joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100d633
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor edi, edi
push 0xfffffffffffffff5
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebx, eax
mov dword [ebp - 8], ebx
cmp ebx, 0xffffffff
je 0x100d77c
cmp ebx, edi
je 0x100d77c
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push dword [ebp + 0xc]
call fcn.0100d5ab
mov esi, eax
test esi, esi
jl 0x100d7aa
push ebx
call fcn.0100e805
test eax, eax
je 0x100d6bf
push dword [ebp - 4]
push dword [ebp + 0xc]
push ebx
call fcn.0100d471
test eax, eax
je 0x100d69b
xor esi, esi
jmp 0x100d7aa
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x100d6b3
jle 0x100d6b8
and eax, 0xffff
or eax, 0x80070000
jmp 0x100d6b8
mov eax, 0x80004005
mov esi, eax
jmp 0x100d7aa
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp - 4]
push 2
pop ecx
inc eax
mul ecx
push edx
push eax
call fcn.0100bd73
mov esi, eax
test esi, esi
jl 0x100d7aa
push dword [ebp + 8]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x100d6ff
mov esi, 0x8007000e
jmp 0x100d796
push edi
push dword [ebp + 0xc]
mov byte [edi], 0
call dword [sym.imp.USER32.dll_CharToOemW]
mov ebx, 0x80070000
test eax, eax
jne 0x100d735
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x100d72a
jle 0x100d72f
and eax, 0xffff
or eax, ebx
jmp 0x100d72f
mov eax, 0x80004005
mov esi, eax
test eax, eax
jl 0x100d796
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
push edi
call fcn.0100d4e0
mov esi, eax
test esi, esi
jl 0x100d796
xor esi, esi
push esi
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0xc]
push edi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x100d796
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
je 0x100d775
jle 0x100d794
and eax, 0xffff
or eax, ebx
jmp 0x100d794
mov eax, 0x80004005
jmp 0x100d794
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x100d6b8
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test edi, edi
je 0x100d7aa
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x100dddb
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x1013b58]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
push ebx
push edi
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], 0x3a
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x800
push 0
stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
jne 0x100de30
mov dword [ebp - 0x1c], 0x8007000e
jmp 0x100df15
push esi
push 8
push ebx
push 0x1e
xor eax, eax
mov esi, 0x400
push esi
mov word [ebx], ax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp eax, 1
jle 0x100de63
push ebx
push 8
lea eax, [ebp - 0x14]
push eax
call fcn.01007d23
mov dword [ebp - 0x1c], eax
test eax, eax
jl 0x100df04
push dword [ebp - 0x18]
push esi
push ebx
call fcn.01007d23
mov dword [ebp - 0x1c], eax
test eax, eax
jl 0x100df04
mov esi, dword [sym.imp.msvcrt.dll_wcstok]
lea eax, [ebp - 0x14]
push eax
push ebx
call esi
and dword [ebp - 0x18], 0
pop ecx
pop ecx
lea edi, [ebp - 0x2c]
test eax, eax
je 0x100deb6
push edi
push eax
call fcn.0100db7b
inc dword [ebp - 0x18]
add edi, 4
mov dword [ebp - 0x1c], eax
test eax, eax
jl 0x100df04
lea eax, [ebp - 0x14]
push eax
push 0
call esi
cmp dword [ebp - 0x18], 3
pop ecx
pop ecx
jb 0x100de8e
mov eax, dword [ebp - 0x18]
dec eax
je 0x100def9
dec eax
je 0x100dee4
dec eax
je 0x100decb
mov dword [ebp - 0x1c], 0x80070057
jmp 0x100df04
mov cx, word [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov word [eax + 0x64], cx
mov cx, word [ebp - 0x28]
mov word [eax + 0x66], cx
mov cx, word [ebp - 0x24]
jmp 0x100def3
mov cx, word [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov word [eax + 0x66], cx
mov cx, word [ebp - 0x28]
mov word [eax + 0x68], cx
jmp 0x100df04
mov ax, word [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
mov word [ecx + 0x68], ax
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1c]
pop edi
xor ecx, ebp
pop ebx
call fcn.0100b071
leave
ret 8
Function at 0x100ed25
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x1013b58]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor edi, edi
cmp dword [0x1014008], edi
jne 0x100ee41
push esi
mov esi, 0x11c
push esi
lea eax, [ebp - 0x120]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
test eax, eax
jne 0x100ed8c
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x114
call esi
mov eax, dword [ebp - 0x110]
dec eax
mov dword [0x1014008], edi
pop esi
je 0x100ee14
dec eax
jne 0x100ee41
cmp dword [ebp - 0x11c], 5
jne 0x100ee01
mov eax, dword [ebp - 0x118]
sub eax, edi
je 0x100edf5
dec eax
je 0x100ede2
dec eax
je 0x100edc8
mov dword [0x1014008], 0x14
jmp 0x100ee41
cmp word [ebp - 0xc], 1
jb 0x100edd9
mov dword [0x1014008], 0x10
or dword [0x1014008], 4
jmp 0x100ee41
cmp word [ebp - 0xc], 2
jb 0x100edd9
mov dword [0x1014008], 8
jmp 0x100edd9
mov dword [0x1014008], 4
jmp 0x100ee41
cmp dword [ebp - 0x11c], 4
ja 0x100ee53
mov dword [0x1014008], 2
cmp dword [ebp - 0x11c], 4
jne 0x100ee41
cmp dword [ebp - 0x118], edi
je 0x100ee37
cmp dword [ebp - 0x118], 0xa
je 0x100ee37
cmp dword [ebp - 0x118], 0x5a
jne 0x100ee41
mov dword [0x1014008], 1
mov ecx, dword [ebp - 4]
mov eax, dword [0x1014008]
xor ecx, ebp
pop edi
call fcn.0100b071
leave
ret
mov dword [0x1014008], 0x20
jmp 0x100ee41

Function at 0x100ee64
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x1013b58]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x20
lea eax, [ebp - 0x44]
push eax
push 8
push 0x404
mov esi, 0xc04
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100eeb8
push 3
lea eax, [ebp - 0x44]
push 0x1002378
push eax
call sub.msvcrt.dll_wcsncmp
add esp, 0xc
mov esi, eax
neg esi
sbb esi, esi
and esi, 0xfffff800
add esi, 0xc04
mov ecx, dword [ebp - 4]
mov ax, si
xor ecx, ebp
pop esi
call fcn.0100b071
leave
ret

Function at 0x100eecd
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1013b58]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
cmp ax, word [0x101400c]
jne 0x100ef68
push esi
lea eax, [ebp - 0x10]
push eax
push 1
xor esi, esi
push esi
push 0x10022a8
push 0x80000002
mov dword [ebp - 0x14], 6
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100ef67
push edi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push 0x1002360
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
pop edi
jne 0x100ef67
push 3
push dword [esi*8 + 0x10020f8]
lea eax, [ebp - 0xc]
push eax
call sub.msvcrt.dll__wcsnicmp
add esp, 0xc
test eax, eax
je 0x100ef59
inc esi
cmp esi, 0x1c
jb 0x100ef38
jmp 0x100ef67
mov ax, word [esi*8 + 0x10020fc]
mov word [0x101400c], ax
pop esi
mov ecx, dword [ebp - 4]
mov ax, word [0x101400c]
xor ecx, ebp
call fcn.0100b071
leave
ret
Function at 0x6ade20
Capabilities:
Encode data using xor

Disassembly:
stc
push dword [edi]
pop dword [esp + 0x28]
stc
cmc
test cx, dx
cmp edi, ebx
push dword [esp + 0xc]
jmp 0x7bd62c
push dword [esp + 4]
pushfd
lea esp, [esp + 0x34]
ja 0x6b2bd4
push edx
push ebx
neg al
sub ebx, edi
lea edi, [edx*4 - 0x37f097b2]
add esp, 8
add ebx, esp
mov di, 0x8983
add di, ax
adc di, 0x6473
mov edi, ebx
shr al, 3
mov al, 0x2e
bt bx, 0xb
cmc
call fcn.006b72ec
pop es
xor esi, dword [ebx + ebx*2 + 0x4a]
insd dword es:[edi], dx
movsd dword es:[edi], dword [esi]
adc al, 0x44
invalid

Function at 0x4cc06c
Capabilities:
Move file

Disassembly:
mov ecx, sym.imp.gdi32.dll_DeleteDC
call ecx
mov ecx, sym.imp.kernel32.dll_MoveFileW
call ecx
jmp 0x4cacf0
pop edi
xor esi, edi
push esi
mov ebx, 0x57140a9c
xor ebx, 0x4fcda624
pop edx
xor ebx, edx
mov esi, 0x5c45c0a9
mov ecx, 0x5c45c08b
xor ecx, esi
mov esi, 0x147b774f
mov edx, 0x147b7747
xor edx, esi
xor ecx, edx
xor ebx, ecx
xor eax, ebx
and eax, 0x7ff
xor ebx, ebx
add ebx, eax
or ebx, ebx
jne 0x4cacf0
call fcn.004ccae6
push eax
push esi
add esp, 0xc
xor ecx, esi
xor ebx, ecx
mov esi, ebx
add esp, 0xfffffffc
mov dword [esp], esi
pop edi
add esp, 0xfffffffc
mov dword [esp], edi
pop ecx
sub ecx, 0
je 0x4cbf16
pop eax
xor ebx, ebx
add ebx, eax
mov edx, ebx
add esp, 0xfffffffc
xor edi, edi
add edi, esp
mov dword [edi], edx
push 0x5fb2e654
mov esi, 0x476b42bd
jmp 0x4cbd8a
Function at 0x403100
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c0c51
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x4d8620]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.00402fb0
xor ebx, ebx
mov dword [esp + 0x18], ebx
lea ecx, [esi + 0x30]
call fcn.0042eaa0
mov byte [esp + 0x18], 1
lea ecx, [esi + 0x1ef0]
call fcn.0045d160
mov byte [esp + 0x18], 2
mov eax, dword [esp + 0x20]
mov byte [esi + 0x1eec], bl
mov byte [esi + 0x1eed], bl
mov dword [esi + 0x1ed8], ebx
mov dword [esi + 0x1ee0], ebx
mov dword [esi + 0x1ee4], ebx
mov dword [esi + 0x1ee8], ebx
mov dword [esi + 0x28], eax
mov dword [esi + 0x1f4c], esi
mov dword [esp + 0x18], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret 4

Function at 0x406a50
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x2e0
mov eax, dword [0x4d8620]
xor eax, esp
mov dword [esp + 0x2dc], eax
push ebx
push ebp
mov ebp, dword [esp + 0x2fc]
push esi
push edi
mov edi, dword [esp + 0x2f4]
mov ebx, ecx
push 0x808
mov dword [esp + 0x38], ebx
call fcn.004afbd0
mov ecx, dword [esp + 0x300]
mov esi, eax
mov eax, dword [esp + 0x2fc]
add esp, 4
push edi
mov dword [esi], eax
mov dword [esi + 4], ecx
call fcn.0046ef00
lea edx, [esi + 8]
movzx ecx, word [eax]
mov word [edx], cx
add eax, 2
add edx, 2
test cx, cx
jne 0x406aa7
cmp dword [ebx + 4], 0x50000
jb 0x406ad7
call fcn.00442d90
cmp eax, 0x400
je 0x406ad7
cmp byte [esp + 0x310], 0
jne 0x406b22
mov ebx, dword [esp + 0x300]
cmp ebx, 0xffffffff
je 0x406ae7
test ebp, ebp
jne 0x406b29
cmp dword [esp + 0x2f8], 2
mov eax, 0x4201
jne 0x406afb
mov eax, 0x4203
push eax
push 0x2b4
lea edx, [esp + 0x40]
push edx
push 0
push edi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
cmp ebx, 0xffffffff
jne 0x406b18
mov ebx, dword [esp + 0x3c]
test ebp, ebp
jne 0x406b29
lea ebp, [esp + 0x44]
jmp 0x406b29
mov ebx, dword [esp + 0x300]
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x10], 0x37
mov dword [esp + 0x18], ebp
test ebp, ebp
jne 0x406b67
mov dword [esp + 0x18], 0xffffffff
mov eax, dword [esp + 0x30c]
mov ecx, dword [esp + 0x308]
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x38]
push 0
mov dword [esp + 0x34], ecx
mov ecx, dword [eax]
push 0x40b
push ecx
mov dword [esp + 0x40], esi
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esp + 0x2ec]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004aedbb
add esp, 0x2e0
ret 0x20
Function at 0x407710
Capabilities:
Get common file path
Get file system object information

Disassembly:
sub esp, 0x2d4
mov eax, dword [0x4d8620]
xor eax, esp
mov dword [esp + 0x2d0], eax
push ebx
mov ebx, dword [esp + 0x2e0]
push esi
mov esi, ecx
cmp dword [esi + 4], 0
push edi
mov edi, dword [esp + 0x2e4]
jne 0x40774a
push str.comctl32.dll
call fcn.00489ac0
mov dword [esi + 4], eax
mov eax, dword [esi]
test eax, eax
je 0x407757
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
mov dword [esi + 8], 0xffffffff
mov eax, dword [0x5138fc]
push eax
push ebx
push edi
push 0xdc
push 0x3c
push 0
push 0
push 0x44200046
push 0
push str.ComboBoxEx32
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
lea ecx, [esp + 0x10]
push ecx
push 0
push 0
mov dword [esi], eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jne 0x4077fb
mov eax, dword [esp + 0x10]
push 0x4209
push 0x2b4
lea edx, [esp + 0x1c]
push edx
push 0
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov ecx, dword [esi]
push eax
push 0
push 0x402
push ecx
call edi
mov eax, dword [0x5662e4]
mov ecx, dword [esp + 0x10]
mov edx, dword [eax]
mov edx, dword [edx + 0x14]
push ecx
push eax
call edx
mov ecx, dword [esp + 0x18]
push 0
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x2c]
push eax
push ecx
push 0
push 1
mov edx, eax
push edx
mov ecx, esi
call fcn.00406a50
mov eax, dword [esi]
push 0
push 4
push 0x408
push eax
call edi
mov ecx, dword [esi]
push 0
push 0
push 0x407
push ecx
call edi
test eax, eax
je 0x407821
push eax
call fcn.0048afa0
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x10], 0
call dword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
test eax, eax
jne 0x40784a
push eax
push eax
mov eax, dword [esp + 0x14]
push eax
mov ecx, esi
call fcn.00406ef0
test al, al
jne 0x4078a8
push ebp
call fcn.00489e00
mov ebp, eax
xor edi, edi
mov ebx, 1
lea esp, [esp]
test ebp, ebx
je 0x40789f
lea ecx, [edi + 0x41]
push ecx
lea edx, [esp + 0x2d0]
push 0x4c5878
push edx
mov edx, 0xa
call fcn.004a5ca0
add esp, 0xc
push 1
push 0xffffffffffffffff
push 2
push 0
push 0xffffffffffffffff
push 0
push 0
lea eax, [esp + 0x2e8]
push eax
mov ecx, esi
call fcn.00406a50
inc edi
rol ebx, 1
cmp edi, 0x20
jl 0x407860
pop ebp
mov ecx, esi
call fcn.00407470
mov ecx, dword [esp + 0x2dc]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004aedbb
add esp, 0x2d4
ret 8
Function at 0x4078d0
Capabilities:
Check if file exists
Get file attributes
Get graphical window text

Disassembly:
sub esp, 0x804
mov eax, dword [0x4d8620]
xor eax, esp
mov dword [esp + 0x800], eax
push esi
push edi
push 0x400
mov esi, ecx
mov ecx, dword [esi]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea edx, [esp + 8]
push edx
call fcn.0044a940
mov ecx, dword [esi]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [esp + 8]
push eax
push 0xffffffffffffffff
push 0x158
push ecx
call edi
cmp eax, 0xffffffff
je 0x407978
mov edx, dword [esi]
push 0
push eax
push 0x14e
push edx
call edi
mov ecx, esi
call fcn.004075f0
cmp byte [0x526d89], 0
mov ecx, esi
je 0x40795c
call fcn.00407240
pop edi
pop esi
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.004aedbb
add esp, 0x804
ret
call fcn.00406e60
pop edi
pop esi
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.004aedbb
add esp, 0x804
ret
cmp byte [0x526d89], 0
je 0x4079b5
lea eax, [esp + 8]
push eax
call fcn.00456e50
test al, al
jne 0x4079b5
lea ecx, [esp + 8]
push ecx
mov ecx, 0x52d6c0
call fcn.00448760
pop edi
pop esi
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.004aedbb
add esp, 0x804
ret
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4079ef
test al, 0x10
jne 0x4079ef
lea eax, [esp + 8]
push eax
mov ecx, 0x52d6c0
call fcn.004485c0
pop edi
pop esi
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.004aedbb
add esp, 0x804
ret
lea ecx, [esp + 8]
push ecx
call fcn.004925f0
mov ecx, dword [esp + 0x808]
pop edi
pop esi
xor ecx, esp
call fcn.004aedbb
add esp, 0x804
ret
Function at 0x407a10
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x2bc
mov eax, dword [0x4d8620]
xor eax, esp
mov dword [esp + 0x2b8], eax
mov ecx, dword [esp + 0x2c4]
mov eax, dword [esp + 0x2c0]
push edi
mov edi, dword [esp + 0x2d0]
cmp ecx, 0x4e
jne 0x407b24
mov eax, dword [edi + 8]
cmp eax, 0xfffffcd9
je 0x407a81
cmp eax, 0xfffffcda
jne 0x407a67
cmp dword [edi + 0x21c], 2
jne 0x407a67
mov ecx, 0x52d6b0
call fcn.004078d0
xor eax, eax
pop edi
mov ecx, dword [esp + 0x2b8]
xor ecx, esp
call fcn.004aedbb
add esp, 0x2bc
ret 0x10
mov ecx, dword [edi + 0x2c]
mov eax, dword [ecx]
mov edx, dword [edi + 0xc]
push ebx
push ebp
push esi
mov dword [esp + 0x10], edx
cmp eax, 4
jne 0x407a9a
mov ebp, dword [ecx + 4]
jmp 0x407a9d
lea ebp, [ecx + 8]
mov ebx, dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
xor ecx, ecx
cmp eax, 4
setne cl
dec ecx
and ecx, 8
mov esi, ecx
test dl, 1
je 0x407ad9
mov edx, esi
or edx, 0x200
push edx
push 0x2b4
lea eax, [esp + 0x1c]
push eax
push 0
push ebp
call ebx
test eax, eax
je 0x407ad9
lea ecx, [esp + 0x20]
mov dword [edi + 0x14], ecx
test byte [esp + 0x10], 6
je 0x407b00
or esi, 0x4001
push esi
push 0x2b4
lea edx, [esp + 0x1c]
push edx
push 0
push ebp
call ebx
mov eax, dword [esp + 0x18]
mov dword [edi + 0x20], eax
mov dword [edi + 0x1c], eax
or dword [edi + 0xc], 0x10000000
pop esi
pop ebp
pop ebx
xor eax, eax
pop edi
mov ecx, dword [esp + 0x2b8]
xor ecx, esp
call fcn.004aedbb
add esp, 0x2bc
ret 0x10
mov edx, dword [esp + 0x2cc]
push edi
push edx
push ecx
push eax
call dword [sym.imp.USER32.dll_DefWindowProcW]
mov ecx, dword [esp + 0x2bc]
pop edi
xor ecx, esp
call fcn.004aedbb
add esp, 0x2bc
ret 0x10
Function at 0x4097e0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x304
mov eax, dword [0x4d8620]
xor eax, esp
mov dword [esp + 0x300], eax
push ebx
push esi
xor ecx, ecx
mov eax, 1
push edi
mov edi, edi
mov edx, eax
and dl, 0x80
movzx edx, dl
mov byte [esp + ecx + 0x10c], al
mov byte [esp + ecx + 0x20b], al
mov byte [esp + eax + 0xc], cl
inc ecx
neg edx
sbb edx, edx
and edx, 0x11b
lea esi, [eax + eax]
xor edx, esi
xor eax, edx
cmp eax, 1
jne 0x409800
xor ecx, ecx
mov dword [ecx + 0x4da6b8], eax
test eax, eax
je 0x40984c
movzx eax, byte [esp + eax + 0xc]
movzx eax, byte [esp + eax + 0x125]
jmp 0x40984e
xor eax, eax
add ecx, 4
cmp ecx, 0x28
jb 0x409833
xor edx, edx
test dl, dl
je 0x409872
movzx ecx, dl
movzx eax, byte [esp + ecx + 0xc]
lea ecx, [esp + 0x20b]
sub ecx, eax
movzx eax, byte [ecx]
jmp 0x409874
xor eax, eax
lea ecx, [eax + eax]
xor ecx, eax
add ecx, ecx
xor ecx, eax
add ecx, ecx
xor ecx, eax
add ecx, ecx
xor eax, ecx
mov ebx, eax
shr ebx, 8
xor bl, al
xor bl, 0x63
je 0x4098ab
movzx eax, bl
movzx eax, byte [esp + eax + 0xc]
movzx ecx, byte [esp + eax + 0x10d]
movzx esi, byte [esp + eax + 0x125]
jmp 0x4098af
xor ecx, ecx
xor esi, esi
shl ecx, 8
movzx eax, bl
or ecx, eax
shl ecx, 8
or ecx, eax
shl ecx, 8
or ecx, esi
mov esi, ecx
rol esi, 8
mov dword [edx*4 + 0x4db6e0], ecx
mov dword [edx*4 + 0x4dbae0], esi
mov esi, ecx
rol esi, 0x10
ror ecx, 8
mov dword [edx*4 + 0x4dc2e0], ecx
mov ecx, eax
rol ecx, 8
mov dword [edx*4 + 0x4daae0], ecx
mov ecx, eax
mov dword [edx*4 + 0x4da6e0], eax
rol ecx, 0x10
ror eax, 8
mov dword [edx*4 + 0x4db2e0], eax
mov dword [edx*4 + 0x4dbee0], esi
movzx esi, dl
lea eax, [esi*8]
xor eax, esi
add eax, eax
add eax, eax
xor eax, esi
mov dword [edx*4 + 0x4daee0], ecx
add eax, eax
mov ecx, eax
shr ecx, 8
xor cl, al
xor cl, 5
je 0x409992
lea eax, [esi*8]
xor eax, esi
add eax, eax
add eax, eax
xor eax, esi
add eax, eax
mov ecx, eax
shr ecx, 8
movzx ecx, cl
movzx eax, al
xor ecx, eax
xor ecx, 5
movzx ecx, byte [esp + ecx + 0xc]
lea eax, [esp + 0x20b]
sub eax, ecx
mov bl, byte [eax]
test bl, bl
je 0x409994
movzx ecx, bl
movzx ecx, byte [esp + ecx + 0xc]
movzx eax, byte [esp + ecx + 0x174]
movzx edi, byte [esp + ecx + 0x1fa]
movzx esi, byte [esp + ecx + 0x1d3]
movzx ecx, byte [esp + ecx + 0x1eb]
jmp 0x40999c
xor bl, bl
xor eax, eax
xor edi, edi
xor esi, esi
xor ecx, ecx
shl eax, 8
or eax, edi
shl eax, 8
or eax, esi
shl eax, 8
or eax, ecx
movzx ecx, bl
add ecx, ecx
add ecx, ecx
mov esi, eax
rol esi, 8
mov dword [ecx + 0x4d9ab8], esi
mov esi, eax
rol esi, 0x10
mov dword [ecx + 0x4d96b8], eax
ror eax, 8
inc edx
mov dword [ecx + 0x4d9eb8], esi
mov dword [ecx + 0x4da2b8], eax
cmp edx, 0x100
jb 0x409858
mov ecx, dword [esp + 0x30c]
pop edi
pop esi
pop ebx
xor ecx, esp
mov byte [0x4dc6e0], 1
call fcn.004aedbb
add esp, 0x304
ret
Function at 0x411870
Capabilities:
Get common file path
Get disk information
Query environment variable

Disassembly:
sub esp, 0x804
mov eax, dword [0x4d8620]
xor eax, esp
mov dword [esp + 0x800], eax
push esi
push edi
mov edi, dword [esp + 0x810]
push 0x400
push 0x4c5a56
lea eax, [esp + 0x10]
push eax
push str.TempFolder
push str.Paths
mov byte [edi], 0
call fcn.00460060
cmp byte [esp + 8], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetTempPathA]
jne 0x4118d4
cmp byte [0x53525c], 0
je 0x411990
lea ecx, [esp + 8]
push ecx
push 0x400
call esi
push 0x400
lea edx, [esp + 0x40c]
push edx
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
jle 0x411911
cmp eax, 0x400
jae 0x411911
push 0x400
lea ecx, [esp + 0x40c]
push ecx
lea edx, [esp + 0x10]
push edx
call fcn.004b0850
add esp, 0xc
push 0
lea eax, [esp + 0xc]
push eax
call fcn.004323d0
test al, al
jne 0x41192d
lea ecx, [esp + 8]
push ecx
push 0x400
call esi
push 1
push str.TempRemovableOnly
push str.Paths
call fcn.0045fbd0
test eax, eax
je 0x411973
cmp byte [0x53525c], 0
jne 0x411973
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
je 0x41195d
cmp eax, 5
jne 0x41198a
lea eax, [esp + 8]
mov edx, edi
mov ecx, eax
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x411967
jmp 0x41198a
lea eax, [esp + 8]
mov edx, edi
mov ecx, eax
sub edx, ecx
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x411980
push edi
call fcn.00456000
mov ecx, dword [esp + 0x808]
pop edi
pop esi
xor ecx, esp
call fcn.004aedbb
add esp, 0x804
ret 4

Function at 0x414b80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c1661
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4d8620]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esp + 0x14], 1
lea ecx, [esi + 0x1ef0]
call fcn.00401a20
mov byte [esp + 0x14], 0
lea ecx, [esi + 0x30]
call fcn.0042e920
mov dword [esp + 0x14], 0xffffffff
mov ecx, esi
call fcn.00402940
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret