joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4044dd
Capabilities:
Delete file
Read .ini file

Disassembly:
mov eax, 0x1004
call fcn.00408e10
mov eax, dword [0x42f180]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
push ebp
push esi
push edi
push dword [0x43292c]
mov edi, dword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
mov ebp, 0x1000
push ebp
lea eax, [esp + 0x18]
push eax
mov ebx, 0x425524
push ebx
push str.title
mov esi, 0x425f40
push esi
call edi
push 0x50
pop ecx
lea eax, [esp + 0x10]
mov edx, 0x431140
call fcn.004047ba
push dword [0x43292c]
lea eax, [esp + 0x14]
push ebp
push eax
push ebx
push str.info
push esi
call edi
mov ecx, ebp
lea eax, [esp + 0x10]
mov edx, 0x431580
call fcn.004047ba
push dword [0x43292c]
push 0x50
push 0x4327c0
push ebx
push str.build_info
push esi
call edi
push dword [0x43292c]
mov ebp, dword [sym.imp.kernel32.dll_GetPrivateProfileIntA]
push 1
push str.target_compile
push esi
call ebp
push dword [0x43292c]
mov dword [0x431194], eax
push 1
push str.target_optimize
push esi
call ebp
push dword [0x43292c]
mov dword [0x431190], eax
push 0xa
push 0x432590
push ebx
push str.target_version
push esi
call edi
push dword [0x43292c]
push 0x50
push 0x4312c0
push ebx
push str.name
push str.metadata
call edi
push dword [0x43292c]
push 0x104
push 0x4311a0
push ebx
push str.install_script
push esi
call edi
push dword [0x43292c]
mov ebp, 0x431550
push 0xa
push ebp
push ebx
push str.user_access_control
push esi
call edi
push 6
mov edi, str.force
mov esi, ebp
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x40462b
call fcn.004047ba
test eax, eax
je 0x404688
call fcn.00403547
test eax, eax
jne 0x404688
call fcn.004047ba
jmp 0x4046cb
push 5
mov edi, str.auto
mov esi, ebp
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x404658
call fcn.004047ba
test eax, eax
je 0x404688
call fcn.00403547
test eax, eax
jne 0x404688
call fcn.004047ba
test eax, eax
je 0x404688
jmp 0x404621
cmp byte [0x431550], al
je 0x404688
push 5
mov edi, str.none
mov esi, ebp
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x404688
push eax
push str.oops
push str.Bad_user_access_control_value
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x431140
call fcn.00402766
push eax
mov dword [0x432580], eax
call fcn.004047ba
pop ecx
pop ecx
push dword [0x432814]
call dword [sym.imp.kernel32.dll_UnmapViewOfFile]
mov eax, dword [0x43292c]
test eax, eax
je 0x4046bb
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov eax, dword [0x432930]
test eax, eax
je 0x4046cb
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [esp + 0x1010]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00407875
add esp, 0x1004
ret

Function at 0x407875
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42f180]
jne 0x40787f
repz ret
jmp fcn.0040bbd7
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x42e072
nop
nop
nop
mov ebx, 0x407ef8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x332d54c4
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x42e060
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
je 0x42e0d2
nop
nop
nop
nop
nop
mov ebx, 0x42cd70
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x160314a8
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x403c00
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x47], 0
je 0x403c22
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0x46
jb 0x403c10
mov byte [esi + 0x47], 0
mov eax, esi
pop esi
ret

Function at 0x403c30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46537d
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
push edi
mov eax, dword [0x47e048]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], edx
mov edi, ecx
mov dword [ebp - 0x18], edi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x18], edi
cmp byte [esi + 7], 0
je 0x403c82
xor edx, edx
nop dword [eax]
lea ecx, [esi + edx]
lea eax, [edx + 0x65]
inc edx
xor byte [ecx], al
cmp edx, 6
jb 0x403c70
mov byte [esi + 7], 0
lea eax, [ebp - 0xd]
push eax
lea eax, [esi + 6]
push eax
push esi
lea ecx, [ebp - 0x34]
call fcn.00408070
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], 0
cmp dword [eax + 0x14], 0x10
mov ecx, dword [eax + 0x10]
jb 0x403ca8
mov eax, dword [eax]
push ecx
push eax
push 0
lea ecx, [ebp - 0x34]
call fcn.0040a8c0
xorps xmm0, xmm0
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [edi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [edi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [ebp - 0x20]
cmp ecx, 0x10
jb 0x403d1f
mov edx, dword [ebp - 0x34]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403d15
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x403d15
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041abdb
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x403d40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46537d
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
push edi
mov eax, dword [0x47e048]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], edx
mov edi, ecx
mov dword [ebp - 0x18], edi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x18], edi
cmp byte [esi + 9], 0
je 0x403d92
xor edx, edx
nop dword [eax]
lea ecx, [esi + edx]
lea eax, [edx + 0x65]
inc edx
xor byte [ecx], al
cmp edx, 8
jb 0x403d80
mov byte [esi + 9], 0
lea eax, [ebp - 0xd]
push eax
lea eax, [esi + 8]
push eax
push esi
lea ecx, [ebp - 0x34]
call fcn.00408070
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], 0
cmp dword [eax + 0x14], 0x10
mov ecx, dword [eax + 0x10]
jb 0x403db8
mov eax, dword [eax]
push ecx
push eax
push 0
lea ecx, [ebp - 0x34]
call fcn.0040a8c0
xorps xmm0, xmm0
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [edi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [edi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [ebp - 0x20]
cmp ecx, 0x10
jb 0x403e2f
mov edx, dword [ebp - 0x34]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403e25
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x403e25
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041abdb
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x403e50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46537d
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
push edi
mov eax, dword [0x47e048]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], edx
mov edi, ecx
mov dword [ebp - 0x18], edi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x18], edi
cmp byte [esi + 0xa], 0
je 0x403ea2
xor edx, edx
nop dword [eax]
lea ecx, [esi + edx]
lea eax, [edx + 0x65]
inc edx
xor byte [ecx], al
cmp edx, 9
jb 0x403e90
mov byte [esi + 0xa], 0
lea eax, [ebp - 0xd]
push eax
lea eax, [esi + 9]
push eax
push esi
lea ecx, [ebp - 0x34]
call fcn.00408070
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], 0
cmp dword [eax + 0x14], 0x10
mov ecx, dword [eax + 0x10]
jb 0x403ec8
mov eax, dword [eax]
push ecx
push eax
push 0
lea ecx, [ebp - 0x34]
call fcn.0040a8c0
xorps xmm0, xmm0
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [edi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [edi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [ebp - 0x20]
cmp ecx, 0x10
jb 0x403f3f
mov edx, dword [ebp - 0x34]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403f35
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x403f35
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041abdb
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x403f60
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x44], 0
je 0x403f82
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0x43
jb 0x403f70
mov byte [esi + 0x44], 0
mov eax, esi
pop esi
ret

Function at 0x403f90
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x136], 0
je 0x403fb7
xor eax, eax
nop
lea edx, [eax + esi]
lea ecx, [eax + 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0x135
jb 0x403fa0
mov byte [esi + 0x136], 0
mov eax, esi
pop esi
ret
Function at 0x4042f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46537d
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
push edi
mov eax, dword [0x47e048]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], edx
mov edi, ecx
mov dword [ebp - 0x18], edi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x18], edi
cmp byte [esi + 0xc], 0
je 0x404342
xor edx, edx
nop dword [eax]
lea ecx, [esi + edx]
lea eax, [edx + 0x65]
inc edx
xor byte [ecx], al
cmp edx, 0xb
jb 0x404330
mov byte [esi + 0xc], 0
lea eax, [ebp - 0xd]
push eax
lea eax, [esi + 0xb]
push eax
push esi
lea ecx, [ebp - 0x34]
call fcn.00408070
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], 0
cmp dword [eax + 0x14], 0x10
mov ecx, dword [eax + 0x10]
jb 0x404368
mov eax, dword [eax]
push ecx
push eax
push 0
lea ecx, [ebp - 0x34]
call fcn.0040a8c0
xorps xmm0, xmm0
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [edi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [edi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [ebp - 0x20]
cmp ecx, 0x10
jb 0x4043df
mov edx, dword [ebp - 0x34]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4043d5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4043d5
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041abdb
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x413ce0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x47e048]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x108], eax
mov esi, edx
mov eax, dword [ebp + 0x10]
mov edi, ecx
push 0x40
mov dword [ebp - 0x10c], eax
lea eax, [ebp - 0x104]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x40
lea eax, [ebp - 0x44]
push 0x36
push eax
call sub.VCRUNTIME140.dll_memset
push 0x40
lea eax, [ebp - 0x84]
push 0x5c
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x24
lea eax, [ebp - 0x104]
cmp esi, 0x40
jbe 0x413d58
push 0x40
push eax
mov edx, esi
mov ecx, edi
call fcn.00413e90
add esp, 8
jmp 0x413d63
push esi
push edi
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
xor eax, eax
nop word [eax + eax]
movups xmm1, xmmword [ebp + eax - 0x104]
movups xmm0, xmmword [ebp + eax - 0x44]
xorps xmm0, xmm1
movups xmmword [ebp + eax - 0x44], xmm0
movups xmm0, xmmword [ebp + eax - 0x84]
xorps xmm0, xmm1
movups xmmword [ebp + eax - 0x84], xmm0
add eax, 0x10
cmp eax, 0x40
jl 0x413d70
mov esi, dword [ebp + 0xc]
lea ebx, [esi + 0x40]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
movups xmm0, xmmword [ebp - 0x44]
mov edi, eax
push esi
push dword [ebp - 0x108]
movups xmmword [edi], xmm0
lea eax, [edi + 0x40]
movups xmm0, xmmword [ebp - 0x34]
push eax
movups xmmword [edi + 0x10], xmm0
movups xmm0, xmmword [ebp - 0x24]
movups xmmword [edi + 0x20], xmm0
movups xmm0, xmmword [ebp - 0x14]
movups xmmword [edi + 0x30], xmm0
call sub.VCRUNTIME140.dll_memcpy
lea eax, [ebp - 0xa4]
mov edx, ebx
push 0x20
push eax
mov ecx, edi
call fcn.00413e90
push edi
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
call edi
push 0x60
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
movups xmm0, xmmword [ebp - 0x84]
mov esi, eax
mov edx, 0x60
lea eax, [ebp - 0xc4]
mov ecx, esi
push 0x20
push eax
movups xmmword [esi], xmm0
movups xmm0, xmmword [ebp - 0x74]
movups xmmword [esi + 0x10], xmm0
movups xmm0, xmmword [ebp - 0x64]
movups xmmword [esi + 0x20], xmm0
movups xmm0, xmmword [ebp - 0x54]
movups xmmword [esi + 0x30], xmm0
movups xmm0, xmmword [ebp - 0xa4]
movups xmmword [esi + 0x40], xmm0
movups xmm0, xmmword [ebp - 0x94]
movups xmmword [esi + 0x50], xmm0
call fcn.00413e90
push esi
call edi
mov esi, dword [ebp + 0x14]
mov eax, 0x20
cmp esi, eax
cmova esi, eax
lea eax, [ebp - 0xc4]
push esi
push eax
push dword [ebp - 0x10c]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [ebp - 4]
add esp, 0x38
mov eax, esi
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0041abe9
mov esp, ebp
pop ebp
ret
Function at 0x413e90
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x9c
mov eax, dword [0x47e048]
xor eax, esp
mov dword [esp + 0x98], eax
push esi
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
push edx
mov edx, ecx
mov dword [esp + 0x34], 0
lea ecx, [esp + 0xc]
movlpd qword [esp + 0xc], xmm0
mov dword [esp + 0x14], 0x6a09e667
mov dword [esp + 0x18], 0xbb67ae85
mov dword [esp + 0x1c], 0x3c6ef372
mov dword [esp + 0x20], 0xa54ff53a
mov dword [esp + 0x24], 0x510e527f
mov dword [esp + 0x28], 0x9b05688c
mov dword [esp + 0x2c], 0x1f83d9ab
mov dword [esp + 0x30], 0x5be0cd19
call fcn.00414140
lea edx, [esp + 0x80]
lea ecx, [esp + 0xc]
call fcn.004141f0
mov eax, dword [ebp + 0xc]
mov ecx, 0x20
cmp eax, ecx
cmova eax, ecx
push eax
lea eax, [esp + 0x84]
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0xac]
add esp, 0x10
pop esi
xor ecx, esp
call fcn.0041abe9
mov esp, ebp
pop ebp
ret
Function at 0x4141f0
Capabilities:
Enumerate pe sections

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, edx
mov ecx, dword [esi + 0x28]
cmp ecx, 0x40
jae 0x414384
lea eax, [ecx*8]
add dword [esi], eax
push ebx
adc dword [esi + 4], 0
mov byte [ecx + esi + 0x2c], 0x80
mov eax, dword [esi + 0x28]
inc eax
mov dword [esi + 0x28], eax
cmp eax, 0x38
jbe 0x41424e
cmp eax, 0x40
jae 0x414237
mov byte [eax + esi + 0x2c], 0
mov eax, dword [esi + 0x28]
inc eax
mov dword [esi + 0x28], eax
cmp eax, 0x40
jb 0x414226
lea ebx, [esi + 0x2c]
mov ecx, esi
mov edx, ebx
call fcn.00413f50
mov dword [esi + 0x28], 0
xor eax, eax
jmp 0x414253
lea ebx, [esi + 0x2c]
jae 0x414264
mov byte [eax + esi + 0x2c], 0
mov eax, dword [esi + 0x28]
inc eax
mov dword [esi + 0x28], eax
cmp eax, 0x38
jb 0x414253
movzx eax, byte [esi + 7]
mov edx, ebx
mov byte [esi + 0x64], al
mov ecx, esi
movzx eax, byte [esi + 6]
mov byte [esi + 0x65], al
movzx eax, byte [esi + 5]
mov byte [esi + 0x66], al
movzx eax, byte [esi + 4]
mov byte [esi + 0x67], al
movzx eax, byte [esi + 3]
mov byte [esi + 0x68], al
movzx eax, byte [esi + 2]
mov byte [esi + 0x69], al
movzx eax, byte [esi + 1]
mov byte [esi + 0x6a], al
movzx eax, byte [esi]
mov byte [esi + 0x6b], al
call fcn.00413f50
movzx eax, byte [esi + 0xb]
mov byte [edi], al
movzx eax, byte [esi + 0xa]
mov byte [edi + 1], al
movzx eax, byte [esi + 9]
mov byte [edi + 2], al
movzx eax, byte [esi + 8]
mov byte [edi + 3], al
movzx eax, byte [esi + 0xf]
mov byte [edi + 4], al
movzx eax, byte [esi + 0xe]
mov byte [edi + 5], al
movzx eax, byte [esi + 0xd]
mov byte [edi + 6], al
movzx eax, byte [esi + 0xc]
mov byte [edi + 7], al
movzx eax, byte [esi + 0x13]
mov byte [edi + 8], al
movzx eax, byte [esi + 0x12]
mov byte [edi + 9], al
movzx eax, byte [esi + 0x11]
mov byte [edi + 0xa], al
movzx eax, byte [esi + 0x10]
mov byte [edi + 0xb], al
movzx eax, byte [esi + 0x17]
mov byte [edi + 0xc], al
movzx eax, byte [esi + 0x16]
mov byte [edi + 0xd], al
movzx eax, byte [esi + 0x15]
mov byte [edi + 0xe], al
movzx eax, byte [esi + 0x14]
mov byte [edi + 0xf], al
movzx eax, byte [esi + 0x1b]
mov byte [edi + 0x10], al
movzx eax, byte [esi + 0x1a]
mov byte [edi + 0x11], al
movzx eax, byte [esi + 0x19]
mov byte [edi + 0x12], al
movzx eax, byte [esi + 0x18]
mov byte [edi + 0x13], al
movzx eax, byte [esi + 0x1f]
mov byte [edi + 0x14], al
movzx eax, byte [esi + 0x1e]
mov byte [edi + 0x15], al
movzx eax, byte [esi + 0x1d]
mov byte [edi + 0x16], al
movzx eax, byte [esi + 0x1c]
mov byte [edi + 0x17], al
movzx eax, byte [esi + 0x23]
mov byte [edi + 0x18], al
movzx eax, byte [esi + 0x22]
mov byte [edi + 0x19], al
movzx eax, byte [esi + 0x21]
mov byte [edi + 0x1a], al
movzx eax, byte [esi + 0x20]
mov byte [edi + 0x1b], al
movzx eax, byte [esi + 0x27]
mov byte [edi + 0x1c], al
movzx eax, byte [esi + 0x26]
mov byte [edi + 0x1d], al
movzx eax, byte [esi + 0x25]
mov byte [edi + 0x1e], al
movzx eax, byte [esi + 0x24]
mov byte [edi + 0x1f], al
pop ebx
pop edi
pop esi
ret
Function at 0x416c20
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
sub esp, 0x18
xorps xmm0, xmm0
mov ecx, esp
push 0xf
movups xmmword [ecx], xmm0
push str.sc_stop_HookDrv
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.00408640
call fcn.00417b10
mov ecx, esp
xorps xmm0, xmm0
push 0x11
push str.sc_delete_HookDrv
movups xmmword [ecx], xmm0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.00408640
call fcn.00417b10
add esp, 0x18
push 0x46a91c
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x416c90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x47e048]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x416d4c
cmp byte [esi + 0x3d], 0
je 0x416d4c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x416d3a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x416d01
sub eax, 1
je 0x416d05
sub eax, 2
jne 0x416d3a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041abe9
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x416d23
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x416d3a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041abe9
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041abe9
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.0041abe9
mov esp, ebp
pop ebp
ret
Function at 0x417b10
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46679d
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x47e048]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 3
push 0x46a89c
push 0
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0
call fcn.0040a8c0
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x50], 0x3c
cmovae eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x50]
push eax
movlpd qword [ebp - 0x2c], xmm0
movlpd qword [ebp - 0x24], xmm0
movlpd qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x4c], 0x40
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], str.cmd.exe
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x417bbc
or esi, 0xffffffff
jmp 0x417be0
push 0xffffffffffffffff
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x14]
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0x10
jb 0x417c16
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x417c0c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x417c0c
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041abdb
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041abe9
mov esp, ebp
pop ebp
ret