joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4530f8
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x479bb8]
cmp dword [eax + 0x30], 0
je 0x4531a2
cmp dword [ebx + 0x94], 0
jne 0x45319c
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x453088
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45319c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x453162
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45319c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00418aa0
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x453171
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x453d00
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x453d35
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404b88
jmp 0x453d42
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404aec
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x454e7c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x454ebd
mov eax, esi
call fcn.0043b5c8
test al, al
je 0x454ebd
mov eax, dword [ebx + 0x84]
call fcn.0043b308
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x454ebd
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043b308
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x456918
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x4159e4]
call fcn.00405428
xor eax, eax
push ebp
push 0x456a5c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x477d6c], 0
jne 0x45696b
mov ecx, dword [0x4785d8]
mov dl, 1
mov eax, dword [0x407ebc]
call fcn.0040c998
call fcn.00404428
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.0040355c
mov eax, ebx
call fcn.004052d4
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x456a6c
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.0040657c
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.004052e4
test eax, eax
jle 0x456a03
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.KERNEL32.DLL_GetComputerNameA
test eax, eax
je 0x4569fc
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404d20
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404d08
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408d4c
test eax, eax
jne 0x4569fc
mov ebx, 0x15
jmp 0x456a08
mov ebx, 0x10
jmp 0x456a08
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x477d6c]
call fcn.00456870
mov eax, dword [ebp - 8]
call fcn.00456870
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00406594
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x456a63
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00404abc
lea eax, [ebp - 0x10]
mov edx, dword [0x4159e4]
call fcn.004054f8
ret

Function at 0x45d110
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffe28
mov edi, eax
lea eax, [esp + 0x48]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
push 0x40
lea eax, [esp + 0xc]
push eax
call sub.wsock32.dll_gethostname
lea eax, [esp + 8]
push eax
call sub.wsock32.dll_gethostbyname
mov dword [esp], eax
cmp dword [esp], 0
je 0x45d178
mov eax, dword [esp]
mov eax, dword [eax + 0xc]
mov dword [esp + 4], eax
xor ebx, ebx
jmp 0x45d168
push dword [esi]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, edi
call fcn.00404c90
inc ebx
mov eax, dword [esp + 4]
mov esi, dword [eax + ebx*4]
test esi, esi
jne 0x45d157
call sub.wsock32.dll_WSACleanup
add esp, 0x1d8
pop edi
pop esi
pop ebx
ret
Function at 0x45d1d4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45d264
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x45d270
call sub.KERNEL32.DLL_GetVolumeInformationA
lea ecx, [ebp - 0x10]
movzx eax, word [ebp - 4]
mov edx, 4
call fcn.0040914c
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.004078dc
movzx eax, ax
lea ecx, [ebp - 0x14]
mov edx, 4
call fcn.0040914c
mov edx, dword [ebp - 0x14]
mov eax, ebx
pop ecx
call fcn.00404da4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45d26b
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00404abc
ret
Function at 0x465d1c
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x465d24
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x465f16
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x465f2c
mov eax, esi
call fcn.00463aac
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.00404aec
lea ecx, [ebp - 0x10]
mov edx, 0x465f40
mov eax, esi
call fcn.00463aac
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.00404aec
lea ecx, [ebp - 0x14]
mov edx, 0x465f58
mov eax, esi
call fcn.00463aac
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.00404aec
lea ecx, [ebp - 0x18]
mov edx, 0x465f74
mov eax, esi
call fcn.00463aac
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.00404aec
lea ecx, [ebp - 0x1c]
mov edx, 0x465f90
mov eax, esi
call fcn.00463aac
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.00404aec
lea ecx, [ebp - 0x24]
mov edx, 0x465fa8
mov eax, esi
call fcn.00463aac
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00408dbc
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.004091b0
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x465fc0
mov eax, esi
call fcn.00463aac
mov eax, dword [ebp - 0x28]
call fcn.00462bc4
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x465fd0
mov eax, esi
call fcn.00463aac
mov eax, dword [ebp - 0x2c]
call fcn.00462bc4
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x465fe8
mov eax, esi
call fcn.00463aac
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.004091b0
inc eax
je 0x465eb9
lea ecx, [ebp - 0x34]
mov edx, 0x465fe8
mov eax, esi
call fcn.00463aac
mov eax, dword [ebp - 0x34]
call fcn.00409174
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040a7d0
fstp qword [ebp - 0x3c]
wait
call fcn.0040ab40
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x465ed4
lea ecx, [ebp - 0x40]
mov edx, 0x465fe8
mov eax, esi
call fcn.00463aac
mov eax, dword [ebp - 0x40]
call fcn.00462bc4
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x465ff8
mov eax, esi
call fcn.00463aac
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.00404aec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x465f1d
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.00404abc
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.00404abc
ret
Function at 0x476398
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x476495
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x2fc]
inc dword [eax + 0xc]
mov eax, dword [ebx + 0x308]
mov edx, dword [eax]
call dword [edx + 0x14]
mov edx, dword [ebx + 0x2fc]
cmp eax, dword [edx + 0xc]
jge 0x47640d
push 0
push 0x4764ac
push dword [ebx + 0x30c]
push 0x4764c0
push 0x4764dc
lea eax, [ebp - 4]
mov edx, 4
call fcn.00404e18
mov eax, dword [ebp - 4]
call fcn.00404f58
push eax
call sub.KERNEL32.DLL_WinExec
mov eax, ebx
call fcn.00450a70
jmp 0x47647a
lea ecx, [ebp - 8]
mov eax, dword [ebx + 0x2fc]
mov edx, dword [eax + 0xc]
dec edx
mov eax, dword [ebx + 0x308]
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0x304]
add eax, 0x44
call fcn.00404aec
lea ecx, [ebp - 0x10]
mov eax, dword [ebx + 0x2fc]
mov edx, dword [eax + 0xc]
dec edx
mov eax, dword [ebx + 0x308]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.00409630
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebx + 0x304]
add eax, 0x3c
mov edx, 0x4764e8
call fcn.00404da4
mov eax, dword [ebx + 0x304]
call fcn.0045638c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47649c
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404abc
ret
Function at 0x40176f
Capabilities:
Capture webcam image

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov byte [ebp - 4], dl
mov dword [ebp - 8], ecx
cmp byte [0x4c3899], dl
je 0x401853
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push edi
xor ebx, ebx
push ebx
push ebx
push 0x418
push ecx
call esi
cmp byte [ebp - 4], bl
je 0x40181c
mov eax, dword [0x4c9204]
mov ecx, dword [eax + 0x1c]
cmp ecx, 0xffffffff
je 0x401850
push ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov byte [ebp - 0x2c], bl
mov byte [ebp - 0x2b], 1
mov byte [ebp - 0x2a], bl
mov byte [ebp - 0x29], bl
xor eax, eax
push 0x44
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x419
push dword [ebp - 8]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], 0x13
mov byte [ebp - 0x18], 4
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], bl
mov byte [ebp - 0x15], bl
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call esi
mov ebx, eax
lea eax, [ebp - 0x34]
push eax
push ebx
mov edi, 0x443
push edi
push dword [ebp - 8]
call esi
lea eax, [ebp - 0x20]
push eax
push ebx
push edi
push dword [ebp - 8]
call esi
mov byte [0x4c3899], 1
jmp 0x401850
push ebx
push 0x13
push 0x419
push dword [ebp - 8]
call esi
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40184a
push ebx
push eax
mov edi, 0x416
push edi
push dword [ebp - 8]
call esi
mov eax, dword [ebp - 0xc]
push ebx
dec eax
push eax
push edi
push dword [ebp - 8]
call esi
mov byte [0x4c3899], bl
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401e8b
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
lea ecx, [ebp - 0xc]
call fcn.00401e09
mov eax, dword [ebp - 0xc]
xor ebx, ebx
cmp eax, ebx
jne 0x401ea9
mov eax, 0x48f94c
push edi
push str.VirusGuard.exe
push eax
push 0x48ff58
call fcn.0043c769
mov dword [ebp - 4], eax
xor eax, eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x44
stosd dword es:[edi], eax
pop esi
push esi
stosd dword es:[edi], eax
lea eax, [ebp - 0x60]
push ebx
push eax
call sub.MSVCRT.dll_memset
mov eax, dword [ebp - 0xc]
add esp, 0x18
mov dword [ebp - 0x60], esi
pop edi
cmp dword [ebp - 0xc], ebx
jne 0x401ee8
mov eax, 0x48f94c
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x60]
push ecx
push eax
push ebx
push 8
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
test eax, eax
je 0x401f0e
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov esi, dword [ebp - 0x1c]
cmp byte [ebp - 8], bl
je 0x401f1e
mov ecx, dword [ebp - 0xc]
call fcn.004444fe
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x40248d
Capabilities:
Hide graphical window

Disassembly:
push edi
mov edi, ecx
cmp dword [edi + 0x14], 0
jne 0x4024d5
push esi
push 0x7c
call fcn.00444d45
pop ecx
test eax, eax
je 0x4024b2
push dword [esp + 0xc]
mov ecx, eax
call fcn.00401f5e
mov esi, eax
jmp 0x4024b4
xor esi, esi
mov eax, dword [esi + 0x24]
push dword [eax + 4]
mov ecx, esi
push 0x418
call fcn.0044f9f0
push 0
mov dword [edi + 0x14], esi
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop edi
ret 4
Function at 0x403447
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
jbe 0x4034fd
push ebx
push edi
mov edi, dword [ebp - 4]
mov eax, dword [esi + 0x30]
push dword [ebp + 8]
shl edi, 2
mov ebx, dword [edi + eax]
lea ecx, [ebx + 8]
call fcn.00402daa
test al, al
jne 0x4034b8
mov ebx, dword [ebx + 0x10]
test ebx, ebx
jne 0x403485
mov ebx, 0x48f94c
push 0x28
push dword [ebp + 8]
push ebx
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
jne 0x4034ec
mov eax, dword [esi + 0x30]
mov eax, dword [edi + eax]
add eax, 8
mov eax, dword [eax]
test eax, eax
jne 0x4034ab
mov eax, 0x48f94c
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov eax, dword [esi + 0x30]
mov ebx, dword [edi + eax]
dec dword [esi + 0x38]
mov eax, dword [esi + 0x38]
sub eax, dword [ebp - 4]
mov ecx, dword [esi + 0x30]
shl eax, 2
push eax
add ecx, edi
lea eax, [ecx + 4]
push eax
push ecx
call sub.MSVCRT.dll_memmove
add esp, 0xc
test ebx, ebx
je 0x4034e9
mov ecx, ebx
call fcn.00410eb4
push ebx
call fcn.004445cb
pop ecx
dec dword [ebp - 4]
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [esi + 0x38]
jb 0x40345e
pop edi
pop ebx
pop esi
leave
ret 4
Function at 0x410ee8
Capabilities:
Create directory

Disassembly:
push ebx
push esi
call fcn.00410cfb
mov esi, eax
xor ebx, ebx
cmp esi, ebx
jne 0x410efc
mov eax, 0x48f94c
push ebx
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test eax, eax
jne 0x410f15
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
jne 0x410f17
mov bl, 1
mov ecx, esi
call fcn.004444fe
pop esi
mov al, bl
pop ebx
ret

Function at 0x410faa
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a8
push ebx
push esi
mov esi, ecx
mov eax, dword [esi]
mov ebx, 0x48f94c
test eax, eax
jne 0x410fc4
mov eax, ebx
mov ecx, dword [0x4c3a18]
push eax
call fcn.00402f8f
mov dword [ebp - 4], eax
test eax, eax
jne 0x410ff9
mov ecx, dword [0x4c3a18]
call fcn.0041992b
mov eax, dword [esi]
test eax, eax
jne 0x410fea
mov eax, ebx
mov ecx, dword [0x4c3a18]
push eax
call fcn.00402f8f
mov dword [ebp - 4], eax
mov eax, dword [esi]
test eax, eax
jne 0x411001
mov eax, ebx
push edi
mov ecx, eax
call fcn.004139b0
mov eax, dword [esi + 8]
mov edi, eax
test eax, eax
jne 0x411014
mov edi, ebx
mov ecx, dword [0x4c3a18]
push 2
lea eax, [ebp - 8]
push eax
call fcn.00419789
push eax
push edi
lea ecx, [ebp - 0xa8]
call fcn.00452f1a
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x84]
test ecx, ecx
je 0x41106a
push 0x43
call fcn.0043adb2
push eax
lea ecx, [ebp - 0x30]
call fcn.00452dc6
lea ecx, [ebp - 0x30]
call fcn.00452b39
lea ecx, [ebp - 0x30]
test eax, eax
je 0x411065
call fcn.00452ada
jmp 0x4110bc
call fcn.00452ada
lea ecx, [ebp - 0xa8]
call fcn.004530e9
mov edi, eax
test edi, edi
je 0x4110bc
push 0x100
lea edx, [ebp - 0x2a8]
mov ecx, edi
call fcn.00468eca
mov eax, dword [esi]
test eax, eax
jne 0x411095
mov eax, ebx
push 0
push 0
push edi
lea ecx, [ebp - 0x2a8]
push ecx
push eax
push str.The_install_of__s_failed._n__s__d_.
call fcn.0043c769
add esp, 0x10
push eax
push dword [0x4c9094]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [esi + 8]
pop edi
test eax, eax
jne 0x4110c6
mov eax, ebx
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov ecx, esi
call fcn.00410e93
push esi
call fcn.004445cb
pop ecx
lea ecx, [ebp - 0xa8]
call fcn.00452d40
xor ecx, ecx
call fcn.004444fe
pop esi
pop ebx
leave
ret
Function at 0x4123d6
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x618
push esi
push edi
lea eax, [ebp - 0x410]
push eax
mov esi, 0x104
push esi
mov edi, ecx
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
lea eax, [ebp - 0x618]
push eax
push 0
push 0x4916e4
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.DLL_GetTempFileNameW]
test eax, eax
jne 0x412436
call sub.MSVCRT.dll_rand
push eax
call sub.MSVCRT.dll_rand
push eax
push str.c:_u_u.tmp
lea eax, [ebp - 0x410]
push esi
push eax
call fcn.0043c6a0
add esp, 0x14
test edi, edi
je 0x4124a1
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x41243f
sub eax, edx
sar eax, 1
mov ecx, 0x103
sub ecx, eax
push ecx
lea edx, [ebp - 0x618]
lea ecx, [ebp - 0x208]
call fcn.00411c98
mov eax, edi
mov edx, edi
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x41246a
sub eax, edx
lea edi, [ebp - 0x208]
dec edi
dec edi
mov cx, word [edi + 2]
inc edi
inc edi
test cx, cx
jne 0x41247e
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x208]
jmp 0x4124a7
lea ecx, [ebp - 0x618]
call fcn.00444cee
pop edi
pop esi
leave
ret

Function at 0x4124b0
Capabilities:
Create directory

Disassembly:
push esi
call fcn.00410cfb
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
push 0x40
call fcn.00444d45
pop ecx
test eax, eax
je 0x4124d8
mov ecx, eax
call fcn.00411cf2
mov ecx, eax
jmp 0x4124da
xor ecx, ecx
push esi
mov dword [0x4c3a18], ecx
call fcn.0041983f
mov ecx, 0x4c3a78
pop esi
jmp fcn.00411a83

Function at 0x414939
Capabilities:
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov esi, ecx
push esi
call edi
mov ebx, eax
test ebx, ebx
jne 0x41496f
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 5
jne 0x41496f
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
xor eax, 1
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
push esi
call edi
mov ebx, eax
pop edi
pop esi
mov eax, ebx
pop ebx
ret
Function at 0x4167bb
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
jne 0x4167c3
xor al, al
jmp 0x4167de
xor eax, eax
push esi
mov esi, dword [esp + 8]
mov edx, eax
xor edx, 3
mov dl, byte [edx + ecx]
mov byte [eax + esi], dl
inc eax
cmp eax, 0x14
jne 0x4167c6
mov al, 1
pop esi
ret 4

Function at 0x4167e1
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov edx, dword [esp + 8]
mov ecx, eax
xor ecx, 3
mov cl, byte [ecx + edx]
mov edx, dword [esp + 4]
mov byte [eax + edx], cl
inc eax
cmp eax, 0x14
jne 0x4167e3
ret 8
Function at 0x419c5a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push 0
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push edx
push ecx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x419ca4
mov esi, dword [sym.imp.KERNEL32.DLL_GetLastError]
call esi
test eax, eax
je 0x419ca0
push dword [ebp + 8]
push dword [ebp + 0xc]
push 0xffffffffffffffff
push 0xffffffffffffff9d
push 0xffffffffffffff9d
push 0x184
call esi
push eax
push str.IO_Error:_d_line:_d_align:_d_pos:_Ld_count:_d_actual:_d
call fcn.004891ee
add esp, 0x20
call esi
jmp 0x419cd4
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0xc]
jae 0x419cd2
push eax
push dword [ebp + 0xc]
mov esi, 0x490
push 0xffffffffffffffff
push 0xffffffffffffff9d
push 0xffffffffffffff9d
push 0x188
push esi
push str.IO_Error:_d_line:_d_align:_d_pos:_Ld_count:_d_actual:_d
call fcn.004891ee
add esp, 0x20
mov eax, esi
jmp 0x419cd4
xor eax, eax
pop esi
pop ebp
ret 8
Function at 0x41c136
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov ecx, dword [edi + 0x10]
push ebx
xor ebx, ebx
lea eax, [edi + 0x2c]
mov dword [eax], ebx
push esi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], eax
mov byte [ebp - 1], bl
mov dword [ebp - 0xc], ebx
cmp dword [ecx + 8], ebx
je 0x41c240
mov dword [ebp - 8], ebx
mov esi, dword [ecx]
add esi, dword [ebp - 8]
test byte [esi + 0x21], 4
je 0x41c1dc
cmp byte [esi + 0x20], bl
je 0x41c21a
push dword [esi + 4]
mov ecx, dword [edi + 0x10]
push dword [esi]
add ecx, 0x2c
push dword [esi + 0xc]
push dword [esi + 8]
push ebx
call fcn.0041bfb9
cmp eax, 0xffffffff
jne 0x41c1ce
push ebx
push 1
push ebx
push dword [ebp - 0x10]
mov eax, esi
push dword [edi + 0x10]
push 1
call fcn.00419e10
cmp eax, 0xffffffff
je 0x41c25a
push dword [esi + 4]
mov eax, dword [0x4c592c]
push dword [esi]
mov dword [esi + 0x14], eax
push dword [esi + 0xc]
mov eax, dword [esi + 0x30]
push dword [esi + 8]
mov ecx, dword [edi + 0x10]
add ecx, 0x2c
push eax
call fcn.0041bfb9
cmp eax, ebx
jne 0x41c25e
and byte [esi + 0x21], 0xfb
jmp 0x41c21a
cmp byte [esi + 0x20], bl
jne 0x41c21a
cmp byte [0x4c3fb2], bl
je 0x41c21a
push ebx
push 1
push 1
lea eax, [ebp - 0x14]
push eax
push dword [edi + 0x10]
mov eax, esi
push ebx
call fcn.00419e10
cmp eax, 0xffffffff
jne 0x41c225
mov eax, dword [ebp - 0x14]
cmp eax, 0xdf
je 0x41c216
cmp eax, 2
je 0x41c216
cmp eax, 3
jne 0x41c25e
or byte [esi + 0x21], 4
mov al, byte [esi + 0x21]
shr al, 2
and al, 1
or byte [ebp - 1], al
inc dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
add dword [ebp - 8], 0x34
cmp eax, dword [ecx + 8]
jne 0x41c160
cmp byte [ebp - 1], bl
jne 0x41c25a
mov ecx, dword [edi + 0x10]
add ecx, 0x2c
call fcn.00445554
mov ecx, dword [edi + 0x10]
call fcn.0041e96b
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
pop esi
pop ebx
leave
ret
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
jmp 0x41c25a