joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401e30
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x18b8
call fcn.0042d8f0
mov eax, dword [0x43c040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push 0x1c
mov ebx, ecx
mov dword [ebp - 0x18b8], edi
push 0
mov dword [ebp - 0x18b4], ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push str.dlnowlist
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x18ac], eax
cmp eax, 0xffffffff
je 0x401fd3
mov esi, dword [ebx + 0x2c]
test esi, esi
jle 0x401fcc
lea ebx, [ebx + esi*4]
add ebx, 0xae4
mov edi, dword [ebx]
test edi, edi
je 0x401fae
push 0x169c
lea eax, [ebp - 0x18a8]
push 0
push eax
call fcn.0041d2c0
add esp, 8
lea eax, [edi + 0xa0]
mov edx, 0x40
push eax
push ecx
lea ecx, [ebp - 0x18a8]
call fcn.00401190
push ecx
push dword [edi + 0x98]
mov edx, 0x800
push ecx
lea ecx, [ebp - 0x1828]
call fcn.00401190
push ecx
lea eax, [edi + 0x120]
mov edx, 0x104
push eax
push ecx
lea ecx, [ebp - 0x828]
call fcn.00401190
push ecx
lea eax, [edi + 0x328]
mov edx, 0x104
push eax
push ecx
lea ecx, [ebp - 0x620]
call fcn.00401190
lea ecx, [edi + 0xd30]
mov edx, 0x100
push ecx
lea eax, [ebp - 0x418]
push eax
push ecx
call fcn.00401190
mov eax, dword [edi + 0x1754]
mov dword [ebp - 0x218], eax
mov eax, dword [edi + 0xa360]
mov dword [ebp - 0x214], eax
mov eax, dword [edi + 0x88]
push 0
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x18b0]
push eax
push 0x169c
lea eax, [ebp - 0x18a8]
mov dword [ebp - 0x18b0], 0
push eax
push dword [ebp - 0x18ac]
call dword [sym.imp.KERNEL32.dll_WriteFile]
dec esi
sub ebx, 4
test esi, esi
jg 0x401ec4
mov ebx, dword [ebp - 0x18b4]
mov eax, dword [ebp - 0x18ac]
mov edi, dword [ebp - 0x18b8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x14
push edi
call dword [sym.imp.USER32.dll_KillTimer]
lea esi, [ebx + 0xae8]
mov edi, 0x100
mov ecx, dword [esi]
test ecx, ecx
je 0x401ff9
push ecx
call fcn.00401a90
mov dword [esi], 0
add esi, 4
sub edi, 1
jne 0x401fe7
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x40200f
push eax
call dword [sym.imp.USER32.dll_DestroyMenu]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov dword [ebx + 4], 0
xor ecx, ebp
pop ebx
call fcn.0041bbdc
mov esp, ebp
pop ebp
ret 4
Function at 0x404be0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x43c040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
cmp word [esi + 0x328], 0
lea ebx, [esi + 0x328]
push edi
je 0x404caa
lea eax, [ebp - 0x258]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x404c23
xor eax, eax
jmp 0x404c3b
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, byte [ebp - 0x258]
not al
movzx eax, al
shr eax, 4
and eax, 1
test eax, eax
je 0x404caa
push ecx
push ebx
push ecx
mov edx, 0x104
lea ecx, [ebp - 0x210]
call fcn.00401190
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov esi, dword [sym.imp.SHELL32.dll_ILCreateFromPathW]
lea eax, [ebp - 0x210]
push eax
call esi
push ebx
mov edi, eax
call esi
mov ebx, eax
lea eax, [ebp - 0x25c]
push 0
push eax
push 1
push edi
mov dword [ebp - 0x25c], ebx
call dword [sym.imp.SHELL32.dll_SHOpenFolderAndSelectItems]
mov esi, dword [sym.imp.SHELL32.dll_ILFree]
push edi
call esi
push ebx
call esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041bbdc
mov esp, ebp
pop ebp
ret
cmp word [esi + 0x120], 0
lea eax, [esi + 0x120]
je 0x404cd1
push 1
push 0
push eax
push str.explorer.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041bbdc
mov esp, ebp
pop ebp
ret

Function at 0x404ed0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
mov eax, dword [0x43c040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
cmp word [edi + 0x328], 0
lea esi, [edi + 0x328]
je 0x404f6b
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x404f59
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
test byte [ebp - 0x258], 0x10
jne 0x404f59
sub esp, 0xc
mov ecx, esi
call fcn.0040fb50
add esp, 0xc
test eax, eax
jns 0x404f6b
cmp eax, 0x80004002
jne 0x404f6b
push 1
push 0
push esi
push str.explorer.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041bbdc
mov esp, ebp
pop ebp
ret
push 0
push 6
push 0x8008
push dword [edi + 8]
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0041bbdc
mov esp, ebp
pop ebp
ret
Function at 0x409020
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov ebx, edx
mov dword [ebp - 8], ebx
mov edx, ecx
mov dword [ebp - 4], edx
push edi
test esi, esi
je 0x409153
xor edi, edi
cmp dword [ebp + 8], edi
jbe 0x4090fc
nop dword [eax]
mov cl, byte [edi + ebx]
mov ebx, dword [esi + 8]
test ebx, ebx
jne 0x409065
cmp cl, 0x7b
jne 0x4090ea
jmp 0x40906f
cmp cl, 0xd
je 0x4090a9
cmp cl, 0xa
je 0x4090a9
mov eax, dword [esi + 4]
mov byte [ebx + eax], cl
inc dword [esi + 8]
mov ebx, dword [esi + 0xc]
cmp dword [esi + 8], ebx
jb 0x4090ea
add ebx, 0x100000
cmp ebx, 0x1000000
ja 0x4090f9
push ebx
push dword [esi + 4]
push 8
push dword [edx + 0x1c]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
test eax, eax
je 0x4090f9
mov dword [esi + 4], eax
mov dword [esi + 0xc], ebx
jmp 0x4090e7
cmp dword [edx + 0xa374], 0
jne 0x409153
push dword [esi + 4]
mov ecx, edx
call fcn.00409e90
mov eax, dword [ebp - 4]
cmp dword [eax + 0xa374], 0
jne 0x409153
push dword [esi + 0xc]
push 0
push dword [esi + 4]
call fcn.0041d2c0
add esp, 0xc
mov dword [esi + 8], 0
mov edx, dword [ebp - 4]
mov ebx, dword [ebp - 8]
inc edi
cmp edi, dword [ebp + 8]
jb 0x409050
jmp 0x4090fc
mov ebx, dword [ebp - 8]
cmp dword [esi + 8], 0
jne 0x40915e
push 0x434c0c
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrIA]
call ebx
mov edi, eax
test edi, edi
je 0x40915e
push 0x434c14
push edi
call ebx
test eax, eax
je 0x409125
mov byte [eax], 0
mov esi, dword [ebp - 4]
xor eax, eax
push 0x100
add esi, 0x1530
push esi
push 0xffffffffffffffff
push edi
push eax
push 0xfde9
mov word [esi], ax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x409153
mov word [esi + 0x1fe], ax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x409178
push 0
lea ecx, [ebp + 0x10]
push ecx
push dword [ebp + 8]
push dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4099e0
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3214
call fcn.0042d8f0
mov eax, dword [0x43c040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
push esi
push edi
mov edi, edx
mov dword [ebp - 0x3210], eax
cmp dword [eax + 0xa380], 0
je 0x409a93
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x409a93
push str.dlnow_debug.txt
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x409a93
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x3214]
mov dword [ebp - 0x3214], 0
push eax
push dword [ebp + 8]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
push 0x1800
mov word [ebp - 0x320c], ax
lea eax, [ebp - 0x320c]
push eax
push 0xffffffffffffffff
push edi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x409b99
lea esi, [ebp - 0x320c]
push ebx
movzx eax, word [esi]
test ax, ax
je 0x409aeb
mov ecx, eax
cmp cx, 0xd
je 0x409add
cmp cx, 0xa
jne 0x409b03
movzx eax, word [esi + 2]
add esi, 2
mov ecx, eax
test ax, ax
jne 0x409ad1
pop ebx
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041bbdc
mov esp, ebp
pop ebp
ret 0x14
test esi, esi
je 0x409aeb
movzx eax, word [esi]
mov ebx, esi
test ax, ax
je 0x409b2d
mov ecx, eax
cmp cx, 0xd
je 0x409b2d
cmp cx, 0xa
je 0x409b2d
movzx eax, word [esi + 2]
add esi, 2
mov ecx, eax
test ax, ax
jne 0x409b13
cmp word [esi], 0
je 0x409b3b
xor eax, eax
mov word [esi], ax
add esi, 2
cmp word [ebx], 0
je 0x409ac7
push str.ERROR:
push ebx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
mov edi, eax
test edi, edi
je 0x409b81
push str.please
push edi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x409b68
xor ecx, ecx
mov word [eax], cx
mov ecx, dword [ebp - 0x3210]
mov edx, 0x100
add ecx, 0x1530
push ecx
push edi
push ecx
call fcn.00401190
mov ecx, dword [ebp - 0x3210]
sub esp, 8
mov edx, ebx
push dword [ebp + 0x10]
call fcn.00409190
jmp 0x409ac7
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
xor ecx, ebp
pop esi
call fcn.0041bbdc
mov esp, ebp
pop ebp
ret 0x14
Function at 0x40af20
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x43c040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x40b004
cmp dword [esi + 0x88], 3
jne 0x40b004
cmp dword [esi + 0x64], 0
je 0x40b004
push ebx
push edi
push eax
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_DebugActiveProcessStop]
push ebx
push 2
mov dword [ebp - 0x234], eax
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x40afc7
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x40afc0
mov eax, dword [ebp - 0x218]
cmp eax, dword [esi + 0x3c]
jne 0x40afae
push dword [ebp - 0x228]
call dword [sym.imp.KERNEL32.dll_DebugActiveProcessStop]
mov ebx, eax
lea eax, [ebp - 0x230]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x40af95
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x234], 0
jne 0x40afe7
test ebx, ebx
jne 0x40afe7
pop edi
pop ebx
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041bbdc
mov esp, ebp
pop ebp
ret
pop edi
pop ebx
mov dword [esi + 0x64], 0
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041bbdc
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.0041bbdc
mov esp, ebp
pop ebp
ret

Function at 0x40ef60
Capabilities:
Delete file

Disassembly:
push esi
push 0
push 0x4000000
push 5
push 0
push 0
mov esi, ecx
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x40ef8a
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop esi
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop esi
ret
Function at 0x40efa0
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x464
mov eax, dword [0x43c040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
test ecx, ecx
je 0x40f142
push ecx
push ecx
push ecx
mov edx, 0x104
lea ecx, [ebp - 0x210]
call fcn.00401190
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
lea eax, [ebp - 0x210]
push 0x435d94
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40f142
test byte [ebp - 0x460], 0x10
jne 0x40f083
lea edi, [esi + esi]
cmp edi, 0x208
jae 0x40f155
xor eax, eax
mov word [ebp + edi - 0x210], ax
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0
push 0x4000000
push 5
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x40f07a
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x40f0e8
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40f0e8
cmp word [ebp - 0x434], 0x2e
jne 0x40f0ae
mov ax, word [ebp - 0x432]
test ax, ax
je 0x40f0a9
cmp ax, 0x2e
jne 0x40f0ae
cmp word [ebp - 0x430], 0
jne 0x40f0ae
lea edi, [esi + esi]
jmp 0x40f0e8
lea edi, [esi + esi]
cmp edi, 0x208
jae 0x40f155
xor eax, eax
mov word [ebp + edi - 0x210], ax
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
xor edx, edx
lea ecx, [ebp - 0x210]
call fcn.0040efa0
lea eax, [ebp - 0x460]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40f011
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp esi, 0x12
jne 0x40f142
cmp edi, 0x208
jae 0x40f155
xor eax, eax
mov word [ebp + edi - 0x210], ax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041bbdc
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041bbdc
mov esp, ebp
pop ebp
ret
call fcn.0041bd3d
int3
Function at 0x40fd90
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x43c040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, ecx
mov dword [ebp - 0x418], 0
push edi
mov dword [ebp - 0x40c], esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edi, eax
lea eax, [ebp - 0x424]
push eax
push esi
mov dword [ebp - 0x414], edi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov esi, eax
test esi, esi
je 0x40fe0f
push esi
push 8
push edi
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x40fe0f
push edi
push esi
push 0
push dword [ebp - 0x40c]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
jne 0x40fe22
push edi
push eax
push dword [ebp - 0x414]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041bbdc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x410]
push eax
push str.VarFileInfoTranslation
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
mov esi, dword [ebp - 0x41c]
mov eax, 1
shr esi, 2
cmp esi, eax
cmova esi, eax
mov dword [ebp - 0x408], esi
xor esi, esi
mov eax, dword [ebp - 0x408]
test eax, eax
je 0x40ff39
test ebx, ebx
je 0x40ff30
xor eax, eax
mov word [ebx], ax
mov eax, dword [ebp - 0x410]
lea ecx, [eax + esi*4]
movzx eax, word [ecx + 2]
push eax
movzx eax, word [ecx]
push eax
push str.StringFileInfo_04x_04xFileVersion
lea eax, [ebp - 0x404]
push 0x200
push eax
call fcn.0040e990
add esp, 0x14
test eax, eax
js 0x40ff2a
lea eax, [ebp - 0x420]
mov dword [ebp - 0x40c], 0
push eax
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x404]
push eax
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
jne 0x40ff0a
mov eax, dword [ebp - 0x410]
mov ecx, 0x409
cmp word [eax + esi*4], cx
jne 0x40feec
mov ecx, 0x4b0
cmp word [eax + esi*4 + 2], cx
je 0x40ff2a
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x40c]
push eax
push str.StringFileInfo040904b0FileVersion
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x40ff2a
mov edx, dword [ebp + 0x18]
shr edx, 1
je 0x40ff20
push ecx
push dword [ebp - 0x40c]
push ecx
mov ecx, ebx
call fcn.00401190
mov dword [ebp - 0x418], 1
mov eax, dword [ebp - 0x408]
inc esi
cmp esi, eax
jb 0x40fe65
push edi
push 0
push dword [ebp - 0x414]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x418]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0041bbdc
mov esp, ebp
pop ebp
ret
Function at 0x40ffe0
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push 0xf0000000
push 1
push str.Microsoft_Base_Cryptographic_Provider_v1.0
xor esi, esi
mov dword [ebp - 0xc], ecx
push esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
mov ebx, edx
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0x10
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x41004f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x410047
push 0xf0000008
push 1
push str.Microsoft_Base_Cryptographic_Provider_v1.0
push esi
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x41004f
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x8003
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x41009a
push 0
push ebx
push dword [ebp - 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x41009a
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
push 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
mov ecx, 1
cmovne esi, ecx
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x4100a8
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x410220
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
cmp dword [ebp + 8], 0
mov eax, 0x4363a8
push esi
mov esi, str.open
mov dword [ebp - 0x34], 0
cmove eax, esi
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x30], eax
xorps xmm0, xmm0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x3c]
push eax
movlpd qword [ebp - 0x1c], xmm0
movlpd qword [ebp - 0x14], xmm0
movlpd qword [ebp - 0xc], xmm0
mov dword [ebp - 4], 0
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x40
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov esi, eax
test esi, esi
je 0x4102a4
mov eax, dword [ebp - 4]
test eax, eax
je 0x4102a2
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4102a2
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x410560
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x43c040]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push eax
mov word [ebp - 8], 0x500
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x4105c3
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041bbdc
mov esp, ebp
pop ebp
ret
Function at 0x410ea0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x318
mov eax, dword [0x43c040]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x110
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x318], 0x1f8
push 0
push eax
call fcn.0041d2c0
add esp, 0xc
mov dword [ebp - 0x120], 0x114
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x410efc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041bbdc
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x11c], 6
mov eax, dword [ebp - 0x318]
jae 0x410f14
sub eax, 4
mov dword [ebp - 0x318], eax
push 0
lea ecx, [ebp - 0x318]
push ecx
push eax
push 0x29
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
lea eax, [ebp - 0x180]
mov byte [ebp - 0x166], 5
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041bbdc
mov esp, ebp
pop ebp
ret

Function at 0x411550
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x43e0a0]
push ebx
push esi
mov esi, dword [0x43e0b8]
push 0x208
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x411631
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x411626
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x411626
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x411626
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ecx, eax
lea eax, [edi + 3]
and eax, 0xfffffffc
mov dword [ebp + 0xc], ecx
add eax, 4
push eax
push 8
push ecx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x411626
mov ecx, edi
mov edx, ebx
shr ecx, 2
test ecx, ecx
je 0x4115ef
nop dword [eax]
mov eax, dword [esi]
add esi, 4
mov dword [edx], eax
add edx, 4
sub ecx, 1
jne 0x4115e0
and edi, 3
je 0x411604
sub esi, edx
mov al, byte [esi + edx]
lea edx, [edx + 1]
mov byte [edx - 1], al
sub edi, 1
jne 0x4115f6
mov ecx, dword [ebp - 4]
push ebx
call fcn.00411450
push ebx
push 0
push dword [ebp + 0xc]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x411920
Capabilities:
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x43c040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp word [esi], 0
jne 0x411963
lea ecx, [esi + 0x410]
mov edx, 0x104
push ecx
push str.FilePath_not_set.
push ecx
call fcn.00401190
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041bbdc
mov esp, ebp
pop ebp
ret 4
push ecx
call fcn.00411ad0
test eax, eax
je 0x411950
push ebx
push edi
push 0
push esi
lea edi, [esi + 0x208]
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ebx, eax
mov dword [ebp - 0x48], ebx
test ebx, ebx
jne 0x411a82
lea ebx, [esi + 0x410]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x411a7f
push 0xa
push 0x20
lea ecx, [ebp - 0x44]
push ecx
push eax
call fcn.0041eff8
add esp, 0xc
mov edx, 0x104
push str.Error_copying_file
push ecx
mov ecx, ebx
call fcn.00401190
mov ecx, 0x104
mov eax, ebx
nop word [eax + eax]
cmp word [eax], 0
je 0x4119de
add eax, 2
sub ecx, 1
jne 0x4119d0
mov edx, 0x104
mov esi, ecx
mov eax, edx
sub eax, ecx
neg esi
sbb esi, esi
and esi, eax
test ecx, ecx
je 0x411a09
push ecx
push 0x434140
push ecx
sub edx, esi
lea ecx, [ebx + esi*2]
call fcn.00401190
mov edx, 0x104
mov ecx, 0x104
mov eax, ebx
cmp word [eax], 0
je 0x411a1e
add eax, 2
sub ecx, 1
jne 0x411a10
mov eax, edx
mov esi, ecx
sub eax, ecx
neg esi
sbb esi, esi
and esi, eax
test ecx, ecx
je 0x411a43
push ecx
lea eax, [ebp - 0x44]
sub edx, esi
push eax
push ecx
lea ecx, [ebx + esi*2]
call fcn.00401190
mov edx, 0x104
mov ecx, 0x104
mov eax, ebx
nop word [eax + eax]
cmp word [eax], 0
je 0x411a5e
add eax, 2
sub ecx, 1
jne 0x411a50
mov eax, edx
mov esi, ecx
sub eax, ecx
neg esi
sbb esi, esi
and esi, eax
test ecx, ecx
je 0x411a7f
push ecx
push 0x434a88
push ecx
sub edx, esi
lea ecx, [ebx + esi*2]
call fcn.00401190
mov ebx, dword [ebp - 0x48]
cmp word [edi], 0
je 0x411abb
push 0
push 0x4000000
push 5
push 0
push 0
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x411aaf
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x411ab6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov word [edi], ax
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop ebx
xor ecx, ebp
pop esi
call fcn.0041bbdc
mov esp, ebp
pop ebp
ret 4