joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a060
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc esp
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.004097e7
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040979c
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.004097e7
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040979c
add esp, 0xc
mov dword [ebp - 0x538], eax
invalid
movsd dword es:[edi], dword [esi]
adc al, 0xfc
invalid

Function at 0x40a700
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.004097e7
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040979c
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.004097d7
iretd
Function at 0x40dd20
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x42b0b8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4363e4]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebx, ecx
push 0x42f748
push 0x430000
call fcn.0040e350
add esp, 8
xor eax, eax
lea edi, [ebx + 4]
push edi
push eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x40dda8
push 0
lea eax, [esp + 0x18]
push eax
push 0
push 2
push 0
push 0
push 0
push 4
push esi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], 0x42f748
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
push str.begin_share_memory_initialize
call fcn.0040e350
lea edi, [ebx + 0x82c]
add esp, 4
lea esi, [edi + 4]
call fcn.00410680
push str.End_share_memory_initialize
mov dword [edi + 0x30], eax
mov dword [esi], edi
mov dword [edi + 0x34], eax
call fcn.0040e350
add esp, 4
push str.add_ServiceWorkerThread_to_CThreadPool
call fcn.0040e350
add esp, 4
push 8
call fcn.00413137
add esp, 4
test eax, eax
je 0x40ddfe
mov dword [eax], 0x40de70
mov dword [eax + 4], ebx
jmp 0x40de00
xor eax, eax
mov dword [esp + 0x14], eax
push 0x10
push eax
push 0x40e0e0
mov dword [esp + 0x34], 0
call dword [sym.imp.KERNEL32.dll_QueueUserWorkItem]
test eax, eax
je 0x40de52
push 0
mov dword [esp + 0x2c], 0xffffffff
call fcn.00412bf6
add esp, 4
push str.End_add_ServiceWorkerThread_to_CThreadPool_tell_SCM_service_starts_already
call fcn.0040e350
add esp, 4
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x433688
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x18], eax
call fcn.0041451a
int3
Function at 0x40df20
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
push str.CFCSafeUpdateService_in_OnStop
push 0x430000
mov esi, ecx
call fcn.0040e350
add esp, 8
lea eax, [esi + 4]
xor ebx, ebx
push eax
push ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], eax
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov edi, eax
cmp edi, ebx
je 0x40df8b
mov eax, dword [esp + 0xc]
push ebx
lea ecx, [esp + 0x14]
push ecx
push ebx
push 2
push ebx
push ebx
push ebx
push 4
push edi
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], str.CFCSafeUpdateService_in_OnStop
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push edi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
push str.begin_share_memory_UNinitialize
call fcn.0040e350
mov eax, dword [esi + 0x838]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 4
cmp eax, ebx
je 0x40dfb1
push eax
call edi
mov dword [esi + 0x838], ebx
mov eax, dword [esi + 0x83c]
cmp eax, ebx
je 0x40dfc8
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [esi + 0x83c], ebx
mov eax, dword [esi + 0x834]
cmp eax, ebx
je 0x40dfdb
push eax
call edi
mov dword [esi + 0x834], ebx
mov eax, dword [esi + 0x840]
cmp eax, ebx
je 0x40dfee
push eax
call edi
mov dword [esi + 0x840], ebx
mov eax, dword [esi + 0x844]
cmp eax, ebx
je 0x40e001
push eax
call edi
mov dword [esi + 0x844], ebx
mov dword [esi + 0x830], ebx
push str.End_share_memory_UNinitialize
mov dword [esi + 0x85c], ebx
mov dword [esi + 0x860], ebx
call fcn.0040e350
add esp, 4
push str.CFCSafeUpdateService_wait_ServerThread_exit
mov dword [esi + 0x824], 1
call fcn.0040e350
mov edx, dword [esi + 0x828]
add esp, 4
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x40e0b2
push str.CFCSafeUpdateService_wait___20_s
push 0x430000
call fcn.0040e350
mov edi, dword [esp + 0x14]
add esp, 8
push edi
push ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
cmp esi, ebx
je 0x40e09e
push ebx
lea eax, [esp + 0x14]
push eax
push ebx
push 2
push ebx
push ebx
push ebx
push 4
push esi
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], str.CFCSafeUpdateService_wait___20_s
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CFCSafeUpdateService_wait_stop_failure_error:_d
call fcn.0040e350
add esp, 8
push str.CFCSafeUpdateService_OnStop_end
call fcn.0040e350
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40ed50
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
push ebx
push 0x430000
call fcn.0040e350
mov edi, dword [ebp + 8]
add esp, 8
xor eax, eax
add edi, 4
push edi
push eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x40edaa
mov ecx, dword [ebp + 0xc]
push 0
lea eax, [ebp - 8]
push eax
push 0
push 2
push 0
push 0
push 0
push ecx
push esi
mov dword [ebp - 8], edi
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x40edc0
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4363e4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
push ecx
push eax
mov edi, edx
push str._s_failed_w_err_0x_08lx
lea edx, [ebp - 0x20c]
call fcn.0040ee70
lea edx, [ebp - 0x20c]
push edx
push 0x430000
call fcn.0040e350
add esp, 0x14
add edi, 4
push edi
push 0
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x210], 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x40ee5b
push 0
lea ecx, [ebp - 0x214]
push ecx
push 0
push 2
push 0
push 0
push 0
push 1
lea eax, [ebp - 0x20c]
push esi
mov dword [ebp - 0x214], edi
mov dword [ebp - 0x210], eax
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00412be7
mov esp, ebp
pop ebp
ret 4
Function at 0x40f120
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push 0xf003f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
jne 0x40f15b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x430220
call fcn.0040e350
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.ADVAPI32.dll_LockServiceDatabase]
mov dword [ebp - 8], eax
test eax, eax
je 0x40f1e0
push 2
push str.FoxitCloudUpdateService
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
jne 0x40f1a1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenService_failed_w_err_0x_08lx_n
call fcn.0040e350
add esp, 8
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 4]
push eax
push 1
push edi
mov dword [ebp - 4], str.Provide_service_for_Foxit_Cloud_products__once_to_stop_the_service__is_likely_to_affect_your_Foxit_Cloud_product_safety.
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
mov ebx, eax
test ebx, ebx
jne 0x40f1cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ChangeServiceConfig2_failed_w_err_0x_08lx_n
call fcn.0040e350
add esp, 8
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_UnlockServiceDatabase]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40f230
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4363e4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20e]
push ecx
mov word [ebp - 0x210], ax
call fcn.00420700
add esp, 0xc
push 0x104
lea edx, [ebp - 0x210]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x40f29f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetModuleFileName_failed_w_err_0x_08lx_n
call fcn.0040e350
add esp, 8
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00412be7
mov esp, ebp
pop ebp
ret
push 3
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x40f2d5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x430220
call fcn.0040e350
add esp, 8
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00412be7
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0x42ffb4
push 0
push 0
lea eax, [ebp - 0x210]
push eax
push 1
push 3
push 0x110
push 0xf01ff
push 0x42fcb0
push str.FoxitCloudUpdateService
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov esi, eax
test esi, esi
jne 0x40f31c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateService_failed_w_err_0x_08lx_n
jmp 0x40f326
push str.FoxitCloudUpdateService
push str._s_is_installed._n
call fcn.0040e350
add esp, 8
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
test esi, esi
je 0x40f33e
push esi
call edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00412be7
mov esp, ebp
pop ebp
ret
Function at 0x40f350
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4363e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
push esi
push edi
push 1
push eax
push eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
mov dword [ebp - 0x24], edi
test edi, edi
jne 0x40f3b2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x430220
call fcn.0040e350
add esp, 8
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00412be7
mov esp, ebp
pop ebp
ret
push 0x10124
push str.FoxitCloudUpdateService
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x40f3da
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenService_failed_w_err_0x_08lx_n
jmp 0x40f48a
lea eax, [ebp - 0x20]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x40f467
push str.FoxitCloudUpdateService
push str.Stopping__s.
call fcn.0040e350
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 8
push 0x3e8
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea ecx, [ebp - 0x20]
push ecx
push esi
call ebx
test eax, eax
je 0x40f445
jmp 0x40f420
cmp dword [ebp - 0x1c], 3
jne 0x40f445
push 0x4305b0
call fcn.0040e350
add esp, 4
push 0x3e8
call edi
lea edx, [ebp - 0x20]
push edx
push esi
call ebx
test eax, eax
jne 0x40f420
cmp dword [ebp - 0x1c], 1
push str.FoxitCloudUpdateService
jne 0x40f457
push 0x4305b4
jmp 0x40f45c
push str._n_s_failed_to_stop._n
call fcn.0040e350
mov edi, dword [ebp - 0x24]
add esp, 8
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x40f480
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.DeleteService_failed_w_err_0x_08lx_n
jmp 0x40f48a
push str.FoxitCloudUpdateService
push str._s_is_removed._n
call fcn.0040e350
add esp, 8
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
test esi, esi
je 0x40f4a2
push esi
call edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00412be7
mov esp, ebp
pop ebp
ret
Function at 0x411520
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x4363e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push 2
mov edi, ecx
mov dword [ebp - 0x240], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0x41157c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.TraverseProcessID_CreateToolhelp32Snapshot_failure:_d
call fcn.0040e350
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00412be7
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x238]
push eax
push esi
mov dword [ebp - 0x238], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x4115cc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.TraverseProcessID_Process32First_failure:_d
call fcn.0040e350
add esp, 8
test esi, esi
je 0x4115b7
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00412be7
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x214]
push edi
push ecx
call fcn.00413ad3
add esp, 8
test eax, eax
jne 0x41161f
lea edx, [ebp - 0x23c]
mov dword [ebp - 0x23c], eax
mov eax, dword [ebp - 0x230]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x41160f
mov ecx, dword [ebp + 8]
cmp dword [ebp - 0x23c], ecx
je 0x411657
call ebx
push eax
push str.TraverseProcessID_ProcessIdToSessionId_failure:_d
call fcn.0040e350
add esp, 8
lea edx, [ebp - 0x238]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x4115d2
mov edi, dword [ebp - 0x240]
test esi, esi
je 0x411642
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00412be7
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x230]
jmp 0x411637
Function at 0x411870
Capabilities:
Create directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x4363e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
mov esi, ecx
push eax
lea ecx, [ebp - 0x40e]
push ecx
mov word [ebp - 0x410], ax
call fcn.00420700
add esp, 0xc
xor edx, edx
push 0x1fe
push edx
lea eax, [ebp - 0x206]
push eax
mov word [ebp - 0x208], dx
call fcn.00420700
add esp, 0xc
call fcn.00411780
test eax, eax
je 0x4118e3
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00412be7
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x410]
mov eax, esi
sub edx, esi
lea ecx, [ecx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4118f0
lea eax, [ebp - 0x410]
lea edx, [eax + 2]
jmp 0x411910
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x411910
sub eax, edx
sar eax, 1
lea ecx, [ebp + eax*2 - 0x412]
movzx eax, word [ecx]
mov edx, 0x2f2f
cmp ax, dx
je 0x411938
cmp eax, 0x2f
jne 0x411940
mov eax, 0x2f30
mov word [ecx], ax
lea eax, [ebp - 0x410]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x411950
sub eax, edx
push 0x100
sar eax, 1
lea ecx, [ebp - 0x208]
mov esi, eax
push 0
push ecx
mov dword [ebp - 0x418], esi
call fcn.00420700
add esp, 0xc
xor ebx, ebx
test esi, esi
jle 0x411a89
xor edx, edx
mov word [ebp - 0x412], dx
movzx eax, word [ebp + ebx*2 - 0x410]
mov ecx, 0x2f2f
cmp ax, cx
je 0x4119de
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x414]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4119b1
lea edi, [ebp - 0x208]
sub eax, edx
add edi, 0xfffffffe
jmp 0x4119d0
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x4119d0
jmp 0x411a3c
push 0
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x411a03
push 0x80
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, 0x2f2f
lea eax, [ebp - 0x414]
mov word [ebp - 0x414], cx
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x411a17
lea edi, [ebp - 0x208]
sub eax, edx
add edi, 0xfffffffe
lea ecx, [ecx]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x411a30
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebp - 0x418]
and ecx, 3
dec eax
rep movsb byte es:[edi], byte [esi]
cmp ebx, eax
jne 0x411a7c
push 0
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x411a7c
push 0x80
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
inc ebx
cmp ebx, dword [ebp - 0x418]
jl 0x411990
lea esi, [ebp - 0x208]
call fcn.00411780
mov ecx, dword [ebp - 4]
neg eax
pop edi
sbb eax, eax
pop esi
xor ecx, ebp
neg eax
pop ebx
call fcn.00412be7
mov esp, ebp
pop ebp
ret
Function at 0x411fb0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x460
mov eax, dword [0x4363e4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
lea edx, [ebp - 0x210]
push edi
mov eax, esi
sub edx, esi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x411fd1
lea eax, [ebp - 0x210]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x411ff0
sub eax, edx
sar eax, 1
lea ecx, [ebp + eax*2 - 0x212]
movzx eax, word [ecx]
mov edx, 0x2f2f
cmp ax, dx
je 0x412018
cmp eax, 0x2f
jne 0x412020
mov eax, 0x2f30
mov word [ecx], ax
lea ecx, [ebp - 0x460]
push ecx
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x41204d
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00412be7
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x460], 0x10
jne 0x41205a
xor esi, esi
jmp 0x412063
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00412be7
mov esp, ebp
pop ebp
ret

Function at 0x412be7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4363e4]
jne 0x412bf1
repz ret
jmp fcn.00417422
Function at 0x423b4c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4363e4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00418bb3
and dword [ebp - 0x14], 0
cmp dword [0x438934], 0
mov dword [ebp - 0x18], eax
jne 0x423bff
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x423ca7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x423ca7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x438934], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x438938], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x43893c], eax
call edi
push eax
call esi
mov dword [0x438944], eax
test eax, eax
je 0x423bff
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x438940], eax
mov eax, dword [0x438940]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x423c58
cmp dword [0x438944], ecx
je 0x423c58
push eax
call esi
push dword [0x438944]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x423c58
test ebx, ebx
je 0x423c58
call edi
test eax, eax
je 0x423c4f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x423c4f
test byte [ebp - 8], 1
jne 0x423c58
or dword [ebp + 0x10], 0x200000
jmp 0x423c8b
mov eax, dword [0x438938]
cmp eax, dword [ebp - 0x18]
je 0x423c8b
push eax
call esi
test eax, eax
je 0x423c8b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x423c8b
mov eax, dword [0x43893c]
cmp eax, dword [ebp - 0x18]
je 0x423c8b
push eax
call esi
test eax, eax
je 0x423c8b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x438934]
call esi
test eax, eax
je 0x423ca7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x423ca9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00412be7
leave
ret