joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4273c2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push ecx
add esp, 4
xor esi, 0x16f80
or esi, 0x172da
add esi, 0x5698
xor esi, 0xa399
pop esi
push ebx
or ebx, 0x11891
sub ebx, 0xf7cf
sub ebx, 0x7953
pop ebx
lea eax, [ebp - 0x1774]
mov dword [ebp - 0xccc], eax
mov ecx, dword [ebp - 0x518]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xcc8], edx
xor eax, eax
mov word [ebp - 0x220], ax
xor ecx, ecx
mov word [ebp - 0x3c], cx
push ebx
push edi
add esp, 4
call 0x4273b7
add byte [eax], bh
dec ebx
dec ecx
xor cl, byte [ebp + 0x4e]
xor eax, 0x834d3a37
les eax, [eax + ebp*8]
or eax, dword [eax]
add byte [eax], al
add byte [esp + edi], bh
inc ebx
inc eax
dec esp
dec edi
inc esi
inc eax
inc edi
cmp eax, 0x8104c483
jecxz 0x427435
loop 0x4273d2
add byte [ebx - 0x75], bl
xchg ebp, eax
cmp bl, dh
invalid
add byte [ecx + 0x12e0dc1], al
add byte [ecx + 0x56], bl
push edx
add esp, 4
jmp 0x42744a
add esi, 0x15d51
sub esi, 0xfb37
xor esi, 0x168c6
pop esi
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x42747a
movzx edx, word [ebp - 0x220]
movzx eax, word [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0x166c], edx
jmp 0x4274d4
movzx ecx, word [ebp - 0x220]
movzx edx, word [ebp - 0x3c]
cmp ecx, edx
je 0x4273a2
movzx eax, word [ebp - 0x220]
xor eax, 0x20
movzx ecx, word [ebp - 0x3c]
cmp eax, ecx
je 0x4273a2
movzx edx, word [ebp - 0x220]
movzx eax, word [ebp - 0x3c]
cmp edx, eax
jge 0x4274be
mov dword [ebp - 0x1668], 0xffffffff
jmp 0x4274c8
mov dword [ebp - 0x1668], 1
mov ecx, dword [ebp - 0x1668]
mov dword [ebp - 0x166c], ecx
cmp dword [ebp - 0x166c], 0
jne 0x42751d
push ecx
push eax
add esp, 4
add ecx, 0x8353
and ecx, 0x16b37
or ecx, 0x4b14
jmp 0x4274fc
pop ecx
push ebx
push ebx
add esp, 4
or ebx, 0x97ee
add ebx, 0x10333
pop ebx
mov edx, dword [ebp - 0x518]
mov dword [ebp - 0x774], edx
jmp 0x427585
push eax
sub eax, 0x949b
and eax, 0x13d23
add eax, 0x391c
pop eax
push ebx
push esi
add esp, 4
or ebx, 0x13afc
and ebx, 0x16c18
add ebx, 0xfcd0
add ebx, 0x263d
pop ebx
mov eax, dword [ebp - 0x518]
mov ecx, dword [eax]
mov dword [ebp - 0x518], ecx
mov edx, dword [ebp - 0x518]
cmp edx, dword [ebp - 0xcd0]
je 0x42757b
mov eax, dword [ebp - 0x518]
cmp dword [eax + 0x30], 0
jne 0x427346
mov dword [ebp - 0x774], 0
push edx
push esi
add esp, 4
add edx, 0xf00c
pop edx
push ebx
add ebx, 0x10725
xor ebx, 0xf9d0
add ebx, 0x8b9d
xor ebx, 0x6f98
add byte [eax], al
pop ebx
push edx
push eax
add esp, 4
Function at 0x4273ca
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push ecx
add esp, 4
xor esi, 0x16f80
or esi, 0x172da
add esi, 0x5698
xor esi, 0xa399
pop esi
push ebx
or ebx, 0x11891
sub ebx, 0xf7cf
sub ebx, 0x7953
pop ebx
lea eax, [ebp - 0x1774]
mov dword [ebp - 0xccc], eax
mov ecx, dword [ebp - 0x518]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xcc8], edx
xor eax, eax
mov word [ebp - 0x220], ax
xor ecx, ecx
mov word [ebp - 0x3c], cx
push ebx
push edi
add esp, 4
call 0x4273b7
add byte [eax], bh
dec ebx
dec ecx
xor cl, byte [ebp + 0x4e]
xor eax, 0x834d3a37
les eax, [eax + ebp*8]
or eax, dword [eax]
add byte [eax], al
add byte [esp + edi], bh
inc ebx
inc eax
dec esp
dec edi
inc esi
inc eax
inc edi
cmp eax, 0x8104c483
jecxz 0x427435
loop 0x4273d2
add byte [ebx - 0x75], bl
xchg ebp, eax
cmp bl, dh
invalid
add byte [ecx + 0x12e0dc1], al
add byte [ecx + 0x56], bl
push edx
add esp, 4
jmp 0x42744a
add esi, 0x15d51
sub esi, 0xfb37
xor esi, 0x168c6
pop esi
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x42747a
movzx edx, word [ebp - 0x220]
movzx eax, word [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0x166c], edx
jmp 0x4274d4
movzx ecx, word [ebp - 0x220]
movzx edx, word [ebp - 0x3c]
cmp ecx, edx
je 0x4273a2
movzx eax, word [ebp - 0x220]
xor eax, 0x20
movzx ecx, word [ebp - 0x3c]
cmp eax, ecx
je 0x4273a2
movzx edx, word [ebp - 0x220]
movzx eax, word [ebp - 0x3c]
cmp edx, eax
jge 0x4274be
mov dword [ebp - 0x1668], 0xffffffff
jmp 0x4274c8
mov dword [ebp - 0x1668], 1
mov ecx, dword [ebp - 0x1668]
mov dword [ebp - 0x166c], ecx
cmp dword [ebp - 0x166c], 0
jne 0x42751d
push ecx
push eax
add esp, 4
add ecx, 0x8353
and ecx, 0x16b37
or ecx, 0x4b14
jmp 0x4274fc
pop ecx
push ebx
push ebx
add esp, 4
or ebx, 0x97ee
add ebx, 0x10333
pop ebx
mov edx, dword [ebp - 0x518]
mov dword [ebp - 0x774], edx
jmp 0x427585
push eax
sub eax, 0x949b
and eax, 0x13d23
add eax, 0x391c
pop eax
push ebx
push esi
add esp, 4
or ebx, 0x13afc
and ebx, 0x16c18
add ebx, 0xfcd0
add ebx, 0x263d
pop ebx
mov eax, dword [ebp - 0x518]
mov ecx, dword [eax]
mov dword [ebp - 0x518], ecx
mov edx, dword [ebp - 0x518]
cmp edx, dword [ebp - 0xcd0]
je 0x42757b
mov eax, dword [ebp - 0x518]
cmp dword [eax + 0x30], 0
jne 0x427346
mov dword [ebp - 0x774], 0
push edx
push esi
add esp, 4
add edx, 0xf00c
pop edx
push ebx
add ebx, 0x10725
xor ebx, 0xf9d0
add ebx, 0x8b9d
xor ebx, 0x6f98
add byte [eax], al
pop ebx
push edx
push eax
add esp, 4
Function at 0x4275a8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push ecx
add esp, 4
xor esi, 0x16f80
or esi, 0x172da
add esi, 0x5698
xor esi, 0xa399
pop esi
push ebx
or ebx, 0x11891
sub ebx, 0xf7cf
sub ebx, 0x7953
pop ebx
lea eax, [ebp - 0x1774]
mov dword [ebp - 0xccc], eax
mov ecx, dword [ebp - 0x518]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xcc8], edx
xor eax, eax
mov word [ebp - 0x220], ax
xor ecx, ecx
mov word [ebp - 0x3c], cx
push ebx
push edi
add esp, 4
call 0x4273b7
add byte [eax], bh
dec ebx
dec ecx
xor cl, byte [ebp + 0x4e]
xor eax, 0x834d3a37
les eax, [eax + ebp*8]
or eax, dword [eax]
add byte [eax], al
add byte [esp + edi], bh
inc ebx
inc eax
dec esp
dec edi
inc esi
inc eax
inc edi
cmp eax, 0x8104c483
jecxz 0x427435
loop 0x4273d2
add byte [ebx - 0x75], bl
xchg ebp, eax
cmp bl, dh
invalid
add byte [ecx + 0x12e0dc1], al
add byte [ecx + 0x56], bl
push edx
add esp, 4
jmp 0x42744a
add esi, 0x15d51
sub esi, 0xfb37
xor esi, 0x168c6
pop esi
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x42747a
movzx edx, word [ebp - 0x220]
movzx eax, word [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0x166c], edx
jmp 0x4274d4
movzx ecx, word [ebp - 0x220]
movzx edx, word [ebp - 0x3c]
cmp ecx, edx
je 0x4273a2
movzx eax, word [ebp - 0x220]
xor eax, 0x20
movzx ecx, word [ebp - 0x3c]
cmp eax, ecx
je 0x4273a2
movzx edx, word [ebp - 0x220]
movzx eax, word [ebp - 0x3c]
cmp edx, eax
jge 0x4274be
mov dword [ebp - 0x1668], 0xffffffff
jmp 0x4274c8
mov dword [ebp - 0x1668], 1
mov ecx, dword [ebp - 0x1668]
mov dword [ebp - 0x166c], ecx
cmp dword [ebp - 0x166c], 0
jne 0x42751d
push ecx
push eax
add esp, 4
add ecx, 0x8353
and ecx, 0x16b37
or ecx, 0x4b14
jmp 0x4274fc
pop ecx
push ebx
push ebx
add esp, 4
or ebx, 0x97ee
add ebx, 0x10333
pop ebx
mov edx, dword [ebp - 0x518]
mov dword [ebp - 0x774], edx
jmp 0x427585
push eax
sub eax, 0x949b
and eax, 0x13d23
add eax, 0x391c
pop eax
push ebx
push esi
add esp, 4
or ebx, 0x13afc
and ebx, 0x16c18
add ebx, 0xfcd0
add ebx, 0x263d
pop ebx
mov eax, dword [ebp - 0x518]
mov ecx, dword [eax]
mov dword [ebp - 0x518], ecx
mov edx, dword [ebp - 0x518]
cmp edx, dword [ebp - 0xcd0]
je 0x42757b
mov eax, dword [ebp - 0x518]
cmp dword [eax + 0x30], 0
jne 0x427346
mov dword [ebp - 0x774], 0
push edx
push esi
add esp, 4
add edx, 0xf00c
pop edx
push ebx
add ebx, 0x10725
xor ebx, 0xf9d0
add ebx, 0x8b9d
xor ebx, 0x6f98
add byte [eax], al
pop ebx
push edx
push eax
add esp, 4

Function at 0x4275b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub edx, 0x9737
pop edx
cmp dword [ebp - 0x774], 0
jne 0x427601
push edi
or edi, 0x221c
sub edi, 0x1541e
push ebx
and ebx, 0x14307
jmp 0x42760e
call 0x42761b

Function at 0x427613
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [eax], bh
push eax
dec ebp
dec ecx
inc eax
dec edi
cmp eax, 0x8104c483
retf

Function at 0x42761b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [eax], bh
push eax
dec ebp
dec ecx
inc eax
dec edi
cmp eax, 0x8104c483
retf
Function at 0x427706
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x778]
mov eax, dword [ebp - 0x3a4]
add eax, dword [edx + 0x24]
mov dword [ebp - 0x1a0c], eax
mov ecx, dword [ebp - 0x778]
mov edx, dword [ebp - 0x3a4]
add edx, dword [ecx + 0x1c]
mov dword [ebp - 0x1a10], edx
mov dword [ebp - 0x77c], 0
add byte [eax], al
jmp 0x42774b

Function at 0x427738
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x778]
mov eax, dword [ebp - 0x3a4]
add eax, dword [edx + 0x24]
mov dword [ebp - 0x1a0c], eax
mov ecx, dword [ebp - 0x778]
mov edx, dword [ebp - 0x3a4]
add edx, dword [ecx + 0x1c]
mov dword [ebp - 0x1a10], edx
mov dword [ebp - 0x77c], 0
add byte [eax], al
jmp 0x42774b
Function at 0x44c620
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ff9f0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x56c158]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [edi], vtable.boost::program_options::error_with_option_name.0
mov eax, dword [edi + 0x4c]
mov dword [ebp - 4], 0
cmp eax, 0x10
jb 0x44c668
inc eax
lea ecx, [edi + 0x38]
push eax
push dword [edi + 0x38]
call fcn.0044de80
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0xf
mov byte [edi + 0x38], 0
mov eax, dword [edi + 0x34]
mov dword [ebp - 4], 1
cmp eax, 0x10
jb 0x44c696
inc eax
lea ecx, [edi + 0x20]
push eax
push dword [edi + 0x20]
call fcn.0044de80
lea esi, [edi + 0x18]
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0xf
mov ecx, esi
mov byte [edi + 0x20], 0
mov eax, dword [esi]
push dword [eax + 4]
push esi
call fcn.004494b0
push 0x58
push dword [esi]
call fcn.00497ad0
mov eax, dword [edi + 0x10]
lea esi, [edi + 0x10]
add esp, 8
mov ecx, esi
push dword [eax + 4]
push esi
call fcn.00427706
push 0x40
push dword [esi]
call fcn.00497ad0
lea eax, [edi + 4]
mov dword [ebp - 4], 4
push eax
mov dword [edi], vtable.std::exception.0
call fcn.004a1a32
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x462e30
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x502c0d
mov eax, dword fs:[0]
push eax
sub esp, 0x64
push esi
mov eax, dword [0x56c158]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
mov dword [esi + 4], eax
push 0
lea ecx, [ebp - 0x70]
mov dword [ebp - 4], 0
mov dword [esi], vtable.std::codecvt_wchar_t__char__struct__Mbstatet_.0
call fcn.00463554
mov dword [ebp - 0x6c], 0
mov byte [ebp - 0x68], 0
mov dword [ebp - 0x64], 0
mov byte [ebp - 0x60], 0
xor eax, eax
mov dword [ebp - 0x5c], 0
mov word [ebp - 0x58], ax
mov dword [ebp - 0x54], eax
mov word [ebp - 0x50], ax
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], al
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], al
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 7
push 0x50b828
push eax
call fcn.00464852
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 8
push eax
call fcn.004649e1
movups xmm0, xmmword [eax]
movups xmmword [esi + 8], xmm0
movups xmm0, xmmword [eax + 0x10]
movups xmmword [esi + 0x18], xmm0
movq xmm0, qword [eax + 0x20]
movq qword [esi + 0x28], xmm0
mov eax, dword [eax + 0x28]
mov dword [esi + 0x30], eax
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 9
push eax
call fcn.0046489d
add esp, 0x10
mov eax, dword [ebp - 0x44]
mov byte [ebp - 4], 0xa
test eax, eax
je 0x462f10
push eax
call fcn.004ad1d7
add esp, 4
mov dword [ebp - 0x44], 0
mov eax, dword [ebp - 0x4c]
mov byte [ebp - 4], 0xb
test eax, eax
je 0x462f2b
push eax
call fcn.004ad1d7
add esp, 4
mov dword [ebp - 0x4c], 0
mov eax, dword [ebp - 0x54]
mov byte [ebp - 4], 0xc
test eax, eax
je 0x462f46
push eax
call fcn.004ad1d7
add esp, 4
mov dword [ebp - 0x54], 0
mov eax, dword [ebp - 0x5c]
mov byte [ebp - 4], 0xd
test eax, eax
je 0x462f61
push eax
call fcn.004ad1d7
add esp, 4
mov dword [ebp - 0x5c], 0
mov eax, dword [ebp - 0x64]
mov byte [ebp - 4], 0xe
test eax, eax
je 0x462f7c
push eax
call fcn.004ad1d7
add esp, 4
mov dword [ebp - 0x64], 0
mov eax, dword [ebp - 0x6c]
mov byte [ebp - 4], 0xf
test eax, eax
je 0x462f97
push eax
call fcn.004ad1d7
add esp, 4
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x6c], 0
call fcn.004635bb
mov dword [esi], vtable.boost::program_options::detail::utf8_codecvt_facet.0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4820cc
Capabilities:
Delete registry key

Disassembly:
push 0xac
mov eax, 0x505e23
call fcn.00498168
mov edi, ecx
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
mov edx, dword [ebp + 0xc]
push edx
mov ebx, dword [eax]
call fcn.00401488
cmp dword [eax + 0x14], 8
jb 0x4820f6
mov eax, dword [eax]
xor esi, esi
push esi
push ebx
push esi
push dword [ebp + 0x10]
push eax
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyTransactedW]
lea ecx, [ebp - 0x2c]
mov edi, eax
call fcn.0040dc64
cmp edi, 2
je 0x48219a
test edi, edi
jne 0x4821a2
jmp 0x48219a
call fcn.004980ba
ret 0xc
push 0x472
push 0x532d7c
push edi
push 4
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], esi
call fcn.00417422
push 0x5519c4
lea eax, [ebp - 0xa8]
push eax
call fcn.004a1a51
int3

Function at 0x499e83
Capabilities:
Create thread

Disassembly:
push 0
mov eax, 0x5085aa
call fcn.004980c9
mov esi, ecx
push dword [ebp + 8]
lea eax, [ebp + 8]
push eax
call fcn.0049a108
xor ebx, ebx
lea edi, [esi + 4]
push edi
push ebx
push dword [ebp + 8]
mov dword [ebp - 4], ebx
push 0x499fee
push ebx
push ebx
call fcn.004cc926
add esp, 0x20
mov dword [esi], eax
test eax, eax
je 0x499ec9
mov eax, esi
call fcn.00498097
ret 4
push 6
mov dword [edi], ebx
call fcn.004642ea
int3

Function at 0x4a0160
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret
Function at 0x4d5ad4
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004d56af

Function at 0x4d5adf
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004d5839
Function at 0x4010b0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push str.SoftwareWildTangent
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push str.InstallSemaphore_1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
leave
ret

Function at 0x4010df
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
lea eax, [ebp - 4]
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SoftwareWildTangent
push 0x80000002
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401161
push edi
movzx edx, ax
push 7
pop ecx
mov eax, edx
shl edx, 0x10
or eax, edx
lea edi, [ebp - 0x2c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push str.InstallSemaphore_1
push dword [ebp - 4]
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 0x1e
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
pop edi
test eax, eax
jne 0x401161
lea eax, [ebp - 0x2c]
push eax
push str.Success
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x401161
mov bl, 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
leave
ret

Function at 0x40116f
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x401194
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
add esi, 0x32
cmp esi, 0xfa
jb 0x401175
pop esi
pop ebp
ret

Function at 0x401197
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x664
push ebx
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_StrCpyW]
push edi
push dword [ebp + 8]
lea eax, [esp + 0x46c]
push eax
call esi
mov edi, dword [sym.imp.SHLWAPI.dll_StrCatW]
push 0x4020ac
lea eax, [esp + 0x46c]
push eax
call edi
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x46c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x401238
cmp word [esp + 0x3c], 0x2e
je 0x401228
push dword [ebp + 8]
lea eax, [esp + 0x264]
push eax
call esi
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x264]
push eax
call edi
test byte [esp + 0x10], 0x10
lea eax, [esp + 0x260]
push eax
je 0x401222
call fcn.00401197
jmp 0x401227
call fcn.0040116f
pop ecx
lea eax, [esp + 0x10]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4011e8
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40124f
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x401271
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
sete al
pop ebp
ret
mov al, 1
pop ebp
ret
Function at 0x4012e6
Capabilities:
Accept command line arguments
Get common file path
Get program files directory
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x464
push 1
push 0x26
lea eax, [ebp - 0x25c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x40130e
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push ebx
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_StrCatW]
push 0x4020b0
lea eax, [ebp - 0x25c]
push eax
call edi
lea eax, [ebp - 0x25c]
push eax
call fcn.0040124f
pop ecx
test al, al
jne 0x401339
push 2
jmp 0x401308
push str.App_Update_
lea eax, [ebp - 0x25c]
push eax
call edi
lea eax, [ebp - 0x25c]
push eax
call fcn.0040124f
lea eax, [ebp - 0x25c]
push eax
call fcn.0040124f
pop ecx
pop ecx
test al, al
jne 0x401369
push 3
jmp 0x401308
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x4020f0
lea eax, [ebp - 0x54]
push 0x28
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
mov ebx, dword [sym.imp.SHLWAPI.dll_StrCpyW]
add esp, 0x10
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x464]
push eax
call ebx
push str.patch_
lea eax, [ebp - 0x464]
push eax
call edi
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x464]
push eax
call edi
push 0x402108
lea eax, [ebp - 0x464]
push eax
call edi
lea eax, [ebp - 0x464]
push eax
call fcn.0040103d
pop ecx
test al, al
je 0x4014a4
push esi
push 0x402120
mov esi, section..data
push esi
call ebx
lea eax, [ebp - 0x464]
push eax
push esi
call edi
push 0x402124
push esi
call edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ebx, [eax + 2]
jmp 0x40140c
add ebx, 2
cmp ax, 0x22
je 0x401414
movzx eax, word [ebx]
test ax, ax
jne 0x401403
call fcn.004010b0
push ebx
push esi
call edi
push 1
lea eax, [ebp - 0x25c]
push eax
push esi
call fcn.00401275
add esp, 0xc
push ebx
push esi
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrW]
push str._park_
push esi
call ebx
mov dword [ebp - 4], eax
test eax, eax
je 0x4014a3
push str._nolaunchapp
push esi
call ebx
test eax, eax
jne 0x4014a3
add dword [ebp - 4], 0xe
push 0x402120
push dword [ebp - 4]
call ebx
xor ebx, ebx
cmp eax, ebx
je 0x4014a3
push dword [ebp - 4]
xor ecx, ecx
mov esi, 0x404f40
push esi
mov word [eax], cx
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
call fcn.004010df
test al, al
je 0x401490
push str.__EventExecute__GlobalWTPARKEXEC___SignalExecute
jmp 0x401495
push str.__EventTerminate__GlobalWTPARKTERM___SignalTerminate
push esi
call edi
push ebx
push ebx
push esi
call fcn.00401275
add esp, 0xc
pop esi
lea eax, [ebp - 0x25c]
push eax
call fcn.00401197
pop ecx
pop edi
xor eax, eax
pop ebx
leave
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x11746e07
nop
nop
test eax, eax
nop
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
mov ecx, 0x7bd21480
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40729f
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x432030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6a
sub eax, 0x403d10
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219