joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410d8e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push dword [ebp + 0xc]
mov esi, ecx
lea ecx, [esi + 0x1c]
mov dword [esi + 0x18], ebx
call fcn.00402f12
push dword [ebp + 0x10]
lea ecx, [esi + 0x20]
call fcn.00402f12
push dword [ebp + 0x10]
lea ecx, [esi + 0x24]
call fcn.00402f12
push str..tmp
lea ecx, [esi + 0x24]
call fcn.0040b457
push dword [esi + 0x24]
inc dword [esi + 0x14]
push str.CThreadDownloader::Start_n_t___TempFN___s_n
call fcn.0041141b
pop ecx
pop ecx
push ebx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x410deb
xor al, al
jmp 0x410e20
lea eax, [ebp + 8]
push eax
xor edi, edi
push edi
push esi
push 0x410d5b
push edi
push edi
call fcn.004164ba
add esp, 0x18
push 0x64
mov dword [esi + 0xc], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.CThreadDownloader::Start___Exit_n
call fcn.0041141b
xor eax, eax
cmp dword [esi + 0xc], edi
pop ecx
setne al
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x410edf
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
mov eax, dword [0x43db90]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
mov esi, ecx
push str.DownloadForcer
mov byte [esi + 0xd], bl
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x808], eax
cmp eax, ebx
mov eax, str.success
jne 0x410f1f
mov eax, str.fail
push eax
push str.CallURL___StartInternet___s__n
call fcn.0041141b
push dword [esi + 0x10]
push str.CallURL___InternetOpenUrl_n_t____s_n
call fcn.0041141b
mov eax, dword [esi + 0x10]
add esp, 0x10
push ebx
push 0x4000000
push ebx
push ebx
push eax
push dword [ebp - 0x808]
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov edi, eax
mov dword [ebp - 0x814], edi
cmp edi, ebx
jne 0x410f6b
push dword [esi + 0x10]
push str.CallURL___Failed_to_open_the_file_for_downloading__n_t____s_n
jmp 0x41104c
push ebx
lea eax, [ebp - 0x818]
push eax
lea eax, [ebp - 0x810]
push eax
push 0x20000013
push edi
mov dword [ebp - 0x810], ebx
mov dword [ebp - 0x818], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x411044
mov eax, dword [ebp - 0x810]
add eax, 0xffffff38
cmp eax, 0x63
ja 0x411044
lea ecx, [esi + 0x14]
push 0x42f814
mov dword [ebp - 0x80c], ebx
call fcn.00402f65
lea eax, [ebp - 0x80c]
push eax
push 0x800
lea eax, [ebp - 0x804]
push eax
push edi
mov edi, dword [sym.imp.WININET.dll_InternetReadFile]
jmp 0x41101a
mov eax, dword [ebp - 0x80c]
cmp eax, ebx
je 0x411020
mov byte [ebp + eax - 0x804], bl
lea eax, [ebp - 0x804]
push eax
lea ecx, [esi + 0x14]
call fcn.0040b457
lea eax, [ebp - 0x80c]
push eax
push 0x800
lea eax, [ebp - 0x804]
push eax
push dword [ebp - 0x814]
call edi
test eax, eax
jne 0x410fe1
cmp dword [ebp - 0x808], ebx
je 0x411034
push dword [ebp - 0x808]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, dword [esi]
mov ecx, esi
mov byte [esi + 0xd], 1
call dword [eax + 4]
mov al, byte [esi + 0xd]
jmp 0x411069
push dword [esi + 0x10]
push str.CallURL___The_requested_file_was_not_found_on_the_download_server__n_t____s_n
call fcn.0041141b
pop ecx
pop ecx
cmp dword [ebp - 0x808], ebx
je 0x411067
push dword [ebp - 0x808]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00415106
leave
ret
Function at 0x41126e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push str.SoftwareLFG_
lea ecx, [ebp - 8]
call fcn.00403883
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
push dword [eax - 8]
lea ecx, [ebp - 8]
call fcn.00409e03
lea eax, [ebp - 4]
push eax
push 0x20019
xor ebx, ebx
push ebx
push dword [ebp - 8]
mov dword [ebp - 0x10], ebx
push closesocket
mov dword [ebp - 0x14], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x411300
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edi
lea eax, [ebp - 0x18]
push eax
push ebx
lea eax, [ebp - 0xc]
push eax
push ebx
mov edi, 0x432f70
push edi
push dword [ebp - 4]
call esi
test eax, eax
jne 0x4112f5
cmp dword [ebp - 0xc], 4
jne 0x4112f5
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push edi
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
cmp dword [ebp - 0x10], 1
lea ecx, [ebp - 8]
sete bl
call fcn.004017df
mov al, bl
pop ebx
leave
ret

Function at 0x411331
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push str.SoftwareLFG_
lea ecx, [ebp - 4]
xor ebx, ebx
call fcn.00403883
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
push dword [eax - 8]
lea ecx, [ebp - 4]
call fcn.00409e03
lea eax, [ebp - 8]
push eax
push 0xf003f
push ebx
push dword [ebp - 4]
mov dword [ebp - 0xc], 1
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4113a1
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push ebx
push 0x432f70
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x411398
mov bl, 1
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 4]
call fcn.004017df
mov al, bl
pop ebx
leave
ret 4

Function at 0x4113b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
lea eax, [ebp + 8]
push eax
lea ecx, [esi + 0x10]
call fcn.00402f12
push dword [ebp + 0xc]
lea ecx, [esi + 0x18]
call fcn.00402f12
push 0x42f814
lea ecx, [esi + 0x14]
call fcn.00402f65
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push ebx
push esi
push 0x411314
push ebx
push ebx
mov word [esi + 0xc], bx
mov byte [esi + 4], bl
call fcn.004164ba
add esp, 0x18
push 0x64
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esi + 8], ebx
lea ecx, [ebp + 8]
setne bl
call fcn.004017df
pop esi
mov al, bl
pop ebx
leave
ret 8

Function at 0x41141b
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x43db90]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
je 0x41146f
push esi
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
mov esi, 0x400
lea eax, [ebp - 0x404]
push esi
push eax
call fcn.00416e20
lea eax, [ebp - 0x404]
push eax
call fcn.00414820
add esp, 0x14
cmp eax, esi
pop esi
jae 0x41146f
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00415106
leave
ret
Function at 0x4115f9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x43b014]
push ebx
push dword [ebp + 8]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push str.SetupSpec_d
push eax
mov bl, 1
call fcn.004038de
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
push str.SoftwareMicrosoftDirectInfo
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x41166a
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp - 4]
mov dword [ebp - 0x14], 4
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x411661
cmp dword [ebp - 0xc], eax
sete bl
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 4]
call fcn.004017df
mov al, bl
pop ebx
leave
ret

Function at 0x411677
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x43b014]
push ebx
push esi
push edi
push dword [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push str.SetupSpec_d
push eax
call fcn.004038de
mov eax, dword [0x43b014]
push dword [ebp + 8]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push str.UpdateSpec_d
push eax
call fcn.004038de
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
add esp, 0x18
lea eax, [ebp - 4]
push eax
mov ebx, str.SoftwareMicrosoftDirectInfo
push ebx
mov edi, closesocket
push edi
call esi
test eax, eax
jne 0x4116f7
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push 0
push dword [ebp - 0xc]
mov dword [ebp - 0x10], 0x45
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push ebx
push edi
call esi
pop edi
pop esi
pop ebx
test eax, eax
jne 0x41172c
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push 0
push dword [ebp - 8]
mov dword [ebp - 0x10], 0xc0fe
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 8]
call fcn.004017df
lea ecx, [ebp - 0xc]
call fcn.004017df
leave
ret
Function at 0x41173e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push str.SoftwareLFG_
lea ecx, [ebp - 8]
call fcn.00403883
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
push eax
push dword [eax - 8]
lea ecx, [ebp - 8]
call fcn.00409e03
mov eax, dword [0x43b014]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push dword [ebp - 8]
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4117f2
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edi
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov edi, str.TrackID
push edi
push dword [ebp - 4]
call esi
test eax, eax
jne 0x4117e7
cmp dword [ebp - 0x10], 1
jne 0x4117e7
push dword [ebp - 0xc]
call fcn.00414d17
pop ecx
lea ecx, [ebp - 0xc]
push ecx
push eax
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 0
push edi
push dword [ebp - 4]
call esi
test eax, eax
jne 0x4117de
push dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
call fcn.00402f65
push dword [ebp + 0xc]
call fcn.0041446f
pop ecx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
lea ecx, [ebp - 8]
call fcn.004017df
mov eax, dword [ebp + 8]
leave
ret

Function at 0x4117ff
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push str.SoftwareLFG_
lea ecx, [ebp - 4]
xor ebx, ebx
call fcn.00403883
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
push dword [eax - 8]
lea ecx, [ebp - 4]
call fcn.00409e03
lea eax, [ebp - 8]
push eax
push 0xf003f
push ebx
push dword [ebp - 4]
mov dword [ebp - 0xc], 1
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41186f
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push ebx
push str.Done
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x411866
mov bl, 1
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 4]
call fcn.004017df
mov al, bl
pop ebx
leave
ret

Function at 0x411972
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push str.SoftwareLFG
lea ecx, [ebp - 0xc]
xor ebx, ebx
call fcn.00403883
mov eax, dword [0x43b014]
push 0xbb9
lea ecx, [ebp - 8]
mov dword [ebp - 8], eax
call fcn.00403284
push dword [ebp - 8]
call fcn.0041462b
pop ecx
mov dword [ebp - 0x10], eax
lea eax, [ebp - 4]
push eax
push 0x20006
push ebx
push dword [ebp - 0xc]
mov esi, closesocket
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4119d9
lea eax, [ebp - 4]
push eax
push dword [ebp - 0xc]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4119ff
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push ebx
push 0x42f8ec
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x4119f6
mov bl, 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 8]
call fcn.004017df
lea ecx, [ebp - 0xc]
call fcn.004017df
pop esi
mov al, bl
pop ebx
leave
ret
Function at 0x411a15
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x43db90]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
push 0x42f814
mov ecx, edi
call fcn.00403883
and dword [ebp - 0x210], 0
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x108]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
je 0x411b03
push esi
call fcn.00414d17
pop ecx
push eax
push esi
push dword [ebp - 0x218]
mov dword [ebp - 0x214], eax
lea eax, [ebp - 0x108]
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x411af7
push 0x4b0
push 0x409
lea eax, [ebp - 0x20c]
push str.StringFileInfo_04x_04xSpecialBuild
push eax
call fcn.004153fa
add esp, 0x10
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x214]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x411af7
cmp dword [ebp - 0x210], 0
je 0x411af7
cmp dword [ebp - 0x21c], 0
je 0x411af7
push dword [ebp - 0x210]
mov ecx, edi
call fcn.00402f65
push dword [ebp - 0x214]
call fcn.0041446f
pop ecx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.00415106
leave
ret

Function at 0x411b13
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push str.SoftwareLFG_
lea ecx, [ebp - 8]
xor ebx, ebx
call fcn.00403883
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
push dword [eax - 8]
lea ecx, [ebp - 8]
call fcn.00409e03
mov eax, dword [0x43b014]
push 0xbb8
lea ecx, [ebp - 4]
mov dword [ebp - 4], eax
call fcn.00403284
mov eax, dword [0x43b014]
mov dword [ebp + 8], eax
lea eax, [ebp - 0x10]
push eax
call fcn.00411a15
pop ecx
push eax
lea ecx, [ebp + 8]
call fcn.00402f12
lea ecx, [ebp - 0x10]
call fcn.004017df
mov eax, dword [ebp + 8]
cmp dword [eax - 8], ebx
je 0x411b87
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 4]
call fcn.00402f12
lea eax, [ebp - 0xc]
push eax
push 0x20006
push ebx
push dword [ebp - 8]
mov esi, closesocket
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x411bb6
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x411bdd
mov eax, dword [ebp - 4]
push dword [eax - 8]
push eax
push 1
push ebx
push str.TrackID
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x411bd4
mov bl, 1
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 8]
call fcn.004017df
lea ecx, [ebp - 4]
call fcn.004017df
lea ecx, [ebp - 8]
call fcn.004017df
pop esi
mov al, bl
pop ebx
leave
ret

Function at 0x4120c0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret
Function at 0x415106
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43db90]
jne 0x415110
repz ret
jmp fcn.0041b64c

Function at 0x424869
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x43db90]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00418039
and dword [ebp - 0x14], 0
cmp dword [0x440068], 0
mov dword [ebp - 0x18], eax
jne 0x42491c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4249c4
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4249c4
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x440068], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x44006c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x440070], eax
call edi
push eax
call esi
mov dword [0x440078], eax
test eax, eax
je 0x42491c
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x440074], eax
mov eax, dword [0x440074]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x424975
cmp dword [0x440078], ecx
je 0x424975
push eax
call esi
push dword [0x440078]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x424975
test ebx, ebx
je 0x424975
call edi
test eax, eax
je 0x42496c
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x42496c
test byte [ebp - 8], 1
jne 0x424975
or dword [ebp + 0x10], 0x200000
jmp 0x4249a8
mov eax, dword [0x44006c]
cmp eax, dword [ebp - 0x18]
je 0x4249a8
push eax
call esi
test eax, eax
je 0x4249a8
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4249a8
mov eax, dword [0x440070]
cmp eax, dword [ebp - 0x18]
je 0x4249a8
push eax
call esi
test eax, eax
je 0x4249a8
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x440068]
call esi
test eax, eax
je 0x4249c4
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4249c6
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00415106
leave
ret
Function at 0x42c191
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x4400ec], 0
push esi
push edi
jne 0x42c107
call fcn.0042c073
test eax, eax
je 0x42c14c
mov eax, dword [0x4400ec]
cmp eax, 1
jne 0x42c128
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x42c14c
jmp 0x42c18e
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x42c18e
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x42c150
xor eax, eax
jmp 0x42c18e
mov eax, dword [esi]
push dword [0x4400ec]
call edi
mov edi, eax
test edi, edi
je 0x42c172
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x42c18e
lea edi, [esi + 0xff0]
push esi
push dword [0x4400ec]
call dword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x42c178
mov eax, esi
pop edi
pop esi
ret
jmp 0x42c0f3
Function at 0x401040
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov ebx, 0x43c1bc
mov dword [ebp - 8], 0
mov eax, dword [ebx]
inc eax
push eax
call fcn.0041fc44
mov edi, eax
xor eax, eax
add esp, 4
mov dword [ebp - 4], edi
cmp dword [ebx], eax
jbe 0x401082
lea esp, [esp]
mov ecx, dword [ebx + 4]
mov dl, byte [ecx + eax]
xor dl, byte [ebx - 4]
inc eax
mov byte [eax + edi - 1], dl
cmp eax, dword [ebx]
jb 0x401070
mov byte [eax + edi], 0
mov ecx, dword [0x443b80]
mov edx, dword [0x443b7c]
lea eax, [ebp - 4]
cmp eax, ecx
jae 0x401109
cmp edx, eax
ja 0x401109
mov esi, dword [0x443b84]
mov edi, eax
sub edi, edx
sar edi, 2
cmp ecx, esi
jne 0x4010fe
mov eax, ecx
sub eax, edx
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x40118c
sub esi, edx
inc eax
sar esi, 2
cmp eax, esi
jbe 0x4010fe
mov ecx, esi
mov edx, ecx
shr edx, 1
mov esi, 0x3fffffff
sub esi, edx
cmp esi, ecx
jae 0x4010df
xor ecx, ecx
jmp 0x4010e1
add ecx, edx
cmp ecx, eax
jae 0x4010e7
mov ecx, eax
push ecx
mov esi, 0x443b7c
call fcn.00401200
mov ecx, dword [0x443b80]
mov edx, dword [0x443b7c]
test ecx, ecx
je 0x401165
mov edx, dword [edx + edi*4]
mov dword [ecx], edx
jmp 0x40115f
mov esi, dword [0x443b84]
cmp ecx, esi
jne 0x401159
mov eax, ecx
sub eax, edx
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x40118c
sub esi, edx
mov edx, esi
inc eax
sar edx, 2
cmp eax, edx
jbe 0x401159
mov ecx, edx
shr edx, 1
mov esi, 0x3fffffff
sub esi, edx
cmp esi, ecx
jae 0x401140
xor ecx, ecx
jmp 0x401142
add ecx, edx
cmp ecx, eax
jae 0x401148
mov ecx, eax
push ecx
mov esi, 0x443b7c
call fcn.00401200
mov ecx, dword [0x443b80]
test ecx, ecx
je 0x401165
mov dword [ecx], edi
mov ecx, dword [0x443b80]
mov eax, dword [ebp - 8]
add eax, 0xc
add ecx, 4
add ebx, 0xc
mov dword [0x443b80], ecx
mov dword [ebp - 8], eax
cmp eax, 0x1e0
jb 0x401055
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.vector_T__too_long
call fcn.0041fb89
int3
Function at 0x401300
Capabilities:
Check if file exists

Disassembly:
push ebx
push esi
push edi
push 0
call fcn.0042105a
push eax
call fcn.00420f26
add esp, 8
mov ebx, 0x443be4
mov edi, 0x443bc8
lea ecx, [ecx]
mov eax, dword [ebx]
push eax
call fcn.00420fe0
add esp, 4
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401330
sub eax, edx
mov edx, eax
mov eax, dword [edi]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401340
sub eax, esi
lea ecx, [eax + edx + 8]
push ecx
call fcn.0041fc44
mov edx, dword [edi]
add esp, 4
mov esi, eax
mov eax, dword [ebx]
push edx
push eax
call fcn.00420fe0
add esp, 4
push eax
push 0x43c3ac
push esi
call fcn.00420e97
add esp, 0x10
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x40140b
push esi
call fcn.00420f1b
add edi, 4
add esp, 4
cmp edi, 0x443be4
jl 0x401320
add ebx, 4
cmp ebx, 0x443be8
jl 0x401318
call fcn.00420f38
mov ecx, dword [0x443be4]
push ecx
call fcn.00420fe0
add esp, 4
mov ebx, eax
call fcn.00420f38
cdq
mov ecx, 7
idiv ecx
mov eax, ebx
mov edi, dword [edx*4 + 0x443bc8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4013d6
sub eax, edx
mov edx, eax
mov eax, edi
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4013e6
sub eax, esi
lea edx, [eax + edx + 8]
push edx
call fcn.0041fc44
push edi
push ebx
mov esi, eax
push 0x43c3ac
push esi
call fcn.00420e97
add esp, 0x14
pop edi
mov eax, esi
pop esi
pop ebx
ret