joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416bb0
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
add eax, 0x18
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.Iime_enc.map
mov ecx, dword [ebp - 4]
add ecx, 0x18
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov edx, dword [ebp - 4]
add edx, 0x18
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x416bfb
mov eax, dword [ebp - 4]
add eax, 0x18
push eax
call fcn.00418ac0
add esp, 4
push 0
push 2
push 2
push 0
push 0
push 0xc0000000
mov ecx, dword [ebp - 4]
add ecx, 0x18
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x14], 0xffffffff
jne 0x416c2d
xor eax, eax
jmp 0x416d33
push str.Iime_EnTrie_Codetable
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x78c]
push edx
push 0
push 4
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edx, dword [ebp - 4]
mov dword [edx + 0x220], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x220], 0
jne 0x416c82
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov dword [eax + 0x14], 0xffffffff
xor eax, eax
jmp 0x416d33
push 0
push 0
push 0
push 0xf001f
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x220]
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x224], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x224], 0
jne 0x416cea
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x220]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
mov dword [edx + 0x220], 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], 0xffffffff
xor eax, eax
jmp 0x416d33
mov ecx, dword [ebp - 4]
call fcn.00416d40
test eax, eax
jne 0x416d2e
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x220]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
mov dword [edx + 0x220], 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], 0xffffffff
xor eax, eax
jmp 0x416d33
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x416d40
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x224], 0
jne 0x416d5e
xor eax, eax
jmp 0x416e4a
mov dword [ebp - 0xc], 0
push 0
push 0
push 0
push 4
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x416d87
jmp 0x416dfc
mov edi, dword [ebp - 4]
add edi, 0x228
mov ecx, 0x159
mov esi, dword [ebp - 8]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 4]
mov dword [eax + 0x794], 0
mov ecx, dword [ebp - 4]
call fcn.00417280
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 4], 0
jne 0x416dc2
jmp 0x416dfc
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x2e4]
mov dword [eax + 0x10], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, dword [eax + 0x10]
cmp edx, dword [ecx + 0xc]
jae 0x416df5
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.004173b0
test eax, eax
jne 0x416df3
jmp 0x416dfc
jmp 0x416dd1
mov dword [ebp - 0xc], 1
cmp dword [ebp - 8], 0
je 0x416e13
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [ebp - 8], 0
mov edx, dword [ebp - 4]
cmp dword [edx + 8], 0
je 0x416e33
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
mov dword [edx + 8], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], 0
mov eax, dword [ebp - 0xc]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x417d60
Capabilities:
Check if file exists
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x438040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x417d82
xor eax, eax
jmp 0x417de2
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x417dab
xor eax, eax
jmp 0x417de2
mov dword [ebp - 8], 0
push 0
lea edx, [ebp - 8]
push edx
push 0x564
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041cba0
mov esp, ebp
pop ebp
ret
Function at 0x417df0
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x160
mov eax, dword [0x438040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x417e1a
xor eax, eax
jmp 0x417eee
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0xffffffff
jne 0x417e4c
xor eax, eax
jmp 0x417eee
mov dword [ebp - 8], 0
push 0
lea edx, [ebp - 8]
push edx
push 0x564
lea eax, [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x15c]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x160], eax
mov edx, dword [ebp - 0x15c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x15c], 0
cmp dword [ebp + 0x570], 0
je 0x417ee8
push 0x14e
push 0
lea eax, [ebp - 0x158]
push eax
call fcn.0041e4b0
add esp, 0xc
lea ecx, [ebp - 0x158]
push ecx
call fcn.00417f00
add esp, 4
mov edx, 1
mov word [ebp - 0x13a], dx
sub esp, 0x150
mov ecx, 0x53
lea esi, [ebp - 0x158]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.00418050
add esp, 0x150
mov eax, dword [ebp - 0x160]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041cba0
mov esp, ebp
pop ebp
ret

Function at 0x417f00
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x438040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.0041e4b0
add esp, 0xc
push 0x11
lea ecx, [ebp - 0x20c]
push ecx
call fcn.00418830
add esp, 8
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x417f81
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.00418130
add esp, 8
mov esi, dword [ebp + 8]
sub esp, 0x150
mov ecx, 0x53
mov edi, esp
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.00418050
add esp, 0x150
mov eax, 1
jmp 0x417f94
lea ecx, [ebp - 0x20c]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00417fb0
add esp, 8
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041cba0
mov esp, ebp
pop ebp
ret
Function at 0x417fb0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x438040]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x417fe9
xor eax, eax
jmp 0x418035
mov dword [ebp - 8], 0
push 0
lea ecx, [ebp - 8]
push ecx
push 0x14e
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + 0x34]
cmp edx, 0xa
jne 0x418021
xor eax, eax
mov ecx, dword [ebp + 8]
mov word [ecx + 0x34], ax
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041cba0
mov esp, ebp
pop ebp
ret

Function at 0x418050
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x438040]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.0041e4b0
add esp, 0xc
push 0x11
lea ecx, [ebp - 0x20c]
push ecx
call fcn.00418830
add esp, 8
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0xffffffff
je 0x418116
mov dword [ebp - 0x210], 0
mov eax, 0x14e
mov word [ebp + 8], ax
push 0
lea ecx, [ebp - 0x210]
push ecx
push 0x14e
lea edx, [ebp + 8]
push edx
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 0x214]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x214], 0
push 0
push 0
push 0x10
call fcn.0041c910
add esp, 0xc
mov eax, 1
jmp 0x418118
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041cba0
mov esp, ebp
pop ebp
ret
Function at 0x4184a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x438040]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x218]
push eax
push 0x20219
push 0
push str.SoftwareIime
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
je 0x4184e7
xor eax, eax
jmp 0x418705
push 0x208
push 0
lea ecx, [ebp - 0x20c]
push ecx
call fcn.0041e4b0
add esp, 0xc
mov dword [ebp - 0x210], 0x208
mov dword [ebp - 0x214], 1
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x214]
push ecx
push 0
push str.Clsid
mov edx, dword [ebp - 0x218]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x418550
push str.83DB39EE_30A2_4143_9062_0C4FD8274968
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x20c]
push edx
call fcn.00419050
add esp, 8
mov dword [ebp - 0x210], 0x208
mov dword [ebp - 0x214], 1
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [ebp - 0x214]
push edx
push 0
push str.Guid
mov eax, dword [ebp - 0x218]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4185b6
push str.F0970D4D_3985_46B0_B882_0EC7BA3D3BD1
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edx, dword [ebp + 8]
add edx, 0x10
push edx
lea eax, [ebp - 0x20c]
push eax
call fcn.00419050
add esp, 8
mov dword [ebp - 0x210], 0x208
mov dword [ebp - 0x214], 1
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x20c]
push edx
lea eax, [ebp - 0x214]
push eax
push 0
push str.SetupLocation
mov ecx, dword [ebp - 0x218]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x41861c
lea edx, [ebp - 0x20c]
push edx
call fcn.004188e0
add esp, 4
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x20
call fcn.004021b0
mov dword [ebp - 0x210], 0x208
mov dword [ebp - 0x214], 1
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x20c]
push edx
lea eax, [ebp - 0x214]
push eax
push 0
push str.DataLocation
mov ecx, dword [ebp - 0x218]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x41869a
mov ecx, dword [ebp + 8]
add ecx, 0x20
call fcn.004021a0
push eax
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str.IimeData
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x20c]
push ecx
mov ecx, dword [ebp + 8]
add ecx, 0x38
call fcn.004021b0
mov edx, dword [ebp + 8]
mov dword [edx + 0x50], 0
mov dword [ebp - 0x210], 4
mov dword [ebp - 0x214], 4
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x50
push ecx
lea edx, [ebp - 0x214]
push edx
push 0
push str.Portable
mov eax, dword [ebp - 0x218]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x218]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041cba0
mov esp, ebp
pop ebp
ret
Function at 0x418960
Capabilities:
Check if file exists
Create directory
Delete file
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x438040]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.0041e4b0
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, 2
imul ecx, eax, 3
mov dword [ebp - 0x418], ecx
cmp dword [ebp - 0x418], 0x208
jae 0x4189b6
jmp 0x4189bb
call fcn.0041d1cd
xor edx, edx
mov eax, dword [ebp - 0x418]
mov word [ebp + eax - 0x20c], dx
push str.IimeFile
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x418a0c
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 2
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0x208
push 0
lea edx, [ebp - 0x414]
push edx
call fcn.0041e4b0
add esp, 0xc
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [ebp - 0x414]
push edx
call dword [sym.imp.SHELL32.dll_PathYetAnotherMakeUniqueName]
mov dword [ebp - 0x41c], 0
push 3
lea eax, [ebp - 0x414]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x418a92
push 2
lea edx, [ebp - 0x414]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 4
push 0
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x418a92
mov dword [ebp - 0x41c], 1
push 4
push 0
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov eax, dword [ebp - 0x41c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041cba0
mov esp, ebp
pop ebp
ret

Function at 0x418ac0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x418adf
mov ecx, dword [ebp + 8]
push ecx
call fcn.00418960
add esp, 4
jmp 0x418ae4
mov eax, 1
pop ebp
ret
Function at 0x418af0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x438040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 2
imul ecx, eax, 0
xor edx, edx
mov eax, dword [ebp + 8]
mov word [eax + ecx], dx
push str.Shell32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x418b27
jmp 0x418b81
push str.SHGetKnownFolderPath
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x418b6f
mov dword [ebp - 8], 0
lea edx, [ebp - 8]
push edx
push 0
push 0
lea eax, [ebp + 0xc]
push eax
call dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x418b81
push 0
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041cba0
mov esp, ebp
pop ebp
ret

Function at 0x4191e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x438040]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.00417900
movzx eax, al
test eax, eax
je 0x4192a5
push 6
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jl 0x4192a3
push 0x3c
push 0
lea ecx, [ebp - 0x44]
push ecx
call fcn.0041e4b0
add esp, 0xc
mov dword [ebp - 0x44], 0x3c
mov dword [ebp - 0x40], 0x440
mov dword [ebp - 0x38], 0x431674
mov edx, dword [ebp + 8]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], 1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0x44]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x419265
jmp 0x4192a5
cmp dword [ebp - 0xc], 0
je 0x4192a3
mov dword [ebp - 8], 0x103
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [ebp - 8], 0x103
je 0x419299
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
jmp 0x419280
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4192c3
push 1
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push str.open
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041cba0
mov esp, ebp
pop ebp
ret
Function at 0x41bdf0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x438040]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0xffffffff
jne 0x41be12
xor eax, eax
jmp 0x41beb9
mov dword [ebp - 8], 2
push 0
push 0
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
test eax, eax
jne 0x41be38
xor eax, eax
jmp 0x41beb9
mov dword [ebp - 0xc], 0
push 0
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x41be61
xor eax, eax
jmp 0x41beb9
mov dword [ebp - 0x14], 0
push 0
lea eax, [ebp + 0xc]
push eax
push 0x800
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x41be9b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
je 0x41be9b
jmp 0x41bea1
cmp dword [ebp - 0x14], 0
je 0x41be68
cmp dword [ebp - 0x14], 0
je 0x41beaf
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x18], ecx
jmp 0x41beb6
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041cba0
mov esp, ebp
pop ebp
ret 8

Function at 0x41d64c
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41d68b
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41d68b
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41d68b
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41d68b
cmp dword [ecx + 0x74], 0xe
jbe 0x41d68b
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x422381
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42cb40
push 0x42cb38
push str.FlsAlloc
push 0x1f
call fcn.0042229d
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4223b5
push dword [ebp + 8]
mov ecx, esi
call dword [0x42b1f4]
call esi
jmp 0x4223bb
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4223ff
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42cb50
push 0x42cb48
push str.FlsGetValue
push 0x21
call fcn.0042229d
mov esi, eax
add esp, 0x10
test esi, esi
je 0x422436
push dword [ebp + 8]
mov ecx, esi
call dword [0x42b1f4]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x42243e
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42cb58
push 0x42cb50
push str.FlsSetValue
push 0x22
call fcn.0042229d
mov esi, eax
add esp, 0x10
test esi, esi
je 0x422478
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x42b1f4]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x423c75
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x423d12
push ebx
push esi
call fcn.00423c3e
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00423bd2
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x423cbf
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x423d11
push edi
push eax
call fcn.004226df
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x423cdf
call fcn.00421742
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x423d10
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00423bd2
add esp, 0x20
test eax, eax
jne 0x423cfe
push edi
call fcn.00421742
jmp 0x423d06
push ebx
call fcn.00421742
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x4291c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4291ed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4291ed
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx