joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409888
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40995b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409974
push ebx
push 0x409980
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409908
mov al, 0x62
call fcn.00409460
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.0040985c
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409911
call fcn.0040985c
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409962
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409a14
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409ac8
jmp 0x409abd
cmp dword [esi + 0x10], 0x1000
jne 0x409aa9
test byte [esi + 0x15], 1
jne 0x409aa9
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409a68
cmp eax, 2
je 0x409a68
cmp eax, 0x10
je 0x409a68
cmp eax, 0x20
jne 0x409a7d
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409a7d
mov bl, 1
xor ebp, ebp
jmp 0x409a8e
mov eax, dword [esi]
add eax, ebp
call fcn.00409a0c
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409a81
test bl, bl
je 0x409aa9
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409ac8
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409a40
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x409ebd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x409ebd
lcall 0x5de5, 0x8b10c483
jmp fcn.0076d6b4
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..reloc
mov ebx, 0x40de38
nop
mov ecx, 0x58b0f74
nop
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..text
mov ebx, 0x4304d8
nop
mov ecx, 0x40575375
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x414e67
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x414ebd
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x414ebd
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 8]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x414eaf
cmp esi, ecx
jae 0x414ebd
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edx, 1
jne 0x414e9d
cmp esi, ecx
jae 0x414ebd
cmp word [esi], 0
je 0x414ebd
mov eax, esi
jmp 0x414ebf
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x4209f6
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, eax
cmp dword [eax + 0x14], 8
jb 0x420a06
mov ecx, dword [eax]
push esi
push edi
mov edi, dword [eax + 0x10]
mov edx, 0x811c9dc5
push 0
pop esi
add edi, edi
je 0x420a28
movzx eax, byte [esi + ecx]
xor eax, edx
imul edx, eax, 0x1000193
inc esi
cmp esi, edi
jb 0x420a17
pop edi
mov eax, edx
pop esi
pop ebp
ret 4

Function at 0x422eb8
Capabilities:
Create pipe
Create thread
Create two anonymous pipes

Disassembly:
push ebx
xor ebx, ebx
push esi
mov esi, ebx
push edi
cmp dword [0x456090], ebx
jne 0x422f10
mov edi, dword [sym.imp.KERNEL32.dll_CreatePipe]
push 0x10000
push ebx
push 0x456094
push 0x456090
call edi
test eax, eax
jne 0x422efa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x422f62
movzx esi, si
or esi, 0x80070000
jmp 0x422f62
push 0x10000
push ebx
push 0x45609c
push 0x456098
call edi
test eax, eax
je 0x422ee3
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x4560a4
push ebx
push ebx
push 0x422cff
push 0x1000
push ebx
call edi
mov dword [0x4560a0], eax
test eax, eax
jne 0x422f3e
call fcn.0041a0ab
mov esi, eax
test esi, esi
js 0x422f62
push 0x4560ac
push ebx
push ebx
push 0x422dfd
push 0x1000
push ebx
call edi
mov dword [0x4560a8], eax
test eax, eax
jne 0x422f62
call fcn.0041a0ab
mov esi, eax
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x423084
Capabilities:
Link many functions at runtime

Disassembly:
push 4
mov eax, 0x44cedf
call fcn.0044653a
cmp byte [0x456220], 0
jne 0x42317f
mov edx, 0x40e664
lea ecx, [ebp - 0x10]
call fcn.00423185
and dword [ebp - 4], 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0041b5ee
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test edi, edi
je 0x423103
push 0x40e67c
push edi
call esi
push 0x40e68c
push edi
call esi
push 0x40e6ac
push edi
call esi
push 0x40e6cc
push edi
mov dword [0x45622c], eax
call esi
push 0x40e6ec
push edi
mov dword [0x456224], eax
call esi
mov edx, 0x40e708
lea ecx, [ebp - 0x10]
call fcn.00423185
mov dword [ebp - 4], 2
push dword [eax]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0041b5ee
test edi, edi
je 0x423151
push 0x40e720
push edi
call esi
push 0x40e734
push edi
call esi
push 0x40e74c
push edi
call esi
mov dword [0x456228], eax
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
test edi, edi
je 0x423178
mov esi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x58
push edi
call esi
push 0x5a
push edi
call esi
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
mov byte [0x456220], 1
call fcn.00446503
ret

Function at 0x423185
Capabilities:
Get common file path

Disassembly:
push 0x1c
mov eax, 0x44cf42
call fcn.0044653a
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x18], edi
and dword [ebp - 0x14], 0
lea ecx, [ebp - 0x10]
call fcn.0041b610
mov dword [ebp - 4], 2
lea eax, [ebp - 0x10]
and dword [ebp - 0x24], 0
mov ebx, 0x104
or dword [ebp - 0x20], 0xffffffff
mov ecx, eax
push ebx
mov dword [ebp - 0x28], eax
call fcn.00414fc1
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 3
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x10]
push 0xffffffffffffffff
call fcn.00424028
push esi
lea ecx, [ebp - 0x10]
call fcn.00423b5c
lea eax, [ebp - 0x10]
mov ecx, edi
push eax
call fcn.00414d67
mov dword [ebp - 0x14], 1
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x1c], eax
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.0041b5ee
mov eax, edi
call fcn.00446503
ret
Function at 0x4237c5
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x8c
mov eax, dword [0x454014]
xor eax, esp
mov dword [esp + 0x88], eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push 0
mov ebx, eax
lea eax, [esp + 0x20]
push 0
push eax
mov dword [esp + 0x24], ebx
call dword [sym.imp.USER32.dll_GetMessageW]
jmp 0x423934
mov edi, dword [0x456018]
cmp ebx, edi
je 0x423859
lea eax, [esp + 0x34]
mov dword [esp + 0x34], 0x30
push eax
push ebx
mov dword [esp + 0x6c], 0x30
call dword [sym.imp.USER32.dll_GetGUIThreadInfo]
mov esi, eax
lea eax, [esp + 0x64]
push eax
push edi
call dword [sym.imp.USER32.dll_GetGUIThreadInfo]
test esi, esi
je 0x42384a
test eax, eax
je 0x42384a
mov eax, dword [esp + 0x40]
cmp eax, dword [esp + 0x70]
je 0x423859
push 1
push dword [0x456018]
push ebx
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov eax, dword [esp + 0x1c]
sub eax, 0x100
je 0x423877
sub eax, 1
je 0x423877
sub eax, 3
je 0x423877
sub eax, 1
jne 0x423909
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x423888
mov bh, 1
jmp 0x423890
cmp dword [esp + 0x20], 0x10
sete bh
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x4238a1
mov bl, 1
jmp 0x4238a9
cmp dword [esp + 0x20], 0x11
sete bl
push 0x12
mov byte [esp + 0x14], bl
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x4238c1
mov byte [esp + 0xc], 1
jmp 0x4238cb
cmp dword [esp + 0x20], 0x12
sete byte [esp + 0xc]
push dword [esp + 0xc]
mov dl, bl
lea ecx, [esp + 0x1c]
call fcn.00424f18
test al, al
jne 0x42391f
mov eax, dword [esp + 0x20]
mov dl, bh
push 0x17
pop ecx
add eax, 0xffffff90
cmp ecx, eax
lea ecx, [esp + 0x18]
sbb al, al
inc al
movzx eax, al
push eax
push dword [esp + 0x10]
push dword [esp + 0x18]
call fcn.00424ffd
test al, al
jne 0x42391f
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 0
push 0
push 0
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
mov ebx, dword [esp + 0x14]
test eax, eax
jne 0x423804
mov ecx, dword [esp + 0x94]
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0042cd7a
mov esp, ebp
pop ebp
ret
Function at 0x424109
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], ebx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp + 0x10]
push eax
push ebx
push 0x40e790
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x424173
cmp dword [ebp + 0x10], 1
je 0x424148
cmp dword [ebp + 0x10], 2
jne 0x424163
mov ecx, dword [ebp - 4]
test esi, esi
je 0x42416d
test ecx, ecx
je 0x424168
test cl, 1
jne 0x424163
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], bx
je 0x42416d
push 0xd
pop eax
jmp 0x424173
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x425c27
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov edx, 0x811c9dc5
xor ecx, ecx
movzx eax, byte [ecx + esi]
xor eax, edx
imul edx, eax, 0x1000193
inc ecx
cmp ecx, 4
jb 0x425c35
mov eax, edx
pop esi
pop ebp
ret 4

Function at 0x4268e1
Capabilities:
Get common file path

Disassembly:
push 0xc
mov eax, 0x44d6f7
call fcn.0044653a
mov ebx, edx
mov edi, ecx
lea ecx, [ebp - 0x14]
call fcn.0041b610
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0041b610
mov byte [ebp - 4], 1
mov esi, 0x104
push esi
lea ecx, [ebp - 0x14]
call fcn.00414fc1
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
mov esi, eax
call fcn.00424028
test esi, esi
jne 0x426946
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4269b6
movzx esi, si
or esi, 0x80070000
jmp 0x4269b6
push 0x104
lea ecx, [ebp - 0x10]
call fcn.00414fc1
push eax
push 0
push 0x40f1a0
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
mov esi, eax
call fcn.00424028
test esi, esi
je 0x42692f
push 0x40f1a8
lea ecx, [ebp - 0x18]
call fcn.004130fb
mov byte [ebp - 4], 2
lea edx, [ebp - 0x18]
push ebx
lea ecx, [ebp - 0x10]
call fcn.004269dc
mov esi, eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.0041b5ee
test esi, esi
js 0x4269b6
push 3
push 5
push dword [ebp - 0x10]
push edi
call dword [sym.imp.wer.dll_WerReportAddFile]
mov esi, eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0041b5ee
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.0041b5ee
mov eax, esi
call fcn.00446503
ret
Function at 0x426ca4
Capabilities:
Parse pe header

Disassembly:
push 0x214
push 0x4525a0
call fcn.004466c0
mov ebx, edx
mov edi, ecx
xor esi, esi
mov dword [ebp - 0x220], esi
push 0x200
push esi
lea eax, [ebp - 0x21c]
push eax
call fcn.0042e4b0
add esp, 0xc
mov dword [ebp - 4], esi
lea eax, [ebp - 0x220]
push eax
push 0x200
lea eax, [ebp - 0x21c]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x426d35
cmp dword [ebp - 0x220], 0x200
jne 0x426d35
mov eax, 0x5a4d
cmp word [ebp - 0x21c], ax
jne 0x426d1f
mov eax, dword [ebp - 0x1e0]
mov esi, dword [ebp + eax - 0x214]
jmp 0x426d49
mov eax, 0x4550
cmp word [ebp - 0x21c], ax
jne 0x426d4f
mov esi, dword [ebp - 0x214]
jmp 0x426d49
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
jmp 0x426d58
mov dword [ebp - 0x224], esi
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x426d68
Capabilities:
Get file version info

Disassembly:
push 0x1c
mov eax, 0x44d7e5
call fcn.0044653a
mov esi, edx
mov dword [ebp - 0x14], esi
mov eax, ecx
mov dword [ebp - 0x18], eax
xor ecx, ecx
mov ebx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], ecx
push ecx
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test edi, edi
jne 0x426da6
mov ebx, 0x80004005
jmp 0x426e4b
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
sub edx, ecx
cmp edi, edx
jae 0x426dba
lea eax, [ecx + edi]
mov dword [ebp - 0x24], eax
jmp 0x426df0
jbe 0x426df0
mov eax, dword [ebp - 0x20]
sub eax, ecx
cmp edi, eax
jbe 0x426dd1
push ecx
push edi
lea ecx, [ebp - 0x28]
call fcn.004271af
jmp 0x426ded
mov ecx, dword [ebp - 0x24]
mov eax, edi
sub eax, edx
push eax
push 0
push ecx
lea esi, [ecx + eax]
call fcn.0042e4b0
mov dword [ebp - 0x24], esi
add esp, 0xc
mov esi, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
push ecx
push edi
xor edi, edi
push edi
push dword [ebp - 0x18]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
jne 0x426e09
mov ebx, 0x80004005
jmp 0x426e4b
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x10], edi
push eax
lea eax, [ebp - 0x10]
push eax
push 0x40e7b4
push dword [ebp - 0x28]
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x426e02
mov ecx, dword [ebp - 0x10]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push 0x40f1e8
push esi
call fcn.00427134
add esp, 0x18
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x28]
test ecx, ecx
je 0x426e87
mov edx, dword [ebp - 0x20]
mov eax, ecx
sub edx, ecx
cmp edx, 0x1000
jb 0x426e75
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x426e8f
push edx
push ecx
call fcn.0042cdae
pop ecx
pop ecx
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], edi
mov eax, ebx
call fcn.00446503
ret
call fcn.004301df
int3
Function at 0x427277
Capabilities:
Create thread

Disassembly:
push 4
mov eax, 0x44d8cb
call fcn.0044653a
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [edi], eax
mov dword [edi + 4], ebx
mov dword [ebp - 4], ebx
mov dword [edi + 0xc], ebx
mov byte [ebp - 4], 1
mov dword [edi + 0x10], ebx
mov byte [ebp - 4], 2
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push ebx
push ebx
push 1
push ebx
mov dword [edi + 0xc], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x10], eax
lea eax, [edi + 8]
push eax
push ebx
push edi
push 0x427384
push 0x1000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x4272eb
mov dword [edi + 4], eax
or dword [ebp - 4], 0xffffffff
mov eax, edi
call fcn.00446503
ret 4
call fcn.004273f6
int3

Function at 0x42740f
Capabilities:
Create thread

Disassembly:
push 4
mov eax, 0x44d93b
call fcn.0044653a
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [0x456004]
mov esi, dword [ebp + 8]
mov dword [edi], eax
mov dword [edi + 4], esi
and dword [edi + 0xc], 0
and dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword fs:[0x2c]
lea ebx, [edi + 0x10]
push eax
push esi
push 0x42751d
mov ecx, dword [ecx]
push 4
mov dword [ebx], eax
mov dword [ecx + 4], edi
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [edi + 8], eax
test eax, eax
je 0x427490
push ebx
push 0
push edi
push 0x4275ae
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x427490
mov dword [edi + 0xc], eax
or dword [ebp - 4], 0xffffffff
mov eax, edi
call fcn.00446503
ret 8
call fcn.004273f6
int3

Function at 0x427ce1
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x18]
mov ebx, dword [esi]
cmp dword [ebx - 4], 1
jle 0x427d05
push dword [ebx - 0xc]
mov ecx, esi
call fcn.00414ec6
mov ebx, dword [esi]
mov eax, dword [edi]
test eax, eax
jne 0x427d82
mov ecx, dword [ebp + 8]
test ecx, ecx
jle 0x427d82
push 0x64
sub ecx, 0x64
push ebx
mov dword [ebp + 8], ecx
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
jne 0x427d41
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x427d7c
cmp eax, 0x79
je 0x427d7c
call fcn.0041a0ab
mov dword [ebp - 4], eax
test eax, eax
js 0x427d88
push 0
push 0x40000000
push 3
push 0
push 3
push 0xc0000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x427d7a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe7
je 0x427d7c
call fcn.0041a0ab
mov dword [ebp - 4], eax
test eax, eax
js 0x427d88
mov dword [edi], esi
mov eax, dword [edi]
test eax, eax
je 0x427d0b
mov dword [edi + 0x1c], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x427d8f
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
xor ecx, ecx
push edi
mov edi, ecx
cmp dword [esi + 4], ecx
jne 0x427dc7
push ecx
push ecx
lea eax, [esi + 0x1c]
push eax
push 0x42783f
push 0x1000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
test eax, eax
jne 0x427dc5
call fcn.0041a0ab
mov edi, eax
test edi, edi
js 0x427e04
xor ecx, ecx
cmp dword [esi + 8], ecx
jne 0x427e04
push ecx
push ecx
push 1
push ecx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x28], eax
lea eax, [esi + 0xc]
push eax
push 0
lea eax, [esi + 0x1c]
push eax
push 0x427b0e
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 8], eax
test eax, eax
jne 0x427e04
call fcn.0041a0ab
mov edi, eax
mov eax, edi
pop edi
pop esi
ret

Function at 0x428148
Capabilities:
Check if file exists
Create directory

Disassembly:
push 8
mov eax, 0x44dbd8
call fcn.0044653a
mov edi, ecx
test edi, edi
jne 0x428161
mov eax, 0x80070057
jmp 0x4281cc
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x428170
xor eax, eax
jmp 0x4281cc
push edi
lea ecx, [ebp - 0x10]
call fcn.004130fb
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0042967e
test eax, eax
jne 0x428190
mov esi, 0x8007000e
jmp 0x4281bf
mov ecx, dword [ebp - 0x10]
call fcn.00428148
mov esi, eax
test esi, esi
jne 0x4281bf
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4281bf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4281bf
movzx esi, si
or esi, 0x80070000
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0041b5ee
mov eax, esi
call fcn.00446503
ret
Function at 0x428606
Capabilities:
Check if file exists
Delete registry key

Disassembly:
push 0x28
mov eax, 0x44dc7e
call fcn.0044656e
mov edi, ecx
lea ecx, [ebp - 0x24]
call fcn.0041b610
xor ebx, ebx
lea edx, [ebp - 0x24]
push ebx
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.00428bd8
mov esi, eax
test esi, esi
js 0x428778
lea eax, [ebp - 0x24]
mov ecx, 0x456168
push eax
call fcn.004130ad
push dword [0x456168]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42865e
push ecx
call fcn.0042ca15
test al, al
je 0x428665
mov esi, ebx
jmp 0x428778
push 0x40f3a4
lea ecx, [ebp - 0x28]
call fcn.004130fb
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 1
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
mov esi, eax
test esi, esi
js 0x42876d
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ole32.dll_StringFromCLSID]
mov esi, eax
test esi, esi
js 0x42876d
push dword [ebp - 0x30]
lea ecx, [ebp - 0x28]
call fcn.00423b5c
push dword [ebp - 0x30]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push dword [ebp - 0x28]
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
je 0x4286ec
jle 0x42876d
movzx esi, si
or esi, 0x80070000
jmp 0x42876d
mov ecx, dword [ebp - 0x2c]
call fcn.00428500
mov esi, eax
test esi, esi
jns 0x428756
push 1
lea edx, [ebp - 0x24]
mov ecx, edi
call fcn.00428bd8
mov esi, eax
test esi, esi
js 0x42876d
lea eax, [ebp - 0x24]
mov ecx, 0x456168
push eax
call fcn.004130ad
mov esi, dword [ebp - 0x2c]
mov dl, 1
call fcn.00428254
test al, al
je 0x428754
push ebx
push dword [0x456168]
push esi
call dword [sym.imp.ADVAPI32.dll_RegSaveKeyW]
mov esi, eax
test esi, esi
je 0x42874d
jle 0x428749
movzx esi, si
or esi, 0x80070000
test esi, esi
jns 0x428756
jmp 0x42876d
xor dl, dl
call fcn.00428254
mov esi, ebx
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x28]
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov ecx, dword [ebp - 0x28]
lea ecx, [ecx - 0x10]
call fcn.0041b5ee
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.0041b5ee
mov eax, esi
call fcn.00446518
ret