joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f5b0
Capabilities:
Enumerate process modules
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x914
mov eax, dword [0x504070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
mov ebx, eax
lea eax, [ebp - 0x90c]
push eax
push 0x400
lea eax, [ebp - 0x508]
push eax
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
call fcn.0040b1d0
xor edi, edi
test dword [ebp - 0x90c], 0xfffffffc
jbe 0x40f6b0
nop
mov eax, dword [ebp + edi*4 - 0x508]
cmp eax, ebx
je 0x40f69e
push eax
push 0
push 0x411
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov esi, eax
test esi, esi
je 0x40f69e
lea eax, [ebp - 0x910]
push eax
push 0x400
lea eax, [ebp - 0x908]
push eax
push esi
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x40f697
push 0x80
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x908]
push esi
call dword [sym.imp.PSAPI.DLL_GetModuleBaseNameW]
lea eax, [ebp - 0x108]
push 0x80
push eax
call fcn.00435cb4
lea eax, [ebp - 0x108]
push str.vksaver.exe
push eax
call fcn.0042ec01
add esp, 0x10
test eax, eax
je 0x40f697
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [ebp - 0x90c]
inc edi
shr eax, 2
cmp edi, eax
jb 0x40f600
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042cc9c
mov esp, ebp
pop ebp
ret

Function at 0x40f6d0
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x504070]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x100
lea eax, [ebp - 0x204]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
push 0x38
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x240], 0x3c
push 0
push eax
call fcn.0042fec0
add esp, 0xc
mov dword [ebp - 0x23c], 0x140
lea eax, [ebp - 0x204]
mov dword [ebp - 0x234], str.runas
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x238], 0
call dword [sym.imp.KERNEL32.DLL_GetCommandLineW]
movzx ecx, word [eax]
cmp ecx, 0x22
jne 0x40f7a9
nop dword [eax]
add eax, 2
cmp cx, 0x22
je 0x40f763
movzx ecx, word [eax]
test cx, cx
jne 0x40f750
jmp 0x40f76c
cmp word [eax], 0x20
jne 0x40f76c
add eax, 2
xor ecx, ecx
cmp word [eax], cx
mov dword [ebp - 0x224], 1
cmovne ecx, eax
lea eax, [ebp - 0x240]
push eax
mov dword [ebp - 0x22c], ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp dword [ebp - 0x220], 0x20
mov ecx, dword [ebp - 4]
seta al
xor ecx, ebp
call fcn.0042cc9c
mov esp, ebp
pop ebp
ret
test cx, cx
je 0x40f76c
nop
cmp cx, 0x20
je 0x40f769
movzx ecx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x40f7b0
jmp 0x40f76c
Function at 0x40f7d0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa3c
mov eax, dword [0x504070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0xa3c], ecx
test edi, edi
je 0x40f8d0
call fcn.0040b1d0
push 0
push 2
mov esi, 1
mov dword [ebp - 0x808], edi
call dword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
push 0x228
mov ebx, eax
lea eax, [ebp - 0xa34]
push 0
push eax
call fcn.0042fec0
add esp, 0xc
mov dword [ebp - 0xa38], 0x22c
lea eax, [ebp - 0xa38]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_Process32FirstW]
test eax, eax
je 0x40f888
nop dword [eax]
nop dword [eax + eax]
mov eax, dword [ebp - 0xa30]
cmp eax, dword [ebp - 0xa3c]
je 0x40f876
cmp edi, dword [ebp - 0xa20]
jne 0x40f876
mov dword [ebp + esi*4 - 0x808], eax
inc esi
cmp esi, 0x200
jae 0x40f888
lea eax, [ebp - 0xa38]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_Process32NextW]
test eax, eax
jne 0x40f850
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor edi, edi
test esi, esi
je 0x40f8d0
nop word [eax + eax]
push dword [ebp + edi*4 - 0x808]
push 0
push 0x411
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40f8cb
push 0
push ebx
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
inc edi
cmp edi, esi
jb 0x40f8a0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042cc9c
mov esp, ebp
pop ebp
ret
Function at 0x410240
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov edx, 0x2130
mov ecx, 0x4f7d50
call fcn.0040ed50
mov edi, eax
mov dword [ebp - 4], 0x2130
push 0x2130
mov edx, edi
mov ecx, 0x527b28
call fcn.0040bc10
add esp, 4
cmp al, 1
je 0x4102c7
mov ecx, 0x527b28
call fcn.0040bad0
test al, al
je 0x410358
push 0
push 0
push 2
push 0
push 1
push 0x40000000
push 0x527b28
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x410358
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push edi
push esi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push edi
call fcn.00432137
add esp, 4
mov edx, 0x5fe00
mov ecx, 0x497f40
call fcn.0040ed50
mov edi, eax
mov dword [ebp - 4], 0x5fe00
push 0x5fe00
mov edx, edi
mov ecx, 0x527d28
call fcn.0040bc10
add esp, 4
cmp al, 1
je 0x410347
mov ecx, 0x527d28
call fcn.0040bad0
test al, al
je 0x410358
push 0
push 0
push 2
push 0
push 1
push 0x40000000
push 0x527d28
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x410358
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push edi
push esi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push edi
call fcn.00432137
add esp, 4
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x410360
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
push 2
push 0
mov edi, edx
call dword [sym.imp.ole32.dll_CoInitializeEx]
lea eax, [ebp - 4]
push eax
push 0x4533d0
push 1
push 0
push 0x4533e0
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
js 0x410407
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
mov dword [ebp - 8], 0
push 0x4533f0
mov edx, dword [ecx]
push ecx
call dword [edx]
cmp dword [ebp - 8], 0
je 0x410407
mov eax, dword [ebp - 4]
push 0x527d28
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, dword [ebp - 4]
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 4]
push dword [ebp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp - 4]
push dword [ebp + 0x10]
push 0x527d28
mov ecx, dword [eax]
push eax
call dword [ecx + 0x44]
mov eax, dword [ebp - 8]
push 1
push dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov esi, eax
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x410420
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x464
mov eax, dword [0x504070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x44
lea eax, [ebp - 0x460]
mov esi, edx
push 0
push eax
call fcn.0042fec0
add esp, 0xc
mov dword [ebp - 0x460], 0x44
lea eax, [ebp - 0x408]
xorps xmm0, xmm0
movups xmmword [ebp - 0x418], xmm0
test esi, esi
je 0x41047e
push esi
push 0x527d28
push str.__s___s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
jmp 0x410492
push 0x527d28
push 0x4fa768
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x460]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x408]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [ebp - 0x418], eax
pop esi
setne al
xor ecx, ebp
call fcn.0042cc9c
mov esp, ebp
pop ebp
ret
Function at 0x4111d0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x504070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
push 2
mov edi, ecx
mov dword [ebp - 0x234], 0
call dword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
push 0x228
mov esi, eax
lea eax, [ebp - 0x22c]
push 0
push eax
call fcn.0042fec0
add esp, 0xc
mov dword [ebp - 0x230], 0x22c
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_Process32FirstW]
test eax, eax
je 0x41125b
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_Process32NextW]
cmp dword [ebp - 0x228], edi
je 0x41124e
lea eax, [ebp - 0x230]
push eax
push esi
call ebx
test eax, eax
jne 0x411236
jmp 0x41125a
mov eax, dword [ebp - 0x218]
mov dword [ebp - 0x234], eax
pop ebx
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x234]
xor ecx, ebp
pop edi
pop esi
call fcn.0042cc9c
mov esp, ebp
pop ebp
ret

Function at 0x411280
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
lea eax, [ebp - 0x10]
mov ebx, ecx
push eax
push ebx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov esi, eax
lea edx, [esi + 4]
push edx
push 1
call fcn.00435b20
add esp, 8
mov edi, eax
push edi
push esi
push 0
push ebx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 4]
push eax
push 0x46028c
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
mov eax, dword [ebp - 4]
test eax, eax
mov edx, dword [ebp - 8]
cmovne edx, eax
mov dword [ebp - 8], edx
mov eax, dword [edx + 8]
mov ecx, eax
shr ecx, 0x10
mov dword [ebp - 0xc], ecx
mov dword [0x5075e8], ecx
mov ecx, dword [edx + 0xc]
mov esi, ecx
movzx ebx, ax
mov edi, ecx
shr esi, 0x19
mov edx, ecx
imul eax, esi, 0x64
shr edi, 0x15
and edi, 0xf
shr edx, 0x10
and edx, 0x1f
movzx ecx, cx
mov dword [0x5075ec], ebx
add eax, edi
mov dword [0x5075f4], ecx
imul eax, eax, 0x64
add eax, edx
mov dword [0x5075f0], eax
lea eax, [esi + 0x7d0]
push eax
push edi
push edx
push ecx
push ebx
push dword [ebp - 0xc]
push 0x4fab48
push 0x527a28
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [ebp - 8]
add esp, 0x20
movzx eax, word [eax + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4113a0
Capabilities:
Create directory
Get common file path

Disassembly:
push 0
push 0x23
push 0x528328
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp word [0x528328], 0
mov eax, 0x528328
je 0x4113c9
add eax, 2
cmp word [eax], 0
jne 0x4113c0
cmp word [eax - 2], 0x5c
je 0x4113d8
mov ecx, 0x5c
mov word [eax], cx
push 0x4fa740
push 0x100
push 0x528328
call fcn.00435aa0
add esp, 0xc
push 0
push 0x528328
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
push 0x528328
push 0x100
push 0x528128
call fcn.00435d47
add esp, 0xc
push 0x100
push 0x527f28
push 0x528128
call dword [sym.imp.KERNEL32.DLL_GetShortPathNameW]
push 0x46028c
push 0x100
push 0x528128
call fcn.00435aa0
push 0x528128
push 0x100
push 0x527d28
call fcn.00435d47
push 0x528128
push 0x100
push 0x527b28
call fcn.00435d47
push str.vksaver3.dll
push 0x100
push 0x528128
call fcn.00435aa0
push str.VKSaver.exe
push 0x100
push 0x527d28
call fcn.00435aa0
push str.config.dat
push 0x100
push 0x527b28
call fcn.00435aa0
add esp, 0x48
push str._vksaver3.dll
push 0x100
push 0x527f28
call fcn.00435aa0
add esp, 0xc
ret

Function at 0x4114c0
Capabilities:
Check os version

Disassembly:
push esi
mov esi, ecx
push str.__vk2kill
push esi
call fcn.0042ec01
movzx edx, byte [0x527624]
test eax, eax
mov ecx, 1
cmovne edx, ecx
push str.__newupdate
push esi
mov byte [0x527624], dl
call fcn.0042ec01
add esp, 0x10
test eax, eax
je 0x411515
call fcn.0040c480
xor dl, dl
xor cl, cl
call fcn.004104e0
xor ecx, ecx
mov edx, 3
test al, al
cmove ecx, edx
mov eax, ecx
pop esi
ret
call fcn.00410f80
test eax, eax
jne 0x41155f
call dword [sym.imp.KERNEL32.DLL_GetVersion]
movzx eax, al
mov dword [0x528528], eax
cmp eax, 6
jb 0x411544
mov ecx, 0x528620
call fcn.004129a0
call fcn.00410a90
xor eax, eax
pop esi
ret
push 0x10
push 0x4fac38
push 0x4fac68
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 5
pop esi
ret
mov ecx, 0x5286b0
call fcn.004129a0
call fcn.0040f5b0
call fcn.00410a90
xor eax, eax
pop esi
ret
Function at 0x411580
Capabilities:
Accept command line arguments
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x5c8
mov eax, dword [0x504070]
xor eax, esp
mov dword [esp + 0x5c4], eax
push esi
push edi
push str.VKSaverInstallerMtx
push 0
push 0x100000
call dword [sym.imp.KERNEL32.DLL_OpenMutexW]
mov dword [0x528530], eax
test eax, eax
je 0x4115fc
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 0
push str.VKSaverInstallWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
test esi, esi
je 0x4115e1
push 1
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0x5c4]
xor ecx, esp
call fcn.0042cc9c
mov esp, ebp
pop ebp
ret 0x10
push str.VKSaverInstallerMtx
push 1
push 0
call dword [sym.imp.KERNEL32.DLL_CreateMutexW]
mov dword [0x528530], eax
lea eax, [esp + 0x38]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x41163f
mov eax, 4
pop edi
pop esi
mov ecx, dword [esp + 0x5c4]
xor ecx, esp
call fcn.0042cc9c
mov esp, ebp
pop ebp
ret 0x10
mov esi, dword [sym.imp.USER32.dll_MessageBoxW]
mov edi, dword [sym.imp.WS2_32.dll_GetAddrInfoW]
nop dword [eax + eax]
lea eax, [esp + 0xc]
xorps xmm0, xmm0
push eax
lea eax, [esp + 0x14]
movaps xmmword [esp + 0x14], xmm0
push eax
push 0x4fab24
push str.audiovk.com
movaps xmmword [esp + 0x30], xmm0
mov dword [esp + 0x24], 2
mov dword [esp + 0x28], 2
mov dword [esp + 0x2c], 0x11
call edi
test eax, eax
je 0x4116ba
push 0x25
push 0x4fad14
push 0x4fad48
push 0
call esi
cmp eax, 2
jne 0x411650
pop edi
pop esi
mov ecx, dword [esp + 0x5c4]
xor ecx, esp
call fcn.0042cc9c
mov esp, ebp
pop ebp
ret 0x10
push dword [esp + 0xc]
call dword [sym.imp.WS2_32.dll_FreeAddrInfoW]
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
mov esi, eax
mov ecx, esi
call fcn.004111d0
mov edi, eax
lea eax, [esp + 0x1c8]
push 0x200
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
lea ecx, [esp + 0x1c8]
call fcn.00411280
lea ecx, [esp + 0x1c8]
call fcn.00411360
mov ecx, edi
mov dword [esp + 0xc], eax
call fcn.00410d40
test al, al
je 0x411724
push str.vksaver_install
push dword [esp + 0x10]
call fcn.00435696
add esp, 8
jmp 0x41172d
mov edx, edi
mov ecx, esi
call fcn.0040f7d0
mov eax, dword [ebp + 8]
mov dword [0x528534], eax
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push 2
push 0
mov dword [0x5275f8], eax
call dword [sym.imp.ole32.dll_CoInitializeEx]
call fcn.004113a0
call dword [sym.imp.KERNEL32.DLL_GetCommandLineW]
mov ecx, eax
call fcn.004114c0
test eax, eax
jne 0x41176d
call fcn.0040fa10
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
mov ecx, dword [esp + 0x5cc]
pop edi
pop esi
xor ecx, esp
call fcn.0042cc9c
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4129a0
Capabilities:
Hide graphical window

Disassembly:
test ecx, ecx
je 0x4129f2
cmp ecx, dword [0x528538]
je 0x4129f2
push esi
push edi
mov edi, dword [0x528610]
mov dword [0x528538], ecx
mov esi, dword [edi]
cmp esi, edi
je 0x4129d5
push ebx
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [esi + 8]
call ebx
mov esi, dword [esi]
cmp esi, edi
jne 0x4129c7
pop ebx
call fcn.004119f0
mov eax, dword [0x52852c]
pop edi
pop esi
test eax, eax
je 0x4129f2
push 5
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_RedrawWindow]
ret

Function at 0x414850
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_EnableWindow]
push edi
mov edi, ecx
push 0
push dword [edi + 0xc]
call esi
push 0x4fbd7c
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea eax, [ebp - 8]
mov byte [0x527626], 1
push eax
push 0
push 0x528548
push 0x40c010
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
push 0
push dword [edi + 4]
call esi
mov eax, dword [edi + 8]
mov esi, dword [0x528850]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push dword [esi + 4]
push esi
call fcn.0040eb00
mov edx, dword [0x528854]
mov ecx, 0x15555554
sub ecx, edx
mov ebx, eax
cmp ecx, 1
jb 0x414950
inc edx
mov dword [0x528854], edx
mov dword [esi + 4], ebx
mov eax, dword [ebx + 4]
push 5
mov dword [eax], ebx
push dword [edi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
movsd xmm1, qword [0x504a10]
movsd xmm2, qword [0x504a18]
movaps xmm0, xmm1
mulsd xmm0, qword [0x4fc298]
push 1
mulsd xmm1, qword [0x4fc2b0]
cvttsd2si eax, xmm0
movaps xmm0, xmm2
mulsd xmm2, qword [0x4fc1f8]
push eax
mulsd xmm0, qword [0x4fc3d0]
mulsd xmm2, qword [0x4fc208]
cvttsd2si eax, xmm0
push eax
cvttsd2si eax, xmm1
push eax
cvttsd2si eax, xmm2
push eax
push dword [edi]
call dword [sym.imp.USER32.dll_MoveWindow]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.list_T__too_long
call fcn.004171e5
int3

Function at 0x415f90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov byte [0x5075e2], 0
mov edi, ecx
mov byte [0x5075e1], 0
call fcn.00403350
mov ecx, dword [0x5075e4]
call fcn.0040f430
call fcn.0040f5b0
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x4107e0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
push 0
push dword [edi + 4]
mov byte [0x527625], 0
mov byte [0x5075e3], 0
call dword [sym.imp.USER32.dll_EnableWindow]
push 0
push dword [edi + 8]
call dword [sym.imp.USER32.dll_EnableWindow]
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x4160c0
Capabilities:
Enumerate gui resources
Get graphical window text

Disassembly:
push esi
mov esi, ecx
call fcn.00403170
mov edx, dword [esi + 4]
pop esi
jmp fcn.0040ee30

Function at 0x44030f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044018e

Function at 0x447e31
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00447af1
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x4f3a6b4b
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
je 0x4300d2
nop
nop
nop
nop
nop
mov ebx, 0x42e3d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x199f7567
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x10012be0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10066c9c
mov eax, dword fs:[0]
push eax
sub esp, 0x268
mov eax, dword [0x1009e118]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1d0], ecx
mov ecx, dword [ebp - 0x1d0]
call fcn.10001a30
mov dword [ebp - 4], 0
push 0xb8
lea ecx, [ebp - 0x1cc]
call fcn.100022b0
push 1
push 0x40
push 1
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x1cc]
call fcn.100126a0
mov byte [ebp - 4], 1
push 0x104
push 0
lea ecx, [ebp - 0x114]
push ecx
call fcn.1004b350
add esp, 0xc
mov edx, dword [ebp - 0x1cc]
mov eax, dword [edx + 4]
lea ecx, [ebp + eax - 0x1cc]
call fcn.10011090
movzx ecx, al
test ecx, ecx
jne 0x10012cf8
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0x1f0], esp
push 0x10069890
mov edx, dword [ebp + 8]
push edx
push str.File_doesnt_exists__
lea eax, [ebp - 0x208]
push eax
call fcn.10011ce0
add esp, 0xc
mov dword [ebp - 0x1d4], eax
mov ecx, dword [ebp - 0x1d4]
mov dword [ebp - 0x1d8], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x1d8]
push edx
push esi
call fcn.10007bb0
add esp, 0xc
lea ecx, [ebp - 0x274]
call fcn.10012e90
push 0x1009b4dc
lea eax, [ebp - 0x274]
push eax
call fcn.10049273
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x208]
call fcn.10001c80
lea ecx, [ebp - 0x114]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov edx, dword [ebp + 8]
push edx
push 0x100698ac
lea ecx, [ebp - 0x250]
call fcn.100064d0
mov dword [ebp - 0x1dc], eax
mov eax, dword [ebp - 0x1dc]
mov dword [ebp - 0x1e0], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x1e0]
push ecx
lea edx, [ebp - 0x114]
push edx
lea eax, [ebp - 0x238]
push eax
call fcn.10007c70
add esp, 0xc
mov dword [ebp - 0x1e4], eax
mov ecx, dword [ebp - 0x1e4]
mov dword [ebp - 0x1e8], ecx
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x1e8]
push edx
lea eax, [ebp - 0x220]
push eax
call fcn.10011cb0
add esp, 0xc
mov dword [ebp - 0x1ec], eax
mov ecx, dword [ebp - 0x1ec]
push ecx
mov ecx, dword [ebp - 0x1d0]
call fcn.1000b650
lea ecx, [ebp - 0x220]
call fcn.10001c80
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x238]
call fcn.10001c80
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x250]
call fcn.10001c80
lea ecx, [ebp - 0x1cc]
call fcn.100148d0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1cc]
call fcn.10013430
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1d0]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10047e30
mov esp, ebp
pop ebp
ret 4
Function at 0x10013e10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x1009e118]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
cmp dword [eax + 0x38], 0
je 0x10013e37
mov ecx, dword [ebp - 0x30]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x10013e3e
mov al, 1
jmp 0x10013f29
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x44], edx
call fcn.10002660
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
push eax
mov ecx, dword [ebp - 0x30]
call dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
call fcn.10002660
mov dword [ebp - 0x4c], eax
lea ecx, [ebp - 0x48]
push ecx
lea edx, [ebp - 0x4c]
push edx
call fcn.10010d30
add esp, 8
movzx eax, al
test eax, eax
je 0x10013e84
xor al, al
jmp 0x10013f29
mov dword [ebp - 0x54], 0x20
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 0x38]
mov dword [ebp - 0x50], edx
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x28]
push edx
mov eax, dword [ebp - 0x30]
add eax, 0x40
push eax
mov ecx, dword [ebp - 0x50]
call fcn.10015a10
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x10013ec6
cmp dword [ebp - 0x34], 1
je 0x10013ecd
cmp dword [ebp - 0x34], 3
je 0x10013f1c
jmp 0x10013f27
mov ecx, dword [ebp - 0x30]
mov byte [ecx + 0x3d], 0
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
sub edx, eax
mov dword [ebp - 0x38], edx
je 0x10013efc
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 0x4c]
push edx
mov eax, dword [ebp - 0x38]
push eax
push 1
lea ecx, [ebp - 0x28]
push ecx
call fcn.1004e3fc
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x10013efc
xor al, al
jmp 0x10013f29
mov edx, dword [ebp - 0x30]
movzx eax, byte [edx + 0x3d]
test eax, eax
jne 0x10013f10
mov dword [ebp - 0x3c], 1
jmp 0x10013f17
mov dword [ebp - 0x3c], 0
mov al, byte [ebp - 0x3c]
jmp 0x10013f29
mov ecx, dword [ebp - 0x30]
mov byte [ecx + 0x3d], 0
mov al, 1
jmp 0x10013f29
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10047e30
mov esp, ebp
pop ebp
ret