joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45923c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x497be4]
cmp dword [eax + 0x30], 0
je 0x4592e6
cmp dword [ebx + 0x94], 0
jne 0x4592e0
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4591cc
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4592e0
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x4592a6
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4592e0
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00418240
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4592b5
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x459e44
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x459e79
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404694
jmp 0x459e86
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004045f8
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45b050
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45b091
mov eax, esi
call fcn.004409f8
test al, al
je 0x45b091
mov eax, dword [ebx + 0x84]
call fcn.004406f4
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45b091
push 0
mov eax, dword [ebx + 0x84]
call fcn.004406f4
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x45e824
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x45e852
mov eax, ebx
call fcn.0045f2d8
cmp dword [ebx + 0x40], 0
je 0x45e84b
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x45e8c3
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x45e8b5
cmp dword [ebx + 8], 0
je 0x45e874
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x45e886
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x45e8b5
cmp dword [ebx + 8], 0
je 0x45e867
cmp eax, 3
je 0x45e899
dec eax
jne 0x45e867
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x45e867
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x45e867
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x45e8e1
cmp dword [ebx + 0x14], 0xcc
je 0x45e8e1
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0045e8ec
pop ebx
ret
Function at 0x46f848
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x41542c]
call fcn.00404f40
xor eax, eax
push ebp
push 0x46f98c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x495798], 0
jne 0x46f89b
mov ecx, dword [0x496014]
mov dl, 1
mov eax, dword [0x4078f0]
call fcn.0040c408
call fcn.00403f34
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00403198
mov eax, ebx
call fcn.00404e0c
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x46f99c
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00405f80
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00404e1c
test eax, eax
jle 0x46f933
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x46f92c
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.0040482c
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404814
mov eax, dword [ebp - 0x48]
pop edx
call fcn.004087d4
test eax, eax
jne 0x46f92c
mov ebx, 0x15
jmp 0x46f938
mov ebx, 0x10
jmp 0x46f938
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x495798]
call fcn.0046f7a0
mov eax, dword [ebp - 8]
call fcn.0046f7a0
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00405f98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46f993
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.004045c8
lea eax, [ebp - 0x10]
mov edx, dword [0x41542c]
call fcn.00405010
ret

Function at 0x476a10
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x476a61
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x476a48
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x476a38
jmp 0x476a61
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x476a49
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xdd6170
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xe3126c
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0xe480c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], 0
mov dword [ebx], 0xe435f4
mov dword [ebx + 0x70], 0
mov dword [ebx + 0x74], 0
mov dword [ebx + 0x78], 0
mov dword [ebx + 0x7c], 0
mov dword [ebx + 0x80], 0
mov dword [ebx + 0x84], 0
mov dword [ebx + 0x88], 0
mov dword [ebx + 0x8c], 0
mov dword [ebx + 0x90], 0
mov dword [ebx + 0x94], 0
mov dword [ebx + 0x98], 0
mov dword [ebx + 0x68], 0xe3aee4
mov dword [ebx + 0xa0], 0
mov dword [ebx + 0xa4], 0
mov byte [ebx + 0xa8], 0
push 0
push 0
lea esi, [ebx + 4]
mov dword [ebp - 4], 0
push esi
mov dword [ebp - 0x18], 1
call fcn.00dd7bb0
mov dword [ebp - 4], 1
lea edi, [esi + 0x28]
mov eax, dword [ebx]
mov dword [ebp - 0x14], esi
push 8
mov eax, dword [eax + 4]
mov dword [ebx + eax], 0xe435f0
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ecx + ebx - 4], eax
lea eax, [esi + 4]
mov dword [esi], 0xe3aef4
mov dword [ebp - 0x14], eax
mov dword [eax], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [edi], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.00e0a801
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov byte [ebp - 4], 2
call fcn.00e08297
mov ecx, ebx
mov dword [esi + 4], eax
add esp, 8
mov dword [ecx + 0x38], esi
lea ecx, [ecx + 4]
call fcn.00dd8800
mov eax, ebx
lea esi, [eax + 8]
mov dword [eax + 4], 0xe3af34
mov dword [eax + 0x10], esi
lea edx, [eax + 0xc]
mov esi, ebx
mov byte [eax + 0x4c], 0
lea ecx, [eax + 0x18]
mov byte [eax + 0x41], 0
mov dword [eax + 0x14], edx
mov dword [eax + 0x20], ecx
lea eax, [esi + 0x1c]
mov dword [esi + 0x24], eax
lea ebx, [esi + 0x28]
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], edi
mov esi, dword [ebp - 0x14]
mov dword [edx], 0
mov dword [eax], 0
mov dword [edi], 0
mov dword [esi], 0
mov dword [ecx], 0
mov dword [ebx], 0
mov ebx, dword [ebp - 0x10]
mov eax, ebx
mov dword [ebx + 0x50], 0
mov ecx, dword [0xe4a220]
mov edx, dword [0xe4a224]
mov dword [ebx + 0x44], ecx
mov dword [ebx + 0x48], edx
mov dword [ebx + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0xe0b67c
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [0xe331fc]
test eax, eax
je 0xe0b6bb
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0xe0b6bb
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0xe0b6bb
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0xe0b6bb
cmp dword [ecx + 0x74], 0xe
jbe 0xe0b6bb
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x10066708
Capabilities:
Delete directory

Disassembly:
push 0x10
mov eax, 0x1009ec1c
call fcn.1003d9e2
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 0x1001c77c
mov dword [edi + 4], 0x1001d894
mov dword [edi + 0xc], 0x1001c78c
mov dword [edi + 0x10], 0x1001c7c8
xor ebx, ebx
mov dword [ebp - 4], 2
cmp dword [edi + 0x38], ebx
je 0x1006679c
lea eax, [edi + 0x1e8]
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call fcn.10069288
mov esi, dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
cmp esi, eax
je 0x10066770
push 0x326a6f78
call fcn.10058672
cmp dword [edi + 0x208], ebx
je 0x10066782
push 0x326a6f79
call fcn.10058672
cmp dword [edi + 0x204], ebx
je 0x10066794
push 0x326a6f7a
call fcn.10058672
lea ecx, [ebp - 0x1c]
call fcn.1007e529
mov ecx, dword [edi + 0x14]
test ecx, ecx
je 0x100667ac
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [edi + 0x14], ebx
mov ecx, dword [edi + 0x18]
test ecx, ecx
je 0x100667bc
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [edi + 0x18], ebx
mov eax, dword [edi + 0x214]
cmp eax, 0xffffffff
je 0x100667d5
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
or dword [edi + 0x214], 0xffffffff
cmp dword [edi + 0x218], ebx
je 0x10066803
lea esi, [edi + 0x21c]
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
jne 0x100667f8
push 0x326a7030
call fcn.10058672
xor eax, eax
mov word [esi], ax
mov dword [edi + 0x218], ebx
lea eax, [edi + 0x1e8]
push eax
call dword [sym.imp.kernel32.dll_DeleteCriticalSection]
lea ecx, [edi + 0x40]
call fcn.10064f06
or dword [ebp - 4], 0xffffffff
mov ecx, edi
call fcn.1004f259
call fcn.1003daba
ret

Function at 0x10098e80
Capabilities:
Terminate process

Disassembly:
push 0xc
mov eax, 0x1009f32b
call fcn.1003d9e2
mov edi, ecx
mov dword [ebp - 0x18], edi
xor edx, edx
mov dword [edi], edx
mov dword [ebp - 4], 1
cmp dword [ebp + 8], edx
je 0x10098f1d
mov esi, dword [ebp + 8]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, dx
jne 0x10098ea7
sub esi, ecx
sar esi, 1
inc esi
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.msvcr100.dll_void____cdecl_operator_new___unsigned_int_
pop ecx
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x10098eea
push 0x100a3d54
lea eax, [ebp + 8]
push eax
mov dword [ebp + 8], 0x8007000e
call sub.msvcr100.dll__CxxThrowException
lea ecx, [esi + esi]
mov dword [ebp - 0x14], ecx
cmp ecx, esi
ja 0x10098f0b
push 2
pop eax
push eax
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
push ecx
push dword [ebp + 8]
push eax
call sub.msvcr100.dll_memcpy
mov eax, dword [ebp - 0x10]
add esp, 0xc
mov dword [edi], eax
or dword [ebp - 4], 0xffffffff
mov eax, edi
call fcn.1003daba
ret 4
Function at 0x10099080
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x224
mov eax, 0x1009f374
call fcn.1003da4b
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x22c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x228], eax
mov eax, dword [ebp + 0x14]
xor ecx, ecx
mov dword [ebp - 0x230], eax
mov esi, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x220], 0x208
test eax, eax
je 0x100990e3
push eax
mov dword [ebp - 0x21c], ecx
call dword [sym.imp.advapi32.dll_RegCloseKey]
xor ecx, ecx
lea eax, [ebp - 0x21c]
push eax
push 1
push ecx
push dword [ebp - 0x22c]
push edi
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
mov edi, 0xffff
test eax, eax
je 0x10099117
mov esi, eax
jle 0x1009910f
and esi, edi
or esi, 0x80070000
test esi, esi
js 0x100991cd
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x224]
push eax
push 0
push dword [ebp - 0x228]
push dword [ebp - 0x21c]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
je 0x10099150
mov esi, eax
jle 0x10099150
and esi, edi
or esi, 0x80070000
test esi, esi
js 0x100991cd
cmp dword [ebp - 0x224], 1
je 0x1009916d
cmp dword [ebp - 0x224], 7
je 0x1009916d
mov esi, 0x8000ffff
jmp 0x100991cd
mov eax, dword [ebp - 0x220]
xor ecx, ecx
push 2
shr eax, 1
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.msvcr100.dll_void____cdecl_operator_new___unsigned_int_
mov edi, eax
pop ecx
test edi, edi
jne 0x100991ab
push 0x100a3d54
lea eax, [ebp - 0x228]
push eax
mov dword [ebp - 0x228], 0x8007000e
call sub.msvcr100.dll__CxxThrowException
mov ecx, dword [ebp - 0x230]
push edi
call fcn.10058672
push dword [ebp - 0x220]
lea eax, [ebp - 0x218]
push eax
push edi
call sub.msvcr100.dll_memcpy
add esp, 0xc
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x21c]
test ecx, ecx
je 0x100991e9
and dword [ebp - 0x21c], 0
push ecx
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, esi
call fcn.1003dace
ret 0x10

Function at 0xde3d08
Capabilities:
Encode data using xor

Disassembly:
jmp 0xde3d12
pushal
call 0xde3d18
pop ebp
sub ebp, 0x10
sub ebp, 0x9e3d08
jmp 0xde3d2e
mov eax, 0x9e3d08
add eax, ebp
add eax, 0x4c
mov ecx, 0x5a9
mov edx, 0xa53490f2
add eax, 0xf2ba0000
nop
xor al, 0xa5
xor byte [eax], dl
inc eax
dec ecx
jne 0xde3d45
jmp 0xde3d58
jns 0xde3d99
jns 0xde3dd7
into
bnd jae 0xde3d95
or dh, dl
int1
aas
dec edx
cli
dec eax
invalid
invalid
sbb eax, edx
repne cmpsd dword [esi], dword es:[edi]
jg 0xde3d3d
salc
bnd jns 0xde3e1a
cli
bnd jns 0xde3e10
invalid
lcall 0x6b9a, 0xf2d3ab9e
adc dword [esi - 0x29210c0e], ecx
lcall 0xdef3, 0xf28e116b
salc
jg 0xde3d78
salc
push cs
jnp 0xde3de4
salc
sbb dh, bh
sbb ecx, ebx
repne cmpsd dword [esi], dword es:[edi]
cmpsb byte [esi], byte es:[edi]
scasd eax, dword es:[edi]
or eax, 0x870dfe87
cli
sbb bl, byte [esi + 0x79f2f2f2]
dec edi
cli
sar dword [ebx], 0xc1
and byte [ecx + 0x1a], dh
idiv dword [edx - 0xd438903]
sbb dh, bh
mov edx, 0xf2bc76fd
std
std
jp 0xde3dd0
xchg esp, eax
jns 0xde3e0a
retf
Function at 0x4011d0
Capabilities:
Encode data using xor

Disassembly:
push 0x445f08
call sub.MSVBVM60.DLL_ThunRTMain
add byte [eax], al
add byte [eax], al
add byte [eax], al
xor byte [eax], al
add byte [eax], al
inc eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edi], bl
xchg edi, eax
cdq
xor al, 0x74
sbb eax, 0xcda811d6
test eax, 0x83ec8778
cmp eax, 0
add byte [eax], al
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
push eax
jb 0x40127e
push 0x65
arpl word [ecx + esi], si
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add bh, bh
int3
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [0x2100044c], bh
cmp eax, 0x2100044c
or dword [eax], eax
add byte [eax], al
add eax, 0x726f4600
insd dword es:[edi], dx
inc esi
outsd dx, dword [esi]
jb 0x4012f5
xor dword [eax], eax
or eax, 0xde001601
fsub st(6)
frstor dword [eax]
jecxz 0x401279
and bh, al
loope 0x40126c
in eax, dx
ror ecx, 1
and bh, al
loope 0x401284
enter 0xffffffffffffede6, 0xffffffffffffffc9
add byte [ebx], al
invalid
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], 0
add byte [eax], 0
add byte [eax + 0x800080], al
add byte [eax], al
add byte [eax], 0x80
add byte [eax - 0x3fffff80], al
rol al, 0
rcr ah, 0xc0
add al, dh
retf 0xa6
Function at 0x40f80b
Capabilities:
Get common file path

Disassembly:
push 0x60
mov eax, 0x486cd9
call fcn.004304dd
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x68]
xor ebx, ebx
mov dword [ebp - 0x6c], esi
push 0x7fff
mov dword [ebp - 4], ebx
mov dword [ebp - 0x58], ebx
call fcn.0040e88c
mov edi, dword [ebp - 0x60]
push edi
push dword [ebp - 0x64]
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x40f8b3
push dword [ebp - 0x64]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
je 0x40f8c6
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], 0xf
mov byte [esi], bl
push esi
push edi
mov dword [ebp - 0x58], 1
call fcn.0040e468
cmp dword [esi + 0x14], 0x10
pop ecx
pop ecx
mov ecx, esi
jb 0x40f87f
mov ecx, dword [esi]
mov eax, dword [esi + 0x10]
cmp byte [eax + ecx - 1], 0x5c
je 0x40f89e
mov ebx, 0x48f1b4
push ebx
call fcn.00459b10
pop ecx
push eax
push ebx
mov ecx, esi
call fcn.004071d0
cmp byte [ebp - 0x5c], 0
je 0x40f8ab
push edi
call fcn.0043045c
pop ecx
mov eax, esi
call fcn.00430487
ret
push str.Cannot_get_temporary_directory_path
lea ecx, [ebp - 0x28]
call fcn.0040587c
mov byte [ebp - 4], 3
jmp 0x40f8d7
push str.Cannot_get_temporary_directory_long_path_name
lea ecx, [ebp - 0x28]
call fcn.0040587c
mov byte [ebp - 4], 2
push ebx
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x54]
call fcn.00408f3e
push 0x4c456c
lea eax, [ebp - 0x54]
push eax
call fcn.004519dc
int3
Function at 0x4127de
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.004123cf
push eax
push esi
push dword [ebp + 8]
call fcn.00412384
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.004123bf
sub edi, dword [ebx]
lea edi, [edi]
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.004123bf
pop eax
invalid

Function at 0x412a5f
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x412a73
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x412a6e
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x412a58
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x412a60
cmp edx, ebx
jne 0x412bae
invalid
add byte [ebx + 0x45830448], cl
or byte [edx], al
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x412a2f
add eax, dword [eax + 4]
jmp 0x412a1c
mov dword [ebp + 0xc], ebx
jmp 0x412a7e
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x412a96
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x412ab4
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x412b12
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x412af9
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x412b02
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x412b0c
add ecx, eax
or byte [ecx], 4
invalid
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x412aee
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x412a78
mov dword [ebp + 8], esi
xor edi, edi
Function at 0x412a8c
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x412a73
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x412a6e
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x412a58
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x412a60
cmp edx, ebx
jne 0x412bae
invalid
add byte [ebx + 0x45830448], cl
or byte [edx], al
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x412a2f
add eax, dword [eax + 4]
jmp 0x412a1c
mov dword [ebp + 0xc], ebx
jmp 0x412a7e
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x412a96
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x412ab4
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x412b12
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x412af9
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x412b02
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x412b0c
add ecx, eax
or byte [ecx], 4
invalid
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x412aee
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x412a78
mov dword [ebp + 8], esi
xor edi, edi