joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40da94
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x40dac2
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x40dac9
cmp ebx, dword [eax + 4]
jae 0x40dac9
xor eax, eax
jmp 0x40dcb9
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x40dada
xor eax, eax
inc eax
jmp 0x40dcb8
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x40daf0
cmp ecx, edx
jae 0x40dc35
cmp dword [eax + 4], 0
je 0x40daf9
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x40dae1
cmp dword [ebp + 8], 0
je 0x40db1b
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x40dc35
cmp eax, esi
jae 0x40dc35
mov eax, dword [0x416d20]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x40db40
cmp dword [esi*4 + 0x416d28], edi
je 0x40dc39
inc esi
cmp esi, eax
jl 0x40db2e
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40dcb5
cmp dword [ebp - 8], 0x1000000
jne 0x40dcb5
test byte [ebp - 0xc], 0xcc
je 0x40dbbe
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x40dcb5
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x40dcb5
cmp word [eax + 0x18], 0x10b
jne 0x40dcb5
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x40dcb5
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x40dbbe
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x40dbbe
test byte [ecx + 0x27], 0x80
jne 0x40dc35
push 1
push 0x416d68
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test eax, eax
jne 0x40dad2
mov ecx, dword [0x416d20]
test ecx, ecx
mov edx, ecx
jle 0x40dbf2
lea eax, [ecx*4 + 0x416d24]
cmp dword [eax], edi
je 0x40dbf2
dec edx
sub eax, 4
test edx, edx
jg 0x40dbe6
test edx, edx
jne 0x40dc23
push 0xf
pop ebx
cmp ecx, ebx
jg 0x40dbff
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x40dc17
lea eax, [edx*4 + 0x416d28]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x40dc05
cmp ecx, 0x10
jge 0x40dc23
inc ecx
mov dword [0x416d20], ecx
push 0
push 0x416d68
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x40dad2
xor eax, eax
jmp 0x40dcb8
test esi, esi
jle 0x40dad2
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 1
push 0x416d68
call ebx
test eax, eax
jne 0x40dad2
cmp dword [esi*4 + 0x416d28], edi
je 0x40dc8f
mov eax, dword [0x416d20]
lea esi, [eax - 1]
test esi, esi
jl 0x40dc7d
cmp dword [esi*4 + 0x416d28], edi
je 0x40dc79
dec esi
jns 0x40dc6d
test esi, esi
jge 0x40dc8d
cmp eax, 0x10
jge 0x40dc88
inc eax
mov dword [0x416d20], eax
lea esi, [eax - 1]
jmp 0x40dc8f
je 0x40dca7
xor ecx, ecx
test esi, esi
jl 0x40dca7
lea eax, [ecx*4 + 0x416d28]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x40dc95
push 0
push 0x416d68
call ebx
jmp 0x40dad2
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40f25e
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.0040d830
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40f2f9
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x416a34]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x40f2f9
cmp eax, 1
je 0x40f31a
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40f2f9
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x40f2c6
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x40f2f5
xor eax, eax
inc eax
jmp 0x40f339
cmp edi, eax
jae 0x40f2fd
xor eax, eax
jmp 0x40f339
cmp eax, esi
jae 0x40f304
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x416a34]
jmp 0x40f31d
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403590
Capabilities:
Create pipe
Create process on windows
Get thread local storage value
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x180c
call fcn.004100b0
mov eax, dword [0x45a9f4]
mov ecx, dword [0x45a484]
push ebx
shr eax, 3
push esi
push edi
test eax, eax
jbe 0x4036a7
mov edi, dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
mov esi, dword [sym.imp.KERNEL32.dll_GetTimeFormatW]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
cmp dword [0x45a9f4], 0x959
jne 0x403690
push 0
lea eax, [ebp - 0xc08]
push eax
push 0
push 0
push 0
push 0
call edi
push 0
push 0
call ebx
push 0
lea ecx, [ebp - 0x408]
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileShortNameW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0
push 0
push 0
push 0
push 0
push 0
call esi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea edx, [ebp - 0x1808]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0
push 0
push 0
push 0
push 0
push 0
call esi
push 0
lea eax, [ebp - 0x1008]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, dword [ebp - 4]
push ecx
call fcn.004032d0
add dword [ebp - 4], 8
sub dword [ebp - 8], 1
jne 0x4035ce
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40543b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44b168]
jne 0x405445
repz ret
jmp fcn.0040a8cc

Function at 0x40ae5e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00409569
and dword [ebp - 4], 0
cmp dword [0x4519b4], 0
mov ebx, eax
jne 0x40af0f
push 0x401ad8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40afc0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401acc
push edi
call esi
test eax, eax
je 0x40afc0
push eax
call fcn.004094f7
mov dword [esp], 0x401abc
push edi
mov dword [0x4519b4], eax
call esi
push eax
call fcn.004094f7
mov dword [esp], 0x401aa8
push edi
mov dword [0x4519b8], eax
call esi
push eax
call fcn.004094f7
mov dword [esp], 0x401a8c
push edi
mov dword [0x4519bc], eax
call esi
push eax
call fcn.004094f7
pop ecx
mov dword [0x4519c4], eax
test eax, eax
je 0x40af0f
push 0x401a74
push edi
call esi
push eax
call fcn.004094f7
pop ecx
mov dword [0x4519c0], eax
mov eax, dword [0x4519c0]
cmp eax, ebx
je 0x40af67
cmp dword [0x4519c4], ebx
je 0x40af67
push eax
call fcn.00409572
push dword [0x4519c4]
mov esi, eax
call fcn.00409572
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40af67
test edi, edi
je 0x40af67
call esi
test eax, eax
je 0x40af5e
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40af5e
test byte [ebp - 0xc], 1
jne 0x40af67
or dword [ebp + 0x10], 0x200000
jmp 0x40afa0
mov eax, dword [0x4519b8]
cmp eax, ebx
je 0x40afa0
push eax
call fcn.00409572
pop ecx
test eax, eax
je 0x40afa0
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40afa0
mov eax, dword [0x4519bc]
cmp eax, ebx
je 0x40afa0
push eax
call fcn.00409572
pop ecx
test eax, eax
je 0x40afa0
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4519b4]
call fcn.00409572
pop ecx
test eax, eax
je 0x40afc0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40afc2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x484cdf
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x484a08
add edx, edx
call fcn.00484d19
mov esi, edx
sub esi, 0x527a524d
xor dword [edi], eax
inc edx
sub edx, 0x30718057
or esi, edx
add edi, 2
add esi, esi
cmp edi, ecx
jl fcn.00484cdf
or esi, edx
mov edx, 0xd1b3e7b8
sub esi, edx
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408f6c
nop
mov ecx, 0x5cd96594
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0x1c576b9b
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219

Function at 0x503b8c
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x503376
mov dword [0x50521c], 2
jmp 0x503bbc
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x50408c
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x503c8f
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x503cbc
push 0x505248
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x503c8f
mov eax, dword [0x505250]
jmp 0x503cc9
call 0x502c0d
ret
Function at 0x431003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40915c
mov ecx, 0x4a9e2d0c
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43104e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x431024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
mov ecx, 0x30517b71
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x776620eb
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x253c4c80
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x180fb6c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x181b520]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.01806e52
and dword [ebp - 0x14], 0
cmp dword [0x185d558], 0
mov dword [ebp - 0x18], eax
jne 0x180fc1f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x180fcc7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x180fcc7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x185d558], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x185d55c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x185d560], eax
call edi
push eax
call esi
mov dword [0x185d568], eax
test eax, eax
je 0x180fc1f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x185d564], eax
mov eax, dword [0x185d564]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x180fc78
cmp dword [0x185d568], ecx
je 0x180fc78
push eax
call esi
push dword [0x185d568]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x180fc78
test ebx, ebx
je 0x180fc78
call edi
test eax, eax
je 0x180fc6f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x180fc6f
test byte [ebp - 8], 1
jne 0x180fc78
or dword [ebp + 0x10], 0x200000
jmp 0x180fcab
mov eax, dword [0x185d55c]
cmp eax, dword [ebp - 0x18]
je 0x180fcab
push eax
call esi
test eax, eax
je 0x180fcab
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x180fcab
mov eax, dword [0x185d560]
cmp eax, dword [ebp - 0x18]
je 0x180fcab
push eax
call esi
test eax, eax
je 0x180fcab
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x185d558]
call esi
test eax, eax
je 0x180fcc7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x180fcc9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.018013cb
leave
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x42e030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219

Function at 0x8ccb9e
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x8cc92e
or eax, eax
add esi, esi
add esi, eax
call fcn.008ccbd5
inc eax
mov esi, eax
sub eax, eax
xor dword [ebx], ecx
push 0x7e0a128e
pop eax
sub eax, 0x253397dc
inc ebx
add eax, 0x529c9fc8
mov esi, eax
dec esi
cmp ebx, edx
jne fcn.008ccb9e
inc eax
add eax, eax
ret
Function at 0x403392
Capabilities:
Get common file path

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
push 0x400
call fcn.0040c5f0
mov dword [esp], eax
push dword [0x413b08]
push dword [0x413b08]
call fcn.0040c90d
lea eax, [esp + 8]
push eax
call fcn.0040f460
push dword [esp]
push 0
push 0x41201e
push dword [esp + 0x10]
call sub.KERNEL32.dll_GetTempFileNameA
push dword [0x413b08]
push dword [0x413b08]
push dword [esp + 8]
call fcn.0040c6a0
lea eax, [0x4135e8]
push eax
call fcn.0040f460
push dword [esp]
call fcn.0040c6f0
push dword [0x4135e8]
call fcn.0040c99c
push dword [0x4135e8]
call fcn.0040c9aa
push dword [0x413b08]
push dword [0x413b08]
call fcn.0040c845
lea eax, [0x413568]
push eax
call fcn.0040f460
push dword [esp + 0x14]
pop eax
call fcn.0040c610
push eax
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x40346b
mov edx, dword [0x4135e8]
push dword [0x413b08]
call fcn.0040f510
lea eax, [0x413568]
push eax
call fcn.0040f460
mov dword [esp + 0xc], 2
jmp 0x40347d
mov ebx, 1
cmp ebx, dword [esp]
jne 0x40347d
mov dword [esp + 0xc], 1
pop eax
mov ebx, dword [esp + 0x14]
add ebx, dword [esp + 8]
push ebx
pop eax
call fcn.0040c610
mov dword [0x4135a4], eax
mov ebx, dword [esp + 0x14]
add ebx, dword [esp + 8]
inc ebx
push ebx
pop eax
call fcn.0040c610
mov dword [0x4134b4], eax
mov eax, 1
jmp 0x4034b0
push dword [esp + 4]
call fcn.0040f570
add esp, 0xc
pop ebx
ret 4
Function at 0x403bc2
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov edx, 9
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x403bc8
lea eax, [esp]
push eax
call sub.KERNEL32.dll_GetNativeSystemInfo
lea ebp, [esp]
cmp word [ebp], 0
je 0x403bef
mov eax, 1
jmp 0x403bf1
xor eax, eax
add esp, 0x24
pop ebp
ret

Function at 0x403bf6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov edx, 9
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x403bfc
mov edx, dword [esp + 0x30]
lea ecx, [esp]
call fcn.00405060
push 0x21
call fcn.0040c5f0
mov dword [esp + 4], eax
push 0x21
push dword [esp + 8]
call fcn.0040c740
push 0x20
push dword [esp + 8]
mov eax, dword [0x413604]
push eax
call fcn.0040c760
push 1
push dword [esp + 4]
mov ebx, dword [esp + 0xc]
add ebx, 0x20
push ebx
call fcn.0040c790
push dword [0x413b08]
push dword [0x413b08]
push dword [0x413b08]
push dword [0x413b08]
push 0x21
push dword [esp + 0x18]
call fcn.0040dcb0
mov edx, dword [0x412320]
add dword [esp], edx
call fcn.00405a70
lea eax, [esp + 0xc]
push eax
call fcn.0040f460
push dword [esp + 4]
call fcn.0040c6f0
push 0xa
push dword [esp + 0xc]
push dword [esp + 0x34]
call sub.KERNEL32.dll_FindResourceA
mov dword [esp + 0xc], eax
cmp dword [esp + 0xc], 0
je 0x403de1
push dword [esp + 0xc]
push dword [esp + 0x30]
call sub.KERNEL32.dll_LoadResource
mov dword [0x4134b8], eax
push dword [esp + 0xc]
push dword [esp + 0x30]
call sub.KERNEL32.dll_SizeofResource
mov dword [0x4134cc], eax
push dword [esp]
mov edx, 0x412027
pop ecx
call fcn.0040f4e0
jne 0x403d29
push dword [esp]
mov edx, 0x41202b
pop ecx
call fcn.0040f4e0
jne 0x403d29
push dword [esp]
mov edx, 0x41202d
pop ecx
call fcn.0040f4e0
jne 0x403d29
push dword [esp]
mov edx, 0x412035
pop ecx
call fcn.0040f4e0
jne 0x403d29
jmp 0x403d30
mov eax, 1
jmp 0x403d32
xor eax, eax
and eax, eax
je 0x403de1
push dword [0x4134cc]
call fcn.0040c5f0
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0
mov ebx, dword [0x4134cc]
dec ebx
cmp ebx, dword [esp + 0x14]
jl 0x403d97
mov ebx, dword [0x4134b8]
add ebx, dword [esp + 0x14]
push ebx
pop eax
call fcn.0040c610
mov dword [esp + 0x18], eax
mov ebx, dword [esp + 0x18]
imul ebx, ebx, 0xffffffff
mov dword [esp + 0x1c], ebx
push dword [esp + 0x1c]
mov ebx, dword [esp + 0x14]
add ebx, dword [esp + 0x18]
push ebx
pop eax
call fcn.0040c620
inc dword [esp + 0x14]
jno 0x403d51
push dword [0x413604]
push dword [0x4134cc]
push dword [esp + 0x18]
call fcn.00403000
push dword [esp + 0x10]
pop eax
mov dword [0x4134b8], eax
push dword [0x4134cc]
push dword [esp + 0x14]
call fcn.0040417a
mov dword [esp + 0x20], eax
push dword [esp + 0x20]
pop eax
mov dword [0x4134b8], eax
push dword [esp + 0x20]
call fcn.0040c7d0
mov dword [0x4134cc], eax
mov eax, dword [esp + 0xc]
jmp 0x403de9
push dword [esp + 8]
call fcn.0040f570
push dword [esp]
call fcn.0040f570
add esp, 0x24
pop ebx
ret 8
Function at 0x4040ae
Capabilities:
Delete directory

Disassembly:
push ebp
push ebx
xor eax, eax
push eax
mov ebx, dword [0x4135a4]
cmp ebx, 1
jne 0x40416b
push dword [0x41361c]
call fcn.00409c8b
mov ebx, eax
and ebx, ebx
jle 0x404112
push dword [0x41361c]
call fcn.00409c95
push dword [0x41361c]
call fcn.00409caa
or eax, eax
je 0x404112
mov ebp, dword [0x413620]
push dword [ebp + 8]
call fcn.0040dfd0
mov ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x404110
mov ebp, dword [0x413620]
push dword [ebp + 8]
call fcn.0040c99c
jmp 0x4040de
push dword [0x413624]
call fcn.00409c8b
mov dword [esp], eax
mov ebx, dword [esp]
and ebx, ebx
jle 0x40416b
push 5
push 0
push 1
push dword [0x413624]
call fcn.00407940
push dword [0x413624]
call fcn.00409c95
push dword [0x413624]
call fcn.00409caa
or eax, eax
je 0x40416b
mov ebp, dword [0x413628]
push dword [ebp + 0xc]
call sub.KERNEL32.dll_RemoveDirectoryA
jmp 0x40414c
mov eax, 1
jmp 0x404174
add esp, 4
pop ebx
pop ebp
ret

Function at 0x40825d
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
xor ebx, ebx
push esi
push edi
cmp dword [esp + 0x10], ebx
je 0x4082ac
push dword [esp + 0x10]
push 0x4081db
call dword [sym.imp.USER32.DLL_EnumWindows]
mov esi, dword [0x413634]
cmp esi, ebx
je 0x408300
mov edi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 8], eax
jne 0x4082a4
cmp byte [esi + 0x10], bl
je 0x4082a4
push 3
push ebx
push ebx
push ebx
push ebx
push 0xfffffffffffffffe
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
mov esi, edi
cmp edi, ebx
jne 0x408281
jmp 0x408300
mov esi, dword [0x413634]
cmp esi, ebx
je 0x408300
push ebp
mov ebp, dword [esi]
lea edi, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [edi], eax
jne 0x4082f9
cmp byte [esi + 0x11], bl
je 0x4082d6
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_EnableWindow]
cmp byte [esi + 0x10], bl
je 0x4082ec
push 3
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
push edi
push 0x413634
call fcn.0040f08d
pop ecx
pop ecx
mov esi, ebp
cmp ebp, ebx
jne 0x4082b7
pop ebp
pop edi
pop esi
pop ebx
ret 4