joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403310
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x40a044
call sym._EnterCriticalSection_4
mov ebx, dword [0x40a03c]
sub esp, 4
test ebx, ebx
je 0x40335b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x403354
test esi, esi
je 0x403354
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x403330
mov dword [esp], 0x40a044
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x403540
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x403590
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x403668
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x4035ce
cmp eax, 4
jne 0x4035f0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x4035de
cmp edx, 4
je 0x4035de
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00403540
Function at 0x418bb0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x448
mov eax, dword [0x442288]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [sym.imp.WS2_32.dll_htons]
mov ebx, edx
push edi
push 3
mov edi, ecx
mov dword [ebp - 0x448], eax
call esi
push 0
mov word [ebp - 0x434], ax
call esi
mov word [ebp - 0x432], ax
xor ecx, ecx
cmp ecx, 0x3ff
je 0x418c1a
mov al, byte [ecx + str.WTware_TFTP_v.6.2.16.]
mov byte [ebp + ecx - 0x430], al
inc ecx
cmp byte [ecx + str.WTware_TFTP_v.6.2.16.], 0
jne 0x418bf1
mov byte [ebp + ecx - 0x430], 0
jmp 0x418c1e
mov byte [ebp - 0x31], 0
lea ecx, [ebp - 0x430]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x418c27
sub ecx, edx
movzx edx, bl
lea esi, [ecx + 4]
lea ecx, [ebp - 0x444]
call fcn.004015f0
xor ecx, ecx
cmp byte [ebp + ecx - 0x444], 0
je 0x418c80
cmp byte [ebp + ecx - 0x443], 0
je 0x418c7f
cmp byte [ebp + ecx - 0x442], 0
je 0x418c7a
cmp byte [ebp + ecx - 0x441], 0
je 0x418c75
add ecx, 4
cmp ecx, 0x10
jb 0x418c43
jmp 0x418c80
add ecx, 3
jmp 0x418c80
add ecx, 2
jmp 0x418c80
inc ecx
lea eax, [ecx + 2]
cmp eax, 0x10
ja 0x418c92
mov word [ebp + ecx - 0x444], 0x2e
mov edx, ebx
lea ecx, [ebp - 0x28]
shr edx, 8
and edx, 0xff
call fcn.004015f0
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x444]
call fcn.004016c0
xor ecx, ecx
cmp byte [ebp + ecx - 0x444], 0
je 0x418cf2
cmp byte [ebp + ecx - 0x443], 0
je 0x418cf1
cmp byte [ebp + ecx - 0x442], 0
je 0x418cec
cmp byte [ebp + ecx - 0x441], 0
je 0x418ce7
add ecx, 4
cmp ecx, 0x10
jb 0x418cb5
jmp 0x418cf2
add ecx, 3
jmp 0x418cf2
add ecx, 2
jmp 0x418cf2
inc ecx
lea eax, [ecx + 2]
cmp eax, 0x10
ja 0x418d04
mov word [ebp + ecx - 0x444], 0x2e
mov edx, ebx
lea ecx, [ebp - 0x28]
shr edx, 0x10
and edx, 0xff
call fcn.004015f0
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x444]
call fcn.004016c0
xor ecx, ecx
jmp 0x418d30
cmp byte [ebp + ecx - 0x444], 0
je 0x418d6d
cmp byte [ebp + ecx - 0x443], 0
je 0x418d6c
cmp byte [ebp + ecx - 0x442], 0
je 0x418d67
cmp byte [ebp + ecx - 0x441], 0
je 0x418d62
add ecx, 4
cmp ecx, 0x10
jb 0x418d30
jmp 0x418d6d
add ecx, 3
jmp 0x418d6d
add ecx, 2
jmp 0x418d6d
inc ecx
lea eax, [ecx + 2]
cmp eax, 0x10
ja 0x418d7f
mov word [ebp + ecx - 0x444], 0x2e
shr ebx, 0x18
lea ecx, [ebp - 0x28]
mov edx, ebx
call fcn.004015f0
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x444]
call fcn.004016c0
lea eax, [ebp - 0x444]
push eax
push str.__s__Sending_WTware_TFTP_version.
call fcn.00416900
add esp, 8
lea eax, [ebp - 0x434]
push 0x10
push dword [ebp - 0x448]
push 0
push esi
push eax
push edi
call dword [sym.imp.WS2_32.dll_sendto]
cmp eax, esi
je 0x418ddf
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.sendto___failed:__d
call fcn.004168b0
add esp, 8
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041e406
mov esp, ebp
pop ebp
ret
Function at 0x4287df
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
cmp dword [0x45aa24], 0
je 0x428816
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
call main
add esp, 4
jmp 0x42882f
call main
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
call main
add esp, 4
jmp 0x42882f
pop edi
pop esi
pop ebx
leave
ret

Function at 0x432cb5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x432cc4
pop dword [ebp - 0x50]
mov eax, 0x31ee3ef2
sub eax, 0x31ab122e
sub dword [ebp - 0x50], eax
push 0x40
push 0x1000
push 0x4b42d
push 0
mov eax, 0x4c2c4e74
add eax, 0xb41a1964
add eax, dword [ebp - 0x50]
call dword [eax]
mov ecx, 0xa36da212
add ecx, 0x5c929c68
mov edx, eax
mov ebx, 0xd32d9231
sub ebx, 0xd2e4b231
add ebx, dword [ebp - 0x50]
mov edi, 0x2c630bbf
add edi, 0x6954fe73
sub dword [ebp - 0xc], 0x5056cf7
mov esi, dword [ebx]
xor dword [ebp - 0x30], 0xd7dd7aae
xor esi, edi
add dword [ebp - 0x18], ebx
mov dword [edx], esi
mov dword [ebp - 0x34], 0x250fa03d
add edx, 0x38f02d44
add edx, 0xc70fd2c0
add ebx, 4
loop 0x432d23
add eax, 0x4d494424
add eax, 0xb2b7a897
xor ebx, ebx
add ebx, eax
add eax, 0x2e54026e
add eax, 0xd1abfd97
mov ecx, 0xeadc4e4a
sub ecx, 0xea9c4e4a
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x44c8c0
Capabilities:
Move file

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push eax
push ecx
call dword [sym.imp.kernel32.dll_MoveFileA]
test eax, eax
mov eax, 0
jne 0x44c8df
call dword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
je 0x44c8f2
push eax
call fcn.0044d700
add esp, 4
mov eax, 0xffffffff
ret
xor eax, eax
ret
Function at 0x29a051e9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x29a051f8
pop dword [ebp - 0x2c]
mov eax, 0x29a051f8
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xfa6984b6
add dword [ebp - 0x3c], 0x53e8c095
mov dword [ebp - 0x38], 0xb3add81
sub dword [ebp - 0x38], 0xd907913c
mov dword [ebp - 0x34], 0xc69fae40
sub dword [ebp - 0x34], 0x7a536a12
mov dword [ebp - 0x30], 0x909ff3b4
add dword [ebp - 0x30], 0x6f600c4c
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x4f563767
add dword [ebp - 0x3c], 0x251c31ef
mov dword [ebp - 0x38], 0xf11bf704
sub dword [ebp - 0x38], 0xafaf958f
mov dword [ebp - 0x34], 0x81409695
sub dword [ebp - 0x34], 0x1dd12a29
mov dword [ebp - 0x30], 0xebe75bcb
add dword [ebp - 0x30], 0x1418a435
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0xfa33a58f
add eax, 0x2f6d9ab5
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x37b3c
push 0
call eax
mov ecx, 0xb0701975
sub ecx, 0xb06fdc14
mov ebx, eax
mov edx, 0x29a22000
add edx, dword [ebp - 0x2c]
mov edi, 0x5c2880f3
xor dword [ebp - 0x18], ecx
mov esi, dword [edx]
xor dword [ebp - 8], 0xa05ee936
sub esi, edi
add dword [ebp - 0x1c], esi
mov dword [ebx], esi
sub dword [ebp - 0x10], 0xdbb873ce
add ebx, 0xb4734db4
sub ebx, 0xb4734db0
add edx, 0x946357b2
sub edx, 0x946357ae
loop 0x29a05304
add eax, 0x9ee9eb03
add eax, 0x6116fd54
mov ebx, eax
add eax, 0x8117fb36
sub eax, 0x8117fb31
mov ecx, 0x29a00000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x40b01e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x449500]
jne 0x40b028
repz ret
jmp fcn.0040f8ba

Function at 0x40eb32
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00405839
xor ebx, ebx
cmp dword [0x464ed0], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x40ec07
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x40eb72
xor eax, eax
jmp 0x40eccb
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x40eb6b
push eax
call fcn.004057d6
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x464ed0], eax
call esi
push eax
call fcn.004057d6
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x464ed4], eax
call esi
push eax
call fcn.004057d6
mov dword [0x464ed8], eax
lea eax, [ebp - 8]
push eax
call fcn.00409c28
test eax, eax
pop ecx
pop ecx
je 0x40ebd5
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00404832
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x40ec07
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.004057d6
cmp eax, ebx
pop ecx
mov dword [0x464ee0], eax
je 0x40ec07
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004057d6
pop ecx
mov dword [0x464edc], eax
mov eax, dword [0x464edc]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x40ec80
cmp dword [0x464ee0], esi
je 0x40ec80
push eax
call fcn.00405842
pop ecx
call eax
cmp eax, ebx
je 0x40ec4d
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x464ee0]
call fcn.00405842
pop ecx
call eax
test eax, eax
je 0x40ec4d
test byte [ebp - 0x18], 1
jne 0x40ec80
lea eax, [ebp - 0xc]
push eax
call fcn.00409c5f
test eax, eax
pop ecx
je 0x40ec68
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00404832
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x40ec77
or dword [ebp + 0x10], 0x200000
jmp 0x40ecb1
or dword [ebp + 0x10], 0x40000
jmp 0x40ecb1
mov eax, dword [0x464ed4]
cmp eax, esi
je 0x40ecb1
push eax
call fcn.00405842
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x40ecb1
mov eax, dword [0x464ed8]
cmp eax, esi
je 0x40ecb1
push dword [ebp - 4]
push eax
call fcn.00405842
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x464ed0]
call fcn.00405842
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100022ca
Capabilities:
Create thread

Disassembly:
mov eax, 0x586
mov word [0x10006014], ax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.ws2_32
mov dword [0x10006374], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0
push 0
push 0x10002305
mov dword [0x10006370], eax
call dword [sym.imp.MSVCR120.dll__beginthread]
xor eax, eax
add esp, 0xc
inc eax
ret

Function at 0x1000246b
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 6
push 1
push 2
pop ebx
push ebx
mov edi, ecx
call dword [sym.imp.WS2_32.dll_socket]
push 4
mov esi, eax
mov dword [ebp - 0x18], 0x5dc
lea eax, [ebp - 0x18]
push eax
push 0x1006
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
push str.pastebin.com
call dword [sym.imp.WS2_32.dll_gethostbyname]
push 0x1bb
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x14]
push 0x10
push eax
push esi
mov word [ebp - 0x14], bx
call dword [sym.imp.WS2_32.dll_connect]
push ecx
push ecx
push dword [sym.imp.WS2_32.dll_recv]
push dword [sym.imp.WS2_32.dll_send]
push esi
call section..text
add esp, 0x14
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
push str._r_n_r_n
push dword [0x100063dc]
call dword [sym.imp.MSVCR120.dll_strstr]
push 0xa
lea ecx, [ebp - 0x1c]
add eax, 4
push ecx
push eax
call dword [sym.imp.MSVCR120.dll_strtoul]
mov ecx, dword [ebp - 4]
add esp, 0x14
mov dword [edi], eax
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.100028b7
mov esp, ebp
pop ebp
ret
Function at 0x405831
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0
je 0x405873
lea eax, [ebp - 0x714]
push eax
call fcn.004038a0
pop ecx
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.00403855
add esp, 0xc
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
jne 0x405873
jmp 0x405232
cmp dword [ebp - 0x37c], 0
je 0x405881
jmp 0x405936

Function at 0x405c25
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x425ef0
push esi
call fcn.0040624c
push esi
call fcn.00405bc8
mov edi, eax
test edi, edi
jne 0x405c46
xor eax, eax
jmp 0x405c9e
push edi
call fcn.004064e0
test byte [0x42a21c], 0x80
je 0x405c63
mov ax, word [edi]
test ax, ax
je 0x405c42
cmp ax, 0x5c
je 0x405c42
sub edi, esi
sar edi, 1
jmp 0x405c7d
call fcn.0040658f
test eax, eax
je 0x405c77
test byte [eax], 0x10
je 0x405c42
push esi
call fcn.00405b69
push esi
call sub.KERNEL32.dll_lstrlenW
cmp eax, edi
push esi
jg 0x405c69
call fcn.00405b1d
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405d19
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405d38
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4

Function at 0x405d3e
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
ret 0xc

Function at 0x405d6d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
mov eax, dword [0x40a558]
dec edi
mov dword [ebp - 8], eax
mov eax, dword [0x40a55c]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp - 8]
push 0
push eax
push dword [ebp + 0xc]
add word [ebp - 4], dx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x405dbd
test edi, edi
jne 0x405d7a
and word [esi], di
pop edi
pop esi
leave
ret 8
mov eax, esi
jmp 0x405db7
Function at 0x42fb71
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x43757a
call fcn.004339e0
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x43c770
mov dword [esi + 4], 0x43c758
mov dword [esi + 8], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.004028e9
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x24], 1
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov byte [esi + 0x4c], bl
mov byte [esi + 0x4d], bl
mov dword [esi], 0x43c73c
mov dword [esi + 4], 0x43c724
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x43196e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x43197d
pop dword [ebp - 0x44]
mov eax, 0xedc4572f
add eax, 0x127ec24e
sub dword [ebp - 0x44], eax
push 0x40
push 0x1000
push 0x391e4
push 0
mov eax, 0xffd35b69
sub eax, 0xff8fdb39
add eax, dword [ebp - 0x44]
call dword [eax]
mov ecx, 0x41a4
xor edi, edi
add edi, eax
mov edx, 0x71484073
sub edx, 0x71037a73
add edx, dword [ebp - 0x44]
mov esi, 0x938857d4
mov dword [ebp - 0x14], 0xf6be14bc
mov ebx, dword [edx]
mov dword [ebp - 0x40], 0xb1f2cb21
sub ebx, esi
xor dword [ebp - 0x1c], ebx
mov dword [edi], ebx
sub dword [ebp - 0x30], 0x945ffdf5
add edi, 0x85a1c8b5
add edi, 0x7a5e374f
add edx, 4
loop 0x4319d2
add eax, 0xca2c6cac
sub eax, 0xca2b7349
mov ebx, eax
add eax, 0x89c25947
add eax, 0x763da6be
mov ecx, 0x400000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x433770
Capabilities:
Create thread

Disassembly:
push esi
lea eax, [esp + 8]
push eax
push 0
mov esi, ecx
mov ecx, dword [esp + 0x10]
push ecx
push edx
push 0
push 0
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
mov dword [esi], eax
pop esi
test eax, eax
je 0x433799
xor eax, eax
ret 4
call dword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x4337a8
mov eax, 1
ret 4
Function at 0x10058a3
Capabilities:
Create directory
Get common file path
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1020104]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1021588], 0
push esi
push edi
mov esi, 0x1021588
jne 0x100596a
mov edi, 0x104
push edi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x10058f3
push 0x1001400
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x1005997
push 0x10013f8
lea eax, [ebp - 0x108]
push eax
push 0x10013f0
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.010056ac
add esp, 0x14
test eax, eax
jns 0x100591f
push 0x10013cc
jmp 0x10058e8
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x1005946
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1005946
push 0x100139c
jmp 0x10058e8
push 0x1001430
push 0x1001384
lea eax, [ebp - 0x108]
push eax
push 0x100137c
push edi
push esi
call fcn.010056ac
add esp, 0x18
test eax, eax
js 0x1005918
push 0x1001378
push esi
call fcn.0100e291
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x1005987
push 0x100134c
jmp 0x10058e8
push esi
push ebx
call fcn.0100ded4
push esi
call fcn.0100de53
add esp, 0xc
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0100e2ad
leave
ret

Function at 0x1006155
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x9c
mov eax, dword [0x1020104]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [section..data]
cmp eax, 0xffffffff
je 0x1006182
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
jmp 0x100621e
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
jne 0x100620d
cmp dword [ebp - 0x94], 5
jb 0x100620d
push edi
push 0x10019d4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x100620c
push esi
push 0x10019b8
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x100620b
and dword [ebp - 0x9c], 0
push 0
push 4
lea eax, [ebp - 0x9c]
push eax
push 0x1a
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
js 0x1006204
cmp dword [ebp - 0x9c], 0
je 0x1006204
mov dword [section..data], 1
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
pop edi
mov eax, dword [section..data]
cmp eax, 0xffffffff
jne 0x100621e
xor eax, eax
mov dword [section..data], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0100e2ad
leave
ret
Function at 0x10069de
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x24]
push edi
xor edi, edi
cmp eax, edi
je 0x1006a06
push edi
push edi
push 0x46b
push eax
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
lea eax, [ebp - 4]
push eax
push edi
push esi
push 0x1006973
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x138], eax
cmp eax, edi
jne 0x1006a4b
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1001b04
push 0x1001af0
push 0x2ad
push 0x10019f8
call fcn.010059aa
add esp, 0x18
xor eax, eax
jmp 0x1006a4e
xor eax, eax
inc eax
pop edi
pop esi
leave
ret

Function at 0x1006b8b
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x1020104]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1006bee
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x1006be6
cmp eax, 2
je 0x1006be6
push 0
push eax
push 0x1001b3c
push 0x1001b2c
push 0x115
push 0x1001780
call fcn.010059aa
add esp, 0x18
xor eax, eax
jmp 0x1006ca6
xor eax, eax
inc eax
jmp 0x1006ca6
push ebx
push esi
xor ebx, ebx
push edi
test al, 0x10
je 0x1006c71
mov esi, 0x104
push esi
lea eax, [ebp - 0x10c]
push eax
call fcn.01006a97
lea eax, [ebp - 0x10c]
push esi
push eax
call fcn.0100e302
pop ecx
pop ecx
mov byte [ebp + eax - 0x10b], bl
lea eax, [ebp - 0x10c]
push 0x14
mov dword [ebp - 0x124], eax
pop eax
mov word [ebp - 0x11c], ax
lea eax, [ebp - 0x12c]
push eax
mov dword [ebp - 0x12c], ebx
mov dword [ebp - 0x128], 3
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x116], ebx
mov dword [ebp - 0x112], 0x1001ac3
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
mov esi, eax
neg esi
sbb esi, esi
inc esi
jmp 0x1006c79
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, eax
cmp esi, ebx
jne 0x1006ca2
push edi
push 0x1001b14
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push 0x1001b2c
push 0x12e
push 0x1001780
call fcn.010059aa
add esp, 0x1c
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0100e2ad
leave
ret 4