joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4010b2
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x410284]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x4010ff
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x804]
push 0x3ff
push 0x400
push eax
call fcn.0040170c
lea eax, [ebp - 0x804]
push eax
call fcn.0040170c
add esp, 0x18
push 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401ea2
leave
ret

Function at 0x40110b
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x410284]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x401158
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x404]
push 0x3ff
push 0x400
push eax
call fcn.0040170c
lea eax, [ebp - 0x404]
push eax
call fcn.0040170c
add esp, 0x18
push 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401ea2
leave
ret

Function at 0x40170c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x40171b
pop dword [ebp - 0x18]
mov eax, 0xc555bfe0
sub eax, 0xc515a8c5
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x7fe4da5a
sub dword [ebp - 0x28], 0x3192950f
mov dword [ebp - 0x24], 0xfea8cfd9
sub dword [ebp - 0x24], 0xcc758394
mov dword [ebp - 0x20], 0x460f12a
sub dword [ebp - 0x20], 0xb814acfc
mov dword [ebp - 0x1c], 0x831ad2d9
add dword [ebp - 0x1c], 0x7ce52d27
lea eax, [ebp - 0x28]
push eax
mov eax, 0x5b687983
sub eax, 0x5b27a92f
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x3537f016
sub dword [ebp - 0x28], 0xc0c586c0
mov dword [ebp - 0x24], 0x24835ab2
add dword [ebp - 0x24], 0x1ce906c3
mov dword [ebp - 0x20], 0x70acb09
sub dword [ebp - 0x20], 0xa39b5e9d
mov dword [ebp - 0x1c], 0x79e09b34
add dword [ebp - 0x1c], 0x861f64cc
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0xed78b090
sub eax, 0xed37e044
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x38ed6
push 0
call eax
mov ecx, 0x44c8
xor esi, esi
add esi, eax
mov edx, 0xa805e329
add edx, 0x583bccd7
add edx, dword [ebp - 0x18]
mov edi, 0x72222456
add edi, 0x455fd15
xor dword [ebp - 0x10], 0xab6ac14b
mov ebx, dword [edx]
xor dword [ebp - 0x10], eax
xor ebx, edi
sub dword [ebp - 8], ecx
mov dword [esi], ebx
mov dword [ebp - 8], 0x7792bf26
add esi, 0x92c8d7ce
add esi, 0x6d372836
add edx, 0xd1375c7c
add edx, 0x2ec8a388
loop 0x401839
add eax, 0x4b1b79f2
sub eax, 0x4b1a73ff
mov ebx, eax
add eax, 5
mov ecx, 0x2fa15f54
sub ecx, 0x2f615f54
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53
Function at 0x4049a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 1
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp dword [ebp - 4], 0
je 0x404a1b
mov dword [ebp - 8], 1
mov dword [ebp - 0xc], 0x104
lea eax, [ebp - 0xc]
push eax
push 0x104
mov ecx, dword [ebp + 0x14]
call fcn.00403160
push eax
lea ecx, [ebp - 8]
push ecx
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xffffffffffffffff
mov ecx, dword [ebp + 0x14]
call fcn.00403b30
mov eax, 1
jmp 0x404a1d
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x404d70
Capabilities:
Get installed programs
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44ce42
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4c
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x38]
call fcn.004052d0
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x50]
mov dword [ebp - 0x54], ecx
mov dword [ebp - 4], 0
push 0x450e34
mov edx, dword [ebp - 0x54]
push edx
lea eax, [ebp - 0x18]
push eax
call fcn.00402990
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x38]
call fcn.0041bb00
lea ecx, [ebp - 0x10]
call fcn.00403100
mov byte [ebp - 4], 3
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x14]
push ecx
push 8
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp dword [ebp - 0x14], 0
je 0x404f10
mov dword [ebp - 0x20], 0
mov edx, 1
test edx, edx
je 0x404f06
lea ecx, [ebp - 0x2c]
call fcn.00403100
mov byte [ebp - 4], 4
mov dword [ebp - 0x34], 0x104
mov dword [ebp - 0x30], 0x104
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x30]
push ecx
push 0x104
lea ecx, [ebp - 0x2c]
call fcn.00403160
push eax
push 0
lea edx, [ebp - 0x34]
push edx
push 0x104
lea ecx, [ebp - 0x10]
call fcn.00403160
push eax
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x404e82
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2c]
call fcn.0041bb00
jmp 0x404f06
mov edx, dword [ebp - 0x20]
add edx, 1
mov dword [ebp - 0x20], edx
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.00403b30
push 0xffffffffffffffff
lea ecx, [ebp - 0x2c]
call fcn.00403b30
lea ecx, [ebp - 0x18]
call fcn.00403180
push eax
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x10]
call fcn.00404690
mov dword [ebp - 0x58], eax
mov ecx, dword [ebp - 0x58]
call fcn.00413dd0
push eax
lea ecx, [ebp - 0x18]
call fcn.004050b0
neg eax
sbb eax, eax
inc eax
mov byte [ebp - 0x39], al
lea ecx, [ebp - 0x40]
call fcn.0041bb00
movzx ecx, byte [ebp - 0x39]
test ecx, ecx
je 0x404ef5
mov dword [ebp - 0x1c], 1
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2c]
call fcn.0041bb00
jmp 0x404f06
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2c]
call fcn.0041bb00
jmp 0x404e0e
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x1c], 0
je 0x404f4e
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x10]
call fcn.00413dd0
push eax
mov ecx, dword [ebp - 0x4c]
call fcn.00404af0
mov dword [ebp - 0x44], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x10]
call fcn.0041bb00
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0041bb00
mov eax, dword [ebp - 0x44]
jmp 0x404f73
mov dword [ebp - 0x48], 0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x10]
call fcn.0041bb00
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0041bb00
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x404f90
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44ce54
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x10]
call fcn.00403100
mov dword [ebp - 4], 0
push str.SoftwareMicrosoftInternet_ExplorerMain
lea eax, [ebp - 0x10]
push eax
call fcn.00403a90
add esp, 8
lea ecx, [ebp - 0x14]
push ecx
push 2
push 0
lea ecx, [ebp - 0x10]
call fcn.00413dd0
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp dword [ebp - 0x14], 0
je 0x405043
mov edx, dword [ebp + 8]
push edx
call fcn.0042f0c0
add esp, 4
add eax, 1
push eax
mov eax, dword [ebp + 8]
push eax
push 1
push 0
push str.Start_Page
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x18], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0041bb00
mov eax, dword [ebp - 0x18]
jmp 0x40505c
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0041bb00
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x405ea0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
call fcn.00409e30
mov dword [ebp - 0x10], eax
push str.Image
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x405ed1
xor eax, eax
jmp 0x405f35
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00406c80
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0x14]
push eax
push 0
mov ecx, dword [ebp + 0xc]
call fcn.00406ce0
push eax
call fcn.0042f740
add esp, 0xc
mov ecx, dword [ebp - 8]
push ecx
call fcn.00406700
mov eax, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x40bac0
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x2c], ecx
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [ebp - 4], eax
mov byte [ebp - 9], 0x43
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov eax, dword [0x45113c]
mov dword [ebp - 8], eax
mov dword [ebp - 0x1c], 0
jmp 0x40bafe
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], 0x1a
jge 0x40bb73
mov edx, 1
mov ecx, dword [ebp - 0x1c]
shl edx, cl
and edx, dword [ebp - 4]
je 0x40bb71
mov eax, dword [ebp - 0x1c]
add eax, 0x41
mov byte [ebp - 8], al
lea ecx, [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jne 0x40bb71
mov dword [ebp - 0x28], 0
xor edx, edx
mov dword [ebp - 0x24], edx
lea eax, [ebp - 0x28]
push eax
push 0
push 0
lea ecx, [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
mov edx, dword [ebp - 0x24]
cmp edx, dword [ebp - 0x14]
jb 0x40bb71
ja 0x40bb5f
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x18]
jbe 0x40bb71
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x14], edx
mov al, byte [ebp - 8]
mov byte [ebp - 9], al
jmp 0x40baf5
mov al, byte [ebp - 9]
mov esp, ebp
pop ebp
ret

Function at 0x40bc20
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [0x4654b0]
mov dword [ebp - 4], eax
push edi
mov dword [ebp - 0xac], ecx
mov dword [ebp - 0xa8], 0x9c
mov ecx, 0x26
xor eax, eax
lea edi, [ebp - 0xa4]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xa8]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0xa4], 6
jb 0x40bc77
cmp dword [ebp - 0xa0], 1
jb 0x40bc77
mov eax, 1
jmp 0x40bc79
xor eax, eax
mov ecx, dword [ebp - 4]
call fcn.0042fef0
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x40e240
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
push 0
push 0
push 2
push 0
push 3
push 0x40000000
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x40e2ac
mov dword [ebp - 8], 0
mov ecx, dword [ebp + 8]
call fcn.00406ca0
test eax, eax
je 0x40e2a2
push 0
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00406ca0
push eax
push 0
mov ecx, dword [ebp + 8]
call fcn.00406ce0
push eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x4118f0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44daae
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov dword [eax], edx
mov eax, dword [ebp + 8]
add eax, 4
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.00403120
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
add ecx, 8
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 8
call fcn.00403120
mov byte [ebp - 4], 1
mov edx, dword [ebp + 8]
add edx, 0xc
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.00403120
mov byte [ebp - 4], 2
mov eax, dword [ebp + 8]
add eax, 0x10
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x10
call fcn.00403120
mov byte [ebp - 4], 3
mov ecx, dword [ebp + 8]
add ecx, 0x14
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call fcn.00403120
mov byte [ebp - 4], 4
mov edx, dword [ebp + 8]
add edx, 0x18
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.00403120
mov byte [ebp - 4], 5
mov eax, dword [ebp + 8]
add eax, 0x1c
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x1c
call fcn.00403120
mov byte [ebp - 4], 6
mov ecx, dword [ebp + 8]
add ecx, 0x20
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x20
call fcn.00403120
mov byte [ebp - 4], 7
mov edx, dword [ebp + 8]
add edx, 0x24
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
call fcn.00403120
mov byte [ebp - 4], 8
mov eax, dword [ebp + 8]
add eax, 0x28
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x28
call fcn.00403120
mov byte [ebp - 4], 9
mov ecx, dword [ebp + 8]
add ecx, 0x2c
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x2c
call fcn.00403120
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x30]
mov dword [edx + 0x30], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x34]
mov dword [edx + 0x34], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x416f10
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44e175
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x90
push edi
mov dword [ebp - 0x84], ecx
lea eax, [ebp - 0x74]
push eax
call fcn.0040cd00
mov ecx, eax
call fcn.004179a0
mov dword [ebp - 0x88], eax
mov ecx, dword [ebp - 0x88]
mov dword [ebp - 0x8c], ecx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x84]
add ecx, 0x1330
call fcn.00413dd0
push eax
lea edx, [ebp - 0x78]
push edx
call fcn.00418710
add esp, 8
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x94], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x8c]
push ecx
mov edx, dword [ebp - 0x94]
push edx
lea eax, [ebp - 0x70]
push eax
call fcn.004028f0
add esp, 0xc
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x78]
call fcn.0041bb00
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x74]
call fcn.0041bb00
push 0
call fcn.004256d0
add esp, 4
movzx ecx, al
test ecx, ecx
jne 0x416fd7
jmp 0x416ffd
mov edx, dword [ebp - 0x70]
push edx
push str.Call_LaunchGuaGua__s__n
push 0x414
push 0x452878
push 0
call fcn.004256f0
add esp, 0xc
push eax
call fcn.00425630
add esp, 0xc
mov dword [ebp - 0x6c], 0x44
mov ecx, 0x10
xor eax, eax
lea edi, [ebp - 0x68]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x70]
call fcn.00413dd0
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.0041a8c0
add esp, 8
mov dword [ebp - 0x98], eax
mov ecx, dword [ebp - 0x98]
mov dword [ebp - 0x9c], ecx
mov byte [ebp - 4], 5
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x6c]
push eax
mov ecx, dword [ebp - 0x9c]
call fcn.00413dd0
push eax
push 0
push 0
push 0
push 0
push 0
push 0x104
lea ecx, [ebp - 0x70]
call fcn.00403160
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x7c]
call fcn.0041bb00
cmp dword [ebp - 0x20], 0
je 0x417098
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call fcn.004256d0
add esp, 4
movzx eax, al
test eax, eax
jne 0x4170ab
jmp 0x4170d5
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x70]
push edx
push str.Exec__s___d__n
push 0x41e
push 0x4528a4
push 0
call fcn.004256f0
add esp, 0xc
push eax
call fcn.00425630
add esp, 0x10
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x80], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
call fcn.0041bb00
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4189e0
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44e314
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x18]
push ecx
call fcn.00418710
add esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 3
lea ecx, [ebp - 0x10]
call fcn.00403100
mov byte [ebp - 4], 1
cmp dword [ebp - 0x14], 0
jl 0x418a95
mov edx, dword [ebp - 0x14]
push edx
push 0x5c
lea ecx, [ebp - 0x18]
call fcn.004045e0
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jge 0x418a44
jmp 0x418a95
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x18]
call fcn.00404690
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x28], edx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x28]
push eax
lea ecx, [ebp - 0x10]
call fcn.00403140
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.0041bb00
push 0
lea ecx, [ebp - 0x10]
call fcn.00413dd0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
jmp 0x418a25
push 0x5c
lea ecx, [ebp - 0x18]
call fcn.004101e0
lea ecx, [ebp - 0x18]
call fcn.00413dd0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0041bb00
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0041bb00
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x418cb0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44e362
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
push edi
mov dword [ebp - 0x48], 0
mov ecx, 0xe
xor eax, eax
lea edi, [ebp - 0x44]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x48], 0x3c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x44], 0x440
lea edx, [ebp - 0x48]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
push 0
call fcn.004256d0
add esp, 4
movzx eax, al
test eax, eax
jne 0x418d20
jmp 0x418da8
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x4c]
call fcn.004052d0
mov dword [ebp - 0x54], eax
mov edx, dword [ebp - 0x54]
mov dword [ebp - 0x58], edx
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x50]
call fcn.004052d0
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp - 0x5c]
mov dword [ebp - 0x60], ecx
mov byte [ebp - 4], 1
xor edx, edx
cmp dword [ebp - 0x10], 0
setne dl
push edx
mov eax, dword [ebp - 0x58]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp - 0x60]
mov eax, dword [edx]
push eax
push str.ExecApp__s__s___d__n
push 0x85
push 0x45314c
push 0
call fcn.004256f0
add esp, 0xc
push eax
call fcn.00425630
add esp, 0x14
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x50]
call fcn.0041bb00
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.0041bb00
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x41a300
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
mov eax, 1
test eax, eax
je 0x41a34a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 8]
jae 0x41a33e
mov eax, dword [ebp - 0x10]
cmp dword [eax + 8], 0
je 0x41a340
jmp 0x41a34a
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x41a312
mov esp, ebp
pop ebp
ret 4

Function at 0x41a4c0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x4654b0]
mov dword [ebp - 4], eax
push edi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0
jne 0x41a4ef
jmp 0x41a5af
mov dword [ebp - 0x130], 0x128
mov ecx, 0x49
xor eax, eax
lea edi, [ebp - 0x12c]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x138]
call fcn.004052d0
lea ecx, [ebp - 0x130]
push ecx
mov edx, dword [ebp - 0x134]
push edx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x41a597
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x138]
call fcn.004050b0
test eax, eax
jne 0x41a580
mov ecx, dword [ebp - 0x128]
push ecx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0
je 0x41a580
push 0xffffffffffffffff
mov edx, dword [ebp - 0x13c]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 0x13c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x130]
push ecx
mov edx, dword [ebp - 0x134]
push edx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x41a52e
mov eax, dword [ebp - 0x134]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x138]
call fcn.0041bb00
mov ecx, dword [ebp - 4]
call fcn.0042fef0
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x41a5c0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
mov eax, dword [0x4654b0]
mov dword [ebp - 4], eax
push edi
mov dword [ebp - 0x138], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0
jne 0x41a5fb
xor eax, eax
jmp 0x41a69d
mov dword [ebp - 0x130], 0x128
mov ecx, 0x49
xor eax, eax
lea edi, [ebp - 0x12c]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x13c]
call fcn.004052d0
lea ecx, [ebp - 0x130]
push ecx
mov edx, dword [ebp - 0x134]
push edx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x41a673
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x13c]
call fcn.004050b0
test eax, eax
jne 0x41a65c
mov dword [ebp - 0x138], 1
jmp 0x41a673
lea ecx, [ebp - 0x130]
push ecx
mov edx, dword [ebp - 0x134]
push edx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x41a63a
mov eax, dword [ebp - 0x134]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x138]
mov dword [ebp - 0x140], ecx
lea ecx, [ebp - 0x13c]
call fcn.0041bb00
mov eax, dword [ebp - 0x140]
mov ecx, dword [ebp - 4]
call fcn.0042fef0
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x41b560
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 0x2c], 0
je 0x41b574
jmp 0x41b598
mov dword [ebp - 4], 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x41b598
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [eax + 0xc], ecx
mov esp, ebp
pop ebp
ret 4