joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46158b
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b8b12
mov eax, dword fs:[0]
push eax
push ecx
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4f91bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.DS_MP3_Constructor.0
mov dword [ebp - 4], 2
xor ebx, ebx
mov ecx, dword [esi + 0xcc]
test ecx, ecx
je 0x4615dc
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 0xcc], ebx
mov ecx, dword [esi + 0xc8]
test ecx, ecx
je 0x4615f2
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 0xc8], ebx
mov ecx, dword [esi + 0xc4]
test ecx, ecx
je 0x461608
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 0xc4], ebx
mov ecx, dword [esi + 0xc0]
test ecx, ecx
je 0x46161e
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 0xc0], ebx
mov ecx, dword [esi + 0xbc]
test ecx, ecx
je 0x461634
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 0xbc], ebx
lea edi, [esi + 0xd4]
cmp dword [edi + 0x14], 8
jb 0x461644
mov eax, dword [edi]
jmp 0x461646
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], edi
mov byte [ebp - 4], 1
mov ecx, edi
push ebx
push 1
call fcn.00403470
mov byte [ebp - 4], bl
lea ecx, [esi + 0x9c]
call fcn.00458378
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.00453950
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46168d
Capabilities:
Copy file
Get common file path

Disassembly:
push 0x2f4
mov eax, 0x4b8b7a
call fcn.00483391
mov edi, ecx
push ecx
call fcn.00461b38
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.0040344b
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x230]
lea esi, [edi + 0xd4]
push eax
mov ecx, esi
call fcn.0040c71d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
push 0
push ebx
call fcn.00403470
lea eax, [ebp - 0x230]
lea ebx, [edi + 0x9c]
push eax
mov ecx, ebx
call fcn.00458422
mov dword [ebp - 4], 3
mov ecx, esi
push 0xffffffffffffffff
push 0
push eax
call fcn.00446f52
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
push 0
push 1
call fcn.00403470
cmp dword [edi + 0xb8], 0
je 0x461799
push ecx
lea ecx, [ebp - 0x300]
call fcn.00446caa
mov dword [ebp - 4], 5
push ecx
push ecx
push esi
lea ecx, [ebp - 0x300]
call fcn.00446c53
xor ebx, ebx
lea ecx, [ebp - 0x300]
push ebx
push dword [edi + 0xb8]
push dword [edi + 0xb4]
call fcn.00446d42
lea ecx, [ebp - 0x300]
call fcn.00446ba2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x298]
call fcn.00446bd4
lea ecx, [ebp - 0x298]
call fcn.0040d35d
jmp 0x4617b9
cmp dword [esi + 0x14], 8
jb 0x4617a3
mov eax, dword [esi]
jmp 0x4617a5
mov eax, esi
cmp dword [ebx + 0x14], 8
jb 0x4617ad
mov ebx, dword [ebx]
push 0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
xor ebx, ebx
cmp dword [esi + 0x14], 8
jb 0x4617c1
mov esi, dword [esi]
mov ecx, dword [edi + 0xbc]
test ecx, ecx
jne 0x4617cf
mov ecx, ebx
jmp 0x4617eb
mov eax, dword [ecx]
lea edx, [ebp - 0x244]
push edx
push esi
push esi
push ecx
call dword [eax + 0x38]
mov ecx, dword [ebp - 0x244]
xor edx, edx
test eax, eax
cmovs ecx, edx
mov dword [edi + 0xd0], ecx
push ecx
mov ecx, edi
call fcn.004619bb
mov eax, dword [edi + 0xc4]
lea edx, [ebp - 0x250]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
push ebx
push 0x989680
push dword [ebp - 0x24c]
push dword [ebp - 0x250]
call fcn.004a5ff0
imul eax, eax, 0x64
lea ecx, [ebp - 0x240]
push eax
call fcn.00408243
mov dword [ebp - 4], 6
mov esi, dword [edi + 0x48]
mov eax, dword [ebp - 0x234]
push ebx
lea ecx, [esi + 0xe0]
mov dword [esi + 0xdc], eax
mov eax, dword [ecx]
call dword [eax + 0xc]
mov ecx, dword [edi + 0x48]
mov eax, dword [esi + 0xdc]
push ebx
mov dword [ecx + 0xb4], eax
add ecx, 0xb8
mov eax, dword [ecx]
call dword [eax + 0xc]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x240]
call fcn.004058de
mov esi, dword [edi + 0x48]
cmp dword [esi + 0x144], ebx
je 0x46189b
push ebx
lea ecx, [esi + 0x138]
mov dword [esi + 0x144], ebx
call fcn.00404b35
mov ecx, dword [edi + 0x48]
mov eax, dword [esi + 0x144]
add ecx, 0xfc
cmp dword [ecx + 0xc], eax
je 0x4618b8
push ebx
mov dword [ecx + 0xc], eax
call fcn.00404b35
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x48]
call fcn.0048333b
ret
Function at 0x461c9a
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x4f91bc]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [0x4f9b8c]
cmp ecx, 0xffffffff
jne 0x461cf0
push esi
mov esi, 0x114
lea eax, [ebp - 0x118]
push esi
push 0
push eax
call fcn.004849f0
add esp, 0xc
mov dword [ebp - 0x118], esi
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov ecx, dword [ebp - 0x114]
mov dword [0x4f9b8c], ecx
pop esi
xor eax, eax
cmp ecx, 5
mov ecx, dword [ebp - 4]
sete al
xor ecx, ebp
call fcn.00482854
mov esp, ebp
pop ebp
ret

Function at 0x462136
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
xor edi, edi
mov dword [ebp - 8], ecx
push edi
lea eax, [ebp - 4]
mov esi, edx
push eax
push edi
push 0xf003f
push edi
push edi
push edi
push 0x4fe148
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x462182
push 4
lea eax, [ebp - 8]
push eax
push 4
push edi
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x462188
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], 4
push ebx
lea eax, [ebp - 4]
mov esi, edx
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push 0x4fe148
push SysReAllocString
mov edi, ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4621d9
lea eax, [ebp - 8]
push eax
push edi
push ebx
push ebx
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4659f8
Capabilities:
Find taskbar
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
xor esi, esi
lea eax, [ebp - 8]
push esi
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push 0x4fea60
push SysReAllocString
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x465ae3
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
push 0x4fec00
push esi
push esi
push str.Show_dialog
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0040a4dc
test al, al
jne 0x465a79
push esi
push 0x1a3
push 0x111
push esi
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
call fcn.00466940
cmp dword [eax], 0xffffffff
jne 0x465ad2
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov ecx, 0x3ff
and ax, cx
movzx ecx, ax
push 7
pop eax
cmp ax, cx
jne 0x465aa1
xor eax, eax
inc eax
jmp 0x465abc
push 0xc
pop eax
cmp ax, cx
jne 0x465aae
push 2
pop eax
jmp 0x465abc
push 0xa
pop esi
xor eax, eax
cmp si, cx
push 3
pop edx
cmove eax, edx
movzx esi, ax
call fcn.00466940
mov edx, str._Language_
mov ecx, esi
mov dword [eax], esi
call fcn.00462136
call fcn.00466940
mov ecx, dword [eax]
call fcn.004032c4
xor eax, eax
inc eax
jmp 0x465ae5
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x46624e
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x4fe57c]
push ebx
push esi
push edi
push ecx
push eax
push ecx
mov ecx, dword [0x4fe574]
push eax
call fcn.00462482
test al, al
jne 0x46626d
xor eax, eax
jmp 0x4662df
mov ecx, dword [0x4fe574]
push 0x6b
call fcn.0046271e
call fcn.00466868
mov ecx, dword [0x4fe574]
push dword [eax]
call fcn.004627c3
call fcn.004667ff
xor ecx, ecx
inc ecx
push 3
cmp dword [eax], 0
mov eax, dword [0x4fe574]
pop edx
cmovne ecx, edx
mov dword [eax + 0x14], ecx
call fcn.00466793
mov esi, dword [eax]
call fcn.004668d4
test esi, esi
setne bl
mov edi, dword [eax]
mov dl, bl
mov ecx, edi
call fcn.004469a6
mov dl, bl
mov ecx, edi
call fcn.00453cfd
push 5
push dword [0x4fe57c]
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
call fcn.0046631a
pop edi
pop esi
pop ebx
ret

Function at 0x466388
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
mov dword [0x4fecfc], 0x4fe580
call fcn.00453c2c
call fcn.00461c9a
test al, al
jne 0x4663c8
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
push dword [ebp + 8]
mov ecx, dword [0x4fe570]
call fcn.0042d202
push 5
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
inc eax
pop ecx
pop ebp
ret 4
Function at 0x46655a
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xca4
mov eax, dword [0x4f91bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x410
xor edi, edi
lea eax, [ebp - 0x418]
push edi
push eax
mov esi, ecx
call fcn.004849f0
add esp, 0xc
call fcn.00466940
mov ebx, 0x208
mov eax, dword [eax]
sub eax, edi
je 0x4665bd
sub eax, 1
je 0x4665b6
sub eax, 1
je 0x4665af
sub eax, 1
jne 0x4665d2
push str.http:__www.animatedwallpaper7.com_es_
jmp 0x4665c2
push str.http:__www.animatedwallpaper7.com_fr_
jmp 0x4665c2
push str.http:__www.animatedwallpaper7.com_de_
jmp 0x4665c2
push str.http:__www.animatedwallpaper7.com_
lea eax, [ebp - 0x418]
push ebx
push eax
call fcn.0048d046
add esp, 0xc
push esi
lea eax, [ebp - 0x418]
push ebx
push eax
call fcn.0048d0aa
push 0x410
lea eax, [ebp - 0x828]
push edi
push eax
call fcn.004849f0
add esp, 0x18
mov dword [ebp - 0xc44], edi
lea eax, [ebp - 0xc3c]
mov dword [ebp - 0xc40], ebx
push eax
push 0x20019
push edi
push str.http_shellopencommand
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x466629
xor eax, eax
jmp 0x466716
lea eax, [ebp - 0xc40]
push eax
lea eax, [ebp - 0x828]
push eax
lea eax, [ebp - 0xc44]
push eax
push edi
push edi
push dword [ebp - 0xc3c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0xc3c]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x466622
lea eax, [ebp - 0x828]
push str.__1_
push eax
call fcn.0048475e
pop ecx
pop ecx
test eax, eax
je 0x4666af
push 0x73
pop ecx
mov word [eax + 4], cx
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x828]
push eax
lea eax, [ebp - 0xc38]
push eax
call fcn.004669a9
lea eax, [ebp - 0xc38]
push eax
lea eax, [ebp - 0x828]
push ebx
push eax
call fcn.0048d046
add esp, 0x18
jmp 0x4666cb
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x828]
push eax
push str._s__s
push eax
call fcn.004669a9
add esp, 0x10
push 0x44
pop esi
push esi
lea eax, [ebp - 0xca0]
push edi
push eax
call fcn.004849f0
push 0x10
lea eax, [ebp - 0xc54]
push edi
push eax
call fcn.004849f0
add esp, 0x18
mov dword [ebp - 0xca0], esi
lea eax, [ebp - 0xc54]
push eax
lea eax, [ebp - 0xca0]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x828]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00482854
mov esp, ebp
pop ebp
ret
Function at 0x468cc0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b99e9
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x4f91bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea esi, [edi + 0x30]
mov dword [ebp - 0x14], esi
push 0
mov dword [ebp - 4], 0xffffffff
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004691e0
mov dword [ebp - 4], 0xffffffff
mov dword [esi], eax
mov eax, dword [ebp + 8]
xorps xmm1, xmm1
mov dword [ebp - 4], 7
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0x3f800000
movq xmm0, qword [eax]
movq qword [edi], xmm0
movaps xmm0, xmm1
mov eax, dword [eax + 8]
mov dword [edi + 8], eax
unpcklps xmm0, xmm1
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
movq qword [edi + 0xc], xmm0
mov dword [edi + 0x14], eax
unpcklps xmm1, xmm1
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
movq qword [edi + 0x18], xmm1
mov dword [edi + 0x20], eax
mov eax, edi
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x469eb0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x4d0ccc
movzx eax, cx
mov esi, edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x469eee
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x469ef1
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
jmp 0x469ef3
mov ebx, dword [ebp - 4]
xor eax, eax
push dword [ebp + 0x10]
mov edx, ebx
push dword [ebp + 0xc]
push ecx
mov ecx, eax
call fcn.00469f10
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4790d0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
call fcn.0046dec0
mov cl, byte [0x4f9b62]
mov ebx, eax
test cl, cl
je 0x4790f7
push 0x4fe3f0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov cl, byte [0x4f9b62]
mov ebx, dword [ebx + 0x17c]
test cl, cl
je 0x47910c
push 0x4fe3f0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebx, ebx
je 0x479175
call fcn.0046dec0
mov cl, byte [0x4f9b62]
mov ebx, eax
test cl, cl
je 0x479132
push 0x4fe3f0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov cl, byte [0x4f9b62]
mov bl, byte [ebx + 0x366]
test cl, cl
je 0x479147
push 0x4fe3f0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test bl, bl
jne 0x479175
call fcn.0046e040
push 0
lea edx, [ebp - 4]
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
push dword [ebp - 4]
call fcn.00478b10
add esp, 4
push 5
call fcn.0046e080
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x47a980
Capabilities:
Check if file exists
Query environment variable

Disassembly:
push ebx
push esi
push edi
call fcn.0046e080
test eax, eax
je 0x47a999
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
call fcn.0046dec0
mov cl, byte [0x4f9b62]
mov esi, eax
mov edi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test cl, cl
je 0x47a9bd
push 0x4fe3f0
call edi
mov cl, byte [0x4f9b62]
mov dword [esi + 0x308], 0
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test cl, cl
je 0x47a9d8
push 0x4fe3f0
call esi
mov cl, 1
call fcn.004795e0
mov cl, 1
call fcn.00477e10
call fcn.0046dec0
mov cl, byte [0x4f9b62]
mov ebx, eax
test cl, cl
je 0x47aa04
push 0x4fe3f0
call edi
mov cl, byte [0x4f9b62]
mov ebx, dword [ebx]
test cl, cl
je 0x47aa11
push 0x4fe3f0
call esi
test ebx, ebx
je 0x47aa1b
mov eax, dword [ebx]
push ebx
call dword [eax + 8]
call fcn.0046dec0
mov cl, byte [0x4f9b62]
mov ebx, eax
test cl, cl
je 0x47aa39
push 0x4fe3f0
call edi
mov cl, byte [0x4f9b62]
mov dword [ebx], 0
test cl, cl
je 0x47aa4a
push 0x4fe3f0
call esi
call fcn.0046dec0
mov cl, byte [0x4f9b62]
mov ebx, eax
test cl, cl
je 0x47aa68
push 0x4fe3f0
call edi
mov cl, byte [0x4f9b62]
mov ebx, dword [ebx + 0x164]
test cl, cl
je 0x47aa79
push 0x4fe3f0
call esi
test ebx, ebx
je 0x47aa83
mov eax, dword [ebx]
push ebx
call dword [eax + 8]
call fcn.0046dec0
mov cl, byte [0x4f9b62]
mov ebx, eax
test cl, cl
je 0x47aaa1
push 0x4fe3f0
call edi
mov cl, byte [0x4f9b62]
mov dword [ebx + 0x164], 0
test cl, cl
je 0x47aab6
push 0x4fe3f0
call esi
call fcn.0046dec0
mov cl, byte [0x4f9b62]
mov ebx, eax
test cl, cl
je 0x47aad4
push 0x4fe3f0
call edi
mov cl, byte [0x4f9b62]
mov bl, byte [ebx + 0x364]
test cl, cl
je 0x47aae5
push 0x4fe3f0
call esi
test bl, bl
je 0x47aaf1
pop edi
pop esi
pop ebx
jmp fcn.0047be00
pop edi
pop esi
pop ebx
ret
Function at 0x47be00
Capabilities:
Check if file exists
Create process on windows
Get file attributes
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4f91bc]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
push str._SystemRoot_ehomeehshell.exe
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x47be3e
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00482854
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x47be2e
push 1
push 0
push 0
lea eax, [ebp - 0x20c]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
cmp eax, 0x20
setg al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00482854
mov esp, ebp
pop ebp
ret

Function at 0x47c2f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bb54c
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4f91bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 0
mov byte [ebp - 4], 3
mov byte [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 1
mov dword [esi + 0x3c], 0x280
mov dword [esi + 0x44], 0x1e0
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x48], 0xffffffff
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0xffffffff
mov dword [esi + 0x54], 0xffff
call fcn.0047d730
mov ecx, esi
call fcn.0047d800
mov ecx, esi
call fcn.0047da20
mov dword [esi + 0x38], 0x10101
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x497fbb
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00497e3a

Function at 0x49eb73
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0049e833
Function at 0x406274
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x406299
mov eax, dword [0x40a8a8]
cmp eax, 0xffffffff
je 0x406290
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0x40a8a8], 0xffffffff
jmp 0x40630c
cmp dword [0x424a60], ebx
je 0x40630c
cmp byte [0x424660], bl
je 0x4062d8
cmp dword [0x40a8a8], 0xffffffff
jne 0x4062e1
push 4
push 0x40000000
push 0x424660
call fcn.00405c50
cmp eax, 0xffffffff
mov dword [0x40a8a8], eax
je 0x40630c
push 2
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [0x40a8a8], 0xffffffff
je 0x40630c
push esi
mov esi, 0x425280
push 0x40aaf0
push esi
call sub.KERNEL32.dll_lstrcatA
lea eax, [ebp + 8]
push ebx
push eax
push esi
call sub.KERNEL32.dll_lstrlenA
push eax
push esi
push dword [0x40a8a8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
pop ebx
pop ebp
ret 4

Function at 0x4064b4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42425c], 0
push esi
jne 0x4064eb
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4064c5
mov dword [ecx*4 + 0x424258], eax
inc ecx
cmp ecx, 0x100
jl 0x4064c0
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x40651c
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x424258]
xor eax, esi
inc ecx
dec edx
jne 0x4064fe
pop edi
not eax
pop esi
ret 0xc

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403e6a
sub eax, 0x403e10
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x431030
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x4029ad
Capabilities:
Extract resource via kernel32 functions
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x8c
push ebx
push esi
push edi
lea eax, [esp + 0x58]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_BeginPaint]
mov esi, eax
lea eax, [esp + 0x48]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetClientRect]
push 6
lea eax, [esp + 0x4c]
push eax
push esi
call dword [sym.imp.USER32.dll_FillRect]
push 4
lea eax, [esp + 0x28]
push eax
push 0x404158
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
cmp byte [esp + 0x24], 0x33
jne 0x402b40
push esi
lea esi, [esp + 0x30]
call fcn.00402652
push 0x40415c
push 0x6a
push dword [0x403294]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push dword [0x403294]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [0x403294]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, eax
lea eax, [esp + 0x38]
call fcn.0040326c
push eax
call fcn.00402623
mov esi, eax
call fcn.004024e3
mov dword [esp + 0x18], eax
call fcn.004024c2
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ecx, dword [esp + 0x1c]
imul ecx, dword [esp + 0x18]
shl ecx, 2
push ecx
xor edi, edi
push edi
push eax
mov dword [esp + 0x34], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
and dword [esp + 0x14], edi
mov ebx, eax
mov dword [esp + 0x20], 0xff000000
cmp dword [esp + 0x1c], edi
jbe 0x402b01
and dword [esp + 0x10], 0
cmp dword [esp + 0x18], 0
jbe 0x402af3
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x18]
push dword [esp + 0x18]
call fcn.0040248a
mov eax, dword [esp + 0x20]
mov ecx, eax
shr ecx, 0x18
mov byte [edi + ebx], cl
mov ecx, eax
shr ecx, 0x10
mov byte [edi + ebx + 1], cl
mov ecx, eax
shr ecx, 8
mov byte [edi + ebx + 2], cl
mov byte [edi + ebx + 3], al
add edi, 4
inc dword [esp + 0x10]
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + 0x18]
jb 0x402aae
inc dword [esp + 0x14]
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x1c]
jb 0x402aa2
push ebx
call fcn.0040281c
push ebx
push 0
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_HeapFree]
lea eax, [esp + 0x34]
call fcn.00403265
mov eax, esi
lea esi, [esp + 0x2c]
call fcn.00402442
push dword [esp + 0x2c]
call dword [sym.imp.gdiplus.dll_GdipDeleteGraphics]
lea eax, [esp + 0x58]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_EndPaint]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219