joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401060
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
lea eax, [ebp - 0x88]
sub esp, 0x9c
mov dword [esp + 4], eax
mov dword [esp], str.browseui.dll
call sym._GetFileVersionInfoSizeW_8
sub esp, 8
test eax, eax
jne 0x4010a8
mov dword [esp], str.Native_IE_detected__not_doing_registration_n
call sym._wine_dbg_printf.constprop.0
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], eax
mov edi, dword fs:[0x18]
mov dword [ebp - 0x8c], eax
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov esi, eax
mov dword [esp + 0xc], eax
mov edx, dword [ebp - 0x8c]
mov dword [esp + 4], 0
mov dword [esp + 8], edx
mov dword [esp], str.browseui.dll
call sym._GetFileVersionInfoW_16
lea eax, [ebp - 0x80]
sub esp, 0x10
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x7c]
mov dword [esp + 8], eax
mov dword [esp + 4], str.VarFileInfoTranslation
mov dword [esp], esi
call sym._VerQueryValueW_16
sub esp, 0x10
test eax, eax
jne 0x401150
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
jmp 0x40108b
mov eax, dword [ebp - 0x7c]
movzx edx, word [eax + 2]
mov dword [esp + 0xc], edx
movzx eax, word [eax]
lea edx, [ebp - 0x78]
mov dword [esp], edx
mov dword [esp + 8], eax
mov dword [esp + 4], str.StringFileInfo_04x_04xFileDescription
call sym._wsprintfW
lea eax, [ebp - 0x80]
lea edx, [ebp - 0x78]
mov dword [esp], esi
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x84]
mov dword [esp + 8], eax
mov dword [esp + 4], edx
call sym._VerQueryValueW_16
sub esp, 0x10
test eax, eax
je 0x40111f
mov dword [esp + 4], 0x4030e6
mov eax, dword [ebp - 0x84]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcsstr]
mov dword [ebp - 0x8c], eax
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov edx, dword [ebp - 0x8c]
sub esp, 0xc
test edx, edx
je 0x40108b
test ebx, ebx
mov edx, str.RegisterIE
mov eax, str.UnregisterIE
mov dword [esp + 8], 0
cmovne eax, edx
mov dword [esp], 0
mov dword [esp + 4], eax
call sym._RegInstallA_12
sub esp, 0xc
lea esp, [ebp - 0xc]
shr eax, 0x1f
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4013d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x40142b
cmp byte [esi + ebx - 1], 0xa
je 0x4013ff
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x404084], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x401980
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0xf0
mov edi, dword [0x404094]
mov esi, dword [ebp + 8]
test edi, edi
je 0x401b40
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [0x404094]
movzx eax, al
bt eax, esi
jae 0x401ba0
mov ecx, dword [0x404084]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], ecx
je 0x401a46
test byte [0x402014], 8
jne 0x401ae0
lea ebx, [esp + 0x28]
mov edi, ebx
test byte [0x402024], 8
jne 0x401a90
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call dbg.sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x401a15
cmp esi, 3
jbe 0x401a50
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
mov dword [esp + 8], str._s:_s:_s
lea edx, [edi + 1]
mov dword [esp], eax
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x4031bc]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x401a15
mov ecx, dword [0x404094]
test ecx, ecx
je 0x401b80
mov dword [esp], 0x402024
call dword [0x404094]
test al, 8
je 0x4019ec
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call dbg.sprintf
add edi, eax
jmp 0x4019ec
mov ebx, dword [0x404094]
test ebx, ebx
je 0x401b60
mov dword [esp], 0x402014
call dword [0x404094]
test al, 8
je 0x4019d9
call dword [sym.imp.kernel32.dll_GetTickCount]
lea ebx, [esp + 0x28]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mov eax, 0x10624dd3
mov dword [esp], ebx
mul ecx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call dbg.sprintf
lea edi, [ebx + eax]
jmp 0x4019df
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x404094
call sym._load_func.part.0
jmp 0x4019a0
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x404094
call sym._load_func.part.0
jmp 0x401aea
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x404094
call sym._load_func.part.0
jmp 0x401a9e
mov eax, 0xffffffff
jmp 0x401a46
Function at 0x401d60
Capabilities:
Accept command line arguments
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call dbg.wmain
mov dword [esp], eax
call sym._exit

Function at 0x401dd0
Capabilities:
Accept command line arguments
Encrypt data using rc4 prga

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x6c
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov ebx, eax
movzx eax, word [eax]
test ax, ax
je 0x401e37
xor ecx, ecx
xor edx, edx
jmp 0x401e19
cmp ax, 0x5c
jne 0x401ea8
add edx, 1
movzx eax, word [ebx + 2]
add ebx, 2
test ax, ax
je 0x401e37
cmp ax, 9
je 0x401e25
cmp ax, 0x20
jne 0x401e00
test ecx, ecx
je 0x401e93
movzx eax, word [ebx + 2]
add ebx, 2
xor edx, edx
test ax, ax
jne 0x401e19
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
sub esp, 4
test byte [ebp - 0x30], 1
je 0x401ec8
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call dbg.wWinMain@16
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
add ebx, 2
movzx eax, word [ebx]
cmp ax, 9
je 0x401e90
cmp ax, 0x20
je 0x401e90
jmp 0x401e37
cmp ax, 0x22
jne 0x401e29
and edx, 1
jne 0x401e29
xor ecx, 1
jmp 0x401e0d
mov eax, 1
mov esi, 1
mov word [ebp - 0x2c], ax
jmp 0x401e50
Function at 0x4ebfa0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x58], ecx
ret

Function at 0xc3d47f
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x1043cec
jmp fcn.010357cd
jmp 0x1043d98
push edi
mov edi, esp
add edi, 4
sub edi, 4
xchg dword [esp], edi
pop esp
mov dword [esp], ebp
mov ebp, esp
add ebp, 4
sub ebp, 4
jmp 0x1043dbb
xchg dword [esp], ebp
mov esp, dword [esp]
mov dword [esp], ebp
jmp 0x1043e1c
jmp 0x1035773

Function at 0x10357cd
Capabilities:
Execute anti-debugging instructions

Disassembly:
cpuid
jmp 0x102d971
jmp 0x1044487
jmp fcn.0102dbfd
push ebp
mov ebp, esp
add ebp, 4
sub ebp, 4
xchg dword [esp], ebp
pop esp
mov dword [esp], esp
add dword [esp], 4
push dword [esp]
jmp 0x1035840
pop ebp
add esp, 4
jmp 0x1035897
jmp 0x103738f
jmp 0x1036727
cpuid
jmp 0x103672e
jmp 0x103b2ff
jmp 0x1036b67
rdtsc
jmp 0x1036b6e
jmp 0x103c380
jmp 0x10374a9
push edi
mov dword [esp], ebp
push esp
push dword [esp]
pop ebp
add esp, 4
add ebp, 4
sub ebp, 0x14
xchg dword [esp], ebp
pop esp
jmp 0x10374c7
jmp 0x1039bfa
push esi
mov esi, esp
add esi, 4
push ebp
mov ebp, 4
sub esi, ebp
pop ebp
xchg dword [esp], esi
mov esp, dword [esp]
jmp 0x10376ea
mov dword [esp], ecx
mov dword [esp], edx
jmp 0x10376f5
jmp 0x1036a6b
jmp 0x1039d28
mov dword [esp], edi
mov dword [esp], ebx
jmp 0x1039d3c
push ebp
mov dword [esp], edx
push edi
mov edi, 0x7fb3a89a
mov dword [esp + 4], edi
pop edi
jmp 0x1039cbd
jmp 0x103c01b
jmp 0x103a2e4
push 0x58178dc2
mov dword [esp], ebp
mov dword [esp], 0
mov eax, dword [esp]
push edi
mov edi, esp
add edi, 4
add edi, 4
xchg dword [esp], edi
pop esp
jmp 0x103a3d0
jmp 0x103661d
jmp 0x103b3a9
add esi, 4
xchg dword [esp], esi
pop esp
jmp 0x103b408
push 0
push dword [esp]
pop eax
push esi
push esp
pop esi
add esi, 4
jmp 0x103b33f
jmp 0x102d87b
jmp 0x103c083
push 0x2bcc2dd1
mov dword [esp], esi
push esi
push 0x2e39a99b
pop esi
mov dword [esp + 4], esi
pop esi
mov dword [esp], ecx
jmp 0x103c161
jmp 0x10375e3
sub esp, 4
mov dword [esp], ecx
mov dword [esp], esi
mov dword [esp], eax
pop dword [ebp - 0x14]
jmp 0x103c488
jmp 0x1041d23
push 0
mov eax, dword [esp]
push esi
mov esi, esp
add esi, 4
push ecx
mov ecx, 0x37fef896
neg ecx
inc ecx
dec ecx
sub ecx, 0xc8010766
add esi, ecx
pop ecx
xchg dword [esp], esi
jmp 0x103e698
mov esp, dword [esp]
jmp 0x103e6a0
jmp 0x1041707
jmp 0x103e855
rdtsc
jmp 0x103e8b2
jmp 0x102db95
jmp 0x104176e
cpuid
jmp 0x1041822
jmp 0x103a296
jmp 0x1041b29
cpuid
jmp 0x1041be4
jmp 0x103e7ae
jmp 0x1041d75
push 0x2ab4d326
mov dword [esp], edx
mov dword [esp], esi
mov dword [esp], 0x5a77cadf
mov dword [esp], edx
pop dword [ebp - 0x10]
jmp 0x1041e3b
jmp 0x103e563
jmp 0x10444d9
push 0
push dword [esp]
pop eax
push eax
mov eax, esp
add eax, 4
add eax, 4
xchg dword [esp], eax
mov esp, dword [esp]
jmp 0x104459d
jmp 0x1041adb
Function at 0x4332de
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
pushal
push ebp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add dl, dl
jne 0x4332fb
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x4332ec
add dl, dl
jne 0x433306
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x433352
xor eax, eax
add dl, dl
jne 0x433313
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x4333ef
add dl, dl
jne 0x433322
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x43332d
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x433338
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x433343
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x43334d
push edi
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
jmp 0x4332f2
mov eax, 1
add dl, dl
jne 0x433360
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x43336b
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x433357
sub eax, 2
jne 0x43339a
mov ecx, 1
add dl, dl
jne 0x433380
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x43338b
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x433377
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4332f2
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x4333b1
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x4333bc
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x4333a8
cmp eax, 0x7d00
jae 0x4333df
cmp eax, 0x500
jb 0x4333da
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4332f2
cmp eax, 0x7f
ja 0x4333e2
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4332f2
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x43340b
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4332f2
pop ebp
sub edi, dword [ebp + 0xc]
mov dword [ebp - 4], edi
popal
pop ebp
ret 8
Function at 0x40d860
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xa000]
push edi
or ebp, 0xffffffff
jmp 0x40d882
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40d889
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40d878
mov eax, 1
add ebx, ebx
jne 0x40d89b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40d890
jne 0x40d8ac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40d890
xor ecx, ecx
sub eax, 3
jb 0x40d8c0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40d932
mov ebp, eax
add ebx, ebx
jne 0x40d8cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40d8d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40d8fc
inc ecx
add ebx, ebx
jne 0x40d8e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40d8dd
jne 0x40d8f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40d8dd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40d91c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40d90d
jmp 0x40d87e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40d91c
add edi, ecx
jmp 0x40d87e
pop esi
mov edi, esi
mov ecx, 0x28
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40d93a
cmp byte [edi], 2
jne 0x40d93a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40d93f
lea edi, [esi + 0xb000]
mov eax, dword [edi]
or eax, eax
je 0x40d9b7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xe1b0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xe1ec]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40d96c
mov ecx, edi
jns 0x40d99b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xe1f0]
or eax, eax
je 0x40d9b1
mov dword [ebx], eax
add ebx, 4
jmp 0x40d989
call dword [esi + 0xe200]
mov ebp, dword [esi + 0xe1f4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1df]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40d9eb
sub esp, 0xffffff80
jmp 0x401370
Function at 0x401460
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp + 0x14], 5
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x407064
mov dword [esp + 4], str.open
mov dword [esp], 0
call sym._ShellExecuteW_24
sub esp, 0x18
nop
leave
ret

Function at 0x401667
Capabilities:
Empty the recycle bin

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp], str.SHELL32.dll
call sym._LoadLibraryA_4
sub esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x401693
mov dword [esp], str.Error:_Could_not_load_SHELL32.dll
call sym._printf
jmp 0x4016fc
mov dword [esp + 4], str.SHEmptyRecycleBinW
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._GetProcAddress_8
sub esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4016ce
mov dword [esp], str.Error:_Could_not_find_SHEmptyRecycleBinW
call sym._printf
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._FreeLibrary_4
sub esp, 4
jmp 0x4016fc
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], 0
call sym._SHEmptyRecycleBinW_12
sub esp, 0xc
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._FreeLibrary_4
sub esp, 4
nop
leave
ret

Function at 0x4016fe
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov dword [ebp - 0x44], 0x3c
mov dword [ebp - 0x34], str.C:WindowsSystem32cmd.exe
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 1
lea eax, [ebp - 0x44]
mov dword [esp], eax
call sym._ShellExecuteExW_4
sub esp, 4
nop
leave
ret

Function at 0x401c3b
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov dword [ebp - 0xc], 0x4073e4
mov dword [ebp - 0x10], 0x4073ed
mov dword [ebp - 0x14], str.cmd.exe
mov dword [ebp - 0x18], 0x4073fe
mov dword [ebp - 0x1c], 0
mov dword [esp + 8], 0x44
mov dword [esp + 4], 0
lea eax, [ebp - 0x64]
mov dword [esp], eax
call sym._memset
mov dword [ebp - 0x64], 0x44
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
lea eax, [ebp - 0x74]
mov dword [esp], eax
call sym._memset
lea eax, [ebp - 0x74]
mov dword [esp + 0x28], eax
lea eax, [ebp - 0x64]
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], str._c_calc.exe
mov dword [esp + 0x10], 0x407064
mov dword [esp + 0xc], 2
mov dword [esp + 8], str.password
mov dword [esp + 4], str.domain
mov dword [esp], str.username
call sym._CreateProcessWithLogonW_44
sub esp, 0x2c
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x401d3e
mov eax, dword [ebp - 0x74]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
mov eax, dword [ebp - 0x74]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, dword [ebp - 0x70]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
jmp 0x401d53
call sym._GetLastError_0
mov dword [esp + 4], eax
mov dword [esp], str.CreateProcessWithLogonW_failed___d__n
call sym._printf
nop
leave
ret
Function at 0x401e38
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
call sym._GetCurrentProcess_0
mov edx, eax
lea eax, [ebp - 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x28
mov dword [esp], edx
call sym._OpenProcessToken_12
sub esp, 0xc
lea eax, [ebp - 0x14]
mov dword [esp + 8], eax
mov dword [esp + 4], str.SeDebugPrivilege
mov dword [esp], 0
call sym._LookupPrivilegeValueA_12
sub esp, 0xc
mov dword [ebp - 0x24], 1
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], 2
mov eax, dword [ebp - 0xc]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
lea edx, [ebp - 0x24]
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._AdjustTokenPrivileges_24
sub esp, 0x18
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
nop
leave
ret

Function at 0x401ffb
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 0x18], 4
mov dword [ebp - 0x1c], 4
lea eax, [ebp - 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40763c
mov dword [esp], 0x80000001
call sym._RegOpenKeyExW_20
sub esp, 0x14
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x402054
mov dword [esp], str.Error_opening_key.
call sym._puts
jmp 0x4020bf
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x1c]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x14]
mov dword [esp + 0x10], edx
lea edx, [ebp - 0x18]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov dword [esp + 4], str.Test
mov dword [esp], eax
call sym._RegQueryValueExW_24
sub esp, 0x18
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40209e
mov dword [esp], str.Error_reading_key_value.
call sym._puts
jmp 0x4020bf
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov dword [esp], str.Value:__d_n
call sym._printf
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
leave
ret

Function at 0x4020c1
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
lea eax, [ebp - 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xf003f
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40763c
mov dword [esp], 0x80000002
call sym._RegOpenKeyExW_20
sub esp, 0x14
nop
leave
ret

Function at 0x4020f8
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [esp + 0x20], 0
lea eax, [ebp - 0xc]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0xf003f
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40763c
mov dword [esp], 0x80000001
call sym._RegCreateKeyExW_36
sub esp, 0x24
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
nop
leave
ret
Function at 0x40215d
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], str.C:WindowsSystem32cmd.exe
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40763c
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._RegSetValueExW_24
sub esp, 0x18
nop
leave
ret

Function at 0x40219c
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp], str.ADVAPI32.dll
call sym._LoadLibraryA_4
sub esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4021c8
mov dword [esp], str.Error:_Unable_to_load_ADVAPI32.dll
call sym._puts
jmp 0x402235
mov dword [esp + 4], str.RegDeleteKeyW
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._GetProcAddress_8
sub esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4021f5
mov dword [esp], str.Error:_Unable_to_find_RegDeleteKeyW
call sym._puts
jmp 0x402235
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov dword [esp + 4], 0x40763c
mov dword [esp], 0x80000001
mov eax, dword [ebp - 0x14]
call eax
sub esp, 8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x402229
mov dword [esp], str.Error:_RegDeleteKeyW_failed
call sym._puts
jmp 0x402235
mov dword [esp], str.Success:_RegDeleteKeyW_called
call sym._puts
leave
ret

Function at 0x402396
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x110]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
lea eax, [ebp - 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xf003f
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersionRun
mov dword [esp], 0x80000001
call sym._RegOpenKeyExA_20
sub esp, 0x14
lea eax, [ebp - 0x110]
mov dword [esp], eax
call sym._strlen
lea edx, [eax + 1]
mov eax, dword [ebp - 0xc]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x110]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.AutoRun
mov dword [esp], eax
call sym._RegSetValueExA_24
sub esp, 0x18
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
nop
leave
ret