joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b5cf8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov ebx, dword [ebp + 0x10]
test ebx, ebx
js 0x4b5d11
shr ebx, 2
mov esi, dword [ecx + ebx*4]
dec ebx
push esi
jns 0x4b5d0a
mov ecx, esp
mov ebx, edx
test ebx, ebx
js 0x4b5d23
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x4b5d1c
mov eax, esp
mov dword [ebp - 4], ecx
push 5
lea ecx, [ebp - 0xa]
call fcn.004b58e0
mov ebx, 6
mov eax, dword [ebp - 4]
lea edx, [ebp - 0xa]
mov cl, byte [eax]
xor byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x4b5d3d
mov al, byte [ebp - 0xa]
xor edx, edx
mov dl, al
shr edx, 2
mov byte [ebp - 0x12], dl
and al, 3
shl eax, 4
mov dl, byte [ebp - 9]
xor ecx, ecx
mov cl, dl
shr ecx, 4
or al, cl
mov byte [ebp - 0x11], al
and dl, 0xf
shl edx, 2
mov al, byte [ebp - 8]
xor ecx, ecx
mov cl, al
shr ecx, 6
or dl, cl
mov byte [ebp - 0x10], dl
and al, 0x3f
mov byte [ebp - 0xf], al
mov al, byte [ebp - 7]
xor edx, edx
mov dl, al
shr edx, 2
mov byte [ebp - 0xe], dl
and al, 3
shl eax, 4
xor edx, edx
mov dl, byte [ebp - 6]
shr edx, 4
or al, dl
mov byte [ebp - 0xd], al
mov al, byte [ebp - 6]
and al, 0xf
shl eax, 2
xor edx, edx
mov dl, byte [ebp - 5]
shr edx, 6
or al, dl
mov byte [ebp - 0xc], al
mov al, byte [ebp - 5]
and al, 0x3f
mov byte [ebp - 0xb], al
xor ebx, ebx
lea esi, [ebp - 0x12]
mov eax, ebx
mov dl, byte [esi]
call fcn.004b59fc
mov byte [esi], al
inc ebx
inc esi
cmp ebx, 8
jne 0x4b5dc2
mov ebx, 4
lea eax, [ebp - 0x12]
lea edx, [ebp - 0xa]
mov cl, byte [eax]
shl ecx, 4
or cl, byte [eax + 1]
mov byte [edx], cl
inc edx
add eax, 2
dec ebx
jne 0x4b5ddf
lea eax, [ebp - 0xa]
mov edx, 5
call fcn.004b5970
mov ebx, 4
lea eax, [ebp - 0xa]
mov edx, dword [ebp + 0xc]
mov cl, byte [eax]
mov byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x4b5e08
mov esi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4b5e20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov ebx, ecx
test ebx, ebx
js 0x4b5e39
shr ebx, 2
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x4b5e32
mov edx, esp
mov dword [ebp - 4], edx
mov ebx, eax
mov dword [ebp - 8], 8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov dl, byte [eax]
mov byte [ecx], dl
inc ecx
inc eax
dec dword [ebp - 8]
jne 0x4b5e4d
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004b57c8
test bl, bl
jne 0x4b5f20
mov dword [ebp - 8], 0x10
mov dword [ebp - 0x14], 0x512c50
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
mov cl, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x4b5e84
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
mov cl, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x4b5e98
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004b5cf8
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov bl, byte [edx]
xor bl, byte [esi]
mov byte [ecx], bl
inc ecx
inc esi
inc edx
dec eax
jne 0x4b5eca
add dword [ebp - 0x14], 6
dec dword [ebp - 8]
jne 0x4b5e79
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ecx, [ebp - 0xc]
mov bl, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x4b5eed
mov eax, 4
mov edx, dword [ebp + 0xc]
mov cl, byte [edx]
mov byte [edx + 4], cl
inc edx
dec eax
jne 0x4b5efe
mov eax, 4
lea edx, [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
mov bl, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x4b5f12
jmp 0x4b5fdb
cmp bl, 1
jne 0x4b5fdb
mov dword [ebp - 8], 0xfffffff0
mov ebx, 0x512caa
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
mov cl, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x4b5f40
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
mov cl, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x4b5f54
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov ecx, ebx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004b5cf8
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov dword [ebp - 0x18], ecx
mov cl, byte [edx]
xor cl, byte [esi]
mov edi, dword [ebp - 0x18]
mov byte [edi], cl
inc dword [ebp - 0x18]
inc esi
inc edx
dec eax
jne 0x4b5f86
sub ebx, 6
inc dword [ebp - 8]
jne 0x4b5f35
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ebx, [ebp - 0xc]
mov cl, byte [edx]
mov byte [ebx], cl
inc ebx
inc edx
dec eax
jne 0x4b5fad
mov eax, 4
mov ebx, dword [ebp + 0xc]
mov dl, byte [ebx]
mov byte [ebx + 4], dl
inc ebx
dec eax
jne 0x4b5fbe
mov eax, 4
lea ebx, [ebp - 0xc]
mov edx, dword [ebp + 0xc]
mov cl, byte [ebx]
mov byte [edx], cl
inc edx
inc ebx
dec eax
jne 0x4b5fd2
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004b5854
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret 8
Function at 0x4b65c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b6631
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404d60
lea eax, [ebp - 0x106]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 0x10c]
lea eax, [ebp - 0x106]
call fcn.0040ab38
mov eax, dword [ebp - 0x10c]
mov edx, ebx
call fcn.004b6574
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b6638
lea eax, [ebp - 0x10c]
call fcn.00404d60
ret

Function at 0x4b704c
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov byte [ebp - 1], 0
lea eax, [ebp - 8]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
mov ebx, eax
test ebx, ebx
jne 0x4b7091
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x3f0
jne 0x4b7091
lea eax, [ebp - 8]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
mov ebx, eax
test ebx, ebx
je 0x4b7122
mov eax, 0x400
call fcn.00402b18
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 0x400
push esi
push 2
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_GetTokenInformation
mov ebx, eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
test ebx, ebx
je 0x4b711b
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
push 0x503fe8
call sub.advapi32.dll_AllocateAndInitializeSid
mov ebx, dword [esi]
dec ebx
test ebx, ebx
jl 0x4b7112
inc ebx
xor edi, edi
mov eax, dword [esi + edi*8 + 4]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x4b710e
mov byte [ebp - 1], 1
jmp 0x4b7112
inc edi
dec ebx
jne 0x4b70f6
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_FreeSid
mov eax, esi
call fcn.00402b48
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4b8ccc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, eax
mov byte [ebp - 1], 0
cmp dword [ebp + 8], 0
je 0x4b8d58
push ecx
push edx
push edi
call sub.kernel32.dll_FindResourceA
mov ebx, eax
test ebx, ebx
je 0x4b8d58
push ebx
push edi
call sub.kernel32.dll_LoadResource
mov esi, eax
test esi, esi
je 0x4b8d58
push esi
call sub.kernel32.dll_LockResource
mov dword [ebp - 8], eax
push esi
call sub.kernel32.dll_FreeResource
cmp dword [ebp - 8], 0
je 0x4b8d58
push ebx
push edi
call sub.kernel32.dll_SizeofResource
test eax, eax
je 0x4b8d58
xor edx, edx
push ebp
push 0x4b8d4e
push dword fs:[edx]
mov dword fs:[edx], esp
mov ecx, eax
test ecx, ecx
jns 0x4b8d35
call fcn.00403e70
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
call fcn.004215e4
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b8d58
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x4ddc88
Capabilities:
Create process on windows
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
xor eax, eax
push ebp
push 0x4dddb9
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push pe_nt_image_headers32
push 2
push 0
push 3
push 0x40000000
mov eax, dword [0x512d84]
call fcn.00405230
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x4ddd4b
mov dl, 1
mov eax, dword [0x41ba1c]
call fcn.00403f04
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4ddd3b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
mov ecx, 0x4dddc4
mov edx, 0x4dddc8
mov eax, dword [0x512668]
call fcn.004b8ccc
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_WriteFile_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ddd42
mov eax, dword [ebp - 8]
call fcn.00403f34
ret
push 1
push dword [0x512d84]
push 0x4ddddc
lea edx, [ebp - 0x18]
mov eax, dword [0x510e18]
mov eax, dword [eax]
call fcn.0048b630
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x14]
mov dl, 0x22
call fcn.004098a0
push dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004050f0
mov eax, dword [ebp - 0x10]
call fcn.00405230
push eax
call sub.kernel32.dll_WinExec
mov eax, dword [0x510e18]
mov eax, dword [eax]
call fcn.0048af98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dddc0
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00404d84
ret

Function at 0x4e39a8
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
mov dword [ebp - 4], 7
push 0
lea eax, [ebp - 4]
push eax
call sub.wininet.dll_InternetGetConnectedState
test eax, eax
je 0x4e39c9
mov bl, 1
jmp 0x4e39dd
push 0
push 1
push 0x4e39e4
call sub.wininet.dll_InternetCheckConnectionA
test eax, eax
je 0x4e39dd
mov bl, 1
mov eax, ebx
pop ebx
pop ecx
pop ebp
ret

Function at 0x401000
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0
nop
mov eax, section..data
push eax
call sub.msvcrt.dll_puts
add esp, 4
mov eax, str.pause
push eax
call sub.msvcrt.dll_system
add esp, 4
leave
ret
Function at 0x438ca9
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x438a14
and edi, edi
sub eax, edi
call fcn.00438cee
add eax, eax
push edi
pop edi
xor dword [edx], esi
push edi
pop eax
sub eax, 1
inc edx
or edi, edi
sub edi, 1
cmp edx, ebx
jne fcn.00438ca9
sub esp, 4
mov dword [esp], edi
pop eax
inc eax
add eax, 0xdc9db0db
ret
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x7a324499
nop
nop
nop
nop
test eax, eax
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x1eef52a9
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x1d1932dd
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x42e04e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x322e4ecc
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x40c08e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x40c09d
pop dword [ebp - 4]
mov eax, 0x40c09d
sub dword [ebp - 4], eax
mov dword [ebp - 0x14], 0x5fbd1a2e
sub dword [ebp - 0x14], 0x116ad4e3
mov dword [ebp - 0x10], 0x4f20d3c0
add dword [ebp - 0x10], 0xe3127885
mov dword [ebp - 0xc], 0x31918157
add dword [ebp - 0xc], 0x1abac2d7
mov dword [ebp - 8], 0xb064ae
sub dword [ebp - 8], 0xb064ae
lea eax, [ebp - 0x14]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 4]
call dword [eax]
mov dword [ebp - 0x14], 0x3b8c4c10
add dword [ebp - 0x14], 0x38e61d46
mov dword [ebp - 0x10], 0xf46230be
add dword [ebp - 0x10], 0x4d0a30b7
mov dword [ebp - 0xc], 0xac6a9535
add dword [ebp - 0xc], 0xb704d737
mov dword [ebp - 8], 0xcaac1a3e
add dword [ebp - 8], 0x3553e5c2
lea ebx, [ebp - 0x14]
push ebx
push eax
mov eax, 0xff521404
add eax, 0xeebc30
add eax, dword [ebp - 4]
call dword [eax]
push 0x40
push 0x1000
push 0x378c0
push 0
call eax
mov ecx, 0x92a2d72b
sub ecx, 0x92a29034
mov ebx, eax
mov esi, 0x415400
add esi, dword [ebp - 4]
mov edx, 0x68925450
mov edi, dword [esi]
xor edi, edx
mov dword [ebx], edi
add ebx, 0x234e5a4f
add ebx, 0xdcb1a5b5
add esi, 0x9d8f5355
sub esi, 0x9d8f5351
loop 0x40c1a9
add eax, 0x2ce4cdf3
sub eax, 0x2ce3bf44
xor ebx, ebx
add ebx, eax
add eax, 0xcafd0a0d
add eax, 0x3502f5f8
mov ecx, 0x4b0bc728
sub ecx, 0x4acbc728
add ecx, dword [ebp - 4]
call ebx
leave
ret

Function at 0x408942
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x4085d8
and esi, esi
sub ecx, ecx
call fcn.00408969
sub esi, esi
xor dword [edx], eax
inc edx
cmp edx, ebx
jne fcn.00408942
sub ecx, 0x66b7651e
ret
Function at 0x4011b0
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x403004]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x418], 0xffffffff
push eax
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetCommandLineW]
push eax
call main
add esp, 8
mov edi, eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
test eax, eax
jne 0x401213
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004012f2
mov esp, ebp
pop ebp
ret
push esi
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call sub.VCRUNTIME140_APP.dll_wcsrchr
mov esi, eax
add esp, 8
test esi, esi
jne 0x40123e
push dword [ebp - 0x418]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
lea ecx, [ebp - 0x20c]
mov eax, esi
sub eax, ecx
sar eax, 1
push eax
mov eax, ecx
push eax
lea eax, [ebp - 0x414]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
add esp, 0x10
test eax, eax
js 0x4012d6
push str.entrypoint
lea eax, [ebp - 0x414]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
test eax, eax
js 0x4012d6
push esi
lea eax, [ebp - 0x414]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
test eax, eax
js 0x4012d6
lea eax, [ebp - 0x418]
push eax
lea eax, [edi + 4]
push eax
mov eax, dword [ebp - 0x41c]
dec eax
push eax
lea eax, [ebp - 0x414]
push eax
call sub.UWPHOST.dll_ExecuteAssembly
add esp, 0x10
push dword [ebp - 0x418]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop edi
call fcn.004012f2
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x47f060]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
push 1
lea eax, [ebp - 0x18]
push eax
mov edi, ecx
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push 1
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
xorps xmm0, xmm0
movq qword [ebp - 0x24], xmm0
lea eax, [ebp - 0x18]
push esi
mov dword [ebp - 0x20], eax
push 0
lea eax, [ebp - 0x24]
mov dword [ebp - 0x1c], 0
push eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x24], 0xc
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
call esi
cmp eax, 0xb7
jne 0x40107c
push 0
call dword [sym.imp.MSVCR110.dll_exit]
call esi
cmp eax, 0xb7
jne 0x40108d
push 0
call dword [sym.imp.MSVCR110.dll_exit]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.00452076
mov esp, ebp
pop ebp
ret 4
Function at 0x403250
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4542b7
mov eax, dword fs:[0]
push eax
sub esp, 0x274
mov eax, dword [0x47f060]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x27c], 0
mov dword [ebp - 0x264], 7
mov dword [ebp - 0x268], 0
mov word [ebp - 0x278], ax
lea edx, [ebp - 0x278]
lea ecx, [ebp - 0x27c]
mov dword [ebp - 4], eax
call fcn.00429c10
test al, al
je 0x40344e
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x403300
mov ebx, dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
sub ecx, edx
sar ecx, 1
test ecx, ecx
jle 0x40334b
cmp dword [ebp - 0x268], ecx
jb 0x40334b
cmp dword [ebp - 0x264], 8
lea eax, [ebp - 0x278]
cmovae eax, dword [ebp - 0x278]
push ecx
push eax
lea eax, [ebp - 0x218]
push eax
call ebx
test eax, eax
jne 0x40334b
mov bl, 1
jmp 0x403450
cmp dword [ebp - 0x264], 8
lea eax, [ebp - 0x278]
cmovae eax, dword [ebp - 0x278]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov dword [ebp - 0x27c], eax
push 0xc
xor eax, eax
push str.explorer.exe
lea ecx, [ebp - 0x260]
mov dword [ebp - 0x24c], 7
mov dword [ebp - 0x250], 0
mov word [ebp - 0x260], ax
call fcn.00406c00
mov byte [ebp - 4], 1
push 0xa
xor eax, eax
push str.devenv.exe
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x234], 7
mov dword [ebp - 0x238], 0
mov word [ebp - 0x248], ax
call fcn.00406c00
mov byte [ebp - 4], 2
push 7
xor eax, eax
push str.cmd.exe
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
call fcn.00406c00
xor edi, edi
lea esi, [ebp - 0x260]
lea esp, [esp]
cmp dword [esi + 0x14], 8
jb 0x40341a
mov eax, dword [esi]
jmp 0x40341c
mov eax, esi
push dword [esi + 0x10]
push dword [ebp - 0x27c]
push eax
call ebx
test eax, eax
je 0x403486
inc edi
add esi, 0x18
cmp edi, 3
jl 0x403410
push fcn.00401100
push 3
push 0x18
lea eax, [ebp - 0x260]
push eax
mov byte [ebp - 4], 0
call fcn.004521cc
xor bl, bl
cmp dword [ebp - 0x264], 8
jb 0x403468
push dword [ebp - 0x278]
call dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00452076
mov esp, ebp
pop ebp
ret
push fcn.00401100
push 3
push 0x18
lea eax, [ebp - 0x260]
push eax
mov byte [ebp - 4], 0
call fcn.004521cc
mov bl, 1
jmp 0x403450