joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7b2104
Capabilities:
Encode data using add xor sub operations

Disassembly:
inc ebp
mov dword [ebp], ebx
call fcn.0082d0b8
mov ecx, 0xad285d32
ror ecx, cl
movzx esi, cx
mov esi, dword [ebp + ecx*4 - 0x5d32ad28]
ror cl, 0x85
add ecx, ecx
mov ecx, dword [ebp + ecx - 0x2e9956a0]
ja 0x7d1ec4
adc esi, 4
call fcn.00b1dbba
dec esi
mov ebx, dword [esp + ebx*2 - 0x1facc]
pop esi
dec esp
mov esi, dword [esp + esi*2 + 0x55ed9e28]
dec eax
mov esi, dword [esp + esi + 0x2af6cf4c]
dec eax
lea esp, [esp + 0x70]
ret
adc ebp, 8
push 0x30ae1312
mov dword ss:[esi], ecx
push 0xe803e30b
lea esp, [esp + 8]
jmp fcn.007b2609

Function at 0x7c970e
Capabilities:
Encode data using add xor sub operations

Disassembly:
mov dword [esp + 4], 0xb42cd38e
call fcn.007adba1

Function at 0x7cdec9
Capabilities:
Encode data using add xor sub operations

Disassembly:
mov word [ebp], ax
lea esp, [esp + 4]
jmp fcn.007b2609

Function at 0x7e8e42
Capabilities:
Encode data using xor

Disassembly:
xor edx, edx
test ecx, ecx
push 0xf3922804
lea esp, [esp + 8]
je 0x7e8e84
movzx eax, byte [ebp]
xor eax, edx
push 0x3f99a41b
and eax, 0xff
mov eax, dword [eax*4 + 0x7bbe7c]
shr edx, 8
xor edx, eax
inc ebp
xor edx, 0xd1ad8ba7
dec ecx
lea esp, [esp + 4]
jne 0x7e8e55
jmp 0xa5f5be

Function at 0xa5e674
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
ret
mov esp, ebp
jmp 0xb21eab
inc ecx
xor cl, byte [ebp + ecx*4 + 8]
call fcn.00a88948
jmp 0xb7791c
cmp esi, 0xffff
jmp 0xb22cf5
mov eax, dword [edx + 0x3c]
cmc
cmp bp, 0x7d9d
lea eax, [eax + edx]
test dx, sp
cmp dword [eax], 0x4550
jne 0xb34149
mov ecx, dword [eax + 0x78]
clc
mov dword [ebp - 4], ecx
cmp cl, 3
test bl, al
test ecx, ecx
jmp 0xb1ec6d
je 0xb34149
mov eax, dword [eax + 0x7c]
jmp 0xb5e9e7
pop ebp
jmp 0x7ba1ef
ja 0xb47dd0
mov edx, dword [esi]
call 0x81b5e2
push esi
stc
test edx, edx
je 0xb34149
mov esi, dword [ebp + 0xc]
test ebp, 0xca268837
cmp si, sp
test esi, esi
jmp 0xb329a6
je 0xb34149
mov eax, 0x5a4d
stc
test ecx, 0x101b173f
test di, dx
cmp word [edx], ax
jmp 0xb34143
je 0xa801b2
sub eax, eax
not esi
pop esi
jmp 0x839cc0
mov edi, dword [ecx + edx + 0x18]
cmc
clc
test edx, ebp
test edi, edi
je 0xb41cf9
mov eax, dword [ecx + edx + 0x20]
jmp 0xb7cfe9
push ebx
push edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0xffffffff
jmp 0xa744f1
jmp 0xb2541b

Function at 0xa6e198
Capabilities:
Encode data using add xor sub operations

Disassembly:
mov dword [esi], ebp
jmp 0xa8682e
call fcn.00a9b752
inc eax
mov al, byte [ebp + 4]
push 0xba817481
add ebp, 6
mov byte ss:[ecx], al
push 0x3510fa09
lea esp, [esp + 8]
jmp fcn.007b2609

Function at 0xa90431
Capabilities:
Encode data using add xor sub operations

Disassembly:
add edi, 2
mov dword [esp], 0x37bf76a6
xor cx, bx
inc cx
xor cx, 0x271a
neg cx
sub cx, 0xe205
not cx
push 0x1d14692f
inc cx
sal byte [esp], 0x85
xor cx, 0x6a17
not cx
push 0x98beeea3
xor cx, 0xc624

Function at 0xb84340
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
btr edx, ebx
mov edx, dword [ebp + 8]
lea esp, [esp - 0x114]
jmp 0xb25422
Function at 0x100313d0
Capabilities:
Encode data using xor

Disassembly:
inc esi
pop edi
mov esi, ebx
mov ebp, 0x3dbb6c29
lodsd eax, dword [esi]
adc edx, dword [edi + 0x58]
aaa
invalid
Function at 0x402ad4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x43f008], 0x8088405
inc edx
mov dword [ebx + 0x43f008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x402f5c
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x43f024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402ff4
push 0x80000002
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x402fd4
xor eax, eax
push ebp
push 0x402fcd
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403010
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402fd4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
ret
mov ax, word [0x43f024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x43f024], ax
mov esp, ebp
pop ebp
ret
Function at 0x405160
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call fcn.0040123c
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405390
push 0x80000001
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4051e3
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405390
push 0x80000002
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4051e3
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4053ac
push 0x80000001
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x40526c
xor eax, eax
push ebp
push 0x405265
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00404fa8
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x40524a
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x4053cc
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x40524a
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40526c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call fcn.00401274
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call fcn.0040125c
push eax
call fcn.00401234
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x405386
cmp byte [ebp - 0xd], 0
jne 0x4052b3
cmp byte [ebp - 0x12], 0
je 0x405386
lea eax, [ebp - 0x11d]
push eax
call fcn.0040127c
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x4052cc
dec ebx
cmp byte [ebx], 0x2e
je 0x4052db
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x4052cb
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x405386
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405318
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call fcn.00401274
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call fcn.00401264
mov esi, eax
test esi, esi
jne 0x405386
cmp byte [ebp - 0xd], 0
je 0x405386
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call fcn.00401274
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call fcn.00401264
mov esi, eax
test esi, esi
jne 0x405386
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call fcn.00401274
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call fcn.00401264
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406a3c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x110], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x406b46
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x406a8f
push 0x105
lea eax, [ebp - 0x109]
push eax
push 0
call sub.KERNEL32.DLL_UnhandledExceptionFilter
mov ecx, eax
lea edx, [ebp - 0x109]
mov eax, dword [ebp - 4]
call fcn.00403f6c
jmp 0x406b2d
call sub.KERNEL32.DLL_ReadFile
mov ebx, eax
mov eax, ebx
call fcn.004069f0
mov ebx, eax
mov edi, ebx
mov eax, ebx
call fcn.00406a10
mov ebx, eax
test esi, esi
je 0x406ab7
dec esi
test esi, esi
jl 0x406ab7
cmp edi, ebx
jne 0x406a96
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x110]
mov edx, edi
call fcn.00404074
mov eax, dword [ebp - 0x110]
mov ecx, ebx
sub ecx, edi
mov edx, 1
call fcn.0040439c
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040413c
cmp eax, 2
jl 0x406b2d
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp byte [eax], 0x22
jne 0x406b2d
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040413c
mov edx, dword [ebp - 4]
mov edx, dword [edx]
cmp byte [edx + eax - 1], 0x22
jne 0x406b2d
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040413c
mov ecx, eax
sub ecx, 2
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, 2
call fcn.0040439c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406b4d
lea eax, [ebp - 0x110]
call fcn.00403e7c
ret

Function at 0x4077ec
Capabilities:
Delete file

Disassembly:
push edi
mov edi, eax
push esi
mov esi, edx
call fcn.004077dc
mov eax, esi
mov edx, esp
call fcn.00406504
test al, al
jne 0x40787d
pop edx
pop ecx
pop eax
push eax
push ecx
push edx
sub eax, edx
cmp edx, dword [esi]
mov dl, 0
je 0x407813
inc edx
cmp ecx, dword [esi + 4]
je 0x40781b
or dl, 2
or byte [edi + 0xbe], dl
push eax
mov eax, dword [edi + 0x12e]
sub eax, ecx
push eax
push edi
cmp byte [edi + 0xfe], 0
jne 0x40783c
mov eax, edi
call fcn.004078e0
lea edi, [edi + 0x122]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, edi
pop edi
mov ecx, dword [edi + 0x28]
jecxz 0x40786c
std
push 0x14
lodsd eax, dword [esi]
lodsd eax, dword [esi]
xchg edx, eax
lodsd eax, dword [esi]
xchg ecx, eax
lodsd eax, dword [esi]
sub edx, eax
push edx
xchg edx, eax
lodsd eax, dword [esi]
cld
sub ecx, eax
push ecx
push edx
push eax
push 0
push dword [edi + 0x28]
call sub.KERNEL32.DLL_DeleteFileA
pop edx
pop eax
cmp byte [edi + 0x4c1], 0
je 0x40787d
xchg edi, eax
call fcn.004078e0
add esp, 0x10
pop esi
pop edi
ret
Function at 0x409868
Capabilities:
Get file size

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
or eax, 0xffffffff
mov esi, ebx
and esi, 3
cmp esi, 2
ja 0x4098bb
mov edx, ebx
and edx, 0xf0
cmp edx, 0x40
ja 0x4098bb
push 0
push 0x80
push 3
push 0
mov eax, ebx
and eax, 0xf0
shr eax, 4
mov eax, dword [eax*4 + 0x43f268]
push eax
mov eax, dword [esi*4 + 0x43f25c]
push eax
mov eax, edi
call fcn.0040433c
push eax
call sub.KERNEL32.DLL_GetFileSize
pop edi
pop esi
pop ebx
ret

Function at 0x4098c0
Capabilities:
Get file size

Disassembly:
push ebx
mov ebx, eax
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, ebx
call fcn.0040433c
push eax
call sub.KERNEL32.DLL_GetFileSize
pop ebx
ret

Function at 0x409984
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
push ebx
mov ebx, eax
lea eax, [ebp - 0x14c]
push eax
mov eax, ebx
call fcn.0040433c
push eax
call sub.KERNEL32.DLL_GlobalAlloc
cmp eax, 0xffffffff
je 0x4099dd
push eax
call sub.KERNEL32.DLL_GetWindowsDirectoryA
test byte [ebp - 0x14c], 0x10
jne 0x4099dd
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x138]
push eax
call sub.KERNEL32.DLL_GetVersionExA
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 2]
push eax
lea eax, [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GetTimeZoneInformation
test eax, eax
jne 0x4099e4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40d2f4
Capabilities:
Get geographical location

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
je 0x40d35b
mov eax, dword [esp + 0x10]
mov dword [0x43f1e4], eax
mov eax, dword [esp + 4]
mov dword [0x43f1e8], eax
mov eax, dword [esp + 8]
mov dword [0x43f1ec], eax
cmp dword [0x43f1e4], 1
jne 0x40d33f
mov eax, dword [esp + 0xc]
and eax, 0xffff
mov dword [0x43f1f0], eax
jmp 0x40d348
mov eax, dword [esp + 0xc]
mov dword [0x43f1f0], eax
mov eax, 0x43f1f4
lea edx, [esp + 0x14]
mov ecx, 0x80
call fcn.004040ec
add esp, 0x94
ret

Function at 0x40d840
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40d8a4
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_RtlUnwind
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004040ec
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_LockResource
mov edx, eax
pop eax
call fcn.0040967c
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d8ab
lea eax, [ebp - 0xc]
call fcn.00403e7c
ret

Function at 0x40e020
Capabilities:
Create thread
Write file on windows

Disassembly:
push ebx
push 0x40e058
call sub.KERNEL32.DLL_WriteFile
mov ebx, eax
test ebx, ebx
je 0x40e041
push 0x40e068
push ebx
call sub.KERNEL32.DLL_CreateThread
mov dword [0x43f250], eax
cmp dword [0x43f250], 0
jne 0x40e054
mov eax, 0x409ac0
mov dword [0x43f250], eax
pop ebx
ret
Function at 0x40e1d4
Capabilities:
Get file attributes

Disassembly:
push ebx
push esi
test dl, dl
je 0x40e1e2
add esp, 0xfffffff0
call fcn.004033f0
mov ebx, edx
mov esi, eax
xor edx, edx
mov eax, esi
call fcn.004030b4
mov dword [esi + 0xc], 0xffff
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
call sub.KERNEL32.DLL_GetFileAttributesA
mov dword [esi + 0x10], eax
push 0
push 0
push 0
push 0
call sub.KERNEL32.DLL_GetFileAttributesA
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], 0xffffffff
mov dl, 1
mov eax, dword [0x408f70]
call fcn.004030b4
mov dword [esi + 0x20], eax
mov eax, esi
test bl, bl
je 0x40e241
call fcn.00403448
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
ret

Function at 0x40eeb4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, edx
mov edx, ebx
mov ecx, dword [ebp + 8]
cmp dword [ecx - 4], 0
je 0x40eeda
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.KERNEL32.DLL_CreateThread
mov edx, eax
test edx, edx
jne 0x40eeda
mov edx, ebx
mov eax, edx
pop ebx
pop ebp
ret

Function at 0x4198b8
Capabilities:
Get file attributes

Disassembly:
push 0x44489c
call sub.KERNEL32.DLL_MultiByteToWideChar
push 0x4198e8
push 0
push 0xffffffffffffffff
push 0
call sub.KERNEL32.DLL_GetFileAttributesA
mov dword [0x444884], eax
cmp dword [0x444884], 0
jne 0x4198e5
call fcn.0040df54
ret

Function at 0x419d98
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 4], edx
call sub.KERNEL32.DLL_SetEvent
mov edx, dword [0x443810]
cmp eax, dword [edx]
jne 0x419dbf
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call dword [ebx + 8]
jmp 0x419ed2
push 0
push 0
push 0xffffffffffffffff
push 0
call sub.KERNEL32.DLL_GetFileAttributesA
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x419eba
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x44489c
call sub.KERNEL32.DLL_GetStringTypeExA
xor eax, eax
push ebp
push 0x419e9c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x43f4e0], 0
jne 0x419e0f
mov dl, 1
mov eax, dword [0x412a4c]
call fcn.004030b4
mov dword [0x43f4e0], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0xc]
mov eax, dword [0x43f4e0]
call fcn.00413d0c
call fcn.0041992c
cmp word [0x43f4d2], 0
je 0x419e42
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
mov eax, dword [0x43f4d4]
call dword [0x43f4d0]
push 0x44489c
call sub.KERNEL32.DLL_WideCharToMultiByte
xor eax, eax
push ebp
push 0x419e7d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xffffffffffffffff
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_LocalAlloc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x419e84
push 0x44489c
call sub.KERNEL32.DLL_GetStringTypeExA
ret
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41c9c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
xor edx, edx
push ebp
push 0x41ca63
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [eax + eax*2]
lea ebx, [eax*4 + 0x43f4e8]
cmp dword [0x43f4e4], 0
jne 0x41ca32
push 0x276d
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 8]
mov eax, dword [0x4434fc]
call fcn.004059c4
mov eax, dword [ebp - 8]
mov edx, dword [ebx + 8]
mov dword [ebp - 0x10], edx
mov byte [ebp - 0xc], 6
lea edx, [ebp - 0x10]
xor ecx, ecx
call fcn.0040a0d0
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x41bac4]
call fcn.0041bb3c
call fcn.00403858
mov eax, dword [ebx + 8]
push eax
mov eax, dword [0x43f4e4]
push eax
call sub.KERNEL32.DLL_CreateThread
mov esi, eax
mov eax, dword [ebx + 4]
mov dword [eax], esi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41ca6a
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403ea0
ret

Function at 0x41ca98
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x41cb65
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x43f4e4], 0
jne 0x41cb48
push 0x41cb78
call sub.KERNEL32.DLL_VirtualQuery
mov dword [0x43f4e4], eax
cmp dword [0x43f4e4], 0
jne 0x41cb20
call sub.KERNEL32.DLL_GetStdHandle
push eax
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 8]
mov eax, dword [0x4433fc]
call fcn.004059c4
mov eax, dword [ebp - 8]
push eax
mov eax, 0x41cb8c
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0xb
lea edx, [ebp - 0x10]
xor ecx, ecx
pop eax
call fcn.0040a0d0
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x41bac4]
call fcn.0041bb3c
call fcn.00403858
push 0x41cb98
mov eax, dword [0x43f4e4]
push eax
call sub.KERNEL32.DLL_CreateThread
mov dword [0x444a88], eax
mov eax, dword [ebp + 0xc]
push eax
mov ax, word [ebp + 8]
push eax
call dword [0x444a88]
mov ebx, eax
jmp 0x41cb4a
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41cb6c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403ea0
ret

Function at 0x41eb40
Capabilities:
Compare security identifiers

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x1c
call fcn.00402ab4
lea eax, [ebx + 0x14]
push eax
push 0
lea eax, [ebx + 0x10]
push eax
lea eax, [ebx + 0xc]
push eax
lea eax, [ebx + 8]
push eax
push 0
lea eax, [ebx + 4]
push eax
push ebx
push 0
push 0
push 0
mov eax, dword [esi + 4]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
sete al
mov edx, dword [0x44380c]
cmp byte [edx + 0xc], 0
je 0x41eba4
mov edx, dword [0x443800]
cmp dword [edx], 2
jne 0x41eba4
mov edx, dword [ebx + 4]
add dword [ebx + 4], edx
mov edx, dword [ebx + 0xc]
add dword [ebx + 0xc], edx
pop esi
pop ebx
ret
Function at 0x436160
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040432c
mov eax, dword [ebp - 8]
call fcn.0040432c
xor eax, eax
push ebp
push 0x43621b
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4361f6
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x27], eax
mov dword [ebp - 0x23], 2
lea eax, [ebp - 4]
mov edx, 0x436234
call fcn.00404144
mov eax, dword [ebp - 4]
call fcn.0040433c
mov dword [ebp - 0x1f], eax
lea eax, [ebp - 8]
mov edx, 0x436234
call fcn.00404144
mov eax, dword [ebp - 8]
call fcn.0040433c
mov dword [ebp - 0x1b], eax
mov word [ebp - 0x17], 0x50
lea eax, [ebp - 0x27]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
sete byte [ebp - 9]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x436200
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x436222
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403ea0
ret

Function at 0x4367ac
Capabilities:
Clear file content
Get disk size
Resume thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov esi, 0x444bb0
mov byte [esi], 0
mov byte [esi + 1], 0
mov byte [esi + 2], 0
mov byte [esi + 3], 0
mov byte [esi + 4], 0
mov byte [esi + 5], 5
mov byte [ebp - 1], 0
lea eax, [ebp - 8]
push eax
push 0xffffffffffffffff
push 8
call sub.KERNEL32.DLL_SetEndOfFile
push eax
call fcn.00405d68
mov ebx, eax
test ebx, ebx
jne 0x43680c
call sub.KERNEL32.DLL_GetStdHandle
cmp eax, 0x3f0
jne 0x43680c
lea eax, [ebp - 8]
push eax
push 8
call sub.KERNEL32.DLL_ResumeThread
push eax
call fcn.00405d60
mov ebx, eax
test ebx, ebx
je 0x4368ea
mov eax, 0x400
call fcn.004026ac
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4368e3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
push 0x400
mov eax, dword [ebp - 0xc]
push eax
push 2
mov eax, dword [ebp - 8]
push eax
call fcn.00405d50
mov ebx, eax
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GetDiskFreeSpaceA
test ebx, ebx
je 0x4368cd
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
push esi
call fcn.00405d38
xor eax, eax
push ebp
push 0x4368c6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
dec ebx
test ebx, ebx
jl 0x4368af
inc ebx
xor esi, esi
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + esi*8 + 4]
push eax
mov eax, dword [ebp - 0x14]
push eax
call fcn.00405d40
test eax, eax
je 0x4368ab
mov byte [ebp - 1], 1
jmp 0x4368af
inc esi
dec ebx
jne 0x436890
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4368cd
mov eax, dword [ebp - 0x14]
push eax
call fcn.00405d48
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4368ea
mov eax, dword [ebp - 0xc]
call fcn.004026cc
ret
mov al, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret