joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6bed20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x6bed58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0x6bed60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x6bed94
mov eax, dword [esp + 0x14]
test eax, eax
je 0x6bed94
push eax
push esi
call fcn.006c120b
add esp, 8
pop esi
ret 0x10

Function at 0x6beda0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x6bee22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0x6bee15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0x6d7320
push ecx
mov dword [esp + 0x1c], 4
call fcn.006c0dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0x6bedda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0x6bee30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x6beec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0x6beeb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0x6d7320
push ecx
mov dword [esp + 0x1c], 4
call fcn.006c0dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x6beeab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0x6bee6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0x6bf000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x6bf131
push esi
call fcn.006c2145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.006b1080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x6bf131
push 0
push ebp
call fcn.006b13a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.006b1260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x6bf08b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.006b12f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x6bf121
push 0x6d7918
push edi
call fcn.006c03f0
push eax
push ebx
push esi
call fcn.006bef60
push 0x6d78f8
push edi
call fcn.006c03f0
push eax
push ebx
push esi
call fcn.006bef60
push 0x6d78d8
push edi
call fcn.006c03f0
push eax
push ebx
push esi
call fcn.006bef60
push 0x6d78c0
push edi
call fcn.006c03f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.006bef60
push 0x6d78a0
push edi
call fcn.006c03f0
push eax
push ebx
push esi
call fcn.006bef60
push 0x6d7888
push edi
call fcn.006c03f0
push eax
push ebx
push esi
call fcn.006bef60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x6c01b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.006c0140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.006c0140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.006c0140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.006c0140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x6c0bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6c0c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x6d287c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x6c0c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x6c0c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x4012c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4012db
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401314
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x401310
jmp 0x401300
cmp esi, eax
jae 0x401314
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401300
cmp esi, eax
jb 0x40131b
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x401c90
Capabilities:
Encode data using xor
Get file size
Read file on windows
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2001c
call fcn.004292a0
mov eax, dword [0x44e6d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, edx
push 0x2460
mov esi, ecx
mov dword [ebp - 0x2001c], ebx
call fcn.0042559c
add esp, 4
xor edi, edi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push edi
push edi
push 3
push edi
push edi
push SysReAllocStringLen
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x20010], esi
mov dword [0x44fa70], edi
cmp esi, 0xffffffff
je 0x401e37
push edi
push edi
push 2
push edi
push edi
push 0x40000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x20018], eax
cmp eax, 0xffffffff
je 0x401e30
lea eax, [ebp - 0x20008]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, eax
mov dword [ebp - 0x20014], ecx
mov dword [ebp - 0x2000c], 1
test ecx, ecx
je 0x401df9
lea ecx, [ecx]
cmp dword [ebp - 0x2000c], 0
je 0x401df9
mov edi, 0x20000
mov dword [ebp - 0x2000c], 0
cmp ecx, edi
jae 0x401d62
mov edi, ecx
push 0
lea ecx, [ebp - 0x20008]
push ecx
push edi
lea edx, [ebp - 0x20004]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x401dd9
mov eax, dword [ebp - 0x20008]
cmp eax, edi
jne 0x401ddf
xor esi, esi
mov ebx, eax
test eax, eax
jbe 0x401da1
call fcn.004255ae
xor byte [ebp + esi - 0x20004], al
inc esi
cmp esi, ebx
jb 0x401d90
mov edx, dword [ebp - 0x20018]
push 0
lea eax, [ebp - 0x20008]
push eax
push edi
lea ecx, [ebp - 0x20004]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x401dd9
mov eax, dword [ebp - 0x20008]
cmp eax, edi
jne 0x401ddf
mov dword [ebp - 0x2000c], 1
jmp 0x401ddf
mov eax, dword [ebp - 0x20008]
mov ecx, dword [ebp - 0x20014]
mov esi, dword [ebp - 0x20010]
sub ecx, eax
mov dword [ebp - 0x20014], ecx
jne 0x401d40
mov eax, dword [ebp - 0x20018]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x2001c]
push 0
push 0x4000000
push 3
push 0
push 1
push SysReAllocStringLen
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, dword [ebp - 0x2000c]
mov dword [0x44fa70], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00425324
mov esp, ebp
pop ebp
ret
Function at 0x401e50
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20cc
call fcn.004292a0
mov eax, dword [0x44e6d0]
xor eax, ebp
mov dword [ebp - 4], eax
lea edx, [ebp - 0x10cc]
mov eax, ebx
sub edx, ebx
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x401e71
push esi
push edi
lea edi, [ebp - 0x10cc]
add edi, 0xfffffffe
jmp 0x401e90
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x401e90
mov eax, dword [0x443f70]
mov dword [edi], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.0042559c
add esp, 4
xor esi, esi
call fcn.004255ae
cdq
mov ecx, 0x1a
idiv ecx
inc esi
add edx, 0x61
cmp esi, 6
mov word [ebp + esi*2 - 0xce], dx
jl 0x401eb4
xor edx, edx
lea eax, [ebp - 0xcc]
mov word [ebp - 0xc0], dx
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401ee3
lea edi, [ebp - 0x10cc]
sub eax, edx
add edi, 0xfffffffe
lea esp, [esp]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x401f00
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea edx, [ebp - 0x20cc]
rep movsb byte es:[edi], byte [esi]
mov eax, ebx
sub edx, ebx
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x401f26
push 0x452960
push 1
push 0x443f74
push 0x443f80
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
lea eax, [ebp - 0x20cc]
je 0x40202b
add eax, 0xfffffffe
lea ecx, [ecx]
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x401f60
mov ecx, dword [str.lclz]
mov edx, dword [0x443f98]
mov dword [eax], ecx
mov ecx, dword [0x443f9c]
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
lea eax, [ebp - 0x10cc]
add eax, 0xfffffffe
nop
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x401f90
mov edx, dword [str..dat]
mov ecx, dword [0x443fa4]
mov dword [eax], edx
mov dx, word [0x443fa8]
mov dword [eax + 4], ecx
mov word [eax + 8], dx
lea edx, [ebp - 0x10cc]
lea ecx, [ebp - 0x20cc]
call fcn.00401c90
test eax, eax
je 0x402088
lea eax, [ebp - 0x10cc]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x459a88], eax
test eax, eax
jne 0x40207e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error:__d
lea edx, [ebp - 0xcc]
call fcn.00402350
add esp, 8
push pe_nt_image_headers32
push str.lclz_not_loaded
lea ecx, [ebp - 0xcc]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00425324
mov esp, ebp
pop ebp
ret
add eax, 0xfffffffe
mov edi, edi
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x402030
mov edx, dword [str.lang.dll]
mov ecx, dword [0x443fe4]
mov dword [eax], edx
mov edx, dword [0x443fe8]
mov dword [eax + 4], ecx
mov ecx, dword [0x443fec]
mov dword [eax + 8], edx
mov edx, dword [0x443ff0]
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], edx
lea eax, [ebp - 0x20cc]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x459a88], eax
test eax, eax
je 0x402088
mov esi, eax
call fcn.00412214
mov dword [eax + 0xc], esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00425324
mov esp, ebp
pop ebp
ret
Function at 0x402100
Capabilities:
Create thread
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1484
call fcn.004292a0
mov eax, dword [0x44e6d0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push 0
mov dword [ebp - 0x1008], ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x1004]
push 0x5c
push ecx
call fcn.004256f6
add esp, 8
test eax, eax
je 0x40214b
xor edx, edx
mov word [eax], dx
xor eax, eax
lea ecx, [ecx]
movzx ecx, word [ebp + eax - 0x1004]
mov word [eax + 0x452960], cx
add eax, 2
test cx, cx
jne 0x402150
push ebx
push esi
push edi
mov edi, 0x452960
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x402172
mov eax, dword [0x443f70]
mov dword [edi], eax
mov edi, 0x452960
add edi, 0xfffffffe
lea ecx, [ecx]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x402190
mov ecx, 6
mov esi, str.settings.ini
rep movsd dword es:[edi], dword [esi]
lea ebx, [ebp - 0x1004]
movsw word es:[edi], word [esi]
call fcn.00401e50
lea ecx, [ebp - 0x1010]
push ecx
mov dword [ebp - 0x1010], 8
mov dword [ebp - 0x100c], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, dword [ebp - 0x1008]
call fcn.00410a94
mov edx, dword [0x44fa88]
push 0x452960
push edx
push str.FontHeight
push str.Settings
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0x452960
push 0x100
push str.Tahoma
push str.Tahoma
push str.FontName
push str.Settings
mov dword [0x44fa88], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x402310
mov ecx, 0x45ded8
call fcn.0041122f
pop edi
pop esi
pop ebx
test eax, eax
jne 0x402241
call fcn.0040936c
push 0x402310
mov ecx, 0x45ded8
call fcn.0041122f
test eax, eax
jne 0x402259
call fcn.0040936c
push eax
call fcn.00408199
add esp, 4
lea eax, [ebp - 0x1484]
push eax
call fcn.00402b50
push 0
push 0
lea ecx, [ebp - 0x1484]
push ecx
push 0x4020a0
push 0x800000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x402298
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [ebp - 0x1484]
call fcn.00402d00
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.00425324
mov esp, ebp
pop ebp
ret

Function at 0x402820
Capabilities:
Connect network resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
xor eax, eax
push 8
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push edx
mov dword [ebp - 0x10], ecx
push eax
lea ecx, [ebp - 0x24]
push ecx
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x18], 1
call sub.MPR.dll_WNetAddConnection2W
neg eax
sbb eax, eax
inc eax
mov esp, ebp
pop ebp
ret
Function at 0x402870
Capabilities:
Encode data using xor
Get file size
Read file on windows
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2001c
call fcn.004292a0
mov eax, dword [0x44e6d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov ebx, edx
push 0x2460
mov esi, ecx
mov dword [ebp - 0x2001c], ebx
mov dword [ebp - 0x20018], eax
call fcn.0042559c
add esp, 4
xor edi, edi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push edi
push edi
push 3
push edi
push edi
push SysReAllocStringLen
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, dword [ebp - 0x20018]
mov esi, eax
mov dword [ebp - 0x20010], esi
mov dword [ecx], edi
cmp esi, 0xffffffff
je 0x402a27
push edi
push 1
push 2
push edi
push edi
push 0x40000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x45dca8], eax
cmp eax, 0xffffffff
je 0x402a20
lea edx, [ebp - 0x20008]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, eax
mov dword [ebp - 0x20014], ecx
mov dword [ebp - 0x2000c], 1
test ecx, ecx
je 0x4029e9
jmp 0x402930
cmp dword [ebp - 0x2000c], 0
je 0x4029e9
mov ebx, 0x20000
mov dword [ebp - 0x2000c], 0
cmp ecx, ebx
jae 0x402952
mov ebx, ecx
push 0
lea eax, [ebp - 0x20008]
push eax
push ebx
lea ecx, [ebp - 0x20004]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4029c9
mov eax, dword [ebp - 0x20008]
cmp eax, ebx
jne 0x4029cf
xor esi, esi
mov edi, eax
test eax, eax
jbe 0x402991
call fcn.004255ae
xor byte [ebp + esi - 0x20004], al
inc esi
cmp esi, edi
jb 0x402980
mov ecx, dword [0x45dca8]
push 0
lea edx, [ebp - 0x20008]
push edx
push ebx
lea eax, [ebp - 0x20004]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4029c9
mov eax, dword [ebp - 0x20008]
cmp eax, ebx
jne 0x4029cf
mov dword [ebp - 0x2000c], 1
jmp 0x4029cf
mov eax, dword [ebp - 0x20008]
mov ecx, dword [ebp - 0x20014]
mov esi, dword [ebp - 0x20010]
sub ecx, eax
mov dword [ebp - 0x20014], ecx
jne 0x402930
mov edx, dword [0x45dca8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x2001c]
push 0
push 0
push 3
push 0
push 1
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, dword [ebp - 0x20018]
mov edi, dword [ebp - 0x2000c]
mov dword [ecx], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00425324
mov esp, ebp
pop ebp
ret
Function at 0x403080
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x26c
mov eax, dword [0x44e6d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ecx, dword [0x4442d4]
mov eax, dword [0x4442d0]
mov edx, dword [0x4442d8]
mov dword [ebp - 0x18], eax
mov eax, dword [0x4442dc]
mov dword [ebp - 0x14], ecx
mov cx, word [0x4442e0]
mov dword [ebp - 0x10], edx
mov edx, dword [str.CSRSS.EXE]
mov dword [ebp - 0xc], eax
mov eax, dword [0x4442e8]
mov word [ebp - 8], cx
mov ecx, dword [0x4442ec]
mov dword [ebp - 0x2c], edx
mov edx, dword [0x4442f0]
mov dword [ebp - 0x28], eax
mov eax, dword [0x4442f4]
mov dword [ebp - 0x24], ecx
mov ecx, dword [str.LSASS.EXE]
mov dword [ebp - 0x20], edx
mov edx, dword [0x4442fc]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x444300]
mov dword [ebp - 0x40], ecx
mov ecx, dword [0x444304]
mov dword [ebp - 0x3c], edx
mov edx, dword [0x444308]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], edx
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push ebx
push 2
mov edi, eax
mov dword [ebp - 0x26c], 0x22c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x4031c5
lea eax, [ebp - 0x26c]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4031be
mov eax, dword [ebp - 0x264]
test eax, eax
jbe 0x4031a5
cmp eax, edi
je 0x4031a5
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x248]
push edx
call fcn.004258e0
add esp, 8
test eax, eax
je 0x4031b8
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x248]
push ecx
call fcn.004258e0
add esp, 8
test eax, eax
je 0x4031b8
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x248]
push eax
call fcn.004258e0
add esp, 8
test eax, eax
je 0x4031b8
lea ecx, [ebp - 0x26c]
push ecx
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x403152
jmp 0x4031be
mov ebx, dword [ebp - 0x264]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.00425324
mov esp, ebp
pop ebp
ret
Function at 0x4031e0
Capabilities:
Delete file
Enumerate files on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x125c
call fcn.004292a0
mov eax, dword [0x44e6d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
lea esp, [esp]
movzx ecx, word [eax + 0x458a88]
mov word [ebp + eax - 0x1008], cx
add eax, 2
test cx, cx
jne 0x403200
lea eax, [ebp - 0x1008]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x403220
mov ecx, dword [str..]
mov edx, dword [0x444310]
mov dword [eax], ecx
mov cx, word [0x444314]
mov dword [eax + 4], edx
lea edx, [ebp - 0x1258]
mov word [eax + 8], cx
push edx
lea eax, [ebp - 0x1008]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov dword [ebp - 0x125c], esi
cmp esi, 0xffffffff
je 0x40336d
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test byte [ebp - 0x1258], 0x10
jne 0x403350
lea eax, [ebp - 0x122c]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x403290
sub eax, edx
sar eax, 1
cmp eax, 6
jne 0x403350
lea ecx, [ebp - 0x122c]
push 0x2e
push ecx
call fcn.00425722
add esp, 8
test eax, eax
jne 0x403350
movzx ecx, word [eax + 0x458a88]
mov word [ebp + eax - 0x1008], cx
add eax, 2
test cx, cx
jne 0x4032c1
lea edi, [ebp - 0x1008]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4032e1
mov edx, dword [0x443f70]
lea eax, [ebp - 0x122c]
mov dword [edi], edx
mov edx, eax
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x403300
lea edi, [ebp - 0x1008]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x403316
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
lea eax, [ebp - 0x1008]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call ebx
lea ecx, [ebp - 0x1008]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, dword [ebp - 0x125c]
lea edx, [ebp - 0x1258]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x403273
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00425324
mov esp, ebp
pop ebp
ret

Function at 0x403380
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.004292a0
mov eax, dword [0x44e6d0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x452960
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push 0x444318
push str.flags
push 0x44fa30
call esi
cmp dword [0x459a94], 0
jne 0x4033e9
push 0x452960
push 0x1000
push 0x459b00
push 0x443dd0
push 0x44fa50
push 0x44fa30
call esi
lea ecx, [ebp - 0x1004]
push ecx
call fcn.00425989
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop esi
call fcn.00425324
mov esp, ebp
pop ebp
ret