joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003e69c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe6c
push ebx
mov eax, dword [0x1005d7f3]
mov eax, dword [eax]
or dword [ebp - 0x194], 0xffffffff
mov eax, dword [eax + 0x30c]
or eax, eax
je 0x1003e6d5
mov eax, dword [eax + 0x80]
or eax, eax
je 0x1003e6d5
mov eax, dword [eax + 4]
or eax, eax
je 0x1003e6d5
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 0xffffffff
je 0x1003e7a4
cmp dword [ebp + 0x10], 0
je 0x1003e6ed
mov eax, dword [ebp + 0x10]
jmp 0x1003e701
movzx eax, byte [0x10062823]
and eax, 0xf
cmp al, 9
jb 0x1003e6ff
mov al, 1
jmp 0x1003e701
inc al
jmp 0x1003e707
push eax
push 0x1003e703
lea eax, [ebp - 0x190]
push eax
call fcn.10050e22
add esp, 0xc
cmp dword [ebp + 8], 0
je 0x1003e731
push dword [ebp + 8]
lea eax, [ebp - 0x190]
push eax
call fcn.100510f8
cmp dword [ebp + 0xc], 0
je 0x1003e746
push dword [ebp + 0xc]
lea eax, [ebp - 0x190]
push eax
call fcn.100510f8
jmp 0x1003e74a
push 0x1003e748
lea eax, [ebp - 0x190]
push eax
call fcn.100510f8
lea eax, [ebp - 0x190]
push eax
call fcn.1002f5af
push 0
push eax
lea eax, [ebp - 0x190]
push eax
push dword [ebp - 0x194]
call fcn.10051140
cmp byte [0x10062823], 0x39
jb 0x1003e78e
mov byte [0x10062823], 0x31
jmp 0x1003e794
inc byte [0x10062823]
cmp dword [ebp + 0x10], 0
je 0x1003e7a4
mov al, byte [ebp + 0x10]
sub al, 0x30
mov byte [0x10062823], al
pop ebx
leave
ret 0xc

Function at 0x1003e929
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
cmp dword [eax + 0x28], 0
jne 0x1003e995
call fcn.1005103e
sub eax, dword [0x1005252c]
cmp eax, 0x5dc
jbe 0x1003e98e
call fcn.1005103e
mov edx, dword [ebp + 8]
sub eax, dword [edx + 0x16c]
cmp eax, 0x2710
jbe 0x1003e984
movzx ecx, word [edx + 8]
movzx ebx, word [edx + 0xa]
mov edx, dword [edx + 4]
mov eax, dword [0x1005d7f3]
mov eax, dword [eax]
push ebx
call dword [int.1005d3c5]
call fcn.1005103e
mov edx, dword [ebp + 8]
mov dword [edx + 0x16c], eax
call fcn.1005103e
mov dword [0x1005252c], eax
or al, 0xff
pop ebx
leave
ret 4
xor al, al
pop ebx
leave
ret 4
Function at 0x10040208
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor bl, bl
mov dword [ebp - 4], 0
mov eax, dword [0x1005d7f7]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x5a854]
mov ecx, dword [eax + 8]
cmp dword [ebp - 4], ecx
jb 0x10040231
jmp 0x10040297
mov edx, dword [ebp - 4]
call dword [fcn.1005d229]
mov ecx, eax
cmp byte [ecx + 0x20], 0
jne 0x1004028f
cmp ecx, esi
je 0x1004028f
test byte [ecx + 0x1f], 4
jne 0x1004028f
mov ax, word [ecx + 0xe]
cmp al, 0x32
je 0x1004028f
cmp al, 0x18
je 0x1004028f
cmp al, 0xc
je 0x1004028f
or al, al
je 0x1004028f
mov ax, word [ecx + 8]
mov dx, word [ecx + 0xa]
sub ax, word [esi + 8]
jns 0x10040271
neg ax
sub dx, word [esi + 0xa]
jns 0x1004027a
neg dx
cmp ax, 1
ja 0x1004028f
cmp dx, 1
ja 0x1004028f
inc bl
cmp bl, 2
jbe 0x1004028f
jmp 0x10040297
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jb 0x10040218
cmp bl, 2
jbe 0x100402f5
call fcn.1005103e
mov ecx, eax
mov edx, dword [0x1005d833]
sub eax, dword [edx]
cmp eax, 0x5dc
jb 0x100402f1
mov eax, dword [0x1006b6c6]
mov dword [ebp - 8], eax
mov eax, dword [0x1005d7cb]
mov eax, dword [eax]
mov eax, dword [eax]
mov ecx, dword [0x1005d7bb]
mov ecx, dword [ecx]
movzx ebx, word [ecx + 0xa]
movzx ecx, word [ecx + 8]
mov edx, 0xbc9
push ebx
push dword [ebp - 8]
push 0
call dword [fcn.1005d20d]
call fcn.1005103e
mov edx, dword [0x1005d833]
mov dword [edx], eax
mov al, 1
jmp 0x100402f7
xor al, al
pop ebx
leave
ret 4

Function at 0x10040af6
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov byte [0x100626d8], 0
mov byte [0x100626d5], 0
mov dword [0x100626cc], 0
call fcn.10043281
cmp byte [0x100626c2], 0
jne 0x10040b79
cmp al, 0xff
je 0x10040b79
jmp 0x10040b2a
jmp 0x10040b35
push 0x10040b2c
push 0x10040b25
call fcn.1000b638
cmp eax, 0xffffffff
je 0x10040b79
or eax, eax
jne 0x10040b77
cmp dword [ebp + 8], 1
jne 0x10040b70
jmp 0x10040b66
push 0x10040b55
call fcn.10048003
mov byte [0x100626c2], 1
jmp 0x10040bf3
mov byte [0x100626c2], 1
call fcn.1001c981
cmp byte [0x100626c3], 0
jne 0x10040bea
cmp al, 0xff
je 0x10040bea
jmp 0x10040b9b
jmp 0x10040ba4
push 0x10040b9d
push 0x10040b94
call fcn.1000b638
cmp eax, 0xffffffff
je 0x10040bea
or eax, eax
jne 0x10040be8
cmp dword [ebp + 8], 1
jne 0x10040be1
jmp 0x10040bd7
push 0x10040bc4
call fcn.10048003
mov byte [0x100626c3], 1
jmp 0x10040bf3
or al, 0xff
jmp 0x10040bf3
cmp al, 0xff
je 0x10040c22
call fcn.10048058
cmp al, 0x2e
jb 0x10040c02
jmp 0x10040c22
mov eax, dword [0x1005d7bb]
mov eax, dword [eax]
mov dx, word [eax + 0x52]
sub dx, word [eax + 0x50]
cmp dx, 0
jg 0x10040c19
jmp 0x10040c22
mov byte [0x100626d9], 1
jmp 0x10040c85
call fcn.10048073
cmp eax, 0xffffffff
jne 0x10040c4a
mov byte [0x100626d9], 0
mov byte [0x100626c2], 0
mov byte [0x100626c3], 0
mov byte [0x100626e5], 1
jmp 0x10040c85
mov byte [0x100626d9], 0
mov byte [0x100626c2], 0
mov byte [0x100626c3], 0
mov byte [0x100626d4], 1
jmp 0x10040c7b
push 0x10040c68
call fcn.10048003
call fcn.1005103e
mov dword [0x1006280c], eax
leave
ret 4
Function at 0x100430e6
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
push esi
push 0x76d
push dword [ebp + 8]
call fcn.1001517d
or eax, eax
je 0x1004327c
mov dword [ebp - 4], eax
push 0
push 0
push 0x1009
push dword [ebp - 4]
call fcn.10050f6c
lea eax, [ebp - 0x150]
push eax
call fcn.10015a95
or eax, eax
jne 0x1004327c
lea eax, [ebp - 0x150]
push eax
call fcn.1002fd52
push dword [ebp + 0xc]
push dword [ebp + 0x10]
lea eax, [ebp - 0x4c]
push eax
call fcn.10050e22
add esp, 0xc
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x150]
push eax
call fcn.100510f8
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea eax, [ebp - 0x150]
push eax
call fcn.10050fc0
cmp eax, 0xffffffff
je 0x1004327c
mov dword [ebp - 8], eax
push 0
push dword [ebp - 8]
call fcn.10050ff6
or eax, eax
je 0x10043274
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
push 0
call fcn.1003d03c
mov dword [ebp - 0xc], eax
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0xc]
push dword [ebp - 8]
call fcn.1005109e
mov esi, dword [ebp - 0xc]
jmp 0x10043262
lea eax, [esi + 1]
push eax
push 0x76d
push dword [ebp + 8]
call fcn.100302be
cmp eax, 0xffffffff
jne 0x1004325f
push 0x28
lea eax, [ebp - 0x38]
push eax
call fcn.1003062f
push 0
push 0
push 0x1004
push dword [ebp - 4]
call fcn.10050f6c
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x20], 0x10
mov dword [ebp - 0x38], 1
lea eax, [esi + 1]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x38]
push eax
push 0
push 0x1007
push dword [ebp - 4]
call fcn.10050f6c
inc dword [ebp - 0x30]
jmp 0x1004322c
push dword [esi + 0x14]
push 0x10043228
lea eax, [ebp - 0x150]
push eax
call fcn.10050e22
add esp, 0xc
lea eax, [ebp - 0x150]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x38]
push eax
push 1
push 0x1006
push dword [ebp - 4]
call fcn.10050f6c
add esi, 0x18
cmp byte [esi], 0
jne 0x100431c3
lea eax, [ebp - 0xc]
push eax
call fcn.1003d00f
push dword [ebp - 8]
call fcn.10050fb4
pop esi
leave
ret 0xc

Function at 0x10043f7c
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
or dword [ebp - 8], 0xffffffff
push 0
push 0x8000080
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
call fcn.10050fc0
cmp eax, 0xffffffff
je 0x1004401b
mov dword [ebp - 4], eax
push 0
push dword [ebp - 4]
call fcn.10050ff6
or eax, eax
je 0x1004401b
mov dword [ebp - 8], eax
inc eax
push eax
push pe_nt_image_headers32
call fcn.1003d03c
mov dword [ebp - 0xc], eax
push 0x400
push pe_nt_image_headers32
call fcn.1003d03c
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
call fcn.1002ed12
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 4]
call fcn.1005109e
push dword [ebp - 4]
call fcn.10050fb4
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call fcn.10032922
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
call fcn.1003d00f
lea eax, [ebp - 0xc]
push eax
call fcn.1003d00f
mov eax, dword [ebp - 8]
leave
ret 4
Function at 0x1004474c
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
jmp 0x1004475f
push 0x10044754
call fcn.1005100e
or eax, eax
je 0x100449ce
mov dword [ebp - 4], eax
jmp 0x10044781
push 0x10044776
push dword [ebp - 4]
call fcn.10051020
or eax, eax
je 0x1004479d
push eax
push 0x4fa704
call fcn.1002edf0
jmp 0x100447aa
push 0x1004479f
push dword [ebp - 4]
call fcn.10051020
or eax, eax
je 0x100447c6
push eax
push 0x4fa708
call fcn.1002edf0
jmp 0x100447d8
push 0x100447c8
push dword [ebp - 4]
call fcn.10051020
or eax, eax
je 0x100447f4
push eax
push 0x4fa70c
call fcn.1002edf0
jmp 0x10044805
push 0x100447f6
push dword [ebp - 4]
call fcn.10051020
or eax, eax
je 0x10044821
push eax
push 0x4fa710
call fcn.1002edf0
jmp 0x10044831
push 0x10044823
push dword [ebp - 4]
call fcn.10051020
or eax, eax
je 0x1004484d
push eax
push 0x4fa714
call fcn.1002edf0
jmp 0x1004485d
push 0x1004484f
push dword [ebp - 4]
call fcn.10051020
or eax, eax
je 0x10044879
push eax
push 0x4fa718
call fcn.1002edf0
jmp 0x10044882
push 0x1004487b
push dword [ebp - 4]
call fcn.10051020
or eax, eax
je 0x1004489e
push eax
push 0x4fa71c
call fcn.1002edf0
jmp 0x100448a5
push 0x100448a0
push dword [ebp - 4]
call fcn.10051020
or eax, eax
je 0x100448c1
push eax
push 0x4fa720
call fcn.1002edf0
jmp 0x100448c8
push 0x100448c3
push dword [ebp - 4]
call fcn.10051020
or eax, eax
je 0x100448e4
push eax
push 0x4fa724
call fcn.1002edf0
jmp 0x100448ec
push 0x100448e6
push dword [ebp - 4]
call fcn.10051020
or eax, eax
je 0x10044908
push eax
push 0x4fa728
call fcn.1002edf0
jmp 0x10044916
push 0x1004490a
push dword [ebp - 4]
call fcn.10051020
or eax, eax
je 0x10044932
push eax
push 0x4fa72c
call fcn.1002edf0
jmp 0x1004493e
push 0x10044934
push dword [ebp - 4]
call fcn.10051020
or eax, eax
je 0x1004495a
push eax
push 0x4fa730
call fcn.1002edf0
jmp 0x10044962
push 0x1004495c
push dword [ebp - 4]
call fcn.10051020
or eax, eax
je 0x1004497e
push eax
push 0x4fa734
call fcn.1002edf0
jmp 0x10044988
push 0x10044980
push dword [ebp - 4]
call fcn.10051020
or eax, eax
je 0x100449a4
push eax
push 0x4fa738
call fcn.1002edf0
jmp 0x100449b2
push 0x100449a6
push dword [ebp - 4]
call fcn.10051020
or eax, eax
je 0x100449ce
push eax
push 0x4fa73c
call fcn.1002edf0
leave
ret
Function at 0x10044d61
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd8
push esi
push edi
push ebx
call fcn.1005103e
sub eax, dword [0x1006b414]
cmp eax, 0x1f4
jae 0x10044d86
pop ebx
pop edi
pop esi
leave
ret 4
mov eax, 0x4a4158
mov eax, dword [eax]
mov eax, dword [eax]
mov ebx, dword [eax + 4]
push dword [eax + 8]
pop dword [ebp - 4]
cmp dword [ebp - 4], 0
jne 0x10044da5
pop ebx
pop edi
pop esi
leave
ret 4
push 0x1005231e
call fcn.1003d00f
mov eax, dword [ebp - 4]
inc eax
imul eax, eax, 4
push eax
push pe_nt_image_headers32
call fcn.1003d03c
mov dword [0x1005231e], eax
push 0
pop dword [ebp - 0xc]
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x10044edf
mov eax, dword [ebx]
movzx eax, word [eax + 0x32]
jmp 0x10044dde
push eax
push 0x10044dda
lea eax, [ebp - 0x124]
push eax
call fcn.10050e22
add esp, 0xc
push 0x14
lea eax, [ebp - 0x20]
push eax
call fcn.1003062f
mov esi, dword [ebx]
mov eax, dword [0x1005d7df]
mov edi, dword [eax]
mov ecx, 0xd
cld
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x1005d7e3]
mov eax, dword [eax]
mov eax, dword [eax]
mov byte [eax + 0x776], 1
lea edx, [ebp - 0x18]
push edx
lea edx, [ebp - 0x1c]
push edx
lea edx, [ebp - 0x20]
push edx
push 0
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x10]
call dword [fcn.1005d2d5]
mov eax, dword [0x1005d7e3]
mov eax, dword [eax]
mov eax, dword [eax]
mov byte [eax + 0x776], 0
mov byte [ebp - 0x228], 0
push dword [ebp - 0x14]
lea eax, [ebp - 0x228]
push eax
call fcn.1002f616
push dword [ebp - 0x18]
lea eax, [ebp - 0x228]
push eax
call fcn.100510f8
push dword [ebp - 0x1c]
lea eax, [ebp - 0x228]
push eax
call fcn.100510f8
cmp dword [ebp - 0x1c], 0
jne 0x10044e92
cmp dword [ebp - 0x18], 0
jne 0x10044e92
cmp dword [ebp - 0x14], 0
jne 0x10044e92
inc dword [ebp - 0xc]
mov eax, dword [0x1005d7df]
mov eax, dword [eax]
mov byte [eax], 0
lea eax, [ebp - 0x1c]
mov edx, 4
call dword [fcn.1005d2d9]
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x124]
push eax
push 0x3e9
push dword [ebp + 8]
call fcn.10044f3b
mov eax, dword [ebx]
mov eax, dword [eax + 0x2c]
mov edx, dword [0x1005231e]
mov ecx, dword [ebp - 8]
mov dword [edx + ecx*4], eax
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
add ebx, 4
cmp eax, dword [ebp - 4]
jae 0x10044eee
cmp dword [ebp - 0xc], 0
je 0x10044dd2
push 0x10045122
push 0
push 0x1030
push 0x3e9
push dword [ebp + 8]
call fcn.10050f66
call fcn.100451a1
push 0x10045122
push 0
push 0x1030
push 0x3e9
push dword [ebp + 8]
call fcn.10050f66
call fcn.100451a1
call fcn.1005103e
mov dword [0x1006b414], eax
pop ebx
pop edi
pop esi
leave
ret 4
Function at 0x10044fb3
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
call fcn.1005103e
sub eax, dword [0x1006b414]
cmp eax, 0x1f4
jae 0x10044fd2
leave
ret 8
push 0
push 0
push 0x188
push 0x3e8
push dword [ebp + 8]
call fcn.10050f66
cmp eax, 0xffffffff
jne 0x10044ff1
leave
ret 8
lea edx, [ebp - 0xfc]
push edx
push eax
push 0x189
push 0x3e8
push dword [ebp + 8]
call fcn.10050f66
cmp eax, 0xffffffff
je 0x10045014
or eax, eax
jne 0x10045018
leave
ret 8
mov dword [ebp - 0x100], eax
or dword [ebp - 0x104], 0xffffffff
mov eax, dword [0x1005231e]
or eax, eax
jne 0x10045032
leave
ret 8
mov ecx, dword [ebp + 0xc]
mov ecx, dword [eax + ecx*4]
lea eax, [ebp - 0xfc]
push eax
mov eax, dword [0x1005d7cf]
mov eax, dword [eax]
mov edx, dword [eax]
mov eax, dword [0x1005d7cb]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [fcn.1005d255]
push 0x64
call fcn.100510c8
push 0
push dword [ebp + 0xc]
push 0x1008
push 0x3e9
push dword [ebp + 8]
call fcn.10050f66
call fcn.1005103e
mov dword [0x1006b414], eax
mov ax, 2
shl eax, 0x10
mov ax, 0x3e8
push 0
push eax
push 0x111
push dword [ebp + 8]
call fcn.10050f4e
leave
ret 8

Function at 0x100452de
Capabilities:
Execute syscall

Disassembly:
mov eax, 0x120b
lea edx, [esp + 4]
int 0x2e
ret 0x10

Function at 0x10047dae
Capabilities:
Check if file exists
Encode data using xor
Get common file path
Write file on windows

Disassembly:
sub esp, 0xe08
xor eax, eax
jmp 0x10047dbe
mov cl, byte [eax + 0x1006a800]
xor cl, 0x45
mov byte [esp + eax + 0x208], cl
inc eax
cmp eax, 0xc00
jl 0x10047dbe
push esi
push 0x104
lea edx, [esp + 0xc]
push edx
call fcn.10051026
mov eax, dword [0x10032912]
push eax
xor esi, esi
call fcn.10051116
dec eax
js 0x10047e0a
mov ecx, dword [0x10032912]
mov dl, byte [eax + ecx]
mov byte [esp + esi + 0x10c], dl
inc esi
dec eax
jns 0x10047dfc
call 0x10047e11
pop esp
pop esp
lea eax, [esp + 0xc]
mov byte [esp + esi + 0x110], 0
mov esi, fcn.100510f8
push eax
call esi
lea ecx, [esp + 0x10c]
push ecx
lea edx, [esp + 0xc]
push edx
call esi
lea eax, [esp + 8]
push eax
call fcn.10050ff0
cmp eax, 0xffffffff
jne 0x10047e81
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
lea ecx, [esp + 0x20]
push ecx
call fcn.10050fc0
push 0
lea edx, [esp + 8]
push edx
mov esi, eax
push 0xc00
lea eax, [esp + 0x218]
push eax
push esi
call fcn.100510ec
push esi
call fcn.10050fb4
pop esi
add esp, 0xe08
ret
Function at 0x10047e11
Capabilities:
Check if file exists
Get file attributes
Write file on windows

Disassembly:
sub esp, 0xe08
xor eax, eax
jmp 0x10047dbe
mov cl, byte [eax + 0x1006a800]
xor cl, 0x45
mov byte [esp + eax + 0x208], cl
inc eax
cmp eax, 0xc00
jl 0x10047dbe
push esi
push 0x104
lea edx, [esp + 0xc]
push edx
call fcn.10051026
mov eax, dword [0x10032912]
push eax
xor esi, esi
call fcn.10051116
dec eax
js 0x10047e0a
mov ecx, dword [0x10032912]
mov dl, byte [eax + ecx]
mov byte [esp + esi + 0x10c], dl
inc esi
dec eax
jns 0x10047dfc
call 0x10047e11
pop esp
pop esp
lea eax, [esp + 0xc]
mov byte [esp + esi + 0x110], 0
mov esi, fcn.100510f8
push eax
call esi
lea ecx, [esp + 0x10c]
push ecx
lea edx, [esp + 0xc]
push edx
call esi
lea eax, [esp + 8]
push eax
call fcn.10050ff0
cmp eax, 0xffffffff
jne 0x10047e81
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
lea ecx, [esp + 0x20]
push ecx
call fcn.10050fc0
push 0
lea edx, [esp + 8]
push edx
mov esi, eax
push 0xc00
lea eax, [esp + 0x218]
push eax
push esi
call fcn.100510ec
push esi
call fcn.10050fb4
pop esi
add esp, 0xe08
ret

Function at 0x10047e89
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
push ebx
push esi
push edi
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x118], 0x2e59534a
mov dword [ebp - 0x114], 0x4c4c44
push 0x104
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x118]
push ecx
call fcn.1005100e
push eax
call fcn.10051008
lea edx, [ebp - 0x108]
push edx
call fcn.10051116
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x138]
sub eax, 1
mov dword [ebp - 0x11c], eax
jmp 0x10047f03
mov ecx, dword [ebp - 0x11c]
sub ecx, 1
mov dword [ebp - 0x11c], ecx
cmp dword [ebp - 0x11c], 0
jl 0x10047f31
mov edx, dword [ebp - 0x11c]
movsx eax, byte [edx + ebp - 0x108]
cmp eax, 0x5c
jne 0x10047f2f
mov ecx, dword [ebp - 0x11c]
mov byte [ecx + ebp - 0x107], 0
jmp 0x10047f31
jmp 0x10047ef4
mov dword [ebp - 0x11c], 0
jmp 0x10047f4c
mov edx, dword [ebp - 0x11c]
add edx, 1
mov dword [ebp - 0x11c], edx
cmp dword [ebp - 0x11c], 0x10
jge 0x10047f76
mov eax, dword [0x1005d29d]
add eax, dword [ebp - 0x11c]
movsx ecx, byte [eax]
xor ecx, 0x33
mov edx, dword [0x1005d29d]
add edx, dword [ebp - 0x11c]
mov byte [edx], cl
jmp 0x10047f3d
mov eax, dword [0x1005d29d]
push eax
lea ecx, [ebp - 0x108]
push ecx
call fcn.100510f8
lea edx, [ebp - 0x108]
push edx
call fcn.10050ff0
cmp eax, 0xffffffff
je 0x10047ffc
push 4
push 0
lea eax, [ebp - 0x108]
push eax
call fcn.10051086
lea ecx, [ebp - 0x124]
push ecx
call fcn.10050e9a
mov edx, dword [ebp - 0x124]
add edx, dword [ebp - 0x120]
and edx, 0xf
jne 0x10047ffc
mov dword [ebp - 0x134], 0x6e696166
mov dword [ebp - 0x130], 0x66
push 0
lea eax, [ebp - 0x134]
push eax
push eax
push 0
call fcn.10050f36
lea eax, [0x1005c443]
push eax
pop esp
popal
lea eax, [0x1005c443]
jmp eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405a06
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ebx
and eax, 4
push edi
mov dword [ebp - 4], eax
call fcn.00405cd1
test bl, 8
mov dword [ebp - 8], eax
je 0x405a45
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
inc eax
add dword [0x7a8b08], eax
jmp 0x405bc2
mov dword [ebp + 8], ebx
and dword [ebp + 8], 1
je 0x405a5f
test eax, eax
je 0x405b70
test bl, 2
je 0x405b70
mov esi, 0x7a3f70
push edi
push esi
call fcn.00406215
cmp dword [ebp + 8], 0
je 0x405a7e
push str..
push esi
call sub.KERNEL32.dll_lstrcatW
jmp 0x405a84
push edi
call fcn.00405c15
cmp word [edi], 0
jne 0x405a94
cmp word [0x7a3f70], 0x5c
jne 0x405a9f
push 0x40a014
push edi
call sub.KERNEL32.dll_lstrcatW
push edi
call sub.KERNEL32.dll_lstrlenW
lea ebx, [edi + eax*2]
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405b65
cmp word [ebp - 0x22c], 0x2e
jne 0x405ae9
cmp word [ebp - 0x22a], 0
je 0x405b48
cmp word [ebp - 0x22a], 0x2e
jne 0x405ae9
cmp word [ebp - 0x228], 0
je 0x405b48
lea eax, [ebp - 0x22c]
push eax
push ebx
call fcn.00406215
test byte [ebp - 0x258], 0x10
je 0x405b14
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405b48
push dword [ebp + 0xc]
push edi
call fcn.00405a06
jmp 0x405b48
push dword [ebp - 4]
push edi
call fcn.004059be
test eax, eax
jne 0x405b40
cmp dword [ebp - 4], eax
je 0x405b38
push edi
push 0xfffffffffffffff1
call fcn.00405374
push 0
push edi
call fcn.004060b6
jmp 0x405b48
inc dword [0x7a8b08]
jmp 0x405b48
push edi
push 0xfffffffffffffff2
call fcn.00405374
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x405ac1
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x405b70
and word [ebx - 2], 0
xor esi, esi
cmp dword [ebp + 8], esi
je 0x405bc2
cmp dword [ebp - 8], esi
jne 0x405b84
inc dword [0x7a8b08]
jmp 0x405bc2
push edi
call fcn.00406558
test eax, eax
je 0x405bc2
push edi
call fcn.00405bc9
mov eax, dword [ebp - 4]
or al, 1
push eax
push edi
call fcn.004059be
test eax, eax
jne 0x405bba
cmp dword [ebp - 4], esi
je 0x405b7c
push edi
push 0xfffffffffffffff1
call fcn.00405374
push esi
push edi
call fcn.004060b6
jmp 0x405bc2
push edi
push 0xffffffffffffffe5
call fcn.00405374
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4011d0
Capabilities:
Query or enumerate registry value

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [edi]
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x10]
push esi
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
push eax
push 0
mov dword [edi], 0
mov eax, dword [ecx]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401237
mov eax, dword [esp + 0x10]
cmp eax, 1
je 0x401213
cmp eax, 2
jne 0x401226
test esi, esi
mov eax, dword [esp + 0x14]
je 0x401233
test eax, eax
je 0x401230
cmp byte [eax + esi - 1], 0
je 0x401233
pop edi
mov eax, 0xd
pop esi
ret 0xc
mov byte [esi], 0
mov dword [edi], eax
xor eax, eax
pop edi
pop esi
ret 0xc

Function at 0x4017d0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x34
mov eax, dword [0x42dc40]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
mov ebx, dword [esp + 0x3c]
push esi
mov esi, dword [esp + 0x44]
push str.SOFTWARECyberscienceLauncher
lea eax, [esp + 0x14]
push 0x28
push eax
call fcn.004118e3
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0xc]
push edx
push 0
push 0x2001f
push 0
push 0
push 0
lea eax, [esp + 0x2c]
push eax
push SysReAllocStringLen
mov dword [esp + 0x2c], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x401866
test esi, esi
push edi
mov edi, dword [esp + 0xc]
jne 0x401842
push 0x80004005
call fcn.004010e0
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
push esi
push 1
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test edi, edi
je 0x401865
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov ecx, dword [esp + 0x38]
pop esi
pop ebx
xor ecx, esp
call fcn.0041133e
add esp, 0x34
ret

Function at 0x401880
Capabilities:
Delete registry value

Disassembly:
sub esp, 0x438
mov eax, dword [0x42dc40]
xor eax, esp
mov dword [esp + 0x434], eax
push edi
push str.SOFTWARECyberscienceLauncher
lea eax, [esp + 0x10]
push 0x28
push eax
xor edi, edi
call fcn.004118e3
add esp, 0xc
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 8]
push edx
push edi
push 0x2001f
push edi
push edi
push edi
lea eax, [esp + 0x28]
push eax
push SysReAllocStringLen
mov dword [esp + 0x28], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40192a
push esi
mov esi, dword [esp + 8]
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x3c]
push edx
push str.Destination
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], 0x401
call fcn.004011d0
test eax, eax
jne 0x40191e
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push str.Destination
push esi
lea edi, [eax + 1]
call ebx
push str.DestinationLeaf
push esi
call ebx
pop ebx
test esi, esi
je 0x401929
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov ecx, dword [esp + 0x438]
mov eax, edi
pop edi
xor ecx, esp
call fcn.0041133e
add esp, 0x438
ret