joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4541d0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x104
mov eax, dword [0x4ad3b0]
xor eax, esp
mov dword [esp + 0x100], eax
mov ecx, dword [esp + 0x10c]
push ebx
mov ebx, dword [esp + 0x10c]
push esi
push edi
mov edi, dword [esp + 0x120]
mov eax, dword [ebx]
push 0
push dword [esp + 0x120]
mov eax, dword [eax + 8]
push ecx
mov dword [edi], 0
push dword [eax + 0x98]
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
cmp esi, 0xffffffff
jne 0x45426f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2733
jne 0x45423c
mov dword [edi], 0x51
jmp 0x45426c
push 0x100
lea eax, [esp + 0x10]
push eax
push esi
call fcn.00434ce0
push eax
push str.Recv_failure:__s
push dword [ebx + 4]
call fcn.00422a30
mov eax, dword [ebx + 4]
add esp, 0x18
mov dword [eax + 0x934], esi
mov dword [edi], 0x38
or esi, 0xffffffff
push dword [edi]
push esi
push dword [esp + 0x124]
push str.nw_in_read_len_zu______d__err_d
push dword [ebx]
push dword [ebx + 4]
call fcn.00422b90
mov ecx, dword [esp + 0x124]
add esp, 0x18
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00464714
add esp, 0x104
ret

Function at 0x4542b0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x188
mov eax, dword [0x4ad3b0]
xor eax, esp
mov dword [esp + 0x184], eax
mov eax, dword [esp + 0x18c]
push ebx
mov ebx, dword [esp + 0x194]
push esi
mov esi, dword [eax + 8]
mov eax, dword [ebx + 0x18]
mov eax, dword [eax + 0x1e8]
test dword [eax + 0x44], 0x800
jne 0x4543dd
push 0x80
lea eax, [esp + 0x10]
mov dword [esp + 0xc], 0x80
push 0
push eax
call fcn.00466e70
add esp, 0xc
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x10]
push eax
push dword [esi + 0x98]
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x45436a
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
lea eax, [esp + 0x8c]
push 0x100
push eax
push esi
call fcn.00434ce0
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
push ebx
call fcn.00422a30
add esp, 0x1c
mov eax, 2
pop esi
pop ebx
mov ecx, dword [esp + 0x184]
xor ecx, esp
call fcn.00464714
add esp, 0x188
ret
lea eax, [esi + 0x120]
push eax
lea eax, [esi + 0xf0]
push eax
push dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
call fcn.00423a50
add esp, 0x10
test al, al
jne 0x4543dd
push edi
call fcn.0046e5b0
mov esi, dword [eax]
call fcn.0046e5b0
mov edi, eax
lea eax, [esp + 0x90]
push 0x100
push eax
push esi
call fcn.00434ce0
push eax
push dword [edi]
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.00422a30
add esp, 0x1c
mov eax, 2
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x184]
xor ecx, esp
call fcn.00464714
add esp, 0x188
ret
mov ecx, dword [esp + 0x18c]
xor eax, eax
pop esi
pop ebx
xor ecx, esp
call fcn.00464714
add esp, 0x188
ret
Function at 0x45ac90
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x120
mov eax, dword [0x4ad3b0]
xor eax, esp
mov dword [esp + 0x11c], eax
mov eax, dword [esp + 0x124]
push ebx
push ebp
mov ebp, dword [esp + 0x134]
xor ebx, ebx
push esi
push edi
mov edi, dword [esp + 0x138]
xor esi, esi
push edi
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], edi
call fcn.0047b4e9
add esp, 4
mov dword [esp + 0x20], eax
test eax, eax
jne 0x45ad08
push 0x100
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00434dd0
push eax
push edi
push str.schannel:_invalid_path_name_for_CA_file__s:__s
push ebp
call fcn.00422a30
add esp, 0x1c
lea esi, [ebx + 0x4d]
jmp 0x45ae47
push 0
push 0x80
push 3
push 0
push 1
push bind
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esp + 0x18], eax
cmp eax, 0xffffffff
jne 0x45ad5a
push 0x100
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00434dd0
push eax
push edi
push str.schannel:_failed_to_open_CA_file__s:__s
push ebp
call fcn.00422a30
add esp, 0x1c
mov esi, 0x4d
jmp 0x45ae47
lea ecx, [esp + 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x45ad9a
push 0x100
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00434dd0
push eax
push edi
push str.schannel:_failed_to_determine_size_of_CA_file__s:__s
push ebp
call fcn.00422a30
add esp, 0x1c
mov esi, 0x4d
jmp 0x45ae3d
mov edi, dword [esp + 0x24]
cmp dword [esp + 0x28], ebx
jl 0x45adc8
jg 0x45adae
cmp edi, 0x100000
jbe 0x45adc8
push 0x100000
push str.schannel:_CA_file_exceeds_max_size_of__u_bytes
push ebp
call fcn.00422a30
add esp, 0xc
mov esi, 0x4d
jmp 0x45ae3d
lea eax, [edi + 1]
push eax
call dword [section..data]
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x45ade0
lea esi, [eax + 0x1b]
jmp 0x45ae3d
test edi, edi
je 0x45ae24
nop dword [eax]
nop dword [eax + eax]
push 0
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0
push eax
mov eax, edi
sub eax, esi
push eax
lea eax, [esi + ebx]
push eax
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x45ae81
mov eax, dword [esp + 0x10]
test eax, eax
je 0x45ae7d
add esi, eax
cmp esi, edi
jb 0x45adf0
push ebp
push dword [esp + 0x18]
mov byte [edi + ebx], 0
push edi
push ebx
push dword [esp + 0x2c]
call fcn.0045aa90
add esp, 0x14
mov esi, eax
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [0x4ad004]
mov eax, dword [esp + 0x24]
add esp, 4
test eax, eax
je 0x45ae62
push eax
call fcn.0046a118
add esp, 4
mov ecx, dword [esp + 0x12c]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00464714
add esp, 0x120
ret
mov edi, esi
jmp 0x45ae24
push 0x100
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00434dd0
push eax
push dword [esp + 0x24]
push str.schannel:_failed_to_read_from_CA_file__s:__s
push ebp
call fcn.00422a30
add esp, 0x1c
mov esi, 0x4d
jmp 0x45ae3d
Function at 0x461970
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [section..data]
mov edi, eax
add esp, 4
test edi, edi
jne 0x461997
pop edi
pop esi
pop ecx
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [esp + 0x1c]
mov dword [edi + 8], eax
push ebp
cmp ebx, dword [esi + 0x10]
jbe 0x4619e2
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push dword [esp + 0x24]
push dword [edi + 4]
call eax
mov ebp, dword [edi + 8]
push dword [edi + 4]
add ebp, dword [esi + 0xc]
mov eax, dword [esi + 8]
push ebp
call eax
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov ecx, dword [edi + 4]
mov dword [esp + 0x20], ebx
jmp 0x4619e6
mov ebp, dword [esp + 0x1c]
mov eax, dword [esi]
push ecx
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [esp + 0x28]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x461a46
mov dword [esp + 0x10], eax
mov ebx, eax
movzx eax, byte [ebp]
xor al, 0x36
mov byte [esp + 0x18], al
lea eax, [esp + 0x18]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebp]
lea ebp, [ebp + 1]
xor al, 0x5c
mov byte [esp + 0x24], al
lea eax, [esp + 0x24]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub ebx, 1
jne 0x461a05
mov ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0x10]
jae 0x461a77
nop dword [eax + eax]
mov eax, dword [esi + 4]
push 1
push 0x49b181
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x49b182
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x461a50
pop ebp
pop ebx
mov eax, edi
pop edi
pop esi
pop ecx
ret
Function at 0x461a80
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push dword [esp + 0x20]
call fcn.00424ad0
mov esi, dword [esp + 0x1c]
mov ebx, eax
mov ebp, dword [esp + 0x20]
mov dword [esp + 0x14], ebx
mov edx, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea ecx, [ecx + edx*2]
add ecx, 0xc
push ecx
call dword [section..data]
mov edi, eax
add esp, 8
test edi, edi
je 0x461be8
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0x461afc
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push ebp
push dword [edi + 4]
call eax
mov ebp, dword [edi + 8]
push dword [edi + 4]
add ebp, dword [esi + 0xc]
mov eax, dword [esi + 8]
push ebp
call eax
mov eax, dword [esi + 0x14]
add esp, 0x18
mov ecx, dword [edi + 4]
mov dword [esp + 0x10], eax
mov eax, dword [esi]
push ecx
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [esp + 0x18]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x461b61
mov dword [esp + 0x18], eax
mov ebx, eax
nop dword [eax + eax]
movzx eax, byte [ebp]
xor al, 0x36
mov byte [esp + 0x1c], al
lea eax, [esp + 0x1c]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebp]
lea ebp, [ebp + 1]
xor al, 0x5c
mov byte [esp + 0x28], al
lea eax, [esp + 0x28]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub ebx, 1
jne 0x461b20
mov ebx, dword [esp + 0x18]
cmp ebx, dword [esi + 0x10]
jae 0x461b8d
mov eax, dword [esi + 4]
push 1
push 0x49b181
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x49b182
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x461b66
push dword [esp + 0x28]
call fcn.00424ad0
mov ecx, dword [edi]
push eax
push dword [esp + 0x2c]
push dword [edi + 4]
mov eax, dword [ecx + 4]
call eax
mov esi, dword [esp + 0x3c]
add esp, 0x10
mov ebx, dword [edi]
test esi, esi
jne 0x461bb8
mov esi, dword [ebx + 0xc]
add esi, dword [edi + 8]
push dword [edi + 4]
mov eax, dword [ebx + 8]
push esi
call eax
push dword [ebx + 0x14]
mov eax, dword [ebx + 4]
push esi
push dword [edi + 8]
call eax
push dword [edi + 8]
mov eax, dword [ebx + 8]
push esi
call eax
push edi
call dword [0x4ad004]
add esp, 0x20
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
mov eax, 0x1b
pop ebx
pop ecx
ret
Function at 0x461cc0
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
sub esp, 0xc
lea eax, [esp + 4]
push 0xf0000040
push 0x18
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x461ce6
mov eax, 0x1b
add esp, 0xc
ret
lea eax, [esp + 8]
push eax
push 0
push 0
push 0x800c
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x461d16
push eax
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 2
add esp, 0xc
ret
push dword [esp + 0x18]
call fcn.00424ad0
add esp, 4
push 0
push eax
push dword [esp + 0x1c]
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
push 0
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
push 0
push 2
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [esp], 0x20
jne 0x461d6d
push 0
lea eax, [esp + 4]
push eax
push dword [esp + 0x18]
push 2
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov eax, dword [esp + 8]
test eax, eax
je 0x461d7c
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x461d8d
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
add esp, 0xc
ret
Function at 0x47e90a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0047e780

Function at 0x403945
Capabilities:
Terminate process

Disassembly:
jmp 0x469dbe
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x469dcf
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405fd8
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x403a7b
Capabilities:
Query environment variable

Disassembly:
jmp 0x4a7e1a
mov edi, edi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x4a7e2e
xor edi, edi
jmp 0x4a7e65
push ebx
push esi
call fcn.004a7d24
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00404453
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x4a7e55
push ebx
push esi
push edi
call fcn.00405d6c
add esp, 0xc
push 0
call fcn.004069d8
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
pop ebx
mov eax, edi
pop edi
pop esi
ret

Function at 0x405e3e
Capabilities:
Parse pe header

Disassembly:
jmp 0x45900b
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x45904a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x45904a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x45904a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x45904a
cmp dword [ecx + 0x74], 0xe
jbe 0x45904a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x457280
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
call fcn.00403adf
push 2
lea ecx, [ebp - 4]
push ecx
mov eax, dword [eax + 0x14]
push 0x22
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx eax, word [ebp - 4]
sub eax, 0x30
je 0x4572bf
sub eax, 1
je 0x4572ba
sub eax, 1
je 0x4572b6
xor eax, eax
leave
ret
push 3
jmp 0x4572c1
xor eax, eax
inc eax
leave
ret
push 2
pop eax
leave
ret
Function at 0x3c174b
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, ecx
mov eax, dword [edi + 0x44]
xor ebx, ebx
cmp eax, ebx
je 0x3c17a6
cmp eax, 0xffffffff
je 0x3c17a6
cmp dword [ebp + 8], ebx
je 0x3c17a6
push esi
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, dword [edi + 0x44]
push ebx
mov esi, eax
lea eax, [ebp - 4]
push eax
add esi, esi
push esi
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x3cf302
cmp esi, dword [ebp - 4]
jne 0x3cf31d
pop esi
pop edi
mov eax, ebx
pop ebx
leave
ret 4
mov ebx, 0x80070057
jmp 0x3c179e

Function at 0x3c227c
Capabilities:
Query environment variable

Disassembly:
push 0x20
mov eax, 0x3d621c
call fcn.003c1350
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
push ebx
push 0x20019
push dword [0x3db458]
lea ecx, [ebp - 0x2c]
push 0x80000002
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], ebx
call fcn.003c2097
test eax, eax
jne 0x3c23c4
lea eax, [ebp - 0x20]
push eax
push dword [0x3db45c]
lea ecx, [ebp - 0x2c]
push ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x20], ebx
call fcn.003c23dc
test eax, eax
jne 0x3c23c4
mov eax, dword [ebp - 0x20]
xor ecx, ecx
push 2
add eax, eax
pop edx
mul edx
seto cl
mov byte [ebp - 4], 1
neg ecx
or ecx, eax
push ecx
call fcn.003c13e0
mov esi, eax
pop ecx
mov dword [ebp - 0x1c], esi
cmp esi, ebx
je 0x3c23c4
lea eax, [ebp - 0x20]
push eax
push dword [0x3db45c]
lea ecx, [ebp - 0x2c]
push esi
call fcn.003c23dc
test eax, eax
jne 0x3c23bb
push ebx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
call esi
mov edi, eax
cmp edi, ebx
je 0x3c23bb
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.003c13e0
pop ecx
mov dword [ebp - 0x14], eax
cmp eax, ebx
je 0x3c23bb
push edi
push eax
push dword [ebp - 0x1c]
call esi
mov esi, eax
cmp esi, ebx
je 0x3c23b2
cmp dword [ebp + 8], ebx
je 0x3cea08
push dword [0x3db460]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [eax + esi + 1]
xor ecx, ecx
push 2
pop edx
mov eax, edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.003c13e0
pop ecx
mov dword [ebp - 0x18], eax
cmp eax, ebx
je 0x3c23b2
push dword [ebp - 0x14]
push esi
push eax
call fcn.003c21cb
push dword [0x3db460]
push edi
push dword [ebp - 0x18]
call fcn.003c2436
push dword [ebp - 0x14]
call fcn.003c13c0
pop ecx
push dword [ebp - 0x1c]
call fcn.003c13c0
pop ecx
lea ecx, [ebp - 0x2c]
call fcn.003c1f10
mov eax, dword [ebp - 0x18]
call fcn.003c1390
ret 4
Function at 0x3c23dc
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
push edi
push esi
lea eax, [ebp - 4]
push eax
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 4], ebx
jbe 0x3c242c
cmp dword [ebp - 4], 2
ja 0x3ce965
mov ecx, dword [edi]
test cl, 1
jne 0x3c242c
cmp esi, ebx
je 0x3c2425
shr ecx, 1
cmp word [esi + ecx*2 - 2], bx
jne 0x3c242c
pop edi
pop esi
pop ebx
leave
ret 0xc
push 0xd
pop eax
jmp 0x3c2425

Function at 0x3c24ed
Capabilities:
Delete file
Move file

Disassembly:
push 0x14
mov eax, 0x3d6b05
call fcn.003c1350
mov esi, ecx
mov eax, dword [esi + 0x44]
xor edi, edi
mov ebx, 0x8007000e
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
cmp eax, edi
je 0x3c2519
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x44], edi
cmp dword [ebp + 8], edi
je 0x3c265b
cmp dword [ebp + 0xc], edi
je 0x3c265b
push 1
call fcn.003c227c
mov dword [ebp - 0x1c], eax
cmp eax, edi
je 0x3c264a
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
mov dword [ebp - 4], edi
call esi
push dword [ebp + 8]
mov edi, eax
call esi
lea eax, [eax + edi + 1]
xor ecx, ecx
push 2
pop edx
mov dword [ebp - 0x20], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.003c13e0
pop ecx
mov dword [ebp - 0x18], eax
test eax, eax
je 0x3c259b
push dword [ebp - 0x1c]
inc edi
push edi
push eax
call fcn.003c21cb
mov ebx, eax
test ebx, ebx
jl 0x3c259b
push dword [ebp + 8]
push dword [ebp - 0x20]
push dword [ebp - 0x18]
call fcn.003c2436
mov ebx, eax
test ebx, ebx
jl 0x3c259b
xor ebx, ebx
inc ebx
or dword [ebp - 4], 0xffffffff
test ebx, ebx
jl 0x3c2632
push 2
pop ebx
push dword [ebp - 0x1c]
mov dword [ebp - 4], ebx
call esi
push dword [ebp + 0xc]
mov edi, eax
call esi
lea esi, [eax + edi + 1]
xor ecx, ecx
mov eax, esi
mul ebx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.003c13e0
pop ecx
mov dword [ebp - 0x14], eax
test eax, eax
je 0x3c2654
push dword [ebp - 0x1c]
inc edi
push edi
push eax
call fcn.003c21cb
mov ebx, eax
test ebx, ebx
jl 0x3c2623
push dword [ebp + 0xc]
push esi
push dword [ebp - 0x14]
call fcn.003c2436
mov ebx, eax
test ebx, ebx
jl 0x3c2623
xor ebx, ebx
inc ebx
test ebx, ebx
jl 0x3c2623
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 1
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x3cf3a2
xor ebx, ebx
cmp dword [ebp - 0x14], 0
je 0x3c2632
push dword [ebp - 0x14]
call fcn.003c13c0
pop ecx
cmp dword [ebp - 0x18], 0
je 0x3c2641
push dword [ebp - 0x18]
call fcn.003c13c0
pop ecx
push dword [ebp - 0x1c]
call fcn.003c13c0
pop ecx
mov eax, ebx
call fcn.003c1390
ret 8
mov ebx, 0x8007000e
jmp 0x3c25fe
mov ebx, 0x80070057
jmp 0x3c264a
Function at 0x3c3a67
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 8], 0
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x3c3ae4
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x3c3ac0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push 0x3c3ad0
push dword [ebp - 4]
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 0xffffffff
pop esi
je 0x3ce30e
mov eax, dword [ebp - 8]
leave
ret
Function at 0x3c4267
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
cmp dword [0x3db00c], esi
jne 0x3c42be
lea eax, [ebp - 4]
push eax
push esi
push esi
push 0x3c2c6f
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x3db00c], eax
cmp eax, esi
je 0x3ce4ec
push 0xffffffffffffffff
push dword [0x3db014]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [0x3db014]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
cmp dword [0x3db018], esi
jl 0x3ce50a
pop esi
leave
ret

Function at 0x3c4441
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x3c4498
call fcn.003c2712
xor eax, eax
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x3c4490
cmp ecx, 0xffffffff
je 0x3c4490
and dword [ebp - 4], eax
mov edx, 0x5a4d
cmp word [ecx], dx
jne 0x3c4489
mov edx, dword [ecx + 0x3c]
test edx, edx
jl 0x3c4489
cmp edx, 0x10000000
jae 0x3c4489
lea eax, [edx + ecx]
mov dword [ebp - 0x1c], eax
cmp dword [eax], 0x4550
jne 0x3ce892
mov dword [ebp - 4], 0xfffffffe
call fcn.003c2757
ret 4

Function at 0x3c681f
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x3db004]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push esi
mov esi, ecx
inc eax
cmp dword [esi + 0x2c], 0
jne 0x3c6933
push edi
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x41c], ax
lea eax, [ebp - 0x41a]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov edi, 0x105
push edi
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov dword [ebp - 0x420], eax
cmp eax, edi
ja 0x3ced16
lea eax, [ebp - 0x41c]
push eax
push edi
lea eax, [ebp - 0x210]
push eax
call fcn.003c21cb
test eax, eax
jl 0x3c6932
mov ecx, dword [ebp - 0x420]
cmp word [ebp + ecx*2 - 0x210], 0x5c
je 0x3c68c3
push 0x3c6994
push edi
lea eax, [ebp - 0x210]
push eax
call fcn.003c2436
test eax, eax
jl 0x3c6932
push 0x3c6980
push edi
lea eax, [ebp - 0x210]
push eax
call fcn.003c2436
test eax, eax
jl 0x3c6932
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi + 0x2c], eax
test eax, eax
je 0x3ced20
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x3c6970
push eax
call edi
push 0x3c695c
push dword [esi + 0x2c]
mov dword [esi + 0x30], eax
call edi
push 0x3c6948
push dword [esi + 0x2c]
mov dword [esi + 0x34], eax
call edi
cmp dword [esi + 0x30], 0
mov dword [esi + 0x38], eax
je 0x3c6940
cmp dword [esi + 0x34], 0
je 0x3c6940
test eax, eax
je 0x3c6940
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.003c20d4
leave
ret
mov eax, 0x8007007f
jmp 0x3c6932