joyce8/EMBER2024-capa huggingface dataset:
Function at 0x63ecbcb0
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x63ecbc37
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x63ecbc32
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x63ecbc1c
and ecx, 0xfff
mov edx, esi
salc
salc
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x63ecbc24
cmp edx, ebx
jne 0x63ecbd72
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x63ecbbf3
add eax, dword [eax + 4]
jmp 0x63ecbbe0
mov dword [ebp + 0xc], ebx
jmp 0x63ecbc42
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x63ecbc5a
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x63ecbc78
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x63ecbcd6
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
invalid
invalid
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x63ecbcbd
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x63ecbcc6
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x63ecbcd0
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x63ecbcb2
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x63ecbc3c
mov dword [ebp + 8], esi
xor edi, edi
Function at 0x63ecbe50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [eax], al
add byte [eax - 0x3335b], al
inc dword [eax]
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.63ecb593
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.63ecb548
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], pe_nt_image_headers32
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
push eax
call fcn.63ecb593
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.63ecb548
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.63ecb583
sub eax, 0x80d11c50
movsd dword es:[edi], dword [esi]
int3
Function at 0x63ecf700
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, edx
sub esp, 0x18
mov edi, dword [eax + 0x4804]
mov dword [eax + edx*4 + 0x4808], edi
movzx edx, word [eax]
mov dword [esp + 4], edi
shr dx, 4
movzx ecx, dx
xor edx, 0x7f
movzx edx, dx
movzx esi, byte [ecx + 0x63ee3820]
movzx ecx, byte [edx + 0x63ee3820]
movzx edx, word [eax + 2]
mov dword [esp + 0x10], esi
shr dx, 4
movzx esi, dx
xor edx, 0x7f
movzx esi, byte [esi + 0x63ee3820]
movzx edx, dx
movzx edx, byte [edx + 0x63ee3820]
add esi, ecx
mov dword [esp + 8], esi
lea esi, [edx + ecx]
imul edx, ebx, 0x440
mov dword [esp + 0xc], esi
lea esi, [eax + edx + 0x404]
mov dword [esp], esi
test edi, edi
je 0x63ecf8ab
shl ebx, 4
xor edi, edi
mov dword [esp + 0x14], ebx
lea ebp, [ebx + 4]
lea esi, [esi]
lea ebx, [edi + 8]
xor esi, esi
lea esi, [esi]
mov ecx, ebx
shr ebx, 1
and ecx, 1
lea edx, [eax + ebx*2]
movzx edx, word [edx + ebp]
neg ecx
and ecx, 0x7ff
xor edx, ecx
shr edx, 4
movzx edx, byte [edx + 0x63ee3820]
add esi, edx
cmp ebx, 1
jne 0x63ecf798
mov ebx, dword [esp]
add esi, dword [esp + 0x10]
mov dword [ebx + edi*4], esi
add edi, 1
cmp dword [esp + 4], edi
jbe 0x63ecf8ab
cmp edi, 7
jbe 0x63ecf790
cmp dword [esp + 4], edi
jbe 0x63ecf8ab
mov ebx, dword [esp + 0x14]
add ebx, 0x104
lea esi, [esi]
mov esi, edi
xor ebp, ebp
lea esi, [esi]
mov ecx, esi
shr esi, 1
and ecx, 1
lea edx, [eax + esi*2]
movzx edx, word [edx + ebx]
neg ecx
and ecx, 0x7ff
xor edx, ecx
shr edx, 4
movzx edx, byte [edx + 0x63ee3820]
add ebp, edx
cmp esi, 1
jne 0x63ecf800
mov esi, dword [esp]
add ebp, dword [esp + 8]
lea edx, [edi + 1]
mov dword [esi + edi*4], ebp
cmp dword [esp + 4], edx
jbe 0x63ecf8ab
cmp edx, 0xf
ja 0x63ecf845
mov edi, edx
jmp 0x63ecf7f8
mov esi, dword [esp + 4]
cmp esi, edx
jbe 0x63ecf8ab
add esi, 0xf0
lea ebx, [eax + 0x204]
add edi, 0xf1
mov ebp, esi
lea esi, [esi]
mov ecx, edi
xor esi, esi
lea esi, [esi]
mov edx, ecx
shr ecx, 1
and edx, 1
movzx eax, word [ebx + ecx*2]
neg edx
and edx, 0x7ff
xor eax, edx
shr eax, 4
movzx eax, byte [eax + 0x63ee3820]
add esi, eax
cmp ecx, 1
jne 0x63ecf870
mov eax, dword [esp]
add esi, dword [esp + 0xc]
mov dword [eax + edi*4 - 0x3c0], esi
add edi, 1
cmp ebp, edi
jne 0x63ecf868
add esp, 0x18
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x63ed1800
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ecx, dword [eax + 0xaa4]
and edx, dword [eax + 0xaa8]
mov ebx, dword [esp + 0x18]
mov esi, edx
mov edx, 8
sub edx, ecx
shl esi, cl
mov ecx, edx
shr edi, cl
lea edx, [esi + edi]
lea edx, [edx + edx*2]
shl edx, 9
lea edi, [eax + edx + 0xaac]
mov eax, dword [esp + 0x1c]
add eax, 0x100
cmp byte [esp + 0x14], 0
jne 0x63ed1880
xor ecx, ecx
lea esi, [esi]
nop
mov ebx, eax
shr eax, 1
and ebx, 1
movzx edx, word [edi + eax*2]
neg ebx
and ebx, 0x7ff
xor edx, ebx
shr edx, 4
movzx edx, byte [edx + 0x63ee3820]
add ecx, edx
cmp eax, 1
jne 0x63ed1850
pop ebx
mov eax, ecx
pop esi
pop edi
pop ebp
ret
mov esi, 0x100
xor ecx, ecx
lea esi, [esi]
nop
mov edx, eax
add ebx, ebx
mov ebp, esi
shr edx, 8
and ebp, ebx
add edx, esi
add edx, ebp
mov ebp, eax
add eax, eax
shl ebp, 0x18
movzx edx, word [edi + edx*2]
sar ebp, 0x1f
and ebp, 0x7ff
xor edx, ebp
shr edx, 4
movzx edx, byte [edx + 0x63ee3820]
add ecx, edx
mov edx, ebx
xor edx, eax
not edx
and esi, edx
cmp eax, 0xffff
jbe 0x63ed1890
pop ebx
mov eax, ecx
pop esi
pop edi
pop ebp
ret
Function at 0x63eda4a0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.63edb100
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.63edb100
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x63eda500
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x63eeb398]
test esi, esi
jle 0x63eda600
mov eax, dword [0x63eeb39c]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x63eda530
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x63eda5af
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x63eda520
mov dword [esp], ebx
call fcn.63edac50
mov edi, eax
test eax, eax
je 0x63eda627
mov eax, dword [0x63eeb39c]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.63edad60
mov edx, dword [0x63eeb39c]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x63eda607
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x63eda5a8
sub eax, 4
and eax, 0xfffffffb
jne 0x63eda5b6
add dword [0x63eeb398], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
add ebx, dword [0x63eeb39c]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x63eda5a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.63eda4a0
xor esi, esi
jmp 0x63eda53a
mov eax, dword [0x63eeb39c]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.63eda4a0
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.63eda4a0
lea esi, [esi]
nop
Function at 0x408968
Capabilities:
Encode data using xor

Disassembly:
push 0x4085d8
pop edx
mov eax, ecx
sub ecx, 0xeb6f4e8d
call fcn.00408996
xor dword [edi], edx
add eax, eax
push 0xa7b24fd3
pop ecx
add edi, 1
add eax, eax
cmp edi, esi
jne fcn.00408968
and eax, eax
and ecx, ecx
ret

Function at 0xface9c
Capabilities:
Encode data using xor

Disassembly:
jmp 0xfacea6
pushal
call 0xfaceac
pop ebp
sub ebp, 0x10
sub ebp, 0xbace9c
jmp 0xfacec2
mov eax, 0xbace9c
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c3
mov edx, 0x2a15948e
xor byte [eax], dl
inc eax
dec ecx
jne 0xfaced9
jmp 0xfaceec
add eax, 0xb2070543
mov cs, word [esi + 0x764f0f8e]
mov cs, word [esi + 0x36438d8e]
mov byte [esi - 0x59cb7172], cl
mov cs, word [esi - 0x72938672]
inc esi
add eax, 0x8e8e820f
mov cs, word [ebp - 0x5515fcb5]
jb 0xfacf1e
mov ch, byte [edx + 0x72aaea03]
pop es
mov ch, byte [edx - 0x50f2651a]
mov fs, esi
push es
lds edx, [edi]
mov cs, word [edi - 0x1419555e]
jl 0xfacf2e
jmp 0xfacfac
int 0x66
mov ecx, dword [esi - 0x5f987172]
mov cs, word [esi - 0x5515fc72]
jb 0xfacf48
mov byte [0x5d3daaa], al
or eax, dword [esi + 0x58e8e8e]
sbb eax, dword [edx + 0x58e8e8e]
add ebx, dword [esi + 0x4f8e8e8e]
invalid
mov cs, word [esi - 0x7de4fa72]
mov cs, word [esi - 0x61fcfa72]
mov cs, word [esi - 0x7398b072]
mov edi, 0x8a4c0d8c
mov dword [ecx + 0x71717a0b], 0x824cd371
mov es, word [0x8e8aaa02]
jp 0xfacfd5
jno 0xfacfd7
ror dword [edx + eax*4 - 0x72], cl
add eax, 0x8e8aaa02
or byte [esi - 0x7555fdfb], 0x8e
mov cs, word [esi - 0x50f2651a]
mov fs, esi
push es
lds edx, [edi]
mov cs, word [edi + 0x66dfaaa2]
mov ecx, dword [esi - 0x26987172]
mov word [esi - 0x5515fc72], cs
jb 0xfacf95
mov byte [0x71d3daaa], al
sti
stosb byte es:[edi], al
fcmovbe st(0), st(3)
jno 0xfacf8f
xor byte [ecx - 5], 0x86
or cl, byte [esi + 0x33058e8e]
xchg byte [esi + 0x7f0f8e8e], cl
jge 0xfacf62
jno 0xfacf92
xchg byte [esi + 0xa], ah
mov cs, word [esi - 0x79ccfa72]
mov cs, word [esi + 0x7d7f0f8e]
mov ebx, 0x7f0fbc8c
jge 0xfacf68
invalid
mov ebx, 0x47bdbc8c
invalid
invalid
or word [edx], 0x8e94
mov cs, word [esi - 0x7e988af2]
or bl, byte [edi - 0x17717172]
pcmpeqw mm6, qword [ecx - 0x55]
or dl, byte [esi + ecx*4 + 0x750e8e8e]
or dword [bp + si], 0x8e8e8e9f
call 0xac6c44f9
or dword [edx], 0x8e8e8e9b
iretd
Function at 0x402300
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x43a99b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x44a5d0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.004245bd
push 4
mov dword [esp + 0x24], 0
call fcn.004258d3
mov edi, eax
add esp, 4
test edi, edi
je 0x402382
call fcn.0042486f
mov dword [edi], eax
call fcn.0042469d
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.0042457e
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x402377
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.004245a6
jmp 0x402384
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x4079b0
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
sub esp, 0xc
push ebx
mov ebx, eax
mov eax, dword [ebx + 0x10]
sub eax, dword [ebx + 0xc]
push ebp
push esi
push edi
je 0x407a50
push 0
push 0x80
push 3
push 0
push 1
push 0xc0000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x407a50
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
push edi
call fcn.00424be9
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x407a49
push 0
lea edx, [esp + 0x18]
push edx
push edi
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x407a40
cmp edi, dword [esp + 0x14]
jne 0x407a40
push edi
push ebp
call fcn.00407a60
add esp, 8
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [esp + 0x1c]
push eax
push edi
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebp
call fcn.00425fc3
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x407bf0
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x44a5d0]
xor eax, esp
mov dword [esp + 0x114], eax
cmp byte [0x44b647], 0
je 0x407c5c
push 0x114
lea eax, [esp + 4]
push 0
push eax
call fcn.0042ad60
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 4], 6
mov byte [0x44b647], 0
setae al
mov byte [0x44cdc8], al
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.00425821
add esp, 0x118
ret
mov ecx, dword [esp + 0x114]
mov al, byte [0x44cdc8]
xor ecx, esp
call fcn.00425821
add esp, 0x118
ret
Function at 0x407c80
Capabilities:
Create process on windows
Get file size
Move file

Disassembly:
push 0xffffffffffffffff
push 0x43aea8
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x44a5d0]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x44a5d0]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov eax, dword [esp + 0x88]
mov esi, ecx
mov dword [esp + 0x18], eax
mov byte [esp + 0x14], 0
call fcn.00407bf0
test al, al
jne 0x407cd2
mov byte [esp + 0x14], 1
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [eax + 1]
xor ecx, ecx
mov eax, edi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00424be9
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x407e74
xor ecx, ecx
mov eax, edi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00424be9
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x407e6b
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
push ebp
call edi
push esi
push ebx
call edi
push str..exe
push ebp
call dword [sym.imp.SHLWAPI.dll_PathRenameExtensionW]
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push ebx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push ebp
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x407d79
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x407e62
mov eax, str.r123unas
lea ecx, [esp + 0x58]
call fcn.00408360
push 0
push 0x440f04
push 3
mov edi, 1
lea esi, [esp + 0x64]
mov dword [esp + 0x8c], 0
call fcn.00407010
push 0x38
xor esi, esi
lea eax, [esp + 0x24]
push esi
push eax
call fcn.0042ad60
add esp, 0xc
cmp byte [esp + 0x14], 0
mov dword [esp + 0x1c], 0x3c
mov dword [esp + 0x20], 0x40
mov dword [esp + 0x24], esi
lea edi, [esi + 8]
je 0x407dee
mov dword [esp + 0x28], esi
jmp 0x407e06
cmp dword [esp + 0x70], edi
jb 0x407dfe
mov ecx, dword [esp + 0x5c]
mov dword [esp + 0x28], ecx
jmp 0x407e06
lea edx, [esp + 0x5c]
mov dword [esp + 0x28], edx
mov eax, dword [esp + 0x18]
push 6
push esi
mov dword [esp + 0x34], ebp
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], 1
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jl 0x407e4f
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x407e49
mov eax, dword [esp + 0x54]
cmp eax, esi
je 0x407e49
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.ole32.dll_CoUninitialize]
cmp dword [esp + 0x70], edi
jb 0x407e62
mov edx, dword [esp + 0x5c]
push edx
call fcn.004258ad
add esp, 4
push ebx
call fcn.00425fc3
add esp, 4
push ebp
call fcn.00425fc3
add esp, 4
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.00425821
add esp, 0x70
ret
Function at 0x407ea0
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x620
mov eax, dword [0x44a5d0]
xor eax, esp
mov dword [esp + 0x61c], eax
push ebx
push ebp
push 0x30b
lea eax, [esp + 0x10]
push eax
xor ebp, ebp
push ebp
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x407ee6
pop ebp
pop ebx
mov ecx, dword [esp + 0x61c]
xor ecx, esp
call fcn.00425821
add esp, 0x620
ret
push esi
push edi
xor ecx, ecx
push 0x418
mov word [esp + 0x62e], cx
call fcn.004258d3
mov esi, eax
add esp, 4
test esi, esi
je 0x407f3f
lea edx, [esp + 0x14]
push edx
lea edi, [esi + 4]
push 0x208
push edi
mov dword [esi], vtable.FileReader.0
call fcn.00426d0f
add esp, 0xc
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 0x414], eax
jmp 0x407f41
xor esi, esi
mov eax, dword [esi]
mov edx, dword [eax]
mov ecx, esi
call edx
mov edi, eax
cmp edi, 0xffffffff
je 0x407fed
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp ebx, eax
jle 0x407f63
mov ebx, eax
cmp dword [esp + 0x634], eax
jle 0x407f73
mov dword [esp + 0x634], eax
mov ecx, dword [esp + 0x634]
xor eax, eax
cmp byte [esp + 0x638], al
setne al
dec eax
and eax, 2
push eax
push 0
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x407fed
cmp byte [esp + 0x63c], 0
lea eax, [ebx + 1]
jne 0x407fa9
mov eax, ebx
push eax
call fcn.00424be9
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x407fed
push 0
lea edx, [esp + 0x14]
push edx
push ebx
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x407fdf
cmp dword [esp + 0x10], ebx
jne 0x407fdf
push ebp
call fcn.00425fc3
add esp, 4
xor ebp, ebp
jmp 0x407fed
cmp byte [esp + 0x63c], 0
je 0x407fed
mov byte [ebx + ebp], 0
push esi
call fcn.004258ad
mov ecx, dword [esp + 0x630]
add esp, 4
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
xor ecx, esp
call fcn.00425821
add esp, 0x620
ret

Function at 0x4087b0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x84
push edi
push 0x38
lea eax, [esp + 0x18]
push 0
push eax
call fcn.0042ad60
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteExW]
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x14], 0x3c
mov dword [esp + 0x18], 0x100
mov dword [esp + 0x30], 1
mov dword [esp + 0x20], 0x440fc0
mov dword [esp + 0x24], esi
call edi
test eax, eax
jne 0x40888c
mov eax, dword [esp + 0x30]
cmp eax, 0x1b
je 0x40880f
cmp eax, 0x1f
jne 0x40888c
xor eax, eax
mov dword [esp + 0xc], eax
push str.shell32.dll
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov dword [esp + 0x10], 0x24
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.SHOpenWithDialog
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x408883
push 0x38
push eax
lea edx, [esp + 0x58]
push edx
call fcn.0042ad60
add esp, 0xc
lea eax, [esp + 0x4c]
push eax
mov dword [esp + 0x50], 0x3c
mov dword [esp + 0x54], 0x100
mov dword [esp + 0x6c], 1
mov dword [esp + 0x5c], str.openas
mov dword [esp + 0x60], esi
call edi
pop edi
add esp, 0x84
ret
lea ecx, [esp + 4]
push ecx
push 0
call eax
pop edi
add esp, 0x84
ret
Function at 0x409550
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x43b0a8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x44a5d0]
xor eax, esp
mov dword [esp + 0x28], eax
push ebp
push esi
push edi
mov eax, dword [0x44a5d0]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
lea eax, [esp + 0x10]
push eax
push 0x20019
xor edi, edi
push edi
push str.Software4sharedDownloadHelper
mov dword [esp + 0x20], edi
push 0x80000001
mov esi, ecx
mov dword [esp + 0x24], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x409674
mov eax, dword [esp + 0x10]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0x18]
push ecx
push edi
lea edx, [esp + 0x1c]
push edx
push edi
push ebx
push eax
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
call ebp
test eax, eax
jne 0x409674
cmp dword [esp + 0x14], 1
jne 0x409674
xor ecx, ecx
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], edi
mov word [esp + 0x20], cx
mov dword [esp + 0x44], edi
mov eax, dword [esp + 0x18]
cmp eax, edi
jbe 0x409640
shr eax, 1
lea ecx, [esp + 0x1c]
call fcn.004098d0
cmp dword [esp + 0x34], 8
mov eax, dword [esp + 0x20]
jae 0x40961e
lea eax, [esp + 0x20]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x18]
push edx
push eax
lea eax, [esp + 0x1c]
push eax
push edi
push ebx
push ecx
call ebp
mov eax, dword [esp + 0x30]
dec eax
lea ecx, [esp + 0x1c]
call fcn.004098d0
push 0xffffffffffffffff
xor edx, edx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push edi
lea eax, [esp + 0x24]
mov ecx, esi
mov word [esi + 4], dx
call fcn.00408690
cmp dword [esp + 0x34], 8
jb 0x4096aa
mov eax, dword [esp + 0x20]
push eax
call fcn.004258ad
add esp, 4
jmp 0x4096aa
xor ecx, ecx
mov eax, 0x440f04
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
mov word [esi + 4], cx
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x409690
sub eax, edx
sar eax, 1
push eax
mov eax, 0x440f04
call fcn.004085a0
mov eax, esi
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.00425821
add esp, 0x38
ret

Function at 0x4096d0
Capabilities:
Set registry value

Disassembly:
push ecx
push ebx
xor ebx, ebx
push ebx
lea eax, [esp + 8]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.Software4sharedDownloadHelper
push 0x80000001
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40973d
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x409700
sub eax, edx
mov edx, dword [esp + 0xc]
sar eax, 1
lea ecx, [eax + eax]
mov eax, dword [esp + 4]
push ecx
push esi
push 1
push ebx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x40972d
mov bl, 1
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
pop ecx
ret
xor al, al
pop ebx
pop ecx
ret