joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4042e4
Capabilities:
Get disk size

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffff44
mov edi, edx
mov esi, eax
xor ebx, ebx
mov dword [esp + 0x20], 0x94
lea eax, [esp + 0x20]
push eax
call sub.kernel32.dll_GetVersionExA
xor eax, eax
mov edx, dword [esp + 0x30]
cmp edx, 2
jne 0x40431a
cmp dword [esp + 0x24], 4
setae al
jmp 0x404348
cmp edx, 1
jne 0x404348
mov edx, dword [esp + 0x24]
cmp edx, 4
seta al
test al, al
jne 0x404348
cmp edx, 4
jne 0x404348
cmp dword [esp + 0x28], 0
seta al
test al, al
jne 0x404348
cmp word [esp + 0x2c], 0x1111
setae al
test al, al
je 0x404365
push 0x4043d4
call sub.kernel32.dll_GetModuleHandleA_1
mov ebx, eax
push 0x4043e0
push ebx
call sub.kernel32.dll_GetProcAddress
mov ebx, eax
test ebx, ebx
je 0x404380
push edi
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
mov eax, esi
call fcn.00401e98
push eax
call ebx
jmp 0x4043c8
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
mov eax, esi
call fcn.00401e98
push eax
call sub.kernel32.dll_GetDiskFreeSpaceA
lea ecx, [esp + 0xb4]
mov eax, dword [esp]
imul dword [esp + 4]
xor edx, edx
call fcn.004036c0
lea eax, [esp + 0xb4]
mov ecx, edi
mov edx, dword [esp + 8]
call fcn.00408e98
add esp, 0xbc
pop edi
pop esi
pop ebx
ret

Function at 0x404960
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
add esp, 0xfffffff4
mov esi, edx
mov ebx, eax
mov dword [esp + 8], 4
xor eax, eax
mov dword [esp], eax
test ebx, ebx
je 0x4049a4
lea eax, [esp + 8]
push eax
lea eax, [esp + 4]
push eax
lea eax, [esp + 0xc]
push eax
push 0
mov eax, esi
call fcn.00401e98
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x4049a4
cmp dword [esp + 4], 4
je 0x4049a9
xor eax, eax
mov dword [esp], eax
mov eax, dword [esp]
add esp, 0xc
pop esi
pop ebx
ret

Function at 0x4049b4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
add eax, 0xfffffff8
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x14]
push eax
mov eax, dword [ebp + 8]
add eax, 0xfffffffc
push eax
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x10]
call fcn.00401e98
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
sete al
pop ebp
ret
Function at 0x4049f0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
mov eax, ebx
call fcn.00401a48
cmp dword [ebp - 0xc], 0
je 0x404a96
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0x14], eax
push ebp
call fcn.004049b4
pop ecx
test al, al
je 0x404a96
cmp dword [ebp - 4], 1
je 0x404a33
cmp dword [ebp - 4], 2
jne 0x404a96
mov eax, dword [ebp - 8]
call fcn.0040114c
mov dword [ebp - 0x14], eax
push ebp
call fcn.004049b4
pop ecx
test al, al
je 0x404a8e
cmp dword [ebp - 4], 2
jne 0x404a84
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
mov edi, eax
mov eax, edi
call fcn.0040114c
mov esi, eax
push edi
push esi
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
mov eax, ebx
mov edx, esi
call fcn.00401c1c
mov eax, esi
call fcn.00401164
jmp 0x404a8e
mov eax, ebx
mov edx, dword [ebp - 0x14]
call fcn.00401c1c
mov eax, dword [ebp - 0x14]
call fcn.00401164
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x404b24
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov esi, edx
mov ebx, eax
test ebx, ebx
je 0x404b51
lea eax, [esp + 4]
push eax
push 0
lea eax, [esp + 8]
push eax
push 0
mov eax, esi
call fcn.00401e98
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x404b55
xor eax, eax
jmp 0x404b57
mov al, 1
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x404b94
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x404c54
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp - 4]
call fcn.0040b474
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0
push edi
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
jne 0x404c3e
cmp dword [ebp - 8], 0
jbe 0x404c3c
mov eax, dword [ebp - 8]
inc eax
call fcn.0040114c
mov ebx, eax
xor esi, esi
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 0xc], eax
jmp 0x404c1a
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00401c1c
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0040b464
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 0xc], eax
inc esi
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
push ebx
push esi
push edi
call sub.advapi32.dll_RegEnumKeyExA
cmp eax, 0x103
jne 0x404bfd
mov eax, ebx
call fcn.00401164
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404c5b
lea eax, [ebp - 0x10]
call fcn.00401a48
ret
Function at 0x405490
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffffc
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov edi, dword [ebp + 8]
cmp byte [ebx + 0x18], 0
jne 0x40550c
mov byte [ebp - 0x1004], 0
mov eax, dword [ebx + 0x19]
call fcn.00401e98
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
mov eax, esi
call fcn.00401e98
push eax
mov eax, dword [ebp - 4]
call fcn.00401e98
push eax
mov eax, dword [ebx + 0x1d]
call fcn.00401e98
push eax
call sub.kernel32.dll_GetPrivateProfileStringA
test eax, eax
je 0x405503
mov eax, edi
lea edx, [ebp - 0x1004]
mov ecx, 0x1000
call fcn.00401c88
jmp 0x40553d
mov eax, edi
call fcn.00401a48
jmp 0x40553d
mov eax, edi
mov edx, esi
call fcn.00401a9c
mov eax, dword [ebx + 0x19]
call fcn.00401e98
push eax
mov eax, esi
call fcn.00401e98
push eax
mov eax, dword [ebp - 4]
call fcn.00401e98
push eax
mov eax, dword [ebx + 0x1d]
call fcn.00401e98
push eax
call sub.kernel32.dll_WritePrivateProfileStringA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x409254
Capabilities:
Get file attributes

Disassembly:
call fcn.004031c8
push eax
call sub.kernel32.dll_GetFileAttributesA
inc eax
je 0x409268
dec eax
and al, 0x10
sete al
ret

Function at 0x4092d8
Capabilities:
Get file attributes

Disassembly:
push ebx
push eax
push 0x8001
call sub.kernel32.dll_SetErrorMode
xchg ebx, eax
call sub.kernel32.dll_GetFileAttributesA
inc eax
je 0x4092f3
dec eax
and al, 0x10
setne al
xchg ebx, eax
push eax
call sub.kernel32.dll_SetErrorMode
xchg ebx, eax
pop ebx
ret

Function at 0x40a838
Capabilities:
Hide graphical window

Disassembly:
and byte [eax + 0x37], 0xef
test dl, dl
je 0x40a844
or byte [eax + 0x37], 0x10
mov byte [eax + 0x52], dl
mov ecx, dword [eax + 0x28]
jecxz 0x40a860
push eax
je 0x40a861
call dword [0x418110]
pop eax
push 5
push dword [eax + 0x28]
call sub.user32.dll_ShowWindow
ret
mov byte [eax + 0x177], dl
push 0
push ecx
call sub.user32.dll_ShowWindow
pop eax
call dword [0x418110]
ret

Function at 0x40bd28
Capabilities:
Capture screenshot

Disassembly:
push ebx
mov ebx, eax
call fcn.0040bc24
je 0x40bd5a
mov eax, ebx
push edx
call fcn.00407904
pop edx
cmp eax, edx
je 0x40bd5a
test edx, edx
mov eax, ebx
jne 0x40bd4c
pop ebx
inc edx
jmp fcn.004078f4
mov byte [ebx + 0x49], dl
xor edx, edx
call fcn.004078f4
xchg ebx, eax
cmp eax, 0
pop ebx
jne fcn.0040bd78
ret
Function at 0x40cbd8
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov word [ebp - 2], cx
mov edi, edx
mov esi, eax
push 0
push 0x8000080
push 3
push 0
push 1
push 0xc0000000
push esi
call sub.kernel32.dll_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40cc0c
xor eax, eax
jmp 0x40cc5d
lea eax, [ebp - 0xc]
push eax
mov ax, word [ebp - 2]
push eax
push edi
call sub.kernel32.dll_DosDateTimeToFileTime
test eax, eax
je 0x40cc40
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
call sub.kernel32.dll_LocalFileTimeToFileTime
test eax, eax
je 0x40cc40
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push ebx
call sub.kernel32.dll_SetFileTime
push ebx
call sub.kernel32.dll_CloseHandle
mov ax, word [ebp + 8]
and ax, 0x27
movzx eax, ax
push eax
push esi
call sub.kernel32.dll_SetFileAttributesA
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40df04
Capabilities:
Identify system language via api

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], eax
mov edx, dword [0x4186c0]
mov edx, dword [edx]
mov eax, dword [esp]
mov eax, dword [eax + 0x18]
call fcn.0040a7dc
mov ebp, 0xff
mov eax, 0x1a
call fcn.00415568
mov esi, eax
dec esi
test esi, esi
jl 0x40df76
inc esi
xor ebx, ebx
mov edi, ebx
shl edi, 2
mov eax, dword [0x418658]
mov eax, dword [eax]
mov edx, dword [eax + edi*4]
mov eax, dword [esp]
mov eax, dword [eax + 0x24]
call fcn.0040b0cc
mov eax, dword [0x418658]
mov eax, dword [eax]
mov eax, dword [eax + edi*4 + 4]
call fcn.00409018
push eax
call sub.kernel32.dll_GetUserDefaultLangID
movzx eax, ax
pop edx
cmp edx, eax
jne 0x40df72
mov ebp, ebx
inc ebx
dec esi
jne 0x40df38
cmp ebp, 0xff
jne 0x40dfb6
mov eax, 0x1a
call fcn.00415568
mov esi, eax
dec esi
test esi, esi
jl 0x40dfb6
inc esi
xor ebx, ebx
mov eax, ebx
shl eax, 2
mov edx, dword [0x418658]
mov edx, dword [edx]
mov eax, dword [edx + eax*4]
mov edx, 0x40dfdc
call fcn.00401de4
jne 0x40dfb2
mov ebp, ebx
jmp 0x40dfb6
inc ebx
dec esi
jne 0x40df92
cmp ebp, 0xff
jne 0x40dfc0
xor ebp, ebp
mov eax, dword [esp]
mov eax, dword [eax + 0x24]
mov edx, ebp
call fcn.0040b370
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x410270
Capabilities:
Get hostname
Get session user name

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, edx
mov dword [esp], pe_nt_image_headers32
test al, al
je 0x410291
push esp
lea eax, [esp + 8]
push eax
call sub.advapi32.dll_GetUserNameA
jmp 0x41029c
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
mov eax, ebx
lea edx, [esp + 4]
mov ecx, pe_nt_image_headers32
call fcn.00401c88
add esp, 0x104
pop ebx
ret

Function at 0x4102b4
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffc10
mov ebx, edx
push esp
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov eax, dword [esp]
push eax
call sub.ole32.dll_CoTaskMemFree
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x3e9
call fcn.00401c88
add esp, 0x3f0
pop ebx
ret
Function at 0x411b7c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x48], edx
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x411d1d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x41866c]
mov eax, dword [eax]
mov edx, dword [eax + 0xe4]
mov eax, dword [0x4197c0]
mov eax, dword [eax + 0x5c]
call fcn.0040a7dc
mov eax, dword [0x4186ac]
mov eax, dword [eax]
call fcn.0040ad44
mov eax, 0x28
call fcn.00415568
mov edi, eax
dec edi
test edi, edi
jl 0x411cfa
inc edi
xor ebx, ebx
mov esi, ebx
add esi, esi
lea esi, [esi + esi*2]
mov eax, dword [0x418668]
mov eax, dword [eax]
mov eax, dword [eax + esi*4 + 0x10]
call fcn.00409018
xor edx, edx
mov dl, byte [ebp - 1]
cmp eax, edx
jne 0x411cf2
mov eax, dword [0x418668]
mov eax, dword [eax]
mov eax, dword [eax + esi*4 + 4]
lea ecx, [ebp - 8]
xor edx, edx
call fcn.00410828
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x3c
call fcn.00401330
mov dword [ebp - 0x44], 0x3c
xor eax, eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 8]
call fcn.00401e98
mov dword [ebp - 0x34], eax
lea edx, [ebp - 0x48]
mov eax, dword [ebp - 8]
call fcn.00404024
mov eax, dword [ebp - 0x48]
call fcn.00401e98
mov dword [ebp - 0x2c], eax
mov eax, dword [0x418668]
mov eax, dword [eax]
mov eax, dword [eax + esi*4 + 8]
lea ecx, [ebp - 0x4c]
xor edx, edx
call fcn.00410828
mov eax, dword [ebp - 0x4c]
call fcn.00401e98
mov dword [ebp - 0x30], eax
mov eax, dword [0x418668]
mov eax, dword [eax]
mov eax, dword [eax + esi*4 + 0xc]
call fcn.00409018
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x40], 0x400
mov eax, dword [0x418668]
mov eax, dword [eax]
mov eax, dword [eax + esi*4 + 0x14]
call fcn.00409018
dec eax
jne 0x411caf
mov eax, dword [ebp - 0x40]
or eax, 0x40
or eax, 0x200
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x44]
push eax
call sub.shell32.dll_ShellExecuteExA
jmp 0x411cc6
mov eax, dword [0x4186ac]
mov eax, dword [eax]
call fcn.0040ad44
push 0x32
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x411cba
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle
push 0
push 0x2800
mov eax, dword [0x4197c0]
call fcn.004109f0
inc ebx
dec edi
jne 0x411bdf
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x411d24
lea eax, [ebp - 0x4c]
mov edx, 2
call fcn.00401a6c
lea eax, [ebp - 8]
call fcn.00401a48
ret
Function at 0x4121f4
Capabilities:
Delete file

Disassembly:
push ebx
add esp, 0xfffffff0
mov ebx, eax
cmp dword [0x4197e0], 0
jle 0x412213
mov eax, dword [0x4197ec]
call fcn.00401e98
push eax
call sub.kernel32.dll_DeleteFileA
mov eax, ebx
call fcn.004094a4
mov dword [esp], eax
mov eax, dword [esp]
mov edx, 0x4122c8
call fcn.00405264
mov eax, 0x75
call fcn.00415568
cmp eax, dword [0x4197e0]
jne 0x412251
mov eax, 0x76
call fcn.00415568
cdq
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
jmp 0x412264
mov eax, 0x5f
call fcn.00415568
cdq
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
cmp dword [0x4197e8], 1
jne 0x412293
mov eax, 0x5f
call fcn.00415568
mov edx, eax
imul edx, dword [0x4197e0]
mov eax, dword [0x418698]
add edx, dword [eax]
mov eax, dword [0x4197e4]
xor ecx, ecx
call fcn.00409380
push dword [esp + 0xc]
push dword [esp + 0xc]
mov eax, dword [esp + 8]
call fcn.00411ff0
mov eax, dword [esp]
call fcn.0040867c
mov eax, 0x4197ec
mov edx, ebx
call fcn.00401a9c
add esp, 0x10
pop ebx
ret
Function at 0x412530
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov esi, edx
lea edi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc], ecx
mov esi, eax
xor eax, eax
push ebp
push 0x4126ee
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x1d], 1
lea eax, [esi + esi*2]
mov edx, dword [0x4186c8]
mov edx, dword [edx]
mov eax, dword [edx + eax*4]
lea ecx, [ebp - 0x24]
xor edx, edx
call fcn.00410828
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
call fcn.00401a9c
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00401e98
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x412685
test bl, 0x10
jne 0x412685
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00401e98
push eax
call sub.kernel32.dll_CreateFileA
mov edi, eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push edi
call sub.kernel32.dll_GetFileTime
push edi
call sub.kernel32.dll_CloseHandle
lea eax, [esi + esi*2]
mov edx, dword [0x4186c8]
mov edx, dword [edx]
mov eax, dword [edx + eax*4 + 4]
call fcn.00409018
cmp eax, 4
ja case.default.0x4125f7
jmp dword [eax*4 + 0x4125fe]
push ebp
call fcn.00412330
pop ecx
jmp case.default.0x4125f7
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x1c]
call fcn.00403f5c
dec eax
jne 0x412632
push ebp
call fcn.00412330
pop ecx
jmp case.default.0x4125f7
mov byte [ebp - 0x1d], 0
jmp case.default.0x4125f7
mov byte [ebp - 0x1d], 1
jmp case.default.0x4125f7
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x1c]
call fcn.00403f5c
dec eax
sete byte [ebp - 0x1d]
jmp case.default.0x4125f7
mov byte [ebp - 0x1d], 0
cmp byte [ebp - 0x1d], 0
je 0x41269a
test bl, 1
je 0x412673
and ebx, 0xfffffffe
push ebx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00401e98
push eax
call sub.kernel32.dll_SetFileAttributesA
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00401e98
push eax
call sub.kernel32.dll_DeleteFileA
jmp 0x41269a
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00404024
mov eax, dword [ebp - 0x28]
call fcn.004040a0
cmp byte [ebp - 0x1d], 0
jne 0x4126aa
mov eax, dword [ebp - 0xc]
call fcn.00401a48
jmp 0x4126d0
lea eax, [esi + esi*2]
mov edx, dword [0x4186c8]
mov edx, dword [edx]
mov eax, dword [edx + eax*4 + 8]
call fcn.00409018
dec eax
jne 0x4126d0
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
mov eax, dword [0x4197f0]
call fcn.0040b464
mov bl, byte [ebp - 0x1d]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4126f5
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00401a6c
ret
Function at 0x41563c
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x415715
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
lea ecx, [ebp - 4]
xor edx, edx
mov eax, edi
call fcn.00415578
mov eax, dword [ebp - 4]
call fcn.00401e98
push eax
call sub.kernel32.dll_DeleteFileA
inc edi
cmp edi, 0x12
jne 0x41565b
test bl, bl
je 0x4156d2
mov eax, 0x1a
call fcn.00415568
mov esi, eax
add esi, 0x14
sub esi, 0x14
jl 0x4156d2
inc esi
mov edi, 0x14
lea ecx, [ebp - 8]
xor edx, edx
mov eax, edi
call fcn.00415578
mov eax, dword [ebp - 8]
call fcn.00401e98
push eax
call sub.kernel32.dll_DeleteFileA
lea ecx, [ebp - 0xc]
lea eax, [edi + 0x1e]
xor edx, edx
call fcn.00415578
mov eax, dword [ebp - 0xc]
call fcn.00401e98
push eax
call sub.kernel32.dll_DeleteFileA
inc edi
dec esi
jne 0x415699
lea ecx, [ebp - 0x14]
xor edx, edx
mov eax, 1
call fcn.00415578
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00404024
mov eax, dword [ebp - 0x10]
call fcn.00401e98
push eax
call sub.kernel32.dll_RemoveDirectoryA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41571c
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00401a6c
ret

Function at 0x415aac
Capabilities:
Compare security identifiers

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov byte [esp], 0
lea eax, [esp + 4]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
mov ebx, eax
test ebx, ebx
jne 0x415af0
call sub.kernel32.dll_GetLastError
cmp eax, 0x3f0
jne 0x415af0
lea eax, [esp + 4]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
mov ebx, eax
test ebx, ebx
je 0x415b87
mov eax, 0x400
call fcn.0040114c
mov esi, eax
lea eax, [esp + 8]
push eax
push 0x400
push esi
push 2
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_GetTokenInformation
mov ebx, eax
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_CloseHandle
test ebx, ebx
je 0x415b80
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
push 0x418644
call sub.advapi32.dll_AllocateAndInitializeSid
mov ebx, dword [esi]
dec ebx
test ebx, ebx
jl 0x415b76
inc ebx
xor edi, edi
mov eax, dword [esi + edi*8 + 4]
push eax
mov eax, dword [esp + 0x10]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x415b72
mov byte [esp], 1
jmp 0x415b76
inc edi
dec ebx
jne 0x415b59
mov eax, dword [esp + 0xc]
push eax
call sub.advapi32.dll_FreeSid
mov eax, esi
call fcn.00401164
mov al, byte [esp]
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x415e80
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00401e88
xor eax, eax
push ebp
push 0x415ef1
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040904c
mov edx, dword [ebp - 8]
mov eax, 0x419890
call fcn.00401a9c
xor eax, eax
mov dword [0x41988c], eax
push 0
push 0x415d94
call sub.user32.dll_EnumWindows
mov ebx, dword [0x41988c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x415ef8
lea eax, [ebp - 8]
mov edx, 2
call fcn.00401a6c
ret

Function at 0x415f00
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ecx
mov esi, eax
xor ebx, ebx
test esi, esi
jns 0x415f11
call fcn.004013ec
push esi
push 0xffffffffffffffff
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov edi, eax
test edi, edi
jns 0x415f29
call fcn.004013ec
push esp
mov esi, edi
test esi, esi
jns 0x415f35
call fcn.004013ec
push esi
call sub.kernel32.dll_GetExitCodeProcess
test edi, edi
je 0x415f58
mov eax, dword [esp]
push eax
test edi, edi
jns 0x415f4c
call fcn.004013ec
push esi
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb ebx, ebx
inc ebx
test edi, edi
jns 0x415f61
call fcn.004013ec
push esi
call sub.kernel32.dll_CloseHandle
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x535000
Capabilities:
Packed with generic packer

Disassembly:
push 0x535db7
call fcn.0053500f
jmp fcn.0048c444
Function at 0x535693
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
cld
xor edx, edx
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
push 0x18
pop ecx
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x5356c1
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x5356b8
cmp edi, 0x6a4abc5b
mov ebx, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x5356b0
mov eax, ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x5356e2
mov esp, ebp
pop ebp
ret

Function at 0x5356e6
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
add esp, 0xffffffec
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 0x10]
xor edx, edx
xchg edx, eax
mov esi, 0x3c
add esi, dword [ebp + 0xc]
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
mov esi, dword [eax + 0x78]
add esi, 0x18
add esi, dword [ebp + 0xc]
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
add esi, 4
lea edi, [ebp - 8]
lodsd eax, dword [esi]
add eax, dword [ebp + 0xc]
stosd dword es:[edi], eax
mov dword [ebp - 8], eax
lodsd eax, dword [esi]
add eax, dword [ebp + 0xc]
push eax
stosd dword es:[edi], eax
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
pop esi
mov dword [ebp - 4], 0
push esi
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
xchg edi, eax
mov ebx, edi
push edi
xor al, al
scasb al, byte es:[edi]
jne 0x535752
pop esi
sub edi, ebx
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x53577f
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x53576e
xor ecx, eax
xor edx, ebx
dec edi
jne 0x53575f
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop edx
cmp edx, eax
je 0x5357a5
pop esi
add esi, 4
add dword [ebp - 4], 1
jmp 0x535746
pop esi
mov eax, dword [ebp - 4]
shl eax, 1
add eax, dword [ebp - 0x10]
xor esi, esi
xchg esi, eax
mov ax, word [esi]
shl ax, 2
add eax, dword [ebp - 8]
xchg esi, eax
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
pop ecx
pop edx
pop edi
pop ebx
pop esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x5357d1
mov esp, ebp
pop ebp
ret 0xc