joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ac40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4990c0
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4c4184]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push dword [ebp + 0xc]
movzx eax, word [ebp + 8]
mov edi, dword [ebp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x40ad6f
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x40ad6f
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push 0x22
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x40ad68
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x40ad61
test ebx, ebx
je 0x40ad61
push dword [ebp - 0x10]
push eax
push ebx
call fcn.0044c1b0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
push 1
push edi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x40ad37
mov edi, dword [ebp + 8]
push 0x10
call sub.gdiplus.dll_GdipAlloc
mov esi, eax
test esi, esi
je 0x40ad37
lea eax, [ebp - 0x10]
mov dword [esi], vtable.Gdiplus::Bitmap.0
push eax
push edi
mov dword [ebp - 0x10], 0
call sub.gdiplus.dll_GdipCreateBitmapFromStream
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esi + 4], eax
jmp 0x40ad39
xor esi, esi
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], 2
test ecx, ecx
je 0x40ad4d
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40c450
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x499290
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x4c4184]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x22c], eax
mov ebx, dword [eax + 4]
mov ecx, dword [ebp + 8]
or ebx, 0x2001f
mov dword [ebp - 0x228], ecx
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x214], 0
lea edx, [ebp - 0x224]
mov dword [ebp - 0x224], 0
push edx
push ebx
push 0
push ecx
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
mov eax, dword [ebp - 0x21c]
test esi, esi
jne 0x40c5de
xor esi, esi
test eax, eax
je 0x40c4f4
push eax
call edi
mov esi, eax
mov eax, dword [ebp - 0x224]
and ebx, 0x300
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x218], ebx
test esi, esi
jne 0x40c5de
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea ecx, [ebp - 0x234]
push ecx
push esi
push esi
push esi
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x220], 0x100
push ecx
lea ecx, [ebp - 0x210]
push ecx
push esi
push eax
call ebx
test eax, eax
jne 0x40c597
nop dword [eax]
nop dword [eax + eax]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x21c]
call fcn.0040c450
mov esi, eax
test esi, esi
jne 0x40c5d8
lea eax, [ebp - 0x234]
mov dword [ebp - 0x220], 0x100
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x210]
push eax
push esi
push dword [ebp - 0x21c]
call ebx
test eax, eax
je 0x40c550
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x40c5ae
push eax
call edi
mov dword [ebp - 0x21c], 0
push dword [ebp - 0x228]
mov ecx, dword [ebp - 0x22c]
mov dword [ebp - 0x218], 0
call fcn.0040bb20
mov ecx, dword [ebp - 0x21c]
mov esi, eax
test ecx, ecx
je 0x40c5e5
push ecx
jmp 0x40c5e3
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x40c5e5
push eax
call edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044a466
mov esp, ebp
pop ebp
ret 4
Function at 0x40c7b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4992db
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x4c4184]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0x60
push 0
push esi
mov byte [ebp - 4], 1
call ebx
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x40c85c
push 2
push eax
push esi
call ebx
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x40c85c
call fcn.0040ba50
mov esi, eax
jmp 0x40c94c
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x40c87f
call fcn.0040ba50
jmp 0x40c93f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
test ebx, ebx
jne 0x40c89d
call fcn.0040ba50
jmp 0x40c93f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x41c], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x40c8be
mov esi, 0x8007000e
jmp 0x40c941
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.0040b8c0
jmp 0x40c8e8
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
jne 0x40c8ff
mov esi, 0x8007000e
jmp 0x40c941
push esi
push dword [ebp - 0x418]
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x40c91f
call fcn.0040ba50
jmp 0x40c93f
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.0040c610
mov esi, eax
test edi, edi
je 0x40c94c
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x40c965
lea ecx, [ebp - 0x418]
call fcn.0040bd50
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0044a466
mov esp, ebp
pop ebp
ret 0x10
Function at 0x412ad0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x499a7c
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4c4184]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], ebx
cmp dword [ebp + 8], 0
mov dword [ebp - 0x10], 0
je 0x412b44
mov dword [ebx], 0x4a1ee0
mov dword [ebx + 0x58], 0
mov dword [ebx + 0x78], 0
mov dword [ebx + 0x7c], 0
mov dword [ebx + 0x80], 0
mov dword [ebx + 0x50], vtable.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
push 0
lea esi, [ebx + 4]
mov ecx, ebx
push 0
push esi
mov dword [ebp + 8], esi
call fcn.004128e0
mov eax, dword [ebx]
push 8
mov dword [ebp - 4], 1
mov eax, dword [eax + 4]
mov dword [ebx + eax], vtable.std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x50]
mov dword [ecx + ebx - 4], eax
mov dword [esi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.0044a090
mov esi, eax
add esp, 4
test esi, esi
je 0x412b9e
push 1
mov byte [ebp - 4], 2
call fcn.0042d8a3
add esp, 4
mov dword [esi + 4], eax
jmp 0x412ba0
xor esi, esi
lea eax, [ebx + 4]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
lea edi, [eax + 0x14]
mov dword [eax + 0x1c], edi
lea ecx, [eax + 0x18]
mov dword [eax + 0x20], ecx
lea edx, [eax + 0x24]
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp + 8]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x10]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp + 8]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov dword [eax], vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov dword [eax + 0x38], 0
mov dword [eax + 0x3c], 4
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x418330
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49a286
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x4c4184]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x20], eax
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x1c], 0
push ecx
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0
push ecx
push 0
push 0
push 0
push dword [eax]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x4184b6
mov eax, dword [ebp - 0x10]
xor ebx, ebx
inc eax
mov ecx, 2
mov dword [ebp - 0x10], eax
mul ecx
seto bl
neg ebx
or ebx, eax
push ebx
call fcn.0044a0ce
mov edi, eax
add esp, 4
test edi, edi
je 0x4183d7
push ebx
push 0
push edi
call fcn.0044ccb0
add esp, 0xc
jmp 0x4183d9
xor edi, edi
mov dword [ebp - 0x28], edi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 1
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], 3
test eax, eax
je 0x41841e
cmp eax, 0xaaaaaaa
ja 0x4184d2
push eax
mov ecx, esi
call fcn.00425e30
mov eax, dword [ebp - 0x14]
xor ebx, ebx
test eax, eax
je 0x41848c
mov eax, dword [ebp - 0x10]
push 0
push 0
push 0
push 0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x20]
push edi
push ebx
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x4184af
mov ecx, dword [esi + 4]
mov dword [ebp - 0x24], edi
cmp ecx, dword [esi + 8]
je 0x418476
mov eax, dword [ebp - 0x18]
push eax
push edi
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
call fcn.00409280
add dword [esi + 4], 0x18
jmp 0x418486
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
push eax
push ecx
mov ecx, esi
call fcn.0040f9b0
inc ebx
cmp ebx, dword [ebp - 0x14]
jb 0x418424
test edi, edi
je 0x418499
push edi
call fcn.0044a0d7
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.Cannot_enumerate_subkeys:_RegEnumKeyEx_failed.
jmp 0x4184bb
push str.RegQueryInfoKey_failed_while_preparing_for_subkey_enumeration.
push eax
lea ecx, [ebp - 0x3c]
call fcn.00402900
push 0x4bb0bc
lea eax, [ebp - 0x3c]
push eax
call fcn.0044bcae
call fcn.00426990
int3
Function at 0x419640
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, ecx
push edi
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
test edi, edi
js 0x4196bd
mov esi, dword [ebp + 8]
mov ecx, 1
mov edx, dword [esi]
mov eax, dword [edx - 8]
sub ecx, dword [edx - 4]
sub eax, edi
or ecx, eax
jge 0x419677
push edi
mov ecx, esi
call fcn.0040a6d0
mov edx, dword [esi]
push edi
push edx
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov edi, eax
mov ecx, edi
cmp edi, 0xffffffff
jne 0x41969e
mov ecx, dword [esi]
test ecx, ecx
je 0x4196a2
push dword [ecx - 8]
push ecx
call fcn.0046c270
add esp, 8
mov ecx, eax
test ecx, ecx
js 0x4196bd
mov eax, dword [esi]
cmp ecx, dword [eax - 8]
jg 0x4196bd
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [esi]
mov word [eax + ecx*2], dx
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 4
push 0x80070057
call fcn.004046b0
int3
Function at 0x41fd50
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x24], 0
movlpd qword [ebp - 0x1c], xmm0
movlpd qword [ebp - 0x14], xmm0
movlpd qword [ebp - 0xc], xmm0
mov dword [ebp - 4], 0
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x800500
mov dword [ebp - 0x30], str.open
mov dword [ebp - 0x20], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x41fdbd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4200f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49ac00
mov eax, dword fs:[0]
push eax
sub esp, 0x10c
mov eax, dword [0x4c4184]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x114], ecx
mov eax, dword [0x4c6eac]
test eax, eax
je 0x42019b
cmp dword [eax + 4], 4
jl 0x42019b
push 0
push 0
push 0x4a0d84
push 0x21e
push str.AsusUpdateDlg::StartOmahaUpdate
push 4
lea ecx, [ebp - 0x110]
call fcn.00413ac0
mov ebx, eax
lea ecx, [ebx + 0x28]
mov dword [ebp - 4], 0
push str.Begin_OmahaUpdateThread
push ecx
call fcn.004160f0
mov edi, dword [0x4c6eac]
add esp, 8
mov esi, dword [edi + 8]
cmp esi, dword [edi + 0xc]
je 0x420190
nop dword [eax + eax]
mov ecx, dword [esi]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 4
cmp esi, dword [edi + 0xc]
jne 0x420180
lea ecx, [ebp - 0x110]
call fcn.004151d0
lea eax, [ebp - 0x118]
push eax
push 0
push dword [ebp - 0x114]
push 0x41a690
push 0
push 0
call fcn.0046e2e1
add esp, 0x18
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044a466
mov esp, ebp
pop ebp
ret
Function at 0x426f10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
sub edx, edi
sar edx, 1
add edx, edx
je 0x426f41
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x426f30
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x42a6b0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x4c4184]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
push 2
mov byte [ebp - 0x231], 0
mov dword [ebp - 0x230], 0x22c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
cmp eax, 1
jne 0x42a76b
lea eax, [ebp - 0x231]
mov dword [ebp - 0x238], eax
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
jne 0x42a76b
lea eax, [ebp - 0x20c]
push str.ArmouryCrate.exe
push eax
call fcn.0046c6d2
add esp, 8
test eax, eax
je 0x42a75b
lea eax, [ebp - 0x20c]
push str.ArmouryCrateSE.exe
push eax
call fcn.0046c6d2
add esp, 8
test eax, eax
je 0x42a754
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
je 0x42a710
jmp 0x42a76b
push 0x4a1908
jmp 0x42a760
push 0x4a18d0
lea ecx, [ebp - 0x238]
call fcn.0042a650
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x231]
xor ecx, ebp
pop esi
call fcn.0044a466
mov esp, ebp
pop ebp
ret

Function at 0x42a790
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
cmp dword [ebp + 8], 0
push esi
mov esi, dword [ebp + 0xc]
jne 0x42a7ae
test esi, esi
jne 0x42a7ae
mov eax, 0x80070057
pop esi
mov esp, ebp
pop ebp
ret
push 0x40
lea eax, [ebp - 0x50]
mov dword [ebp - 0x54], 0x44
xorps xmm0, xmm0
push 0
push eax
movups xmmword [ebp - 0x10], xmm0
call fcn.0044ccb0
add esp, 0xc
mov dword [ebp - 0x28], 0x80
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x42a80c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x42a829
movzx eax, ax
or eax, 0x80070000
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xc]
call esi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x48c901
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0048c2bf

Function at 0x48cc9b
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0048cb6f
Function at 0x4028d0
Capabilities:
Terminate process

Disassembly:
call fcn.00401000
push 0x18
push 0x4029f8
call fcn.004032a6
xor esi, esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], esi
call dword [sym.imp.MSVCR120_CLR0400.dll___crtGetShowWindowMode]
movzx ebx, ax
mov dword [ebp - 4], esi
mov eax, dword fs:[0x18]
mov edx, dword [eax + 4]
mov edi, esi
mov esi, 0x4150e8
mov ecx, edx
xor eax, eax
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0x404373
xor esi, esi
inc esi
cmp dword [0x4150ec], esi
je 0x404385
cmp dword [0x4150ec], 0
jne 0x402a1e
mov dword [0x4150ec], esi
push 0x4029f4
push 0x4029e4
call 0x4a6000
pop ecx
pop ecx
test eax, eax
jne 0x404392
cmp dword [0x4150ec], esi
jne 0x402973
push 0x4029e0
push 0x4029cc
call sub.MSVCR120_CLR0400.dll__initterm
pop ecx
pop ecx
mov dword [0x4150ec], 2
test edi, edi
jne 0x402980
xor eax, eax
mov ecx, 0x4150e8
xchg dword [ecx], eax
cmp dword [0x4150f8], 0
jne 0x4043a3
mov eax, dword [sym.imp.MSVCR120_CLR0400.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov edi, dword [ebp - 0x24]
nop
nop
nop
nop
nop
nop
mov cl, byte [esi]
cmp cl, 0x20
jbe 0x402a14
cmp cl, 0x22
je 0x4043d1
movzx eax, cl
push eax
call dword [sym.imp.MSVCR120_CLR0400.dll__ismbblead]
pop ecx
test eax, eax
jne 0x4043e2
inc esi
mov dword [ebp - 0x20], esi
jmp 0x4029a0
test cl, cl
je 0x402a29
test edi, edi
je 0x402a29
jmp 0x4029a7
mov dword [0x415244], esi
jmp 0x402950
mov al, byte [esi]
test al, al
je 0x402a39
cmp al, 0x20
ja 0x402a39
inc esi
mov dword [ebp - 0x20], esi
jmp 0x402a29
push ebx
push esi
push 0
push 0x400000
call fcn.00403044
mov dword [0x415060], eax
cmp dword [0x415064], 0
jne 0x40441a
push eax
call dword [sym.imp.MSVCR120_CLR0400.dll_exit]
test ecx, ecx
je 0x402a82
push ecx
call fcn.0040117d
jmp 0x402a82
mov eax, esi
pop esi
pop ebp
ret 4
cmp eax, edx
jne 0x402905
xor esi, esi
inc esi
mov edi, esi
jmp 0x402918
push 0x1f
call sub.MSVCR120_CLR0400.dll__amsg_exit
pop ecx
jmp 0x402950
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x404435
push 0x4150f8
call fcn.0040fdd0
pop ecx
test eax, eax
je 0x40298d
push 0
push 2
push 0
mov esi, dword [0x4150f8]
mov ecx, esi
call dword [0x416268]
call esi
jmp 0x40298d
xor eax, eax
test edi, edi
sete al
mov edi, eax
mov dword [ebp - 0x24], edi
jmp 0x4029b0
inc esi
mov dword [ebp - 0x20], esi
jmp 0x4029c3
cmp dword [0x415244], 0
jne 0x40442e
call dword [sym.imp.MSVCR120_CLR0400.dll__cexit]
mov eax, dword [0x415060]
mov dword [ebp - 4], 0xfffffffe
call fcn.004032ee
ret
Function at 0x40d596
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov edx, 0x1505
jmp 0x40d5b7
lea eax, [ecx - 0x61]
cmp eax, 0x19
ja 0x40d5af
and ecx, 0xffffffdf
imul edx, edx, 0x21
xor edx, ecx
add esi, 2
movzx ecx, word [esi]
test ecx, ecx
jne 0x40d5a4
mov eax, dword [ebp + 0x10]
movzx ecx, dl
mov edx, ecx
and ecx, 0x1f
shr edx, 5
mov dword [eax], edx
xor edx, edx
mov eax, dword [ebp + 0x14]
inc edx
shl edx, cl
pop esi
mov dword [eax], edx
pop ebp
ret 0x10

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
mov ebx, 0x408ed0
nop
mov ecx, 0x2fca1ee3
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x4f765684
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x10001720
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x1000b598]
xor eax, esp
mov dword [esp + 0x208], eax
push 0x206
lea eax, [esp + 6]
push 0
push eax
mov word [esp + 0xc], 0
call fcn.10005630
add esp, 0xc
lea ecx, [esp]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x10001764
mov edx, dword [0x1000d760]
mov ecx, dword [0x1000d764]
mov dword [eax], edx
mov dx, word [0x1000d768]
mov dword [eax + 4], ecx
mov word [eax + 8], dx
lea eax, [esp]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x10001792
mov ecx, dword [0x1000d76c]
mov edx, dword [0x1000d770]
mov dword [eax], ecx
mov ecx, dword [0x1000d774]
mov dword [eax + 4], edx
mov edx, dword [0x1000d778]
mov dword [eax + 8], ecx
mov cx, word [0x1000d77c]
mov dword [eax + 0xc], edx
push esi
lea edx, [esp + 4]
push edx
mov word [eax + 0x10], cx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
push 0x1000d780
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
call eax
add esp, 4
test eax, eax
push esi
jne 0x1000180f
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.100019ee
add esp, 0x20c
ret
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x20c]
pop esi
xor ecx, esp
mov eax, 1
call fcn.100019ee
add esp, 0x20c
ret

Function at 0x100019ee
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1000b598]
jne 0x100019f8
repz ret
jmp fcn.10002da6