joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404b24
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x800
push ebx
push esi
push edi
mov ebx, ecx
call fcn.00401046
mov esi, eax
mov ecx, esi
call fcn.00413194
push 1
mov ecx, esi
mov edi, eax
call fcn.00413179
mov ecx, esi
call fcn.00413172
push eax
mov ecx, esi
call fcn.004130f9
mov ecx, edi
call fcn.00414d9c
push eax
mov ecx, esi
call fcn.00413134
lea eax, [ebp - 0x800]
push 0x400
push eax
mov ecx, ebx
call fcn.00404cd5
test eax, eax
jne 0x404ba3
mov edi, 0x47f
mov ecx, esi
mov dword [0x434bb4], edi
call fcn.00413141
shr eax, 0xa
push eax
push edi
call fcn.00415587
pop ecx
pop ecx
jmp 0x404cc9
lea eax, [ebp - 0x400]
push eax
push 0
lea eax, [ebp - 0x800]
push 0x42d1cc
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea eax, [ebp - 0x400]
push eax
call fcn.0041609e
lea eax, [ebp - 0x400]
push 0x2e
push eax
call fcn.0041cbc0
and byte [eax], 0
pop ecx
pop ecx
lea eax, [ebp - 0x400]
push eax
call fcn.00416047
test eax, eax
jne 0x404bf9
lea eax, [ebp - 0x400]
push eax
call fcn.00415f9d
lea eax, [ebp - 0x400]
mov edi, 0x431c0c
push eax
push edi
call fcn.0041bb20
pop ecx
pop ecx
push dword [0x42e1ec]
mov ecx, ebx
call fcn.00401046
mov ecx, eax
call fcn.00413c89
test eax, eax
jne 0x404c48
push 2
mov ecx, esi
call fcn.00413179
push dword [0x42e1ec]
mov ecx, esi
call fcn.0041312d
push eax
push 0x433ce0
call fcn.00415ec8
jmp 0x404c64
push dword [0x42e1ec]
push edi
push 0x433ce0
call fcn.00415ec8
mov ecx, esi
call fcn.00413c9d
test eax, eax
je 0x404cc9
push dword [0x42e200]
mov ecx, ebx
call fcn.00401046
mov ecx, eax
call fcn.00413c89
test eax, eax
je 0x404c98
push 1
push 0
push 0
push 1
push dword [0x42e200]
mov ecx, ebx
call fcn.00401046
mov ecx, eax
call fcn.00413eea
mov ecx, ebx
call fcn.00404d96
test eax, eax
jne 0x404cb5
mov eax, 0x481
push 0
mov dword [0x434bb4], eax
push eax
jmp 0x404b97
cmp dword [esi + 0x14bc], 5
jne 0x404ccd
mov ecx, esi
call fcn.00413e45
test eax, eax
jne 0x404ccd
xor eax, eax
jmp 0x404cd0
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x404cd5
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
call fcn.00401046
mov ecx, eax
call fcn.00413141
mov edi, dword [esp + 0x10]
mov esi, eax
push edi
push dword [esp + 0x18]
shr esi, 0xa
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x404d16
push 0x8003
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push esi
push edi
mov ecx, ebx
call fcn.00404d6b
test eax, eax
jne 0x404d62
push dword [esp + 0x14]
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jle 0x404d32
push esi
push edi
mov ecx, ebx
call fcn.00404d6b
test eax, eax
jne 0x404d62
push 0x431bf0
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
push esi
push 3
call fcn.00415c1d
add esp, 0xc
test eax, eax
jge 0x404d62
push edi
push esi
push 4
call fcn.00415c1d
add esp, 0xc
test eax, eax
jge 0x404d62
xor eax, eax
jmp 0x404d65
push 1
pop eax
pop edi
pop esi
pop ebx
ret 8
Function at 0x423f36
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x431660
cmp edx, dword [eax]
je 0x423f58
add eax, 8
inc ecx
cmp eax, 0x4316f0
jl 0x423f49
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x431660]
jne 0x424086
mov eax, dword [0x434c94]
cmp eax, 1
je 0x424060
test eax, eax
jne 0x423f89
cmp dword [0x42ec54], 1
je 0x424060
cmp edx, 0xfc
je 0x424086
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x423fc0
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0041bb20
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0041baa0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x424003
lea eax, [ebp - 0x1a4]
push eax
call fcn.0041baa0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x429428
push edi
call fcn.0041b9a0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0041bb20
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0041bb30
lea eax, [ebp - 0xa0]
push 0x429408
push eax
call fcn.0041bb30
push dword [esi + 0x431664]
lea eax, [ebp - 0xa0]
push eax
call fcn.0041bb30
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00425cd8
add esp, 0x2c
pop edi
jmp 0x424086
lea eax, [ebp + 8]
lea esi, [esi + 0x431664]
push 0
push eax
push dword [esi]
call fcn.0041baa0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
mov ecx, 0x35c00453
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x469b154c
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x40f2a0
Capabilities:
Write file on windows

Disassembly:
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, dword [esp + 0x20]
add dword [0x497f60], 0x157ebc3b
mov dword [0x48ab7c], 0x1218bb3c
cmp dword [0x49a604], 0
jne 0x40f2fa
mov dword [0x48aeac], 0x1bda4581
call fcn.004068b0
mov dword [0x49a604], eax
mov ax, word [0x483bd4]
cwde
sar eax, 3
mov ecx, dword [0x495d00]
inc ecx
mov dword [0x495d00], ecx
or ecx, eax
add dword [0x488214], ecx
mov eax, dword [0x4973e0]
lea ecx, [eax - 1]
mov dword [0x4973e0], ecx
xor eax, 0x63e8cd5d
mov ecx, dword [0x48a648]
sub ecx, eax
mov dword [0x48a648], ecx
mov dword [esp + 4], 3
mov dword [esp], 0x3250
call fcn.0041b440
mov edi, eax
and dword [0x495420], 0x1140000
mov dword [esp + 4], edi
mov dword [esp], ebx
call fcn.004508af
mov esi, eax
and dword [0x491034], 0xdd77e2c4
mov eax, dword [0x497554]
imul eax, eax, 0xc25d3cdf
mov dword [0x497554], eax
and dword [0x495c54], 0xd86e1717
mov eax, dword [0x499b0c]
or eax, 0x83cb4d94
mov dword [0x48a270], eax
mov byte [edi], 0
mov byte [edi + 1], 0
mov byte [edi + 2], 0
mov byte [edi + 3], 0
mov byte [edi + 4], 0
mov byte [edi + 5], 0
mov byte [edi + 6], 0
mov dword [0x491a90], 0x26e92094
mov dword [esp], edi
call fcn.0044cc10
mov eax, dword [0x488218]
lea ecx, [eax - 1]
mov dword [0x488218], ecx
xor eax, 0x5f056ad2
or dword [0x489848], eax
mov eax, dword [0x48ba44]
test esi, esi
je 0x40f3da
add dword [0x48de58], 0x952651a4
jmp 0x40f4f2
mov ax, word [0x4848de]
lea ecx, [eax - 1]
mov word [0x4848de], cx
cwde
mov ecx, 0x2fd46a8c
sub ecx, eax
mov eax, dword [0x48fb8c]
shl eax, 5
or eax, ecx
cmp eax, 0x2bd2b454
je 0x40f40d
add dword [0x48facc], 0xc5fd687d
mov dword [esp], 0x40c
call dword [0x47e900]
sub esp, 4
mov ax, word [0x4845ba]
cwde
and eax, 0x29883203
or eax, 0xd6604d14
and dword [0x48ca5c], eax
mov dword [esp + 4], 3
mov dword [esp], 0x3250
call fcn.0041b440
mov edi, eax
mov dword [0x4982c8], 0x9120028
mov dword [esp + 4], edi
mov dword [esp], ebx
call fcn.004508af
mov esi, eax
mov word [0x4814f6], 0x9c9b
mov eax, dword [0x497554]
imul eax, eax, 0xc25d3cdf
mov dword [0x497554], eax
and dword [0x495c54], 0xd86e1717
mov eax, dword [0x499b0c]
or eax, 0x83cb4d94
mov dword [0x48a270], eax
mov byte [edi], 0
mov byte [edi + 1], 0
mov byte [edi + 2], 0
mov byte [edi + 3], 0
mov byte [edi + 4], 0
mov byte [edi + 5], 0
mov byte [edi + 6], 0
mov dword [0x491a90], 0x26e92094
mov dword [esp], edi
call fcn.0044cc10
mov eax, dword [0x488218]
lea ecx, [eax - 1]
mov dword [0x488218], ecx
xor eax, 0x5f056ad2
or dword [0x489848], eax
add dword [0x48d68c], 0x3a588068
add dword [0x48de58], 0x952651a4
test esi, esi
je 0x40f54d
mov ax, word [0x4865f0]
mov cx, word [0x486054]
and ecx, eax
movsx eax, cx
or dword [0x49835c], eax
mov dword [esp + 0xc], esi
mov dword [esp + 8], 1
mov dword [esp + 4], 4
mov dword [esp], 0x49a604
call fcn.00450c34
mov ax, word [0x47eabc]
add eax, 0x4efd
mov word [0x47eabc], ax
mov dword [esp], esi
call fcn.00450d22
xor dword [0x48d5b4], 0xfffda76b
mov eax, dword [0x49827c]
mov ecx, dword [0x498498]
lea eax, [eax + ecx - 0x54f08730]
mov dword [0x498498], eax
add esp, 0x10
pop esi
pop edi
pop ebx
ret
Function at 0x410730
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
push eax
mov esi, dword [esp + 0x10]
mov ax, word [0x483658]
cwde
imul eax, eax, 0x7fbc187a
cmp eax, 0x59a14202
jg 0x41075d
mov eax, dword [0x493cf0]
mov ecx, 0x88a3a2d1
sub ecx, eax
and dword [0x496324], ecx
mov ax, word [0x4873de]
dec eax
mov word [0x4873de], ax
mov ax, word [0x484408]
add eax, 0xffffd6ed
mov word [0x484408], ax
mov eax, dword [0x48f280]
imul eax, eax, 0x62ea7f01
mov dword [0x48f280], eax
mov dword [esp], esi
call fcn.0044cd20
xor dword [0x48bb1c], 0xa8057987
mov ecx, dword [0x488c18]
inc ecx
mov dword [0x488c18], ecx
mov edx, dword [0x493f28]
mov edi, dword [0x493c2c]
imul edi, ecx
imul edi, edx
cmp edi, 0xf2021f22
je 0x4107d8
mov cx, word [0x484b84]
or ecx, 0x908f
mov word [0x484b84], cx
movzx ecx, byte [esi + eax - 1]
cmp ecx, 0x22
jne 0x410836
mov cx, word [0x485388]
movsx ecx, cx
mov dx, word [0x482462]
movsx edx, dx
not edx
and edx, ecx
xor edx, 0x19dd3e10
cmp edx, 0xcc4a1820
jl 0x4108ec
mov ecx, dword [0x48e810]
lea edx, [ecx + 1]
mov dword [0x48e810], edx
cmp ecx, 0x97ede8e2
jl 0x4108d6
add dword [0x4913f4], 0x46424031
jmp 0x4108ec
mov cx, word [0x482720]
movsx ecx, cx
shl ecx, 0xa
mov dx, word [0x481916]
movsx edx, dx
sub ecx, edx
mov edx, dword [0x498a88]
imul edx, ecx
mov dword [0x498a88], edx
mov byte [esi], 0x20
mov ecx, dword [0x4919f4]
cmp ecx, 0xa5e803c5
jne 0x410880
add dword [0x48be40], 0x84ff18c4
nop
nop
nop
nop
nop
nop
nop
xor dword [0x488330], 0xa71fc4bc
mov cx, word [0x47f666]
movsx ecx, cx
not ecx
and ecx, 0xd2970cf9
or dword [0x48cce4], ecx
movzx ecx, byte [esi + eax - 2]
dec eax
cmp ecx, 0x20
jne 0x410880
mov ecx, dword [0x4900cc]
mov ecx, dword [0x48dd0c]
imul ecx, ecx, 0x7fc63242
mov dword [0x48dd0c], ecx
add esi, eax
xor dword [0x490b1c], 0x6439a995
jmp 0x4109b0
mov ecx, dword [0x48b8c8]
mov dx, word [0x485f7e]
xor edx, ecx
mov word [0x485f7e], dx
mov byte [esi], 0x22
mov ecx, dword [0x48ae48]
imul ecx, ecx, 0x38616207
mov dword [0x48ae48], ecx
mov byte [esi + eax - 1], 0
and dword [0x4932e0], 0x62928263
mov cx, word [0x47ed3e]
imul ecx, ecx, 0xffffdf7b
mov word [0x47ed3e], cx
add dword [0x496f64], 0xa9266f8f
movzx ecx, byte [esi + eax - 2]
dec eax
cmp ecx, 0x22
jne 0x410910
mov ecx, dword [0x48cec0]
or ecx, 0xb0ef
mov dx, word [0x48537c]
xor edx, ecx
mov word [0x48537c], dx
add esi, eax
mov ax, word [0x4867e2]
inc eax
mov word [0x4867e2], ax
cwde
add eax, 0xf6c20761
cmp eax, 0xc10a6780
jl 0x41097d
add dword [0x498ce8], 0xab9f2a8a
jmp 0x4109b0
mov eax, dword [0x48d43c]
cmp eax, 0x18cf05a1
jne 0x4109b0
mov eax, dword [0x48a078]
lea ecx, [eax + 1]
mov dword [0x48a078], ecx
mov ecx, 0xcb10badd
sub ecx, eax
or ecx, 0x643a02fe
mov eax, dword [0x4923f8]
sub eax, ecx
mov dword [0x4923f8], eax
mov eax, dword [0x48ae88]
lea ecx, [eax - 1]
mov dword [0x48ae88], ecx
cmp eax, 0xff1bdffb
jl 0x4109e6
mov ax, word [0x485816]
cwde
shl eax, 0xa
cmp eax, 0x60429ca9
jl 0x4109e6
mov eax, dword [0x48ce34]
imul eax, eax, 0xacb3fec4
mov dword [0x48ce34], eax
mov eax, esi
add esp, 4
pop esi
pop edi
ret
Function at 0x42ec20
Capabilities:
Hash data with md5

Disassembly:
push edi
push esi
sub esp, 8
mov esi, ecx
mov edi, dword [esp + 0x14]
mov eax, dword [0x495a58]
not eax
mov ecx, dword [0x4960e8]
imul ecx, eax
mov dword [0x4960e8], ecx
mov eax, dword [0x491b20]
lea ecx, [eax + 1]
mov dword [0x491b20], ecx
xor eax, 0x4e59870b
mov ecx, dword [0x48fac8]
sub ecx, eax
mov dword [0x48fac8], ecx
mov dword [esp], edi
call fcn.0044cd20
mov ecx, dword [0x48babc]
add ecx, 0x536b0d5b
mov dword [0x495edc], ecx
mov ecx, dword [0x487c24]
lea edx, [ecx + 1]
mov dword [0x487c24], edx
cmp ecx, 0xbc1f3239
jg 0x42ecc1
mov cx, word [0x47ea68]
dec ecx
mov word [0x47ea68], cx
mov cx, word [0x47fd0a]
movsx ecx, cx
and ecx, 0x4243b847
mov edx, dword [0x496bd0]
imul edx, ecx
mov dword [0x496bd0], edx
mov dword [esi], 0
mov ecx, dword [0x4882c4]
imul ecx, ecx, 0x308292a3
mov edx, dword [0x48e804]
lea ecx, [ecx + edx - 0x5ee5cb3f]
mov dword [0x48e804], ecx
mov dword [esi + 4], 0
mov dword [0x497814], 0xabfa4376
mov dword [esi + 8], 0x67452301
or dword [0x495e04], 0x2c6f991b
mov dword [esi + 0xc], 0xefcdab89
mov ecx, dword [0x488338]
add ecx, 0x59621f3f
or dword [0x490760], ecx
mov dword [esi + 0x10], 0x98badcfe
mov dword [0x492870], 0xd12016
mov dword [esi + 0x14], 0x10325476
mov cx, word [0x484332]
movsx ecx, cx
imul ecx, ecx, 0xcd65f7ac
cmp ecx, 0x6457c60
jg 0x42ed69
mov ecx, dword [0x498b44]
add ecx, 0x8f457cca
xor ecx, 0x35c68b0b
mov dword [0x494188], ecx
mov ecx, dword [0x488e8c]
lea edx, [ecx + 1]
mov dword [0x488e8c], edx
add ecx, 0x9081bfef
mov dword [0x498538], ecx
mov dword [esp + 4], eax
mov dword [esp], edi
mov ecx, esi
call fcn.0040c620
sub esp, 8
mov eax, dword [0x48d08c]
dec eax
mov dword [0x48d08c], eax
mov ecx, dword [0x4934ac]
imul ecx, eax
mov dword [0x4934ac], ecx
mov ecx, esi
call fcn.00443f80
mov eax, dword [0x493b98]
cmp eax, 0x932fc0e9
je 0x42edd2
mov eax, dword [0x48e0e8]
imul eax, eax, 0x4cc4640
mov dword [0x48e0e8], eax
mov ecx, esi
call fcn.0040efe0
and dword [0x49444c], 0xf4511b96
add esi, 0xb9
mov eax, esi
add esp, 8
pop esi
pop edi
ret 4

Function at 0x436b40
Capabilities:
Terminate process

Disassembly:
sub esp, 8
mov eax, dword [0x4896d8]
sar eax, 0xa
mov ecx, dword [0x4924b4]
and ecx, eax
add dword [0x4983ac], ecx
mov eax, dword [0x499ee0]
mov cx, word [0x483428]
xor ecx, 0x835f
mov word [0x483428], cx
mov cx, word [0x4804ce]
mov dx, word [0x480544]
imul edx, ecx
shl edx, 3
mov word [0x480544], dx
mov dword [esp], eax
mov dword [esp + 4], 0x4e20
call dword [0x47e8f8]
sub esp, 8
mov ecx, dword [0x498e6c]
lea edx, [ecx + 1]
mov dword [0x498e6c], edx
mov edx, 0x60e827ac
sub edx, ecx
add dword [0x493ff0], edx
cmp eax, 0x80
je 0x436bf5
test eax, eax
jne 0x436c02
mov ax, word [0x485a12]
lea ecx, [eax + 1]
mov word [0x485a12], cx
cwde
add eax, 0x1bc016f1
mov ecx, dword [0x48b138]
inc ecx
mov dword [0x48b138], ecx
xor ecx, eax
xor dword [0x48e4bc], ecx
jmp 0x436c17
mov eax, dword [0x491648]
or dword [0x492fe0], eax
jmp 0x436c17
mov eax, dword [0x4936a0]
mov cx, word [0x483714]
or ecx, eax
mov word [0x483714], cx
mov ax, word [0x482154]
add eax, 0x72e5
mov word [0x482154], ax
mov dword [esp], 1
call fcn.004507d7
int3
Function at 0x457b4c
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x47df30]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00452859
mov dword [ebp - 0x14], eax
cmp dword [0x49b04c], esi
jne 0x457c3f
push 0x800
push esi
push 0x46e230
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x457bcc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x457d1f
push esi
push esi
push 0x46e230
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x457d1f
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x457d1f
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x49b04c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x49b050], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x49b054], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x49b05c], eax
test eax, eax
je 0x457c3c
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x49b058], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x457c64
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x457c57
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x457c79
push 4
pop eax
jmp 0x457d21
cmp dword [ebp - 0x14], esi
je 0x457c79
push dword [0x49b04c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x457c5e
mov eax, dword [0x49b058]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x457cd7
cmp dword [0x49b05c], edi
je 0x457cd7
push eax
call ebx
push dword [0x49b05c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x457cd7
test eax, eax
je 0x457cd7
call ecx
test eax, eax
je 0x457ccc
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x457ccc
test byte [ebp - 8], 1
jne 0x457cd7
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x457d07
mov eax, dword [0x49b050]
cmp eax, edi
je 0x457d04
push eax
call ebx
test eax, eax
je 0x457d04
call eax
mov esi, eax
test esi, esi
je 0x457d04
mov eax, dword [0x49b054]
cmp eax, edi
je 0x457d04
push eax
call ebx
test eax, eax
je 0x457d04
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x49b04c]
call ebx
test eax, eax
je 0x457d1f
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x457d21
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00457d50
mov esp, ebp
pop ebp
ret
Function at 0x4280ab
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.00428156
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x4280f3
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.0040dda1
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.0040cea3
jmp 0x4280fe
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.0041a386
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x4d2f7f
Capabilities:
Get file system object information

Disassembly:
push 0x4c8
mov eax, 0x5667ae
call fcn.0052f034
mov ebx, ecx
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.004068f0
pop ecx
lea esi, [eax + 0x10]
mov dword [ebp - 0x4d0], esi
and dword [ebp - 4], 0
lea ecx, [ebp - 0x4d0]
push 0
push 0x56ebc0
call fcn.004094e7
cmp eax, 0xffffffff
jne 0x4d3033
push 0
push 0x5777f4
lea ecx, [ebp - 0x4d0]
call fcn.004094e7
cmp eax, 0xffffffff
jne 0x4d3033
push 0
push 0x56e514
lea ecx, [ebp - 0x4d0]
call fcn.004094e7
cmp eax, 0xffffffff
jne 0x4d3033
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.004068f0
pop ecx
lea edi, [eax + 0x10]
mov dword [ebp - 0x4d4], edi
xor ecx, ecx
mov byte [ebp - 4], 1
push ecx
lea eax, [ebp - 0x218]
push eax
push 0x104
push ecx
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x4d300f
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x14]
lea ecx, [edi - 0x10]
mov ebx, eax
call fcn.00404e10
jmp 0x4d3062
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x4d0]
call fcn.00406d60
lea ecx, [edi - 0x10]
mov byte [ebp - 4], 0
call fcn.00404e10
mov esi, dword [ebp - 0x4d0]
push 0x105
push 0x2b4
lea eax, [ebp - 0x4cc]
push eax
push 0
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x4d3059
mov ebx, dword [ebp - 0x4cc]
jmp 0x4d3062
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x14]
mov ebx, eax
lea ecx, [esi - 0x10]
call fcn.00404e10
mov eax, ebx
call fcn.0052efe3
ret
Function at 0x547eb9
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x569595
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x5695d0
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x5695b7
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x5695c8
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x5695d2
inc edi
add eax, 0x28
cmp edi, esi
jb 0x5695ad
xor eax, eax
pop edi
pop esi
ret
Function at 0x41c500
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x427850], 0
jne 0x41c581
cmp dword [0x427870], 0
jne 0x41c530
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x427870], eax
test eax, eax
jne 0x41c530
push str.GetEnvironmentStrings_failed
call fcn.0041bd1c
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x427870]
jmp 0x41c544
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c53c
lea edi, [ebp + 1]
push edi
call fcn.004161a8
pop ecx
mov ebx, eax
mov dword [0x427854], ebx
test ebx, ebx
jne 0x41c56e
xor eax, eax
jmp 0x41c644
push edi
mov edx, dword [0x427870]
push edx
push ebx
call fcn.00416754
add esp, 0xc
jmp 0x41c5a1
xor esi, esi
mov ebx, dword [0x427850]
jmp 0x41c59b
push eax
call fcn.004168a4
pop ecx
test eax, eax
jne 0x41c597
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c58b
lea ebx, [esi + 4]
push 4
mov dword [0x427858], ebx
inc ebx
push ebx
call fcn.00415c80
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x41c5c4
xor eax, eax
jmp 0x41c644
cmp dword [0x427850], 0
jne 0x41c5f5
xor esi, esi
mov ebx, dword [0x427854]
mov eax, dword [esp]
mov ebp, eax
jmp 0x41c5e6
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c5dc
jmp 0x41c626
xor esi, esi
mov ebx, dword [0x427850]
mov eax, dword [esp]
mov edi, eax
jmp 0x41c620
push eax
call fcn.004168a4
pop ecx
test eax, eax
je 0x41c615
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x41c619
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c604
mov eax, dword [0x427850]
test eax, eax
je 0x41c636
push eax
call fcn.004161b8
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x427850], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x42e004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x3af944e7
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x42e04e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x42e024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x239e3274
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0xbb0370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0xbb038e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0xbd9074
push ecx
mov edi, eax
call fcn.00bc4198
mov esi, eax
add esp, 8
test esi, esi
jne 0xbb03cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.00bc402e
push esi
call fcn.00bc3fb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret