joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4adb30
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x5cdb40]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4adbd1
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov edx, dword [esp + 0x18]
cmp dword [edx], ecx
jne 0x4adbc7
movzx ecx, byte [eax + 4]
cmp byte [edx + 4], cl
jne 0x4adbc7
movzx ecx, byte [eax + 5]
cmp byte [edx + 5], cl
jne 0x4adbc7
movzx ecx, byte [eax + 6]
cmp byte [edx + 6], cl
jne 0x4adbc7
movzx ecx, byte [eax + 7]
cmp byte [edx + 7], cl
jne 0x4adbc7
movzx ecx, byte [eax + 8]
cmp byte [edx + 8], cl
jne 0x4adbc7
movzx ecx, byte [eax + 9]
cmp byte [edx + 9], cl
jne 0x4adbc7
movzx ecx, byte [eax + 0xa]
cmp byte [edx + 0xa], cl
jne 0x4adbc7
movzx ecx, byte [eax + 0xb]
cmp byte [edx + 0xb], cl
jne 0x4adbc7
movzx ecx, byte [eax + 0xc]
cmp byte [edx + 0xc], cl
jne 0x4adbc7
add eax, 0x10
mov dword [esp], eax
lea eax, [edx + 0x10]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x4c
call sym.runtime.memequal
movzx eax, byte [esp + 0xc]
jmp 0x4adbc9
xor eax, eax
mov byte [esp + 0x1c], al
add esp, 0x10
ret
call sym.runtime.morestack_noctxt
jmp sym.type:.eq.fmt.fmt
Function at 0x4b2470
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x5cdb40]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4b256a
sub esp, 0x20
mov ecx, dword [esp + 0x24]
test byte [ecx], al
mov edx, dword [esp + 0x28]
mov ebx, edx
and edx, 0x7f
shl edx, 5
add ecx, edx
mov dword [esp + 0x1c], ecx
xor eax, eax
jmp 0x4b24b0
mov ebp, dword [esp + 0x14]
inc ebp
mov ecx, dword [esp + 0x1c]
mov ebx, eax
mov eax, ebp
cmp eax, 4
jge 0x4b24e9
mov dword [esp + 0x14], eax
lea edx, [ecx + eax*8]
mov dword [esp], edx
call sym.sync_atomic.LoadUint64
mov eax, dword [esp + 0x28]
cmp dword [esp + 4], eax
sete cl
mov edx, dword [esp + 0x2c]
cmp dword [esp + 8], edx
sete bl
and ebx, ecx
test bl, bl
je 0x4b24a3
mov byte [esp + 0x30], 1
add esp, 0x20
ret
xor eax, eax
mov edx, 0x84222325
jmp 0x4b24f3
inc eax
cmp eax, 4
jge 0x4b2509
mov dword [esp + 0x18], eax
lea ebp, [ecx + eax*8]
mov esi, dword [ebp]
mov ebp, dword [ebp + 4]
xor edi, edi
jmp 0x4b2563
and edx, 3
lea eax, [ecx + edx*8]
mov dword [esp], eax
mov dword [esp + 4], ebx
mov eax, dword [esp + 0x2c]
mov dword [esp + 8], eax
call sym.sync_atomic.StoreUint64
mov byte [esp + 0x30], 0
add esp, 0x20
ret
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebp
and esi, 0xff
xor edx, esi
mov esi, dword [esp + 0xc]
shr esi, 8
shl ebp, 0x18
mov eax, edx
mov ebx, 0x1b3
mul ebx
inc edi
or esi, ebp
mov ebp, dword [esp + 0x10]
shr ebp, 8
mov ebx, dword [esp + 0x28]
mov edx, eax
mov eax, dword [esp + 0x18]
cmp edi, 8
jl 0x4b252c
jmp 0x4b24f2
call sym.runtime.morestack_noctxt
jmp sym.internal_bisect._dedup_.seenLossy
Function at 0x41f1d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x41f229
test eax, edx
je 0x41f22c
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x41f1e7
movzx eax, word [eax]
sub eax, ecx
jmp 0x41f20e
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x41f20f
add ecx, 4
js 0x41f1ff
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x41f20c
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x41f20e
xor eax, eax
ret
test eax, eax
je 0x41f238
test edx, edx
jne 0x41f1d8
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x4201a4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [esi]
add eax, edi
push eax
push ebx
call sub.kernel32.dll_ReadFile
test eax, eax
jne 0x4201d1
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 4

Function at 0x423f28
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW
test eax, eax
jle 0x423f61
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.00409bbc
jmp 0x423f6a
mov eax, ebx
mov edx, esi
call fcn.00409e14
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x423f74
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW
test eax, eax
jle 0x423f96
movzx eax, word [esp]
jmp 0x423f98
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4252d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x4253f5
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.004250d8
mov esi, eax
mov eax, dword [0x4dca5c]
cmp byte [eax], 0
je 0x42539d
mov eax, dword [0x4dc8b0]
call fcn.0040754c
call fcn.00406f64
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x4252a0]
call fcn.0040bed8
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x425410
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
jmp 0x4253d9
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x4dc878]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4e0634]
call fcn.0040c2c8
push eax
call sub.user32.dll_LoadStringW
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4253fc
lea eax, [ebp - 4]
mov edx, dword [0x4252a0]
call fcn.0040bffc
ret
Function at 0x426500
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x426600
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00409e5c
lea eax, [ebp - 4]
call fcn.00409f78
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040a4bc
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x4265ea
mov eax, ebx
call fcn.00406e10
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x4265e3
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040a4bc
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x4265cd
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x426614
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x4265cd
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x10]
shr eax, 0x10
movzx eax, ax
mov dword [esi], eax
mov eax, dword [ebp - 0x14]
movzx eax, word [eax + 0x10]
mov dword [edi], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x14]
shr eax, 0x10
movzx eax, ax
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4265ea
mov eax, dword [ebp - 0x10]
call fcn.00406e2c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x426607
lea eax, [ebp - 4]
call fcn.00409a34
ret

Function at 0x42738c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.00409f04
mov ebp, eax
push ebp
push 0
push 0
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040efb8
mov edi, eax
cmp edi, 0x104
jbe 0x427337
mov eax, edi
add eax, eax
call fcn.00406e10
mov esi, eax
jmp 0x427339
mov esi, esp
push ebp
push esi
push edi
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040efb8
push esi
call sub.user32.dll_CharUpperW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x427372
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x42735c
mov eax, esp
cmp esi, eax
je 0x42737f
mov eax, esi
call fcn.00406e2c
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x4273b8
cmp bl, 0
je 0x4273b4
cmp bl, 0x41
jl 0x4273af
cmp bl, 0x5a
jg 0x4273af
or bl, 0x20
xor al, bl
inc esi
jmp 0x427393
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x4272f8

Function at 0x427cb0
Capabilities:
Get geographical location

Disassembly:
push ebx
add esp, 0xfffff800
mov ebx, ecx
mov word [esp], 0
push 0x400
lea ecx, [esp + 4]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW
mov eax, ebx
mov edx, esp
mov ecx, 0x400
call fcn.0040a560
add esp, 0x800
pop ebx
ret
Function at 0x480f94
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x480f9c
mov eax, edx
pop esi
pop ebx
ret

Function at 0x4b3844
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
or dl, byte [ebx + 0xd]
je 0x4b3887
cmp byte [ebx + 0x11], 0
jne 0x4b3887
cmp byte [ebx + 0x2c], 0
jne 0x4b3887
mov byte [ebx + 0xf], 0
mov byte [ebx + 0xd], 0
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
je 0x4b389e
mov ecx, dword [0x4dca18]
mov dl, 1
mov eax, dword [0x48e584]
call fcn.00425554
call fcn.004090b0
pop ebx
ret
mov ecx, dword [0x4dca18]
mov dl, 1
mov eax, dword [0x48e584]
call fcn.00425554
call fcn.004090b0
pop ebx
ret

Function at 0x4b40d0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xf]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x4b411e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xf], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.004b36c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b4137
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4b4140
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.004b36c4
dec esi
jne 0x4b4162
mov byte [ebx + 0xf], 0
pop esi
pop ebx
ret
Function at 0x402220
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x4241dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [ebp + 8]
mov byte [ebp - 0x45], al
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x50], ecx
cmp eax, 2
ja 0x402248
mov ecx, 2
jmp 0x402263
cmp eax, 8
ja 0x402254
mov ecx, 8
jmp 0x402263
mov ecx, 0xa
cmp ecx, eax
sbb ecx, ecx
and ecx, 6
add ecx, 0xa
cmp dword [ebp + 0x14], 1
push ebx
push esi
push edi
lea esi, [ebp - 0x44]
jbe 0x4022df
mov dword [ebp - 0x44], 0x300030
mov dword [ebp - 0x40], 0x300030
mov dword [ebp - 0x3c], 0x300030
mov dword [ebp - 0x38], 0x300030
mov dword [ebp - 0x34], 0x300030
mov dword [ebp - 0x30], 0x300030
mov dword [ebp - 0x2c], 0x300030
mov dword [ebp - 0x28], 0x300030
mov dword [ebp - 0x24], 0x300030
mov dword [ebp - 0x20], 0x300030
mov dword [ebp - 0x1c], 0x300030
mov dword [ebp - 0x18], 0x300030
mov dword [ebp - 0x14], 0x300030
mov dword [ebp - 0x10], 0x300030
mov dword [ebp - 0xc], 0x300030
mov dword [ebp - 8], 0x300030
mov ebx, dword [ebp + 0xc]
xor edi, edi
mov eax, ebx
xor edx, edx
div ecx
inc edi
lea esi, [esi + 2]
mov ebx, eax
mov ax, word [edx*2 + str.0123456789ABCDEF]
mov word [esi - 2], ax
test ebx, ebx
jne 0x4022e4
mov dword [ebp - 0x4c], edi
mov edi, dword [ebp + 0x14]
cmp dword [ebp - 0x4c], edi
lea ebx, [ebp - 0x44]
cmova edi, dword [ebp - 0x4c]
xor eax, eax
cmp byte [ebp - 0x45], al
lea ebx, [ebx + edi*2]
setne al
lea esi, [eax + edi]
lea eax, [esi*2 + 0xd]
and eax, 0xfffffff8
add eax, 8
push eax
call fcn.0040e50c
mov ecx, dword [ebp - 0x50]
mov dword [eax + 4], esi
mov dword [eax + 8], 0x402150
mov dword [eax], 1
add esp, 4
cmp byte [ebp - 0x45], 0
mov dword [ecx], eax
mov dword [ecx + 4], 0
lea ecx, [eax + 0xc]
je 0x402364
mov eax, 0x2d
mov word [ecx], ax
add ecx, 2
test edi, edi
je 0x402380
jmp 0x402370
mov ax, word [ebx - 2]
lea ebx, [ebx - 2]
mov word [ecx], ax
lea ecx, [ecx + 2]
dec edi
jne 0x402370
xor eax, eax
mov word [ecx], ax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040e585
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4034c0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x418828
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
mov eax, dword [0x4241dc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0
call fcn.00402110
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4035a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
jne 0x4035a5
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x18]
call fcn.00401000
push 0
push 0x41a47c
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.00401ef0
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.00402170
test eax, eax
lea ecx, [ebp - 0x20]
sete bl
mov byte [ebp - 4], 1
call fcn.004010d0
test bl, bl
jne 0x403596
sub esp, 8
lea eax, [ebp - 0x18]
mov ecx, esp
push eax
call fcn.00401000
call fcn.004034c0
add esp, 8
test al, al
je 0x403596
push 0
lea ecx, [ebp + 8]
call fcn.00402110
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
lea ecx, [ebp - 0x18]
setne bl
mov byte [ebp - 4], 0
call fcn.004010d0
jmp 0x4035a7
xor bl, bl
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], bl
call fcn.004010d0
jmp 0x4035a7
mov bl, 1
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0xffffffff
call fcn.004010d0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4035d0
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x870
mov eax, dword [0x4241dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push eax
mov dword [ebp - 0x870], eax
lea eax, [ebp - 0x414]
push 0x104
push eax
mov bl, 1
call fcn.0040f310
push 0x41a480
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.0040f2a4
push 0x41a620
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.0040f2a4
add esp, 0x24
lea eax, [ebp - 0x86c]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x403777
push edi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x403660
lea eax, [ebp - 0x840]
push eax
lea eax, [ebp - 0x61c]
push 0x104
push eax
call fcn.0040f310
add esp, 0xc
mov ecx, 0x41a624
lea eax, [ebp - 0x61c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4036ac
test dx, dx
je 0x4036a8
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4036ac
add eax, 4
add ecx, 4
test dx, dx
jne 0x403686
xor eax, eax
jmp 0x4036b1
sbb eax, eax
or eax, 1
test eax, eax
je 0x403759
mov ecx, 0x41a628
lea eax, [ebp - 0x61c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4036ea
test dx, dx
je 0x4036e6
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4036ea
add eax, 4
add ecx, 4
test dx, dx
jne 0x4036c4
xor eax, eax
jmp 0x4036ef
sbb eax, eax
or eax, 1
test eax, eax
je 0x403759
push dword [ebp - 0x870]
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0040f310
push 0x41a480
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0040f2a4
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0040f2a4
add esp, 0x24
test byte [ebp - 0x86c], 0x10
lea eax, [ebp - 0x20c]
push eax
je 0x403757
call fcn.004035d0
add esp, 4
mov bl, al
jmp 0x403759
call edi
lea eax, [ebp - 0x86c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x403660
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
push dword [ebp - 0x870]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, dword [ebp - 4]
neg eax
sbb al, al
and al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.0040e585
mov esp, ebp
pop ebp
ret
Function at 0x404670
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x417eb8
mov eax, dword fs:[0]
push eax
push ebx
mov eax, dword [0x4241dc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0
call fcn.00402110
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4046b6
test al, 0x10
jne 0x4046b6
mov bl, 1
jmp 0x4046b8
xor bl, bl
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0xffffffff
call fcn.004010d0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4046e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x418a90
mov eax, dword fs:[0]
push eax
sub esp, 0x248
mov eax, dword [0x4241dc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 0x1c]
cmp byte [ebp + 8], 0
mov dword [ebp - 4], 1
jne 0x40472d
cmp dword [edi + 0x2a0], 2
jl 0x404843
lea ecx, [ebp + 0xc]
call fcn.00402110
push eax
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.0040f310
lea eax, [ebp - 0x218]
push 0x5c
push eax
call fcn.0040f4f8
add esp, 0x14
test eax, eax
je 0x404761
xor ecx, ecx
mov word [eax], cx
mov eax, esi
neg eax
sbb eax, eax
and eax, 0x140
mov dword [ebp - 0x254], 0x3c
mov dword [ebp - 0x250], eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp dword [edi + 0x2a0], 2
mov dword [ebp - 0x24c], eax
mov ecx, str.open
mov eax, str.runas
cmovl eax, ecx
lea ecx, [ebp + 0xc]
mov dword [ebp - 0x248], eax
call fcn.00402110
lea ecx, [ebp + 0x14]
mov dword [ebp - 0x244], eax
call fcn.00402170
test eax, eax
jle 0x4047cc
lea ecx, [ebp + 0x14]
call fcn.00402110
mov dword [ebp - 0x240], eax
jmp 0x4047d6
mov dword [ebp - 0x240], 0
lea eax, [ebp - 0x218]
mov dword [ebp - 0x23c], eax
lea eax, [ebp - 0x254]
push eax
mov dword [ebp - 0x238], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x40483d
test esi, esi
je 0x404839
cmp dword [ebp - 0x234], 0x20
jbe 0x40483d
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x404839
push 0x1b7740
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
jmp 0x404845
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor bl, bl
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 0
call fcn.004010d0
lea ecx, [ebp + 0x14]
mov dword [ebp - 4], 0xffffffff
call fcn.004010d0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040e585
mov esp, ebp
pop ebp
ret 0x18
Function at 0x404880
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push esi
mov esi, ecx
je 0x4048fd
push ebx
push 0x20a
call fcn.0040f856
add esp, 4
mov dword [esi + 4], eax
push eax
push 0x104
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ebx, eax
cmp ebx, 0x105
jbe 0x4048e7
push dword [esi + 4]
call fcn.0040f851
xor ecx, ecx
mov eax, ebx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0040f856
add esp, 8
mov dword [esi + 4], eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
pop ebx
test eax, eax
jne 0x4048fd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
pop esi
pop ebp
ret 4

Function at 0x404a50
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x418b08
mov eax, dword fs:[0]
push eax
sub esp, 0x41c
mov eax, dword [0x4241dc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0x428]
push eax
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0
call fcn.00402110
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x41e]
push eax
call fcn.0040ff40
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.0040ff40
push dword [esi]
lea eax, [ebp - 0x420]
push 0x104
push eax
call fcn.0040f2a4
lea eax, [ebp - 0x420]
push 0x5f
push eax
call fcn.0040f4f8
add esp, 0x2c
test eax, eax
je 0x404b2e
push 0xffffffffffffffff
add eax, 2
push eax
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.0040f43a
lea eax, [ebp - 0x218]
push 0x2e
push eax
call fcn.0040f4f8
add esp, 0x18
test eax, eax
je 0x404b2e
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x404b37
sub eax, edx
sar eax, 1
je 0x404b58
lea eax, [ebp - 0x218]
push eax
mov ecx, edi
call fcn.004017e0
jmp 0x404b6e
sub esp, 8
mov ecx, esp
push 0x41aeb4
call fcn.00401070
mov ecx, edi
call fcn.00401820
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0xffffffff
call fcn.004010d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040e585
mov esp, ebp
pop ebp
ret 0xc