joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416cf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
lea eax, [ebx + 0xd68]
push 0x100
push eax
mov eax, dword [ebx + 0xcc0]
lea edi, [ebx + 0x9c48]
mov dword [ebp - 0x18], 0x6e6b6e55
mov dword [ebp - 0x14], 0x6e776f
call eax
mov ecx, dword [ebx + 0xcb8]
push eax
call ecx
mov esi, eax
test esi, esi
jne 0x416d4f
push 8
lea edx, [ebp - 0x18]
push edx
lea eax, [ebx + 0xd68]
push eax
call fcn.0041bdd0
add esp, 0xc
mov esi, 7
jmp 0x416d60
cmp esi, 0x40
jbe 0x416d60
mov byte [ebx + 0xda7], 0
mov esi, 0x40
push 7
lea eax, [ebp - 0x10]
push eax
push edi
mov dword [ebp - 8], 0xa0d0a0d
mov byte [ebp - 4], 0
mov dword [ebp - 0x10], 0x74736f48
mov word [ebp - 0xc], 0x203a
mov byte [ebp - 0xa], 0
call fcn.0041bdd0
push esi
lea eax, [ebx + 0xd68]
push eax
lea ecx, [edi + 6]
push ecx
call fcn.0041bdd0
push 5
lea edx, [ebp - 8]
push edx
push edi
mov byte [esi + edi + 6], 0
call fcn.0041c1d0
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
lea edx, [esi + edi + 0xa]
push edx
call fcn.0041bdd0
mov eax, dword [ebx + 0x1178]
mov ecx, dword [ebp + 0x10]
push eax
push 2
lea edx, [esi + ecx + 0xa]
push edx
push edi
push ebx
call fcn.004163e0
add esp, 0x44
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x417330
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
xor eax, eax
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x19], eax
mov byte [ebp - 0x15], al
push 0xf
lea eax, [ebp - 0x14]
push eax
push edi
mov dword [ebp - 4], 0x104
mov dword [ebp - 0x24], 0x6d6c7275
mov dword [ebp - 0x20], 0x642e6e6f
mov word [ebp - 0x1c], 0x6c6c
mov byte [ebp - 0x1a], 0
mov dword [ebp - 0x14], 0x73550a0d
mov dword [ebp - 0x10], 0x412d7265
mov dword [ebp - 0xc], 0x746e6567
mov dword [ebp - 8], 0x203a
call fcn.0041bdd0
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x24]
push ecx
add esi, 0xc94
push esi
call fcn.0040ace0
push 0x69767207
push 0
push 0
push eax
push esi
call fcn.00414e40
mov esi, eax
add esp, 0x28
test esi, esi
je 0x4173d9
lea edx, [ebp - 4]
push edx
push edi
call fcn.0041c0a0
add esp, 4
add eax, edi
push eax
push 0
call esi
test eax, eax
jne 0x4173d9
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4181c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
xor al, al
mov byte [ebp - 0x1a], al
dec esi
push esi
lea eax, [ebp - 8]
push eax
push edi
mov dword [ebp - 8], 0x72657375
mov word [ebp - 4], 0x20
mov dword [ebp - 0x10], 0x73736170
mov word [ebp - 0xc], 0x20
mov dword [ebp - 0x18], 0x68747561
mov word [ebp - 0x14], 0x20
mov dword [ebp - 0x20], 0x69676f6c
mov word [ebp - 0x1c], 0x206e
call fcn.0041c630
add esp, 0xc
test eax, eax
je 0x418225
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
push esi
lea ecx, [ebp - 0x10]
push ecx
push edi
call fcn.0041c630
add esp, 0xc
test eax, eax
jne 0x41821a
push esi
lea edx, [ebp - 0x18]
push edx
push edi
call fcn.0041c630
add esp, 0xc
test eax, eax
jne 0x41821a
push esi
lea eax, [ebp - 0x20]
push eax
push edi
call fcn.0041c630
add esp, 0xc
neg eax
sbb eax, eax
pop edi
neg eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x418270
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x18
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x41834a
push edi
mov edi, dword [ebp + 8]
lea ecx, [edi + 0x164f0]
cmp eax, ecx
je 0x418349
mov ecx, dword [ebp + 0x10]
lea edx, [ecx - 0x10]
cmp edx, 0x1ef
ja 0x418349
push ecx
push eax
push edi
call fcn.004181c0
add esp, 0xc
test eax, eax
je 0x418349
push esi
lea esi, [edi + 0x3e48]
push 0x200
push esi
mov dword [ebp - 8], 0xa0d0a0d
mov byte [ebp - 4], bl
mov dword [ebp - 0x18], 0x66696e53
mov dword [ebp - 0x14], 0x72662066
mov dword [ebp - 0x10], 0x93a6d6f
mov dword [ebp - 0xc], ebx
call fcn.0041be00
push 0xe
lea ecx, [ebp - 0x18]
push ecx
push esi
call fcn.0041bdd0
push ebx
lea edx, [edi + 0x1574]
push edx
push esi
call fcn.0041c1d0
push ebx
lea eax, [ebp - 8]
push eax
push esi
call fcn.0041c1d0
push esi
call fcn.0041c0a0
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push ecx
mov ebx, eax
push edx
lea eax, [ebx + edi + 0x3e48]
push eax
call fcn.0041bdd0
mov ecx, dword [edi + 0x1178]
add ebx, dword [ebp + 0x10]
push ecx
push 3
push ebx
push esi
push edi
call fcn.004163e0
add esp, 0x50
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x418c90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
push edi
push 0xff
lea eax, [ebp - 0x11f]
push 0
push eax
mov byte [ebp - 0x120], 0
call fcn.0041be50
mov ecx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov al, 0x6f
mov byte [ebp - 0xc], al
mov eax, dword [ecx + 0x7d8]
add eax, 0x2000
add esp, 0xc
cmp dword [edi + 0x960], 0
mov dword [ebp - 4], 0x544547
mov dword [ebp - 0x18], 0x646e6957
mov dword [ebp - 0x14], 0x2073776f
mov dword [ebp - 0x10], 0x6c707845
mov dword [ebp - 0xb], 0x726572
mov dword [ebp + 8], eax
jne 0x418d18
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x18]
push edx
push edi
call fcn.0041a970
add esp, 0x18
mov dword [edi + 0x960], eax
mov esi, dword [edi + 0x960]
test esi, esi
je 0x418e77
mov eax, dword [ebp + 0x10]
add eax, 4
push eax
lea ecx, [ebp - 0x120]
push ecx
call fcn.00418c10
mov edx, dword [ebp + 0x18]
push 1
push 0
push 3
push 0
push 0
push 0x50
push edx
push esi
push edi
call fcn.0041a9e0
mov esi, eax
add esp, 0x2c
mov dword [ebp - 0x20], esi
test esi, esi
je 0x418e77
push ebx
push 1
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 4]
push ecx
push esi
push edi
call fcn.0041aa60
mov ebx, eax
add esp, 0x24
test ebx, ebx
jne 0x418d97
push esi
push edi
call fcn.0041abc0
add esp, 8
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 0
push ebx
push edi
call fcn.0041aae0
add esp, 0x18
test eax, eax
jle 0x418e65
mov eax, dword [ebp + 0x1c]
mov esi, dword [ebp + 8]
test eax, eax
je 0x418e7d
lea ecx, [esi + 0x5440]
mov dword [ebp + 0xc], ecx
mov ecx, dword [ebp + 8]
mov dword [esi + 0x50], 1
add esi, 0x24
add ecx, 0x10
mov dword [ebp - 0x1c], ecx
mov dword [esi], 0
test eax, eax
je 0x418e0d
mov edx, dword [ebp + 0xc]
push 0x200
push edx
call fcn.0041be00
mov eax, dword [ebp + 8]
lea ecx, [eax + 0x4f1c50]
push 0x14
push ecx
add eax, 0x4c20
push eax
call fcn.0041bdd0
add esp, 0x14
mov eax, dword [esi]
lea edx, [ebp + 8]
push edx
mov ecx, 0x1f4000
sub ecx, eax
add eax, dword [ebp + 0xc]
push ecx
push eax
push ebx
push edi
call fcn.0041ab50
add esp, 0x14
test eax, eax
je 0x418e59
lea ecx, [ecx]
mov eax, dword [ebp + 8]
test eax, eax
je 0x418e59
add dword [esi], eax
mov eax, dword [esi]
lea ecx, [ebp + 8]
push ecx
mov edx, 0x1f4000
sub edx, eax
add eax, dword [ebp + 0xc]
push edx
push eax
push ebx
push edi
call fcn.0041ab50
add esp, 0x14
test eax, eax
jne 0x418e30
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
mov dword [edx], 1
push ebx
push edi
call fcn.0041abc0
push esi
push edi
call fcn.0041abc0
add esp, 0x10
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea edx, [esi + 0x6ed040]
mov dword [ebp + 0xc], edx
mov edx, dword [ebp + 8]
add esi, 0x68
add edx, 0x6c
mov dword [ebp - 0x1c], edx
jmp 0x418ddb
Function at 0x418ea0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
xor eax, eax
push esi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov byte [ebp - 8], al
mov dword [ebp - 7], eax
mov word [ebp - 3], ax
mov byte [ebp - 1], al
push edi
mov al, 0x6f
mov byte [ebp - 0x20], al
xor eax, eax
push 0x7f
push eax
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov word [ebp - 0xf], ax
mov byte [ebp - 0xd], al
mov byte [ebp - 0xc0], al
lea eax, [ebp - 0xbf]
push eax
mov dword [ebp - 0x38], 0x2a2f2a
mov dword [ebp - 0xc], 0x54534f50
mov dword [ebp - 0x2c], 0x646e6957
mov dword [ebp - 0x28], 0x2073776f
mov dword [ebp - 0x24], 0x6c707845
mov dword [ebp - 0x1f], 0x726572
call fcn.0041be50
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edi, dword [ecx + 0x7d8]
add esp, 0xc
cmp dword [esi + 0x960], 0
jne 0x418f51
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x2c]
push edx
push esi
call fcn.0041a970
add esp, 0x18
mov dword [esi + 0x960], eax
test eax, eax
je 0x419060
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x418f79
lea esp, [esp]
cmp dword [eax], 0xa0d0a0d
je 0x418f70
inc eax
cmp byte [eax], 0
jne 0x418f60
jmp 0x418f79
mov dword [eax], 0
add eax, 4
push ebx
mov dword [ebp + 8], eax
push 0x2f
lea eax, [edi + 0x4f3cb0]
push eax
lea ecx, [ebp - 0xc0]
push ecx
call fcn.0041bdd0
mov eax, dword [ebp + 0x18]
mov ecx, dword [esi + 0x960]
push 1
push 0
push 3
push 0
push 0
push 0x50
push eax
push ecx
lea edx, [ebp - 0x38]
push esi
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], 0
call fcn.0041a9e0
mov ebx, eax
add esp, 0x30
test ebx, ebx
je 0x41905f
push 1
push 0
lea edx, [ebp - 0x40]
push edx
push 0
push 0
lea eax, [edi + 0x4f3c70]
push eax
lea ecx, [ebp - 0xc]
push ecx
push ebx
push esi
call fcn.0041aa60
add esp, 0x24
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x419002
push ebx
push esi
call fcn.0041abc0
add esp, 8
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
push edx
call fcn.0041c0a0
add esp, 4
push eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0xc0]
push ecx
call fcn.0041c0a0
add esp, 4
push eax
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0xc0]
push edx
push eax
push esi
call fcn.0041aae0
add esp, 0x18
test eax, eax
jle 0x41904b
cmp dword [ebp + 0x1c], 0
je 0x41904b
mov dword [edi + 0x2050], 1
mov ecx, dword [ebp + 0xc]
push ecx
push esi
call fcn.0041abc0
push ebx
push esi
call fcn.0041abc0
add esp, 0x10
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41a970
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x10]
push ecx
push edx
lea esi, [eax + 0x964]
push esi
push eax
mov dword [ebp - 0x10], 0x65746e49
mov dword [ebp - 0xc], 0x74656e72
mov dword [ebp - 8], 0x6e65704f
mov word [ebp - 4], 0x41
call fcn.0041b000
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x41a9ce
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
push eax
push ecx
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41a9e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x968]
push esi
push eax
mov dword [ebp - 0x14], 0x65746e49
mov dword [ebp - 0x10], 0x74656e72
mov dword [ebp - 0xc], 0x6e6e6f43
mov dword [ebp - 8], 0x41746365
mov byte [ebp - 4], 0
call fcn.0041b000
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x41aa4f
mov eax, dword [ebp + 0x28]
mov ecx, dword [ebp + 0x24]
mov edx, dword [ebp + 0x20]
push eax
mov eax, dword [ebp + 0x1c]
push ecx
mov ecx, dword [ebp + 0x18]
push edx
mov edx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
push eax
push ecx
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41aa60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x96c]
push esi
push eax
mov dword [ebp - 0x14], 0x70747448
mov dword [ebp - 0x10], 0x6e65704f
mov dword [ebp - 0xc], 0x75716552
mov dword [ebp - 8], 0x41747365
mov byte [ebp - 4], 0
call fcn.0041b000
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x41aacf
mov eax, dword [ebp + 0x28]
mov ecx, dword [ebp + 0x24]
mov edx, dword [ebp + 0x20]
push eax
mov eax, dword [ebp + 0x1c]
push ecx
mov ecx, dword [ebp + 0x18]
push edx
mov edx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
push eax
push ecx
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41aae0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x970]
push esi
push eax
mov dword [ebp - 0x14], 0x70747448
mov dword [ebp - 0x10], 0x646e6553
mov dword [ebp - 0xc], 0x75716552
mov dword [ebp - 8], 0x41747365
mov byte [ebp - 4], 0
call fcn.0041b000
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x41ab43
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
push eax
push ecx
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41ab50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x974]
push esi
push eax
mov dword [ebp - 0x14], 0x65746e49
mov dword [ebp - 0x10], 0x74656e72
mov dword [ebp - 0xc], 0x64616552
mov dword [ebp - 8], 0x656c6946
mov byte [ebp - 4], 0
call fcn.0041b000
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x41abaf
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push ecx
push edx
push eax
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41abc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x978]
push esi
push eax
mov dword [ebp - 0x14], 0x65746e49
mov dword [ebp - 0x10], 0x74656e72
mov dword [ebp - 0xc], 0x736f6c43
mov dword [ebp - 8], 0x6e614865
mov dword [ebp - 4], 0x656c64
call fcn.0041b000
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x41ac16
mov eax, dword [ebp + 0xc]
push eax
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41b400
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 4]
test edi, edi
je 0x41b466
cmp dword [esi + 0x18], 0
je 0x41b481
lea ecx, [ecx]
mov edx, dword [esi + 0x30]
push edi
push edx
call fcn.0041cd10
add esp, 8
test eax, eax
jne 0x41b45e
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x41b440
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x41b481
mov eax, dword [esi + 0x18]
test eax, eax
je 0x41b481
cmp eax, ecx
je 0x41b45e
mov esi, dword [esi]
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x41b474
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10002670
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x100026d1
mov eax, dword [ebp + 0x14]
shl dword [ebp + 0x10], 8
mov ecx, dword [ebp + 8]
push ebx
mov eax, dword [eax]
mov ebx, dword [ebp + 0x1c]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0x18]
push esi
mov cl, byte [ecx]
movsx edx, cl
sub cl, 0x61
cmp cl, 0x19
mov ecx, dword [ebp + 0x10]
lea esi, [edx - 0x20]
cmova esi, edx
mov edx, dword [ebp + 0xc]
add ecx, esi
add eax, ebx
xor eax, dword [edx + ecx*4]
mov ecx, ebx
shl ecx, 5
add ecx, 3
add ecx, esi
add ebx, ecx
mov ecx, dword [ebp + 8]
inc ecx
add ebx, eax
mov dword [ebp + 8], ecx
sub edi, 1
jne 0x10002692
pop esi
pop ebx
pop edi
pop ebp
ret 0x18
mov eax, dword [ebp + 0x18]
pop edi
pop ebp
ret 0x18
Function at 0xc63122
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0xc6b084]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor eax, eax
mov word [ebp - 0xc], ax
lea edi, [ebp - 0xa]
stosd dword es:[edi], eax
xor ebx, ebx
stosw word es:[edi], ax
test esi, esi
je 0xc631ba
mov eax, esi
push 2
lea edx, [eax + 2]
pop edi
mov cx, word [eax]
add eax, edi
test cx, cx
jne 0xc63154
sub eax, edx
sar eax, 1
cmp eax, edi
jb 0xc631ba
push esi
call fcn.00c631d7
test al, al
jne 0xc64cb3
cmp word [esi], 0x5c
je 0xc64ca4
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsURLW]
test eax, eax
jne 0xc64cb3
mov ax, word [esi]
mov word [ebp - 0xc], ax
mov ax, word [esi + 2]
push 0x5c
mov word [ebp - 0xa], ax
pop eax
mov word [ebp - 8], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
sub eax, edi
je 0xc631cd
dec eax
jne 0xc64cbb
mov ebx, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.00c6235b
leave
ret 4
xor ebx, ebx
inc ebx
jmp 0xc631ba
cmp word [esi + 2], 0x5c
jne 0xc6317e
push 3
jmp 0xc64cb5
push 6
pop ebx
jmp 0xc631ba
dec eax
je 0xc64caf
dec eax
je 0xc64ccf
dec eax
je 0xc64ccb
xor ebx, ebx
jmp 0xc631ba
push 5
jmp 0xc64cb5
push 4
jmp 0xc64cb5

Function at 0xc63792
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [ebp - 8]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
test esi, esi
je 0xc65e24
cmp dword [ebp - 8], 4
jl 0xc65e30
push ebx
mov ebx, dword [ebp + 0x10]
push edi
push ebx
mov edi, 0xc63834
push edi
push dword [esi + 4]
call fcn.00c6383f
mov eax, dword [ebx]
add esp, 0xc
test eax, eax
je 0xc63823
test al, 3
jne 0xc63823
mov ebx, dword [ebp + 0xc]
push ebx
push edi
push dword [esi + 8]
call fcn.00c6383f
add esp, 0xc
cmp dword [ebx], 0
je 0xc63823
mov edi, dword [ebp + 8]
push edi
push 0xc6382c
push dword [esi + 0xc]
call fcn.00c6383f
add esp, 0xc
cmp dword [edi], 0
je 0xc63823
pop edi
pop ebx
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
pop esi
leave
ret 0xc
mov dword [ebp - 4], 0xc000000d
jmp 0xc63812
mov dword [ebp - 4], 0xc0000017
jmp 0xc63814
mov dword [ebp - 4], 0xc000000d
jmp 0xc63814
Function at 0xc64043
Capabilities:
Read file via mapping

Disassembly:
push 0x30
push 0xc640f0
call fcn.00c61b44
xor esi, esi
mov dword [ebp - 0x1c], esi
xor edi, edi
mov ebx, dword [ebp + 0xc]
mov dword [ebx], esi
push esi
push esi
push esi
push 2
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp + 0xc], eax
cmp eax, esi
je 0xc640e5
push esi
push esi
push esi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
mov dword [ebp - 0x24], edi
cmp edi, esi
je 0xc640e5
push 0x1c
lea eax, [ebp - 0x40]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0xc640e5
mov dword [ebp - 4], esi
lea eax, [ebp + 8]
push eax
push esi
push dword [ebp - 0x34]
push edi
push esi
call dword [0xc6124c]
cmp eax, esi
jl 0xc66634
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov dword [ebx], eax
mov dword [ebp - 4], 0xfffffffe
cmp edi, esi
je 0xc640cc
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp dword [ebp + 0xc], esi
je 0xc640da
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1c]
call fcn.00c61b89
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0xc6662c
mov dword [ebp - 0x1c], eax
jmp 0xc640c1
push eax
call dword [fcn.00c6123c]
mov dword [ebp - 0x1c], eax
jmp 0xc640ba
Function at 0xc67062
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LocalAlloc]
push edi
push 0x10
push 0x40
call ebx
mov edi, eax
mov dword [ebp - 4], edi
test edi, edi
jne 0xc67084
push 8
pop eax
jmp 0xc670d6
push esi
mov esi, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x14
push 0x40
movsd dword es:[edi], dword [esi]
call ebx
xor esi, esi
cmp eax, esi
je 0xc670c9
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
mov ecx, dword [ebp + 0xc]
push esi
push esi
mov dword [eax + 4], ecx
mov ecx, dword [ebp + 0x10]
push eax
mov dword [eax + 8], ecx
mov ecx, dword [ebp + 0x14]
push 0xc66ce9
mov dword [eax + 0xc], ecx
mov ecx, dword [ebp + 0x1c]
push esi
push esi
mov dword [eax + 0x10], ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, esi
jne 0xc670ce
push 8
pop eax
jmp 0xc670d5
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
xor eax, eax
pop esi
pop edi
pop ebx
leave
ret 0x18
Function at 0xc68719
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
xor edi, edi
lea eax, [ebp + 8]
push eax
push edi
lea eax, [ebp - 0x24]
push eax
push 0xc68239
push edi
push edi
mov dword [0xc6b468], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
cmp esi, edi
jne 0xc6878f
mov eax, dword [0xc6b080]
cmp eax, 0xc6b080
je 0xc687d3
test byte [eax + 0x1c], 4
je 0xc687d3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0xc6b080]
push 0xc62618
push 0x3c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.00c67fdf
jmp 0xc687d3
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0xc687cc
mov eax, dword [0xc6b080]
cmp eax, 0xc6b080
je 0xc687cc
test byte [eax + 0x1c], 4
je 0xc687cc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0xc6b080]
push 0xc62618
push 0x3d
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.00c67fdf
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp dword [0xc6b468], edi
pop edi
sete al
pop esi
leave
ret 8

Function at 0xc68d72
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push dword [ebp + 0x10]
shr eax, 4
inc eax
movzx eax, ax
push eax
push 6
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0xc68df4
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0xc68df4
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0xc68ded
and dword [ebp + 0xc], 0xf
jbe 0xc68dc0
mov ecx, dword [ebp + 0xc]
dec ecx
movzx edx, word [eax]
lea eax, [eax + edx*2 + 2]
jne 0xc68db6
mov ecx, dword [ebp + 0x14]
test ecx, ecx
je 0xc68ddc
push esi
movzx esi, word [eax]
neg esi
sbb esi, esi
lea edx, [eax + 2]
and esi, edx
mov dword [ecx], esi
mov ecx, dword [ebp + 0x18]
pop esi
jmp 0xc68de3
mov ecx, dword [ebp + 0x18]
test ecx, ecx
je 0xc68de9
mov ax, word [eax]
mov word [ecx], ax
xor eax, eax
jmp 0xc68df9
mov eax, 0x80004005
jmp 0xc68df9
call fcn.00c68eea
pop ebp
ret 0x14