joyce8/EMBER2024-capa huggingface dataset:
Function at 0x34f9e4
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1f8], 0
je 0x34fa00
cmp dword [esi + 4], 0
je 0x34fa2d
test byte [ebx + 0x55], 1
jne 0x34fa1f
mov eax, ebx
call fcn.0034e584
test eax, eax
jne 0x34fa1f
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x34fb3d
mov edx, esi
mov eax, ebx
call fcn.0034f508
jmp 0x34fb3d
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x34fb36
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00351854
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.0034c220
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.0034f9e4
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00351854
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x34fb3d
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x356254
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x3c0394]
cmp byte [eax + 0xc], 0
je 0x3563c1
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x3563ba
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x3c1ba4], 0
jne 0x3562a8
push 0x3563c8
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x3563d0
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x3c1ba4], eax
cmp dword [0x3bed80], 0
jne 0x3563a3
push 0x3563e0
call sub.kernel32.dll_LoadLibraryA
mov dword [0x3bed80], eax
cmp dword [0x3bed80], 0
je 0x3563a3
push 0x3563ec
mov eax, dword [0x3bed80]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x3c1ba8], eax
push 0x3563fc
mov eax, dword [0x3bed80]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x3c1bac], eax
push 0x356410
mov eax, dword [0x3bed80]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x3c1bb0], eax
push 0x356428
mov eax, dword [0x3bed80]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x3c1bb4], eax
push 0x356440
mov eax, dword [0x3bed80]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x3c1bb8], eax
push 0x356454
mov eax, dword [0x3bed80]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x3c1bbc], eax
push 0x35646c
mov eax, dword [0x3bed80]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x3c1bc0], eax
push 0x356484
mov eax, dword [0x3bed80]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x3c1bc4], eax
push 0x3564a0
mov eax, dword [0x3bed80]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x3c1bc8], eax
push 0x3564ac
mov eax, dword [0x3bed80]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x3c1bcc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3563c1
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x35a7b4
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00305304
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x35a803
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.00305574
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x362014
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x362064]
test si, 4
je 0x362028
or bl, 1
test si, 8
je 0x362032
or bl, 4
test si, 1
je 0x36203c
or bl, 8
test si, 2
je 0x362046
or bl, 0x10
test si, 0x10
je 0x362050
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x36205f
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x362068
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x3620a0]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x362081
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x362090
or bl, 4
test esi, 0x20000000
je 0x36209b
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x368764
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x368776
add esp, 0xfffffff0
call fcn.00304890
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0031f504
mov eax, dword [0x3bffd4]
mov dword [eax + 4], ebx
mov dword [eax], 0x368b08
mov eax, dword [0x3bffe0]
mov dword [eax + 4], ebx
mov dword [eax], 0x368b14
mov eax, ebx
call fcn.00368b20
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x316d28]
call fcn.00304528
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x316d28]
call fcn.00304528
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x316d28]
call fcn.00304528
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x316d28]
call fcn.00304528
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x316d28]
call fcn.00304528
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x364f38
push eax
push 0
push 0
mov eax, dword [0x3c014c]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x320fa8]
call fcn.00322740
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x320fa8]
call fcn.00322740
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x320fa8]
call fcn.00322740
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.00368f70
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x368e38
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x368e38
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x368e38
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x3688b3
call fcn.003048e8
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x368c1c
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x368dc7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x368da8
mov dl, 1
mov eax, dword [0x31738c]
call fcn.00304528
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00305304
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x368d97
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.003565b4
test al, al
je 0x368d8a
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x368dd8
lea eax, [ebp - 0x254]
call fcn.0030ab9c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x368d8a
xor eax, eax
push ebp
push 0x368d83
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x368e10
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x368d6c
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00305574
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x368d6c
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00305574
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x368d8a
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x368c8d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.0031b6f4
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x368dce
lea eax, [ebp - 0x260]
call fcn.00305304
ret

Function at 0x369710
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x3c1bf0]
cmp byte [eax + 0xa5], 0
jne 0x369781
cmp dword [0x3c1c08], 0
jne 0x369742
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x3696cc
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x3c1c08], eax
cmp dword [0x3c1c04], 0
jne 0x36975d
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x3c1c04], eax
cmp dword [0x3c1c0c], 0
jne 0x369781
push esp
push 0
push 0
push 0x369670
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x3c1c0c], eax
pop edx
ret
Function at 0x369e14
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x3c1bf0]
cmp dword [eax + 0x30], 0
je 0x369ebe
cmp dword [ebx + 0x94], 0
jne 0x369eb8
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x369da4
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x369eb8
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x369e7e
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x369eb8
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.003192d8
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x369e8d
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x36aa1c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x36aa51
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.003053f4
jmp 0x36aa5e
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00305358
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x36bc18
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x36bc59
mov eax, esi
call fcn.00351b58
test al, al
je 0x36bc59
mov eax, dword [ebx + 0x84]
call fcn.00351854
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x36bc59
push 0
mov eax, dword [ebx + 0x84]
call fcn.00351854
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x36f344
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x36f372
mov eax, ebx
call fcn.0036fdf8
cmp dword [ebx + 0x40], 0
je 0x36f36b
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x36f3e3
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x36f3d5
cmp dword [ebx + 8], 0
je 0x36f394
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x36f3a6
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x36f3d5
cmp dword [ebx + 8], 0
je 0x36f387
cmp eax, 3
je 0x36f3b9
dec eax
jne 0x36f387
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x36f387
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x36f387
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x36f401
cmp dword [ebx + 0x14], 0xcc
je 0x36f401
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0036f40c
pop ebx
ret
Function at 0x384918
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x384989
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [0x3bf8fc]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
cmp dword [ebp - 4], 0
je 0x384973
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.00384908
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x384714]
call fcn.003849b0
mov dword [0x3bf960], eax
mov eax, dword [ebp - 4]
call fcn.003848b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x384990
lea eax, [ebp - 8]
call fcn.00306f80
ret

Function at 0x384ec0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
lea eax, [ebp - 0x94]
mov edx, 0x94
call fcn.003850b8
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.kernel32.dll_GetVersionExA
mov eax, dword [ebp - 0x84]
cmp eax, 2
jne 0x384f41
mov eax, dword [ebp - 0x90]
cmp eax, 3
jne 0x384f15
cmp dword [ebp - 0x8c], 0x33
jb 0x384f15
mov eax, 2
jmp 0x384f5d
cmp eax, 4
jne 0x384f21
mov eax, 3
jmp 0x384f5d
cmp dword [ebp - 0x90], 5
jne 0x384f3a
cmp dword [ebp - 0x8c], 0
jne 0x384f3a
mov eax, 4
jmp 0x384f5d
mov eax, 5
jmp 0x384f5d
cmp eax, 1
jne 0x384f5a
cmp dword [ebp - 0x8c], 0
jne 0x384f53
xor eax, eax
jmp 0x384f5d
mov eax, 1
jmp 0x384f5d
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret

Function at 0x385b14
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
xor eax, eax
push ebp
push 0x385c12
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov byte [0x3bfa1c], 0
mov eax, 0x3c1c88
xor ecx, ecx
mov edx, 0x874
call fcn.003036ec
mov bl, 0x19
mov eax, 0x3c1d34
mov dword [eax], 0xffffffff
add eax, 0x50
dec bl
jne 0x385b50
mov bl, 2
mov esi, 0x3c1d2c
lea eax, [ebp - 0xc]
mov edx, ebx
add dl, 0x41
call fcn.003054ec
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
mov ecx, 0x385c2c
call fcn.00305610
lea eax, [ebp - 4]
call fcn.0030581c
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp al, 5
jne 0x385ba5
mov edx, esi
mov eax, ebx
call fcn.0038599c
cmp byte [esi + 4], 0
je 0x385ba5
inc byte [ebp - 5]
inc ebx
add esi, 0x50
cmp bl, 0x1b
jne 0x385b64
call fcn.00385af8
mov byte [0x3c1c88], al
cmp byte [0x3bfa1c], 0
je 0x385bf1
mov bl, 0x19
mov eax, 0x3c1d30
cmp byte [eax], 0
je 0x385be0
cmp byte [eax - 2], 0xfa
jne 0x385be0
mov byte [eax - 2], 0
mov dl, byte [0x3c1c88]
mov byte [eax - 4], dl
add eax, 0x50
dec bl
jne 0x385bc8
call fcn.00385af8
mov byte [0x3c1c88], al
mov bl, byte [ebp - 5]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x385c19
lea eax, [ebp - 0xc]
call fcn.00305304
lea eax, [ebp - 4]
call fcn.00305304
ret
Function at 0x38c35c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x38c3ce
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [esi + 1], 0
lea eax, [ebp - 0x6a]
push eax
push 0x69
call sub.kernel32.dll_GetLogicalDriveStringsA
lea ebx, [ebp - 0x6a]
xor edi, edi
jmp 0x38c3b6
push ebx
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 5
jne 0x38c3ad
imul eax, edi, 0xa1
mov dl, byte [ebx]
mov byte [esi + eax*8 + 0x507], dl
movzx edi, byte [esi + 1]
inc edi
inc byte [esi + 1]
push ebx
call sub.kernel32.dll_lstrlenA_1
add ebx, eax
inc ebx
cmp byte [ebx], 0
jne 0x38c38b
xor ebx, ebx
mov bl, byte [esi + 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x38c3d5
ret

Function at 0x393004
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe68
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x198], eax
mov dword [ebp - 0x190], eax
mov dword [ebp - 0x194], eax
mov dword [ebp - 0x18c], eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x3931d8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x15c330c]
mov eax, dword [eax + 0x7b4]
mov edx, dword [eax]
call dword [edx + 0xc8]
test eax, eax
jle 0x3931b2
lea edx, [ebp - 0x18c]
mov eax, dword [0x3c2e40]
call fcn.00392f78
lea eax, [ebp - 0x18c]
mov edx, 0x3931f0
call fcn.003055cc
mov edx, dword [ebp - 0x18c]
lea eax, [ebp - 0x15c]
call fcn.003032d0
mov edx, 1
lea eax, [ebp - 0x15c]
call fcn.00303a00
mov eax, dword [0x15c330c]
mov eax, dword [eax + 0x7b4]
mov edx, dword [eax]
call dword [edx + 0xc8]
dec eax
test eax, eax
jl 0x3931a7
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 8]
mov eax, dword [0x15c330c]
mov eax, dword [eax + 0x7b4]
mov eax, dword [eax + 0x218]
mov edx, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea eax, [ebp - 0x190]
push eax
lea edx, [ebp - 0x194]
mov eax, dword [ebp - 8]
call fcn.00392eec
mov eax, dword [ebp - 0x194]
mov ecx, 5
mov edx, 0xc
call fcn.00305824
mov eax, dword [ebp - 0x190]
mov edx, 0x393204
call fcn.00305710
je 0x39319b
mov eax, dword [ebp - 8]
call fcn.003055c4
mov ebx, eax
inc ebx
lea eax, [ebp - 0x198]
mov edx, ebx
call fcn.003054ec
mov edx, dword [ebp - 0x198]
lea eax, [ebp - 8]
mov ecx, dword [ebp - 8]
call fcn.00305610
mov esi, ebx
and esi, 0xff
mov edx, esi
lea eax, [ebp - 8]
call fcn.00305950
lea eax, [ebp - 8]
call fcn.0030581c
mov ecx, esi
lea edx, [ebp - 0x188]
call fcn.00302d8c
sub esi, 2
jl 0x393182
inc esi
lea eax, [ebp - 0x187]
mov dl, byte [eax]
xor dl, bl
xor dl, byte [ebp - 4]
mov byte [eax], dl
inc eax
dec esi
jne 0x393175
lea eax, [ebp - 0xc]
push eax
xor ecx, ecx
mov cl, bl
lea edx, [ebp - 0x188]
lea eax, [ebp - 0x15c]
call fcn.00303454
inc dword [ebp - 4]
dec dword [ebp - 0x10]
jne 0x3930bd
lea eax, [ebp - 0x15c]
call fcn.00303474
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3931df
lea eax, [ebp - 0x198]
mov edx, 4
call fcn.00305328
lea eax, [ebp - 8]
call fcn.00305304
ret
Function at 0x398738
Capabilities:
Hash data using crc32b

Disassembly:
push ebx
push esi
movzx ebx, word [0x3bfe74]
test ebx, ebx
jb 0x398781
inc ebx
xor esi, esi
mov ecx, 0x3c2e8c
mov eax, esi
shl eax, 0x18
and eax, 0xffffffff
mov edx, 8
test eax, 0x80000000
jne 0x398768
add eax, eax
and eax, 0xffffffff
jmp 0x398775
add eax, eax
and eax, 0xffffffff
xor eax, 0x4c11db7
and eax, 0xffffffff
dec edx
jne 0x39875a
mov dword [ecx], eax
inc esi
add ecx, 4
dec ebx
jne 0x39874d
pop esi
pop ebx
ret
Function at 0x3ad894
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.003057b4
xor eax, eax
push ebp
push 0x3ad944
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x3c0278]
mov byte [eax], 0
mov eax, dword [0x3c0278]
mov byte [eax], 2
mov edx, dword [ebp - 4]
mov al, 1
call fcn.003923b8
mov esi, eax
test esi, esi
jbe 0x3ad92e
mov edx, 0x20
mov eax, dword [ebp - 4]
call fcn.00309f28
mov edx, 2
mov eax, dword [ebp - 4]
call fcn.00309d64
mov ebx, eax
mov eax, dword [0x3bfea0]
xor edx, edx
push edx
push eax
mov eax, esi
xor edx, edx
call fcn.003062f8
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
push dword [ebp - 0xc]
push dword [ebp - 0x10]
xor edx, edx
mov eax, ebx
call fcn.00309e4c
test ebx, ebx
jns 0x3ad921
call fcn.00304494
push ebx
call sub.kernel32.dll_SetEndOfFile_1
mov eax, ebx
call fcn.00309e84
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3ad94b
lea eax, [ebp - 4]
call fcn.00305304
ret
Function at 0x4013a0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x415004]
xor eax, ebp
mov dword [ebp - 4], eax
push 1
call fcn.00401940
add esp, 4
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x10]
push ecx
push 0x40d1f0
push 0x65
call fcn.004018d0
add esp, 0x10
test eax, eax
jne 0x4013dc
xor eax, eax
jmp 0x401515
lea edx, [ebp - 0xc]
push edx
push 0xf023f
push 0
push 0x40d1f4
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40141a
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
push 3
push 0
push 0x40d208
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x401421
xor eax, eax
jmp 0x401515
lea eax, [ebp - 0xc]
push eax
push 0xf013f
push 0
push str.SOFTWARE
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40145f
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x10]
push edx
push 3
push 0
push str._cuqgufvlstager
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x401466
xor eax, eax
jmp 0x401515
push 0
call section..text
add esp, 4
mov dword [ebp - 0x18], eax
push 1
call section..text
add esp, 4
mov dword [ebp - 0x1c], eax
push 0x40d25c
call fcn.00401750
add esp, 4
call fcn.00401970
test eax, eax
je 0x40149f
mov dword [ebp - 0x14], str.C:WindowsSysWOW64WindowsPowerShell_v1.0
jmp 0x4014a6
mov dword [ebp - 0x14], 0x40d2f0
mov ecx, dword [ebp - 0x18]
push ecx
push 0x40d280
mov edx, dword [ebp - 0x14]
push edx
push 0x40d2f4
call fcn.00401550
add esp, 0x10
test eax, eax
je 0x4014d1
push str._cuqgufvlsfmefgqc
call fcn.004019c0
add esp, 4
call fcn.00401970
test eax, eax
je 0x401513
push 0x40d33c
call fcn.00401750
add esp, 4
mov eax, dword [ebp - 0x1c]
push eax
push str.powershell
push 0x40d378
push 0x40d37c
call fcn.00401550
add esp, 0x10
test eax, eax
je 0x401513
push str._cuqgufvlpuevcqdl
call fcn.004019c0
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401a9f
mov esp, ebp
pop ebp
ret 0x10