joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e735
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov edx, dword [0x4a9450]
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], edx
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x70]
cmp eax, 2
mov dword [ebp - 8], ecx
jne 0x40e78b
cmp byte [esi + 2], bl
je 0x40e78b
lea eax, [ebp + 8]
push ecx
push eax
call fcn.00473039
pop ecx
pop ecx
push eax
lea ecx, [ebp - 4]
call fcn.004065e8
lea ecx, [ebp + 8]
call fcn.00401085
mov eax, dword [ebp - 4]
push 1
mov dword [ebp - 8], eax
pop eax
mov ecx, dword [ebp - 8]
sub eax, ebx
je 0x40e7ca
dec eax
je 0x40e7bf
dec eax
je 0x40e7ca
dec eax
je 0x40e7a2
dec eax
je 0x40e7a7
dec eax
jne 0x40e8e4
mov eax, dword [edi + 0x74]
jmp 0x40e7d1
mov eax, dword [ebp + 0xc]
mov edi, dword [edi + 0x70]
push edi
mov eax, dword [eax]
push eax
call fcn.004123d3
pop ecx
mov ebx, eax
pop ecx
jmp 0x40e8e4
push ecx
call fcn.00491136
pop ecx
shl eax, 1
jmp 0x40e7d1
push ecx
call fcn.004916e0
pop ecx
cmp byte [esi], bl
mov dword [ebp + 8], eax
mov dword [ebp - 0xc], ebx
je 0x40e7e2
mov dword [ebp - 0xc], 0x2100
cmp byte [esi + 1], bl
jne 0x40e7eb
xor eax, eax
jmp 0x40e7f5
lea eax, [ebp - 0x24]
push eax
call fcn.0044f684
pop ecx
mov esi, dword [ebp + 0xc]
push ebx
push dword [ebp - 0xc]
lea edx, [ebp - 0x24]
mov ecx, dword [esi]
neg eax
sbb eax, eax
push 2
and eax, edx
push eax
push ebx
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0xc], eax
jne 0x40e865
push 0x4a94c0
push esi
lea eax, [ebp + 0x10]
push 0x4aba00
push eax
call fcn.0040673f
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.004066f3
lea ecx, [ebp + 0x10]
call fcn.00401085
push dword [ebp + 0xc]
call fcn.0043d497
pop ecx
lea ecx, [ebp + 0xc]
call fcn.00401085
lea ecx, [ebp - 4]
call fcn.00401085
xor eax, eax
jmp 0x40e8ee
cmp dword [edi + 0x6c], 1
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
jne 0x40e889
lea ecx, [ebp - 0x14]
push ebx
push ecx
lea ecx, [ebp - 0x18]
push 2
push ecx
push eax
mov dword [ebp - 0x18], 0xfeff
mov dword [ebp - 0x14], ebx
call esi
lea eax, [ebp - 0x10]
push ebx
push eax
mov dword [ebp - 0x10], ebx
push dword [ebp + 8]
push dword [ebp - 8]
push dword [ebp - 0xc]
call esi
test eax, eax
je 0x40e8ad
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 0x10]
jne 0x40e8ad
push 1
pop esi
jmp 0x40e8af
xor esi, esi
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [edi + 0x30], bl
je 0x40e8cb
mov eax, dword [ebp + 0xc]
push 1
push dword [eax]
call fcn.0045a6b1
pop ecx
pop ecx
cmp esi, ebx
je 0x40e8e2
mov eax, dword [ebp + 0x10]
cmp byte [eax + 3], bl
je 0x40e8e2
mov eax, dword [ebp + 0xc]
push dword [eax]
call fcn.0040e997
pop ecx
mov ebx, esi
lea ecx, [ebp - 4]
call fcn.00401085
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40ef73
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
lea ecx, [ebp - 4]
push dword [ebp + 0xc]
call fcn.004064a9
and byte [ebp + 0xf], 0
and dword [ebp - 8], 0
mov edi, str.http:__
mov dword [ebp - 0x20], str.https:__
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x1c], str.ftp:__
mov dword [ebp - 0x18], str.mailto:
mov dword [ebp - 0x14], str.file:___
mov dword [ebp - 0x10], str.file:__
lea esi, [ebp - 0x24]
mov ebx, dword [esi]
push ebx
call fcn.00491136
pop ecx
mov ecx, dword [ebp - 4]
cmp dword [ecx - 8], eax
jl 0x40effa
push eax
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 4]
call fcn.0040694d
mov eax, dword [eax]
push ebx
push eax
call fcn.00491db7
mov ebx, eax
pop ecx
neg ebx
pop ecx
sbb bl, bl
lea ecx, [ebp - 0xc]
inc bl
call fcn.00401085
test bl, bl
jne 0x40f008
inc dword [ebp - 8]
add esi, 4
cmp dword [ebp - 8], 6
jb 0x40efbd
jmp 0x40f00c
mov byte [ebp + 0xf], 1
mov esi, 0x4a9724
lea ecx, [ebp - 4]
push esi
push 0x4a9964
call fcn.004091dc
push esi
push 0x4ab810
lea ecx, [ebp - 4]
call fcn.004091dc
push esi
push 0x4aa044
lea ecx, [ebp - 4]
call fcn.004091dc
push esi
push 0x4aa0cc
lea ecx, [ebp - 4]
call fcn.004091dc
push esi
push 0x4ab05c
lea ecx, [ebp - 4]
call fcn.004091dc
push esi
push 0x4ab9f0
lea ecx, [ebp - 4]
call fcn.004091dc
cmp byte [ebp + 0xf], 0
jne 0x40f08a
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 0xc]
push edi
push eax
call fcn.0040673f
push eax
lea ecx, [ebp - 4]
call fcn.004065e8
lea ecx, [ebp + 0xc]
call fcn.00401085
cmp byte [ebp + 0x10], 0
je 0x40f0a8
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.0044fbd4
dec al
pop ecx
neg al
sbb eax, eax
pop ecx
inc eax
mov esi, eax
jmp 0x40f0c9
push 5
push 0
push 0
push dword [ebp - 4]
push str.open
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
cmp eax, 0x20
setg cl
mov esi, ecx
lea ecx, [ebp - 4]
call fcn.00401085
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4100a6
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push esi
push edi
call fcn.0044ebcc
mov edi, eax
mov eax, dword [0x4a9450]
test edi, edi
mov dword [ebp - 0x10], edi
jne 0x4100f8
mov esi, str.CAppObjects::Set_App_Privelegies:_CANNOT_OpenProcessToken
mov dword [ebp - 4], eax
mov eax, esi
test eax, eax
je 0x4100d6
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push eax
lea ecx, [ebp - 4]
call fcn.00406586
push dword [ebp - 4]
call fcn.0043d497
pop ecx
lea ecx, [ebp - 4]
call fcn.00401085
xor eax, eax
jmp 0x410269
mov esi, str.CAppObjects::Set_App_Privelegies:_succesfully_OpenProcessToken
mov dword [ebp - 4], eax
mov eax, esi
test eax, eax
je 0x41010d
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
push esi
push eax
lea ecx, [ebp - 4]
call fcn.00406586
push dword [ebp - 4]
call fcn.0043d98d
pop ecx
lea ecx, [ebp - 4]
call fcn.00401085
push 2
mov dword [ebp - 0x30], edi
pop edi
mov dword [ebp - 0x38], str.SeTakeOwnershipPrivilege
mov dword [ebp - 0x34], str.SeDebugPrivilege
lea esi, [ebp - 0x50]
mov ebx, edi
mov ecx, esi
call fcn.00405c2b
add esi, 0xc
dec ebx
jne 0x410142
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x50]
push edi
push eax
call fcn.0044ecda
add esp, 0xc
and dword [ebp - 0xc], 0
lea esi, [ebp - 0x50]
mov dword [ebp - 8], edi
mov eax, dword [esi]
push 1
pop edi
push edi
push eax
push dword [ebp - 0x10]
call fcn.0044eb04
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x410185
mov dword [ebp - 0xc], edi
mov eax, dword [0x4a9450]
mov edi, dword [esi + 4]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push ebx
push eax
call fcn.00411a7d
pop ecx
pop ecx
push eax
push 0x4a9db4
lea eax, [ebp - 0x28]
push edi
push eax
call fcn.00450531
pop ecx
pop ecx
push eax
push 0x4a9724
push esi
lea eax, [ebp - 0x24]
push str.SecurityUtil2::SetPrivilege:
push eax
call fcn.0040673f
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.004066f3
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0040665f
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004066f3
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0040665f
push eax
lea ecx, [ebp - 4]
call fcn.004065e8
lea ecx, [ebp - 0x14]
call fcn.00401085
lea ecx, [ebp - 0x18]
call fcn.00401085
lea ecx, [ebp - 0x1c]
call fcn.00401085
lea ecx, [ebp - 0x20]
call fcn.00401085
lea ecx, [ebp - 0x24]
call fcn.00401085
lea ecx, [ebp - 0x28]
call fcn.00401085
lea ecx, [ebp - 0x2c]
call fcn.00401085
push ebx
push dword [ebp - 4]
call fcn.0043db97
pop ecx
pop ecx
lea ecx, [ebp - 4]
call fcn.00401085
add esi, 0xc
dec dword [ebp - 8]
jne 0x41016a
push fcn.0043ea0b
push 2
lea eax, [ebp - 0x50]
push 0xc
push eax
call fcn.00406359
lea ecx, [ebp - 0x30]
call fcn.00410955
mov eax, dword [ebp - 0xc]
pop ebx
pop edi
pop esi
leave
ret
Function at 0x41053d
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
call fcn.0047c0a9
mov edi, eax
test edi, edi
je 0x410669
mov eax, dword [0x4a9450]
push esi
mov dword [ebp + 8], eax
mov eax, dword [edi + 0x6c]
test eax, eax
jl 0x4105ae
cmp eax, 1
jle 0x410596
cmp eax, 2
je 0x410589
cmp eax, 3
je 0x410581
cmp eax, 4
jne 0x4105ae
mov esi, str..bmp
jmp 0x41058e
push 1
pop esi
jmp 0x41065e
mov esi, str..rtf
mov eax, esi
test eax, eax
jne 0x41059d
jmp 0x4105a4
mov esi, str..txt
jmp 0x41058e
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push eax
lea ecx, [ebp + 8]
call fcn.00406586
push dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
call fcn.0041066c
lea eax, [ebp + 0xc]
push eax
push edi
call fcn.0040e941
add esp, 0x10
test eax, eax
jne 0x410604
push dword [ebp + 0xc]
lea eax, [ebp + 0x14]
push eax
call fcn.004504e0
pop ecx
pop ecx
push eax
lea eax, [ebp + 0x10]
push str.Cannot_write_clipboard_data_into
push eax
call fcn.0040673f
push dword [eax]
call fcn.0043d497
pop ecx
lea ecx, [ebp + 0x10]
call fcn.00401085
lea ecx, [ebp + 0x14]
call fcn.00401085
xor esi, esi
jmp 0x410656
cmp dword [ebp + 0x14], 0
je 0x410647
push 1
lea eax, [ebp + 0x14]
push dword [ebp + 0xc]
push eax
call fcn.00411030
add esp, 0xc
push 3
push dword [ebp + 0x14]
push 0
push dword [ebp + 0xc]
push str.open
push dword [ebp + 0x10]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
cmp eax, 0x20
setg cl
mov esi, ecx
lea ecx, [ebp + 0x14]
call fcn.00401085
jmp 0x410656
push dword [ebp + 0xc]
push dword [ebp + 0x10]
call fcn.0040e238
pop ecx
mov esi, eax
pop ecx
lea ecx, [ebp + 0xc]
call fcn.00401085
lea ecx, [ebp + 8]
call fcn.00401085
mov eax, esi
pop esi
pop edi
pop ebp
ret

Function at 0x410816
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 8]
push esi
push dword [ebp + 0xc]
call fcn.0047c0a9
mov esi, eax
test esi, esi
je 0x4108ac
push str..txt
lea ecx, [ebp - 8]
call fcn.004064a9
mov eax, dword [esi + 0x6c]
sub eax, 3
je 0x4108a0
dec eax
je 0x4108a0
push dword [ebp - 8]
lea eax, [ebp + 0xc]
push eax
call fcn.0041066c
lea eax, [ebp + 0xc]
push eax
push esi
call fcn.0040e919
add esp, 0x10
test eax, eax
jne 0x4108af
push dword [ebp + 0xc]
lea eax, [ebp - 0xc]
push eax
call fcn.004504e0
pop ecx
pop ecx
push eax
lea eax, [ebp + 0x10]
push str.Cannot_write_clipboard_data_into
push eax
call fcn.0040673f
push dword [eax]
call fcn.0043d497
pop ecx
lea ecx, [ebp + 0x10]
call fcn.00401085
lea ecx, [ebp - 0xc]
call fcn.00401085
lea ecx, [ebp + 0xc]
call fcn.00401085
xor esi, esi
lea ecx, [ebp - 8]
call fcn.00401085
mov eax, esi
pop esi
leave
ret
lea eax, [ebp - 4]
push eax
call fcn.0040d74d
push 1
lea eax, [ebp + 8]
push dword [ebp + 0xc]
push eax
call fcn.00411030
add esp, 0x10
push 3
push dword [ebp + 8]
push dword [ebp + 0xc]
push dword [ebp - 4]
push str.open
push dword [ebp + 0x10]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
cmp eax, 0x20
setg cl
mov esi, ecx
lea ecx, [ebp + 8]
call fcn.00401085
lea ecx, [ebp - 4]
call fcn.00401085
lea ecx, [ebp + 0xc]
call fcn.00401085
jmp 0x4108a2
Function at 0x41188a
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
and word [ebp - 0x208], 0
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x206]
push dword [ebp + 8]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x208]
push eax
call fcn.004909ee
push dword [ebp + 8]
call fcn.00491136
add esp, 0xc
cmp word [ebp + eax*2 - 0x208], 0x5c
pop edi
je 0x4118e6
lea eax, [ebp - 0x208]
push 0x4a9890
push eax
call fcn.004909c4
pop ecx
pop ecx
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
jbe 0x4118fd
cmp eax, 4
jne 0x411901
mov al, 1
leave
ret
xor al, al
leave
ret

Function at 0x411905
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
lea eax, [ebp - 8]
push edi
push eax
push 1
xor edi, edi
pop esi
mov dword [ebp - 8], edi
push esi
push edi
push 0x4ac1c8
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x411941
mov ecx, dword [ebp + 8]
push 0x4bf5f0
call fcn.004064a9
jmp 0x411a0a
mov eax, dword [0x4a9450]
mov dword [ebp - 0x10], esi
mov esi, 0x3e8
lea ecx, [ebp - 4]
push esi
mov dword [ebp - 0xc], 0x3e7
mov dword [ebp - 4], eax
call fcn.00406846
test eax, eax
je 0x411978
mov eax, dword [ebp - 4]
mov dword [eax - 8], esi
mov eax, dword [ebp - 4]
mov word [eax + 0x7d0], di
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0xc]
push ecx
push eax
lea eax, [ebp - 0x10]
push eax
push edi
push edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0xffffffffffffffff
lea ecx, [ebp - 4]
mov esi, eax
call fcn.004068ae
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, edi
jne 0x4119f5
mov eax, dword [ebp - 4]
cmp dword [eax - 8], edi
je 0x4119f5
mov esi, 0x4ac1c4
lea ecx, [ebp - 4]
push esi
call fcn.00406dba
push edi
push esi
lea ecx, [ebp - 4]
call fcn.004069b6
cmp eax, edi
jl 0x4119e7
push eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 4]
call fcn.0040694d
push eax
lea ecx, [ebp - 4]
call fcn.004065e8
lea ecx, [ebp - 0x14]
call fcn.00401085
mov ecx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
call fcn.00406383
jmp 0x411a02
mov ecx, dword [ebp + 8]
push 0x4bf5f0
call fcn.004064a9
lea ecx, [ebp - 4]
call fcn.00401085
mov eax, dword [ebp + 8]
pop edi
pop esi
leave
ret

Function at 0x411bc2
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
push esi
push edi
push dword [esp + 0x10]
call fcn.00491136
test eax, eax
pop ecx
jne 0x411bd7
xor al, al
jmp 0x411c2c
mov esi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x8001
call esi
push dword [esp + 0x10]
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x411c1f
call dword [sym.imp.KERNEL32.dll_GetLastError]
dec eax
dec eax
je 0x411c1a
dec eax
je 0x411c1a
dec eax
push ebx
dec eax
je 0x411c16
sub eax, 0x76
xor bl, bl
push ebp
call esi
mov al, bl
pop ebx
jmp 0x411c2c
mov bl, 1
jmp 0x411c0e
push ebp
call esi
jmp 0x411bd3
push ebp
call esi
mov eax, edi
and eax, 0x10
cmp al, 0x10
setne al
pop edi
pop esi
pop ebp
ret
Function at 0x411c30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_IsBadStringPtrW]
test eax, eax
je 0x411c4e
xor al, al
jmp 0x411caf
push esi
call fcn.00491136
mov edx, eax
pop ecx
test edx, edx
jle 0x411c4a
cmp word [esi + edx*2 - 2], 0x5c
push ebx
push edi
mov ecx, 0x82
sete bl
and word [ebp - 0x20c], 0
xor eax, eax
lea edi, [ebp - 0x20a]
rep stosd dword es:[edi], eax
pop edi
test bl, bl
pop ebx
je 0x411c9b
dec edx
lea eax, [ebp - 0x20c]
push edx
push esi
push eax
call fcn.00490987
add esp, 0xc
lea esi, [ebp - 0x20c]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x411c4a
and eax, 0x10
cmp al, 0x10
sete al
pop esi
leave
ret

Function at 0x411e42
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, dword [ebp + 8]
and byte [esi + 8], 0
mov dword [esi + 4], ecx
mov ecx, str.CAutoForegroundWindow
push ecx
push eax
mov dword [esi], eax
mov dword [esi + 0xc], ecx
call fcn.0043dab1
push dword [esi + 0xc]
push dword [esi + 4]
call fcn.0043dab1
mov eax, dword [esi]
and dword [ebp + 8], 0
add esp, 0x10
test eax, eax
je 0x411eb3
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x411eb3
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp eax, dword [ebp - 4]
sete al
mov byte [esi + 8], al
jmp 0x411eb7
mov byte [esi + 8], 1
cmp byte [esi + 8], 0
jne 0x411eef
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 1
push dword [ebp + 8]
call edi
mov ebx, dword [sym.imp.USER32.dll_AttachThreadInput]
push eax
call ebx
push dword [esi + 4]
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
cmp dword [ebp - 4], 0
je 0x411eef
push 0
push dword [ebp + 8]
call edi
push eax
call ebx
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x411ef8
Capabilities:
Log keystrokes

Disassembly:
push ecx
push esi
mov esi, ecx
cmp byte [esi + 8], 0
jne 0x411f5f
push ebx
push ebp
push edi
push dword [esi + 0xc]
push dword [esi]
call fcn.0043dab1
push dword [esi + 0xc]
push dword [esi + 4]
call fcn.0043dab1
add esp, 0x10
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
push 1
push ebx
call edi
mov ebp, dword [sym.imp.USER32.dll_AttachThreadInput]
push eax
call ebp
push dword [esi]
mov dword [esp + 0x14], eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
cmp dword [esp + 0x10], 0
je 0x411f58
push 0
push ebx
call edi
push eax
call ebp
pop edi
pop ebp
mov byte [esi + 8], 1
pop ebx
pop esi
pop ecx
ret
Function at 0x411fec
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
lea eax, [ebp - 4]
push esi
push eax
mov al, byte [ebp + 8]
xor esi, esi
push 1
neg al
sbb eax, eax
push esi
add eax, 0x80000002
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push eax
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x412063
push edi
mov ecx, 0x104
lea edi, [ebp - 0x41a]
mov word [ebp - 0x41c], si
rep stosd dword es:[edi], eax
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x208
push eax
lea eax, [ebp - 0x41c]
push eax
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
pop edi
je 0x412067
xor al, al
jmp 0x412093
lea eax, [ebp - 0x41c]
push ebx
push eax
lea eax, [ebp + 8]
push eax
call fcn.00412174
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.00412096
add esp, 0x10
lea ecx, [ebp + 8]
mov bl, al
call fcn.00401085
mov al, bl
pop ebx
pop esi
leave
ret

Function at 0x4120e2
Capabilities:
Delete registry value
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push ebx
push eax
mov al, byte [ebp + 8]
xor ebx, ebx
push 0xf003f
neg al
sbb eax, eax
push ebx
add eax, 0x80000002
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x412116
xor al, al
jmp 0x41215a
cmp byte [ebp + 0xc], bl
jne 0x412129
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x412147
push dword [ebp + 0x14]
call fcn.00491136
pop ecx
shl eax, 1
push eax
push dword [ebp + 0x14]
push 1
push ebx
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
leave
ret
Function at 0x4122d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
xor ebx, ebx
push dword [esi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x4123be
push ebx
push esi
push eax
movzx eax, word [esi + 8]
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0x14]
call dword [sym.imp.GDI32.dll_GetDIBits]
test eax, eax
je 0x4123be
push ebx
push 0x80
push 2
push ebx
push ebx
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp + 0xc], eax
je 0x4123be
mov eax, dword [esi + 0x20]
mov ecx, dword [esi]
mov edx, dword [esi + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
shl eax, 2
add edx, ecx
push ebx
mov word [ebp - 0x18], 0x4d42
mov word [ebp - 0x12], bx
lea edx, [edx + eax + 0xe]
lea eax, [ecx + eax + 0xe]
mov dword [ebp - 0xe], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x18]
push 0xe
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x16], edx
mov word [ebp - 0x10], bx
call edi
test eax, eax
jne 0x412382
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4123be
lea eax, [ebp - 4]
push ebx
push eax
mov eax, dword [esi + 0x20]
lea eax, [eax*4 + 0x28]
push eax
push esi
push dword [ebp + 0xc]
call edi
test eax, eax
je 0x412377
mov esi, dword [esi + 0x14]
lea eax, [ebp - 4]
push ebx
push eax
push esi
push dword [ebp - 8]
push dword [ebp + 0xc]
call edi
push dword [ebp + 0xc]
test eax, eax
je 0x41237a
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x4123c2
xor eax, eax
jmp 0x4123ce
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x412446
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0x18]
push esi
push eax
push 0x18
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_GetObjectW]
cmp eax, 0x18
jne 0x412492
push 0
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_CopyImage]
mov esi, eax
test esi, esi
je 0x412492
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
push esi
jne 0x412496
call dword [sym.imp.GDI32.dll_DeleteObject]
xor eax, eax
jmp 0x4124a7
push 2
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
push 1
pop eax
pop esi
leave
ret

Function at 0x412a0d
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x412a41
mov ecx, eax
and ecx, 0x10
cmp cl, 0x10
jne 0x412a2c
xor eax, eax
pop esi
ret
mov ecx, eax
and ecx, 1
cmp cl, 1
jne 0x412a41
xor eax, 1
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop esi
ret