joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402610
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x431c38]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x114], eax
lea eax, [ebp - 0x108]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x108]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
push esi
call fcn.0040a096
add esp, 4
mov edi, eax
lea eax, [ebp - 0x108]
push edi
push esi
push 0
push eax
call sub.VERSION.dll_GetFileVersionInfoA
mov eax, 0x400
mov word [ebp - 0x110], ax
lea eax, [ebp - 0x110]
mov dword [ebp - 0x10c], eax
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x10c]
push eax
push 0x427724
push edi
call sub.VERSION.dll_VerQueryValueA
mov ecx, dword [ebp - 0x10c]
push 0x42766c
movzx eax, word [ecx + 2]
push eax
movzx eax, word [ecx]
push eax
push edi
call fcn.004023e0
mov esi, dword [ebp - 0x114]
push esi
push ebx
push eax
mov dword [ebp - 0x118], eax
call fcn.00401e40
add esp, 0x1c
test ebx, ebx
je 0x4026f0
push esi
push ebx
push dword [ebp - 0x118]
call fcn.00401730
add esp, 0xc
test eax, eax
je 0x40270a
push edi
call fcn.0040a07b
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00406b74
mov esp, ebp
pop ebp
push str.Eula_declined._n_n
push 2
call fcn.0040a4ba
add esp, 4
push eax
call fcn.004027c0
add esp, 8
push 1
call fcn.0040a3dc
int3

Function at 0x402730
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
push edi
lea eax, [ebx - 0x834]
mov edi, 0x1300
cmp eax, 0x383
ja 0x402768
push 2
push esi
push str.netmsg.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov esi, eax
mov eax, 0x1b00
test esi, esi
cmovne edi, eax
push 0
push 0
lea eax, [ebp + 8]
push eax
push 0x400
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
je 0x4027a4
push 0
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp + 8]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
test esi, esi
je 0x4027af
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402830
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
test eax, eax
jne 0x402862
mov esi, str.Counter_009
mov ebx, str.Last_Counter
jmp 0x402875
cmp eax, 1
jne 0x4029a1
mov esi, str.Explain_009
mov ebx, str.Last_Help
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
push 0x20019
push 0
push str.softwaremicrosoftwindows_ntcurrentversionperflib
push 0x80000002
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4029a1
lea eax, [ebp - 8]
push eax
push edi
push 0
push 0
push ebx
push dword [ebp + 8]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call ebx
push dword [ebp + 8]
test eax, eax
je 0x4028d3
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0
push esi
push 0x80000004
call ebx
test eax, eax
jne 0x4029a1
push dword [ebp - 4]
call fcn.00406bbc
add esp, 4
mov dword [edi + 8], eax
lea ecx, [ebp - 4]
push ecx
push eax
push 0
push 0
push esi
push 0x80000004
call ebx
test eax, eax
jne 0x40293b
mov eax, dword [edi]
xor ecx, ecx
inc eax
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00406bbc
mov ecx, eax
add esp, 4
mov dword [edi + 4], ecx
test ecx, ecx
jne 0x402951
push dword [edi + 8]
call fcn.00406bc5
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi]
lea eax, [eax*4 + 4]
push eax
push 0
push ecx
call fcn.00407be0
mov esi, dword [edi + 8]
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
test ebx, ebx
je 0x4029a1
push esi
call fcn.004118b8
add esp, 4
cmp eax, dword [edi]
ja 0x4029a1
mov ecx, dword [edi + 4]
inc ebx
add esi, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
mov dword [ecx + eax*4], esi
call ebx
inc eax
add esi, eax
push esi
call ebx
mov ebx, eax
test ebx, ebx
jne 0x402976
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x406370
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x431c38]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
push 0x58
push dword [edi]
call fcn.00406bfa
add esp, 8
mov dword [edi], 0
test ebx, ebx
je 0x4063f7
xor eax, eax
xor ecx, ecx
cmp byte [0x432662], al
je 0x4063d6
cmp dword [0x431c1c], 0x10
mov eax, 0x431c08
mov ecx, 0x431c20
cmovae eax, dword [0x431c08]
cmp dword [0x431c34], 0x10
cmovae ecx, dword [0x431c20]
lea edx, [ebp - 0x10c]
push edx
push 0x80000004
push ecx
push eax
push ebx
call fcn.004024d0
add esp, 0x14
test eax, eax
jne 0x40655c
jmp 0x406401
mov dword [ebp - 0x10c], 0x80000004
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_IsBadStringPtrA]
test eax, eax
jne 0x40655c
push esi
call fcn.00411bd5
push 0x427780
push eax
mov dword [ebp - 0x110], eax
lea esi, [ebp - 0x104]
call fcn.00412854
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x40647c
nop dword [eax + eax]
mov ecx, dword [edi + 4]
push ebx
call fcn.004029e0
test eax, eax
je 0x406455
push eax
push 0x4287e0
jmp 0x40645b
push ebx
push 0x4287e4
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
add esi, eax
push 0x427780
push 0
call fcn.00412854
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x406440
push dword [ebp - 0x110]
call fcn.0040a07b
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x108]
add esp, 4
mov dword [ebp - 0x108], 0
xor esi, esi
mov dword [edi], esi
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x10c]
call ebx
test eax, eax
je 0x406521
nop dword [eax + eax]
cmp eax, 0xea
jne 0x40654c
push dword [edi]
call fcn.00406bc5
mov eax, dword [ebp - 0x108]
add esp, 4
cmp eax, esi
jbe 0x4064e7
lea esi, [eax + 0x1000]
jmp 0x4064ed
add esi, 0x1000
push esi
call fcn.00406bbc
add esp, 4
mov dword [edi], eax
test eax, eax
je 0x40654c
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x108], esi
push ecx
push eax
push 0
push 0
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x10c]
call ebx
test eax, eax
jne 0x4064c0
mov eax, dword [edi]
cmp dword [eax], 0x450050
jne 0x40654c
cmp dword [eax + 4], 0x460052
jne 0x40654c
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00406b74
mov esp, ebp
pop ebp
ret 8
push dword [edi]
call fcn.00406bc5
add esp, 4
mov dword [edi], 0
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406b74
mov esp, ebp
pop ebp
ret 8

Function at 0x4078ac
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4078eb
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4078eb
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4078eb
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4078eb
cmp dword [ecx + 0x74], 0xe
jbe 0x4078eb
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x414dae
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42b0d4
push 0x42b0cc
push str.FlsAlloc
push 0x1f
call fcn.00414c2d
mov esi, eax
add esp, 0x10
test esi, esi
je 0x414de2
push dword [ebp + 8]
mov ecx, esi
call dword [0x4211ec]
call esi
jmp 0x414de8
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x414e2c
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42b0e4
push 0x42b0dc
push str.FlsGetValue
push 0x21
call fcn.00414c2d
mov esi, eax
add esp, 0x10
test esi, esi
je 0x414e63
push dword [ebp + 8]
mov ecx, esi
call dword [0x4211ec]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x414e6b
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42b0ec
push 0x42b0e4
push str.FlsSetValue
push 0x22
call fcn.00414c2d
mov esi, eax
add esp, 0x10
test esi, esi
je 0x414ea5
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x4211ec]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x417b93
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00407540
mov eax, dword [0x431c38]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.00410c39
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x417bd5
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x417d31
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00406e60
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x432e70]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.0041d416
mov ecx, dword [esi*4 + 0x432e70]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x417d2a
cmp eax, dword [ecx + edi + 0x24]
jne 0x417d2a
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x417d2a
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0041d416
add esp, 0x14
test edx, edx
jl 0x417d2a
jg 0x417ca0
test eax, eax
jb 0x417d2a
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x417d2a
jl 0x417cba
cmp dword [ebp - 0x1008], eax
ja 0x417d2a
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x417cd8
test ebx, ebx
je 0x417d11
cmp ecx, edi
jae 0x417d11
mov al, byte [ecx]
cmp al, 0xd
jne 0x417cf2
lea eax, [edi - 1]
cmp ecx, eax
jae 0x417cfe
cmp byte [ecx + 1], 0xa
jne 0x417cfe
inc ecx
jmp 0x417cfe
movzx eax, al
movsx eax, byte [eax + 0x4323f0]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x417cd8
cmp edx, ebx
jne 0x417cd8
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x417d2f
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00406b74
leave
ret
Function at 0x419c49
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x419ce6
push ebx
push esi
call fcn.00419c12
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00416a0b
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x419c93
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x419ce5
push edi
push eax
call fcn.00414929
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x419cb3
call fcn.004148ef
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x419ce4
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00416a0b
add esp, 0x20
test eax, eax
jne 0x419cd2
push edi
call fcn.004148ef
jmp 0x419cda
push ebx
call fcn.004148ef
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x41f940
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41f96d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41f96d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401830
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x454
push ebx
push edi
xor ebx, ebx
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x5d]
mov byte [esp + 0x5c], bl
lea edx, [esp + 0x5c]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x460]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x464]
push eax
push ecx
push edx
call dword [sym.imp.USER32.dll_wvsprintfA]
xor eax, eax
mov ecx, 0x11
mov dword [esp + 8], eax
lea edi, [esp + 0x18]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], eax
push ecx
mov dword [esp + 0x1c], 0x44
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
lea edx, [esp + 8]
lea eax, [esp + 0x18]
push edx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
lea ecx, [esp + 0x78]
push ebx
push ecx
push ebx
mov dword [esp + 0x6c], 1
mov word [esp + 0x70], bx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4018e7
mov edx, dword [esp + 0xc]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 0xc]
push eax
call esi
pop esi
pop edi
mov al, 1
pop ebx
add esp, 0x454
ret
mov al, bl
pop edi
pop ebx
add esp, 0x454
ret
Function at 0x401910
Capabilities:
Check if file exists
Check mutex on windows
Contain obfuscated stackstrings
Create thread

Disassembly:
sub esp, 0x30
mov al, 0x6c
push ebx
mov byte [esp + 5], al
mov byte [esp + 9], al
mov al, 0x30
mov bl, 0x34
mov byte [esp + 0xf], al
mov byte [esp + 0x11], al
mov al, 0x2d
mov dl, 0x42
mov byte [esp + 0x14], al
mov byte [esp + 0x19], al
mov byte [esp + 0x1e], al
mov byte [esp + 0x23], al
mov al, 0x31
mov byte [esp + 0x1a], bl
mov byte [esp + 0x24], al
mov byte [esp + 0x29], al
mov byte [esp + 0x25], bl
mov byte [esp + 0x2e], bl
lea eax, [esp + 4]
xor ebx, ebx
mov byte [esp + 0x15], dl
mov byte [esp + 0x17], dl
mov byte [esp + 0x1f], dl
push eax
mov cl, 0x44
mov dl, 0x35
push ebx
push 0x100000
mov byte [esp + 0x10], 0x47
mov byte [esp + 0x12], 0x6f
mov byte [esp + 0x13], 0x62
mov byte [esp + 0x14], 0x61
mov byte [esp + 0x16], 0x5c
mov byte [esp + 0x17], 0x7b
mov byte [esp + 0x18], cl
mov byte [esp + 0x19], 0x33
mov byte [esp + 0x1a], 0x39
mov byte [esp + 0x1c], 0x46
mov byte [esp + 0x1e], 0x43
mov byte [esp + 0x1f], 0x37
mov byte [esp + 0x22], cl
mov byte [esp + 0x24], 0x41
mov byte [esp + 0x27], 0x66
mov byte [esp + 0x28], 0x64
mov byte [esp + 0x29], 0x32
mov byte [esp + 0x2c], dl
mov byte [esp + 0x2d], 0x38
mov byte [esp + 0x2e], cl
mov byte [esp + 0x32], 0x36
mov byte [esp + 0x33], cl
mov byte [esp + 0x34], dl
mov byte [esp + 0x36], 0x37
mov byte [esp + 0x37], dl
mov byte [esp + 0x38], 0x33
mov byte [esp + 0x39], 0x33
mov byte [esp + 0x3b], 0x45
mov byte [esp + 0x3c], 0x7d
mov byte [esp + 0x3d], bl
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
cmp eax, ebx
jne 0x401a54
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x401a5b
mov al, byte [esp + 0x3c]
mov ecx, dword [esp + 0x40]
cmp al, bl
mov dword [0x43bbf8], ecx
je 0x401a4a
push ebx
push ebx
push ebx
push 0x401900
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
je 0x401a43
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
mov al, bl
pop ebx
add esp, 0x30
ret
call fcn.00401050
pop ebx
add esp, 0x30
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop ebx
add esp, 0x30
ret
Function at 0x401ca0
Capabilities:
Create directory
Get common file path

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
push 1
push 0x23
push ebx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
mov dl, 0x5c
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [ecx + ebx - 1], dl
je 0x401cf7
mov edi, 0x43bb94
or ecx, 0xffffffff
xor eax, eax
push ebp
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
pop ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
mov byte [esp + 0xc], 0x57
mov byte [esp + 0xd], 0x69
mov byte [esp + 0xe], 0x6e
mov byte [esp + 0xf], 0x64
mov byte [esp + 0x10], 0x6f
mov byte [esp + 0x11], 0x77
mov byte [esp + 0x12], 0x73
mov byte [esp + 0x13], dl
mov byte [esp + 0x14], 0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
pop edi
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x4024f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [esp + 4]
xor eax, eax
xor edx, edx
mov dl, byte [eax + ecx]
add edx, 0x40
and edx, 0x800000ff
jns 0x40250e
dec edx
or edx, 0xffffff00
inc edx
xor dl, 0xdd
mov byte [eax + ecx], dl
inc eax
cmp eax, 0x750
jb 0x4024f6
ret 4
Function at 0x100234c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100357b3
mov eax, dword fs:[0]
push eax
sub esp, 0xf8
mov eax, dword [0x10047018]
xor eax, esp
mov dword [esp + 0xf0], eax
push ebx
push esi
push edi
mov eax, dword [0x10047018]
xor eax, esp
push eax
lea eax, [esp + 0x108]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ebx, ecx
cmp dword [ebx], 0
mov edi, edx
mov dword [esp + 0x14], eax
je 0x100235a8
push 0x802
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x400
call fcn.1001a730
push 0x802
mov esi, eax
push 0
push esi
call sub.MSVCR100.dll_memset
add esp, 0x10
cmp dword [edi + 0x14], 8
jb 0x1002354a
mov eax, dword [edi]
jmp 0x1002354c
mov eax, edi
lea ecx, [esp + 0x18]
push ecx
push esi
lea edx, [esp + 0x18]
push edx
push 0
push eax
mov eax, dword [ebx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cdq
test eax, eax
jne 0x1002356c
test edx, edx
je 0x100235af
lea ecx, [esp + 0xe4]
push str.Query_registry_value_with_key:
push ecx
mov ebx, edi
call fcn.1001a730
add esp, 8
cmp dword [esp + 0xf8], 8
jb 0x1002359e
mov edx, dword [esp + 0xe4]
push edx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
push esi
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
add esp, 4
xor al, al
jmp 0x10023676
cmp dword [esp + 0x10], 4
jne 0x10023649
mov ebx, dword [esi]
lea eax, [esp + 0x1c]
push eax
call fcn.1001a730
xor edi, edi
push ebx
lea ecx, [esp + 0x30]
mov dword [esp + 0x114], edi
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___int_]
lea ecx, [esp + 0xc8]
lea eax, [esp + 0x1c]
call fcn.1001a730
mov ecx, dword [esp + 0x14]
push eax
mov byte [esp + 0x114], 1
call fcn.1001a730
cmp dword [esp + 0xdc], 8
jb 0x10023617
mov ecx, dword [esp + 0xc8]
push ecx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor edx, edx
lea ecx, [esp + 0x1c]
mov dword [esp + 0xdc], 7
mov dword [esp + 0xd8], edi
mov word [esp + 0xc8], dx
mov dword [esp + 0x110], 0xffffffff
call fcn.1001a730
jmp 0x1002366a
mov eax, esi
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10023650
mov ecx, dword [esp + 0x14]
sub eax, edx
sar eax, 1
push eax
push esi
call fcn.1001a730
push esi
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x108]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xf0]
xor ecx, esp
call fcn.10030836
mov esp, ebp
pop ebp
ret 4

Function at 0x10030836
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10047018]
jne 0x10030840
repz ret
jmp fcn.10030e15
Function at 0x401a9d
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
cmp dword [ebp + 0x14], 0
jne 0x401ae2
push 0x80000005
push 0
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx]
test eax, eax
jne 0x401acc
mov eax, 0x41931d
push eax
push 1
mov ebx, 0x194
call fcn.00403c60
add esp, 0x10
mov dword [ebp + 0x10], eax
mov dword [ebp - 8], esp
push 0x40
push 0x1000
push dword [ebp + 0x10]
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x401b16
push 6
call fcn.00403264
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x401b2d
mov eax, 0
jmp 0x401b76
mov dword [ebp - 8], esp
mov eax, 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx]
test eax, eax
je 0x401b4b
add eax, 8
push eax
push dword [ebp - 4]
push dword [ebp + 8]
call dword [0x4821b2]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x401b6e
push 6
call fcn.00403264
add esp, 4
mov eax, dword [ebp - 4]
jmp 0x401b76
mov esp, ebp
pop ebp
ret 0x10

Function at 0x401bee
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
push dword [ebp + 0x20]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x401c38
push 6
call fcn.00403264
add esp, 4
mov ebx, dword [ebp + 0x18]
mov dword [ebx], eax
mov dword [ebp - 8], esp
push 0xffffffff
mov ebx, dword [ebp + 0x18]
push dword [ebx]
call dword [0x4821b6]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x401c66
push 6
call fcn.00403264
add esp, 4
mov dword [ebp - 8], esp
lea eax, [ebp - 4]
push eax
mov ebx, dword [ebp + 0x18]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x401c8e
push 6
call fcn.00403264
add esp, 4
cmp dword [ebp + 0x1c], 0
jne 0x401cab
mov ebx, dword [ebp + 0x18]
cmp dword [ebx], 0
je 0x401cab
mov eax, 1
jmp 0x401cad
xor eax, eax
test eax, eax
je 0x401cd9
mov dword [ebp - 8], esp
mov ebx, dword [ebp + 0x18]
push dword [ebx]
call dword [0x4821ba]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x401cd9
push 6
call fcn.00403264
add esp, 4
mov eax, dword [ebp - 4]
jmp 0x401ce1
mov esp, ebp
pop ebp
ret 0x20