joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a51f
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
mov esi, ecx
test esi, esi
jne 0x40a536
xor al, al
jmp 0x40a5e4
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
push esi
call edi
cmp eax, 0xffffffff
je 0x40a54f
shr al, 4
and al, 1
jmp 0x40a5e3
push 0xffffffffffffffff
push esi
lea eax, [ebp - 0x208]
push 0x104
push eax
call fcn.00423035
mov ax, word [ebp - 0x208]
lea esi, [ebp - 0x208]
add esp, 0x10
test ax, ax
je 0x40a5bc
movzx ecx, ax
push 0x5c
pop eax
cmp cx, ax
jne 0x40a5af
xor eax, eax
mov word [esi], ax
lea eax, [ebp - 0x208]
push eax
call edi
cmp eax, 0xffffffff
jne 0x40a5a9
push 0
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test eax, eax
je 0x40a5dd
push 0x5c
pop eax
mov word [esi], ax
add esi, 2
movzx eax, word [esi]
mov ecx, eax
test ax, ax
jne 0x40a57b
lea eax, [ebp - 0x208]
push eax
call edi
cmp eax, 0xffffffff
jne 0x40a5e1
push 0
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test eax, eax
jne 0x40a5e1
xor al, al
jmp 0x40a5e3
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40a5e9
Capabilities:
Get file attributes

Disassembly:
sub esp, 0x228
push ebx
push ebp
push edi
push dword [0x4a15b0]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
or ebx, 0xffffffff
cmp eax, ebx
jne 0x40a610
mov ecx, dword [0x4a15b0]
call fcn.0040a51f
cmp word [0x4a223c], 0
je 0x40a6e2
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0x463ee4
mov dword [esp + 0x14], ebx
call fcn.0040b6e3
push 0x4a223c
push dword [0x4a17c8]
mov eax, ecx
push dword [0x4a15b0]
push 0x45d9c4
push eax
call fcn.0040c813
add esp, 0x10
lea ecx, [esp + 0x14]
push 2
push 3
push 0x40000000
push dword [esp + 0x2c]
call fcn.004011ce
xor ebp, ebp
test al, al
je 0x40a6c3
push 2
push 0x45d964
lea ecx, [esp + 0x18]
call fcn.0040a9bb
mov edx, dword [0x4a22f8]
test edx, edx
je 0x40a6a0
mov ecx, edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bp
jne 0x40a68f
sub ecx, edi
sar ecx, 1
jmp 0x40a6a2
mov ecx, ebp
lea eax, [ecx + ecx]
push eax
push edx
lea ecx, [esp + 0x18]
call fcn.0040a9bb
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x40a6c7
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, ebx
jmp 0x40a6c7
mov eax, dword [esp + 0x14]
mov dword [esp + 0x18], 0x45bcb8
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
cmp eax, ebx
je 0x40a6e2
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop ebp
pop ebx
add esp, 0x228
ret
Function at 0x40a6ec
Capabilities:
Create process memory minidump
Delete file

Disassembly:
sub esp, 0x234
push ebx
push ebp
push esi
push edi
xor eax, eax
lea edi, [esp + 0x1c]
stosd dword es:[edi], eax
lea ecx, [esp + 0x28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.0040b6e3
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
mov edi, dword [esp + 0x248]
push 0x4a223c
push dword [0x4a17c8]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x30]
push dword [0x4a15b0]
mov dword [esp + 0x2c], edi
push str._s_s._s.tmp
push eax
call fcn.0040c813
add esp, 0x14
xor ebx, ebx
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push dword [esp + 0x44]
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
or ebp, 0xffffffff
cmp esi, ebp
je 0x40a881
push ebx
xor eax, eax
lea ecx, [esp + 0x20]
push ebx
test edi, edi
cmove ecx, eax
push ecx
push 0x1104
push esi
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.dbghelp.dll_MiniDumpWriteDump]
mov ebx, dword [sym.imp.KERNEL32.DLL_CloseHandle]
push esi
call ebx
and dword [esp + 0x10], 0
cmp dword [esp + 0x2c], 0
mov dword [esp + 0x14], 0x463ee4
mov dword [esp + 0x18], ebp
je 0x40a881
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x30]
lea ecx, [esp + 0x1c]
call fcn.0040a911
mov edi, eax
test edi, edi
je 0x40a876
mov esi, 0x4a223c
lea eax, [esp + 0x28]
push esi
push str._s.dmp
push eax
call fcn.0040c813
mov ecx, dword [esp + 0x38]
add esp, 0xc
test ecx, ecx
je 0x40a7fb
push dword [esp + 0x10]
push edi
call fcn.0040a9f5
push esi
push dword [0x4a17c8]
lea eax, [esp + 0x30]
push dword [0x4a15b0]
push str._s_s._s.tmp
push eax
call fcn.0040c813
add esp, 0x14
push dword [esp + 0x10]
push 0
push edi
call fcn.004183a0
pop ecx
pop ecx
push 3
push 2
push 0x40000000
push dword [esp + 0x3c]
lea ecx, [esp + 0x28]
call fcn.004011ce
test al, al
je 0x40a85f
push dword [esp + 0x10]
lea ecx, [esp + 0x18]
push edi
call fcn.0040a9bb
mov esi, dword [esp + 0x18]
cmp esi, ebp
je 0x40a863
push esi
call ebx
mov esi, ebp
jmp 0x40a863
mov esi, dword [esp + 0x18]
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
push edi
call fcn.004166cf
pop ecx
jmp 0x40a87a
mov esi, dword [esp + 0x18]
cmp esi, ebp
je 0x40a881
push esi
call ebx
lea ecx, [esp + 0x28]
call fcn.0040b2f3
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x234
ret 8
Function at 0x40a911
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push edi
push ecx
push 3
push 3
push SysReAllocString
push dword [esp + 0x20]
xor ebx, ebx
mov edi, ecx
mov dword [esp + 0x1c], ebx
call fcn.004011ce
test al, al
jne 0x40a937
xor eax, eax
jmp 0x40a9b5
push ebp
mov ecx, edi
call fcn.00401209
mov ebp, dword [esp + 0x18]
mov dword [ebp], eax
test eax, eax
jne 0x40a955
mov ecx, edi
call fcn.004011b6
xor eax, eax
jmp 0x40a9b4
push esi
add eax, 0x10
push 0x44d836
push eax
call fcn.004166c6
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x40a9aa
cmp dword [ebp], ebx
jbe 0x40a9a8
push ebx
lea eax, [esp + 0x14]
push eax
push dword [ebp]
push esi
push dword [edi + 4]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x40a996
push esi
call fcn.004166cf
pop ecx
mov esi, ebx
mov dword [ebp], ebx
jmp 0x40a9a8
mov eax, dword [esp + 0x10]
mov dword [ebp], eax
mov byte [esi + eax], bl
mov eax, dword [esp + 0x10]
mov byte [esi + eax + 1], bl
mov ebx, esi
mov ecx, edi
call fcn.004011b6
mov eax, ebx
pop esi
pop ebp
pop edi
pop ebx
pop ecx
ret 8

Function at 0x40af66
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4a22f8]
sub esp, 0x200
test eax, eax
jne 0x40af96
push 0x44d836
push 0x80000
call fcn.004166c6
mov dword [0x4a22f8], eax
pop ecx
pop ecx
test eax, eax
je 0x40b0b9
xor ecx, ecx
mov word [eax], cx
cmp dword [ebp + 8], ecx
je 0x40afad
push dword [ebp + 8]
mov ecx, 0x4a15ac
call fcn.0040c54b
cmp dword [ebp + 0xc], 0
je 0x40afc0
push dword [ebp + 0xc]
mov ecx, 0x4a17c4
call fcn.0040c54b
cmp dword [ebp + 0x10], 0
je 0x40afd3
push dword [ebp + 0x10]
mov ecx, 0x4a19dc
call fcn.0040c54b
mov eax, dword [ebp + 0x14]
mov dword [0x4a2290], eax
mov eax, dword [ebp + 0x18]
mov dword [0x4a2294], eax
mov eax, dword [ebp + 0x20]
mov dword [0x4a2298], eax
mov eax, dword [0x4a22f0]
or eax, dword [0x4a22f4]
jne 0x40b00a
push eax
call fcn.004233e0
pop ecx
mov dword [0x4a22f0], eax
mov dword [0x4a22f4], edx
cmp dword [ebp + 0x1c], 0
je 0x40b01d
push dword [ebp + 0x1c]
mov ecx, 0x4a229c
call fcn.0040c54b
push edi
mov edi, 0x4a1e0c
mov ecx, edi
call fcn.00401782
test al, al
je 0x40b0b8
push ebx
push esi
push 0x200
lea eax, [ebp - 0x200]
push 0
push eax
call fcn.004183a0
mov esi, dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
lea eax, [ebp - 0x200]
add esp, 0xc
mov ebx, 0x100
push ebx
push eax
push 0x45d9dc
call esi
test eax, eax
jne 0x40b07b
push ebx
lea eax, [ebp - 0x200]
push eax
push str.COMPUTERNAME
call esi
test eax, eax
je 0x40b0b6
lea eax, [ebp - 0x200]
mov ecx, edi
push eax
call fcn.0040c54b
push ebx
lea eax, [ebp - 0x200]
push eax
push str.USERDOMAIN
call esi
test eax, eax
je 0x40b0b6
push 0x45dd54
mov ecx, edi
call fcn.0040c7b8
lea eax, [ebp - 0x200]
mov ecx, edi
push eax
call fcn.0040c7b8
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x40b1f6
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
mov esi, ecx
cmp dword [esi + 4], 0
je 0x40b22e
lea eax, [ebp - 4]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.DLL_GetExitCodeThread]
cmp dword [ebp - 4], 0x103
jne 0x40b221
xor al, al
jmp 0x40b252
push dword [esi + 4]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
and dword [esi + 4], 0
lea eax, [ebp - 4]
push eax
push 0x10000
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp + 0x10]
push 0
call fcn.00424df6
add esp, 0x18
mov dword [esi + 4], eax
test eax, eax
setne al
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x40e449
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 8]
push ebx
mov ebx, ecx
test edx, edx
jne 0x40e459
push 0xd
pop eax
jmp 0x40e49e
push ebp
push esi
xor eax, eax
push edi
mov dword [esp + 0x18], eax
mov esi, eax
mov edi, edx
mov ecx, edi
lea ebp, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [esp + 0x18]
jne 0x40e46b
sub ecx, ebp
sar ecx, 1
inc ecx
lea edi, [edi + ecx*2]
lea esi, [esi + ecx*2]
cmp ecx, 1
jne 0x40e466
push esi
push edx
push 7
xor eax, eax
push eax
push dword [esp + 0x24]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x40e99d
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x21c
push ebx
mov ebx, ecx
lea ecx, [esp + 8]
push ebp
push esi
xor ebp, ebp
mov eax, dword [ebx + 4]
or eax, 0x2001f
mov dword [esp + 0x10], ebp
push eax
push dword [esp + 0x230]
mov dword [esp + 0x1c], ebp
push dword [ebx]
mov dword [esp + 0x24], ebp
call fcn.0040e93f
mov esi, eax
test esi, esi
jne 0x40ea6c
lea eax, [esp + 0x20]
mov dword [esp + 0x1c], 0x100
push eax
push ebp
push ebp
push ebp
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x3c]
push eax
push ebp
push dword [esp + 0x2c]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
call ebp
test eax, eax
jne 0x40ea41
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x14]
call fcn.0040e99d
mov esi, eax
test esi, esi
jne 0x40ea6c
lea eax, [esp + 0x20]
mov dword [esp + 0x1c], 0x100
push eax
push esi
push esi
push esi
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x3c]
push eax
push esi
push dword [esp + 0x2c]
call ebp
test eax, eax
je 0x40ea06
jmp 0x40ea43
xor esi, esi
cmp dword [esp + 0x10], 0
je 0x40ea58
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], esi
push dword [esp + 0x22c]
mov ecx, ebx
mov dword [esp + 0x18], esi
call fcn.0040eb2b
mov esi, eax
cmp dword [esp + 0x10], 0
je 0x40ea7d
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x21c
ret 4
Function at 0x40f3d3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x40c
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_LoadLibraryExW]
xor ebp, ebp
push edi
push 0x60
push ebp
push dword [esp + 0x428]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x24], ebp
call esi
mov edi, eax
push 2
pop eax
test edi, edi
jne 0x40f423
push eax
push ebp
push dword [esp + 0x428]
call esi
mov edi, eax
test edi, edi
jne 0x40f423
call fcn.0040def4
mov esi, eax
jmp 0x40f4e8
push dword [esp + 0x428]
push dword [esp + 0x428]
push edi
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov esi, eax
test esi, esi
jne 0x40f448
call fcn.0040def4
jmp 0x40f4db
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x40f43e
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
cmp eax, esi
jae 0x40f46e
mov esi, 0x8007000e
jmp 0x40f4dd
push 2
pop ecx
mul ecx
cmp edx, ebp
ja 0x40f50a
jb 0x40f486
cmp eax, 0xffffffff
ja 0x40f50a
cmp eax, 0x400
jbe 0x40f499
push eax
lea ecx, [esp + 0x1c]
call fcn.0040ded2
jmp 0x40f4a1
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], ebp
je 0x40f467
push esi
push dword [esp + 0x1c]
push esi
push ebx
push ebp
push 3
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x40f43e
mov eax, dword [esp + 0x18]
xor edx, edx
push dword [esp + 0x42c]
mov word [eax + ecx*2], dx
lea ecx, [esp + 0x14]
push dword [esp + 0x1c]
call fcn.0040f2a7
mov esi, eax
test edi, edi
je 0x40f4e8
push edi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
lea eax, [esp + 0x1c]
cmp dword [esp + 0x18], eax
je 0x40f4fb
lea ecx, [esp + 0x18]
call fcn.0040dec9
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x40c
ret 0x10
push 0x80070216
call fcn.0040e809
int3

Function at 0x40f869
Capabilities:
Check os version

Disassembly:
sub esp, 0x114
push ebx
push ebp
push esi
push 0x30
pop esi
push esi
xor ebp, ebp
mov ebx, ecx
push ebp
push ebx
call fcn.004183a0
push 0x110
lea eax, [esp + 0x20]
mov dword [esp + 0x1c], 0x114
push ebp
push eax
call fcn.004183a0
add esp, 0x18
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExW]
test eax, eax
je 0x40f8b2
cmp dword [esp + 0x10], 6
jae 0x40f8b5
push 0x2c
pop esi
mov eax, dword [esp + 0x128]
mov dword [ebx], esi
mov esi, dword [esp + 0x130]
mov dword [ebx + 4], ebp
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], 1
test esi, esi
je 0x40f8df
push edi
lea edi, [ebx + 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
mov eax, dword [0x47dbc8]
pop esi
mov dword [ebx + 0x20], eax
mov eax, dword [esp + 0x130]
mov dword [ebx + 0x28], ebp
pop ebp
mov dword [ebx + 0x24], eax
pop ebx
add esp, 0x114
ret 0x18
Function at 0x41016f
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov bl, 1
mov ecx, dword [edi + 0x54]
mov eax, ecx
and eax, 0xc
cmp al, 0xc
jne 0x4101ba
mov eax, dword [edi + 4]
mov esi, dword [sym.imp.USER32.dll_GetDlgCtrlID]
push eax
mov dword [ebp - 0xc], eax
call esi
push dword [edi + 4]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0xfffffffe
call esi
push dword [edi + 4]
mov esi, eax
call dword [sym.imp.USER32.dll_GetParent]
lea ecx, [ebp - 0xc]
push ecx
push esi
push 0x4e
jmp 0x4101e2
shr ecx, 2
test cl, 1
je 0x4101eb
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
push dword [edi + 4]
mov esi, eax
call dword [sym.imp.USER32.dll_GetParent]
push dword [edi + 4]
movzx ecx, si
push ecx
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x410218
push 1
xor esi, esi
push esi
push esi
push dword [edi + 0x28]
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
seta bl
jbe 0x410218
or byte [edi + 0x58], 2
push 1
push esi
push dword [edi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x410dc5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
push ecx
push ebx
push ebp
push edi
xor ebx, ebx
mov dword [esp + 0x10], ecx
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
mov edi, eax
movzx eax, word [esp + 0x18]
push 0x45f604
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov ebp, eax
test ebp, ebp
je 0x410f00
push esi
push ebp
push edi
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov esi, eax
cmp esi, 0x10
jbe 0x410eff
push ebp
push edi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov ebp, eax
test ebp, ebp
je 0x410eff
push esi
push 2
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x410eff
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
test eax, eax
je 0x410ef8
push esi
push ebp
push eax
mov dword [esp + 0x28], ebx
call fcn.004309f0
add esp, 0xc
lea eax, [esp + 0x1c]
push eax
push ebx
push edi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x410ef1
mov ecx, dword [esp + 0x1c]
call fcn.00410f43
mov ebp, eax
mov eax, dword [esp + 0x1c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
test ebp, ebp
je 0x410ef1
push dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
push 0xfc
push 0x1e0
mov dword [esp + 0x1c], ebx
call fcn.004110db
test al, al
je 0x410ee8
push dword [esp + 0x28]
lea eax, [esp + 0x14]
push eax
push dword [ebp + 4]
call dword [sym.imp.gdiplus.dll_GdipCreateHBITMAPFromBitmap]
test eax, eax
je 0x410ebb
mov dword [ebp + 8], eax
jmp 0x410ebd
mov eax, ebx
test eax, eax
jne 0x410ee8
mov esi, dword [esp + 0x10]
test esi, esi
je 0x410ee8
push dword [esp + 0x28]
mov eax, dword [esp + 0x18]
push esi
push dword [eax + 4]
call dword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
test esi, esi
je 0x410ee6
push esi
call dword [sym.imp.GDI32.dll_DeleteObject]
mov bl, 1
mov eax, dword [ebp]
mov ecx, ebp
push 1
call dword [eax]
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
pop esi
pop edi
pop ebp
mov al, bl
pop ebx
pop ecx
pop ecx
ret 0x10

Function at 0x411eb7
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
lea eax, [ebp - 0x5c]
push ebx
push esi
push edi
push 0x44
xor ebx, ebx
mov esi, ecx
push ebx
push eax
call fcn.004183a0
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
mov ecx, esi
call fcn.00411f2f
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x5c]
push ecx
push ebx
push ebx
push 8
push ebx
push ebx
push ebx
push dword [eax + 4]
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
test eax, eax
jne 0x411f0d
xor al, al
jmp 0x411f26
mov eax, dword [ebp - 0x14]
mov dword [esi], eax
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [esi + 4], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x14], eax
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4132ae
Capabilities:
Delete directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
push esi
push 0x46235c
push 0x10
lea eax, [esp + 0x20]
mov esi, ecx
push eax
lea ecx, [esp + 0x14]
call fcn.0041137a
and dword [esp + 4], 0
lea eax, [esp + 4]
push eax
lea edx, [esp + 0xc]
mov dword [esp + 0xc], 0x462358
mov ecx, esi
call fcn.004130a2
pop ecx
test al, al
je 0x413328
push dword [esi + 4]
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
test eax, eax
je 0x413302
mov al, 1
jmp 0x41332a
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 5
jne 0x413328
push 0x80
push dword [esi + 4]
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
test eax, eax
jne 0x4132fe
xor al, al
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x413d0c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.004309c0
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
je 0x413d65
mov edi, 0x49f540
push edi
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov esi, dword [0x4a0304]
jmp 0x413d5a
push dword [ebp + 8]
push esi
call fcn.00425930
pop ecx
pop ecx
test eax, eax
jne 0x413d54
lea ecx, [esi + 0x894]
call fcn.00401782
test al, al
je 0x413d70
mov esi, dword [esi + 0x18c0]
test esi, esi
jne 0x413d36
push edi
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x800
lea eax, [ebp - 0x1000]
push eax
lea ecx, [ebp - 0x1010]
call fcn.00401c3e
cmp byte [esi + 0x80], 0
mov ecx, 0x10a4
mov eax, 0x894
mov dword [ebp - 0x1010], 0x45dc20
cmove eax, ecx
lea ecx, [ebp - 0x1010]
add eax, esi
push eax
call fcn.0040d181
xor ebx, ebx
mov byte [esi + 0x80], bl
cmp dword [ebp + 0xc], ebx
je 0x413df2
push 0x462a18
lea ecx, [ebp - 0x1010]
call fcn.00411d77
test eax, eax
jns 0x413de4
push 0x462a1c
lea ecx, [ebp - 0x1010]
call fcn.0040c7b8
push dword [ebp + 0xc]
lea ecx, [ebp - 0x1010]
call fcn.0040c7b8
push edi
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
push 1
push ebx
push ebx
push dword [ebp - 0x100c]
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov al, 1
jmp 0x413d67
Function at 0x414429
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi], ebx
je 0x4144ee
mov edx, dword [esi + 8]
test edx, edx
je 0x4144ee
mov ebp, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esi + 0x10]
dec eax
mov dword [esp + 0x1c], ecx
mov edi, dword [ebp + 4]
lea eax, [edi + eax*2]
mov dword [esp + 0x10], eax
lea eax, [edx + ecx*2]
mov dword [esp + 0x18], eax
lea eax, [esi + 0x14]
cmp dword [esi + 0x18], ebx
je 0x414480
mov edx, dword [eax]
lea eax, [ecx + ecx]
cmp eax, edx
je 0x41447d
mov ecx, dword [esp + 0x1c]
jmp 0x4144d8
lea eax, [esi + 0x14]
push ebx
push eax
push dword [esi + 0xc]
mov dword [esi + 0x10], ebx
push dword [esi + 8]
push dword [esi]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x4144ee
mov edx, dword [esi + 0x14]
cmp edx, 1
jb 0x414530
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0x10]
mov dword [esp + 0x18], eax
jmp 0x4144d8
cmp edi, dword [esp + 0x10]
jae 0x41451f
mov ecx, dword [esp + 0x18]
movzx eax, word [ecx]
cmp eax, 0xa
je 0x4144f8
add ecx, 2
mov word [edi], ax
mov dword [esp + 0x18], ecx
add edi, 2
mov ecx, dword [esi + 0x10]
inc ecx
mov dword [esi + 0x10], ecx
mov edx, dword [esi + 0x14]
lea eax, [ecx + ecx]
cmp eax, edx
jb 0x4144af
lea eax, [ecx + ecx]
mov dword [esp + 0x1c], ecx
cmp eax, edx
jbe 0x414466
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
cmp edi, dword [ebp + 4]
jbe 0x414507
lea eax, [edi - 2]
cmp word [eax], 0xd
cmove edi, eax
xor eax, eax
mov ecx, ebp
mov word [edi], ax
call fcn.00401be0
mov eax, dword [esi + 0x18]
inc dword [esi + 0x10]
inc eax
mov dword [esi + 0x18], eax
jmp 0x4144f0
xor eax, eax
mov ecx, ebp
mov word [edi], ax
call fcn.00401be0
mov eax, dword [esi + 0x18]
jmp 0x4144f0
xor eax, eax
mov ecx, ebp
mov word [edi], ax
call fcn.00401be0
cmp edi, dword [ebp + 4]
je 0x414544
mov ebx, dword [esi + 0x18]
mov eax, ebx
jmp 0x4144f0