joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ad5d0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
call fcn.0044a148
mov byte [ebp - 1], al
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4ad60e
cmp dword [ebp + 8], 0
je 0x4ad5fc
lea eax, [ebp + 8]
push eax
call fcn.004499c3
add esp, 4
movzx ecx, byte [ebp - 1]
test ecx, ecx
je 0x4ad60e
mov eax, 4
jmp 0x4ad73e
call fcn.0044b246
movzx edx, al
test edx, edx
jne 0x4ad63c
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4ad62d
mov dword [ebp - 0xc], 4
jmp 0x4ad634
mov dword [ebp - 0xc], 3
mov eax, dword [ebp - 0xc]
jmp 0x4ad73e
movzx eax, byte [ebp - 1]
test eax, eax
je 0x4ad6e5
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0
push 0
push 0
lea ecx, [ebp - 0x34]
push ecx
push 0x4ad920
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
lea ecx, [ebp - 8]
call fcn.0044ab8e
lea ecx, [ebp - 8]
call fcn.004493a6
movzx edx, al
test edx, edx
jne 0x4ad6a7
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 8]
call fcn.0044ab25
mov eax, dword [ebp - 0x10]
jmp 0x4ad73e
push 0
push 0xffffffffffffffff
lea ecx, [ebp - 8]
call fcn.00449e19
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
test eax, eax
je 0x4ad6d2
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 8]
call fcn.0044ab25
mov eax, dword [ebp - 0x14]
jmp 0x4ad73e
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 8]
call fcn.0044ab25
mov eax, dword [ebp - 0x18]
jmp 0x4ad73e
call fcn.0044a675
movzx ecx, al
test ecx, ecx
jne 0x4ad71e
mov edx, dword [ebp + 0x10]
or edx, 0x200000
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp + 0xc]
push ecx
lea edx, [ebp + 8]
push edx
lea eax, [ebp - 0x20]
push eax
call fcn.0044928e
add esp, 0x10
jmp 0x4ad73e
call fcn.0044927a
mov dword [ebp - 0x24], eax
lea ecx, [ebp + 0x10]
push ecx
lea edx, [ebp + 0xc]
push edx
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x24]
push ecx
call fcn.0044826c
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x430000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00401219
Function at 0x401000
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push esi
push 0x40
mov esi, eax
lea eax, [ebp - 0x58]
push 0
push eax
call fcn.0045c960
add esp, 0xc
xor eax, eax
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x5c]
push edx
push eax
push eax
push eax
push eax
push eax
push eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push eax
push 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x5c], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x401078
test esi, esi
je 0x40105f
mov ecx, dword [ebp - 0x14]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp - 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [ebp - 0x10]
push eax
call esi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
xor al, al
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x401120
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, eax
mov ebx, ecx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x401194
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x401194
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 8], eax
test eax, eax
je 0x401194
mov ecx, dword [ebp + 8]
push 1
mov ebx, 0x40000000
call fcn.00402100
mov esi, eax
cmp esi, 0xffffffff
je 0x401194
mov ecx, dword [ebp - 8]
push 0
lea eax, [ebp - 4]
push eax
push edi
push ecx
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4011a0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x48e110]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call esi
cmp dword [ebp - 0x114], 5
jne 0x4011df
cmp dword [ebp - 0x110], 1
je 0x401241
lea ecx, [ebp - 0x118]
push ecx
mov dword [ebp - 0x118], 0x114
call esi
cmp dword [ebp - 0x114], 6
jne 0x401204
cmp dword [ebp - 0x110], 0
je 0x401241
lea edx, [ebp - 0x118]
push edx
mov dword [ebp - 0x118], 0x114
call esi
cmp dword [ebp - 0x114], 6
jne 0x401229
cmp dword [ebp - 0x110], 1
je 0x401241
call fcn.00403620
test al, al
jne 0x401241
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045a10c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov al, 1
pop esi
call fcn.0045a10c
mov esp, ebp
pop ebp
ret
Function at 0x402100
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46d7cb
mov eax, dword fs:[0]
push eax
sub esp, 0x124
mov eax, dword [0x48e110]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 0
push 2
push 0
push 0
mov esi, ecx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40217b
cmp byte [ebp + 8], 0
je 0x4021b3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
jne 0x4021b1
push esi
call fcn.004023b0
add esp, 4
push 0
push 0
push 2
push 0
push 0
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4021b3
lea eax, [ebp - 0x128]
push eax
mov dword [ebp - 0x128], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x124], 6
jb 0x4021b1
mov dword [ebp - method.CAccessRight.virtual_0], vtable.CAccessRight.0
mov dword [ebp - 4], 0
call fcn.00401980
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045a10c
mov esp, ebp
pop ebp
ret 4

Function at 0x4021d0
Capabilities:
Check os version
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46c4cb
mov eax, dword fs:[0]
push eax
sub esp, 0x168
mov eax, dword [0x48e110]
xor eax, ebp
mov dword [ebp - 0x14], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edi, eax
test edi, edi
jne 0x402239
cmp byte [ebp + 8], al
je 0x4022a6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
jne 0x4022a6
push esi
call fcn.004022d0
add esp, 4
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
mov edi, eax
test edi, edi
je 0x4022a6
lea eax, [ebp - 0x16c]
push eax
mov dword [ebp - 0x16c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x168], 6
jb 0x4022a6
mov dword [ebp - method.CAccessRight.virtual_0], vtable.CAccessRight.0
xor ecx, ecx
push 0x3e
push ecx
lea edx, [ebp - 0x52]
mov dword [ebp - 4], 0
push edx
mov word [ebp - 0x54], cx
call fcn.0045c960
add esp, 0xc
push 0x20
push str.Users
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0
lea ecx, [ebp - 0x54]
push ecx
push esi
call fcn.004019e0
add esp, 0xc
mov eax, 1
jmp 0x4022a8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0045a10c
mov esp, ebp
pop ebp
ret
Function at 0x402430
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x484e50
push 0x45e910
mov eax, dword fs:[0]
push eax
sub esp, 0x880
mov eax, dword [0x48e110]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 8]
test esi, esi
je 0x4024c8
mov bl, 1
mov dword [ebp - 0x890], 0xffffffff
push 0x476940
push esi
push 0x476914
push 0x104
lea eax, [ebp - 0x638]
push eax
call fcn.0045ac31
add esp, 0x14
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x888]
push ecx
lea edx, [ebp - 0x638]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x890], eax
cmp eax, 0xffffffff
jne 0x4024cf
mov dword [ebp - 4], 0xfffffffe
xor al, al
jmp 0x40261b
mov edi, dword [ebp + 0xc]
cmp word [ebp - 0x85c], 0x2e
je 0x40258d
test byte [ebp - 0x888], 0x10
je 0x402527
lea eax, [ebp - 0x85c]
push eax
push esi
push str._s_s_
push 0x104
lea ecx, [ebp - 0x430]
push ecx
call fcn.0045ac31
add esp, 0x14
xor edx, edx
mov word [ebp - 0x22a], dx
push edi
lea eax, [ebp - 0x430]
push eax
call fcn.00402430
add esp, 8
mov bl, al
jmp 0x402587
lea ecx, [ebp - 0x85c]
push ecx
push esi
push 0x476914
push 0x104
lea edx, [ebp - 0x228]
push edx
call fcn.0045ac31
add esp, 0x14
xor eax, eax
mov word [ebp - 0x22], ax
test edi, edi
je 0x402557
cmp edi, 1
jne 0x40258d
lea ecx, [ebp - 0x228]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffffe
push eax
lea edx, [ebp - 0x228]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne bl
mov byte [ebp - 0x889], bl
lea ecx, [ebp - 0x888]
push ecx
mov edx, dword [ebp - 0x890]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4024d2
mov eax, dword [ebp - 0x890]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 0x890], 0xffffffff
test edi, edi
je 0x4025c9
cmp edi, 2
jne 0x402612
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne bl
mov byte [ebp - 0x889], bl
jmp 0x402612
mov dword [ebp - 4], 0xfffffffe
mov al, bl
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0045a10c
mov esp, ebp
pop ebp
ret
Function at 0x402640
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46eb98
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x48e110]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.004033b0
lea esi, [eax + 0x10]
mov dword [ebp - 0x18], esi
lea edi, [esi - 0x10]
mov eax, edi
mov byte [ebp - 4], 1
call fcn.004033b0
add eax, 0x10
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 2
mov dword [ebp - 0x14], ebx
lea esp, [esp]
push 4
push str._del
lea ebx, [ebp - 0x10]
call fcn.00402d70
mov ebx, dword [ebp - 0x10]
push 3
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x402747
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 0xa
jl 0x4026a0
lea eax, [ebx - 0x10]
mov byte [ebp - 4], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4026f0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
or edx, 0xffffffff
lea ecx, [edi + 0xc]
mov byte [ebp - 4], 0
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40270d
mov ecx, dword [edi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push edi
call edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402733
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 5
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
or edx, 0xffffffff
test eax, eax
lea eax, [ebx - 0x10]
mov byte [ebp - 4], 1
lea ecx, [eax + 0xc]
je 0x4026dd
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40277a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
lea ecx, [edi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402797
mov ecx, dword [edi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push edi
call edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4027bd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4027e0
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46f438
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x48e110]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40285d
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edx, dword [ebp + 8]
and eax, 0xfffffffe
push eax
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x40285d
mov eax, dword [ebp + 8]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x10], esp
mov esi, esp
call fcn.004033b0
add eax, 0x10
mov dword [esi], eax
call fcn.00402640
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402883
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4028a0
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x470240
mov eax, dword fs:[0]
push eax
sub esp, 0x878
mov eax, dword [0x48e110]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 8]
test esi, esi
jne 0x4028df
xor eax, eax
jmp 0x4029d3
push 0x476940
push esi
push 0x476914
lea eax, [ebp - 0x62c]
push 0x104
push eax
mov edi, 1
call fcn.0045ac31
add esp, 0x14
lea ecx, [ebp - 0x87c]
push ecx
lea edx, [ebp - 0x62c]
push edx
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x880], eax
cmp eax, 0xffffffff
je 0x4028d8
mov ebx, dword [ebp + 0xc]
cmp word [ebp - 0x850], 0x2e
je 0x40297c
test byte [ebp - 0x87c], 0x10
je 0x4029ef
lea eax, [ebp - 0x850]
push eax
push esi
push str._s_s_
lea ecx, [ebp - 0x424]
push 0x104
push ecx
call fcn.0045ac31
lea eax, [ebp - 0x424]
xor edx, edx
push ebx
push eax
mov word [ebp - 0x21e], dx
call fcn.004028a0
add esp, 0x1c
mov edi, eax
mov eax, dword [ebp - 0x880]
lea edx, [ebp - 0x87c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40292c
mov ecx, dword [ebp - 0x880]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
test ebx, ebx
je 0x4029aa
cmp ebx, 2
jne 0x4029d1
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x4029d1
push 4
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0045a10c
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x850]
push ecx
push esi
push 0x476914
lea edx, [ebp - 0x21c]
push 0x104
push edx
call fcn.0045ac31
xor eax, eax
add esp, 0x14
mov word [ebp - 0x16], ax
test ebx, ebx
je 0x402a23
cmp ebx, 1
jne 0x40297c
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffffe
push eax
lea edx, [ebp - 0x21c]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, eax
test edi, edi
jne 0x40297c
push ecx
mov ecx, esp
mov dword [ebp - 0x884], esp
push ecx
lea ecx, [ebp - 0x21c]
call fcn.00403080
call fcn.00402640
add esp, 4
jmp 0x40297c
Function at 0x402eb0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
mov eax, dword [ebp + 8]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x402ec8
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402efa
mov ecx, dword [ebp + 8]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x402ef6
cmp esi, eax
jae 0x402efa
dec edi
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x402ee8
cmp esi, eax
jb 0x402f00
pop esi
xor eax, eax
pop edi
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret

Function at 0x403460
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, ebx
push esi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x403470
mov ecx, dword [ebp + 8]
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push ebx
push 1
push ecx
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov esi, eax
cmp esi, 5
jne 0x4034f5
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, edi
mov dword [ebp - 4], vtable.CAccessPermission.0
call fcn.00403880
test eax, eax
je 0x4034f5
mov eax, ebx
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4034c0
sub eax, edx
sar eax, 1
lea edx, [eax + eax + 2]
mov eax, dword [ebp + 8]
push edx
push ebx
push 1
push eax
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, edi
mov esi, eax
call fcn.00403960
test esi, esi
sete al
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x403580
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x48e110]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x114], 6
jae 0x4035c6
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045a10c
mov esp, ebp
pop ebp
ret
push esi
push str.user32.dll
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x4035e7
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045a10c
mov esp, ebp
pop ebp
ret
push str.ChangeWindowMessageFilter
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x403601
mov ecx, dword [ebp + 8]
push 1
push ecx
call eax
mov esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0045a10c
mov esp, ebp
pop ebp
ret
Function at 0x403620
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x48e110]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x114], 6
jne 0x40366c
cmp dword [ebp - 0x110], 2
jne 0x40366c
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045a10c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor al, al
call fcn.0045a10c
mov esp, ebp
pop ebp
ret

Function at 0x403880
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa1c
mov eax, dword [0x48e110]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push esi
add eax, 0x80000000
push edi
mov edi, ecx
cmp eax, 3
ja case.default.0x4038a8
jmp dword [eax*4 + 0x403944]
mov esi, str.CLASSES_ROOT
jmp 0x4038c9
mov esi, str.CURRENT_USER
jmp 0x4038c9
mov esi, str.MACHINE
jmp 0x4038c9
mov esi, str.USERS
lea eax, [ebp - 0xa18]
push eax
lea ecx, [ebp - 0x214]
push ecx
mov dword [ebp - 0xa18], 0x202
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push edi
push esi
push 0x476a00
lea edx, [ebp - 0xa14]
push 0x800
push edx
call fcn.0045ac31
add esp, 0x14
push 0xf003f
lea eax, [ebp - 0x214]
push eax
push 2
lea edi, [ebp - 0xa14]
call fcn.00403780
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0045a10c
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 8]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.0045a10c
mov esp, ebp
pop ebp
ret 4

Function at 0x403960
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa1c
mov eax, dword [0x48e110]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push esi
add eax, 0x80000000
push edi
mov edi, ecx
cmp eax, 3
ja case.default.0x403988
jmp dword [eax*4 + 0x403a20]
mov esi, str.CLASSES_ROOT
jmp 0x4039a9
mov esi, str.CURRENT_USER
jmp 0x4039a9
mov esi, str.MACHINE
jmp 0x4039a9
mov esi, str.USERS
lea eax, [ebp - 0xa18]
push eax
lea ecx, [ebp - 0x214]
push ecx
mov dword [ebp - 0xa18], 0x202
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push edi
push esi
push 0x476a00
lea edx, [ebp - 0xa14]
push 0x800
push edx
call fcn.0045ac31
add esp, 0x14
push 2
lea eax, [ebp - 0x214]
push eax
push 3
lea edi, [ebp - 0xa14]
call fcn.00403780
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0045a10c
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 8]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.0045a10c
mov esp, ebp
pop ebp
ret 4