joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418fc0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45ded8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x47b0e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
push 0x202
push dword [0x47b0c8]
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0
push 0x80000002
call fcn.00418bb0
test eax, eax
je 0x4190e8
mov esi, dword [ebp - 0x18]
mov edi, dword [0x47b0c8]
mov dword [ebp - 0x10], 0
test esi, esi
je 0x419093
cmp dword [esi], 0
je 0x419086
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x419053
mov eax, 1
jmp 0x4190b4
push str.RegCreateKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41908c
push 0
push dword [esi]
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0x20206
push 0
push 0
push 0
push edi
push 0x80000002
call eax
jmp 0x4190b4
cmp dword [esi + 4], 0
jne 0x419093
mov eax, 1
jmp 0x4190b4
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x20206
push 0
push 0
push 0
push edi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4190de
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x4190c6
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], 0x200
test eax, eax
je 0x4190eb
xor ebx, ebx
jmp 0x41918f
mov esi, dword [ebp - 0x20]
xor ebx, ebx
jmp 0x41918f
mov esi, dword [ebp - 0x20]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
je 0x419148
mov ecx, dword [ebx]
test ecx, ecx
je 0x4191ae
push ecx
push eax
call fcn.00444e04
add esp, 8
test eax, eax
je 0x419148
mov edx, dword [edi]
test edx, edx
je 0x419148
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x419120
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push str.m2_old
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebx]
test edx, edx
jne 0x419153
lea eax, [edx + 0xd]
jmp 0x419188
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x419160
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push 0x466ee8
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor ebx, ebx
test eax, eax
sete bl
test esi, esi
je 0x41919a
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00403106
int3
Function at 0x41a8d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], 0
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41a941
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x41a90f
cmp eax, 2
jne 0x41a92b
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x41a93b
test ecx, ecx
je 0x41a936
test cl, 1
jne 0x41a92b
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], 0
je 0x41a93b
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x41e580
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45e348
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x47b0e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push eax
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x28]
push 0x1a
push eax
call fcn.0041f220
cmp dword [ebp - 0x18], 0
mov dword [ebp - 4], 0
je 0x41e5e7
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41e665
push dword [ebp - 0x44]
lea eax, [ebp - 0x40]
mov ecx, esi
push 1
push eax
call fcn.0041f220
mov esi, eax
lea eax, [ebp - 0x28]
cmp eax, esi
je 0x41e62b
mov ecx, eax
call fcn.00405dd6
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [ebp - 0x28], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x18], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov edx, dword [ebp - 0x2c]
cmp edx, 8
jb 0x41e665
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41e65b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41e76d
push edx
push ecx
call fcn.0041bc9b
add esp, 8
cmp dword [ebp - 0x18], 0
jne 0x41e690
xor eax, eax
mov dword [edi + 0x10], 0
push eax
mov dword [edi + 0x14], 7
mov ecx, edi
push 0x461588
mov word [edi], ax
call fcn.0040aada
jmp 0x41e746
call fcn.004038e4
mov ecx, eax
test ecx, ecx
je 0x41e772
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 1
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.00402826
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.0040343b
mov edx, dword [ebp - 0x48]
add esp, 8
mov byte [ebp - 4], 1
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41e6f7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x44]
xor eax, eax
mov ecx, esi
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
mov word [edi], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41e712
sub ecx, edx
sar ecx, 1
push ecx
push esi
mov ecx, edi
call fcn.0040aada
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x41e746
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x28]
call fcn.0040d0cc
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041bf51
mov esp, ebp
pop ebp
ret 8
call fcn.00434389
push 0x80004005
call fcn.00403106
int3
Function at 0x4212d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45e8d2
mov eax, dword fs:[0]
push eax
sub esp, 0x818
mov eax, dword [0x47b0e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edx, edx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x824], esi
mov dword [ebp - 0x81c], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov dword [ebp - 0x818], 0
mov word [esi], dx
mov dword [ebp - 4], edx
mov dword [ebp - 0x81c], 1
test ecx, ecx
je 0x421400
test eax, eax
je 0x421400
test ebx, ebx
je 0x421400
lea edx, [ebp - 0x818]
push edx
push 0x20219
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4213ef
cmp dword [ebp - 0x818], eax
je 0x421400
push 0x802
push eax
lea eax, [ebp - 0x814]
push eax
call fcn.00431220
add esp, 0xc
mov dword [ebp - 0x820], 0x800
lea eax, [ebp - 0x820]
push eax
lea eax, [ebp - 0x814]
push eax
push 0
push 0xffff
push ebx
push 0
push dword [ebp - 0x818]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x4213ef
lea ecx, [ebp - 0x814]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4213d1
sub ecx, edx
lea eax, [ebp - 0x814]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.0040aada
mov eax, dword [ebp - 0x818]
test eax, eax
je 0x421400
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041bf51
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4282b0
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45f540
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x47b0e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 8]
test edi, edi
je 0x4283f9
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x4283f9
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4283f9
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x4283f9
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 5
push 0x80000000
push edi
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x18], edi
cmp edi, 0xffffffff
je 0x4283e5
lea eax, [ebp - 0x20]
xorps xmm0, xmm0
push eax
push edi
movq qword [ebp - 0x20], xmm0
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x4283de
cmp dword [ebp - 0x1c], ebx
jne 0x4283de
mov ecx, dword [esi + 0x10]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], ebx
cmp eax, ecx
ja 0x42837d
mov dword [esi + 0x10], eax
mov ecx, esi
cmp dword [esi + 0x14], 0x10
jb 0x428377
mov ecx, dword [esi]
mov byte [ecx + eax], 0
jmp 0x428389
sub eax, ecx
mov ecx, esi
push 0
push eax
call fcn.0040aa58
push 0
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
push dword [ebp - 0x20]
mov ecx, esi
push 0
call fcn.0040d006
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp + 8]
jne 0x4283de
push edi
mov ebx, 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44b947
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044b7c6

Function at 0x451150
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00450e10
Function at 0x45b7e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4606a1
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x47b0e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 1
mov dword [ebp - 0x1c], 0
mov dword [edi], 0
call fcn.004038e4
mov ecx, eax
test ecx, ecx
je 0x45b974
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x24], 1
push eax
push 0xf003f
push 0
push dword [ebp + 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x45b935
lea eax, [ebp - 0x14]
xorps xmm0, xmm0
push eax
push 0
lea eax, [ebp - 0x18]
movlpd qword [ebp - 0x18], xmm0
push eax
push 0
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x45b927
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x45b935
add eax, 0x10
push 0x481e08
push eax
mov dword [ebp - 0x20], eax
call fcn.0045c9e7
mov esi, eax
add esp, 8
test esi, esi
je 0x45b935
push dword [ebp - 0x20]
push 0
push esi
call fcn.00431220
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
push esi
push 0
push 0
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x45b8ea
push esi
call fcn.0041bcb2
add esp, 4
jmp 0x45b935
mov ecx, esi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45b8f0
sub ecx, edx
sar ecx, 1
je 0x45b91e
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45b906
sub ecx, edx
sar ecx, 1
push ecx
push esi
mov ecx, edi
call fcn.0040465f
push esi
call fcn.0041bcb2
add esp, 4
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x45b935
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp + 0x10]
or eax, 0xffffffff
mov byte [ebp - 4], 0
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x45b954
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041bf51
mov esp, ebp
pop ebp
ret 0x10
push 0x80004005
call fcn.00403106
int3
Function at 0x45b980
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x47b0e4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, edi
mov dword [ebp - 0xc], eax
lea edx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x45b9a4
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0xf003f
push 0
push dword [ebp + 0xc]
sub esi, edx
push ecx
sar esi, 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ebx, ebx
test eax, eax
sete bl
test eax, eax
jne 0x45ba06
lea eax, [esi*2 + 2]
push eax
push edi
push 1
push 0
push dword [ebp - 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb ebx, ebx
mov eax, dword [ebp - 8]
inc ebx
test eax, eax
je 0x45ba06
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0xc]
or ecx, 0xffffffff
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x45ba21
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041bf51
mov esp, ebp
pop ebp
ret 0x10
Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..wixburn
mov ebx, 0x40c7d0
nop
mov ecx, 0x7c182796
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
mov eax, section..pdata
nop
mov ebx, 0x42f314
mov ecx, 0x790c2f53
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x414dd0
Capabilities:
Encode data using xor

Disassembly:
xor dword [edx], esi
add edi, edi
push 0xad127eed
pop edi
add ecx, 1
add edx, 4
and ecx, ecx
cmp edx, ebx
jne fcn.00414dd0
or ecx, eax
sub eax, 0x1d6433c7
ret
Function at 0x406322
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push edi
lea edi, [esi + 0xc]
and dword [edi], 0
mov dword [esi + 4], eax
mov dword [esi + 8], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp dword [esi + 4], 0
mov dword [esi], eax
je 0x406365
cmp dword [esi + 8], 0
je 0x406365
push ebx
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
test eax, eax
je 0x406365
push edi
push 0x40
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, esi
pop edi
pop ebp
ret 4

Function at 0x4069a4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40d01c]
jne 0x4069ae
repz ret
jmp fcn.00406f22
Function at 0x40105d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x244
xor esi, esi
lea eax, [ebp - 0x248]
push esi
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
mov edi, 0x122
push edi
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x4010b0
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0040117a
leave
ret
push str.kernel32.dll
lea eax, [ebp - 0x248]
push edi
push eax
call dword [sym.imp.MSVCR80.dll_wcscat_s]
add esp, 0xc
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
cmp edi, esi
je 0x4010a0
push str.HeapSetInformation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, esi
jne 0x4010f4
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
jmp 0x4010a2
push esi
push esi
push 1
push esi
call eax
mov esi, eax
neg esi
sbb esi, esi
neg esi
jmp 0x4010e9

Function at 0x40117a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x401184
repz ret
jmp fcn.0040149e
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..retplne
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x5d9e4e87
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..reloc
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x397c7252
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4330c0
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x40b680
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f074d
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x53ba20]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 2
call fcn.004c8c9a
xor ecx, ecx
mov dword [ebp - 0x14], eax
mov word [eax], cx
mov eax, dword [ebp + 0x14]
mov ebx, 0x4fbd20
mov dword [ebp - 4], ecx
test eax, eax
mov ecx, ebx
cmovne ecx, eax
push ecx
mov dword [ebp - 0x18], ecx
call fcn.004c8c20
push 0
mov edi, eax
call fcn.004c8c7f
push 0x4fca88
call fcn.004c8c20
push 0
mov esi, eax
call fcn.004c8c7f
test esi, esi
mov ecx, ebx
cmovne ecx, esi
push ecx
call fcn.004c8c20
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8c7f
add esp, 0x1c
lea ecx, [ebp - 0x10]
push edi
call fcn.00405090
push esi
call fcn.004c8c7f
push 0x4fca74
call fcn.004c8c20
push 0
mov esi, eax
call fcn.004c8c7f
mov ecx, dword [ebp - 0x10]
mov eax, ebx
test ecx, ecx
cmovne eax, ecx
push eax
call fcn.004c8c20
push 0
mov dword [ebp + 0x14], eax
call fcn.004c8c7f
add esp, 0x14
lea ecx, [ebp + 0x14]
push esi
call fcn.00405090
push esi
call fcn.004c8c7f
mov ebx, dword [ebp + 0x14]
mov eax, 0x4fbd20
test ebx, ebx
cmovne eax, ebx
push eax
call fcn.004c8c20
push dword [ebp - 0x14]
mov esi, eax
mov dword [ebp + 0x14], esi
call fcn.004c8c7f
push ebx
call fcn.004c8c7f
push dword [ebp - 0x10]
call fcn.004c8c7f
push edi
call fcn.004c8c7f
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0040aa80
add esp, 0x24
cmp dword [ebp + 8], 0
je 0x40b8bc
mov eax, dword [0x54000c]
test eax, eax
je 0x40b7c4
push 1
call eax
push 0x200
push dword [0x540000]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push dword [ebp - 0x18]
call fcn.004c8c20
push 0
mov edi, eax
call fcn.004c8c7f
push 0x4fcab8
call fcn.004c8c20
push 0
mov esi, eax
call fcn.004c8c7f
mov ebx, 0x4fbd20
test esi, esi
mov ecx, ebx
cmovne ecx, esi
push ecx
call fcn.004c8c20
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8c7f
add esp, 0x18
lea ecx, [ebp - 0x10]
push edi
call fcn.00405090
push esi
call fcn.004c8c7f
push 0x4fca74
call fcn.004c8c20
push 0
mov esi, eax
call fcn.004c8c7f
mov ecx, dword [ebp - 0x10]
mov eax, ebx
test ecx, ecx
cmovne eax, ecx
push eax
call fcn.004c8c20
push 0
mov dword [ebp + 8], eax
call fcn.004c8c7f
add esp, 0x14
lea ecx, [ebp + 8]
push esi
call fcn.00405090
push esi
call fcn.004c8c7f
mov eax, dword [ebp + 8]
mov ecx, 0x4fbd20
mov ebx, dword [ebp + 0x14]
test eax, eax
cmovne ecx, eax
push ecx
call fcn.004c8c20
mov esi, eax
push ebx
mov dword [ebp + 0x14], esi
call fcn.004c8c7f
push dword [ebp + 8]
call fcn.004c8c7f
push dword [ebp - 0x10]
call fcn.004c8c7f
push edi
call fcn.004c8c7f
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0040aa80
mov eax, dword [0x54000c]
add esp, 0x24
test eax, eax
je 0x40b8bc
push 0
call eax
push 0x100
push dword [0x540000]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call fcn.004c8c7f
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x414b30
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
push 0
push 0
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov edi, eax
push 2
mov dword [ebp - 4], edi
call fcn.004c8c9a
mov esi, dword [ebp + 8]
lea edi, [edi*2 + 2]
xor ecx, ecx
push edi
mov dword [esi], eax
mov word [eax], cx
push dword [esi]
call fcn.004c8ca5
add esp, 0xc
mov dword [esi], eax
test eax, eax
je 0x414b7f
push edi
push 0
push eax
call fcn.004c52c0
add esp, 0xc
push dword [ebp - 4]
push dword [esi]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x414c30
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
push dword [ebp + 8]
lea eax, [ebp - 8]
mov ecx, 0x540734
push 0
push eax
lea eax, [ebp - 4]
push eax
call fcn.004080d0
mov esi, dword [ebp - 4]
test esi, esi
je 0x414c5a
mov eax, dword [esi]
jmp 0x414c5c
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
test esi, esi
je 0x414ca9
or ecx, 0xffffffff
lock xadd dword [esi + 8], ecx
dec ecx
jne 0x414ca9
mov eax, dword [esi]
test eax, eax
je 0x414c87
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x414c9e
push eax
call fcn.004c3453
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.004c3279
add esp, 8
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x414cc0
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
push dword [ebp + 8]
lea eax, [ebp - 8]
mov ecx, 0x540734
push 0
push eax
lea eax, [ebp - 4]
push eax
call fcn.004080d0
mov esi, dword [ebp - 4]
test esi, esi
je 0x414cea
mov eax, dword [esi]
jmp 0x414cec
xor eax, eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov edi, eax
test esi, esi
je 0x414d45
or ecx, 0xffffffff
lock xadd dword [esi + 8], ecx
dec ecx
jne 0x414d45
mov eax, dword [esi]
test eax, eax
je 0x414d23
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x414d3a
push eax
call fcn.004c3453
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.004c3279
add esp, 8
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret