joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10016030
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x100161f4
pushal
mov esi, section.UPX1
lea edi, [esi - 0x9000]
push edi
jmp 0x1001605a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x10016061
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10016050
mov eax, 1
add ebx, ebx
jne 0x10016073
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x10016068
jne 0x10016084
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10016068
xor ecx, ecx
sub eax, 3
jb 0x10016098
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1001610a
mov ebp, eax
add ebx, ebx
jne 0x100160a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x100160b0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x100160d4
inc ecx
add ebx, ebx
jne 0x100160c0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x100160b5
jne 0x100160d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x100160b5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x100160f4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x100160e5
jmp 0x10016056
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x100160f4
add edi, ecx
jmp 0x10016056
pop esi
mov edi, esi
mov ecx, 0xa9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x10016112
cmp byte [edi], 3
jne 0x10016112
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x10016117
lea edi, [esi + 0x14000]
mov eax, dword [edi]
or eax, eax
je 0x10016186
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x16088]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x16148]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x10016144
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1614c]
or eax, eax
je 0x10016180
mov dword [ebx], eax
add ebx, 4
jmp 0x10016161
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x100161b7
cmp al, 0xef
ja 0x100161aa
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x1001618c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x10016199
mov ebp, dword [esi + 0x16150]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x100161eb
sub esp, 0xffffff80
jmp 0x10002168
Function at 0x41e120
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x12000]
push edi
or ebp, 0xffffffff
jmp 0x41e142
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41e149
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41e138
mov eax, 1
add ebx, ebx
jne 0x41e15b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41e150
jne 0x41e16c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41e150
xor ecx, ecx
sub eax, 3
jb 0x41e180
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41e1f2
mov ebp, eax
add ebx, ebx
jne 0x41e18b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41e198
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41e1bc
inc ecx
add ebx, ebx
jne 0x41e1a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41e19d
jne 0x41e1b9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41e19d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41e1dc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41e1cd
jmp 0x41e13e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41e1dc
add edi, ecx
jmp 0x41e13e
pop esi
mov edi, esi
mov ecx, 0x905
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41e1fa
cmp byte [edi], 5
jne 0x41e1fa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x41e1ff
lea edi, [esi + 0x1c000]
mov eax, dword [edi]
or eax, eax
je 0x41e26e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1f578]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1f62c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41e22c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1f630]
or eax, eax
je 0x41e268
mov dword [ebx], eax
add ebx, 4
jmp 0x41e249
call dword [esi + 0x1f634]
popal
jmp 0x40eca4

Function at 0xfe4adc
Capabilities:
Encode data using xor

Disassembly:
jmp 0xfe4ae6
pushal
call 0xfe4aec
pop ebp
sub ebp, 0x10
sub ebp, 0xbe4adc
jmp 0xfe4b02
mov eax, 0xbe4adc
add eax, ebp
add eax, 0x4c
mov ecx, 0x5cb
mov edx, 0xdf222c0
xor byte [eax], dl
inc eax
dec ecx
jne 0xfe4b19
jmp 0xfe4b2c
dec ebx
or eax, 0xc0fc494b
rol al, 0x41
add dword [eax], edi
rol al, 0xc0
ret
Function at 0x430001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x3b91120b
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
mov ecx, 0x2d334f4a
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x4057f1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.004048ba
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c

Function at 0x405d6b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
dec edi
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
clc
invalid
jmp [ebp - 0x3a]
test eax, esp
clc
invalid
dec dword [edi - 0x3a]
test ecx, esp
clc
invalid
call dword [edx - 0x3a]
test edx, esp
clc
invalid
dec dword [ecx - 0x3a]
test ebx, esp
clc
invalid
call [eax - 0x3a]
test esp, esp
clc
invalid
call [esi - 0x3a]
test ebp, esp
clc
invalid
dec dword [ecx - 0x3a]
test esi, esp
clc
invalid
invalid
cmp eax, 0xffeb17e8
invalid
cmp eax, dword [esi - 0x7a72ee3a]
aam 0xf8
invalid
Function at 0x401046
Capabilities:
Access peb ldr_data

Disassembly:
jmp 0x4186b0
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x468db8
push eax
mov dword fs:[0], esp
push ebx
push esi
mov esi, dword [esp + 0x18]
mov ebx, ecx
push edi
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x41872d
mov edi, dword [sym.imp.MSVCRT.dll_strchr]
push 0x3d
push esi
call edi
add esp, 8
test eax, eax
jne 0x41872d
push 0x3b
push esi
call edi
add esp, 8
test eax, eax
jne 0x41872d
lea ecx, [esp + 0x1c]
call fcn.0041ca70
lea eax, [esp + 0x1c]
mov ecx, ebx
push eax
push esi
mov dword [esp + 0x1c], 0
call fcn.0040138e
test eax, eax
jne 0x418743
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call fcn.0041d520
xor eax, eax
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 8
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx - 8]
cdq
sub eax, edx
mov esi, eax
sar esi, 1
inc esi
push esi
call sub.MFC42u.DLL_operatornew
mov ecx, esi
mov ebx, eax
mov edx, ecx
xor eax, eax
mov edi, ebx
push esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push ebx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x28]
push eax
call fcn.00431fd0
mov ecx, dword [esp + 0x30]
add esp, 0x10
push ebx
call fcn.0041d7e0
push ebx
call sub.MFC42u.DLL_operatordelete
add esp, 4
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call fcn.0041d520
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov eax, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 8

Function at 0x401064
Capabilities:
Access peb ldr_data

Disassembly:
jmp 0x418810
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x468dd8
push eax
mov dword fs:[0], esp
push ebx
push esi
mov esi, dword [esp + 0x18]
mov ebx, ecx
push edi
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x41888d
mov edi, dword [sym.imp.MSVCRT.dll_strchr]
push 0x3d
push esi
call edi
add esp, 8
test eax, eax
jne 0x41888d
push 0x3b
push esi
call edi
add esp, 8
test eax, eax
jne 0x41888d
lea ecx, [esp + 0x1c]
call fcn.0041ca70
lea eax, [esp + 0x1c]
mov ecx, ebx
push eax
push esi
mov dword [esp + 0x1c], 0
call fcn.0040138e
test eax, eax
jne 0x4188a3
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call fcn.0041d520
xor eax, eax
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 8
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx - 8]
cdq
sub eax, edx
sar eax, 1
inc eax
lea ebx, [eax + eax]
push ebx
call sub.MFC42u.DLL_operatornew
mov ecx, ebx
mov esi, eax
mov edx, ecx
xor eax, eax
mov edi, esi
push ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push esi
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x28]
push eax
call fcn.00431fd0
mov ecx, dword [esp + 0x30]
add esp, 0x10
push esi
call fcn.004231e0
push esi
call sub.MFC42u.DLL_operatordelete
add esp, 4
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call fcn.0041d520
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov eax, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 8
Function at 0x401087
Capabilities:
Get hostname
Resolve dns

Disassembly:
jmp 0x4088c0
sub esp, 0x100
push edi
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 5]
mov byte [esp + 4], 0
push pe_nt_image_headers32
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 8]
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
jne 0x4088fd
xor eax, eax
pop edi
add esp, 0x100
ret 8
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov edi, eax
test edi, edi
jne 0x408918
pop edi
add esp, 0x100
ret 8
mov ecx, dword [edi + 0xc]
xor eax, eax
cmp dword [ecx], 0
je 0x408952
push ebx
mov ebx, dword [esp + 0x110]
push esi
mov esi, dword [esp + 0x110]
xor edx, edx
cmp eax, ebx
jge 0x408944
mov ecx, dword [edx + ecx]
inc eax
add esi, 4
mov ecx, dword [ecx]
mov dword [esi - 4], ecx
mov ecx, dword [edi + 0xc]
add edx, 4
cmp dword [edx + ecx], 0
jne 0x408934
pop esi
pop ebx
pop edi
add esp, 0x100
ret 8
Function at 0x401276
Capabilities:
Get file size

Disassembly:
jmp 0x4194b0
push esi
mov esi, ecx
cmp dword [esi + 0x24], 0xffffffff
jne 0x419529
mov eax, dword [esi + 0x28]
test eax, eax
je 0x4194dc
push 0
push 0x80
push 4
push 0
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 0x24], eax
mov eax, dword [esi + 0x24]
cmp eax, 0xffffffff
jne 0x4194e8
xor eax, eax
pop esi
ret
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x500000
jbe 0x419519
mov eax, dword [esi + 0x24]
push 0
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [esi + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov eax, 1
pop esi
ret
mov edx, dword [esi + 0x24]
push 2
push 0
push 0
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, 1
pop esi
ret
Function at 0x4012e9
Capabilities:
Initialize winsock library

Disassembly:
jmp 0x41a2c0
mov eax, dword [0x47cb98]
sub esp, 0x190
test eax, eax
je 0x41a2db
mov eax, 1
add esp, 0x190
ret
lea eax, [esp]
push eax
push 0x101
call sub.WS2_32.dll_WSAStartup
test eax, eax
jne 0x41a31a
mov ax, word [esp]
cmp al, 1
jne 0x41a315
xor ecx, ecx
mov cl, ah
cmp cl, al
jne 0x41a315
mov dword [0x47cb98], 1
mov eax, 1
add esp, 0x190
ret
call sub.WS2_32.dll_WSACleanup
xor eax, eax
add esp, 0x190
ret

Function at 0x401325
Capabilities:
Accept command line arguments

Disassembly:
jmp 0x402310
push 0xffffffffffffffff
push 0x467000
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x18], ecx
xor ebx, ebx
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [esp + 0x14]
call sub.MFC42u.DLL_CString::CString_2
push ebx
push 0x2d
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], ebx
call sub.MFC42u.DLL_CString::Find_1
mov esi, eax
cmp esi, 0xffffffff
je 0x4023bf
mov edi, dword [sym.imp.MSVCRT.dll__wcsicoll]
inc esi
push 3
lea eax, [esp + 0x18]
push esi
push eax
lea ecx, [esp + 0x1c]
call sub.MFC42u.DLL_CString::Mid_1
mov ecx, dword [esp + 0x14]
push 0x475780
push ecx
mov byte [esp + 0x2c], 1
call edi
add esp, 8
cmp eax, ebx
je 0x4023ad
push esi
push 0x2d
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::Find_1
lea ecx, [esp + 0x14]
mov esi, eax
mov byte [esp + 0x24], bl
call sub.MFC42u.DLL_CString::CString
cmp esi, 0xffffffff
jne 0x402361
jmp 0x4023bf
lea ecx, [esp + 0x14]
mov ebp, 1
mov byte [esp + 0x24], bl
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call sub.MFC42u.DLL_CString::CString
cmp ebp, ebx
jne 0x4023f6
mov edx, dword [esp + 0x18]
lea ecx, [edx + 0xc8]
call fcn.00401703
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret

Function at 0x40136b
Capabilities:
Copy file

Disassembly:
jmp 0x4142a0
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
test edi, edi
je 0x414330
mov ebx, dword [sym.imp.MSVCRT.dll_wcslen]
push edi
call ebx
add esp, 4
test eax, eax
je 0x414330
mov esi, dword [esp + 0x14]
test esi, esi
je 0x414330
push esi
call ebx
add esp, 4
test eax, eax
je 0x414330
push edi
call fcn.00401721
add esp, 4
test eax, eax
je 0x414330
push esi
push edi
call dword [sym.imp.MSVCRT.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x414330
push esi
call fcn.004011d6
add esp, 4
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x414327
mov eax, dword [esp + 0x18]
test eax, eax
je 0x414330
push 0
push 0
push 0x240
push esi
push 0
push edi
push 0
push 0
call dword [sym.imp.SETUPAPI.dll_SetupInstallFileW]
test eax, eax
je 0x414330
pop edi
pop esi
mov eax, 1
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x4013d4
Capabilities:
Encode data using xor

Disassembly:
jmp 0x418f60
push ebx
mov ebx, dword [esp + 8]
test ebx, ebx
push esi
je 0x418fc4
mov esi, dword [esp + 0x10]
test esi, esi
je 0x418fc4
mov edx, dword [esp + 0x14]
test edx, edx
je 0x418fc4
mov ecx, dword [esp + 0x1c]
xor eax, eax
test ecx, ecx
je 0x418f86
mov dword [ecx], esi
mov ecx, dword [esp + 0x18]
cmp ecx, esi
jb 0x418fc6
push ebp
mov ebp, ecx
push edi
xor eax, eax
mov edi, edx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, ebp
and ecx, 3
rep stosb byte es:[edi], al
pop edi
pop ebp
test esi, esi
jbe 0x418fba
mov ecx, ebx
mov eax, edx
sub ecx, edx
mov dl, byte [ecx + eax]
xor dl, 0x54
mov byte [eax], dl
inc eax
dec esi
jne 0x418fae
pop esi
mov eax, 1
pop ebx
ret 0x14
xor eax, eax
pop esi
pop ebx
ret 0x14

Function at 0x401406
Capabilities:
Delete file
Move file

Disassembly:
jmp 0x403740
push 0xffffffffffffffff
push 0x4672f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
mov ebp, ecx
push edi
push ebp
lea ecx, [esp + 0x14]
xor esi, esi
call sub.MFC42u.DLL_CString::CString_1
push 0x475b14
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], esi
call fcn.0041c0dc
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x10]
push eax
call fcn.00401721
add esp, 4
test eax, eax
je 0x4037ca
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4037da
call ebx
cmp eax, 5
jne 0x4037da
mov ecx, dword [0x47b1f8]
push 0x1388
inc ecx
mov esi, 1
mov dword [0x47b1f8], ecx
call edi
jmp 0x4037ce
test esi, esi
je 0x4037da
cmp dword [0x47b1f8], 0xb4
jl 0x403788
mov eax, dword [ebp]
push eax
call fcn.004011c2
add esp, 4
test eax, eax
jne 0x40383f
push 0x475abc
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::CString_2
mov eax, dword [ebp]
push 4
push 0
push eax
mov byte [esp + 0x2c], 1
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea ecx, [esp + 0x14]
mov byte [esp + 0x20], 0
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0xffffffff
call sub.MFC42u.DLL_CString::CString
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x401564
Capabilities:
Access peb ldr_data

Disassembly:
jmp 0x417c20
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x468c30
push eax
mov dword fs:[0], esp
sub esp, 0x10
xor eax, eax
push ebp
mov ebp, dword [esp + 0x24]
push esi
mov esi, ecx
push edi
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x417ca0
mov edi, dword [sym.imp.MSVCRT.dll_strchr]
push 0x3d
push ebp
call edi
add esp, 8
test eax, eax
jne 0x417ca0
push 0x3b
push ebp
call edi
add esp, 8
test eax, eax
jne 0x417ca0
lea ecx, [esp + 0x2c]
call fcn.0041ca70
lea eax, [esp + 0x2c]
mov ecx, esi
push eax
push ebp
mov dword [esp + 0x2c], 0
call fcn.0040138e
test eax, eax
je 0x417cb6
lea ecx, [esp + 0x2c]
mov dword [esp + 0x24], 0xffffffff
call fcn.0041d520
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 8
mov edx, dword [esp + 0x30]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x1c]
push edx
push ecx
call fcn.00431e00
add esp, 0xc
mov edi, eax
add esi, 4
push ebp
lea edx, [esp + 0x18]
push esi
push edx
mov byte [esp + 0x30], 1
call fcn.0041dc60
push 0x3d
push eax
lea eax, [esp + 0x18]
mov byte [esp + 0x2c], 2
push eax
call fcn.0041ec70
push edi
lea ecx, [esp + 0x10]
push eax
push ecx
mov byte [esp + 0x30], 3
call fcn.0041daa0
push 0x3b
lea edx, [esp + 0x34]
push eax
push edx
mov byte [esp + 0x30], 4
call fcn.0041ec70
push eax
mov ecx, esi
mov byte [esp + 0x28], 5
call fcn.0041d6c0
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], 4
call fcn.0041d520
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 3
call fcn.0041d520
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 2
call fcn.0041d520
lea ecx, [esp + 0x14]
mov byte [esp + 0x24], 1
call fcn.0041d520
lea ecx, [esp + 0x18]
mov byte [esp + 0x24], 0
call fcn.0041d520
lea ecx, [esp + 0x2c]
mov dword [esp + 0x24], 0xffffffff
call fcn.0041d520
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
mov eax, 1
pop ebp
mov dword fs:[0], ecx
add esp, 0x1c
ret 8
Function at 0x4015ff
Capabilities:
Check if file exists
Get file attributes

Disassembly:
jmp 0x402950
push 0xffffffffffffffff
push 0x4670c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, ecx
push 0x47b1f4
lea ecx, [esp + 8]
call sub.MFC42u.DLL_CString::CString_2
lea eax, [esp + 4]
mov ecx, esi
push eax
mov dword [esp + 0x1c], 0
call fcn.004016b3
test eax, eax
pop esi
je 0x402a2c
push 0x47b1f4
lea ecx, [esp + 8]
call sub.MFC42u.DLL_CString::CString_2
mov eax, dword [esp]
mov byte [esp + 0x14], 1
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x402a00
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402a00
test al, 0x10
je 0x402a00
push 0x27
lea ecx, [esp + 4]
call sub.MFC42u.DLL_CString::TrimRight_1
lea ecx, [esp]
push str.AgentSetup.log
lea edx, [esp + 0xc]
push ecx
push edx
call sub.MFC42u.DLL_operator_1
push eax
lea ecx, [esp + 8]
mov byte [esp + 0x18], 2
call sub.MFC42u.DLL_CString::operator_1
lea ecx, [esp + 8]
mov byte [esp + 0x14], 1
call sub.MFC42u.DLL_CString::CString
mov eax, dword [esp + 4]
push eax
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x402a10
push 2
jmp 0x402a12
push 3
push 3
call sym.ASetup.exe_void___cdecl_Dll_SetLogOutput_unsigned_long_int__unsigned_long_int__unsigned_short_int_const__
add esp, 0xc
lea ecx, [esp + 4]
mov byte [esp + 0x14], 0
call sub.MFC42u.DLL_CString::CString
jmp 0x402a3a
push 0
push 0
push 0
call sym.ASetup.exe_void___cdecl_Dll_SetLogOutput_unsigned_long_int__unsigned_long_int__unsigned_short_int_const__
add esp, 0xc
lea ecx, [esp]
mov dword [esp + 0x14], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x40163b
Capabilities:
Create directory

Disassembly:
jmp 0x417020
push 0xffffffffffffffff
push 0x468a20
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
cmp esi, ebx
push edi
mov dword [esp + 0x10], ecx
je 0x417149
push esi
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
test eax, eax
je 0x417149
push esi
lea ecx, [esp + 0x28]
call sub.MFC42u.DLL_CString::CString_2
cmp word [esi], 0x5c
mov dword [esp + 0x1c], ebx
jne 0x417096
cmp word [esi + 2], 0x5c
jne 0x417096
push 3
push 0x5c
lea ecx, [esp + 0x2c]
call sub.MFC42u.DLL_CString::Find_1
inc eax
lea ecx, [esp + 0x24]
push eax
push 0x5c
call sub.MFC42u.DLL_CString::Find_1
jmp 0x4170a1
push 0x5c
lea ecx, [esp + 0x28]
call sub.MFC42u.DLL_CString::Find
mov esi, eax
cmp esi, 0xffffffff
je 0x417101
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [esp + 0xc]
push esi
push eax
lea ecx, [esp + 0x2c]
call sub.MFC42u.DLL_CString::Left
mov ecx, dword [esp + 0xc]
mov byte [esp + 0x1c], 1
push ecx
mov ecx, dword [esp + 0x14]
call fcn.004014d3
test eax, eax
jne 0x4170e0
mov edx, dword [esp + 0xc]
push ebx
push edx
call edi
test eax, eax
je 0x41712b
inc esi
lea ecx, [esp + 0x24]
push esi
push 0x5c
call sub.MFC42u.DLL_CString::Find_1
lea ecx, [esp + 0xc]
mov esi, eax
mov byte [esp + 0x1c], bl
call sub.MFC42u.DLL_CString::CString
cmp esi, 0xffffffff
jne 0x4170ae
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 0xffffffff
call sub.MFC42u.DLL_CString::CString
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret 4
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], bl
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x14]
pop edi
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 4