joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10075bd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push esi
push edi
call fcn.010062c4
mov ecx, 0xb62e29
sub ecx, 0xb61000
add eax, ecx
push eax
call fcn.01006d58
mov edi, eax
lea ecx, [edi + 0x190]
push ecx
call fcn.01006d7b
push 0x208
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x214]
push 0
push eax
call fcn.0100647f
add esp, 0x14
lea eax, [ebp - 0x214]
mov ebx, 0xb9f5b9c
push 0x104
push eax
push 0
push 0xdfa8b17
push ebx
call fcn.01006a98
pop ecx
pop ecx
call eax
lea esi, [edi + 0x90]
push esi
call fcn.01006d90
pop ecx
lea eax, [eax*2 + 2]
push eax
push esi
lea eax, [ebp - 0x214]
push 0x5c
push eax
call fcn.01006e50
pop ecx
pop ecx
lea ecx, [ebp - 0x212]
lea eax, [ecx + eax*2]
push eax
call fcn.0100644e
push 0xad68927
push ebx
call fcn.01006a98
add esp, 0x14
lea ecx, [ebp - 0x214]
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push ebx
push 0x80000000
push ecx
call eax
push dword [edi + 6]
mov dword [ebp - 8], eax
call fcn.01006388
and dword [ebp - 4], ebx
mov esi, eax
pop ecx
push 0xb78cba5
push 0xb9f5b9c
call fcn.01006a98
pop ecx
pop ecx
push 0
lea ecx, [ebp - 4]
push ecx
push dword [edi + 6]
lea ecx, [ebx + esi]
push ecx
push dword [ebp - 8]
call eax
add ebx, dword [ebp - 4]
cmp dword [ebp - 4], 0
jne 0x1007698
push dword [ebp - 8]
push 0x9ae7db5
push 0xb9f5b9c
call fcn.01006a98
pop ecx
pop ecx
call eax
movzx eax, byte [edi + 4]
shr eax, 3
and eax, 1
sub eax, 1
jne 0x100770d
mov ecx, dword [edi + 6]
sub ecx, 1
je 0x100770d
mov ebx, dword [ebp - 0xc]
mov eax, ecx
xor edx, edx
div ebx
mov al, byte [edx + edi + 0x190]
add al, byte [ecx + esi - 1]
xor byte [ecx + esi], al
sub ecx, 1
jne 0x10076f4
push esi
call fcn.0100758d
pop ecx
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [edi + 6]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1007db9
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ebx], ax
jne 0x1007e8b
push edi
mov edi, dword [ebx + 0x3c]
add edi, ebx
cmp dword [edi], 0x4550
jne 0x1007e8a
mov eax, 0xe0
cmp word [edi + 0x14], ax
jne 0x1007e8a
add eax, 0x2b
cmp word [edi + 0x18], ax
jne 0x1007e8a
mov eax, dword [edi + 0x50]
add eax, dword [edi + 0x34]
mov edx, dword [edi + 0x34]
or eax, 0xfff
push esi
mov esi, dword [ebp + 0x10]
and edx, 0xfffff000
sub eax, edx
inc eax
push 0x3d8cae3
push 0xb9f5b9c
mov dword [esi], eax
call fcn.01006a98
pop ecx
pop ecx
push 0x40
push 0x1000
push dword [esi]
xor ecx, ecx
push ecx
mov dword [ebp + 8], ecx
call eax
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
push dword [edi + 0x54]
push ebx
push eax
call fcn.0100644e
movzx esi, word [edi + 0x14]
xor eax, eax
add esp, 0xc
add esi, 0x2c
cmp ax, word [edi + 6]
jae 0x1007e89
add esi, edi
push dword [esi - 4]
mov eax, dword [esi]
mov ecx, dword [ebp + 0xc]
add eax, ebx
push eax
mov eax, dword [esi - 8]
add eax, dword [ecx]
push eax
call fcn.0100644e
mov ecx, dword [ebp + 8]
lea esi, [esi + 0x28]
movzx eax, word [edi + 6]
add esp, 0xc
inc ecx
mov dword [ebp + 8], ecx
cmp ecx, eax
jl 0x1007e5e
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x1007e90
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov byte [ebp - 0xa], 0x2f
mov byte [ebp - 9], 0x69
mov byte [ebp - 8], 0x6e
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0x61
push ebx
mov byte [ebp - 4], 0x6c
xor ebx, ebx
mov byte [ebp - 3], 0x6c
push esi
mov byte [ebp - 2], 0x2f
push edi
mov byte [ebp - 1], bl
mov al, byte [ebp - 0xa]
push 9
lea eax, [ebp - 0xa]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0100644e
push 0x10
push dword [ebp + 0x10]
lea eax, [ebp - 0x1f]
push eax
call fcn.0100644e
mov esi, dword [ebp + 8]
add esp, 0x18
mov edi, dword [ebp + 0xc]
mov byte [ebp - 0xf], bl
lea ebx, [esi + 0x1b0]
movzx eax, word [esi + 0x8e]
lea ecx, [esi + 0xe]
push edi
push eax
push ebx
lea eax, [ebp - 0x28]
push eax
push ecx
call fcn.01006664
mov edx, eax
add esp, 0x14
test edx, edx
jne 0x1007f2e
push 0x7530
push 0x5a2bc0
push 0xb9f5b9c
call fcn.01006a98
pop ecx
pop ecx
call eax
jmp 0x1007ef4
push 0
pop ebx
je 0x1007f48
mov esi, dword [ebp + 0x10]
mov ecx, dword [edi]
mov eax, ebx
and eax, 0xf
mov al, byte [eax + esi]
xor byte [ecx + ebx], al
inc ebx
cmp ebx, edx
jb 0x1007f36
pop edi
pop esi
mov eax, edx
pop ebx
leave
ret
Function at 0x100d5ae
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov edi, edi
push ebx
push esi
xor esi, esi
push esi
push esi
push esi
push 3
push esi
push esi
push esi
push 0xffffffffffffffff
push esi
mov ebx, ecx
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
jge 0x100d5cf
xor al, al
jmp 0x100d638
push edi
lea edi, [ebx + 4]
push edi
push 0x1001e30
push 1
push esi
push 0x1001f00
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x100d631
mov eax, dword [edi]
mov ecx, dword [eax]
add ebx, 8
push ebx
push esi
push esi
push esi
push esi
push esi
push esi
push 0x1001a58
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x100d627
push esi
push esi
push 3
push 3
push 0xffffffffffffffff
push esi
push 0xffffffffffffffff
push dword [ebx]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jge 0x100d635
mov eax, dword [ebx]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebx], esi
mov eax, dword [edi]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [edi], esi
xor al, al
jmp 0x100d637
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0x100e5b7
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x100ed48
call fcn.0100e944
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x1010448
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x100e36e
cmp eax, esi
jne 0x100e361
xor esi, esi
inc esi
mov ebx, esi
jmp 0x100e371
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100e348
xor esi, esi
inc esi
mov eax, dword [0x1010444]
cmp eax, esi
jne 0x100e384
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x100e3b3
mov eax, dword [0x1010444]
test eax, eax
jne 0x100e3ad
mov dword [0x1010444], esi
push 0x1001338
push 0x100132c
call fcn.0100e2ad
pop ecx
pop ecx
test eax, eax
je 0x100e3b3
jmp 0x100e4db
mov dword [0x1010114], esi
mov eax, dword [0x1010444]
cmp eax, esi
jne 0x100e3d7
push 0x1001328
push 0x100131c
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1010444], 2
test ebx, ebx
jne 0x100e3e3
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1010454], 0
je 0x100e407
push 0x1010454
call fcn.0100e8b9
pop ecx
test eax, eax
je 0x100e407
push 0
push 2
push 0
call dword [0x1010454]
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x100e463
test al, al
je 0x100e421
cmp dword [ebp - 0x1c], 0
jne 0x100e463
mov al, byte [esi]
test al, al
je 0x100e431
cmp al, 0x20
ja 0x100e431
inc esi
mov dword [ebp - 0x20], esi
jmp 0x100e421
test byte [ebp - 0x3c], 1
je 0x100e43d
movzx eax, word [ebp - 0x38]
jmp 0x100e440
push 0xa
pop eax
push eax
push esi
push 0
push 0x1000000
call main
mov dword [0x1010110], eax
cmp dword [0x1010104], 0
jne 0x100e4b7
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp al, 0x22
jne 0x100e472
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
je 0x100e485
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x100e40e
cmp dword [0x1010114], 0
jne 0x100e4c6
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1010110]
jmp 0x100e4e7
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.0100e989
ret
call fcn.0100ea91
jmp 0x100e30e

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x406128
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x40614d
mov dword [0x40a0f4], eax
add esp, 0xfffffff8
push 0x4060ec
push eax
call fcn.00407c20
jmp 0x406152
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x406168
mov dword [0x409054], 0x40624c
jmp 0x406172
mov dword [0x409054], 0x406200
leave
ret

Function at 0x401260
Capabilities:
Hide graphical window

Disassembly:
push ebp
push esp
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov esi, dword [esp + 8]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x4030f4], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [0x403100], eax
xor eax, eax
mov ebp, esp
mov ecx, 0xa
push eax
dec ecx
jne 0x40128d
push esp
mov dword [ebp - 0x24], 0x401330
mov eax, dword [0x4030f4]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], str.wookernof
call dword [sym.imp.USER32.dll_RegisterClassA]
xor eax, eax
push eax
push dword [0x4030f4]
push eax
push eax
push 0x190
push 0x2b2
push 0x640
push 0x9c4
push 0
push str.tofkol
push str.wookernof
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x403104], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x40132c
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [ebp - 0x1c]
push eax
call esi
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x40130d
pop ebp
ret 0x10
Function at 0x4518f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmpsd dword [esi], dword es:[edi]
call fcn.00451652
sub byte [edx], al
mov byte [0xa8458dea], al
push eax
call fcn.00451662
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.00451617
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x451940
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.00451652
mov ebp, 0x8dbb4ff5
inc ebp
rcl byte [eax - 0x18], 0xc5
cld
invalid

Function at 0x459d10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5df073
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x65eff4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push dword [ebp + 8]
call fcn.00450470
mov dword [ebp - 4], 0
call fcn.00453f30
push eax
lea ecx, [edi + 0x14]
call fcn.00450470
mov al, byte [ebp + 0xc]
mov byte [ebp - 4], 1
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov byte [edi + 0x34], al
mov word [edi + 0x35], 0x100
mov byte [edi + 0x37], 0
mov esi, dword [edi + 8]
mov ecx, dword [edi + 0xc]
test esi, esi
je 0x459d9e
lea eax, [esi - 1]
lea eax, [ecx + eax*4]
cmp dword [eax], 0
jne 0x459dc5
sub eax, 4
sub esi, 1
jne 0x459d91
mov eax, 1
push eax
lea ecx, [edi + 0x14]
mov dword [edi + 0x28], eax
call fcn.00451760
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
test esi, esi
je 0x459d9e
lea ecx, [ecx + esi*4]
add ecx, 0xfffffffc
call fcn.00441bb0
shl esi, 5
add eax, 0xffffffe0
add eax, esi
cmp eax, 0x11
jbe 0x459d9e
cmp eax, 0x18
ja 0x459ded
mov eax, 2
jmp 0x459da3
cmp eax, 0x46
ja 0x459df9
mov eax, 3
jmp 0x459da3
cmp eax, 0xc5
ja 0x459e07
mov eax, 4
jmp 0x459da3
cmp eax, 0x21b
ja 0x459e15
mov eax, 5
jmp 0x459da3
mov ecx, 0x59a
cmp ecx, eax
sbb eax, eax
neg eax
add eax, 6
jmp 0x459da3
Function at 0x459fd0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5de421
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x65eff4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], 0
cmp dword [0x6bd3e0], 0
jne 0x45a016
call fcn.0044ec90
mov dword [0x6bd3e0], 0x444410
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.004079b0
mov dword [ebp - 4], 1
push ecx
mov dword [esi], vtable.CryptoPP::Integer.0
push 2
mov dword [esi + 8], 2
call fcn.00453c40
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 0
mov dword [eax + 4], 0
mov eax, dword [esi + 0xc]
mov dword [eax], 0
push 1
push dword [ebp + 0x10]
mov dword [ebp - 4], 0
mov ecx, edi
push dword [ebp + 0xc]
mov edx, dword [edi]
push esi
mov dword [ebp - 0x10], 1
call dword [edx + 0x30]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10053a10
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x10053bfd
pushal
mov esi, section.UPX1
lea edi, [esi - 0x44000]
push edi
or ebp, 0xffffffff
jmp 0x10053a3a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x10053a41
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10053a30
mov eax, 1
add ebx, ebx
jne 0x10053a53
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x10053a64
jne 0x10053a83
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10053a83
dec eax
add ebx, ebx
jne 0x10053a70
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x10053a48
add ebx, ebx
jne 0x10053a7f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x10053ad5
xor ecx, ecx
sub eax, 3
jb 0x10053a9b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x10053b0a
sar eax, 1
mov ebp, eax
jmp 0x10053aa6
add ebx, ebx
jne 0x10053aa6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10053a74
inc ecx
add ebx, ebx
jne 0x10053ab4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10053a74
add ebx, ebx
jne 0x10053ac1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x10053ab6
jne 0x10053ad2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10053ab6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x10053af4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x10053ae6
jmp 0x10053a36
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x10053af4
add edi, ecx
jmp 0x10053a36
pop esi
mov edi, esi
mov ecx, 0x698
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x10053b12
cmp byte [edi], 0xa
jne 0x10053b12
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x10053b17
lea edi, [esi + 0x50000]
mov eax, dword [edi]
or eax, eax
je 0x10053b8f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x5425c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x542fc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x10053b44
mov ecx, edi
jns 0x10053b73
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x54300]
or eax, eax
je 0x10053b89
mov dword [ebx], eax
add ebx, 4
jmp 0x10053b61
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x10053bc0
cmp al, 0xef
ja 0x10053bb3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x10053b95
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x10053ba2
mov ebp, dword [esi + 0x54304]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x10053bf4
sub esp, 0xffffff80
jmp 0x1001815f
Function at 0x401756
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, eax
xor ebx, ebx
cmp byte [esi + 0x1c], bl
jne 0x401769
xor al, al
jmp 0x4017bb
cmp dword [esi + 0x18], 8
jb 0x401774
mov eax, dword [esi + 4]
jmp 0x401777
lea eax, [esi + 4]
push edi
push ebx
push 0x80
push 4
push ebx
push ebx
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4017b8
push ebx
lea eax, [ebp - 4]
push eax
push 0x50
add esi, 0x1f
push esi
push edi
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], 0x50
sete bl
mov al, bl
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402b3f
Capabilities:
Delete file
Get common file path

Disassembly:
push 0x22c
mov eax, 0x487820
call fcn.00458e5d
xor eax, eax
push 0x206
mov word [ebp - 0x21c], ax
xor edi, edi
lea eax, [ebp - 0x21a]
push edi
push eax
call fcn.004504c0
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor eax, eax
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], edi
mov word [ebp - 0x234], ax
lea eax, [ebp - 0x21c]
push eax
mov dword [ebp - 4], edi
call fcn.00450a1d
pop ecx
lea ecx, [ebp - 0x21c]
lea esi, [ebp - 0x238]
call fcn.00401b92
push 0x49b660
mov eax, esi
push eax
call fcn.00401817
push 0x49b664
mov eax, esi
push eax
call fcn.00401817
cmp dword [ebp - 0x220], 8
mov eax, dword [ebp - 0x234]
jae 0x402be9
lea eax, [ebp - 0x234]
call fcn.00426200
test eax, eax
je 0x402c54
cmp dword [ebp - 0x220], 8
mov eax, dword [ebp - 0x234]
jae 0x402c07
lea eax, [ebp - 0x234]
push eax
call fcn.0040d84a
mov esi, eax
pop ecx
cmp esi, edi
je 0x402c38
push esi
call fcn.0040d8f6
mov eax, dword [0x4b3198]
pop ecx
cmp eax, edi
je 0x402c31
push eax
call fcn.004539ce
pop ecx
mov dword [0x4b3198], edi
push esi
call fcn.004374fa
pop ecx
cmp dword [ebp - 0x220], 8
mov eax, dword [ebp - 0x234]
jae 0x402c4d
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
push 1
lea esi, [ebp - 0x238]
call fcn.004019bb
xor eax, eax
inc eax
call fcn.00458ee0
ret
Function at 0x403939
Capabilities:
Get common file path

Disassembly:
push 0x414
mov eax, 0x487768
call fcn.00458e5d
xor esi, esi
xor eax, eax
mov dword [ebp - 0x418], esi
push 0x206
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
mov edi, ecx
push esi
push eax
mov dword [ebp - 0x420], edi
call fcn.004504c0
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor eax, eax
mov dword [ebp - 0x23c], 7
mov dword [ebp - 0x240], esi
mov word [ebp - 0x250], ax
lea eax, [ebp - 0x21c]
push eax
mov dword [ebp - 4], esi
call fcn.00450a1d
pop ecx
lea ecx, [ebp - 0x21c]
lea esi, [ebp - 0x254]
call fcn.00401b92
mov eax, esi
push eax
lea esi, [ebp - 0x238]
call fcn.004017f2
push 0x49b660
mov eax, esi
push eax
mov byte [ebp - 4], 1
call fcn.00401817
push 0x49b990
mov eax, esi
push eax
call fcn.00401817
cmp dword [ebp - 0x220], 8
mov eax, dword [ebp - 0x234]
jae 0x403a03
lea eax, [ebp - 0x234]
push eax
push str.GetLogZipPrefix___wsIniPath_S
push 0x1ed
push ecx
call fcn.0041ef10
pop ecx
push eax
mov ebx, 0x800040
mov ecx, str..SupportWrapper.cpp
call fcn.0041f0d0
add esp, 0x10
lea eax, [ebp - 0x414]
push eax
call fcn.0040321d
or dword [ebp - 0x41c], 0xffffffff
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
mov byte [ebp - 4], 3
cmp dword [ebp - 0x220], 8
mov eax, dword [ebp - 0x234]
jae 0x403a60
lea eax, [ebp - 0x234]
lea ebx, [ebp - 0x41c]
call fcn.0040b342
test al, al
je 0x403a88
cmp dword [ebp - 0x3d4], 0
je 0x403a88
lea eax, [ebp - 0x3e8]
push eax
mov esi, edi
call fcn.004017f2
jmp 0x403a94
push 0x49b010
mov eax, edi
call fcn.004017d2
cmp dword [ebp - 0x41c], 0xffffffff
je 0x403aa9
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edi, [ebp - 0x414]
call fcn.00403ade
push 0
push 1
lea esi, [ebp - 0x238]
call fcn.004019bb
push 0
push 1
lea esi, [ebp - 0x254]
call fcn.004019bb
mov eax, dword [ebp - 0x420]
call fcn.00458ee0
ret
Function at 0x406072
Capabilities:
Create process on windows

Disassembly:
push 0x3c
mov eax, 0x48835c
call fcn.00458e5d
push str.Generate_Support_Token..._n_n
call fcn.00450ee8
lea eax, [ebp - 0x2c]
mov dword [esp], str.https:__spnsupport.trendmicro.com_default.aspx_guid
call fcn.004017d2
xor ebx, ebx
lea esi, [ebp - 0x48]
mov dword [ebp - 4], ebx
call fcn.0040e855
push 0xffffffffffffffff
push ebx
lea esi, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.00401aee
push ebx
push 1
lea esi, [ebp - 0x48]
mov byte [ebp - 4], bl
call fcn.004019bb
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x4060cd
lea eax, [ebp - 0x28]
push eax
push str.Query_Support_Token__S_
push 0x496
push ecx
call fcn.0041ef10
pop ecx
push eax
mov ebx, 0x800008
mov ecx, str..SupportWrapper.cpp
call fcn.0041f0d0
mov eax, dword [ebp - 0x28]
add esp, 0x10
cmp dword [ebp - 0x14], 8
jae 0x4060fe
lea eax, [ebp - 0x28]
push 1
xor esi, esi
push esi
push esi
push eax
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push esi
push 1
lea esi, [ebp - 0x2c]
call fcn.004019bb
call fcn.00458ee0
ret