joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433dc0
Capabilities:
Encode data using xor
Hash data using sha1
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x5c
mov ebp, dword [esp + 0x74]
mov eax, dword [esp + 0x70]
mov dword [esp + 0x14], 0xc3d2e1f0
mov dword [esp + 0x10], 0x10325476
mov dword [esp + 0xc], 0x98badcfe
mov dword [esp + 8], 0xefcdab89
mov dword [esp + 4], 0x67452301
cmp ebp, 0x40
jb 0x433e7d
mov edi, ebp
shr edi, 6
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebp, eax
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [ebp + esi]
mov dword [esp + esi + 0x1c], eax
movzx ecx, byte [ebp + esi + 1]
shl ecx, 8
or ecx, eax
mov dword [esp + esi + 0x1c], ecx
movzx eax, byte [ebp + esi + 2]
shl eax, 0x10
or eax, ecx
mov dword [esp + esi + 0x1c], eax
movzx ecx, byte [ebp + esi + 3]
shl ecx, 0x18
or ecx, eax
mov dword [esp + esi + 0x1c], ecx
add esi, 4
cmp esi, 0x40
jne 0x433e20
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 8]
push eax
call fcn.00434730
add esp, 8
inc ebx
lea eax, [esi + ebp]
cmp ebx, edi
jne 0x433e10
add ebp, esi
mov eax, ebp
mov ebp, dword [esp + 0x74]
mov dword [esp + 0x58], 0
mov dword [esp + 0x54], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov ecx, ebp
and ecx, 0x3f
mov dword [esp], ecx
je 0x433f74
mov ecx, ebp
and ecx, 1
xor edi, edi
cmp dword [esp], 1
je 0x433f5d
mov dword [esp + 0x18], ecx
sub dword [esp], ecx
xor ebx, ebx
xor edi, edi
nop
movzx ebp, byte [eax + edi]
mov ecx, ebx
and cl, 0x10
shl ebp, cl
mov edx, edi
and edx, 0xfffffffc
xor ebp, dword [esp + edx + 0x1c]
mov dword [esp + edx + 0x1c], ebp
movzx esi, byte [eax + edi + 1]
or cl, 8
shl esi, cl
xor esi, ebp
mov dword [esp + edx + 0x1c], esi
add edi, 2
add ebx, 0x10
cmp dword [esp], edi
jne 0x433f20
add eax, edi
mov ebp, dword [esp + 0x74]
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x433f74
movzx eax, byte [eax]
lea ecx, [edi*8]
shl eax, cl
and edi, 0xfffffffc
xor dword [esp + edi + 0x1c], eax
lea ebx, [ebp*8]
mov ecx, ebx
and cl, 0x18
or cl, 7
mov eax, 1
shl eax, cl
mov ecx, ebp
and ecx, 0x3c
xor dword [esp + ecx + 0x1c], eax
mov esi, dword [esp + 0x78]
mov eax, ebp
not eax
test al, 0x38
jne 0x433fc5
lea edi, [esp + 0x1c]
lea eax, [esp + 4]
push edi
push eax
call fcn.00434730
add esp, 8
xor eax, eax
mov ecx, 0x10
rep stosd dword es:[edi], eax
lea edi, [esp + 0x5c]
xor eax, eax
xor ecx, ecx
rep stosw word es:[edi], ax
mov dword [esp + 0x54], ebx
shr ebp, 0x1d
mov dword [esp + 0x58], ebp
lea eax, [esp + 0x1c]
lea ecx, [esp + 4]
push eax
push ecx
call fcn.00434730
add esp, 8
mov eax, dword [esp + 4]
mov dword [esi], eax
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
mov eax, dword [esp + 0xc]
mov dword [esi + 8], eax
mov eax, dword [esp + 0x10]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 0x10], eax
add esp, 0x5c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x437380
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, esp
push eax
sub esp, 0x1c
mov edi, esp
and edi, 0xfffffff8
mov esp, edi
push eax
sub esp, 0x24
mov ecx, esp
and ecx, 0xfffffff8
mov esp, ecx
push eax
sub esp, 0x1c
mov eax, esp
and eax, 0xfffffff8
mov esp, eax
mov dword [esi + 0x34], ecx
mov dword [esi + 0x30], eax
mov dword [esi + 8], 0x93ec91e0
mov dword [esi + 0xc], 0x9fe89dfe
mov dword [esi + 0x10], 0x9bae99ea
mov dword [esi + 0x14], 0xa7d0a5f6
mov dword [esi + 0x18], 0xa3a0a1d2
mov dword [esi + 0x1c], 0
mov dword [esi + 4], 0
mov eax, dword [esi + 4]
cmp eax, 0x17
ja 0x437432
nop
nop
mov eax, dword [esi + 4]
mov ecx, dword [esi + 4]
movzx ecx, byte [esi + ecx + 8]
lea edx, [eax + 0x10e93]
add eax, 0x93
and eax, ecx
or edx, ecx
sub edx, eax
mov dword [esi], edx
mov eax, dword [esi]
add al, 0xfb
mov ecx, dword [esi + 4]
mov byte [esi + ecx + 8], al
mov eax, dword [esi + 4]
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
mov dword [esi + 4], eax
mov eax, dword [esi + 4]
cmp eax, 0x18
jb 0x4373f0
lea ebx, [esi + 8]
push ebx
call fcn.00439490
add esp, 4
mov ecx, eax
mov dword [0x451c8c], eax
xor eax, eax
test ecx, ecx
sete al
mov eax, dword [eax*4 + 0x4465c8]
mov edx, 0xa3244cf8
xor edx, dword [0x4465d0]
add edx, eax
inc edx
xor eax, eax
jmp edx

Function at 0x4399f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov dword [esp + 0x18], 0x8b8485d6
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x23], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xe
ja 0x439a7c
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x18]
add eax, 0x45560415
mov edx, eax
and edx, ecx
mov esi, eax
xor esi, ecx
not ecx
or eax, ecx
add ecx, esi
add eax, edx
sub ecx, eax
lea eax, [ecx + edx*2]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov ecx, eax
xor ecx, 0x6c
and eax, 0x6c
lea eax, [ecx + eax*2]
inc al
mov ecx, dword [esp]
mov byte [esp + ecx + 0x18], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xf
jb 0x439a30
mov eax, dword [esp + 0x18]
mov eax, dword fs:[eax]
mov ecx, dword [0x447df0]
mov edx, 0x44e9455b
xor edx, dword [0x447df4]
add ecx, edx
inc ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp ecx
Function at 0x4054ce
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [0x4088a4], eax
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0xcf0000
push 0x4082b0
push 0x4082bc
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x405516
xor eax, eax
jmp 0x405567
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0
push 0x1b58
push 0x7ee
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [0x4088a8], 0
mov dword [0x4088a0], 0
mov dword [0x408898], 1
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401000
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
cmp dword [0x424a28], 0
push esi
push edi
jne 0x401117
push 1
xor eax, eax
pop esi
lea edi, [ebp - 0x118]
push 0x46
mov dword [0x424a28], esi
pop ecx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x11c], 0x11c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x401117
push 2
pop ecx
cmp dword [ebp - 0x10c], ecx
jne 0x401117
mov edx, dword [ebp - 0x118]
cmp edx, 4
jbe 0x401117
push 5
pop edi
cmp edx, edi
jne 0x4010cb
cmp dword [ebp - 0x114], 0
jne 0x401082
mov eax, ecx
jmp 0x401110
cmp dword [ebp - 0x114], esi
jne 0x4010bb
mov ax, word [ebp - 8]
test ax, ax
jne 0x401097
push 3
jmp 0x4010ec
cmp ax, si
jne 0x4010a0
push 4
jmp 0x4010ec
cmp ax, cx
jne 0x4010a9
push 6
jmp 0x4010ec
cmp ax, 3
jne 0x4010fe
mov dword [0x424a24], 7
jmp 0x4010fe
cmp dword [ebp - 0x114], ecx
jne 0x4010fe
mov dword [0x424a24], edi
jmp 0x4010fe
cmp edx, 6
jne 0x4010fe
mov eax, dword [ebp - 0x114]
test eax, eax
jne 0x4010de
push 8
jmp 0x4010ec
cmp eax, esi
jne 0x4010e6
push 9
jmp 0x4010ec
cmp eax, ecx
jne 0x4010ef
push 0xa
pop eax
jmp 0x401110
cmp eax, 3
jne 0x4010fe
mov dword [0x424a24], 0xb
mov eax, dword [0x424a24]
test eax, eax
jne 0x40111c
cmp edx, edi
sbb eax, eax
and al, 0xf5
add eax, 0xc
mov dword [0x424a24], eax
jmp 0x40111c
mov eax, dword [0x424a24]
pop edi
pop esi
leave
ret

Function at 0x401120
Capabilities:
Check if file exists
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4008
call fcn.0041be40
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
cmp ebx, edi
mov dword [ebp - 4], edi
je 0x4011fb
cmp dword [ebp + 0xc], edi
je 0x4011fb
mov esi, dword [ebp + 0x10]
cmp esi, edi
je 0x4011fb
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4011fb
mov word [ebp - 0x4008], di
mov ecx, 0xfff
xor eax, eax
lea edi, [ebp - 0x4006]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp + 0x10]
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x4011fb
cmp eax, 0x2000
ja 0x4011fb
lea ecx, [ebp - 0x4008]
push ecx
push eax
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4011f6
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x4008]
push 0x42209c
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4011f6
mov eax, dword [ebp + 8]
movzx ecx, word [eax + 0xc]
push ecx
mov ecx, dword [eax + 0xc]
shr ecx, 0x10
push ecx
movzx ecx, word [eax + 8]
mov eax, dword [eax + 8]
push ecx
shr eax, 0x10
push eax
dec esi
push 0x422084
push esi
push dword [ebp + 0xc]
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x1c
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
jmp 0x4011fd
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40135e
Capabilities:
Check if file exists
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
je 0x4013e6
mov esi, dword [ebp + 0xc]
cmp esi, ebx
je 0x4013e6
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x206]
mov word [ebp - 0x208], bx
push ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x208]
push 0x26
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x208]
push str.Internet_Exploreriexplore.exe
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
pop edi
je 0x4013e2
lea eax, [ebp - 0x208]
dec esi
push eax
push 0x4220a0
push esi
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
push 1
pop ebx
mov eax, ebx
jmp 0x4013e8
xor eax, eax
pop esi
pop ebx
leave
ret

Function at 0x4013ec
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x288
push esi
xor esi, esi
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x40140d
push 1
pop eax
jmp 0x4014a0
push edi
push 0x1f
pop ecx
xor eax, eax
lea edi, [ebp - 0x7e]
mov word [ebp - 0x80], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push str.JUZITEST__d.tmp
lea eax, [ebp - 0x80]
push 0x3f
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x286]
mov word [ebp - 0x288], si
rep stosd dword es:[edi], eax
add esp, 0x10
stosw word es:[edi], ax
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x288]
push dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push esi
push 0x80
push 2
push esi
push esi
lea eax, [ebp - 0x288]
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
pop edi
je 0x40149e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x288]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 1
pop esi
mov eax, esi
pop esi
leave
ret

Function at 0x4014a3
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x40153d
cmp word [esi], 0
je 0x40153d
mov ebx, dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
push esi
call ebx
test eax, eax
je 0x4014d1
push 1
pop eax
jmp 0x40153f
and word [ebp - 0x208], 0
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x206]
push esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x4220a0
lea eax, [ebp - 0x208]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
pop edi
je 0x40153d
lea eax, [ebp - 0x208]
push eax
call ebx
test eax, eax
jne 0x401532
lea eax, [ebp - 0x208]
push eax
call fcn.004014a3
pop ecx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x40153f
xor eax, eax
pop esi
pop ebx
leave
ret
Function at 0x401543
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x86c
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
je 0x4016bd
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x4016bd
and dword [ebp - 0x254], 0
mov ecx, 0x93
xor eax, eax
lea edi, [ebp - 0x250]
rep stosd dword es:[edi], eax
mov ax, word [0x424a2c]
mov ebx, 0x81
mov word [ebp - 0x86c], ax
mov ecx, ebx
xor eax, eax
lea edi, [ebp - 0x86a]
rep stosd dword es:[edi], eax
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 0x422114
push dword [ebp + 8]
stosw word es:[edi], ax
lea eax, [ebp - 0x86c]
push eax
call esi
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x86c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x4016bd
mov edi, dword [sym.imp.MSVCRT.dll_wcscmp]
lea eax, [ebp - 0x228]
push 0x422110
push eax
call edi
pop ecx
test eax, eax
pop ecx
je 0x401683
lea eax, [ebp - 0x228]
push 0x422108
push eax
call edi
pop ecx
test eax, eax
pop ecx
je 0x401683
test byte [ebp - 0x254], 0x10
mov ax, word [0x424a2c]
je 0x40164e
mov word [ebp - 0x45c], ax
mov ecx, ebx
xor eax, eax
lea edi, [ebp - 0x45a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x45c]
push dword [ebp + 8]
push eax
call esi
lea eax, [ebp - 0x45c]
push eax
call fcn.00401543
jmp 0x401682
mov word [ebp - 0x664], ax
mov ecx, ebx
xor eax, eax
lea edi, [ebp - 0x662]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x664]
push dword [ebp + 8]
push eax
call esi
lea eax, [ebp - 0x664]
push eax
call fcn.00401a3c
pop ecx
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4015d7
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x80
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x4016bf
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4016c4
Capabilities:
Check if file exists
Copy file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
push esi
push edi
xor edi, edi
cmp dword [ebp + 8], edi
mov dword [ebp - 4], edi
je 0x401822
cmp dword [ebp + 0xc], edi
je 0x401822
cmp dword [ebp + 0x10], edi
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
je 0x4016fe
push dword [ebp + 0xc]
call esi
test eax, eax
jne 0x401822
mov word [ebp - 0x414], di
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x412]
rep stosd dword es:[edi], eax
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll__snwprintf]
push dword [ebp + 0xc]
stosw word es:[edi], ax
push 0x4220a0
lea eax, [ebp - 0x414]
push 0x103
push eax
call ebx
add esp, 0x10
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x414]
push eax
call fcn.004014a3
test eax, eax
pop ecx
je 0x40181c
cmp dword [ebp + 0x10], 0
je 0x401782
push dword [ebp + 0xc]
call esi
test eax, eax
jne 0x40181c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov dword [ebp - 4], eax
jmp 0x40181c
and word [ebp - 0x20c], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push edi
push 0x42211c
push 0x103
push eax
call ebx
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call esi
test eax, eax
je 0x4017cf
lea eax, [ebp - 0x20c]
push eax
call fcn.00401a3c
pop ecx
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileW]
lea eax, [ebp - 0x20c]
push eax
push edi
call ebx
push edi
mov dword [ebp + 0xc], eax
call esi
test eax, eax
jne 0x4017f7
push eax
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0
je 0x40181c
cmp dword [ebp - 4], 0
jne 0x40180f
lea eax, [ebp - 0x20c]
push edi
push eax
call ebx
jmp 0x40181c
lea eax, [ebp - 0x20c]
push eax
call fcn.00401a3c
pop ecx
mov eax, dword [ebp - 4]
pop ebx
jmp 0x401824
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x401828
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ecx
push ebp
push edi
push 0x42213c
xor ebp, ebp
push dword [esp + 0x14]
mov dword [esp + 0x10], ebp
call dword [sym.imp.MSVCRT.dll__wfopen]
mov edi, eax
pop ecx
cmp edi, ebp
pop ecx
je 0x4018d2
push ebx
push esi
mov esi, dword [sym.imp.MSVCRT.dll_fseek]
push 2
push ebp
push edi
call esi
push edi
call dword [sym.imp.MSVCRT.dll_ftell]
push ebp
push ebp
push edi
mov ebx, eax
call esi
lea ebp, [ebx + 1]
push ebp
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
add esp, 0x20
test esi, esi
je 0x4018c8
push ebp
push 0
push esi
call sub.MSVCRT.dll_memset
push edi
push ebx
push 1
push esi
call dword [sym.imp.MSVCRT.dll_fread]
push 0x422134
push dword [esp + 0x3c]
call dword [sym.imp.MSVCRT.dll__wfopen]
mov ebp, eax
add esp, 0x24
test ebp, ebp
je 0x4018c1
push ebp
push ebx
push 1
pop ebx
push ebx
push esi
call dword [sym.imp.MSVCRT.dll_fwrite]
push ebp
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
mov dword [esp + 0x10], ebx
push esi
call fcn.0041be20
pop ecx
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
pop ecx
pop esi
pop ebx
mov eax, dword [esp + 8]
pop edi
pop ebp
pop ecx
ret
Function at 0x4018da
Capabilities:
Check if file exists
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
push esi
push edi
xor edi, edi
cmp dword [ebp + 8], edi
mov dword [ebp - 4], edi
je 0x401a36
cmp dword [ebp + 0xc], edi
je 0x401a36
cmp dword [ebp + 0x10], edi
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
je 0x401914
push dword [ebp + 0xc]
call esi
test eax, eax
jne 0x401a36
mov word [ebp - 0x414], di
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x412]
rep stosd dword es:[edi], eax
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll__snwprintf]
push dword [ebp + 0xc]
stosw word es:[edi], ax
push 0x4220a0
lea eax, [ebp - 0x414]
push 0x103
push eax
call ebx
add esp, 0x10
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x414]
push eax
call fcn.004014a3
test eax, eax
pop ecx
je 0x401a30
cmp dword [ebp + 0x10], 0
je 0x401996
push dword [ebp + 0xc]
call esi
test eax, eax
jne 0x401a30
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401828
pop ecx
mov dword [ebp - 4], eax
pop ecx
jmp 0x401a30
and word [ebp - 0x20c], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push edi
push 0x42211c
push 0x103
push eax
call ebx
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call esi
test eax, eax
je 0x4019e3
lea eax, [ebp - 0x20c]
push eax
call fcn.00401a3c
pop ecx
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileW]
lea eax, [ebp - 0x20c]
push eax
push edi
call ebx
push edi
mov dword [ebp + 0xc], eax
call esi
test eax, eax
jne 0x401a0b
push edi
push dword [ebp + 8]
call fcn.00401828
pop ecx
mov dword [ebp - 4], eax
pop ecx
cmp dword [ebp + 0xc], 0
je 0x401a30
cmp dword [ebp - 4], 0
jne 0x401a23
lea eax, [ebp - 0x20c]
push edi
push eax
call ebx
jmp 0x401a30
lea eax, [ebp - 0x20c]
push eax
call fcn.00401a3c
pop ecx
mov eax, dword [ebp - 4]
pop ebx
jmp 0x401a38
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x401c99
Capabilities:
Create shortcut via ishelllink

Disassembly:
mov eax, 0x41c32c
call fcn.0041be90
sub esp, 0x214
push ebx
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ebx
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 1
push eax
push 0x41dcf0
push 1
push ebx
push 0x41dd00
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x401d9c
mov eax, dword [ebp - 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x50]
cmp dword [ebp + 0x14], 0xffffffff
je 0x401cfb
mov eax, dword [ebp - 0x10]
push dword [ebp + 0x14]
mov ecx, dword [eax]
push esi
jmp 0x401d09
cmp dword [ebp + 0x18], ebx
je 0x401d0d
mov eax, dword [ebp - 0x10]
push ebx
push dword [ebp + 0x18]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x44]
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x21e]
mov word [ebp - 0x220], bx
rep stosd dword es:[edi], eax
push esi
stosw word es:[edi], ax
call dword [sym.imp.MSVCRT.dll_wcslen]
push eax
lea eax, [ebp - 0x220]
push esi
push eax
call dword [sym.imp.MSVCRT.dll_wcsncpy]
add esp, 0x10
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x220]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
cmp dword [ebp + 0x10], ebx
pop edi
pop esi
je 0x401d6e
mov eax, dword [ebp - 0x10]
push dword [ebp + 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x14]
push edx
push 0x41dd10
mov ecx, dword [eax]
push eax
call dword [ecx]
test eax, eax
jl 0x401d9c
mov eax, dword [ebp - 0x14]
push 2
push dword [ebp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
test eax, eax
jl 0x401d9c
mov dword [ebp - 0x18], 1
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], bl
cmp eax, ebx
je 0x401dac
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
cmp eax, ebx
pop ebx
je 0x401dbe
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], ecx
leave
ret
Function at 0x402231
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x66c
push esi
xor esi, esi
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x402366
push edi
mov ecx, 0x103
xor eax, eax
lea edi, [ebp - 0x66a]
mov word [ebp - 0x66c], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp + 0xc]
cmp eax, esi
je 0x402293
cmp word [eax], si
je 0x402293
push eax
lea eax, [ebp - 0x66c]
push dword [ebp + 8]
push str.__s___s
push 0x207
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x14
jmp 0x4022b0
push dword [ebp + 8]
lea eax, [ebp - 0x66c]
push str.__s_
push 0x207
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
push dword [ebp + 8]
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x25a]
mov word [ebp - 0x25c], si
push 0x4220a0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x25c]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x10
xor eax, eax
pop ecx
lea edi, [ebp - 0x50]
rep stosd dword es:[edi], eax
lea edi, [ebp - 0xc]
mov dword [ebp - 0x10], esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x54], 0x44
push eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x25c]
push eax
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x66c]
push esi
push eax
push dword [ebp + 8]
mov dword [ebp - 0x28], 0x80
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x402363
cmp dword [ebp + 0x10], esi
je 0x402350
push dword [ebp + 0x10]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x402353
push 1
pop esi
push dword [ebp - 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x10]
call edi
mov eax, esi
pop edi
pop esi
leave
ret