joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4790da
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x48e9a8], 0xffffffff
je 0x47912a
mov eax, dword [ebp + 8]
cmp eax, dword [0x48e9a8]
je 0x479115
mov ecx, dword [0x48e9a8]
mov edx, dword [ecx*4 + 0x4b6ba8]
push edx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x479115
push 0
mov ecx, 0x4b69b0
call fcn.004746ad
push 0
mov eax, dword [0x48e9a8]
mov ecx, dword [eax*4 + 0x4b6ba8]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [ebp + 8], 0xffffffff
jne 0x479137
mov dword [ebp + 8], 0
push 5
mov edx, dword [ebp + 8]
mov eax, dword [edx*4 + 0x4b6ba8]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp + 8]
mov dword [0x48e9a8], ecx
pop ebp
ret

Function at 0x479728
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0x400
jb 0x479736
jmp 0x479791
mov eax, dword [0x4b7508]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x479754
push 1
push 0
mov ecx, 0x4b69b0
call fcn.0047467a
push dword [ebp + 8]
call fcn.004061e4
push dword [0x4b7508]
call fcn.00478664
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 9
mov eax, dword [0x4b7508]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
call fcn.0047cae3
nop
pop ebp
ret 4

Function at 0x479b59
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov dword [0x4b7504], 0
mov eax, dword [0x4b7508]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x479ba8
push 0
push 0x479164
mov ecx, dword [0x4b6a68]
push ecx
push 0xa6
mov edx, dword [0x4b6a60]
push edx
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov dword [0x4b7508], eax
cmp dword [0x4b7508], 0
jne 0x479ba8
xor eax, eax
jmp 0x479bbb
push 0
mov eax, dword [0x4b7508]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
pop ebp
ret

Function at 0x479bf1
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push dword [0x4b5fd8]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [0x4b5fec]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [0x4b7508]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 0x48bae0
xor ecx, ecx
dec cx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
push 0
push dword [0x4ff3d0]
call dword [sym.imp.USER32.dll_ShowWindow]
nop
call fcn.00426c3b
pop ebp
ret

Function at 0x47ae51
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ecx + 0x58]
cmp ecx, dword [ebp + 8]
je 0x47aea0
push 0
mov ecx, 0x4b69b0
call fcn.004746ad
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 0x58], eax
push 0
push 0
push 0x1009
mov ecx, dword [ebp - 4]
push dword [ecx + 0x10]
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp - 4]
call fcn.00479d12
push 0
push dword [0x4b7508]
call dword [sym.imp.USER32.dll_ShowWindow]
mov esp, ebp
pop ebp
ret 4
Function at 0x47bbdb
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push dword [ebp + 0xc]
push dword [ebp + 8]
lea eax, [ebp - 0x18]
push eax
call fcn.0047b929
mov ecx, dword [eax + 0xc]
sub ecx, dword [eax + 4]
mov dword [ebp - 4], ecx
mov edx, dword [eax + 8]
sub edx, dword [eax]
mov dword [ebp - 8], edx
shl ecx, 0x10
add ecx, edx
mov dword [0x501bfc], ecx
push 9
push dword [0x4b6a68]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x62
mov eax, dword [ebp - 4]
inc eax
push eax
push dword [ebp - 8]
push 0
push 0
push 0
push dword [0x4b6a68]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
shl ecx, 8
or eax, ecx
push eax
push 0
push 5
push dword [0x4b6a8c]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x48e9c4
push dword [0x4b6a68]
call dword [sym.imp.USER32.dll_SetWindowTextA]
push dword [0x4b6a68]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esp, ebp
pop ebp
ret 8

Function at 0x47c0e9
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4b5fdc]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x47c10b
push 0
mov ecx, dword [0x4b5fdc]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [0x4b5fd8]
push edx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x47c134
push 0
push 0x9cbd
push 0x111
mov eax, dword [0x4b5fd8]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [0x4b7508]
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x47c154
push 0
mov edx, dword [0x4b7508]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebp
ret

Function at 0x47c2aa
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
add eax, 4
push eax
push 4
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x47c2e3
push 1
call fcn.0042b5e1
nop
nop
nop
jmp 0x47c2f9
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp - 4]
call fcn.0047c2ff
mov edx, dword [ebp - 4]
mov dword [edx + 8], 0
mov esp, ebp
pop ebp
ret 8

Function at 0x47c39a
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x47c3c8
mov ecx, dword [ebp - 4]
cmp dword [ecx + 8], 0
jne 0x47c3c8
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], 1
mov esp, ebp
pop ebp
ret

Function at 0x47c434
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x47c464
push 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [ebp - 4]
mov dword [eax], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], 0
mov esp, ebp
pop ebp
ret
Function at 0x4817e0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4877a8
push 0x482c08
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffa8
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor edx, edx
mov dl, ah
mov dword [0x4bcc64], edx
movzx ecx, al
mov dword [0x4bcc60], ecx
shl ecx, 8
add ecx, edx
mov dword [0x4bcc5c], ecx
shr eax, 0x10
mov dword [0x4bcc58], eax
call fcn.00483bb8
test eax, eax
jne 0x481845
push 0x1c
call fcn.0048199f
add esp, 4
mov dword [ebp - 4], 0
call fcn.004069b0
call fcn.004839c0
call fcn.004839b0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x4bd888], eax
call fcn.00483370
mov dword [0x4bcc98], eax
test eax, eax
je 0x48187d
mov eax, dword [0x4bd888]
test eax, eax
jne 0x481887
push 0xffffffffffffffff
call fcn.00481630
add esp, 4
call fcn.004830c0
call fcn.00482fd0
call fcn.004815fa
mov esi, dword [0x4bd888]
mov dword [ebp - 0x64], esi
cmp byte [esi], 0x22
je 0x4818af
cmp byte [esi], 0x20
jbe 0x4818de
inc esi
mov dword [ebp - 0x64], esi
jmp 0x4818a4
inc esi
mov dword [ebp - 0x64], esi
mov al, byte [esi]
cmp al, 0x22
je 0x4818d5
test al, al
je 0x4818d5
and eax, 0xff
push eax
call fcn.00482f70
add esp, 4
test eax, eax
je 0x4818af
inc esi
mov dword [ebp - 0x64], esi
jmp 0x4818af
cmp byte [esi], 0x22
jne 0x4818de
inc esi
mov dword [ebp - 0x64], esi
mov al, byte [esi]
test al, al
je 0x4818ee
cmp al, 0x20
ja 0x4818ee
inc esi
mov dword [ebp - 0x64], esi
jmp 0x4818de
mov dword [ebp - 0x30], 0
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x48190f
mov eax, dword [ebp - 0x2c]
and eax, 0xffff
jmp 0x481914
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x60], eax
push eax
call fcn.00481630
jmp 0x481952
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x48199f
Capabilities:
Terminate process

Disassembly:
cmp dword [0x4bcca0], 1
jne 0x4819ad
call fcn.00483c03
mov eax, dword [esp + 4]
push eax
call fcn.00483c40
add esp, 4
push 0xff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1c2d39e
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 5]
lea esp, [esp + 3]
mov dword [esp], esp
push sp
call fcn.01c2d353
mov word [esp], di
mov dword [esp], edi
lea ecx, [ecx - 0x34]
pushal
pushfd
jmp 0x1c2d3f3
xchg dword [esp + 0x28], ecx
call 0x1c2d3ab

Function at 0x1c2f86a
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf1c1be04
jmp 0x1c2f812
cpuid
rdtsc
inc ebp
jo 0x1c2f839
jno 0x1c2f839
bswap ecx
dec ebx
jp 0x1c2f814
mov bx, si
jmp 0x1c2f817
jmp 0x1c2f7f3
mov bx, si
call 0x1c2f88e
lea eax, [edx + 0x13]
sub esp, 0xc0
jmp 0x1c2f852
mov esi, dword [esp + 0x2c]
jmp 0x1c2f7fc
mov ebp, esp
not ax
rol ch, cl
jns 0x1c2f8da
js 0x1c2f8e5
mov ebx, 0x23d0b121
lahf
loopne 0x1c2f88c
pop edx
mov dword [esp + 0x24], edi
lea esp, [esp + 0x24]
pushfd
jmp 0x1c2ea0b
or dword [eax - reloc.WINMM.dll_midiStreamOut], ebp
invalid
mov dx, 0x9aa5
jmp 0x1c2f975
mov dx, 0x9aa5
neg al
jmp 0x1c2f977
neg al

Function at 0x1c72a23
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor esi, esi
jmp 0x1c72e33
shl ax, 0xf
bts dx, dx
jmp 0x1c72de5
mov bx, cx
jmp 0x1c72a3b
jmp 0x1c72a0d
mov dword [ebp - 0x10], eax
jmp 0x1c72a87
mov ebx, dword [esi + 0x18]
mov dword [esp], edi
mov edi, dword [esi + 0x24]
jmp 0x1c72a25
mov eax, dword [esi + 0x1c]
call fcn.01c72a71
mov dword [ebp - 8], edi
jmp 0x1c72ac4
mov dword [ebp - 0x14], eax
js 0x1c727ae
jns 0x1c7281c
mov dx, 0x6b3c
jmp 0x1c72e0c
rdtsc
mov eax, dword [ebp - 0x10]
mov edx, dword [esp]
lea edx, reloc.WINMM.dll_midiStreamOut
pushfd
jmp 0x1c72dcf
lea edi, [eax + edi]
mov edx, dword [edi]
pop edi
add ax, 0xf3cd
btr ax, bx
jmp 0x1c72e18
push edi
mov edi, esi
lea edi, [edi*4]
jmp 0x1c72df6
lea eax, [ebx*4]
jmp 0x1c72e41
test ebx, ebx
jl 0x1c728a2
jge 0x1c7284e
lea esp, [esp + 4]
add edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push esp
jmp 0x1c72ea5
test eax, eax
call 0x1c72e6e
lea esp, [esp + 4]
inc esi
sub esp, 0xd
pop word [esp + 2]
pop dword [esp]
jmp 0x1c72ec8
lea esp, [esp + 4]
call fcn.01c3aa8e
stc
cmc
jmp 0x1c72e84
cmp esi, ebx
jmp 0x1c72fe2
pop word [esp + 1]
lea esp, [esp + 1]
jmp 0x1c72eb2
lea esp, [esp + 4]
jle 0x1c7284e
jmp 0x1c728a2

Function at 0x1c72a71
Capabilities:
Execute anti-debugging instructions

Disassembly:
add edi, ecx
call fcn.01c72b04
shl dword [ebp + reloc.WINMM.dll_midiStreamOut], 1
mov ebx, ss
cdq
in eax, dx
sub eax, 0x7e17e4f5

Function at 0x1c72b04
Capabilities:
Execute anti-debugging instructions

Disassembly:
add eax, ecx
lea esp, [esp + 8]
dec ebx
jmp 0x1c72a8f
mov byte [esp + 2], dl
mov word [esp], dx
jmp 0x1c72aa5

Function at 0x1cd4b39
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword [eax + 0x1c]
jmp 0x1cd4b02
lea esp, [esp + 0x5c]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x1cd4ac7
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x1cd411d
push edi
pushal
mov dword [esp + 0x5c], edi
jmp 0x1cd4add
Function at 0x409f23
Capabilities:
Check if file exists
Create directory

Disassembly:
push 0x58
mov eax, 0x4985cb
call fcn.0047abd7
lea eax, [ebp - 0x2c]
push eax
call fcn.00433810
pop ecx
and dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea ecx, [ebp - 0x64]
push ecx
mov edx, eax
call fcn.004363c0
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x48]
push 0x49fe70
push eax
call fcn.0040a9e2
add esp, 0x10
mov byte [ebp - 4], 2
push eax
lea ebx, [ebp - 0x2c]
call fcn.0040a144
mov byte [ebp - 4], 1
xor ebx, ebx
push ebx
push 1
lea ecx, [ebp - 0x48]
call fcn.0040292b
mov byte [ebp - 4], bl
push ebx
push 1
lea ecx, [ebp - 0x64]
call fcn.0040292b
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x409f9c
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x409fd4
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x409fb3
lea eax, [ebp - 0x28]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x409fd4
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x2c]
push eax
call fcn.00408871
mov al, bl
call fcn.0047ac5a
ret
lea eax, [ebp - 0x2c]
push eax
mov ebx, 0x4c23c4
call fcn.0043b2a0
mov bl, 1
jmp 0x409fbf

Function at 0x40a74c
Capabilities:
Hash data using fnv

Disassembly:
cmp dword [eax + 0x18], 8
jb 0x40a757
mov ecx, dword [eax + 4]
jmp 0x40a75a
lea ecx, [eax + 4]
mov edx, dword [eax + 0x14]
push esi
mov eax, 0x811c9dc5
lea edx, [ecx + edx*2]
jmp 0x40a775
movzx esi, word [ecx]
imul eax, eax, 0x1000193
xor eax, esi
inc ecx
inc ecx
cmp ecx, edx
jne 0x40a768
mov esi, SysReAllocString
and eax, esi
push 0x1f31d
push eax
call fcn.0047714b
imul eax, eax, 0xb14
imul edx, edx, 0x41a7
pop ecx
sub edx, eax
pop ecx
mov eax, edx
jns 0x40a7a1
add eax, esi
pop esi
ret

Function at 0x40f3c1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40f3d8
pop esi
ret
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x40f40d
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, edi
and esi, 0xf
jbe 0x40f409
cmp edi, eax
jae 0x40f40d
dec esi
movzx ecx, word [edi]
lea edi, [edi + ecx*2 + 2]
jne 0x40f3fb
cmp edi, eax
jb 0x40f411
xor eax, eax
jmp 0x40f41a
movzx eax, word [edi]
neg eax
sbb eax, eax
and eax, edi
pop edi
pop esi
ret
Function at 0x418601
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [esi + 0x54]
mov ecx, eax
and ecx, 0xc
push edi
mov byte [ebp - 1], 1
cmp cl, 0xc
jne 0x41864b
mov eax, dword [esi + 4]
mov edi, dword [sym.imp.USER32.dll_GetDlgCtrlID]
push eax
mov dword [ebp - 0x10], eax
call edi
push dword [esi + 4]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0xfffffffe
call edi
push dword [esi + 4]
mov edi, eax
call dword [sym.imp.USER32.dll_GetParent]
lea ecx, [ebp - 0x10]
push ecx
push edi
push 0x4e
jmp 0x418672
shr eax, 2
test al, 1
je 0x41867b
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
push dword [esi + 4]
mov edi, eax
call dword [sym.imp.USER32.dll_GetParent]
push dword [esi + 4]
movzx ecx, di
push ecx
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4186ae
push ebx
push 1
xor ebx, ebx
push ebx
push ebx
push dword [esi + 0x28]
push 0x4a0f4c
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
seta byte [ebp - 1]
cmp byte [ebp - 1], bl
je 0x4186ad
or byte [esi + 0x58], 2
push 1
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
pop ebx
mov al, byte [ebp - 1]
pop edi
leave
ret
Function at 0x418e5b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
and dword [esi], 0
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x418ebf
cmp dword [ebp + 0xc], 1
je 0x418e97
cmp dword [ebp + 0xc], 2
je 0x418e97
push 0xd
pop eax
jmp 0x418ebf
mov eax, dword [ebp - 4]
test edi, edi
je 0x418eb9
test eax, eax
je 0x418eb4
test al, 1
jne 0x418e92
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x418eb9
jmp 0x418e92
xor ecx, ecx
mov word [edi], cx
shr eax, 1
mov dword [esi], eax
xor eax, eax
leave
ret 8

Function at 0x42508c
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x496758
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x4bf490]
xor eax, esp
mov dword [esp + 0x54], eax
push ebx
push esi
mov eax, dword [0x4bf490]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xc]
inc ebx
mov dword [esp + 0xc], eax
mov esi, 0x4c2954
test byte [0x4c2950], bl
jne 0x425107
or dword [0x4c2950], ebx
and dword [esp + 0x70], 0
push str.file:___
mov ecx, esi
call fcn.00403740
push 0x49b23d
call fcn.004772c4
pop ecx
or dword [esp + 0x70], 0xffffffff
push 0
push dword [esp + 0x10]
mov eax, esi
call fcn.0041901e
cmp eax, 0xffffffff
je 0x4251f4
push 0xffffffffffffffff
push dword [0x4c2968]
lea eax, [esp + 0x4c]
push eax
push dword [esp + 0x18]
call fcn.00408f2b
mov dword [esp + 0x70], ebx
cmp dword [esp + 0x5c], 8
mov eax, dword [esp + 0x48]
jae 0x425146
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4251e3
cmp dword [esp + 0x5c], 8
mov eax, dword [esp + 0x48]
jae 0x425164
lea eax, [esp + 0x48]
push eax
lea esi, [esp + 0x28]
call fcn.0042a83c
mov byte [esp + 0x70], 2
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [esp + 0x70], 3
push 0x16
pop eax
mov word [esp + 0x14], ax
mov dword [esp + 0x1c], 0x194
mov byte [esp + 0x70], 4
mov ebx, dword [esp + 0x10]
mov ecx, esi
call fcn.0042544d
mov byte [esp + 0x70], 3
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [esp + 0x14]
push eax
call esi
mov byte [esp + 0x70], 2
lea eax, [esp + 0x34]
push eax
call esi
mov byte [esp + 0x70], 1
lea eax, [esp + 0x24]
push eax
call esi
or dword [esp + 0x70], 0xffffffff
push 0
push 1
lea ecx, [esp + 0x4c]
call fcn.0040292b
xor al, al
jmp 0x425201
or dword [esp + 0x70], 0xffffffff
push 0
push ebx
lea ecx, [esp + 0x4c]
call fcn.0040292b
push dword [esp + 0xc]
push dword [esp + 0x14]
call fcn.00425220
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x54]
xor ecx, esp
call fcn.00476b4b
mov esp, ebp
pop ebp
ret 8
Function at 0x42ad7f
Capabilities:
Check mutex on windows

Disassembly:
push esi
push dword [esp + 8]
mov esi, eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
push eax
call fcn.004093fc
cmp dword [esi], 0
je 0x42adac
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x42adac
mov byte [esi + 8], 1
pop esi
ret 4

Function at 0x42c950
Capabilities:
Get disk information

Disassembly:
push 0x1c
mov eax, 0x49a261
call fcn.0047ab6e
mov eax, edi
call fcn.0042126c
lea eax, [ebp - 0x28]
push eax
call fcn.0046205f
xor eax, eax
mov dword [ebp - 4], eax
mov esi, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
push eax
push eax
call esi
mov ebx, eax
lea eax, [ebx + 1]
push eax
lea eax, [ebp - 0x28]
call fcn.0042ca77
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x1c]
sar eax, 1
jne 0x42c998
call fcn.00476d83
push dword [ebp - 0x1c]
push ebx
call esi
mov esi, eax
test esi, esi
jne 0x42c9bb
xor bl, bl
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x28]
push eax
call fcn.00412310
mov al, bl
call fcn.0047ac46
ret
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x1c]
sar eax, 1
jne 0x42c9ca
call fcn.00476d83
mov ecx, dword [ebp - 0x1c]
push esi
mov ebx, edi
call fcn.004353c0
mov eax, dword [edi + 0x10]
sub eax, dword [edi + 0xc]
pop ecx
push 0x1c
cdq
pop ecx
idiv ecx
test eax, eax
seta bl
jmp 0x42c9a6

Function at 0x42d6d4
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0xc
mov eax, 0x48deea
call fcn.0047ab6e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
xor ebx, ebx
cmp eax, ebx
je 0x42d6f3
mov dword [ecx], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ebx
cmp esi, 0xffffffff
jne 0x42d725
or dword [ebp - 4], eax
push eax
jmp 0x42d7a3
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
mov dword [ebp + 0xc], ebx
mov byte [ebp - 4], 1
push edi
lea eax, [ebp + 0xc]
push eax
call fcn.0042ca3a
push ebx
lea eax, [ebp - 0x10]
push eax
push edi
mov edi, dword [ebp + 0xc]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, ebx
je 0x42d78d
cmp dword [ebp - 0x10], ebx
je 0x42d78d
push dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
push edi
call fcn.0042d7b6
mov byte [ebp + 0xb], al
mov byte [ebp - 4], bl
push edi
call fcn.00476c1b
pop ecx
mov dword [ebp + 0xc], ebx
or dword [ebp - 4], 0xffffffff
cmp esi, ebx
je 0x42d788
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x18], ebx
mov al, byte [ebp + 0xb]
jmp 0x42d7ae
mov byte [ebp - 4], bl
push edi
call fcn.00476c1b
pop ecx
mov dword [ebp + 0xc], ebx
or dword [ebp - 4], 0xffffffff
cmp esi, ebx
je 0x42d7ac
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x18], ebx
xor al, al
call fcn.0047ac46
ret 8
Function at 0x42e593
Capabilities:
Create process on windows
Write and execute a file
Write file on windows

Disassembly:
push 0x14
mov eax, 0x496566
call fcn.0047ab6e
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [esi]
cmp eax, ebx
je 0x42e6c1
cmp dword [eax - 0xc], ebx
jge 0x42e5c0
push 0x80070057
call fcn.00407bce
movzx eax, word [eax]
cmp ax, bx
je 0x42e6c1
lea eax, [ebp - 0x10]
push eax
call fcn.00407441
mov byte [ebp - 4], 1
push 0x4a5058
lea eax, [ebp - 0x14]
push eax
call fcn.0040f504
mov byte [ebp - 4], 2
lea edi, [ebp - 0x10]
lea ecx, [ebp - 0x14]
call fcn.0043f100
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.004071b8
push str..bat
mov eax, edi
push eax
call fcn.0042e49b
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 4], 3
cmp edi, 0xffffffff
jne 0x42e648
mov byte [ebp - 4], 1
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x20], ebx
jmp 0x42e6b6
lea eax, [ebp - 0x14]
push eax
call fcn.00407441
mov byte [ebp - 4], 4
push dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push dword [ebp - 0x10]
push dword [esi]
push dword [esi]
push dword [esi]
push str._echo_off__r_nATTRIB__r___s___r_n:try__r_ndel___s___r_nif_exist___s__goto_try_r_nATTRIB__r___s___r_ndel___s___cls
push eax
call fcn.0042ec93
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax - 0xc]
add esp, 0x1c
push ebx
lea edx, [ebp - 0x18]
push edx
push ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x14]
call fcn.004071b8
mov byte [ebp - 4], 1
cmp edi, ebx
je 0x42e6a4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x20], ebx
push ebx
push ebx
push ebx
push dword [ebp - 0x10]
push 0x4a0f4c
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x10]
call fcn.004071b8
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.004071b8
call fcn.0047ac46
ret 4

Function at 0x42fb30
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
jne 0x42fb3e
push 0xd
pop eax
jmp 0x42fb71
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x42fb45
mov eax, dword [ebp + 8]
push edi
push dword [ebp + 0x10]
push 7
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc