joyce8/EMBER2024-capa huggingface dataset:
Function at 0xd98f90
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x208
lea eax, [esp]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push ebp
push esi
push edi
xor edi, edi
push 0x104
push eax
push edi
push SysStringLen
call ebx
mov esi, dword [esp + 0x21c]
mov ebp, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0xd98ffb
mov ecx, dword [esi + 8]
push 0
push ecx
call ebp
test eax, eax
je 0xd99035
lea edx, [esp + 0x10]
push esi
push edx
push SysStringLen
call fcn.00d98e00
add esp, 0xc
lea eax, [esp + 0x10]
inc edi
push 0x104
push eax
push edi
push SysStringLen
call ebx
test eax, eax
je 0xd98fc5
mov edi, 0xdb38b0
mov ecx, dword [esi + 8]
push 0
push ecx
call ebp
test eax, eax
je 0xd99035
mov edx, dword [edi]
push esi
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00d98e00
add edi, 4
add esp, 0xc
cmp edi, 0xdb38c0
jb 0xd99000
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x208
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x208
ret

Function at 0xd99070
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x250
push esi
push edi
mov edi, dword [esp + 0x25c]
push 0x5c
push edi
call fcn.00d9f082
mov esi, eax
add esp, 8
test esi, esi
je 0xd99107
lea eax, [esp + 8]
mov word [esi], 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0xd99102
push ebx
lea ebx, [esi + 2]
push ebp
lea ecx, [esp + 0x3c]
push ebx
push ecx
call fcn.00d9e946
add esp, 8
test eax, eax
je 0xd990e3
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea edx, [esp + 0x10]
push edx
push edi
call ebp
test eax, eax
je 0xd990e8
lea eax, [esp + 0x3c]
push ebx
push eax
call fcn.00d9e946
add esp, 8
test eax, eax
jne 0xd990c5
mov word [esi], 0x5c
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp word [esi], 0
pop ebp
pop ebx
je 0xd99102
pop edi
mov al, 1
pop esi
add esp, 0x250
ret
mov word [esi], 0x5c
pop edi
xor al, al
pop esi
add esp, 0x250
ret
Function at 0xd99f10
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0xdae9fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [esp + 0x2c]
xor ebp, ebp
mov dword [esp + 0x10], eax
xor ebx, ebx
mov eax, 1
mov ecx, ebx
shl eax, cl
mov ecx, dword [esp + 0x10]
test ecx, eax
je 0xd9a002
lea edx, [ebx + 0x41]
lea eax, [esp + 0x14]
push edx
push str._c:_
push eax
call fcn.00d9ddff
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0xd9a002
lea edx, [esp + 0x14]
push edx
push str.Mounting__s_n
call fcn.00d956e0
lea eax, [esp + 0x1c]
lea edi, [esi + 0x1048]
push eax
push edi
mov word [esp + 0x28], bp
call fcn.00d9e20b
push 0x10
call fcn.00d9e1d3
add esp, 0x14
mov dword [esp + 0x2c], eax
cmp eax, ebp
mov dword [esp + 0x24], ebp
je 0xd99fc5
mov cx, word [edi]
push ecx
mov ecx, eax
call fcn.00d8a1c0
jmp 0xd99fc7
xor eax, eax
push esi
mov dword [esp + 0x28], 0xffffffff
mov dword [esi], eax
call fcn.00d99b80
mov edi, dword [esi]
add esp, 4
cmp edi, ebp
je 0xd99ff0
mov ecx, edi
call fcn.00d8a2c0
push edi
call fcn.00d9e1c8
add esp, 4
mov edx, dword [esi + 0x1024]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0xd9a021
inc ebx
cmp ebx, 0x20
jb 0xd99f3e
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0xd9b250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xdaf808
push 0xd9f288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0xd9b329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0xd9b329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.00d9e1d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0xd9b329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0xd9b329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0xd9b32c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.00d9b351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xd9bd20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xd9bd58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0xd9bd60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xd9bd94
mov eax, dword [esp + 0x14]
test eax, eax
je 0xd9bd94
push eax
push esi
call fcn.00d9e20b
add esp, 8
pop esi
ret 0x10

Function at 0xd9bda0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xd9be22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0xd9be15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0xdb4320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00d9ddff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0xd9bdda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0xd9be30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xd9bec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0xd9beb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0xdb4320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00d9ddff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0xd9beab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0xd9be6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0xd9c000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0xd9c131
push esi
call fcn.00d9f145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00d8e080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0xd9c131
push 0
push ebp
call fcn.00d8e3a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00d8e260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0xd9c08b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.00d8e2f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0xd9c121
push 0xdb4918
push edi
call fcn.00d9d3f0
push eax
push ebx
push esi
call fcn.00d9bf60
push 0xdb48f8
push edi
call fcn.00d9d3f0
push eax
push ebx
push esi
call fcn.00d9bf60
push 0xdb48d8
push edi
call fcn.00d9d3f0
push eax
push ebx
push esi
call fcn.00d9bf60
push 0xdb48c0
push edi
call fcn.00d9d3f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00d9bf60
push 0xdb48a0
push edi
call fcn.00d9d3f0
push eax
push ebx
push esi
call fcn.00d9bf60
push 0xdb4888
push edi
call fcn.00d9d3f0
push eax
push ebx
push esi
call fcn.00d9bf60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0xd9d1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00d9d140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00d9d140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00d9d140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00d9d140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xd9dbfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xd9dc50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xdaf87c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xd9dc43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xd9dc52
xor eax, eax
pop esi
leave
ret 4
Function at 0x8ccbc0
Capabilities:
Encode data using xor

Disassembly:
push 0x8cc92e
pop edx
inc eax
or edi, eax
add eax, edi
call fcn.008ccbe6
sub edi, eax
xor dword [ebx], edx
add edi, 0x71971508
inc ebx
and edi, edi
cmp ebx, esi
jne fcn.008ccbc0
sub eax, edi
ret
Function at 0x402a32
Capabilities:
Create process on windows
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x2002c
call fcn.00441f50
push ebx
push esi
push edi
lea ecx, [esp + 0x28]
call fcn.0040a961
lea eax, [esp + 0x38]
xor ebx, ebx
push eax
push 0x7fff
mov byte [esp + 0x19], bl
mov byte [esp + 0x1a], bl
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
lea eax, [esp + 0x13]
push eax
push dword [ebp + 8]
call fcn.00402e37
call dword [sym.imp.KERNEL32.DLL_IsDebuggerPresent]
test eax, eax
jne 0x442b2d
mov eax, dword [0x4d1400]
test eax, eax
je 0x442b45
xor edi, edi
mov esi, 0x4d2390
inc edi
cmp eax, edi
je 0x442b51
lea eax, [esp + 0x11]
push eax
push ecx
push 0x4d1400
push 0x4d1418
mov ecx, esi
call fcn.00402de3
test al, al
je 0x442b70
mov al, byte [0x4d2390]
mov byte [0x4d1404], al
mov al, byte [0x4d2391]
mov byte [esp + 0x12], al
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1003c]
push eax
push 0x7fff
push dword [0x4d1418]
call dword [sym.imp.KERNEL32.DLL_GetFullPathNameW]
push dword [esp + 0x14]
mov ecx, 0x4d13f0
call fcn.00406b57
mov bl, byte [esp + 0x11]
push dword [0x4d1400]
push 0x4d1418
call fcn.00401cd0
test eax, eax
jne 0x442b7b
cmp byte [esp + 0x12], 1
je 0x442b98
call fcn.00402b83
call fcn.00402c63
cmp byte [0x4d1404], 0
mov ebx, 0x4d1990
jne 0x402b44
mov ecx, ebx
call fcn.00403837
push edi
mov ecx, 0x4d1430
call fcn.0040d760
cmp byte [0x4d1404], 0
jne 0x402b5f
mov ecx, ebx
call fcn.004030f2
mov ecx, esi
call fcn.00403d1b
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryW]
lea ecx, [esp + 0x28]
call fcn.0040988f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x10
push 0x4c5998
push str.This_is_a_third_party_compiled_AutoIt_script.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x402b71
or dword [0x4d135c], 0xffffffff
jmp 0x402b66
push 0xffffffffffffffff
push dword [0x4d1408]
mov ecx, esi
push edi
call fcn.004075ac
mov al, byte [0x4d1364]
mov byte [0x4d2392], al
jmp 0x402b02
mov dword [0x4d135c], edi
jmp 0x402b66
mov ecx, esi
call fcn.00403d1b
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryW]
mov dword [0x4d135c], edi
jmp 0x402b71
call fcn.00461663
test al, al
jne 0x402b25
cmp byte [esp + 0x13], al
jne 0x402b25
lea ecx, [esp + 0x28]
call fcn.00403a5a
push 0x4c2224
lea ecx, [esp + 0x1c]
call fcn.00409cb3
lea ecx, [esp + 0x18]
test bl, bl
je 0x442bf5
mov edi, 0x4c59cc
push edi
call fcn.004033c6
push 0x4d1418
lea ecx, [esp + 0x1c]
call fcn.00406350
push edi
lea ecx, [esp + 0x1c]
call fcn.004033c6
push 1
jmp 0x442bfe
push dword [ebp + 8]
call fcn.004033c6
push edi
lea eax, [esp + 0x3c]
push eax
push dword [esp + 0x20]
push dword [esp + 0x34]
push 0x4c59d0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [esp + 0x18]
call fcn.0040988f
jmp 0x402b5f
Function at 0x403b1c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 8], 0
push ebx
push esi
je 0x403b99
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x403b99
xor eax, eax
xor ebx, ebx
mov word [esi], ax
lea eax, [ebp - 8]
push eax
push 1
push ebx
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x403b99
mov eax, dword [ebp + 0xc]
push edi
lea edi, [eax + eax]
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
push esi
push ebx
push ebx
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x403b80
mov eax, dword [ebp - 4]
shr eax, 1
mov dword [ebp - 4], eax
cmp eax, dword [ebp + 0xc]
jae 0x403b90
xor ecx, ecx
mov word [esi + eax*2], cx
mov bl, 1
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop edi
pop esi
pop ebx
leave
ret
xor eax, eax
mov word [edi + esi - 2], ax
jmp 0x403b7e
xor al, al
jmp 0x403b8c

Function at 0x4042a2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x10]
push ebx
push 1
push 0
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
js 0x4042da
push edi
push 0
push 0x49cbb8
push 0xa
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.DLL_FindResourceExW]
mov edi, eax
test edi, edi
jne 0x4435ba
pop edi
pop esi
pop ebx
leave
ret
push edi
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x4042d9
push edi
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov edi, eax
test edi, edi
je 0x4042d9
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_LockResource]
test eax, eax
je 0x4042d9
mov ecx, dword [ebx]
push 0
push edi
push eax
mov edx, dword [ecx]
push ecx
call dword [edx + 0x10]
mov eax, dword [ebx]
xor edx, edx
push edx
push edx
push edx
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x14]
mov byte [esi + 0x14], 1
jmp 0x4042d9
Function at 0x409a40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 8], 0
je 0x409abb
mov ebx, dword [ebp + 0xc]
xor edi, edi
test ebx, ebx
je 0x409a7c
mov ecx, dword [esi + 0xc]
lea ebx, [ebx]
cmp ecx, dword [esi + 8]
je 0x409a8c
mov eax, dword [esi + 4]
mov al, byte [ecx + eax]
mov ecx, dword [ebp + 8]
mov byte [edi + ecx], al
inc edi
inc dword [esi + 0xc]
mov ecx, dword [esi + 0xc]
cmp edi, ebx
jb 0x409a60
add dword [esi + 0x10], edi
mov eax, edi
pop edi
adc dword [esi + 0x14], 0
pop esi
pop ebx
pop ebp
ret 8
push 0
lea eax, [ebp + 0xc]
push eax
push 0x10000
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x409a7c
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x409a7c
mov dword [esi + 8], eax
xor ecx, ecx
mov dword [esi + 0xc], 0
jmp 0x409a65
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
call fcn.0041e40f
jmp 0x409a4e
Function at 0x41f4d4
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov al, byte [0x4d1363]
push ebx
push esi
push edi
mov edi, ecx
mov byte [ebp - 1], al
push 0x8000
push edi
mov esi, edx
call fcn.0042d955
pop ecx
push eax
call fcn.0042d776
cmp dword [esi + 0xc], 0xb
mov ebx, eax
pop ecx
pop ecx
je 0x45f274
lea ecx, [ebp - 0x18]
call fcn.00409ad3
mov ecx, esi
call fcn.00407510
mov ecx, dword [esi + 8]
lea edx, [ebp - 0x18]
call fcn.0041f6c9
push dword [ebp - 0x18]
push 0x49d158
push edi
call fcn.0041f574
add esp, 0xc
mov dword [ebp - 8], eax
cmp byte [ebp - 1], 0
jne 0x45f294
lea ecx, [ebp - 0x18]
call fcn.0040988f
mov esi, dword [ebp - 8]
push edi
call fcn.0042dd99
push edi
call fcn.0042d955
pop ecx
pop ecx
cmp ebx, 0xffffffff
jne 0x41f564
mov ebx, 0x4000
push ebx
push eax
call fcn.0042d776
pop ecx
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
push edi
mov ecx, esi
call fcn.00471f06
push eax
push 1
call fcn.00471e96
push eax
call fcn.0042dbb3
add esp, 0x10
mov esi, eax
jmp 0x41f54c
mov ecx, esi
call fcn.00407510
mov eax, dword [esi + 8]
push dword [eax]
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringW]
jmp 0x41f541
Function at 0x41f98e
Capabilities:
Find taskbar
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov ebx, ecx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
cmp ebx, esi
jne 0x45f467
xor eax, eax
inc eax
pop esi
pop ebx
leave
ret
push edi
xor edi, edi
test esi, esi
jne 0x45f47c
push edi
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
push ebx
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x45f490
push 9
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
mov dword [ebp - 0x10], edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
jne 0x45f56b
push edi
push esi
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call esi
mov edi, eax
mov dword [ebp - 0xc], edi
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
push 0
push ebx
mov dword [ebp - 4], eax
call esi
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
push 1
push eax
push dword [ebp - 4]
mov dword [ebp - 8], eax
call esi
push 1
push edi
push dword [ebp - 4]
call esi
push 1
push dword [ebp - 8]
push edi
call esi
push ebx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
jne 0x45f547
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
push eax
push eax
push eax
push 0x12
call edi
mov esi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x12
call esi
push 0
push 2
push 0
push 0x12
call edi
push eax
push 0x12
call esi
xor eax, eax
push eax
push eax
push eax
push 0x12
call edi
push eax
push 0x12
call esi
push 0
push 2
push 0
push 0x12
call edi
push eax
push 0x12
call esi
push ebx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
mov edi, dword [ebp - 0xc]
test eax, eax
je 0x45f54c
push 4
jmp 0x45f549
push 3
pop ebx
jmp 0x45f54f
mov ebx, dword [ebp - 0x10]
push 0
push dword [ebp - 8]
push dword [ebp - 4]
call esi
push 0
push edi
push dword [ebp - 4]
call esi
push 0
push dword [ebp - 8]
push edi
call esi
jmp 0x45f56e
push 2
pop ebx
mov eax, ebx
pop edi
jmp 0x41f9ab

Function at 0x43927b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004390fa

Function at 0x43d1d0
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043ce90
Function at 0x4606de
Capabilities:
Connect network resource
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x270
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x10], ebx
mov edi, edx
mov dword [ebp - 0xc], ebx
call fcn.0040a961
lea ecx, [ebp - 0x20]
call fcn.0040a961
lea ecx, [ebp - 0x40]
call fcn.0040a961
push 0x4c5950
lea ecx, [ebp - 0x30]
call fcn.00406b57
push esi
lea ecx, [ebp - 0x30]
call fcn.004033c6
push str.CLSID
lea ecx, [ebp - 0x30]
call fcn.004033c6
lea ecx, [ebp - 0x20]
call fcn.0040a6c3
test edi, edi
je 0x460761
push 0x5c
pop eax
cmp word [edi], ax
je 0x460761
cmp word [edi + 2], ax
je 0x460761
push 0x4c5984
lea ecx, [ebp - 0x20]
call fcn.00406b57
push edi
lea ecx, [ebp - 0x20]
call fcn.004033c6
cmp dword [ebp + 0xc], ebx
je 0x4607b2
push 0x20
lea eax, [ebp - 0x60]
push ebx
push eax
call fcn.00422340
add esp, 0xc
mov dword [ebp - 0x5c], ebx
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x40]
push eax
call fcn.0040a8c7
push str.IPC_
lea ecx, [ebp - 0x40]
call fcn.004033c6
mov eax, dword [ebp - 0x40]
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x60]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.MPR.dll_WNetAddConnection2W]
mov esi, eax
test esi, esi
js 0x46083e
lea eax, [ebp - 0x10]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
mov esi, eax
test esi, esi
jne 0x46083e
lea eax, [ebp - 0xc]
push eax
push 0x20019
push ebx
push dword [ebp - 0x30]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
test esi, esi
jne 0x460839
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x1fe
push eax
lea eax, [ebp - 0x26c]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x460834
mov eax, dword [ebp - 8]
xor ecx, ecx
push dword [ebp + 8]
shr eax, 1
mov dword [ebp - 8], eax
mov word [ebp + eax*2 - 0x26c], cx
lea eax, [ebp - 0x26c]
push eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
mov esi, eax
push dword [ebp - 0xc]
call edi
push dword [ebp - 0x10]
call edi
lea ecx, [ebp - 0x40]
call fcn.0040988f
lea ecx, [ebp - 0x20]
call fcn.0040988f
lea ecx, [ebp - 0x30]
call fcn.0040988f
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x461014
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov ebx, ecx
push edi
push esi
push 0
push dword [eax]
push 3
push ebx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov edi, eax
test edi, edi
jne 0x46106c
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x7a
jne 0x46106a
push dword [esi]
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
test eax, eax
je 0x46106a
push esi
push dword [esi]
push eax
push 3
push ebx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov edi, eax
test edi, edi
pop edi
pop esi
setne al
pop ebx
pop ebp
ret