joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43a6f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x44cea0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
mov ebp, ecx
push esi
xor ecx, ecx
push edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], 0x452940
mov dword [esp + 0x28], ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], 0x44ec1c
mov eax, dword [esp + 0x38]
mov esi, dword [esp + 0x34]
mov edi, dword [esi + 4]
cdq
sub eax, edx
sar eax, 1
dec eax
add edi, eax
mov dword [esi + 4], edi
mov eax, dword [ebp + 0x54]
push eax
push 1
push ecx
mov byte [esp + 0x34], 1
call dword [sym.imp.GDI32.dll_CreatePen]
push eax
lea ecx, [esp + 0x1c]
call sub.MFC71U.DLL_CDC::Attach
mov edi, dword [esp + 0x30]
lea eax, [esp + 0x10]
push eax
push esi
push edi
mov ecx, ebp
call fcn.0043a570
lea ecx, [esp + 0x10]
push ecx
mov ecx, edi
call sub.MFC71U.DLL_CDC::SelectObject_2
lea edx, [esp + 0x18]
push edx
mov ecx, edi
mov ebp, eax
call sub.MFC71U.DLL_CDC::SelectObject_1
mov edx, dword [esi + 4]
mov ebx, eax
mov eax, 6
mov ecx, eax
push ecx
mov ecx, dword [esi + 8]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push ecx
mov ecx, dword [edi + 4]
push edx
push eax
push ecx
call dword [sym.imp.GDI32.dll_RoundRect]
push ebx
mov ecx, edi
call sub.MFC71U.DLL_CDC::SelectObject_1
push ebp
mov ecx, edi
call sub.MFC71U.DLL_CDC::SelectObject_2
lea ecx, [esp + 0x18]
call sub.MFC71U.DLL_CListBox::DeleteItem
lea ecx, [esp + 0x10]
call sub.MFC71U.DLL_CListBox::DeleteItem
mov esi, 0x44ec08
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 0
mov dword [esp + 0x10], esi
call sub.MFC71U.DLL_CListBox::DeleteItem
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x18], esi
lea ecx, [esp + 0x18]
call sub.MFC71U.DLL_CListBox::DeleteItem
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0xc
Function at 0x43ac20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x44cf68
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebp
mov ebp, dword [esp + 0x5c]
test ebp, ebp
je 0x43ad52
lea ecx, [esp + 8]
call sub.MFC71U.DLL_CDBVariant::CDBVariant
mov eax, dword [esp + 0x58]
test eax, eax
mov dword [esp + 0x50], 0
je 0x43ac61
mov eax, dword [eax + 4]
push ebx
push esi
push edi
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esp + 0x18]
call sub.MFC71U.DLL_CAsyncSocket::Attach
mov eax, dword [esp + 0x18]
push ebp
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [esp + 0x6c]
mov ebx, dword [esp + 0x74]
mov esi, dword [esp + 0x78]
mov edi, dword [esp + 0x70]
sub ebx, ecx
lea ecx, [esp + 0x3c]
push ecx
push 0x18
sub esi, edi
push ebp
mov dword [esp + 0x1c], esi
call dword [sym.imp.GDI32.dll_GetObjectW]
lea edx, [esp + 0x24]
push edx
push 0x18
push ebp
call dword [sym.imp.GDI32.dll_GetObjectW]
cmp edi, esi
mov ebp, dword [esp + 0x2c]
mov eax, edi
mov dword [esp + 0x68], eax
jge 0x43ad33
jmp 0x43acd0
mov esi, dword [esp + 0x10]
lea esp, [esp]
lea ecx, [eax + ebp]
cmp ecx, esi
jle 0x43acdb
mov ebp, esi
sub ebp, eax
mov esi, dword [esp + 0x6c]
mov edi, dword [esp + 0x40]
mov ecx, esi
cmp ecx, ebx
jge 0x43ad25
lea esp, [esp]
lea edx, [esi + edi]
cmp edx, ebx
jle 0x43acfb
mov edi, ebx
sub edi, esi
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x64]
push 0xcc0020
push 0
push 0
push ecx
push ebp
push edi
push eax
mov eax, dword [edx + 4]
push esi
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esp + 0x68]
add esi, edi
cmp esi, ebx
jl 0x43acf0
mov ecx, dword [esp + 0x10]
add eax, ebp
cmp eax, ecx
mov dword [esp + 0x68], eax
jl 0x43acc5
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.GDI32.dll_DeleteDC]
lea ecx, [esp + 0x14]
mov dword [esp + 0x5c], 0xffffffff
call fcn.0043cbd8
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x48]
pop ebp
mov dword fs:[0], ecx
add esp, 0x50
ret 0x18
Function at 0x43cd04
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x74
push 0x45b388
call fcn.0043d22c
xor edi, edi
mov dword [ebp - 0x20], edi
push edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call ebx
cmp word [eax], 0x5a4d
jne 0x43cd44
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43cd44
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x43cd5c
cmp eax, 0x20b
je 0x43cd49
mov dword [ebp - 0x1c], edi
jmp 0x43cd70
cmp dword [ecx + 0x84], 0xe
jbe 0x43cd44
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x43cd6a
cmp dword [ecx + 0x74], 0xe
jbe 0x43cd44
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 2
call dword [sym.imp.MSVCR71.dll___set_app_type]
pop ecx
or dword [0x468dfc], 0xffffffff
or dword [0x468e00], 0xffffffff
call dword [sym.imp.MSVCR71.dll___p__fmode]
mov ecx, dword [0x468d68]
mov dword [eax], ecx
call dword [sym.imp.MSVCR71.dll___p__commode]
mov ecx, dword [0x468d64]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCR71.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x468df8], eax
call fcn.0043d284
call fcn.0043d324
cmp dword [0x468a20], edi
jne 0x43cdd0
push fcn.0043d324
call dword [sym.imp.MSVCR71.dll___setusermatherr]
pop ecx
call fcn.0043d312
push 0x468070
push 0x46806c
call sub.MSVCR71.dll__initterm
push 0x43d2c8
call fcn.0043cfdd
mov eax, dword [0x468d60]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x468d5c]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.MSVCR71.dll___wgetmainargs]
add esp, 0x20
mov dword [ebp - 0x3c], eax
cmp eax, edi
jge 0x43ce24
push 8
call sub.MSVCR71.dll__amsg_exit
pop ecx
push 0x468068
push section..data
call sub.MSVCR71.dll__initterm
pop ecx
pop ecx
mov eax, dword [sym.imp.MSVCR71.dll__wcmdln]
mov esi, dword [eax]
cmp esi, edi
jne 0x43ce4e
or dword [ebp - 4], 0xffffffff
mov eax, 0xff
jmp 0x43cf08
mov dword [ebp - 0x24], esi
mov ax, word [esi]
cmp ax, 0x20
ja 0x43cebd
cmp ax, di
je 0x43ce64
cmp dword [ebp - 0x20], edi
jne 0x43cebd
mov ax, word [esi]
cmp ax, di
je 0x43ce79
cmp ax, 0x20
ja 0x43ce79
inc esi
inc esi
mov dword [ebp - 0x24], esi
jmp 0x43ce64
mov dword [ebp - 0x58], edi
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
test byte [ebp - 0x58], 1
je 0x43ce95
movzx eax, word [ebp - 0x54]
jmp 0x43ce98
push 0xa
pop eax
push eax
push esi
push edi
push edi
call ebx
push eax
call fcn.00447571
mov esi, eax
mov dword [ebp - 0x40], esi
cmp dword [ebp - 0x1c], edi
jne 0x43ceb5
push esi
call dword [sym.imp.MSVCR71.dll_exit]
call dword [sym.imp.MSVCR71.dll__cexit]
jmp 0x43cf02
cmp ax, 0x22
jne 0x43cece
xor eax, eax
cmp dword [ebp - 0x20], edi
sete al
mov dword [ebp - 0x20], eax
inc esi
inc esi
jmp 0x43ce4e
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0043d267
ret
Function at 0x4461e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45d200
push 0x43d15e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov esi, edx
push 0x1c
lea eax, [ebp - 0x3c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x1c], ecx
cmp word [ecx], 0x5a4d
jne 0x446277
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x20], eax
cmp dword [eax], 0x4550
jne 0x446277
mov edx, dword [eax + 0xd8]
lea edi, [edx + ecx]
cmp esi, edi
jb 0x446277
mov eax, dword [eax + 0xdc]
add eax, edx
add eax, ecx
cmp esi, eax
jae 0x446277
mov dword [ebp - 4], 0xffffffff
mov al, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x446340
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [0x468dd4]
test esi, esi
je 0x44636a
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 8]
push eax
push 0x40
push 0x10000
push esi
call edi
mov esi, dword [esi + 4]
test esi, esi
jne 0x446353
pop edi
pop esi
pop ecx
ret
Function at 0x446610
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45d210
push 0x43d15e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x1c
lea eax, [ebp - 0x38]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x446697
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x34]
cmp word [eax], 0x5a4d
jne 0x446690
mov ecx, dword [eax + 0x3c]
add ecx, eax
mov dword [ebp - 0x1c], ecx
cmp dword [ecx], 0x4550
jne 0x446690
cmp word [ecx + 0x14], 0
je 0x446690
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x446710
Capabilities:
Resume thread

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x468de0], eax
je 0x446726
mov eax, 0x10dd
pop ecx
ret
push ebx
push ebp
push esi
mov esi, dword [0x468df0]
xor ebp, ebp
cmp esi, ebp
push edi
je 0x4467a3
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [esp]
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
lea eax, [esp + 0x10]
push eax
movzx eax, byte [edx + 0x17]
push ecx
mov ecx, dword [esi + 0xc]
push eax
push ecx
call ebx
cmp dword [esi + 4], ebp
jne 0x446792
mov eax, dword [esi + 0x10]
cmp eax, ebp
je 0x446792
mov ecx, eax
and ecx, 0xffff0000
xor edx, edx
mov edi, eax
mov dword [edi], edx
mov dword [edi + 4], edx
mov dword [edi + 8], edx
mov dword [edi + 0xc], edx
mov dword [edi + 0x10], edx
mov dword [edi + 0x14], edx
mov dword [edi + 0x18], edx
mov dword [edi + 0x1c], edx
mov edx, dword [ecx + 8]
mov dword [eax + 0x18], edx
mov dword [ecx + 8], eax
mov dword [esi + 0x10], ebp
mov edi, dword [esi]
push esi
call sub.MFC71U.DLL_CNoTrackObject::operator_new
add esp, 4
cmp edi, ebp
mov esi, edi
jne 0x446740
mov dword [0x468df0], ebp
call fcn.00446370
mov esi, dword [0x468dec]
cmp esi, ebp
je 0x4467d7
mov ebx, dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edi, edi
mov eax, dword [esi + 4]
push eax
call ebx
mov edi, dword [esi]
push esi
call sub.MFC71U.DLL_CNoTrackObject::operator_new
add esp, 4
cmp edi, ebp
mov esi, edi
jne 0x4467c0
pop edi
pop esi
mov dword [0x468dec], ebp
mov dword [0x468de0], ebp
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x446b00
Capabilities:
Suspend thread

Disassembly:
mov eax, dword [0x468de4]
test eax, eax
jne 0x446b7e
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edi, dword [esp + 8]
cmp edi, eax
jne 0x446b1e
xor eax, eax
pop edi
ret 4
push esi
push 8
call sub.MFC71U.DLL_CWordArray::CWordArray
mov esi, eax
add esp, 4
test esi, esi
jne 0x446b36
mov edi, 8
jmp 0x446b53
push edi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x446b6a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call sub.MFC71U.DLL_CNoTrackObject::operator_new
add esp, 4
pop esi
mov dword [0x468de4], edi
mov eax, edi
mov dword [0x468de8], 0
pop edi
ret 4
mov eax, dword [0x468dec]
mov dword [esi + 4], edi
mov dword [esi], eax
mov dword [0x468dec], esi
pop esi
xor eax, eax
pop edi
ret 4
Function at 0x446eb0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x468de0], eax
je 0x446ec8
mov eax, 0x10dd
pop ecx
ret 8
mov eax, dword [0x468de4]
test eax, eax
jne 0x44700d
push ebp
mov ebp, dword [esp + 0xc]
test ebp, ebp
jne 0x446ee8
mov eax, 6
pop ebp
pop ecx
ret 8
cmp dword [ebp], 0
jne 0x446f03
mov eax, 6
mov dword [0x468de8], ebp
mov dword [0x468de4], eax
pop ebp
pop ecx
ret 8
push ebx
push esi
push edi
push 0x18
call sub.MFC71U.DLL_CWordArray::CWordArray
mov edi, eax
add esp, 4
test edi, edi
jne 0x446f20
mov esi, 8
jmp 0x446fee
mov esi, dword [esp + 0x1c]
test esi, esi
mov ebx, dword [ebp]
jne 0x446f2f
xor ecx, ecx
jmp 0x446f76
mov al, byte [esi]
cmp al, 0xff
jne 0x446f54
cmp byte [esi + 1], 0x25
jne 0x446f54
mov ebp, dword [esi + 2]
mov edx, ebp
mov ecx, esi
call fcn.004461e0
test al, al
je 0x446f70
mov ecx, dword [ebp]
mov ebp, dword [esp + 0x18]
jmp 0x446f76
cmp al, 0xeb
jne 0x446f74
movsx eax, byte [esi + 1]
mov cl, byte [eax + esi + 2]
cmp cl, 0xe9
lea eax, [eax + esi + 2]
jne 0x446f6c
add eax, dword [eax + 1]
mov ecx, eax
jmp 0x446f76
mov ebp, dword [esp + 0x18]
mov ecx, esi
movzx eax, byte [ebx + 0x17]
mov esi, dword [ebx + 0x18]
sub esi, eax
test eax, eax
je 0x446fe0
cmp eax, 0x17
ja 0x446fe0
cmp dword [ebx + 0x1c], ecx
jne 0x446fe0
lea ecx, [esp + 0x10]
push ecx
push 0x40
push eax
push esi
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x446fb2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x446fee
mov eax, dword [0x468df0]
mov dword [edi + 8], ebp
mov dword [edi + 0x10], ebx
mov dword [edi + 0xc], esi
mov dword [edi + 4], 1
mov edx, dword [esp + 0x10]
mov dword [edi], eax
mov dword [edi + 0x14], edx
mov dword [0x468df0], edi
pop edi
pop esi
pop ebx
xor eax, eax
pop ebp
pop ecx
ret 8
mov eax, dword [0x468ddc]
test eax, eax
mov esi, 9
jne 0x446ff4
mov dword [0x468de4], esi
test edi, edi
je 0x447001
push edi
call sub.MFC71U.DLL_CNoTrackObject::operator_new
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
mov dword [0x468de8], ebp
pop ebp
pop ecx
ret 8
Function at 0x42ec50
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x29000]
push edi
jmp 0x42ec6a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x42ec71
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x42ec60
mov eax, 1
add ebx, ebx
jne 0x42ec83
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x42ec78
jne 0x42ec94
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42ec78
xor ecx, ecx
sub eax, 3
jb 0x42eca8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42ed1a
mov ebp, eax
add ebx, ebx
jne 0x42ecb3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x42ecc0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x42ece4
inc ecx
add ebx, ebx
jne 0x42ecd0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x42ecc5
jne 0x42ece1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42ecc5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x42ed04
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x42ecf5
jmp 0x42ec66
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x42ed04
add edi, ecx
jmp 0x42ec66
pop esi
mov edi, esi
mov ecx, 0x581
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x42ed22
cmp byte [edi], 1
jne 0x42ed22
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x42ed27
lea edi, [esi + 0x2c000]
mov eax, dword [edi]
or eax, eax
je 0x42ed96
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x321ec]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x3228c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x42ed54
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x32290]
or eax, eax
je 0x42ed90
mov dword [ebx], eax
add ebx, 4
jmp 0x42ed71
call dword [esi + 0x322a0]
mov ebp, dword [esi + 0x32294]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42edca
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x40b220
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
mov eax, dword [0x430008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.00413ca0
add esp, 0xc
mov dword [ebp - 0x258], 0x1637b
mov dword [ebp - 0x21c], 0xf3a4
mov dword [ebp - 0x218], 0x1de9
mov dword [ebp - 0x214], 0xc597
mov dword [ebp - 0x210], 0xa862
lea ecx, [ebp - 0x20c]
push ecx
push 0
push 0
push 0xe
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
jmp 0x40cba1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004125c1
mov esp, ebp
pop ebp
ret
Function at 0x412e34
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x412e73
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x412e73
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x412e73
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x412e73
cmp dword [ecx + 0x74], 0xe
jbe 0x412e73
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x41d574
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x428dac
push 0x428da4
push str.FlsAlloc
push 0x1f
call fcn.0041d4af
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41d5a8
push dword [ebp + 8]
mov ecx, esi
call dword [0x427228]
call esi
jmp 0x41d5ae
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x41d5f2
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x428dbc
push 0x428db4
push str.FlsGetValue
push 0x21
call fcn.0041d4af
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41d629
push dword [ebp + 8]
mov ecx, esi
call dword [0x427228]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x41d631
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x428dc4
push 0x428dbc
push str.FlsSetValue
push 0x22
call fcn.0041d4af
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41d66b
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x427228]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x41e062
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x430008]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x41e0ad
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.0041e27f
test al, al
jne 0x41e0a7
sub edx, 2
cmp edx, edi
jne 0x41e08d
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x41e0cf
lea eax, [edi + 2]
cmp edx, eax
je 0x41e0cf
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.0041dfae
add esp, 0x10
jmp 0x41e1c9
push esi
lea ecx, [ebp - 0x255]
call fcn.0041e27f
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x41e112
push dword [ebp - 0x25c]
jmp 0x41e0bf
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x41e14f
cmp word [ebp - 0x226], 0
je 0x41e170
cmp word [ebp - 0x226], ax
jne 0x41e14f
cmp word [ebp - 0x224], 0
je 0x41e170
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.0041dfae
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x41e1bc
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x41e129
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x41e1a4
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x41e1c9
push 0x41ddde
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.00422fa0
add esp, 0x10
jmp 0x41e199
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004125c1
leave
ret
Function at 0x425e30
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x425e5d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x425e5d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401ca4
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x401cb6
mov eax, dword [0x66209f]
shl eax, 2
mov dword [0x6620a3], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleW
mov edx, eax
call fcn.0064f2b8
pop edx
call fcn.0064f1fc
call fcn.0064f414
push 0
call fcn.00650f98
pop ecx
push 0x662048
push 0
call sub.KERNEL32.DLL_GetModuleHandleW
mov dword [0x6620a7], eax
push 0
jmp fcn.0065b0ec

Function at 0x409b48
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax + 0x14], edx
mov dword [eax + 0x10], edx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret
Function at 0x40eb3c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
mov ebx, eax
mov eax, 0x669da8
call fcn.00650394
push 0x6674f0
push 0
call sub.USER32.DLL_FindWindowW
mov esi, eax
mov dword [ebx + 0x414], esi
test esi, esi
jne 0x40eba9
mov word [ebp - 0x18], 0xc
mov edx, 0x667500
lea eax, [ebp - 4]
call fcn.0065fa0c
inc dword [ebp - 0xc]
mov dl, 1
mov eax, dword [eax]
call fcn.004be384
push eax
dec dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 2
call fcn.0065fb9c
pop ecx
test cl, cl
je 0x40eba9
push 0
push 0x667511
call sub.KERNEL32.DLL_WinExec
push 0x667522
push 0
call sub.USER32.DLL_FindWindowW
mov esi, eax
mov dword [ebx + 0x414], esi
test esi, esi
je 0x40ebd6
mov eax, ebx
call fcn.0055975c
mov ecx, eax
mov edx, 0x3ea
mov eax, ebx
call fcn.00411908
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x416a40
Capabilities:
Check os version

Disassembly:
push ebx
push esi
add esp, 0xfffffeec
mov ebx, edx
xor eax, eax
mov dword [ebx], eax
push 0x114
push 0
lea edx, [esp + 8]
push edx
call fcn.0064fec3
add esp, 0xc
mov dword [esp], 0x114
push esp
call sub.KERNEL32.DLL_GetVersionExW
mov esi, eax
test eax, eax
jne 0x416a8d
mov dword [esp], 0x114
push esp
call sub.KERNEL32.DLL_GetVersionExW
test eax, eax
jne 0x416a8d
xor eax, eax
jmp 0x416b53
mov edx, dword [esp + 0x10]
dec edx
je 0x416b0f
dec edx
je 0x416a9c
jmp 0x416b4d
cmp dword [esp + 4], 6
jne 0x416ab0
cmp dword [esp + 8], 0
jne 0x416ab0
mov dword [ebx], 1
cmp dword [esp + 4], 5
jne 0x416ac4
cmp dword [esp + 8], 2
jne 0x416ac4
mov dword [ebx], 2
cmp dword [esp + 4], 5
jne 0x416ad8
cmp dword [esp + 8], 1
jne 0x416ad8
mov dword [ebx], 3
cmp dword [esp + 4], 5
jne 0x416aec
cmp dword [esp + 8], 0
jne 0x416aec
mov dword [ebx], 4
cmp dword [esp + 4], 4
ja 0x416af9
mov dword [ebx], 5
cmp dword [esp + 4], 6
jne 0x416b51
cmp dword [esp + 8], 1
jne 0x416b51
mov dword [ebx], 6
jmp 0x416b51
cmp dword [esp + 4], 4
jne 0x416b23
cmp dword [esp + 8], 0
jne 0x416b23
mov dword [ebx], 7
cmp dword [esp + 4], 4
jne 0x416b37
cmp dword [esp + 8], 0xa
jne 0x416b37
mov dword [ebx], 8
cmp dword [esp + 4], 4
jne 0x416b51
cmp dword [esp + 8], 0x5a
jne 0x416b51
mov dword [ebx], 9
jmp 0x416b51
xor ecx, ecx
mov dword [ebx], ecx
mov al, 1
add esp, 0x114
pop esi
pop ebx
ret