joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100ae570
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f07f8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x1013d0b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push 8
mov dword [ebx + 0x30], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0x201
mov dword [ebx + 0x18], 6
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x28], 0
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0xc], 0
call fcn.10005973
mov esi, eax
add esp, 4
test esi, esi
je 0x100ae60d
push 1
mov dword [ebp - 4], 0
call fcn.100bf564
add esp, 4
mov dword [esi + 4], eax
jmp 0x100ae60f
xor esi, esi
mov eax, dword [ebp + 8]
mov dword [ebx + 0x30], esi
mov dword [ebx + 0x38], eax
mov dword [ebx + 0x3c], 0
mov edi, dword [esi + 4]
mov dword [ebp - 4], 1
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], edi
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x100f4524]
mov ecx, edi
call esi
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 2
push eax
call fcn.100aa060
mov edi, eax
add esp, 4
mov ecx, dword [edi]
push 0x20
mov esi, dword [ecx + 0x30]
mov ecx, esi
call dword [0x100f4524]
mov ecx, edi
call esi
mov byte [ebp - 0xd], al
mov edi, dword [ebp - 0x14]
mov dword [ebp - 4], 3
test edi, edi
je 0x100ae6a5
mov edx, dword [edi]
mov esi, dword [edx + 8]
mov ecx, esi
call dword [0x100f4524]
mov ecx, edi
call esi
mov edi, eax
test edi, edi
je 0x100ae6a2
mov ecx, dword [edi]
push 1
mov esi, dword [ecx]
mov ecx, esi
call dword [0x100f4524]
mov ecx, edi
call esi
mov al, byte [ebp - 0xd]
cmp dword [ebx + 0x38], 0
mov dword [ebp - 4], 0xffffffff
mov byte [ebx + 0x40], al
jne 0x100ae6c5
mov eax, dword [ebx + 0xc]
mov ecx, ebx
push 0
or eax, 4
push eax
call fcn.10082620
cmp byte [ebp + 0xc], 0
je 0x100ae6d4
push ebx
call fcn.100bf974
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100af6c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x1013d0b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, ecx
cmp ebx, 0xffffffff
jne 0x100af6f0
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100055f3
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi + 0x20]
push esi
mov ecx, dword [eax]
test ecx, ecx
je 0x100af72c
mov edx, dword [edi + 0x30]
mov esi, dword [edx]
lea eax, [esi + ecx]
cmp ecx, eax
jae 0x100af72c
lea ecx, [esi - 1]
mov dword [edx], ecx
mov edx, dword [edi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop esi
pop edi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100055f3
mov esp, ebp
pop ebp
ret 4
cmp dword [edi + 0x4c], 0
je 0x100af829
mov esi, dword [edi + 0xc]
lea eax, [edi + 0x3c]
cmp dword [esi], eax
jne 0x100af754
mov edx, dword [edi + 0x54]
mov ecx, dword [edi + 0x50]
sub edx, ecx
mov dword [esi], ecx
mov eax, dword [edi + 0x1c]
mov dword [eax], ecx
mov eax, dword [edi + 0x2c]
mov dword [eax], edx
mov eax, dword [edi + 0x38]
mov dword [ebp - 0x30], eax
test eax, eax
jne 0x100af792
push dword [edi + 0x4c]
lea eax, [ebp - 0x28]
mov byte [ebp - 0x28], bl
push 1
push 1
push eax
call fcn.100c828a
add esp, 0x10
or ecx, 0xffffffff
cmp eax, 1
cmove ecx, ebx
pop esi
pop edi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100055f3
mov esp, ebp
pop ebp
ret 4
mov byte [ebp - 0x2c], bl
mov eax, dword [eax]
mov esi, dword [eax + 0x1c]
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 4]
mov ecx, esi
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x2b]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [edi + 0x40]
push eax
call dword [0x100f4524]
mov ecx, dword [ebp - 0x30]
call esi
test eax, eax
js 0x100af829
cmp eax, 1
jle 0x100af7fc
cmp eax, 3
jne 0x100af829
push dword [edi + 0x4c]
push dword [ebp - 0x2c]
call fcn.100a8d60
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop esi
pop edi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100055f3
mov esp, ebp
pop ebp
ret 4
mov esi, dword [ebp - 0x34]
lea eax, [ebp - 0x24]
sub esi, eax
je 0x100af819
push dword [edi + 0x4c]
push esi
push 1
push eax
call fcn.100c828a
add esp, 0x10
cmp esi, eax
jne 0x100af829
lea eax, [ebp - 0x2c]
mov byte [edi + 0x3d], 1
cmp dword [ebp - 0x38], eax
jne 0x100af717
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop esi
pop edi
xor ecx, ebp
pop ebx
call fcn.100055f3
mov esp, ebp
pop ebp
ret 4
Function at 0x100b09d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
je 0x100b0ab1
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
test esi, esi
jl 0x100b0aa0
jg 0x100b0a08
test edx, edx
je 0x100b0aa0
call fcn.10082450
mov esi, eax
mov eax, edx
mov dword [ebp - 0xc], eax
test eax, eax
jl 0x100b0a56
jg 0x100b0a1e
test esi, esi
je 0x100b0a56
cmp ebx, eax
jg 0x100b0a2d
jl 0x100b0a28
cmp edi, esi
jae 0x100b0a2d
mov esi, edi
mov dword [ebp - 0xc], ebx
mov eax, dword [ebp - 8]
push esi
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x20]
push dword [eax]
call fcn.10006ac0
mov ecx, dword [ebp - 4]
add esp, 0xc
sub edi, esi
sbb ebx, dword [ebp - 0xc]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x100b0a85
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
mov ecx, esi
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
push eax
call dword [0x100f4524]
mov ecx, dword [ebp - 4]
call esi
cmp eax, 0xffffffff
je 0x100b0a9a
mov ecx, dword [ebp - 4]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [ebp - 8], esi
test ebx, ebx
jg 0x100b0a08
jl 0x100b0a9a
test edi, edi
jne 0x100b0a08
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
pop edi
sbb esi, ebx
mov eax, edx
mov edx, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x10], esi
mov eax, dword [eax]
mov dword [ebp - 0x14], edi
mov dword [ebp - 8], eax
test eax, eax
je 0x100b0ad0
mov eax, dword [ecx + 0x30]
mov eax, dword [eax]
jmp 0x100b0ad2
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [ebp - 0xc], eax
test edi, edi
jl 0x100b0b4b
jg 0x100b0ae4
test esi, esi
je 0x100b0b4b
test eax, eax
jl 0x100b0b25
jg 0x100b0aee
test ebx, ebx
je 0x100b0b25
cmp edi, eax
jg 0x100b0afd
jl 0x100b0af8
cmp esi, ebx
jae 0x100b0afd
mov ebx, esi
mov dword [ebp - 0xc], edi
push ebx
push dword [ebp + 8]
push dword [ebp - 8]
call fcn.10006ac0
mov ecx, dword [ebp - 4]
add esp, 0xc
mov edx, dword [ebp + 8]
add edx, ebx
sub esi, ebx
mov eax, dword [ecx + 0x30]
sbb edi, dword [ebp - 0xc]
sub dword [eax], ebx
mov eax, dword [ecx + 0x20]
add dword [eax], ebx
jmp 0x100b0b28
mov edx, dword [ebp + 8]
test edi, edi
jl 0x100b0b4b
jg 0x100b0b32
test esi, esi
je 0x100b0b4b
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x100b0b4b
push eax
push esi
push 1
push edx
call fcn.100c828a
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100b0cd0
Capabilities:
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f09b8
mov eax, dword fs:[0]
push eax
sub esp, 0x68
push esi
push edi
mov eax, dword [0x1013d0b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x1c]
xorps xmm0, xmm0
movlpd qword [ebp - 0x24], xmm0
mov esi, dword [eax + 4]
mov edi, dword [eax]
sub esi, edi
call fcn.100b4260
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 0
push eax
push 1
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], esi
push eax
mov dword [ebp - 0x20], edi
call sub.CRYPT32.dll_CryptUnprotectData
test eax, eax
jne 0x100b0d52
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
push str.msadal::WindowsCryptoUtils::Decrypt
cmp eax, 0xd
jne 0x100b0ddd
jmp 0x100b0d98
mov esi, dword [ebp + 8]
push dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
add ecx, edx
mov dword [esi], 0
push ecx
push edx
mov ecx, esi
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.100b0c40
lea ecx, [ebp - 0x1c]
call fcn.100b4270
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x88
push str.e:_agent01_work18_s_srccpp_srclibwindowswindowscryptoutils.cpp
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x10], 0xd
call fcn.100a6110
sub esp, 8
mov esi, eax
lea eax, [ebp - 0x10]
mov ecx, esp
push eax
call fcn.1009fbe0
push 0xcaa40007
push esi
lea ecx, [ebp - 0x58]
call fcn.100b42a0
push 0x10138440
lea eax, [ebp - 0x58]
push eax
call fcn.10006a50
push 0x8a
push str.e:_agent01_work18_s_srccpp_srclibwindowswindowscryptoutils.cpp
lea ecx, [ebp - 0x3c]
call fcn.100a6110
sub esp, 8
mov esi, eax
lea eax, [ebp - 0x10]
mov ecx, esp
push eax
call fcn.1009fbe0
push 0xcaa40009
push esi
lea ecx, [ebp - 0x74]
call fcn.100b42a0
push 0x10138440
lea eax, [ebp - 0x74]
push eax
call fcn.10006a50
int3
Function at 0x100b0e20
Capabilities:
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f09e8
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push esi
mov eax, dword [0x1013d0b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xorps xmm0, xmm0
lea ecx, [ebp - 0x1c]
movlpd qword [ebp - 0x24], xmm0
call fcn.100b4260
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x1c]
push eax
push 1
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 0
push eax
call sub.CRYPT32.dll_CryptProtectData
test eax, eax
je 0x100b0ec9
mov esi, dword [ebp + 8]
push dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
add ecx, edx
mov dword [esi], 0
push ecx
push edx
mov ecx, esi
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.100b0c40
lea ecx, [ebp - 0x1c]
call fcn.100b4270
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.msadal::WindowsCryptoUtils::Encrypt
push 0x75
push str.e:_agent01_work18_s_srccpp_srclibwindowswindowscryptoutils.cpp
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x10], eax
call fcn.100a6110
sub esp, 8
mov esi, eax
lea eax, [ebp - 0x10]
mov ecx, esp
push eax
call fcn.1009fbe0
push 0xcaa40008
push esi
lea ecx, [ebp - 0x4c]
call fcn.100b42a0
push 0x10138440
lea eax, [ebp - 0x4c]
push eax
call fcn.10006a50
int3
Function at 0x100ba060
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.100ba070

Function at 0x100ba2f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x100ba2fc
pop ebp
ret
mov dword [ebp + 0xc], eax
pop ebp
jmp fcn.100ba310
Function at 0x100c94fb
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100c9371

Function at 0x100cc6b1
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x6ac130
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1c8000]
push edi
or ebp, 0xffffffff
jmp 0x6ac152
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x6ac159
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6ac148
mov eax, 1
add ebx, ebx
jne 0x6ac16b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x6ac17c
jne 0x6ac19b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6ac19b
dec eax
add ebx, ebx
jne 0x6ac188
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x6ac160
add ebx, ebx
jne 0x6ac197
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x6ac1ed
xor ecx, ecx
sub eax, 3
jb 0x6ac1b3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x6ac222
sar eax, 1
mov ebp, eax
jmp 0x6ac1be
add ebx, ebx
jne 0x6ac1be
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6ac18c
inc ecx
add ebx, ebx
jne 0x6ac1cc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6ac18c
add ebx, ebx
jne 0x6ac1d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x6ac1ce
jne 0x6ac1ea
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x6ac1ce
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x6ac20c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x6ac1fe
jmp 0x6ac14e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x6ac20c
add edi, ecx
jmp 0x6ac14e
pop esi
mov edi, esi
mov ecx, 0x389d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x6ac22a
cmp byte [edi], 0x12
jne 0x6ac22a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x6ac22f
lea edi, [esi + 0x2a9000]
mov eax, dword [edi]
or eax, eax
je 0x6ac2a7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2c5cc4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2c5d88]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x6ac25c
mov ecx, edi
jns 0x6ac28b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2c5d90]
or eax, eax
je 0x6ac2a1
mov dword [ebx], eax
add ebx, 4
jmp 0x6ac279
call dword [esi + 0x2c5d8c]
mov ebp, dword [esi + 0x2c5d94]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x6ac2db
sub esp, 0xffffff80
jmp 0x4715ce
Function at 0x401530
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x401549
jmp 0x401550
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x4021f0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
mov eax, dword [0x4165e0]
xor eax, ebp
mov dword [ebp - 0xc], eax
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x40221b
xor ecx, ecx
mov word [ebp - 8], cx
jmp 0x40223e
push 0
call fcn.004021d0
add esp, 4
cmp eax, 3
jne 0x402235
mov edx, 1
mov word [ebp - 8], dx
jmp 0x40223e
mov eax, 2
mov word [ebp - 8], ax
movzx ecx, word [ebp - 8]
mov dword [ebp - 0x814], ecx
cmp dword [ebp - 0x814], 0
je 0x402265
cmp dword [ebp - 0x814], 2
je 0x40225c
jmp 0x402271
movsx eax, word [ebp - 8]
jmp 0x402300
mov dword [ebp - 4], 0
jmp 0x4022fd
push 0x400
lea edx, [ebp - 0x810]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00401da0
add esp, 0xc
lea ecx, [ebp - 0x810]
push ecx
call fcn.00401a40
add esp, 4
lea edx, [ebp - 0x810]
push edx
call fcn.004072d4
add esp, 4
cmp eax, 3
jbe 0x4022f6
lea eax, [ebp - 0x810]
push eax
call fcn.004021f0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x818], ecx
cmp dword [ebp - 0x818], 0
je 0x4022d4
jmp 0x4022f4
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4022ed
mov dword [ebp - 4], 0
jmp 0x4022f4
mov dword [ebp - 4], 3
jmp 0x4022fd
mov dword [ebp - 4], 2
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0040716f
mov esp, ebp
pop ebp
ret

Function at 0x402310
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esp, ebp
pop ebp
ret

Function at 0x4023b0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0xffffffff
push 0x1e
push 0
lea eax, [ebp - 0x24]
push eax
call fcn.00407180
add esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], 1
mov edx, 0x210
mov word [ebp - 0x14], dx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x18], ecx
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
jne 0x40240a
cmp dword [ebp - 0x12], 0
jne 0x40240a
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x402420
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x4165e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4024b2
push 0x20c
push 0
lea ecx, [ebp - 0x218]
push ecx
call fcn.00407180
add esp, 0xc
push 0x104
lea edx, [ebp - 0x218]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00401da0
add esp, 0xc
push 0x1e
push 0
lea ecx, [ebp - 0x238]
push ecx
call fcn.00407180
add esp, 0xc
mov dword [ebp - 0x234], 3
lea edx, [ebp - 0x218]
mov dword [ebp - 0x230], edx
mov eax, 0x10
mov word [ebp - 0x228], ax
lea ecx, [ebp - 0x238]
push ecx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040716f
mov esp, ebp
pop ebp
ret
Function at 0x4024c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1028
call fcn.00408f70
mov eax, dword [0x4165e0]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0x15f8f
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
jae 0x4024f1
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x1028], ecx
jmp 0x4024fa
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x1028], edx
mov eax, dword [ebp - 0x1028]
mov dword [ebp - 0xc], eax
push 0
push 0
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x1020], 0x78ef8fef
push 0x1000
push 0
lea eax, [ebp - 0x1018]
push eax
call fcn.00407180
add esp, 0xc
mov ecx, dword [ebp + 0xc]
sub ecx, 4
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
je 0x402644
mov dword [ebp - 0x101c], 0xffc
mov edx, dword [ebp - 0x101c]
cmp edx, dword [ebp - 4]
jbe 0x402566
mov eax, dword [ebp - 4]
mov dword [ebp - 0x101c], eax
push 0
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x101c]
push edx
lea eax, [ebp - 0x1014]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x402593
mov edx, dword [ebp - 0x101c]
cmp edx, dword [ebp - 0x10]
je 0x402598
jmp 0x402644
mov eax, dword [ebp - 0x10]
sub eax, 4
mov dword [ebp - 0x101c], eax
mov dword [ebp - 8], 0
jmp 0x4025b6
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 0x101c]
jae 0x402611
mov eax, dword [ebp - 8]
movsx ecx, byte [ebp + eax - 0x1018]
movsx edx, byte [ebp - 0x1020]
cmp ecx, edx
jne 0x40260f
mov eax, dword [ebp - 8]
lea ecx, [ebp + eax - 0x1018]
mov dword [ebp - 0x1024], ecx
push 4
lea edx, [ebp - 0x1020]
push edx
mov eax, dword [ebp - 8]
lea ecx, [ebp + eax - 0x1018]
push ecx
call fcn.004078e5
add esp, 0xc
test eax, eax
jne 0x40260f
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
jmp 0x402646
jmp 0x4025ad
push 4
mov edx, dword [ebp - 0x10]
lea eax, [ebp + edx - 0x1018]
push eax
lea ecx, [ebp - 0x1018]
push ecx
call fcn.00407580
add esp, 0xc
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0x10]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
jmp 0x40253e
xor eax, eax
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040716f
mov esp, ebp
pop ebp
ret
Function at 0x403550
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x414540
push 0x408fa0
mov eax, dword fs:[0]
push eax
add esp, 0xfffff7e4
mov eax, dword [0x4165e0]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x28], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
lea eax, [ebp - 0x20]
push eax
push 0x412ae8
push 1
push 0
push 0x412af8
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jl 0x403656
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [eax + 0x50]
call edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [edx + 0x24]
call ecx
push 5
mov edx, dword [ebp - 0x20]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [eax + 0x3c]
call edx
lea eax, [ebp - 0x24]
push eax
push 0x412ad8
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [edx]
call ecx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jl 0x403648
push 0x400
lea edx, [ebp - 0x828]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004018a0
add esp, 0xc
push 1
lea ecx, [ebp - 0x828]
push ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [eax + 0x18]
call edx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ecx + 8]
call eax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [edx + 8]
call ecx
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x82c], edx
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x82c]
jmp 0x403689
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x28]
xor ecx, ebp
call fcn.0040716f
mov esp, ebp
pop ebp
ret
Function at 0x404f60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
xor eax, eax
mov ecx, dword [ebp + 8]
mov word [ecx], ax
lea edx, [ebp - 8]
push edx
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x404fba
lea eax, [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
push str.ProgramFilesDir
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret