joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5e54fc
Capabilities:
Check os version
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
mov ebx, eax
call fcn.00426774
cmp eax, 2
je 0x5e5519
mov byte [ebp - 1], 1
jmp 0x5e56ee
mov byte [ebp - 1], 0
mov eax, 0x646ad8
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push 0x20
push 2
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_AllocateAndInitializeSid
test eax, eax
je 0x5e56ee
xor eax, eax
push ebp
push 0x5e56e7
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetVersion
and eax, 0xff
cmp ax, 5
jb 0x5e5582
push 0x5e56f8
push 0x5e5724
call sub.kernel32.dll_GetModuleHandleW
push eax
call fcn.0041158c
mov ebx, eax
test ebx, ebx
je 0x5e55a9
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
call ebx
test eax, eax
je 0x5e56d0
cmp dword [ebp - 0xc], 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
jmp 0x5e56d0
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
test eax, eax
jne 0x5e55fa
call sub.kernel32.dll_GetLastError
cmp eax, 0x3f0
je 0x5e55db
call fcn.004075d4
jmp 0x5e56ee
lea eax, [ebp - 0x10]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x5e55fa
call fcn.004075d4
jmp 0x5e56ee
xor eax, eax
push ebp
push 0x5e56c9
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x5e563d
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
je 0x5e563d
call fcn.004075d4
call fcn.004075d4
jmp 0x5e56ee
mov eax, dword [ebp - 0x14]
call fcn.00405490
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x5e566f
call fcn.004075d4
call fcn.004075d4
jmp 0x5e56ee
mov eax, dword [ebp - 0x18]
mov esi, dword [eax]
dec esi
test esi, esi
jl 0x5e56aa
inc esi
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x5e56a6
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 8]
and eax, 0x14
cmp eax, 4
jne 0x5e56a6
mov byte [ebp - 1], 1
jmp 0x5e56aa
inc ebx
dec esi
jne 0x5e567c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e56d0
mov eax, dword [ebp - 0x18]
call fcn.004054ac
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e56ee
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_FreeSid
ret
movzx eax, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5e5964
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd98
push ebx
xor edx, edx
mov dword [ebp - 0x264], edx
mov dword [ebp - 0x268], edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x5e5b2f
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x5e5af5
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, 0x5e5b4c
call fcn.00409224
test eax, eax
jne 0x5e5af5
mov eax, dword [ebp - 8]
call fcn.005e4cbc
test al, al
je 0x5e5af5
lea eax, [ebp - 0x25c]
push eax
lea edx, [ebp - 0x260]
mov eax, dword [ebp - 8]
call fcn.005d15dc
lea eax, [ebp - 0x260]
mov edx, 0x5e5b5c
call fcn.00408e4c
mov eax, dword [ebp - 0x260]
call fcn.00408c3c
push eax
call sub.kernel32.dll_FindFirstFileW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x5e5af5
xor eax, eax
push ebp
push 0x5e5aee
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x5e5b60
lea eax, [ebp - 0x230]
call fcn.00420c20
test eax, eax
je 0x5e5abf
mov edx, 0x5e5b64
lea eax, [ebp - 0x230]
call fcn.00420c20
test eax, eax
je 0x5e5abf
lea edx, [ebp - 0x264]
mov eax, dword [ebp - 8]
call fcn.005d15dc
mov eax, dword [ebp - 0x264]
push eax
lea eax, [ebp - 0x268]
lea edx, [ebp - 0x230]
mov ecx, 0x104
call fcn.00408cf4
mov ecx, dword [ebp - 0x268]
lea eax, [ebp - 4]
pop edx
call fcn.00408ea4
mov ebx, dword [ebp - 0x25c]
test bl, 1
je 0x5e5a9e
and ebx, 0xfffffffe
push ebx
mov eax, dword [ebp - 4]
call fcn.00408c3c
push eax
call sub.kernel32.dll_SetFileAttributesW
test byte [ebp - 0x25c], 0x10
jne 0x5e5ab7
mov eax, dword [ebp - 4]
call fcn.00408c3c
push eax
call sub.kernel32.dll_DeleteFileW
jmp 0x5e5abf
mov eax, dword [ebp - 4]
call fcn.005e5964
lea eax, [ebp - 0x25c]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x5e5a1b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e5af5
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_FindClose
ret
mov eax, dword [ebp - 8]
call fcn.00408c3c
push eax
call sub.kernel32.dll_RemoveDirectoryW
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e5b36
lea eax, [ebp - 0x268]
mov edx, 3
call fcn.00407e44
lea eax, [ebp - 4]
call fcn.00407de4
ret

Function at 0x5e7838
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
add esp, 0xfffffff4
xor ebx, ebx
call fcn.00426788
cmp eax, 0xa
jl 0x5e78a1
push 0
push 1
lea eax, [esp + 8]
push eax
mov ecx, 0x5e78a8
mov edx, 0x80000001
xor eax, eax
call fcn.005e5180
test eax, eax
jne 0x5e78a1
mov dword [esp + 4], 4
lea eax, [esp + 4]
push eax
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0x5e7924
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x5e7898
cmp dword [esp + 8], 0
jne 0x5e7898
mov bl, 1
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey
mov eax, ebx
add esp, 0xc
pop ebx
ret
Function at 0x5e8720
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
xor eax, eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5e8878
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00426774
cmp eax, 2
jne 0x5e8754
lea eax, [ebp - 4]
call fcn.005e4ef4
jmp 0x5e875c
lea eax, [ebp - 4]
call fcn.005e4ec8
lea eax, [ebp - 0x54]
xor ecx, ecx
mov edx, 0x44
call fcn.00405b40
mov dword [ebp - 0x54], 0x44
push 0x5e8884
push 0x5e88c4
call sub.kernel32.dll_GetModuleHandleW
push eax
call fcn.0041158c
mov ebx, eax
push 0x5e88e0
push 0x5e88c4
call sub.kernel32.dll_GetModuleHandleW
push eax
call fcn.0041158c
mov dword [ebp - 8], eax
test ebx, ebx
je 0x5e87b5
cmp dword [ebp - 8], 0
je 0x5e87b5
lea eax, [ebp - 0x10]
push eax
call ebx
test eax, eax
jne 0x5e87b9
xor eax, eax
jmp 0x5e87bb
mov al, 1
mov byte [ebp - 9], al
xor eax, eax
push ebp
push 0x5e883c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x54]
push eax
mov eax, dword [ebp - 4]
call fcn.00408c3c
push eax
push 0
push 0
push 0
push 0
push 0
push 0x5e8928
lea edx, [ebp - 0x6c]
mov eax, dword [ebp - 4]
call fcn.005d15dc
push dword [ebp - 0x6c]
push 0x5e8938
lea eax, [ebp - 0x68]
mov edx, 3
call fcn.00408f2c
mov eax, dword [ebp - 0x68]
call fcn.00408c3c
push eax
push 0
call sub.kernel32.dll_CreateProcessW
call fcn.00427bfc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e8843
cmp byte [ebp - 9], 0
je 0x5e883b
mov eax, dword [ebp - 0x10]
push eax
call dword [ebp - 8]
ret

Function at 0x5eeea4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
push 0
push 0
push 0
push 2
push 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
mov ecx, edi
mov edx, ebx
xor eax, eax
call fcn.005e5148
call fcn.005eedc8
xor eax, eax
push ebp
push 0x5eef2d
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, esi
test ebx, ebx
je 0x5eeef2
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
mov eax, ebx
add eax, eax
push eax
mov eax, esi
call fcn.00408c3c
push eax
push 1
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExW
call fcn.005eedc8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5eef34
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret

Function at 0x5ef8a8
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
push 0
push 2
lea eax, [ebp - 4]
push eax
mov ecx, esi
mov edx, ebx
xor eax, eax
call fcn.005e5180
test eax, eax
jne 0x5ef8df
push edi
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegDeleteValueW
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x5f4bd0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
mov ebx, eax
push 0x104
lea eax, [ebp - 0x208]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov edx, ebx
lea eax, [ebp - 0x208]
call fcn.00420e48
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x6079b8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x64ed7c], 0
jne 0x6079cf
call fcn.00607974
mov eax, edi
dec eax
test eax, eax
jl 0x6079f7
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x64e97c]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x6079d9
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x60a9c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x60a9f1
dec al
je 0x60aa2c
dec al
je 0x60aa70
dec al
je 0x60aae2
jmp 0x60ab7d
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x60ab7d
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x60aa01
jmp 0x60ab7d
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x60ab7d
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
movzx ecx, al
mov ecx, dword [ebx + ecx*4 + 0x40]
add dl, byte [ecx + esi]
and dl, 0xff
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x60aa3c
jmp 0x60ab7d
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x60ab7d
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, dword [ebx + 0x24]
mov ecx, esi
dec ecx
cmp edx, ecx
jbe 0x60aaa3
xor edx, edx
mov dword [esp + 4], edx
jmp 0x60aab8
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov ebp, dword [ebx + edx*4 + 0x40]
movzx edx, byte [ebp + esi]
add eax, dword [esp + 4]
sar eax, 1
jns 0x60aad0
adc eax, 0
add dl, al
and dl, 0xff
mov byte [ebp + esi], dl
inc esi
dec edi
jne 0x60aa80
jmp 0x60ab7d
xor eax, eax
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 8], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x60ab7d
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, dword [ebx + 0x24]
mov ecx, esi
dec ecx
cmp edx, ecx
ja 0x60ab49
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 8], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 8]
push eax
movzx eax, byte [esp + 8]
pop edx
call fcn.00607a00
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [esp]
and al, 0xff
mov byte [edx + esi], al
inc esi
dec edi
jne 0x60aafe
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x6230d8
Capabilities:
Check if file exists
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x6230e1
mov eax, dword [ebp - 4]
add esp, 0xffffffec
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x2018], edx
mov dword [ebp - 0x200c], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x62332f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x2008]
push eax
push 0
push 0x623340
lea edx, [ebp - 0x200c]
mov eax, ebx
call fcn.005d1a2c
mov eax, dword [ebp - 0x200c]
call fcn.00408c3c
push eax
call sub.kernel32.dll_GetTempFileNameW
test eax, eax
jne 0x623179
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x2014], eax
mov byte [ebp - 0x2010], 0
lea eax, [ebp - 0x2014]
push eax
push 0
mov ecx, 0x623354
mov dl, 1
mov eax, dword [0x41902c]
call fcn.00425aa0
call fcn.004074e0
lea eax, [ebp - 4]
lea edx, [ebp - 0x2008]
mov ecx, 0x1000
call fcn.00408cf4
xor edx, edx
push ebp
push 0x623283
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0x2018]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x2e0]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov edx, dword [ebp - 0x2018]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
movzx ecx, byte [eax + 0x354]
mov eax, dword [ebp - 4]
call fcn.005e8060
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
cmp byte [eax + 0x65b], 0
je 0x623233
mov eax, ebx
call fcn.005e4c84
test al, al
je 0x623233
lea ecx, [ebp - 8]
mov edx, 0x6233c8
mov eax, ebx
call fcn.005d1644
mov eax, dword [ebp - 8]
call fcn.00420768
mov eax, dword [ebp - 8]
call fcn.00408c3c
push eax
mov eax, ebx
call fcn.00408c3c
push eax
call sub.kernel32.dll_MoveFileW
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x623233
mov ecx, 0x6233e0
mov dl, 1
mov eax, dword [0x41902c]
call fcn.00425a64
call fcn.004074e0
mov eax, ebx
call fcn.00420768
test al, al
jne 0x623279
call sub.kernel32.dll_GetLastError
cmp eax, 2
je 0x623279
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x2014], eax
mov byte [ebp - 0x2010], 0
lea eax, [ebp - 0x2014]
push eax
push 0
mov ecx, 0x62344c
mov dl, 1
mov eax, dword [0x41902c]
call fcn.00425aa0
call fcn.004074e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x62329a
mov eax, ebx
call fcn.00408c3c
push eax
mov eax, dword [ebp - 4]
call fcn.00408c3c
push eax
call sub.kernel32.dll_MoveFileW
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x6232eb
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x2014], eax
mov byte [ebp - 0x2010], 0
lea eax, [ebp - 0x2014]
push eax
push 0
mov ecx, 0x6234d0
mov dl, 1
mov eax, dword [0x41902c]
call fcn.00425aa0
call fcn.004074e0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
lea edx, [eax + 0x34c]
mov eax, ebx
call fcn.005e7538
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x623336
lea eax, [ebp - 0x2018]
call fcn.00407de4
lea eax, [ebp - 0x200c]
call fcn.00407de4
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407e44
ret
Function at 0x666c12f3
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
lea eax, [ebp - 0x2c]
mov dword [esp], eax
call sym._GetSystemInfo_4
sub esp, 4
mov eax, dword [ebp - 0x14]
cmp eax, 0x182
je 0x666c1325
mov eax, dword [ebp - 0x14]
cmp eax, 0x1e6
je 0x666c1325
mov eax, dword [ebp - 0x14]
cmp eax, 0x24a
jne 0x666c132c
mov eax, 1
jmp 0x666c1331
mov eax, 0
leave
ret

Function at 0x666c1333
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov dword [ebp - 0xc], 0
mov dword [esp + 8], 0x100
lea eax, [ebp - 0x10c]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
test eax, eax
jne 0x666c1382
call sym._GetLastError_0
mov dword [esp + 4], eax
mov dword [esp], str.GetModuleFileName___failed_with_error_code__d_n
call sym._printf
jmp 0x666c14e4
mov dword [esp + 4], 0x5c
lea eax, [ebp - 0x10c]
mov dword [esp], eax
call sym._strrchr
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x666c13bb
call sym._GetLastError_0
mov dword [esp + 4], eax
mov dword [esp], str.strrchr___failed_with_error_code__d_n
call sym._printf
jmp 0x666c14e4
mov eax, dword [ebp - 0xc]
mov byte [eax], 0
lea eax, [ebp - 0x20c]
mov dword [eax], 0x74666f53
mov dword [eax + 4], 0x65726177
mov dword [eax + 8], 0x63694d5c
mov dword [eax + 0xc], 0x6f736f72
mov dword [eax + 0x10], 0x575c7466
mov dword [eax + 0x14], 0x6f646e69
mov dword [eax + 0x18], 0x435c7377
mov dword [eax + 0x1c], 0x65727275
mov dword [eax + 0x20], 0x6556746e
mov dword [eax + 0x24], 0x6f697372
mov dword [eax + 0x28], 0x75525c6e
mov word [eax + 0x2c], 0x6e
mov dword [ebp - 0x210], 0
lea eax, [ebp - 0x210]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xf003f
mov dword [esp + 8], 0
lea eax, [ebp - 0x20c]
mov dword [esp + 4], eax
mov dword [esp], 0x80000001
call sym._RegOpenKeyExA_20
sub esp, 0x14
test eax, eax
je 0x666c1471
call sym._GetLastError_0
mov dword [esp + 4], eax
mov dword [esp], str.RegOpenKeyEx___failed_with_error_code__d_n
call sym._printf
jmp 0x666c14e4
lea eax, [ebp - 0x10c]
mov dword [esp], eax
call sym._strlen
mov edx, eax
mov eax, dword [ebp - 0x210]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x10c]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.MyApp
mov dword [esp], eax
call sym._RegSetValueExA_24
sub esp, 0x18
test eax, eax
je 0x666c14d3
call sym._GetLastError_0
mov dword [esp + 4], eax
mov dword [esp], str.RegSetValueEx___failed_with_error_code__d_n
call sym._printf
jmp 0x666c14e4
mov eax, dword [ebp - 0x210]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
leave
ret
Function at 0x666c1550
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
add eax, 1
mov dword [ebp - 0xc], eax
mov dword [esp], str.kernel32.dll
call sym._GetModuleHandleA_4
sub esp, 4
mov dword [esp + 4], str.LoadLibraryA
mov dword [esp], eax
call sym._GetProcAddress_8
sub esp, 8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x1f0fff
call sym._OpenProcess_12
sub esp, 0xc
mov dword [ebp - 0x14], eax
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0x1000
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._VirtualAllocEx_20
sub esp, 0x14
mov dword [ebp - 0x18], eax
mov dword [esp + 0x10], 0
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._WriteProcessMemory_20
sub esp, 0x14
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov edx, dword [ebp - 0x18]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._CreateRemoteThread_28
sub esp, 0x1c
mov dword [ebp - 0x1c], eax
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
mov dword [esp + 0xc], 0x8000
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._VirtualFreeEx_16
sub esp, 0x10
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
nop
leave
ret

Function at 0x666c1849
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0xc]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov eax, dword [ebp + 8]
call eax
nop
leave
ret

Function at 0x666c1892
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x10c]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
mov dword [esp], 0x1388
call sym._Sleep_4
sub esp, 4
lea eax, [ebp - 0x10c]
mov dword [esp], eax
call sym._DeleteFileA_4
sub esp, 4
nop
leave
ret
Function at 0x666c1c20
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x666c603c
call sym._EnterCriticalSection_4
mov ebx, dword [0x666c6034]
sub esp, 4
test ebx, ebx
je 0x666c1c6b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x666c1c64
test esi, esi
je 0x666c1c64
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x666c1c40
mov dword [esp], 0x666c603c
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x666c1e50
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], 0x666c41c0
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x666c1ea0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x666c1f78
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x666c1ede
cmp eax, 4
jne 0x666c1f00
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x666c1eee
cmp edx, 4
je 0x666c1eee
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.666c1e50