joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4080c4
Capabilities:
Check if file exists
Enumerate files on windows
Enumerate files recursively
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x25c
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], edx
xor eax, eax
mov dword [esp + 0xc], edi
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x408283
test al, 0x10
je 0x408283
push 0x208
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x408283
push edi
push 0x104
push esi
call fcn.004a66ef
add esp, 0xc
test eax, eax
jne 0x40827c
push 0x4dc964
push 0x104
push esi
call fcn.004a6753
add esp, 0xc
test eax, eax
jne 0x40827c
mov ecx, dword [esp + 0x10]
mov eax, 0x4dc968
test ecx, ecx
cmovne eax, ecx
push eax
push 0x104
push esi
call fcn.004a6753
add esp, 0xc
test eax, eax
jne 0x40827c
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x40827c
lea eax, [esp + 0x44]
push 0x4dc96c
push eax
call fcn.004a65ee
pop ecx
pop ecx
test eax, eax
je 0x40825b
lea eax, [esp + 0x44]
push 0x4dc970
push eax
call fcn.004a65ee
pop ecx
pop ecx
test eax, eax
je 0x40825b
push edi
push 0x104
push esi
call fcn.004a66ef
add esp, 0xc
test eax, eax
jne 0x40825b
push 0x4dc964
push 0x104
push esi
call fcn.004a6753
add esp, 0xc
test eax, eax
jne 0x40825b
mov edi, esi
xor edx, edx
lea ecx, [edi + 2]
mov ax, word [edi]
add edi, 2
cmp ax, dx
jne 0x4081e7
lea eax, [esp + 0x44]
sub edi, ecx
push eax
push 0x104
push esi
sar edi, 1
call fcn.004a6753
add esp, 0xc
test eax, eax
jne 0x408257
cmp dword [ebp + 0x14], eax
jne 0x40823d
test byte [esp + 0x18], 0x10
je 0x40823d
cmp dword [ebp + 8], eax
je 0x408257
push dword [ebp + 0x1c]
mov edx, dword [esp + 0x14]
mov ecx, esi
push dword [ebp + 0x18]
push eax
push eax
mov eax, dword [ebp + 0xc]
inc eax
push eax
push 1
call fcn.004080c4
add esp, 0x18
jmp 0x408251
cmp dword [ebp + 0x18], 0
je 0x408257
push dword [ebp + 0x1c]
lea eax, [esi + edi*2]
push eax
push esi
push dword [ebp + 0xc]
call dword [ebp + 0x18]
mov ebx, eax
test ebx, ebx
jne 0x408272
mov edi, dword [esp + 0xc]
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x408180
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40909b
Capabilities:
Get domain controller name

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
or edx, 0x40020000
mov dword [ebp - 4], esi
push edx
push esi
push esi
push ecx
push esi
call dword [sym.imp.NETAPI32.dll_DsGetDcNameW]
test eax, eax
jne 0x409116
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
add ecx, 4
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x4090c9
sub ecx, edx
sar ecx, 1
push edi
lea edi, [ecx*2 + 2]
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ecx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
test ecx, ecx
je 0x40910a
mov eax, dword [ebp - 4]
xor esi, esi
push edi
inc esi
mov eax, dword [eax]
add eax, 4
push eax
push ecx
call fcn.0049fa90
add esp, 0xc
push dword [ebp - 4]
call dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
pop edi
jmp 0x409123
push eax
push str.ERROR_kull_m_net_getDC___DsGetDcName:__u_n
call fcn.00409cda
pop ecx
pop ecx
mov eax, esi
pop esi
leave
ret

Function at 0x409128
Capabilities:
Get hostname

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 4
pop ebp
push 7
pop eax
xor esi, esi
mov ebx, edx
test ecx, ecx
mov dword [esp + 0x10], esi
cmovne ebp, eax
lea eax, [esp + 0x10]
push eax
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4091a1
call edi
cmp eax, 0xea
jne 0x4091a1
mov eax, dword [esp + 0x10]
add eax, eax
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebx], eax
test eax, eax
je 0x4091b0
lea ecx, [esp + 0x10]
push ecx
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
mov esi, eax
test esi, esi
jne 0x4091b0
call edi
push eax
push str.ERROR_kull_m_net_getComputerName___GetComputerNameEx_data___0x_08x__n
call fcn.00409cda
pop ecx
pop ecx
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x4091b0
call edi
push eax
push str.ERROR_kull_m_net_getComputerName___GetComputerNameEx_init___0x_08x__n
call fcn.00409cda
pop ecx
pop ecx
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x4092a6
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
mov ebx, ecx
mov dword [esp + 0xc], 0x5285a4
push esi
xor esi, esi
mov dword [esp + 0xc], esi
mov ecx, dword [ebx + 4]
push edi
mov edi, edx
mov eax, dword [ecx]
sub eax, esi
je 0x4093b0
sub eax, 1
je 0x40934a
dec eax
sub eax, 1
je 0x409327
sub eax, 3
jne 0x40945a
mov eax, dword [edi + 4]
cmp dword [eax], esi
jne 0x409366
cmp dword [ebx], esi
je 0x409307
mov eax, dword [ecx + 4]
push esi
push esi
push dword [ebx]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
je 0x40945a
push esi
lea eax, [esp + 0x10]
push eax
mov eax, dword [ebx + 4]
push dword [ebp + 8]
push dword [edi]
mov eax, dword [eax + 4]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
jmp 0x40945a
mov eax, dword [edi + 4]
cmp dword [eax], esi
jne 0x409366
push esi
push esi
push ebx
push dword [ebp + 8]
mov edx, 0x22c187
mov ecx, dword [ecx + 4]
push dword [edi]
mov ecx, dword [ecx]
call fcn.004083ec
add esp, 0x14
jmp 0x409320
mov eax, dword [edi + 4]
cmp dword [eax], esi
jne 0x409366
mov eax, dword [ecx + 4]
push esi
push dword [ebp + 8]
push dword [edi]
push dword [ebx]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x409320
push dword [ebp + 8]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [esp + 0x10], eax
test eax, eax
je 0x40945a
push dword [ebp + 8]
mov edx, edi
lea ecx, [esp + 0x14]
call fcn.004092a6
pop ecx
test eax, eax
je 0x4093a1
push dword [ebp + 8]
lea edx, [esp + 0x14]
mov ecx, ebx
call fcn.004092a6
pop ecx
mov esi, eax
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x40945a
mov ecx, dword [edi + 4]
mov eax, dword [ecx]
sub eax, esi
je 0x409448
sub eax, 1
je 0x409430
sub eax, 1
je 0x409418
sub eax, 1
je 0x409407
sub eax, 3
jne 0x40945a
mov eax, dword [ecx + 4]
push esi
push esi
push dword [edi]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x40945a
push esi
lea eax, [esp + 0x10]
push eax
mov eax, dword [edi + 4]
push dword [ebp + 8]
push dword [ebx]
mov eax, dword [eax + 4]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x409320
push esi
lea eax, [ebp + 8]
mov edx, 0x22c183
push eax
push ebx
push esi
jmp 0x409339
mov ecx, dword [ecx + 4]
push dword [ebp + 8]
mov edx, dword [ebx]
push dword [edi]
mov ecx, dword [ecx]
call fcn.00409851
pop ecx
pop ecx
jmp 0x409320
mov eax, dword [ecx + 4]
push esi
push dword [ebp + 8]
push dword [ebx]
push dword [edi]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
jmp 0x409320
push dword [ebp + 8]
push dword [edi]
push dword [ebx]
call fcn.0049fa90
xor esi, esi
add esp, 0xc
inc esi
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4096e1
Capabilities:
Compress data via winapi

Disassembly:
sub esp, 0x10
push ebx
push ebp
lea eax, [esp + 0x14]
mov dword [esp + 0x10], ecx
push eax
lea eax, [esp + 0xc]
mov ebp, edx
push eax
push 0x102
mov dword [esp + 0x18], ebp
xor ebx, ebx
call dword [sym.imp.ntdll.dll_RtlGetCompressionWorkSpaceSize]
test eax, eax
js 0x40976c
push esi
push edi
push dword [esp + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
push 0x40
call edi
mov esi, eax
test esi, esi
je 0x40976a
push ebp
push 0x40
call edi
mov ebp, dword [esp + 0x24]
mov ecx, eax
mov edi, dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp], ecx
test ecx, ecx
je 0x409767
mov eax, dword [esp + 0x14]
push esi
push dword [esp + 0x2c]
push 0x1000
push eax
push ecx
push eax
push dword [esp + 0x30]
push 0x102
call dword [sym.imp.ntdll.dll_RtlCompressBuffer]
test eax, eax
setns bl
test eax, eax
jns 0x409767
push dword [ebp]
call edi
push esi
call edi
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x10
ret

Function at 0x409774
Capabilities:
Read file via mapping

Disassembly:
push ebx
push esi
push edi
push 8
push 0x40
mov edi, edx
mov ebx, ecx
xor esi, esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [edi], eax
test eax, eax
je 0x4097de
push esi
push esi
push esi
push 2
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ecx, dword [edi]
mov dword [ecx], eax
mov eax, dword [edi]
cmp dword [eax], esi
je 0x4097d7
push esi
push esi
push esi
push 4
push dword [eax]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [edi]
mov dword [eax + 4], ecx
test ecx, ecx
je 0x4097d7
mov eax, dword [edi]
mov eax, dword [eax + 4]
cmp dword [eax], 0x504d444d
jne 0x4097d7
mov ecx, 0xa793
cmp word [eax + 4], cx
jne 0x4097d7
inc esi
jmp 0x4097de
mov ecx, dword [edi]
call fcn.004097e4
pop edi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x40a4c5
Capabilities:
Get system information on windows

Disassembly:
push ecx
push ebx
mov ebx, edx
push ebp
push esi
mov ebp, ecx
mov esi, 0xc0000004
cmp dword [ebx], 0
je 0x40a4ed
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x18]
push dword [ebx]
push ebp
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov esi, eax
jmp 0x40a529
push edi
mov edi, 0x1000
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebx], eax
test eax, eax
je 0x40a528
lea ecx, [esp + 0x10]
push ecx
push edi
push eax
push ebp
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov esi, eax
test esi, esi
jns 0x40a51e
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_LocalFree]
add edi, edi
cmp esi, 0xc0000004
je 0x40a4f3
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x40add0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x44
or dword [esp + 0x48], 0x10
lea eax, [esp]
push ebx
push ebp
push esi
push edi
push 0x44
pop ebx
push ebx
xor edi, edi
mov ebp, edx
push edi
push eax
mov esi, ecx
call fcn.0049ee30
add esp, 0xc
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x70], edi
je 0x40ae03
mov ebx, dword [esp + 0x70]
jmp 0x40ae0f
push 0x10
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
test ebx, ebx
je 0x40aed2
push ebp
call fcn.004a6476
mov ebp, eax
pop ecx
test ebp, ebp
je 0x40aed2
sub esi, edi
je 0x40ae83
sub esi, 1
je 0x40ae69
sub esi, 1
jne 0x40aebd
push ebx
lea eax, [esp + 0x14]
push eax
push edi
push edi
push dword [esp + 0x68]
push ebp
push edi
push dword [esp + 0x7c]
push dword [esp + 0x8c]
push dword [esp + 0x8c]
push dword [esp + 0x8c]
call dword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
jmp 0x40ae9a
push ebx
lea eax, [esp + 0x14]
push eax
push edi
push edi
push dword [esp + 0x68]
push edi
push edi
push edi
push ebp
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
jmp 0x40ae9a
push ebx
lea eax, [esp + 0x14]
push eax
push edi
push edi
push dword [esp + 0x68]
push edi
push edi
push edi
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, eax
test edi, edi
je 0x40aebd
cmp dword [esp + 0x74], 0
jne 0x40aeae
cmp dword [esp + 0x70], 0
jne 0x40aecb
push dword [ebx + 4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebx]
call esi
cmp dword [esp + 0x70], 0
jne 0x40aecb
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
push ebp
call fcn.004a64d5
pop ecx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret
Function at 0x40bf95
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push ebp
mov ebp, ecx
xor ebx, ebx
push esi
push edi
mov eax, dword [ebp]
sub eax, ebx
je 0x40c01c
sub eax, 1
jne 0x40c047
push dword [esp + 0x14]
call fcn.0040be83
pop ecx
mov ecx, eax
test ecx, ecx
setne bl
test ecx, ecx
je 0x40c047
mov esi, dword [ecx + 8]
mov edx, dword [esp + 0x1c]
and esi, 0x7fffffff
test edx, edx
je 0x40bfdc
mov eax, dword [ecx + 0x10]
mov dword [edx], eax
mov edi, dword [esp + 0x24]
test edi, edi
je 0x40c047
cmp dword [esp + 0x20], 0
je 0x40c018
cmp dword [edi], esi
sbb ebx, ebx
inc ebx
cmp dword [edi], esi
jb 0x40c018
cmp dword [ecx + 8], 0
lea edx, [ecx + 0xc]
jl 0x40c00a
mov eax, dword [ebp + 4]
mov edx, dword [edx]
mov ecx, dword [eax + 8]
add ecx, 4
add edx, ecx
push esi
push edx
push dword [esp + 0x28]
call fcn.0049fa90
add esp, 0xc
mov dword [edi], esi
jmp 0x40c047
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push 0
push dword [esp + 0x24]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor ebx, ebx
test eax, eax
sete bl
test eax, eax
je 0x40c047
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret

Function at 0x40c04e
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov eax, dword [edi]
sub eax, ebx
je 0x40c0c3
sub eax, 1
jne 0x40c0e9
push dword [ebp + 8]
call fcn.0040be83
pop ecx
mov ecx, eax
test ecx, ecx
je 0x40c0e9
mov esi, dword [ecx + 8]
mov edx, esi
and edx, 0x7fffffff
cmp edx, dword [ebp + 0x18]
sbb ebx, ebx
inc ebx
cmp edx, dword [ebp + 0x18]
jb 0x40c0bf
mov eax, dword [ebp + 0x10]
and esi, 0x80000000
or esi, dword [ebp + 0x18]
mov dword [ecx + 8], esi
lea esi, [ecx + 0xc]
mov dword [ecx + 0x10], eax
jl 0x40c0b0
mov eax, dword [edi + 4]
mov esi, dword [esi]
mov ecx, dword [eax + 8]
add ecx, 4
add esi, ecx
push edx
push dword [ebp + 0x14]
push esi
call fcn.0049fa90
add esp, 0xc
jmp 0x40c0e9
push 0x32
jmp 0x40c0e3
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor ebx, ebx
test eax, eax
sete bl
test eax, eax
je 0x40c0e9
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret
Function at 0x40c0f0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov eax, dword [edi]
sub eax, ebx
je 0x40c1fe
sub eax, 1
jne 0x40c227
cmp dword [edx + 0x18], ebx
je 0x40c227
mov ecx, dword [esp + 0x14]
cmp ecx, dword [edx + 0x18]
jae 0x40c227
mov esi, dword [edx + 0x20]
cmp esi, 0xffffffff
je 0x40c227
mov eax, dword [edi + 4]
mov ebp, 0x666c
mov edi, dword [eax + 8]
add esi, edi
movzx eax, word [esi + 4]
cmp ax, bp
je 0x40c151
mov ebp, 0x686c
cmp ax, bp
jne 0x40c227
movzx eax, word [esi + 6]
test ax, ax
je 0x40c227
cmp ecx, eax
jae 0x40c227
mov ecx, dword [esi + ecx*8 + 8]
mov eax, 0x6b6e
add ecx, edi
cmp word [ecx + 4], ax
jne 0x40c227
mov edi, dword [esp + 0x18]
test edi, edi
je 0x40c227
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x40c227
test byte [ecx + 6], 0x20
movzx esi, word [ecx + 0x4c]
je 0x40c1ce
cmp esi, dword [eax]
sbb ebx, ebx
neg ebx
cmp dword [eax], esi
jbe 0x40c1f0
add ecx, 0x50
mov edx, esi
call fcn.0040f5fc
mov ebp, eax
test ebp, ebp
je 0x40c1ec
lea eax, [esi + esi]
push eax
push ebp
push edi
call fcn.0049fa90
add esp, 0xc
push ebp
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x40c1ec
shr esi, 1
cmp esi, dword [eax]
sbb ebx, ebx
neg ebx
cmp dword [eax], esi
jbe 0x40c1f0
movzx eax, word [edx + 0x4c]
push eax
lea eax, [ecx + 0x50]
push eax
push edi
call fcn.0049fa90
add esp, 0xc
mov eax, dword [esp + 0x1c]
test ebx, ebx
je 0x40c1fa
xor ecx, ecx
mov word [edi + esi*2], cx
mov dword [eax], esi
jmp 0x40c227
push ebx
push ebx
push ebx
push ebx
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
xor ebx, ebx
test eax, eax
sete bl
test eax, eax
je 0x40c227
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret
Function at 0x40c22e
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ecx
mov eax, dword [ecx]
push ebx
push ebp
xor ebx, ebx
mov dword [esp + 0xc], ecx
push esi
push edi
sub eax, ebx
je 0x40c3b3
sub eax, 1
jne 0x40c3e6
test edx, edx
jne 0x40c257
mov eax, dword [ecx + 4]
mov edx, dword [eax + 0xc]
mov eax, 0x6b6e
cmp word [edx + 4], ax
jne 0x40c3e6
cmp dword [edx + 0x28], ebx
je 0x40c3e6
mov edi, dword [esp + 0x1c]
cmp edi, dword [edx + 0x28]
jae 0x40c3e6
mov esi, dword [edx + 0x2c]
cmp esi, 0xffffffff
je 0x40c3e6
mov eax, dword [ecx + 4]
mov ecx, dword [eax + 8]
lea eax, [ecx + edi*4]
mov esi, dword [eax + esi + 4]
mov eax, 0x6b76
add esi, ecx
cmp word [esi + 4], ax
jne 0x40c3e6
cmp dword [esp + 0x20], ebx
je 0x40c3e6
mov ebp, dword [esp + 0x24]
test ebp, ebp
je 0x40c3e6
movzx eax, word [esi + 6]
mov ecx, eax
test ax, ax
je 0x40c34b
test byte [esi + 0x14], 1
mov edx, ecx
mov dword [esp + 0x10], edx
je 0x40c2e3
lea ecx, [esi + 0x18]
call fcn.0040f5fc
mov edi, eax
jmp 0x40c313
mov eax, edx
shr edx, 1
add eax, 2
mov dword [esp + 0x10], edx
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
je 0x40c3e6
movzx eax, word [esi + 6]
push eax
lea eax, [esi + 0x18]
push eax
push edi
call fcn.0049fa90
add esp, 0xc
mov eax, dword [esp + 0x10]
inc eax
test edi, edi
je 0x40c3e6
cmp dword [ebp], eax
sbb ebx, ebx
inc ebx
cmp dword [ebp], eax
jb 0x40c342
add eax, eax
push eax
push edi
push dword [esp + 0x28]
call fcn.0049fa90
mov eax, dword [esp + 0x1c]
add esp, 0xc
mov dword [ebp], eax
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x40c34e
and dword [ebp], ebx
test ebx, ebx
je 0x40c3e6
mov edi, dword [esi + 8]
mov ecx, dword [esp + 0x2c]
and edi, 0x7fffffff
test ecx, ecx
je 0x40c36c
mov eax, dword [esi + 0x10]
mov dword [ecx], eax
mov ebp, dword [esp + 0x34]
test ebp, ebp
je 0x40c3e6
cmp dword [esp + 0x30], 0
je 0x40c3ae
cmp dword [ebp], edi
sbb ebx, ebx
inc ebx
cmp dword [ebp], edi
jb 0x40c3ae
cmp dword [esi + 8], 0
lea edx, [esi + 0xc]
jl 0x40c3a0
mov eax, dword [esp + 0x14]
mov edx, dword [edx]
mov eax, dword [eax + 4]
mov ecx, dword [eax + 8]
add ecx, 4
add edx, ecx
push edi
push edx
push dword [esp + 0x38]
call fcn.0049fa90
add esp, 0xc
mov dword [ebp], edi
jmp 0x40c3e6
push dword [esp + 0x34]
push dword [esp + 0x34]
push dword [esp + 0x34]
push 0
push dword [esp + 0x34]
push dword [esp + 0x34]
push dword [esp + 0x34]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
xor ebx, ebx
test eax, eax
sete bl
test eax, eax
je 0x40c3e6
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
pop ecx
pop ecx
ret
Function at 0x40cb27
Capabilities:
Encode data using xor
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x120
push ebx
mov bh, byte [esp + 0x12c]
mov bl, dl
push ebp
push esi
push edi
mov al, bh
mov word [esp + 0x18], 0x103
add al, 5
and dword [esp + 0x10], 0
mov byte [esp + 0x1a], al
lea edi, [esp + 0x1b]
xor eax, eax
mov ebp, ecx
stosd dword es:[edi], eax
push 0x100
push 0
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [esp + 0x38]
push eax
call fcn.0049ee30
add esp, 0xc
cmp bh, 0x12
jae 0x40cd11
movzx esi, bh
lea eax, [esp + 0x1c]
push esi
push dword [esp + 0x138]
mov byte [esp + 0x23], bl
push eax
call fcn.0049fa90
lea edi, [esi + 3]
add esp, 0xc
xor dl, dl
xor cl, cl
test edi, edi
je 0x40cbaf
xor eax, eax
xor dl, byte [esp + eax + 0x19]
inc cl
movzx eax, cl
cmp eax, edi
jb 0x40cba2
push 0xc
push ebp
mov byte [esp + esi + 0x24], dl
mov byte [esp + esi + 0x25], 4
call dword [sym.imp.KERNEL32.dll_PurgeComm]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x64
call esi
push 0
lea eax, [esp + 0x18]
push eax
push 0x18
lea eax, [esp + 0x24]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40ccfe
cmp dword [esp + 0x14], 0x18
jne 0x40ccfe
push 0
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_ClearCommError]
push 0x64
call esi
push 0
lea eax, [esp + 0x18]
push eax
push 0x100
lea eax, [esp + 0x3c]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40ccf0
cmp dword [esp + 0x14], 6
jb 0x40cce5
cmp byte [esp + 0x30], 5
jne 0x40ccde
cmp byte [esp + 0x31], 1
jne 0x40ccde
mov al, byte [esp + 0x32]
cmp al, 5
jb 0x40ccd7
or bl, 0x80
cmp byte [esp + 0x33], bl
jne 0x40ccd7
sub al, 5
xor cl, cl
movzx esi, al
xor bl, bl
lea edi, [esi + 3]
test edi, edi
je 0x40cc77
xor edx, edx
xor cl, byte [esp + edx + 0x31]
inc bl
movzx edx, bl
cmp edx, edi
jb 0x40cc6a
cmp byte [esp + esi + 0x34], cl
jne 0x40cccb
cmp byte [esp + esi + 0x35], 4
jne 0x40cccb
xor ebx, ebx
inc ebx
test al, al
je 0x40cd15
mov edi, dword [esp + 0x13c]
test edi, edi
je 0x40cd15
mov ecx, dword [esp + 0x140]
test ecx, ecx
je 0x40cd15
push esi
push 0x40
mov byte [ecx], al
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [edi], eax
test eax, eax
je 0x40ccc7
push esi
lea ecx, [esp + 0x38]
push ecx
push eax
call fcn.0049fa90
add esp, 0xc
jmp 0x40cd15
xor ebx, ebx
jmp 0x40cd15
push str.ERROR_sr98_send_receive___Bad_CRC_data_n
call fcn.00409cda
jmp 0x40cd10
push str.ERROR_sr98_send_receive___Bad_data_size_ctl_code_n
jmp 0x40ccd0
push str.ERROR_sr98_send_receive___Bad_header_n
jmp 0x40ccd0
push dword [esp + 0x14]
push str.ERROR_sr98_send_receive___Read_size___u_n
jmp 0x40cd0a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_sr98_send_receive___ReadFile__0x_08x__n
jmp 0x40cd0a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_sr98_send_receive___WriteFile__0x_08x__n
call fcn.00409cda
pop ecx
pop ecx
mov ebx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x120
ret
Function at 0x40e10d
Capabilities:
Encrypt data using rc4 via systemfunction033

Disassembly:
sub esp, 0x8c
push ebx
push ebp
push esi
push edi
push 0x10
pop eax
mov edi, ecx
mov dword [esp + 0x18], eax
xor ebp, ebp
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x88]
mov dword [esp + 0x20], eax
mov ebx, dword [edi + 4]
cmp dword [0x5285c4], ebp
je 0x40e245
cmp dword [0x5285c0], ebp
je 0x40e245
cmp dword [edi], 0x14
jb 0x40e23e
test ebx, ebx
je 0x40e23e
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.cryptdll.dll_MD5Init]
push dword [0x5285c0]
mov esi, dword [sym.imp.cryptdll.dll_MD5Update]
lea eax, [esp + 0x34]
push dword [0x5285c4]
push eax
call esi
push 0x10
push ebx
lea eax, [esp + 0x38]
push eax
call esi
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.cryptdll.dll_MD5Final]
mov eax, dword [edi]
sub eax, 0x10
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], eax
lea eax, [ebx + 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_SystemFunction033]
test eax, eax
js 0x40e237
mov esi, dword [edi]
lea eax, [esp + 0x14]
push 4
push eax
sub esi, 0x14
add ebx, 0x14
push esi
mov edx, ebx
mov ecx, 0x8000
call fcn.004032e8
add esp, 0xc
test eax, eax
je 0x40e230
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
cmp eax, dword [ecx]
jne 0x40e21e
mov eax, dword [edi + 4]
push esi
mov dword [esp + 0x14], eax
call fcn.0040d4ee
mov dword [edi + 4], eax
test eax, eax
je 0x40e250
push esi
push ebx
push eax
call fcn.0049fa90
add esp, 0xc
mov dword [edi], esi
inc ebp
push dword [esp + 0x10]
call fcn.0040d4fd
jmp 0x40e250
push dword [ecx]
push eax
push str.ERROR_kull_m_rpc_drsr_ProcessGetNCChangesReply_decrypt___Checksums_dont_match__C:0x_08x___R:0x_08x__n
call fcn.00409cda
add esp, 0xc
jmp 0x40e250
push str.ERROR_kull_m_rpc_drsr_ProcessGetNCChangesReply_decrypt___Unable_to_calculate_CRC32_n
jmp 0x40e24a
push str.ERROR_kull_m_rpc_drsr_ProcessGetNCChangesReply_decrypt___RtlDecryptData2_n
jmp 0x40e24a
push str.ERROR_kull_m_rpc_drsr_ProcessGetNCChangesReply_decrypt___No_valid_data_n
jmp 0x40e24a
push str.ERROR_kull_m_rpc_drsr_ProcessGetNCChangesReply_decrypt___No_Session_Key_n
call fcn.00409cda
pop ecx
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x8c
ret