joyce8/EMBER2024-capa huggingface dataset:
Function at 0xaf3b71
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
pushal
mov eax, 1
test eax, eax
je 0xaf3ddd
mov byte [ebp - 0x10c], 0x50
mov byte [ebp - 0x10b], 0x72
mov byte [ebp - 0x10a], 0x6f
mov byte [ebp - 0x109], 0x63
mov byte [ebp - 0x108], 0x65
mov byte [ebp - 0x107], 0x73
mov byte [ebp - 0x106], 0x73
mov byte [ebp - 0x105], 0x69
mov byte [ebp - 0x104], 0x6e
mov byte [ebp - 0x103], 0x67
mov byte [ebp - 0x102], 0x20
mov byte [ebp - 0x101], 0x49
mov byte [ebp - 0x100], 0x6d
mov byte [ebp - 0xff], 0x70
mov byte [ebp - 0xfe], 0x6f
mov byte [ebp - 0xfd], 0x72
mov byte [ebp - 0xfc], 0x74
mov byte [ebp - 0xfb], 0x20
mov byte [ebp - 0xfa], 0x44
mov byte [ebp - 0xf9], 0x69
mov byte [ebp - 0xf8], 0x72
mov byte [ebp - 0xf7], 0x65
mov byte [ebp - 0xf6], 0x63
mov byte [ebp - 0xf5], 0x74
mov byte [ebp - 0xf4], 0x6f
mov byte [ebp - 0xf3], 0x72
mov byte [ebp - 0xf2], 0x79
mov byte [ebp - 0xf1], 0x3a
mov byte [ebp - 0xf0], 0
mov eax, 1
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0xc]
add eax, dword [ebp + 0xc]
mov ebx, eax
mov eax, 1
test eax, eax
je 0xaf3ddd
mov eax, 1
test eax, eax
je 0xaf3ddd
push ebx
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
test eax, eax
je 0xaf3ddd
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [edx + 0x10]
add eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
sub ecx, ecx
mov eax, dword [ebp - 0xc]
add eax, ecx
mov eax, dword [eax]
test eax, eax
je 0xaf3dd3
mov ebx, eax
and eax, 0x80000000
jne 0xaf3d4a
mov byte [ebp - 0x10c], 0x4e
mov byte [ebp - 0x10b], 0x61
mov byte [ebp - 0x10a], 0x6d
mov byte [ebp - 0x109], 0x65
mov byte [ebp - 0x108], 0x3a
mov byte [ebp - 0x107], 0x20
mov byte [ebp - 0x106], 0
lea eax, [ebp - 0x10c]
mov eax, 1
test eax, eax
je 0xaf3ddd
add ebx, dword [ebp + 0xc]
lea ebx, [ebx + 2]
mov eax, ebx
mov eax, 1
test eax, eax
je 0xaf3ddd
mov eax, 1
test eax, eax
je 0xaf3ddd
push ecx
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
pop ecx
test eax, eax
je 0xaf3ddd
mov ebx, dword [ebp - 8]
add ebx, ecx
mov dword [ebx], eax
add ecx, 4
jmp 0xaf3ca5
mov byte [ebp - 0x10c], 0x4f
mov byte [ebp - 0x10b], 0x72
mov byte [ebp - 0x10a], 0x64
mov byte [ebp - 0x109], 0x69
mov byte [ebp - 0x108], 0x6e
mov byte [ebp - 0x107], 0x61
mov byte [ebp - 0x106], 0x6c
mov byte [ebp - 0x105], 0x3a
mov byte [ebp - 0x104], 0x20
mov byte [ebp - 0x103], 0
lea eax, [ebp - 0x10c]
mov eax, 1
test eax, eax
je 0xaf3ddd
xor ebx, 0x80000000
mov eax, ebx
mov eax, 1
test eax, eax
je 0xaf3b67
push ecx
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
pop ecx
test eax, eax
je 0xaf3ddd
mov ebx, dword [ebp - 8]
add ebx, ecx
mov dword [ebx], eax
add ecx, 4
jmp 0xaf3ca5
popal
mov eax, 1
leave
ret 0xc
popal
mov eax, 0
leave
ret 0xc
Function at 0xaf3e9d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
pushal
mov edx, dword [ebp + 0xc]
sub eax, eax
mov ax, word [edx + 2]
mov dword [ebp - 0x118], eax
add edx, 0x14
mov eax, dword [edx + 0x1c]
mov dword [ebp - 0x114], eax
mov eax, dword [edx + 0x38]
mov dword [ebp - 0x110], edx
lea edx, [ebp - 0xc]
mov ebx, dword [ebp + 8]
push edx
push 4
push eax
push dword [ebp - 0x114]
call dword [ebx + 0x24]
test eax, eax
je 0xaf3fee
mov byte [ebp - 0x10c], 0x53
mov byte [ebp - 0x10b], 0x65
mov byte [ebp - 0x10a], 0x74
mov byte [ebp - 0x109], 0x20
mov byte [ebp - 0x108], 0x49
mov byte [ebp - 0x107], 0x6d
mov byte [ebp - 0x106], 0x61
mov byte [ebp - 0x105], 0x67
mov byte [ebp - 0x104], 0x65
mov byte [ebp - 0x103], 0x20
mov byte [ebp - 0x102], 0x77
mov byte [ebp - 0x101], 0x72
mov byte [ebp - 0x100], 0x69
mov byte [ebp - 0xff], 0x74
mov byte [ebp - 0xfe], 0x61
mov byte [ebp - 0xfd], 0x62
mov byte [ebp - 0xfc], 0x6c
mov byte [ebp - 0xfb], 0x65
mov byte [ebp - 0xfa], 0x3a
mov byte [ebp - 0xf9], 0
mov eax, 1
mov eax, 1
test eax, eax
je 0xaf3fee
mov edx, dword [ebp - 0x110]
lea ebx, [edx + 0x60]
mov eax, dword [edx + 0x5c]
mov edx, 8
mul edx
add eax, ebx
mov dword [ebp - 8], eax
mov eax, 0x28
mov edx, dword [ebp - 0x118]
mul edx
add eax, dword [ebp - 8]
mov ebx, dword [ebp + 0x10]
sub eax, ebx
mov dword [ebp - 4], eax
mov edi, dword [ebp - 0x114]
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x118]
mov ebx, dword [ebp - 8]
push dword [ebp + 0x10]
push dword [ebp - 0x114]
push ebx
push dword [ebp + 8]
call fcn.00af3ff8
test eax, eax
je 0xaf3fee
add ebx, 0x28
dec ecx
jne 0xaf3fc7
popal
mov eax, dword [ebp - 0x114]
leave
ret 0x10
popal
mov eax, 0
leave
ret 0x10

Function at 0xaf409e
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
pushal
mov edx, dword [ebp + 0xc]
mov ebx, dword [edx + 0x24]
and ebx, 0xe0000000
cmp ebx, 0xe0000000
jne 0xaf40c9
mov eax, 0x40
mov dword [ebp - 0x108], eax
jmp 0xaf412e
mov ebx, dword [edx + 0x24]
and ebx, 0x60000000
cmp ebx, 0x60000000
jne 0xaf40e7
mov eax, 0x20
mov dword [ebp - 0x108], eax
jmp 0xaf412e
mov ebx, dword [edx + 0x24]
and ebx, 0xc0000000
cmp ebx, 0xc0000000
jne 0xaf4105
mov eax, 4
mov dword [ebp - 0x108], eax
jmp 0xaf412e
mov ebx, dword [edx + 0x24]
and ebx, 0x40000000
cmp ebx, 0x40000000
jne 0xaf4123
mov eax, 2
mov dword [ebp - 0x108], eax
jmp 0xaf412e
mov eax, 1
mov dword [ebp - 0x108], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0xc]
add eax, dword [ebp + 0x10]
mov ebx, dword [edx + 8]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x104]
push edx
push dword [ebp - 0x108]
push ebx
push eax
call dword [ecx + 0x24]
test eax, eax
je 0xaf416b
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0xc]
add eax, dword [ebp + 0x10]
mov eax, 1
popal
mov eax, 1
leave
ret 0x10
popal
sub eax, eax
leave
ret 0x10
Function at 0xaf4172
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
pushal
mov edx, dword [ebp + 8]
mov ax, word [edx]
cmp ax, 0x5a4d
jne 0xaf41a1
mov eax, dword [edx + 0x3c]
add edx, eax
mov eax, dword [edx]
cmp eax, 0x4550
jne 0xaf41a1
add edx, 4
mov dword [ebp - 4], edx
popal
mov eax, dword [ebp - 4]
leave
ret 8
popal
sub eax, eax
leave
ret 8

Function at 0xaf4dff
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov ecx, 3
mov edx, 1
push ecx
push dword [ebp + 8]
call fcn.00af4f04
rol eax, 8
push dword [ebp + 0xc]
push eax
call fcn.00af4f20
push edx
push dword [ebp + 0x10]
push eax
call fcn.00af4eec
inc edx
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.00af4f04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.00af4ecb
push ecx
push dword [ebp + 8]
call fcn.00af4f04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.00af4f04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.00af4ecb
push ecx
push dword [ebp + 8]
call fcn.00af4f04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.00af4f04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.00af4ecb
push ecx
push dword [ebp + 8]
call fcn.00af4f04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.00af4f04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.00af4ecb
cmp ecx, 0x2b
jne 0xaf4e0f
leave
ret 0xc

Function at 0xaf64b4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
pushal
mov byte [ebp - 0x118], 0x42
mov byte [ebp - 0x117], 0x72
mov byte [ebp - 0x116], 0x75
mov byte [ebp - 0x115], 0x74
mov byte [ebp - 0x114], 0x65
mov byte [ebp - 0x113], 0x66
mov byte [ebp - 0x112], 0x6f
mov byte [ebp - 0x111], 0x72
mov byte [ebp - 0x110], 0x63
mov byte [ebp - 0x10f], 0x69
mov byte [ebp - 0x10e], 0x6e
mov byte [ebp - 0x10d], 0x67
mov byte [ebp - 0x10c], 0x20
mov byte [ebp - 0x10b], 0x4b
mov byte [ebp - 0x10a], 0x65
mov byte [ebp - 0x109], 0x79
mov byte [ebp - 0x108], 0
mov eax, 1
lea edi, [ebp - 0x14]
mov ecx, 0x10
mov al, 0
mov byte [edi], al
inc edi
dec ecx
jne 0xaf6544
mov eax, dword [ebp + 8]
push 4
push 0x3000
push 0x374810
push 0
call dword [eax + 0x20]
test eax, eax
je 0xaf65d6
mov dword [ebp - 4], eax
mov edi, eax
mov esi, dword [ebp + 0xc]
mov ecx, 0x374810
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
push dword [ebp + 0xc]
push 0x374810
call fcn.00af63fa
push 0x374810
push dword [ebp + 0xc]
call fcn.00af41a8
test eax, eax
jne 0xaf65b8
mov esi, dword [ebp - 4]
mov edi, dword [ebp + 0xc]
mov ecx, 0x374810
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14]
push eax
call fcn.00af65dd
test eax, eax
je 0xaf65d6
jmp 0xaf6574
mov eax, dword [ebp + 8]
push 0x8000
push 0
push dword [ebp - 4]
call dword [eax + 0x28]
test eax, eax
je 0xaf65d6
popal
mov eax, 1
leave
ret 8
popal
sub eax, eax
leave
ret 8
Function at 0xaf660b
Capabilities:
Terminate process

Disassembly:
call fcn.00af6618
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
Function at 0x402a36
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x1b0]
sub esp, 0x230
mov eax, dword [0x40d040]
xor eax, ebp
mov dword [ebp + 0x1ac], eax
push ebx
push esi
push 0
push 2
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
push 0x228
mov esi, eax
lea eax, [ebp - 0x7c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x80], 0x22c
lea eax, [ebp - 0x80]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x402ac6
jmp 0x402a9a
lea edx, [ebp - 0x5c]
mov ecx, ebx
call fcn.004052c2
test al, al
jne 0x402aab
lea eax, [ebp - 0x80]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x402a8c
jmp 0x402ac6
push dword [ebp - 0x78]
push 1
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x1ac]
pop esi
xor ecx, ebp
pop ebx
call fcn.00406228
add ebp, 0x1b0
leave
ret

Function at 0x402b20
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, 0x7ffffffe
push ebx
push esi
mov esi, dword [ecx + 0x10]
xor ebx, ebx
sub eax, esi
push edi
mov edi, edx
cmp eax, 0x17
jb 0x402b9a
lfence
cmp dword [ecx + 0x14], 7
jbe 0x402b47
mov ecx, dword [ecx]
push esi
push ecx
push 0x17
push ecx
push ecx
push dword [ebp - 4]
lea ecx, [ebp - 0x1c]
call fcn.0040594f
cmp dword [ebp - 8], 7
lea ecx, [ebp - 0x1c]
push ebx
cmova ecx, dword [ebp - 0x1c]
imul eax, edi, 0x20a
push ebx
lea esi, [eax + 0x40d7d0]
push esi
push ecx
push ebx
call dword [sym.imp.urlmon.dll_URLDownloadToFileW]
lea ecx, [ebp - 0x1c]
call fcn.00404f2c
sub esp, 0x18
mov ecx, esp
push esi
call fcn.00402791
call fcn.00402ae4
add esp, 0x18
pop edi
pop esi
pop ebx
leave
ret
call fcn.00401445
int3

Function at 0x402ba0
Capabilities:
Download url
Receive data

Disassembly:
push ecx
cmp dword [ecx + 0x14], 7
push esi
jbe 0x402baa
mov ecx, dword [ecx]
imul eax, edx, 0x20a
lea esi, [eax + 0x40d7d0]
xor eax, eax
push eax
push eax
push esi
push ecx
push eax
call dword [sym.imp.urlmon.dll_URLDownloadToFileW]
sub esp, 0x18
mov ecx, esp
push esi
call fcn.00402791
call fcn.00402ae4
add esp, 0x18
pop esi
pop ecx
ret
Function at 0x402c5b
Capabilities:
Read .ini file
Terminate process

Disassembly:
push 0x5c
mov eax, 0x407a07
call fcn.00407250
mov ebx, ecx
xor eax, eax
lea ecx, [ebp - 0x68]
xor edi, edi
mov word [0x40d7d0], ax
mov word [0x417f04], ax
call fcn.00402743
push eax
lea ecx, [ebp - 0x50]
mov dword [ebp - 4], edi
call fcn.00404d66
push 0x52
lea edx, [ebp - 0x50]
mov byte [ebp - 4], 1
pop ecx
call fcn.00402929
lea ecx, [ebp - 0x50]
call fcn.00404f2c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.00404f2c
push str.LoLSuite.ini
lea ecx, [ebp - 0x50]
call fcn.00402791
push 0x52
lea edx, [ebp - 0x50]
mov dword [ebp - 4], 2
pop ecx
call fcn.00402929
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x50]
call fcn.00404f2c
cmp dword [ebx + 0x14], 7
mov eax, ebx
jbe 0x402ce5
mov eax, dword [ebx]
push 0x417f04
push 0x105
mov esi, 0x40d7d0
push esi
push edi
push eax
push str.Path
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push esi
lea ecx, [ebp - 0x68]
call fcn.00402791
lea ecx, [ebp - 0x68]
mov esi, dword [eax + 0x10]
call fcn.00404f2c
test esi, esi
jne 0x402d9e
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0x34]
rep stosd dword es:[edi], eax
mov edx, 0x409194
mov dword [ebp - 0x24], 0x250
mov ecx, ebx
call fcn.004052c2
test al, al
mov esi, str.X:Riot_Games
mov edx, 0x4091b8
mov ecx, ebx
cmove esi, dword [ebp - 0x28]
mov dword [ebp - 0x28], esi
call fcn.004052c2
test al, al
mov ecx, str.X:Program_Files__x86_Steam_steamappscommondota_2_betagame_binwin64
lea eax, [ebp - 0x34]
cmove ecx, esi
push eax
mov dword [ebp - 0x28], ecx
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
test eax, eax
jne 0x402d77
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov esi, 0x40d7d0
push esi
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
cmp dword [ebx + 0x14], 7
jbe 0x402d8c
mov ebx, dword [ebx]
push 0x417f04
push esi
push ebx
push str.Path
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
call fcn.0040720e
ret
Function at 0x402da4
Capabilities:
Create process on windows
Terminate process

Disassembly:
push 0x54
mov eax, 0x407a6b
call fcn.0040721d
mov bl, cl
push str.dota2.exe
lea ecx, [ebp - 0x24]
call fcn.00402791
lea ecx, [ebp - 0x24]
call fcn.00402a36
lea ecx, [ebp - 0x24]
call fcn.00401cf8
xor eax, eax
lea ecx, [ebp - 0x24]
push 0x4091b8
mov word [0x40d9da], ax
mov word [0x40dbe4], ax
call fcn.00402791
and dword [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.00402c5b
or esi, 0xffffffff
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], esi
call fcn.00401cf8
push str.D3DCompiler_47.dll
lea ecx, [ebp - 0x24]
call fcn.00402791
xor edi, edi
lea eax, [ebp - 0x24]
inc edi
xor edx, edx
push eax
mov ecx, edi
mov dword [ebp - 4], edi
call fcn.004029aa
pop ecx
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], esi
call fcn.00401cf8
push str.embree3.dll
lea ecx, [ebp - 0x24]
call fcn.00402791
push 2
pop ecx
lea eax, [ebp - 0x24]
mov dword [ebp - 4], ecx
push eax
xor edx, edx
call fcn.004029aa
pop ecx
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], esi
call fcn.00401cf8
lea ecx, [ebp - 0x24]
test bl, bl
je 0x402e9d
push str.r_dota2_d3dcompiler_47.dlll
call fcn.00402791
mov edx, edi
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x24]
call fcn.00402b20
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], esi
call fcn.00401cf8
push str.r_dota2_embree3.dll
lea ecx, [ebp - 0x24]
call fcn.00402791
mov dword [ebp - 4], 4
jmp 0x402ed7
push str.6_D3DCompiler_47.dll
call fcn.00402791
mov edx, edi
mov dword [ebp - 4], 5
lea ecx, [ebp - 0x24]
call fcn.00402b20
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], esi
call fcn.00401cf8
push str.6_embree.dll
lea ecx, [ebp - 0x24]
call fcn.00402791
mov dword [ebp - 4], 6
push 2
pop edx
lea ecx, [ebp - 0x24]
call fcn.00402b20
lea ecx, [ebp - 0x24]
call fcn.00401cf8
push 0x3c
pop ebx
push ebx
lea eax, [ebp - 0x60]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea esi, [ebp - 0x60]
mov eax, 0x418114
mov edi, eax
push 0xf
pop ecx
rep movsd dword es:[edi], dword [esi]
push eax
mov dword [0x418114], ebx
mov dword [0x418118], 0x40
mov dword [0x418130], 5
mov dword [0x418124], 0x40934c
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov eax, dword [0x41814c]
test eax, eax
je 0x402f48
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x40390c
Capabilities:
Create process on windows

Disassembly:
push 0x8c
mov eax, 0x407c62
call fcn.0040721d
xor eax, eax
lea ecx, [ebp - 0x5c]
xor esi, esi
mov word [0x417f04], ax
call fcn.00402743
push eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], esi
call fcn.00404d66
push 0x52
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 1
pop ecx
call fcn.00402929
lea ecx, [ebp - 0x28]
call fcn.00404f2c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c]
call fcn.00404f2c
call fcn.00402bd9
test al, al
je 0x4039bb
push str.jdk_22_windows_x64_bin.exe
lea ecx, [ebp - 0x28]
call fcn.00402791
push 0x52
lea edx, [ebp - 0x28]
mov dword [ebp - 4], 2
pop ecx
call fcn.00402929
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00404f2c
push str.https:__download.oracle.com_java_22_latest_jdk_22_windows_x64_bin.exe
lea ecx, [ebp - 0x28]
call fcn.00402791
push 0x52
pop edx
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 3
call fcn.00402ba0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00404f2c
push 0x3c
lea eax, [ebp - 0x98]
push esi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea esi, [ebp - 0x98]
mov eax, 0x418114
mov edi, eax
push 0xf
pop ecx
rep movsd dword es:[edi], dword [esi]
push eax
mov dword [0x418114], 0x3c
mov dword [0x418118], 0x40
mov dword [0x418130], 5
mov dword [0x418124], 0x417f04
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov eax, dword [0x41814c]
test eax, eax
je 0x403a20
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ecx
push 0x40d7d0
lea ecx, [ebp - 0x44]
call fcn.00405283
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 4
call fcn.00402640
lea ecx, [ebp - 0x44]
call fcn.00404f2c
push 0
push 0x40907c
push str.Minecraft_Launcher___Minecraft:_Java_Edition___Installations___Latest___Edit___More_Options___Java_Executable_Path____drive_:Program_FilesJavajdk_22_binjavaw.exe
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
call fcn.004071fa
ret
Function at 0x403a5f
Capabilities:
Create process on windows

Disassembly:
push 0x8c
mov eax, 0x407c62
call fcn.0040721d
xor eax, eax
lea ecx, [ebp - 0x5c]
xor esi, esi
mov word [0x417f04], ax
call fcn.00402743
push eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], esi
call fcn.00404d66
push 0x52
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 1
pop ecx
call fcn.00402929
lea ecx, [ebp - 0x28]
call fcn.00404f2c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c]
call fcn.00404f2c
push str.dxwebsetup.exe
lea ecx, [ebp - 0x28]
call fcn.00402791
push 0x52
lea edx, [ebp - 0x28]
mov dword [ebp - 4], 2
pop ecx
call fcn.00402929
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00404f2c
push str.https:__download.microsoft.com_download_1_7_1_1718CCC4_6315_4D8E_9543_8E28A4E18C4C_dxwebsetup.exe
lea ecx, [ebp - 0x28]
call fcn.00402791
push 0x52
pop edx
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 3
call fcn.00402ba0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00404f2c
push 0x3c
lea eax, [ebp - 0x98]
push esi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea esi, [ebp - 0x98]
mov eax, 0x418114
mov edi, eax
push 0xf
pop ecx
rep movsd dword es:[edi], dword [esi]
mov esi, 0x417f04
mov dword [0x418114], 0x3c
push eax
mov dword [0x418118], 0x40
mov dword [0x418130], 5
mov dword [0x418128], 0x409c5c
mov dword [0x418124], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov eax, dword [0x41814c]
test eax, eax
je 0x403b75
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ecx
push esi
lea ecx, [ebp - 0x44]
call fcn.00405283
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 4
call fcn.00402640
lea ecx, [ebp - 0x44]
call fcn.00404f2c
call fcn.004071fa
ret
Function at 0x403b9c
Capabilities:
Create process on windows

Disassembly:
push 0x8c
mov eax, 0x407cb7
call fcn.0040721d
xor eax, eax
lea ecx, [ebp - 0x5c]
xor esi, esi
mov word [0x40d7d0], ax
call fcn.00402743
push eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], esi
call fcn.00404d66
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 1
xor ecx, ecx
call fcn.00402929
lea ecx, [ebp - 0x28]
call fcn.00404f2c
or ebx, 0xffffffff
lea ecx, [ebp - 0x5c]
mov dword [ebp - 4], ebx
call fcn.00404f2c
push str.7z.exe
lea ecx, [ebp - 0x28]
call fcn.00402791
lea edx, [ebp - 0x28]
mov dword [ebp - 4], 2
xor ecx, ecx
call fcn.00402929
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], ebx
call fcn.00404f2c
call fcn.00402bd9
lea ecx, [ebp - 0x28]
test al, al
je 0x403c35
push str.https:__7_zip.org_a_7z2406_x64.exe
call fcn.00402791
mov dword [ebp - 4], 3
jmp 0x403c46
push str.https:__7_zip.org_a_7z2406.exe
call fcn.00402791
mov dword [ebp - 4], 4
xor edx, edx
lea ecx, [ebp - 0x28]
call fcn.00402ba0
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], ebx
call fcn.00404f2c
push 0x3c
pop ebx
push ebx
lea eax, [ebp - 0x98]
push esi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea esi, [ebp - 0x98]
mov eax, 0x418114
mov edi, eax
push 0xf
pop ecx
rep movsd dword es:[edi], dword [esi]
push 5
pop esi
mov edi, 0x40d7d0
mov dword [0x418114], ebx
push eax
mov dword [0x418118], 0x40
mov dword [0x418130], esi
mov dword [0x418128], 0x409d00
mov dword [0x418124], edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov eax, dword [0x41814c]
test eax, eax
je 0x403cc8
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ecx
push edi
lea ecx, [ebp - 0x44]
call fcn.00405283
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], esi
call fcn.00402640
lea ecx, [ebp - 0x44]
call fcn.00404f2c
call fcn.004071fa
ret
Function at 0x403ceb
Capabilities:
Create process on windows

Disassembly:
push 0x8c
mov eax, 0x407c62
call fcn.0040721d
xor eax, eax
lea ecx, [ebp - 0x5c]
xor esi, esi
mov word [0x40d7d0], ax
call fcn.00402743
push eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], esi
call fcn.00404d66
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 1
xor ecx, ecx
call fcn.00402929
lea ecx, [ebp - 0x28]
call fcn.00404f2c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c]
call fcn.00404f2c
push str.VisualCppRedist_AIO_x86_x64.exe
lea ecx, [ebp - 0x28]
call fcn.00402791
lea edx, [ebp - 0x28]
mov dword [ebp - 4], 2
xor ecx, ecx
call fcn.00402929
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00404f2c
push str.https:__github.com_abbodi1406_vcredist_releases_download_v0.82.0_VisualCppRedist_AIO_x86_x64.exe
lea ecx, [ebp - 0x28]
call fcn.00402791
xor edx, edx
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x28]
call fcn.00402ba0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00404f2c
push 0x3c
pop ebx
push ebx
lea eax, [ebp - 0x98]
push esi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea esi, [ebp - 0x98]
mov eax, 0x418114
mov edi, eax
push 0xf
pop ecx
rep movsd dword es:[edi], dword [esi]
push eax
mov dword [0x418114], ebx
mov dword [0x418118], 0x40
mov dword [0x418130], 5
mov dword [0x418128], 0x409e0c
mov dword [0x418124], 0x40d7d0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov eax, dword [0x41814c]
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x403dfd
push 0xffffffffffffffff
push eax
call ebx
push 0x3c
lea eax, [ebp - 0x98]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea esi, [ebp - 0x98]
mov eax, 0x418114
mov edi, eax
push 0xf
pop ecx
rep movsd dword es:[edi], dword [esi]
mov esi, 0x40d7d0
mov dword [0x418114], 0x3c
push eax
mov dword [0x418118], 0x40
mov dword [0x418130], 5
mov dword [0x418128], 0x409e20
mov dword [0x418124], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov eax, dword [0x41814c]
test eax, eax
je 0x403e6a
push 0xffffffffffffffff
push eax
call ebx
push ecx
push esi
lea ecx, [ebp - 0x44]
call fcn.00405283
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 4
call fcn.00402640
lea ecx, [ebp - 0x44]
call fcn.00404f2c
call fcn.004071fa
ret