joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4568e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
xor eax, eax
push ebp
xor ebp, ebp
cmp dword [ebx + 0x14], eax
mov dword [esp + 4], eax
jle 0x456993
push esi
push edi
cmp ebp, 2
mov esi, ebp
jge 0x456901
xor esi, 1
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x456959
mov edx, dword [ebx + 0x10]
mov eax, esi
shl eax, 4
mov edi, dword [eax + edx]
mov dl, byte [ecx]
test dl, dl
je 0x45693d
lea ebx, [ebx]
movzx eax, byte [edi]
movzx edx, dl
mov dl, byte [edx + 0x4cf738]
cmp dl, byte [eax + 0x4cf738]
jne 0x45693d
mov dl, byte [ecx + 1]
inc ecx
inc edi
test dl, dl
jne 0x456920
movzx ecx, byte [ecx]
movzx edx, byte [edi]
movzx edx, byte [edx + 0x4cf738]
movzx ecx, byte [ecx + 0x4cf738]
sub ecx, edx
mov eax, dword [esp + 0xc]
jne 0x456987
mov eax, dword [esp + 0x18]
mov ecx, dword [ebx + 0x10]
lea edx, [esp + 0x10]
push edx
push eax
shl esi, 4
mov eax, dword [esi + ecx + 0xc]
add eax, 8
call fcn.00424820
add esp, 8
test eax, eax
je 0x456998
mov eax, dword [eax + 8]
mov dword [esp + 0xc], eax
test eax, eax
jne 0x456991
inc ebp
cmp ebp, dword [ebx + 0x14]
jl 0x4568f7
pop edi
pop esi
pop ebp
add esp, 8
ret
xor eax, eax
mov dword [esp + 0xc], eax
jmp 0x456987

Function at 0x456a90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x10
mov edx, dword [ecx + 0x14]
push ebp
xor eax, eax
xor ebp, ebp
mov dword [esp + 4], eax
mov dword [esp + 0xc], edx
test edx, edx
jle 0x456b4a
mov ecx, dword [ecx + 0x10]
push esi
mov dword [esp + 0xc], ecx
push edi
cmp ebp, 2
mov ecx, ebp
jge 0x456abe
xor ecx, 1
mov edx, dword [esp + 0x10]
shl ecx, 4
mov edi, dword [ecx + edx + 0xc]
add ecx, edx
test ebx, ebx
je 0x456b19
mov esi, dword [ecx]
mov cl, byte [ebx]
mov edx, ebx
test cl, cl
je 0x456b01
lea esp, [esp]
movzx eax, byte [esi]
movzx ecx, cl
mov cl, byte [ecx + 0x4cf738]
cmp cl, byte [eax + 0x4cf738]
jne 0x456afd
mov cl, byte [edx + 1]
inc edx
inc esi
test cl, cl
jne 0x456ae0
mov eax, dword [esp + 0xc]
movzx edx, byte [edx]
movzx ecx, byte [esi]
movzx ecx, byte [ecx + 0x4cf738]
movzx edx, byte [edx + 0x4cf738]
sub edx, ecx
jne 0x456b3d
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x18]
push eax
push ecx
lea eax, [edi + 0x18]
call fcn.00424820
add esp, 8
test eax, eax
je 0x456b4f
mov eax, dword [eax + 8]
mov dword [esp + 0xc], eax
test eax, eax
jne 0x456b48
inc ebp
cmp ebp, dword [esp + 0x14]
jl 0x456ab4
pop edi
pop esi
pop ebp
add esp, 0x10
ret
xor eax, eax
mov dword [esp + 0xc], eax
jmp 0x456b3d
Function at 0x48b7f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c51f8
mov eax, dword fs:[0]
push eax
sub esp, 0xb0
mov eax, dword [0x4e5d60]
xor eax, esp
mov dword [esp + 0xac], eax
push edi
mov eax, dword [0x4e5d60]
xor eax, esp
push eax
lea eax, [esp + 0xb8]
mov dword fs:[0], eax
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x24], esi
mov edi, ecx
mov dword [esp + 0xc], 0
call fcn.00495260
mov dword [esp + 0xc0], 1
and dword [esp + 0x14], 0xfffffe00
mov dword [esp + 0x18], 0
push 0xffffffffffffffff
push 0
push edi
lea ecx, [esp + 0x70]
mov byte [esp + 0xcc], 3
call fcn.0040ea30
cmp dword [esp + 0x7c], 0x10
mov eax, dword [esp + 0x68]
jae 0x48b880
lea eax, [esp + 0x68]
mov ecx, dword [esp + 0x78]
lea edx, [esp + 0xc]
push edx
add ecx, eax
push ecx
push eax
lea eax, [esp + 0x30]
push eax
call fcn.00495320
sub esp, 0x10
lea edx, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x2c], esp
push edx
call fcn.00492d60
push esi
call fcn.0048b450
add esp, 0x14
lea eax, [esp + 0xc]
mov dword [esp + 8], 1
mov byte [esp + 0xc0], 1
call fcn.00492ec0
lea edi, [esp + 0x24]
call fcn.0048b900
mov eax, esi
mov ecx, dword [esp + 0xb8]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [esp + 0xac]
xor ecx, esp
call fcn.004a6859
add esp, 0xbc
ret
Function at 0x48c3b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c395c
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x4e5d60]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, dword [esp + 0x44]
mov eax, dword [esp + 0x40]
lea esi, [esp + 0x10]
mov dword [esp + 0xc], 0
call fcn.0048b410
push eax
mov esi, 1
push edi
mov dword [esp + 0x40], esi
call fcn.0048bf60
mov dword [esp + 0xc], esi
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], 2
call fcn.0040c360
mov eax, dword [esp + 0x10]
push eax
call fcn.00498c5e
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret 8

Function at 0x48d670
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c3478
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x4e5d60]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor ebx, ebx
lea eax, [esi + 4]
mov dword [esp + 0x14], ebx
push eax
mov dword [esi], vtable.Json::StyledWriter.0
call fcn.0040b8c0
mov dword [esi + 0x30], ebx
mov eax, 0xf
mov dword [esi + 0x34], eax
mov byte [esi + 0x20], bl
mov dword [esi + 0x50], eax
mov dword [esi + 0x4c], ebx
mov byte [esi + 0x3c], bl
mov dword [esi + 0x54], 0x4a
mov dword [esi + 0x58], 3
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 4

Function at 0x490680
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x4c260b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4e5d60]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.004c12ab
push 4
mov dword [esp + 0x20], 0
call fcn.00498c24
mov edi, eax
add esp, 4
test edi, edi
je 0x4906fe
call fcn.004c0e4c
mov dword [edi], eax
call fcn.004c0c7a
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.004c0b9e
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x4906f3
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.004c0bc6
jmp 0x490700
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x4a6859
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4e5d60]
jne 0x4a6863
repz ret
jmp fcn.004adddc

Function at 0x4a7b24
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x4a7b55
call fcn.004aa0ab
mov dword [eax], esi
call fcn.004aa098
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.004a7f57
add esp, 0x14
push 0x16
pop eax
jmp 0x4a7baa
test dword [ebp + 0xc], 0xfffffff9
jne 0x4a7b31
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4a7b82
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004aa0be
pop ecx
call fcn.004aa098
mov eax, dword [eax]
jmp 0x4a7baa
test al, 0x10
jne 0x4a7ba8
test al, 1
je 0x4a7ba8
test byte [ebp + 0xc], 2
je 0x4a7ba8
call fcn.004aa0ab
mov dword [eax], 5
call fcn.004aa098
mov dword [eax], 0xd
jmp 0x4a7b79
xor eax, eax
pop esi
pop ebp
ret

Function at 0x4b8780
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004ad740
and dword [ebp - 4], 0
cmp dword [0x4eb34c], 0
mov ebx, eax
jne 0x4b8831
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4b88e2
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4b88e2
push eax
call fcn.004ad6ce
mov dword [esp], 0x4ca168
push edi
mov dword [0x4eb34c], eax
call esi
push eax
call fcn.004ad6ce
mov dword [esp], 0x4ca154
push edi
mov dword [0x4eb350], eax
call esi
push eax
call fcn.004ad6ce
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4eb354], eax
call esi
push eax
call fcn.004ad6ce
pop ecx
mov dword [0x4eb35c], eax
test eax, eax
je 0x4b8831
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004ad6ce
pop ecx
mov dword [0x4eb358], eax
mov eax, dword [0x4eb358]
cmp eax, ebx
je 0x4b8889
cmp dword [0x4eb35c], ebx
je 0x4b8889
push eax
call fcn.004ad749
push dword [0x4eb35c]
mov esi, eax
call fcn.004ad749
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4b8889
test edi, edi
je 0x4b8889
call esi
test eax, eax
je 0x4b8880
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4b8880
test byte [ebp - 0xc], 1
jne 0x4b8889
or dword [ebp + 0x10], 0x200000
jmp 0x4b88c2
mov eax, dword [0x4eb350]
cmp eax, ebx
je 0x4b88c2
push eax
call fcn.004ad749
pop ecx
test eax, eax
je 0x4b88c2
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4b88c2
mov eax, dword [0x4eb354]
cmp eax, ebx
je 0x4b88c2
push eax
call fcn.004ad749
pop ecx
test eax, eax
je 0x4b88c2
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4eb34c]
call fcn.004ad749
pop ecx
test eax, eax
je 0x4b88e2
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4b88e4
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4257a0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [esi], 0
jne 0x4257e9
cmp dword [ebp + 0x1c], 8
mov eax, dword [ebp + 8]
jae 0x4257b4
lea eax, [ebp + 8]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi], eax
test eax, eax
jne 0x4257e9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x4257e9
cmp dword [ebp + 0x1c], 8
mov eax, dword [ebp + 8]
jae 0x4257dc
lea eax, [ebp + 8]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [esi], eax
cmp dword [esi], 0
push ebx
setne bl
cmp dword [ebp + 0x1c], 8
jb 0x425802
mov eax, dword [ebp + 8]
push eax
call fcn.0043a5c1
add esp, 4
mov al, bl
pop ebx
pop ebp
ret 0x1c

Function at 0x434432
Capabilities:
Write file on windows

Disassembly:
push 0x24
mov eax, 0x452e6a
call fcn.0043d3bc
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x44], ebx
je 0x434526
cmp byte [esi + 0x49], bl
je 0x434526
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x434467
xor al, al
jmp 0x434528
push ebx
push 8
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.0040d250
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x4344c9
lea eax, [ebp - 0x2c]
mov edx, eax
mov ecx, dword [esi + 0x44]
mov edi, dword [ecx]
lea ebx, [ebp - 0x30]
push ebx
mov ebx, dword [ebp - 0x1c]
add eax, ebx
push eax
push edx
lea eax, [esi + 0x4c]
push eax
call dword [edi + 0x18]
sub eax, 0
je 0x4344ce
dec eax
je 0x4344d2
dec eax
dec eax
je 0x434522
xor bl, bl
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00401760
mov al, bl
jmp 0x434528
mov edx, dword [ebp - 0x2c]
jmp 0x434490
mov byte [esi + 0x49], 0
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x4344de
lea eax, [ebp - 0x2c]
mov edi, dword [ebp - 0x30]
sub edi, eax
je 0x434504
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x4344f1
lea eax, [ebp - 0x2c]
push dword [esi + 0x54]
push edi
push 1
push eax
call fcn.0043dea0
add esp, 0x10
cmp edi, eax
jne 0x4344b3
cmp byte [esi + 0x49], 0
je 0x434522
test edi, edi
jne 0x434482
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.004049f0
jmp 0x434482
mov bl, 1
jmp 0x4344b5
mov al, 1
call fcn.0043d406
ret
Function at 0x43531a
Capabilities:
Check if file exists
Create directory

Disassembly:
push 0x3c
mov eax, 0x4531a3
call fcn.0043d3bc
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x2c]
push esi
push eax
call fcn.004353df
pop ecx
pop ecx
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x43527a
lea eax, [ebp - 0x2c]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push eax
call edi
mov bl, 1
test eax, eax
je 0x4352a1
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00401760
mov al, bl
call fcn.0043d406
ret
lea eax, [ebp - 0x48]
push esi
push eax
call fcn.004350c4
pop ecx
pop ecx
mov byte [ebp - 4], 1
xor esi, esi
cmp dword [ebp - 0x38], esi
je 0x4352c8
lea eax, [ebp - 0x48]
push eax
call 0x43524f
mov bl, al
pop ecx
test bl, bl
je 0x435306
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x4352d4
lea eax, [ebp - 0x2c]
push eax
call edi
test eax, eax
jne 0x435306
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x4352e7
lea eax, [ebp - 0x2c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne bl
test bl, bl
jne 0x435306
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
sete bl
mov byte [ebp - 4], 0
push esi
push 1
lea ecx, [ebp - 0x48]
call fcn.00401760
jmp 0x435289
push ebp
mov ebp, esp
pop ebp
jmp 0x43524f

Function at 0x436fc2
Capabilities:
Check if file exists
Get common file path

Disassembly:
push 0x450
mov eax, 0x4538a0
call fcn.0043d3bc
mov edi, dword [ebp + 8]
xor ebx, ebx
push 0x410
lea eax, [ebp - 0x420]
push ebx
push eax
mov byte [ebp - 0x459], bl
call fcn.0043b860
add esp, 0xc
lea eax, [ebp - 0x420]
push eax
mov esi, 0x208
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x4370d4
push esi
lea eax, [ebp - 0x420]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x43c]
call fcn.00401410
mov dword [ebp - 4], ebx
push eax
lea eax, [ebp - 0x458]
push eax
call fcn.00435323
pop ecx
pop ecx
mov byte [ebp - 4], 2
push ebx
push 1
lea ecx, [ebp - 0x43c]
call fcn.004018b0
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4370aa
cmp byte [ebp + 0xc], bl
je 0x4370aa
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x43c]
call fcn.00401410
mov byte [ebp - 4], 3
lea eax, [ebp - 0x43c]
push eax
call fcn.0043782c
pop ecx
mov byte [ebp - 0x45a], al
mov byte [ebp - 4], 2
push ebx
push 1
lea ecx, [ebp - 0x43c]
call fcn.004018b0
cmp byte [ebp - 0x45a], bl
je 0x4370c2
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x458]
push eax
mov ecx, edi
call fcn.004015e0
mov byte [ebp - 0x459], 1
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea ecx, [ebp - 0x458]
call fcn.00401760
mov al, byte [ebp - 0x459]
call fcn.0043d406
ret
Function at 0x43782c
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp dword [eax + 0x14], 8
jb 0x43783d
mov eax, dword [eax]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x437856
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x437858
mov bl, 1
mov al, bl
pop ebx
pop ebp
ret

Function at 0x43785d
Capabilities:
Check if file exists

Disassembly:
push 0x470
mov eax, 0x4539fb
call fcn.0043d3bc
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push 0x208
lea eax, [ebp - 0x420]
push ebx
push eax
mov byte [ebp - 0x475], bl
call fcn.0043b860
xor eax, eax
mov dword [ebp - 0x428], 7
mov dword [ebp - 0x42c], ebx
mov word [ebp - 0x43c], ax
mov dword [ebp - 4], ebx
push ebx
push dword [ebp + 8]
lea eax, [ebp - 0x420]
push eax
push ebx
call fcn.00437796
xor edi, edi
inc edi
add esp, 0x1c
cmp eax, edi
jne 0x43793d
lea eax, [ebp - 0x420]
push eax
call fcn.0043d415
pop ecx
push eax
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x43c]
call fcn.00401d50
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x458]
call fcn.00401410
mov byte [ebp - 4], 1
lea eax, [ebp - 0x458]
push eax
lea eax, [ebp - 0x474]
push eax
call fcn.00435323
pop ecx
pop ecx
mov byte [ebp - 4], 2
push eax
mov ecx, esi
call fcn.00401560
mov byte [ebp - 4], 1
push ebx
push edi
lea ecx, [ebp - 0x474]
call fcn.00401760
mov byte [ebp - 4], bl
push ebx
push edi
lea ecx, [ebp - 0x458]
call fcn.004018b0
jmp 0x4379f6
lea eax, [ebp - 0x47c]
push eax
push dword [ebp + 8]
call fcn.004377e5
pop ecx
pop ecx
test al, al
je 0x437a35
lea eax, [ebp - 0x420]
push eax
push dword [ebp - 0x47c]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x437a35
lea eax, [ebp - 0x420]
push eax
call fcn.0043d415
pop ecx
push eax
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x43c]
call fcn.00401d50
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x458]
call fcn.00401410
mov byte [ebp - 4], 3
lea eax, [ebp - 0x458]
push eax
lea eax, [ebp - 0x474]
push eax
call fcn.00435323
pop ecx
pop ecx
mov byte [ebp - 4], 4
push eax
mov ecx, esi
call fcn.00401560
mov byte [ebp - 4], 3
push ebx
push edi
lea ecx, [ebp - 0x474]
call fcn.00401760
mov byte [ebp - 4], bl
push ebx
push edi
lea ecx, [ebp - 0x458]
call fcn.004018b0
lea eax, [ebp - 0x47c]
push eax
call fcn.00437803
pop ecx
mov byte [ebp - 0x475], 1
cmp byte [ebp + 0x10], bl
je 0x437a35
cmp dword [ebp - 0x428], 8
mov eax, dword [ebp - 0x43c]
jae 0x437a17
lea eax, [ebp - 0x43c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x437a35
lea eax, [ebp - 0x43c]
push eax
call fcn.0043782c
pop ecx
mov byte [ebp - 0x475], al
or dword [ebp - 4], 0xffffffff
push ebx
push edi
lea ecx, [ebp - 0x43c]
call fcn.004018b0
mov al, byte [ebp - 0x475]
call fcn.0043d406
ret

Function at 0x43a0d5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x468620]
jne 0x43a0df
repz ret
jmp fcn.0044336a
Function at 0x451e65
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.00451a96
push eax
push esi
push dword [ebp + 8]
call fcn.00451a4b
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00451a96
push eax
push esi
push dword [ebp + 8]
call fcn.00451a4b
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.00451a86
xor byte [eax - 0x7a], al
mov byte [di - 0x84], bl
invalid
Function at 0x452103
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x45213a
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x452135
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
add byte [ecx + 0x3000fa], al
add byte [ebp + 0x13], dh
add byte [ecx + 0x3000fa], al
add byte [ebp + 0x13], dh
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x452127
cmp edx, ebx
jne 0x452275
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x4520f6
add eax, dword [eax + 4]
jmp 0x4520e3
mov dword [ebp + 0xc], ebx
jmp 0x452145
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x45215d
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x45217b
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x4521d9
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x4521c0
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x4521c9
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x4521d3
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x4521b5
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x45213f
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x452226
dec eax
je 0x45221d
sub eax, 3
je 0x452214
mov dword [ebp - 4], 0x40
jmp 0x452243
mov dword [ebp - 4], 4
jmp 0x452229
mov dword [ebp - 4], 0x20
jmp 0x452229
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x452275
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x4521f5
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.00451a86
adc eax, dword [ebp + 0x75ff6e9a]
adc al, 0x6a
add dword [esi - 1], edx
xlatb
mov eax, esi
jmp 0x452281
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
invalid
pop edi
pop esi
pop ebx
Function at 0x401f80
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x43e25c]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x108], 0
push 0x103
push 0
lea eax, [ebp - 0x107]
push eax
call fcn.0040fc50
add esp, 0xc
mov byte [ebp - 0x20c], 0
push 0x103
push 0
lea ecx, [ebp - 0x20b]
push ecx
call fcn.0040fc50
add esp, 0xc
mov ecx, 0x44175c
call fcn.004029c0
test eax, eax
jne 0x402086
push 0x104
push 0x104
lea edx, [ebp - 0x20c]
push edx
lea eax, [ebp - 0x108]
push eax
call fcn.00401860
add esp, 0x10
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x41c], ecx
mov edx, dword [ebp - 0x41c]
add edx, 1
mov dword [ebp - 0x42c], edx
mov eax, dword [ebp - 0x41c]
mov cl, byte [eax]
mov byte [ebp - 0x411], cl
add dword [ebp - 0x41c], 1
cmp byte [ebp - 0x411], 0
jne 0x40201a
mov edx, dword [ebp - 0x41c]
sub edx, dword [ebp - 0x42c]
mov dword [ebp - 0x420], edx
je 0x40205f
lea eax, [ebp - 0x108]
push eax
mov ecx, 0x44175c
call fcn.004027d0
jmp 0x402064
jmp 0x402198
push 0x438bcc
mov ecx, 0x44175c
call fcn.00402810
push 0
mov ecx, 0x44175c
call fcn.004029a0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, 0x441744
call fcn.004029c0
test eax, eax
jne 0x4020f9
lea ecx, [ebp - 0x20c]
mov dword [ebp - 0x418], ecx
mov edx, dword [ebp - 0x418]
add edx, 1
mov dword [ebp - 0x428], edx
mov eax, dword [ebp - 0x418]
mov cl, byte [eax]
mov byte [ebp - 0x412], cl
add dword [ebp - 0x418], 1
cmp byte [ebp - 0x412], 0
jne 0x4020af
mov edx, dword [ebp - 0x418]
sub edx, dword [ebp - 0x428]
mov dword [ebp - 0x424], edx
je 0x4020f4
lea eax, [ebp - 0x20c]
push eax
mov ecx, 0x441744
call fcn.004027d0
jmp 0x4020f9
jmp 0x402198
mov byte [ebp - 0x40c], 0
push 0x1ff
push 0
lea ecx, [ebp - 0x40b]
push ecx
call fcn.0040fc50
add esp, 0xc
mov ecx, 0x441744
call fcn.004029a0
push eax
mov ecx, 0x44175c
call fcn.004029a0
push eax
push 0x438bd0
lea edx, [ebp - 0x40c]
push edx
call fcn.004065f3
add esp, 0x10
lea eax, [ebp - 0x40c]
push eax
mov ecx, 0x441774
call fcn.004027d0
push str..txt
mov ecx, 0x441774
call fcn.00402810
push 0x441740
lea ecx, [ebp - 0x410]
call fcn.004029e0
push 0x438be0
mov ecx, 0x441774
call fcn.004029a0
push eax
call fcn.00407328
add esp, 8
mov dword [0x441738], eax
lea ecx, [ebp - 0x410]
call fcn.00402a10
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00406523
mov esp, ebp
pop ebp
ret