joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000db20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005d6e6
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x1008ab18]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 4]
cmp dword [eax + 0x16], 0
je 0x1000dc4f
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call sym.ScCore.dll_protected:_int___thiscall_ScCore::LiveObject::cloneContent_class_ScCore::LiveObject___bool_const
mov edi, dword [esi + 4]
mov dword [ebp - 4], 0
call sym.ScCore.dll_public:_static_class_ScCore::Encoder_const____cdecl_ScCore::Encoder::getBinary_void_
cmp dword [edi + 0x12], eax
mov eax, edi
setne cl
cmp byte [ebp + 0xc], 0
je 0x1000db90
test cl, cl
je 0x1000db90
push dword [edi + 0x26]
lea ecx, [ebp - 0x10]
call sym.ScCore.dll_protected:_int___thiscall_ScCore::LiveObject::cloneContent_class_ScCore::LiveObject___bool_const
mov eax, dword [esi + 4]
push dword [eax + 0x12]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
call sym.ScCore.dll_protected:_int___thiscall_ScCore::LiveObject::cloneContent_class_ScCore::LiveObject___bool_const
mov edi, eax
test edi, edi
jne 0x1000dbd0
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x1000dbd0
mov eax, dword [esi + 4]
push dword [eax + 0x16]
push 1
push ecx
push dword [ebp - 0x18]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
mov ecx, 0x34
cmp eax, 1
cmovne edi, ecx
mov eax, dword [esi + 4]
push dword [eax + 0x16]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ferror]
add esp, 4
test eax, eax
mov eax, dword [esi + 4]
push dword [eax + 0x16]
je 0x1000dc14
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_clearerr]
add esp, 4
lea ecx, [ebp - 0x10]
mov edi, 0x34
call sym.ScCore.dll_protected:_int___thiscall_ScCore::LiveObject::cloneContent_class_ScCore::LiveObject___bool_const
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__ftelli64]
mov ecx, dword [esi + 4]
add esp, 4
cmp edx, dword [ecx + 0x1e]
jl 0x1000dc32
jg 0x1000dc2c
cmp eax, dword [ecx + 0x1a]
jbe 0x1000dc32
mov dword [ecx + 0x1a], eax
mov dword [ecx + 0x1e], edx
lea ecx, [ebp - 0x10]
call sym.ScCore.dll_protected:_int___thiscall_ScCore::LiveObject::cloneContent_class_ScCore::LiveObject___bool_const
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, 0x32
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x10010020
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push 0
push 0
call sym.ScCore.dll_protected:_int___thiscall_ScCore::LiveObject::cloneContent_class_ScCore::LiveObject___bool_const
cwde
test eax, eax
je 0x10010052
mov ecx, dword [esi]
and al, 3
pop esi
cmp al, 2
jne 0x10010049
mov dword [ebp + 8], ecx
pop ebp
jmp fcn.10033360
mov dword [ebp + 8], ecx
pop ebp
jmp fcn.10033590
mov eax, 0x30
pop esi
pop ebp
ret
Function at 0x10035360
Capabilities:
Get graphical window text
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18c
mov eax, dword [0x1008ab18]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
call sym.ScCore.dll_protected:_int___thiscall_ScCore::LiveObject::cloneContent_class_ScCore::LiveObject___bool_const
mov ebx, eax
test ebx, ebx
je 0x100354cc
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edi, eax
test edi, edi
je 0x100353ac
push 4
push edi
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
jne 0x100353a8
push edi
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x100353ac
mov edi, eax
jmp 0x10035390
push 0x100
lea eax, [ebp - 0x184]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x100354c4
push 0x80
lea eax, [ebp - 0x84]
push eax
push edi
call dword [sym.imp.USER32.dll_GetClassNameA]
test eax, eax
je 0x100354c4
lea eax, [ebp - 0x184]
push eax
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, edi
jne 0x100354c4
test edi, edi
je 0x100354c4
push esi
push 0xfffffffffffffffc
push edi
call dword [sym.imp.USER32.dll_GetWindowLongA]
push 0
push edi
mov esi, eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0
push ebx
mov edi, eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test esi, esi
mov dword [ebp - 0x188], eax
pop esi
je 0x100354c4
cmp eax, edi
je 0x100354c4
push 1
push edi
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
je 0x10035471
push ebx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
push edi
push dword [ebp - 0x188]
call dword [sym.imp.USER32.dll_AttachThreadInput]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005a9e0
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 0x18c]
push eax
push 0
push 0x2000
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
push 2
lea eax, [ebp - 0x188]
mov dword [ebp - 0x188], 0
push eax
push 0
push 0x2001
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
push ebx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 2
lea eax, [ebp - 0x18c]
push eax
push 0
push 0x2001
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
push ebx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.1005a9e0
mov esp, ebp
pop ebp
ret
Function at 0x100354f0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
call dword [sym.imp.kernel32.dll_GetCurrentProcessId]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov esi, eax
test esi, esi
jne 0x1003551b
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
push dword [ebp - 0xc]
push esi
call sym.ScCore.dll_protected:_int___thiscall_ScCore::LiveObject::cloneContent_class_ScCore::LiveObject___bool_const
add esp, 8
mov dword [ebp - 8], eax
test eax, eax
je 0x10035544
push eax
call dword [sym.imp.USER32.dll_IsWindowEnabled]
mov edx, dword [ebp - 8]
test eax, eax
cmove edx, esi
mov dword [ebp - 8], edx
test edx, edx
jne 0x1003555a
lea eax, [ebp - 0xc]
push eax
push 0x100355e0
call dword [sym.imp.USER32.dll_EnumWindows]
mov edx, dword [ebp - 8]
test edx, edx
je 0x100355a1
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1008baa8]
mov dword [ebp - 4], edx
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1008ba20]
cmp eax, dword [ecx + 4]
jg 0x100355a8
jmp 0x1003557e
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push 0
push dword [0x1008ba1c]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp - 8]
test eax, eax
pop esi
cmovne ecx, dword [ebp - 4]
mov eax, ecx
mov esp, ebp
pop ebp
ret
mov eax, edx
pop esi
mov esp, ebp
pop ebp
ret
push 0x1008ba20
call sym.ScCore.dll_protected:_int___thiscall_ScCore::LiveObject::cloneContent_class_ScCore::LiveObject___bool_const
add esp, 4
cmp dword [0x1008ba20], 0xffffffff
jne 0x1003557b
push str.adobe.sccore.get.dialog.owner
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
push 0x1008ba20
mov dword [0x1008ba1c], eax
call sym.ScCore.dll_protected:_int___thiscall_ScCore::LiveObject::cloneContent_class_ScCore::LiveObject___bool_const
add esp, 4
jmp 0x1003557b
Function at 0x10035720
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10061183
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1008ab18]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.ScCore::Thread.0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 1
call sym.ScCore.dll_protected:_int___thiscall_ScCore::LiveObject::cloneContent_class_ScCore::LiveObject___bool_const
mov edi, eax
mov ebx, edx
lea eax, [ebp - 0x10]
push eax
push 4
push esi
push sym.ScCore.dll_private:_static_unsigned_int___stdcall_ScCore::Thread::go_void__
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 4], eax
cmp eax, 0xffffffff
jne 0x100357b8
mov dword [esi + 0xc], 0x20
mov eax, esi
mov dword [esi + 8], 0
mov dword [esi + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov dword [esi + 8], eax
mov eax, dword [0x1008b8f8]
test eax, eax
jne 0x100357cc
call sym.ScCore.dll_public:_static_class_ScCore::Context____cdecl_ScCore::Context::get_void_
mov dword [eax + 0x52], edi
mov dword [eax + 0x56], ebx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10035860
Capabilities:
Resume thread

Disassembly:
cmp dword [ecx + 0xc], 0
jne 0x1003586f
push dword [ecx + 4]
call dword [sym.imp.kernel32.dll_ResumeThread]
ret

Function at 0x10035bb0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x1008ba4c]
test eax, eax
jne 0x10035c19
push dword [0x1008a930]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
jne 0x10035c19
push esi
push 0x16c
call sym.ScCore.dll_protected:_int___thiscall_ScCore::LiveObject::cloneContent_class_ScCore::LiveObject___bool_const
add esp, 4
test eax, eax
je 0x10035be6
mov ecx, eax
call sym.ScCore.dll_protected:_int___thiscall_ScCore::LiveObject::cloneContent_class_ScCore::LiveObject___bool_const
mov esi, eax
jmp 0x10035be8
xor esi, esi
cmp byte [0x1008ba48], 0
jne 0x10035c02
mov ecx, esi
mov dword [0x1008ba4c], esi
call fcn.1001d780
mov eax, esi
pop esi
ret
push esi
push dword [0x1008a930]
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, esi
call fcn.1001d780
mov eax, esi
pop esi
ret

Function at 0x10035c20
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x1008a930]
cmp eax, 0xffffffff
je 0x10035c76
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x10035c67
mov ecx, dword [0x1008ba4c]
xor eax, eax
cmp esi, ecx
cmove ecx, eax
mov dword [0x1008ba4c], ecx
mov ecx, esi
call fcn.1001d7b0
mov ecx, esi
call fcn.1001d750
push 0x16c
push esi
call sym.ScCore.dll_protected:_int___thiscall_ScCore::LiveObject::cloneContent_class_ScCore::LiveObject___bool_const
add esp, 8
push 0
push dword [0x1008a930]
call dword [sym.imp.kernel32.dll_TlsSetValue]
pop esi
ret
Function at 0x417864
Capabilities:
Encode data using xor

Disassembly:
and eax, 0x87384d12
loope 0x41789c
adc al, 9
sbb esp, dword [edx]
add eax, 0x305bc0a
mov ecx, ebp
jb 0x41787e
mov ah, 0xa8
or bh, byte [edi]
aas
adc eax, 0x969e8f6d
arpl word [ebx + 0xc1e55c2], sp
or edx, eax
arpl word [ebx], bp
pop ebx
test dword [ecx + 0xc5cd283], ecx
dec edx
dec esp
pushal
pop ebp
mov esi, 0x2b09862c
fisttp word [esi + 0x6e13df6a]
pushfd
invalid
mov gs, word [edx - 0x21]
adc ebp, dword [esi - 0x64]
xor bh, byte [0xae538f91]
xlatb
pop esp
push edi
mov dl, 0x89
sbb dword [ebp + 0xe], 0x764cab5
sub al, 0xf6
pop es
mov ecx, 0x12856f75
fistp qword [eax - 0x860f354]
nop
xchg edi, eax
scasd eax, dword es:[edi]
jg 0x41787b
jo 0x41787e
in eax, dx
clc
mov cl, 0xc8
sub dh, al
push cs
cmp al, 0x5d
push cs
fcomp qword [eax - 0x52]
push 0xd80e558e
pushfd
int3

Function at 0x417e10
Capabilities:
Get disk information

Disassembly:
push ecx
push esi
push 0x4c3074
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [0x4c6aec], eax
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
mov dword [0x4c6aec], eax
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
mov dword [0x4c74b0], eax
mov dword [esp + 8], 0
call dword [sym.imp.ole32.dll_CoInitialize]
test esi, esi
je 0x417e66
lea eax, [esp + 4]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push str.MSWHEEL_ROLLMSG
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
pop esi
mov ecx, dword [esp]
add ecx, eax
mov eax, ecx
pop ecx
ret

Function at 0x420498
Capabilities:
Encode data using xor

Disassembly:
arpl ax, si
lcall 0xcc17, 0x8a0a0ab1
out 0xd9, al
imul esi, esi, 0xffffffc9
fst st(3)
mov dh, bl
clc
xor eax, 0x834eb320
lahf
arpl word [ecx + 0x20], dx
jg 0x42046f
loopne 0x4204c5
shr dword [edi - 0x64], 1
cmpsd dword [esi], dword es:[edi]
cwde
cwde
sub dword [eax - 0x22], eax
enter 0xffffffffffffc3fb, 0xffffffffffffff98
aad 0x24
cmc
sbb ch, byte [ebx]
sbb byte [ecx + 0x60], dl
push edi
cmovp ebx, dword [esi]
mov dh, 0x6f
inc edx
jp 0x42045f
shr al, 1
rol dword [ebp + 0x4604a09d], 9
push esi
wait
aaa
repne movsb byte es:[edi], byte [esi]
loop 0x4204de
pop ebx
invalid
add dh, bl
sbb byte [esi - 0x37], ch
invalid

Function at 0x47c634
Capabilities:
Encode data using xor

Disassembly:
jge 0x47c627
xor eax, 0x54cbd4e8
invalid
hlt
aad 0xc3
jbe 0x47c5eb
mov eax, dword [ebp - 0x23d3c2fe]
sbb eax, 0x72f37c1e
je 0x47c5df
sti
xchg esp, eax
les ebp, [eax]
xor al, 0x5a

Function at 0x493ec4
Capabilities:
Encode data using xor

Disassembly:
imul ebp, dword [eax - 0x6c], 0x6d
sub eax, 0x6cd1df65
xor eax, 0xd8854079
push ebx
jbe 0x493ec8
xchg esp, eax
invalid

Function at 0x4a23f8
Capabilities:
Encode data using xor

Disassembly:
or ch, dh
cmp eax, 0x611a1a33
xor ebx, dword [edx]
sbb ah, byte [ecx + 0x12]
inc edx
invalid
dec eax
call 0x4edb65d9
push edx
jns 0x4a238d
Function at 0x41145c
Capabilities:
Check if file exists
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x628
mov eax, dword [0x42d008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x208
lea eax, [ebp - 0x20c]
push esi
xor edi, edi
push edi
push eax
call fcn.00412f70
push esi
lea eax, [ebp - 0x61c]
push edi
push eax
call fcn.00412f70
add esp, 0x18
mov dword [ebp - 0x620], edi
lea eax, [ebp - 0x20c]
mov bl, 1
push dword [ebp + 8]
push 0x104
push eax
call fcn.0040e1a0
test eax, eax
js 0x411634
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 0x20c]
push eax
mov dword [ebp - 0x624], edi
call edi
cmp eax, 0xffffffff
je 0x411585
test al, 0x10
jne 0x41162f
push esi
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.00412f70
add esp, 0xc
xor esi, esi
lea eax, [ebp - 0x20c]
test esi, esi
jne 0x411529
push eax
push 0x4010c0
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.004112b5
add esp, 0x10
jmp 0x411544
push esi
push eax
push 0x4010d0
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.004112b5
add esp, 0x14
test eax, eax
js 0x411634
lea eax, [ebp - 0x414]
push eax
call edi
cmp eax, 0xffffffff
je 0x411569
inc esi
cmp esi, 0x400
jl 0x411503
je 0x411634
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x411634
mov ecx, dword [ebp - 0x20c]
lea esi, [ebp - 0x20c]
push 0x5c
pop edx
cmp cx, dx
jne 0x4115a7
cmp word [ebp - 0x20a], dx
sete al
dec al
and bl, al
lea edi, [ebp - 0x61c]
test cx, cx
je 0x41162f
movzx eax, cx
mov ecx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [ebp - 0x628], ecx
test ax, ax
je 0x4115f8
movzx ecx, ax
mov word [edi], cx
add esi, 2
add edi, 2
cmp cx, dx
jne 0x4115ee
test bl, bl
jne 0x4115f8
mov eax, dword [ebp - 0x620]
inc eax
cmp eax, 3
mov dword [ebp - 0x620], eax
sete bl
movzx eax, word [esi]
mov ecx, eax
test ax, ax
jne 0x4115c9
xor eax, eax
mov word [edi], ax
lea eax, [ebp - 0x61c]
push eax
call dword [ebp - 0x624]
cmp eax, 0xffffffff
jne 0x411622
push 0
lea eax, [ebp - 0x61c]
push eax
call dword [ebp - 0x628]
test eax, eax
je 0x411634
movzx ecx, word [esi]
mov eax, ecx
push 0x5c
pop edx
test cx, cx
jne 0x4115c1
xor eax, eax
inc eax
jmp 0x411636
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004118ce
leave
ret 4
Function at 0x4118bf
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x42c6e0
call fcn.00411ff0
push 1
call fcn.0041198a
pop ecx
test al, al
je 0x4118a9
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.00411958
mov byte [ebp - 0x24], al
mov eax, dword [0x42da2c]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x4118a9
test eax, eax
jne 0x4117c7
mov dword [0x42da2c], ecx
push 0x4010a0
push 0x401080
call fcn.0041d18d
pop ecx
pop ecx
test eax, eax
je 0x4117aa
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x411899
push 0x40107c
push section..text
call fcn.0041d131
pop ecx
pop ecx
mov dword [0x42da2c], 2
jmp 0x4117cc
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.00411ade
pop ecx
call fcn.00411db0
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x4117fd
push esi
call fcn.00411a4a
pop ecx
test al, al
je 0x4117fd
mov esi, dword [esi]
push edi
push 2
push edi
mov ecx, esi
call dword [0x42f2ac]
call esi
call fcn.00411db6
mov esi, eax
cmp dword [esi], edi
je 0x41181b
push esi
call fcn.00411a4a
pop ecx
test al, al
je 0x41181b
push dword [esi]
call fcn.0041d430
pop ecx
call fcn.0041d118
mov edi, eax
call fcn.0041d4da
mov esi, dword [eax]
call fcn.0041d4d4
push edi
push esi
push dword [eax]
call main
add esp, 0xc
mov esi, eax
call fcn.00411edc
test al, al
je 0x4118b0
test bl, bl
jne 0x41184e
call fcn.0041d40b
push 0
push 1
call fcn.00411afb
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x411899
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
push 7
call fcn.00411dbc
push esi
call fcn.0041d468
push dword [ebp - 0x20]
call fcn.0041d41a
int3
call 0x55b000
jmp 0x41173d

Function at 0x421ef7
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00421ba5

Function at 0x42a3c2
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, dword [ebp + 0xc]
add esi, 0xffff0000
movzx eax, si
push edi
test eax, eax
je 0x42a3dd
sub esi, eax
cmp esi, dword [ebp + 8]
jbe 0x42a44f
mov ebx, 0x10000
lea eax, [esi - 0x50000000]
cmp eax, 0x30000000
ja 0x42a3fc
sub esi, 0x8000000
jmp 0x42a44a
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
push 0x1c
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x42a44f
cmp dword [ebp - 0xc], ebx
jne 0x42a438
cmp dword [ebp - 0x10], ebx
jb 0x42a438
push 0x40
push 0x3000
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x42a451
sub esi, ebx
jmp 0x42a44a
mov esi, dword [ebp - 0x18]
add esi, 0xffff0000
movzx eax, si
test eax, eax
je 0x42a44a
sub esi, eax
cmp esi, dword [ebp + 8]
ja 0x42a3e7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x42a458
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, 0x10000
movzx eax, si
push edi
test eax, eax
je 0x42a4d9
sub esi, eax
add esi, ebx
jmp 0x42a4d9
lea eax, [esi - 0x50000000]
cmp eax, 0x30000000
ja 0x42a48b
add esi, 0x8000000
jmp 0x42a4d9
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
push 0x1c
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x42a4de
mov ecx, dword [ebp - 0x10]
cmp dword [ebp - 0xc], ebx
jne 0x42a4c7
cmp ecx, ebx
jb 0x42a4c7
push 0x40
push 0x3000
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x42a4e0
jmp 0x42a472
mov esi, dword [ebp - 0x1c]
add esi, ecx
movzx ecx, si
test ecx, ecx
je 0x42a4d9
mov eax, ebx
sub eax, ecx
add esi, eax
cmp esi, dword [ebp + 0xc]
jb 0x42a476
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x42a4e7
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
cmp esi, 0x7ff80000
jbe 0x42a50d
lea edi, [esi - 0x7ff80000]
cmp esi, 0x80000000
jb 0x42a512
mov ebx, 0xfff80000
jmp 0x42a518
mov edi, 0x10000
lea ebx, [esi + 0x7ff80000]
mov edx, dword [0x42e60c]
mov eax, dword [0x42e608]
test edx, edx
jne 0x42a533
test eax, eax
je 0x42a546
mov edx, eax
mov dword [0x42e60c], edx
mov ecx, dword [edx + 8]
test ecx, ecx
je 0x42a546
cmp ecx, edi
jb 0x42a546
cmp ecx, ebx
jbe 0x42a5c6
mov edx, eax
test eax, eax
jmp 0x42a564
test edx, edx
je 0x42a55f
mov eax, dword [edx + 8]
test eax, eax
je 0x42a55f
cmp eax, edi
jb 0x42a55f
cmp eax, ebx
jbe 0x42a5c6
mov edx, dword [edx + 4]
test edx, edx
mov dword [0x42e60c], edx
jne 0x42a54c
and esi, 0xffff0000
push esi
push edi
call fcn.0042a3c2
mov edx, eax
test edx, edx
jne 0x42a58c
push ebx
push esi
call fcn.0042a458
mov edx, eax
test edx, edx
je 0x42a5eb
xor ecx, ecx
mov dword [edx], 0x52727464
mov dword [edx + 8], ecx
mov esi, 0x38b
mov eax, dword [0x42e608]
mov dword [edx + 4], eax
lea eax, [edx + 0xffa8]
mov dword [0x42e60c], edx
mov dword [0x42e608], edx
mov dword [eax + 0x40], ecx
mov ecx, eax
sub eax, 0x48
sub esi, 1
jne 0x42a5b6
mov dword [edx + 8], ecx
mov esi, dword [edx + 8]
cmp esi, edi
jb 0x42a5eb
cmp esi, ebx
ja 0x42a5eb
mov ecx, dword [esi + 0x40]
push 0x48
push 0xcc
push esi
mov dword [edx + 8], ecx
call fcn.00412f70
add esp, 0xc
mov eax, esi
jmp 0x42a5ed
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x42a8b5
Capabilities:
Parse pe header

Disassembly:
push 0x24
push 0x42cd70
call fcn.00411ff0
push 0x1c
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
and dword [ebp - 4], 0
mov eax, 0x5a4d
mov ecx, dword [ebp - 0x30]
cmp word [ecx], ax
jne 0x42a92d
mov edx, dword [ecx + 0x3c]
cmp dword [edx + ecx], 0x4550
jne 0x42a92d
mov esi, dword [edx + ecx + 0xd8]
lea eax, [esi + ecx]
cmp dword [ebp + 0xc], eax
jb 0x42a92d
mov eax, dword [edx + ecx + 0xdc]
add eax, esi
add eax, ecx
cmp dword [ebp + 0xc], eax
jae 0x42a92d
mov dword [ebp - 4], 0xfffffffe
mov al, 1
jmp 0x42a936
mov dword [ebp - 4], 0xfffffffe
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x401c66
pop dword [ebp - 0x24]
mov eax, 0x401c66
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x5cfa6204
add dword [ebp - 0x34], 0xf157e347
mov dword [ebp - 0x30], 0x9a9bebc2
add dword [ebp - 0x30], 0x97976083
mov dword [ebp - 0x2c], 0x272896fd
add dword [ebp - 0x2c], 0x2523ad31
mov dword [ebp - 0x28], 0x79d82b4b
sub dword [ebp - 0x28], 0x79d82b4b
lea eax, [ebp - 0x34]
push eax
mov eax, 0xb0bb916c
sub eax, 0xb07b6118
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x7ce4143f
add dword [ebp - 0x34], 0xf78e5517
mov dword [ebp - 0x30], 0x7de96221
add dword [ebp - 0x30], 0xc382ff54
mov dword [ebp - 0x2c], 0x5105396a
add dword [ebp - 0x2c], 0x126a3302
mov dword [ebp - 0x28], 0x6e6a64ab
sub dword [ebp - 0x28], 0x6e6a64ab
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0x892b2487
add eax, 0x77150ba5
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x3853a
push 0
call eax
mov ecx, 0x4f62
xor ebx, ebx
add ebx, eax
mov esi, 0x407000
add esi, dword [ebp - 0x24]
mov edi, 0x65070e35
sub dword [ebp - 0x18], esi
mov edx, dword [esi]
sub edx, edi
xor dword [ebp - 0xc], esi
mov dword [ebx], edx
mov dword [ebp - 8], 0x3b56ae68
add ebx, 0xee2d661c
sub ebx, 0xee2d6618
add esi, 0x7afbe385
add esi, 0x85041c7f
loop 0x401d73
add eax, 0xb82797ae
add eax, 0x47d998ad
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret