joyce8/EMBER2024-capa huggingface dataset:
Function at 0x458002
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x4ed290]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x4580b8
movzx eax, word [esi]
test ax, ax
je 0x4580b8
push edi
mov edi, esi
mov ecx, esi
cmp ax, 0x2f
je 0x458042
cmp ax, 0x5c
jne 0x458044
mov edi, ecx
add ecx, 2
movzx eax, word [ecx]
test ax, ax
jne 0x458036
cmp edi, esi
je 0x45808b
sub edi, esi
lea eax, [ebp - 0x20c]
sar edi, 1
push edi
push esi
push eax
call fcn.00482978
add edi, edi
add esp, 0xc
cmp edi, 0x208
jae 0x4580c8
xor eax, eax
mov word [ebp + edi - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.00458002
pop ecx
pop ecx
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.0047a962
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.0047e43b
add esp, 0x10
lea eax, [ebp - 0x414]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00431c76
mov esp, ebp
pop ebp
ret
call fcn.0043212a
int3

Function at 0x45868d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
cmp dword [edi], 0
jne 0x458709
cmp dword [edi + 4], 0xffffffff
jne 0x458709
push esi
lea esi, [edi + 0x138]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x4c3d88
push esi
call fcn.0047e43b
cmp dword [ebp + 0x10], 1
pop ecx
pop ecx
pop esi
jne 0x4586db
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x4586db
mov eax, 0x2000000
jmp 0x45870e
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0045aba8
add esp, 0x10
test eax, eax
jne 0x4586f9
mov eax, dword [ebp - 4]
jmp 0x45870e
push eax
call fcn.0045b2b0
mov dword [edi], eax
mov eax, dword [0x4f4ec0]
pop ecx
jmp 0x45870e
mov eax, 0x1000000
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x45acb5
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
imul esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
cmp byte [edi], 0
je 0x45ace9
push 0
lea eax, [ebp + 0x10]
push eax
push esi
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x45ace4
mov byte [edi + 8], 1
mov eax, dword [ebp + 0x10]
jmp 0x45ad10
mov edx, dword [edi + 0x18]
lea eax, [edx + esi]
cmp eax, dword [edi + 0x14]
jbe 0x45acf9
mov esi, dword [edi + 0x14]
sub esi, edx
mov ecx, dword [edi + 0x10]
push esi
add ecx, edx
push ecx
push dword [ebp + 8]
call fcn.00475ee0
add esp, 0xc
mov eax, esi
add dword [edi + 0x18], esi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop esi
pop ebp
ret

Function at 0x45ae83
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x45ae91
xor eax, eax
pop ebp
ret
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
not ecx
cmp esi, 8
jb 0x45af50
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4cbdd8]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4cbdd8]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4cbdd8]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4cbdd8]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4cbdd8]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4cbdd8]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4cbdd8]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4cbdd8]
sub edi, 1
jne 0x45aea9
pop edi
test esi, esi
je 0x45af6c
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4cbdd8]
inc edx
sub esi, 1
jne 0x45af54
not ecx
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x4644ae
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 8]
and edi, 7
je 0x4644d2
cmp dword [esi + 8], edi
jge 0x4644ca
push esi
call fcn.0046274f
pop ecx
mov ecx, edi
shr dword [esi + 0xc], cl
sub dword [esi + 8], edi
mov edx, dword [esi + 8]
xor ecx, ecx
test edx, edx
jle 0x4644fb
mov edi, dword [esi + 0xc]
mov al, byte [esi + 0xc]
sub edx, 8
mov byte [ebp + ecx + 8], al
inc ecx
shr edi, 8
mov dword [esi + 0xc], edi
test edx, edx
jg 0x4644de
mov dword [esi + 8], edx
cmp ecx, 4
jge 0x464518
mov edx, dword [esi]
cmp edx, dword [esi + 4]
jb 0x464506
xor eax, eax
jmp 0x46450e
mov al, byte [edx]
inc edx
mov dword [esi], edx
movzx eax, al
mov byte [ebp + ecx + 8], al
inc ecx
cmp ecx, 4
jl 0x4644fd
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xb]
movzx edi, ah
movzx eax, al
shl edi, 8
add edi, eax
shl ecx, 8
movzx eax, byte [ebp + 0xa]
add ecx, eax
mov eax, edi
xor eax, 0xffff
cmp ecx, eax
je 0x46454d
push str.zlib_corrupt
call fcn.0046260a
add esp, 4
jmp 0x46458a
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x46455d
push str.read_past_buffer
jmp 0x464543
mov eax, dword [esi + 0x10]
add eax, edi
cmp eax, dword [esi + 0x18]
jbe 0x464574
push edi
push esi
call fcn.00462619
pop ecx
pop ecx
test eax, eax
je 0x46458a
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.00475ee0
add dword [esi], edi
xor eax, eax
add dword [esi + 0x10], edi
add esp, 0xc
inc eax
pop edi
pop esi
pop ebp
ret
Function at 0x46c8a3
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x2cc
mov eax, 0x4bedef
call fcn.00431cf2
mov dword [ebp - 0x2d8], ecx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x2cc], ebx
call fcn.00439ddb
push eax
lea ecx, [ebp - 0x94]
call fcn.00437f5c
xor edi, edi
mov dword [ebp - 4], edi
call fcn.00439de1
mov ecx, eax
call fcn.0043873c
test al, al
je 0x46c991
push ebx
lea ecx, [ebp - 0x94]
call fcn.0043819c
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocStringLen
lea ecx, [ebp - 0x94]
call fcn.0043817c
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x46c934
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.00438097
jmp 0x46ca72
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test esi, esi
je 0x46c920
push esi
mov dword [ebp - 0x2c8], edi
call fcn.0043267a
pop ecx
push 0
mov edi, eax
lea eax, [ebp - 0x2c8]
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2c8], esi
je 0x46ca5d
push edi
call fcn.00431d9a
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.00438097
jmp 0x46ca70
call fcn.00439de1
push eax
lea ecx, [ebp - 0x94]
call fcn.0043817f
call fcn.00439f0d
test al, al
je 0x46c9b2
call fcn.00439de7
jmp 0x46c9c9
push 2
push edi
lea ecx, [ebp - 0x94]
call fcn.0043817c
push eax
call fcn.00458715
add esp, 0xc
mov ebx, eax
test ebx, ebx
je 0x46c920
lea eax, [ebp - 0x2c4]
push eax
lea eax, [ebp - 0x2d4]
push eax
push 1
push dword [ebp - 0x2cc]
push ebx
call fcn.00458156
add esp, 0x14
test eax, eax
jne 0x46c920
mov esi, dword [ebp - 0x98]
test esi, esi
je 0x46c920
push esi
call fcn.0043267a
push 3
push esi
mov edi, eax
push edi
push dword [ebp - 0x2d4]
push ebx
call fcn.00458ad5
add esp, 0x18
test eax, eax
je 0x46ca4d
cmp eax, 0x600
je 0x46ca4d
push edi
call fcn.00431d9a
pop ecx
call fcn.00439f0d
test al, al
jne 0x46c97d
push ebx
call fcn.00457fb0
jmp 0x46c97c
call fcn.00439f0d
test al, al
jne 0x46ca5d
push ebx
call fcn.00457fb0
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.00438097
test edi, edi
jne 0x46cae4
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocStringLen
push dword [ebp - 0x2cc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x46cae0
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test esi, esi
je 0x46cae0
push esi
mov dword [ebp - 0x2d0], edi
call fcn.0043267a
pop ecx
push 0
mov edi, eax
lea eax, [ebp - 0x2d0]
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2d0], esi
je 0x46cadc
push edi
call fcn.00431d9a
pop ecx
xor edi, edi
test edi, edi
jne 0x46cae4
xor eax, eax
jmp 0x46caff
mov ecx, dword [ebp - 0x2d8]
push esi
push edi
call fcn.0046cb07
push 1
push edi
mov esi, eax
call fcn.00431c68
pop ecx
pop ecx
mov eax, esi
call fcn.00431c9c
ret 4
Function at 0x4738b0
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x8c
mov eax, 0x4bd198
call fcn.00431cf2
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
call fcn.00439ddb
push eax
lea ecx, [ebp - 0x94]
call fcn.00437f5c
xor edi, edi
lea ecx, [ebp - 0x94]
push esi
mov dword [ebp - 4], edi
call fcn.0043819c
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocStringLen
lea ecx, [ebp - 0x94]
call fcn.0043817c
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x47395a
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebx], eax
test eax, eax
je 0x47395a
and dword [ebp - 0x98], 0
push eax
call fcn.0043267a
pop ecx
push 0
mov esi, eax
lea eax, [ebp - 0x98]
push eax
push dword [ebx]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x98]
cmp eax, dword [ebx]
je 0x47395c
push esi
call fcn.00431d9a
pop ecx
xor esi, esi
lea ecx, [ebp - 0x94]
call fcn.00438097
mov eax, esi
call fcn.00431c9c
ret

Function at 0x473c5f
Capabilities:
Check if file exists

Disassembly:
push 0x274
mov eax, 0x4bf452
call fcn.00431cf2
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov edi, dword [ebp + 8]
mov dword [ebp - 0x280], ebx
cmp dword [esi + 0x14], 8
jb 0x473c86
mov eax, dword [esi]
jmp 0x473c88
mov eax, esi
push eax
lea eax, [ebp - 0x27c]
push eax
call fcn.00473ba1
pop ecx
pop ecx
cmp dword [esi + 0x14], 8
mov dword [ebp - 4], ebx
jb 0x473ca2
mov esi, dword [esi]
lea eax, [ebp - 0x234]
push esi
push eax
call fcn.00473b12
cmp dword [ebp - 0x220], 8
lea eax, [ebp - 0x234]
mov byte [ebp - 4], 1
cmovae eax, dword [ebp - 0x234]
push eax
lea eax, [ebp - 0x264]
push eax
call fcn.00473a67
cmp dword [ebp - 0x220], 8
lea eax, [ebp - 0x234]
mov byte [ebp - 4], 2
cmovae eax, dword [ebp - 0x234]
push eax
lea eax, [ebp - 0x24c]
push eax
call fcn.00473ad1
add esp, 0x18
xor esi, esi
mov byte [ebp - 4], 3
inc esi
push 0x20a
lea eax, [ebp - 0x21c]
push ebx
push eax
call fcn.00476e20
cmp dword [ebp - 0x238], 8
lea edx, [ebp - 0x24c]
lea ecx, [ebp - 0x264]
cmovae edx, dword [ebp - 0x24c]
lea eax, [ebp - 0x27c]
cmp dword [ebp - 0x250], 8
push edx
cmovae ecx, dword [ebp - 0x264]
cmp dword [ebp - 0x268], 8
push esi
cmovae eax, dword [ebp - 0x27c]
push ecx
push eax
lea eax, [ebp - 0x21c]
push str._s_s__d__s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x24
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x473d8f
inc esi
cmp esi, 0x3e8
jl 0x473d03
push 0x4c0cec
jmp 0x473d96
lea eax, [ebp - 0x21c]
push eax
mov ecx, edi
call fcn.00401daf
xor esi, esi
lea ecx, [ebp - 0x24c]
push ebx
inc esi
push esi
call fcn.004022f7
push ebx
push esi
lea ecx, [ebp - 0x264]
call fcn.004022f7
push ebx
push esi
lea ecx, [ebp - 0x234]
call fcn.004022f7
push ebx
push esi
lea ecx, [ebp - 0x27c]
call fcn.004022f7
mov eax, edi
call fcn.00431c9c
ret
Function at 0x474846
Capabilities:
Create process on windows

Disassembly:
push 0x90
mov eax, 0x4bf520
call fcn.00431cf2
mov eax, dword [ebp + 0x18]
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
and dword [ebp - 0x44], 0
push 0x44
pop ebx
push ebx
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x9c]
push 0
push eax
call fcn.00476e20
push 0x10
lea eax, [ebp - 0x58]
mov dword [ebp - 0x9c], ebx
push 0
push eax
call fcn.00476e20
add esp, 0x18
xor edx, edx
xor eax, eax
mov dword [ebp - 0x18], edx
mov word [ebp - 0x28], ax
push 7
pop ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
mov word [ebp - 0x40], ax
or ebx, 0xffffffff
mov byte [ebp - 4], 1
test edi, edi
je 0x47492e
cmp word [edi], dx
jne 0x4748bf
mov eax, edx
jmp 0x4748c6
push edi
call fcn.0047a984
pop ecx
push eax
push edi
lea ecx, [ebp - 0x40]
call fcn.0040244a
cmp dword [ebp - 0x30], 0
je 0x47492e
mov edi, 0x4c3bac
push edi
call fcn.0047a984
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.0040244a
xor edi, edi
cmp word [esi], di
jne 0x4748f7
mov eax, edi
jmp 0x4748fe
push esi
call fcn.0047a984
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.004272fc
mov esi, 0x4d1124
push esi
call fcn.0047a984
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.004272fc
push ebx
push edi
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.0042725d
jmp 0x47494a
xor edi, edi
cmp word [esi], di
jne 0x474939
mov eax, edi
jmp 0x474940
push esi
call fcn.0047a984
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.0040244a
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push 0x67
call fcn.00475dab
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
pop ecx
cmovae eax, dword [ebp - 0x28]
pop ecx
lea ecx, [ebp - 0x58]
push ecx
lea ecx, [ebp - 0x9c]
push ecx
push edi
push edi
push edi
push 1
push edi
push edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x47498c
mov esi, edi
jmp 0x4749d4
cmp byte [ebp + 0x10], 0
je 0x4749a4
cmp dword [ebp + 0x14], 0
cmovg ebx, dword [ebp + 0x14]
push ebx
push dword [ebp - 0x58]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, dword [ebp - 0x48]
test esi, esi
je 0x4749c1
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x58]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x4749c1
mov eax, dword [ebp - 0x44]
mov dword [esi], eax
push dword [ebp - 0x58]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x54]
call esi
xor esi, esi
inc esi
push edi
push 1
lea ecx, [ebp - 0x40]
call fcn.004022f7
push edi
push 1
lea ecx, [ebp - 0x28]
call fcn.004022f7
mov eax, esi
call fcn.00431c9c
ret
Function at 0x474a17
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.0047a984
mov dword [ebp - 4], eax
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0043267a
push dword [ebp + 8]
mov esi, eax
push esi
call fcn.0047a962
mov eax, dword [ebp - 4]
xor edi, edi
add esp, 0x10
xor ebx, ebx
inc edi
test eax, eax
js 0x474a91
push 0x5c
pop ecx
cmp word [esi + ebx*2], cx
jne 0x474a88
xor eax, eax
push esi
mov word [esi + ebx*2], ax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x474a7e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x474a8f
mov eax, dword [ebp - 4]
push 0x5c
pop ecx
mov word [esi + ebx*2], cx
inc ebx
cmp ebx, eax
jle 0x474a5b
jmp 0x474a91
xor edi, edi
push esi
call fcn.00431d9a
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x474aa1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4ed290]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
xor edi, edi
push 0x208
push edi
push eax
mov dword [ebp - 0x210], edi
call fcn.00476e20
add esp, 0xc
lea eax, [ebp - 0x20c]
push edi
push 0x1a
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00401daf
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00431c76
mov esp, ebp
pop ebp
ret

Function at 0x474b8c
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4ed290]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
xor edi, edi
push 0x208
push edi
push eax
mov dword [ebp - 0x210], edi
call fcn.00476e20
add esp, 0xc
lea eax, [ebp - 0x20c]
push edi
push 0x26
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00401daf
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00431c76
mov esp, ebp
pop ebp
ret

Function at 0x474bf2
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4ed290]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x210], 0
lea eax, [ebp - 0x20c]
push esi
mov esi, dword [ebp + 8]
push 0x208
push 0
push eax
call fcn.00476e20
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00401daf
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00431c76
mov esp, ebp
pop ebp
ret
Function at 0x474c57
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x4ed290]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.0047a984
pop ecx
test eax, eax
je 0x474d0f
push ebx
push edi
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x200]
push str.Program_FilesInternet_Exploreriexplore.exe
push eax
call fcn.0047a962
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0047e43b
push 0x3c
xor edi, edi
lea eax, [ebp - 0x248]
push edi
push eax
call fcn.00476e20
add esp, 0x1c
mov dword [ebp - 0x244], 0x200
xor ebx, ebx
mov dword [ebp - 0x234], esi
inc ebx
mov eax, str.open
mov dword [ebp - 0x23c], eax
push ebx
push edi
push edi
push esi
push eax
push edi
mov dword [ebp - 0x22c], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x474d0b
push edi
push edi
push edi
lea ecx, [ebp - 0x20c]
push edi
push ecx
call fcn.00474846
add esp, 0x14
pop edi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00431c76
mov esp, ebp
pop ebp
ret
Function at 0x475c7e
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00432c00
mov eax, dword [0x4ed290]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
call fcn.00483582
mov dword [ebp - 0x1014], eax
lea eax, [ebp - 0x1014]
push eax
mov dword [ebp - 0x1010], edx
call fcn.0048384e
pop ecx
pop ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [esi + 0x10]
push edi
push eax
push dword [esi]
mov eax, dword [esi + 0x14]
inc ecx
push dword [esi + 4]
add eax, 0x76c
push dword [esi + 8]
push dword [esi + 0xc]
push ecx
push eax
lea eax, [ebp - 0x1004]
push str.__d__d__d__d__d__d___d_:_s
push eax
call fcn.00475b95
add esp, 0x28
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push 0
xor ecx, ecx
pop edi
inc ecx
test eax, eax
push 0x4c6730
push ebx
cmovne edi, ecx
call fcn.0047fd3a
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x475d9a
test edi, edi
jne 0x475d3d
push esi
push 2
lea eax, [ebp - 0x100c]
mov dword [ebp - 0x100c], 0xfeff
push 1
push eax
call fcn.0047e297
add esp, 0x10
lea eax, [ebp - 0x1004]
push eax
call fcn.0047a984
push esi
add eax, eax
push eax
lea eax, [ebp - 0x1004]
push 1
push eax
call fcn.0047e297
push esi
push 2
lea eax, [ebp - 0x1008]
mov dword [ebp - 0x1008], 0xd
push 1
push eax
call fcn.0047e297
push esi
push 2
lea eax, [ebp - 0x1008]
mov dword [ebp - 0x1008], 0xa
push 1
push eax
call fcn.0047e297
push esi
call fcn.0047de51
add esp, 0x38
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00431c76
mov esp, ebp
pop ebp
ret

Function at 0x48a30f
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00489fcf

Function at 0x4a28d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebx - 4]
jle 0x4a293a
mov ecx, dword [ebp + 8]
sub ecx, ebx
push esi
mov dword [ebp + 8], ecx
push edi
nop word [eax + eax]
mov esi, dword [ecx + ebx]
lea ebx, [ebx + 4]
mov ecx, eax
mov edi, esi
and edi, 0xffff00ff
and ecx, 0xffff00ff
add edi, ecx
mov edx, esi
movzx ecx, ax
and edx, 0xff00
add edx, ecx
and eax, 0xff00ffff
mov ecx, dword [ebp + 8]
xor edi, edx
and esi, 0xff00ff00
and edi, 0xff00ff
add eax, esi
xor eax, edi
sub dword [ebp + 0x10], 1
mov dword [ebx - 4], eax
jne 0x4a28f0
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4248a5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041e46c
and dword [ebp - 4], 0
cmp dword [0x44c388], 0
mov ebx, eax
jne 0x424956
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x424a07
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x424a07
push eax
call fcn.0041e3fa
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x44c388], eax
call esi
push eax
call fcn.0041e3fa
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x44c38c], eax
call esi
push eax
call fcn.0041e3fa
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x44c390], eax
call esi
push eax
call fcn.0041e3fa
pop ecx
mov dword [0x44c398], eax
test eax, eax
je 0x424956
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041e3fa
pop ecx
mov dword [0x44c394], eax
mov eax, dword [0x44c394]
cmp eax, ebx
je 0x4249ae
cmp dword [0x44c398], ebx
je 0x4249ae
push eax
call fcn.0041e475
push dword [0x44c398]
mov esi, eax
call fcn.0041e475
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4249ae
test edi, edi
je 0x4249ae
call esi
test eax, eax
je 0x4249a5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4249a5
test byte [ebp - 0xc], 1
jne 0x4249ae
or dword [ebp + 0x10], 0x200000
jmp 0x4249e7
mov eax, dword [0x44c38c]
cmp eax, ebx
je 0x4249e7
push eax
call fcn.0041e475
pop ecx
test eax, eax
je 0x4249e7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4249e7
mov eax, dword [0x44c390]
cmp eax, ebx
je 0x4249e7
push eax
call fcn.0041e475
pop ecx
test eax, eax
je 0x4249e7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44c388]
call fcn.0041e475
pop ecx
test eax, eax
je 0x424a07
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x424a09
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10010e1
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push 0x100109c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jne 0x1001123
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x100107c
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
call fcn.010010c8
jmp 0x1001143
push 0x1001074
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x1001141
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1001050
jmp 0x1001105
call eax
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]