joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x433072
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x3c6e4287
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x57395308
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401000
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebx
push ecx
push edx
enter 0x84, 0
sub ebp, 0x82
mov dword [ebp - 2], 0
call fcn.00401554
mov ebx, eax
xor eax, eax
mov dword [ebp + 0x7e], eax
lea eax, [ebp + 0x7e]
push eax
mov eax, ebx
or al, 0x40
push eax
mov eax, 0x401e00
sub eax, fcn.004015cb
push eax
push fcn.004015cb
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
cmp dword [ebp + 0x7e], 0
je 0x40107d
mov eax, ebx
lea edx, [ebp - 2]
jmp loc.00422000
xor eax, eax
lea esp, [ebp + 0x82]
pop ebp
pop edx
pop ecx
pop ebx
ret

Function at 0x401554
Capabilities:
Delete file
Encode data using base64 via winapi

Disassembly:
push ebx
push ecx
push edx
enter 0x11c, 0
lea ebx, [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
push ebx
call dword [sym.imp.USER32.DLL_GetCursorPos]
push 0
push 0
lea ebx, [ebp - 4]
call dword [sym.imp.USER32.DLL_GetWindow]
push ebx
lea ebx, [ebp - 0x18]
push ebx
push 1
push 1
lea eax, [ebp - 0x11c]
push eax
mov dword [ebp - 4], 0xa
mov byte [ebp - 0x11c], 0
call dword [sym.imp.CRYPT32.DLL_CryptBinaryToStringA]
lea eax, [ebp - 0x18]
movzx ebx, byte [ebp - 0x18]
push eax
sub ebx, 0x41
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
mov eax, ebx
leave
pop edx
pop ecx
pop ebx
ret

Function at 0x4015cb
Capabilities:
Delete file

Disassembly:
hlt
push edi
mov edi, 0x72647246
jb 0x401617
ror byte [ecx + 0x6ed8c765], 0
inc edi
add al, 0xe8
push edi
jbe 0x4015a9
popal
mov dword [ebx + edx*2 + 0x6c], ebp
mov dword [ecx + 0x45], esp
jae 0x401612
and byte [ebp + eax*2], 0x8d
mov dword [edx - 0x39], edx
invalid
inc ebp
call 0x6e75775d
outsb dx, byte [esi]
inc ebp
inc ebp
add al, 0xa2
invalid

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10024e56
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x10024e65
pop dword [ebp - 0x30]
mov eax, 0x10024e65
sub dword [ebp - 0x30], eax
push 0x40
push 0x1000
push 0x41b3d
push 0
mov eax, 0xbb4a1e8
sub eax, 0xfbad20cc
add eax, dword [ebp - 0x30]
call dword [eax]
mov ecx, 0x741962d5
add ecx, 0x8be6e010
xor esi, esi
add esi, eax
mov edi, 0x58373d17
sub edi, 0x481ec917
add edi, dword [ebp - 0x30]
mov ebx, 0xad3f7ba1
add dword [ebp - 0x10], edx
mov edx, dword [edi]
add dword [ebp - 8], ebx
sub edx, ebx
add dword [ebp - 0x24], ecx
mov dword [esi], edx
xor dword [ebp - 0x18], ecx
add esi, 0x2792f69e
sub esi, 0x2792f69a
add edi, 0x12081a0a
add edi, 0xedf7e5fa
loop 0x10024ebb
add eax, 0xf667df14
add eax, 0x9991f53
mov ebx, eax
add eax, 0xd1f50fd8
sub eax, 0xd1f50fd3
mov ecx, 0x10000000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x10072480
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x2d], 0
jne 0x1007251b
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push esi
push 0
push eax
push ebx
push dword [ebp + 0xc]
push dword [edi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov esi, dword [ebp - 4]
cmp esi, ebx
je 0x100724d2
mov byte [edi + 0x2d], 0xff
test esi, esi
je 0x100724d2
cmp esi, ebx
jge 0x100724d2
mov eax, ebx
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [edi + 0x18], 0
je 0x10072515
add dword [edi + 0x1c], ebx
cmp dword [edi + 0x1c], 0xffff
jle 0x10072515
xor eax, eax
mov word [edi + 0x1e], ax
mov eax, dword [edi]
push edi
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x100783d8]
call esi
mov ecx, dword [edi + 0x18]
push 1
push dword [edi + 0x20]
mov esi, dword [ecx]
push eax
push ecx
mov ecx, dword [esi + 0xc]
call dword [0x100783d8]
call dword [esi + 0xc]
mov esi, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
jmp 0x1007252d
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
pop edi
leave
ret 0xc

Function at 0x10072750
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100bb860]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10176180], 0
mov eax, dword [ebp + 8]
je 0x10072778
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x10072792
lea ecx, [ebp - 0x108]
push ecx
push eax
call fcn.10024e56
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.10076730
leave
ret 4

Function at 0x10072960
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x100bb860]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10176180], 0
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
je 0x10072996
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x100729f5
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call fcn.10024e56
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.10024e56
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.10024e56
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10076730
leave
ret 0x10
Function at 0x10072a10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100bb860]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10176180], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x10072a3c
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x10072a6d
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x10072a6b
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.10024e56
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x10072a6d
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10076730
leave
ret 8
Function at 0x401950
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov esi, dword [edi + 0xbc]
mov eax, dword [ecx + 0x14]
add esi, edi
mov edx, dword [edi + 0x1c]
mov dword [ebp - 0xc], edx
mov dword [esi + 8], eax
mov eax, dword [ecx + 0x18]
mov ecx, 1
mov dword [esi + 0xc], eax
mov eax, 0x100
mov dword [esi + 0x10], 1
test word [edi + 0x94], ax
jne 0x40199a
mov dword [esi + 0x10], 0
xor ecx, ecx
mov dword [esi + 0x14], 0
mov eax, dword [edi + 0x78]
mov dword [ebp - 8], eax
lea eax, [edx + 0x3a]
test byte [ebp - 8], 4
je 0x4019b5
test byte [eax], 1
je 0x4019ec
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
and eax, 0xfffffffb
mov dword [edi + 0x78], eax
mov ecx, dword [esi + 0x10]
mov eax, dword [ebp - 4]
or ecx, 0x200
mov edx, eax
mov dword [esi + 0x10], ecx
test byte [edx], 2
mov edx, dword [ebp - 0xc]
je 0x4019ec
mov eax, dword [edx + 0x46]
or ecx, 0x400
mov dword [esi + 0x14], eax
mov eax, dword [ebp - 4]
mov dword [esi + 0x10], ecx
test dword [edi + 0x78], 0x400
je 0x4019fe
or ecx, 0x4000
mov dword [esi + 0x10], ecx
test byte [eax], 4
je 0x401a0c
or ecx, 0x100
mov dword [esi + 0x10], ecx
mov eax, dword [ebp + 8]
test byte [eax + 6], 2
je 0x401a39
or ecx, 0x80
mov eax, 1
mov dword [esi + 0x10], ecx
mov word [esi + 0x20], ax
cmp word [edi + 0x18], 3
jne 0x401a3e
mov eax, 0x2000
or word [edi + 0x7c], ax
jmp 0x401a3e
or word [esi + 0x20], 0x20
mov ecx, dword [edx + 0x3c]
mov dword [esi + 0x18], ecx
mov eax, dword [edx + 0x40]
mov dword [esi + 0x1c], eax
cmp cx, 0xd
jne 0x401aa3
mov ecx, dword [0x4af094]
movsx edx, word [edx]
cmp edx, dword [ecx + 0x194]
jge 0x401a96
mov eax, dword [ecx + 0x198]
movzx eax, word [eax + edx*2]
mov dword [ecx + 0x1a0], eax
mov eax, dword [0x4af094]
imul edx, dword [eax + 0x1a0], 0x2c
add edx, dword [eax + 0x400]
je 0x401a96
mov ecx, dword [edx + 0x24]
test ecx, ecx
je 0x401a96
mov edx, dword [edx + 0xc]
call fcn.004368e0
jmp 0x401a98
xor eax, eax
mov dword [esi + 0x1c], eax
test eax, eax
jne 0x401aa3
mov word [esi + 0x18], ax
cmp dword [edi + 0xcc], 0
jne 0x401aca
or word [esi + 0x20], 2
mov eax, 1
or dword [esi + 0x10], 8
mov ecx, dword [esi + 0x10]
movzx ecx, cx
pop edi
mov word [esi + 0x22], cx
pop esi
mov esp, ebp
pop ebp
ret
movzx eax, word [esi + 0x10]
mov word [esi + 0x22], ax
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x402c00
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
mov dword [ebp - 0xc], edx
xorps xmm0, xmm0
movups xmmword [esi], xmm0
movq qword [esi + 0x10], xmm0
mov dword [esi + 0x18], 0
mov eax, dword [0x4af094]
test eax, eax
je 0x402c34
cmp dword [eax + 0x1fc], 0
jne 0x402dc2
push 0
push 0
push 0
push 0
push esi
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x402daa
push edi
mov edi, dword [sym.imp.USER32.dll_IsDialogMessageW]
push 0
push 0
push 0
push esi
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x402d5e
mov ecx, dword [0x4aee7c]
mov dword [ebp - 4], 0
test ecx, ecx
je 0x402ca5
mov eax, dword [ecx + 4]
mov dword [ebp - 8], eax
test eax, eax
je 0x402ca5
lea eax, [ebp - 8]
push eax
call dword [sym.imp.MMFS2.dll_Ordinal_536]
push esi
push eax
call edi
test eax, eax
jne 0x402d5e
cmp dword [ebp - 8], eax
je 0x402ca5
mov ecx, dword [0x4aee7c]
jmp 0x402c82
mov eax, dword [0x4af094]
test eax, eax
je 0x402d50
mov ecx, 0x4000
test word [eax + 0x16], cx
je 0x402d50
push dword [0x4af068]
call dword [sym.imp.MMFS2.dll_Ordinal_19]
test eax, eax
je 0x402ce9
push esi
push eax
call dword [sym.imp.USER32.dll_TranslateMDISysAccel]
mov ecx, dword [ebp - 4]
test eax, eax
mov eax, 1
cmovne ecx, eax
mov dword [ebp - 4], ecx
mov eax, dword [esi + 4]
cmp eax, 0x100
je 0x402cfa
cmp eax, 0x104
jne 0x402d4a
mov edi, dword [esi + 8]
cmp edi, 0x10
je 0x402d4a
cmp edi, 0x11
je 0x402d4a
mov ecx, dword [0x4af094]
test ecx, ecx
je 0x402d4a
mov ecx, dword [ecx + 0xb4]
test ecx, ecx
je 0x402d4a
cmp eax, 0x104
je 0x402d31
mov eax, 0x2000
test word [esi + 0xe], ax
jne 0x402d31
xor edx, edx
jmp 0x402d36
mov edx, 1
push ecx
mov ecx, dword [0x4af070]
push edi
call fcn.00453a20
add esp, 8
test eax, eax
jne 0x402d5e
cmp dword [ebp - 4], 0
jne 0x402d5e
push esi
call dword [sym.imp.USER32.dll_TranslateMessage]
push esi
call dword [sym.imp.USER32.dll_DispatchMessageW]
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x402d8c
test al, 1
je 0x402d72
cmp dword [esi + 4], 0x111
je 0x402da9
test al, 2
je 0x402d7f
cmp dword [esi + 4], 0x201
je 0x402da9
test al, 4
je 0x402d8c
cmp dword [esi + 4], 0x202
je 0x402da9
push 0
push 0
push 0
push 0
push esi
call dword [sym.imp.USER32.dll_PeekMessageW]
mov edi, dword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x402c52
pop edi
push 0
call dword [sym.imp.USER32.dll_GetKeyState]
push 0x4aef50
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov dword [0x4aef4c], eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x408010
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea edx, [ecx + 2]
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x408020
sub ecx, edx
sar ecx, 1
push 2
lea eax, [ecx + 4]
push eax
call fcn.00473719
mov ebx, eax
add esp, 8
mov dword [ebp - 4], ebx
test ebx, ebx
je 0x4080e1
mov ecx, ebx
sub ecx, esi
nop
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x408050
push 0x5c
push ebx
call fcn.00470ee6
add esp, 8
test eax, eax
je 0x408075
xor ecx, ecx
mov word [eax + 2], cx
cmp word [ebx], 0x5c
jne 0x40809e
cmp word [ebx + 2], 0x5c
jne 0x40809e
lea eax, [ebx + 4]
push 0x5c
push eax
call fcn.00470f88
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x4080c1
push 0x5c
lea eax, [ebx + 2]
push eax
jmp 0x4080b7
cmp word [ebx + 2], 0x3a
jne 0x4080b4
cmp word [ebx + 4], 0x5c
jne 0x4080b4
push 0x5c
lea eax, [ebx + 6]
push eax
jmp 0x4080b7
push 0x5c
push ebx
call fcn.00470f88
add esp, 8
mov ebx, eax
push 2
push 0x104
call fcn.00473719
mov esi, eax
add esp, 8
test esi, esi
jne 0x4080eb
push dword [ebp - 4]
call fcn.0047372f
add esp, 4
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
test ebx, ebx
je 0x408158
mov eax, ebx
sub eax, ecx
sar eax, 1
push eax
push ecx
push esi
call fcn.00476f9d
push esi
call fcn.00477147
add esp, 0x10
test eax, eax
je 0x408134
push esi
call fcn.00477152
add esp, 4
test eax, eax
je 0x408121
mov edi, 1
jmp 0x408134
push esi
call fcn.00477147
add esp, 4
test eax, eax
mov eax, 1
cmovne edi, eax
lea eax, [ebx + 2]
mov dword [ebp - 8], ebx
push 0x5c
push eax
call fcn.00470f88
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x4081cc
mov ecx, dword [ebp - 8]
test edi, edi
je 0x4080f2
jmp 0x4081cc
mov edx, esi
sub edx, dword [ebp - 4]
nop dword [eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x408160
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x408175
sub ecx, edx
sar ecx, 1
cmp ecx, 3
jbe 0x408198
cmp word [esi + ecx*2 - 2], 0x5c
jne 0x408198
xor eax, eax
mov word [esi + ecx*2 - 2], ax
push esi
call fcn.00477147
add esp, 4
test eax, eax
je 0x4081cc
push esi
call fcn.00477152
add esp, 4
test eax, eax
je 0x4081b9
mov edi, 1
jmp 0x4081cc
push esi
call fcn.00477147
add esp, 4
mov ecx, 1
test eax, eax
cmovne edi, ecx
push esi
call fcn.0047372f
push dword [ebp - 4]
call fcn.0047372f
add esp, 8
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4089e0
Capabilities:
Set current directory

Disassembly:
mov eax, dword [0x4af220]
test eax, eax
je 0x408a13
cmp dword [0x4af21c], 0
je 0x408a02
push eax
mov ecx, 0x4af378
call fcn.004648a0
mov eax, dword [0x4af220]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x4af220], 0
mov eax, dword [0x4aee44]
test eax, eax
je 0x408a50
push 0x5c
push eax
call fcn.00470ee6
add esp, 8
test eax, eax
je 0x408a50
mov edx, dword [0x4aee44]
mov ecx, eax
sub ecx, edx
sar ecx, 1
cmp ecx, 3
jae 0x408a44
xor ecx, ecx
mov word [eax + 2], cx
jmp 0x408a49
xor ecx, ecx
mov word [eax], cx
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push edi
mov edi, dword [0x4aee3c]
test edi, edi
je 0x408b3d
cmp word [edi], 0
je 0x408b34
xor esi, esi
push edi
call fcn.0047491a
add esp, 4
test eax, eax
je 0x408a99
call fcn.0047736a
cmp dword [eax], 2
je 0x408a99
push 0x3e8
call ebx
inc esi
cmp esi, 0xa
jl 0x408a73
jmp 0x408b06
mov ecx, edi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x408aa0
sub ecx, edx
sar ecx, 1
push 2
lea eax, [ecx + 1]
push eax
call fcn.00473719
mov esi, eax
add esp, 8
test esi, esi
je 0x408b06
mov edx, esi
mov ecx, edi
sub edx, edi
nop dword [eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x408ad0
push 0x5c
push esi
call fcn.00470ee6
add esp, 8
test eax, eax
je 0x408afd
xor ecx, ecx
push esi
mov word [eax], cx
call fcn.0047737d
add esp, 4
push esi
call fcn.0047372f
add esp, 4
mov ecx, edi
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x408b10
sub ecx, edx
sar ecx, 1
lea edi, [edi + ecx*2]
add edi, 2
cmp word [edi], ax
jne 0x408a71
mov edi, dword [0x4aee3c]
push edi
call fcn.0047372f
add esp, 4
mov edx, dword [0x4aee38]
test edx, edx
je 0x408baa
xor esi, esi
nop dword [eax]
mov ecx, edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x408b55
sub ecx, edi
sar ecx, 1
cmp ecx, 3
jle 0x408b78
cmp word [edx + ecx*2 - 2], 0x5c
jne 0x408b78
xor eax, eax
mov word [edx + ecx*2 - 2], ax
push edx
call fcn.0047737d
add esp, 4
test eax, eax
je 0x408ba4
call fcn.0047736a
cmp dword [eax], 2
je 0x408ba4
push 0x3e8
call ebx
inc esi
cmp esi, 0xa
jge 0x408ba4
mov edx, dword [0x4aee38]
jmp 0x408b50
mov edx, dword [0x4aee38]
push edx
call fcn.0047372f
push dword [0x4aee44]
mov dword [0x4aee38], 0
call fcn.0047372f
add esp, 8
mov dword [0x4aee44], 0
pop edi
pop esi
pop ebx
ret
Function at 0x412050
Capabilities:
Create process on windows
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
push ebx
push esi
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x58]
push edi
push eax
mov dword [ebp - 0x50], 0
movlpd qword [ebp - 0x38], xmm0
movlpd qword [ebp - 0x30], xmm0
movlpd qword [ebp - 0x28], xmm0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x58], 0x3c
mov dword [ebp - 0x54], 0x440
mov dword [ebp - 0x4c], str.open
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x412174
mov ebx, dword [ebp + 0xc]
test bl, 1
je 0x412162
call fcn.0042cfd0
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
and ebx, 2
je 0x4120f3
mov eax, dword [0x4af09c]
push 0
push dword [eax + 0x10]
call esi
mov eax, dword [0x4af09c]
mov eax, dword [eax + 0x4c4]
test eax, eax
je 0x4120f3
push 0
push eax
call esi
mov edi, dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
nop dword [eax]
lea eax, [ebp + 8]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x412138
cmp dword [ebp + 8], 0x103
jne 0x412138
xor edx, edx
lea ecx, [ebp - 0x1c]
call fcn.00402c00
push 0x4ff
push 0xc8
push 0
push 0
push 0
call edi
jmp 0x412100
test bx, bx
je 0x41215d
mov eax, dword [0x4af09c]
push 5
push dword [eax + 0x10]
call esi
mov eax, dword [0x4af09c]
mov eax, dword [eax + 0x4c4]
test eax, eax
je 0x41215d
push 5
push eax
call esi
call fcn.0042d0e0
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x426530
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push 2
push 0x104
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.00473719
mov esi, eax
add esp, 8
test esi, esi
je 0x42665a
push edi
push 2
push 0x104
call fcn.00473719
mov edi, eax
add esp, 8
test edi, edi
je 0x42658d
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push esi
push ebx
push 0x4ad044
push edi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push edi
call fcn.0047372f
add esp, 4
cmp word [esi], bx
je 0x42664b
push esi
call fcn.0047491a
mov ecx, esi
add esp, 4
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4265a4
sub ecx, edx
sar ecx, 1
cmp word [esi + ecx*2 - 2], 0x5c
je 0x4265d3
lea edi, [esi - 2]
nop
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x4265c0
mov eax, dword [0x49c464]
mov dword [edi], eax
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4265e0
sub ecx, edx
sar ecx, 1
lea edi, [ecx*2 + 4]
push edi
call fcn.0047370e
mov edx, eax
add esp, 4
test edx, edx
jne 0x426615
call fcn.0047cba0
push edi
call fcn.0047370e
add esp, 4
mov edx, eax
mov eax, dword [ebp - 4]
mov ecx, esi
mov dword [eax], edx
sub edx, esi
nop
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x426620
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push esi
call fcn.0047372f
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
mov ebx, 0xe
call fcn.0047372f
add esp, 4
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret