joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40eedc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x40ef98
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.0040ecb8
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 0x14]
call fcn.004038b4
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x40ef82
xor eax, eax
push ebp
push 0x40ef7b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.004038b4
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
sete byte [ebp - 0xd]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ef82
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ef9f
lea eax, [ebp - 0x14]
call fcn.00403498
ret

Function at 0x40f2e4
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbdc
xor ecx, ecx
mov dword [ebp - 0x424], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x40f424
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0xc]
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0040ecb8
mov eax, dword [ebp - 8]
call fcn.0040a380
xor eax, eax
push ebp
push 0x40f3fc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x40]
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 0xc]
call fcn.004038b4
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x40f3e6
xor eax, eax
push ebp
push 0x40f3df
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x20], 0x400
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x420]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegEnumKeyExA
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x40f3c2
lea eax, [ebp - 0x424]
lea edx, [ebp - 0x420]
call fcn.0040364c
mov edx, dword [ebp - 0x424]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x34]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x1c], 0
je 0x40f370
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f3e6
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f403
mov eax, dword [ebp - 8]
call fcn.0040a43c
ret
Function at 0x40f430
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x40f4e7
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.0040ecb8
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x14]
call fcn.004038b4
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCreateKeyA
test eax, eax
jne 0x40f4cd
xor eax, eax
push ebp
push 0x40f4c6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.004038b4
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
sete byte [ebp - 0xd]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f4d1
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov byte [ebp - 0xd], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f4ee
lea eax, [ebp - 0x14]
call fcn.00403498
ret

Function at 0x40f878
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x40f901
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
lea ecx, [ebp - 0x10]
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.0040ecb8
lea eax, [ebp - 0x18]
push eax
push 0x20006
push 0
mov eax, dword [ebp - 0x10]
call fcn.004038b4
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x40f8eb
mov eax, dword [ebp - 8]
call fcn.004038b4
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegDeleteValueA
test eax, eax
sete byte [ebp - 9]
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f908
lea eax, [ebp - 0x10]
call fcn.00403498
ret
Function at 0x40f910
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x40fa87
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 6], 0
mov dl, 1
mov eax, dword [0x409ac8]
call fcn.00402b48
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x40fa58
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp - 5], 0
je 0x40f9bb
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.0040f2e4
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x40f9bb
inc eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.00410fb0
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x2c]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x2c]
pop eax
call fcn.004036f8
mov eax, dword [ebp - 0x28]
mov dl, 1
call fcn.0040f910
inc dword [ebp - 0x20]
dec dword [ebp - 0x24]
jne 0x40f983
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004110e8
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.00406b5c
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 0xc]
call fcn.00406b28
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.004110e8
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0xc]
call fcn.00403530
lea ecx, [ebp - 0xc]
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.0040ecb8
lea eax, [ebp - 0x18]
push eax
push 0x20006
push 0
mov eax, dword [ebp - 0xc]
call fcn.004038b4
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x40fa42
mov eax, dword [ebp - 0x10]
call fcn.004038b4
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegDeleteKeyA
test eax, eax
sete byte [ebp - 6]
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40fa5f
mov eax, dword [ebp - 0x1c]
call fcn.00402b70
ret
Function at 0x40fa98
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x40fb53
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 0x10]
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.0040ecb8
lea eax, [ebp - 0x18]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 0x10]
call fcn.004038b4
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x40fb3d
xor eax, eax
push ebp
push 0x40fb36
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.004038b4
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x40fb1f
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40fb3d
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40fb5a
lea eax, [ebp - 0x10]
call fcn.00403498
ret

Function at 0x40fee0
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
mov eax, dword [0x41a4a8]
cmp dword [eax], 2
jne 0x40ff4d
test byte [ebp - 4], 0xb
je 0x40ff4d
lea eax, [ebp - 0xc]
push eax
push 0x20
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x40ff4d
lea eax, [ebp - 0x18]
push eax
push 0x40ff68
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
test eax, eax
je 0x40ff4d
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], 2
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
test eax, eax
je 0x40ff61
push 0
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_ExitWindowsEx
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret
Function at 0x40ffa0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov byte [ebp - 9], 0
mov eax, dword [ebp - 8]
mov byte [eax], 0
mov edx, 0x20
mov eax, dword [ebp - 4]
call fcn.00406784
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x410089
xor eax, eax
push ebp
push 0x410082
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 1
lea edx, [ebp - 0x54]
mov ecx, 0x40
mov eax, dword [ebp - 0x10]
call fcn.004067e8
cmp eax, 0x40
je 0x410001
call fcn.00403050
jmp 0x410089
cmp word [ebp - 0x54], 0x5a4d
jne 0x41000f
cmp dword [ebp - 0x18], 0
jne 0x410016
call fcn.00403050
jmp 0x410089
mov eax, dword [ebp - 4]
call fcn.00411038
cmp eax, dword [ebp - 0x18]
jg 0x41002a
call fcn.00403050
jmp 0x410089
xor ecx, ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
call fcn.00406840
inc eax
jne 0x410041
call fcn.00403050
jmp 0x410089
lea edx, [ebp - 0x14]
mov ecx, 4
mov eax, dword [ebp - 0x10]
call fcn.004067e8
cmp eax, 4
je 0x41005d
call fcn.00403050
jmp 0x410089
cmp dword [ebp - 0x14], 0x4550
jne 0x41006c
mov eax, dword [ebp - 8]
mov byte [eax], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x410089
mov eax, dword [ebp - 0x10]
call fcn.0040684c
ret
mov al, byte [ebp - 9]
mov esp, ebp
pop ebp
ret

Function at 0x4101b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x410209
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
lea eax, [ebp - 8]
mov ecx, 0x410220
call fcn.0040373c
mov eax, dword [ebp - 8]
call fcn.004038b4
push eax
call sub.kernel32.dll_WinExec
cmp eax, 0x20
setge byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x410210
lea eax, [ebp - 8]
call fcn.00403498
ret
Function at 0x410554
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc8
xor edx, edx
mov dword [ebp - 0x234], edx
mov dword [ebp - 0x238], edx
mov dword [ebp - 0x1d4], edx
mov dword [ebp - 0x1d8], edx
mov dword [ebp - 0x1dc], edx
mov byte [ebp - 0x1cd], al
xor eax, eax
push ebp
push 0x4107dc
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x238]
call fcn.00412b24
mov eax, dword [ebp - 0x238]
lea edx, [ebp - 0x234]
call fcn.00406b28
mov eax, dword [ebp - 0x234]
lea edx, [ebp - 0x1d8]
call fcn.004110e8
lea edx, [ebp - 0x1dc]
mov eax, dword [ebp - 0x1d8]
call fcn.00406b28
push 1
lea eax, [ebp - 0x234]
push eax
mov ecx, 0x4107f0
xor edx, edx
mov eax, dword [ebp - 0x1dc]
call fcn.00410aa8
mov ecx, dword [ebp - 0x234]
lea eax, [ebp - 0x1d4]
mov edx, dword [ebp - 0x1dc]
call fcn.0040373c
mov edx, dword [ebp - 0x1d4]
lea eax, [ebp - 0x1cc]
call fcn.00404a9a
lea eax, [ebp - 0x1cc]
call fcn.00404d22
call fcn.00402628
push ebp
mov eax, 0x410800
call fcn.004104e4
pop ecx
push ebp
push 0x410810
lea eax, [ebp - 0x238]
call fcn.00412b24
push dword [ebp - 0x238]
push 0x410820
lea eax, [ebp - 0x234]
mov edx, 3
call fcn.004037b0
mov eax, dword [ebp - 0x234]
call fcn.004104e4
pop ecx
push ebp
push 0x41082c
lea eax, [ebp - 0x238]
call fcn.00412b24
push dword [ebp - 0x238]
push 0x410820
push 0x410840
lea eax, [ebp - 0x234]
mov edx, 4
call fcn.004037b0
mov eax, dword [ebp - 0x234]
call fcn.004104e4
pop ecx
cmp byte [ebp - 0x1cd], 0
je 0x4106d9
push ebp
push 0x410854
push dword [ebp - 0x1d8]
push 0x410820
lea eax, [ebp - 0x234]
mov edx, 3
call fcn.004037b0
mov eax, dword [ebp - 0x234]
call fcn.004104e4
pop ecx
push ebp
push 0x410810
push dword [ebp - 0x1d4]
push 0x410820
lea eax, [ebp - 0x234]
mov edx, 3
call fcn.004037b0
mov eax, dword [ebp - 0x234]
call fcn.004104e4
pop ecx
lea eax, [ebp - 0x1cc]
call fcn.00404b3c
call fcn.00402628
lea eax, [ebp - 0x230]
xor ecx, ecx
mov edx, 0x44
call fcn.004028fc
mov dword [ebp - 0x204], 1
mov word [ebp - 0x200], 0
lea eax, [ebp - 0x1ec]
push eax
lea eax, [ebp - 0x230]
push eax
mov eax, dword [ebp - 0x1dc]
call fcn.004038b4
push eax
push 0
push 0x40
push 0
push 0
push 0
push 0x410820
push dword [ebp - 0x1d4]
push 0x410820
lea eax, [ebp - 0x234]
mov edx, 3
call fcn.004037b0
mov eax, dword [ebp - 0x234]
call fcn.004038b4
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x4107ae
mov eax, dword [ebp - 0x1e8]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x1ec]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4107e3
lea eax, [ebp - 0x238]
mov edx, 2
call fcn.004034bc
lea eax, [ebp - 0x1dc]
mov edx, 3
call fcn.004034bc
ret

Function at 0x410914
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004108f0
mov ebx, eax
push 0
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetFileSize_1
cmp ebx, eax
jge 0x41093d
mov byte [ebp - 5], 0
jmp 0x410941
mov byte [ebp - 5], 1
mov al, byte [ebp - 5]
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x410cc8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004038a4
xor eax, eax
push ebp
push 0x410d23
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004038b4
push eax
call sub.kernel32.dll_GetFileAttributesA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x410d04
test byte [ebp - 0xc], 0x10
jne 0x410d08
xor eax, eax
jmp 0x410d0a
mov al, 1
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x410d2a
lea eax, [ebp - 4]
call fcn.00403498
ret

Function at 0x41129c
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
push 0x80
mov eax, dword [ebp - 4]
call fcn.004038b4
push eax
call sub.kernel32.dll_SetFileAttributesA
mov eax, dword [ebp - 4]
call fcn.004069d8
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
pop ecx
pop ecx
pop ebp
ret
Function at 0x412098
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00403498
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004038b4
push eax
call sub.kernel32.dll_GetEnvironmentVariableA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jle 0x4120f0
mov edx, dword [ebp - 0xc]
dec edx
mov eax, dword [ebp - 8]
call fcn.004039c4
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.004038b4
push eax
mov eax, dword [ebp - 4]
call fcn.004038b4
push eax
call sub.kernel32.dll_GetEnvironmentVariableA
mov esp, ebp
pop ebp
ret
Function at 0x4140f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x41435a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp + 0x14]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
call fcn.00412e48
call fcn.00405310
mov byte [eax + 0x6d], 0
call fcn.00405310
mov dl, byte [ebp + 8]
mov byte [eax + 0x6c], dl
call fcn.00405310
add eax, 0x1c
mov edx, dword [ebp - 8]
call fcn.004034ec
xor eax, eax
push ebp
push 0x4142f6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
mov edx, 0x104
call fcn.004039c4
mov eax, dword [ebp - 4]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x14]
call fcn.004038b4
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0xc]
call fcn.004038b4
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0x413fb0
xor eax, eax
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x20], eax
call fcn.00405310
add eax, 0x64
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
call fcn.004034ec
cmp dword [0x41a32c], 0
je 0x4141d8
call fcn.00405310
mov edx, dword [0x41a32c]
mov dword [eax + 0x70], edx
jmp 0x414210
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_IsWindow
test eax, eax
je 0x414203
push 0
push 0
push 0x31
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SendMessageA
mov ebx, eax
call fcn.00405310
mov dword [eax + 0x70], ebx
jmp 0x414210
call fcn.00405310
xor edx, edx
mov dword [eax + 0x70], edx
lea eax, [ebp - 0x3c]
push eax
call sub.shell32.dll_SHBrowseForFolderA
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x41429b
xor eax, eax
push ebp
push 0x414294
push dword fs:[eax]
mov dword fs:[eax], esp
test byte [ebp + 0x11], 0x10
jne 0x41425c
lea eax, [ebp - 0x18]
mov edx, 0x104
call fcn.004039c4
mov eax, dword [ebp - 0x18]
call fcn.004038b4
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
call fcn.00408954
jmp 0x414267
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0x34]
call fcn.0040364c
mov eax, dword [ebp - 0x18]
call fcn.004038b4
mov edx, eax
mov eax, dword [ebp + 0xc]
call fcn.0040364c
mov byte [ebp - 0xd], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41429b
mov eax, dword [ebp - 0x1c]
push eax
call sub.ole32.dll_CoTaskMemFree
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4142fd
call fcn.00405310
cmp dword [eax + 0x68], 0
je 0x4142c7
call fcn.00405310
mov eax, dword [eax + 0x68]
push eax
call sub.user32.dll_UnhookWindowsHookEx
call fcn.00405310
cmp dword [eax + 0x2c], 0
je 0x4142e6
call fcn.00405310
mov eax, dword [eax + 0x2c]
push eax
call sub.user32.dll_DestroyWindow
cmp dword [ebp - 0x38], 0
je 0x4142f5
mov eax, dword [ebp - 0x38]
push eax
call sub.ole32.dll_CoTaskMemFree
ret
Function at 0x416964
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x416b15
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x41b705], 0
je 0x416a06
mov eax, 0x416b2c
call fcn.00415b44
mov eax, dword [0x41b6e0]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x416a06
inc esi
xor ebx, ebx
lea ecx, [ebp - 8]
mov edx, ebx
mov eax, dword [0x41b6e0]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.00415ba0
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0xc]
mov eax, 0xf
call fcn.00415148
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea edx, [ebp - 0x14]
xor ecx, ecx
pop eax
call fcn.00407208
mov eax, dword [ebp - 8]
call fcn.00415b18
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.00410d84
call fcn.00415ad4
inc ebx
dec esi
jne 0x4169a7
mov eax, 0x416b40
call fcn.00415b44
mov eax, dword [0x41b6e0]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
je 0x416af2
mov eax, dword [0x41b6cc]
call fcn.0041129c
mov eax, dword [0x41b6e0]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x416a6d
inc esi
xor ebx, ebx
lea ecx, [ebp - 0xc]
mov edx, ebx
mov eax, dword [0x41b6e0]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.00415ba0
mov ecx, dword [ebp - 8]
mov edx, ebx
mov eax, dword [0x41b6e0]
mov edi, dword [eax]
call dword [edi + 0x20]
inc ebx
dec esi
jne 0x416a40
mov eax, dword [0x41b6e0]
mov edx, dword [eax]
call dword [edx + 0x7c]
mov eax, dword [0x41b6e0]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
cmp ebx, 0
jl 0x416af2
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0xc]
mov edx, ebx
mov eax, dword [0x41b6e0]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x18]
mov eax, 0xf
call fcn.00415148
mov eax, dword [ebp - 0x18]
xor ecx, ecx
pop edx
call fcn.00407208
mov eax, dword [ebp - 8]
call fcn.00415b18
lea ecx, [ebp - 8]
mov edx, ebx
mov eax, dword [0x41b6e0]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 8]
call fcn.004038b4
push eax
call sub.kernel32.dll_RemoveDirectoryA_1
call fcn.00415ad4
dec ebx
cmp ebx, 0xffffffff
jne 0x416a89
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x416b1c
lea eax, [ebp - 0x18]
call fcn.00403498
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004034bc
ret
Function at 0x4171e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov edi, eax
xor eax, eax
push ebp
push 0x417389
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x41739c
mov edx, edi
mov eax, 1
call fcn.0040cb04
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 4]
mov dl, 0x22
call fcn.0040c6c8
lea eax, [ebp - 8]
push eax
mov ecx, 0x41739c
mov edx, edi
mov eax, 2
call fcn.0040cb04
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x41739c
mov edx, edi
mov eax, 3
call fcn.0040cb04
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x41739c
mov edx, edi
mov eax, 4
call fcn.0040cb04
mov eax, dword [ebp - 0x18]
mov edx, 1
call fcn.004066ec
sub eax, 1
jb 0x41727d
je 0x417281
dec eax
je 0x417288
dec eax
je 0x41728f
jmp 0x417296
xor esi, esi
jmp 0x41729b
mov esi, 1
jmp 0x41729b
mov esi, 3
jmp 0x41729b
mov esi, 7
jmp 0x41729b
mov esi, 1
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x41739c
mov edx, edi
mov eax, 5
call fcn.0040cb04
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x10]
mov dl, 0x22
call fcn.0040c6c8
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x41739c
mov edx, edi
mov eax, 6
call fcn.0040cb04
mov eax, dword [ebp - 0x18]
mov edx, 1
call fcn.004066ec
mov byte [ebp - 0x11], al
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x41739c
mov edx, edi
mov eax, 7
call fcn.0040cb04
mov eax, dword [ebp - 0x18]
mov edx, 1
call fcn.004066ec
mov byte [ebp - 0x12], al
mov eax, dword [ebp - 0x10]
call fcn.00415b18
cmp byte [ebp - 0x11], 0
je 0x417336
mov eax, dword [ebp - 0xc]
push eax
push esi
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [0x41b6b4]
call fcn.00414408
cmp byte [ebp - 0x12], 0
je 0x417364
test eax, eax
jne 0x417366
jmp 0x417364
push esi
mov eax, dword [ebp - 0xc]
call fcn.004038b4
push eax
mov eax, dword [ebp - 8]
call fcn.004038b4
push eax
mov eax, dword [ebp - 4]
call fcn.004038b4
push eax
push 0
mov eax, dword [0x41b6b4]
push eax
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
jle 0x417366
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x417390
lea eax, [ebp - 0x18]
call fcn.00403498
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.004034bc
ret