joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d332
Capabilities:
Read file on windows

Disassembly:
test byte [esi], 4
push ebx
je 0x40d362
mov ebx, dword [edi]
push 0
push edi
push ebx
push dword [esp + 0x14]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x40d388
and dword [edi], eax
push 1
push eax
push ebx
push dword [esi + 4]
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
xor al, al
jmp 0x40d38a
push dword [esi + 4]
push dword [edi]
push 1
push dword [esp + 0x14]
call fcn.00452f60
mov dword [edi], eax
push dword [esi + 4]
call fcn.00452776
add esp, 0x14
test eax, eax
je 0x40d388
and dword [edi], 0
jmp 0x40d35e
mov al, 1
pop ebx
ret 4

Function at 0x40d6d9
Capabilities:
Read file on windows

Disassembly:
push edi
mov edi, dword [esi + 0x58]
cmp dword [esi + 0x5c], edi
jne 0x40d758
cmp edi, 4
jle 0x40d6ea
push 4
pop edi
push 4
pop eax
sub eax, edi
push eax
lea eax, [edi + esi + 0x10]
push eax
lea eax, [esi + 0x10]
push eax
call fcn.00453170
mov eax, dword [esi + 0x58]
sub eax, edi
lea eax, [eax + esi + 0x14]
push edi
push eax
mov eax, esi
sub eax, edi
add eax, 0x14
push eax
call fcn.0044fd10
push dword [esi + 4]
lea eax, [esi + 0x14]
push pe_nt_image_headers32
push 1
push eax
mov dword [esi + 0x54], edi
call fcn.00452f60
and dword [esi + 0x5c], 0
add esp, 0x28
test eax, eax
mov dword [esi + 0x58], eax
jne 0x40d758
push dword [esi + 4]
call fcn.00452747
test eax, eax
pop ecx
jne 0x40d753
push dword [esi + 4]
call fcn.00452776
test eax, eax
pop ecx
jne 0x40d753
pop edi
ret
or eax, 0xffffffff
pop edi
ret
mov ecx, dword [esi + 0x5c]
movzx eax, byte [ecx + esi + 0x14]
inc ecx
mov dword [esi + 0x5c], ecx
pop edi
ret

Function at 0x40d871
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x14]
push edi
add eax, eax
mov dword [ebp + 0x14], eax
lea eax, [ebp - 4]
push eax
push 1
xor edi, edi
push edi
push dword [ebp + 0xc]
mov word [esi], di
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40d8be
lea eax, [ebp + 0x14]
push eax
push esi
push edi
push edi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp + 0x14], edi
je 0x40d8b5
shr dword [ebp + 0x14], 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
leave
ret

Function at 0x40d8c1
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
xor esi, esi
push esi
push esi
push 0x10
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_PostMessageW]
lea eax, [ebp - 8]
push eax
push 0x1f4
push 2
push esi
push esi
push 0x10
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
test eax, eax
jne 0x40d921
push edi
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp - 4]
push esi
push 0x1f0fff
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov edi, eax
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
leave
ret
Function at 0x40eccd
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
push dword [ebp + 8]
lea eax, [ebp - 0x22c]
call fcn.0040e1cb
pop ecx
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40ecfb
test al, 0x10
jne 0x40ecff
xor al, al
leave
ret
push ebx
xor ebx, ebx
cmp byte [ebp + 0xc], bl
lea eax, [ebp - 0x22c]
push eax
jne 0x40ed1b
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
test eax, eax
setne al
jmp 0x40ed5e
call fcn.0045177a
mov word [ebp + eax*2 - 0x22a], bx
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x18], eax
pop ecx
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xa], ebx
mov dword [ebp - 6], ebx
mov dword [ebp - 0xe], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], 3
mov word [ebp - 0x10], 0x614
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
neg eax
sbb al, al
inc al
pop ebx
leave
ret

Function at 0x40ee2c
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a0
push esi
mov esi, eax
lea eax, [ebp - 0x29c]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
test eax, eax
jne 0x40eeec
push 0x100
lea eax, [ebp - 0x10c]
push eax
call sub.WSOCK32.dll_gethostname
lea eax, [ebp - 0x10c]
push eax
call sub.WSOCK32.dll_gethostbyname
test eax, eax
je 0x40eeec
mov eax, dword [eax + 0xc]
xor edx, edx
cmp dword [eax], edx
je 0x40ee86
mov ecx, eax
add ecx, 4
inc edx
cmp dword [ecx], 0
jne 0x40ee7d
cmp esi, edx
jle 0x40ee9b
push str.0.0.0.0
push dword [ebp + 8]
call fcn.0044f86d
pop ecx
pop ecx
jmp 0x40eee5
push 4
push dword [eax + esi*4 - 4]
lea eax, [ebp - 8]
push eax
call fcn.0044fd10
add esp, 0xc
push dword [ebp - 8]
call sub.WSOCK32.dll_inet_ntoa
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.00451f70
lea eax, [ebp - 0x10c]
push eax
or eax, 0xffffffff
call fcn.0040fbdc
mov esi, eax
push esi
push dword [ebp + 8]
call fcn.0044f86d
push esi
call fcn.0044f951
add esp, 0x18
call sub.WSOCK32.dll_WSACleanup
jmp 0x40eefb
push 0x46bf80
push dword [ebp + 8]
call fcn.0044f86d
pop ecx
pop ecx
pop esi
leave
ret
Function at 0x432562
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
push str.open
lea esi, [ebp - 0x18]
mov edi, eax
call fcn.0040ffd4
xor ebx, ebx
push 0x3c
lea eax, [ebp - 0x54]
push ebx
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], 1
call fcn.00451700
add esp, 0xc
cmp dword [ebp + 0x10], 2
jb 0x4325c3
mov eax, dword [edi + 4]
mov esi, dword [eax + 4]
call fcn.00412336
cmp word [eax], bx
je 0x4325c3
mov eax, dword [edi + 4]
mov esi, dword [eax + 4]
call fcn.00412336
push eax
call fcn.0040f3a1
pop ecx
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], 3
jb 0x4325de
mov eax, dword [edi + 4]
mov esi, dword [eax + 8]
call fcn.00412336
push eax
call fcn.0040f3a1
pop ecx
mov dword [ebp - 8], eax
cmp dword [ebp + 0x10], 4
jb 0x43260b
mov eax, dword [edi + 4]
mov esi, dword [eax + 0xc]
call fcn.00412336
cmp word [eax], bx
je 0x43260b
mov eax, dword [edi + 4]
mov esi, dword [eax + 0xc]
call fcn.00412358
mov ebx, eax
lea eax, [ebp - 0x18]
call fcn.00410163
xor ebx, ebx
cmp dword [ebp + 0x10], 5
jb 0x432622
mov eax, dword [edi + 4]
mov eax, dword [eax + 0x10]
call fcn.00412431
movzx eax, ax
mov dword [ebp - 0xc], eax
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x54]
push ebx
push eax
call fcn.00451700
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x48], eax
mov eax, dword [edi + 4]
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x50], pe_nt_image_headers32
mov dword [ebp - 0x4c], ebx
mov esi, dword [eax]
add esp, 0xc
call fcn.00412336
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x54]
push eax
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x3c], edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp esi, ebx
mov dword [ebp + 0x10], eax
je 0x43267d
push esi
call fcn.0044f951
pop ecx
cmp edi, ebx
je 0x432688
push edi
call fcn.0044f951
pop ecx
cmp dword [ebp + 0x10], ebx
jne 0x4326a3
mov eax, dword [ebp + 8]
push ebx
push 1
call fcn.0041c783
mov esi, dword [ebp + 0x14]
push ebx
call fcn.00412914
jmp 0x4326ce
cmp byte [ebp + 0xc], bl
je 0x4326b6
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x554], eax
jmp 0x4326ce
mov esi, dword [ebp + 0x14]
push 1
call fcn.00412914
cmp dword [ebp - 0x1c], ebx
je 0x4326ce
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push dword [ebp - 0x18]
call fcn.0044f951
pop ecx
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10
Function at 0x435d52
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x214
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push edi
xor ebx, ebx
lea eax, [esp + 0x18]
push eax
push ebx
push ebx
push ebx
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x34]
push eax
push ebx
push dword [ebp + 8]
mov dword [esp + 0x30], 0xff
call esi
mov edi, 0x103
jmp 0x435e0d
xor eax, eax
cmp byte [0x48a300], bl
je 0x435d9f
mov eax, 0x100
lea ecx, [esp + 0x14]
push ecx
or eax, 0x20019
push eax
push ebx
lea eax, [esp + 0x2c]
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x435e19
push dword [esp + 0x14]
call fcn.00435d52
pop ecx
push dword [esp + 0x14]
mov byte [esp + 0x13], al
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [esp + 0xf], bl
je 0x435e19
lea eax, [esp + 0x20]
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x435e19
lea eax, [esp + 0x18]
push eax
push ebx
push ebx
push ebx
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x34]
push eax
push ebx
push dword [ebp + 8]
mov dword [esp + 0x30], 0xff
call esi
cmp eax, edi
jne 0x435d90
mov al, 1
jmp 0x435e1b
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43bbdd
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
push 0x44
xor ebx, ebx
push ebx
mov edi, 0x48b8d8
push edi
call fcn.00451700
push 0x10
push ebx
mov esi, 0x48b8c8
push esi
call fcn.00451700
add esp, 0x18
push esi
push edi
push ebx
push ebx
push 0x20
push ebx
push ebx
push ebx
push dword [esp + 0x30]
xor eax, eax
inc eax
push ebx
mov dword [0x48b8d8], 0x44
mov dword [0x48b904], eax
mov word [0x48b908], ax
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
test eax, eax
pop edi
pop esi
pop ebx
je 0x43bc40
push dword [0x48b8c8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
ret 4
Function at 0x461037
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x476dec]
jne 0x461041
repz ret
jmp fcn.00464809

Function at 0x461558
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00455898
xor ebx, ebx
cmp dword [0x479228], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x46162e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x46170e
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x46170e
push eax
call fcn.0045582a
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x479228], eax
call esi
push eax
call fcn.0045582a
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x47922c], eax
call esi
push eax
call fcn.0045582a
mov dword [0x479230], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0044fa96
test eax, eax
pop ecx
pop ecx
je 0x4615fc
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00455e21
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x46162e
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0045582a
cmp eax, ebx
pop ecx
mov dword [0x479238], eax
je 0x46162e
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0045582a
pop ecx
mov dword [0x479234], eax
mov eax, dword [0x479234]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x4616b3
cmp dword [0x479238], ecx
je 0x4616b3
push eax
call fcn.004558a1
push dword [0x479238]
mov esi, eax
call fcn.004558a1
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x4616b3
cmp edi, ebx
je 0x4616b3
call esi
cmp eax, ebx
je 0x461680
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x461680
test byte [ebp - 0x18], 1
jne 0x4616b3
lea eax, [ebp - 0x10]
push eax
call fcn.0044facd
test eax, eax
pop ecx
je 0x46169b
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00455e21
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x4616aa
or dword [ebp + 0x10], 0x200000
jmp 0x4616ee
or dword [ebp + 0x10], 0x40000
jmp 0x4616ee
mov eax, dword [0x47922c]
cmp eax, dword [ebp - 8]
je 0x4616ee
push eax
call fcn.004558a1
cmp eax, ebx
pop ecx
je 0x4616ee
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4616ee
mov eax, dword [0x479230]
cmp eax, dword [ebp - 8]
je 0x4616ee
push eax
call fcn.004558a1
cmp eax, ebx
pop ecx
je 0x4616ee
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x479228]
call fcn.004558a1
cmp eax, ebx
pop ecx
je 0x46170e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x461710
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40333c
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x410aa0
call fcn.00406024
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x40323d
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x40323d
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x40323d
cmp dword [eax + 0x400074], 0xe
jbe 0x40323d
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x403241
and dword [ebp - 0x1c], 0
push 1
call main
pop ecx
test eax, eax
jne 0x403255
push 0x1c
call main
pop ecx
call fcn.00407199
test eax, eax
jne 0x403266
push 0x10
call main
pop ecx
call fcn.00406d3d
and dword [ebp - 4], 0
call fcn.00403bed
test eax, eax
jge 0x403280
push 0x1b
call main
pop ecx
call sub.kernel32.dll_GetCommandLineW
mov dword [0x413d00], eax
call fcn.00406ce0
mov dword [0x412ff8], eax
call main
test eax, eax
jge 0x4032a5
push 8
call main
pop ecx
call fcn.00406a03
test eax, eax
jge 0x4032b6
push 9
call main
pop ecx
push 1
call main
pop ecx
test eax, eax
je 0x4032c9
push eax
call main
pop ecx
mov eax, dword [0x413340]
mov dword [0x413344], eax
push eax
push dword [0x413334]
push dword [0x41332c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4032f7
push eax
call main
call fcn.0040428b
jmp 0x40332c
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.00406069
ret
call main
jmp 0x4031eb

Function at 0x40c75f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x40c76e
pop dword [ebp - 0x30]
mov eax, 0x73e3afb3
sub eax, 0x73a2e845
sub dword [ebp - 0x30], eax
push 0x40
push 0x1000
push 0x3b21e
push 0
mov eax, 0xc61f9ff3
sub eax, 0xc5debed3
add eax, dword [ebp - 0x30]
call dword [eax]
mov ecx, 0xec344cf
sub ecx, 0xec2f5af
mov esi, eax
mov edx, 0x417800
add edx, dword [ebp - 0x30]
mov ebx, 0x4201c723
add ebx, 0xc440212d
mov edi, dword [edx]
xor dword [ebp - 0x2c], eax
sub edi, ebx
add dword [ebp - 0x14], edx
mov dword [esi], edi
sub dword [ebp - 0x10], 0x2c62d2d4
add esi, 0x7c00bea6
sub esi, 0x7c00bea2
add edx, 4
loop 0x40c7c7
add eax, 0xff207e87
add eax, 0xe0b0cc
mov ebx, eax
add eax, 0x48cebfdd
add eax, 0xb7314028
mov ecx, 0x400000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x40610d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x40611c
pop dword [ebp - 0x1c]
mov eax, 0x5f9a394
sub eax, 0x5b94278
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xe32897a5
add dword [ebp - 0x2c], 0x6b29ada6
mov dword [ebp - 0x28], 0x228a5155
add dword [ebp - 0x28], 0xfa8faf0
mov dword [ebp - 0x24], 0xbc464db8
sub dword [ebp - 0x24], 0x6ffa098a
mov dword [ebp - 0x20], 0xeb908e46
sub dword [ebp - 0x20], 0xeb908e46
lea eax, [ebp - 0x2c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x6992a105
sub dword [ebp - 0x2c], 0xf52037af
mov dword [ebp - 0x28], 0xf2264edd
add dword [ebp - 0x28], 0x4f461298
mov dword [ebp - 0x24], 0x83a0e072
sub dword [ebp - 0x24], 0x20317406
mov dword [ebp - 0x20], 0x24536d39
sub dword [ebp - 0x20], 0x24536d39
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0x75722c03
sub eax, 0x7531bb03
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x380ab
push 0
call eax
mov ecx, 0x4dbc
mov ebx, eax
mov edi, 0x6e1ff21c
add edi, 0x92210de4
add edi, dword [ebp - 0x1c]
mov edx, 0x708ef16c
add edx, 0x2aeb4075
add dword [ebp - 0x14], ebx
mov esi, dword [edi]
add dword [ebp - 0x14], 0x8d2cbf7d
xor esi, edx
mov dword [ebp - 0x18], 0x5db6b93d
mov dword [ebx], esi
add ebx, 0x76661819
sub ebx, 0x76661815
add edi, 0x88afac19
sub edi, 0x88afac15
loop 0x406233
add eax, 0xe3b8e3a8
add eax, 0x1c48461b
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x4012ef
Capabilities:
Check if file exists
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4111e0
push 0x40fc8a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ecx
sub esp, 0x828
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
and dword [ebp - 0x20], 0
or dword [ebp - 0x24], 0xffffffff
and dword [ebp - 0x1c], 0
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jne 0x4013a5
cmp dword [ebp + 0x14], 0
je 0x4013a5
push 0x800
push 0
lea eax, [ebp - 0x840]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x400
lea eax, [ebp - 0x840]
push eax
push 0xffffffffffffffff
push dword [ebp + 8]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
and dword [ebp - 4], 0
push 0xffffffffffffffff
lea eax, [ebp - 0x840]
push eax
push 0
push 0x4013a5
mov edi, edi
push ebp
mov eax, dword [ebp + 0x14]
add eax, 3
jmp eax
push 0
push 0
push 4
push 0
push 0
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffff
jne 0x4013cd
xor eax, eax
jmp 0x40147d
cmp dword [ebp - 0x20], 0
jne 0x401407
mov dword [ebp - 0x3c], 0x1ec61500
mov dword [ebp - 0x38], 0x1c479c6
push 8
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x34]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 8
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x2c]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
jmp 0x401415
push 0
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x24]
call fcn.00402db5
push 0
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40144a
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x20], 0
jne 0x401446
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
jmp 0x40147d
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push 1
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x24]
call fcn.00402db5
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x4013a5
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4111e0
push 0x40fc8a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ecx
sub esp, 0x828
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
and dword [ebp - 0x20], 0
or dword [ebp - 0x24], 0xffffffff
and dword [ebp - 0x1c], 0
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jne 0x4013a5
cmp dword [ebp + 0x14], 0
je 0x4013a5
push 0x800
push 0
lea eax, [ebp - 0x840]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x400
lea eax, [ebp - 0x840]
push eax
push 0xffffffffffffffff
push dword [ebp + 8]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
and dword [ebp - 4], 0
push 0xffffffffffffffff
lea eax, [ebp - 0x840]
push eax
push 0
push 0x4013a5
mov edi, edi
push ebp
mov eax, dword [ebp + 0x14]
add eax, 3
jmp eax
push 0
push 0
push 4
push 0
push 0
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffff
jne 0x4013cd
xor eax, eax
jmp 0x40147d
cmp dword [ebp - 0x20], 0
jne 0x401407
mov dword [ebp - 0x3c], 0x1ec61500
mov dword [ebp - 0x38], 0x1c479c6
push 8
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x34]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 8
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x2c]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
jmp 0x401415
push 0
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x24]
call fcn.00402db5
push 0
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40144a
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x20], 0
jne 0x401446
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
jmp 0x40147d
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push 1
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x24]
call fcn.00402db5
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x40148e
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
and dword [ebp - 0x40c], 0
and dword [ebp - 4], 0
and dword [ebp - 8], 0
push dword [ebp + 8]
push dword [0x413ce0]
push 0x4103c4
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x40c]
push eax
push 0x2001f
push 0
lea eax, [ebp - 0x408]
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, dword [ebp - 0x40c]
mov dword [ebp - 8], eax
cmp dword [ebp + 0xc], 0
je 0x401527
and dword [ebp - 0x410], 0
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp - 0x40c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push dword [ebp + 0x14]
push 2
push 0
push dword [ebp + 0x10]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x40c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], 0
je 0x40155f
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret 0x10