joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4044dd
Capabilities:
Delete file
Read .ini file

Disassembly:
mov eax, 0x1004
call fcn.00408e10
mov eax, dword [0x42f180]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
push ebp
push esi
push edi
push dword [0x43292c]
mov edi, dword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
mov ebp, 0x1000
push ebp
lea eax, [esp + 0x18]
push eax
mov ebx, 0x425524
push ebx
push str.title
mov esi, 0x425f40
push esi
call edi
push 0x50
pop ecx
lea eax, [esp + 0x10]
mov edx, 0x431140
call fcn.004104dc
push dword [0x43292c]
lea eax, [esp + 0x14]
push ebp
push eax
push ebx
push str.info
push esi
call edi
mov ecx, ebp
lea eax, [esp + 0x10]
mov edx, 0x431580
call fcn.004104dc
push dword [0x43292c]
push 0x50
push 0x4327c0
push ebx
push str.build_info
push esi
call edi
push dword [0x43292c]
mov ebp, dword [sym.imp.kernel32.dll_GetPrivateProfileIntA]
push 1
push str.target_compile
push esi
call ebp
push dword [0x43292c]
mov dword [0x431194], eax
push 1
push str.target_optimize
push esi
call ebp
push dword [0x43292c]
mov dword [0x431190], eax
push 0xa
push 0x432590
push ebx
push str.target_version
push esi
call edi
push dword [0x43292c]
push 0x50
push 0x4312c0
push ebx
push str.name
push str.metadata
call edi
push dword [0x43292c]
push 0x104
push 0x4311a0
push ebx
push str.install_script
push esi
call edi
push dword [0x43292c]
mov ebp, 0x431550
push 0xa
push ebp
push ebx
push str.user_access_control
push esi
call edi
push 6
mov edi, str.force
mov esi, ebp
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x40462b
call fcn.004104dc
test eax, eax
je 0x404688
call fcn.00403547
test eax, eax
jne 0x404688
call fcn.004104dc
jmp 0x4046cb
push 5
mov edi, str.auto
mov esi, ebp
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x404658
call fcn.004104dc
test eax, eax
je 0x404688
call fcn.00403547
test eax, eax
jne 0x404688
call fcn.004104dc
test eax, eax
je 0x404688
jmp 0x404621
cmp byte [0x431550], al
je 0x404688
push 5
mov edi, str.none
mov esi, ebp
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x404688
push eax
push str.oops
push str.Bad_user_access_control_value
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x431140
call fcn.00402766
push eax
mov dword [0x432580], eax
call fcn.004104dc
pop ecx
pop ecx
push dword [0x432814]
call dword [sym.imp.kernel32.dll_UnmapViewOfFile]
mov eax, dword [0x43292c]
test eax, eax
je 0x4046bb
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov eax, dword [0x432930]
test eax, eax
je 0x4046cb
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [esp + 0x1010]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00407875
add esp, 0x1004
ret

Function at 0x407875
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42f180]
jne 0x40787f
repz ret
jmp fcn.0040bbd7
Function at 0x41d2d5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040e95e
and dword [ebp - 4], 0
cmp dword [0x4310f8], 0
mov ebx, eax
jne 0x41d386
push str.USER32.DLL
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41d437
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push 0x42d324
push edi
call esi
test eax, eax
je 0x41d437
push eax
call fcn.004104dc
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4310f8], eax
call esi
push eax
call fcn.004104dc
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4310fc], eax
call esi
push eax
call fcn.004104dc
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x431100], eax
call esi
push eax
call fcn.004104dc
pop ecx
mov dword [0x431108], eax
test eax, eax
je 0x41d386
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004104dc
pop ecx
mov dword [0x431104], eax
mov eax, dword [0x431104]
cmp eax, ebx
je 0x41d3de
cmp dword [0x431108], ebx
je 0x41d3de
push eax
call fcn.004104dc
push dword [0x431108]
mov esi, eax
call fcn.004104dc
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41d3de
test edi, edi
je 0x41d3de
call esi
test eax, eax
je 0x41d3d5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41d3d5
test byte [ebp - 0xc], 1
jne 0x41d3de
or dword [ebp + 0x10], 0x200000
jmp 0x41d417
mov eax, dword [0x4310fc]
cmp eax, ebx
je 0x41d417
push eax
call fcn.004104dc
pop ecx
test eax, eax
je 0x41d417
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41d417
mov eax, dword [0x431100]
cmp eax, ebx
je 0x41d417
push eax
call fcn.004104dc
pop ecx
test eax, eax
je 0x41d417
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4310f8]
call fcn.004104dc
pop ecx
test eax, eax
je 0x41d437
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41d439
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401750
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
xchg ebp, eax
inc ebp
or byte [ebx + 0x40c0c8f0], cl
add byte [eax - 0x7d], dl
rol dword [eax + 0x68], 0x74
rol byte [eax], cl
push ecx
mov dh, dl
adc ch, 0x40
add byte [edx + 0xdc02ac], bh
rcr dword [edx + 0x31aa85d0], 0xf
push eax
push str.Total_of__d_requests_completed_n
call dword [0x40c14b]
add esp, 0x68
push 1
call dword [sym.imp.MSVCRT.dll_exit]
nop
push ebp
sub esp, 0x3d
in al, dx
mov eax, 0xa1000049
js 0x40179e
inc ecx
add byte [ebp + 0x404ca1c0], al
inc ecx
outsd dx, dword [esi]
test eax, eax
mov eax, dword [0x6f41404c]
sti
adc al, 0x17
inc eax
cmp al, 0x41
jg 0x4017fd
call fcn.00402650
mov cx, word [0x410274]
jmp 0x4017cf
mov dword [0x41e808], eax
mov eax, dword [0x13410288]
push ebx
push esi
mov esi, dword [0x7b40c164]
stosb byte es:[edi], al
or eax, 0xb1410bb4
test eax, eax
or al, 0x75
sbb cl, byte [ebx + 0x41180015]
jg 0x401846
stosb byte es:[edi], al
add al, byte [ecx]
in eax, dx

Function at 0x407114
Capabilities:
Encode data using xor

Disassembly:
call 0x406fda
xor ecx, ecx
sub ecx, 0xffffff90
call 0x407114
rcr byte [esi - 0x7f], 0x76
push cs
mov ch, byte [ecx - 0x117cfeed]
cld
xor dword [esi + 0xe], 0x113a98a
sub esi, 0xfffffffc
loop 0x407117
xor eax, dword [ebx]
adc al, byte [ecx]
mov al, byte [ecx - 0x14]
invalid

Function at 0x431002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40915c
nop
nop
mov ecx, 0x3bb33d03
nop
nop
test eax, eax
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x431024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x443759a6
test eax, eax
nop
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x402c44
Capabilities:
Delete directory
Get common file path
Get file attributes
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x104c
call fcn.0040dec0
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [eax]
mov eax, dword [eax + 4]
xor ebx, ebx
cmp dword [0x431b78], 0x594
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], eax
jne 0x402c94
push 0x4026c8
push 0x4026d8
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointA]
push 0x4026f4
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceW]
mov eax, dword [0x4274a8]
mov dword [ebp - 0x28], eax
mov eax, dword [0x4274ac]
mov dword [ebp - 0x30], eax
push edi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
call fcn.00402c3d
mov eax, dword [0x4274b0]
add dword [ebp - 0x10], 0x23f
mov dword [ebp - 0x2c], eax
mov eax, dword [0x4274b4]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0x20
jmp 0x402cd3
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov eax, esi
shl eax, 4
cmp dword [0x431b78], 0xc
mov dword [ebp - 4], eax
jne 0x402d35
push ebx
lea eax, [ebp - 0x84c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
xor eax, eax
mov word [ebp - 0x1c], ax
lea edi, [ebp - 0x1a]
stosw word es:[edi], ax
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x1c]
lea eax, [ebp - 0x104c]
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterW]
lea eax, [ebp - 0x38]
push eax
push ebx
lea eax, [ebp - 0x4c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
mov eax, dword [ebp - 0x2c]
add dword [ebp - 4], eax
mov eax, dword [0x431b78]
cmp eax, 0xfa9
jne 0x402d51
mov dword [0x431114], 0xedeb2e40
cmp eax, 0x3eb
jne 0x402d5e
mov dword [0x430ac0], ebx
mov ecx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov edx, esi
shr edx, cl
lea eax, [edi + esi]
mov dword [ebp - 0x18], eax
mov dword [0x431110], 0xf4ea3dee
add edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
xor dword [ebp - 4], eax
xor edx, dword [ebp - 4]
cmp dword [0x431b78], 0x213
mov dword [ebp - 0x18], edx
jne 0x402d9e
push 0x402710
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov eax, dword [ebp - 0x18]
add dword [ebp - 8], 0x64
sub dword [ebp - 8], eax
sub dword [ebp - 8], 0x64
mov eax, dword [ebp - 8]
lea ecx, [ebp - 4]
call fcn.00402c37
mov eax, dword [ebp - 0x28]
add dword [ebp - 4], eax
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
add dword [ebp - 0x10], 0x61c88647
mov eax, edx
shr eax, cl
lea esi, [edi + edx]
add eax, dword [ebp - 0x30]
xor eax, esi
xor dword [ebp - 4], eax
mov eax, dword [ebp - 4]
sub dword [ebp - 0x14], eax
dec dword [ebp - 0x20]
jne 0x402cd0
cmp dword [0x431b78], 0xa6d
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp + 8]
mov dword [esi], eax
pop edi
jne 0x402e08
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
mov edx, dword [ebp - 8]
mov dword [esi + 4], edx
pop esi
pop ebx
leave
ret 4
Function at 0x402448
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xor eax, 0x349c45c6
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
and al, 0xc6
inc ebp
movsb byte es:[edi], byte [esi]
and al, dh
inc ebp
movsd dword es:[edi], dword [esi]
xor eax, 0x41a645c6

Function at 0x402468
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and al, 0xc6
inc ebp
movsb byte es:[edi], byte [esi]
and al, dh
inc ebp
movsd dword es:[edi], dword [esi]
xor eax, 0x41a645c6
call fcn.0040207e
push eax
push esi
push dword [ebp + 8]
call fcn.00402033
invalid
invalid
inc esp
invalid

Function at 0x402660
Capabilities:
Inspect section memory permissions

Disassembly:
ja 0x4026dc
jmp 0x4026a1
add al, 0xeb
rol byte [ebx - 0x74eb43bb], 0xbd
js 0x4026ab
invalid
invalid
cmp dword [eax], ebx
je 0x402722
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x40271d
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x402707
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x40270f
cmp edx, ebx
jne 0x40285d
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x4026de
add eax, dword [eax + 4]
jmp 0x4026cb
mov dword [ebp + 0xc], ebx
jmp fcn.0040272d
Function at 0x402770
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x402745
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x402763
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
ror byte [ecx - 0x3e7443bb], cl
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x4027c1
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x402727
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x40280e
dec eax
je 0x402805
sub eax, 3
je 0x4027fc
mov dword [ebp - 4], 0x40
jmp 0x40282b
mov dword [ebp - 4], 4
jmp 0x402811
mov dword [ebp - 4], 0x20
jmp 0x402811
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x40285d
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x4027dd
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.0040206e
jo 0x402827
push esp
aam 0xff
jne 0x402868
push 1
push esi
call edi
mov eax, esi
jmp 0x402869
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
rcr byte [edi + 0x5e], 0x5b
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4027a0
Capabilities:
Inspect section memory permissions

Disassembly:
cmp edx, ebx
je 0x4027a8
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x4027b1
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x4027bb
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x40279d
Function at 0x407080
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, dword [0x409214]
mov dword [eax], ecx
mov ebx, edx
test ebx, ebx
jle 0x4070a1
mov eax, 0xff
call fcn.00402680
xor byte [esi], al
inc esi
dec ebx
jne 0x407091
pop esi
pop ebx
ret

Function at 0x419824
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.00419398
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00404c4c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x419882
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x41c684]
mov dl, 1
mov eax, dword [0x419290]
call fcn.0040971c
call fcn.0040420c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x41988c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00404c4c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x4198e4
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x41c774]
mov dl, 1
mov eax, dword [0x419290]
call fcn.0040971c
call fcn.0040420c
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.004193c8
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x41a34c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
xor edx, edx
mov dword [ebp - 0x104], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x41a3bb
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xff
lea eax, [ebp - 0x100]
push eax
call sub.KERNEL32.DLL_GetWindowsDirectoryA
lea edx, [ebp - 0x104]
lea eax, [ebp - 0x100]
call fcn.004082f4
mov edx, dword [ebp - 0x104]
mov eax, ebx
mov ecx, 0x41a3d0
call fcn.00404ab0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41a3c2
lea eax, [ebp - 0x104]
call fcn.004047ac
ret
Function at 0x402c54
Capabilities:
Delete directory
Get common file path
Get file attributes
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x104c
call fcn.0040ded0
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [eax]
mov eax, dword [eax + 4]
xor ebx, ebx
cmp dword [0x431b78], 0x594
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], eax
jne 0x402ca4
push 0x4026c8
push 0x4026d8
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointA]
push 0x4026f4
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceW]
mov eax, dword [0x4274a8]
mov dword [ebp - 0x28], eax
mov eax, dword [0x4274ac]
mov dword [ebp - 0x30], eax
push edi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
call fcn.00402c4d
mov eax, dword [str.C3_]
add dword [ebp - 0x10], 0x23f
mov dword [ebp - 0x2c], eax
mov eax, dword [0x4274b4]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0x20
jmp 0x402ce3
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov eax, esi
shl eax, 4
cmp dword [0x431b78], 0xc
mov dword [ebp - 4], eax
jne 0x402d45
push ebx
lea eax, [ebp - 0x84c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
xor eax, eax
mov word [ebp - 0x1c], ax
lea edi, [ebp - 0x1a]
stosw word es:[edi], ax
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x1c]
lea eax, [ebp - 0x104c]
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterW]
lea eax, [ebp - 0x38]
push eax
push ebx
lea eax, [ebp - 0x4c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
mov eax, dword [ebp - 0x2c]
add dword [ebp - 4], eax
mov eax, dword [0x431b78]
cmp eax, 0xfa9
jne 0x402d61
mov dword [0x431114], 0xedeb2e40
cmp eax, 0x3eb
jne 0x402d6e
mov dword [0x430ac0], ebx
mov ecx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov edx, esi
shr edx, cl
lea eax, [edi + esi]
mov dword [ebp - 0x18], eax
mov dword [0x431110], 0xf4ea3dee
add edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
xor dword [ebp - 4], eax
xor edx, dword [ebp - 4]
cmp dword [0x431b78], 0x213
mov dword [ebp - 0x18], edx
jne 0x402dae
push 0x402710
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov eax, dword [ebp - 0x18]
add dword [ebp - 8], 0x64
sub dword [ebp - 8], eax
sub dword [ebp - 8], 0x64
mov eax, dword [ebp - 8]
lea ecx, [ebp - 4]
call fcn.00402c47
mov eax, dword [ebp - 0x28]
add dword [ebp - 4], eax
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
add dword [ebp - 0x10], 0x61c88647
mov eax, edx
shr eax, cl
lea esi, [edi + edx]
add eax, dword [ebp - 0x30]
xor eax, esi
xor dword [ebp - 4], eax
mov eax, dword [ebp - 4]
sub dword [ebp - 0x14], eax
dec dword [ebp - 0x20]
jne 0x402ce0
cmp dword [0x431b78], 0xa6d
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp + 8]
mov dword [esi], eax
pop edi
jne 0x402e18
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
mov edx, dword [ebp - 8]
mov dword [esi + 4], edx
pop esi
pop ebx
leave
ret 4
Function at 0x402e21
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x431b78]
mov ecx, dword [0x430ac8]
sub esp, 0x544
push ebx
push esi
shr eax, 3
xor esi, esi
push edi
cmp eax, esi
jbe 0x402e94
mov edi, ecx
mov ebx, eax
cmp dword [0x431b78], 0x959
jne 0x402e88
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
lea eax, [ebp - 0x140]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
push 0x402720
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
push esi
lea eax, [ebp - 0x540]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push edi
call fcn.00402c54
add edi, 8
dec ebx
jne 0x402e45
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4031c8
Capabilities:
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x424
push ebx
push esi
xor esi, esi
cmp dword [0x431b78], 0x400
push edi
jne 0x40321a
push esi
push esi
call fcn.004035c6
push esi
push esi
call fcn.004035c6
push esi
push esi
push esi
call fcn.00403e60
add esp, 0x14
mov dword [esp + 4], esi
mov dword [esp], esi
call fcn.00402bc2
fstp st(0)
push esi
call fcn.00403ee5
pop ecx
push esi
call fcn.00403c77
pop ecx
mov eax, dword [0x427b34]
mov dword [0x431b78], eax
mov eax, dword [0x427b0c]
mov dword [0x431b7c], eax
call fcn.00402eb3
mov dword [esp + 0x10], esi
mov ebx, 0x2b259d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor eax, eax
mov dword [esp + 0x1c], esi
lea edi, [esp + 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
push esi
lea eax, [esp + 0x3c]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp dword [esp + 0x10], ebx
jle 0x403281
cmp dword [esp + 0x18], 0x785074d5
jne 0x40328f
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x1c1b
jl 0x40323c
xor edi, edi
push esi
lea eax, [esp + 0x34]
push eax
push esi
push 0x402a38
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
push 0x402a74
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
cmp edi, ebx
jle 0x4032be
cmp dword [esp + 0x18], 0x785074d5
jne 0x4032c7
inc edi
cmp edi, 0x11915
jl 0x403291
mov eax, dword [0x430ac8]
mov dword [0x43110c], eax
call eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x404850
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4260d8]
jne 0x40485a
repz ret
jmp fcn.00408c2a
Function at 0x4088e5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00405aac
and dword [ebp - 4], 0
cmp dword [0x4283b8], 0
mov ebx, eax
jne 0x408996
push 0x401b18
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x408a47
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401b0c
push edi
call esi
test eax, eax
je 0x408a47
push eax
call fcn.00405a3a
mov dword [esp], 0x401afc
push edi
mov dword [0x4283b8], eax
call esi
push eax
call fcn.00405a3a
mov dword [esp], 0x401ae8
push edi
mov dword [0x4283bc], eax
call esi
push eax
call fcn.00405a3a
mov dword [esp], 0x401acc
push edi
mov dword [0x4283c0], eax
call esi
push eax
call fcn.00405a3a
pop ecx
mov dword [0x4283c8], eax
test eax, eax
je 0x408996
push 0x401ab4
push edi
call esi
push eax
call fcn.00405a3a
pop ecx
mov dword [0x4283c4], eax
mov eax, dword [0x4283c4]
cmp eax, ebx
je 0x4089ee
cmp dword [0x4283c8], ebx
je 0x4089ee
push eax
call fcn.00405ab5
push dword [0x4283c8]
mov esi, eax
call fcn.00405ab5
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4089ee
test edi, edi
je 0x4089ee
call esi
test eax, eax
je 0x4089e5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4089e5
test byte [ebp - 0xc], 1
jne 0x4089ee
or dword [ebp + 0x10], 0x200000
jmp 0x408a27
mov eax, dword [0x4283bc]
cmp eax, ebx
je 0x408a27
push eax
call fcn.00405ab5
pop ecx
test eax, eax
je 0x408a27
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x408a27
mov eax, dword [0x4283c0]
cmp eax, ebx
je 0x408a27
push eax
call fcn.00405ab5
pop ecx
test eax, eax
je 0x408a27
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4283b8]
call fcn.00405ab5
pop ecx
test eax, eax
je 0x408a47
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408a49
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret