joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40df95
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x20
or dword [esp + 0x1c], 0xffffffff
mov eax, ecx
push ebx
push ebp
push esi
push edi
push ecx
push 3
push 3
push closesocket
push dword [esp + 0x44]
xor ebx, ebx
mov dword [esp + 0x38], eax
lea ecx, [esp + 0x3c]
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [esp + 0x3c], 0x4f88f0
call fcn.00401140
mov esi, dword [esp + 0x2c]
test al, al
je 0x40e124
xorps xmm0, xmm0
movlpd qword [esp + 0x18], xmm0
cmp esi, 0xffffffff
je 0x40e002
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x40e002
mov edi, dword [esp + 0x18]
mov ebp, dword [esp + 0x1c]
jmp 0x40e013
xorps xmm0, xmm0
movlpd qword [esp + 0x28], xmm0
mov ebp, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
mov ecx, edi
mov dword [esp + 0x14], ebp
add ecx, 2
mov eax, ebp
adc eax, ebx
push eax
push ecx
mov ecx, dword [esp + 0x2c]
call fcn.00403842
test al, al
je 0x40e115
cmp esi, 0xffffffff
je 0x40e0d4
mov eax, dword [esp + 0x24]
mov eax, dword [eax]
mov dword [esp + 0x28], eax
test eax, eax
je 0x40e0d4
cmp ebp, ebx
ja 0x40e057
cmp edi, 1
jb 0x40e0d4
mov eax, dword [esp + 0x14]
xorps xmm0, xmm0
movlpd qword [esp + 0x18], xmm0
mov ecx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
mov dword [esp + 0x34], ecx
mov edx, edi
mov dword [esp + 0x18], ebx
sub edx, ebp
sbb eax, ecx
cmp eax, ebx
jb 0x40e091
ja 0x40e088
cmp edx, 0xfffffff
jbe 0x40e091
mov eax, 0xfffffff
mov ecx, ebp
jmp 0x40e097
mov ecx, ebp
mov eax, edi
sub eax, ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push eax
mov eax, dword [esp + 0x34]
add eax, ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x34]
test eax, eax
je 0x40e0e5
cmp dword [esp + 0x18], ebx
je 0x40e0e5
add ebp, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
adc ecx, ebx
mov dword [esp + 0x34], ecx
cmp ecx, eax
jb 0x40e070
ja 0x40e0e5
cmp ebp, edi
jb 0x40e070
jmp 0x40e0e5
xorps xmm0, xmm0
movlpd qword [esp + 0x28], xmm0
mov ecx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x28]
cmp ebp, edi
jne 0x40e115
mov ebp, dword [esp + 0x14]
cmp ecx, ebp
jne 0x40e115
cmp esi, 0xffffffff
je 0x40e100
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or esi, 0xffffffff
mov eax, dword [esp + 0x24]
mov ecx, eax
mov dword [eax + 8], edi
mov dword [eax + 0xc], ebp
call fcn.004037f6
mov bl, al
jmp 0x40e124
cmp esi, 0xffffffff
je 0x40e130
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or esi, 0xffffffff
cmp esi, 0xffffffff
je 0x40e130
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x20
ret 0xc
Function at 0x40e440
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x660
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x24], 0x10
jbe 0x40e514
push 0x250
lea eax, [esp + 0xc]
push 0
push eax
call fcn.0041d6f0
add esp, 0xc
lea ecx, [esp + 0x258]
call fcn.004047b4
push dword [esi + 0x20]
mov eax, ecx
push str._s.
push eax
call fcn.0040371e
add esp, 0xc
lea eax, [esp + 8]
push eax
push dword [esp + 0x260]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x40e509
test byte [esp + 8], 0x10
jne 0x40e4e9
lea eax, [esp + 0x34]
push eax
push dword [esi + 0x20]
lea eax, [esp + 0x260]
push 0x50d448
push eax
call fcn.0040371e
add esp, 0x10
mov ecx, esi
push dword [esp + 0x25c]
call fcn.0040e13c
test al, al
je 0x40e4e9
push dword [esp + 0x25c]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp byte [esi + 0xce79], 0
jne 0x40e502
lea eax, [esp + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40e4a6
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [esi + 0x95d8]
mov eax, dword [ecx]
call dword [eax + 0xc]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40e9a9
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
mov esi, ecx
push edi
test esi, esi
je 0x40ea25
xor edi, edi
cmp word [esi], di
je 0x40ea25
call fcn.0040e67f
test al, al
je 0x40ea25
push 0x50e03c
push esi
push str._scheckwritepermissions._s
push 0xffffffffffffffff
lea eax, [ebp - 0x208]
push 0x103
push eax
call fcn.00401bd1
add esp, 0x18
lea eax, [ebp - 0x208]
push edi
push 0x80
push 2
push edi
push 3
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x40ea25
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov al, 1
jmp 0x40ea27
xor al, al
pop edi
pop esi
leave
ret
Function at 0x40eb79
Capabilities:
Reference wmi statements

Disassembly:
sub esp, 0x130
push ebx
push ebp
push esi
mov esi, dword [esp + 0x140]
mov ebp, ecx
push edi
test esi, esi
je 0x40ed44
lea eax, [esp + 0x40]
mov dword [esp + 0x3c], 0x80
mov dword [esp + 0x34], eax
lea ecx, [esp + 0x1c]
xor eax, eax
mov dword [esp + 0x30], 0x50c0c8
mov word [esp + 0x40], ax
xor ebx, ebx
mov eax, dword [esi]
push str.SELECT__FROM_Win32_VideoController
mov dword [esp + 0x18], ebx
mov dword [esp + 0x3c], ebx
mov eax, dword [eax + 0x50]
mov dword [esp + 0x1c], eax
call fcn.0040ea2b
mov edi, dword [eax]
test edi, edi
je 0x40ebde
mov edi, dword [edi]
jmp 0x40ebe0
mov edi, ebx
push 0x50e100
lea ecx, [esp + 0x14]
call fcn.0040ea2b
mov eax, dword [eax]
test eax, eax
je 0x40ebf8
mov eax, dword [eax]
jmp 0x40ebfa
mov eax, ebx
lea ecx, [esp + 0x14]
push ecx
push ebx
push 0x30
push edi
push eax
push esi
call dword [esp + 0x30]
lea ecx, [esp + 0x10]
mov esi, eax
call fcn.0040ea9d
lea ecx, [esp + 0x1c]
call fcn.0040ea9d
test esi, esi
js 0x40ed40
jmp 0x40ed1c
lea edx, [esp + 0x18]
mov dword [esp + 0x18], ebx
push edx
lea edx, [esp + 0x14]
mov dword [esp + 0x14], ebx
mov eax, dword [ecx]
push edx
push 1
push 0xffffffffffffffff
push ecx
call dword [eax + 0x10]
test eax, eax
jne 0x40ed30
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x40ed30
cmp dword [esp + 0x18], ebx
je 0x40ed2a
lea edi, [esp + 0x20]
mov esi, str.Caption
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ecx]
lea edx, [esp + 0x20]
push ebx
push ebx
push edx
push ebx
push esi
push ecx
call dword [eax + 0x10]
test eax, eax
jns 0x40ec8b
push str.n_a
jmp 0x40ecd8
movzx eax, word [esp + 0x20]
cmp eax, 3
je 0x40ecbe
mov ecx, ebp
cmp eax, 8
je 0x40eca3
push str.n_a
jmp 0x40ecda
cmp dword [esp + 0x28], ebx
mov eax, 0x50e108
cmovne eax, dword [esp + 0x28]
push eax
call fcn.0040eacb
push 0x50e190
jmp 0x40ecd8
push dword [esp + 0x28]
lea eax, [esp + 0x34]
push 0x50e110
push eax
call fcn.0040371e
add esp, 0xc
push dword [esp + 0x34]
mov ecx, ebp
call fcn.0040eacb
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x40ecef
sub ecx, edx
sar ecx, 1
lea esi, [esi + ecx*2]
add esi, 2
cmp word [esi], bx
je 0x40ed12
mov ecx, dword [esp + 0x10]
jmp 0x40ec71
mov eax, dword [esp + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, dword [esp + 0x14]
test ecx, ecx
jne 0x40ec2a
jmp 0x40ed3e
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x40ed3e
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov bl, 1
mov al, bl
jmp 0x40ed46
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x130
ret 0xc
Function at 0x40ed53
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
sub esp, 0x10
xor eax, eax
mov edx, 0x5098d4
push ebx
push ebp
push esi
push edi
push 0x100
mov edi, ecx
mov ebp, 0x50e194
push 0x3fe
push edi
push ebp
mov ecx, closesocket
mov word [edi], ax
call fcn.00403ccc
add esp, 0x10
xor ebx, ebx
test al, al
je 0x40ed93
cmp word [edi], bx
jne 0x40eedc
push ebx
push ebx
push ebx
push 3
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push ebx
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
jns 0x40edb3
cmp eax, 0x80010119
jne 0x40ee66
lea eax, [esp + 0x18]
mov dword [esp + 0x18], ebx
push eax
push 0x4f084c
push 1
push ebx
push 0x4f085c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x40ee66
mov eax, dword [esp + 0x18]
test eax, eax
je 0x40ee66
mov dword [esp + 0x14], ebx
lea ecx, [esp + 0x1c]
mov eax, dword [eax]
push str.ROOTCIMV2
mov esi, dword [eax + 0xc]
call fcn.0040ea2b
mov eax, dword [eax]
test eax, eax
je 0x40ee04
mov eax, dword [eax]
jmp 0x40ee06
mov eax, ebx
lea ecx, [esp + 0x14]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
push dword [esp + 0x38]
call esi
lea ecx, [esp + 0x1c]
mov esi, eax
call fcn.0040ea9d
test esi, esi
js 0x40ee5c
cmp dword [esp + 0x14], ebx
je 0x40ee5c
push ebx
push ebx
push 3
push 3
push ebx
push ebx
push 0xa
push dword [esp + 0x30]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x40ee52
push ecx
push ecx
push dword [esp + 0x1c]
mov ecx, edi
call fcn.0040eb79
mov eax, dword [esp + 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x18]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x40ee6b
sub ecx, edx
sar ecx, 1
je 0x40ee90
cmp word [edi + ecx*2 - 2], 0x7c
jne 0x40ee90
sub ecx, 1
push 0
pop eax
mov word [edi + ecx*2], ax
jne 0x40ee7c
mov esi, 0x50e190
jmp 0x40ee9d
push 0x2c
pop ecx
mov word [eax], cx
push esi
push edi
call fcn.0041c9ee
pop ecx
pop ecx
test eax, eax
jne 0x40ee97
mov esi, edi
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, bx
jne 0x40eeaf
sub esi, ecx
mov edx, 0x5098d4
sar esi, 1
push ecx
lea eax, [esi*2 + 2]
push eax
push edi
push ecx
push ebp
mov ecx, closesocket
call fcn.00403b9e
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
Function at 0x40eee6
Capabilities:
Check if file exists
Create directory
Get common file path
Get file attributes
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [0x55cdf8]
sub esp, 0x604
push ebx
push esi
push edi
test eax, eax
jne 0x40ef18
push 0x4f086c
push 0x200000
call fcn.0041b7ed
mov dword [0x55cdf8], eax
pop ecx
pop ecx
test eax, eax
je 0x40ef1d
xor ecx, ecx
mov word [eax], cx
xor ebx, ebx
cmp dword [0x5686ac], ebx
jne 0x40ef3f
push 4
push 0x3000
push 0x22000
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x5686ac], eax
push dword [0x55b850]
mov dword [0x5686b0], ebx
push ebx
push ebx
push 0x1a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, 0x55b84c
mov ecx, esi
call fcn.00403e73
push 0x50c510
mov ecx, esi
call fcn.004035d5
push dword [0x55b850]
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call edi
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, 0xffffffff
jne 0x40ef90
push ebx
push dword [0x55b850]
call esi
push str.Crashes
mov ecx, 0x55b84c
call fcn.004035d5
push dword [0x55b850]
call edi
cmp eax, 0xffffffff
jne 0x40efb5
push ebx
push dword [0x55b850]
call esi
push str.MT5WEBSETUP
mov ecx, 0x55ba64
call fcn.004031de
push str.MetaTrader_Web_Setup
mov ecx, 0x55bc7c
call fcn.004031de
mov eax, 0xe94
mov dword [0x55cd90], 0x1f4
mov dword [0x55cd94], eax
mov ecx, 0x55be94
mov dword [0x55cd98], 0x2897
push ebx
mov dword [0x5686e0], eax
call fcn.004031de
mov eax, dword [0x55cdf0]
or eax, dword [0x55cdf4]
jne 0x40f020
push ebx
call fcn.0042bcc4
pop ecx
mov dword [0x55cdf0], eax
mov dword [0x55cdf4], edx
push str.16_May_2023
mov ecx, 0x55cd9c
call fcn.004031de
mov edi, 0x55c6f4
mov ecx, edi
call fcn.00401887
test al, al
je 0x40f108
push 0x200
lea eax, [esp + 0x14]
push ebx
push eax
call fcn.0041d6f0
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea eax, [esp + 0x1c]
add esp, 0xc
push 0x100
push eax
push str.CLIENTNAME
call esi
test eax, eax
jne 0x40f086
push 0x100
lea eax, [esp + 0x14]
push eax
push str.COMPUTERNAME
call esi
test eax, eax
je 0x40f0bf
lea eax, [esp + 0x10]
mov ecx, edi
push eax
call fcn.004031de
push 0x100
lea eax, [esp + 0x14]
push eax
push str.USERDOMAIN
call esi
test eax, eax
je 0x40f0bf
push 0x509828
mov ecx, edi
call fcn.004035d5
lea eax, [esp + 0x10]
mov ecx, edi
push eax
call fcn.004035d5
push 0x100
push 0x1fe
lea eax, [esp + 0x18]
mov edx, str.SOFTWAREMetaQuotes_SoftwareSettings
push eax
push str.MQL5.Login
mov ecx, closesocket
call fcn.00403ccc
add esp, 0x10
test al, al
je 0x40f108
cmp word [esp + 0x10], bx
je 0x40f108
push str._for
mov ecx, edi
call fcn.004035d5
lea eax, [esp + 0x10]
mov ecx, edi
push eax
call fcn.004035d5
mov esi, 0x400
lea eax, [esp + 0x210]
push esi
push ebx
push eax
call fcn.0041d6f0
pop ecx
pop ecx
lea ecx, [esp + 0x214]
call fcn.0040ed53
lea eax, [esp + 0x210]
mov ecx, 0x55c90c
push eax
call fcn.004031de
lea eax, [esp + 0x210]
mov byte [eax], bl
inc eax
sub esi, 1
jne 0x40f143
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
Function at 0x40f154
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
push esi
push edi
call fcn.004083c0
test eax, eax
jne 0x40f1ed
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x40f1ed
push 0x424
lea eax, [ebp - 0x424]
push 0
push eax
call fcn.0041d6f0
add esp, 0xc
mov dword [ebp - 0x428], 0x428
lea eax, [ebp - 0x428]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
jmp 0x40f1e2
xor edi, edi
push dword [edi + 0x50e220]
lea eax, [ebp - 0x408]
push eax
call fcn.0042bf95
pop ecx
pop ecx
test eax, eax
je 0x40f1f3
add edi, 4
cmp edi, 0xc
jb 0x40f1b4
lea eax, [ebp - 0x428]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x40f1b2
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
pop esi
leave
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x40f1ef
Function at 0x40fb6e
Capabilities:
Get file version info

Disassembly:
sub esp, 0xc
cmp dword [esp + 0x10], 0
push ebx
push esi
je 0x40fc45
lea eax, [esp + 0xc]
xor ebx, ebx
push eax
push dword [esp + 0x1c]
mov dword [esp + 0x14], ebx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov esi, eax
test esi, esi
je 0x40fc45
mov eax, dword [0x5686b4]
cmp esi, dword [0x5686b8]
jbe 0x40fbe5
test eax, eax
je 0x40fbc1
push 0x8000
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x5686b4], ebx
push 4
push 0x3000
push esi
push ebx
mov dword [0x5686b8], ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x5686b4], eax
test eax, eax
je 0x40fc45
mov dword [0x5686b8], esi
push eax
push esi
push ebx
push dword [esp + 0x24]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x18], ebx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x40fc41
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x14]
push eax
push 0x509834
push dword [0x5686b4]
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x40fc41
mov edx, dword [esp + 0x10]
test edx, edx
je 0x40fc41
mov eax, dword [esp + 0x1c]
mov ecx, dword [edx + 0x10]
mov edx, dword [edx + 0x14]
mov dword [eax], ecx
mov eax, dword [esp + 0x20]
mov dword [eax], edx
test ecx, ecx
je 0x40fc41
test edx, edx
je 0x40fc41
mov bl, 1
mov al, bl
jmp 0x40fc47
xor al, al
pop esi
pop ebx
add esp, 0xc
ret 0xc
Function at 0x410adb
Capabilities:
Check if file exists
Get file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
push ebx
push esi
push dword [0x55b850]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x410b02
mov ecx, dword [0x55b850]
call fcn.00410a4b
cmp word [0x55cd3c], 0
je 0x410bdf
or dword [ebp - 8], 0xffffffff
lea ecx, [ebp - 0x228]
mov dword [ebp - 0xc], 0x4f88f0
call fcn.0040337a
push 0x55cd3c
push dword [0x55ba68]
mov eax, ecx
push dword [0x55b850]
push 0x50f268
push eax
call fcn.0040371e
add esp, 0x10
lea ecx, [ebp - 0xc]
push 2
push 3
push 0x40000000
push dword [ebp - 0x224]
call fcn.00401140
mov esi, dword [ebp - 8]
test al, al
je 0x410bbb
and dword [ebp - 4], 0
cmp esi, 0xffffffff
je 0x410b82
push 0
lea eax, [ebp - 4]
push eax
push 2
push 0x50f214
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, dword [0x55cdf8]
mov ecx, ebx
call fcn.00408f92
and dword [ebp - 4], 0
add eax, eax
cmp esi, 0xffffffff
je 0x410bbb
test ebx, ebx
je 0x410bb1
test eax, eax
je 0x410bb1
push 0
lea ecx, [ebp - 4]
push ecx
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or esi, 0xffffffff
and dword [ebp - 0x224], 0
and dword [ebp - 0x220], 0
mov dword [ebp - 0x228], 0x5098cc
cmp esi, 0xffffffff
je 0x410bdf
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
leave
ret

Function at 0x410cb0
Capabilities:
Create process memory minidump
Delete file

Disassembly:
sub esp, 0x224
xor eax, eax
push ebx
push ebp
push esi
push edi
lea edi, [esp + 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [esp + 0x238]
test edi, edi
je 0x410cdc
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edi
push 0x55cd3c
push dword [0x55ba68]
lea eax, [esp + 0x30]
push dword [0x55b850]
push str._s_s._s.dmp
push 0xffffffffffffffff
push 0x103
push eax
call fcn.00401bd1
add esp, 0x1c
lea eax, [esp + 0x28]
xor ebp, ebp
push ebp
push 0x80
push 2
push ebp
push ebp
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x410da5
mov ecx, 0x55c0ac
call fcn.00401887
test al, al
je 0x410d48
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push ebp
jmp 0x410d6c
mov eax, dword [0x55c0b0]
mov dword [esp + 0x20], 0x410be3
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [esp + 0x20]
push ecx
xor edx, edx
lea ecx, [esp + 0x18]
push ebp
test edi, edi
cmove ecx, edx
push ecx
push dword [esp + 0x248]
push ebx
push esi
push eax
call dword [sym.imp.dbghelp.dll_MiniDumpWriteDump]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x28]
push eax
call fcn.00411079
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x224
ret 8
Function at 0x411079
Capabilities:
Encode data using xor
Get file size
Read file on windows
Write file on windows

Disassembly:
sub esp, 0xa30
push ebx
mov ebx, dword [esp + 0xa38]
xorps xmm0, xmm0
movlpd qword [esp + 0x14], xmm0
push ebp
push esi
push edi
test ebx, ebx
je 0x411275
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
xor ebp, ebp
push ebp
push 0x80
push 3
push ebp
push ebp
push closesocket
push ebx
mov dword [esp + 0x30], ebp
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x411275
lea eax, [esp + 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x4110e4
cmp dword [esp + 0x24], ebp
jne 0x41112c
cmp dword [esp + 0x20], 0x10000000
ja 0x41112c
push 0x55cd3c
push dword [0x55ba68]
lea eax, [esp + 0x40]
push dword [0x55b850]
push 0x50f268
push 0xffffffffffffffff
push 0x103
push eax
call fcn.00401bd1
add esp, 0x1c
lea eax, [esp + 0x38]
push ebp
push 0x80
push 3
push ebp
push 3
push 0xc0000000
push eax
call edi
mov edi, eax
cmp edi, 0xffffffff
jne 0x411138
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x411275
push 2
lea eax, [esp + 0x38]
xorps xmm0, xmm0
push eax
push ebp
push edi
movlpd qword [esp + 0x40], xmm0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [esp + 0x34], eax
lea eax, [esp + 0x14]
push eax
push 4
lea eax, [esp + 0x38]
mov dword [esp + 0x38], 0x50000
push eax
push edi
call ebp
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [esp + 0x14]
jne 0x411177
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 1]
mov dword [esp + 0x18], eax
xor eax, eax
push eax
lea eax, [esp + 0x14]
push eax
push 4
lea eax, [esp + 0x24]
push eax
push edi
call ebp
push ebx
lea eax, [esp + 0x3c]
push 0x104
push eax
call fcn.00424506
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x44]
push 0x4fa800
lea edx, [eax + eax]
call fcn.00451721
add esp, 0x10
lea eax, [esp + 0x10]
xor ebx, ebx
push ebx
push eax
mov eax, dword [esp + 0x20]
add eax, eax
push eax
lea eax, [esp + 0x44]
push eax
push edi
call ebp
push ebx
lea eax, [esp + 0x14]
push eax
push 4
lea eax, [esp + 0x2c]
push eax
push edi
call ebp
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], eax
jmp 0x41124b
mov edx, dword [esp + 0x1c]
test edx, edx
je 0x411269
xor eax, eax
mov ecx, eax
test edx, edx
je 0x411237
mov eax, ebx
and eax, 0xf
mov al, byte [eax*4 + 0x50f280]
add al, byte [esp + 0x14]
xor byte [esp + ecx + 0x240], al
inc ebx
movsx eax, byte [esp + ecx + 0x240]
inc ecx
mov dword [esp + 0x14], eax
cmp ecx, edx
jb 0x41120c
xor eax, eax
push eax
lea eax, [esp + 0x14]
push eax
push edx
lea eax, [esp + 0x24c]
push eax
push edi
call ebp
xor eax, eax
push eax
lea eax, [esp + 0x20]
push eax
push 0x800
lea eax, [esp + 0x24c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4111fc
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa30
ret 4
Function at 0x412312
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 8]
push ebx
mov ebx, ecx
test edx, edx
jne 0x412322
push 0xd
pop eax
jmp 0x412367
push ebp
push esi
xor eax, eax
push edi
mov dword [esp + 0x18], eax
mov esi, eax
mov edi, edx
mov ecx, edi
lea ebp, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [esp + 0x18]
jne 0x412334
sub ecx, ebp
sar ecx, 1
inc ecx
lea edi, [edi + ecx*2]
lea esi, [esi + ecx*2]
cmp ecx, 1
jne 0x41232f
push esi
push edx
push 7
xor eax, eax
push eax
push dword [esp + 0x24]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x4128c5
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x21c
push ebx
mov ebx, ecx
lea ecx, [esp + 8]
push ebp
push esi
xor ebp, ebp
mov eax, dword [ebx + 4]
or eax, 0x2001f
mov dword [esp + 0x10], ebp
push eax
push dword [esp + 0x230]
mov dword [esp + 0x1c], ebp
push dword [ebx]
mov dword [esp + 0x24], ebp
call fcn.00412869
mov esi, eax
test esi, esi
jne 0x412994
lea eax, [esp + 0x20]
mov dword [esp + 0x1c], 0x100
push eax
push ebp
push ebp
push ebp
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x3c]
push eax
push ebp
push dword [esp + 0x2c]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
call ebp
test eax, eax
jne 0x412969
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x14]
call fcn.004128c5
mov esi, eax
test esi, esi
jne 0x412994
lea eax, [esp + 0x20]
mov dword [esp + 0x1c], 0x100
push eax
push esi
push esi
push esi
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x3c]
push eax
push esi
push dword [esp + 0x2c]
call ebp
test eax, eax
je 0x41292e
jmp 0x41296b
xor esi, esi
cmp dword [esp + 0x10], 0
je 0x412980
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], esi
push dword [esp + 0x22c]
mov ecx, ebx
mov dword [esp + 0x18], esi
call fcn.00412a51
mov esi, eax
cmp dword [esp + 0x10], 0
je 0x4129a5
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x21c
ret 4