joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101e758
Capabilities:
Get domain controller name

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1028084]
push ebx
mov ebx, dword [ebp + 0x14]
xor edx, edx
cmp byte [0x1028b00], 1
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], edx
jne 0x101e788
xor eax, eax
jmp 0x101e937
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x14]
and ecx, 0xff
mov dword [ebp - 0x28], eax
mov ax, word [ebp + 0x10]
mov word [ebp - 0x14], ax
mov eax, ecx
shr ecx, 2
push edi
mov word [ebp - 0x12], dx
lea edi, [ebp - 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [0x1029018]
and ecx, 3
cmp byte [0x1028f90], 0
mov dword [ebp - 0x24], 0x10
rep movsb byte es:[edi], byte [esi]
jne 0x101e8da
cmp byte [0x1028f91], 1
jne 0x101e7df
push 0x32
pop edi
jmp 0x101e912
mov ebx, dword [sym.imp.NETAPI32.dll_DsAddressToSiteNamesW]
mov dword [ebp - 0x18], edx
xor esi, esi
cmp eax, esi
je 0x101e80c
test byte [eax + 0x1c], 0x20
je 0x101e80c
cmp byte [eax + 0x19], 2
jb 0x101e80c
push 0x1002850
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01006234
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x18]
push dword [eax + 0x10283ec]
push esi
push esi
push esi
push esi
call dword [sym.imp.NETAPI32.dll_DsGetDcNameW]
mov edi, eax
mov eax, dword [0x1029018]
cmp eax, esi
je 0x101e851
test byte [eax + 0x1c], 0x20
je 0x101e851
cmp byte [eax + 0x19], 3
jb 0x101e851
push 0x1002850
push 0xb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01006234
mov eax, dword [0x1029018]
cmp edi, esi
jne 0x101e8ca
mov eax, dword [ebp - 0x1c]
mov esi, dword [eax]
test esi, esi
je 0x101e891
mov ax, word [esi]
test ax, ax
je 0x101e883
cmp ax, 0x5c
jne 0x101e875
cmp word [esi + 2], ax
jne 0x101e875
add esi, 4
push dword [ebp - 0x20]
lea eax, [ebp - 0x28]
push eax
push 1
push esi
call ebx
mov edi, eax
test esi, esi
je 0x101e891
cmp word [esi], 0
je 0x101e891
test edi, edi
je 0x101e8b9
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
test eax, eax
je 0x101e8ab
cmp word [eax], 0x5c
jne 0x101e8ab
cmp word [eax + 2], 0x5c
jne 0x101e8ab
add eax, 4
push dword [ebp - 0x20]
lea ecx, [ebp - 0x28]
push ecx
push 1
push eax
call ebx
mov edi, eax
push dword [ebp - 0x1c]
call sub.NETAPI32.dll_NetApiBufferFree
test edi, edi
je 0x101e934
mov eax, dword [0x1029018]
add dword [ebp - 0x18], 4
cmp dword [ebp - 0x18], 8
jb 0x101e7e8
jmp 0x101e912
cmp eax, edx
je 0x101e8fc
test byte [eax + 0x1c], 0x20
je 0x101e8fc
cmp byte [eax + 0x19], 2
jb 0x101e8fc
push 0x1002850
push 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01006234
push ebx
lea eax, [ebp - 0x28]
push eax
push 1
push 0
call dword [sym.imp.NETAPI32.dll_DsAddressToSiteNamesW]
mov edi, eax
mov eax, dword [0x1029018]
test eax, eax
je 0x101e934
test byte [eax + 0x1c], 0x20
je 0x101e934
cmp byte [eax + 0x19], 2
jb 0x101e934
push 0x1002850
push 0xd
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01006234
mov eax, edi
pop edi
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.01005634
leave
ret 0x10
Function at 0x101f06e
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push esi
xor esi, esi
push esi
push esi
push esi
lea eax, [ebp - 4]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 8]
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
add eax, eax
push eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, esi
pop ecx
mov dword [ebp - 0x14], eax
jne 0x101f0b2
mov dword [ebp - 8], 8
jmp 0x101f10e
push ebx
push edi
mov edi, dword [ebp + 0xc]
mov dword [edi], esi
xor ebx, ebx
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push esi
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x14]
mov dword [ebp - 0x10], esi
push ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, esi
je 0x101f0ea
cmp eax, 0xea
jne 0x101f0f9
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
lea eax, [ecx + eax*2 + 2]
add dword [edi], eax
inc ebx
jmp 0x101f0bb
cmp eax, 0x103
pop edi
pop ebx
je 0x101f105
mov dword [ebp - 8], eax
push dword [ebp - 0x14]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
mov eax, dword [ebp - 8]
pop esi
leave
ret 8
Function at 0x1021dae
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x14]
add eax, esi
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 0x18]
add eax, 0x2c
cmp dword [ebp + 0xc], eax
mov dword [ebp - 8], eax
jae 0x1021dda
mov eax, 0xea
jmp 0x1021f10
mov edx, dword [ebp + 0x10]
and dword [edx + 4], 0xfffffffc
and word [edx], 0
add dword [ebp - 8], 2
and dword [ebp - 4], 0
push ebx
push edi
lea ebx, [edx + 8]
push 8
mov word [edx + 2], 1
xor eax, eax
pop ecx
mov edi, ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, dword [esi + 0xc]
test ecx, ecx
jbe 0x1021e32
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
mov edi, dword [ebp - 8]
add eax, 4
add eax, edi
cmp eax, dword [ebp + 0xc]
jae 0x1021e32
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
add eax, esi
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
mov dword [ebp - 0xc], eax
jb 0x1021e0a
mov eax, dword [ebp - 4]
mov word [ebx + 0xe], ax
cmp dword [esi + 0xc], 0
jbe 0x1021e4e
test ax, ax
jne 0x1021e4e
mov eax, 0xea
jmp 0x1021f0e
movzx edi, word [edx + 2]
imul edi, edi, 0x22
add edi, ebx
mov eax, edi
sub eax, ebx
mov word [ebx + 0xc], ax
mov word [edi], 0x5c
push dword [esi + 0x18]
lea eax, [esi + 0x1c]
inc edi
push eax
inc edi
push edi
call dword [sym.imp.ntdll.dll_memmove]
mov eax, dword [esi + 0x18]
shr eax, 1
lea edi, [edi + eax*2]
xor ecx, ecx
mov word [edi], cx
mov dx, word [ebx + 6]
mov eax, dword [esi + 0x14]
and dx, 0xfffe
add esp, 0xc
or dx, 2
inc edi
inc edi
mov word [ebx + 6], dx
mov edx, edi
sub edx, ebx
add eax, esi
cmp word [ebx + 0xe], cx
mov dword [ebp + 0xc], edi
mov word [ebx], 3
mov word [ebx + 2], 0x22
mov word [ebx + 4], cx
mov dword [ebx + 8], 0x258
mov word [ebx + 0x10], dx
mov dword [ebp - 4], ecx
jbe 0x1021f04
mov ecx, dword [eax + 0x10]
mov edx, ecx
shr ecx, 2
lea esi, [eax + 0x14]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edx, dword [eax + 0x10]
mov ecx, dword [ebp + 0xc]
shr edx, 1
and word [ecx + edx*2], 0
mov edx, dword [eax + 0x10]
mov eax, dword [eax]
add eax, dword [ebp + 8]
shr edx, 1
inc dword [ebp - 4]
lea edi, [ecx + edx*2 + 2]
movzx ecx, word [ebx + 0xe]
cmp dword [ebp - 4], ecx
mov dword [ebp + 0xc], edi
jb 0x1021ec6
sub edi, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
mov dword [eax], edi
xor eax, eax
pop edi
pop ebx
pop esi
leave
ret 0x10
Function at 0x102276f
Capabilities:
Get domain controller name
Get domain trust relationships

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
push esi
push edi
push 6
mov edx, ecx
pop ecx
xor eax, eax
lea edi, [ebp - 0x34]
rep stosd dword es:[edi], eax
xor esi, esi
lea eax, [ebp - 4]
push eax
push 0x11
push esi
push esi
push dword [edx + 4]
mov dword [ebp - 0x14], edx
push esi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], esi
call dword [sym.imp.NETAPI32.dll_DsGetDcNameW]
mov edi, eax
cmp edi, esi
jne 0x1022848
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push 0x20
push dword [eax]
call dword [sym.imp.NETAPI32.dll_DsEnumerateDomainTrustsW]
mov edi, eax
cmp edi, esi
jne 0x1022840
mov eax, dword [ebp - 4]
push dword [eax]
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x1c]
push eax
call sub.ADVAPI32.dll_LsaOpenPolicy
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edi, eax
cmp edi, esi
jne 0x1022838
push ebx
xor ebx, ebx
cmp dword [ebp - 8], esi
jbe 0x102282f
mov eax, dword [ebp - 0xc]
add eax, esi
test byte [eax + 8], 1
jne 0x1022826
cmp dword [eax + 0x10], 3
je 0x1022826
test byte [eax + 0x14], 8
je 0x1022826
push dword [eax + 4]
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x10]
call fcn.01022691
inc ebx
add esi, 0x2c
cmp ebx, dword [ebp - 8]
jb 0x1022801
push dword [ebp - 0x10]
call sub.ADVAPI32.dll_LsaClose
pop ebx
push dword [ebp - 0xc]
call sub.NETAPI32.dll_NetApiBufferFree
push dword [ebp - 4]
call sub.NETAPI32.dll_NetApiBufferFree
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x10228a1
Capabilities:
Get domain trust relationships

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push edi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
xor edi, edi
push 0x3f
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], edi
call dword [sym.imp.NETAPI32.dll_DsEnumerateDomainTrustsW]
mov ebx, eax
mov eax, dword [0x1029018]
cmp eax, edi
je 0x1022905
mov ecx, ebx
neg ecx
sbb ecx, ecx
and ecx, 0xc
xor edx, edx
dec ecx
inc edx
and ecx, 0x1f
shl edx, cl
or edx, 0x20
test dword [eax + 0x1c], edx
je 0x1022905
cmp byte [eax + 0x19], 2
jb 0x1022905
push ebx
push 0x1002a98
push 0xe
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010174e5
cmp ebx, edi
jne 0x10229dd
mov ecx, dword [ebp - 4]
push esi
xor esi, esi
lea eax, [ecx + 8]
cmp esi, dword [ebp - 0xc]
jae 0x102296a
cmp dword [eax + 8], 1
je 0x1022926
test byte [eax], 8
jne 0x102292c
inc esi
add eax, 0x2c
jmp 0x1022916
imul esi, esi, 0x2c
mov eax, dword [esi + ecx]
cmp eax, edi
je 0x102294d
cmp word [eax], di
je 0x102294d
mov ecx, dword [ebp - 8]
push 1
push edi
push eax
call fcn.01022853
mov ebx, eax
cmp ebx, edi
jne 0x102296a
mov eax, dword [ebp - 4]
mov esi, dword [esi + eax + 4]
cmp esi, edi
je 0x102296a
cmp word [esi], di
je 0x102296a
mov ecx, dword [ebp - 8]
push edi
push edi
push esi
call fcn.01022853
mov ebx, eax
cmp ebx, edi
mov dword [ebp - 0x10], edi
jne 0x10229d4
xor esi, esi
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jae 0x10229d4
mov eax, dword [ebp - 4]
add eax, esi
cmp dword [eax + 0x10], 1
je 0x10229ca
test byte [eax + 8], 8
jne 0x10229ca
mov eax, dword [eax]
cmp eax, edi
je 0x10229a9
cmp word [eax], di
je 0x10229a9
mov ecx, dword [ebp - 8]
push 1
push edi
push eax
call fcn.01022853
mov ebx, eax
cmp ebx, edi
jne 0x10229d4
mov eax, dword [ebp - 4]
mov eax, dword [esi + eax + 4]
cmp eax, edi
je 0x10229ca
cmp word [eax], di
je 0x10229ca
mov ecx, dword [ebp - 8]
push edi
push edi
push eax
call fcn.01022853
mov ebx, eax
cmp ebx, edi
jne 0x10229d4
inc dword [ebp - 0x10]
add esi, 0x2c
cmp ebx, edi
je 0x1022973
push dword [ebp - 4]
call sub.NETAPI32.dll_NetApiBufferFree
pop esi
pop edi
mov eax, ebx
pop ebx
leave
ret
Function at 0x10238cd
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor ebx, ebx
push ebx
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp + 8]
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov esi, eax
cmp esi, ebx
jne 0x1023990
add dword [ebp - 4], 2
push edi
mov esi, dword [ebp - 4]
push esi
call sub.msvcrt.dll_malloc
mov edi, eax
cmp edi, ebx
pop ecx
je 0x102395d
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 0xc]
shr esi, 1
push dword [ebp + 8]
mov word [edi + esi*2 - 2], bx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
cmp esi, ebx
jne 0x102394c
mov eax, dword [ebp - 4]
shr eax, 1
cmp word [edi + eax*2 - 2], bx
je 0x1023964
add dword [ebp - 4], 2
mov esi, 0xea
cmp esi, 0xea
jne 0x1023960
push edi
call sub.msvcrt.dll_free
pop ecx
jmp 0x1023904
push 8
pop esi
cmp esi, ebx
jne 0x102397e
cmp dword [ebp - 8], 1
jne 0x1023977
push edi
push dword [ebp + 0x10]
call fcn.01023557
mov esi, eax
jmp 0x102397a
push 0xd
pop esi
cmp esi, ebx
je 0x102398f
cmp edi, ebx
je 0x102398f
push edi
call sub.msvcrt.dll_free
mov eax, dword [ebp + 0x10]
pop ecx
mov dword [eax + 4], ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc

Function at 0x10256fa
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
movzx eax, word [ecx]
push esi
mov esi, dword [ecx + 4]
push edi
xor edi, edi
shr eax, 1
je 0x1025734
push ebx
mov ebx, eax
xor eax, eax
mov ax, word [esi]
push eax
call dword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
inc esi
inc esi
xor eax, edi
and eax, 0x7f
shr edi, 7
xor edi, dword [eax*4 + 0x10284b8]
dec ebx
jne 0x1025713
pop ebx
mov eax, edi
pop edi
pop esi
pop ebp
ret 4

Function at 0x10265fc
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push edi
xor edi, edi
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], edi
push 0x4000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
cmp ebx, edi
je 0x1026659
lea eax, [ebp - 0xc]
push eax
push edi
push ebx
push 0x102653e
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, edi
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x1029080], eax
je 0x102665e
add dword [ebp - 4], 4
cmp dword [ebp - 4], 0x10
jb 0x1026618
jmp 0x1026672
push 8
pop eax
jmp 0x1026675
push ebx
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4097c8
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x40987c
jmp 0x409871
cmp dword [esi + 0x10], 0x1000
jne 0x40985d
test byte [esi + 0x15], 1
jne 0x40985d
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x40981c
cmp eax, 2
je 0x40981c
cmp eax, 0x10
je 0x40981c
cmp eax, 0x20
jne 0x409831
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409831
mov bl, 1
xor ebp, ebp
jmp 0x409842
mov eax, dword [esi]
add eax, ebp
call fcn.004097c0
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409835
test bl, bl
je 0x40985d
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x40987c
mov eax, dword [esi + 4]
cmp eax, edi
je 0x4097f4
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x38e1538e
test eax, eax
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
nop
mov eax, section..tls
nop
mov ebx, 0x42f314
nop
nop
mov ecx, 0x4df94811
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408f6c
mov ecx, 0x45224b96
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x3b660463
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x404440
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x834
cmp dword [0x5e9580], 0x400
push ebx
push esi
push edi
jne 0x4044ec
push 0
lea eax, [esp + 0x44]
push eax
push 0x403d9c
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
push 0
call fcn.004046e9
add esp, 4
push 0
push 0
call fcn.00404bfc
push 0
push 0
call fcn.004049ac
push 0
call fcn.00404e1c
add esp, 0x14
push 0
push 0
push 0
call fcn.00404d33
fldz
push ecx
fst qword [esp + 8]
fstp qword [esp]
call fcn.004045a0
add esp, 8
fstp st(0)
mov eax, esp
mov dword [eax], 0
mov dword [eax + 4], 0
call fcn.004045c0
fstp st(0)
mov eax, esp
mov dword [eax], 0
mov dword [eax + 4], 0
call fcn.004048c0
fstp st(0)
push 0
call fcn.00404e90
add esp, 0xc
mov ebx, dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
xor esi, esi
lea ebx, [ebx]
cmp esi, 0x97f
jge 0x404516
push 0
push 0
push 0
push 0
push 0
push 0
call ebx
push 0
push 0
push 0
push 0
call edi
cmp esi, 0x160d5c2
jg 0x404531
inc esi
cmp esi, 0x33cd5b9
jl 0x404500
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
nop
call edi
call ebx
cmp esi, 0x12e8236
jg 0x404555
inc esi
cmp esi, 0x2ff8d
jl 0x404540
mov ecx, dword [0x445c5c]
mov dword [0x5e9580], ecx
call fcn.00404130
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov edi, 0x2ec37
mov ebx, 0x51f
cmp dword [0x5e9580], ebx
jne 0x404587
lea edx, [esp + 0x40]
push edx
push 0
call esi
dec edi
jne 0x404576
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4099f3
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x442420]
jne 0x4099fd
repz ret
jmp fcn.0040e37c
Function at 0x40b03c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x442420]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040872d
and dword [ebp - 0x14], 0
cmp dword [0x45a4bc], 0
mov dword [ebp - 0x18], eax
jne 0x40b0ef
push 0x402c34
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40b197
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402c28
push ebx
call edi
test eax, eax
je 0x40b197
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x402c18
push ebx
mov dword [0x45a4bc], eax
call edi
push eax
call esi
push 0x402c04
push ebx
mov dword [0x45a4c0], eax
call edi
push eax
call esi
push 0x402be8
push ebx
mov dword [0x45a4c4], eax
call edi
push eax
call esi
mov dword [0x45a4cc], eax
test eax, eax
je 0x40b0ef
push 0x402bd0
push ebx
call edi
push eax
call esi
mov dword [0x45a4c8], eax
mov eax, dword [0x45a4c8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40b148
cmp dword [0x45a4cc], ecx
je 0x40b148
push eax
call esi
push dword [0x45a4cc]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40b148
test ebx, ebx
je 0x40b148
call edi
test eax, eax
je 0x40b13f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40b13f
test byte [ebp - 8], 1
jne 0x40b148
or dword [ebp + 0x10], 0x200000
jmp 0x40b17b
mov eax, dword [0x45a4c0]
cmp eax, dword [ebp - 0x18]
je 0x40b17b
push eax
call esi
test eax, eax
je 0x40b17b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40b17b
mov eax, dword [0x45a4c4]
cmp eax, dword [ebp - 0x18]
je 0x40b17b
push eax
call esi
test eax, eax
je 0x40b17b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x45a4bc]
call esi
test eax, eax
je 0x40b197
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40b199
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004099f3
leave
ret
Function at 0x402a54
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004047ec
test esi, esi
jne 0x402a8a
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004048dc
jmp 0x402aa8
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402968
mov edi, eax
test esi, esi
je 0x402aa8
cmp dword [ebx], 0
je 0x402aa8
dec esi
jmp 0x402a91
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x403848
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4ac020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4038e0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4038c0
xor eax, eax
push ebp
push 0x4038b9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4038fc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4038c0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x4ac020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4ac020], ax
mov esp, ebp
pop ebp
ret

Function at 0x4045ec
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4b2048], 0
je 0x40464d
cmp word [0x4b221c], 0xd7b2
jne 0x404615
cmp dword [0x4b2224], 0
jbe 0x404615
mov eax, 0x4b2218
call dword [0x4b2234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x4ac070
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404674
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4ac030], 0
jne 0x404669
push 0
push 0x4ac068
push 0x4ac070
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4047a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.0040272c
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x4b2049], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x404768
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc