joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bfec5
Capabilities:
Create thread

Disassembly:
push 0
mov eax, 0x54678b
call fcn.0051f1dc
xor edi, edi
cmp dword [0x5a3350], edi
je 0x4bff8e
cmp dword [0x5a4bac], 0xfffffffe
jne 0x4bff7b
cmp dword [ebp + 8], 0xffffffff
je 0x4bff8e
test byte [0x5ad144], 1
mov esi, 0x5ad124
jne 0x4bff24
or dword [0x5ad144], 1
mov ecx, esi
mov dword [ebp - 4], edi
call fcn.0042bfba
push 0x551fd4
call fcn.0051e59a
or dword [ebp - 4], 0xffffffff
pop ecx
mov ecx, esi
call fcn.0042c012
cmp dword [0x5ad120], edi
je 0x4bff38
call fcn.0041f5a0
push edi
push edi
push 0x4bfe6d
call fcn.0052418f
add esp, 0xc
mov dword [0x5ad120], eax
cmp eax, edi
jbe 0x4bff68
cmp eax, 0xffffffff
je 0x4bff68
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [ebp + 8]
mov dword [0x5a4bac], eax
jmp 0x4bff6e
mov dword [0x5ad120], edi
push 0x5ad12c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x4bff8e
mov eax, dword [ebp + 8]
mov dword [0x5a4bac], eax
cmp eax, 0xffffffff
jne 0x4bff8e
mov dword [0x5ad120], edi
call fcn.0051f2b4
ret

Function at 0x4c15a3
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x5a68a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x20c]
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x20c], esi
mov dword [ebp - 0x208], esi
call fcn.004c1051
mov ebx, eax
cmp ebx, esi
je 0x4c1610
lea ecx, [ebp - 0x20c]
call fcn.0043b627
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051c801
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x4c162e
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0x20c]
call fcn.004c15a3
cmp eax, esi
jne 0x4c1675
lea eax, [ebp - 0x21c]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x204]
push eax
push esi
push dword [ebp - 0x20c]
mov dword [ebp - 0x210], 0x100
call ebx
test eax, eax
je 0x4c1618
lea ecx, [ebp - 0x20c]
call fcn.0043b627
push dword [ebp - 0x214]
mov ecx, edi
call fcn.004c0ff2
lea ecx, [ebp - 0x20c]
mov esi, eax
call fcn.0043b627
mov eax, esi
jmp 0x4c15ff
Function at 0x4d2f76
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [ebp + 0xc], 0x20
push ebx
mov ebx, ecx
jne 0x4d2fc7
lea eax, [ebp - 0x18]
push eax
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x18]
add eax, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x14]
add eax, 0x17
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
mov ecx, ebx
call fcn.004d294a
mov ecx, ebx
call fcn.004d2eee
push 2
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_KillTimer]
xor eax, eax
jmp 0x4d301d
xor eax, eax
cmp dword [ebx + 0x2e4], eax
jne 0x4d2fe2
cmp dword [ebp + 0xc], 0x79
je 0x4d2fdd
cmp dword [ebp + 0xc], 0x12
jne 0x4d301d
xor eax, eax
inc eax
jmp 0x4d301d
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
push 0x11
call esi
movzx edi, ax
shr edi, 0xf
push 0x10
and edi, 1
call esi
mov esi, dword [ebp + 0xc]
shr eax, 0xf
and eax, 1
cmp esi, 0x12
je 0x4d3022
cmp esi, 0x79
je 0x4d3022
push 2
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_KillTimer]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x5abd44], 0
jne 0x4d3019
test byte [ebx + 0x2f4], 2
jne 0x4d3019
cmp esi, 0x12
je 0x4d3046
cmp esi, 0x79
jne 0x4d3019
test edi, edi
jne 0x4d3019
test eax, eax
jne 0x4d3019
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call fcn.004252f4
cmp eax, ebx
jne 0x4d3069
test dword [ebp + 0x10], 0x40000000
jne 0x4d3069
cmp esi, 0x79
jne 0x4d3077
mov ecx, dword [ebp + 8]
jmp 0x4d3070
cmp esi, 0x79
jne 0x4d3077
mov ecx, ebx
call fcn.004289e5
jmp 0x4d3092
cmp dword [ebx + 0x2a0], 0
jge 0x4d3092
push 0
push 0xc8
push 2
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_SetTimer]
xor eax, eax
inc eax
jmp 0x4d301b
Function at 0x4d5705
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push 0x74
mov eax, 0x547745
call fcn.0051f245
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x80], eax
call fcn.0040a290
mov esi, dword [ebp + 0xc]
xor edi, edi
mov dword [ebp - 4], edi
cmp esi, 0x13
jne 0x4d5733
push 0x56a610
jmp 0x4d5776
push 0x66
lea eax, [ebp - 0x78]
push edi
push eax
call fcn.0051fb60
add esp, 0xc
push edi
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push edi
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyExW]
shl eax, 0x10
add esi, 0xffffffdf
or eax, 1
cmp esi, 0xe
ja 0x4d5765
or eax, 0x1000000
push 0x32
lea ecx, [ebp - 0x78]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
lea eax, [ebp - 0x78]
push eax
lea ecx, [ebp - 0x7c]
call fcn.0040aaa0
lea ecx, [ebp - 0x7c]
call fcn.00404f20
mov esi, dword [ebp - 0x7c]
cmp dword [esi - 0xc], edi
jle 0x4d57c7
push edi
lea ecx, [ebp - 0x7c]
call fcn.0042c4c8
movzx ebx, ax
push ebx
call dword [sym.imp.USER32.dll_IsCharLowerW]
test eax, eax
jne 0x4d57ad
inc edi
cmp edi, dword [esi - 0xc]
jl 0x4d578e
jmp 0x4d57c7
movzx eax, bx
push eax
call fcn.00524062
pop ecx
movzx eax, ax
push eax
push edi
lea ecx, [ebp - 0x7c]
call fcn.0049672f
mov esi, dword [ebp - 0x7c]
push dword [esi - 0xc]
mov ecx, dword [ebp - 0x80]
push esi
call fcn.0040a2f0
cmp dword [ebp + 0x10], 0
jne 0x4d57e3
mov ecx, dword [ebp - 0x80]
push 0x2b
call fcn.0041ef76
lea ecx, [esi - 0x10]
call fcn.0040a830
call fcn.0051f2c8
ret 0xc
Function at 0x4df0ce
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx + 4], 0x20a
push esi
mov esi, ecx
jne 0x4df118
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
test ecx, ecx
je 0x4df118
call fcn.004de989
test eax, eax
je 0x4df118
push dword [ebx + 0xc]
mov eax, dword [esi + 0x54]
push dword [ebx + 8]
mov ecx, dword [eax + 0xb4]
push dword [ebx + 4]
call fcn.004125c0
xor eax, eax
inc eax
jmp 0x4df330
cmp dword [ebx + 4], 0x100
push edi
jne 0x4df327
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
call edi
test ax, ax
jl 0x4df215
push 0x11
call edi
test ax, ax
jl 0x4df215
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
test ecx, ecx
je 0x4df215
mov eax, dword [ebx + 8]
cmp eax, 0xd
je 0x4df188
cmp eax, 0x20
jbe 0x4df215
cmp eax, 0x24
jbe 0x4df17b
cmp eax, 0x26
je 0x4df17b
cmp eax, 0x28
jne 0x4df215
call fcn.004de989
test eax, eax
je 0x4df215
mov ecx, esi
call fcn.004289e5
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
call fcn.004de989
test eax, eax
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
je 0x4df1bd
push dword [ebx + 0xc]
push dword [ebx + 8]
push dword [ebx + 4]
call fcn.004125c0
jmp 0x4df322
call fcn.00426981
test eax, eax
je 0x4df322
mov eax, dword [esi + 0x54]
add eax, 0xb8
push eax
mov ecx, esi
call fcn.004269b9
mov eax, dword [esi + 0x54]
mov eax, dword [eax + 0xb4]
test eax, eax
jne 0x4df1eb
xor edi, edi
jmp 0x4df1ee
mov edi, dword [eax + 0x20]
mov esi, dword [esi + 0x54]
mov ecx, dword [esi + 0xb4]
movzx esi, word [esi + 0x20]
call fcn.00426981
push edi
push esi
push 0x111
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x4df322
mov eax, dword [ebx + 8]
sub eax, 9
je 0x4df2f1
sub eax, 0x12
je 0x4df2c9
sub eax, 0xb
je 0x4df237
dec eax
dec eax
jne 0x4df327
push 0x12
call edi
test ax, ax
jl 0x4df327
push 0x11
call edi
test ax, ax
jl 0x4df327
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
test ecx, ecx
je 0x4df327
call fcn.004de989
test eax, eax
jne 0x4df322
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
push 1
call fcn.004de903
mov eax, dword [esi + 0x54]
mov eax, dword [eax + 0xb4]
push dword [eax + 0x20]
mov edi, dword [sym.imp.USER32.dll_GetParent]
call edi
push eax
call fcn.004252f4
test eax, eax
je 0x4df322
mov esi, dword [esi + 0x54]
lea ebx, [esi + 0x90]
mov esi, dword [esi + 0xb4]
push dword [esi + 0x20]
call edi
push eax
call fcn.004252f4
push 1
push ebx
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x4df322
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
test ecx, ecx
je 0x4df2dd
push 0
call fcn.004de903
mov ecx, esi
call fcn.0042644f
test eax, eax
je 0x4df327
mov ecx, esi
call fcn.0042644f
jmp 0x4df31b
push dword [esi + 0x20]
mov edi, dword [sym.imp.USER32.dll_GetParent]
call edi
push eax
call fcn.004252f4
test eax, eax
je 0x4df327
push dword [esi + 0x20]
call edi
push eax
call fcn.004252f4
push 0
push esi
mov ecx, eax
call fcn.0042e2c7
mov ecx, eax
call fcn.004289e5
xor eax, eax
inc eax
jmp 0x4df32f
push ebx
mov ecx, esi
call fcn.00423058
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x4ef5ff
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
test byte [esi + 4], 1
push edi
mov ebx, ecx
je 0x4ef617
mov edi, dword [esi + 0xc]
jmp 0x4ef657
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x4ef630
call fcn.0042a8ad
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x4ef645
call fcn.0042a8ad
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x4ef657
call fcn.0042a8ad
call fcn.004205a9
cmp dword [eax + 0x3c], 0
je 0x4ef66c
push edi
mov ecx, ebx
call fcn.004ee450
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.004ef525
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x5c]
test eax, eax
je 0x4ef68a
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
and dword [ebx + 0x5c], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x4ef696
mov edi, eax
mov dword [ebx + 0x5c], eax
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x4fe826
Capabilities:
Get common file path

Disassembly:
push 0x224
mov eax, 0x549278
call fcn.0051f245
mov esi, ecx
mov dword [ebp - 0x22c], esi
call fcn.004d7ff0
push 0x15c
call fcn.0041eb8c
pop ecx
mov ecx, eax
mov dword [ebp - 0x228], ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp ecx, ebx
je 0x4fe86a
mov eax, dword [esi + 4]
push ebx
push eax
call fcn.004f1fd4
jmp 0x4fe86c
xor eax, eax
or dword [ebp - 4], 0xffffffff
push eax
mov ecx, esi
call fcn.004d7fc2
call fcn.004205a9
mov eax, dword [eax + 4]
mov edi, dword [eax + 0x88]
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
push 0x5c
pop eax
mov word [ebp + esi*2 - 0x218], ax
inc esi
xor eax, eax
mov dword [ebp - 0x228], esi
mov word [ebp + esi*2 - 0x218], ax
mov dword [ebp - 0x224], ebx
cmp edi, ebx
je 0x4fea0c
cmp dword [edi + 4], ebx
jle 0x4fea0c
lea ecx, [ebp - 0x21c]
call fcn.0040a290
mov edx, dword [edi]
xor eax, eax
inc eax
push eax
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x218]
push eax
push ebx
lea eax, [ebp - 0x21c]
push eax
mov ecx, edi
call dword [edx + 8]
test eax, eax
je 0x4fe9f0
lea ecx, [ebp - 0x220]
call fcn.0040a290
mov eax, dword [ebp - 0x224]
mov byte [ebp - 4], 2
cmp eax, 9
jne 0x4fe941
push dword [ebp - 0x21c]
lea eax, [ebp - 0x220]
push str.10__s
push eax
call fcn.0040a270
add esp, 0xc
jmp 0x4fe973
jge 0x4fe961
push dword [ebp - 0x21c]
inc eax
push eax
lea eax, [ebp - 0x220]
push str._d__s
push eax
call fcn.0040a270
add esp, 0x10
jmp 0x4fe973
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x220]
call fcn.0040a4c0
push 0x15c
call fcn.0041eb8c
pop ecx
mov dword [ebp - 0x230], eax
mov byte [ebp - 4], 3
test eax, eax
je 0x4fe997
mov ecx, eax
call fcn.004707a9
mov esi, eax
jmp 0x4fe999
xor esi, esi
push dword [ebp - 0x220]
mov eax, dword [esi]
mov ecx, esi
mov byte [ebp - 4], 2
call dword [eax + 0x10]
mov eax, dword [esi]
lea ecx, [ebx + 0xe110]
push ecx
mov ecx, esi
call dword [eax + 0xc]
push ebx
mov ecx, edi
call fcn.0043ba97
mov eax, dword [eax]
mov edx, dword [esi]
push eax
mov ecx, esi
call dword [edx + 0x24]
mov ecx, dword [ebp - 0x22c]
push esi
call fcn.004d7fc2
mov ecx, dword [ebp - 0x220]
inc dword [ebp - 0x224]
add ecx, 0xfffffff0
call fcn.0040a830
mov esi, dword [ebp - 0x228]
mov ecx, dword [ebp - 0x21c]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.0040a830
inc ebx
cmp ebx, dword [edi + 4]
jl 0x4fe8da
call fcn.0051f2c8
ret

Function at 0x5178de
Capabilities:
Log keystrokes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi]
push edi
call dword [eax + 0x150]
mov edi, eax
movzx eax, word [ebp + 8]
push 2
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
cmp byte [ebp + 0xc], 0
movzx eax, ax
jne 0x517923
test edi, edi
jl 0x517923
cmp ax, 0x20
je 0x517918
cmp word [ebp + 8], 0x71
jne 0x517923
mov eax, dword [esi]
push edi
mov ecx, esi
call dword [eax + 0x168]
pop edi
pop esi
pop ebp
ret 8

Function at 0x51c801
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5a68a0]
jne 0x51c80b
repz ret
jmp fcn.005253e6
Function at 0x534bb8
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00524d4a
and dword [ebp - 4], 0
cmp dword [0x5aee74], 0
mov ebx, eax
jne 0x534c69
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x534d1a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x534d1a
push eax
call fcn.00524cd8
mov dword [esp], 0x57b534
push edi
mov dword [0x5aee74], eax
call esi
push eax
call fcn.00524cd8
mov dword [esp], 0x57b520
push edi
mov dword [0x5aee78], eax
call esi
push eax
call fcn.00524cd8
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x5aee7c], eax
call esi
push eax
call fcn.00524cd8
pop ecx
mov dword [0x5aee84], eax
test eax, eax
je 0x534c69
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00524cd8
pop ecx
mov dword [0x5aee80], eax
mov eax, dword [0x5aee80]
cmp eax, ebx
je 0x534cc1
cmp dword [0x5aee84], ebx
je 0x534cc1
push eax
call fcn.00524d53
push dword [0x5aee84]
mov esi, eax
call fcn.00524d53
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x534cc1
test edi, edi
je 0x534cc1
call esi
test eax, eax
je 0x534cb8
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x534cb8
test byte [ebp - 0xc], 1
jne 0x534cc1
or dword [ebp + 0x10], 0x200000
jmp 0x534cfa
mov eax, dword [0x5aee78]
cmp eax, ebx
je 0x534cfa
push eax
call fcn.00524d53
pop ecx
test eax, eax
je 0x534cfa
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x534cfa
mov eax, dword [0x5aee7c]
cmp eax, ebx
je 0x534cfa
push eax
call fcn.00524d53
pop ecx
test eax, eax
je 0x534cfa
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x5aee74]
call fcn.00524d53
pop ecx
test eax, eax
je 0x534d1a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x534d1c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401201
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x5208
call fcn.0040bd10
push esi
push edi
xor edi, edi
mov esi, ecx
push edi
push 0x80
push 3
push edi
push 3
push 0xc0000000
push 0x417118
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
cmp eax, 0xffffffff
mov dword [esi], eax
je 0x401304
push ebx
mov dword [ebp - 4], edi
lea eax, [ebp - 4]
push edi
push eax
lea eax, [ebp - 0x5208]
push 0x5000
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov ebx, eax
lea eax, [ebp - 0x208]
push 0x417114
push eax
mov word [ebp - 0x208], di
call fcn.0040b7e3
pop ecx
cmp ebx, edi
pop ecx
je 0x4012fb
mov eax, dword [ebp - 4]
push dword [ebp - 4]
shr eax, 1
mov word [ebp + eax*2 - 0x5208], di
lea eax, [ebp - 0x5208]
push eax
call fcn.00401412
mov ecx, eax
call fcn.00401033
cmp eax, edi
je 0x4012b2
mov edx, dword [eax]
lea ecx, [ebp - 0x208]
push ecx
mov ecx, eax
call dword [edx + 4]
jmp 0x4012cc
lea eax, [ebp - 0x208]
push str._9999
push eax
mov word [ebp - 0x208], di
call fcn.0040b7e3
pop ecx
pop ecx
lea eax, [ebp - 8]
push edi
push eax
lea eax, [ebp - 0x208]
push eax
mov dword [ebp - 8], edi
call fcn.0040b7c6
pop ecx
shl eax, 1
push eax
lea eax, [ebp - 0x208]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
jne 0x40123e
push dword [esi]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop ebx
pop edi
pop esi
leave
ret

Function at 0x401368
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
push edi
xor edi, edi
cmp ecx, edi
je 0x4013af
mov eax, dword [ecx]
lea edx, [ebp - 4]
push edx
lea edx, [ebp - 0x310]
push edx
call dword [eax + 8]
lea eax, [ebp - 8]
push edi
push eax
mov eax, dword [ebp - 4]
add eax, eax
mov dword [ebp - 8], edi
push eax
lea eax, [ebp - 0x310]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
jne 0x4013b3
xor al, al
jmp 0x4013f4
lea eax, [ebp + 8]
push edi
push eax
lea eax, [ebp - 0x108]
push 0xfe
push eax
push dword [esi]
mov dword [ebp + 8], edi
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov eax, dword [ebp + 8]
shr eax, 1
cmp dword [ebp + 0xc], edi
mov word [ebp + eax*2 - 0x108], di
je 0x4013f2
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0xc]
call fcn.0040b80d
pop ecx
pop ecx
mov al, 1
pop edi
pop esi
leave
ret 8

Function at 0x4016aa
Capabilities:
Persist via run registry key

Disassembly:
cmp byte [esp + 4], 0
je 0x4016cc
push dword [esp + 0xc]
push dword [esp + 0xc]
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push SysReAllocString
call fcn.004029a5
add esp, 0x10
ret
push dword [esp + 8]
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push SysReAllocString
call fcn.00402a3a
add esp, 0xc
ret
Function at 0x401e1d
Capabilities:
Create directory
Delete file

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call fcn.00402fc1
push dword [esp + 0x10]
push esi
push 0x4177fc
push esi
call fcn.0040bd3f
add esp, 0x14
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x401e61
push esi
call fcn.00402bb6
test al, al
pop ecx
je 0x401e58
push esi
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
pop esi
ret

Function at 0x402179
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push ebx
push esi
mov esi, ecx
call fcn.0040216d
test al, al
je 0x402248
lea eax, [ebp - 4]
xor ebx, ebx
push eax
mov eax, dword [esi + 0x19004]
shr eax, 1
push eax
push esi
mov dword [ebp - 4], ebx
call fcn.00402048
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
add esp, 0xc
cmp byte [eax], bl
je 0x402248
push edi
mov edi, dword [ebp + 8]
lea eax, [edi + 0x1340]
push eax
lea eax, [ebp - 0x410]
push str._sinit.xml
push eax
call fcn.0040bd3f
add esp, 0xc
lea eax, [ebp - 0x410]
push ebx
push ebx
push 2
push ebx
push ebx
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x402215
lea eax, [ebp + 8]
push ebx
push eax
push dword [ebp - 8]
push dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x40223e
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
lea eax, [ebp - 0x208]
push str.createInitXml__d
push eax
call fcn.0040bd3f
add esp, 0xc
lea eax, [ebp - 0x208]
mov ecx, edi
push eax
call fcn.00402368
push dword [ebp - 4]
call fcn.0040b5d6
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x402586
Capabilities:
Create process on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp word [esi], 0
je 0x4025eb
push str.Execute_process_NO_WAIT__cmd:
call fcn.004072ab
mov ecx, eax
call fcn.004072b1
push esi
call fcn.004072ab
mov ecx, eax
call fcn.004072b1
push str.__param:
call fcn.004072ab
mov ecx, eax
call fcn.004072b1
push dword [esp + 0xc]
call fcn.004072ab
mov ecx, eax
call fcn.004072b1
push 1
push 0
push dword [esp + 0x14]
push esi
push str.open
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop esi
ret
Function at 0x4025fb
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push esi
push edi
push 0x44
pop edi
push edi
push 0x40
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov esi, eax
mov eax, dword [ebp + 0xc]
neg eax
sbb eax, eax
mov dword [ebp - 4], 0xfffffffb
and al, 0xf6
mov dword [esi], edi
add eax, 0xa
xor edi, edi
mov word [esi + 0x30], ax
mov eax, dword [ebp + 0x14]
push str.Execute_process__WAIT_cmd:
mov dword [esi + 0x2c], 0x101
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edi
mov dword [esi + 0x38], edi
call fcn.004072ab
mov ecx, eax
call fcn.004072b1
push dword [ebp + 8]
call fcn.004072ab
mov ecx, eax
call fcn.004072b1
lea eax, [ebp - 0x14]
push eax
push esi
push edi
push edi
push edi
push 1
push edi
push edi
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
test eax, eax
je 0x4026f0
push 0xc8
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0xffffffffffffffff
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push str.End_waiting_process_:
call fcn.004072ab
mov ecx, eax
call fcn.004072b1
push dword [ebp + 8]
call fcn.004072ab
mov ecx, eax
call fcn.004072b1
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
test eax, eax
je 0x4026e0
cmp dword [ebp - 4], 0x103
jne 0x4026e7
push 0xffffffffffffffff
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
mov dword [ebp - 4], 0xfffffffc
jmp 0x4026e7
mov dword [ebp - 4], 0xfffffffe
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp dword [ebp - 4], edi
pop edi
pop esi
je 0x402721
push dword [ebp - 4]
lea eax, [ebp - 0x214]
push str.Exit_code_is__d
push eax
call fcn.0040bd3f
add esp, 0xc
lea eax, [ebp - 0x214]
push eax
call fcn.004072ab
mov ecx, eax
call fcn.004072c2
mov eax, dword [ebp - 4]
leave
ret

Function at 0x402726
Capabilities:
Create pipe
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push 0xc
lea eax, [ebp - 0x18]
pop esi
push esi
push 0
push eax
call fcn.0040c160
add esp, 0xc
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], 1
push 0
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.DLL_CreatePipe]
push dword [ebp - 8]
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004025fb
push dword [ebp + 0x14]
mov ebx, eax
push 0
push dword [ebp + 0x10]
call fcn.0040c160
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
add esp, 0x1c
push dword [ebp - 8]
call esi
lea eax, [ebp - 0xc]
push 0
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push dword [ebp - 4]
call esi
mov eax, ebx
pop esi
pop ebx
leave
ret