joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49c800
Capabilities:
Write file on windows

Disassembly:
mov edx, ecx
push ebx
push esi
push edi
mov ebx, dword [edx + 0x18]
test ebx, ebx
je 0x49c850
mov edi, dword [edx + 0x1c]
mov eax, dword [esp + 0x14]
mov esi, dword [edx + 0x20]
lea ecx, [edi + eax]
cmp ecx, esi
jb 0x49c82c
pop edi
pop esi
mov dword [edx + 0xc], 0x30000
xor eax, eax
pop ebx
ret 8
mov esi, dword [esp + 0x10]
mov ecx, eax
add edi, ebx
mov ebx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [edx + 0x1c]
pop edi
add ecx, eax
pop esi
mov dword [edx + 0x1c], ecx
pop ebx
ret 8
mov eax, dword [edx]
test eax, eax
je 0x49c878
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x14]
push 0
push edx
mov edx, dword [esp + 0x18]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
ret 8
pop edi
pop esi
mov dword [edx + 0xc], 0x1000000
xor eax, eax
pop ebx
ret 8

Function at 0x49cca0
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, ecx
push ebp
push esi
mov edx, dword [ebx + 0x58]
test edx, edx
je 0x49cd0a
mov eax, dword [ebx + 0x60]
mov ebp, dword [ebx + 0x5c]
cmp eax, ebp
jae 0x49cd5b
mov ecx, dword [esp + 0x14]
sub ebp, eax
cmp ebp, ecx
jbe 0x49ccc6
mov ebp, ecx
mov ecx, ebp
lea esi, [eax + edx]
mov eax, dword [esp + 0x10]
mov edx, ecx
push edi
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebp
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov edx, dword [ebx + 0x60]
mov ecx, dword [ebx + 0x48]
mov eax, dword [ebx + 0x4c]
add edx, ebp
add ecx, ebp
push eax
mov dword [ebx + 0x60], edx
mov dword [ebx + 0x48], ecx
call fcn.0049c130
add esp, 0xc
mov dword [ebx + 0x4c], eax
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
ret 8
mov eax, dword [ebx + 0x50]
test eax, eax
je 0x49cd54
mov edx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push 0
push ecx
push edx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x49cd5b
mov eax, dword [esp + 0x14]
mov ecx, dword [ebx + 0x48]
add ecx, eax
push eax
mov eax, dword [ebx + 0x4c]
push esi
push eax
mov dword [ebx + 0x48], ecx
call fcn.0049c130
add esp, 0xc
mov dword [ebx + 0x4c], eax
mov eax, dword [esp + 0x14]
pop esi
pop ebp
pop ebx
ret 8
mov dword [ebx + 0xc], 0x1000000
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8
Function at 0x49f950
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x49f95b
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x49fa5e
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x584154]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x584154]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x584154]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x584154]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x584154]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x584154]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x584154]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x584154]
xor eax, edx
inc ecx
dec edi
jne 0x49f976
pop edi
test esi, esi
je 0x49fa80
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x584154]
xor eax, edx
inc ecx
dec esi
jne 0x49fa62
pop esi
pop ebx
not eax
ret

Function at 0x4a0420
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x10]
mov cl, byte [ebx]
mov eax, ebp
imul eax, dword [esp + 0x14]
test cl, cl
je 0x4a0461
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0xc]
push 0
push ecx
push eax
mov eax, dword [ebx + 4]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4a0456
mov byte [ebx + 8], 1
mov eax, dword [esp + 0xc]
xor edx, edx
div ebp
pop ebp
pop ebx
ret
mov edx, dword [ebx + 0x18]
mov ecx, dword [ebx + 0x14]
push esi
push edi
lea esi, [edx + eax]
cmp esi, ecx
jbe 0x4a0474
sub ecx, edx
mov eax, ecx
mov esi, dword [ebx + 0x10]
mov edi, dword [esp + 0x14]
mov ecx, eax
add esi, edx
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
xor edx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0x18]
pop edi
add ecx, eax
pop esi
div ebp
mov dword [ebx + 0x18], ecx
pop ebp
pop ebx
ret
Function at 0x4a13b0
Capabilities:
Get common file path

Disassembly:
push ecx
push ebp
mov ebp, ecx
push esi
push edi
cmp dword [ebp], 0
jne 0x4a1465
cmp dword [ebp + 4], 0xffffffff
jne 0x4a1465
push ebx
lea ebx, [ebp + 0x138]
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov edi, 0x5a6b00
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
pop ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x14]
cmp esi, 1
jne 0x4a142d
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x4a142d
pop edi
pop esi
mov eax, 0x2000000
pop ebp
pop ecx
ret 0xc
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0xc]
push eax
push esi
push ecx
push edi
call fcn.004a01b0
add esp, 0x10
test eax, eax
jne 0x4a1450
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebp
pop ecx
ret 0xc
push eax
call fcn.004a06f0
add esp, 4
mov dword [ebp], eax
xor eax, eax
pop edi
pop esi
pop ebp
pop ecx
ret 0xc
pop edi
pop esi
mov eax, 0x1000000
pop ebp
pop ecx
ret 0xc

Function at 0x4a18c0
Capabilities:
Create directory

Disassembly:
mov ecx, dword [esp + 8]
sub esp, 0x208
test ecx, ecx
je 0x4a1988
mov al, byte [ecx]
test al, al
je 0x4a1988
push ebx
push esi
push edi
mov ebx, ecx
mov esi, ecx
cmp al, 0x2f
je 0x4a18eb
cmp al, 0x5c
jne 0x4a18ed
mov ebx, esi
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x4a18e3
mov edi, dword [esp + 0x218]
cmp ebx, ecx
je 0x4a1924
mov esi, ebx
lea eax, [esp + 0xc]
sub esi, ecx
push esi
push ecx
push eax
call fcn.004bd8a0
lea ecx, [esp + 0x18]
mov byte [esp + esi + 0x18], 0
push ecx
push edi
call fcn.004a18c0
add esp, 0x14
inc ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x110]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x110]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x114]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
pop edi
pop esi
pop ebx
add esp, 0x208
ret
Function at 0x4a3c50
Capabilities:
Reference the vmware io port

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x584980
push 0x4bd944
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov byte [ebp - 0x1c], 1
mov dword [ebp - 4], 0
push edx
push ecx
push ebx
mov eax, 0x564d5868
mov ebx, 0
mov ecx, 0xa
mov edx, 0x5658
in eax, dx
cmp ebx, 0x564d5868
sete byte [ebp - 0x1c]
pop ebx
pop ecx
pop edx
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a4090
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x4a40f6
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x4a40f6
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x4a40d7
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x4a4870
Capabilities:
Create http request

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x4a48a8
mov edx, dword [esi + 4]
xor eax, eax
push 0
push 0
mov ecx, dword [edx - 8]
test ecx, ecx
setne al
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, edx
neg eax
sbb eax, eax
push ecx
and eax, 2
inc eax
push eax
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.0_
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi], eax
mov ecx, dword [esi]
xor eax, eax
test ecx, ecx
setne al
pop esi
ret
Function at 0x4a4f40
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x4a4f89
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x4a5400
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4de9a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.004a4fb0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.004a5030
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.004a5030
lea ecx, [esi + 0xc]
call fcn.004cce68
lea ecx, [esi + 0x10]
call fcn.004cce68
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.004a65c0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.004a65c0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.004a65c0
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.004ccedd
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.004ccedd
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4a7970
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x5a8b0c]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x4a7983
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x4a79c4
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x5a8bb4]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x4a79f6
mov bl, byte [esp + ecx + 0x4c]
jmp 0x4a79fa
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x4a79eb
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x4a7a18
mov bl, byte [esp + ecx + 0x4c]
jmp 0x4a7a1c
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x4a7a0d
xor ecx, ecx
mov eax, 0x5a8b1c
xor ebx, ebx
mov bl, byte [ecx + 0x5a8bc4]
cmp byte [esp + ebx + 0x14], 0
je 0x4a7a47
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x5a8bdc]
cmp byte [esp + ebx + 0x14], 0
je 0x4a7a5e
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x4a7a2e
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x4a79b7
lea edx, [esp + 0x84]
push edx
call fcn.004a7aa0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x4bd1cd
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4bd1ed
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004bf99a
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x4bd210
test byte [esp + 8], 2
je 0x4bd210
call fcn.004bfa0d
mov dword [eax], 0xd
call fcn.004bfa16
mov dword [eax], 5
jmp 0x4bd1e9
xor eax, eax
ret

Function at 0x4cf344
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4cf37c
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004cd384
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004cd35c
jmp 0x4cf388
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4d0a3e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4d0a80
call fcn.004d693f
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4d0a80
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4d0a77
xor eax, eax
jmp 0x4d0a88
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004d0a8e
pop edi
pop esi
pop ebx
ret 4

Function at 0x4d6e53
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4d6e81
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4d6e9f
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004d6db9
jmp 0x4d6e9f
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4d6e9f
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004d6db9
test edi, edi
mov eax, edi
jne 0x4d6e89
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x401460
Capabilities:
Terminate process

Disassembly:
sub esp, 0x2c0
push ebp
push esi
xor ebp, ebp
push str.imjp81k.dll
mov dword [esp + 0xc], ebp
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
cmp esi, ebp
mov dword [esp + 0xc], esi
je 0x40149a
push str.CreateIFEDictionary2Instance
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebp
je 0x40149a
lea ecx, [esp + 8]
push ecx
call eax
mov ecx, dword [esp + 8]
cmp ecx, ebp
jne 0x4014b5
push str.Fatal_error._Could_not_acquire_dictionary_interface._n
call fcn.0040216c
add esp, 4
push ebp
call fcn.00401b19
mov edx, dword [esp + 0x2d4]
push ebx
mov eax, dword [edx + 4]
cmp eax, ebp
jne 0x4014c8
xor ebx, ebx
jmp 0x4014d0
mov ebx, dword [edx + 8]
sub ebx, eax
sar ebx, 2
cmp ebx, ebp
jle 0x4015cc
push edi
mov edi, dword [esp + 0x2d4]
jmp 0x4014e9
mov edx, dword [esp + 0x2dc]
mov edx, dword [edx + 4]
mov eax, dword [edx + ebp*4]
mov esi, dword [eax]
push esi
call fcn.004015f0
add esp, 4
test eax, eax
push esi
je 0x401513
lea ecx, [esp + 0x1c]
push 0x40a0c0
push ecx
call fcn.0040211a
add esp, 0xc
jmp 0x40152d
mov edx, dword [esp + 0x2dc]
lea eax, [esp + 0x1c]
push edx
push str._s_s
push eax
call fcn.0040211a
add esp, 0x10
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x11c]
push edx
lea edx, [esp + 0x1c]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0xc]
test eax, eax
je 0x401558
push esi
push str.Skipped___s__n
call fcn.0040216c
add esp, 8
jmp 0x4015ba
cmp edi, 0xffffffff
je 0x40158d
test edi, edi
je 0x401579
cmp edi, 1
jne 0x4015b0
mov eax, dword [esp + 0x10]
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x68]
push esi
push str.Set_Sharable___s__n
jmp 0x4015a8
mov eax, dword [esp + 0x10]
push 0
push eax
mov edx, dword [eax]
call dword [edx + 0x68]
push esi
push str.Set_UnSharable___s__n
jmp 0x4015a8
mov eax, dword [esp + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x64]
test eax, eax
push esi
jne 0x4015a3
push str.__s__is_shareable_n
jmp 0x4015a8
push str.__s__is_not_shareable_n
call fcn.0040216c
add esp, 8
mov eax, dword [esp + 0x10]
push eax
mov edx, dword [eax]
call dword [edx + 0x10]
inc ebp
cmp ebp, ebx
jl 0x4014e2
mov ecx, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
pop edi
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop ebx
pop esi
xor eax, eax
pop ebp
add esp, 0x2c0
ret
Function at 0x40216b
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
call main
jmp 0x402175
push 0x14
push 0x411788
call fcn.00405300
call main
movzx esi, ax
push 2
call main
pop ecx
mov eax, 0x5a4d
cmp word [0x400000], ax
je 0x4021a3
xor ebx, ebx
jmp 0x4021d6
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x40219f
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x40219f
xor ebx, ebx
cmp dword [eax + 0x400074], 0xe
jbe 0x4021d6
cmp dword [eax + 0x4000e8], ebx
setne bl
mov dword [ebp - 0x1c], ebx
call fcn.004048ef
test eax, eax
jne 0x4021ea
push 0x1c
call main
pop ecx
call fcn.00403b58
test eax, eax
jne 0x4021fb
push 0x10
call main
pop ecx
call fcn.004051cc
and dword [ebp - 4], 0
call fcn.00404904
test eax, eax
jns 0x402215
push 0x1b
call main
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x4162e8], eax
call main
mov dword [0x414430], eax
call main
test eax, eax
jns 0x40223b
push 8
call main
pop ecx
call fcn.00404de7
test eax, eax
jns 0x40224c
push 9
call main
pop ecx
push 1
call main
pop ecx
test eax, eax
je 0x40225f
push eax
call main
pop ecx
call fcn.00405299
push esi
push eax
push 0
push 0x400000
call main
mov esi, eax
mov dword [ebp - 0x24], esi
test ebx, ebx
jne 0x402281
push esi
call main
call fcn.00404663
jmp 0x4022b6
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
call fcn.00405345
ret

Function at 0x407282
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x407291
pop dword [ebp - 0x20]
mov eax, 0x407291
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x2f9e4493
add dword [ebp - 0x30], 0x1eb400b8
mov dword [ebp - 0x2c], 0xfe367a8f
sub dword [ebp - 0x2c], 0xcc032e4a
mov dword [ebp - 0x28], 0x21b93fa3
sub dword [ebp - 0x28], 0xd56cfb75
mov dword [ebp - 0x24], 0x492f5caa
add dword [ebp - 0x24], 0xb6d0a356
lea eax, [ebp - 0x30]
push eax
mov eax, 0xd51166af
add eax, 0x2b2f6985
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x3c9b3555
sub dword [ebp - 0x30], 0xc828cbff
mov dword [ebp - 0x2c], 0x26399498
sub dword [ebp - 0x2c], 0xe4cd3323
mov dword [ebp - 0x28], 0xe3d627b4
sub dword [ebp - 0x28], 0x8066bb48
mov dword [ebp - 0x24], 0x46c6cca1
add dword [ebp - 0x24], 0xb939335f
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0xb4a7369a
add eax, 0x4b999996
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x39205
push 0
call eax
mov ecx, 0xcb7536f1
sub ecx, 0xcb74edd0
mov edi, eax
mov ebx, 0x25b22bbc
add ebx, 0xda8fe444
add ebx, dword [ebp - 0x20]
mov esi, 0xb7719946
sub esi, 0xfc2a8bf6
add dword [ebp - 0x18], ecx
mov edx, dword [ebx]
xor dword [ebp - 0x18], edi
add edx, esi
add dword [ebp - 0x1c], 0x90d4dcf5
mov dword [edi], edx
sub dword [ebp - 0x14], esi
add edi, 0xdb431f79
add edi, 0x24bce08b
add ebx, 4
loop 0x4073ae
add eax, 0x11757
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x1b323bc3
sub ecx, 0x1af23bc3
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x401450
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401469
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x40147d
pop esi
pop edi
xor eax, eax
pop ebx
ret
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x40149e
cmp esi, eax
jae 0x401477
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401490
cmp esi, eax
jae 0x401477
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x401730
Capabilities:
Copy file
Move file

Disassembly:
mov dl, byte [ecx + 0x20b0]
xor eax, eax
test dl, 1
je 0x401742
mov eax, 2
test byte [ecx + 0x20b0], 2
push esi
mov esi, dword [esp + 0xc]
je 0x401768
or eax, 0xa
push eax
mov eax, dword [esp + 0xc]
push ecx
push 0x401650
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
jmp 0x40177e
push 8
push 0
push ecx
mov ecx, dword [esp + 0x14]
push 0x401650
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileExW]
push 0
push 0
push 3
push 0
push 7
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4017b0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push esi
call edi
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
ret 8

Function at 0x4023e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4e3448
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x1c]
mov eax, dword [esi]
mov ecx, dword [eax - 0x10]
mov edx, dword [ecx]
push edi
xor edi, edi
mov dword [esp + 8], edi
call dword [edx + 0x10]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax]
mov edx, dword [eax - 0xc]
mov ecx, dword [esi]
mov esi, dword [ecx - 0xc]
push edx
push eax
push esi
push ecx
lea ecx, [esp + 0x30]
push ecx
mov dword [esp + 0x28], edi
call fcn.00402140
mov esi, dword [esp + 0x34]
add esi, 0xfffffff0
push esi
call fcn.00401ba0
mov edi, dword [esp + 0x34]
add eax, 0x10
mov dword [edi], eax
add esp, 0x18
mov dword [esp + 0x14], 0xffffffff
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x402472
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
mov ecx, dword [esp + 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4038e0
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x2b4
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
mov esi, ecx
mov eax, dword [esi + 0x5c]
mov eax, dword [eax + 0x1c]
push 0
push 0x1108
push eax
call edi
push eax
call fcn.004c2d21
test eax, eax
je 0x403914
lea ecx, [esi + 0x60]
call fcn.004c2ce1
mov eax, dword [esi + 0x68]
push 0x4001
push 0x2b4
lea ecx, [esp + 0x10]
push ecx
push 0
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
jne 0x40394b
push str.Cannot_retrive_the_Handle_of_system_ImageList_
lea ecx, [esi + 0x70]
call fcn.00401f70
pop edi
xor eax, eax
pop esi
add esp, 0x2b4
ret
mov dword [esi + 0x64], eax
lea eax, [esi + 0x60]
test eax, eax
mov esi, dword [esi + 0x5c]
je 0x40395b
mov eax, dword [eax + 4]
mov edx, dword [esi + 0x1c]
push eax
push 0
push 0x1109
push edx
call edi
push eax
call fcn.004c2d21
pop edi
mov eax, 1
pop esi
add esp, 0x2b4
ret