joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413784
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
and dword [ebp - 4], 0
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
and dword [ebp + 0xc], 0xfffffffe
and edi, 1
cmp word [ebx], 0
mov dword [ebp - 0x14], edi
je 0x41395b
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
jmp 0x4137b9
mov edi, dword [ebp - 0x14]
push ebx
mov dword [ebp - 0x10], ebx
call esi
add eax, edi
mov edi, dword [ebp - 0x10]
push edi
lea ebx, [ebx + eax*2]
call esi
and dword [ebp - 8], 0
lea eax, [edi + eax*2 - 2]
cmp word [eax], 0x5c
jne 0x4137e5
and word [eax], 0
mov dword [ebp - 8], 2
jmp 0x4137f7
push edi
call fcn.00482b55
test eax, eax
pop ecx
je 0x4137f7
mov dword [ebp - 8], 1
push edi
lea ecx, [ebp + 8]
call fcn.004419bc
cmp dword [ebp - 8], 0
je 0x413813
push 0x49a420
lea ecx, [ebp + 8]
call fcn.004371ec
and dword [ebp - 0xc], 0
lea eax, [ebp - 0x264]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.00482c3e
push dword [ebp + 8]
call fcn.0040c795
add esp, 0x10
push dword [ebp + 8]
call esi
inc eax
lea edi, [eax + eax]
mov eax, dword [ebp + 8]
mov word [edi + eax - 2], 0x5c
mov eax, dword [ebp + 8]
and word [edi + eax], 0
cmp dword [ebp - 0xc], 0
je 0x4138fe
mov eax, dword [ebp + 8]
and word [edi + eax], 0
lea eax, [ebp - 0x238]
push eax
lea ecx, [ebp + 8]
call fcn.004371ec
test byte [ebp - 0x264], 0x10
jne 0x4138a9
cmp dword [ebp + 0xc], 0
push dword [ebp + 8]
je 0x41389d
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4138e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x413898
inc eax
mov dword [ebp - 4], eax
jmp 0x4138e5
call fcn.0040e510
test eax, eax
pop ecx
je 0x4138e5
jmp 0x413898
cmp word [ebp - 0x238], 0x2e
jne 0x4138d1
cmp word [ebp - 0x236], 0
je 0x4138e5
cmp word [ebp - 0x236], 0x2e
jne 0x4138d1
cmp word [ebp - 0x234], 0
je 0x4138e5
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00413784
test eax, eax
pop ecx
pop ecx
jne 0x4138e5
and dword [ebp - 4], eax
lea eax, [ebp - 0x264]
push eax
lea ecx, [ebp - 0xc]
call fcn.004048d9
test eax, eax
jne 0x41385a
jmp 0x41390c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x413909
inc eax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0xc]
call fcn.00402baa
xor edi, edi
cmp dword [ebp - 8], edi
je 0x413949
cmp dword [ebp + 0xc], edi
push dword [ebp - 0x10]
je 0x41393c
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x413949
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jne 0x413946
xor eax, eax
inc eax
jmp 0x413946
call fcn.0040e510
cmp eax, edi
pop ecx
je 0x413949
mov dword [ebp - 4], eax
lea ecx, [ebp + 8]
call fcn.00431c4c
cmp word [ebx], di
jne 0x4137b6
pop esi
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret
Function at 0x415d81
Capabilities:
Check mutex on windows

Disassembly:
test byte [0x4b3003], 1
je 0x415d99
push str.UCallBackhWnd
call fcn.0040ebb2
test eax, eax
pop ecx
jne 0x415d9c
xor eax, eax
ret
push edi
push str.GlobalPECMD:main_u
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, eax
test edi, edi
je 0x415dd7
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
sub esi, 0xb7
neg esi
sbb esi, esi
push edi
inc esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
pop esi
jne 0x415dd7
xor eax, eax
inc eax
pop edi
ret
xor eax, eax
pop edi
ret

Function at 0x4168d5
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
add esi, 0x84
lea eax, [esi + 0x325]
push eax
lea ecx, [ebp - 0xc]
call fcn.0043719c
cmp word [edi], 0x5c
mov ebx, dword [ebp - 0xc]
push 2
pop eax
mov dword [ebp - 4], ebx
lea ebx, [ebx + esi*2]
mov dword [ebp - 8], eax
jne 0x4169b8
and dword [ebp + 8], 0
push 0x2c
add edi, eax
push 0
push edi
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
mov esi, eax
test esi, esi
je 0x416947
and word [esi], 0
inc esi
inc esi
push esi
call dword [sym.imp.USER32.dll_CharUpperW]
movzx esi, word [esi]
test si, si
je 0x416947
mov dword [ebp + 8], esi
push edi
call fcn.0040f738
pop ecx
push ebx
push 0x324
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
cmp word [ebx], 0
mov esi, ebx
je 0x416a1f
mov ax, word [ebp + 8]
cmp word [esi], ax
jb 0x4169a5
mov ebx, dword [ebp - 4]
push edi
push esi
push str._s_sFonts
push ebx
call dword [sym.imp.USER32.dll_wsprintfW]
push ebx
call fcn.00482b55
add esp, 0x14
test eax, eax
je 0x4169a5
push 0x49a420
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push ebx
call fcn.0041681d
pop ecx
mov dword [ebp - 8], eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [esi + eax*2 + 2]
cmp word [esi], 0
jne 0x416968
jmp 0x416a1f
push edi
call fcn.0040f738
and dword [ebp + 8], 0
mov esi, eax
push esi
call fcn.00482b55
test eax, eax
pop ecx
pop ecx
je 0x4169e9
push esi
lea ecx, [ebp + 8]
call fcn.00441a80
push 0x49a420
lea ecx, [ebp + 8]
call fcn.004371ec
mov esi, dword [ebp + 8]
push esi
push 0x49a8f4
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_wsprintfW]
push esi
call fcn.0040c795
push esi
call fcn.00482b55
add esp, 0x14
test eax, eax
je 0x416a17
push dword [ebp - 4]
call fcn.0041681d
pop ecx
mov dword [ebp - 8], eax
lea ecx, [ebp + 8]
call fcn.00431c4c
lea ecx, [ebp - 0xc]
call fcn.00431c4c
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4196a2
Capabilities:
Check for time delay via gettickcount
Log keystrokes via application hook

Disassembly:
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, 0x4b069c
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ebx, ebx
test byte [esp + 0x32], 1
jne 0x4196cb
cmp dword [0x4afecc], ebx
jne 0x4196cb
mov dword [0x4afec8], ebx
movzx eax, byte [esp + 0x30]
add dword [0x4afecc], 1
cmp dword [0x4afec4], ebx
mov dword [esp + 0x30], eax
jne 0x419710
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
push 0x4195a3
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
cmp eax, ebx
mov dword [0x4afec4], eax
jne 0x419710
sub dword [0x4afecc], 1
xor esi, esi
jmp 0x419800
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
mov esi, dword [esp + 0x30]
mov edi, eax
add edi, esi
cmp esi, 0x3e8
jb 0x419737
push ebx
call fcn.004335fe
pop ecx
cmp dword [esp + 0x34], 2
jne 0x4197cd
cmp esi, ebx
jne 0x4197cd
push 0xa
pop esi
jmp 0x4197cd
cmp dword [esp + 0x34], 2
je 0x419760
call ebp
mov esi, edi
sub esi, eax
cmp esi, ebx
jle 0x4197d9
cmp byte [0x4ae290], bl
jle 0x4197d9
push 0xa
pop eax
cmp esi, eax
ja 0x419771
mov eax, esi
push 0x4bf
push eax
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
jmp 0x4197c5
cmp dword [0x4afec8], ebx
jne 0x4197d9
cmp dword [esp + 0x34], 2
je 0x41979b
call ebp
mov esi, edi
sub esi, eax
cmp esi, ebx
jle 0x4197cd
push 1
push ebx
push ebx
push ebx
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x4197cd
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp byte [0x4ae290], bl
jg 0x419782
cmp dword [0x4afec8], ebx
je 0x41974f
push 0x4b069c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x4afec8]
sub dword [0x4afecc], 1
pop ebp
jne 0x4197f9
mov dword [0x4afec8], ebx
mov esi, eax
mov edi, 0x4b069c
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x1c
ret
Function at 0x41a3f0
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0xd0
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [0x4b0048], eax
call fcn.0040c53d
call fcn.0042d431
call fcn.00410aaa
xor ebx, ebx
mov esi, 0x4aff28
push ebx
mov ecx, esi
call fcn.0040cf86
call fcn.00404b0a
mov edi, 0x4b069c
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x4afc38]
or eax, dword [0x4afc3c]
jne 0x41a450
push 0x4afc38
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x4afc40
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push 0x4afea0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push ebx
push 0x2f73
call fcn.0040fa07
push 0xd6fc3
push 0x311f1
lea eax, [ebp - 0x60]
push str._06lu_06lu
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
lea eax, [ebp - 0x60]
push eax
push 0x49ad3e
mov ecx, esi
call fcn.00436b54
lea eax, [ebp - 0x60]
push eax
push str.PECMDVER
mov ecx, esi
call fcn.00436b54
push str.X86_U
lea ecx, [ebp + 0x68]
call fcn.004419bc
push dword [0x4ae0d0]
lea ecx, [ebp + 0x68]
call fcn.004371ec
push dword [ebp + 0x68]
mov ecx, esi
push 0x49ad14
call fcn.00436b54
push 0x49ad10
push 0x49ad00
mov ecx, esi
call fcn.00436ba4
push ebx
push 0x2f80
call fcn.0040fa07
call fcn.0040f88f
push ebx
push 0x2f82
call fcn.0040fa07
mov eax, dword [ebp + 0x78]
mov dword [0x4afe10], eax
mov eax, dword [ebp + 0x7c]
mov dword [0x4ae26c], eax
call fcn.004322fc
push str.WM_TaskbarRestart
push dword [0x4b0064]
mov esi, 0x4aff28
push esi
call fcn.004394c3
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
add esp, 0x1c
push str.__PID
call edi
push eax
push esi
call fcn.004394c3
add esp, 0xc
push str.__PPID
call edi
push eax
call fcn.004041b8
pop ecx
push eax
push esi
call fcn.004394c3
push str.__HINST
push dword [0x4afe10]
push esi
call fcn.004394c3
add esp, 0x18
push 0x49ac94
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push esi
call fcn.004394c3
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0x2f8b
push ebx
push eax
call fcn.0040fa07
movzx eax, word [0x4b3010]
push str.SYSCODEPAGE
push eax
push esi
call fcn.004394c3
add esp, 0x14
push 0x20a
lea ecx, [ebp + 0x6c]
call fcn.0043719c
push dword [ebp + 0x6c]
mov edi, 0x208
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push dword [ebp + 0x6c]
mov ecx, esi
push 0x49a948
call fcn.00436ba4
push dword [ebp + 0x6c]
mov ecx, esi
push str._CD
call fcn.00436ba4
mov eax, dword [ebp + 0x6c]
mov word [eax + 4], bx
push dword [ebp + 0x6c]
mov ecx, esi
push str.CurDrv
call fcn.00436ba4
mov eax, dword [ebp + 0x6c]
push edi
push eax
push ebx
mov word [eax], bx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push dword [ebp + 0x6c]
mov ecx, esi
push str.CurFile
call fcn.00436ba4
call fcn.0040fa17
lea ecx, [ebp + 0x6c]
call fcn.00431c4c
lea ecx, [ebp + 0x68]
call fcn.00431c4c
pop edi
pop esi
pop ebx
add ebp, 0x70
leave
ret
Function at 0x41b193
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 8], 0
jne 0x41b1ba
push dword [esp + 0xc]
push dword [esp + 0xc]
call fcn.0040cdd9
test eax, eax
je 0x41b1ba
call fcn.0040ce60
test eax, eax
mov dword [esp + 0xc], eax
jne 0x41b1c1
xor eax, eax
jmp 0x41b283
mov ecx, dword [esi + 0x10]
mov ecx, dword [ecx + 0x34]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push ebp
push edi
push 0x40
mov ebp, 0x3000
push ebp
push eax
push ecx
call ebx
mov edi, eax
test edi, edi
jne 0x41b1f9
push 0x40
push ebp
push dword [esp + 0x20]
push eax
call ebx
mov edi, eax
test edi, edi
jne 0x41b1f9
xor eax, eax
jmp 0x41b280
push dword [esp + 0x14]
mov ecx, esi
push edi
call fcn.00410fab
mov eax, dword [esi + 0x10]
xor ebx, ebx
cmp dword [eax + 0xa0], ebx
jbe 0x41b226
cmp dword [eax + 0xa4], ebx
jbe 0x41b226
push edi
mov ecx, esi
call fcn.0040cc8f
test eax, eax
je 0x41b1f2
push edi
mov ecx, esi
call fcn.0040ccee
test eax, eax
jne 0x41b241
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x41b1f2
mov eax, dword [esi + 0x10]
mov dword [eax + 0x34], edi
mov eax, dword [esi + 0x10]
mov eax, dword [eax + 0x28]
push ebx
xor ebp, ebp
inc ebp
push ebp
add eax, edi
push edi
mov dword [esi + 4], eax
call eax
test eax, eax
jne 0x41b279
push ebx
push ebx
push edi
call dword [esi + 4]
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [esi + 4], ebx
jmp 0x41b1f2
mov dword [esi], ebp
mov dword [esi + 8], edi
mov eax, ebp
pop edi
pop ebp
pop ebx
pop esi
ret 8
Function at 0x42939c
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0xa4
push ebx
push esi
mov esi, dword [ebp + 0x7c]
push edi
push 0x49aa70
lea ecx, [ebp + 0x64]
sar esi, 0x10
call fcn.004419bc
mov ebx, dword [ebp + 0x74]
push esi
push dword [ebx]
call fcn.0040f222
pop ecx
pop ecx
push 0x20a
lea ecx, [ebp + 0x68]
mov dword [ebp + 0x74], eax
call fcn.0043719c
push dword [ebp + 0x68]
push 0x208
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, dword [ebp + 0x78]
push edi
lea ecx, [ebp - 0x38]
call fcn.0040c99d
push edi
lea ecx, [ebp - 0x38]
call fcn.0040cf86
push dword [ebp + 0x68]
mov eax, dword [edi + 0x14]
push 0x49a948
mov dword [ebp - 0x24], eax
call fcn.00436b54
movzx eax, si
push eax
lea ecx, [ebp - 0x38]
mov word [ebp - 0xc], si
call fcn.00436055
mov ecx, dword [ebp + 0x7c]
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp + 0x64]
push eax
push dword [ebp + 0x74]
push 0
push ebx
call fcn.00421e41
movzx esi, ax
or esi, dword [ebp + 0x7c]
add esp, 0x14
mov edi, 0x4b069c
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
and dword [ebp + 0xc], 0
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
lea ecx, [ebp - 0x38]
call fcn.00429312
lea ecx, [ebp + 8]
call fcn.00431c4c
lea ecx, [ebp + 0x68]
call fcn.00431c4c
lea ecx, [ebp + 0x64]
call fcn.00431c4c
pop edi
mov eax, esi
pop esi
pop ebx
add ebp, 0x6c
leave
ret
Function at 0x42dacb
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
push ebx
push esi
push edi
xor eax, eax
mov ecx, 0xff
lea edi, [ebp - 0x40b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 8
lea eax, [ebp - 0x409]
push str.MSWIN4.1
push eax
mov byte [ebp - 0x40c], 0xeb
mov byte [ebp - 0x40b], 0x3c
mov byte [ebp - 0x40a], 0x90
call fcn.00483c80
mov eax, dword [ebp + 0xc]
push 0xb
mov dword [ebp - 0x3f0], eax
lea eax, [ebp - 0x3e1]
push 0x49c584
mov esi, 0x200
xor ebx, ebx
push eax
mov word [ebp - 0x401], si
mov word [ebp - 0x3fe], 1
mov byte [ebp - 0x3fc], 2
mov word [ebp - 0x3fb], 0xf0
mov byte [ebp - 0x3f7], 0xf0
mov word [ebp - 0x3f4], 0x3f
mov word [ebp - 0x3f2], 0xff
mov byte [ebp - 0x3e8], 0x80
mov byte [ebp - 0x3e6], 0x29
mov dword [ebp - 0x3e5], ebx
call fcn.00483c80
push 8
lea eax, [ebp - 0x3d6]
push 0x49c578
push eax
call fcn.00483c80
movzx eax, word [ebp - 0x3fb]
movzx edi, word [ebp - 0x401]
shl eax, 5
lea eax, [eax + edi - 1]
cdq
idiv edi
movzx ecx, byte [ebp - 0x3fc]
add ecx, 0x100
add esp, 0x24
push ebx
push ebx
push esi
push dword [ebp + 0x10]
mov word [ebp - 0x20e], 0xaa55
push dword [ebp + 0xc]
mov word [ebp - 0x3f9], 0x11
mov byte [ebp - 0x3ff], 1
mov edx, eax
mov eax, ecx
sub eax, edx
movzx edx, word [ebp - 0x3fe]
sub eax, edx
add eax, 0x10
xor edx, edx
div ecx
mov word [ebp - 0x3f6], ax
call fcn.004833f0
push edx
push eax
push dword [ebp + 8]
call fcn.00432bc3
add esp, 0x10
push ebx
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x40c]
push eax
push dword [ebp + 8]
mov dword [ebp - 4], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
call ebx
movzx eax, byte [ebp - 0x3fc]
movzx edi, word [ebp - 0x3fb]
mov dword [ebp - 8], eax
movzx eax, word [ebp - 0x3f6]
shl edi, 5
add edi, 0x1ff
sar edi, 9
dec eax
push 0x400
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x40c]
push 0
push eax
call fcn.004832e0
movzx eax, word [ebp - 0x3fe]
add esp, 0xc
sub eax, 2
js 0x42dc8e
inc eax
mov dword [ebp + 0x10], eax
push 0
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 8]
call ebx
dec dword [ebp + 0x10]
jne 0x42dc76
mov eax, dword [ebp - 8]
test eax, eax
mov dword [ebp - 0x40c], 0xfffff8
jbe 0x42dce4
mov ecx, dword [ebp - 0xc]
dec ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], eax
push 0
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x40c]
push eax
push dword [ebp + 8]
call ebx
mov eax, dword [ebp - 0xc]
test eax, eax
jl 0x42dcdf
inc eax
mov dword [ebp + 0x10], eax
push 0
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 8]
call ebx
dec dword [ebp + 0x10]
jne 0x42dcc7
dec dword [ebp - 8]
jne 0x42dca9
push 0x400
lea eax, [ebp - 0x40c]
push 0
push eax
call fcn.004832e0
push 0x1a
lea eax, [ebp - 0x40c]
push str.____________b
push eax
call fcn.00483c80
add esp, 0x18
push 0
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x40c]
push eax
push dword [ebp + 8]
call ebx
add edi, 0xfffffffe
js 0x42dd3c
inc edi
push 0
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 8]
call ebx
dec edi
jne 0x42dd26
pop edi
pop esi
pop ebx
leave
ret
Function at 0x432ad4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
push edi
push 4
pop edi
push edi
push 0x20019
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00432a66
mov esi, eax
add esp, 0x14
cmp esi, 5
je 0x432b2a
test esi, esi
jne 0x432b32
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push eax
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 5
jne 0x432b32
test edi, edi
je 0x432b32
xor edi, edi
jmp 0x432ae1
pop edi
mov eax, esi
pop esi
leave
ret

Function at 0x432b38
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push 4
push 0x20006
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00432a66
add esp, 0x14
test eax, eax
jne 0x432b82
push esi
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push eax
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret

Function at 0x432b84
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push 4
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00432a66
add esp, 0x14
test eax, eax
jne 0x432bc1
push esi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret
Function at 0x433214
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x4b00d0], 0
push edi
mov edi, ecx
jne 0x433443
and dword [ebp - 4], 0
test byte [0x4b0ab8], 4
jne 0x43324a
or byte [0x4b0ab8], 8
push 2
push str.SeDebugPrivilege
call fcn.0040fac5
pop ecx
pop ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x4b00cc
mov esi, str.WS2_32.DLL
push esi
push str.WSAStartup
call fcn.00432cb9
lea eax, [ebp - 4]
push eax
push 0x4b00d4
push esi
push str.shutdown
call fcn.00432cb9
lea eax, [ebp - 4]
push eax
push 0x4b00d8
push esi
push str.closesocket
call fcn.00432cb9
lea eax, [ebp - 4]
push eax
push 0x4b00dc
push esi
push str.connect
call fcn.00432cb9
add esp, 0x40
lea eax, [ebp - 4]
push eax
push 0x4b00e0
push esi
push str.send
call fcn.00432cb9
lea eax, [ebp - 4]
push eax
push 0x4b00e4
push esi
push str.select
call fcn.00432cb9
lea eax, [ebp - 4]
push eax
push 0x4b00e8
push esi
push str.recvfrom
call fcn.00432cb9
lea eax, [ebp - 4]
push eax
push 0x4b00ec
push esi
push str.sendto
call fcn.00432cb9
add esp, 0x40
lea eax, [ebp - 4]
push eax
push 0x4b00f0
push esi
push str.bind
call fcn.00432cb9
lea eax, [ebp - 4]
push eax
push 0x4b00f4
push esi
push str.listen
call fcn.00432cb9
lea eax, [ebp - 4]
push eax
push 0x4b00f8
push esi
push str.accept
call fcn.00432cb9
lea eax, [ebp - 4]
push eax
push 0x4b0100
push esi
push str.getsockname
call fcn.00432cb9
add esp, 0x40
lea eax, [ebp - 4]
push eax
push 0x4b00fc
push esi
push str.getpeername
call fcn.00432cb9
lea eax, [ebp - 4]
push eax
push 0x4b0104
push esi
push str.ioctlsocket
call fcn.00432cb9
lea eax, [ebp - 4]
push eax
push 0x4b0108
push esi
push str.setsockopt
call fcn.00432cb9
lea eax, [ebp - 4]
push eax
push 0x4b010c
push esi
push str.ntohl
call fcn.00432cb9
add esp, 0x40
lea eax, [ebp - 4]
push eax
push 0x4b0110
push esi
push str.htonl
call fcn.00432cb9
lea eax, [ebp - 4]
push eax
push 0x4b0114
push esi
push str.htons
call fcn.00432cb9
lea eax, [ebp - 4]
push eax
push 0x4b0118
push esi
push str.inet_addr
call fcn.00432cb9
lea eax, [ebp - 4]
push eax
push 0x4b011c
push esi
push str.gethostbyname
call fcn.00432cb9
add esp, 0x40
lea eax, [ebp - 4]
push eax
push 0x4b0120
push esi
push str.inet_ntoa
call fcn.00432cb9
lea eax, [ebp - 4]
push eax
push 0x4b0124
push esi
push str.WSAGetLastError
call fcn.00432cb9
lea eax, [ebp - 4]
push eax
push 0x4b0128
push esi
push str.__WSAFDIsSet
call fcn.00432cb9
lea eax, [ebp - 4]
push eax
push 0x4b00d0
push esi
push str.socket
call fcn.00432cb9
add esp, 0x40
pop esi
mov eax, edi
pop edi
leave
ret

Function at 0x434432
Capabilities:
Find taskbar

Disassembly:
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowA]
push 0
push str.TrayNotifyWnd
push 0
push eax
call dword [sym.imp.USER32.dll_FindWindowExA]
ret
Function at 0x4347d7
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
xor edi, edi
cmp ebx, edi
mov esi, ecx
jne 0x4347eb
lea ebx, [ebp + 0x10]
mov eax, dword [esi + 8]
cmp eax, dword [esi + 0xc]
jl 0x43482e
mov eax, dword [esi + 4]
push edi
lea ecx, [ebp + 0x10]
push ecx
push 0x1000
push eax
push dword [esi]
mov dword [esi + 8], edi
mov dword [ebp + 0x10], edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, edi
mov ecx, dword [ebp + 0x10]
mov dword [esi + 0xc], ecx
jne 0x434824
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
je 0x43482e
cmp dword [ebp + 0x10], edi
jne 0x43482e
dec dword [esi + 0x14]
jns 0x4347f3
mov eax, dword [esi + 8]
cmp eax, dword [esi + 0xc]
jge 0x43484e
lea ecx, [eax + 1]
mov dword [esi + 8], ecx
mov ecx, dword [esi + 4]
mov al, byte [eax + ecx]
mov ecx, dword [ebp + 8]
mov byte [ecx], al
xor eax, eax
inc eax
mov dword [ebx], eax
jmp 0x434852
mov dword [ebx], edi
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x434d61
Capabilities:
Delete registry key

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x108
push esi
push edi
mov ax, word [ebp + 0x7c]
push 0x20
pop ecx
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionExplorerMountPoints_
lea edi, [ebp - 0x10]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x21
pop ecx
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionExplorerMountPoints2_
lea edi, [ebp - 0x94]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov word [ebp + 0x6e], ax
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x10]
push eax
mov edi, 0x80000001
push edi
call esi
lea eax, [ebp - 0x94]
push eax
push edi
call esi
pop edi
pop esi
add ebp, 0x74
leave
ret

Function at 0x43500e
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push edi
xor edi, edi
push edi
lea eax, [ebp - 4]
push eax
push 8
lea eax, [ebp - 0x10]
push eax
push edi
push edi
push 0x7405c
push dword [ebp + 8]
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
call ebx
push edi
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 0x18
push esi
push edi
push edi
push 0x70000
push dword [ebp + 8]
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
call ebx
cmp dword [ebp - 8], edi
je 0x43506d
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
jmp 0x43508a
mov eax, dword [esi + 0x14]
mul dword [esi + 0x10]
push edi
push dword [esi + 0xc]
push edx
push eax
call fcn.004833f0
push dword [esi + 4]
push dword [esi]
push edx
push eax
call fcn.004833f0
pop edi
pop ebx
leave
ret