joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40126d
Capabilities:
Accept command line arguments
Delete file
Move file
Print debug messages
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4012a4
cmp dword [ebp - 4], 2
je 0x4012b7
push 0x4021f4
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
or eax, 0xffffffff
jmp 0x4013fc
mov eax, dword [ebp - 0x10]
cmp dword [eax + 4], 0
jne 0x4012d3
push 0x4021fc
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
or eax, 0xffffffff
jmp 0x4013fc
push str.GetSEHandle_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call fcn.00401140
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4013a5
push str.GetSEHandle_done_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
push dword [eax + 4]
push 0x404860
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push 0x404860
push section..data
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push str..old
push section..data
call dword [sym.imp.SHLWAPI.dll_StrCatW]
push section..data
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.After_DeleteFile_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
or dword [ebp - 0x14], 0xffffffff
push section..data
push 0x404860
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x401388
push str.After_MoveFile_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [ebp - 0x10]
push dword [eax + 4]
call fcn.00401012
pop ecx
mov dword [ebp - 0x14], eax
push str.After_CopyExe_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], 0
jl 0x4013a5
push 1
call fcn.004011d9
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
inc eax
je 0x4013d0
call fcn.00401140
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4013ba
jmp 0x4013d0
push 0xffffffffffffffff
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4013a5
mov eax, dword [ebp - 0x10]
push dword [eax + 4]
call fcn.00401012
pop ecx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
setge al
push eax
call fcn.004011d9
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
leave
ret
Function at 0x40141e
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x214
lea eax, [esp]
push ebp
push esi
mov esi, dword [esp + 0x228]
push edi
mov edi, dword [esp + 0x22c]
and esi, 0x300
push eax
mov eax, esi
and edi, 1
or eax, 9
push eax
push dword [esp + 0x230]
push dword [esp + 0x230]
call fcn.00406491
test eax, eax
jne 0x401527
xor ebp, ebp
test byte [esp + 0x22c], 2
je 0x401493
push ebp
push ebp
push ebp
push ebp
lea eax, [esp + 0x20]
mov dword [esp + 0x20], ebp
push eax
lea eax, [esp + 0x28]
push eax
push ebp
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
jne 0x401503
push 0x105
lea eax, [esp + 0x18]
push eax
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
jmp 0x4014ce
test edi, edi
jne 0x401503
push dword [esp + 0x22c]
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x14]
call fcn.0040141e
test eax, eax
jne 0x4014d8
push 0x105
lea eax, [esp + 0x18]
push eax
push edi
push dword [esp + 0x18]
call ebp
test eax, eax
je 0x4014a6
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.00406a9f
test eax, eax
jne 0x401514
push dword [esp + 0x228]
push dword [esp + 0x228]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x401527
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x3eb
jmp 0x401527
push 0
push esi
push dword [esp + 0x230]
push dword [esp + 0x230]
call eax
pop edi
pop esi
pop ebp
add esp, 0x214
ret 0xc
Function at 0x40330b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
push edi
xor edi, edi
test ecx, ecx
js 0x403334
mov eax, dword [0x429598]
push edi
add eax, ecx
push edi
push eax
push dword [0x40a014]
mov dword [0x40c954], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
call fcn.0040318c
test eax, eax
js 0x40340a
push ebx
push esi
push 4
lea eax, [ebp + 8]
push eax
push dword [0x40a014]
call fcn.00406b01
test eax, eax
je 0x403405
push dword [ebp + 8]
add dword [0x40c954], 4
call fcn.0040318c
mov esi, eax
test esi, esi
js 0x403401
cmp dword [ebp + 0x10], edi
jne 0x4033d5
mov ecx, dword [ebp + 8]
test ecx, ecx
jle 0x403401
mov ebx, 0x4000
mov edi, 0x4149f8
cmp ecx, ebx
mov eax, ebx
cmovl eax, ecx
push eax
push edi
push dword [0x40a014]
mov dword [ebp - 4], eax
call fcn.00406b01
test eax, eax
je 0x403405
push dword [ebp - 4]
push edi
push dword [ebp + 0xc]
call fcn.00406bc4
test eax, eax
je 0x4033d1
mov eax, dword [ebp - 4]
add esi, eax
mov ecx, dword [ebp + 8]
add dword [0x40c954], eax
sub ecx, eax
mov dword [ebp + 8], ecx
test ecx, ecx
jg 0x40338d
jmp 0x403401
push 0xfffffffffffffffe
jmp 0x403407
push edi
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0x14]
cmp dword [ebp + 8], eax
cmovl eax, dword [ebp + 8]
push eax
push dword [ebp + 0x10]
push dword [0x40a014]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x403405
mov esi, dword [ebp - 4]
add dword [0x40c954], esi
mov eax, esi
jmp 0x403408
push 0xfffffffffffffffd
pop eax
pop esi
pop ebx
pop edi
leave
ret 0x10

Function at 0x40342d
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
cmp dword [ebp + 8], 0
je 0x403455
mov eax, dword [0x40c968]
test eax, eax
je 0x40344c
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
and dword [0x40c968], 0
leave
ret
cmp dword [0x40c968], 0
je 0x403467
push 0
call fcn.004063c8
leave
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [0x429540]
jbe 0x4034d1
cmp dword [0x428538], 0
je 0x4034ac
test byte [0x429634], 1
je 0x4034d1
call fcn.0040340f
push eax
lea eax, [ebp - 0x80]
push str....__d__
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
push 0
call fcn.00405f02
leave
ret
push 0
push 0x40378b
push 0
push 0x6f
push dword [0x428534]
call dword [sym.imp.USER32.dll_CreateDialogParamW]
push 5
push eax
mov dword [0x40c968], eax
call dword [sym.imp.USER32.dll_ShowWindow]
leave
ret
Function at 0x405fe6
Capabilities:
Create directory

Disassembly:
push esi
xor esi, esi
push esi
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x406000
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, esi
pop esi
ret 4
Function at 0x406357
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
lea eax, [ebp - 0x23c]
push esi
mov esi, 0x104
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
ja 0x406391
test eax, eax
je 0x406391
add eax, eax
cmp word [ebp + eax - 0x23e], 0x5c
je 0x406393
mov ecx, 0x4082a8
jmp 0x406398
xor eax, eax
mov ecx, 0x4082aa
push dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x23c]
add eax, ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x4063f6
Capabilities:
Move file

Disassembly:
push 5
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x406419
push dword [esp + 8]
push dword [esp + 8]
call fcn.004064bf
pop ecx
pop ecx
inc dword [0x429610]
ret 8

Function at 0x4064bf
Capabilities:
Get file size

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
mov ebx, 0x400
mov dword [0x426680], 0x55004e
mov ebp, 0x426680
mov dword [0x426684], 0x4c
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test esi, esi
je 0x406515
push 1
push 0
push esi
call fcn.00406ad4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push ebp
push esi
call edi
test eax, eax
je 0x4065f5
cmp eax, ebx
jg 0x4065f5
push ebx
mov esi, 0x425e80
push esi
push dword [esp + 0x1c]
call edi
test eax, eax
je 0x4065f5
cmp eax, ebx
jg 0x4065f5
push esi
push ebp
push str._ls_ls_r_n
push 0x425a80
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [0x429550]
add esp, 0x10
mov ebp, eax
push dword [ecx + 0x128]
push esi
call fcn.00406061
push 4
push 0xc0000000
push esi
call fcn.00406ad4
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4065f5
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea ecx, [ebp + 0xa]
add ecx, esi
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x4065ee
push esi
push edi
push ebx
call fcn.00406b01
test eax, eax
je 0x4065ee
push str._Rename__r_n
push edi
call fcn.00406cef
test eax, eax
jne 0x4065fa
push str._Rename__r_n
lea eax, [edi + esi]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esi, 0xa
mov ecx, esi
push ebp
push 0x425a80
lea eax, [ecx + edi]
push eax
call fcn.0040686d
xor eax, eax
push eax
push eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esi + ebp]
push eax
push edi
push ebx
call fcn.00406bc4
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
ret
push 0x4089bc
add eax, 0xa
push eax
call fcn.00406cef
mov ecx, eax
test ecx, ecx
je 0x4065bf
lea edx, [edi + esi]
jmp 0x406619
mov al, byte [edx]
mov byte [edx + ebp], al
dec edx
cmp edx, ecx
ja 0x406613
sub ecx, edi
inc ecx
jmp 0x4065c1
Function at 0x40673e
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 8]
call fcn.00406d56
mov edi, eax
cmp edi, 0xffffffff
je 0x406781
test byte [ebp + 0xc], 1
push dword [ebp + 8]
je 0x406762
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x406768
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x406771
xor eax, eax
inc eax
jmp 0x406783
test byte [ebp + 0xc], 4
jne 0x406781
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor eax, eax
pop edi
pop ebp
ret 8

Function at 0x4067f1
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push dword [esp + 0xc]
mov ebx, 0x425280
push ebx
call fcn.00406cd3
push ebx
call fcn.00406d7e
mov esi, eax
test esi, esi
je 0x406866
push esi
call fcn.00406ef6
test byte [0x42954c], 0x80
je 0x40682a
movzx eax, word [esi]
test ax, ax
je 0x406866
cmp eax, 0x5c
je 0x406866
sub esi, ebx
sar esi, 1
jmp 0x406844
call fcn.00406788
test eax, eax
je 0x40683e
test byte [eax], 0x10
je 0x406866
push ebx
call fcn.00406ec9
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
cmp eax, esi
jg 0x406830
call fcn.0040670f
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x406866
xor eax, eax
inc eax
jmp 0x406868
xor eax, eax
pop esi
pop ebx
ret 4

Function at 0x40688f
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x424a38], 0x44
lea eax, [ebp - 0x10]
push eax
push 0x424a38
xor eax, eax
push eax
push eax
push 0x4000000
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4068ce
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4
Function at 0x4068d2
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x25c
push ebx
mov ebx, dword [esp + 0x268]
push esi
mov esi, dword [esp + 0x268]
push edi
mov edi, ebx
push esi
and edi, 4
call fcn.004067f1
mov dword [esp + 0x14], eax
test bl, 8
je 0x406914
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
inc eax
add dword [0x429608], eax
jmp 0x406a93
push ebp
mov ebp, ebx
and ebp, 1
mov dword [esp + 0x14], ebp
je 0x406931
test eax, eax
je 0x406a82
test bl, 2
je 0x406a4b
push esi
push 0x424a80
call fcn.00406cd3
test ebp, ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcatW]
je 0x406954
push str..
push 0x424a80
call ebp
jmp 0x40695a
push esi
call fcn.00406ec9
xor eax, eax
cmp word [esi], ax
jne 0x40696b
cmp word [0x424a80], 0x5c
jne 0x406973
push 0x4082a8
push esi
call ebp
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esi + eax*2]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x1c]
push eax
push 0x424a80
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x406a34
push 0x2e
pop eax
cmp word [esp + 0x48], ax
jne 0x4069bd
cmp word [esp + 0x4a], 0
je 0x406a16
cmp word [esp + 0x4a], ax
jne 0x4069bd
cmp word [esp + 0x4c], 0
je 0x406a16
lea eax, [esp + 0x48]
push eax
push dword [esp + 0x14]
call fcn.00406cd3
test byte [esp + 0x1c], 0x10
je 0x4069e4
mov eax, ebx
and eax, 3
cmp al, 3
jne 0x406a16
push ebx
push esi
call fcn.004068d2
jmp 0x406a16
push edi
push esi
call fcn.0040673e
test eax, eax
jne 0x406a0e
test edi, edi
je 0x406a06
push esi
push 0xfffffffffffffff1
call fcn.00405f02
xor eax, eax
push eax
push esi
call fcn.004063f6
jmp 0x406a16
inc dword [0x429608]
jmp 0x406a16
push esi
push 0xfffffffffffffff2
call fcn.00405f02
lea eax, [esp + 0x1c]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x40699f
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [esp + 0x14], 0
je 0x406a92
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov word [eax - 2], cx
cmp dword [esp + 0x18], ecx
je 0x406a82
push esi
call fcn.00406788
test eax, eax
je 0x406a92
push esi
call fcn.0040670f
mov eax, edi
or eax, 1
push eax
push esi
call fcn.0040673e
test eax, eax
jne 0x406a8a
test edi, edi
je 0x406a82
push esi
push 0xfffffffffffffff1
call fcn.00405f02
xor eax, eax
push eax
push esi
call fcn.004063f6
jmp 0x406a92
inc dword [0x429608]
jmp 0x406a92
push esi
push 0xffffffffffffffe5
call fcn.00405f02
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x25c
ret 8

Function at 0x406ad4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
push 0
cmove eax, ecx
push eax
push dword [esp + 0x14]
push ecx
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
ret 0xc
Function at 0x406b30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
lea eax, [ebp - 4]
mov dword [ebp - 8], 0x800
push eax
mov eax, dword [ebp + 0x18]
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00406491
mov edi, dword [ebp + 0x14]
test eax, eax
jne 0x406ba2
push esi
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp + 0x18]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
mov word [edi + 0x7fe], ax
pop esi
jne 0x406ba2
cmp dword [ebp + 0x18], 1
je 0x406ba7
cmp dword [ebp + 0x18], 2
je 0x406ba7
xor eax, eax
mov word [edi], ax
pop edi
leave
ret 0x14

Function at 0x406bac
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push eax
and dword [eax + 0x24], 0
mov dword [eax], 0x3c
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
ret 4

Function at 0x406c0f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp - 8], 0x73006e
mov dword [ebp - 4], 0x61
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
pop ecx
xor edx, edx
div ecx
push esi
add word [ebp - 4], dx
lea eax, [ebp - 8]
push 0
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x406c59
test edi, edi
jne 0x406c1c
mov word [esi], ax
jmp 0x406c5b
mov eax, esi
pop edi
pop esi
leave
ret 8

Function at 0x406d56
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x406d78
mov ecx, esi
and ecx, 0xfffffffe
push ecx
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4

Function at 0x406ff5
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4270d4], 0
push esi
jne 0x40702f
xor ecx, ecx
push 8
mov edx, ecx
pop esi
mov eax, edx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr edx, 1
and eax, 0xedb88320
xor edx, eax
sub esi, 1
jne 0x407006
mov dword [ecx*4 + 0x4270d0], edx
inc ecx
cmp ecx, 0x100
jl 0x407001
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x10]
not ecx
test edx, edx
je 0x407059
mov esi, dword [esp + 0xc]
movzx eax, byte [esi]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4270d0]
inc esi
sub edx, 1
jne 0x407041
not ecx
mov eax, ecx
pop esi
ret 0xc
Function at 0x122f6
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ntoskrnl.exe_KeQuerySystemTime]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ntoskrnl.exe_ExSystemTimeToLocalTime]
lea eax, [ebp - 8]
push eax
call fcn.000120d8
movzx ecx, byte [ebp - 4]
movzx eax, byte [ebp - 3]
add eax, ecx
movzx ecx, byte [ebp - 5]
add eax, ecx
movzx ecx, byte [ebp - 6]
add ecx, dword [ebp - 0x10]
push 0x21f60
add ecx, eax
mov dword [ebp - 0x10], ecx
call dword [sym.imp.ntoskrnl.exe_RtlGetVersion]
test eax, eax
jne 0x12365
cmp dword [0x21f64], 6
jb 0x12365
push dword [ebp - 0x10]
call dword [sym.imp.ntoskrnl.exe_srand]
pop ecx
call dword [sym.imp.ntoskrnl.exe_rand]
leave
ret
mov ecx, dword [ebp - 0x10]
mov eax, 0x3039
test ecx, ecx
jne IoGetRelatedDeviceObject
mov ecx, dword [0x1f178]
imul ecx, ecx, 0x41c64e6d
add ecx, eax
imul ecx, ecx, 0x3e39b193
sub eax, ecx
shr eax, 0x10
and eax, 0x7fff
leave
ret

Function at 0x12f96
Capabilities:
Create device object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
xor edi, edi
push 0x1c646
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 4], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0x80
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ntoskrnl.exe_IoGetDeviceObjectPointer]
mov esi, eax
cmp esi, edi
jge 0x12feb
mov ecx, dword [ebp - 8]
cmp ecx, edi
je 0x12fe4
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, esi
jmp 0x13078
push ebx
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0xc]
push edi
push dword [eax + 0x20]
push dword [eax + 0x2c]
push edi
push 0x14
pop esi
push esi
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_IoCreateDevice]
mov ebx, eax
cmp ebx, edi
jge 0x13019
mov ecx, dword [ebp]
shr byte [eax + ecx*4 - 0x32], 1
add bl, ch
pop esp
push dword [ebp - 0xc]
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_IoAttachDeviceToDeviceStack]
mov edx, eax
cmp edx, edi
jne 0x13039
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
mov dword [ebp - 4], edi
jmp 0x1300e
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x28]
xor eax, eax
mov edi, ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ecx], esi
mov eax, dword [ebp - 4]
mov dword [ecx + 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 8]
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], edx
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx + 0x1c]
mov eax, dword [ebp - 4]
and ecx, esi
or dword [eax + 0x1c], ecx
mov eax, dword [ebp - 4]
mov dword [0x1f194], eax
mov eax, ebx
pop ebx
pop edi
pop esi
leave
ret 4
Function at 0x16f7a
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1f108]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x18], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, 0x4000
push esi
call fcn.00015866
mov edi, eax
test edi, edi
jne 0x16fbb
mov eax, dword [0x1f1c8]
test eax, eax
je 0x16fb3
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
jmp 0x17104
push 0x11
push 2
push 2
call fcn.000109a4
add esp, 0xc
mov dword [ebp - 0x1c], eax
cmp eax, 0xffffffff
jne 0x16fed
push edi
call fcn.00015880
mov eax, dword [0x1f1c8]
test eax, eax
jne 0x16fb0
push 0x1ca0e
call sub.ntoskrnl.exe_DbgPrint
pop ecx
jmp 0x16fb3
push esi
push 0
push edi
call sub.ntoskrnl.exe_memset
add esp, 0xc
push ebx
push edi
call fcn.00016e0c
push 2
mov dword [ebp - 0x24], eax
pop eax
push 0x35
mov word [ebp - 0x14], ax
call 0x10109fe
shr byte [eax + ecx*4 + 0x45], 0xee
call fcn.00016d22
push 0x10
pop ebx
push ebx
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp - 0x24]
push edi
push dword [ebp - 0x1c]
call fcn.00010904
add esp, 0x18
mov dword [ebp - 0x20], eax
test eax, eax
jge 0x17094
push edi
call fcn.00015880
push dword [ebp - 0x1c]
call fcn.00010542
cmp dword [ebp - 0x20], 0xc0000022
mov eax, dword [0x1f1c8]
pop ecx
jne 0x17079
test eax, eax
jne 0x1706e
mov eax, dword [0x1f1c4]
and eax, 3
mov eax, dword [eax*4 + 0x1d424]
inc dword [0x1f1c4]
jmp 0x16fb0
test eax, eax
jne 0x16fb0
push dword [ebp - 0x20]
push 0x1c9f0
call sub.ntoskrnl.exe_DbgPrint
pop ecx
jmp 0x16fea
push esi
push 0
push edi
mov dword [ebp - 0x20], ebx
call sub.ntoskrnl.exe_memset
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push esi
push edi
push dword [ebp - 0x1c]
call fcn.0001082a
mov esi, eax
add esp, 0x24
test esi, esi
jge 0x170e1
push edi
call fcn.00015880
push dword [ebp - 0x1c]
call fcn.00010542
mov eax, dword [0x1f1c8]
pop ecx
test eax, eax
jne 0x16fb0
push esi
push 0x1c9ce
jmp 0x17089
push esi
push edi
call fcn.00016ee2
mov esi, eax
test esi, esi
jne 0x170f9
mov eax, dword [0x1f1c8]
test eax, eax
je 0x170f9
mov esi, eax
push dword [ebp - 0x1c]
call fcn.00010542
pop ecx
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0001b175
leave
ret 4
Function at 0x1ae74
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
mov edi, dword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
xor esi, esi
push esi
push 1
mov dword [ebp - 4], esi
push 0x2122c
mov dword [0x21220], 1
mov dword [0x21224], esi
mov dword [0x21228], esi
call edi
push esi
push 1
push 0x21270
call edi
push esi
push 0x1ac12
push esi
push esi
lea eax, [ebp - 0x1c]
push eax
mov edi, 0x1f03ff
push edi
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0x1c], 0x18
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], 0x200
mov dword [ebp - 0x14], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
call dword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
cmp eax, esi
jl 0x1af0c
push esi
push 0x21280
push esi
push esi
push edi
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, esi
pop edi
pop esi
leave
ret

Function at 0x220be
Capabilities:
Create device object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
call fcn.00022085
pop ebp
jmp fcn.00012afa

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx