joyce8/EMBER2024-capa huggingface dataset:
Function at 0x423284
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x449238]
jne 0x42328e
repz ret
jmp fcn.004292f9

Function at 0x43024b
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x449df0]
je 0x430266
inc edi
cmp edi, 0x17
jb 0x430257
cmp edi, 0x17
jae 0x4303e6
push ebp
push 3
call fcn.004387c8
cmp eax, 1
pop ecx
je 0x4303b2
push 3
call fcn.004387c8
test eax, eax
pop ecx
jne 0x43029a
cmp dword [0x449288], 1
je 0x4303b2
cmp ebx, 0xfc
je 0x4303e5
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x458070
push ebp
call fcn.00432984
add esp, 0xc
test eax, eax
je 0x4302d0
push esi
push esi
push esi
push esi
push esi
call fcn.004291d9
add esp, 0x14
push 0x104
mov esi, 0x458089
push esi
push 0
mov byte [0x45818d], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x430314
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.00432984
add esp, 0xc
test eax, eax
je 0x430314
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.004291d9
add esp, 0x14
push esi
call fcn.00429100
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x430359
push esi
call fcn.00429100
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x458384
push 0x44243c
sub ecx, eax
push ecx
push eax
call fcn.004332f6
add esp, 0x14
test eax, eax
je 0x430359
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.004291d9
add esp, 0x14
jmp 0x43035b
xor esi, esi
push 0x442438
push ebx
push ebp
call fcn.0043323a
add esp, 0xc
test eax, eax
je 0x43037b
push esi
push esi
push esi
push esi
push esi
call fcn.004291d9
add esp, 0x14
push dword [edi*8 + 0x449df4]
push ebx
push ebp
call fcn.0043323a
add esp, 0xc
test eax, eax
je 0x43039d
push esi
push esi
push esi
push esi
push esi
call fcn.004291d9
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0043860b
add esp, 0xc
jmp 0x4303e5
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x4303e5
cmp ebp, 0xffffffff
je 0x4303e5
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x449df4]
push dword [esi]
call fcn.00429100
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x43860b
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00428c15
xor ebx, ebx
cmp dword [0x458730], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x4386e1
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x4387c1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x4387c1
push eax
call fcn.00428ba7
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x458730], eax
call esi
push eax
call fcn.00428ba7
mov dword [esp], 0x4436b4
push edi
mov dword [0x458734], eax
call esi
push eax
call fcn.00428ba7
mov dword [0x458738], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00427e04
test eax, eax
pop ecx
pop ecx
je 0x4386af
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004291d9
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x4386e1
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00428ba7
cmp eax, ebx
pop ecx
mov dword [0x458740], eax
je 0x4386e1
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00428ba7
pop ecx
mov dword [0x45873c], eax
mov eax, dword [0x45873c]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x438766
cmp dword [0x458740], ecx
je 0x438766
push eax
call fcn.00428c1e
push dword [0x458740]
mov esi, eax
call fcn.00428c1e
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x438766
cmp edi, ebx
je 0x438766
call esi
cmp eax, ebx
je 0x438733
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x438733
test byte [ebp - 0x18], 1
jne 0x438766
lea eax, [ebp - 0x10]
push eax
call fcn.00427e3b
test eax, eax
pop ecx
je 0x43874e
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004291d9
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x43875d
or dword [ebp + 0x10], 0x200000
jmp 0x4387a1
or dword [ebp + 0x10], 0x40000
jmp 0x4387a1
mov eax, dword [0x458734]
cmp eax, dword [ebp - 8]
je 0x4387a1
push eax
call fcn.00428c1e
cmp eax, ebx
pop ecx
je 0x4387a1
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4387a1
mov eax, dword [0x458738]
cmp eax, dword [ebp - 8]
je 0x4387a1
push eax
call fcn.00428c1e
cmp eax, ebx
pop ecx
je 0x4387a1
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x458730]
call fcn.00428c1e
cmp eax, ebx
pop ecx
je 0x4387c1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4387c3
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43c4d2
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x449238]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0043c467
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.004238f0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x43c521
cmp dword [ebp - 0x1c], 5
jb 0x43c539
jmp 0x43c535
cmp dword [ebp - 0x10], 1
jne 0x43c539
cmp dword [ebp - 0x1c], 4
ja 0x43c535
jne 0x43c539
cmp dword [ebp - 0x18], 0
jbe 0x43c539
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x4437a0
call fcn.0043c33b
test eax, eax
jge 0x43c55a
mov byte [0x44a940], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00423284
add ebp, 0x78
leave
ret
Function at 0x401963
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4019a2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4019a2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4019a2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4019a2
cmp dword [ecx + 0x74], 0xe
jbe 0x4019a2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4025e8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x40400c]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402680
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x402660
xor eax, eax
push ebp
push 0x402659
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x40269c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402660
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov ax, word [0x40400c]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x40400c], ax
mov esp, ebp
pop ebp
ret

Function at 0x402cc8
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x405034], 0
je 0x402d29
cmp word [0x405208], 0xd7b2
jne 0x402cf1
cmp dword [0x405210], 0
jbe 0x402cf1
mov eax, 0x405204
call dword [0x405220]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x40404c
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x402d50
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
pop edx
ret
cmp byte [0x404018], 0
jne 0x402d45
push 0
push 0x40406c
push 0x40404c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x403830
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403150
mov eax, dword [ebp - 8]
call fcn.00403150
xor eax, eax
push ebp
push 0x40392e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
mov eax, dword [0x4040a8]
call fcn.00402f68
mov ecx, eax
mov edx, 5
mov eax, dword [0x4040a8]
call fcn.0040316c
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00403628
mov edx, dword [ebp - 0x10]
mov eax, 0x405714
call fcn.00402e98
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
lea eax, [ebp - 0x18]
mov ecx, dword [0x405714]
mov edx, 0x403944
call fcn.00402fb4
mov eax, dword [ebp - 0x18]
call fcn.00403160
push eax
push 0x80000000
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403906
mov eax, dword [ebp - 8]
call fcn.00402f68
push eax
mov eax, dword [ebp - 8]
call fcn.00403160
push eax
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00403160
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
jne 0x403906
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403935
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00402e68
lea eax, [ebp - 8]
mov edx, 2
call fcn.00402e68
ret
Function at 0x403948
Capabilities:
Persist via default file association registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403150
mov eax, dword [ebp - 8]
call fcn.00403150
xor eax, eax
push ebp
push 0x403a50
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
mov eax, dword [0x4040a8]
call fcn.00402f68
mov ecx, eax
mov edx, 5
mov eax, dword [0x4040a8]
call fcn.0040316c
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00403628
mov edx, dword [ebp - 0x10]
mov eax, 0x405714
call fcn.00402e98
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
push dword [0x405714]
push 0x403a64
push 0x403a74
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00403028
mov eax, dword [ebp - 0x18]
call fcn.00403160
push eax
push 0x80000000
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403a28
mov eax, dword [ebp - 8]
call fcn.00402f68
push eax
mov eax, dword [ebp - 8]
call fcn.00403160
push eax
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00403160
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
jne 0x403a28
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403a57
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00402e68
lea eax, [ebp - 8]
mov edx, 2
call fcn.00402e68
ret

Function at 0x403a88
Capabilities:
Persist via default file association registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403150
mov eax, dword [ebp - 8]
call fcn.00403150
xor eax, eax
push ebp
push 0x403b20
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
push 0x403b2c
push 0x80000000
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403b05
mov eax, dword [ebp - 8]
call fcn.00402f68
push eax
mov eax, dword [ebp - 8]
call fcn.00403160
push eax
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00403160
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
jne 0x403b05
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403b27
lea eax, [ebp - 8]
mov edx, 2
call fcn.00402e68
ret
Function at 0x401317
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov al, byte [0x4c20c1]
push ebx
push esi
push edi
mov esi, ecx
push 0x8000
push esi
mov edi, edx
mov byte [ebp - 1], al
call fcn.00424223
pop ecx
push eax
call fcn.00424055
pop ecx
pop ecx
push 0xb
mov ecx, edi
mov ebx, eax
call fcn.0040e2d8
test al, al
jne 0x475977
lea ecx, [ebp - 0x18]
call fcn.0040b959
mov ecx, edi
call fcn.00409796
lea eax, [ebp - 0x18]
push eax
push dword [edi + 8]
call fcn.004029e8
push dword [ebp - 0x18]
push 0x4afc34
push esi
call fcn.0042441c
add esp, 0xc
cmp byte [ebp - 1], 0
mov dword [ebp - 8], eax
jne 0x475997
lea ecx, [ebp - 0x18]
call fcn.00408d6e
mov edi, dword [ebp - 8]
push esi
call fcn.004245e1
pop ecx
cmp ebx, 0xffffffff
je 0x4759ae
push ebx
push esi
call fcn.00424223
pop ecx
push eax
call fcn.00424055
pop ecx
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
push esi
mov ecx, edi
call fcn.0044cbe9
push eax
push 1
call fcn.0044cba0
push eax
call fcn.0042439e
add esp, 0x10
mov edi, eax
jmp 0x401397
mov ecx, edi
call fcn.00409796
mov eax, dword [edi + 8]
push dword [eax]
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringW]
jmp 0x40138c
push 0x4000
jmp 0x4013a8

Function at 0x402048
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
push edi
mov edi, ecx
push 5
pop eax
xor ebx, ebx
mov dword [edi], eax
mov dword [edi + 4], eax
mov word [edi + 8], 1
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
push ebx
mov dword [edi + 0x1c], ebx
push 0x5b
mov dword [edi + 0xc], 4
call esi
push ebx
push 0x10
mov byte [edi + 0x29], al
call esi
push ebx
push 0xa0
mov byte [edi + 0x26], al
call esi
push ebx
push 0xa1
mov byte [edi + 0x27], al
call esi
push ebx
push 0x11
mov byte [edi + 0x28], al
call esi
push ebx
push 0x12
mov byte [edi + 0x24], al
call esi
mov byte [edi + 0x25], al
pop edi
pop esi
pop ebx
ret
Function at 0x40388f
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push ebx
xor edx, edx
xor ebx, ebx
push esi
inc ebx
push edi
mov dword [ebp - 4], edx
mov dword [ebp - 0x10], edx
cmp dword [eax + 4], edx
je 0x47508b
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov byte [eax], dl
mov eax, dword [ebp + 0x10]
mov byte [ecx], dl
mov ecx, dword [ebp + 0x14]
mov dword [edi], edx
mov byte [ecx], dl
mov byte [eax], dl
mov dword [ebp - 0xc], 0x2b
mov dword [ebp - 8], 0x23
mov edi, edx
push edi
mov ecx, esi
call fcn.004039fa
movzx eax, word [eax]
push 0x2b
pop ecx
push 0x5e
cmp ax, cx
pop ecx
push 0x21
pop edx
je 0x475092
cmp ax, cx
je 0x475092
cmp ax, dx
je 0x475092
cmp ax, word [ebp - 8]
je 0x475092
push edi
inc edi
mov ecx, esi
mov dword [ebp + 0x1c], edi
call fcn.004039fa
movzx eax, word [eax]
mov esi, dword [ebp - 0x10]
mov edi, dword [ebp + 0xc]
cmp eax, 0x7b
jne 0x47510d
push 0x40
lea ecx, [ebp - 0x20]
call fcn.00406288
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp + 8]
push eax
push 0x7d
call fcn.004039a4
test al, al
je 0x4039a0
push dword [ebp - 0x20]
push dword [esi*4 + 0x4bc5d0]
call fcn.00422837
pop ecx
pop ecx
test eax, eax
je 0x40396e
inc esi
cmp esi, 0x62
jl 0x403953
cmp esi, 0x62
je 0x4750c4
cmp byte [esi + 0x4bc568], 0
jne 0x4039a0
movzx eax, byte [esi + str._f_b_b..__reepqrstuvwxyz________t___]
mov dword [edi], eax
lea ecx, [ebp - 0x20]
call fcn.00408d6e
and dword [edi], 0xff
mov al, bl
pop edi
pop esi
pop ebx
leave
ret 0x18
xor bl, bl
jmp 0x403989
lea ecx, [ebp - 0x20]
call fcn.00408d6e
xor al, al
jmp 0x403999
cmp ax, word [ebp - 0xc]
jne 0x47509d
mov eax, dword [ebp + 0x10]
jmp 0x4750bc
cmp ax, cx
jne 0x4750a7
mov eax, dword [ebp + 0x14]
jmp 0x4750bc
cmp ax, dx
jne 0x4750b1
mov eax, dword [ebp + 0x18]
jmp 0x4750bc
push 0x23
pop ecx
cmp ax, cx
jne 0x4750be
mov eax, dword [ebp + 0x1c]
mov byte [eax], bl
inc edi
jmp 0x4038db
push 0
lea ecx, [ebp - 0x20]
call fcn.0040b7be
movzx eax, word [eax]
push eax
call dword [sym.imp.USER32.dll_VkKeyScanW]
cwde
mov dword [edi], eax
cmp eax, 0xffffffff
je 0x475083
test eax, 0x200
je 0x4750ec
mov ecx, dword [ebp + 0x14]
mov byte [ecx], bl
test eax, 0x400
je 0x4750f8
mov ecx, dword [ebp + 0x18]
mov byte [ecx], bl
test eax, 0x100
je 0x403989
mov eax, dword [ebp + 0x10]
mov byte [eax], bl
jmp 0x403989
push eax
call dword [sym.imp.USER32.dll_VkKeyScanW]
cwde
mov dword [edi], eax
cmp eax, 0xffffffff
je 0x47508b
test eax, 0x200
je 0x47512c
mov ecx, dword [ebp + 0x14]
mov byte [ecx], bl
test eax, 0x400
je 0x475138
mov ecx, dword [ebp + 0x18]
mov byte [ecx], bl
test eax, 0x100
je 0x403991
mov eax, dword [ebp + 0x10]
mov byte [eax], bl
jmp 0x403991
Function at 0x403d16
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x254
push esi
mov esi, ecx
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x475853
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 8]
push ecx
push esi
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x47586b
or eax, eax
jmp 0x403d35
push eax
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov eax, dword [esp + 8]
jmp 0x403d35
Function at 0x4043ad
Capabilities:
Create process on windows
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x440
push ebx
push esi
push edi
lea eax, [ebp - 0x22c]
push eax
xor bl, bl
push 0x104
mov byte [ebp - 5], bl
xor bh, bh
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
lea eax, [ebp - 6]
push eax
push dword [ebp + 8]
call fcn.004059e8
call dword [sym.imp.KERNEL32.DLL_IsDebuggerPresent]
test eax, eax
jne 0x472f73
mov eax, dword [0x4c2124]
test eax, eax
je 0x4044cc
xor edi, edi
inc edi
mov esi, 0x4c32e8
cmp eax, edi
je 0x472f8c
lea eax, [ebp - 5]
push eax
push ecx
push 0x4c2124
push 0x4c213c
mov ecx, esi
call fcn.0040465c
test al, al
je 0x4044d5
mov al, byte [0x4c32e8]
mov bh, byte [0x4c32e9]
push 0x4c2120
mov byte [0x4c2128], al
lea eax, [ebp - 0x43c]
push eax
push 0x104
push 0x4c213c
call dword [sym.imp.KERNEL32.DLL_GetFullPathNameW]
mov bl, byte [ebp - 5]
push dword [0x4c2124]
push 0x4c213c
call fcn.004045c7
test eax, eax
jne 0x472fab
cmp bh, 1
je 0x472fca
call fcn.00403e68
call fcn.004050a8
cmp byte [0x4c2128], 0
mov ebx, 0x4c28f0
jne 0x404496
mov ecx, ebx
call fcn.004044dd
push edi
mov ecx, 0x4c2348
call fcn.0040f5d0
cmp byte [0x4c2128], 0
jne 0x4044b1
mov ecx, ebx
call fcn.0040522e
mov ecx, esi
call fcn.004040a3
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryW]
pop edi
pop esi
pop ebx
leave
ret 4
or dword [0x4c20bc], 0xffffffff
jmp 0x4044b8
mov dword [0x4c20bc], edi
jmp 0x4044b8
push 0x10
push 0x4b393c
push str.This_is_a_compiled_AutoIt_script._AV_researchers_please_email_avsupport_autoitscript.com_for_support.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4044c5
push 0xffffffffffffffff
push dword [0x4c212c]
mov ecx, esi
push edi
call fcn.00443b87
mov al, byte [0x4c20c2]
mov byte [0x4c32ea], al
jmp 0x404456
mov ecx, esi
call fcn.004040a3
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryW]
mov dword [0x4c20bc], edi
jmp 0x4044c5
call fcn.0043ca99
test al, al
jne 0x404477
cmp byte [ebp - 6], al
jne 0x404477
push 0x104
lea eax, [ebp - 0x43c]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
push 0x49eaa4
lea ecx, [ebp - 0x18]
call fcn.0040df29
lea ecx, [ebp - 0x18]
test bl, bl
je 0x47302d
mov edi, 0x4b39a8
push edi
call fcn.00405f15
push 0x4c213c
lea ecx, [ebp - 0x18]
call fcn.00405f15
push edi
lea ecx, [ebp - 0x18]
call fcn.00405f15
push 1
jmp 0x473036
push dword [ebp + 8]
call fcn.00405f15
push edi
lea eax, [ebp - 0x22c]
push eax
push dword [ebp - 0x18]
lea eax, [ebp - 0x43c]
push eax
push 0x4b39ac
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x18]
call fcn.00408d6e
jmp 0x4044b1
Function at 0x40490d
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp byte [ecx + 0x14], 0
jne 0x476673
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0042510e
add esp, 0x10
leave
ret 0x10
mov ecx, dword [ecx + 0x10]
lea eax, [ebp - 4]
mov edx, dword [ecx]
push eax
mov eax, dword [ebp + 0xc]
imul eax, dword [ebp + 0x10]
push eax
push dword [ebp + 8]
push ecx
call dword [edx + 0xc]
mov eax, dword [ebp - 4]
jmp 0x404933

Function at 0x404b10
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 8], 0
je 0x404b84
mov ebx, dword [ebp + 0xc]
xor edi, edi
test ebx, ebx
je 0x404b47
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 8]
je 0x404b57
mov ecx, dword [esi + 4]
mov eax, dword [esi + 0xc]
inc edi
mov al, byte [ecx + eax]
mov ecx, dword [ebp + 8]
mov byte [edi + ecx - 1], al
inc dword [esi + 0xc]
cmp edi, ebx
jb 0x404b27
add dword [esi + 0x10], edi
mov eax, edi
pop edi
adc dword [esi + 0x14], 0
pop esi
pop ebx
pop ebp
ret 8
push 0
lea eax, [ebp + 0xc]
push eax
push 0x10000
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x404b47
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x404b47
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0
jmp 0x404b2f
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
call fcn.00404c31
jmp 0x404b1e

Function at 0x40506c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x10]
push ebx
push 1
push 0
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
js 0x4050a4
push edi
push 0
push str.SCRIPT
push 0xa
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.DLL_FindResourceExW]
mov edi, eax
test edi, edi
jne 0x4765c9
pop edi
pop esi
pop ebx
leave
ret
push edi
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x4050a3
push edi
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov edi, eax
test edi, edi
je 0x4050a3
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_LockResource]
test eax, eax
je 0x4050a3
mov ecx, dword [ebx]
push 0
mov edx, dword [ecx]
push edi
push eax
push ecx
call dword [edx + 0x10]
mov eax, dword [ebx]
xor edx, edx
mov ecx, dword [eax]
push edx
push edx
push edx
push edx
push eax
call dword [ecx + 0x14]
mov byte [esi + 0x14], 1
jmp 0x4050a3