joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407da0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x478118
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x48d744]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], ecx
cmp dword [ebp + 8], 0
je 0x407dfa
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
add ecx, 1
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x24]
mov al, byte [edx]
mov byte [ebp - 0x29], al
add dword [ebp - 0x24], 1
cmp byte [ebp - 0x29], 0
jne 0x407ddd
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x28]
mov dword [ebp - 0x30], ecx
jne 0x407e0a
mov edx, dword [ebp - 0x20]
mov eax, dword [edx]
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 0x20]
call fcn.00407820
cmp dword [ebp + 8], 0
je 0x407e3c
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 0x34]
add edx, 1
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x34]
mov cl, byte [eax]
mov byte [ebp - 0x39], cl
add dword [ebp - 0x34], 1
cmp byte [ebp - 0x39], 0
jne 0x407e1f
mov edx, dword [ebp - 0x34]
sub edx, dword [ebp - 0x38]
mov dword [ebp - 0x40], edx
jne 0x407e40
xor al, al
jmp 0x407e84
lea ecx, [ebp - 0x18]
call fcn.004169e0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x18]
call fcn.00416630
lea ecx, [ebp - 0x18]
call fcn.00402850
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne cl
mov byte [ebp - 0x19], cl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00416a10
mov al, byte [ebp - 0x19]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x40ac40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x40ac6d
mov ecx, dword [ebp - 4]
and ecx, 0x10
je 0x40ac6d
mov dword [ebp - 0xc], 1
jmp 0x40ac74
mov dword [ebp - 0xc], 0
mov al, byte [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x40ac80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x40acad
mov ecx, dword [ebp - 4]
and ecx, 0x10
jne 0x40acad
mov dword [ebp - 0xc], 1
jmp 0x40acb4
mov dword [ebp - 0xc], 0
mov al, byte [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x40d4f0
Capabilities:
Send data
Send data on socket
Send http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x34]
push ecx
push str._______________________m_szHead__n__s
call fcn.0044b4a1
add esp, 8
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x34]
push eax
push str._____________n_baotou__n__s
call fcn.0044b4a1
add esp, 8
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x34]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0xc]
mov dl, byte [ecx]
mov byte [ebp - 0x11], dl
add dword [ebp - 0xc], 1
cmp byte [ebp - 0x11], 0
jne 0x40d533
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
push 0
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x34]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x2c]
push edx
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x34]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x1c]
mov cl, byte [eax]
mov byte [ebp - 0x21], cl
add dword [ebp - 0x1c], 1
cmp byte [ebp - 0x21], 0
jne 0x40d57d
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x20]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
push eax
push str._____________n_chanff__n__d
call fcn.0044b4a1
add esp, 8
cmp dword [ebp - 4], 0
jge 0x40d5c8
push str._____________n______________AHttpSocket::sendMsg_failed_________
call fcn.0044b4a1
add esp, 4
mov ecx, dword [ebp - 8]
call fcn.0040d5e0
xor al, al
jmp 0x40d5cf
cmp dword [ebp - 4], 0
setne al
mov esp, ebp
pop ebp
ret

Function at 0x40d610
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov byte [ebp - 1], 1
mov eax, dword [ebp - 8]
cmp dword [eax + 0x58], 0
jne 0x40d666
push 1
mov ecx, dword [ebp - 8]
call fcn.0040dff0
push 1
mov ecx, dword [ebp - 8]
call fcn.0040dfa0
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 8]
add ecx, 0x5c
push ecx
push 0
mov edx, dword [ebp - 8]
push edx
push 0x40bea0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x58], eax
jmp 0x40d66a
mov byte [ebp - 1], 0
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret
Function at 0x410040
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov byte [eax + 0x68], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x14], 0
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], 0
mov eax, dword [ebp - 4]
mov dword [eax], 0x67452301
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], 0xefcdab89
mov edx, dword [ebp - 4]
mov dword [edx + 8], 0x98badcfe
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 0x10325476
mov esp, ebp
pop ebp
ret
Function at 0x411fe0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x479548
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x48d744]
xor eax, ebp
mov dword [ebp - 0x18], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x58], ecx
mov eax, dword [ebp - 0x58]
cmp dword [eax + 0x44], 0
je 0x412020
mov ecx, dword [ebp - 0x58]
movzx edx, byte [ecx + 0x49]
test edx, edx
jne 0x41202c
mov al, 1
jmp 0x4121cf
mov dword [ebp - 0x10], 8
call fcn.0040f290
push eax
mov eax, dword [ebp - 0x58]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x58]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x3c], eax
call fcn.0040f290
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x40]
push edx
call fcn.0040f270
add esp, 8
movzx eax, al
test eax, eax
je 0x41206f
xor al, al
jmp 0x4121cf
push 0
push 8
lea ecx, [ebp - 0x34]
call fcn.00411970
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x44]
push edx
lea ecx, [ebp - 0x34]
call fcn.004119f0
mov ecx, eax
call fcn.004121f0
mov esi, eax
lea ecx, [ebp - 0x34]
call fcn.00405810
add esi, eax
push esi
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x34]
call fcn.004119f0
mov ecx, eax
call fcn.004121f0
push eax
mov ecx, dword [ebp - 0x58]
add ecx, 0x4c
push ecx
mov edx, dword [ebp - 0x58]
mov ecx, dword [edx + 0x44]
call fcn.004123b0
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
je 0x4120ea
cmp dword [ebp - 0x5c], 1
je 0x4120f1
cmp dword [ebp - 0x5c], 3
je 0x41218b
jmp 0x4121a3
mov eax, dword [ebp - 0x58]
mov byte [eax + 0x49], 0
lea ecx, [ebp - 0x4c]
push ecx
lea ecx, [ebp - 0x34]
call fcn.004119f0
mov ecx, eax
call fcn.004121f0
mov edx, dword [ebp - 0x14]
sub edx, eax
mov dword [ebp - 0x38], edx
je 0x412154
mov eax, dword [ebp - 0x58]
mov ecx, dword [eax + 0x54]
push ecx
mov edx, dword [ebp - 0x38]
push edx
push 1
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x34]
call fcn.004119f0
mov ecx, eax
call fcn.004121f0
push eax
call fcn.0044bd1a
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x412154
mov byte [ebp - 0x51], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00406d50
mov al, byte [ebp - 0x51]
jmp 0x4121cf
mov ecx, dword [ebp - 0x58]
movzx edx, byte [ecx + 0x49]
test edx, edx
jne 0x412177
mov byte [ebp - 0x52], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00406d50
mov al, byte [ebp - 0x52]
jmp 0x4121cf
cmp dword [ebp - 0x38], 0
jne 0x412189
push 0
push 8
lea ecx, [ebp - 0x34]
call fcn.00411470
jmp 0x4121bb
mov byte [ebp - 0x53], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00406d50
mov al, byte [ebp - 0x53]
jmp 0x4121cf
mov byte [ebp - 0x54], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00406d50
mov al, byte [ebp - 0x54]
jmp 0x4121cf
jmp 0x412082
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0044ab62
mov esp, ebp
pop ebp
ret
Function at 0x414dd0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov byte [ebp - 6], 0
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x14], 0
je 0x414e57
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + 0x14], 0
je 0x414e57
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x14]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], 0x47fda3
mov ecx, dword [ebp - 0x18]
mov dl, byte [ecx]
mov byte [ebp - 0x19], dl
mov eax, dword [ebp - 0x14]
cmp dl, byte [eax]
jne 0x414e43
cmp byte [ebp - 0x19], 0
je 0x414e3a
mov ecx, dword [ebp - 0x18]
mov dl, byte [ecx + 1]
mov byte [ebp - 0x1a], dl
mov eax, dword [ebp - 0x14]
cmp dl, byte [eax + 1]
jne 0x414e43
add dword [ebp - 0x18], 2
add dword [ebp - 0x14], 2
cmp byte [ebp - 0x1a], 0
jne 0x414e06
mov dword [ebp - 0x20], 0
jmp 0x414e4b
sbb ecx, ecx
sbb ecx, 0xffffffff
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], 0
jne 0x414e72
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x1c], 0
je 0x414e70
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x1c]
mov dword [ebp - 4], edx
jmp 0x414eb4
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x1c], 0
je 0x414e86
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x1c]
mov dword [ebp - 4], edx
jmp 0x414eb4
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 4], eax
mov byte [ebp - 6], 1
mov eax, dword [ebp - 4]
cdq
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], edx
cmp dword [ebp - 0x2c], 0
jne 0x414eb4
cmp dword [ebp - 0x28], 0
jne 0x414eb4
xor eax, eax
jmp 0x414f2d
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0x20], 0x47fdad
jne 0x414ec4
xor eax, eax
jmp 0x414f2d
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x10]
push eax
push 0x414cb0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesA]
test eax, eax
setne dl
mov byte [ebp - 5], dl
movzx eax, byte [ebp - 5]
test eax, eax
jne 0x414f0b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x3b02
je 0x414f07
cmp dword [ebp - 0xc], 0
jne 0x414f0b
mov byte [ebp - 5], 1
cmp dword [ebp - 4], 0
jne 0x414f17
cmp dword [ebp - 4], 0
je 0x414f29
movzx ecx, byte [ebp - 6]
test ecx, ecx
je 0x414f29
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
movzx eax, byte [ebp - 5]
mov esp, ebp
pop ebp
ret
Function at 0x4177c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4788db
mov eax, dword fs:[0]
push eax
sub esp, 0x14c
mov eax, dword [0x48d744]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x158], ecx
movzx eax, byte [0x48fe38]
test eax, eax
je 0x417806
mov al, byte [0x48fe38]
jmp 0x4178a8
mov byte [ebp - 0x11c], 0
push 0x103
push 0
lea ecx, [ebp - 0x11b]
push ecx
call fcn.00453010
add esp, 0xc
push 1
push 0x1a
lea edx, [ebp - 0x11c]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x4178a3
push str.config_systemprofile
lea ecx, [ebp - 0x138]
call fcn.00406c40
mov dword [ebp - 4], 0
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x154]
call fcn.00406c40
push 0
lea ecx, [ebp - 0x138]
push ecx
lea ecx, [ebp - 0x154]
call fcn.0041b0f0
cmp eax, dword [0x4854f8]
je 0x417886
mov byte [0x48fe38], 1
lea ecx, [ebp - 0x154]
call fcn.00406d50
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x138]
call fcn.00406d50
mov al, byte [0x48fe38]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044ab62
mov esp, ebp
pop ebp
ret
Function at 0x417e10
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47838b
mov eax, dword fs:[0]
push eax
sub esp, 0x268
mov eax, dword [0x48d744]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x274], ecx
lea ecx, [ebp - 0x254]
call fcn.004169e0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x254]
call fcn.00416630
lea ecx, [ebp - 0x254]
call fcn.00402850
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0
jne 0x417ea3
mov dword [ebp - 0x264], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x254]
call fcn.00416a10
mov eax, dword [ebp - 0x264]
jmp 0x418023
mov dword [ebp - 0x258], 0
mov dword [ebp - 0x25c], 0
mov dword [ebp - 0x244], 0
push 0x228
push 0
lea ecx, [ebp - 0x240]
push ecx
call fcn.00453010
add esp, 0xc
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 0xffffffff
jne 0x417f17
mov dword [ebp - 0x268], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x254]
call fcn.00416a10
mov eax, dword [ebp - 0x268]
jmp 0x418023
mov dword [ebp - 0x244], 0x22c
lea edx, [ebp - 0x244]
push edx
mov eax, dword [ebp - 0x258]
push eax
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x417fe8
mov ecx, dword [ebp - 0x248]
push ecx
lea edx, [ebp - 0x220]
push edx
call fcn.0044c1e4
add esp, 8
test eax, eax
jne 0x417fc0
mov eax, dword [ebp - 0x23c]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x260], eax
mov ecx, dword [ebp + 8]
push ecx
push 0xf01ff
mov edx, dword [ebp - 0x260]
push edx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [ebp - 0x25c], eax
mov eax, dword [ebp - 0x258]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x25c]
mov dword [ebp - 0x26c], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x254]
call fcn.00416a10
mov eax, dword [ebp - 0x26c]
jmp 0x418023
lea edx, [ebp - 0x244]
push edx
mov eax, dword [ebp - 0x258]
push eax
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x417f3d
mov dword [ebp - 0x25c], 1
jmp 0x417ff2
mov dword [ebp - 0x25c], 0
mov ecx, dword [ebp - 0x258]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x25c]
mov dword [ebp - 0x270], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x254]
call fcn.00416a10
mov eax, dword [ebp - 0x270]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044ab62
mov esp, ebp
pop ebp
ret 8
Function at 0x4194c0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x479390
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x48d744]
xor eax, ebp
mov dword [ebp - 0x54], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x7c], ecx
lea ecx, [ebp - 0x4c]
call fcn.00409020
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x4c]
call fcn.00408030
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x4c]
call fcn.00408b70
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x20]
call fcn.004445d0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x50], 0
jmp 0x419533
mov edx, dword [ebp - 0x50]
add edx, 1
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x10]
jge 0x419593
mov ecx, dword [ebp - 0x50]
push ecx
lea ecx, [ebp - 0x20]
call fcn.0041b140
mov edx, dword [eax]
push edx
lea ecx, [ebp - 0x70]
call fcn.00406c40
lea ecx, [ebp - 0x70]
call fcn.00406d70
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0xffffffff
jne 0x419589
push 0
lea ecx, [ebp - 0x70]
call fcn.00406d70
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x419589
lea ecx, [ebp - 0x70]
call fcn.00406d50
jmp 0x419593
lea ecx, [ebp - 0x70]
call fcn.00406d50
jmp 0x41952a
mov byte [ebp - 0x75], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.00447b60
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.00409080
mov al, byte [ebp - 0x75]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x54]
xor ecx, ebp
call fcn.0044ab62
mov esp, ebp
pop ebp
ret 4

Function at 0x41a3d0
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41a430
push 0
push str.TrayNotifyWnd
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_FindWindowExW]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41a430
push 0
push str.TrayClockWClass
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_FindWindowExW]
jmp 0x41a432
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x41a440
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x487ae8
push 0x4546c0
mov eax, dword fs:[0]
push eax
add esp, 0xfffff920
mov eax, dword [0x48d744]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x6f0], ecx
mov dword [ebp - 0x46c], 2
mov dword [ebp - 0x468], 0
mov dword [ebp - 0x254], 0
mov dword [ebp - 0x464], 0
xor eax, eax
mov word [ebp - 0x678], ax
push 0x206
push 0
lea ecx, [ebp - 0x676]
push ecx
call fcn.00453010
add esp, 0xc
xor edx, edx
mov word [ebp - 0x460], dx
push 0x206
push 0
lea eax, [ebp - 0x45e]
push eax
call fcn.00453010
add esp, 0xc
mov dword [ebp - 0x250], 0
push 0x228
push 0
lea ecx, [ebp - 0x24c]
push ecx
call fcn.00453010
add esp, 0xc
mov dword [ebp - 4], 0
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x464], eax
cmp dword [ebp - 0x464], 0xffffffff
jne 0x41a533
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x46c], eax
jmp 0x41a687
mov dword [ebp - 0x250], 0x22c
lea edx, [ebp - 0x250]
push edx
mov eax, dword [ebp - 0x464]
push eax
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x41a566
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x46c], eax
jmp 0x41a687
mov ecx, dword [ebp + 8]
cmp ecx, dword [ebp - 0x248]
jne 0x41a66b
mov edx, dword [ebp - 0x248]
push edx
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0
je 0x41a61f
lea eax, [ebp - 0x67c]
push eax
push 2
mov ecx, dword [ebp - 0x254]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x41a601
mov dword [ebp - 0x680], 0
lea edx, [ebp - 0x680]
push edx
push 1
push 2
push 0
push 0xf01ff
mov eax, dword [ebp - 0x67c]
push eax
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x680]
mov dword [ecx], edx
mov dword [ebp - 0x46c], 0
mov eax, dword [ebp - 0x67c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x41a687
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6ec], eax
mov byte [ebp - 0x6e8], 0
push 0x63
push 0
lea edx, [ebp - 0x6e7]
push edx
call fcn.00453010
add esp, 0xc
mov eax, dword [ebp - 0x248]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x6ec]
push edx
push str.error:_d:_d:_d
lea eax, [ebp - 0x6e8]
push eax
call fcn.0044ab71
add esp, 0x14
lea ecx, [ebp - 0x250]
push ecx
mov edx, dword [ebp - 0x464]
push edx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x41a566
mov dword [ebp - 4], 0xfffffffe
call fcn.0041a695
jmp 0x41a6c2
mov eax, dword [ebp - 0x46c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0044ab62
mov esp, ebp
pop ebp
ret 8
Function at 0x41c680
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x108c
call fcn.0046d430
mov eax, dword [0x48d744]
xor eax, ebp
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x24], 0xc
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 1
push 0
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x41c6cb
xor eax, eax
jmp 0x41c7ee
mov dword [ebp - 0x70], 0x44
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 4]
mov dword [ebp - 0x34], edx
xor eax, eax
mov word [ebp - 0x40], ax
mov dword [ebp - 0x44], 0x101
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x70]
push edx
push 0
push 0
push 0
push 1
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x41c720
xor eax, eax
jmp 0x41c7ee
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x1078], 0
push 0xfff
push 0
lea edx, [ebp - 0x1077]
push edx
call fcn.00453010
add esp, 0xc
mov eax, 1
test eax, eax
je 0x41c7e9
lea ecx, [ebp - 0x1078]
mov dword [ebp - 0x1080], ecx
mov edx, dword [ebp - 0x1080]
add edx, 1
mov dword [ebp - 0x1084], edx
mov eax, dword [ebp - 0x1080]
mov cl, byte [eax]
mov byte [ebp - 0x1085], cl
add dword [ebp - 0x1080], 1
cmp byte [ebp - 0x1085], 0
jne 0x41c76f
mov edx, dword [ebp - 0x1080]
sub edx, dword [ebp - 0x1084]
mov dword [ebp - 0x108c], edx
mov eax, dword [ebp - 0x108c]
push eax
push 0
lea ecx, [ebp - 0x1078]
push ecx
call fcn.00453010
add esp, 0xc
push 0
lea edx, [ebp - 0x107c]
push edx
push 0xfff
lea eax, [ebp - 0x1078]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41c7dc
jmp 0x41c7e9
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x41c747
mov eax, 1
mov ecx, dword [ebp - 0x74]
xor ecx, ebp
call fcn.0044ab62
mov esp, ebp
pop ebp
ret
Function at 0x43bc90
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
cmp dword [ebp + 0xc], 0
jne 0x43bcb6
push 0x8d
push 0x4802c0
push 0x480084
call fcn.0044d77e
add esp, 0xc
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteTreeA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x43bcf8
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x43bcf1
mov eax, 1
jmp 0x43bcfa
mov eax, 1
jmp 0x43bcfa
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x43ca40
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x48d744]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x118], ecx
cmp dword [ebp + 8], 0
jne 0x43ca76
push 0x1de
push 0x480c68
push 0x48076c
call fcn.0044d77e
add esp, 0xc
cmp dword [ebp + 0xc], 0
jne 0x43ca88
mov ecx, dword [ebp - 0x118]
mov edx, dword [ecx + 4]
mov dword [ebp + 0xc], edx
mov dword [ebp - 0x114], 0x104
push 0x47fc62
mov ecx, dword [ebp + 8]
call fcn.00409190
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x110]
push ecx
mov edx, dword [ebp - 0x118]
mov eax, dword [edx + 0xc]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x43cafa
mov edx, dword [ebp - 0x118]
mov eax, dword [edx + 0xc]
add eax, 1
mov ecx, dword [ebp - 0x118]
mov dword [ecx + 0xc], eax
lea edx, [ebp - 0x110]
push edx
mov ecx, dword [ebp + 8]
call fcn.00409190
mov eax, 1
jmp 0x43cb09
mov eax, dword [ebp - 0x118]
mov dword [eax + 0xc], 0
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044ab62
mov esp, ebp
pop ebp
ret 0xc