joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c097
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetLastActivePopup]
xor esi, esi
cmp eax, esi
je 0x40c0c0
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsChild]
mov eax, dword [ebx + 0x74]
test eax, eax
jne 0x40c0eb
mov eax, ebx
call fcn.0040c612
test eax, eax
jne 0x40c0eb
push 0x42abba
push esi
push esi
push 7
lea eax, [ebx + 0xd4]
call fcn.00401b49
jmp 0x40c16b
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
mov eax, 0x2001f
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
call fcn.00409df4
test eax, eax
jne 0x40c137
push str.RavDown
lea eax, [ebp - 0xc]
mov dword [ebp - 4], esi
push eax
lea esi, [ebp - 4]
xor edi, edi
call fcn.0040dc48
cmp dword [ebp - 4], edi
jbe 0x40c135
push str.RavDown
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
xor esi, esi
push esi
push 1
push dword [ebx + 0x84]
call fcn.0040e70a
add esp, 0xc
push str.succeed_
push esi
push 1
push 7
lea eax, [ebx + 0xd4]
call fcn.00401b49
cmp dword [ebp - 0xc], esi
je 0x40c16b
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push esi
push 6
push ebx
call fcn.0040c805
pop edi
pop esi
leave
ret
Function at 0x40c68e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetLastActivePopup]
test eax, eax
je 0x40c6b6
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsChild]
mov eax, dword [0x430fec]
and dword [ebp - 0x10], 0
and dword [ebp - 0xc], 0
mov ecx, 0x430fec
call dword [eax + 0xc]
mov ebx, eax
add ebx, 0x10
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
lea esi, [ebp - 8]
mov dword [ebp - 4], ebx
call fcn.00407f9b
push dword [ebp + 8]
mov eax, esi
push eax
call fcn.00407a5c
push dword [ebp - 8]
mov eax, 0x2001f
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x10]
call fcn.00409df4
test eax, eax
jne 0x40c7da
and dword [ebp + 8], eax
push str.InstallLocation
lea eax, [ebp - 0x10]
push eax
lea esi, [ebp + 8]
xor edi, edi
call fcn.0040dc48
test eax, eax
jne 0x40c7da
mov eax, dword [ebp + 8]
test eax, eax
jbe 0x40c7da
dec eax
push eax
lea eax, [ebp - 4]
call fcn.0040d86e
push str.InstallLocation
lea ecx, [ebp - 0x10]
push ecx
mov edi, eax
call fcn.0040dc48
test eax, eax
jne 0x40c7d7
mov esi, dword [ebp - 4]
mov ecx, dword [esi - 0xc]
test ecx, ecx
jne 0x40c76d
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
call fcn.00408191
lea eax, [esi - 0x10]
jmp 0x40c7e8
mov eax, dword [ebp + 8]
add eax, 0xfffffffe
js 0x40c7cd
cmp eax, ecx
jg 0x40c7cd
cmp byte [eax + esi], 0x5c
push 0x42ac40
lea eax, [ebp - 4]
push eax
call fcn.00407a5c
push dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
call fcn.00407a5c
mov ebx, dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40c7da
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
call fcn.00408191
lea eax, [ebx - 0x10]
call fcn.00408191
cmp dword [ebp - 0x10], 0
je 0x40c7c8
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
jmp 0x40c7fe
push 0x80070057
call fcn.00408152
mov ebx, dword [ebp - 4]
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
call fcn.00408191
lea eax, [ebx - 0x10]
call fcn.00408191
cmp dword [ebp - 0x10], 0
je 0x40c7fc
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x40c855
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetLastActivePopup]
test eax, eax
je 0x40c87c
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsChild]
push esi
push dword [ebp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
call esi
cmp eax, 0xffffffff
je 0x40c8dd
mov eax, dword [ebp + 8]
push str.Rising.info
lea ecx, [ebp + 8]
push 0x42ac40
add eax, 0x84
push ecx
call fcn.0040d7f5
pop ecx
pop ecx
lea ecx, [ebp + 0xc]
push ecx
call fcn.0040d7f5
pop ecx
pop ecx
push dword [eax]
call esi
xor ecx, ecx
cmp eax, 0xffffffff
mov eax, dword [ebp + 0xc]
setne cl
add eax, 0xfffffff0
mov esi, ecx
call fcn.00408191
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.00408191
mov eax, esi
jmp 0x40c8df
xor eax, eax
pop esi
leave
ret 8
Function at 0x40d020
Capabilities:
Check if file exists
Create directory
Delete file
Get common file path
Get file attributes
Set file attributes

Disassembly:
push ecx
push ebx
push esi
push edi
mov ebx, eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetLastActivePopup]
test eax, eax
je 0x40d045
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsChild]
mov esi, 0x400
push esi
mov eax, ebx
call fcn.0040d86e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x40d070
mov esi, ebx
call fcn.0040802e
push str.C:Temp
push ebx
call fcn.00407f6c
mov esi, ebx
call fcn.0040802e
push dword [ebx]
call fcn.0040d115
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x40d09a
mov edi, dword [ebx]
call fcn.0040b4cf
mov eax, dword [ebx]
push 0
push eax
call esi
test eax, eax
je 0x40d10e
call fcn.0040d716
push 0x42ac40
push ebx
call fcn.00407a5c
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0xa4]
push dword [eax - 0xc]
push eax
mov eax, ebx
call fcn.00407c78
push 0x42b53c
push ebx
call fcn.00407a5c
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40d0f4
push dword [ebx]
call fcn.0040b344
pop ecx
push 0x80
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edi, dword [ebx]
call fcn.0040b4cf
push 0
push dword [ebx]
call esi
push dword [ebx]
call fcn.0040d115
neg eax
sbb eax, eax
neg eax
pop edi
pop esi
pop ebx
pop ecx
ret 4

Function at 0x40d115
Capabilities:
Check if file exists
Get file attributes

Disassembly:
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetLastActivePopup]
test eax, eax
je 0x40d134
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsChild]
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40d14c
test al, 0x10
je 0x40d14c
xor eax, eax
inc eax
jmp 0x40d14e
xor eax, eax
ret 4
Function at 0x40d229
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
push esi
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetLastActivePopup]
xor ebx, ebx
cmp eax, ebx
je 0x40d253
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsChild]
mov eax, dword [ebp + 8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40d259
sub eax, edx
mov esi, eax
mov eax, dword [ebp + 0xc]
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40d26a
sub eax, edi
add eax, esi
lea eax, [eax + eax + 4]
push eax
call fcn.00412242
mov esi, eax
pop ecx
mov dword [ebp - 4], esi
cmp esi, ebx
jne 0x40d290
xor eax, eax
jmp 0x40d322
push dword [ebp + 0xc]
lea eax, [ebp - 4]
push dword [ebp + 8]
push str.__s___s
call fcn.0040da80
push 0x44
pop edi
push edi
lea eax, [ebp - 0x60]
push ebx
push eax
call fcn.00414930
add esp, 0x18
lea eax, [ebp - 0x60]
push eax
mov dword [ebp - 0x60], edi
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x60]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push esi
test eax, eax
jne 0x40d2ed
call fcn.0041224d
pop ecx
jmp 0x40d289
call fcn.0041224d
pop ecx
cmp dword [ebp + 0x10], ebx
je 0x40d30f
push 0xffffffffffffffff
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp + 0x14]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x14]
call esi
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x40d329
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
push ebx
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetLastActivePopup]
test eax, eax
je 0x40d34b
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsChild]
push esi
call fcn.0040b344
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
pop ecx
xor edi, edi
push esi
call ebx
cmp eax, 0xffffffff
je 0x40d37a
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call fcn.0040b344
inc edi
cmp edi, 0xa
pop ecx
jl 0x40d35a
push esi
call ebx
inc eax
neg eax
sbb eax, eax
pop edi
inc eax
pop ebx
pop ecx
ret
Function at 0x40d387
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetLastActivePopup]
xor ebx, ebx
cmp eax, ebx
je 0x40d3b0
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsChild]
mov edi, dword [ebp + 0xc]
lea esi, [ebp - 4]
call fcn.00407f9b
mov esi, dword [ebp - 4]
push ebx
push ebx
push 2
push ebx
push 3
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp + 0xc], eax
cmp eax, 0xffffffff
jne 0x40d3ea
lea eax, [esi - 0x10]
call fcn.00408191
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
mov esi, dword [ebp + 8]
add esi, 0xa0
mov eax, dword [esi]
mov dword [ebp - 8], ebx
mov edi, dword [eax - 0xc]
sub eax, 0x10
cmp dword [eax + 0xc], 1
jle 0x40d40d
push dword [eax + 4]
push esi
call fcn.00408047
mov esi, dword [esi]
push ebx
lea eax, [ebp - 8]
push eax
push edi
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40d43b
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.00408191
mov eax, ebx
jmp 0x40d3e3
xor ebx, ebx
inc ebx
jmp 0x40d423
Function at 0x40d53e
Capabilities:
Get file version info

Disassembly:
push ebp
lea ebp, [esp - 0x1ac]
sub esp, 0x22c
mov eax, dword [0x42f080]
xor eax, ebp
mov dword [ebp + 0x1a8], eax
mov eax, dword [ebp + 0x1b4]
push ebx
push esi
push edi
mov esi, ecx
mov edi, 0x42abba
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x68], eax
call fcn.00407f9b
push 4
call fcn.004121dd
pop ecx
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x68]
xor ebx, ebx
mov dword [ebp - 0x74], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
cmp esi, ebx
je 0x40d67c
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
mov dword [ebp - 0x6c], edi
cmp edi, ebx
je 0x40d67c
push edi
push esi
push dword [ebp - 0x74]
push dword [ebp - 0x68]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x40d673
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x7c]
push eax
push str.VarFileInfoTranslation
push edi
mov dword [ebp - 0x68], ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x40d673
test dword [ebp - 0x68], 0xfffffffc
jbe 0x40d673
push 0x103
lea eax, [ebp + 0xa5]
push ebx
push eax
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x80], ebx
mov byte [ebp + 0xa4], bl
call fcn.00414930
mov eax, dword [ebp - 0x7c]
movzx ecx, word [eax + 2]
movzx eax, word [eax]
push ecx
push eax
mov esi, 0x104
push str.StringFileInfo_04x_04xCompanyName
mov ecx, esi
lea edi, [ebp + 0xa4]
call fcn.0040b550
push esi
lea eax, [ebp - 0x63]
push ebx
push eax
mov byte [ebp - 0x64], bl
call fcn.00414930
add esp, 0x24
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
mov eax, edi
push eax
push dword [ebp - 0x6c]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x40d673
mov edx, dword [ebp - 0x78]
lea eax, [ebp - 0x64]
push eax
mov ecx, esi
call fcn.00408241
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0x70]
call fcn.00407f6c
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp + 0x1a8]
mov eax, dword [ebp - 0x70]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00411d8c
add ebp, 0x1ac
leave
ret 4

Function at 0x40dc48
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
and dword [esi], 0
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40dc9d
cmp dword [ebp + 0xc], 1
je 0x40dc82
cmp dword [ebp + 0xc], 2
je 0x40dc82
push 0xd
pop eax
jmp 0x40dc9d
mov eax, dword [ebp - 4]
test edi, edi
je 0x40dc99
test eax, eax
je 0x40dc96
cmp byte [eax + edi - 1], 0
je 0x40dc99
jmp 0x40dc7d
mov byte [edi], 0
mov dword [esi], eax
xor eax, eax
leave
ret 8

Function at 0x40e011
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor ecx, ecx
or eax, 0xffffffff
cmp dword [esp + 8], ecx
jbe 0x40e041
push esi
mov edx, dword [esp + 8]
movzx edx, byte [ecx + edx]
mov esi, eax
and esi, 0xff
xor edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x430678]
inc ecx
cmp ecx, dword [esp + 0xc]
jb 0x40e01d
pop esi
not eax
ret
Function at 0x40e0a6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x40e0cf
push 0x100
call fcn.00412242
pop ecx
mov ecx, eax
call fcn.0040e044
test eax, eax
jne 0x40e0d4
push ecx
call fcn.0041224d
pop ecx
xor eax, eax
pop esi
leave
ret
push edi
xor edi, edi
cmp dword [ebp + 0xc], esi
mov dword [ebp - 4], esi
jle 0x40e147
push ebx
inc esi
and esi, 0x800000ff
jns 0x40e0f1
dec esi
or esi, 0xffffff00
inc esi
lea eax, [esi + ecx]
movzx edx, byte [eax]
add edi, edx
and edi, 0x800000ff
jns 0x40e109
dec edi
or edi, 0xffffff00
inc edi
mov dl, byte [eax]
mov bl, byte [edi + ecx]
mov byte [eax], bl
mov ebx, dword [ebp + 8]
mov byte [edi + ecx], dl
mov edx, dword [ebp - 4]
movzx eax, byte [eax]
add ebx, edx
mov dword [ebp - 4], ebx
movzx ebx, byte [edi + ecx]
add eax, ebx
and eax, 0x800000ff
jns 0x40e135
dec eax
or eax, 0xffffff00
inc eax
mov bl, byte [eax + ecx]
mov eax, dword [ebp - 4]
xor byte [eax], bl
inc edx
cmp edx, dword [ebp + 0xc]
mov dword [ebp - 4], edx
jl 0x40e0e0
pop ebx
push ecx
call fcn.0041224d
pop ecx
or eax, 0xffffffff
pop edi
jmp 0x40e0d1
Function at 0x40e966
Capabilities:
Check if file exists
Copy file
Set file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x42f080]
xor eax, ebp
mov dword [ebp + 0x88], eax
mov eax, dword [ebp + 0x94]
push esi
mov esi, 0x103
push esi
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x7b]
push 0
push eax
mov byte [ebp - 0x7c], 0
call fcn.00414930
mov eax, edi
add esp, 0xc
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40e9a8
sub eax, ecx
cmp eax, esi
jbe 0x40e9bc
push 0x6f
jmp 0x40ea40
push esi
lea eax, [ebp - 0x7c]
push edi
push eax
call fcn.00414521
lea eax, [ebp - 0x7c]
push 0x5c
push eax
call fcn.004136b9
add esp, 0x14
test eax, eax
je 0x40ea3e
mov byte [eax], 0
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 3
jge 0x40e9fa
push 0x42ac40
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push dword [ebp - 0x80]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
call esi
test eax, eax
jne 0x40ea0d
push 2
jmp 0x40ea40
lea ecx, [ebp - 0x7c]
call fcn.0040ea5e
test eax, eax
jne 0x40ea1d
push 0x52
jmp 0x40ea40
push edi
call esi
test eax, eax
je 0x40ea30
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
push edi
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
jmp 0x40ea48
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [ebp + 0x88]
xor ecx, ebp
pop esi
call fcn.00411d8c
add ebp, 0x8c
leave
ret
Function at 0x40ea5e
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x10c
mov eax, dword [0x42f080]
xor eax, esp
mov dword [esp + 0x108], eax
push ebp
push esi
push edi
mov edi, 0x103
push edi
lea eax, [esp + 0x15]
push 0
push eax
mov esi, ecx
mov dword [esp + 0x18], 1
mov byte [esp + 0x1c], 0
call fcn.00414930
add esp, 0xc
test esi, esi
je 0x40eabc
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
call ebp
test eax, eax
jle 0x40eabc
push esi
call ebp
cmp eax, 0x104
jbe 0x40ead6
push 0x6f
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [esp + 0x114]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.00411d8c
add esp, 0x10c
ret
push ebx
push edi
push esi
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.SHLWAPI.dll_PathSkipRootA]
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebp, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x40eb13
push 0x5c
push eax
call fcn.00413134
pop ecx
pop ecx
mov esi, eax
jmp 0x40eb15
xor esi, esi
lea eax, [esp + 0x14]
push eax
test esi, esi
je 0x40eb73
mov byte [esi], 0
call edi
cmp eax, 0xffffffff
je 0x40eb2c
test al, 0x10
jne 0x40eb6b
test al, 0x10
jne 0x40eb43
push 0x80
lea eax, [esp + 0x18]
push eax
call ebp
lea eax, [esp + 0x14]
push eax
call ebx
push 0
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
and dword [esp + 0x10], eax
jne 0x40eb6b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40eb6b
mov dword [esp + 0x10], 1
mov byte [esi], 0x5c
lea eax, [esi + 1]
jmp 0x40eb01
call edi
cmp eax, 0xffffffff
je 0x40eb7e
test al, 0x10
jne 0x40ebbd
test al, 0x10
jne 0x40eb95
push 0x80
lea eax, [esp + 0x18]
push eax
call ebp
lea eax, [esp + 0x14]
push eax
call ebx
push 0
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
and dword [esp + 0x10], eax
jne 0x40ebbd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40ebbd
mov dword [esp + 0x10], 1
mov eax, dword [esp + 0x10]
pop ebx
jmp 0x40eabe

Function at 0x40ebe7
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push 0x3c
lea eax, [ebp - 0x3c]
push 0
push eax
call fcn.00414930
mov eax, dword [ebp + 8]
and dword [ebp - 0x38], 0
and dword [ebp - 0x34], 0
and dword [ebp - 0x24], 0
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
add esp, 0xc
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x30], str.runas
mov dword [ebp - 0x20], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
leave
ret
Function at 0x40fcb8
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [ebx + 0xa0], edi
jbe 0x40fd82
mov eax, dword [ebx + 0x9c]
mov eax, dword [eax]
mov dword [ebp - 8], eax
mov eax, dword [ebx + 0x88]
mov dword [ebp - 0xc], eax
mov esi, dword [ebx + 0x9c]
mov eax, dword [ebx + 0x88]
cmp dword [ebp - 0xc], edi
je 0x40fcfb
cmp dword [ebp - 0xc], eax
je 0x40fd00
call fcn.004123b5
cmp dword [ebp - 8], esi
je 0x40fd82
lea esi, [ebp - 0xc]
call fcn.004106b3
mov eax, dword [eax]
cmp byte [eax + 0x38], 0
je 0x40fd56
cmp dword [eax + 0x34], 0x10
jb 0x40fd20
mov eax, dword [eax + 0x20]
jmp 0x40fd23
add eax, 0x20
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
push edi
add esi, 0x1800
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40fd6d
cmp dword [eax + 0x3c], edi
je 0x40fd68
mov eax, dword [eax + 0x40]
lea esi, [eax + 0x1800]
cmp eax, edi
jne 0x40fd6d
mov esi, 0x2000
add dword [ebp - 4], esi
lea edi, [ebp - 0x14]
lea esi, [ebp - 0xc]
call fcn.004106de
xor edi, edi
jmp 0x40fce5
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret
Function at 0x411d8c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42f080]
jne 0x411d96
repz ret
jmp fcn.00414b9c

Function at 0x4217ba
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00416fbe
and dword [ebp - 4], 0
cmp dword [0x431a78], 0
mov ebx, eax
jne 0x42186b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x42191c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x42191c
push eax
call fcn.00416f4c
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x431a78], eax
call esi
push eax
call fcn.00416f4c
mov dword [esp], 0x42a638
push edi
mov dword [0x431a7c], eax
call esi
push eax
call fcn.00416f4c
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x431a80], eax
call esi
push eax
call fcn.00416f4c
pop ecx
mov dword [0x431a88], eax
test eax, eax
je 0x42186b
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00416f4c
pop ecx
mov dword [0x431a84], eax
mov eax, dword [0x431a84]
cmp eax, ebx
je 0x4218c3
cmp dword [0x431a88], ebx
je 0x4218c3
push eax
call fcn.00416fc7
push dword [0x431a88]
mov esi, eax
call fcn.00416fc7
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4218c3
test edi, edi
je 0x4218c3
call esi
test eax, eax
je 0x4218ba
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4218ba
test byte [ebp - 0xc], 1
jne 0x4218c3
or dword [ebp + 0x10], 0x200000
jmp 0x4218fc
mov eax, dword [0x431a7c]
cmp eax, ebx
je 0x4218fc
push eax
call fcn.00416fc7
pop ecx
test eax, eax
je 0x4218fc
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4218fc
mov eax, dword [0x431a80]
cmp eax, ebx
je 0x4218fc
push eax
call fcn.00416fc7
pop ecx
test eax, eax
je 0x4218fc
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x431a78]
call fcn.00416fc7
pop ecx
test eax, eax
je 0x42191c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x42191e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret