joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44f630
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x472910
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.0044f1e0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.0044f260
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.0044f260
lea ecx, [esi + 0xc]
call fcn.00463fe1
lea ecx, [esi + 0x10]
call fcn.00463fe1
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.00451a90
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.00451a90
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.00451a90
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.00464056
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.00464056
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x4502d8
Capabilities:
Get hostname

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x472b38
push eax
mov dword fs:[0], esp
sub esp, 0x64
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
test eax, eax
je 0x4502e8
call fcn.00450800
mov edi, dword [esp + 0x7c]
test edi, edi
je 0x4503cb
cmp byte [edi], 0
je 0x4503cb
mov eax, dword [esp + 0x8c]
test eax, eax
jg 0x45030d
mov eax, 0x7d0
mov ecx, esi
mov dword [esi + 8], eax
call fcn.0044f000
test eax, eax
jne 0x45032d
push 0x59e980
lea ecx, [esi + 0x38]
call fcn.00464193
jmp 0x4503cb
mov eax, dword [esp + 0x80]
mov ecx, esi
push eax
push edi
call fcn.0044f050
test eax, eax
jne 0x45035c
mov ecx, esi
call fcn.0044f150
push edi
add esi, 0x38
push 0x59e95c
push esi
call fcn.00461e5a
add esp, 0xc
jmp 0x4503cb
push 0xdc
mov ecx, esi
mov dword [esi + 4], 1
call fcn.00451080
test eax, eax
je 0x4503c4
lea ecx, [esp + 8]
push 0x64
push ecx
call sub.WS2_32.dll_gethostname
mov eax, dword [esp + 0x88]
mov ecx, dword [esp + 0x84]
lea edx, [esp + 0x8c]
mov dword [esp + 0x8c], 1
push edx
push eax
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, esi
call fcn.004504a0
test eax, eax
jne 0x4503e0
push edi
lea eax, [esi + 0x38]
push 0x59e938
push eax
call fcn.00461e5a
add esp, 0xc
mov ecx, esi
call fcn.00450800
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x450488
mov ecx, dword [0x59ebf0]
mov dword [esp + 0x7c], ecx
lea edx, [esp + 8]
lea eax, [esp + 0x7c]
push edx
push str.HELO__s_r_n
push eax
mov dword [esp + 0x80], 0
call fcn.00461e5a
mov edx, dword [esp + 0x88]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
mov ecx, esi
call fcn.0044f100
test eax, eax
jne 0x45044a
push 0x59e91c
lea ecx, [esi + 0x38]
call fcn.00464193
jmp 0x45045a
push 0xfa
mov ecx, esi
call fcn.00451080
test eax, eax
jne 0x450477
mov ecx, esi
call fcn.00450800
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.00464056
jmp 0x4503cb
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.00464056
mov ecx, dword [esp + 0x6c]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
Function at 0x4663fd
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x466435
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004644b1
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00464489
jmp 0x466441
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x467aef
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x467b31
call fcn.0046d664
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x467b31
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x467b28
xor eax, eax
jmp 0x467b39
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00467b3f
pop edi
pop esi
pop ebx
ret 4

Function at 0x46db94
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x46dbc2
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x46dbe0
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0046dafa
jmp 0x46dbe0
mov eax, dword [esi + 0x14]
test eax, eax
je 0x46dbe0
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0046dafa
test edi, edi
mov eax, edi
jne 0x46dbca
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x40100b
Capabilities:
Query or enumerate registry value

Disassembly:
call 0x40100b
push eax
call sub.KERNEL32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffef0
jmp 0x40109c
lea eax, [ebp - 0x104]
push eax
call fcn.004011ec
push 0x401019
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
jne 0x401165
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push 0x401038
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x4011a5
mov dword [ebp - 0x110], 0x103
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x401052
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x4011a5
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x40114a
mov word [ebx], 0x5c
push 0x401023
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
je 0x4011a5
mov dword [ebp - 0x108], eax
push 0x40102d
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x40119a
push 0x3e8
call eax
test eax, eax
je 0x40119a
call 0x40118a
add dword [esp], 0x1e76
call eax
push 0
call sub.KERNEL32.dll_ExitProcess
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
push 0x10
push 0x401096
push 0x401057
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0xffffffff
leave
ret

Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x30b922d9
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x133a392f
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x4023fb
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0x44f89c
mov eax, dword [ebp + 0x10]
push eax
call fcn.00424ce0
add esp, 8
test eax, eax
jne 0x402417
xor eax, eax
jmp 0x402481
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00423170
add esp, 4
cmp eax, 4
jae 0x40242c
xor eax, eax
jmp 0x402481
push 0
mov edx, dword [ebp + 0xc]
push edx
call fcn.00413d10
add esp, 8
mov eax, dword [ebp + 0xc]
mov byte [eax + 1], 0x3a
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40246b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x44f8a0
mov edx, dword [ebp + 8]
push edx
call fcn.0040d6c0
add esp, 0xc
xor eax, eax
jmp 0x402481
push 0x44f8cc
mov eax, dword [ebp + 8]
push eax
call fcn.0040d6c0
add esp, 8
mov eax, 1
pop ebp
ret
Function at 0x402512
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x730
push edi
mov eax, dword [ebp + 8]
push eax
call fcn.004129e0
add esp, 4
mov dword [ebp - 0x730], eax
push 0x44f924
mov ecx, dword [ebp - 0x730]
push ecx
call fcn.00424ce0
add esp, 8
test eax, eax
jne 0x402576
push 0x44f928
mov edx, dword [ebp - 0x730]
push edx
call fcn.00424ce0
add esp, 8
test eax, eax
jne 0x402576
push 0x44f930
mov eax, dword [ebp - 0x730]
push eax
call fcn.00424ce0
add esp, 8
test eax, eax
je 0x40258e
push 0x44f938
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004136d0
add esp, 8
xor eax, eax
jmp 0x402701
lea edx, [ebp - 0x628]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00412d90
add esp, 8
and eax, 0xff
test eax, eax
jne 0x4025c6
mov ecx, dword [ebp + 8]
push ecx
push 0x44f960
mov edx, dword [ebp + 0xc]
push edx
call fcn.004136d0
add esp, 0xc
xor eax, eax
jmp 0x402701
push 0x44f980
lea eax, [ebp - 0x524]
push eax
call fcn.00424ce0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4025fe
push str.affected
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004136d0
add esp, 8
mov eax, 1
jmp 0x402701
mov dl, byte [0x45473c]
mov byte [ebp - 0x72c], dl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x72b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 8]
push eax
call fcn.004129e0
add esp, 4
push eax
push 0x45488c
push 0x44f998
lea ecx, [ebp - 0x72c]
push ecx
call fcn.00423bd4
add esp, 0x10
lea edx, [ebp - 0x72c]
push edx
call fcn.00412a10
add esp, 4
and eax, 0xff
test eax, eax
je 0x402669
lea eax, [ebp - 0x72c]
push eax
call fcn.00433f1c
add esp, 4
push 0xb
lea ecx, [ebp - 0x72c]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x402699
mov eax, dword [ebp + 8]
push eax
push 0x44f9a0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004136d0
add esp, 0xc
xor eax, eax
jmp 0x402701
push str._systemdrive_Program_Fileshatjava
push 0
lea edx, [ebp - 0x524]
push edx
push 6
lea eax, [ebp - 0x214]
push eax
push 0x44f9e4
push str._systemdrive_Program_Fileshatjavawrapper.exe
mov ecx, dword [ebp + 8]
push ecx
call fcn.00412c40
add esp, 0x20
and eax, 0xff
test eax, eax
jne 0x4026eb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error__d:_CreateShortCut___failed.
mov edx, dword [ebp + 0xc]
push edx
call fcn.004136d0
add esp, 0xc
xor eax, eax
jmp 0x402701
push 0x44fa40
mov eax, dword [ebp + 0xc]
push eax
call fcn.004136d0
add esp, 8
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x402706
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x730
push edi
mov eax, dword [ebp + 8]
push eax
call fcn.004129e0
add esp, 4
mov dword [ebp - 0x730], eax
push 0x44fa44
mov ecx, dword [ebp - 0x730]
push ecx
call fcn.00424ce0
add esp, 8
test eax, eax
jne 0x40276a
push 0x44fa48
mov edx, dword [ebp - 0x730]
push edx
call fcn.00424ce0
add esp, 8
test eax, eax
jne 0x40276a
push 0x44fa50
mov eax, dword [ebp - 0x730]
push eax
call fcn.00424ce0
add esp, 8
test eax, eax
je 0x402782
push str.These_shortcut_cannot_not_processed_
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004136d0
add esp, 8
xor eax, eax
jmp 0x4028ad
lea edx, [ebp - 0x628]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00412d90
add esp, 8
and eax, 0xff
test eax, eax
jne 0x4027ba
mov ecx, dword [ebp + 8]
push ecx
push str.Cannot_get_shortcut_info____s
mov edx, dword [ebp + 0xc]
push edx
call fcn.004136d0
add esp, 0xc
xor eax, eax
jmp 0x4028ad
push 0x44faa0
lea eax, [ebp - 0x524]
push eax
call fcn.00424ce0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4027f2
push str.unaffected
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004136d0
add esp, 8
mov eax, 1
jmp 0x4028ad
mov dl, byte [0x454740]
mov byte [ebp - 0x72c], dl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x72b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 8]
push eax
call fcn.004129e0
add esp, 4
push eax
push 0x45488c
push str._s_s
lea ecx, [ebp - 0x72c]
push ecx
call fcn.00423bd4
add esp, 0x10
lea edx, [ebp - 0x72c]
push edx
call fcn.00412a10
add esp, 4
and eax, 0xff
test eax, eax
jne 0x402867
mov eax, dword [ebp + 8]
push eax
push str.Cannot_restore_shortcut____s
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004136d0
add esp, 0xc
xor eax, eax
jmp 0x4028ad
push 0xb
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x72c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x402897
mov ecx, dword [ebp + 8]
push ecx
push str.Failed_to_move_linkfile____s
mov edx, dword [ebp + 0xc]
push edx
call fcn.004136d0
add esp, 0xc
xor eax, eax
jmp 0x4028ad
push 0x44fb00
mov eax, dword [ebp + 0xc]
push eax
call fcn.004136d0
add esp, 8
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x402d5d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x514
push edi
mov al, byte [0x454754]
mov byte [ebp - 0x108], al
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x107]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea ecx, [ebp - 0x108]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0
call fcn.00425379
add esp, 4
push eax
lea edx, [ebp - 0x108]
push edx
call fcn.00423920
add esp, 8
push 0x44fe5c
lea eax, [ebp - 0x108]
push eax
call fcn.00423920
add esp, 8
push 0
lea ecx, [ebp - 0x108]
push ecx
call fcn.00412720
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], 0
je 0x402df0
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.0040146d
add esp, 8
jmp 0x402e45
lea ecx, [ebp - 0x40c]
push ecx
lea edx, [ebp - 0x30c]
push edx
lea eax, [ebp - 0x50c]
push eax
lea ecx, [ebp - 0x510]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.00423a00
add esp, 0x14
lea eax, [ebp - 0x40c]
push eax
lea ecx, [ebp - 0x30c]
push ecx
call fcn.00423920
add esp, 8
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x30c]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00412790
add esp, 0xc
mov edx, dword [ebp - 4]
push edx
call fcn.00412850
add esp, 4
and eax, 0xff
test eax, eax
je 0x402e6e
mov eax, dword [ebp - 4]
push eax
call fcn.004127b0
add esp, 4
mov dword [ebp - 0x514], eax
jmp 0x402e80
mov ecx, dword [ebp - 4]
push ecx
call fcn.00419600
add esp, 4
mov dword [ebp - 0x514], eax
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0040111b
add esp, 8
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x404ca4
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], str._Dwrapper.pid
mov dword [ebp - 0xc], str._Dwrapper.
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00424ce0
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x404d2a
mov edx, dword [ebp - 4]
push edx
call fcn.00423170
add esp, 4
mov ecx, dword [ebp - 8]
add ecx, eax
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.00424ce0
add esp, 8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x404d2a
mov ecx, dword [ebp - 0x14]
mov dl, byte [ecx]
mov byte [ebp - 0x18], dl
mov eax, dword [ebp - 0x14]
mov byte [eax], 0
mov ecx, dword [ebp - 8]
push ecx
call fcn.00425529
add esp, 4
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x14]
mov al, byte [ebp - 0x18]
mov byte [edx], al
cmp dword [ebp - 0x10], 0
je 0x404d79
mov ecx, dword [ebp - 0x10]
push ecx
push str.Wrapper_ProcessId_d
call fcn.004130c0
add esp, 8
mov edx, dword [ebp - 0x10]
push edx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x1c], eax
push 0
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 0x1c]
push ecx
push str.Call_TerminateProcess__p__0__to_kill_wrapper....OK
call fcn.004130c0
add esp, 8
mov eax, 1
jmp 0x404d7b
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x40adeb
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x440bf8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14c
push edi
mov dword [ebp - 0x158], ecx
lea eax, [ebp - 0x144]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040b790
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0041a460
add esp, 8
test eax, eax
jne 0x40ae6b
push 0x451350
call fcn.004130c0
add esp, 4
mov dword [ebp - 0x148], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0040b7d0
mov eax, dword [ebp - 0x148]
jmp 0x40b080
mov al, byte [0x454a9c]
mov byte [ebp - 0x120], al
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x11f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x124], 0
jmp 0x40aea3
mov ecx, dword [ebp - 0x124]
add ecx, 1
mov dword [ebp - 0x124], ecx
lea ecx, [ebp - 0x1c]
call fcn.0040b830
cmp dword [ebp - 0x124], eax
jae 0x40b061
mov edx, dword [ebp - 0x124]
push edx
lea ecx, [ebp - 0x1c]
call fcn.0040b870
mov eax, dword [eax]
mov dword [ebp - 0x12c], eax
lea ecx, [ebp - 0x14c]
push ecx
lea ecx, [ebp - 0x13c]
call fcn.0040b790
mov byte [ebp - 4], 1
lea edx, [ebp - 0x13c]
push edx
mov eax, dword [ebp - 0x12c]
push eax
call fcn.0041a530
add esp, 8
test eax, eax
jg 0x40af1f
push 0x45136c
call fcn.004130c0
add esp, 4
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x13c]
call fcn.0040b8a0
jmp 0x40ae94
mov dword [ebp - 0x128], 0
jmp 0x40af3a
mov ecx, dword [ebp - 0x128]
add ecx, 1
mov dword [ebp - 0x128], ecx
lea ecx, [ebp - 0x13c]
call fcn.0040b900
cmp dword [ebp - 0x128], eax
jae 0x40afa7
mov edx, dword [ebp - 0x128]
push edx
lea ecx, [ebp - 0x13c]
call fcn.0040b940
mov ecx, eax
call fcn.0040b760
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0x140]
push eax
call fcn.00412a00
add esp, 4
push eax
push str..EXE
call fcn.004299c0
add esp, 8
test eax, eax
jne 0x40afa5
mov ecx, dword [ebp - 0x140]
push ecx
lea edx, [ebp - 0x120]
push edx
call fcn.00423910
add esp, 8
jmp 0x40afa7
jmp 0x40af2b
mov ecx, dword [ebp - 0x158]
add ecx, 0xc0
call fcn.00403450
push eax
lea eax, [ebp - 0x120]
push eax
call fcn.004299c0
add esp, 8
test eax, eax
je 0x40b037
mov ecx, dword [ebp - 0x158]
add ecx, 0xc0
call fcn.00403450
push eax
call fcn.00412f50
add esp, 4
push 1
mov ecx, dword [ebp - 0x158]
add ecx, 0xc0
call fcn.00403450
push eax
lea ecx, [ebp - 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov dword [ebp - 0x150], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x13c]
call fcn.0040b8a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0040b7d0
mov eax, dword [ebp - 0x150]
jmp 0x40b080
push 0x104
push 0
lea edx, [ebp - 0x120]
push edx
call fcn.00424820
add esp, 0xc
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x13c]
call fcn.0040b8a0
jmp 0x40ae94
mov dword [ebp - 0x154], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0040b7d0
mov eax, dword [ebp - 0x154]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x40b1ca
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
push str.HELPME_PLEASE_CHECK_NOW_MUTEX
call fcn.00419ef0
add esp, 4
test eax, eax
jne 0x40b1f7
push str.RUNDLL_IS_RUNNING
call fcn.00419ef0
add esp, 4
test eax, eax
jne 0x40b1f7
jmp 0x40b204
push 0x4514b8
call fcn.004130c0
add esp, 4
push str._enc0DEBUG_
call fcn.004130c0
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
call fcn.00404ca4
add esp, 4
mov byte [ebp - 8], 0x46
movsx eax, byte [ebp - 8]
push eax
push 0x45150c
call fcn.004130c0
add esp, 8
mov cl, byte [ebp - 8]
push ecx
mov ecx, dword [ebp - 0xc]
call fcn.0040b28d
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40b261
movsx edx, byte [ebp - 8]
push edx
push str._enc0ERROR_
call fcn.004130c0
add esp, 8
xor eax, eax
jmp 0x40b289
mov eax, dword [ebp - 4]
push eax
push str._enc0RUN__s
call fcn.004130c0
add esp, 8
push 0
push 2
push 0
mov ecx, dword [ebp - 4]
push ecx
call fcn.0041a3d0
add esp, 0x10
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x40b28d
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x440c15
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push esi
mov dword [ebp - 0x30], ecx
push 0
lea ecx, [ebp - 0x1c]
call fcn.00413440
mov dword [ebp - 4], 0
push 0
push 0xffffffffffffffff
push 0
mov ecx, dword [ebp - 0x30]
add ecx, 0xc0
call fcn.00403450
push eax
lea ecx, [ebp - 0x1c]
call fcn.00413730
and eax, 0xff
test eax, eax
jne 0x40b301
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00413510
mov eax, dword [ebp - 0x24]
jmp 0x40b47b
lea ecx, [ebp - 0x1c]
call fcn.004136b0
push eax
push 0x451558
lea ecx, [ebp - 0x1c]
call fcn.004136c0
push eax
call fcn.004148c0
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x40b39f
mov eax, dword [ebp - 0x10]
add eax, 7
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
movsx edx, byte [ecx]
test edx, edx
je 0x40b369
mov eax, dword [ebp - 0x10]
mov cl, byte [ebp + 8]
mov byte [eax + 5], cl
jmp 0x40b350
mov edx, dword [ebp - 0x20]
add edx, 1
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
movsx ecx, byte [eax]
test ecx, ecx
je 0x40b369
mov edx, dword [ebp - 0x20]
mov al, byte [edx]
xor al, byte [ebp + 8]
mov ecx, dword [ebp - 0x20]
mov byte [ecx], al
jmp 0x40b347
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x10], edx
lea ecx, [ebp - 0x1c]
call fcn.004136b0
mov esi, eax
lea ecx, [ebp - 0x1c]
call fcn.004136c0
mov ecx, dword [ebp - 0x10]
sub ecx, eax
sub esi, ecx
push esi
push str._enc0
mov edx, dword [ebp - 0x10]
push edx
call fcn.004148c0
add esp, 0xc
mov dword [ebp - 0x10], eax
jmp 0x40b323
push 0x454990
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
movsx eax, byte [0x454990]
test eax, eax
jne 0x40b3e5
push str._enc0ERROR_GetTempPath___failed.
call fcn.004130c0
add esp, 4
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00413510
mov eax, dword [ebp - 0x28]
jmp 0x40b47b
push 0x454990
call fcn.00412a10
add esp, 4
and eax, 0xff
test eax, eax
jne 0x40b408
push 0
push 0x454990
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
movsx ecx, byte [ebp + 8]
mov edx, dword [ecx*4 + 0x450810]
push edx
push 0x45158c
push 0x454990
call fcn.00423170
add esp, 4
add eax, 0x454990
push eax
call fcn.00423bd4
add esp, 0xc
push 0
push 0xffffffffffffffff
push 0
push 0x454990
lea ecx, [ebp - 0x1c]
call fcn.004138e0
and eax, 0xff
test eax, eax
jne 0x40b462
push 0x454990
push str._enc0ERROR_WriteFile__s__failed_.
call fcn.004130c0
add esp, 8
mov dword [ebp - 0x2c], 0x454990
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00413510
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 4