joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10221da7
Capabilities:
Authenticate hmac
Check for software breakpoints
Check http status code
Encode data using base64
Encrypt data using aes mixcolumns step
Encrypt data using chaskey
Encrypt data using speck
Execute anti-debugging instructions
Hash data using murmur3
Parse credit card information

Disassembly:
movaps xmm0, xmmword [ebp - 0xc960]
movaps xmmword [ebp - 0x17300], xmm0
adc ax, cx
mov eax, dword [ebp - 0xde38]
movups xmm0, xmmword [eax + 0x350]
and ecx, ecx
movaps xmmword [ebp - 0x172f0], xmm0
adc cx, ax
movaps xmm0, xmmword [ebp - 0x172f0]
btc cx, 0x91
xorps xmm0, xmmword [ebp - 0x17300]
and cx, bx
xor ecx, 0x5d0bbd9c
movaps xmmword [ebp - 0x17310], xmm0
not ecx
sar cx, cl
and cx, si
movaps xmm0, xmmword [ebp - 0x17310]
sbb ecx, ebp
sub ecx, esp
xchg cx, cx
mov ecx, dword [ebp - 0xde38]
lea ecx, [ecx + 0x350]
movups xmmword [ecx], xmm0
clc
cmp cx, 0x1fa0
xor edx, edx
jmp 0x1024c867
ror al, 0x87
lea esi, [0x10221dbf]
push eax
jae 0x102637f2
movaps xmm0, xmmword [ebp - 0xc980]
movaps xmmword [ebp - 0x172a0], xmm0
mov eax, dword [ebp - 0xde38]
btr cx, dx
movups xmm0, xmmword [eax + 0x330]
bsf cx, sp
movaps xmmword [ebp - 0x17290], xmm0
sal ch, 0x91
or cx, dx
movaps xmm0, xmmword [ebp - 0x17290]
sub cl, ah
xorps xmm0, xmmword [ebp - 0x172a0]
xor ecx, edi
movaps xmmword [ebp - 0x172b0], xmm0
test ebx, ebp
movaps xmm0, xmmword [ebp - 0x172b0]
rol ch, cl
mov ecx, dword [ebp - 0xde38]
lea ecx, [ecx + 0x330]
clc
movups xmmword [ecx], xmm0
cmp ah, 0x11
cmp al, ah
xor edx, edx
jmp 0x1022a44d
add ecx, 0x340
clc
cmc
movups xmmword [ecx], xmm0
cmp esi, 0x57100708
xor edx, edx
jmp 0x10258e23
sal dword [esp + 4], 0x5c
mov dword [esp], 0x14341c01
mov edx, 0
sbb ebx, edx
lea esp, [esp + 8]
mov eax, 0xd61267b3
jmp 0x1014a9c3
je 0x1024dbaf
jmp 0x10205f25
movaps xmm0, xmmword [ebp - 0xc970]
and cx, 0xbaae
movzx eax, bx
cmovnp eax, ebx
movaps xmmword [ebp - 0x172d0], xmm0
rcr ecx, 0xb0
clc
test ah, 0x8a
mov eax, dword [ebp - 0xde38]
movups xmm0, xmmword [eax + 0x340]
movaps xmmword [ebp - 0x172c0], xmm0
movzx ecx, bx
movaps xmm0, xmmword [ebp - 0x172c0]
clc
xorps xmm0, xmmword [ebp - 0x172d0]
sub ecx, ecx
movaps xmmword [ebp - 0x172e0], xmm0
movzx ecx, sp
sub cx, di
shl cx, 0xbd
movaps xmm0, xmmword [ebp - 0x172e0]
shr cx, 0x82
test esp, 0x6dbc2dbb
xor cx, 0x6229
mov ecx, dword [ebp - 0xde38]
jmp 0x10205f14
je 0x10016dbb
jmp 0x10016e33
mov eax, dword [ebp]
sar word [esp], 0x8a
call fcn.1028220f
push 0
jmp 0x1001be76

Function at 0x1023d317
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov edi, dword [esp + 0xc]
mov dword [esp + 0xc], 0xc2ea3010
push dword [esp + 8]
popfd
lea esp, [esp + 0xc]
call fcn.1021f525

Function at 0x102494e9
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop eax
xor dword [esp + 4], ecx
mov word [edi], dx
movzx eax, cl
pop edx
pop ecx
jne fcn.100782ef
Function at 0x1025b347
Capabilities:
Resolve function by parsing pe exports

Disassembly:
popfd
lea esp, [esp + 8]
call fcn.1021f525
mov ebp, 0xd2a676ac
pushfd
mov ecx, ebp
lea ebp, [ebp + ecx*2 + 0xe07d8a4]
add ebp, 0x930ceea0
mov ecx, dword [esp + 0xc]
mov dword [esp + 0xc], 0x81d02610
mov ebp, dword [esp + 8]
jl 0x100572b8
movaps xmm1, xmmword [esp + 0x80]
jmp loc.1005d2b0

Function at 0x10260d92
Capabilities:
Parse pe header

Disassembly:
push edi
mov ebp, dword [esp + esi - 0x7fffffdc]
lea ebp, [ebp + esi*2 - 0x49e36275]
rol ebp, 1
bt di, ax
inc ax
ror ax, 0x8e
sbb ebp, 0xc2808626
neg si
bswap ebp
rol byte [esp + eax*2 - 0x890e], 0xc5
adc ebp, ebx
inc dword [esp + eax - 0x4487]
neg esi
cwde
mov dword [esp + eax*4 - 0x111fc], ecx
inc word [esp + esi - 0x7fffffff]
lea ecx, [edi + esi*8 + 0x1ab751b3]
mov dword [esp + eax*2 - 0x88ea], edx
lea edi, [esp + esi - 0x7ffffffc]
lea eax, [eax + edi - 0x456f]
mov esp, eax
btc di, 3
movsx eax, di
mov dword [esp + eax - 0x1a24], ebx
mov ebx, eax
mov ebx, 0
shl ax, 3
shl esi, 0x7d
movsx ebp, ax
mov dword [esp + esi - 0x7ffffff8], ebx
jbe 0x1018d19d

Function at 0x10265dac
Capabilities:
Check http status code
Encode data using base64
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0xc9c], ecx
cmove cx, di
mov ecx, dword [esp + 0x494]
jmp 0x1027c355
mov dword [esp], 0x56803010
call fcn.1021f525
mov dword [esp + 0xc98], eax
setne ah
mov eax, dword [esp + 0x490]
jmp 0x101e8476
mov dword [esp + 0x498], 0x96714868
jmp 0x10177488

Function at 0x10279940
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 8], 0x6c8ab090
lea esp, [esp + 8]
call fcn.1021f525

Function at 0x1027f99f
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebx
push edi
mov ebx, 0xa3897905
pushfd
add dword [esp + ebx + 0x5c768707], 0xeffa69d3
mov edi, 0x34b68a10
mov dword [esp + 0xc], 0xb1a8a910
mov edi, dword [esp + edi*2 - 0x696d141c]
call fcn.1028935a

Function at 0x102839a4
Capabilities:
Check http status code
Encode data using base64
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x10]
call fcn.1021f525

Function at 0x1028a48d
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov byte [ebp - 0xbfb7], 0xd
mov byte [ebp - 0xbfb6], 0x90
jmp loc.10050e3b
call fcn.10213e88
mov byte [ebp - 0xbfb8], 0xd5
jmp 0x10252041
Function at 0x1028b20e
Capabilities:
Check for software breakpoints
Encode data using base64
Encrypt data using aes mixcolumns step
Encrypt data using chaskey
Encrypt data using speck
Execute anti-debugging instructions
Parse credit card information

Disassembly:
movaps xmm0, xmmword [ebp - 0xda00]
ror ax, cl
cmovae ecx, ebx
btc dx, 0xaf
movaps xmmword [ebp - 0x1ae00], xmm0
mov edx, dword [ebp - 0xdea0]
setle cl
dec ch
cmp cx, si
movups xmm0, xmmword [edx + 0x60]
shl eax, cl
movaps xmmword [ebp - 0x1adf0], xmm0
movaps xmm0, xmmword [ebp - 0x1adf0]
xorps xmm0, xmmword [ebp - 0x1ae00]
lahf
movaps xmmword [ebp - 0x1ae10], xmm0
cmc
nop
movaps xmm0, xmmword [ebp - 0x1ae10]
mov eax, dword [ebp - 0xdea0]
add cx, 0x3234
shl ecx, cl
add eax, 0x60
shrd cx, ax, 0x20
movups xmmword [eax], xmm0
ror ecx, 0x13
mov ecx, 1
test ecx, ecx
jmp 0x1027c990
je 0x10197809
jmp 0x10197879
movaps xmm0, xmmword [ebp - 0xda10]
movaps xmmword [ebp - 0x1add0], xmm0
sal ax, cl
test edi, 0xb1a94c00
btr ax, si
mov edx, dword [ebp - 0xdea0]
movups xmm0, xmmword [edx + 0x50]
rcl eax, 0x31
movaps xmmword [ebp - 0x1adc0], xmm0
add cx, bp
movsx cx, al
btr ax, bx
movaps xmm0, xmmword [ebp - 0x1adc0]
neg ecx
xorps xmm0, xmmword [ebp - 0x1add0]
not ah
movaps xmmword [ebp - 0x1ade0], xmm0
movaps xmm0, xmmword [ebp - 0x1ade0]
and eax, 0x223fcf8b
mov eax, dword [ebp - 0xdea0]
lea eax, [eax + 0x50]
movups xmmword [eax], xmm0
rcr ecx, 0x88
mov ch, ch
mov ecx, 1
clc
test esi, edx
test ecx, ecx
je 0x100644ed
jmp 0x1006455c
movaps xmm0, xmmword [ebp - 0x1ad90]
setg ah
cbw
xorps xmm0, xmmword [ebp - 0x1ada0]
bsr eax, edi
movaps xmmword [ebp - 0x1adb0], xmm0
cmp esp, eax
shrd ax, si, 0
movaps xmm0, xmmword [ebp - 0x1adb0]
movsx ecx, sp
shl ah, 6
mov eax, dword [ebp - 0xdea0]
shl ecx, 0xac
lea eax, [eax + 0x40]
movups xmmword [eax], xmm0
mov ecx, 1
test ecx, ecx
jmp 0x1014b818
pushfd
add dword [esp + 4], 0xeff5f14f
push edi
mov edi, 0x433f1520
mov dword [esp + 8], 0x7da03690
mov edi, dword [esp + edi - 0x433f1520]
call fcn.1028c122
movaps xmm0, xmmword [ebp - 0xda20]
sal al, cl
movaps xmmword [ebp - 0x1ada0], xmm0
shrd edx, eax, 0x32
mov edx, dword [ebp - 0xdea0]
movups xmm0, xmmword [edx + 0x40]
movsx eax, bp
btc eax, edi
movaps xmmword [ebp - 0x1ad90], xmm0
jmp 0x10223a58

Function at 0x1028c122
Capabilities:
Parse pe header

Disassembly:
add dword [esp], 0xefd74dcf
push dword [esp + 8]
popfd
lea esp, [esp + 0xc]
call fcn.1021f525
Function at 0x77f530
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x2a7000]
push edi
jmp 0x77f54a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x77f551
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x77f540
mov eax, 1
add ebx, ebx
jne 0x77f563
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x77f574
jne 0x77f593
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x77f593
dec eax
add ebx, ebx
jne 0x77f580
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x77f558
add ebx, ebx
jne 0x77f58f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x77f5e5
xor ecx, ecx
sub eax, 3
jb 0x77f5ab
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x77f61a
sar eax, 1
mov ebp, eax
jmp 0x77f5b6
add ebx, ebx
jne 0x77f5b6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x77f584
inc ecx
add ebx, ebx
jne 0x77f5c4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x77f584
add ebx, ebx
jne 0x77f5d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x77f5c6
jne 0x77f5e2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x77f5c6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x77f604
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x77f5f6
jmp 0x77f546
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x77f604
add edi, ecx
jmp 0x77f546
pop esi
mov edi, esi
mov ecx, 0x467
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x77f622
cmp byte [edi], 7
jne 0x77f622
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x77f627
lea edi, [esi + 0x37d000]
mov eax, dword [edi]
or eax, eax
je 0x77f696
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x409214]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x409250]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x77f654
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x409258]
or eax, eax
je 0x77f690
mov dword [ebx], eax
add ebx, 4
jmp 0x77f671
call dword [esi + 0x409254]
mov ebp, dword [esi + 0x40925c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x247]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x77f6ca
sub esp, 0xffffff80
jmp 0x40125d
Function at 0x404b70
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aa7a0
mov eax, dword fs:[0]
push eax
sub esp, 0xac
mov eax, dword [0x4d82a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
lea ecx, [ebp - 0xac]
call fcn.00455090
cmp dword [ebx + 0x17c], 8
lea esi, [ebx + 0x168]
jb 0x404bbe
mov eax, dword [esi]
jmp 0x404bc0
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x404cc8
cmp dword [esi + 0x14], 8
jb 0x404bd7
mov esi, dword [esi]
push 0
push 0x80
push 4
push 0
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x404cc8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0xb0], eax
inc eax
push eax
mov dword [ebp - 0xb4], eax
call fcn.004139fb
mov edi, eax
add esp, 4
test edi, edi
je 0x404cc8
push dword [ebp - 0xb4]
push 0
push edi
call fcn.00462120
add esp, 0xc
lea eax, [ebp - 0xb8]
push 0
push eax
push dword [ebp - 0xb0]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xb0]
lea ecx, [ebp - 0xac]
push edi
call fcn.00455a2f
push edi
call fcn.00413a04
add esp, 4
lea eax, [ebp - 0x40]
lea ecx, [ebp - 0xac]
push eax
call fcn.00455299
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
call fcn.00456cc1
add esp, 8
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.00404810
cmp dword [ebp - 0x18], 0
jbe 0x404cc0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
mov ecx, ebx
cmovae eax, dword [ebp - 0x28]
push eax
push str.FileMD5
push str.AppSetting
call fcn.0045152a
lea ecx, [ebp - 0x28]
call fcn.0040bda0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00413a09
mov esp, ebp
pop ebp
ret
Function at 0x406720
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push esi
mov esi, ecx
je 0x406750
lea eax, [esi + 0x2bc]
push eax
push 0
push esi
push 0x406700
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x2b8], eax
pop esi
pop ebp
ret 4
call fcn.00406190
pop esi
pop ebp
ret 4

Function at 0x406760
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x4d82a4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x208
lea eax, [ebp - 0x20c]
mov esi, ecx
push 0
push eax
call fcn.00462120
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.00462120
add esp, 0x18
lea eax, [ebp - 0x20c]
push 0
push 0x2b
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp dword [esi + 0x11c], 8
lea ecx, [esi + 0x108]
jb 0x4067c3
mov ecx, dword [ecx]
lea edx, [ebp - 0x414]
nop dword [eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x4067d0
push edi
lea edi, [ebp - 0x20c]
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x4067f0
mov eax, dword [0x4af844]
lea edx, [ebp - 0x20c]
mov dword [edi], eax
add edx, 0xfffffffe
nop dword [eax]
mov cx, word [edx + 2]
lea edx, [edx + 2]
test cx, cx
jne 0x406810
mov ecx, dword [0x4af848]
lea edi, [ebp - 0x20c]
mov dword [edx], ecx
add edi, 0xfffffffe
mov ecx, dword [str.nSuZip]
mov dword [edx + 4], ecx
mov ecx, dword [0x4af850]
mov dword [edx + 8], ecx
mov ecx, dword [0x4af854]
mov dword [edx + 0xc], ecx
mov cx, word [0x4af858]
mov word [edx + 0x10], cx
mov cx, word [edi + 2]
lea edi, [edi + 2]
test cx, cx
jne 0x406853
mov dword [edi], eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00455eb7
add esp, 4
lea ecx, [ebp - 0x20c]
add ecx, 0xfffffffe
pop edi
nop word [eax + eax]
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x406880
mov eax, dword [0x4af848]
mov dword [ecx], eax
mov eax, dword [str.nSuZip]
mov dword [ecx + 4], eax
mov eax, dword [0x4af850]
mov dword [ecx + 8], eax
mov eax, dword [0x4af854]
mov dword [ecx + 0xc], eax
mov ax, word [0x4af858]
mov word [ecx + 0x10], ax
lea ecx, [ebp - 0x20c]
add ecx, 0xfffffffe
nop
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x4068c0
mov eax, dword [str..ini]
mov dword [ecx], eax
mov eax, dword [0x4afa00]
mov dword [ecx + 4], eax
mov ax, word [0x4afa04]
mov word [ecx + 8], ax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
push str.InstallPath
push str.AppCfg
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea eax, [ebp - 0x414]
mov ecx, esi
push eax
push str.InstallPath
call fcn.00406930
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00413a09
mov esp, ebp
pop ebp
ret
Function at 0x406930
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aa9b8
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push esi
push edi
mov eax, dword [0x4d82a4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x3c]
call fcn.00454f70
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], 0
call fcn.00454fa4
mov edi, dword [ebp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x406a08
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0
push eax
push 0xf013f
push 0
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x14], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x406a83
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push 0x4af848
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x4069de
push dword [ebp + 0xc]
call esi
jmp 0x406a83
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
push edi
push 1
push 0
push dword [ebp + 8]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x14]
call esi
push dword [ebp + 0xc]
call esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push 0xf003f
push 0
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x406a83
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push 0x4af848
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x406a7e
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
push edi
push 1
push 0
push dword [ebp + 8]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x18]
call esi
push dword [ebp - 0x10]
call esi
lea ecx, [ebp - 0x3c]
call fcn.00454f83
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x40ae30
Capabilities:
Get disk information
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa38
mov eax, dword [0x4d82a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, eax
push esi
mov esi, dword [ebp + 8]
push 0
push 0x4af804
mov dword [ebp - 0xa38], eax
call fcn.00407de0
push 0x20a
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00462120
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x105
push eax
push esi
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
jne 0x40ae9d
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00413a09
mov esp, ebp
pop ebp
ret 8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
push edi
push 0
push 0
call ebx
mov edi, eax
test edi, edi
je 0x40aef1
xor ecx, ecx
lea esi, [edi + 1]
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004139fb
push esi
mov esi, eax
mov dword [ebp - 0xa34], eax
push 0
push esi
call fcn.00462120
add esp, 0x10
push esi
push edi
call ebx
test eax, eax
jne 0x40af06
push esi
call fcn.00413a04
add esp, 4
pop edi
pop ebx
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00413a09
mov esp, ebp
pop ebp
ret 8
mov eax, dword [0x4b0200]
mov dword [ebp - 0xc], eax
mov ax, word [0x4b0204]
push 0x208
mov word [ebp - 8], ax
call fcn.004139fb
add esp, 4
mov ebx, eax
mov cx, word [esi]
lea eax, [ebp - 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
push 0x104
push ebx
push eax
mov word [ebp - 0xc], cx
call edi
test eax, eax
jne 0x40af8a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x40b019
push ebx
call fcn.00413a04
xor ecx, ecx
mov eax, 1
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004139fb
add esp, 8
mov ebx, eax
lea eax, [ebp - 0xc]
push 1
push ebx
push eax
call edi
test eax, eax
je 0x40b019
mov edi, ebx
lea ecx, [edi + 2]
nop
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x40af90
sub edi, ecx
lea eax, [ebp - 0x218]
sar edi, 1
push edi
push ebx
push eax
call fcn.00468bc8
add esp, 0xc
test eax, eax
je 0x40afc9
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x40afb4
cmp word [esi], ax
je 0x40b019
jmp 0x40af27
lea eax, [ebp - 0x218]
lea eax, [eax + edi*2]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x4b0208
lea eax, [ebp - 0xa18]
push 0x400
push eax
call fcn.0040b420
add esp, 0x14
lea eax, [ebp - 0xa18]
lea ecx, [ebp - 0xa30]
push eax
call fcn.00404610
mov ecx, dword [ebp - 0xa38]
push eax
call fcn.0040a220
lea ecx, [ebp - 0xa30]
call fcn.0040bda0
mov eax, dword [ebp - 0xa34]
push eax
call fcn.00413a04
push ebx
call fcn.00413a04
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
mov al, 1
pop edi
pop ebx
pop esi
call fcn.00413a09
mov esp, ebp
pop ebp
ret 8
Function at 0x40b050
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4d82a4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push edi
mov edi, dword [ebp + 8]
push 0x208
push 0
push eax
mov dword [ebp - 0x214], 0
call fcn.00462120
add esp, 0xc
push esi
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x40b0d8
lea eax, [ebp - 0x218]
push eax
push 4
lea eax, [ebp - 0x210]
push eax
push esi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x40b0d1
push 0x104
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x210]
push esi
call sub.PSAPI.DLL_GetModuleFileNameExW
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
mov word [edi], ax
cmp word [ebp - 0x20c], ax
jne 0x40b0f8
xor ecx, ecx
jmp 0x40b110
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40b101
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.00407de0
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.00413a09
mov esp, ebp
pop ebp
ret 8
Function at 0x40b140
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aae56
mov eax, dword fs:[0]
push eax
sub esp, 0x470
mov eax, dword [0x4d82a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x478], ecx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x230]
xor eax, eax
mov dword [ebp - 0x47c], 0
push eax
push 0x4af804
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
call fcn.00407de0
push 0x22c
lea eax, [ebp - 0x474]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.00462120
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x40b1fe
push 0x4af804
mov ecx, ebx
call fcn.00404610
mov ecx, dword [ebp - 0x21c]
cmp ecx, 8
jb 0x40b3bd
inc ecx
push ecx
jmp 0x40b3ac
lea eax, [ebp - 0x474]
mov dword [ebp - 0x474], 0x22c
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x40b377
nop dword [eax]
xor eax, eax
mov dword [ebp - 0x234], 7
mov dword [ebp - 0x238], 0
mov word [ebp - 0x248], ax
cmp word [ebp - 0x450], ax
jne 0x40b24a
xor ecx, ecx
jmp 0x40b262
lea ecx, [ebp - 0x450]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40b253
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x450]
push eax
lea ecx, [ebp - 0x248]
call fcn.00407de0
mov esi, dword [ebp - 0x46c]
mov byte [ebp - 4], 1
cmp esi, dword [ebp + 0xc]
je 0x40b2c0
mov eax, dword [ebp - 0x234]
mov byte [ebp - 4], 0
cmp eax, 8
jb 0x40b2a6
inc eax
lea ecx, [ebp - 0x248]
push eax
push dword [ebp - 0x248]
call fcn.00407fb0
lea eax, [ebp - 0x474]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x40b220
jmp 0x40b377
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00462120
add esp, 0xc
push esi
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x40b365
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0
push esi
call sub.PSAPI.DLL_GetModuleFileNameExW
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00408e70
lea eax, [ebp - 0x230]
push 0x4af804
push eax
call fcn.0040a0b0
add esp, 8
test al, al
je 0x40b365
mov ecx, dword [ebp - 0x478]
lea eax, [ebp - 0x230]
push eax
push esi
call fcn.0040ae30
lea eax, [ebp - 0x230]
push 0x4af804
push eax
call fcn.0040a0b0
add esp, 8
test al, al
je 0x40b365
lea eax, [ebp - 0x450]
push eax
lea ecx, [ebp - 0x230]
call fcn.00408e70
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x248]
call fcn.0040bda0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov dword [ebx + 0x14], 7
mov dword [ebx + 0x10], 0
mov ecx, ebx
mov word [ebx], ax
lea eax, [ebp - 0x230]
push eax
call fcn.00406e90
mov eax, dword [ebp - 0x21c]
cmp eax, 8
jb 0x40b3bd
inc eax
push eax
push dword [ebp - 0x230]
lea ecx, [ebp - 0x230]
call fcn.00407fb0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00413a09
mov esp, ebp
pop ebp
ret 8