joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405629
Capabilities:
Create process on windows

Disassembly:
push 5
mov eax, 0x40e464
push eax
push eax
push dword [esp + 0x14]
push 0x410634
push dword [esp + 0x18]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x20
pop ecx
cmp ecx, eax
sbb eax, eax
neg eax
ret

Function at 0x4057ba
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push 0
lea eax, [ebp - 4]
push eax
push 2
push 0x410a18
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
leave
ret

Function at 0x40607d
Capabilities:
Enumerate files on windows

Disassembly:
push ecx
push esi
mov esi, eax
mov eax, dword [esi]
cmp eax, 0xffffffff
jne 0x4060a9
lea eax, [esi + 0x28c]
push eax
lea eax, [esi + 4]
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov dword [esi], eax
mov dword [esp + 4], ecx
jmp 0x4060c4
lea ecx, [esi + 0x28c]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
mov dword [esp + 4], eax
jne 0x4060cb
call fcn.00406116
cmp dword [esp + 4], 0
je 0x40610f
push ebx
push ebp
push edi
lea edi, [esi + 0x4dc]
lea ebx, [esi + 0x2b8]
add esi, 0x764
push esi
call sub.msvcrt.dll_wcslen
push ebx
mov ebp, eax
call sub.msvcrt.dll_wcslen
lea eax, [eax + ebp + 1]
cmp eax, 0x143
pop ecx
pop ecx
jae 0x406108
push ebx
push esi
mov eax, edi
call fcn.004052fc
pop ecx
pop ecx
jmp 0x40610c
and word [edi], 0
pop edi
pop ebp
pop ebx
mov eax, dword [esp + 4]
pop esi
pop ecx
ret

Function at 0x4068af
Capabilities:
Read .ini file

Disassembly:
and word [esi], 0
push 0x4146f8
push dword [esp + 0xc]
push esi
push 0x40e464
push dword [esp + 0x14]
push 0x414908
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
mov eax, esi
ret

Function at 0x4068d4
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.0040d420
and word [ebp - 0x2004], 0
push 0x2000
lea eax, [ebp - 0x2002]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x4146f8
push 0x1000
lea eax, [ebp - 0x2004]
push eax
push 0x40e464
push dword [ebp + 8]
push 0x414908
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
cmp word [ebp - 0x2004], 0
je 0x406943
lea eax, [ebp - 0x2004]
push eax
push dword [ebp + 0xc]
call sub.msvcrt.dll_wcscpy
pop ecx
xor eax, eax
pop ecx
inc eax
leave
ret
xor eax, eax
leave
ret

Function at 0x406947
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.0040d420
and word [ebp - 0x2004], 0
push esi
push edi
push 0x2000
lea eax, [ebp - 0x2002]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov edi, 0x4146f8
push edi
push 0x1000
lea eax, [ebp - 0x2004]
push eax
push 0x40e464
push dword [ebp + 8]
mov esi, 0x414908
push esi
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
cmp word [ebp - 0x2004], 0
je 0x4069ae
cmp dword [ebp + 0x10], 0
jne 0x4069ae
xor eax, eax
jmp 0x4069bc
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringW]
pop edi
pop esi
leave
ret
Function at 0x406d0f
Capabilities:
Read .ini file

Disassembly:
push dword [esp + 4]
call fcn.004050e5
test eax, eax
pop ecx
je 0x406d96
push esi
push edi
push dword [esp + 0xc]
mov edi, 0x4146f8
push edi
call sub.msvcrt.dll_wcscpy
push str.general
mov esi, 0x414908
push esi
call sub.msvcrt.dll_wcscpy
add esp, 0x10
push edi
push 0
push 0x4106e0
push esi
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntW]
dec eax
neg eax
sbb eax, eax
inc eax
push 0x3f
push str.charset
mov esi, 0x414990
mov dword [0x41498c], eax
call fcn.004068af
push 0x3f
push str.TranslatorName
mov esi, 0x414a10
call fcn.004068af
push 0xff
push str.TranslatorURL
mov esi, 0x414a90
call fcn.004068af
add esp, 0x18
pop edi
pop esi
ret

Function at 0x407db7
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.0040d420
push ebx
push esi
mov esi, 0x1fff
xor ebx, ebx
push esi
lea eax, [ebp - 0x2003]
push ebx
push eax
mov byte [ebp - 0x2004], bl
call sub.msvcrt.dll_memset
add esp, 0xc
push ebx
push ebx
push esi
lea eax, [ebp - 0x2004]
push eax
push 0xffffffffffffffff
push dword [ebp + 0xc]
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
push ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x2004]
push eax
call sub.msvcrt.dll_strlen
pop ecx
push eax
lea eax, [ebp - 0x2004]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
pop esi
pop ebx
leave
ret
Function at 0x408b8d
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x2bc
push ebx
mov ebx, dword [sym.imp.COMCTL32.dll_ImageList_Create]
push ebp
push esi
mov esi, eax
xor ebp, ebp
cmp dword [esi + 0x2a8], ebp
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
je 0x408c37
cmp dword [esi + 0x2b0], ebp
je 0x408c05
push 0x2b0
lea eax, [esp + 0x20]
push ebp
push eax
mov dword [esp + 0x24], ebp
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x4001
push 0x2b4
lea eax, [esp + 0x20]
push eax
push ebp
push 0x40e464
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push eax
push 1
push 0x1003
push dword [esi + 0x294]
mov dword [esi + 0x29c], eax
call edi
jmp 0x408c37
push 1
push 1
push 0x19
push 0x10
push 0x10
call ebx
push 1
lea ebp, [esi + 0x29c]
push eax
mov dword [ebp], eax
call dword [sym.imp.COMCTL32.dll_ImageList_SetImageCount]
push dword [ebp]
push 1
push 0x1003
push dword [esi + 0x294]
call edi
xor ebp, ebp
cmp dword [esi + 0x2ac], ebp
je 0x408c6f
push 1
push 1
push 0x19
push 0x20
push 0x20
call ebx
push 1
lea ebp, [esi + 0x2a0]
push eax
mov dword [ebp], eax
call dword [sym.imp.COMCTL32.dll_ImageList_SetImageCount]
push dword [ebp]
push 0
push 0x1003
push dword [esi + 0x294]
call edi
push 1
push 1
push 0x19
push 0x10
pop ebp
push ebp
push ebp
call ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
push 0
mov dword [esi + 0x298], eax
call ebx
push 0x1000
push ebp
push ebp
mov ebp, dword [sym.imp.USER32.dll_LoadImageW]
push 0
push 0x85
push eax
call ebp
push 0
mov dword [esp + 0x14], eax
call ebx
push 0x1000
push 0x10
push 0x10
push 0
push 0x86
push eax
call ebp
push 0
push dword [esi + 0x298]
mov ebx, eax
call dword [sym.imp.COMCTL32.dll_ImageList_SetImageCount]
push 0xf
call dword [sym.imp.USER32.dll_GetSysColor]
mov ebp, dword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
push eax
push dword [esp + 0x14]
mov dword [esp + 0x1c], eax
push dword [esi + 0x298]
call ebp
push dword [esp + 0x14]
push ebx
push dword [esi + 0x298]
call ebp
push dword [esp + 0x10]
mov ebp, dword [sym.imp.GDI32.dll_DeleteObject]
call ebp
push ebx
call ebp
mov eax, dword [esi + 0x298]
mov esi, dword [esi + 0x294]
push eax
push 0
push 0x1208
push esi
call fcn.0040310f
pop ecx
push eax
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2bc
ret
Function at 0x409b41
Capabilities:
Hide graphical window

Disassembly:
push edi
mov eax, esi
call fcn.00409b24
test eax, eax
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
je 0x409b61
push 5
push dword [esi + 0x6b4]
call edi
push 0
jmp 0x409b6d
push 0
push dword [esi + 0x6b4]
call edi
push 5
mov eax, dword [esi + 0x69c]
push dword [eax + 0x294]
call edi
pop edi
ret

Function at 0x40a1e8
Capabilities:
Delete file
Open clipboard

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
push edi
mov esi, eax
call fcn.00409b04
test eax, eax
je 0x40a20b
lea edi, [esi + 0x6b4]
call fcn.00404acb
jmp 0x40a27a
push 0x410bc8
lea edi, [ebp - 0x208]
call fcn.00405035
pop ecx
push 1
push 1
mov eax, edi
push 2
push eax
mov edi, esi
call fcn.00408fb6
push esi
call fcn.0040a1b5
test eax, eax
je 0x40a27a
push dword [esi + 0x208]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x40a255
lea eax, [ebp - 0x208]
push eax
call fcn.00404dc6
pop ecx
jmp 0x40a25b
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
je 0x40a26d
push dword [esi + 0x208]
mov ecx, eax
call fcn.00404c57
pop ecx
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
pop edi
pop esi
leave
ret
Function at 0x40a61d
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x44
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x698]
push ebx
xor ebx, ebx
push esi
push edi
mov dword [esp + 0x10], ebx
xor esi, esi
mov dword [esp + 0x44], 0x400
mov dword [esp + 0x48], 0x100
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x38], ebx
call fcn.00407288
mov edi, eax
dec edi
js 0x40a77f
push edi
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x698]
call fcn.0040793b
test eax, eax
je 0x40a6ab
mov eax, dword [esp + 0x10]
add eax, 0xc
push eax
mov dword [esp + 0x18], eax
call sub.msvcrt.dll_wcslen
pop ecx
push dword [esp + 0x14]
lea esi, [esi + eax + 1]
lea eax, [esp + 0x34]
call fcn.00405ac8
dec edi
jns 0x40a670
cmp esi, ebx
jle 0x40a77f
xor eax, eax
lea edi, [esp + 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x14
stosd dword es:[edi], eax
pop ebx
lea eax, [esi + esi + 0x16]
push eax
push 0x2042
mov dword [esp + 0x34], 1
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
push eax
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
mov edi, eax
push ebx
lea eax, [esp + 0x20]
push eax
push edi
call sub.msvcrt.dll_memcpy
xor ebx, ebx
add esp, 0xc
xor esi, esi
cmp dword [esp + 0x4c], ebx
jle 0x40a73e
mov ecx, ebx
lea eax, [esp + 0x30]
call fcn.00405b6a
push eax
mov dword [esp + 0x18], eax
call sub.msvcrt.dll_wcslen
push dword [esp + 0x18]
mov dword [esp + 0x20], eax
lea eax, [edi + esi*2 + 0x14]
push eax
call sub.msvcrt.dll_wcscpy
mov eax, dword [esp + 0x24]
add esp, 0xc
inc ebx
cmp ebx, dword [esp + 0x4c]
lea esi, [esi + eax + 1]
jl 0x40a705
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
mov eax, dword [ebp + 8]
push dword [eax + 0x208]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x40a775
call dword [sym.imp.USER32.dll_EmptyClipboard]
push dword [esp + 0x10]
push 0xf
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x40a77f
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
lea esi, [esp + 0x30]
call fcn.00405aa2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40c19d
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20000
call fcn.0040d420
cmp dword [ebp + 8], 0
je 0x40c202
test esi, esi
je 0x40c1f0
push 0x22
push esi
call sub.msvcrt.dll_wcschr
test eax, eax
pop ecx
pop ecx
je 0x40c1f0
and word [ebp - 0x20000], 0
push esi
push str.__s_
lea eax, [ebp - 0x20000]
push 0xfffe
push eax
call sub.msvcrt.dll__snwprintf
add esp, 0x10
push dword [ebp + 0x1c]
lea eax, [ebp - 0x20000]
push eax
jmp 0x40c1f4
push dword [ebp + 0x1c]
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringW]
leave
ret
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
leave
ret

Function at 0x40c21a
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4004
call fcn.0040d420
push esi
push edi
xor eax, eax
cmp dword [ebp + 8], eax
push 0x4000
push eax
mov word [ebp - 0x4004], ax
lea eax, [ebp - 0x4002]
mov edi, ecx
push eax
je 0x40c279
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x4004]
push eax
push dword [edi]
push dword [ebp + 0x14]
call fcn.0040580a
add esp, 0x18
push dword [ebp + 0x18]
lea eax, [ebp - 0x4004]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringW]
mov esi, eax
jmp 0x40c2ba
call sub.msvcrt.dll_memset
add esp, 0xc
push dword [ebp + 0x18]
lea eax, [ebp - 0x4004]
push 0x2000
push eax
push 0x40e464
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
push dword [ebp + 0x14]
xor ecx, ecx
cmp ecx, eax
sbb esi, esi
push edi
lea edi, [ebp - 0x4004]
neg esi
call fcn.00405893
pop ecx
pop ecx
pop edi
mov eax, esi
pop esi
leave
ret

Function at 0x40c2c0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push dword [ebp + 0x18]
je 0x40c2de
push dword [esi]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0040c150
add esp, 0x10
pop ebp
ret
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntW]
mov dword [esi], eax
pop ebp
ret

Function at 0x40c30d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40c346
mov ecx, dword [ebp - 4]
cmp ecx, 2
jb 0x40c342
shr ecx, 1
and word [esi + ecx*2], ax
leave
ret
and word [esi], 0
leave
ret
Function at 0x40cf3c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
push esi
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x10], esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
cmp eax, esi
mov dword [ebp - 4], eax
jbe 0x40d0ce
push ebx
mov eax, edi
call fcn.00401acd
push dword [ebp - 4]
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov ebx, eax
push ebx
push dword [ebp - 4]
push esi
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0x4105e8
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x40cfbf
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x30]
mov dword [edi + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edi], ecx
mov ecx, dword [eax + 0x14]
mov dword [edi + 0xc], ecx
mov ecx, dword [eax + 0x10]
mov dword [edi + 8], ecx
mov ecx, dword [eax + 0x24]
mov dword [edi + 0x10], ecx
mov eax, dword [eax + 0x28]
mov dword [edi + 0x14], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push str.VarFileInfoTranslation
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x40d00e
mov eax, dword [ebp - 0xc]
movzx ecx, word [eax + 2]
movzx eax, word [eax]
push ecx
push eax
push str._4.4X_4.4X
lea eax, [ebp - 0x38]
push 0x14
push eax
call sub.msvcrt.dll__snwprintf
add esp, 0x14
push 0x40e464
lea eax, [ebp - 0x38]
push eax
push ebx
lea esi, [ebp - 0x238]
call fcn.0040cead
test eax, eax
jne 0x40d01e
lea eax, [ebp - 0x38]
push str.040904E4
push eax
call sub.msvcrt.dll_wcscpy
pop ecx
pop ecx
push 0x4113e4
lea eax, [ebp - 0x38]
push eax
lea esi, [edi + 0x18]
push ebx
call fcn.0040cead
push 0x4113fc
lea eax, [ebp - 0x38]
push eax
lea esi, [edi + 0x218]
push ebx
call fcn.0040cead
push 0x41141c
lea eax, [ebp - 0x38]
push eax
lea esi, [edi + 0x418]
push ebx
call fcn.0040cead
push 0x411434
lea eax, [ebp - 0x38]
push eax
lea esi, [edi + 0x618]
push ebx
call fcn.0040cead
push 0x411454
lea eax, [ebp - 0x38]
push eax
lea esi, [edi + 0x818]
push ebx
call fcn.0040cead
push 0x41146c
lea eax, [ebp - 0x38]
push eax
lea esi, [edi + 0xa18]
push ebx
call fcn.0040cead
push 0x411488
lea eax, [ebp - 0x38]
push eax
lea esi, [edi + 0xc18]
push ebx
call fcn.0040cead
push str.OriginalFileName
lea eax, [ebp - 0x38]
push eax
lea esi, [edi + 0xe18]
push ebx
call fcn.0040cead
xor esi, esi
push ebx
inc esi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop ebx
mov eax, esi
pop esi
leave
ret 4
Function at 0x40d1aa
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x40e400
call fcn.0040d3b8
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x40d1e5
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40d1e5
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x40d1fd
cmp eax, 0x20b
je 0x40d1ea
mov dword [ebp - 0x1c], edi
jmp 0x40d211
cmp dword [ecx + 0x84], 0xe
jbe 0x40d1e5
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x40d20b
cmp dword [ecx + 0x74], 0xe
jbe 0x40d1e5
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 2
pop ebx
push ebx
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x415184], 0xffffffff
or dword [0x415188], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x413e4c]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x413e48]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x415180], eax
call fcn.00401a5c
cmp dword [section..data], edi
jne 0x40d26e
push fcn.00401a5c
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.0040d3a6
push 0x40e3d8
push 0x40e3d4
call sub.msvcrt.dll__initterm
mov eax, dword [0x413e44]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x413e40]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___wgetmainargs]
mov dword [ebp - 0x30], eax
push 0x40e3d0
push 0x40e3b8
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
mov esi, dword [eax]
cmp esi, edi
jne 0x40d2d4
or dword [ebp - 4], 0xffffffff
mov eax, 0xff
jmp 0x40d38e
mov dword [ebp - 0x34], esi
cmp word [esi], 0x22
jne 0x40d322
add esi, ebx
mov dword [ebp - 0x34], esi
mov ax, word [esi]
cmp ax, di
je 0x40d2f0
cmp ax, 0x22
jne 0x40d2dd
cmp word [esi], 0x22
jne 0x40d2fb
add esi, ebx
mov dword [ebp - 0x34], esi
mov ax, word [esi]
cmp ax, di
je 0x40d309
cmp ax, 0x20
jbe 0x40d2f6
mov dword [ebp - 0x4c], edi
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.DLL_GetStartupInfoW]
test byte [ebp - 0x4c], 1
je 0x40d32f
movzx eax, word [ebp - 0x48]
jmp 0x40d332
cmp word [esi], 0x20
jbe 0x40d2fb
add esi, ebx
mov dword [ebp - 0x34], esi
jmp 0x40d322
push 0xa
pop eax
push eax
push esi
push edi
push edi
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call main
mov esi, eax
mov dword [ebp - 0x7c], esi
cmp dword [ebp - 0x1c], edi
jne 0x40d353
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x40d388
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0040d3f1
ret
Function at 0x401000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x28
mov al, 0x6c
mov cl, 0x6f
mov byte [esp + 7], al
mov byte [esp + 0xf], al
mov byte [esp + 0x16], al
mov byte [esp + 0x1c], al
mov byte [esp + 0x1d], al
xor eax, eax
mov byte [esp + 4], cl
mov byte [esp + 8], cl
mov byte [esp + 0xc], cl
mov byte [esp + 0x18], cl
mov dword [esp + 0x1f], eax
lea ecx, [esp + 0x14]
push esi
mov dl, 0x64
mov dword [esp + 0x27], eax
push ecx
xor esi, esi
mov byte [esp + 8], 0x55
mov byte [esp + 9], 0x52
mov byte [esp + 0xa], 0x4c
mov byte [esp + 0xb], 0x44
mov byte [esp + 0xd], 0x77
mov byte [esp + 0xe], 0x6e
mov byte [esp + 0x11], 0x61
mov byte [esp + 0x12], dl
mov byte [esp + 0x13], 0x54
mov byte [esp + 0x15], 0x46
mov byte [esp + 0x16], 0x69
mov byte [esp + 0x18], 0x65
mov byte [esp + 0x19], 0x41
mov byte [esp + 0x1a], 0
mov byte [esp + 0x1b], 0
mov byte [esp + 0x1c], 0x55
mov byte [esp + 0x1d], 0x72
mov byte [esp + 0x1f], 0x6d
mov byte [esp + 0x21], 0x6e
mov byte [esp + 0x22], 0x2e
mov byte [esp + 0x23], dl
mov byte [esp + 0x26], 0
mov byte [esp + 0x2f], al
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x4010ca
lea edx, [esp + 4]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
pop esi
add esp, 0x28
ret
mov eax, esi
pop esi
add esp, 0x28
ret

Function at 0x401120
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
xor eax, eax
push ebx
push esi
mov dword [esp + 0xc], eax
push edi
mov dword [esp + 0x14], eax
mov ecx, 0x10
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x6c]
xor esi, esi
dec ecx
mov dword [esp + 0x18], eax
neg ecx
sbb ecx, ecx
lea edx, [esp + 0xc]
and ecx, 0xfffffffb
mov ebx, dword [esp + 0x64]
add ecx, 5
lea eax, [esp + 0x1c]
mov word [esp + 0x4c], cx
mov ecx, dword [esp + 0x68]
push edx
push eax
push ecx
push esi
push 0x20
push esi
push esi
push esi
push ebx
push esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x44], 0x44
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], esi
mov word [esp + 0x76], si
mov dword [esp + 0x70], esi
mov dword [esp + 0x78], esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edi, eax
cmp edi, esi
jne 0x4011ba
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
push str.Create_process_failed._process_name:__s_n
call fcn.00403062
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x54
ret
cmp byte [esp + 0x70], 1
jne 0x4011ce
mov edx, dword [esp + 0xc]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x54
ret
Function at 0x4011f0
Capabilities:
Move file

Disassembly:
sub esp, 0x20
push edi
mov ecx, 6
xor eax, eax
lea edi, [esp + 8]
mov dword [esp + 4], 0
lea edx, [esp + 4]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x2c]
push edx
stosw word es:[edi], ax
mov eax, dword [esp + 0x2c]
mov word [esp + 0x18], 0x50
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], 1
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
test eax, eax
pop edi
je 0x40124d
push str.Error:_copy_files_failed._n
call fcn.00403062
add esp, 4
xor eax, eax
add esp, 0x20
ret
mov eax, 1
add esp, 0x20
ret

Function at 0x4012d0
Capabilities:
Get common file path

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push ebx
push 0x104
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x40134f
mov cl, byte [eax + ebx - 1]
push edi
cmp cl, 0x5c
je 0x40131c
mov edi, 0x409114
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.mcupdatepackage.exe
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
ret
mov eax, esi
pop esi
pop ebx
ret