joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a6ab
Capabilities:
Delete registry key

Disassembly:
push 0xc
mov eax, 0x43d2b8
call fcn.004399e8
call fcn.00409efa
test eax, eax
jne 0x40a6c5
call fcn.00409f77
and dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push eax
push 0x2001f
push 0
push 0x44196c
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40a71c
mov edi, dword [ebp - 0x14]
push str.SOFTWARETencentQQPCMgrDownloader
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test edi, edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
je 0x40a708
push edi
call esi
xor edi, edi
xor eax, eax
test ebx, ebx
sete al
test edi, edi
mov ebx, eax
je 0x40a718
push edi
call esi
mov eax, ebx
jmp 0x40a71e
xor eax, eax
call fcn.00439a6b
ret

Function at 0x40a7fc
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x44b074]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
test byte [0x44e590], 1
mov dword [ebp - 0x214], esi
jne 0x40a848
mov eax, dword [0x44d32c]
or dword [0x44e590], 1
mov ecx, 0x44d32c
call dword [eax + 0xc]
add eax, 0x10
push 0x43e09b
mov dword [0x44e578], eax
call fcn.0041e9fb
pop ecx
mov eax, dword [0x44e578]
cmp dword [eax - 0xc], esi
jne 0x40a8cd
push edi
push 0x20a
lea eax, [ebp - 0x20e]
push esi
push eax
mov word [ebp - 0x210], si
call fcn.0041e7c0
add esp, 0xc
push 1
push 0x1a
lea eax, [ebp - 0x210]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x210]
push eax
mov edi, 0x44e578
push edi
call fcn.004015de
mov eax, dword [0x44e578]
cmp dword [eax - 0xc], esi
jle 0x40a8cc
call fcn.00409ebc
mov eax, str.TencentQQPCMgr_
mov ecx, edi
call fcn.00401a10
push dword [0x44e578]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40a8cc
push esi
push dword [0x44e578]
push esi
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
pop edi
mov eax, dword [0x44e578]
add eax, 0xfffffff0
call fcn.00401671
mov ecx, dword [ebp - 4]
add eax, 0x10
mov dword [ebx], eax
xor ecx, ebp
mov eax, ebx
pop esi
call fcn.0041e8c8
leave
ret

Function at 0x40af17
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x44b074]
xor eax, ebp
mov dword [ebp - 4], eax
and word [ebp - 0x24], 0
push edi
push 7
pop ecx
push dword [edx]
xor eax, eax
lea edi, [ebp - 0x22]
rep stosd dword es:[edi], eax
push 0xf
stosw word es:[edi], ax
lea eax, [ebp - 0x24]
push eax
push 0
push str.LastFailTime
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
pop edi
je 0x40af69
push 0xa
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0042279c
add esp, 0xc
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
xor ecx, ebp
call fcn.0041e8c8
leave
ret 4
Function at 0x40fe36
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
mov edi, ecx
mov eax, dword [edi + 8]
lea ecx, [ebp - 4]
push ecx
push 0x20019
xor ebx, ebx
push ebx
push eax
push dword [edi + 4]
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40fe71
push 0x44196c
push dword [ebp + 8]
call fcn.004015de
mov eax, ebx
jmp 0x40febb
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
inc ebx
push 0x104
mov dword [ebp - 8], 0x208
mov dword [ebp - 0xc], ebx
call fcn.004018a1
lea ecx, [ebp - 8]
push ecx
push eax
lea eax, [ebp - 0xc]
push eax
push 0
lea esi, [edi + 0xc]
call fcn.0040f7a9
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, dword [ebp + 8]
mov edi, eax
call fcn.0040a8ee
test edi, edi
pop esi
jne 0x40fe60
push 2
pop eax
pop edi
pop ebx
leave
ret 4

Function at 0x411aa0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp + 8]
push eax
xor ebx, ebx
inc ebx
push ebx
push 0
mov dword [ebp - 4], pe_nt_image_headers32
call fcn.0040f7a9
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x411b02
mov esi, dword [ebp + 0x10]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x14]
lea eax, [ebp - 8]
push eax
push 0
call fcn.0040f7a9
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x411b02
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov al, bl
pop ebx
leave
ret 0x10
mov esi, dword [ebp + 0x10]
call fcn.0040a8ee
mov esi, dword [ebp + 0xc]
call fcn.0040a8ee
xor bl, bl
jmp 0x411af1
Function at 0x411b16
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x40
mov eax, 0x43c988
call fcn.0043997f
mov edi, dword [ebp + 0x10]
call fcn.00412ced
mov eax, dword [ebp + 0xc]
push 4
pop esi
mov dword [ebp + 0xc], eax
mov dword [ebp - 0x10], esi
mov ebx, 0x208
jmp 0x411b43
mov eax, dword [ebp + 0xc]
push 4
pop esi
mov ecx, dword [eax]
and dword [ebp - 0x2c], 0
mov dword [ebp - 0x18], ecx
mov ecx, dword [eax + 4]
xor eax, eax
dec ecx
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
je 0x411b7f
dec ecx
je 0x411b70
dec ecx
dec ecx
jne 0x411b93
push esi
call fcn.0041eb6e
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x2c], esi
jmp 0x411b8f
push ebx
call fcn.0041eb6e
mov dword [ebp - 0x2c], 2
jmp 0x411b8c
push ebx
call fcn.0041eb6e
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x24], ebx
pop ecx
mov dword [ebp - 0x28], eax
push dword [ebp - 0x24]
push 0
push dword [ebp - 0x28]
call fcn.0041e7c0
mov eax, dword [ebp - 0x24]
add esp, 0xc
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x28]
lea eax, [ebp - 0x2c]
push eax
xor esi, esi
push esi
push dword [ebp - 0x18]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
je 0x411bdb
cmp dword [ebp - 0x28], esi
mov dword [ebp - 0x1c], eax
je 0x411bdb
push dword [ebp - 0x28]
call fcn.0041e7ba
pop ecx
mov dword [ebp - 0x28], esi
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x48]
call fcn.0040944c
mov ecx, dword [ebp + 0x10]
lea eax, [ebp - 0x48]
push eax
mov dword [ebp - 4], esi
call fcn.00412bec
mov ecx, dword [ebp - 0x1c]
mov dword [eax + 0x10], ecx
mov ecx, dword [ebp - 0x20]
mov dword [eax + 0xc], ecx
mov ecx, dword [ebp - 0x24]
mov dword [eax + 8], ecx
mov ecx, dword [ebp - 0x28]
push esi
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 0x2c]
or dword [ebp - 4], 0xffffffff
push 1
lea esi, [ebp - 0x48]
mov dword [eax], ecx
call fcn.004097e6
add dword [ebp + 0xc], 8
dec dword [ebp - 0x10]
jne 0x411b3d
xor eax, eax
inc eax
call fcn.00439a57
ret 0xc

Function at 0x411da7
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x44b074]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor edi, edi
push 0x206
lea eax, [ebp - 0x20a]
push edi
push eax
mov word [ebp - 0x20c], di
call fcn.0041e7c0
add esp, 0xc
cmp dword [esi + 4], edi
jne 0x411e5a
call dword [sym.imp.KERNEL32.dll_GetVersion]
and eax, 0xff
cmp eax, 5
push 0x443640
lea eax, [ebp - 0x20c]
jb 0x411e00
push str..Global_s
jmp 0x411e05
push str.._s
push 0x104
push eax
call fcn.0041f58d
add esp, 0x10
push edi
push 0x80
push 3
push edi
xor edi, edi
inc edi
push edi
push 0xc0000000
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x411e42
push eax
mov dword [esi], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x411e5a
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 5
je 0x411e57
call ebx
cmp eax, 0x1f
jne 0x411e59
mov dword [esi], edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0041e8c8
leave
ret
Function at 0x41250f
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
xor edi, edi
cmp dword [ebp + 8], edi
mov dword [ebp - 4], edi
jne 0x412524
xor eax, eax
jmp 0x4125a1
push esi
mov esi, closesocket
push esi
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
cmp eax, edi
mov dword [ebp - 0xc], eax
jne 0x412547
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
jmp 0x41259d
push ebx
push esi
push str.QQPCRTP
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
cmp esi, edi
jne 0x41256e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
jmp 0x412597
lea eax, [ebp - 8]
push eax
push 0x24
push dword [ebp + 8]
mov dword [ebp - 8], edi
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
cmp eax, edi
mov dword [ebp - 4], eax
jne 0x412594
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
push esi
call ebx
push dword [ebp - 0xc]
call ebx
pop ebx
mov eax, dword [ebp - 4]
pop esi
pop edi
leave
ret 8

Function at 0x41293f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.SOFTWARETencentQQPCMgr
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4129a6
push edi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push esi
push esi
push str.SVCStart
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
pop edi
jne 0x4129a6
xor eax, eax
cmp dword [ebp - 8], esi
sete al
jmp 0x4129a8
xor al, al
pop esi
leave
ret
Function at 0x413fd5
Capabilities:
Create directory

Disassembly:
push 8
mov eax, 0x43c8cc
call fcn.0043997f
mov esi, dword [ebp + 8]
mov ebx, 0x44d32c
mov ecx, ebx
call fcn.004014d4
and dword [esi + 4], 0
lea eax, [esi + 8]
push eax
mov dword [ebp - 4], 2
mov dword [ebp - 0x14], eax
call fcn.0040af7a
lea edi, [esi + 0x40]
mov ecx, ebx
mov esi, edi
mov byte [ebp - 4], 3
call fcn.004014d4
lea ebx, [ebp - 0x10]
mov byte [ebp - 4], 4
call fcn.0040a7fc
mov byte [ebp - 4], 5
call fcn.004013c0
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.004019a0
mov eax, dword [edi]
mov eax, dword [eax - 0xc]
test eax, eax
jle 0x414061
lea ecx, [eax - 1]
test ecx, ecx
jl 0x4140b0
mov eax, edi
call fcn.00401363
cmp ax, 0x5c
je 0x414061
push 0x5c
mov eax, edi
call fcn.00401401
mov eax, 0x443768
mov ecx, edi
call fcn.00401a10
push 0
push dword [edi]
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov eax, str.History.ini
mov ecx, edi
call fcn.00401a10
mov esi, edi
call fcn.0040f7a9
mov esi, dword [ebp + 8]
push eax
call fcn.0040aeda
mov esi, edi
call fcn.0040f7a9
push eax
push dword [ebp - 0x14]
call fcn.0040b027
mov eax, dword [ebp + 8]
call fcn.00439a57
ret 4
push 0x80070057
call fcn.004019b8
int3

Function at 0x414107
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x44b074]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [edi + 0x14], 0
push ebx
push esi
mov ebx, ecx
jne 0x41412b
xor al, al
jmp 0x414257
push dword [ebx + 0x40]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x414124
xor esi, esi
push 0x206
lea eax, [ebp - 0x20e]
push esi
push eax
mov byte [ebp - 0x211], 0
mov word [ebp - 0x210], si
call fcn.0041e7c0
push 0xa
push 0x104
lea eax, [ebp - 0x210]
push eax
push dword [edi]
call fcn.00423b08
add esp, 0x1c
push dword [ebx]
lea eax, [ebp - 0x210]
push esi
push str.FailCount
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push esi
lea esi, [ebp - 0x210]
mov edx, ebx
mov dword [ebp - 0x218], eax
call fcn.0040af17
push 0
mov ebx, eax
call fcn.0041f495
lea esi, [edi + 0x24]
mov dword [esp], 0x4435b4
push esi
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x21c], edx
call fcn.0040a91a
test eax, eax
jne 0x4141f0
mov eax, dword [ebp - 0x218]
cmp dword [edi + 0x1c], eax
jg 0x414265
mov eax, dword [edi + 0x20]
imul eax, eax, 0x15180
cdq
push 0
add eax, ebx
pop ecx
adc edx, ecx
cmp dword [ebp - 0x21c], edx
jg 0x414265
jl 0x41422d
jmp 0x414225
push 0x4437c4
push esi
call fcn.0040a91a
test eax, eax
jne 0x414236
mov eax, dword [ebp - 0x218]
cmp dword [edi + 0x1c], eax
jle 0x41422d
mov eax, dword [edi + 0x20]
imul eax, eax, 0x15180
cdq
push 0
add eax, ebx
pop ecx
adc edx, ecx
cmp dword [ebp - 0x21c], edx
jl 0x41422d
jg 0x414265
cmp dword [ebp - 0x220], eax
ja 0x414265
mov byte [ebp - 0x211], 1
jmp 0x414251
mov eax, dword [edi + 0x1c]
cmp eax, 0xffffffff
je 0x4141d3
cmp dword [edi + 0x20], 0xffffffff
jne 0x414251
cmp eax, dword [ebp - 0x218]
setle byte [ebp - 0x211]
mov al, byte [ebp - 0x211]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0041e8c8
leave
ret
mov byte [ebp - 0x211], 0
jmp 0x414251
Function at 0x41426e
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x44b074]
xor eax, ebp
mov dword [ebp - 4], eax
and word [ebp - 0x20c], 0
push ebx
push esi
push 0x206
lea eax, [ebp - 0x20a]
push 0
push eax
mov esi, ecx
call fcn.0041e7c0
push 0xa
push 0x104
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 8]
call fcn.00423b08
add esp, 0x1c
push dword [esi]
lea eax, [ebp - 0x20c]
push 0
push str.FailCount
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
inc eax
add esi, 8
push eax
lea ebx, [ebp - 0x20c]
call fcn.0040b44a
push 0
call fcn.0041f495
pop ecx
push eax
mov dword [ebp - 0x210], edx
call fcn.0040b49c
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0041e8c8
leave
ret 4

Function at 0x4152b9
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [esi + 0x30]
mov ecx, dword [eax + 0x18]
mov eax, dword [ecx]
push ebx
push edi
push dword [ebp + 0xc]
call dword [eax + 0xc]
cmp dword [ebp + 8], 0
jne 0x415341
push dword [esi + 0x30]
call fcn.004168fc
test eax, eax
je 0x415348
mov eax, dword [esi + 0x30]
push dword [eax + 0x3c]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x415328
mov eax, dword [esi + 0x30]
push dword [eax + 0x3c]
mov ecx, dword [eax + 0x38]
call fcn.00416e5d
test eax, eax
je 0x415328
cmp dword [esi + 0x20], 1
jne 0x415313
mov ecx, dword [esi + 0x30]
call fcn.00416592
jmp 0x415348
mov edi, dword [esi + 0x30]
call fcn.004170af
test al, al
jne 0x415348
mov byte [0x44e24b], 0xb
jmp 0x415348
mov edi, dword [esi + 0x30]
call fcn.004170af
test al, al
je 0x41531f
push dword [esi + 4]
mov ebx, dword [esi + 0x30]
call fcn.00416fb4
jmp 0x415351
mov byte [0x44e24b], 1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x415897
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x44b074]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
push 0x443950
xor esi, esi
push 0x8c
push esi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
cmp edi, esi
jne 0x4158cf
xor eax, eax
jmp 0x41591b
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp eax, esi
mov dword [ebp - 0x10], eax
je 0x4158cb
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, esi
je 0x4158cb
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
cmp ebx, esi
je 0x415918
push esi
push 0x80
push 2
push esi
push 1
push 0x10000000
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x415929
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0041e8c8
leave
ret
push esi
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x10]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x415948
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x41591a
xor esi, esi
inc esi
jmp 0x41593d
Function at 0x415a16
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x120c
call fcn.00433460
mov eax, dword [0x44b074]
xor eax, esp
mov dword [esp + 0x1208], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0xf9c
lea eax, [esp + 0x28]
push ebx
push eax
mov dword [esp + 0x2c], ebx
call fcn.0041e7c0
add esp, 0xc
push 0x206
lea eax, [esp + 0x100e]
push ebx
push eax
mov dword [esp + 0x20], ebx
mov word [esp + 0x1014], bx
call fcn.0041e7c0
add esp, 0xc
push 0x40
lea eax, [esp + 0xfc6]
push ebx
push eax
mov dword [esp + 0x1c], ebx
mov word [esp + 0xfcc], bx
call fcn.0041e7c0
xor eax, eax
add esp, 0xc
cmp eax, str.071132e14ea664c6eaedb1417e589b86
je 0x415b9f
lea eax, [esp + 0x14]
push eax
push 0xfa0
lea eax, [esp + 0x28]
push eax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x415b9f
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x415b9f
shr eax, 2
mov dword [esp + 0x1c], eax
mov eax, ebx
mov dword [esp + 0x18], eax
je 0x415b9f
push dword [esp + eax*4 + 0x20]
push ebx
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
cmp edi, ebx
je 0x415b8c
push 0x208
lea eax, [esp + 0x100c]
push ebx
push eax
mov dword [esp + 0x1c], ebx
call fcn.0041e7c0
add esp, 0xc
lea eax, [esp + 0x14]
push eax
push 4
lea eax, [esp + 0x18]
push eax
push edi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x415b85
push 0x104
lea eax, [esp + 0x100c]
push eax
push dword [esp + 0x18]
push edi
call sub.PSAPI.DLL_GetModuleBaseNameW
test eax, eax
je 0x415b85
lea eax, [esp + 0x1008]
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
lea eax, [esp + 0x1008]
push eax
call fcn.0041eae3
pop ecx
push eax
lea esi, [esp + 0xfc4]
lea ecx, [esp + 0x100c]
call fcn.0041d720
test al, al
pop ecx
je 0x415b85
push str.071132e14ea664c6eaedb1417e589b86
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x415bb6
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x18]
inc eax
cmp eax, dword [esp + 0x1c]
mov dword [esp + 0x18], eax
jb 0x415ad9
xor eax, eax
mov ecx, dword [esp + 0x1214]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041e8c8
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
jmp 0x415ba1
Function at 0x415d55
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, eax
mov eax, ebx
cdq
push 3
pop ecx
idiv ecx
mov eax, ebx
xor esi, esi
sub eax, edx
lea eax, [eax*4 + 0xc]
cdq
idiv ecx
inc eax
push eax
call fcn.0042205d
cmp ebx, 2
pop ecx
mov ecx, eax
jle 0x415df7
lea eax, [ebx - 3]
xor edx, edx
push 3
pop ebx
div ebx
inc eax
mov dword [ebp - 4], eax
imul eax, eax, 0xfffffffd
add dword [ebp + 8], eax
movzx edx, byte [edi]
mov eax, edx
shr eax, 2
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + esi], al
movzx eax, byte [edi + 1]
and edx, 3
shl edx, 4
mov ebx, eax
shr ebx, 4
mov dl, byte [ebx + edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc esi
mov byte [ecx + esi], dl
movzx edx, byte [edi + 2]
and eax, 0xf
mov ebx, edx
shr ebx, 6
mov al, byte [ebx + eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc esi
mov byte [ecx + esi], al
and edx, 0x3f
mov al, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc esi
mov byte [ecx + esi], al
inc esi
add edi, 3
dec dword [ebp - 4]
jne 0x415d9c
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x415e4f
movzx eax, byte [edi]
mov edx, eax
shr edx, 2
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
and eax, 3
mov byte [ecx + esi], dl
inc esi
shl eax, 4
cmp ebx, 1
jle 0x415e3b
movzx edx, byte [edi + 1]
mov edi, edx
shr edi, 4
mov al, byte [edi + eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + esi], al
inc esi
and edx, 0xf
mov al, byte [edx*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + esi], al
jmp 0x415e49
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + esi], al
inc esi
mov byte [ecx + esi], 0x3d
inc esi
mov byte [ecx + esi], 0x3d
inc esi
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x415e58
mov dword [eax], esi
pop edi
mov byte [ecx + esi], 0
pop esi
mov eax, ecx
pop ebx
leave
ret
Function at 0x4168fc
Capabilities:
Delete file
Read file on windows

Disassembly:
push 0x20
mov eax, 0x43dc98
call fcn.0043997f
lea ebx, [ebp - 0x1c]
call fcn.0040a7fc
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
call fcn.0041717e
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.004019a0
mov dword [ebp - 0x10], edi
push 3
push 1
mov byte [ebp - 4], 3
push 0xc0000000
lea esi, [ebp - 0x24]
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
call fcn.0040f7a9
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0040a987
test eax, eax
jge 0x41697c
cmp dword [ebp - 0x10], edi
je 0x416967
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff0
call fcn.004019a0
mov eax, edi
call fcn.00439a57
ret 4
lea eax, [ebp - 0x10]
push eax
lea esi, [ebp - 0x20]
call fcn.0040aa24
push dword [ebp - 0x20]
call fcn.0041eb6e
pop ecx
push edi
mov esi, eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x20]
mov dword [ebp - 0x28], edi
push esi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4169b1
call fcn.0040bbe9
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x1c]
push ecx
push eax
push esi
mov dword [ebp - 0x1c], eax
call fcn.00415e63
add esp, 0xc
push esi
mov dword [ebp - 0x14], eax
call fcn.0041e7ba
cmp dword [ebp - 0x10], edi
pop ecx
je 0x4169e0
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], edi
cmp dword [ebp - 0x14], edi
mov dword [ebp - 0x18], edi
je 0x416a51
mov esi, dword [ebp - 0x1c]
add esi, esi
push esi
call fcn.0041eb6e
mov ebx, eax
cmp ebx, edi
pop ecx
je 0x416a43
push esi
push edi
push ebx
call fcn.0041e7c0
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
add esp, 0xc
lea eax, [ebp - 0x18]
dec esi
push eax
dec esi
push ebx
mov dword [ebp - 0x18], esi
call fcn.00407513
push dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
call fcn.0041e7ba
add esp, 0xc
cmp dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
je 0x416a3c
mov ecx, dword [ebp + 8]
push ebx
call fcn.00416a70
mov dword [ebp - 0x18], eax
push ebx
call fcn.0041e7ba
pop ecx
cmp dword [ebp - 0x14], edi
je 0x416a51
push dword [ebp - 0x14]
call fcn.0041e7ba
pop ecx
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x10], edi
je 0x416a68
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x18]
jmp 0x416967