joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e32d7
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, edi
mov eax, dword [ebx]
sub ecx, eax
sar ecx, 1
mov dword [ebp - 4], ecx
mov esi, dword [eax - 0xc]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], esi
test eax, eax
js 0x4e33b3
test edi, edi
jne 0x4e330c
xor edx, edx
mov dword [ebp + 8], edx
jmp 0x4e331b
push eax
push edi
call 0x70eec0
add esp, 8
mov dword [ebp + 8], eax
mov edx, eax
mov ecx, 0x7fffffff
sub ecx, edx
cmp ecx, esi
jl 0x4e33b3
add esi, edx
js 0x4e33b3
mov eax, dword [ebx]
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, esi
or ecx, eax
jge 0x4e3350
push esi
mov ecx, ebx
call int.004e4037
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
cmp eax, ecx
ja 0x4e335f
mov edi, dword [ebx]
lea edi, [edi + eax*2]
mov eax, dword [ebx]
lea eax, [eax + ecx*2]
add edx, edx
je 0x4e3398
test eax, eax
je 0x4e3388
push edx
test edi, edi
je 0x4e337d
push edi
push eax
call 0x70aea7
add esp, 0xc
jmp 0x4e3398
push 0
push eax
hlt
fcom st(3)
call 0xc882ea4f
insb byte es:[edi], dx
cmp byte [esi + 0xe], bh
outsb dx, byte [esi]
mov eax, 0x784005fe
into
js 0x4e3368
test byte [esi], dl
pop eax
dec edx
into
pop edx
mov eax, 0x9eee28e6
xor eax, 0xa410a788
push es
invalid
insb byte es:[edi], dx
cdq
push esp
pushal
scasd eax, dword es:[edi]
pop ecx
das
lcall 0xbc55, 0xa4b6caf4
test eax, 0xc1cc08e4
Function at 0x525d90
Capabilities:
Encode data using xor

Disassembly:
jl 0x525dc4
out dx, al
and dh, byte [ebx]
iretd
pop ecx
dec edi
push 0xbf7c8290
jge 0x525de3
mov esi, 0x52dd6dd7
add dword [edx], ebp
xchg edx, eax
inc ebx
jmp 0x525e47
imul edx, dword [ebp - 0x12], 0x82591464
invalid
sbb ecx, esp
jmp 0x525ebb
sahf
ret 0x1b75
sbb ecx, edi
sbb esi, dword [esp + edx*4 + 0x61]
popal
js 0x525e74
insd dword es:[edi], dx
fnstcw word [ebx + ecx*8]
aad 0xd8
cmp al, 0x25
js 0x525eb0
test byte ds:[eax - 0x62], cl
test byte [eax - 0x62], cl
sub ebp, dword [edx + 0x45a167ab]
and bl, byte [ebx + esi*4]
mov eax, dword [0x2245]
sbb al, 0xb3
push ebx
imul ecx, dword [ebx], 0x975205aa
push edx
xchg edi, eax
mov eax, dword fs:[0x8929d6df]
jecxz 0x525e9c
cmp al, 0x22
pushfd
xchg edi, esi
cdq
pop ebp
adc eax, 0x41209ff7
mov ecx, 0x3f9a2802
jecxz 0x525eaa
xchg edx, eax
jle 0x525e97
rcr dword [esi + 0x29254a3c], 1
rol dword [edx], 1
mov eax, dword [0xf868765e]
dec edx
and eax, 0xa102d129
pop esi
jbe 0x525f4f
clc
xor bh, 0x7a
pop es
cmp eax, 0xa2b01bff
sti
sbb ch, byte [eax]
xchg edx, eax
and esp, ebx
ficomp dword [esi + 0x1535f1f2]
jbe 0x525ede
loope 0x525f2a
rol dword [edx], 1
mov eax, dword [0x1bf0f256]
rcl bh, 0x78
adc byte [ecx - 0x5dfbeb03], cl
jmp 0x525f19
int1
xor eax, 0x7dd77615
int1
xor byte [edi + 1], al
push esi
cli
int3
popal
salc
push eax
lcall 0xec89, 0x935de0db
das
xor ah, byte [ecx - 0x43835e1c]
mov ch, 0x90
mov edi, 0xc2a23c2a
adc ecx, ebx
fcmovnu st(0), st(7)
push 0x78f782a0
and ch, dh
sti
adc dword [eax + 0x78], esp
rol dword [edx], cl
pop esi
invalid
pushal
js 0x525f25
add bl, byte [esi + 0xf]
cmp al, 0x98
sbb edi, esi
adc ebx, dword [edx]
pop ebx
sahf
or edi, dword [esi + 0x315d5cab]
push 0x6fed77ec
or edi, dword [edx - 0x75af2bfb]
sub byte [edx - 0x13], bl
xchg dword [ecx], ebp
push ebp
mov ch, 0xe0
xchg esp, eax
invalid

Function at 0x533fcc
Capabilities:
Encode data using xor

Disassembly:
sahf
outsd dx, dword [esi]
cmp ch, ch
push ss
sbb byte [esi + 0x1170cfd0], bl
jo 0x533fe8
movsd dword es:[edi], dword [esi]
jae 0x534041
cmpsd dword [esi], dword es:[edi]
push ecx
jbe 0x53401f
lcall 0x144b, 0xfe599e90
sahf
pop ecx
dec byte [ebx + 0x14]
cmp bl, byte [edx - 0x10]
cmc
rcl byte [ecx + 4], 0xb8
push esi
jno 0x533ff1
cdq
cli
rcl edx, 1
loope 0x533fe0
aas
into
cmpsb byte [esi], byte es:[edi]
pop edi
or eax, 0xe882f57a
add ebx, eax
jg 0x53404e
push ss
jb 0x534049
mov eax, 0xda1c7f85
jno 0x534024
add al, 0x2b
fnstsw word [edx - 0x3bfcbe7f]
retf 0xe035
push eax
push 0x77
cmp eax, 0x258051c1
and eax, 0x31d870f
push ecx
and byte [0x1d870f25], 3
push ecx
ret 0x232e
and ecx, dword cs:[esi]
mov bh, 0x2e
cmp dl, byte [edi + 0x39300000]
pop es
mov byte [eax], al
inc byte [eax - 0x63]
in al, 0x9e
push eax
pop edx
add byte [esp + eax*8 - 0x36], cl
cmp dword [0x9e8067c4], ebp
les esp, [edi - 0x80]
sahf
cmpsd dword [esi], dword es:[edi]
xchg al, bh
pop esi
and edi, ebx
xor dh, ch
rcl ecx, 0xa4
xlatb
aad 0x86
wait
jg 0x534053
mov esp, 0xe9eb9e01
dec edi
je 0x53402e
cmp dword [esi + 0x4914a904], eax
pop edi
sub byte [edx + 0x66], dh
pop eax
xchg ebx, eax
ret
Function at 0x595d97
Capabilities:
Encode data using xor

Disassembly:
sbb eax, 0xd4768e35
adc ebp, dword [esi - 0x67]
sbb byte [edi + esi*8], 0x13
sbb byte [edi + esi*8], 0x13
cmpsb byte [esi], byte es:[edi]
movsd dword es:[edi], dword [esi]
inc ebx
cmpsb byte [esi], byte es:[edi]
dec ebp
and bl, dl
xchg ebx, eax
stosd dword es:[edi], eax
mov eax, dword [0x54d2be50]
xchg esi, eax
push es
sub esp, ebx
push es
xchg ebp, eax
or eax, 0x5ee21670
loop 0x595df7
loop 0x595df7
movsd dword es:[edi], dword [esi]
xor edx, ebx
and bh, ah
jne 0x595d72
mov al, byte [0xc202b254]
fstpnce st(4), st(0)
out 0x2c, al
adc byte [esi - 0x5c79ca], dh
jecxz 0x595d7b
rol al, 1
and ah, byte [esi + 0x3be1b523]
div byte gs:[edx]
push edx
inc ecx
movsb byte es:[edi], byte [esi]
pop esp
lodsb al, byte [esi]
adc ebx, edx
aaa
lcall 0x9c8e, 0xf0cb4d2e
dec edx
and ah, byte [edx]
mov word [edx], es
test byte [ebp - 0xd1b6af1], dh
push bx
add ch, bh
sbb eax, 0x4c23a61c
inc ebx
fisttp dword [edx + 0x1c789170]
pop ss
loope fcn.00595d97
aam 0xde
lodsd eax, dword [esi]
cwde
inc edx
sub byte [ebx + 0x6502fa46], ah
mov byte [edx - 0x50], bh
mov byte gs:[edx - 0x50], bh
int3

Function at 0x59cb07
Capabilities:
Encode data using xor

Disassembly:
sub byte [ecx], ah
or eax, 0x1732656c
pop ss
adc edi, dword [ecx - 0x61ae29c6]
push edi
dec ebx
xor cl, byte [eax - 0x79db7430]
insd dword es:[edi], dx
or eax, 0xe657047a
mov bl, 0x4e
rcl byte [eax - 0x67f39353]
jg 0x59cb88
invalid
lodsb al, byte [esi]
jle 0x59cb0d
sal ch, 1
daa
push 0x4da77c0f
xchg esi, eax
dec ebx
iretd

Function at 0x6028c7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ds
adc byte [ecx + 0x33a859aa], ch
push edx
mov eax, dword [0xe828a9e8]
outsd dx, dword [esi]
add dh, 0xc8
push ebp
js 0x602872
invalid
dec ecx
test dword [eax + 0x17], ebx
mov edi, 0x7e808437
test eax, 0xbba377d9
or dword [0x8f4bcde9], 0x51980bc1
xchg esp, ebp
sbb dword [edi - 4], edi
cli
pop esp
add ebp, dword [edx]
mov eax, dword [0xbaf777f3]
fst st(4)
outsd dx, dword [esi]
pop edx
pop ecx
xor eax, 0x946efb09
outsw dx, word [esi]
inc esp
or byte [esi + 0x19], bl
dec ecx
mov cl, 0x2f
lahf
or eax, dword [edi - 0x4f18c616]
xchg ecx, eax
test eax, 0xcb9e4a43
adc esi, dword [ebx + 0x5b]
nop
insd dword es:[edi], dx
fmul st(3)
pop ds
mov cl, 0x51
push ecx
push ecx
mov ecx, 0x54768be3
and eax, edx
daa
jge 0x602905
test byte [eax - 0x66], bh
dec edi
dec ebp
jae 0x602863
dec ecx
push 0x22
xchg edi, eax
mov eax, 0xe9596abb
add eax, 0xb9e92bc9
pop eax
jmp 0x8673746d
add byte [ebx + 0x7b767fff], al
movzx edx, word [esi]
add esi, 2
mov eax, edx
and eax, 0xfc00
cmp eax, 0xd800
jne 0x602939
movzx eax, word [esi]
mov ecx, 0x3ff
and edx, ecx
and eax, ecx
shl edx, 0xa
or edx, eax
add edx, 0x10000
add esi, 2
test ebx, ebx
je 0x602982
mov eax, edx
shr eax, 7
movzx ecx, byte [eax + 0x4bff40]
mov eax, edx
and eax, 0x7f
shl ecx, 7
add ecx, eax
movzx eax, word [ecx*2 + 0x4b1c40]
add edx, dword [eax*8 + 0x4af3f4]
mov eax, 0xff
cmp edx, eax
jbe 0x60296d
mov edx, eax
mov ebx, dword [ebp - 4]
mov ecx, edx
shr ecx, 3
and edx, 7
pop es
movzx eax, byte [ecx + ebx]
bts eax, edx
mov byte [ecx + ebx], al
mov eax, esi
jmp 0x6029b5
pop edi
pop esi
pop ebx
leave
ret
Function at 0x62fbd7
Capabilities:
Encode data using xor

Disassembly:
jb 0x62fb71
lea ebp, cs:[ecx + 0x561ba97b]
adc ah, byte [edx]
mov esi, 0x9430bd4d
cmp eax, ebp
bswap ebp
xor esp, dword [ebx - 0x9a578c]
push ebp
insd dword es:[edi], dx
push 0xc47f15fc
fstp dword [ebx - 0xbc6a780]
push ecx
popfd
adc eax, dword [ebx]
push ebp
xor byte [ecx + 0x36ba2e19], ah
jecxz 0x62fb56
mov cl, 0xd1
add dword [ebp + 0x571235d8], 0xd5eca550
dec ebx
sbb dword [edi - 0x39], 0xffffffd8
mov dh, 0x3f
aaa
dec esi
sub eax, 0x27cf4f4e
invalid
jae 0x62fb7d
cmp byte [ebx - 0x78], al
or al, 0xa
test byte [0x6e0aaff0], 0x33
fild dword [esi - 0x35]
sahf
push 0xffffffffffffffdf
sub byte [eax], 0x73
sub al, byte [0x50e2b140]
mov edi, 0xef89d7ef
adc eax, 0x2af45dc5
das
xor ebx, dword [edx - 0x3d]
xchg edx, eax
inc eax
push ebx
invalid

Function at 0x64d81d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x656358
cmp edx, dword [eax]
je 0x64d83f
add eax, 8
inc ecx
cmp eax, 0x6563e8
jl 0x64d830
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x656358]
jne 0x64d96d
mov eax, dword [0xa59cc0]
cmp eax, 1
je 0x64d947
test eax, eax
jne 0x64d870
cmp dword [0x656284], 1
je 0x64d947
cmp edx, 0xfc
je 0x64d96d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x64d8a7
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0064e200
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0064e690
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x64d8ea
lea eax, [ebp - 0x1a4]
push eax
call fcn.0064e690
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x652a44
push edi
call fcn.00650560
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0064e200
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0064e210
lea eax, [ebp - 0xa0]
push 0x652a24
push eax
call fcn.0064e210
push dword [esi + 0x65635c]
lea eax, [ebp - 0xa0]
push eax
call fcn.0064e210
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.006504d4
add esp, 0x2c
pop edi
jmp 0x64d96d
lea eax, [ebp + 8]
lea esi, [esi + 0x65635c]
push 0
push eax
push dword [esi]
call fcn.0064e690
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0xee3968
Capabilities:
Encode data using xor

Disassembly:
mov dl, byte [ecx]
inc ebp
sbb al, 0x43
jle 0xee399c
mov eax, dword [0x1c6ce249]
int3
jo 0xee393e
sbb al, 0xdc
mov dl, 0xe3
xchg edi, eax
dec eax
cmpsb byte [esi], byte es:[edi]
aaa
mov eax, dword [eax - 0x56]
das
mov edi, 0x9d607559
jnp 0xee3940
fistp word [eax + eax + 0x1c0008eb]
or al, 0
add byte [eax], al
add byte [eax], al
jmp 0xee3972
pushal
call 0xee3978
pop ebp
sub ebp, 0x10
sub ebp, 0xae3968
jmp 0xee398e
mov eax, 0xae3968
add eax, ebp
add eax, 0x4c
mov ecx, 0x5b1
mov cl, 5
add byte [eax], al
mov edx, 0x6657e78b
xor byte [eax], dl
inc eax
dec ecx
jne 0xee39a5
jmp 0xee39b8
add byte [esi], al
add dh, byte [edi + 0xa8b8b8b]
dec edx
jae 0xee394f
mov ecx, dword [ebx - 0x72ccb978]
mov ecx, dword [ebx - 0x745cce75]
mov ecx, dword [ebx + 0x4388697c]
add byte [edx], cl
xchg dword [ebx + 0x4e888b8b], ecx
push es
out dx, eax
scasd eax, dword es:[edi]
ja 0xee39e5
invalid
fninit
iretd
Function at 0x4076a8
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffffc
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov edi, dword [ebp + 8]
cmp byte [ebx + 0x18], 0
jne 0x407724
mov byte [ebp - 0x1004], 0
mov eax, dword [ebx + 0x19]
call fcn.00403b08
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
mov eax, esi
call fcn.00403b08
push eax
mov eax, dword [ebp - 4]
call fcn.00403b08
push eax
mov eax, dword [ebx + 0x1d]
call fcn.00403b08
push eax
call sub.kernel32.dll_GetPrivateProfileStringA
test eax, eax
je 0x40771b
mov eax, edi
lea edx, [ebp - 0x1004]
mov ecx, 0x1000
call fcn.004038f0
jmp 0x407755
mov eax, edi
call fcn.004036a8
jmp 0x407755
mov eax, edi
mov edx, esi
call fcn.004036fc
mov eax, dword [ebx + 0x19]
call fcn.00403b08
push eax
mov eax, esi
call fcn.00403b08
push eax
mov eax, dword [ebp - 4]
call fcn.00403b08
push eax
mov eax, dword [ebx + 0x1d]
call fcn.00403b08
push eax
call sub.kernel32.dll_WritePrivateProfileStringA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x409398
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x4093b3
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.004090c5
cld
invalid
invalid
ljmp 0xc045

Function at 0x40a524
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x72c], 0
and byte [ebp - 0x72b], 0
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.004090c5
dec eax
hlt
Function at 0x40b278
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
cmp byte [eax + 0x1c], 0x18
je 0x40b289
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.004090c5
in eax, dx
pop esp
mov ah, 0x5c
mov edi, eax

Function at 0x40b298
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]

Function at 0x40bccc
Capabilities:
Get file attributes

Disassembly:
push ebx
push eax
push 0x8001
call sub.kernel32.dll_SetErrorMode
xchg ebx, eax
call sub.kernel32.dll_GetFileAttributesA
inc eax
je 0x40bce7
dec eax
and al, 0x10
setne al
xchg ebx, eax
push eax
call sub.kernel32.dll_SetErrorMode
xchg ebx, eax
pop ebx
ret

Function at 0x40ca60
Capabilities:
Hide graphical window

Disassembly:
and byte [eax + 0x37], 0xef
test dl, dl
je 0x40ca6c
or byte [eax + 0x37], 0x10
mov byte [eax + 0x56], dl
mov ecx, dword [eax + 0x28]
jecxz 0x40ca88
push eax
je 0x40ca89
call dword [0x41a12c]
pop eax
push 5
push dword [eax + 0x28]
call sub.user32.dll_ShowWindow
ret
mov byte [eax + 0x178], dl
push 0
push ecx
call sub.user32.dll_ShowWindow
pop eax
call dword [0x41a12c]
ret

Function at 0x40ea7c
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov word [ebp - 2], cx
mov edi, edx
mov esi, eax
push 0
push 0x8000080
push 3
push 0
push 1
push 0xc0000000
push esi
call sub.kernel32.dll_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40eab0
xor eax, eax
jmp 0x40eb01
lea eax, [ebp - 0xc]
push eax
mov ax, word [ebp - 2]
push eax
push edi
call sub.kernel32.dll_DosDateTimeToFileTime
test eax, eax
je 0x40eae4
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
call sub.kernel32.dll_LocalFileTimeToFileTime
test eax, eax
je 0x40eae4
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push ebx
call sub.kernel32.dll_SetFileTime
push ebx
call sub.kernel32.dll_CloseHandle
mov ax, word [ebp + 8]
and ax, 0x27
movzx eax, ax
push eax
push esi
call sub.kernel32.dll_SetFileAttributesA
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40fda8
Capabilities:
Identify system language via api

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], eax
mov edx, dword [0x41a6dc]
mov edx, dword [edx]
mov eax, dword [esp]
mov eax, dword [eax + 0x18]
call fcn.0040ca04
mov ebp, 0xff
mov eax, 0x1a
call fcn.00417368
mov esi, eax
dec esi
test esi, esi
jl 0x40fe1a
inc esi
xor ebx, ebx
mov edi, ebx
shl edi, 2
mov eax, dword [0x41a674]
mov eax, dword [eax]
mov edx, dword [eax + edi*4]
mov eax, dword [esp]
mov eax, dword [eax + 0x24]
call fcn.00409398
mov eax, dword [0x41a674]
mov eax, dword [eax]
mov eax, dword [eax + edi*4 + 4]
call fcn.0040bbb0
push eax
call sub.kernel32.dll_GetUserDefaultLangID
movzx eax, ax
pop edx
cmp edx, eax
jne 0x40fe16
mov ebp, ebx
inc ebx
dec esi
jne 0x40fddc
cmp ebp, 0xff
jne 0x40fe5a
mov eax, 0x1a
call fcn.00417368
mov esi, eax
dec esi
test esi, esi
jl 0x40fe5a
inc esi
xor ebx, ebx
mov eax, ebx
shl eax, 2
mov edx, dword [0x41a674]
mov edx, dword [edx]
mov eax, dword [edx + eax*4]
mov edx, 0x40fe80
call fcn.00403a54
jne 0x40fe56
mov ebp, ebx
jmp 0x40fe5a
inc ebx
dec esi
jne 0x40fe36
cmp ebp, 0xff
jne 0x40fe64
xor ebp, ebp
mov eax, dword [esp]
mov eax, dword [eax + 0x24]
mov edx, ebp
call fcn.0040d3a0
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x411ff0
Capabilities:
Get hostname
Get session user name

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, edx
mov dword [esp], pe_nt_image_headers32
test al, al
je 0x412011
push esp
lea eax, [esp + 8]
push eax
call sub.advapi32.dll_GetUserNameA
jmp 0x41201c
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
mov eax, ebx
lea edx, [esp + 4]
mov ecx, pe_nt_image_headers32
call fcn.004038f0
add esp, 0x104
pop ebx
ret

Function at 0x412034
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffc10
mov ebx, edx
push esp
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov eax, dword [esp]
push eax
call sub.ole32.dll_CoTaskMemFree
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x3e9
call fcn.004038f0
add esp, 0x3f0
pop ebx
ret
Function at 0x41743c
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x417515
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
lea ecx, [ebp - 4]
xor edx, edx
mov eax, edi
call fcn.00417378
mov eax, dword [ebp - 4]
call fcn.00403b08
push eax
call sub.kernel32.dll_DeleteFileA
inc edi
cmp edi, 0x12
jne 0x41745b
test bl, bl
je 0x4174d2
mov eax, 0x1a
call fcn.00417368
mov esi, eax
add esi, 0x14
sub esi, 0x14
jl 0x4174d2
inc esi
mov edi, 0x14
lea ecx, [ebp - 8]
xor edx, edx
mov eax, edi
call fcn.00417378
mov eax, dword [ebp - 8]
call fcn.00403b08
push eax
call sub.kernel32.dll_DeleteFileA
lea ecx, [ebp - 0xc]
lea eax, [edi + 0x1e]
xor edx, edx
call fcn.00417378
mov eax, dword [ebp - 0xc]
call fcn.00403b08
push eax
call sub.kernel32.dll_DeleteFileA
inc edi
dec esi
jne 0x417499
lea ecx, [ebp - 0x14]
xor edx, edx
mov eax, 1
call fcn.00417378
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00406114
mov eax, dword [ebp - 0x10]
call fcn.00403b08
push eax
call sub.kernel32.dll_RemoveDirectoryA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41751c
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.004036cc
ret

Function at 0x417943
Capabilities:
Compare security identifiers

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov byte [esp], 0
lea eax, [esp + 4]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
mov ebx, eax
test ebx, ebx
jne 0x4178f0
call sub.kernel32.dll_GetLastError
cmp eax, 0x3f0
jne 0x4178f0
lea eax, [esp + 4]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
mov ebx, eax
test ebx, ebx
je 0x417987
mov eax, 0x400
call fcn.00402830
mov esi, eax
lea eax, [esp + 8]
push eax
push 0x400
push esi
push 2
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_GetTokenInformation
mov ebx, eax
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_CloseHandle
test ebx, ebx
je 0x417980
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
push 0x41a660
call sub.advapi32.dll_AllocateAndInitializeSid
mov ebx, dword [esi]
dec ebx
test ebx, ebx
jl 0x417976
inc ebx
xor edi, edi
mov eax, dword [esi + edi*8 + 4]
push eax
mov eax, dword [esp + 0x10]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x417972
mov byte [esp], 1
jmp 0x417976
inc edi
dec ebx
jne 0x417959
mov eax, dword [esp + 0xc]
push eax
call sub.advapi32.dll_FreeSid
mov eax, esi
call fcn.00402860
mov al, byte [esp]
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x417c80
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403af8
xor eax, eax
push ebp
push 0x417cf1
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040bbe4
mov edx, dword [ebp - 8]
mov eax, 0x41b874
call fcn.004036fc
xor eax, eax
mov dword [0x41b870], eax
push 0
push 0x417b94
call sub.user32.dll_EnumWindows
mov ebx, dword [0x41b870]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x417cf8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004036cc
ret

Function at 0x417d00
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ecx
mov esi, eax
xor ebx, ebx
test esi, esi
jns 0x417d11
call fcn.00402d08
push esi
push 0xffffffffffffffff
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov edi, eax
test edi, edi
jns 0x417d29
call fcn.00402d08
push esp
mov esi, edi
test esi, esi
jns 0x417d35
call fcn.00402d08
push esi
call sub.kernel32.dll_GetExitCodeProcess
test edi, edi
je 0x417d58
mov eax, dword [esp]
push eax
test edi, edi
jns 0x417d4c
call fcn.00402d08
push esi
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb ebx, ebx
inc ebx
test edi, edi
jns 0x417d61
call fcn.00402d08
push esi
call sub.kernel32.dll_CloseHandle
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x417d12
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ecx
mov esi, eax
xor ebx, ebx
test esi, esi
jns 0x417d11
call fcn.00402d08
push esi
push 0xffffffffffffffff
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov edi, eax
test edi, edi
jns 0x417d29
call fcn.00402d08
push esp
mov esi, edi
test esi, esi
jns 0x417d35
call fcn.00402d08
push esi
call sub.kernel32.dll_GetExitCodeProcess
test edi, edi
je 0x417d58
mov eax, dword [esp]
push eax
test edi, edi
jns 0x417d4c
call fcn.00402d08
push esi
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb ebx, ebx
inc ebx
test edi, edi
jns 0x417d61
call fcn.00402d08
push esi
call sub.kernel32.dll_CloseHandle
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret