joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40852b
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
mov edi, ecx
lea ecx, [edi + 0x18]
mov dword [ebp - 4], edi
mov dword [ebp - 0xc], ecx
call fcn.00446bf3
xor ebx, ebx
cmp dword [edi + 0x38], ebx
jbe 0x4085bd
add edi, 0x30
push esi
mov eax, dword [edi]
push dword [ebp + 8]
mov esi, ebx
shl esi, 2
mov ecx, dword [esi + eax]
add ecx, 4
call fcn.004a1101
test al, al
mov eax, dword [edi]
jne 0x40859c
mov ecx, dword [esi + eax]
add ecx, 8
call fcn.004a0ff9
push 0x28
push dword [ebp + 8]
push eax
call sub.msvcrt.dll_wcsncmp
add esp, 0xc
test eax, eax
jne 0x4085b3
mov eax, dword [edi]
mov ecx, dword [esi + eax]
add ecx, 4
call fcn.004a0ff9
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [edi]
mov esi, dword [esi + eax]
push 4
push 1
push ebx
mov ecx, edi
call fcn.004a0be8
mov ecx, esi
call fcn.00406bc3
dec ebx
mov eax, dword [ebp - 4]
inc ebx
cmp ebx, dword [eax + 0x38]
jb 0x40854e
pop esi
mov ecx, dword [ebp - 0xc]
call fcn.00446c71
pop edi
pop ebx
leave
ret 4

Function at 0x40917b
Capabilities:
Hide graphical window

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, ecx
mov eax, dword [esi + 4]
mov ebp, 0x6b5
push ebp
push eax
call edi
xor ebx, ebx
push ebx
push ebx
push 0x40a
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esi + 4]
push 0x6b3
push eax
call edi
push ebx
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebx
mov eax, dword [esi + 4]
push 0x6af
push eax
call edi
push 0
push eax
call ebx
mov eax, dword [esi + 4]
push ebp
push eax
call edi
push 0
push eax
call ebx
mov eax, dword [esi + 4]
push 0x6b1
push eax
call edi
push 5
push eax
call ebx
mov esi, dword [esi + 4]
push 0x6b4
push esi
call edi
push 5
push eax
call ebx
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x40991a
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [ebp + 0x10], 0
push ebx
push esi
mov ebx, edx
push edi
mov dword [ebp - 4], ebx
mov esi, ecx
mov edi, 0x553900
jne 0x409938
mov edi, 0x5538b8
mov eax, ebx
push 3
shl eax, 2
xor edx, edx
pop ecx
div ecx
mov dword [ebp + 0x10], 0x80000001
mov ecx, eax
add ecx, 5
cmp byte [ebp + 0xc], 0
je 0x40996a
mov eax, ebx
push 0x16
xor edx, edx
pop ebx
div ebx
and dword [ebp + 0x10], 0
mov ebx, dword [ebp - 4]
lea ecx, [ecx + eax + 2]
call fcn.00479b81
mov ecx, eax
mov dword [ebp + 0xc], ecx
lea ebx, [esi + ebx - 3]
jmp 0x4099da
movzx edx, byte [esi]
movzx eax, byte [esi + 1]
shl edx, 8
add edx, eax
movzx eax, byte [esi + 2]
shl edx, 8
add edx, eax
mov eax, edx
shr eax, 0x12
mov al, byte [eax + edi]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
mov al, byte [eax + edi]
mov byte [ecx + 1], al
mov eax, edx
shr eax, 6
and eax, 0x3f
mov al, byte [eax + edi]
and edx, 0x3f
mov byte [ecx + 2], al
mov al, byte [edx + edi]
add esi, 3
mov byte [ecx + 3], al
add ecx, 4
inc dword [ebp + 0x10]
cmp dword [ebp + 0x10], 0xf
jne 0x4099da
mov byte [ecx], 0xd
mov byte [ecx + 1], 0xa
inc ecx
inc ecx
and dword [ebp + 0x10], 0
cmp esi, ebx
jbe 0x40997a
lea eax, [ebx + 2]
cmp esi, eax
jne 0x409a04
movzx edx, byte [esi]
shl edx, 4
mov eax, edx
shr eax, 6
mov al, byte [eax + edi]
and edx, 0x3f
mov byte [ecx], al
mov al, byte [edx + edi]
mov byte [ecx + 1], al
mov byte [ecx + 2], 0x3d
jmp 0x409a39
inc ebx
cmp esi, ebx
jne 0x409a43
movzx edx, byte [esi]
movzx eax, byte [esi + 1]
shl edx, 8
add edx, eax
shl edx, 2
mov eax, edx
shr eax, 0xc
mov al, byte [eax + edi]
mov byte [ecx], al
mov eax, edx
shr eax, 6
and eax, 0x3f
mov al, byte [eax + edi]
and edx, 0x3f
mov byte [ecx + 1], al
mov al, byte [edx + edi]
mov byte [ecx + 2], al
mov byte [ecx + 3], 0x3d
add ecx, 4
inc dword [ebp + 0x10]
cmp dword [ebp + 0x10], 0
pop edi
pop esi
pop ebx
jle 0x409a55
mov byte [ecx], 0xd
mov byte [ecx + 1], 0xa
inc ecx
inc ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x409a63
mov edx, ecx
sub edx, dword [ebp + 0xc]
mov dword [eax], edx
mov byte [ecx], 0
mov eax, dword [ebp + 0xc]
leave
ret 0xc
Function at 0x42386d
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
push ebx
push esi
push edi
mov edi, ecx
lea ecx, [ebp - 0x14]
call fcn.004a0e93
lea eax, [ebp - 8]
mov esi, 0x88ddec
push eax
mov ecx, esi
call fcn.00409044
mov ecx, edi
call fcn.004a0ff9
mov ecx, dword [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0040863b
mov eax, dword [ebp - 0x10]
neg eax
sbb eax, eax
test eax, fcn.00466ca2
jne 0x4238fc
lea eax, [ebp - 8]
push eax
mov ecx, esi
call fcn.00409044
mov ecx, dword [ebp - 8]
call fcn.00441612
lea eax, [ebp - 8]
push eax
mov ecx, esi
call fcn.00409044
mov ecx, edi
call fcn.004a0ff9
mov ecx, dword [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
call fcn.0040863b
push eax
lea ecx, [ebp - 0x10]
call fcn.00423839
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x4238fc
call fcn.00406bc3
mov ecx, edi
call fcn.004a0ff9
mov ecx, eax
call fcn.004a4ba7
lea ecx, [ebp - 0xc]
call fcn.004a0e93
lea eax, [ebp - 4]
push eax
mov ecx, esi
call fcn.00409044
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
lea esi, [edi + 4]
call fcn.0043a7f8
push eax
mov ecx, esi
call fcn.004a0ff9
push eax
lea ecx, [ebp - 0x64]
call fcn.00425573
lea ecx, [ebp - 4]
call fcn.004a0e93
push eax
lea ecx, [ebp - 0x64]
call fcn.00425bc5
lea ecx, [ebp - 4]
mov ebx, eax
call fcn.004a0c7d
test ebx, ebx
jne 0x423971
push 0x517834
lea ecx, [ebp - 0xc]
call fcn.004a1101
test al, al
jne 0x4239cd
push 0x100
lea edx, [ebp - 0x264]
mov ecx, ebx
call fcn.004b922b
push 0
push 0
lea ecx, [ebp - 0xc]
call fcn.004a0ff9
push eax
push ebx
lea eax, [ebp - 0x264]
push eax
mov ecx, edi
call fcn.004a0ff9
push eax
lea eax, [ebp - 4]
push 0x512bf0
push eax
call fcn.004a1618
add esp, 0x18
mov ecx, eax
call fcn.004a0ff9
push eax
push dword [0x88f7f8]
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 4]
call fcn.004a0c7d
mov ecx, esi
call fcn.004a0ff9
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test edi, edi
je 0x4239ed
mov ecx, edi
call fcn.0040d782
push edi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
lea ecx, [ebp - 0x64]
call fcn.0042500d
lea ecx, [ebp - 0xc]
call fcn.004a0c7d
mov ecx, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
test ecx, ecx
je 0x423a0c
call fcn.00406bc3
lea ecx, [ebp - 0x14]
call fcn.004a0c7d
leave
ret
Function at 0x423a16
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
lea ebx, [edi + 0xc]
mov esi, 0x510d20
push esi
mov ecx, ebx
call fcn.004a0f85
test al, al
jne 0x423c02
push dword [0x890128]
mov ecx, ebx
call fcn.004a0f85
test al, al
jne 0x423c02
push 0x512d50
mov ecx, ebx
call fcn.004a0f85
test al, al
je 0x423a66
push esi
mov ecx, ebx
call fcn.004a0eb9
mov ecx, ebx
call fcn.004a0e99
mov edx, eax
mov ecx, 0x890128
call fcn.0049fe6d
lea ecx, [ebp - 0xc]
call fcn.004a0e93
lea eax, [ebp - 0xc]
lea ecx, [edi + 8]
push eax
call fcn.004a0ff9
mov edx, eax
lea ecx, [ebp - 8]
call fcn.00408336
mov eax, dword [ebp - 8]
neg eax
sbb eax, eax
test eax, fcn.00466ca2
jne 0x423abf
lea ecx, [ebp - 0xc]
call fcn.004a0ff9
push eax
push 0x512d14
call fcn.004263e6
pop ecx
pop ecx
jmp 0x423bee
push 0
lea esi, [edi + 4]
push esi
lea eax, [edi + 8]
push eax
lea edx, [ebp - 8]
lea ecx, [ebp - 4]
call fcn.004cfe9f
lea ecx, [ebp - 4]
call fcn.004a1005
lea ecx, [ebp - 4]
test eax, eax
je 0x423be9
lea eax, [ebp - 0xc]
push eax
call fcn.004a0ff9
mov edx, eax
lea ecx, [ebp - 0x14]
call fcn.00408336
push eax
lea ecx, [ebp - 8]
call fcn.00423839
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x423b0f
call fcn.00406bc3
mov ecx, esi
call fcn.004a0e99
mov edx, eax
lea ecx, [ebp - 0x10]
call fcn.00422f63
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x10]
call fcn.004082d7
test al, al
jne 0x423b73
lea ecx, [ebp - 4]
call fcn.004a0ff9
push eax
lea ecx, [ebp - 0x10]
call fcn.004a0ff9
push eax
lea eax, [ebp - 0x14]
push 0x512c80
push eax
call fcn.004a1618
add esp, 0x10
push 0
push 0x512c40
lea ecx, [ebp - 0x14]
call fcn.004a0ff9
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0x14]
call fcn.004a0c7d
lea ecx, [ebp - 4]
call fcn.004a0ff9
mov ecx, eax
call fcn.004a4ba7
mov ecx, ebx
mov esi, eax
call fcn.004a0ea5
test eax, eax
je 0x423ba0
mov ecx, ebx
call fcn.004a0e99
lea ecx, [esi + 8]
mov edx, eax
call fcn.0049fe6d
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x88ddec
call fcn.00409044
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 8]
push eax
call fcn.00408fd8
lea ecx, [edi + 8]
call fcn.004a0ff9
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0
push 0x8037
push dword [0x890598]
call dword [sym.imp.USER32.dll_PostMessageW]
lea ecx, [ebp - 0x10]
call fcn.004a0c7d
lea ecx, [ebp - 4]
call fcn.004a0c7d
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x423bfa
call fcn.00406bc3
lea ecx, [ebp - 0xc]
call fcn.004a0c7d
test edi, edi
je 0x423c14
mov ecx, edi
call fcn.00422d43
push edi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42423b
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x26c
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [ebp - 0xc]
call fcn.004a0e93
lea ecx, [ebp - 0x20]
call fcn.004a0e93
lea ecx, [ebp - 0x1c]
call fcn.004a0e93
lea ecx, [ebp - 8]
call fcn.004a0e93
lea edi, [esi + 0x2c]
mov ecx, edi
call fcn.004a1005
test eax, eax
jne 0x4243c7
lea ecx, [ebp - 0x10]
call fcn.004a0e93
lea eax, [ebp - 4]
push eax
mov ecx, 0x88ddec
call fcn.00409044
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea edi, [esi + 0x3c]
call fcn.0043a7f8
push eax
mov ecx, edi
call fcn.004a0ff9
push eax
lea ecx, [ebp - 0x6c]
call fcn.00425573
lea ecx, [ebp - 0x6c]
call fcn.00424f65
push eax
lea ecx, [ebp - 0x1c]
call fcn.004a101e
lea ecx, [ebp - 0xc]
call fcn.004a1005
xor ebx, ebx
test eax, eax
je 0x42432a
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0xc]
call fcn.004a0ff9
mov edx, eax
lea ecx, [ebp - 4]
call fcn.00408336
mov eax, dword [ebp - 4]
neg eax
sbb eax, eax
test eax, fcn.00466ca2
je 0x42431e
push ebx
lea eax, [esi + 0x20]
push eax
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 4]
lea ecx, [ebp - 0x18]
call fcn.004cfe9f
push dword [eax]
lea ecx, [ebp - 0x20]
call fcn.004a101e
lea ecx, [ebp - 0x18]
call fcn.004a0c7d
mov ecx, dword [ebp - 4]
cmp ecx, ebx
je 0x42432a
call fcn.00406bc3
cmp dword [ebp - 0x14], ebx
jne 0x42434e
mov edi, 0x517834
push edi
lea ecx, [ebp - 8]
call fcn.004a1101
test al, al
je 0x42434e
push edi
lea ecx, [ebp - 0x10]
call fcn.004a1101
test al, al
jne 0x4243b5
mov ecx, dword [ebp - 0x14]
push 0x100
lea edx, [ebp - 0x26c]
call fcn.004b922b
push ebx
push ebx
lea ecx, [ebp - 0x10]
call fcn.004a0ff9
push eax
lea ecx, [ebp - 8]
call fcn.004a0ff9
push eax
push dword [ebp - 0x14]
lea eax, [ebp - 0x26c]
push eax
lea ecx, [esi + 0x3c]
call fcn.004a0ff9
push eax
lea eax, [ebp - 0x18]
push 0x512dd0
push eax
call fcn.004a1618
add esp, 0x1c
mov ecx, eax
call fcn.004a0ff9
push eax
push dword [0x88f7f8]
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0x18]
call fcn.004a0c7d
lea ecx, [ebp - 0x6c]
call fcn.0042500d
lea ecx, [ebp - 0x10]
call fcn.004a0c7d
jmp 0x4243df
xor ebx, ebx
push ebx
push ebx
mov ecx, edi
call fcn.004a0ff9
push eax
push dword [0x88f7f8]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp byte [esi + 0x44], bl
jne 0x4243f3
lea ecx, [esi + 0x3c]
call fcn.004a0ff9
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp byte [esi + 0x46], bl
pop edi
pop esi
pop ebx
je 0x424406
push 0x567fbc
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea ecx, [ebp - 8]
call fcn.004a0c7d
lea ecx, [ebp - 0x1c]
call fcn.004a0c7d
lea ecx, [ebp - 0x20]
call fcn.004a0c7d
lea ecx, [ebp - 0xc]
call fcn.004a0c7d
mov al, 1
leave
ret
Function at 0x424540
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [ebp - 4]
call fcn.004a0e93
lea ecx, [ebp - 0xc]
call fcn.004a0e93
lea ecx, [esi + 0x2c]
call fcn.004a1005
xor ebx, ebx
test eax, eax
jne 0x4245bf
lea eax, [ebp - 0xc]
lea edi, [esi + 0x3c]
push eax
mov ecx, edi
call fcn.004a0ff9
mov edx, eax
lea ecx, [ebp - 8]
call fcn.00408336
mov eax, dword [ebp - 8]
neg eax
sbb eax, eax
test eax, fcn.00466ca2
je 0x4245b3
push 1
lea eax, [esi + 0x20]
push eax
push edi
lea edx, [ebp - 8]
lea ecx, [ebp - 0x10]
call fcn.004cfe9f
push dword [eax]
lea ecx, [ebp - 4]
call fcn.004a101e
lea ecx, [ebp - 0x10]
call fcn.004a0c7d
mov ecx, dword [ebp - 8]
cmp ecx, ebx
je 0x4245bf
call fcn.00406bc3
cmp byte [esi + 0x44], bl
jne 0x4245d3
lea ecx, [esi + 0x3c]
call fcn.004a0ff9
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 4]
call fcn.004a1005
test eax, eax
jne 0x424635
mov edi, dword [0x895434]
lea ecx, [ebp - 0xc]
call fcn.004a0ff9
push eax
lea eax, [ebp - 0x10]
push edi
push eax
call fcn.004a1618
add esp, 0xc
push eax
mov ecx, esi
call fcn.00423ec6
lea ecx, [ebp - 0x10]
call fcn.004a0c7d
push esi
push ebx
push 0x801e
push dword [0x890598]
call dword [sym.imp.USER32.dll_PostMessageW]
lea ecx, [ebp - 0xc]
call fcn.004a0c7d
lea ecx, [ebp - 4]
call fcn.004a0c7d
pop edi
pop esi
mov al, bl
pop ebx
leave
ret
lea ecx, [ebp - 4]
call fcn.004a0ff9
push eax
mov ecx, esi
call fcn.0042442a
push esi
push ebx
push 0x801f
push dword [0x890598]
call dword [sym.imp.USER32.dll_PostMessageW]
mov bl, 1
jmp 0x42461e
Function at 0x425778
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
lea eax, [ebp - 0x14]
mov byte [ebp - 4], cl
push eax
mov ecx, 0x567ff8
call fcn.00448d5b
mov esi, 0x567ffc
jmp 0x425831
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x18]
add ecx, 0x18
call fcn.004a0ff9
mov ecx, eax
call fcn.0049a53c
push eax
lea ecx, [ebp - 0xc]
call fcn.004a0fd9
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x18]
add eax, 0x2c
push eax
lea ecx, [ebp - 8]
call fcn.004a1682
lea ecx, [ebp - 8]
call fcn.004a1005
test eax, eax
je 0x4257e5
lea ecx, [ebp - 8]
call fcn.004a0ff9
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x18]
add ecx, 0x18
call fcn.004a1005
test eax, eax
je 0x425806
lea ecx, [ebp - 0xc]
call fcn.004a0ff9
mov ecx, eax
call fcn.004697fe
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x18]
lea ecx, [ebp - 8]
mov dword [eax + 0x14], 4
call fcn.004a0c7d
lea ecx, [ebp - 0xc]
call fcn.004a0c7d
push 0
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x14]
call fcn.004a0e09
push 0
push esi
lea ecx, [ebp - 0x1c]
call fcn.004a0d87
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x14]
call fcn.004a0e33
test al, al
jne 0x42579a
pop esi
cmp byte [ebp - 4], al
jne 0x42585b
call fcn.0049b96a
leave
ret
Function at 0x428b54
Capabilities:
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, ecx
push esi
call edi
mov ebx, eax
test ebx, ebx
jne 0x428b8a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x428b8a
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor eax, 1
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call edi
mov ebx, eax
pop edi
pop esi
mov eax, ebx
pop ebx
ret
Function at 0x4319e4
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4bc
push ebx
push esi
mov esi, ecx
cmp byte [esi + 0x4c], 0
push edi
je 0x431a0b
push 0x4303c2
push 0x10
push 0x10
push 3
call fcn.004318f7
mov dword [esi + 0x40], eax
push 0x4317ca
push 9
push 9
push 2
mov ecx, esi
call fcn.004318f7
mov dword [esi + 0x44], eax
lea eax, [ebp - 0x208]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x431a3d
mov word [ebp - 0x208], ax
mov edi, dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push 0x4011
mov ebx, 0x2b4
push ebx
lea eax, [ebp - 0x4bc]
push eax
push 0x10
lea eax, [ebp - 0x208]
push eax
call edi
mov dword [esi + 0x3c], eax
mov eax, dword [ebp - 0x4b8]
push 0x4013
mov dword [esi + 0x50], eax
push ebx
lea eax, [ebp - 0x4bc]
push eax
push 0x10
lea eax, [ebp - 0x208]
push eax
call edi
mov eax, dword [ebp - 0x4b8]
pop edi
mov dword [esi + 0x54], eax
pop esi
pop ebx
leave
ret

Function at 0x431d25
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp dword [esi + 0x44], ebx
je 0x431dfc
mov eax, dword [esi + 4]
mov dword [ebp + 8], eax
test eax, eax
je 0x431d4b
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0x40]
mov dword [esi + 0x44], ebx
mov eax, dword [eax + ebx*4]
mov dword [esi + 4], eax
test eax, eax
jne 0x431dbc
push edi
push 0x18
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
pop ecx
test edi, edi
je 0x431d86
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10]
and dword [edi + 8], 0
mov dword [edi + 0xc], esi
mov dword [edi], 0x515a94
mov dword [edi + 0x10], esi
mov dword [edi + 0x14], eax
jmp 0x431d88
xor edi, edi
mov eax, dword [esi + 0x38]
mov eax, dword [eax + 4]
mov ecx, dword [esi + 0x3c]
push edi
push fcn.00475cda
push eax
mov eax, ebx
shl eax, 4
mov edx, dword [ecx + eax]
mov ecx, dword [0x56bf8c]
call fcn.00477422
cmp byte [esi + 0x48], 0
mov dword [esi + 4], eax
pop edi
je 0x431dbc
mov ecx, eax
call fcn.004765dc
mov ecx, dword [esi + 0x38]
mov eax, dword [ecx]
push ebx
push esi
or edx, 0xffffffff
call dword [eax + 0x30]
mov eax, dword [esi + 0x2c]
mov edx, dword [esi + 0x34]
mov ecx, dword [esi + 0x28]
push 0x250
sub edx, eax
push edx
mov edx, dword [esi + 0x30]
sub edx, ecx
push edx
push eax
push ecx
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x431dfc
mov edx, dword [ebp + 8]
call fcn.004306ff
pop esi
pop ebx
pop ebp
ret 8
Function at 0x434607
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
lea eax, [ebp - 0x10]
push eax
mov edi, ecx
call fcn.00448d5b
lea esi, [edi + 4]
jmp 0x434634
mov ecx, dword [ebp - 0x10]
add ecx, 0xb0
call fcn.004a0ff9
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push esi
lea ecx, [ebp - 8]
call fcn.004a0d87
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x10]
call fcn.004a0e33
test al, al
jne 0x43461f
mov ecx, edi
call fcn.0040dfc2
pop edi
pop esi
leave
ret

Function at 0x43555d
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
cmp byte [0x56aa20], 0
je 0x435573
mov al, 1
leave
ret
lea eax, [ebp - 0x190]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x4355a9
mov eax, dword [ebp - 0x190]
cmp al, 2
jne 0x4355a3
shr eax, 8
cmp al, 2
jne 0x4355a3
mov byte [0x56aa20], 1
jmp 0x43556f
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor al, al
leave
ret

Function at 0x4355ad
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
push edi
push 0x44
pop esi
push esi
xor edi, edi
lea eax, [ebp - 0x5c]
push edi
push eax
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
call sub.msvcrt.dll_memset
mov ebx, dword [ebp + 0xc]
add esp, 0xc
mov dword [ebp - 0x5c], esi
cmp ebx, edi
je 0x435613
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
push 1
push edi
lea eax, [ebp + 0xc]
push eax
call esi
push eax
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x4355fc
mov eax, dword [ebp + 0xc]
or dword [ebp - 0x30], 0x100
or dword [ebp - 0x30], 1
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x20], ebx
mov word [ebp - 0x2c], ax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x5c]
push eax
push dword [ebp + 8]
xor eax, eax
push edi
cmp ebx, edi
setne al
push edi
push eax
push edi
push edi
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp + 0xc], eax
cmp eax, edi
je 0x43565b
mov eax, dword [ebp + 0x10]
cmp eax, edi
je 0x435651
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
jmp 0x435656
push dword [ebp - 0x18]
call esi
push dword [ebp - 0x14]
call esi
cmp ebx, edi
je 0x435664
push dword [ebp - 0x1c]
call esi
xor eax, eax
cmp dword [ebp + 0xc], edi
pop edi
pop esi
setne al
pop ebx
leave
ret 0xc
Function at 0x4359ba
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 0xc], 0
push ebx
push esi
mov esi, edx
mov dword [ebp - 0x10], ecx
call fcn.004a2796
cmp byte [eax + 0x135], 0
je 0x4359e7
xor ebx, ebx
push esi
inc ebx
push 0x5160cc
lea eax, [ebp - 0xc]
jmp 0x4359f3
push 2
pop ebx
push esi
push 0x5160a8
lea eax, [ebp - 8]
push eax
call fcn.004a1618
add esp, 0xc
push eax
lea ecx, [ebp - 4]
call fcn.004a1682
test bl, 2
je 0x435a15
lea ecx, [ebp - 8]
and ebx, 0xfffffffd
call fcn.004a0c7d
test bl, 1
je 0x435a22
lea ecx, [ebp - 0xc]
call fcn.004a0c7d
push 1
push 0
lea ecx, [ebp - 4]
call fcn.004a0ff9
push eax
push dword [ebp - 0x10]
push 0x510edc
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
lea ecx, [ebp - 4]
setg bl
call fcn.004a0c7d
pop esi
mov al, bl
pop ebx
leave
ret

Function at 0x435a84
Capabilities:
Create process on windows
Get comspec environment variable
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x624
push esi
push 0x104
lea eax, [ebp - 0x624]
push eax
push 0x516164
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x435be3
push ebx
mov ecx, 0x516150
call fcn.00468e30
push eax
lea ecx, [ebp - 4]
call fcn.004a0fd9
lea ecx, [ebp - 4]
call fcn.004a0ff9
push eax
lea eax, [ebp - 8]
push 0x516128
push eax
call fcn.004a1618
add esp, 0xc
lea ecx, [ebp - 8]
call fcn.004a0ff9
push 2
lea edx, [ebp - 0x214]
pop ebx
movzx ecx, word [eax]
mov word [edx], cx
add eax, ebx
add edx, ebx
test cx, cx
jne 0x435aee
push edi
mov eax, esi
lea ecx, [ebp - 0x214]
call fcn.004068fc
xor edx, edx
xor ecx, ecx
call fcn.0048245f
lea edi, [ebp - 0x41c]
mov edx, eax
sub edi, eax
movzx esi, word [edx]
mov word [edi + edx], si
add edx, ebx
test si, si
jne 0x435b1e
mov dl, 1
mov ecx, eax
call fcn.00479b79
mov eax, 0x51611c
lea ecx, [ebp - 0x41c]
call fcn.004068fc
push 0
push 0x80
push 7
pop edx
lea ecx, [ebp - 0x41c]
call fcn.00482361
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x214]
lea edx, [eax + 2]
pop edi
mov cx, word [eax]
add eax, ebx
test cx, cx
jne 0x435b67
sub eax, edx
sar eax, 1
push eax
lea ecx, [ebp - 0x214]
call fcn.0049e64a
mov ecx, dword [ebp - 0xc]
mov edx, eax
call fcn.004b8410
lea ecx, [ebp - 0xc]
call fcn.00481ff4
mov eax, 0x516110
lea ecx, [ebp - 0x624]
call fcn.004068fc
lea eax, [ebp - 0x41c]
lea ecx, [ebp - 0x624]
call fcn.004068fc
push 0
lea ecx, [ebp - 0x624]
call fcn.0049e64a
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x1f
lea ecx, [ebp - 8]
seta bl
call fcn.004a0c7d
lea ecx, [ebp - 4]
call fcn.004a0c7d
mov al, bl
pop ebx
jmp 0x435be5
xor al, al
pop esi
leave
ret