joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000c4b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x64
cmp dword [0x10011914], 0
push ebx
push esi
push edi
push ebp
je 0x1000c685
mov ebx, dword [esp + 0x78]
test ebx, ebx
je 0x1000c685
cmp dword [esp + 0x94], 0
je 0x1000c685
mov edi, dword [esp + 0x80]
test edi, edi
je 0x1000c685
cmp dword [esp + 0x84], 0
je 0x1000c685
mov ebp, dword [esp + 0x88]
test ebp, ebp
je 0x1000c685
cmp dword [esp + 0x8c], 0
je 0x1000c685
cmp word [ebx + 0x40], 0
je 0x1000c52c
mov eax, 0x400f0002
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x64
ret
mov eax, dword [esp + 0x94]
mov ecx, dword [esp + 0x7c]
push ecx
push ebx
mov dword [eax], 0
call fcn.1000b9b0
add esp, 8
mov esi, eax
test esi, esi
jne 0x1000c570
mov eax, dword [esp + 0x7c]
push eax
push 0
push ebx
call fcn.1000b9e0
add esp, 0xc
mov esi, eax
test esi, esi
jne 0x1000c570
mov eax, 2
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x64
ret
mov eax, dword [esp + 0x90]
lea ecx, [esi + 0xc]
mov edx, 4
mov dword [esi + 0x10], eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edx
mov dword [esp + 0x14], 0x534f504e
mov ecx, 0xffffffff
mov dword [esp + 0x2c], edi
mov dword [esp + 0x24], 0x4f574e52
mov word [esp + 0x18], 0
mov word [esp + 0x28], 0
sub eax, eax
repne scasb al, byte es:[edi]
mov word [esp + 0x38], 0
mov eax, dword [esp + 0x84]
mov dword [esp + 0x40], ebp
not ecx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x3c], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], ebp
mov dword [esp + 0x34], 0x55524551
mov dword [esp + 0x44], 0x55414354
lea ecx, [esp + 0x8c]
mov dword [esp + 0x60], edx
mov dword [esp + 0x54], 0x4c454e20
mov dword [esp + 0x64], 0x4d4f4445
lea ebp, [esp + 0x90]
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x6c], ebp
mov dword [esp + 0x70], edx
lea eax, [esp + 0x14]
push 6
push eax
mov ecx, dword [ebx + 0x38]
lea edx, [esp + 0x18]
push ecx
mov word [esp + 0x54], 0
mov word [esp + 0x64], 0
mov word [esp + 0x74], 0
push edx
call fcn.1000d070
add esp, 0x10
mov edi, eax
test edi, edi
jne 0x1000c67b
mov eax, dword [esp + 0x10]
push 1
push eax
call fcn.1000d290
add esp, 8
mov edi, eax
test edi, edi
jne 0x1000c672
mov eax, dword [esp + 0x94]
pop ebp
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x64
ret
push esi
call fcn.1000ba30
add esp, 4
mov eax, edi
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x64
ret
mov eax, 3
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x64
ret
Function at 0x1000c6a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x44
cmp dword [0x10011914], 0
push esi
push edi
je 0x1000c79b
mov eax, dword [esp + 0x50]
test eax, eax
je 0x1000c79b
lea edi, [eax + 0xc]
cmp dword [edi], 0
je 0x1000c79b
mov edx, dword [eax + 4]
test edx, edx
je 0x1000c79b
cmp dword [edx + 0x38], 0
je 0x1000c79b
mov eax, dword [esp + 0x58]
test eax, eax
je 0x1000c79b
mov ecx, dword [esp + 0x60]
test ecx, ecx
je 0x1000c79b
cmp word [edx + 0x40], 0
je 0x1000c709
mov eax, 0x400f0002
pop edi
pop esi
add esp, 0x44
ret
xor esi, esi
mov dword [esp + 0x14], edi
mov word [esp + 0x10], si
mov edi, 4
mov word [esp + 0x20], si
mov dword [esp + 0x18], edi
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
mov word [esp + 0x30], si
lea eax, [esp + 0x5c]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], edi
mov dword [esp + 0xc], 0x50555348
mov word [esp + 0x40], si
lea ecx, [esp + 0x54]
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], edi
mov dword [esp + 0x1c], 0x50444154
mov dword [esp + 0x2c], 0x504f4653
lea ecx, [esp + 8]
push edi
mov dword [esp + 0x40], 0x4c454e20
lea edi, [esp + 0x10]
mov eax, dword [edx + 0x38]
push edi
push eax
push ecx
call fcn.1000d070
add esp, 0x10
test eax, eax
jne 0x1000c7a0
mov eax, dword [esp + 8]
push esi
push eax
call fcn.1000d290
add esp, 8
pop edi
pop esi
add esp, 0x44
ret
mov eax, 3
pop edi
pop esi
add esp, 0x44
ret
Function at 0x1000c870
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x64
cmp dword [0x10011914], 0
push ebx
push esi
push edi
je 0x1000c9b9
mov edx, dword [esp + 0x74]
test edx, edx
je 0x1000c9b9
cmp dword [edx + 0x38], 0
je 0x1000c9b9
cmp word [edx + 0x40], 0
je 0x1000c8ac
mov eax, 0x400f0002
pop edi
pop esi
pop ebx
add esp, 0x64
ret
xor esi, esi
mov ebx, dword [esp + 0x78]
mov word [esp + 0x14], si
mov edi, ebx
mov ecx, 0xffffffff
sub eax, eax
mov dword [esp + 0x10], 0x464f504e
mov dword [esp + 0x18], ebx
repne scasb al, byte es:[edi]
mov word [esp + 0x24], si
mov edi, ebx
sub eax, eax
mov dword [esp + 0x28], ebx
not ecx
mov dword [esp + 0x20], 0x4f574e52
mov dword [esp + 0x1c], ecx
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov word [esp + 0x34], si
mov eax, dword [esp + 0x7c]
not ecx
mov word [esp + 0x44], si
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x80]
mov edi, dword [esp + 0x90]
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ecx
mov ecx, 0xffffffff
sub eax, eax
mov dword [esp + 0x30], 0x55524551
mov dword [esp + 0x40], 0x46535953
mov dword [esp + 0x48], edi
repne scasb al, byte es:[edi]
mov word [esp + 0x54], si
mov edi, dword [esp + 0x8c]
sub eax, eax
mov dword [esp + 0x58], edi
not ecx
mov dword [esp + 0x50], 0x46535450
mov dword [esp + 0x4c], ecx
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov word [esp + 0x64], si
mov eax, dword [esp + 0x84]
mov dword [esp + 0x68], eax
push 6
not ecx
lea ebx, [esp + 0x14]
mov eax, dword [edx + 0x38]
mov dword [esp + 0x60], ecx
push ebx
mov ecx, dword [esp + 0x90]
push eax
mov dword [esp + 0x6c], 0x55414354
mov dword [esp + 0x78], ecx
lea ecx, [esp + 0x18]
push ecx
call fcn.1000d070
add esp, 0x10
test eax, eax
jne 0x1000c9be
mov eax, dword [esp + 0xc]
push 1
push eax
call fcn.1000d290
add esp, 8
pop edi
pop esi
pop ebx
add esp, 0x64
ret
mov eax, 3
pop edi
pop esi
pop ebx
add esp, 0x64
ret

Function at 0x1000d750
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10c
mov dword [esp], 0
mov byte [esp + 0xc], 0
lea eax, [esp]
push ebx
mov ebx, dword [esp + 0x114]
push esi
push edi
push ebp
push eax
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0x20019
mov byte [ebx], 0
push 0
push str.SoftwareAdobeAcrobatExe
push 0x80000000
call ebp
test eax, eax
jne 0x1000d803
lea eax, [esp + 0x14]
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x18]
push eax
mov eax, dword [esp + 0x14]
push ecx
push edx
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [esp + 0x20], 0x100
push 0
push 0
push eax
call ebp
test eax, eax
jne 0x1000d803
lea edi, [esp + 0x1c]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x1000d803
lea edi, [esp + 0x1c]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
push str._s__o
rep movsb byte es:[edi], byte [esi]
push ebx
call sub.MSVCRT40.dll_sprintf
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x10c
ret
Function at 0x1000d860
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x10c
push ebx
push esi
mov ebx, dword [esp + 0x118]
push edi
push 0
mov esi, dword [sym.imp.USER32.dll_FindWindowA]
push str.EWHAcrobatTransportWindow
call esi
mov dword [ebx + 0x14], eax
test eax, eax
jne 0x1000d94c
lea eax, [esp + 0x14]
push eax
call fcn.1000d750
lea edi, [esp + 0x18]
add esp, 4
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x1000d93d
lea eax, [esp + 0x14]
push 7
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x20
jb 0x1000d93d
lea eax, [esp + 0x10]
push eax
call sub.MSVCRT40.dll_time
mov dword [esp + 0x14], eax
lea eax, [esp + 0x10]
add esp, 4
push eax
call sub.MSVCRT40.dll_time
mov dword [esp + 0x10], eax
add esp, 4
push 0
push str.EWHAcrobatTransportWindow
call esi
mov dword [ebx + 0x14], eax
test eax, eax
jne 0x1000d928
mov eax, dword [esp + 0x10]
add eax, 0x1e
cmp eax, dword [esp + 0xc]
jle 0x1000d928
push ebx
call fcn.1000d810
lea eax, [esp + 0x10]
add esp, 4
push eax
call sub.MSVCRT40.dll_time
mov dword [esp + 0x10], eax
add esp, 4
push 0
push str.EWHAcrobatTransportWindow
call esi
mov dword [ebx + 0x14], eax
test eax, eax
je 0x1000d8f1
cmp dword [ebx + 0x14], 0
jne 0x1000d94c
mov eax, 0x400f0004
pop edi
pop esi
pop ebx
add esp, 0x10c
ret
mov eax, 0x400f0003
pop edi
pop esi
pop ebx
add esp, 0x10c
ret
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x10c
ret

Function at 0x1000dfb0
Capabilities:
Read file via mapping

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x18]
test eax, eax
mov dword [esi], 0
mov dword [edi], 0
jne 0x1000dfe1
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1000dfe3
push eax
push 0
push 6
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov dword [edi], eax
mov eax, dword [edi]
test eax, eax
je 0x1000dffa
push 0
push 0
push 0
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi], eax
cmp dword [esi], 0
je 0x1000e00c
cmp dword [edi], 0
je 0x1000e00c
mov eax, 1
pop edi
pop esi
ret
xor eax, eax
pop edi
pop esi
ret
Function at 0x47d3e0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x5a000]
push edi
or ebp, 0xffffffff
jmp 0x47d402
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x47d409
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x47d3f8
mov eax, 1
add ebx, ebx
jne 0x47d41b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x47d42c
jne 0x47d43c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x47d43c
dec eax
add ebx, ebx
jne 0x47d438
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x47d410
xor ecx, ecx
sub eax, 3
jb 0x47d454
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x47d4c6
sar eax, 1
mov ebp, eax
jmp 0x47d45f
add ebx, ebx
jne 0x47d45f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x47d46c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x47d490
inc ecx
add ebx, ebx
jne 0x47d47c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x47d471
jne 0x47d48d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x47d471
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x47d4b0
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x47d4a1
jmp 0x47d3fe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x47d4b0
add edi, ecx
jmp 0x47d3fe
pop esi
mov edi, esi
mov ecx, 0x5f7
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x47d4ce
cmp byte [edi], 0
jne 0x47d4ce
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x47d4d3
lea edi, [esi + 0x7b000]
mov eax, dword [edi]
or eax, eax
je 0x47d542
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x7d1e8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x7d24c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x47d500
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x7d250]
or eax, eax
je 0x47d53c
mov dword [ebx], eax
add ebx, 4
jmp 0x47d51d
call dword [esi + 0x7d254]
popal
jmp 0x40e330
Function at 0x4051d6
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [0x42c080], 0x44
push eax
xor eax, eax
push 0x42c080
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x405211
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x40529b
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push ebx
mov ebx, dword [ebp + 8]
push esi
push ebx
call fcn.0040553d
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], eax
test cl, 8
je 0x4052d1
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x42ec88], eax
jmp 0x405456
mov dword [ebp + 8], ecx
push edi
and dword [ebp + 8], 1
je 0x4052ec
test eax, eax
je 0x405401
test cl, 2
je 0x405401
mov esi, 0x42b080
push ebx
push esi
call fcn.00405969
cmp dword [ebp + 8], 0
je 0x40530b
push 0x409380
push esi
call sub.KERNEL32.dll_lstrcatA
jmp 0x405311
push ebx
call fcn.004054a3
push 0x409010
push ebx
call sub.KERNEL32.dll_lstrcatA
push ebx
call sub.KERNEL32.dll_lstrlenA
mov edi, eax
lea eax, [ebp - 0x148]
push eax
push esi
add edi, ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x4053f7
lea eax, [ebp - 0x11c]
push 0x3f
push eax
lea esi, [ebp - 0x11c]
call fcn.00405487
cmp byte [eax], 0
je 0x405362
cmp byte [ebp - 0x18], 0
je 0x405362
lea esi, [ebp - 0x18]
cmp byte [esi], 0x2e
jne 0x405378
mov al, byte [esi + 1]
test al, al
je 0x4053d6
cmp al, 0x2e
jne 0x405378
cmp byte [esi + 2], 0
je 0x4053d6
push esi
push edi
call fcn.00405969
test byte [ebp - 0x148], 0x10
je 0x40539d
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x4053d6
push dword [ebp + 0xc]
push ebx
call fcn.0040529b
jmp 0x4053d6
push ebx
call fcn.00405621
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4053ce
test byte [ebp + 0xc], 4
je 0x4053c6
push ebx
push 0xfffffffffffffff1
call fcn.00404d1d
push 0
push ebx
call fcn.004056b7
jmp 0x4053d6
inc dword [0x42ec88]
jmp 0x4053d6
push ebx
push 0xfffffffffffffff2
call fcn.00404d1d
lea eax, [ebp - 0x148]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x405340
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x405401
and byte [edi - 1], 0
xor esi, esi
pop edi
cmp dword [ebp + 8], esi
je 0x405456
cmp dword [ebp - 8], esi
jne 0x405416
inc dword [0x42ec88]
jmp 0x405456
push ebx
call fcn.00405c11
test eax, eax
je 0x405456
push ebx
call fcn.0040545c
push ebx
call fcn.00405621
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x40544e
test byte [ebp + 0xc], 4
je 0x40540e
push ebx
push 0xfffffffffffffff1
call fcn.00404d1d
push esi
push ebx
call fcn.004056b7
jmp 0x405456
push ebx
push 0xffffffffffffffe5
call fcn.00404d1d
pop esi
pop ebx
leave
ret 8
Function at 0x405850
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp + 0x18]
push esi
push eax
mov eax, dword [ebp + 0x18]
xor ebx, ebx
neg eax
sbb eax, eax
mov esi, dword [ebp + 0x14]
and eax, 0x100
or eax, 0x20019
mov byte [esi], bl
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4058c1
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0x400
push eax
lea eax, [ebp + 0x14]
push esi
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4058b0
cmp dword [ebp + 0x14], 1
je 0x4058b2
cmp dword [ebp + 0x14], 2
je 0x4058b2
mov byte [esi], bl
push dword [ebp + 0x18]
mov byte [esi + 0x3ff], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop ebp
ret 0x14

Function at 0x40598b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
jge 0x4059ac
mov ecx, dword [0x42e3dc]
lea eax, [edi*4 + 4]
sub ecx, eax
mov edi, dword [ecx]
mov eax, dword [0x42ec38]
mov ecx, dword [ebp + 8]
add edi, eax
mov eax, 0x42dba0
sub ecx, eax
mov ebx, eax
cmp ecx, 0x800
jae 0x405b52
Function at 0x4059cb
Capabilities:
Get common file path

Disassembly:
mov ebx, dword [ebp + 8]
and dword [ebp + 8], 0
jmp 0x405b52
mov edx, ebx
sub edx, eax
cmp edx, 0x400
jge 0x405b5f
inc edi
cmp cl, 0xfc
jbe 0x405b45
movsx eax, byte [edi + 1]
movsx ecx, byte [edi]
mov esi, eax
mov edx, ecx
and esi, 0x7f
and edx, 0x7f
shl esi, 7
or esi, edx
mov edx, 0x8000
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], eax
or ecx, edx
or eax, edx
inc edi
mov dword [ebp - 0x10], ecx
inc edi
cmp byte [ebp + 0xf], 0xfe
mov dword [ebp - 8], eax
jne 0x405af0
cmp dword [0x42ec84], 0
push 2
pop esi
je 0x405a37
push 4
pop esi
mov eax, dword [ebp - 0x14]
test al, al
jns 0x405a6e
mov ecx, eax
and eax, 0x3f
add eax, dword [0x42ec38]
and ecx, 0x40
push ecx
push ebx
push eax
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call fcn.00405850
cmp byte [ebx], 0
jne 0x405ad7
push dword [ebp - 0xc]
push ebx
call fcn.0040598b
jmp 0x405ad2
cmp eax, 0x25
jne 0x405a81
push 0x400
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x405ad2
cmp eax, 0x24
jne 0x405ace
push 0x400
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
xor esi, esi
jmp 0x405ace
lea eax, [ebp - 4]
dec esi
push eax
push dword [ebp + esi*4 - 0x14]
push dword [0x42ec04]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x405acb
push ebx
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
push dword [ebp - 4]
mov dword [ebp + 0xc], eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
cmp dword [ebp + 0xc], 0
jne 0x405ad2
and byte [ebx], 0
test esi, esi
jne 0x405a96
cmp byte [ebx], 0
je 0x405ae8
cmp dword [ebp - 0xc], 0x1a
jne 0x405ae8
push str.MicrosoftInternet_ExplorerQuick_Launch
push ebx
call sub.KERNEL32.dll_lstrcatA
push ebx
call fcn.00405b78
jmp 0x405b36
cmp byte [ebp + 0xf], 0xfd
jne 0x405b24
cmp esi, 0x1d
jne 0x405b09
push dword [0x42ec04]
push ebx
call fcn.004058c7
jmp 0x405b1a
mov eax, esi
shl eax, 0xa
add eax, section..ndata
push eax
push ebx
call fcn.00405969
add esi, 0xffffffeb
cmp esi, 7
jae 0x405b36
jmp 0x405ae8
cmp byte [ebp + 0xf], 0xff
jne 0x405b36
or eax, 0xffffffff
sub eax, esi
push eax
push ebx
call fcn.0040598b
push ebx
call sub.KERNEL32.dll_lstrlenA
add ebx, eax
mov eax, 0x42dba0
jmp 0x405b52
jne 0x405b4f
mov cl, byte [edi]
mov byte [ebx], cl
inc ebx
inc edi
jmp 0x405b52
mov byte [ebx], cl
inc ebx
mov cl, byte [edi]
test cl, cl
mov byte [ebp + 0xf], cl
jne 0x4059d7
and byte [ebx], 0
cmp dword [ebp + 8], 0
pop edi
pop esi
pop ebx
je 0x405b74
push eax
push dword [ebp + 8]
call fcn.00405969
leave
ret 8
Function at 0x40109d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call sub.kernel32.dll_WriteFile
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 8]
leave
ret 0xc
Function at 0x40145b
Capabilities:
Copy file
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbfc
pushal
push str.xcpro30.dll
lea eax, [ebp - 0x200]
push eax
call sub.kernel32.dll_lstrcpyA
push 0
push 0x82
push 3
push 0
push 2
push 0x80000000
lea eax, [ebp - 0x200]
push eax
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x4014d8
push 4
push 0x406c2c
push str.Cant_open_File._Search_for_it_
push dword [0x406d44]
call sub.user32.dll_MessageBoxA
cmp eax, 6
jne 0x4014d3
push dword [0x406d44]
push str.Exe_Files
lea eax, [ebp - 0x200]
push eax
call fcn.00401690
cmp eax, 1
jne 0x4014d3
jmp 0x401476
jmp 0x40168d
mov dword [0x406d34], eax
push 0
push dword [0x406d34]
call sub.kernel32.dll_GetFileSize
mov dword [0x406d38], eax
push eax
push 0x42
call sub.kernel32.dll_GlobalAlloc
mov dword [0x406d40], eax
push dword [0x406d40]
call sub.kernel32.dll_GlobalLock
mov dword [0x406d3c], eax
mov ebx, dword [0x406d38]
push 0
push 0x406a9e
push ebx
push dword [0x406d3c]
push dword [0x406d34]
call sub.kernel32.dll_ReadFile
push dword [0x406d34]
call sub.kernel32.dll_CloseHandle
mov byte [ebp - 0x401], 0
mov esi, 0x40620b
add esi, 4
mov ecx, dword [esi]
mov ebx, dword [esi + 4]
push ebx
push dword [0x406d38]
push ecx
lea eax, [esi + ecx*2 + 8]
add eax, ecx
push eax
lea eax, [esi + ecx*2 + 8]
push eax
lea eax, [ecx + esi + 8]
push eax
lea eax, [esi + 8]
push eax
push dword [0x406d3c]
call section..text
pushal
or eax, eax
jne 0x4015a6
cmp dword [esi + ecx*4 + 8], 0
je 0x4015a6
push 4
push 0x406c7c
push str.Cant_find_current_Pattern_r_nTry_next_one_
push dword [0x406d44]
call sub.user32.dll_MessageBoxA
cmp eax, 6
jne 0x40159e
jmp 0x4015b2
popal
jmp 0x401677
cmp eax, 1
jne 0x4015b2
mov byte [ebp - 0x401], 1
popal
lea esi, [esi + ecx*4 + 8]
cmp dword [esi], 0
jne 0x401545
cmp byte [ebp - 0x401], 0
jne 0x4015dc
push str.Nothing_was_patched
push 0x6a
push dword [0x406d44]
call sub.user32.dll_SetDlgItemTextA
jmp 0x401677
push 0
push 0
push 0xf0
push dword [0x406d48]
call sub.user32.dll_SendMessageA
cmp eax, 1
jne 0x401635
lea eax, [ebp - 0x200]
push eax
lea eax, [ebp - 0x400]
push eax
call sub.kernel32.dll_lstrcpyA
lea eax, [ebp - 0x400]
push eax
call sub.kernel32.dll_lstrlenA
mov dword ss:[eax + ebp - 0x404], 0x4b41422e
push 1
lea eax, [ebp - 0x400]
push eax
lea eax, [ebp - 0x200]
push eax
call sub.kernel32.dll_CopyFileA
push dword [0x406d38]
push dword [0x406d3c]
lea eax, [ebp - 0x200]
push eax
call fcn.0040109d
or eax, eax
jne 0x401665
push str.Cant_Save_File__Maybe_its_write_protected_
push 0x6a
push dword [0x406d44]
call sub.user32.dll_SetDlgItemTextA
jmp 0x401677
push str.File_saved__Now_test_it_
push 0x6a
push dword [0x406d44]
call sub.user32.dll_SetDlgItemTextA
push dword [0x406d3c]
call sub.kernel32.dll_GlobalUnlock
push dword [0x406d40]
call sub.kernel32.dll_GlobalFree
popal
leave
ret
Function at 0x40154d
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.004016fd
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x40164b
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x4015ee
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x401631
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x401605
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x401620
test al, 0x40
je 0x401617
mov ecx, dword [edi + 0x20]
jmp 0x40161e
test al, 0x80
je 0x401631
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x401631
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x4015bd
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret