joyce8/EMBER2024-capa huggingface dataset:
Function at 0x466bf0
Capabilities:
Query environment variable

Disassembly:
push ecx
push ebx
mov ebx, ecx
movzx eax, byte [ebx + 0x17]
push esi
push edi
cmp eax, 3
ja case.default.0x466c03
jmp dword [eax*4 + 0x466d58]
mov eax, ebx
call fcn.00401150
cmp dword [0x4a0b8c], 0
jne 0x466c93
cmp dword [ebx + 0xc], 0
jne 0x466c93
mov edi, dword [esp + 0x14]
cmp dword [0x4a3b6c], ebx
jne 0x466c30
test edi, edi
jne 0x466c6e
mov ecx, dword [ebx + 0x18]
push 0
lea eax, [esp + 0x13]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x466c6a
mov dword [0x4a3b6c], 0
test edi, edi
je 0x466c62
mov ecx, dword [ebx + 0x18]
call fcn.00465330
pop edi
pop esi
pop ebx
pop ecx
ret 4
dec eax
pop edi
pop esi
pop ebx
pop ecx
ret 4
test edi, edi
je 0x466c84
mov byte [edi], 0
mov dword [0x4a3b6c], 0
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
ret 4
mov dword [0x4a3b6c], ebx
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
ret 4
mov esi, dword [esp + 0x14]
mov edi, dword [ebx + 0xc]
test esi, esi
je 0x466ce8
test edi, edi
jne 0x466cae
mov byte [esi], 0
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
ret 4
mov ecx, dword [ebx + 8]
cmp esi, ecx
je 0x466ce8
cmp edi, 0x186a0
jae 0x466cd9
mov al, byte [ecx]
test al, al
je 0x466ccd
inc ecx
mov byte [esi], al
mov al, byte [ecx]
inc esi
test al, al
jne 0x466cc3
mov byte [esi], 0
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
ret 4
push edi
push ecx
push esi
call fcn.0047b470
add esp, 0xc
mov byte [edi + esi], 0
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
ret 4
mov edx, dword [esp + 0x14]
mov ecx, dword [ebx + 0xc]
push edx
call fcn.00466bf0
pop edi
pop esi
pop ebx
pop ecx
ret 4
mov esi, dword [esp + 0x14]
push esi
mov ecx, 0x4a2bfc
call fcn.004039a0
cmp eax, reloc.USER32.dll_AdjustWindowRectEx
jne 0x466d1b
xor eax, eax
test esi, esi
je 0x466d4f
mov byte [eax + esi], 0
pop edi
pop esi
pop ebx
pop ecx
ret 4
mov eax, dword [esp + 0x14]
test eax, eax
je 0x466d35
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
ret 4
mov eax, dword [ebx + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [ebx + 0x10]
push eax
push ecx
call edx
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret 4
Function at 0x467640
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0x10
push edi
mov edi, eax
test edi, edi
jne 0x46764f
pop edi
add esp, 0x10
ret
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push ebp
push esi
push 0
push edi
call ebx
mov ebp, eax
mov dword [esp + 0x1c], ebp
cmp ebp, dword [0x4a2bbc]
je 0x46767a
mov esi, edi
call fcn.00468640
test al, al
jne 0x467812
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
test esi, esi
jne 0x467694
push eax
push 0x49204c
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
cmp edi, esi
jne 0x4676a2
pop esi
pop ebp
pop ebx
mov eax, edi
pop edi
add esp, 0x10
ret
push edi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x4676b6
push 9
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
cmp byte [0x4a0b5a], 0
jne 0x4676d0
push esi
call fcn.004675e0
add esp, 4
test eax, eax
jne 0x467814
mov byte [esp + 0x12], 0
mov byte [esp + 0x13], 0
test esi, esi
je 0x46772d
push 0
push esi
call ebx
mov ebx, eax
mov dword [esp + 0x18], ebx
test ebx, ebx
je 0x46772d
cmp dword [0x4a2bbc], ebx
je 0x467714
call fcn.00468640
test al, al
jne 0x467714
mov eax, dword [0x4a2bbc]
push 1
push ebx
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne byte [esp + 0x12]
test ebp, ebp
je 0x46772d
cmp ebx, ebp
je 0x46772d
push 1
push ebp
push ebx
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne byte [esp + 0x13]
mov ebx, dword [sym.imp.USER32.dll_SetForegroundWindow]
mov dword [esp + 0x14], 0
jmp 0x467740
push edi
call ebx
push 1
push 0xa
mov dword [0x49d328], 0
call fcn.00401340
add esp, 8
mov dword [0x49d328], 1
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebp, eax
cmp ebp, edi
jne 0x467773
mov ebp, edi
jmp 0x467784
cmp ebp, esi
je 0x467788
push 4
push ebp
call dword [sym.imp.USER32.dll_GetWindow]
cmp edi, eax
jne 0x467788
test ebp, ebp
jne 0x4677c9
mov eax, dword [esp + 0x14]
inc eax
mov dword [esp + 0x14], eax
cmp eax, 5
jl 0x467740
push 0xffc3d44d
push 0
push 0
push 0
push 0x12
push 2
call fcn.0040e2a0
push 0xffc3d44d
push 0
push 0
push 0
push 0x12
push 2
call fcn.0040e2a0
push esi
call fcn.004675e0
add esp, 0x34
mov ebp, eax
cmp byte [esp + 0x12], 0
je 0x4677e4
mov ecx, dword [esp + 0x18]
mov edx, dword [0x4a2bbc]
push 0
push ecx
push edx
call dword [sym.imp.USER32.dll_AttachThreadInput]
cmp byte [esp + 0x13], 0
je 0x4677fd
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push 0
push eax
push ecx
call dword [sym.imp.USER32.dll_AttachThreadInput]
test ebp, ebp
je 0x467812
push edi
call dword [sym.imp.USER32.dll_BringWindowToTop]
pop esi
mov eax, ebp
pop ebp
pop ebx
pop edi
add esp, 0x10
ret
xor eax, eax
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x10
ret
Function at 0x467f31
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x8014
call fcn.00488480
push ebx
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
push edi
test ecx, ecx
je 0x467f50
push 1
push 0
push 0xffffffffffffffff
push 0
call fcn.004668b0
mov eax, 0x4916f4
jmp 0x467f55
mov eax, 0x491918
mov ecx, dword [0x4a13a4]
mov edi, 1
push edi
push 0
push 0xffffffffffffffff
push eax
call fcn.004668b0
cmp dword [ebp + 0x14], 0
jne 0x467f78
mov dword [ebp + 0x14], reloc.USER32.dll_AdjustWindowRectEx
cmp dword [ebp + 0x18], edi
jge 0x467f84
mov dword [ebp + 0x18], 0x32
cmp dword [ebp + 0xc], edi
jge 0x467f8c
mov dword [ebp + 0xc], edi
test esi, esi
je 0x468128
mov ebx, dword [sym.imp.USER32.dll_SendMessageTimeoutA]
lea eax, [esp + 0x1c]
push eax
push 0x7d0
push 2
push 0
push 0
push 0x406
push esi
call ebx
test eax, eax
je 0x468128
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [esp + 0x1c]
jg 0x468128
push 0x8000
mov ecx, esi
lea edi, [esp + 0x18]
call fcn.004653f0
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
je 0x468128
mov edi, dword [ebp + 0xc]
dec edi
mov byte [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x18], eax
lea esp, [esp]
lea edx, [esp + 0xc]
push edx
push 0x7d0
push 2
push 0
push edi
push 0x403
push esi
call ebx
test eax, eax
je 0x46807b
mov eax, 0x7fff
cmp word [esp + 0xc], ax
ja 0x4680be
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0xc]
push ecx
push 0x7d0
push 2
push edx
push edi
push 0x402
push esi
call ebx
test eax, eax
je 0x46807b
movzx eax, word [esp + 0xc]
mov edx, dword [esp + 0x10]
push 0
inc eax
push eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x28]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x4680b9
mov edx, dword [ebp + 0x10]
lea eax, [esp + 0x20]
call fcn.004674b0
test al, al
jne 0x4680db
cmp dword [ebp + 8], 0
jne 0x4680c4
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x468109
cmp dword [ebp + 0x14], 0
jl 0x4680a6
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x18]
add ecx, dword [ebp + 0x14]
sub ecx, eax
cmp ecx, 5
jle 0x4680f3
mov eax, dword [ebp + 0x18]
push 1
push eax
call fcn.00401340
add esp, 8
jmp 0x468000
mov byte [esp + 0x20], 0
cmp dword [ebp + 8], 0
je 0x468109
push 1
push 0
push 0xffffffffffffffff
lea ecx, [esp + 0x2c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004668b0
mov edi, eax
jmp 0x46810e
mov ecx, dword [0x4a13a4]
push 1
push 0
push 0xffffffffffffffff
push 0x4900b0
call fcn.004668b0
jmp 0x4680be
mov ecx, dword [0x4a13a4]
push 1
push 0
push 0xffffffffffffffff
push 0x4916f4
call fcn.004668b0
mov edi, 1
mov edx, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
push edx
call fcn.00465470
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x475bf2
Capabilities:
Encode data using xor

Disassembly:
push edi
push dword [esp + 0x10]
call fcn.00411710
xor edi, edi
pop ecx
cmp dword [esp + 0xc], edi
jbe 0x475c1c
push esi
mov eax, dword [esp + 0xc]
lea esi, [edi + eax]
call fcn.00411880
xor byte [esi], al
inc edi
cmp edi, dword [esp + 0x10]
jb 0x475c06
pop esi
pop edi
ret 0xc

Function at 0x47608e
Capabilities:
Hash data using crc32b

Disassembly:
mov eax, ecx
push esi
push edi
mov edi, eax
or dword [eax + reloc.USER32.dll_AdjustWindowRectEx], 0xffffffff
xor esi, esi
mov edx, esi
push 8
shl edx, 0x18
pop ecx
test edx, 0x80000000
je 0x4760b7
add edx, edx
xor edx, 0x4c11db7
jmp 0x4760b9
shl edx, 1
dec ecx
jne 0x4760a5
mov dword [edi], edx
inc esi
add edi, 4
cmp esi, 0x100
jl 0x47609d
pop edi
pop esi
ret

Function at 0x430006
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
call 0x43000c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403daa
nop
nop
sub eax, 0x403d50
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x401009
Capabilities:
Delete file
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x40102f
xor eax, eax
jmp 0x4010cb
mov edx, dword [ebp - 0x18]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x18]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
push 0
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 2
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x4010cf
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
push ebx
push esi
push edi
nop
mov dword [ebp - 4], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x401157
mov dword [ebp - 0x134], 0x128
lea eax, [ebp - 0x134]
push eax
mov ecx, dword [ebp - 8]
push ecx
call sub.KERNEL32.dll_Process32First
mov dword [ebp - 0xc], eax
jmp 0x401127
lea edx, [ebp - 0x134]
push edx
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.dll_Process32Next
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40114d
lea ecx, [ebp - 0x110]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x40114b
mov dword [ebp - 4], 1
jmp 0x40114d
jmp 0x401114
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40129f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push edi
mov byte [ebp - 0x108], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x107]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push 0x40807c
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0xffffffff
jne 0x401304
jmp 0x401380
mov dword [ebp - 4], 0
push 0
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x108]
push edx
call fcn.00401ab0
add esp, 4
push eax
lea eax, [ebp - 0x108]
push eax
mov ecx, dword [ebp - 0x10c]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea edx, [ebp - 4]
push edx
push 1
push 0x40808c
mov eax, dword [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00401ab0
add esp, 4
push eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10c]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0x10c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x40a675
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x420408]
jne 0x40a67f
repz ret
jmp fcn.00410ee8

Function at 0x40f27a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x420408]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00408e25
and dword [ebp - 0x14], 0
cmp dword [0x44089c], 0
mov dword [ebp - 0x18], eax
jne 0x40f32d
push 0x4023a8
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40f3d5
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40239c
push ebx
call edi
test eax, eax
je 0x40f3d5
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x40238c
push ebx
mov dword [0x44089c], eax
call edi
push eax
call esi
push 0x402378
push ebx
mov dword [0x4408a0], eax
call edi
push eax
call esi
push 0x40235c
push ebx
mov dword [0x4408a4], eax
call edi
push eax
call esi
mov dword [0x4408ac], eax
test eax, eax
je 0x40f32d
push 0x402344
push ebx
call edi
push eax
call esi
mov dword [0x4408a8], eax
mov eax, dword [0x4408a8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40f386
cmp dword [0x4408ac], ecx
je 0x40f386
push eax
call esi
push dword [0x4408ac]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40f386
test ebx, ebx
je 0x40f386
call edi
test eax, eax
je 0x40f37d
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40f37d
test byte [ebp - 8], 1
jne 0x40f386
or dword [ebp + 0x10], 0x200000
jmp 0x40f3b9
mov eax, dword [0x4408a0]
cmp eax, dword [ebp - 0x18]
je 0x40f3b9
push eax
call esi
test eax, eax
je 0x40f3b9
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40f3b9
mov eax, dword [0x4408a4]
cmp eax, dword [ebp - 0x18]
je 0x40f3b9
push eax
call esi
test eax, eax
je 0x40f3b9
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x44089c]
call esi
test eax, eax
je 0x40f3d5
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40f3d7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a675
leave
ret

Function at 0x41df00
Capabilities:
Delete file
Get uefi variable

Disassembly:
sub esp, 0x800
cmp dword [0x2b6a404], 0x37
jne 0x41df70
push 0x4035d8
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x4035f0
push 0x403640
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionW]
push 0
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
push 0
lea eax, [esp + 4]
push eax
push 0x4036b8
push 0x4036d4
call dword [sym.imp.KERNEL32.dll_GetFirmwareEnvironmentVariableW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
push 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0
lea ecx, [esp + 0x404]
push ecx
push 0x4036e8
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointA]
mov edx, dword [0x2b6a818]
mov ecx, dword [0x2b69ee8]
mov al, byte [edx + esi + 0x38d6]
mov byte [ecx + esi], al
add esp, 0x800
ret
Function at 0x401ca0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x421248
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x42e008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.4154.exe
lea ecx, [ebp - 0x28]
call fcn.004029c0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00401ed0
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 0x30], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x401d17
mov byte [ebp - 0x2b], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00401ef0
mov al, byte [ebp - 0x2b]
jmp 0x401d51
call fcn.00403c30
movzx eax, al
test eax, eax
je 0x401d3b
mov byte [ebp - 0x2a], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00401ef0
mov al, byte [ebp - 0x2a]
jmp 0x401d51
mov byte [ebp - 0x29], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00401ef0
mov al, byte [ebp - 0x29]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00409240
mov esp, ebp
pop ebp
ret

Function at 0x4036f0
Capabilities:
Create process on windows
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x42e008]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor eax, eax
mov word [ebp - 0x20c], ax
push 0x206
push 0
lea ecx, [ebp - 0x20a]
push ecx
call fcn.0040fa30
add esp, 0xc
push 0x208
push 0
lea edx, [ebp - 0x20c]
push edx
call fcn.0040fa30
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
lea ecx, [ebp - 0x20c]
push ecx
call fcn.00403880
add esp, 8
xor edx, edx
mov word [eax + 2], dx
lea eax, [ebp - 0x20c]
add eax, 0xfffffffe
mov dword [ebp - 0x214], eax
mov ecx, dword [ebp - 0x214]
mov dx, word [ecx + 2]
mov word [ebp - 0x216], dx
add dword [ebp - 0x214], 2
cmp word [ebp - 0x216], 0
jne 0x403773
mov edi, dword [ebp - 0x214]
mov eax, dword [0x42b0fc]
mov dword [edi], eax
mov ecx, dword [0x42b100]
mov dword [edi + 4], ecx
mov edx, dword [0x42b104]
mov dword [edi + 8], edx
mov eax, dword [0x42b108]
mov dword [edi + 0xc], eax
mov cx, word [0x42b10c]
mov word [edi + 0x10], cx
push 0
push 0x80
push 2
push 0
push 3
push 0xc0000000
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0xffffffff
jne 0x4037f9
xor eax, eax
jmp 0x403865
push 0
lea eax, [ebp - 0x220]
push eax
push 0x67104
push 0x42f410
mov ecx, dword [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
jne 0x403839
mov edx, dword [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x403865
mov eax, dword [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
push 0
push 0
lea ecx, [ebp - 0x20c]
push ecx
push 0x42b2bc
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409240
mov esp, ebp
pop ebp
ret
Function at 0x408c80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x42e008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x42c204
push ecx
lea eax, [ebp - 0x14]
mov edi, edx
push eax
xor esi, esi
call fcn.0041e854
mov eax, dword [ebp - 0x14]
add esp, 0xc
test eax, eax
je 0x408d2c
push esi
push 0x64
push eax
call fcn.0041e928
add esp, 0xc
cmp eax, 0xffffffff
je 0x408d0f
push dword [ebp - 0x14]
lea eax, [ebp - 0x10]
push 1
push 0xa
push eax
call fcn.0041ed4b
add esp, 0x10
cmp eax, 1
jne 0x408d0f
lea eax, [ebp - 0x10]
push eax
call fcn.00416d55
push 0
push 0x73
push dword [ebp - 0x14]
mov esi, eax
call fcn.0041e928
add esp, 0x10
cmp eax, 0xffffffff
je 0x408d0f
push dword [ebp - 0x14]
push 1
push 0x4f
push edi
call fcn.0041ed4b
xor ecx, ecx
add esp, 0x10
cmp eax, 1
cmovne esi, ecx
push dword [ebp - 0x14]
call fcn.00416431
add esp, 4
mov eax, esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409240
mov esp, ebp
pop ebp
ret
push str.fopen_error
call fcn.00409264
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
xor eax, eax
pop edi
pop esi
call fcn.00409240
mov esp, ebp
pop ebp
ret

Function at 0x408f50
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x42e008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
push ebx
mov dword [ebp - 0x1c], eax
mov bl, 1
mov eax, dword [ebp + 0xc]
push 0x42c228
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0x18], ecx
push eax
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
call fcn.0041e854
add esp, 0xc
test eax, eax
je 0x408fa9
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409240
mov esp, ebp
pop ebp
ret 0xc
push esi
push edi
push dword [ebp - 8]
call fcn.0041f187
push 2
push 0
push dword [ebp - 8]
mov esi, eax
call fcn.0041e928
push dword [ebp - 8]
call fcn.0041f187
push 0
push esi
push dword [ebp - 8]
mov edi, eax
call fcn.0041e928
push edi
call fcn.00409237
push dword [ebp - 8]
mov dword [ebp - 0x14], eax
push 1
push edi
push eax
call fcn.0041ed4b
lea eax, [edi + edi*2]
push eax
mov dword [ebp - 0x10], eax
call fcn.00409237
mov esi, eax
mov eax, dword [ebp - 0x18]
sub edi, eax
push edi
mov edi, dword [ebp - 0x14]
add eax, edi
push eax
lea eax, [ebp - 0x10]
push eax
push esi
call fcn.004195c0
add esp, 0x48
test eax, eax
je 0x40901a
xor bl, bl
jmp 0x409047
push 0x42c22c
push dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
push eax
call fcn.0041e854
add esp, 0xc
test eax, eax
je 0x409036
xor bl, bl
jmp 0x409047
push dword [ebp - 0xc]
push 1
push dword [ebp - 0x10]
push esi
call fcn.0041eb04
add esp, 0x10
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x409057
push eax
call fcn.00416431
add esp, 4
mov eax, dword [ebp - 8]
test eax, eax
je 0x409067
push eax
call fcn.00416431
add esp, 4
test edi, edi
je 0x409074
push edi
call fcn.00409767
add esp, 4
test esi, esi
je 0x409081
push esi
call fcn.00409767
add esp, 4
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409240
mov esp, ebp
pop ebp
ret 0xc