joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4013bd
Capabilities:
Accept command line arguments
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x105c
call fcn.00401000
push ebx
push esi
push edi
mov edi, 0x7fe
xor esi, esi
push edi
lea eax, [ebp - 0x105a]
push esi
push eax
mov dword [ebp - 8], 1
mov word [ebp - 0x105c], si
call fcn.0040135c
push edi
lea eax, [ebp - 0x85a]
push esi
push eax
mov word [ebp - 0x85c], si
call fcn.0040135c
push 0x40
lea eax, [ebp - 0x58]
push esi
push eax
mov dword [ebp - 0x5c], esi
call fcn.0040135c
add esp, 0x24
push 0x4bf
mov dword [ebp - 0x18], esi
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
push esi
push esi
stosd dword es:[edi], eax
push esi
push esi
stosd dword es:[edi], eax
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
call fcn.00401230
cmp eax, esi
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x401464
push eax
push esi
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, esi
mov dword [ebp - 4], eax
je 0x401464
push 0xffffffffffffffff
push eax
call ebx
push dword [ebp - 4]
call edi
lea eax, [ebp - 0x85c]
push eax
call fcn.004010cd
test eax, eax
pop ecx
je 0x40151c
push 0x400
lea eax, [ebp - 0x105c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x105c]
push str._proc
push eax
push str._extractor
lea eax, [ebp - 0x85c]
push eax
push str.__1___2___3___4__5_u___6
call fcn.0040138f
add esp, 0x1c
cmp eax, esi
mov dword [ebp - 4], eax
jne 0x4014d0
xor eax, eax
inc eax
jmp 0x40151f
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x5c]
push ecx
push esi
push esi
push esi
push esi
push esi
push esi
push eax
push esi
mov dword [ebp - 0x5c], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, 1
jne 0x401513
push 0xffffffffffffffff
push dword [ebp - 0x18]
call ebx
push dword [ebp - 0x18]
call edi
push dword [ebp - 0x14]
call edi
lea eax, [ebp - 0x85c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 8], esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x827a50
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x165000]
push edi
or ebp, 0xffffffff
jmp 0x827a72
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x827a79
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x827a68
mov eax, 1
add ebx, ebx
jne 0x827a8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x827a9c
jne 0x827abb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x827abb
dec eax
add ebx, ebx
jne 0x827aa8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x827a80
add ebx, ebx
jne 0x827ab7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x827b0d
xor ecx, ecx
sub eax, 3
jb 0x827ad3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x827b42
sar eax, 1
mov ebp, eax
jmp 0x827ade
add ebx, ebx
jne 0x827ade
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x827aac
inc ecx
add ebx, ebx
jne 0x827aec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x827aac
add ebx, ebx
jne 0x827af9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x827aee
jne 0x827b0a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x827aee
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x827b2c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x827b1e
jmp 0x827a6e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x827b2c
add edi, ecx
jmp 0x827a6e
pop esi
mov edi, esi
mov ecx, 0x69cf
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x827b4a
cmp byte [edi], 0xa
jne 0x827b4a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x827b4f
lea edi, [esi + 0x41e000]
mov eax, dword [edi]
or eax, eax
je 0x827bc7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x42bb94]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x42bcd4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x827b7c
mov ecx, edi
jns 0x827bab
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x42bcd8]
or eax, eax
je 0x827bc1
mov dword [ebx], eax
add ebx, 4
jmp 0x827b99
call dword [esi + 0x42bce8]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x827bf8
cmp al, 0xef
ja 0x827beb
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x827bcd
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x827bda
mov ebp, dword [esi + 0x42bcdc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x827c2c
sub esp, 0xffffff80
jmp 0x4af640
Function at 0x40268e
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, dword [esp + 0x10]
push esi
push ebp
push ebx
xor esi, esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x402743
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x402743
movzx eax, word [ebx]
push edi
xor edi, edi
mov ecx, ebx
test ax, ax
je 0x4026e4
movzx eax, ax
cmp ax, 0x5c
jne 0x4026d6
mov edi, ecx
inc ecx
inc ecx
movzx eax, word [ecx]
test ax, ax
jne 0x4026ce
test edi, edi
jne 0x4026f8
mov esi, 0x80070003
push esi
push 0x7e
push 0x410eee
call fcn.00402f4c
jmp 0x402742
push ebp
xor eax, eax
push ebx
mov word [edi], ax
call fcn.0040268e
mov esi, eax
push 0x5c
pop eax
mov word [edi], ax
test esi, esi
jl 0x402742
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x402740
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40272e
xor esi, esi
inc esi
jmp 0x402742
test eax, eax
jle 0x40273c
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
jmp 0x402742
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x4029aa
Capabilities:
Delete file
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
xor edi, edi
push edi
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
call fcn.00402892
mov esi, eax
cmp esi, edi
jl 0x402a99
push ebx
push edi
push 0x80
push dword [ebp + 0x10]
push edi
push edi
push 0x40000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x402a31
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, edi
jle 0x402a18
and esi, 0xffff
or esi, 0x80070000
cmp esi, edi
jl 0x402a1f
mov esi, 0x80004005
push esi
push 0xde
push 0x410f22
call fcn.00402f4c
jmp 0x402a86
push edi
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
mov dword [ebp - 0xc], 1
push dword [ebp - 8]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x402a7f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, edi
jle 0x402a68
and esi, 0xffff
or esi, 0x80070000
cmp esi, edi
jl 0x402a6f
mov esi, 0x80004005
push esi
push 0xe4
push 0x410f22
call fcn.00402f4c
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, edi
pop ebx
jge 0x402a99
cmp dword [ebp - 0xc], edi
je 0x402a99
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop edi
mov eax, esi
pop esi
leave
ret 0xc
Function at 0x402c4e
Capabilities:
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor esi, esi
push edi
xor edi, edi
mov dword [ebp - 4], esi
cmp dword [ebp + 0x10], esi
je 0x402c6a
mov dword [ebp - 4], 1
cmp dword [ebp + 0x14], esi
je 0x402c73
or dword [ebp - 4], 2
push dword [ebp - 4]
mov ebx, dword [ebp + 0xc]
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x402d44
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp + 0x10], esi
jne 0x402caa
cmp eax, 0x50
je 0x402ca2
cmp eax, 0xb7
jne 0x402caa
xor edi, edi
inc edi
jmp 0x402d44
cmp eax, 3
jne 0x402d34
movzx eax, word [ebx]
mov ecx, ebx
test ax, ax
je 0x402d2d
movzx eax, ax
cmp ax, 0x5c
jne 0x402cc8
mov esi, ecx
inc ecx
inc ecx
movzx eax, word [ecx]
test ax, ax
jne 0x402cc0
test esi, esi
je 0x402d2d
xor eax, eax
push eax
push ebx
mov word [esi], ax
call fcn.0040268e
mov edi, eax
push 0x5c
pop eax
mov word [esi], ax
test edi, edi
jl 0x402d44
push dword [ebp - 4]
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x402d44
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x402d19
and edi, 0xffff
or edi, 0x80070000
test edi, edi
jge 0x402d44
push edi
push 0x26d
push 0x410f56
call fcn.00402f4c
jmp 0x402d44
mov edi, 0x80070003
jmp 0x402d44
cmp eax, esi
jle 0x402d42
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x402d4e
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
lea ebp, [esp - 0x1a0]
sub esp, 0x220
mov eax, dword [0x4170a0]
xor eax, ebp
mov dword [ebp + 0x19c], eax
mov eax, dword [ebp + 0x1b0]
and dword [ebp - 0x70], 0
or dword [ebp - 0x74], 0xffffffff
push ebx
mov ebx, dword [ebp + 0x1ac]
push esi
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0x1b4]
push edi
mov edi, dword [ebp + 0x1a8]
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x6c]
push eax
push 0x104
mov esi, 0x80004005
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x402ddd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x402dc6
and esi, 0xffff
or esi, 0x80070000
test esi, esi
jge 0x402ddd
push esi
push 0x2cc
push 0x410f56
call fcn.00402f4c
jmp 0x402e7c
and dword [ebp - 0x78], 0
cmp dword [ebp - 0x74], 0xffffffff
jne 0x402e60
push ebx
push dword [ebp - 0x78]
lea eax, [ebp - 0x6c]
push edi
push eax
lea eax, [ebp - 0x70]
push 0x410f8a
push eax
call fcn.0040267a
mov esi, eax
add esp, 0x18
test esi, esi
jl 0x402e95
push 0
push 0x80
push 1
push 0
push 1
push 0x40000000
push dword [ebp - 0x70]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x74], eax
cmp eax, 0xffffffff
jne 0x402e54
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x402e42
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, 0x80070050
jne 0x402e50
xor esi, esi
jmp 0x402e54
test esi, esi
jl 0x402e95
inc dword [ebp - 0x78]
cmp dword [ebp - 0x78], 0x3e8
jl 0x402de1
mov eax, dword [ebp - 0x7c]
test eax, eax
je 0x402e6c
mov ecx, dword [ebp - 0x74]
mov dword [eax], ecx
mov eax, dword [ebp - 0x80]
test eax, eax
je 0x402e7c
mov ecx, dword [ebp - 0x70]
and dword [ebp - 0x70], 0
mov dword [eax], ecx
test esi, esi
jl 0x402e86
cmp dword [ebp - 0x7c], 0
jne 0x402e95
cmp dword [ebp - 0x74], 0xffffffff
je 0x402e95
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x70], 0
je 0x402ea3
push dword [ebp - 0x70]
call fcn.00401f72
mov ecx, dword [ebp + 0x19c]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403653
add ebp, 0x1a0
leave
ret 0x10

Function at 0x403653
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4170a0]
jne 0x40365d
repz ret
jmp fcn.00404e3a
Function at 0x40bb4c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00407399
and dword [ebp - 4], 0
cmp dword [0x418a28], 0
mov ebx, eax
jne 0x40bbfd
push 0x41347c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40bcae
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x413470
push edi
call esi
test eax, eax
je 0x40bcae
push eax
call fcn.00407327
mov dword [esp], 0x413460
push edi
mov dword [0x418a28], eax
call esi
push eax
call fcn.00407327
mov dword [esp], 0x41344c
push edi
mov dword [0x418a2c], eax
call esi
push eax
call fcn.00407327
mov dword [esp], 0x413430
push edi
mov dword [0x418a30], eax
call esi
push eax
call fcn.00407327
pop ecx
mov dword [0x418a38], eax
test eax, eax
je 0x40bbfd
push 0x413418
push edi
call esi
push eax
call fcn.00407327
pop ecx
mov dword [0x418a34], eax
mov eax, dword [0x418a34]
cmp eax, ebx
je 0x40bc55
cmp dword [0x418a38], ebx
je 0x40bc55
push eax
call fcn.004073a2
push dword [0x418a38]
mov esi, eax
call fcn.004073a2
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40bc55
test edi, edi
je 0x40bc55
call esi
test eax, eax
je 0x40bc4c
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40bc4c
test byte [ebp - 0xc], 1
jne 0x40bc55
or dword [ebp + 0x10], 0x200000
jmp 0x40bc8e
mov eax, dword [0x418a2c]
cmp eax, ebx
je 0x40bc8e
push eax
call fcn.004073a2
pop ecx
test eax, eax
je 0x40bc8e
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40bc8e
mov eax, dword [0x418a30]
cmp eax, ebx
je 0x40bc8e
push eax
call fcn.004073a2
pop ecx
test eax, eax
je 0x40bc8e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x418a28]
call fcn.004073a2
pop ecx
test eax, eax
je 0x40bcae
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40bcb0
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40dfc0
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0xffffffff
jne 0x40dfe4
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov word [ebp - 8], ax
movzx eax, word [ebp - 8]
mov dword [ebp + 8], eax
cmp dword [ebp + 0x10], 0
je 0x40dffd
mov ecx, dword [ebp + 8]
xor edx, edx
cmp ecx, dword [ebp + 0xc]
sete dl
mov dword [ebp - 4], edx
jmp 0x40e095
movzx eax, word [ebp + 8]
and eax, 0x3ff
cmp eax, 4
jne 0x40e077
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0xc04
ja 0x40e037
cmp dword [ebp - 0xc], 0xc04
je 0x40e05c
cmp dword [ebp - 0xc], 0x404
je 0x40e058
cmp dword [ebp - 0xc], 0x804
je 0x40e04b
jmp 0x40e067
cmp dword [ebp - 0xc], 0x1004
je 0x40e04f
cmp dword [ebp - 0xc], 0x1404
je 0x40e060
jmp 0x40e067
xor edx, edx
jne 0x40e04b
mov dword [ebp + 8], 0x804
jmp 0x40e067
xor eax, eax
jne 0x40e058
xor ecx, ecx
jne 0x40e05c
mov dword [ebp + 8], 0x404
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, dword [ebp + 0xc]
sete al
mov dword [ebp - 4], eax
jmp 0x40e095
movzx ecx, word [ebp + 8]
and ecx, 0x3ff
movzx edx, word [ebp + 0xc]
and edx, 0x3ff
xor eax, eax
cmp ecx, edx
sete al
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x40e5a0
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b4
mov eax, dword [0x4170a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x2b4], 0
mov eax, dword [ebp + 0x10]
neg eax
sbb eax, eax
and eax, 7
add eax, 0x1c
mov dword [ebp - 0x54], eax
lea ecx, [ebp - 0x260]
push ecx
push 0
push 0
mov edx, dword [ebp - 0x54]
or edx, 0x8000
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0
jge 0x40e603
jmp 0x40e71c
push 0x27
lea eax, [ebp - 0x2b0]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x8c
push ecx
call dword [sym.imp.ole32.dll_StringFromGUID2]
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0
jge 0x40e635
jmp 0x40e71c
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xa0]
and eax, 0xffff
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xa0]
shr edx, 0x10
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x9c]
and ecx, 0xffff
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x9c]
shr eax, 0x10
push eax
push 0x414020
push 0x24
lea ecx, [ebp - 0x50]
push ecx
call fcn.00401ea0
add esp, 0x1c
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0
jge 0x40e69a
jmp 0x40e71c
lea edx, [ebp - 0x50]
push edx
lea eax, [ebp - 0x2b0]
push eax
lea ecx, [ebp - 0x260]
push ecx
push str._lsApplicationsCache_lsv_ls.mst
mov edx, dword [ebp + 0x14]
push edx
call fcn.0040267a
add esp, 0x14
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0
jge 0x40e6d0
jmp 0x40e71c
push 1
push 1
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.00402c4e
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0
jge 0x40e71c
cmp dword [ebp + 0x10], 1
jne 0x40e71c
mov eax, dword [ebp + 0x14]
push eax
xor ecx, ecx
cmp dword [ebp + 0x10], 0
sete cl
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0040e5a0
add esp, 0x10
mov dword [ebp - 0x2b4], eax
mov eax, dword [ebp - 0x2b4]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403653
mov esp, ebp
pop ebp
ret
Function at 0x40e730
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b4
mov eax, dword [0x4170a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x2b4], 0
mov eax, dword [ebp + 0x10]
neg eax
sbb eax, eax
and eax, 7
add eax, 0x1c
mov dword [ebp - 0x54], eax
lea ecx, [ebp - 0x260]
push ecx
push 0
push 0
mov edx, dword [ebp - 0x54]
or edx, 0x8000
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0
jge 0x40e793
jmp 0x40e8ac
push 0x27
lea eax, [ebp - 0x2b0]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x8c
push ecx
call dword [sym.imp.ole32.dll_StringFromGUID2]
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0
jge 0x40e7c5
jmp 0x40e8ac
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xa0]
and eax, 0xffff
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xa0]
shr edx, 0x10
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x9c]
and ecx, 0xffff
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x9c]
shr eax, 0x10
push eax
push 0x413fa4
push 0x24
lea ecx, [ebp - 0x50]
push ecx
call fcn.00401ea0
add esp, 0x1c
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0
jge 0x40e82a
jmp 0x40e8ac
lea edx, [ebp - 0x50]
push edx
lea eax, [ebp - 0x2b0]
push eax
lea ecx, [ebp - 0x260]
push ecx
push str._lsApplicationsCache_lsv_ls.msi
mov edx, dword [ebp + 0x14]
push edx
call fcn.0040267a
add esp, 0x14
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0
jge 0x40e860
jmp 0x40e8ac
push 1
push 1
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.00402c4e
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0
jge 0x40e8ac
cmp dword [ebp + 0x10], 1
jne 0x40e8ac
mov eax, dword [ebp + 0x14]
push eax
xor ecx, ecx
cmp dword [ebp + 0x10], 0
sete cl
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0040e730
add esp, 0x10
mov dword [ebp - 0x2b4], eax
mov eax, dword [ebp - 0x2b4]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403653
mov esp, ebp
pop ebp
ret
Function at 0x410d60
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x4170a0]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.00410640
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
je 0x410d9a
mov eax, dword [ebp - 0x220]
push eax
call fcn.004037e1
add esp, 4
test eax, eax
jne 0x410dad
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x410eaa
mov dword [ebp - 0x214], 0
mov eax, dword [ebp - 0x220]
push eax
push 0x414778
lea ecx, [ebp - 0x214]
push ecx
call fcn.0040267a
add esp, 0xc
mov dword [ebp - 0x218], 0
xor edx, edx
mov word [ebp - 0x210], dx
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.00403800
add esp, 0xc
mov dword [ebp - 0x21c], 0x206
mov dword [ebp - 0x224], 1
lea ecx, [ebp - 0x218]
push ecx
push 0x20019
push 0
mov edx, dword [ebp - 0x214]
push edx
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x410e93
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x224]
push edx
push 0
push 0x414800
mov eax, dword [ebp - 0x218]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x410e86
lea ecx, [ebp - 0x210]
push ecx
push str._sTemp
lea edx, [ebp + 0xc]
push edx
call fcn.0040267a
add esp, 0xc
mov eax, dword [ebp + 0xc]
push eax
call fcn.004037e1
add esp, 4
jmp 0x410eaa
mov ecx, dword [ebp - 0x218]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x220], 0
je 0x410ea8
mov edx, dword [ebp - 0x220]
push edx
call fcn.00401f72
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403653
mov esp, ebp
pop ebp
ret
Function at 0x4010b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
push edi
mov ecx, 0x3caf
lea ebx, [esi + 0x26]
mov edi, 0x594d
test edx, edx
je 0x401150
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x401150
cmp edx, eax
jae 0x401150
mov ecx, esi
sub eax, edx
je 0x4010f6
mov edi, eax
mov al, byte [ecx + edx + 1]
add al, 3
xor byte [ecx + edx], al
inc ecx
cmp ecx, edi
jb 0x4010e3
mov edi, 0x594d
inc esi
mov eax, 0x38e38e39
imul esi
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, esi
lea eax, [eax + eax*8]
sub ecx, eax
jne 0x401113
add esi, 2
cmp esi, 0x7674
jl 0x4010f6
mov eax, 0x4ec7
mov ecx, 0xeb
cmp ebx, ecx
cmovl ebx, ecx
dec eax
jne 0x401125
lea ecx, [ecx]
mov eax, 0x964fda6d
imul edi
add edx, edi
sar edx, 6
mov edi, edx
shr edi, 0x1f
add edi, edx
jne 0x401130
pop edi
pop esi
pop ebx
pop ebp
ret
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
jne 0x401150
pop edi
pop esi
pop ebx
pop ebp
ret