joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e9d0
Capabilities:
Delete registry value
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x33c
mov eax, dword [0x4315b8]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x130], 0x114
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x120], 2
jne 0x40ea0c
mov dword [ebp - 4], 0x80000001
jmp 0x40ea13
mov dword [ebp - 4], 0x80000002
lea ecx, [ebp - 0x33c]
push ecx
lea edx, [ebp - 0x10]
push edx
push 0
push 3
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40ea47
xor eax, eax
jmp 0x40eae2
cmp dword [ebp + 8], 0
je 0x40eaa0
push 0x104
lea ecx, [ebp - 0x338]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [ebp - 0x338]
push edx
call fcn.004129b4
add esp, 4
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x338]
push ecx
push 1
push 0
push str.UniKey
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 8], eax
xor eax, eax
cmp dword [ebp - 8], 0
sete al
mov dword [ebp - 0xc], eax
jmp 0x40ead5
push str.UniKey
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 0
push 0
push 0
push 0
push str.UniKey
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 8], eax
xor eax, eax
cmp dword [ebp - 8], 0
setne al
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041256e
mov esp, ebp
pop ebp
ret

Function at 0x40eaf0
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x4315b8]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x128], 0x114
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x118], 2
jne 0x40eb2c
mov dword [ebp - 4], 0x80000001
jmp 0x40eb33
mov dword [ebp - 4], 0x80000002
lea ecx, [ebp - 0xc]
push ecx
push 3
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40eb57
xor eax, eax
jmp 0x40eb84
push 0
push 0
push 0
push 0
push str.UniKey
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [ebp - 8], 0
sete al
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041256e
mov esp, ebp
pop ebp
ret
Function at 0x41256e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4315b8]
jne 0x412578
repz ret
jmp fcn.00414f75

Function at 0x41c2fc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x41c32d
call fcn.00417127
mov dword [eax], esi
call fcn.00417114
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.004170ac
add esp, 0x14
push 0x16
pop eax
jmp 0x41c382
test dword [ebp + 0xc], 0xfffffff9
jne 0x41c309
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x41c35a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0041713a
pop ecx
call fcn.00417114
mov eax, dword [eax]
jmp 0x41c382
test al, 0x10
jne 0x41c380
test al, 1
je 0x41c380
test byte [ebp + 0xc], 2
je 0x41c380
call fcn.00417127
mov dword [eax], 5
call fcn.00417114
mov dword [eax], 0xd
jmp 0x41c351
xor eax, eax
pop esi
pop ebp
ret

Function at 0x41f7fc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00415da6
and dword [ebp - 4], 0
cmp dword [0x45eb60], 0
mov ebx, eax
jne 0x41f8ad
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41f95e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x42a534
push edi
call esi
test eax, eax
je 0x41f95e
push eax
call fcn.00415d34
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x45eb60], eax
call esi
push eax
call fcn.00415d34
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x45eb64], eax
call esi
push eax
call fcn.00415d34
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x45eb68], eax
call esi
push eax
call fcn.00415d34
pop ecx
mov dword [0x45eb70], eax
test eax, eax
je 0x41f8ad
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00415d34
pop ecx
mov dword [0x45eb6c], eax
mov eax, dword [0x45eb6c]
cmp eax, ebx
je 0x41f905
cmp dword [0x45eb70], ebx
je 0x41f905
push eax
call fcn.00415daf
push dword [0x45eb70]
mov esi, eax
call fcn.00415daf
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41f905
test edi, edi
je 0x41f905
call esi
test eax, eax
je 0x41f8fc
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41f8fc
test byte [ebp - 0xc], 1
jne 0x41f905
or dword [ebp + 0x10], 0x200000
jmp 0x41f93e
mov eax, dword [0x45eb64]
cmp eax, ebx
je 0x41f93e
push eax
call fcn.00415daf
pop ecx
test eax, eax
je 0x41f93e
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41f93e
mov eax, dword [0x45eb68]
cmp eax, ebx
je 0x41f93e
push eax
call fcn.00415daf
pop ecx
test eax, eax
je 0x41f93e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x45eb60]
call fcn.00415daf
pop ecx
test eax, eax
je 0x41f95e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41f960
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x423630
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 0x14], 0
je 0x423646
xor eax, eax
jmp 0x4236b8
cmp dword [ebp + 0xc], 0xffffffff
jne 0x42367d
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00423f7e
add esp, 8
xor ecx, ecx
cmp eax, 0xffffffff
sete cl
mov edx, dword [ebp - 8]
mov dword [edx + 0x14], ecx
mov eax, dword [ebp - 8]
xor ecx, ecx
cmp dword [eax + 0x14], 0
sete cl
mov eax, ecx
jmp 0x4236b8
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call fcn.00423efc
add esp, 0x10
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
xor ecx, ecx
cmp eax, dword [ebp + 0xc]
setne cl
mov edx, dword [ebp - 8]
mov dword [edx + 0x14], ecx
mov eax, dword [ebp - 8]
xor ecx, ecx
cmp dword [eax + 0x14], 0
sete cl
mov eax, ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x401ca4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x401cb3
pop dword [ebp - 0x48]
mov eax, 0x401cb3
sub dword [ebp - 0x48], eax
push 0x40
push 0x1000
push 0x3722d
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x48]
call dword [eax]
mov ecx, 0xa748729a
add ecx, 0x58b7cd0c
xor edx, edx
add edx, eax
mov edi, 0x413bc4
add edi, dword [ebp - 0x48]
mov esi, 0x262cb6b5
sub esi, 0x8aa01a33
xor dword [ebp - 0x3c], edi
mov ebx, dword [edi]
add dword [ebp - 0x30], esi
sub ebx, esi
mov dword [edx], ebx
add dword [ebp - 8], eax
add edx, 0x5e0302e3
add edx, 0xa1fcfd21
add edi, 4
loop 0x401d04
add eax, 0xcecf7a32
sub eax, 0xcece88c7
xor ebx, ebx
add ebx, eax
add eax, 0xa60ec7e1
sub eax, 0xa60ec7dc
mov ecx, 0xec605584
add ecx, 0x13dfaa7c
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.00401ca4
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.00401ca4
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.00401ca4
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.00401ca4
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.00401ca4
mov dword [0x41203c], eax
call fcn.00401ca4
test eax, eax
jge 0x402550
push 8
call fcn.00401ca4
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.00401ca4
pop ecx
push 1
call fcn.00401ca4
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.00401ca4
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.00401ca4
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.00401ca4
jmp 0x402495
Function at 0x10041536
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x10041545
pop dword [ebp - 0x28]
mov eax, 0x791d8c04
sub eax, 0x691976bf
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x67674d3b
add dword [ebp - 0x38], 0xe6eaf810
mov dword [ebp - 0x34], 0x3f1f5feb
add dword [ebp - 0x34], 0xf313ec5a
mov dword [ebp - 0x30], 0xd36ed051
add dword [ebp - 0x30], 0x78dd73dd
mov dword [ebp - 0x2c], 0x7b738c60
sub dword [ebp - 0x2c], 0x7b738c60
lea eax, [ebp - 0x38]
push eax
mov eax, 0x43912b1f
sub eax, 0x338b2b0f
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0xc3df249a
sub dword [ebp - 0x38], 0x4f6cbb44
mov dword [ebp - 0x34], 0x3843e47b
add dword [ebp - 0x34], 0x9287cfa
mov dword [ebp - 0x30], 0x269dc97
add dword [ebp - 0x30], 0x61058fd5
mov dword [ebp - 0x2c], 0xc851070f
add dword [ebp - 0x2c], 0x37aef8f1
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0xa759edf9
add eax, 0x68ac121b
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x56357
push 0
call eax
mov ecx, 0xbe93c575
add ecx, 0x416c8375
mov edi, eax
mov edx, 0xa8e92c7e
sub edx, 0x98e0707e
add edx, dword [ebp - 0x28]
mov esi, 0xb09989da
add esi, 0x8285eeac
xor dword [ebp - 0x24], edx
mov ebx, dword [edx]
add dword [ebp - 0x1c], 0xec2cb7c6
xor ebx, esi
sub dword [ebp - 8], 0x636b3708
mov dword [edi], ebx
xor dword [ebp - 0x10], 0xb84e1fd7
add edi, 4
add edx, 0x9424fd2f
add edx, 0x6bdb02d5
loop 0x10041667
add eax, 0x9419227e
add eax, 0x6be7f3fd
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x2721da6f
sub ecx, 0x1721da6f
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x1002aadf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x1002aaee
pop dword [ebp - 0x1c]
mov eax, 0x1002aaee
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x5e8ed0cb
add dword [ebp - 0x2c], 0xefc37480
mov dword [ebp - 0x28], 0xd851ca7f
sub dword [ebp - 0x28], 0xa61e7e3a
mov dword [ebp - 0x24], 0x308fb3ea
sub dword [ebp - 0x24], 0xe4436fbc
mov dword [ebp - 0x20], 0x49e9791e
sub dword [ebp - 0x20], 0x49e9791e
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x664f505d
sub eax, 0x564c9025
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x1b242a47
add dword [ebp - 0x2c], 0x594e3f0f
mov dword [ebp - 0x28], 0xbfb32a88
sub dword [ebp - 0x28], 0x7e46c913
mov dword [ebp - 0x24], 0xf3b6e551
add dword [ebp - 0x24], 0x6fb8871b
mov dword [ebp - 0x20], 0x952245b3
add dword [ebp - 0x20], 0x6addba4d
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0x9ee875df
add eax, 0x711a4a49
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x3a124
push 0
call eax
mov ecx, 0x24ce1b4f
add ecx, 0xdb323b1b
mov ebx, eax
mov edi, 0xee80c39e
sub edi, 0xde7d2d9e
add edi, dword [ebp - 0x1c]
mov edx, 0x5c83c641
sub edx, 0x463d000
add dword [ebp - 0x10], 0xdd4c1b4
mov esi, dword [edi]
xor esi, edx
xor dword [ebp - 0x14], edi
mov dword [ebx], esi
sub dword [ebp - 0x14], edx
add ebx, 0xed527fa4
add ebx, 0x12ad8060
add edi, 0x451835a0
sub edi, 0x4518359c
loop 0x1002ac0b
add eax, 0x7958626b
add eax, 0x86a8ea10
mov ebx, eax
add eax, 5
mov ecx, 0x94f7b2f8
sub ecx, 0x84f7b2f8
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x40610d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x40611c
pop dword [ebp - 0x48]
mov eax, 0xd20dde5b
add eax, 0x2e3282c1
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x69ae94e1
sub dword [ebp - 0x58], 0x1b5c4f96
mov dword [ebp - 0x54], 0x555d697c
add dword [ebp - 0x54], 0xdcd5e2c9
mov dword [ebp - 0x50], 0x87a9ae4a
add dword [ebp - 0x50], 0xc4a295e4
mov dword [ebp - 0x4c], 0x1a74f35e
sub dword [ebp - 0x4c], 0x1a74f35e
lea eax, [ebp - 0x58]
push eax
mov eax, 0xdb3c3af7
sub eax, 0xdafbca97
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x3fe2e729
sub dword [ebp - 0x58], 0xcb707dd3
mov dword [ebp - 0x54], 0xb58ed6fd
sub dword [ebp - 0x54], 0x74227588
mov dword [ebp - 0x50], 0xd0a06800
sub dword [ebp - 0x50], 0x6d30fb94
mov dword [ebp - 0x4c], 0x9406909a
sub dword [ebp - 0x4c], 0x9406909a
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0x4d0d841c
sub eax, 0x4ccd131c
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x35a07
push 0
call eax
mov ecx, 0x4413
mov esi, eax
mov edi, 0x410000
add edi, dword [ebp - 0x48]
mov ebx, 0x5c51a13e
add ebx, 0x662df57f
sub dword [ebp - 0x24], 0xc076b8de
mov edx, dword [edi]
mov dword [ebp - 0x24], 0x9864e8b7
xor edx, ebx
add dword [ebp - 4], ebx
mov dword [esi], edx
sub dword [ebp - 0x14], esi
add esi, 4
add edi, 0x51a1670f
add edi, 0xae5e98f5
loop 0x406232
add eax, 0xd9324822
sub eax, 0xd9314503
mov ebx, eax
add eax, 0x3344b898
sub eax, 0x3344b893
mov ecx, 0xa38b6d52
sub ecx, 0xa34b6d52
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x452b5d
Capabilities:
Encode data using xor

Disassembly:
push esi
xor eax, eax
push edi
mov edi, dword [esp + 0x10]
shr edi, 2
mov ecx, edi
dec edi
test ecx, ecx
je 0x452b8b
mov edx, dword [esp + 0xc]
mov esi, dword [esp + 0x14]
mov ecx, esi
mov esi, dword [edx]
add eax, esi
xor ecx, esi
mov dword [edx], ecx
add edx, 4
mov ecx, edi
dec edi
test ecx, ecx
jne 0x452b77
pop edi
pop esi
ret

Function at 0x452c23
Capabilities:
Inspect section memory permissions

Disassembly:
mov ecx, dword [esp + 8]
mov eax, dword [esp + 4]
imul ecx, ecx, 0x28
mov ecx, dword [ecx + eax + 0x24]
test ecx, 0x20000000
je 0x452c5c
test ecx, 0x40000000
je 0x452c55
mov eax, ecx
and eax, 0x80000000
cmp eax, 1
sbb eax, eax
and al, 0xe0
add eax, 0x40
jmp 0x452c6d
mov eax, 0x10
jmp 0x452c6d
mov eax, ecx
and eax, 0x80000000
cmp eax, 1
sbb eax, eax
and al, 0xfe
add eax, 4
test ecx, 0x4000000
je 0x452c7a
add eax, 0x200
ret
Function at 0x454738
Capabilities:
Get common file path

Disassembly:
push ebp
mov edx, dword [esp + 0xc]
mov ebp, esp
sub esp, 0x104
test edx, edx
push esi
push edi
je 0x454794
mov edi, dword [ebp + 8]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edi, [ebp - 0x104]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp byte [ebp + edx - 0x105], 0x5c
je 0x45479b
mov esi, 0x44f534
lea edi, [ebp - 0x104]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
movsw word es:[edi], word [esi]
jmp 0x45479b
mov byte [ebp - 0x104], 0
push dword [ebp + 8]
push 0
push 0x44f538
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetTempFileNameA]
test eax, eax
mov eax, 0
je 0x4547cd
push 0x10
push 0x44f53c
push dword [ebp + 8]
call fcn.00452aa9
add esp, 0xc
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4547d3
Capabilities:
Delete file
Get common file path
Query environment variable

Disassembly:
push ebp
mov eax, 0x4220
mov ebp, esp
call fcn.00454e30
push esi
push edi
push 0
call fcn.004546c3
add esp, 4
mov dword [0x44f524], eax
cmp eax, 0xffffffff
jne 0x454911
mov edi, 0x104
lea eax, [ebp - 0x11c]
push edi
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
push eax
lea ecx, [ebp - 0x11c]
push ecx
call fcn.00454738
add esp, 8
mov esi, eax
test esi, esi
jne 0x454899
push edi
lea eax, [ebp - 0x220]
push eax
lea edi, [ebp - 0x220]
push str.PATH
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
mov al, byte [edi]
test al, al
je 0x454886
xor ecx, ecx
inc edi
mov byte [ebp - 0x11c], al
cmp al, cl
je 0x454868
cmp byte [ebp + ecx - 0x11c], 0x3b
je 0x454868
inc ecx
mov al, byte [edi]
inc edi
mov byte [ebp + ecx - 0x11c], al
test al, al
jne 0x45484f
push ecx
lea eax, [ebp - 0x11c]
mov byte [ebp + ecx - 0x11c], 0
push eax
call fcn.00454738
add esp, 8
mov esi, eax
test esi, esi
je 0x45483c
test esi, esi
jne 0x454899
push 0xc
push 0x44f548
call fcn.004532f6
add esp, 8
push 0x1050
lea eax, [ebp - 0x4220]
push eax
push 0x44e4d4
call fcn.00452a89
add esp, 0xc
test eax, eax
jne 0x4548c2
push 2
push 0
call fcn.004532f6
add esp, 8
lea edi, [ebp - 0x41e0]
xor eax, eax
mov ecx, 0x10
rep stosd dword es:[edi], eax
push esi
mov eax, dword [0x44e4d0]
push eax
lea ecx, [ebp - 0x4220]
push ecx
call fcn.00452afc
add esp, 0xc
push esi
call fcn.00452a9c
add esp, 4
lea ecx, [ebp - 0x11c]
push ecx
call fcn.004546c3
add esp, 4
mov dword [0x44f524], eax
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
cmp dword [0x44f524], 0xffffffff
jne 0x454926
push 0xc
push 0x44f54c
jmp 0x4549d3
xor esi, esi
lea eax, [ebp - 8]
push esi
lea ecx, [ebp - 0x18]
push eax
push 0x10
push ecx
push esi
push esi
push 1
push dword [0x44f524]
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
test eax, eax
je 0x4549cc
cmp dword [ebp - 0x18], 0x328
jne 0x4549c3
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
push esi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 8]
push ecx
mov dword [ebp - 0x10], edx
push 4
lea edx, [ebp - 4]
push edx
mov dword [ebp - 0xc], eax
push 0x10
lea eax, [ebp - 0x18]
push eax
push 2
push dword [0x44f524]
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
test eax, eax
je 0x454999
mov eax, dword [ebp - 4]
mov dword [0x44f528], eax
jmp 0x4549db
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x76
je 0x4549b2
cmp eax, 0x77
je 0x4549b2
push 0xc
push 0x44f578
jmp 0x4549d3
push 0
call dword [sym.imp.KERNEL32.DLL_SetLastError]
push 1
push str.___please_restart_your_system_and_retry
jmp 0x4549d3
push 0xc
push 0x44f57c
jmp 0x4549d3
push 0xc
push 0x44f580
call fcn.004532f6
add esp, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100010d0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0
jmp 0x100010ee
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp + 8]
jae 0x10001111
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 8]
movzx eax, byte [edx]
xor eax, dword [ebp - 4]
mov dword [ebp - 4], eax
imul ecx, dword [ebp - 4], 0x1000193
mov dword [ebp - 4], ecx
jmp 0x100010e5
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4

Function at 0x10001a70
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1000ad8d
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x1000e008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp + 8]
call fcn.10002d20
mov dword [ebp - 0x14], eax
push 0xc
lea ecx, [ebp - 0x20]
call fcn.10001a50
lea ecx, [ebp - 0x29]
call fcn.10001860
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x14]
add eax, 4
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x38]
push ecx
mov edx, dword [ebp - 0x3c]
push edx
lea ecx, [ebp - 0x20]
call fcn.10002ef0
mov dword [ebp - 4], 0
push 4
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x20]
call fcn.10002de0
push eax
call dword [sym.imp.VCRUNTIME140.dll_memcpy]
add esp, 0xc
mov ecx, dword [ebp + 8]
call fcn.10002d20
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp + 8]
call fcn.10002de0
mov dword [ebp - 0x44], eax
lea ecx, [ebp - 0x20]
call fcn.10002de0
add eax, 4
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x40]
push ecx
mov edx, dword [ebp - 0x44]
push edx
mov eax, dword [ebp - 0x48]
push eax
call dword [sym.imp.VCRUNTIME140.dll_memcpy]
add esp, 0xc
mov byte [ebp - 0x21], 1
mov dword [ebp - 0x28], 0
push 0
mov edx, 1
mov ecx, dword [ebp - 0x30]
mov ecx, dword [ecx + 0x10]
call fcn.10001050
test eax, eax
je 0x10001b4f
jmp 0x10001b37
lea ecx, [ebp - 0x20]
call fcn.10002d20
cmp dword [ebp - 0x28], eax
jae 0x10001bb0
lea ecx, [ebp - 0x20]
call fcn.10002d20
sub eax, dword [ebp - 0x28]
mov dword [ebp - 0x4c], eax
mov edx, dword [ebp - 0x28]
push edx
lea ecx, [ebp - 0x20]
call fcn.10002d00
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x54], ecx
push 0
mov edx, dword [ebp - 0x4c]
push edx
mov eax, dword [ebp - 0x50]
push eax
mov ecx, dword [ebp - 0x54]
push ecx
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xffffffff
jne 0x10001ba5
mov byte [ebp - 0x21], 0
jmp 0x10001bb0
mov edx, dword [ebp - 0x28]
add edx, dword [ebp - 0x34]
mov dword [ebp - 0x28], edx
jmp 0x10001b4f
xor edx, edx
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0x10]
call fcn.10001030
mov byte [ebp - 0x22], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.10002e60
movzx eax, byte [ebp - 0x22]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100092fa
mov esp, ebp
pop ebp
ret 4
Function at 0x10001bf0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1000e008]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
cmp dword [ebp - 0xc], 4
jge 0x10001c4f
push 0
mov eax, 4
sub eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0xc]
lea edx, [ebp + ecx - 8]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x10001c44
xor al, al
jmp 0x10001cb8
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 0x10]
mov dword [ebp - 0xc], edx
jmp 0x10001c11
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
call fcn.10002e40
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 8]
jge 0x10001cb6
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], edx
mov ecx, dword [ebp + 8]
call fcn.10002de0
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x24], ecx
push 0
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
jne 0x10001cab
xor al, al
jmp 0x10001cb8
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 0x18]
mov dword [ebp - 0xc], edx
jmp 0x10001c62
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100092fa
mov esp, ebp
pop ebp
ret 4