joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41d326
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4310a0]
jne 0x41d330
repz ret
jmp fcn.004206ea

Function at 0x42584c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4310a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0041ff22
and dword [ebp - 0x14], 0
cmp dword [0x46a2a0], 0
mov dword [ebp - 0x18], eax
jne 0x4258ff
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4259a7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4259a7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x46a2a0], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x46a2a4], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x46a2a8], eax
call edi
push eax
call esi
mov dword [0x46a2b0], eax
test eax, eax
je 0x4258ff
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x46a2ac], eax
mov eax, dword [0x46a2ac]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x425958
cmp dword [0x46a2b0], ecx
je 0x425958
push eax
call esi
push dword [0x46a2b0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x425958
test ebx, ebx
je 0x425958
call edi
test eax, eax
je 0x42594f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x42594f
test byte [ebp - 8], 1
jne 0x425958
or dword [ebp + 0x10], 0x200000
jmp 0x42598b
mov eax, dword [0x46a2a4]
cmp eax, dword [ebp - 0x18]
je 0x42598b
push eax
call esi
test eax, eax
je 0x42598b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x42598b
mov eax, dword [0x46a2a8]
cmp eax, dword [ebp - 0x18]
je 0x42598b
push eax
call esi
test eax, eax
je 0x42598b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x46a2a0]
call esi
test eax, eax
je 0x4259a7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4259a9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041d326
leave
ret
Function at 0x401ce6
Capabilities:
Create thread

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0xc]
push edi
xor edi, edi
cmp dword [esi + 0x14], edi
jne 0x401d14
lea eax, [esp + 0x10]
push eax
push edi
push esi
push 0x401bb2
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, edi
mov dword [esi + 0x14], eax
jne 0x401d1e
push 0xfffffffffffffffc
pop eax
jmp 0x401d64
lea eax, [esi + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [esi + 0x48], edi
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
jne 0x401d32
push edi
call ebx
cmp dword [esi + 0x48], edi
je 0x401d2a
lea ebp, [esi + 0x28]
mov dword [esi + 0x44], edi
push ebp
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esi + 0x44], 1
cmp dword [esi + 0x48], edi
je 0x401d50
push edi
call ebx
jmp 0x401d46
cmp dword [esi + 0x4c], edi
pop ebx
je 0x401d62
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esi + 0x50]
jmp 0x401d64
xor eax, eax
pop edi
pop esi
pop ebp
ret 4

Function at 0x401f11
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor esi, esi
cmp dword [0x4093f4], esi
push edi
jne 0x401f4b
mov ecx, 0x4093f0
push 8
mov eax, esi
pop edi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec edi
jne 0x401f27
mov dword [ecx], eax
add ecx, 4
inc esi
cmp ecx, 0x4097f0
jl 0x401f22
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov edx, ecx
dec ecx
test edx, edx
not eax
jbe 0x401f80
lea edx, [ecx + 1]
mov ecx, dword [esp + 0x10]
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4093f0]
xor eax, esi
inc ecx
dec edx
jne 0x401f63
pop edi
pop esi
not eax
ret 0xc
Function at 0x40384a
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
xor ebx, ebx
push 8
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x4038d6
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x105
lea eax, [ebp - 0x10c]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
jne 0x4038c1
cmp dword [ebp + 0x10], ebx
jne 0x4038b3
lea eax, [ebp - 0x10c]
push ebx
push eax
push dword [ebp - 4]
call fcn.0040384a
test eax, eax
jne 0x4038c1
lea eax, [ebp - 0x10c]
push edi
push eax
push ebx
push dword [ebp - 4]
jmp 0x403886
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
pop eax
jmp 0x4038d6
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x403d18
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
cmp eax, edi
jl 0x403d45
mov ecx, dword [0x423f70]
push edi
add eax, ecx
push edi
push eax
mov dword [0x4174d8], eax
push dword [0x409094]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
pop esi
push esi
call fcn.00403e43
cmp eax, edi
jl 0x403e3c
lea eax, [ebp - 4]
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
push eax
lea eax, [ebp + 8]
push esi
push eax
push dword [0x409094]
call ebx
test eax, eax
je 0x403e39
cmp dword [ebp - 4], esi
jne 0x403e39
push dword [ebp + 8]
add dword [0x4174d8], esi
call fcn.00403e43
cmp eax, edi
mov dword [ebp - 8], eax
jl 0x403e3c
cmp dword [ebp + 0x10], edi
jne 0x403e08
cmp dword [ebp + 8], edi
jle 0x403e34
mov esi, 0x413494
mov edi, 0x4000
cmp dword [ebp + 8], edi
jge 0x403db8
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push 0
push eax
push edi
push esi
push dword [0x409094]
call ebx
test eax, eax
je 0x403e39
cmp edi, dword [ebp - 4]
jne 0x403e39
lea eax, [ebp + 0x14]
push 0
push eax
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403e04
cmp dword [ebp + 0x14], edi
jne 0x403e04
mov eax, dword [ebp - 4]
add dword [ebp - 8], eax
sub dword [ebp + 8], eax
add dword [0x4174d8], eax
cmp dword [ebp + 8], 0
jg 0x403dab
jmp 0x403e34
push 0xfffffffffffffffe
jmp 0x403e3b
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x403e13
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push edi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x409094]
call ebx
test eax, eax
je 0x403e39
mov eax, dword [ebp - 4]
add dword [0x4174d8], eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x403e3c
push 0xfffffffffffffffd
pop eax
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x403e43
Capabilities:
Check for time delay via gettickcount
Write file on windows

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
push edi
xor edi, edi
mov dword [esp + 0x10], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [0x4174d8]
mov ebx, eax
sub esi, dword [0x40b43c]
add ebx, 0x1f4
add esi, dword [esp + 0x38]
cmp esi, edi
jle 0x40402a
push dword [0x41f4e4]
call fcn.0040406d
push edi
push edi
push dword [0x40b43c]
push dword [0x409094]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [0x41f4e0], esi
mov dword [0x4174d4], edi
mov eax, dword [0x4174dc]
mov ebp, 0x4000
sub eax, dword [0x41f4e4]
cmp eax, ebp
jg 0x403eb7
mov ebp, eax
mov esi, 0x413494
push ebp
push esi
call fcn.0040403b
test eax, eax
je 0x404002
add dword [0x41f4e4], ebp
mov dword [0x40b458], esi
mov dword [0x40b45c], ebp
cmp dword [0x423f28], edi
je 0x403f75
cmp dword [0x423f9c], edi
jne 0x403f75
cmp dword [esp + 0x10], edi
je 0x403f42
mov eax, dword [0x41f4e0]
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
sub eax, dword [0x4174d8]
push 1
push edi
push edi
sub eax, dword [esp + 0x44]
push edi
add eax, dword [0x40b43c]
mov dword [0x4174d4], eax
lea eax, [esp + 0x28]
push eax
call esi
test eax, eax
je 0x403f75
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push edi
push edi
lea eax, [esp + 0x24]
push edi
push eax
jmp 0x403f25
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, ebx
jbe 0x403f75
mov eax, dword [0x423f24]
neg eax
sbb eax, eax
not eax
and eax, str.unpacking_data:__d__
push eax
push 0x40393a
push edi
push 0x6f
push dword [0x423f20]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov dword [esp + 0x10], eax
push 0x40b440
mov dword [0x40b460], 0x40b494
mov dword [0x40b464], 0x8000
call fcn.00401ce6
test eax, eax
jl 0x404036
mov esi, dword [0x40b460]
mov eax, 0x40b494
sub esi, eax
je 0x403fdc
lea ecx, [esp + 0x14]
push edi
push ecx
push esi
push eax
push dword [0x409094]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x404007
cmp esi, dword [esp + 0x14]
jne 0x404007
add dword [0x40b43c], esi
cmp dword [0x40b45c], edi
jne 0x403edd
jmp 0x403fe8
cmp dword [0x40b45c], edi
jne 0x404036
cmp ebp, edi
je 0x404036
mov eax, dword [0x4174d8]
mov ecx, eax
sub ecx, dword [0x40b43c]
add ecx, dword [esp + 0x38]
test ecx, ecx
jle 0x40400b
jmp 0x403ea1
or eax, 0xffffffff
jmp 0x40402c
push 0xfffffffffffffffe
jmp 0x404038
push edi
push edi
push eax
push dword [0x409094]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [esp + 0x10], edi
je 0x40402a
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_DestroyWindow]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 4
push 0xfffffffffffffffd
pop eax
jmp 0x40402c
Function at 0x40463e
Capabilities:
Identify system language via api

Disassembly:
push ecx
cmp byte [0x42a000], 0
push ebx
push ebp
push esi
push edi
mov ebx, pe_overlay
mov ebp, 0x42a000
je 0x40465e
push ebp
call fcn.004069d7
jmp 0x404664
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov dword [esp + 0x10], eax
xor edi, edi
mov esi, dword [0x423f64]
mov eax, esi
dec esi
test eax, eax
je 0x4046c0
mov eax, dword [0x423f28]
mov ecx, dword [eax + 0x5c]
mov edx, ecx
imul ecx, esi
neg edx
add ecx, dword [0x423f60]
mov ax, word [esp + 0x10]
mov edi, ecx
xor ax, word [ecx]
and eax, ebx
test ax, ax
je 0x4046a8
mov eax, esi
dec esi
add ecx, edx
test eax, eax
jne 0x40468c
jmp 0x4046c0
mov eax, dword [edi + 2]
mov dword [0x423700], eax
mov eax, dword [edi + 6]
mov dword [0x423fa4], eax
lea eax, [edi + 0xa]
mov dword [0x4236fc], eax
cmp dword [0x4236fc], 0
jne 0x4046db
cmp bx, 0xffff
jne 0x4046d7
mov ebx, 0x3ff
jmp 0x40466a
xor ebx, ebx
jmp 0x40466a
movzx eax, word [edi]
push eax
push ebp
call fcn.004069be
push 0xfffffffffffffffe
push 0x423720
call fcn.00406a7f
push eax
push dword [0x4208f8]
call dword [sym.imp.USER32.dll_SetWindowTextA]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x40640c
Capabilities:
Check if file exists
Create process on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push dword [ebp + 0xc]
mov dword [0x422120], 0x44
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
je 0x406430
test al, 0x10
jne 0x406433
mov dword [ebp + 0xc], ecx
lea eax, [ebp - 0x10]
push eax
push 0x422120
push dword [ebp + 0xc]
push ecx
push ecx
push ecx
push ecx
push ecx
push dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40645e
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 8

Function at 0x4064ed
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.00406642
test eax, eax
je 0x406552
test byte [ebp + 0xc], 1
je 0x40653a
mov eax, dword [0x423f24]
push esi
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 3
call fcn.00406a72
and byte [eax + esi + 1], 0
and dword [ebp - 0x14], 0
lea eax, [ebp - 0x20]
mov dword [ebp - 0x18], esi
push eax
mov word [ebp - 0x10], 0x414
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
jmp 0x406552
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x406552
test byte [ebp + 0xc], 2
je 0x406552
push eax
push esi
call fcn.0040679d
pop esi
leave
ret 8
Function at 0x406642
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x421d20
push esi
call fcn.00406a61
push esi
call fcn.004065f1
test eax, eax
jne 0x406661
xor eax, eax
jmp 0x4066aa
test byte [0x423f30], 0x80
je 0x406675
mov cl, byte [eax]
test cl, cl
je 0x40665d
cmp cl, 0x5c
je 0x40665d
mov edi, eax
sub edi, esi
push esi
call fcn.00406a72
cmp eax, edi
push esi
jle 0x40669a
call fcn.00406d76
test eax, eax
je 0x406692
test byte [eax], 0x10
je 0x40665d
push esi
call fcn.0040659f
jmp 0x406679
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x406725
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x406754
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x63
pop edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x406799
mov eax, edi
dec edi
test eax, eax
jne 0x40675f
and byte [esi], al
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x406793
Function at 0x40679d
Capabilities:
Get common file path
Get file size

Disassembly:
push ebx
push ebp
push esi
push edi
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
mov esi, dword [esp + 0x18]
je 0x4067d5
push str.MoveFileExA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4067d5
push 5
push esi
push dword [esp + 0x1c]
call eax
test eax, eax
jne 0x40691a
mov eax, dword [0x409334]
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test esi, esi
mov dword [0x422aa8], eax
mov edi, 0x400
mov ebp, 0x422aa8
je 0x406819
push 1
push 0
push esi
call fcn.00406725
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x406920
cmp eax, edi
jg 0x406920
mov esi, 0x4226a8
push edi
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x406920
cmp eax, edi
jg 0x406920
push esi
push ebp
push str._s_s_r_n
push 0x4222a8
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ebp, eax
push 0x3f0
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.wininit.ini
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
xor edi, edi
push edi
push 0x8000080
push 4
push edi
push edi
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40691a
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
push edi
lea eax, [esi + ebp + 0xa]
push eax
push edi
push 4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, edi
mov dword [esp + 0x14], eax
je 0x406902
push edi
push edi
push edi
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
je 0x4068f6
push str._Rename__r_n
push edi
call fcn.004066af
test eax, eax
jne 0x406927
lea eax, [edi + esi]
push str._Rename__r_n
push eax
call fcn.00406a61
add esi, 0xa
mov eax, esi
push ebp
add eax, edi
push 0x4222a8
push eax
call fcn.004066fb
push edi
add esi, ebp
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
push edi
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [0x423f90]
pop edi
pop esi
pop ebp
pop ebx
ret 8
add eax, 0xa
push 0x40930c
push eax
call fcn.004066af
test eax, eax
je 0x4068dd
inc eax
lea edx, [edi + esi]
cmp eax, edx
mov ecx, eax
jae 0x406950
mov dl, byte [ecx]
mov byte [ecx + ebp], dl
inc ecx
lea edx, [edi + esi]
cmp ecx, edx
jb 0x406943
sub eax, edi
jmp 0x4068df
Function at 0x406954
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
xor ebx, ebx
push eax
push 0x20019
push ebx
push dword [ebp + 0xc]
mov byte [esi], bl
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4069b8
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x400
push eax
lea eax, [ebp + 0x14]
push esi
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4069a7
cmp dword [ebp + 0x14], 1
je 0x4069a9
cmp dword [ebp + 0x14], 2
je 0x4069a9
mov byte [esi], bl
push dword [ebp + 0xc]
mov byte [esi + 0x3ff], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x404100
Capabilities:
Get common file path
Get disk information
Get hostname
Manipulate console buffer
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x18c8
call fcn.00411920
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [0x45f688]
push ebx
push esi
mov dword [ebp - 8], ecx
mov ecx, dword [0x45f68c]
mov dword [ebp - 0x18], eax
push edi
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x1c], ecx
call fcn.004040f0
mov ebx, dword [ebp - 0xc]
mov edx, dword [0x45f690]
mov eax, dword [0x45f694]
mov edi, dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
add ebx, 0x23f
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x14], 0x20
jmp 0x404170
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov esi, dword [ebp - 8]
mov eax, dword [0x466e24]
shl esi, 4
add esi, dword [ebp - 0x20]
cmp eax, 0xfa9
jne 0x40419c
mov dword [0x466e20], 0xedeb2e40
jmp 0x4041b7
cmp eax, 0x3eb
jne 0x4041b7
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov dword [0x4668b0], 0
mov ecx, dword [ebp - 8]
add ecx, ebx
mov eax, dword [ebp - 8]
shr eax, 5
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x24]
add dword [ebp - 4], edx
xor esi, ecx
cmp dword [0x466e24], 0x9e6
mov dword [0x466e1c], 0xf4ea3dee
jne 0x4041ef
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommConfig]
xor dword [ebp - 4], esi
cmp dword [0x466e24], 0x213
jne 0x40428b
push 0
lea eax, [ebp - 0xcc8]
push eax
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrencyFormatW]
lea ecx, [ebp - 0x4c8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
lea edx, [ebp - 0x34]
push edx
lea eax, [ebp - 0x10c8]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push 0
call dword [sym.imp.KERNEL32.dll_ClearCommBreak]
push 0
push 0
push 0
call edi
push 0
push 0
lea ecx, [ebp - 0x18c8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0
push 0
push 0
call edi
lea edx, [ebp - 0x2c]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
lea eax, [ebp - 0xc8]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea ecx, [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov esi, dword [ebp - 0x10]
sub esi, dword [ebp - 4]
cmp dword [0x466e24], 0xc
mov dword [ebp - 0x10], esi
jne 0x4042a5
push 0
call dword [sym.imp.KERNEL32.dll_GlobalUnWire]
mov edx, esi
shr edx, 5
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
mov eax, esi
shl eax, 4
add eax, dword [ebp - 0x18]
lea ecx, [ebx + esi]
xor eax, ecx
xor eax, dword [ebp - 4]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
sub dword [ebp - 8], eax
add ebx, 0x61c88647
sub dword [ebp - 0x14], 1
jne 0x404170
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
pop edi
pop esi
mov dword [eax], edx
mov dword [eax + 4], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x404300
Capabilities:
Connect pipe
Create process on windows
Create reverse shell
Read pipe
Set environment variable
Set thread local storage value
Write pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.00411920
mov eax, dword [0x466e24]
mov ecx, dword [0x4668b4]
shr eax, 3
test eax, eax
jbe 0x40441e
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_OpenJobObjectA]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTimeFormatA]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
mov edi, edi
cmp dword [0x466e24], 0x959
jne 0x404404
push 0
lea eax, [ebp - 0x408]
push eax
push 0
push 0
push 0
push 0
call edi
push 0
push 0
push 0
call ebx
push 0
lea ecx, [ebp - 0xc08]
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CallNamedPipeA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileShortNameW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0
push 0
push 0
push 0
push 0
push 0
call esi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
lea edx, [ebp - 0x808]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0
push 0
push 0
push 0
push 0
push 0
call esi
push 0
lea eax, [ebp - 0x1008]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, dword [ebp - 4]
push ecx
call fcn.00404100
add dword [ebp - 4], 8
sub dword [ebp - 8], 1
jne 0x404340
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a8cf
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x45e470]
jne 0x40a8d9
repz ret
jmp fcn.00410773

Function at 0x40be1c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004076e2
and dword [ebp - 4], 0
cmp dword [0x46489c], 0
mov ebx, eax
jne 0x40becd
push 0x4034d4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40bf7e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4034c8
push edi
call esi
test eax, eax
je 0x40bf7e
push eax
call fcn.00407670
mov dword [esp], 0x4034b8
push edi
mov dword [0x46489c], eax
call esi
push eax
call fcn.00407670
mov dword [esp], 0x4034a4
push edi
mov dword [0x4648a0], eax
call esi
push eax
call fcn.00407670
mov dword [esp], 0x403488
push edi
mov dword [0x4648a4], eax
call esi
push eax
call fcn.00407670
pop ecx
mov dword [0x4648ac], eax
test eax, eax
je 0x40becd
push 0x403470
push edi
call esi
push eax
call fcn.00407670
pop ecx
mov dword [0x4648a8], eax
mov eax, dword [0x4648a8]
cmp eax, ebx
je 0x40bf25
cmp dword [0x4648ac], ebx
je 0x40bf25
push eax
call fcn.004076eb
push dword [0x4648ac]
mov esi, eax
call fcn.004076eb
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40bf25
test edi, edi
je 0x40bf25
call esi
test eax, eax
je 0x40bf1c
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40bf1c
test byte [ebp - 0xc], 1
jne 0x40bf25
or dword [ebp + 0x10], 0x200000
jmp 0x40bf5e
mov eax, dword [0x4648a0]
cmp eax, ebx
je 0x40bf5e
push eax
call fcn.004076eb
pop ecx
test eax, eax
je 0x40bf5e
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40bf5e
mov eax, dword [0x4648a4]
cmp eax, ebx
je 0x40bf5e
push eax
call fcn.004076eb
pop ecx
test eax, eax
je 0x40bf5e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x46489c]
call fcn.004076eb
pop ecx
test eax, eax
je 0x40bf7e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40bf80
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret