joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407250
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x60
push esi
push edi
push str.RunApp
push 0x473b64
push 0x80
call fcn.00431310
add esp, 0x10
test ebx, ebx
je 0x40734a
mov eax, ebx
lea edx, [eax + 1]
test edi, edi
je 0x4072c4
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407280
sub eax, edx
mov edx, eax
mov eax, edi
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407290
sub eax, esi
add eax, edx
lea eax, [eax + eax + 4]
push eax
call fcn.00441dab
mov esi, eax
add esp, 4
test esi, esi
je 0x40734a
push edi
push ebx
push str.__s___s
push esi
call fcn.004439fb
add esp, 0x10
jmp 0x4072ef
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4072c4
sub eax, edx
lea ecx, [eax + eax + 4]
push ecx
call fcn.00441dab
mov esi, eax
add esp, 4
test esi, esi
je 0x40734a
push ebx
push 0x473b78
push esi
call fcn.004439fb
add esp, 0xc
push 0x44
lea edx, [esp + 0x1c]
push 0
push edx
call fcn.00446e10
add esp, 0xc
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], 0x44
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
xor eax, eax
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x1c]
push edx
push eax
push eax
push eax
push eax
push eax
push eax
push esi
push eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push esi
test eax, eax
jne 0x407351
call fcn.00443398
add esp, 4
xor eax, eax
pop esi
add esp, 0x60
ret
push str.RunApp
push str._s_param_s
push 0x80
call fcn.00431310
push esi
call fcn.00443398
add esp, 0x14
cmp dword [esp + 0x68], 0
je 0x407392
mov eax, dword [esp + 8]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0x6c]
mov edx, dword [esp + 8]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 8]
push ecx
call esi
mov eax, 1
pop esi
add esp, 0x60
ret
Function at 0x407720
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileA]
push ebp
push esi
push edi
push 0
push 0x80
push 2
push 0
push 2
mov edi, eax
push 0x40000000
push edi
mov dword [esp + 0x2c], 0
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x4077b9
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
call ebp
push eax
push str.ReleaseRes_CreateFile_Failed_ErrorCode__d_File_s
push 0x80
call fcn.00431310
add esp, 0x10
mov ecx, edi
call fcn.00406780
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push edi
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x4077b9
push edi
call ebp
push eax
push str.ReleaseRes_2_CreateFile_Failed_ErrorCode__d_File_s
push 0x80
call fcn.00431310
add esp, 0x10
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0x474724
push 0x65
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push edi
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0
lea ecx, [esp + 0x14]
push ecx
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
Function at 0x407800
Capabilities:
Get disk size

Disassembly:
sub esp, 0x1d0
mov eax, dword [0x483390]
xor eax, esp
mov dword [esp + 0x1cc], eax
push ebx
push ebp
mov ebp, dword [esp + 0x1dc]
push esi
push edi
lea eax, [esp + 0x38]
xor ebx, ebx
push eax
xor esi, esi
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x407983
push 0x473a1c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp eax, ebx
je 0x407983
cmp dword [esp + 0x3c], 4
jne 0x4078eb
cmp dword [esp + 0x40], ebx
jne 0x4078eb
push 0x473c64
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x407983
push ebp
lea ecx, [esp + 0xd4]
push ecx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x18], ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0xd0]
push 0x5c
push edx
call fcn.00443ab0
add esp, 8
mov byte [eax + 1], bl
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0xe0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
mov esi, dword [esp + 0x1c]
imul esi, dword [esp + 0x28]
imul esi, dword [esp + 0x20]
mov dword [esp + 0x34], ebx
jmp 0x407983
push str.GetDiskFreeSpaceExA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
cmp edi, ebx
je 0x407983
push 0x103
lea edx, [esp + 0xd5]
push ebx
push edx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov byte [esp + 0xdc], bl
call fcn.00446e10
add esp, 0xc
push ebp
lea eax, [esp + 0xd4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0xd0]
push 0x5c
push ecx
call fcn.00443ab0
add esp, 8
lea edx, [esp + 0x10]
push edx
mov byte [eax + 1], bl
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0xdc]
push edx
call edi
test eax, eax
je 0x407983
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
mov dword [esp + 0x34], eax
mov ecx, dword [esp + 0x1dc]
mov edx, dword [esp + 0x34]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004426a0
add esp, 0x1d0
ret
Function at 0x409a10
Capabilities:
Set current directory

Disassembly:
push esi
push edi
mov esi, eax
push esi
push str.CRsWork::SwitchLoadDLLDir
push str._s...DIr_s_BAlreadyWitch__d
push 0x80
call fcn.00431310
add esp, 0x14
push str.SetDllDirectoryA
push 0x473a1c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x409a56
test edi, edi
je 0x409a51
push 0
call eax
jmp 0x409a5d
push esi
call eax
jmp 0x409a5d
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov esi, eax
push esi
push str.CRsWork::SwitchLoadDLLDir
push str._s...return__d
push 0x80
call fcn.00431310
add esp, 0x10
mov eax, esi
pop esi
ret
Function at 0x40ab20
Capabilities:
Check if file exists
Get file attributes
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x46e91b
mov eax, dword fs:[0]
push eax
sub esp, 0x118
mov eax, dword [0x483390]
xor eax, esp
mov dword [esp + 0x114], eax
push ebx
push esi
mov eax, dword [0x483390]
xor eax, esp
push eax
lea eax, [esp + 0x124]
mov dword fs:[0], eax
push str.CRsWork::GetInstalledPath
push 0x473ab0
push 0x80
call fcn.00431310
add esp, 0xc
lea eax, [esp + 0x10]
push eax
mov ecx, 0x473127
call fcn.00403130
xor ebx, ebx
push 0x103
lea ecx, [esp + 0x21]
push ebx
mov dword [esp + 0x134], ebx
push ecx
mov byte [esp + 0x28], bl
call fcn.00446e10
add esp, 0xc
lea edx, [esp + 0xc]
push edx
push str.SOFTWARE_risingRAV
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x40ac6d
mov ecx, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x14]
push eax
push ebx
push ebx
push ebx
push str.installpath
push ecx
mov dword [esp + 0x30], ebx
call esi
test eax, eax
jne 0x40ac6d
cmp dword [esp + 0x14], ebx
je 0x40ac6d
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x20]
push eax
push ebx
push str.installpath
push ecx
call esi
test eax, eax
jne 0x40ac6d
lea edx, [esp + 0x1c]
mov ebx, edi
call fcn.004031f0
lea eax, [esp + 0x1c]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x40ac20
mov edx, dword [str._rsmain.exe]
mov ecx, dword [0x473394]
mov dword [eax], edx
mov edx, dword [0x473398]
mov dword [eax + 4], ecx
mov dword [eax + 8], edx
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40ac6d
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x10]
call fcn.004031d0
mov eax, 1
jmp 0x40aca5
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x12c], 0xffffffff
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40aca3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x124]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.004426a0
add esp, 0x124
ret
Function at 0x40b080
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x124
mov eax, dword [0x483390]
xor eax, esp
mov dword [esp + 0x120], eax
push ebx
push str.CRsWork::IsEnoughToInstall
push 0x473ab0
push 0x80
call fcn.00431310
add esp, 0xc
xor ebx, ebx
push 0x103
lea eax, [esp + 0x1d]
push ebx
push eax
mov byte [esp + 0x24], bl
call fcn.00446e10
mov eax, dword [ebp + 8]
lea edx, [esp + 0x24]
add esp, 0xc
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x40b0d4
lea ecx, [esp + 0x18]
push ecx
mov byte [esp + 0x1e], bl
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
je 0x40b128
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40b111
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x120]
xor ecx, esp
call fcn.004426a0
mov esp, ebp
pop ebp
ret 4
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x28]
push edx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x40b1a9
mov eax, dword [esp + 0xc]
shr eax, 0xa
imul eax, dword [esp + 8]
imul eax, dword [esp + 4]
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
test eax, eax
jge 0x40b17e
fadd qword [0x477ed8]
fmul qword [0x477ed0]
fcomp qword [0x477ec8]
fnstsw ax
test ah, 5
jp 0x40b1a9
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x40b105
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40b1c8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x124]
pop ebx
xor ecx, esp
mov eax, 1
call fcn.004426a0
mov esp, ebp
pop ebp
ret 4
Function at 0x40c5c0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x61c
mov eax, dword [0x483390]
xor eax, esp
mov dword [esp + 0x618], eax
push ebp
push esi
push edi
push 0x103
lea eax, [esp + 0x115]
push 0
push eax
mov byte [esp + 0x11c], 0
call fcn.00446e10
push 0x40f
lea ecx, [esp + 0x225]
push 0
push ecx
mov byte [esp + 0x22c], 0
call fcn.00446e10
mov edx, dword [esp + 0x648]
push 0x47321c
push edx
call fcn.00442f26
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebp, dword [esp + 0x650]
add esp, 0x20
lea eax, [esp + 0x110]
push eax
call edi
lea ecx, [esp + 0x110]
mov esi, 0x103
push ecx
sub esi, eax
call edi
lea edi, [esp + eax + 0x110]
test esi, esi
je 0x40c681
cmp esi, 0x7fffffff
ja 0x40c681
lea edx, [esp + 0x634]
push edx
push ebp
dec esi
push esi
push edi
call fcn.00443456
add esp, 0x10
test eax, eax
jl 0x40c67d
cmp eax, esi
ja 0x40c67d
jne 0x40c681
mov byte [esi + edi], 0
mov ecx, 6
mov esi, str._RAPInstall__install.exe_
lea edi, [esp + 0x214]
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x110]
movsw word es:[edi], word [esi]
mov edx, eax
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c6a0
lea edi, [esp + 0x214]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40c6b1
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0x103
lea eax, [esp + 0x11]
and ecx, 3
push 0
push eax
rep movsb byte es:[edi], byte [esi]
mov byte [esp + 0x18], 0
call fcn.00446e10
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
pop edi
pop esi
pop ebp
test eax, eax
jne 0x40c70e
push 0x104
push str.C:Temp
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea eax, [esp]
push 0x5c
push eax
call fcn.00443381
add esp, 8
test eax, eax
je 0x40c729
cmp byte [eax + 1], 0
jne 0x40c729
mov byte [eax], 0
lea eax, [esp]
dec eax
lea ecx, [ecx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x40c730
mov ecx, dword [str.RsInstall.log]
mov edx, dword [0x4732dc]
mov dword [eax], ecx
mov ecx, dword [0x4732e0]
mov dword [eax + 4], edx
mov dx, word [0x4732e4]
mov dword [eax + 8], ecx
mov cl, byte [0x4732e6]
mov word [eax + 0xc], dx
mov byte [eax + 0xe], cl
mov ecx, dword [esp + 0x620]
lea edx, [esp + 0x208]
push edx
lea eax, [esp + 4]
push eax
push 1
push ecx
call fcn.00401ad0
mov ecx, dword [esp + 0x628]
add esp, 0x10
xor ecx, esp
call fcn.004426a0
add esp, 0x61c
ret
Function at 0x40c7a0
Capabilities:
Create process memory minidump

Disassembly:
sub esp, 0xc
push esi
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40c7e1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x47495c
push 4
call fcn.0040c5c0
add esp, 0xc
xor eax, eax
pop esi
add esp, 0xc
ret
mov ecx, dword [esp + 0x14]
push edi
mov dword [esp + 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push 0
lea edx, [esp + 0x10]
push edx
push 0
push esi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x24], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call sub.dbghelp.dll_MiniDumpWriteDump
mov edi, eax
test edi, edi
jne 0x40c837
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x47495c
push 4
call fcn.0040c5c0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
add esp, 0xc
ret
Function at 0x40d510
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46c718
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x483390]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov dword [esp + 8], 0
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push eax
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x30]
push edx
push eax
mov dword [esp + 0x24], 0
call fcn.0040d390
mov esi, eax
mov dword [esp + 0x24], 0xffffffff
mov eax, dword [esp + 0x18]
add esp, 0x10
test eax, eax
je 0x40d57c
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x40d670
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 0xc]
cmp eax, 0x400000
jbe 0x40d680
mov eax, 0x400000
mov edx, dword [esp + 8]
push 0
lea ecx, [esp + 0x10]
push ecx
push eax
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0xc]
push edx
push ecx
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x10]
test eax, eax
setne al
test ecx, ecx
je 0x40d6b6
mov edx, dword [esp + 0xc]
mov dword [ecx], edx
test al, al
je 0x40d6bf
xor eax, eax
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x40d6d1
mov eax, 0x80004005
ret 0x10
jle 0x40d6dd
and eax, 0xffff
or eax, 0x80070000
ret 0x10

Function at 0x40d790
Capabilities:
Get file size

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [ecx + 8]
push esi
push edi
lea eax, [esp + 0xc]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40d7b8
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
test eax, eax
jne 0x40d7e0
mov eax, dword [esp + 0xc]
push 1
push 0
push 0
push eax
call fcn.004542e0
mov ecx, eax
xor eax, eax
add ecx, esi
adc edx, eax
mov eax, dword [esp + 0x10]
pop edi
mov dword [eax], ecx
mov dword [eax + 4], edx
xor eax, eax
pop esi
ret 8
call edi
test eax, eax
jne 0x40d7f0
pop edi
mov eax, 0x80004005
pop esi
ret 8
jle 0x40d7fc
and eax, 0xffff
or eax, 0x80070000
pop edi
pop esi
ret 8

Function at 0x40d810
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 0xc]
cmp eax, 0x400000
jbe 0x40d820
mov eax, 0x400000
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
push 0
lea ecx, [esp + 0x14]
push ecx
push eax
mov eax, dword [esi + 8]
push edx
push eax
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x14]
test eax, eax
mov eax, dword [esp + 0x10]
setne dl
add dword [esi + 0x10], eax
adc dword [esi + 0x14], 0
pop esi
test ecx, ecx
je 0x40d85f
mov dword [ecx], eax
test dl, dl
je 0x40d868
xor eax, eax
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x40d87a
mov eax, 0x80004005
ret 0x10
jle 0x40d886
and eax, 0xffff
or eax, 0x80070000
ret 0x10
Function at 0x40e710
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46c6e8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x483390]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, ecx
lea esi, [edi + 4]
push esi
mov dword [esp + 0x14], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [esp + 0x28]
push 0
push 0
push edx
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], 0
mov eax, dword [edi]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x10]
call eax
mov ebx, eax
test ebx, ebx
je 0x40e788
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 0x14
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
mov edi, dword [edi]
mov ecx, dword [edi]
push edx
mov edx, dword [esp + 0x30]
push eax
mov eax, dword [ecx + 0xc]
push edx
push edi
call eax
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 0x14

Function at 0x40f280
Capabilities:
Create thread

Disassembly:
push ecx
lea eax, [esp]
push eax
push 0
push ecx
push 0x40f2c0
push 0
push 0
call fcn.00444702
mov edx, dword [esp + 0x20]
add esp, 0x18
mov dword [edx], eax
test eax, eax
je 0x40f2a9
xor eax, eax
pop ecx
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x40f2b8
mov eax, 1
pop ecx
ret 4
Function at 0x40f820
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [esp + 0xc]
sub esp, 8
push ebp
push esi
mov esi, dword [ecx]
xor ebp, ebp
and esi, 7
cmp eax, 5
jae 0x40f83d
pop esi
xor eax, eax
pop ebp
add esp, 8
ret
mov edx, dword [esp + 0x14]
add dword [esp + 0x18], 5
push ebx
lea ebx, [edx + eax - 4]
push edi
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x14], ebx
lea edi, [edx + ebp]
cmp edi, ebx
jae 0x40f86d
nop
mov al, byte [edi]
and al, 0xfe
cmp al, 0xe8
je 0x40f86d
inc edi
cmp edi, ebx
jb 0x40f860
mov ebp, edi
sub ebp, edx
mov eax, ebp
sub eax, dword [esp + 0x10]
cmp edi, ebx
jae 0x40f96c
cmp eax, 3
jbe 0x40f8a0
xor esi, esi
mov al, byte [edi + 4]
mov dword [esp + 0x10], ebp
test al, al
je 0x40f8d8
cmp al, 0xff
je 0x40f8d8
and esi, 3
add esi, esi
or esi, 1
inc ebp
jmp 0x40f858
lea ecx, [eax - 1]
shl esi, cl
and esi, 7
je 0x40f886
movzx ecx, byte [esi + 0x4752e8]
mov eax, edi
sub eax, ecx
cmp byte [esi + 0x4752e0], 0
mov al, byte [eax + 4]
je 0x40f8c9
test al, al
je 0x40f8c9
cmp al, 0xff
jne 0x40f886
and esi, 3
add esi, esi
mov dword [esp + 0x10], ebp
or esi, 1
inc ebp
jmp 0x40f858
movzx ecx, byte [edi + 3]
movzx edx, al
movzx eax, byte [edi + 2]
shl edx, 8
or edx, ecx
movzx ecx, byte [edi + 1]
shl edx, 8
or edx, eax
shl edx, 8
or edx, ecx
sub edx, ebp
sub edx, dword [esp + 0x20]
mov eax, edx
test esi, esi
je 0x40f93e
movzx edx, byte [esi + 0x4752e8]
add edx, edx
add edx, edx
add edx, edx
mov ecx, 0x18
sub ecx, edx
mov ebx, eax
shr ebx, cl
test bl, bl
je 0x40f923
cmp bl, 0xff
jne 0x40f93a
mov ebx, dword [esp + 0x14]
mov ecx, 0x20
sub ecx, edx
mov edx, 1
shl edx, cl
dec edx
xor edx, eax
jmp 0x40f8f6
mov ebx, dword [esp + 0x14]
mov edx, eax
shr edx, 0x18
and dl, 1
dec dl
not dl
mov byte [edi + 4], dl
mov edx, eax
shr edx, 8
mov ecx, eax
shr ecx, 0x10
mov byte [edi + 2], dl
mov edx, dword [esp + 0x1c]
mov byte [edi + 3], cl
mov byte [edi + 1], al
add ebp, 5
jmp 0x40f858
pop edi
pop ebx
cmp eax, 3
jbe 0x40f983
mov eax, dword [esp + 0x1c]
xor esi, esi
mov dword [eax], esi
pop esi
mov eax, ebp
pop ebp
add esp, 8
ret
lea ecx, [eax - 1]
mov eax, dword [esp + 0x1c]
shl esi, cl
and esi, 7
mov dword [eax], esi
pop esi
mov eax, ebp
pop ebp
add esp, 8
ret

Function at 0x413a50
Capabilities:
Set file attributes

Disassembly:
sub esp, 0xc
cmp byte [0x5873c0], 0
push ebx
push esi
mov esi, eax
mov ebx, ecx
jne 0x413a90
lea ecx, [esp + 8]
call fcn.004134a0
mov eax, dword [eax]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov esi, eax
mov eax, dword [esp + 8]
push eax
call fcn.00443398
add esp, 4
test esi, esi
je 0x413aa4
pop esi
mov al, 1
pop ebx
add esp, 0xc
ret
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x413aa4
pop esi
mov al, 1
pop ebx
add esp, 0xc
ret
pop esi
xor al, al
pop ebx
add esp, 0xc
ret
Function at 0x413e70
Capabilities:
Delete file

Disassembly:
sub esp, 0xc
push ebx
mov ebx, eax
xor eax, eax
mov ecx, ebx
call fcn.00413a50
test al, al
je 0x413ecc
cmp byte [0x5873c0], 0
jne 0x413eba
push esi
lea ecx, [esp + 8]
call fcn.004134a0
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, eax
mov eax, dword [esp + 8]
push eax
call fcn.00443398
add esp, 4
test esi, esi
pop esi
je 0x413ecc
mov al, 1
pop ebx
add esp, 0xc
ret
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x413ecc
mov al, 1
pop ebx
add esp, 0xc
ret
xor al, al
pop ebx
add esp, 0xc
ret

Function at 0x413fd0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x46c010
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebp
push esi
push edi
mov eax, dword [0x483390]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x38]
mov esi, ecx
mov eax, dword [esi]
mov dword [ebp + 0x20], eax
mov ecx, dword [esi + 4]
mov dword [ebp + 8], ecx
mov edx, dword [esi + 8]
mov dword [ebp + 0xc], edx
mov eax, dword [esi + 0xc]
mov dword [ebp + 0x10], eax
mov ecx, dword [esi + 0x10]
mov dword [ebp + 0x14], ecx
mov edx, dword [esi + 0x14]
push 1
mov dword [ebp + 0x18], edx
mov eax, dword [esi + 0x18]
push 0
mov dword [ebp + 0x1c], eax
mov ecx, dword [esi + 0x1c]
push 0
push ecx
call fcn.004542e0
mov ecx, dword [esi + 0x20]
xor edi, edi
add eax, ecx
adc edx, edi
add esi, 0x2c
push esi
lea esi, [esp + 0x14]
mov dword [ebp], eax
mov dword [ebp + 4], edx
mov byte [ebp + 0x24], 0
call fcn.00404f40
mov ecx, esi
lea esi, [esp + 0x1c]
mov dword [esp + 0x30], edi
call fcn.00403920
mov edi, eax
lea eax, [ebp + 0x28]
mov byte [esp + 0x30], 1
call fcn.00404ea0
mov edx, dword [esp + 0x1c]
push edx
call fcn.00443398
mov eax, dword [esp + 0x14]
push eax
call fcn.00443398
add esp, 8
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x24
ret