joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001e77
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.10001ad0
push eax
push esi
push dword [ebp + 8]
call fcn.10001a85
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.10001ad0
push eax
push esi
push dword [ebp + 8]
call fcn.10001a85
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.10001ac0
adc eax, 0x88f66952
popfd
jl 0x10001f45
invalid
invalid
Function at 0x100021cf
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x10002174
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x1000216f
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x10002159
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x10002161
cmp edx, ebx
jne 0x100022af
test dword [esi + 1], ecx
add byte [eax], al
test dword [esi + 1], ecx
add byte [eax], al
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x10002130
add eax, dword [eax + 4]
jmp 0x1000211d
mov dword [ebp + 0xc], ebx
jmp 0x1000217f
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x10002197
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x100021b5
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
inc ebp
invalid
ja 0x10002213
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x100021fa
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x10002203
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x1000220d
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x100021ef
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x10002179
mov dword [ebp + 8], esi
xor edi, edi

Function at 0x10002385
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc edi
test dword [esp + edi*8 - 1], edi
inc dword [eax + eax]
add byte [eax], al
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
invalid
invalid
dec esi
Function at 0x10005f42
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x10006004
push 0
push 0
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x10006004
mov ecx, dword [ebp - 0xc]
add ecx, 2
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x10006004
push 0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10006004
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
mov dword [ecx], edx
mov eax, 1
jmp 0x1000601f
cmp dword [ebp - 0x10], 0
je 0x10006014
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 0
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0xcf5a0c
Capabilities:
Encode data using xor

Disassembly:
jmp 0xcf5a16
pushal
call 0xcf5a1c
pop ebp
sub ebp, 0x10
sub ebp, 0x8f5a0c
jmp 0xcf5a32
mov eax, 0x8f5a0c
add eax, ebp
add eax, 0x4c
mov ecx, 0x617
mov edx, 0xe77d2cea
xor byte [eax], dl
inc eax
dec ecx
jne 0xcf5a49
jmp 0xcf5a5c
popal
daa
popal
arpl si, dx
ljmp 0xea12
Function at 0x4029e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40f078
push 0x402b12
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
and dword [ebp - 4], 0
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x40f250], 0xffffffff
or dword [0x40f104], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x40f314]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x40f194]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x40f254], eax
call fcn.00402b11
cmp dword [0x40f178], 0
jne 0x402a62
push 0x4132d4
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.00402afc
push 0x40f29c
push 0x40f29c
call sub.msvcrt.dll__initterm
mov eax, dword [0x40f0e8]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x40f2e0]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
push 0x40f0e0
push 0x40f0e0
call sub.msvcrt.dll__initterm
call dword [sym.imp.msvcrt.dll___p___initenv]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
push dword [ebp - 0x20]
push dword [ebp - 0x2c]
push dword [ebp - 0x1c]
jmp fcn.00401280
Function at 0x402b40
Capabilities:
Access peb ldr_data
Query or enumerate registry value
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x406568
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x28]
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 0x24]
mov dword [esp + 0x38], 0
call sub.MFC42.DLL_CString::CString_1
push 0x409424
lea ecx, [esp + 0x24]
mov byte [esp + 0x3c], 1
call sub.MFC42.DLL_CString::CString
mov eax, 4
mov byte [esp + 0x38], 2
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
mov dword [esp + 0x1c], 0
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x402be9
mov ecx, dword [esi + 0xac]
push ecx
push str.uid:_s_no_internet_settings_key
push 0x409a00
call sub.MFC42.DLL_CString::Format
add esp, 0xc
mov ecx, esi
push 0x409a00
call fcn.00404c60
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
push eax
push ecx
push 0
push str.EnableAutodial
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x402c34
push eax
mov eax, dword [esi + 0xac]
push eax
push str.uid:_s_no_internet_settings_value:_d
push 0x409a00
call sub.MFC42.DLL_CString::Format
add esp, 0x10
mov ecx, esi
push 0x409a00
call fcn.00404c60
mov eax, dword [esp + 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x402c89
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x10]
push edx
push eax
push 0
push str.EnableAutodial
push ecx
call edi
test eax, eax
je 0x402c89
mov edx, dword [esi + 0xac]
push eax
push edx
push str.uid:_s_fail_to_change_internet_setting:_d
push 0x409a00
call sub.MFC42.DLL_CString::Format
add esp, 0x10
mov ecx, esi
push 0x409a00
call fcn.00404c60
mov edx, dword [esp + 0x40]
lea eax, [esp + 0x2c]
lea ecx, [esi + 0xb0]
push eax
push ecx
push edx
mov ecx, esi
call fcn.00402d50
test eax, eax
mov eax, dword [esp + 0x14]
setne bl
test eax, eax
je 0x402cf5
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x14]
push eax
mov eax, dword [esp + 0x10]
push ecx
push edx
push 0
push str.EnableAutodial
push eax
call edi
test eax, eax
je 0x402cf5
mov ecx, dword [esi + 0xac]
push eax
push ecx
push str.uid:_s_fl_cls_a_d:_d
push 0x409a00
call sub.MFC42.DLL_CString::Format
add esp, 0x10
mov ecx, esi
push 0x409a00
call fcn.00404c60
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x20]
mov byte [esp + 0x38], 1
call fcn.00405af6
lea ecx, [esp + 0x24]
mov byte [esp + 0x38], 0
call fcn.00405af6
lea ecx, [esp + 0x28]
mov dword [esp + 0x38], 0xffffffff
call fcn.00405af6
mov ecx, dword [esp + 0x30]
pop edi
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x30
ret 4
Function at 0x4031b0
Capabilities:
Get disk information

Disassembly:
sub esp, 0x20c
lea eax, [esp + 0xc]
lea ecx, [esp + 8]
lea edx, [esp + 4]
push 0x100
push eax
push ecx
lea eax, [esp + 0xc]
push edx
push eax
lea ecx, [esp + 0x120]
push 0x100
push ecx
push 0x4094f4
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov eax, dword [esp]
mov edx, eax
mov ecx, eax
and edx, 0xff
push edx
xor edx, edx
shr ecx, 4
mov dl, ah
and ecx, 0xff
shr eax, 0xc
push ecx
and eax, 0xff
push edx
push eax
mov eax, dword [esp + 0x220]
push str._02.2X___02.2X___02.2X___02.2X_
push eax
call sub.MFC42.DLL_CString::Format
mov al, 1
add esp, 0x224
ret 4
Function at 0x404320
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4067db
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30c
push ebx
push esi
mov esi, dword [esp + 0x324]
push str.default
mov ecx, esi
mov bl, 1
mov dword [esp + 0x14], 0x100
call fcn.00405b02
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString_1
lea eax, [esp + 0x14]
push 0x409668
push eax
mov dword [esp + 0x324], 0
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0xc]
push 0
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREClasses.htm
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40440f
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x10]
lea eax, [esp + 0x114]
push edx
push eax
push 0
push 0
push 0x409a04
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40440f
lea edx, [esp + 0x114]
lea ecx, [esp + 8]
push edx
call fcn.00405b02
lea eax, [esp + 8]
mov ecx, esi
push eax
call fcn.00405bc2
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::MakeLower
push str.htmlfile
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::Find
mov ecx, dword [esp + 0xc]
test eax, eax
push ecx
sete bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 8]
mov dword [esp + 0x31c], 0xffffffff
call fcn.00405af6
mov ecx, dword [esp + 0x314]
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x318
ret 4
Function at 0x405550
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x406a0f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0
call sub.MFC42.DLL_CString::CString_1
push 0x409a04
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 1
call sub.MFC42.DLL_CString::CString
mov eax, dword [esi + 0xac]
mov byte [esp + 0x28], 2
mov eax, dword [eax - 8]
lea edi, [eax - 1]
test edi, edi
jl 0x4055c5
mov ecx, dword [esi + 0xac]
mov dl, 0xa4
mov al, byte [edi + ecx]
lea ecx, [esp + 0xc]
sub dl, al
push edx
call sub.MFC42.DLL_CString::operator_2
sub edi, 2
jns 0x4055a9
push 0x409890
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::operator_1
mov edi, dword [esp + 0x34]
push 0x2e
mov ecx, edi
call sub.MFC42.DLL_CString::ReverseFind
push eax
lea eax, [esp + 0x1c]
push 0
push eax
mov ecx, edi
call sub.MFC42.DLL_CString::Mid_1
mov edi, eax
push 2
lea ecx, [esp + 0x18]
push 2
push ecx
lea ecx, [esp + 0x18]
mov byte [esp + 0x34], 3
call sub.MFC42.DLL_CString::Mid_1
mov ebp, eax
push 1
lea edx, [esp + 0x38]
push 0
push edx
lea ecx, [esp + 0x18]
mov byte [esp + 0x34], 4
call sub.MFC42.DLL_CString::Mid_1
mov ecx, dword [edi]
mov edx, dword [ebp]
mov eax, dword [eax]
push ecx
mov ecx, dword [esi + 0xe0]
push edx
push eax
push ecx
lea edx, [esp + 0x20]
push str._s_swin_s_s.exe
push edx
mov byte [esp + 0x40], 5
call sub.MFC42.DLL_CString::Format
add esp, 0x18
lea ecx, [esp + 0x34]
mov byte [esp + 0x28], 4
call fcn.00405af6
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 3
call fcn.00405af6
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], 2
call fcn.00405af6
mov esi, dword [esp + 0x30]
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 0x1c], 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 1
call fcn.00405af6
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 0
call fcn.00405af6
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x20
ret 8
Function at 0x4056c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x406a5f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
push edi
mov edi, ecx
mov dword [esp + 0x1c], 0
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 8]
mov dword [esp + 0x28], 1
call sub.MFC42.DLL_CString::CString_1
mov eax, dword [edi + 0xac]
push 0x409078
push eax
mov byte [esp + 0x30], 2
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 8
test eax, eax
jne 0x40572c
push 0x4098a4
lea ecx, [esp + 0xc]
call fcn.00405b02
jmp 0x40575a
mov eax, dword [edi + 0xac]
xor esi, esi
mov ecx, dword [eax - 8]
test ecx, ecx
jle 0x40575a
mov al, byte [eax + esi]
mov cl, 0xa3
sub cl, al
push ecx
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::operator_2
mov eax, dword [edi + 0xac]
add esi, 2
cmp esi, dword [eax - 8]
jl 0x40573b
push 1
lea edx, [esp + 0x1c]
push 2
push edx
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Mid_1
mov esi, eax
mov edi, dword [esp + 0x34]
push 0x2e
mov ecx, edi
mov byte [esp + 0x2c], 3
call sub.MFC42.DLL_CString::ReverseFind
push eax
lea eax, [esp + 0x18]
push 0
push eax
mov ecx, edi
call sub.MFC42.DLL_CString::Mid_1
mov edi, eax
push 2
lea ecx, [esp + 0x14]
push 0
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], 4
call sub.MFC42.DLL_CString::Mid_1
mov edx, dword [esi]
mov ecx, dword [edi]
push edx
mov edx, dword [eax]
push ecx
push edx
lea eax, [esp + 0x18]
push str._s_srng_s.exe
push eax
mov byte [esp + 0x3c], 5
call sub.MFC42.DLL_CString::Format
add esp, 0x14
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 4
call fcn.00405af6
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 3
call fcn.00405af6
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], 2
call fcn.00405af6
mov esi, dword [esp + 0x30]
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 0x1c], 1
lea ecx, [esp + 8]
mov byte [esp + 0x28], 1
call fcn.00405af6
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 0
call fcn.00405af6
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x24
ret 8
Function at 0x405840
Capabilities:
Create shortcut via ishelllink

Disassembly:
sub esp, 0x210
push ebp
mov ebp, ecx
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jl 0x4059d1
lea eax, [esp + 4]
push esi
push eax
push 0x407564
push 1
push 0
push 0x407574
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
jl 0x40598f
mov eax, dword [esp + 8]
push edi
mov edi, dword [esp + 0x220]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x50]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x228]
push ecx
push eax
mov edx, dword [eax]
call dword [edx + 0x1c]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x22c]
push ecx
push eax
mov edx, dword [eax]
call dword [edx + 0x2c]
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ecx
push 0x407584
mov edx, dword [eax]
push eax
call dword [edx]
mov esi, eax
test esi, esi
jl 0x405949
push ebx
mov ebx, dword [esp + 0x228]
lea edx, [esp + 0x18]
push 0x104
push edx
push 0xffffffffffffffff
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
push 1
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov esi, eax
push esi
push ebx
push edi
push str.Crt_lnk_4_:_s_s__X_
push 0x409a00
call sub.MFC42.DLL_CString::Format
add esp, 0x14
mov ecx, ebp
push 0x409a00
call fcn.00404c60
mov eax, dword [esp + 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x10]
pop ebx
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
pop edi
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, esi
pop esi
pop ebp
add esp, 0x210
ret 0x10
mov edx, dword [esp + 0x224]
push esi
push edx
push edi
push str.Crt_lnk_2_:_s_s__X_
push 0x409a00
call sub.MFC42.DLL_CString::Format
add esp, 0x14
mov ecx, ebp
push 0x409a00
call fcn.00404c60
mov eax, dword [esp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
pop edi
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, esi
pop esi
pop ebp
add esp, 0x210
ret 0x10
mov edx, dword [esp + 0x220]
mov eax, dword [esp + 0x21c]
push esi
push edx
push eax
push str.Crt_lnk_3_:_s_s__X_
push 0x409a00
call sub.MFC42.DLL_CString::Format
add esp, 0x14
mov ecx, ebp
push 0x409a00
call fcn.00404c60
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, esi
pop esi
pop ebp
add esp, 0x210
ret 0x10
mov eax, dword [esp + 8]
pop ebp
add esp, 0x210
ret 0x10
Function at 0x42e006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x42e072
mov ebx, 0x407ef8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x756534b9
nop
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x42e060
nop
nop
mov eax, str.w_
cmp eax, 0
nop
nop
nop
je 0x42e0d2
nop
nop
nop
nop
nop
mov ebx, 0x42cd70
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x7d3729c3
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x401407
Capabilities:
Delete registry key
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x42c14c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
cmp dword [0x50bce4], 0x40
jne 0x401436
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
cmp dword [0x50bce4], 0xadf
mov eax, dword [ebp + 8]
mov dword [0x4e4654], eax
jne 0x40147a
push edi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
xor eax, eax
mov dword [ebp - 0x18], esi
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004025a2
leave
ret 4

Function at 0x401489
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
xor esi, esi
mov dword [ebp - 4], esi
sub dword [ebp - 4], 0x656bc990
add dword [ebp - 4], 0x44929110
mov eax, dword [ebp - 4]
mov dword [0x448464], eax
mov eax, dword [0x4e4654]
imul eax, eax, 0x343fd
cmp dword [0x50bce4], 0x58a
mov dword [0x4e4654], eax
jne 0x4014d8
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
push esi
call dword [sym.imp.ADVAPI32.dll_DestroyPrivateObjectSecurity]
add dword [0x4e4654], 0x269ec3
cmp dword [0x50bce4], 0x171
mov dword [0x4e4660], esi
jne 0x401503
lea eax, [ebp - 8]
push eax
push esi
push esi
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_GetAce]
movzx eax, word [0x4e4656]
and eax, 0x7fff
pop esi
leave
ret

Function at 0x401512
Capabilities:
Access the windows event log
Get disk information
Manipulate console buffer
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x814
mov eax, dword [0x42c14c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
xor edi, edi
mov dword [ebp - 0x80c], eax
cmp ebx, 0x4b7
jne 0x401542
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenBackupEventLogA]
xor esi, esi
cmp ebx, edi
jle 0x401598
cmp ebx, 0xad7
jne 0x401560
lea eax, [ebp - 0x810]
push eax
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
call fcn.00401489
mov ecx, dword [ebp - 0x80c]
xor byte [ecx + esi], al
cmp ebx, 0x13a1
jne 0x401593
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea eax, [ebp - 0x814]
push eax
push edi
lea eax, [ebp - 0x804]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
inc esi
cmp esi, ebx
jl 0x401548
mov dword [ebp - 0x808], 0xd431db60
shr eax, 0xb
add dword [ebp - 0x808], 0x2bce24a0
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x808]
pop edi
xor ecx, ebp
mov dword [0x448460], eax
pop esi
call fcn.004025a2
leave
ret 4