joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003ac80
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x1004ecbb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x130
push esi
mov esi, dword [esp + 0x144]
push esi
lea ecx, [esp + 8]
mov dword [esp + 0xc], 0
call fcn.10049029
mov eax, dword [esp + 0x148]
test eax, eax
jne 0x1003ad52
mov eax, dword [esp + 4]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x1003acea
lea ecx, [esp + 4]
mov dword [esp + 0x13c], 0xffffffff
call fcn.10048fff
xor eax, eax
jmp 0x1003ada2
push esi
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x1003ad05
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
jmp 0x1003ad56
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea edx, [esp + 0xc]
mov esi, eax
push edx
push esi
mov dword [esp + 0x14], pe_nt_image_headers32
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x1003ad56
mov ecx, dword [esp + 4]
lea eax, [esp + 0x30]
push eax
push ecx
call fcn.1003dfa4
add esp, 8
test eax, eax
je 0x1003ad4e
lea edx, [esp + 0xc]
push edx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x1003ad27
jmp 0x1003ad56
mov eax, dword [esp + 0x14]
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
test eax, eax
jne 0x1003ad76
lea ecx, [esp + 4]
mov dword [esp + 0x13c], 0xffffffff
call fcn.10048fff
xor eax, eax
jmp 0x1003ada2
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea ecx, [esp + 4]
mov esi, eax
mov dword [esp + 0x13c], 0xffffffff
call fcn.10048fff
mov eax, esi
mov ecx, dword [esp + 0x134]
pop esi
mov dword fs:[0], ecx
add esp, 0x13c
ret 8
Function at 0x1001293
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
cmp dword [0x1004370], 0
mov eax, dword [ebp + 8]
lea edx, [eax + 2]
je 0x10012ce
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x10012a8
push 0
sub eax, edx
lea ecx, [ebp - 4]
push ecx
sar eax, 1
push eax
push dword [ebp + 8]
push dword [0x100436c]
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
jmp 0x1001324
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x10012ce
sub eax, edx
sar eax, 1
push esi
lea eax, [eax + eax + 2]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x1001323
push esi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_CharToOemW]
mov eax, esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10012ff
push 0
sub eax, ecx
lea ecx, [ebp - 4]
push ecx
push eax
push esi
push dword [0x100436c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop esi
leave
ret 4

Function at 0x1001437
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
xor esi, esi
mov dword [ebp - 0x18], esi
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push esi
stosd dword es:[edi], eax
push 0x14
lea eax, [ebp - 0x18]
push eax
push 0x5a
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
jl 0x1001473
cmp dword [ebp - 8], 2
jne 0x1001473
inc esi
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.01002561
leave
ret

Function at 0x100150c
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
push 7
call fcn.0100132d
mov esi, dword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
pop ecx
pop ecx
lea eax, [ebp - 4]
push eax
xor ebx, ebx
push ebx
push ebx
push dword [ebp + 8]
call esi
test eax, eax
jne 0x1001554
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 0xea
je 0x1001554
call edi
push eax
call fcn.01001391
jmp 0x10015d8
mov eax, dword [ebp - 4]
add eax, eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
cmp edi, ebx
jne 0x100156b
push 8
jmp 0x100154a
push ebx
push dword [ebp - 4]
push edi
push dword [ebp + 8]
call esi
test eax, eax
jne 0x1001588
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1001549
cmp word [edi], bx
jne 0x10015ae
push dword [ebp + 8]
call fcn.01001488
test eax, eax
je 0x100159d
push 0xc
jmp 0x100159f
push 9
call fcn.0100132d
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x10015d8
mov esi, edi
push esi
push 6
call fcn.0100132d
pop ecx
pop ecx
mov ax, word [esi]
inc esi
inc esi
test ax, ax
jne 0x10015ba
cmp word [esi], bx
jne 0x10015b0
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 8
call fcn.0100132d
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x10016d6
Capabilities:
Delete directory
Enumerate disk volumes
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1054
call fcn.01002580
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0xffffffffffffffff
push 0x80
push 3
xor ebx, ebx
push ebx
push 3
push 0xc0000000
push 0x1001140
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x100171a
xor eax, eax
jmp 0x1001769
push ebx
lea eax, [ebp - 0x1054]
push eax
push ebx
push ebx
push ebx
push ebx
push 0x6dc038
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push esi
mov dword [ebp - 0x1048], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x1048], ebx
je 0x1001716
push edi
mov edi, 0x104
push edi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov dword [ebp - 0x1050], eax
cmp eax, 0xffffffff
jne 0x1001779
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.01002561
leave
ret
xor ebx, ebx
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x1001782
sub eax, edx
sar eax, 1
mov ebx, eax
lea esi, [ebx + ebx]
push esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xe3c]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
push 0x208
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointW]
mov dword [ebp - 0x104c], eax
cmp eax, 0xffffffff
je 0x10018a8
cmp dword [ebp - 0x1048], 0
je 0x100189c
lea eax, [ebp + esi - 0xe3c]
mov dword [ebp - 0x1048], eax
lea eax, [ebp - 0x824]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x10017f7
sub eax, edx
sar eax, 1
mov esi, eax
lea eax, [esi + esi]
push eax
lea eax, [ebp - 0x824]
push eax
push dword [ebp - 0x1048]
call sub.msvcrt.dll_memcpy
xor eax, eax
add esp, 0xc
add esi, ebx
mov word [ebp + esi*2 - 0xe3c], ax
mov esi, dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
push edi
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0xe3c]
push eax
call esi
test eax, eax
je 0x10018cf
push edi
lea eax, [ebp - 0x1044]
push eax
lea eax, [ebp - 0x414]
push eax
call esi
test eax, eax
jne 0x100187c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
jne 0x10018cf
lea eax, [ebp - 0xe3c]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x10018cf
push 0x208
lea eax, [ebp - 0x824]
push eax
push dword [ebp - 0x104c]
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
test eax, eax
jne 0x10017ee
push dword [ebp - 0x104c]
call dword [sym.imp.KERNEL32.dll_FindVolumeMountPointClose]
push edi
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x1050]
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
mov dword [ebp - 0x1048], eax
test eax, eax
jne 0x1001777
xor esi, esi
inc esi
jmp 0x10018dd
push dword [ebp - 0x104c]
call dword [sym.imp.KERNEL32.dll_FindVolumeMountPointClose]
xor esi, esi
push dword [ebp - 0x1050]
call dword [sym.imp.KERNEL32.dll_FindVolumeClose]
mov eax, esi
jmp 0x1001768
Function at 0x10018f5
Capabilities:
Get disk information
Unmount volume via ioctl

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push esi
xor esi, esi
mov dword [ebp - 0x218], eax
mov dword [eax], esi
push 0x104
lea eax, [ebp - 0x20c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
je 0x1001ac5
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
lea eax, [ebp - 0x214]
push eax
push esi
push esi
lea eax, [ebp - 0x20c]
push eax
call ebx
test eax, eax
jne 0x1001967
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
je 0x1001967
xor eax, eax
jmp 0x1001ac4
mov eax, dword [ebp - 0x214]
push edi
add eax, eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
cmp edi, esi
je 0x1001ac1
push esi
push dword [ebp - 0x214]
lea eax, [ebp - 0x20c]
push edi
push eax
call ebx
test eax, eax
jne 0x10019a3
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1001ac1
cmp word [edi], si
jne 0x10019b5
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1001ac1
mov eax, edi
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x10019b7
push edi
cmp word [eax], si
je 0x10019e8
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x218]
push 0x57
mov dword [eax], 1
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0xe
jmp 0x1001a7a
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x10019f7
push 0xffffffffffffffff
push 0x80
sub eax, edx
push 3
sar eax, 1
xor ecx, ecx
push esi
mov word [ebp + eax*2 - 0x20e], cx
dec eax
push 3
mov dword [ebp - 0x214], eax
push 0xc0000000
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x1001ac1
mov edi, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push esi
lea eax, [ebp - 0x210]
push eax
push esi
push esi
push esi
push esi
push 0x560004
push ebx
call edi
test eax, eax
jne 0x1001a82
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x218]
push 0x57
mov dword [eax], 1
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0xf
call fcn.0100132d
pop ecx
jmp 0x1001ac1
push esi
lea eax, [ebp - 0x210]
push eax
push esi
push esi
push esi
push esi
push 0x90018
push ebx
call edi
test eax, eax
jne 0x1001aa2
push 0xb
call fcn.0100132d
pop ecx
push esi
lea eax, [ebp - 0x210]
push eax
push esi
push esi
push esi
push esi
push 0x90020
push ebx
call edi
test eax, eax
jne 0x1001ad4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.01002561
leave
ret 8
push esi
lea eax, [ebp - 0x210]
push eax
push esi
push esi
push esi
push esi
push 0x56c00c
push ebx
call edi
test eax, eax
jne 0x1001af7
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x1001ac3
xor esi, esi
inc esi
jmp 0x1001aec
Function at 0x1002552
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x1002a18
call fcn.01002744
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x1004380
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x1002367
cmp eax, esi
jne 0x100235a
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x100236a
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1002341
xor esi, esi
inc esi
mov eax, dword [0x100437c]
cmp eax, esi
jne 0x100237d
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x10023b8
mov eax, dword [0x100437c]
test eax, eax
jne 0x10023b2
mov dword [0x100437c], esi
push 0x1001118
push 0x100110c
call fcn.010022be
pop ecx
pop ecx
test eax, eax
je 0x10023b8
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x1002482
mov dword [0x100403c], esi
mov eax, dword [0x100437c]
cmp eax, esi
jne 0x10023dc
push 0x1001108
push 0x1001100
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x100437c], 2
cmp dword [ebp - 0x1c], ebx
jne 0x10023e9
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1004384], ebx
je 0x100240a
push 0x1004384
call fcn.010026b9
pop ecx
test eax, eax
je 0x100240a
push ebx
push 2
push ebx
call dword [0x1004384]
push dword [0x1004024]
push dword [0x1004028]
push dword [0x1004020]
call fcn.01001e99
add esp, 0xc
mov dword [0x1004038], eax
cmp dword [0x100402c], ebx
jne 0x1002468
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x100403c], ebx
jne 0x1002476
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1004038]
call fcn.01002789
ret
call fcn.01002891
jmp 0x100231f
Function at 0x10014f7
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x1001540
push esi
lea ecx, [eax + 8]
call dword [sym.imp.ulib.dll_public:_class_WSTRING____thiscall_PATH::QueryFullPathString_void_const]
mov esi, eax
cmp esi, ebx
je 0x100153f
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x1001537
cmp word [eax], bx
je 0x1001537
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1001537
test eax, 0x1000
je 0x1001537
mov bl, 1
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
pop esi
mov al, bl
pop ebx
pop ebp
ret 4

Function at 0x100356b
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x1003a78
call fcn.01003590
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x1005380
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x1003380
cmp eax, esi
jne 0x1003373
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x1003383
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100335a
xor esi, esi
inc esi
mov eax, dword [0x100537c]
cmp eax, esi
jne 0x1003396
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x10033d1
mov eax, dword [0x100537c]
test eax, eax
jne 0x10033cb
mov dword [0x100537c], esi
push 0x10011f4
push 0x10011e8
call fcn.010032d7
pop ecx
pop ecx
test eax, eax
je 0x10033d1
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x100349b
mov dword [0x1005044], esi
mov eax, dword [0x100537c]
cmp eax, esi
jne 0x10033f5
push 0x10011e4
push 0x10011dc
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x100537c], 2
cmp dword [ebp - 0x1c], ebx
jne 0x1003402
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1005384], ebx
je 0x1003423
push 0x1005384
call fcn.01003709
pop ecx
test eax, eax
je 0x1003423
push ebx
push 2
push ebx
call dword [0x1005384]
push dword [0x100502c]
push dword [0x1005030]
push dword [0x1005028]
call fcn.0100311f
add esp, 0xc
mov dword [0x1005040], eax
cmp dword [0x1005034], ebx
jne 0x1003481
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x1005044], ebx
jne 0x100348f
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1005040]
call fcn.010035d5
ret
call fcn.01003856
jmp 0x1003338
Function at 0x40279c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x40b02c], 0x8088405
inc edx
mov dword [0x40b02c], edx
mul edx
mov eax, edx
ret

Function at 0x4051d8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405211
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403278
jmp 0x40521a
mov eax, ebx
mov edx, esi
call fcn.0040322c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x405224
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405245
mov al, byte [esp]
jmp 0x405247
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40683c
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x406884
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.004067d8
mov eax, dword [ebp - 4]
call fcn.004034b8
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40688b
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x406b34
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
mov eax, esp
call fcn.00404dac
add esp, 0x104
pop ebx
ret
Function at 0x406c7c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x406d9d
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 8]
push eax
push 0
push edi
push esi
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x406d87
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
je 0x406cd5
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x406d87
cmp dword [ebp - 0xc], 0
jne 0x406cea
mov eax, dword [ebp - 4]
call fcn.00403198
mov bl, 1
jmp 0x406d87
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
xor edx, edx
call fcn.00403278
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
call fcn.004034c4
push eax
lea eax, [ebp - 8]
push eax
push 0
push edi
push esi
call sub.advapi32.dll_RegQueryValueExA
cmp eax, 0xea
je 0x406ca1
test eax, eax
jne 0x406d87
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
je 0x406d31
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x406d87
jmp 0x406d31
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0
je 0x406d44
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
cmp byte [eax + edx - 1], 0
je 0x406d2e
cmp dword [ebp - 8], 7
jne 0x406d53
cmp dword [ebp - 0xc], 0
je 0x406d53
inc dword [ebp - 0xc]
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.00403594
cmp dword [ebp - 8], 7
jne 0x406d7a
cmp dword [ebp - 0xc], 0
je 0x406d7a
lea eax, [ebp - 0x10]
call fcn.004034c4
mov edx, dword [ebp - 0xc]
mov byte [eax + edx - 1], 0
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
call fcn.004031e8
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406da4
lea eax, [ebp - 0x10]
call fcn.00403198
ret

Function at 0x407648
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x40b55c
mov eax, esi
mov edx, 8
test al, 1
je 0x407664
shr eax, 1
xor eax, 0xedb88320
jmp 0x407666
shr eax, 1
dec edx
jne 0x407657
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x407650
pop esi
ret

Function at 0x40767c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x40b558], 0
jne 0x40769f
call fcn.00407648
push 1
push 0x40b558
call sub.kernel32.dll_InterlockedExchange
mov eax, edi
test esi, esi
je 0x4076ca
mov edx, ebx
and dx, 0xff
xor ecx, ecx
mov cl, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x40b55c]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x4076a5
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x408c60
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00408c14
test al, al
jne 0x408c81
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x408ccd
xor eax, eax
push ebp
push 0x408cbd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004034b8
push eax
call sub.kernel32.dll_DeleteFileA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408cc4
lea eax, [ebp - 0xc]
call fcn.00408c50
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x408fd4
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x4090c3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.00406b60
mov edx, dword [ebp - 8]
mov ecx, 0x4090dc
xor eax, eax
call fcn.00408ec8
push 0
mov eax, dword [ebp - 4]
call fcn.004034b8
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x409091
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 0xb7
je 0x408ff4
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x18]
mov edx, dword [ebp - 4]
mov al, 0x2f
call fcn.00408a80
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.00404c60
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.004070d8
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x14]
mov ecx, 2
mov al, 0x60
call fcn.00408a50
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, 0x40462c
call fcn.0040585c
call fcn.00402eb4
jmp 0x408ff4
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.0040322c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4090ca
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.004031b8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004031b8
ret

Function at 0x40910c
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffffec
cmp dword [0x40a07c], 2
jne 0x409179
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x409131
call fcn.004090ec
jmp 0x40918b
lea eax, [esp + 8]
push eax
push 0x409190
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [esp + 4], 1
mov dword [esp + 0x10], 2
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError_1
test eax, eax
je 0x409179
call fcn.004090ec
jmp 0x40918b
push 0
push 2
call sub.user32.dll_ExitWindowsEx
test eax, eax
jne 0x40918b
call fcn.004090ec
add esp, 0x14
ret