joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42df90
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
mov esi, eax
mov ebx, edx
sub esp, 0xac
mov eax, dword [edx + 0x18]
mov dword [esp + 0x2c], 0
test eax, eax
je 0x42e160
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x100
mov dword [esp], ebx
call sub.libX11_6.dll_XkbAllocNames
test eax, eax
jne 0x42e195
lea edx, [esp + 0x2c]
mov eax, esi
mov edi, 3
xor ebp, ebp
call fcn.0042d150
movzx eax, al
mov dword [esp + 0x1c], eax
mov dword [esp], esi
call sub.msvcrt.dll_getc
cmp eax, 0xffffffff
setne al
movzx eax, al
add ebp, eax
sub edi, 1
jne 0x42dff2
mov edi, dword [ebx + 0x18]
lea edx, [esp + 0x2c]
mov eax, esi
add dword [esp + 0x2c], ebp
call fcn.0042d200
mov dword [edi], eax
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x42e0c8
jmp 0x42e11d
lea eax, [esp + 0x30]
mov dword [esp + 0xc], esi
mov dword [esp + 8], 1
mov dword [esp + 4], 0xc
mov dword [esp], eax
call sub.msvcrt.dll_fread
test eax, eax
je 0x42e130
lea edx, [eax + eax*2]
mov eax, dword [esp + 0x2c]
mov ecx, dword [ebx + 0x1c]
lea eax, [eax + edx*4]
test ecx, ecx
mov dword [esp + 0x2c], eax
je 0x42e110
movzx edi, byte [esp + 0x30]
lea edx, [edi - 1]
mov dword [ecx + edi*4 + 0x50], ebp
lea ecx, [edx + edx*2]
mov edx, dword [ebx + 0x18]
sub dword [esp + 0x1c], 1
lea edx, [edx + ecx*4]
movzx ecx, byte [esp + 0x31]
mov byte [edx + 4], cl
movzx ecx, byte [esp + 0x36]
mov byte [edx + 5], cl
movzx ecx, byte [esp + 0x37]
mov byte [edx + 6], cl
movzx ecx, byte [esp + 0x32]
mov byte [edx + 7], cl
movzx ecx, byte [esp + 0x33]
mov byte [edx + 8], cl
mov byte [edx + 9], cl
movzx ecx, word [esp + 0x34]
mov word [edx + 0xa], cx
mov ecx, dword [esp + 0x38]
mov dword [edx + 0xc], ecx
je 0x42e121
lea edx, [esp + 0x3c]
mov ecx, 0x64
mov eax, esi
call fcn.0042d280
test eax, eax
je 0x42e130
add dword [esp + 0x2c], eax
xor ebp, ebp
cmp byte [esp + 0x3c], 0
je 0x42e030
lea eax, [esp + 0x3c]
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [ebx]
mov dword [esp], eax
call fcn.00422360
mov ebp, eax
jmp 0x42e030
movzx edx, byte [esp + 0x30]
sub edx, 1
jmp 0x42e07d
mov eax, dword [esp + 0x2c]
add esp, 0xac
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [0x44c348], 0x18
mov dword [0x44b754], 0x441d94
mov eax, 0xffffffff
mov dword [0x44c344], 0
add esp, 0xac
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], edx
call sub.libX11_6.dll_XkbAllocIndicatorMaps
test eax, eax
je 0x42dfb1
mov dword [0x44c348], 0x17
mov dword [0x44b754], 0x441d76
mov eax, 0xffffffff
mov dword [0x44c344], 0
jmp 0x42e121
mov dword [0x44c348], 0x17
mov dword [0x44b754], 0x441d84
mov eax, 0xffffffff
mov dword [0x44c344], 0
jmp 0x42e121
Function at 0x42eaa0
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
mov ecx, 0x64
push esi
push ebx
mov ebx, eax
sub esp, 0x9c
mov dword [esp + 0x18], edx
lea edx, [esp + 0x2c]
mov dword [esp + 0x28], 0
mov byte [esp + 0x2c], 0
call fcn.0042d280
lea edx, [esp + 0x28]
add dword [esp + 0x28], eax
mov eax, ebx
call fcn.0042d150
lea ecx, [esp + 0x28]
mov ebp, eax
movzx edi, al
mov eax, ebx
mov edx, ecx
call fcn.0042d150
mov esi, eax
mov eax, dword [esp + 0x18]
movzx eax, byte [eax + 8]
test al, al
jne 0x42ec00
mov ecx, dword [esp + 0x18]
mov eax, ebp
mov byte [ecx + 8], al
mov eax, esi
mov byte [ecx + 9], al
lea edx, [esp + 0x28]
mov eax, ebx
call fcn.0042d150
mov dword [esp], ebx
movzx eax, al
mov ebp, eax
mov dword [esp + 0x1c], eax
call sub.msvcrt.dll_getc
cmp eax, 0xffffffff
mov dword [esp + 0xc], ebp
mov dword [esp + 8], 0
setne al
mov dword [esp + 4], 0x601
movzx eax, al
add dword [esp + 0x28], eax
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call sub.libX11_6.dll_XkbAllocNames
test eax, eax
jne 0x42ecdf
cmp byte [esp + 0x2c], 0
jne 0x42eca1
mov eax, dword [esp + 0x18]
mov ecx, esi
movzx esi, cl
cmp edi, esi
mov eax, dword [eax + 0x1c]
mov edx, dword [eax + 0xe4]
lea ebp, [edx + edi*4]
jle 0x42eba9
jmp 0x42ecca
mov eax, dword [esp + 0x28]
add edi, 1
add ebp, 4
add eax, 4
cmp edi, esi
mov dword [esp + 0x28], eax
jg 0x42ec41
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 4
mov dword [esp + 4], 1
mov dword [esp], ebp
call sub.msvcrt.dll_fread
cmp eax, 4
je 0x42eb90
mov dword [0x44c348], 0x18
mov dword [0x44b754], 0x441d53
mov eax, 0xffffffff
mov dword [0x44c344], 0
add esp, 0x9c
pop ebx
pop esi
pop edi
pop ebp
ret
cmp edi, eax
jae 0x42ec0d
mov edx, dword [esp + 0x18]
mov eax, ebp
mov byte [edx + 8], al
mov edx, dword [esp + 0x18]
mov ecx, esi
mov eax, esi
movzx eax, al
cmp byte [edx + 9], cl
jae 0x42eb0c
mov dword [0x44c344], eax
mov dword [0x44c348], 0x10
mov eax, 0xffffffff
mov dword [0x44b754], 0x441d53
jmp 0x42ebed
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x42ebed
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 0x1c]
mov esi, dword [eax + 0xe8]
xor ebp, ebp
jmp 0x42ec7b
mov eax, dword [esp + 0x28]
add ebp, 1
add esi, 8
add eax, 8
cmp dword [esp + 0x1c], ebp
mov dword [esp + 0x28], eax
jbe 0x42ebed
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 8
mov dword [esp + 4], 1
mov dword [esp], esi
call sub.msvcrt.dll_fread
cmp eax, 8
je 0x42ec60
jmp 0x42ebca
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x2c]
mov ebp, dword [eax + 0x1c]
mov dword [esp + 8], 0
mov dword [esp + 4], ecx
mov eax, dword [eax]
mov dword [esp], eax
call fcn.00422360
mov dword [ebp], eax
jmp 0x42eb68
mov edx, dword [esp + 0x1c]
test edx, edx
jne 0x42ec50
mov eax, dword [esp + 0x28]
jmp 0x42ebed
mov dword [0x44c348], 0x17
mov dword [0x44b754], 0x441d53
mov eax, 0xffffffff
mov dword [0x44c344], 0
jmp 0x42ebed
Function at 0x42f890
Capabilities:
Encrypt data using rc4 prga
Read file on windows

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov esi, dword [esp + 0x30]
lea edx, [esp + 0x1c]
mov dword [esp + 0x1c], 0
mov eax, esi
call fcn.0042d200
cmp eax, 0x786b6d0f
je 0x42f920
mov edx, eax
xor edx, 0x786b6d0f
and edx, 0xffffff00
je 0x42f8f0
mov dword [0x44c344], eax
mov dword [0x44c348], 0x14
xor eax, eax
mov dword [0x44b754], 0x441e59
add esp, 0x20
pop ebx
pop esi
pop edi
ret
and eax, 0xff
mov dword [0x44c348], 0x15
mov dword [0x44b754], 0x441e59
mov dword [0x44c344], eax
add esp, 0x20
xor eax, eax
pop ebx
pop esi
pop edi
ret
mov eax, dword [esp + 0x34]
mov dword [esp + 0xc], esi
mov dword [esp + 8], 1
mov dword [esp + 4], 8
mov dword [esp], eax
call sub.msvcrt.dll_fread
mov eax, dword [esp + 0x34]
mov ebx, dword [esp + 0x3c]
movzx eax, byte [eax + 3]
cmp dword [esp + 0x38], eax
cmovbe eax, dword [esp + 0x38]
test eax, eax
lea edi, [ebx + eax*8]
je 0x42f983
lea esi, [esi]
mov dword [esp], ebx
mov dword [esp + 0xc], esi
add ebx, 8
mov dword [esp + 8], 1
mov dword [esp + 4], 8
call sub.msvcrt.dll_fread
cmp ebx, edi
jne 0x42f960
add esp, 0x20
mov eax, 1
pop ebx
pop esi
pop edi
ret
Function at 0x42fdc0
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0xbc
lea eax, [esp + 0x30]
mov edi, dword [esp + 0xd0]
mov ebx, dword [esp + 0xd4]
mov esi, dword [esp + 0xd8]
mov dword [esp + 8], 0x10
mov dword [esp + 0xc], eax
lea eax, [esp + 0x28]
mov dword [esp], edi
mov dword [esp + 4], eax
or esi, ebx
call fcn.0042f890
test eax, eax
je 0x42fe30
movzx eax, word [esp + 0x2c]
mov edx, ebx
and edx, eax
cmp edx, ebx
je 0x42fe40
not eax
mov dword [0x44c348], 0xc
mov dword [0x44b754], 0x441eab
and ebx, eax
mov dword [0x44c344], ebx
add esp, 0xbc
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
movzx eax, byte [esp + 0x28]
mov ebx, dword [esp + 0xdc]
mov dword [ebx], eax
mov eax, dword [ebx + 8]
test eax, eax
je 0x43008e
cmp byte [esp + 0x2b], 0
je 0x42fe30
mov eax, dword [esp + 0xdc]
lea ebx, [esp + 0x36]
xor ebp, ebp
add eax, 8
mov dword [esp + 0x1c], eax
mov dword [esp + 8], 0
movzx eax, word [ebx]
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msvcrt.dll_fseek
lea eax, [esp + 0x20]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 1
mov dword [esp + 4], 8
mov dword [esp], eax
call sub.msvcrt.dll_fread
movzx edx, word [esp + 0x20]
cmp dx, word [ebx - 6]
jne 0x42fe30
movzx ecx, word [ebx - 4]
cmp word [esp + 0x22], cx
jne 0x42fe30
movzx ecx, word [ebx - 2]
cmp word [esp + 0x24], cx
jne 0x42fe30
movzx ecx, word [ebx]
cmp word [esp + 0x26], cx
jne 0x42fe30
movzx ecx, dx
bt esi, ecx
jae 0x42ff83
shl eax, 3
cmp dx, 6
mov dword [esp + 0x18], eax
ja case.default.0x42ff03
jmp dword [ecx*4 + 0x441eb8]
mov edx, dword [esp + 0x1c]
mov eax, edi
call fcn.0042d550
nop
lea esi, [esi]
test eax, eax
je 0x42ff43
movzx ecx, word [ebx - 6]
add dword [esp + 0x18], eax
mov eax, 1
shl eax, cl
mov ecx, dword [esp + 0xdc]
mov edx, eax
not edx
or dword [ecx + 4], eax
and esi, edx
movzx eax, word [esp + 0x24]
cmp eax, dword [esp + 0x18]
je 0x42ff83
movzx eax, word [esp + 0x20]
mov dword [esp + 4], 3
mov dword [0x44c348], 0x18
mov dword [esp], eax
call fcn.004284f0
mov dword [0x44b754], eax
movzx eax, word [esp + 0x24]
mov edx, dword [esp + 0x18]
sub edx, eax
mov dword [0x44c344], edx
movzx eax, byte [esp + 0x2b]
add ebp, 1
add ebx, 8
cmp eax, ebp
ja 0x42fe74
jmp 0x42fe30
mov eax, dword [esp + 0xdc]
mov edx, dword [eax + 8]
mov eax, edi
call fcn.0042eaa0
jmp 0x42ff20
mov eax, dword [esp + 0xdc]
mov edx, dword [eax + 8]
mov eax, edi
call fcn.0042df90
jmp 0x42ff20
mov eax, dword [esp + 0xdc]
mov edx, dword [eax + 8]
mov eax, edi
call fcn.0042eee0
jmp 0x42ff20
mov eax, dword [esp + 0xdc]
mov edx, dword [eax + 8]
mov eax, edi
call fcn.0042e1c0
jmp 0x42ff20
mov eax, dword [esp + 0xdc]
mov edx, dword [eax + 8]
mov eax, edi
call fcn.0042e480
jmp 0x42ff20
mov eax, dword [esp + 0xdc]
mov edx, dword [eax + 8]
mov eax, edi
call fcn.0042ed10
jmp 0x42ff20
mov dword [esp + 4], 3
mov dword [esp], ecx
mov dword [0x44c348], 0x1a
call fcn.004284f0
mov dword [0x44c344], 0
mov dword [0x44b754], eax
jmp 0x42ff43
call sub.libX11_6.dll_XkbAllocKeyboard
mov ebx, dword [esp + 0xdc]
mov dword [ebx + 8], eax
jmp 0x42fe59
Function at 0x430ce0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x44be78
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x44be70]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x430d35
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x430d2e
test esi, esi
je 0x430d2e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x430d10
mov dword [esp], 0x44be78
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x430f90
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x430fc8
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp edx, ebx
ja 0x430fbe
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x430fca
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x430fb0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x401ab0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
xor edx, edx
cmp edi, 4
jle 0x401b14
lea esi, [edi - 1]
mov ecx, dword [esp + 0x10]
shr esi, 2
mov eax, esi
push ebx
neg eax
lea edi, [edi + eax*4]
mov eax, dword [esp + 0x18]
mov ebx, dword [ecx]
mov ebp, dword [eax]
xor ebx, ebp
mov ebp, dword [eax + 4]
add eax, 4
add ecx, 4
or edx, ebx
add eax, 4
mov ebx, dword [ecx]
add ecx, 4
xor ebx, ebp
mov ebp, dword [eax]
or edx, ebx
mov ebx, dword [ecx]
xor ebx, ebp
mov ebp, dword [eax + 4]
add eax, 4
add ecx, 4
or edx, ebx
add eax, 4
mov ebx, dword [ecx]
add ecx, 4
xor ebx, ebp
or edx, ebx
dec esi
jne 0x401ad4
pop ebx
jmp 0x401b1c
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
test edi, edi
jle 0x401b33
mov esi, edi
mov edi, dword [ecx]
mov ebp, dword [eax]
xor edi, ebp
add eax, 4
or edx, edi
add ecx, 4
dec esi
jne 0x401b22
xor eax, eax
pop edi
test edx, edx
pop esi
pop ebp
setne al
ret
Function at 0x1002d72
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x28
push 0x1001210
call fcn.01002ff4
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x1002dad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1002dad
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x1002dc5
cmp eax, 0x20b
je 0x1002db2
mov dword [ebp - 0x1c], edi
jmp 0x1002dd9
cmp dword [ecx + 0x84], 0xe
jbe 0x1002dad
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x1002dd3
cmp dword [ecx + 0x74], 0xe
jbe 0x1002dad
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x1007aec], 0xffffffff
or dword [0x1007af0], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x1004004]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x1004030]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x1007af4], eax
call fcn.01002fee
cmp dword [0x1004010], edi
jne 0x1002e34
push fcn.01002fee
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.01002fdc
push 0x1001100
push 0x10010fc
call sub.msvcrt.dll__initterm
mov eax, dword [0x100402c]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x1004028]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x30], eax
push 0x10010f8
push 0x10010f4
call sub.msvcrt.dll__initterm
mov eax, dword [ebp - 0x24]
mov ecx, dword [sym.imp.msvcrt.dll___initenv]
mov dword [ecx], eax
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.01002941
add esp, 0x30
mov esi, eax
mov dword [ebp - 0x34], esi
cmp dword [ebp - 0x1c], edi
jne 0x1002eab
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x1002ee0
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0100302d
ret
Function at 0x402e3e
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push edi
xor eax, eax
mov byte [ebp - 0x18], 0
lea edi, [ebp - 0x17]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x18
stosb byte es:[edi], al
lea eax, [ebp - 0x18]
push eax
push 0xb
push 0x800
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea eax, [ebp - 0x18]
push eax
call fcn.0042a6eb
cmp eax, 1
pop ecx
pop edi
jle 0x402e7f
mov word [0x48ad54], ax
leave
ret

Function at 0x402ec3
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
mov edi, dword [sym.imp.USER32.dll_GetLastInputInfo]
lea eax, [ebp - 8]
xor ebx, ebx
push eax
mov dword [ebp - 8], 8
mov dword [ebp - 4], ebx
call edi
mov eax, dword [ebp - 4]
mov ecx, eax
sub ecx, dword [0x48ab90]
test ecx, ecx
jle 0x402ef6
mov dword [0x48ab90], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov dword [0x48ab90], eax
jmp 0x402f2e
lea eax, [ebp - 8]
push eax
mov dword [ebp - 4], ebx
call edi
call esi
mov ecx, eax
sub ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jb 0x402f26
sub eax, dword [0x48ab90]
cmp eax, dword [ebp + 8]
jae 0x402f36
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x4892b4], bl
jg 0x402f06
mov eax, dword [ebp - 4]
mov ecx, eax
sub ecx, dword [0x48ab90]
pop esi
test ecx, ecx
jle 0x402f4b
mov dword [0x48ab90], eax
xor eax, eax
cmp byte [0x4892b4], bl
pop edi
setg al
pop ebx
leave
ret

Function at 0x403125
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push edi
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x10], ebx
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0xf
xor eax, eax
cmp byte [ebp + 0x10], bl
pop ecx
lea edi, [ebp - 0x4c]
mov dword [ebp - 0x54], 0x44
mov dword [ebp - 0x50], ebx
rep stosd dword es:[edi], eax
je 0x40315b
or dword [ebp - 0x28], 1
mov word [ebp - 0x24], bx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40319a
push esi
push dword [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
cmp byte [ebp + 0xc], bl
je 0x403194
push 0xffffffffffffffff
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x10]
call esi
pop esi
pop edi
pop ebx
leave
ret

Function at 0x40319e
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push 0x3ff
lea eax, [ebp - 0x400]
push eax
push str.SHOWEWFMSG
mov byte [ebp - 0x400], 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
cmp byte [ebp - 0x400], 0x31
jne 0x4031e0
push 0
push 0x475b6c
push dword [ebp + 8]
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
leave
ret
Function at 0x4031e2
Capabilities:
Terminate process

Disassembly:
cmp byte [0x4892b4], 2
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x14
pop esi
je 0x4031f9
push esi
call edi
cmp dword [0x48ab9c], 0
je 0x403214
push 0x1e
pop esi
jmp 0x403214
cmp dword [0x48ab94], 0
je 0x403217
push 0xa
call edi
dec esi
jns 0x403207
mov eax, dword [0x48ab94]
test eax, eax
pop edi
pop esi
je 0x403235
push 0
push eax
mov dword [0x48ab94], 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov byte [0x4892b4], 0xff
ret

Function at 0x40323d
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [ebp + 0xc]
mov esi, 0x8000004
push 0x64
push ebx
push esi
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edi, eax
cmp edi, ebx
mov byte [ebp - 1], 1
je 0x40327e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40328f
mov byte [ebp - 1], bl
jmp 0x40328f
push dword [ebp + 0xc]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov edi, eax
cmp edi, ebx
je 0x4032cb
push ebx
push ebx
push ebx
push 6
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push edi
mov dword [0x48aba4], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x48aba4]
cmp eax, ebx
je 0x4032cb
cmp byte [ebp - 1], bl
je 0x4032c6
push 0x64
push ebx
push eax
call fcn.00461780
mov eax, dword [0x48aba4]
add esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4034db
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push 0x169
lea ecx, [ebp - 4]
call fcn.0042465d
mov ebx, dword [ebp - 4]
push 0x104
push dword [ebp + 0xc]
add ebx, 0xc8
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea eax, [ebp - 8]
push eax
xor esi, esi
push ebx
mov dword [ebp - 8], esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
cmp eax, esi
mov dword [ebp - 0x10], eax
je 0x403599
push edi
push eax
push 2
mov dword [ebp - 0x14], esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
push edi
push dword [ebp - 0x10]
push dword [ebp - 8]
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x475ba4
push edi
call sub.VERSION.dll_VerQueryValueW
mov eax, dword [ebp - 0xc]
mov cx, word [eax + 0x12]
mov dx, word [eax + 0x10]
mov di, word [eax + 0x16]
movzx eax, word [eax + 0x14]
push eax
movzx eax, di
push eax
movzx eax, dx
push eax
movzx eax, cx
push eax
push 0x475b8c
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
mov eax, dword [ebp - 4]
mov esi, dword [ebp + 8]
and dword [ebp - 4], 0
lea ecx, [ebp - 4]
mov dword [esi], eax
call fcn.00424686
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x403a5a
Capabilities:
Create directory
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
and dword [ebp - 0x14], 0
and dword [ebp - 0x10], 0
push ebx
push esi
mov esi, dword [ebp + 8]
test esi, esi
push edi
jne 0x403a75
lea esi, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x403a7f
lea eax, [ebp - 0x10]
push 0x26c
mov ecx, esi
mov dword [ebp - 4], eax
call fcn.00424699
mov ecx, dword [ebp - 4]
push 0x2d0
call fcn.00424699
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebx, 0x208
push ebx
push dword [esi]
push 0x475d10
call edi
test eax, eax
jg 0x403abe
push ebx
push dword [esi]
push str.TEMP
call edi
and dword [ebp + 8], 0
add eax, eax
mov dword [ebp - 0xc], 0xc7
mov dword [ebp - 8], eax
mov edi, dword [esi]
add edi, dword [ebp - 8]
call fcn.004264c1
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
push eax
push dword [ebp + 0x14]
push str.pecmd__s._lu._lu.tmp
push edi
call ebx
mov eax, dword [esi]
add esp, 0x14
xor edi, edi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x403b39
push 5
mov ecx, 0x48aec0
call fcn.0040ac88
dec dword [ebp - 0xc]
jns 0x403ace
mov eax, dword [esi]
mov word [eax], di
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x403bd5
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
jmp 0x403be4
cmp dword [ebp + 0xc], edi
jne 0x403b45
xor esi, esi
jmp 0x403be7
push dword [esi]
call fcn.0046176a
mov edi, dword [ebp - 4]
mov dword [ebp + 8], eax
inc eax
push eax
push dword [esi]
push dword [edi]
call fcn.0040391f
mov eax, dword [ebp + 8]
and dword [ebp + 0xc], 0
add esp, 0x10
add eax, eax
mov dword [ebp - 8], eax
mov esi, dword [edi]
push dword [ebp + 0xc]
add esi, dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push dword [ebp + 0x14]
push str.pecmd__s._lu._lu.tmp
push esi
call ebx
mov eax, dword [edi]
add esp, 0x14
xor esi, esi
push esi
push 0x80
push 1
push esi
push esi
push 0x40000000
push eax
lea ecx, [ebp + 8]
mov dword [ebp + 8], esi
call fcn.00403993
cmp eax, esi
mov dword [ebp + 8], eax
jne 0x403b24
push 5
mov ecx, 0x48aec0
call fcn.0040ac88
inc dword [ebp + 0xc]
cmp dword [ebp + 0xc], 0xc8
jl 0x403b6c
mov eax, dword [edi]
and word [eax], si
jmp 0x403b24
cmp dword [ebp + 8], 0
je 0x403be4
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.00424686
lea ecx, [ebp - 0x14]
call fcn.00424686
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret