joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a80c
Capabilities:
Set current directory

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, 0x4107ac
mov dword [esi], eax
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi + 8], 0x4107cc
mov eax, 0x40a868
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 1
xor eax, eax
mov dword [esi + 0x14], eax
xor eax, eax
mov dword [esi + 0x18], eax
push esi
call sub.shell32.dll_SHBrowseForFolderA
mov dword [0x4108d4], eax
cmp dword [0x4108d4], 0
je 0x40a862
push ebx
mov eax, dword [0x4108d4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
push ebx
call sub.kernel32.dll_SetCurrentDirectoryA
pop esi
pop ebx
ret

Function at 0x40b1a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 0xc]
xor eax, eax
mov dword [ebx], eax
mov dword [ebp - 8], 0xffffffff
mov dx, 1
xor eax, eax
call fcn.0040b14c
mov eax, dword [0x40f4a4]
mov eax, dword [eax]
xor edx, edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
xor edx, edx
mov eax, dword [ebp - 0x10]
call fcn.0040b14c
mov eax, dword [ebp + 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push edi
mov eax, dword [esi]
push eax
call sub.kernel32.dll_ReadFile
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x40b2c4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov eax, dword [0x40f4c8]
cmp byte [eax], 0
je 0x40b2e6
mov eax, dword [0x40f634]
xor edx, edx
mov dword [eax], edx
xor eax, eax
mov dword [0x410920], eax
or eax, 0xffffffff
pop esi
pop ebx
ret
mov eax, dword [0x40f634]
cmp dword [eax], 0
jg 0x40b2ff
xor eax, eax
mov dword [0x410920], eax
or eax, 0xffffffff
jmp 0x40b3b8
movzx eax, word [0x41091c]
cmp eax, dword [0x410920]
jb 0x40b381
push 0x410920
push 0
mov eax, dword [0x40f634]
mov eax, dword [eax]
mov edx, 0x8000
call fcn.0040d9a4
mov ecx, eax
mov edx, dword [0x410914]
mov eax, dword [0x40f454]
call fcn.0040b1a0
mov eax, dword [0x40f624]
mov ax, word [eax + 6]
and ax, 1
cmp ax, 1
jne 0x40b378
mov esi, dword [0x410920]
dec esi
test esi, esi
jl 0x40b378
inc esi
xor ebx, ebx
call fcn.0040c964
mov edx, dword [0x410914]
xor byte [edx + ebx], al
mov eax, dword [0x410914]
mov al, byte [eax + ebx]
call fcn.0040c890
inc ebx
dec esi
jne 0x40b359
mov word [0x41091c], 0
cmp dword [0x410920], 0
jne 0x40b398
mov word [0x41091c], 0
or eax, 0xffffffff
jmp 0x40b3b8
movzx eax, word [0x41091c]
mov edx, dword [0x410914]
movzx eax, byte [edx + eax]
inc word [0x41091c]
mov edx, dword [0x40f634]
dec dword [edx]
pop esi
pop ebx
ret
Function at 0x40b40c
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebp, esp
mov eax, dword [0x41090c]
mov dword [ebp], eax
mov ax, word [0x410910]
mov word [esp + 4], ax
mov bx, word [0x410924]
mov si, word [esp + 4]
and si, 7
lea ecx, [esp + 4]
mov edx, ebp
mov eax, esi
call fcn.0040b400
lea ecx, [esp + 4]
mov edx, ebp
mov ax, 0x10
call fcn.0040b3bc
mov si, word [ebp]
and si, 0xffff
lea ecx, [esp + 4]
mov edx, ebp
mov ax, 0x10
call fcn.0040b400
lea ecx, [esp + 4]
mov edx, ebp
mov ax, 0x10
call fcn.0040b3bc
mov ax, word [ebp]
not ax
and ax, 0xffff
cmp si, ax
je 0x40b494
mov word [0x410924], 0
lea ecx, [esp + 4]
mov edx, ebp
mov ax, 0x10
call fcn.0040b400
test si, si
je 0x40b531
dec esi
lea ecx, [esp + 4]
mov edx, ebp
mov ax, 8
call fcn.0040b3bc
movzx eax, bx
mov edx, dword [0x410918]
mov cl, byte [ebp]
mov byte [edx + eax], cl
inc ebx
cmp bx, 0x8000
jne 0x40b50f
push 0
lea eax, [esp + 0xc]
push eax
movzx eax, bx
push eax
mov eax, dword [0x410918]
push eax
mov eax, dword [0x40f5f4]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_WriteFile_1
movzx edi, bx
mov eax, edi
call fcn.0040d828
mov ecx, dword [0x40f544]
mov edx, edi
mov eax, dword [0x410918]
call fcn.0040d980
xor ebx, ebx
lea ecx, [esp + 4]
mov edx, ebp
mov ax, 8
call fcn.0040b400
mov eax, dword [0x40f4c8]
cmp byte [eax], 0
jne 0x40b54b
test si, si
jne 0x40b4ac
mov word [0x410924], bx
mov eax, dword [ebp]
mov dword [0x41090c], eax
mov ax, word [esp + 4]
mov word [0x410910], ax
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40c448
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, 0x410908
mov word [0x41091c], 0
xor eax, eax
mov dword [0x410920], eax
mov word [0x410924], 0
mov word [0x410910], 0
xor eax, eax
mov dword [0x41090c], eax
xor ebx, ebx
xor eax, eax
mov dword [0x410914], eax
xor eax, eax
mov dword [0x410918], eax
mov eax, 0x8002
call fcn.00402874
mov dword [0x410914], eax
mov eax, 0x8002
call fcn.00402874
mov dword [0x410918], eax
xor eax, eax
push ebp
push 0x40c593
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [0x410928], eax
xor eax, eax
mov dword [0x41092c], eax
xor eax, eax
push ebp
push 0x40c55d
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [esi], 0
lea eax, [ebp - 4]
call fcn.0040c3a8
cmp bx, word [esi]
jae 0x40c4ec
mov bx, word [esi]
cmp dword [ebp - 4], 0
jne 0x40c4fc
mov eax, dword [0x40f4c8]
cmp byte [eax], 0
je 0x40c4d7
cmp word [0x410924], 0
jbe 0x40c553
push 0
lea eax, [ebp - 8]
push eax
movzx eax, word [0x410924]
push eax
mov eax, dword [0x410918]
push eax
mov eax, dword [0x40f5f4]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_WriteFile_1
movzx eax, word [0x410924]
call fcn.0040d828
mov ecx, dword [0x40f544]
movzx edx, word [0x410924]
mov eax, dword [0x410918]
call fcn.0040d980
mov word [0x410924], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x40c567
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c59a
mov edx, 0x8001
mov eax, dword [0x410914]
call fcn.004028a4
mov edx, 0x8001
mov eax, dword [0x410918]
call fcn.004028a4
ret
Function at 0x40c5dc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x40c790
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00403fbc
jmp 0x40c734
mov edx, dword [ebp - 8]
mov eax, 0x40c7a8
call fcn.00404278
mov dword [ebp - 0x10], eax
mov esi, dword [ebp - 0x10]
dec esi
test esi, esi
jle 0x40c63f
mov edi, 1
mov eax, dword [ebp - 8]
mov al, byte [eax + edi - 1]
mov edx, dword [ebp - 4]
mov byte [edx + ebx], al
inc ebx
inc edi
dec esi
jne 0x40c62d
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x40c7b4
call fcn.00404278
mov ecx, eax
sub ecx, dword [ebp - 0x10]
inc ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00404238
lea eax, [ebp - 8]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x40c7b4
call fcn.00404278
inc eax
push eax
mov eax, dword [ebp - 8]
call fcn.00404054
mov ecx, eax
mov eax, dword [ebp - 8]
pop edx
call fcn.00404238
mov eax, dword [ebp - 0xc]
mov edx, 0x40c7c0
call fcn.0040412c
jne 0x40c6c4
mov eax, dword [0x40f5c0]
call fcn.0040dad0
movzx ecx, ax
mov eax, dword [ebp - 4]
lea edx, [eax + ebx]
mov eax, dword [0x40f5c0]
call fcn.00402a00
mov eax, dword [0x40f5c0]
call fcn.0040dad0
movzx eax, ax
add ebx, eax
jmp 0x40c734
mov eax, dword [ebp - 0xc]
mov edx, 0x40c7d0
call fcn.0040412c
jne 0x40c6ea
mov eax, pe_nt_image_headers32
sub eax, ebx
push eax
mov eax, dword [ebp - 4]
add eax, ebx
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
add ebx, eax
jmp 0x40c734
mov eax, dword [ebp - 0xc]
mov edx, 0x40c7e0
call fcn.0040412c
jne 0x40c710
mov eax, pe_nt_image_headers32
sub eax, ebx
push eax
mov eax, dword [ebp - 4]
add eax, ebx
push eax
call sub.kernel32.dll_GetSystemDirectoryA
add ebx, eax
jmp 0x40c734
mov eax, dword [ebp - 0xc]
mov edx, 0x40c7f0
call fcn.0040412c
jne 0x40c734
mov eax, dword [ebp - 4]
add eax, ebx
push eax
mov eax, pe_nt_image_headers32
sub eax, ebx
push eax
call sub.kernel32.dll_GetTempPathA
add ebx, eax
mov edx, dword [ebp - 8]
mov eax, 0x40c7a8
call fcn.00404278
test eax, eax
jne 0x40c610
mov eax, dword [ebp - 8]
call fcn.00404054
mov esi, eax
test esi, esi
jle 0x40c76e
mov edi, 1
mov eax, dword [ebp - 8]
mov al, byte [eax + edi - 1]
mov edx, dword [ebp - 4]
mov byte [edx + ebx], al
inc ebx
inc edi
dec esi
jne 0x40c75c
mov eax, dword [ebp - 4]
mov byte [eax + ebx], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c797
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00403e04
ret

Function at 0x40c890
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, 0x410950
mov edx, dword [esi]
mov eax, ebx
call fcn.0040c874
mov edi, eax
mov dword [esi], edi
and edi, 0xff
add dword [esi + 4], edi
imul ebx, dword [esi + 4], 0x8088405
inc ebx
mov dword [esi + 4], ebx
mov eax, ebx
call fcn.00405140
call fcn.00405144
mov edx, dword [esi + 8]
call fcn.0040c874
mov dword [esi + 8], eax
pop edi
pop esi
pop ebx
ret
Function at 0x40c988
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov byte [ebp - 1], dl
mov esi, eax
mov eax, dword [ebp + 8]
call fcn.004041d0
xor eax, eax
push ebp
push 0x40ca51
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 2], 0
cmp dword [ebp + 8], 0
je 0x40ca3b
mov eax, dword [ebp + 8]
call fcn.0040c8d8
mov al, byte [ebp - 1]
dec eax
test al, al
jb 0x40c9fe
inc eax
mov byte [ebp - 4], al
mov bl, 0
call fcn.0040c964
xor edx, edx
mov dl, bl
xor ecx, ecx
mov cl, byte [ebp - 1]
add edx, ecx
xor al, byte [esi + edx]
mov byte [ebp - 3], al
mov al, byte [ebp - 3]
call fcn.0040c890
xor eax, eax
mov al, bl
mov dl, byte [ebp - 3]
mov byte [esi + eax], dl
inc ebx
dec byte [ebp - 4]
jne 0x40c9d0
xor eax, eax
mov al, byte [ebp - 1]
mov bl, byte [esi + eax - 1]
and di, 8
cmp di, 8
je 0x40ca28
mov eax, dword [ebp + 0x10]
call fcn.00405140
call fcn.00405144
cmp bl, al
jne 0x40ca3b
mov byte [ebp - 2], 1
jmp 0x40ca3b
xor eax, eax
mov al, bl
movzx edx, word [ebp + 0xc]
shr edx, 8
cmp eax, edx
jne 0x40ca3b
mov byte [ebp - 2], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ca58
lea eax, [ebp + 8]
call fcn.00403de0
ret

Function at 0x40d9ac
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, dword [0x40f634]
mov eax, dword [edi]
mov edx, 0x8000
call fcn.0040d9a4
add eax, 2
call fcn.00402874
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x40dac2
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [edi], 0
jle 0x40daa7
lea eax, [ebp - 4]
push eax
push 0
mov eax, dword [edi]
mov edx, 0x8000
call fcn.0040d9a4
mov ecx, eax
mov edx, dword [ebp - 8]
mov eax, dword [0x40f454]
call fcn.0040b1a0
mov eax, dword [edi]
mov edx, 0x8000
call fcn.0040d9a4
cmp eax, dword [ebp - 4]
jbe 0x40da25
call fcn.004038c4
jmp 0x40dac9
mov eax, dword [ebp - 4]
sub dword [edi], eax
mov eax, dword [0x40f624]
mov ax, word [eax + 6]
and ax, 1
cmp ax, 1
jne 0x40da6a
mov esi, dword [ebp - 4]
dec esi
test esi, esi
jl 0x40da6a
inc esi
xor ebx, ebx
call fcn.0040c964
mov edx, dword [ebp - 8]
mov dl, byte [edx + ebx]
xor al, dl
mov edx, dword [ebp - 8]
mov byte [edx + ebx], al
mov eax, dword [ebp - 8]
mov al, byte [eax + ebx]
call fcn.0040c890
inc ebx
dec esi
jne 0x40da48
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x40f5f4]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_WriteFile_1
mov eax, dword [ebp - 4]
call fcn.0040d828
mov ecx, dword [0x40f544]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.0040d980
cmp dword [edi], 0
jg 0x40d9e9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40dac9
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.004028a4
ret
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x420860
Capabilities:
Inspect section memory permissions

Disassembly:
sub esp, 0x124
push ebx
push ebp
push esi
push edi
mov ecx, 0x3e
xor eax, eax
lea edi, [esp + 0x3c]
xor ebx, ebx
rep stosd dword es:[edi], eax
mov ecx, 0xa
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x138]
lea eax, [esp + 0x3c]
push eax
push ecx
mov dword [esp + 0x18], ebx
xor esi, esi
call fcn.00420cd0
add eax, 4
movsx edx, word [esp + 0x50]
jo 0x4209b6
add eax, 0x14
jo 0x4209b6
add eax, edx
jo 0x4209b6
mov edi, eax
mov ax, word [esp + 0x42]
sub ax, 1
jo 0x4209b6
movsx ebp, ax
cmp ebp, ebx
jl 0x4209a7
lea ecx, [esp + 0x14]
push ecx
call fcn.004210b0
push 0x28
push edi
push eax
call fcn.00421000
mov eax, dword [esp + 0x38]
test eax, 0x20000000
je 0x42091e
test eax, 0x40000000
je 0x42090d
and eax, 0x80000000
neg eax
sbb eax, eax
and eax, 0x20
add eax, 0x20
jmp 0x420943
and eax, 0x80000000
neg eax
sbb eax, eax
and eax, 0x70
add eax, 0x10
jmp 0x420943
test eax, 0x40000000
je 0x420936
and eax, 0x80000000
neg eax
sbb eax, eax
and eax, 2
add eax, 2
jmp 0x420943
and eax, 0x80000000
neg eax
sbb eax, eax
and eax, 7
inc eax
lea edx, [esp + 0x10]
mov esi, eax
push edx
call fcn.004210b0
push eax
push esi
mov ecx, dword [esp + 0x28]
mov esi, dword [esp + 0x140]
mov eax, dword [esp + 0x24]
add ecx, esi
push eax
jo 0x4209b6
push ecx
call fcn.00420fe0
test eax, eax
je 0x420990
add edi, 0x28
jo 0x4209b6
add ebx, 1
jo 0x4209b6
cmp ebx, ebp
jle 0x4208d7
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x124
ret 4
mov esi, 4
call dword [sym.imp.KERNEL32.DLL_SetFileApisToANSI]
call dword [sym.imp.KERNEL32.DLL_SetFileApisToOEM]
call dword [sym.imp.USER32.DLL_WaitMessage]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x124
ret 4
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]
nop
nop
nop
nop

Function at 0xf16900
Capabilities:
Encode data using xor

Disassembly:
jmp 0xf1690a
pushal
call 0xf16910
pop ebp
sub ebp, 0x10
sub ebp, 0xb16900
jmp 0xf16926
mov eax, 0xb16900
add eax, ebp
add eax, 0x4c
mov ecx, 0x5bb
mov edx, 0x5cb6e2cb
xor byte [eax], dl
inc eax
dec ecx
jne 0xf1693d
jmp 0xf16950
inc eax
push es
inc eax
inc edx
test ebx, 0xa4acbcb
xor ecx, ebx
retf
Function at 0x100dd1ae
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100dd024

Function at 0x401026
Capabilities:
Create process on windows
Delete file
Read file on windows
Set file attributes
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov edx, section..text
push edi
push esi
push ebx
sub esp, 0x574
lea ecx, [esp + 0x64]
cmp edx, entry0
jae 0x40104c
movzx eax, byte [edx]
inc edx
xor al, 0xd9
mov byte [ecx], al
inc ecx
jmp 0x401039
mov byte [ecx], 0
lea esi, [esp + 0x64]
push esi
push 1
push 0
call 0x401220
push 0x104
lea ebx, [esp + 0x468]
push ebx
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push ebx
call sub.KERNEL32.dll_CreateFileA
test eax, eax
mov ebx, eax
je 0x401205
cmp eax, 0xffffffff
je 0x401205
push 2
push 0
push 0xffffffffffffff9c
push eax
call sub.KERNEL32.dll_SetFilePointer
push 0
lea ebp, [esp + 4]
push ebp
push 0x64
push esi
push ebx
call sub.KERNEL32.dll_ReadFile
push ebx
call sub.KERNEL32.dll_CloseHandle
lea edx, [esp + 0x65]
lea ecx, [esp + 0xc7]
cmp edx, ecx
jae 0x4010d4
movzx eax, byte [esp + 0x64]
xor byte [edx], al
inc edx
jmp 0x4010c6
lea edx, [esp + 0x14]
lea eax, [esp + 0x58]
cmp edx, eax
jae 0x4010e6
mov byte [edx], 0
inc edx
jmp 0x4010dc
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x8d]
push eax
call sub.KERNEL32.dll_CreateProcessA
test eax, eax
jne 0x401205
push 0
push 0
push 3
push 0
push 1
push 0x80000000
lea eax, [esp + 0x47c]
push eax
call sub.KERNEL32.dll_CreateFileA
test eax, eax
mov ebx, eax
je 0x401205
cmp eax, 0xffffffff
je 0x401205
push 2
mov eax, 0xffffff9c
push 0
sub eax, dword [esp + 0x6d]
push eax
push ebx
call sub.KERNEL32.dll_SetFilePointer
push 0
push ebp
push dword [esp + 0x6d]
push dword [esp + 0x71]
push 0
call sub.KERNEL32.dll_GetProcessHeap
push eax
call sub.KERNEL32.dll_HeapAlloc
push eax
mov esi, eax
push ebx
call sub.KERNEL32.dll_ReadFile
push ebx
call sub.KERNEL32.dll_CloseHandle
mov eax, esi
mov edx, esi
add eax, dword [esp + 0x65]
cmp esi, eax
jae 0x40119b
movzx eax, byte [esp + 0x64]
xor byte [edx], al
mov eax, esi
inc edx
add eax, dword [esp + 0x65]
cmp edx, eax
jmp 0x401187
push pe_nt_image_headers32
lea edi, [esp + 0x6d]
push edi
call sub.KERNEL32.dll_SetFileAttributesA
push edi
call sub.KERNEL32.dll_DeleteFileA
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push edi
call sub.KERNEL32.dll_CreateFileA
test eax, eax
mov ebx, eax
je 0x401205
cmp eax, 0xffffffff
je 0x401205
push 0
push ebp
push dword [esp + 0x6d]
push esi
push eax
call sub.KERNEL32.dll_WriteFile
push ebx
call sub.KERNEL32.dll_CloseHandle
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push edi
call sub.KERNEL32.dll_CreateProcessA
push 0
call sub.KERNEL32.dll_ExitProcess
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp dword [sym.imp.KERNEL32.dll_CreateMutexA]
Function at 0x41dbc8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc48
xor eax, eax
mov dword [ebp - 0x3b8], eax
mov dword [ebp - 0x3b4], eax
mov dword [ebp - 0x3b0], eax
mov dword [ebp - 0x3a0], eax
mov dword [ebp - 0x3a8], eax
mov dword [ebp - 0x3ac], eax
mov dword [ebp - 0x3a4], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x41dd6d
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x3a4]
xor eax, eax
call fcn.004029a0
mov eax, dword [ebp - 0x3a4]
lea edx, [ebp - 0x3a0]
call fcn.00408148
push dword [ebp - 0x3a0]
lea edx, [ebp - 0x3ac]
xor eax, eax
call fcn.004029a0
mov eax, dword [ebp - 0x3ac]
lea edx, [ebp - 0x3a8]
call fcn.00408210
push dword [ebp - 0x3a8]
push 0x41dd80
lea eax, [ebp - 4]
mov edx, 3
call fcn.00404b0c
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1d0]
call fcn.00402d44
lea eax, [ebp - 0x1d0]
call fcn.00402ad4
lea eax, [ebp - 0x1d0]
call fcn.00402ee8
lea eax, [ebp - 0x3b0]
call fcn.0041ca9c
lea eax, [ebp - 0x3b0]
mov edx, 0x41dd90
call fcn.00404a54
mov edx, dword [ebp - 0x3b0]
lea eax, [ebp - 0x39c]
call fcn.00402d44
lea eax, [ebp - 0x39c]
call fcn.00402ad4
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x39c]
call fcn.00404d90
call fcn.00403558
lea eax, [ebp - 0x39c]
call fcn.00402ee8
push 0
lea eax, [ebp - 0x3b4]
call fcn.0041ca9c
lea eax, [ebp - 0x3b4]
mov edx, 0x41dd90
call fcn.00404a54
mov eax, dword [ebp - 0x3b4]
call fcn.00404c44
push eax
call sub.kernel32.dll_WinExec
push 0x5dc
call sub.kernel32.dll_Sleep
lea eax, [ebp - 0x3b8]
call fcn.0041ca9c
lea eax, [ebp - 0x3b8]
mov edx, 0x41dd90
call fcn.00404a54
mov eax, dword [ebp - 0x3b8]
call fcn.004080e0
mov eax, dword [ebp - 4]
call fcn.004080e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41dd74
lea eax, [ebp - 0x3b8]
mov edx, 7
call fcn.004047b8
lea eax, [ebp - 4]
call fcn.00404794
ret

Function at 0x401040
Capabilities:
Delete directory

Disassembly:
push str.C:Windows
push str.deleting_directory__s__n
call fcn.00401010
add esp, 8
push str.C:Windows
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
mov edx, str.Failed_to_delete__s_directory__n
mov ecx, str.Directory__s_was_deleted__n
cmove ecx, edx
push str.C:Windows
push ecx
call fcn.00401010
add esp, 8
xor eax, eax
ret
Function at 0x419593
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x445ea3
call fcn.004205a0
sub esp, 0x138
and byte [ebp - 0x144], 0
push ebx
push esi
push edi
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x143]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor esi, esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
stosb byte es:[edi], al
push 1
lea eax, [ebp - 0x10]
pop ebx
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersion
add byte [eax + 2], ch
add byte [eax], al
or byte [ecx + 0x15fffc5d], 0x2c
nop
inc esp
add byte [ebp - 0x767af040], al
add byte [eax], al
invalid
cmp dword [ebp + 0xc], ebx
mov dword [ebp - 0x18], 0x104
mov eax, str.CommonFilesDir
je 0x4195fd
mov eax, str.ProgramFilesDir
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x144]
push ecx
push esi
push esi
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp + 0xf]
push 0
push eax
lea eax, [ebp - 0x144]
mov edi, 0x449500
mov esi, 0x4494f8
push eax
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x20], esi
call fcn.00404716
push 0x453344
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.00403c36
lea ecx, [ebp - 0x40]
call fcn.004191d8
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x40]
push 0
push eax
mov dword [ecx], edi
mov dword [ecx + 0x20], esi
call fcn.00401a9c
mov dword [ebp - 0x14], ebx
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x40]
jmp 0x4196bf
lea eax, [ebp + 0xf]
push 0
push eax
lea eax, [ebp - 0x144]
mov edi, 0x449500
mov esi, 0x4494f8
push eax
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x20], esi
call fcn.00404716
push 0x453344
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 3
call fcn.00403c36
mov ecx, dword [ebp + 8]
push 0
push eax
mov dword [ecx], edi
mov dword [ecx + 0x20], esi
call fcn.00401a9c
mov dword [ebp - 0x14], ebx
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x40]
call fcn.00401291
cmp dword [ebp - 0x10], 0
je 0x4196d8
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x4196d8
push dword [ebp - 0x10]
call eax
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x419d00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
cmp dword [ebp + 0xc], 0xffffffff
push esi
mov esi, ecx
jne 0x419d16
mov dword [ebp + 0xc], 4
lea eax, [ebp + 0xc]
push 0
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x419d4b
add esi, 0xc
push 1
push esi
lea ecx, [ebp - 0x48]
call fcn.0040ada6
lea eax, [ebp - 0x48]
push 0x44cc60
push eax
call fcn.00420f48
mov eax, dword [ebp + 0xc]
pop esi
leave
ret 8