joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403130
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x40fa93
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10c
push esi
mov dword [esp + 0xc], 0
lea ecx, [esp + 4]
mov dword [esp + 0x118], 1
call sub.MFC42.DLL_CString::CString_2
mov eax, dword [esp + 0x124]
mov esi, dword [sym.imp.MSVCRT.dll__mbscmp]
push str.WINDOWS
push eax
mov byte [esp + 0x120], 2
call esi
add esp, 8
test eax, eax
jne 0x4031af
lea ecx, [esp + 0x10]
push 0xff
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [esp + 0x10]
lea ecx, [esp + 4]
push edx
call sub.MFC42.DLL_CString::operator
jmp 0x40331c
mov eax, dword [esp + 0x124]
push 0x41616c
push eax
call esi
add esp, 8
test eax, eax
jne 0x4031e8
lea ecx, [esp + 0x10]
push 0xff
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [esp + 0x10]
lea ecx, [esp + 4]
push edx
call sub.MFC42.DLL_CString::operator
jmp 0x40331c
mov eax, dword [esp + 0x124]
push 0x416160
push eax
call esi
add esp, 8
test eax, eax
jne 0x403220
push eax
lea ecx, [esp + 0x14]
push 5
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea edx, [esp + 0x10]
lea ecx, [esp + 4]
push edx
call sub.MFC42.DLL_CString::operator
jmp 0x40331c
mov eax, dword [esp + 0x124]
push 0x416154
push eax
call esi
add esp, 8
test eax, eax
jne 0x403249
push 0x416150
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::operator
jmp 0x40331c
mov ecx, dword [esp + 0x124]
push 0x416144
push ecx
call esi
add esp, 8
lea edx, [esp + 0x10]
test eax, eax
push 0xff
push edx
jne 0x4032bc
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [esp + 0x10]
lea ecx, [esp + 4]
push eax
call sub.MFC42.DLL_CString::operator
push 0x5c
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::Find_2
lea ecx, [esp + 8]
push eax
push ecx
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::Left
push eax
lea ecx, [esp + 8]
mov byte [esp + 0x11c], 3
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 8]
mov byte [esp + 0x118], 2
call sub.MFC42.DLL_CString::CString
jmp 0x40331c
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [esp + 0x10]
lea ecx, [esp + 4]
push eax
call sub.MFC42.DLL_CString::operator
push 0x5c
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::Find_2
inc eax
lea ecx, [esp + 8]
push eax
push ecx
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::Left
push eax
lea ecx, [esp + 8]
mov byte [esp + 0x11c], 4
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 8]
mov byte [esp + 0x118], 2
call sub.MFC42.DLL_CString::CString
push str.Program_Files
lea ecx, [esp + 8]
call fcn.0040f078
mov eax, dword [esp + 4]
mov ecx, dword [eax - 8]
cmp byte [ecx + eax - 1], 0x5c
je 0x403338
push 0x416074
lea ecx, [esp + 8]
call fcn.0040f078
mov esi, dword [esp + 0x120]
lea edx, [esp + 4]
push edx
mov ecx, esi
call fcn.0040f000
mov dword [esp + 0xc], 1
lea ecx, [esp + 4]
mov byte [esp + 0x118], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x124]
mov byte [esp + 0x118], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x110]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x118
ret
Function at 0x4051c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, ecx
push ebp
push esi
mov eax, dword [ebx + 0x18]
push edi
test eax, eax
mov dword [ebx + 4], 0
je 0x4051e1
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebx + 0x18], 0
call sub.MFC42.DLL_AfxGetModuleState
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov eax, dword [eax + 0xc]
and ecx, 0xffff
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 0xc]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 0xc]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push 2
mov dword [ebx + 0x24], eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
je 0x40530b
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x405287
mov ecx, dword [ebx + 0x24]
mov edi, eax
mov edx, ecx
push ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea eax, [ebx + 0x18]
push eax
push 1
push ebp
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
je 0x405287
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8
mov eax, dword [ebx + 0x1c]
lea esi, [ebx + 0x1c]
test eax, eax
je 0x40529d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esi], 0
mov edx, dword [ebx + 0x24]
mov eax, dword [ebx + 0x18]
push esi
push 0x413878
push 1
push edx
push eax
call dword [sym.imp.OLEPRO32.DLL_OleLoadPicture]
test eax, eax
jne 0x405313
mov eax, dword [esi]
lea edx, [ebx + 0x20]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [esi]
lea edi, [ebx + 0x10]
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov esi, dword [esi]
lea ebp, [ebx + 0x14]
push ebp
push esi
mov edx, dword [esi]
call dword [edx + 0x1c]
fild dword [edi]
fmul qword [0x4129a0]
call sub.MSVCRT.dll__ftol
fild dword [ebp]
mov dword [ebx + 8], eax
fmul qword [0x4129a0]
call sub.MSVCRT.dll__ftol
mov dword [ebx + 0xc], eax
mov eax, 1
pop edi
pop esi
mov dword [ebx + 4], eax
pop ebp
pop ebx
ret 8
push 0
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8
Function at 0x4090e0
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x4107eb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x120
push ebp
push esi
push edi
mov ebp, ecx
mov dword [esp + 0x134], 1
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 4]
mov esi, dword [sym.imp.MSVCRT.dll__mbscmp]
push str.TRUE
xor edi, edi
mov eax, dword [eax + 0x44d8]
push eax
call esi
add esp, 8
test eax, eax
jne 0x409135
mov edi, 1
mov eax, dword [esp + 0x13c]
push 0x4166a8
push eax
call esi
add esp, 8
test eax, eax
jne 0x409175
test edi, edi
push 0x30
je 0x409163
mov ecx, dword [esp + 0x144]
push ecx
push 0x416338
jmp 0x4092e7
mov edx, dword [esp + 0x144]
push edx
push str.Invalid_driver_
jmp 0x4092e7
mov eax, dword [esp + 0x13c]
mov ecx, dword [eax - 8]
cmp byte [ecx + eax - 1], 0x5c
jne 0x40919d
dec ecx
push 1
push ecx
lea ecx, [esp + 0x144]
call sub.MFC42.DLL_CString::Delete
mov eax, dword [esp + 0x13c]
mov ecx, dword [eax - 8]
cmp ecx, 2
jne 0x4092b6
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
dec eax
je 0x4091ed
dec eax
je 0x409292
sub eax, 3
jne 0x40931d
test edi, edi
push 0x30
je 0x4091db
mov eax, dword [esp + 0x144]
push eax
push 0x41631c
jmp 0x4092e7
mov ecx, dword [esp + 0x144]
push ecx
push str.Netword_driver_
jmp 0x4092e7
push ebx
lea ecx, [esp + 0x10]
push 2
push ecx
lea ecx, [esp + 0x148]
call sub.MFC42.DLL_CString::Left
mov eax, dword [eax]
mov esi, dword [sym.imp.MSVCRT.dll__mbsicmp]
push 0x416308
push eax
mov byte [esp + 0x140], 2
call esi
add esp, 8
test eax, eax
je 0x409256
lea edx, [esp + 0x14]
push 2
push edx
lea ecx, [esp + 0x148]
call sub.MFC42.DLL_CString::Left
mov eax, dword [eax]
push 0x416304
push eax
call esi
add esp, 8
lea ecx, [esp + 0x14]
test eax, eax
setne bl
call sub.MFC42.DLL_CString::CString
test bl, bl
je 0x409256
mov bl, 1
jmp 0x409258
xor bl, bl
lea ecx, [esp + 0x10]
mov byte [esp + 0x138], 1
call sub.MFC42.DLL_CString::CString
test bl, bl
pop ebx
je 0x409292
test edi, edi
push 0x30
je 0x409283
mov eax, dword [esp + 0x144]
push eax
push 0x416338
jmp 0x4092e7
mov ecx, dword [esp + 0x144]
push ecx
push str.Invalid_driver_
jmp 0x4092e7
test edi, edi
push 0x30
je 0x4092a7
mov edx, dword [esp + 0x144]
push edx
push 0x4162f8
jmp 0x4092e7
mov eax, dword [esp + 0x144]
push eax
push str.Floppy_driver_
jmp 0x4092e7
lea ecx, [esp + 0x14]
push ecx
push eax
call sub.MFC42.DLL_CFile::GetStatus
test eax, eax
jne 0x40931d
test edi, edi
push 0x30
je 0x4092da
mov edx, dword [esp + 0x144]
push edx
push 0x4162d8
jmp 0x4092e7
mov eax, dword [esp + 0x144]
push eax
push str.Invalid_folder_
mov ecx, ebp
call sub.MFC42.DLL_CWnd::MessageBoxA
lea ecx, [esp + 0x13c]
mov byte [esp + 0x134], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x140]
mov dword [esp + 0x134], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
jmp 0x40934d
lea ecx, [esp + 0x13c]
mov byte [esp + 0x134], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x140]
mov dword [esp + 0x134], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, 1
mov ecx, dword [esp + 0x12c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x12c
ret 8
Function at 0x409620
Capabilities:
Check if file exists
Get file attributes
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x41086b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x124
push ebx
push esi
xor ebx, ebx
push 0x4166a8
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], ebx
call sub.MFC42.DLL_CString::CString_1
push str.Software_
lea ecx, [esp + 0x14]
mov dword [esp + 0x138], 1
call sub.MFC42.DLL_CString::CString_1
mov byte [esp + 0x134], 2
call sub.MFC42.DLL_AfxGetModuleState
mov esi, dword [eax + 4]
lea ecx, [esp + 0x10]
lea eax, [esi + 0x4200]
push eax
call fcn.0040f0cc
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
push edx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x409790
lea eax, [esp + 0xc]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x30]
push eax
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x24]
push ecx
push edx
push ebx
push str.InstallPath
push eax
mov dword [esp + 0x28], 0xff
call edi
test eax, eax
jne 0x4096ec
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x30]
push edx
mov byte [esp + ecx + 0x34], bl
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::operator
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0xff
call sub.MFC42.DLL_CString::CString_2
lea eax, [esp + 0x10]
lea ecx, [esp + 0x30]
push eax
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x24]
push ecx
push edx
push ebx
push str.Version
push eax
mov byte [esp + 0x150], 3
call edi
test eax, eax
jne 0x40973b
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x30]
push edx
mov byte [esp + ecx + 0x34], bl
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CString::operator
mov esi, dword [esi + 0x4208]
mov edi, dword [esp + 0x18]
push esi
call dword [sym.imp.MSVCRT.dll_atof]
fstp qword [esp + 0x2c]
push edi
call dword [sym.imp.MSVCRT.dll_atof]
fcomp qword [esp + 0x30]
add esp, 8
pop edi
fnstsw ax
test ah, 0x40
jne 0x409774
push 0x4166a8
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::operator
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x14]
mov byte [esp + 0x134], 2
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4097ae
push 0x4166a8
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::operator
mov esi, dword [esp + 0x13c]
lea edx, [esp + 8]
push edx
mov ecx, esi
call fcn.0040f000
mov dword [esp + 0x20], 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x134], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov byte [esp + 0x134], bl
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x12c]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x130
ret 4
Function at 0x40a3c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x410b3f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], 0
push 0x5c
lea ecx, [esp + 0x2c]
mov dword [esp + 0x20], 1
call sub.MFC42.DLL_CString::Find_2
push eax
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x30]
call sub.MFC42.DLL_CString::Left
mov ecx, dword [esp + 0x28]
push 0x5c
mov byte [esp + 0x20], 2
mov esi, dword [ecx - 8]
lea ecx, [esp + 0x2c]
call sub.MFC42.DLL_CString::Find_2
sub esi, eax
lea edx, [esp + 0xc]
dec esi
lea ecx, [esp + 0x28]
push esi
push edx
call sub.MFC42.DLL_CString::Right
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x20], 3
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 2
call sub.MFC42.DLL_CString::CString
mov eax, dword [esp + 8]
mov esi, dword [sym.imp.MSVCRT.dll__mbscmp]
push str.WINDOWS_FOLDER
push eax
call esi
add esp, 8
test eax, eax
jne 0x40a46d
mov edi, dword [edi + 0xd0]
jmp 0x40a4df
mov ecx, dword [esp + 8]
push str.SYSTEM_FOLDER
push ecx
call esi
add esp, 8
test eax, eax
jne 0x40a488
mov edi, dword [edi + 0xd4]
jmp 0x40a4df
mov edx, dword [esp + 8]
push str.TEMP_FOLDER
push edx
call esi
add esp, 8
test eax, eax
jne 0x40a4a3
mov edi, dword [edi + 0xdc]
jmp 0x40a4df
mov eax, dword [esp + 8]
push str.USER_FOLDER
push eax
call esi
add esp, 8
test eax, eax
jne 0x40a4be
mov edi, dword [edi + 0xe0]
jmp 0x40a4df
mov ecx, dword [esp + 8]
push str.SYSDRIVER_FOLDER
push ecx
call esi
add esp, 8
test eax, eax
jne 0x40a4d9
mov edi, dword [edi + 0xe4]
jmp 0x40a4df
mov edi, dword [edi + 0xd8]
push edi
push 0
lea ecx, [esp + 0x30]
call sub.MFC42.DLL_CString::Insert
mov esi, dword [esp + 0x24]
lea edx, [esp + 0x28]
push edx
mov ecx, esi
call fcn.0040f000
mov dword [esp + 0x10], 1
lea ecx, [esp + 8]
mov byte [esp + 0x1c], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x28]
mov byte [esp + 0x1c], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret 8
Function at 0x40a7e0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x410b96
push eax
mov eax, 0x1044
mov dword fs:[0], esp
call fcn.0040f530
push ebx
mov dword [esp + 0x28], ecx
push esi
push edi
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CFile::CFile
mov eax, dword [ebp + 0xc]
push 0
push 0x40
push eax
lea ecx, [esp + 0x28]
mov dword [esp + 0x1064], 0
call sub.MFC42.DLL_CFile::Open
test eax, eax
je 0x40a9e5
mov edi, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x10]
cmp edi, 0xffffffff
jne 0x40a854
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CFile::GetLength
mov edi, eax
sub edi, ebx
mov dword [ebp + 0x14], edi
lea ecx, [esp + 0x34]
call sub.MFC42.DLL_CFile::CFile
mov esi, dword [ebp + 8]
push 0x80
push esi
mov byte [esp + 0x1060], 1
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
push 0x1001
push esi
lea ecx, [esp + 0x40]
call sub.MFC42.DLL_CFile::Open
test eax, eax
je 0x40a9cb
xor esi, esi
mov dword [esp + 0x14], 0
cmp edi, esi
mov dword [esp + 0x18], 0x3ff00000
jle 0x40a8b0
fild dword [ebp + 0x14]
fmul qword [0x413428]
fstp qword [esp + 0x14]
mov ecx, dword [ebp + 0x18]
mov eax, 0x66666667
imul ecx
sar edx, 3
mov ecx, edx
push esi
shr ecx, 0x1f
add edx, ecx
push ebx
lea ecx, [esp + 0x24]
mov dword [esp + 0x34], edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], esi
call sub.MFC42.DLL_CFile::Seek
cmp edi, esi
mov ebx, 0x1000
jle 0x40a978
cmp ebx, edi
jle 0x40a8ee
mov ebx, edi
lea edx, [esp + 0x50]
push ebx
push edx
lea ecx, [esp + 0x24]
call sub.MFC42.DLL_CFile::Read
mov esi, eax
lea eax, [esp + 0x50]
push esi
push eax
lea ecx, [esp + 0x3c]
call sub.MFC42.DLL_CFile::Write
mov eax, dword [esp + 0xc]
sub edi, esi
add eax, esi
mov dword [esp + 0xc], eax
fild dword [esp + 0xc]
fst qword [esp + 0x44]
fild dword [esp + 0x10]
fmul qword [esp + 0x14]
fmul qword [0x413420]
fxch st(1)
fcompp
fnstsw ax
test ah, 1
jne 0x40a970
mov ecx, dword [esp + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [esp + 0x44]
fdiv qword [esp + 0x14]
push 0
call sub.MSVCRT.dll__ftol
mov edx, dword [esp + 0x34]
push eax
push 0x402
mov eax, dword [edx + 0x108]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
inc dword [esp + 0x10]
test edi, edi
jg 0x40a8e8
lea ecx, [esp + 0x34]
call sub.MFC42.DLL_CFile::Close
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CFile::Close
lea ecx, [esp + 0x34]
mov byte [esp + 0x1058], 0
call fcn.0040f024
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1058], 0xffffffff
call fcn.0040f024
mov eax, 1
mov ecx, dword [esp + 0x1050]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CFile::Close
lea ecx, [esp + 0x34]
mov byte [esp + 0x1058], 0
call fcn.0040f024
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1058], 0xffffffff
call fcn.0040f024
mov ecx, dword [esp + 0x1050]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x40b280
Capabilities:
Check if file exists
Create process on windows
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x410c48
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
lea ecx, [esp + 8]
lea ebx, [esi + 0xd8]
push ebx
call fcn.0040f000
push str.setup.bat
lea ecx, [esp + 0xc]
mov dword [esp + 0x18], 0
call fcn.0040f078
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40b331
lea edx, [esi + 0x94]
push edi
mov ecx, 0xf
xor eax, eax
mov edi, edx
push edx
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x10]
mov ebx, dword [ebx]
mov dword [edx], 0x3c
mov dword [esi + 0x98], 0x440
mov dword [esi + 0x9c], eax
mov dword [esi + 0xa0], eax
mov dword [esi + 0xa4], ecx
mov dword [esi + 0xac], ebx
mov dword [esi + 0xb0], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov edx, dword [esi + 0xcc]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop edi
lea ecx, [esp + 8]
mov dword [esp + 0x14], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x40cec0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x411077
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], 0
lea ecx, [esp + 8]
mov dword [esp + 0x1c], 1
call sub.MFC42.DLL_CString::CString_2
push 0x5c
lea ecx, [esp + 0x2c]
mov byte [esp + 0x20], 2
call sub.MFC42.DLL_CString::Find_2
push eax
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x30]
call sub.MFC42.DLL_CString::Left
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 3
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 2
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x28]
push 0x5c
mov esi, dword [ecx - 8]
lea ecx, [esp + 0x2c]
call sub.MFC42.DLL_CString::Find_2
sub esi, eax
lea edx, [esp + 0xc]
push esi
push edx
lea ecx, [esp + 0x30]
call sub.MFC42.DLL_CString::Right
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x20], 4
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 2
call sub.MFC42.DLL_CString::CString
mov eax, dword [esp + 8]
mov esi, dword [sym.imp.MSVCRT.dll__mbscmp]
push str.WINDOWS_FOLDER
push eax
call esi
add esp, 8
test eax, eax
jne 0x40cf92
add edi, 0x90
jmp 0x40d004
mov ecx, dword [esp + 8]
push str.SYSTEM_FOLDER
push ecx
call esi
add esp, 8
test eax, eax
jne 0x40cfad
add edi, 0x94
jmp 0x40d004
mov edx, dword [esp + 8]
push str.TEMP_FOLDER
push edx
call esi
add esp, 8
test eax, eax
jne 0x40cfc8
add edi, 0x9c
jmp 0x40d004
mov eax, dword [esp + 8]
push str.USER_FOLDER
push eax
call esi
add esp, 8
test eax, eax
jne 0x40cfe3
add edi, 0xa4
jmp 0x40d004
mov ecx, dword [esp + 8]
push str.SYSDRIVER_FOLDER
push ecx
call esi
add esp, 8
test eax, eax
jne 0x40cffe
add edi, 0xa8
jmp 0x40d004
add edi, 0x98
push edi
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::operator_1
lea edx, [esp + 0x28]
lea ecx, [esp + 8]
push edx
call fcn.0040f0cc
mov esi, dword [esp + 0x24]
lea eax, [esp + 8]
push eax
mov ecx, esi
call fcn.0040f000
mov dword [esp + 0x10], 1
lea ecx, [esp + 8]
mov byte [esp + 0x1c], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x28]
mov byte [esp + 0x1c], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret 8
Function at 0x100019b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call dword [eax + 0x56]
push dword [ebp + 8]
call fcn.1000162b
add esp, 0x10
mov dword [ebp - 0x88], eax
js 0x100019c1
invalid
invalid
call fcn.10001666
sar dword [0x458d5e65], 1
call 0x60e8775c
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.10001676
push eax
push esi
push dword [ebp + 8]
call fcn.1000162b
mov dword [ebp - 8], eax

Function at 0x10001a20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.10001676
push eax
push esi
push dword [ebp + 8]
call fcn.1000162b
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.10001676
push eax
push esi
push dword [ebp + 8]
call fcn.1000162b
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.10001666
inc eax
wait
punpcklbw mm1, dword [eax - 0x8363]
dec dword [eax - 0x8263]
inc esi
test dword [esi - 1], edi
invalid

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0x17be1235
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x5cf71886
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x40449c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x25c
mov eax, dword [0x42600c]
xor eax, esp
mov dword [esp + 0x258], eax
push esi
mov esi, ecx
test esi, esi
jne 0x4044c1
push 0xd
jmp 0x404516
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x404514
push 0x250
lea eax, [esp + 0xc]
push 0
push eax
call fcn.004095e0
add esp, 0xc
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x404514
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push ecx
xor edx, edx
mov ecx, esi
call fcn.00403c3e
neg eax
pop ecx
sbb eax, eax
and eax, 0xfffffc12
add eax, 0x3ee
jmp 0x404517
push 2
pop eax
mov ecx, dword [esp + 0x25c]
pop esi
xor ecx, esp
call fcn.0040797f
mov esp, ebp
pop ebp
ret