joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44a2d0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1a8
xor eax, eax
mov ecx, 0x454108
push ebx
mov edx, dword [esp + 0x1b0]
push esi
push edi
push ebp
cmp dword [ecx], edx
je 0x44a2f8
add ecx, 8
inc eax
cmp ecx, 0x454190
jb 0x44a2e8
cmp dword [eax*8 + 0x454108], edx
lea ebx, [eax*8]
jne 0x44a4b3
cmp dword [0x453b7c], 1
je 0x44a478
cmp dword [0x453b7c], 0
jne 0x44a32f
cmp dword [0x453b80], 1
je 0x44a478
cmp edx, 0xfc
je 0x44a4b3
lea eax, [esp + 0xb4]
push 0x104
push eax
mov ebp, dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA_1]
push 0
call ebp
test eax, eax
jne 0x44a36c
mov esi, 0x4541e0
lea edi, [esp + 0xb4]
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea ebp, [esp + 0xb4]
lea edi, [esp + 0xb4]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
cmp ecx, 0x3c
jbe 0x44a3b0
lea edi, [esp + 0xb4]
mov ecx, 0xffffffff
sub eax, eax
push 3
repne scasb al, byte es:[edi]
not ecx
lea ebp, [esp + ecx + 0x7c]
push 0x4541dc
push ebp
call fcn.0044a6a0
add esp, 0xc
mov esi, 0x4541c0
lea edi, [esp + 0x14]
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, ebp
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x14]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4541bc
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x14]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebx + 0x45410c]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
lea edi, [esp + 0x14]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x12010
and ecx, 3
push 0x454194
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x1c]
push eax
call fcn.0044a600
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1a8
ret
mov eax, dword [0x476bb0]
mov esi, dword [eax + 0x10]
cmp esi, 0xffffffff
jne 0x44a48f
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.DLL_GetStdHandle_1]
mov esi, eax
mov edx, dword [ebx + 0x45410c]
push 0
lea eax, [esp + 0x14]
mov edi, edx
push eax
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.DLL_WriteFile_1]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1a8
ret
Function at 0xc9b834
Capabilities:
Encode data using xor

Disassembly:
jmp 0xc9b83e
pushal
call 0xc9b844
pop ebp
sub ebp, 0x10
sub ebp, 0x89b834
jmp 0xc9b85a
mov eax, 0x89b834
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c1
mov edx, 0xe03224bb
xor byte [eax], dl
inc eax
dec ecx
jne 0xc9b871
jmp 0xc9b884
xor byte [esi + 0x30], dh
xor al, byte [edi + 0x3abbbbbb]
jp 0xc9b8d2
mov ebx, 0x76b8bbbb
add edi, dword [edi + 0x1bbbbbb]
xchg ebx, eax
mov ebx, 0x594cbbbb
mov eax, 0xb73a3073
mov ebx, 0x7eb8bbbb
jmp 0xc9b8e2
mov bl, 0xbb
mov ebx, 0xb72e30bb
mov ebx, 0x3630bbbb
stosd dword es:[edi], eax
mov ebx, 0x527abbbb
mov ecx, 0x7938b98a
mov edi, 0x4f3eb4f2
mov ebx, 0x8ab9527a
mov ecx, 0xf2bf7938
mov ah, 0x3e
dec edi
inc esp
inc esp
inc esp
out 0x79, al
mov bh, 0xbb
xor byte [edi], dh
lahf
mov edi, 0xd3bbbbbb
das
mov word [esi + 0x3b25d3bb], fs
xlatb
mov ebx, 0x369f97ba
fistp word [edi - 0x6048cdb9]
push ebx
mov esi, 0x52bbbbbb
cli
mov ecx, 0x36eebbbb
xlatb
lahf
mov ebx, 0x44b7ce44
into
mov bl, 0x53
leave
mov ebx, 0x630bbbb
mov bl, 0xbb
mov ebx, 0x3a7288bb
dec ecx
leave
pop ds
outsd dx, dword [esi]
wait
cmp cl, byte [ecx - 0x37]
pop ds
outsd dx, dword [esi]
wait
mov byte [ecx + 0x38], ch
push ebx
mov esi, 0xf53fb4f3
mov ebx, 0x33b4bbbb
mov ebx, 0x30ddbbbb
cmpsd dword [esi], dword es:[edi]
cmp byte [ebx], 0x40
push ebx
mov ah, 0x3f
mov eax, dword [0x3bbbbbbb]
inc eax
push edx
mov ah, 0x3f
stosb byte es:[edi], al
mov ebx, 0x3addbbbb
inc eax
inc esp
sahf
mov ah, 0x3f
scasb al, byte es:[edi]
mov ebx, 0x52fabbbb
ja 0xc9b9ba
inc esp
inc esp
xchg edx, eax
test dword [edx - 0x4185c746], 0x52bf5338
push es
inc esp
inc esp
inc esp
xchg edx, eax
out dx, eax
cmp byte [ecx + 0x38bd7a38], 0x51
mov edi, 0x52be5338
adc byte [esp + eax*2 + 0x44], al
out 0x79, al
mov bh, 0xbb
out dx, al
xor byte [edi - 0x13], dl
in al, dx
out dx, al
xor dh, cl
mov bh, 0x30
invalid
mov ebx, 0xbbb900bb
mov ebx, 0xb469b9bb
mov esi, 0x31bbbbbb
lodsd eax, dword [esi]
std
test eax, 0x6338b469
inc esp
inc esp
inc esp
mov ecx, 0xbe3eb469
mov ebx, 0xad31bbbb
std
test eax, 0xd138b469
mov ebx, 0x7b88bbbb
mov ecx, 0xbe3eb469
mov ebx, 0xad31bbbb
std
test eax, 0x9138b469
mov edx, 0x69b9bbbb
mov ah, 0x3e
mov esi, 0x31bbbbbb
lodsd eax, dword [esi]
std
test eax, 0xb97ba869
imul esi, dword [esi + edi - 0x44444442], 0xa9fdad31
imul ebp, dword [eax - 0x4b964685], 0xbbbbbe3e
mov ebx, 0xa9fdad31
imul ebp, dword [eax - 0x4b964685], 0xbbbbbe3e
mov ebx, 0xa9fdad31
imul ebp, dword [eax - 0x42c04b85], 0x30bbbbbb
nop
arpl word [ecx], si
mov eax, 0xfcbc33
mov ecx, 0x52bbbbbb
retf
Function at 0xe7d1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00e7d140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00e7d140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00e7d140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00e7d140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xe7dbfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xe7dc50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xe8f87c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xe7dc43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xe7dc52
xor eax, eax
pop esi
leave
ret 4

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Create process on windows
Execute shellcode via indirect call
Read file on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x104
mov edi, 0x10003030
push edi
push dword [0x10003020]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
mov word [0x10003036], ax
xor ebx, ebx
movzx ecx, word [eax + 0x10002040]
mov word [eax + 0x10003030], cx
add eax, 2
cmp cx, bx
jne 0x1000117f
push 1
push ebx
push ebx
push edi
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov word [0x10003036], ax
movzx ecx, word [eax + str.desktop.ini]
mov word [eax + 0x10003030], cx
add eax, 2
cmp cx, bx
jne 0x100011aa
push 0x40
mov esi, 0x1000
push esi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push edi
mov dword [0x10003018], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000301c], eax
push ebx
cmp eax, 0xffffffff
jne 0x100011fd
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x10003024
push esi
push dword [0x10003018]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [0x10003018]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
nop
pop eax
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x401490
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x4014e8
cmp byte [esi + ebx - 1], 0xa
je 0x4014bc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x4050a4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x401f90
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov edx, 2
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov ecx, dword [eax + 0x3c]
cmp word [eax + ecx + 0x5c], 2
je 0x401fe0
mov edx, 1
mov dword [esp], edx
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call dbg.wmain
mov dword [esp], eax
call sym._exit
Function at 0x40272c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.0040372c
test esi, esi
jne 0x402762
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.0040381c
jmp 0x402780
invalid
inc ecx

Function at 0x402bf8
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x41d008], 0x8088405
inc edx
mov dword [ebx + 0x41d008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x402e44
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x41d018]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402edc
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402ebc
xor eax, eax
push ebp
push 0x402eb5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402ef8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402ebc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x41d018]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x41d018], ax
mov esp, ebp
pop ebp
ret

Function at 0x403534
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x41e034], 0
je 0x403595
cmp word [0x41e208], 0xd7b2
jne 0x40355d
cmp dword [0x41e210], 0
jbe 0x40355d
mov eax, 0x41e204
call dword [0x41e220]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x41d084
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4035bc
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x41d024], 0
jne 0x4035b1
push 0
push 0x41d07c
push 0x41d084
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4036e8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.004024d0
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x41e035], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x4036b0
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x4055bc
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff64
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403a94
xor eax, eax
push ebp
push 0x40568a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
push 0
lea eax, [ebp - 0x9c]
push eax
mov eax, dword [ebp - 4]
call fcn.00403aa4
push eax
call sub.kernel32.dll_OpenFile
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x40566c
lea eax, [ebp - 0x10]
mov edx, 0x186a0
call fcn.00403b84
push 0
lea eax, [ebp - 0x14]
push eax
push 0x186a0
lea eax, [ebp - 0x10]
call fcn.00403af4
mov edx, 1
dec edx
test eax, eax
je 0x405636
cmp edx, dword [eax - 4]
jb 0x40563b
call fcn.00402f14
inc edx
lea eax, [eax + edx - 1]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x40566c
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
mov edx, dword [ebp - 0x10]
mov eax, 0x4056a0
call fcn.00403b3c
test eax, eax
jle 0x40566c
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405691
lea eax, [ebp - 0x10]
call fcn.0040372c
lea eax, [ebp - 4]
call fcn.0040372c
ret

Function at 0x4056b8
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403a94
mov eax, dword [ebp - 8]
call fcn.00403a94
xor eax, eax
push ebp
push 0x405752
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [ebp - 9]
xor al, 1
neg al
sbb eax, eax
push eax
mov eax, dword [ebp - 8]
call fcn.00403aa4
push eax
mov eax, dword [ebp - 4]
call fcn.00403aa4
push eax
call sub.kernel32.dll_CopyFileA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xa], al
mov al, byte [ebp - 0xa]
and al, byte [ebp + 0x10]
je 0x405737
mov ecx, dword [ebp + 8]
test ecx, ecx
jns 0x405723
call fcn.00402f14
mov edx, dword [ebp + 0xc]
test edx, edx
jns 0x40572f
call fcn.00402f14
mov eax, dword [ebp - 8]
call fcn.00405c8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405759
Function at 0x4057dc
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea4
xor edx, edx
mov dword [ebp - 0x15c], edx
mov dword [ebp - 0x158], edx
mov dword [ebp - 0x154], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403a94
xor eax, eax
push ebp
push 0x405996
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004038a4
cmp eax, 2
jl 0x405963
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x154]
mov ecx, 0x4059ac
mov edx, dword [ebp - 4]
call fcn.004038f0
mov eax, dword [ebp - 0x154]
call fcn.00403aa4
push eax
call sub.kernel32.dll_FindFirstFileA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x40592a
lea eax, [ebp - 0x158]
lea edx, [ebp - 0x124]
mov ecx, 0x104
call fcn.0040388c
mov ecx, dword [ebp - 0x158]
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.004038f0
lea eax, [ebp - 0x10]
lea edx, [ebp - 0x124]
mov ecx, 0x104
call fcn.0040388c
test byte [ebp - 0x150], 0x10
je 0x4058e2
mov eax, dword [ebp - 0x10]
mov edx, 0x4059b8
call fcn.004039f0
je 0x405912
mov eax, dword [ebp - 0x10]
mov edx, 0x4059c4
call fcn.004039f0
je 0x405912
lea eax, [ebp - 0x15c]
mov ecx, 0x4059d0
mov edx, dword [ebp - 0xc]
call fcn.004038f0
mov eax, dword [ebp - 0x15c]
call fcn.004057dc
jmp 0x405912
mov eax, dword [ebp - 0xc]
call fcn.00403aa4
push eax
call sub.kernel32.dll_DeleteFileA
test eax, eax
jne 0x405912
push 0x20
mov eax, dword [ebp - 0xc]
call fcn.00403aa4
push eax
call sub.kernel32.dll_SetFileAttributesA
mov eax, dword [ebp - 0xc]
call fcn.00403aa4
push eax
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x150]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x405861
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindClose
mov eax, dword [ebp - 4]
call fcn.00403aa4
push eax
call sub.kernel32.dll_RemoveDirectoryA
test eax, eax
jne 0x405963
push 0x20
mov eax, dword [ebp - 4]
call fcn.00403aa4
push eax
call sub.kernel32.dll_SetFileAttributesA
mov eax, dword [ebp - 4]
call fcn.00403aa4
push eax
invalid
shr esi, 0xff

Function at 0x4059d4
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403a94
xor eax, eax
push ebp
push 0x405a20
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00403aa4
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405a27
lea eax, [ebp - 4]
call fcn.0040372c
ret
Function at 0x406d68
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00403a94
mov eax, dword [ebp - 0xc]
call fcn.00403a94
mov eax, dword [ebp + 8]
call fcn.00403a94
xor eax, eax
push ebp
push 0x406e74
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x41e6b8
push 0
push 2
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00403aa4
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
jns 0x406dc9
call fcn.00402f14
mov dword [0x41e6bc], eax
cmp dword [ebp + 8], 0
jne 0x406de1
lea eax, [ebp + 8]
mov edx, 0x406e8c
call fcn.004037c4
mov eax, dword [ebp + 8]
call fcn.004038a4
test eax, eax
jns 0x406df2
call fcn.00402f14
push eax
lea eax, [ebp + 8]
call fcn.00403af4
mov edx, 1
dec edx
test eax, eax
je 0x406e0a
cmp edx, dword [eax - 4]
jb 0x406e0f
call fcn.00402f14
inc edx

Function at 0x406e10
Capabilities:
Set registry value

Disassembly:
lea eax, [eax + edx - 1]
push eax
push 1
push 0
mov eax, dword [ebp - 0xc]
call fcn.00403aa4
push eax
mov eax, dword [0x41e6b8]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
jns 0x406e36
call fcn.00402f14
mov dword [0x41e6bc], eax
cmp dword [0x41e6bc], 0
sete byte [ebp - 0xd]
mov eax, dword [0x41e6b8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406e7b
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00403750
lea eax, [ebp + 8]
call fcn.0040372c
ret

Function at 0x406e90
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00403a94
mov eax, dword [ebp - 0xc]
call fcn.00403a94
xor eax, eax
push ebp
push 0x406f4b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x41e6b8
push 0
push 2
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00403aa4
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
jns 0x406ee9
call fcn.00402f14
mov dword [0x41e6bc], eax
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
mov eax, dword [ebp - 0xc]
call fcn.00403aa4
push eax
mov eax, dword [0x41e6b8]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
jns 0x406f15
call fcn.00402f14
mov dword [0x41e6bc], eax
cmp dword [0x41e6bc], 0
sete byte [ebp - 0xd]
mov eax, dword [0x41e6b8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406f52
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00403750
ret