joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e520
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x80
push esi
mov dword [esp + 4], 0x10d040e
xor esi, esi
mov dword [esp + 8], 0x80b0f02
mov dword [esp + 0xc], 0xc060a03
mov dword [esp + 0x10], 0x7000905
mov dword [esp + 0x14], 0xe08010f
mov dword [esp + 0x18], 0x4030b06
mov dword [esp + 0x1c], 0xd020709
mov dword [esp + 0x20], 0xa05000c
mov dword [esp + 0x24], 0xe09000a
mov dword [esp + 0x28], 0x50f0306
mov dword [esp + 0x2c], 0x70c0d01
mov dword [esp + 0x30], 0x802040b
mov dword [esp + 0x34], 0x30e0d07
mov dword [esp + 0x38], 0xa090600
mov dword [esp + 0x3c], 0x5080201
mov dword [esp + 0x40], 0xf040c0b
mov dword [esp + 0x44], 0x1040c02
mov dword [esp + 0x48], 0x60b0a07
mov dword [esp + 0x4c], 0xf030508
mov dword [esp + 0x50], 0x90e000d
mov dword [esp + 0x54], 0xf0a010c
mov dword [esp + 0x58], 0x8060209
mov dword [esp + 0x5c], 0x4030d00
mov dword [esp + 0x60], 0xb05070e
mov dword [esp + 0x64], 0xe020b04
mov dword [esp + 0x68], 0xd08000f
mov dword [esp + 0x6c], 0x7090c03
mov dword [esp + 0x70], 0x1060a05
mov dword [esp + 0x74], 0x408020d
mov dword [esp + 0x78], 0x10b0f06
mov dword [esp + 0x7c], 0xe03090a
mov dword [esp + 0x80], 0x70c0005
nop dword [eax]
mov ecx, esi
mov edx, esi
sar ecx, 4
and edx, 0xf
movzx eax, byte [esp + ecx + 4]
shl al, 4
or al, byte [esp + edx + 0x14]
mov byte [esi + 0x441de0], al
movzx eax, byte [esp + ecx + 0x24]
shl al, 4
or al, byte [esp + edx + 0x34]
mov byte [esi + 0x441ae0], al
movzx eax, byte [esp + ecx + 0x44]
shl al, 4
or al, byte [esp + edx + 0x54]
mov byte [esi + 0x441ce0], al
movzx eax, byte [esp + ecx + 0x64]
shl al, 4
or al, byte [esp + edx + 0x74]
mov byte [esi + 0x441be0], al
inc esi
cmp esi, 0x100
jl 0x41e630
pop esi
add esp, 0x80
ret
Function at 0x42b1d0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x441008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
mov dword [ebp - 0x214], eax
mov dword [eax], 0
cmp dword [0x441558], 0
jne 0x42b3a7
push ebx
push esi
push edi
push 0x20a
lea eax, [ebp - 0x210]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x218], 0x104
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
xor eax, eax
mov word [ebp - 0xa], ax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
mov ecx, dword [0x44155c]
mov ebx, eax
add esp, 4
mov dword [ebp - 0x21c], ecx
cmp ebx, ecx
ja 0x42b2a4
cmp ecx, 8
mov dword [0x441558], ebx
lea esi, [ebx + ebx]
mov edi, 0x441548
cmovae edi, dword [0x441548]
lea eax, [ebp - 0x210]
push esi
push eax
push edi
call dword [sym.imp.VCRUNTIME140.dll_memmove]
add esp, 0xc
xor eax, eax
mov word [esi + edi], ax
mov eax, dword [ebp - 0x214]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004226d8
mov esp, ebp
pop ebp
ret
cmp ebx, 0x7ffffffe
ja 0x42b3bb
mov esi, ebx
or esi, 7
cmp esi, 0x7ffffffe
jbe 0x42b2c4
mov esi, 0x7ffffffe
jmp 0x42b2e2
mov edx, ecx
mov eax, 0x7ffffffe
shr edx, 1
sub eax, edx
cmp ecx, eax
jbe 0x42b2da
mov esi, 0x7ffffffe
jmp 0x42b2e2
lea eax, [edx + ecx]
cmp esi, eax
cmovb esi, eax
lea eax, [esi + 1]
lea ecx, [eax + eax]
cmp eax, 0x7fffffff
jbe 0x42b2f4
or ecx, 0xffffffff
jmp 0x42b2fc
cmp ecx, 0x1000
jb 0x42b323
lea eax, [ecx + 0x23]
or edx, 0xffffffff
cmp eax, ecx
cmovbe eax, edx
push eax
call fcn.004226e9
add esp, 4
test eax, eax
je 0x42b3b5
lea edi, [eax + 0x23]
and edi, 0xffffffe0
mov dword [edi - 4], eax
jmp 0x42b336
test ecx, ecx
je 0x42b334
push ecx
call fcn.004226e9
add esp, 4
mov edi, eax
jmp 0x42b336
xor edi, edi
mov dword [0x44155c], esi
lea eax, [ebp - 0x210]
lea esi, [ebx + ebx]
mov dword [0x441558], ebx
push esi
push eax
push edi
call dword [sym.imp.VCRUNTIME140.dll_memcpy]
xor eax, eax
add esp, 0xc
mov word [esi + edi], ax
mov eax, dword [ebp - 0x21c]
cmp eax, 8
jb 0x42b398
lea ecx, [eax*2 + 2]
mov eax, dword [0x441548]
cmp ecx, 0x1000
jb 0x42b38e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42b3b5
mov eax, edx
push ecx
push eax
call fcn.00422996
add esp, 8
mov eax, dword [ebp - 0x214]
mov dword [0x441548], edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004226d8
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
call fcn.00403000
int3
Function at 0x42e5e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], ecx
cmp dword [ebp + 8], 0
jne 0x42e5f3
xor eax, eax
jmp 0x42e645
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x42e60e
mov ecx, dword [ebp - 4]
and ecx, 0x10
je 0x42e612
xor eax, eax
jmp 0x42e645
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 8]
call fcn.0042e5b0
movzx eax, al
test eax, eax
jne 0x42e635
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 8]
call fcn.0042e010
xor eax, eax
jmp 0x42e645
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x42e770
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x441008]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x110
lea eax, [ebp - 0x114]
mov dword [ebp - 0x118], 0x114
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x42e7da
mov eax, dword [ebp - 0x114]
cmp eax, 5
ja 0x42e7ca
jne 0x42e7da
cmp dword [ebp - 0x110], 0
jbe 0x42e7da
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004226d8
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
call fcn.004226d8
mov esp, ebp
pop ebp
ret

Function at 0x42e886
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x441008]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x110
lea eax, [ebp - 0x114]
mov dword [ebp - 0x118], 0x114
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x42e8e2
cmp dword [ebp - 0x114], 5
ja 0x42e8de
jne 0x42e8e2
cmp dword [ebp - 0x110], 0
jbe 0x42e8e2
mov al, 1
jmp 0x42e8e4
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004226d8
leave
ret

Function at 0x42f9eb
Capabilities:
Check os version

Disassembly:
push 0x134
mov eax, 0x435664
call fcn.00430daf
push 0x110
lea eax, [ebp - 0x13c]
mov dword [ebp - 0x140], 0x114
push 0
push eax
call sub.VCRUNTIME140.dll_memset
xor eax, eax
add esp, 0xc
mov word [ebp - 0x12c], ax
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x42fa98
cmp dword [ebp - 0x13c], 5
jne 0x42fa98
cmp dword [ebp - 0x138], 1
jne 0x42fa98
lea eax, [ebp - 0x12c]
push eax
lea ecx, [ebp - 0x28]
call fcn.00402c19
and dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00404f90
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
jb 0x42fa71
mov ecx, dword [ebp - 0x28]
test ecx, ecx
je 0x42fa7f
mov edx, str.Service_Pack_1
call fcn.00404da0
test al, al
jne 0x42faa0
cmp dword [ebp - 0x18], 0
je 0x42faa0
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 9
call fcn.00402d45
or dword [ebp - 4], 0xffffffff
xor al, al
call fcn.00430d6a
ret
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 5
call fcn.00402d45
or dword [ebp - 4], 0xffffffff
mov al, 1
jmp 0x42fa9a
Function at 0x2580fc62
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x2580fc71
pop dword [ebp - 0x38]
mov eax, 0x2580fc71
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x28d9aded
add dword [ebp - 0x48], 0x2578975e
mov dword [ebp - 0x44], 0xc2ce13cd
add dword [ebp - 0x44], 0x6f653878
mov dword [ebp - 0x40], 0xd356bec4
sub dword [ebp - 0x40], 0x870a7a96
mov dword [ebp - 0x3c], 0x84980f4f
add dword [ebp - 0x3c], 0x7b67f0b1
lea eax, [ebp - 0x48]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0xf1370a92
add dword [ebp - 0x48], 0x833b5ec4
mov dword [ebp - 0x44], 0xf9e8a12d
add dword [ebp - 0x44], 0x4783c048
mov dword [ebp - 0x40], 0x79576df1
add dword [ebp - 0x40], 0xea17fe7b
mov dword [ebp - 0x3c], 0x330ae066
sub dword [ebp - 0x3c], 0x330ae066
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0xef430376
add eax, 0x363ecd0a
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x3c02a
push 0
call eax
mov ecx, 0x398d1ae3
sub ecx, 0x398cd532
mov edi, eax
mov ebx, 0xf31bcb8b
sub ebx, 0xcd99358b
add ebx, dword [ebp - 0x38]
mov edx, 0x10bbe02a
sub edx, 0xc348b448
xor dword [ebp - 0x28], ebx
mov esi, dword [ebx]
mov dword [ebp - 0x2c], 0xf89eb78e
sub esi, edx
sub dword [ebp - 0x1c], 0x8dd2975c
mov dword [edi], esi
xor dword [ebp - 8], ecx
add edi, 0x5d043d3d
sub edi, 0x5d043d39
add ebx, 0xa74af515
add ebx, 0x58b50aef
loop 0x2580fd89
add eax, 0x10997
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x80eb910a
sub ecx, 0x5b6b910a
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x40344c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x40345b
pop dword [ebp - 0x50]
mov eax, 0xd6aead4b
sub eax, 0xd66e78f0
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x1ab8c1c9
add dword [ebp - 0x60], 0x33998382
mov dword [ebp - 0x5c], 0x14099972
add dword [ebp - 0x5c], 0x1e29b2d3
mov dword [ebp - 0x58], 0x3913c1f
sub dword [ebp - 0x58], 0xb744f7f1
mov dword [ebp - 0x54], 0x8de7a004
sub dword [ebp - 0x54], 0x8de7a004
lea eax, [ebp - 0x60]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x9c87f593
sub dword [ebp - 0x60], 0x28158c3d
mov dword [ebp - 0x5c], 0x84eadc7c
sub dword [ebp - 0x5c], 0x437e7b07
mov dword [ebp - 0x58], 0xc4af6ef0
add dword [ebp - 0x58], 0x9ebffd7c
mov dword [ebp - 0x54], 0xbd239163
sub dword [ebp - 0x54], 0xbd239163
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0xf584c180
add eax, 0xabb7ed0
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3919b
push 0
call eax
mov ecx, SetUnhandledExceptionFilter
xor edx, edx
add edx, eax
mov ebx, 0x2a5f95e3
add ebx, 0xd5e0ee1d
add ebx, dword [ebp - 0x50]
mov esi, 0x3dc1c9cd
sub esi, 0x8e45a778
add dword [ebp - 0x2c], 0x7b8c5562
mov edi, dword [ebx]
sub dword [ebp - 0x48], edx
xor edi, esi
mov dword [edx], edi
xor dword [ebp - 0x1c], edx
add edx, 0x1ed2c333
sub edx, 0x1ed2c32f
add ebx, 0xb4eef5a
add ebx, 0xf4b110aa
loop 0x403574
add eax, 0x13697
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x414d19
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0040d053
xor ebx, ebx
cmp dword [0x4244a8], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x414dee
push str.USER32.DLL
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x414d59
xor eax, eax
jmp 0x414eb2
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x414d52
push eax
call fcn.0040cff0
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4244a8], eax
call esi
push eax
call fcn.0040cff0
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4244ac], eax
call esi
push eax
call fcn.0040cff0
mov dword [0x4244b0], eax
lea eax, [ebp - 8]
push eax
call fcn.0040f0e1
test eax, eax
pop ecx
pop ecx
je 0x414dbc
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040ce51
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x414dee
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0040cff0
cmp eax, ebx
pop ecx
mov dword [0x4244b8], eax
je 0x414dee
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040cff0
pop ecx
mov dword [0x4244b4], eax
mov eax, dword [0x4244b4]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x414e67
cmp dword [0x4244b8], esi
je 0x414e67
push eax
call fcn.0040d05c
pop ecx
call eax
cmp eax, ebx
je 0x414e34
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x4244b8]
call fcn.0040d05c
pop ecx
call eax
test eax, eax
je 0x414e34
test byte [ebp - 0x18], 1
jne 0x414e67
lea eax, [ebp - 0xc]
push eax
call fcn.0040f118
test eax, eax
pop ecx
je 0x414e4f
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040ce51
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x414e5e
or dword [ebp + 0x10], 0x200000
jmp 0x414e98
or dword [ebp + 0x10], 0x40000
jmp 0x414e98
mov eax, dword [0x4244ac]
cmp eax, esi
je 0x414e98
push eax
call fcn.0040d05c
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x414e98
mov eax, dword [0x4244b0]
cmp eax, esi
je 0x414e98
push dword [ebp - 4]
push eax
call fcn.0040d05c
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x4244a8]
call fcn.0040d05c
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4014b8
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x4014ca
mov eax, dword [0x4b408f]
shl eax, 2
mov dword [0x4b4093], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleW
mov edx, eax
call fcn.004a363c
pop edx
call fcn.004a3220
call fcn.004a3b30
push 0
call fcn.004a4cb4
pop ecx
push 0x4b4038
push 0
call sub.KERNEL32.DLL_GetModuleHandleW
mov dword [0x4b4097], eax
push 0
jmp fcn.004af6cc

Function at 0x402598
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb0
mov eax, 0x4b5634
call fcn.004a40b4
mov dword [ebp - 0x1c], 1
lea edx, [ebp + 0x10]
lea eax, [ebp + 0x10]
call fcn.004b2b54
inc dword [ebp - 0x1c]
mov word [ebp - 0x28], 0xc
mov word [ebp - 0x28], 0x18
lea eax, [ebp - 4]
call fcn.00402770
inc dword [ebp - 0x1c]
mov word [ebp - 0x28], 0xc
xor edx, edx
mov dword [ebp - 0x3c], edx
xor ecx, ecx
mov dword [ebp - 0x40], ecx
call sub.KERNEL32.DLL_WTSGetActiveConsoleSessionId
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0xffffffff
je 0x40263a
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x44]
call sub.WTSAPI32.DLL_WTSQueryUserToken
test eax, eax
je 0x402624
lea edx, [ebp - 0x250]
push edx
push 0
push dword [ebp - 0x48]
push 0x1c
push 0
call sub.SHFOLDER.DLL_SHGetFolderPathW
push dword [ebp - 0x48]
call sub.KERNEL32.DLL_CloseHandle
jmp 0x40264e
lea ecx, [ebp - 0x250]
push ecx
push 0
push 0
push 0x1c
push 0
call sub.SHFOLDER.DLL_SHGetFolderPathW
jmp 0x40264e
lea eax, [ebp - 0x250]
push eax
push 0
push 0
push 0x1c
push 0
call sub.SHFOLDER.DLL_SHGetFolderPathW
mov word [ebp - 0x28], 0x24
lea edx, [ebp - 0x250]
lea eax, [ebp - 8]
call fcn.004b2bc0
inc dword [ebp - 0x1c]
lea edx, [ebp - 8]
lea eax, [ebp - 4]
call fcn.004b2c4c
dec dword [ebp - 0x1c]
lea eax, [ebp - 8]
mov edx, 2
call fcn.004b2c24
mov word [ebp - 0x28], 0x30
mov edx, 0x4b4c06
lea eax, [ebp - 0xc]
call fcn.004b2b14
inc dword [ebp - 0x1c]
lea edx, [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.004b2c60
dec dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004b2c24
push 0
lea eax, [ebp - 4]
call fcn.004027a0
push eax
call sub.KERNEL32.DLL_CreateDirectoryW
mov word [ebp - 0x28], 0x3c
lea eax, [ebp - 0x14]
call fcn.00402770
push eax
inc dword [ebp - 0x1c]
mov edx, 0x4b4c1a
lea eax, [ebp - 0x10]
call fcn.004b2b14
inc dword [ebp - 0x1c]
lea edx, [ebp - 0x10]
lea eax, [ebp + 0x10]
pop ecx
call fcn.004b2c74
lea edx, [ebp - 0x14]
lea eax, [ebp - 4]
call fcn.004b2c60
dec dword [ebp - 0x1c]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004b2c24
dec dword [ebp - 0x1c]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004b2c24
mov word [ebp - 0x28], 0x48
lea edx, [ebp - 4]
mov eax, dword [ebp + 8]
call fcn.004b2c4c
mov eax, dword [ebp + 8]
mov word [ebp - 0x28], 0x54
push eax
dec dword [ebp - 0x1c]
lea eax, [ebp - 4]
mov edx, 2
call fcn.004b2c24
dec dword [ebp - 0x1c]
lea eax, [ebp + 0x10]
mov edx, 2
call fcn.004b2c24
pop eax
mov word [ebp - 0x28], 0x48
inc dword [ebp - 0x1c]
mov edx, dword [ebp - 0x38]
mov dword fs:[0], edx
mov esp, ebp
pop ebp
ret
Function at 0x4027dc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbb0
mov eax, 0x4b56d4
call fcn.004a40b4
mov word [ebp - 0x20], 0xc
lea eax, [ebp - 4]
call fcn.00402770
inc dword [ebp - 0x14]
mov word [ebp - 0x20], 0x18
xor edx, edx
mov dword [ebp - 0x34], edx
xor ecx, ecx
mov dword [ebp - 0x38], ecx
call sub.KERNEL32.DLL_WTSGetActiveConsoleSessionId
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xffffffff
je 0x402863
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x3c]
call sub.WTSAPI32.DLL_WTSQueryUserToken
test eax, eax
je 0x40284d
lea edx, [ebp - 0x450]
push edx
push 0
push dword [ebp - 0x40]
push 0x1c
push 0
call sub.SHFOLDER.DLL_SHGetFolderPathW
push dword [ebp - 0x40]
call sub.KERNEL32.DLL_CloseHandle
jmp 0x402877
lea ecx, [ebp - 0x450]
push ecx
push 0
push 0
push 0x1c
push 0
call sub.SHFOLDER.DLL_SHGetFolderPathW
jmp 0x402877
lea eax, [ebp - 0x450]
push eax
push 0
push 0
push 0x1c
push 0
call sub.SHFOLDER.DLL_SHGetFolderPathW
mov word [ebp - 0x20], 0x24
lea edx, [ebp - 0x450]
lea eax, [ebp - 8]
call fcn.004b2bc0
inc dword [ebp - 0x14]
lea edx, [ebp - 8]
lea eax, [ebp - 4]
call fcn.004b2c4c
dec dword [ebp - 0x14]
lea eax, [ebp - 8]
mov edx, 2
call fcn.004b2c24
mov word [ebp - 0x20], 0x30
mov edx, str.ArmouryLiveUpdate_
lea eax, [ebp - 0xc]
call fcn.004b2b14
inc dword [ebp - 0x14]
lea edx, [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.004b2c60
dec dword [ebp - 0x14]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004b2c24
lea eax, [ebp - 4]
call fcn.004027a0
push eax
call fcn.00413254
pop ecx
dec dword [ebp - 0x14]
lea eax, [ebp - 4]
mov edx, 2
call fcn.004b2c24
mov ecx, dword [ebp - 0x30]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x402afc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
cmp dword [eax + 0x400], 0
je 0x402b17
mov edx, dword [ebp + 8]
xor ecx, ecx
mov dword [edx + 0x400], ecx
lea eax, [ebp - 4]
push eax
push 0
push dword [0x4c1a28]
push 0x402b40
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
mov edx, dword [ebp + 8]
mov dword [edx + 0x400], eax
mov al, 1
pop ecx
pop ebp
ret
Function at 0x404028
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0
push dword [0x4c1a28]
push 0x404054
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
mov edx, dword [ebp + 8]
mov dword [edx + 0x400], eax
mov al, 1
pop ecx
pop ebp
ret

Function at 0x404de0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
lea eax, [ebp - 4]
push eax
push 0
push dword [0x4c1a28]
push 0x404e10
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
mov edx, dword [ebp + 8]
mov dword [edx + 0x404], eax
mov al, 1
pop ecx
pop ecx
pop ebp
ret

Function at 0x4059e0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
call fcn.00402a6c
mov eax, dword [ebp + 8]
push dword [eax + 0x404]
call sub.KERNEL32.DLL_SetEvent
push 0
mov edx, dword [ebp + 8]
push dword [edx + 0x404]
call sub.KERNEL32.DLL_WaitForSingleObject
test eax, eax
je 0x405a1a
push 0
mov ecx, dword [ebp + 8]
push dword [ecx + 0x404]
call sub.KERNEL32.DLL_TerminateThread
rcl dh, 0xa
invalid
mov eax, dword [ebp + 8]
push dword [eax + 0x404]
Function at 0x413254
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff998
push dword [ebp + 8]
lea eax, [ebp - 0x460]
push eax
call fcn.004a3fe8
add esp, 8
push 0x4b9fce
lea edx, [ebp - 0x460]
push edx
call fcn.004a4028
add esp, 8
push dword [ebp + 8]
lea ecx, [ebp - 0x668]
push ecx
call fcn.004a3fe8
add esp, 8
push 0x4b9fd4
lea eax, [ebp - 0x668]
push eax
call fcn.004a4028
add esp, 8
lea edx, [ebp - 0x258]
push edx
lea ecx, [ebp - 0x460]
push ecx
call sub.KERNEL32.DLL_FindFirstFileW
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4132cc
xor eax, eax
jmp 0x4133f6
lea edx, [ebp - 0x668]
push edx
lea ecx, [ebp - 0x460]
push ecx
call fcn.004a3fe8
add esp, 8
mov byte [ebp - 5], 1
cmp byte [ebp - 5], 0
je 0x4133e6
lea eax, [ebp - 0x258]
push eax
push dword [ebp - 4]
call sub.KERNEL32.DLL_FindNextFileW
test eax, eax
je 0x4133c0
lea edx, [ebp - 0x22c]
push edx
call fcn.0041321c
pop ecx
test eax, eax
jne 0x4132e6
lea ecx, [ebp - 0x22c]
push ecx
lea eax, [ebp - 0x668]
push eax
call fcn.004a4028
add esp, 8
test byte [ebp - 0x258], 0x10
je 0x41337b
lea edx, [ebp - 0x668]
push edx
call fcn.00413254
pop ecx
test eax, eax
jne 0x413357
push dword [ebp - 4]
call sub.KERNEL32.DLL_FindClose
xor eax, eax
jmp 0x4133f6
lea edx, [ebp - 0x668]
push edx
call sub.KERNEL32.DLL_RemoveDirectoryW
lea ecx, [ebp - 0x460]
push ecx
lea eax, [ebp - 0x668]
push eax
call fcn.004a3fe8
add esp, 8
jmp 0x4133dc
push 0x80
lea edx, [ebp - 0x668]
push edx
call sub.KERNEL32.DLL_SetFileAttributesW
lea ecx, [ebp - 0x668]
push ecx
call sub.KERNEL32.DLL_DeleteFileW
test eax, eax
jne 0x4133a8
push dword [ebp - 4]
call sub.KERNEL32.DLL_FindClose
xor eax, eax
jmp 0x4133f6
lea edx, [ebp - 0x460]
push edx
lea ecx, [ebp - 0x668]
push ecx
call fcn.004a3fe8
add esp, 8
jmp 0x4133dc
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x12
jne 0x4133d0
mov byte [ebp - 5], 0
jmp 0x4133dc
push dword [ebp - 4]
call sub.KERNEL32.DLL_FindClose
xor eax, eax
jmp 0x4133f6
cmp byte [ebp - 5], 0
jne 0x4132f0
push dword [ebp - 4]
call sub.KERNEL32.DLL_FindClose
push dword [ebp + 8]
call sub.KERNEL32.DLL_RemoveDirectoryW
mov esp, ebp
pop ebp
ret