joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40cab4
Capabilities:
Set file attributes

Disassembly:
pushal
mov ebx, edx
lea edx, [ebx]
xor ecx, ecx
call fcn.0040ce88
push dword [ebx + 8]
push dword [esp + 0x20]
call sub.kernel32.dll_SetFileAttributesA
popal
ret

Function at 0x40cd68
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, eax
xor ebx, ebx
test esi, esi
je 0x40cdc5
mov eax, esi
call fcn.00403464
push eax
call sub.kernel32.dll_GetFileAttributesA
mov edi, eax
cmp edi, 0xffffffff
je 0x40cdc5
test edi, 0x10
jne 0x40cdc5
push 0x80
mov eax, esi
call fcn.00403464
mov ebp, eax
push ebp
call sub.kernel32.dll_SetFileAttributesA
neg eax
sbb ebx, ebx
neg ebx
test bl, bl
je 0x40cdc5
push ebp
call sub.kernel32.dll_DeleteFileA
neg eax
sbb ebx, ebx
neg ebx
test bl, bl
jne 0x40cdc5
push edi
push ebp
call sub.kernel32.dll_SetFileAttributesA
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40d2c4
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
pushal
mov byte [ebp - 1], 0x5c
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], edx
and ecx, 0xffffff
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x18], ecx
xor edx, edx
mov dword [ecx], edx
dec edx
mov dword [ecx + 4], edx
lea edx, [ecx + 8]
mov dword [ebp - 0x1c], edx
lea edx, [ecx + 0xc]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x1c]
call fcn.0040cf7c
mov eax, dword [ebp - 0x20]
call fcn.0040cf7c
mov eax, dword [ebp - 8]
test eax, eax
je 0x40d497
call fcn.0040cfcc
test eax, eax
je 0x40d37c
or dword [ebp - 0x14], 0x20000000
cmp byte [eax], 0
je 0x40d332
or dword [ebp - 0x14], 0x10000000
mov dword [ebp - 0xc], eax
sub eax, dword [ebp - 8]
mov edx, eax
mov ebx, eax
mov eax, dword [ebp - 0x20]
test edx, edx
jle 0x40d354
test dword [ebp - 0x14], 0x100
je 0x40d354
or dword [ebp - 0x14], 0x4000000
inc edx
call fcn.0040cf50
je 0x40d37c
mov esi, dword [ebp - 8]
mov ecx, ebx
rep movsb byte es:[edi], byte [esi]
test dword [ebp - 0x14], 0x4000000
je 0x40d36f
mov al, byte [ebp - 1]
stosb byte es:[edi], al
test dword [ebp - 0x14], 0x10000000
je 0x40d497
mov esi, dword [ebp - 0xc]
test dword [ebp - 0x14], 0x80
jne 0x40d397
mov eax, esi
call fcn.0040d130
test al, al
je 0x40d497
mov al, byte [esi]
call fcn.0040cf30
jne 0x40d3aa
or dword [ebp - 0x14], 0x80000000
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov esi, eax
sub eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
call fcn.0040d15c
test al, al
je 0x40d3c5
or dword [ebp - 0x14], 0x8000000
test dword [ebp - 0x14], 0x20
je 0x40d3db
test dword [ebp - 0x14], 0x8000000
jne 0x40d3db
dec ebx
jge 0x40d3db
inc ebx
mov ecx, dword [ebp - 0x18]
mov dword [ecx], ebx
mov dword [ebp - 0x28], ebx
mov edx, dword [ebp - 0x10]
cmp edx, 0x7fffffff
jne 0x40d3f0
mov edx, ebx
test edx, edx
jge 0x40d3f8
add ebx, edx
mov edx, ebx
mov dword [ebp - 0x2c], edx
test edx, edx
jl 0x40d497
jg 0x40d41a
test dword [ebp - 0x14], 0x40
jne 0x40d497
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0x24]
jmp 0x40d432
cmp edx, dword [ebp - 0x28]
jg 0x40d497
mov dword [ecx + 4], edx
mov esi, dword [ebp - 0xc]
call fcn.0040cf3c
dec edx
jg 0x40d425
mov edx, esi
sub edx, dword [ebp - 8]
mov ebx, edx
mov esi, dword [ebp - 8]
test dword [ebp - 0x14], 0x20000000
jne 0x40d468
test dword [ebp - 0x14], 0x80000000
jne 0x40d45c
test dword [ebp - 0x14], 0x10
je 0x40d468
inc edx
or dword [ebp - 0x14], 0x40000000
jmp 0x40d468
test dword [ebp - 0x14], 8
je 0x40d468
dec edx
inc esi
dec ebx
mov eax, dword [ebp - 0x1c]
call fcn.0040cf50
je 0x40d497
test dword [ebp - 0x14], 0x40000000
je 0x40d47f
mov al, byte [ebp - 1]
stosb byte es:[edi], al
mov ecx, ebx
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x2c], 0
je 0x40d497
mov edx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x1c]
mov ah, byte [ebp - 1]
call fcn.0040d180
popal
mov esp, ebp
pop ebp
ret 4
Function at 0x40d6e8
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40d742
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetCommandLineW
lea edx, [ebp - 8]
call fcn.0040a988
mov eax, dword [ebp - 8]
lea ecx, [ebp - 4]
mov edx, esi
call fcn.0040d750
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0040309c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d749
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040306c
ret

Function at 0x40d8ec
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
lea eax, [ebp - 0x18]
mov edx, dword [0x40c59c]
call fcn.00403570
xor eax, eax
push ebp
push 0x40d9b0
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 1
lea eax, [ebp - 0x18]
push eax
mov ecx, 2
mov edx, esi
mov eax, edi
call fcn.0040d2c4
cmp dword [ebp - 0xc], 0
setne bl
jmp 0x40d98a
mov edx, 0x10
mov eax, dword [ebp - 0x10]
call fcn.0040d6ac
test al, al
jne 0x40d977
cmp dword [ebp - 4], 0
je 0x40d95d
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call dword [ebp - 4]
test al, al
je 0x40d971
push 0
mov eax, dword [ebp - 0x10]
call fcn.00403464
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x40d975
xor ebx, ebx
jmp 0x40d977
mov bl, 1
inc esi
lea eax, [ebp - 0x18]
push eax
mov ecx, 2
mov edx, esi
mov eax, edi
call fcn.0040d2c4
test bl, bl
je 0x40d994
cmp dword [ebp - 0x10], 0
jne 0x40d939
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d9b7
lea eax, [ebp - 0x18]
mov edx, dword [0x40c59c]
call fcn.00403638
ret
Function at 0x40df90
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x150], ecx
mov dword [ebp - 0x148], ecx
mov dword [ebp - 0x14c], edx
mov ebx, eax
lea eax, [ebp - 0x160]
mov edx, dword [0x40c59c]
call fcn.00403570
xor eax, eax
push ebp
push 0x40e1c2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x160]
push eax
xor ecx, ecx
mov edx, 0x7fffffff
mov eax, ebx
call fcn.0040d2c4
cmp dword [ebp - 0x158], 0
setne bl
test bl, bl
je 0x40e17a
lea ecx, [ebp - 0x150]
lea edx, [ebp - 4]
mov eax, dword [ebp - 0x158]
call fcn.0040d21c
lea eax, [ebp - 0x144]
push eax
mov eax, dword [ebp - 0x158]
call fcn.00403464
push eax
call sub.kernel32.dll_FindFirstFileA
mov esi, eax
cmp esi, 0xffffffff
setne al
jmp 0x40e0de
push ebp
call fcn.0040dddc
pop ecx
cmp dword [ebp - 0x144], 0
jne 0x40e053
mov dword [ebp - 0x144], 0x8000
push ebp
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
call fcn.0040de3c
pop ecx
mov ebx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
and eax, dword [ebp - 0x144]
je 0x40e0a4
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x118]
mov ecx, 0x104
call fcn.00403274
mov eax, dword [ebp - 0x164]
call fcn.0040dc7c
test al, al
jne 0x40e0a4
push ebp
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
call fcn.0040de3c
pop ecx
mov ebx, eax
test bl, bl
je 0x40e0c3
mov eax, dword [ebp + 8]
test byte [eax - 1], 0x80
je 0x40e0c3
mov eax, dword [ebp + 8]
test byte [eax - 1], 0x20
je 0x40e0c3
push ebp
call fcn.0040de7c
pop ecx
mov ebx, eax
test bl, bl
je 0x40e0d8
lea eax, [ebp - 0x144]
push eax
push esi
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x40e0dc
xor eax, eax
jmp 0x40e0de
mov al, 1
test al, al
jne 0x40e039
cmp esi, 0xffffffff
je 0x40e0f1
push esi
call sub.kernel32.dll_FindClose
test bl, bl
je 0x40e17a
mov eax, dword [ebp + 8]
test byte [eax - 1], 0x80
je 0x40e17a
mov eax, dword [ebp + 8]
test byte [eax - 1], 0x20
jne 0x40e17a
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0x164]
mov ecx, 0x40e1dc
mov edx, dword [ebp - 4]
call fcn.004032ec
mov eax, dword [ebp - 0x164]
call fcn.00403464
push eax
call sub.kernel32.dll_FindFirstFileA
mov esi, eax
cmp esi, 0xffffffff
setne al
jmp 0x40e16b
push ebp
call fcn.0040dddc
pop ecx
push ebp
call fcn.0040de7c
pop ecx
mov ebx, eax
test bl, bl
je 0x40e165
lea eax, [ebp - 0x144]
push eax
push esi
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x40e169
xor eax, eax
jmp 0x40e16b
mov al, 1
test al, al
jne 0x40e140
cmp esi, 0xffffffff
je 0x40e17a
push esi
call sub.kernel32.dll_FindClose
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e1c9
lea eax, [ebp - 0x164]
call fcn.00403048
lea eax, [ebp - 0x160]
mov edx, dword [0x40c59c]
call fcn.00403638
lea eax, [ebp - 0x150]
call fcn.00403048
lea eax, [ebp - 0x148]
call fcn.00403048
lea eax, [ebp - 4]
call fcn.00403048
ret
Function at 0x40e214
Capabilities:
Get disk size

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe0
mov ebp, ecx
mov edi, edx
mov dword [esp], eax
call fcn.0040ee9c
mov ebx, eax
test bl, bl
je 0x40e278
push 0x40e2f0
call sub.kernel32.dll_LoadLibraryA
mov esi, eax
test esi, esi
setne bl
test bl, bl
je 0x40e278
push 0x40e300
push esi
call sub.kernel32.dll_GetProcAddress
mov ebx, eax
test ebx, ebx
je 0x40e26a
push ebp
push edi
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0xc]
call fcn.00403464
push eax
call ebx
test eax, eax
jne 0x40e26e
xor eax, eax
jmp 0x40e270
mov al, 1
mov ebx, eax
push esi
call sub.kernel32.dll_FreeLibrary_1
test bl, bl
jne 0x40e2d3
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
call fcn.00403464
push eax
call sub.kernel32.dll_GetDiskFreeSpaceA
neg eax
sbb ebx, ebx
neg ebx
test bl, bl
je 0x40e2d3
mov eax, dword [esp + 4]
imul dword [esp + 8]
mov edx, eax
imul edx, dword [esp + 0x10]
mov dword [esp + 0x1c], edx
fild dword [esp + 0x1c]
fistp qword [edi]
wait
imul dword [esp + 0xc]
mov dword [esp + 0x1c], eax
fild dword [esp + 0x1c]
fistp qword [ebp]
wait
test bl, bl
jne 0x40e2e6
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
xor eax, eax
mov dword [ebp], eax
mov dword [ebp + 4], eax
mov eax, ebx
add esp, 0x20
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40e3c8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
mov eax, edi
mov ecx, 0x38
xor edx, edx
call fcn.00405fd4
lea eax, [ebp - 0x30]
call fcn.004063d4
lea eax, [ebp - 8]
push eax
mov eax, esi
call fcn.00403464
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
setg byte [ebp - 1]
cmp byte [ebp - 1], 0
je 0x40e4bf
xor eax, eax
push ebp
push 0x40e4b8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x30]
mov edx, ebx
call fcn.004063dc
mov eax, dword [ebp - 0x30]
push eax
push ebx
push 0
mov eax, esi
call fcn.00403464
push eax
call sub.version.dll_GetFileVersionInfoA
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x40e4a2
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x40e4cc
mov eax, dword [ebp - 0x30]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40e475
mov eax, dword [ebp - 0x10]
push eax
mov eax, edi
mov ecx, 0x34
xor edx, edx
call fcn.00405f48
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x40e4d0
mov eax, dword [ebp - 0x30]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40e4a2
mov eax, dword [ebp - 0x10]
push eax
lea eax, [edi + 0x34]
mov ecx, 4
xor edx, edx
call fcn.00405f48
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e4bf
lea eax, [ebp - 0x30]
call fcn.0040667c
ret
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40e4ec
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff90
pushal
xor ebx, ebx
test eax, eax
je 0x40e5a6
test edx, edx
je 0x40e5a6
lea edx, [ebp - 0x38]
call fcn.0040e3c8
test al, al
je 0x40e565
mov eax, dword [esp + 0x14]
lea edx, [ebp - 0x70]
call fcn.0040e3c8
test al, al
je 0x40e565
mov eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0x28]
jb 0x40e536
ja 0x40e533
mov eax, dword [ebp - 0x5c]
cmp eax, dword [ebp - 0x24]
jbe 0x40e536
or ebx, 4
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x14]
jne 0x40e546
mov eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0x10]
je 0x40e549
or ebx, 0x20
mov ax, word [ebp - 0x3c]
cmp ax, word [ebp - 4]
je 0x40e556
or ebx, 8
mov ax, word [ebp - 0x3a]
cmp ax, word [ebp - 2]
je 0x40e5a6
or ebx, 0x10
jmp 0x40e5a6
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
call fcn.0040ced4
test eax, eax
jge 0x40e579
or ebx, 4
push dword [esp + 0x14]
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x40e5a6
test eax, 1
je 0x40e5a6
push dword [esp + 0x1c]
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x40e5a6
test eax, 1
jne 0x40e5a6
or ebx, 0x40
mov dword [esp + 0x1c], ebx
popal
mov esp, ebp
pop ebp
ret

Function at 0x40e714
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, ebx
mov edx, 0x3c
call fcn.00405fec
mov dword [ebx], 0x3c
mov eax, esi
call fcn.00403464
mov dword [ebx + 0x10], eax
mov eax, edi
call fcn.00403464
mov dword [ebx + 0x14], eax
mov eax, dword [ebp - 4]
call fcn.00403464
mov dword [ebx + 0x18], eax
mov eax, dword [ebp + 0x10]
call fcn.00403464
mov dword [ebx + 0xc], eax
mov eax, dword [ebp + 0xc]
or eax, 0x500
mov dword [ebx + 4], eax
mov dword [ebx + 0x1c], 1
push ebx
call sub.shell32.dll_ShellExecuteExA
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc
Function at 0x40e8f8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov edi, ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x40ea70
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
call sub.shell32.dll_SHGetMalloc
test eax, eax
sete byte [ebp - 1]
mov eax, ebx
call fcn.00403048
cmp byte [ebp - 1], 0
je 0x40ea5a
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp + 0xc]
push eax
push esi
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
sete byte [ebp - 1]
cmp byte [ebp - 1], 0
je 0x40ea5a
xor eax, eax
push ebp
push 0x40ea53
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x34]
xor ecx, ecx
mov edx, 0x20
call fcn.00402688
push 0x104
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x34], esi
mov eax, edi
call fcn.00403464
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x34]
push eax
call sub.shell32.dll_SHBrowseForFolderA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
setne byte [ebp - 1]
cmp byte [ebp - 1], 0
je 0x40ea2b
xor eax, eax
push ebp
push 0x40ea24
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, 0x104
call fcn.004034a4
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x40ea09
mov eax, dword [ebp - 0x14]
call fcn.00406710
mov ecx, eax
mov eax, ebx
mov edx, dword [ebp - 0x14]
call fcn.0040312c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ea2b
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
ret
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ea5a
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ea77
lea eax, [ebp - 8]
call fcn.0040403c
ret

Function at 0x40ef44
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
pushal
mov ebx, dword [ebp + 8]
mov edi, eax
mov esi, dword [ebp + 0x14]
test ebx, 1
je 0x40ef5f
call fcn.0040e784
jmp 0x40ef64
call fcn.0040efbc
mov dword [esp + 0x1c], eax
test eax, eax
je 0x40efb7
test ebx, 2
je 0x40efa2
push dword [ebp + 0xc]
push dword [esp + 0x20]
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
jne 0x40ef94
test esi, esi
je 0x40ef74
mov eax, dword [ebp + 0x10]
call esi
test al, al
jne 0x40ef74
test ebx, 4
je 0x40efa2
push edi
call sub.kernel32.dll_DeleteFileA
mov ebx, dword [esp + 0x1c]
lea eax, [esp + 0x1c]
push eax
push ebx
call sub.kernel32.dll_GetExitCodeProcess
push ebx
call sub.kernel32.dll_CloseHandle_1
popal
pop ebp
ret 0x10
Function at 0x40efbc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x58], ebx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40f03a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x44]
mov ecx, 0x44
xor edx, edx
call fcn.00405fd4
mov dword [ebp - 0x44], 0x44
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x44]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x58]
mov edx, esi
mov eax, ebx
call fcn.0040d8b0
mov eax, dword [ebp - 0x58]
call fcn.00403464
push eax
push 0
call sub.kernel32.dll_CreateProcessA
mov ebx, dword [ebp - 0x54]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f041
lea eax, [ebp - 0x58]
call fcn.00403048
ret

Function at 0x413a84
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, eax
cmp dword [esi + 4], 0
jne 0x413af9
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov edi, eax
mov eax, dword [esi]
mov dword [edi], eax
lea edx, [edi + 4]
mov eax, 0x42a614
mov ecx, 2
call fcn.004025bc
mov edx, 0x413a60
lea eax, [edi + 5]
call fcn.00413a7c
mov dword [edi + 6], eax
lea ebx, [edi + 0xa]
mov byte [ebx], 0xe8
lea edx, [edi + 4]
mov eax, ebx
call fcn.00413a7c
mov dword [ebx + 1], eax
mov eax, dword [esi + 4]
mov dword [ebx + 5], eax
mov dword [esi + 4], ebx
add ebx, 0xd
mov eax, ebx
sub eax, edi
cmp eax, 0xffc
jl 0x413ad0
mov dword [esi], edi
mov edx, dword [esi + 4]
mov eax, edx
mov ebx, edx
mov edx, dword [ebx + 5]
mov dword [esi + 4], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4156f4
Capabilities:
Log keystrokes via polling

Disassembly:
pushal
test eax, eax
je 0x415769
mov edi, eax
mov ecx, dword [edi - 4]
mov al, 0x26
repne scasb al, byte es:[edi]
jne 0x415767
test ecx, ecx
jle 0x415767
movzx eax, byte [edi]
cmp al, 0x41
jb 0x415718
cmp al, 0x5a
ja 0x415718
add al, 0x20
lea edi, [0x42a628]
xor ebx, ebx
push eax
call sub.user32.dll_VkKeyScanA
or eax, dword [esp + 0x14]
shr ah, 1
jae 0x415738
mov edx, 0x10
call fcn.00415760
shr ah, 1
jae 0x415746
mov edx, 0x11
call fcn.00415760
shr ah, 1
jae 0x415754
mov edx, 0x12
call fcn.00415760
movzx edx, al
call fcn.00415760
mov eax, edi
jmp 0x415769
xor eax, eax
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x419cbc
Capabilities:
Set registry value

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 0x18]
push eax
mov eax, dword [ebx + 0x28]
push eax
mov eax, dword [ebx + 0x10]
push eax
push 0
mov eax, dword [ebx + 4]
call fcn.00403464
push eax
mov eax, dword [ebx + 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
pop ebx
ret

Function at 0x419ce4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
mov ebx, eax
lea eax, [ebx + 0x1c]
push eax
mov eax, dword [ebx + 0x28]
push eax
lea eax, [ebx + 0x14]
push eax
push 0
mov eax, dword [ebx + 4]
call fcn.00403464
push eax
mov eax, dword [ebx + 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
pop ebx
ret
Function at 0x419d0c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
mov ebx, eax
lea eax, [ebx + 0x1c]
push eax
push 0
lea eax, [ebx + 0x14]
push eax
push 0
mov eax, dword [ebx + 4]
call fcn.00403464
push eax
mov eax, dword [ebx + 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
pop ebx
ret

Function at 0x41a200
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x40]
mov edx, dword [0x419aa8]
call fcn.00403570
xor eax, eax
push ebp
push 0x41a27e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x40]
push eax
push 2
mov ecx, edi
mov edx, esi
mov eax, ebx
call fcn.00419ffc
mov ebx, eax
test bl, bl
je 0x41a262
mov eax, dword [ebp - 0x3c]
call fcn.00403464
push eax
mov eax, dword [ebp - 0x34]
push eax
call sub.advapi32.dll_RegDeleteValueA
test eax, eax
sete bl
mov eax, dword [ebp - 0x34]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41a285
lea eax, [ebp - 0x40]
mov edx, dword [0x419aa8]
call fcn.00403638
ret

Function at 0x4213e4
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x421471
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0040ed04
cmp dword [ebp - 4], 0
je 0x421456
mov eax, dword [ebp - 4]
call fcn.00403464
mov esi, eax
test edi, edi
je 0x421434
lea edx, [ebp - 8]
mov eax, edi
call fcn.0040ed04
mov eax, dword [ebp - 8]
call fcn.00403464
mov ebx, eax
jmp 0x42143e
lea eax, [ebp - 8]
call fcn.00403048
xor ebx, ebx
push 5
push ebx
push esi
call sub.kernel32.dll_MoveFileExA
test eax, eax
jne 0x421456
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00421334
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x421478
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040306c
ret