joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4dc08a
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4dc0c2
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004da0d7
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004da0af
jmp 0x4dc0ce
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4dd886
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4dd8c8
call fcn.004e3f6d
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4dd8c8
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4dd8bf
xor eax, eax
jmp 0x4dd8d0
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004dd8d6
pop edi
pop esi
pop ebx
ret 4

Function at 0x4e449d
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4e44cb
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4e44e9
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004e4403
jmp 0x4e44e9
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4e44e9
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004e4403
test edi, edi
mov eax, edi
jne 0x4e44d3
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x430e90
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x24000]
push edi
jmp 0x430eaa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x430eb1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x430ea0
mov eax, 1
add ebx, ebx
jne 0x430ec3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x430eb8
jne 0x430ed4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x430eb8
xor ecx, ecx
sub eax, 3
jb 0x430ee8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x430f5a
mov ebp, eax
add ebx, ebx
jne 0x430ef3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x430f00
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x430f24
inc ecx
add ebx, ebx
jne 0x430f10
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x430f05
jne 0x430f21
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x430f05
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x430f44
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x430f35
jmp 0x430ea6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x430f44
add edi, ecx
jmp 0x430ea6
pop esi
mov edi, esi
mov ecx, 0x91a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x430f62
cmp byte [edi], 9
jne 0x430f62
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x430f67
lea edi, [esi + 0x2e000]
mov eax, dword [edi]
or eax, eax
je 0x430fdf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x43908]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x439e8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x430f94
mov ecx, edi
jns 0x430fc3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x439f0]
or eax, eax
je 0x430fd9
mov dword [ebx], eax
add ebx, 4
jmp 0x430fb1
call dword [esi + 0x439ec]
mov ebp, dword [esi + 0x439f4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x17f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x431013
sub esp, 0xffffff80
jmp 0x41382f
Function at 0x419b00
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0xa56218a8
sbb eax, 0xa054bd
xlatb
and al, 0x53
xor ah, dh
fcomp qword [edi + 0xb8270fd]
cmc
sub eax, 0x3d0774e4
sbb byte [edi + 0x17], bl
aaa
xor ecx, edx
jecxz 0x419b1c
jl 0x419b5b
mov dword [0x7e9c2ec7], eax
inc edi
out 0xd0, eax
mov edi, dword [esi]
sbb esi, dword [edx]
int 0xcf
rcl byte [eax]
fiadd dword [ebp + 0x12]
jecxz 0x419b69
sbb al, byte [eax + eax + 0x74000000]
stc
test byte [eax], al
add byte [eax], al
add byte [ecx + edi*8 - 0x43], dh
je 0x419afb
mov ebp, 0x7731d031
add dword [eax], eax
invalid
jp 0x419b0c
je 0x419afb
mov ebp, 0x7731d031
add dword [eax], eax
call 0xab419b88
jae 0x419b16
add byte [ebx + 0x26000673], ch
add byte [esi], ah
add eax, 0x31a8d00
add byte [ecx], ch
cdq
sub byte [0x45157ab7], 0x2e
loopne 0x419abf
add eax, dword [eax]
sub dword [ecx + 0x7ab72d82], ebx
mov bh, 0x7a
adc eax, 0x9ce02e45
int 0x9e
fimul dword [ebp - 0x7d]
shr byte [edx - 0x675b92], 0xf3
ja 0x419b81
leave
inc edi
hlt
jge 0x419bb6
outsd dx, dword [esi]
dec eax
mov bl, dh
xor esi, ebp
aas
wait
sbb ebx, ebx
std
clc
into
ret 0xab06
salc
adc eax, 0xe3fec155
mov dword [0x7160e872], eax
and dword gs:[eax], ebx
lea ebp, [edx]
lea eax, [eax]
cmpsd dword [esi], dword es:[edi]
std
mov ebp, 0x4b70e31b
dec edi
sbb ch, cl
mov eax, 0xdabfde48
hlt
int 0xf8
scasb al, byte es:[edi]
xor ebx, dword [ebx + 0x54]
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x5be890
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x293000]
push edi
jmp 0x5be8aa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5be8b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5be8a0
mov eax, 1
add ebx, ebx
jne 0x5be8c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5be8d4
jne 0x5be8f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5be8f3
dec eax
add ebx, ebx
jne 0x5be8e0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5be8b8
add ebx, ebx
jne 0x5be8ef
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x5be945
xor ecx, ecx
sub eax, 3
jb 0x5be90b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5be97a
sar eax, 1
mov ebp, eax
jmp 0x5be916
add ebx, ebx
jne 0x5be916
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5be8e4
inc ecx
add ebx, ebx
jne 0x5be924
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5be8e4
add ebx, ebx
jne 0x5be931
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x5be926
jne 0x5be942
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x5be926
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5be964
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x5be956
jmp 0x5be8a6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5be964
add edi, ecx
jmp 0x5be8a6
pop esi
mov edi, esi
mov ecx, 0x170b3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x5be982
cmp byte [edi], 0x45
jne 0x5be982
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x5be987
lea edi, [esi + 0x3c1000]
mov eax, dword [edi]
or eax, eax
je 0x5be9ff
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x3e5b08]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x3e5cd4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5be9b4
mov ecx, edi
jns 0x5be9e3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x3e5cd8]
or eax, eax
je 0x5be9f9
mov dword [ebx], eax
add ebx, 4
jmp 0x5be9d1
call dword [esi + 0x3e5ce8]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x5bea30
cmp al, 0xef
ja 0x5bea23
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x5bea05
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x5bea12
mov ebp, dword [esi + 0x3e5cdc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x5bea64
sub esp, 0xffffff80
jmp 0x39e487
Function at 0x4017b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0x4017de
call fcn.00401c30
mov eax, dword [ebp + 8]
cmp word [eax], 0x5a4d
jne 0x4017de
add eax, dword [eax + 0x3c]
cmp dword [eax], 0x4550
jne 0x4017de
call fcn.00401c4d
xor eax, eax
inc eax
leave
ret 4
call fcn.00401c4d
xor eax, eax
leave
ret 4
Function at 0x401fb4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x401fbe
repz ret
jmp fcn.004022d9

Function at 0x401026
Capabilities:
Create process on windows
Delete file
Read file on windows
Set file attributes
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov edx, section..text
push edi
push esi
push ebx
sub esp, 0x574
lea ecx, [esp + 0x64]
cmp edx, entry0
jae 0x40104c
movzx eax, byte [edx]
inc edx
xor al, 0xd9
mov byte [ecx], al
inc ecx
jmp 0x401039
mov byte [ecx], 0
lea esi, [esp + 0x64]
push esi
push 1
push 0
call 0x401220
push 0x104
lea ebx, [esp + 0x468]
push ebx
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push ebx
call sub.KERNEL32.dll_CreateFileA
test eax, eax
mov ebx, eax
je 0x401205
cmp eax, 0xffffffff
je 0x401205
push 2
push 0
push 0xffffffffffffff9c
push eax
call sub.KERNEL32.dll_SetFilePointer
push 0
lea ebp, [esp + 4]
push ebp
push 0x64
push esi
push ebx
call sub.KERNEL32.dll_ReadFile
push ebx
call sub.KERNEL32.dll_CloseHandle
lea edx, [esp + 0x65]
lea ecx, [esp + 0xc7]
cmp edx, ecx
jae 0x4010d4
movzx eax, byte [esp + 0x64]
xor byte [edx], al
inc edx
jmp 0x4010c6
lea edx, [esp + 0x14]
lea eax, [esp + 0x58]
cmp edx, eax
jae 0x4010e6
mov byte [edx], 0
inc edx
jmp 0x4010dc
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x8d]
push eax
call sub.KERNEL32.dll_CreateProcessA
test eax, eax
jne 0x401205
push 0
push 0
push 3
push 0
push 1
push 0x80000000
lea eax, [esp + 0x47c]
push eax
call sub.KERNEL32.dll_CreateFileA
test eax, eax
mov ebx, eax
je 0x401205
cmp eax, 0xffffffff
je 0x401205
push 2
mov eax, 0xffffff9c
push 0
sub eax, dword [esp + 0x6d]
push eax
push ebx
call sub.KERNEL32.dll_SetFilePointer
push 0
push ebp
push dword [esp + 0x6d]
push dword [esp + 0x71]
push 0
call sub.KERNEL32.dll_GetProcessHeap
push eax
call sub.KERNEL32.dll_HeapAlloc
push eax
mov esi, eax
push ebx
call sub.KERNEL32.dll_ReadFile
push ebx
call sub.KERNEL32.dll_CloseHandle
mov eax, esi
mov edx, esi
add eax, dword [esp + 0x65]
cmp esi, eax
jae 0x40119b
movzx eax, byte [esp + 0x64]
xor byte [edx], al
mov eax, esi
inc edx
add eax, dword [esp + 0x65]
cmp edx, eax
jmp 0x401187
push pe_nt_image_headers32
lea edi, [esp + 0x6d]
push edi
call sub.KERNEL32.dll_SetFileAttributesA
push edi
call sub.KERNEL32.dll_DeleteFileA
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push edi
call sub.KERNEL32.dll_CreateFileA
test eax, eax
mov ebx, eax
je 0x401205
cmp eax, 0xffffffff
je 0x401205
push 0
push ebp
push dword [esp + 0x6d]
push esi
push eax
call sub.KERNEL32.dll_WriteFile
push ebx
call sub.KERNEL32.dll_CloseHandle
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push edi
call sub.KERNEL32.dll_CreateProcessA
push 0
call sub.KERNEL32.dll_ExitProcess
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp dword [sym.imp.KERNEL32.dll_CreateMutexA]
Function at 0x401000
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x5fc]
sub esp, 0x67c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp + 0x5f8], eax
push esi
lea eax, [ebp - 0x80]
push eax
mov esi, ecx
mov dword [ebp - 0x80], 0x44
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
lea eax, [ebp + 0x3ec]
push edi
push eax
call fcn.00403298
pop ecx
pop ecx
lea eax, [ebp + 0x3ec]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push esi
call fcn.004032b7
movzx eax, word [esi + eax*2 - 2]
pop ecx
cmp ax, 0x69
je 0x401073
cmp ax, 0x49
je 0x401073
push ebx
push esi
lea eax, [ebp + 0x3ec]
push eax
push str.__s_s___s
jmp 0x401081
push ebx
push esi
lea eax, [ebp + 0x3ec]
push eax
push 0x4040b4
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x80]
push eax
push edi
xor eax, eax
push eax
push eax
push eax
push eax
push eax
lea ecx, [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4010b2
push 0xc
pop eax
jmp 0x4010dd
push 0xffffffffffffffff
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x3c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x38]
call esi
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp + 0x5f8]
xor ecx, ebp
pop esi
call fcn.0040325b
add ebp, 0x5fc
leave
ret
Function at 0x401217
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, 0xb7
mov dword [ebp - 0x22c], 5
mov eax, dword [ebp - 0x22c]
dec dword [ebp - 0x22c]
test eax, eax
je 0x401376
push 3
pop esi
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
test eax, eax
je 0x4012a9
mov al, byte [ebp - 0x22c]
mov dword [ebp - 0x228], 0x1df14869
mov byte [ebp - 0x220], 0x87
mov byte [ebp - 0x21f], 0x2f
mov byte [ebp - 0x21e], 0x49
mov byte [ebp - 0x21d], 0x3a
mov byte [ebp - 0x21c], 0xe
mov byte [ebp - 0x21b], al
mov byte [ebp - 0x21a], 0xdb
mov byte [ebp - 0x219], 0x17
mov eax, 0xbab0
mov word [ebp - 0x224], ax
mov eax, 0x7891
mov word [ebp - 0x222], ax
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x401376
lea eax, [ebp - 0x218]
push eax
xor esi, esi
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
movzx eax, byte [ebp - 0x219]
push eax
movzx eax, byte [ebp - 0x21a]
push eax
movzx eax, byte [ebp - 0x21b]
push eax
movzx eax, byte [ebp - 0x21c]
push eax
movzx eax, byte [ebp - 0x21d]
push eax
movzx eax, byte [ebp - 0x21e]
push eax
movzx eax, byte [ebp - 0x21f]
push eax
movzx eax, byte [ebp - 0x220]
push eax
movzx eax, word [ebp - 0x222]
push eax
movzx eax, word [ebp - 0x224]
push eax
push dword [ebp - 0x228]
lea eax, [ebp - 0x218]
push eax
push str._s_08lX__04X__04X__02X_02X__02X_02X_02X_02X_02X_02X_
push ebx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x38
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x401376
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0xb7
je 0x40123a
mov ecx, dword [ebp - 4]
xor eax, eax
test esi, esi
sete al
xor ecx, ebp
pop esi
call fcn.0040325b
leave
ret

Function at 0x4013f7
Capabilities:
Accept command line arguments

Disassembly:
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
test esi, esi
je 0x40141d
movzx eax, word [esi]
cmp ax, 0x20
je 0x40141d
cmp ax, 0x2f
je 0x40141d
cmp ax, 0x2d
je 0x40141d
inc esi
inc esi
jne 0x401404
push str.CommandLine
push dword [esp + 0xc]
call fcn.0040138a
push eax
push dword [esp + 0x18]
call fcn.00403298
push 0x40417c
push dword [esp + 0x20]
call fcn.0040326a
push esi
push dword [esp + 0x28]
call fcn.0040326a
add esp, 0x20
xor eax, eax
pop esi
ret
Function at 0x401454
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa04
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0xa00], eax
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ebx, [esp + 0x28]
mov edi, eax
mov byte [esp + 0xf], 0
call fcn.00401217
test al, al
jne 0x401495
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0xa
push 0x404180
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
xor ebx, ebx
cmp eax, ebx
je 0x4014bf
push eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x18]
push eax
push edi
call fcn.0040188d
add esp, 0x10
jmp 0x4014c4
mov eax, 0x716
cmp eax, ebx
jne 0x4014fb
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x28]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], 3
mov dword [esp + 0x18], ebx
call fcn.00401622
test eax, eax
je 0x4014fe
lea esi, [esp + 0x14]
call fcn.00401601
push ebx
jmp 0x40148f
push 1
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x1c]
call fcn.004016bb
cmp eax, ebx
jne 0x4014fb
lea esi, [esp + 0x14]
call fcn.00401601
lea eax, [esp + 0x238]
push eax
push edi
call fcn.004013f7
pop ecx
pop ecx
cmp eax, ebx
jne 0x4014fb
xor edx, edx
cmp word [esp + 0x238], bx
je 0x40158f
movzx ecx, word [esp + 0x238]
xor eax, eax
cmp cx, 0x2d
je 0x401551
cmp cx, 0x2f
jne 0x401577
movzx ecx, word [esp + eax + 0x23a]
cmp cx, bx
je 0x401577
cmp cx, 0x72
jne 0x401577
movzx eax, word [esp + eax + 0x23c]
cmp ax, bx
je 0x401577
cmp ax, 0x74
je 0x40158a
inc edx
lea eax, [edx + edx]
movzx ecx, word [esp + eax + 0x238]
cmp cx, bx
jne 0x401545
jmp 0x40158f
mov byte [esp + 0xf], 1
push str.ExecuteFiles
push edi
call fcn.0040138a
mov esi, eax
push esi
call fcn.004032b7
add esp, 0xc
test eax, eax
je 0x4015be
push esi
lea ecx, [esp + 0x23c]
lea ebx, [esp + 0x2c]
call fcn.00401180
xor ebx, ebx
jmp 0x4015f0
lea eax, [esp + 0x238]
push eax
mov edx, 0x4041a8
lea ecx, [esp + 0x2c]
call fcn.004010f3
pop ecx
cmp eax, 5
jne 0x4015f1
lea eax, [esp + 0x238]
push eax
mov edx, str.setup.exe
lea ecx, [esp + 0x2c]
call fcn.004010f3
pop ecx
cmp byte [esp + 0xf], bl
je 0x4014fb
push eax
jmp 0x40148f
Function at 0x4016bb
Capabilities:
Create directory
Get common file path
Set current directory
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
je 0x4016df
and dword [esi], 0
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x401700
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40187c
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x4016f5
mov ecx, dword [esi]
cmp ecx, dword [esi + 4]
jae 0x401865
mov eax, dword [esi + 8]
mov edi, dword [eax + ecx]
add dword [esi], 4
mov ecx, dword [esi]
mov dword [ebp - 0x224], edi
mov edx, dword [ecx + eax]
add ecx, 4
mov dword [ebp - 0x230], edx
mov dword [esi], ecx
cmp edx, 2
je 0x401865
test edx, edx
jne 0x401790
cmp dword [esi + 0xc], 1
jbe 0x401790
and dword [ebp - 0x21c], 0
lea edx, [ecx + eax]
mov dword [ebp - 0x220], edx
lea edx, [ebp - 0x22c]
sub dword [ebp - 0x220], edx
mov edx, dword [ebp - 0x21c]
mov ebx, dword [ebp - 0x220]
inc dword [ebp - 0x21c]
cmp dword [ebp - 0x21c], 8
lea edx, [ebp + edx - 0x22c]
mov bl, byte [ebx + edx]
mov byte [edx], bl
jb 0x401764
add ecx, 8
mov dword [esi], ecx
mov ebx, dword [esi]
lea ecx, [ebx + edi]
mov edx, ecx
and edx, 3
mov dword [esi], ecx
je 0x4017a5
sub ecx, edx
add ecx, 4
mov dword [esi], ecx
mov edi, dword [esi]
add edi, eax
push edi
call fcn.004032b7
lea eax, [eax + eax + 2]
add dword [esi], eax
mov eax, dword [esi]
pop ecx
mov ecx, eax
and ecx, 3
je 0x4017c6
sub eax, ecx
add eax, 4
mov dword [esi], eax
cmp dword [ebp - 0x230], 1
jne 0x4017ff
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4017eb
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0xb7
jne 0x40185c
push 0
push edi
mov ecx, esi
call fcn.004016bb
test eax, eax
je 0x40170b
jmp 0x40187c
xor eax, eax
push eax
push 0x80
push 2
push eax
push eax
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x401860
push 0
lea eax, [ebp - 0x224]
push eax
push dword [ebp - 0x224]
mov eax, dword [esi + 8]
add eax, ebx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [esi + 0xc], 1
jbe 0x401850
lea eax, [ebp - 0x22c]
push eax
push eax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40170b
call ebx
jmp 0x40187c
push 9
pop eax
jmp 0x40187c
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x4016f5
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040325b
leave
ret 8
Function at 0x4018ea
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
sub esp, 0xc
xor eax, eax
and edx, 7
cmp ecx, 5
jae 0x401901
leave
ret
or dword [ebp - 4], 0xffffffff
push ebx
push esi
mov esi, dword [ebp + 8]
lea ecx, [esi + ecx - 4]
push edi
mov dword [ebp - 8], ecx
lea edi, [eax + esi]
jmp 0x401920
mov al, byte [edi]
and al, 0xfe
cmp al, 0xe8
je 0x401925
inc edi
cmp edi, dword [ebp - 8]
jb 0x401917
mov eax, edi
sub eax, esi
cmp edi, dword [ebp - 8]
jae 0x401a14
mov ecx, eax
sub ecx, dword [ebp - 4]
cmp ecx, 3
jbe 0x4019a7
xor edx, edx
mov cl, byte [edi + 4]
mov dword [ebp - 4], eax
test cl, cl
je 0x401951
cmp cl, 0xff
jne 0x4019d6
movzx esi, cl
movzx ecx, byte [edi + 3]
shl esi, 8
or esi, ecx
movzx ecx, byte [edi + 2]
shl esi, 8
or esi, ecx
movzx ecx, byte [edi + 1]
shl esi, 8
or esi, ecx
sub esi, eax
sub esi, 5
mov ebx, esi
mov dword [ebp - 0xc], ebx
test edx, edx
je 0x4019e7
movzx esi, byte [edx + 0x4041dc]
push 0x18
shl esi, 3
pop ecx
sub ecx, esi
shr ebx, cl
test bl, bl
je 0x401997
cmp bl, 0xff
jne 0x4019e4
push 0x20
pop ecx
sub ecx, esi
xor esi, esi
inc esi
shl esi, cl
dec esi
xor esi, dword [ebp - 0xc]
jmp 0x40196f
dec ecx
shl edx, cl
and edx, 7
je 0x40193e
movzx ecx, byte [edx + 0x4041dc]
mov ebx, edi
sub ebx, ecx
cmp byte [edx + 0x4041d4], 0
mov cl, byte [ebx + 4]
je 0x4019d3
test cl, cl
je 0x4019d3
cmp cl, 0xff
jne 0x40193e
mov dword [ebp - 4], eax
and edx, 3
add edx, edx
or edx, 1
inc eax
jmp 0x401912
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp + 8]
mov ecx, ebx
shr ecx, 0x18
and cl, 1
dec cl
not cl
mov byte [edi + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [edi + 3], cl
mov ecx, ebx
shr ecx, 8
mov byte [edi + 2], cl
mov byte [edi + 1], bl
add eax, 5
jmp 0x401912
mov esi, eax
sub esi, dword [ebp - 4]
push 3
lea ecx, [esi - 1]
shl edx, cl
pop edi
and edx, 7
cmp edi, esi
sbb ecx, ecx
not ecx
pop edi
and ecx, edx
mov edx, dword [ebp + 0xc]
pop esi
mov dword [edx], ecx
pop ebx
leave
ret

Function at 0x40325b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x403265
repz ret
jmp fcn.0040331b