joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42ba8c
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x41fd23
call 0x43c508
push ecx
push ebx
push esi
mov esi, ecx
xor eax, eax
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [ebp - 4], eax
mov dword [esi + 4], eax
mov ecx, dword [ebp + 8]
push 8
mov dword [esi + 8], ecx
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0xc], ecx
lea ecx, [esi + 0x10]
pop edi
mov edx, 0x4224e0
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], edi
mov dword [ecx], edx
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], edi
mov dword [esi + 0x24], edx
lea ebx, [esi + 0x38]
mov edx, 0x4222a8
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], 4
mov dword [ebx], edx
lea edi, [esi + 0x4c]
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], 4
mov dword [edi], edx
push dword [esi + 8]
mov byte [ebp - 4], 5
call 0x4372b2
push dword [esi + 8]
mov ecx, ebx
call 0x4372b2
push dword [esi + 0xc]
mov ecx, edi
call 0x4372b2
push dword [esi + 0xc]
mov ecx, edi
call 0x4372b2
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x42ba98
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x41fd23
call 0x43c508
push ecx
push ebx
push esi
mov esi, ecx
xor eax, eax
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [ebp - 4], eax
mov dword [esi + 4], eax
mov ecx, dword [ebp + 8]
push 8
mov dword [esi + 8], ecx
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0xc], ecx
lea ecx, [esi + 0x10]
pop edi
mov edx, 0x4224e0
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], edi
mov dword [ecx], edx
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], edi
mov dword [esi + 0x24], edx
lea ebx, [esi + 0x38]
mov edx, 0x4222a8
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], 4
mov dword [ebx], edx
lea edi, [esi + 0x4c]
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], 4
mov dword [edi], edx
push dword [esi + 8]
mov byte [ebp - 4], 5
call 0x4372b2
push dword [esi + 8]
mov ecx, ebx
call 0x4372b2
push dword [esi + 0xc]
mov ecx, edi
call 0x4372b2
push dword [esi + 0xc]
mov ecx, edi
call 0x4372b2
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x42ed13
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push edi
xor edi, edi
cmp eax, 5
jae 0x42ed29
xor eax, eax
jmp 0x42ee9f
mov ecx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0x18]
mov edx, ecx
push esi
sub edx, dword [ebx]
cmp edx, 5
jbe 0x42ed3f
lea edx, [ecx - 5]
mov dword [ebx], edx
mov esi, dword [ebp + 0x14]
add eax, 0xfffffffb
mov dword [ebp - 4], eax
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 8]
mov al, byte [edi + edx]
cmp al, 0xe8
je 0x42ed62
cmp al, 0xe9
je 0x42ed62
inc edi
inc dword [ebp + 0xc]
jmp 0x42ee92
mov eax, dword [ebp + 0xc]
mov ecx, edi
sub ecx, dword [ebx]
mov dword [ebx], eax
add ecx, dword [ebp + 0x10]
cmp ecx, 5
jbe 0x42ed78
and dword [esi], 0
jmp 0x42ed88
test ecx, ecx
jbe 0x42ed88
mov eax, dword [esi]
and eax, 0x77
shl eax, 1
dec ecx
mov dword [esi], eax
jne 0x42ed7c
mov cl, byte [edi + edx + 4]
lea eax, [edi + edx + 4]
test cl, cl
je 0x42ed9d
cmp cl, 0xff
jne 0x42ee7a
mov ebx, dword [esi]
mov dword [ebp + 0x14], ebx
shr dword [ebp + 0x14], 1
mov ebx, dword [ebp + 0x14]
and ebx, 7
cmp dword [ebx*4 + 0x422658], 0
je 0x42ee77
mov ebx, dword [esi]
and ebx, 0xfffffffe
cmp ebx, 0x20
jae 0x42ee77
xor ebx, ebx
mov bh, cl
mov bl, byte [edi + edx + 3]
movzx ecx, byte [edi + edx + 2]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [edi + edx + 1]
shl ebx, 8
or ebx, ecx
mov edx, ebx
cmp dword [ebp + 0x1c], 0
je 0x42edf4
mov ecx, dword [ebp + 0xc]
lea ebx, [ecx + edx + 5]
jmp 0x42edfe
sub edx, edi
sub edx, dword [ebp + 0x10]
sub edx, 5
mov ebx, edx
mov ecx, dword [esi]
test ecx, ecx
je 0x42ee41
mov ecx, dword [ebp + 0x14]
push 0x18
movzx ecx, byte [ecx + 0x422678]
shl ecx, 3
mov edx, ecx
pop ecx
sub ecx, edx
mov edx, ebx
shr edx, cl
test dl, dl
je 0x42ee25
cmp dl, 0xff
jne 0x42ee41
mov edx, dword [ebp + 0x14]
push 4
pop ecx
movzx edx, byte [edx + 0x422678]
sub ecx, edx
push 1
shl ecx, 3
pop edx
shl edx, cl
dec edx
xor edx, ebx
jmp 0x42ede5
mov ecx, ebx
add dword [ebp + 0xc], 5
shr ecx, 0x18
and cl, 1
add edi, 5
dec cl
not cl
mov byte [eax], cl
mov eax, dword [ebp + 8]
mov ecx, ebx
shr ecx, 0x10
mov byte [edi + eax - 2], cl
mov ecx, ebx
shr ecx, 8
mov byte [edi + eax - 3], cl
mov byte [edi + eax - 4], bl
and dword [esi], 0
mov ebx, dword [ebp + 0x18]
jmp 0x42ee92
mov ebx, dword [ebp + 0x18]
or dword [esi], 1
mov al, byte [eax]
mov ecx, dword [esi]
inc edi
inc dword [ebp + 0xc]
test al, al
je 0x42ee8d
cmp al, 0xff
jne 0x42ee92
or ecx, 0x10
mov dword [esi], ecx
cmp edi, dword [ebp - 4]
jbe 0x42ed4b
pop esi
mov eax, edi
pop ebx
pop edi
leave
ret 0x18
Function at 0x431d34
Capabilities:
Hash data using sha256

Disassembly:
and dword [ecx + 0x20], 0
and dword [ecx + 0x24], 0
mov dword [ecx], 0x6a09e667
mov dword [ecx + 4], 0xbb67ae85
mov dword [ecx + 8], 0x3c6ef372
mov dword [ecx + 0xc], 0xa54ff53a
mov dword [ecx + 0x10], 0x510e527f
mov dword [ecx + 0x14], 0x9b05688c
mov dword [ecx + 0x18], 0x1f83d9ab
mov dword [ecx + 0x1c], 0x5be0cd19
ret
Function at 0x435c28
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x4208f8
call 0x43c508
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 1
mov eax, dword [esi]
push 0
mov dword [edi], eax
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
mov eax, dword [esi + 0x18]
push 0
mov dword [edi + 0x18], eax
push dword [esi + 0x1c]
call 0x43cef0
mov ecx, dword [esi + 0x20]
xor ebx, ebx
add eax, ecx
lea ecx, [ebp - 0x18]
mov dword [edi + 0x20], eax
lea eax, [esi + 0x2c]
adc edx, ebx
push eax
mov dword [edi + 0x24], edx
call fcn.004322cd
and dword [ebp - 4], ebx
call dword [fcn.00422040]
neg eax
sbb eax, eax
inc eax
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.00435ce8
push eax
lea ecx, [edi + 0x30]
mov byte [ebp - 4], 1
call fcn.00432835
push dword [ebp - 0x24]
and byte [ebp - 4], bl
call main
push dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
call main
mov eax, dword [esi + 0x24]
pop ecx
pop ecx
mov dword [edi + 0x28], eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x10003120
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x11916e8
push 0x1178cd8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
rdtsc
mov esi, eax
mov edi, edx
call ebx
rdtsc
pop ebx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0xffffffff
xor esi, esi
mov edi, dword [ebp - 0x20]
push 1
push esi
push esi
mov eax, dword [ebp - 0x28]
push eax
call fcn.10019560
sub eax, esi
sbb edx, edi
mov ecx, dword [ebp - 0x1c]
sub eax, ecx
sbb edx, esi
mov ecx, dword [ebp - 0x24]
add eax, ecx
adc edx, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10004df0
Capabilities:
Get storage device properties

Disassembly:
mov eax, 0x2820
call fcn.10019950
mov eax, dword [esp + 0x2824]
push ebx
push esi
push edi
push eax
lea ecx, [esp + 0x20]
push 0x1199aac
push ecx
call fcn.1001910f
add esp, 0xc
lea edx, [esp + 0x1c]
push 0
push 0
push 3
push 0
push 3
push 0
push edx
call dword [0x1191318]
mov esi, eax
cmp esi, 0xffffffff
je 0x10004f9d
xor eax, eax
mov ecx, 0x9c4
mov dword [esp + 0x10], eax
lea edi, [esp + 0x11c]
mov dword [esp + 0x14], eax
mov ebx, dword [0x119131c]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
push eax
push ecx
lea edx, [esp + 0x124]
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
push 0x2710
push edx
lea eax, [esp + 0x20]
push 0xc
push eax
push 0x2d1400
push esi
mov dword [esp + 0x2c], 0
call ebx
test eax, eax
je 0x10004f9d
mov ecx, dword [esp + 0x283c]
mov edx, dword [esp + 0x128]
push ecx
push 0
lea eax, [esp + 0x124]
push edx
push eax
call fcn.10004fb0
mov ecx, dword [esp + 0x2848]
mov edx, dword [esp + 0x13c]
push ecx
push 0
lea eax, [esp + 0x134]
push edx
push eax
call fcn.10004fb0
mov ecx, dword [esp + 0x2860]
mov edx, dword [esp + 0x150]
push ecx
push 0
lea eax, [esp + 0x144]
push edx
push eax
call fcn.10004fb0
mov ecx, dword [esp + 0x2864]
mov edx, dword [esp + 0x164]
push ecx
push 1
lea eax, [esp + 0x154]
push edx
push eax
call fcn.10004fb0
mov ecx, dword [esp + 0x2884]
add esp, 0x40
xor eax, eax
lea edi, [esp + 0x11c]
mov dword [ecx], 1
mov ecx, 0x9c4
lea edx, [esp + 0xc]
push eax
rep stosd dword es:[edi], eax
push edx
lea eax, [esp + 0x124]
push 0x2710
push eax
push 0
push 0
push 0x700a0
push esi
call ebx
test eax, eax
je 0x10004f9d
mov edi, dword [esp + 0x124]
mov edx, dword [esp + 0x2848]
mov eax, dword [esp + 0x284c]
xor ecx, ecx
cmp edi, 0xc
push esi
setne cl
inc ecx
mov dword [edx], ecx
mov ecx, dword [esp + 0x138]
mov edx, dword [esp + 0x13c]
mov dword [eax], ecx
mov dword [eax + 4], edx
call dword [0x1191320]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x2820
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x2820
ret
Function at 0x4045f0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x404656
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00403b3c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402860
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x404640
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40465d
lea eax, [ebp - 0x10]
call fcn.004038e8
ret

Function at 0x4067c8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x406801
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004039d8
jmp 0x40680a
mov eax, ebx
mov edx, esi
call fcn.0040393c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x406814
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x406835
mov al, byte [esp]
jmp 0x406837
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40795c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x4079c0
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00403b3c
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00405b7c
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4079c7
lea eax, [ebp - 0xc]
call fcn.004038e8
ret

Function at 0x408a50
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x408a96
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.004089b4
mov eax, dword [ebp - 4]
call fcn.00403cc4
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408a9d
lea eax, [ebp - 4]
call fcn.004038e8
ret
Function at 0x408c90
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x408d1d
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x408cda
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA_1
mov ecx, eax
lea edx, [ebp - 0x108]
mov eax, esi
call fcn.004039d8
jmp 0x408d07
call sub.kernel32.dll_GetCommandLineA_1
cmp byte [eax], 0
jne 0x408cee
lea eax, [ebp - 4]
call fcn.004038e8
jmp 0x408cfd
lea edx, [ebp - 4]
call fcn.00408b60
test ebx, ebx
je 0x408cfd
dec ebx
jmp 0x408cdf
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.0040393c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408d24
lea eax, [ebp - 4]
call fcn.004038e8
ret

Function at 0x408d2c
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
mov eax, esp
call fcn.00405d5c
add esp, 0x104
pop ebx
ret

Function at 0x408e70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x408f91
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 8]
push eax
push 0
push edi
push esi
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x408f7b
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
je 0x408ec9
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x408f7b
cmp dword [ebp - 0xc], 0
jne 0x408ede
mov eax, dword [ebp - 4]
call fcn.004038e8
mov bl, 1
jmp 0x408f7b
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
xor edx, edx
call fcn.004039d8
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
call fcn.00403d14
push eax
lea eax, [ebp - 8]
push eax
push 0
push edi
push esi
call sub.advapi32.dll_RegQueryValueExA_1
cmp eax, 0xea
je 0x408e95
test eax, eax
jne 0x408f7b
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
je 0x408f25
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x408f7b
jmp 0x408f25
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0
je 0x408f38
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
cmp byte [eax + edx - 1], 0
je 0x408f22
cmp dword [ebp - 8], 7
jne 0x408f47
cmp dword [ebp - 0xc], 0
je 0x408f47
inc dword [ebp - 0xc]
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.00403db8
cmp dword [ebp - 8], 7
jne 0x408f6e
cmp dword [ebp - 0xc], 0
je 0x408f6e
lea eax, [ebp - 0x10]
call fcn.00403d14
mov edx, dword [ebp - 0xc]
mov byte [eax + edx - 1], 0
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
call fcn.0040393c
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408f98
lea eax, [ebp - 0x10]
call fcn.004038e8
ret
Function at 0x409930
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x40e7d4
mov eax, esi
mov edx, 8
test al, 1
je 0x40994c
shr eax, 1
xor eax, 0xedb88320
jmp 0x40994e
shr eax, 1
dec edx
jne 0x40993f
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x409938
pop esi
ret

Function at 0x409964
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x40e7d0], 0
jne 0x409987
call fcn.00409930
push 1
push 0x40e7d0
call sub.kernel32.dll_InterlockedExchange
mov eax, edi
test esi, esi
je 0x4099b3
mov edx, ebx
and edx, 0xff
xor ecx, ecx
mov cl, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x40e7d4]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x40998d
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x40b2f4
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.0040b2a8
test al, al
jne 0x40b315
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x40b361
xor eax, eax
push ebp
push 0x40b351
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403cc4
push eax
call sub.kernel32.dll_DeleteFileA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b358
lea eax, [ebp - 0xc]
call fcn.0040b2e4
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40b6a0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x40b6a8
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x40b795
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.00408d58
mov edx, dword [ebp - 8]
mov ecx, 0x40b7ac
xor eax, eax
call fcn.0040b590
push 0
mov eax, dword [ebp - 4]
call fcn.00403cc4
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x40b763
call sub.kernel32.dll_GetLastError
mov ebx, eax
cmp ebx, 0xb7
je 0x40b6c2
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x1c]
mov edx, dword [ebp - 4]
mov al, 0x2f
call fcn.0040b0a0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.00405b54
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x24]
mov eax, ebx
call fcn.0040922c
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x18]
mov ecx, 2
mov al, 0x60
call fcn.0040b070
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x404f5c]
call fcn.00406fb4
call fcn.00403348
jmp 0x40b6c2
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.0040393c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b79c
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.0040390c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040390c
ret
Function at 0x40b7bc
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffffec
mov eax, dword [0x40d500]
cmp dword [eax], 2
jne 0x40b824
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x40b7df
xor eax, eax
jmp 0x40b833
lea eax, [esp + 8]
push eax
push 0x40b838
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [esp + 4], 1
mov dword [esp + 0x10], 2
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError
test eax, eax
je 0x40b824
xor eax, eax
jmp 0x40b833
push 0
push 2
call sub.user32.dll_ExitWindowsEx
cmp eax, 1
sbb eax, eax
inc eax
add esp, 0x14
ret

Function at 0x40b84c
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x40b8a6
inc esi
xor edi, edi
cmp edi, 1
jne 0x40b872
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_Sleep
jmp 0x40b880
cmp edi, 1
jle 0x40b880
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0040b2f4
test eax, eax
jne 0x40b8a6
call sub.kernel32.dll_GetLastError
cmp eax, 2
je 0x40b8a6
call sub.kernel32.dll_GetLastError
cmp eax, 3
je 0x40b8a6
inc edi
dec esi
jne 0x40b862
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x40bb78
Capabilities:
Identify system language via api

Disassembly:
push ebx
push esi
push edi
push ebp
cmp dword [0x40ef40], 0
je 0x40bbc1
mov edi, dword [0x40f07c]
dec edi
test edi, edi
jl 0x40bbc1
inc edi
xor esi, esi
mov eax, esi
shl eax, 4
add eax, esi
mov edx, dword [0x40f078]
mov edx, dword [edx + eax*4]
mov eax, dword [0x40ef40]
call fcn.004059e8
test eax, eax
jne 0x40bbbd
mov eax, esi
call fcn.0040bb2c
jmp 0x40bc86
inc esi
dec edi
jne 0x40bb93
mov al, byte [0x40f064]
sub al, 1
jb 0x40bbce
je 0x40bbd7
jmp 0x40bbe0
call fcn.00408fd8
mov ebp, eax
jmp 0x40bbe2
call sub.kernel32.dll_GetUserDefaultLangID
mov ebp, eax
jmp 0x40bbe2
xor ebp, ebp
test bp, bp
je 0x40bc7f
mov edi, dword [0x40f07c]
dec edi
test edi, edi
jl 0x40bc2e
inc edi
xor esi, esi
mov eax, esi
shl eax, 4
add eax, esi
mov edx, dword [0x40f078]
lea ebx, [edx + eax*4]
movzx eax, bp
cmp eax, dword [ebx + 0x2c]
jne 0x40bc2a
cmp dword [ebx + 0x30], 0
je 0x40bc21
call sub.kernel32.dll_GetACP
cmp eax, dword [ebx + 0x30]
jne 0x40bc2a
mov eax, esi
call fcn.0040bb2c
jmp 0x40bc86
inc esi
dec edi
jne 0x40bbf9
mov edi, dword [0x40f07c]
dec edi
test edi, edi
jl 0x40bc7f
inc edi
xor esi, esi
mov eax, esi
shl eax, 4
add eax, esi
mov edx, dword [0x40f078]
lea ebx, [edx + eax*4]
mov eax, dword [ebx + 0x2c]
and eax, 0x3ff
mov edx, ebp
and dx, 0x3ff
movzx edx, dx
cmp eax, edx
jne 0x40bc7b
cmp dword [ebx + 0x30], 0
je 0x40bc72
call sub.kernel32.dll_GetACP
cmp eax, dword [ebx + 0x30]
jne 0x40bc7b
mov eax, esi
call fcn.0040bb2c
jmp 0x40bc86
inc esi
dec edi
jne 0x40bc3c
xor eax, eax
call fcn.0040bb2c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40bd18
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40bded
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x40be04
push ebx
push 0x40be10
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.00403c28
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00402824
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403cc4
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x40bd98
mov al, 0x62
call fcn.0040b8e8
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle
call fcn.0040bcec
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x40bda1
call fcn.0040bcec
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40bdf4
lea eax, [ebp - 4]
call fcn.004038e8
ret

Function at 0x40beb0
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x40bf64
jmp 0x40bf59
cmp dword [esi + 0x10], 0x1000
jne 0x40bf45
test byte [esi + 0x15], 1
jne 0x40bf45
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x40bf04
cmp eax, 2
je 0x40bf04
cmp eax, 0x10
je 0x40bf04
cmp eax, 0x20
jne 0x40bf19
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x40bf19
mov bl, 1
xor ebp, ebp
jmp 0x40bf2a
mov eax, dword [esi]
add eax, ebp
call fcn.0040bea8
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x40bf1d
test bl, bl
je 0x40bf45
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x40bf64
mov eax, dword [esi + 4]
cmp eax, edi
je 0x40bedc
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret