joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10101ad0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1025e270]
mov dword [ebp - 4], eax
jmp 0x10101ae8
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x10101afe
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x10101afc
mov eax, dword [ebp - 4]
jmp 0x10101b79
jmp 0x10101ae0
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10101b76
mov ecx, dword [ebp - 4]
add ecx, 0x20
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
mov dword [edx + 4], 0
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [ecx + 4], edx
mov eax, dword [ebp - 8]
add eax, 0x20
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 4]
cmp ecx, 0xfe0
jbe 0x10101b38
mov edx, dword [ebp - 4]
mov eax, dword [0x1025e270]
mov dword [edx], eax
mov ecx, dword [ebp - 4]
mov dword [0x1025e270], ecx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x10102080
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
test eax, eax
je 0x101020c9
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + edx]
cmp ecx, 0x90
je 0x101020c9
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + eax]
cmp edx, 0xcc
je 0x101020c9
xor eax, eax
jmp 0x1010210a
mov dword [ebp - 4], 1
jmp 0x101020db
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x10102105
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
mov ecx, 1
imul edx, ecx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + edx]
cmp eax, edx
je 0x10102103
xor eax, eax
jmp 0x1010210a
jmp 0x101020d2
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x101098c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [eax + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 0x78]
test eax, eax
je 0x101098e5
push dword [edi + 0x74]
call eax
add esp, 4
push ebx
push esi
mov esi, dword [edi + 0x54]
test esi, esi
je 0x1010994b
nop
mov ebx, dword [esi + 4]
xor edx, edx
mov eax, dword [ebx + 0x60]
mov eax, dword [eax + 8]
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0x54]
test eax, eax
je 0x10109944
mov ecx, dword [eax + 8]
cmp eax, esi
je 0x10109917
mov edx, eax
mov eax, ecx
test eax, eax
jne 0x10109906
jmp 0x10109944
test edx, edx
jne 0x10109920
mov dword [ebx + 0x54], ecx
jmp 0x10109923
mov dword [edx + 8], ecx
mov eax, dword [esi + 0x14]
test eax, eax
je 0x10109930
push esi
call eax
add esp, 4
push esi
call fcn.10109e40
mov eax, dword [esp + 0x20]
push esi
push eax
mov eax, dword [eax + 8]
call eax
add esp, 0xc
mov esi, dword [edi + 0x54]
test esi, esi
jne 0x101098f0
lea eax, [edi + 0x6c]
test eax, eax
je 0x101099ce
test ebp, ebp
je 0x101099ce
mov ebx, dword [eax]
test ebx, ebx
je 0x101099c1
nop dword [eax]
mov esi, dword [ebx + 8]
mov eax, dword [ebx + 4]
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 8]
test eax, eax
je 0x10109977
push esi
call eax
add esp, 4
mov eax, dword [esp + 0x20]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x3c]
test eax, eax
je 0x1010998b
push esi
call eax
add esp, 4
mov eax, dword [esi + 0x28]
test eax, eax
je 0x1010999c
push eax
mov eax, dword [ebp + 8]
push ebp
call eax
add esp, 8
mov dword [esi + 0x28], 0
mov eax, dword [ebp + 8]
push esi
push ebp
call eax
mov eax, dword [ebp + 8]
push ebx
push ebp
call eax
mov eax, dword [esp + 0x2c]
add esp, 0x10
mov ebx, eax
test eax, eax
jne 0x10109960
lea eax, [edi + 0x6c]
mov dword [eax], 0
mov dword [eax + 4], 0
mov eax, dword [edi + 0x30]
mov dword [edi + 0x58], 0
test eax, eax
je 0x101099e2
push edi
call eax
add esp, 4
push ebp
push edi
call fcn.10109840
mov eax, dword [esp + 0x18]
add esp, 8
mov eax, dword [eax + 0x34]
test eax, eax
je 0x101099fd
push edi
call eax
add esp, 4
mov esi, dword [edi + 0x68]
mov eax, dword [edi + 8]
mov dword [esp + 0x20], eax
test esi, esi
je 0x10109a2f
mov eax, dword [esi + 0x18]
mov ebx, dword [esi + 0x1c]
test eax, eax
je 0x10109a1b
push esi
call eax
add esp, 4
test dword [esp + 0x20], 0x400
jne 0x10109a2f
mov eax, dword [ebx + 8]
push esi
push ebx
call eax
add esp, 8
mov eax, dword [edi + 0x80]
mov dword [edi + 0x68], 0
pop esi
pop ebx
test eax, eax
je 0x10109a56
push eax
mov eax, dword [ebp + 8]
push ebp
call eax
add esp, 8
mov dword [edi + 0x80], 0
mov eax, dword [ebp + 8]
push edi
push ebp
call eax
add esp, 8
pop edi
pop ebp
pop ecx
ret
Function at 0x10150530
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x14
xorps xmm0, xmm0
push ebx
push ebp
mov ebp, dword [esp + 0x20]
lea ebx, [ebp + 0x318]
movups xmmword [ebx], xmm0
push esi
movq qword [ebx + 0x10], xmm0
movzx ecx, word [ebp + 0x98]
mov eax, dword [ebp + 0x9c]
shl ecx, 4
add ecx, eax
push edi
cmp eax, ecx
jae 0x1015071d
cmp dword [eax], 0x42444620
jne 0x10150575
mov esi, dword [eax + 0xc]
test esi, esi
jne 0x10150589
add eax, 0x10
cmp eax, ecx
jb 0x10150566
pop edi
pop esi
pop ebp
mov eax, 8
pop ebx
add esp, 0x14
ret
push dword [eax + 8]
mov edi, dword [esp + 0x30]
push edi
call fcn.10108c90
add esp, 8
test eax, eax
jne 0x1015071d
cmp esi, 8
jb 0x1015071d
push ebx
push esi
push edi
call fcn.101083a0
add esp, 0xc
mov dword [esp + 0x20], eax
test eax, eax
jne 0x1015071d
mov eax, dword [ebx]
lea ecx, [eax + esi]
mov dword [ebp + 0x31c], ecx
mov ecx, eax
movzx edi, byte [ecx + 2]
movzx eax, byte [ecx + 3]
movzx edx, byte [ecx + 5]
shl edi, 8
or edi, eax
movzx eax, byte [ecx + 4]
shl eax, 8
or edx, eax
movzx eax, byte [ecx + 6]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 7]
movzx ecx, byte [ecx + 1]
shl edx, 8
or edx, eax
mov eax, dword [ebx]
movzx eax, byte [eax]
shl eax, 8
or ecx, eax
cmp ecx, 1
jne 0x10150705
cmp edx, 8
jb 0x10150705
lea eax, [edx - 8]
shr eax, 2
cmp eax, edi
jb 0x10150705
lea eax, [edx + 1]
cmp eax, esi
ja 0x10150705
mov eax, dword [ebx]
sub esi, edx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [ebp + 0x328], edi
mov dword [ebp + 0x324], esi
lea ecx, [eax + edx]
mov dword [ebp + 0x320], ecx
lea edx, [eax + 8]
lea eax, [edx + edi*4]
mov dword [esp + 0x10], eax
cmp edi, 2
jb 0x101506c1
lea esi, [edi - 2]
xor ebx, ebx
shr esi, 1
inc esi
xor ebp, ebp
movzx ecx, byte [edx + 2]
sub edi, 2
movzx eax, byte [edx + 3]
shl ecx, 8
or ecx, eax
lea eax, [ecx + ecx*4]
movzx ecx, byte [edx + 6]
lea ebx, [ebx + eax*2]
shl ecx, 8
movzx eax, byte [edx + 7]
add edx, 8
or ecx, eax
lea eax, [ecx + ecx*4]
lea ebp, [ebp + eax*2]
sub esi, 1
jne 0x10150675
mov dword [esp + 0x18], ebp
mov ebp, dword [esp + 0x28]
mov dword [esp + 0x14], ebx
mov esi, dword [ebp + 0x320]
lea ebx, [ebp + 0x318]
jmp 0x101506c3
mov esi, ecx
test edi, edi
je 0x101506e0
movzx ecx, byte [edx + 2]
movzx eax, byte [edx + 3]
mov edx, dword [esp + 0x10]
shl ecx, 8
or ecx, eax
lea eax, [ecx + ecx*4]
lea edx, [edx + eax*2]
jmp 0x101506e4
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
add eax, dword [esp + 0x18]
add eax, edx
cmp eax, esi
ja 0x10150705
mov eax, dword [esp + 0x20]
pop edi
pop esi
mov byte [ebp + 0x32c], 1
pop ebp
pop ebx
add esp, 0x14
ret
push ebx
push dword [esp + 0x30]
call fcn.10108c50
xorps xmm0, xmm0
add esp, 8
movups xmmword [ebx], xmm0
movq qword [ebx + 0x10], xmm0
mov eax, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x6c4e80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1c6000]
push edi
or ebp, 0xffffffff
jmp 0x6c4ea2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x6c4ea9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6c4e98
mov eax, 1
add ebx, ebx
jne 0x6c4ebb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x6c4ecc
jne 0x6c4eeb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6c4eeb
dec eax
add ebx, ebx
jne 0x6c4ed8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x6c4eb0
add ebx, ebx
jne 0x6c4ee7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x6c4f3d
xor ecx, ecx
sub eax, 3
jb 0x6c4f03
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x6c4f72
sar eax, 1
mov ebp, eax
jmp 0x6c4f0e
add ebx, ebx
jne 0x6c4f0e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6c4edc
inc ecx
add ebx, ebx
jne 0x6c4f1c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6c4edc
add ebx, ebx
jne 0x6c4f29
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x6c4f1e
jne 0x6c4f3a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x6c4f1e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x6c4f5c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x6c4f4e
jmp 0x6c4e9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x6c4f5c
add edi, ecx
jmp 0x6c4e9e
pop esi
mov edi, esi
mov ecx, 0x65fb
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x6c4f7a
cmp byte [edi], 0x13
jne 0x6c4f7a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x6c4f7f
lea edi, [esi + 0x2bb000]
mov eax, dword [edi]
or eax, eax
je 0x6c4ff7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2c9b64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2c9ca4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x6c4fac
mov ecx, edi
jns 0x6c4fdb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2c9ca8]
or eax, eax
je 0x6c4ff1
mov dword [ebx], eax
add ebx, 4
jmp 0x6c4fc9
call dword [esi + 0x2c9cb8]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x6c5028
cmp al, 0xef
ja 0x6c501b
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x6c4ffd
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x6c500a
mov ebp, dword [esi + 0x2c9cac]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x6c505c
sub esp, 0xffffff80
jmp 0x4ab843
Function at 0x401ff0
Capabilities:
Create thread
Resume thread

Disassembly:
push ecx
push ebx
push esi
push edi
call fcn.00408ac0
push eax
push str._Consent
push str.ROCred.Privacy
push str.Ai4rei.E.Skal
call fcn.00416b90
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
mov dword [esp + 0xc], eax
jne 0x402030
push eax
call fcn.00416bb0
test al, al
jne 0x4020ac
mov eax, dword [esp + 0xc]
push eax
mov esi, 1
call fcn.00416bb0
test al, al
je 0x402065
mov eax, dword [esp + 0xc]
push eax
call fcn.00416bc0
test al, al
je 0x402052
mov esi, 3
mov ecx, dword [esp + 0xc]
push ecx
call fcn.00416bd0
test al, al
je 0x40206a
or esi, 4
jmp 0x40206a
mov esi, 7
lea edx, [esp + 0xc]
push edx
push str.http:__ai4rei.net_about_telemetry_
push esi
push ebx
push 0xfffffffffffffffa
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongA]
push eax
call fcn.00416b30
test al, al
je 0x402101
mov eax, dword [esp + 0xc]
push eax
call fcn.00408ac0
push eax
push str._Consent
push str.ROCred.Privacy
push str.Ai4rei.E.Skal
call fcn.00416b60
test edi, edi
jne 0x402101
mov ecx, dword [esp + 0xc]
push ecx
call fcn.00416bb0
test al, al
je 0x402101
mov edx, dword [esp + 0xc]
push edx
call fcn.00416bc0
test al, al
jne 0x4020d6
mov eax, dword [esp + 0xc]
push eax
call fcn.00416bd0
test al, al
je 0x402101
lea ecx, [esp + 0x18]
push ecx
push 4
push ebx
push 0x402110
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x402101
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
pop ecx
ret 8
Function at 0x404d30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x38
push ebx
push esi
call fcn.00408e50
mov cl, byte [eax]
xor ebx, ebx
cmp cl, bl
je 0x404e4c
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x404e4c
mov esi, dword [esp + 0x44]
push edi
mov ecx, 9
xor eax, eax
lea edi, [esp + 0x20]
mov dword [esp + 0x1c], ebx
push 0xfffffffffffffffa
push esi
rep stosd dword es:[edi], eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
push 0x7f00
push ebx
mov dword [esp + 0x34], eax
mov dword [esp + 0x28], 0x405820
mov dword [esp + 0x48], str.BackgroundMediaClass
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [esp + 0x34], eax
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x2c], 4
call dword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
pop edi
je 0x404e4c
lea ecx, [esp + 8]
push ecx
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
mov al, byte [0x4507dc]
test al, 1
jne 0x404e11
mov dl, al
push 0x4058b0
or dl, 1
mov dword [0x4507e4], ebx
mov byte [0x4507dc], dl
mov byte [0x4507e8], bl
mov byte [0x4507e9], bl
mov dword [0x4507ec], ebx
mov byte [0x4507f0], bl
mov byte [0x4507f1], bl
mov dword [0x4507e0], 0x43fb60
call fcn.004359a8
add esp, 4
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
push 0x4507e0
push edx
mov edx, dword [esp + 0x18]
push 0x6b
sub ecx, eax
push esi
push ecx
mov ecx, dword [esp + 0x1c]
sub edx, ecx
push edx
push eax
push ecx
push 0x54000000
push 0x43f4a8
push str.BackgroundMediaClass
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExA]
pop esi
mov al, 1
pop ebx
add esp, 0x38
ret
Function at 0x407d30
Capabilities:
Hide graphical window

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
mov dword [esp], 0
test eax, eax
jbe 0x407db6
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetWindowLongA]
push ebp
mov ebp, dword [sym.imp.USER32.dll_SetWindowLongA]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
mov eax, dword [eax + ecx*4]
push eax
push edx
call fcn.00407dc0
mov esi, eax
test esi, esi
je 0x407da1
mov al, byte [esp + 0x24]
test al, al
je 0x407d8f
push 5
push esi
call edi
push 0xffffffffffffffec
push esi
call ebx
or al, 8
push eax
push 0xffffffffffffffec
push esi
call ebp
jmp 0x407da1
push 0xffffffffffffffec
push esi
call ebx
and al, 0xf7
push eax
push 0xffffffffffffffec
push esi
call ebp
push 0
push esi
call edi
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
inc eax
cmp eax, ecx
mov dword [esp + 0x10], eax
jb 0x407d57
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
Function at 0x409b90
Capabilities:
Delete file
Write file on windows

Disassembly:
sub esp, 0x214
mov edx, dword [esp + 0x21c]
lea eax, [esp + 4]
push ebx
lea ecx, [esp + 4]
push eax
push ecx
push edx
push 0xa
push 0
xor bl, bl
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call fcn.0041bd60
test eax, eax
je 0x409cb3
lea eax, [esp + 0x114]
push 0x104
push eax
call fcn.0041ba90
test eax, eax
je 0x409cac
lea ecx, [esp + 0x10]
push 0x104
push ecx
push 0
lea edx, [esp + 0x120]
push str.rcd
push edx
call fcn.0041b8a0
test eax, eax
je 0x409cac
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x409cac
push esi
push eax
push eax
push 3
push eax
push eax
lea eax, [esp + 0x28]
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x409c9c
mov edx, dword [esp + 8]
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push 0
push ecx
push edx
push eax
push esi
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
push esi
je 0x409c96
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x14]
mov ecx, dword [esp + 0x228]
mov eax, dword [esp + 0x220]
push ecx
push edx
push 0x442994
push eax
call fcn.00409990
test al, al
je 0x409c9c
mov al, byte [0x44d3e4]
mov bl, 1
or al, 2
mov byte [0x44d3e4], al
jmp 0x409c9c
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test bl, bl
pop esi
jne 0x409cb3
or byte [0x44d3e4], 0x20
mov al, bl
pop ebx
add esp, 0x214
ret 0xc

Function at 0x40d610
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 4]
push ebx
xor bl, bl
cmp byte [eax], 0x2e
jne 0x40d669
lea ecx, [esp + 8]
push ecx
push 1
push 0
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40d669
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], edx
mov edx, dword [esp + 8]
push eax
push ecx
push 0
push 0
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40d65e
mov bl, 1
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
ret 0xc
Function at 0x40d690
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x74
push ebx
push ebp
push esi
push edi
call fcn.00408c20
mov ebp, dword [esp + 0x88]
push 0xfffffffffffffffa
test al, al
push ebp
sete bl
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov esi, eax
mov ecx, 0x15
xor eax, eax
lea edi, [esp + 0x30]
mov dword [esp + 0x2c], 0x58
push 6
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push ebp
call edi
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push ebp
call edi
test bl, bl
je 0x40d727
push 1
push esi
mov dword [esp + 0x38], ebp
mov dword [esp + 0x3c], 1
mov dword [esp + 0x40], 6
call fcn.0041e160
push 0x40
mov dword [esp + 0x44], eax
lea eax, [esp + 0x48]
push eax
push 0x3ec
push esi
call dword [sym.imp.USER32.dll_LoadStringA]
lea ecx, [esp + 0x2c]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
push 0x40
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov edi, dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
push 0xff
push 0xffffffffffffffff
lea edx, [esp + 0x94]
push 0
push edx
push 1
call edi
test eax, eax
je 0x40d7c0
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
push 1
push 0
push 0
lea eax, [esp + 0x1c]
push 0
push eax
call esi
test eax, eax
je 0x40d7a7
lea ecx, [esp + 0x10]
push ecx
push ebp
call dword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
jne 0x40d794
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push 0
push 0
lea ecx, [esp + 0x1c]
push 0
push ecx
call esi
test eax, eax
jne 0x40d76e
push 0xff
push 0xffffffffffffffff
lea edx, [esp + 0x94]
push 0
push edx
push 1
call edi
test eax, eax
jne 0x40d75b
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
test bl, bl
je 0x40d7e0
lea eax, [esp + 0x2c]
push eax
push 2
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 2
push ebp
call esi
push 9
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x74
ret 8
Function at 0x40d800
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x1a44
call fcn.004359f0
push ebx
push ebp
push esi
push edi
mov byte [esp + 0x13], 0
call fcn.00408d30
mov ebx, eax
mov ecx, 0xe
xor eax, eax
lea edi, [esp + 0x1c]
mov dword [esp + 0x18], 0x3c
lea edx, [esp + 0x254]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x1a64]
lea eax, [esp + 0x1a68]
push eax
xor ebp, ebp
push ecx
push edx
mov dword [esp + 0x20], ebp
call dword [sym.imp.USER32.dll_wvsprintfA]
mov esi, dword [esp + 0x1a60]
mov cl, 0x5c
cmp byte [esi], cl
jne 0x40d89d
cmp byte [esi + 1], cl
jne 0x40d89d
cmp byte [esi + 2], 0x3f
jne 0x40d896
cmp byte [esi + 3], cl
jne 0x40d89d
mov al, byte [esi + 4]
cmp al, 0x55
je 0x40d87b
cmp al, 0x75
jne 0x40d89d
mov al, byte [esi + 5]
cmp al, 0x4e
je 0x40d886
cmp al, 0x6e
jne 0x40d89d
mov al, byte [esi + 6]
cmp al, 0x43
je 0x40d891
cmp al, 0x63
jne 0x40d89d
cmp byte [esi + 7], cl
jne 0x40d89d
mov eax, 1
jmp 0x40d89f
xor eax, eax
neg al
mov edi, dword [esp + 0x1a58]
lea ecx, [esp + 0x54]
sbb eax, eax
push 0x100
and eax, 0x80
push ecx
or eax, 0x441
push str..exe
mov dword [esp + 0x28], eax
lea eax, [esp + 0x260]
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], eax
mov dword [esp + 0x40], 1
call fcn.0040d610
test al, al
je 0x40d8f9
lea edx, [esp + 0x54]
mov dword [esp + 0x40], edx
jmp 0x40d901
mov dword [esp + 0x40], str.exefile
cmp byte [ebx], 0
je 0x40d915
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x40d958
mov eax, dword [esp + 0x50]
test eax, eax
je 0x40da01
test byte [esp + 0x1a5c], 1
jne 0x40d94b
push eax
push edi
call fcn.0040d690
mov eax, dword [esp + 0x50]
push eax
call ebx
mov byte [esp + 0x13], 1
jmp 0x40da01
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebp
cmp eax, 0x4c7
je 0x40da01
push 0
lea ecx, [esp + 0x658]
push 0x400
push ecx
push 0x400
call ebp
push eax
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
lea edx, [esp + 0x154]
push 0x100
push edx
push 0x3f3
push 0xfffffffffffffffa
push edi
call dword [sym.imp.USER32.dll_GetWindowLongA]
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [esp + 0x654]
lea ecx, [esp + 0x254]
push eax
push ecx
lea edx, [esp + 0x15c]
push esi
push edx
lea eax, [esp + 0xa64]
push 0x1000
push eax
call fcn.00405c60
add esp, 0x18
lea ecx, [esp + 0xa54]
push 0x10
push ecx
push edi
call fcn.00401100
lea edx, [esp + 0xa54]
push 0x1000
push edx
call fcn.0040d5f0
lea eax, [esp + 0x254]
push 0x400
push eax
call fcn.0040d5f0
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40da1e
push eax
call ebx
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a44
ret