joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402c00
Capabilities:
Create process on windows

Disassembly:
push str.c:Progra1chenhu8cqjcdir
push 0x43c780
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x43c780
push str.runas__trustlevel:0x20000__s
push 0x43c860
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 5
push 0x43c860
call dword [sym.imp.KERNEL32.dll_WinExec]
ret
cmp dword [0x43c5b8], 1
push esi
jne 0x402bf9
cmp dword [0x43c98c], 1
jne 0x402bf9
push str.SOFTWAREMicrosoftCTFTIP65653599_5030_4C0F_8871_83F6AFDE5098
xor esi, esi
call fcn.00402b10
add esp, 4
test eax, eax
je 0x402b94
push str.SOFTWAREMicrosoftCTFTIP65653599_5030_4C0F_8871_83F6AFDE5098CategoryItem65653599_5030_4C0F_8871_83F6AFDE509813A016DF_560B_46CD_947A_4C3AF1E0E35D
call fcn.00402b10
add esp, 4
test eax, eax
jne 0x402bc0
mov esi, 1
push esi
push 0x20
push str._ddll
push 0x43c860
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0
push 0x41c44c
push 0x43c860
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
ret
push str.SOFTWAREMicrosoftCTFTIP65653599_5030_4C0F_8871_83F6AFDE5098CategoryItem65653599_5030_4C0F_8871_83F6AFDE509825504FB4_7BAB_4BC1_9C69_CF81890F0EF5
call fcn.00402b10
add esp, 4
test eax, eax
jne 0x402bd6
lea esi, [eax + 2]
jmp 0x402b94
push str.SOFTWAREMicrosoftCTFTIP65653599_5030_4C0F_8871_83F6AFDE5098CategoryItem65653599_5030_4C0F_8871_83F6AFDE509834745C63_B2F0_4784_8B67_5E12C8701A31
call fcn.00402b10
add esp, 4
test eax, eax
jne 0x402bec
lea esi, [eax + 3]
jmp 0x402b94
push 0x41c3e3
call fcn.00402a80
add esp, 4
pop esi
jmp 0x4024c0
cmp dword [0x43c5b8], 1
jne 0x402ca6
cmp dword [0x439620], 0x20
push esi
jne 0x402c6f
push 3
push str.chensrf.dll
push str.chensrf.dll
call fcn.004028c0
add esp, 0xc
mov esi, eax
push str.chensrf.dll
push 0x43c860
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test esi, esi
pop esi
je 0x402ca6
push 0x43c860
push 0x41ccc4
push 0x43c860
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
push 0x41c44c
push 0x43c860
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
ret
push 1
push str.chensrf.dll
push str.chensrf.dll
call fcn.004028c0
add esp, 0xc
mov esi, eax
test esi, esi
jne 0x402c2d
push 2
push str.chensrf6.dll
push str.chensrf6.dll
call fcn.004028c0
add esp, 0xc
mov esi, eax
push str.chensrf6.dll
jmp 0x402c32
jmp 0x402b50
Function at 0x402cb0
Capabilities:
Get common file path
Set registry value

Disassembly:
sub esp, 0x1a0
mov eax, dword [0x4250e0]
xor eax, esp
mov dword [esp + 0x19c], eax
push 0x41cde8
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea ecx, [esp + 4]
push ecx
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402dac
mov ecx, dword [esp + 4]
push ebx
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 8]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.chenqwb8
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x402da4
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
lea edx, [esp + 0x18]
push edx
call esi
mov ecx, dword [esp + 0xc]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add eax, eax
push eax
lea eax, [esp + 0x1c]
push eax
push 1
push 0
push str.DisplayName
push ecx
call edi
push 0x64
push 0x43c780
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0x43c780
lea edx, [esp + 0x1c]
push str._schendel8.exe
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [esp + 0x18]
push eax
call esi
mov edx, dword [esp + 0xc]
add eax, eax
push eax
lea ecx, [esp + 0x1c]
push ecx
push 1
push 0
push str.UninstallString
push edx
call edi
mov eax, dword [esp + 0xc]
push eax
call ebx
pop edi
pop esi
mov ecx, dword [esp + 8]
push ecx
call ebx
pop ebx
mov ecx, dword [esp + 0x19c]
xor ecx, esp
call fcn.0040a10d
add esp, 0x1a0
ret

Function at 0x402dd0
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ecx
call fcn.00402770
test eax, eax
je 0x402e82
lea eax, [esp]
push eax
mov dword [esp + 4], 0
call fcn.00402860
add esp, 4
cmp eax, 1
jne 0x402e82
push ebx
push esi
push edi
push 0x43c5c0
call fcn.00402500
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push 0x43c5c0
push str.regsvr32__s__schensrf.dll
push 0x43c860
call esi
mov edi, dword [sym.imp.KERNEL32.dll_WinExec]
add esp, 0x10
push 5
push 0x43c860
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x7d0
call ebx
push 0xc8
push 0x43c780
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x43c780
push str.regsvr32__s__schensrf6.dll
push 0x43c860
call esi
add esp, 0xc
push 5
push 0x43c860
call edi
push 0x7d0
call ebx
mov ecx, dword [esp + 0xc]
push ecx
call fcn.00402890
add esp, 4
pop edi
pop esi
pop ebx
mov eax, 1
pop ecx
ret
Function at 0x402e90
Capabilities:
Create process on windows
Get common file path

Disassembly:
cmp dword [0x439620], 0x20
jne 0x402edf
push 0xc8
push 0x43c780
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x43c780
push str.regsvr32__s__schensrf.dll
push 0x43c860
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 5
push 0x43c860
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
ret
push ebx
push esi
push edi
push 0x43c5c0
call fcn.00402500
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push 0x43c5c0
push str.regsvr32__s__schensrf.dll
push 0x43c860
call esi
mov edi, dword [sym.imp.KERNEL32.dll_WinExec]
add esp, 0x10
push 5
push 0x43c860
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x7d0
call ebx
push 0xc8
push 0x43c780
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x43c780
push str.regsvr32__s__schensrf6.dll
push 0x43c860
call esi
add esp, 0xc
push 5
push 0x43c860
call edi
push 0x7d0
call ebx
call fcn.00402dd0
pop edi
pop esi
pop ebx
mov eax, 1
ret
Function at 0x403a00
Capabilities:
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x20
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
push esi
call dword [sym.imp.KERNEL32.dll__lopen]
cmp eax, 0xffffffff
jne 0x403a20
xor eax, eax
pop esi
ret
push eax
call dword [sym.imp.KERNEL32.dll__lclose]
push esi
call fcn.0040a5b1
add esp, 4
pop esi
ret

Function at 0x403d40
Capabilities:
Get common file path
Get program files directory

Disassembly:
cmp byte [0x439021], 0x3a
jne 0x403d5f
cmp byte [0x439022], 0x5c
jne 0x403d5f
cmp dword [0x429b9c], 1
je 0x403e15
push 0xc8
push 0
push 0x439020
call fcn.0040a120
add esp, 0xc
push 0
push 0x26
push 0x439020
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x403d98
push str.c:Program_Files
push 0x439020
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push 0x439020
call esi
xor ecx, ecx
test eax, eax
jle 0x403dbd
mov dl, 0x28
mov edi, edi
cmp byte [ecx + 0x439020], dl
je 0x403dbd
inc ecx
cmp ecx, eax
jl 0x403db0
mov byte [ecx + 0x439020], 0
test ecx, ecx
jle 0x403ddb
mov eax, 0x439020
dec eax
mov edi, edi
cmp byte [eax + ecx], 0x20
jne 0x403ddb
dec ecx
test ecx, ecx
jg 0x403dd0
push 0x439020
mov byte [ecx + 0x439020], 0
call esi
pop esi
test eax, eax
jle 0x403e05
cmp byte [eax + 0x43901f], 0x5c
je 0x403e05
mov byte [eax + 0x439020], 0x5c
mov byte [eax + 0x439021], 0
push str.chenhu8_
push 0x439020
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, 0x439020
ret

Function at 0x403e20
Capabilities:
Get common file path

Disassembly:
sub esp, 0xcc
mov eax, dword [0x4250e0]
xor eax, esp
mov dword [esp + 0xc8], eax
push esi
push 0xc8
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp + 4]
push ecx
push 0x41cfd8
push 0x43c860
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
push 0x43c860
call dword [sym.imp.KERNEL32.dll__lopen]
mov esi, eax
cmp esi, 0xffffffff
je 0x403e99
cmp byte [esp + 0xd4], 1
mov eax, 0x439640
je 0x403e85
mov eax, 0x439020
push 0x200
push eax
push esi
call dword [sym.imp.KERNEL32.dll__lread]
push esi
call dword [sym.imp.KERNEL32.dll__lclose]
mov ecx, dword [esp + 0xcc]
pop esi
xor ecx, esp
call fcn.0040a10d
add esp, 0xcc
ret

Function at 0x403eb0
Capabilities:
Get disk information

Disassembly:
sub esp, 0xc
mov eax, dword [0x4250e0]
xor eax, esp
mov dword [esp + 8], eax
push ebx
push esi
push edi
push 0x41cff4
lea eax, [esp + 0x10]
push eax
mov byte [0x429c80], 0
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edi, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov bl, 0x67
mov esi, 6
lea ecx, [esp + 0xc]
push ecx
mov byte [esp + 0x10], bl
call edi
cmp eax, 3
je 0x403eff
dec esi
dec bl
cmp esi, 1
jg 0x403ee5
jmp 0x403f17
lea edx, [esp + 0xc]
push edx
push str._schenhu8_
push 0x429c80
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 0x429c80
call fcn.0040a10d
add esp, 0xc
ret
Function at 0x403f30
Capabilities:
Get common file path

Disassembly:
sub esp, 0xcc
mov eax, dword [0x4250e0]
xor eax, esp
mov dword [esp + 0xc8], eax
push ebx
push ebp
push esi
push edi
push 0xc8
push 0x43c780
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x43c780
push 0x41cfd8
push 0x43c860
call dword [sym.imp.USER32.dll_wsprintfA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
add esp, 0xc
push 0x439020
call edi
test eax, eax
jle 0x403f98
mov cl, 0x5c
cmp byte [eax + 0x43901f], cl
je 0x403f98
mov byte [eax + 0x439020], cl
mov byte [eax + 0x439021], 0
push 0x439020
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ebx, dword [sym.imp.KERNEL32.dll__lcreat]
push 0
push 0x43c860
call ebx
lea ecx, [esp + 0x10]
push ecx
mov esi, eax
call edi
mov ebp, dword [sym.imp.KERNEL32.dll__lwrite]
push eax
lea edx, [esp + 0x14]
push edx
push esi
call ebp
push esi
call dword [sym.imp.KERNEL32.dll__lclose]
push 0xc8
push 0x43c780
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp dword [0x439760], 6
jl 0x404032
call fcn.00403eb0
mov esi, eax
push esi
call fcn.0040a5e1
push esi
push str._schenpat8.chh
push 0x43c860
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0
push 0x43c860
call ebx
push 0x439020
mov esi, eax
call edi
push eax
push 0x439020
push esi
call ebp
push esi
call dword [sym.imp.KERNEL32.dll__lclose]
mov ecx, dword [esp + 0xd8]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040a10d
add esp, 0xcc
ret
Function at 0x404050
Capabilities:
Delete registry value
Set registry value

Disassembly:
sub esp, 0x24
mov eax, dword [0x4250e0]
xor eax, esp
mov dword [esp + 0x20], eax
lea eax, [esp + 4]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsUser_Agent
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x404153
push edi
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 8]
push edx
push eax
push 0xf003f
push eax
push eax
push eax
mov eax, dword [esp + 0x24]
push str.Post_Platform
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x40414b
push ebx
push esi
push str.znwb6300
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov bl, 0x33
mov edi, edi
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x18]
push edx
push eax
mov byte [esp + 0x25], bl
call esi
inc bl
cmp bl, 0x39
jb 0x4040d0
mov byte [esp + 0x1c], 0x37
mov bl, 0x30
mov edi, edi
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x18]
push ecx
push edx
mov byte [esp + 0x25], bl
call esi
inc bl
cmp bl, 0x39
jbe 0x4040f0
mov byte [esp + 0x1c], 0x38
mov bl, 0x30
mov edi, edi
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x18]
push eax
push ecx
mov byte [esp + 0x25], bl
call esi
inc bl
cmp bl, 0x39
jbe 0x404110
mov edx, dword [esp + 0xc]
push 0
push 0x41c3e3
push 1
push 0
push str.znwb8800
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0xc]
push eax
call edi
pop esi
pop ebx
mov ecx, dword [esp + 8]
push ecx
call edi
pop edi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0040a10d
add esp, 0x24
ret
Function at 0x404340
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x40
mov eax, dword [0x4250e0]
xor eax, esp
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x4c]
push ebx
mov ebx, dword [esp + 0x4c]
push esi
mov dword [esp + 0x18], eax
xor eax, eax
push edi
mov edi, dword [esp + 0x50]
mov byte [ebx], al
cmp byte [edi + 1], 0x30
mov dword [esp + 0x10], eax
mov byte [esp + 0xf], al
jne 0x404378
mov byte [esp + 0xf], 1
mov ecx, dword [edi + 6]
mov dword [esp + 0x18], ecx
mov esi, 0xa
mov dword [esp + 0x14], eax
cmp ecx, eax
jbe 0x40447c
push ebp
cmp byte [edi + esi], 0x43
lea ebp, [edi + esi]
jne 0x404461
cmp byte [edi + esi + 1], 0x46
jne 0x404461
add esi, 2
lea ecx, [edi + esi]
push ecx
push 0x439020
push 0x41c5ac
push 0x43c860
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
cmp byte [esp + 0x13], 1
jne 0x4043d8
mov eax, dword [edi + esi + 0x32]
add esi, 0x36
jmp 0x4043df
mov eax, dword [edi + esi + 0xe]
add esi, 0x12
lea edx, [esp + 0x24]
push edx
push 0x43c860
add esi, eax
call fcn.00404270
add esp, 8
cmp byte [esp + 0x13], 1
jne 0x40442e
lea eax, [ebp + 0x12]
push eax
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x404413
inc dword [esp + 0x14]
jmp 0x40444e
mov edx, dword [esp + 0x20]
add ebp, 2
push ebp
push edx
call fcn.00403ca0
add esp, 8
test eax, eax
je 0x40443c
inc dword [esp + 0x14]
jmp 0x40444e
cmp eax, dword [ebp + 0x10]
jb 0x404439
inc dword [esp + 0x14]
jmp 0x40444e
add ebp, 2
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcatA]
push ebx
call ebp
push str.....
push ebx
call ebp
mov eax, dword [esp + 0x18]
inc eax
mov dword [esp + 0x18], eax
cmp eax, dword [esp + 0x1c]
jb 0x404391
mov eax, dword [esp + 0x14]
pop ebp
cmp eax, dword [esp + 0x18]
jae 0x40447c
push 0x41d0a8
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x48]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040a10d
add esp, 0x40
ret
Function at 0x404b00
Capabilities:
Get storage device properties

Disassembly:
sub esp, 0x54
mov eax, dword [0x4250e0]
xor eax, esp
mov dword [esp + 0x50], eax
push ebx
push ebp
mov ebp, dword [esp + 0x60]
push esi
xor esi, esi
push esi
lea eax, [esp + 0x20]
push str..PHYSICALDRIVE_d
push eax
mov byte [ebp], 0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push esi
push esi
push 3
push esi
push 3
push 0xc0000000
lea ecx, [esp + 0x34]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
xor eax, eax
cmp ebx, 0xffffffff
je 0x404be7
push 0x2710
push esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
push 0x4269d8
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
call fcn.0040a120
add esp, 0xc
push esi
lea edx, [esp + 0x10]
push edx
push 0x2710
push 0x4269d8
push 0xc
lea eax, [esp + 0x24]
push eax
push 0x2d1400
push ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x404bde
mov esi, dword [0x4269f0]
push edi
lea esi, [esi + 0x4269d8]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
xor edx, edx
xor ecx, ecx
test edi, edi
jle 0x404bd9
nop
test edx, edx
jne 0x404bcd
cmp byte [esi + ecx], 0x20
ja 0x404bcd
inc ecx
jmp 0x404bc4
mov al, byte [esi + ecx]
mov byte [edx + ebp], al
inc ecx
inc edx
cmp ecx, edi
jl 0x404bc0
mov byte [edx + ebp], 0
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [esp + 0x5c]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040a10d
add esp, 0x54
ret
Function at 0x404f50
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
push str.Software
lea edi, [esi + 0x64]
mov byte [esi], 0
push 0x80000002
mov dword [esp + 0x24], 4
mov ebp, 1
mov byte [edi], 0
call ebx
test eax, eax
jne 0x40501a
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
push ecx
push 0xf003f
push eax
push str.Chznwb
push edx
call ebx
test eax, eax
jne 0x40500b
mov ecx, dword [esp + 0x1c]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x10]
push eax
push esi
push 0
push 0
push 0x41d148
push ecx
mov dword [esp + 0x28], 0x18
call ebx
test eax, eax
je 0x404fdc
xor ebp, ebp
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x10]
push edx
push edi
push 0
push 0
push str.cqpy
push eax
mov dword [esp + 0x28], 0x18
call ebx
test eax, eax
je 0x405000
xor ebp, ebp
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebp, ebp
je 0x405067
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
call ebx
cmp eax, 0xc
jne 0x405067
push esi
call ebx
cmp eax, 0x17
jne 0x405067
xor eax, eax
add byte [eax + esi], 0xeb
inc eax
cmp eax, 0x17
jl 0x405032
xor eax, eax
mov edi, edi
add byte [edi + eax], 0xed
inc eax
cmp eax, 0xc
jl 0x405040
push edi
lea ebx, [esi + 0xb]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x40505c
mov byte [esi], 0
pop edi
pop esi
pop ebp
mov byte [ebx], 0
pop ebx
add esp, 8
ret
pop edi
mov byte [esi], 0
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x405080
Capabilities:
Delete registry value
Set registry value

Disassembly:
sub esp, 0x18
push esi
push edi
mov edi, dword [esp + 0x24]
lea eax, [esp + 0x10]
push eax
lea esi, [edi + 0x64]
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
movzx ecx, word [esp + 0x1c]
movzx edx, word [esp + 0x1a]
movzx eax, word [esp + 0x18]
push ecx
movzx ecx, word [esp + 0x1a]
push edx
movzx edx, word [esp + 0x1a]
push eax
movzx eax, word [esp + 0x1c]
push ecx
push edx
push eax
lea ecx, [esi + 0x32]
push str._04d_02d_02d_02d_02d_02d
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x20
lea edx, [esi + 0x34]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
xor eax, eax
add byte [eax + edi], 0x15
inc eax
cmp eax, 0x17
jl 0x4050e2
xor eax, eax
mov edi, edi
add byte [eax + esi], 0x13
inc eax
cmp eax, 0xc
jl 0x4050f0
lea eax, [esp + 8]
push eax
push 0x20019
push 0
push str.Software
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4051c7
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x28]
push edx
push eax
push 0xf003f
push eax
push eax
push eax
mov eax, dword [esp + 0x24]
push str.Chznwb
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4051bc
mov ecx, dword [esp + 0x24]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push ebp
push 0x41d148
push ecx
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
call ebp
mov edx, dword [esp + 0x2c]
push eax
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 1
push 0
push 0x41d148
push edx
call edi
test eax, eax
je 0x405184
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [esp + 0x2c]
push str.cqpy
push eax
call ebx
push esi
call ebp
mov ecx, dword [esp + 0x2c]
push eax
push esi
push 1
push 0
push str.cqpy
push ecx
call edi
pop ebp
pop ebx
test eax, eax
je 0x4051b1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0x24]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
add esp, 0x18
ret
Function at 0x405280
Capabilities:
Get session user name

Disassembly:
sub esp, 0xf8
mov eax, dword [0x4250e0]
xor eax, esp
mov dword [esp + 0xf4], eax
push esi
mov esi, dword [esp + 0x100]
push edi
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x38]
push ecx
mov edi, 1
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0xc6
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push 0
push 0
lea edx, [esp + 0x14]
push edx
push 0
push 0
push 4
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_GetNamedSecurityInfoA]
test eax, eax
jne 0x40532d
push 3
push edi
push 0x10000000
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_BuildExplicitAccessWithNameA]
mov eax, dword [esp + 0xc]
lea edx, [esp + 8]
push edx
push eax
lea ecx, [esp + 0x1c]
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclA]
test eax, eax
jne 0x40532d
mov edx, dword [esp + 8]
push eax
push edx
push eax
push eax
push 4
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoA]
test eax, eax
je 0x40532f
xor edi, edi
mov eax, dword [esp + 8]
test eax, eax
je 0x40533e
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [esp + 0xfc]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.0040a10d
add esp, 0xf8
ret

Function at 0x405380
Capabilities:
Create directory

Disassembly:
sub esp, 0xc
lea eax, [esp]
push eax
mov dword [esp + 4], 0xc
mov dword [esp + 0xc], 0
call fcn.00405360
add esp, 4
test eax, eax
je 0x4053bc
mov edx, dword [esp + 0x10]
lea ecx, [esp]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x4053c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
add esp, 0xc
ret
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
neg eax
sbb eax, eax
inc eax
add esp, 0xc
ret

Function at 0x4054c0
Capabilities:
Check os version
Get system information on windows

Disassembly:
sub esp, 0x24
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov cx, ax
mov edx, 0xff
and cx, dx
imul cx, cx, 0xa
movzx ax, ah
add cx, ax
mov word [0x43cddc], cx
cmp cx, 0x3c
jae 0x4054f5
mov eax, 0x20
add esp, 0x24
ret
call fcn.00402770
lea ecx, [esp]
push ecx
mov dword [0x43cb08], eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov ax, word [esp]
cmp ax, 9
je 0x40551e
cmp ax, 6
mov eax, 0x20
jne 0x405523
mov eax, 0x40
add esp, 0x24
ret
Function at 0x405dc0
Capabilities:
Enumerate files on windows
Get file attributes
Set current directory

Disassembly:
sub esp, 0x44c
mov eax, dword [0x4250e0]
xor eax, esp
mov dword [esp + 0x448], eax
push ebx
push ebp
push esi
push edi
call fcn.00403d40
xor ebx, ebx
push 0x439020
mov byte [0x43c328], bl
mov byte [0x4390f4], bl
mov byte [0x43c320], bl
mov byte [0x43ca05], bl
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, ebx
jle 0x405e1c
mov cl, 0x5c
cmp byte [eax + 0x43901f], cl
je 0x405e1c
mov byte [eax + 0x439020], cl
mov byte [eax + 0x439021], bl
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
push 0x439020
lea eax, [esp + 0x154]
push str._s.
push eax
call edi
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x154]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebp, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov esi, eax
cmp esi, 0xffffffff
je 0x405f4f
lea ecx, [ecx]
mov byte [0x43c328], 1
mov ecx, 0x41d400
lea eax, [esp + 0x3c]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x405e90
cmp dl, bl
je 0x405e8c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x405e90
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x405e70
xor eax, eax
jmp 0x405e95
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x405f3b
mov ecx, 0x41d3fc
lea eax, [esp + 0x3c]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x405ec6
cmp dl, bl
je 0x405ec2
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x405ec6
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x405ea6
xor eax, eax
jmp 0x405ecb
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x405f3b
lea eax, [esp + 0x3c]
push eax
push 0x439020
lea ecx, [esp + 0x25c]
push 0x41c5ac
push ecx
call edi
add esp, 0x10
lea edx, [esp + 0x254]
push edx
call ebp
test eax, eax
jne 0x405f3b
lea eax, [esp + 0x3c]
push str..txt
push eax
call fcn.00403ca0
add esp, 8
test eax, eax
je 0x405f17
inc byte [0x4390f4]
jmp 0x405f3b
lea ecx, [esp + 0x3c]
push str..chh
push ecx
call fcn.00403ca0
add esp, 8
test eax, eax
je 0x405f35
inc byte [0x43c320]
jmp 0x405f3b
inc byte [0x43ca05]
lea edx, [esp + 0x10]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x405e60
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x439020
call ebp
pop edi
pop esi
pop ebp
pop ebx
test eax, eax
je 0x405f6c
add byte [0x43c328], 0xa
push 0x439020
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0x10
jne 0x405f83
add byte [0x43c328], 3
mov ecx, dword [esp + 0x448]
xor ecx, esp
call fcn.0040a10d
add esp, 0x44c
ret