joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4031c0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x340
lea eax, [esp + 0x100]
push 0xff
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x100]
push str.DDRAW.DLL
push ecx
lea edx, [esp + 8]
push str._s_s
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea eax, [esp + 0x200]
lea ecx, [esp]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x403226
push 0
push 0
push str._DirectX
call sub.MFC42.DLL_AfxMessageBox
add esp, 0x340
ret
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
add esp, 0x340
ret

Function at 0x403240
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x40c
push ebx
push esi
lea eax, [esp + 0xc]
push edi
push eax
push str.SOFTWARECCRIGPC
mov esi, ecx
push 0x80000002
mov dword [esp + 0x18], 0x400
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0xc]
lea edx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push edx
push eax
push 0
push str.Location
push ecx
call ebx
lea edx, [esp + 0x18]
lea ecx, [esi + 0xe0]
push edx
call sub.MFC42.DLL_CString::operator
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x18]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
lea ecx, [esp + 0x18]
push eax
mov eax, dword [esp + 0x14]
push ecx
push edx
push 0
push 0x407304
push eax
mov dword [esp + 0x24], 0x400
call ebx
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esi + 0xf4]
call sub.MFC42.DLL_CString::operator
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x18]
lea edx, [esp + 0xc]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x18]
push edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push eax
push ecx
push 0
push str.LOGIN
push edx
mov dword [esp + 0x24], 0x400
call ebx
lea eax, [esp + 0x18]
lea ecx, [esi + 0xe8]
push eax
call sub.MFC42.DLL_CString::operator
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0xc]
add esi, 0xf8
push ecx
lea edx, [esp + 0x18]
push esi
push edx
push 0
push str.Port
push eax
mov dword [esp + 0x24], 4
call ebx
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
add esp, 0x40c
ret

Function at 0x403360
Capabilities:
Set registry value

Disassembly:
push ecx
push esi
lea eax, [esp + 4]
push edi
push eax
push str.SOFTWARECCRIGPC
mov esi, ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov eax, dword [esi + 0xf4]
mov edx, dword [esp + 8]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [eax - 8]
push ecx
push eax
push 1
push 0
push 0x407304
push edx
call edi
mov eax, dword [esp + 8]
add esi, 0xf8
push 4
push esi
push 4
push 0
push str.Port
push eax
call edi
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ecx
ret
Function at 0x403550
Capabilities:
Get hostname
Resolve dns

Disassembly:
push 0xffffffffffffffff
push 0x404ea8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x158
push ebx
push esi
push edi
mov ebx, ecx
push 0x11c
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [esp + 0xc], eax
test eax, eax
mov dword [esp + 0x16c], 0
je 0x40359a
push ebx
mov ecx, eax
call fcn.00401a10
jmp 0x40359c
xor eax, eax
lea esi, [ebx + 0x160]
push 0x407348
mov ecx, esi
mov dword [esp + 0x170], 0xffffffff
mov dword [ebx + 0xfc], eax
call sub.MFC42.DLL_CString::operator
lea edi, [ebx + 0x100]
push 0
mov ecx, edi
call sub.MFC42.DLL_CWnd::UpdateData
mov edx, dword [ebx + 0xf8]
mov ecx, dword [ebx + 0xfc]
push edx
mov edx, dword [ebx + 0xf4]
mov eax, dword [ecx]
push edx
call dword [eax + 0xbc]
test eax, eax
jne 0x403610
mov ecx, dword [ebx + 0xfc]
test ecx, ecx
je 0x4035ff
mov eax, dword [ecx]
push 1
call dword [eax + 4]
mov dword [ebx + 0xfc], 0
xor eax, eax
jmp 0x40372b
push 0x407328
mov ecx, esi
call sub.MFC42.DLL_CString::operator
push 0
mov ecx, edi
call sub.MFC42.DLL_CWnd::UpdateData
mov edi, dword [ebx + 0xec]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x47]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebx + 0xf0]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 0x64]
push 0x100
push ecx
mov dword [esp + 0x174], 1
call sub.WSOCK32.dll_gethostname
lea edx, [esp + 0x64]
push edx
call sub.WSOCK32.dll_gethostbyname
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
push edx
call sub.WSOCK32.dll_inet_ntoa
push eax
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::operator
mov edi, dword [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x28]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x16c], 0xffffffff
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebx + 0xfc]
mov dword [esp + 0x60], 0
lea eax, [esp + 0x10]
mov edx, dword [ecx]
push eax
call dword [edx + 0xd4]
mov ecx, dword [ebx + 0xfc]
mov edx, dword [ecx]
call dword [edx + 0xe0]
mov eax, dword [ebx + 0x120]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, 1
mov ecx, dword [esp + 0x164]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x164
ret
Function at 0x4039e0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x158
lea eax, [esp + 8]
push esi
xor esi, esi
push eax
push 1
push esi
push str.SOFTWARECCRIGPCAddOnGames
push 0x80000002
mov dword [esp + 0x18], 0x41
mov dword [esp + 0x1c], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x403a38
push esi
lea ecx, [esp + 0x60]
push 0xff
push ecx
push esi
push eax
push esi
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
pop esi
add esp, 0x158
ret 4
lea edx, [esp + 8]
push edi
lea eax, [esp + 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
push edx
lea ecx, [esp + 0x1c]
push eax
push ecx
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x14]
push 0
lea eax, [esp + 0x30]
push edx
push eax
push 0
push ecx
call edi
cmp eax, 0x103
je 0x403acb
push ebp
mov ebp, dword [sym.imp.planet.dll_public:_void___thiscall_CPlanetMode::SetGameMenu_class_CString_]
push ebx
mov ebx, dword [esp + 0x16c]
push ecx
lea edx, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x28], esp
push edx
call fcn.00404744
mov ecx, ebx
call ebp
lea eax, [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
lea edx, [esp + 0x24]
push ecx
push edx
mov edx, dword [esp + 0x24]
lea eax, [esp + 0x1c]
push 0
lea ecx, [esp + 0x38]
inc esi
push eax
push ecx
push esi
push edx
mov dword [esp + 0x30], 0x41
mov dword [esp + 0x34], 4
call edi
cmp eax, 0x103
jne 0x403a79
pop ebx
pop ebp
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
add esp, 0x158
ret 4
Function at 0x4047d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x405db8
push 0x4049d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffff98
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push 2
call dword [sym.imp.MSVCRT.dll___set_app_type]
add esp, 4
mov dword [0x40768c], 0xffffffff
mov dword [0x407690], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x407680]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov edx, dword [0x40767c]
mov dword [eax], edx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov ecx, dword [eax]
mov dword [0x407688], ecx
call fcn.00403c20
mov eax, dword [0x407598]
test eax, eax
jne 0x404861
push 0x4049c0
call dword [sym.imp.MSVCRT.dll___setusermatherr]
add esp, 4
call fcn.004049a0
push 0x407014
push 0x407010
call sub.MSVCRT.dll__initterm
add esp, 8
mov edx, dword [0x407678]
mov dword [ebp - 0x6c], edx
lea eax, [ebp - 0x6c]
push eax
mov ecx, dword [0x407674]
push ecx
lea edx, [ebp - 0x64]
push edx
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x60]
push ecx
call dword [sym.imp.MSVCRT.dll___getmainargs]
add esp, 0x14
push 0x40700c
push section..data
call sub.MSVCRT.dll__initterm
add esp, 8
mov edx, dword [sym.imp.MSVCRT.dll__acmdln]
mov esi, dword [edx]
mov dword [ebp - 0x74], esi
cmp byte [esi], 0x22
jne 0x40496f
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x4048d5
cmp al, 0x22
jne 0x4048c7
cmp byte [esi], 0x22
jne 0x4048de
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x4048ee
cmp al, 0x20
ja 0x4048ee
inc esi
mov dword [ebp - 0x74], esi
jmp 0x4048de
mov dword [ebp - 0x30], 0
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x40490f
mov eax, dword [ebp - 0x2c]
and eax, 0xffff
jmp 0x404914
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x68], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
jmp 0x404954
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0x20
jbe 0x4048de
inc esi
mov dword [ebp - 0x74], esi
jmp 0x40496f
Function at 0x4011e0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x108
push 0x40e040
call fcn.00405cb4
add esp, 4
test eax, eax
jne 0x401252
push str.TEMP
call fcn.00405cb4
add esp, 4
test eax, eax
jne 0x401252
lea eax, [esp + 4]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0
push 0
lea ecx, [esp + 8]
push 0
lea edx, [esp + 0x10]
push ecx
push edx
call fcn.00405b6d
mov ecx, dword [esp + 0x120]
push 0
push 0
lea eax, [esp + 0x1c]
push 0x40e030
push eax
push ecx
call fcn.00405adc
add esp, 0x28
add esp, 0x108
ret
mov edx, dword [esp + 0x10c]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esp, 0x108
ret

Function at 0x4013c0
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
sub esp, 0x248
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
push edi
mov edi, dword [esp + 0x258]
lea eax, [esp + 0x10]
push edi
push eax
call ebp
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x10]
push str..
push ecx
call esi
lea edx, [esp + 0x114]
lea eax, [esp + 0x10]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
je 0x4014e6
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [esp + 0x144]
push 0x40e088
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x4014bf
lea edx, [esp + 0x144]
push 0x40e084
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x4014bf
mov al, byte [esp + 0x118]
push edi
test al, 0x10
je 0x401486
lea eax, [esp + 0x18]
push eax
call ebp
lea ecx, [esp + 0x14]
push 0x40e080
push ecx
call esi
lea edx, [esp + 0x144]
lea eax, [esp + 0x14]
push edx
push eax
call esi
lea ecx, [esp + 0x14]
push ecx
call fcn.004013c0
add esp, 4
jmp 0x4014bf
lea edx, [esp + 0x18]
push edx
call ebp
lea eax, [esp + 0x14]
push 0x40e080
push eax
call esi
lea ecx, [esp + 0x144]
lea edx, [esp + 0x14]
push ecx
push edx
call esi
lea eax, [esp + 0x14]
push 0x80
push eax
call ebx
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x118]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x401417
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebx
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop edi
pop esi
pop ebp
add esp, 0x248
ret
Function at 0x401550
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x44c
lea eax, [esp]
push eax
call fcn.004011e0
add esp, 4
lea ecx, [esp]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [esp + eax - 1], 0x5c
je 0x401585
lea edx, [esp]
push 0x40e080
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push esi
lea eax, [esp + 4]
push edi
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
push eax
lea ecx, [esp + 0x354]
push str._svis
push ecx
call edi
add esp, 0xc
lea edx, [esp + 0x10c]
lea eax, [esp + 0x350]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x401629
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileA]
test byte [esp + 0x110], 0x10
je 0x401612
lea ecx, [esp + 0x13c]
lea edx, [esp + 0xc]
push ecx
push edx
lea eax, [esp + 0x258]
push str._s_s
push eax
call edi
lea ecx, [esp + 0x260]
push ecx
call fcn.00401500
add esp, 0x14
test eax, eax
je 0x401612
lea edx, [esp + 0x250]
push edx
call fcn.004013c0
add esp, 4
lea eax, [esp + 0x110]
push eax
push esi
call ebp
test eax, eax
jne 0x4015c8
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebp
pop edi
pop esi
add esp, 0x44c
ret

Function at 0x401660
Capabilities:
Delete directory

Disassembly:
push 0x40eeb4
call fcn.00401100
add esp, 4
test eax, eax
je 0x40167e
push 0x40eeb4
call fcn.004013c0
add esp, 4
push 0x40efbc
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x401698
push 0x40efbc
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
ret
Function at 0x4016a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x270
mov eax, 1
push 0
mov dword [esp + 8], eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x20]
mov dword [esp + 0x3c], 2
push eax
call fcn.00402080
add esp, 8
test ax, ax
je 0x4016d8
xor eax, eax
add esp, 0x270
ret
push ebx
push ebp
push esi
mov esi, dword [esp + 0x280]
push edi
mov edi, dword [sym.imp.KERNEL32.dll__lread]
lea ecx, [esp + 0x12]
push 2
push ecx
push esi
call edi
cmp word [esp + 0x12], 0
mov dword [esp + 0x1c], 0
jle 0x401898
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x18]
push 1
push edx
push esi
call edi
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x180]
and eax, 0xff
push eax
push ecx
push esi
call edi
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x20]
and edx, 0xff
push 2
push eax
push esi
mov byte [esp + edx + 0x18c], 0
call edi
lea ecx, [esp + 0x28]
push 2
push ecx
push esi
call edi
lea edx, [esp + 0x70]
push 4
push edx
push esi
call edi
lea eax, [esp + 0x6c]
push 4
push eax
push esi
call edi
lea ecx, [esp + 0x7c]
push 0x40eeb4
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0x7c]
push 0x40e080
push edx
call ebx
lea eax, [esp + 0x180]
lea ecx, [esp + 0x7c]
push eax
push ecx
call ebx
lea edx, [esp + 0x24]
push 4
push edx
push esi
call edi
lea eax, [esp + 0x7c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll__lcreat]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x401890
mov ecx, dword [esp + 0x24]
xor eax, eax
lea edx, [esp + 0x2c]
push eax
push edx
mov dword [esp + 0x34], 3
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ecx
mov word [esp + 0x48], si
mov word [esp + 0x4a], bp
mov dword [esp + 0x4c], 9
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], 0x10000
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
call fcn.00402080
add esp, 8
test ax, ax
jne 0x40187f
push ebp
call dword [sym.imp.KERNEL32.dll__lclose]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x64]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
lea eax, [esp + 0x74]
lea ecx, [esp + 0x64]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
push 0
lea edx, [esp + 0x78]
push 0
push edx
push 0
lea eax, [esp + 0x8c]
push 0
push eax
call fcn.00401000
mov ebp, dword [esp + 0x34]
add esp, 0x18
test ebp, ebp
jne 0x40186b
lea ecx, [esp + 0x7c]
push ecx
push 0x40f0c0
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
movsx edx, word [esp + 0x12]
inc ebp
cmp ebp, edx
mov dword [esp + 0x1c], ebp
jl 0x40170d
jmp 0x401898
push ebp
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll__lclose]
jmp 0x401898
mov dword [esp + 0x14], 0
lea eax, [esp + 0x2c]
push 0
push eax
mov dword [esp + 0x34], 4
call fcn.00402080
add esp, 8
test ax, ax
pop edi
pop esi
pop ebp
pop ebx
je 0x4018c0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
add esp, 0x270
ret
Function at 0x4019d0
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x14
push esi
xor esi, esi
call fcn.00401990
test eax, eax
je 0x401a3a
lea eax, [esp + 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x401a49
lea ecx, [esp + 0xc]
push ecx
push str.SeShutdownPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x401a49
mov eax, dword [esp + 4]
push esi
push esi
lea edx, [esp + 0x10]
push esi
push edx
push esi
push eax
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x401a49
push 0
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
pop esi
add esp, 0x14
ret
mov eax, esi
pop esi
add esp, 0x14
ret
Function at 0x401f40
Capabilities:
Parse pe header

Disassembly:
sub esp, 0xfc
push 0x40000
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
mov dword [esp], eax
jne 0x401f67
mov eax, 1
add esp, 0xfc
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll__lread]
push ebp
mov ebp, dword [esp + 0x108]
push esi
push edi
lea eax, [esp + 0x14]
push 0x40
push eax
push ebp
call ebx
cmp eax, 0x40
je 0x401f91
mov esi, 3
jmp 0x40205b
mov edx, dword [esp + 0x50]
xor ecx, ecx
cmp word [esp + 0x14], 0x5a4d
mov edi, dword [sym.imp.KERNEL32.dll__llseek]
push 0
setne cl
dec ecx
and ecx, edx
mov esi, ecx
push esi
push ebp
call edi
lea edx, [esp + 0x14]
push pe_nt_image_headers32
push edx
push ebp
call ebx
cmp eax, 0xf8
je 0x401fd0
mov esi, 3
jmp 0x40205b
cmp dword [esp + 0x14], 0x4550
je 0x401fe1
mov esi, 5
jmp 0x40205b
mov eax, dword [esp + 0x28]
mov ebx, dword [esp + 0x1a]
and eax, 0xffff
push 0
and ebx, 0xffff
lea ecx, [eax + esi + 0x18]
push ecx
push ebp
call edi
mov edx, ebx
dec ebx
test edx, edx
je 0x402046
lea eax, [esp + 0x14]
push 0x28
push eax
push ebp
call dword [sym.imp.KERNEL32.dll__lread]
cmp eax, 0x28
jne 0x401f87
mov ecx, 2
mov edi, str._mvdata
lea esi, [esp + 0x14]
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
je 0x40203e
mov eax, ebx
dec ebx
test eax, eax
jne 0x402005
mov esi, 6
jmp 0x40205b
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x40204d
mov esi, 6
jmp 0x40205b
mov ecx, dword [esp + 0x114]
add eax, 8
xor esi, esi
mov dword [ecx], eax
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xfc
ret
Function at 0x4035e0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [0x40f620]
xor eax, eax
push esi
mov dword [0x40f4dc], eax
mov dword [0x40f598], eax
mov word [0x40f4e4], ax
mov edx, 2
movzx si, byte [ecx]
and eax, 0x3ff
and esi, 0x7fff
shl eax, 5
xor esi, eax
inc ecx
mov ax, si
dec edx
mov word [0x40f4e4], ax
jne 0x4035fe
call fcn.00404c70
pop esi
ret
Function at 0x408701
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40e9f8
cmp edx, dword [eax]
je 0x408723
add eax, 8
inc ecx
cmp eax, 0x40ea88
jl 0x408714
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40e9f8]
jne 0x408851
mov eax, dword [0x40f200]
cmp eax, 1
je 0x40882b
test eax, eax
jne 0x408754
cmp dword [0x40e4b4], 1
je 0x40882b
cmp edx, 0xfc
je 0x408851
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40878b
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00409e30
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00406f10
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4087ce
lea eax, [ebp - 0x1a4]
push eax
call fcn.00406f10
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40d4dc
push edi
call fcn.00408ab0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00409e30
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00409e40
lea eax, [ebp - 0xa0]
push 0x40d4bc
push eax
call fcn.00409e40
push dword [esi + 0x40e9fc]
lea eax, [ebp - 0xa0]
push eax
call fcn.00409e40
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0040b024
add esp, 0x2c
pop edi
jmp 0x408851
lea eax, [ebp + 8]
lea esi, [esi + 0x40e9fc]
push 0
push eax
push dword [esi]
call fcn.00406f10
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x1000b4f0
Capabilities:
Allocate or change rwx memory
Create process on windows
Encode data using base64
Encrypt data using chaskey
Encrypt data using speck
Execute anti-debugging instructions
Execute shellcode via indirect call
Hide graphical window
Parse pe header
Resume thread

Disassembly:
jmp 0x1000c832
push ebp
bswap edx
movzx ebp, ax
xor dl, cl
mov ebp, esp
mov ecx, 0xd72fde87
push ebx
shl al, 0x15
or ah, bh
push edi
sub dh, 0xb1
push esi
btr cx, ax
lea esp, [esp - 0x204]
add dl, 0x92
sub cl, 0x24
mov eax, dword [0x1008b480]
movsx edx, dx
adc ecx, esp
cdq
xor eax, ebp
add ch, 0x13
mov dword [ebp - 0x10], eax
mov ecx, dword [0x1008c934]
cwd
mov eax, dword [0x1008c930]
rcr dl, 0xe
neg dh
sub esi, esi
add dh, al
sub esi, 1
xadd dh, dl
inc dx
btr edx, eax
mov edx, ecx
cmp ebp, ecx
test ebp, 0xf7902732
test di, dx
lea edx, [edx + esi]
cmp cl, 0x14
cmp si, ax
imul ecx, edx
stc
and ecx, 1
cmp ecx, 0
jmp loc.100956e1

Function at 0x100195d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], 0x75d7a354
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
sub eax, 0x3cb4ee1e
je 0x10019640
jmp 0x10019605
mov eax, dword [ebp - 0x14]
sub eax, 0x75d7a354
je 0x1001961d
jmp 0x10019618
jmp 0x1001966b
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.10019520
and al, 1
mov byte [ebp - 1], al
mov dword [ebp - 0x10], 0x3cb4ee1e
jmp 0x1001966b
mov ah, byte [ebp - 1]
mov al, ah
xor al, 0xff
and al, 1
mov dl, 1
xor dl, 1
and ah, dl
mov cl, 1
xor cl, 1
and cl, 0xff
and dl, 1
or al, ah
or cl, dl
xor al, cl
and al, 1
movzx eax, al
add esp, 0x1c
pop ebp
ret
jmp 0x100195ef

Function at 0x10028c5a
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10028c99
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10028c99
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10028c99
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10028c99
cmp dword [ecx + 0x74], 0xe
jbe 0x10028c99
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret