joyce8/EMBER2024-capa huggingface dataset:
Function at 0x461ac4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x461bfe
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00415590
mov eax, dword [ebp - 4]
cmp byte [eax + 0x30], 2
jne 0x461b40
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x461b40
lea ecx, [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00408040
mov edx, dword [ebp - 0x14]
mov ebx, dword [0x46b544]
mov ebx, dword [ebx]
mov eax, 0x461c14
call ebx
dec eax
jne 0x461b40
mov ebx, 1
jmp 0x461b42
xor ebx, ebx
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
sub eax, ebx
jl 0x461be3
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], ebx
lea ecx, [ebp - 0x1c]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x1c]
call fcn.004615d4
test al, al
jne 0x461bd7
mov eax, dword [ebp - 4]
call fcn.00461ab8
mov ebx, eax
lea ecx, [ebp - 0x20]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 0x20]
lea eax, [ebx + 0x1c]
call fcn.004040dc
xor edx, edx
push ebp
push 0x461bc5
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x30]
test al, al
je 0x461bbb
mov edx, eax
mov ecx, ebx
mov eax, dword [ebp - 4]
call fcn.00461ed8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x461bd7
inc dword [ebp - 0xc]
dec dword [ebp - 0x10]
jne 0x461b5a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461c05
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.004040ac
ret
Function at 0x406043
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
mov esi, 0x104
lea eax, [ebp - 0x120]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, esi
pop esi
jbe 0x406067
xor eax, eax
test eax, eax
je 0x406079
cmp byte [ebp + eax - 0x121], 0x5c
je 0x406079
xor ecx, ecx
jmp 0x40607c
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx + 0x409010]
lea eax, [ebp + eax - 0x120]
push ecx
push str._s_s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x120]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
leave
ret 4

Function at 0x406120
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422af4], 0
push esi
jne 0x406157
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406131
mov dword [ecx*4 + 0x422af0], eax
inc ecx
cmp ecx, 0x100
jl 0x40612c
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406188
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422af0]
xor eax, esi
inc ecx
dec edx
jne 0x40616a
pop edi
not eax
pop esi
ret 0xc

Function at 0x401215
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push esi
mov esi, dword [sym.imp.USER32.dll_LoadIconA]
push edi
push 0x7f00
xor edi, edi
push edi
mov dword [ebp - 0x24], str.construct
mov dword [ebp - 0x44], 0x401000
mov dword [ebp - 0x48], 3
mov dword [ebp - 0x4c], 0x30
call esi
push 0x7f00
push edi
mov dword [ebp - 0x34], eax
call esi
push 0x7f00
push edi
mov dword [ebp - 0x20], eax
call dword [sym.imp.USER32.dll_LoadCursorW]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push edi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
call esi
push edi
mov dword [0x4030f0], eax
mov dword [ebp - 0x38], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExA]
test ax, ax
je 0x401327
push 1
push dword [0x4030f0]
call dword [sym.imp.USER32.dll_LoadBitmapA]
push edi
push edi
call esi
push eax
push edi
push edi
push 0x80000000
push 0x80000000
push 0x80000000
push 0x80000000
push 0xcf0000
push str.displayed
push str.construct
push edi
call dword [sym.imp.USER32.dll_CreateWindowExA]
push 0
push eax
mov dword [0x4030f8], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
push edi
push edi
push edi
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
je 0x401327
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [ebp - 0x1c]
push eax
call edi
lea ecx, [ebp - 0x1c]
push ecx
call ebx
push 0
push 0
push 0
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
jne 0x40130a
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40300d
Capabilities:
Terminate process

Disassembly:
mov dword [0x402020], eax
call dword [sym.imp.kernel32.dll_GetTickCount]
call dword [sym.imp.kernel32.dll_GetVersion]
mov edx, eax
xor edi, edi
xor esi, esi
push dword [0x4035d8]
call dword [sym.imp.winmm.dll_waveInClose]
add eax, 6
test eax, 0xb
jne 0x403046
push 0
call dword [sym.imp.kernel32.dll_ExitProcess]
mov edx, eax
ret
Function at 0x404257
Capabilities:
Delete file
Read .ini file

Disassembly:
mov eax, 0x1004
call fcn.00406600
mov eax, dword [0x40c17c]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
push ebp
push esi
push edi
push dword [0x40dbec]
mov edi, dword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
mov ebp, 0x1000
push ebp
lea eax, [esp + 0x18]
push eax
mov ebx, 0x4074e8
push ebx
push str.title
mov esi, 0x4083d8
push esi
call edi
push 0x50
pop ecx
lea eax, [esp + 0x10]
mov edx, 0x40c620
call fcn.0040632d
push dword [0x40dbec]
lea eax, [esp + 0x14]
push ebp
push eax
push ebx
push str.info
push esi
call edi
mov ecx, ebp
lea eax, [esp + 0x10]
mov edx, 0x40ca40
call fcn.0040632d
push dword [0x40dbec]
push 0x50
push 0x40da80
push ebx
push str.build_info
push esi
call edi
push dword [0x40dbec]
mov ebp, dword [sym.imp.kernel32.dll_GetPrivateProfileIntA]
push 1
push str.target_compile
push esi
call ebp
push dword [0x40dbec]
mov dword [0x40c674], eax
push 1
push str.target_optimize
push esi
call ebp
push dword [0x40dbec]
mov dword [0x40c670], eax
push 0xa
push 0x40da50
push ebx
push str.target_version
push esi
call edi
push dword [0x40dbec]
push 0x50
push 0x40c7a0
push ebx
push str.name
push str.metadata
call edi
push dword [0x40dbec]
push 0x104
push 0x40c680
push ebx
push str.install_script
push esi
call edi
push 0x40c620
call fcn.00402490
push eax
mov dword [0x40da40], eax
call fcn.0040632d
pop ecx
pop ecx
push dword [0x40dad4]
call dword [sym.imp.kernel32.dll_UnmapViewOfFile]
mov eax, dword [0x40dbec]
test eax, eax
pop edi
pop esi
pop ebp
pop ebx
je 0x404399
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov eax, dword [0x40dbf0]
test eax, eax
je 0x4043a9
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [esp + 0x1000]
xor ecx, esp
xor eax, eax
call fcn.004065b0
add esp, 0x1004
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x40344c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x40345b
pop dword [ebp - 0x4c]
mov eax, 0xf8968963
sub eax, 0xf8565508
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x49df1ba7
add dword [ebp - 0x5c], 0x47329a4
mov dword [ebp - 0x58], 0xfe0b2c02
add dword [ebp - 0x58], 0x34282043
mov dword [ebp - 0x54], 0xe157b61d
sub dword [ebp - 0x54], 0x950b71ef
mov dword [ebp - 0x50], 0x916e8db9
add dword [ebp - 0x50], 0x6e917247
lea eax, [ebp - 0x5c]
push eax
mov eax, 0xef1d4020
sub eax, 0xeedcffcc
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x9945858f
add dword [ebp - 0x5c], 0xdb2ce3c7
mov dword [ebp - 0x58], 0x74d78984
add dword [ebp - 0x58], 0xcc94d7f1
mov dword [ebp - 0x54], 0x930c32cf
add dword [ebp - 0x54], 0xd063399d
mov dword [ebp - 0x50], 0x52dc042e
sub dword [ebp - 0x50], 0x52dc042e
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0xd27644c8
add eax, 0x2dc9fb88
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x38603
push 0
call eax
mov ecx, 0xf5dc5763
sub ecx, 0xf5dc0958
mov ebx, eax
mov edi, 0xb87dbaad
sub edi, 0xb83d36ad
add edi, dword [ebp - 0x4c]
mov edx, 0x170c8288
sub edx, 0xfb3bf68b
mov dword [ebp - 0x18], 0x192820d
mov esi, dword [edi]
add esi, edx
xor dword [ebp - 4], 0x3c36a8b2
mov dword [ebx], esi
xor dword [ebp - 0xc], 0x63de94a7
add ebx, 0x14c2ab9f
add ebx, 0xeb3d5465
add edi, 0xd040c88e
sub edi, 0xd040c88a
loop 0x40357d
add eax, 0x19dbe6ce
add eax, 0xe6254431
xor ebx, ebx
add ebx, eax
add eax, 0x26802d6c
add eax, 0xd97fd299
mov ecx, 0xeb120408
add ecx, 0x152dfbf8
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x401320
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x42a044]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
xor eax, eax
mov word [ebp - 0x134], ax
mov dword [ebp - 0x130], 0
push 0x118
push 0
lea ecx, [ebp - 0x12c]
push ecx
call fcn.00417a40
add esp, 0xc
mov dword [ebp - 0x130], 0x11c
lea edx, [ebp - 0x130]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40141a
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x128]
mov dword [ebp - 8], ecx
mov dx, word [ebp - 0x1c]
mov word [ebp - 0x134], dx
cmp dword [ebp - 0xc], 5
jne 0x4013cc
cmp dword [ebp - 8], 0
jne 0x4013cc
movzx eax, word [ebp - 0x134]
cmp eax, 4
jl 0x4013cc
mov dword [ebp - 4], 1
cmp dword [ebp - 0xc], 5
jne 0x4013df
cmp dword [ebp - 8], 2
jne 0x4013df
mov dword [ebp - 4], 2
cmp dword [ebp - 0xc], 5
jne 0x4013f8
cmp dword [ebp - 8], 2
jae 0x4013f1
cmp dword [ebp - 8], 1
jne 0x4013f8
mov dword [ebp - 4], 3
cmp dword [ebp - 0xc], 6
jne 0x40141a
cmp dword [ebp - 8], 0
jne 0x40140d
mov dword [ebp - 4], 4
jmp 0x40141a
cmp dword [ebp - 8], 1
jne 0x40141a
mov dword [ebp - 4], 5
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004109f5
mov esp, ebp
pop ebp
ret

Function at 0x4018e0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 4], 0xffffffff
push 0
push 0
push 3
push 0
push 3
push connect
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x40191e
or eax, 0xffffffff
or edx, 0xffffffff
jmp 0x40194d
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp eax, 1
jne 0x40193d
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x401ec0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
mov eax, dword [0x42a044]
xor eax, ebp
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x138], 0x114
lea eax, [ebp - 0x138]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x134], 5
jne 0x401f62
mov ecx, dword [ebp - 0x130]
mov dword [ebp - 0x140], ecx
cmp dword [ebp - 0x140], 0
je 0x401f1c
cmp dword [ebp - 0x140], 1
je 0x401f2c
cmp dword [ebp - 0x140], 2
je 0x401f49
jmp 0x401f59
mov dword [ebp - 0xc], 0xa0
mov dword [ebp - 0x10], 0xa4
jmp 0x401f60
push 0x427c94
call fcn.00411439
add esp, 4
mov dword [ebp - 0xc], 0x88
mov dword [ebp - 0x10], 0x8c
jmp 0x401f60
mov dword [ebp - 0xc], 0x8a
mov dword [ebp - 0x10], 0x8e
jmp 0x401f60
xor eax, eax
jmp 0x4020aa
jmp 0x401f94
cmp dword [ebp - 0x134], 4
jne 0x401f8d
cmp dword [ebp - 0x130], 0
jne 0x401f8d
cmp dword [ebp - 0x128], 2
jne 0x401f8d
mov dword [ebp - 0xc], 0x98
mov dword [ebp - 0x10], 0x9c
jmp 0x401f94
xor eax, eax
jmp 0x4020aa
mov dword [ebp - 8], 0xffffffff
mov edx, dword [ebp + 8]
push edx
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x401fbc
xor eax, eax
jmp 0x4020aa
mov eax, dword [ebp + 8]
push eax
call fcn.00401d00
add esp, 4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x401fd8
xor eax, eax
jmp 0x4020aa
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
push ecx
push 0x427c9c
call fcn.00411439
add esp, 8
mov edx, dword [ebp - 4]
push edx
push 0x427cac
call fcn.00411439
add esp, 8
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x13c], eax
mov ecx, dword [ebp - 0x13c]
push ecx
call fcn.004111dc
add esp, 4
push 0x427cbc
call fcn.00411439
add esp, 4
push 4
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
push eax
call fcn.00401e30
add esp, 0xc
test eax, eax
je 0x40209e
push 4
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x10]
push edx
call fcn.00401e30
add esp, 0xc
test eax, eax
je 0x40209c
push 4
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
add ecx, 4
push ecx
call fcn.00401e70
add esp, 0xc
test eax, eax
je 0x40209c
push 4
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x14]
push eax
call fcn.00401e70
add esp, 0xc
test eax, eax
je 0x40209c
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x4020aa
jmp 0x4020aa
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.004109f5
mov esp, ebp
pop ebp
ret
Function at 0x4020c0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4020f5
push 1
push 0x427cd0
mov ecx, dword [ebp - 4]
push ecx
call fcn.00401bb0
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x402105
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4038b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x42a044]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
xor eax, eax
mov word [ebp - 0x2c], ax
xor ecx, ecx
mov dword [ebp - 0x2a], ecx
mov dword [ebp - 0x26], ecx
mov dword [ebp - 0x22], ecx
mov dword [ebp - 0x1e], ecx
mov dword [ebp - 0x1a], ecx
mov dword [ebp - 0x16], ecx
mov dword [ebp - 0x12], ecx
mov word [ebp - 0xe], cx
push 0x68
push 0
lea edx, [ebp - 0x98]
push edx
call fcn.00417a40
add esp, 0xc
mov eax, dword [ebp + 0xc]
push eax
push 0x20
lea ecx, [ebp - 0x98]
push ecx
call fcn.00410a30
add esp, 0xc
mov edx, dword [ebp + 0x14]
mov dword [ebp - 0x34], edx
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.00401070
add esp, 8
lea edx, [ebp - 0x2c]
push edx
push 0x10
lea eax, [ebp - 0x56]
push eax
call fcn.00410a30
add esp, 0xc
lea ecx, [ebp - 0x98]
mov dword [ebp - 0x9c], ecx
mov dword [ebp - 0xa0], 0
jmp 0x403969
mov edx, dword [ebp - 0xa0]
add edx, 1
mov dword [ebp - 0xa0], edx
cmp dword [ebp - 0xa0], 0x68
jae 0x403993
mov eax, dword [ebp - 0x9c]
add eax, dword [ebp - 0xa0]
movzx ecx, byte [eax]
not ecx
mov edx, dword [ebp - 0x9c]
add edx, dword [ebp - 0xa0]
mov byte [edx], cl
jmp 0x40395a
push 0x42791c
mov eax, dword [ebp + 8]
push eax
call fcn.00410b65
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4039b1
jmp 0x4039cf
mov ecx, dword [ebp - 8]
push ecx
push 0x68
push 1
mov edx, dword [ebp - 0x9c]
push edx
call fcn.00411ce8
add esp, 0x10
mov dword [ebp - 4], 1
cmp dword [ebp - 8], 0
je 0x4039e1
mov eax, dword [ebp - 8]
push eax
call fcn.00410c46
add esp, 4
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004109f5
mov esp, ebp
pop ebp
ret

Function at 0x403a00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x403a58
mov edx, dword [ebp + 8]
push edx
call fcn.004018e0
add esp, 4
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x10]
jne 0x403a58
mov dword [ebp - 0xc], 1
mov dword [ebp - 4], 1
cmp dword [ebp - 0xc], 0
jne 0x403ac6
push 0x200000
call fcn.00411236
add esp, 4
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 0x200000
lea ecx, [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 0x30]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00402130
add esp, 0x10
test eax, eax
je 0x403aba
mov edx, dword [ebp - 0x2c]
push edx
mov eax, dword [ebp - 0x30]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00408e90
add esp, 0xc
cmp eax, 1
jne 0x403ab3
mov dword [ebp - 4], 1
jmp 0x403aba
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x30]
push edx
call fcn.004113ab
add esp, 4
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x403d30
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64c
mov eax, dword [0x42a044]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x620], ax
push 0x206
push 0
lea ecx, [ebp - 0x61e]
push ecx
call fcn.00417a40
add esp, 0xc
xor edx, edx
mov word [ebp - 0x418], dx
push 0x206
push 0
lea eax, [ebp - 0x416]
push eax
call fcn.00417a40
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0x210], cx
push 0x206
push 0
lea edx, [ebp - 0x20e]
push edx
call fcn.00417a40
add esp, 0xc
xor eax, eax
mov word [ebp - 0x640], ax
xor ecx, ecx
mov dword [ebp - 0x63e], ecx
mov dword [ebp - 0x63a], ecx
mov dword [ebp - 0x636], ecx
mov dword [ebp - 0x632], ecx
mov dword [ebp - 0x62e], ecx
mov dword [ebp - 0x62a], ecx
mov dword [ebp - 0x626], ecx
mov word [ebp - 0x622], cx
lea edx, [ebp - 0x418]
push edx
call fcn.00401000
add esp, 4
push 0x4279ec
push 0x104
lea eax, [ebp - 0x418]
push eax
call fcn.004114fe
add esp, 0xc
mov ecx, dword [0x42e0ca]
push ecx
mov edx, dword [0x42e0c6]
push edx
push 0x42e0ce
lea eax, [ebp - 0x418]
push eax
call fcn.004038b0
add esp, 0x10
mov dword [ebp - 0x648], 0
mov dword [ebp - 0x644], 0
lea ecx, [ebp - 0x620]
push ecx
call fcn.00401000
add esp, 4
push 0x427a00
push 0x104
lea edx, [ebp - 0x620]
push edx
call fcn.004114fe
add esp, 0xc
push 0x42e10e
push 0x104
lea eax, [ebp - 0x620]
push eax
call fcn.004114fe
add esp, 0xc
push 0x427a04
push 0x104
lea ecx, [ebp - 0x620]
push ecx
call fcn.004114fe
add esp, 0xc
lea edx, [ebp - 0x644]
push edx
push 0x427a10
push 0x83
call fcn.004058c0
add esp, 0xc
mov dword [ebp - 0x648], eax
cmp dword [ebp - 0x648], 0
jne 0x403ec0
jmp 0x403f0d
mov eax, dword [ebp - 0x644]
push eax
mov ecx, dword [ebp - 0x648]
push ecx
lea edx, [ebp - 0x620]
push edx
call fcn.00403a00
add esp, 0xc
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push 0
push 0x427a28
lea eax, [ebp - 0x620]
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x648], 0
je 0x403f31
mov ecx, dword [ebp - 0x648]
mov dword [ebp - 0x64c], ecx
mov edx, dword [ebp - 0x64c]
push edx
call fcn.004111dc
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004109f5
mov esp, ebp
pop ebp
ret
Function at 0x404c20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50c
mov eax, dword [0x42a044]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
movzx eax, byte [0x42dfcb]
cmp eax, 2
jne 0x404c46
jmp 0x404d95
xor ecx, ecx
mov word [ebp - 0x388], cx
push 0x206
push 0
lea edx, [ebp - 0x386]
push edx
call fcn.00417a40
add esp, 0xc
mov dword [ebp - 0x508], 0
mov dword [ebp - 0x50c], 0
mov dword [ebp - 0x504], 0xffffffff
mov dword [ebp - 0x390], 0
mov dword [ebp - 0x38c], 0
mov dword [ebp - 0x17c], 0
push 0x427b04
call fcn.00408fb0
add esp, 4
push 0x427b20
call fcn.00408fb0
add esp, 4
push 0x427b4c
call fcn.00408fb0
add esp, 4
push 0x104
lea eax, [ebp - 0x388]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
movzx ecx, word [ebp - 0x388]
sub ecx, 0x41
mov dword [ebp - 0x508], ecx
lea edx, [ebp - 0x50c]
push edx
mov eax, dword [ebp - 0x508]
push eax
call fcn.00405630
add esp, 8
mov dword [ebp - 0x390], eax
mov ecx, dword [ebp - 0x50c]
push ecx
call fcn.004054c0
add esp, 4
mov dword [ebp - 0x504], eax
cmp dword [ebp - 0x504], 0xffffffff
jne 0x404d28
jmp 0x404d95
lea edx, [ebp - 0x178]
push edx
call fcn.00405b50
add esp, 4
test eax, eax
jne 0x404d3f
jmp 0x404d95
mov eax, dword [ebp - 0x504]
push eax
call fcn.00404e50
add esp, 4
mov ecx, dword [ebp - 0x178]
mov dword [ebp - 0x17c], ecx
mov ecx, 0x5b
lea esi, [ebp - 0x178]
lea edi, [ebp - 0x500]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edx, dword [ebp - 0x17c]
mov dword [ebp - 0x500], edx
push 0
push 0x1e
lea eax, [ebp - 0x500]
push eax
mov ecx, dword [ebp - 0x504]
push ecx
call fcn.00405d90
add esp, 0x10
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004109f5
mov esp, ebp
pop ebp
ret

Function at 0x4050a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
mov dword [ebp - 0x24], 0
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 0xffffffff
jne 0x4050d3
jmp 0x405124
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
push 0
push 0x200
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00415d20
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp + 0x10]
shl eax, 9
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x405340
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
mov dword [ebp - 0x24], 0
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 0xffffffff
jne 0x405373
jmp 0x4053c4
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
push 0
push 0x200
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00415d20
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp + 0x10]
shl eax, 9
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret