joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1019836e
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x10198395
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x10198398
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.1019834a
pop esi
leave
ret 8
Function at 0x10015fe2
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001603d
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1001601e
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x1001603b
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.1001779a
mov dword [eax], 0xf603fa75
jmp 0x10016013
jmp 0x10016045
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esp, ebp
pop ebp
ret
Function at 0x1001c24f
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
xor esi, esi
xor ebx, ebx
inc esi
test cl, cl
je 0x1001c35a
mov dword [ebp - 8], esi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x18], 0xffffffff
cmp dword [ebp - 8], ebx
jne 0x1001c286
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp dword [ebp - 8], esi
jg 0x1001c327
mov dword [ebp - 0xc], 0xf16d
xor ecx, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], 0xb66c146d
mov dword [ebp - 0x18], 0xf84b0f4
mov dword [ebp - 0x18], 0x7de97ee8
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
sub eax, 0xa
cmp eax, 0xffffffff
mov eax, 0xcd1b7e2
setne cl
sub eax, ecx
sub eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xfffffff8
jg 0x1001c2ed
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov ecx, 0xf607dbc1
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
inc eax
cmp ecx, eax
mov eax, dword [ebp - 0xc]
sbb edx, edx
xor ecx, ecx
neg edx
add edx, 0xc254
cmp edx, eax
setne cl
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
jmp 0x1001c336
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x1001c336
push ebx
call dword [sym.imp.COMDLG32.dll_FindTextW]
push ebx
push 0x103c
push 0xc96
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
jmp 0x1001c40d
mov dword [ebp - 8], 0xef7d6512
mov dword [ebp - 0x14], 0xffd81438
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], 0x7374fd5
mov dword [ebp - 0xc], 0xdda8db88
mov dword [ebp - 0x18], 0x752e4a6b
mov dword [ebp - 0x18], 0x9e149cff
cmp dword [ebp - 8], ebx
jne 0x1001c3c9
mov eax, dword [ebp - 8]
mov ecx, ebx
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x1001c39f
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
xor edx, edx
cmp ecx, 0x58f5
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, 0xee24
setg al
mov dword [ebp - 0x18], eax
mov eax, ebx
cmp dword [ebp - 0x10], ebx
je 0x1001c3cb
mov eax, esi
inc eax
jne 0x1001c3d5
cmp dword [ebp - 0xc], ebx
jne 0x1001c3d5
mov esi, ebx
imul eax, esi, 0xfc03
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
neg eax
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xc], ebx
jmp 0x1001c400
mov dword [ebp - 0x18], 0x1fa6
cmp dword [ebp - 0x18], ebx
jne 0x1001c406
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xd
jle 0x1001c3f1
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10029c9d
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10029cca
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10029cc8
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x10029cd2
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esp, ebp
pop ebp
ret
Function at 0x10031131
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x10031155
xor eax, eax
jmp 0x1003129e
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x10031173
xor eax, eax
jmp 0x1003129e
push dword [ebp - 8]
lea eax, [ebp - 0xc]
push eax
push 1
call fcn.100303f0
add esp, 0xc
cmp dword [ebp - 0xc], 0
jne 0x10031191
xor eax, eax
jmp 0x1003129e
push dword [ebp - 8]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
push 0x702c
lea eax, [ebp - 0xc]
push eax
push 0x336a
push dword [ebp - 0x10]
push 1
call fcn.10030ce5
add esp, 0x20
push dword [ebp + 8]
push 0
push 0x1a4
push 0x7a24
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.1002db23
add esp, 0x18
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [eax + 0x34]
mov dword [ebp - 0x1c], ecx
lea eax, [ebp - 0x1c]
push eax
push 1
push 0x6515
lea eax, [ebp - 4]
push eax
push 0x7268
call fcn.10030e74
add esp, 0x14
push dword [ebp - 4]
call fcn.100302b1
pop ecx
test eax, eax
jne 0x10031210
xor eax, eax
jmp 0x1003129e
lea eax, [ebp - 4]
push eax
push 1
call fcn.10030f04
pop ecx
pop ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x10031286
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x14], ecx
jne 0x1003123c
xor eax, eax
jmp 0x1003129e
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x10031255
xor eax, eax
jmp 0x1003129e
push 0x4d90
lea eax, [ebp - 4]
push eax
push 0x215f
push 1
push 0x3f1e
push 0x5a35
push 0x4f4d
push 0x7122
push 0x66fc
call fcn.10030f6c
add esp, 0x24
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x10031297
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
jmp 0x1003129b
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret
Function at 0x10047720
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10047769
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x18], 0
jbe 0x10047767
mov eax, dword [ebp - 4]
mov eax, dword [eax]
push dword [eax + 0x18]
push 0
call fcn.10043ab5
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
jmp 0x10047787
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x10047787
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esp, ebp
pop ebp
ret
Function at 0x1004d7c8
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
mov dword [ebp - 0x14], 0x7013dce9
xor edi, edi
inc edi
xor ebx, ebx
mov dword [ebp - 0x10], edi
mov esi, ecx
mov dword [ebp - 0xc], ebx
lea ecx, [ebp - 0x34]
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 8], 0x2ff40fc0
mov dword [ebp - 8], ebx
mov dword [ebp - 8], edi
mov dword [ebp - 8], 0x20bd2ab
mov dword [ebp - 8], 0xf3d4e677
push 3
call fcn.1001770e
mov dword [ebp - 8], ebx
jmp 0x1004d822
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x34]
mov dword [eax + ecx*4], edi
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x1004d816
mov edx, dword [ebp - 0x34]
mov ecx, dword [edx + 8]
lea eax, [ecx + 1]
mov dword [edx + 8], eax
test ecx, ecx
jne 0x1004d85d
mov eax, dword [ebp - 0x10]
sub eax, 0x8d30
cmp eax, 0x244
setg cl
xor eax, eax
add ecx, dword [ebp - 0xc]
cmp ecx, 0x39d6b9c2
setge al
cmp dword [ebp - 0x14], eax
mov eax, ebx
jl 0x1004d85f
mov eax, edi
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 0x34]
call fcn.10017fa2
push esi
push edi
push 0x1e1e
push 0x44e3
call fcn.100486e1
mov dword [ebp - 8], 0xc03342eb
add esp, 0x10
mov dword [ebp - 0x14], 0x18e9934b
mov dword [ebp - 8], ebx
jmp 0x1004d8a9
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x14], edi
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x1004d8a6
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jle 0x1004d891
push esi
call fcn.10031131
mov dword [ebp - 8], 0x31713b91
mov esi, eax
mov dword [ebp - 0x14], 0x2ba8
pop ecx
mov dword [ebp - 8], ebx
jmp 0x1004d8d9
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x18], 0xec0351a9
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x1004d8cb
mov dword [ebp - 8], ebx
jmp 0x1004d983
push 2
mov dword [ebp - 0xc], ebx
pop ecx
jmp 0x1004d8fc
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x20], 0x76d7be7e
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x1004d8ee
mov dword [ebp - 0x1c], 0x6e83
mov dword [ebp - 0xc], 0xfff6
mov dword [ebp - 0xc], ebx
jmp 0x1004d922
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x28], 0xfffffffe
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x1004d914
cmp dword [ebp - 8], ebx
jne 0x1004d956
mov dword [ebp - 0xc], 0xffff
xor edx, edx
mov eax, dword [ebp - 0xc]
cmp eax, 0xbf33
mov eax, dword [ebp - 0x1c]
setle dl
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x24]
cmp edx, eax
mov eax, dword [ebp - 8]
setl cl
add eax, ecx
je 0x1004d95d
mov eax, edi
cmp dword [ebp - 0x24], ebx
jne 0x1004d95f
mov eax, ebx
mov dword [ebp - 0x18], eax
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x1004d971
push ebx
call dword [sym.imp.USER32.dll_DestroyMenu]
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x1004d980
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xffffffec
jl 0x1004d8e6
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1007f4de
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1008a330]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.100702a4
mov dword [ebp - 0x14], eax
cmp dword [0x10cc2b64], esi
jne 0x1007f5d1
push 0x800
push esi
push 0x10007c94
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x1007f55e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1007f6b1
push esi
push esi
push 0x10007c94
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x1007f6b1
push 0x10007cac
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1007f6b1
push eax
call ebx
push 0x10007cb8
push edi
mov dword [0x10cc2b64], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007cc8
push edi
mov dword [0x10cc2b68], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007cdc
push edi
mov dword [0x10cc2b6c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10cc2b74], eax
test eax, eax
je 0x1007f5ce
push 0x10007cf8
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10cc2b70], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1007f5f6
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1007f5e9
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x1007f60b
push 4
pop eax
jmp 0x1007f6b3
cmp dword [ebp - 0x14], esi
je 0x1007f60b
push dword [0x10cc2b64]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x1007f5f0
mov eax, dword [0x10cc2b70]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x1007f669
cmp dword [0x10cc2b74], edi
je 0x1007f669
push eax
call ebx
push dword [0x10cc2b74]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x1007f669
test eax, eax
je 0x1007f669
call ecx
test eax, eax
je 0x1007f65e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x1007f65e
test byte [ebp - 8], 1
jne 0x1007f669
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x1007f699
mov eax, dword [0x10cc2b68]
cmp eax, edi
je 0x1007f696
push eax
call ebx
test eax, eax
je 0x1007f696
call eax
mov esi, eax
test esi, esi
je 0x1007f696
mov eax, dword [0x10cc2b6c]
cmp eax, edi
je 0x1007f696
push eax
call ebx
test eax, eax
je 0x1007f696
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x10cc2b64]
call ebx
test eax, eax
je 0x1007f6b1
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1007f6b3
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call main
mov esp, ebp
pop ebp
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x40729f
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43201e
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x430001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0xa0d230d
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x55dc1e13
nop
nop
nop
nop
test eax, eax
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x405500
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cmp al, 0x60
mov ebp, esp
add ebp, 0x24
push esp
call fcn.00403362
inc ebx
test cl, ch
scasb al, byte es:[edi]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
cmp byte [eax + 0x1c], 0x18
je 0x405526
xchg esi, eax

Function at 0x405525
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.00403362
loop 0x405593
fst qword [eax - 0x75]
clc
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
call fcn.00403362
sbb esi, dword [eax - 0x74b6e2ba]
mov al, 0x46
sbb eax, 0x8b348b49
add al, 0xff
jne 0x405597

Function at 0x40567d
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x4056ac
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x4056f0
test edi, edi
jne 0x4056b7
and byte [esi], 0
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x4056ea
Function at 0x4059ce
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
test ebx, ebx
jge 0x4059ef
mov ecx, dword [0x423f1c]
lea eax, [ebx*4 + 4]
sub ecx, eax
mov ebx, dword [ecx]
mov eax, dword [0x424778]
mov ecx, dword [ebp + 8]
add ebx, eax
mov eax, 0x4236e0
sub ecx, eax
mov edi, eax
cmp ecx, 0x800
jae 0x405bc2
mov edi, dword [ebp + 8]
and dword [ebp + 8], 0
jmp 0x405bc2
mov edx, edi
sub edx, eax
cmp edx, 0x400
jge 0x405bcf
inc ebx
cmp cl, 0xfc
jbe 0x405bb5
movsx eax, byte [ebx + 1]
movsx ecx, byte [ebx]
mov esi, eax
mov edx, ecx
and esi, 0x7f
and edx, 0x7f
shl esi, 7
or esi, edx
mov edx, 0x8000
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], eax
or ecx, edx
or eax, edx
inc ebx
mov dword [ebp - 0x14], ecx
inc ebx
cmp byte [ebp + 0xf], 0xfe
mov dword [ebp - 0xc], eax
jne 0x405b60
and dword [ebp + 0xc], 0
and byte [edi], 0
push 4
pop esi
cmp dword [ebp - 0x10], esi
jne 0x405a83
mov dword [ebp + 0xc], str.MicrosoftInternet_ExplorerQuick_Launch
jmp 0x405afb
mov eax, dword [ebp - 0x18]
cmp eax, 0x2b
jne 0x405aa2
push edi
push str.CommonFilesDir
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call fcn.004058a0
jmp 0x405af6
cmp eax, 0x26
jne 0x405ad2
push edi
push str.ProgramFilesDir
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call fcn.004058a0
cmp byte [edi], 0
jne 0x405b58
push str.C:Program_Files
push edi
call fcn.004059ac
jmp 0x405af6
cmp eax, 0x25
jne 0x405ae5
push 0x400
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x405af6
cmp eax, 0x24
jne 0x405afb
push 0x400
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp byte [edi], 0
jne 0x405b58
cmp dword [0x4247c4], 0
jne 0x405b07
push 2
pop esi
lea eax, [ebp - 4]
dec esi
push eax
push dword [ebp + esi*4 - 0x18]
push dword [0x424744]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x405b3d
push edi
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
push dword [ebp - 4]
mov dword [ebp - 8], eax
call 0x405209
cmp dword [ebp - 8], 0
jne 0x405b44
jmp 0x405b40
and byte [edi], 0
test esi, esi
jne 0x405b07
cmp byte [edi], 0
je 0x405b58
cmp dword [ebp + 0xc], 0
je 0x405b58
push dword [ebp + 0xc]
push edi
call sub.KERNEL32.dll_lstrcatA
push edi
call fcn.00405be8
jmp 0x405ba6
cmp byte [ebp + 0xf], 0xfd
jne 0x405b94
cmp esi, 0x1b
jne 0x405b79
push dword [0x424744]
push edi
call fcn.0040590a
jmp 0x405b8a
mov eax, esi
shl eax, 0xa
add eax, section..ndata
push eax
push edi
call fcn.004059ac
add esi, 0xffffffeb
cmp esi, 6
jae 0x405ba6
jmp 0x405b58
cmp byte [ebp + 0xf], 0xff
jne 0x405ba6
or eax, 0xffffffff
sub eax, esi
push eax
push edi
call fcn.004059ce
push edi
call sub.KERNEL32.dll_lstrlenA
add edi, eax
mov eax, 0x4236e0
jmp 0x405bc2
jne 0x405bbf
mov cl, byte [ebx]
mov byte [edi], cl
inc edi
inc ebx
jmp 0x405bc2
mov byte [edi], cl
inc edi
mov cl, byte [ebx]
test cl, cl
mov byte [ebp + 0xf], cl
jne 0x405a1a
and byte [edi], 0
cmp dword [ebp + 8], 0
pop edi
pop esi
pop ebx
je 0x405be4
push eax
push dword [ebp + 8]
call fcn.004059ac
leave
ret 8
Function at 0x1006155f
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0x10]
mov edx, dword [eax]
mov eax, dword [ebp + 8]
and dword [ebp - 0xc], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov ecx, ebx
mov dword [ebp - 8], edx
mov dword [ebp - 0x1c], eax
call fcn.100266ed
test dl, 0x40
jne 0x10061596
cmp dword [0x100a955c], 0
je 0x100618c1
push 5
pop ecx
cmp eax, ecx
jl 0x100618c1
mov edi, 0x1009be24
mov esi, ebx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x100618c1
or dword [ebp - 8], 0x40
xor esi, esi
cmp eax, esi
mov dword [ebp + 8], esi
lea edi, [eax + 2]
jle 0x100615d2
xor ecx, ecx
cmp byte [esi + ebx], 0x26
sete cl
add edi, ecx
inc esi
cmp esi, eax
jl 0x100615c2
push edi
call fcn.10024a7e
pop ecx
mov dword [ebp - 4], eax
test eax, eax
jne 0x100615e8
push 7
pop eax
jmp 0x1006193c
cmp byte [ebx + 5], 0x2f
jne 0x10061641
cmp byte [ebx + 6], 0x2f
jne 0x10061641
lea edi, [ebx + 7]
mov al, byte [edi]
push 7
pop edx
mov dword [ebp - 0x24], edi
test al, al
je 0x10061644
cmp al, 0x2f
je 0x1006160f
inc edx
mov al, byte [edx + ebx]
test al, al
jne 0x10061603
cmp edx, 7
je 0x10061644
cmp edx, 0x10
jne 0x1006162a
push 9
pop ecx
mov esi, 0x1009be2c
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x10061644
mov edi, dword [ebp - 0x24]
push edi
add edx, 0xfffffff9
push edx
push 0x1009be38
push 5
pop edx
mov al, byte [edx + ebx]
xor esi, esi
test al, al
je 0x1006177d
mov esi, eax
lea eax, [esi + 2]
push eax
call fcn.10024a7e
mov edi, eax
pop ecx
mov dword [ebp - 4], edi
test edi, edi
je 0x100615e0
push esi
push ebx
push edi
call fcn.10070600
lea eax, [edi + esi]
add esp, 0xc
mov byte [eax], 0
mov byte [eax + 1], 0