joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7a0b00
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x8a0204]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp eax, 0x1a
jbe 0x7a0b43
call fcn.0077d33d
mov dword [eax], 0xf
call fcn.0077d350
mov dword [eax], 0xd
call fcn.0077d588
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0075c173
leave
ret
test eax, eax
jne 0x7a0b4a
inc eax
jmp 0x7a0b37
add eax, 0x40
push 0x3a
mov word [ebp - 0xc], ax
pop eax
mov word [ebp - 0xa], ax
push 0x5c
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, eax
test ecx, ecx
je 0x7a0b35
xor eax, eax
cmp ecx, 1
setne al
jmp 0x7a0b37
Function at 0x407a2a
Capabilities:
Get graphical window text

Disassembly:
push 0
push 0
push 0x87
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_SendMessageW]
shr eax, 0xd
and eax, 1
ret

Function at 0x409220
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov esi, eax
push edi
test esi, esi
je 0x409231
lea edi, [esi - 0xc0]
jmp 0x409233
xor edi, edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [edi + 4]
call ebx
call fcn.0040890a
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, esi
call fcn.00408a00
cmp dword [esi + 0x18], 0
je 0x409262
mov ecx, dword [esi + 0x18]
mov eax, dword [ecx]
call dword [eax + 0xc]
push 5
push dword [edi + 4]
call ebx
pop edi
pop esi
xor eax, eax
pop ebx
ret

Function at 0x409746
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x1c
mov eax, 0x4a434b
call fcn.0048e4de
xor ebx, ebx
cmp esi, ebx
je 0x409763
lea eax, [esi - 0xc0]
mov dword [ebp - 0x18], eax
jmp 0x409766
mov dword [ebp - 0x18], ebx
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
call dword [eax + 4]
test al, al
mov eax, dword [ebp + 0xc]
mov dword [eax], ebx
jne 0x409854
xor edi, edi
inc edi
push 0x17
mov dword [ebp - 0x14], edi
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x409794
mov dword [ebp - 0x14], 2
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
seta al
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
cmp byte [esi + 0x14], bl
je 0x4097b9
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
cmp dword [ebp + 8], 8
jne 0x4097cd
xor ecx, ecx
cmp al, bl
setne cl
inc ecx
inc ecx
mov dword [ebp - 0x10], ecx
jmp 0x4097df
cmp dword [ebp + 8], 0x14
jne 0x4097e4
xor ecx, ecx
cmp al, bl
setne cl
inc ecx
inc ecx
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
mov eax, dword [ebp - 0x18]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_GetWindowDC]
mov edi, eax
mov dword [ebp + 0xc], edi
mov dword [ebp - 4], ebx
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
push ebx
push dword [ebp - 0x10]
push ebx
push edi
call dword [eax + 0x18]
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
push ebx
push dword [ebp - 0x14]
push 2
push edi
call dword [eax + 0x18]
cmp dword [ebp + 8], 8
je 0x409821
cmp dword [ebp + 8], 0x14
jne 0x409842
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 4]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x28], 0x10
mov dword [ebp - 0x24], 0x12
call dword [sym.imp.USER32.dll_TrackMouseEvent]
or dword [ebp - 4], 0xffffffff
cmp edi, ebx
je 0x409854
push edi
mov dword [ebp + 0xc], ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
xor eax, eax
call fcn.0048e5b6
ret 8
Function at 0x40cac1
Capabilities:
Check if file exists
Create directory

Disassembly:
push 0x58
mov eax, 0x4aaa86
call fcn.0048e547
lea eax, [ebp - 0x2c]
push eax
call fcn.00442a70
pop ecx
and dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
lea esi, [ebp - 0x64]
call fcn.00439a20
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x48]
push 0x4bc9fc
push eax
call fcn.0040d770
add esp, 0xc
mov byte [ebp - 4], 2
push eax
lea ebx, [ebp - 0x2c]
call fcn.0040ccde
mov byte [ebp - 4], 1
xor ebx, ebx
push ebx
push 1
lea ecx, [ebp - 0x48]
call fcn.004043a7
mov byte [ebp - 4], bl
push ebx
push 1
mov ecx, esi
call fcn.004043a7
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x40cb38
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40cb70
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x40cb4f
lea eax, [ebp - 0x28]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40cb70
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x2c]
push eax
call fcn.0040ca60
mov al, bl
call fcn.0048e5ca
ret
lea eax, [ebp - 0x2c]
push eax
mov ebx, 0x4e8a34
call fcn.004419f0
mov bl, 1
jmp 0x40cb5b

Function at 0x40d444
Capabilities:
Hash data using fnv

Disassembly:
cmp dword [eax + 0x18], 8
jb 0x40d44f
mov ecx, dword [eax + 4]
jmp 0x40d452
lea ecx, [eax + 4]
mov edx, dword [eax + 0x14]
push esi
mov eax, 0x811c9dc5
lea edx, [ecx + edx*2]
jmp 0x40d46d
movzx esi, word [ecx]
imul eax, eax, 0x1000193
xor eax, esi
inc ecx
inc ecx
cmp ecx, edx
jne 0x40d460
mov esi, SysReAllocString
and eax, esi
push 0x1f31d
push eax
call fcn.0048a17e
imul eax, eax, 0xb14
imul edx, edx, 0x41a7
pop ecx
sub edx, eax
pop ecx
mov eax, edx
jns 0x40d499
add eax, esi
pop esi
ret

Function at 0x41299b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4129b2
pop esi
ret
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x4129e7
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, edi
and esi, 0xf
jbe 0x4129e3
cmp edi, eax
jae 0x4129e7
dec esi
movzx ecx, word [edi]
lea edi, [edi + ecx*2 + 2]
jne 0x4129d5
cmp edi, eax
jb 0x4129eb
xor eax, eax
jmp 0x4129f4
movzx eax, word [edi]
neg eax
sbb eax, eax
and eax, edi
pop edi
pop esi
ret
Function at 0x41bc81
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [esi + 0x54]
mov ecx, eax
and ecx, 0xc
push edi
mov byte [ebp - 1], 1
cmp cl, 0xc
jne 0x41bccb
mov eax, dword [esi + 4]
mov edi, dword [sym.imp.USER32.dll_GetDlgCtrlID]
push eax
mov dword [ebp - 0x10], eax
call edi
push dword [esi + 4]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0xfffffffe
call edi
push dword [esi + 4]
mov edi, eax
call dword [sym.imp.USER32.dll_GetParent]
lea ecx, [ebp - 0x10]
push ecx
push edi
push 0x4e
jmp 0x41bcf2
shr eax, 2
test al, 1
je 0x41bcfb
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
push dword [esi + 4]
mov edi, eax
call dword [sym.imp.USER32.dll_GetParent]
push dword [esi + 4]
movzx ecx, di
push ecx
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x41bd2e
push ebx
push 1
xor ebx, ebx
push ebx
push ebx
push dword [esi + 0x28]
push 0x4bdc34
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
seta byte [ebp - 1]
cmp byte [ebp - 1], bl
je 0x41bd2d
or byte [esi + 0x58], 2
push 1
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
pop ebx
mov al, byte [ebp - 1]
pop edi
leave
ret
Function at 0x41c530
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
and dword [esi], 0
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41c594
cmp dword [ebp + 0xc], 1
je 0x41c56c
cmp dword [ebp + 0xc], 2
je 0x41c56c
push 0xd
pop eax
jmp 0x41c594
mov eax, dword [ebp - 4]
test edi, edi
je 0x41c58e
test eax, eax
je 0x41c589
test al, 1
jne 0x41c567
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x41c58e
jmp 0x41c567
xor ecx, ecx
mov word [edi], cx
shr eax, 1
mov dword [esi], eax
xor eax, eax
leave
ret 8

Function at 0x428a65
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4ac6e3
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x4e52f4]
xor eax, esp
mov dword [esp + 0x54], eax
push ebx
push esi
mov eax, dword [0x4e52f4]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
push ebx
push dword [0x4e8b98]
mov esi, ecx
push esi
mov dword [esp + 0x1c], eax
call fcn.0040e463
cmp eax, 0xffffffff
je 0x428b93
mov eax, dword [0x4e8b98]
mov eax, dword [eax - 0xc]
push 0xffffffffffffffff
push eax
lea eax, [esp + 0x4c]
push eax
push esi
call fcn.00403ec3
mov dword [esp + 0x70], ebx
cmp dword [esp + 0x5c], 8
mov eax, dword [esp + 0x48]
jae 0x428ae5
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x428b82
cmp dword [esp + 0x5c], 8
mov eax, dword [esp + 0x48]
jae 0x428b03
lea eax, [esp + 0x48]
push eax
lea esi, [esp + 0x18]
call fcn.0042e486
mov byte [esp + 0x70], 1
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [esp + 0x70], 2
push 0x16
pop eax
mov word [esp + 0x24], ax
mov dword [esp + 0x2c], 0x194
mov byte [esp + 0x70], 3
mov ebx, dword [esp + 0x10]
mov ecx, esi
call fcn.00428f5f
mov byte [esp + 0x70], 2
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [esp + 0x24]
push eax
call esi
mov byte [esp + 0x70], 1
lea eax, [esp + 0x34]
push eax
call esi
mov byte [esp + 0x70], 0
lea eax, [esp + 0x14]
push eax
call esi
or dword [esp + 0x70], 0xffffffff
push 0
push 1
lea ecx, [esp + 0x4c]
call fcn.004043a7
xor al, al
jmp 0x428b9d
or dword [esp + 0x70], 0xffffffff
push ebx
push 1
lea ecx, [esp + 0x4c]
call fcn.004043a7
push esi
push dword [esp + 0x14]
call fcn.00428bbc
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x54]
xor ecx, esp
call fcn.00489b1b
mov esp, ebp
pop ebp
ret 4
Function at 0x42e9d1
Capabilities:
Check mutex on windows

Disassembly:
push esi
push dword [esp + 8]
mov esi, eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
push eax
call fcn.0040bfad
cmp dword [esi], 0
je 0x42e9fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x42e9fe
mov byte [esi + 8], 1
pop esi
ret 4

Function at 0x4316f6
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4b197f
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x4e52f4]
xor eax, esp
mov dword [esp + 0x74], eax
push ebx
push esi
mov eax, dword [0x4e52f4]
xor eax, esp
push eax
lea eax, [esp + 0x88]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ebx, ecx
mov ecx, dword [edi + 0x30]
mov dword [esp + 0x10], eax
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, eax
mov eax, dword [ebx]
mov ecx, ebx
mov dword [esp + 0xc], esi
call dword [eax + 8]
push eax
lea ecx, [esp + 0x4c]
call fcn.0040572b
xor ebx, ebx
mov dword [esp + 0x90], ebx
cmp dword [esp + 0x5c], ebx
je 0x43184a
mov eax, dword [esi]
lea ecx, [esp + 0x48]
push ecx
lea ecx, [esp + 0x68]
push ecx
mov ecx, esi
call dword [eax]
mov byte [esp + 0x90], 1
lea eax, [esp + 0x14]
push eax
call fcn.0041004c
mov byte [esp + 0x90], 2
push 0x4c066c
lea ecx, [esp + 0x30]
call fcn.0040432c
mov byte [esp + 0x90], 3
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x68]
push eax
lea esi, [esp + 0x1c]
call fcn.004406d0
pop ecx
pop ecx
mov byte [esp + 0x90], 2
push ebx
push 1
lea ecx, [esp + 0x34]
call fcn.004043a7
mov eax, dword [esp + 0x24]
sub eax, dword [esp + 0x20]
push 0x1c
cdq
pop ecx
idiv ecx
cmp eax, 2
jne 0x431825
push ebx
call fcn.00415614
push dword [esp + 0xc]
mov ecx, eax
call fcn.0043133d
pop ecx
mov ecx, dword [esp + 0x10]
mov dword [edi + 0xfc], eax
push 1
mov dword [ecx + 0x64], eax
call fcn.00415614
push dword [esp + 0xc]
mov ecx, eax
call fcn.0043133d
pop ecx
mov ecx, dword [esp + 0x10]
mov dword [edi + 0x100], eax
mov dword [ecx + 0x68], eax
mov byte [esp + 0x90], 1
lea eax, [esp + 0x14]
push eax
call fcn.00410084
mov byte [esp + 0x90], bl
push ebx
push 1
lea ecx, [esp + 0x6c]
call fcn.004043a7
or dword [esp + 0x90], 0xffffffff
push ebx
push 1
lea ecx, [esp + 0x50]
call fcn.004043a7
mov ecx, dword [esp + 0x88]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x74]
xor ecx, esp
call fcn.00489b1b
mov esp, ebp
pop ebp
ret 4
Function at 0x432688
Capabilities:
Get disk information

Disassembly:
push 0x2c
mov eax, 0x4b18bb
call fcn.0048e547
mov eax, edi
call fcn.00424a63
xor ebx, ebx
push ebx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], 7
call fcn.00404389
mov dword [ebp - 4], ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
push ebx
push ebx
call esi
push ebx
push eax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x34], eax
call fcn.00432747
push ebx
lea ecx, [ebp - 0x2c]
call fcn.0043271f
push eax
push dword [ebp - 0x34]
call esi
cmp eax, ebx
jne 0x4326f5
mov byte [ebp - 0x2d], bl
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.004043a7
mov al, byte [ebp - 0x2d]
call fcn.0048e5ca
ret
push eax
push ebx
lea ecx, [ebp - 0x2c]
call fcn.0043271f
mov ebx, edi
mov ecx, eax
call fcn.004408e0
mov eax, dword [edi + 0x10]
sub eax, dword [edi + 0xc]
pop ecx
push 0x1c
cdq
pop ecx
idiv ecx
test eax, eax
seta byte [ebp - 0x2d]
xor ebx, ebx
jmp 0x4326dd

Function at 0x43352d
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0xc
mov eax, 0x4a3b59
call fcn.0048e4de
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
xor ebx, ebx
cmp eax, ebx
je 0x43354c
mov dword [ecx], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ebx
cmp esi, 0xffffffff
jne 0x43357e
or dword [ebp - 4], eax
push eax
jmp 0x4335fc
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
mov dword [ebp + 0xc], ebx
mov byte [ebp - 4], 1
push edi
lea eax, [ebp + 0xc]
push eax
call fcn.004338b8
push ebx
lea eax, [ebp - 0x10]
push eax
push edi
mov edi, dword [ebp + 0xc]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, ebx
je 0x4335e6
cmp dword [ebp - 0x10], ebx
je 0x4335e6
push dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
push edi
call fcn.0043360f
mov byte [ebp + 0xb], al
mov byte [ebp - 4], bl
push edi
call fcn.00489beb
pop ecx
mov dword [ebp + 0xc], ebx
or dword [ebp - 4], 0xffffffff
cmp esi, ebx
je 0x4335e1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x18], ebx
mov al, byte [ebp + 0xb]
jmp 0x433607
mov byte [ebp - 4], bl
push edi
call fcn.00489beb
pop ecx
mov dword [ebp + 0xc], ebx
or dword [ebp - 4], 0xffffffff
cmp esi, ebx
je 0x433605
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x18], ebx
xor al, al
call fcn.0048e5b6
ret 8
Function at 0x4342bf
Capabilities:
Create process on windows
Write and execute a file
Write file on windows

Disassembly:
push 0x54
mov eax, 0x4aed00
call fcn.0048e4de
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [esi]
cmp eax, ebx
je 0x434459
cmp dword [eax - 0xc], ebx
jge 0x4342ec
push 0x80070057
call fcn.00403da7
cmp byte [eax], bl
je 0x434459
lea eax, [ebp - 0x10]
push eax
call fcn.00403dfc
mov byte [ebp - 4], 1
push 0x4c2630
lea eax, [ebp - 0x18]
push eax
call fcn.00412ade
mov byte [ebp - 4], 2
lea edi, [ebp - 0x10]
lea ecx, [ebp - 0x18]
call fcn.00445dd0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.00403d84
push str..bat
mov eax, edi
push eax
call fcn.004341c7
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], ebx
mov byte [ebp - 4], 3
cmp edi, 0xffffffff
jne 0x434373
mov byte [ebp - 4], 1
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x24], ebx
jmp 0x43444e
lea eax, [ebp - 0x18]
push eax
call fcn.00434dab
mov byte [ebp - 4], 4
push dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push eax
call fcn.00434dda
mov byte [ebp - 4], 5
mov eax, str._echo_off__r_nATTRIB__r___s___r_n:try__r_nrd___s___r_nif_exist___s__goto_try_r_nATTRIB__r___s___r_ndel___s___cls
cmp byte [esi + 5], bl
jne 0x43439f
mov eax, str._echo_off__r_nATTRIB__r___s___r_n:try__r_ndel___s___r_nif_exist___s__goto_try_r_nATTRIB__r___s___r_ndel___s___cls
push dword [ebp - 0x14]
push dword [ebp - 0x14]
push dword [esi]
push dword [esi]
push dword [esi]
push eax
lea eax, [ebp - 0x18]
call fcn.0043518a
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax - 0xc]
add esp, 0x18
push ebx
lea edx, [ebp - 0x1c]
push edx
push ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov byte [ebp - 4], 4
lea eax, [ebp - 0x14]
push eax
call fcn.00434e24
mov byte [ebp - 4], 3
lea eax, [ebp - 0x18]
push eax
call fcn.00434e24
mov byte [ebp - 4], 1
cmp edi, ebx
je 0x4343f7
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x24], ebx
cmp byte [esi + 4], bl
jne 0x434410
push ebx
push ebx
push ebx
push dword [ebp - 0x10]
push 0x4bdc34
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x43444e
push 0x3c
pop edi
push edi
lea eax, [ebp - 0x60]
push ebx
push eax
call fcn.0048a3e0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x50], eax
add esp, 0xc
lea eax, [ebp - 0x60]
push eax
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x5c], 0x500
mov dword [ebp - 0x54], str.runas
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x44], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x10]
call fcn.00403d84
or dword [ebp - 4], 0xffffffff
push esi
call fcn.00434e24
call fcn.0048e5b6
ret 4
Function at 0x43621d
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
jne 0x43622b
push 0xd
pop eax
jmp 0x43625e
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x436232
mov eax, dword [ebp + 8]
push edi
push dword [ebp + 0x10]
push 7
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x438f93
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.0047f101
movzx eax, ax
push str.kernel32.dll
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
push str.IsWow64Process
push ebx
call esi
mov edi, eax
test edi, edi
je 0x438ffa
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
test eax, eax
je 0x438ffa
cmp dword [ebp - 4], 0
je 0x438ffa
push str.GetNativeSystemInfo
push ebx
call esi
test eax, eax
je 0x438ffa
lea ecx, [ebp - 0x28]
push ecx
call eax
jmp 0x439004
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov cx, word [ebp - 0x28]
movzx eax, cx
test eax, eax
je 0x439036
cmp eax, 6
je 0x43902f
cmp eax, 9
jne 0x43903c
cmp word [ebp + 8], ax
je 0x439026
cmp word [ebp + 8], 0
jne 0x43903c
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 4
cmp word [ebp + 8], 6
jmp 0x439024
cmp word [ebp + 8], cx
je 0x439026
push 0x10
push ecx
mov eax, esp
push ecx
mov dword [eax], 0x2797
mov eax, esp
push 0
mov dword [eax], 0x2796
call fcn.0040aaf4
add esp, 0x10
xor al, al
jmp 0x439028
Function at 0x43e340
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a5183
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4e52f4]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.std::locale::_Locimp.0
mov dword [esp + 0x14], 1
push esi
call fcn.00489242
add esp, 4
mov byte [esp + 0x14], 0
cmp dword [esi + 0x30], 0x10
jb 0x43e396
mov eax, dword [esi + 0x1c]
push eax
call fcn.00489b10
add esp, 4
mov dword [esi + 0x30], 0xf
mov dword [esi + 0x2c], 0
mov byte [esi + 0x1c], 0
mov dword [esp + 0x14], 0xffffffff
mov dword [esi], vtable.std::locale::facet.0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x43f3f0
Capabilities:
Create thread

Disassembly:
push 8
call fcn.00489f6f
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
add esp, 4
push 0
push 0
push eax
push 0x43f420
push 0
push 0
mov dword [eax], ecx
mov dword [eax + 4], edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x4417a0
Capabilities:
Delete file

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, eax
mov ebx, dword [esi + 0xc]
push edi
cmp ebx, dword [esi + 0x10]
jbe 0x4417b6
call fcn.00489d53
mov ebp, dword [esi + 0x10]
mov edi, dword [esi]
cmp dword [esi + 0xc], ebp
jbe 0x4417c5
call fcn.00489d53
mov eax, dword [esi]
mov dword [esp + 0x10], eax
jmp 0x4417d0
test edi, edi
je 0x4417da
cmp edi, dword [esp + 0x10]
je 0x4417df
call fcn.00489d53
cmp ebx, ebp
je 0x44182c
test edi, edi
jne 0x441824
call fcn.00489d53
xor eax, eax
cmp ebx, dword [eax + 0x10]
jb 0x4417f8
call fcn.00489d53
cmp dword [ebx + 0x18], 8
lea eax, [ebx + 4]
jb 0x441803
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test edi, edi
jne 0x441828
call fcn.00489d53
xor eax, eax
cmp ebx, dword [eax + 0x10]
jb 0x44181f
call fcn.00489d53
add ebx, 0x1c
jmp 0x4417d0
mov eax, dword [edi]
jmp 0x4417ee
mov eax, dword [edi]
jmp 0x441815
mov ebp, dword [esi + 0x10]
cmp dword [esi + 0xc], ebp
jbe 0x441839
call fcn.00489d53
mov edi, dword [esi + 0xc]
mov ebx, dword [esi]
cmp edi, dword [esi + 0x10]
jbe 0x441848
call fcn.00489d53
mov eax, dword [esi]
push ebp
push ebx
push edi
push eax
lea ecx, [esp + 0x20]
push ecx
call fcn.00441b70
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x441860
Capabilities:
Delete directory

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
mov esi, eax
mov ebx, dword [esi + 0x10]
push edi
cmp dword [esi + 0xc], ebx
jbe 0x441876
call fcn.00489d53
mov edi, dword [esi]
mov ebp, ebx
mov ebx, dword [esi + 0xc]
mov dword [esp + 0x14], ebx
cmp ebx, dword [esi + 0x10]
jbe 0x44188b
call fcn.00489d53
mov eax, dword [esi]
mov dword [esp + 0x18], eax
test edi, edi
je 0x44189b
cmp edi, dword [esp + 0x18]
je 0x4418a0
call fcn.00489d53
cmp ebp, ebx
je 0x441913
mov dword [esp + 0x24], ebp
test edi, edi
jne 0x4418e0
call fcn.00489d53
xor eax, eax
cmp ebp, dword [eax + 0xc]
ja 0x4418bd
call fcn.00489d53
lea ebx, [ebp - 0x1c]
test edi, edi
jne 0x4418e4
call fcn.00489d53
xor eax, eax
cmp ebx, dword [eax + 0x10]
jb 0x4418d5
call fcn.00489d53
cmp dword [ebx + 0x18], 8
jb 0x4418e8
mov eax, dword [ebx + 4]
jmp 0x4418eb
mov eax, dword [edi]
jmp 0x4418b3
mov eax, dword [edi]
jmp 0x4418cb
lea eax, [ebx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test edi, edi
jne 0x44190f
call fcn.00489d53
xor eax, eax
cmp ebp, dword [eax + 0xc]
ja 0x441907
call fcn.00489d53
mov ebp, ebx
mov ebx, dword [esp + 0x14]
jmp 0x441891
mov eax, dword [edi]
jmp 0x4418fd
mov ebp, dword [esi + 0x10]
cmp dword [esi + 0xc], ebp
jbe 0x441920
call fcn.00489d53
mov edi, dword [esi + 0xc]
mov ebx, dword [esi]
cmp edi, dword [esi + 0x10]
jbe 0x44192f
call fcn.00489d53
mov eax, dword [esi]
push ebp
push ebx
push edi
push eax
lea ecx, [esp + 0x30]
push ecx
call fcn.00441b70
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret