joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402da0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x4c
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.00413a90
lea eax, [ebx + 0x78]
mov dword [ebx], vtable._P.0
mov dword [ebp - 0x3c], eax
lea eax, [ebx + 0x80]
sub esp, 4
mov dword [ebx + 0x78], eax
mov edi, dword [esi]
mov esi, dword [esi + 4]
mov edx, edi
add edx, esi
je 0x402de4
test edi, edi
je 0x402f98
mov dword [ebp - 0x30], esi
cmp esi, 0xf
ja 0x402f58
cmp esi, 1
jne 0x402ec8
movzx edx, byte [edi]
mov byte [ebx + 0x80], dl
fld1
mov dword [ebx + 0x7c], esi
lea ecx, [ebx + 0x78]
mov byte [eax + esi], 0
lea eax, [ebx + 0x98]
lea esi, [ebx + 0x90]
fst dword [ebx + 0xa8]
fst dword [ebx + 0xc0]
mov dword [ebx + 0x90], eax
mov dword [ebx + 0x94], 0
mov byte [ebx + 0x98], 0
mov dword [ebx + 0xac], 0x18
mov dword [ebx + 0xb0], 0xc
mov dword [ebx + 0xcc], 0x3f34b4b5
mov dword [esp], 0x5a0158
fst dword [ebx + 0xc4]
fstp dword [ebx + 0xc8]
call fcn.004d5f70
sub esp, 4
test eax, eax
je 0x402f30
mov dword [esp], 0x5a0158
mov ecx, dword [ebp + 0x10]
call fcn.004d5f70
sub esp, 4
test eax, eax
je 0x402ed8
mov eax, dword [ebp + 0x10]
mov ecx, esi
mov dword [esp], eax
call fcn.005437c0
sub esp, 4
mov eax, dword [ebp + 0x14]
test eax, eax
mov eax, 0x10
cmovg eax, dword [ebp + 0x14]
mov dword [ebp + 0x14], eax
mov dword [ebx + 0x68], eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
test esi, esi
je 0x402e02
jmp 0x402f7d
lea eax, [ebp - 0x30]
lea edi, [ebp - 0x28]
mov ecx, esi
mov dword [ebp - 0x28], 0x63616c42
mov dword [esp], eax
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x24], 0x6c6f486b
mov byte [ebp - 0x20], 0x65
mov dword [ebp - 0x2c], 9
mov byte [ebp - 0x1f], 0
call fcn.005437c0
mov eax, dword [ebp - 0x30]
sub esp, 4
cmp eax, edi
je 0x402ea4
mov edx, dword [ebp - 0x28]
mov dword [esp], eax
add edx, 1
mov dword [esp + 4], edx
call fcn.0056dd60
jmp 0x402ea4
lea eax, [ebp - 0x30]
mov ecx, ebx
mov dword [ebp - 0x30], 0x14
mov dword [esp], eax
mov dword [ebp - 0x2c], 0x14
call fcn.00402d30
sub esp, 4
jmp 0x402e7e
lea eax, [ebp - 0x30]
mov dword [esp + 4], 0
lea ecx, [ebx + 0x78]
mov dword [esp], eax
call fcn.00543880
mov edx, dword [ebp - 0x30]
mov dword [ebx + 0x78], eax
sub esp, 8
mov dword [ebx + 0x80], edx
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov esi, dword [ebp - 0x30]
mov eax, dword [ebx + 0x78]
jmp 0x402e02
mov dword [esp], 0x5a015c
call fcn.00571aa0
mov edi, eax
jmp 0x56ecf0
lea ecx, [ebp - 0x30]
call fcn.00540fc0
mov ecx, esi
call fcn.00540fc0
lea ecx, [ebx + 0x78]
call fcn.00540fc0
mov ecx, ebx
call fcn.00413380
mov dword [esp], edi
call fcn.0049fa60
nop
nop
nop
nop
nop
nop
sub esp, 0x1c
mov ecx, 0x656464
call fcn.00563540
mov dword [esp], 0x405e00
call fcn.004014d0
add esp, 0x1c
ret
Function at 0x4051c0
Capabilities:
Create thread

Disassembly:
push ebx
sub esp, 0x28
mov ebx, dword [esp + 0x30]
mov eax, dword [ebx]
test eax, eax
je 0x4051da
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [esp + 0x34]
mov dword [esp + 8], 0x5a202c
mov dword [esp + 4], 0x104
mov dword [esp + 0xc], eax
lea eax, [ebx + 8]
mov dword [esp], eax
call fcn.00404d30
test eax, eax
js 0x405298
mov eax, dword [esp + 0x38]
mov dword [esp + 8], 0x5a202c
mov dword [esp + 4], 0x104
mov dword [esp + 0xc], eax
lea eax, [ebx + 0x210]
mov dword [esp], eax
call fcn.00404d30
test eax, eax
js 0x405298
mov eax, dword [esp + 0x3c]
mov dword [esp + 8], 0x5a202c
mov dword [esp + 4], 0x104
mov dword [esp + 0xc], eax
lea eax, [ebx + 0x418]
mov dword [esp], eax
call fcn.00404d30
test eax, eax
js 0x405298
mov dword [esp + 0xc], ebx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0x404d60
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
sub esp, 0x18
mov dword [ebx], eax
add esp, 0x28
pop ebx
ret
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], 0x5a2034
mov dword [esp + 4], str.Install:_swprintf_nInvalid_path.
mov dword [esp], 0
call dword [sym.imp.USER32.dll_MessageBoxW]
sub esp, 0x10
add esp, 0x28
pop ebx
ret

Function at 0x4052d0
Capabilities:
Create process on windows

Disassembly:
push esi
push ebx
sub esp, 0xa74
lea ebx, [esp + 0x2c]
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call fcn.00402470
mov eax, dword [esp + 0xa84]
mov dword [esp + 0xc], ebx
lea ebx, [esp + 0x234]
mov dword [esp + 8], 0x5a2218
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call fcn.00404d30
test eax, eax
js 0x4053d0
mov eax, dword [esp + 0xa88]
lea esi, [esp + 0x43c]
mov dword [esp + 8], 0x5a2218
mov dword [esp + 4], 0x104
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0xa80]
mov dword [esp], esi
add eax, 0x210
mov dword [esp + 0xc], eax
call fcn.00404d30
test eax, eax
js 0x4053d0
mov dword [esp + 0xc], ebx
lea ebx, [esp + 0x644]
mov dword [esp + 0x10], esi
mov dword [esp + 8], str._E__I__Y___ls____ls_
mov dword [esp + 4], 0x216
mov dword [esp], ebx
call fcn.00404d30
test eax, eax
js 0x4053d0
mov dword [esp + 0xc], ebx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 8], str.xcopy
mov dword [esp + 4], str.open
mov dword [esp], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
sub esp, 0x18
add esp, 0xa74
pop ebx
pop esi
ret
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], 0x5a2034
mov dword [esp + 4], str.ApplyCrack:_swprintf_nInvalid_path.
mov dword [esp], 0
call dword [sym.imp.USER32.dll_MessageBoxW]
sub esp, 0x10
add esp, 0xa74
pop ebx
pop esi
ret
Function at 0x405410
Capabilities:
Create shortcut via ishelllink

Disassembly:
push edi
push esi
push ebx
sub esp, 0x850
lea ebx, [esp + 0x440]
mov dword [esp + 4], 0x104
lea esi, [esp + 0x30]
mov dword [esp], ebx
call fcn.004023a0
mov eax, dword [esp + 0x868]
mov dword [esp + 8], 0x5a2218
mov dword [esp + 4], 0x104
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x860]
mov dword [esp], esi
add eax, 0x210
mov dword [esp + 0xc], eax
call fcn.00404d30
test eax, eax
js 0x405510
mov eax, dword [esp + 0x864]
mov dword [esp + 0xc], ebx
lea ebx, [esp + 0x648]
mov dword [esp + 8], 0x5a22f6
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call fcn.00404d30
test eax, eax
js 0x405510
lea edi, [esp + 0x238]
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x5a202c
mov dword [esp + 4], 0x104
mov dword [esp], edi
call fcn.00404d30
mov dword [esp + 4], 0x104
mov dword [esp], edi
call dword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathCchRemoveFileSpec]
sub esp, 8
mov dword [esp + 4], 2
mov dword [esp], 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
sub esp, 8
cmp eax, 1
jbe 0x405548
mov dword [esp], str.CreateShortcut:_CoInitializeEx_n
call fcn.004027a0
add esp, 0x850
pop ebx
pop esi
pop edi
ret
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], 0x5a2034
mov dword [esp + 4], str.CreateShortcut:_swprintf_nInvalid_path.
mov dword [esp], 0
call dword [sym.imp.USER32.dll_MessageBoxW]
sub esp, 0x10
add esp, 0x850
pop ebx
pop esi
pop edi
ret
lea eax, [esp + 0x28]
mov dword [esp + 0xc], 0x5ef390
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0x17
mov dword [esp + 4], 0
mov dword [esp], 0x5ea91c
call dword [sym.imp.ole32.dll_CoCreateInstance]
sub esp, 0x14
test eax, eax
jne 0x405650
mov eax, dword [esp + 0x28]
mov edx, dword [eax]
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [edx + 0x50]
sub esp, 8
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x86c]
mov edx, dword [eax]
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [edx + 0x2c]
sub esp, 8
mov eax, dword [esp + 0x28]
mov edx, dword [eax]
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [edx + 0x24]
sub esp, 8
mov eax, dword [esp + 0x28]
mov edx, dword [eax]
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [edx + 0x44]
sub esp, 0xc
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0x2c]
mov edx, dword [eax]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0x5ee9b0
mov dword [esp], eax
call dword [edx]
sub esp, 0xc
test eax, eax
jne 0x405668
mov eax, dword [esp + 0x2c]
mov edx, dword [eax]
mov dword [esp + 8], 1
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [edx + 0x18]
sub esp, 0xc
mov eax, dword [esp + 0x2c]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
sub esp, 4
mov eax, dword [esp + 0x28]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
sub esp, 4
call dword [sym.imp.ole32.dll_CoUninitialize]
add esp, 0x850
pop ebx
pop esi
pop edi
ret
mov dword [esp], str.CreateShortcut:_CoCreateInstance_n
call fcn.004027a0
jmp 0x405538
mov dword [esp], str.CreateShortcut:_QueryInterface_n
call fcn.004027a0
jmp 0x405627
Function at 0x406930
Capabilities:
Check mutex on windows

Disassembly:
push esi
push ebx
sub esp, 0x234
call fcn.004065e0
mov eax, dword [0x656434]
lea ebx, [esp + 0x28]
mov dword [esp + 8], 0x5a29a2
mov dword [esp + 4], 0x104
mov dword [esp + 0x10], eax
mov eax, dword [0x656438]
mov dword [esp], ebx
mov dword [esp + 0xc], eax
call fcn.00405ef0
mov dword [esp + 8], ebx
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esp + 4], 1
mov dword [esp], 0
call esi
sub esp, 0xc
test eax, eax
je 0x406a0b
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
test eax, eax
jne 0x406a3b
mov eax, dword [0x6563f0]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov dword [esp], 0x6561e0
mov ebx, eax
call fcn.004024a0
mov eax, dword [0x6563f0]
mov dword [esp + 8], ebx
mov dword [esp], 0x6561e0
mov dword [esp + 4], eax
call fcn.00402540
test eax, eax
je 0x406a23
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call esi
sub esp, 0xc
mov dword [0x6563e8], eax
add esp, 0x234
pop ebx
pop esi
ret
mov dword [esp], str.Init:_CreateMutex_n
call fcn.004027a0
mov dword [esp], 1
call sub.msvcrt.dll_exit
mov dword [esp], str.Init:_WriteTempFile_n
call fcn.004027a0
mov dword [esp], 1
call sub.msvcrt.dll_exit
mov dword [esp], str.Init:_WaitForSingleObject_n
call fcn.004027a0
mov dword [esp], 1
call sub.msvcrt.dll_exit
lea esi, [esi]
lea esi, [esi]
Function at 0x40d730
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp byte [ecx + 0x4c], 0
jne 0x40d740
ret
jmp fcn.0040cd60
Function at 0x426b10
Capabilities:
Create thread

Disassembly:
push ebx
sub esp, 0x28
mov ebx, dword [esp + 0x30]
mov eax, dword [ebx]
test eax, eax
je 0x426b2a
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [esp + 0xc], ebx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0x4269a0
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
sub esp, 0x18
mov dword [ebx], eax
add esp, 0x28
pop ebx
ret
Function at 0x42e7f0
Capabilities:
Get common file path
Get memory capacity

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x40000
mov esi, dword [esp + 0x24]
call sub.msvcrt.dll_malloc
test eax, eax
je 0x42e83b
mov ebx, eax
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.0042e440
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.USER32.dll_CharToOemW]
sub esp, 8
mov dword [esp], ebx
call sub.msvcrt.dll_free
add esp, 0x14
mov eax, esi
pop ebx
pop esi
ret
cmp dword [0x677e60], 0
je 0x42e859
mov dword [esp + 4], 1
mov dword [esp], 0x677e20
call dword [sym.imp.msvcrt.dll_longjmp]
mov eax, 0x40000
call fcn.0042e550
lea esi, [esi]
lea esi, [esi]
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x40000
mov esi, dword [esp + 0x24]
call sub.msvcrt.dll_malloc
test eax, eax
je 0x42e8bb
mov ebx, eax
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_OemToCharW]
sub esp, 8
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.0042e6c0
mov dword [esp], ebx
call sub.msvcrt.dll_free
add esp, 0x14
mov eax, esi
pop ebx
pop esi
ret
cmp dword [0x677e60], 0
je 0x42e8d9
mov dword [esp + 4], 1
mov dword [esp], 0x677e20
call dword [sym.imp.msvcrt.dll_longjmp]
mov eax, 0x40000
call fcn.0042e550
lea esi, [esi]
lea esi, [esi]

Function at 0x42e8f0
Capabilities:
Get common file path
Get memory capacity

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [0x678014]
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x42e970
test eax, eax
je 0x42e931
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x42e937
mov eax, dword [0x678014]
test eax, eax
je 0x42e931
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [0x678014], 0
cmp word [ebx], 0
jne 0x42e940
add esp, 0x14
pop ebx
pop esi
ret
mov dword [esp], ebx
call sub.msvcrt.dll_wcslen
lea esi, [eax + eax + 2]
mov dword [esp], esi
call sub.msvcrt.dll_malloc
test eax, eax
je 0x42e98c
mov dword [esp + 4], ebx
mov dword [esp], eax
mov dword [0x678014], eax
call sub.msvcrt.dll_wcscpy
add esp, 0x14
pop ebx
pop esi
ret
test eax, eax
je 0x42e937
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [0x678014], 0
add esp, 0x14
pop ebx
pop esi
ret
cmp dword [0x677e60], 0
je 0x42e9aa
mov dword [esp + 4], 1
mov dword [esp], 0x677e20
call dword [sym.imp.msvcrt.dll_longjmp]
mov eax, esi
call fcn.0042e550
lea esi, [esi]
lea esi, [esi]
nop
Function at 0x42e9c0
Capabilities:
Get common file path
Get memory capacity

Disassembly:
push ebx
sub esp, 0x18
mov ebx, dword [0x678014]
test ebx, ebx
je 0x42e9d8
add esp, 0x18
mov eax, ebx
pop ebx
ret
mov dword [esp], 0x40000
call sub.msvcrt.dll_malloc
test eax, eax
je 0x42ea2b
mov dword [0x678014], eax
mov dword [esp + 4], eax
mov dword [esp], 0x10000
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov eax, dword [0x678014]
sub esp, 8
mov dword [esp], eax
call sub.msvcrt.dll_wcslen
mov ebx, dword [0x678014]
lea eax, [eax + eax + 2]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_realloc
add esp, 0x18
mov eax, ebx
pop ebx
ret
cmp dword [0x677e60], 0
je 0x42ea49
mov dword [esp + 4], 1
mov dword [esp], 0x677e20
call dword [sym.imp.msvcrt.dll_longjmp]
mov eax, 0x40000
call fcn.0042e550
lea esi, [esi]
lea esi, [esi]

Function at 0x42ea60
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x7c
mov dword [esp + 0x30], 0x40
mov dword [esp], 0x5a5698
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 4], str.GlobalMemoryStatusEx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
sub esp, 8
test eax, eax
je 0x42eaa3
lea edx, [esp + 0x30]
mov dword [esp], edx
call eax
sub esp, 4
test eax, eax
jne 0x42eac8
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x20
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
xor edx, edx
sub esp, 4
mov eax, dword [esp + 0x18]
add esp, 0x7c
ret
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
add esp, 0x7c
ret

Function at 0x42eb60
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x4c
lea eax, [esp + 0x1c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
sub esp, 4
mov eax, dword [esp + 0x30]
add esp, 0x4c
ret

Function at 0x42eb80
Capabilities:
Timestomp file

Disassembly:
push esi
push ebx
sub esp, 0x44
mov edx, dword [esp + 0x54]
test edx, edx
jns 0x42eb95
mov dword [esp + 0x54], 0x7fffffff
lea eax, [esp + 0x54]
lea esi, [esp + 0x28]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll_gmtime]
movzx ecx, word [eax + 0x14]
lea edx, [ecx + 0x76c]
movzx ecx, word [eax + 0x10]
mov word [esp + 0x30], dx
lea edx, [ecx + 1]
mov word [esp + 0x32], dx
mov edx, dword [eax + 0xc]
mov word [esp + 0x36], dx
mov edx, dword [eax + 8]
mov word [esp + 0x38], dx
mov edx, dword [eax + 4]
mov eax, dword [eax]
mov dword [esp + 4], esi
mov word [esp + 0x3a], dx
mov word [esp + 0x3c], ax
xor eax, eax
mov word [esp + 0x3e], ax
lea eax, [esp + 0x30]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
sub esp, 8
mov eax, dword [esp + 0x50]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x2000000
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0x100
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
sub esp, 0x1c
mov ebx, eax
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetFileTime]
sub esp, 0x10
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
add esp, 0x44
pop ebx
pop esi
ret
Function at 0x42ed70
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Create process suspended

Disassembly:
push edi
mov ecx, 0x10
xor eax, eax
push esi
push ebx
sub esp, 0x90
lea edx, [esp + 0x50]
mov ebx, dword [esp + 0xac]
mov dword [esp + 0x4c], 0x44
lea esi, [esp + 0x4c]
mov edi, edx
rep stosd dword es:[edi], eax
test ebx, ebx
je 0x42eeb0
mov edi, dword [sym.imp.msvcrt.dll__get_osfhandle]
mov dword [esp + 0x78], 0x101
mov dword [esp], 0
call edi
mov dword [esp], 1
mov dword [esp + 0x84], eax
call edi
mov dword [esp], 2
mov dword [esp + 0x88], eax
call edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x8c], eax
lea eax, [esp + 0x3c]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0xa4]
mov dword [esp + 0x3c], 0
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0xa0]
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
sub esp, 0x28
mov esi, eax
mov eax, dword [esp + 0xb0]
mov dword [esp], eax
call ebx
test esi, esi
je 0x42eea2
mov edx, dword [esp + 0xa8]
mov eax, dword [esp + 0x3c]
test edx, edx
jne 0x42ef70
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp], eax
call ebx
sub esp, 4
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call ebx
sub esp, 4
mov eax, dword [esp + 0x38]
add esp, 0x90
pop ebx
pop esi
pop edi
ret
mov ebx, dword [sym.imp.msvcrt.dll__get_osfhandle]
mov dword [esp], 0
call ebx
mov dword [esp], 1
mov dword [esp + 0x84], eax
call ebx
mov dword [esp], 2
mov dword [esp + 0x88], eax
call ebx
mov dword [esp + 0x20], esi
mov dword [esp + 0x8c], eax
lea eax, [esp + 0x3c]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0xa4]
mov dword [esp + 0x3c], 0
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0xa0]
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
sub esp, 0x28
mov esi, eax
jmp 0x42ee71
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
lea eax, [esp + 0x38]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
sub esp, 8
mov eax, dword [esp + 0x3c]
jmp 0x42ee88
Function at 0x42f1e0
Capabilities:
Create directory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov esi, dword [esp + 0x20]
mov dword [esp + 4], 0
mov dword [esp], esi
call sub.msvcrt.dll_wcschr
mov ebx, eax
jmp 0x42f217
movzx eax, word [ebx]
mov dword [esp], 0x5a5776
mov dword [esp + 4], eax
call sub.msvcrt.dll_wcschr
test eax, eax
jne 0x42f228
sub ebx, 2
cmp esi, ebx
jbe 0x42f200
add esp, 0x10
pop ebx
pop esi
pop edi
ret
xor eax, eax
movzx edi, word [ebx]
mov word [ebx], ax
mov dword [esp + 4], 0
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__waccess]
test eax, eax
jne 0x42f250
mov word [ebx], di
add esp, 0x10
pop ebx
pop esi
pop edi
ret
mov dword [esp], esi
call fcn.0042f1e0
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__wmkdir]
mov word [ebx], di
jmp 0x42f248
Function at 0x432370
Capabilities:
Set console window title

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov esi, dword [0x678010]
sub esi, 1
js 0x42f33b
mov ebx, dword [esi*4 + 0x677e80]
mov eax, dword [ebx + 8]
test eax, eax
jns 0x42f348
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x14]
sub esi, 1
jae 0x42f321
add esp, 0x10
pop ebx
pop esi
pop edi
ret
mov dword [esp], eax
call sub.msvcrt.dll__close
test eax, eax
je 0x42f400
mov eax, dword [0x677e60]
test eax, eax
jne 0x42f420
mov dword [esp], 0x40000
call sub.msvcrt.dll_malloc
mov edi, eax
test eax, eax
je 0x42f435
mov dword [esp], 0x40000
call sub.msvcrt.dll_malloc
mov esi, eax
test eax, eax
je 0x42f435
mov eax, dword [ebx + 0x10]
mov dword [esp + 4], 0x5a577c
mov dword [esp], edi
mov dword [esp + 8], eax
call fcn.004bf1f0
mov dword [esp], 0x40000
call sub.msvcrt.dll_malloc
mov ebx, eax
test eax, eax
je 0x42f413
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.0042e440
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.USER32.dll_CharToOemW]
sub esp, 8
mov dword [esp], ebx
call sub.msvcrt.dll_free
mov dword [esp + 4], esi
mov dword [esp], 0x5a575c
call fcn.004bf160
mov dword [esp], 2
call sub.msvcrt.dll_exit
lea esi, [esi]
mov dword [ebx + 8], 0xffffffff
mov ebx, dword [esi*4 + 0x677e80]
jmp 0x42f32f
cmp dword [0x677e60], 0
je 0x42f435
lea esi, [esi]
mov dword [esp + 4], 1
mov dword [esp], 0x677e20
call dword [sym.imp.msvcrt.dll_longjmp]
mov eax, 0x40000
call fcn.0042e550
nop
sub esp, 0x1c
cmp byte [0x657621], 0
jne 0x42f455
cmp byte [0x657620], 0
je 0x42f470
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
sub esp, 4
add esp, 0x1c
ret
mov dword [esp + 4], 0x103e8
mov dword [esp], 0x657640
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleW]
mov byte [0x657621], 1
sub esp, 8
jmp 0x42f455
jmp 0x42f310

Function at 0x4326a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
xor ebx, ebx
lea esi, [esi]
nop
mov eax, ebx
mov edx, 8
nop
mov ecx, eax
and eax, 1
neg eax
shr ecx, 1
and eax, 0xedb88320
xor eax, ecx
sub edx, 1
jne 0x4326b0
mov dword [ebx*4 + 0x678040], eax
add ebx, 1
cmp ebx, 0x100
jne 0x4326a8
lea esi, [esi]
nop
mov eax, dword [ebx*4 + 0x677c40]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x678040]
mov dword [ebx*4 + 0x678040], eax
add ebx, 1
cmp ebx, 0x800
jne 0x4326e0
pop ebx
ret
Function at 0x432710
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [0x67a03c]
mov ebx, dword [esp + 0x30]
mov esi, dword [esp + 0x34]
mov edi, dword [esp + 0x38]
test eax, eax
je 0x432760
movzx eax, byte [0x67df08]
test al, al
je 0x432770
mov eax, dword [0x67df10]
test eax, eax
je 0x4327b0
mov dword [esp + 0xc], 0x678040
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], edi
call eax
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.004326a0
movzx eax, byte [0x67df08]
test al, al
jne 0x432737
mov dword [esp], 0x67df08
call fcn.0056e210
test eax, eax
je 0x432737
mov dword [esp + 4], 0
mov dword [esp], str.CrcUpdate
call fcn.00432220
mov dword [esp], 0x67df08
mov dword [0x67df10], eax
call fcn.0056e2e0
mov eax, dword [0x67df10]
test eax, eax
jne 0x432740
nop
test esi, esi
jne 0x4327e1
jmp 0x432870
mov edx, edi
xor dl, byte [ebx]
mov eax, edi
add ebx, 1
movzx edx, dl
shr eax, 8
xor eax, dword [edx*4 + 0x678040]
mov edi, eax
sub esi, 1
je 0x432870
test bl, 3
jne 0x4327c0
cmp esi, 3
jbe 0x43287a
lea eax, [esi - 4]
shr eax, 2
lea ecx, [ebx + eax*4 + 4]
mov eax, edi
lea esi, [esi]
nop
xor eax, dword [ebx]
add ebx, 4
mov edx, eax
movzx ebp, al
shr edx, 0x10
mov ebp, dword [ebp*4 + 0x678c40]
movzx edi, dl
mov edx, eax
shr edx, 0x18
xor ebp, dword [edx*4 + 0x678040]
movzx edx, ah
mov eax, dword [edx*4 + 0x678840]
xor eax, ebp
xor eax, dword [edi*4 + 0x678440]
cmp ebx, ecx
jne 0x432800
and esi, 3
je 0x432755
add esi, ecx
movzx edx, byte [ecx]
add ecx, 1
xor edx, eax
shr eax, 8
movzx edx, dl
xor eax, dword [edx*4 + 0x678040]
cmp ecx, esi
jne 0x432845
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x1c
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, ebx
mov eax, edi
jmp 0x432843