joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004e00
Capabilities:
Get windows directory from kuser_shared_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x10004e18
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x103ea784]
test eax, eax
je 0x10004e11
cmp dword [0x103ea788], 0
jne 0x10004f1d
xor eax, eax
push esi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov word [ebp - 4], ax
mov byte [ebp - 2], al
lea eax, [ebp - 0xc]
push eax
push 4
push 0xb
push 0x10016cc4
mov eax, 0x10016cc0
call fcn.10009e70
push 0x104
lea ecx, [ebp - 0x110]
push 0
push ecx
call sub.msvcrt.dll_memset
mov eax, 0x7ffe0030
add esp, 0x1c
xor esi, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10004e75
sub eax, edx
sar eax, 1
jne 0x10004e8e
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, ebx
push edi
lea edi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x10004e94
sub ecx, edi
lea ecx, [eax + ecx + 0xc]
xor eax, eax
pop edi
cmp ecx, 0x104
ja 0x10004e88
test ecx, ecx
je 0x10004ecf
cmp word [eax + eax + 0x7ffe0030], 0
je 0x10004ecf
mov dl, byte [eax + eax + 0x7ffe0030]
mov byte [ebp + eax - 0x110], dl
inc eax
inc esi
cmp eax, ecx
jb 0x10004eb0
xor eax, eax
test ecx, ecx
je 0x10004eea
mov dl, byte [ebp + eax - 0xc]
test dl, dl
je 0x10004eea
mov byte [ebp + esi - 0x110], dl
inc eax
inc esi
cmp eax, ecx
jb 0x10004ed5
xor eax, eax
test ecx, ecx
je 0x10004f06
lea esi, [ebp + esi - 0x110]
mov dl, byte [eax + ebx]
test dl, dl
je 0x10004f06
mov byte [esi], dl
inc eax
inc esi
cmp eax, ecx
jb 0x10004ef7
push 8
push 0
lea eax, [ebp - 0x110]
push eax
call dword [0x103ea784]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x800
push 0
push ebx
call eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10009e70
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push esi
push edi
push 0x100
mov edi, eax
lea eax, [ebp - 0x100]
push 0
push eax
call sub.msvcrt.dll_memset
xor esi, esi
add esp, 0xc
cmp dword [ebp + 8], esi
je 0x10009f8a
test edi, edi
je 0x10009f8a
cmp dword [ebp + 0x10], esi
je 0x10009f8a
cmp dword [ebp + 0x14], esi
je 0x10009f8a
xor eax, eax
lea ebx, [ebx]
mov byte [ebp + eax - 0x100], al
inc eax
cmp eax, 0x100
jb 0x10009ec0
xor ecx, ecx
push ebx
xor edx, edx
mov eax, ecx
div dword [ebp + 0x10]
movzx ebx, byte [ebp + ecx - 0x100]
inc ecx
movzx edx, byte [edx + edi]
add edx, ebx
add esi, edx
and esi, 0xff
mov al, byte [ebp + esi - 0x100]
mov byte [ebp + ecx - 0x101], al
mov byte [ebp + esi - 0x100], bl
cmp ecx, 0x100
jb 0x10009ed2
mov eax, dword [ebp + 0xc]
xor esi, esi
xor edi, edi
test eax, eax
je 0x10009f89
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0x14]
sub edx, ecx
mov dword [ebp + 8], eax
jmp 0x10009f30
inc esi
and esi, 0xff
movzx eax, byte [ebp + esi - 0x100]
add edi, eax
and edi, 0xff
mov bl, byte [ebp + edi - 0x100]
mov byte [ebp + esi - 0x100], bl
mov byte [ebp + edi - 0x100], al
movzx ebx, byte [ebp + esi - 0x100]
add ebx, eax
and ebx, 0x800000ff
jns 0x10009f76
dec ebx
or ebx, 0xffffff00
inc ebx
mov al, byte [ebp + ebx - 0x100]
xor al, byte [edx + ecx]
inc ecx
dec dword [ebp + 8]
mov byte [ecx - 1], al
jne 0x10009f30
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000b310
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push ebx
mov ebx, dword [ebp + 8]
push esi
push 0x400
lea eax, [ebp - 0x400]
push 0
push eax
or esi, 0xffffffff
call sub.msvcrt.dll_memset
lea ecx, [ebp - 0x400]
push ecx
push 4
push 0x400
push 0x1001742c
mov eax, 0x10017428
call fcn.10009e70
add esp, 0x1c
xor eax, eax
test edi, edi
je 0x1000b37b
lea ebx, [ebx]
movzx edx, byte [eax + ebx]
xor edx, esi
and edx, 0xff
shr esi, 8
xor esi, dword [ebp + edx*4 - 0x400]
inc eax
cmp eax, edi
jb 0x1000b360
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000b390
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
xor eax, eax
mov dword [ebp - 8], eax
test esi, esi
je 0x1000b490
mov eax, dword [esi + 0x10]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esi + 4]
lea ecx, [ebp - 4]
push ecx
push eax
lea edx, [ebp - 8]
push edx
push 0
push 0x10016bb8
push SysStringLen
mov dword [ebp - 4], edi
call ebx
cmp eax, 0xea
je 0x1000b3df
test eax, eax
jne 0x1000b48c
cmp dword [esi + 0x10], eax
jne 0x1000b434
mov ecx, dword [ebp - 8]
cmp ecx, 1
je 0x1000b3f1
cmp ecx, 2
je 0x1000b3f1
cmp ecx, 7
jne 0x1000b3f5
add dword [ebp - 4], 6
cmp eax, 0xea
jne 0x1000b408
cmp dword [ebp - 4], edi
jne 0x1000b408
add dword [ebp - 4], 0x400
mov eax, dword [ebp - 4]
mov ecx, esi
call fcn.1000af90
test eax, eax
je 0x1000b48c
mov eax, dword [esi + 0x10]
lea ecx, [ebp - 4]
push ecx
push eax
lea edx, [ebp - 8]
push edx
push 0
push 0x10016bb8
push SysStringLen
call ebx
test eax, eax
jne 0x1000b48c
mov eax, dword [ebp - 8]
cmp eax, 1
je 0x1000b45b
cmp eax, 2
je 0x1000b45b
mov ecx, dword [ebp - 4]
mov eax, dword [esi + 4]
cmp ecx, eax
jbe 0x1000b44d
mov ecx, eax
pop edi
mov dword [esi + 8], ecx
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x10]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1000b461
mov ecx, dword [esi + 4]
sub eax, edx
sar eax, 1
mov dword [esi + 0xc], eax
add eax, eax
cmp eax, ecx
jbe 0x1000b47e
mov eax, ecx
pop edi
mov dword [esi + 8], eax
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000b540
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x18]
push ebx
push edi
mov edi, dword [eax + 0x30]
mov ecx, dword [edi + 0xa4]
mov dword [esi + 4], ecx
mov edx, dword [edi + 0xa8]
mov dword [esi + 8], edx
movzx eax, word [edi + 0xac]
mov dword [esi + 0xc], eax
mov ecx, dword [edi + 0xb0]
mov dword [esi + 0x10], ecx
mov eax, dword [edi + 0x1f4]
mov ebx, 1
test eax, eax
je 0x1000b591
push 0x7f
push eax
lea edx, [esi + 0x14]
push edx
call dword [sym.imp.msvcrt.dll_wcsncpy]
add esp, 0xc
jmp 0x1000b597
xor eax, eax
mov word [esi + 0x14], ax
movzx ecx, byte [edi + 0xaf]
mov word [esi + 0x114], cx
mov dx, word [edi + 0xae]
mov eax, 0xff
and dx, ax
mov word [esi + 0x116], dx
movzx ecx, word [0x7ffe02d0]
mov word [esi + 0x118], cx
mov byte [esi + 0x11a], 0
cmp byte [0x7ffe0268], 0
je 0x1000b5df
mov ebx, dword [0x7ffe0264]
pop edi
mov byte [esi + 0x11a], bl
cmp ebx, 1
pop ebx
jne 0x1000b5f8
mov edx, 0xffef
and word [esi + 0x118], dx
ret

Function at 0x1000c690
Capabilities:
Get windows directory from kuser_shared_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
push esi
push edi
push 0
push 0
push 0x103ea8f0
mov edi, eax
call ebx
mov esi, eax
test esi, esi
jne 0x1000c7b5
mov eax, 0x7ffe0030
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1000c6c0
sub eax, edx
sar eax, 1
cmp eax, 2
ja 0x1000c726
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
push 4
push 0x18
push 0x100178b0
mov eax, 0x100178ac
call fcn.10009e70
lea eax, [ebp - 0x18]
add esp, 0x10
lea edx, [eax + 2]
jmp 0x1000c710
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1000c710
sub eax, edx
sar eax, 1
push eax
lea ecx, [ebp - 0x18]
push ecx
jmp 0x1000c72c
push eax
push 0x7ffe0030
mov esi, edi
call fcn.10003040
cmp dword [edi + 0x18], 8
mov ecx, dword [edi + 0x14]
jb 0x1000c741
mov eax, dword [edi + 4]
jmp 0x1000c744
lea eax, [edi + 4]
cmp word [eax + ecx*2 - 2], 0x5c
je 0x1000c758
push 0x5c
mov eax, 1
call fcn.10001aa0
mov ebx, dword [edi + 0x14]
lea ebx, [ebx + ebx + 4]
push ebx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x1000c7c9
cmp dword [edi + 0x18], 8
mov ecx, dword [edi + 0x14]
jb 0x1000c783
mov eax, dword [edi + 4]
jmp 0x1000c786
lea eax, [edi + 4]
lea edx, [ecx + ecx]
push edx
push eax
push ebx
push esi
call fcn.100131ba
mov eax, dword [edi + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
add esp, 0x10
push eax
push 0x103ea8f8
call edi
push esi
push 0x103ea8f0
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0x103ea8f8
call ebx
push eax
push esi
mov esi, edi
call fcn.10003040
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10012e52
Capabilities:
Execute syscall

Disassembly:
mov edx, esp
sysenter
ret
Function at 0xae51b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00ae5140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00ae5140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00ae5140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00ae5140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xae5bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xae5c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xaf787c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xae5c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xae5c52
xor eax, eax
pop esi
leave
ret 4

Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..rsrc
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x431072
mov ebx, 0x40915c
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x31d34e53
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x431060
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4310d2
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x38173676
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x403ad0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
xor eax, 0xffffffff
test ecx, ecx
mov esi, dword [ebp + 8]
je 0x403af9
xor al, byte [esi]
movzx edx, al
shr eax, 8
mov edx, dword [edx*4 + section..data]
inc esi
xor eax, edx
dec ecx
jne 0x403ae4
xor eax, 0xffffffff
pop esi
leave
ret 0xc

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
mov ecx, 0x29162f98
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x431024
nop
mov eax, section..data
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x451b3289
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x431084
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219

Function at 0x4022e0
Capabilities:
Terminate process

Disassembly:
mov edx, eax
push dword [0x40374f]
call dword [sym.imp.pdh.dll_PdhCloseQuery]
mov eax, 5
add eax, 5
inc eax
xor edi, edi
xor esi, esi
test eax, 0xb
jne 0x40230e
push 0
call dword [sym.imp.kernel32.dll_ExitProcess]
mov edx, eax
mov dword [0x401775], eax
ret
Function at 0x403250
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4476bd
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x460080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 4
call fcn.004281b7
mov ecx, eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], ecx
mov dword [ecx], eax
lea edi, [esi + 4]
mov dword [ebp - 4], 0
push edi
push 0
push ecx
push 0x403500
push 0
push 0
call fcn.0042d10c
add esp, 0x1c
mov dword [esi], eax
test eax, eax
je 0x4032d1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004281a9
mov esp, ebp
pop ebp
ret 4
push 6
mov dword [edi], 0
call fcn.00426c2e
int3
Function at 0x4069d0
Capabilities:
Get common file path

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x447c08
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x54
mov eax, dword [0x460080]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0
push eax
push 0
push 0
push 0x44b300
mov dword [ebp - 0x18], 0
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
mov edx, dword [ebp - 0x18]
test edx, edx
je 0x406b61
mov ecx, edx
mov dword [ebp - 0x3c], 0
xorps xmm0, xmm0
mov dword [ebp - 0x38], 0
movups xmmword [ebp - 0x4c], xmm0
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x406a53
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x4c]
call fcn.004032e0
mov byte [ebp - 4], 1
lea eax, [ebx + 8]
cmp dword [ebx + 0x1c], 7
lea ecx, [ebp - 0x4c]
push dword [ebx + 0x18]
cmova eax, dword [ebx + 8]
push eax
call fcn.004030c0
xor ecx, ecx
movups xmm1, xmmword [eax]
movq xmm0, qword [eax + 0x10]
movups xmmword [ebp - 0x64], xmm1
mov dword [eax + 0x10], 0
movq qword [ebp - 0x54], xmm0
mov dword [eax + 0x14], 7
mov word [eax], cx
xor eax, eax
movq qword [ebp - 0x24], xmm0
movups xmmword [ebp - 0x34], xmm1
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x50], 7
mov word [ebp - 0x64], ax
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 3
call fcn.00404f90
mov ecx, dword [ebp - 0x20]
mov byte [ebp - 0x19], al
cmp ecx, 7
jbe 0x406b0d
mov edx, dword [ebp - 0x34]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x406b03
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x406bbb
push ecx
push edx
call fcn.004281e7
add esp, 8
mov ecx, dword [ebp - 0x38]
xor eax, eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 7
mov word [ebp - 0x34], ax
cmp ecx, 7
jbe 0x406b57
mov edx, dword [ebp - 0x4c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x406b4d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x406bbb
push ecx
push edx
call fcn.004281e7
add esp, 8
cmp byte [ebp - 0x19], 0
mov byte [ebp - 0x19], 1
jne 0x406b65
mov byte [ebp - 0x19], 0
mov ecx, dword [ebx + 0x1c]
cmp ecx, 7
jbe 0x406b9b
mov edx, dword [ebx + 8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x406b91
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x406bc0
push ecx
push edx
call fcn.004281e7
add esp, 8
mov al, byte [ebp - 0x19]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004281a9
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.0042cf5f
call fcn.0042cf5f
int3
Function at 0x407510
Capabilities:
Set file attributes

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x447d65
mov eax, dword fs:[0]
push eax
push ecx
push ebx
sub esp, 0x50
mov eax, dword [0x460080]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x38], esi
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x3c], esi
call fcn.00407170
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x24]
test ecx, ecx
jne 0x4075ca
xorps xmm0, xmm0
movups xmmword [esi], xmm0
push ecx
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], ecx
push 0x4571b0
mov ecx, esi
call fcn.004032e0
mov ecx, dword [ebp - 0x20]
cmp ecx, 7
jbe 0x4075c3
mov edx, dword [ebp - 0x34]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4075b9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407701
push ecx
push edx
call fcn.004281e7
add esp, 8
mov eax, esi
jmp 0x4076e3
sub esp, 0x18
mov byte [ebp - 4], 1
mov eax, 0x7ffffffe
mov edx, esp
sub eax, ecx
mov dword [ebp - 0x38], edx
cmp eax, 0xd
jb 0x407706
cmp dword [ebp - 0x20], 7
lea eax, [ebp - 0x34]
push 0xd
cmova eax, dword [ebp - 0x34]
push 0x4571c0
push ecx
push eax
push ecx
push dword [ebp - 0x38]
mov ecx, edx
call fcn.0040b500
call fcn.004267b0
add esp, 0x18
mov byte [ebp - 0x40], 0
mov edi, eax
lea edx, [ebp - 0x38]
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x38], edi
push dword [ebp - 0x40]
call fcn.0040b700
add esp, 4
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 2
call fcn.004053c0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x48]
cmp ecx, 7
jbe 0x407671
mov edx, dword [ebp - 0x5c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x407667
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40770b
push ecx
push edx
call fcn.004281e7
add esp, 8
push 2
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, edi
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x407693
sub ecx, edx
sar ecx, 1
push ecx
push edi
jmp 0x407582
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004281a9
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.0042cf5f
call fcn.00401510
call fcn.0042cf5f
int3
Function at 0x4086e0
Capabilities:
Get common file path

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x447f0b
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x24c
mov eax, dword [0x460080]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x224], esi
push 0x104
lea eax, [ebp - 0x220]
mov dword [ebp - 0x224], esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xorps xmm0, xmm0
test eax, eax
je 0x4088d9
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x244], 0
movups xmmword [ebp - 0x254], xmm0
mov dword [ebp - 0x240], 0
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x408770
sub ecx, edx
lea eax, [ebp - 0x220]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x254]
call fcn.004032e0
push 1
sub esp, 8
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x254]
call fcn.0040b330
mov dword [ebp - 0x22c], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x23c], xmm0
mov dword [ebp - 0x228], 0
xor ecx, ecx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x23c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x22c], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
push 9
push str.cmd.exe_
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], 1
call fcn.004030c0
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [esi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov ecx, dword [ebp - 0x228]
cmp ecx, 7
jbe 0x40887e
mov edx, dword [ebp - 0x23c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x408874
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408917
push ecx
push edx
call fcn.004281e7
add esp, 8
mov ecx, dword [ebp - 0x240]
xor eax, eax
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x228], 7
mov word [ebp - 0x23c], ax
cmp ecx, 7
jbe 0x4088f8
mov edx, dword [ebp - 0x254]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4088cd
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408917
push ecx
push edx
call fcn.004281e7
add esp, 8
jmp 0x4088f8
push 0x1d
movups xmmword [esi], xmm0
push str._C:WindowsSystem32cmd.exe_
mov ecx, esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.004032e0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004281a9
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.0042cf5f
int3