joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5cb2a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x1c]
push eax
push 0x1000
push 1
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x20]
push edx
call fcn.005a2ce9
add esp, 0x10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
ja 0x5cb335
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 0x24]
test ecx, ecx
je 0x5cb2fc
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov dword [eax + 0x14], 0x2a
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [eax]
call ecx
add esp, 4
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov dword [eax + 0x14], 0x78
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [eax + 4]
call ecx
add esp, 8
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x20]
mov byte [eax], 0xff
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x20]
mov byte [edx + 1], 0xd9
mov dword [ebp - 4], 2
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x20]
mov dword [eax], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 8]
mov byte [edx + 0x24], 0
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x5e6b30
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
test ebx, ebx
je 0x5e6bf0
push esi
mov esi, dword [esp + 0xc]
push edi
push dword [esi + 0x158]
push esi
call fcn.005e7140
mov edi, dword [esi + 0x154]
push esi
movzx ecx, byte [edi + esi + 0x16c]
movzx eax, byte [edi + esi + 0x16d]
shl ecx, 5
xor ecx, eax
movzx eax, byte [edi + esi + 0x16e]
shl ecx, 5
xor ecx, eax
imul edx, ecx, 0x9f5f
shr edx, 5
and edx, 0x3fff
movzx eax, word [esi + edx*2 + 0xd16c]
mov word [esi + edi*2 + 0x1516c], ax
movzx eax, word [esi + 0x154]
mov word [esi + edx*2 + 0xd16c], ax
mov cx, word [esi + 4]
mov eax, dword [esi + 0x154]
inc cx
mov word [esi + eax*2 + 0x2e16a], cx
inc word [esi + edx*2 + 0x47168]
mov eax, dword [esi + 0x154]
movzx ecx, word [esi + eax + 0x16c]
movzx eax, word [esi + 0x154]
mov word [esi + ecx*2 + 0x4f168], ax
call fcn.005e6db0
add esp, 0xc
dec ebx
jne 0x5e6b43
pop edi
pop esi
pop ebx
ret

Function at 0x5e7050
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [esp + 0x14]
push edi
mov ecx, dword [eax]
mov edi, dword [esp + 0x14]
sub ecx, ebx
mov dword [eax + 0x164], ecx
mov dword [eax + 0x168], edi
test ebx, ebx
je 0x5e7130
lea ecx, [edi + 0x170b5]
lea ecx, [eax + ecx*2]
push ebp
mov dword [esp + 0x1c], ecx
lea edx, [eax + 0x16c]
push esi
lea esi, [eax + 0x16e]
mov ecx, eax
sub ecx, esi
lea ebp, [edx + edi]
add ecx, 0x16d
sub esi, edx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x1c], esi
lea esp, [esp]
lea edx, [esi + ebp]
movzx esi, byte [edx + ecx]
lea ebp, [ebp + 1]
movzx ecx, byte [ebp - 1]
shl ecx, 5
xor esi, ecx
movzx ecx, byte [edx]
mov edx, dword [esp + 0x20]
shl esi, 5
xor esi, ecx
imul esi, esi, 0x9f5f
shr esi, 5
and esi, 0x3fff
movzx ecx, word [eax + esi*2 + 0xd16c]
mov word [edx - 0x18ffe], cx
movzx edx, di
inc edi
mov word [eax + esi*2 + 0xd16c], dx
movzx ecx, word [eax + 4]
mov eax, dword [esp + 0x20]
inc cx
add dword [esp + 0x20], 2
mov word [eax], cx
mov eax, dword [esp + 0x18]
inc word [eax + esi*2 + 0x47168]
movzx ecx, word [ebp - 1]
mov esi, dword [esp + 0x1c]
mov word [eax + ecx*2 + 0x4f168], dx
mov ecx, dword [esp + 0x10]
dec ebx
jne 0x5e70b0
pop esi
pop ebp
pop edi
pop ebx
pop ecx
ret
Function at 0x4047ba
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x4047c9
pop dword [ebp - 0x18]
mov eax, 0x11e31a81
add eax, 0xee5d2d48
sub dword [ebp - 0x18], eax
push 0x40
push 0x1000
push 0x41293
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x18]
call dword [eax]
mov ecx, 0x7ff11f5
add ecx, 0xf8014386
xor edi, edi
add edi, eax
mov esi, 0xfdf1d768
add esi, 0x2517c98
add esi, dword [ebp - 0x18]
mov ebx, 0xbee3eb0a
sub ebx, 0x16e56389
xor dword [ebp - 0x14], esi
mov edx, dword [esi]
xor dword [ebp - 0x14], ebx
sub edx, ebx
mov dword [ebp - 4], 0xe6390526
mov dword [edi], edx
sub dword [ebp - 8], edi
add edi, 4
add esi, 0xea2bb175
sub esi, 0xea2bb171
loop 0x404825
add eax, 0x148bf
mov ebx, eax
add eax, 0xe77901ba
add eax, 0x1886fe4b
mov ecx, 0x400000
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x407875
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42f180]
jne 0x40787f
repz ret
jmp fcn.0040bbd7
Function at 0x40bf93
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40c030
push ebx
push esi
call fcn.0040bf5c
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040bef0
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40bfdd
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40c02f
push edi
push eax
call fcn.0040cbb0
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40bffd
call fcn.0040aa51
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40c02e
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040bef0
add esp, 0x20
test eax, eax
jne 0x40c01c
push edi
call fcn.0040aa51
jmp 0x40c024
push ebx
call fcn.0040aa51
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x40d32d
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x44a608
push 0x44a600
push str.FlsAlloc
push 0x1f
call fcn.0040d1ec
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40d361
push dword [ebp + 8]
mov ecx, esi
call dword [0x416174]
call esi
jmp 0x40d367
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40d3ab
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x44a618
push 0x44a610
push str.FlsGetValue
push 0x21
call fcn.0040d1ec
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40d3e2
push dword [ebp + 8]
mov ecx, esi
call dword [0x416174]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x40d3ea
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x44a620
push 0x44a618
push str.FlsSetValue
push 0x22
call fcn.0040d1ec
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40d424
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x416174]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x100284a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x100a020]
cmp eax, 0xffffffff
je 0x1002905
push ebx
push esi
xor ebx, ebx
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
lea eax, [ebp - 4]
push eax
mov esi, 0x314
push esi
push 0x100a5a0
push dword [0x100a020]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10028f9
cmp dword [ebp - 4], esi
jne 0x10028f9
cmp dword [0x100a5a0], 0x6e776453
jne 0x10028f9
test dword [0x100a5a8], 0x80000000
jne 0x1002903
or dword [0x100a5a8], 0x40000000
push 0x100a7b0
push 0x103
push 0x100a9e0
mov byte [0x100a7af], bl
mov byte [0x100a8b3], bl
call dword [sym.imp.msvcrt.dll__snprintf]
add esp, 0xc
cmp dword [0x100a5a4], 0x10000
jne 0x1002903
test dword [0x100a5a8], 0x3fffffec
jne 0x1002903
and dword [0x100a5a8], 0xbfffffff
jmp 0x1002903
or dword [0x100a5a8], 0x80000000
pop esi
pop ebx
leave
ret

Function at 0x1002cf7
Capabilities:
Check if file exists
Delete directory
Delete file
Move file

Disassembly:
push ebx
push esi
push edi
push 0x100ad40
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x100a184]
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x1002d1e
push eax
call esi
and dword [0x100a184], 0
mov eax, dword [0x100a020]
cmp eax, 0xffffffff
je 0x1002d32
push eax
call esi
or dword [0x100a020], 0xffffffff
mov esi, dword [0x100a004]
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov edi, 0x100a004
jmp 0x1002d76
mov eax, dword [esi + 4]
test eax, eax
je 0x1002d74
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x1002d70
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x1002d70
cmp eax, 3
je 0x1002d70
push 4
push 0
push dword [esi + 4]
call ebx
and dword [esi + 4], 0
mov esi, dword [esi]
cmp esi, edi
jne 0x1002d45
mov esi, dword [0x100a00c]
mov edi, 0x100a00c
jmp 0x1002db8
mov eax, dword [esi + 4]
test eax, eax
je 0x1002db6
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x1002db2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x1002db2
cmp eax, 3
je 0x1002db2
push 4
push 0
push dword [esi + 4]
call ebx
and dword [esi + 4], 0
mov esi, dword [esi]
cmp esi, edi
jne 0x1002d87
push 0x100ad40
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
ret

Function at 0x1003b2a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call [ecx + 0x50]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0100324c
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
invalid
invalid
invalid
stc
Function at 0x10046ae
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 5
jge 0x10046dd
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
movsx ecx, byte [ebp - 0x24]
fdiv qword [ebx]
ror dword [ebx - 0x6ff73], 0xff
fdiv qword [ebx]
ror dword [ebx - 0x6ff73], 0xff
mov byte [ebp + ecx - 0x394], al
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0x1004687
call fcn.01003287
imul ebx, dword [eax - 0x5a7fcbf7], 0xfffff8d4
add byte [eax - 0x72a5b], al
inc dword [eax]
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.01003287
nop
movsb byte es:[edi], byte [esi]
out 0xf8, eax
lea eax, [ebp - 0x72c]
push eax
call fcn.01003297
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0100324c
add esp, 0xc
mov dword [ebp - 0x6e4], eax
call fcn.01003287
imul ecx, ebp, 0x858d0170
call 0x5200479e
push 0x40
push 5
push dword [ebp - 0x3a8]
call dword [ebp - 0x6e4]
push 5
lea eax, [ebp - 0x394]
push eax
push dword [ebp - 0x3a8]
call fcn.010031f8
add esp, 0xc
lea eax, [ebp - 0x718]
push eax
push dword [ebp - 0x718]
push 5
push dword [ebp - 0x3a8]
call dword [ebp - 0x6e4]
call fcn.01003287
jb 0x1004844
jecxz 0x1004824
and dword [ebp - 0x700], 0
jmp 0x1004807
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 5
jge 0x1004820
mov eax, dword [ebp - 0x700]
and byte [ebp + eax - 0x394], 0
jmp 0x10047fa
push 4
mov eax, dword [ebp - 0x378]
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax - 0x18]
push eax
lea eax, [ebp - 0x540]
push eax
call fcn.010031f8
add esp, 0xc
movsx eax, byte [ebp - 8]
mov ecx, dword [ebp - 0x540]
sub ecx, eax
mov dword [ebp - 0x540], ecx
push 4
mov eax, dword [ebp - 0x378]
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.010031f8
add esp, 0xc
movsx eax, byte [ebp - 8]
mov ecx, dword [ebp - 0xc]
sub ecx, eax
mov dword [ebp - 0xc], ecx
push 4
mov eax, dword [ebp - 0x378]
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax - 0x10]
push eax
lea eax, [ebp - 0x400]
push eax
call fcn.010031f8
add esp, 0xc
movsx eax, byte [ebp - 8]
mov ecx, dword [ebp - 0x400]
sub ecx, eax
mov dword [ebp - 0x400], ecx
call fcn.01003287
sbb eax, 0x6abcc3af
add al, 0x8b
test dword [eax - 0x74000004], ecx
dec ebp
cld
lea eax, [ecx + eax - 0xc]
push eax
lea eax, [ebp - 0x54c]
push eax
call fcn.010031f8
add esp, 0xc
movsx eax, byte [ebp - 8]
mov ecx, dword [ebp - 0x54c]
sub ecx, eax
mov dword [ebp - 0x54c], ecx
call fcn.01003287
xor dh, dh
lds esp, [edx + ebp*2 - 0x777a74fc]
cld
invalid
mov ah, bh
invalid
invalid
Function at 0x404a1d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x407360
cmp edx, dword [eax]
je 0x404a3f
add eax, 8
inc ecx
cmp eax, 0x4073f0
jl 0x404a30
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x407360]
jne 0x404b6d
mov eax, dword [0x40770c]
cmp eax, 1
je 0x404b47
test eax, eax
jne 0x404a70
cmp dword [0x4072b0], 1
je 0x404b47
cmp edx, 0xfc
je 0x404b6d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x404aa7
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004052d0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00405440
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x404aea
lea eax, [ebp - 0x1a4]
push eax
call fcn.00405440
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x406398
push edi
call fcn.00405880
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004052d0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004052e0
lea eax, [ebp - 0xa0]
push 0x406378
push eax
call fcn.004052e0
push dword [esi + 0x407364]
lea eax, [ebp - 0xa0]
push eax
call fcn.004052e0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004057f5
add esp, 0x2c
pop edi
jmp 0x404b6d
lea eax, [ebp + 8]
lea esi, [esi + 0x407364]
push 0
push eax
push dword [esi]
call fcn.00405440
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x401000
Capabilities:
Parse pe header

Disassembly:
mov eax, dword [esp + 4]
cmp word [eax], 0x5a4d
jne 0x40104e
mov ecx, dword [eax + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x40104e
mov ecx, dword [esp + 8]
mov dword [ecx], eax
mov edx, dword [eax]
cmp edx, 0x4550
jne 0x40104e
mov edx, dword [esp + 0xc]
add eax, 4
mov dword [ecx], eax
add eax, 0x14
mov dword [edx], eax
cmp word [eax], 0x10b
jne 0x40104e
mov ecx, dword [esp + 0x10]
add eax, 0xe0
mov dword [ecx], eax
mov eax, 1
ret
xor eax, eax
ret

Function at 0x401150
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [0x405020]
sub esp, 8
mov ecx, dword [eax + 0x3c]
push ebx
push ebp
push esi
mov ecx, dword [ecx + eax + 0x78]
push edi
add ecx, eax
xor esi, esi
mov edx, dword [ecx + 0x20]
mov edi, dword [ecx + 0x18]
add edx, eax
test edi, edi
jbe 0x4011ee
mov ebp, edx
mov edi, dword [ebp]
add edi, eax
cmp byte [edi], 0x4e
jne 0x4011bc
cmp byte [edi + 1], 0x74
jne 0x4011bc
mov edx, dword [ecx + 0x24]
xor ebx, ebx
lea edx, [edx + esi*2]
mov bx, word [edx + eax]
mov edx, dword [ecx + 0x1c]
lea edx, [edx + ebx*4]
mov edx, dword [edx + eax]
add edx, eax
mov ebx, dword [edx]
mov dword [esp + 0x10], ebx
mov dl, byte [edx + 4]
mov byte [esp + 0x14], dl
mov dl, bl
cmp dl, 0xb8
jne 0x4011bc
mov edx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x11]
cmp edx, ebx
je 0x4011cf
mov edx, dword [ecx + 0x18]
inc esi
add ebp, 4
cmp esi, edx
jb 0x401175
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x20]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x401200
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x74
mov edx, dword [0x40502c]
push ebx
push ebp
push esi
mov eax, dword [edx + 0x3c]
push edi
mov dword [esp + 0x14], 0
mov ebx, dword [eax + edx + 0x78]
mov eax, dword [ebx + edx + 0x20]
add ebx, edx
add eax, edx
mov dword [esp + 0x18], ebx
mov ecx, dword [ebx + 0x18]
test ecx, ecx
mov dword [esp + 0x1c], ecx
jbe 0x4012d2
mov ebp, dword [esp + 0x88]
mov dword [esp + 0x10], eax
jmp 0x401248
mov ebx, dword [esp + 0x18]
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x10]
mov edi, ebp
not ecx
mov esi, dword [eax]
dec ecx
add esi, edx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x4012dd
mov eax, dword [0x405028]
xor ebx, ebx
test eax, eax
jbe 0x4012b2
mov ecx, 0x19
xor eax, eax
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x20]
push ecx
push ebx
call fcn.00401150
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ebp
lea esi, [esp + 0x20]
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x401306
mov eax, dword [0x405028]
inc ebx
cmp ebx, eax
jb 0x40126f
mov edx, dword [0x40502c]
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
inc eax
add esi, 4
cmp eax, ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], esi
jb 0x401244
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x74
ret
mov eax, dword [ebx + 0x24]
mov ecx, dword [esp + 0x14]
pop edi
pop esi
lea eax, [eax + ecx*2]
xor ecx, ecx
pop ebp
mov cx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
pop ebx
lea ecx, [eax + ecx*4]
mov eax, dword [ecx + edx]
mov ecx, dword [0x405038]
add eax, ecx
add esp, 0x74
ret
mov edx, dword [0x405024]
mov ecx, dword [0x40502c]
pop edi
pop esi
lea eax, [edx + ebx*4]
pop ebp
pop ebx
mov eax, dword [eax + ecx]
add esp, 0x74
ret
Function at 0x4018b0
Capabilities:
Get common file path
Move file
Persist via appinit_dlls registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30c
push ebx
push esi
push edi
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [ebp - 0x30b]
mov byte [ebp - 0x30c], 0
mov byte [ebp - 0x104], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [ebp - 0x103]
mov byte [ebp - 0x208], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [ebp - 0x207]
push 0x40531c
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x405310
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov ebx, eax
lea eax, [ebp - 0x104]
push 0x104
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
lea edi, [ebp - 0x104]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x208]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [ebp - 0x208]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x405304
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [ebp - 0x104]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4052f4
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [ebp - 0x104]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call ebx
test eax, eax
je 0x401a0e
push 2
call fcn.00402190
add esp, 4
lea ecx, [ebp - 0x104]
lea edx, [ebp - 0x30c]
push eax
push ecx
push 0x4052e8
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
nop
nop
pushal
popal
nop
lea eax, [ebp - 0x30c]
push 3
lea ecx, [ebp - 0x104]
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_MoveFileExA]
lea edx, [ebp - 0x104]
push edx
push 0x68
push 0x405200
push 0
call fcn.00402000
push 1
push 0x4052d4
push 0x40529c
push 0x80000002
call fcn.00405a20
lea eax, [ebp - 0x104]
push eax
call fcn.00405ce0
add esp, 0x24
nop
nop
pushal
popal
nop
lea ecx, [ebp - 0x208]
push 0x405010
push ecx
call fcn.00402110
add esp, 8
test eax, eax
je 0x401a9f
nop
nop
pushal
popal
nop
mov eax, dword [0x405010]
mov ecx, dword [0x405014]
sub esp, 0x10
mov edx, esp
mov dword [edx], eax
mov eax, dword [0x405018]
mov dword [edx + 4], ecx
mov ecx, dword [0x40501c]
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
lea edx, [ebp - 0x104]
push edx
call fcn.00402080
add esp, 0x14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401ab0
Capabilities:
Disable system features via registry on windows
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
nop
nop
pushal
popal
nop
lea eax, [ebp - 4]
xor esi, esi
push eax
push 0x40536c
push 0x80000002
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov edx, dword [ebp - 4]
lea ecx, [ebp - 8]
push 4
push ecx
push 4
push esi
push 0x405350
push edx
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
nop
nop
pushal
popal
nop
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push 4
push eax
push 4
push 0
push 0x405344
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
nop
nop
pushal
popal
nop
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push 4
push edx
push 4
push 0
push 0x40532c
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
nop
pushal
popal
nop
call fcn.004018b0
call fcn.00402870
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401b50
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push ebx
push esi
push edi
nop
nop
pushal
popal
nop
nop
nop
pushal
popal
nop
mov dword [ebp - 0x94], 0x94
nop
nop
pushal
popal
nop
lea eax, [ebp - 0x94]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
nop
nop
pushal
popal
nop
cmp dword [ebp - 0x84], 3
jae 0x401ba5
cmp dword [ebp - 0x90], 5
jne 0x401ba5
call fcn.00401830
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
nop
nop
pushal
popal
nop
call fcn.00402410
call fcn.00401ab0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402000
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
and ecx, 0xffff
push eax
push ecx
push edi
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
mov esi, eax
test esi, esi
je 0x402075
mov ebp, dword [sym.imp.KERNEL32.DLL_SizeofResource]
push esi
push edi
call ebp
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x402075
mov edx, dword [esp + 0x20]
push 0x4053a8
push edx
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.DLL_LockResource]
push edi
push esi
push 0
mov ebx, eax
call ebp
push eax
push 1
push ebx
call dword [sym.imp.MSVCRT.dll_fwrite]
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
ret