joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406de0
Capabilities:
Hide graphical window

Disassembly:
push 0
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80
push eax
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_SetWindowLongA
push 5
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x411710
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xa000]
push edi
jmp 0x41172a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x411731
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x411720
mov eax, 1
add ebx, ebx
jne 0x411743
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x411738
jne 0x411754
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x411738
xor ecx, ecx
sub eax, 3
jb 0x411768
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4117da
mov ebp, eax
add ebx, ebx
jne 0x411773
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x411780
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4117a4
inc ecx
add ebx, ebx
jne 0x411790
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x411785
jne 0x4117a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x411785
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4117c4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4117b5
jmp 0x411726
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4117c4
add edi, ecx
jmp 0x411726
pop esi
mov edi, esi
mov ecx, 0x27e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4117e2
cmp byte [edi], 5
jne 0x4117e2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4117e7
lea edi, [esi + 0xf000]
mov eax, dword [edi]
or eax, eax
je 0x411856
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x12cd0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x12cf8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x411814
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x12cfc]
or eax, eax
je 0x411850
mov dword [ebx], eax
add ebx, 4
jmp 0x411831
call dword [esi + 0x12d0c]
mov ebp, dword [esi + 0x12d00]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41188a
sub esp, 0xffffff80
jmp 0x4022e2
Function at 0x401e50
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push edi
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
lea ecx, [esp + 0x14]
mov edx, dword [esp + 0x5c]
push eax
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push edx
mov dword [esp + 0x3c], 0x44
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
pop edi
add esp, 0x54
ret

Function at 0x402000
Capabilities:
Read file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx]
lea eax, [esp + 8]
push 0
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov eax, dword [esp + 8]
ret 8

Function at 0x402030
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx]
lea eax, [esp + 8]
push 0
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
ret 8

Function at 0x419610
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x11000]
push edi
or ebp, 0xffffffff
jmp 0x419632
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x419639
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x419628
mov eax, 1
add ebx, ebx
jne 0x41964b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x419640
jne 0x41965c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419640
xor ecx, ecx
sub eax, 3
jb 0x419670
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4196e2
mov ebp, eax
add ebx, ebx
jne 0x41967b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x419688
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4196ac
inc ecx
add ebx, ebx
jne 0x419698
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41968d
jne 0x4196a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41968d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4196cc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4196bd
jmp 0x41962e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4196cc
add edi, ecx
jmp 0x41962e
pop esi
mov edi, esi
mov ecx, 0x5ce
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4196ea
cmp byte [edi], 0
jne 0x4196ea
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x4196ef
lea edi, [esi + 0x17000]
mov eax, dword [edi]
or eax, eax
je 0x41975e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x191e8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1924c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41971c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19250]
or eax, eax
je 0x419758
mov dword [ebx], eax
add ebx, 4
jmp 0x419739
call dword [esi + 0x19254]
popal
jmp 0x40e274
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x365f142f
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x76971e87
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
jmp 0x401219

Function at 0x431003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43100c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403e6a
nop
sub eax, reloc.kernel32.dll_GetTimeFormatA
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x431030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43101e
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x49bad0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x64000]
push edi
jmp 0x49baea
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x49baf1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x49bae0
mov eax, 1
add ebx, ebx
jne 0x49bb03
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x49bb14
jne 0x49bb33
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x49bb33
dec eax
add ebx, ebx
jne 0x49bb20
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x49baf8
add ebx, ebx
jne 0x49bb2f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x49bb85
xor ecx, ecx
sub eax, 3
jb 0x49bb4b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x49bbba
sar eax, 1
mov ebp, eax
jmp 0x49bb56
add ebx, ebx
jne 0x49bb56
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x49bb24
inc ecx
add ebx, ebx
jne 0x49bb64
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x49bb24
add ebx, ebx
jne 0x49bb71
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x49bb66
jne 0x49bb82
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x49bb66
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x49bba4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x49bb96
jmp 0x49bae6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x49bba4
add edi, ecx
jmp 0x49bae6
pop esi
mov edi, esi
mov ecx, 0x318d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x49bbc2
cmp byte [edi], 0x1b
jne 0x49bbc2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x49bbc7
lea edi, [esi + 0x98000]
mov eax, dword [edi]
or eax, eax
je 0x49bc3f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xa1fa0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xa20b8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x49bbf4
mov ecx, edi
jns 0x49bc23
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xa20bc]
or eax, eax
je 0x49bc39
mov dword [ebx], eax
add ebx, 4
jmp 0x49bc11
call dword [esi + 0xa20cc]
mov ebp, dword [esi + 0xa20c0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x49bc73
sub esp, 0xffffff80
jmp 0x453e3d
Function at 0x403015
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x403024
pop dword [ebp - 0x4c]
mov eax, 0x41e9c854
sub eax, 0x41a99830
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x36e1376b
sub dword [ebp - 0x5c], 0xe88ef220
mov dword [ebp - 0x58], 0x5804d143
sub dword [ebp - 0x58], 0x25d184fe
mov dword [ebp - 0x54], 0xa4209c42
sub dword [ebp - 0x54], 0x57d45814
mov dword [ebp - 0x50], 0xf9d72f2e
sub dword [ebp - 0x50], 0xf9d72f2e
lea eax, [ebp - 0x5c]
push eax
mov eax, 0xac0b3fd3
sub eax, 0xabcabf5b
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x19d09736
sub dword [ebp - 0x5c], 0xa55e2de0
mov dword [ebp - 0x58], 0x7e6faef7
sub dword [ebp - 0x58], 0x3d034d82
mov dword [ebp - 0x54], 0x63dfca44
sub dword [ebp - 0x54], 0x705dd8
mov dword [ebp - 0x50], 0x7c0b4ad6
add dword [ebp - 0x50], 0x83f4b52a
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0xcb625d7b
add eax, 0x34de2301
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x391e0
push 0
call eax
mov ecx, 0x5051
xor ebx, ebx
add ebx, eax
mov edx, 0x7d01f5e3
add edx, 0x83439c1d
add edx, dword [ebp - 0x4c]
mov edi, 0x5f7f08ed
xor dword [ebp - 0x30], 0x4864b86c
mov esi, dword [edx]
add dword [ebp - 0x40], 0xd2105efc
sub esi, edi
sub dword [ebp - 0x24], edi
mov dword [ebx], esi
add dword [ebp - 0xc], 0xe5bfeef1
add ebx, 0xe112b910
add ebx, 0x1eed46f4
add edx, 4
loop 0x40313c
add eax, 0x74b38cdc
sub eax, 0x74b258c5
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x40324c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 8], esi
test edi, edi
jne 0x40326c
mov dword [ebp - 8], 0x8000
and dword [ebp - 4], 0
mov dword [ebp - 0xc], edi
test edi, edi
jne 0x40327e
mov dword [ebp - 0xc], 0x422a20
mov eax, dword [ebp + 8]
test eax, eax
jl 0x403293
mov ecx, dword [0x434f78]
add ecx, eax
push ecx
call fcn.0040347d
lea eax, [ebp + 0x14]
push 4
push eax
call fcn.00403467
test eax, eax
je 0x403455
test byte [ebp + 0x17], 0x80
je 0x403400
mov ebx, dword [sym.imp.kernel32.dll_GetTickCount]
call ebx
and dword [0x40d384], 0
and dword [0x40d380], 0
and dword [ebp + 0x14], 0x7fffffff
mov dword [ebp - 0x10], eax
mov eax, 0x40ea08
mov dword [0x40ce68], 8
mov dword [0x416a10], eax
mov dword [0x416a0c], eax
mov eax, dword [ebp + 0x14]
mov dword [0x416a08], 0x416a08
mov dword [ebp + 8], eax
jle 0x40345d
mov esi, 0x4000
cmp dword [ebp + 0x14], esi
jge 0x40330c
mov esi, dword [ebp + 0x14]
mov edi, 0x41ea20
push esi
push edi
call fcn.00403467
test eax, eax
je 0x403455
sub dword [ebp + 0x14], esi
mov dword [0x40ce58], edi
mov dword [0x40ce5c], esi
mov edi, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
push 0x40ce58
mov dword [0x40ce60], edi
mov dword [0x40ce64], eax
call fcn.00403015
test eax, eax
mov dword [ebp - 0x14], eax
jl 0x4033f8
mov esi, dword [0x40ce60]
sub esi, edi
call ebx
test byte [0x434fd4], 1
mov edi, eax
je 0x4033b3
sub eax, dword [ebp - 0x10]
cmp eax, 0xc8
ja 0x40337a
cmp dword [ebp + 0x14], 0
jne 0x4033b3
mov eax, dword [ebp + 8]
push dword [ebp + 8]
sub eax, dword [ebp + 0x14]
push 0x64
push eax
call dword [sym.imp.kernel32.dll_MulDiv]
push eax
lea eax, [ebp - 0x94]
push str....__d__
push eax
call dword [sym.imp.user32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x94]
push eax
push 0
call fcn.00403015
mov dword [ebp - 0x10], edi
test esi, esi
je 0x4033ec
cmp dword [ebp + 0x10], 0
jne 0x4033d2
push esi
push dword [ebp - 0xc]
push dword [ebp + 0xc]
call fcn.00403015
test eax, eax
je 0x4033fc
add dword [ebp - 4], esi
jmp 0x4033e0
mov eax, dword [0x40ce60]
add dword [ebp - 4], esi
sub dword [ebp - 8], esi
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x14], 1
jne 0x40332f
jmp 0x40345d
cmp dword [ebp + 0x14], 0
jg 0x4032ff
jmp 0x40345d
push 0xfffffffffffffffc
jmp 0x403457
push 0xfffffffffffffffe
jmp 0x403457
test edi, edi
jne 0x403442
cmp dword [ebp + 0x14], edi
jle 0x40345d
mov ebx, dword [ebp - 8]
cmp dword [ebp + 0x14], ebx
mov esi, dword [ebp + 0x14]
jl 0x403416
mov esi, ebx
mov edi, 0x41ea20
push esi
push edi
call fcn.00403467
test eax, eax
je 0x403455
push esi
push edi
push dword [ebp + 0xc]
call fcn.00403015
test eax, eax
je 0x4033fc
add dword [ebp - 4], esi
sub dword [ebp + 0x14], esi
cmp dword [ebp + 0x14], 0
jg 0x40340c
jmp 0x40345d
cmp dword [ebp + 0x14], esi
jge 0x40344a
mov esi, dword [ebp + 0x14]
push esi
push edi
call fcn.00403467
test eax, eax
jne 0x40345a
push 0xfffffffffffffffd
pop eax
jmp 0x403460
mov dword [ebp - 4], esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x40605d
Capabilities:
Get file size

Disassembly:
push ebx
mov ebx, dword [sym.imp.kernel32.dll_GetShortPathNameW]
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
test esi, esi
mov dword [0x430908], 0x55004e
mov dword [0x43090c], 0x4c
mov edi, 0x400
mov ebp, 0x430908
je 0x4060b3
push 1
push 0
push esi
call fcn.00405f07
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x4061d2
cmp eax, edi
jg 0x4061d2
mov esi, 0x431108
push edi
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x4061d2
cmp eax, edi
jg 0x4061d2
push esi
push ebp
push str._ls_ls_r_n
push 0x430508
call dword [sym.imp.user32.dll_wsprintfA]
mov ebx, eax
mov eax, dword [0x434f14]
add esp, 0x10
push dword [eax + 0x128]
push esi
call fcn.00403015
push 4
push 0xc0000000
push esi
call fcn.00405f07
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x18], ebp
je 0x4061d2
push 0
push ebp
call dword [sym.imp.kernel32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.kernel32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x4061cb
push edi
push esi
push ebp
call fcn.00403015
test eax, eax
je 0x4061cb
push str._Rename__r_n
push esi
call fcn.00403015
test eax, eax
jne 0x406169
lea eax, [esi + edi]
push str._Rename__r_n
push eax
call dword [sym.imp.kernel32.dll_lstrcpyA]
add edi, 0xa
jmp 0x40619e
add eax, 0xa
push 0x40a580
push eax
call fcn.00403015
mov ebp, eax
test ebp, ebp
je 0x40619a
lea ecx, [esi + edi]
lea eax, [ecx + ebx]
jmp 0x40618b
mov dl, byte [ecx]
mov byte [eax], dl
dec eax
dec ecx
cmp ecx, ebp
ja 0x406185
sub ebp, esi
inc ebp
mov eax, ebp
mov ebp, dword [esp + 0x18]
jmp 0x4061a0
mov ebp, dword [esp + 0x18]
mov eax, edi
push ebx
add eax, esi
push 0x430508
push eax
call fcn.00405ec2
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.kernel32.dll_SetFilePointer]
add edi, ebx
push edi
push esi
push ebp
call fcn.00403015
push esi
call dword [sym.imp.kernel32.dll_GlobalFree]
push ebp
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x4061d7
Capabilities:
Move file

Disassembly:
push 5
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_MoveFileExW]
test eax, eax
jne 0x4061fa
push dword [esp + 8]
push dword [esp + 8]
call fcn.0040605d
pop ecx
pop ecx
inc dword [0x434fb0]
ret 8
Function at 0x46cd10
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x14
xor ecx, ecx
mov word [esp + 2], 0
push ebx
mov cl, byte [0xc386f2]
push esi
mov edx, dword [0xc3aba0]
push edi
lea eax, [ecx + ecx*4]
push ebp
lea eax, [eax + eax*8]
sub eax, ecx
mov eax, dword [eax + edx + 0x94]
lea esi, [eax + 4]
mov eax, dword [eax]
test eax, eax
lea edi, [esi + eax*8]
je 0x46cd50
push ecx
call fcn.0046cfe0
add esp, 4
xor ecx, ecx
mov cl, byte [0xc386f2]
mov eax, ecx
lea edx, [ecx + ecx*4]
mov dword [esp + 0x14], 0
lea ecx, [edx + edx*8]
sub ecx, eax
mov eax, dword [0xc3aba0]
lea edx, [ecx + eax + 0x94]
mov dword [esp + 0x18], edx
mov eax, dword [edx]
cmp dword [eax], 0
jbe 0x46cf00
xor edx, edx
cmp word [esi], dx
jbe 0x46cee7
movzx bx, byte [0xc3ab95]
add bx, 0x1e0
mov ecx, dword [esp + 0x14]
movzx ax, byte [0xc3ab94]
mov word [esp + 0x20], ax
inc cl
mov byte [esp + 0x1c], cl
mov eax, dword [esp + 0x12]
mov cl, byte [esp + 0x1c]
and eax, 0xffff
shl eax, 2
lea eax, [eax + eax*8]
mov byte [eax + 0xaa7ad0], 1
mov byte [eax + 0xaa7ad1], cl
mov cx, word [esi + 2]
and cx, 0x3f
shl cx, 4
mov word [eax + 0xaa7ac0], cx
mov word [eax + 0xaa7ac2], bx
mov cl, byte [edi]
mov byte [eax + 0xaa7abe], cl
mov cl, byte [edi + 1]
mov byte [eax + 0xaa7abf], cl
movzx cx, byte [edi + 2]
add cx, word [esi + 4]
sub cx, 0xa0
mov word [eax + 0xaa7ab4], cx
movzx cx, byte [edi + 3]
add cx, word [esi + 6]
sub cx, 0x78
mov word [eax + 0xaa7ab6], cx
mov bp, word [edi + 4]
mov word [eax + 0xaa7ad2], bp
mov cx, word [edi + 6]
mov bp, cx
and bp, 0x1f
add bp, word [esp + 0x20]
mov word [eax + 0xaa7abc], bp
test ch, 0xf0
jne 0x46ce6a
mov bp, word [edi + 8]
add edi, 0xc
mov word [eax + 0xaa7ab8], bp
mov bp, word [edi - 2]
mov word [eax + 0xaa7aba], bp
jmp 0x46ce87
mov bp, cx
add edi, 8
and bp, 0xf1ff
shr bp, 9
mov word [eax + 0xaa7ab8], bp
mov word [eax + 0xaa7aba], bp
mov dword [eax + 0xaa7ab0], 0x40
test ch, 0xc
jne 0x46cea0
mov dword [eax + 0xaa7ab0], 0x8000040
mov bp, cx
inc edx
and bp, 0x180
shr bp, 7
movzx ebp, bp
and cx, 0x60
shl ebp, 0x18
shr cx, 5
or ebp, dword [eax + 0xaa7ab0]
movzx ecx, cx
inc word [esp + 0x12]
mov dword [eax + 0xaa7ab0], ebp
shl ecx, 0x1c
or ecx, ebp
mov dword [eax + 0xaa7ab0], ecx
xor eax, eax
mov ax, word [esi]
cmp eax, edx
ja 0x46cdb4
add esi, 8
mov eax, dword [esp + 0x18]
inc dword [esp + 0x14]
mov edx, dword [eax]
mov ecx, dword [esp + 0x14]
cmp dword [edx], ecx
ja 0x46cd85
mov eax, dword [0xc3aba0]
mov cl, byte [esp + 0x12]
pop ebp
pop edi
pop esi
mov byte [eax], cl
pop ebx
add esp, 0x14
ret
Function at 0x401480
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401499
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4014d4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x4014d0
lea ebx, [ebx]
cmp esi, eax
jae 0x4014d4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4014c0
cmp esi, eax
jb 0x4014da
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x401a60
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push esi
mov esi, dword [esp + 0x5c]
test esi, esi
jne 0x401a73
xor eax, eax
pop esi
add esp, 0x54
ret
push 0x44
lea eax, [esp + 0x18]
push 0
push eax
call fcn.0040b6a0
add esp, 0xc
xor eax, eax
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x18]
push edx
push eax
push eax
push 0x10
push eax
push eax
push eax
push esi
push eax
mov dword [esp + 0x3c], 0x44
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
pop esi
add esp, 0x54
ret
Function at 0x401d60
Capabilities:
Read .ini file
Set current directory

Disassembly:
mov eax, 0x1044
call fcn.0040b800
mov eax, dword [0x423ad4]
xor eax, esp
mov dword [esp + 0x1040], eax
push ebx
mov ebx, dword [esp + 0x1050]
push ebp
mov ebp, dword [esp + 0x1058]
push esi
push edi
mov edi, dword [esp + 0x1058]
push str.SetDefaultDllDirectories
push 0x41c4f0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor esi, esi
cmp eax, esi
je 0x401db5
push 0x800
call eax
mov eax, dword [esp + 0x1064]
push eax
push ebp
push ebx
push edi
call fcn.004030ef
test eax, eax
je 0x401fc6
push 0x40e
lea ecx, [esp + 0x426]
push esi
push ecx
mov word [esp + 0x42c], si
call fcn.0040b6a0
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
add esp, 0xc
push 0x208
lea edx, [esp + 0x424]
push edx
push esi
call edi
test eax, eax
je 0x401fc6
lea eax, [esp + 0x420]
push 0x5c
push eax
call fcn.0040b66a
add esp, 8
lea ecx, [esp + 0x420]
push ecx
mov word [eax], si
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x401fc6
mov dword [0x424ee8], esi
call fcn.00401060
push eax
mov dword [0x424ef0], eax
call fcn.00401bf0
add esp, 4
test eax, eax
je 0x401fc6
push 0x206
lea edx, [esp + 0x16]
push esi
push edx
mov word [esp + 0x1c], si
call fcn.0040b6a0
push 0x40e
lea eax, [esp + 0xc52]
push esi
push eax
mov word [esp + 0xc58], si
call fcn.0040b6a0
push 0x40e
lea ecx, [esp + 0x84e]
push esi
push ecx
mov word [esp + 0x854], si
call fcn.0040b6a0
push 0x206
lea edx, [esp + 0x242]
push esi
push edx
mov word [esp + 0x248], si
call fcn.0040b6a0
add esp, 0x30
call fcn.00401060
mov dword [0x424ef0], eax
call fcn.00401ac0
mov dword [0x424eec], eax
push 0x104
lea eax, [esp + 0x424]
push eax
push esi
call edi
test eax, eax
je 0x401fc6
lea ecx, [esp + 0x420]
push ecx
lea edx, [esp + 0x834]
push 0x208
push edx
call fcn.0040b794
lea eax, [esp + 0x83c]
push 0x2e
push eax
call fcn.0040b66a
lea ecx, [esp + 0x844]
push ecx
lea edx, [esp + 0xc58]
push 0x208
push edx
mov word [eax + 2], si
call fcn.0040b71a
push 0x41c4e8
lea eax, [esp + 0xc64]
push 0x208
push eax
call fcn.0040b71a
mov eax, dword [0x424eec]
add esp, 0x2c
cmp eax, 7
ja case.0x401f55.0
jmp dword [eax*4 + 0x401fe4]
mov edi, 1
jmp 0x401f65
xor edi, edi
push str.Command
lea ecx, [esp + 0x21c]
push 0x104
push ecx
call fcn.0040b794
add esp, 0xc
lea edx, [esp + 0xc40]
push edx
push 0x104
lea eax, [esp + 0x18]
push eax
push esi
lea ecx, [esp + 0x228]
push ecx
push str.CommandLine
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp edi, esi
je 0x401fb9
call fcn.00401ba0
test eax, eax
jne 0x401fc6
lea edx, [esp + 0x10]
push edx
jmp 0x401fbe
lea eax, [esp + 0x10]
push eax
call fcn.00401a60
add esp, 4
mov ecx, dword [esp + 0x1050]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0040b0f5
add esp, 0x1044
ret 0x10