joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000655b
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov edi, dword [ebp + 8]
lea esi, [edi - 0x6c]
mov ecx, esi
call fcn.10008bb5
test eax, eax
jne 0x1000657b
mov eax, 0x80070005
jmp 0x100065ec
push esi
mov ecx, esi
call fcn.10008bb5
test eax, eax
js 0x100065ea
cmp dword [edi + 0x44], 0
je 0x100065ea
and dword [ebp + 8], 0
lea eax, [ebp - 0x10]
mov esi, dword [sym.imp.USER32.dll_GetCursorPos]
push eax
call esi
lea eax, [ebp - 8]
push eax
call esi
push 0x14
pop ecx
call fcn.100099b8
test eax, eax
je 0x100065c7
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
and dword [eax + 8], 0
mov dword [eax], vtable.CNameShowContactCardJob.0
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], edx
jmp 0x100065c9
xor eax, eax
push eax
lea ecx, [ebp + 8]
call fcn.10008bb5
mov esi, dword [ebp + 8]
test esi, esi
je 0x100065ea
mov ecx, dword [edi + 0x44]
push esi
call fcn.10008bb5
test eax, eax
mov eax, dword [esi]
push esi
call dword [eax + 8]
xor eax, eax
pop edi
pop esi
leave
ret 4

Function at 0x10008bb5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x10008bc4
pop dword [ebp - 0x4c]
mov eax, 0x5c8247fe
sub eax, 0x4c81bc3a
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x39e98
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x3fe389e8
add ecx, 0xc01cc4ea
mov edi, eax
mov esi, 0x1dff0ecf
add esi, 0xf2024331
add esi, dword [ebp - 0x4c]
mov ebx, 0x9be10c6a
mov dword [ebp - 0x30], 0x9040800d
mov edx, dword [esi]
sub dword [ebp - 0x10], esi
sub edx, ebx
sub dword [ebp - 0x28], 0xb28f9fdd
mov dword [edi], edx
xor dword [ebp - 0xc], eax
add edi, 0xd039da2
add edi, 0xf2fc6262
add esi, 0x616994ff
add esi, 0x9e966b05
loop 0x10008c18
add eax, 0x12e1b
mov ebx, eax
add eax, 0x39a8503c
add eax, 0xc657afc9
mov ecx, 0x1048444b
add ecx, 0xffb7bbb5
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x107388a0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push eax
push ebp
not cx
rdtsc
push edi
rdtsc
lahf
mov ecx, 0
movsx ebx, cx
cwde
push ecx
bts edi, eax
mov edi, dword [esp + 0x28]
xchg esi, esi
rol edi, 1
bt eax, 0x32
bswap edi
clc
btc dx, dx
rol edi, 2
neg dx
cdq
neg edi
cmc
sal dh, 0x5b
sub dx, 0x418e
lea edi, [edi + ecx]
rdtsc
mov ebp, esp
shr ax, 0xf4
lea esp, [esp - 0xc0]
rol bx, cl
and si, bp
mov ebx, edi
xor ah, 0x1f
mov edx, 0
sub ebx, edx
or esi, 0x1b425c36
lea esi, [0x10670f3a]
rcr al, cl
sbb ah, 0x39
sub edi, 4
stc
xchg ah, al
mov eax, dword [edi]
cmp esp, 0x64e02a3a
xor eax, ebx
jmp 0x106e7b9e
dec eax
clc
stc
rol eax, 2
inc eax
not eax
cmp ecx, eax
cmc
lea eax, [eax - 0x2fa420f9]
cmc
neg eax
xor ebx, eax
add esi, eax
jmp 0x107111ad
push esi
ret
push ecx
jmp 0x10810d1d
pushfd
rol cx, 0xb7
cmc
push edx
btc edx, esp
rcl dh, cl
push ebx
btc edx, eax
not dl
ror ecx, 0xb
push esi
jmp 0x10670ed3
Function at 0x402140
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
push 0xe4
mov eax, 0x445cb6
call fcn.00424e5c
mov dword [ebp - 0xa8], edx
mov bl, cl
and dword [ebp - 0x38], 0
xor eax, eax
mov dword [ebp - 0x34], 7
mov word [ebp - 0x48], ax
and dword [ebp - 4], eax
call fcn.00416d56
lea edx, [ebp - 0x48]
mov cl, al
call fcn.004158c7
push str.OneDriveStandaloneUpdater.exe
lea ecx, [ebp - 0x48]
mov esi, eax
call fcn.004029f2
xor eax, eax
mov dword [ebp - 0x94], 0x44
lea edi, [ebp - 0xa4]
stosd dword es:[edi], eax
push 0x40
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x90]
xor edi, edi
push edi
push eax
call fcn.00426720
add esp, 0xc
mov dword [ebp - 0x20], edi
xor eax, eax
mov dword [ebp - 0x1c], 7
lea ecx, [ebp - 0x30]
mov word [ebp - 0x30], ax
push str.OneDriveStandaloneUpdater.exe__repair:19.043.0304.0013
call fcn.004029c9
mov byte [ebp - 4], 1
test bl, bl
je 0x4022a1
push str.___vermismatch:
lea ecx, [ebp - 0x30]
call fcn.004029f2
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], edi
push eax
push dword [ebp - 0xa8]
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, eax
cmp dword [ebp - 0x18], edi
jle 0x402292
push 0x458e70
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0xf0]
call fcn.00402c9a
mov byte [ebp - 4], 2
mov ecx, eax
push dword [ebx + edi*4]
call fcn.004029f2
push eax
lea ecx, [ebp - 0xd8]
call fcn.004030bd
push 0x458e68
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 3
call fcn.004029f2
push eax
lea ecx, [ebp - 0xc0]
call fcn.004030bd
lea eax, [ebp - 0xc0]
push eax
lea ecx, [ebp - 0x30]
call fcn.004028ad
lea ecx, [ebp - 0xc0]
call fcn.00403265
lea ecx, [ebp - 0xd8]
call fcn.00403265
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], 1
call fcn.00403265
inc edi
cmp edi, dword [ebp - 0x18]
jl 0x402207
push 0x458c10
lea ecx, [ebp - 0x30]
call fcn.004029f2
xor edi, edi
cmp dword [ebp - 0x1c], 8
lea edx, [ebp - 0xa4]
push edx
lea edx, [ebp - 0x94]
push edx
push edi
push edi
push edi
push edi
push edi
lea ecx, [ebp - 0x30]
cmovae ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x48]
cmp dword [ebp - 0x34], 8
push edi
cmovae eax, dword [ebp - 0x48]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4022f1
push dword [ebp - 0xa0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xa4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x402305
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
lea ecx, [ebp - 0x30]
call fcn.00403265
lea ecx, [ebp - 0x48]
call fcn.00403265
mov eax, esi
call fcn.00424e06
ret
Function at 0x4163a1
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x22c
mov eax, 0x44814b
call fcn.00424e5c
mov esi, edx
mov edi, ecx
mov eax, dword [ebp + 0xc]
mov ecx, eax
mov dword [ebp - 0x238], eax
call fcn.00403d52
movzx eax, byte [ebp + 8]
and dword [ebp - 0x234], 0
shl eax, 8
or eax, 0x20019
cmp dword [esi + 0x14], 8
jb 0x4163df
mov esi, dword [esi]
lea ecx, [ebp - 0x234]
push ecx
push eax
push 0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x4164b8
xor ebx, ebx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x218]
mov dword [ebp - 0x218], 0xff
push eax
lea eax, [ebp - 0x214]
push eax
push ebx
push dword [ebp - 0x234]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov edi, eax
test edi, edi
jne 0x41648b
and dword [ebp - 0x220], eax
lea ecx, [ebp - 0x230]
mov word [ebp - 0x230], ax
lea eax, [ebp - 0x214]
push eax
mov dword [ebp - 0x21c], 7
call fcn.004029c9
mov ecx, dword [ebp - 0x238]
lea eax, [ebp - 0x230]
and dword [ebp - 4], edi
push eax
call fcn.004070fc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.00403265
jmp 0x416493
cmp edi, 0x103
jne 0x41649e
inc ebx
test edi, edi
je 0x416409
jmp 0x4164ac
movzx esi, di
or esi, 0x80070000
test edi, edi
cmovle esi, edi
push dword [ebp - 0x234]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
call fcn.00424e06
ret 8

Function at 0x4164c2
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x228
mov eax, 0x44818b
call fcn.00424e5c
mov esi, edx
mov eax, dword [ebp + 0xc]
mov ecx, eax
mov dword [ebp - 0x234], eax
call fcn.00403d52
xor edi, edi
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x230], edi
jb 0x4164f3
mov esi, dword [esi]
lea eax, [ebp - 0x230]
push eax
push 0x20019
push edi
push esi
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x4165d2
mov ebx, edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 0xff
push eax
lea eax, [ebp - 0x210]
push eax
push ebx
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov edi, eax
test edi, edi
jne 0x4165a2
and dword [ebp - 0x21c], eax
lea ecx, [ebp - 0x22c]
mov word [ebp - 0x22c], ax
lea eax, [ebp - 0x210]
push eax
mov dword [ebp - 0x218], 7
call fcn.004029c9
mov ecx, dword [ebp - 0x234]
lea eax, [ebp - 0x22c]
and dword [ebp - 4], edi
push eax
call fcn.004070fc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x22c]
call fcn.00403265
jmp 0x4165aa
cmp edi, 0x103
jne 0x4165b8
inc ebx
test edi, edi
push 0
pop edi
je 0x416524
jmp 0x4165c6
movzx esi, di
or esi, 0x80070000
test edi, edi
cmovle esi, edi
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
call fcn.00424e06
ret 8
Function at 0x4168eb
Capabilities:
Create process on windows

Disassembly:
push 0x2b0
mov eax, 0x448251
call fcn.00424e5c
mov edi, edx
mov esi, ecx
mov eax, dword [ebp + 8]
xor ebx, ebx
push 0x208
mov dword [ebp - 0x28c], eax
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.00426720
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
mov edx, str._client
lea ecx, [ebp - 0x248]
call fcn.0040632f
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x230]
push edi
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x21c], ebx
call fcn.0040543e
push ecx
lea eax, [ebp - 0x248]
mov byte [ebp - 4], 1
push eax
mov ecx, edi
call fcn.00403ec6
cmp eax, 0xffffffff
jne 0x4169d1
push 0x45a478
lea edx, [ebp - 0x248]
lea ecx, [ebp - 0x2bc]
call fcn.00402c9a
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 2
push ecx
mov ecx, eax
call fcn.00402e69
push eax
lea ecx, [ebp - 0x2a4]
call fcn.004030bd
lea eax, [ebp - 0x2a4]
push eax
lea ecx, [ebp - 0x230]
call fcn.004028ad
lea ecx, [ebp - 0x2a4]
call fcn.00403265
lea ecx, [ebp - 0x2bc]
call fcn.00403265
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x284]
push ebx
push eax
call fcn.00426720
add esp, 0xc
mov dword [ebp - 0x284], esi
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x218]
mov dword [ebp - 0x274], eax
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
mov dword [ebp - 0x270], eax
lea eax, [ebp - 0x284]
push eax
mov dword [ebp - 0x280], 0x8000
mov dword [ebp - 0x278], 0x45a47c
mov dword [ebp - 0x268], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
setne byte [ebp - 0x285]
test eax, eax
jne 0x416a51
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [ebp - 0x28c]
lea ecx, [ebp - 0x230]
mov dword [eax], ebx
call fcn.00403265
lea ecx, [ebp - 0x248]
call fcn.00403265
mov al, byte [ebp - 0x285]
call fcn.00424e06
ret 4

Function at 0x416c52
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
cmp dword [ecx + 0x14], 8
push esi
push edi
mov esi, ecx
jb 0x416c5e
mov esi, dword [ecx]
mov edi, dword [ecx + 0x10]
mov ecx, 0x811c9dc5
push 0
pop edx
add edi, edi
je 0x416c7e
movzx eax, byte [esi + edx]
xor eax, ecx
imul ecx, eax, 0x1000193
inc edx
cmp edx, edi
jb 0x416c6d
pop edi
mov eax, ecx
pop esi
ret
Function at 0x41a2b5
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x228
mov eax, 0x4489bb
call fcn.00424e5c
mov esi, ecx
mov eax, dword [ebp + 0xc]
mov ecx, eax
push 0x14
pop edi
push 0x459068
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x220], edi
call fcn.004029c9
and dword [ebp - 0x21c], 0
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x21c]
mov ebx, 0x80004004
push eax
lea ecx, [esi + 4]
call fcn.0041aacf
mov ecx, dword [ebp - 0x21c]
cmp ecx, dword [esi + 4]
je 0x41a316
cmp dword [ecx + 0x10], edi
jle 0x41a319
mov ecx, dword [esi + 4]
cmp ecx, dword [esi + 4]
je 0x41a3e6
and dword [ebp - 0x224], 0
lea edi, [ebp - 0x230]
xor eax, eax
mov dword [ebp - 0x21c], 0x208
stosd dword es:[edi], eax
add ecx, 0x14
push ecx
lea ecx, [ebp - 0x230]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.0041a9a0
and dword [ebp - 4], 0
mov edi, dword [ebp - 0x22c]
mov esi, dword [ebp - 0x230]
cmp esi, edi
je 0x41a3db
add esi, 0x18
cmp byte [esi + 0x1c], 0
lea ecx, [esi + 4]
mov edx, 0x2001b
mov eax, 0x3001b
cmovne edx, eax
cmp dword [esi + 0x18], 8
jb 0x41a380
mov ecx, dword [ecx]
cmp dword [esi], 8
lea eax, [esi - 0x14]
jb 0x41a38a
mov eax, dword [eax]
lea ebx, [ebp - 0x21c]
push ebx
lea ebx, [ebp - 0x218]
push ebx
lea ebx, [ebp - 0x224]
push ebx
push edx
push ecx
push eax
push dword [esi - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
jns 0x41a3c9
add esi, 0x38
lea eax, [esi - 0x18]
cmp eax, edi
jne 0x41a364
jmp 0x41a3db
mov ecx, dword [ebp - 0x234]
lea eax, [ebp - 0x218]
push eax
call fcn.004029c9
lea ecx, [ebp - 0x230]
call fcn.0041746d
mov eax, ebx
call fcn.00424e06
ret 8
Function at 0x41c830
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push 0x54
mov eax, 0x448e28
call fcn.00424e5c
mov esi, dword [ebp + 8]
mov eax, esi
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
cmp dword [esi + 0x14], 8
jb 0x41c84f
mov eax, dword [esi]
push eax
lea ecx, [ebp - 0x48]
call fcn.004028e6
and dword [ebp - 4], 0
lea ecx, [ebp - 0x48]
push edi
push ebx
xor dl, dl
call fcn.0041c9d4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x30], eax
call fcn.00403265
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x41c881
mov eax, dword [esi]
push eax
lea ecx, [ebp - 0x60]
call fcn.004028e6
push edi
push ebx
mov dl, 1
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x60]
call fcn.0041c9d4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x60]
call fcn.00403265
and dword [ebp - 0x18], 0
lea ecx, [ebp - 0x28]
xor eax, eax
mov dword [ebp - 0x14], 7
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerDesktopNameSpace_
mov word [ebp - 0x28], ax
call fcn.004029c9
mov dword [ebp - 4], 2
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x41c8d8
mov eax, dword [esi]
push dword [esi + 0x10]
lea ecx, [ebp - 0x28]
push eax
call fcn.00402ac8
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push 0x1010b
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
lea eax, [ebp - 0x2c]
push eax
push 0x1010b
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerHideDesktopIconsNewStartPanel
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
js 0x41c95e
cmp dword [esi + 0x14], 8
jb 0x41c93d
mov esi, dword [esi]
push esi
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x2c]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0041c9ba
lea ecx, [ebp - 0x28]
call fcn.00403265
mov eax, dword [ebp - 0x30]
test ebx, ebx
cmovne edi, ebx
test eax, eax
cmovne edi, eax
mov eax, edi
call fcn.00424e06
ret 0xc
Function at 0x41ce64
Capabilities:
Accept command line arguments

Disassembly:
push 0x230
mov eax, 0x448f2d
call fcn.00424e5c
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x238], esi
mov dword [ebp - 0x23c], esi
xor ecx, ecx
mov dword [ebp - 0x234], ecx
xor eax, eax
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], 7
mov word [esi], ax
mov dword [ebp - 4], ecx
mov dword [ebp - 0x234], 1
call fcn.00416d56
mov bl, al
test bl, bl
jne 0x41cf2b
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00426720
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x41cf2b
lea eax, [ebp - 0x218]
push 0x45b584
push eax
call fcn.00425f1e
pop ecx
pop ecx
test eax, eax
je 0x41cf2b
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x230]
call fcn.004028e6
push ecx
push str._allusers
lea ecx, [ebp - 0x230]
call fcn.00403e8d
cmp eax, 0xffffffff
lea ecx, [ebp - 0x230]
setne bl
call fcn.00403265
mov edx, esi
mov cl, bl
call fcn.004158c7
test eax, eax
js 0x41cf44
push 0x458ebc
mov ecx, esi
call fcn.004029f2
push 0x45a3f8
mov ecx, esi
call fcn.004029f2
mov dl, 1
mov ecx, edi
call fcn.0041ce34
mov edx, eax
lea ecx, [ebp - 0x230]
call 0x4174f6
push eax
mov ecx, esi
mov dword [ebp - 4], 1
call fcn.00402e69
lea ecx, [ebp - 0x230]
call fcn.00403265
mov eax, esi
call fcn.00424e06
ret 4
Function at 0x416d18
Capabilities:
Accept command line arguments

Disassembly:
push 0x44
mov eax, 0x444538
call fcn.00443e79
mov edi, ecx
sub esp, 0x58
mov ecx, esp
push 0xdc
push 9
push 0x46
push 0x402df0
push 0x402d58
push 0x402d68
call fcn.00440fc8
xor ebx, ebx
lea ecx, [ebp - 0x50]
push ebx
call fcn.00441304
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
movzx ecx, word [esi]
push ecx
jmp 0x416d6b
add esi, 2
movzx eax, word [esi]
push eax
call dword [sym.imp.msvcrt.dll_iswspace]
pop ecx
test eax, eax
jne 0x416d64
movzx eax, word [esi]
push 0x22
pop ecx
cmp ax, cx
jne 0x416da6
push ecx
add esi, 2
push esi
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
je 0x416ee8
push 0x22
push esi
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
lea esi, [eax + 2]
jmp 0x416dc6
test ax, ax
je 0x416dc6
mov ecx, eax
push ecx
call dword [sym.imp.msvcrt.dll_iswspace]
pop ecx
test eax, eax
jne 0x416dc6
add esi, 2
movzx eax, word [esi]
mov ecx, eax
test ax, ax
jne 0x416dad
push esi
mov ecx, edi
call fcn.004172d9
test al, al
je 0x416f24
push ebx
push ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov esi, eax
test esi, esi
js 0x416f39
push 0x402e58
push 0x402f50
sub esp, 0x58
mov ecx, esp
push 0xdc
push 9
push 0x61
push 0x402df0
push 0x402d58
push 0x402d68
call fcn.00440fc8
lea eax, [ebp - 0x50]
push eax
call fcn.00441c0c
add esp, 0x64
lea edx, [ebp - 0x10]
xor ebx, ebx
mov ecx, 0x403c6c
inc ebx
mov byte [edi + 0x29c], bl
call fcn.00438add
test al, al
je 0x416e3d
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x416eda
xor eax, eax
push eax
push eax
push eax
push 3
push 6
push eax
push eax
push 0xffffffffffffffff
push eax
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
mov esi, eax
test esi, esi
jns 0x416ea2
mov ecx, esi
call fcn.00416f95
push eax
push esi
mov edi, 0x402f68
lea eax, [ebp - 0x50]
push edi
push 0x402e88
push eax
call fcn.00441fad
add esp, 0x14
mov ecx, esi
call fcn.00416f95
push eax
push esi
push edi
push 0x402f2c
push esi
sub esp, 0x58
mov ecx, esp
push 0xdc
push 9
push 0x79
jmp 0x416f77
push 0x402f68
push 0x402f50
sub esp, 0x58
mov ecx, esp
push 0xdc
push 9
push 0x79
push 0x402df0
push 0x402d58
push 0x402d68
call fcn.00440fc8
lea eax, [ebp - 0x50]
push eax
call fcn.00441c0c
add esp, 0x64
lea ecx, [ebp - 0x50]
call fcn.004413c9
call fcn.00443e47
ret
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
push 0x402e24
push 0x8000ffff
sub esp, 0x58
mov ecx, esp
push 0xdc
push 9
push 0x4f
push 0x402df0
push 0x402d58
push 0x402d68
call fcn.00440fc8
lea eax, [ebp - 0x50]
push eax
call fcn.00441d48
push 0x44d04c
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x80070057
push eax
call sub.msvcrt.dll__CxxThrowException
mov ecx, esi
call fcn.00416f95
push eax
push esi
mov edi, 0x402e58
lea eax, [ebp - 0x50]
push edi
push 0x402e88
push eax
call fcn.00441fad
add esp, 0x14
mov ecx, esi
call fcn.00416f95
push eax
push esi
push edi
push 0x402f2c
push esi
sub esp, 0x58
mov ecx, esp
push 0xdc
push 9
push 0x61
push 0x402df0
push 0x402d58
push 0x402d68
call fcn.00440fc8
lea eax, [ebp - 0x50]
push eax
call fcn.0044255f
int3
Function at 0x422834
Capabilities:
Copy file

Disassembly:
push 0x498
mov eax, 0x445053
call fcn.00443f18
mov edi, ecx
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x438], edi
mov dword [ebp - 0x444], eax
and dword [ebp - 4], 0
sub esp, 0x58
mov ecx, esp
push 0xdc
push 9
push 0x9c3
push 0x40986c
push 0x402d58
push 0x404fd8
call fcn.00440fc8
push 0
lea ecx, [ebp - 0x48c]
call fcn.00441304
push ebx
push 9
push 0x4098a8
lea eax, [ebp - 0x440]
mov byte [ebp - 4], 1
push eax
push edi
call fcn.004279d2
add esp, 0x14
push ebx
push dword [ebp - 0x444]
lea eax, [ebp - 0x42c]
mov byte [ebp - 4], 3
push 0x4098b4
push 0x104
push eax
call fcn.00417966
add esp, 0x14
mov dword [ebp - 0x484], eax
lea eax, [ebp - 0x42c]
push eax
push 0x4098c0
sub esp, 0x58
mov ecx, esp
push 0xdc
push 9
push 0x9cc
push 0x40986c
push 0x402d58
push 0x404fd8
call fcn.00440fc8
lea eax, [ebp - 0x48c]
push eax
call fcn.00441c0c
add esp, 0xc
mov ecx, esp
push 0xdc
push 9
push 0x9cd
push 0x40986c
push 0x402d58
push 0x404fd8
call fcn.00440fc8
mov edx, 0x405060
lea ecx, [ebp - 0x48c]
call fcn.00419ceb
add esp, 0x58
mov eax, esi
test esi, esi
jne 0x422953
mov eax, ebx
push eax
lea eax, [edi + 0x20]
push eax
push 0x4098b4
lea eax, [ebp - 0x224]
push 0x104
push eax
call fcn.00417966
add esp, 0x14
mov dword [ebp - 0x484], eax
lea eax, [ebp - 0x224]
push eax
push 0x4098e8
sub esp, 0x58
mov ecx, esp
push 0xdc
push 9
push 0x9d3
push 0x40986c
push 0x402d58
push 0x404fd8
call fcn.00440fc8
lea eax, [ebp - 0x48c]
push eax
call fcn.00441c0c
add esp, 0xc
mov ecx, esp
push 0xdc
push 9
push 0x9d4
push 0x40986c
push 0x402d58
push 0x404fd8
call fcn.00440fc8
mov edx, 0x405060
lea ecx, [ebp - 0x48c]
call fcn.00419ceb
add esp, 0x58
lea eax, [ebp - 0x224]
push 0
push eax
lea eax, [ebp - 0x42c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x422b5d
test esi, esi
jne 0x422a10
mov esi, ebx
push esi
push 0x409934
lea ecx, [ebp - 0x440]
call fcn.00419156
jmp 0x422a75
mov dword [ebp - 4], 2
cmp dword [ebp - 0x484], 0
jge 0x422aae
push dword [ebp - 0x484]
lea eax, [ebp - 0x440]
push 0x4056cc
push 0x409940
push ecx
push ecx
mov ecx, esp
push eax
call fcn.0042c1f1
push edi
call fcn.00427b5e
add esp, 0x18
lea eax, [ebp - 0x440]
push eax
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp + 0x14]
call fcn.00419a59
lea ecx, [ebp - 0x434]
call fcn.00419d7f
lea ecx, [ebp - 0x440]
call fcn.00419d7f
lea ecx, [ebp - 0x48c]
call fcn.004413c9
lea ecx, [ebp + 0x14]
call fcn.00419d7f
call fcn.00443e6a
ret 0x14
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x42c]
push eax
push 0x409910
sub esp, 0x58
mov ecx, esp
push 0xdc
push 9
push 0x9d8
push 0x40986c
push 0x402d58
push 0x404fd8
call fcn.00440fc8
lea eax, [ebp - 0x48c]
push eax
call fcn.004423d6
sub esp, 0x58
mov byte [ebp - 4], 5
mov ecx, esp
push 0xdc
push 9
push 0x9de
push 0x40986c
push 0x402d58
push 0x404fd8
call fcn.00440fc8
lea ecx, [ebp - 0x48c]
call fcn.00441d17
int3
Function at 0x427c6e
Capabilities:
Write file on windows

Disassembly:
push 0x60
mov eax, 0x4458cb
call fcn.00443e79
mov esi, ecx
sub esp, 0x58
mov edi, 0xdc
mov ecx, esp
push edi
push 9
push 0xdf8
push 0x40b6cc
push 0x402d58
push 0x404fd8
call fcn.00440fc8
xor ebx, ebx
lea ecx, [ebp - 0x6c]
push ebx
call fcn.00441304
push dword [ebp + 8]
lea eax, [ebp - 0x6c]
mov dword [ebp - 4], ebx
push 0x40b70c
push eax
call fcn.00441fad
add esp, 0xc
push ebx
push ebx
push 4
push ebx
push 1
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x2c], 0x401090
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 1
cmp eax, 0xffffffff
je 0x427dec
lea ecx, [esi + 0x18]
call fcn.00419afe
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x1c], esi
mov byte [ebp - 4], 2
test esi, esi
je 0x427e1b
push esi
call dword [sym.imp.OLEAUT32.dll_VariantInit]
mov edi, eax
push 0x4026c0
lea eax, [edi*2 + 2]
push eax
call fcn.004439ee
pop ecx
mov ebx, eax
mov dword [ebp - 0x24], 0x4010f0
pop ecx
mov dword [ebp - 0x20], ebx
mov byte [ebp - 4], 3
test ebx, ebx
jne 0x427d5a
sub esp, 0x58
mov ecx, esp
push 0xdc
push 9
push 0xe13
jmp 0x427e28
xor ecx, ecx
lea eax, [edi*2 + 2]
push ecx
push ecx
push eax
push ebx
push edi
push esi
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
jg 0x427d8f
push 0x40b758
sub esp, 0x58
mov ecx, esp
push 0xdc
push 9
push 0xe17
jmp 0x427dfe
push 0
lea eax, [ebp - 0x18]
mov byte [edi + ebx], 0
push eax
push edi
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x427dd4
cmp dword [ebp - 0x18], edi
jne 0x427dd4
lea ecx, [ebp - 0x24]
call fcn.004286c5
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea ecx, [ebp - 0x2c]
call fcn.00428c04
lea ecx, [ebp - 0x6c]
call fcn.004413c9
call fcn.00443e47
ret 4
push 0x40b780
sub esp, 0x58
mov ecx, esp
push 0xdc
push 9
push 0xe1f
jmp 0x427dfe
push 0x40b740
sub esp, 0x58
mov ecx, esp
push edi
push 9
push 0xe07
push 0x40b6cc
push 0x402d58
push 0x404fd8
call fcn.00440fc8
lea eax, [ebp - 0x6c]
push eax
call fcn.004423d6
sub esp, 0x58
mov ecx, esp
push edi
push 9
push 0xe0b
push 0x40b6cc
push 0x402d58
push 0x404fd8
call fcn.00440fc8
lea ecx, [ebp - 0x6c]
call fcn.00441d17
int3