joyce8/EMBER2024-capa huggingface dataset:
Function at 0x457e80
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x10], 0
je 0x457ea2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0xf
jb 0x457e90
mov byte [esi + 0x10], 0
pop esi
ret

Function at 0x457eb0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xa], 0
je 0x457ed2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 9
jb 0x457ec0
mov byte [esi + 0xa], 0
pop esi
ret

Function at 0x457ee0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xc], 0
je 0x457f02
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0xb
jb 0x457ef0
mov byte [esi + 0xc], 0
pop esi
ret

Function at 0x457f10
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xb], 0
je 0x457f32
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0xa
jb 0x457f20
mov byte [esi + 0xb], 0
pop esi
ret

Function at 0x474330
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004741a6

Function at 0x42e003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x585861c0
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x42e04e
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x49977f91
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x42e084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x401ec8
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x405b08
jmp fcn.00401631

Function at 0x401f0e
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x405b08
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x401f2b
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x401f30
push 1
pop eax
pop esi
ret
call fcn.00401ec8
pop esi
ret

Function at 0x401020
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x40104e
mov al, byte [esi + 1]
inc esi
test al, al
je 0x401046
cmp al, 0x22
je 0x401046
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x40103a
cmp byte [esi], 0x22
jne 0x40105a
inc esi
jmp 0x40105a
cmp al, 0x20
jbe 0x40105a
mov al, byte [esi + 1]
inc esi
cmp al, 0x20
ja 0x401052
mov al, byte [esi]
test al, al
je 0x40106c
cmp al, 0x20
ja 0x40106c
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x401060
lea eax, [esp + 4]
mov dword [esp + 0x30], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [esp + 0x30], 1
je 0x401091
mov eax, dword [esp + 0x34]
and eax, 0xffff
jmp 0x401096
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x409978
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409a4b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409a64
push ebx
push 0x409a70
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.00403388
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00402750
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004033e8
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x4099f8
mov al, 0x69
call fcn.0040961c
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.0040994c
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409a01
call fcn.0040994c
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409a52
lea eax, [ebp - 4]
call fcn.0040316c
ret

Function at 0x409b04
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409bb8
jmp 0x409bad
cmp dword [esi + 0x10], 0x1000
jne 0x409b99
test byte [esi + 0x15], 1
jne 0x409b99
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409b58
cmp eax, 2
je 0x409b58
cmp eax, 0x10
je 0x409b58
cmp eax, 0x20
jne 0x409b6d
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409b6d
mov bl, 1
xor ebp, ebp
jmp 0x409b7e
mov eax, dword [esi]
add eax, ebp
call fcn.00409afc
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409b71
test bl, bl
je 0x409b99
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409bb8
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409b30
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40893f
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x4085d8
call fcn.00408960
push ebx
pop ecx
sub ebx, ecx
xor dword [edi], esi
sub ecx, 1
inc edi
add ecx, ebx
sub ecx, ebx
cmp edi, eax
jne fcn.0040893f
dec ebx
ret
Function at 0x401000
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x60
push 0x11548b4
call fcn.0040121c
mov edi, 0x94
mov eax, edi
call fcn.004011dc
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x11548b4], ecx
mov eax, dword [esi + 4]
mov dword [0x11548b8], eax
mov edx, dword [esi + 8]
mov dword [0x11548bc], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x11548c0], esi
cmp ecx, 2
je 0x401060
or esi, 0x8000
mov dword [0x11548c4], esi
shl eax, 8
add eax, edx
mov dword [0x11548b4], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x40109b
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40109b
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x4010b3
cmp eax, 0x20b
je 0x4010a0
mov dword [ebp - 0x1c], esi
jmp 0x4010c7
cmp dword [ecx + 0x84], 0xe
jbe 0x40109b
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x4010c1
cmp dword [ecx + 0x74], 0xe
jbe 0x40109b
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push esi
call fcn.00401224
pop ecx
test eax, eax
jne 0x4010f3
cmp dword [0x11548b4], 1
jne 0x4010e0
call fcn.00401224
push 0x1c
call fcn.00401224
push 0xff
call fcn.00401224
pop ecx
pop ecx
call fcn.00401224
mov dword [ebp - 4], esi
call fcn.00401224
test eax, eax
jge 0x40110c
push 0x1b
call fcn.00401224
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x11548b4], eax
call fcn.00401224
mov dword [0x11548b8], eax
call fcn.00401224
test eax, eax
jge 0x401132
push 8
call fcn.00401224
pop ecx
call fcn.00401224
test eax, eax
jge 0x401143
push 9
call fcn.00401224
pop ecx
push 1
call fcn.00401224
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x401159
push eax
call fcn.00401224
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00401224
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x40117a
movzx eax, word [ebp - 0x40]
jmp 0x40117d
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.00401228
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x40119b
push edi
call fcn.00401220
call fcn.00401224
jmp 0x4011cd
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.00401224
ret

Function at 0x401228
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push esi
push edi
push ebx
lea eax, [ebp - 4]
push eax
push 0x40
push 0x18a000
push section..rdata
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x401252
push 0xfcb37c
jmp 0x40125e
pop ebx
pop edi
pop esi
leave
ret 0x14
ret
Function at 0x407ece
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x407f97
lea eax, [ebp + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x407f65
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x407f54
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
movzx eax, word [eax]
sar eax, 0xc
mov ecx, dword [ebp - 0x2c]
mov dword [ecx], eax
jmp 0x407f63
push 0
push 0x1df2
push 0
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
jmp 0x407f95
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
push dword [ebp - 0x38]
push 0
push 0x4c6d
push 0x2fa8
push 0x130e
push dword [ebp - 0x3c]
push 0x4bb1
call fcn.00412b2b
add esp, 0x1c
jmp 0x407fc4
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x40], eax
push 0x7ed3
push 0x7a5b
push 0
push 1
push dword [ebp - 0x40]
push dword [ebp - 0x44]
push 0x2841
call fcn.0040de81
add esp, 0x1c
mov esp, ebp
pop ebp
ret
Function at 0x40c94d
Capabilities:
Connect pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
movzx eax, byte [ebp + 0x24]
test eax, eax
je 0x40ca98
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0x34]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x40c9ee
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x40c9df
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x40c9dd
push 0
push 0x4d5
push 0x2142
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
jmp 0x40c9e9
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
jmp 0x40ca96
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x40ca4b
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x58]
mov dword [eax], 1
jmp 0x40ca96
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x40ca79
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x40ca96
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x6c]
call fcn.00426311
mov dword [eax], 0xa439beb0
jmp 0x40ca6e
jmp 0x40cabd
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x74], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 0x70], eax
push 1
mov eax, dword [ebp - 0x70]
push dword [eax]
push 0x4d2e
push 0
push dword [ebp - 0x74]
call fcn.0040ff04
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x414007
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x4140cb
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x41405b
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
push 0
push 0x3eb8
push dword [ebp - 0x14]
call fcn.0041a97c
add esp, 0xc
jmp 0x4140c9
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x4140a5
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x4140a3
push 0
push 0
push 0x788
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x4140c9
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
push 0
mov ecx, dword [ebp - 0x3c]
call fcn.00426311
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x414140
lea eax, [ebp + 0xc]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x48], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x41410b
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x50], eax
push 1
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
call fcn.0040f6c5
add esp, 0xc
jmp 0x414140
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
movzx eax, byte [eax]
test eax, eax
je 0x414133
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x414131
push 0
push 0
call dword [sym.imp.GDI32.dll_GetRgnBox]
jmp 0x414140
push 0xcd4
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov esp, ebp
pop ebp
ret
Function at 0x4171ba
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
movzx eax, byte [ebp + 0x30]
test eax, eax
je 0x417302
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x417266
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x41722e
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x41722c
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
jmp 0x417261
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x417261
push 0
push 1
push 0x4c2e
push 0x1ca9
push 0x40b1
push 0
push 0x1367
push 0x3283
call fcn.00417b77
add esp, 0x20
jmp 0x417300
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x4172cf
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x4172b0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 1
jge 0x4172cd
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x48]
call fcn.00426311
mov dword [eax], 0x31ac6914
jmp 0x4172a5
jmp 0x417300
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x417300
push 0x1903
push 0
push 0xec9
push 0x4711
push 0x7d4a
push 0x3420
push 0
call fcn.0041e38c
add esp, 0x1c
jmp 0x417342
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x5c], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
movzx eax, byte [eax]
push eax
push dword [ebp - 0x50]
push 1
push dword [ebp - 0x54]
push dword [ebp - 0x58]
push 0x1ae9
push dword [ebp - 0x5c]
call fcn.004102b0
add esp, 0x1c
mov esp, ebp
pop ebp
ret
Function at 0x41a435
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x41a51a
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x41a507
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x41a4ae
push 0xc12
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
push 1
push 0
push 1
push dword [ebp - 0x40]
push 1
mov eax, dword [ebp - 0x44]
push dword [eax]
mov eax, dword [ebp - 0x48]
push dword [eax]
push 0x6620
mov eax, dword [ebp - 0x4c]
push dword [eax]
call fcn.00413185
add esp, 0x24
jmp 0x41a518
push 0
push 1
push 0x16bc
call fcn.0040cbc7
add esp, 0xc
jmp 0x41a565
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x54], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
movzx eax, byte [eax]
test eax, eax
je 0x41a54f
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
push 0
push 0x2870
push 0x17a
push dword [ebp - 0x58]
call fcn.00417aa8
add esp, 0x10
jmp 0x41a565
push 1
push 0x20d6
push 0
push 0x499
call fcn.00407e4e
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x41b540
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movzx eax, byte [ebp + 0x28]
test eax, eax
je 0x41b5a0
lea eax, [ebp + 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
push dword [ebp - 4]
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
push eax
push 1
push 0x2400
push dword [ebp - 0xc]
push 1
push 0x6455
push 0x51b4
push 0x7557
push 0x253d
push dword [ebp - 0x10]
call fcn.0041b677
add esp, 0x2c
jmp 0x41b673
lea eax, [ebp + 0x24]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x40], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x41b643
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x41b604
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x41b602
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x41b641
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x41b641
push 1
push 0x41f7
push 0x2e2
push 0x6a61
push 1
push 0x5b75
push 1
push 0x2ee2
call fcn.00411557
add esp, 0x20
jmp 0x41b673
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
push 1
push 0xfbf
push 0xc06
push dword [ebp - 0x44]
push 0x1e46
push 0x7bb1
push 1
push 1
push 0xf5
call fcn.00418f39
add esp, 0x24
mov esp, ebp
pop ebp
ret