joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b5c88
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4b5cb6
mov eax, ebx
call fcn.004b673c
cmp dword [ebx + 0x40], 0
je 0x4b5caf
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4b5d27
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4b5d19
cmp dword [ebx + 8], 0
je 0x4b5cd8
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4b5cea
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4b5d19
cmp dword [ebx + 8], 0
je 0x4b5ccb
cmp eax, 3
je 0x4b5cfd
dec eax
jne 0x4b5ccb
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4b5ccb
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4b5ccb
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4b5d45
cmp dword [ebx + 0x14], 0xcc
je 0x4b5d45
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004b5d50
pop ebx
ret
Function at 0x4cb614
Capabilities:
Hash data with md5

Disassembly:
push ebx
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
mov edx, 0x40
lea ecx, [eax + 0x18]
mov byte [ecx], 0
inc ecx
dec edx
jne 0x4cb627
mov edx, 0x10
lea ecx, [eax + 0x58]
xor ebx, ebx
mov dword [ecx], ebx
add ecx, 4
dec edx
jne 0x4cb636
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebx
ret

Function at 0x4cc144
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff50
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xb0], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004046dc
mov eax, dword [ebp - 8]
call fcn.004046dc
xor eax, eax
push ebp
push 0x4cc2b9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.004044ec
cmp eax, 0x40
jle 0x4cc1b0
lea edx, [ebp - 0xb0]
mov eax, dword [ebp - 8]
call fcn.004cc108
mov edx, dword [ebp - 0xb0]
lea eax, [ebp - 8]
call fcn.004042c4
lea ecx, [ebp - 0xc]
mov edx, 0x40
mov al, 0x36
call fcn.004048dc
lea ecx, [ebp - 0x10]
mov edx, 0x40
mov al, 0x5c
call fcn.004048dc
mov eax, dword [ebp - 8]
call fcn.004044ec
mov esi, eax
test esi, esi
jle 0x4cc219
mov ebx, 1
lea eax, [ebp - 0xc]
call fcn.00404744
mov edx, dword [ebp - 0xc]
mov dl, byte [edx + ebx - 1]
mov ecx, dword [ebp - 8]
xor dl, byte [ecx + ebx - 1]
mov byte [eax + ebx - 1], dl
lea eax, [ebp - 0x10]
call fcn.00404744
mov edx, dword [ebp - 0x10]
mov dl, byte [edx + ebx - 1]
mov ecx, dword [ebp - 8]
xor dl, byte [ecx + ebx - 1]
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x4cc1e1
lea eax, [ebp - 0xac]
call fcn.004cb614
mov ebx, 0x4cb748
mov ecx, ebx
lea eax, [ebp - 0xac]
mov edx, dword [ebp - 0xc]
call fcn.004cbe64
mov ecx, ebx
lea eax, [ebp - 0xac]
mov edx, dword [ebp - 4]
call fcn.004cbe64
lea ecx, [ebp - 0x14]
mov edx, ebx
lea eax, [ebp - 0xac]
call fcn.004cbf8c
lea eax, [ebp - 0xac]
call fcn.004cb614
mov ecx, ebx
lea eax, [ebp - 0xac]
mov edx, dword [ebp - 0x10]
call fcn.004cbe64
mov ecx, ebx
lea eax, [ebp - 0xac]
mov edx, dword [ebp - 0x14]
call fcn.004cbe64
mov ecx, edi
mov edx, ebx
lea eax, [ebp - 0xac]
call fcn.004cbf8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cc2c0
lea eax, [ebp - 0xb0]
call fcn.0040422c
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00404250
ret
Function at 0x4d7e58
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4d7f20
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4d7f38
push edi
push 0x4d7f4c
lea eax, [ebp - 4]
mov edx, 3
call fcn.004045ac
cmp byte [ebx + 0x32], 0
je 0x4d7ebc
test esi, esi
jle 0x4d7ebc
push dword [ebp - 4]
push 0x4d7f58
lea edx, [ebp - 8]
mov eax, esi
call fcn.00408ba4
push dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, 3
call fcn.004045ac
mov al, byte [0x4d7f60]
cmp al, byte [ebx + 0x4a]
je 0x4d7ed3
lea eax, [ebp - 4]
mov edx, 0x4d7f6c
call fcn.004044f4
lea eax, [ebp - 0xc]
mov ecx, 0x4d7f80
mov edx, dword [ebp - 4]
call fcn.00404538
mov edx, dword [ebp - 0xc]
mov eax, dword [ebx + 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, ebx
call fcn.004d7438
mov ecx, 0x64
cdq
idiv ecx
cmp eax, 2
sete al
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d7f27
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404250
ret

Function at 0x4d7fc8
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4d80ac
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4d80c4
push esi
push 0x4d80d8
lea eax, [ebp - 8]
mov edx, 3
call fcn.004045ac
lea eax, [ebp - 4]
call fcn.0040422c
test byte [ebx + 0x4a], 1
je 0x4d8017
push ebp
mov eax, 0x4d80e4
call fcn.004d7f84
pop ecx
test byte [ebx + 0x4a], 2
je 0x4d8029
push ebp
mov eax, 0x4d80f4
call fcn.004d7f84
pop ecx
test byte [ebx + 0x4a], 4
je 0x4d803b
push ebp
mov eax, 0x4d8104
call fcn.004d7f84
pop ecx
cmp dword [ebp - 4], 0
je 0x4d805f
push dword [ebp - 8]
push 0x4d8114
push dword [ebp - 4]
push 0x4d8128
push esi
lea eax, [ebp - 8]
mov edx, 5
call fcn.004045ac
lea eax, [ebp - 0xc]
mov ecx, 0x4d8140
mov edx, dword [ebp - 8]
call fcn.00404538
mov edx, dword [ebp - 0xc]
mov eax, dword [ebx + 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, ebx
call fcn.004d7438
mov ecx, 0x64
cdq
idiv ecx
cmp eax, 2
sete al
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d80b3
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404250
ret
Function at 0x4d8144
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4d827f
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov edx, 0x4d8298
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, dword [ebp - 4]
call fcn.004d7438
cmp eax, 0x162
jne 0x4d8264
lea eax, [ebp - 0x10]
call fcn.0040422c
mov dword [ebp - 0x14], 0x5dc
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x4d822a
inc ebx
xor esi, esi
lea ecx, [ebp - 0xc]
mov edx, esi
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0xc]
call fcn.004044ec
dec eax
jl 0x4d81df
mov eax, dword [ebp - 0xc]
cmp byte [eax], 0x2e
jne 0x4d81df
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov edx, 0x4d82a8
call fcn.00404538
mov eax, dword [ebp - 0x10]
call fcn.004044ec
mov edi, eax
mov eax, dword [ebp - 0xc]
call fcn.004044ec
add edi, eax
cmp edi, dword [ebp - 0x14]
jl 0x4d820e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov edx, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x30]
lea eax, [ebp - 0x10]
call fcn.0040422c
push dword [ebp - 0x10]
push dword [ebp - 0xc]
push 0x4d82b4
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004045ac
inc esi
dec ebx
jne 0x4d81af
cmp dword [ebp - 0x10], 0
je 0x4d823e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov edx, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov edx, 0x4d82c0
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, dword [ebp - 4]
call fcn.004d7438
mov ecx, 0x64
cdq
idiv ecx
cmp eax, 2
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d8286
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00404250
ret

Function at 0x4e1194
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
xor edx, edx
push ebp
push 0x4e1207
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, ecx
call fcn.004e1174
mov ebx, eax
mov edx, 0x4e1220
mov eax, ebx
call fcn.004df834
lea eax, [ebx + 0xc]
mov edx, esi
call fcn.00404280
lea eax, [ebx + 0x24]
mov edx, 0x4e1234
call fcn.00404280
lea eax, [ebp - 4]
call fcn.004dfbb4
mov edx, dword [ebp - 4]
lea eax, [ebx + 0x30]
call fcn.00404280
mov eax, ebx
call fcn.004df2c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e120e
lea eax, [ebp - 4]
call fcn.0040422c
ret
Function at 0x4e4b18
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004046dc
xor eax, eax
push ebp
push 0x4e4bde
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4e4ba2
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0xc
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x24]
mov ecx, 0x4e4bf4
mov edx, dword [ebp - 4]
call fcn.00404538
mov eax, dword [ebp - 0x24]
call fcn.004046ec
push eax
call sub.kernel32.dll_GetVolumeInformationA
mov eax, dword [ebp - 0xc]
xor edx, edx
push edx
push eax
mov edx, dword [ebp - 8]
mov eax, 8
call fcn.00408ce0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4e4bc0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e4be5
lea eax, [ebp - 0x24]
call fcn.0040422c
lea eax, [ebp - 4]
call fcn.0040422c
ret

Function at 0x4e72b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
push ebx
xor edx, edx
mov dword [ebp - 0x84], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4e734d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x80
lea eax, [ebp - 0x80]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
cmp eax, 0x80
jg 0x4e72eb
test eax, eax
jne 0x4e72f4
mov eax, ebx
call fcn.0040422c
jmp 0x4e72fe
mov edx, ebx
lea eax, [ebp - 0x80]
call fcn.004095c4
lea edx, [ebp - 0x84]
mov eax, dword [ebx]
call fcn.004087b0
mov edx, dword [ebp - 0x84]
mov eax, ebx
call fcn.00404280
mov eax, dword [ebx]
call fcn.004044ec
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
je 0x4e7334
mov eax, ebx
mov edx, 0x4e7364
call fcn.004044f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e7354
lea eax, [ebp - 0x84]
call fcn.0040422c
ret

Function at 0x432006
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
call 0x43200c
nop
nop
nop
nop
nop
pop eax
nop
add eax, reloc.user32.dll_EnumDesktopsA
nop
sub eax, 0x407245
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219

Function at 0x4036a8
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
cpuid
rdtsc
mov esi, eax
mov edi, edx
cpuid
rdtsc
sub eax, esi
sub edx, edi
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
pop edi
pop esi
cmp dword [ebp - 4], 0x100
jle 0x4036d9
cmp dword [ebp - 8], 0
jne 0x4036d9
jmp 0x4036e1
push dword [0x34]
jmp 0x4036d9
mov eax, 1
leave
ret
Function at 0x5f4134
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2bc
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x5f414f
add esi, 0x1000
lea eax, [ebp - 0x2bc]
push edx
push 0x1c
push eax
push esi
call dword [edx + 0x124b9374]
pop edx
test eax, eax
je 0x5f4221
cmp dword [ebp - 0x2ac], 0x1000
jne 0x5f4210
test dword [ebp - 0x2a8], 1
jne 0x5f4210
and dword [ebp - 0x2a8], 0x100
jne 0x5f4210
push esi
push edx
push 4
push esi
call dword [edx + 0x122d2d2b]
pop edx
pop esi
test eax, eax
je 0x5f41b3
jmp 0x5f4210
cmp word [esi], 0x5a4d
jne 0x5f4210
mov eax, esi
push ebx
mov ebx, dword [esi + 0x3c]
add eax, ebx
pop ebx
cmp dword [eax], 0x4550
jne 0x5f4210
lea eax, [ebp - 0x28c]
push edx
push 0x28a
push eax
push esi
call dword [edx + 0x122d2d9f]
pop edx
test eax, eax
je 0x5f4210
lea eax, [ebp - 0x28c]
push eax
call fcn.005f4090
test eax, eax
jne 0x5f4209
jmp 0x5f4210
mov eax, esi
jmp 0x5f4221
mov esi, dword [ebp - 0x2b0]
add esi, dword [ebp - 0x2bc]
jmp 0x5f414f
pop esi
leave
ret 4
Function at 0x426ea0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x426ecd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x426ecd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x40b080
Capabilities:
Read file on windows

Disassembly:
scasd eax, dword es:[edi]
mov eax, dword [ebp - 0x53]
mov dword [ebx + 0x3c], esi
adc al, 0x75
adc byte [eax - 0x3f7a03ab], bl
mov dword [ebp - 0x4a], ecx
minps xmm5, xmmword [eax - 1]
invalid
add byte [ecx + 0x45], dl
or byte [ebp - 0x26], dh
mov dword [ebx + 0x28], 0xbf002a01
mov eax, dword [ebp + 0xc]
js 0x40afef
or byte [ebx + 0x5b5e0845], cl
mov esp, ebp
pop ebp
ret 0xc
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 5]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x3e]
loopne 0x40b054
mov dword [ebp + 0x10], 0xfc003300
jne 0x40b10d
mov al, byte [esi + 8]
out 0xc0, al
je 0x40b10d
mov ebp, dword [ebp + 0x84dd404]
push 0x5d
mov byte [0x6a966a], al
push 0
push edx
rcl dword [sym.imp.KERNEL32.dll_PeekNamedPipe], cl
xor dword [esi], ebx
jne 0x40b0f2
mov ebx, dword [ecx + sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jne 0x40b0d2
mov eax, dword [ebx - 0x76a1a0ec]
test eax, 0xd6ff175d
call esi
add eax, 0x34a7fc80
in eax, dx
cld
or al, byte [eax]
jne 0x40b0e5
mov eax, 0x790111b9
cmp dword [ebp + 0x14], ecx
pop edi
pop esi
add al, byte [ecx]
add byte [eax], al
add byte [eax], al
dec edx
ret
leave
inc ebp
sub eax, 0xe75c085
mov edx, dword [ebp + 0x14]
pop edi
pop esi
mov dword [edx], eax
mov eax, 0xea
pop ebp
ret
mov eax, dword [esi + 0xc]
test eax, eax
je 0x40b111
sal byte [ebp + edi*8 - 0x76], 0x4e
or byte [ecx + ecx*8 + 0x4e1e1c75], al
mov cl, byte [esi + 8]
test cl, cl
jne 0x40b137
push ds
dec esi
popfd
mov dword [esi], ecx
or byte [ecx - 0x7974afba], bl
push esp
mov ecx, 0x20
call 0x11cb810
mov edx, dword [esi + 0xc]
mov dword [edx + 0x41], eax
mov eax, dword [esi + 0xc]
mov edi, dword [edi - 0x7b]
push ebx
invalid
Function at 0x401303
Capabilities:
Acquire debug privileges
Get explorer pid

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
lea eax, [ebp - 8]
push eax
xor ebx, ebx
push 0x28
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x401407
push esi
mov esi, dword [ebp - 8]
lea eax, [ebp - 0x20]
push eax
push str.SeDebugPrivilege
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x40134c
push esi
lea esi, [ebp - 0x20]
call fcn.0040140a
pop ecx
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.USER32.dll_GetShellWindow]
lea ecx, [ebp - 0xc]
push ecx
push eax
mov dword [ebp - 0xc], ebx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [ebp - 0xc], ebx
je 0x4013f2
push dword [ebp - 0xc]
push ebx
push 0x20000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x4013ec
mov esi, dword [sym.imp.USER32.dll_GetUserObjectSecurity]
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0
push dword [edi]
lea eax, [ebp - 0x14]
push eax
push ebx
mov dword [ebp - 0x14], 1
call esi
cmp dword [ebp - 4], 0
je 0x4013ec
push dword [ebp - 4]
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ecx, [ebp - 4]
push ecx
push dword [ebp - 4]
mov dword [edi], eax
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
call esi
test eax, eax
je 0x4013ec
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorOwner]
test eax, eax
jne 0x4013f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
jmp 0x401406
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
neg eax
sbb eax, eax
and eax, dword [ebp - 0x10]
pop esi
pop ebx
leave
ret

Function at 0x40148a
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
mov esi, 0x103
push esi
lea eax, [ebp - 0x20f]
push 0
push eax
mov byte [ebp - 0x210], 0
call fcn.0040a870
push esi
lea eax, [ebp - 0x10b]
push 0
push eax
mov dword [ebp - 8], 0x104
mov byte [ebp - 0x10c], 0
call fcn.0040a870
add esp, 0x18
mov byte [ebp - 1], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov ebx, eax
dec ebx
neg ebx
lea eax, [ebp - 0x10c]
sbb bl, bl
push eax
inc bl
call fcn.0040154e
dec eax
neg eax
pop ecx
sbb al, al
inc al
pop esi
test bl, bl
pop ebx
je 0x401549
test al, al
je 0x401549
lea ecx, [ebp - 0x10c]
lea eax, [ebp - 0x210]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40153c
test dl, dl
je 0x401538
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40153c
inc eax
inc eax
inc ecx
inc ecx
test dl, dl
jne 0x40151e
xor eax, eax
jmp 0x401541
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x401549
mov byte [ebp - 1], 0
mov al, byte [ebp - 1]
leave
ret
Function at 0x40154e
Capabilities:
Get explorer pid

Disassembly:
push 0x22c
push 0x4128b8
call fcn.0040e5a4
xor ebx, ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.USER32.dll_GetShellWindow]
mov edi, eax
mov dword [ebp - 0x2c], ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
lea eax, [ebp - 0x2c]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [ebp - 0x2c], ebx
je 0x401657
push dword [ebp - 0x2c]
push ebx
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x24], eax
cmp eax, ebx
jne 0x4015af
call esi
jmp 0x401657
lea ecx, [ebp - 0x20]
push ecx
push 0xa
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x401657
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push 1
push dword [ebp - 0x20]
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
test eax, eax
jne 0x4015e5
call esi
cmp eax, 0x7a
jne 0x401657
push dword [ebp - 0x1c]
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x1c]
push ecx
push dword [ebp - 0x1c]
push eax
push 1
push dword [ebp - 0x20]
call edi
test eax, eax
je 0x401657
mov esi, 0x104
mov dword [ebp - 0x1c], esi
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x138]
push eax
mov eax, dword [ebp - 0x28]
push dword [eax]
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidA]
test eax, eax
je 0x401657
mov dword [ebp - 0x30], 1
lea eax, [ebp - 0x138]
push eax
push 0x410d88
push esi
push dword [ebp + 8]
call fcn.004058c6
add esp, 0x10
or dword [ebp - 4], 0xffffffff
call fcn.0040166b
mov eax, dword [ebp - 0x30]
call fcn.0040e5df
ret
Function at 0x401696
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x670
push ebx
push esi
push edi
mov esi, 0x103
xor ebx, ebx
push esi
lea eax, [ebp - 0x163]
push ebx
push eax
mov byte [ebp - 0x164], bl
call fcn.0040a870
push esi
lea eax, [ebp - 0x26b]
push ebx
push eax
mov byte [ebp - 0x26c], bl
call fcn.0040a870
lea eax, [ebp - 0x164]
push eax
call fcn.00403176
lea eax, [ebp - 0x164]
push eax
push str._sInternet_Exploreriexplore.exe
lea eax, [ebp - 0x26c]
push esi
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
mov esi, 0x3ff
push esi
lea eax, [ebp - 0x66b]
push ebx
push eax
mov byte [ebp - 0x66c], bl
call fcn.0040a870
push dword [ebp + 8]
lea eax, [ebp - 0x26c]
push eax
push str._s__s
lea eax, [ebp - 0x66c]
push esi
push eax
call fcn.004058c6
add esp, 0x4c
push 0x44
pop esi
push esi
lea eax, [ebp - 0x5c]
push ebx
push eax
call fcn.0040a870
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x5c]
push eax
push ebx
push ebx
push 0x8000000
push 1
push ebx
push ebx
lea eax, [ebp - 0x66c]
push eax
push ebx
mov dword [ebp - 0x5c], esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
dec eax
neg eax
sbb eax, eax
pop edi
and eax, 2
pop esi
add eax, 0x64
pop ebx
leave
ret

Function at 0x40177d
Capabilities:
Move file

Disassembly:
push 5
push 0
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
ret

Function at 0x40178c
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
push ebx
push esi
push edi
mov byte [ebp - 1], 0
call fcn.00401294
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0xc], eax
mov ebx, 0x20006
mov edi, str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
test eax, eax
je 0x4017c8
lea ecx, [ebp - 8]
push ecx
push ebx
push 0
push edi
push eax
call esi
test eax, eax
je 0x4017fb
lea eax, [ebp - 8]
push eax
push ebx
push 0
push edi
push 0x80000001
call esi
test eax, eax
je 0x4017fb
cmp dword [ebp - 8], 0
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x4017ec
push dword [ebp - 8]
call esi
cmp dword [ebp - 0xc], 0
je 0x4017f7
push dword [ebp - 0xc]
call esi
xor al, al
jmp 0x401829
mov ecx, dword [ebp + 0xc]
call fcn.004057cb
push eax
push ecx
push 1
push 0
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x40181d
mov byte [ebp - 1], 1
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret