joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402ee0
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], 0x10
push 0xf0000020
push 1
push 0
push 0
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x402f52
lea ecx, [ebp - 4]
push ecx
push 0
push 0
push 0x8002
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x402f52
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x402f52
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 2
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x402f70
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0x10
push 0xf0000020
push 1
push 0
push 0
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x402fdf
lea ecx, [ebp - 4]
push ecx
push 0
push 0
push 0x8003
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x402fdf
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x402fdf
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 2
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov esp, ebp
pop ebp
ret

Function at 0x4039fd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], 0
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
mov ecx, dword [ebp - 0x10]
add ecx, 0x64
call fcn.00404530
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x403a6b
push 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x403a5f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x403a74
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 8
Function at 0x40ad39
Capabilities:
Delete registry value
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x443e75
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xb8
mov dword [ebp - 0xb4], ecx
push 1
push 3
lea ecx, [ebp - 0x98]
call fcn.004049c0
mov dword [ebp - 4], 0
mov dword [ebp - 0x9c], 0
mov eax, dword [ebp + 0x10]
and eax, 0xff
test eax, eax
je 0x40ad95
mov dword [ebp - 0xb8], str.StandardProfile
jmp 0x40ad9f
mov dword [ebp - 0xb8], str.DomainProfile
lea ecx, [ebp - 0x98]
test ecx, ecx
je 0x40adb7
lea edx, [ebp - 0x90]
mov dword [ebp - 0xbc], edx
jmp 0x40adc1
mov dword [ebp - 0xbc], 0
push str.AuthorizedApplicationsList
mov eax, dword [ebp - 0xb8]
push eax
push str.SYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicy_
mov ecx, dword [ebp - 0xbc]
push ecx
call fcn.00407180
add esp, 8
push eax
call fcn.00407180
add esp, 8
push eax
call fcn.00407180
add esp, 8
lea edx, [ebp - 0x9c]
push edx
push 0xf003f
push 0
lea eax, [ebp - 0xb0]
push eax
lea ecx, [ebp - 0x98]
call fcn.00404ae0
mov dword [ebp - 0xc0], eax
mov ecx, dword [ebp - 0xc0]
mov dword [ebp - 0xc4], ecx
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0xc4]
call fcn.00404530
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
neg eax
sbb eax, eax
inc eax
mov byte [ebp - 0xa0], al
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xb0]
call fcn.004044d0
mov edx, dword [ebp - 0xa0]
and edx, 0xff
test edx, edx
je 0x40aef4
cmp dword [ebp + 0xc], 0
je 0x40aeb9
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x9c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x40aeb7
mov edx, dword [ebp + 0xc]
push edx
call fcn.00429d80
add esp, 4
push eax
mov eax, dword [ebp + 0xc]
push eax
push 1
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x9c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x40aee7
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x9c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40aee7
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x9c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, dword [ebp - 0x9c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x98]
call fcn.00404300
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40afe6
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x444
mov dword [ebp - 0x444], ecx
mov eax, dword [str.profiles.ini]
mov dword [ebp - 0x114], eax
mov ecx, dword [0x458f50]
mov dword [ebp - 0x110], ecx
mov edx, dword [0x458f54]
mov dword [ebp - 0x10c], edx
mov al, byte [0x458f58]
mov byte [ebp - 0x108], al
mov ecx, dword [str.Firefox]
mov dword [ebp - 0x228], ecx
mov edx, dword [0x458f60]
mov dword [ebp - 0x224], edx
mov eax, dword [str.Mozilla]
mov dword [ebp - 0x11c], eax
mov ecx, dword [0x458f68]
mov dword [ebp - 0x118], ecx
cmp dword [ebp + 8], 0
je 0x40b05e
cmp dword [ebp + 0xc], 0
jne 0x40b065
xor al, al
jmp 0x40b232
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
push 0x104
push 0
lea eax, [ebp - 0x220]
push eax
call fcn.00428c00
add esp, 0xc
push 0
push 0x1a
lea ecx, [ebp - 0x220]
push ecx
push 0
call fcn.0040bc20
add esp, 0x10
test eax, eax
jl 0x40b229
lea edx, [ebp - 0x114]
push edx
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x11c]
push ecx
lea edx, [ebp - 0x220]
push edx
push 0x458f6c
lea eax, [ebp - 0x104]
push eax
call fcn.0042a288
add esp, 0x18
mov dword [ebp - 0x330], 0
jmp 0x40b0ec
mov ecx, dword [ebp - 0x330]
add ecx, 1
mov dword [ebp - 0x330], ecx
mov edx, 1
test edx, edx
je 0x40b229
mov eax, dword [ebp - 0x330]
push eax
push str.Profile_d
lea ecx, [ebp - 0x32c]
push ecx
call fcn.0042a288
add esp, 0xc
lea edx, [ebp - 0x104]
push edx
push 0xffffffffffffffff
push str.IsRelative
lea eax, [ebp - 0x32c]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 0x440], eax
cmp dword [ebp - 0x440], 0xffffffff
jne 0x40b143
jmp 0x40b229
lea ecx, [ebp - 0x104]
push ecx
push 0x104
lea edx, [ebp - 0x434]
push edx
push 0x470d9c
push str.Path
lea eax, [ebp - 0x32c]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ebp - 0x438], eax
cmp dword [ebp - 0x438], 0
ja 0x40b181
jmp 0x40b229
lea ecx, [ebp - 0x104]
push ecx
push 0xffffffffffffffff
push str.Default
lea edx, [ebp - 0x32c]
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 0x43c], eax
cmp dword [ebp - 0x43c], 1
je 0x40b1b4
cmp dword [ebp - 0x330], 0
jne 0x40b224
cmp dword [ebp - 0x440], 1
jne 0x40b200
push 0x2f
lea eax, [ebp - 0x434]
push eax
call fcn.0040bc00
add esp, 8
mov byte [eax], 0x5c
lea ecx, [ebp - 0x434]
push ecx
lea edx, [ebp - 0x228]
push edx
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x220]
push ecx
push str._s_s_s_s
mov edx, dword [ebp + 8]
push edx
call fcn.0042a288
add esp, 0x18
jmp 0x40b213
lea eax, [ebp - 0x434]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0042a7b0
add esp, 8
mov edx, dword [ebp + 8]
push edx
call fcn.00429d80
add esp, 4
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
jmp 0x40b0dd
xor eax, eax
cmp dword [ebp + 0xc], 0
setne al
mov esp, ebp
pop ebp
ret 8
Function at 0x40b9e0
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
call fcn.0040baa0
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40ba99
mov ecx, dword [ebp - 0x18]
call fcn.0040b980
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x18]
add ecx, 0xc
push ecx
push 0
mov edx, dword [ebp - 0x18]
add edx, 4
push edx
push 0
mov eax, dword [ebp - 8]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 4]
push edx
call fcn.0042a240
add esp, 4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0xc]
push eax
call fcn.0042a240
add esp, 4
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov dword [ecx + 0x10], edx
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x18]
add ecx, 0xc
push ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x10]
push eax
mov ecx, dword [ebp - 0x18]
add ecx, 4
push ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
sub eax, 1
neg eax
sbb eax, eax
inc eax
mov byte [ebp - 4], al
mov al, byte [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x40d062
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44400b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x110
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x120], ecx
push 1
mov eax, dword [ebp - 0x120]
add eax, 0x18bc
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040e2e0
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
jl 0x40d203
cmp dword [ebp + 8], 0x14
jge 0x40d203
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 8]
imul ecx, ecx, 0x13c
mov edx, dword [ebp - 0x120]
cmp dword [edx + ecx + 0x20], 0
je 0x40d19a
mov eax, dword [ebp - 0x120]
mov ecx, dword [eax + 0x18b4]
cmp ecx, dword [ebp + 8]
jne 0x40d0fd
mov edx, dword [ebp - 0x120]
mov dword [edx + 0x18b4], 0xffffffff
mov eax, dword [ebp + 8]
imul eax, eax, 0x13c
mov ecx, dword [ebp - 0x120]
mov edx, dword [ecx + eax + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp + 8]
imul eax, eax, 0x13c
mov ecx, dword [ebp - 0x120]
lea edx, [ecx + eax + 0x39]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp + 8]
imul eax, eax, 0x13c
mov ecx, dword [ebp - 0x120]
mov edx, dword [ecx + eax + 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 8]
imul eax, eax, 0x13c
mov ecx, dword [ebp - 0x120]
lea edx, [ecx + eax + 0xc]
push edx
call fcn.004267ad
add esp, 4
mov eax, dword [ebp + 8]
imul eax, eax, 0x13c
mov ecx, dword [ebp - 0x120]
lea edx, [ecx + eax + 0x10]
push edx
call fcn.004267ad
add esp, 4
mov eax, dword [ebp + 8]
imul eax, eax, 0x13c
mov ecx, dword [ebp - 0x120]
mov dword [ecx + eax + 0x20], 0
jmp 0x40d1d9
mov dword [ebp - 4], 0
push 0x13c
push 0
mov ecx, dword [ebp + 8]
imul ecx, ecx, 0x13c
mov edx, dword [ebp - 0x120]
lea eax, [edx + ecx + 4]
push eax
call fcn.00428c00
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0040e320
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40d288
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44401e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x214
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x224], ecx
mov byte [ebp - 0x14], 0
cmp dword [ebp + 8], 0
jl 0x40d49c
cmp dword [ebp + 8], 0x14
jge 0x40d49c
push 1
mov eax, dword [ebp - 0x224]
add eax, 0x18bc
push eax
lea ecx, [ebp - 0x20]
call fcn.0040e2e0
mov dword [ebp - 4], 0
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 8]
imul ecx, ecx, 0x13c
mov edx, dword [ebp - 0x224]
mov eax, dword [edx + ecx + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str.CModule::StopModule_Stop:__ld__s
call fcn.004288c1
add esp, 0xc
mov edx, dword [ebp + 8]
imul edx, edx, 0x13c
mov eax, dword [ebp - 0x224]
cmp dword [eax + edx + 0x20], 0
je 0x40d350
mov ecx, dword [ebp + 8]
imul ecx, ecx, 0x13c
mov edx, dword [ebp - 0x224]
cmp dword [edx + ecx + 0x28], 0
je 0x40d350
mov eax, dword [ebp + 8]
imul eax, eax, 0x13c
mov ecx, dword [ebp - 0x224]
call dword [ecx + eax + 0x28]
jmp 0x40d38f
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.0040e320
mov ecx, dword [ebp + 8]
imul ecx, ecx, 0x13c
mov edx, dword [ebp - 0x224]
cmp dword [edx + ecx + 0x20], 0
je 0x40d498
mov eax, dword [ebp + 8]
imul eax, eax, 0x13c
mov ecx, dword [ebp - 0x224]
cmp dword [ecx + eax + 4], 0
je 0x40d489
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
imul eax, eax, 0x13c
mov ecx, dword [ebp - 0x224]
mov edx, dword [ecx + eax + 4]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x40d489
mov dword [ebp - 4], 3
mov eax, dword [ebp + 8]
imul eax, eax, 0x13c
mov ecx, dword [ebp - 0x224]
mov edx, dword [ecx + eax + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push str.CModule::StopModule_Terminate:__ld__s
call fcn.004288c1
add esp, 0xc
push 0
mov ecx, dword [ebp + 8]
imul ecx, ecx, 0x13c
mov edx, dword [ebp - 0x224]
mov eax, dword [edx + ecx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x40d482
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x224]
call fcn.0040d062
mov byte [ebp - 0x14], 1
mov al, byte [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40ded8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 8]
and eax, 0xff
test eax, eax
je 0x40df18
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x18d8], 0
je 0x40df0d
push 0xffffffffffffffff
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x18d8]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x40df16
mov ecx, dword [ebp - 8]
push ecx
call fcn.0040de69
jmp 0x40df46
mov edx, dword [ebp - 8]
cmp dword [edx + 0x18d8], 0
jne 0x40df46
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp - 8]
push ecx
push fcn.0040de69
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 8]
mov dword [edx + 0x18d8], eax
mov esp, ebp
pop ebp
ret 4
Function at 0x41797a
Capabilities:
Create process on windows
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x444810
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x624
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
mov dword [ebp - 0x628], 0
push 0x469624
mov eax, dword [ebp + 8]
push eax
push 0x469630
push 0x104
lea ecx, [ebp - 0x618]
push ecx
call fcn.0042a698
add esp, 0x14
push 0x104
lea edx, [ebp - 0x514]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x417a20
push str.__SelfDelete_WINNT_2000_XP_2003_
call fcn.004288c1
add esp, 4
push str._echo_off_r_n:Repeat_r_ndel__Q___s__r_nping__n_1_localhost___nul_r_nif_exist___s__goto_Repeat_r_ndel__Q___s_
push 0x4696c0
push 0x400
lea eax, [ebp - 0x410]
push eax
call fcn.0042a698
add esp, 0x10
jmp 0x417a4b
push str.__SelfDelete_WINVISTA
call fcn.004288c1
add esp, 4
push str._echo_off_r_n:Repeat_r_ndel___s__r_nping__n_1_localhost___nul_r_nif_exist___s__goto_Repeat_r_ndel___s__r_n
push 0x46973c
push 0x400
lea ecx, [ebp - 0x410]
push ecx
call fcn.0042a698
add esp, 0x10
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea edx, [ebp - 0x618]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x62c], eax
cmp dword [ebp - 0x62c], 0xffffffff
je 0x417bb4
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 0x30c
push eax
call fcn.00429a5b
add esp, 4
mov dword [ebp - 0x61c], eax
lea ecx, [ebp - 0x618]
push ecx
lea edx, [ebp - 0x514]
push edx
lea eax, [ebp - 0x514]
push eax
lea ecx, [ebp - 0x410]
push ecx
lea edx, [ebp - 0x410]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 0x30c
push eax
mov eax, dword [ebp - 0x61c]
push eax
call fcn.0042a698
add esp, 0x18
push 0
lea ecx, [ebp - 0x620]
push ecx
mov edx, dword [ebp - 0x61c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov eax, dword [ebp - 0x61c]
push eax
mov ecx, dword [ebp - 0x62c]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0x61c]
push edx
call fcn.00429b95
add esp, 4
mov eax, dword [ebp - 0x62c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x618]
push ecx
push 0x469740
push 0x400
lea edx, [ebp - 0x410]
push edx
call fcn.0042a698
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x417b83
lea eax, [ebp - 0x410]
push eax
push str.__SelfDelete__WINNT_2000_XP_2003...:_ShellExecute__s
call fcn.004288c1
add esp, 8
push 0
push 0
lea ecx, [ebp - 0x410]
push ecx
push 0x469780
push 0x469784
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x417bb4
lea edx, [ebp - 0x410]
push edx
push str.__SelfDelete__Win95__Win98__Me:_ShellExecute__s
call fcn.004288c1
add esp, 8
push 0
push 0
lea eax, [ebp - 0x410]
push eax
push 0x4697bc
push 0x4697c4
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x417bd0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x417be8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44481a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x68
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
push 0x12c
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x417ce4
lea eax, [ebp - 0x5c]
push eax
mov ecx, dword [0x470e40]
push ecx
call dword [sym.imp.USER32.dll_BeginPaint]
mov dword [ebp - 0x1c], eax
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [0x470e40]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [ebp - 0x60], eax
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x60]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x78]
push ecx
push 0x18
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.GDI32.dll_GetObjectA]
test eax, eax
je 0x417cb3
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 0x60]
push eax
push 0x3c
push 0x1a4
push 0
push 0
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.GDI32.dll_BitBlt]
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x60]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [ebp - 0x60]
push ecx
call dword [sym.imp.GDI32.dll_DeleteDC]
lea edx, [ebp - 0x5c]
push edx
mov eax, dword [0x470e40]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
jmp 0x417cf1
push str.__PaintBitmap_Error:_LoadBitmap
call fcn.004288c1
add esp, 4
jmp 0x417d0d
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x419e81
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4449c9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
push str.__ShowQuest_Initialized
call fcn.004288c1
add esp, 4
call fcn.00422890
test eax, eax
je 0x419eec
push str.__ShowQuest_Current_User_Is_Local_Administrator
call fcn.004288c1
add esp, 4
push 5
push 0
mov eax, dword [ebp + 8]
push eax
push 0x46ab6c
push 0x46ab78
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [ebp - 0x14], eax
jmp 0x419f16
push str.__ShowQuest_Current_User_Is_NOT_Local_Administrator
call fcn.004288c1
add esp, 4
push 5
push 0
mov ecx, dword [ebp + 8]
push ecx
push str.iexplore
push str.runas
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [ebp - 0x18], eax
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.__ShowQuest_Finished__ld
call fcn.004288c1
add esp, 8
jmp 0x419f51
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41bc21
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x444ccc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28c
mov dword [ebp - 0x298], ecx
mov byte [ebp - 0x10], 0
lea ecx, [ebp - 0x20]
call fcn.00404430
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x298]
call fcn.0041b93b
lea eax, [ebp - 0x160]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
je 0x41bdb2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x41bda2
mov edx, dword [ebp - 0x160]
and edx, dword [ebp + 0xc]
test edx, edx
je 0x41bd8c
mov eax, dword [ebp - 0x160]
and eax, dword [ebp + 0x10]
test eax, eax
jne 0x41bd8c
push 0x46b4bc
lea ecx, [ebp - 0x134]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x41bd8c
push 0x46b4c0
lea edx, [ebp - 0x134]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x41bd8c
lea eax, [ebp - 0x134]
push eax
lea ecx, [ebp - 0x268]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [ebp - 0x160]
mov dword [ebp - 0x28c], edx
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x288], eax
mov ecx, dword [ebp - 0x144]
mov dword [ebp - 0x284], ecx
mov edx, dword [ebp - 0x15c]
mov dword [ebp - 0x280], edx
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x27c], eax
mov ecx, dword [ebp - 0x154]
mov dword [ebp - 0x278], ecx
mov edx, dword [ebp - 0x150]
mov dword [ebp - 0x274], edx
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x270], eax
mov ecx, dword [ebp - 0x148]
mov dword [ebp - 0x26c], ecx
mov edx, dword [ebp - 0x28c]
and edx, 0x10
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x164], edx
lea eax, [ebp - 0x28c]
push eax
mov ecx, dword [ebp - 0x298]
call fcn.0041b678
lea ecx, [ebp - 0x160]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
jmp 0x41bc81
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov byte [ebp - 0x10], 1
jmp 0x41bdd2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x290], eax
mov ecx, dword [ebp - 0x290]
push ecx
push str.xGetList_INVALID_HANDLE_VALUE_error__ld
call fcn.004288c1
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dl, byte [ebp - 0x10]
mov byte [ebp - 0x294], dl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00404480
mov al, byte [ebp - 0x294]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc