joyce8/EMBER2024-capa huggingface dataset:
Function at 0xb21930
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [str.lmjU]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x60], 0
xor eax, eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x60]
push ecx
push 0
lea edx, [ebp - 0x20]
push edx
mov ecx, dword [ebp + 8]
call fcn.00b18bb0
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.00aed370
add esp, 8
mov ecx, eax
call fcn.00984c40
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x65], al
lea ecx, [ebp - 0x3c]
call fcn.00984e90
lea ecx, [ebp - 0x20]
call fcn.00a40ca0
movzx ecx, byte [ebp - 0x65]
test ecx, ecx
je 0xb219b6
xor al, al
jmp 0xb219de
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 2
je 0xb219d4
cmp dword [ebp - 0x64], 3
je 0xb219d4
mov dword [ebp - 0x70], 0
jmp 0xb219db
mov dword [ebp - 0x70], 1
mov al, byte [ebp - 0x70]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00ac8a41
mov esp, ebp
pop ebp
ret 4

Function at 0xb219f0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [str.lmjU]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x7c], ecx
push 1
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00b18bb0
push eax
lea ecx, [ebp - 0x3c]
push ecx
call fcn.00aed370
add esp, 8
mov ecx, eax
call fcn.00984c40
push eax
lea edx, [ebp - 0x58]
push edx
mov ecx, dword [ebp + 8]
call fcn.00b18bb0
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.00aed370
add esp, 8
mov ecx, eax
call fcn.00984c40
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x75], al
lea ecx, [ebp - 0x74]
call fcn.00984e90
lea ecx, [ebp - 0x58]
call fcn.00a40ca0
lea ecx, [ebp - 0x3c]
call fcn.00984e90
lea ecx, [ebp - 0x20]
call fcn.00a40ca0
mov al, byte [ebp - 0x75]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00ac8a41
mov esp, ebp
pop ebp
ret 8
Function at 0xb21a90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
mov eax, dword [str.lmjU]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x258], ecx
lea eax, [ebp - 0x250]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0xb21ac6
xor al, al
jmp 0xb21b56
call fcn.00b22470
movzx ecx, al
test ecx, ecx
jne 0xb21af3
push 0x105
lea edx, [ebp - 0x250]
push edx
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
jne 0xb21af3
xor al, al
jmp 0xb21b56
lea ecx, [ebp - 0x250]
push ecx
call fcn.00b22450
add esp, 4
push eax
lea edx, [ebp - 0x250]
push edx
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp + 8]
call fcn.00b18bb0
push eax
lea ecx, [ebp - 0x3c]
push ecx
call fcn.00aed370
add esp, 8
mov ecx, eax
call fcn.00984c40
push eax
call fcn.00b224b0
add esp, 0xc
neg eax
sbb eax, eax
add eax, 1
mov byte [ebp - 0x251], al
lea ecx, [ebp - 0x3c]
call fcn.00984e90
lea ecx, [ebp - 0x20]
call fcn.00a40ca0
mov al, byte [ebp - 0x251]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00ac8a41
mov esp, ebp
pop ebp
ret 4
Function at 0xb21d80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x274
mov eax, dword [str.lmjU]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x274], ecx
movzx eax, byte [ebp + 0xc]
neg eax
sbb eax, eax
and eax, 0xfffffff9
add eax, 0x23
mov dword [ebp - 0x5c], eax
push 1
mov ecx, dword [ebp - 0x5c]
push ecx
lea edx, [ebp - 0x270]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0xb21dca
xor al, al
jmp 0xb21f7a
call fcn.00b22470
movzx eax, al
test eax, eax
jne 0xb21dfa
push 0x105
lea ecx, [ebp - 0x270]
push ecx
lea edx, [ebp - 0x270]
push edx
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
jne 0xb21dfa
xor al, al
jmp 0xb21f7a
push 0xffffffffffffffff
push 0xb4ea6c
push 0x105
lea eax, [ebp - 0x270]
push eax
call fcn.00b22570
add esp, 0x10
mov dword [ebp - 0x60], eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x274]
add ecx, 4
push ecx
lea edx, [ebp - 0x20]
push edx
call fcn.00aed370
add esp, 8
mov ecx, eax
call fcn.00984c40
push eax
mov eax, 0x105
sub eax, dword [ebp - 0x60]
push eax
mov ecx, dword [ebp - 0x60]
lea edx, [ebp + ecx*2 - 0x270]
push edx
call fcn.00b22500
add esp, 0x10
add eax, dword [ebp - 0x60]
mov dword [ebp - 0x60], eax
lea ecx, [ebp - 0x20]
call fcn.00984e90
cmp dword [ebp - 0x60], 0
jbe 0xb21ea1
mov eax, dword [ebp - 0x60]
movzx ecx, word [ebp + eax*2 - 0x272]
cmp ecx, 0x5c
je 0xb21ea1
push 0xffffffffffffffff
push 0xb4eb0c
mov edx, 0x105
sub edx, dword [ebp - 0x60]
push edx
mov eax, dword [ebp - 0x60]
lea ecx, [ebp + eax*2 - 0x270]
push ecx
call fcn.00b22500
add esp, 0x10
add eax, dword [ebp - 0x60]
mov dword [ebp - 0x60], eax
push 0xffffffffffffffff
mov edx, dword [ebp - 0x274]
add edx, 0x20
push edx
lea eax, [ebp - 0x3c]
push eax
call fcn.00aed370
add esp, 8
mov ecx, eax
call fcn.00984c40
push eax
mov ecx, 0x105
sub ecx, dword [ebp - 0x60]
push ecx
mov edx, dword [ebp - 0x60]
lea eax, [ebp + edx*2 - 0x270]
push eax
call fcn.00b22500
add esp, 0x10
add eax, dword [ebp - 0x60]
mov dword [ebp - 0x60], eax
lea ecx, [ebp - 0x3c]
call fcn.00984e90
cmp dword [ebp - 0x60], 0
jbe 0xb21f2a
mov ecx, dword [ebp - 0x60]
movzx edx, word [ebp + ecx*2 - 0x272]
cmp edx, 0x5c
je 0xb21f2a
push 0xffffffffffffffff
push 0xb4ebbc
mov eax, 0x105
sub eax, dword [ebp - 0x60]
push eax
mov ecx, dword [ebp - 0x60]
lea edx, [ebp + ecx*2 - 0x270]
push edx
call fcn.00b22500
add esp, 0x10
add eax, dword [ebp - 0x60]
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0x104
jb 0xb21f37
xor al, al
jmp 0xb21f7a
mov ecx, dword [ebp + 8]
call fcn.00b18b20
lea eax, [ebp - 0x270]
push eax
lea ecx, [ebp - 0x58]
push ecx
call fcn.00b1a380
add esp, 8
push eax
mov ecx, dword [ebp + 8]
call fcn.00b18f80
lea ecx, [ebp - 0x58]
call fcn.00a40ca0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x274]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x274]
mov eax, dword [edx + 0x20]
call eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00ac8a41
mov esp, ebp
pop ebp
ret 8
Function at 0xb22000
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [str.lmjU]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x23c], ecx
cmp dword [ebp + 0xc], 0
jne 0xb22026
xor al, al
jmp 0xb2223c
lea ecx, [ebp - 0x218]
call fcn.009850e0
mov dword [ebp - 0x1fc], 0
push 4
lea eax, [ebp - 0x224]
push eax
mov ecx, dword [ebp + 8]
call fcn.00b19310
movzx ecx, al
test ecx, ecx
je 0xb220a1
lea edx, [ebp - 0x224]
push edx
lea ecx, [ebp - 0x20]
call fcn.00986550
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x3c]
push ecx
call fcn.00aed370
add esp, 8
push eax
lea ecx, [ebp - 0x218]
call fcn.0098fd10
lea ecx, [ebp - 0x3c]
call fcn.00984e90
lea ecx, [ebp - 0x20]
call fcn.00a40ca0
lea ecx, [ebp - 0x218]
call fcn.00984c40
mov dword [ebp - 0x1fc], eax
jmp 0xb22108
push 0xb4ec5c
push 2
push 0
lea edx, [ebp - 0x74]
push edx
lea eax, [ebp - 0x58]
push eax
mov ecx, dword [ebp + 8]
call fcn.00b18e60
mov ecx, eax
call fcn.0098b350
push eax
call fcn.0098e3d0
add esp, 8
mov byte [ebp - 0x231], al
lea ecx, [ebp - 0x74]
call fcn.00a40ca0
lea ecx, [ebp - 0x58]
call fcn.00a40ca0
movzx ecx, byte [ebp - 0x231]
test ecx, ecx
je 0xb22108
mov byte [ebp - 0x232], 0
lea ecx, [ebp - 0x218]
call fcn.00984e90
mov al, byte [ebp - 0x232]
jmp 0xb2223c
mov edx, dword [ebp - 0x1fc]
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [ebp - 0x228], eax
mov eax, dword [ebp - 0x228]
and eax, 4
jne 0xb22131
mov ecx, dword [ebp - 0x228]
and ecx, 0
je 0xb2219b
xor edx, edx
je 0xb2217e
lea eax, [ebp - 0x224]
push eax
push str._remove_or_unknown_drive
push 0
push 0
push 0
push 1
push 0
push 0
lea ecx, [ebp - 0x138]
call fcn.00af4170
mov ecx, eax
call fcn.00aef550
push eax
call fcn.009816a0
add esp, 8
push eax
call fcn.009816a0
add esp, 8
lea ecx, [ebp - 0x138]
call fcn.00af4580
jmp 0xb22131
mov byte [ebp - 0x233], 0
lea ecx, [ebp - 0x218]
call fcn.00984e90
mov al, byte [ebp - 0x233]
jmp 0xb2223c
lea ecx, [ebp - 0x220]
push ecx
lea edx, [ebp - 0x230]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x1fc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0xb221da
mov byte [ebp - 0x234], 1
lea ecx, [ebp - 0x218]
call fcn.00984e90
mov al, byte [ebp - 0x234]
jmp 0xb2223c
xor edx, edx
je 0xb22217
push str._GetDiskFreeSpaceEx_returns_error
push 0
push 0
push 0
push 1
push 0
push 0
lea ecx, [ebp - 0x1f8]
call fcn.00af4170
mov ecx, eax
call fcn.00aef550
push eax
call fcn.009816a0
add esp, 8
lea ecx, [ebp - 0x1f8]
call fcn.00af4580
jmp 0xb221da
mov byte [ebp - 0x235], 0
lea ecx, [ebp - 0x218]
call fcn.00984e90
mov al, byte [ebp - 0x235]
jmp 0xb2223c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00ac8a41
mov esp, ebp
pop ebp
ret 8
Function at 0xb22250
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
mov eax, dword [str.lmjU]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x154], ecx
lea ecx, [ebp - 0x140]
call fcn.00b189b0
mov dword [ebp - 0x148], 0
push 0
lea ecx, [ebp - 0x144]
call fcn.00b0b8e0
lea ecx, [ebp - 0x144]
call fcn.00aeda50
push eax
mov eax, dword [ebp - 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0
jne 0xb22328
xor ecx, ecx
je 0xb222fb
push str.::GetCurrentDirectory___failed
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 2
push 4
push 0x1c0
push str.P:p_agentshpam2.eem_recipes201152726_base_branchesinputtools_win_release_branchgoogleclient_third_partylibjingle_files_talk_basewin32filesystem.cc
lea ecx, [ebp - 0xc8]
call fcn.00af4170
mov ecx, eax
call fcn.00aef550
push eax
call fcn.009816a0
add esp, 8
lea ecx, [ebp - 0xc8]
call fcn.00af4580
jmp 0xb222b3
lea edx, [ebp - 0x140]
push edx
mov ecx, dword [ebp + 8]
call fcn.00b22400
lea ecx, [ebp - 0x144]
call fcn.00b224d0
lea ecx, [ebp - 0x140]
call fcn.00b0f370
mov eax, dword [ebp + 8]
jmp 0xb223e2
mov eax, dword [ebp - 0x14c]
cmp eax, dword [ebp - 0x148]
jg 0xb22338
jmp 0xb22388
xor ecx, ecx
mov eax, dword [ebp - 0x14c]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00ac7a7c
add esp, 4
mov dword [ebp - 0x150], eax
mov eax, dword [ebp - 0x150]
push eax
lea ecx, [ebp - 0x144]
call fcn.00aeda10
mov ecx, dword [ebp - 0x14c]
mov dword [ebp - 0x148], ecx
mov edx, 1
test edx, edx
jne 0xb2228b
lea ecx, [ebp - 0x144]
call fcn.00aeda50
push eax
lea eax, [ebp - 0xe4]
push eax
call fcn.00b1a380
add esp, 8
push eax
lea ecx, [ebp - 0x140]
call fcn.00b18f80
lea ecx, [ebp - 0xe4]
call fcn.00a40ca0
lea ecx, [ebp - 0x140]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00b22400
lea ecx, [ebp - 0x144]
call fcn.00b224d0
lea ecx, [ebp - 0x140]
call fcn.00b0f370
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00ac8a41
mov esp, ebp
pop ebp
ret 4

Function at 0xb23a45
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0xb23a6c
call fcn.00acaeef
mov dword [eax], esi
call fcn.00acaedc
push 0x16
pop esi
mov dword [eax], esi
call fcn.00ac8cab
mov eax, esi
jmp 0xb23ac1
test dword [ebp + 0xc], 0xfffffff9
jne 0xb23a52
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0xb23a99
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00acaf02
pop ecx
call fcn.00acaedc
mov eax, dword [eax]
jmp 0xb23ac1
test al, 0x10
jne 0xb23abf
test al, 1
je 0xb23abf
test byte [ebp + 0xc], 2
je 0xb23abf
call fcn.00acaeef
mov dword [eax], 5
call fcn.00acaedc
mov dword [eax], 0xd
jmp 0xb23a90
xor eax, eax
pop esi
pop ebp
ret
Function at 0x4046d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x513b28
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x555760]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xorps xmm0, xmm0
lea ecx, [ebp - 0x40]
movlpd qword [ebp - 0x48], xmm0
call fcn.00423210
push 0x52df90
mov edx, eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00406080
add esp, 4
cmp dword [ebp - 0x2c], 8
jb 0x404735
push dword [ebp - 0x40]
call fcn.004dbf30
add esp, 4
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
lea edx, [ebp - 0x48]
cmovae ecx, dword [ebp - 0x28]
call fcn.00421190
cmp dword [ebp - 0x48], 0x92200
jne 0x404757
cmp dword [ebp - 0x44], 0
je 0x40478c
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x4c], 0
push eax
push 0
push esi
push 0x404560
push 0
push 0
call fcn.004dce62
mov esi, eax
add esp, 0x18
test esi, esi
je 0x40478c
push 0xffffffffffffffff
push esi
call dword [0x51f370]
push esi
call dword [0x51f374]
cmp dword [ebp - 0x14], 8
jb 0x40479d
push dword [ebp - 0x28]
call fcn.004dbf30
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004dbf35
mov esp, ebp
pop ebp
ret
Function at 0x408a40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
mov edi, ecx
mov esi, dword [edi]
movzx eax, byte [esi]
cmp byte [eax + 0x52e598], 0
je 0x408a6e
jmp 0x408a60
movzx eax, byte [esi + 1]
inc esi
cmp byte [eax + 0x52e598], 0
jne 0x408a60
mov dword [edi], esi
mov ecx, esi
movzx eax, byte [esi]
mov dword [ebp - 4], ecx
cmp byte [eax + 0x52e798], 0
je 0x408bf1
mov dl, byte [esi]
cmp dl, 0x26
jne case.0x408aa7.36
movsx eax, byte [esi + 1]
add eax, 0xffffffdd
cmp eax, 0x4e
ja case.0x408aa7.36
movzx eax, byte [eax + 0x408c3c]
jmp dword [eax*4 + 0x408c24]
mov al, byte [esi + 2]
cmp al, 0x6d
jne 0x408acd
cmp byte [esi + 3], 0x70
jne 0x408acd
cmp byte [esi + 4], 0x3b
jne 0x408acd
mov byte [ecx], 0x26
inc ecx
add esi, 5
jmp 0x408bde
cmp al, 0x70
jne case.0x408aa7.36
cmp byte [esi + 3], 0x6f
jne case.0x408aa7.36
cmp byte [esi + 4], 0x73
jne case.0x408aa7.36
cmp byte [esi + 5], 0x3b
jne case.0x408aa7.36
mov byte [ecx], 0x27
inc ecx
add esi, 6
jmp 0x408bde
cmp byte [esi + 2], 0x75
jne case.0x408aa7.36
cmp byte [esi + 3], 0x6f
jne case.0x408aa7.36
cmp byte [esi + 4], 0x74
jne case.0x408aa7.36
cmp byte [esi + 5], 0x3b
jne case.0x408aa7.36
mov byte [ecx], 0x22
inc ecx
add esi, 6
jmp 0x408bde
cmp byte [esi + 2], 0x74
jne case.0x408aa7.36
cmp byte [esi + 3], 0x3b
jne case.0x408aa7.36
mov byte [ecx], 0x3e
inc ecx
add esi, 4
jmp 0x408bde
cmp byte [esi + 2], 0x74
jne case.0x408aa7.36
cmp byte [esi + 3], 0x3b
jne case.0x408aa7.36
mov byte [ecx], 0x3c
inc ecx
add esi, 4
jmp 0x408bde
xor edx, edx
cmp byte [esi + 2], 0x78
jne 0x408b9d
movzx eax, byte [esi + 3]
add esi, 3
mov al, byte [eax + 0x52eca0]
cmp al, 0xff
je 0x408bc7
inc esi
movzx eax, al
shl edx, 4
add edx, eax
movzx eax, byte [esi]
mov al, byte [eax + 0x52eca0]
cmp al, 0xff
jne 0x408b85
jmp 0x408bc7
movzx eax, byte [esi + 2]
add esi, 2
mov al, byte [eax + 0x52eca0]
cmp al, 0xff
je 0x408bc7
mov edi, edi
movzx eax, al
lea ecx, [edx + edx*4]
inc esi
lea edx, [eax + ecx*2]
movzx eax, byte [esi]
mov al, byte [eax + 0x52eca0]
cmp al, 0xff
jne 0x408bb0
lea ecx, [ebp - 4]
call fcn.004086b0
cmp byte [esi], 0x3b
jne 0x408bfb
mov ecx, dword [ebp - 4]
inc esi
jmp 0x408be1
mov byte [ecx], dl
inc ecx
inc esi
mov dword [ebp - 4], ecx
movzx eax, byte [esi]
cmp byte [eax + 0x52e798], 0
jne 0x408a85
mov dword [edi], esi
mov eax, ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x18]
call fcn.004dccf7
push 0x550f80
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x52f1d4
push eax
mov dword [ebp - 0xc], 0x52e568
mov dword [ebp - 8], esi
call fcn.004e2c2b
mov edi, edi
insb byte es:[edi], dx
mov eax, dword [eax]
scasb al, byte es:[edi]
mov al, byte [eax]
xor ecx, dword [ebx - 0x74acffc0]
inc eax
add bh, bh
mov al, byte [eax]
fimul dword [ebx + 0x5000040]
add eax, 84215045
add eax, 84215045
add eax, 84215045
add eax, 84215045
add eax, 84215045
add eax, 84215045
add eax, 84215045
add eax, 84215045
add eax, 84215045
add eax, 84215045
add eax, 84215045
add eax, 84215045
add dword [84215045], eax
add al, byte [50660613]
add eax, 67437829
int3
Function at 0x41e770
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5152b1
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x555760]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
xor eax, eax
test esi, esi
je 0x41e984
push 0x208
push eax
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push eax
call fcn.004e24c0
push 0x104
lea eax, [ebp - 0x21c]
push esi
push eax
call fcn.004dfe0a
add esp, 0x18
test eax, eax
jne 0x41e7e5
xor eax, eax
jmp 0x41e984
lea eax, [ebp - 0x21c]
push eax
call dword [0x51f4ac]
test eax, eax
je 0x41e7de
lea eax, [ebp - 0x21c]
push eax
call dword [0x51f3f0]
mov ebx, eax
mov dword [ebp - 0x22c], ebx
test ebx, ebx
jne 0x41e982
test edi, edi
je 0x41e982
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x228]
call fcn.00424d20
push ecx
lea eax, [ebp - 0x224]
mov dword [ebp - 4], ebx
push eax
lea ecx, [ebp - 0x228]
call fcn.00424ea0
mov ecx, eax
call fcn.00424f80
lea ecx, [ebp - 0x224]
mov bl, al
call fcn.0041d1f0
test bl, bl
je 0x41e964
lea ecx, [ebp - 0x220]
call fcn.0041d1c0
push ecx
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 1
call fcn.00424e60
push eax
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x228]
call fcn.00424f10
mov byte [ebp - 4], 2
mov ecx, 1
mov esi, dword [ebp - 0x220]
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, 0x104
or ecx, eax
jge 0x41e8c1
push 0x104
lea ecx, [ebp - 0x220]
call fcn.0042c1e0
mov esi, dword [ebp - 0x220]
push esi
push 0
push 0x52f1e0
push dword [ebp - 0x224]
call dword [0x51f3ec]
push ecx
lea ecx, [ebp - 0x220]
mov edi, eax
call fcn.0042c0a0
test edi, edi
jne 0x41e90a
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x220]
push 0x531b5c
push eax
call fcn.00427ed0
mov esi, dword [ebp - 0x220]
add esp, 0xc
jmp 0x41e916
mov edx, 1
mov ecx, esi
call fcn.0041e770
lea eax, [ebp - 0x21c]
push esi
push eax
call fcn.004dffa0
add esp, 8
push 4
push 0
test eax, eax
jne 0x41e93d
push esi
call dword [0x51f3f4]
mov ebx, dword [ebp - 0x22c]
jmp 0x41e94c
lea eax, [ebp - 0x21c]
push eax
call dword [0x51f3f4]
mov ebx, eax
lea ecx, [ebp - 0x224]
call fcn.0041d1f0
lea ecx, [ebp - 0x220]
call fcn.0041d1f0
jmp 0x41e977
push 4
push 0
lea eax, [ebp - 0x21c]
push eax
call dword [0x51f3f4]
mov ebx, eax
lea ecx, [ebp - 0x228]
call fcn.0041d1f0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004dbf35
mov esp, ebp
pop ebp
ret
Function at 0x4253f0
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x515be7
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x555760]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], 0
mov dword [edi], 0x5321f4
mov dword [edi + 0x70], str.RunAppAsAdmin_lpszExePath_s_lpszCmd_s_nVer_d_bFileExsit_d
mov dword [ebp - 4], 0
lea esi, [edi + 0x10]
mov eax, dword [edi]
mov dword [ebp - 0x10], 1
mov eax, dword [eax + 4]
mov dword [edi + eax], 0x5321f0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
push ecx
push esi
lea eax, [ecx - 0x18]
mov dword [ecx + edi - 4], eax
mov eax, dword [edi]
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov ecx, dword [eax + 4]
add ecx, edi
call fcn.0042ac90
mov dword [ebp - 4], 2
mov eax, dword [edi]
mov eax, dword [eax + 4]
mov dword [edi + eax], 0x5321e8
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ecx + edi - 4], eax
mov ecx, esi
call fcn.00427550
lea eax, [esi + 4]
mov dword [esi], 0x532138
mov dword [esi + 0xc], eax
lea ecx, [esi + 8]
lea eax, [esi + 0x14]
mov byte [esi + 0x4c], 0
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x18]
mov dword [esi + 0x20], eax
lea eax, [esi + 0x24]
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x28]
mov dword [esi + 0x30], eax
mov byte [esi + 0x45], 0
mov dword [esi + 0x10], ecx
mov dword [ecx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [0x55b0f8]
mov dword [esi + 0x48], eax
mov eax, edi
mov dword [esi + 0x50], 0
mov dword [esi + 0x40], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x425e70
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x515c97
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x555760]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], 0
mov dword [edi], str.RunApp_bRetCode_d
mov dword [edi + 0x60], str.RunAppAsAdmin_lpszExePath_s_lpszCmd_s_nVer_d_bFileExsit_d
mov dword [ebp - 4], 0
lea esi, [edi + 4]
mov eax, dword [edi]
mov dword [ebp - 0x10], 1
mov eax, dword [eax + 4]
mov dword [edi + eax], 0x5320cc
mov eax, dword [edi]
mov ecx, dword [eax + 4]
push ecx
push esi
lea eax, [ecx - 8]
mov dword [ecx + edi - 4], eax
mov eax, dword [edi]
mov ecx, dword [eax + 4]
add ecx, edi
call fcn.0042ac90
mov dword [ebp - 4], 2
mov eax, dword [edi]
mov eax, dword [eax + 4]
mov dword [edi + eax], 0x5320bc
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x60]
mov dword [ecx + edi - 4], eax
mov ecx, esi
call fcn.00427550
lea eax, [esi + 4]
mov dword [esi], 0x532138
mov dword [esi + 0xc], eax
lea ecx, [esi + 8]
lea eax, [esi + 0x14]
mov byte [esi + 0x4c], 0
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x18]
mov dword [esi + 0x20], eax
lea eax, [esi + 0x24]
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x28]
mov dword [esi + 0x30], eax
mov byte [esi + 0x45], 0
mov dword [esi + 0x10], ecx
mov dword [ecx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [0x55b0f8]
mov dword [esi + 0x48], eax
mov eax, edi
mov dword [esi + 0x50], 0
mov dword [esi + 0x40], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4