joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4026eb
Capabilities:
Get installed programs

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
push ebx
push esi
push edi
push 0x34
mov ecx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
lea eax, [ebp - 0x20]
mov dword [ebp - 0x78], str.1F1C2DFC_2D24_3E06_BCB8_725134ADF989
mov dword [ebp - 0x74], str.9BE518E6_ECC6_35A9_88E4_87755C07200F
mov dword [ebp - 0x70], str.FF66E9F6_83E7_3A3E_AF14_8DE9A809A6A4
mov dword [ebp - 0x6c], str.9A25302D_30C0_39D9_BD6F_21E6EC160475
mov dword [ebp - 0x68], str.A09D5493_0D9F_3211_B3BF_DD7ABBB318C1
mov dword [ebp - 0x64], str.F2E0402D_AA60_32E3_8480_39AD5CE79DF2
mov dword [ebp - 0x60], str.CC1DB186_550F_3CFE_A2A9_EBA5E5A34BC1
mov dword [ebp - 0x5c], str.09298F26_A95C_31E2_9D95_2C60F586F075
mov dword [ebp - 0x58], str.31B44A9A_7CFE_3039_AEAE_A664F3C5F7BD
mov dword [ebp - 0x54], str.E3F7F270_4ADD_3DA6_8B35_A924C134D49F
mov dword [ebp - 0x50], str.9B775AA1_7B10_379A_9B16_7E373790568C
mov dword [ebp - 0x4c], str.DCB46B42_723F_350E_B18A_449BC6C21636
mov dword [ebp - 0x48], str.09C0A8D5_EEC1_369D_8C7A_2E2DD17DCA5E
mov dword [ebp - 0x44], str.86CE1746_9EFF_3C9C_8755_81EA8903AC34
mov dword [ebp - 0x40], str.CA8A885F_E95B_3FC6_BB91_F4D9377C7686
mov dword [ebp - 0x3c], str.820B6609_4C97_3A2B_B644_573B06A0F0CC
mov dword [ebp - 0x38], str.6AFCA4E1_9B78_3640_8F72_A7BF33448200
mov dword [ebp - 0x34], str.F03CB3EF_DC16_35CE_B3C1_C68EA09E5E97
mov dword [ebp - 0x30], str.402ED4A1_8F5B_387A_8688_997ABF58B8F2
mov dword [ebp - 0x2c], str.887868A2_D6DE_3255_AA92_AA0B5A59B874
mov dword [ebp - 0x28], str.527BBE2F_1FED_3D8B_91CB_4DB0F838E69E
mov dword [ebp - 0x24], str.57660847_B1F7_35BD_9118_F62EB863A598
call fcn.00402e70
mov esi, eax
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop ecx
mov eax, 0x200
movsd dword es:[edi], dword [esi]
call fcn.00402d91
xor ebx, ebx
mov esi, eax
mov dword [ebp - 8], ebx
cmp esi, ebx
jne 0x4027c6
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
inc eax
jmp 0x40282d
and dword [ebp - 4], 0
mov ecx, esi
call fcn.00402e9d
lea edi, [ebp - 0x14]
mov eax, esi
call fcn.00402f65
mov eax, dword [ebp + ebx*4 - 0x78]
mov ecx, esi
call fcn.00402fa6
lea eax, [ebp - 4]
push eax
push 1
push 0
mov eax, esi
call fcn.00402f20
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp dword [ebp - 4], 0
mov edi, eax
je 0x402812
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x40281e
inc ebx
cmp ebx, 0x16
jb 0x4027c6
jmp 0x402825
mov dword [ebp - 8], 1
call fcn.00402e7e
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402996
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
push ebx
lea eax, [ebp - 4]
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402a02
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push str.SecureProtocols
push dword [ebp - 4]
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402a02
cmp dword [ebp - 0x10], 4
jne 0x402a02
test dword [ebp - 8], 0x200
je 0x402a08
test dword [ebp - 8], 0x800
je 0x402a08
inc ebx
jmp 0x402a08
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 4], 0
je 0x402a17
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
pop ebx
leave
ret

Function at 0x402ca6
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov edi, eax
xor esi, esi
cmp edi, esi
jne 0x402cb4
xor eax, eax
jmp 0x402d20
push ebx
push 0x14
pop eax
call fcn.00402330
mov ebx, eax
cmp ebx, esi
je 0x402d12
push 0x14
call fcn.00401ecc
push esi
push dword [esp + 0x18]
mov dword [ebx + 0x10], 1
call fcn.00402a6f
add esp, 0xc
mov dword [ebx], eax
cmp eax, esi
je 0x402d0b
lea eax, [ebx + 8]
push eax
push esi
push ebx
push 0x402c7c
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebx + 4], eax
cmp eax, esi
jne 0x402d16
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebx]
call fcn.00402ac6
push ebx
call fcn.00402355
pop ecx
xor eax, eax
jmp 0x402d1f
mov dword [ebx + 0xc], fcn.0040abe7
mov eax, ebx
pop ebx
pop edi
pop esi
ret

Function at 0x402d23
Capabilities:
Terminate thread

Disassembly:
push ebx
mov ebx, eax
test ebx, ebx
je 0x402d71
call fcn.00402b81
call fcn.00402b0f
push 0xbb8
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x402d58
cmp eax, 0x102
jne 0x402d58
push 0
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebx]
call fcn.00402ac6
push ebx
call fcn.00402355
pop ecx
pop esi
pop ebx
ret

Function at 0x403bac
Capabilities:
Delete file

Disassembly:
test edi, edi
je 0x403c28
mov eax, dword [edi + 8]
test eax, eax
je 0x403bbe
push eax
call fcn.004034ae
pop ecx
mov eax, dword [edi + 4]
test eax, eax
je 0x403bcc
push eax
call fcn.004034ae
pop ecx
mov eax, dword [edi]
test eax, eax
je 0x403bd9
push eax
call fcn.004034ae
pop ecx
mov eax, dword [edi + 0xc]
cmp eax, 0xffffffff
je 0x403bf1
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
mov esi, dword [edi + 0x20]
call fcn.00402e7e
mov esi, dword [edi + 0x24]
call fcn.00402e7e
mov eax, dword [edi + 0x2c]
cmp dword [eax + 0x14], 0
pop esi
je 0x403c28
mov ecx, dword [edi + 0x30]
cmp dword [ecx + 4], 0
je 0x403c28
mov eax, dword [eax + 0x18]
call fcn.00402f20
test eax, eax
je 0x403c28
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
ret
Function at 0x404154
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
push ebx
push esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0x20000013
push dword [edi + 8]
mov dword [ebp - 8], 4
mov dword [ebp - 0xc], 1
call fcn.00403795
mov eax, 0x100
call fcn.00402d91
push str._req_state_read_status_code__zHttpQueryInfo_complete__status:
push 0x3d
pop ebx
mov esi, eax
call fcn.00402fdf
push dword [ebp - 4]
mov ecx, esi
call fcn.004030e2
add esp, 0x18
mov eax, esi
call fcn.00401649
call fcn.00402e7e
cmp dword [ebp - 4], 0x197
je 0x4041c7
cmp dword [ebp - 4], 0x191
jne 0x40421c
xor esi, esi
cmp dword [ebp - 0xc], esi
je 0x40421c
push 0x2eee
push dword [edi + 8]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call fcn.00403748
add esp, 0xc
cmp eax, 0x4c7
jne 0x4041f1
mov dword [ebp - 0xc], esi
jmp 0x4041b5
push esi
push esi
push dword [edi + 8]
call fcn.004036fe
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0x20000013
push dword [edi + 8]
mov dword [ebp - 8], 4
call fcn.00403795
add esp, 0x1c
jmp 0x4041b5
mov eax, 0x100
call fcn.00402d91
push str._req_state_read_status_code__zHttpQueryInfo_complete__status:
mov esi, eax
call fcn.00402fdf
push dword [ebp - 4]
mov ecx, esi
call fcn.004030e2
push str._Error:
push 8
pop ebx
mov eax, esi
call fcn.00402fdf
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call fcn.004030e2
pop ecx
mov eax, esi
call fcn.00401649
call fcn.00402e7e
mov eax, dword [edi + 0x30]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret
Function at 0x4050fd
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [esi + 8]
sub esp, 0x10
test eax, eax
je 0x40514c
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x40514c
lea eax, [ebp - 0x10]
push eax
push dword [esi + 8]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0xc]
push 0
push eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 8]
call dword [sym.imp.USER32.dll_MoveWindow]
push 5
push dword [esi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
leave
ret 8

Function at 0x405a27
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, eax
mov eax, dword [esi]
test eax, eax
je 0x405bf3
push edi
lea ecx, [ebp - 0x10]
push ecx
push dword [eax + 0x25c]
call dword [sym.imp.USER32.dll_GetClientRect]
xor edx, edx
push 0x20
pop edi
cmp dword [ebp + 0x10], edx
jne 0x405ab3
mov eax, dword [esi]
push dword [eax + 0x25c]
call fcn.00406e09
push 0x30
pop edx
mov dword [esp], 0x1a0
sub edx, eax
push edi
push edx
lea eax, [esi + 0x50]
mov ecx, edi
call fcn.00406f1c
mov eax, dword [esi + 0x5c]
push 0x190
lea eax, [eax + edx + 0xc]
push 0x2c
push eax
lea eax, [esi + 0x80]
mov ecx, edi
call fcn.00406f1c
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
push 0x47
add eax, 0xffffffc8
push edi
push eax
add ecx, 0xffffff99
lea eax, [esi + 4]
call fcn.00406f1c
add esp, 0x24
xor edx, edx
cmp ebx, edx
je 0x405ad7
mov ecx, dword [esi + 8]
push 0x9b
push edi
push dword [esi + 0xc]
sub ecx, 0xaf
lea eax, [esi + 0xb0]
call fcn.00406f1c
add esp, 0xc
cmp dword [ebp + 8], edx
je 0x405b05
cmp ebx, edx
je 0x405ae8
mov eax, dword [esi + 0xb4]
jmp 0x405aeb
mov eax, dword [esi + 8]
push 0x71
push edi
push dword [esi + 0xc]
lea ecx, [eax - 0x85]
lea eax, [esi + 0xfc]
call fcn.00406f1c
add esp, 0xc
cmp dword [ebp + 0xc], edx
je 0x405b43
cmp dword [ebp + 8], edx
je 0x405b17
mov eax, dword [esi + 0x100]
jmp 0x405b26
cmp ebx, edx
je 0x405b23
mov eax, dword [esi + 0xb4]
jmp 0x405b26
mov eax, dword [esi + 8]
push 0xa9
push edi
push dword [esi + 0xc]
lea ecx, [eax - 0xbd]
lea eax, [esi + 0x148]
call fcn.00406f1c
add esp, 0xc
cmp dword [ebp + 0x10], edx
je 0x405bf2
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
cmp ebx, edx
mov ebx, dword [sym.imp.USER32.dll_MoveWindow]
je 0x405b80
push 1
push dword [esi + 0xbc]
push dword [esi + 0xc0]
push dword [esi + 0xb8]
push dword [esi + 0xb4]
push dword [esi + 0xb0]
call ebx
jmp 0x405b8a
push 0
push dword [esi + 0xb0]
call edi
cmp dword [ebp + 8], 0
je 0x405bb4
push 1
push dword [esi + 0x108]
push dword [esi + 0x10c]
push dword [esi + 0x104]
push dword [esi + 0x100]
push dword [esi + 0xfc]
call ebx
jmp 0x405bbe
push 0
push dword [esi + 0xfc]
call edi
cmp dword [ebp + 0xc], 0
je 0x405be8
push 1
push dword [esi + 0x154]
push dword [esi + 0x158]
push dword [esi + 0x150]
push dword [esi + 0x14c]
push dword [esi + 0x148]
call ebx
jmp 0x405bf2
push 0
push dword [esi + 0x148]
call edi
pop edi
pop ebx
leave
ret 0xc
Function at 0x406cc5
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0xc
push esi
xor esi, esi
cmp ebx, esi
je 0x406d8a
push edi
mov edi, dword [sym.imp.USER32.dll_IsWindowVisible]
push ebx
call edi
test eax, eax
je 0x406d89
push 0xfffffffffffffff0
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, 0x40000000
jne 0x406d89
push ebx
call edi
test eax, eax
je 0x406d14
push ebx
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x406d14
push 9
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
push ebp
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push esi
push edi
mov dword [esp + 0x14], eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebp, dword [sym.imp.USER32.dll_AttachThreadInput]
push 1
push dword [esp + 0x10]
mov dword [esp + 0x1c], eax
push eax
call ebp
mov edi, dword [sym.imp.USER32.dll_SetWindowPos]
push 3
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push ebx
mov dword [esp + 0x2c], eax
call edi
push 3
push esi
push esi
push esi
push esi
push 0xfffffffffffffffe
push ebx
call edi
push ebx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
cmp dword [esp + 0x10], esi
je 0x406d7a
push esi
push dword [esp + 0x10]
push dword [esp + 0x1c]
call ebp
push ebx
call dword [sym.imp.USER32.dll_SetFocus]
push ebx
call dword [sym.imp.USER32.dll_SetActiveWindow]
pop ebp
pop edi
pop esi
add esp, 0xc
ret

Function at 0x407400
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push edi
mov edi, eax
test edi, edi
je 0x40745d
cmp dword [esp + 8], 0
je 0x40745d
push ebx
push esi
mov eax, 0x400
call fcn.00402d91
mov esi, eax
call fcn.00402f65
xor ebx, ebx
push 0x40c33c
inc ebx
mov eax, esi
call fcn.00402fdf
mov eax, dword [esp + 0x14]
pop ecx
mov ecx, esi
call fcn.00402fa6
mov eax, esi
call fcn.00402f20
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, eax
call fcn.00402e7e
pop esi
xor eax, eax
cmp edi, 0xffffffff
pop ebx
setne al
pop edi
ret
xor eax, eax
pop edi
ret
Function at 0x407461
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
mov esi, eax
xor edi, edi
test esi, esi
jne 0x407472
xor eax, eax
jmp 0x40752a
call fcn.00402f20
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40746b
test al, 0x10
je 0x40746b
push ebp
mov ebp, str.Zoom.exe
push ebp
mov eax, esi
call fcn.00407400
pop ecx
test eax, eax
je 0x407527
push str.zChatApp.dll
mov eax, esi
call fcn.00407400
pop ecx
test eax, eax
je 0x407527
push str.zVideoApp.dll
mov eax, esi
call fcn.00407400
pop ecx
test eax, eax
je 0x407527
push str.Cmmlib.dll
mov eax, esi
call fcn.00407400
pop ecx
test eax, eax
je 0x407527
push ebx
mov eax, esi
call fcn.00402e33
xor ebx, ebx
push 0x40c33c
inc ebx
mov edi, eax
call fcn.00402fdf
push ebp
push 8
pop ebx
mov eax, edi
call fcn.00402fdf
pop ecx
pop ecx
mov eax, 0x400
call fcn.00402d91
mov esi, eax
test esi, esi
je 0x40751f
push str._imp_has_zoom_under_path__found_zoom_binaries_under:
push 0x35
pop ebx
call fcn.00402fdf
pop ecx
mov eax, esi
call fcn.00401649
call fcn.00402e7e
mov eax, edi
call fcn.00401649
pop ebx
mov eax, edi
pop ebp
pop edi
pop esi
ret

Function at 0x40752d
Capabilities:
Create directory
Get common file path

Disassembly:
push esi
push edi
mov eax, 0x400
call fcn.00402d91
mov esi, eax
xor edi, edi
cmp esi, edi
jne 0x407548
xor eax, eax
jmp 0x407602
mov eax, dword [esp + 0xc]
sub eax, edi
je 0x407576
dec eax
je 0x40756d
dec eax
je 0x407564
sub eax, 4
jne 0x407591
push dword [esi + 8]
push edi
push edi
push 0x2a
jmp 0x40757d
push dword [esi + 8]
push edi
push edi
push 0x26
jmp 0x40757d
push dword [esi + 8]
push edi
push edi
push 0x1c
jmp 0x40757d
push dword [esi + 8]
push edi
push edi
push 0x1a
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
xor ecx, ecx
test eax, eax
setge cl
mov eax, ecx
cmp eax, edi
jne 0x40759e
call fcn.00402e7e
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x407541
push ebx
push 1
push 1
xor eax, eax
xor bl, bl
mov edx, esi
call fcn.004031da
mov dword [esi + 4], eax
xor ebx, ebx
push 0x40c33c
inc ebx
mov eax, esi
call fcn.00402fdf
add esp, 0xc
mov eax, str.ZoomVDI
cmp dword [esp + 0x18], edi
jne 0x4075d3
mov eax, str.Zoom
mov ecx, esi
call fcn.00402fa6
cmp dword [esp + 0x14], edi
je 0x4075ef
push edi
mov eax, esi
call fcn.00402f20
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
xor ebx, ebx
push 0x40c33c
inc ebx
mov eax, esi
call fcn.00402fdf
pop ecx
mov eax, esi
pop ebx
pop edi
pop esi
ret
Function at 0x407a7d
Capabilities:
Create directory

Disassembly:
push esi
push edi
xor esi, esi
push esi
push 1
push esi
call fcn.0040752d
mov edi, eax
add esp, 0xc
cmp edi, esi
jne 0x407aa0
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
jmp 0x407b3c
push ebx
push ebp
push str.ZoomDownload
push 0xc
pop ebx
call fcn.00402fdf
pop ecx
push esi
mov eax, edi
call fcn.00402f20
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ebp, eax
xor ebx, ebx
push 0x40c33c
inc ebx
mov eax, edi
call fcn.00402fdf
mov eax, 0x800
call fcn.00402d91
mov dword [esp], str._param_query_local_path__path_is:
push 0x22
pop ebx
mov esi, eax
call fcn.00402fdf
mov eax, esi
call fcn.00402f65
mov dword [esp], str._dir_create_response_:
push 0x17
pop ebx
mov eax, esi
call fcn.00402fdf
push ebp
mov ecx, esi
call fcn.004030e2
push str._system_error:
push 0xf
pop ebx
mov eax, esi
call fcn.00402fdf
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call fcn.004030e2
pop ecx
mov eax, esi
call fcn.00401649
call fcn.00402e7e
pop ebp
mov eax, edi
pop ebx
pop edi
pop esi
ret

Function at 0x407f8b
Capabilities:
Get session user name

Disassembly:
push ebp
lea ebp, [esp - 0x88]
sub esp, 0x108
mov eax, dword [0x40f004]
xor eax, ebp
mov dword [ebp + 0x84], eax
push esi
mov eax, 0x400
call fcn.00402d91
mov esi, eax
mov dword [ebp - 0x80], 0xff
test esi, esi
je 0x407ffb
push ebx
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push str.GlobalZOpener.
push 0xf
pop ebx
mov eax, esi
call fcn.00402fdf
lea eax, [ebp - 0x7c]
mov ecx, esi
call fcn.00402fa6
mov dword [esp], str..launcher
push 9
pop ebx
mov eax, esi
call fcn.00402fdf
pop ecx
mov eax, esi
pop ebx
mov ecx, dword [ebp + 0x84]
xor ecx, ebp
pop esi
call fcn.00402440
add ebp, 0x88
leave
ret

Function at 0x40804f
Capabilities:
Check mutex on windows

Disassembly:
push esi
call fcn.00407f8b
mov esi, eax
test esi, esi
jne 0x40805d
pop esi
ret
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
mov eax, esi
call fcn.00402f20
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ebx, eax
call fcn.00402e7e
call edi
cmp eax, 0xb7
je 0x408099
push 0x2710
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4080a4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4080a7
xor eax, eax
inc eax
pop edi
pop ebx
pop esi
ret
Function at 0x408190
Capabilities:
Copy file
Create process on windows
Create process suspended
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
mov edi, 0x400
mov eax, edi
call fcn.00402d91
mov ebx, eax
mov eax, 0x800
mov dword [ebp - 4], ebx
call fcn.00402d91
mov esi, eax
mov eax, edi
call fcn.00402d91
mov edi, eax
test ebx, ebx
je 0x4082c8
mov eax, dword [ebx]
dec eax
push eax
push dword [ebx + 8]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebx + 4], eax
test eax, eax
jbe 0x4082c8
push dword [esi + 8]
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
cmp eax, 0x104
ja 0x4082c8
test eax, eax
je 0x4082c8
push dword [edi + 8]
push 0
push 0x40d8e8
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x4082c8
mov ecx, dword [edi + 8]
call fcn.004033ad
mov dword [edi + 4], eax
test eax, eax
jbe 0x4082c8
push 0
push ecx
push dword [ebx + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0
push dword [ebx + 8]
call fcn.0040222e
pop ecx
pop ecx
test eax, eax
je 0x4082c8
mov ecx, esi
call fcn.00402e9d
xor ebx, ebx
push 0x40d83c
inc ebx
mov eax, esi
call fcn.00402fdf
mov eax, esi
call fcn.00402f65
mov dword [esp], 0x40d8ec
push 2
pop ebx
mov eax, esi
call fcn.00402fdf
mov dword [esp], str._DAF8C715436E44649F1312698287E6A5
push 0x22
pop ebx
mov eax, esi
call fcn.00402fdf
mov edi, dword [ebp - 4]
mov eax, esi
call fcn.00402f65
push 0x44
pop edx
push edx
lea eax, [ebp - 0x58]
call fcn.00401ecc
push 0x10
lea eax, [ebp - 0x14]
mov dword [ebp - 0x58], edx
call fcn.00401ecc
add esp, 0xc
push eax
lea eax, [ebp - 0x58]
push eax
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push dword [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x408314
Capabilities:
Accept command line arguments
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x16c
mov eax, dword [0x40f004]
xor eax, esp
mov dword [esp + 0x168], eax
push ebx
push esi
push edi
call sub.KERNEL32.dll_GetCommandLineA
mov ecx, eax
test ecx, ecx
je 0x40844c
call fcn.004033ad
push eax
lea eax, [esp + 0x24]
call fcn.00402e70
mov esi, eax
lea edi, [esp + 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x18]
push eax
mov ecx, str._DAF8C715436E44649F1312698287E6A5
movsd dword es:[edi], dword [esi]
call fcn.00408461
mov esi, eax
pop ecx
pop ecx
mov dword [esp + 0xc], 0x14
test esi, esi
je 0x408419
and dword [esp + 0x10], 0
mov edi, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea eax, [esp + 0x30]
push eax
push dword [esi + 8]
call edi
cmp dword [esp + 0xc], 1
mov ebx, eax
jle 0x4083bc
cmp ebx, 0xffffffff
je 0x4083bc
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4083bc
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
dec dword [esp + 0xc]
jmp 0x4083c4
mov dword [esp + 0x10], 1
cmp ebx, 0xffffffff
je 0x4083d0
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [esp + 0x10], 0
je 0x408386
push str..._
push 4
pop ebx
mov eax, esi
call fcn.00402fdf
mov dword [esp], str.zopener_8a4800ea0a3f43f4bafd7706c1a4e7ee.log
push 0x2c
pop ebx
mov eax, esi
call fcn.00402fdf
pop ecx
lea eax, [esp + 0x30]
push eax
push dword [esi + 8]
call edi
mov edi, eax
cmp edi, 0xffffffff
je 0x408419
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, 0x400
call fcn.00402d91
mov esi, eax
test esi, esi
je 0x40844c
mov eax, dword [esi]
dec eax
push eax
push dword [esi + 8]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [esi + 4], eax
test eax, eax
jbe 0x40844c
push 4
push 0
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov ecx, dword [esp + 0x174]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00402440
mov esp, ebp
pop ebp
ret
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x47c008], 0x8088405
inc edx
mov dword [ebx + 0x47c008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cb9c
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cbcd
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cbb5
add dl, dl
jne 0x41cbd8
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cc29
xor eax, eax
add dl, dl
jne 0x41cbe5
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41ccc6
add dl, dl
jne 0x41cbf4
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cbff
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cc0a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cc15
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cc1f
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cbc4
mov eax, 1
add dl, dl
jne 0x41cc37
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cc42
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cc2e
sub eax, ebx
mov ebx, 1
jne 0x41cc75
mov ecx, 1
add dl, dl
jne 0x41cc5b
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cc66
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cc52
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cbc4
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41cc8c
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cc97
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cc83
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cbc4
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41cce7
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cbc4
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret