joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402519
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
lea eax, [ebp - 0xc]
push 0x8000
lea ecx, [edi + 0x58]
push eax
call fcn.0048a019
mov eax, dword [eax]
lea ecx, [ebp - 0xc]
mov esi, dword [eax - 8]
call fcn.004038fb
cmp esi, 2
jle 0x402607
lea esi, [ebp + 8]
lea eax, [ebp + 0xc]
neg esi
sbb esi, esi
lea ecx, [edi + 0x58]
and esi, eax
lea ebx, [edi + 0x5c]
neg ecx
mov eax, dword [esi]
sbb ecx, ecx
push eax
and ecx, ebx
mov ecx, dword [ecx]
push ecx
call fcn.0048a0e7
pop ecx
test al, al
pop ecx
jne 0x402607
lea eax, [ebp - 0xc]
lea ecx, [ebp + 8]
push eax
call fcn.00489fbf
push 0x4b06b4
lea ecx, [ebp - 8]
call fcn.00403927
push str.ERSTELLE
lea ecx, [ebp - 4]
call fcn.00403927
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00403b20
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00403b20
push dword [eax]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [ebp - 0x10]
call fcn.004038fb
lea ecx, [ebp - 0x14]
call fcn.004038fb
lea ecx, [ebp - 4]
call fcn.004038fb
lea ecx, [ebp - 8]
call fcn.004038fb
mov ecx, ebx
call fcn.00403816
push esi
mov ecx, ebx
call fcn.00404359
lea eax, [edi + 0x58]
mov ecx, edi
push eax
call fcn.00402616
lea ecx, [ebp - 0xc]
call fcn.004038fb
lea ecx, [ebp + 8]
call fcn.0048996a
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x402616
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x74], edi
je 0x4027fa
cmp dword [esi + 0x70], edi
mov dword [esi + 0x54], edi
je 0x4027fa
mov eax, dword [esi + 0x6c]
cmp eax, edi
je 0x4027fa
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
lea ebx, [esi + 0x58]
mov dword [ebp - 8], edi
mov eax, ebx
neg eax
lea ecx, [ebx + 4]
sbb eax, eax
and eax, ecx
lea ecx, [ebp - 0x18]
push eax
call fcn.00404359
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x18]
neg eax
sbb eax, eax
mov dword [ebp - 0x1c], 0x4aa998
and eax, ecx
mov ecx, esi
push dword [eax]
lea eax, [ebp - 8]
push eax
call fcn.00402405
cmp dword [ebp - 8], edi
je 0x4027f2
push str.________________________:
lea ecx, [ebp - 4]
mov dword [esi + 0x54], edi
mov dword [ebp - 0xc], edi
call fcn.00403927
lea eax, [ebp - 0x14]
push 0x8000
push eax
mov ecx, ebx
call fcn.0048a019
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00403b20
push dword [eax]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [ebp - 0x10]
call fcn.004038fb
lea ecx, [ebp - 0x14]
call fcn.004038fb
lea ecx, [ebp - 4]
call fcn.004038fb
cmp dword [esi + 0x50], 3
je 0x4027cf
mov eax, ebx
add ebx, 4
push ecx
push ecx
neg eax
sbb eax, eax
mov edi, esp
and eax, ebx
push eax
lea ecx, [edi + 4]
call fcn.00404359
lea eax, [ebp - 4]
mov dword [edi], 0x4aa998
push eax
call fcn.0049260d
add esp, 0xc
lea ecx, [ebp - 0x14]
push str.image
call fcn.00403927
mov eax, dword [eax]
xor edi, edi
push edi
push eax
lea ecx, [ebp - 4]
call fcn.00403d34
mov ebx, eax
lea ecx, [ebp - 0x14]
neg ebx
sbb bl, bl
inc bl
call fcn.004038fb
test bl, bl
jne 0x4027a3
push str.video
lea ecx, [ebp - 0x10]
call fcn.00403927
mov eax, dword [eax]
push edi
push eax
lea ecx, [ebp - 4]
call fcn.00403d34
test eax, eax
je 0x40278a
push str.audio
lea ecx, [ebp - 0x14]
call fcn.00403927
mov eax, dword [eax]
push edi
push eax
lea ecx, [ebp - 4]
call fcn.00403d34
mov ebx, eax
lea ecx, [ebp - 0x14]
neg ebx
sbb bl, bl
inc bl
call fcn.004038fb
test bl, bl
je 0x40278c
mov bl, 1
lea ecx, [ebp - 0x10]
call fcn.004038fb
test bl, bl
jne 0x4027a3
push 1
pop eax
mov dword [ebp - 0xc], eax
mov dword [esi + 0x54], eax
jmp 0x4027a6
push 1
pop eax
cmp dword [esi + 0x54], edi
jne 0x4027c5
cmp dword [esi + 0x40], edi
je 0x4027c5
lea ecx, [ebp - 4]
mov dword [ebp - 0xc], eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x40], edi
call fcn.004038fb
xor edi, edi
jmp 0x4027d5
lea ecx, [ebp - 4]
call fcn.004038fb
xor edi, edi
mov eax, dword [esi + 0x54]
mov dword [esi + 0x40], eax
mov eax, dword [esi + 0x6c]
push dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
cmp dword [ebp - 0xc], edi
jne 0x4027f2
mov esi, dword [esi + 0x70]
push 5
push edi
push esi
mov eax, dword [esi]
call dword [eax + 0x3c]
lea ecx, [ebp - 0x1c]
call fcn.0048996a
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x404562
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea ecx, [ebp - 0x18]
call fcn.00424d0a
lea eax, [ebp + 8]
lea ecx, [ebp - 0x18]
push eax
call fcn.00424d32
lea ecx, [ebp - 0x18]
call fcn.00424d58
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4045f2
push ebx
push esi
push edi
call dword [sym.imp.USER32.dll_EmptyClipboard]
lea ecx, [ebp - 0x18]
call fcn.00424e27
push eax
push 0x2042
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea ecx, [ebp - 0x18]
mov ebx, eax
call fcn.00424e27
lea ecx, [ebp - 0x18]
mov edi, eax
call fcn.00424e23
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 4], edi
mov edi, eax
mov eax, dword [ebp - 4]
push ebx
mov ecx, eax
push 0xf
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
pop ebx
lea ecx, [ebp - 0x18]
call fcn.00424d1d
lea ecx, [ebp + 8]
call fcn.004038fb
leave
ret

Function at 0x40485c
Capabilities:
Check os version

Disassembly:
cmp dword [0x4bd880], 0
push esi
push edi
jne 0x4048d6
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0x45
mov edx, 0x4bd740
pop ecx
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
push edx
mov dword [0x4bd740], 0x114
call esi
mov ecx, dword [0x4bd744]
movzx edx, word [0x4bd748]
movzx eax, cx
shl eax, 0x10
or eax, edx
cmp ecx, 5
mov dword [0x4bd880], eax
jb 0x4048d6
push 0x47
mov edx, 0x4bd620
pop ecx
xor eax, eax
mov edi, edx
push edx
rep stosd dword es:[edi], eax
mov dword [0x4bd620], 0x11c
call esi
mov eax, dword [0x4bd624]
mov dword [0x4bd744], eax
mov eax, dword [0x4bd628]
mov dword [0x4bd748], eax
mov edi, dword [esp + 0xc]
cmp dword [edi], 0
je 0x40494a
push dword [0x4bd748]
push dword [0x4bd744]
push str.Windows__d._d
push edi
call fcn.00403d66
mov eax, dword [0x4bd750]
add esp, 0x10
cmp eax, 2
jne 0x40490a
mov esi, str._Win32_NT
jmp 0x404924
cmp eax, 1
jne 0x404916
mov esi, str._Win32_WINDOWS
jmp 0x404924
test eax, eax
mov esi, str._Win32s
je 0x404924
mov esi, str._Unbekannt
mov eax, esi
test eax, eax
je 0x404931
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push eax
mov ecx, edi
call fcn.00403bd8
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40494a
mov ecx, dword [0x4bd750]
mov dword [eax], ecx
mov eax, dword [0x4bd880]
pop edi
pop esi
ret
Function at 0x405c0c
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push esi
push edi
push 0x2001f
push dword [ebp + 8]
mov ebx, ecx
xor esi, esi
lea ecx, [ebp - 4]
push dword [ebx]
mov dword [ebp - 4], esi
call fcn.00405cf0
mov edi, eax
cmp edi, esi
je 0x405c4c
cmp dword [ebp - 4], esi
je 0x405c45
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x405ce9
lea eax, [ebp - 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push eax
push esi
push esi
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0x214]
mov dword [ebp - 8], 0x100
push eax
push esi
push dword [ebp - 4]
call edi
test eax, eax
jne 0x405cbd
lea eax, [ebp - 0x214]
lea ecx, [ebp - 4]
push eax
call fcn.00405c0c
cmp eax, esi
mov dword [ebp - 0xc], eax
jne 0x405caa
lea eax, [ebp - 0x14]
mov dword [ebp - 8], 0x100
push eax
push esi
push esi
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0x214]
push eax
push esi
push dword [ebp - 4]
jmp 0x405c6f
cmp dword [ebp - 4], esi
je 0x405cb8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
jmp 0x405ce9
cmp dword [ebp - 4], esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x405cd0
push dword [ebp - 4]
call edi
mov dword [ebp - 4], esi
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp dword [ebp - 4], esi
mov ebx, eax
je 0x405ce7
push dword [ebp - 4]
call edi
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x405d2e
Capabilities:
Create process on windows
Get common file path
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x634
push ebx
push esi
push edi
push str.:RepeatDEL___s_if_exist___s__goto_RepeatDEL___s_
lea ecx, [ebp - 0x10]
call fcn.0040a4e8
push str._selfdestruct.bat
lea eax, [ebp - 0xc]
push 0x4c67d8
push eax
call fcn.0040a915
mov edx, dword [0x4bd5dc]
mov esi, 0x81
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0x428]
mov dword [ebp - 0x42c], edx
rep stosd dword es:[edi], eax
mov ecx, esi
lea edi, [ebp - 0x220]
mov dword [ebp - 0x224], edx
mov dword [ebp - 0x634], edx
rep stosd dword es:[edi], eax
mov ecx, esi
lea edi, [ebp - 0x630]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x224]
mov esi, 0x104
push eax
push esi
call edi
lea eax, [ebp - 0x634]
push eax
push esi
call edi
push dword [ebp - 0xc]
lea eax, [ebp - 0x224]
push eax
call fcn.0049d3f2
pop ecx
lea eax, [ebp - 0x42c]
pop ecx
xor ebx, ebx
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push ecx
lea eax, [ebp - 0x42c]
mov ecx, esp
push eax
call fcn.0040a4e8
lea eax, [ebp - 8]
push eax
call fcn.00485b5a
pop ecx
lea eax, [ebp - 0x224]
pop ecx
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x14], eax
je 0x405ec8
push dword [ebp - 0xc]
mov eax, dword [0x4b0550]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push dword [ebp - 8]
push dword [ebp - 8]
push dword [ebp - 0x10]
push eax
call fcn.00403d66
add esp, 0x14
lea ecx, [ebp - 4]
push 0x4b0cdc
push 0x4b0cd4
call fcn.004040f7
mov eax, dword [ebp - 4]
invalid
Function at 0x4061a9
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
mov esi, ecx
push edi
push 0x4bd5dc
lea ecx, [ebp - 8]
call fcn.0040a4e8
lea ecx, [ebp - 0x48]
call fcn.00497925
push 0x104
push 0x400
lea ecx, [ebp - 0x40]
call fcn.00403c58
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, 0x3ea
push eax
push ebx
push dword [esi + 4]
call edi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x40]
call fcn.00403cd2
push ecx
lea eax, [ebp - 0x40]
mov ecx, esp
push eax
call fcn.004038b5
lea eax, [ebp - 0xc]
push eax
call fcn.004604b6
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x40]
call fcn.00403a8c
lea ecx, [ebp - 0xc]
call fcn.004038fb
lea eax, [ebp - 8]
push eax
push 1
push ecx
mov ecx, esp
push 0x4bd5d8
call fcn.0040a4e8
push dword [esi + 4]
lea ecx, [ebp - 0x48]
call fcn.00497b92
test eax, eax
jne 0x40624c
xor esi, esi
jmp 0x4062c7
push dword [esi + 0x30]
mov eax, dword [0x4b0550]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push dword [ebp - 8]
push str._s_s
push eax
call fcn.00403d66
lea eax, [ebp - 4]
push eax
call fcn.004602be
add esp, 0x14
push ebx
push dword [esi + 4]
call edi
push dword [ebp - 4]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
xor ebx, ebx
push ebx
push ebx
push 0x146
push edi
call esi
push ebx
lea ecx, [ebp - 4]
mov dword [ebp - 0xc], eax
call fcn.00403c58
push eax
push dword [ebp - 0xc]
push 0x14a
push edi
call esi
push ebx
push dword [ebp - 0xc]
push 0x14e
push edi
call esi
lea ecx, [ebp - 4]
call fcn.004038fb
push 1
pop esi
lea ecx, [ebp - 0x48]
call fcn.00497962
lea ecx, [ebp - 8]
call fcn.004038fb
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x407c00
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, ecx
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push dword [esp + 0xc]
push 1
push 0
push dword [esp + 0x1c]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop esi
ret 8

Function at 0x407c2a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 0xc], 0
push ebx
push esi
lea eax, [ebp + 0xc]
push edi
mov edi, ecx
push eax
je 0x407c90
mov ebx, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
push 0xb
push dword [ebp + 8]
call ebx
mov esi, 0x400
lea ecx, [edi + 0x24]
push esi
mov dword [ebp - 0xc], ecx
call fcn.00403c58
push eax
push dword [ebp + 0xc]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
call ebx
lea ecx, [edi + 0x20]
push esi
mov dword [ebp - 8], ecx
call fcn.00403c58
push eax
push dword [ebp + 0xc]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea eax, [ebp + 0xc]
push eax
push 2
jmp 0x407cdf
mov ebx, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
push 0x16
push dword [ebp + 8]
call ebx
mov esi, 0x400
lea ecx, [edi + 0x24]
push esi
mov dword [ebp - 0xc], ecx
call fcn.00403c58
push eax
push dword [ebp + 0xc]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea eax, [ebp + 0xc]
push eax
push 0x19
push dword [ebp + 8]
call ebx
lea ecx, [edi + 0x20]
push esi
mov dword [ebp - 8], ecx
call fcn.00403c58
push eax
push dword [ebp + 0xc]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea eax, [ebp + 0xc]
push eax
push 0x17
push dword [ebp + 8]
call ebx
lea ecx, [edi + 0x28]
push esi
mov dword [ebp - 4], ecx
call fcn.00403c58
push eax
push dword [ebp + 0xc]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea eax, [ebp + 0xc]
push eax
push 0x1a
push dword [ebp + 8]
call ebx
add edi, 0x2c
push esi
mov ecx, edi
call fcn.00403c58
push eax
push dword [ebp + 0xc]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov ecx, dword [ebp - 4]
or esi, 0xffffffff
push esi
call fcn.00403cd2
mov ecx, dword [ebp - 8]
push esi
call fcn.00403cd2
mov ecx, dword [ebp - 0xc]
push esi
call fcn.00403cd2
push esi
mov ecx, edi
call fcn.00403cd2
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x407e8a
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4b8
push ebx
push esi
push edi
mov ebx, ecx
push 0x4b2
mov dword [ebp - 0x38], 6
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
xor edi, edi
push edi
push edi
push pe_nt_image_headers32
push eax
call esi
push eax
mov ecx, ebx
push dword [ebx + 4]
mov dword [ebx + 0x1c], eax
call fcn.00407c2a
push edi
push edi
push 0x101c
push dword [ebp + 8]
call esi
push edi
push edi
push 0x1009
push dword [ebp + 8]
call esi
mov eax, dword [0x4bd5dc]
push dword [ebx + 0x28]
mov dword [ebp - 0x4b8], eax
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x4b4]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x4b8]
push str._s.
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0x10]
xor edi, edi
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], 0x4bd5dc
mov dword [ebp - 0x28], 0x100
sub eax, 0x14
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x38]
push eax
push edi
push 0x1061
push dword [ebp + 8]
call esi
lea eax, [ebp - 0x2b0]
xor ebx, ebx
push eax
lea eax, [ebp - 0x4b8]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x408018
mov eax, dword [0x4b0550]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x284]
test eax, eax
je 0x407f90
lea eax, [ebp - 0x284]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [ebp - 0x284]
push ecx
push eax
lea ecx, [ebp - 4]
call fcn.004039ec
push 0x4b1120
push dword [ebp - 4]
call fcn.0049cec5
pop ecx
test eax, eax
pop ecx
je 0x407fef
push 0x4b111c
push dword [ebp - 4]
call fcn.0049cec5
pop ecx
test eax, eax
pop ecx
je 0x407fef
lea eax, [ebp - 0x284]
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x60]
push eax
push edi
push 0x104d
mov dword [ebp - 0x58], edi
push dword [ebp + 8]
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x60], 7
call esi
inc ebx
lea ecx, [ebp - 4]
call fcn.004038fb
lea eax, [ebp - 0x2b0]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x407f71
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x40801f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov edx, dword [0x4bd5dc]
push esi
mov esi, ecx
push edi
mov ecx, 0xff
xor eax, eax
cmp dword [esi + 0x1c], eax
lea edi, [ebp - 0x800]
mov dword [ebp - 0x804], edx
mov dword [ebp - 0x404], edx
rep stosd dword es:[edi], eax
mov ecx, 0xff
lea edi, [ebp - 0x400]
rep stosd dword es:[edi], eax
lea eax, [ebp - 4]
push eax
je 0x408067
push 2
jmp 0x408069
push 0x17
push dword [esi + 4]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
lea eax, [ebp - 0x404]
push eax
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x804]
push 0x4b0e24
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push dword [esi + 0x34]
push 0x3e9
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call fcn.00407e8a
pop edi
pop esi
leave
ret 8

Function at 0x4080c9
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
push esi
push edi
lea eax, [ebp - 0x24c]
push 0x104
push eax
push dword [0x4c7a90]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0xf
xor eax, eax
pop ecx
lea edi, [ebp - 0x44]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x24c]
lea ecx, [ebp - 4]
push eax
mov dword [ebp - 0x44], 0x3c
call fcn.0040a4e8
xor esi, esi
lea ecx, [ebp - 4]
push esi
mov dword [ebp - 0x40], esi
call fcn.00403c58
mov dword [ebp - 0x34], eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push str._install__runas
push eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x28], 1
call fcn.0040a961
mov eax, dword [ebp - 8]
mov dword [ebp - 0x38], 0x4b1138
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
lea ecx, [ebp - 8]
mov esi, eax
call fcn.004038fb
lea ecx, [ebp - 4]
call fcn.004038fb
lea ecx, [ebp + 8]
call fcn.004038fb
mov eax, esi
pop edi
pop esi
leave
ret
Function at 0x408e01
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x474
mov dword [ebp - 0xc], ecx
push ebx
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push edi
xor edi, edi
lea eax, [ecx - 0xc]
mov word [ebp - 0x1c], 0x5c
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
cmp dword [eax], edi
jl 0x408e36
push eax
mov dword [ebp - 4], ecx
call esi
jmp 0x408e47
mov eax, dword [0x4b0550]
push ecx
lea ecx, [ebp - 4]
mov dword [ebp - 4], eax
call fcn.0040a70f
mov eax, dword [ebp - 4]
push ecx
mov ecx, esp
cmp dword [eax - 0xc], edi
jl 0x408e5f
mov dword [ecx], eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff4
push eax
call esi
jmp 0x408e6e
mov eax, dword [0x4b0550]
mov dword [ecx], eax
push dword [ebp - 4]
call fcn.0040a70f
call fcn.00460471
pop ecx
push 1
pop ebx
cmp eax, ebx
jne 0x408ec6
mov eax, dword [ebp - 4]
push ecx
mov ecx, esp
cmp dword [eax - 0xc], edi
jl 0x408e93
mov dword [ecx], eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff4
push eax
call esi
jmp 0x408ea2
mov eax, dword [0x4b0550]
mov dword [ecx], eax
push dword [ebp - 4]
call fcn.0040a70f
mov esi, dword [ebp - 0xc]
mov ecx, esi
call fcn.00409061
cmp eax, edi
jne 0x408eb8
mov dword [esi + 0x1c], ebx
jmp 0x408fc2
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x408fc2
lea eax, [ebp - 4]
push eax
call fcn.00408ff4
lea ecx, [ebp - 8]
mov dword [esp], 0x4b12fc
call fcn.00403927
mov eax, dword [ebp - 8]
lea ecx, [ebp - 4]
push eax
push dword [eax - 8]
call fcn.00403bd8
lea ecx, [ebp - 8]
call fcn.004038fb
push dword [ebp - 4]
lea ecx, [ebp - 0x474]
call fcn.0040b0d3
test eax, eax
je 0x408fae
lea ecx, [ebp - 0x474]
call fcn.0040b176
lea ecx, [ebp - 0x474]
mov esi, eax
call fcn.0040b099
test eax, eax
jne 0x408fa6
push 0x10
lea ecx, [ebp - 0x474]
call fcn.0040b07d
test eax, eax
je 0x408f6e
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x474]
push eax
call fcn.0040afaf
push eax
lea ecx, [ebp - 4]
call fcn.00403a8c
lea ecx, [ebp - 0x10]
call fcn.004038fb
push ecx
lea eax, [ebp - 4]
mov ecx, esp
push eax
call fcn.004038b5
mov ecx, dword [ebp - 0xc]
call fcn.00408e01
jmp 0x408fa6
lea eax, [ebp - 8]
lea ecx, [ebp - 0x474]
push eax
call fcn.0040afaf
push ecx
lea eax, [ebp - 8]
mov ecx, esp
push eax
call fcn.004038b5
mov ecx, dword [ebp - 0xc]
call fcn.00409061
test eax, eax
je 0x408fe4
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 8]
call fcn.004038fb
cmp esi, edi
jne 0x408f0b
lea ecx, [ebp - 0x474]
call fcn.0040b1a0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [ebp - 4]
call fcn.004038fb
lea ecx, [ebp - 0x474]
call fcn.0040b1a0
lea ecx, [ebp + 8]
call fcn.004038fb
pop edi
pop esi
pop ebx
leave
ret 4
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 8]
mov dword [eax + 0x1c], ebx
call fcn.004038fb
jmp 0x408fc2
Function at 0x409061
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x409075
xor esi, esi
jmp 0x40908f
test al, 1
je 0x40909c
push 0x80
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x409071
push 1
pop esi
lea ecx, [esp + 8]
call fcn.004038fb
mov eax, esi
jmp 0x4090a8
lea ecx, [esp + 8]
call fcn.004038fb
push 1
pop eax
pop esi
ret 4
Function at 0x409b07
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 2
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
ret