joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401032
Capabilities:
Get common file path
Move file
Read .ini file

Disassembly:
jmp 0x401fe0
mov eax, 0x10210
call fcn.0041be90
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0x1020c], eax
mov eax, dword [esp + 0x10218]
push ebp
mov ebp, dword [esp + 0x10218]
test ebp, ebp
mov dword [esp + 4], eax
jne 0x402027
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x1020c]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x10210
ret
test eax, eax
je 0x40200f
push ebx
xor ebx, ebx
cmp dword [0x44fe24], 3
jl 0x40204e
push 5
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ebx, eax
neg ebx
sbb ebx, ebx
neg ebx
jmp 0x402119
push esi
push edi
push 0xfffe
lea esi, [esp + 0x220]
mov eax, esi
push 0
push eax
call fcn.0041be10
add esp, 0xc
push 0x104
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push str.WinInit.ini
lea edx, [esp + 0x18]
push edx
call edi
lea eax, [esp + 0x14]
push eax
push 0x7fff
mov ecx, esi
push ecx
push 0x435c10
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
cmp word [esp + 0x21c], bx
je 0x4020c0
lea ecx, [ecx]
mov dx, word [esi]
add esi, 2
test dx, dx
jne 0x4020b0
cmp word [esi], bx
jne 0x4020b0
mov eax, dword [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x435c0c
push esi
call edi
push ebp
push esi
call edi
jmp 0x4020e0
mov cx, word [esi]
add esi, 2
test cx, cx
jne 0x4020e0
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x220]
push eax
push 0x435c10
mov word [esi], bx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionW]
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
pop edi
pop esi
mov ecx, dword [esp + 0x10214]
mov eax, ebx
pop ebx
pop ebp
xor ecx, esp
call fcn.0041bdf4
add esp, 0x10210
ret
Function at 0x401037
Capabilities:
Create shortcut via ishelllink

Disassembly:
jmp 0x4031c0
push ecx
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x4031cf
xor eax, eax
pop esi
pop ecx
ret
push ebp
mov ebp, dword [esp + 0x14]
test ebp, ebp
jne 0x4031de
pop ebp
xor eax, eax
pop esi
pop ecx
ret
push ebx
mov ebx, dword [esp + 0x1c]
test ebx, ebx
jne 0x4031ee
pop ebx
pop ebp
xor eax, eax
pop esi
pop ecx
ret
push edi
mov edi, dword [esp + 0x24]
test edi, edi
je 0x4032d1
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jne 0x4032d1
lea eax, [esp + 0x10]
push eax
push 0x436e1c
push 1
push 0
push 0x4370fc
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x4032cb
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
lea edx, [esp + 0x18]
push edx
push 0x43752c
push eax
mov eax, dword [ecx]
call eax
test eax, eax
jne 0x4032bf
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x50]
push esi
push eax
call edx
test eax, eax
jne 0x4032bf
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x44]
push 0
push esi
push eax
call edx
test eax, eax
jne 0x4032bf
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x2c]
push edi
push eax
call edx
test eax, eax
jne 0x4032bf
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x24]
push ebx
push eax
call edx
test eax, eax
jne 0x4032bf
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x28]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x3c]
call eax
test eax, eax
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
jne 0x4032c5
mov edx, dword [ecx + 0x18]
push 1
push ebp
push eax
call edx
test eax, eax
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
je 0x4032d9
call edx
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
call dword [sym.imp.ole32.dll_CoUninitialize]
pop edi
pop ebx
pop ebp
xor eax, eax
pop esi
pop ecx
ret
call edx
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
call dword [sym.imp.ole32.dll_CoUninitialize]
pop edi
pop ebx
pop ebp
mov eax, 1
pop esi
pop ecx
ret
Function at 0x401078
Capabilities:
Enumerate processes

Disassembly:
jmp 0x4058e0
sub esp, 0x230
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0x22c], eax
push ebx
mov ebx, dword [esp + 0x238]
push esi
push edi
push 0x22c
xor edi, edi
lea eax, [esp + 0x10]
push edi
push eax
call fcn.0041be10
add esp, 0xc
push edi
push 2
mov dword [esp + 0x14], 0x22c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [esp + 0xc]
mov esi, eax
push ecx
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x405955
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x230
ret
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push ebx
lea edx, [esp + 0x38]
push edx
call ebp
test eax, eax
jne 0x40596b
lea edi, [eax + 1]
lea eax, [esp + 0x10]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x40599e
lea ebx, [ebx]
push ebx
lea ecx, [esp + 0x38]
push ecx
call ebp
test eax, eax
jne 0x40598f
add edi, 1
lea edx, [esp + 0x10]
push edx
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x405980
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x23c]
pop ebp
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041bdf4
add esp, 0x230
ret
Function at 0x4010c8
Capabilities:
Get common file path
Get installed programs

Disassembly:
jmp 0x4027a0
sub esp, 0x670
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0x66c], eax
mov eax, dword [esp + 0x674]
push esi
xor esi, esi
push 0x208
lea ecx, [esp + 0x264]
push esi
push ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
call fcn.0041be10
push 0x208
lea edx, [esp + 0x478]
push esi
push edx
call fcn.0041be10
push 0x250
lea eax, [esp + 0x2c]
push esi
push eax
call fcn.0041be10
add esp, 0x24
lea ecx, [esp + 0x468]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x402830
pop esi
mov ecx, dword [esp + 0x66c]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x670
ret
push ebx
push ebp
push edi
push 0x479448
lea edx, [esp + 0x478]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov ebp, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, dword [sym.imp.KERNEL32.dll_FindClose]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x402860
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x478]
push ecx
call ebp
cmp eax, 0xffffffff
je 0x402886
push eax
call edi
push 0x3e8
add esi, 1
call ebx
cmp esi, 0x3c
jl 0x402860
cmp esi, 0x3c
je 0x402893
mov dword [esp + 0x14], 1
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
lea edx, [esp + 0x270]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [esp + 0x18]
push eax
lea ecx, [esp + 0x270]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea edx, [esp + 0x10]
push edx
push 0x20019
xor edi, edi
push edi
lea eax, [esp + 0x278]
push eax
push 0x80000002
call esi
test eax, eax
je 0x402906
cmp dword [0x44fe24], 5
jl 0x402915
lea edx, [esp + 0x10]
push edx
push 0x20119
push edi
lea eax, [esp + 0x278]
push eax
push 0x80000002
call esi
test eax, eax
jne 0x402915
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], edi
mov ecx, dword [esp + 0x67c]
mov eax, dword [esp + 0x14]
pop edi
pop ebp
pop ebx
pop esi
xor ecx, esp
call fcn.0041bdf4
add esp, 0x670
ret
Function at 0x4010e1
Capabilities:
Get file size
Read file on windows

Disassembly:
jmp 0x409710
mov eax, dword [esp + 4]
test eax, eax
jne 0x409719
ret
push ebp
mov ebp, dword [esp + 0xc]
test ebp, ebp
jne 0x409726
xor eax, eax
pop ebp
ret
push ebx
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push eax
mov dword [ebp], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x409753
pop ebx
xor eax, eax
pop ebp
ret
push esi
push edi
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea eax, [esi + 2]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x409792
push 0
push ebp
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4097a0
push edi
call fcn.004012bc
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
xor eax, eax
pop ebp
ret
shr dword [ebp], 1
shr esi, 1
push ebx
mov word [edi + esi*2], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x401104
Capabilities:
Get file size
Read file on windows

Disassembly:
jmp 0x40d3e0
push ecx
mov eax, dword [esp + 8]
test eax, eax
jne 0x40d3eb
pop ecx
ret
push edi
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push eax
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x40d46c
push ebx
push esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea eax, [ebx + 1]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x40d46a
push 0
lea ecx, [esp + 0x18]
push ecx
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40d461
call fcn.00401307
push eax
push esi
call fcn.00401127
add esp, 8
mov dword [esp + 0xc], eax
push esi
call fcn.004012bc
add esp, 4
pop esi
pop ebx
test edi, edi
je 0x40d477
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 4]
pop edi
pop ecx
ret
Function at 0x40114a
Capabilities:
Write file on windows

Disassembly:
jmp 0x403350
sub esp, 0x418
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0x414], eax
push esi
mov esi, dword [esp + 0x420]
test esi, esi
jne 0x403388
xor eax, eax
pop esi
mov ecx, dword [esp + 0x414]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x418
ret
push 0x410
lea eax, [esp + 0xc]
push 0
push eax
mov dword [esp + 0x10], 0
call fcn.0041be10
add esp, 0xc
cmp dword [esp + 0x424], 1
push 0xa
push 0xd
push esi
jne 0x4033bf
push str.FILEREGI__s__1c_1c
lea ecx, [esp + 0x18]
push ecx
jmp 0x4033c9
push str.FILE__s__1c_1c
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
push 0
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
mov eax, dword [0x486308]
lea edx, [esp + 0x14]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x418]
neg eax
sbb eax, eax
pop esi
xor ecx, esp
neg eax
call fcn.0041bdf4
add esp, 0x418
ret

Function at 0x40114f
Capabilities:
Enumerate files on windows

Disassembly:
jmp 0x401910
sub esp, 0x69c
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0x698], eax
mov eax, dword [esp + 0x6a4]
push esi
mov esi, dword [esp + 0x6a4]
test esi, esi
push edi
mov edi, dword [esp + 0x6b0]
mov dword [esp + 8], eax
jne 0x40195c
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x698]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x69c
ret
test eax, eax
je 0x401943
test edi, edi
je 0x401943
push ebx
push ebp
push 0x410
lea eax, [esp + 0x29c]
push 0
push eax
call fcn.0041be10
push 0x250
lea ecx, [esp + 0x58]
push 0
push ecx
call fcn.0041be10
push 0x34
lea edx, [esp + 0x30]
push 0
push edx
call fcn.0041be10
add esp, 0x24
push 0x3f5
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebp, eax
push edi
lea eax, [esp + 0x29c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x435bf0
lea ecx, [esp + 0x29c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea edx, [esp + 0x48]
push edx
lea eax, [esp + 0x29c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x401a31
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov al, byte [esp + 0x48]
test al, 0x10
je 0x401a1e
test al, 2
jne 0x401a1e
push 0x435bec
lea ecx, [esp + 0x78]
push ecx
call edi
test eax, eax
je 0x401a1e
push 0x435be4
lea edx, [esp + 0x78]
push edx
call edi
test eax, eax
jne 0x401a4c
lea eax, [esp + 0x48]
push eax
push esi
call ebx
test eax, eax
jne 0x4019f2
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
mov ecx, dword [esp + 0x6a8]
pop ebp
pop ebx
pop edi
pop esi
xor ecx, esp
call fcn.0041bdf4
add esp, 0x69c
ret
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push 0
push 0x1132
push ebp
mov dword [esp + 0x24], ecx
mov dword [esp + 0x2c], 0x11
mov dword [esp + 0x3c], str.Dummy
call dword [sym.imp.USER32.dll_SendMessageW]
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, 1
jmp 0x401a33
Function at 0x401163
Capabilities:
Write file on windows

Disassembly:
jmp 0x4064e0
sub esp, 0x418
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0x414], eax
push esi
mov esi, dword [esp + 0x420]
test esi, esi
jne 0x406518
xor eax, eax
pop esi
mov ecx, dword [esp + 0x414]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x418
ret
push 0x410
lea eax, [esp + 0xc]
push 0
push eax
mov dword [esp + 0x10], 0
call fcn.0041be10
add esp, 0xc
cmp dword [esp + 0x424], 1
push 0xa
push 0xd
push esi
jne 0x406565
cmp dword [esp + 0x434], 0
je 0x406559
push str.FILEREGI64__s__1c_1c
lea ecx, [esp + 0x18]
push ecx
jmp 0x40656f
push str.FILEREGI__s__1c_1c
lea edx, [esp + 0x18]
push edx
jmp 0x40656f
push str.FILE__s__1c_1c
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
push 0
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [0x486308]
add eax, eax
push eax
lea eax, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x418]
neg eax
sbb eax, eax
pop esi
xor ecx, esp
neg eax
call fcn.0041bdf4
add esp, 0x418
ret
Function at 0x401186
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x408000
sub esp, 0x6b8
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0x6b4], eax
push esi
mov esi, dword [esp + 0x6c0]
test esi, esi
jne 0x408038
xor eax, eax
pop esi
mov ecx, dword [esp + 0x6b4]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x6b8
ret
cmp dword [esp + 0x6c4], 0
je 0x408020
cmp dword [esp + 0x6c8], 0
je 0x408020
push edi
push 0x208
lea eax, [esp + 0x6c]
push 0
push eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0x226
mov dword [esp + 0x2c], 1
call fcn.0041be10
push 0x44c
lea ecx, [esp + 0x280]
push 0
push ecx
call fcn.0041be10
xor eax, eax
push 0x44
push eax
lea edx, [esp + 0x44]
push edx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
call fcn.0041be10
add esp, 0x24
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
lea eax, [esp + 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
lea ecx, [esp + 0x6c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea edx, [esp + 8]
push edx
push 0x20019
push 0
lea eax, [esp + 0x74]
push eax
push 0x80000002
call edi
test eax, eax
je 0x408113
cmp dword [0x44fe24], 5
jl 0x408113
lea ecx, [esp + 8]
push ecx
push 0x20119
push 0
lea edx, [esp + 0x74]
push edx
push 0x80000002
call edi
test eax, eax
jne case.0x408190.0
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x274]
push ecx
lea edx, [esp + 0x28]
push edx
push 0
push str.UninstallString
push eax
mov dword [esp + 0x24], 0x44c
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x40816a
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0x6b4]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x6b8
ret
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x47964c], 1
jne case.default.0x408190
push esi
call fcn.0040104b
add esp, 4
cmp eax, 3
ja case.default.0x408190
jmp dword [eax*4 + 0x408278]
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0x6b4]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x6b8
ret
lea edx, [esp + 0x270]
push edx
push esi
call fcn.0040101e
add esp, 8
test eax, eax
je case.default.0x408190
cmp word [0x479248], 0
je case.default.0x408190
push 0x435c6c
lea eax, [esp + 0x274]
push 0x226
push eax
call fcn.0041c1b5
push 0x479248
lea ecx, [esp + 0x280]
push 0x226
push ecx
call fcn.0041c1b5
add esp, 0x18
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x28]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
lea ecx, [esp + 0x290]
push ecx
push 0
mov dword [esp + 0x4c], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edx, dword [esp + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call edi
mov eax, dword [esp + 0x10]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0x10]
push ecx
call edi
push esi
call fcn.004010c8
mov ecx, dword [esp + 0x6c0]
add esp, 4
neg eax
pop edi
sbb eax, eax
pop esi
xor ecx, esp
neg eax
call fcn.0041bdf4
add esp, 0x6b8
ret
Function at 0x4011c7
Capabilities:
Enumerate processes

Disassembly:
jmp 0x4054b0
sub esp, 0x230
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0x22c], eax
push esi
push edi
mov edi, dword [esp + 0x23c]
push 0x22c
lea eax, [esp + 0xc]
push 0
push eax
call fcn.0041be10
add esp, 0xc
push 0
push 2
mov dword [esp + 0x10], 0x22c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [esp + 8]
mov esi, eax
push ecx
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x405523
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x230
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push edi
lea edx, [esp + 0x34]
push edx
call ebx
test eax, eax
je 0x405581
lea eax, [esp + 0xc]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x405560
push edi
lea ecx, [esp + 0x34]
push ecx
call ebx
test eax, eax
je 0x405581
lea edx, [esp + 0xc]
push edx
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x405545
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x230
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x238]
pop ebx
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.0041bdf4
add esp, 0x230
ret
Function at 0x4011d1
Capabilities:
Copy file
Delete file
Get common file path

Disassembly:
jmp 0x41a5b0
sub esp, 0xa2c
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0xa28], eax
cmp dword [0x46b138], 1
jne 0x41a5e7
mov eax, 1
mov ecx, dword [esp + 0xa28]
xor ecx, esp
call fcn.0041bdf4
add esp, 0xa2c
ret
push esi
push edi
push 0x208
lea eax, [esp + 0xc]
push 0
push eax
call fcn.0041be10
push 0x410
push 0
push 0x4781d8
call fcn.0041be10
push 0x410
lea ecx, [esp + 0x22c]
push 0
push ecx
call fcn.0041be10
push 0x410
lea edx, [esp + 0x648]
push 0
push edx
call fcn.0041be10
mov eax, dword [0x486308]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
add esp, 0x30
test eax, eax
jne 0x41a71e
push 0x45e730
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x45e730
push 0x4781d8
call edi
push 0x435bfc
push 0x4781d8
call esi
push 0x4781b0
push 0x4781d8
call esi
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
push 0x4781d8
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [0x486308], eax
jne 0x41a71e
mov ecx, dword [0x486304]
push 0x100
lea eax, [esp + 0x214]
push eax
push 0x452
push ecx
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x44fc20
lea edx, [esp + 0x214]
push edx
lea eax, [esp + 0x628]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
push 0
lea ecx, [esp + 0x630]
push ecx
push 0
call fcn.004010be
mov edx, dword [0x486308]
add esp, 0x18
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0xa28]
xor ecx, esp
call fcn.0041bdf4
add esp, 0xa2c
ret
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [0x478e2c], 1
jne 0x41a739
call fcn.004011d6
cmp dword [0x486308], 0
je 0x41a7f2
push 0x44fc20
call fcn.00401208
add esp, 4
push 0x46b190
lea eax, [esp + 0xc]
push eax
call edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [esp + 8]
push ecx
call edi
cmp word [esp + eax*2 + 6], 0x5c
je 0x41a780
push 0x435bfc
lea edx, [esp + 0xc]
push edx
jmp 0x41a7a7
lea eax, [esp + 8]
push eax
call edi
lea ecx, [esp + eax*2 + 6]
push ecx
lea edx, [esp + 0xc]
push edx
call fcn.00401113
add esp, 8
test eax, eax
jne 0x41a7a9
push 0x435bfc
lea eax, [esp + 0xc]
push eax
call esi
push 0x44fc20
lea ecx, [esp + 0xc]
push ecx
call esi
mov edx, dword [0x486308]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
lea eax, [esp + 0xc]
push eax
push 0x4781d8
mov dword [0x486308], 0
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0x4781d8
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [esp + 8]
call fcn.0040c9a0
cmp dword [0x478e20], 0
je 0x41a812
cmp word [0x450c58], 0
je 0x41a812
push 0x450c58
call fcn.00401212
add esp, 4
mov ecx, dword [esp + 0xa30]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.0041bdf4
add esp, 0xa2c
ret
Function at 0x4011f4
Capabilities:
Check os version

Disassembly:
jmp 0x401700
sub esp, 0x118
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0x114], eax
push 0x114
lea eax, [esp + 4]
push 0
push eax
call fcn.0041be10
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [esp + 4]
cmp eax, 4
jae 0x40175a
xor eax, eax
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x118
ret
jne 0x401816
mov eax, dword [esp + 8]
test eax, eax
jne 0x4017c3
mov eax, 1
cmp dword [esp + 0x10], eax
jne 0x40179b
cmp dword [0x46b13c], 0
je 0x401743
mov dword [0x44fe24], 0
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x118
ret
cmp dword [0x478e14], 0
je 0x401743
mov dword [0x44fe24], 3
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x118
ret
cmp eax, 0xa
jne 0x4017f4
cmp dword [0x45043c], 0
je 0x401743
mov eax, 1
mov dword [0x44fe24], eax
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x118
ret
cmp eax, 0x5a
jne 0x401889
cmp dword [0x479044], 0
je 0x401743
mov dword [0x44fe24], 2
jmp 0x401889
cmp eax, 5
jne 0x401854
cmp dword [esp + 8], 0
jne 0x40183b
cmp dword [0x450c50], 0
je 0x401743
mov dword [0x44fe24], 4
jmp 0x401889
cmp dword [0x451058], 0
je 0x401743
mov dword [0x44fe24], 5
jmp 0x401889
cmp eax, 6
jne 0x40186d
cmp dword [0x478e24], 0
je 0x401743
mov dword [0x44fe24], eax
jmp 0x401889
cmp eax, 7
jb 0x401889
cmp dword [0x478e1c], 0
je 0x401743
mov dword [0x44fe24], 0x1c
mov ecx, dword [esp + 0x114]
xor ecx, esp
mov eax, 1
call fcn.0041bdf4
add esp, 0x118
ret