joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41d360
Capabilities:
Terminate process

Disassembly:
sub esp, 8
mov eax, dword [0x86ff3c]
mov edx, 0x20
sub edx, dword [eax + 0x820]
mov eax, dword [eax + 0x808]
mov ecx, dword [eax]
push esi
push edi
mov dword [esp + 8], ecx
mov eax, dword [esp + 8]
bswap eax
mov dword [esp + 8], eax
mov ecx, dword [0x86ff3c]
mov ecx, dword [ecx + 0x820]
or eax, 0xffffffff
shr eax, cl
lea ecx, [edx - 0x1b]
and eax, dword [esp + 8]
shr eax, cl
cmp eax, 8
jne 0x41d4ff
lea edi, [eax + 0x13]
call fcn.0041be20
mov edi, 5
call fcn.0041be20
mov edi, 0x1c
call fcn.0041be20
cmp eax, 0x12
je 0x41d3d7
push 0x65
call dword [sym.imp.MSVCR90.dll_exit]
mov edi, 0xd
call fcn.0041be20
mov edi, 1
call fcn.0041be20
test eax, eax
je 0x41d3f9
mov edi, 7
call fcn.0041be20
mov edi, 4
call fcn.0041be20
mov edi, 1
call fcn.0041be20
test eax, eax
je 0x41d45b
mov edi, 3
call fcn.0041be20
mov edi, 1
call fcn.0041be20
test eax, eax
je 0x41d45b
mov edi, 0x10
call fcn.0041be20
call fcn.0041be20
call fcn.0041be20
mov edi, 3
call fcn.0041be20
mov edi, 0xc
call fcn.0041be20
mov edi, 0x10
call fcn.0041be20
mov edi, 2
call fcn.0041be20
mov esi, eax
call fcn.0041db50
mov edi, 0x10
call fcn.0041be20
mov dword [esp + 8], eax
call fcn.0041db50
mov edi, 1
call fcn.0041be20
test eax, eax
je 0x41d4ca
fild dword [esp + 8]
call sub.MSVCR90.dll__CIlog
fstp qword [esp + 8]
fld qword [0x43ba78]
call sub.MSVCR90.dll__CIlog
fdivr qword [esp + 8]
sub esp, 8
fstp qword [esp]
call dword [sym.imp.MSVCR90.dll_ceil]
add esp, 8
call fcn.0042a270
cmp eax, edi
jge 0x41d4c3
mov eax, edi
mov edi, eax
call fcn.0041be20
cmp esi, 2
je 0x41d4ff
test esi, esi
jne 0x41d4ff
call fcn.0041db50
lea edi, [esi + 0xd]
call fcn.0041be20
mov edx, dword [esp + 0x14]
mov dword [edx], eax
call fcn.0041db50
call fcn.0041be20
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
pop edi
lea eax, [esi + 1]
pop esi
add esp, 8
ret
pop edi
xor eax, eax
pop esi
add esp, 8
ret
Function at 0x427860
Capabilities:
Enumerate pe sections

Disassembly:
mov edx, dword [esp + 0x10]
sub esp, 0x18
test edx, edx
jle 0x4279fd
push ebx
push ebp
push esi
mov esi, dword [esp + 0x30]
mov ecx, 2
sub ecx, esi
mov dword [esp + 0x34], ecx
mov ecx, 3
sub ecx, esi
mov dword [esp + 0xc], ecx
mov ecx, 4
sub ecx, esi
mov dword [esp + 0x10], ecx
mov ecx, 5
sub ecx, esi
mov dword [esp + 0x14], ecx
mov ecx, 7
sub ecx, esi
mov dword [esp + 0x20], ecx
mov ebp, 1
mov ecx, 6
sub ebp, esi
sub ecx, esi
push edi
mov edi, dword [esp + 0x2c]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x30]
lea eax, [edi + esi + 1]
mov dword [esp + 0x20], edx
movzx ebx, byte [edi + 1]
movzx edx, byte [eax - 1]
add edx, ebx
movzx ebx, byte [eax]
add edx, ebx
movzx ebx, byte [edi]
lea edx, [edx + ebx + 2]
sar edx, 2
mov byte [ecx], dl
movzx ebx, byte [edi + 1]
movzx edx, byte [eax + ebp]
add edx, ebx
movzx ebx, byte [eax + 1]
add edx, ebx
movzx ebx, byte [eax]
lea edx, [edx + ebx + 2]
sar edx, 2
mov byte [ecx + 1], dl
movzx ebx, byte [eax + ebp]
movzx edx, byte [eax + 2]
add edx, ebx
movzx ebx, byte [eax + 1]
add edx, ebx
mov ebx, dword [esp + 0x38]
movzx ebx, byte [ebx + eax]
lea edx, [edx + ebx + 2]
mov ebx, dword [esp + 0x10]
sar edx, 2
mov byte [ecx + 2], dl
movzx ebx, byte [ebx + eax]
movzx edx, byte [eax + 2]
add edx, ebx
movzx ebx, byte [eax + 3]
add edx, ebx
mov ebx, dword [esp + 0x38]
movzx ebx, byte [ebx + eax]
lea edx, [edx + ebx + 2]
sar edx, 2
mov byte [ecx + 3], dl
movzx ebx, byte [eax + 4]
mov edx, dword [esp + 0x14]
movzx edx, byte [edx + eax]
add edx, ebx
mov ebx, dword [esp + 0x10]
movzx ebx, byte [ebx + eax]
add edx, ebx
movzx ebx, byte [eax + 3]
lea edx, [edx + ebx + 2]
sar edx, 2
mov byte [ecx + 4], dl
movzx ebx, byte [eax + 5]
mov edx, dword [esp + 0x18]
movzx edx, byte [edx + eax]
add edx, ebx
mov ebx, dword [esp + 0x14]
movzx ebx, byte [ebx + eax]
add edx, ebx
movzx ebx, byte [eax + 4]
lea edx, [edx + ebx + 2]
mov ebx, dword [esp + 0x18]
sar edx, 2
mov byte [ecx + 5], dl
movzx ebx, byte [ebx + eax]
movzx edx, byte [eax + 6]
add edx, ebx
movzx ebx, byte [eax + 5]
add edx, ebx
mov ebx, dword [esp + 0x1c]
movzx ebx, byte [ebx + eax]
lea edx, [edx + ebx + 2]
sar edx, 2
mov byte [ecx + 6], dl
mov edx, dword [esp + 0x24]
movzx edx, byte [edx + eax]
movzx ebx, byte [eax + 7]
add edx, ebx
movzx ebx, byte [eax + 6]
add edx, ebx
mov ebx, dword [esp + 0x1c]
movzx ebx, byte [ebx + eax]
lea edx, [edx + ebx + 2]
sar edx, 2
mov byte [ecx + 7], dl
add edi, esi
add eax, esi
add ecx, esi
sub dword [esp + 0x20], 1
jne 0x4278d0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x427b30
Capabilities:
Enumerate pe sections

Disassembly:
mov edx, dword [esp + 0x10]
sub esp, 0x18
test edx, edx
jle 0x427ccd
push ebx
push ebp
push esi
mov esi, dword [esp + 0x30]
mov ecx, 2
sub ecx, esi
mov dword [esp + 0x34], ecx
mov ecx, 3
sub ecx, esi
mov dword [esp + 0xc], ecx
mov ecx, 4
sub ecx, esi
mov dword [esp + 0x10], ecx
mov ecx, 5
sub ecx, esi
mov dword [esp + 0x14], ecx
mov ecx, 7
sub ecx, esi
mov dword [esp + 0x20], ecx
mov ebp, 1
mov ecx, 6
sub ebp, esi
sub ecx, esi
push edi
mov edi, dword [esp + 0x2c]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x30]
lea eax, [edi + esi + 1]
mov dword [esp + 0x20], edx
movzx ebx, byte [edi + 1]
movzx edx, byte [eax - 1]
add edx, ebx
movzx ebx, byte [eax]
add edx, ebx
movzx ebx, byte [edi]
lea edx, [edx + ebx + 1]
sar edx, 2
mov byte [ecx], dl
movzx ebx, byte [edi + 1]
movzx edx, byte [eax + ebp]
add edx, ebx
movzx ebx, byte [eax + 1]
add edx, ebx
movzx ebx, byte [eax]
lea edx, [edx + ebx + 1]
sar edx, 2
mov byte [ecx + 1], dl
movzx ebx, byte [eax + ebp]
movzx edx, byte [eax + 2]
add edx, ebx
movzx ebx, byte [eax + 1]
add edx, ebx
mov ebx, dword [esp + 0x38]
movzx ebx, byte [ebx + eax]
lea edx, [edx + ebx + 1]
mov ebx, dword [esp + 0x10]
sar edx, 2
mov byte [ecx + 2], dl
movzx ebx, byte [ebx + eax]
movzx edx, byte [eax + 2]
add edx, ebx
movzx ebx, byte [eax + 3]
add edx, ebx
mov ebx, dword [esp + 0x38]
movzx ebx, byte [ebx + eax]
lea edx, [edx + ebx + 1]
sar edx, 2
mov byte [ecx + 3], dl
movzx ebx, byte [eax + 4]
mov edx, dword [esp + 0x14]
movzx edx, byte [edx + eax]
add edx, ebx
mov ebx, dword [esp + 0x10]
movzx ebx, byte [ebx + eax]
add edx, ebx
movzx ebx, byte [eax + 3]
lea edx, [edx + ebx + 1]
sar edx, 2
mov byte [ecx + 4], dl
movzx ebx, byte [eax + 5]
mov edx, dword [esp + 0x18]
movzx edx, byte [edx + eax]
add edx, ebx
mov ebx, dword [esp + 0x14]
movzx ebx, byte [ebx + eax]
add edx, ebx
movzx ebx, byte [eax + 4]
lea edx, [edx + ebx + 1]
mov ebx, dword [esp + 0x18]
sar edx, 2
mov byte [ecx + 5], dl
movzx ebx, byte [ebx + eax]
movzx edx, byte [eax + 6]
add edx, ebx
movzx ebx, byte [eax + 5]
add edx, ebx
mov ebx, dword [esp + 0x1c]
movzx ebx, byte [ebx + eax]
lea edx, [edx + ebx + 1]
sar edx, 2
mov byte [ecx + 6], dl
mov edx, dword [esp + 0x24]
movzx edx, byte [edx + eax]
movzx ebx, byte [eax + 7]
add edx, ebx
movzx ebx, byte [eax + 6]
add edx, ebx
mov ebx, dword [esp + 0x1c]
movzx ebx, byte [ebx + eax]
lea edx, [edx + ebx + 1]
sar edx, 2
mov byte [ecx + 7], dl
add edi, esi
add eax, esi
add ecx, esi
sub dword [esp + 0x20], 1
jne 0x427ba0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x428790
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 0xf0
push edi
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x58]
rep stosd dword es:[edi], eax
mov ecx, 0x10
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0xf8]
pop edi
mov cl, byte [eax + 0x30]
mov byte [esp + 0x84], cl
mov byte [esp + 0x40], cl
mov cl, byte [eax + 0x34]
mov byte [esp + 0x85], cl
mov byte [esp + 0x41], cl
mov cl, byte [eax + 0x38]
mov byte [esp + 0x86], cl
mov byte [esp + 0x42], cl
mov cl, byte [eax + 0x3c]
mov byte [esp + 0x87], cl
mov byte [esp + 0x43], cl
mov cl, byte [eax + 0x20]
mov byte [esp + 0x88], cl
mov byte [esp + 0x44], cl
mov cl, byte [eax + 0x24]
mov byte [esp + 0x89], cl
mov byte [esp + 0x45], cl
mov cl, byte [eax + 0x28]
mov byte [esp + 0x8a], cl
mov byte [esp + 0x46], cl
mov cl, byte [eax + 0x2c]
mov byte [esp + 0x8b], cl
mov byte [esp + 0x47], cl
mov cl, byte [eax + 0x10]
mov byte [esp + 0x8c], cl
mov byte [esp + 0x48], cl
mov cl, byte [eax + 0x14]
mov byte [esp + 0x8d], cl
mov byte [esp + 0x49], cl
mov cl, byte [eax + 0x18]
mov byte [esp + 0x8e], cl
mov byte [esp + 0x4a], cl
mov cl, byte [eax + 0x1c]
mov byte [esp + 0x8f], cl
mov byte [esp + 0x4b], cl
mov cl, byte [eax]
mov byte [esp + 0x90], cl
mov byte [esp + 0x4c], cl
mov cl, byte [eax + 4]
mov byte [esp + 0x91], cl
mov byte [esp + 0x4d], cl
mov cl, byte [eax + 8]
mov al, byte [eax + 0xc]
mov byte [esp + 0x93], al
mov byte [esp + 0x4f], al
mov byte [esp + 0x92], cl
mov byte [esp + 0x4e], cl
xor eax, eax
mov dl, byte [esp + eax + 0x10]
mov cl, byte [esp + eax + 0x54]
xor dl, 0x36
xor cl, 0x5c
mov byte [esp + eax + 0x10], dl
mov byte [esp + eax + 0x54], cl
inc eax
cmp eax, 0x40
jl 0x428898
lea eax, [esp + 0x98]
push eax
call fcn.00428b30
lea ecx, [esp + 0x14]
push 0x40
lea edx, [esp + 0xa0]
push ecx
push edx
call fcn.00428b60
mov eax, dword [0x86fac8]
mov ecx, dword [esp + 0x108]
push eax
lea edx, [esp + 0xac]
push ecx
push edx
call fcn.00428b60
lea eax, [esp + 0x1c]
lea ecx, [esp + 0xb4]
push eax
push ecx
call fcn.004295f0
lea edx, [esp + 0xbc]
push edx
call fcn.00428b30
lea eax, [esp + 0x7c]
push 0x40
lea ecx, [esp + 0xc4]
push eax
push ecx
call fcn.00428b60
lea edx, [esp + 0x34]
push 0x10
lea eax, [esp + 0xd0]
push edx
push eax
call fcn.00428b60
add esp, 0x40
lea ecx, [esp]
lea edx, [esp + 0x98]
push ecx
push edx
call fcn.004295f0
mov eax, dword [esp + 0x104]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov dword [eax], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x14]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
xor eax, eax
add esp, 0xf8
ret

Function at 0x428b30
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
ret

Function at 0x429cfe
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x459f34]
jne 0x429d08
repz ret
jmp fcn.0042a328
Function at 0x401620
Capabilities:
Get disk information

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x28c
lea ebp, [esp + 0x8c]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
mov dword [esp + 4], ebp
mov dword [esp], 0x1f4
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
sub esp, 8
test eax, eax
je 0x401701
cmp byte [esp + 0x8c], 0
je 0x401701
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea edi, [esp + 0x28]
lea esi, [esi]
mov dword [esp + 4], section..rdata
mov dword [esp], ebp
call ebx
sub esp, 8
test eax, eax
je 0x4016f4
mov dword [esp + 4], 0x4f6004
mov dword [esp], ebp
call ebx
sub esp, 8
test eax, eax
je 0x4016f4
movzx eax, byte [ebp]
mov byte [esp + 0x27], 0
mov byte [esp + 0x25], al
movzx eax, byte [ebp + 1]
mov dword [esp + 8], 0x64
mov byte [esp + 0x26], al
lea eax, [esp + 0x25]
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
sub esp, 0xc
test eax, eax
je 0x401726
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
sub esp, 4
mov esi, eax
mov dword [esp + 8], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__strnicmp]
test eax, eax
je 0x401733
add ebp, 4
cmp byte [ebp], 0
jne 0x401670
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor eax, eax
sub esp, 8
add esp, 0x28c
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x28c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, dword [esp + 0x1c]
lea eax, [esp + 0x25]
mov dword [esp + 4], eax
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
sub esp, 8
add esi, dword [esp + 0x18]
mov dword [esp], edi
mov dword [esp + 4], esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, 1
sub esp, 8
add esp, 0x28c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x401770
Capabilities:
Create process on windows

Disassembly:
push edi
push esi
push ebx
push eax
mov eax, 0x101c
call fcn.0041a2f0
mov ecx, 0x400
sub esp, eax
mov eax, dword [esp + eax]
lea esi, [esp + 0x20]
mov edi, esi
mov ebx, eax
xor eax, eax
rep stosd dword es:[edi], eax
mov dword [esp + 8], 0x1000
mov dword [esp + 4], esi
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
sub esp, 0xc
cmp byte [0x50a071], 0
jne 0x401841
mov edx, esi
mov ecx, dword [edx]
add edx, 4
lea eax, [ecx - 0x1010101]
not ecx
and eax, ecx
and eax, 0x80808080
je 0x4017bf
mov ecx, eax
mov dword [esp + 4], esi
shr ecx, 0x10
test eax, 0x8080
mov dword [esp], 0x4f5780
cmove eax, ecx
lea ecx, [edx + 2]
cmove edx, ecx
mov ecx, eax
add cl, al
sbb edx, 3
sub edx, esi
mov dword [esp + 8], edx
call method.std::basic_ostream_char__std::char_traits_char____std::__ostream_insert_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const__int_
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], esi
mov dword [esp + 4], str.runas
mov dword [esp], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
sub esp, 0x18
mov dword [esp], 0
call sym._exit
mov dword [esp + 8], esi
mov dword [esp + 4], str._s___hide
mov dword [esp], esi
call sym.sprintf_char__char_const__..._
jmp 0x4017bd
Function at 0x403c30
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, ecx
push ebx
sub esp, 0x14
mov ebx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov dword [ebx + 8], 0
mov ecx, ebx
mov dword [ebx + 0x4c], 0x6a09e667
mov dword [ebx + 0x50], 0xbb67ae85
mov dword [ebx + 0x54], 0x3c6ef372
mov dword [ebx + 0x58], 0xa54ff53a
mov dword [ebx + 0x5c], 0x510e527f
mov dword [ebx + 0x60], 0x9b05688c
mov dword [ebx + 0x64], 0x1f83d9ab
mov dword [ebx + 0x68], 0x5be0cd19
mov edx, dword [eax + 4]
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [esp + 4], edx
mov eax, dword [eax]
mov dword [esp], eax
call method.SHA256.add_void_const__unsigned_int_
mov ecx, esi
sub esp, 8
mov dword [esp], ebx
call method.SHA256.getHash_abi:cxx11___
mov eax, esi
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret 8

Function at 0x403cc0
Capabilities:
Get token membership

Disassembly:
sub esp, 0x4c
mov eax, 0x500
mov word [esp + 0x3e], ax
lea eax, [esp + 0x30]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x3a]
mov dword [esp + 0x3a], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x220
mov dword [esp + 8], 0x20
mov dword [esp + 4], 2
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
sub esp, 0x2c
mov dword [esp + 0x34], eax
test eax, eax
jne 0x403d50
mov eax, dword [esp + 0x50]
call sym.GetAdmin_int___clone_.part.0_
lea esi, [esi]
lea esi, [esi]
lea eax, [esp + 0x34]
mov dword [esp], 0
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
sub esp, 0xc
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
sub esp, 4
cmp dword [esp + 0x34], 1
jne 0x403d3d
xor eax, eax
add esp, 0x4c
ret
Function at 0x403d90
Capabilities:
Acquire debug privileges

Disassembly:
push ebx
xor ebx, ebx
sub esp, 0x48
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edx, [esp + 0x24]
mov dword [esp + 4], 0x28
mov dword [esp + 8], edx
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
sub esp, 0xc
test eax, eax
jne 0x403dc8
add esp, 0x48
mov eax, ebx
pop ebx
ret
lea eax, [esp + 0x28]
mov dword [esp + 4], str.SeDebugPrivilege
mov dword [esp + 8], eax
mov dword [esp], 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
sub esp, 0xc
test eax, eax
je 0x403e70
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x30], 1
mov ebx, 1
mov dword [esp + 0x3c], 2
mov dword [esp + 0x34], eax
lea eax, [esp + 0x30]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x38], edx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x10
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
sub esp, 0x18
test eax, eax
jne 0x403dbc
mov eax, dword [esp + 0x24]
xor ebx, ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
jmp 0x403dbc
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
sub esp, 4
add esp, 0x48
pop ebx
ret

Function at 0x404180
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push edi
xor eax, eax
mov ecx, 0x7f
push esi
push ebx
sub esp, 0x210
lea edi, [esp + 0x14]
mov dword [esp + 0x10], 0
rep stosd dword es:[edi], eax
mov dword [esp + 4], 0x4f6029
mov dword [esp], str..PhysicalDrive0
call sym._fopen
test eax, eax
je 0x404258
mov dword [esp], eax
mov ebx, eax
call sym._feof
mov edx, eax
mov eax, 1
test edx, edx
je 0x4041e0
add esp, 0x210
pop ebx
pop esi
pop edi
ret
mov dword [esp + 8], 0
lea esi, [esp + 0x10]
mov dword [esp + 4], 0
mov dword [esp], ebx
call sym._fseek
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 1
mov dword [esp + 4], 0x200
mov dword [esp], esi
call sym._fread
mov dword [esp + 4], 0x4f6040
mov dword [esp], str.DataMBRData.data
call sym._fopen
mov edi, eax
test eax, eax
je 0x404258
mov dword [esp], eax
call sym._feof
test eax, eax
je 0x404268
mov dword [esp], ebx
call sym._fclose
add esp, 0x210
mov eax, 1
pop ebx
pop esi
pop edi
ret
add esp, 0x210
xor eax, eax
pop ebx
pop esi
pop edi
ret
mov dword [esp + 0xc], edi
mov dword [esp + 8], 1
mov dword [esp + 4], 0x200
mov dword [esp], esi
call sym._fwrite
mov dword [esp], edi
call sym._fclose
jmp 0x40423e
Function at 0x404290
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push edi
xor eax, eax
mov ecx, 0x7f
push esi
push ebx
sub esp, 0x210
lea edi, [esp + 0x14]
mov dword [esp + 0x10], 0
rep stosd dword es:[edi], eax
mov dword [esp + 4], 0x4f6029
mov dword [esp], str.DataMBRData.data
call sym._fopen
test eax, eax
je 0x404368
mov dword [esp], eax
mov ebx, eax
call sym._feof
mov edx, eax
mov eax, 1
test edx, edx
je 0x4042f0
add esp, 0x210
pop ebx
pop esi
pop edi
ret
mov dword [esp + 8], 0
lea esi, [esp + 0x10]
mov dword [esp + 4], 0
mov dword [esp], ebx
call sym._fseek
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 1
mov dword [esp + 4], 0x200
mov dword [esp], esi
call sym._fread
mov dword [esp + 4], 0x4f6040
mov dword [esp], str..PhysicalDrive0
call sym._fopen
mov edi, eax
test eax, eax
je 0x404368
mov dword [esp], eax
call sym._feof
test eax, eax
je 0x404378
mov dword [esp], ebx
call sym._fclose
add esp, 0x210
mov eax, 1
pop ebx
pop esi
pop edi
ret
add esp, 0x210
xor eax, eax
pop ebx
pop esi
pop edi
ret
mov dword [esp + 0xc], edi
mov dword [esp + 8], 1
mov dword [esp + 4], 0x200
mov dword [esp], esi
call sym._fwrite
mov dword [esp], edi
call sym._fclose
jmp 0x40434e

Function at 0x4045d0
Capabilities:
Delete registry value
Persist via run registry key
Set registry value

Disassembly:
push edi
mov eax, 0x1030
push esi
push ebx
call fcn.0041a2f0
mov ecx, 0x3ff
sub esp, eax
xor eax, eax
lea edi, [esp + 0x34]
lea esi, [esp + 0x30]
mov dword [esp + 0x30], 0
mov ebx, dword [esp + 0x1040]
rep stosd dword es:[edi], eax
mov dword [esp + 8], 0x1000
mov dword [esp + 4], esi
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
sub esp, 0xc
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xf003f
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREMicrosoftWindowsCurrentVersionRun_
mov dword [esp], 0x80000002
test bl, bl
je 0x404670
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
sub esp, 0x14
test eax, eax
je 0x4046b8
add esp, 0x1030
xor eax, eax
pop ebx
pop esi
pop edi
ret
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
sub esp, 0x14
test eax, eax
jne 0x40465b
mov eax, dword [esp + 0x2c]
mov dword [esp + 4], 0x4f609b
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
sub esp, 8
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
sub esp, 4
add esp, 0x1030
pop ebx
pop esi
pop edi
ret
mov edx, esi
mov ecx, dword [edx]
add edx, 4
lea eax, [ecx - 0x1010101]
not ecx
and eax, ecx
and eax, 0x80808080
je 0x4046ba
mov ecx, eax
mov dword [esp + 0x10], esi
shr ecx, 0x10
test eax, 0x8080
mov dword [esp + 0xc], 1
cmove eax, ecx
lea ecx, [edx + 2]
mov dword [esp + 8], 0
cmove edx, ecx
mov dword [esp + 4], 0x4f609b
mov ecx, eax
add cl, al
mov eax, dword [esp + 0x2c]
sbb edx, 3
sub edx, esi
mov dword [esp], eax
add edx, 1
mov dword [esp + 0x14], edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
sub esp, 0x18
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
sub esp, 4
add esp, 0x1030
pop ebx
pop esi
pop edi
ret
Function at 0x404740
Capabilities:
Shutdown system

Disassembly:
push ebx
sub esp, 0x48
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edx, [esp + 0x2c]
mov dword [esp + 4], 0x28
mov dword [esp + 8], edx
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
sub esp, 0xc
test eax, eax
jne 0x404778
add esp, 0x48
xor eax, eax
pop ebx
ret
lea eax, [esp + 0x34]
lea ebx, [esp + 0x30]
mov dword [esp + 4], str.SeShutdownPrivilege
mov dword [esp + 8], eax
mov dword [esp], 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
sub esp, 0xc
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x30], 1
mov dword [esp + 0x3c], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
sub esp, 0x18
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x40476a
mov dword [esp + 4], 0x80020003
mov dword [esp], 5
call dword [sym.imp.USER32.dll_ExitWindowsEx]
sub esp, 8
test eax, eax
setne al
add esp, 0x48
movzx eax, al
pop ebx
ret

Function at 0x404930
Capabilities:
Enumerate threads
Resume thread
Suspend thread

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov esi, dword [esp + 0x60]
movzx eax, byte [esp + 0x64]
mov dword [esp], 4
mov dword [esp + 4], esi
mov byte [esp + 0x1b], al
call sym._CreateToolhelp32Snapshot_8
mov ebx, eax
sub esp, 8
xor eax, eax
cmp ebx, 0xffffffff
jne 0x404970
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
xor edx, edx
xor eax, eax
mov dword [esp + eax + 0x28], edx
add eax, 4
cmp eax, 0x18
jb 0x404974
lea edi, [esp + 0x24]
mov dword [esp], ebx
mov dword [esp + 4], edi
mov dword [esp + 0x24], 0x1c
call sym._Thread32First_8
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 8
test eax, eax
jne 0x4049c3
jmp 0x404a18
mov dword [esp + 4], edi
mov dword [esp], ebx
call sym._Thread32Next_8
sub esp, 8
test eax, eax
je 0x404a18
cmp dword [esp + 0x30], esi
jne 0x4049b0
mov eax, dword [esp + 0x2c]
mov dword [esp + 4], 0
mov dword [esp], 2
mov dword [esp + 8], eax
call dword [sym.imp.KERNEL32.dll_OpenThread]
sub esp, 0xc
mov edx, eax
test eax, eax
je 0x404a0a
cmp byte [esp + 0x1b], 0
mov dword [esp], eax
mov dword [esp + 0x1c], eax
je 0x404a30
call dword [sym.imp.KERNEL32.dll_SuspendThread]
sub esp, 4
mov edx, dword [esp + 0x1c]
mov dword [esp], edx
call ebp
sub esp, 4
jmp 0x4049b0
mov dword [esp], ebx
call ebp
mov eax, 1
sub esp, 4
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_ResumeThread]
sub esp, 4
mov edx, dword [esp + 0x1c]
jmp 0x404a0a