joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5a18c0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xc4], 0
je 0x5a191d
cmp byte [ebx + 0xeb], 0
jne 0x5a191d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x190]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00409f40
mov eax, dword [esi]
test eax, eax
je 0x5a190a
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x5a192a
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040a198
jmp 0x5a192a
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040a198
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x5a3428
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x98]
test esi, esi
je 0x5a3499
mov eax, esi
call fcn.0051df78
test al, al
je 0x5a3499
mov eax, dword [ebx + 0x98]
call fcn.0051db10
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5a3499
mov eax, dword [ebx + 0x98]
mov edx, dword [eax]
call dword [edx + 0x160]
test al, al
je 0x5a348a
push 0
mov eax, dword [ebx + 0x98]
call fcn.0051db10
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebx + 0x98]
xor edx, edx
call fcn.00514134
jmp 0x5a3499
mov edx, dword [ebx + 0x88]
mov cl, 1
mov eax, ebx
call fcn.005a3234
pop esi
pop ebx
ret
Function at 0x5a8ed0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
cmp dword [ebx + 0x94], 0
jne 0x5a8f56
mov eax, dword [ebx + 8]
call fcn.0051db10
mov ecx, eax
mov dl, 1
mov eax, dword [0x52d33c]
call fcn.00517768
mov dword [ebx + 0x94], eax
mov esi, dword [ebx + 0x94]
xor edx, edx
mov eax, esi
call fcn.005342e8
mov dword [esi + 0x2dc], ebx
mov dword [esi + 0x2d8], 0x5a87a0
push 8
mov edx, 3
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xe0]
push eax
push 0
push 0
push 0
push 0
mov eax, dword [ebx + 0x94]
call fcn.0051db10
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x94]
call fcn.0051db10
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0xa4], 0
jne 0x5a8fd8
mov eax, dword [ebx + 8]
call fcn.0051db10
mov ecx, eax
mov dl, 1
mov eax, dword [0x52d33c]
call fcn.00517768
mov dword [ebx + 0xa4], eax
mov esi, dword [ebx + 0xa4]
mov dl, 1
mov eax, esi
call fcn.005342e8
mov dword [esi + 0x2dc], ebx
mov dword [esi + 0x2d8], 0x5a87ec
push 8
push 0
mov edx, 2
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xe0]
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0xa4]
call fcn.0051db10
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0xa4]
call fcn.0051db10
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x9c], 0
jne 0x5a9056
mov eax, dword [ebx + 8]
call fcn.0051db10
mov ecx, eax
mov dl, 1
mov eax, dword [0x52de30]
call fcn.00517768
mov dword [ebx + 0x9c], eax
mov esi, dword [ebx + 0x9c]
mov byte [esi + 0x2b0], 1
push 8
mov edx, 3
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xe0]
push eax
mov edx, 2
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xe0]
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x9c]
call fcn.0051db10
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x9c]
call fcn.0051db10
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x5ad76c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5ad911
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00409da8
mov eax, ebx
sub al, 0x13
je 0x5ad7fd
dec al
je 0x5ad7d1
dec al
je 0x5ad7bb
dec al
je 0x5ad7e7
jmp 0x5ad87a
push 0x104
lea eax, [ebp - 0x20c]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
jmp 0x5ad8af
lea eax, [ebp - 0x20c]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathW
jmp 0x5ad8af
push 0x104
lea eax, [ebp - 0x20c]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
jmp 0x5ad8af
mov ecx, 0x20019
mov dl, 1
mov eax, dword [0x4db1c0]
call fcn.004dc26c
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5ad873
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 4]
call fcn.004dc310
xor ecx, ecx
mov edx, 0x5ad92c
mov eax, dword [ebp - 4]
call fcn.004dc378
lea ecx, [ebp - 0x210]
mov edx, 0x5ad98c
mov eax, dword [ebp - 4]
call fcn.004dcc1c
mov eax, dword [ebp - 0x210]
mov edx, esi
call fcn.005ae954
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ad8f1
mov eax, dword [ebp - 4]
call fcn.00408128
pop eax
jmp eax
push 0
movzx eax, bl
mov eax, dword [eax*4 + 0x6b7bc4]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
test eax, eax
jne 0x5ad8af
mov ecx, 0x5ad9b8
mov dl, 1
mov eax, dword [0x41c77c]
call fcn.0042b52c
call fcn.004094a0
lea eax, [ebp - 0x214]
lea edx, [ebp - 0x20c]
mov ecx, 0x104
call fcn.0040aa64
cmp dword [ebp - 0x214], 0
je 0x5ad8f1
lea eax, [ebp - 0x218]
lea edx, [ebp - 0x20c]
mov ecx, 0x104
call fcn.0040aa64
mov eax, dword [ebp - 0x218]
mov edx, esi
call fcn.005ae954
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ad918
lea eax, [ebp - 0x218]
mov edx, 3
call fcn.00409e08
pop eax
jmp eax

Function at 0x5ada20
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffb94
push ebx
push esi
push edi
mov byte [ebp - 1], cl
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x5ada4b
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5ada61
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00407a7c
mov dword [ebp - 0x48], 0x44
mov dword [ebp - 0x1c], 0x41
test bl, bl
je 0x5ada8a
mov word [ebp - 0x18], 0
jmp 0x5ada90
mov word [ebp - 0x18], 1
lea eax, [ebp - 0x46a]
mov edx, esi
call fcn.0042523c
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
lea eax, [ebp - 0x46a]
push eax
push 0
call sub.kernel32.dll_CreateProcessW
cmp eax, 1
sbb ebx, ebx
inc ebx
cmp byte [ebp - 1], 0
je 0x5adae5
test bl, bl
je 0x5adae5
push 0xffffffffffffffff
mov eax, dword [ebp - 0x58]
push eax
call sub.user32.dll_WaitForInputIdle
push 0xffffffffffffffff
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5adc1c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
cmp byte [0x6b7bc0], 0
jne 0x5adce2
xor eax, eax
mov dword [ebp - 4], eax
xor edx, edx
push ebp
push 0x5adcdb
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.005aea48
mov ecx, 1
mov edx, ebx
mov eax, 0x5adcf4
call fcn.0040af40
lea esi, [eax + 4]
mov ecx, esi
mov edx, ebx
mov ax, 0x2f
call fcn.005ae9e8
mov edi, eax
test edi, edi
jne 0x5adca8
mov ecx, esi
mov edx, ebx
mov ax, 0x3f
call fcn.005ae9e8
test eax, eax
jne 0x5adca8
test edi, edi
jne 0x5adc9b
lea eax, [ebp - 4]
mov edx, 0x5add08
call fcn.0040abbc
jmp 0x5adca8
lea eax, [ebp - 4]
mov edx, 0x5add20
call fcn.0040abbc
push 1
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040a9b0
push eax
push 0x5add28
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5adce2
lea eax, [ebp - 4]
call fcn.00409da8
pop eax
jmp eax
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x5adf1c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd6c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x294], ebx
mov dword [ebp - 0x290], ebx
mov dword [ebp - 0x28c], ebx
mov dword [ebp - 0x288], ebx
mov dword [ebp - 0x284], ebx
mov dword [ebp - 0x280], ebx
mov dword [ebp - 0x27c], ebx
mov dword [ebp - 0x278], ebx
mov byte [ebp - 0x271], cl
mov edi, edx
mov esi, eax
lea eax, [ebp - 0x270]
mov edx, dword [0x41c15c]
call fcn.0040b070
xor eax, eax
push ebp
push 0x5ae15e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x278]
mov ecx, edi
mov edx, esi
call fcn.0040ac14
mov eax, dword [ebp - 0x278]
lea ecx, [ebp - 0x270]
mov edx, 0x1ef
call fcn.00424bd0
mov ebx, eax
test ebx, ebx
jne 0x5ae02d
lea eax, [ebp - 0x27c]
mov ecx, dword [ebp - 0x25c]
mov edx, esi
call fcn.0040ac14
mov eax, dword [ebp - 0x27c]
call fcn.0040a9b0
push eax
call sub.kernel32.dll_DeleteFileW
test eax, eax
jne 0x5ae01c
lea eax, [ebp - 0x280]
mov ecx, dword [ebp - 0x25c]
mov edx, esi
call fcn.0040ac14
mov eax, dword [ebp - 0x280]
mov cl, 1
xor edx, edx
call fcn.00424a4c
lea eax, [ebp - 0x284]
mov ecx, dword [ebp - 0x25c]
mov edx, esi
call fcn.0040ac14
mov eax, dword [ebp - 0x284]
call fcn.0040a9b0
push eax
call sub.kernel32.dll_DeleteFileW
lea eax, [ebp - 0x270]
call fcn.00424c20
mov ebx, eax
test ebx, ebx
je 0x5adfae
lea eax, [ebp - 0x270]
call fcn.00424c44
cmp byte [ebp - 0x271], 0
je 0x5ae12d
lea eax, [ebp - 0x288]
mov ecx, 0x5ae178
mov edx, esi
call fcn.0040ac14
mov eax, dword [ebp - 0x288]
lea ecx, [ebp - 0x270]
mov edx, 0x10
call fcn.00424bd0
mov ebx, eax
test ebx, ebx
jne 0x5ae122
mov eax, dword [ebp - 0x25c]
mov edx, 0x5ae18c
call fcn.0040adac
je 0x5ae10d
mov eax, dword [ebp - 0x25c]
mov edx, 0x5ae19c
call fcn.0040adac
je 0x5ae10d
lea eax, [ebp - 0x28c]
mov ecx, dword [ebp - 0x25c]
mov edx, esi
call fcn.0040ac14
mov eax, dword [ebp - 0x28c]
mov cl, 1
mov edx, 0x10
call fcn.00424a4c
push esi
push dword [ebp - 0x25c]
push 0x5ae1b0
lea eax, [ebp - 0x290]
mov edx, 3
call fcn.0040ac9c
mov eax, dword [ebp - 0x290]
mov cl, 1
mov edx, edi
call fcn.005adf1c
lea eax, [ebp - 0x294]
mov ecx, dword [ebp - 0x25c]
mov edx, esi
call fcn.0040ac14
mov eax, dword [ebp - 0x294]
call fcn.00407800
lea eax, [ebp - 0x270]
call fcn.00424c20
mov ebx, eax
test ebx, ebx
je 0x5ae077
lea eax, [ebp - 0x270]
call fcn.00424c44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ae165
lea eax, [ebp - 0x294]
mov edx, 8
call fcn.00409e08
lea eax, [ebp - 0x270]
mov edx, dword [0x41c15c]
call fcn.0040b45c
pop eax
jmp eax
Function at 0x5ae2c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00409e9c
mov eax, dword [ebp - 8]
call fcn.00409e9c
xor eax, eax
push ebp
push 0x5ae357
push dword fs:[eax]
mov dword fs:[eax], esp
test bl, bl
je 0x5ae305
lea eax, [ebp - 0xc]
mov edx, 0x5ae374
call fcn.0040a1e0
jmp 0x5ae312
lea eax, [ebp - 0xc]
mov edx, 0x5ae38c
call fcn.0040a1e0
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.0040a9b0
push eax
mov eax, dword [ebp - 4]
call fcn.0040a9b0
push eax
mov eax, dword [ebp - 0xc]
call fcn.0040a9b0
push eax
push 0
call sub.shell32.dll_ShellExecuteW
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ae35e
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00409e08
pop eax
jmp eax

Function at 0x5ae398
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00409e9c
mov eax, dword [ebp - 8]
call fcn.00409e9c
xor eax, eax
push ebp
push 0x5ae430
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x3c
call fcn.00407a7c
mov dword [ebp - 0x44], 0x3c
mov dword [ebp - 0x40], 0x40
mov eax, dword [ebp - 4]
call fcn.0040a9b0
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 8]
call fcn.0040a9b0
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], 5
lea eax, [ebp - 0x44]
push eax
call sub.shell32.dll_ShellExecuteExW
push 0xbb8
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_WaitForSingleObject
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ae437
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409e08
pop eax
jmp eax

Function at 0x5c2388
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 0x18], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5c23f9
push dword fs:[eax]
mov dword fs:[eax], esp
push 7
lea eax, [ebp - 0x12]
push eax
push 0x1004
mov eax, ebx
call fcn.005c2408
push eax
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x18]
lea edx, [ebp - 0x12]
mov ecx, 7
call fcn.0040aa64
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 4]
call fcn.00407b5c
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x5c23e1
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c2400
lea eax, [ebp - 0x18]
call fcn.00409da8
pop eax
jmp eax

Function at 0x5cf118
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x6c0270], 0
jne 0x5cf12f
call fcn.005cf0d4
mov eax, edi
dec eax
test eax, eax
jl 0x5cf157
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x6bfe70]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x5cf139
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x5d21d4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x5d2205
dec al
je 0x5d2240
dec al
je 0x5d2284
dec al
je 0x5d22f6
jmp 0x5d2391
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x5d2391
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x5d2215
jmp 0x5d2391
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5d2391
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
movzx ecx, al
mov ecx, dword [ebx + ecx*4 + 0x40]
add dl, byte [ecx + esi]
and dl, 0xff
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x5d2250
jmp 0x5d2391
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5d2391
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, dword [ebx + 0x24]
mov ecx, esi
dec ecx
cmp edx, ecx
jbe 0x5d22b7
xor edx, edx
mov dword [esp + 4], edx
jmp 0x5d22cc
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov ebp, dword [ebx + edx*4 + 0x40]
movzx edx, byte [ebp + esi]
add eax, dword [esp + 4]
sar eax, 1
jns 0x5d22e4
adc eax, 0
add dl, al
and dl, 0xff
mov byte [ebp + esi], dl
inc esi
dec edi
jne 0x5d2294
jmp 0x5d2391
xor eax, eax
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 8], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5d2391
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, dword [ebx + 0x24]
mov ecx, esi
dec ecx
cmp edx, ecx
ja 0x5d235d
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 8], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 8]
push eax
movzx eax, byte [esp + 8]
pop edx
call fcn.005cf160
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [esp]
and al, 0xff
mov byte [edx + esi], al
inc esi
dec edi
jne 0x5d2312
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x6384cc
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x6384d5
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
call fcn.00409e9c
mov eax, dword [ebp - 8]
call fcn.00409e9c
mov eax, dword [ebp + 0xc]
call fcn.00409e9c
xor eax, eax
push ebp
push 0x6386ad
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x638671
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
call fcn.00638094
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.0040a1e0
mov eax, dword [ebp - 0x18]
push dword [eax + 0x3f0]
push 0x6386cc
push dword [ebp + 0xc]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040ac9c
cmp byte [ebp + 8], 0
jne 0x6385fb
mov dl, 1
mov eax, dword [0x4db1c0]
call fcn.004dc228
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x6385f4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x1c]
mov byte [eax + 0xc], 0
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x40e], 0
je 0x638597
mov edx, 0x80000002
mov eax, dword [ebp - 0x1c]
call fcn.004dc310
mov cl, 1
mov edx, 0x6386dc
mov eax, dword [ebp - 0x1c]
call fcn.004dc378
test al, al
je 0x6385dc
push 0x638748
push dword [ebp - 0xc]
push 0x638758
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.0040ac9c
mov ecx, dword [ebp - 0x20]
mov edx, 0x63877c
mov eax, dword [ebp - 0x1c]
call fcn.004dcbe8
mov eax, dword [ebp - 0x1c]
call fcn.004dc2e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6385fb
mov eax, dword [ebp - 0x1c]
call fcn.00408128
pop eax
jmp eax
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x40e], 0
je 0x638613
lea edx, [ebp - 0x10]
mov al, 3
call fcn.005ad76c
jmp 0x63861d
lea edx, [ebp - 0x10]
mov al, 0x11
call fcn.005ad76c
push 0x638798
mov eax, dword [ebp - 0x14]
push eax
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0x10]
call fcn.005ae9a8
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.005af14c
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0x10]
call fcn.005ae954
push dword [ebp - 0x28]
push dword [ebp - 4]
push 0x6387b8
mov eax, dword [ebp - 0x18]
add eax, 0x418
mov edx, 3
call fcn.0040ac9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x63867b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6386b4
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.00409e08
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00409e08
lea eax, [ebp + 0xc]
call fcn.00409da8
pop eax
jmp eax

Function at 0x638fe8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
add ebx, 0xfffffd90
mov esi, dword [ebp + 8]
add esi, 0xfffffd8c
mov eax, dword [ebx + 0x14]
call fcn.0040a9b0
push eax
call sub.kernel32.dll_DeleteFileW
mov eax, ebx
call fcn.00424c20
mov dword [esi], eax
cmp dword [esi], 0
je 0x638fff
pop esi
pop ebx
pop ebp
ret
Function at 0x6ae87c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, 0x6a1fe8
call fcn.004106f8
xor eax, eax
push ebp
push 0x6aeaad
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x6d4780
mov eax, 1
call fcn.00407724
mov eax, dword [0x6d4780]
test eax, eax
je 0x6ae8c2
sub eax, 4
mov eax, dword [eax]
dec eax
jle 0x6ae8d0
mov eax, dword [0x6d4780]
movzx eax, word [eax + 2]
jmp 0x6ae8d2
xor eax, eax
sub ax, 0x64
je 0x6ae9c4
sub ax, 5
je 0x6ae9c4
sub ax, 0xc
je 0x6ae9c4
push 0x6d3e1c
push 0x4b0
call sub.kernel32.dll_GetTempPathW
mov edx, 0x6aeabc
mov eax, 0x6d3e1c
call 0x425284
xor eax, eax
mov dword [ebp - 0x14], eax
xor edx, edx
push ebp
push 0x6ae9bd
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x14]
mov edx, 0x6aeae4
call fcn.0040a1e0
mov eax, dword [0x6d4780]
test eax, eax
je 0x6ae93c
sub eax, 4
mov eax, dword [eax]
dec eax
jle 0x6ae95a
push dword [ebp - 0x14]
push 0x6aeaf8
push dword [0x6d4780]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.0040ac9c
mov edx, 0x6d4780
xor eax, eax
call fcn.00407724
push 0
push 0x6d3e1c
mov eax, dword [0x6d4780]
call fcn.0040a9b0
push eax
call sub.kernel32.dll_CopyFileW
push 1
push 0
mov eax, dword [ebp - 0x14]
call fcn.0040a9b0
push eax
push 0x6d3e1c
push 0x6aeafc
push 0
call sub.shell32.dll_ShellExecuteW
call fcn.00409594
jmp 0x6aea90
lea edx, [ebp - 0x18]
mov eax, 1
call fcn.00407724
mov eax, dword [ebp - 0x18]
mov edx, 0x6aeb14
call fcn.0040adac
je 0x6aea06
lea edx, [ebp - 0x1c]
mov eax, 1
call fcn.00407724
mov eax, dword [ebp - 0x1c]
mov edx, 0x6aeb28
call fcn.0040adac
je 0x6aea06
call fcn.00639020
jmp 0x6aea90
call fcn.0063644c
mov eax, dword [0x6b8b4c]
mov eax, dword [eax]
call fcn.005a1fa8
mov eax, dword [0x6b8b4c]
mov eax, dword [eax]
mov edx, 0x6aeb3c
call fcn.005a19dc
mov ecx, dword [0x6b8668]
mov eax, dword [0x6b8b4c]
mov eax, dword [eax]
mov edx, dword [0x632a30]
call fcn.005a1fc0
mov ecx, dword [0x6b8720]
mov eax, dword [0x6b8b4c]
mov eax, dword [eax]
mov edx, dword [0x635ebc]
call fcn.005a1fc0
mov ecx, dword [0x6b861c]
mov eax, dword [0x6b8b4c]
mov eax, dword [eax]
mov edx, dword [0x5b3934]
call fcn.005a1fc0
mov edx, dword [0x6b8b4c]
mov edx, dword [edx]
mov eax, dword [0x6b8720]
mov eax, dword [eax]
call fcn.006364c8
mov eax, dword [0x6b8b4c]
mov eax, dword [eax]
call fcn.005a2120
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6aeab4
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00409e08
pop eax
jmp eax
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0x40b054], 1
mov dword [0x40b050], 1
mov dword [0x40b04c], 1
mov dword [0x40b044], 1
jne 0x401060
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010c0
mov dword [0x40b00c], eax
mov eax, dword [0x40b060]
test eax, eax
jne 0x4010b0
mov dword [esp], 1
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0x40b074]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0x40b05c]
mov dword [eax], edx
call dbg._setargv
cmp dword [0x40801c], 1
je 0x4010f0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 2
call sym.___set_app_type
jmp 0x40107a
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x401108
cmp dx, 0x20b
jne 0x401060
cmp dword [ecx + 0x84], 0xe
jbe 0x401060
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401060
mov dword [esp], dbg._matherr
call dbg.__mingw_setusermatherr
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401060
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401060

Function at 0x401980
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call dbg.__acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call dbg.__acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]