ret
push esi
call fcn.00406340
add esp, 4
neg eax
sbb eax, eax
pop edi
neg eax
inc eax
pop esi
add esp, 0x208
ret
pop edi
mov eax, 1
pop esi
add esp, 0x208
ret
Function at 0x406470
Capabilities:
Get common file path

Disassembly:
sub esp, 0x108
lea eax, [esp + 4]
push 0x103
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x406542
cmp eax, 0x103
ja 0x406542
push esi
push edi
lea edi, [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [esp + ecx + 0xb], 0x5c
je 0x406508
mov ecx, 0x104
lea eax, [esp + 0xc]
cmp byte [eax], 0
je 0x4064c4
inc eax
dec ecx
jne 0x4064b9
jmp 0x406508
test ecx, ecx
je 0x406508
lea edx, [esp + 8]
test edx, edx
je 0x4064d9
mov eax, 0x104
sub eax, ecx
jmp 0x4064dd
mov eax, dword [esp + 8]
mov edx, 0x104
sub edx, eax
lea eax, [esp + eax + 0xc]
je 0x406508
mov esi, 0x419800
sub esi, eax
mov cl, byte [esi + eax]
test cl, cl
je 0x406500
mov byte [eax], cl
inc eax
dec edx
jne 0x4064f1
jmp 0x406504
test edx, edx
jne 0x406505
dec eax
mov byte [eax], 0
mov esi, dword [esp + 0x118]
mov edi, dword [esp + 0x114]
lea eax, [esp + 0xc]
push str.wininit.ini
push eax
push 0x419584
push esi
push edi
call fcn.00409880
add esp, 0x14
mov byte [edi + esi - 1], 0
mov eax, 1
pop edi
pop esi
add esp, 0x108
ret
xor eax, eax
add esp, 0x108
ret

Function at 0x406550
Capabilities:
Check if file exists
Delete file
Get common file path
Move file

Disassembly:
sub esp, 0x208
push esi
mov esi, dword [esp + 0x210]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x406571
pop esi
add esp, 0x208
ret
push esi
call fcn.00406260
add esp, 4
call fcn.00406110
test eax, eax
je 0x40660e
mov dl, byte [0x41d744]
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x10d]
mov byte [esp + 0x10c], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x10c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea edx, [esp + 0x114]
push 0x419804
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
pop edi
je 0x40660e
push 4
lea ecx, [esp + 8]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov eax, 1
pop esi
add esp, 0x208
ret
Function at 0x406620
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
sub esp, 0x554
push ebp
push esi
mov esi, dword [esp + 0x564]
test esi, esi
je 0x406806
cmp byte [esi], 0
je 0x406806
cmp byte [esi + 1], 0x3a
jne 0x406806
mov eax, dword [esp + 0x560]
mov ebp, dword [sym.imp.SHLWAPI.dll_PathCombineA]
push eax
lea ecx, [esp + 0x45c]
push esi
push ecx
mov dword [esp + 0x18], 0x80
call ebp
lea edx, [esp + 0xc]
lea eax, [esp + 0x458]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 8], eax
je 0x406806
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
cmp byte [esp + 0x40], 0x2e
jne 0x4066b6
mov al, byte [esp + 0x41]
test al, al
je 0x4067d7
cmp al, 0x2e
jne 0x4066b6
mov al, byte [esp + 0x42]
test al, al
je 0x4067d7
test byte [esp + 0x14], 0x10
jne 0x406776
mov dl, byte [0x41d744]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x259]
mov byte [esp + 0x258], dl
mov byte [esp + 0x154], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x155]
lea edx, [esp + 0x258]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x40]
stosw word es:[edi], ax
push ecx
push esi
push edx
stosb byte es:[edi], al
call ebp
lea eax, [esp + 0x154]
push 0x104
lea ecx, [esp + 0x25c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea edx, [esp + 0x154]
push edx
call ebx
test eax, eax
jne 0x4067d7
lea eax, [esp + 0x154]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [esp + 0x154]
push ecx
call ebx
test eax, eax
jne 0x4067d7
mov eax, dword [esp + 0x574]
test eax, eax
je 0x4067d7
lea edx, [esp + 0x154]
push edx
call fcn.00406260
add esp, 4
jmp 0x4067d7
mov eax, dword [esp + 0x570]
test eax, eax
je 0x4067d7
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x35c]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x40]
lea ecx, [esp + 0x35c]
push eax
push esi
push ecx
call ebp
mov edx, dword [esp + 0x574]
mov eax, dword [esp + 0x570]
push edx
mov edx, dword [esp + 0x56c]
lea ecx, [esp + 0x360]
push eax
push ecx
push edx
call fcn.00406620
add esp, 0x10
lea eax, [esp + 0x35c]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov edi, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x406693
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop ebx
pop esi
mov eax, 1
pop ebp
add esp, 0x554
ret
pop esi
xor eax, eax
pop ebp
add esp, 0x554
ret
Function at 0x406820
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x248
mov al, byte [0x41d744]
push ebx
push ebp
push edi
mov byte [esp + 0x10], al
mov ebx, dword [esp + 0x258]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x11]
push ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str._s.
lea ecx, [esp + 0x18]
push 0x103
push ecx
stosb byte es:[edi], al
xor ebp, ebp
call fcn.00409880
add esp, 0x10
lea edx, [esp + 0x114]
lea eax, [esp + 0x10]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40688b
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0x248
ret
mov edi, dword [esp + 0x25c]
push esi
mov esi, dword [esp + 0x264]
cmp byte [esp + 0x144], 0x2e
jne 0x4068c6
mov al, byte [esp + 0x145]
test al, al
je 0x40695e
cmp al, 0x2e
jne 0x4068c6
mov al, byte [esp + 0x146]
test al, al
je 0x40695e
mov al, byte [esp + 0x118]
lea ecx, [esp + 0x144]
test al, 0x10
push ecx
je 0x406909
push ebx
push str._s_s
lea edx, [esp + 0x20]
push 0x103
push edx
call fcn.00409880
push esi
lea eax, [esp + 0x2c]
push edi
push eax
call fcn.00406820
add esp, 0x20
mov ebp, eax
test esi, esi
jne 0x40695e
test ebp, ebp
jne 0x40697f
jmp 0x40695e
push 0x419808
lea edx, [esp + 0x1c]
push 0x103
push edx
call fcn.00409880
add esp, 0x10
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x40695e
test esi, esi
je 0x40697a
lea ecx, [esp + 0x144]
lea edx, [esp + 0x14]
push ecx
push ebx
push str._s_s
push 0x103
push edx
call fcn.00409880
lea eax, [esp + 0x28]
push eax
call fcn.00406260
add esp, 0x18
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x118]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x40697f
jmp 0x40689a
mov ebp, 1
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
pop esi
mov eax, ebp
pop edi
pop ebp
pop ebx
add esp, 0x248
ret

Function at 0x406c80
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x41da3c]
push esi
mov esi, dword [esp + 8]
push edi
xor edi, edi
cmp eax, esi
jne 0x406c9b
pop edi
mov eax, 1
pop esi
ret 4
call fcn.00406110
test eax, eax
push esi
push 0
je 0x406cab
push 1
jmp 0x406cb0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x406cce
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
ret 4
Function at 0x406fb0
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x14
lea eax, [esp]
push esi
push eax
push 0x28
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x407011
lea ecx, [esp + 0xc]
mov dword [esp + 8], 1
push ecx
push str.SeDebugPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [esp + 4]
push esi
push esi
lea edx, [esp + 0x10]
push 0x10
push edx
push esi
push eax
mov dword [esp + 0x2c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ecx, dword [esp + 4]
mov esi, eax
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
add esp, 0x14
ret
Function at 0x4070a0
Capabilities:
Delete file
Delete registry key
Get common file path
Query or enumerate registry value

Disassembly:
sub esp, 0x314
mov dl, byte [0x41d744]
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x115]
mov byte [esp + 0x114], dl
mov byte [esp + 0x218], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x219]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x320]
lea ecx, [esp + 0x114]
push eax
push str.SYSTEMCurrentControlSetServices
push str._s_s
push 0x103
push ecx
call fcn.00409880
add esp, 0x14
lea edx, [esp + 0xc]
lea eax, [esp + 0x218]
lea ecx, [esp + 8]
push edx
push eax
push ecx
lea edx, [esp + 0x120]
push str.ImagePath
push edx
push 0x80000002
mov dword [esp + 0x20], 1
mov dword [esp + 0x24], 0x104
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x407249
lea eax, [esp + 0x218]
push 0x5c
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
mov esi, eax
add esp, 8
test esi, esi
je 0x407249
mov cl, byte [0x41d744]
xor eax, eax
mov byte [esp + 0x10], cl
mov ecx, 0x40
lea edi, [esp + 0x11]
lea edx, [esp + 0x10]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x103
push edx
inc esi
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov ecx, 0x104
lea eax, [esp + 0x10]
cmp byte [eax], 0
je 0x4071a7
inc eax
dec ecx
jne 0x40719c
jmp 0x4071eb
test ecx, ecx
je 0x4071eb
lea eax, [esp + 8]
test eax, eax
je 0x4071bc
mov eax, 0x104
sub eax, ecx
jmp 0x4071c0
mov eax, dword [esp + 8]
mov edx, 0x104
sub edx, eax
lea eax, [esp + eax + 0x10]
je 0x4071eb
mov edi, str.drivers_
sub edi, eax
mov cl, byte [edi + eax]
test cl, cl
je 0x4071e3
mov byte [eax], cl
inc eax
dec edx
jne 0x4071d4
jmp 0x4071e7
test edx, edx
jne 0x4071e8
dec eax
mov byte [eax], 0
mov ecx, 0x104
lea eax, [esp + 0x10]
cmp byte [eax], 0
je 0x4071ff
inc eax
dec ecx
jne 0x4071f4
jmp 0x40723e
test ecx, ecx
je 0x40723e
lea edx, [esp + 8]
test edx, edx
je 0x407214
mov eax, 0x104
sub eax, ecx
jmp 0x407218
mov eax, dword [esp + 8]
mov edx, 0x104
sub edx, eax
lea eax, [esp + eax + 0x10]
je 0x40723e
sub esi, eax
mov cl, byte [esi + eax]
test cl, cl
je 0x407236
mov byte [eax], cl
inc eax
dec edx
jne 0x407227
jmp 0x40723a
test edx, edx
jne 0x40723b
dec eax
mov byte [eax], 0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x114]
push ecx
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
pop edi
mov eax, 1
pop esi
add esp, 0x314
ret
Function at 0x4072a0
Capabilities:
Modify service
Stop service

Disassembly:
sub esp, 0x1c
push esi
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ecx, dword [esp + 0x24]
push 0xf003f
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x4072cc
pop esi
add esp, 0x1c
ret
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 4
push 0xffffffffffffffff
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
test eax, eax
jne 0x4072f0
pop esi
add esp, 0x1c
ret
lea edx, [esp + 4]
push edx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
pop esi
add esp, 0x1c
ret

Function at 0x407310
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
sub esp, 0xd0
push ebp
push esi
push edi
mov edi, dword [esp + 0xe0]
push edi
xor esi, esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x40741e
push esi
push 0x80
push 3
push esi
push 5
push 0x80000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x40741e
push ebx
mov ecx, 0x32
xor eax, eax
lea edi, [esp + 0x18]
push esi
push ebp
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, dword [esp + 0xe8]
mov dword [esp + 0x14], esi
mov ecx, dword [ebx]
test ecx, ecx
je 0x407382
cmp eax, ecx
jne 0x40740a
mov dword [esp + 0x10], 0
add ebx, 0xc
mov eax, dword [ebx - 4]
test eax, eax
je 0x40740a
cmp dword [ebx], 0
je 0x40740a
mov eax, dword [ebx - 8]
push 0
push 0
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x4073e3
mov edx, dword [ebx]
lea ecx, [esp + 0x14]
push 0
push ecx
lea eax, [esp + 0x20]
push edx
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4073e3
mov ecx, dword [ebx]
mov eax, dword [esp + 0x14]
cmp eax, ecx
jne 0x4073e3
mov edi, dword [ebx - 4]
lea esi, [esp + 0x18]
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x407408
mov esi, 1
mov eax, dword [esp + 0x10]
add ebx, 0xc
inc eax
cmp eax, 5
mov dword [esp + 0x10], eax
jl 0x40738d
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
mov eax, esi
pop edi
pop esi
pop ebp
add esp, 0xd0
ret
xor esi, esi
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
mov eax, esi
pop edi
pop esi
pop ebp
add esp, 0xd0
ret
mov eax, esi
pop edi
pop esi
pop ebp
add esp, 0xd0
ret
Function at 0x4077c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10c
lea eax, [esp]
push esi
mov esi, dword [esp + 0x114]
push eax
push 0x20019
push 0
push str.software_tencentqq
push 0x80000002
mov byte [esi], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4077fb
xor eax, eax
pop esi
add esp, 0x10c
ret
test esi, esi
mov dword [esp + 8], 0x104
jne 0x40780b
lea esi, [esp + 0xc]
mov edx, dword [esp + 4]
lea ecx, [esp + 8]
push ecx
push esi
push 0
push 0
push str.install
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
setne al
pop esi
add esp, 0x10c
ret
Function at 0x407ab0
Capabilities:
Check if file exists
Get common file path
Query or enumerate registry value

Disassembly:
sub esp, 0x210
mov al, byte [0x41d744]
push edi
mov byte [esp + 0xc], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.00406110
test eax, eax
pop edi
je 0x407b4b
lea ecx, [esp + 4]
lea edx, [esp + 0x10c]
push ecx
lea eax, [esp + 4]
push edx
push eax
push str.DataBasePath
push str.SYSTEMCurrentControlSetServicesTcpipParameters
push 0x80000002
mov dword [esp + 0x18], 2
mov dword [esp + 0x1c], 0x104
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x407b2f
lea ecx, [esp + 0x10c]
push str.Hosts
lea edx, [esp + 0xc]
push ecx
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
jmp 0x407b6b
lea eax, [esp + 8]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 8]
push str.DriversetcHosts
push ecx
jmp 0x407b65
lea edx, [esp + 8]
push 0x104
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [esp + 8]
push str.Hosts
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
mov ecx, dword [esp + 0x218]
push esi
cmp ecx, 0x7fffffff
ja 0x407ba5
mov eax, dword [esp + 0x218]
mov esi, ecx
test ecx, ecx
je 0x407ba5
lea edx, [esp + 0xc]
sub edx, eax
mov cl, byte [edx + eax]
test cl, cl
je 0x407b9d
mov byte [eax], cl
inc eax
dec esi
jne 0x407b8e
jmp 0x407ba1
test esi, esi
jne 0x407ba2
dec eax
mov byte [eax], 0
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
pop esi
je 0x407bd0
lea edx, [esp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
jne 0x407bd0
mov eax, 1
add esp, 0x210
ret
xor eax, eax
add esp, 0x210
ret

Function at 0x407cf0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x5c
push esi
push edi
push 0x1000
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
add esp, 4
test esi, esi
jne 0x407d0e
pop edi
pop esi
add esp, 0x5c
ret
mov eax, dword [esp + 0x68]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x407d43
push esi
call fcn.00413190
add esp, 4
xor eax, eax
pop edi
pop esi
add esp, 0x5c
ret
lea ecx, [esp + 0xc]
push ebx
push ecx
call fcn.00411330
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
add esp, 4
lea edx, [esp + 0xc]
mov dword [esp + 0xc], 0x1000
push 0
push edx
push 0x1000
push esi
push edi
call ebx
test eax, eax
je 0x407da6
mov eax, dword [esp + 0xc]
test eax, eax
je 0x407da6
push eax
lea eax, [esp + 0x14]
push esi
push eax
call fcn.00410a20
add esp, 0xc
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x1000
push 0
push ecx
push 0x1000
push esi
push edi
call ebx
test eax, eax
jne 0x407d73
push esi
call fcn.00413190
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x70]
lea edx, [esp + 0x10]
push edx
push eax
call fcn.00410b1f
add esp, 8
mov eax, 1
pop ebx
pop edi
pop esi
add esp, 0x5c
ret
Function at 0x407de0
Capabilities:
Delete file
Enumerate processes

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x230
lea ecx, [esp + 0x12c]
lea eax, [esp + 0x12c]
push ebp
push esi
xor ebp, ebp
mov esi, 0x104
sub edx, ecx
mov cl, byte [edx + eax]
test cl, cl
je 0x407e12
mov byte [eax], cl
inc eax
dec esi
jne 0x407e03
jmp 0x407e16
test esi, esi
jne 0x407e17
dec eax
lea edx, [esp + 0x134]
push 0x5c
push edx
mov byte [eax], 0
call dword [sym.imp.MSVCRT.dll__mbsrchr]
mov esi, eax
add esp, 8
test esi, esi
jne 0x407e3c
pop esi
pop ebp
add esp, 0x230
ret
push ebx
push edi
push 0
push 2
inc esi
mov dword [esp + 0x1c], pe_nt_image_headers32
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], eax
push ecx
push eax
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x407ed9
mov ebx, dword [sym.imp.MSVCRT.dll_strstr]
mov edi, dword [sym.imp.MSVCRT.dll__strlwr]
lea edx, [esp + 0x38]
push edx
call edi
add esp, 4
push eax
push esi
call edi
add esp, 4
push eax
call ebx
add esp, 8
test eax, eax
jne 0x407e9f
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x407e6f
jmp 0x407ed9
mov edx, dword [esp + 0x1c]
push edx
call fcn.00406c80
test eax, eax
jne 0x407eb1
xor ebp, ebp
jmp 0x407ed9
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
mov eax, dword [esp + 0x244]
push eax
call edi
mov ebp, eax
test ebp, ebp
jne 0x407ed9
push 0xa
call ebx
inc esi
cmp esi, 0x32
jb 0x407ebf
mov eax, dword [esp + 0x10]
pop edi
test eax, eax
pop ebx
je 0x407eea
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebp
pop esi
pop ebp
add esp, 0x230
ret
Function at 0x407f00
Capabilities:
Parse pe header
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x13c
test eax, eax
push ebx
push ebp
push esi
push edi
je 0x40804c
mov ecx, dword [esp + 0x15c]
test ecx, ecx
je 0x40804c
mov ecx, dword [esp + 0x160]
test ecx, ecx
je 0x40804c
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40804c
mov edi, dword [esp + 0x154]
test edi, edi
jne 0x407f64
lea edi, [esp + 0x14]
mov ebp, dword [esp + 0x158]
test ebp, ebp
jne 0x407f73
lea ebp, [esp + 0x54]
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [esp + 0x10]
push 0
push eax
push 0x40
push edi
push esi
call ebx
test eax, eax
je 0x408045
cmp dword [esp + 0x10], 0x40
jne 0x408045
cmp word [edi], 0x5a4d
jne 0x408045
mov ecx, dword [edi + 0x3c]
push 0
push 0
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, dword [edi + 0x3c]
jne 0x408045
lea edx, [esp + 0x10]
push 0
push edx
push 0xf8
push ebp
push esi
call ebx
test eax, eax
je 0x408045
cmp dword [esp + 0x10], 0xf8
jne 0x408045
cmp dword [ebp], 0x4550
jne 0x408045
cmp word [ebp + 6], 0
je 0x408045
xor eax, eax
push 1
mov ax, word [ebp + 0x14]
push 0
sub eax, 0xe0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x160]
lea ecx, [esp + 0x10]
push 0
push ecx
lea edx, [eax + eax*4]
mov eax, dword [esp + 0x164]
shl edx, 3
push edx
push eax
push esi
call ebx
test eax, eax
je 0x408045
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xcccccccd
pop edi
mul dword [esp + 0xc]
mov eax, edx
pop esi
pop ebp
pop ebx
shr eax, 5
add esp, 0x13c
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x13c
ret