joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405ef4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a34], 0
push esi
jne 0x405f2b
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f05
mov dword [ecx*4 + 0x422a30], eax
inc ecx
cmp ecx, 0x100
jl 0x405f00
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f5c
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a30]
xor eax, esi
inc ecx
dec edx
jne 0x405f3e
pop edi
not eax
pop esi
ret 0xc

Function at 0x42a030
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1d000]
push edi
jmp 0x42a04a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x42a051
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x42a040
mov eax, 1
add ebx, ebx
jne 0x42a063
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x42a058
jne 0x42a074
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42a058
xor ecx, ecx
sub eax, 3
jb 0x42a088
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42a0fa
mov ebp, eax
add ebx, ebx
jne 0x42a093
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x42a0a0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x42a0c4
inc ecx
add ebx, ebx
jne 0x42a0b0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x42a0a5
jne 0x42a0c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42a0a5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x42a0e4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x42a0d5
jmp 0x42a046
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x42a0e4
add edi, ecx
jmp 0x42a046
pop esi
mov edi, esi
mov ecx, 0x190
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x42a102
cmp byte [edi], 1
jne 0x42a102
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x42a107
lea edi, [esi + 0x28000]
mov eax, dword [edi]
or eax, eax
je 0x42a17f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2a460]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2a500]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x42a134
mov ecx, edi
jns 0x42a163
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2a504]
or eax, eax
je 0x42a179
mov dword [ebx], eax
add ebx, 4
jmp 0x42a151
call dword [esi + 0x2a514]
mov ebp, dword [esi + 0x2a508]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42a1b3
sub esp, 0xffffff80
jmp 0x40380e
Function at 0x1001798
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push edi
xor edi, edi
mov dword [ebp - 4], 0x80004005
cmp dword [ebp + 8], edi
je 0x1001841
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
cmp esi, edi
je 0x1001840
push 0x1001238
push 0x1f4
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 8], eax
cmp eax, edi
je 0x1001840
push ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push edi
push 0x80
push 2
push edi
push edi
push 0x40000000
push dword [ebp + 8]
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, edi
je 0x100183f
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 0xc]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
lea ecx, [ebp + 8]
push ecx
push esi
push eax
push ebx
mov dword [ebp + 8], edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 8], esi
jne 0x100183f
mov dword [ebp - 4], edi
pop ebx
pop esi
mov eax, dword [ebp - 4]
pop edi
leave
ret 4

Function at 0x100184e
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x40
push esi
xor esi, esi
push 0x3c
lea eax, [ebp - 0x40]
push esi
push eax
mov dword [ebp - 4], esi
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
add esp, 0xc
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x3c], 0x40
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x20], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
pop esi
test eax, eax
je 0x10018d7
push 0xffffffffffffffff
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x10018cc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10018e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
leave
ret 8
Function at 0x1001a42
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x1005074]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x214], eax
lea eax, [ebp - 0x20c]
push eax
mov esi, 0x104
push esi
mov dword [ebp - 0x210], 0x80004005
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, esi
jae 0x1001ac8
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0x10]
push edi
call fcn.010018ec
mov dword [ebp - 0x210], eax
test eax, eax
jl 0x1001ac8
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x1001270
push dword [ebp + 0x18]
push dword [ebp - 0x214]
call fcn.0100195b
add esp, 0x14
mov dword [ebp - 0x210], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x210]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01002632
leave
ret 0x14

Function at 0x1001b22
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xe20
mov eax, dword [0x1005074]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
xor eax, eax
push 0x7fe
mov word [ebp - 0xe1c], ax
xor ebx, ebx
lea eax, [ebp - 0xe1a]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x400
lea eax, [ebp - 0xe1c]
push eax
push esi
call fcn.010019ba
test eax, eax
jl 0x1001caa
xor eax, eax
mov edi, 0x206
push edi
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push edi
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0x18
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
push esi
lea eax, [ebp - 0x414]
push eax
push 0x10012a0
call fcn.01001a42
test eax, eax
jl 0x1001ca3
lea eax, [ebp - 0x20c]
push eax
call fcn.01001798
test eax, eax
jl 0x1001c9c
push 0x10053a4
lea ecx, [ebp - 0xe20]
call fcn.01001ae4
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0xe20]
call fcn.01004399
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jl 0x1001c7e
xor eax, eax
push edi
push eax
mov word [ebp - 0x61c], ax
lea eax, [ebp - 0x61a]
push eax
call sub.msvcrt.dll_memset
push 0x100127c
lea eax, [ebp - 0x414]
push eax
push 0x1001270
lea eax, [ebp - 0x61c]
push esi
push eax
call fcn.0100195b
add esp, 0x20
test eax, eax
jl 0x1001c77
lea eax, [ebp - 0xe1c]
push eax
lea eax, [ebp - 0x61c]
push eax
call fcn.0100184e
mov esi, eax
lea eax, [ebp - 0x61c]
push eax
call ebx
jmp 0x1001c83
mov esi, 0x4e25
jmp 0x1001c83
mov esi, 0x4e24
lea eax, [ebp - 0x20c]
push eax
call ebx
mov ecx, dword [ebp - 0xe20]
add ecx, 0xfffffff0
call fcn.01001674
jmp 0x1001caf
mov esi, 0x4e23
jmp 0x1001caf
mov esi, 0x4e22
jmp 0x1001caf
mov esi, 0x4e21
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.01002632
leave
ret 0x10
Function at 0x10025f1
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x1004c18
call fcn.01002f24
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x20], ebx
mov edi, 0x10057cc
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x10023ac
cmp eax, esi
jne 0x100239f
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0x10023af
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1002386
xor esi, esi
inc esi
mov eax, dword [0x10057c8]
cmp eax, esi
jne 0x10023c2
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x10023f1
mov eax, dword [0x10057c8]
test eax, eax
jne 0x10023eb
mov dword [0x10057c8], esi
push 0x1001028
push 0x100101c
call fcn.010022e8
pop ecx
pop ecx
test eax, eax
je 0x10023f1
jmp 0x1002515
mov dword [0x1005424], esi
mov eax, dword [0x10057c8]
cmp eax, esi
jne 0x1002415
push 0x1001018
push section..text
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x10057c8], 2
cmp dword [ebp - 0x20], ebx
jne 0x1002422
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x10057dc], ebx
je 0x1002443
push 0x10057dc
call fcn.01002e99
pop ecx
test eax, eax
je 0x1002443
push ebx
push 2
push ebx
call dword [0x10057dc]
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
cmp dword [eax], ebx
je 0x1002515
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
movzx ecx, word [eax]
cmp cx, 0x20
ja 0x10024ad
cmp cx, bx
je 0x1002468
cmp dword [ebp - 0x1c], ebx
jne 0x10024ad
movzx ecx, word [eax]
cmp cx, bx
je 0x100247d
cmp cx, 0x20
ja 0x100247d
inc eax
inc eax
mov dword [ebp - 0x24], eax
jmp 0x1002468
test byte [ebp - 0x40], 1
je 0x1002489
movzx ecx, word [ebp - 0x3c]
jmp 0x100248c
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x1000000
call main
mov dword [0x1005420], eax
cmp dword [0x1005414], ebx
jne 0x10024f2
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp cx, 0x22
jne 0x10024be
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
inc eax
inc eax
jmp 0x1002452
cmp dword [0x1005424], ebx
jne 0x1002500
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1005420]
jmp 0x1002521
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.01002f69
ret
call fcn.01003047
jmp 0x1002349
Function at 0x10038fe
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1003957
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x1003949
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x1003945
cmp esi, eax
jae 0x1003949
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x1003937
cmp esi, eax
jb 0x100394d
xor eax, eax
jmp 0x1003956
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop ebp
ret 0xc

Function at 0x1004399
Capabilities:
Check if file exists

Disassembly:
push 0x128
mov eax, 0x1004a4a
call fcn.0100267f
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov esi, ecx
mov dword [ebp - 0x120], 0x80004005
test edi, edi
je 0x1004567
test ebx, ebx
je 0x1004567
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1004567
push ebx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x1004567
push edi
lea ecx, [ebp - 0x11c]
call fcn.010042f1
and dword [ebp - 4], 0
push 0x5c
pop edi
push edi
lea ecx, [ebp - 0x11c]
call fcn.01003ca8
inc eax
push eax
lea eax, [ebp - 0x124]
push eax
lea ecx, [ebp - 0x11c]
call fcn.01003efb
push edi
lea ecx, [ebp - 0x11c]
mov byte [ebp - 4], 1
call fcn.01003ca8
inc eax
push eax
lea eax, [ebp - 0x128]
push eax
lea ecx, [ebp - 0x11c]
call fcn.01003f25
push ebx
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.0100423a
mov eax, dword [esi]
push dword [eax - 0xc]
mov ecx, esi
call fcn.01003df3
cmp ax, di
je 0x1004464
push edi
mov ecx, esi
call fcn.010040fa
and dword [ebp - 0x134], 0
xor eax, eax
lea edi, [ebp - 0x130]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x134]
push eax
push 0xffffffffffffffff
push 0x1003b5f
push fcn.01003b43
push 0x1003b11
push 0x1003adf
push 0x1003ab1
push 0x1003aa1
push 0x1003a91
call sub.Cabinet.dll_FDICreate
mov edi, eax
xor ebx, ebx
add esp, 0x24
cmp edi, ebx
je 0x100453d
push dword [ebp - 0x128]
lea ecx, [ebp - 0x118]
call fcn.01002185
push dword [ebp - 0x124]
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 3
call fcn.01002185
push esi
push ebx
push 0x1004337
push ebx
push dword [ebp - 0x118]
push dword [ebp - 0x94]
push edi
call sub.Cabinet.dll_FDICopy
add esp, 0x1c
test eax, eax
je 0x1004502
mov dword [ebp - 0x120], ebx
push edi
call sub.Cabinet.dll_FDIDestroy
mov esi, dword [sym.imp.msvcrt.dll_free]
lea eax, [ebp - 0x90]
pop ecx
cmp dword [ebp - 0x94], eax
je 0x1004526
push dword [ebp - 0x94]
call esi
pop ecx
lea eax, [ebp - 0x114]
cmp dword [ebp - 0x118], eax
je 0x100453d
push dword [ebp - 0x118]
call esi
pop ecx
mov ecx, dword [ebp - 0x128]
add ecx, 0xfffffff0
call fcn.01001674
mov ecx, dword [ebp - 0x124]
add ecx, 0xfffffff0
call fcn.01001674
mov ecx, dword [ebp - 0x11c]
add ecx, 0xfffffff0
call fcn.01001674
mov eax, dword [ebp - 0x120]
call fcn.010026d3
ret 8
Function at 0x10047ec
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x1005074]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
call fcn.0100472d
mov eax, 0x1000000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x98]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
jne 0x100485f
cmp dword [ebp - 0x94], 5
jb 0x1004880
jmp 0x100487c
cmp dword [ebp - 0x88], 1
jne 0x1004880
cmp dword [ebp - 0x94], 4
ja 0x100487c
jne 0x1004880
cmp dword [ebp - 0x90], 0
jbe 0x1004880
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x10014c8
call fcn.010045c4
test eax, eax
jge 0x10048a1
mov byte [0x1005394], 1
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.01002632
leave
ret
Function at 0x407f31
Capabilities:
Encode data using base64

Disassembly:
mov eax, 0x47248e
call fcn.004535cc
sub esp, 0x10
push esi
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], esi
mov ecx, dword [ebp + 8]
call fcn.00403ce8
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], 1
cmp dword [ebp + 0x10], esi
je 0x408081
push edi
mov edi, dword [ebp + 0xc]
push ebx
mov al, byte [edi]
dec dword [ebp + 0x10]
mov byte [ebp + esi - 0x10], al
mov bl, byte [ebp - 0xf]
inc esi
inc edi
cmp esi, 3
jne 0x407fdb
mov al, byte [ebp - 0x10]
shr al, 2
mov byte [ebp - 0x14], al
mov al, byte [ebp - 0x10]
and al, 3
shl al, 4
mov cl, bl
shr cl, 4
add al, cl
mov cl, byte [ebp - 0xe]
mov byte [ebp - 0x13], al
mov al, bl
and al, 0xf
shl al, 2
shr cl, 6
add al, cl
mov byte [ebp - 0x12], al
mov al, byte [ebp - 0xe]
and al, 0x3f
mov byte [ebp - 0x11], al
xor esi, esi
movzx eax, byte [ebp + esi - 0x14]
push eax
mov ecx, 0x49f8d4
call fcn.004036e2
mov al, byte [eax]
mov ecx, dword [ebp + 8]
mov byte [ebp - 0x1c], al
push dword [ebp - 0x1c]
push 1
call fcn.00403de1
inc esi
cmp esi, 4
jl 0x407fb1
xor esi, esi
cmp dword [ebp + 0x10], 0
jne 0x407f67
xor edi, edi
cmp esi, edi
je 0x40807f
cmp esi, 3
jge 0x408007
push 3
pop ecx
sub ecx, esi
push ecx
lea eax, [ebp + esi - 0x10]
push edi
push eax
call fcn.00454e90
mov bl, byte [ebp - 0xf]
add esp, 0xc
mov al, byte [ebp - 0x10]
mov cl, al
shr cl, 2
mov byte [ebp - 0x14], cl
and al, 3
mov cl, bl
shl al, 4
shr cl, 4
add al, cl
mov byte [ebp - 0x13], al
mov al, byte [ebp - 0xe]
and bl, 0xf
mov cl, al
shl bl, 2
shr cl, 6
add bl, cl
mov byte [ebp - 0x12], bl
and al, 0x3f
lea ebx, [esi + 1]
mov byte [ebp - 0x11], al
test ebx, ebx
jle 0x408067
movzx eax, byte [ebp + edi - 0x14]
push eax
mov ecx, 0x49f8d4
call fcn.004036e2
mov al, byte [eax]
mov ecx, dword [ebp + 8]
mov byte [ebp + 0x10], al
push dword [ebp + 0x10]
push 1
call fcn.00403de1
inc edi
cmp edi, ebx
jl 0x408040
push 3
pop edi
cmp esi, edi
jge 0x40807f
sub edi, esi
mov ecx, dword [ebp + 8]
push 0x3d
push 1
call fcn.00403de1
dec edi
jne 0x408070
pop ebx
pop edi
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x40bcbc
Capabilities:
Create directory

Disassembly:
mov eax, 0x472b63
call fcn.004535cc
sub esp, 0x14
push ebx
push esi
push edi
and dword [ebp - 4], 0
and dword [ebp - 0x14], 0
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.00401407
lea eax, [ebp - 0x20]
mov esi, 0x49faac
push eax
mov ecx, esi
mov dword [ebp - 0x14], ebx
call fcn.0041c7a4
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 2
push ebx
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
call fcn.0041c5d0
mov byte [ebp - 4], 3
push dword [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.004146c6
add esp, 0xc
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x1c]
call fcn.00401436
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x20]
call fcn.00401436
push 0x47ad14
push 0x47badc
lea ecx, [ebp - 0x10]
call fcn.00414362
lea eax, [ebp - 0x10]
push eax
mov ecx, edi
call fcn.0040b964
push 0x47bad8
mov ecx, edi
call fcn.004147e5
mov eax, dword [edi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40bd9f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x40bd9f
push ebx
lea eax, [ebp - 0x20]
push eax
mov ecx, esi
call fcn.0041c5d0
mov byte [ebp - 4], 7
push eax
mov ecx, edi
call fcn.0040ba16
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x20]
call fcn.00401436
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x10]
call fcn.00401436
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.00401436
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x40ccf8
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x472e49
call fcn.004535cc
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor esi, esi
mov dword [ebp - 4], esi
push str.openUrlOnDefaultBrowser
mov ecx, 0x49fb88
call fcn.004019b3
mov byte [ebp - 4], 1
push 1
push esi
push esi
push dword [ebp + 8]
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 4], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401436
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x41a96a
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x3c]
add eax, ecx
movzx ecx, word [eax + 0x14]
push ebx
movzx ebx, word [eax + 6]
lea edx, [ecx + eax + 0x18]
push esi
xor ecx, ecx
push edi
test ebx, ebx
jle 0x41a9ad
lea eax, [edx + 8]
mov edi, dword [eax]
test edi, edi
jne 0x41a996
mov edi, dword [eax + 8]
mov esi, dword [eax + 4]
cmp dword [ebp + 0xc], esi
jb 0x41a9a5
add esi, edi
cmp dword [ebp + 0xc], esi
jb 0x41a9b4
inc ecx
add eax, 0x28
cmp ecx, ebx
jl 0x41a98d
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
imul ecx, ecx, 0x28
add ecx, edx
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
add eax, dword [ebp + 8]
add eax, dword [ebp + 0xc]
jmp 0x41a9af

Function at 0x41a9c7
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x3c]
mov edx, 0x5a4d
add eax, ecx
cmp word [ecx], dx
je 0x41a9e0
xor eax, eax
pop ebp
ret
cmp dword [eax], 0x4550
jne 0x41a9dc
mov edx, 0xe0
cmp word [eax + 0x14], dx
jb 0x41a9dc
push dword [eax + 0x88]
push ecx
call fcn.0041a96a
pop ecx
pop ecx
pop ebp
ret
Function at 0x41ae3d
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x628
push esi
mov esi, dword [ebp + 8]
push 0x25
push esi
call fcn.004571e5
pop ecx
pop ecx
test eax, eax
jne 0x41ae60
or eax, 0xffffffff
jmp 0x41af3d
add eax, 2
push 0x25
push eax
call fcn.004571e5
pop ecx
pop ecx
test eax, eax
je 0x41ae58
xor eax, eax
push ebx
mov word [ebp - 0x210], ax
push edi
lea edi, [ebp - 0x210]
cmp word [esi], ax
je 0x41af13
movzx eax, word [esi]
cmp ax, 0x25
je 0x41ae9d
mov word [edi], ax
inc edi
inc edi
inc esi
inc esi
jmp 0x41af09
lea ebx, [esi + 2]
push 0x25
push ebx
call fcn.004571e5
pop ecx
pop ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x41af40
sub eax, esi
sar eax, 1
push eax
push ebx
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0x104
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jbe 0x41af03
lea eax, [ebp - 0x41c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [edi + eax*2]
mov esi, dword [ebp - 4]
add esi, 2
cmp word [esi], 0
jne 0x41ae8b
xor eax, eax
mov word [edi], ax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x41af39
lea eax, [ebp - 0x210]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
xor eax, eax
pop edi
pop ebx
pop esi
leave
ret
or eax, 0xffffffff
jmp 0x41af3b
Function at 0x41b1c2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
push 0
push dword [ebp + 0x14]
call fcn.0040925f
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x18], 8
mov dword [ebp - 4], 0x400
jb 0x41b1ef
mov eax, dword [eax + 4]
jmp 0x41b1f2
add eax, 4
push esi
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp - 0x404]
push ecx
push 0
push 0
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x41b221
mov ecx, dword [ebp + 0x10]
lea eax, [ebp - 0x404]
push eax
call fcn.0040940c
mov eax, esi
pop esi
leave
ret