joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40bd9d
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
push edi
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push 3
push dword [ebp + 8]
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
call esi
push dword [ebp - 4]
call fcn.0041050f
pop ecx
mov edi, eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push edi
push 3
push dword [ebp + 8]
call esi
test eax, eax
jne 0x40bdf1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov esi, eax
call fcn.004110e7
mov eax, esi
jmp 0x40be5b
lea eax, [ebp - 0x10]
push eax
push str.SeTcbPrivilege
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov edx, dword [edi]
xor ecx, ecx
cmp edx, ebx
jbe 0x40be36
lea eax, [edi + 4]
mov esi, dword [eax + 4]
cmp esi, dword [ebp - 0xc]
jne 0x40be1b
mov esi, dword [eax]
cmp esi, dword [ebp - 0x10]
je 0x40be25
inc ecx
add eax, 0xc
cmp ecx, edx
jb 0x40be0c
jmp 0x40be36
inc ecx
imul ecx, ecx, 0xc
lea eax, [ecx + edi]
or dword [eax], 2
mov dword [ebp - 8], 1
push ebx
push ebx
push ebx
push edi
push ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push edi
call fcn.004110e7
mov eax, dword [ebp - 8]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40bf30
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x660
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x40c044
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x40bf4c
sub eax, edx
sar eax, 1
cmp eax, 1
jb 0x40c044
push ebx
push str._s
mov esi, 0x104
lea eax, [ebp - 0x660]
push esi
push eax
call fcn.0041121d
add esp, 0x10
lea eax, [ebp - 0x458]
push eax
lea eax, [ebp - 0x660]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40bfa4
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40c047
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x208], ax
lea eax, [ebp - 0x206]
push eax
call fcn.00412380
lea eax, [ebp - 0x42c]
push eax
push ebx
push str._s_s
lea eax, [ebp - 0x208]
push esi
push eax
call fcn.0041121d
add esp, 0x20
test byte [ebp - 0x458], 0x10
je 0x40c016
lea eax, [ebp - 0x458]
push eax
call fcn.0040bf02
pop ecx
test eax, eax
jne 0x40c023
lea eax, [ebp - 0x208]
push eax
call fcn.0040be61
lea eax, [ebp - 0x208]
push eax
call fcn.0040bf30
pop ecx
pop ecx
test eax, eax
jne 0x40c039
jmp 0x40c023
lea eax, [ebp - 0x208]
push eax
call fcn.0040be61
pop ecx
lea eax, [ebp - 0x458]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40bfa4
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x40c047
push 0xd
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40c04c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push 0x114
lea eax, [ebp - 0x114]
push 0
push eax
call fcn.00412380
add esp, 0xc
lea eax, [ebp - 0x114]
push eax
mov dword [ebp - 0x114], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40c0a5
cmp dword [ebp - 0x110], 6
jne 0x40c09f
cmp dword [ebp - 0x10c], 2
jae 0x40c0a1
cmp dword [ebp - 0x110], 6
jbe 0x40c0a5
mov al, 1
leave
ret
xor al, al
leave
ret

Function at 0x40c0a9
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
cmp byte [0x432072], 0
je 0x40c0c2
mov al, byte [0x432071]
leave
ret
push 0x114
lea eax, [ebp - 0x114]
push 0
push eax
call fcn.00412380
add esp, 0xc
lea eax, [ebp - 0x114]
push eax
mov dword [ebp - 0x114], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x40c0f7
xor al, al
leave
ret
cmp dword [ebp - 0x110], 0xa
mov byte [0x432072], 1
sbb al, al
inc al
mov byte [0x432071], al
leave
ret

Function at 0x40c16d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ebx
mov ebx, dword [eax]
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
jle 0x40c1b9
push esi
inc bl
movzx ebx, bl
mov edx, dword [eax + ebx*4 + 8]
add cl, dl
movzx ecx, cl
lea esi, [eax + ecx*4 + 8]
mov dword [ebp + 8], ecx
mov ecx, dword [esi]
mov dword [eax + ebx*4 + 8], ecx
add cl, dl
mov dword [esi], edx
mov esi, dword [ebp + 0xc]
movzx ecx, cl
mov cl, byte [eax + ecx*4 + 8]
add esi, edi
xor byte [esi], cl
mov ecx, dword [ebp + 8]
inc edi
cmp edi, dword [ebp + 0x10]
jl 0x40c182
pop esi
pop edi
mov dword [eax], ebx
mov dword [eax + 4], ecx
pop ebx
pop ebp
ret

Function at 0x40c617
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x318
push esi
lea eax, [ebp - 8]
push eax
xor esi, esi
push esi
push esi
push dword [ebp + 8]
mov dword [ebp - 8], esi
call sub.PSAPI.DLL_EnumProcessModules
mov eax, dword [ebp - 8]
cmp eax, esi
jne 0x40c63f
mov al, 1
jmp 0x40c664
push edi
push 0x432268
xor ecx, ecx
push 4
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004123fa
mov edi, eax
pop ecx
pop ecx
cmp edi, esi
jne 0x40c667
mov al, 1
pop edi
pop esi
leave
ret
push ebx
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push edi
push dword [ebp + 8]
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
jne 0x40c68a
mov bl, 1
push edi
call fcn.004110e7
pop ecx
mov al, bl
pop ebx
jmp 0x40c663
mov byte [ebp - 1], 0
cmp dword [ebp - 8], esi
jbe 0x40c6fe
push 0x105
lea eax, [ebp - 0x318]
push eax
push dword [edi + esi*4]
push dword [ebp + 8]
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x40c6f2
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10c]
call fcn.004034f7
push dword [eax]
lea eax, [ebp - 0x318]
push eax
call fcn.00412c41
mov ebx, eax
neg ebx
sbb bl, bl
lea eax, [ebp - 0x108]
pop ecx
inc bl
pop ecx
cmp dword [ebp - 0x10c], eax
je 0x40c6ee
push dword [ebp - 0x10c]
call fcn.004110f2
pop ecx
test bl, bl
jne 0x40c6fa
inc esi
cmp esi, dword [ebp - 8]
jb 0x40c693
jmp 0x40c6fe
mov byte [ebp - 1], 1
mov bl, byte [ebp - 1]
jmp 0x40c67e
Function at 0x40cace
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push edi
push dword [ebp + 0xc]
lea ecx, [ebp - 0x120]
call fcn.004034f7
mov eax, dword [eax]
push 0x24
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
lea eax, [ebp - 0x11c]
cmp dword [ebp - 0x120], eax
je 0x40cb10
push dword [ebp - 0x120]
call fcn.004110f2
pop ecx
test edi, edi
jne 0x40cb1b
xor al, al
pop edi
leave
ret 8
push ebx
lea eax, [ebp - 0x1c]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
xor bl, bl
test eax, eax
jne 0x40cb3b
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, bl
pop ebx
jmp 0x40cb16
push esi
xor esi, esi
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x1c]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x40cb68
cmp dword [ebp - 0x18], 1
je 0x40cb66
inc esi
cmp esi, 0xa
jb 0x40cb3e
jmp 0x40cb68
mov bl, 1
pop esi
jmp 0x40cb2f
Function at 0x40cf63
Capabilities:
Set registry value

Disassembly:
mov eax, 0x4255ac
call fcn.004121ac
sub esp, 0x468
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
push 0x1c
cdq
pop ecx
idiv ecx
test eax, eax
je 0x40d14b
push ebx
push edi
xor ebx, ebx
push ebx
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x20], 0xf
call fcn.00403256
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
push 0x1c
cdq
pop ecx
idiv ecx
xor edi, edi
mov dword [ebp - 4], ebx
test eax, eax
jbe 0x40cff6
push edi
mov ecx, esi
call fcn.0040c28c
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x38]
call fcn.0040ccc8
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
push 0x1c
cdq
pop ecx
idiv ecx
dec eax
cmp edi, eax
jae 0x40cfe5
push 0x2c
push 1
lea ecx, [ebp - 0x38]
call fcn.0040cc60
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
push 0x1c
cdq
pop ecx
idiv ecx
inc edi
cmp edi, eax
jb 0x40cfb4
push dword [0x43084c]
lea ecx, [ebp - 0x54]
call fcn.0040590a
mov eax, dword [ebp - 0x24]
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], eax
cmp eax, ebx
je 0x40d133
push 0x432268
push eax
call fcn.004123fa
pop ecx
pop ecx
mov dword [ebp - 0x10], eax
cmp eax, ebx
je 0x40d133
cmp dword [ebp - 0x20], 0x10
mov eax, dword [ebp - 0x34]
jae 0x40d03a
lea eax, [ebp - 0x34]
push dword [ebp - 0x14]
push eax
push dword [ebp - 0x10]
call fcn.004124d0
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x54]
call fcn.00403085
mov esi, eax
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x54]
call fcn.004030a5
mov edi, eax
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x54]
call fcn.00403085
push 0x40c1c2
push dword [esi + 4]
push dword [esi]
push dword [edi + 4]
push dword [edi]
push dword [eax + 4]
push dword [eax]
lea eax, [ebp - 0x64]
push eax
call fcn.0040cdcc
mov eax, dword [ebp - 0x50]
add esp, 0x20
cmp dword [ebp - 0x3c], 0x10
jae 0x40d09d
lea eax, [ebp - 0x50]
push dword [ebp - 0x40]
push eax
lea eax, [ebp - 0x474]
push eax
call fcn.0040c110
push dword [ebp - 0x14]
lea eax, [ebp - 0x474]
push dword [ebp - 0x10]
push eax
call fcn.0040c16d
mov dword [ebp + 8], ebx
lea eax, [ebp + 8]
push eax
mov byte [ebp - 4], 2
call fcn.0040b344
add esp, 0x1c
test eax, eax
jne 0x40d12a
push str.ConfigOSSProxySettings
lea ecx, [ebp + 8]
call fcn.00402618
push 0x2001f
push dword [ebp + 8]
lea ecx, [ebp - 0x1c]
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
call fcn.0040153d
test eax, eax
jne 0x40d122
push dword [ebp - 0x14]
push dword [ebp - 0x10]
push 3
push ebx
push 0x429b34
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x10]
call fcn.004110e7
pop ecx
lea ecx, [ebp - 0x1c]
call fcn.00401522
push dword [ebp + 8]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push ebx
push 1
lea ecx, [ebp - 0x54]
call fcn.0040394b
push ebx
push 1
lea ecx, [ebp - 0x38]
call fcn.0040394b
pop edi
pop ebx
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x40d71d
Capabilities:
Get process image filename
Terminate process

Disassembly:
mov eax, 0x424da9
call fcn.004121ac
sub esp, 0x330
push ebx
push esi
mov esi, dword [ebp + 8]
push dword [esi + 0x1c]
xor ebx, ebx
push ebx
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp + 8], eax
cmp eax, ebx
jne 0x40d74e
xor al, al
jmp 0x40d7c3
xor eax, eax
push 0x208
mov word [ebp - 0x33c], ax
lea eax, [ebp - 0x33a]
push ebx
push eax
call fcn.00412380
add esp, 0xc
push 0x105
lea eax, [ebp - 0x33c]
push eax
push dword [ebp + 8]
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
je 0x40d74a
push edi
lea eax, [ebp - 0x33c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00404ed4
push 1
push 0xffffffffffffffff
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], 0x5c
call fcn.004029ea
mov edi, eax
cmp edi, 0xffffffff
jne 0x40d7d3
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.00403537
xor al, al
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
cmp dword [esi + 0x38], 0x10
jb 0x40d7de
mov esi, dword [esi + 0x24]
jmp 0x40d7e1
add esi, 0x24
push esi
lea ecx, [ebp - 0x130]
call fcn.004034f7
cmp dword [ebp - 0x14], 8
mov ecx, dword [eax]
mov eax, dword [ebp - 0x28]
jae 0x40d7fb
lea eax, [ebp - 0x28]
push ecx
lea eax, [eax + edi*2 + 2]
push eax
call fcn.00412c41
test eax, eax
lea eax, [ebp - 0x12c]
pop ecx
setne bl
pop ecx
cmp dword [ebp - 0x130], eax
je 0x40d827
push dword [ebp - 0x130]
call fcn.004110f2
pop ecx
test bl, bl
je 0x40d83d
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00403537
mov al, bl
jmp 0x40d7c2
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [ebp + 8]
test eax, eax
setne bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40d82d
Function at 0x40e44e
Capabilities:
Set registry value

Disassembly:
mov eax, 0x4256e4
call fcn.004121ac
sub esp, 0x24
push ebx
push edi
push 0xf003f
xor edi, edi
push edi
push edi
mov ebx, ecx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x10], eax
cmp eax, edi
je 0x40e5de
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
sar eax, 6
test eax, eax
jbe 0x40e4f3
push edi
mov ecx, esi
call fcn.0040c2d9
cmp dword [eax + 0x14], 0
je 0x40e4bd
push edi
mov ecx, esi
call fcn.0040c2d9
cmp dword [eax + 0x18], 0x10
jb 0x40e4ab
mov eax, dword [eax + 4]
jmp 0x40e4ae
add eax, 4
push eax
push dword [ebp - 0x10]
mov ecx, ebx
call fcn.0040cace
test al, al
jne 0x40e4d1
push edi
mov ecx, esi
call fcn.0040c2d9
push eax
mov ecx, ebx
call fcn.0040d71d
test al, al
je 0x40e4e5
push edi
mov ecx, esi
call fcn.0040c2d9
add eax, 0x20
push eax
lea ecx, [ebx + 4]
call fcn.00408460
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
inc edi
sar eax, 6
cmp edi, eax
jb 0x40e48a
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
xor ebx, ebx
sar eax, 6
xor edi, edi
test eax, eax
jbe 0x40e528
push edi
mov ecx, esi
call fcn.0040c2d9
cmp byte [eax + 0x3c], bl
jne 0x40e538
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
inc edi
sar eax, 6
cmp edi, eax
jb 0x40e50d
push str.Dont_need_to_update_registry___exiting_n
call fcn.004016c6
pop ecx
jmp 0x40e5dd
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
lea eax, [ebp - 0x30]
push 0x430080
push eax
mov dword [ebp - 4], ebx
call fcn.004058a1
add esp, 0xc
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], 1
jae 0x40e567
lea eax, [ebp - 0x2c]
push eax
push str.Reg_key:__s_n
call fcn.004016c6
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
pop ecx
pop ecx
jae 0x40e580
lea eax, [ebp - 0x2c]
push 0xf013f
push eax
push SysStringLen
lea ecx, [ebp - 0x14]
call fcn.0040153d
test eax, eax
jne 0x40e5ca
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x40e5a3
lea eax, [ebp - 0x2c]
push eax
push str.Setting_Reg_key:__s_n
call fcn.004016c6
pop ecx
pop ecx
push 4
lea eax, [ebp + 8]
push eax
push 4
push ebx
push str.ProxyEnable
push dword [ebp - 0x14]
mov dword [ebp + 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push ebx
push 1
lea ecx, [ebp - 0x30]
call fcn.00403537
lea ecx, [ebp - 0x14]
call fcn.00401522
pop esi
mov ecx, dword [ebp - 0xc]
pop edi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x40fd84
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
push esi
push edi
lea eax, [ebp - 4]
push eax
mov esi, 0x100
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push eax
call fcn.0040fd2d
mov eax, dword [ebp - 4]
mov cl, byte [ebp + eax - 0x105]
add esp, 0x10
cmp cl, 0x3a
je 0x40fdcb
cmp cl, 0x5c
je 0x40fdcb
mov byte [ebp + eax - 0x104], 0x5c
inc eax
mov dword [ebp - 4], eax
lea ecx, [ebp - 4]
push ecx
mov ecx, esi
sub ecx, eax
push ecx
push dword [ebp + 0xc]
lea eax, [ebp + eax - 0x104]
push eax
call fcn.0040fd2d
add esp, 0x10
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40fe0d
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40ff04
push ebx
xor ebx, ebx
cmp byte [ebp - 0x218], 0x2e
jne 0x40fe3a
cmp byte [ebp - 0x217], bl
je 0x40fee2
cmp byte [ebp - 0x217], 0x2e
jne 0x40fe3a
cmp byte [ebp - 0x216], bl
je 0x40fee2
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push eax
call fcn.0040fd2d
mov eax, dword [ebp - 4]
mov cl, byte [ebp + eax - 0x105]
add esp, 0x10
cmp cl, 0x3a
je 0x40fe71
cmp cl, 0x5c
je 0x40fe71
mov byte [ebp + eax - 0x104], 0x5c
inc eax
mov dword [ebp - 4], eax
lea ecx, [ebp - 4]
push ecx
mov ecx, esi
sub ecx, eax
push ecx
lea ecx, [ebp - 0x218]
push ecx
lea eax, [ebp + eax - 0x104]
push eax
call fcn.0040fd2d
add esp, 0x10
test byte [ebp - 0x244], 0x10
lea eax, [ebp - 0x104]
je 0x40fec3
push 1
push 0x4270d0
push eax
call fcn.0040fd84
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x40fee2
jmp 0x40fed3
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40fee2
cmp byte [ebp + 0x10], bl
je 0x40ff08
lea eax, [ebp - 0x104]
push ebx
push eax
call fcn.0040faab
pop ecx
pop ecx
lea eax, [ebp - 0x244]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40fe10
xor esi, esi
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, esi
pop ebx
pop edi
pop esi
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x40fefa

Function at 0x413328
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4309d4]
jne 0x413332
repz ret
jmp fcn.0041c1d3
Function at 0x4215ef
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00418026
and dword [ebp - 4], 0
cmp dword [0x432d98], 0
mov ebx, eax
jne 0x4216a0
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x421751
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x421751
push eax
call fcn.00417fb4
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x432d98], eax
call esi
push eax
call fcn.00417fb4
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x432d9c], eax
call esi
push eax
call fcn.00417fb4
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x432da0], eax
call esi
push eax
call fcn.00417fb4
pop ecx
mov dword [0x432da8], eax
test eax, eax
je 0x4216a0
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00417fb4
pop ecx
mov dword [0x432da4], eax
mov eax, dword [0x432da4]
cmp eax, ebx
je 0x4216f8
cmp dword [0x432da8], ebx
je 0x4216f8
push eax
call fcn.0041802f
push dword [0x432da8]
mov esi, eax
call fcn.0041802f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4216f8
test edi, edi
je 0x4216f8
call esi
test eax, eax
je 0x4216ef
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4216ef
test byte [ebp - 0xc], 1
jne 0x4216f8
or dword [ebp + 0x10], 0x200000
jmp 0x421731
mov eax, dword [0x432d9c]
cmp eax, ebx
je 0x421731
push eax
call fcn.0041802f
pop ecx
test eax, eax
je 0x421731
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x421731
mov eax, dword [0x432da0]
cmp eax, ebx
je 0x421731
push eax
call fcn.0041802f
pop ecx
test eax, eax
je 0x421731
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x432d98]
call fcn.0041802f
pop ecx
test eax, eax
je 0x421751
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x421753
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x3000d073
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 0x218
push edi
call fcn.30012f0c
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call edi
test eax, eax
je 0x3001679a
pop edi
leave
ret 4
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
mov ebx, eax
cmp ebx, 5
jne 0x300167cb
push 0x80
push dword [ebp + 8]
call fcn.30023914
mov ecx, dword [ebp + 8]
call fcn.30012f0c
push eax
call edi
test eax, eax
jne 0x3001680b
call esi
mov ebx, eax
test ebx, ebx
je 0x3001680b
mov ecx, dword [ebp + 8]
call fcn.30012f0c
push eax
push 0x30016814
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.30023192
add esp, 0x10
push 0x43
pop ecx
mov esi, eax
push 0x30049d54
lea eax, [ebp - 0x10c]
lea edi, [ebp - 0x10c]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.30028332
pop esi
pop ebx
jmp 0x3000d096

Function at 0x3000d5c0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 0x218
call fcn.30012f0c
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x30016a9c
leave
ret 4
push 0x30016ad8
call dword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x3000ea09
Capabilities:
Delete file

Disassembly:
push 3
jmp 0x3000ea2c
mov ecx, 0xc0000000
jmp 0x3000ea4b
mov ecx, SysReAllocString
jmp 0x3000ea4b
mov ecx, dword [ebp + 8]
jmp 0x3000ea4b
xor eax, eax
jmp 0x3000ea60
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x218
push esi
xor esi, esi
sub eax, esi
push edi
mov edi, ecx
je 0x3000d09b
dec eax
jne 0x3001665b
push 2
pop edx
mov eax, dword [ebp + 0x10]
sub eax, esi
je 0x3000d0ac
dec eax
je 0x3000d0a2
dec eax
jne 0x3000d0b6
mov ecx, 0x40000000
mov eax, dword [ebp + 0x14]
sub eax, esi
je 0x3000d0be
dec eax
jne 0x30016689
xor eax, eax
inc eax
push esi
push 0x80
push edx
push esi
push eax
push ecx
mov ecx, dword [ebp + 8]
call fcn.30012f0c
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [edi + 0x30], eax
je 0x300166a3
cmp dword [ebp + 0xc], esi
jne 0x3000ea95
push 2
push esi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push dword [ebp + 8]
lea ecx, [edi + 8]
call fcn.300115a9
pop edi
pop esi
leave
ret 0x10
dec eax
je 0x30016679
dec eax
je 0x3000d09b
dec eax
je 0x30016672
dec eax
jne 0x30016681
push 5
jmp 0x3000ea2c
push 4
jmp 0x3000ea2c
xor edx, edx
inc edx
jmp 0x3000ea2d
mov edx, dword [ebp + 8]
jmp 0x3000ea2d
dec eax
je 0x30016693
dec eax
jne 0x3001669b
push 2
jmp 0x30016695
push 3
pop eax
jmp 0x3000ea60
mov eax, dword [ebp + 8]
jmp 0x3000ea60
mov ecx, dword [ebp + 8]
call fcn.30012f0c
push eax
push 0x300166e8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.30023192
add esp, 0x10
push 0x43
pop ecx
mov esi, eax
push 0x30049d54
lea eax, [ebp - 0x10c]
lea edi, [ebp - 0x10c]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.30028332
nop
nop
nop
popaw
imul ebp, dword [ebp + 0x64], 0x206f7420
outsd dx, dword [esi]
jo 0x3001675a
outsb dx, byte [esi]
and byte [esi + 0x69], ah
insb byte es:[edi], dx
and byte gs:[edi], ah
and eax, 0x68002753
push 0x8d300167
test esp, esp
std
invalid
imul ebp, dword [ebp + 0x20], 0x6c696166
add byte fs:[eax + 0x72749090], dl
jns 0x300167d5
outsb dx, byte [esi]
and byte [si + 0x6f], dh
and byte [edx + 0x65], dh
popal
and byte fs:[esi + 0x72], ah
outsd dx, dword [esi]
insd dword es:[edi], dx
and byte [ecx + 0x20], ah
imul bp, word [ebp + 0x20], 0x6874
popal
je 0x300167af
jae 0x300167aa
outsb dx, byte [esi]
outsd dx, dword [esi]
je 0x300167ae
outsd dx, dword [esi]
jo 0x300167f6
outsb dx, byte [esi]
add byte [edx], dh
shr cl, 0xc5
pop esi
invalid
and byte [eax - 0x80], ch
add byte [eax], al
add byte [eax], al
add bh, bh
jne 0x300167bb
invalid
xor byte [ebp - 0x10b7b], cl
dec dword [ebp - 0x10b43]
call dword [eax - 0xd]
movsd dword es:[edi], dword [esi]