joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42da50
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47e058
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4a9074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [sym.imp.ole32.dll_CoInitializeEx]
push 0
push 0
call esi
test eax, eax
je 0x42daa2
cmp eax, 1
je 0x42daa2
push 2
push 0
call esi
test eax, eax
je 0x42daa2
cmp eax, 1
jne 0x42db9d
lea ebx, [edi + 0x20]
mov byte [edi + 0x24], 1
push ebx
push 0x484320
push 1
push 0
push 0x484310
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x42db9d
push 0x49936c
lea ecx, [ebp - 0x14]
call fcn.00406c0c
mov dword [ebp - 4], 0
mov eax, dword [eax]
test eax, eax
je 0x42dae4
mov edx, dword [eax]
jmp 0x42dae6
xor edx, edx
mov ecx, dword [ebx]
add edi, 0x1c
push edi
push 0
push 0
mov eax, dword [ecx]
push 0
push 0
push 0
push 0
push edx
push ecx
call dword [eax + 0xc]
test eax, eax
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x14]
setns cl
mov byte [ebp - 0xd], cl
test esi, esi
je 0x42db63
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x42db5c
test esi, esi
je 0x42db5c
mov eax, dword [esi]
test eax, eax
je 0x42db37
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x42db4e
push eax
call fcn.00448c6c
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.00437c09
mov cl, byte [ebp - 0xd]
add esp, 8
mov dword [ebp - 0x14], 0
test cl, cl
je 0x42db8f
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [edi]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
mov eax, dword [edi]
jns 0x42db9f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [edi], 0
mov eax, dword [ebx]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov dword [ebx], 0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43237a
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x4323df
xor eax, eax
cmp ax, word [esi]
je 0x4323df
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x43239b
push 2
jmp 0x4323e1
push 0
call fcn.00432142
pop ecx
push esi
mov ecx, eax
call fcn.004347eb
test eax, eax
je 0x4323e2
push 0x4ac650
push dword [0x480a38]
push 0x4a9020
push 0x4a903c
push dword [0x480a3c]
push esi
call fcn.00433929
add esp, 0x18
neg eax
sbb eax, eax
and eax, 0xfffffffb
add eax, 5
jmp 0x4323e2
push 0x57
pop eax
pop esi
pop ebp
ret
Function at 0x433e55
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
xor ecx, ecx
lea eax, [ebp - 4]
push eax
push ecx
push dword [ebp + 8]
mov dword [ebp - 4], ecx
push 0x434132
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
je 0x433e97
push esi
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
test esi, esi
pop esi
sete al
jmp 0x433e99
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x434182
Capabilities:
Check if file exists
Get common file path

Disassembly:
push 0x27c
mov eax, 0x47e8b8
call fcn.00437feb
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x218]
mov esi, dword [ebp + 0xc]
push 0x208
push 0
push eax
call fcn.0043d1d0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathStripToRootW]
push str.Program_FilesCommon_FilesMcAfeePlatformCore_trusted.js
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
je 0x434210
lea eax, [ebp - 0x218]
push eax
call fcn.00433bb1
pop ecx
test eax, eax
je 0x434210
lea eax, [ebp - 0x218]
mov ecx, ebx
push eax
call fcn.00432635
push esi
lea ecx, [ebp - 0x278]
call fcn.00432410
and dword [ebp - 4], 0
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x278]
call fcn.0043469c
push 0x480a20
lea ecx, [ebp - 0x260]
mov byte [ebp - 4], 1
call fcn.00432574
mov esi, eax
cmp dword [esi + 0x14], 8
jb 0x434250
mov esi, dword [esi]
push esi
mov dword [ebp - 0x27c], esi
call edi
test eax, eax
je 0x434276
push esi
call fcn.00433bb1
pop ecx
test eax, eax
je 0x434276
lea eax, [ebp - 0x27c]
mov ecx, ebx
push eax
call fcn.0043260a
lea eax, [ebp - 0x288]
push eax
call fcn.0043435c
pop ecx
mov esi, dword [ebp - 0x288]
mov byte [ebp - 4], 2
jmp 0x434321
push esi
lea ecx, [ebp - 0x248]
call fcn.00406245
lea eax, [ebp - 0x230]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x248]
call fcn.0043469c
push 0x480a20
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 4
call fcn.00432574
mov edi, eax
cmp dword [edi + 0x14], 8
jb 0x4342d2
mov edi, dword [edi]
push edi
mov dword [ebp - 0x27c], edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4342fc
push edi
call fcn.00433bb1
pop ecx
test eax, eax
je 0x4342fc
lea eax, [ebp - 0x27c]
mov ecx, ebx
push eax
call fcn.0043260a
push 0
push 1
lea ecx, [ebp - 0x230]
call fcn.0040626d
push 0
push 1
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 2
call fcn.0040626d
add esi, 0x18
cmp esi, dword [ebp - 0x284]
jne 0x434292
lea ecx, [ebp - 0x288]
call fcn.0043409a
push 0
push 1
lea ecx, [ebp - 0x260]
call fcn.0040626d
push 0
push 1
lea ecx, [ebp - 0x278]
call fcn.0040626d
call fcn.00437f95
ret
Function at 0x43435c
Capabilities:
Enumerate processes

Disassembly:
push 0x464
mov eax, 0x47e8f6
call fcn.00437feb
mov edi, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x46c], edi
mov dword [ebp - 0x470], esi
mov dword [ebp - 0x464], esi
mov dword [ebp - 0x460], esi
mov dword [ebp - 0x45c], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x458], esi
mov dword [ebp - 0x454], esi
mov dword [ebp - 0x450], esi
push esi
push 2
mov byte [ebp - 4], 1
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
je 0x434546
push 0x228
lea eax, [ebp - 0x440]
push esi
push eax
call fcn.0043d1d0
add esp, 0xc
mov dword [ebp - 0x444], 0x22c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
lea eax, [ebp - 0x218]
push 0x208
push 0
push eax
mov dword [ebp - 0x44c], esi
call fcn.0043d1d0
add esp, 0xc
lea eax, [ebp - 0x444]
push eax
push ebx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x43453f
mov edi, dword [ebp - 0x458]
cmp dword [ebp - 0x43c], esi
jne 0x43448b
push esi
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x448], eax
test eax, eax
je 0x4344e6
push 0x48e4d0
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.00448c08
add esp, 0xc
mov dword [ebp - 0x468], 0x104
lea eax, [ebp - 0x468]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push dword [ebp - 0x448]
call dword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
test eax, eax
jne 0x4344a2
push dword [ebp - 0x448]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x444]
push eax
push ebx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x434418
jmp 0x4344ef
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x464]
call fcn.00432635
lea eax, [ebp - 0x44c]
push eax
lea ecx, [ebp - 0x458]
call fcn.004325de
mov esi, dword [ebp - 0x42c]
push dword [ebp - 0x448]
mov dword [ebp - 0x44c], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x458]
jmp 0x4344ef
or esi, 0xffffffff
mov dword [ebp - 0x44c], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x434539
cmp esi, 0xffffffff
je 0x434539
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp esi, eax
je 0x434539
mov ecx, dword [ebp - 0x454]
mov eax, edi
cmp edi, ecx
je 0x434524
cmp dword [eax], esi
je 0x434520
add eax, 4
cmp eax, ecx
jne 0x434515
cmp eax, ecx
jne 0x434539
lea eax, [ebp - 0x444]
push eax
push ebx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x434418
mov edi, dword [ebp - 0x46c]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x464]
mov ecx, edi
push eax
call fcn.004326f3
lea ecx, [ebp - 0x458]
call fcn.00424a21
lea ecx, [ebp - 0x464]
call fcn.0043409a
mov eax, edi
call fcn.00437f95
ret
Function at 0x4347eb
Capabilities:
Check if file exists

Disassembly:
push 0x664
mov eax, 0x47e995
call fcn.00437feb
mov esi, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x668], eax
test eax, eax
je 0x434a6b
xor ecx, ecx
cmp cx, word [eax]
je 0x434a6b
lea edi, [esi + 8]
push edi
mov dword [ebp - 0x670], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ebx, ebx
inc ebx
mov byte [ebp - 0x66c], bl
and dword [ebp - 4], 0
cmp dword [esi + 4], 0
jne 0x434a2f
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.0043d1d0
push 0x10
lea eax, [ebp - 0x664]
mov dword [ebp - 0x660], ebx
push eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x664], 0x208
push eax
lea eax, [ebp - 0x660]
push eax
push str.Install_Dir
push str.SOFTWAREMcAfeePlatform
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00403892
add esp, 0x28
test eax, eax
jne 0x4348b5
cmp dword [ebp - 0x660], ebx
jne 0x4348b5
push str.core_vtploader_x86.dll
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.0044a3cd
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov dword [ebp - 0x65c], 2
test eax, eax
jne 0x4349c8
push 0x208
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.0043d1d0
add esp, 0xc
lea eax, [ebp - 0x420]
push 0x208
push eax
push 0x400000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x4349c8
push 0x208
lea eax, [ebp - 0x628]
push 0
push eax
call fcn.0043d1d0
add esp, 0xc
lea eax, [ebp - 0x628]
push 0
push eax
push 0x104
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
lea eax, [ebp - 0x628]
push eax
lea ecx, [ebp - 0x640]
call fcn.00432410
push str._vtploader_x86.dll
lea ecx, [ebp - 0x658]
mov byte [ebp - 4], bl
call fcn.00430950
lea ecx, [ebp - 0x640]
mov byte [ebp - 4], 2
call fcn.00434aa8
lea eax, [ebp - 0x658]
push eax
lea ecx, [ebp - 0x640]
call fcn.00430cd0
push 0
push ebx
lea ecx, [ebp - 0x658]
call fcn.0040626d
cmp dword [ebp - 0x62c], 8
lea eax, [ebp - 0x640]
cmovae eax, dword [ebp - 0x640]
push eax
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.00448c08
add esp, 0xc
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x640]
push 0
push ebx
call fcn.0040626d
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x434a4a
push 0x4ac650
push dword [0x480a38]
lea eax, [ebp - 0x218]
push 0x4a9020
push 0x4a903c
push dword [0x480a3c]
push eax
call fcn.00433929
add esp, 0x18
test eax, eax
je 0x434a29
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi], eax
test eax, eax
je 0x434a29
push str.ValidateModule
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 4], eax
cmp dword [esi + 4], 0
je 0x434a4f
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [ebp - 0x668]
xor bl, bl
mov byte [ebp - 0x66c], bl
call dword [esi + 4]
pop ecx
jmp 0x434a52
push 2
pop eax
jmp 0x434a58
push 5
pop eax
mov dword [ebp - 0x65c], eax
test bl, bl
je 0x434a6e
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 0x65c]
jmp 0x434a6e
push 0x57
pop eax
call fcn.00437f95
ret 4
Function at 0x43511d
Capabilities:
Get common file path

Disassembly:
push 0x218
mov eax, 0x47eaf5
call fcn.00437feb
mov ebx, ecx
mov dword [ebp - 0x220], ebx
mov eax, dword [ebp + 8]
lea esi, [ebx + 0x18]
xor edi, edi
mov dword [ebp - 0x224], ebx
mov dword [ebx], edi
mov ecx, esi
mov dword [ebx + 4], edi
mov dword [ebx + 8], edi
mov dword [ebx + 0xc], edi
mov dword [ebx + 0x10], edi
mov dword [ebx + 0x14], edi
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x220], esi
mov dword [esi], edi
mov dword [esi + 4], edi
call fcn.00435fc5
mov dword [esi], eax
lea esi, [ebx + 0x24]
mov dword [ebx + 0x20], edi
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], edi
cmp dword [esi + 0x14], 8
mov dword [ebp - 4], edi
jb 0x43518a
mov eax, dword [esi]
jmp 0x43518c
mov eax, esi
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x21c]
mov byte [ebp - 4], 1
test eax, eax
je 0x4351a9
push eax
mov ecx, esi
call fcn.004062c4
jmp 0x435217
push 0x208
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.0043d1d0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathStripToRootW]
push str.Program_FilesCommon_FilesMcAfeePlatformCore_trusted.js
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp word [ebp - 0x218], 0
je 0x435208
lea eax, [ebp - 0x218]
push eax
call fcn.00449daa
pop ecx
mov edi, eax
push edi
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.004062e3
mov eax, ebx
call fcn.00437f95
ret 4
Function at 0x435e38
Capabilities:
Check if file exists
Copy file
Create directory
Move file

Disassembly:
push 0x234
mov eax, 0x47ec0d
call fcn.00437feb
mov edi, ecx
mov dword [ebp - 0x220], edi
mov eax, dword [ebp + 8]
lea esi, [edi + 0x14]
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x224], esi
test esi, esi
je 0x435e6c
push esi
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
add edi, 0x24
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [edi + 0x14], 8
jb 0x435e7e
mov eax, dword [edi]
jmp 0x435e80
mov eax, edi
push 1
push eax
lea ecx, [ebp - 0x240]
call fcn.00435221
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.0043d1d0
add esp, 0xc
cmp dword [edi + 0x14], 8
jb 0x435ead
mov eax, dword [edi]
jmp 0x435eaf
mov eax, edi
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
call fcn.00407895
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push ebx
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push str.trusted.tmp
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push ebx
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x435f75
cmp dword [edi + 0x14], 8
jb 0x435f11
mov eax, dword [edi]
jmp 0x435f13
mov eax, edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x435f3f
cmp dword [edi + 0x14], 8
jb 0x435f28
mov eax, dword [edi]
jmp 0x435f2a
mov eax, edi
push ebx
push ebx
push 2
push ebx
lea ecx, [ebp - 0x218]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReplaceFileW]
jmp 0x435f59
cmp dword [edi + 0x14], 8
jb 0x435f49
mov eax, dword [edi]
jmp 0x435f4b
mov eax, edi
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x435f95
cmp dword [edi + 0x14], 8
jb 0x435f65
mov edi, dword [edi]
push 4
push edi
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea ecx, [ebp - 0x240]
call fcn.0043535d
test esi, esi
je 0x435f8b
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, ebx
call fcn.00437f95
ret 4
lea ecx, [ebp - 0x240]
call fcn.0043535d
push str.67136527_5D6B_4AC9_865B_3E392E982420
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomW]
mov ecx, dword [ebp - 0x220]
call fcn.0043583a
mov ecx, dword [ebp - 0x220]
call fcn.00435a94
mov ebx, eax
jmp 0x435f80
Function at 0x4369e2
Capabilities:
Check if file exists
Delete file

Disassembly:
push 0x4a8
mov eax, 0x47eca5
call fcn.00437feb
mov edi, ecx
mov eax, dword [ebp + 8]
xor esi, esi
cmp dword [edi + 0x10], esi
jne 0x436a04
xor eax, eax
jmp 0x436b95
lea ecx, [ebp - 0x2a4]
push 3
mov dword [ebp - 0x2a8], ecx
lea ecx, [ebp - 0x2a8]
push eax
call fcn.0042cd40
mov ebx, 0x104
mov dword [ebp - 4], esi
push ebx
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.0043d1d0
push ebx
lea eax, [ebp - 0x114]
push esi
push eax
call fcn.0043d1d0
add esp, 0x18
push dword [ebp - 0x2a8]
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push eax
push ebx
lea eax, [ebp - 0x218]
push eax
call fcn.00436942
push dword [ebp - 0x2a8]
lea eax, [ebp - 0x114]
push ebx
push eax
call fcn.00436942
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push 0x480f30
push ebx
lea eax, [ebp - 0x114]
push eax
call fcn.004368d4
lea eax, [ebp - 0x224]
push eax
push 0xffffffffffffffff
push 0x436be6
push 0x436bcb
push 0x436bef
push 0x436bdd
push 0x436bd4
push 0x436bf8
push fcn.00428730
call dword [edi + 4]
mov ebx, eax
add esp, 0x24
test ebx, ebx
je 0x436b79
push 0x108
lea eax, [ebp - 0x4b4]
push esi
push eax
call fcn.0043d1d0
lea eax, [ebp - 0x4b4]
push eax
push esi
push 0x436bfd
push esi
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [edi + 8]
push ebx
call dword [edi + 0xc]
add esp, 0x2c
lea eax, [ebp - 0x4b0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x436b79
cmp dword [ebp - 0x4b4], 0
je 0x436b6c
lea eax, [ebp - 0x3a8]
mov dword [ebp - 0x3ac], eax
lea ecx, [ebp - 0x3ac]
push 3
lea eax, [ebp - 0x4b0]
push eax
call fcn.0041b1bb
push dword [ebp - 0x3ac]
mov byte [ebp - 4], 1
call fcn.00433298
mov esi, eax
lea eax, [ebp - 0x3a8]
pop ecx
cmp dword [ebp - 0x3ac], eax
je 0x436b6c
push dword [ebp - 0x3ac]
call fcn.00448c6c
pop ecx
lea eax, [ebp - 0x4b0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x2a4]
cmp dword [ebp - 0x2a8], eax
je 0x436b93
push dword [ebp - 0x2a8]
call fcn.00448c6c
pop ecx
mov eax, esi
call fcn.00437f95
ret 4
Function at 0x45736b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045702a

Function at 0x457376
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004571ad

Function at 0x45aa7c
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045a39f

Function at 0x45aa87
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045a5e6

Function at 0x46262e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x1002aadf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x1002aaee
pop dword [ebp - 0x48]
mov eax, 0x85ec743d
add eax, 0x8a1636b1
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x252f9317
sub dword [ebp - 0x58], 0xd6dd4dcc
mov dword [ebp - 0x54], 0x34e017cb
add dword [ebp - 0x54], 0xfd53347a
mov dword [ebp - 0x50], 0xd9a189df
sub dword [ebp - 0x50], 0x8d5545b1
mov dword [ebp - 0x4c], 0x51c0556e
add dword [ebp - 0x4c], 0xae3faa92
lea eax, [ebp - 0x58]
push eax
mov eax, 0xaee9593
sub eax, 0xfaebd55b
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x9d01d862
sub dword [ebp - 0x58], 0x288f6f0c
mov dword [ebp - 0x54], 0x85e57739
add dword [ebp - 0x54], 0xbb86ea3c
mov dword [ebp - 0x50], 0xa04b0612
add dword [ebp - 0x50], 0xc324665a
mov dword [ebp - 0x4c], 0x4cda764c
add dword [ebp - 0x4c], 0xb32589b4
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x30dc8
push 0
call eax
mov ecx, 0x3193
mov ebx, eax
mov esi, 0xc5aa53d4
sub esi, 0xb5a6bdd4
add esi, dword [ebp - 0x48]
mov edi, 0x3eb205b3
sub edi, 0xdb9cd011
sub dword [ebp - 0x2c], 0x13301c44
mov edx, dword [esi]
mov dword [ebp - 0x18], 0x6e462fbb
xor edx, edi
xor dword [ebp - 4], 0xb771ee9b
mov dword [ebx], edx
xor dword [ebp - 0x24], ebx
add ebx, 0x3b4ce02a
add ebx, 0xc4b31fda
add esi, 4
loop 0x1002ac05
add eax, 0xb91f
xor ebx, ebx
add ebx, eax
add eax, 0xa9118905
add eax, 0x56ee7700
mov ecx, 0x452ef1a3
add ecx, 0xcad10e5d
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x416153
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x416192
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x416192
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x416192
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x416192
cmp dword [ecx + 0x74], 0xe
jbe 0x416192
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x428560
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42858d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42858d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408f6c
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x209a0fdd
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..data_1
nop
nop
nop
nop
cmp eax, 0
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e3d0
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x4ca96a59
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219