joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4573b0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, word [edx + 0x14]
push ebx
movzx ebx, word [edx + 6]
push esi
lea esi, [edx + 0x18]
mov dword [ebp - 0xc], ecx
add esi, eax
xor cl, cl
push edi
xor eax, eax
mov byte [ebp - 1], cl
xor edi, edi
test ebx, ebx
je 0x45740e
nop word [eax + eax]
push esi
push str..rsrc
call fcn.004af813
add esp, 8
test eax, eax
je 0x457403
inc edi
add esi, 0x28
cmp edi, ebx
jb 0x4573e0
mov cl, byte [ebp - 1]
xor esi, esi
xor eax, eax
jmp 0x457410
mov eax, dword [esi + 0x14]
mov esi, dword [esi + 8]
mov cl, byte [ebp - 1]
jmp 0x457410
xor esi, esi
mov ebx, dword [ebp - 0xc]
add ebx, eax
je 0x45750f
lea eax, [esi - 2]
push 2
add eax, ebx
push eax
push 0x4fecb4
call fcn.004afee0
add esp, 0xc
test eax, eax
jne 0x457505
cmp dword [esi + ebx - 6], 1
jne 0x457505
mov eax, dword [esi + ebx - 0xe]
lea edi, [esi - 0xa]
mov ecx, dword [edi + ebx]
sub edi, 8
mov esi, dword [ebp + 8]
mov dword [ebp - 8], eax
mov edx, dword [edi + ebx]
sub edi, ecx
test byte [esi + 0x24], 1
mov dword [ebp - 0xc], edx
je 0x457493
add esi, 0x18
push esi
push ecx
mov ecx, esi
call fcn.00417a50
mov ecx, dword [esi]
mov eax, dword [esi + 4]
cmp ecx, eax
je 0x45748d
sub eax, ecx
push eax
lea eax, [edi + ebx]
push eax
push ecx
call fcn.0047e730
add esp, 0xc
mov byte [ebp - 1], 1
mov eax, dword [ebp - 8]
mov esi, dword [ebp + 8]
sub edi, eax
test byte [esi + 0x24], 4
je 0x4574cd
add esi, 0xc
push esi
push eax
mov ecx, esi
call fcn.00417a50
mov ecx, dword [esi]
mov eax, dword [esi + 4]
cmp ecx, eax
je 0x4574ca
sub eax, ecx
push eax
lea eax, [edi + ebx]
push eax
push ecx
call fcn.0047e730
mov esi, dword [ebp + 8]
mov al, 1
add esp, 0xc
mov byte [ebp - 1], al
jmp 0x4574d0
mov esi, dword [ebp + 8]
mov al, byte [ebp - 1]
test byte [esi + 0x24], 2
je 0x457511
push esi
push dword [ebp - 0xc]
mov ecx, esi
call fcn.00417a50
mov ecx, dword [esi]
mov eax, dword [esi + 4]
cmp ecx, eax
je 0x457505
sub edi, dword [ebp - 0xc]
sub eax, ecx
push eax
add edi, ebx
push edi
push ecx
call fcn.0047e730
add esp, 0xc
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, cl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45dc5f
Capabilities:
Check if file exists
Extract resource via kernel32 functions
Get file attributes

Disassembly:
push 0x18
mov eax, 0x4dea34
call fcn.0047ce6a
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov esi, dword [ebp + 8]
push 0x1c
push esi
mov dword [ebp - 4], ebx
call fcn.004168f0
mov edi, str.SpreadsheetToolsempty.xls
mov dword [ebp - 4], ebx
push edi
mov dword [ebp - 0x14], 3
call fcn.00489fcd
add esp, 0xc
mov ecx, esi
push eax
push edi
call fcn.00409280
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x45dca9
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x45dd6b
call fcn.00460c6c
mov edi, eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
push str.RT_ZIPPED_DATA
push 0x7f
push edi
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x45dd28
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x45dd28
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x45dd28
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x45dd28
mov edi, dword [ebp - 0x18]
lea eax, [ebp - 0x24]
push eax
push edi
mov ecx, eax
call fcn.00417a50
push edi
push ebx
push dword [ebp - 0x24]
call fcn.0047e730
add esp, 0xc
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x20]
je 0x45dd63
lea ecx, [ebp - 0xd]
call fcn.00429230
cmp dword [esi + 0x14], 8
mov eax, esi
mov byte [ebp - 4], 2
jb 0x45dd46
mov eax, dword [esi]
push 0
push eax
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0xd]
sub eax, dword [ebp - 0x24]
push eax
push dword [ebp - 0x24]
call fcn.00429640
lea ecx, [ebp - 0xd]
call fcn.00429240
lea ecx, [ebp - 0x24]
call fcn.00407c60
mov eax, esi
call fcn.0047ce33
ret
Function at 0x45e10d
Capabilities:
Delete registry key

Disassembly:
push 0xa8
mov eax, 0x4deaf2
call fcn.0047ce9e
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x90]
xor ebx, ebx
inc ebx
call fcn.0042a7b0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x90]
call fcn.0042b1e0
test eax, eax
je 0x45e275
and dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x48]
mov byte [ebp - 4], bl
push eax
lea ecx, [ebp - 0x28]
call fcn.004102d0
mov esi, str.ExcelResiliencyDisabledItems
push esi
call fcn.00489fcd
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00409280
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push ebx
cmovae eax, dword [ebp - 0x28]
lea ecx, [ebp - 0xb4]
push SysReAllocString
push eax
call fcn.0040ea80
mov eax, dword [ebp - 0xb4]
xor esi, esi
test eax, eax
cmovne esi, ebx
mov byte [ebp - 4], 2
je 0x45e1b1
push eax
call dword [ebp - 0xa8]
mov byte [ebp - 4], bl
test esi, esi
jne 0x45e219
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x28]
call fcn.004102d0
push str.ExcelResiliencyStartupItems
call fcn.00489fcd
pop ecx
push eax
push str.ExcelResiliencyStartupItems
lea ecx, [ebp - 0x28]
call fcn.00409280
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push ebx
cmovae eax, dword [ebp - 0x28]
lea ecx, [ebp - 0xb4]
push SysReAllocString
push eax
call fcn.0040ea80
mov eax, dword [ebp - 0xb4]
test eax, eax
cmovne esi, ebx
mov byte [ebp - 4], 3
je 0x45e212
push eax
call dword [ebp - 0xa8]
mov byte [ebp - 4], bl
test esi, esi
je 0x45e26d
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x28]
call fcn.004102d0
mov esi, str.ExcelResiliency
push esi
call fcn.00489fcd
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00409280
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
test eax, eax
je 0x45e26d
mov esi, str.Data_can_not_be_removed_from_Registry.
push esi
call fcn.00489fcd
pop ecx
push eax
push esi
mov ecx, edi
call fcn.00410170
xor ebx, ebx
lea ecx, [ebp - 0x28]
call fcn.00410420
lea ecx, [ebp - 0x90]
call fcn.0042ace0
mov eax, ebx
call fcn.0047ce48
ret
Function at 0x45e349
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x74
mov eax, 0x4deb5f
call fcn.0047ce9e
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x70], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x6c], eax
call fcn.00460c6c
push 0x4e4564
mov esi, eax
push 0x7d
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x45e487
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x68], eax
test eax, eax
je 0x45e487
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x45e487
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x45e487
lea ecx, [ebp - 0x80]
call fcn.0042f610
mov esi, dword [ebp - 0x68]
mov dword [ebp - 4], ebx
test esi, esi
je 0x45e47f
lea eax, [ebp - 0x80]
push eax
push esi
mov ecx, eax
call fcn.00417a50
push esi
push edi
push dword [ebp - 0x80]
call fcn.0047e730
add esp, 0xc
lea ecx, [ebp - 0x4c]
call fcn.00433530
lea eax, [ebp - 0x80]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x4c]
call fcn.00433890
test eax, eax
je 0x45e477
mov esi, dword [ebp - 0x6c]
lea ecx, [ebp - 0x80]
push esi
call fcn.0042ffc0
push esi
lea ecx, [ebp - 0x30]
call fcn.00401910
mov byte [ebp - 4], 2
cmp byte [esi + 4], bl
jne 0x45e46d
push ebx
lea ecx, [ebp - 0x30]
call fcn.00403640
test al, al
jne 0x45e46d
cmp dword [ebp - 0x18], ebx
je 0x45e46f
push dword [ebp - 0x70]
lea eax, [ebp - 0x64]
push eax
call fcn.00460af6
pop ecx
pop ecx
mov ecx, eax
cmp dword [ecx + 0x14], 8
jb 0x45e449
mov ecx, dword [ecx]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0x1010
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call fcn.00460aa0
add esp, 0xc
lea ecx, [ebp - 0x64]
call fcn.00410420
jmp 0x45e46f
mov bl, 1
lea ecx, [ebp - 0x30]
call fcn.00401970
lea ecx, [ebp - 0x4c]
call fcn.004335c0
lea ecx, [ebp - 0x80]
call fcn.0042f630
mov al, bl
call fcn.0047ce48
ret
Function at 0x45eb98
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x468
mov eax, 0x4ded25
call fcn.0047ce9e
mov esi, dword [ebp + 8]
xor ecx, ecx
mov dword [ebp - 0x474], esi
xor eax, eax
mov dword [ebp - 0x45c], ecx
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], 7
mov word [esi], ax
mov dword [ebp - 4], ecx
mov dword [ebp - 0x45c], 1
call fcn.00460c6c
push 0x4e4564
mov ebx, eax
push 0x7d
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x460], eax
test eax, eax
je 0x45ecd4
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x45ecd4
push dword [ebp - 0x460]
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x45ecd4
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x45ecd4
lea ecx, [ebp - 0x470]
call fcn.0042f610
mov dword [ebp - 4], 1
test edi, edi
je 0x45ecc9
lea eax, [ebp - 0x470]
push eax
push edi
mov ecx, eax
call fcn.00417a50
push edi
push ebx
push dword [ebp - 0x470]
call fcn.0047e730
add esp, 0xc
lea ecx, [ebp - 0x2c]
call fcn.00433530
lea eax, [ebp - 0x470]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x2c]
call fcn.00433890
test eax, eax
je 0x45ecc1
lea ecx, [ebp - 0x458]
call fcn.0042bf60
lea eax, [ebp - 0x458]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x470]
call fcn.0042ffc0
lea eax, [ebp - 0x450]
mov ecx, esi
push eax
call fcn.004102d0
lea ecx, [ebp - 0x458]
call fcn.0042c750
lea ecx, [ebp - 0x2c]
call fcn.004335c0
lea ecx, [ebp - 0x470]
call fcn.0042f630
mov eax, esi
call fcn.0047ce48
ret

Function at 0x45f0ef
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 0x10]
push ebx
push esi
push dword [ebp + 0xc]
xor bl, bl
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x45f157
push edi
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push dword [ebp + 8]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x45f156
test edi, edi
je 0x45f156
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp + 0x10], eax
test eax, eax
je 0x45f156
mov esi, dword [ebp + 0x14]
mov ecx, esi
push esi
push edi
call fcn.00417a50
push edi
push dword [ebp + 0x10]
push dword [esi]
call fcn.0047e730
add esp, 0xc
inc bl
pop edi
pop esi
mov al, bl
pop ebx
pop ebp
ret

Function at 0x45f1f8
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x45f209
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x45f226
cmp dword [esi + 0x14], 8
jb 0x45f21d
mov esi, dword [esi]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop esi
pop ebp
ret
Function at 0x460ad9
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x460ae7
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
pop ebp
ret

Function at 0x4c6389
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004c5f70

Function at 0x4c6394
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004c60fa

Function at 0x4cba6c
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004cb424

Function at 0x4cbe06
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004cbcda
Function at 0x401540
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0
call fcn.00420e6f
push eax
call fcn.00420c64
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
xor esi, esi
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push connect
call edi
mov eax, dword [ebp - 4]
test eax, eax
je 0x4015a4
mov ecx, dword [esi*4 + 0x444ac0]
push 0
push 0
push 0
push 0
push ecx
push eax
call ebx
test eax, eax
je 0x4015c9
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc esi
cmp esi, 8
jl 0x401565
call fcn.00420c76
and eax, 0x80000007
jns 0x4015bb
dec eax
or eax, 0xfffffff8
inc eax
mov eax, dword [eax*4 + 0x444ac0]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esi*4 + 0x444ac0]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401f50
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push 0x43c2fc
push eax
xor bl, bl
call fcn.00421d73
mov esi, eax
add esp, 8
test esi, esi
je 0x401fcf
mov ecx, dword [ebp + 8]
push edi
push 0x43c304
push ecx
call fcn.00421d73
mov edi, eax
add esp, 8
test edi, edi
je 0x401fc5
push esi
call fcn.00420fbc
add esp, 4
test eax, eax
jne 0x401fba
push esi
push 1
lea edx, [ebp - 1]
push 1
push edx
call fcn.004220ca
push edi
push 1
lea eax, [ebp - 1]
push 1
push eax
call fcn.004222be
push esi
call fcn.00420fbc
add esp, 0x24
test eax, eax
je 0x401f91
push edi
mov bl, 1
call fcn.004226f5
add esp, 4
push esi
call fcn.004226f5
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401fe0
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x441480]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push str.SYSTEMROOT
mov dword [ebp - 0x98], eax
call fcn.00420d1e
add esp, 4
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402010
sub eax, edx
add eax, 0x20
push eax
call fcn.0041ff97
push str.SYSTEMROOT
mov edi, eax
call fcn.00420d1e
push eax
push str._s_notepad.exe
push edi
call fcn.00420bd5
mov ebx, dword [sym.imp.KERNEL32.dll_OpenFile]
add esp, 0x14
push 0
lea ecx, [ebp - 0x94]
push ecx
push edi
call ebx
mov esi, eax
cmp esi, 0xffffffff
je 0x4020a1
push 0
push 0
lea edx, [ebp - 0xa0]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x98]
push 2
lea eax, [ebp - 0x94]
push eax
push ecx
call ebx
mov esi, eax
cmp esi, 0xffffffff
je 0x4020a1
push 0
push 0
lea edx, [ebp - 0xa0]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.00420c59
mov ecx, dword [ebp - 8]
add esp, 4
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00420bc6
mov esp, ebp
pop ebp
ret
Function at 0x404910
Capabilities:
Check if file exists
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, edx
push esi
mov edi, ecx
mov dword [esp + 0x18], eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x40493b
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
lea ebx, [esp + 0x10]
mov dword [esp + 0x10], 0
call fcn.00401db0
mov esi, eax
add esp, 4
test esi, esi
je 0x404932
push 0
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x18], 0
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
jne 0x404983
push esi
xor edi, edi
call fcn.00420c59
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x18]
push eax
push esi
mov ecx, edi
call fcn.004046c0
add esp, 0xc
push esi
mov edi, eax
call fcn.00420c59
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x404bb0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push 0x22
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov esi, eax
mov dword [ebp - 0xc], esi
test esi, esi
jne 0x404bd0
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push 3
push 1
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebx, eax
mov dword [ebp - 8], ebx
test ebx, ebx
je 0x404bff
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x404bff
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
test eax, eax
jne 0x404c0e
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov esi, dword [ebx + 4]
push edi
push esi
call fcn.0041ff97
add esp, 4
mov edi, eax
test esi, esi
je 0x404c34
mov ecx, dword [ebp - 4]
sub ecx, edi
mov edx, esi
mov bl, byte [ecx + eax]
mov byte [eax], bl
inc eax
dec edx
jne 0x404c28
mov ebx, dword [ebp - 8]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edx, dword [ebp + 8]
mov eax, edi
pop edi
pop ebx
mov dword [edx], esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4054a0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x441480]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
push edi
lea eax, [ebp - 0x134]
push eax
push ebx
mov dword [ebp - 0x134], 0x128
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x4055b1
mov edi, dword [sym.imp.KERNEL32.dll_OpenProcess]
jmp 0x4054e0
lea eax, [ebp - 0x110]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4054f0
sub eax, edx
inc eax
push eax
call fcn.0041ff97
mov esi, eax
lea eax, [ebp - 0x110]
mov edx, esi
mov ecx, eax
add esp, 4
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x405511
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x405520
sub eax, edx
mov edx, eax
xor ecx, ecx
test edx, edx
jle 0x405546
mov al, byte [ecx + esi]
cmp al, 0x41
jl 0x405541
cmp al, 0x5a
jg 0x405541
add al, 0x20
mov byte [ecx + esi], al
inc ecx
cmp ecx, edx
jl 0x405531
mov ecx, dword [ebp + 8]
mov eax, esi
jmp 0x405550
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x405570
test dl, dl
je 0x40556c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x405570
add eax, 2
add ecx, 2
test dl, dl
jne 0x405550
xor eax, eax
jmp 0x405575
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x405592
mov edx, dword [ebp - 0x12c]
push edx
push eax
push 1
call edi
test eax, eax
je 0x405592
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call fcn.00420c59
add esp, 4
lea eax, [ebp - 0x134]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x4054e0
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
pop edi
xor ecx, ebp
pop esi
call fcn.00420bc6
mov esp, ebp
pop ebp
ret

Function at 0x4055d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push 0x184
push 0
push esi
xor bl, bl
call fcn.00429890
add esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SoftwareClasses.exe_shellopencommand
push connect
mov dword [ebp - 8], 0x184
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, dword [ebp - 4]
test eax, eax
je 0x405634
lea ecx, [ebp - 8]
push ecx
push esi
push 0
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40562a
mov bl, 1
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405f40
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x444a84], 0
jne 0x405fec
push ebx
call fcn.004053d0
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x405f6d
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x405f64
sub eax, edx
add eax, 0x104
push eax
call fcn.0041ff97
add esp, 4
lea ecx, [ebp - 4]
push ecx
push eax
mov dword [0x444a58], eax
mov dword [ebp - 4], 0x100
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test ebx, ebx
je 0x405fe4
mov ecx, dword [0x444a58]
push esi
push edi
lea edi, [ecx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x405fa1
mov dx, word [0x43c7b0]
mov eax, ebx
mov word [edi], dx
mov esi, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x405fb7
sub eax, esi
lea edi, [ecx - 1]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x405fc3
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call fcn.00420c59
add esp, 4
pop edi
pop esi
mov byte [0x444a84], 1
pop ebx
mov eax, dword [0x444a58]
mov esp, ebp
pop ebp
ret

Function at 0x406000
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0x43c2fc
push eax
call fcn.00421d73
mov esi, eax
add esp, 8
test esi, esi
je 0x4060e1
push ebx
push edi
push 2
push 0
push esi
call fcn.004225bb
push esi
call fcn.004224cc
mov edi, eax
push edi
call fcn.0041ff97
push 0
push 0
push esi
mov dword [ebp - 4], eax
call fcn.004225bb
add esp, 0x20
xor ebx, ebx
test edi, edi
jle 0x406076
lea ecx, [ecx]
push esi
call fcn.00420fbc
add esp, 4
test eax, eax
jne 0x406076
mov ecx, dword [ebp - 4]
push esi
push 1
lea edx, [ebx + ecx]
push 1
push edx
call fcn.004220ca
inc ebx
add esp, 0x10
cmp ebx, edi
jl 0x406050
push esi
call fcn.004226f5
add esp, 4
xor eax, eax
xor ecx, ecx
test edi, edi
jle 0x4060a2
cmp ecx, dword [ebp + 0x10]
jl 0x40608e
xor ecx, ecx
mov edx, dword [ebp + 0xc]
mov dl, byte [ecx + edx]
mov esi, dword [ebp - 4]
neg dl
xor byte [eax + esi], dl
inc eax
inc ecx
cmp eax, edi
jl 0x406087
mov eax, dword [ebp + 8]
push 0x43c304
push eax
call fcn.00421d73
mov esi, eax
add esp, 8
test esi, esi
je 0x4060d8
mov ecx, dword [ebp - 4]
push esi
push edi
push 1
push ecx
call fcn.004222be
push esi
call fcn.004226f5
add esp, 0x14
pop edi
pop ebx
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
pop edi
pop ebx
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
xor al, al
pop esi
mov esp, ebp
pop ebp
ret