joyce8/EMBER2024-capa huggingface dataset:
Function at 0x449532
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x472224]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.0043e2a0
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.0043e2a0
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x4495a9
cmp word [ecx], dx
je 0x4495a9
mov eax, dword [0x461e8c]
push edi
dec eax
push eax
push 0x461d78
call fcn.004494d1
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x44961c
cmp word [eax], dx
je 0x44961c
mov eax, dword [edi]
test eax, eax
je 0x4495cd
cmp word [eax], dx
je 0x4495cd
lea eax, [ebp - 0x10]
push eax
call fcn.00448eb4
jmp 0x4495d6
lea eax, [ebp - 0x10]
push eax
call fcn.00448f4f
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x449646
mov eax, dword [0x461d74]
push dword [ebp - 0x14]
dec eax
push eax
push 0x461a68
call fcn.004494d1
add esp, 0xc
test al, al
je 0x449646
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x449611
cmp word [eax], di
je 0x449611
lea eax, [ebp - 0x10]
push eax
call fcn.00448eb4
pop ecx
jmp 0x449648
lea eax, [ebp - 0x10]
push eax
call fcn.00448f4f
jmp 0x44960e
mov eax, dword [edi]
test eax, eax
je 0x449633
cmp word [eax], dx
je 0x449633
lea eax, [ebp - 0x10]
push eax
call fcn.00448e69
pop ecx
jmp 0x449646
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x449711
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.00449356
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x449711
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x449711
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x449711
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x44969e
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.00440144
test ebx, ebx
je 0x44970c
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.00440144
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x449711
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x449711
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.004436a3
add esp, 0x10
xor eax, eax
inc eax
jmp 0x449713
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00428f90
leave
ret
Function at 0x44d960
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x44d98d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x44d98d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x407d9c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407e75
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x407dd4
mov eax, dword [ebp - 4]
call fcn.004071d0
jmp 0x407ddc
mov eax, dword [ebp - 4]
call fcn.00407bd4
call fcn.00404ae8
mov esi, eax
test esi, esi
jle 0x407e28
mov ebx, 1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x407e12
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.004071d0
jmp 0x407e24
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0x10]
call fcn.00407bd4
inc ebx
dec esi
jne 0x407dec
push 1
push dword [ebp - 4]
push 0x407e8c
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00406f34
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004032cc
mov eax, dword [ebp - 0x14]
call fcn.0040340c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407e7c
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x42e072
nop
nop
nop
nop
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x78474e69
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e060
nop
nop
nop
mov eax, section..text_1
nop
nop
nop
nop
cmp eax, 0
je 0x42e0d2
nop
nop
nop
nop
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x430d1367
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x42e0c0
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x40f000
Capabilities:
Packed with generic packer

Disassembly:
pushal
call 0x40f006
or ebp, 0xffffffff
xor ebx, ebx
pop esi
lea edi, [esi - 0xe006]
push edi
add word [edi], 0
add esi, 0x1b3
jmp 0x40f02e
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40f039
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40f028
mov eax, 1
add ebx, ebx
jne 0x40f04b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
ja 0x40f040
jne 0x40f05c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40f040
xor ecx, ecx
sub eax, 3
jb 0x40f0ca
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40f0e6
mov ebp, eax
add ebx, ebx
jne 0x40f07b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40f088
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40f0ac
inc ecx
add ebx, ebx
jne 0x40f098
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
ja 0x40f08d
jne 0x40f0a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40f08d
add ecx, 2
cmp eax, 0xfffff300
adc ecx, 1
lea edx, [edi + eax]
cmp eax, 0xfffffffc
jle 0x40f0d0
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40f0bc
jmp 0x40f02e
mov eax, ebp
jmp 0x40f070
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40f0d0
add edi, ecx
jmp 0x40f02e
pop esi
sub edi, dword [edi - 4]
push edi
lea edi, [esi]
mov ecx, 0x2b9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40f0f6
cmp byte [edi], 0
jne 0x40f0f6
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x40f0fb
pop edi
mov eax, dword [edi]
or eax, eax
je 0x40f166
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xd000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xd0a0]
xchg edx, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40f123
push edx
mov ecx, edi
jns 0x40f153
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push edx
call dword [esi + 0xd0a4]
pop edx
mov dword [ebx], eax
add ebx, 4
jmp 0x40f140
lea ebx, [esi - 4]
add edi, 4
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x40f197
cmp al, 0xef
ja 0x40f18a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x40f16c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x40f179
popal
jmp 0x405be8
Function at 0x1000125c
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0xc], 0
call sub.KERNEL32.DLL_GetEnvironmentStringsA
mov ebx, eax
mov dword [ebp - 0x10], ebx
jmp 0x10001299
cmp byte [ebx], 0x3d
je 0x10001285
inc dword [ebp - 0xc]
mov edi, ebx
xor eax, eax
stc
sbb ecx, ecx
repne scasb al, byte es:[edi]
neg ecx
lea eax, [ecx - 2]
mov edi, eax
inc edi
lea ebx, [ebx + edi]
cmp byte [ebx], 0
jne 0x10001278
mov edi, dword [ebp - 0xc]
inc edi
lea edi, [edi*4]
mov dword [ebp - 0x14], edi
push dword [ebp - 0x14]
call sub.CRTDLL.DLL_malloc
pop ecx
mov dword [ebp - 8], eax
mov dword [0x10003010], eax
cmp dword [ebp - 8], 0
jne 0x100012cc
xor eax, eax
jmp 0x10001342
mov ebx, dword [ebp - 0x10]
jmp 0x10001325
mov edi, ebx
xor eax, eax
stc
sbb ecx, ecx
repne scasb al, byte es:[edi]
neg ecx
lea eax, [ecx - 2]
mov edi, eax
inc edi
mov dword [ebp - 4], edi
cmp byte [ebx], 0x3d
je 0x1000131f
push dword [ebp - 4]
call sub.CRTDLL.DLL_malloc
pop ecx
mov esi, dword [ebp - 8]
mov dword [esi], eax
or eax, eax
jne 0x10001308
jmp 0x10001342
push ebx
mov edi, dword [ebp - 8]
push dword [edi]
call sub.CRTDLL.DLL_strcpy
add esp, 8
add dword [ebp - 8], 4
mov edx, dword [ebp - 4]
lea ebx, [ebx + edx]
cmp byte [ebx], 0
jne 0x100012d1
mov edx, dword [ebp - 8]
mov dword [edx], 0
mov eax, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401770
Capabilities:
Check os version

Disassembly:
push ebp
mov ecx, 0x94
mov ebp, esp
push ebx
lea eax, [ebp - 0xa8]
sub esp, 0xc4
mov dword [ebp - 0xa8], ecx
mov ebx, dword [ebp + 8]
mov dword [esp], eax
call sub.KERNEL32.dll_GetVersionExA
mov ecx, dword [ebp - 0xa4]
sub esp, 4
cmp ecx, 6
je 0x4017d7
cmp ecx, 5
mov edx, dword [ebp - 0xa0]
je 0x401810
mov eax, dword [ebp - 0x9c]
mov dword [esp], ebx
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], eax
mov eax, str.Windows__i._i_build__i
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
call sub.msvcrt.dll_sprintf
mov ebx, dword [ebp - 4]
leave
ret
mov edx, dword [ebp - 0xa0]
cmp edx, 2
je 0x401840
cmp edx, 1
je 0x40182f
test edx, edx
jne 0x4017af
mov edx, dword [ebp - 0x9c]
mov eax, str.Windows_Vista_build__i
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.msvcrt.dll_sprintf
mov ebx, dword [ebp - 4]
leave
ret
cmp edx, 2
je 0x401855
cmp edx, 1
je 0x401866
test edx, edx
jne 0x4017af
mov edx, dword [ebp - 0x9c]
mov eax, str.Windows_2000_build__i
mov dword [esp + 8], edx
jmp 0x4017fa
mov ecx, dword [ebp - 0x9c]
mov eax, str.Windows_7_build__i
mov dword [esp + 8], ecx
jmp 0x4017fa
mov eax, dword [ebp - 0x9c]
mov edx, str.Windows_8_build__i
mov dword [esp + 4], edx
mov dword [esp + 8], eax
jmp 0x4017fe
mov eax, dword [ebp - 0x9c]
mov dword [esp + 8], eax
mov eax, str.Windows_Server_2003_build__i
jmp 0x4017fa
mov ecx, dword [ebp - 0x9c]
mov eax, str.Windows_XP_build__i
mov dword [esp + 8], ecx
jmp 0x4017fa
Function at 0x4027a0
Capabilities:
Create process on windows
Create process suspended
Set current directory

Disassembly:
push ebp
mov eax, 0x325fc
mov ebp, esp
push edi
push esi
push ebx
call fcn.004f12a0
mov byte [ebp - 0x128], 0
xor ebx, ebx
mov byte [ebp - 0x19128], 0
mov byte [ebp - 0x325c9], 0
call sub.msvcrt.dll___p___argc
cmp dword [eax], ebx
jle 0x402800
cmp byte [ebp - 0x325c9], 0
jne 0x402840
call sub.msvcrt.dll___p___argv
cld
mov edx, dword [eax]
mov ecx, 7
mov edi, str._START
mov esi, dword [edx + ebx*4]
repe cmpsb byte [esi], byte es:[edi]
je 0x402880
inc ebx
call sub.msvcrt.dll___p___argc
cmp dword [eax], ebx
jg 0x4027d0
cmp byte [ebp - 0x325c9], 0
je 0x402834
xor ebx, ebx
lea edi, [ebp - 0x128]
jmp 0x40281d
inc ebx
cmp ebx, 0x28
jge 0x4028b7
mov ecx, dword [ebx*4 + section..data]
mov dword [esp], edi
mov dword [esp + 4], ecx
call sub.msvcrt.dll_strstr
test eax, eax
je 0x402813
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.msvcrt.dll___p___argv
mov esi, dword [eax]
lea eax, [ebp - 0x19128]
mov edi, dword [esi + ebx*4]
mov dword [esp], eax
inc ebx
mov dword [esp + 4], edi
call sub.msvcrt.dll_strcat
lea edx, [ebp - 0x19128]
mov dword [esp], edx
call sub.msvcrt.dll_strlen
mov ecx, 0x20
mov word [eax + ebp - 0x19128], cx
jmp 0x4027f7
mov byte [ebp - 0x325c9], 1
inc ebx
call sub.msvcrt.dll___p___argc
cmp dword [eax], ebx
jle 0x4027f6
call sub.msvcrt.dll___p___argv
mov esi, dword [eax]
lea eax, [ebp - 0x128]
mov edi, dword [esi + ebx*4]
mov dword [esp], eax
inc ebx
mov dword [esp + 4], edi
call sub.msvcrt.dll_strcpy
jmp 0x4027f7
mov dword [esp], edi
xor edx, edx
lea esi, [ebp - 0x19348]
mov dword [esp + 0xc], edx
lea ebx, [ebp - 0x19238]
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
call sub.msvcrt.dll__splitpath
mov dword [esp + 8], ebx
mov ecx, 0x504346
lea ebx, [ebp - 0x19458]
mov dword [esp + 4], ecx
mov dword [esp + 0xc], esi
lea esi, [ebp - 0x19128]
mov dword [esp], ebx
call sub.msvcrt.dll_sprintf
mov dword [esp], ebx
mov ebx, str.__s___s
call sub.KERNEL32.dll_SetCurrentDirectoryA
sub esp, 4
mov dword [esp + 4], ebx
lea ebx, [ebp - 0x32568]
mov dword [esp + 0xc], esi
mov esi, 0x100
mov dword [esp + 8], edi
lea edi, [ebp - 0x325c8]
mov dword [esp], ebx
call sub.msvcrt.dll_sprintf
mov dword [esp + 0x24], edi
lea eax, [ebp - 0x325b8]
xor edx, edx
mov dword [esp + 0x20], eax
xor ecx, ecx
xor edi, edi
mov dword [esp + 0x1c], edx
xor eax, eax
xor edx, edx
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], edi
mov dword [esp + 4], ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
mov dword [esp], 0
call sub.KERNEL32.dll_CreateProcessA
sub esp, 0x28
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x402990
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov eax, 0x104
mov ebp, esp
push ebx
sub esp, 0x134
lea ebx, [ebp - 0x118]
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleFileNameA
sub esp, 0xc
mov ecx, ebx
mov esi, esi
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
not eax
and edx, eax
mov eax, edx
and eax, 0x80808080
je 0x4029c0
and edx, 0x8080
jne 0x4029e6
shr eax, 0x10
add ecx, 2
add al, al
sbb ecx, 3
sub ecx, ebx
cmp ecx, 3
jbe 0x402a80
mov ecx, ebx
nop
lea esi, [esi]
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
not eax
and edx, eax
mov eax, edx
and eax, 0x80808080
je 0x402a00
and edx, 0x8080
jne 0x402a26
shr eax, 0x10
add ecx, 2
add al, al
sbb ecx, 3
sub ecx, ebx
xor edx, edx
mov byte [ecx + ebp - 0x11c], dl
mov dword [esp], ebx
call dword [sym.imp.SHLWAPI.DLL_PathFileExistsA]
sub esp, 4
test eax, eax
je 0x402a80
mov dword [esp + 0xc], ebx
mov edx, 5
xor eax, eax
mov dword [esp + 0x14], edx
mov ecx, 0x504353
mov ebx, str.explorer
mov dword [esp + 0x10], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], ecx
mov dword [esp], 0
call sub.SHELL32.DLL_ShellExecuteA
sub esp, 0x18
lea esi, [esi]
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x402a90
Capabilities:
Check if file exists
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov edi, esp
mov dword [ebp - 0xc], ebx
mov dword [esp], str.PROGRAMFILES
call sub.msvcrt.dll_getenv
mov dword [esp], eax
mov esi, eax
call sub.msvcrt.dll_strlen
add eax, 0x9e
and eax, 0xfffffff0
call fcn.004f12a0
mov dword [esp + 8], esi
lea ebx, [esp + 0x1b]
mov eax, str._sAgnitum
mov dword [esp + 4], eax
and ebx, 0xfffffff0
mov dword [esp], ebx
call sub.msvcrt.dll_sprintf
mov dword [esp], ebx
call dword [sym.imp.SHLWAPI.DLL_PathFileExistsA]
sub esp, 4
test eax, eax
je 0x402af7
mov byte [0x535010], 1
mov dword [esp + 8], esi
mov edx, str._sCOMODO
mov dword [esp + 4], edx
mov dword [esp], ebx
call sub.msvcrt.dll_sprintf
mov dword [esp], ebx
call dword [sym.imp.SHLWAPI.DLL_PathFileExistsA]
sub esp, 4
test eax, eax
je 0x402b23
mov byte [0x535010], 1
mov esp, edi
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4035b0
Capabilities:
Check if file exists
Check os version
Create directory
Create process on windows
Delete file
Persist via run registry key
Set current directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1dc
call fcn.00404140
mov dword [esp], eax
mov edi, eax
call dword [sym.imp.SHLWAPI.DLL_PathFileExistsA]
sub esp, 4
test eax, eax
je 0x403795
mov dword [esp], edi
call sub.KERNEL32.dll_SetCurrentDirectoryA
sub esp, 4
call fcn.00404280
mov dword [esp], 0
mov ecx, 0x104
mov esi, eax
mov dword [esp + 8], ecx
lea eax, [ebp - 0x128]
mov dword [esp + 4], eax
call sub.KERNEL32.dll_GetModuleFileNameA
sub esp, 0xc
mov dword [esp], esi
call dword [sym.imp.SHLWAPI.DLL_PathFileExistsA]
sub esp, 4
test eax, eax
jne 0x403788
mov dword [esp + 4], esi
lea ecx, [ebp - 0x128]
xor ebx, ebx
mov dword [esp], ecx
mov dword [esp + 8], ebx
lea ebx, [ebp - 0x1c8]
call fcn.00404bf0
mov dword [esp], esi
call fcn.004095c0
mov dword [esp], esi
mov eax, 6
mov dword [esp + 4], eax
call sub.KERNEL32.dll_SetFileAttributesA
sub esp, 8
mov dword [esp], esi
call fcn.00404cf0
mov dword [esp], ebx
mov edx, 0x94
mov dword [ebp - 0x1c8], edx
call sub.KERNEL32.dll_GetVersionExA
sub esp, 4
cmp dword [ebp - 0x1c4], 5
jbe 0x4036c0
mov dword [esp], esi
call fcn.00402b40
mov dword [esp + 4], esi
lea ecx, [ebp - 0x128]
mov dword [esp], ecx
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x40370f
test edi, edi
je 0x4036aa
mov dword [esp], edi
call fcn.004ef210
test esi, esi
je 0x4036b6
mov dword [esp], esi
call fcn.004ef210
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], esi
call sub.msvcrt.dll_strlen
mov ebx, eax
call fcn.004045e0
mov dword [esp + 0xc], eax
mov edx, 0x504520
mov eax, 1
mov dword [esp + 4], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 8], eax
mov dword [esp], 0x80000001
call fcn.00405470
mov dword [esp + 4], esi
lea ecx, [ebp - 0x128]
mov dword [esp], ecx
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x40369e
mov dword [esp], esi
call dword [sym.imp.SHLWAPI.DLL_PathFileExistsA]
sub esp, 4
test eax, eax
je 0x40369e
mov eax, dword [0x535100]
test eax, eax
jne 0x4037be
mov dword [esp + 8], esi
mov ecx, 5
xor ebx, ebx
mov dword [esp + 0x14], ecx
mov eax, 0x50454e
mov edx, 0x504353
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], edx
mov dword [esp], 0
call sub.SHELL32.DLL_ShellExecuteA
sub esp, 0x18
test edi, edi
je 0x403770
mov dword [esp], edi
call fcn.004ef210
test esi, esi
je 0x40377c
mov dword [esp], esi
call fcn.004ef210
mov dword [esp], 0
call sub.msvcrt.dll_exit
mov dword [esp], esi
call sub.msvcrt.dll_remove
jmp 0x40361f
mov dword [esp], edi
call sub.msvcrt.dll__mkdir
mov dword [esp], edi
mov edx, 6
mov dword [esp + 4], edx
call sub.KERNEL32.dll_SetFileAttributesA
sub esp, 8
mov dword [esp], edi
call fcn.00404cf0
jmp 0x4035d7
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
jmp 0x403730
Function at 0x4037d0
Capabilities:
Check if file exists
Create directory
Create process on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x15c
mov dword [ebp - 0x13c], esp
call fcn.004043a0
mov dword [esp], eax
mov esi, eax
call dword [sym.imp.SHLWAPI.DLL_PathFileExistsA]
sub esp, 4
test eax, eax
je 0x403995
mov dword [esp], esi
call sub.msvcrt.dll_strlen
add eax, 0x26
and eax, 0xfffffff0
call fcn.004f12a0
mov dword [esp + 8], esi
lea ebx, [esp + 0x27]
mov edx, str._s
mov dword [esp + 4], edx
and ebx, 0xfffffff0
mov dword [esp], ebx
call sub.msvcrt.dll_sprintf
mov dword [esp], ebx
lea eax, [ebp - 0x138]
mov dword [esp + 4], eax
call sub.msvcrt.dll__findfirst
mov dword [ebp - 0x140], eax
test eax, eax
je 0x40392d
lea edi, [ebp - 0x124]
lea esi, [esi]
lea edi, [edi]
mov dword [ebp - 0x144], esp
mov dword [esp], esi
call sub.msvcrt.dll_strlen
mov ebx, eax
mov ecx, edi
lea esi, [esi]
lea edi, [edi]
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
not eax
and edx, eax
mov eax, edx
and eax, 0x80808080
je 0x403880
and edx, 0x8080
jne 0x4038a6
shr eax, 0x10
add ecx, 2
add al, al
sbb ecx, 3
sub ecx, edi
lea eax, [ebx + ecx + 0x26]
and eax, 0xfffffff0
call fcn.004f12a0
mov dword [esp + 0xc], edi
lea ebx, [esp + 0x27]
mov edx, 0x504554
mov dword [esp + 4], edx
and ebx, 0xfffffff0
mov dword [esp + 8], esi
mov dword [esp], ebx
call sub.msvcrt.dll_sprintf
mov dword [esp], edi
mov ecx, str..dll
mov dword [esp + 4], ecx
call sub.msvcrt.dll_strstr
test eax, eax
je 0x403947
mov dword [esp], ebx
call sub.KERNEL32.dll_LoadLibraryA
sub esp, 4
mov esp, dword [ebp - 0x144]
lea edx, [ebp - 0x138]
mov dword [esp + 4], edx
mov ebx, dword [ebp - 0x140]
mov dword [esp], ebx
call sub.msvcrt.dll__findnext
test eax, eax
je 0x403860
mov edi, dword [ebp - 0x140]
mov dword [esp], edi
call sub.msvcrt.dll__findclose
test esi, esi
je 0x403939
mov dword [esp], esi
call fcn.004ef210
mov esp, dword [ebp - 0x13c]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], edi
mov ecx, str..exe
mov dword [esp + 4], ecx
call sub.msvcrt.dll_strstr
test eax, eax
je 0x4038f9
mov dword [esp + 8], ebx
mov ecx, 5
xor eax, eax
mov dword [esp + 0x14], ecx
mov edx, 0x50454e
mov ebx, 0x504353
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], edx
mov dword [esp + 4], ebx
mov dword [esp], 0
call sub.SHELL32.DLL_ShellExecuteA
sub esp, 0x18
jmp 0x4038f9
mov dword [esp], esi
call sub.msvcrt.dll__mkdir
mov dword [esp], esi
mov ecx, 6
mov dword [esp + 4], ecx
call sub.KERNEL32.dll_SetFileAttributesA
sub esp, 8
mov dword [esp], esi
call fcn.00404cf0
jmp 0x4037fd
Function at 0x404140
Capabilities:
Check if file exists
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0
call sub.msvcrt.dll_time
mov dword [esp], eax
call sub.msvcrt.dll_srand
xor esi, esi
jmp 0x404170
mov eax, dword [edi*4 + 0x5350dc]
mov dword [esp], eax
call sub.msvcrt.dll_getenv
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov ecx, dword [esi*4 + 0x5350c0]
mov ebx, eax
mov dword [esp], ecx
call sub.msvcrt.dll_strlen
lea edx, [ebx + eax + 8]
mov dword [esp], edx
call fcn.004ef170
mov ebx, eax
mov eax, dword [edi*4 + 0x5350dc]
mov dword [esp], eax
call sub.msvcrt.dll_getenv
mov dword [esp + 8], eax
mov ecx, dword [esi*4 + 0x5350c0]
mov edx, 0x504580
mov dword [esp + 4], edx
mov dword [esp], ebx
mov dword [esp + 0xc], ecx
call sub.msvcrt.dll_sprintf
mov dword [esp], ebx
call dword [sym.imp.SHLWAPI.DLL_PathFileExistsA]
sub esp, 4
test eax, eax
jne 0x404274
test ebx, ebx
je 0x4041f5
mov dword [esp], ebx
call fcn.004ef210
inc esi
cmp esi, 7
jl 0x404170
inc edi
cmp edi, 1
jl 0x40415f
call sub.msvcrt.dll_rand
mov edi, 1
cdq
idiv edi
mov eax, dword [edx*4 + 0x5350dc]
mov dword [esp], eax
call sub.msvcrt.dll_getenv
mov edi, eax
call sub.msvcrt.dll_rand
mov dword [esp], edi
mov ecx, 7
cdq
idiv ecx
mov esi, dword [edx*4 + 0x5350c0]
call sub.msvcrt.dll_strlen
mov ebx, eax
mov dword [esp], esi
call sub.msvcrt.dll_strlen
lea edx, [ebx + eax + 8]
mov dword [esp], edx
call fcn.004ef170
mov dword [esp + 0xc], esi
mov esi, 0x504580
mov ebx, eax
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.msvcrt.dll_sprintf
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret