joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e835
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0xc]
push esi
xor esi, esi
mov dword [ebp - 4], esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x41e845
push esi
sub ecx, edx
lea eax, [ebp - 4]
push eax
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
test eax, eax
jne 0x41e890
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp + 8]
call fcn.0040e7a2
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
push 0x4421bc
lea eax, [ebp + 0xc]
push eax
call fcn.0042fb98
leave
ret 8
Function at 0x421a4b
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c8
mov eax, dword [0x4497b8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, 0x9c
push edi
lea eax, [ebp - 0x2c0]
push 0
push eax
mov esi, ecx
mov bl, 1
call fcn.004308c0
add esp, 0xc
lea eax, [ebp - 0x2c0]
mov dword [ebp - 0x2c0], edi
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push eax
call edi
test eax, eax
jne 0x421ad9
lea eax, [ebp - 0x2c0]
push eax
mov dword [ebp - 0x2c0], 0x94
call edi
test eax, eax
jne 0x421ad7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x2c8]
call fcn.0040e7a2
mov eax, dword [eax]
mov dword [ebp - 0x2c4], eax
push 0x4421bc
lea eax, [ebp - 0x2c4]
push eax
call fcn.0042fb98
xor bl, bl
mov eax, dword [ebp - 0x2bc]
imul eax, eax, 0x64
add eax, dword [ebp - 0x2b8]
mov edi, 0x401950
push eax
push edi
mov dword [esi + 0x24], eax
lea eax, [ebp - 0x1c]
push 0xffffffffffffffff
push eax
call fcn.0040f218
add esp, 0x10
lea eax, [ebp - 0x1c]
push eax
push 0x40769c
mov ecx, esi
call fcn.0042046b
mov eax, dword [ebp - 0x2b0]
mov ecx, esi
dec eax
je 0x421b2c
dec eax
je 0x421b25
push 0x4076f0
jmp 0x421b31
push 0x4076b4
jmp 0x421b31
push 0x4076e4
push 0x4076c0
call fcn.0042046b
test bl, bl
je 0x421b68
movzx ecx, word [ebp - 0x22c]
movzx eax, word [ebp - 0x22a]
imul ecx, ecx, 0x64
add ecx, eax
push ecx
push edi
lea eax, [ebp - 0x1c]
push 0xffffffffffffffff
push eax
call fcn.0040f218
add esp, 0x10
lea eax, [ebp - 0x1c]
push eax
jmp 0x421b6d
push 0x4012f0
push 0x407700
mov ecx, esi
call fcn.0042046b
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx eax, ax
push eax
push edi
lea eax, [ebp - 0x1c]
push 0xffffffffffffffff
push eax
call fcn.0040f218
add esp, 0x10
lea eax, [ebp - 0x1c]
push eax
push 0x407720
mov ecx, esi
call fcn.0042046b
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
push eax
push edi
lea eax, [ebp - 0x1c]
push 0xffffffffffffffff
push eax
call fcn.0040f218
add esp, 0x10
lea eax, [ebp - 0x1c]
push eax
push 0x407748
mov ecx, esi
call fcn.0042046b
call dword [0x4495a4]
test al, al
mov eax, 0x40149c
jne 0x421bdf
mov eax, 0x401ca8
push eax
push 0x40776c
mov ecx, esi
call fcn.0042046b
call dword [0x4495ac]
sub eax, 0
je 0x421c27
sub eax, 5
je 0x421c20
dec eax
je 0x421c19
sub eax, 3
je 0x421c12
sub eax, 0xfff6
jne 0x421c38
push 0x4076f0
jmp 0x421c2c
push 0x4077c4
jmp 0x421c2c
push 0x4077cc
jmp 0x421c2c
push 0x4077d8
jmp 0x421c2c
push 0x407790
push 0x407798
mov ecx, esi
call fcn.0042046b
mov edi, 0x104
push edi
lea eax, [ebp - 0x224]
push eax
push 0
call dword [0x449588]
test eax, eax
je 0x421c99
cmp eax, edi
je 0x421c99
lea eax, [ebp - 0x224]
push eax
push 0x4077e0
mov ecx, esi
call fcn.0042046b
push 0x407808
push 0x407810
mov ecx, esi
call fcn.00421cbd
push 0x401aac
push 0x407828
mov ecx, esi
call fcn.00421cbd
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042fb8a
leave
ret
mov esi, 0x449318
push 0x405d20
mov ecx, esi
call fcn.00426d1d
push 0x401280
mov ecx, esi
call fcn.00426d1d
push 0x7b
jmp 0x421ab3
Function at 0x421cbd
Capabilities:
Get common file path

Disassembly:
push 0x250
mov eax, 0x44098e
call fcn.0042fc83
mov edi, ecx
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push 0x103
mov dword [ebp - 0x24c], eax
mov dword [ebp - 0x250], eax
lea eax, [ebp - 0x117]
push ebx
push eax
mov dword [ebp - 0x25c], edi
mov byte [ebp - 0x118], bl
call fcn.004308c0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x421d47
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x24c]
call fcn.0040e7a2
mov eax, dword [eax]
mov dword [ebp - 0x254], eax
push 0x4421bc
lea eax, [ebp - 0x254]
push eax
call fcn.0042fb98
push 0xffffffffffffffff
push 0x40784c
lea eax, [ebp - 0x118]
push 0x104
push eax
call fcn.00432906
push 0xffffffffffffffff
push esi
lea eax, [ebp - 0x118]
push 0x104
push eax
call fcn.00432906
add esp, 0x20
mov esi, 0x449318
push 0x407850
mov ecx, esi
call fcn.00426d1d
lea eax, [ebp - 0x118]
push eax
mov ecx, esi
call fcn.00426d1d
push 0x401284
mov ecx, esi
call fcn.00426d1d
push 0x401280
mov ecx, esi
call fcn.00426d1d
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x144]
push eax
call fcn.004270ae
cmp dword [ebp - 0x120], 0x10
mov eax, dword [ebp - 0x134]
mov byte [ebp - 4], 1
jae 0x421dd9
lea eax, [ebp - 0x134]
lea ecx, [ebp - 0x244]
push 3
mov dword [ebp - 0x248], ecx
push eax
lea ecx, [ebp - 0x248]
call fcn.0041189b
push dword [ebp - 0x248]
mov ecx, edi
push dword [ebp - 0x24c]
mov byte [ebp - 4], 2
call fcn.0042046b
lea eax, [ebp - 0x244]
cmp dword [ebp - 0x248], eax
je 0x421e24
push dword [ebp - 0x248]
call fcn.0042f99c
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x134]
call fcn.0040d603
call fcn.0042fcdc
ret 8

Function at 0x4246f0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push eax
push eax
push 3
push eax
push eax
push SysReAllocString
push dword [ebp + 8]
mov ebx, ecx
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x42473c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 8]
call fcn.0040e7a2
mov eax, dword [eax]
mov dword [ebp + 8], eax
push 0x4421bc
lea eax, [ebp + 8]
push eax
call fcn.0042fb98
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
je 0x42471a
lea eax, [esi + 1]
push eax
call fcn.004308b5
pop ecx
mov dword [ebx], eax
test eax, eax
jne 0x42476c
mov al, byte [ebp + 0xb]
mov byte [ebp + 0xb], al
push 0x444a20
lea eax, [ebp + 0xb]
jmp 0x424736
push 0
lea ecx, [ebp - 4]
push ecx
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42471a
mov eax, dword [ebx]
push edi
mov byte [esi + eax], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x426c22
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x4497b8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x108]
push eax
xor ebx, ebx
push 0x103
mov esi, ecx
mov edi, ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x426c7f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x110]
call fcn.0040e7a2
mov eax, dword [eax]
mov dword [ebp - 0x10c], eax
push 0x4421bc
lea eax, [ebp - 0x10c]
push eax
call fcn.0042fb98
inc edi
push edi
lea eax, [ebp - 0x108]
push eax
push 0x408cec
push 0x103
push esi
call fcn.00426d56
add esp, 0x14
test eax, eax
js 0x426cd3
push ebx
push ebx
push 1
push ebx
push ebx
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x426cc3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
je 0x426c7f
jmp 0x426ce2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, esi
call fcn.00426ba2
jmp 0x426ce2
push 0x408d08
mov ecx, 0x449318
call fcn.00426d1d
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042fb8a
leave
ret
Function at 0x42a83f
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x4497b8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x42a85b
sub ecx, edx
cmp ecx, 2
je 0x42a91a
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x42a91a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x42a91a
cmp eax, 3
je 0x42a8b9
push eax
lea ecx, [ebp - 0x110]
call fcn.0040e7a2
mov eax, dword [eax]
mov dword [ebp - 0x10c], eax
push 0x4421bc
lea eax, [ebp - 0x10c]
push eax
call fcn.0042fb98
push 0xffffffffffffffff
push esi
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.00430a3a
add esp, 0x10
cmp eax, 0x50
jne 0x42a8d9
push 0x7b
jmp 0x42a895
lea eax, [ebp - 0x108]
push 0x5c
push eax
call fcn.004310c1
pop ecx
pop ecx
test eax, eax
je 0x42a8d5
mov byte [eax], 0
lea eax, [ebp - 0x108]
push eax
call fcn.0042a83f
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x42a91a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x42a894
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0042fb8a
leave
ret 4

Function at 0x42b59e
Capabilities:
Create restart manager session

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
cmp byte [esi + 0x46], 0
je 0x42b5c8
lea ecx, [ebp - 2]
call fcn.00419ba9
mov al, byte [eax]
mov byte [ebp - 1], al
push 0x443884
lea eax, [ebp - 1]
push eax
call fcn.0042fb98
lea eax, [esi + 4]
push eax
push 0
push esi
call sub.RstrtMgr.DLL_RmStartSession
test eax, eax
je 0x42b5f0
push eax
lea ecx, [ebp - 0xc]
call fcn.0040e7a2
mov eax, dword [eax]
mov dword [ebp - 8], eax
push 0x4421bc
lea eax, [ebp - 8]
jmp 0x42b5c2
mov byte [esi + 0x46], 1
pop esi
leave
ret

Function at 0x42fb8a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4497b8]
jne fcn.0043093a
repz ret
Function at 0x43093a
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x44aa98], eax
mov dword [0x44aa94], ecx
mov dword [0x44aa90], edx
mov dword [0x44aa8c], ebx
mov dword [0x44aa88], esi
mov dword [0x44aa84], edi
mov word [0x44aab0], ss
mov word [0x44aaa4], cs
mov word [0x44aa80], ds
mov word [0x44aa7c], es
mov word [0x44aa78], fs
mov word [0x44aa74], gs
pushfd
pop dword [0x44aaa8]
mov eax, dword [ebp]
mov dword [0x44aa9c], eax
mov eax, dword [ebp + 4]
mov dword [0x44aaa0], eax
lea eax, [ebp + 8]
mov dword [0x44aaac], eax
mov eax, dword [ebp - 0x320]
mov dword [0x44a9e8], 0x10001
mov eax, dword [0x44aaa0]
mov dword [0x44a99c], eax
mov dword [0x44a990], 0xc0000409
mov dword [0x44a994], 1
mov eax, dword [0x4497b8]
mov dword [ebp - 0x328], eax
mov eax, dword [0x4497bc]
mov dword [ebp - 0x324], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x44a9e0], eax
push 1
call fcn.0043770a
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x409b18
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x44a9e0], 0
jne 0x430a26
push 1
call fcn.0043770a
pop ecx
push 0xc0000409
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
leave
ret

Function at 0x430b2e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x430b55
call fcn.00434a47
mov dword [eax], esi
call fcn.00434a34
push 0x16
pop esi
mov dword [eax], esi
call fcn.00435bcc
mov eax, esi
jmp 0x430baa
test dword [ebp + 0xc], 0xfffffff9
jne 0x430b3b
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x430b82
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00434a5a
pop ecx
call fcn.00434a34
mov eax, dword [eax]
jmp 0x430baa
test al, 0x10
jne 0x430ba8
test al, 1
je 0x430ba8
test byte [ebp + 0xc], 2
je 0x430ba8
call fcn.00434a47
mov dword [eax], 5
call fcn.00434a34
mov dword [eax], 0xd
jmp 0x430b79
xor eax, eax
pop esi
pop ebp
ret
Function at 0x439ac7
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4497b8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00434074
and dword [ebp - 0x14], 0
cmp dword [0x44b5b8], 0
mov dword [ebp - 0x18], eax
jne 0x439b7a
push 0x40aa64
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x439c22
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4093a0
push ebx
call edi
test eax, eax
je 0x439c22
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x40aa54
push ebx
mov dword [0x44b5b8], eax
call edi
push eax
call esi
push 0x40aa40
push ebx
mov dword [0x44b5bc], eax
call edi
push eax
call esi
push 0x40aa24
push ebx
mov dword [0x44b5c0], eax
call edi
push eax
call esi
mov dword [0x44b5c8], eax
test eax, eax
je 0x439b7a
push 0x40aa0c
push ebx
call edi
push eax
call esi
mov dword [0x44b5c4], eax
mov eax, dword [0x44b5c4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x439bd3
cmp dword [0x44b5c8], ecx
je 0x439bd3
push eax
call esi
push dword [0x44b5c8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x439bd3
test ebx, ebx
je 0x439bd3
call edi
test eax, eax
je 0x439bca
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x439bca
test byte [ebp - 8], 1
jne 0x439bd3
or dword [ebp + 0x10], 0x200000
jmp 0x439c06
mov eax, dword [0x44b5bc]
cmp eax, dword [ebp - 0x18]
je 0x439c06
push eax
call esi
test eax, eax
je 0x439c06
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x439c06
mov eax, dword [0x44b5c0]
cmp eax, dword [ebp - 0x18]
je 0x439c06
push eax
call esi
test eax, eax
je 0x439c06
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x44b5b8]
call esi
test eax, eax
je 0x439c22
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x439c24
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042fb8a
leave
ret
Function at 0xf31609
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0xf31a90
call fcn.00f317b4
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x20], ebx
mov edi, 0xf32370
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0xf313c4
cmp eax, esi
jne 0xf313b7
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0xf313c7
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0xf3139e
xor esi, esi
inc esi
mov eax, dword [0xf3236c]
cmp eax, esi
jne 0xf313da
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0xf31409
mov eax, dword [0xf3236c]
test eax, eax
jne 0xf31403
mov dword [0xf3236c], esi
push 0xf310b8
push 0xf310ac
call fcn.00f31300
pop ecx
pop ecx
test eax, eax
je 0xf31409
jmp 0xf3152d
mov dword [0xf32034], esi
mov eax, dword [0xf3236c]
cmp eax, esi
jne 0xf3142d
push 0xf310a8
push 0xf310a0
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0xf3236c], 2
cmp dword [ebp - 0x20], ebx
jne 0xf3143a
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0xf32374], ebx
je 0xf3145b
push 0xf32374
call fcn.00f31729
pop ecx
test eax, eax
je 0xf3145b
push ebx
push 2
push ebx
call dword [0xf32374]
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
cmp dword [eax], ebx
je 0xf3152d
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
movzx ecx, word [eax]
cmp cx, 0x20
ja 0xf314c5
cmp cx, bx
je 0xf31480
cmp dword [ebp - 0x1c], ebx
jne 0xf314c5
movzx ecx, word [eax]
cmp cx, bx
je 0xf31495
cmp cx, 0x20
ja 0xf31495
inc eax
inc eax
mov dword [ebp - 0x24], eax
jmp 0xf31480
test byte [ebp - 0x40], 1
je 0xf314a1
movzx ecx, word [ebp - 0x3c]
jmp 0xf314a4
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0xf30000
call main
mov dword [0xf32030], eax
cmp dword [0xf32024], ebx
jne 0xf3150a
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp cx, 0x22
jne 0xf314d6
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
inc eax
inc eax
jmp 0xf3146a
cmp dword [0xf32034], ebx
jne 0xf31518
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0xf32030]
jmp 0xf31539
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.00f317f9
ret
call fcn.00f31901
jmp 0xf31361
Function at 0xb7afb8
Capabilities:
Encode data using xor

Disassembly:
jmp 0xb7afc2
pushal
call 0xb7afc8
pop ebp
sub ebp, 0x10
sub ebp, 0x77afb8
jmp 0xb7afde
mov eax, 0x77afb8
add eax, ebp
add eax, 0x4c
mov ecx, 0x5ff
mov edx, 0x26072db6
xor byte [eax], dl
inc eax
dec ecx
jne 0xb7aff5
jmp 0xb7b008
cmp eax, 0x8a3f3d7b
mov dh, 0xb6
mov dh, 0x37
ja 0xb7b061
mov dh, 0xb6
mov dh, 0xb5
jnp 0xb7b027
mov dl, 0xb6
mov dh, 0xb6
or al, 0x9e
mov dh, 0xb6
mov dh, 0x41
push esp
mov ch, 0x7e
cmp eax, 0xb6b6ba37
mov dh, 0xb5
aaa
mov edx, 0xb5b6b6b6
jae 0xb7b06a
rcl byte [edx - 0x6d4dc0b6], cl
out 0xde, al
out 0xb, al
mov eax, 0x44d0deb6
fidiv word [esi - 0x216d6549]
nop
std
invalid
cmp eax, 0xb6b6ba23
mov dh, 0x3d
cmp esp, dword [esi + 0x77b6b6b6]
mov dh, 0xb6
mov dh, 0x77
pop edi
mov ah, 0x87
mov ah, 0x35
je 0xb7b027
invalid
Function at 0x40161f
Capabilities:
Compare security identifiers

Disassembly:
mov edi, edi
push ebp
push esp
pop ebp
sub esp, 0x1c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x408108]
push ebx
xor ebx, ebx
mov word [ebp - 8], 0x500
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
cmp eax, 2
jne 0x401745
lea ecx, [ebp - 0x10]
call fcn.0040157c
test eax, eax
jne 0x401734
lea eax, [ebp - 0x14]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
or eax, eax
je 0x401745
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x18]
push eax
push ebx
push ebx
push 2
push dword [ebp - 0x14]
call edi
or eax, eax
jne 0x401725
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x401725
push esi
push dword [ebp - 0x18]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x401724
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x18]
push esi
push 2
push dword [ebp - 0x14]
call edi
or eax, eax
je 0x40171d
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x40171d
cmp dword [esi], ebx
jbe 0x401714
lea edi, [esi + 4]
push dword [ebp - 0x1c]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
or eax, eax
jne 0x401709
inc ebx
add edi, 8
cmp ebx, dword [esi]
jb 0x4016f0
jmp 0x401714
xor eax, eax
inc eax
mov dword [0x408108], eax
mov dword [ebp - 0x10], eax
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop esi
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
pop edi
jmp 0x401745
mov eax, dword [ebp - 0x10]
or eax, eax
je 0x401745
mov dword [0x408108], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004069ed
push ebp
pop esp
pop ebp
ret
Function at 0x401d1e
Capabilities:
Shutdown system

Disassembly:
mov edi, edi
push ebp
push esp
pop ebp
sub esp, 0x18
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
xor edi, edi
or eax, eax
jne 0x401cac
mov edx, 0x4f5
push edi
push 0x10
push edi
push edi
sub ecx, ecx
call fcn.004041b0
xor eax, eax
jmp 0x401d0a
push esi
lea eax, [ebp - 0x10]
push eax
push 0x401114
push edi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push edi
push edi
push edi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 1
push eax
push edi
push dword [ebp - 0x18]
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [ebp - 0x18]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or esi, esi
pop esi
push edi
jne 0x401cf4
mov edx, 0x4f6
jmp 0x401c9d
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x401d07
mov edx, 0x4f7
jmp 0x401c9c
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.004069ed
push ebp
pop esp
pop ebp
ret
pushfd
popfd
push ebx
push ecx
pop ebx
test bl, 2
jne 0x401d32
call 0x401c2b
cmp eax, 2
jne 0x401d67
test bl, 4
jne 0x401d53
push 4
push 0x40
push 0
push 0x401091
mov edx, 0x522
sub ecx, ecx
call fcn.004041b0
cmp eax, 6
jne 0x401d67
cmp word [0x409a80], 0
jne 0x401d69
push 0
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
pop ebx
ret
pop ebx
jmp 0x401c6b

Function at 0x401d74
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
cmp byte [0x408570], 0
je 0x401db9
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
or eax, eax
jne 0x401db9
push 0x408570
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
pop esp
pop ebp
ret
Function at 0x40200e
Capabilities:
Get common file path
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x348
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x408570], 0
je 0x402133
push ebx
lea eax, [ebp - 0x344]
sub ebx, ebx
push eax
push 0x2001f
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
or eax, eax
jne 0x402132
push edi
lea eax, [ebp - 0x348]
mov edi, 0x238
push eax
lea eax, [ebp - 0x340]
mov dword [ebp - 0x348], edi
push eax
push ebx
push ebx
push 0x408570
push dword [ebp - 0x344]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402125
push esi
push 0x103
lea eax, [ebp - 0x107]
mov byte [ebp - 0x108], bl
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x108]
mov esi, 0x104
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
or eax, eax
je 0x4020d2
push 0x401091
push esi
pop edx
lea ecx, [ebp - 0x108]
call fcn.004062ff
push 0x409224
lea eax, [ebp - 0x108]
push eax
push str.rundll32.exe__sadvpack.dll_DelNodeRunDLL32___s_
lea eax, [ebp - 0x340]
push edi
push eax
call fcn.004014a4
add esp, 0x14
lea ecx, [ebp - 0x340]
lea edx, [ecx + 1]
pop esi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4020fd
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x340]
push eax
push 1
push ebx
push 0x408570
push dword [ebp - 0x344]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x344]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004069ed
mov esp, ebp
pop ebp
ret