joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b69dc
Capabilities:
Encode data using xor

Disassembly:
cmp cl, cl
cmp ah, byte [ebp + 0x4ab61bc0]
mov dh, 0x4a
loopne 0x4b6a5d
call 0xffdf1262
sub byte [edi + 0x34], bl
pop edi
xor al, 0x99
cdq
push 0xb71ac329
wait
loope 0x4b6a4e
std
sbb byte [edx], cl
out 0xa1, eax
inc esi
mov ecx, 0xbf5a0ea8
mov cl, 0x7c
dec ebx
jle 0x4b69ec
in al, dx
push 0xfffffffffffffffd
test eax, 0xdeb9904b
jno 0x4b69e2
dec ecx
inc ebx
aad 0x30
std
cdq
sbb ebx, dword [edx + 0x3b0b0377]
pop ss
scasb al, byte es:[edi]
loope 0x4b6a7a
mov al, byte [0xf9867040]
invalid
clc
nop
and edx, dword [ebx + 0x6a]
ror dword [ecx], cl
daa
js 0x4b6a72
jns 0x4b69ee
iretd
test eax, 0x75d68179
cld
mov esi, ds
sbb byte [eax - 0x66c7767f], bh
xchg esp, eax
lodsd eax, dword [esi]
cmp byte [edx - 0x670ea170], bh
cwde
xor eax, 0x4883a136
lds ebx, [ebx + 0x4829ef7c]
mov bh, 1
jl 0x4b6a6b
sub dword [eax - 0xd], ecx
mov bh, 1
pop ecx
lcall 0xd907, 0x313d3cd5
test al, 4
or ebp, dword [esi + 0x79]
mov byte [0x1dc9918], al
scasb al, byte es:[edi]
mov dl, 0x32
add eax, 0x29ea35ff
cmpsb byte [esi], byte es:[edi]
test al, 0xbd
fdivr dword [0xbaf108e2]
pop ebp
in eax, dx
push esi
fisttp qword [ecx + 0x5738acf0]
sub ah, bl
mov ch, 0x9e
mov dl, 0xf8
xchg byte [ecx + 0x6a], bh
xchg ecx, eax
mov ecx, 0xc5d98b61
sub ebp, eax
cmp dl, byte [ebp + 0x54c71b16]
std
pop edi
mov al, byte gs:[0xb88abd7d]
dec esp
xor byte [ecx], ch
ror byte [eax - 0x73], 1
and ah, byte [eax]
and dword [eax], 0x85554670
cwde
outsb dx, byte [esi]
dec edx
cmp byte [ecx + edx*4 + 7], ah
xchg dword [eax - 0x5a], ecx
invalid
Function at 0x5967bc
Capabilities:
Encode data using xor

Disassembly:
pop ss
cmpsb byte [esi], byte es:[edi]
scasd eax, dword es:[edi]
xor edi, 0xffffffa4
int 0x78
invalid
js 0x596825
das
test byte [eax + 0x69acb172], dl
salc
daa
xchg dword [eax + 0x62], edx
pop ss
jecxz 0x59677f
mov esp, 0x2a9cc939
push 0xffffffffffffffa2
in eax, 0xce
nop
inc esi
mov dh, 0x7a
inc ebx
push eax
rol dword [ebx - 0x1e], 1
movsd dword es:[edi], dword [esi]
push es
enter 0x21c, 0x21
retf 0x3045
aam 0x49
mov dl, 0xe8
out dx, al
dec ebp
and ch, byte [esi - 0x6c3eccec]
sub al, 0x3e
les esp, [ecx - 0x46]
lahf
and al, al
inc esp
cmp al, 0x8b
loopne 0x5968ac
adc dword [ecx + edx - 0x76], eax
sub byte [eax], dh
and byte [ebx + 0x113883a2], bh
invalid
sal byte [edx], cl
jp 0x596917
lcall 0x2048, 0x73629f4a
mov al, 0x19
mov esi, 0x3229430f
test al, 0x57
inc edx
pop esi
jno 0xb35c6fdb
pop ecx
jecxz 0x596917
rol byte [esi + 0x42], cl
inc ecx
ret
adc bl, cl
dec ah
xor dword [ebp + 0x52], edx
jecxz 0x596970
and al, byte [ebx - 0x39]
dec edi
xor cl, byte [edi]
and al, 0x93
mov al, byte [0x60195493]
frstor dword [edi - 0x78]
xchg byte [edx], dh
cmp dword [edi], 0x6f
dec ebp
sub dword [0x205fd275], ebx
fdiv st(3)
mov dh, 0xed
jecxz 0x596972
jl 0x596969
and ah, byte [ecx]
xchg edx, eax
mov edx, ecx
inc ebx
test byte [edi + 4], ch
sbb ecx, eax
or al, byte [eax - 0x77]
and ah, byte [ecx - 0x5bc7a7a]
sub al, 0x66
test dh, cl
invalid
add byte [eax + 0x36c15fe], ch
arpl word [eax + 0x6311af66], dx
dec edx
nop
scasw ax, word es:[edi]
scasd eax, dword es:[edi]
adc dword [ebx + 0x4a], esp
push es
cdq
add byte [ecx + 0x21], 0x18
adc dl, bl
fnstcw word [0x5a35c7d5]
xor dh, byte [edi + 0x18]
retf

Function at 0x59767c
Capabilities:
Encode data using xor

Disassembly:
mov al, 0x45
inc ebp
pop edi
wait
push cs
loop 0x5976b0
wait
adc ecx, dword [eax]
out 0x73, eax
call 0xf28159b1
rol dword fs:[eax - 0x4ecc2635], cl
cvttps2pi mm5, qword [esi - 0x1340da3c]
adc dword [eax + 0x29ef6793], eax
popal
and byte [0x864eed26], dh
mov dword [0x91ad9ef1], eax
push ss
lodsb al, byte [esi]
mov esi, 0xa130487f
hlt
jno 0x59763c
pop ds
cmp ecx, 0xffffff9f
mov ebp, 0x9d3e561f
arpl word [ebp + 0x637536e4], bx
mov bh, 0xd5
jne 0x5976a4
cmp byte [edx + eax*4 - 0x783c37bd], 0xf4
mov bh, 0xf
mov dword [esi - 0x4f], edi
pop es
sti
jae 0x5976d5
push ecx
out 0xe4, al
sub dword [esi], ebx
daa
dec ebp
xor cl, byte [ebp - 0xdbb195b]
aam 0x35
aam 0x35
rcr byte [edi - 0x58d67026], cl
xor esp, dword [ebx]
lahf
fimul dword [edi + 0x2333a729]
rcl dword [edx + 0x74], cl
add byte [ebx + 0x3e], 0x7d
das
mov eax, dword [0x96a7721e]
cmpsb byte cs:[esi], byte es:[edi]
fist word [edx + 0x263987b5]
das
ja 0x5976ab
aad 0xe1
rol dword [esi - 0x58164abf], cl
jle 0x597679
jmp 0x3bf9f581
cmp eax, dword [ebp - 0xd36548f]
add dword [eax - 0x6c], 0x90226501
out dx, eax
cdq
imul esp, dword [edx], 0xd511af76
nop
xchg edi, eax
invalid
Function at 0x6241bc
Capabilities:
Encode data using xor

Disassembly:
in eax, dx
bound ebx, qword [ebx]
xchg ebx, eax
std
sbb eax, 0x5d19b1cf
std
js 0x6241a8
cli
jne 0x624125
not dword [esi - 0x37c900c4]
and ah, byte [edi - 0x37]
ljmp 0x160c
loopne 0x6241e7
mov ebx, 0x5c6cf87a
push cs
mov dword [esi], ebx
aam 0xfd
jb 0x6241f0
outsb dx, byte [esi]
scasb al, byte es:[edi]
and al, 0x68
jb 0x624119
cmpsd dword [esi], dword es:[edi]
and dword [edx + 0x406e0fbc], 0x18
fbstp tbyte [0xbc413cb5]
inc eax
sbb bh, bl
xor eax, 0xbc413cb5
jp 0x62417d
fdivr qword [ebx*4 + 0x5b32d995]
cmp al, 0x9d
xchg ebp, eax
fnstenv [edx]
pop ebx
xor al, 0xae
scasb al, byte es:[edi]
jae 0x624197
jb 0x624163
lodsb al, byte [esi]
in eax, 0xd8
mov ebx, 0x992219a2
sub ebp, edi
sbb edx, esi
lodsd eax, dword [esi]
sbb byte [ebx + 0x4efb70b3], al
mov bl, 0x70
sti
dec esi
fmulp st(3)
cmpsb byte [esi], byte es:[edi]
std
cmpsd dword [esi], dword es:[edi]
and dword [eax + 0x577dba33], edx
cmp esp, ebx
inc esi
test al, 0x42
fadd qword [esi - 0x58]
inc edx
lcall 0x4b15, 0x8f2761e6
push es
jl 0x62418c
out dx, al
loopne 0x624259
invalid
jl 0x6241a0
ret 0x4623
and eax, dword [esi + 0x3b]
test byte [ebx - 0x72cfee8d], bl
and dh, 0xf0
cwde
pop esi
dec ebx
adc eax, 0x80be5031
pop ecx
jb 0x6241cc
mov esi, 0xd7725980
fistp dword [ebp - 0x47c5549a]
cmp dword [edi - 0x3b0c1739], ebx
outsb dx, byte [esi]
in eax, dx
xchg edx, eax
jl 0x6241de
xor bl, byte [esi + 0x58]
jo 0x624243
pushal
dec eax
and dword [esp + edi*4 + 0x5205015e], 0x39
inc edi
xchg ebp, eax
add cl, byte [ecx - 0x35aec7e3]
xchg ebp, eax
cmp dword [ebp - 0x7c], 0x10
jne 0x62421f
dec esp
ljmp 0xb173
call 0xb1d5c6d2
arpl si, di
wait
or esi, ebp
imul edi
lds eax, [edx - 0x67]
mov ebp, 0xe12ecc54
test dword [edx - 0x6a], 0x573c73f0
rcr dword [eax + 0x619233ca], 1
dec esi
or byte [eax], 0xbc
mov eax, 0xcd59bfb8
in al, 0xab
pop esp
invalid
stosb byte es:[edi], al
adc ecx, dword [ebp + 0x61ccdab6]
jnp 0x624228
cdq
and eax, 0xbe893331
rol byte [ebp + 0x46], 0x35
dec ecx
neg eax
push esp
inc eax
and ebp, edi
cmpsd dword [esi], dword es:[edi]
xlatb
mov edx, dword [eax - 0x7d]
add ch, byte [edi - 0x3c7830f8]
mov ch, 0xc0
fst qword [ebx]
les ebp, [ebx + 0x6a]
lahf
mov eax, 0x1164c5ae
outsd dx, dword [esi]
mov byte [0x1b16b0c2], al
xchg dword [edx + 0x17824df0], edi
xor eax, 0xe1f0e6ca
outsb dx, byte [esi]
in al, 0
rcr bl, 1
push ss
leave
lodsd eax, dword [esi]
or dword [ecx + ebp*8], edx
push edx
mov byte [ecx], ah
stosb byte es:[edi], al
mov byte [0xb82843c6], al
mov ch, 0xca
jno 0x6242cd
jmp 0xaa83cafd
pop es
stc
sub byte [eax + 0x27f58c77], dl
fisttp qword [eax]
xor cl, byte [edx + 0x67]
mov dh, 0x44
mov ebx, 0x8402e00d
invalid
push ebx
nop
loope 0x6242a6
sbb dword [eax], 0x70eaf99b
scasd eax, dword es:[edi]
sbb ah, bh
stosb byte es:[edi], al
insd dword es:[edi], dx
test bh, dl
mov dword [edx - 0x27], ebx
invalid
Function at 0x407eea
Capabilities:
Read file on windows

Disassembly:
push 0xf8
mov eax, 0x4c2bf1
call fcn.0048652b
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
xor eax, eax
push 0xc6
mov word [ebp - 0xd8], ax
xor ebx, ebx
lea eax, [ebp - 0xd6]
push ebx
push eax
mov dword [ebp - 0x100], esi
call sub.MSVCR100.dll_memset
push dword [edi]
push 1
push dword [edi + 0xc]
push esi
call dword [sym.imp.MSVCR100.dll_fread]
lea ecx, [eax - 1]
mov eax, dword [edi + 0xc]
add esp, 0x1c
neg ecx
sbb cl, cl
cdq
idiv dword [edi + 0x10]
inc cl
mov byte [ebp - 0xf5], cl
mov dword [edi + 0x14], eax
test cl, cl
je 0x408080
push eax
lea eax, [ebp - 0xd8]
push str.length__d
push eax
call fcn.00401000
lea eax, [ebp - 0xd8]
push eax
call dword [sym.imp.MSVCR100.dll_wcslen]
lea esi, [edi + 0x18]
add esp, 0x10
lea ecx, [ebp - 0xd8]
mov dword [ebp - 0x104], esi
call fcn.0040885a
mov ecx, dword [edi + 0x10]
mov esi, dword [ebp - 0x100]
xor eax, eax
cmp ecx, 1
mov dword [ebp - 0xfc], ebx
mov ebx, dword [edi + 0x14]
sete byte [ebp - 0xf6]
test ebx, ebx
je 0x408052
xor edx, edx
dec ebx
cmp byte [ebp - 0xf6], dl
je 0x407fbf
cmp byte [esi], dl
jmp 0x407fc2
cmp word [esi], dx
sete dl
test edx, edx
je 0x407ff6
test eax, eax
je 0x407fea
cmp esi, eax
je 0x407fea
imul ecx, dword [ebp - 0xfc]
mov edx, esi
sub edx, eax
push edx
push eax
sub eax, ecx
push eax
call dword [sym.imp.MSVCR100.dll_memmove]
add esp, 0xc
mov ecx, dword [edi + 0x10]
inc dword [ebp - 0xfc]
lea eax, [ecx + esi]
add esi, ecx
test ebx, ebx
jne 0x407fb0
test eax, eax
je 0x40801e
cmp esi, eax
je 0x40801e
mov ecx, dword [edi + 0x10]
imul ecx, dword [ebp - 0xfc]
sub esi, eax
push esi
push eax
sub eax, ecx
push eax
call dword [sym.imp.MSVCR100.dll_memmove]
add esp, 0xc
mov esi, dword [ebp - 0xfc]
test esi, esi
je 0x408052
push esi
lea eax, [ebp - 0xd8]
push str.__d_nulls_removed_
push eax
call fcn.00401000
add esp, 0xc
lea eax, [ebp - 0xd8]
push eax
push dword [ebp - 0x104]
call fcn.0040883a
sub dword [edi + 0x14], esi
cmp dword [edi + 0x10], 1
jle 0x4080ab
test byte [edi + 4], 0x80
je 0x4080ab
push dword [edi + 0x14]
push dword [ebp - 0x100]
call sym.Uninstall.exe_protected:_static_void___cdecl_CMarkup::x_EndianSwapUTF16_unsigned_short_int___int_
pop ecx
pop ecx
push str.endian_swap
push dword [ebp - 0x104]
call fcn.0040883a
jmp 0x4080ab
lea eax, [ebp - 0xf4]
push eax
call sym.Uninstall.exe_protected:_static_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____cdecl_CMarkup::x_GetLastError_void_
pop ecx
mov ecx, eax
mov dword [ebp - 4], ebx
lea eax, [edi + 0x18]
mov ebx, ecx
call fcn.004089fe
push 1
xor edi, edi
lea esi, [ebp - 0xf4]
call fcn.00408e84
mov al, byte [ebp - 0xf5]
call fcn.004865ae
ret
Function at 0x408344
Capabilities:
Write file on windows

Disassembly:
push 0xf4
mov eax, 0x4c2bbe
call fcn.0048652b
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x100], eax
xor eax, eax
push 0xc6
push eax
mov word [ebp - 0xd8], ax
lea eax, [ebp - 0xd6]
push eax
call sub.MSVCR100.dll_memset
mov eax, dword [esi + 0x14]
mov edi, dword [esi + 0x10]
add esp, 0xc
imul edi, eax
test ebx, ebx
jne 0x408393
mov ebx, dword [ebp - 0x100]
and dword [ebp - 0xfc], 0
test byte [esi + 4], 0x80
je 0x4083ff
cmp dword [ebp - 0x100], 0
jne 0x4083e1
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call dword [sym.imp.MSVCR100.dll_void____cdecl_operator_new___unsigned_int_]
mov ecx, dword [esi + 0x14]
add ecx, ecx
push ecx
push ebx
push eax
mov dword [ebp - 0xfc], eax
call dword [sym.imp.MSVCR100.dll_memcpy]
mov ebx, dword [ebp - 0xfc]
add esp, 0x10
mov dword [ebp - 0x100], ebx
push dword [esi + 0x14]
push dword [ebp - 0x100]
call sym.Uninstall.exe_protected:_static_void___cdecl_CMarkup::x_EndianSwapUTF16_unsigned_short_int___int_
pop ecx
pop ecx
push str.endian_swap
lea eax, [esi + 0x18]
push eax
call fcn.0040883a
push dword [esi]
push 1
push edi
push ebx
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
lea ebx, [eax - 1]
neg ebx
sbb bl, bl
inc bl
cmp dword [ebp - 0xfc], 0
mov byte [ebp - 0xf5], bl
je 0x408433
push dword [ebp - 0xfc]
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
pop ecx
test bl, bl
je 0x408460
push dword [esi + 0x14]
lea eax, [ebp - 0xd8]
push str.length__d
push eax
call fcn.00401000
add esp, 0xc
lea eax, [ebp - 0xd8]
push eax
add esi, 0x18
push esi
call fcn.0040883a
jmp 0x408490
lea eax, [ebp - 0xf4]
push eax
call sym.Uninstall.exe_protected:_static_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____cdecl_CMarkup::x_GetLastError_void_
pop ecx
mov ebx, eax
and dword [ebp - 4], 0
lea eax, [esi + 0x18]
call fcn.004089fe
push 1
xor edi, edi
lea esi, [ebp - 0xf4]
call fcn.00408e84
mov bl, byte [ebp - 0xf5]
mov al, bl
call fcn.004865ae
ret
Function at 0x40aed1
Capabilities:
Copy file
Create process on windows
Delete file
Get common file path

Disassembly:
push 0x8a4
mov eax, 0x4c2a3e
call fcn.0048652b
mov esi, 0x104
push esi
lea eax, [ebp - 0x420]
push eax
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x218]
push eax
push edi
push 0x4e0d24
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 1
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x85c], eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x83c]
call fcn.00408702
push 0x4e0d2c
mov dword [ebp - 4], edi
call dword [sym.imp.MSVCR100.dll_wcslen]
pop ecx
push eax
lea eax, [ebp - 0x83c]
call fcn.0040d9c2
push eax
push edi
lea eax, [ebp - 0x83c]
push eax
lea eax, [ebp - 0x858]
call fcn.004089b5
mov ebx, eax
lea eax, [ebp - 0x83c]
mov byte [ebp - 4], 1
call fcn.004089fe
push 1
lea esi, [ebp - 0x858]
call fcn.00408e84
cmp dword [ebp - 0x828], 8
mov eax, dword [ebp - 0x83c]
jae 0x40afc8
lea eax, [ebp - 0x83c]
push eax
push dword [ebp - 0x85c]
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x820]
push 0x4e0d30
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
push 0x44
pop edi
push edi
xor esi, esi
lea eax, [ebp - 0x8b0]
push esi
push eax
call dword [sym.imp.MSVCR100.dll_memset]
add esp, 0x20
lea eax, [ebp - 0x86c]
push eax
lea eax, [ebp - 0x8b0]
push eax
push esi
push esi
push esi
push 1
push esi
push esi
lea eax, [ebp - 0x820]
push eax
push esi
mov dword [ebp - 0x8b0], edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push dword [ebp - 0x85c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
xor edi, edi
lea esi, [ebp - 0x83c]
call fcn.00408e84
call fcn.004865ae
ret
Function at 0x40c02e
Capabilities:
Create thread
Read .ini file
Reference cloudflare dns server

Disassembly:
push 0x480
mov eax, 0x4c441f
call fcn.0048652b
mov eax, dword [ebp + 8]
mov esi, ecx
xor ebx, ebx
push 0x103
mov dword [esi], eax
lea eax, [ebp - 0x117]
push ebx
push eax
mov dword [ebp - 0x488], esi
mov byte [ebp - 0x118], bl
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x104
lea eax, [ebp - 0x118]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.MSVCR100.dll_strlen]
pop ecx
push eax
lea eax, [ebp - 0x118]
lea edi, [esi + 8]
push eax
mov ecx, edi
call fcn.0040dda8
push 0x4e0dd8
push edi
call fcn.0040d3e3
inc eax
push eax
push ebx
push edi
lea eax, [ebp - 0x484]
call fcn.0040d403
mov esi, eax
mov dword [ebp - 4], ebx
call fcn.0040d729
or dword [ebp - 4], 0xffffffff
xor esi, esi
push ebx
inc esi
push esi
lea ecx, [ebp - 0x484]
call fcn.0040d8cd
lea eax, [ebp - 0x44c]
push str.config.ini
push eax
call fcn.0040e413
push 0x103
lea eax, [ebp - 0x327]
push ebx
mov dword [ebp - 4], esi
push eax
mov byte [ebp - 0x328], bl
call sub.MSVCR100.dll_memset
mov eax, dword [ebp - 0x44c]
add esp, 0x14
cmp dword [ebp - 0x438], 0x10
jae 0x40c116
lea eax, [ebp - 0x44c]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x328]
push eax
push 0x4e0e5c
push str.soft
push str.base
call edi
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.MSVCR100.dll_strlen]
pop ecx
mov ecx, dword [ebp - 0x488]
push eax
lea eax, [ebp - 0x328]
push eax
add ecx, 0x48
call fcn.0040dda8
push 0x103
lea eax, [ebp - 0x42f]
push ebx
push eax
mov byte [ebp - 0x430], bl
call sub.MSVCR100.dll_memset
mov eax, dword [ebp - 0x44c]
add esp, 0xc
cmp dword [ebp - 0x438], 0x10
jae 0x40c18f
lea eax, [ebp - 0x44c]
push eax
push esi
lea eax, [ebp - 0x430]
push eax
push 0x4e0e70
push str.user
push str.base
call edi
lea eax, [ebp - 0x430]
push eax
lea ecx, [ebp - 0x468]
call fcn.0040d339
push 0x103
lea eax, [ebp - 0x21f]
push ebx
mov byte [ebp - 4], 2
push eax
mov byte [ebp - 0x220], bl
call sub.MSVCR100.dll_memset
mov eax, dword [ebp - 0x44c]
add esp, 0xc
cmp dword [ebp - 0x438], 0x10
jae 0x40c1ef
lea eax, [ebp - 0x44c]
push eax
push esi
lea eax, [ebp - 0x220]
push eax
push str.1.0.0.1
push str.version
push str.base
call edi
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.MSVCR100.dll_strlen]
mov esi, dword [ebp - 0x488]
pop ecx
push eax
lea eax, [ebp - 0x220]
push eax
lea ecx, [esi + 0x80]
call fcn.0040dda8
push ebx
push ebx
push esi
push 0x40b049
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, esi
call fcn.0040c272
push ebx
push 1
lea ecx, [ebp - 0x468]
call fcn.0040d8cd
push ebx
push 1
lea ecx, [ebp - 0x44c]
call fcn.0040d8cd
call fcn.004865ae
ret 4
Function at 0x40cf5d
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4f840c]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [esi]
mov eax, dword [esi + 4]
push ebx
push edi
sub eax, ecx
push 0x1c
cdq
pop ebx
idiv ebx
xor edi, edi
mov dword [ebp - 0x24], edi
test eax, eax
je 0x40cfd1
lea eax, [edi + ecx]
cmp dword [eax + 0x14], 8
jb 0x40cf90
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x20]
push eax
call sym.Uninstall.exe_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_KpBase::ws2s_wchar_t_const__
cmp dword [eax + 0x14], 0x10
pop ecx
pop ecx
jb 0x40cfa4
mov eax, dword [eax]
push 1
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
push 1
lea ecx, [ebp - 0x20]
call fcn.0040d8cd
mov ecx, dword [esi]
mov eax, dword [esi + 4]
sub eax, ecx
push 0x1c
cdq
pop ebx
idiv ebx
inc dword [ebp - 0x24]
add edi, 0x1c
cmp dword [ebp - 0x24], eax
jb 0x40cf85
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.00485d44
leave
ret

Function at 0x4125b9
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4c4488
mov eax, dword fs:[0]
push eax
sub esp, 0x140
mov eax, dword [0x4f840c]
xor eax, esp
mov dword [esp + 0x138], eax
push ebx
push esi
push edi
mov eax, dword [0x4f840c]
xor eax, esp
push eax
lea eax, [esp + 0x150]
mov dword fs:[0], eax
xor ebx, ebx
push ebx
push ebx
mov esi, ecx
push esi
push 0x412790
push ebx
push ebx
mov dword [esp + 0x28], esi
mov dword [esi + 0x354], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
push str.page_ctrl
lea ecx, [esi + 4]
call fcn.00412dcb
mov dword [esi + 0x358], eax
push 0x402
lea eax, [esp + 0x18]
push eax
call fcn.0040a721
add esi, 0x35c
mov edi, eax
mov dword [esp + 0x158], ebx
call fcn.004126a2
or dword [esp + 0x158], 0xffffffff
lea ebx, [esp + 0x14]
call fcn.0040a884
mov eax, dword [esp + 0x10]
push dword [eax + 0x23c]
mov ecx, esi
call fcn.0040c02e
xor eax, eax
mov ecx, dword [esp + 0x150]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x138]
xor ecx, esp
call fcn.00485d44
mov esp, ebp
pop ebp
ret

Function at 0x4128a9
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, eax
push 0
push dword [esi + 0x23c]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
push 0x12
push dword [esi + 0x23c]
call dword [sym.imp.USER32.dll_PostMessageW]
pop esi
ret

Function at 0x4128e5
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push 0
push dword [edi + 0x23c]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi + 0x23c]
lea ebx, [edi + 0x35c]
call fcn.0040aa02
pop esi
pop ebx
ret
Function at 0x4137b1
Capabilities:
Create process on windows
Get common file path
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x318
mov eax, dword [0x4f840c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x103
xor ebx, ebx
push esi
lea eax, [ebp - 0x20b]
push ebx
push eax
mov byte [ebp - 0x20c], bl
call sub.MSVCR100.dll_memset
push esi
lea eax, [ebp - 0x107]
push ebx
push eax
mov byte [ebp - 0x108], bl
call sub.MSVCR100.dll_memset
push esi
lea eax, [ebp - 0x30f]
push ebx
push eax
mov byte [ebp - 0x310], bl
call sub.MSVCR100.dll_memset
add esp, 0x24
lea eax, [ebp - 0x108]
push eax
inc esi
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x108]
push str._kpuninsep.bat
push eax
call dword [sym.imp.MSVCR100.dll_strcat]
pop ecx
pop ecx
push esi
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.MSVCR100.dll_strcpy]
lea eax, [ebp - 0x310]
push 0x5c
push eax
call dword [sym.imp.MSVCR100.dll_strrchr]
add esp, 0x10
cmp eax, ebx
je 0x41386b
mov byte [eax], bl
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x314], eax
cmp eax, 0xffffffff
je 0x41392d
mov esi, dword [sym.imp.MSVCR100.dll_strlen]
push str.:Repeat_r_ndel___s__r_nif_exist___s__goto_Repeat_r_nrmdir___s__r_ndel___s_
call esi
mov edi, eax
lea eax, [ebp - 0x108]
push eax
call esi
add edi, eax
lea eax, [ebp - 0x20c]
push eax
call esi
add eax, edi
add esp, 0xc
lea eax, [eax*4 + 0x50]
call fcn.0049ef40
mov edi, esp
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x20c]
push eax
push eax
push str.:Repeat_r_ndel___s__r_nif_exist___s__goto_Repeat_r_nrmdir___s__r_ndel___s_
push edi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push ebx
lea eax, [ebp - 0x318]
push eax
push edi
call esi
pop ecx
push eax
push edi
push dword [ebp - 0x314]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x314]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push ebx
push ebx
lea eax, [ebp - 0x108]
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea esp, [ebp - 0x324]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00485d44
leave
ret