joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401880
Capabilities:
Get file version info

Disassembly:
fcomp dword [ebx]
rcr byte [edi - 9], 0xd8
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 0x18
mov ecx, dword [ebp + 8]
push ebx
push esi
lea eax, [ebp - 4]
push edi
xor esi, esi
push eax
push ecx
mov dword [ebp - 4], esi
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov ebx, eax
cmp ebx, esi
je 0x4019bb
push ebx
push 2
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
jb 0x4018c4
nop
nop
nop
nop
jae 0x4018c4
xor edi, dword [edi + 0xe58be73]
lea ebx, [ebp + 0x15ff5676]
je 0x401919
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
jp 0x4018f1
inc eax
add byte [ebx + 0x1e8a0ff8], cl
add byte [eax], al
add byte [eax + 0x66], dl
mov eax, 0xf58ea42
mov edx, dword [edx]
add byte [eax], al
add byte [edi + 0x58], ah
push eax
mov ax, 0xea42
pop eax
jnp 0x4018f1
pop eax
mov edx, 0xb7bc9ea5
jb 0x401912
jp 0x401878
test cl, 0x87
xor esp, esi
cwde
push edx
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
push edi
push ebx
push edx
push eax
call sub.VERSION.dll_GetFileVersionInfoA
push eax
push ecx
push edx
test cx, 0x7529
cmp cx, 0x2eaa
dec al
add ecx, 0x45fb
inc ebp
add byte [eax], al
cmp ah, 0x7c
mov al, 0x3a
inc dx
cmp ah, byte [esi + 0x42]
cmp ah, 0x36
and cl, 0x44
pop edx
pop ecx
pop eax
lea ecx, [ebp - 0xc]
lea edx, [ebp - 8]
push ecx
push edx
push 0x406524
push edi
call sub.VERSION.dll_VerQueryValueA
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x10]
mov dx, word [eax + 0x10]
shr ecx, 0x10
mov word [ebp - 0x16], dx
mov dx, word [eax + 0x14]
mov word [ebp - 0x18], cx
mov ecx, dword [eax + 0x14]
mov word [ebp - 0x12], dx
mov eax, dword [ebp - 0x12]
shr ecx, 0x10
mov word [ebp - 0x14], cx
and eax, 0xffff
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x16]
push eax
mov eax, dword [ebp - 0x18]
and ecx, 0xffff
and edx, 0xffff
push ecx
mov ecx, dword [ebp + 0xc]
and eax, 0xffff
push edx
push eax
push 0x4064e8
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x18
push ebx
test ebx, 0x2fbf
cmp bh, ch
add bh, 0x30
pop ebx
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push eax
push ebx
push ecx
mov cl, 0x6d
inc ebx
pop ecx
pop ebx
pop eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402140
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
push ebx
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x22b]
mov byte [ebp - 0x22c], 0
mov byte [ebp - 0x128], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x127]
mov ebx, dword [ebp + 0xc]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x22c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push ecx
push edi
push ax
test di, 0x934
test edi, 0x48bd
and edi, eax
and ch, 0xb
cmp cl, 0x6f
mov cl, 0xc
sub di, 0x5090
test cx, di
pop ax
pop edi
pop ecx
lea edi, [ebp - 0x22c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x128]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
push edx
cmp dh, al
mov eax, 0x2562
add ax, di
test ax, 0x5cb2
cmp ax, di
cmp ax, di
or al, 0x4c
or eax, ecx
pop edx
pop eax
mov edi, 0x406050
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x128]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jo 0x40224d
push edx
mov dx, 0xbd71
pop edx
jno 0x40224d
popal
stosd dword es:[edi], eax
retf
lea eax, [ebp - 0x24]
lea ecx, [ebp - 0x128]
push eax
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
mov esi, ebx
cmp esi, 0xffffffff
jne 0x402282
mov edx, dword [ebp + 8]
push edx
call fcn.00401b80
mov ebx, eax
add esp, 4
cmp ebx, esi
jne 0x402282
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
jo 0x40229a
push esi
mov esi, 0x387ef7e0
pop esi
jno 0x40229a
invalid
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x18]
push eax
lea edx, [ebp - 0x20]
push ecx
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
cmp esi, 0xffffffff
jne 0x4022b9
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403200
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x14]
push ebx
push esi
push edi
test eax, eax
mov dword [ebp - 8], 0
jbe 0x403284
push ax
push ecx
push esi
dec al
pop esi
pop ecx
pop ax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 8]
mov dl, byte [ecx + eax]
mov byte [ebp - 1], dl
pushal
test si, 0x3660
add si, 0x20c2
test edi, eax
popal
mov esi, dword [ebp - 8]
xor edx, edx
mov eax, esi
mov bl, byte [ebp - 1]
div dword [ebp + 0xc]
mov eax, dword [ebp + 8]
xor bl, byte [edx + eax]
push eax
push ecx
push edx
test cx, 0x7529
cmp cx, 0x2eaa
dec al
add ecx, 0x45fb
cmp ah, 0x7c
mov al, 0x3a
inc dx
cmp ah, 0x36
and cl, 0x44
pop edx
pop ecx
pop eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
mov byte [esi + ecx], bl
inc esi
cmp esi, eax
mov dword [ebp - 8], esi
jb 0x403217
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x403540
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov dword [ebp - 4], 0
push ebx
push ecx
or bl, ah
sub cl, 0x27
cmp bh, 8
and cx, 0x784f
and bx, 0x94f
pop ecx
pop ebx
lea eax, [ebp - 4]
push eax
call fcn.00401000
add esp, 4
test eax, eax
jne 0x403579
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
push edx
test bl, 0x3e
sub dh, cl
mov dh, ah
pop edx
pop ebx
mov eax, dword [ebp - 4]
test eax, eax
jne 0x403593
xor eax, eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
push ecx
dec cx
xor eax, 0x687c
test dx, cx
test ah, 0x30
mov cx, 0xcd1
pop ecx
pop eax
mov edx, dword [ebp - 4]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push 1
push 0x40624c
push 0x40620c
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
neg eax
sbb eax, eax
pop edi
inc eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4035e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push ebx
push esi
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
jne 0x403600
pop esi
pop ebx
pop ebp
ret
push ecx
push edx
and cx, si
cmp dx, si
xor dl, bh
or dl, 0x67
pop edx
pop ecx
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
push esi
push edx
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
push ebx
push cx
push dx
xor ch, bl
pop dx
pop cx
pop ebx
push esi
call dword [sym.imp.MSVCRT.dll_fflush]
add esp, 4
push eax
push dx
and al, bh
xor dl, al
or dh, dh
xor ah, 0x62
sub eax, 0x3488
and eax, 0x7ee5
dec dh
add eax, eax
pop dx
pop eax
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
pop esi
pop ebx
pop ebp
ret
Function at 0x403cf0
Capabilities:
Delete registry key
Set registry value

Disassembly:
sub esp, 0x114
xor ecx, ecx
xor al, al
mov dword [esp + 1], ecx
push esi
mov dword [esp + 9], ecx
push edi
mov dword [esp + 0x11], ecx
mov byte [esp + 8], al
mov word [esp + 0x15], cx
mov byte [esp + 0x18], al
mov byte [esp + 0x17], cl
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x19]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.00404870
lea edx, [esp + 8]
push 5
push edx
call fcn.00404930
mov edi, dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 8
lea eax, [esp + 8]
lea ecx, [esp + 0x18]
push eax
push 0x40632c
push ecx
call edi
add esp, 0xc
push 0x406370
push 0x80000000
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueA]
lea edx, [esp + 8]
push 0x10
push edx
push 1
push 0x420940
push 0x406370
push 0x80000000
call esi
push 0x4b
push 0x4063a4
push 1
lea eax, [esp + 0x24]
push 0x420940
push eax
push 0x80000000
call esi
lea ecx, [esp + 8]
lea edx, [esp + 0x18]
push ecx
push 0x4063f0
push edx
call edi
add esp, 0xc
lea eax, [esp + 0x18]
push 0x14
push 0x406434
push 1
push 0x40642c
push eax
push 0x80000000
call esi
pop edi
pop esi
add esp, 0x114
ret
Function at 0x403de0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
push ebx
push esi
push edi
xor ebx, ebx
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x263]
mov byte [ebp - 0x264], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x15f]
mov byte [ebp - 0x160], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 0xc]
mov edx, 1
cmp eax, ebx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], edx
je 0x403e35
mov ebx, edx
js 0x403e45
mov edx, edx
jns 0x403e45
sub eax, 0x1bf31dd6
xchg esi, eax
and byte [ebx], 0xc3
cmp dword [ebx + 0x3d8b0875], ecx
mov ah, 0x50
inc eax
add byte [esi - 0x73], dl
test dword [eax + 0x68fffffe], esp
xchg esp, eax
pushal
inc eax
add byte [eax - 1], dl
xlatb
mov esi, dword [ebp + 8]
mov edi, dword [sym.imp.MSVCRT.dll_sprintf]
push esi
lea eax, [ebp - 0x160]
push 0x406094
push eax
call edi
add esp, 0xc
lea ecx, [ebp - 0x264]
push esi
push 0x4060ac
push ecx
call edi
lea eax, [ebp - 0x160]
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], ecx
lea eax, [ebp - 4]
lea ecx, [ebp - 8]
mov dword [ebp - 0x14], eax
in al, dx
mov dword [ebp - 0x10], ecx
lea edi, [ebp - 0x160]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, esi
mov dword [ebp - 0x48], ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
mov edx, 4
dec ecx
mov dword [ebp - 0x34], 0x4060d4
mov dword [ebp - 0x30], 0x4060e0
mov dword [ebp - 0x2c], 0x4060ec
mov dword [ebp - 0x28], 0x4060fc
mov dword [ebp - 0x24], 0x406104
mov dword [ebp - 0x5c], 2
mov dword [ebp - 0x58], 1
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x38], edx
jle 0x403f0a
mov ax, ax
mov cx, cx
jg 0x403f0a
aaa
jecxz 0x403e86
hlt
cmp ebx, 5
jae 0x403f4a
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueA]
lea esi, [ebx*4]
mov edx, dword [ebp + esi - 0x48]
mov eax, dword [ebp + esi - 0x20]
mov ecx, dword [ebp + esi - 0x5c]
push edx
mov edx, dword [ebp + esi - 0x34]
push eax
push ecx
lea eax, [ebp - 0x264]
push edx
push eax
push 0x80000002
call edi
test eax, eax
jne 0x403f56
add esi, 4
cmp esi, 0x14
jb 0x403f1c
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403fd0
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
push edi
mov ecx, 0x7f
xor eax, eax
lea edi, [ebp - 0x207]
mov byte [ebp - 0x208], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.00404340
test eax, eax
jne 0x404005
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 8]
cmp esi, 0xffffffff
jne 0x40403d
call fcn.004042b0
test eax, eax
je 0x40402a
push bx
push edx
push edi
or dh, dh
xor bx, cx
pop edi
pop edx
pop bx
mov esi, 0xc
jmp 0x40403d
jbe 0x404038
mov di, di
xchg edi, edi
ja 0x404038
and eax, 0xe2f4cc58
mov esi, 0xd
push edi
or edi, 0x693
or di, 0xd76
or edi, 0x291a
sub di, bx
test di, 0x481d
xor di, 0x7174
and di, di
pop edi
lea eax, [ebp - 8]
push 0
push eax
push 0
push 0x40
push 1
push 0x406278
call dword [0x42094c]
test eax, eax
je 0x404084
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
jle 0x404096
jg 0x404096
inc ebx
xor byte [eax - 0x74c625aa], cl
dec ebp
clc
mov ecx, dword [ebp - 8]
mov eax, dword [ecx + 0x18]
js 0x4040aa
jns 0x4040aa
add eax, 0x5415ff50
or dword [edx], eax
push eax
call dword [0x420954]
jp 0x4040c8
push edi
mov di, 0xb224
pop edi
jnp 0x4040c8
xchg edx, eax
clc
mov esi, 0x34a96cf4
inc eax
lds ebp, [0x5617b43a]
push esi
push eax
lea edx, [ebp - 0x208]
push 0x406288
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
je 0x4040f0
push cx
mov cl, 0x54
pop cx
jne 0x4040f0
push ss
pop edi
push 0x47
test eax, 0x6a18c5
push 0
push 0
push 0
push 0
push 0x420940
call dword [0x420950]
test eax, eax
mov dword [ebp + 8], eax
jne 0x404111
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
jbe 0x40411f
mov di, di
xchg edi, edi
ja 0x40411f
and eax, 0xe2f4cc58
lea ecx, [ebp - 4]
push 4
push ecx
push 2
push eax
mov dword [ebp - 4], 0xbb8
call dword [0x420948]
pushal
test ax, 0xc7b
test ah, ch
or cx, 0x31fd
mov bx, ax
popal
mov esi, dword [ebp + 8]
push 0
push 0x84000000
push 0
lea edx, [ebp - 0x208]
push 0
push edx
push esi
call dword [0x420944]
test eax, eax
jne 0x404175
push esi
call dword [0x420958]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
jbe 0x404186
xchg ecx, ecx
xchg dl, dl
ja 0x404186
pop eax
push eax
call dword [0x420958]
push esi
call dword [0x420958]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4041a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, 1
jo 0x4041b9
push ecx
mov ecx, 0x9bcdcc09
pop ecx
jno 0x4041b9
inc eax
movsd dword es:[edi], dword [esi]
mov edx, 0x8b0c4d8b
push ebp
or byte [ebp + 0x6850fc45], cl
aas
add byte [edi], cl
add byte [edx], ch
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4041de
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
push ebx
push ecx
mov cl, 0x6d
inc ebx
pop ecx
pop ebx
pop eax
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp - 4]
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x404209
xor esi, esi
jle 0x404217
mov si, si
mov si, si
jg 0x404217
fsub qword [ebp + 0x558b92c9]
cld
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404340
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [0x42095c]
push ebx
push esi
push edi
test eax, eax
je 0x404355
mov eax, 1
pop edi
pop esi
pop ebx
ret
push ebx
add bx, ax
mov bx, 0x6602
and bh, dl
pop ebx
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x406184
call esi
mov ecx, eax
test ecx, ecx
jne 0x404377
pop edi
pop esi
pop ebx
ret
push eax
push edx
cmp dh, al
mov eax, 0x2562
add ax, di
test ax, 0x5cb2
cmp ax, di
cmp ax, di
or al, 0x4c
or eax, ecx
pop edx
pop eax
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x406190
push ecx
call edi
test eax, eax
mov dword [0x42094c], eax
jne 0x4043ae
pop edi
pop esi
pop ebx
ret
push ebx
add bx, ax
mov bx, 0x6602
and bh, dl
pop ebx
push 0x40619c
call esi
test eax, eax
jne 0x4043c8
pop edi
pop esi
pop ebx
ret
je 0x4043d1
mov ch, ch
xchg esi, esi
jne 0x4043d1
inc esp
push 0x4061a8
push eax
call edi
test eax, eax
mov dword [0x420954], eax
jne 0x4043e6
pop edi
pop esi
pop ebx
ret
jp 0x404402
mov ebx, ebx
mov esi, esi
xchg bx, bx
jnp 0x404402
psrlw mm1, qword [edx + 0x13]
enter 0x626d, 0x3f
daa
in eax, 0x78
retf
push 0x4061b4
call esi
mov ebx, eax
test ebx, ebx
jne 0x404413
pop edi
pop esi
pop ebx
ret
jl 0x40441e
push ebx
mov bh, 0x4c
pop ebx
jge 0x40441e
xchg edx, eax
cmp eax, 0x4061c068
add byte [ebx - 1], dl
xlatb
push 0x4061c0
push ebx
call edi
test eax, eax
mov dword [0x420950], eax
jne 0x404433
pop edi
pop esi
pop ebx
ret
jbe 0x40443d
push esi
pop esi
ja 0x40443d
pop ebx
hlt
push 0x4061d0
push ebx
call edi
test eax, eax
mov dword [0x420944], eax
jne 0x404452
pop edi
pop esi
pop ebx
ret
push eax
push edx
push esi
test si, 0x2af8
xor edx, ecx
add ax, bx
or ax, 0x11a9
pop esi
pop edx
pop eax
push 0x4061e4
push ebx
call edi
test eax, eax
mov dword [0x420948], eax
jne 0x40447b
pop edi
pop esi
pop ebx
ret
je 0x40448a
mov di, di
mov edx, edx
xchg ebx, ebx
jne 0x40448a
enter 0x5e1b, 0x11
push 0x4061f8
push ebx
call edi
test eax, eax
mov dword [0x420958], eax
jne 0x40449f
pop edi
pop esi
pop ebx
ret
jbe 0x4044b9
xchg bh, bh
xchg edi, edi
ja 0x4044b9
cmp eax, eax
xchg esp, eax
movsd dword es:[edi], dword [esi]
mov bh, 0xdf
mov ebp, 0xb8e181d0
add dword [eax], eax
add byte [eax], al
mov eax, 1
pop edi
pop esi
mov dword [0x42095c], eax
pop ebx
ret
Function at 0x404610
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
mov dword [ebp - 4], esi
jne 0x404646
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
jb 0x404657
nop
nop
nop
nop
jae 0x404657
xor edi, dword [edi + 0xe58be73]
lea ebx, [ebp + 0x10558b76]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
lea ecx, [ebp + 8]
push 0
push ecx
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x404677
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
or di, 0x74e3
sub di, ax
cmp di, dx
and edi, 0x25ec
and di, 0x51b8
or di, di
pop edi
mov eax, dword [0x420964]
test eax, eax
je 0x4046ae
push esi
call fcn.00404530
add esp, 4
neg eax
sbb eax, eax
inc eax
mov dword [0x420964], eax
pushal
test si, 0x3660
add si, 0x20c2
test edi, eax
popal
mov esi, dword [ebp - 4]
push esi
push 0
call fcn.00402140
add esp, 8
jl 0x4046df
push cx
mov ch, 0xcc
pop cx
jge 0x4046df
xchg esi, eax
xor esp, dword [ebx - 0x5f]
or dword fs:[edx], eax
mov eax, dword [0x420964]
test eax, eax
jne 0x4046ef
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4049d0
Capabilities:
Create process on windows
Get common file path

Disassembly:
sub esp, 0x82c
xor eax, eax
push ebx
mov dword [esp + 5], eax
push ebp
mov dword [esp + 0xd], eax
push esi
mov dword [esp + 0x15], eax
push edi
xor ebx, ebx
mov word [esp + 0x1d], ax
mov ecx, 0x40
lea edi, [esp + 0x2d]
mov byte [esp + 0x1f], al
mov byte [esp + 0x2c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x131]
mov byte [esp + 0x130], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x43d]
mov byte [esp + 0x43c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x338]
push 0x104
push ecx
mov byte [esp + 0x18], bl
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [esp + 0x130]
push 0x104
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x10]
push 6
push eax
call fcn.00404930
add esp, 8
lea ecx, [esp + 0x10]
lea edx, [esp + 0x338]
lea eax, [esp + 0x234]
push ecx
push edx
push 0x40644c
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
mov dword [esp + 0x20], 0x4064f4
mov dword [esp + 0x24], 0x4064f8
mov dword [esp + 0x28], 0x406504
lea edx, [esp + 0x20]
mov ebp, 3
lea edi, [esp + 0x2c]
or ecx, 0xffffffff
xor eax, eax
lea ebx, [esp + 0x2c]
repne scasb al, byte es:[edi]
mov edi, dword [edx]
add edx, 4
not ecx
dec ecx
mov byte [esp + ecx + 0x2c], 0xa
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
dec ebp
rep movsb byte es:[edi], byte [esi]
jne 0x404ab7
movsx ecx, byte [esp + 0x338]
lea edx, [esp + 0x130]
push ecx
lea eax, [esp + 0x134]
push edx
lea ecx, [esp + 0x34]
push eax
lea edx, [esp + 0x448]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
lea edi, [esp + 0x450]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x450]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, 0x40651c
mov byte [esp + ecx + 0x450], 0xa
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x450]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x450]
push ecx
push eax
lea ecx, [esp + 0x250]
push 0x406448
push ecx
call fcn.004035e0
add esp, 0x24
test eax, eax
pop edi
pop esi
pop ebp
pop ebx
jne 0x404ba9
add esp, 0x82c
ret
lea edx, [esp + 0x224]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov eax, 1
add esp, 0x82c
ret
Function at 0x404bd0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push 0
push eax
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0xcf0000
push 0x420940
push 0x420928
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov ecx, eax
test ecx, ecx
jne 0x404c0a
pop ebp
ret
push eax
push edx
xor al, 0x3d
sub ah, 0x2b
add eax, 0x7c28
or dh, dl
xor ax, dx
cmp ax, 0x4001
pop edx
pop eax
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
pop ebp
ret

Function at 0x4014d1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp - 0x134]
sub esp, 0x154
mov dword [ebp - 0x134], 0
mov dword [esp], eax
lea ebx, [ebp - 0x10c]
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x118], 6
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x120], 0
call dword [sym.imp.USER32.dll_RegisterClassA]
push ecx
mov dword [esp + 4], ebx
mov dword [esp], 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push eax
push eax
mov dword [esp], ebx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x80000000
call dword [sym.imp.KERNEL32.dll_CreateFileA]
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [ebp - 4]
leave
sub eax, 3
ret

Function at 0x40159e
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xa4
mov dword [ebp - 0x88], 0
call fcn.004014d1
test eax, eax
jne 0x401638
lea eax, [ebp - 0x8c]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
mov eax, 0x4020ce
sub eax, 0x40166c
mov dword [esp], 0x40166c
mov dword [esp + 4], eax
mov dword [ebp - 0x8c], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp dword [ebp - 0x8c], 0
je 0x401638
lea ebx, [ebp - 0x88]
mov dword [esp], 0
call fcn.004013d1
mov dword [esp + 4], ebx
mov dword [esp], 0
call fcn.0040144c
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1b600
mov dword [esp], str.g_n_p
call fcn.00401dd1
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x423e6d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00423cec

Function at 0x427fa7
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00427c67