joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44dcc4
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x44dcdb
add esp, 0xfffffff0
call fcn.00403554
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041cf78
mov eax, dword [0x452fdc]
cmp word [eax + 2], 0
jne 0x44dd03
mov eax, dword [0x452fdc]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0044f39c
mov eax, dword [0x45308c]
cmp word [eax + 2], 0
jne 0x44dd1d
mov eax, dword [0x45308c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0044f594
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x415270]
call fcn.00403218
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x415270]
call fcn.00403218
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41f14c]
call fcn.00424d94
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x44dea4
mov eax, dword [0x452f00]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00425164
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x44fb34
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x452f00]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040c384
test eax, eax
je 0x44de12
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.004086f4
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040c3ac
test eax, eax
je 0x44de26
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.004041f0
mov eax, dword [0x452e00]
cmp byte [eax], 0
jne 0x44de5a
mov eax, ebx
call fcn.0044dfcc
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.0044fd10
mov eax, ebx
call fcn.004506d4
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x44de9a
call fcn.004035ac
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44e24c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x454bb0]
cmp dword [eax + 0x30], 0
je 0x44e2f6
cmp dword [ebx + 0x94], 0
jne 0x44e2f0
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x44e1dc
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x44e2f0
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x44e2b6
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x44e2f0
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.004175d8
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x44e2c5
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x44ee58
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x44ee8d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404070
jmp 0x44ee9a
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00403fd4
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x44feec
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x44ff2d
mov eax, esi
call fcn.004368b8
test al, al
je 0x44ff2d
mov eax, dword [ebx + 0x84]
call fcn.00436658
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x44ff2d
push 0
mov eax, dword [ebx + 0x84]
call fcn.00436658
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x450d18
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404430
lea esi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x450e7b
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 2
call fcn.00450a20
mov ebx, eax
mov dword [esi], 0x128
mov edx, esi
mov eax, ebx
call fcn.00450a40
jmp 0x450e4d
lea eax, [ebp - 0x138]
lea edx, [esi + 0x24]
mov ecx, 0x104
call fcn.004041f0
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.004085b8
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00407c80
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.00407c80
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.0040438c
je 0x450e2f
lea eax, [ebp - 0x144]
lea edx, [esi + 0x24]
mov ecx, 0x104
call fcn.004041f0
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00407c80
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.00407c80
mov edx, dword [ebp - 0x148]
pop eax
call fcn.0040438c
jne 0x450e44
push 0
mov eax, dword [esi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edx, esi
mov eax, ebx
call fcn.00450a60
test eax, eax
jne 0x450d90
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x450e82
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.00403fa4
lea eax, [ebp - 4]
call fcn.00403f80
ret
Function at 0x451030
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x5b
push 0
push 0
dec ecx
jne 0x451038
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404430
lea eax, [ebp - 0x29c]
mov edx, dword [0x407000]
call fcn.004048ec
xor eax, eax
push ebp
push 0x45122d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x451244
call fcn.00404248
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0x2a0]
mov ecx, 0x451250
mov edx, dword [ebp - 4]
call fcn.0040428c
mov eax, dword [ebp - 0x2a0]
call fcn.00404440
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov ebx, eax
lea eax, [ebp - 0x2b0]
mov edx, ebx
mov cl, 4
call fcn.00412d78
lea eax, [ebp - 0x2b0]
push eax
lea eax, [ebp - 0x2c0]
call fcn.00414128
lea edx, [ebp - 0x2c0]
pop eax
call fcn.00414130
je 0x4511bc
jmp 0x4511a1
mov eax, dword [ebp - 0x144]
sub eax, 0x10
jne 0x45116c
lea edx, [ebp - 0x2c4]
lea eax, [ebp - 0x118]
call fcn.004088a4
mov eax, dword [ebp - 0x2c4]
mov edx, 0x45125c
call fcn.0040438c
je 0x4511a1
lea edx, [ebp - 0x2c8]
lea eax, [ebp - 0x118]
call fcn.004088a4
mov eax, dword [ebp - 0x2c8]
mov edx, 0x451268
call fcn.0040438c
je 0x4511a1
lea eax, [ebp - 0x2d0]
lea edx, [ebp - 0x118]
mov ecx, 0x104
call fcn.004041f0
mov ecx, dword [ebp - 0x2d0]
lea eax, [ebp - 0x2cc]
mov edx, dword [ebp - 4]
call fcn.0040428c
mov eax, dword [ebp - 0x2cc]
call fcn.00451030
jmp 0x4511a1
lea eax, [ebp - 0x2d8]
lea edx, [ebp - 0x118]
mov ecx, 0x104
call fcn.004041f0
mov ecx, dword [ebp - 0x2d8]
lea eax, [ebp - 0x2d4]
mov edx, dword [ebp - 4]
call fcn.0040428c
mov eax, dword [ebp - 0x2d4]
call fcn.00408520
lea eax, [ebp - 0x144]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x4510dc
mov dword [ebp - 0x288], ebx
lea eax, [ebp - 0x29c]
call fcn.00408504
mov eax, dword [ebp - 4]
call fcn.004086a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x451234
lea eax, [ebp - 0x2d8]
mov edx, 6
call fcn.00403fa4
lea eax, [ebp - 0x2c0]
mov edx, dword [0x4010a0]
mov ecx, 2
call fcn.004049fc
lea eax, [ebp - 0x2a0]
call fcn.00403f80
lea eax, [ebp - 0x29c]
mov edx, dword [0x407000]
call fcn.004049b0
lea eax, [ebp - 4]
call fcn.00403f80
ret
Function at 0x409450
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x4131b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [ebp - 0x108], ecx
lea eax, [ecx - 1]
cmp eax, 0xa
ja 0x40947d
mov edx, dword [ecx*4 + 0x412f78]
lea eax, [ebp - 0x108]
mov eax, dword [eax - 4]
test eax, eax
je 0x4094bb
push esi
mov esi, 0xc483
cmp si, word [eax]
pop esi
jne 0x4094bb
cmp byte [eax + 2], 0xc
jl 0x4094bb
push dword [ebp + 0x10]
lea eax, [ebp - 0x104]
push dword [ebp + 0xc]
push edx
push ecx
push 0x40d3e4
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
jmp 0x4094d2
push edx
push ecx
lea eax, [ebp - 0x104]
push str.program_internal_error_number_is__d.__r_n_s_r_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov eax, dword [0x413248]
test eax, eax
je 0x40950b
cmp dword [0x41325c], 0
jne 0x40950b
lea ecx, [ebp - 0x104]
mov dword [0x41325c], 1
push ecx
push dword [ebp - 0x108]
call eax
mov dword [0x41325c], 0
test eax, eax
jne 0x409521
push 0x10
push str.error
lea eax, [ebp - 0x104]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
call fcn.004090c0
cmp dword [0x413240], 0
jne 0x409537
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, 0
mov ebp, dword [0x413244]
mov esp, dword [0x413240]
sub esp, 4
ret
Function at 0x408937
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x4085d8
add ebx, 0x7c5b9798
dec ebx
call fcn.00408967
xor dword [eax], edi
inc eax
mov ebx, ecx
inc ecx
cmp eax, edx
jne fcn.00408937
push 0x2823caf8
pop ebx
add ecx, 0xabd2cac5
ret
Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d

Function at 0x404d5d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x404d6c
pop dword [ebp - 0x1c]
mov eax, 0x3c5cd532
sub eax, 0x3c1c87c6
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x2d438e5a
sub dword [ebp - 0x2c], 0xdef1490f
mov dword [ebp - 0x28], 0xc0cf48a1
add dword [ebp - 0x28], 0x716403a4
mov dword [ebp - 0x24], 0x569463d4
sub dword [ebp - 0x24], 0xa481fa6
mov dword [ebp - 0x20], 0xf0b8d975
sub dword [ebp - 0x20], 0xf0b8d975
lea eax, [ebp - 0x2c]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x84396a37
sub dword [ebp - 0x2c], 0xfc700e1
mov dword [ebp - 0x28], 0xdbd5e3c4
sub dword [ebp - 0x28], 0x9a69824f
mov dword [ebp - 0x24], 0x90e50b06
sub dword [ebp - 0x24], 0x2d759e9a
mov dword [ebp - 0x20], 0x16e4715
sub dword [ebp - 0x20], 0x16e4715
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0x508537ec
sub eax, 0x504467a4
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x3e2a7
push 0
call eax
mov ecx, 0x5adc
xor edi, edi
add edi, eax
mov ebx, 0xcccc3c44
add ebx, 0x337573bc
add ebx, dword [ebp - 0x1c]
mov esi, 0x32d8ac47
sub esi, 0xa9e96e84
mov dword [ebp - 0xc], 0x977d9e34
mov edx, dword [ebx]
xor dword [ebp - 0x14], 0xef572629
add edx, esi
add dword [ebp - 0xc], edi
mov dword [edi], edx
add dword [ebp - 0xc], 0xf9806416
add edi, 4
add ebx, 0x731b3220
sub ebx, 0x731b321c
loop 0x404e85
add eax, 0x6d66b5e4
sub eax, 0x6d6557a1
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x40a15c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov word [ebp + 0xc], ax
mov ebx, 0x19826993
mov eax, ebx
mul ebx
mov dword [ebp - 0x10], eax
mov ebx, eax
xor esi, esi
mov eax, ebx
mul ebx
mov dword [ebp - 0x14], eax
mov ebx, eax
mov word [ebp - 0xc], 0
jmp 0x40a272
mov eax, ebx
xor eax, ebx
mov ebx, eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call fcn.00405066
pop ecx
mov edx, eax
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
jne 0x40a1b3
mov byte [ebp - 2], 0
jmp 0x40a1dd
call fcn.0040ddd8
mov dword [ebp - 0x18], eax
mov eax, 0x7fff
mov edi, 7
movzx edx, byte [ebp - 1]
mov ecx, edi
sub ecx, edx
cdq
idiv ecx
mov ecx, eax
mov eax, dword [ebp - 0x18]
cdq
idiv ecx
mov edx, eax
mov byte [ebp - 2], dl
mov eax, dword [ebp + 8]
mov al, byte [esi + eax]
cmp al, 0x70
jb 0x40a1fc
cmp al, 0x7f
ja 0x40a1fc
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, dword [ebp + 8]
movzx eax, byte [esi + eax]
cmp eax, 0xe2
jne 0x40a21b
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 8
push 0x90
lea eax, [ebp - 0xa]
push eax
call fcn.0040ddc0
movzx eax, byte [ebp - 1]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
lea eax, [ebp - 0xa]
movzx edx, byte [ebp - 2]
add eax, edx
push eax
call fcn.0040ddb4
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 6
lea eax, [ebp - 0xa]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call fcn.0040ddb4
add esp, 0x24
mov eax, ebx
add eax, ebx
mov ebx, eax
add esi, 6
inc word [ebp - 0xc]
movzx eax, word [ebp + 0xc]
dec eax
cmp esi, eax
jb 0x40a190
pop edi
pop esi
pop ebx
leave
ret

Function at 0x408911
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x4085d8
call fcn.0040893a
mov ebx, eax
xor dword [edi], edx
mov eax, 0xdaa46d5b
inc ebx
inc edi
dec eax
cmp edi, ecx
jne fcn.00408911
or eax, ebx
sub eax, 0xdd1c5314
ret
Function at 0x40279c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x40c02c], 0x8088405
inc edx
mov dword [0x40c02c], edx
mul edx
mov eax, edx
ret

Function at 0x4042e8
Capabilities:
Encode data using xor

Disassembly:
push 0x10b3dac
mov ecx, 0x84d3d2c
pop eax
xor ecx, eax
mov edi, 0x10080004
mov esi, 0x10
xor edi, esi
xor ecx, edi
push 0x77c37729
mov edx, 0x75c37d23
pop edi
xor edx, edi
mov edi, 0x483720a2
mov esi, 0x68a7a482
xor esi, edi
xor edx, esi
mov esi, esi
jmp 0x403f30

Function at 0x40520c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405245
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403278
jmp 0x40524e
mov eax, ebx
mov edx, esi
call fcn.0040322c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x405258
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405279
mov al, byte [esp]
jmp 0x40527b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4069dc
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x406a24
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00406978
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406a2b
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x406c2c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x406cba
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x406c77
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [ebp - 0x108]
mov eax, esi
call fcn.00403278
jmp 0x406ca4
call sub.kernel32.dll_GetCommandLineA_1
cmp byte [eax], 0
jne 0x406c8b
lea eax, [ebp - 4]
call fcn.00403198
jmp 0x406c9a
lea edx, [ebp - 4]
call fcn.00406af0
test ebx, ebx
je 0x406c9a
dec ebx
jmp 0x406c7c
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.0040322c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406cc1
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x406cc8
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
mov eax, esp
call fcn.00404de0
add esp, 0x104
pop ebx
ret
Function at 0x4063f0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x42d98b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
lea ecx, [esi + 4]
mov dword [esi], 0x4042f4
call fcn.004075db
push 4
mov dword [esp + 0x18], 0
call fcn.004085c8
mov edi, eax
add esp, 4
test edi, edi
je 0x406464
push ebx
call fcn.004073d6
mov dword [edi], eax
call fcn.00407195
push 0
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.0040759c
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x406458
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0xc]
call fcn.004075c4
pop ebx
jmp 0x406466
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x40919b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x430354]
jne 0x4091a5
repz ret
jmp fcn.0040d42c
Function at 0x411742
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x430354]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040b99f
and dword [ebp - 0x14], 0
cmp dword [0x435aa0], 0
mov dword [ebp - 0x18], eax
jne 0x4117f5
push 0x403e68
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41189d
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403e5c
push ebx
call edi
test eax, eax
je 0x41189d
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403e4c
push ebx
mov dword [0x435aa0], eax
call edi
push eax
call esi
push 0x403e38
push ebx
mov dword [0x435aa4], eax
call edi
push eax
call esi
push 0x403e1c
push ebx
mov dword [0x435aa8], eax
call edi
push eax
call esi
mov dword [0x435ab0], eax
test eax, eax
je 0x4117f5
push 0x403e04
push ebx
call edi
push eax
call esi
mov dword [0x435aac], eax
mov eax, dword [0x435aac]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41184e
cmp dword [0x435ab0], ecx
je 0x41184e
push eax
call esi
push dword [0x435ab0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41184e
test ebx, ebx
je 0x41184e
call edi
test eax, eax
je 0x411845
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x411845
test byte [ebp - 8], 1
jne 0x41184e
or dword [ebp + 0x10], 0x200000
jmp 0x411881
mov eax, dword [0x435aa4]
cmp eax, dword [ebp - 0x18]
je 0x411881
push eax
call esi
test eax, eax
je 0x411881
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x411881
mov eax, dword [0x435aa8]
cmp eax, dword [ebp - 0x18]
je 0x411881
push eax
call esi
test eax, eax
je 0x411881
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x435aa0]
call esi
test eax, eax
je 0x41189d
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41189f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040919b
leave
ret
Function at 0x428660
Capabilities:
Accept command line arguments
Manipulate console buffer
Move file

Disassembly:
mov eax, dword [0x7b9804]
sub esp, 0x97c
push ebx
push ebp
push esi
shr eax, 3
xor ebx, ebx
push edi
mov edi, dword [0x7b976c]
cmp eax, ebx
jbe 0x42885e
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], eax
jmp 0x428696
mov edi, dword [esp + 0x1c]
xor ebx, ebx
cmp dword [0x7b9804], 0x1c
jne 0x4286ad
lea eax, [esp + 0x40]
push eax
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
mov ecx, dword [edi + 4]
mov edx, dword [0x4312d0]
mov eax, dword [0x4312d4]
mov esi, dword [edi]
mov dword [esp + 0x14], ecx
mov ecx, dword [0x4312d8]
mov dword [esp + 0x28], edx
mov edx, dword [0x4312dc]
mov edi, 0xc6ef3720
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x2c], edx
mov ebp, 0x20
jmp 0x4286f2
xor ebx, ebx
mov ecx, esi
shl ecx, 4
add ecx, dword [esp + 0x30]
mov eax, esi
shr eax, 5
add eax, dword [esp + 0x2c]
lea edx, [edi + esi]
xor ecx, edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], ecx
mov dword [0x7b9770], ebx
mov eax, dword [esp + 0x18]
add dword [0x7b9770], eax
mov eax, dword [0x7b9770]
mov dword [esp + 0x24], eax
mov dword [esp + 0x18], ebx
mov eax, dword [esp + 0x24]
add dword [esp + 0x18], eax
mov eax, dword [esp + 0x10]
xor eax, dword [esp + 0x18]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x18]
sub dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov ecx, eax
shl ecx, 4
add ecx, dword [esp + 0x28]
cmp dword [0x7b9804], 0x1be
mov dword [esp + 0x10], ecx
lea ebx, [edi + eax]
jne 0x4287c7
push 0
lea edx, [esp + 0x18c]
push edx
push 0
push 0x403f08
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
lea eax, [esp + 0x44]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
xor eax, eax
lea ecx, [esp + 0x38]
push ecx
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
call dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
shr eax, 5
add eax, dword [esp + 0x34]
xor ecx, ebx
mov dword [0x7b9778], 0xff6b3619
mov dword [0x7b977c], 0xffffffff
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x18]
xor dword [esp + 0x10], eax
sub esi, dword [esp + 0x10]
add edi, 0x61c88647
dec ebp
jne 0x4286f0
cmp dword [0x7b9804], 0x8d4
jne 0x428817
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
mov dword [edi], esi
mov dword [edi + 4], edx
cmp dword [0x7b9804], 0x17
jne 0x42884d
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
lea eax, [esp + 0x48]
push eax
push 0x403f68
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
add edi, 8
dec dword [esp + 0x20]
mov dword [esp + 0x1c], edi
jne 0x428690
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x97c
ret