joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ab4bd
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4eb664]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.0049f45f
mov dword [ebp - 0x14], eax
cmp dword [0x4f0c8c], edi
jne 0x4ab5ae
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x4ab53b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4ab68e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x4ab68e
push 0x4cafa0
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4ab68e
push eax
call ebx
push 0x4cafac
push esi
mov dword [0x4f0c8c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x4f0c90], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x4f0c94], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4f0c9c], eax
test eax, eax
je 0x4ab5ab
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4f0c98], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4ab5d3
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4ab5c6
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x4ab5e8
push 4
pop eax
jmp 0x4ab690
cmp dword [ebp - 0x14], edi
je 0x4ab5e8
push dword [0x4f0c8c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4ab5cd
mov eax, dword [0x4f0c98]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x4ab646
cmp dword [0x4f0c9c], esi
je 0x4ab646
push eax
call ebx
push dword [0x4f0c9c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4ab646
test eax, eax
je 0x4ab646
call ecx
test eax, eax
je 0x4ab63b
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4ab63b
test byte [ebp - 8], 1
jne 0x4ab646
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x4ab676
mov eax, dword [0x4f0c90]
cmp eax, esi
je 0x4ab673
push eax
call ebx
test eax, eax
je 0x4ab673
call eax
mov edi, eax
test edi, edi
je 0x4ab673
mov eax, dword [0x4f0c94]
cmp eax, esi
je 0x4ab673
push eax
call ebx
test eax, eax
je 0x4ab673
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x4f0c8c]
call ebx
test eax, eax
je 0x4ab68e
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x4ab690
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048f059
leave
ret
Function at 0x4ae17c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.0049d0a9
mov esi, dword [ebp + 8]
push 2
mov edi, eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x4ae1b4
xor eax, eax
jmp 0x4ae1e0
cmp esi, dword [ebp - 4]
je 0x4ae1dd
cmp dword [ebp + 0xc], 0
je 0x4ae1dd
push dword [edi + 0x9c]
call fcn.004add8a
push dword [edi + 0x9c]
mov esi, eax
call fcn.004a847b
pop ecx
pop ecx
cmp esi, eax
je 0x4ae1b0
xor eax, eax
inc eax
pop edi
pop esi
leave
ret

Function at 0x4b445c
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
mov edx, 0x1505
mov ebx, dword [edi + 0x38]
add ebx, ecx
cmp esi, 0x102
jae 0x4b453e
test esi, esi
je 0x4b453e
xor eax, eax
mov dword [ebp + 0x10], eax
test esi, esi
je 0x4b44a7
mov edi, eax
movzx eax, byte [edi + ebx]
imul edx, edx, 0x21
add edx, eax
inc edi
cmp edi, esi
jb 0x4b4494
mov edi, dword [ebp + 8]
xor eax, eax
and edx, 0xff
mov ebx, dword [edi + edx*4 + 0x60]
mov dword [edi + edx*4 + 0x60], ecx
mov dword [edi + 0x474], eax
test ebx, ebx
je 0x4b453e
sub ecx, ebx
mov dword [ebp + 0xc], ecx
cmp ecx, esi
jbe 0x4b453e
mov eax, dword [edi + 0x2c]
sub eax, 0x106
cmp ecx, eax
jae 0x4b453e
cmp esi, dword [edi + 0x478]
ja 0x4b453e
test esi, esi
je 0x4b4517
mov edx, dword [edi + 0x38]
add edx, ebx
mov dword [ebp + 8], edx
mov al, byte [edx + ecx]
cmp al, byte [edx]
jne 0x4b453e
mov eax, dword [ebp + 0x10]
add eax, ebx
push eax
push edi
call fcn.004b438c
pop ecx
pop ecx
cmp eax, 1
jne 0x4b453e
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
inc eax
inc edx
mov dword [ebp + 0x10], eax
mov dword [ebp + 8], edx
cmp eax, esi
jb 0x4b44e8
mov eax, dword [edi + 0x38]
lea ecx, [ebx + esi]
cmp byte [ecx + eax - 1], 0x3b
je 0x4b4534
lea eax, [ebx + esi]
push eax
push edi
call fcn.004b438c
pop ecx
pop ecx
test eax, eax
jne 0x4b453e
mov dword [edi + 0x474], ebx
mov eax, esi
jmp 0x4b4540
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4b50d5
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x4b50e2
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.004b50e8
Function at 0xc09423
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebp, dword [esp + 0x2c]
setbe dh
bsr di, cx
jmp 0xc0952d
jle 0xc09447
rdtsc
bswap ecx

Function at 0xc260c2
Capabilities:
Encode data using xor

Disassembly:
call fcn.00c26128
test al, 0x33
mov dword [0xbe8735c6], eax
xor al, 0xaa
int 0x3c
mov esp, dword [ecx - 0x4aa5dc20]
pop word [esp]
lea esp, [esp + 1]
jmp 0xc26152
out dx, eax
sbb bl, bl
idiv byte [edi - 0x11]
lea esp, [esp + 1]
jl 0xc25921
jge 0xc25c16
loop 0xc261d6
loopne 0xc260ed
jb 0xc26135
loopne 0xc261e1
out 0x82, eax
jno 0xc2613a
ljmp 0xfe71:0xe820f983
test bl, ah
push ds
test eax, 0x7e1b8b04
lea ecx, [edi - 0x56]
sub al, 0xa2
lds esi, [esp + eax*4]
mov esp, 0x3bc8a939
invalid

Function at 0xc28ef9
Capabilities:
Encrypt data using aes

Disassembly:
mov eax, dword [eax*4 + 0xc06414]
xchg bl, bh
neg bl
jmp 0xc28f2d
mov byte [esp], bh
btr ebx, edx
jmp 0xc28ede
lea esp, [esp + 4]
xor eax, 0x1000000
clc
bsf di, si
inc di
jmp 0xc28f17
Function at 0xc2ff29
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp byte [eax], 0x2e
jmp 0xc2f438
jmp 0xc2f4d6
inc edi
movzx ecx, byte [esi + 0xc]
mov di, dx
bsf di, si
mov di, dx
jmp 0xc2f22a
movzx eax, byte [esi + 0xb]
mov byte [esi + 0x5b], al
shr edi, 1
clc
jmp 0xc2f1d7
mov di, word [esp]
rcl di, cl
xchg al, ah
mov byte [esi + 0x5d], dl
jmp 0xc2f236
mov byte [esi + 0x5e], al
inc dx
jmp 0xc2f289
mov byte [esi + 0x5c], cl
mov dl, dh
stc
movzx edx, byte [esi + 0xd]
jmp 0xc2f206
movzx eax, byte [esi + 0xe]
inc ch
not edx
xchg ecx, edx
mov cl, 0x8a
jmp 0xc2f214
mov byte [esi + 0x5a], dl
inc dl
lea ecx, [eax - 0xc1]
mov di, sp
sub esp, 2
lea esp, [esp + 2]
jmp 0xc2f1fa
mov byte [esi + 0x5f], cl
movzx edx, byte [esi + 0x10]
lea edi, [esi - 0x65]
mov di, dx
jmp 0xc2f401
movzx ecx, byte [esi + 0xf]
cmc
xchg edi, eax
jmp 0xc2f270
setae ah
xchg word [esp + 0xb], ax
lea esp, [esp + 0x20]
movzx edx, byte [esi + 0xa]
jmp 0xc2f259
mov byte [esi + 0x62], cl
mov edx, ecx
inc dx
movzx edx, byte [esi + 0x13]
jmp 0xc2f2fd
movzx eax, byte [esi + 0x14]
jmp 0xc2f2e7
rdtsc
movzx ecx, byte [esi + 0x12]
rdtsc
not dx
jmp 0xc2f2b5
mov byte [esi + 0x64], al
lea edx, [edx + ebp]
inc dl
jmp 0xc2f376
mov byte [esi + 0x63], dl
mov ch, byte [esp]
xchg ah, ch
xchg ah, ch
jmp 0xc2f2c2
mov edi, 0x8ec5aab8
movzx eax, byte [esi + 0x11]
bswap ecx
mov byte [esi + 0x61], al
jmp 0xc2f2da
mov edi, dword [esp]
mov byte [esi + 0x66], dl
bts edi, ebx
btr edi, esp
jmp 0xc2f352
mov dx, bx
clc
movzx edx, byte [esi + 0x16]
btr eax, edx
mov di, bx
jmp 0xc2f328
movzx eax, byte [esi + 0x17]
mov edi, dword [esp]
lea esp, [esp + 4]
jmp 0xc2f39a
pop esi
call fcn.00c2f383
mov eax, 0x29dabf2f
test dh, dl
inc eax
salc
mov cl, 0x40
int1
jge 0xc2f3bf
fbld tbyte [esi]
push ecx
movzx ecx, byte [esi + 0x15]
bswap edi
sub edi, eax
mov byte [esi + 0x65], cl
jmp 0xc2f342
mov byte [esi + 0x67], al
bt esi, edx
mov si, word [esp]
mov esi, 0x3651d6de
lea esi, [edx + edi]
jmp 0xc2f35f
stosd dword es:[edi], eax
loop 0xc2f441
out dx, eax
mov bh, byte [ecx + 0x45]
ror byte [ebp - 0x24], cl
mov word [esp + 2], sp
lea esp, [esp + 2]
lea esp, [esp + 4]
ret
mov al, 0xdc
mov byte [esi + 0x60], dl
setbe ah
setae ch
or ecx, eax
jmp 0xc2f318
mov al, 0x16
rdtsc
mov byte [esi + 0x59], cl
mov cx, 0x2c65
pushal
jmp 0xc2f2a3
je 0xbfd477
bsf ax, ax
mov ax, word [esp]
sub esp, 0x12
jmp 0xc2f46b
shl byte [esi - 0x75], 4
and al, 0x83
in al, dx
adc ch, bl
and byte [ecx + 3], ah
xchg ebx, eax
test byte [0x648d46b0], 0x24
lea esp, [esp + 4]
ret
jmp 0xbfd40b
lea esp, [esp + 2]
xor eax, eax
lea esp, [esp + 0x10]
jmp 0xbfd477
ret
mov byte [esi + 0x58], al
neg ah
lea edi, [edx + edi]
bswap edi
movzx ecx, byte [esi + 9]
jmp 0xc2f427
call fcn.00bfcaf4
movzx eax, byte [ecx]
neg dx
xchg dh, ch
jmp 0xc2f57c
lea esp, [esp + 4]
jmp 0xc2f91a
Function at 0x40cc0c
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov word [ebp - 2], cx
mov edi, edx
mov esi, eax
push 0
push 0x8000080
push 3
push 0
push 1
push 0xc0000000
push esi
call sub.kernel32.dll_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40cc40
xor eax, eax
jmp 0x40cc91
lea eax, [ebp - 0xc]
push eax
mov ax, word [ebp - 2]
push eax
push edi
call sub.kernel32.dll_DosDateTimeToFileTime
test eax, eax
je 0x40cc74
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
call sub.kernel32.dll_LocalFileTimeToFileTime
test eax, eax
je 0x40cc74
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push ebx
call sub.kernel32.dll_SetFileTime
push ebx
call sub.kernel32.dll_CloseHandle
mov ax, word [ebp + 8]
and ax, 0x27
movzx eax, ax
push eax
push esi
call sub.kernel32.dll_SetFileAttributesA
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40df38
Capabilities:
Identify system language via api

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], eax
mov edx, dword [0x4186c0]
mov edx, dword [edx]
mov eax, dword [esp]
mov eax, dword [eax + 0x18]
call fcn.0040a7e0
mov ebp, 0xff
mov eax, 0x1a
call fcn.0041559c
mov esi, eax
dec esi
test esi, esi
jl 0x40dfaa
inc esi
xor ebx, ebx
mov edi, ebx
shl edi, 2
mov eax, dword [0x418658]
mov eax, dword [eax]
mov edx, dword [eax + edi*4]
mov eax, dword [esp]
mov eax, dword [eax + 0x24]
call fcn.0040b0d0
mov eax, dword [0x418658]
mov eax, dword [eax]
mov eax, dword [eax + edi*4 + 4]
call fcn.00409018
push eax
call sub.kernel32.dll_GetUserDefaultLangID
movzx eax, ax
pop edx
cmp edx, eax
jne 0x40dfa6
mov ebp, ebx
inc ebx
dec esi
jne 0x40df6c
cmp ebp, 0xff
jne 0x40dfea
mov eax, 0x1a
call fcn.0041559c
mov esi, eax
dec esi
test esi, esi
jl 0x40dfea
inc esi
xor ebx, ebx
mov eax, ebx
shl eax, 2
mov edx, dword [0x418658]
mov edx, dword [edx]
mov eax, dword [edx + eax*4]
mov edx, 0x40e010
call fcn.00401de4
jne 0x40dfe6
mov ebp, ebx
jmp 0x40dfea
inc ebx
dec esi
jne 0x40dfc6
cmp ebp, 0xff
jne 0x40dff4
xor ebp, ebp
mov eax, dword [esp]
mov eax, dword [eax + 0x24]
mov edx, ebp
call fcn.0040b374
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4102a4
Capabilities:
Get hostname
Get session user name

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, edx
mov dword [esp], pe_nt_image_headers32
test al, al
je 0x4102c5
push esp
lea eax, [esp + 8]
push eax
call sub.advapi32.dll_GetUserNameA
jmp 0x4102d0
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
mov eax, ebx
lea edx, [esp + 4]
mov ecx, pe_nt_image_headers32
call fcn.00401c88
add esp, 0x104
pop ebx
ret

Function at 0x4102e8
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffc10
mov ebx, edx
push esp
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov eax, dword [esp]
push eax
call sub.ole32.dll_CoTaskMemFree
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x3e9
call fcn.00401c88
add esp, 0x3f0
pop ebx
ret
Function at 0x411bb0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x48], edx
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x411d51
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x41866c]
mov eax, dword [eax]
mov edx, dword [eax + 0xe4]
mov eax, dword [0x4197c4]
mov eax, dword [eax + 0x5c]
call fcn.0040a7e0
mov eax, dword [0x4186ac]
mov eax, dword [eax]
call fcn.0040ad48
mov eax, 0x28
call fcn.0041559c
mov edi, eax
dec edi
test edi, edi
jl 0x411d2e
inc edi
xor ebx, ebx
mov esi, ebx
add esi, esi
lea esi, [esi + esi*2]
mov eax, dword [0x418668]
mov eax, dword [eax]
mov eax, dword [eax + esi*4 + 0x10]
call fcn.00409018
xor edx, edx
mov dl, byte [ebp - 1]
cmp eax, edx
jne 0x411d26
mov eax, dword [0x418668]
mov eax, dword [eax]
mov eax, dword [eax + esi*4 + 4]
lea ecx, [ebp - 8]
xor edx, edx
call fcn.0041085c
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x3c
call fcn.00401330
mov dword [ebp - 0x44], 0x3c
xor eax, eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 8]
call fcn.00401e98
mov dword [ebp - 0x34], eax
lea edx, [ebp - 0x48]
mov eax, dword [ebp - 8]
call fcn.00404024
mov eax, dword [ebp - 0x48]
call fcn.00401e98
mov dword [ebp - 0x2c], eax
mov eax, dword [0x418668]
mov eax, dword [eax]
mov eax, dword [eax + esi*4 + 8]
lea ecx, [ebp - 0x4c]
xor edx, edx
call fcn.0041085c
mov eax, dword [ebp - 0x4c]
call fcn.00401e98
mov dword [ebp - 0x30], eax
mov eax, dword [0x418668]
mov eax, dword [eax]
mov eax, dword [eax + esi*4 + 0xc]
call fcn.00409018
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x40], 0x400
mov eax, dword [0x418668]
mov eax, dword [eax]
mov eax, dword [eax + esi*4 + 0x14]
call fcn.00409018
dec eax
jne 0x411ce3
mov eax, dword [ebp - 0x40]
or eax, 0x40
or eax, 0x200
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x44]
push eax
call sub.shell32.dll_ShellExecuteExA
jmp 0x411cfa
mov eax, dword [0x4186ac]
mov eax, dword [eax]
call fcn.0040ad48
push 0x32
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x411cee
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle
push 0
push 0x2800
mov eax, dword [0x4197c4]
call fcn.00410a24
inc ebx
dec edi
jne 0x411c13
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x411d58
lea eax, [ebp - 0x4c]
mov edx, 2
call fcn.00401a6c
lea eax, [ebp - 8]
call fcn.00401a48
ret
Function at 0x412228
Capabilities:
Delete file

Disassembly:
push ebx
add esp, 0xfffffff0
mov ebx, eax
cmp dword [0x4197e4], 0
jle 0x412247
mov eax, dword [0x4197f0]
call fcn.00401e98
push eax
call sub.kernel32.dll_DeleteFileA
mov eax, ebx
call fcn.004094ac
mov dword [esp], eax
mov eax, dword [esp]
mov edx, 0x4122fc
call fcn.00405264
mov eax, 0x75
call fcn.0041559c
cmp eax, dword [0x4197e4]
jne 0x412285
mov eax, 0x76
call fcn.0041559c
cdq
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
jmp 0x412298
mov eax, 0x5f
call fcn.0041559c
cdq
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
cmp dword [0x4197ec], 1
jne 0x4122c7
mov eax, 0x5f
call fcn.0041559c
mov edx, eax
imul edx, dword [0x4197e4]
mov eax, dword [0x418698]
add edx, dword [eax]
mov eax, dword [0x4197e8]
xor ecx, ecx
call fcn.00409380
push dword [esp + 0xc]
push dword [esp + 0xc]
mov eax, dword [esp + 8]
call fcn.00412024
mov eax, dword [esp]
call fcn.0040867c
mov eax, 0x4197f0
mov edx, ebx
call fcn.00401a9c
add esp, 0x10
pop ebx
ret
Function at 0x412564
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov esi, edx
lea edi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc], ecx
mov esi, eax
xor eax, eax
push ebp
push 0x412722
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x1d], 1
lea eax, [esi + esi*2]
mov edx, dword [0x4186c8]
mov edx, dword [edx]
mov eax, dword [edx + eax*4]
lea ecx, [ebp - 0x24]
xor edx, edx
call fcn.0041085c
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
call fcn.00401a9c
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00401e98
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4126b9
test bl, 0x10
jne 0x4126b9
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00401e98
push eax
call sub.kernel32.dll_CreateFileA
mov edi, eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push edi
call sub.kernel32.dll_GetFileTime
push edi
call sub.kernel32.dll_CloseHandle
lea eax, [esi + esi*2]
mov edx, dword [0x4186c8]
mov edx, dword [edx]
mov eax, dword [edx + eax*4 + 4]
call fcn.00409018
cmp eax, 4
ja case.default.0x41262b
jmp dword [eax*4 + 0x412632]
push ebp
call fcn.00412364
pop ecx
jmp case.default.0x41262b
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x1c]
call fcn.00403f5c
dec eax
jne 0x412666
push ebp
call fcn.00412364
pop ecx
jmp case.default.0x41262b
mov byte [ebp - 0x1d], 0
jmp case.default.0x41262b
mov byte [ebp - 0x1d], 1
jmp case.default.0x41262b
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x1c]
call fcn.00403f5c
dec eax
sete byte [ebp - 0x1d]
jmp case.default.0x41262b
mov byte [ebp - 0x1d], 0
cmp byte [ebp - 0x1d], 0
je 0x4126ce
test bl, 1
je 0x4126a7
and ebx, 0xfffffffe
push ebx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00401e98
push eax
call sub.kernel32.dll_SetFileAttributesA
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00401e98
push eax
call sub.kernel32.dll_DeleteFileA
jmp 0x4126ce
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00404024
mov eax, dword [ebp - 0x28]
call fcn.004040a0
cmp byte [ebp - 0x1d], 0
jne 0x4126de
mov eax, dword [ebp - 0xc]
call fcn.00401a48
jmp 0x412704
lea eax, [esi + esi*2]
mov edx, dword [0x4186c8]
mov edx, dword [edx]
mov eax, dword [edx + eax*4 + 8]
call fcn.00409018
dec eax
jne 0x412704
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
mov eax, dword [0x4197f4]
call fcn.0040b468
mov bl, byte [ebp - 0x1d]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x412729
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00401a6c
ret
Function at 0x415670
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x415749
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
lea ecx, [ebp - 4]
xor edx, edx
mov eax, edi
call fcn.004155ac
mov eax, dword [ebp - 4]
call fcn.00401e98
push eax
call sub.kernel32.dll_DeleteFileA
inc edi
cmp edi, 0x12
jne 0x41568f
test bl, bl
je 0x415706
mov eax, 0x1a
call fcn.0041559c
mov esi, eax
add esi, 0x14
sub esi, 0x14
jl 0x415706
inc esi
mov edi, 0x14
lea ecx, [ebp - 8]
xor edx, edx
mov eax, edi
call fcn.004155ac
mov eax, dword [ebp - 8]
call fcn.00401e98
push eax
call sub.kernel32.dll_DeleteFileA
lea ecx, [ebp - 0xc]
lea eax, [edi + 0x1e]
xor edx, edx
call fcn.004155ac
mov eax, dword [ebp - 0xc]
call fcn.00401e98
push eax
call sub.kernel32.dll_DeleteFileA
inc edi
dec esi
jne 0x4156cd
lea ecx, [ebp - 0x14]
xor edx, edx
mov eax, 1
call fcn.004155ac
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00404024
mov eax, dword [ebp - 0x10]
call fcn.00401e98
push eax
call sub.kernel32.dll_RemoveDirectoryA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x415750
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00401a6c
ret

Function at 0x415ae0
Capabilities:
Compare security identifiers

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov byte [esp], 0
lea eax, [esp + 4]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
mov ebx, eax
test ebx, ebx
jne 0x415b24
call sub.kernel32.dll_GetLastError
cmp eax, 0x3f0
jne 0x415b24
lea eax, [esp + 4]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
mov ebx, eax
test ebx, ebx
je 0x415bbb
mov eax, 0x400
call fcn.0040114c
mov esi, eax
lea eax, [esp + 8]
push eax
push 0x400
push esi
push 2
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_GetTokenInformation
mov ebx, eax
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_CloseHandle
test ebx, ebx
je 0x415bb4
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
push 0x418644
call sub.advapi32.dll_AllocateAndInitializeSid
mov ebx, dword [esi]
dec ebx
test ebx, ebx
jl 0x415baa
inc ebx
xor edi, edi
mov eax, dword [esi + edi*8 + 4]
push eax
mov eax, dword [esp + 0x10]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x415ba6
mov byte [esp], 1
jmp 0x415baa
inc edi
dec ebx
jne 0x415b8d
mov eax, dword [esp + 0xc]
push eax
call sub.advapi32.dll_FreeSid
mov eax, esi
call fcn.00401164
mov al, byte [esp]
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x415eb4
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00401e88
xor eax, eax
push ebp
push 0x415f25
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040904c
mov edx, dword [ebp - 8]
mov eax, 0x419894
call fcn.00401a9c
xor eax, eax
mov dword [0x419890], eax
push 0
push 0x415dc8
call sub.user32.dll_EnumWindows
mov ebx, dword [0x419890]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x415f2c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00401a6c
ret

Function at 0x415f34
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ecx
mov esi, eax
xor ebx, ebx
test esi, esi
jns 0x415f45
call fcn.004013ec
push esi
push 0xffffffffffffffff
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov edi, eax
test edi, edi
jns 0x415f5d
call fcn.004013ec
push esp
mov esi, edi
test esi, esi
jns 0x415f69
call fcn.004013ec
push esi
call sub.kernel32.dll_GetExitCodeProcess
test edi, edi
je 0x415f8c
mov eax, dword [esp]
push eax
test edi, edi
jns 0x415f80
call fcn.004013ec
push esi
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb ebx, ebx
inc ebx
test edi, edi
jns 0x415f95
call fcn.004013ec
push esi
call sub.kernel32.dll_CloseHandle
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret