joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003250
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
lea eax, [esp + 8]
mov dword [esp + 3], 0x63657845
push eax
mov word [esp + 4], 0x6957
mov byte [esp + 6], 0x6e
mov byte [esp + 0xb], 0
mov dword [esp + 0x12], 0x642e3233
mov word [esp + 0x16], 0x6c6c
mov byte [esp + 0x18], 0
mov word [esp + 0xd], 0x7265
mov word [esp + 0x10], 0x6c65
mov byte [esp + 0xc], 0x4b
mov byte [esp + 0xf], 0x6e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [esp]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100032c0
push dword [esp + 0x20]
push dword [esp + 0x20]
call eax
add esp, 0x18
ret
xor eax, eax
add esp, 0x18
ret

Function at 0x100032d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
push esi
push edi
lea eax, [esp + 8]
mov dword [esp + 9], 0x70617664
push eax
mov edi, 1
mov word [esp + 0x14], 0x642e
mov word [esp + 0x17], 0x6c
mov word [esp + 0x11], 0x3369
mov byte [esp + 0xc], 0x41
mov byte [esp + 0x16], 0x6c
mov byte [esp + 0x13], 0x32
call fcn.100030c0
mov esi, eax
add esp, 4
test esi, esi
je 0x10003372
lea eax, [esp + 0x18]
mov dword [esp + 0x19], 0x65536765
push eax
push esi
mov dword [esp + 0x25], 0x6c615674
mov dword [esp + 0x2b], 0x417845
mov word [esp + 0x29], 0x6575
mov byte [esp + 0x20], 0x52
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10003369
push dword [esp + 0x40]
push dword [esp + 0x40]
push dword [esp + 0x40]
push dword [esp + 0x40]
push dword [esp + 0x40]
push dword [esp + 0x40]
call eax
mov edi, eax
push esi
call fcn.100031d0
add esp, 4
mov eax, edi
pop edi
pop esi
add esp, 0x20
ret

Function at 0x10003380
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
lea eax, [esp]
mov word [esp + 0x1c], 0x4165
push eax
mov dword [esp + 0x16], 0x6946646e
mov dword [esp + 0x1b], 0x69467473
mov word [esp + 0x14], 0x6946
mov byte [esp + 0x1a], 0x72
mov byte [esp + 0x22], 0
mov byte [esp + 0x1f], 0x6c
mov dword [esp + 0xa], 0x642e3233
mov word [esp + 0xe], 0x6c6c
mov byte [esp + 0x10], 0
mov word [esp + 5], 0x7265
mov word [esp + 8], 0x6c65
mov byte [esp + 4], 0x4b
mov byte [esp + 7], 0x6e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10003404
push dword [esp + 0x28]
push dword [esp + 0x28]
call eax
add esp, 0x20
ret
or eax, 0xffffffff
add esp, 0x20
ret

Function at 0x10003410
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
lea eax, [esp + 0xc]
mov dword [esp + 6], 0x65736f
push eax
mov dword [esp + 4], 0x646e6946
mov word [esp + 8], 0x6c43
mov dword [esp + 0x16], 0x642e3233
mov word [esp + 0x1a], 0x6c6c
mov byte [esp + 0x1c], 0
mov word [esp + 0x11], 0x7265
mov word [esp + 0x14], 0x6c65
mov byte [esp + 0x10], 0x4b
mov byte [esp + 0x13], 0x6e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [esp]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000347a
push dword [esp + 0x20]
call eax
add esp, 0x1c
ret
xor eax, eax
add esp, 0x1c
ret
Function at 0x10003480
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
lea eax, [esp]
mov dword [esp + 0x14], 0x7478654e
push eax
mov dword [esp + 0x14], 0x646e6946
mov dword [esp + 0x1d], 0x41656c69
mov byte [esp + 0x1c], 0x46
mov byte [esp + 0x21], 0
mov dword [esp + 0xa], 0x642e3233
mov word [esp + 0xe], 0x6c6c
mov byte [esp + 0x10], 0
mov word [esp + 5], 0x7265
mov word [esp + 8], 0x6c65
mov byte [esp + 4], 0x4b
mov byte [esp + 7], 0x6e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100034f9
push dword [esp + 0x28]
push dword [esp + 0x28]
call eax
add esp, 0x20
ret
xor eax, eax
add esp, 0x20
ret

Function at 0x10003500
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push esi
lea eax, [esp + 4]
mov dword [esp + 4], 0x72657355
push edi
push eax
or esi, 0xffffffff
mov word [esp + 0x15], 0x6c
mov dword [esp + 0x10], 0x642e3233
mov byte [esp + 0x14], 0x6c
call fcn.100030c0
mov edi, eax
add esp, 4
test edi, edi
je 0x10003586
lea eax, [esp + 0x14]
mov dword [esp + 0x1b], 0x416674
push eax
push edi
mov word [esp + 0x20], 0x6972
mov word [esp + 0x1d], 0x7376
mov byte [esp + 0x1f], 0x70
mov byte [esp + 0x22], 0x6e
mov byte [esp + 0x1c], 0x77
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000357d
lea ecx, [esp + 0x2c]
push ecx
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call eax
mov esi, eax
push edi
call fcn.100031d0
add esp, 4
pop edi
mov eax, esi
pop esi
add esp, 0x18
ret
Function at 0x10003740
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x1002c210
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
push edi
push 0
push 0
push 3
push 0
push 0
push 0x80000000
push dword [esp + 0x40]
mov dword [esp + 0x3c], 1
call fcn.100028b0
mov edi, eax
add esp, 0x1c
cmp edi, 0xffffffff
je 0x1000385d
push 0
push edi
mov dword [esp + 0x18], 0
call fcn.10002950
mov esi, eax
add esp, 8
test esi, esi
je 0x1000385d
push esi
call fcn.100080e3
mov ebp, eax
lea eax, [esp + 0x14]
push 0
push eax
push esi
push ebp
push edi
mov dword [esp + 0x2c], ebp
call fcn.10002a60
push edi
call fcn.10002af0
push esi
call fcn.100080e3
add esp, 0x20
xor edi, edi
mov ebx, eax
test esi, esi
je 0x10003802
sub ebp, ebx
jmp 0x100037e0
mov eax, edi
lea ecx, [edi + ebx]
cdq
idiv dword [esp + 0x34]
mov al, byte [ecx + ebp]
mov ecx, dword [esp + 0x30]
xor al, byte [edx + ecx]
lea ecx, [edi + ebx]
inc edi
mov byte [ecx], al
cmp edi, esi
jb 0x100037e0
mov ebp, dword [esp + 0x14]
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push dword [esp + 0x44]
call fcn.100028b0
mov edi, eax
add esp, 0x1c
cmp edi, 0xffffffff
je 0x10003854
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push esi
push ebx
push edi
call fcn.10002dc0
push edi
call fcn.10002af0
push ebp
call fcn.1000a231
push ebx
call fcn.1000a231
add esp, 0x20
mov bl, 1
jmp 0x1000385f
push ebx
call fcn.1000a231
add esp, 4
xor bl, bl
mov edx, dword [esp + 0x28]
or esi, 0xffffffff
add edx, 0xfffffff0
mov byte [esp + 0x20], 0
mov eax, esi
lea ecx, [edx + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x10003884
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esp + 0x2c]
add edi, 0xfffffff0
mov dword [esp + 0x20], 0xffffffff
lea eax, [edi + 0xc]
lock xadd dword [eax], esi
dec esi
test esi, esi
jg 0x100038a7
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [esp + 0x18]
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x100038d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x830
mov eax, dword [esp + 0x83c]
push esi
mov esi, dword [esp + 0x844]
push edi
mov dword [0x100386a4], eax
mov eax, dword [esp + 0x840]
push 0x3ff
mov dword [0x100386a8], eax
lea eax, [esp + 0x43d]
push 0
push eax
mov dword [0x100386a0], esi
mov byte [esp + 0x444], 0
call fcn.1000a3e0
add esp, 0xc
test esi, esi
je 0x1000394f
mov edi, dword [esi]
test edi, edi
je 0x1000394f
lea eax, [edi + 4]
push eax
lea eax, [esp + 0x43c]
push eax
call fcn.10002d40
mov eax, dword [0x100386a0]
mov ecx, dword [edi]
push edi
mov dword [eax], ecx
call fcn.10002f40
mov esi, dword [0x100386a0]
add esp, 0xc
push 0x3ff
lea eax, [esp + 0x3d]
mov byte [esp + 0x3c], 0
push 0
push eax
call fcn.1000a3e0
add esp, 0xc
test esi, esi
je 0x10003992
mov esi, dword [esi]
test esi, esi
je 0x10003992
lea eax, [esi + 4]
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.10002d40
mov eax, dword [0x100386a0]
mov ecx, dword [esi]
push esi
mov dword [eax], ecx
call fcn.10002f40
add esp, 0xc
push 0x28
lea eax, [esp + 0xc]
mov word [esp + 0xd], 0x7469
push eax
push ecx
lea eax, [esp + 0x44]
mov word [esp + 0x18], 0x7669
mov ecx, esp
mov dword [esp + 0x22], 0x67617a65
push eax
mov word [esp + 0x2b], 0x6271
mov dword [esp + 0x38], 0x6c717261
mov byte [esp + 0x18], 0x79
mov dword [esp + 0x1f], 0x79787577
mov dword [esp + 0x33], 0x71616975
mov word [esp + 0x23], 0x6a6f
mov dword [esp + 0x3d], 0x656265
mov word [esp + 0x2e], 0x7167
mov byte [esp + 0x1b], 0x77
mov byte [esp + 0x2a], 0x76
mov byte [esp + 0x3c], 0x73
mov byte [esp + 0x25], 0x69
mov word [esp + 0x31], 0x6474
mov byte [esp + 0x2d], 0x7a
mov byte [esp + 0x37], 0x6c
mov byte [esp + 0x30], 0x6f
mov byte [esp + 0x1e], 0x66
call fcn.10005290
push ecx
lea eax, [esp + 0x448]
mov ecx, esp
push eax
call fcn.10005290
call fcn.10003740
add esp, 0x10
pop edi
pop esi
add esp, 0x830
ret
Function at 0x100064c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push dword [esp + 8]
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x100064d3
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10006514
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x10006510
jmp 0x10006500
cmp esi, edx
jae 0x10006514
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x10006500
cmp esi, edx
jb 0x10006518
xor eax, eax
pop esi
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
ret

Function at 0x10006f20
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
call fcn.10008169
mov dword [0x100386dc], eax
mov ecx, 1
nop
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add eax, ecx
mov dword [ecx*4 + 0x100386dc], eax
inc ecx
cmp ecx, 0x270
jl 0x10006f30
mov dword [0x100386d8], 0x270
ret

Function at 0x100073a0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov edx, dword [esp + 4]
push esi
push edi
mov dword [ecx + 0x1384], 0xffffffff
lea edi, [ecx + 8]
mov dword [ecx + 4], edx
mov esi, 1
jmp 0x100073c0
mov eax, edx
lea edi, [edi + 4]
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi - 4], edx
cmp esi, 0x270
jl 0x100073c0
pop edi
mov dword [ecx], 0x270
mov eax, ecx
pop esi
ret 4

Function at 0x10007440
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
push esi
push edi
mov edi, ecx
dec eax
jmp 0x10007450
xor ebp, ebp
xor ebx, ebx
test eax, eax
je 0x100074d4
mov ecx, dword [edi + 4]
dec ecx
shl ebp, cl
add ebp, ebp
mov esi, dword [edi]
mov eax, dword [esi]
cmp eax, 0x270
jne 0x10007474
mov ecx, esi
call fcn.100077f0
jmp 0x10007482
cmp eax, 0x4e0
jb 0x10007482
mov ecx, esi
call fcn.10007730
mov eax, dword [esi]
mov edx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov ecx, edx
mov eax, dword [esi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
cmp eax, dword [edi + 8]
ja 0x10007460
mov ecx, dword [edi + 4]
or ebp, eax
mov eax, dword [esp + 0x14]
dec ecx
shl ebx, cl
dec eax
add ebx, ebx
or ebx, dword [edi + 8]
cmp ebx, eax
jb 0x10007458
xor edx, edx
mov eax, ebx
mov ebx, dword [esp + 0x14]
div ebx
mov ecx, eax
mov esi, edx
xor edx, edx
mov eax, ebp
div ebx
cmp eax, ecx
jb 0x100074f7
lea eax, [ebx - 1]
cmp esi, eax
jne 0x10007450
mov eax, ebp
xor edx, edx
div ebx
pop edi
pop esi
pop ebp
mov eax, edx
pop ebx
ret 4
Function at 0x10007730
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov ebx, ecx
mov ecx, 0xe3
push esi
push edi
lea edi, [ebx + 0x9c4]
mov edx, dword [edi + 4]
lea edi, [edi + 4]
xor edx, dword [edi - 4]
and edx, 0x7fffffff
xor edx, dword [edi - 4]
mov eax, edx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr edx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x630]
xor eax, edx
mov dword [edi - 0x9c4], eax
dec ecx
jne 0x10007740
lea esi, [ebx + 0xd50]
mov edi, 0x18c
mov ecx, dword [esi]
lea esi, [esi + 4]
xor ecx, dword [esi]
and ecx, 0x7fffffff
xor ecx, dword [esi - 4]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi - 0xd50]
xor eax, ecx
mov dword [esi - 0x9c4], eax
dec edi
jne 0x10007780
mov ecx, dword [ebx + 0x1380]
xor ecx, dword [ebx + 4]
and ecx, 0x7fffffff
xor ecx, dword [ebx + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx + 0x9c0], eax
mov dword [ebx], edi
pop edi
pop esi
pop ebx
ret

Function at 0x100077f0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
lea eax, [ecx + 8]
mov esi, 0x270
lea esp, [esp]
mov edx, dword [eax - 4]
lea eax, [eax + 4]
xor edx, dword [eax - 4]
and edx, 0x7fffffff
xor edx, dword [eax - 8]
mov ecx, edx
and cl, 1
movzx ecx, cl
neg ecx
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [eax + 0x62c]
xor ecx, edx
mov dword [eax + 0x9b8], ecx
dec esi
jne 0x10007800
pop esi
ret
Function at 0x41a330
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x444
push ebx
push esi
push edi
lea edi, [ebp - 0x444]
mov ecx, 0x111
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x404], eax
mov ecx, dword [ebp - 0x404]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x400
lea eax, [ebp - 0x400]
push eax
call fcn.00457f00
add esp, 0x10
mov dword [ebp - 0x404], 0
mov esi, esp
lea ecx, [ebp - 0x400]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00457ec0
pop edi
pop esi
pop ebx
add esp, 0x444
cmp ebp, esp
call fcn.00457ec0
mov esp, ebp
pop ebp
ret

Function at 0x41bc50
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x318c
call fcn.00458750
push ebx
push esi
push edi
lea edi, [ebp - 0x318c]
mov ecx, 0xc63
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
push 0x1000
push 0
lea eax, [ebp - 0x1144]
push eax
call fcn.00457a30
add esp, 0xc
mov esi, esp
lea ecx, [ebp - 0x1144]
push ecx
push 0x1000
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
cmp esi, esp
call fcn.00457ec0
push 0x1000
push 0
lea edx, [ebp - 0x2144]
push edx
call fcn.00457a30
add esp, 0xc
push str.map.map
lea eax, [ebp - 0x1144]
push eax
push str._s_s
lea ecx, [ebp - 0x2144]
push ecx
call fcn.00457b10
add esp, 0x10
mov esi, esp
lea edx, [ebp - 0x140]
push edx
lea eax, [ebp - 0x2144]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp esi, esp
call fcn.00457ec0
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0xffffffff
je 0x41bdef
push 0x1000
push 0
lea ecx, [ebp - 0x3144]
push ecx
call fcn.00457a30
add esp, 0xc
lea edx, [ebp - 0x114]
push edx
push str.map_
lea eax, [ebp - 0x1144]
push eax
push str._s_s_s
lea ecx, [ebp - 0x3144]
push ecx
call fcn.00457b10
add esp, 0x14
push 0x4e2584
lea edx, [ebp - 0x3144]
push edx
call fcn.00458730
add esp, 8
mov dword [ebp - 0x3148], eax
cmp dword [ebp - 0x3148], 0
je 0x41bdef
push 2
push 0
mov eax, dword [ebp - 0x3148]
push eax
call fcn.00458510
add esp, 0xc
mov ecx, dword [ebp - 0x3148]
push ecx
call fcn.00458280
add esp, 4
mov dword [ebp - 0x314c], eax
mov edx, dword [ebp - 0x314c]
push edx
call fcn.00421f40
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp + 8]
cmp dword [edx], 0
je 0x41bdef
push 0
push 0
mov eax, dword [ebp - 0x3148]
push eax
call fcn.00458510
add esp, 0xc
mov ecx, dword [ebp - 0x3148]
push ecx
push 1
mov edx, dword [ebp - 0x314c]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call fcn.004580b0
add esp, 0x10
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x314c]
mov dword [edx], eax
jmp 0x41bdf8
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 0xffffffff
pop edi
pop esi
pop ebx
add esp, 0x318c
cmp ebp, esp
call fcn.00457ec0
mov esp, ebp
pop ebp
ret
Function at 0x422040
Capabilities:
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x358
push ebx
push esi
push edi
lea edi, [ebp - 0x358]
mov ecx, 0xd6
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov dword [ebp - 4], 0
jmp 0x422070
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xc8
jge 0x42208c
mov ecx, dword [ebp - 4]
mov edx, dword [ecx*4 + 0x6effb0]
cmp edx, dword [ebp + 8]
jne 0x42208a
jmp 0x42208c
jmp 0x422067
cmp dword [ebp - 4], 0xc8
jl 0x422222
mov dword [ebp - 4], 0
jmp 0x4220ab
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xc8
jge 0x4220c5
mov ecx, dword [ebp - 4]
cmp dword [ecx*4 + 0x6effb0], 0
jne 0x4220c3
jmp 0x4220c5
jmp 0x4220a2
mov edx, dword [ebp - 4]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
mov dword [eax*4 + 0x6effb0], ecx
mov esi, esp
lea edx, [ebp - 0x10c]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
cmp esi, esp
call fcn.00457ec0
mov esi, esp
lea eax, [ebp - 0x210]
push eax
push 0
push 0x4e27cc
lea ecx, [ebp - 0x10c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
cmp esi, esp
call fcn.00457ec0
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x314]
push eax
call fcn.00457c10
add esp, 8
lea ecx, [ebp - 0x314]
push ecx
call fcn.00457a90
add esp, 4
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
xor eax, eax
mov al, byte [edx + 8]
test eax, eax
jne 0x42216e
mov ecx, dword [ebp - 4]
mov byte [ebp + ecx - 0x317], 0x6d
mov edx, dword [ebp - 4]
mov byte [ebp + edx - 0x316], 0x69
mov eax, dword [ebp - 4]
mov byte [ebp + eax - 0x315], 0x64
jmp 0x42218f
mov ecx, dword [ebp - 4]
mov byte [ebp + ecx - 0x317], 0x77
mov edx, dword [ebp - 4]
mov byte [ebp + edx - 0x316], 0x61
mov eax, dword [ebp - 4]
mov byte [ebp + eax - 0x315], 0x76
mov esi, esp
lea ecx, [ebp - 0x314]
push ecx
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
cmp esi, esp
call fcn.00457ec0
lea eax, [ebp - 0x314]
push eax
mov ecx, dword [ebp + 8]
add ecx, 9
push ecx
call fcn.00457c10
add esp, 8
push 0x4e27c8
mov edx, dword [ebp + 8]
add edx, 9
push edx
call fcn.00458730
add esp, 8
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x318], 0
je 0x422214
mov eax, dword [ebp - 0x318]
push eax
push 1
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call fcn.00458b60
add esp, 0x10
mov edx, dword [ebp - 0x318]
push edx
call fcn.00458a80
add esp, 4
jmp 0x422222
mov eax, dword [ebp - 8]
mov dword [eax*4 + 0x6effb0], 0
pop edi
pop esi
pop ebx
add esp, 0x358
cmp ebp, esp
call fcn.00457ec0
mov esp, ebp
pop ebp
ret
Function at 0x4222d0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
lea edi, [ebp - 0x44]
mov ecx, 0x11
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov esi, esp
push 0
push 0
push 0
push str.close_nn
call dword [sym.imp.WINMM.dll_mciSendStringA]
cmp esi, esp
call fcn.00457ec0
mov dword [ebp - 4], 0
jmp 0x422314
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xc8
jge 0x422349
mov ecx, dword [ebp - 4]
cmp dword [ecx*4 + 0x6effb0], 0
je 0x422347
mov edx, dword [ebp - 4]
mov eax, dword [edx*4 + 0x6effb0]
add eax, 9
mov esi, esp
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp esi, esp
call fcn.00457ec0
jmp 0x42230b
pop edi
pop esi
pop ebx
add esp, 0x44
cmp ebp, esp
call fcn.00457ec0
mov esp, ebp
pop ebp
ret
Function at 0x42aeb0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48c
push ebx
push esi
push edi
lea edi, [ebp - 0x48c]
mov ecx, 0x123
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov byte [ebp - 0x40], 0
mov ecx, 0xf
xor eax, eax
lea edi, [ebp - 0x3f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x5c
mov eax, dword [ebp + 8]
push eax
call fcn.004589d0
add esp, 8
mov dword [ebp - 0x44], eax
push 0x2e
mov ecx, dword [ebp + 8]
push ecx
call fcn.004589d0
add esp, 8
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x4c], 0
mov byte [ebp - 0x44c], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x44b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edx, dword [ebp - 0x48]
sub edx, dword [ebp - 0x44]
sub edx, 1
push edx
mov eax, dword [ebp - 0x44]
add eax, 1
push eax
lea ecx, [ebp - 0x40]
push ecx
call fcn.0045b160
add esp, 0xc
push 0x5f
lea edx, [ebp - 0x40]
push edx
call fcn.004589d0
add esp, 8
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
je 0x42af86
mov eax, dword [ebp - 0x4c]
add eax, 1
push eax
call fcn.00457a90
add esp, 4
cmp eax, 3
jne 0x42af86
mov ecx, dword [ebp - 0x4c]
add ecx, 1
push ecx
call fcn.0045b010
add esp, 4
cmp eax, 0x3e8
jge 0x42af86
jmp 0x42b007
lea edx, [ebp - 0x40]
push edx
push str.C:_soyououtexe_s
lea eax, [ebp - 0x44c]
push eax
call fcn.00457b10
add esp, 0xc
push 0
lea ecx, [ebp - 0x44c]
push ecx
call fcn.0046cf40
add esp, 8
test eax, eax
jge 0x42afc2
lea edx, [ebp - 0x44c]
push edx
call fcn.0046cef0
add esp, 4
mov eax, dword [0x4edd54]
push eax
mov ecx, dword [0x4edd50]
push ecx
lea edx, [ebp - 0x40]
push edx
lea eax, [ebp - 0x40]
push eax
push str.C:_soyououtexe_s_s__d__d.exe
lea ecx, [ebp - 0x44c]
push ecx
call fcn.00457b10
add esp, 0x18
mov esi, esp
push 0
lea edx, [ebp - 0x44c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
cmp esi, esp
call fcn.00457ec0
pop edi
pop esi
pop ebx
add esp, 0x48c
cmp ebp, esp
call fcn.00457ec0
mov esp, ebp
pop ebp
ret

Function at 0x42b240
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
lea edi, [ebp - 0x4c]
mov ecx, 0x13
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov byte [ebp - 0xc], 0x6d
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x6c
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x72
mov byte [ebp - 7], 0x76
mov byte [ebp - 6], 0x32
mov byte [ebp - 5], 0x2e
mov byte [ebp - 4], 0x64
mov byte [ebp - 3], 0x6c
mov byte [ebp - 2], 0x6c
mov byte [ebp - 1], 0
push 0xc
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004576f0
add esp, 0xc
pop edi
pop esi
pop ebx
add esp, 0x4c
cmp ebp, esp
call fcn.00457ec0
mov esp, ebp
pop ebp
ret
Function at 0x42d340
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
lea edi, [ebp - 0x4c]
mov ecx, 0x13
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov byte [ebp - 0xc], 0x6d
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x6c
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x72
mov byte [ebp - 7], 0x76
mov byte [ebp - 6], 0x32
mov byte [ebp - 5], 0x2e
mov byte [ebp - 4], 0x64
mov byte [ebp - 3], 0x6c
mov byte [ebp - 2], 0x6c
mov byte [ebp - 1], 0
push 0xc
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004576f0
add esp, 0xc
pop edi
pop esi
pop ebx
add esp, 0x4c
cmp ebp, esp
call fcn.00457ec0
mov esp, ebp
pop ebp
ret