joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ac53c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00405240
mov eax, dword [ebp - 8]
call fcn.00405240
xor eax, eax
push ebp
push 0x4ac5e9
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 1
cmp byte [ebp + 8], 0
jne 0x4ac57c
xor ebx, ebx
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040a38c
mov eax, dword [ebp - 0xc]
call fcn.00409f48
test al, al
je 0x4ac5ab
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0040a38c
mov eax, dword [ebp - 0x10]
call fcn.00402cb0
call fcn.00402c74
push ebx
push 0
mov eax, dword [ebp - 8]
call fcn.00405250
push eax
mov eax, dword [ebp - 4]
call fcn.00405250
push eax
push 0x4ac5fc
push 0
call sub.shell32.dll_ShellExecuteA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ac5f0
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404db4
ret

Function at 0x4ac604
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
xor ebx, ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00405240
mov eax, dword [ebp - 8]
call fcn.00405240
xor eax, eax
push ebp
push 0x4ac725
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x48]
mov eax, dword [ebp - 4]
call fcn.0040a38c
mov eax, dword [ebp - 0x48]
call fcn.00409f48
test al, al
je 0x4ac666
lea edx, [ebp - 0x4c]
mov eax, dword [ebp - 4]
call fcn.0040a38c
mov eax, dword [ebp - 0x4c]
call fcn.00402cb0
call fcn.00402c74
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x3c
call fcn.00403670
mov dword [ebp - 0x44], 0x3c
mov dword [ebp - 0x40], 0x40
mov eax, dword [0x4d85d4]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 4]
call fcn.00405250
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 8]
call fcn.00405250
mov dword [ebp - 0x30], eax
cmp byte [ebp + 8], 0
je 0x4ac6b5
mov dword [ebp - 0x28], 1
jmp 0x4ac6ba
xor eax, eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x44]
push eax
call sub.shell32.dll_ShellExecuteExA
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x4ac6fd
jmp 0x4ac6eb
mov eax, dword [0x4d85d4]
mov eax, dword [eax]
call fcn.00463dfc
mov eax, dword [0x4d85d4]
mov eax, dword [eax]
cmp byte [eax + 0x9c], 0
jne 0x4ac6fd
push 0x64
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x4ac6cf
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ac72c
lea eax, [ebp - 0x4c]
mov edx, 2
call fcn.00404db4
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404db4
ret
Function at 0x4acb88
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405240
xor eax, eax
push ebp
push 0x4acbea
push dword fs:[eax]
mov dword fs:[eax], esp
or esi, 0xffffffff
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004ac7a0
test eax, eax
jbe 0x4acbd4
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov ebx, eax
test ebx, ebx
jbe 0x4acbd4
push 0
push ebx
call sub.kernel32.dll_TerminateProcess
mov esi, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4acbf1
lea eax, [ebp - 4]
call fcn.00404d90
ret

Function at 0x4acbf8
Capabilities:
Create service
Persist via windows service
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, ecx
mov ebx, edx
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
setne byte [ebp - 1]
cmp byte [ebp - 1], 0
je 0x4accf5
xor eax, eax
push ebp
push 0x4accee
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf01ff
push ebx
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
setne byte [ebp - 1]
cmp dword [ebp - 0xc], 0
jne 0x4acc8b
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x424
jne 0x4acc8b
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
push 0
push 2
push 0x110
push 0xf01ff
push esi
push ebx
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CreateServiceA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
setne byte [ebp - 1]
mov al, byte [ebp - 1]
and al, byte [ebp + 8]
je 0x4accce
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_StartServiceA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
jne 0x4accce
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x420
jne 0x4accce
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4accf5
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
mov al, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4acd00
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
setne byte [ebp - 1]
cmp byte [ebp - 1], 0
je 0x4acdfa
xor eax, eax
push ebp
push 0x4acdf3
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf01ff
push ebx
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
setne byte [ebp - 1]
cmp dword [ebp - 0xc], 0
jne 0x4acd77
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x424
jne 0x4acd77
mov ecx, 0x4ace0c
mov dl, 1
mov eax, dword [0x40846c]
call fcn.0040ddd0
cmp dword [ebp - 0xc], 0
je 0x4acddc
xor eax, eax
push ebp
push 0x4acdd5
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_StartServiceA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
jne 0x4acdbe
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x420
jne 0x4acdbe
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4acddc
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4acdfa
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
mov al, byte [ebp - 1]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4ace34
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
mov ebx, edx
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
setne byte [ebp - 1]
cmp byte [ebp - 1], 0
je 0x4acf13
xor eax, eax
push ebp
push 0x4acf0c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf01ff
push ebx
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
setne byte [ebp - 1]
cmp dword [ebp - 0xc], 0
jne 0x4aceab
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x424
jne 0x4aceab
mov ecx, 0x4acf24
mov dl, 1
mov eax, dword [0x40846c]
call fcn.0040ddd0
cmp dword [ebp - 0xc], 0
je 0x4acef5
xor eax, eax
push ebp
push 0x4aceee
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
push eax
push 1
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_ControlService
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4acef5
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4acf13
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
mov al, byte [ebp - 1]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4acf4c
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
mov ebx, edx
mov dword [ebp - 4], 1
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4acffa
xor eax, eax
push ebp
push 0x4acff3
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf01ff
push ebx
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4acfdc
xor eax, eax
push ebp
push 0x4acfd5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_QueryServiceStatus
mov eax, dword [ebp - 0x24]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4acfdc
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4acffa
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4ad40c
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0xc], ecx
mov ebx, edx
xor eax, eax
push ebp
push 0x4ad4d1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.00404e28
lea eax, [ebp - 0xc]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.004052b0
mov eax, dword [ebp - 0xc]
call fcn.00405050
dec eax
jg 0x4ad471
lea eax, [ebp - 0xc]
mov edx, 0x4ad4ec
call fcn.00405058
lea eax, [ebp - 0x2c]
mov ecx, 0x4ad4f8
mov edx, dword [ebp - 0xc]
call fcn.0040509c
mov eax, dword [ebp - 0x2c]
call fcn.00409f48
test al, al
je 0x4ad4b3
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00405250
push eax
call sub.kernel32.dll_GetDiskFreeSpaceExA
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ad4d8
lea eax, [ebp - 0x2c]
call fcn.00404d90
lea eax, [ebp - 0xc]
call fcn.00404d90
ret
Function at 0x4ad4fc
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x260], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
xor eax, eax
push ebp
push 0x4ad651
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00403030
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040eb28
mov eax, dword [ebp - 8]
call fcn.00405050
mov ebx, 0xfa
sub ebx, eax
test ebx, ebx
jbe 0x4ad572
mov eax, 0x1a
call fcn.00403690
mov edx, eax
add dl, 0x41
lea eax, [ebp - 0x260]
call fcn.00404f78
mov edx, dword [ebp - 0x260]
lea eax, [ebp - 8]
call fcn.00405058
dec ebx
jne 0x4ad547
mov eax, dword [ebp - 8]
call fcn.00409f38
test al, al
jne 0x4ad529
mov bl, 1
xor eax, eax
push ebp
push 0x4ad5bb
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x154]
call fcn.004033cc
mov edx, 1
lea eax, [ebp - 0x154]
call fcn.004037b4
call fcn.00402c74
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ad5c7
test bl, bl
je 0x4ad5eb
lea eax, [ebp - 0x154]
call fcn.00403494
call fcn.00402c74
lea eax, [ebp - 0x154]
call fcn.00403638
call fcn.00402c74
test bl, bl
jne 0x4ad630
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404e28
lea eax, [ebp - 0x259]
push eax
push 0
push 0x4ad664
mov eax, dword [ebp - 8]
call fcn.00405250
push eax
call sub.kernel32.dll_GetTempFileNameA
test eax, eax
je 0x4ad62e
lea eax, [ebp - 0x259]
push eax
call sub.kernel32.dll_DeleteFileA_1
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x4ad630
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ad658
lea eax, [ebp - 0x260]
call fcn.00404d90
lea eax, [ebp - 8]
call fcn.00404d90
ret

Function at 0x4ad874
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00405240
mov eax, dword [ebp - 8]
call fcn.00405240
xor eax, eax
push ebp
push 0x4ad936
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.004ad808
test al, al
je 0x4ad91b
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.0040a38c
mov eax, dword [ebp - 0xc]
call fcn.00409f6c
push 0x64
mov ecx, 0xa
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.004ad948
xor ebx, ebx
mov edi, 0xb
mov eax, dword [ebp - 8]
call fcn.00405250
push eax
mov eax, dword [ebp - 4]
call fcn.00405250
push eax
call sub.kernel32.dll_MoveFileA
test eax, eax
je 0x4ad90c
mov bl, 1
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.004ad808
jmp 0x4ad91b
mov edx, 0x12c
mov eax, esi
call fcn.004a9978
dec edi
jne 0x4ad8e3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ad93d
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404db4
ret
Function at 0x4ad948
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00405240
xor eax, eax
push ebp
push 0x4ad9c1
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp - 4]
call fcn.00409f38
test al, al
jne 0x4ad980
mov bl, 1
jmp 0x4ad9ab
dec esi
test esi, esi
jl 0x4ad9ab
inc esi
mov eax, dword [ebp - 4]
call fcn.00405250
push eax
call sub.kernel32.dll_DeleteFileA_1
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x4ad9ab
mov edx, dword [ebp + 8]
mov eax, edi
call fcn.004a9978
dec esi
jne 0x4ad986
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ad9c8
lea eax, [ebp - 4]
call fcn.00404d90
ret
Function at 0x4ad9d4
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe7c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x184], ecx
mov dword [ebp - 0x180], ecx
mov dword [ebp - 0x17c], ecx
mov dword [ebp - 0x178], ecx
mov dword [ebp - 0x174], ecx
mov dword [ebp - 0x170], ecx
mov dword [ebp - 0x16c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00405240
lea eax, [ebp - 0x168]
mov edx, dword [0x40844c]
call fcn.004057c8
xor eax, eax
push ebp
push 0x4adc34
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x418ba4]
call fcn.00403f50
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4adbeb
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x16c]
mov eax, dword [ebp - 8]
call fcn.0040eb14
mov edx, dword [ebp - 0x16c]
lea eax, [ebp - 8]
call fcn.00404e28
lea eax, [ebp - 0x170]
mov ecx, 0x4adc50
mov edx, dword [ebp - 8]
call fcn.0040509c
mov eax, dword [ebp - 0x170]
lea ecx, [ebp - 0x168]
mov edx, 0x3f
call fcn.0040a1a4
mov ebx, eax
test ebx, ebx
jne 0x4adb94
test byte [ebp - 0x160], 0x10
jne 0x4adb0a
lea edx, [ebp - 0x174]
mov eax, dword [ebp - 0x15c]
call fcn.004091cc
mov edx, dword [ebp - 0x174]
mov eax, 0x4adc5c
call fcn.00405394
test eax, eax
jg 0x4adb50
push 0x64
lea eax, [ebp - 0x178]
mov ecx, dword [ebp - 0x15c]
mov edx, dword [ebp - 8]
call fcn.0040509c
mov edx, dword [ebp - 0x178]
mov ecx, 3
mov eax, dword [ebp - 4]
call fcn.004ad948
mov eax, dword [0x4d85d4]
mov eax, dword [eax]
call fcn.00463dfc
jmp 0x4adb50
mov eax, dword [ebp - 0x15c]
mov edx, 0x4adc70
call fcn.0040519c
je 0x4adb50
mov eax, dword [ebp - 0x15c]
mov edx, 0x4adc7c
call fcn.0040519c
je 0x4adb50
lea eax, [ebp - 0x17c]
mov ecx, dword [ebp - 0x15c]
mov edx, dword [ebp - 8]
call fcn.0040509c
mov edx, dword [ebp - 0x17c]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push dword [ebp - 8]
push dword [ebp - 0x15c]
push 0x4adc88
lea eax, [ebp - 0x180]
mov edx, 3
call fcn.00405110
mov eax, dword [ebp - 0x180]
call fcn.00405250
push eax
call sub.kernel32.dll_RemoveDirectoryA
lea eax, [ebp - 0x168]
call fcn.0040a1f4
mov ebx, eax
test ebx, ebx
je 0x4adaa5
lea eax, [ebp - 0x168]
call fcn.0040a218
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x4adbd3
inc ebx
xor esi, esi
lea ecx, [ebp - 0x184]
mov edx, esi
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x184]
mov eax, dword [ebp - 4]
call fcn.004ad9d4
inc esi
dec ebx
jne 0x4adbb1
mov eax, dword [ebp - 8]
call fcn.00405250
push eax
call sub.kernel32.dll_RemoveDirectoryA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4adbf5
lea eax, [ebp - 0x10]
call fcn.0040fb9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4adc3b
lea eax, [ebp - 0x184]
mov edx, 7
call fcn.00404db4
lea eax, [ebp - 0x168]
mov edx, dword [0x40844c]
call fcn.00405898
lea eax, [ebp - 8]
call fcn.00404d90
ret
Function at 0x4af338
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
add eax, 0xc
mov eax, dword [eax]
mov dword [edx + 0xc], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0xc]
mov ebx, ecx
shl ebx, 0x18
shr ecx, 8
or ebx, ecx
mov ecx, ebx
xor ebx, ebx
mov bl, cl
mov ebx, dword [ebx*4 + 0x4d765c]
mov dword [esp + 4], ebx
mov ebx, ecx
shr ebx, 8
and ebx, 0xff
mov esi, dword [ebx*4 + 0x4d765c]
mov ebx, ecx
shr ebx, 0x10
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x4d765c]
mov dword [esp + 8], ebx
shr ecx, 0x18
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4d765c]
mov ebx, esi
shl ebx, 8
shr esi, 0x18
or ebx, esi
xor ebx, dword [esp + 4]
mov esi, dword [esp + 8]
shl esi, 0x10
mov edi, dword [esp + 8]
shr edi, 0x10
or esi, edi
xor ebx, esi
mov esi, ecx
shl esi, 0x18
shr ecx, 8
or esi, ecx
xor ebx, esi
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x4d71e0]
mov dword [edx + eax*4 + 0x10], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x10]
mov dword [edx + eax*4 + 0x14], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x18], ebx
mov ecx, dword [edx + eax*4 + 0xc]
xor ecx, ebx
mov dword [edx + eax*4 + 0x1c], ecx
add eax, 4
cmp eax, 0x28
jl 0x4af363
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x404010
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [ebx]
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.00403707
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004036bc
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], 0x80
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
push eax
call fcn.00403707
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004036bc
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.004036f7
xchg dword [ebx + 0x25], ecx
and al, 0x80
movsd dword es:[edi], dword [esi]
int3
Function at 0x405c60
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43d790
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2ac
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
push 0x24
push 0
lea eax, [ebp - 0x34]
push eax
call fcn.0041fa10
add esp, 0xc
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [ebp - 0x14]
mov dword [ebp - 0x38], eax
mov ax, word [ebp - 0x12]
mov word [ebp - 0x3c], ax
movzx eax, word [ebp - 0x3c]
imul eax, dword [ebp - 0x38]
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x58]
call fcn.00402bf0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x5c]
call fcn.00402bf0
mov byte [ebp - 4], 1
mov al, byte [0x43f87b]
mov byte [ebp - 0x15c], al
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x15b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov al, byte [0x43f87b]
mov byte [ebp - 0x25c], al
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x25b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x260], 0
mov dword [ebp - 0x264], 0
mov dword [ebp - 0x268], 0
mov dword [ebp - 0x270], 0
mov dword [ebp - 0x26c], 0
call fcn.004026d0
mov dword [ebp - 0x270], eax
mov dword [ebp - 0x26c], edx
mov eax, dword [ebp - 0x38]
xor ecx, ecx
add eax, dword [ebp - 0x270]
adc ecx, dword [ebp - 0x26c]
mov dword [ebp - 0x2b8], eax
mov dword [ebp - 0x2b4], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x5c]
call fcn.00402c20
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.00402c20
mov eax, dword [ebp - 0x2b8]
mov edx, dword [ebp - 0x2b4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406b60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
push 0x104
push 0
mov eax, dword [ebp - 4]
add eax, 0x32c
push eax
call fcn.0041fa10
add esp, 0xc
mov eax, dword [ebp - 4]
add eax, 0x32c
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x104
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.0041fa10
add esp, 0xc
mov eax, dword [ebp - 4]
add eax, 0x32c
push eax
call fcn.0042004a
add esp, 4
mov dword [ebp - 0x210], eax
mov eax, dword [ebp - 0x210]
mov ecx, dword [ebp - 4]
movzx edx, word [ecx + eax*2 + 0x32a]
cmp edx, 0x5c
je 0x406bf4
push str.config.ini
lea eax, [ebp - 0x20c]
push eax
call fcn.004207ab
add esp, 8
jmp 0x406c08
push 0x440238
lea eax, [ebp - 0x20c]
push eax
call fcn.004207ab
add esp, 8
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x32c
push ecx
call fcn.00420781
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x406c30
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43d808
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x20]
call fcn.00436539
mov dword [ebp - 4], 0
push 0
push 0
mov eax, dword [ebp - 0x10]
add eax, 0x32c
push eax
lea ecx, [ebp - 0x20]
call fcn.004367d5
test eax, eax
je 0x406c83
lea ecx, [ebp - 0x20]
call fcn.004364d7
jmp 0x406cc7
push 0
push 0x1002
mov eax, dword [ebp - 0x10]
add eax, 0x32c
push eax
lea ecx, [ebp - 0x20]
call fcn.004367d5
test eax, eax
je 0x406ca9
lea ecx, [ebp - 0x20]
call fcn.004364d7
jmp 0x406cc7
push 0
push 0x440180
push 0x440268
mov ecx, dword [ebp - 0x10]
call fcn.00431c05
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00436578
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret