joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46ecc0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x4ee4f0]
xor edx, edx
cmp eax, edx
jne 0x46ece6
xor eax, eax
mov byte [eax + 0x4ee3f0], al
inc eax
cmp eax, 0x100
jl 0x46ecce
mov dword [0x4ee4f0], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x4ee3f0
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x46ed77
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x46ed4a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x46ed18
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x46edf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x46ee43
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x46ee2a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x475800
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a327e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.00476120
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x4ade14
call fcn.0049449a
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x475893
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0049449a
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x47588c
push 0
mov ecx, eax
call fcn.0046c900
mov dword [esi + 0xc], eax
jmp 0x475895
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x475895
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x496b27
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x496b5f
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00494bb4
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00494b8c
jmp 0x496b6b
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x498219
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x49825b
call fcn.0049dd8c
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x49825b
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x498252
xor eax, eax
jmp 0x498263
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00498269
pop edi
pop esi
pop ebx
ret 4

Function at 0x49e2bc
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x49e2ea
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x49e308
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0049e222
jmp 0x49e308
mov eax, dword [esi + 0x14]
test eax, eax
je 0x49e308
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0049e222
test edi, edi
mov eax, edi
jne 0x49e2f2
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x215f058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.0215f1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x215f07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x215f06a
add dl, dl
jne 0x215f089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x215f0dc
xor eax, eax
add dl, dl
jne 0x215f096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x215f17d
add dl, dl
jne 0x215f0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x215f0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x215f0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x215f0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x215f0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x215f075
mov eax, 1
add dl, dl
jne 0x215f0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x215f0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x215f0e1
sub eax, ebx
mov ebx, 1
jne 0x215f128
mov ecx, 1
add dl, dl
jne 0x215f10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x215f119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x215f105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x215f075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x215f13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x215f14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x215f136
cmp eax, 0x7d00
jae 0x215f16d
cmp eax, 0x500
jb 0x215f168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x215f075
cmp eax, 0x7f
ja 0x215f170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x215f075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x215f19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x215f075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x40141e
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x214
lea eax, [esp]
push ebp
push esi
mov esi, dword [esp + 0x228]
push edi
mov edi, dword [esp + 0x22c]
and esi, 0x300
push eax
mov eax, esi
and edi, 1
or eax, 9
push eax
push dword [esp + 0x230]
push dword [esp + 0x230]
call fcn.0040629d
test eax, eax
jne 0x401527
xor ebp, ebp
test byte [esp + 0x22c], 2
je 0x401493
push ebp
push ebp
push ebp
push ebp
lea eax, [esp + 0x20]
mov dword [esp + 0x20], ebp
push eax
lea eax, [esp + 0x28]
push eax
push ebp
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
jne 0x401503
push 0x105
lea eax, [esp + 0x18]
push eax
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
jmp 0x4014ce
test edi, edi
jne 0x401503
push dword [esp + 0x22c]
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x14]
call fcn.0040141e
test eax, eax
jne 0x4014d8
push 0x105
lea eax, [esp + 0x18]
push eax
push edi
push dword [esp + 0x18]
call ebp
test eax, eax
je 0x4014a6
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.004068ab
test eax, eax
jne 0x401514
push dword [esp + 0x228]
push dword [esp + 0x228]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x401527
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x3eb
jmp 0x401527
push 0
push esi
push dword [esp + 0x230]
push dword [esp + 0x230]
call eax
pop edi
pop esi
pop ebp
add esp, 0x214
ret 0xc
Function at 0x4032ff
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
push edi
xor edi, edi
test ecx, ecx
js 0x403328
mov eax, dword [0x434278]
push edi
add eax, ecx
push edi
push eax
push dword [0x40a014]
mov dword [0x40c974], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
call fcn.00403180
test eax, eax
js 0x4033fe
push ebx
push esi
push 4
lea eax, [ebp + 8]
push eax
push dword [0x40a014]
call fcn.0040690d
test eax, eax
je 0x4033f9
push dword [ebp + 8]
add dword [0x40c974], 4
call fcn.00403180
mov esi, eax
test esi, esi
js 0x4033f5
cmp dword [ebp + 0x10], edi
jne 0x4033c9
mov ecx, dword [ebp + 8]
test ecx, ecx
jle 0x4033f5
mov ebx, 0x4000
mov edi, 0x41e550
cmp ecx, ebx
mov eax, ebx
cmovl eax, ecx
push eax
push edi
push dword [0x40a014]
mov dword [ebp - 4], eax
call fcn.0040690d
test eax, eax
je 0x4033f9
push dword [ebp - 4]
push edi
push dword [ebp + 0xc]
call fcn.004069d0
test eax, eax
je 0x4033c5
mov eax, dword [ebp - 4]
add esi, eax
mov ecx, dword [ebp + 8]
add dword [0x40c974], eax
sub ecx, eax
mov dword [ebp + 8], ecx
test ecx, ecx
jg 0x403381
jmp 0x4033f5
push 0xfffffffffffffffe
jmp 0x4033fb
push edi
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0x14]
cmp dword [ebp + 8], eax
cmovl eax, dword [ebp + 8]
push eax
push dword [ebp + 0x10]
push dword [0x40a014]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4033f9
mov esi, dword [ebp - 4]
add dword [0x40c974], esi
mov eax, esi
jmp 0x4033fc
push 0xfffffffffffffffd
pop eax
pop esi
pop ebx
pop edi
leave
ret 0x10

Function at 0x403421
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
cmp dword [ebp + 8], 0
je 0x403449
mov eax, dword [0x40c988]
test eax, eax
je 0x403440
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
and dword [0x40c988], 0
leave
ret
cmp dword [0x40c988], 0
je 0x40345b
push 0
call fcn.004061d4
leave
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [0x434220]
jbe 0x4034c5
cmp dword [0x433218], 0
je 0x4034a0
test byte [0x434314], 1
je 0x4034c5
call fcn.00403403
push eax
lea eax, [ebp - 0x80]
push str....__d__
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
push 0
call fcn.00405d0e
leave
ret
push 0
push 0x4037a4
push 0
push 0x6f
push dword [0x433214]
call dword [sym.imp.USER32.dll_CreateDialogParamW]
push 5
push eax
mov dword [0x40c988], eax
call dword [sym.imp.USER32.dll_ShowWindow]
leave
ret
Function at 0x405df2
Capabilities:
Create directory

Disassembly:
push esi
xor esi, esi
push esi
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x405e0c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, esi
pop esi
ret 4
Function at 0x406163
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
lea eax, [ebp - 0x23c]
push esi
mov esi, 0x104
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
ja 0x40619d
test eax, eax
je 0x40619d
add eax, eax
cmp word [ebp + eax - 0x23e], 0x5c
je 0x40619f
mov ecx, 0x4082a8
jmp 0x4061a4
xor eax, eax
mov ecx, 0x4082aa
push dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x23c]
add eax, ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406202
Capabilities:
Move file

Disassembly:
push 5
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x406225
push dword [esp + 8]
push dword [esp + 8]
call fcn.004062cb
pop ecx
pop ecx
inc dword [0x4342f0]
ret 8

Function at 0x4062cb
Capabilities:
Get file size

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
mov ebx, 0x400
mov dword [0x4301d8], 0x55004e
mov ebp, 0x4301d8
mov dword [0x4301dc], 0x4c
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test esi, esi
je 0x406321
push 1
push 0
push esi
call fcn.004068e0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push ebp
push esi
call edi
test eax, eax
je 0x406401
cmp eax, ebx
jg 0x406401
push ebx
mov esi, 0x42f9d8
push esi
push dword [esp + 0x1c]
call edi
test eax, eax
je 0x406401
cmp eax, ebx
jg 0x406401
push esi
push ebp
push str._ls_ls_r_n
push 0x42f5d8
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [0x434230]
add esp, 0x10
mov ebp, eax
push dword [ecx + 0x128]
push esi
call fcn.00405e6d
push 4
push 0xc0000000
push esi
call fcn.004068e0
mov ebx, eax
cmp ebx, 0xffffffff
je 0x406401
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea ecx, [ebp + 0xa]
add ecx, esi
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x4063fa
push esi
push edi
push ebx
call fcn.0040690d
test eax, eax
je 0x4063fa
push str._Rename__r_n
push edi
call fcn.00406afb
test eax, eax
jne 0x406406
push str._Rename__r_n
lea eax, [edi + esi]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esi, 0xa
mov ecx, esi
push ebp
push 0x42f5d8
lea eax, [ecx + edi]
push eax
call fcn.00406679
xor eax, eax
push eax
push eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esi + ebp]
push eax
push edi
push ebx
call fcn.004069d0
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
ret
push 0x408984
add eax, 0xa
push eax
call fcn.00406afb
mov ecx, eax
test ecx, ecx
je 0x4063cb
lea edx, [edi + esi]
jmp 0x406425
mov al, byte [edx]
mov byte [edx + ebp], al
dec edx
cmp edx, ecx
ja 0x40641f
sub ecx, edi
inc ecx
jmp 0x4063cd
Function at 0x40654a
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 8]
call fcn.00406b62
mov edi, eax
cmp edi, 0xffffffff
je 0x40658d
test byte [ebp + 0xc], 1
push dword [ebp + 8]
je 0x40656e
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x406574
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x40657d
xor eax, eax
inc eax
jmp 0x40658f
test byte [ebp + 0xc], 4
jne 0x40658d
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor eax, eax
pop edi
pop ebp
ret 8

Function at 0x4065fd
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push dword [esp + 0xc]
mov ebx, 0x42edd8
push ebx
call fcn.00406adf
push ebx
call fcn.00406b8a
mov esi, eax
test esi, esi
je 0x406672
push esi
call fcn.00406d02
test byte [0x43422c], 0x80
je 0x406636
movzx eax, word [esi]
test ax, ax
je 0x406672
cmp eax, 0x5c
je 0x406672
sub esi, ebx
sar esi, 1
jmp 0x406650
call fcn.00406594
test eax, eax
je 0x40664a
test byte [eax], 0x10
je 0x406672
push ebx
call fcn.00406cd5
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
cmp eax, esi
jg 0x40663c
call fcn.0040651b
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x406672
xor eax, eax
inc eax
jmp 0x406674
xor eax, eax
pop esi
pop ebx
ret 4

Function at 0x40669b
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x42e590], 0x44
lea eax, [ebp - 0x10]
push eax
push 0x42e590
xor eax, eax
push eax
push eax
push 0x4000000
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4066da
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4
Function at 0x4066de
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x25c
push ebx
mov ebx, dword [esp + 0x268]
push esi
mov esi, dword [esp + 0x268]
push edi
mov edi, ebx
push esi
and edi, 4
call fcn.004065fd
mov dword [esp + 0x14], eax
test bl, 8
je 0x406720
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
inc eax
add dword [0x4342e8], eax
jmp 0x40689f
push ebp
mov ebp, ebx
and ebp, 1
mov dword [esp + 0x14], ebp
je 0x40673d
test eax, eax
je 0x40688e
test bl, 2
je 0x406857
push esi
push 0x42e5d8
call fcn.00406adf
test ebp, ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcatW]
je 0x406760
push str..
push 0x42e5d8
call ebp
jmp 0x406766
push esi
call fcn.00406cd5
xor eax, eax
cmp word [esi], ax
jne 0x406777
cmp word [0x42e5d8], 0x5c
jne 0x40677f
push 0x4082a8
push esi
call ebp
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esi + eax*2]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x1c]
push eax
push 0x42e5d8
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x406840
push 0x2e
pop eax
cmp word [esp + 0x48], ax
jne 0x4067c9
cmp word [esp + 0x4a], 0
je 0x406822
cmp word [esp + 0x4a], ax
jne 0x4067c9
cmp word [esp + 0x4c], 0
je 0x406822
lea eax, [esp + 0x48]
push eax
push dword [esp + 0x14]
call fcn.00406adf
test byte [esp + 0x1c], 0x10
je 0x4067f0
mov eax, ebx
and eax, 3
cmp al, 3
jne 0x406822
push ebx
push esi
call fcn.004066de
jmp 0x406822
push edi
push esi
call fcn.0040654a
test eax, eax
jne 0x40681a
test edi, edi
je 0x406812
push esi
push 0xfffffffffffffff1
call fcn.00405d0e
xor eax, eax
push eax
push esi
call fcn.00406202
jmp 0x406822
inc dword [0x4342e8]
jmp 0x406822
push esi
push 0xfffffffffffffff2
call fcn.00405d0e
lea eax, [esp + 0x1c]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x4067ab
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [esp + 0x14], 0
je 0x40689e
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov word [eax - 2], cx
cmp dword [esp + 0x18], ecx
je 0x40688e
push esi
call fcn.00406594
test eax, eax
je 0x40689e
push esi
call fcn.0040651b
mov eax, edi
or eax, 1
push eax
push esi
call fcn.0040654a
test eax, eax
jne 0x406896
test edi, edi
je 0x40688e
push esi
push 0xfffffffffffffff1
call fcn.00405d0e
xor eax, eax
push eax
push esi
call fcn.00406202
jmp 0x40689e
inc dword [0x4342e8]
jmp 0x40689e
push esi
push 0xffffffffffffffe5
call fcn.00405d0e
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x25c
ret 8

Function at 0x4068e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
push 0
cmove eax, ecx
push eax
push dword [esp + 0x14]
push ecx
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
ret 0xc
Function at 0x40693c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
lea eax, [ebp - 4]
mov dword [ebp - 8], 0x800
push eax
mov eax, dword [ebp + 0x18]
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040629d
mov edi, dword [ebp + 0x14]
test eax, eax
jne 0x4069ae
push esi
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp + 0x18]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
mov word [edi + 0x7fe], ax
pop esi
jne 0x4069ae
cmp dword [ebp + 0x18], 1
je 0x4069b3
cmp dword [ebp + 0x18], 2
je 0x4069b3
xor eax, eax
mov word [edi], ax
pop edi
leave
ret 0x14

Function at 0x4069b8
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push eax
and dword [eax + 0x24], 0
mov dword [eax], 0x3c
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
ret 4

Function at 0x406a1b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp - 8], 0x73006e
mov dword [ebp - 4], 0x61
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
pop ecx
xor edx, edx
div ecx
push esi
add word [ebp - 4], dx
lea eax, [ebp - 8]
push 0
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x406a65
test edi, edi
jne 0x406a28
mov word [esi], ax
jmp 0x406a67
mov eax, esi
pop edi
pop esi
leave
ret 8

Function at 0x406b62
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x406b84
mov ecx, esi
and ecx, 0xfffffffe
push ecx
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4

Function at 0x406e01
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x430c2c], 0
push esi
jne 0x406e3b
xor ecx, ecx
push 8
mov edx, ecx
pop esi
mov eax, edx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr edx, 1
and eax, 0xedb88320
xor edx, eax
sub esi, 1
jne 0x406e12
mov dword [ecx*4 + 0x430c28], edx
inc ecx
cmp ecx, 0x100
jl 0x406e0d
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x10]
not ecx
test edx, edx
je 0x406e65
mov esi, dword [esp + 0xc]
movzx eax, byte [esi]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x430c28]
inc esi
sub edx, 1
jne 0x406e4d
not ecx
mov eax, ecx
pop esi
ret 0xc
Function at 0x11651190
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x117b2768]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
test eax, eax
jne 0x116511d0
mov esi, str.Wtsapi32.dll
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x116511bb
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.WTSQueryUserToken
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x117b2768], eax
je 0x1165121e
push ebx
push dword [ebp + 8]
call eax
mov edi, eax
test edi, edi
jne 0x1165121e
call fcn.116ba640
cmp eax, dword [ebp + 8]
je 0x1165121e
push 1
push str.SeDebugPrivilege
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.116a68c0
call fcn.11651df0
push eax
call fcn.116a7510
add esp, 0x10
mov esi, eax
push ebx
push dword [ebp + 8]
call dword [0x117b2768]
test esi, esi
mov edi, eax
je 0x1165121e
call fcn.116a7820
xor eax, eax
cmp dword [0x117bf398], eax
je 0x1165124c
cmp ebx, eax
je 0x1165122e
mov eax, dword [ebx]
push eax
push dword [ebp + 8]
push edi
push str.CAdminTokenMgr::UseWTSQueryUserToken__Ret___d__dwSessionId__d__hToken__08x_
push str.AdminToken
push 0xffffffffffffffff
push 0x117beb04
call fcn.116bdf00
add esp, 0x1c
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret