joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407cf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov eax, dword [0x44414f]
cmp byte [0x46b0a0], 0xe9
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [0x444153]
mov dword [ebp - 8], eax
mov al, byte [0x444157]
mov byte [ebp - 4], al
je 0x407d27
xor eax, eax
jmp 0x407e1b
xor ecx, ecx
xor edx, edx
mov cl, byte [0x46b0a2]
mov dl, byte [0x46b0a1]
shl ecx, 8
push 0
add edx, ecx
mov dword [0x46b1c4], edx
add dword [0x46b1c4], 3
mov eax, dword [0x46b1c4]
add eax, 0x103
push eax
push esi
call fcn.0042e350
add esp, 0xc
xor ebx, ebx
lea edi, [ebp - 0xc]
push esi
call fcn.00430138
pop ecx
cmp al, byte [edi]
je 0x407d76
xor eax, eax
jmp 0x407e1b
inc ebx
inc edi
cmp ebx, 9
jl 0x407d64
push 1
push esi
push 0x23
call fcn.00401410
add esp, 0xc
dec eax
je 0x407d94
xor eax, eax
jmp 0x407e1b
push 0
mov edx, dword [0x46b1c4]
add edx, 0x6f6
push edx
push esi
call fcn.0042e350
add esp, 0xc
push esi
call fcn.00430138
pop ecx
mov byte [ebp - 1], al
push 0
mov ecx, dword [0x46b1c4]
add ecx, 0x6e2
push ecx
push esi
call fcn.0042e350
add esp, 0xc
xor ebx, ebx
mov edi, 0x46b0a0
push esi
call fcn.00430138
pop ecx
xor al, byte [ebp - 1]
mov byte [edi], al
inc ebx
inc edi
cmp ebx, 3
jl 0x407dd5
push 0
push 0
push esi
call fcn.0042e350
add esp, 0xc
push esi
push 3
push 1
push 0x46b0a0
call fcn.0042e540
add esp, 0x10
push esi
call fcn.00418690
pop ecx
inc eax
jne 0x407e16
or eax, 0xffffffff
jmp 0x407e1b
mov eax, 0x23
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408764
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec8
mov eax, dword [0x4441b5]
push ebx
push esi
push edi
xor ebx, ebx
mov edi, dword [ebp + 8]
mov dword [ebp - 0x138], eax
mov eax, dword [0x4441b9]
mov dword [ebp - 0x134], eax
mov eax, dword [0x4441bd]
mov dword [ebp - 0x130], eax
jmp 0x4087be
mov eax, ebx
push 4
shl eax, 3
push 0x44466a
lea eax, [eax + eax*4]
add eax, dword [0x46b1b4]
push eax
call fcn.0042be6c
add esp, 0xc
test eax, eax
je 0x4087c9
inc ebx
movzx edx, word [0x46b0c2]
cmp ebx, edx
jl 0x40879b
movzx ecx, word [0x46b0c2]
cmp ebx, ecx
jne 0x4087db
xor eax, eax
jmp 0x40897e
lea edx, [ebx + ebx*4]
mov ecx, dword [0x46b1b4]
push 0
mov eax, dword [ecx + edx*8 + 0x14]
push eax
push edi
call fcn.0042e350
add esp, 0xc
xor ebx, ebx
lea esi, [ebp - 0x138]
push edi
call fcn.00430138
pop ecx
cmp al, byte [esi]
je 0x40880e
xor eax, eax
jmp 0x40897e
inc ebx
inc esi
cmp ebx, 0xc
jl 0x4087fc
push 0
push edi
push 0x28
call fcn.00401410
add esp, 0xc
dec eax
je 0x40882c
xor eax, eax
jmp 0x40897e
push 0
mov edx, dword [0x46a898]
push edx
call fcn.00417790
mov ecx, dword [0x46a898]
add esp, 8
mov edi, ecx
xor eax, eax
or ecx, 0xffffffff
lea esi, [ebp - 0xc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [ebp - 0xc8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x2e
push eax
call fcn.0042bead
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x40889b
inc ebx
mov edi, ebx
mov esi, 0x44466f
mov eax, edi
movsd dword es:[edi], dword [esi]
push 0
lea edx, [ebp - 0xc8]
push edx
call fcn.00417790
add esp, 8
push 0x64
push 0
lea ecx, [ebp - 0xc8]
push ecx
call fcn.0042bcc0
add esp, 0xc
push 0x64
lea eax, [ebp - 0x64]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
test eax, eax
jne 0x4088c4
xor eax, eax
jmp 0x40897e
xor eax, eax
lea edi, [ebp - 0x64]
or ecx, 0xffffffff
lea esi, [ebp - 0x12c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [ebp - 0x12c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push str.WSOCK32.SKA
push eax
call fcn.0042bd64
add esp, 8
push 0
lea edx, [ebp - 0x12c]
push edx
call fcn.0042da94
add esp, 8
test eax, eax
je 0x408929
push 0x4446cd
push str.Your_WSOCK32.DLL_file_is_corrupted._You_must_replace_it_from_a_clean_backup.
call fcn.00418598
add esp, 8
xor eax, eax
jmp 0x40897e
xor eax, eax
lea edi, [ebp - 0x64]
or ecx, 0xffffffff
lea esi, [ebp - 0xc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [ebp - 0xc8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push str.WSOCK32.DLL
push eax
call fcn.0042bd64
add esp, 8
lea edx, [ebp - 0x12c]
push edx
lea ecx, [ebp - 0xc8]
push ecx
call fcn.00417790
add esp, 8
mov eax, 0x28
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408e08
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov ecx, 4
push ebx
push esi
push edi
mov esi, 0x44420e
mov edi, dword [ebp + 8]
push edi
lea edi, [ebp - 0x10]
rep movsd dword es:[edi], dword [esi]
pop edi
push 0
push 0x400
push edi
call fcn.0042e350
add esp, 0xc
xor esi, esi
lea ebx, [ebp - 0x10]
push edi
call fcn.00430138
pop ecx
cmp al, byte [ebx]
je 0x408e49
xor eax, eax
jmp 0x408e91
inc esi
inc ebx
cmp esi, 0x10
jl 0x408e3a
push 0
push edi
push 0x2c
call fcn.00401410
add esp, 0xc
dec eax
je 0x408e64
xor eax, eax
jmp 0x408e91
push 0
mov edx, dword [0x46a898]
push edx
call fcn.00417790
add esp, 8
push str.Fix2001
push 0x44470f
push 0x80000002
call fcn.00417e0c
add esp, 0xc
mov eax, 0x2c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x409198
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov eax, dword [0x444242]
mov edx, dword [0x44424e]
push ebx
push esi
push edi
mov dword [ebp - 0xc], eax
mov eax, dword [0x444246]
mov dword [ebp - 8], eax
mov eax, dword [0x44424a]
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], edx
mov edx, dword [0x444252]
xor ebx, ebx
mov dword [ebp - 0x14], edx
mov edx, dword [0x444256]
mov dword [ebp - 0x10], edx
jmp 0x4091fe
mov eax, ebx
push 4
shl eax, 3
push str.CODE
lea eax, [eax + eax*4]
add eax, dword [0x46b1b4]
push eax
call fcn.0042be6c
add esp, 0xc
test eax, eax
je 0x409209
inc ebx
movzx edx, word [0x46b0c2]
cmp ebx, edx
jl 0x4091db
movzx ecx, word [0x46b0c2]
cmp ebx, ecx
jne 0x40921b
xor eax, eax
jmp 0x4092dd
lea edx, [ebx + ebx*4]
mov ecx, dword [0x46b1b4]
push 0
mov eax, dword [ecx + edx*8 + 0x14]
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.0042e350
add esp, 0xc
xor esi, esi
lea edi, [ebp - 0xc]
mov eax, dword [ebp + 8]
push eax
call fcn.00430138
pop ecx
cmp al, byte [edi]
jne 0x409251
inc esi
inc edi
cmp esi, 0xc
jl 0x40923c
cmp esi, 0xc
jge 0x409290
lea edx, [ebx + ebx*4]
mov ecx, dword [0x46b1b4]
push 0
mov eax, dword [ecx + edx*8 + 0x14]
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.0042e350
add esp, 0xc
xor esi, esi
lea ebx, [ebp - 0x18]
mov eax, dword [ebp + 8]
push eax
call fcn.00430138
pop ecx
cmp al, byte [ebx]
je 0x409289
xor eax, eax
jmp 0x4092dd
inc esi
inc ebx
cmp esi, 0xc
jl 0x409277
push 0
mov edx, dword [ebp + 8]
push edx
push 0x45
call fcn.00401410
add esp, 0xc
dec eax
je 0x4092a7
xor eax, eax
jmp 0x4092dd
push str.SystemBackup
push 0x444750
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push 0
mov edx, dword [0x46a898]
push edx
call fcn.00417790
add esp, 8
test eax, eax
je 0x4092da
mov eax, 0x45
jmp 0x4092dd
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4096fc
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
mov eax, 0x445258
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
call fcn.0042c210
push esi
mov esi, 0x444276
lea edi, [ebp - 0x4c]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
push esi
mov esi, 0x444296
lea edi, [ebp - 0x6c]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
push 0
push 0x1000
push esi
call fcn.0042e350
add esp, 0xc
xor ebx, ebx
lea edi, [ebp - 0x4c]
push esi
call fcn.00430138
pop ecx
cmp al, byte [edi]
jne 0x40975b
inc ebx
inc edi
cmp ebx, 0x20
jl 0x409749
cmp ebx, 0x20
jge 0x409787
push 0
push 0x36fa
push esi
call fcn.0042e350
add esp, 0xc
xor ebx, ebx
lea edi, [ebp - 0x6c]
push esi
call fcn.00430138
pop ecx
cmp al, byte [edi]
jne 0x409787
inc ebx
inc edi
cmp ebx, 0x20
jl 0x409775
cmp ebx, 0x20
jge 0x40979d
xor eax, eax
mov edx, dword [ebp - 0x2c]
mov dword fs:[0], edx
jmp 0x40984e
push 0
push esi
push 0x48
call fcn.00401410
add esp, 0xc
dec eax
je 0x4097be
xor eax, eax
mov edx, dword [ebp - 0x2c]
mov dword fs:[0], edx
jmp 0x40984e
push 0
mov ecx, dword [0x46a898]
push ecx
call fcn.00417790
mov word [ebp - 0x1c], 8
add esp, 8
mov edx, 0x4447a8
lea eax, [ebp - 4]
call fcn.0043862c
inc dword [ebp - 0x10]
mov edx, 0x44478c
mov ecx, dword [eax]
lea eax, [ebp - 8]
push ecx
call fcn.0043862c
inc dword [ebp - 0x10]
mov ecx, dword [eax]
push ecx
push Ordinal_1
call fcn.004183c0
add esp, 0xc
dec dword [ebp - 0x10]
lea eax, [ebp - 8]
mov edx, 2
call fcn.004386a0
dec dword [ebp - 0x10]
lea eax, [ebp - 4]
mov edx, 2
call fcn.004386a0
push str.Win32BaseServiceMOD
push 0x4447b0
push 0x80000002
call fcn.00417e0c
add esp, 0xc
mov eax, 0x48
mov edx, dword [ebp - 0x2c]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x409858
Capabilities:
Get common file path
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff90
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [str.:nongmin_cn_n]
mov dword [ebp - 0x70], eax
mov eax, dword [0x4442ba]
mov dword [ebp - 0x6c], eax
mov eax, dword [0x4442be]
mov dword [ebp - 0x68], eax
push 0
push 0x171a5
push edi
call fcn.0042e350
add esp, 0xc
xor esi, esi
lea ebx, [ebp - 0x70]
push edi
call fcn.00430138
pop ecx
cmp al, byte [ebx]
je 0x4098a3
xor eax, eax
jmp 0x409909
inc esi
inc ebx
cmp esi, 0xc
jl 0x409894
push 0
push edi
push 0x5b
call fcn.00401410
add esp, 0xc
dec eax
je 0x4098be
xor eax, eax
jmp 0x409909
push 0x64
lea edx, [ebp - 0x64]
push edx
call sub.KERNEL32.DLL_GetWindowsDirectoryA
push str._note.com
lea ecx, [ebp - 0x64]
push ecx
call fcn.0042bd64
add esp, 8
lea eax, [ebp - 0x64]
push eax
mov edx, dword [0x46a898]
push edx
call fcn.00417790
add esp, 8
push str.startIE
push 0x4447fd
push 0x80000002
call fcn.00417e0c
add esp, 0xc
mov eax, 0x5b
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40aa78
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
mov eax, 0x4454e8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
call fcn.0042c210
push edi
mov esi, 0x4443dc
lea edi, [ebp - 0x60]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop edi
push 0
push 0x4a1c
push edi
call fcn.0042e350
add esp, 0xc
xor esi, esi
lea ebx, [ebp - 0x60]
push edi
call fcn.00430138
pop ecx
cmp al, byte [ebx]
je 0x40aad0
xor eax, eax
mov edx, dword [ebp - 0x40]
mov dword fs:[0], edx
jmp 0x40acdc
inc esi
inc ebx
cmp esi, 0x10
jl 0x40aab4
push 0
push edi
push 0x20a
call fcn.00401410
add esp, 0xc
dec eax
je 0x40aafb
xor eax, eax
mov edx, dword [ebp - 0x40]
mov dword fs:[0], edx
jmp 0x40acdc
push 0
mov ecx, dword [0x46a898]
push ecx
call fcn.00417790
mov word [ebp - 0x30], 0x14
add esp, 8
mov edx, str.WIN.INI
lea eax, [ebp - 4]
call fcn.0043862c
inc dword [ebp - 0x24]
mov ecx, dword [eax]
mov dl, 1
mov eax, dword [0x41a0c8]
call fcn.00409ea0
mov ebx, eax
dec dword [ebp - 0x24]
lea eax, [ebp - 4]
mov edx, 2
call fcn.004386a0
mov word [ebp - 0x30], 8
mov edx, 0x444997
lea eax, [ebp - 0xc]
call fcn.0043862c
inc dword [ebp - 0x24]
mov edx, 0x44498f
mov ecx, dword [eax]
lea eax, [ebp - 8]
push ecx
mov word [ebp - 0x30], 0x20
call fcn.0043862c
inc dword [ebp - 0x24]
mov edx, dword [eax]
mov eax, ebx
pop ecx
mov esi, dword [eax]
call dword [esi + 0x48]
dec dword [ebp - 0x24]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004386a0
dec dword [ebp - 0x24]
lea eax, [ebp - 8]
mov edx, 2
call fcn.004386a0
mov edx, 0x4449a4
lea eax, [ebp - 0x14]
call fcn.0043862c
inc dword [ebp - 0x24]
mov edx, str.windows
mov ecx, dword [eax]
lea eax, [ebp - 0x10]
push ecx
mov word [ebp - 0x30], 0x2c
call fcn.0043862c
inc dword [ebp - 0x24]
mov edx, dword [eax]
mov eax, ebx
pop ecx
mov esi, dword [eax]
call dword [esi + 0x48]
dec dword [ebp - 0x24]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004386a0
dec dword [ebp - 0x24]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004386a0
mov esi, ebx
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x40ac15
mov eax, dword [esi]
mov dword [ebp - 0x18], eax
mov word [ebp - 0x30], 0x44
mov edx, 3
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx - 4]
mov word [ebp - 0x30], 0x38
push 0x4449d7
push 0x4449a8
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push 0x444a14
push 0x4449e5
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push 0x444a5a
push 0x444a2b
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push 0x444a92
push 0x444a63
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.bymer.scanner
push 0x444a99
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.distributed.net.client
push 0x444ade
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.internat
push 0x444b2c
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.msinit
push 0x444b6c
push 0x80000002
call fcn.00417e0c
add esp, 0xc
mov eax, 0x20a
mov edx, dword [ebp - 0x40]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40af38
Capabilities:
Get common file path
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffb5c
push ebx
push esi
push edi
mov esi, 0x444418
lea edi, [ebp - 0x24]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
mov esi, 0x444438
lea edi, [ebp - 0x44]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
mov esi, 0x444458
lea edi, [ebp - 0x64]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
push 0
push 0x3f0
mov eax, dword [ebp + 8]
push eax
call fcn.0042e350
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
push 1
push 0x40
lea ecx, [ebp - 0xa4]
push ecx
call fcn.0042e2b0
add esp, 0x10
mov eax, dword [ebp + 8]
test byte [eax + 0x12], 0x20
je 0x40afab
xor eax, eax
jmp 0x40b0c1
xor edx, edx
lea esi, [ebp - 0xa4]
mov dword [ebp - 4], edx
xor eax, eax
lea ecx, [ebp - 0x24]
mov edx, esi
movzx edi, byte [ecx]
xor ebx, ebx
dec edi
mov bl, byte [edx]
cmp ebx, edi
jne 0x40afd1
inc eax
inc ecx
inc edx
cmp eax, 0x20
jl 0x40afbd
cmp eax, 0x20
je 0x40b01d
xor eax, eax
lea ecx, [ebp - 0x44]
mov edx, esi
mov bl, byte [ecx]
add bl, 0xff
cmp bl, byte [edx]
jne 0x40afee
inc eax
inc ecx
inc edx
cmp eax, 0x20
jl 0x40afdd
cmp eax, 0x20
je 0x40b01d
xor eax, eax
lea ecx, [ebp - 0x64]
mov edx, esi
movzx edi, byte [ecx]
xor ebx, ebx
dec edi
mov bl, byte [edx]
cmp ebx, edi
jne 0x40b00e
inc eax
inc ecx
inc edx
cmp eax, 0x20
jl 0x40affa
cmp eax, 0x20
je 0x40b01d
inc dword [ebp - 4]
inc esi
cmp dword [ebp - 4], 0x20
jl 0x40afb6
cmp dword [ebp - 4], 0x20
jne 0x40b02a
xor eax, eax
jmp 0x40b0c1
push 0
mov edx, dword [ebp + 8]
push edx
push 0x713
call fcn.00401410
add esp, 0xc
dec eax
je 0x40b044
xor eax, eax
jmp 0x40b0c1
push 0
mov edx, dword [0x46a898]
push edx
call fcn.00417790
add esp, 8
push 0x400
lea ecx, [ebp - 0x4a4]
push ecx
call sub.KERNEL32.DLL_GetWindowsDirectoryA
push 0x444c5d
lea eax, [ebp - 0x4a4]
push eax
call fcn.0042bd64
add esp, 8
push str.inetd.exe
lea edx, [ebp - 0x4a4]
push edx
call fcn.00417cc4
add esp, 8
push 0x444ca3
push 0x444c70
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push 0x444ce2
push 0x444cac
push reloc.DZIP32.DLL_Ordinal_1
call fcn.00417e0c
add esp, 0xc
mov eax, 0x713
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40ba90
Capabilities:
Get common file path
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
mov ecx, 4
push ebx
push esi
push edi
mov esi, 0x4444b4
mov edi, dword [ebp + 8]
push edi
lea edi, [ebp - 0x14]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop edi
mov eax, dword [0x46b1bc]
sub eax, 0x7f
push 0
push eax
push edi
call fcn.0042e350
add esp, 0xc
xor esi, esi
lea ebx, [ebp - 0x14]
push edi
call fcn.00430138
pop ecx
cmp al, byte [ebx]
je 0x40badd
xor eax, eax
jmp 0x40bb90
inc esi
inc ebx
cmp esi, 0x12
jl 0x40bacb
push 0
push edi
push 0x99f
call fcn.00401410
add esp, 0xc
dec eax
je 0x40bafe
xor eax, eax
jmp 0x40bb90
push 0
mov edx, dword [0x46a898]
push edx
call fcn.00417790
add esp, 8
push 0x444ddd
push 0x444daa
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x118]
push ecx
call sub.KERNEL32.DLL_GetSystemDirectoryA
lea eax, [ebp - 0x118]
push eax
call fcn.0042bda0
pop ecx
movsx edx, byte [ebp + eax - 0x119]
cmp edx, 0x5c
jne 0x40bb66
lea ecx, [ebp - 0x118]
push ecx
call fcn.0042bda0
pop ecx
mov byte [ebp + eax - 0x119], 0
push str.kdll.dll
lea eax, [ebp - 0x118]
push eax
call fcn.0042bd64
add esp, 8
push 0
lea edx, [ebp - 0x118]
push edx
call fcn.00417790
add esp, 8
mov eax, 0x99f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40bb98
Capabilities:
Get common file path
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
mov ecx, 8
push ebx
push esi
push edi
mov esi, str.FormB
mov edi, dword [ebp + 8]
push edi
lea edi, [ebp - 0x20]
rep movsd dword es:[edi], dword [esi]
pop edi
push 0
push 0xe10
push edi
call fcn.0042e350
add esp, 0xc
xor esi, esi
lea ebx, [ebp - 0x20]
push edi
call fcn.00430138
pop ecx
cmp al, byte [ebx]
je 0x40bbdf
xor eax, eax
jmp 0x40bcaa
inc esi
inc ebx
cmp esi, 0x20
jl 0x40bbcd
push 0
push edi
push 0x9a0
call fcn.00401410
add esp, 0xc
dec eax
je 0x40bc00
xor eax, eax
jmp 0x40bcaa
push 0x444df0
call fcn.004175d0
pop ecx
push str.pentagone
call fcn.004175d0
pop ecx
push 0
mov edx, dword [0x46a898]
push edx
call fcn.00417790
add esp, 8
push 0x104
lea ecx, [ebp - 0x124]
push ecx
call sub.KERNEL32.DLL_GetSystemDirectoryA
lea eax, [ebp - 0x124]
push eax
call fcn.0042bda0
pop ecx
movsx edx, byte [ebp + eax - 0x125]
cmp edx, 0x5c
jne 0x40bc67
lea ecx, [ebp - 0x124]
push ecx
call fcn.0042bda0
pop ecx
mov byte [ebp + eax - 0x125], 0
push str.gone.scr
lea eax, [ebp - 0x124]
push eax
call fcn.0042bd64
add esp, 8
push 0
lea edx, [ebp - 0x124]
push edx
call fcn.00417790
add esp, 8
lea ecx, [ebp - 0x124]
push ecx
push 0x444e0d
push 0x80000002
call fcn.00417e0c
add esp, 0xc
mov eax, 0x9a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40bcb4
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov ecx, 4
push ebx
push esi
push edi
mov esi, 0x4444e6
mov edi, dword [ebp + 8]
push edi
lea edi, [ebp - 0x14]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop edi
mov eax, dword [0x46b1bc]
push 0
push eax
push edi
call fcn.0042e350
add esp, 0xc
xor esi, esi
lea ebx, [ebp - 0x14]
push edi
call fcn.00430138
pop ecx
cmp al, byte [ebx]
je 0x40bcf8
xor eax, eax
jmp 0x40bd4e
inc esi
inc ebx
cmp esi, 0x12
jl 0x40bce9
push 0
push edi
push 0x9a5
call fcn.00401410
add esp, 0xc
dec eax
je 0x40bd16
xor eax, eax
jmp 0x40bd4e
push str.karen.exe
call fcn.004175d0
pop ecx
push 0
mov edx, dword [0x46a898]
push edx
call fcn.00417790
add esp, 8
push str.Karen
push 0x444e46
push 0x80000002
call fcn.00417e0c
add esp, 0xc
mov eax, 0x9a5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40bd58
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov ecx, 3
push ebx
push esi
push edi
mov esi, str.WINL0G0
mov edi, dword [ebp + 8]
push edi
lea edi, [ebp - 0x10]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop edi
mov eax, dword [0x46b1bc]
add eax, 0x1d7a
push 0
push eax
push edi
call fcn.0042e350
add esp, 0xc
xor esi, esi
lea ebx, [ebp - 0x10]
push edi
call fcn.00430138
pop ecx
cmp al, byte [ebx]
je 0x40bda4
xor eax, eax
jmp 0x40be28
inc esi
inc ebx
cmp esi, 0xe
jl 0x40bd92
push 0
push edi
push 0x9a9
call fcn.00401410
add esp, 0xc
dec eax
je 0x40bdc2
xor eax, eax
jmp 0x40be28
push str.WINL0G0N.EXE
call fcn.004175d0
pop ecx
push 0
mov edx, dword [0x46a898]
push edx
call fcn.00417790
add esp, 8
push 0x444eb7
push 0x444e88
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push 0x444eef
push 0x444ec0
push reloc.DZIP32.DLL_Ordinal_1
call fcn.00417e0c
add esp, 0xc
push str.WINL0G0N
push str..DefaultSoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000003
call fcn.00417e0c
add esp, 0xc
mov eax, 0x9a5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40bf64
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde0
mov ecx, 5
push ebx
push esi
push edi
mov esi, 0x444520
mov edi, dword [ebp + 8]
push edi
lea edi, [ebp - 0x18]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop edi
mov eax, dword [0x46b1bc]
push 0
push eax
push edi
call fcn.0042e350
add esp, 0xc
xor esi, esi
lea ebx, [ebp - 0x18]
push edi
call fcn.00430138
pop ecx
cmp al, byte [ebx]
je 0x40bfae
xor eax, eax
jmp 0x40c058
inc esi
inc ebx
cmp esi, 0x16
jl 0x40bf9c
push 0
push edi
push 0x9b9
call fcn.00401410
add esp, 0xc
dec eax
je 0x40bfcf
xor eax, eax
jmp 0x40c058
push 0
mov edx, dword [0x46a898]
push edx
call fcn.00417790
add esp, 8
lea ecx, [ebp - 0x220]
lea eax, [ebp - 0x11c]
lea edx, [ebp - 0x220]
push ecx
push eax
push edx
lea ecx, [ebp - 0x220]
push ecx
mov eax, dword [0x46a898]
push eax
call fcn.0042de18
add esp, 0x14
lea edx, [ebp - 0x11c]
push edx
push 0x444f66
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push 0x444fc4
push 0x444f95
push 0x80000002
call fcn.00417e0c
add esp, 0xc
lea ecx, [ebp - 0x11c]
push ecx
push 0x444fc8
push 0x80000002
call fcn.00417e0c
add esp, 0xc
mov eax, 0x9b9
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40c0f0
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffddc
mov ecx, 6
push ebx
push esi
push edi
mov esi, 0x444548
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0xa09
push edi
lea edi, [ebp - 0x1c]
rep movsd dword es:[edi], dword [esi]
pop edi
mov eax, dword [0x46b1bc]
push 0
push eax
push edi
call fcn.0042e350
add esp, 0xc
xor ebx, ebx
lea esi, [ebp - 0x1c]
push edi
call fcn.00430138
pop ecx
cmp al, byte [esi]
jne 0x40c13f
inc ebx
inc esi
cmp ebx, 0x18
jl 0x40c12d
cmp ebx, 0x18
jge 0x40c179
push 0
push 0x8458
push edi
call fcn.0042e350
add esp, 0xc
xor ebx, ebx
lea esi, [ebp - 0x1c]
push edi
call fcn.00430138
pop ecx
cmp al, byte [esi]
je 0x40c16b
xor eax, eax
jmp 0x40c20c
inc ebx
inc esi
cmp ebx, 0x18
jl 0x40c159
mov dword [ebp - 4], 0xa9b
push 0
push edi
mov edx, dword [ebp - 4]
push edx
call fcn.00401410
add esp, 0xc
dec eax
je 0x40c18f
xor eax, eax
jmp 0x40c20c
push 0
mov edx, dword [0x46a898]
push edx
call fcn.00417790
add esp, 8
lea ecx, [ebp - 0x224]
lea eax, [ebp - 0x120]
lea edx, [ebp - 0x224]
push ecx
push eax
push edx
lea ecx, [ebp - 0x224]
push ecx
mov eax, dword [0x46a898]
push eax
call fcn.0042de18
add esp, 0x14
lea edx, [ebp - 0x120]
push edx
call fcn.004175d0
pop ecx
lea ecx, [ebp - 0x120]
push ecx
push 0x444ff7
push 0x80000002
call fcn.00417e0c
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
push 0x445026
push 0x80000002
call fcn.00417e0c
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret