joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43ed88
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x14
mov eax, 0x498927
call fcn.0045dae3
mov esi, ecx
push dword [esi + 0xb0]
lea ecx, [ebp - 0x20]
call fcn.00436319
xor ebx, ebx
cmp dword [ebp + 8], 9
mov dword [ebp - 4], ebx
jne 0x43ee7d
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x43ee7d
mov ecx, dword [esi + 0xc0]
test ecx, ecx
je 0x43ede2
push ebx
push ebx
push ebx
push 0xc
call fcn.00437ca7
test eax, eax
jne 0x43ee7d
mov edi, dword [esi + 0xc0]
xor ebx, ebx
inc ebx
mov byte [esi + 0xce], bl
test edi, edi
je 0x43ee01
mov eax, dword [edi + 0x24]
shr eax, 0xf
test bl, al
je 0x43ee01
xor edi, edi
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, esi
push edi
test al, 1
je 0x43ee1a
call fcn.0043d093
jmp 0x43ee1f
call fcn.0043cf6b
mov edi, eax
test edi, edi
je 0x43ee57
push edi
mov ecx, esi
call fcn.0043c7de
xor eax, eax
mov ecx, edi
push eax
push eax
push eax
push 0x11
call fcn.00437ca7
cmp eax, 4
jne 0x43ee57
and dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
or dword [ebp - 0x10], 0xffffffff
lea ecx, [edi + 0xac]
push eax
call fcn.0043bdf7
mov ecx, dword [esi + 0xb0]
xor edi, edi
push edi
push edi
push edi
push 0x6e
call fcn.00437ca7
cmp eax, ebx
jne 0x43ee7d
mov ecx, dword [esi + 0xb0]
push edi
push edi
push edi
push 0x6f
call fcn.00437ca7
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], vtable.CTrackFinalEvent.0
call fcn.00439204
mov eax, ebx
call fcn.0045daac
ret 8

Function at 0x441a32
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
shl edi, 2
mov dword [ebp - 4], edx
test ecx, ecx
je 0x441a77
cmp ecx, 0xffffffff
je 0x441a77
push edi
xor ebx, ebx
push ebx
push ebx
push 4
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
je 0x441a79
push edi
push esi
push dword [ebp - 4]
call fcn.0045f970
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov bl, 1
jmp 0x441a79
xor bl, bl
pop edi
pop esi
mov al, bl
pop ebx
leave
ret
Function at 0x44b2a2
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x828
mov eax, 0x49962b
call fcn.0045db17
mov esi, ecx
mov dword [ebp - 0x82c], esi
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x834]
mov ebx, dword [ebp + 0xc]
xor edi, edi
push ecx
push 1
push edi
push eax
mov dword [ebp - 0x82c], esi
push 0x80000001
mov dword [ebp - 0x834], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp dword [ebp - 0x834], edi
jne 0x44b2ff
xor eax, eax
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], 7
mov word [esi], ax
jmp 0x44b408
push 0x800
lea eax, [ebp - 0x810]
push 0
push eax
call fcn.0045f220
xor ecx, ecx
mov dword [ebp - 0x814], 7
xor eax, eax
mov dword [ebp - 0x818], ecx
add esp, 0xc
mov word [ebp - 0x828], ax
lea eax, [ebp - 0x82c]
mov dword [ebp - 4], ecx
push eax
push ecx
lea eax, [ebp - 0x830]
mov dword [ebp - 0x830], ecx
push eax
push ecx
push ebx
push dword [ebp - 0x834]
mov dword [ebp - 0x82c], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44b3cb
cmp dword [ebp - 0x830], 1
je 0x44b37b
cmp dword [ebp - 0x830], 2
je 0x44b37b
cmp dword [ebp - 0x830], 7
jne 0x44b3cb
cmp dword [ebp - 0x82c], 0x800
jae 0x44b38f
lea edi, [ebp - 0x810]
jmp 0x44b39d
push dword [ebp - 0x82c]
call fcn.0045d658
pop ecx
mov edi, eax
lea eax, [ebp - 0x82c]
push eax
push edi
lea eax, [ebp - 0x830]
push eax
push 0
push ebx
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44b3cb
push edi
lea ecx, [ebp - 0x828]
call fcn.0040ad20
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x44b3ef
lea eax, [ebp - 0x810]
cmp edi, eax
je 0x44b3ef
push 2
push edi
call fcn.0045cf49
pop ecx
pop ecx
lea eax, [ebp - 0x828]
mov ecx, esi
push eax
call fcn.004050e0
lea ecx, [ebp - 0x828]
call fcn.004054f0
mov eax, esi
call fcn.0045dac1
ret
Function at 0x44b4f3
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x830
mov eax, 0x4996ac
call fcn.0045db17
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x83c], eax
lea eax, [ebp - 0x830]
push eax
push 9
push edi
push edx
push 0x80000001
mov dword [ebp - 0x830], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp dword [ebp - 0x830], edi
je 0x44b68c
push edi
push edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x834]
mov dword [ebp - 0x838], edi
push eax
lea eax, [ebp - 0x838]
mov dword [ebp - 0x834], edi
push eax
push edi
push edi
push edi
push dword [ebp - 0x830]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov esi, eax
test esi, esi
jne 0x44b679
mov ebx, dword [ebp - 0x838]
test ebx, ebx
je 0x44b679
push 0x800
lea eax, [ebp - 0x814]
push edi
push eax
call fcn.0045f220
mov eax, dword [ebp - 0x834]
add esp, 0xc
push 2
pop edx
cmp eax, 0x400
jae 0x44b5a9
lea edi, [ebp - 0x814]
jmp 0x44b5d6
xor ecx, ecx
inc eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0045d658
mov ecx, dword [ebp - 0x834]
mov edi, eax
inc ecx
push ecx
push 0
push edi
call fcn.0045f220
mov ebx, dword [ebp - 0x838]
add esp, 0x10
mov ecx, dword [ebp - 0x83c]
push ebx
call 0x44b972
mov eax, dword [ebp - 0x834]
inc eax
push eax
push edi
push 0
push dword [ebp - 0x830]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
xor ebx, ebx
inc ebx
jmp 0x44b659
cmp esi, 0xea
je 0x44b63a
test esi, esi
jne 0x44b63a
push edi
lea ecx, [ebp - 0x82c]
call fcn.00405370
mov ecx, dword [ebp - 0x83c]
lea eax, [ebp - 0x82c]
and dword [ebp - 4], esi
push eax
call fcn.0042aa60
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x82c]
call fcn.004054f0
cmp ebx, dword [ebp - 0x838]
jae 0x44b665
mov eax, dword [ebp - 0x834]
inc eax
push eax
push edi
push ebx
push dword [ebp - 0x830]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
inc ebx
mov esi, eax
cmp esi, 0x103
jne 0x44b5fe
xor esi, esi
lea eax, [ebp - 0x814]
cmp edi, eax
je 0x44b679
push 2
push edi
call fcn.0045cf49
pop ecx
pop ecx
push dword [ebp - 0x830]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
sete al
jmp 0x44b68e
xor al, al
call fcn.0045dac1
ret
Function at 0x44b694
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x838
mov eax, 0x4996df
call fcn.0045db17
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x844], eax
inc ebx
lea eax, [ebp - 0x834]
xor edi, edi
push eax
push ebx
push edi
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp dword [ebp - 0x834], edi
jne 0x44b6d5
xor al, al
jmp 0x44b859
push edi
push edi
push edi
lea eax, [ebp - 0x830]
mov dword [ebp - 0x830], edi
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov esi, eax
test esi, esi
jne 0x44b856
push 0x800
lea eax, [ebp - 0x814]
push edi
push eax
call fcn.0045f220
mov ecx, dword [ebp - 0x830]
add esp, 0xc
mov eax, 0x400
mov dword [ebp - 0x83c], eax
push 2
pop edx
cmp ecx, eax
jae 0x44b737
lea edi, [ebp - 0x814]
jmp 0x44b76d
lea eax, [ecx + 1]
xor ecx, ecx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0045d658
mov ecx, dword [ebp - 0x830]
mov edi, eax
inc ecx
push ecx
push 0
push edi
call fcn.0045f220
mov eax, dword [ebp - 0x830]
add esp, 0x10
inc eax
mov dword [ebp - 0x83c], eax
xor ecx, ecx
mov dword [ebp - 0x838], eax
push ecx
push ecx
lea eax, [ebp - 0x840]
mov dword [ebp - 0x840], ebx
push eax
push ecx
lea eax, [ebp - 0x838]
push eax
lea eax, [ebp - 0x814]
push eax
push ecx
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
jmp 0x44b830
cmp esi, 0xea
je 0x44b840
test esi, esi
jne 0x44b7fc
lea eax, [ebp - 0x814]
push eax
lea ecx, [ebp - 0x82c]
call fcn.00405370
mov ecx, dword [ebp - 0x844]
push eax
mov dword [ebp - 4], esi
call fcn.0042aa60
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x82c]
call fcn.004054f0
push 0x800
lea eax, [ebp - 0x814]
push esi
push eax
call fcn.0045f220
add esp, 0xc
jmp 0x44b7fe
xor esi, esi
mov eax, dword [ebp - 0x83c]
push esi
push esi
mov dword [ebp - 0x838], eax
lea eax, [ebp - 0x840]
push eax
push esi
lea eax, [ebp - 0x838]
push eax
lea eax, [ebp - 0x814]
push eax
push ebx
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
inc ebx
mov esi, eax
cmp esi, 0x103
jne 0x44b7a5
xor esi, esi
lea eax, [ebp - 0x814]
cmp edi, eax
je 0x44b854
push 2
push edi
call fcn.0045cf49
pop ecx
pop ecx
test esi, esi
sete al
call fcn.0045dac1
ret
Function at 0x44fdd4
Capabilities:
Get file size
Read file on windows

Disassembly:
push 4
mov eax, 0x499a39
call fcn.0045dae3
mov edi, edx
mov esi, ecx
push 0x78
call fcn.0045cf57
pop ecx
mov dword [ebp - 0x10], eax
xor ebx, ebx
mov ecx, eax
mov dword [ebp - 4], ebx
call fcn.0045326d
or dword [ebp - 4], 0xffffffff
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push esi
mov dword [edi], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x44fe86
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x10], eax
lea ecx, [eax + 1]
push ecx
call fcn.0045d658
pop ecx
push 0
mov esi, eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
push esi
mov byte [esi + eax], 0
mov ecx, dword [edi]
call fcn.00453338
push 1
push esi
test al, al
je 0x44fe70
call fcn.0045cf49
pop ecx
pop ecx
mov al, 1
jmp 0x44fe88
call fcn.0045cf49
pop ecx
pop ecx
mov ecx, dword [edi]
test ecx, ecx
je 0x44fe83
push ecx
call 0x44fe8e
and dword [edi], 0
xor al, al
call fcn.0045daac
ret

Function at 0x450ab7
Capabilities:
Check if file exists
Get file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor eax, eax
mov ebx, ecx
push eax
push 0x80
push 2
push eax
push eax
push 0x40000000
push ebx
mov edi, edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x450b15
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x450b11
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
and eax, 6
push ecx
push eax
push 2
push ecx
push ecx
push 0x40000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x450b15
xor al, al
jmp 0x450b42
mov ecx, dword [ebp + 8]
test ecx, ecx
jg 0x450b2a
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x450b21
sub ecx, edx
push 0
lea eax, [ebp - 4]
push eax
push ecx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x45452a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.0045e2e0
mov eax, dword [0x4d406c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x1008]
push edi
push eax
push 1
xor edi, edi
push edi
push edx
push ecx
mov dword [ebp - 0x1008], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4545d7
push 0x1000
lea eax, [ebp - 0x1004]
mov dword [ebp - 0x1010], 1
push edi
push eax
call fcn.0045f220
add esp, 0xc
mov dword [ebp - 0x100c], 0x800
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x1010]
push eax
push edi
push edi
push dword [ebp - 0x1008]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4545b9
cmp eax, 2
jne 0x4545d7
lea ecx, [ebp - 0x1004]
push ecx
mov ecx, esi
call fcn.0040ad20
push dword [ebp - 0x1008]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x4545d9
xor al, al
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0045cf38
leave
ret

Function at 0x454ba0
Capabilities:
Hash data with md5

Disassembly:
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x10], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret

Function at 0x45549c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4d406c]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x6c], edx
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x455531
lea ecx, [ebp - 0x64]
call fcn.00454ba0
push 0xa000
call fcn.0045d658
mov edi, eax
jmp 0x4554fa
cmp dword [ebp - 0x68], ebx
je 0x455516
push dword [ebp - 0x68]
mov edx, edi
lea ecx, [ebp - 0x64]
call fcn.00454bd0
pop ecx
push ebx
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], ebx
push eax
push 0xa000
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4554e8
jmp 0x455518
mov bl, 1
push edi
call fcn.0045d661
mov ecx, dword [ebp - 0x6c]
lea edx, [ebp - 0x64]
call 0x454c90
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045cf38
leave
ret

Function at 0x47c4f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x47c990
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x47c9a5
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x47c9b7
movzx eax, ax
or eax, 0x80070000
push eax
lea ecx, [ebp - 0x10]
call fcn.00484935
push 0x4cfcf0
lea eax, [ebp - 0x10]
push eax
call fcn.0045f8f4
int3
Function at 0x407d9c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407e75
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x407dd4
mov eax, dword [ebp - 4]
call fcn.004071d0
jmp 0x407ddc
mov eax, dword [ebp - 4]
call fcn.00407bd4
call fcn.00404ae8
mov esi, eax
test esi, esi
jle 0x407e28
mov ebx, 1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x407e12
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.004071d0
jmp 0x407e24
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0x10]
call fcn.00407bd4
inc ebx
dec esi
jne 0x407dec
push 1
push dword [ebp - 4]
push 0x407e8c
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00406f34
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004032cc
mov eax, dword [ebp - 0x14]
call fcn.0040340c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407e7c
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
mov ecx, 0x232e4562
nop
nop
nop
test eax, eax
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e024
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x22aa54ef
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e06c
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x4032d9
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 8], esi
test edi, edi
jne 0x4032f9
mov dword [ebp - 8], 0x8000
and dword [ebp - 4], 0
mov dword [ebp - 0xc], edi
test edi, edi
jne 0x40330b
mov dword [ebp - 0xc], 0x422a20
mov eax, dword [ebp + 8]
test eax, eax
jl 0x403320
mov ecx, dword [0x434758]
add ecx, eax
push ecx
call fcn.0040350a
lea eax, [ebp + 0x14]
push 4
push eax
call fcn.004034f4
test eax, eax
je 0x4034e2
test byte [ebp + 0x17], 0x80
je 0x40348d
mov ebx, dword [sym.imp.KERNEL32.DLL_GetTickCount]
call ebx
and dword [0x40d384], 0
and dword [0x40d380], 0
and dword [ebp + 0x14], 0x7fffffff
mov dword [ebp - 0x10], eax
mov eax, 0x40ea08
mov dword [0x40ce68], 8
mov dword [0x416a10], eax
mov dword [0x416a0c], eax
mov eax, dword [ebp + 0x14]
mov dword [0x416a08], 0x416a08
mov dword [ebp + 8], eax
jle 0x4034ea
mov esi, 0x4000
cmp dword [ebp + 0x14], esi
jge 0x403399
mov esi, dword [ebp + 0x14]
mov edi, 0x41ea20
push esi
push edi
call fcn.004034f4
test eax, eax
je 0x4034e2
sub dword [ebp + 0x14], esi
mov dword [0x40ce58], edi
mov dword [0x40ce5c], esi
mov edi, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
push 0x40ce58
mov dword [0x40ce60], edi
mov dword [0x40ce64], eax
call fcn.00406ac6
test eax, eax
mov dword [ebp - 0x14], eax
jl 0x403485
mov esi, dword [0x40ce60]
sub esi, edi
call ebx
test byte [0x4347b4], 1
mov edi, eax
je 0x403440
sub eax, dword [ebp - 0x10]
cmp eax, 0xc8
ja 0x403407
cmp dword [ebp + 0x14], 0
jne 0x403440
mov eax, dword [ebp + 8]
push dword [ebp + 8]
sub eax, dword [ebp + 0x14]
push 0x64
push eax
call dword [sym.imp.KERNEL32.DLL_MulDiv]
push eax
lea eax, [ebp - 0x94]
push str....__d__
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x94]
push eax
push 0
call fcn.004055fc
mov dword [ebp - 0x10], edi
test esi, esi
je 0x403479
cmp dword [ebp + 0x10], 0
jne 0x40345f
push esi
push dword [ebp - 0xc]
push dword [ebp + 0xc]
call fcn.00406119
test eax, eax
je 0x403489
add dword [ebp - 4], esi
jmp 0x40346d
mov eax, dword [0x40ce60]
add dword [ebp - 4], esi
sub dword [ebp - 8], esi
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x14], 1
jne 0x4033bc
jmp 0x4034ea
cmp dword [ebp + 0x14], 0
jg 0x40338c
jmp 0x4034ea
push 0xfffffffffffffffc
jmp 0x4034e4
push 0xfffffffffffffffe
jmp 0x4034e4
test edi, edi
jne 0x4034cf
cmp dword [ebp + 0x14], edi
jle 0x4034ea
mov ebx, dword [ebp - 8]
cmp dword [ebp + 0x14], ebx
mov esi, dword [ebp + 0x14]
jl 0x4034a3
mov esi, ebx
mov edi, 0x41ea20
push esi
push edi
call fcn.004034f4
test eax, eax
je 0x4034e2
push esi
push edi
push dword [ebp + 0xc]
call fcn.00406119
test eax, eax
je 0x403489
add dword [ebp - 4], esi
sub dword [ebp + 0x14], esi
cmp dword [ebp + 0x14], 0
jg 0x403499
jmp 0x4034ea
cmp dword [ebp + 0x14], esi
jge 0x4034d7
mov esi, dword [ebp + 0x14]
push esi
push edi
call fcn.004034f4
test eax, eax
jne 0x4034e7
push 0xfffffffffffffffd
pop eax
jmp 0x4034ed
mov dword [ebp - 4], esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x405b5a
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [0x42fa70], 0x44
push eax
xor eax, eax
push 0x42fa70
push eax
push eax
push 0x4000000
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
test eax, eax
je 0x405b99
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x405b9d
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push eax
and dword [eax + 0x24], 0
mov dword [eax], 0x3c
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
ret 4

Function at 0x405c3b
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push esi
call fcn.00406042
mov edi, eax
cmp edi, 0xffffffff
je 0x405c7c
test byte [esp + 0x10], 1
push esi
je 0x405c5e
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
jmp 0x405c64
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
test eax, eax
je 0x405c6d
xor eax, eax
inc eax
jmp 0x405c7e
test byte [esp + 0x10], 4
jne 0x405c7c
push edi
push esi
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
xor eax, eax
pop edi
pop esi
ret 8
Function at 0x405c83
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ebx
and eax, 4
push edi
mov dword [ebp - 4], eax
call fcn.00405f4e
test bl, 8
mov dword [ebp - 8], eax
je 0x405cc2
push edi
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
neg eax
sbb eax, eax
inc eax
add dword [0x434788], eax
jmp 0x405e3f
mov dword [ebp + 8], ebx
and dword [ebp + 8], 1
je 0x405cdc
test eax, eax
je 0x405ded
test bl, 2
je 0x405ded
mov esi, 0x42ea70
push edi
push esi
call fcn.00406577
cmp dword [ebp + 8], 0
je 0x405cfb
push str..
push esi
call sub.KERNEL32.DLL_lstrcatW
jmp 0x405d01
push edi
call fcn.00405e92
cmp word [edi], 0
jne 0x405d11
cmp word [0x42ea70], 0x5c
jne 0x405d1c
push 0x40a014
push edi
call sub.KERNEL32.DLL_lstrcatW
push edi
call sub.KERNEL32.DLL_lstrlenW
lea ebx, [edi + eax*2]
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405de2
cmp word [ebp - 0x22c], 0x2e
jne 0x405d66
cmp word [ebp - 0x22a], 0
je 0x405dc5
cmp word [ebp - 0x22a], 0x2e
jne 0x405d66
cmp word [ebp - 0x228], 0
je 0x405dc5
lea eax, [ebp - 0x22c]
push eax
push ebx
call fcn.00406577
test byte [ebp - 0x258], 0x10
je 0x405d91
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405dc5
push dword [ebp + 0xc]
push edi
call fcn.00405c83
jmp 0x405dc5
push dword [ebp - 4]
push edi
call fcn.00405c3b
test eax, eax
jne 0x405dbd
cmp dword [ebp - 4], eax
je 0x405db5
push edi
push 0xfffffffffffffff1
call fcn.004055fc
push 0
push edi
call fcn.00406337
jmp 0x405dc5
inc dword [0x434788]
jmp 0x405dc5
push edi
push 0xfffffffffffffff2
call fcn.004055fc
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x405d3e
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
cmp dword [ebp + 8], 0
je 0x405ded
and word [ebx - 2], 0
xor esi, esi
cmp dword [ebp + 8], esi
je 0x405e3f
cmp dword [ebp - 8], esi
jne 0x405e01
inc dword [0x434788]
jmp 0x405e3f
push edi
call fcn.004068d4
test eax, eax
je 0x405e3f
push edi
call fcn.00405e46
mov eax, dword [ebp - 4]
or al, 1
push eax
push edi
call fcn.00405c3b
test eax, eax
jne 0x405e37
cmp dword [ebp - 4], esi
je 0x405df9
push edi
push 0xfffffffffffffff1
call fcn.004055fc
push esi
push edi
call fcn.00406337
jmp 0x405e3f
push edi
push 0xffffffffffffffe5
call fcn.004055fc
pop edi
pop esi
pop ebx
leave
ret 8