joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003e510
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
push ebp
mov ebp, dword [esp + 0x28]
xor edx, edx
push esi
mov esi, dword [esp + 0x28]
mov dword [esp + 0x18], edx
cmp esi, ebp
jne 0x1003e52f
pop esi
xor eax, eax
pop ebp
add esp, 0x18
ret
push ebx
mov ebx, dword [esp + 0x34]
cmp dword [esi + 4], ebx
jb 0x1003e53e
cmp dword [ebp + 4], ebx
jae 0x1003e56a
push ebx
push esi
call fcn.100411e0
mov edx, eax
add esp, 8
test edx, edx
js 0x1003e6b4
push ebx
push ebp
call fcn.100411e0
mov edx, eax
add esp, 8
mov dword [esp + 0x1c], edx
test edx, edx
js 0x1003e6b4
mov eax, dword [esp + 0x28]
mov ecx, dword [esi + 8]
push edi
lea edi, [eax - 1]
not eax
shr eax, 0x1f
shr edi, 0x1f
and edi, eax
mov eax, dword [ebp + 8]
xor eax, ecx
dec edi
and eax, edi
mov dword [esp + 0x24], edi
xor ecx, eax
mov dword [esi + 8], ecx
xor dword [ebp + 8], eax
mov ecx, dword [esi]
mov eax, dword [ebp]
xor eax, ecx
movd xmm0, edi
and eax, edi
pshufd xmm4, xmm0, 0
xor ecx, eax
xor edi, edi
mov dword [esi], ecx
xor dword [ebp], eax
test ebx, ebx
je 0x1003e6b3
cmp ebx, 4
jb 0x1003e687
mov ecx, dword [ebp + 0xc]
lea eax, [ebp + 0xc]
mov ebp, dword [esi + 0xc]
mov dword [esp + 0x10], ecx
lea ecx, [esi + 0xc]
mov esi, dword [esp + 0x10]
mov dword [esp + 0x18], ebp
lea ebp, [ebp + ebx*4]
add ebp, 0xfffffffc
lea esi, [esi + ebx*4]
mov dword [esp + 0x1c], ebp
add esi, 0xfffffffc
cmp dword [esp + 0x10], ebp
mov ebp, dword [esp + 0x34]
mov dword [esp + 0x14], esi
mov esi, dword [esp + 0x30]
ja 0x1003e608
mov ebp, dword [esp + 0x14]
cmp ebp, dword [esp + 0x18]
mov ebp, dword [esp + 0x34]
jae 0x1003e687
cmp dword [esp + 0x10], eax
ja 0x1003e614
cmp dword [esp + 0x14], eax
jae 0x1003e687
cmp dword [esp + 0x10], ecx
ja 0x1003e620
cmp dword [esp + 0x14], ecx
jae 0x1003e687
cmp dword [esp + 0x18], eax
ja 0x1003e62c
cmp dword [esp + 0x1c], eax
jae 0x1003e687
mov eax, dword [esp + 0x18]
cmp eax, ecx
ja 0x1003e63a
cmp dword [esp + 0x1c], ecx
jae 0x1003e687
mov ecx, ebx
and ecx, 0xfffffffc
mov dword [esp + 0x34], ecx
mov ecx, dword [esp + 0x10]
nop word [eax + eax]
movups xmm1, xmmword [eax + edi*4]
movups xmm3, xmmword [ecx + edi*4]
movaps xmm2, xmm1
pxor xmm2, xmm3
pand xmm2, xmm4
movaps xmm0, xmm2
pxor xmm2, xmm3
pxor xmm0, xmm1
movups xmmword [eax + edi*4], xmm0
movups xmmword [ecx + edi*4], xmm2
add edi, 4
cmp edi, dword [esp + 0x34]
jb 0x1003e650
mov dword [esp + 0x34], edi
cmp edi, ebx
jae 0x1003e6b3
mov eax, dword [esi + 0xc]
mov ecx, dword [eax + edi*4]
lea edx, [eax + edi*4]
mov eax, dword [ebp + 0xc]
mov esi, dword [eax + edi*4]
xor esi, ecx
and esi, dword [esp + 0x24]
xor ecx, esi
mov dword [edx], ecx
mov eax, dword [ebp + 0xc]
xor dword [eax + edi*4], esi
inc edi
mov esi, dword [esp + 0x30]
cmp edi, ebx
jb 0x1003e687
mov edx, dword [esp + 0x20]
pop edi
pop ebx
pop esi
mov eax, edx
pop ebp
add esp, 0x18
ret
Function at 0x10044e30
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
mov dword [esp], 0
mov eax, dword [ecx + 0xc]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1c]
movd xmm0, edx
pshufd xmm7, xmm0, 0
mov dword [ecx], 0
mov dword [ecx + 8], eax
test eax, eax
je 0x10044fc0
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
xor ebx, ebx
push esi
push edi
mov edi, dword [esp + 0x30]
mov ecx, eax
xor esi, esi
xor eax, eax
test edi, edi
je 0x10044f99
cmp edi, 8
jb 0x10044f70
movaps xmm5, xmmword [0x1007b150]
mov ecx, 0x1f
movaps xmm6, xmmword [0x1007b140]
mov esi, edi
and esi, 0xfffffff8
xorps xmm4, xmm4
xorps xmm2, xmm2
movd xmm3, ecx
nop
movd xmm0, eax
lea edx, [ebx + eax]
pshufd xmm1, xmm0, 0
lea ecx, [eax + 4]
paddd xmm1, xmm5
add eax, 8
pxor xmm1, xmm7
movaps xmm0, xmm1
pandn xmm1, xmmword [0x1007b160]
psubd xmm0, xmm6
psrld xmm1, xmm3
psrld xmm0, xmm3
pand xmm0, xmm1
xorps xmm1, xmm1
psubd xmm1, xmm0
movups xmm0, xmmword [ebp + edx*4]
pand xmm1, xmm0
movd xmm0, ecx
por xmm4, xmm1
pshufd xmm1, xmm0, 0
paddd xmm1, xmm5
pxor xmm1, xmm7
movaps xmm0, xmm1
pandn xmm1, xmmword [0x1007b160]
psubd xmm0, xmm6
psrld xmm1, xmm3
psrld xmm0, xmm3
pand xmm0, xmm1
xorps xmm1, xmm1
psubd xmm1, xmm0
movups xmm0, xmmword [ebp + edx*4 + 0x10]
pand xmm1, xmm0
por xmm2, xmm1
cmp eax, esi
jb 0x10044eb0
mov edx, dword [esp + 0x28]
por xmm2, xmm4
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd esi, xmm2
cmp eax, edi
jae 0x10044f95
nop dword [eax]
mov ecx, eax
xor ecx, edx
lea edx, [ecx - 1]
not ecx
shr edx, 0x1f
shr ecx, 0x1f
and edx, ecx
lea ecx, [ebx + eax]
neg edx
inc eax
and edx, dword [ebp + ecx*4]
or esi, edx
mov edx, dword [esp + 0x28]
cmp eax, edi
jb 0x10044f70
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x10]
add ebx, edi
mov ebp, dword [esp + 0x14]
mov dword [ebp + eax*4], esi
inc eax
mov ebp, dword [esp + 0x24]
mov dword [esp + 0x10], eax
cmp eax, ecx
jb 0x10044e77
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
push ecx
call fcn.10040610
xor eax, eax
add esp, 0x10
ret
Function at 0x10050de0
Capabilities:
Get disk information
Get disk size
Get hostname
Get memory capacity

Disassembly:
sub esp, 0x1c8
mov eax, dword [0x100883c8]
xor eax, esp
mov dword [esp + 0x1c4], eax
lea eax, [esp + 0x44]
push 0x14
push eax
call fcn.10050cf0
push eax
lea eax, [esp + 0x50]
push eax
call fcn.10011930
add esp, 0x10
mov dword [esp + 0x24], 0x20
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
lea eax, [esp + 0x24]
push 0x20
push eax
call fcn.10011930
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [esp], eax
lea eax, [esp]
push 4
push eax
call fcn.10011930
add esp, 8
mov dword [esp], 0x100
lea eax, [esp]
push eax
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x10050e71
push dword [esp]
lea eax, [esp + 0x48]
push eax
call fcn.10011930
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [esp + 4], eax
lea eax, [esp + 4]
push 4
push eax
call fcn.10011930
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp], eax
lea eax, [esp]
push 4
push eax
call fcn.10011930
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esp], eax
lea eax, [esp]
push 4
push eax
call fcn.10011930
add esp, 8
mov byte [esp + 0x144], 0
lea eax, [esp + 0x44]
mov byte [esp + 0x44], 0
push 0x100
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x18]
push eax
push 0x80
lea eax, [esp + 0x15c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
lea ecx, [esp + 0x144]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10050f00
sub ecx, edx
lea eax, [esp + 0x144]
push ecx
push eax
call fcn.10011930
lea eax, [esp + 0x10]
push 4
push eax
call fcn.10011930
lea eax, [esp + 0x1c]
push 4
push eax
call fcn.10011930
lea eax, [esp + 0x28]
push 4
push eax
call fcn.10011930
lea ecx, [esp + 0x64]
add esp, 0x20
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10050f45
sub ecx, edx
lea eax, [esp + 0x44]
push ecx
push eax
call fcn.10011930
add esp, 8
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x10050faf
lea eax, [esp + 0x14]
push 4
push eax
call fcn.10011930
lea eax, [esp + 0x20]
push 4
push eax
call fcn.10011930
lea eax, [esp + 0x2c]
push 4
push eax
call fcn.10011930
lea eax, [esp + 0x38]
push 4
push eax
call fcn.10011930
add esp, 0x20
lea eax, [esp + 0x44]
push 0x14
push eax
call fcn.10050cf0
push eax
lea eax, [esp + 0x50]
push eax
call fcn.10011930
mov ecx, dword [esp + 0x1d4]
add esp, 0x10
xor ecx, esp
call fcn.10065810
add esp, 0x1c8
ret

Function at 0x10050fe0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push edi
push dword [esp + 0xc]
xor edi, edi
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
cmovne edi, dword [esp + 0xc]
mov eax, edi
pop edi
ret
Function at 0x10052960
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
movdqu xmm1, xmmword [ecx]
movdqu xmmword [edx], xmm1
movdqa xmm2, xmm1
lea eax, [0x10088350]
movdqa xmm0, xmmword [eax]
lea eax, [0x10088320]
movdqa xmm4, xmmword [eax]
mov eax, 8
lea edx, [edx + 0x10]
dec eax
pshufb xmm2, xmm4
aesenclast xmm2, xmm0
pslld xmm0, 1
movdqa xmm3, xmm1
pslldq xmm3, 4
pxor xmm1, xmm3
pslldq xmm3, 4
pxor xmm1, xmm3
pslldq xmm3, 4
pxor xmm1, xmm3
pxor xmm1, xmm2
movdqu xmmword [edx], xmm1
movdqa xmm2, xmm1
jne 0x1005298d
lea eax, str.eeee
movdqa xmm0, xmmword [eax]
pshufb xmm2, xmm4
aesenclast xmm2, xmm0
pslld xmm0, 1
movdqa xmm3, xmm1
pslldq xmm3, 4
pxor xmm1, xmm3
pslldq xmm3, 4
pxor xmm1, xmm3
pslldq xmm3, 4
pxor xmm1, xmm3
pxor xmm1, xmm2
movdqu xmmword [edx + 0x10], xmm1
movdqa xmm2, xmm1
pshufb xmm2, xmm4
aesenclast xmm2, xmm0
movdqa xmm3, xmm1
pslldq xmm3, 4
pxor xmm1, xmm3
pslldq xmm3, 4
pxor xmm1, xmm3
pslldq xmm3, 4
pxor xmm1, xmm3
pxor xmm1, xmm2
movdqu xmmword [edx + 0x20], xmm1
movdqa xmm2, xmm1
ret

Function at 0x10052d10
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
movdqu xmm1, xmmword [ecx]
movdqu xmm3, xmmword [ecx + 0x10]
movdqu xmmword [edx], xmm1
movdqu xmmword [edx + 0x10], xmm3
lea eax, [0x10088350]
movdqu xmm0, xmmword [eax]
lea eax, [0x10088340]
movdqu xmm5, xmmword [eax]
pxor xmm6, xmm6
mov eax, 6
movdqa xmm2, xmm3
pshufb xmm2, xmm5
aesenclast xmm2, xmm0
pslld xmm0, 1
movdqa xmm4, xmm1
pslldq xmm4, 4
pxor xmm1, xmm4
pslldq xmm4, 4
pxor xmm1, xmm4
pslldq xmm4, 4
pxor xmm1, xmm4
pxor xmm1, xmm2
movdqu xmmword [edx + 0x20], xmm1
pshufd xmm2, xmm1, 0xff
aesenclast xmm2, xmm6
movdqa xmm4, xmm3
pslldq xmm4, 4
pxor xmm3, xmm4
pslldq xmm4, 4
pxor xmm3, xmm4
pslldq xmm4, 4
pxor xmm3, xmm4
pxor xmm3, xmm2
movdqu xmmword [edx + 0x30], xmm3
lea edx, [edx + 0x20]
dec eax
jne 0x10052d47
movdqa xmm2, xmm3
pshufb xmm2, xmm5
aesenclast xmm2, xmm0
movdqa xmm4, xmm1
pslldq xmm4, 4
pxor xmm1, xmm4
pslldq xmm4, 4
pxor xmm1, xmm4
pslldq xmm4, 4
pxor xmm1, xmm4
pxor xmm1, xmm2
movdqu xmmword [edx + 0x20], xmm1
ret
Function at 0x419fd3
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x441343
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x4096f0]
xor eax, esp
mov dword [esp + 0x5c], eax
push esi
push edi
mov eax, dword [0x4096f0]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov edi, dword [ebp + 0xc]
push 1
lea ecx, [esp + 0x20]
push ecx
push esi
call dword [eax + 0x30]
test eax, eax
js 0x41a0cb
mov eax, dword [esp + 0x24]
or eax, dword [esp + 0x28]
jne 0x41a038
mov eax, 0x80004005
jmp 0x41a0cb
push dword [esp + 0x24]
mov eax, 0x2011
push 0
push 0x11
mov word [edi], ax
call dword [sym.imp.OLEAUT32.dll_SafeArrayCopyData]
mov dword [edi + 8], eax
xor edi, edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edi
test eax, eax
je 0x41a08c
lea ecx, [esp + 0x14]
push ecx
push eax
call dword [sym.imp.OLEAUT32.dll_SafeArrayUnaccessData]
test eax, eax
setns al
test al, al
jne 0x41a08c
cmp dword [esp + 0x10], edi
je 0x41a084
push dword [esp + 0x10]
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetElement]
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
push edi
push edi
push edi
push edi
mov dword [esp + 0x88], edi
mov eax, dword [esi]
push esi
call dword [eax + 0x14]
mov edi, eax
test edi, edi
js 0x41a0b8
mov eax, dword [esi]
lea ecx, [esp + 0x18]
push ecx
push dword [esp + 0x28]
push dword [esp + 0x1c]
push esi
call dword [eax + 0xc]
mov edi, eax
cmp dword [esp + 0x10], 0
je 0x41a0c9
push dword [esp + 0x10]
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetElement]
mov eax, edi
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.0042e34e
mov esp, ebp
pop ebp
ret 8

Function at 0x41a13b
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push 0x3c
lea eax, [ebp - 0x3c]
push eax
call fcn.004304e4
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
push 0xffffffffffffffff
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x100
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], 5
call dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
neg eax
sbb eax, eax
neg eax
leave
ret 8
Function at 0x41a938
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
lea eax, [ebp - 0x54]
push eax
push 0xffffffffffffffff
call fcn.00430385
call fcn.00430100
call fcn.0042fc7f
push 0
call fcn.0042a037
test eax, eax
jne 0x41a96d
push 0x30303030
call fcn.00429d5a
call fcn.0042ce0b
push esi
push edi
call fcn.0042a253
push 0x14
call fcn.004303d5
call fcn.004303fd
push 0x401a8c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test edi, edi
je 0x41a9be
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebx
push 0x401aa0
push edi
call esi
push 0x401ab4
push edi
mov ebx, eax
call esi
test eax, eax
je 0x41a9bd
test ebx, ebx
je 0x41a9bd
call eax
cmp eax, 2
jne 0x41a9bd
push 1
call ebx
pop ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call fcn.00420012
test eax, eax
jne 0x41aa73
lea ecx, [ebp - 4]
mov dword [ebp - 4], eax
call fcn.0041dfc6
test al, al
jne 0x41a9ff
mov eax, dword [ebp - 4]
test eax, eax
je 0x41a9f4
cmp eax, 0xffffffff
je 0x41a9f4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret 0x10
lea ecx, [ebp - 0x2c]
call fcn.0041e38a
lea ecx, [ebp - 0x2c]
call fcn.0041e089
mov esi, dword [ebp - 4]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x41aa26
cmp esi, 0xffffffff
je 0x41aa24
push esi
call edi
xor esi, esi
push 0
push 0x4202a2
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 0x4018d4
call fcn.00430c65
lea ecx, [ebp - 0x20]
call fcn.00430a83
lea ecx, [ebp - 0x2c]
call fcn.00419f10
test esi, esi
je 0x41aa58
cmp esi, 0xffffffff
je 0x41aa58
push esi
call edi
call fcn.0043042d
call fcn.0042fe40
call fcn.00430112
call fcn.0042a056
call fcn.004303a7
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x41d626
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44030b
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x4096f0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
push 2
push 0
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x420], edi
test edi, edi
jne 0x41d6b2
call fcn.0041add2
mov esi, eax
jmp 0x41d797
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x41d6cb
call fcn.0041add2
jmp 0x41d78e
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x424], ebx
test ebx, ebx
jne 0x41d6e9
call fcn.0041add2
jmp 0x41d78e
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
mov dword [ebp - 0x41c], esi
cmp eax, esi
jae 0x41d70a
mov esi, 0x8007000e
jmp 0x41d790
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.0041d83d
mov dword [ebp - 4], 1
jmp 0x41d742
mov eax, dword [ebp - 0x418]
test eax, eax
jne 0x41d753
mov esi, 0x8007000e
jmp 0x41d790
push esi
push eax
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x41d76e
call fcn.0041add2
jmp 0x41d78e
mov eax, dword [ebp - 0x418]
push dword [ebp + 0x14]
xor edx, edx
mov word [eax + ecx*2], dx
push dword [ebp - 0x418]
lea ecx, [ebp - 0x42c]
call fcn.0041c10c
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x41d7b2
lea ecx, [ebp - 0x418]
call fcn.0041d8ec
lea ebx, [ebx]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0042e34e
mov esp, ebp
pop ebp
ret 0x10
Function at 0x420012
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4406f9
mov eax, dword fs:[0]
push eax
sub esp, 0x358
mov eax, dword [0x4096f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x420284
lea ecx, [ebp - 0x350]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
mov dword [ebp - 0x354], esi
test esi, esi
jne 0x42006d
or eax, 0xffffffff
jmp 0x420284
push 2
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
xor ebx, ebx
cmp dword [ebp - 0x350], 1
jle 0x420275
push 1
push 0xffffffffffffffff
push 0x401a58
push 0xffffffffffffffff
push dword [esi + 4]
call fcn.0042f63d
test eax, eax
jne 0x420272
cmp dword [ebp - 0x350], 3
jle 0x420272
lea eax, [ebp - 0x114]
mov dword [ebp - 0x118], 0x102
mov dword [ebp - 0x124], 0x476e78
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x11c], 0x102
xor eax, eax
mov word [ebp - 0x114], ax
lea eax, [ebp - 0x228]
mov dword [ebp - 4], 1
mov dword [ebp - 0x22c], 0x102
mov dword [ebp - 0x238], 0x476e78
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x230], 0x102
xor eax, eax
mov word [ebp - 0x228], ax
push eax
lea eax, [ebp - 0x124]
push eax
push dword [esi + 8]
mov byte [ebp - 4], 3
call fcn.0042f6b6
push ebx
lea eax, [ebp - 0x238]
push eax
push dword [esi + 0xc]
call fcn.0042f6b6
push ebx
push dword [ebp - 0x120]
call dword [sym.imp.SHLWAPI.dll_UrlIsW]
test eax, eax
jne 0x42016e
lea ecx, [ebp - 0x238]
or ebx, 0xffffffff
call fcn.0041845c
lea ecx, [ebp - 0x124]
call fcn.0041845c
jmp 0x420275
lea eax, [ebp - 0x33c]
mov dword [ebp - 0x340], 0x102
mov dword [ebp - 0x34c], 0x476e78
mov dword [ebp - 0x348], eax
mov dword [ebp - 0x344], 0x102
xor eax, eax
mov word [ebp - 0x33c], ax
mov esi, dword [ebp - 0x120]
lea edi, [ebp - 0x34c]
mov byte [ebp - 4], 5
call fcn.0041f86a
push 0
push dword [0x4782bc]
push 0
push 0
push 0
push 0
push 0x80000000
push 0x80000000
push 0xcf0000
push 0x4173dc
push 0x401a7c
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
mov edi, eax
push 5
push edi
call esi
push 0
push edi
call esi
push edi
call dword [sym.imp.USER32.dll_DestroyWindow]
push dword [0x477864]
lea ecx, [ebp - 0x364]
call fcn.0041f6c1
push dword [ebp - 0x234]
lea ecx, [ebp - 0x364]
push dword [ebp - 0x348]
mov byte [ebp - 4], 6
call fcn.004183b6
xor ebx, ebx
test al, al
setne bl
lea ecx, [ebp - 0x364]
mov byte [ebp - 4], 5
lea ebx, [ebx*2 - 1]
call fcn.0041f74a
lea ecx, [ebp - 0x34c]
call fcn.0041845c
lea ecx, [ebp - 0x238]
call fcn.0041845c
lea ecx, [ebp - 0x124]
call fcn.0041845c
mov esi, dword [ebp - 0x354]
jmp 0x420275
or ebx, 0xffffffff
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042e34e
mov esp, ebp
pop ebp
ret 4
Function at 0x4291a8
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1060
call fcn.0042f167
mov eax, dword [0x4096f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, ecx
push 0x1c9181
mov dword [ebp - 0x1054], ebx
call fcn.00429d5a
add ebx, 0xb0
mov eax, dword [ebx]
push ebx
xor edi, edi
mov dword [ebp - 0x105c], ebx
call dword [eax + 0xc]
push 0x824
lea ecx, [ebp - 0x1050]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov esi, eax
test esi, esi
jne 0x4292ce
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x429349
mov ebx, dword [ebp - 0x1054]
add ebx, 0xb0
mov esi, dword [ebx]
push ebx
mov dword [ebp - 0x1058], ebx
call dword [esi + 0x18]
push eax
push ebx
call dword [esi + 0xb8]
mov esi, eax
mov eax, dword [ebx]
push ebx
mov dword [ebp - 0x1060], esi
call dword [eax + 0x18]
push 0x5c
pop ecx
push ecx
push eax
push esi
call fcn.004346eb
mov ebx, eax
test ebx, ebx
je 0x429349
xor eax, eax
mov word [ebx], ax
push 0x824
lea eax, [ebp - 0x1050]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov esi, eax
push 0x5c
pop eax
mov word [ebx], ax
lea eax, [esi - 1]
cmp eax, 0x823
ja 0x4292b9
mov eax, ebx
sub eax, dword [ebp - 0x1060]
sar eax, 1
cmp esi, eax
jbe 0x429299
push 0x1c9183
call fcn.00429d5a
mov eax, 0x825
sub eax, esi
push eax
lea eax, [ebp - 0x1050]
lea eax, [eax + esi*2]
push eax
push ebx
call fcn.00429168
push ebx
call fcn.004186fe
add esi, eax
mov ecx, dword [ebp - 0x1058]
mov eax, dword [ecx]
push ecx
call dword [eax + 0xbc]
mov ebx, dword [ebp - 0x105c]
lea eax, [esi - 1]
cmp eax, 0x823
ja 0x429349
mov eax, dword [ebx]
push ebx
call dword [eax + 0xc]
push eax
lea eax, [ebp - 0x1050]
push eax
call fcn.00421a82
test eax, eax
je 0x429349
cmp esi, 0x104
ja 0x429349
mov edi, dword [ebp - 0x1054]
push esi
lea ecx, [ebp - 0x1050]
add edi, 0xb0
mov eax, dword [edi]
push ecx
push edi
call dword [eax + 0x28]
test eax, eax
jne 0x42931c
mov eax, 0x8007000e
jmp 0x42934b
mov eax, dword [ebx]
push ebx
call dword [eax + 0xc]
push dword [ebp + 8]
mov esi, eax
mov eax, dword [edi]
push edi
call dword [eax + 0x18]
mov ebx, dword [ebp - 0x1054]
push eax
push esi
mov ecx, ebx
call fcn.00428471
mov edi, eax
test edi, edi
js 0x429349
mov ecx, ebx
call fcn.0042645b
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042e34e
leave
ret 4