joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101bb9e0
Capabilities:
Generate random numbers via winapi

Disassembly:
mov eax, 4
call fcn.102610d0
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
push 1
push esi
xor edi, edi
call fcn.101b52b0
mov ebx, eax
push ebx
push esi
call fcn.101b51a0
mov ebp, eax
add esp, 0x10
test ebp, ebp
je 0x101bba69
push 0xf0000040
push 1
push edi
push edi
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x101bba43
push ebp
push ebx
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push 0
push dword [esp + 0x14]
test eax, eax
cmovne edi, ebx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea eax, [edi*8]
push eax
push edi
push esi
call fcn.101b5200
push esi
call fcn.101b5330
mov edi, eax
add esp, 0x10
test edi, edi
je 0x101bba69
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 1
push esi
call fcn.101b52b0
mov ebx, eax
push ebx
push esi
call fcn.101b51a0
mov ebp, eax
add esp, 0x10
test ebp, ebp
je 0x101bbad8
push 0xf0000040
push 0x16
push str.Intel_Hardware_Cryptographic_Service_Provider
xor edi, edi
lea eax, [esp + 0x1c]
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x101bbabe
push ebp
push ebx
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push 0
push dword [esp + 0x14]
test eax, eax
cmovne edi, ebx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea eax, [edi*8]
push eax
push edi
push esi
call fcn.101b5200
push esi
call fcn.101b5330
add esp, 0x10
mov edi, eax
test edi, edi
jne 0x101bba61
push esi
call fcn.101b5330
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x101cf490
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.102610d0
mov edx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
mov dword [esp + 4], 0x10
lea eax, [edx + 0xf]
lea ecx, [esi + 0xf]
cmp esi, eax
ja 0x101cf4d4
cmp ecx, edx
jb 0x101cf4d4
push edi
mov ecx, esi
sub edx, esi
mov edi, 0x10
mov al, byte [edx + ecx]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
sub edi, 1
jne 0x101cf4c3
pop edi
jmp 0x101cf4e1
movups xmm1, xmmword [esi]
movups xmm0, xmmword [edx]
pxor xmm1, xmm0
movups xmmword [esi], xmm1
push 0x10
push esi
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0x18]
push esi
push dword [eax + 4]
call fcn.101b42e0
add esp, 0x14
pop esi
test eax, eax
je 0x101cf50b
cmp dword [esp], 0x10
jne 0x101cf50b
mov eax, 1
pop ecx
ret
xor eax, eax
pop ecx
ret
Function at 0x101cf650
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x101cf6b3
mov edx, dword [esp + 0x10]
test edx, edx
je 0x101cf6b3
push ebx
push edi
mov edi, dword [esp + 0x10]
mov eax, dword [edi + 0xc]
cmp edx, eax
mov ebx, eax
cmovb ebx, edx
xor ecx, ecx
test ebx, ebx
je 0x101cf686
mov al, byte [ecx + esi]
xor byte [edi + ecx + 0x10], al
inc ecx
cmp ecx, ebx
jb 0x101cf677
mov eax, dword [edi + 0xc]
cmp edx, eax
jbe 0x101cf6b1
sub edx, eax
mov eax, 0x10
cmp edx, eax
cmova edx, eax
xor ecx, ecx
test edx, edx
je 0x101cf6b1
nop dword [eax]
mov eax, dword [edi + 0xc]
add eax, ecx
mov al, byte [eax + esi]
xor byte [edi + ecx + 0x30], al
inc ecx
cmp ecx, edx
jb 0x101cf6a0
pop edi
pop ebx
pop esi
ret

Function at 0x101d3f00
Capabilities:
Check if file exists

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push esi
push dword [esp + 0x14]
call fcn.101fe750
push 0x62
push esi
mov edi, eax
mov ebx, 1
call sub.VCRUNTIME140.dll_strchr
add esp, 0x10
mov ecx, 0x11
test eax, eax
cmove ebx, ecx
test edi, edi
jne 0x101d3fa5
push 0x48
push str.crypto_bio_bss_file.c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 2
call fcn.101b8ab0
push 0x102a279c
push esi
push 0x102a27a0
push dword [esp + 0x30]
push str.fopen_
push 5
call fcn.101b8140
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
add esp, 0x2c
call esi
cmp dword [eax], 2
je 0x101d3f82
call esi
cmp dword [eax], 6
je 0x101d3f82
lea eax, [edi + 2]
lea ecx, [edi + 0x51]
jmp 0x101d3f8c
mov eax, 0x80
mov ecx, 0x4f
push ecx
push str.crypto_bio_bss_file.c
push eax
push 0x6d
push 0x20
call fcn.101b8ab0
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0x102a2744
call fcn.101bf060
mov esi, eax
add esp, 4
test esi, esi
jne 0x101d3fc8
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0
push esi
call fcn.101bea30
push edi
push ebx
push 0x6a
push esi
call fcn.101bea60
add esp, 0x18
mov eax, esi
pop edi
pop esi
pop ebx
ret
Function at 0x1022e850
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 0x18], 0
je 0x1022e864
mov dword [esp + 0x18], fcn.1022d030
jmp fcn.1021fa40
mov dword [esp + 0x18], fcn.1022c2d0
jmp fcn.1021f770
Function at 0x402dcb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25
mov edx, 0x54cc4c
movzx eax, word [edx]
movzx ebx, word [edx + 2]
mov edx, dword [0x54cd34]
sub ecx, 2
mov dword [ebp - 4], ecx
mov dword [ebp - 8], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], edx
movzx eax, word [0x415907]
mov bl, byte [0x41563a]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x20], 0x4d5abf
mov dword [ebp - 0x24], 0x4a5ac0
mov byte [ebp - 0x25], bl
cmp bl, 3
je 0x402e7c
mov ecx, dword [0x4158ee]
mov dword [ebp - 0x18], ecx
mov ecx, dword [0x413d0a]
lea ecx, [ecx + ecx*2]
mov dword [ebp - 4], ecx
mov esi, 0x455a70
mov dword [ebp - 8], esi
call fcn.0040e90a
or edx, 0xffffffff
mov eax, dword [ebp - 0x18]
cmp eax, edx
je 0x402e7c
movss xmm0, dword [0x54cc70]
movss xmm1, dword [0x54cc6c]
xorps xmm2, xmm2
punpcklwd xmm0, xmm2
punpcklwd xmm1, xmm2
psubd xmm0, xmm1
cvtdq2ps xmm0, xmm0
dec eax
imul eax, eax, 0xc
add eax, dword [ebp - 8]
movlps xmm1, qword [eax]
addps xmm1, xmm0
movlps qword [eax], xmm1
xor ebx, ebx
push ebx
mov edx, dword [0x54cd6c]
mov dword [ebp - 0x1c], edx
mov ecx, dword [ebp - 8]
cmp ebx, 1
cmove ecx, dword [ebp - 0x24]
cmp ebx, 1
cmove edx, dword [ebp - 0x20]
mov eax, dword [0x413d0e]
mov ebx, dword [0x413d0a]
cmp byte [0x415279], 0
je 0x402eb0
lea ebx, [ebx + ebx*2]
mov eax, dword [0x413d0e]
push eax
push ebx
lea ebx, [ebx + ebx*2]
movzx esi, byte [0x415279]
call fcn.0040e405
mov dword [0x413d12], ecx
pop ebx
pop eax
imul eax, ebx
pop ebx
cmp byte [ebp - 0x25], 3
jne 0x402ee3
inc ebx
cmp ebx, 1
je 0x402e7e
jmp 0x402f67
mov dword [0x54cd10], eax
mov ecx, eax
mov dword [0x54cd14], 3
xor eax, eax
push eax
push ecx
mov esi, dword [ebp - 0x1c]
cmp eax, 1
cmove esi, dword [ebp - 0x20]
mov edx, dword [ebp - 0x14]
xorps xmm3, xmm3
movlps xmm4, qword [ebp - 0x14]
mov eax, 3
movd xmm5, eax
shufps xmm5, xmm5, 0
paddd xmm3, xmm5
psubd xmm4, xmm5
movups xmm0, xmmword [esi]
cvtps2dq xmm0, xmm0
movaps xmm7, xmm0
movaps xmm6, xmm0
pcmpgtd xmm7, xmm4
pcmpgtd xmm6, xmm3
xorps xmm7, xmm6
pmovmskb eax, xmm7
cmp al, 0xff
jne 0x402f62
pcmpeqd xmm7, xmm7
sub esp, 8
movlps qword [esp], xmm0
pop eax
pop ebx
imul ebx, edx
add ebx, eax
shl ebx, 2
add ebx, dword [ebp - 0xc]
movlps qword [ebx], xmm7
lea ebx, [ebx + edx*4]
movlps qword [ebx], xmm7
add esi, 0xc
loop 0x402f21
mov esi, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov edi, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call fcn.0040e895
mov ecx, dword [ebp - 4]
mov esi, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov edi, dword [0x54cd4c]
call fcn.0040d931
mov esp, ebp
pop ebp
ret
Function at 0x407d2a
Capabilities:
Allocate or change rwx memory

Disassembly:
push 0x40
push 0x3000
push eax
push 0
call dword [sym.imp.KERNEL32_VirtualAlloc]
or eax, eax
jne 0x407d43
call fcn.00407d53
ret

Function at 0x408334
Capabilities:
Encode data using xor

Disassembly:
pushal
movaps xmm7, xmm0
movhps xmm7, qword [0x4108b0]
shufps xmm7, xmm7, 0x48
xorps xmm3, xmm3
mov ecx, 3
mulps xmm0, xmm0
movaps xmm1, xmm7
shufps xmm0, xmm0, 0
mov edx, 1
mulps xmm1, xmm0
mov ebx, ecx
mov eax, ecx
dec ebx
sub eax, 2
push edx
push eax
push ebx
push ecx
movups xmm2, xmmword [esp]
cvtdq2ps xmm2, xmm2
movaps xmm4, xmm2
add esp, 0x10
shufps xmm4, xmm4, 9
shufps xmm2, xmm2, 0xf4
mulps xmm4, xmm2
rcpps xmm4, xmm4
mulps xmm1, xmm4
movaps xmm6, xmm1
xorps xmm6, xmm3
subps xmm7, xmm6
xorps xmm3, xmmword [0x410800]
add ecx, 2
cmp ecx, 0x50
jb 0x40835a
movaps xmm0, xmm7
popal
ret

Function at 0x40998f
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push edx
push eax
push ecx
mov eax, 0xbb8
mov eax, eax
call fcn.00407d2a
push eax
push eax
add eax, 0x640
push eax
mov ecx, dword [ebp - 0xc]
cmp ecx, 0x78616d
jne 0x4099bf
push dword [0x41590e]
pop dword [ebp - 0xc]
jmp 0x4099cd
mov ebx, 4
cmp ecx, 0xffffffff
cmove ecx, ebx
mov dword [ebp - 0xc], ecx
xor ebx, ebx
push ebx
mov eax, ebx
or eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
push dword [edx + ebx*4]
push 0x20
push eax
push dword [ebp - 8]
push 0
push 0
call dword [sym.imp.KERNEL32_CreateThread]
shl ebx, 2
add ebx, dword [ebp - 0x14]
mov dword [ebx], eax
push 0x20
push ebx
call dword [sym.imp.KERNEL32_SetThreadPriority]
pop ebx
inc ebx
cmp ebx, dword [ebp - 0xc]
jne 0x4099cf
xor ebx, ebx
mov eax, dword [ebp - 0x14]
push 0
push dword [eax + ebx*4]
call dword [sym.imp.KERNEL32_SetThreadAffinityMask]
inc ebx
cmp ebx, dword [ebp - 0xc]
jne 0x409a05
xor ebx, ebx
mov eax, dword [ebp - 0x14]
push dword [eax + ebx*4]
call dword [sym.imp.KERNEL32_ResumeThread]
inc ebx
cmp ebx, dword [ebp - 0xc]
jne 0x409a1b
mov eax, dword [ebp - 0x14]
push 0
push 0xffffffffffffffff
push 1
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32_WaitForMultipleObjectsEx]
xor ebx, ebx
mov eax, dword [ebp - 0x14]
push dword [eax + ebx*4]
call dword [sym.imp.KERNEL32_CloseHandle]
inc ebx
cmp ebx, dword [ebp - 0xc]
jne 0x409a42
mov eax, dword [ebp - 0x10]
call fcn.00407d44
mov esp, ebp
pop ebp
ret
Function at 0x40b359
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov edi, 0x413d16
mov dword [ebp - 4], 0x447a0000
mov dword [ebp - 8], 0x44480000
mov dword [ebp - 0xc], 0x43c80000
rcpss xmm3, dword [ebp - 0xc]
rcpss xmm2, dword [ebp - 8]
xor esi, esi
mov edx, 0x320
xor ecx, ecx
call fcn.0040b4fd
sub eax, 0x190
cvtsi2ss xmm1, eax
mulss xmm1, xmm3
movss dword [edi + esi*4], xmm1
inc esi
cmp esi, 3
jne 0x40b385
mov edx, 0x3e8
xor ecx, ecx
call fcn.0040b4fd
cvtsi2ss xmm4, eax
xorps xmm4, xmmword [0x410800]
mulss xmm4, xmm2
movss dword [edi + 8], xmm4
xor esi, esi
mov ecx, 0xe6
mov edx, 0xff
call fcn.0040b4fd
movzx ax, al
mov word [edi + esi*2 + 0x1c], ax
inc esi
cmp esi, 4
jne 0x40b3cb
xor esi, esi
mov ecx, 0x46
movzx edx, word [edi + esi*2 + 0x1c]
call fcn.0040b4fd
movzx ax, al
mov word [edi + esi*2 + 0xc], ax
inc esi
cmp esi, 3
jne 0x40b3eb
xor esi, esi
mov ecx, 1
movzx edx, word [edi + esi*2 + 0xc]
call fcn.0040b4fd
movzx ax, al
mov word [edi + esi*2 + 0x14], ax
inc esi
cmp esi, 3
jne 0x40b40b
add edi, 0x26
cmp edi, str.3d_Studio_objects__.3ds_
jne 0x40b383
mov esi, 0x413d16
mov edi, 0x410620
xorps xmm5, xmm5
movaps xmm6, xmmword [0x410810]
movaps xmm7, xmmword [0x410870]
movups xmm0, xmmword [esi]
orps xmm0, xmm7
movaps xmm1, xmm0
mulps xmm1, xmm1
andps xmm1, xmm6
haddps xmm1, xmm1
haddps xmm1, xmm1
rsqrtps xmm1, xmm1
mulps xmm0, xmm1
movlps xmm1, qword [esi + 0xc]
movlps xmm2, qword [esi + 0x14]
movlps xmm3, qword [esi + 0x1c]
punpcklwd xmm1, xmm5
punpcklwd xmm2, xmm5
punpcklwd xmm3, xmm5
psrld xmm1, 1
psrld xmm2, 1
andps xmm0, xmm6
cvtdq2ps xmm1, xmm1
cvtdq2ps xmm2, xmm2
cvtdq2ps xmm3, xmm3
andps xmm1, xmm6
andps xmm2, xmm6
andps xmm3, xmm6
movaps xmmword [edi], xmm0
movaps xmmword [edi + 0x10], xmm1
movaps xmmword [edi + 0x20], xmm2
movaps xmmword [edi + 0x30], xmm3
add edi, 0x40
add esi, 0x26
cmp esi, str.3d_Studio_objects__.3ds_
jne 0x40b453
mov esp, ebp
pop ebp
ret
Function at 0x40eeef
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push edx
push ecx
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32_CreateFileA]
pop ecx
pop edx
mov dword [ebp - 4], eax
push 0
push 0x54d11c
push ecx
push edx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32_WriteFile]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32_CloseHandle]
mov esp, ebp
pop ebp
ret

Function at 0x40ef34
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
movups xmmword [ebp - 0x14], xmm0
mov dword [ebp - 4], ecx
mov ebx, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x34], 0x81800
mov ecx, dword [ebp - 4]
push dword [ebp - 4]
call dword [sym.imp.COMDLG32_GetOpenFileNameA]
or eax, eax
je 0x40f008
push 0
push pe_nt_image_headers32
push 3
push 0
push 1
push 0x80000000
push dword [ebp - 8]
call dword [sym.imp.KERNEL32_CreateFileA]
mov ebx, dword [ebp - 0xc]
mov dword [ebx], eax
cmp eax, 0xffffffff
je 0x40efe4
push 0
push dword [ebx]
call dword [sym.imp.KERNEL32_GetFileSize]
cmp eax, 0xffffffff
je 0x40efe4
mov edx, dword [ebp - 0x10]
mov dword [edx], eax
mov eax, eax
call fcn.00407d2a
mov edx, dword [ebp - 0x14]
mov dword [edx], eax
mov ecx, dword [ebp - 0x10]
push 0
push 0x54d104
push dword [ecx]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32_ReadFile]
or eax, eax
je 0x40efe4
mov ebx, dword [ebp - 0xc]
push dword [ebx]
call dword [sym.imp.KERNEL32_CloseHandle]
mov eax, dword [0x54d104]
push 1
push 0
push dword [0x54d12c]
call dword [sym.imp.USER32_InvalidateRect]
xor eax, eax
jmp 0x40f008
mov eax, dword [ebp - 0xc]
or eax, eax
je 0x40eff3
push dword [eax]
call dword [sym.imp.KERNEL32_CloseHandle]
push 0
push 0
push str.File_read_error.
push dword [0x54d12c]
call dword [sym.imp.USER32_MessageBoxA]
add esp, 0x50
pop ebp
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41a008]
jne 0x40100a
repz ret
jmp fcn.004018ee

Function at 0x4055bb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004038eb
and dword [ebp - 4], 0
cmp dword [0x41bbf8], 0
mov ebx, eax
jne 0x40566c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40571d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40571d
push eax
call fcn.00403879
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x41bbf8], eax
call esi
push eax
call fcn.00403879
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x41bbfc], eax
call esi
push eax
call fcn.00403879
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x41bc00], eax
call esi
push eax
call fcn.00403879
pop ecx
mov dword [0x41bc08], eax
test eax, eax
je 0x40566c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00403879
pop ecx
mov dword [0x41bc04], eax
mov eax, dword [0x41bc04]
cmp eax, ebx
je 0x4056c4
cmp dword [0x41bc08], ebx
je 0x4056c4
push eax
call fcn.004038f4
push dword [0x41bc08]
mov esi, eax
call fcn.004038f4
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4056c4
test edi, edi
je 0x4056c4
call esi
test eax, eax
je 0x4056bb
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4056bb
test byte [ebp - 0xc], 1
jne 0x4056c4
or dword [ebp + 0x10], 0x200000
jmp 0x4056fd
mov eax, dword [0x41bbfc]
cmp eax, ebx
je 0x4056fd
push eax
call fcn.004038f4
pop ecx
test eax, eax
je 0x4056fd
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4056fd
mov eax, dword [0x41bc00]
cmp eax, ebx
je 0x4056fd
push eax
call fcn.004038f4
pop ecx
test eax, eax
je 0x4056fd
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x41bbf8]
call fcn.004038f4
pop ecx
test eax, eax
je 0x40571d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40571f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x415b90
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x41a008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x2b19ce4]
push ebx
push esi
mov esi, dword [0x2b19b2c]
mov ebx, eax
cmp eax, 0x5dd
jne 0x415bca
push 0
lea eax, [ebp - 0x804]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov eax, dword [0x41ac60]
call fcn.00415a30
cmp dword [0x2b19ce4], 0x2f
jne 0x415be5
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push esi
call fcn.00415a70
add esp, 4
cmp dword [0x2b19ce4], 0x568
pop esi
pop ebx
jne 0x415c0c
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaHighestNodeNumber]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401000
mov esp, ebp
pop ebp
ret
Function at 0x401730
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c4
push 0x214c6981
call fcn.004011f0
add esp, 4
mov dword [ebp - 0x1c], eax
push 0x104
lea eax, [ebp - 0x2b8]
push eax
call dword [ebp - 0x1c]
push 0x1c368da0
call fcn.004011f0
add esp, 4
mov dword [ebp - 0x14], eax
call dword [ebp - 0x14]
push eax
push 0
lea ecx, [ebp - 0x158]
push ecx
call section..text
add esp, 0xc
mov byte [ebp - 0x18], 0x5c
mov byte [ebp - 0x17], 0
mov byte [ebp - 0x144], 0x2e
mov byte [ebp - 0x143], 0x64
mov byte [ebp - 0x142], 0x6c
mov byte [ebp - 0x141], 0x6c
mov byte [ebp - 0x140], 0
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x2b8]
push eax
call fcn.00401b70
add esp, 8
lea ecx, [ebp - 0x158]
push ecx
lea edx, [ebp - 0x2b8]
push edx
call fcn.00401b70
add esp, 8
lea eax, [ebp - 0x144]
push eax
lea ecx, [ebp - 0x2b8]
push ecx
call fcn.00401b70
add esp, 8
push 0x4e1e0843
call fcn.004011f0
add esp, 4
mov dword [ebp - 0x1a4], eax
push 0
push 0x80
push 2
push 0
push 0
push 0x10000000
lea edx, [ebp - 0x2b8]
push edx
call dword [ebp - 0x1a4]
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0xffffffff
je 0x401885
mov dword [ebp - 0x2bc], 0
push 0x7463a627
call fcn.004011f0
add esp, 4
mov dword [ebp - 0x2c4], eax
push 0
lea eax, [ebp - 0x2bc]
push eax
push 0xd400
push section..data
mov ecx, dword [ebp - 0x13c]
push ecx
call dword [ebp - 0x2c4]
push 0x70ebfb28
call fcn.004011f0
add esp, 4
mov dword [ebp - 0x2c0], eax
mov edx, dword [ebp - 0x13c]
push edx
call dword [ebp - 0x2c0]
mov byte [ebp - 0x1b0], 0x60
mov byte [ebp - 0x1af], 0x47
mov byte [ebp - 0x1ae], 0x5c
mov byte [ebp - 0x1ad], 0x56
mov byte [ebp - 0x1ac], 0x5e
mov byte [ebp - 0x1ab], 0x5e
mov byte [ebp - 0x1aa], 1
mov byte [ebp - 0x1a9], 0
mov byte [ebp - 0x1a8], 0x12
mov byte [ebp - 0x1a7], 0x32
push 0x32
push 0xa
lea eax, [ebp - 0x1b0]
push eax
lea ecx, [ebp - 0x1b0]
push ecx
call fcn.00401240
add esp, 0x10
mov byte [ebp - 0x10], 0x20
mov byte [ebp - 0xf], 0x45
mov byte [ebp - 0xe], 0x78
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 0xc], 0x63
mov byte [ebp - 0xb], 0x75
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 9], 0x65
mov byte [ebp - 8], 0
push 0x44
push 0
lea edx, [ebp - 0x1a0]
push edx
call fcn.00401220
add esp, 0xc
mov dword [ebp - 0x1a0], 0x44
push 0x10
push 0
lea eax, [ebp - 0x138]
push eax
call fcn.00401220
add esp, 0xc
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x2b8]
push edx
call fcn.00401b70
add esp, 8
lea eax, [ebp - 0x1b0]
push eax
lea ecx, [ebp - 0x128]
push ecx
call fcn.00401b60
add esp, 8
lea edx, [ebp - 0x2b8]
push edx
lea eax, [ebp - 0x128]
push eax
call fcn.00401b70
add esp, 8
lea ecx, [ebp - 0x2b8]
push ecx
call fcn.00401ad0
add esp, 4
push 0xe621d6
call fcn.004011f0
add esp, 4
mov dword [ebp - 4], eax
lea edx, [ebp - 0x138]
push edx
lea eax, [ebp - 0x1a0]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x128]
push ecx
push 0
call dword [ebp - 4]
push 0xea60
mov edx, dword [ebp - 0x134]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esp, ebp
pop ebp
ret
Function at 0x4019e0
Capabilities:
Contain obfuscated stackstrings
Get common file path
Move file
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push 0x7f8a
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_CopyIcon]
push eax
call dword [sym.imp.USER32.dll_SetSystemCursor]
call fcn.00401730
call fcn.00401280
push 0x104
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x104
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov byte [ebp - 0x220], 0x5c
mov byte [ebp - 0x21f], 0x5c
mov byte [ebp - 0x21e], 0x73
mov byte [ebp - 0x21d], 0x79
mov byte [ebp - 0x21c], 0x73
mov byte [ebp - 0x21b], 0x74
mov byte [ebp - 0x21a], 0x65
mov byte [ebp - 0x219], 0x6d
mov byte [ebp - 0x218], 0x2e
mov byte [ebp - 0x217], 0x65
mov byte [ebp - 0x216], 0x78
mov byte [ebp - 0x215], 0x65
mov byte [ebp - 0x214], 0
lea edx, [ebp - 0x220]
push edx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 1
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x401b1e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x401b74
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401b74
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 8]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x401b66
cmp esi, ecx
jae 0x401b74
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edx, 1
jne 0x401b54
cmp esi, ecx
jae 0x401b74
cmp word [esi], 0
je 0x401b74
mov eax, esi
jmp 0x401b76
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x401f60
Capabilities:
Compare security identifiers

Disassembly:
push ebx
push esi
lea ebx, [ecx + 4]
push edi
mov edi, edx
test ebx, ebx
je 0x401f96
lea esi, [edi + 4]
test esi, esi
je 0x401f96
call fcn.00401ec2
test al, al
je 0x401f96
mov ecx, edi
call fcn.00401ec2
test al, al
je 0x401f96
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
setne al
jmp 0x401f98
xor al, al
pop edi
pop esi
pop ebx
ret

Function at 0x404a22
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x43c040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, edx
mov ebx, ecx
test esi, esi
jne 0x404a49
mov eax, 0x80070057
jmp 0x404ae9
push edi
mov ecx, esi
call fcn.00401745
push 0x208
xor edi, edi
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.00416d80
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push edi
push edi
push ebx
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, eax
test edi, edi
jns 0x404aca
movzx ecx, bl
cmp ecx, 0x26
jne 0x404a8e
mov edx, 0x435500
jmp 0x404a98
cmp ecx, 0x1c
jne 0x404ab9
mov edx, str.LocalAppData
lea ecx, [ebp - 0x210]
call fcn.004049e5
push eax
mov ecx, esi
call fcn.004016c6
mov ecx, dword [ebp - 0x210]
lea ecx, [ecx - 0x10]
call fcn.004016ae
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
je 0x404ac6
xor eax, eax
inc eax
jmp 0x404ae8
mov eax, edi
jmp 0x404ae8
lea eax, [ebp - 0x20c]
push eax
call fcn.00422281
pop ecx
push eax
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.004017dd
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00416002
leave
ret