joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4050bb
Capabilities:
Delete file

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
xor edi, edi
cmp dword [esi + 0x108], edi
jle 0x4050ea
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4050f4
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, dword [esi + 0x108]
jl 0x4050cb
push esi
call sub.MFC42.DLL_operatordelete
pop ecx
pop edi
pop esi
ret
cmp byte [esi + 0x104], 0
je 0x4050f1
push 0
push esi
push 1
push 4
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
jmp 0x4050f1

Function at 0x40510c
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push eax
call sub.MSVCRT.dll_strcpy
mov esi, dword [sym.imp.MSVCRT.dll_strchr]
lea eax, [ebp - 0x104]
push 0x5c
push eax
call esi
inc eax
push 0x5c
push eax
call esi
add esp, 0x18
mov edi, eax
test edi, edi
je 0x405165
and byte [edi], 0
lea eax, [ebp - 0x104]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov byte [edi], 0x5c
inc edi
push 0x5c
push edi
call esi
pop ecx
pop ecx
jmp 0x405140
push dword [ebp + 8]
call fcn.00405172
pop ecx
pop edi
pop esi
leave
ret

Function at 0x405172
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
ret

Function at 0x405187
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [sym.imp.MSVCRT.dll_fopen]
push esi
push edi
push 0x40a40c
push dword [esp + 0x18]
call ebp
mov esi, eax
pop ecx
test esi, esi
pop ecx
je 0x4051f2
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
push 2
push 0
push esi
call edi
push esi
call dword [sym.imp.MSVCRT.dll_ftell]
push 0
push 0
push esi
mov ebx, eax
call edi
push ebx
call dword [sym.imp.MSVCRT.dll_malloc]
push esi
mov edi, eax
push 1
push ebx
push edi
call dword [sym.imp.MSVCRT.dll_fread]
push esi
mov esi, dword [sym.imp.MSVCRT.dll_fclose]
call esi
push 0x40a620
push dword [esp + 0x50]
call ebp
mov ebp, eax
add esp, 0x3c
test ebp, ebp
jne 0x4051f6
xor al, al
jmp 0x405210
push ebp
push 1
push ebx
push edi
call dword [sym.imp.MSVCRT.dll_fwrite]
push ebp
call esi
push edi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 0x18
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x895828
Capabilities:
Check http status code

Disassembly:
pushfd
lea esp, [esp + 8]
js 0x9bed68
je 0xa7acea
bt si, 9
stc
cmp ebx, 3
jbe 0x9c62cc
push ecx
mov byte [esp], 0xa1
pushfd
lea esp, [esp + 8]
je 0x9c62c7
pushfd
lea esp, [esp + 4]
jmp 0x898469
pushfd
mov word [esp], si
lea esp, [esp + 4]
je 0x9c62c7
pushfd
pushal
pushfd
lea esp, [esp + 0x28]
jmp 0x898469
pushal
jmp 0x9beb6e
mov bx, word [esi]
cmc
cmp bh, 0xaf
pushal
and ebx, 0xfff
push eax
pushfd
add dword [ebx + edi], edx
add esp, 0x28
bswap bx
bts bx, 5
mov bx, word [esi]
cmc
push esp
and ebx, 0xfff
pushal
pushal
add word [ebx + edi], ax
pushfd
mov dword [esp], 0xfa1387f8
lea esp, [esp + 0x48]
jmp 0x898469
mov byte [esp], 0x12
dec ecx
pushfd
push 0x5fe2596
lea esp, [esp + 0x30]
jne 0xa60e98
pushfd
mov ecx, dword [ebp - 4]
lea esp, [esp + 4]
jl 0x9c31f0
stc
stc
stc
cmp dword [ebp + 0x14], ecx
pushal
call fcn.009bf077
call fcn.00a61251
setnp al
pushfd
lea eax, [0x845906]
push dword [esp]
pushfd
call fcn.009bf8d2
xor eax, 0xffeed9f1
mov dl, 0x70
pop ds
shl byte [esi], cl
loop 0x9bed9b
or ebp, edx
out dx, al
mov ebp, 0x84477fc3
cmp byte [ebp + 0x7fd4b37], cl
mov ecx, 0x7c4536c3
jmp 0xee1da6d1
ret
pushal
call fcn.009be7da
setno ah
lea eax, [esi*4 + 0x1f592449]
mov dword [esp + 0x20], ebx
setg ah
movzx ax, cl
call fcn.00894c14
add byte [eax], al
inc edi
je 0x9c325c
imul ebp, dword [ebp + 0x41], 0x69727474
bound esi, qword [ebp + 0x74]
jae 0x9c327b
add byte [edi - 0x2c], bh
mov bl, 0x1b
inc ebp
mov bl, 0x70
imul esp, dword [eax - 0x6c], 0x5e21bd60
push edx
and dword [esi - 0x4b], esp
sbb bh, byte [edi + 0x60]
mov ch, 0x1a
jg 0x9c329a
scasd eax, dword es:[edi]
cmp eax, dword [edx + 0x6f]
lcall 0x352c, 0x770758cd
rol dword [edi], 1
stc
outsb dx, byte [esi]
daa
inc edi
invalid
invalid
jno 0x9c32c5
sbb ebx, dword [edi]
test dh, 0x3b
lds esp, [ecx + 0x3f]
mov esp, 0x90d574d0
adc ecx, dword [esi + 0x18c5c77f]
mov eax, dword [0x205a3950]
test eax, 0xf3666f67
sar edx, 0x49
xor bh, bh
push es
mov esi, edi
jns 0x9c3236
insd dword es:[edi], dx
out 0xef, al
sti
push 0xf78f19c3
cwde
dec bp
mov ds, word [edx + 0x38500b7e]
div ah
jne 0x9c324c
mov cl, 0x73
xor al, 3
int3
jae 0x9c32d1
add ecx, esp
wait
retf 0xd211
daa
invalid
sal dword [ecx + 0x1d], cl
sub eax, 0x9dd1c464
fidivr dword [eax + 0x5d2789e4]
out dx, eax
out dx, al
xor eax, 0xec765c2c
mov dl, 0x6c
int3
jmp 0x898453
jmp 0x895520
shl bl, 2
shld bx, di, cl
mov bx, word [esi]
stc
cmc
shr ebx, 0xc
stc
cmp ebx, 1
pushfd
lea esp, [esp + 4]
je 0x9be176
stc
test dl, 0xc8
clc
clc
cmp ebx, 2
push ebp
jmp 0x88e61d
Function at 0x9be7a0
Capabilities:
Check http status code

Disassembly:
jmp 0x9bfe36
lea esp, [esp + 8]
je 0xa7acea
pushal
stc
call fcn.009c04ba
add byte [eax], al
push ebx
outsb dx, byte gs:[esi]
inc esp
insb byte es:[edi], dx
dec ecx
je 0x9be822
insd dword es:[edi], dx
dec ebp
jae 0x9be835
popal
push edi
push edi
add byte [eax], al
add byte [edi + 0x65], al
je 0x9be818
je 0x9be818
jns 0x9be832
outsd dx, dword [esi]
popal
jb 0x9be838
push ebx
je 0x9be838
je 0x9be83e
add byte [ecx], bh
dec ebp
adc al, 0x9c
jmp 0x845b5c
jae 0x9be7ca
call 0x24a870e5
dec dword [eax - 0x3963dbf4]
inc esp
and al, 4
movsd dword es:[edi], dword [esi]
pushfd
mov byte [esp + 4], 0xa5
lea esp, [esp + 0x10]
jne 0x9c2912
stc
xor edx, edx
btr eax, 0x15
lahf
bt bx, 0xf
mov eax, edx
rcr al, 1
ror al, cl
push ebx
add edi, 1
cmc
pushfd
sbb al, ah
adc al, ah
mov al, byte [edi]
stc
cmp al, cl
stc
pushfd
test al, al
mov byte [esp], dh
pushfd
call fcn.0088e99d
mov edi, 0xfb15b2de
mov dl, 0x70
outsd dx, dword [esi]
jbe 0x9be879
add ebp, ebp
invalid
cmp eax, 0x1561571b
push edi
popal
adc eax, 0xa7e03019
sbb dword [eax], esi
loopne 0x9be7e0
cmpsd dword [esi], dword es:[edi]
jg 0x9be81f
lds edx, [ecx + edi*2]
mov esi, 0x8172fcaf
cld
jb 0x9be7c4
jo 0x9be7e1
adc byte [ebx - 0x6d765f4f], al
pop esi
jl 0x9be89c
sal dword [esi + 3], cl
xchg ebx, eax
jle 0x9be8cf
ret 0x78f9
mov edx, ecx
sbb dword [ebp + 0x1be303ec], esp
xor eax, 0xc671a29a
and dword [edx - 0x712ea217], esi
jge 0x9be840
cmp dword [ebx - 0x7fd4e8b], ebp
xor bh, bh
je 0x9be8ad
push ebx
je 0x9be906
cmp eax, 0xb08d3c38
movsd dword es:[edi], dword [esi]
xor dword cs:[ebx], 0x4a
add eax, 0xd69f9011
and dword [edx], ecx
mov esp, 0xa70e74ae
push ebp
or bh, byte [esi + ebp*4 + 0x55a70e74]
test al, 0xca
lodsb al, byte [esi]
mov edi, ebp
mov word [ecx + 0x53406a27], gs
fsubr st(1), st(0)
xchg byte [eax + 0x57], bh
daa
mov al, byte [0x6d70b2fa]
std
adc eax, 0xc3c7d834
mov ah, byte [edx - 0x59]
pop ds
xor al, 0xd8
mov ebx, 0x1fa7628a
cmp al, 0x40
aas
xor ecx, dword [edx + 0x33]
and bh, 0xfc
mov bh, 0x38
das
jo 0x9be911
lcall 0x106c, 0x2b9936a9
cmp bl, ah
mov ecx, 0x7c904436
xchg dword [esi - 0x4d8c9b83], edx
inc esi
sub eax, 0x15ee42f5
mov es, word [edx + 0x333d0d16]
sti
rcl dword [ebp + 0x5ba1954], 0xaf
cli
xchg edi, eax
inc ecx
arpl word [0x8c2c6027], di
stc
xchg ebp, eax
mov word [esi - 0x2c555b75], ds
fst dword [ebx + 0x5a]
mov al, byte [0xf7281970]
and al, 0xc1
and byte [eax], ah
pop ss
pop ss
out dx, al
sbb al, 0xde
std
invalid
scasb al, byte es:[edi]
push 0x5bb377e6
lea esp, [esp + 0x2c]
ja 0x9c1150
setae cl
pushal
call fcn.009c54ca
test bx, bp
push esp
or ecx, ecx
pushfd
pushfd
pushal
lea esp, [esp + 0x2c]
je 0x88eed8
call fcn.009c2363
jle 0x9bfded
insd dword es:[edi], dx
pop edx
adc byte [ebx + 0x437cb370], dh
pop ebx
mov dl, byte [eax]
dec esp
pop es
mov byte [esi + 0x55564758], dh
js 0x9bfe1a
push es
add al, 0x37
dec eax
invalid
Function at 0x9bf5d5
Capabilities:
Encode data using xor

Disassembly:
clc
cmc
pushfd
sub edi, 4
call fcn.009c13df
add byte [eax], al
push esp
push 0x64616572
xor esi, dword [edx]
add byte [eax], al
add byte [eax + ebp*2 + 0x72], dl
popal
xor esi, dword fs:[edx]
inc esi
imul esi, dword [edx + 0x73], 0x28fb0074
jecxz 0x9bf5df
cli
and eax, 0x969135b3
push ebp
mov dword [0xbc26c2c5], eax
add eax, 0xa49d6b5d
ret

Function at 0xa5fd24
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x24], ebx
call fcn.009c4106
mov bh, 0xee
pop ebx
sbb al, 0x10
mov ebp, 0x72356870
pop cx
jb 0xa5fd9e
pop ecx
push 0x789191e5
push ecx
sub eax, 0x6d58f4d5
inc ebx
jb 0xa5fd7d
cmpsb byte [esi], byte es:[edi]
not dword [ecx + edi]
inc edx
out 0x21, al
cmp byte [ecx - 0x438ab50c], 0xab
xor al, 0xd2
sbb dword [ecx - 0x3c745a8], esp
or ebp, edx
int 0xdc
retf
push 0xc
invalid
pushal
jp 0xa5fda1
fild qword [eax + 0x4c7ab0f7]
xor al, 0x41
bound ebx, qword [ebp + 0x6c05b919]
jle 0xa5fd05
idiv ecx
leave
push esp
jno 0xa5fd6f
jge 0xa5fd72
fisttp qword [eax]
jb 0xa5fe0b
jge 0xa5fd36
mov cl, 0x70
stc
jbe 0xa5fd62
pop ds
or eax, 0xbbec0ab6
jle 0xa5fdfa
fisttp dword [edi - 0x72]
xlatb
add byte [esi], dl
aaa
and eax, 0x3ac27df4
cmpsd dword [esi], dword es:[edi]
out dx, al
invalid
dec edi
invalid
insd dword es:[edi], dx
cmp dl, byte [edi - 0x1f]
scasb al, byte es:[edi]
popfd
xlatb
jno 0xa5fe23
push ecx
test dword [edi - 0x4d16414f], edi
mov eax, dword [0xede1126d]
insd dword es:[edi], dx
adc ah, cl
in eax, dx
hlt
movsd dword es:[edi], dword [esi]
test byte [ebx], dh
int3

Function at 0xa614d3
Capabilities:
Check http status code

Disassembly:
lea esp, [esp + 0x28]
ja 0x9c1150
Function at 0x401000
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
push 0x20
pop ebx
je 0x401029
cmp al, bl
jbe 0x40103b
inc esi
cmp byte [esi], bl
ja 0x40101e
jmp 0x40103b
cmp al, 0x22
je 0x40103a
inc esi
mov al, byte [esi]
test al, al
jne 0x401025
cmp al, 0x22
jne 0x40103b
jmp 0x40103a
cmp al, bl
ja 0x401041
inc esi
mov al, byte [esi]
test al, al
jne 0x401036
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
push 0x80
push 8
mov dword [0x4051f8], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [0x4051f4], eax
mov eax, section..data
mov edi, 0x405010
cmp eax, edi
mov ebx, eax
jae 0x40108d
mov eax, dword [ebx]
test eax, eax
je 0x401086
call eax
add ebx, 4
cmp ebx, edi
jb 0x40107e
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov ecx, dword [0x4051fc]
test ecx, ecx
mov ebx, eax
je 0x4010c5
mov eax, dword [0x4051f4]
lea edi, [eax + ecx*4]
cmp eax, edi
mov esi, eax
jae 0x4010c5
mov eax, dword [esi]
test eax, eax
je 0x4010be
call eax
add esi, 4
cmp esi, edi
jb 0x4010b6
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x40126f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401286
pop esi
ret
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x401298
xor eax, eax
jmp 0x4012c9
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, edi
and esi, 0xf
jbe 0x4012bb
cmp edi, eax
jae 0x401294
dec esi
movzx ecx, word [edi]
lea edi, [edi + ecx*2 + 2]
jne 0x4012ad
cmp edi, eax
jae 0x401294
mov ax, word [edi]
neg ax
sbb eax, eax
and eax, edi
pop edi
pop esi
ret

Function at 0x4013b2
Capabilities:
Delete directory
Delete file

Disassembly:
push ebx
push esi
xor ebx, ebx
xor esi, esi
cmp dword [edi + 0x14], ebx
je 0x4013d8
cmp esi, ebx
jl 0x40142f
cmp esi, dword [edi + 0x14]
jge 0x40142f
mov eax, dword [edi + 0x10]
push dword [eax + esi*4]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
inc esi
cmp esi, dword [edi + 0x14]
jne 0x4013bd
lea esi, [edi + 0x10]
call fcn.00401f6b
lea ebx, [edi + 0x1c]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov eax, ebx
call fcn.00401edd
mov eax, dword [edi + 0x20]
sub eax, 0x10
call fcn.004012cc
mov eax, dword [ebx]
sub eax, 0x10
call fcn.004012cc
call fcn.00401f6b
mov eax, dword [edi + 0xc]
sub eax, 0x10
call fcn.004012cc
mov eax, dword [edi + 8]
sub eax, 0x10
call fcn.004012cc
mov eax, dword [edi + 4]
pop esi
sub eax, 0x10
pop ebx
jmp fcn.004012cc
push ebx
push ebx
push 1
push 0xc000008c
call dword [sym.imp.KERNEL32.dll_RaiseException]
Function at 0x40160c
Capabilities:
Create directory
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 1
add edi, 0x20
mov esi, 0x104
push esi
mov eax, edi
lea ebx, [ebp - 0xc]
call fcn.00401fa0
push dword [eax + 4]
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov ecx, ebx
call fcn.00401fe7
mov eax, dword [edi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x40165f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x40165f
or eax, 0xffffffff
jmp 0x4016ab
mov eax, dword [ebp + 8]
push 1
add eax, 0x1c
push esi
lea ebx, [ebp - 0xc]
mov dword [ebp + 8], eax
call fcn.00401fa0
mov eax, dword [eax + 4]
mov edi, dword [edi]
push eax
push 0
push 0x40418c
push edi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov ecx, ebx
mov esi, eax
call fcn.00401fe7
test esi, esi
je 0x40165a
mov esi, dword [ebp + 8]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4016b2
Capabilities:
Extract resource via kernel32 functions
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, eax
mov eax, dword [0x405188]
push edi
mov ecx, 0x405188
call dword [eax + 0xc]
add eax, 0x10
push 1
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 4]
lea ebx, [ebp - 0x14]
call fcn.00401fa0
mov eax, dword [eax + 4]
mov ecx, dword [esi + 0x20]
push eax
xor ebx, ebx
push ebx
push 0x404188
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea ecx, [ebp - 0x14]
mov edi, eax
call fcn.00401fe7
cmp edi, ebx
je 0x4017b3
lea eax, [ebp - 4]
push eax
lea edi, [esi + 0x10]
call fcn.00401f11
push str.BDMS_
push 0x66
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x4017b3
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
je 0x4017b3
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
cmp esi, ebx
je 0x4017b3
push ebx
push ebx
push 4
push ebx
push ebx
push 0xc0000000
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
inc eax
neg eax
sbb eax, eax
and eax, dword [fcn.00402a68]
cmp eax, ebx
je 0x4017a7
push edi
push dword [ebp - 8]
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
mov ecx, esi
call fcn.00401959
test eax, eax
pop ecx
pop ecx
jne 0x4017a7
mov esi, dword [ebp - 4]
add esi, 0xfffffff0
call fcn.0040219e
mov esi, dword [ebp + 8]
add eax, 0x10
cmp edi, 0xffffffff
mov dword [esi], eax
je 0x4017bb
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4017bb
cmp edi, 0xffffffff
je 0x4017b3
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp + 8]
call fcn.00401cfc
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.004012cc
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x401959
Capabilities:
Write file on windows

Disassembly:
push ebp
mov eax, 0x20ac
lea ebp, [esp - 0x70]
call fcn.00403eb0
cmp dword [ebp + 0x78], 0xd
mov eax, dword [0x405038]
push ebx
mov dword [ebp + 0x6c], eax
mov ebx, ecx
jae 0x401981
or eax, 0xffffffff
jmp 0x401af7
push edi
push 0x23
pop ecx
xor eax, eax
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
push 5
mov edi, ebx
lea edx, [ebp - 0x20]
call fcn.00402a69
test eax, eax
pop ecx
je 0x4019a5
or eax, 0xffffffff
jmp 0x401af6
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
sub dword [ebp + 0x78], 5
sub dword [ebp + 0x78], 8
add ecx, eax
mov eax, 0x300
shl eax, cl
push esi
add ebx, 5
mov esi, ebx
lea edi, [ebp - 0x2028]
movsd dword es:[edi], dword [esi]
add eax, 0x736
add eax, eax
push eax
movsd dword es:[edi], dword [esi]
add ebx, 8
call fcn.004028cd
mov esi, eax
xor edi, edi
cmp esi, edi
pop ecx
mov dword [ebp - 0x2038], esi
jne 0x4019f7
push edi
call fcn.004028b2
or eax, 0xffffffff
jmp 0x401af4
push dword [ebp - 0x14]
call fcn.004028cd
cmp eax, edi
pop ecx
mov dword [ebp - 0x2034], eax
jne 0x401a18
push edi
call fcn.004028b2
or edi, 0xffffffff
jmp 0x401ae6
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esi
mov dword [ebp + 0x64], 0xfffffffe
mov dword [ebp + 0x38], edi
cmp dword [ebp - 0x2028], edi
jne 0x401a41
cmp dword [ebp - 0x2024], edi
jne 0x401a41
cmp dword [ebp + 0x78], edi
je 0x401adb
mov eax, 0x2000
cmp dword [ebp - 0x2028], eax
mov dword [ebp - 0x202c], edi
mov dword [ebp - 0x2030], edi
jae 0x401a60
mov eax, dword [ebp - 0x2028]
xor ecx, ecx
cmp dword [ebp + 0x78], edi
lea edx, [ebp - 0x20]
sete cl
push ecx
lea ecx, [ebp - 0x2030]
push ecx
push eax
lea eax, [ebp - 0x2020]
push eax
lea eax, [ebp - 0x202c]
push eax
push dword [ebp + 0x78]
push ebx
call fcn.00402aec
add esp, 0x1c
test eax, eax
jne 0x401ad8
mov eax, dword [ebp - 0x202c]
sub dword [ebp + 0x78], eax
mov esi, dword [ebp - 0x2030]
add ebx, eax
sub dword [ebp - 0x2028], esi
push edi
lea eax, [ebp - 0x203c]
sbb dword [ebp - 0x2024], edi
push eax
push esi
lea eax, [ebp - 0x2020]
push eax
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x401ad8
cmp dword [ebp - 0x203c], esi
je 0x401a28
or edi, 0xffffffff
push dword [ebp - 0x2034]
call fcn.004028b2
pop ecx
push dword [ebp - 0x2038]
call fcn.004028b2
mov eax, edi
pop ecx
pop esi
pop edi
mov ecx, dword [ebp + 0x6c]
pop ebx
call fcn.00402a68
add ebp, 0x70
leave
ret

Function at 0x401b05
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0xa0
mov eax, dword [0x405038]
push 0x9c
mov dword [ebp + 0x74], eax
lea eax, [ebp - 0x28]
push 0
push eax
call fcn.0040287f
add esp, 0xc
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x28], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x401b44
xor al, al
jmp 0x401b61
cmp dword [ebp - 0x24], 5
jb 0x401b40
jbe 0x401b50
mov al, 1
jmp 0x401b61
xor eax, eax
inc eax
cmp dword [ebp - 0x20], eax
jae 0x401b61
cmp word [ebp + 0x6c], 4
sbb al, al
inc al
mov ecx, dword [ebp + 0x74]
neg al
sbb eax, eax
and eax, 0x7ffbf8fd
add eax, 0x80040703
call fcn.00402a68
add ebp, 0x78
leave
ret
Function at 0x4022c3
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x405038]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
lea eax, [ebp - 0x20c]
push ebx
mov edx, eax
push esi
sub ecx, edx
mov esi, 0x208
xor ebx, ebx
mov dl, byte [ecx + eax]
cmp dl, bl
je 0x4022f9
mov byte [eax], dl
inc eax
dec esi
jne 0x4022ec
cmp esi, ebx
jne 0x4022fe
dec eax
mov byte [eax], bl
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov ax, word [ebp + 0x14]
or dword [ebp - 0x234], 1
mov word [ebp - 0x230], ax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x260]
push eax
push ebx
push ebx
push 0x400
push ebx
push ebx
push ebx
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40234d
xor al, al
jmp 0x402397
cmp byte [ebp + 0x10], bl
je 0x402360
push 0xffffffffffffffff
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebp + 0xc], ebx
mov byte [ebp + 0xb], 1
je 0x40237e
push dword [ebp + 0xc]
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
setne byte [ebp + 0xb]
push dword [ebp - 0x21c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x218]
call esi
mov al, byte [ebp + 0xb]
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.00402a68
leave
ret

Function at 0x4023a3
Capabilities:
Delete file

Disassembly:
push esi
xor esi, esi
cmp dword [edi + 0x10], esi
je 0x4023c6
test esi, esi
jl 0x4023da
cmp esi, dword [edi + 0x10]
jge 0x4023da
mov eax, dword [edi + 0xc]
push dword [eax + esi*4]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
inc esi
cmp esi, dword [edi + 0x10]
jne 0x4023ab
lea esi, [edi + 0xc]
call fcn.00401f6b
mov eax, dword [edi + 4]
sub eax, 0x10
pop esi
jmp fcn.004012cc
push 0
push 0
push 1
push 0xc000008c
call dword [sym.imp.KERNEL32.dll_RaiseException]
Function at 0x402688
Capabilities:
Read file via mapping

Disassembly:
push esi
push edi
mov esi, eax
call fcn.004026f5
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
je 0x4026ee
push edi
push edi
push edi
push 2
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, edi
mov dword [esi + 8], eax
je 0x4026e9
push edi
push edi
push edi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, edi
mov dword [esi + 0xc], eax
je 0x4026e0
mov al, 1
jmp 0x4026f0
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.004026f5
xor al, al
pop edi
pop esi
ret 4

Function at 0x40272d
Capabilities:
Parse pe header

Disassembly:
cmp dword [esp + 4], 0
je 0x40279a
cmp dword [eax + 4], 0xffffffff
je 0x40279a
mov edx, dword [eax + 0xc]
cmp word [edx], 0x5a4d
jne 0x40279a
mov ecx, dword [edx + 0x3c]
add ecx, edx
cmp dword [ecx], 0x4550
jne 0x40279a
mov ecx, dword [ecx + 0x98]
test ecx, ecx
je 0x40275f
add edx, ecx
jmp 0x402761
xor edx, edx
test edx, edx
je 0x40279a
lea ecx, [edx + 8]
test ecx, ecx
je 0x40279a
cmp byte [ecx], 0x30
push esi
lea esi, [ecx + 1]
jne 0x402793
mov cl, byte [esi]
inc esi
cmp cl, 0x82
jne 0x402793
movzx ecx, byte [esi]
movzx esi, byte [esi + 1]
shl ecx, 8
lea ecx, [ecx + esi + 0x12]
and ecx, 0xffffff8
jmp 0x402795
xor ecx, ecx
test ecx, ecx
pop esi
jne 0x40279f
xor al, al
ret 4
add ecx, edx
jmp 0x4027a6
cmp dword [eax + 4], 0xffffffff
push esi
mov esi, ecx
je 0x4027c2
push 4
mov ecx, str.Gact
mov eax, esi
call fcn.00402846
test eax, eax
pop ecx
je 0x4027c6
xor al, al
jmp 0x402805
movzx cx, byte [esi + 5]
add esi, 4
movzx ax, byte [esi]
push edi
shl eax, 8
add eax, ecx
test ebx, ebx
mov ecx, dword [esp + 0xc]
movzx edi, ax
lea eax, [edi + 1]
jne 0x4027ea
mov dword [ecx], eax
jmp 0x402802
cmp dword [ecx], eax
jge 0x4027f2
xor al, al
jmp 0x402804
lea edx, [esi + 2]
mov eax, edi
mov ecx, ebx
call fcn.00402867
mov byte [edi + ebx], 0
mov al, 1
pop edi
pop esi
ret 4