joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432a16
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 4], ebx
test byte [esi + 4], 1
mov edi, dword [esi + 0xc]
jne 0x432a6c
push 5
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x432a45
call fcn.0042283a
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x432a5a
call fcn.0042283a
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x432a6c
call fcn.0042283a
call fcn.004184c0
cmp dword [eax + 0x3c], 0
je 0x432a81
push edi
mov ecx, ebx
call fcn.00432146
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.00432c53
mov ebx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x88]
test ecx, ecx
je 0x432aaa
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
and dword [eax + 0x88], 0
test ebx, ebx
je 0x432ab6
mov edi, ebx
mov dword [eax + 0x88], ebx
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x4422e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
push edi
test esi, esi
jne 0x4422fa
call fcn.004184c0
mov esi, dword [eax + 0xc]
push 0x59a968
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x442350
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x442350
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
test eax, eax
jne 0x44232f
xor esi, esi
jmp 0x442345
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 8]
push eax
push dword [ebp - 4]
call fcn.00442359
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
jmp 0x442352
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x46f15e
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
call fcn.0050379c
call fcn.00418514
cmp dword [eax + 0x14], 0
jne 0x46f179
mov ecx, esi
pop esi
jmp fcn.0046e461
pop esi
ret

Function at 0x47d90d
Capabilities:
Get common file path
Get file system object information

Disassembly:
push esi
mov esi, ecx
call fcn.00416dd0
call fcn.00418514
cmp dword [eax + 0x14], 0
jne 0x47d928
mov ecx, esi
pop esi
jmp fcn.0047d189
pop esi
ret
Function at 0x528635
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
call fcn.0057367a
pop ecx
test eax, eax
jne 0x528677
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str._s_s_X.tmp
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.00427e97
add esp, 0x18
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x52863d
leave
ret
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
leave
ret

Function at 0x57b75f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0057b422

Function at 0x57b76a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0057b5a3

Function at 0x57e9c2
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0057e682

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x433072
nop
nop
nop
nop
nop
mov ebx, 0x40de38
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x597e67cb
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
mov esi, 0x2a7b1106
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..data
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x5c1456b9
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
mov eax, section..data_1
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4330d2
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x4a8d0e3c
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4330c0
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x401f72
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push 0x20019
push esi
push str.SoftwarePoliciesAdobeAcrobat_ReaderDCFeatureLockDown
push 0x80000002
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401fde
lea eax, [ebp - 0x10]
mov dword [ebp - 8], esi
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0x10], 4
push eax
push esi
push str.bEnableATL7Compat
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401fd5
cmp dword [ebp - 8], 4
jne 0x401fd5
inc eax
cmp dword [ebp - 0xc], eax
cmove esi, eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret

Function at 0x401fe3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 8]
push esi
push edi
push eax
push 0x20019
xor edi, edi
xor esi, esi
push edi
push str.SoftwareAdobeAdobe_AcrobatDCSecurity
push 0x80000002
inc esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402049
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], edi
push eax
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], 4
push eax
push edi
push 0x404588
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402040
cmp dword [ebp - 4], eax
cmove esi, eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
leave
ret

Function at 0x401000
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x403004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], esp
and esp, 0xfffffff0
push 0x33
call 0x40102e
add byte [esp], 5
retf

Function at 0x401080
Capabilities:
Execute command

Disassembly:
push 0x403018
call fcn.00401000
add esp, 4
push 0
push 0
push 0x402100
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push str.pause
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
xor eax, eax
ret
Function at 0x401040
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov ebx, 0x43b194
mov dword [ebp - 8], 0
mov eax, dword [ebx]
inc eax
push eax
call fcn.0041f104
mov edi, eax
xor eax, eax
add esp, 4
mov dword [ebp - 4], edi
cmp dword [ebx], eax
jbe 0x401082
lea esp, [esp]
mov ecx, dword [ebx + 4]
mov dl, byte [ecx + eax]
xor dl, byte [ebx - 4]
inc eax
mov byte [eax + edi - 1], dl
cmp eax, dword [ebx]
jb 0x401070
mov byte [eax + edi], 0
mov ecx, dword [0x442b5c]
mov edx, dword [0x442b58]
lea eax, [ebp - 4]
cmp eax, ecx
jae 0x401109
cmp edx, eax
ja 0x401109
mov esi, dword [0x442b60]
mov edi, eax
sub edi, edx
sar edi, 2
cmp ecx, esi
jne 0x4010fe
mov eax, ecx
sub eax, edx
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x40118c
sub esi, edx
inc eax
sar esi, 2
cmp eax, esi
jbe 0x4010fe
mov ecx, esi
mov edx, ecx
shr edx, 1
mov esi, 0x3fffffff
sub esi, edx
cmp esi, ecx
jae 0x4010df
xor ecx, ecx
jmp 0x4010e1
add ecx, edx
cmp ecx, eax
jae 0x4010e7
mov ecx, eax
push ecx
mov esi, 0x442b58
call fcn.00401200
mov ecx, dword [0x442b5c]
mov edx, dword [0x442b58]
test ecx, ecx
je 0x401165
mov edx, dword [edx + edi*4]
mov dword [ecx], edx
jmp 0x40115f
mov esi, dword [0x442b60]
cmp ecx, esi
jne 0x401159
mov eax, ecx
sub eax, edx
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x40118c
sub esi, edx
mov edx, esi
inc eax
sar edx, 2
cmp eax, edx
jbe 0x401159
mov ecx, edx
shr edx, 1
mov esi, 0x3fffffff
sub esi, edx
cmp esi, ecx
jae 0x401140
xor ecx, ecx
jmp 0x401142
add ecx, edx
cmp ecx, eax
jae 0x401148
mov ecx, eax
push ecx
mov esi, 0x442b58
call fcn.00401200
mov ecx, dword [0x442b5c]
test ecx, ecx
je 0x401165
mov dword [ecx], edi
mov ecx, dword [0x442b5c]
mov eax, dword [ebp - 8]
add eax, 0xc
add ecx, 4
add ebx, 0xc
mov dword [0x442b5c], ecx
mov dword [ebp - 8], eax
cmp eax, 0x1e0
jb 0x401055
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.vector_T__too_long
call fcn.0041f049
int3
Function at 0x401300
Capabilities:
Check if file exists

Disassembly:
push ebx
push esi
push edi
push 0
call fcn.0042051a
push eax
call fcn.004203e6
add esp, 8
mov ebx, 0x442bc0
mov edi, 0x442ba4
lea ecx, [ecx]
mov eax, dword [ebx]
push eax
call fcn.004204a0
add esp, 4
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401330
sub eax, edx
mov edx, eax
mov eax, dword [edi]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401340
sub eax, esi
lea ecx, [eax + edx + 8]
push ecx
call fcn.0041f104
mov edx, dword [edi]
add esp, 4
mov esi, eax
mov eax, dword [ebx]
push edx
push eax
call fcn.004204a0
add esp, 4
push eax
push 0x43b384
push esi
call fcn.00420357
add esp, 0x10
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x40140b
push esi
call fcn.004203db
add edi, 4
add esp, 4
cmp edi, 0x442bc0
jl 0x401320
add ebx, 4
cmp ebx, 0x442bc4
jl 0x401318
call fcn.004203f8
mov ecx, dword [0x442bc0]
push ecx
call fcn.004204a0
add esp, 4
mov ebx, eax
call fcn.004203f8
cdq
mov ecx, 7
idiv ecx
mov eax, ebx
mov edi, dword [edx*4 + 0x442ba4]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4013d6
sub eax, edx
mov edx, eax
mov eax, edi
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4013e6
sub eax, esi
lea edx, [eax + edx + 8]
push edx
call fcn.0041f104
push edi
push ebx
mov esi, eax
push 0x43b384
push esi
call fcn.00420357
add esp, 0x14
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x401420
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
call fcn.0042051a
push eax
call fcn.004203e6
add esp, 8
push ebx
push esi
mov dword [ebp - 4], 0x442bc4
push edi
mov edi, edi
push 0
call fcn.0042051a
push eax
call fcn.004203e6
add esp, 8
mov ebx, 0x442bc0
mov edi, 0x442ba4
lea ebx, [ebx]
mov eax, dword [ebx]
push eax
call fcn.004204a0
add esp, 4
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401470
sub eax, edx
mov edx, eax
mov eax, dword [edi]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401480
sub eax, esi
lea ecx, [eax + edx + 8]
push ecx
call fcn.0041f104
mov edx, dword [edi]
add esp, 4
mov esi, eax
mov eax, dword [ebx]
push edx
push eax
call fcn.004204a0
add esp, 4
push eax
push 0x43b384
push esi
call fcn.00420357
add esp, 0x10
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x40154b
push esi
call fcn.004203db
add edi, 4
add esp, 4
cmp edi, 0x442bc0
jl 0x401460
add ebx, 4
cmp ebx, 0x442bc4
jl 0x401455
call fcn.004203f8
mov ecx, dword [0x442bc0]
push ecx
call fcn.004204a0
add esp, 4
mov ebx, eax
call fcn.004203f8
cdq
mov ecx, 7
idiv ecx
mov eax, ebx
mov edi, dword [edx*4 + 0x442ba4]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401516
sub eax, edx
mov edx, eax
mov eax, edi
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401526
sub eax, esi
lea edx, [eax + edx + 8]
push edx
call fcn.0041f104
push edi
push ebx
mov esi, eax
push 0x43b384
push esi
call fcn.00420357
add esp, 0x14
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401550
mov ebx, dword [ebp - 4]
sub eax, edx
mov edx, eax
mov eax, dword [ebx]
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401563
sub eax, edi
lea eax, [eax + edx + 8]
push eax
call fcn.0041f104
mov ecx, dword [ebx]
push ecx
push esi
mov edi, eax
push 0x43b384
push edi
call fcn.00420357
push esi
call fcn.004203db
add esp, 0x18
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x401624
push edi
call fcn.004203db
add ebx, 4
add esp, 4
mov dword [ebp - 4], ebx
cmp ebx, 0x442be4
jl 0x401440
call fcn.00401300
mov edi, eax
call fcn.004203f8
and eax, 0x80000007
jns 0x4015d2
dec eax
or eax, 0xfffffff8
inc eax
mov ebx, dword [eax*4 + 0x442bc4]
mov eax, edi
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4015e0
sub eax, edx
mov edx, eax
mov eax, ebx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4015f0
sub eax, esi
lea edx, [eax + edx + 8]
push edx
call fcn.0041f104
push ebx
push edi
mov esi, eax
push 0x43b384
push esi
call fcn.00420357
push edi
call fcn.004203db
add esp, 0x18
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401630
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
call fcn.0042051a
push eax
call fcn.004203e6
add esp, 8
push ebx
push esi
mov dword [ebp - 4], 0x442b88
push edi
mov edi, edi
push 0
call fcn.0042051a
push eax
call fcn.004203e6
add esp, 8
mov ebx, 0x442bc0
mov edi, 0x442ba4
lea ebx, [ebx]
mov eax, dword [ebx]
push eax
call fcn.004204a0
add esp, 4
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401680
sub eax, edx
mov edx, eax
mov eax, dword [edi]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401690
sub eax, esi
lea ecx, [eax + edx + 8]
push ecx
call fcn.0041f104
mov edx, dword [edi]
add esp, 4
mov esi, eax
mov eax, dword [ebx]
push edx
push eax
call fcn.004204a0
add esp, 4
push eax
push 0x43b384
push esi
call fcn.00420357
add esp, 0x10
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x40175b
push esi
call fcn.004203db
add edi, 4
add esp, 4
cmp edi, 0x442bc0
jl 0x401670
add ebx, 4
cmp ebx, 0x442bc4
jl 0x401665
call fcn.004203f8
mov ecx, dword [0x442bc0]
push ecx
call fcn.004204a0
add esp, 4
mov ebx, eax
call fcn.004203f8
cdq
mov ecx, 7
idiv ecx
mov eax, ebx
mov edi, dword [edx*4 + 0x442ba4]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401726
sub eax, edx
mov edx, eax
mov eax, edi
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401736
sub eax, esi
lea edx, [eax + edx + 8]
push edx
call fcn.0041f104
push edi
push ebx
mov esi, eax
push 0x43b384
push esi
call fcn.00420357
add esp, 0x14
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401760
mov ebx, dword [ebp - 4]
sub eax, edx
mov edx, eax
mov eax, dword [ebx]
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401773
sub eax, edi
lea eax, [eax + edx + 8]
push eax
call fcn.0041f104
mov ecx, dword [ebx]
push ecx
push esi
mov edi, eax
push 0x43b384
push edi
call fcn.00420357
add esp, 0x14
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x401834
push esi
call fcn.004203db
push edi
call fcn.004203db
add ebx, 4
add esp, 8
mov dword [ebp - 4], ebx
cmp ebx, 0x442ba4
jl 0x401650
call fcn.00401300
mov edi, eax
call fcn.004203f8
cdq
mov ecx, 7
idiv ecx
mov eax, edi
mov ebx, dword [edx*4 + 0x442b88]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4017f0
sub eax, edx
mov edx, eax
mov eax, ebx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401800
sub eax, esi
lea edx, [eax + edx + 8]
push edx
call fcn.0041f104
push ebx
push edi
mov esi, eax
push 0x43b384
push esi
call fcn.00420357
push edi
call fcn.004203db
add esp, 0x18
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401840
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0
call fcn.0042051a
push eax
call fcn.004203e6
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
xor esi, esi
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push connect
call edi
mov eax, dword [ebp - 4]
test eax, eax
je 0x4018a4
mov ecx, dword [esi*4 + 0x442b68]
push 0
push 0
push 0
push 0
push ecx
push eax
call ebx
test eax, eax
je 0x4018c9
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc esi
cmp esi, 8
jl 0x401865
call fcn.004203f8
and eax, 0x80000007
jns 0x4018bb
dec eax
or eax, 0xfffffff8
inc eax
mov eax, dword [eax*4 + 0x442b68]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esi*4 + 0x442b68]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402070
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push 0x43b418
push eax
xor bl, bl
call fcn.00420f39
mov esi, eax
add esp, 8
test esi, esi
je 0x4020ef
mov ecx, dword [ebp + 8]
push edi
push 0x43b41c
push ecx
call fcn.00420f39
mov edi, eax
add esp, 8
test edi, edi
je 0x4020e5
push esi
call fcn.00420667
add esp, 4
test eax, eax
jne 0x4020da
push esi
push 1
lea edx, [ebp - 1]
push 1
push edx
call fcn.00421291
push edi
push 1
lea eax, [ebp - 1]
push 1
push eax
call fcn.0042147a
push esi
call fcn.00420667
add esp, 0x24
test eax, eax
je 0x4020b1
push edi
mov bl, 1
call fcn.00421860
add esp, 4
push esi
call fcn.00421860
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402100
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x43f480]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push str.SYSTEMROOT
mov dword [ebp - 0x98], eax
call fcn.004204a0
add esp, 4
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402130
sub eax, edx
add eax, 0x20
push eax
call fcn.0041f104
push str.SYSTEMROOT
mov edi, eax
call fcn.004204a0
push eax
push str._s_notepad.exe
push edi
call fcn.00420357
mov ebx, dword [sym.imp.KERNEL32.dll_OpenFile]
add esp, 0x14
push 0
lea ecx, [ebp - 0x94]
push ecx
push edi
call ebx
mov esi, eax
cmp esi, 0xffffffff
je 0x4021c1
push 0
push 0
lea edx, [ebp - 0xa0]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x98]
push 2
lea eax, [ebp - 0x94]
push eax
push ecx
call ebx
mov esi, eax
cmp esi, 0xffffffff
je 0x4021c1
push 0
push 0
lea edx, [ebp - 0xa0]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.004203db
mov ecx, dword [ebp - 8]
add esp, 4
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041fc56
mov esp, ebp
pop ebp
ret
Function at 0x402cf0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x436338
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x43f480]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov edi, ecx
cmp ebx, 0xffffffff
jne 0x402d2c
xor eax, eax
jmp 0x402eb1
mov eax, dword [edi + 0x24]
mov ecx, dword [eax]
test ecx, ecx
je 0x402d55
mov eax, dword [edi + 0x34]
mov edx, dword [eax]
add edx, ecx
cmp ecx, edx
jae 0x402d55
dec dword [eax]
mov edi, dword [edi + 0x24]
mov eax, dword [edi]
lea ecx, [eax + 1]
mov dword [edi], ecx
mov byte [eax], bl
mov eax, ebx
jmp 0x402eb1
cmp dword [edi + 0x54], 0
je 0x402eae
mov ecx, dword [edi + 0x10]
lea edx, [edi + 0x48]
cmp dword [ecx], edx
jne 0x402d7d
mov edx, dword [edi + 0x3c]
mov eax, dword [edi + 0x40]
mov dword [ecx], edx
mov ecx, dword [edi + 0x20]
mov dword [ecx], eax
mov edx, dword [edi + 0x30]
sub eax, eax
mov dword [edx], eax
cmp dword [edi + 0x44], 0
jne 0x402da3
mov edi, dword [edi + 0x54]
movsx eax, bl
push edi
push eax
call fcn.0042056b
add esp, 8
cmp eax, 0xffffffff
je 0x402eae
mov eax, ebx
jmp 0x402eb1
lea esi, [ebp - 0x2c]
mov byte [ebp - 0x2d], bl
call fcn.00403660
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x18]
jmp 0x402dc0
mov edx, eax
cmp ebx, 0x10
jae 0x402dcc
lea edx, [ebp - 0x2c]
mov eax, edx
add edx, dword [ebp - 0x1c]
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x34]
push ebx
push edx
push eax
lea edx, [ebp - 0x38]
push edx
lea eax, [ebp - 0x2c]
push eax
lea edx, [ebp - 0x2d]
push edx
lea eax, [edi + 0x4c]
push eax
mov eax, dword [esi + 0x14]
call eax
test eax, eax
js 0x402ea6
cmp eax, 1
jg 0x402e60
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, eax
cmp ebx, 0x10
jae 0x402e0c
lea ecx, [ebp - 0x2c]
mov esi, dword [ebp - 0x34]
sub esi, ecx
je 0x402e35
cmp ebx, 0x10
jae 0x402e1b
lea eax, [ebp - 0x2c]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call fcn.0042147a
add esp, 0x10
cmp esi, eax
jne 0x402ea6
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x2d]
mov byte [edi + 0x49], 1
cmp dword [ebp - 0x38], edx
jne 0x402e99
test esi, esi
jne 0x402dc0
cmp dword [ebp - 0x1c], 0x20
jae 0x402ea6
push esi
lea ebx, [esi + 8]
lea esi, [ebp - 0x2c]
call fcn.004036c0
jmp 0x402db5
cmp eax, 3
jne 0x402ea6
mov edi, dword [edi + 0x54]
movsx eax, byte [ebp - 0x2d]
push edi
push eax
call fcn.0042056b
add esp, 8
cmp eax, 0xffffffff
je 0x402e8a
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
call fcn.00402440
mov eax, esi
jmp 0x402eb1
lea ecx, [ebp - 0x2c]
or esi, 0xffffffff
call fcn.00402440
mov eax, esi
jmp 0x402eb1
lea ecx, [ebp - 0x2c]
call fcn.00402440
mov eax, dword [ebp + 8]
jmp 0x402eb1
lea ecx, [ebp - 0x2c]
call fcn.00402440
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041fc56
mov esp, ebp
pop ebp
ret 4