joyce8/EMBER2024-capa huggingface dataset:
Function at 0x472600
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x470
mov eax, dword [0x519220]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push 0x4ed9a0
push eax
lea eax, [ebp - 0x470]
mov dword [ebp - 0x470], 0
push eax
call fcn.0049cff0
add esp, 0xc
cmp dword [ebp - 0x470], 0
jne 0x472653
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048f1b0
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x46c]
push eax
call fcn.00401380
push dword [ebp - 0x470]
lea eax, [ebp - 0x404]
push 0x400
push 1
push eax
call fcn.004af79d
add esp, 0x14
test eax, eax
je 0x4726b4
nop
push eax
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x46c]
push eax
call fcn.004013c0
push dword [ebp - 0x470]
lea eax, [ebp - 0x404]
push 0x400
push 1
push eax
call fcn.004af79d
add esp, 0x1c
test eax, eax
jne 0x472680
lea eax, [ebp - 0x46c]
push esi
push eax
call fcn.00401480
push dword [ebp - 0x470]
call fcn.0049cc86
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov al, 1
pop esi
call fcn.0048f1b0
mov esp, ebp
pop ebp
ret

Function at 0x49627e
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x4f1b94
push 0x4f1b8c
push 0x4efc90
push 0
call fcn.0049612c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4962b0
push dword [ebp + 8]
mov ecx, esi
call fcn.0048f8d5
call esi
pop esi
pop ebp
ret
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x4962f2
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x4f1ba4
push 0x4f1b9c
push str.FlsGetValue
push 2
call fcn.0049612c
add esp, 0x10
mov esi, eax
push dword [ebp + 8]
test esi, esi
je 0x496323
mov ecx, esi
call fcn.0048f8d5
call esi
jmp 0x496329
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
pop esi
pop ebp
ret

Function at 0x49632c
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x4f1bac
push 0x4f1ba4
push str.FlsSetValue
push 3
call fcn.0049612c
add esp, 0x10
mov esi, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
test esi, esi
je 0x496360
mov ecx, esi
call fcn.0048f8d5
call esi
jmp 0x496366
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
pop ebp
ret
Function at 0x4cefc3
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004cebc8

Function at 0x4cefce
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004ced49

Function at 0x4d61f6
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004d59db

Function at 0x4d6201
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004d5c16

Function at 0x4d6706
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004d648d
Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..rsrc
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x432072
nop
nop
nop
mov ebx, 0x40c7d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x5fee3d78
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x432060
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4320d2
nop
nop
mov ebx, 0x42f314
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x7993421c
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4320c0
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x42e003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x42e00c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00401219
Function at 0xf54a60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [0xf7b010]
push edi
push 0xf849e8
call esi
push 0xf849e8
call esi
push 0xf849e8
call esi
push 0xf849e8
call esi
push 0xf849e8
call esi
mov edi, dword [ebp + 0x10]
lea eax, [edi + 1]
push eax
push 0
call 0x470410
nop
push eax
call 0x77b0e026
nop
mov ebx, eax
push 0xf849e8
mov dword [ebp - 4], ebx
call esi
push 0xf849e8
call esi
push 0xf849e8
call esi
push 0xf849e8
call esi
push 0xf849e8
call esi
push 0xf849e8
mov byte [ebx + edi], 0
call esi
push 0xf849e8
call esi
push 0xf849e8
call esi
push 0xf849e8
call esi
push 0xf849e8
call esi
xor edi, edi
cmp dword [ebp + 0x10], edi
jbe 0xf54b7a
mov eax, dword [ebp + 8]
sub eax, ebx
mov dword [ebp - 8], eax
push 0xf849e8
call esi
push 0xf849e8
call esi
push 0xf849e8
call esi
push 0xf849e8
call esi
push 0xf849e8
call esi
mov ecx, dword [ebp + 0xc]
push ecx
add ebx, edi
call 0x766e43d3
nop
mov ecx, eax
xor edx, edx
mov eax, edi
div ecx
mov eax, dword [ebp + 0xc]
add esp, 4
push 0xf849e8
mov cl, byte [edx + eax]
mov edx, dword [ebp - 8]
xor cl, byte [edx + ebx]
mov byte [ebx], cl
call esi
push 0xf849e8
call esi
push 0xf849e8
call esi
push 0xf849e8
call esi
push 0xf849e8
call esi
mov ebx, dword [ebp - 4]
inc edi
cmp edi, dword [ebp + 0x10]
jb 0xf54b06
push 0xf849e8
call esi
push 0xf849e8
call esi
push 0xf849e8
call esi
push 0xf849e8
call esi
push 0xf849e8
call esi
lea eax, [ebp - 0xc]
push eax
push 0x100
push 4
push ebx
mov dword [ebp - 0xc], 0
call 0x470415
nop
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xf56ef0
Capabilities:
Parse pe header

Disassembly:
cmp dword [ebx + 4], 0x40
jb 0xf56f91
mov eax, dword [ebx]
push 0x40
push eax
push esi
nop
call 0x766d9910
mov ecx, 0x5a4d
add esp, 0xc
cmp word [esi], cx
jne 0xf56fc0
mov eax, dword [esi + 0x3c]
test eax, eax
je 0xf56fc0
lea edx, [eax + 0xf8]
cmp edx, dword [ebx + 4]
ja 0xf56f91
mov ecx, dword [ebx]
push edi
push pe_nt_image_headers32
add ecx, eax
push ecx
lea edi, [esi + 0x40]
push edi
nop
call 0x766d9910
add esp, 0xc
cmp dword [edi], 0x4550
pop edi
jne 0xf56fc0
mov edx, 0x10b
cmp word [esi + 0x58], dx
jne 0xf56fc0
movzx eax, word [esi + 0x46]
test ax, ax
je 0xf56fc0
lea eax, [eax + eax*4]
add eax, eax
add eax, eax
add eax, eax
push eax
push 8
mov dword [esi + 0x140], eax
call dword [fcn.011890f4]
push eax
call dword [fcn.01189088]
mov dword [esi + 0x138], eax
test eax, eax
jne 0xf56f97
mov eax, 3
ret
mov eax, 1
ret
movzx ecx, word [esi + 0x54]
mov edx, dword [esi + 0x3c]
lea ecx, [ecx + edx + 0x18]
mov edx, dword [esi + 0x140]
push ebx
push edx
push ecx
push eax
mov dword [esi + 0x13c], ecx
call fcn.00f57590
add esp, 0x10
neg eax
sbb eax, eax
inc eax
ret
mov eax, 2
ret
Function at 0x1453af0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [0x11890e0]
test esi, esi
jne 0x1453b08
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x1453b01
mov eax, dword [esi + 0x3c]
cmp dword [eax + esi], 0x4550
jne 0x1453b01
mov eax, dword [eax + esi + 0x78]
mov ecx, dword [eax + esi + 0x1c]
add eax, esi
add ecx, esi
push ebx
mov ebx, dword [eax + 0x20]
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + 0x24]
mov eax, dword [eax + 0x18]
push edi
add ecx, esi
add ebx, esi
xor edi, edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x1453b6a
jmp 0x1453b50
mov eax, dword [ebx + edi*4]
mov ecx, dword [0x1188bf0]
add eax, esi
call fcn.01451610
test eax, eax
je 0x1453b73
inc edi
cmp edi, dword [ebp - 4]
jb 0x1453b50
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + edi*2]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + edx*4]
pop edi
pop ebx
add eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10007bb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1004900c]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
movss xmm0, dword [edx]
mov edi, 0x10
subss xmm0, dword [esi + 0xc]
mov ecx, dword [esi + 0xbc]
cvttss2si eax, xmm0
movss xmm0, dword [edx + 4]
subss xmm0, dword [esi + 0x10]
mov dword [ebp - 0x14], eax
cvttss2si eax, xmm0
movss xmm0, dword [edx + 8]
subss xmm0, dword [esi + 0xc]
mov dword [ebp - 0x10], eax
cvttss2si eax, xmm0
movss xmm0, dword [edx + 0xc]
subss xmm0, dword [esi + 0x10]
mov dword [ebp - 0xc], eax
cvttss2si eax, xmm0
mov dword [ebp - 8], eax
mov eax, dword [esi + 0xc4]
lea esi, [ebp - 0x14]
mov edx, dword [eax + ecx*4 - 4]
not edx
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x10041988]
sub edi, 1
jne 0x10007c24
mov eax, dword [0x10049850]
not edx
pop edi
pop esi
cmp dword [eax + 0x1a44], edx
jne 0x10007c55
mov dword [eax + 0x1a48], edx
cmp dword [eax + 0x1a7c], edx
jne 0x10007c64
mov byte [eax + 0x1a80], 1
mov ecx, dword [ebp - 4]
mov eax, edx
xor ecx, ebp
call fcn.1003f62c
mov esp, ebp
pop ebp
ret 4
Function at 0x401950
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov esi, dword [edi + 0xbc]
mov eax, dword [ecx + 0x14]
add esi, edi
mov edx, dword [edi + 0x1c]
mov dword [ebp - 0xc], edx
mov dword [esi + 8], eax
mov eax, dword [ecx + 0x18]
mov ecx, 1
mov dword [esi + 0xc], eax
mov eax, pe_nt_image_headers32
mov dword [esi + 0x10], 1
test word [edi + 0x94], ax
jne 0x40199a
mov dword [esi + 0x10], 0
xor ecx, ecx
mov dword [esi + 0x14], 0
mov eax, dword [edi + 0x78]
mov dword [ebp - 8], eax
lea eax, [edx + 0x3a]
test byte [ebp - 8], 4
je 0x4019b5
test byte [eax], 1
je 0x4019ec
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
and eax, 0xfffffffb
mov dword [edi + 0x78], eax
mov ecx, dword [esi + 0x10]
mov eax, dword [ebp - 4]
or ecx, 0x200
mov edx, eax
mov dword [esi + 0x10], ecx
test byte [edx], 2
mov edx, dword [ebp - 0xc]
je 0x4019ec
mov eax, dword [edx + 0x46]
or ecx, 0x400
mov dword [esi + 0x14], eax
mov eax, dword [ebp - 4]
mov dword [esi + 0x10], ecx
test dword [edi + 0x78], 0x400
je 0x4019fe
or ecx, 0x4000
mov dword [esi + 0x10], ecx
test byte [eax], 4
je 0x401a0c
or ecx, 0x100
mov dword [esi + 0x10], ecx
mov eax, dword [ebp + 8]
test byte [eax + 6], 2
je 0x401a39
or ecx, 0x80
mov eax, 1
mov dword [esi + 0x10], ecx
mov word [esi + 0x20], ax
cmp word [edi + 0x18], 3
jne 0x401a3e
mov eax, 0x2000
or word [edi + 0x7c], ax
jmp 0x401a3e
or word [esi + 0x20], 0x20
mov ecx, dword [edx + 0x3c]
mov dword [esi + 0x18], ecx
mov eax, dword [edx + 0x40]
mov dword [esi + 0x1c], eax
cmp cx, 0xd
jne 0x401aa3
mov ecx, dword [0x4ab3a4]
movsx edx, word [edx]
cmp edx, dword [ecx + 0x194]
jge 0x401a96
mov eax, dword [ecx + 0x198]
movzx eax, word [eax + edx*2]
mov dword [ecx + 0x1a0], eax
mov eax, dword [0x4ab3a4]
imul edx, dword [eax + 0x1a0], 0x2c
add edx, dword [eax + 0x400]
je 0x401a96
mov ecx, dword [edx + 0x24]
test ecx, ecx
je 0x401a96
mov edx, dword [edx + 0xc]
call fcn.0043a030
jmp 0x401a98
xor eax, eax
mov dword [esi + 0x1c], eax
test eax, eax
jne 0x401aa3
mov word [esi + 0x18], ax
cmp dword [edi + 0xcc], 0
jne 0x401aca
or word [esi + 0x20], 2
mov eax, 1
or dword [esi + 0x10], 8
mov ecx, dword [esi + 0x10]
movzx ecx, cx
pop edi
mov word [esi + 0x22], cx
pop esi
mov esp, ebp
pop ebp
ret
movzx eax, word [esi + 0x10]
mov word [esi + 0x22], ax
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x402ca0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
mov dword [ebp - 0xc], edx
xorps xmm0, xmm0
movups xmmword [esi], xmm0
movq qword [esi + 0x10], xmm0
mov dword [esi + 0x18], 0
mov eax, dword [0x4ab3a4]
test eax, eax
je 0x402cd4
cmp dword [eax + 0x1fc], 0
jne 0x402e70
push 0
push 0
push 0
push 0
push esi
mov dword [0x4ab25c], 0
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x402e58
push edi
mov edi, dword [sym.imp.USER32.dll_IsDialogMessageW]
nop dword [eax]
push 0
push 0
push 0
push esi
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x402e0c
mov ecx, dword [0x4ab18c]
mov dword [ebp - 4], 0
test ecx, ecx
je 0x402d53
mov eax, dword [ecx + 4]
mov dword [ebp - 8], eax
test eax, eax
je 0x402d53
lea eax, [ebp - 8]
push eax
call dword [sym.imp.MMFS2.dll_Ordinal_536]
push esi
push eax
call edi
test eax, eax
jne 0x402e0c
cmp dword [ebp - 8], eax
je 0x402d53
mov ecx, dword [0x4ab18c]
jmp 0x402d30
mov eax, dword [0x4ab3a4]
test eax, eax
je 0x402dfe
mov ecx, 0x4000
test word [eax + 0x16], cx
je 0x402dfe
push dword [0x4ab378]
call dword [sym.imp.MMFS2.dll_Ordinal_19]
test eax, eax
je 0x402d97
push esi
push eax
call dword [sym.imp.USER32.dll_TranslateMDISysAccel]
mov ecx, dword [ebp - 4]
test eax, eax
mov eax, 1
cmovne ecx, eax
mov dword [ebp - 4], ecx
mov eax, dword [esi + 4]
cmp eax, 0x100
je 0x402da8
cmp eax, 0x104
jne 0x402df8
mov edi, dword [esi + 8]
cmp edi, 0x10
je 0x402df8
cmp edi, 0x11
je 0x402df8
mov ecx, dword [0x4ab3a4]
test ecx, ecx
je 0x402df8
mov ecx, dword [ecx + 0xb4]
test ecx, ecx
je 0x402df8
cmp eax, 0x104
je 0x402ddf
mov eax, 0x2000
test word [esi + 0xe], ax
jne 0x402ddf
xor edx, edx
jmp 0x402de4
mov edx, 1
push ecx
mov ecx, dword [0x4ab380]
push edi
call fcn.00459460
add esp, 8
test eax, eax
jne 0x402e0c
cmp dword [ebp - 4], 0
jne 0x402e0c
push esi
call dword [sym.imp.USER32.dll_TranslateMessage]
push esi
call dword [sym.imp.USER32.dll_DispatchMessageW]
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x402e3a
test al, 1
je 0x402e20
cmp dword [esi + 4], 0x111
je 0x402e57
test al, 2
je 0x402e2d
cmp dword [esi + 4], 0x201
je 0x402e57
test al, 4
je 0x402e3a
cmp dword [esi + 4], 0x202
je 0x402e57
push 0
push 0
push 0
push 0
push esi
call dword [sym.imp.USER32.dll_PeekMessageW]
mov edi, dword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x402d00
pop edi
push 0
call dword [sym.imp.USER32.dll_GetKeyState]
push 0x4ab260
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov dword [0x4ab25c], eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x408aa0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea edx, [ecx + 2]
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x408ab0
sub ecx, edx
sar ecx, 1
push 2
lea eax, [ecx + 4]
push eax
call fcn.0047122f
mov ebx, eax
add esp, 8
mov dword [ebp - 4], ebx
test ebx, ebx
je 0x408b71
mov ecx, ebx
sub ecx, esi
nop
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x408ae0
push 0x5c
push ebx
call fcn.0046ec77
add esp, 8
test eax, eax
je 0x408b05
xor ecx, ecx
mov word [eax + 2], cx
cmp word [ebx], 0x5c
jne 0x408b2e
cmp word [ebx + 2], 0x5c
jne 0x408b2e
lea eax, [ebx + 4]
push 0x5c
push eax
call fcn.0046ed19
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x408b51
push 0x5c
lea eax, [ebx + 2]
push eax
jmp 0x408b47
cmp word [ebx + 2], 0x3a
jne 0x408b44
cmp word [ebx + 4], 0x5c
jne 0x408b44
push 0x5c
lea eax, [ebx + 6]
push eax
jmp 0x408b47
push 0x5c
push ebx
call fcn.0046ed19
add esp, 8
mov ebx, eax
push 2
push 0x104
call fcn.0047122f
mov esi, eax
add esp, 8
test esi, esi
jne 0x408b7b
push dword [ebp - 4]
call fcn.00471245
add esp, 4
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
test ebx, ebx
je 0x408be8
mov eax, ebx
sub eax, ecx
sar eax, 1
push eax
push ecx
push esi
call fcn.00474d09
push esi
call fcn.00474eb3
add esp, 0x10
test eax, eax
je 0x408bc4
push esi
call fcn.00474ebe
add esp, 4
test eax, eax
je 0x408bb1
mov edi, 1
jmp 0x408bc4
push esi
call fcn.00474eb3
add esp, 4
test eax, eax
mov eax, 1
cmovne edi, eax
lea eax, [ebx + 2]
mov dword [ebp - 8], ebx
push 0x5c
push eax
call fcn.0046ed19
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x408c5c
mov ecx, dword [ebp - 8]
test edi, edi
je 0x408b82
jmp 0x408c5c
mov edx, esi
sub edx, dword [ebp - 4]
nop dword [eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x408bf0
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x408c05
sub ecx, edx
sar ecx, 1
cmp ecx, 3
jbe 0x408c28
cmp word [esi + ecx*2 - 2], 0x5c
jne 0x408c28
xor eax, eax
mov word [esi + ecx*2 - 2], ax
push esi
call fcn.00474eb3
add esp, 4
test eax, eax
je 0x408c5c
push esi
call fcn.00474ebe
add esp, 4
test eax, eax
je 0x408c49
mov edi, 1
jmp 0x408c5c
push esi
call fcn.00474eb3
add esp, 4
mov ecx, 1
test eax, eax
cmovne edi, ecx
push esi
call fcn.00471245
push dword [ebp - 4]
call fcn.00471245
add esp, 8
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4094c0
Capabilities:
Set current directory

Disassembly:
mov eax, dword [0x4ab52c]
test eax, eax
je 0x4094da
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x4ab52c], 0
mov eax, dword [0x4ab154]
test eax, eax
je 0x409517
push 0x5c
push eax
call fcn.0046ec77
add esp, 8
test eax, eax
je 0x409517
mov edx, dword [0x4ab154]
mov ecx, eax
sub ecx, edx
sar ecx, 1
cmp ecx, 3
jae 0x40950b
xor ecx, ecx
mov word [eax + 2], cx
jmp 0x409510
xor ecx, ecx
mov word [eax], cx
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push edi
mov edi, dword [0x4ab14c]
test edi, edi
je 0x40960d
cmp word [edi], 0
je 0x409604
xor esi, esi
nop word [eax + eax]
push edi
call fcn.0047242a
add esp, 4
test eax, eax
je 0x409566
call fcn.004750d6
cmp dword [eax], 2
je 0x409566
push 0x3e8
call ebx
inc esi
cmp esi, 0xa
jl 0x409540
jmp 0x4095d6
mov ecx, edi
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409570
sub ecx, edx
sar ecx, 1
push 2
lea eax, [ecx + 1]
push eax
call fcn.0047122f
mov esi, eax
add esp, 8
test esi, esi
je 0x4095d6
mov edx, esi
mov ecx, edi
sub edx, edi
nop dword [eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x4095a0
push 0x5c
push esi
call fcn.0046ec77
add esp, 8
test eax, eax
je 0x4095cd
xor ecx, ecx
push esi
mov word [eax], cx
call fcn.004750e9
add esp, 4
push esi
call fcn.00471245
add esp, 4
mov ecx, edi
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4095e0
sub ecx, edx
sar ecx, 1
lea edi, [edi + ecx*2]
add edi, 2
cmp word [edi], ax
jne 0x409538
mov edi, dword [0x4ab14c]
push edi
call fcn.00471245
add esp, 4
mov edx, dword [0x4ab148]
test edx, edx
je 0x40967a
xor esi, esi
nop dword [eax]
mov ecx, edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409625
sub ecx, edi
sar ecx, 1
cmp ecx, 3
jle 0x409648
cmp word [edx + ecx*2 - 2], 0x5c
jne 0x409648
xor eax, eax
mov word [edx + ecx*2 - 2], ax
push edx
call fcn.004750e9
add esp, 4
test eax, eax
je 0x409674
call fcn.004750d6
cmp dword [eax], 2
je 0x409674
push 0x3e8
call ebx
inc esi
cmp esi, 0xa
jge 0x409674
mov edx, dword [0x4ab148]
jmp 0x409620
mov edx, dword [0x4ab148]
push edx
call fcn.00471245
push dword [0x4ab154]
mov dword [0x4ab148], 0
call fcn.00471245
add esp, 8
mov dword [0x4ab154], 0
pop edi
pop esi
pop ebx
ret
Function at 0x412e50
Capabilities:
Create process on windows
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
push ebx
push esi
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x58]
push edi
push eax
mov dword [ebp - 0x50], 0
movlpd qword [ebp - 0x38], xmm0
movlpd qword [ebp - 0x30], xmm0
movlpd qword [ebp - 0x28], xmm0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x58], 0x3c
mov dword [ebp - 0x54], 0x440
mov dword [ebp - 0x4c], str.open
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x412f74
mov ebx, dword [ebp + 0xc]
test bl, 1
je 0x412f62
call fcn.0042fd20
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
and ebx, 2
je 0x412ef3
mov eax, dword [0x4ab3ac]
push 0
push dword [eax + 0x10]
call esi
mov eax, dword [0x4ab3ac]
mov eax, dword [eax + 0x4c4]
test eax, eax
je 0x412ef3
push 0
push eax
call esi
mov edi, dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
nop dword [eax]
lea eax, [ebp + 8]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x412f38
cmp dword [ebp + 8], 0x103
jne 0x412f38
xor edx, edx
lea ecx, [ebp - 0x1c]
call fcn.00402ca0
push 0x4ff
push 0xc8
push 0
push 0
push 0
call edi
jmp 0x412f00
test bx, bx
je 0x412f5d
mov eax, dword [0x4ab3ac]
push 5
push dword [eax + 0x10]
call esi
mov eax, dword [0x4ab3ac]
mov eax, dword [eax + 0x4c4]
test eax, eax
je 0x412f5d
push 5
push eax
call esi
call fcn.0042fe10
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x428150
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0xc], ecx
xor esi, esi
mov ecx, dword [eax + 0x404]
mov ebx, dword [eax + 0x400]
mov dword [ebp - 0x10], edx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ecx
push edi
test edx, edx
jle 0x4281b8
nop word [eax + eax]
inc bl
movzx ebx, bl
mov edx, dword [eax + ebx*4]
mov cl, dl
add cl, byte [ebp - 4]
mov eax, dword [ebp - 8]
movzx ecx, cl
mov dword [ebp - 4], ecx
mov edi, dword [ebp - 4]
mov ecx, dword [eax + ecx*4]
mov dword [eax + ebx*4], ecx
mov dword [eax + edi*4], edx
add dl, cl
movzx ecx, dl
mov edx, dword [ebp - 0xc]
mov cl, byte [eax + ecx*4]
xor byte [esi + edx], cl
inc esi
cmp esi, dword [ebp - 0x10]
jl 0x428180
mov ecx, edi
pop edi
mov dword [eax + 0x400], ebx
pop esi
mov dword [eax + 0x404], ecx
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x429050
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push 2
push 0x104
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.0047122f
mov esi, eax
add esp, 8
test esi, esi
je 0x42917a
push edi
push 2
push 0x104
call fcn.0047122f
mov edi, eax
add esp, 8
test edi, edi
je 0x4290ad
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push esi
push ebx
push 0x4a93b4
push edi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push edi
call fcn.00471245
add esp, 4
cmp word [esi], bx
je 0x42916b
push esi
call fcn.0047242a
mov ecx, esi
add esp, 4
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4290c4
sub ecx, edx
sar ecx, 1
cmp word [esi + ecx*2 - 2], 0x5c
je 0x4290f3
lea edi, [esi - 2]
nop
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x4290e0
mov eax, dword [0x498ea4]
mov dword [edi], eax
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x429100
sub ecx, edx
sar ecx, 1
lea edi, [ecx*2 + 4]
push edi
call fcn.00471224
mov edx, eax
add esp, 4
test edx, edx
jne 0x429135
call fcn.00479f45
push edi
call fcn.00471224
add esp, 4
mov edx, eax
mov eax, dword [ebp - 4]
mov ecx, esi
mov dword [eax], edx
sub edx, esi
nop
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x429140
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push esi
call fcn.00471245
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
mov ebx, 0xe
call fcn.00471245
add esp, 4
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret