joyce8/EMBER2024-capa huggingface dataset:
Function at 0x74ed10
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x258000]
push edi
or ebp, 0xffffffff
jmp 0x74ed32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x74ed39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x74ed28
mov eax, 1
add ebx, ebx
jne 0x74ed4b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x74ed5c
jne 0x74ed7b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x74ed7b
dec eax
add ebx, ebx
jne 0x74ed68
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x74ed40
add ebx, ebx
jne 0x74ed77
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x74edcd
xor ecx, ecx
sub eax, 3
jb 0x74ed93
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x74ee02
sar eax, 1
mov ebp, eax
jmp 0x74ed9e
add ebx, ebx
jne 0x74ed9e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x74ed6c
inc ecx
add ebx, ebx
jne 0x74edac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x74ed6c
add ebx, ebx
jne 0x74edb9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x74edae
jne 0x74edca
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x74edae
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x74edec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x74edde
jmp 0x74ed2e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x74edec
add edi, ecx
jmp 0x74ed2e
pop esi
mov edi, esi
mov ecx, 0x844
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x74ee0a
cmp byte [edi], 0x20
jne 0x74ee0a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x74ee0f
lea edi, [esi + 0x34c000]
mov eax, dword [edi]
or eax, eax
je 0x74ee87
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x34e75c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x34e798]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x74ee3c
mov ecx, edi
jns 0x74ee6b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x34e79c]
or eax, eax
je 0x74ee81
mov dword [ebx], eax
add ebx, 4
jmp 0x74ee59
call dword [esi + 0x34e7a4]
mov ebp, dword [esi + 0x34e7a0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1df]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x74eebb
sub esp, 0xffffff80
jmp 0x406260
Function at 0x10016c96
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x10016ca5
pop dword [ebp - 0x20]
mov eax, 0x10016ca5
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x9492148
add dword [ebp - 0x30], 0x45092403
mov dword [ebp - 0x2c], 0xe983040c
sub dword [ebp - 0x2c], 0xb74fb7c7
mov dword [ebp - 0x28], 0x775570f8
sub dword [ebp - 0x28], 0x2b092cca
mov dword [ebp - 0x24], 0x383b8127
add dword [ebp - 0x24], 0xc7c47ed9
lea eax, [ebp - 0x30]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x63e84a80
sub dword [ebp - 0x30], 0xef75e12a
mov dword [ebp - 0x2c], 0xfab25595
sub dword [ebp - 0x2c], 0xb945f420
mov dword [ebp - 0x28], 0xe28d1a9b
sub dword [ebp - 0x28], 0x7f1dae2f
mov dword [ebp - 0x24], 0x4ca5e962
sub dword [ebp - 0x24], 0x4ca5e962
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x3d895
push 0
call eax
mov ecx, 0x692ba500
sub ecx, 0x692b5c0b
mov ebx, eax
mov esi, 0x10035800
add esi, dword [ebp - 0x20]
mov edi, 0x54c87b33
sub edi, 0x62a6562a
sub dword [ebp - 8], 0x31fefe1c
mov edx, dword [esi]
xor dword [ebp - 0x10], 0x55957fb5
add edx, edi
mov dword [ebp - 8], 0x95449ee2
mov dword [ebx], edx
add dword [ebp - 8], 0x8ffda8df
add ebx, 4
add esi, 0x75cd67d2
sub esi, 0x75cd67ce
loop 0x10016db2
add eax, 0xa8d2b72d
sub eax, 0xa8d1a086
mov ebx, eax
add eax, 0xecfb2b10
sub eax, 0xecfb2b0b
mov ecx, 0x60941cac
sub ecx, 0x50941cac
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x419173
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x419182
pop dword [ebp - 0xc]
mov eax, 0x8493638
sub eax, 0x807a4b6
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0xf6d0424e
sub dword [ebp - 0x1c], 0xa87dfd03
mov dword [ebp - 0x18], 0x190b6b9f
sub dword [ebp - 0x18], 0xe6d81f5a
mov dword [ebp - 0x14], 0x4a2ca94
add dword [ebp - 0x14], 0x47a9799a
mov dword [ebp - 0x10], 0xdbc76bb1
add dword [ebp - 0x10], 0x2438944f
lea eax, [ebp - 0x1c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0xdb906dc2
sub dword [ebp - 0x1c], 0x671e046c
mov dword [ebp - 0x18], 0xc6c0bb18
sub dword [ebp - 0x18], 0x855459a3
mov dword [ebp - 0x14], 0xe7253843
add dword [ebp - 0x14], 0x7c4a3429
mov dword [ebp - 0x10], 0x79b81c34
add dword [ebp - 0x10], 0x8647e3cc
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0xc87ea1e7
sub eax, 0xc83c70c3
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x3e5d4
push 0
call eax
mov ecx, 0xeb864a48
sub ecx, 0xeb85ffab
xor edx, edx
add edx, eax
mov edi, 0x434400
add edi, dword [ebp - 0xc]
mov esi, 0xb5292a9b
add esi, 0x50e13e1
xor dword [ebp - 4], 0xa53eae54
mov ebx, dword [edi]
sub dword [ebp - 8], 0x22894fa3
sub ebx, esi
sub dword [ebp - 4], edi
mov dword [edx], ebx
sub dword [ebp - 4], edx
add edx, 0x1fef3ac9
add edx, 0xe010c53b
add edi, 0x94fbcca7
sub edi, 0x94fbcca3
loop 0x41929b
add eax, 0x11d47
xor ebx, ebx
add ebx, eax
add eax, 0x5127cd67
add eax, 0xaed8329e
mov ecx, 0x400000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret

Function at 0x401056
Capabilities:
Get disk information

Disassembly:
cmp dword [ebp + 0x10], 0x65
je 0x40106c
cmp dword [ebp + 0x10], 2
je fcn.0040112d
xor eax, eax
leave
ret 0x10
push 0x25
push 0x402324
push 0x68
push dword [ebp + 8]
call sub.USER32.dll_GetDlgItemTextA
push 0
push 0
push 0x4020c8
push 0x402190
push 0x402194
push 0x32
push 0x40225c
push 0
call sub.KERNEL32.dll_GetVolumeInformationA
push 0x4023f3
push 0x40225c
call sub.KERNEL32.dll_lstrcatA
mov dl, 2
add dword [0x40225c], 1
add dword [0x40225d], 1
add dword [0x40225e], 1
add dword [0x40225f], 1
dec dl
jne 0x4010af
push 0x4023fd
push section.DATA
call sub.KERNEL32.dll_lstrcatA
push 0x40225c
push section.DATA
call sub.KERNEL32.dll_lstrcatA
push 0x402324
push section.DATA
call sub.KERNEL32.dll_lstrcmpiA
cmp eax, eax
nop
je 0x401117
push 0
push 0x402434
push 0x40243b
push dword [ebp + 8]
call sub.USER32.dll_MessageBoxA
jmp fcn.0040112d
push 0
push 0x402406
push 0x402411
push dword [ebp + 8]
call sub.USER32.dll_MessageBoxA
jmp fcn.0040112d
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x2e626fd1
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x5021044e
nop
nop
nop
nop
test eax, eax
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x4011e0
Capabilities:
Encode data using xor

Disassembly:
vmovdqa xmm0, xmmword [0x4dd1e0]
vmovdqa xmm1, xmmword [0x4dd200]
vprotb xmm2, xmm0, xmm1
vprotd xmm0, xmm2, 7
vpperm xmm0, xmm1, xmm0, xmm2
vmovdqa xmm2, xmmword [0x4dd250]
vpcomeqb xmm1, xmm0, xmm2
vpmovmskb eax, xmm1
cmp eax, 0xfbff
sete al
ret

Function at 0x414890
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
xor bl, bl
push esi
mov edi, 0xa
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4148da
mov eax, edi
dec edi
test eax, eax
je 0x4148da
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4148e0
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4148a8
pop edi
pop esi
mov al, bl
pop ebx
ret
pop edi
pop esi
mov al, 1
pop ebx
ret

Function at 0x4148f0
Capabilities:
Check if file exists
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, 0x80
cmp eax, 0xffffffff
je 0x41491b
and eax, 0x3126
cmove eax, ebx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x414937
and eax, 0x3126
cmove eax, ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [ebp + 8]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
neg eax
pop edi
sbb eax, eax
pop esi
neg eax
pop ebx
pop ebp
ret
Function at 0x414950
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ce238
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x517074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
xor bl, bl
mov byte [ebp - 0x29], bl
test esi, esi
jne 0x414995
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x414a90
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
cmp word [esi], ax
jne 0x4149b2
xor ecx, ecx
jmp 0x4149c4
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4149b5
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.00413f90
mov dword [ebp - 4], 0
xor esi, esi
push 2
lea eax, [esi + 1]
push eax
push 0x4ec114
lea ecx, [ebp - 0x28]
call fcn.004156c0
mov esi, eax
cmp esi, 0xffffffff
je 0x414a2a
lea ecx, [esi + 1]
push ecx
push 0
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x28]
call fcn.00415410
cmp dword [eax + 0x14], 8
jb 0x414a0b
mov eax, dword [eax]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, dword [ebp - 0x30]
cmp eax, 8
jb 0x4149d7
inc eax
lea ecx, [ebp - 0x44]
push eax
push dword [ebp - 0x44]
call fcn.00414120
jmp 0x4149d7
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push edi
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
mov eax, dword [ebp - 0x14]
cmp ebx, 0xffffffff
jne 0x414a78
cmp eax, 8
jb 0x414a73
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00414120
mov al, byte [ebp - 0x29]
jmp 0x414a92
shr ebx, 4
and bl, 1
cmp eax, 8
jb 0x414a90
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00414120
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048bc9e
mov esp, ebp
pop ebp
ret
Function at 0x414f50
Capabilities:
Clear file content
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x517074]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, word [ebp + 8]
push ebx
push esi
push 0x4ed69c
mov esi, ecx
mov dword [ebp - 0xc], edx
push eax
push esi
mov dword [ebp - 8], esi
xor bl, bl
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x415013
push edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x415000
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x414ff9
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
je 0x414ff9
cmp esi, 0xffffffff
je 0x414ff9
push dword [ebp - 0x10]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x414ff2
push esi
mov bl, 1
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
pop esi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048bc9e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.0048bc9e
mov esp, ebp
pop ebp
ret
Function at 0x4189e0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ce846
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push ebx
push esi
push edi
mov eax, dword [0x517074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x1c], ebx
mov dword [ebx], vtable.ProgressCallback.0
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x24], 0
mov dword [ebp - 4], 0
lea esi, [ebx + 0x34]
mov dword [ebp - 0x18], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00419b00
mov dword [esi], eax
lea edi, [ebx + 4]
mov byte [ebp - 4], 1
push edi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, dword [ebx + 0x1c]
xorps xmm0, xmm0
mov dword [ebx + 0x20], eax
mov ecx, esi
lea eax, [ebp - 0x14]
mov dword [ebx + 0x30], 0
push eax
lea eax, [ebp - 0x24]
mov byte [ebx + 0x2c], 0
push eax
movlpd qword [ebp - 0x3c], xmm0
mov dword [ebp - 0x44], 0x64
mov dword [ebp - 0x40], 0
mov byte [ebp - 0x4c], 1
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x14], 0
call fcn.00419c20
mov eax, dword [ebp - 0x24]
mov ecx, esi
movups xmm0, xmmword [ebp - 0x4c]
mov dword [ebp - 0x18], 1
movups xmmword [eax + 0x18], xmm0
movups xmm0, xmmword [ebp - 0x3c]
movups xmmword [eax + 0x28], xmm0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00419c20
mov eax, dword [ebp - 0x2c]
movups xmm0, xmmword [ebp - 0x4c]
push edi
movups xmmword [eax + 0x18], xmm0
movups xmm0, xmmword [ebp - 0x3c]
movups xmmword [eax + 0x28], xmm0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push edi
mov dword [ebx + 0x28], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x41a280
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ce928
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x517074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push dword [ebp + 0xc]
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionSharedDLLs
push dword [ebp + 8]
call fcn.00472f90
add esp, 0xc
test al, al
jne 0x41a323
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x41a312
mov edx, eax
lea ecx, [ebp - 0x28]
call fcn.0042f710
mov dword [ebp - 4], 0
cmp dword [eax + 0x14], 8
jb 0x41a2e2
mov eax, dword [eax]
push eax
push dword [ebp + 8]
push str.SoftwareMicrosoftWindowsCurrentVersionSharedDLLs
push str.GetValueImpl:_cannot_get_value__s_s__code__s
push 0x51dbc8
call fcn.004146b0
mov eax, dword [ebp - 0x14]
add esp, 0x14
cmp eax, 8
jb 0x41a312
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00414120
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x41d2c0
Capabilities:
Create directory
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x517074]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x412
lea eax, [ebp - 0x418]
mov esi, ecx
push 0
push eax
call fcn.004a5940
add esp, 0xc
lea eax, [ebp - 0x418]
push 0x209
push eax
push str.TEMP
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x41d33b
push 0x209
lea eax, [ebp - 0x418]
push eax
push 0x4ed0a4
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x41d33b
push 0x208
lea eax, [ebp - 0x418]
push str.C:TEMP
push eax
call fcn.004b1123
add esp, 0xc
push ebx
push 0
push 0x2000000
push 3
push 0
push 7
push 0x100000
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
setne bl
cmp eax, 0xffffffff
je 0x41d36d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
pop ebx
jne 0x41d38b
push 0x208
lea eax, [ebp - 0x418]
push str.C:TEMP
push eax
call fcn.004b1123
add esp, 0xc
lea eax, [ebp - 0x418]
push eax
call fcn.004b1166
add esp, 4
cmp word [ebp - 0x418], 0
je 0x41d3e3
lea ecx, [ebp - 0x418]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41d3b0
sub ecx, edx
sar ecx, 1
cmp word [ebp + ecx*2 - 0x41a], 0x5c
je 0x41d3e3
push 0x208
lea eax, [ebp - 0x418]
push 0x4ec0fc
push eax
call fcn.004b1190
add esp, 0xc
push 0x208
lea eax, [ebp - 0x418]
push str._av_iup.tm
push eax
call fcn.004b1190
push 0x208
lea eax, [ebp - 0x418]
push str.XXXXXX
push eax
call fcn.004b1190
lea eax, [ebp - 0x418]
push eax
call fcn.004b12d7
add esp, 0x1c
cmp byte [ebp + 8], 0
je 0x41d481
push 0
lea eax, [ebp - 0x41c]
push eax
push 1
push str.S:_ML__NW___HI_
call dword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
test eax, eax
je 0x41d481
mov eax, dword [ebp - 0x41c]
xorps xmm0, xmm0
movq qword [ebp - 0x424], xmm0
mov dword [ebp - 0x424], eax
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x418]
mov dword [ebp - 0x428], 0xc
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x41d490
lea eax, [ebp - 0x418]
push eax
call fcn.004b1166
add esp, 4
cmp word [ebp - 0x418], 0
jne 0x41d49e
xor ecx, ecx
jmp 0x41d4b6
lea ecx, [ebp - 0x418]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41d4a7
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x418]
mov ecx, esi
push eax
call fcn.00413f90
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0048bc9e
mov esp, ebp
pop ebp
ret
Function at 0x41d960
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x517074]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push str.Reboot:_Restarting_windows...
push 0x51dbf8
call fcn.00414670
add esp, 8
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x20]
xor bl, bl
push eax
push 0
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x41d9c0
lea eax, [ebp - 0x20]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x41da6c
lea eax, [ebp - 0xc]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x41da1e
mov eax, dword [ebp - 0xc]
push 0
push 0
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
push 0x10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push eax
push 0
push dword [ebp - 0x20]
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x41da1e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x514
movzx ebx, bl
mov ecx, 1
cmovne ebx, ecx
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x41da6c
push 0x80040002
push 1
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownExW]
test eax, eax
jne 0x41da7e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Reboot:_InitiateSystemShutdownEx_returned_0x_08X
push 0x51dbf8
call fcn.004146b0
add esp, 0xc
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048bc9e
mov esp, ebp
pop ebp
ret
push str.Reboot:_AdjustPrivilege_for_SE_SHUTDOWN_NAME_has_failed.
push 0x51dbf8
call fcn.004146b0
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0048bc9e
mov esp, ebp
pop ebp
ret
Function at 0x41db10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x638
mov eax, dword [0x517074]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x624], 7
mov dword [ebp - 0x628], 0
mov word [ebp - 0x638], ax
cmp word [0x51e708], ax
jne 0x41db4d
xor ecx, ecx
jmp 0x41db64
mov ecx, 0x51e708
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41db55
sub ecx, edx
sar ecx, 1
push ecx
push 0x51e708
lea ecx, [ebp - 0x638]
call fcn.00413f90
cmp dword [ebp - 0x624], 8
lea ecx, [ebp - 0x620]
push 0x104
push ecx
push 0x104
lea ecx, [ebp - 0x418]
push ecx
push 0
push 0
push 0
lea eax, [ebp - 0x638]
cmovae eax, dword [ebp - 0x638]
push 0
push eax
call fcn.004b155a
add esp, 0x24
test eax, eax
jne 0x41dc4f
push eax
push 0x19
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x41dc4f
push 0x4ec0fc
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.004b2a0c
add esp, 0xc
test eax, eax
jne 0x41dc4f
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.004b2a0c
add esp, 0xc
test eax, eax
jne 0x41dc4f
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.004b2a0c
add esp, 0xc
test eax, eax
jne 0x41dc4f
cmp dword [ebp - 0x624], 8
lea eax, [ebp - 0x638]
push 0
cmovae eax, dword [ebp - 0x638]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateHardLinkW]
mov eax, dword [ebp - 0x624]
cmp eax, 8
jb 0x41dc6d
inc eax
lea ecx, [ebp - 0x638]
push eax
push dword [ebp - 0x638]
call fcn.00414120
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048bc9e
mov esp, ebp
pop ebp
ret